From: Sasha Levin Date: Fri, 27 Feb 2026 02:48:04 +0000 (-0500) Subject: Fixes for all trees X-Git-Tag: v6.18.15~5 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0f625682d2b28bce8c6ee2f6ea98a964996a1cca;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for all trees Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/acpica-abort-aml-bytecode-execution-when-executing-a.patch b/queue-5.10/acpica-abort-aml-bytecode-execution-when-executing-a.patch new file mode 100644 index 00000000000..9be51eac18f --- /dev/null +++ b/queue-5.10/acpica-abort-aml-bytecode-execution-when-executing-a.patch @@ -0,0 +1,129 @@ +From 7ba75db79ce55a075f0741ff01b605a7ad49b258 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 13:25:33 +0100 +Subject: ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP + +From: Armin Wolf + +[ Upstream commit 026ad376a6a48538b576f3589331daa94daae6f0 ] + +The ACPI specification states that when executing AML_FATAL_OP, +the OS should log the fatal error event and shutdown in a timely +fashion. + +Windows complies with this requirement by immediatly entering a +Bso_d, effectively aborting the execution of the AML bytecode in +question. + +ACPICA however might continue with the AML bytecode execution +should acpi_os_signal() simply return AE_OK. This will cause issues +because ACPI BIOS implementations might assume that the Fatal() +operator does not return. + +Fix this by aborting the AML bytecode execution in such a case +by returning AE_ERROR. Also turn struct acpi_signal_fatal_info into a +local variable because of its small size (12 bytes) and to ensure +that acpi_os_signal() always receives valid information about the +fatal ACPI BIOS error. + +Link: https://github.com/acpica/acpica/commit/d516c7758ba6 +Signed-off-by: Armin Wolf +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/3325491.5fSG56mABF@rafael.j.wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/exoparg3.c | 46 +++++++++++++--------------------- + 1 file changed, 18 insertions(+), 28 deletions(-) + +diff --git a/drivers/acpi/acpica/exoparg3.c b/drivers/acpi/acpica/exoparg3.c +index c8d0d75fc4505..962929d4abbfc 100644 +--- a/drivers/acpi/acpica/exoparg3.c ++++ b/drivers/acpi/acpica/exoparg3.c +@@ -10,6 +10,7 @@ + #include + #include "accommon.h" + #include "acinterp.h" ++#include + #include "acparser.h" + #include "amlcode.h" + +@@ -51,8 +52,7 @@ ACPI_MODULE_NAME("exoparg3") + acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state) + { + union acpi_operand_object **operand = &walk_state->operands[0]; +- struct acpi_signal_fatal_info *fatal; +- acpi_status status = AE_OK; ++ struct acpi_signal_fatal_info fatal; + + ACPI_FUNCTION_TRACE_STR(ex_opcode_3A_0T_0R, + acpi_ps_get_opcode_name(walk_state->opcode)); +@@ -60,28 +60,23 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state) + switch (walk_state->opcode) { + case AML_FATAL_OP: /* Fatal (fatal_type fatal_code fatal_arg) */ + +- ACPI_DEBUG_PRINT((ACPI_DB_INFO, +- "FatalOp: Type %X Code %X Arg %X " +- "<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n", +- (u32)operand[0]->integer.value, +- (u32)operand[1]->integer.value, +- (u32)operand[2]->integer.value)); +- +- fatal = ACPI_ALLOCATE(sizeof(struct acpi_signal_fatal_info)); +- if (fatal) { +- fatal->type = (u32) operand[0]->integer.value; +- fatal->code = (u32) operand[1]->integer.value; +- fatal->argument = (u32) operand[2]->integer.value; +- } ++ fatal.type = (u32)operand[0]->integer.value; ++ fatal.code = (u32)operand[1]->integer.value; ++ fatal.argument = (u32)operand[2]->integer.value; + +- /* Always signal the OS! */ ++ ACPI_BIOS_ERROR((AE_INFO, ++ "Fatal ACPI BIOS error (Type 0x%X Code 0x%X Arg 0x%X)\n", ++ fatal.type, fatal.code, fatal.argument)); + +- status = acpi_os_signal(ACPI_SIGNAL_FATAL, fatal); ++ /* Always signal the OS! */ + +- /* Might return while OS is shutting down, just continue */ ++ acpi_os_signal(ACPI_SIGNAL_FATAL, &fatal); + +- ACPI_FREE(fatal); +- goto cleanup; ++ /* ++ * Might return while OS is shutting down, so abort the AML execution ++ * by returning an error. ++ */ ++ return_ACPI_STATUS(AE_ERROR); + + case AML_EXTERNAL_OP: + /* +@@ -93,21 +88,16 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state) + * wrong if an external opcode ever gets here. + */ + ACPI_ERROR((AE_INFO, "Executed External Op")); +- status = AE_OK; +- goto cleanup; ++ ++ return_ACPI_STATUS(AE_OK); + + default: + + ACPI_ERROR((AE_INFO, "Unknown AML opcode 0x%X", + walk_state->opcode)); + +- status = AE_AML_BAD_OPCODE; +- goto cleanup; ++ return_ACPI_STATUS(AE_AML_BAD_OPCODE); + } +- +-cleanup: +- +- return_ACPI_STATUS(status); + } + + /******************************************************************************* +-- +2.51.0 + diff --git a/queue-5.10/apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch b/queue-5.10/apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch new file mode 100644 index 00000000000..9113fac4dfb --- /dev/null +++ b/queue-5.10/apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch @@ -0,0 +1,137 @@ +From 48873f584fa5d9d56ca6dee1f3cadf2ec0e1bb3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:35:05 +0100 +Subject: APEI/GHES: ensure that won't go past CPER allocated record + +From: Mauro Carvalho Chehab + +[ Upstream commit fa2408a24f8f0db14d9cfc613ef162dc267d7ad4 ] + +The logic at ghes_new() prevents allocating too large records, by +checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB). +Yet, the allocation is done with the actual number of pages from the +CPER bios table location, which can be smaller. + +Yet, a bad firmware could send data with a different size, which might +be bigger than the allocated memory, causing an OOPS: + + Unable to handle kernel paging request at virtual address fff00000f9b40000 + Mem abort info: + ESR = 0x0000000096000007 + EC = 0x25: DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 + FSC = 0x07: level 3 translation fault + Data abort info: + ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 + CM = 0, WnR = 0, TnD = 0, TagAccess = 0 + GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 + swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000 + [fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000 + Internal error: Oops: 0000000096000007 [#1] SMP + Modules linked in: + CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT + Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022 + Workqueue: kacpi_notify acpi_os_execute_deferred + pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) + pc : hex_dump_to_buffer+0x30c/0x4a0 + lr : hex_dump_to_buffer+0x328/0x4a0 + sp : ffff800080e13880 + x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083 + x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004 + x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083 + x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010 + x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020 + x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008 + x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000 + x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020 + x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000 + x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008 + Call trace: + hex_dump_to_buffer+0x30c/0x4a0 (P) + print_hex_dump+0xac/0x170 + cper_estatus_print_section+0x90c/0x968 + cper_estatus_print+0xf0/0x158 + __ghes_print_estatus+0xa0/0x148 + ghes_proc+0x1bc/0x220 + ghes_notify_hed+0x5c/0xb8 + notifier_call_chain+0x78/0x148 + blocking_notifier_call_chain+0x4c/0x80 + acpi_hed_notify+0x28/0x40 + acpi_ev_notify_dispatch+0x50/0x80 + acpi_os_execute_deferred+0x24/0x48 + process_one_work+0x15c/0x3b0 + worker_thread+0x2d0/0x400 + kthread+0x148/0x228 + ret_from_fork+0x10/0x20 + Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44) + ---[ end trace 0000000000000000 ]--- + +Prevent that by taking the actual allocated are into account when +checking for CPER length. + +Signed-off-by: Mauro Carvalho Chehab +Reviewed-by: Jonathan Cameron +Acked-by: Ard Biesheuvel +Reviewed-by: Hanjun Guo +[ rjw: Subject tweaks ] +Link: https://patch.msgid.link/4e70310a816577fabf37d94ed36cde4ad62b1e0a.1767871950.git.mchehab+huawei@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/apei/ghes.c | 6 +++++- + include/acpi/ghes.h | 1 + + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c +index bdb23ca251e23..28651f9e6d60f 100644 +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -262,6 +263,7 @@ static struct ghes *ghes_new(struct acpi_hest_generic *generic) + error_block_length = GHES_ESTATUS_MAX_SIZE; + } + ghes->estatus = kmalloc(error_block_length, GFP_KERNEL); ++ ghes->estatus_length = error_block_length; + if (!ghes->estatus) { + rc = -ENOMEM; + goto err_unmap_status_addr; +@@ -333,13 +335,15 @@ static int __ghes_check_estatus(struct ghes *ghes, + struct acpi_hest_generic_status *estatus) + { + u32 len = cper_estatus_len(estatus); ++ u32 max_len = min(ghes->generic->error_block_length, ++ ghes->estatus_length); + + if (len < sizeof(*estatus)) { + pr_warn_ratelimited(FW_WARN GHES_PFX "Truncated error status block!\n"); + return -EIO; + } + +- if (len > ghes->generic->error_block_length) { ++ if (!len || len > max_len) { + pr_warn_ratelimited(FW_WARN GHES_PFX "Invalid error status block length!\n"); + return -EIO; + } +diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h +index 292a5c40bd0c6..259ae345849f0 100644 +--- a/include/acpi/ghes.h ++++ b/include/acpi/ghes.h +@@ -21,6 +21,7 @@ struct ghes { + struct acpi_hest_generic_v2 *generic_v2; + }; + struct acpi_hest_generic_status *estatus; ++ unsigned int estatus_length; + unsigned long flags; + union { + struct list_head list; +-- +2.51.0 + diff --git a/queue-5.10/arm-9467-1-mm-don-t-use-pk-through-printk.patch b/queue-5.10/arm-9467-1-mm-don-t-use-pk-through-printk.patch new file mode 100644 index 00000000000..3918aa26cc1 --- /dev/null +++ b/queue-5.10/arm-9467-1-mm-don-t-use-pk-through-printk.patch @@ -0,0 +1,42 @@ +From 359cf09f70da4d0bfb61d8d2eb538b81541b850c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 10:56:33 +0100 +Subject: ARM: 9467/1: mm: Don't use %pK through printk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weissschuh + +[ Upstream commit 012ea376a5948b025f260aa45d2a6ec5d96674ea ] + +Restricted pointers ("%pK") were never meant to be used +through printk(). They can acquire sleeping locks in atomic contexts. + +Switch to %px over the more secure %p as this usage is a debugging aid, +gated behind CONFIG_DEBUG_VIRTUAL and used by WARN(). + +Link: https://lore.kernel.org/lkml/20250113171731-dc10e3c1-da64-4af0-b767-7c7070468023@linutronix.de/ +Signed-off-by: Thomas Weißschuh +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/mm/physaddr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/mm/physaddr.c b/arch/arm/mm/physaddr.c +index cf75819e4c137..4ae327bf7aa29 100644 +--- a/arch/arm/mm/physaddr.c ++++ b/arch/arm/mm/physaddr.c +@@ -38,7 +38,7 @@ static inline bool __virt_addr_valid(unsigned long x) + phys_addr_t __virt_to_phys(unsigned long x) + { + WARN(!__virt_addr_valid(x), +- "virt_to_phys used for non-linear address: %pK (%pS)\n", ++ "virt_to_phys used for non-linear address: %px (%pS)\n", + (void *)x, (void *)x); + + return __virt_to_phys_nodebug(x); +-- +2.51.0 + diff --git a/queue-5.10/arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch b/queue-5.10/arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch new file mode 100644 index 00000000000..652fcfe1549 --- /dev/null +++ b/queue-5.10/arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch @@ -0,0 +1,37 @@ +From b2bcb49694adbfd2d205e834059814901422b4fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Dec 2025 17:24:48 +0800 +Subject: arm64: Add support for TSV110 Spectre-BHB mitigation + +From: Jinqian Yang + +[ Upstream commit e3baa5d4b361276efeb87b20d8beced451a7dbd5 ] + +The TSV110 processor is vulnerable to the Spectre-BHB (Branch History +Buffer) attack, which can be exploited to leak information through +branch prediction side channels. This commit adds the MIDR of TSV110 +to the list for software mitigation. + +Signed-off-by: Jinqian Yang +Reviewed-by: Zenghui Yu +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/proton-pack.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c +index 2773bf189a3f1..94db6dcc5c8a2 100644 +--- a/arch/arm64/kernel/proton-pack.c ++++ b/arch/arm64/kernel/proton-pack.c +@@ -904,6 +904,7 @@ static u8 spectre_bhb_loop_affected(void) + MIDR_ALL_VERSIONS(MIDR_CORTEX_X2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), ++ MIDR_ALL_VERSIONS(MIDR_HISI_TSV110), + {}, + }; + static const struct midr_range spectre_bhb_k24_list[] = { +-- +2.51.0 + diff --git a/queue-5.10/arm64-tegra-smaug-add-usb-role-switch-support.patch b/queue-5.10/arm64-tegra-smaug-add-usb-role-switch-support.patch new file mode 100644 index 00000000000..aefff05f355 --- /dev/null +++ b/queue-5.10/arm64-tegra-smaug-add-usb-role-switch-support.patch @@ -0,0 +1,37 @@ +From 8abd89dec7755f6aa2e73ebc5024bdc7546c5215 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Dec 2025 21:27:21 +0000 +Subject: arm64: tegra: smaug: Add usb-role-switch support + +From: Diogo Ivo + +[ Upstream commit dfa93788dd8b2f9c59adf45ecf592082b1847b7b ] + +The USB2 port on Smaug is configured for OTG operation but lacked the +required 'usb-role-switch' property, leading to a failed probe and a +non-functioning USB port. Add the property along with setting the default +role to host. + +Signed-off-by: Diogo Ivo +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/nvidia/tegra210-smaug.dts | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts +index bd78378248a68..0c2cf358dcc35 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts ++++ b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts +@@ -1687,6 +1687,8 @@ usb2-0 { + status = "okay"; + vbus-supply = <&usbc_vbus>; + mode = "otg"; ++ usb-role-switch; ++ role-switch-default-mode = "host"; + }; + + usb3-0 { +-- +2.51.0 + diff --git a/queue-5.10/asoc-es8328-add-error-unwind-in-resume.patch b/queue-5.10/asoc-es8328-add-error-unwind-in-resume.patch new file mode 100644 index 00000000000..25f4593c89c --- /dev/null +++ b/queue-5.10/asoc-es8328-add-error-unwind-in-resume.patch @@ -0,0 +1,57 @@ +From eac3359fde76bdc0a653715fe59a574f1cfc342f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Jan 2026 00:00:17 +0800 +Subject: ASoC: es8328: Add error unwind in resume + +From: Hsieh Hung-En + +[ Upstream commit 8232e6079ae6f8d3a61d87973cb427385aa469b9 ] + +Handle failures in the resume path by unwinding previously enabled +resources. + +If enabling regulators or syncing the regcache fails, disable regulators +and unprepare the clock to avoid leaking resources and leaving the device +in a partially resumed state. + +Signed-off-by: Hsieh Hung-En +Link: https://patch.msgid.link/20260130160017.2630-6-hungen3108@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/es8328.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c +index 60ad9f3683fe9..b169af20cd61c 100644 +--- a/sound/soc/codecs/es8328.c ++++ b/sound/soc/codecs/es8328.c +@@ -750,17 +750,23 @@ static int es8328_resume(struct snd_soc_component *component) + es8328->supplies); + if (ret) { + dev_err(component->dev, "unable to enable regulators\n"); +- return ret; ++ goto err_clk; + } + + regcache_mark_dirty(regmap); + ret = regcache_sync(regmap); + if (ret) { + dev_err(component->dev, "unable to sync regcache\n"); +- return ret; ++ goto err_regulators; + } + + return 0; ++ ++err_regulators: ++ regulator_bulk_disable(ARRAY_SIZE(es8328->supplies), es8328->supplies); ++err_clk: ++ clk_disable_unprepare(es8328->clk); ++ return ret; + } + + static int es8328_component_probe(struct snd_soc_component *component) +-- +2.51.0 + diff --git a/queue-5.10/asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch b/queue-5.10/asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch new file mode 100644 index 00000000000..fe3fa2f1e7a --- /dev/null +++ b/queue-5.10/asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch @@ -0,0 +1,36 @@ +From 6705a07e69d5f66d42cc70f9cd0f83db37f4ccbf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 04:02:08 +0100 +Subject: ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask + +From: Sebastian Krzyszkowiak + +[ Upstream commit 66c26346ae30c883eef70acf9cf9054dfdb4fb2f ] + +This bit is handled by a separate control. + +Signed-off-by: Sebastian Krzyszkowiak +Reviewed-by: Charles Keepax +Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-1-f4f4eeacf089@puri.sm +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index 272932e200d87..ec214b06f5648 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -1759,7 +1759,7 @@ SND_SOC_BYTES("EQR Coefficients", WM8962_EQ24, 18), + + + SOC_SINGLE("3D Switch", WM8962_THREED1, 0, 1, 0), +-SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA), ++SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA | WM8962_ADC_MONOMIX), + + SOC_SINGLE("DF1 Switch", WM8962_DF1, 0, 1, 0), + SND_SOC_BYTES_MASK("DF1 Coefficients", WM8962_DF1, 7, WM8962_DF1_ENA), +-- +2.51.0 + diff --git a/queue-5.10/asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch b/queue-5.10/asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch new file mode 100644 index 00000000000..a2e3bd75020 --- /dev/null +++ b/queue-5.10/asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch @@ -0,0 +1,58 @@ +From 15f54890982f9706c22e560ae89b31c9c2bb8e16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 04:02:10 +0100 +Subject: ASoC: wm8962: Don't report a microphone if it's shorted to ground on + plug + +From: Sebastian Krzyszkowiak + +[ Upstream commit e590752119029d87ce46d725e11245a52d22e1fe ] + +This usually means that a TRS plug with no microphone pin has been plugged +into a TRRS socket. Cases where a user is plugging in a microphone while +pressing a button will be handled via incoming interrupt after the user +releases the button, so the microphone will still be detected once it +becomes usable. + +Signed-off-by: Sebastian Krzyszkowiak +Reviewed-by: Charles Keepax +Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-3-f4f4eeacf089@puri.sm +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index ec214b06f5648..24e6d731942c5 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -67,6 +67,8 @@ struct wm8962_priv { + struct mutex dsp2_ena_lock; + u16 dsp2_ena; + ++ int mic_status; ++ + struct delayed_work mic_work; + struct snd_soc_jack *jack; + +@@ -3058,8 +3060,16 @@ static void wm8962_mic_work(struct work_struct *work) + if (reg & WM8962_MICSHORT_STS) { + status |= SND_JACK_BTN_0; + irq_pol |= WM8962_MICSCD_IRQ_POL; ++ ++ /* Don't report a microphone if it's shorted right after ++ * plugging in, as this may be a TRS plug in a TRRS socket. ++ */ ++ if (!(wm8962->mic_status & WM8962_MICDET_STS)) ++ status = 0; + } + ++ wm8962->mic_status = status; ++ + snd_soc_jack_report(wm8962->jack, status, + SND_JACK_MICROPHONE | SND_JACK_BTN_0); + +-- +2.51.0 + diff --git a/queue-5.10/audit-add-fchmodat2-to-change-attributes-class.patch b/queue-5.10/audit-add-fchmodat2-to-change-attributes-class.patch new file mode 100644 index 00000000000..0060c5b8156 --- /dev/null +++ b/queue-5.10/audit-add-fchmodat2-to-change-attributes-class.patch @@ -0,0 +1,42 @@ +From 75437aef2b2080ffae39ad81892d9af001fc15bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 20:49:30 +0100 +Subject: audit: add fchmodat2() to change attributes class + +From: Jeffrey Bencteux + +[ Upstream commit 4f493a6079b588cf1f04ce5ed6cdad45ab0d53dc ] + +fchmodat2(), introduced in version 6.6 is currently not in the change +attribute class of audit. Calling fchmodat2() to change a file +attribute in the same fashion than chmod() or fchmodat() will bypass +audit rules such as: + +-w /tmp/test -p rwa -k test_rwa + +The current patch adds fchmodat2() to the change attributes class. + +Signed-off-by: Jeffrey Bencteux +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + include/asm-generic/audit_change_attr.h | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/include/asm-generic/audit_change_attr.h b/include/asm-generic/audit_change_attr.h +index 331670807cf01..6c311d4d37f4e 100644 +--- a/include/asm-generic/audit_change_attr.h ++++ b/include/asm-generic/audit_change_attr.h +@@ -20,6 +20,9 @@ __NR_fremovexattr, + __NR_fchownat, + __NR_fchmodat, + #endif ++#ifdef __NR_fchmodat2 ++__NR_fchmodat2, ++#endif + #ifdef __NR_chown32 + __NR_chown32, + __NR_fchown32, +-- +2.51.0 + diff --git a/queue-5.10/audit-add-missing-syscalls-to-read-class.patch b/queue-5.10/audit-add-missing-syscalls-to-read-class.patch new file mode 100644 index 00000000000..611bb9a8ae1 --- /dev/null +++ b/queue-5.10/audit-add-missing-syscalls-to-read-class.patch @@ -0,0 +1,47 @@ +From 0292a3aa978968ede70a2ce5ed5086fca81dcfbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Dec 2025 09:39:24 +0100 +Subject: audit: add missing syscalls to read class + +From: Jeffrey Bencteux + +[ Upstream commit bcb90a2834c7393c26df9609b889a3097b7700cd ] + +The "at" variant of getxattr() and listxattr() are missing from the +audit read class. Calling getxattrat() or listxattrat() on a file to +read its extended attributes will bypass audit rules such as: + +-w /tmp/test -p rwa -k test_rwa + +The current patch adds missing syscalls to the audit read class. + +Signed-off-by: Jeffrey Bencteux +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + include/asm-generic/audit_read.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/include/asm-generic/audit_read.h b/include/asm-generic/audit_read.h +index 7bb7b5a83ae2e..fb9991f53fb6f 100644 +--- a/include/asm-generic/audit_read.h ++++ b/include/asm-generic/audit_read.h +@@ -4,9 +4,15 @@ __NR_readlink, + #endif + __NR_quotactl, + __NR_listxattr, ++#ifdef __NR_listxattrat ++__NR_listxattrat, ++#endif + __NR_llistxattr, + __NR_flistxattr, + __NR_getxattr, ++#ifdef __NR_getxattrat ++__NR_getxattrat, ++#endif + __NR_lgetxattr, + __NR_fgetxattr, + #ifdef __NR_readlinkat +-- +2.51.0 + diff --git a/queue-5.10/binder-don-t-use-pk-through-printk.patch b/queue-5.10/binder-don-t-use-pk-through-printk.patch new file mode 100644 index 00000000000..c971a6e461e --- /dev/null +++ b/queue-5.10/binder-don-t-use-pk-through-printk.patch @@ -0,0 +1,83 @@ +From 011794bbd615a622fa9fa4733f76641c18c2be7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 15:29:50 +0100 +Subject: binder: don't use %pK through printk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 56d21267663bad91e8b10121224ec46366a7937e ] + +In the past %pK was preferable to %p as it would not leak raw pointer +values into the kernel log. Since commit ad67b74d2469 ("printk: hash +addresses printed with %p") the regular %p has been improved to avoid +this issue. Furthermore, restricted pointers ("%pK") were never meant +to be used through printk(). They can still unintentionally leak raw +pointers or acquire sleeping locks in atomic contexts. + +Switch to the regular pointer formatting which is safer and +easier to reason about. + +There are still a few users of %pK left, but these use it through +seq_file, for which its usage is safe. + +Signed-off-by: Thomas Weißschuh +Acked-by: Carlos Llamas +Reviewed-by: Alice Ryhl +Link: https://patch.msgid.link/20260107-restricted-pointers-binder-v1-1-181018bf3812@linutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/android/binder.c | 2 +- + drivers/android/binder_alloc.c | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/android/binder.c b/drivers/android/binder.c +index f75bbe7a4273c..9577193e72e64 100644 +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -4355,7 +4355,7 @@ static int binder_thread_write(struct binder_proc *proc, + } + } + binder_debug(BINDER_DEBUG_DEAD_BINDER, +- "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n", ++ "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n", + proc->pid, thread->pid, (u64)cookie, + death); + if (death == NULL) { +diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c +index b655bc3956c79..bacccfd0fb74c 100644 +--- a/drivers/android/binder_alloc.c ++++ b/drivers/android/binder_alloc.c +@@ -79,7 +79,7 @@ static void binder_insert_free_buffer(struct binder_alloc *alloc, + new_buffer_size = binder_alloc_buffer_size(alloc, new_buffer); + + binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC, +- "%d: add free buffer, size %zd, at %pK\n", ++ "%d: add free buffer, size %zd, at %p\n", + alloc->pid, new_buffer_size, new_buffer); + + while (*p) { +@@ -482,7 +482,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked( + } + + binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC, +- "%d: binder_alloc_buf size %zd got buffer %pK size %zd\n", ++ "%d: binder_alloc_buf size %zd got buffer %p size %zd\n", + alloc->pid, size, buffer, buffer_size); + + has_page_addr = (void __user *) +@@ -651,7 +651,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc, + ALIGN(buffer->extra_buffers_size, sizeof(void *)); + + binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC, +- "%d: binder_free_buf %pK size %zd buffer_size %zd\n", ++ "%d: binder_free_buf %p size %zd buffer_size %zd\n", + alloc->pid, buffer, size, buffer_size); + + BUG_ON(buffer->free); +-- +2.51.0 + diff --git a/queue-5.10/blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch b/queue-5.10/blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch new file mode 100644 index 00000000000..084073153f5 --- /dev/null +++ b/queue-5.10/blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch @@ -0,0 +1,42 @@ +From aa9b3ef112ae61e50c3754a5d9890cf2d356a7d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 16:05:22 +0800 +Subject: blk-mq-debugfs: add missing debugfs_mutex in + blk_mq_debugfs_register_hctxs() + +From: Yu Kuai + +[ Upstream commit 9d20fd6ce1ba9733cd5ac96fcab32faa9fc404dd ] + +In blk_mq_update_nr_hw_queues(), debugfs_mutex is not held while +creating debugfs entries for hctxs. Hence add debugfs_mutex there, +it's safe because queue is not frozen. + +Signed-off-by: Yu Kuai +Reviewed-by: Nilay Shroff +Reviewed-by: Ming Lei +Reviewed-by: Hannes Reinecke +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-debugfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c +index 212e1e7954696..4179b9ccfa9e8 100644 +--- a/block/blk-mq-debugfs.c ++++ b/block/blk-mq-debugfs.c +@@ -905,8 +905,10 @@ void blk_mq_debugfs_register_hctxs(struct request_queue *q) + struct blk_mq_hw_ctx *hctx; + int i; + ++ mutex_lock(&q->debugfs_mutex); + queue_for_each_hw_ctx(q, hctx, i) + blk_mq_debugfs_register_hctx(q, hctx); ++ mutex_unlock(&q->debugfs_mutex); + } + + void blk_mq_debugfs_unregister_hctxs(struct request_queue *q) +-- +2.51.0 + diff --git a/queue-5.10/bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch b/queue-5.10/bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch new file mode 100644 index 00000000000..9f7c44eb5f5 --- /dev/null +++ b/queue-5.10/bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch @@ -0,0 +1,37 @@ +From 768df0cddc9e00b0fae300992456b137b72a39a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 10:13:04 +0100 +Subject: Bluetooth: btusb: Add device ID for Realtek RTL8761BU + +From: Jacopo Scannella + +[ Upstream commit cc6383d4f0cf6127c0552f94cae517a06ccc6b17 ] + +Add USB device ID 0x2c0a:0x8761 to the btusb driver fo the Realtek +RTL8761BU Bluetooth adapter. + +Reference: +https://www.startech.com/en-us/networking-io/av53c1-usb-bluetooth + +Signed-off-by: Jacopo Scannella +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index c5e4f675270c2..3010044f0810b 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -475,6 +475,7 @@ static const struct usb_device_id blacklist_table[] = { + + /* Additional Realtek 8723BU Bluetooth devices */ + { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK }, ++ { USB_DEVICE(0x2c0a, 0x8761), .driver_info = BTUSB_REALTEK }, + + /* Additional Realtek 8723DE Bluetooth devices */ + { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK }, +-- +2.51.0 + diff --git a/queue-5.10/bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch b/queue-5.10/bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch new file mode 100644 index 00000000000..d6b89d0fe8b --- /dev/null +++ b/queue-5.10/bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch @@ -0,0 +1,46 @@ +From b56f646246c444fb493bd5bfedb66ee853c2a0f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 10:20:09 +0100 +Subject: Bluetooth: hci_conn: use mod_delayed_work for active mode timeout +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stefan Sørensen + +[ Upstream commit 49d0901e260739de2fcc90c0c29f9e31e39a2d9b ] + +hci_conn_enter_active_mode() uses queue_delayed_work() with the +intention that the work will run after the given timeout. However, +queue_delayed_work() does nothing if the work is already queued, so +depending on the link policy we may end up putting the connection +into idle mode every hdev->idle_timeout ms. + +Use mod_delayed_work() instead so the work is queued if not already +queued, and the timeout is updated otherwise. + +Signed-off-by: Stefan Sørensen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_conn.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 52e512f41da3c..eb70a4f44c7d1 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -1553,8 +1553,8 @@ void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active) + + timer: + if (hdev->idle_timeout > 0) +- queue_delayed_work(hdev->workqueue, &conn->idle_work, +- msecs_to_jiffies(hdev->idle_timeout)); ++ mod_delayed_work(hdev->workqueue, &conn->idle_work, ++ msecs_to_jiffies(hdev->idle_timeout)); + } + + /* Drop all connection on the device */ +-- +2.51.0 + diff --git a/queue-5.10/bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch b/queue-5.10/bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch new file mode 100644 index 00000000000..21a9a08dcec --- /dev/null +++ b/queue-5.10/bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch @@ -0,0 +1,72 @@ +From b03b2f64602e2c37a1609ce81f45ac12e5d77b5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 18:02:19 +0000 +Subject: bpf: verifier improvement in 32bit shift sign extension pattern + +From: Cupertino Miranda + +[ Upstream commit d18dec4b8990048ce75f0ece32bb96b3fbd3f422 ] + +This patch improves the verifier to correctly compute bounds for +sign extension compiler pattern composed of left shift by 32bits +followed by a sign right shift by 32bits. Pattern in the verifier was +limitted to positive value bounds and would reset bound computation for +negative values. New code allows both positive and negative values for +sign extension without compromising bound computation and verifier to +pass. + +This change is required by GCC which generate such pattern, and was +detected in the context of systemd, as described in the following GCC +bugzilla: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119731 + +Three new tests were added in verifier_subreg.c. + +Signed-off-by: Cupertino Miranda +Signed-off-by: Andrew Pinski +Acked-by: Eduard Zingerman +Cc: David Faust +Cc: Jose Marchesi +Cc: Elena Zannoni +Link: https://lore.kernel.org/r/20251202180220.11128-2-cupertino.miranda@oracle.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 18 +++++++----------- + 1 file changed, 7 insertions(+), 11 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 75251870430e4..150aa47b4a9ad 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -6870,21 +6870,17 @@ static void __scalar64_min_max_lsh(struct bpf_reg_state *dst_reg, + u64 umin_val, u64 umax_val) + { + /* Special case <<32 because it is a common compiler pattern to sign +- * extend subreg by doing <<32 s>>32. In this case if 32bit bounds are +- * positive we know this shift will also be positive so we can track +- * bounds correctly. Otherwise we lose all sign bit information except +- * what we can pick up from var_off. Perhaps we can generalize this +- * later to shifts of any length. ++ * extend subreg by doing <<32 s>>32. smin/smax assignments are correct ++ * because s32 bounds don't flip sign when shifting to the left by ++ * 32bits. + */ +- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_max_value >= 0) ++ if (umin_val == 32 && umax_val == 32) { + dst_reg->smax_value = (s64)dst_reg->s32_max_value << 32; +- else +- dst_reg->smax_value = S64_MAX; +- +- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_min_value >= 0) + dst_reg->smin_value = (s64)dst_reg->s32_min_value << 32; +- else ++ } else { ++ dst_reg->smax_value = S64_MAX; + dst_reg->smin_value = S64_MIN; ++ } + + /* If we might shift our top bit out, then we know nothing */ + if (dst_reg->umax_value > 1ULL << (63 - umax_val)) { +-- +2.51.0 + diff --git a/queue-5.10/clk-microchip-core-correct-return-value-on-_get_pare.patch b/queue-5.10/clk-microchip-core-correct-return-value-on-_get_pare.patch new file mode 100644 index 00000000000..0cda893f4e6 --- /dev/null +++ b/queue-5.10/clk-microchip-core-correct-return-value-on-_get_pare.patch @@ -0,0 +1,80 @@ +From 0cb7154a19d2dac7b70d58d757540e55ff2c02bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 14:46:28 -0500 +Subject: clk: microchip: core: correct return value on *_get_parent() + +From: Brian Masney + +[ Upstream commit 5df96d141cccb37f0c3112a22fc1112ea48e9246 ] + +roclk_get_parent() and sclk_get_parent() has the possibility of +returning -EINVAL, however the framework expects this call to always +succeed since the return value is unsigned. + +If there is no parent map defined, then the current value programmed in +the hardware is used. Let's use that same value in the case where +-EINVAL is currently returned. + +This index is only used by clk_core_get_parent_by_index(), and it +validates that it doesn't overflow the number of available parents. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202512050233.R9hAWsJN-lkp@intel.com/ +Signed-off-by: Brian Masney +Reviewed-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20251205-clk-microchip-fixes-v3-2-a02190705e47@redhat.com +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + drivers/clk/microchip/clk-core.c | 25 ++++++++++++------------- + 1 file changed, 12 insertions(+), 13 deletions(-) + +diff --git a/drivers/clk/microchip/clk-core.c b/drivers/clk/microchip/clk-core.c +index 1b4f023cdc8be..71fbaf8318f22 100644 +--- a/drivers/clk/microchip/clk-core.c ++++ b/drivers/clk/microchip/clk-core.c +@@ -281,14 +281,13 @@ static u8 roclk_get_parent(struct clk_hw *hw) + + v = (readl(refo->ctrl_reg) >> REFO_SEL_SHIFT) & REFO_SEL_MASK; + +- if (!refo->parent_map) +- return v; +- +- for (i = 0; i < clk_hw_get_num_parents(hw); i++) +- if (refo->parent_map[i] == v) +- return i; ++ if (refo->parent_map) { ++ for (i = 0; i < clk_hw_get_num_parents(hw); i++) ++ if (refo->parent_map[i] == v) ++ return i; ++ } + +- return -EINVAL; ++ return v; + } + + static unsigned long roclk_calc_rate(unsigned long parent_rate, +@@ -823,13 +822,13 @@ static u8 sclk_get_parent(struct clk_hw *hw) + + v = (readl(sclk->mux_reg) >> OSC_CUR_SHIFT) & OSC_CUR_MASK; + +- if (!sclk->parent_map) +- return v; ++ if (sclk->parent_map) { ++ for (i = 0; i < clk_hw_get_num_parents(hw); i++) ++ if (sclk->parent_map[i] == v) ++ return i; ++ } + +- for (i = 0; i < clk_hw_get_num_parents(hw); i++) +- if (sclk->parent_map[i] == v) +- return i; +- return -EINVAL; ++ return v; + } + + static int sclk_set_parent(struct clk_hw *hw, u8 index) +-- +2.51.0 + diff --git a/queue-5.10/clocksource-drivers-sh_tmu-always-leave-device-runni.patch b/queue-5.10/clocksource-drivers-sh_tmu-always-leave-device-runni.patch new file mode 100644 index 00000000000..3069e553e70 --- /dev/null +++ b/queue-5.10/clocksource-drivers-sh_tmu-always-leave-device-runni.patch @@ -0,0 +1,149 @@ +From 93fb1731d96d475771e342b33f28bdb7a472186b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 23:13:41 +0100 +Subject: clocksource/drivers/sh_tmu: Always leave device running after probe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Niklas Söderlund + +[ Upstream commit b1278972b08e480990e2789bdc6a7c918bc349be ] + +The TMU device can be used as both a clocksource and a clockevent +provider. The driver tries to be smart and power itself on and off, as +well as enabling and disabling its clock when it's not in operation. +This behavior is slightly altered if the TMU is used as an early +platform device in which case the device is left powered on after probe, +but the clock is still enabled and disabled at runtime. + +This has worked for a long time, but recent improvements in PREEMPT_RT +and PROVE_LOCKING have highlighted an issue. As the TMU registers itself +as a clockevent provider, clockevents_register_device(), it needs to use +raw spinlocks internally as this is the context of which the clockevent +framework interacts with the TMU driver. However in the context of +holding a raw spinlock the TMU driver can't really manage its power +state or clock with calls to pm_runtime_*() and clk_*() as these calls +end up in other platform drivers using regular spinlocks to control +power and clocks. + +This mix of spinlock contexts trips a lockdep warning. + + ============================= + [ BUG: Invalid wait context ] + 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 Not tainted + ----------------------------- + swapper/0/0 is trying to lock: + ffff000008c9e180 (&dev->power.lock){-...}-{3:3}, at: __pm_runtime_resume+0x38/0x88 + other info that might help us debug this: + context-{5:5} + 1 lock held by swapper/0/0: + ccree e6601000.crypto: ARM CryptoCell 630P Driver: HW version 0xAF400001/0xDCC63000, Driver version 5.0 + #0: ffff8000817ec298 + ccree e6601000.crypto: ARM ccree device initialized + (tick_broadcast_lock){-...}-{2:2}, at: __tick_broadcast_oneshot_control+0xa4/0x3a8 + stack backtrace: + CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 PREEMPT + Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT) + Call trace: + show_stack+0x14/0x1c (C) + dump_stack_lvl+0x6c/0x90 + dump_stack+0x14/0x1c + __lock_acquire+0x904/0x1584 + lock_acquire+0x220/0x34c + _raw_spin_lock_irqsave+0x58/0x80 + __pm_runtime_resume+0x38/0x88 + sh_tmu_clock_event_set_oneshot+0x84/0xd4 + clockevents_switch_state+0xfc/0x13c + tick_broadcast_set_event+0x30/0xa4 + __tick_broadcast_oneshot_control+0x1e0/0x3a8 + tick_broadcast_oneshot_control+0x30/0x40 + cpuidle_enter_state+0x40c/0x680 + cpuidle_enter+0x30/0x40 + do_idle+0x1f4/0x280 + cpu_startup_entry+0x34/0x40 + kernel_init+0x0/0x130 + do_one_initcall+0x0/0x230 + __primary_switched+0x88/0x90 + +For non-PREEMPT_RT builds this is not really an issue, but for +PREEMPT_RT builds where normal spinlocks can sleep this might be an +issue. Be cautious and always leave the power and clock running after +probe. + +Signed-off-by: Niklas Söderlund +Signed-off-by: Daniel Lezcano +Tested-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20251202221341.1856773-1-niklas.soderlund+renesas@ragnatech.se +Signed-off-by: Sasha Levin +--- + drivers/clocksource/sh_tmu.c | 18 ------------------ + 1 file changed, 18 deletions(-) + +diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c +index d41df9ba3725d..0e429d28cdd4f 100644 +--- a/drivers/clocksource/sh_tmu.c ++++ b/drivers/clocksource/sh_tmu.c +@@ -143,16 +143,6 @@ static void sh_tmu_start_stop_ch(struct sh_tmu_channel *ch, int start) + + static int __sh_tmu_enable(struct sh_tmu_channel *ch) + { +- int ret; +- +- /* enable clock */ +- ret = clk_enable(ch->tmu->clk); +- if (ret) { +- dev_err(&ch->tmu->pdev->dev, "ch%u: cannot enable clock\n", +- ch->index); +- return ret; +- } +- + /* make sure channel is disabled */ + sh_tmu_start_stop_ch(ch, 0); + +@@ -174,7 +164,6 @@ static int sh_tmu_enable(struct sh_tmu_channel *ch) + if (ch->enable_count++ > 0) + return 0; + +- pm_runtime_get_sync(&ch->tmu->pdev->dev); + dev_pm_syscore_device(&ch->tmu->pdev->dev, true); + + return __sh_tmu_enable(ch); +@@ -187,9 +176,6 @@ static void __sh_tmu_disable(struct sh_tmu_channel *ch) + + /* disable interrupts in TMU block */ + sh_tmu_write(ch, TCR, TCR_TPSC_CLK4); +- +- /* stop clock */ +- clk_disable(ch->tmu->clk); + } + + static void sh_tmu_disable(struct sh_tmu_channel *ch) +@@ -203,7 +189,6 @@ static void sh_tmu_disable(struct sh_tmu_channel *ch) + __sh_tmu_disable(ch); + + dev_pm_syscore_device(&ch->tmu->pdev->dev, false); +- pm_runtime_put(&ch->tmu->pdev->dev); + } + + static void sh_tmu_set_next(struct sh_tmu_channel *ch, unsigned long delta, +@@ -552,7 +537,6 @@ static int sh_tmu_setup(struct sh_tmu_device *tmu, struct platform_device *pdev) + goto err_clk_unprepare; + + tmu->rate = clk_get_rate(tmu->clk) / 4; +- clk_disable(tmu->clk); + + /* Map the memory resource. */ + ret = sh_tmu_map_memory(tmu); +@@ -626,8 +610,6 @@ static int sh_tmu_probe(struct platform_device *pdev) + out: + if (tmu->has_clockevent || tmu->has_clocksource) + pm_runtime_irq_safe(&pdev->dev); +- else +- pm_runtime_idle(&pdev->dev); + + return 0; + } +-- +2.51.0 + diff --git a/queue-5.10/clocksource-drivers-timer-integrator-ap-add-missing-.patch b/queue-5.10/clocksource-drivers-timer-integrator-ap-add-missing-.patch new file mode 100644 index 00000000000..9f9c120eeb8 --- /dev/null +++ b/queue-5.10/clocksource-drivers-timer-integrator-ap-add-missing-.patch @@ -0,0 +1,38 @@ +From 82c5487f266b2dabe16541bb37312b5816b300b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jan 2026 12:17:23 +0100 +Subject: clocksource/drivers/timer-integrator-ap: Add missing Kconfig + dependency on OF + +From: Bartosz Golaszewski + +[ Upstream commit 2246464821e2820572e6feefca2029f17629cc50 ] + +This driver accesses the of_aliases global variable declared in +linux/of.h and defined in drivers/base/of.c. It requires OF support or +will cause a link failure. Add the missing Kconfig dependency. + +Closes: https://lore.kernel.org/oe-kbuild-all/202601152233.og6LdeUo-lkp@intel.com/ +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Daniel Lezcano +Link: https://patch.msgid.link/20260116111723.10585-1-bartosz.golaszewski@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/clocksource/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig +index a0c6e88bebe08..6d46d44921a61 100644 +--- a/drivers/clocksource/Kconfig ++++ b/drivers/clocksource/Kconfig +@@ -240,6 +240,7 @@ config KEYSTONE_TIMER + + config INTEGRATOR_AP_TIMER + bool "Integrator-AP timer driver" if COMPILE_TEST ++ depends on OF + select CLKSRC_MMIO + help + Enables support for the Integrator-AP timer. +-- +2.51.0 + diff --git a/queue-5.10/dm-remove-fake-timeout-to-avoid-leak-request.patch b/queue-5.10/dm-remove-fake-timeout-to-avoid-leak-request.patch new file mode 100644 index 00000000000..35bdf811829 --- /dev/null +++ b/queue-5.10/dm-remove-fake-timeout-to-avoid-leak-request.patch @@ -0,0 +1,86 @@ +From 5b7a12aafedc04b545d0412b5c7e19ab6a10341d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Dec 2025 20:03:50 +0800 +Subject: dm: remove fake timeout to avoid leak request + +From: Ding Hui + +[ Upstream commit f3a9c95a15d2f4466acad5c68faeff79ca5e9f47 ] + +Since commit 15f73f5b3e59 ("blk-mq: move failure injection out of +blk_mq_complete_request"), drivers are responsible for calling +blk_should_fake_timeout() at appropriate code paths and opportunities. + +However, the dm driver does not implement its own timeout handler and +relies on the timeout handling of its slave devices. + +If an io-timeout-fail error is injected to a dm device, the request +will be leaked and never completed, causing tasks to hang indefinitely. + +Reproduce: +1. prepare dm which has iscsi slave device +2. inject io-timeout-fail to dm + echo 1 >/sys/class/block/dm-0/io-timeout-fail + echo 100 >/sys/kernel/debug/fail_io_timeout/probability + echo 10 >/sys/kernel/debug/fail_io_timeout/times +3. read/write dm +4. iscsiadm -m node -u + +Result: hang task like below +[ 862.243768] INFO: task kworker/u514:2:151 blocked for more than 122 seconds. +[ 862.244133] Tainted: G E 6.19.0-rc1+ #51 +[ 862.244337] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 862.244718] task:kworker/u514:2 state:D stack:0 pid:151 tgid:151 ppid:2 task_flags:0x4288060 flags:0x00080000 +[ 862.245024] Workqueue: iscsi_ctrl_3:1 __iscsi_unbind_session [scsi_transport_iscsi] +[ 862.245264] Call Trace: +[ 862.245587] +[ 862.245814] __schedule+0x810/0x15c0 +[ 862.246557] schedule+0x69/0x180 +[ 862.246760] blk_mq_freeze_queue_wait+0xde/0x120 +[ 862.247688] elevator_change+0x16d/0x460 +[ 862.247893] elevator_set_none+0x87/0xf0 +[ 862.248798] blk_unregister_queue+0x12e/0x2a0 +[ 862.248995] __del_gendisk+0x231/0x7e0 +[ 862.250143] del_gendisk+0x12f/0x1d0 +[ 862.250339] sd_remove+0x85/0x130 [sd_mod] +[ 862.250650] device_release_driver_internal+0x36d/0x530 +[ 862.250849] bus_remove_device+0x1dd/0x3f0 +[ 862.251042] device_del+0x38a/0x930 +[ 862.252095] __scsi_remove_device+0x293/0x360 +[ 862.252291] scsi_remove_target+0x486/0x760 +[ 862.252654] __iscsi_unbind_session+0x18a/0x3e0 [scsi_transport_iscsi] +[ 862.252886] process_one_work+0x633/0xe50 +[ 862.253101] worker_thread+0x6df/0xf10 +[ 862.253647] kthread+0x36d/0x720 +[ 862.254533] ret_from_fork+0x2a6/0x470 +[ 862.255852] ret_from_fork_asm+0x1a/0x30 +[ 862.256037] + +Remove the blk_should_fake_timeout() check from dm, as dm has no +native timeout handling and should not attempt to fake timeouts. + +Signed-off-by: Ding Hui +Reviewed-by: Christoph Hellwig +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + drivers/md/dm-rq.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c +index a6ea77432e34c..29a09452abc4a 100644 +--- a/drivers/md/dm-rq.c ++++ b/drivers/md/dm-rq.c +@@ -281,8 +281,7 @@ static void dm_complete_request(struct request *rq, blk_status_t error) + struct dm_rq_target_io *tio = tio_from_request(rq); + + tio->error = error; +- if (likely(!blk_should_fake_timeout(rq->q))) +- blk_mq_complete_request(rq); ++ blk_mq_complete_request(rq); + } + + /* +-- +2.51.0 + diff --git a/queue-5.10/drm-account-property-blob-allocations-to-memcg.patch b/queue-5.10/drm-account-property-blob-allocations-to-memcg.patch new file mode 100644 index 00000000000..68a0e473971 --- /dev/null +++ b/queue-5.10/drm-account-property-blob-allocations-to-memcg.patch @@ -0,0 +1,46 @@ +From 335329fb545e58abf534524faca01b206fe4bc42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 08:22:26 -0500 +Subject: drm: Account property blob allocations to memcg + +From: Xiao Kan <814091656@qq.com> + +[ Upstream commit 26b4309a3ab82a0697751cde52eb336c29c19035 ] + +DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized +property blobs backed by kernel memory. + +Currently, the blob data allocation is not accounted to the allocating +process's memory cgroup, allowing unprivileged users to trigger unbounded +kernel memory consumption and potentially cause system-wide OOM. + +Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory +is properly charged to the caller's memcg. This ensures existing cgroup +memory limits apply and prevents uncontrolled kernel memory growth without +introducing additional policy or per-file limits. + +Signed-off-by: Xiao Kan <814091656@qq.com> +Signed-off-by: Xiao Kan +Link: https://patch.msgid.link/tencent_D12AA2DEDE6F359E1AF59405242FB7A5FD05@qq.com +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_property.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c +index 6ee04803c3620..92ecda176c7bf 100644 +--- a/drivers/gpu/drm/drm_property.c ++++ b/drivers/gpu/drm/drm_property.c +@@ -564,7 +564,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length, + if (!length || length > INT_MAX - sizeof(struct drm_property_blob)) + return ERR_PTR(-EINVAL); + +- blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL); ++ blob = kvzalloc(sizeof(struct drm_property_blob) + length, GFP_KERNEL_ACCOUNT); + if (!blob) + return ERR_PTR(-ENOMEM); + +-- +2.51.0 + diff --git a/queue-5.10/drm-amd-display-avoid-updating-surface-with-the-same.patch b/queue-5.10/drm-amd-display-avoid-updating-surface-with-the-same.patch new file mode 100644 index 00000000000..5fd931c679b --- /dev/null +++ b/queue-5.10/drm-amd-display-avoid-updating-surface-with-the-same.patch @@ -0,0 +1,43 @@ +From b3a84160ae97bb9d7d8e1e4e3a4d5f6902daf042 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 14:47:01 +0800 +Subject: drm/amd/display: Avoid updating surface with the same surface under + MPO + +From: Wayne Lin + +[ Upstream commit 1a38ded4bc8ac09fd029ec656b1e2c98cc0d238c ] + +[Why & How] +Although it's dummy updates of surface update for committing stream +updates, we should not have dummy_updates[j].surface all indicating +to the same surface under multiple surfaces case. Otherwise, +copy_surface_update_to_plane() in update_planes_and_stream_state() +will update to the same surface only. + +Reviewed-by: Harry Wentland +Signed-off-by: Wayne Lin +Signed-off-by: Tom Chung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 0aa681939b7e7..c22783b882067 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -7958,7 +7958,7 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state) + * To fix this, DC should permit updating only stream properties. + */ + for (j = 0; j < status->plane_count; j++) +- dummy_updates[j].surface = status->plane_states[0]; ++ dummy_updates[j].surface = status->plane_states[j]; + + + mutex_lock(&dm->dc_lock); +-- +2.51.0 + diff --git a/queue-5.10/drm-amdgpu-add-hainan-clock-adjustment.patch b/queue-5.10/drm-amdgpu-add-hainan-clock-adjustment.patch new file mode 100644 index 00000000000..931938b9008 --- /dev/null +++ b/queue-5.10/drm-amdgpu-add-hainan-clock-adjustment.patch @@ -0,0 +1,39 @@ +From 8e129e94befbdd3c4c682171ba6aaed1535b967f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Feb 2026 07:24:01 +0000 +Subject: drm/amdgpu: Add HAINAN clock adjustment + +From: decce6 + +[ Upstream commit 49fe2c57bdc0acff9d2551ae337270b6fd8119d9 ] + +This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from +850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This +patch is for amdgpu. + +Signed-off-by: decce6 +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c b/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c +index ece892b16d9a7..47d18f129cac8 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c +@@ -3426,6 +3426,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + max_sclk = 60000; + max_mclk = 80000; + } ++ if ((adev->pdev->device == 0x666f) && ++ (adev->pdev->revision == 0x00)) { ++ max_sclk = 80000; ++ max_mclk = 95000; ++ } + } else if (adev->asic_type == CHIP_OLAND) { + if ((adev->pdev->revision == 0xC7) || + (adev->pdev->revision == 0x80) || +-- +2.51.0 + diff --git a/queue-5.10/drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch b/queue-5.10/drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch new file mode 100644 index 00000000000..c147d341b15 --- /dev/null +++ b/queue-5.10/drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch @@ -0,0 +1,61 @@ +From 5ea02807d017141613cd24dfaa5d4e5fe8d5d9a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Oct 2025 18:14:52 +0200 +Subject: drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state + callback + +From: Ludovic Desroches + +[ Upstream commit f12352471061df83a36edf54bbb16284793284e4 ] + +After several commits, the slab memory increases. Some drm_crtc_commit +objects are not freed. The atomic_destroy_state callback only put the +framebuffer. Use the __drm_atomic_helper_plane_destroy_state() function +to put all the objects that are no longer needed. + +It has been seen after hours of usage of a graphics application or using +kmemleak: + +unreferenced object 0xc63a6580 (size 64): + comm "egt_basic", pid 171, jiffies 4294940784 + hex dump (first 32 bytes): + 40 50 34 c5 01 00 00 00 ff ff ff ff 8c 65 3a c6 @P4..........e:. + 8c 65 3a c6 ff ff ff ff 98 65 3a c6 98 65 3a c6 .e:......e:..e:. + backtrace (crc c25aa925): + kmemleak_alloc+0x34/0x3c + __kmalloc_cache_noprof+0x150/0x1a4 + drm_atomic_helper_setup_commit+0x1e8/0x7bc + drm_atomic_helper_commit+0x3c/0x15c + drm_atomic_commit+0xc0/0xf4 + drm_atomic_helper_set_config+0x84/0xb8 + drm_mode_setcrtc+0x32c/0x810 + drm_ioctl+0x20c/0x488 + sys_ioctl+0x14c/0xc20 + ret_fast_syscall+0x0/0x54 + +Signed-off-by: Ludovic Desroches +Reviewed-by: Manikandan Muralidharan +Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-1-79b615130dc3@microchip.com +Signed-off-by: Manikandan Muralidharan +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +index 40800ec5700a8..9a33e1d83834f 100644 +--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c ++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +@@ -929,8 +929,7 @@ static void atmel_hlcdc_plane_atomic_destroy_state(struct drm_plane *p, + state->dscrs[i]->self); + } + +- if (s->fb) +- drm_framebuffer_put(s->fb); ++ __drm_atomic_helper_plane_destroy_state(s); + + kfree(state); + } +-- +2.51.0 + diff --git a/queue-5.10/drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch b/queue-5.10/drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch new file mode 100644 index 00000000000..33a4bc627d2 --- /dev/null +++ b/queue-5.10/drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch @@ -0,0 +1,81 @@ +From 9e408b978aa1051658acd34e099c099c94fa1461 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Oct 2025 18:14:53 +0200 +Subject: drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release + +From: Ludovic Desroches + +[ Upstream commit bc847787233277a337788568e90a6ee1557595eb ] + +The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying +the atmel_hlcdc_plane state structure without properly duplicating the +drm_plane_state. In particular, state->commit remained set to the old +state commit, which can lead to a use-after-free in the next +drm_atomic_commit() call. + +Fix this by calling +__drm_atomic_helper_duplicate_plane_state(), which correctly clones +the base drm_plane_state (including the ->commit pointer). + +It has been seen when closing and re-opening the device node while +another DRM client (e.g. fbdev) is still attached: + +============================================================================= +BUG kmalloc-64 (Not tainted): Poison overwritten +----------------------------------------------------------------------------- + +0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b +FIX kmalloc-64: Restoring Poison 0xc611b344-0xc611b344=0x6b +Allocated in drm_atomic_helper_setup_commit+0x1e8/0x7bc age=178 cpu=0 +pid=29 + drm_atomic_helper_setup_commit+0x1e8/0x7bc + drm_atomic_helper_commit+0x3c/0x15c + drm_atomic_commit+0xc0/0xf4 + drm_framebuffer_remove+0x4cc/0x5a8 + drm_mode_rmfb_work_fn+0x6c/0x80 + process_one_work+0x12c/0x2cc + worker_thread+0x2a8/0x400 + kthread+0xc0/0xdc + ret_from_fork+0x14/0x28 +Freed in drm_atomic_helper_commit_hw_done+0x100/0x150 age=8 cpu=0 +pid=169 + drm_atomic_helper_commit_hw_done+0x100/0x150 + drm_atomic_helper_commit_tail+0x64/0x8c + commit_tail+0x168/0x18c + drm_atomic_helper_commit+0x138/0x15c + drm_atomic_commit+0xc0/0xf4 + drm_atomic_helper_set_config+0x84/0xb8 + drm_mode_setcrtc+0x32c/0x810 + drm_ioctl+0x20c/0x488 + sys_ioctl+0x14c/0xc20 + ret_fast_syscall+0x0/0x54 +Slab 0xef8bc360 objects=21 used=16 fp=0xc611b7c0 +flags=0x200(workingset|zone=0) +Object 0xc611b340 @offset=832 fp=0xc611b7c0 + +Signed-off-by: Ludovic Desroches +Reviewed-by: Manikandan Muralidharan +Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-2-79b615130dc3@microchip.com +Signed-off-by: Manikandan Muralidharan +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +index 9a33e1d83834f..49eaaf4031f55 100644 +--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c ++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +@@ -910,8 +910,7 @@ atmel_hlcdc_plane_atomic_duplicate_state(struct drm_plane *p) + return NULL; + } + +- if (copy->base.fb) +- drm_framebuffer_get(copy->base.fb); ++ __drm_atomic_helper_plane_duplicate_state(p, ©->base); + + return ©->base; + } +-- +2.51.0 + diff --git a/queue-5.10/drm-radeon-add-hainan-clock-adjustment.patch b/queue-5.10/drm-radeon-add-hainan-clock-adjustment.patch new file mode 100644 index 00000000000..3cd3cb42b4c --- /dev/null +++ b/queue-5.10/drm-radeon-add-hainan-clock-adjustment.patch @@ -0,0 +1,39 @@ +From 996a4690b53759f76be769196cbc6c84bf384918 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Feb 2026 07:26:00 +0000 +Subject: drm/radeon: Add HAINAN clock adjustment + +From: decce6 + +[ Upstream commit 908d318f23d6b5d625bea093c5fc056238cdb7ff ] + +This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from +850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This +patch is for radeon. + +Signed-off-by: decce6 +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/si_dpm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c +index a84df439deb2f..88ec2550ef672 100644 +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -2972,6 +2972,11 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev, + max_sclk = 60000; + max_mclk = 80000; + } ++ if ((rdev->pdev->device == 0x666f) && ++ (rdev->pdev->revision == 0x00)) { ++ max_sclk = 80000; ++ max_mclk = 95000; ++ } + } else if (rdev->family == CHIP_OLAND) { + if ((rdev->pdev->revision == 0xC7) || + (rdev->pdev->revision == 0x80) || +-- +2.51.0 + diff --git a/queue-5.10/efi-cper-don-t-dump-the-entire-memory-region.patch b/queue-5.10/efi-cper-don-t-dump-the-entire-memory-region.patch new file mode 100644 index 00000000000..32b7188bc52 --- /dev/null +++ b/queue-5.10/efi-cper-don-t-dump-the-entire-memory-region.patch @@ -0,0 +1,54 @@ +From b8406ba30a05f87e85b6b473af12346eae5acfb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:35:06 +0100 +Subject: EFI/CPER: don't dump the entire memory region + +From: Mauro Carvalho Chehab + +[ Upstream commit 55cc6fe5716f678f06bcb95140882dfa684464ec ] + +The current logic at cper_print_fw_err() doesn't check if the +error record length is big enough to handle offset. On a bad firmware, +if the ofset is above the actual record, length -= offset will +underflow, making it dump the entire memory. + +The end result can be: + + - the logic taking a lot of time dumping large regions of memory; + - data disclosure due to the memory dumps; + - an OOPS, if it tries to dump an unmapped memory region. + +Fix it by checking if the section length is too small before doing +a hex dump. + +Signed-off-by: Mauro Carvalho Chehab +Reviewed-by: Jonathan Cameron +Acked-by: Ard Biesheuvel +Reviewed-by: Hanjun Guo +[ rjw: Subject tweaks ] +Link: https://patch.msgid.link/1752b5ba63a3e2f148ddee813b36c996cc617e86.1767871950.git.mchehab+huawei@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/cper.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c +index 8e24c36d7b633..2418401b2d816 100644 +--- a/drivers/firmware/efi/cper.c ++++ b/drivers/firmware/efi/cper.c +@@ -524,6 +524,11 @@ static void cper_print_fw_err(const char *pfx, + } else { + offset = sizeof(*fw_err); + } ++ if (offset > length) { ++ printk("%s""error section length is too small: offset=%d, length=%d\n", ++ pfx, offset, length); ++ return; ++ } + + buf += offset; + length -= offset; +-- +2.51.0 + diff --git a/queue-5.10/efi-cper-don-t-go-past-the-arm-processor-cper-record.patch b/queue-5.10/efi-cper-don-t-go-past-the-arm-processor-cper-record.patch new file mode 100644 index 00000000000..990e5803505 --- /dev/null +++ b/queue-5.10/efi-cper-don-t-go-past-the-arm-processor-cper-record.patch @@ -0,0 +1,107 @@ +From 480ef95761c6220b2085ae17a4ab6cf47614c059 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:35:04 +0100 +Subject: EFI/CPER: don't go past the ARM processor CPER record buffer + +From: Mauro Carvalho Chehab + +[ Upstream commit eae21beecb95a3b69ee5c38a659f774e171d730e ] + +There's a logic inside GHES/CPER to detect if the section_length +is too small, but it doesn't detect if it is too big. + +Currently, if the firmware receives an ARM processor CPER record +stating that a section length is big, kernel will blindly trust +section_length, producing a very long dump. For instance, a 67 +bytes record with ERR_INFO_NUM set 46198 and section length +set to 854918320 would dump a lot of data going a way past the +firmware memory-mapped area. + +Fix it by adding a logic to prevent it to go past the buffer +if ERR_INFO_NUM is too big, making it report instead: + + [Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1 + [Hardware Error]: event severity: recoverable + [Hardware Error]: Error 0, type: recoverable + [Hardware Error]: section_type: ARM processor error + [Hardware Error]: MIDR: 0xff304b2f8476870a + [Hardware Error]: section length: 854918320, CPER size: 67 + [Hardware Error]: section length is too big + [Hardware Error]: firmware-generated error record is incorrect + [Hardware Error]: ERR_INFO_NUM is 46198 + +Signed-off-by: Mauro Carvalho Chehab +Reviewed-by: Jonathan Cameron +Acked-by: Ard Biesheuvel +Reviewed-by: Hanjun Guo +[ rjw: Subject and changelog tweaks ] +Link: https://patch.msgid.link/41cd9f6b3ace3cdff7a5e864890849e4b1c58b63.1767871950.git.mchehab+huawei@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/cper-arm.c | 12 ++++++++---- + drivers/firmware/efi/cper.c | 3 ++- + include/linux/cper.h | 3 ++- + 3 files changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/firmware/efi/cper-arm.c b/drivers/firmware/efi/cper-arm.c +index ea43589944ba5..26a12f8076359 100644 +--- a/drivers/firmware/efi/cper-arm.c ++++ b/drivers/firmware/efi/cper-arm.c +@@ -227,7 +227,8 @@ static void cper_print_arm_err_info(const char *pfx, u32 type, + } + + void cper_print_proc_arm(const char *pfx, +- const struct cper_sec_proc_arm *proc) ++ const struct cper_sec_proc_arm *proc, ++ u32 length) + { + int i, len, max_ctx_type; + struct cper_arm_err_info *err_info; +@@ -239,9 +240,12 @@ void cper_print_proc_arm(const char *pfx, + + len = proc->section_length - (sizeof(*proc) + + proc->err_info_num * (sizeof(*err_info))); +- if (len < 0) { +- printk("%ssection length: %d\n", pfx, proc->section_length); +- printk("%ssection length is too small\n", pfx); ++ ++ if (len < 0 || proc->section_length > length) { ++ printk("%ssection length: %d, CPER size: %d\n", ++ pfx, proc->section_length, length); ++ printk("%ssection length is too %s\n", pfx, ++ (len < 0) ? "small" : "big"); + printk("%sfirmware-generated error record is incorrect\n", pfx); + printk("%sERR_INFO_NUM is %d\n", pfx, proc->err_info_num); + return; +diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c +index 2418401b2d816..2a51a072e6700 100644 +--- a/drivers/firmware/efi/cper.c ++++ b/drivers/firmware/efi/cper.c +@@ -609,7 +609,8 @@ cper_estatus_print_section(const char *pfx, struct acpi_hest_generic_data *gdata + + printk("%ssection_type: ARM processor error\n", newpfx); + if (gdata->error_data_length >= sizeof(*arm_err)) +- cper_print_proc_arm(newpfx, arm_err); ++ cper_print_proc_arm(newpfx, arm_err, ++ gdata->error_data_length); + else + goto err_section_too_small; + #endif +diff --git a/include/linux/cper.h b/include/linux/cper.h +index a31e22cc839eb..b3079f687c5c6 100644 +--- a/include/linux/cper.h ++++ b/include/linux/cper.h +@@ -567,7 +567,8 @@ void cper_mem_err_pack(const struct cper_sec_mem_err *, + const char *cper_mem_err_unpack(struct trace_seq *, + struct cper_mem_err_compact *); + void cper_print_proc_arm(const char *pfx, +- const struct cper_sec_proc_arm *proc); ++ const struct cper_sec_proc_arm *proc, ++ u32 length); + void cper_print_proc_ia(const char *pfx, + const struct cper_sec_proc_ia *proc); + +-- +2.51.0 + diff --git a/queue-5.10/fix-it87_wdt-early-reboot-by-reporting-running-timer.patch b/queue-5.10/fix-it87_wdt-early-reboot-by-reporting-running-timer.patch new file mode 100644 index 00000000000..128edeb36f2 --- /dev/null +++ b/queue-5.10/fix-it87_wdt-early-reboot-by-reporting-running-timer.patch @@ -0,0 +1,60 @@ +From ec71318072fd03adea95270ded12e9f54fa7f90d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 13:11:24 +0100 +Subject: fix it87_wdt early reboot by reporting running timer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: René Rebe + +[ Upstream commit 88b2ab346436f799b99894a3e9518a3ffa344524 ] + +Some products, such as the Ugreen DXP4800 Plus NAS, ship with the it87 +wdt enabled by the firmware and a broken BIOS option that does not +allow to change the time or turn it off. As this makes installing +Linux rather difficult, change the it87_wdt to report it running to +the watchdog core. + +Signed-off-by: René Rebe +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/it87_wdt.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/watchdog/it87_wdt.c b/drivers/watchdog/it87_wdt.c +index da9e24e4a8b60..1d41b9fdcedc4 100644 +--- a/drivers/watchdog/it87_wdt.c ++++ b/drivers/watchdog/it87_wdt.c +@@ -191,6 +191,12 @@ static void _wdt_update_timeout(unsigned int t) + superio_outb(t >> 8, WDTVALMSB); + } + ++/* Internal function, should be called after superio_select(GPIO) */ ++static bool _wdt_running(void) ++{ ++ return superio_inb(WDTVALLSB) || (max_units > 255 && superio_inb(WDTVALMSB)); ++} ++ + static int wdt_update_timeout(unsigned int t) + { + int ret; +@@ -373,6 +379,12 @@ static int __init it87_wdt_init(void) + } + } + ++ /* wdt already left running by firmware? */ ++ if (_wdt_running()) { ++ pr_info("Left running by firmware.\n"); ++ set_bit(WDOG_HW_RUNNING, &wdt_dev.status); ++ } ++ + superio_exit(); + + if (timeout < 1 || timeout > max_units * 60) { +-- +2.51.0 + diff --git a/queue-5.10/gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch b/queue-5.10/gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch new file mode 100644 index 00000000000..bd3e8c9cdcd --- /dev/null +++ b/queue-5.10/gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch @@ -0,0 +1,57 @@ +From 3b7878f2590b8c51f29774ddd8aadfad3d3bf7c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 17:26:26 +0800 +Subject: gpio: aspeed-sgpio: Change the macro to support deferred probe + +From: Billy Tsai + +[ Upstream commit e18533b023ec7a33488bcf33140ce69bbba2894f ] + +Use module_platform_driver() to replace module_platform_driver_probe(). +The former utilizes platform_driver_register(), which allows the driver to +defer probing when it doesn't acquire the necessary resources due to probe +order. In contrast, the latter uses __platform_driver_probe(), which +includes the comment "Note that this is incompatible with deferred +probing." Since our SGPIO driver requires access to the clock resource, the +former is more suitable. + +Reviewed-by: Linus Walleij +Signed-off-by: Billy Tsai +Link: https://lore.kernel.org/r/20260123-upstream_sgpio-v2-1-69cfd1631400@aspeedtech.com +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-aspeed-sgpio.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpio/gpio-aspeed-sgpio.c b/drivers/gpio/gpio-aspeed-sgpio.c +index 64e54f8c30d2d..2ac1140725927 100644 +--- a/drivers/gpio/gpio-aspeed-sgpio.c ++++ b/drivers/gpio/gpio-aspeed-sgpio.c +@@ -474,7 +474,7 @@ static const struct of_device_id aspeed_sgpio_of_table[] = { + + MODULE_DEVICE_TABLE(of, aspeed_sgpio_of_table); + +-static int __init aspeed_sgpio_probe(struct platform_device *pdev) ++static int aspeed_sgpio_probe(struct platform_device *pdev) + { + struct aspeed_sgpio *gpio; + u32 nr_gpios, sgpio_freq, sgpio_clk_div; +@@ -562,12 +562,13 @@ static int __init aspeed_sgpio_probe(struct platform_device *pdev) + } + + static struct platform_driver aspeed_sgpio_driver = { ++ .probe = aspeed_sgpio_probe, + .driver = { + .name = KBUILD_MODNAME, + .of_match_table = aspeed_sgpio_of_table, + }, + }; + +-module_platform_driver_probe(aspeed_sgpio_driver, aspeed_sgpio_probe); ++module_platform_driver(aspeed_sgpio_driver); + MODULE_DESCRIPTION("Aspeed Serial GPIO Driver"); + MODULE_LICENSE("GPL"); +-- +2.51.0 + diff --git a/queue-5.10/hfsplus-fix-volume-corruption-issue-for-generic-498.patch b/queue-5.10/hfsplus-fix-volume-corruption-issue-for-generic-498.patch new file mode 100644 index 00000000000..29a4f646a0b --- /dev/null +++ b/queue-5.10/hfsplus-fix-volume-corruption-issue-for-generic-498.patch @@ -0,0 +1,149 @@ +From d9ec66459d3a92063e0fb1b4079d941ed187ee03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Dec 2025 19:58:22 -0800 +Subject: hfsplus: fix volume corruption issue for generic/498 + +From: Viacheslav Dubeyko + +[ Upstream commit 9a8c4ad44721da4c48e1ff240ac76286c82837fe ] + +The xfstests' test-case generic/498 leaves HFS+ volume +in corrupted state: + +sudo ./check generic/498 +FSTYP -- hfsplus +PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #18 SMP PREEMPT_DYNAMIC Thu Dec 4 12:24:45 PST 2025 +MKFS_OPTIONS -- /dev/loop51 +MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch + +generic/498 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent +(see XFSTESTS-2/xfstests-dev/results//generic/498.full for details) + +Ran: generic/498 +Failures: generic/498 +Failed 1 of 1 tests + +sudo fsck.hfsplus -d /dev/loop51 +** /dev/loop51 +Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K. +Executing fsck_hfs (version 540.1-Linux). +** Checking non-journaled HFS Plus Volume. +The volume name is untitled +** Checking extents overflow file. +** Checking catalog file. +Invalid leaf record count +(It should be 16 instead of 2) +** Checking multi-linked files. +CheckHardLinks: found 1 pre-Leopard file inodes. +** Checking catalog hierarchy. +** Checking extended attributes file. +** Checking volume bitmap. +** Checking volume information. +Verify Status: VIStat = 0x0000, ABTStat = 0x0000 EBTStat = 0x0000 +CBTStat = 0x8000 CatStat = 0x00000000 +** Repairing volume. +** Rechecking volume. +** Checking non-journaled HFS Plus Volume. +The volume name is untitled +** Checking extents overflow file. +** Checking catalog file. +** Checking multi-linked files. +CheckHardLinks: found 1 pre-Leopard file inodes. +** Checking catalog hierarchy. +** Checking extended attributes file. +** Checking volume bitmap. +** Checking volume information. +** The volume untitled was repaired successfully. + +The generic/498 test executes such steps on final phase: + +mkdir $SCRATCH_MNT/A +mkdir $SCRATCH_MNT/B +mkdir $SCRATCH_MNT/A/C +touch $SCRATCH_MNT/B/foo +$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/B/foo + +ln $SCRATCH_MNT/B/foo $SCRATCH_MNT/A/C/foo +$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/A + +"Simulate a power failure and mount the filesystem +to check that what we explicitly fsync'ed exists." + +_flakey_drop_and_remount + +The FSCK tool complains about "Invalid leaf record count". +HFS+ b-tree header contains leaf_count field is updated +by hfs_brec_insert() and hfs_brec_remove(). The hfs_brec_insert() +is involved into hard link creation process. However, +modified in-core leaf_count field is stored into HFS+ +b-tree header by hfs_btree_write() method. But, +unfortunately, hfs_btree_write() hasn't been called +by hfsplus_cat_write_inode() and hfsplus_file_fsync() +stores not fully consistent state of the Catalog File's +b-tree. + +This patch adds calling hfs_btree_write() method in +the hfsplus_cat_write_inode() with the goal of +storing consistent state of Catalog File's b-tree. +Finally, it makes FSCK tool happy. + +sudo ./check generic/498 +FSTYP -- hfsplus +PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #22 SMP PREEMPT_DYNAMIC Sat Dec 6 17:01:31 PST 2025 +MKFS_OPTIONS -- /dev/loop51 +MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch + +generic/498 33s ... 31s +Ran: generic/498 +Passed all 1 tests + +Signed-off-by: Viacheslav Dubeyko +cc: John Paul Adrian Glaubitz +cc: Yangtao Li +cc: linux-fsdevel@vger.kernel.org +Link: https://lore.kernel.org/r/20251207035821.3863657-1-slava@dubeyko.com +Signed-off-by: Viacheslav Dubeyko +Signed-off-by: Sasha Levin +--- + fs/hfsplus/inode.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c +index 0ba324ee7dffb..57123b206877c 100644 +--- a/fs/hfsplus/inode.c ++++ b/fs/hfsplus/inode.c +@@ -587,6 +587,7 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd) + int hfsplus_cat_write_inode(struct inode *inode) + { + struct inode *main_inode = inode; ++ struct hfs_btree *tree = HFSPLUS_SB(inode->i_sb)->cat_tree; + struct hfs_find_data fd; + hfsplus_cat_entry entry; + int res = 0; +@@ -597,7 +598,7 @@ int hfsplus_cat_write_inode(struct inode *inode) + if (!main_inode->i_nlink) + return 0; + +- if (hfs_find_init(HFSPLUS_SB(main_inode->i_sb)->cat_tree, &fd)) ++ if (hfs_find_init(tree, &fd)) + /* panic? */ + return -EIO; + +@@ -662,5 +663,14 @@ int hfsplus_cat_write_inode(struct inode *inode) + set_bit(HFSPLUS_I_CAT_DIRTY, &HFSPLUS_I(inode)->flags); + out: + hfs_find_exit(&fd); ++ ++ if (!res) { ++ res = hfs_btree_write(tree); ++ if (res) { ++ pr_err("b-tree write err: %d, ino %lu\n", ++ res, inode->i_ino); ++ } ++ } ++ + return res; + } +-- +2.51.0 + diff --git a/queue-5.10/hfsplus-pretend-special-inodes-as-regular-files.patch b/queue-5.10/hfsplus-pretend-special-inodes-as-regular-files.patch new file mode 100644 index 00000000000..379f553ef17 --- /dev/null +++ b/queue-5.10/hfsplus-pretend-special-inodes-as-regular-files.patch @@ -0,0 +1,45 @@ +From f8d157caeb60fea2b8a43bdfadf2baae4b9c0cae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 18:39:33 +0900 +Subject: hfsplus: pretend special inodes as regular files + +From: Tetsuo Handa + +[ Upstream commit ed8889ca21b6ab37bc1435c4009ce37a79acb9e6 ] + +Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()") +requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/ +S_IFIFO/S_IFSOCK type, use S_IFREG for special inodes. + +Reported-by: syzbot +Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d +Signed-off-by: Tetsuo Handa +Reviewed-by: Viacheslav Dubeyko +Signed-off-by: Viacheslav Dubeyko +Link: https://lore.kernel.org/r/d0a07b1b-8b73-4002-8e29-e2bd56871262@I-love.SAKURA.ne.jp +Signed-off-by: Viacheslav Dubeyko +Signed-off-by: Sasha Levin +--- + fs/hfsplus/super.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c +index 9f8945042faa8..ff9998be089a8 100644 +--- a/fs/hfsplus/super.c ++++ b/fs/hfsplus/super.c +@@ -52,6 +52,12 @@ static int hfsplus_system_read_inode(struct inode *inode) + return -EIO; + } + ++ /* ++ * Assign a dummy file type, for may_open() requires that ++ * an inode has a valid file type. ++ */ ++ inode->i_mode = S_IFREG; ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-5.10/hid-multitouch-add-egalaxtouch-exc3188-support.patch b/queue-5.10/hid-multitouch-add-egalaxtouch-exc3188-support.patch new file mode 100644 index 00000000000..3fbf2c6ee1b --- /dev/null +++ b/queue-5.10/hid-multitouch-add-egalaxtouch-exc3188-support.patch @@ -0,0 +1,49 @@ +From db55041546804d137456cebc20a643183ef46bee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 09:57:05 +0100 +Subject: HID: multitouch: add eGalaxTouch EXC3188 support + +From: Thorsten Schmelzer + +[ Upstream commit 8e4ac86b2ddd36fe501e20ecfcc080e536df1f48 ] + +Add support for the for the EXC3188 touchscreen from eGalaxy. + +Signed-off-by: Thorsten Schmelzer +Signed-off-by: Michael Tretter +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-multitouch.c | 3 +++ + 2 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 174090489072d..4b07b8be5c43e 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -395,6 +395,7 @@ + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7349 0x7349 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7 0x73f7 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001 ++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000 0xc000 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002 0xc002 + + #define USB_VENDOR_ID_EDIFIER 0x2d99 +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 1f1e4a383a85a..227cf3f6ca227 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -1901,6 +1901,9 @@ static const struct hid_device_id mt_devices[] = { + { .driver_data = MT_CLS_EGALAX_SERIAL, + MT_USB_DEVICE(USB_VENDOR_ID_DWAV, + USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) }, ++ { .driver_data = MT_CLS_EGALAX_SERIAL, ++ MT_USB_DEVICE(USB_VENDOR_ID_DWAV, ++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000) }, + { .driver_data = MT_CLS_EGALAX, + MT_USB_DEVICE(USB_VENDOR_ID_DWAV, + USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002) }, +-- +2.51.0 + diff --git a/queue-5.10/hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch b/queue-5.10/hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch new file mode 100644 index 00000000000..961d0c479b3 --- /dev/null +++ b/queue-5.10/hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch @@ -0,0 +1,61 @@ +From b3ae0d58a0db4cfe1d9a38864db4bc6e8b971ec3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 08:35:44 +0100 +Subject: hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 1e5271393d777f6159d896943b4c44c4f3ecff52 ] + +The unpacked union within a packed struct generates alignment warnings +on clang for 32-bit ARM: + +./usr/include/linux/hyperv.h:361:2: error: field within 'struct hv_kvp_exchg_msg_value' + is less aligned than 'union hv_kvp_exchg_msg_value::(anonymous at ./usr/include/linux/hyperv.h:361:2)' + and is usually due to 'struct hv_kvp_exchg_msg_value' being packed, + which can lead to unaligned accesses [-Werror,-Wunaligned-access] + 361 | union { + | ^ + +With the recent changes to compile-test the UAPI headers in more cases, +this warning in combination with CONFIG_WERROR breaks the build. + +Fix the warning. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/ +Reported-by: Nathan Chancellor +Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/ +Suggested-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/ +Signed-off-by: Thomas Weißschuh +Acked-by: Wei Liu (Microsoft) +Tested-by: Nicolas Schier +Reviewed-by: Nicolas Schier +Acked-by: Greg Kroah-Hartman +Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-1-076aed1623ff@linutronix.de +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + include/uapi/linux/hyperv.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/hyperv.h b/include/uapi/linux/hyperv.h +index 6135d92e0d47b..a9f05c61b37e7 100644 +--- a/include/uapi/linux/hyperv.h ++++ b/include/uapi/linux/hyperv.h +@@ -351,7 +351,7 @@ struct hv_kvp_exchg_msg_value { + __u8 value[HV_KVP_EXCHANGE_MAX_VALUE_SIZE]; + __u32 value_u32; + __u64 value_u64; +- }; ++ } __attribute__((packed)); + } __attribute__((packed)); + + struct hv_kvp_msg_enumerate { +-- +2.51.0 + diff --git a/queue-5.10/iio-magnetometer-remove-irqf_oneshot.patch b/queue-5.10/iio-magnetometer-remove-irqf_oneshot.patch new file mode 100644 index 00000000000..f260f11120a --- /dev/null +++ b/queue-5.10/iio-magnetometer-remove-irqf_oneshot.patch @@ -0,0 +1,49 @@ +From f18f2853abeaf0760d10483463a07e5b415651c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:38 +0100 +Subject: iio: magnetometer: Remove IRQF_ONESHOT +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sebastian Andrzej Siewior + +[ Upstream commit a54e9440925e6617c98669066b4753c4cdcea8a0 ] + +Passing IRQF_ONESHOT ensures that the interrupt source is masked until +the secondary (threaded) handler is done. If only a primary handler is +used then the flag makes no sense because the interrupt can not fire +(again) while its handler is running. +The flag also disallows force-threading of the primary handler and the +irq-core will warn about this. +The force-threading functionality is required on PREEMPT_RT because the +handler is using locks with can sleep on PREEMPT_RT. + +Remove IRQF_ONESHOT from irqflags. + +Tested-by: Geert Uytterhoeven +Signed-off-by: Sebastian Andrzej Siewior +Reviewed-by: Andy Shevchenko +Reviewed-by: Nuno Sá +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/magnetometer/ak8975.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c +index fd3a6cd16bcf1..a248a8270cb1d 100644 +--- a/drivers/iio/magnetometer/ak8975.c ++++ b/drivers/iio/magnetometer/ak8975.c +@@ -511,7 +511,7 @@ static int ak8975_setup_irq(struct ak8975_data *data) + irq = gpiod_to_irq(data->eoc_gpiod); + + rc = devm_request_irq(&client->dev, irq, ak8975_irq_handler, +- IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ IRQF_TRIGGER_RISING, + dev_name(&client->dev), data); + if (rc < 0) { + dev_err(&client->dev, "irq %d request failed: %d\n", irq, rc); +-- +2.51.0 + diff --git a/queue-5.10/include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch b/queue-5.10/include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch new file mode 100644 index 00000000000..b8781576f6b --- /dev/null +++ b/queue-5.10/include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch @@ -0,0 +1,42 @@ +From 50f0e861b98f0879f65cfa6cfbaf7b68b994af80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Feb 2026 15:54:06 +0100 +Subject: include: uapi: netfilter_bridge.h: Cover for musl libc + +From: Phil Sutter + +[ Upstream commit 4edd4ba71ce0df015303dba75ea9d20d1a217546 ] + +Musl defines its own struct ethhdr and thus defines __UAPI_DEF_ETHHDR to +zero. To avoid struct redefinition errors, user space is therefore +supposed to include netinet/if_ether.h before (or instead of) +linux/if_ether.h. To relieve them from this burden, include the libc +header here if not building for kernel space. + +Reported-by: Alyssa Ross +Suggested-by: Florian Westphal +Signed-off-by: Phil Sutter +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + include/uapi/linux/netfilter_bridge.h | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/include/uapi/linux/netfilter_bridge.h b/include/uapi/linux/netfilter_bridge.h +index 1610fdbab98df..ad520d3e9df8f 100644 +--- a/include/uapi/linux/netfilter_bridge.h ++++ b/include/uapi/linux/netfilter_bridge.h +@@ -5,6 +5,10 @@ + /* bridge-specific defines for netfilter. + */ + ++#ifndef __KERNEL__ ++#include /* for __UAPI_DEF_ETHHDR if defined */ ++#endif ++ + #include + #include + #include +-- +2.51.0 + diff --git a/queue-5.10/iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch b/queue-5.10/iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch new file mode 100644 index 00000000000..56d0388a961 --- /dev/null +++ b/queue-5.10/iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch @@ -0,0 +1,134 @@ +From ab4c58fab2b2639c0429b9f567fd1677b710427d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 13:28:57 -0800 +Subject: iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency + +From: Alexander Grest + +[ Upstream commit df180b1a4cc51011c5f8c52c7ec02ad2e42962de ] + +The SMMU CMDQ lock is highly contentious when there are multiple CPUs +issuing commands and the queue is nearly full. + +The lock has the following states: + - 0: Unlocked + - >0: Shared lock held with count + - INT_MIN+N: Exclusive lock held, where N is the # of shared waiters + - INT_MIN: Exclusive lock held, no shared waiters + +When multiple CPUs are polling for space in the queue, they attempt to +grab the exclusive lock to update the cons pointer from the hardware. If +they fail to get the lock, they will spin until either the cons pointer +is updated by another CPU. + +The current code allows the possibility of shared lock starvation +if there is a constant stream of CPUs trying to grab the exclusive lock. +This leads to severe latency issues and soft lockups. + +Consider the following scenario where CPU1's attempt to acquire the +shared lock is starved by CPU2 and CPU0 contending for the exclusive +lock. + +CPU0 (exclusive) | CPU1 (shared) | CPU2 (exclusive) | `cmdq->lock` +-------------------------------------------------------------------------- +trylock() //takes | | | 0 + | shared_lock() | | INT_MIN + | fetch_inc() | | INT_MIN + | no return | | INT_MIN + 1 + | spins // VAL >= 0 | | INT_MIN + 1 +unlock() | spins... | | INT_MIN + 1 +set_release(0) | spins... | | 0 see[NOTE] +(done) | (sees 0) | trylock() // takes | 0 + | *exits loop* | cmpxchg(0, INT_MIN) | 0 + | | *cuts in* | INT_MIN + | cmpxchg(0, 1) | | INT_MIN + | fails // != 0 | | INT_MIN + | spins // VAL >= 0 | | INT_MIN + | *starved* | | INT_MIN + +[NOTE] The current code resets the exclusive lock to 0 regardless of the +state of the lock. This causes two problems: +1. It opens the possibility of back-to-back exclusive locks and the + downstream effect of starving shared lock. +2. The count of shared lock waiters are lost. + +To mitigate this, we release the exclusive lock by only clearing the sign +bit while retaining the shared lock waiter count as a way to avoid +starving the shared lock waiters. + +Also deleted cmpxchg loop while trying to acquire the shared lock as it +is not needed. The waiters can see the positive lock count and proceed +immediately after the exclusive lock is released. + +Exclusive lock is not starved in that submitters will try exclusive lock +first when new spaces become available. + +Reviewed-by: Mostafa Saleh +Reviewed-by: Nicolin Chen +Signed-off-by: Alexander Grest +Signed-off-by: Jacob Pan +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 31 ++++++++++++++------- + 1 file changed, 21 insertions(+), 10 deletions(-) + +diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +index 9ac7b37290eb0..8ee0446c358d6 100644 +--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c ++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +@@ -438,20 +438,26 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu) + */ + static void arm_smmu_cmdq_shared_lock(struct arm_smmu_cmdq *cmdq) + { +- int val; +- + /* +- * We can try to avoid the cmpxchg() loop by simply incrementing the +- * lock counter. When held in exclusive state, the lock counter is set +- * to INT_MIN so these increments won't hurt as the value will remain +- * negative. ++ * When held in exclusive state, the lock counter is set to INT_MIN ++ * so these increments won't hurt as the value will remain negative. ++ * The increment will also signal the exclusive locker that there are ++ * shared waiters. + */ + if (atomic_fetch_inc_relaxed(&cmdq->lock) >= 0) + return; + +- do { +- val = atomic_cond_read_relaxed(&cmdq->lock, VAL >= 0); +- } while (atomic_cmpxchg_relaxed(&cmdq->lock, val, val + 1) != val); ++ /* ++ * Someone else is holding the lock in exclusive state, so wait ++ * for them to finish. Since we already incremented the lock counter, ++ * no exclusive lock can be acquired until we finish. We don't need ++ * the return value since we only care that the exclusive lock is ++ * released (i.e. the lock counter is non-negative). ++ * Once the exclusive locker releases the lock, the sign bit will ++ * be cleared and our increment will make the lock counter positive, ++ * allowing us to proceed. ++ */ ++ atomic_cond_read_relaxed(&cmdq->lock, VAL > 0); + } + + static void arm_smmu_cmdq_shared_unlock(struct arm_smmu_cmdq *cmdq) +@@ -478,9 +484,14 @@ static bool arm_smmu_cmdq_shared_tryunlock(struct arm_smmu_cmdq *cmdq) + __ret; \ + }) + ++/* ++ * Only clear the sign bit when releasing the exclusive lock this will ++ * allow any shared_lock() waiters to proceed without the possibility ++ * of entering the exclusive lock in a tight loop. ++ */ + #define arm_smmu_cmdq_exclusive_unlock_irqrestore(cmdq, flags) \ + ({ \ +- atomic_set_release(&cmdq->lock, 0); \ ++ atomic_fetch_andnot_release(INT_MIN, &cmdq->lock); \ + local_irq_restore(flags); \ + }) + +-- +2.51.0 + diff --git a/queue-5.10/ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch b/queue-5.10/ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch new file mode 100644 index 00000000000..8246c56de9c --- /dev/null +++ b/queue-5.10/ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch @@ -0,0 +1,123 @@ +From 756cd81535e3640723094bd28cd2c14a69cdcd6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 04:35:24 +0000 +Subject: ipv4: fib: Annotate access to struct fib_alias.fa_state. + +From: Kuniyuki Iwashima + +[ Upstream commit 6e84fc395e90465f1418f582a9f7d53c87ab010e ] + +syzbot reported that struct fib_alias.fa_state can be +modified locklessly by RCU readers. [0] + +Let's use READ_ONCE()/WRITE_ONCE() properly. + +[0]: +BUG: KCSAN: data-race in fib_table_lookup / fib_table_lookup + +write to 0xffff88811b06a7fa of 1 bytes by task 4167 on cpu 0: + fib_alias_accessed net/ipv4/fib_lookup.h:32 [inline] + fib_table_lookup+0x361/0xd60 net/ipv4/fib_trie.c:1565 + fib_lookup include/net/ip_fib.h:390 [inline] + ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814 + ip_route_output_key_hash net/ipv4/route.c:2705 [inline] + __ip_route_output_key include/net/route.h:169 [inline] + ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932 + udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450 + inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859 + sock_sendmsg_nosec net/socket.c:727 [inline] + __sock_sendmsg net/socket.c:742 [inline] + ____sys_sendmsg+0x53a/0x600 net/socket.c:2592 + ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646 + __sys_sendmmsg+0x185/0x320 net/socket.c:2735 + __do_sys_sendmmsg net/socket.c:2762 [inline] + __se_sys_sendmmsg net/socket.c:2759 [inline] + __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759 + x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +read to 0xffff88811b06a7fa of 1 bytes by task 4168 on cpu 1: + fib_alias_accessed net/ipv4/fib_lookup.h:31 [inline] + fib_table_lookup+0x338/0xd60 net/ipv4/fib_trie.c:1565 + fib_lookup include/net/ip_fib.h:390 [inline] + ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814 + ip_route_output_key_hash net/ipv4/route.c:2705 [inline] + __ip_route_output_key include/net/route.h:169 [inline] + ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932 + udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450 + inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859 + sock_sendmsg_nosec net/socket.c:727 [inline] + __sock_sendmsg net/socket.c:742 [inline] + ____sys_sendmsg+0x53a/0x600 net/socket.c:2592 + ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646 + __sys_sendmmsg+0x185/0x320 net/socket.c:2735 + __do_sys_sendmmsg net/socket.c:2762 [inline] + __se_sys_sendmmsg net/socket.c:2759 [inline] + __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759 + x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +value changed: 0x00 -> 0x01 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 1 UID: 0 PID: 4168 Comm: syz.4.206 Not tainted syzkaller #0 PREEMPT(voluntary) +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 + +Reported-by: syzbot+d24f940f770afda885cf@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/69783ead.050a0220.c9109.0013.GAE@google.com/ +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260127043528.514160-1-kuniyu@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/fib_lookup.h | 6 ++++-- + net/ipv4/fib_trie.c | 4 ++-- + 2 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h +index 818916b2a04d6..f8fe0da3d9af6 100644 +--- a/net/ipv4/fib_lookup.h ++++ b/net/ipv4/fib_lookup.h +@@ -27,8 +27,10 @@ struct fib_alias { + /* Dont write on fa_state unless needed, to keep it shared on all cpus */ + static inline void fib_alias_accessed(struct fib_alias *fa) + { +- if (!(fa->fa_state & FA_S_ACCESSED)) +- fa->fa_state |= FA_S_ACCESSED; ++ u8 fa_state = READ_ONCE(fa->fa_state); ++ ++ if (!(fa_state & FA_S_ACCESSED)) ++ WRITE_ONCE(fa->fa_state, fa_state | FA_S_ACCESSED); + } + + /* Exported by fib_semantics.c */ +diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c +index 671178ed41d0d..5c75591bcce00 100644 +--- a/net/ipv4/fib_trie.c ++++ b/net/ipv4/fib_trie.c +@@ -1237,7 +1237,7 @@ int fib_table_insert(struct net *net, struct fib_table *tb, + new_fa->fa_tos = fa->fa_tos; + new_fa->fa_info = fi; + new_fa->fa_type = cfg->fc_type; +- state = fa->fa_state; ++ state = READ_ONCE(fa->fa_state); + new_fa->fa_state = state & ~FA_S_ACCESSED; + new_fa->fa_slen = fa->fa_slen; + new_fa->tb_id = tb->tb_id; +@@ -1697,7 +1697,7 @@ int fib_table_delete(struct net *net, struct fib_table *tb, + + fib_remove_alias(t, tp, l, fa_to_delete); + +- if (fa_to_delete->fa_state & FA_S_ACCESSED) ++ if (READ_ONCE(fa_to_delete->fa_state) & FA_S_ACCESSED) + rt_cache_flush(cfg->fc_nlinfo.nl_net); + + fib_release_info(fa_to_delete->fa_info); +-- +2.51.0 + diff --git a/queue-5.10/jfs-add-missing-set_freezable-for-freezable-kthread.patch b/queue-5.10/jfs-add-missing-set_freezable-for-freezable-kthread.patch new file mode 100644 index 00000000000..270b2eebc1f --- /dev/null +++ b/queue-5.10/jfs-add-missing-set_freezable-for-freezable-kthread.patch @@ -0,0 +1,37 @@ +From 459512f6d2be8274fc791afa3e21cc008553315c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 19:38:01 +0800 +Subject: jfs: Add missing set_freezable() for freezable kthread + +From: Haotian Zhang + +[ Upstream commit eb0cfcf265714b419cc3549895a00632e76732ae ] + +The jfsIOWait() thread calls try_to_freeze() but lacks set_freezable(), +causing it to remain non-freezable by default. This prevents proper +freezing during system suspend. + +Add set_freezable() to make the thread freezable as intended. + +Signed-off-by: Haotian Zhang +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_logmgr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c +index 78fd136ac13b9..d02bca48bc7b0 100644 +--- a/fs/jfs/jfs_logmgr.c ++++ b/fs/jfs/jfs_logmgr.c +@@ -2322,6 +2322,7 @@ int jfsIOWait(void *arg) + { + struct lbuf *bp; + ++ set_freezable(); + do { + spin_lock_irq(&log_redrive_lock); + while ((bp = log_redrive_list)) { +-- +2.51.0 + diff --git a/queue-5.10/jfs-nlink-overflow-in-jfs_rename.patch b/queue-5.10/jfs-nlink-overflow-in-jfs_rename.patch new file mode 100644 index 00000000000..c9ce1a579e3 --- /dev/null +++ b/queue-5.10/jfs-nlink-overflow-in-jfs_rename.patch @@ -0,0 +1,54 @@ +From 862efaed62a4e035b3a7753d055353dac6600943 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Oct 2025 13:22:12 +0100 +Subject: jfs: nlink overflow in jfs_rename + +From: Jori Koolstra + +[ Upstream commit 9218dc26fd922b09858ecd3666ed57dfd8098da8 ] + +If nlink is maximal for a directory (-1) and inside that directory you +perform a rename for some child directory (not moving from the parent), +then the nlink of the first directory is first incremented and later +decremented. Normally this is fine, but when nlink = -1 this causes a +wrap around to 0, and then drop_nlink issues a warning. + +After applying the patch syzbot no longer issues any warnings. I also +ran some basic fs tests to look for any regressions. + +Signed-off-by: Jori Koolstra +Reported-by: syzbot+9131ddfd7870623b719f@syzkaller.appspotmail.com +Closes: https://syzbot.org/bug?extid=9131ddfd7870623b719f +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/namei.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c +index f155ad6650bd4..e72c48f457d86 100644 +--- a/fs/jfs/namei.c ++++ b/fs/jfs/namei.c +@@ -1226,7 +1226,7 @@ static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry, + jfs_err("jfs_rename: dtInsert returned -EIO"); + goto out_tx; + } +- if (S_ISDIR(old_ip->i_mode)) ++ if (S_ISDIR(old_ip->i_mode) && old_dir != new_dir) + inc_nlink(new_dir); + } + /* +@@ -1242,7 +1242,9 @@ static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry, + goto out_tx; + } + if (S_ISDIR(old_ip->i_mode)) { +- drop_nlink(old_dir); ++ if (new_ip || old_dir != new_dir) ++ drop_nlink(old_dir); ++ + if (old_dir != new_dir) { + /* + * Change inode number of parent for moved directory +-- +2.51.0 + diff --git a/queue-5.10/m68k-nommu-fix-memmove-with-differently-aligned-src-.patch b/queue-5.10/m68k-nommu-fix-memmove-with-differently-aligned-src-.patch new file mode 100644 index 00000000000..7fded755261 --- /dev/null +++ b/queue-5.10/m68k-nommu-fix-memmove-with-differently-aligned-src-.patch @@ -0,0 +1,69 @@ +From 74cf5851efa314b7fd6243f4f53a9313cb4c0ef0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Dec 2025 21:04:01 +0900 +Subject: m68k: nommu: fix memmove() with differently aligned src and dest for + 68000 + +From: Daniel Palmer + +[ Upstream commit 590fe2f46c8698bb758f9002cb247ca10ce95569 ] + +68000 has different alignment needs to 68020+. +memcpy() checks if the destination is aligned and does a smaller copy +to fix the alignment and then critically for 68000 it checks if the +source is still unaligned and if it is reverts to smaller copies. + +memmove() does not currently do the second part and malfunctions if +one of the pointers is aligned and the other isn't. + +This is apparently getting triggered by printk. If I put breakpoints +into the new checks added by this commit the first hit looks like this: + +memmove (n=205, src=0x2f3971 , dest=0x2f3980 ) at arch/m68k/lib/memmove.c:82 + +Signed-off-by: Daniel Palmer +Signed-off-by: Greg Ungerer +Signed-off-by: Sasha Levin +--- + arch/m68k/lib/memmove.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/arch/m68k/lib/memmove.c b/arch/m68k/lib/memmove.c +index 6519f7f349f66..e33f00b02e4c0 100644 +--- a/arch/m68k/lib/memmove.c ++++ b/arch/m68k/lib/memmove.c +@@ -24,6 +24,15 @@ void *memmove(void *dest, const void *src, size_t n) + src = csrc; + n--; + } ++#if defined(CONFIG_M68000) ++ if ((long)src & 1) { ++ char *cdest = dest; ++ const char *csrc = src; ++ for (; n; n--) ++ *cdest++ = *csrc++; ++ return xdest; ++ } ++#endif + if (n > 2 && (long)dest & 2) { + short *sdest = dest; + const short *ssrc = src; +@@ -66,6 +75,15 @@ void *memmove(void *dest, const void *src, size_t n) + src = csrc; + n--; + } ++#if defined(CONFIG_M68000) ++ if ((long)src & 1) { ++ char *cdest = dest; ++ const char *csrc = src; ++ for (; n; n--) ++ *--cdest = *--csrc; ++ return xdest; ++ } ++#endif + if (n > 2 && (long)dest & 2) { + short *sdest = dest; + const short *ssrc = src; +-- +2.51.0 + diff --git a/queue-5.10/mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch b/queue-5.10/mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch new file mode 100644 index 00000000000..f3a2dde9af0 --- /dev/null +++ b/queue-5.10/mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch @@ -0,0 +1,66 @@ +From 331cf79cf18d5e4bf08c05571df5b41386249ae3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:24 +0100 +Subject: mailbox: bcm-ferxrm-mailbox: Use default primary handler + +From: Sebastian Andrzej Siewior + +[ Upstream commit 03843d95a4a4e0ba22ad4fcda65ccf21822b104c ] + +request_threaded_irq() is invoked with a primary and a secondary handler +and no flags are passed. The primary handler is the same as +irq_default_primary_handler() so there is no need to have an identical +copy. + +The lack of the IRQF_ONESHOT flag can be dangerous because the interrupt +source is not masked while the threaded handler is active. This means, +especially on LEVEL typed interrupt lines, the interrupt can fire again +before the threaded handler had a chance to run. + +Use the default primary interrupt handler by specifying NULL and set +IRQF_ONESHOT so the interrupt source is masked until the secondary handler +is done. + +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Thomas Gleixner +Link: https://patch.msgid.link/20260128095540.863589-5-bigeasy@linutronix.de +Signed-off-by: Sasha Levin +--- + drivers/mailbox/bcm-flexrm-mailbox.c | 14 ++------------ + 1 file changed, 2 insertions(+), 12 deletions(-) + +diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c +index e913ed1e34c63..5348ccba13079 100644 +--- a/drivers/mailbox/bcm-flexrm-mailbox.c ++++ b/drivers/mailbox/bcm-flexrm-mailbox.c +@@ -1183,14 +1183,6 @@ static int flexrm_debugfs_stats_show(struct seq_file *file, void *offset) + + /* ====== FlexRM interrupt handler ===== */ + +-static irqreturn_t flexrm_irq_event(int irq, void *dev_id) +-{ +- /* We only have MSI for completions so just wakeup IRQ thread */ +- /* Ring related errors will be informed via completion descriptors */ +- +- return IRQ_WAKE_THREAD; +-} +- + static irqreturn_t flexrm_irq_thread(int irq, void *dev_id) + { + flexrm_process_completions(dev_id); +@@ -1281,10 +1273,8 @@ static int flexrm_startup(struct mbox_chan *chan) + ret = -ENODEV; + goto fail_free_cmpl_memory; + } +- ret = request_threaded_irq(ring->irq, +- flexrm_irq_event, +- flexrm_irq_thread, +- 0, dev_name(ring->mbox->dev), ring); ++ ret = request_threaded_irq(ring->irq, NULL, flexrm_irq_thread, ++ IRQF_ONESHOT, dev_name(ring->mbox->dev), ring); + if (ret) { + dev_err(ring->mbox->dev, + "failed to request ring%d IRQ\n", ring->num); +-- +2.51.0 + diff --git a/queue-5.10/mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch b/queue-5.10/mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch new file mode 100644 index 00000000000..1544ff48165 --- /dev/null +++ b/queue-5.10/mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch @@ -0,0 +1,57 @@ +From 09c3000992e101305e38c0f7232348dc3b80032d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 16:43:36 +0100 +Subject: mailbox: sprd: clear delivery flag before handling TX done +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Otto Pflüger + +[ Upstream commit c77661d60d4223bf2ff10d409beb0c3b2021183b ] + +If there are any pending messages in the mailbox queue, they are sent +as soon as a TX done event arrives from the driver. This may trigger a +new delivery interrupt while the previous one is still being handled. +If the delivery status is cleared after this, the interrupt is lost. +To prevent this from happening, clear the delivery status immediately +after checking it and before any new messages are sent. + +Signed-off-by: Otto Pflüger +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/sprd-mailbox.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c +index 94d9067dc8d09..96b7fc706bb9f 100644 +--- a/drivers/mailbox/sprd-mailbox.c ++++ b/drivers/mailbox/sprd-mailbox.c +@@ -149,6 +149,11 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data) + return IRQ_NONE; + } + ++ /* Clear FIFO delivery and overflow status first */ ++ writel(fifo_sts & ++ (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK), ++ priv->inbox_base + SPRD_MBOX_FIFO_RST); ++ + while (send_sts) { + id = __ffs(send_sts); + send_sts &= (send_sts - 1); +@@ -164,11 +169,6 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data) + mbox_chan_txdone(chan, 0); + } + +- /* Clear FIFO delivery and overflow status */ +- writel(fifo_sts & +- (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK), +- priv->inbox_base + SPRD_MBOX_FIFO_RST); +- + /* Clear irq status */ + writel(SPRD_MBOX_IRQ_CLR, priv->inbox_base + SPRD_MBOX_IRQ_STS); + +-- +2.51.0 + diff --git a/queue-5.10/media-adv7180-fix-frame-interval-in-progressive-mode.patch b/queue-5.10/media-adv7180-fix-frame-interval-in-progressive-mode.patch new file mode 100644 index 00000000000..61064ae8edf --- /dev/null +++ b/queue-5.10/media-adv7180-fix-frame-interval-in-progressive-mode.patch @@ -0,0 +1,49 @@ +From faeddfdd9e531c2c5b1905b448df037c5737b153 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 15:29:57 +0100 +Subject: media: adv7180: fix frame interval in progressive mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thorsten Schmelzer + +[ Upstream commit 90289b67c5c1d4c18784059b27460d292e16d208 ] + +The ADV7280-M may internally convert interlaced video input to +progressive video. If this mode is enabled, the ADV7280-M delivers +progressive video frames at the field rate of 50 fields per second (PAL) +or 60 fields per second (NTSC). + +Fix the reported frame interval if progressive video is enabled. + +Signed-off-by: Thorsten Schmelzer +Reviewed-by: Niklas Söderlund +Signed-off-by: Michael Tretter +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/adv7180.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c +index 4498d14d34291..2d689357f156c 100644 +--- a/drivers/media/i2c/adv7180.c ++++ b/drivers/media/i2c/adv7180.c +@@ -468,6 +468,13 @@ static int adv7180_g_frame_interval(struct v4l2_subdev *sd, + fi->interval.denominator = 25; + } + ++ /* ++ * If the de-interlacer is active, the chip produces full video frames ++ * at the field rate. ++ */ ++ if (state->field == V4L2_FIELD_NONE) ++ fi->interval.denominator *= 2; ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-5.10/media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch b/queue-5.10/media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch new file mode 100644 index 00000000000..9065731813c --- /dev/null +++ b/queue-5.10/media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch @@ -0,0 +1,34 @@ +From 9b62f853cec64cf8b7e1743c3caae4f8cac535fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Jan 2026 15:46:47 +0800 +Subject: media: cx25821: Fix a resource leak in cx25821_dev_setup() + +From: Haoxiang Li + +[ Upstream commit 68cd8ac994cac38a305200f638b30e13c690753b ] + +Add release_mem_region() if ioremap() fails to release the memory +region obtained by cx25821_get_resources(). + +Signed-off-by: Haoxiang Li +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/cx25821/cx25821-core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c +index a3d45287a5343..5b823124ff28b 100644 +--- a/drivers/media/pci/cx25821/cx25821-core.c ++++ b/drivers/media/pci/cx25821/cx25821-core.c +@@ -915,6 +915,7 @@ static int cx25821_dev_setup(struct cx25821_dev *dev) + + if (!dev->lmmio) { + CX25821_ERR("ioremap failed, maybe increasing __VMALLOC_RESERVE in page.h\n"); ++ release_mem_region(dev->base_io_addr, pci_resource_len(dev->pci, 0)); + cx25821_iounmap(dev); + return -ENOMEM; + } +-- +2.51.0 + diff --git a/queue-5.10/media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch b/queue-5.10/media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch new file mode 100644 index 00000000000..fbeb3acb6af --- /dev/null +++ b/queue-5.10/media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch @@ -0,0 +1,110 @@ +From 78acb4b22eb85582cfd9f6a0fd0dff799a629c08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Jun 2025 08:57:35 +0200 +Subject: media: dvb-core: dmxdevfilter must always flush bufs + +From: Hans Verkuil + +[ Upstream commit c4e620eccbef76aa5564ebb295e23d6540e27215 ] + +Currently the buffers are being filled until full, which works fine +for the transport stream, but not when reading sections, those have +to be returned to userspace immediately, otherwise dvbv5-scan will +just wait forever. + +Add a 'flush' argument to dvb_vb2_fill_buffer to indicate whether +the buffer must be flushed or wait until it is full. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-core/dmxdev.c | 8 ++++---- + drivers/media/dvb-core/dvb_vb2.c | 5 +++-- + include/media/dvb_vb2.h | 6 ++++-- + 3 files changed, 11 insertions(+), 8 deletions(-) + +diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c +index 12b7f698f5623..71651086bc4d8 100644 +--- a/drivers/media/dvb-core/dmxdev.c ++++ b/drivers/media/dvb-core/dmxdev.c +@@ -406,11 +406,11 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len, + if (dvb_vb2_is_streaming(&dmxdevfilter->vb2_ctx)) { + ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx, + buffer1, buffer1_len, +- buffer_flags); ++ buffer_flags, true); + if (ret == buffer1_len) + ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx, + buffer2, buffer2_len, +- buffer_flags); ++ buffer_flags, true); + } else { + ret = dvb_dmxdev_buffer_write(&dmxdevfilter->buffer, + buffer1, buffer1_len); +@@ -461,10 +461,10 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len, + + if (dvb_vb2_is_streaming(ctx)) { + ret = dvb_vb2_fill_buffer(ctx, buffer1, buffer1_len, +- buffer_flags); ++ buffer_flags, false); + if (ret == buffer1_len) + ret = dvb_vb2_fill_buffer(ctx, buffer2, buffer2_len, +- buffer_flags); ++ buffer_flags, false); + } else { + if (buffer->error) { + spin_unlock(&dmxdevfilter->dev->lock); +diff --git a/drivers/media/dvb-core/dvb_vb2.c b/drivers/media/dvb-core/dvb_vb2.c +index 1331f2c2237e6..c1aaa0b46c37e 100644 +--- a/drivers/media/dvb-core/dvb_vb2.c ++++ b/drivers/media/dvb-core/dvb_vb2.c +@@ -256,7 +256,8 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx) + + int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx, + const unsigned char *src, int len, +- enum dmx_buffer_flags *buffer_flags) ++ enum dmx_buffer_flags *buffer_flags, ++ bool flush) + { + unsigned long flags = 0; + void *vbuf = NULL; +@@ -313,7 +314,7 @@ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx, + } + } + +- if (ctx->nonblocking && ctx->buf) { ++ if (flush && ctx->buf) { + vb2_set_plane_payload(&ctx->buf->vb, 0, ll); + vb2_buffer_done(&ctx->buf->vb, VB2_BUF_STATE_DONE); + list_del(&ctx->buf->list); +diff --git a/include/media/dvb_vb2.h b/include/media/dvb_vb2.h +index 8cb88452cd6c2..0fbbfc65157e6 100644 +--- a/include/media/dvb_vb2.h ++++ b/include/media/dvb_vb2.h +@@ -124,7 +124,7 @@ static inline int dvb_vb2_release(struct dvb_vb2_ctx *ctx) + return 0; + }; + #define dvb_vb2_is_streaming(ctx) (0) +-#define dvb_vb2_fill_buffer(ctx, file, wait, flags) (0) ++#define dvb_vb2_fill_buffer(ctx, file, wait, flags, flush) (0) + + static inline __poll_t dvb_vb2_poll(struct dvb_vb2_ctx *ctx, + struct file *file, +@@ -166,10 +166,12 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx); + * @buffer_flags: + * pointer to buffer flags as defined by &enum dmx_buffer_flags. + * can be NULL. ++ * @flush: flush the buffer, even if it isn't full. + */ + int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx, + const unsigned char *src, int len, +- enum dmx_buffer_flags *buffer_flags); ++ enum dmx_buffer_flags *buffer_flags, ++ bool flush); + + /** + * dvb_vb2_poll - Wrapper to vb2_core_streamon() for Digital TV +-- +2.51.0 + diff --git a/queue-5.10/media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch b/queue-5.10/media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch new file mode 100644 index 00000000000..9ed59b27b49 --- /dev/null +++ b/queue-5.10/media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch @@ -0,0 +1,53 @@ +From 7438439ce5805119d37bbd0aabc680bc4fb78d33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Oct 2025 15:26:40 +0200 +Subject: media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes + +From: Hans Verkuil + +[ Upstream commit 44c03802a5191626996ee9db4bac090b164ca340 ] + +The isp_video_mbus_to_pix/pix_to_mbus functions did not take +the last empty entry { 0, } of the formats array into account. + +As a result, isp_video_mbus_to_pix would accept code 0 and +isp_video_pix_to_mbus would select code 0 if no match was found. + +Signed-off-by: Hans Verkuil +Acked-by: Sakari Ailus +Signed-off-by: Sasha Levin +--- + drivers/media/platform/omap3isp/ispvideo.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/omap3isp/ispvideo.c b/drivers/media/platform/omap3isp/ispvideo.c +index 8811d6dd4ee74..f7e1ef11cdc4a 100644 +--- a/drivers/media/platform/omap3isp/ispvideo.c ++++ b/drivers/media/platform/omap3isp/ispvideo.c +@@ -148,12 +148,12 @@ static unsigned int isp_video_mbus_to_pix(const struct isp_video *video, + pix->width = mbus->width; + pix->height = mbus->height; + +- for (i = 0; i < ARRAY_SIZE(formats); ++i) { ++ for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) { + if (formats[i].code == mbus->code) + break; + } + +- if (WARN_ON(i == ARRAY_SIZE(formats))) ++ if (WARN_ON(i == ARRAY_SIZE(formats) - 1)) + return 0; + + min_bpl = pix->width * formats[i].bpp; +@@ -191,7 +191,7 @@ static void isp_video_pix_to_mbus(const struct v4l2_pix_format *pix, + /* Skip the last format in the loop so that it will be selected if no + * match is found. + */ +- for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) { ++ for (i = 0; i < ARRAY_SIZE(formats) - 2; ++i) { + if (formats[i].pixelformat == pix->pixelformat) + break; + } +-- +2.51.0 + diff --git a/queue-5.10/media-omap3isp-isppreview-always-clamp-in-preview_tr.patch b/queue-5.10/media-omap3isp-isppreview-always-clamp-in-preview_tr.patch new file mode 100644 index 00000000000..8c64c82ab3f --- /dev/null +++ b/queue-5.10/media-omap3isp-isppreview-always-clamp-in-preview_tr.patch @@ -0,0 +1,63 @@ +From 72f263d6b6efcb1a4c87070b0494eb0f2511a5e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 17:09:18 +0200 +Subject: media: omap3isp: isppreview: always clamp in preview_try_format() + +From: Hans Verkuil + +[ Upstream commit 17e1e1641f74a89824d4de3aa38c78daa5686cc1 ] + +If prev->input != PREVIEW_INPUT_MEMORY the width and height weren't +clamped. Just always clamp. + +This fixes a v4l2-compliance error: + + fail: v4l2-test-subdevs.cpp(171): fse.max_width == ~0U || fse.max_height == ~0U + fail: v4l2-test-subdevs.cpp(270): ret && ret != ENOTTY +test Try VIDIOC_SUBDEV_ENUM_MBUS_CODE/FRAME_SIZE/FRAME_INTERVAL: FAIL + +Signed-off-by: Hans Verkuil +Acked-by: Sakari Ailus +Signed-off-by: Sasha Levin +--- + drivers/media/platform/omap3isp/isppreview.c | 21 ++++++++------------ + 1 file changed, 8 insertions(+), 13 deletions(-) + +diff --git a/drivers/media/platform/omap3isp/isppreview.c b/drivers/media/platform/omap3isp/isppreview.c +index 607b7685c982f..64c7553bef2f9 100644 +--- a/drivers/media/platform/omap3isp/isppreview.c ++++ b/drivers/media/platform/omap3isp/isppreview.c +@@ -1739,22 +1739,17 @@ static void preview_try_format(struct isp_prev_device *prev, + + switch (pad) { + case PREV_PAD_SINK: +- /* When reading data from the CCDC, the input size has already +- * been mangled by the CCDC output pad so it can be accepted +- * as-is. +- * +- * When reading data from memory, clamp the requested width and +- * height. The TRM doesn't specify a minimum input height, make ++ /* ++ * Clamp the requested width and height. ++ * The TRM doesn't specify a minimum input height, make + * sure we got enough lines to enable the noise filter and color + * filter array interpolation. + */ +- if (prev->input == PREVIEW_INPUT_MEMORY) { +- fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH, +- preview_max_out_width(prev)); +- fmt->height = clamp_t(u32, fmt->height, +- PREV_MIN_IN_HEIGHT, +- PREV_MAX_IN_HEIGHT); +- } ++ fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH, ++ preview_max_out_width(prev)); ++ fmt->height = clamp_t(u32, fmt->height, ++ PREV_MIN_IN_HEIGHT, ++ PREV_MAX_IN_HEIGHT); + + fmt->colorspace = V4L2_COLORSPACE_SRGB; + +-- +2.51.0 + diff --git a/queue-5.10/media-omap3isp-set-initial-format.patch b/queue-5.10/media-omap3isp-set-initial-format.patch new file mode 100644 index 00000000000..0fd3352e5db --- /dev/null +++ b/queue-5.10/media-omap3isp-set-initial-format.patch @@ -0,0 +1,51 @@ +From 5048683b3eccf890f74f60e4be0e5889f0d63e2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Apr 2025 09:21:53 +0200 +Subject: media: omap3isp: set initial format + +From: Hans Verkuil + +[ Upstream commit 7575b8dfa91f82fcb34ffd5568ff415ac4685794 ] + +Initialize the v4l2_format to a default. Empty formats are +not allowed in V4L2, so this fixes v4l2-compliance issues: + + fail: v4l2-test-formats.cpp(514): !pix.width || !pix.height +test VIDIOC_G_FMT: FAIL + +Signed-off-by: Hans Verkuil +Acked-by: Sakari Ailus +Signed-off-by: Sasha Levin +--- + drivers/media/platform/omap3isp/ispvideo.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/media/platform/omap3isp/ispvideo.c b/drivers/media/platform/omap3isp/ispvideo.c +index f7e1ef11cdc4a..3304457716450 100644 +--- a/drivers/media/platform/omap3isp/ispvideo.c ++++ b/drivers/media/platform/omap3isp/ispvideo.c +@@ -1293,6 +1293,7 @@ static const struct v4l2_ioctl_ops isp_video_ioctl_ops = { + static int isp_video_open(struct file *file) + { + struct isp_video *video = video_drvdata(file); ++ struct v4l2_mbus_framefmt fmt; + struct isp_video_fh *handle; + struct vb2_queue *queue; + int ret = 0; +@@ -1334,6 +1335,13 @@ static int isp_video_open(struct file *file) + + memset(&handle->format, 0, sizeof(handle->format)); + handle->format.type = video->type; ++ handle->format.fmt.pix.width = 720; ++ handle->format.fmt.pix.height = 480; ++ handle->format.fmt.pix.pixelformat = V4L2_PIX_FMT_UYVY; ++ handle->format.fmt.pix.field = V4L2_FIELD_NONE; ++ handle->format.fmt.pix.colorspace = V4L2_COLORSPACE_SRGB; ++ isp_video_pix_to_mbus(&handle->format.fmt.pix, &fmt); ++ isp_video_mbus_to_pix(video, &fmt, &handle->format.fmt.pix); + handle->timeperframe.denominator = 1; + + handle->video = video; +-- +2.51.0 + diff --git a/queue-5.10/media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch b/queue-5.10/media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch new file mode 100644 index 00000000000..4537d405420 --- /dev/null +++ b/queue-5.10/media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch @@ -0,0 +1,48 @@ +From 98a85f66a3cbb52e101d08090727d5e1861a3ff3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Dec 2025 19:24:19 +0100 +Subject: media: pvrusb2: fix URB leak in pvr2_send_request_ex + +From: Szymon Wilczek + +[ Upstream commit a8333c8262aed2aedf608c18edd39cf5342680a7 ] + +When pvr2_send_request_ex() submits a write URB successfully but fails to +submit the read URB (e.g. returns -ENOMEM), it returns immediately without +waiting for the write URB to complete. Since the driver reuses the same +URB structure, a subsequent call to pvr2_send_request_ex() attempts to +submit the still-active write URB, triggering a 'URB submitted while +active' warning in usb_submit_urb(). + +Fix this by ensuring the write URB is unlinked and waited upon if the read +URB submission fails. + +Reported-by: syzbot+405dcd13121ff75a9e16@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=405dcd13121ff75a9e16 +Signed-off-by: Szymon Wilczek +Acked-by: Mike Isely +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +index 10c21580a827b..fc7eb59aa2c80 100644 +--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c ++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +@@ -3704,6 +3704,11 @@ status); + "Failed to submit read-control URB status=%d", + status); + hdw->ctl_read_pend_flag = 0; ++ if (hdw->ctl_write_pend_flag) { ++ usb_unlink_urb(hdw->ctl_write_urb); ++ while (hdw->ctl_write_pend_flag) ++ wait_for_completion(&hdw->ctl_done); ++ } + goto done; + } + } +-- +2.51.0 + diff --git a/queue-5.10/media-solo6x10-check-for-out-of-bounds-chip_id.patch b/queue-5.10/media-solo6x10-check-for-out-of-bounds-chip_id.patch new file mode 100644 index 00000000000..bdf471b02c5 --- /dev/null +++ b/queue-5.10/media-solo6x10-check-for-out-of-bounds-chip_id.patch @@ -0,0 +1,68 @@ +From f49957ffeb36468762e282f26b3e3652f9390c38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 19:00:35 -0800 +Subject: media: solo6x10: Check for out of bounds chip_id + +From: Kees Cook + +[ Upstream commit 0fdf6323c35a134f206dcad5babb4ff488552076 ] + +Clang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type +(literal "1" is an "int") could end up being shifted beyond 32 bits, +so instrumentation was added (and due to the double is_tw286x() call +seen via inlining), Clang decides the second one must now be undefined +behavior and elides the rest of the function[1]. This is a known problem +with Clang (that is still being worked on), but we can avoid the entire +problem by actually checking the existing max chip ID, and now there is +no runtime instrumentation added at all since everything is known to be +within bounds. + +Additionally use an unsigned value for the shift to remove the +instrumentation even without the explicit bounds checking. + +Link: https://github.com/ClangBuiltLinux/linux/issues/2144 [1] +Suggested-by: Nathan Chancellor +Signed-off-by: Kees Cook +Signed-off-by: Hans Verkuil +[hverkuil: fix checkpatch warning for is_tw286x] +Signed-off-by: Sasha Levin +--- + drivers/media/pci/solo6x10/solo6x10-tw28.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/pci/solo6x10/solo6x10-tw28.c b/drivers/media/pci/solo6x10/solo6x10-tw28.c +index 1b7c22a9bc94f..8f53946c67928 100644 +--- a/drivers/media/pci/solo6x10/solo6x10-tw28.c ++++ b/drivers/media/pci/solo6x10/solo6x10-tw28.c +@@ -166,7 +166,7 @@ static const u8 tbl_tw2865_pal_template[] = { + 0x64, 0x51, 0x40, 0xaf, 0xFF, 0xF0, 0x00, 0xC0, + }; + +-#define is_tw286x(__solo, __id) (!(__solo->tw2815 & (1 << __id))) ++#define is_tw286x(__solo, __id) (!((__solo)->tw2815 & (1U << (__id)))) + + static u8 tw_readbyte(struct solo_dev *solo_dev, int chip_id, u8 tw6x_off, + u8 tw_off) +@@ -686,6 +686,9 @@ int tw28_set_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch, + chip_num = ch / 4; + ch %= 4; + ++ if (chip_num >= TW_NUM_CHIP) ++ return -EINVAL; ++ + if (val > 255 || val < 0) + return -ERANGE; + +@@ -758,6 +761,9 @@ int tw28_get_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch, + chip_num = ch / 4; + ch %= 4; + ++ if (chip_num >= TW_NUM_CHIP) ++ return -EINVAL; ++ + switch (ctrl) { + case V4L2_CID_SHARPNESS: + /* Only 286x has sharpness */ +-- +2.51.0 + diff --git a/queue-5.10/minix-add-required-sanity-checking-to-minix_check_su.patch b/queue-5.10/minix-add-required-sanity-checking-to-minix_check_su.patch new file mode 100644 index 00000000000..dfee1bdba04 --- /dev/null +++ b/queue-5.10/minix-add-required-sanity-checking-to-minix_check_su.patch @@ -0,0 +1,103 @@ +From 4890b94166b5d800baba31343051a46c73b35134 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 16:39:47 +0100 +Subject: minix: Add required sanity checking to minix_check_superblock() + +From: Jori Koolstra + +[ Upstream commit 8c97a6ddc95690a938ded44b4e3202f03f15078c ] + +The fs/minix implementation of the minix filesystem does not currently +support any other value for s_log_zone_size than 0. This is also the +only value supported in util-linux; see mkfs.minix.c line 511. In +addition, this patch adds some sanity checking for the other minix +superblock fields, and moves the minix_blocks_needed() checks for the +zmap and imap also to minix_check_super_block(). + +This also closes a related syzbot bug report. + +Signed-off-by: Jori Koolstra +Link: https://patch.msgid.link/20251208153947.108343-1-jkoolstra@xs4all.nl +Reviewed-by: Jan Kara +Reported-by: syzbot+5ad0824204c7bf9b67f2@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=5ad0824204c7bf9b67f2 +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/minix/inode.c | 50 ++++++++++++++++++++++++++++-------------------- + 1 file changed, 29 insertions(+), 21 deletions(-) + +diff --git a/fs/minix/inode.c b/fs/minix/inode.c +index 7636e789eb49b..5b2056d00121f 100644 +--- a/fs/minix/inode.c ++++ b/fs/minix/inode.c +@@ -153,10 +153,38 @@ static int minix_remount (struct super_block * sb, int * flags, char * data) + static bool minix_check_superblock(struct super_block *sb) + { + struct minix_sb_info *sbi = minix_sb(sb); ++ unsigned long block; + +- if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0) ++ if (sbi->s_log_zone_size != 0) { ++ printk("minix-fs error: zone size must equal block size. " ++ "s_log_zone_size > 0 is not supported.\n"); ++ return false; ++ } ++ ++ if (sbi->s_ninodes < 1 || sbi->s_firstdatazone <= 4 || ++ sbi->s_firstdatazone >= sbi->s_nzones) + return false; + ++ /* Apparently minix can create filesystems that allocate more blocks for ++ * the bitmaps than needed. We simply ignore that, but verify it didn't ++ * create one with not enough blocks and bail out if so. ++ */ ++ block = minix_blocks_needed(sbi->s_ninodes, sb->s_blocksize); ++ if (sbi->s_imap_blocks < block) { ++ printk("MINIX-fs: file system does not have enough " ++ "imap blocks allocated. Refusing to mount.\n"); ++ return false; ++ } ++ ++ block = minix_blocks_needed( ++ (sbi->s_nzones - sbi->s_firstdatazone + 1), ++ sb->s_blocksize); ++ if (sbi->s_zmap_blocks < block) { ++ printk("MINIX-fs: file system does not have enough " ++ "zmap blocks allocated. Refusing to mount.\n"); ++ return false; ++ } ++ + /* + * s_max_size must not exceed the block mapping limitation. This check + * is only needed for V1 filesystems, since V2/V3 support an extra level +@@ -275,26 +303,6 @@ static int minix_fill_super(struct super_block *s, void *data, int silent) + minix_set_bit(0,sbi->s_imap[0]->b_data); + minix_set_bit(0,sbi->s_zmap[0]->b_data); + +- /* Apparently minix can create filesystems that allocate more blocks for +- * the bitmaps than needed. We simply ignore that, but verify it didn't +- * create one with not enough blocks and bail out if so. +- */ +- block = minix_blocks_needed(sbi->s_ninodes, s->s_blocksize); +- if (sbi->s_imap_blocks < block) { +- printk("MINIX-fs: file system does not have enough " +- "imap blocks allocated. Refusing to mount.\n"); +- goto out_no_bitmap; +- } +- +- block = minix_blocks_needed( +- (sbi->s_nzones - sbi->s_firstdatazone + 1), +- s->s_blocksize); +- if (sbi->s_zmap_blocks < block) { +- printk("MINIX-fs: file system does not have enough " +- "zmap blocks allocated. Refusing to mount.\n"); +- goto out_no_bitmap; +- } +- + /* set up enough so that it can read an inode */ + s->s_op = &minix_sops; + s->s_time_min = 0; +-- +2.51.0 + diff --git a/queue-5.10/mips-loongson-make-cpumask_of_node-robust-against-nu.patch b/queue-5.10/mips-loongson-make-cpumask_of_node-robust-against-nu.patch new file mode 100644 index 00000000000..0a17bddb30c --- /dev/null +++ b/queue-5.10/mips-loongson-make-cpumask_of_node-robust-against-nu.patch @@ -0,0 +1,36 @@ +From 8f46db843b5b21ff68ba5f2187a469d3f29377fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 09:40:06 +0000 +Subject: MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE + +From: John Garry + +[ Upstream commit d55d3fe2d1470ac5b6e93efe7998b728013c9fc8 ] + +The arch definition of cpumask_of_node() cannot handle NUMA_NO_NODE - which +is a valid index - so add a check for this. + +Signed-off-by: John Garry +Reviewed-by: Huacai Chen +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/mach-loongson64/topology.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/include/asm/mach-loongson64/topology.h b/arch/mips/include/asm/mach-loongson64/topology.h +index 3414a1fd17835..89bb4deab98a6 100644 +--- a/arch/mips/include/asm/mach-loongson64/topology.h ++++ b/arch/mips/include/asm/mach-loongson64/topology.h +@@ -7,7 +7,7 @@ + #define cpu_to_node(cpu) (cpu_logical_map(cpu) >> 2) + + extern cpumask_t __node_cpumask[]; +-#define cpumask_of_node(node) (&__node_cpumask[node]) ++#define cpumask_of_node(node) ((node) == NUMA_NO_NODE ? cpu_all_mask : &__node_cpumask[node]) + + struct pci_bus; + extern int pcibus_to_node(struct pci_bus *); +-- +2.51.0 + diff --git a/queue-5.10/modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch b/queue-5.10/modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch new file mode 100644 index 00000000000..67297900d13 --- /dev/null +++ b/queue-5.10/modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch @@ -0,0 +1,56 @@ +From 5197468aa5ef4d2d003e434c2821d5d3bd4c95a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Nov 2025 13:13:30 +0100 +Subject: modpost: Amend ppc64 save/restfpr symnames for -Os build +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: René Rebe + +[ Upstream commit 3cd9763ce4ad999d015cf0734e6b968cead95077 ] + +Building a size optimized ppc64 kernel (-Os), gcc emits more FP +save/restore symbols, that the linker generates on demand into the +.sfpr section. Explicitly allow-list those in scripts/mod/modpost.c, +too. They are needed for the amdgpu in-kernel floating point support. + +MODPOST Module.symvers +ERROR: modpost: "_restfpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_26" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savegpr1_27" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savegpr1_25" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_28" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savegpr1_29" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savefpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savefpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_15" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +WARNING: modpost: suppressed 56 unresolved symbol warnings because there were too many) + +Signed-off-by: René Rebe +Link: https://patch.msgid.link/20251123.131330.407910684435629198.rene@exactco.de +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + scripts/mod/modpost.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index fd77ac48dcc17..379d03d0c5e6d 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -668,6 +668,10 @@ static int ignore_undef_symbol(struct elf_info *info, const char *symname) + /* Special register function linked on all modules during final link of .ko */ + if (strstarts(symname, "_restgpr0_") || + strstarts(symname, "_savegpr0_") || ++ strstarts(symname, "_restgpr1_") || ++ strstarts(symname, "_savegpr1_") || ++ strstarts(symname, "_restfpr_") || ++ strstarts(symname, "_savefpr_") || + strstarts(symname, "_restvr_") || + strstarts(symname, "_savevr_") || + strcmp(symname, ".TOC.") == 0) +-- +2.51.0 + diff --git a/queue-5.10/myri10ge-avoid-uninitialized-variable-use.patch b/queue-5.10/myri10ge-avoid-uninitialized-variable-use.patch new file mode 100644 index 00000000000..e3990058c01 --- /dev/null +++ b/queue-5.10/myri10ge-avoid-uninitialized-variable-use.patch @@ -0,0 +1,162 @@ +From b2bc7815774ecddf7efe95caebef3c6a0eb222b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Feb 2026 17:28:09 +0100 +Subject: myri10ge: avoid uninitialized variable use + +From: Arnd Bergmann + +[ Upstream commit fd24173439c033ffb3c2a2628fcbc9cb65e62bdb ] + +While compile testing on less common architectures, I noticed that gcc-10 on +s390 finds a bug that all other configurations seem to miss: + +drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_set_multicast_list': +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:391:25: error: 'cmd.data0' is used uninitialized in this function [-Werror=uninitialized] + 391 | buf->data0 = htonl(data->data0); + | ^~ +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:25: error: '*((void *)&cmd+4)' is used uninitialized in this function [-Werror=uninitialized] + 392 | buf->data1 = htonl(data->data1); + | ^~ +drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_allocate_rings': +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:13: error: 'cmd.data1' is used uninitialized in this function [-Werror=uninitialized] + 392 | buf->data1 = htonl(data->data1); +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data1' was declared here + 1939 | struct myri10ge_cmd cmd; + | ^~~ +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:393:13: error: 'cmd.data2' is used uninitialized in this function [-Werror=uninitialized] + 393 | buf->data2 = htonl(data->data2); +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data2' was declared here + 1939 | struct myri10ge_cmd cmd; + +It would be nice to understand how to make other compilers catch this as +well, but for the moment I'll just shut up the warning by fixing the +undefined behavior in this driver. + +Signed-off-by: Arnd Bergmann +Link: https://patch.msgid.link/20260205162935.2126442-1-arnd@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/myricom/myri10ge/myri10ge.c | 28 ++++++++++++++++++- + 1 file changed, 27 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c +index 5a1ed4818baac..28857053f7514 100644 +--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c ++++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c +@@ -688,6 +688,9 @@ static int myri10ge_get_firmware_capabilities(struct myri10ge_priv *mgp) + + /* probe for IPv6 TSO support */ + mgp->features = NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_TSO; ++ cmd.data0 = 0, ++ cmd.data1 = 0, ++ cmd.data2 = 0, + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_MAX_TSO6_HDR_SIZE, + &cmd, 0); + if (status == 0) { +@@ -805,6 +808,7 @@ static int myri10ge_update_mac_address(struct myri10ge_priv *mgp, u8 * addr) + | (addr[2] << 8) | addr[3]); + + cmd.data1 = ((addr[4] << 8) | (addr[5])); ++ cmd.data2 = 0; + + status = myri10ge_send_cmd(mgp, MXGEFW_SET_MAC_ADDRESS, &cmd, 0); + return status; +@@ -816,6 +820,9 @@ static int myri10ge_change_pause(struct myri10ge_priv *mgp, int pause) + int status, ctl; + + ctl = pause ? MXGEFW_ENABLE_FLOW_CONTROL : MXGEFW_DISABLE_FLOW_CONTROL; ++ cmd.data0 = 0, ++ cmd.data1 = 0, ++ cmd.data2 = 0, + status = myri10ge_send_cmd(mgp, ctl, &cmd, 0); + + if (status) { +@@ -833,6 +840,9 @@ myri10ge_change_promisc(struct myri10ge_priv *mgp, int promisc, int atomic) + int status, ctl; + + ctl = promisc ? MXGEFW_ENABLE_PROMISC : MXGEFW_DISABLE_PROMISC; ++ cmd.data0 = 0; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, ctl, &cmd, atomic); + if (status) + netdev_err(mgp->dev, "Failed to set promisc mode\n"); +@@ -1938,6 +1948,8 @@ static int myri10ge_allocate_rings(struct myri10ge_slice_state *ss) + /* get ring sizes */ + slice = ss - mgp->ss; + cmd.data0 = slice; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_RING_SIZE, &cmd, 0); + tx_ring_size = cmd.data0; + cmd.data0 = slice; +@@ -2230,12 +2242,16 @@ static int myri10ge_get_txrx(struct myri10ge_priv *mgp, int slice) + status = 0; + if (slice == 0 || (mgp->dev->real_num_tx_queues > 1)) { + cmd.data0 = slice; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_OFFSET, + &cmd, 0); + ss->tx.lanai = (struct mcp_kreq_ether_send __iomem *) + (mgp->sram + cmd.data0); + } + cmd.data0 = slice; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status |= myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SMALL_RX_OFFSET, + &cmd, 0); + ss->rx_small.lanai = (struct mcp_kreq_ether_recv __iomem *) +@@ -2304,6 +2320,7 @@ static int myri10ge_open(struct net_device *dev) + if (mgp->num_slices > 1) { + cmd.data0 = mgp->num_slices; + cmd.data1 = MXGEFW_SLICE_INTR_MODE_ONE_PER_SLICE; ++ cmd.data2 = 0; + if (mgp->dev->real_num_tx_queues > 1) + cmd.data1 |= MXGEFW_SLICE_ENABLE_MULTIPLE_TX_QUEUES; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_ENABLE_RSS_QUEUES, +@@ -2406,6 +2423,8 @@ static int myri10ge_open(struct net_device *dev) + + /* now give firmware buffers sizes, and MTU */ + cmd.data0 = dev->mtu + ETH_HLEN + VLAN_HLEN; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_SET_MTU, &cmd, 0); + cmd.data0 = mgp->small_bytes; + status |= +@@ -2464,7 +2483,6 @@ static int myri10ge_open(struct net_device *dev) + static int myri10ge_close(struct net_device *dev) + { + struct myri10ge_priv *mgp = netdev_priv(dev); +- struct myri10ge_cmd cmd; + int status, old_down_cnt; + int i; + +@@ -2483,8 +2501,13 @@ static int myri10ge_close(struct net_device *dev) + + netif_tx_stop_all_queues(dev); + if (mgp->rebooted == 0) { ++ struct myri10ge_cmd cmd; ++ + old_down_cnt = mgp->down_cnt; + mb(); ++ cmd.data0 = 0; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = + myri10ge_send_cmd(mgp, MXGEFW_CMD_ETHERNET_DOWN, &cmd, 0); + if (status) +@@ -2948,6 +2971,9 @@ static void myri10ge_set_multicast_list(struct net_device *dev) + + /* Disable multicast filtering */ + ++ cmd.data0 = 0; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + err = myri10ge_send_cmd(mgp, MXGEFW_ENABLE_ALLMULTI, &cmd, 1); + if (err != 0) { + netdev_err(dev, "Failed MXGEFW_ENABLE_ALLMULTI, error status: %d\n", +-- +2.51.0 + diff --git a/queue-5.10/net-rds-clear-reconnect-pending-bit.patch b/queue-5.10/net-rds-clear-reconnect-pending-bit.patch new file mode 100644 index 00000000000..8e26de52880 --- /dev/null +++ b/queue-5.10/net-rds-clear-reconnect-pending-bit.patch @@ -0,0 +1,42 @@ +From c7e18dacaa034f7dff05a30c067117dfa938f617 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 22:57:20 -0700 +Subject: net/rds: Clear reconnect pending bit +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: HÃ¥kon Bugge + +[ Upstream commit b89fc7c2523b2b0750d91840f4e52521270d70ed ] + +When canceling the reconnect worker, care must be taken to reset the +reconnect-pending bit. If the reconnect worker has not yet been +scheduled before it is canceled, the reconnect-pending bit will stay +on forever. + +Signed-off-by: HÃ¥kon Bugge +Signed-off-by: Allison Henderson +Link: https://patch.msgid.link/20260203055723.1085751-6-achender@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/rds/connection.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/rds/connection.c b/net/rds/connection.c +index 00bda534b9ce2..98c0d5ff9de9c 100644 +--- a/net/rds/connection.c ++++ b/net/rds/connection.c +@@ -428,6 +428,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp) + * to the conn hash, so we never trigger a reconnect on this + * conn - the reconnect is always triggered by the active peer. */ + cancel_delayed_work_sync(&cp->cp_conn_w); ++ ++ clear_bit(RDS_RECONNECT_PENDING, &cp->cp_flags); + rcu_read_lock(); + if (!hlist_unhashed(&conn->c_hash_node)) { + rcu_read_unlock(); +-- +2.51.0 + diff --git a/queue-5.10/net-rds-no-shortcut-out-of-rds_conn_error.patch b/queue-5.10/net-rds-no-shortcut-out-of-rds_conn_error.patch new file mode 100644 index 00000000000..3058b3ad6f1 --- /dev/null +++ b/queue-5.10/net-rds-no-shortcut-out-of-rds_conn_error.patch @@ -0,0 +1,92 @@ +From 43a19868dffba07f7abbc2908b5d335d2633fd2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jan 2026 22:52:12 -0700 +Subject: net/rds: No shortcut out of RDS_CONN_ERROR + +From: Gerd Rausch + +[ Upstream commit ad22d24be635c6beab6a1fdd3f8b1f3c478d15da ] + +RDS connections carry a state "rds_conn_path::cp_state" +and transitions from one state to another and are conditional +upon an expected state: "rds_conn_path_transition." + +There is one exception to this conditionality, which is +"RDS_CONN_ERROR" that can be enforced by "rds_conn_path_drop" +regardless of what state the condition is currently in. + +But as soon as a connection enters state "RDS_CONN_ERROR", +the connection handling code expects it to go through the +shutdown-path. + +The RDS/TCP multipath changes added a shortcut out of +"RDS_CONN_ERROR" straight back to "RDS_CONN_CONNECTING" +via "rds_tcp_accept_one_path" (e.g. after "rds_tcp_state_change"). + +A subsequent "rds_tcp_reset_callbacks" can then transition +the state to "RDS_CONN_RESETTING" with a shutdown-worker queued. + +That'll trip up "rds_conn_init_shutdown", which was +never adjusted to handle "RDS_CONN_RESETTING" and subsequently +drops the connection with the dreaded "DR_INV_CONN_STATE", +which leaves "RDS_SHUTDOWN_WORK_QUEUED" on forever. + +So we do two things here: + +a) Don't shortcut "RDS_CONN_ERROR", but take the longer + path through the shutdown code. + +b) Add "RDS_CONN_RESETTING" to the expected states in + "rds_conn_init_shutdown" so that we won't error out + and get stuck, if we ever hit weird state transitions + like this again." + +Signed-off-by: Gerd Rausch +Signed-off-by: Allison Henderson +Link: https://patch.msgid.link/20260122055213.83608-2-achender@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/rds/connection.c | 2 ++ + net/rds/tcp_listen.c | 5 ----- + 2 files changed, 2 insertions(+), 5 deletions(-) + +diff --git a/net/rds/connection.c b/net/rds/connection.c +index b4cc699c5fad3..00bda534b9ce2 100644 +--- a/net/rds/connection.c ++++ b/net/rds/connection.c +@@ -381,6 +381,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp) + if (!rds_conn_path_transition(cp, RDS_CONN_UP, + RDS_CONN_DISCONNECTING) && + !rds_conn_path_transition(cp, RDS_CONN_ERROR, ++ RDS_CONN_DISCONNECTING) && ++ !rds_conn_path_transition(cp, RDS_CONN_RESETTING, + RDS_CONN_DISCONNECTING)) { + rds_conn_path_error(cp, + "shutdown called in state %d\n", +diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c +index 3994eeef95a3c..7b6d0088ae33e 100644 +--- a/net/rds/tcp_listen.c ++++ b/net/rds/tcp_listen.c +@@ -58,9 +58,6 @@ void rds_tcp_keepalive(struct socket *sock) + * socket and force a reconneect from smaller -> larger ip addr. The reason + * we special case cp_index 0 is to allow the rds probe ping itself to itself + * get through efficiently. +- * Since reconnects are only initiated from the node with the numerically +- * smaller ip address, we recycle conns in RDS_CONN_ERROR on the passive side +- * by moving them to CONNECTING in this function. + */ + static + struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn) +@@ -85,8 +82,6 @@ struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn) + struct rds_conn_path *cp = &conn->c_path[i]; + + if (rds_conn_path_transition(cp, RDS_CONN_DOWN, +- RDS_CONN_CONNECTING) || +- rds_conn_path_transition(cp, RDS_CONN_ERROR, + RDS_CONN_CONNECTING)) { + return cp->cp_transport_data; + } +-- +2.51.0 + diff --git a/queue-5.10/net-usb-r8152-fix-transmit-queue-timeout.patch b/queue-5.10/net-usb-r8152-fix-transmit-queue-timeout.patch new file mode 100644 index 00000000000..a27c348fe74 --- /dev/null +++ b/queue-5.10/net-usb-r8152-fix-transmit-queue-timeout.patch @@ -0,0 +1,42 @@ +From fd6db3a351e90e6484e53cba58795b590d702310 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 09:59:49 +0800 +Subject: net: usb: r8152: fix transmit queue timeout + +From: Mingj Ye + +[ Upstream commit 833dcd75d54f0bf5aa0a0781ff57456b421fbb40 ] + +When the TX queue length reaches the threshold, the netdev watchdog +immediately detects a TX queue timeout. + +This patch updates the trans_start timestamp of the transmit queue +on every asynchronous USB URB submission along the transmit path, +ensuring that the network watchdog accurately reflects ongoing +transmission activity. + +Signed-off-by: Mingj Ye +Reviewed-by: Hayes Wang +Link: https://patch.msgid.link/20260120015949.84996-1-insyelu@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 57565fb2c0a11..2a8fa331a9452 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -2152,6 +2152,8 @@ static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg) + ret = usb_submit_urb(agg->urb, GFP_ATOMIC); + if (ret < 0) + usb_autopm_put_interface_async(tp->intf); ++ else ++ netif_trans_update(tp->netdev); + + out_tx_fill: + return ret; +-- +2.51.0 + diff --git a/queue-5.10/net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch b/queue-5.10/net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch new file mode 100644 index 00000000000..a567eea9f74 --- /dev/null +++ b/queue-5.10/net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch @@ -0,0 +1,117 @@ +From 41c339eeb130cc3965e899bd043b92323af95fba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 17:39:09 -0800 +Subject: net: usb: sr9700: remove code to drive nonexistent multicast filter + +From: Ethan Nelson-Moore + +[ Upstream commit 9a9424c756feee9ee6e717405a9d6fa7bacdef08 ] + +Several registers referenced in this driver's source code do not +actually exist (they are not writable and read as zero in my testing). +They exist in this driver because it originated as a copy of the dm9601 +driver. Notably, these include the multicast filter registers - this +causes the driver to not support multicast packets correctly. Remove +the multicast filter code and register definitions. Instead, set the +chip to receive all multicast filter packets when any multicast +addresses are in the list. + +Reviewed-by: Simon Horman (from v1) +Signed-off-by: Ethan Nelson-Moore +Link: https://patch.msgid.link/20260203013924.28582-1-enelsonmoore@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/Kconfig | 1 - + drivers/net/usb/sr9700.c | 25 ++++--------------------- + drivers/net/usb/sr9700.h | 7 +------ + 3 files changed, 5 insertions(+), 28 deletions(-) + +diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig +index 867ff2ee8ecf3..e1ec0c6b33429 100644 +--- a/drivers/net/usb/Kconfig ++++ b/drivers/net/usb/Kconfig +@@ -318,7 +318,6 @@ config USB_NET_DM9601 + config USB_NET_SR9700 + tristate "CoreChip-sz SR9700 based USB 1.1 10/100 ethernet devices" + depends on USB_USBNET +- select CRC32 + help + This option adds support for CoreChip-sz SR9700 based USB 1.1 + 10/100 Ethernet adapters. +diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c +index 4d860d5bbcd73..9dbce3232d7c2 100644 +--- a/drivers/net/usb/sr9700.c ++++ b/drivers/net/usb/sr9700.c +@@ -18,7 +18,6 @@ + #include + #include + #include +-#include + #include + + #include "sr9700.h" +@@ -264,31 +263,15 @@ static const struct ethtool_ops sr9700_ethtool_ops = { + static void sr9700_set_multicast(struct net_device *netdev) + { + struct usbnet *dev = netdev_priv(netdev); +- /* We use the 20 byte dev->data for our 8 byte filter buffer +- * to avoid allocating memory that is tricky to free later +- */ +- u8 *hashes = (u8 *)&dev->data; + /* rx_ctl setting : enable, disable_long, disable_crc */ + u8 rx_ctl = RCR_RXEN | RCR_DIS_CRC | RCR_DIS_LONG; + +- memset(hashes, 0x00, SR_MCAST_SIZE); +- /* broadcast address */ +- hashes[SR_MCAST_SIZE - 1] |= SR_MCAST_ADDR_FLAG; +- if (netdev->flags & IFF_PROMISC) { ++ if (netdev->flags & IFF_PROMISC) + rx_ctl |= RCR_PRMSC; +- } else if (netdev->flags & IFF_ALLMULTI || +- netdev_mc_count(netdev) > SR_MCAST_MAX) { +- rx_ctl |= RCR_RUNT; +- } else if (!netdev_mc_empty(netdev)) { +- struct netdev_hw_addr *ha; +- +- netdev_for_each_mc_addr(ha, netdev) { +- u32 crc = ether_crc(ETH_ALEN, ha->addr) >> 26; +- hashes[crc >> 3] |= 1 << (crc & 0x7); +- } +- } ++ else if (netdev->flags & IFF_ALLMULTI || !netdev_mc_empty(netdev)) ++ /* The chip has no multicast filter */ ++ rx_ctl |= RCR_ALL; + +- sr_write_async(dev, SR_MAR, SR_MCAST_SIZE, hashes); + sr_write_reg_async(dev, SR_RCR, rx_ctl); + } + +diff --git a/drivers/net/usb/sr9700.h b/drivers/net/usb/sr9700.h +index ea2b4de621c86..c479908f7d823 100644 +--- a/drivers/net/usb/sr9700.h ++++ b/drivers/net/usb/sr9700.h +@@ -104,9 +104,7 @@ + #define WCR_LINKEN (1 << 5) + /* Physical Address Reg */ + #define SR_PAR 0x10 /* 0x10 ~ 0x15 6 bytes for PAR */ +-/* Multicast Address Reg */ +-#define SR_MAR 0x16 /* 0x16 ~ 0x1D 8 bytes for MAR */ +-/* 0x1e unused */ ++/* 0x16 --> 0x1E unused */ + /* Phy Reset Reg */ + #define SR_PRR 0x1F + #define PRR_PHY_RST (1 << 0) +@@ -161,9 +159,6 @@ + /* parameters */ + #define SR_SHARE_TIMEOUT 1000 + #define SR_EEPROM_LEN 256 +-#define SR_MCAST_SIZE 8 +-#define SR_MCAST_ADDR_FLAG 0x80 +-#define SR_MCAST_MAX 64 + #define SR_TX_OVERHEAD 2 /* 2bytes header */ + #define SR_RX_OVERHEAD 7 /* 3bytes header + 4crc tail */ + +-- +2.51.0 + diff --git a/queue-5.10/netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch b/queue-5.10/netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch new file mode 100644 index 00000000000..0473d6f69a3 --- /dev/null +++ b/queue-5.10/netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch @@ -0,0 +1,41 @@ +From ca4a4352a966fbc43dc6ac19f4f858e7746d5a7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Dec 2025 20:53:51 +0900 +Subject: netfilter: nf_conntrack: Add allow_clash to generic protocol handler + +From: Yuto Hamaguchi + +[ Upstream commit 8a49fc8d8a3e83dc51ec05bcd4007bdea3c56eec ] + +The upstream commit, 71d8c47fc653711c41bc3282e5b0e605b3727956 + ("netfilter: conntrack: introduce clash resolution on insertion race"), +sets allow_clash=true in the UDP/UDPLITE protocol handler +but does not set it in the generic protocol handler. + +As a result, packets composed of connectionless protocols at each layer, +such as UDP over IP-in-IP, still drop packets due to conflicts during conntrack insertion. + +To resolve this, this patch sets allow_clash in the nf_conntrack_l4proto_generic. + +Signed-off-by: Yuto Hamaguchi +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_proto_generic.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c +index e831637bc8ca8..cb260eb3d012c 100644 +--- a/net/netfilter/nf_conntrack_proto_generic.c ++++ b/net/netfilter/nf_conntrack_proto_generic.c +@@ -67,6 +67,7 @@ void nf_conntrack_generic_init_net(struct net *net) + const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic = + { + .l4proto = 255, ++ .allow_clash = true, + #ifdef CONFIG_NF_CONNTRACK_TIMEOUT + .ctnl_timeout = { + .nlattr_to_obj = generic_timeout_nlattr_to_obj, +-- +2.51.0 + diff --git a/queue-5.10/netfilter-xt_tcpmss-check-remaining-length-before-re.patch b/queue-5.10/netfilter-xt_tcpmss-check-remaining-length-before-re.patch new file mode 100644 index 00000000000..863ddb9f5c7 --- /dev/null +++ b/queue-5.10/netfilter-xt_tcpmss-check-remaining-length-before-re.patch @@ -0,0 +1,42 @@ +From c5cc037cecc3372f710b9d98fb31c523f48564c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 12:30:42 +0100 +Subject: netfilter: xt_tcpmss: check remaining length before reading optlen + +From: Florian Westphal + +[ Upstream commit 735ee8582da3d239eb0c7a53adca61b79fb228b3 ] + +Quoting reporter: + In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads + op[i+1] directly without validating the remaining option length. + + If the last byte of the option field is not EOL/NOP (0/1), the code attempts + to index op[i+1]. In the case where i + 1 == optlen, this causes an + out-of-bounds read, accessing memory past the optlen boundary + (either reading beyond the stack buffer _opt or the + following payload). + +Reported-by: sungzii +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/xt_tcpmss.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c +index 37704ab017992..0d32d4841cb32 100644 +--- a/net/netfilter/xt_tcpmss.c ++++ b/net/netfilter/xt_tcpmss.c +@@ -61,7 +61,7 @@ tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par) + return (mssval >= info->mss_min && + mssval <= info->mss_max) ^ info->invert; + } +- if (op[i] < 2) ++ if (op[i] < 2 || i == optlen - 1) + i++; + else + i += op[i+1] ? : 1; +-- +2.51.0 + diff --git a/queue-5.10/nfc-nxp-nci-remove-interrupt-trigger-type.patch b/queue-5.10/nfc-nxp-nci-remove-interrupt-trigger-type.patch new file mode 100644 index 00000000000..c68e658322e --- /dev/null +++ b/queue-5.10/nfc-nxp-nci-remove-interrupt-trigger-type.patch @@ -0,0 +1,42 @@ +From 8a156264dadd433c0b833be5ef2b373cabf17134 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Feb 2026 19:11:39 +0800 +Subject: nfc: nxp-nci: remove interrupt trigger type + +From: Carl Lee + +[ Upstream commit 57be33f85e369ce9f69f61eaa34734e0d3bd47a7 ] + +For NXP NCI devices (e.g. PN7150), the interrupt is level-triggered and +active high, not edge-triggered. + +Using IRQF_TRIGGER_RISING in the driver can cause interrupts to fail +to trigger correctly. + +Remove IRQF_TRIGGER_RISING and rely on the IRQ trigger type configured +via Device Tree. + +Signed-off-by: Carl Lee +Link: https://patch.msgid.link/20260205-fc-nxp-nci-remove-interrupt-trigger-type-v2-1-79d2ed4a7e42@amd.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/nfc/nxp-nci/i2c.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c +index f426dcdfcdd6a..78320d7bd2a16 100644 +--- a/drivers/nfc/nxp-nci/i2c.c ++++ b/drivers/nfc/nxp-nci/i2c.c +@@ -306,7 +306,7 @@ static int nxp_nci_i2c_probe(struct i2c_client *client, + + r = request_threaded_irq(client->irq, NULL, + nxp_nci_i2c_irq_thread_fn, +- IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ IRQF_ONESHOT, + NXP_NCI_I2C_DRIVER_NAME, phy); + if (r < 0) + nfc_err(&client->dev, "Unable to register IRQ handler\n"); +-- +2.51.0 + diff --git a/queue-5.10/ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch b/queue-5.10/ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch new file mode 100644 index 00000000000..09b385a7d52 --- /dev/null +++ b/queue-5.10/ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch @@ -0,0 +1,40 @@ +From 1c7a27ca5e78e09bc7d9f2c17ea7595a3b9639fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2025 14:53:18 -0800 +Subject: ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access + +From: Maciej Grochowski + +[ Upstream commit c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface ] + +Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS, +This patch protects against invalid index out of bounds access to mw_sizes +When invalid access print message to user that configuration is not valid. + +Signed-off-by: Maciej Grochowski +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +index c5c1963c699d9..199ca06277ac1 100644 +--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c ++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +@@ -1316,6 +1316,12 @@ static void switchtec_ntb_init_shared(struct switchtec_ntb *sndev) + for (i = 0; i < sndev->nr_lut_mw; i++) { + int idx = sndev->nr_direct_mw + i; + ++ if (idx >= MAX_MWS) { ++ dev_err(&sndev->stdev->dev, ++ "Total number of MW cannot be bigger than %d", MAX_MWS); ++ break; ++ } ++ + sndev->self_shared->mw_sizes[idx] = LUT_SIZE; + } + } +-- +2.51.0 + diff --git a/queue-5.10/ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch b/queue-5.10/ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch new file mode 100644 index 00000000000..dc350a53e9e --- /dev/null +++ b/queue-5.10/ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch @@ -0,0 +1,48 @@ +From fbb9f0f61dfd335f81872fc76827058837e56614 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2025 14:53:17 -0800 +Subject: ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut + +From: Maciej Grochowski + +[ Upstream commit 186615f8855a0be4ee7d3fcd09a8ecc10e783b08 ] + +Number of MW LUTs depends on NTB configuration and can be set to zero, +in such scenario rounddown_pow_of_two will cause undefined behaviour and +should not be performed. +This patch ensures that rounddown_pow_of_two is called on valid value. + +Signed-off-by: Maciej Grochowski +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +index 199ca06277ac1..a912ffa2289ac 100644 +--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c ++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +@@ -1204,7 +1204,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev) + sndev->mmio_self_ctrl); + + sndev->nr_lut_mw = ioread16(&sndev->mmio_self_ctrl->lut_table_entries); +- sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw); ++ if (sndev->nr_lut_mw) ++ sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw); + + dev_dbg(&sndev->stdev->dev, "MWs: %d direct, %d lut\n", + sndev->nr_direct_mw, sndev->nr_lut_mw); +@@ -1214,7 +1215,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev) + + sndev->peer_nr_lut_mw = + ioread16(&sndev->mmio_peer_ctrl->lut_table_entries); +- sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw); ++ if (sndev->peer_nr_lut_mw) ++ sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw); + + dev_dbg(&sndev->stdev->dev, "Peer MWs: %d direct, %d lut\n", + sndev->peer_nr_direct_mw, sndev->peer_nr_lut_mw); +-- +2.51.0 + diff --git a/queue-5.10/octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch b/queue-5.10/octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch new file mode 100644 index 00000000000..94299de3bb0 --- /dev/null +++ b/queue-5.10/octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch @@ -0,0 +1,69 @@ +From aa12ed5b03d48443b6bf3cc8efbeab9a442d6745 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 18:21:47 +0530 +Subject: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geetha sowjanya + +[ Upstream commit 70e9a5760abfb6338d63994d4de6b0778ec795d6 ] + +NIX SQ manager sticky mode is known to cause stalls when multiple SQs +share an SMQ and transmit concurrently. Additionally, PSE may deadlock +on transitions between sticky and non-sticky transmissions. There is +also a credit drop issue observed when certain condition clocks are +gated. + +work around these hardware errata by: +- Disabling SQM sticky operation: + - Clear TM6 (bit 15) + - Clear TM11 (bit 14) +- Disabling sticky → non-sticky transition path that can deadlock PSE: + - Clear TM5 (bit 23) +- Preventing credit drops by keeping the control-flow clock enabled: + - Set TM9 (bit 21) + +These changes are applied via NIX_AF_SQM_DBG_CTL_STATUS. With this +configuration the SQM/PSE maintain forward progress under load without +credit loss, at the cost of disabling sticky optimizations. + +Signed-off-by: Geetha sowjanya +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260127125147.1642-1-gakula@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +index 0a69d326f618c..971e0ae917f41 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +@@ -3155,12 +3155,18 @@ int rvu_nix_init(struct rvu *rvu) + /* Set chan/link to backpressure TL3 instead of TL2 */ + rvu_write64(rvu, blkaddr, NIX_AF_PSE_CHANNEL_LEVEL, 0x01); + +- /* Disable SQ manager's sticky mode operation (set TM6 = 0) ++ /* Disable SQ manager's sticky mode operation (set TM6 = 0, TM11 = 0) + * This sticky mode is known to cause SQ stalls when multiple +- * SQs are mapped to same SMQ and transmitting pkts at a time. ++ * SQs are mapped to same SMQ and transmitting pkts simultaneously. ++ * NIX PSE may deadlock when there are any sticky to non-sticky ++ * transmission. Hence disable it (TM5 = 0). + */ + cfg = rvu_read64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS); +- cfg &= ~BIT_ULL(15); ++ cfg &= ~(BIT_ULL(15) | BIT_ULL(14) | BIT_ULL(23)); ++ /* NIX may drop credits when condition clocks are turned off. ++ * Hence enable control flow clk (set TM9 = 1). ++ */ ++ cfg |= BIT_ULL(21); + rvu_write64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS, cfg); + + ltdefs = rvu->kpu.lt_def; +-- +2.51.0 + diff --git a/queue-5.10/openrisc-define-arch-specific-version-of-nop.patch b/queue-5.10/openrisc-define-arch-specific-version-of-nop.patch new file mode 100644 index 00000000000..d14c18032bc --- /dev/null +++ b/queue-5.10/openrisc-define-arch-specific-version-of-nop.patch @@ -0,0 +1,53 @@ +From e9a4fa0d346428b58ebc92862e43445228df89b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 12:07:23 -0500 +Subject: openrisc: define arch-specific version of nop() + +From: Brian Masney + +[ Upstream commit 0dfffa5479d6260d04d021f69203b1926f73d889 ] + +When compiling a driver written for MIPS on OpenRISC that uses the nop() +function, it fails due to the following error: + + drivers/watchdog/pic32-wdt.c: Assembler messages: + drivers/watchdog/pic32-wdt.c:125: Error: unrecognized instruction `nop' + +The driver currently uses the generic version of nop() from +include/asm-generic/barrier.h: + + #ifndef nop + #define nop() asm volatile ("nop") + #endif + +Let's fix this on OpenRISC by defining an architecture-specific version +of nop(). + +This was tested by performing an allmodconfig openrisc cross compile on +an aarch64 host. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202601180236.BVy480We-lkp@intel.com/ +Signed-off-by: Brian Masney +Signed-off-by: Stafford Horne +Signed-off-by: Sasha Levin +--- + arch/openrisc/include/asm/barrier.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h +index 7538294721bed..8e592c9909023 100644 +--- a/arch/openrisc/include/asm/barrier.h ++++ b/arch/openrisc/include/asm/barrier.h +@@ -4,6 +4,8 @@ + + #define mb() asm volatile ("l.msync" ::: "memory") + ++#define nop() asm volatile ("l.nop") ++ + #include + + #endif /* __ASM_BARRIER_H */ +-- +2.51.0 + diff --git a/queue-5.10/parisc-prevent-interrupts-during-reboot.patch b/queue-5.10/parisc-prevent-interrupts-during-reboot.patch new file mode 100644 index 00000000000..4df9b448e18 --- /dev/null +++ b/queue-5.10/parisc-prevent-interrupts-during-reboot.patch @@ -0,0 +1,32 @@ +From 84d3620445669b2d5cc6e4a8719ba9e6a2e1fb8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 17:58:55 +0100 +Subject: parisc: Prevent interrupts during reboot + +From: Helge Deller + +[ Upstream commit 35ac5a728c878594f2ea6c43b57652a16be3c968 ] + +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/kernel/process.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c +index c14ee40302d85..afe17c3ca0bfc 100644 +--- a/arch/parisc/kernel/process.c ++++ b/arch/parisc/kernel/process.c +@@ -85,6 +85,9 @@ void machine_restart(char *cmd) + #endif + /* set up a new led state on systems shipped with a LED State panel */ + pdc_chassis_send_status(PDC_CHASSIS_DIRECT_SHUTDOWN); ++ ++ /* prevent interrupts during reboot */ ++ set_eiem(0); + + /* "Normal" system reset */ + pdc_do_reset(); +-- +2.51.0 + diff --git a/queue-5.10/pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch b/queue-5.10/pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch new file mode 100644 index 00000000000..f7e78b1a297 --- /dev/null +++ b/queue-5.10/pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch @@ -0,0 +1,41 @@ +From c0dbef4090863c789fa9bf287ce8598d6f591d29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jan 2026 13:53:32 +0530 +Subject: PCI: Add ACS quirk for Qualcomm Hamoa & Glymur + +From: Krishna Chaitanya Chundru + +[ Upstream commit 44d2f70b1fd72c339c72983fcffa181beae3e113 ] + +The Qualcomm Hamoa & Glymur Root Ports don't advertise an ACS capability, +but they do provide ACS-like features to disable peer transactions and +validate bus numbers in requests. + +Add an ACS quirk for Hamoa & Glymur. + +Signed-off-by: Krishna Chaitanya Chundru +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20260109-acs_quirk-v1-1-82adf95a89ae@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index cd2968da288f4..564575affe130 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -4950,6 +4950,10 @@ static const struct pci_dev_acs_enabled { + { PCI_VENDOR_ID_QCOM, 0x0401, pci_quirk_qcom_rp_acs }, + /* QCOM SA8775P root port */ + { PCI_VENDOR_ID_QCOM, 0x0115, pci_quirk_qcom_rp_acs }, ++ /* QCOM Hamoa root port */ ++ { PCI_VENDOR_ID_QCOM, 0x0111, pci_quirk_qcom_rp_acs }, ++ /* QCOM Glymur root port */ ++ { PCI_VENDOR_ID_QCOM, 0x0120, pci_quirk_qcom_rp_acs }, + /* HXT SD4800 root ports. The ACS design is same as QCOM QDF2xxx */ + { PCI_VENDOR_ID_HXT, 0x0401, pci_quirk_qcom_rp_acs }, + /* Intel PCH root ports */ +-- +2.51.0 + diff --git a/queue-5.10/pci-enable-acs-after-configuring-iommu-for-of-platfo.patch b/queue-5.10/pci-enable-acs-after-configuring-iommu-for-of-platfo.patch new file mode 100644 index 00000000000..75c33b69c45 --- /dev/null +++ b/queue-5.10/pci-enable-acs-after-configuring-iommu-for-of-platfo.patch @@ -0,0 +1,136 @@ +From c1f836ab0eae9a737eebcd78abc4542b2eea1dae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jan 2026 21:04:47 +0530 +Subject: PCI: Enable ACS after configuring IOMMU for OF platforms + +From: Manivannan Sadhasivam + +[ Upstream commit c41e2fb67e26b04d919257875fa954aa5f6e392e ] + +Platform, ACPI, or IOMMU drivers call pci_request_acs(), which sets +'pci_acs_enable' to request that ACS be enabled for any devices enumerated +in the future. + +OF platforms called pci_enable_acs() for the first device before +of_iommu_configure() called pci_request_acs(), so ACS was never enabled for +that device (typically a Root Port). + +Call pci_enable_acs() later, from pci_dma_configure(), after +of_dma_configure() has had a chance to call pci_request_acs(). + +Here's the call path, showing the move of pci_enable_acs() from +pci_acs_init() to pci_dma_configure(), where it always happens after +pci_request_acs(): + + pci_device_add + pci_init_capabilities + pci_acs_init + - pci_enable_acs + - if (pci_acs_enable) <-- previous test + - ... + device_add + bus_notify(BUS_NOTIFY_ADD_DEVICE) + iommu_bus_notifier + iommu_probe_device + iommu_init_device + dev->bus->dma_configure + pci_dma_configure # pci_bus_type.dma_configure + of_dma_configure + of_iommu_configure + pci_request_acs + pci_acs_enable = 1 <-- set + + pci_enable_acs + + if (pci_acs_enable) <-- new test + + ... + bus_probe_device + device_initial_probe + ... + really_probe + dev->bus->dma_configure + pci_dma_configure # pci_bus_type.dma_configure + ... + pci_enable_acs + +Note that we will now call pci_enable_acs() twice for every device, first +from the iommu_probe_device() path and again from the really_probe() path. +Presumably that's not an issue since we also call dev->bus->dma_configure() +twice. + +For the ACPI platforms, pci_request_acs() is called during ACPI +initialization time itself, independent of the IOMMU framework. + +Signed-off-by: Manivannan Sadhasivam +[bhelgaas: commit log] +Signed-off-by: Bjorn Helgaas +Tested-by: Marek Szyprowski +Tested-by: Naresh Kamboju +Link: https://patch.msgid.link/20260102-pci_acs-v3-1-72280b94d288@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/pci/pci-driver.c | 8 ++++++++ + drivers/pci/pci.c | 10 +--------- + drivers/pci/pci.h | 1 + + 3 files changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c +index fe15e59e7c56e..de500afdcf97c 100644 +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -1601,6 +1601,14 @@ static int pci_dma_configure(struct device *dev) + ret = acpi_dma_configure(dev, acpi_get_dma_attr(adev)); + } + ++ /* ++ * Attempt to enable ACS regardless of capability because some Root ++ * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have ++ * the standard ACS capability but still support ACS via those ++ * quirks. ++ */ ++ pci_enable_acs(to_pci_dev(dev)); ++ + pci_put_host_bridge_device(bridge); + return ret; + } +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 92f4876c37f06..1663660661302 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -894,7 +894,7 @@ static void pci_std_enable_acs(struct pci_dev *dev) + * pci_enable_acs - enable ACS if hardware support it + * @dev: the PCI device + */ +-static void pci_enable_acs(struct pci_dev *dev) ++void pci_enable_acs(struct pci_dev *dev) + { + if (!pci_acs_enable) + goto disable_acs_redir; +@@ -3548,14 +3548,6 @@ bool pci_acs_path_enabled(struct pci_dev *start, + void pci_acs_init(struct pci_dev *dev) + { + dev->acs_cap = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ACS); +- +- /* +- * Attempt to enable ACS regardless of capability because some Root +- * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have +- * the standard ACS capability but still support ACS via those +- * quirks. +- */ +- pci_enable_acs(dev); + } + + /** +diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h +index c2fd92a9ee1ad..5079800f56ceb 100644 +--- a/drivers/pci/pci.h ++++ b/drivers/pci/pci.h +@@ -547,6 +547,7 @@ static inline resource_size_t pci_resource_alignment(struct pci_dev *dev, + } + + void pci_acs_init(struct pci_dev *dev); ++void pci_enable_acs(struct pci_dev *dev); + #ifdef CONFIG_PCI_QUIRKS + int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags); + int pci_dev_specific_enable_acs(struct pci_dev *dev); +-- +2.51.0 + diff --git a/queue-5.10/pci-fix-pci_slot_lock-device-locking.patch b/queue-5.10/pci-fix-pci_slot_lock-device-locking.patch new file mode 100644 index 00000000000..5495140727a --- /dev/null +++ b/queue-5.10/pci-fix-pci_slot_lock-device-locking.patch @@ -0,0 +1,97 @@ +From 409a9bb82b393cccb3f3eea59b76bf2212fcd1b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 08:59:51 -0800 +Subject: PCI: Fix pci_slot_lock () device locking + +From: Keith Busch + +[ Upstream commit 1f5e57c622b4dc9b8e7d291d560138d92cfbe5bf ] + +Like pci_bus_lock(), pci_slot_lock() needs to lock the bridge device to +prevent warnings like: + + pcieport 0000:e2:05.0: unlocked secondary bus reset via: pciehp_reset_slot+0x55/0xa0 + +Take and release the lock for the bridge providing the slot for the +lock/trylock and unlock routines. + +Signed-off-by: Keith Busch +Signed-off-by: Bjorn Helgaas +Reviewed-by: Dan Williams +Link: https://patch.msgid.link/20260130165953.751063-3-kbusch@meta.com +Signed-off-by: Sasha Levin +--- + drivers/pci/pci.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 15618b87bc4b9..92f4876c37f06 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -5318,10 +5318,9 @@ static int pci_bus_trylock(struct pci_bus *bus) + /* Do any devices on or below this slot prevent a bus reset? */ + static bool pci_slot_resetable(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; + +- if (slot->bus->self && +- (slot->bus->self->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET)) ++ if (bridge && (bridge->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET)) + return false; + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { +@@ -5338,7 +5337,10 @@ static bool pci_slot_resetable(struct pci_slot *slot) + /* Lock devices from the top of the tree down */ + static void pci_slot_lock(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; ++ ++ if (bridge) ++ pci_dev_lock(bridge); + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { + if (!dev->slot || dev->slot != slot) +@@ -5353,7 +5355,7 @@ static void pci_slot_lock(struct pci_slot *slot) + /* Unlock devices from the bottom of the tree up */ + static void pci_slot_unlock(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { + if (!dev->slot || dev->slot != slot) +@@ -5363,12 +5365,18 @@ static void pci_slot_unlock(struct pci_slot *slot) + else + pci_dev_unlock(dev); + } ++ ++ if (bridge) ++ pci_dev_unlock(bridge); + } + + /* Return 1 on successful lock, 0 on contention */ + static int pci_slot_trylock(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; ++ ++ if (bridge && !pci_dev_trylock(bridge)) ++ return 0; + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { + if (!dev->slot || dev->slot != slot) +@@ -5393,6 +5401,9 @@ static int pci_slot_trylock(struct pci_slot *slot) + else + pci_dev_unlock(dev); + } ++ ++ if (bridge) ++ pci_dev_unlock(bridge); + return 0; + } + +-- +2.51.0 + diff --git a/queue-5.10/pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch b/queue-5.10/pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch new file mode 100644 index 00000000000..8a21c9644c4 --- /dev/null +++ b/queue-5.10/pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch @@ -0,0 +1,51 @@ +From 24acb237c91d8c0f835695b904fa4e7f8599c811 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 17:02:08 -0700 +Subject: PCI: Mark ASM1164 SATA controller to avoid bus reset + +From: Alex Williamson + +[ Upstream commit beb2f81792a8a619e5122b6b24a374861309c54b ] + +User forums report issues when assigning ASM1164 SATA controllers to VMs, +especially in configurations with multiple controllers. Logs show the +device fails to retrain after bus reset. Reports suggest this is an issue +across multiple platforms. The device indicates support for PM reset, +therefore the device still has a viable function level reset mechanism. +The reporting user confirms the device is well behaved in this use case +with bus reset disabled. + +Reported-by: Patrick Bianchi +Link: https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/ +Signed-off-by: Alex Williamson +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20260109000211.398300-1-alex.williamson@nvidia.com +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index c925e0be5f476..cd2968da288f4 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3624,6 +3624,16 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_CAVIUM, 0xa100, quirk_no_bus_reset); + */ + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TI, 0xb005, quirk_no_bus_reset); + ++/* ++ * Reports from users making use of PCI device assignment with ASM1164 ++ * controllers indicate an issue with bus reset where the device fails to ++ * retrain. The issue appears more common in configurations with multiple ++ * controllers. The device does indicate PM reset support (NoSoftRst-), ++ * therefore this still leaves a viable reset method. ++ * https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/ ++ */ ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ASMEDIA, 0x1164, quirk_no_bus_reset); ++ + static void quirk_no_pm_reset(struct pci_dev *dev) + { + /* +-- +2.51.0 + diff --git a/queue-5.10/pci-mark-nvidia-gb10-to-avoid-bus-reset.patch b/queue-5.10/pci-mark-nvidia-gb10-to-avoid-bus-reset.patch new file mode 100644 index 00000000000..9c5bd81c70f --- /dev/null +++ b/queue-5.10/pci-mark-nvidia-gb10-to-avoid-bus-reset.patch @@ -0,0 +1,47 @@ +From 9729423cf794d729429056ce30c7d115e45b593c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Nov 2025 16:44:06 +0800 +Subject: PCI: Mark Nvidia GB10 to avoid bus reset + +From: Johnny-CC Chang + +[ Upstream commit c81a2ce6b6a844d1a57d2a69833a9d0f00403f00 ] + +After asserting Secondary Bus Reset to downstream devices via a GB10 Root +Port, the link may not retrain correctly, e.g., the link may retrain with a +lower lane count or config accesses to downstream devices may fail. + +Prevent use of Secondary Bus Reset for devices below GB10. + +Signed-off-by: Johnny-CC Chang +[bhelgaas: drop pci_ids.h update (only used once), update commit log] +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Link: https://patch.msgid.link/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 564575affe130..0319aca1f762b 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3581,6 +3581,14 @@ static void quirk_no_bus_reset(struct pci_dev *dev) + dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET; + } + ++/* ++ * After asserting Secondary Bus Reset to downstream devices via a GB10 ++ * Root Port, the link may not retrain correctly. ++ * https://lore.kernel.org/r/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com ++ */ ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22CE, quirk_no_bus_reset); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22D0, quirk_no_bus_reset); ++ + /* + * Some NVIDIA GPU devices do not work with bus reset, SBR needs to be + * prevented for those affected devices. +-- +2.51.0 + diff --git a/queue-5.10/perf-callchain-fix-srcline-printing-with-inlines.patch b/queue-5.10/perf-callchain-fix-srcline-printing-with-inlines.patch new file mode 100644 index 00000000000..f7c0c6ac649 --- /dev/null +++ b/queue-5.10/perf-callchain-fix-srcline-printing-with-inlines.patch @@ -0,0 +1,55 @@ +From a10f4c49fb9e580391fea45078bc2c56aaebdf6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 20:13:36 -0800 +Subject: perf callchain: Fix srcline printing with inlines + +From: Ian Rogers + +[ Upstream commit abec464767b5d26f0612250d511c18f420826ca1 ] + +sample__fprintf_callchain() was using map__fprintf_srcline() which won't +report inline line numbers. + +Fix by using the srcline from the callchain and falling back to the map +variant. + +Fixes: 25da4fab5f66e659 ("perf evsel: Move fprintf methods to separate source file") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Stephen Brennan +Cc: Tony Jones +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/evsel_fprintf.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/evsel_fprintf.c b/tools/perf/util/evsel_fprintf.c +index fb498a723a006..3aedff5e6fa4d 100644 +--- a/tools/perf/util/evsel_fprintf.c ++++ b/tools/perf/util/evsel_fprintf.c +@@ -170,8 +170,12 @@ int sample__fprintf_callchain(struct perf_sample *sample, int left_alignment, + printed += fprintf(fp, ")"); + } + +- if (print_srcline) +- printed += map__fprintf_srcline(map, addr, "\n ", fp); ++ if (print_srcline) { ++ if (node->srcline) ++ printed += fprintf(fp, "\n %s", node->srcline); ++ else ++ printed += map__fprintf_srcline(map, addr, "\n ", fp); ++ } + + if (sym && sym->inlined) + printed += fprintf(fp, " (inlined)"); +-- +2.51.0 + diff --git a/queue-5.10/phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch b/queue-5.10/phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch new file mode 100644 index 00000000000..11220b3cf8e --- /dev/null +++ b/queue-5.10/phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch @@ -0,0 +1,38 @@ +From dcf976a22543f7fac5279826438cfabfd8d1e88c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 19:17:12 +0800 +Subject: phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature + +From: Xu Yang + +[ Upstream commit 27ee0869d77b2cb404770ac49bdceae3aedf658b ] + +Disabling PHYs in runtime usually causes the client with external abort +exception or similar issue due to lack of API to notify clients about PHY +removal. This patch removes the possibility to unbind i.MX PHY drivers in +runtime. + +Signed-off-by: Xu Yang +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20260120111712.3159782-1-xu.yang_2@nxp.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c +index 62d6d6849ad60..4328396cd13de 100644 +--- a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c ++++ b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c +@@ -194,6 +194,7 @@ static struct platform_driver imx8mq_usb_phy_driver = { + .driver = { + .name = "imx8mq-usb-phy", + .of_match_table = imx8mq_usb_phy_of_match, ++ .suppress_bind_attrs = true, + } + }; + module_platform_driver(imx8mq_usb_phy_driver); +-- +2.51.0 + diff --git a/queue-5.10/pstore-ram_core-fix-incorrect-success-return-when-vm.patch b/queue-5.10/pstore-ram_core-fix-incorrect-success-return-when-vm.patch new file mode 100644 index 00000000000..6cb31803dcb --- /dev/null +++ b/queue-5.10/pstore-ram_core-fix-incorrect-success-return-when-vm.patch @@ -0,0 +1,49 @@ +From 1f4e19c8b2ca8a0a1277ca3a96349f10b4379ebe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 10:03:58 +0800 +Subject: pstore: ram_core: fix incorrect success return when vmap() fails + +From: Ruipeng Qi + +[ Upstream commit 05363abc7625cf18c96e67f50673cd07f11da5e9 ] + +In persistent_ram_vmap(), vmap() may return NULL on failure. + +If offset is non-zero, adding offset_in_page(start) causes the function +to return a non-NULL pointer even though the mapping failed. +persistent_ram_buffer_map() therefore incorrectly returns success. + +Subsequent access to prz->buffer may dereference an invalid address +and cause crashes. + +Add proper NULL checking for vmap() failures. + +Signed-off-by: Ruipeng Qi +Link: https://patch.msgid.link/20260203020358.3315299-1-ruipengqi3@gmail.com +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + fs/pstore/ram_core.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c +index 97ec9041b9b98..ccaa138a57b7c 100644 +--- a/fs/pstore/ram_core.c ++++ b/fs/pstore/ram_core.c +@@ -443,6 +443,13 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size, + vaddr = vmap(pages, page_count, VM_MAP | VM_IOREMAP, prot); + kfree(pages); + ++ /* ++ * vmap() may fail and return NULL. Do not add the offset in this ++ * case, otherwise a NULL mapping would appear successful. ++ */ ++ if (!vaddr) ++ return NULL; ++ + /* + * Since vmap() uses page granularity, we must add the offset + * into the page here, to get the byte granularity address +-- +2.51.0 + diff --git a/queue-5.10/revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch b/queue-5.10/revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch new file mode 100644 index 00000000000..f80c22e3412 --- /dev/null +++ b/queue-5.10/revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch @@ -0,0 +1,42 @@ +From c66ef24e1be3ad159ee87392462a830d68227006 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 17:16:51 +0100 +Subject: Revert "mfd: da9052-spi: Change read-mask to write-mask" + +From: Marcus Folkesson + +[ Upstream commit 12daa9c1954542bf98bb942fb2dadf19de79a44b ] + +This reverts commit 2e3378f6c79a1b3f7855ded1ef306ea4406352ed. + +Almost every register in this chip can be customized via OTP +memory. Somehow the value for R19, which decide if the flag is set +on read or write operation, seems to have been overwritten for the chip +the original patch were written for. + +Revert the change to follow the default behavior. + +Signed-off-by: Marcus Folkesson +Link: https://patch.msgid.link/20251124-da9052-revert-v1-1-fbeb2c894002@gmail.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/da9052-spi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mfd/da9052-spi.c b/drivers/mfd/da9052-spi.c +index 06c500bf4d57e..5faf3766a5e20 100644 +--- a/drivers/mfd/da9052-spi.c ++++ b/drivers/mfd/da9052-spi.c +@@ -37,7 +37,7 @@ static int da9052_spi_probe(struct spi_device *spi) + spi_set_drvdata(spi, da9052); + + config = da9052_regmap_config; +- config.write_flag_mask = 1; ++ config.read_flag_mask = 1; + config.reg_bits = 7; + config.pad_bits = 1; + config.val_bits = 8; +-- +2.51.0 + diff --git a/queue-5.10/rnbd-srv-zero-the-rsp-buffer-before-using-it.patch b/queue-5.10/rnbd-srv-zero-the-rsp-buffer-before-using-it.patch new file mode 100644 index 00000000000..f3737787550 --- /dev/null +++ b/queue-5.10/rnbd-srv-zero-the-rsp-buffer-before-using-it.patch @@ -0,0 +1,47 @@ +From 1eed435c3c9dbf30b1815a51b97a246905de7df6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 13:47:33 +0100 +Subject: rnbd-srv: Zero the rsp buffer before using it + +From: Md Haris Iqbal + +[ Upstream commit 69d26698e4fd44935510553809007151b2fe4db5 ] + +Before using the data buffer to send back the response message, zero it +completely. This prevents any stray bytes to be picked up by the client +side when there the message is exchanged between different protocol +versions. + +Signed-off-by: Md Haris Iqbal +Signed-off-by: Jack Wang +Signed-off-by: Grzegorz Prajsner +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/rnbd/rnbd-srv.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c +index 9c5d52335e17c..6bec309719066 100644 +--- a/drivers/block/rnbd/rnbd-srv.c ++++ b/drivers/block/rnbd/rnbd-srv.c +@@ -535,6 +535,8 @@ static void rnbd_srv_fill_msg_open_rsp(struct rnbd_msg_open_rsp *rsp, + { + struct rnbd_dev *rnbd_dev = sess_dev->rnbd_dev; + ++ memset(rsp, 0, sizeof(*rsp)); ++ + rsp->hdr.type = cpu_to_le16(RNBD_MSG_OPEN_RSP); + rsp->device_id = + cpu_to_le32(sess_dev->device_id); +@@ -649,6 +651,7 @@ static int process_msg_sess_info(struct rtrs_srv *rtrs, + srv_sess->sessname, srv_sess->ver, + sess_info_msg->ver, RNBD_PROTO_VER_MAJOR); + ++ memset(rsp, 0, sizeof(*rsp)); + rsp->hdr.type = cpu_to_le16(RNBD_MSG_SESS_INFO_RSP); + rsp->ver = srv_sess->ver; + +-- +2.51.0 + diff --git a/queue-5.10/rtc-interface-alarm-race-handling-should-not-discard.patch b/queue-5.10/rtc-interface-alarm-race-handling-should-not-discard.patch new file mode 100644 index 00000000000..385b696ea8e --- /dev/null +++ b/queue-5.10/rtc-interface-alarm-race-handling-should-not-discard.patch @@ -0,0 +1,53 @@ +From a15f032a136b37616a0de2575f96453ec9602cab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 17:35:19 +0000 +Subject: rtc: interface: Alarm race handling should not discard preceding + error + +From: Anthony Pighin (Nokia) + +[ Upstream commit 81be22cd4ace020045cc6d31255c6f7c071eb7c0 ] + +Commit 795cda8338ea ("rtc: interface: Fix long-standing race when setting +alarm") should not discard any errors from the preceding validations. + +Prior to that commit, if the alarm feature was disabled, or the +set_alarm failed, a meaningful error code would be returned to the +caller for further action. + +After, more often than not, the __rtc_read_time will cause a success +return code instead, misleading the caller. + +An example of this is when timer_enqueue is called for a rtc-abx080x +device. Since that driver does not clear the alarm feature bit, but +instead relies on the set_alarm operation to return invalid, the discard +of the return code causes very different behaviour; i.e. + hwclock: select() to /dev/rtc0 to wait for clock tick timed out + +Fixes: 795cda8338ea ("rtc: interface: Fix long-standing race when setting alarm") +Signed-off-by: Anthony Pighin (Nokia) +Reviewed-by: Esben Haabendal +Tested-by: Nick Bowler +Link: https://patch.msgid.link/BN0PR08MB6951415A751F236375A2945683D1A@BN0PR08MB6951.namprd08.prod.outlook.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/interface.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c +index 9d2a2637246eb..7c9487050b25b 100644 +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -456,7 +456,7 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm) + * are in, we can return -ETIME to signal that the timer has already + * expired, which is true in both cases. + */ +- if ((scheduled - now) <= 1) { ++ if (!err && (scheduled - now) <= 1) { + err = __rtc_read_time(rtc, &tm); + if (err) + return err; +-- +2.51.0 + diff --git a/queue-5.10/s390-perf-disable-register-readout-on-sampling-event.patch b/queue-5.10/s390-perf-disable-register-readout-on-sampling-event.patch new file mode 100644 index 00000000000..19a1e7a137e --- /dev/null +++ b/queue-5.10/s390-perf-disable-register-readout-on-sampling-event.patch @@ -0,0 +1,53 @@ +From 5590e0c140cd2dc868deba9ebcf247430b90f5e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 10:14:12 +0100 +Subject: s390/perf: Disable register readout on sampling events + +From: Thomas Richter + +[ Upstream commit b2c04fc1239062b39ddfdd8731ee1a10810dfb74 ] + +Running commands + # ./perf record -IR0,R1 -a sleep 1 +extracts and displays register value of general purpose register r1 and r0. +However the value displayed of any register is random and does not +reflect the register value recorded at the time of the sample interrupt. + +The sampling device driver on s390 creates a very large buffer +for the hardware to store the samples. Only when that large buffer +gets full an interrupt is generated and many hundreds of sample +entries are processed and copied to the kernel ring buffer and +eventually get copied to the perf tool. It is during the copy +to the kernel ring buffer that each sample is processed (on s390) +and at that time the register values are extracted. +This is not the original goal, the register values should be read +when the samples are created not when the samples are copied to the +kernel ring buffer. + +Prevent this event from being installed in the first place and +return -EOPNOTSUPP. This is already the case for PERF_SAMPLE_REGS_USER. + +Signed-off-by: Thomas Richter +Reviewed-by: Jan Polensky +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/perf_cpum_sf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c +index fc45f123f3bdc..0c60252a757d2 100644 +--- a/arch/s390/kernel/perf_cpum_sf.c ++++ b/arch/s390/kernel/perf_cpum_sf.c +@@ -887,7 +887,7 @@ static bool is_callchain_event(struct perf_event *event) + u64 sample_type = event->attr.sample_type; + + return sample_type & (PERF_SAMPLE_CALLCHAIN | PERF_SAMPLE_REGS_USER | +- PERF_SAMPLE_STACK_USER); ++ PERF_SAMPLE_REGS_INTR | PERF_SAMPLE_STACK_USER); + } + + static int cpumsf_pmu_event_init(struct perf_event *event) +-- +2.51.0 + diff --git a/queue-5.10/s390-purgatory-add-wno-default-const-init-unsafe-to-.patch b/queue-5.10/s390-purgatory-add-wno-default-const-init-unsafe-to-.patch new file mode 100644 index 00000000000..0d662338ed0 --- /dev/null +++ b/queue-5.10/s390-purgatory-add-wno-default-const-init-unsafe-to-.patch @@ -0,0 +1,45 @@ +From e288a57ab3133ce7d6d9a9d935e2fd1311e5c0d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Dec 2025 16:47:07 +0100 +Subject: s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS + +From: Heiko Carstens + +[ Upstream commit b4780fe4ddf04b51127a33d705f4a2e224df00fa ] + +Add -Wno-default-const-init-unsafe to purgatory KBUILD_CFLAGS, similar +to scripts/Makefile.extrawarn, since clang generates warnings for the +dummy variable in typecheck(): + + CC arch/s390/purgatory/purgatory.o + arch/s390/include/asm/ptrace.h:221:9: warning: default initialization of an object of type 'typeof (regs->psw)' (aka 'const psw_t') leaves the object uninitialized [-Wdefault-const-init-var-unsafe] + 221 | return psw_bits(regs->psw).pstate; + | ^ + arch/s390/include/asm/ptrace.h:98:2: note: expanded from macro 'psw_bits' + 98 | typecheck(psw_t, __psw); \ + | ^ + include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck' + 11 | typeof(x) __dummy2; \ + | ^ + +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/purgatory/Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/s390/purgatory/Makefile b/arch/s390/purgatory/Makefile +index e03f234fcfbef..efbbdc7f6e9d7 100644 +--- a/arch/s390/purgatory/Makefile ++++ b/arch/s390/purgatory/Makefile +@@ -28,6 +28,7 @@ KBUILD_CFLAGS += -fno-stack-protector + KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING + KBUILD_CFLAGS += $(CLANG_FLAGS) + KBUILD_CFLAGS += $(call cc-option,-fno-PIE) ++KBUILD_CFLAGS += $(call cc-option, -Wno-default-const-init-unsafe) + KBUILD_AFLAGS := $(filter-out -DCC_USING_EXPOLINE,$(KBUILD_AFLAGS)) + + # Since we link purgatory with -r unresolved symbols are not checked, so we +-- +2.51.0 + diff --git a/queue-5.10/serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch b/queue-5.10/serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch new file mode 100644 index 00000000000..002e2ba6a45 --- /dev/null +++ b/queue-5.10/serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch @@ -0,0 +1,46 @@ +From 4a4b1bb1971ab79f76ecd8760da2cf10effbdb77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 13:48:29 +0530 +Subject: serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA + termination is done + +From: Moteen Shah + +[ Upstream commit a5fd8945a478ff9be14812693891d7c9b4185a50 ] + +Clear rx_running flag only after DMA teardown polling completes. In the +previous implementation the flag was being cleared while hardware teardown +was still in progress, creating a mismatch between software state +(flag = 0, "ready") and hardware state (still terminating). + +Signed-off-by: Moteen Shah +Link: https://patch.msgid.link/20260112081829.63049-3-m-shah@ti.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 98df9d4ceaecd..e4e2bf9cd4716 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -854,7 +854,6 @@ static void __dma_rx_do_complete(struct uart_8250_port *p) + goto out; + + cookie = dma->rx_cookie; +- dma->rx_running = 0; + + /* Re-enable RX FIFO interrupt now that transfer is complete */ + if (priv->habit & UART_HAS_RHR_IT_DIS) { +@@ -888,6 +887,7 @@ static void __dma_rx_do_complete(struct uart_8250_port *p) + goto out; + ret = tty_insert_flip_string(tty_port, dma->rx_buf, count); + ++ dma->rx_running = 0; + p->port.icount.rx += ret; + p->port.icount.buf_overrun += count - ret; + out: +-- +2.51.0 + diff --git a/queue-5.10/serial-8250_dw-handle-clock-enable-errors-in-runtime.patch b/queue-5.10/serial-8250_dw-handle-clock-enable-errors-in-runtime.patch new file mode 100644 index 00000000000..4cc6f81ae78 --- /dev/null +++ b/queue-5.10/serial-8250_dw-handle-clock-enable-errors-in-runtime.patch @@ -0,0 +1,57 @@ +From 908f47126b1be47ea0d80b4dc6cfb62e64c6c492 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 17:54:25 +0300 +Subject: serial: 8250_dw: handle clock enable errors in runtime_resume + +From: Artem Shimko + +[ Upstream commit d31228143a489ba6ba797896a07541ce06828c09 ] + +Add error checking for clk_prepare_enable() calls in +dw8250_runtime_resume(). Currently if either clock fails to enable, +the function returns success while leaving clocks in inconsistent state. + +This change implements comprehensive error handling by checking the return +values of both clk_prepare_enable() calls. If the second clock enable +operation fails after the first clock has already been successfully +enabled, the code now properly cleans up by disabling and unpreparing +the first clock before returning. The error code is then propagated to +the caller, ensuring that clock enable failures are properly reported +rather than being silently ignored. + +Signed-off-by: Artem Shimko +Link: https://patch.msgid.link/20251104145433.2316165-2-a.shimko.dev@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_dw.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c +index bcf770f344dac..211dc88ce4e2c 100644 +--- a/drivers/tty/serial/8250/8250_dw.c ++++ b/drivers/tty/serial/8250/8250_dw.c +@@ -684,11 +684,18 @@ static int dw8250_runtime_suspend(struct device *dev) + + static int dw8250_runtime_resume(struct device *dev) + { ++ int ret; + struct dw8250_data *data = dev_get_drvdata(dev); + +- clk_prepare_enable(data->pclk); ++ ret = clk_prepare_enable(data->pclk); ++ if (ret) ++ return ret; + +- clk_prepare_enable(data->clk); ++ ret = clk_prepare_enable(data->clk); ++ if (ret) { ++ clk_disable_unprepare(data->pclk); ++ return ret; ++ } + + return 0; + } +-- +2.51.0 + diff --git a/queue-5.10/series b/queue-5.10/series index c49d6a4a3b9..63f8b48df87 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -158,3 +158,96 @@ ext4-fix-memory-leak-in-ext4_ext_shift_extents.patch ata-pata_ftide010-fix-some-dma-timings.patch sunrpc-auth_gss-fix-memory-leaks-in-xdr-decoding-error-paths.patch sunrpc-fix-gss_auth-kref-leak-in-gss_alloc_msg-error-path.patch +perf-callchain-fix-srcline-printing-with-inlines.patch +rtc-interface-alarm-race-handling-should-not-discard.patch +audit-add-fchmodat2-to-change-attributes-class.patch +hfsplus-fix-volume-corruption-issue-for-generic-498.patch +audit-add-missing-syscalls-to-read-class.patch +hfsplus-pretend-special-inodes-as-regular-files.patch +minix-add-required-sanity-checking-to-minix_check_su.patch +tools-power-cpupower-reset-errno-before-strtoull.patch +s390-purgatory-add-wno-default-const-init-unsafe-to-.patch +arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch +rnbd-srv-zero-the-rsp-buffer-before-using-it.patch +x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch +efi-cper-don-t-dump-the-entire-memory-region.patch +apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch +efi-cper-don-t-go-past-the-arm-processor-cper-record.patch +acpica-abort-aml-bytecode-execution-when-executing-a.patch +s390-perf-disable-register-readout-on-sampling-event.patch +xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch +blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch +sparc-synchronize-user-stack-on-fork-and-clone.patch +sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch +bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch +clocksource-drivers-sh_tmu-always-leave-device-runni.patch +clocksource-drivers-timer-integrator-ap-add-missing-.patch +mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch +pstore-ram_core-fix-incorrect-success-return-when-vm.patch +arm64-tegra-smaug-add-usb-role-switch-support.patch +parisc-prevent-interrupts-during-reboot.patch +media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch +media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch +media-omap3isp-isppreview-always-clamp-in-preview_tr.patch +media-omap3isp-set-initial-format.patch +asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch +asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch +media-adv7180-fix-frame-interval-in-progressive-mode.patch +media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch +media-solo6x10-check-for-out-of-bounds-chip_id.patch +media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch +drm-account-property-blob-allocations-to-memcg.patch +hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch +virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch +drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch +drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch +hid-multitouch-add-egalaxtouch-exc3188-support.patch +gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch +spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch +asoc-es8328-add-error-unwind-in-resume.patch +modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch +jfs-add-missing-set_freezable-for-freezable-kthread.patch +jfs-nlink-overflow-in-jfs_rename.patch +dm-remove-fake-timeout-to-avoid-leak-request.patch +iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch +wifi-libertas-fix-warning-in-usb_tx_block.patch +netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch +netfilter-xt_tcpmss-check-remaining-length-before-re.patch +openrisc-define-arch-specific-version-of-nop.patch +net-usb-r8152-fix-transmit-queue-timeout.patch +net-rds-no-shortcut-out-of-rds_conn_error.patch +wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch +wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch +ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch +bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch +bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch +octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch +wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch +net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch +vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch +net-rds-clear-reconnect-pending-bit.patch +pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch +pci-fix-pci_slot_lock-device-locking.patch +pci-enable-acs-after-configuring-iommu-for-of-platfo.patch +pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch +pci-mark-nvidia-gb10-to-avoid-bus-reset.patch +myri10ge-avoid-uninitialized-variable-use.patch +nfc-nxp-nci-remove-interrupt-trigger-type.patch +mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch +clk-microchip-core-correct-return-value-on-_get_pare.patch +m68k-nommu-fix-memmove-with-differently-aligned-src-.patch +serial-8250_dw-handle-clock-enable-errors-in-runtime.patch +serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch +fix-it87_wdt-early-reboot-by-reporting-running-timer.patch +binder-don-t-use-pk-through-printk.patch +phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch +revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch +iio-magnetometer-remove-irqf_oneshot.patch +mips-loongson-make-cpumask_of_node-robust-against-nu.patch +include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch +arm-9467-1-mm-don-t-use-pk-through-printk.patch +drm-amd-display-avoid-updating-surface-with-the-same.patch +drm-amdgpu-add-hainan-clock-adjustment.patch +drm-radeon-add-hainan-clock-adjustment.patch +ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch +ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch diff --git a/queue-5.10/sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch b/queue-5.10/sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch new file mode 100644 index 00000000000..d82faad92ff --- /dev/null +++ b/queue-5.10/sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch @@ -0,0 +1,50 @@ +From 1e103f91110ed08d0d145e338efd2d4d7015580c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 13:40:29 +0000 +Subject: sparc: don't reference obsolete termio struct for TC* constants + +From: Sam James + +[ Upstream commit be0bccffcde3308150d2a90e55fc10e249098909 ] + +Similar in nature to commit ab107276607a ("powerpc: Fix struct termio related ioctl macros"). + +glibc-2.42 drops the legacy termio struct, but the ioctls.h header still +defines some TC* constants in terms of termio (via sizeof). Hardcode the +values instead. + +This fixes building Python for example, which falls over like: + ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio' + +Link: https://bugs.gentoo.org/961769 +Link: https://bugs.gentoo.org/962600 +Signed-off-by: Sam James +Reviewed-by: Andreas Larsson +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/include/uapi/asm/ioctls.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/sparc/include/uapi/asm/ioctls.h b/arch/sparc/include/uapi/asm/ioctls.h +index 7fd2f5873c9e7..a8bbdf9877a41 100644 +--- a/arch/sparc/include/uapi/asm/ioctls.h ++++ b/arch/sparc/include/uapi/asm/ioctls.h +@@ -5,10 +5,10 @@ + #include + + /* Big T */ +-#define TCGETA _IOR('T', 1, struct termio) +-#define TCSETA _IOW('T', 2, struct termio) +-#define TCSETAW _IOW('T', 3, struct termio) +-#define TCSETAF _IOW('T', 4, struct termio) ++#define TCGETA 0x40125401 /* _IOR('T', 1, struct termio) */ ++#define TCSETA 0x80125402 /* _IOW('T', 2, struct termio) */ ++#define TCSETAW 0x80125403 /* _IOW('T', 3, struct termio) */ ++#define TCSETAF 0x80125404 /* _IOW('T', 4, struct termio) */ + #define TCSBRK _IO('T', 5) + #define TCXONC _IO('T', 6) + #define TCFLSH _IO('T', 7) +-- +2.51.0 + diff --git a/queue-5.10/sparc-synchronize-user-stack-on-fork-and-clone.patch b/queue-5.10/sparc-synchronize-user-stack-on-fork-and-clone.patch new file mode 100644 index 00000000000..f5148c8ca21 --- /dev/null +++ b/queue-5.10/sparc-synchronize-user-stack-on-fork-and-clone.patch @@ -0,0 +1,114 @@ +From 7b2ce60e39b6a4141464d72ae46f407c4cabe928 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 15:47:52 +0100 +Subject: sparc: Synchronize user stack on fork and clone + +From: Andreas Larsson + +[ Upstream commit e38eba3b77878ada327a572a41596a3b0b44e522 ] + +Flush all uncommitted user windows before calling the generic syscall +handlers for clone, fork, and vfork. + +Prior to entering the arch common handlers sparc_{clone|fork|vfork}, the +arch-specific syscall wrappers for these syscalls will attempt to flush +all windows (including user windows). + +In the window overflow trap handlers on both SPARC{32|64}, +if the window can't be stored (i.e due to MMU related faults) the routine +backups the user window and increments a thread counter (wsaved). + +By adding a synchronization point after the flush attempt, when fault +handling is enabled, any uncommitted user windows will be flushed. + +Link: https://sourceware.org/bugzilla/show_bug.cgi?id=31394 +Closes: https://lore.kernel.org/sparclinux/fe5cc47167430007560501aabb28ba154985b661.camel@physik.fu-berlin.de/ +Signed-off-by: Andreas Larsson +Signed-off-by: Ludwig Rydberg +Tested-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/20260119144753.27945-2-ludwig.rydberg@gaisler.com +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/kernel/process.c | 38 +++++++++++++++++++++++-------------- + 1 file changed, 24 insertions(+), 14 deletions(-) + +diff --git a/arch/sparc/kernel/process.c b/arch/sparc/kernel/process.c +index 0442ab00518d3..7d69877511fac 100644 +--- a/arch/sparc/kernel/process.c ++++ b/arch/sparc/kernel/process.c +@@ -17,14 +17,18 @@ + + asmlinkage long sparc_fork(struct pt_regs *regs) + { +- unsigned long orig_i1 = regs->u_regs[UREG_I1]; ++ unsigned long orig_i1; + long ret; + struct kernel_clone_args args = { + .exit_signal = SIGCHLD, +- /* Reuse the parent's stack for the child. */ +- .stack = regs->u_regs[UREG_FP], + }; + ++ synchronize_user_stack(); ++ ++ orig_i1 = regs->u_regs[UREG_I1]; ++ /* Reuse the parent's stack for the child. */ ++ args.stack = regs->u_regs[UREG_FP]; ++ + ret = kernel_clone(&args); + + /* If we get an error and potentially restart the system +@@ -40,16 +44,19 @@ asmlinkage long sparc_fork(struct pt_regs *regs) + + asmlinkage long sparc_vfork(struct pt_regs *regs) + { +- unsigned long orig_i1 = regs->u_regs[UREG_I1]; ++ unsigned long orig_i1; + long ret; +- + struct kernel_clone_args args = { + .flags = CLONE_VFORK | CLONE_VM, + .exit_signal = SIGCHLD, +- /* Reuse the parent's stack for the child. */ +- .stack = regs->u_regs[UREG_FP], + }; + ++ synchronize_user_stack(); ++ ++ orig_i1 = regs->u_regs[UREG_I1]; ++ /* Reuse the parent's stack for the child. */ ++ args.stack = regs->u_regs[UREG_FP]; ++ + ret = kernel_clone(&args); + + /* If we get an error and potentially restart the system +@@ -65,15 +72,18 @@ asmlinkage long sparc_vfork(struct pt_regs *regs) + + asmlinkage long sparc_clone(struct pt_regs *regs) + { +- unsigned long orig_i1 = regs->u_regs[UREG_I1]; +- unsigned int flags = lower_32_bits(regs->u_regs[UREG_I0]); ++ unsigned long orig_i1; ++ unsigned int flags; + long ret; ++ struct kernel_clone_args args = {0}; + +- struct kernel_clone_args args = { +- .flags = (flags & ~CSIGNAL), +- .exit_signal = (flags & CSIGNAL), +- .tls = regs->u_regs[UREG_I3], +- }; ++ synchronize_user_stack(); ++ ++ orig_i1 = regs->u_regs[UREG_I1]; ++ flags = lower_32_bits(regs->u_regs[UREG_I0]); ++ args.flags = (flags & ~CSIGNAL); ++ args.exit_signal = (flags & CSIGNAL); ++ args.tls = regs->u_regs[UREG_I3]; + + #ifdef CONFIG_COMPAT + if (test_thread_flag(TIF_32BIT)) { +-- +2.51.0 + diff --git a/queue-5.10/spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch b/queue-5.10/spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch new file mode 100644 index 00000000000..4f8e93ffd4b --- /dev/null +++ b/queue-5.10/spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch @@ -0,0 +1,60 @@ +From 600b78cf1ea0004a39b82df55840290a0d073c19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 20:30:04 +0800 +Subject: spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end + +From: Chin-Ting Kuo + +[ Upstream commit 53f826ff5e0e3ecb279862ca7cce1491b94bb017 ] + +spi_mem_dirmap_create() may reconfigure controller-wide settings, +which can interfere with concurrent transfers to other devices +sharing the same SPI controller but using different chip selects. + +Wrap the ->dirmap_create() callback with spi_mem_access_start() and +spi_mem_access_end() to serialize access and prevent cross-CS +interference during dirmap creation. + +This patch has been verified on a setup where a SPI TPM is connected +to CS0 of a SPI controller, while a SPI NOR flash is connected to CS1 +of the same controller. Without this patch, spi_mem_dirmap_create() +for the SPI NOR flash interferes with ongoing SPI TPM data transfers, +resulting in failure to create the TPM device. This was tested on an +ASPEED AST2700 EVB. + +Signed-off-by: Chin-Ting Kuo +Reviewed-by: Paul Menzel +Link: https://patch.msgid.link/20260120123005.1392071-2-chin-ting_kuo@aspeedtech.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-mem.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c +index 4682f49dc7330..5260923b6a3d6 100644 +--- a/drivers/spi/spi-mem.c ++++ b/drivers/spi/spi-mem.c +@@ -522,9 +522,18 @@ spi_mem_dirmap_create(struct spi_mem *mem, + + desc->mem = mem; + desc->info = *info; +- if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create) ++ if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create) { ++ ret = spi_mem_access_start(mem); ++ if (ret) { ++ kfree(desc); ++ return ERR_PTR(ret); ++ } ++ + ret = ctlr->mem_ops->dirmap_create(desc); + ++ spi_mem_access_end(mem); ++ } ++ + if (ret) { + desc->nodirmap = true; + if (!spi_mem_supports_op(desc->mem, &desc->info.op_tmpl)) +-- +2.51.0 + diff --git a/queue-5.10/tools-power-cpupower-reset-errno-before-strtoull.patch b/queue-5.10/tools-power-cpupower-reset-errno-before-strtoull.patch new file mode 100644 index 00000000000..f48eab4f91e --- /dev/null +++ b/queue-5.10/tools-power-cpupower-reset-errno-before-strtoull.patch @@ -0,0 +1,37 @@ +From 897b427622ad43045dffbcf3f116418f9f79912e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 17:47:45 +0530 +Subject: tools/power cpupower: Reset errno before strtoull() + +From: Kaushlendra Kumar + +[ Upstream commit f9bd3762cf1bd0c2465f2e6121b340883471d1bf ] + +cpuidle_state_get_one_value() never cleared errno before calling +strtoull(), so a prior ERANGE caused every cpuidle counter read to +return zero. Reset errno to 0 before the conversion so each sysfs read +is evaluated independently. + +Link: https://lore.kernel.org/r/20251201121745.3776703-1-kaushlendra.kumar@intel.com +Signed-off-by: Kaushlendra Kumar +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/power/cpupower/lib/cpuidle.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c +index c15d0de12357f..e7b8c56638370 100644 +--- a/tools/power/cpupower/lib/cpuidle.c ++++ b/tools/power/cpupower/lib/cpuidle.c +@@ -148,6 +148,7 @@ unsigned long long cpuidle_state_get_one_value(unsigned int cpu, + if (len == 0) + return 0; + ++ errno = 0; + value = strtoull(linebuf, &endp, 0); + + if (endp == linebuf || errno == ERANGE) +-- +2.51.0 + diff --git a/queue-5.10/virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch b/queue-5.10/virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch new file mode 100644 index 00000000000..c47b99bf094 --- /dev/null +++ b/queue-5.10/virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch @@ -0,0 +1,75 @@ +From 0000c9cf3ec10ace3b99e83c94ac2a606f41ad3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 08:35:45 +0100 +Subject: virt: vbox: uapi: Mark inner unions in packed structs as packed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit c25d01e1c4f2d43f47af87c00e223f5ca7c71792 ] + +The unpacked unions within a packed struct generates alignment warnings +on clang for 32-bit ARM: + +./usr/include/linux/vbox_vmmdev_types.h:239:4: error: field u within 'struct vmmdev_hgcm_function_parameter32' + is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:223:2)' + and is usually due to 'struct vmmdev_hgcm_function_parameter32' being packed, + which can lead to unaligned accesses [-Werror,-Wunaligned-access] + 239 | } u; + | ^ + +./usr/include/linux/vbox_vmmdev_types.h:254:6: error: field u within + 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)' + is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:251:4)' and is usually due to + 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)' + being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] + +With the recent changes to compile-test the UAPI headers in more cases, +these warning in combination with CONFIG_WERROR breaks the build. + +Fix the warnings. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/ +Reported-by: Nathan Chancellor +Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/ +Suggested-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/ +Signed-off-by: Thomas Weißschuh +Tested-by: Nicolas Schier +Reviewed-by: Nicolas Schier +Acked-by: Greg Kroah-Hartman +Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-2-076aed1623ff@linutronix.de +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + include/uapi/linux/vbox_vmmdev_types.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/uapi/linux/vbox_vmmdev_types.h b/include/uapi/linux/vbox_vmmdev_types.h +index f8a8d6b3c5219..436678d4fb24f 100644 +--- a/include/uapi/linux/vbox_vmmdev_types.h ++++ b/include/uapi/linux/vbox_vmmdev_types.h +@@ -236,7 +236,7 @@ struct vmmdev_hgcm_function_parameter32 { + /** Relative to the request header. */ + __u32 offset; + } page_list; +- } u; ++ } __packed u; + } __packed; + VMMDEV_ASSERT_SIZE(vmmdev_hgcm_function_parameter32, 4 + 8); + +@@ -251,7 +251,7 @@ struct vmmdev_hgcm_function_parameter64 { + union { + __u64 phys_addr; + __u64 linear_addr; +- } u; ++ } __packed u; + } __packed pointer; + struct { + /** Size of the buffer described by the page list. */ +-- +2.51.0 + diff --git a/queue-5.10/vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch b/queue-5.10/vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch new file mode 100644 index 00000000000..7d937b6ce23 --- /dev/null +++ b/queue-5.10/vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch @@ -0,0 +1,62 @@ +From 680779835d455df662aa333c6abb2390e52ecbb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 17:34:00 +0100 +Subject: vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 + +From: Arnd Bergmann + +[ Upstream commit e25dbf561e03c0c5e36228e3b8b784392819ce85 ] + +The gcc-16.0.1 snapshot produces a false-positive warning that turns +into a build failure with CONFIG_WERROR: + +In file included from arch/x86/include/asm/string.h:6, + from net/vmw_vsock/vmci_transport.c:10: +In function 'vmci_transport_packet_init', + inlined from '__vmci_transport_send_control_pkt.constprop' at net/vmw_vsock/vmci_transport.c:198:2: +arch/x86/include/asm/string_32.h:150:25: error: argument 2 null where non-null expected because argument 3 is nonzero [-Werror=nonnull] + 150 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n) + | ^~~~~~~~~~~~~~~~~~~~~~~~~ +net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy' + 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait)); + | ^~~~~~ +arch/x86/include/asm/string_32.h:150:25: note: in a call to built-in function '__builtin_memcpy' +net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy' + 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait)); + | ^~~~~~ + +This seems relatively harmless, and it so far the only instance of this +warning I have found. The __vmci_transport_send_control_pkt function +is called either with wait=NULL or with one of the type values that +pass 'wait' into memcpy() here, but not from the same caller. + +Replacing the memcpy with a struct assignment is otherwise the same +but avoids the warning. + +Signed-off-by: Arnd Bergmann +Reviewed-by: Bobby Eshleman +Reviewed-by: Stefano Garzarella +Reviewed-by: Bryan Tan +Link: https://patch.msgid.link/20260203163406.2636463-1-arnd@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/vmw_vsock/vmci_transport.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c +index 912bafcf825b2..5a85e1ce2aa48 100644 +--- a/net/vmw_vsock/vmci_transport.c ++++ b/net/vmw_vsock/vmci_transport.c +@@ -161,7 +161,7 @@ vmci_transport_packet_init(struct vmci_transport_packet *pkt, + + case VMCI_TRANSPORT_PACKET_TYPE_WAITING_READ: + case VMCI_TRANSPORT_PACKET_TYPE_WAITING_WRITE: +- memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait)); ++ pkt->u.wait = *wait; + break; + + case VMCI_TRANSPORT_PACKET_TYPE_REQUEST2: +-- +2.51.0 + diff --git a/queue-5.10/wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch b/queue-5.10/wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch new file mode 100644 index 00000000000..fe28cec61f4 --- /dev/null +++ b/queue-5.10/wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch @@ -0,0 +1,59 @@ +From 5b3865817c00c70301aa2ea539357c3fd296fa70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 17:56:11 +0000 +Subject: wifi: ath10k: fix lock protection in + ath10k_wmi_event_peer_sta_ps_state_chg() + +From: Ziyi Guo + +[ Upstream commit 820ba7dd6859ef8b1eaf6014897e7aa4756fc65d ] + +ath10k_wmi_event_peer_sta_ps_state_chg() uses lockdep_assert_held() to +assert that ar->data_lock should be held by the caller, but neither +ath10k_wmi_10_2_op_rx() nor ath10k_wmi_10_4_op_rx() acquire this lock +before calling this function. + +The field arsta->peer_ps_state is documented as protected by +ar->data_lock in core.h, and other accessors (ath10k_peer_ps_state_disable, +ath10k_dbg_sta_read_peer_ps_state) properly acquire this lock. + +Add spin_lock_bh()/spin_unlock_bh() around the peer_ps_state update, +and remove the lockdep_assert_held() to be aligned with new locking, +following the pattern used by other WMI event handlers in the driver. + +Signed-off-by: Ziyi Guo +Reviewed-by: Baochen Qiang +Link: https://patch.msgid.link/20260123175611.767731-1-n7l8m4@u.northwestern.edu +[removed excess blank line] +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/wmi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c +index 6293dbc32bde4..2852d31cedd6d 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -5282,8 +5282,6 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb) + struct ath10k_sta *arsta; + u8 peer_addr[ETH_ALEN]; + +- lockdep_assert_held(&ar->data_lock); +- + ev = (struct wmi_peer_sta_ps_state_chg_event *)skb->data; + ether_addr_copy(peer_addr, ev->peer_macaddr.addr); + +@@ -5298,7 +5296,9 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb) + } + + arsta = (struct ath10k_sta *)sta->drv_priv; ++ spin_lock_bh(&ar->data_lock); + arsta->peer_ps_state = __le32_to_cpu(ev->peer_ps_state); ++ spin_unlock_bh(&ar->data_lock); + + exit: + rcu_read_unlock(); +-- +2.51.0 + diff --git a/queue-5.10/wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch b/queue-5.10/wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch new file mode 100644 index 00000000000..aba42f65b92 --- /dev/null +++ b/queue-5.10/wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch @@ -0,0 +1,48 @@ +From 1a08c9ae0520b6416b1e7903ede90b546735d7e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 19:30:05 +0000 +Subject: wifi: iwlegacy: add missing mutex protection in + il3945_store_measurement() + +From: Ziyi Guo + +[ Upstream commit 4dd1dda65265ecbc9f43ffc08e333684cf715152 ] + +il3945_store_measurement() calls il3945_get_measurement() which internally +calls il_send_cmd_sync() without holding il->mutex. However, +il_send_cmd_sync() has lockdep_assert_held(&il->mutex) indicating that +callers must hold this lock. + +Other sysfs store functions in the same file properly acquire the mutex: +- il3945_store_flags() acquires mutex at 3945-mac.c:3110 +- il3945_store_filter_flags() acquires mutex at 3945-mac.c:3144 + +Add mutex_lock()/mutex_unlock() around the il3945_get_measurement() call +in the sysfs store function to fix the missing lock protection. + +Signed-off-by: Ziyi Guo +Acked-by: Stanislaw Gruszka +Link: https://patch.msgid.link/20260125193005.1090429-1-n7l8m4@u.northwestern.edu +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlegacy/3945-mac.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c +index 55c00a07bc4d3..a9d06dd5e19ef 100644 +--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c ++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c +@@ -3270,7 +3270,9 @@ il3945_store_measurement(struct device *d, struct device_attribute *attr, + + D_INFO("Invoking measurement of type %d on " "channel %d (for '%s')\n", + type, params.channel, buf); ++ mutex_lock(&il->mutex); + il3945_get_measurement(il, ¶ms, type); ++ mutex_unlock(&il->mutex); + + return count; + } +-- +2.51.0 + diff --git a/queue-5.10/wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch b/queue-5.10/wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch new file mode 100644 index 00000000000..f2f60a2095b --- /dev/null +++ b/queue-5.10/wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch @@ -0,0 +1,49 @@ +From 26056c83b099718ad14ff611b5b7d5cffef69240 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 19:40:39 +0000 +Subject: wifi: iwlegacy: add missing mutex protection in + il4965_store_tx_power() + +From: Ziyi Guo + +[ Upstream commit e31fa691d0b1c07b6094a6cf0cce894192c462b3 ] + +il4965_store_tx_power() calls il_set_tx_power() without holding il->mutex. +However, il_set_tx_power() has lockdep_assert_held(&il->mutex) indicating +that callers must hold this lock. + +All other callers of il_set_tx_power() properly acquire the mutex: +- il_bg_scan_completed() acquires mutex at common.c:1683 +- il_mac_config() acquires mutex at common.c:5006 +- il3945_commit_rxon() and il4965_commit_rxon() are called via work + queues that hold the mutex (like il4965_bg_alive_start) + +Add mutex_lock()/mutex_unlock() around the il_set_tx_power() call in +the sysfs store function to fix the missing lock protection. + +Signed-off-by: Ziyi Guo +Acked-by: Stanislaw Gruszka +Link: https://patch.msgid.link/20260125194039.1196488-1-n7l8m4@u.northwestern.edu +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c +index 6e5decf79a06b..7ef27f95c5265 100644 +--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c ++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c +@@ -4613,7 +4613,9 @@ il4965_store_tx_power(struct device *d, struct device_attribute *attr, + if (ret) + IL_INFO("%s is not in decimal form.\n", buf); + else { ++ mutex_lock(&il->mutex); + ret = il_set_tx_power(il, val, false); ++ mutex_unlock(&il->mutex); + if (ret) + IL_ERR("failed setting tx power (0x%08x).\n", ret); + else +-- +2.51.0 + diff --git a/queue-5.10/wifi-libertas-fix-warning-in-usb_tx_block.patch b/queue-5.10/wifi-libertas-fix-warning-in-usb_tx_block.patch new file mode 100644 index 00000000000..a987c82123b --- /dev/null +++ b/queue-5.10/wifi-libertas-fix-warning-in-usb_tx_block.patch @@ -0,0 +1,44 @@ +From ae5de5e2112656d1809f5974491b194ac51e4d20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Dec 2025 16:58:06 +0100 +Subject: wifi: libertas: fix WARNING in usb_tx_block + +From: Szymon Wilczek + +[ Upstream commit d66676e6ca96bf8680f869a9bd6573b26c634622 ] + +The function usb_tx_block() submits cardp->tx_urb without ensuring that +any previous transmission on this URB has completed. If a second call +occurs while the URB is still active (e.g. during rapid firmware loading), +usb_submit_urb() detects the active state and triggers a warning: +'URB submitted while active'. + +Fix this by enforcing serialization: call usb_kill_urb() before +submitting the new request. This ensures the URB is idle and safe to reuse. + +Reported-by: syzbot+67969ab6a2551c27f71b@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=67969ab6a2551c27f71b +Signed-off-by: Szymon Wilczek +Link: https://patch.msgid.link/20251221155806.23925-1-swilczek.lx@gmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/libertas/if_usb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c +index 2240b4db8c036..d98c81539ba53 100644 +--- a/drivers/net/wireless/marvell/libertas/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas/if_usb.c +@@ -426,6 +426,8 @@ static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload, uint16_t nb + goto tx_ret; + } + ++ usb_kill_urb(cardp->tx_urb); ++ + usb_fill_bulk_urb(cardp->tx_urb, cardp->udev, + usb_sndbulkpipe(cardp->udev, + cardp->ep_out), +-- +2.51.0 + diff --git a/queue-5.10/x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch b/queue-5.10/x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch new file mode 100644 index 00000000000..a114c9f0e53 --- /dev/null +++ b/queue-5.10/x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch @@ -0,0 +1,46 @@ +From 7f6b5377fc41cb5b0e3c80e8deb4b0cf8163396a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 12:00:08 +0800 +Subject: x86/xen/pvh: Enable PAE mode for 32-bit guest only when + CONFIG_X86_PAE is set + +From: Hou Wenlong + +[ Upstream commit db9aded979b491a24871e1621cd4e8822dbca859 ] + +The PVH entry is available for 32-bit KVM guests, and 32-bit KVM guests +do not depend on CONFIG_X86_PAE. However, mk_early_pgtbl_32() builds +different pagetables depending on whether CONFIG_X86_PAE is set. +Therefore, enabling PAE mode for 32-bit KVM guests without +CONFIG_X86_PAE being set would result in a boot failure during CR3 +loading. + +Signed-off-by: Hou Wenlong +Reviewed-by: Juergen Gross +Signed-off-by: Juergen Gross +Message-ID: +Signed-off-by: Sasha Levin +--- + arch/x86/platform/pvh/head.S | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/x86/platform/pvh/head.S b/arch/x86/platform/pvh/head.S +index bfd4e63a90cbe..f7713d5d07f9f 100644 +--- a/arch/x86/platform/pvh/head.S ++++ b/arch/x86/platform/pvh/head.S +@@ -69,10 +69,12 @@ SYM_CODE_START_LOCAL(pvh_start_xen) + + mov $_pa(early_stack_end), %esp + ++#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE) + /* Enable PAE mode. */ + mov %cr4, %eax + orl $X86_CR4_PAE, %eax + mov %eax, %cr4 ++#endif + + #ifdef CONFIG_X86_64 + /* Enable Long mode. */ +-- +2.51.0 + diff --git a/queue-5.10/xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch b/queue-5.10/xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch new file mode 100644 index 00000000000..6cd195eb905 --- /dev/null +++ b/queue-5.10/xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch @@ -0,0 +1,61 @@ +From 14deb1d3d439bb8f1e67d58bd230d30d77acd0f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 17:47:29 -0500 +Subject: xenbus: Use .freeze/.thaw to handle xenbus devices + +From: Jason Andryuk + +[ Upstream commit e08dd1ee49838750a514e83c0aa60cd12ba6ecbb ] + +The goal is to fix s2idle and S3 for Xen PV devices. A domain resuming +from s3 or s2idle disconnects its PV devices during resume. The +backends are not expecting this and do not reconnect. + +b3e96c0c7562 ("xen: use freeze/restore/thaw PM events for suspend/ +resume/chkpt") changed xen_suspend()/do_suspend() from +PMSG_SUSPEND/PMSG_RESUME to PMSG_FREEZE/PMSG_THAW/PMSG_RESTORE, but the +suspend/resume callbacks remained. + +.freeze/restore are used with hiberation where Linux restarts in a new +place in the future. .suspend/resume are useful for runtime power +management for the duration of a boot. + +The current behavior of the callbacks works for an xl save/restore or +live migration where the domain is restored/migrated to a new location +and connecting to a not-already-connected backend. + +Change xenbus_pm_ops to use .freeze/thaw/restore and drop the +.suspend/resume hook. This matches the use in drivers/xen/manage.c for +save/restore and live migration. With .suspend/resume empty, PV devices +are left connected during s2idle and s3, so PV devices are not changed +and work after resume. + +Signed-off-by: Jason Andryuk +Acked-by: Juergen Gross +Signed-off-by: Juergen Gross +Message-ID: <20251119224731.61497-2-jason.andryuk@amd.com> +Signed-off-by: Sasha Levin +--- + drivers/xen/xenbus/xenbus_probe_frontend.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c +index 480944606a3c9..73cf4810715e4 100644 +--- a/drivers/xen/xenbus/xenbus_probe_frontend.c ++++ b/drivers/xen/xenbus/xenbus_probe_frontend.c +@@ -148,11 +148,9 @@ static void xenbus_frontend_dev_shutdown(struct device *_dev) + } + + static const struct dev_pm_ops xenbus_pm_ops = { +- .suspend = xenbus_dev_suspend, +- .resume = xenbus_frontend_dev_resume, + .freeze = xenbus_dev_suspend, + .thaw = xenbus_dev_cancel, +- .restore = xenbus_dev_resume, ++ .restore = xenbus_frontend_dev_resume, + }; + + static struct xen_bus_type xenbus_frontend = { +-- +2.51.0 + diff --git a/queue-5.15/acpi-processor-fix-null-pointer-dereference-in-acpi_.patch b/queue-5.15/acpi-processor-fix-null-pointer-dereference-in-acpi_.patch new file mode 100644 index 00000000000..9093d5522f4 --- /dev/null +++ b/queue-5.15/acpi-processor-fix-null-pointer-dereference-in-acpi_.patch @@ -0,0 +1,101 @@ +From b804d52b7167d0396205da1643b85049d3fbc0ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 00:32:14 +0800 +Subject: ACPI: processor: Fix NULL-pointer dereference in + acpi_processor_errata_piix4() + +From: Tuo Li + +[ Upstream commit f132e089fe89cadc2098991f0a3cb05c3f824ac6 ] + +In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE +device and then reassigned an ISA device: + + dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...); + dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...); + +If the first lookup succeeds but the second fails, dev becomes NULL. This +leads to a potential null-pointer dereference when dev_dbg() is called: + + if (errata.piix4.bmisx) + dev_dbg(&dev->dev, ...); + +To prevent this, use two temporary pointers and retrieve each device +independently, avoiding overwriting dev with a possible NULL value. + +Signed-off-by: Tuo Li +[ rjw: Subject adjustment, added an empty code line ] +Link: https://patch.msgid.link/20260111163214.202262-1-islituo@gmail.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpi_processor.c | 28 +++++++++++++++------------- + 1 file changed, 15 insertions(+), 13 deletions(-) + +diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c +index cfa75b14caa2b..669398045c0fd 100644 +--- a/drivers/acpi/acpi_processor.c ++++ b/drivers/acpi/acpi_processor.c +@@ -33,6 +33,7 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev) + { + u8 value1 = 0; + u8 value2 = 0; ++ struct pci_dev *ide_dev = NULL, *isa_dev = NULL; + + + if (!dev) +@@ -90,12 +91,12 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev) + * each IDE controller's DMA status to make sure we catch all + * DMA activity. + */ +- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, ++ ide_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, + PCI_DEVICE_ID_INTEL_82371AB, + PCI_ANY_ID, PCI_ANY_ID, NULL); +- if (dev) { +- errata.piix4.bmisx = pci_resource_start(dev, 4); +- pci_dev_put(dev); ++ if (ide_dev) { ++ errata.piix4.bmisx = pci_resource_start(ide_dev, 4); ++ pci_dev_put(ide_dev); + } + + /* +@@ -107,24 +108,25 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev) + * disable C3 support if this is enabled, as some legacy + * devices won't operate well if fast DMA is disabled. + */ +- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, ++ isa_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, + PCI_DEVICE_ID_INTEL_82371AB_0, + PCI_ANY_ID, PCI_ANY_ID, NULL); +- if (dev) { +- pci_read_config_byte(dev, 0x76, &value1); +- pci_read_config_byte(dev, 0x77, &value2); ++ if (isa_dev) { ++ pci_read_config_byte(isa_dev, 0x76, &value1); ++ pci_read_config_byte(isa_dev, 0x77, &value2); + if ((value1 & 0x80) || (value2 & 0x80)) + errata.piix4.fdma = 1; +- pci_dev_put(dev); ++ pci_dev_put(isa_dev); + } + + break; + } + +- if (errata.piix4.bmisx) +- dev_dbg(&dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n"); +- if (errata.piix4.fdma) +- dev_dbg(&dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n"); ++ if (ide_dev) ++ dev_dbg(&ide_dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n"); ++ ++ if (isa_dev) ++ dev_dbg(&isa_dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n"); + + return 0; + } +-- +2.51.0 + diff --git a/queue-5.15/acpica-abort-aml-bytecode-execution-when-executing-a.patch b/queue-5.15/acpica-abort-aml-bytecode-execution-when-executing-a.patch new file mode 100644 index 00000000000..c19bf4e2bdb --- /dev/null +++ b/queue-5.15/acpica-abort-aml-bytecode-execution-when-executing-a.patch @@ -0,0 +1,129 @@ +From bdd4befd3e0afc5abcef0db009741a47e1bc2c0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 13:25:33 +0100 +Subject: ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP + +From: Armin Wolf + +[ Upstream commit 026ad376a6a48538b576f3589331daa94daae6f0 ] + +The ACPI specification states that when executing AML_FATAL_OP, +the OS should log the fatal error event and shutdown in a timely +fashion. + +Windows complies with this requirement by immediatly entering a +Bso_d, effectively aborting the execution of the AML bytecode in +question. + +ACPICA however might continue with the AML bytecode execution +should acpi_os_signal() simply return AE_OK. This will cause issues +because ACPI BIOS implementations might assume that the Fatal() +operator does not return. + +Fix this by aborting the AML bytecode execution in such a case +by returning AE_ERROR. Also turn struct acpi_signal_fatal_info into a +local variable because of its small size (12 bytes) and to ensure +that acpi_os_signal() always receives valid information about the +fatal ACPI BIOS error. + +Link: https://github.com/acpica/acpica/commit/d516c7758ba6 +Signed-off-by: Armin Wolf +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/3325491.5fSG56mABF@rafael.j.wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/exoparg3.c | 46 +++++++++++++--------------------- + 1 file changed, 18 insertions(+), 28 deletions(-) + +diff --git a/drivers/acpi/acpica/exoparg3.c b/drivers/acpi/acpica/exoparg3.c +index 140aae0096904..109abf3e12fce 100644 +--- a/drivers/acpi/acpica/exoparg3.c ++++ b/drivers/acpi/acpica/exoparg3.c +@@ -10,6 +10,7 @@ + #include + #include "accommon.h" + #include "acinterp.h" ++#include + #include "acparser.h" + #include "amlcode.h" + +@@ -51,8 +52,7 @@ ACPI_MODULE_NAME("exoparg3") + acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state) + { + union acpi_operand_object **operand = &walk_state->operands[0]; +- struct acpi_signal_fatal_info *fatal; +- acpi_status status = AE_OK; ++ struct acpi_signal_fatal_info fatal; + + ACPI_FUNCTION_TRACE_STR(ex_opcode_3A_0T_0R, + acpi_ps_get_opcode_name(walk_state->opcode)); +@@ -60,28 +60,23 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state) + switch (walk_state->opcode) { + case AML_FATAL_OP: /* Fatal (fatal_type fatal_code fatal_arg) */ + +- ACPI_DEBUG_PRINT((ACPI_DB_INFO, +- "FatalOp: Type %X Code %X Arg %X " +- "<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n", +- (u32)operand[0]->integer.value, +- (u32)operand[1]->integer.value, +- (u32)operand[2]->integer.value)); +- +- fatal = ACPI_ALLOCATE(sizeof(struct acpi_signal_fatal_info)); +- if (fatal) { +- fatal->type = (u32) operand[0]->integer.value; +- fatal->code = (u32) operand[1]->integer.value; +- fatal->argument = (u32) operand[2]->integer.value; +- } ++ fatal.type = (u32)operand[0]->integer.value; ++ fatal.code = (u32)operand[1]->integer.value; ++ fatal.argument = (u32)operand[2]->integer.value; + +- /* Always signal the OS! */ ++ ACPI_BIOS_ERROR((AE_INFO, ++ "Fatal ACPI BIOS error (Type 0x%X Code 0x%X Arg 0x%X)\n", ++ fatal.type, fatal.code, fatal.argument)); + +- status = acpi_os_signal(ACPI_SIGNAL_FATAL, fatal); ++ /* Always signal the OS! */ + +- /* Might return while OS is shutting down, just continue */ ++ acpi_os_signal(ACPI_SIGNAL_FATAL, &fatal); + +- ACPI_FREE(fatal); +- goto cleanup; ++ /* ++ * Might return while OS is shutting down, so abort the AML execution ++ * by returning an error. ++ */ ++ return_ACPI_STATUS(AE_ERROR); + + case AML_EXTERNAL_OP: + /* +@@ -93,21 +88,16 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state) + * wrong if an external opcode ever gets here. + */ + ACPI_ERROR((AE_INFO, "Executed External Op")); +- status = AE_OK; +- goto cleanup; ++ ++ return_ACPI_STATUS(AE_OK); + + default: + + ACPI_ERROR((AE_INFO, "Unknown AML opcode 0x%X", + walk_state->opcode)); + +- status = AE_AML_BAD_OPCODE; +- goto cleanup; ++ return_ACPI_STATUS(AE_AML_BAD_OPCODE); + } +- +-cleanup: +- +- return_ACPI_STATUS(status); + } + + /******************************************************************************* +-- +2.51.0 + diff --git a/queue-5.15/alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch b/queue-5.15/alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch new file mode 100644 index 00000000000..8b1cb646584 --- /dev/null +++ b/queue-5.15/alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch @@ -0,0 +1,42 @@ +From 28ab4cc1a3fcd03802d7dcd3fef5b742bfaea4b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 08:38:29 +0000 +Subject: ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio + +From: Lianqin Hu + +[ Upstream commit ac656d7d7c70f7c352c7652bc2bb0c1c8c2dde08 ] + +Setting up the interface when suspended/resumeing fail on this card. +Adding a reset and delay quirk will eliminate this problem. + +usb 1-1: New USB device found, idVendor=001f, idProduct=0b21 +usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 +usb 1-1: Product: AB13X USB Audio +usb 1-1: Manufacturer: Generic +usb 1-1: SerialNumber: 20210926172016 + +Signed-off-by: Lianqin Hu +Link: https://patch.msgid.link/TYUPR06MB6217522D0DB6E2C9DF46B56ED265A@TYUPR06MB6217.apcprd06.prod.outlook.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/quirks.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index f24a334316a29..778304f349699 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1768,6 +1768,8 @@ struct usb_audio_quirk_flags_table { + + static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + /* Device matches */ ++ DEVICE_FLG(0x001f, 0x0b21, /* AB13X USB Audio */ ++ QUIRK_FLAG_FORCE_IFACE_RESET | QUIRK_FLAG_IFACE_DELAY), + DEVICE_FLG(0x03f0, 0x654a, /* HP 320 FHD Webcam */ + QUIRK_FLAG_GET_SAMPLE_RATE), + DEVICE_FLG(0x041e, 0x3000, /* Creative SB Extigy */ +-- +2.51.0 + diff --git a/queue-5.15/alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch b/queue-5.15/alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch new file mode 100644 index 00000000000..0210abfc21b --- /dev/null +++ b/queue-5.15/alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch @@ -0,0 +1,108 @@ +From 3795363b160300eaba7dcdf62963a92ab1c50ece Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Feb 2026 15:12:07 +0100 +Subject: ALSA: usb-audio: Add sanity check for OOB writes at silencing + +From: Takashi Iwai + +[ Upstream commit fba2105a157fffcf19825e4eea498346738c9948 ] + +At silencing the playback URB packets in the implicit fb mode before +the actual playback, we blindly assume that the received packets fit +with the buffer size. But when the setup in the capture stream +differs from the playback stream (e.g. due to the USB core limitation +of max packet size), such an inconsistency may lead to OOB writes to +the buffer, resulting in a crash. + +For addressing it, add a sanity check of the transfer buffer size at +prepare_silent_urb(), and stop the data copy if the received data +overflows. Also, report back the transfer error properly from there, +too. + +Note that this doesn't fix the root cause of the playback error +itself, but this merely covers the kernel Oops. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076 +Link: https://patch.msgid.link/20260216141209.1849200-4-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/endpoint.c | 39 ++++++++++++++++++++++----------------- + 1 file changed, 22 insertions(+), 17 deletions(-) + +diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c +index f7cad63ae43f0..e442a4fcead9b 100644 +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -277,8 +277,8 @@ static inline bool has_tx_length_quirk(struct snd_usb_audio *chip) + return chip->quirk_flags & QUIRK_FLAG_TX_LENGTH; + } + +-static void prepare_silent_urb(struct snd_usb_endpoint *ep, +- struct snd_urb_ctx *ctx) ++static int prepare_silent_urb(struct snd_usb_endpoint *ep, ++ struct snd_urb_ctx *ctx) + { + struct urb *urb = ctx->urb; + unsigned int offs = 0; +@@ -291,28 +291,34 @@ static void prepare_silent_urb(struct snd_usb_endpoint *ep, + extra = sizeof(packet_length); + + for (i = 0; i < ctx->packets; ++i) { +- unsigned int offset; +- unsigned int length; +- int counts; +- +- counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0); +- length = counts * ep->stride; /* number of silent bytes */ +- offset = offs * ep->stride + extra * i; +- urb->iso_frame_desc[i].offset = offset; ++ int length; ++ ++ length = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0); ++ if (length < 0) ++ return length; ++ length *= ep->stride; /* number of silent bytes */ ++ if (offs + length + extra > ctx->buffer_size) ++ break; ++ urb->iso_frame_desc[i].offset = offs; + urb->iso_frame_desc[i].length = length + extra; + if (extra) { + packet_length = cpu_to_le32(length); +- memcpy(urb->transfer_buffer + offset, ++ memcpy(urb->transfer_buffer + offs, + &packet_length, sizeof(packet_length)); ++ offs += extra; + } +- memset(urb->transfer_buffer + offset + extra, ++ memset(urb->transfer_buffer + offs, + ep->silence_value, length); +- offs += counts; ++ offs += length; + } + +- urb->number_of_packets = ctx->packets; +- urb->transfer_buffer_length = offs * ep->stride + ctx->packets * extra; ++ if (!offs) ++ return -EPIPE; ++ ++ urb->number_of_packets = i; ++ urb->transfer_buffer_length = offs; + ctx->queued = 0; ++ return 0; + } + + /* +@@ -334,8 +340,7 @@ static int prepare_outbound_urb(struct snd_usb_endpoint *ep, + if (data_subs && ep->prepare_data_urb) + return ep->prepare_data_urb(data_subs, urb, in_stream_lock); + /* no data provider, so send silence */ +- prepare_silent_urb(ep, ctx); +- break; ++ return prepare_silent_urb(ep, ctx); + + case SND_USB_ENDPOINT_TYPE_SYNC: + if (snd_usb_get_speed(ep->chip->dev) >= USB_SPEED_HIGH) { +-- +2.51.0 + diff --git a/queue-5.15/alsa-usb-audio-update-the-number-of-packets-properly.patch b/queue-5.15/alsa-usb-audio-update-the-number-of-packets-properly.patch new file mode 100644 index 00000000000..3694aa6228f --- /dev/null +++ b/queue-5.15/alsa-usb-audio-update-the-number-of-packets-properly.patch @@ -0,0 +1,37 @@ +From c45d1df84e0d075c83415c87d3f8e259b56c68d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Feb 2026 15:12:05 +0100 +Subject: ALSA: usb-audio: Update the number of packets properly at receiving + +From: Takashi Iwai + +[ Upstream commit cf044e44190234a41a788de1cdbb6c21f4a52e1e ] + +At receiving the packets from the implicit feedback source, we didn't +update ctx->packets field but only the ctx->packet_size[] data. +In exceptional cases, this might lead to unexpectedly superfluous data +transfer (although this won't happen usually due to the nature of USB +isochronous transfer). Fix it to update the field properly. + +Link: https://patch.msgid.link/20260216141209.1849200-2-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/endpoint.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c +index 40c5825fa41e5..f7cad63ae43f0 100644 +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -488,6 +488,7 @@ int snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep, + + /* copy over the length information */ + if (implicit_fb) { ++ ctx->packets = packet->packets; + for (i = 0; i < packet->packets; i++) + ctx->packet_size[i] = packet->packet_size[i]; + } +-- +2.51.0 + diff --git a/queue-5.15/apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch b/queue-5.15/apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch new file mode 100644 index 00000000000..045e0601acf --- /dev/null +++ b/queue-5.15/apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch @@ -0,0 +1,137 @@ +From b1269a5881ce3ff3dbda6859762a38064e659ba3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:35:05 +0100 +Subject: APEI/GHES: ensure that won't go past CPER allocated record + +From: Mauro Carvalho Chehab + +[ Upstream commit fa2408a24f8f0db14d9cfc613ef162dc267d7ad4 ] + +The logic at ghes_new() prevents allocating too large records, by +checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB). +Yet, the allocation is done with the actual number of pages from the +CPER bios table location, which can be smaller. + +Yet, a bad firmware could send data with a different size, which might +be bigger than the allocated memory, causing an OOPS: + + Unable to handle kernel paging request at virtual address fff00000f9b40000 + Mem abort info: + ESR = 0x0000000096000007 + EC = 0x25: DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 + FSC = 0x07: level 3 translation fault + Data abort info: + ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 + CM = 0, WnR = 0, TnD = 0, TagAccess = 0 + GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 + swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000 + [fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000 + Internal error: Oops: 0000000096000007 [#1] SMP + Modules linked in: + CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT + Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022 + Workqueue: kacpi_notify acpi_os_execute_deferred + pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) + pc : hex_dump_to_buffer+0x30c/0x4a0 + lr : hex_dump_to_buffer+0x328/0x4a0 + sp : ffff800080e13880 + x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083 + x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004 + x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083 + x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010 + x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020 + x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008 + x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000 + x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020 + x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000 + x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008 + Call trace: + hex_dump_to_buffer+0x30c/0x4a0 (P) + print_hex_dump+0xac/0x170 + cper_estatus_print_section+0x90c/0x968 + cper_estatus_print+0xf0/0x158 + __ghes_print_estatus+0xa0/0x148 + ghes_proc+0x1bc/0x220 + ghes_notify_hed+0x5c/0xb8 + notifier_call_chain+0x78/0x148 + blocking_notifier_call_chain+0x4c/0x80 + acpi_hed_notify+0x28/0x40 + acpi_ev_notify_dispatch+0x50/0x80 + acpi_os_execute_deferred+0x24/0x48 + process_one_work+0x15c/0x3b0 + worker_thread+0x2d0/0x400 + kthread+0x148/0x228 + ret_from_fork+0x10/0x20 + Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44) + ---[ end trace 0000000000000000 ]--- + +Prevent that by taking the actual allocated are into account when +checking for CPER length. + +Signed-off-by: Mauro Carvalho Chehab +Reviewed-by: Jonathan Cameron +Acked-by: Ard Biesheuvel +Reviewed-by: Hanjun Guo +[ rjw: Subject tweaks ] +Link: https://patch.msgid.link/4e70310a816577fabf37d94ed36cde4ad62b1e0a.1767871950.git.mchehab+huawei@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/apei/ghes.c | 6 +++++- + include/acpi/ghes.h | 1 + + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c +index bdb23ca251e23..28651f9e6d60f 100644 +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -262,6 +263,7 @@ static struct ghes *ghes_new(struct acpi_hest_generic *generic) + error_block_length = GHES_ESTATUS_MAX_SIZE; + } + ghes->estatus = kmalloc(error_block_length, GFP_KERNEL); ++ ghes->estatus_length = error_block_length; + if (!ghes->estatus) { + rc = -ENOMEM; + goto err_unmap_status_addr; +@@ -333,13 +335,15 @@ static int __ghes_check_estatus(struct ghes *ghes, + struct acpi_hest_generic_status *estatus) + { + u32 len = cper_estatus_len(estatus); ++ u32 max_len = min(ghes->generic->error_block_length, ++ ghes->estatus_length); + + if (len < sizeof(*estatus)) { + pr_warn_ratelimited(FW_WARN GHES_PFX "Truncated error status block!\n"); + return -EIO; + } + +- if (len > ghes->generic->error_block_length) { ++ if (!len || len > max_len) { + pr_warn_ratelimited(FW_WARN GHES_PFX "Invalid error status block length!\n"); + return -EIO; + } +diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h +index 292a5c40bd0c6..259ae345849f0 100644 +--- a/include/acpi/ghes.h ++++ b/include/acpi/ghes.h +@@ -21,6 +21,7 @@ struct ghes { + struct acpi_hest_generic_v2 *generic_v2; + }; + struct acpi_hest_generic_status *estatus; ++ unsigned int estatus_length; + unsigned long flags; + union { + struct list_head list; +-- +2.51.0 + diff --git a/queue-5.15/arm-9467-1-mm-don-t-use-pk-through-printk.patch b/queue-5.15/arm-9467-1-mm-don-t-use-pk-through-printk.patch new file mode 100644 index 00000000000..15d5563e890 --- /dev/null +++ b/queue-5.15/arm-9467-1-mm-don-t-use-pk-through-printk.patch @@ -0,0 +1,42 @@ +From 4f7a5343c2ae0d26c0416149b3877dca8078d1a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 10:56:33 +0100 +Subject: ARM: 9467/1: mm: Don't use %pK through printk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weissschuh + +[ Upstream commit 012ea376a5948b025f260aa45d2a6ec5d96674ea ] + +Restricted pointers ("%pK") were never meant to be used +through printk(). They can acquire sleeping locks in atomic contexts. + +Switch to %px over the more secure %p as this usage is a debugging aid, +gated behind CONFIG_DEBUG_VIRTUAL and used by WARN(). + +Link: https://lore.kernel.org/lkml/20250113171731-dc10e3c1-da64-4af0-b767-7c7070468023@linutronix.de/ +Signed-off-by: Thomas Weißschuh +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/mm/physaddr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/mm/physaddr.c b/arch/arm/mm/physaddr.c +index cf75819e4c137..4ae327bf7aa29 100644 +--- a/arch/arm/mm/physaddr.c ++++ b/arch/arm/mm/physaddr.c +@@ -38,7 +38,7 @@ static inline bool __virt_addr_valid(unsigned long x) + phys_addr_t __virt_to_phys(unsigned long x) + { + WARN(!__virt_addr_valid(x), +- "virt_to_phys used for non-linear address: %pK (%pS)\n", ++ "virt_to_phys used for non-linear address: %px (%pS)\n", + (void *)x, (void *)x); + + return __virt_to_phys_nodebug(x); +-- +2.51.0 + diff --git a/queue-5.15/arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch b/queue-5.15/arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch new file mode 100644 index 00000000000..529afbf6d83 --- /dev/null +++ b/queue-5.15/arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch @@ -0,0 +1,37 @@ +From aeaa0ca0adca6d60460b0eaf7d3b9e36fb079f4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Dec 2025 17:24:48 +0800 +Subject: arm64: Add support for TSV110 Spectre-BHB mitigation + +From: Jinqian Yang + +[ Upstream commit e3baa5d4b361276efeb87b20d8beced451a7dbd5 ] + +The TSV110 processor is vulnerable to the Spectre-BHB (Branch History +Buffer) attack, which can be exploited to leak information through +branch prediction side channels. This commit adds the MIDR of TSV110 +to the list for software mitigation. + +Signed-off-by: Jinqian Yang +Reviewed-by: Zenghui Yu +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/proton-pack.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c +index 42359eaba2dba..6fd2caa968fbe 100644 +--- a/arch/arm64/kernel/proton-pack.c ++++ b/arch/arm64/kernel/proton-pack.c +@@ -896,6 +896,7 @@ static u8 spectre_bhb_loop_affected(void) + MIDR_ALL_VERSIONS(MIDR_CORTEX_X2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), ++ MIDR_ALL_VERSIONS(MIDR_HISI_TSV110), + {}, + }; + static const struct midr_range spectre_bhb_k24_list[] = { +-- +2.51.0 + diff --git a/queue-5.15/arm64-tegra-smaug-add-usb-role-switch-support.patch b/queue-5.15/arm64-tegra-smaug-add-usb-role-switch-support.patch new file mode 100644 index 00000000000..71e45993d71 --- /dev/null +++ b/queue-5.15/arm64-tegra-smaug-add-usb-role-switch-support.patch @@ -0,0 +1,37 @@ +From 140d0b7689b43dc8f5c67092577229081ef0a8f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Dec 2025 21:27:21 +0000 +Subject: arm64: tegra: smaug: Add usb-role-switch support + +From: Diogo Ivo + +[ Upstream commit dfa93788dd8b2f9c59adf45ecf592082b1847b7b ] + +The USB2 port on Smaug is configured for OTG operation but lacked the +required 'usb-role-switch' property, leading to a failed probe and a +non-functioning USB port. Add the property along with setting the default +role to host. + +Signed-off-by: Diogo Ivo +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/nvidia/tegra210-smaug.dts | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts +index 131c064d69919..5fae86c1e4f10 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts ++++ b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts +@@ -1687,6 +1687,8 @@ usb2-0 { + status = "okay"; + vbus-supply = <&usbc_vbus>; + mode = "otg"; ++ usb-role-switch; ++ role-switch-default-mode = "host"; + }; + + usb3-0 { +-- +2.51.0 + diff --git a/queue-5.15/asoc-es8328-add-error-unwind-in-resume.patch b/queue-5.15/asoc-es8328-add-error-unwind-in-resume.patch new file mode 100644 index 00000000000..954726658b5 --- /dev/null +++ b/queue-5.15/asoc-es8328-add-error-unwind-in-resume.patch @@ -0,0 +1,57 @@ +From 31496fbeec6d849beba92f50f7e5551dea060551 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Jan 2026 00:00:17 +0800 +Subject: ASoC: es8328: Add error unwind in resume + +From: Hsieh Hung-En + +[ Upstream commit 8232e6079ae6f8d3a61d87973cb427385aa469b9 ] + +Handle failures in the resume path by unwinding previously enabled +resources. + +If enabling regulators or syncing the regcache fails, disable regulators +and unprepare the clock to avoid leaking resources and leaving the device +in a partially resumed state. + +Signed-off-by: Hsieh Hung-En +Link: https://patch.msgid.link/20260130160017.2630-6-hungen3108@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/es8328.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c +index fe4763805df94..0e4951c4febbd 100644 +--- a/sound/soc/codecs/es8328.c ++++ b/sound/soc/codecs/es8328.c +@@ -750,17 +750,23 @@ static int es8328_resume(struct snd_soc_component *component) + es8328->supplies); + if (ret) { + dev_err(component->dev, "unable to enable regulators\n"); +- return ret; ++ goto err_clk; + } + + regcache_mark_dirty(regmap); + ret = regcache_sync(regmap); + if (ret) { + dev_err(component->dev, "unable to sync regcache\n"); +- return ret; ++ goto err_regulators; + } + + return 0; ++ ++err_regulators: ++ regulator_bulk_disable(ARRAY_SIZE(es8328->supplies), es8328->supplies); ++err_clk: ++ clk_disable_unprepare(es8328->clk); ++ return ret; + } + + static int es8328_component_probe(struct snd_soc_component *component) +-- +2.51.0 + diff --git a/queue-5.15/asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch b/queue-5.15/asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch new file mode 100644 index 00000000000..2c6288935a2 --- /dev/null +++ b/queue-5.15/asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch @@ -0,0 +1,36 @@ +From 0d309828969dd169e1f946a38836f4fa15d5f577 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 04:02:08 +0100 +Subject: ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask + +From: Sebastian Krzyszkowiak + +[ Upstream commit 66c26346ae30c883eef70acf9cf9054dfdb4fb2f ] + +This bit is handled by a separate control. + +Signed-off-by: Sebastian Krzyszkowiak +Reviewed-by: Charles Keepax +Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-1-f4f4eeacf089@puri.sm +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index b5a35999d8dfa..a22a95fb4fd1d 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -1759,7 +1759,7 @@ SND_SOC_BYTES("EQR Coefficients", WM8962_EQ24, 18), + + + SOC_SINGLE("3D Switch", WM8962_THREED1, 0, 1, 0), +-SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA), ++SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA | WM8962_ADC_MONOMIX), + + SOC_SINGLE("DF1 Switch", WM8962_DF1, 0, 1, 0), + SND_SOC_BYTES_MASK("DF1 Coefficients", WM8962_DF1, 7, WM8962_DF1_ENA), +-- +2.51.0 + diff --git a/queue-5.15/asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch b/queue-5.15/asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch new file mode 100644 index 00000000000..4228c66e086 --- /dev/null +++ b/queue-5.15/asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch @@ -0,0 +1,58 @@ +From 35dffb465787b15870fe925ed930f8bb0606038d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 04:02:10 +0100 +Subject: ASoC: wm8962: Don't report a microphone if it's shorted to ground on + plug + +From: Sebastian Krzyszkowiak + +[ Upstream commit e590752119029d87ce46d725e11245a52d22e1fe ] + +This usually means that a TRS plug with no microphone pin has been plugged +into a TRRS socket. Cases where a user is plugging in a microphone while +pressing a button will be handled via incoming interrupt after the user +releases the button, so the microphone will still be detected once it +becomes usable. + +Signed-off-by: Sebastian Krzyszkowiak +Reviewed-by: Charles Keepax +Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-3-f4f4eeacf089@puri.sm +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index a22a95fb4fd1d..d8497b06c0638 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -67,6 +67,8 @@ struct wm8962_priv { + struct mutex dsp2_ena_lock; + u16 dsp2_ena; + ++ int mic_status; ++ + struct delayed_work mic_work; + struct snd_soc_jack *jack; + +@@ -3061,8 +3063,16 @@ static void wm8962_mic_work(struct work_struct *work) + if (reg & WM8962_MICSHORT_STS) { + status |= SND_JACK_BTN_0; + irq_pol |= WM8962_MICSCD_IRQ_POL; ++ ++ /* Don't report a microphone if it's shorted right after ++ * plugging in, as this may be a TRS plug in a TRRS socket. ++ */ ++ if (!(wm8962->mic_status & WM8962_MICDET_STS)) ++ status = 0; + } + ++ wm8962->mic_status = status; ++ + snd_soc_jack_report(wm8962->jack, status, + SND_JACK_MICROPHONE | SND_JACK_BTN_0); + +-- +2.51.0 + diff --git a/queue-5.15/audit-add-fchmodat2-to-change-attributes-class.patch b/queue-5.15/audit-add-fchmodat2-to-change-attributes-class.patch new file mode 100644 index 00000000000..c004e3b44ad --- /dev/null +++ b/queue-5.15/audit-add-fchmodat2-to-change-attributes-class.patch @@ -0,0 +1,42 @@ +From 55f32e5d8b58a04423766a357675e2cc98b7336d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 20:49:30 +0100 +Subject: audit: add fchmodat2() to change attributes class + +From: Jeffrey Bencteux + +[ Upstream commit 4f493a6079b588cf1f04ce5ed6cdad45ab0d53dc ] + +fchmodat2(), introduced in version 6.6 is currently not in the change +attribute class of audit. Calling fchmodat2() to change a file +attribute in the same fashion than chmod() or fchmodat() will bypass +audit rules such as: + +-w /tmp/test -p rwa -k test_rwa + +The current patch adds fchmodat2() to the change attributes class. + +Signed-off-by: Jeffrey Bencteux +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + include/asm-generic/audit_change_attr.h | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/include/asm-generic/audit_change_attr.h b/include/asm-generic/audit_change_attr.h +index 331670807cf01..6c311d4d37f4e 100644 +--- a/include/asm-generic/audit_change_attr.h ++++ b/include/asm-generic/audit_change_attr.h +@@ -20,6 +20,9 @@ __NR_fremovexattr, + __NR_fchownat, + __NR_fchmodat, + #endif ++#ifdef __NR_fchmodat2 ++__NR_fchmodat2, ++#endif + #ifdef __NR_chown32 + __NR_chown32, + __NR_fchown32, +-- +2.51.0 + diff --git a/queue-5.15/audit-add-missing-syscalls-to-read-class.patch b/queue-5.15/audit-add-missing-syscalls-to-read-class.patch new file mode 100644 index 00000000000..75cf57c9308 --- /dev/null +++ b/queue-5.15/audit-add-missing-syscalls-to-read-class.patch @@ -0,0 +1,47 @@ +From 227a7e62b1daba8b92d1fad8c43f28ed7022b2ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Dec 2025 09:39:24 +0100 +Subject: audit: add missing syscalls to read class + +From: Jeffrey Bencteux + +[ Upstream commit bcb90a2834c7393c26df9609b889a3097b7700cd ] + +The "at" variant of getxattr() and listxattr() are missing from the +audit read class. Calling getxattrat() or listxattrat() on a file to +read its extended attributes will bypass audit rules such as: + +-w /tmp/test -p rwa -k test_rwa + +The current patch adds missing syscalls to the audit read class. + +Signed-off-by: Jeffrey Bencteux +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + include/asm-generic/audit_read.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/include/asm-generic/audit_read.h b/include/asm-generic/audit_read.h +index 7bb7b5a83ae2e..fb9991f53fb6f 100644 +--- a/include/asm-generic/audit_read.h ++++ b/include/asm-generic/audit_read.h +@@ -4,9 +4,15 @@ __NR_readlink, + #endif + __NR_quotactl, + __NR_listxattr, ++#ifdef __NR_listxattrat ++__NR_listxattrat, ++#endif + __NR_llistxattr, + __NR_flistxattr, + __NR_getxattr, ++#ifdef __NR_getxattrat ++__NR_getxattrat, ++#endif + __NR_lgetxattr, + __NR_fgetxattr, + #ifdef __NR_readlinkat +-- +2.51.0 + diff --git a/queue-5.15/binder-don-t-use-pk-through-printk.patch b/queue-5.15/binder-don-t-use-pk-through-printk.patch new file mode 100644 index 00000000000..3291b7953e9 --- /dev/null +++ b/queue-5.15/binder-don-t-use-pk-through-printk.patch @@ -0,0 +1,83 @@ +From 018765b3861aecb1992e559bbe9601a069798ff0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 15:29:50 +0100 +Subject: binder: don't use %pK through printk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 56d21267663bad91e8b10121224ec46366a7937e ] + +In the past %pK was preferable to %p as it would not leak raw pointer +values into the kernel log. Since commit ad67b74d2469 ("printk: hash +addresses printed with %p") the regular %p has been improved to avoid +this issue. Furthermore, restricted pointers ("%pK") were never meant +to be used through printk(). They can still unintentionally leak raw +pointers or acquire sleeping locks in atomic contexts. + +Switch to the regular pointer formatting which is safer and +easier to reason about. + +There are still a few users of %pK left, but these use it through +seq_file, for which its usage is safe. + +Signed-off-by: Thomas Weißschuh +Acked-by: Carlos Llamas +Reviewed-by: Alice Ryhl +Link: https://patch.msgid.link/20260107-restricted-pointers-binder-v1-1-181018bf3812@linutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/android/binder.c | 2 +- + drivers/android/binder_alloc.c | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/android/binder.c b/drivers/android/binder.c +index 73fd95bc70c03..24906f085b940 100644 +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -4008,7 +4008,7 @@ static int binder_thread_write(struct binder_proc *proc, + } + } + binder_debug(BINDER_DEBUG_DEAD_BINDER, +- "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n", ++ "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n", + proc->pid, thread->pid, (u64)cookie, + death); + if (death == NULL) { +diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c +index 813894ba5da6b..cb46d36e219a0 100644 +--- a/drivers/android/binder_alloc.c ++++ b/drivers/android/binder_alloc.c +@@ -79,7 +79,7 @@ static void binder_insert_free_buffer(struct binder_alloc *alloc, + new_buffer_size = binder_alloc_buffer_size(alloc, new_buffer); + + binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC, +- "%d: add free buffer, size %zd, at %pK\n", ++ "%d: add free buffer, size %zd, at %p\n", + alloc->pid, new_buffer_size, new_buffer); + + while (*p) { +@@ -474,7 +474,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked( + } + + binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC, +- "%d: binder_alloc_buf size %zd got buffer %pK size %zd\n", ++ "%d: binder_alloc_buf size %zd got buffer %p size %zd\n", + alloc->pid, size, buffer, buffer_size); + + has_page_addr = (void __user *) +@@ -646,7 +646,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc, + ALIGN(buffer->extra_buffers_size, sizeof(void *)); + + binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC, +- "%d: binder_free_buf %pK size %zd buffer_size %zd\n", ++ "%d: binder_free_buf %p size %zd buffer_size %zd\n", + alloc->pid, buffer, size, buffer_size); + + BUG_ON(buffer->free); +-- +2.51.0 + diff --git a/queue-5.15/blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch b/queue-5.15/blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch new file mode 100644 index 00000000000..f3d594c56b3 --- /dev/null +++ b/queue-5.15/blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch @@ -0,0 +1,42 @@ +From 3ac21c6936d23c967daebf7081da108ff1aed625 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 16:05:22 +0800 +Subject: blk-mq-debugfs: add missing debugfs_mutex in + blk_mq_debugfs_register_hctxs() + +From: Yu Kuai + +[ Upstream commit 9d20fd6ce1ba9733cd5ac96fcab32faa9fc404dd ] + +In blk_mq_update_nr_hw_queues(), debugfs_mutex is not held while +creating debugfs entries for hctxs. Hence add debugfs_mutex there, +it's safe because queue is not frozen. + +Signed-off-by: Yu Kuai +Reviewed-by: Nilay Shroff +Reviewed-by: Ming Lei +Reviewed-by: Hannes Reinecke +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-debugfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c +index 7023257a133df..8ae3115666e70 100644 +--- a/block/blk-mq-debugfs.c ++++ b/block/blk-mq-debugfs.c +@@ -903,8 +903,10 @@ void blk_mq_debugfs_register_hctxs(struct request_queue *q) + struct blk_mq_hw_ctx *hctx; + int i; + ++ mutex_lock(&q->debugfs_mutex); + queue_for_each_hw_ctx(q, hctx, i) + blk_mq_debugfs_register_hctx(q, hctx); ++ mutex_unlock(&q->debugfs_mutex); + } + + void blk_mq_debugfs_unregister_hctxs(struct request_queue *q) +-- +2.51.0 + diff --git a/queue-5.15/bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch b/queue-5.15/bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch new file mode 100644 index 00000000000..b5acdc8d2e3 --- /dev/null +++ b/queue-5.15/bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch @@ -0,0 +1,37 @@ +From 40c15c6cab9698eecdc6c9b7f22909bcd3609a50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 10:13:04 +0100 +Subject: Bluetooth: btusb: Add device ID for Realtek RTL8761BU + +From: Jacopo Scannella + +[ Upstream commit cc6383d4f0cf6127c0552f94cae517a06ccc6b17 ] + +Add USB device ID 0x2c0a:0x8761 to the btusb driver fo the Realtek +RTL8761BU Bluetooth adapter. + +Reference: +https://www.startech.com/en-us/networking-io/av53c1-usb-bluetooth + +Signed-off-by: Jacopo Scannella +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index c447e2e9417b3..a79fd106fad7a 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -512,6 +512,7 @@ static const struct usb_device_id blacklist_table[] = { + + /* Additional Realtek 8723BU Bluetooth devices */ + { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK }, ++ { USB_DEVICE(0x2c0a, 0x8761), .driver_info = BTUSB_REALTEK }, + + /* Additional Realtek 8723DE Bluetooth devices */ + { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK }, +-- +2.51.0 + diff --git a/queue-5.15/bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch b/queue-5.15/bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch new file mode 100644 index 00000000000..b5028856ce0 --- /dev/null +++ b/queue-5.15/bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch @@ -0,0 +1,46 @@ +From 36bcbe12fc7a2bd8c43f6254a691f6bf64046855 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 10:20:09 +0100 +Subject: Bluetooth: hci_conn: use mod_delayed_work for active mode timeout +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stefan Sørensen + +[ Upstream commit 49d0901e260739de2fcc90c0c29f9e31e39a2d9b ] + +hci_conn_enter_active_mode() uses queue_delayed_work() with the +intention that the work will run after the given timeout. However, +queue_delayed_work() does nothing if the work is already queued, so +depending on the link policy we may end up putting the connection +into idle mode every hdev->idle_timeout ms. + +Use mod_delayed_work() instead so the work is queued if not already +queued, and the timeout is updated otherwise. + +Signed-off-by: Stefan Sørensen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_conn.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 700920aea39ef..a9ba288afe0ee 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -1604,8 +1604,8 @@ void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active) + + timer: + if (hdev->idle_timeout > 0) +- queue_delayed_work(hdev->workqueue, &conn->idle_work, +- msecs_to_jiffies(hdev->idle_timeout)); ++ mod_delayed_work(hdev->workqueue, &conn->idle_work, ++ msecs_to_jiffies(hdev->idle_timeout)); + } + + /* Drop all connection on the device */ +-- +2.51.0 + diff --git a/queue-5.15/bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch b/queue-5.15/bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch new file mode 100644 index 00000000000..c6a356effde --- /dev/null +++ b/queue-5.15/bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch @@ -0,0 +1,72 @@ +From 291c5a41d328edd2a2b947025d08316ace654154 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 18:02:19 +0000 +Subject: bpf: verifier improvement in 32bit shift sign extension pattern + +From: Cupertino Miranda + +[ Upstream commit d18dec4b8990048ce75f0ece32bb96b3fbd3f422 ] + +This patch improves the verifier to correctly compute bounds for +sign extension compiler pattern composed of left shift by 32bits +followed by a sign right shift by 32bits. Pattern in the verifier was +limitted to positive value bounds and would reset bound computation for +negative values. New code allows both positive and negative values for +sign extension without compromising bound computation and verifier to +pass. + +This change is required by GCC which generate such pattern, and was +detected in the context of systemd, as described in the following GCC +bugzilla: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119731 + +Three new tests were added in verifier_subreg.c. + +Signed-off-by: Cupertino Miranda +Signed-off-by: Andrew Pinski +Acked-by: Eduard Zingerman +Cc: David Faust +Cc: Jose Marchesi +Cc: Elena Zannoni +Link: https://lore.kernel.org/r/20251202180220.11128-2-cupertino.miranda@oracle.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 18 +++++++----------- + 1 file changed, 7 insertions(+), 11 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 4b7c9a60a7352..48776d23b44e2 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -7953,21 +7953,17 @@ static void __scalar64_min_max_lsh(struct bpf_reg_state *dst_reg, + u64 umin_val, u64 umax_val) + { + /* Special case <<32 because it is a common compiler pattern to sign +- * extend subreg by doing <<32 s>>32. In this case if 32bit bounds are +- * positive we know this shift will also be positive so we can track +- * bounds correctly. Otherwise we lose all sign bit information except +- * what we can pick up from var_off. Perhaps we can generalize this +- * later to shifts of any length. ++ * extend subreg by doing <<32 s>>32. smin/smax assignments are correct ++ * because s32 bounds don't flip sign when shifting to the left by ++ * 32bits. + */ +- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_max_value >= 0) ++ if (umin_val == 32 && umax_val == 32) { + dst_reg->smax_value = (s64)dst_reg->s32_max_value << 32; +- else +- dst_reg->smax_value = S64_MAX; +- +- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_min_value >= 0) + dst_reg->smin_value = (s64)dst_reg->s32_min_value << 32; +- else ++ } else { ++ dst_reg->smax_value = S64_MAX; + dst_reg->smin_value = S64_MIN; ++ } + + /* If we might shift our top bit out, then we know nothing */ + if (dst_reg->umax_value > 1ULL << (63 - umax_val)) { +-- +2.51.0 + diff --git a/queue-5.15/btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch b/queue-5.15/btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch new file mode 100644 index 00000000000..736c7c9e2b6 --- /dev/null +++ b/queue-5.15/btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch @@ -0,0 +1,46 @@ +From b4617fca0748fc59537c39c70299415e013cb176 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 22:53:57 +0530 +Subject: btrfs: replace BUG() with error handling in __btrfs_balance() + +From: Adarsh Das + +[ Upstream commit be6324a809dbda76d5fdb23720ad9b20e5c1905c ] + +We search with offset (u64)-1 which should never match exactly. +Previously this was handled with BUG(). Now logs an error +and return -EUCLEAN. + +Reviewed-by: Qu Wenruo +Signed-off-by: Adarsh Das +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/volumes.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index c18918ce8edde..839ee01827b26 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -3992,8 +3992,14 @@ static int __btrfs_balance(struct btrfs_fs_info *fs_info) + * this shouldn't happen, it means the last relocate + * failed + */ +- if (ret == 0) +- BUG(); /* FIXME break ? */ ++ if (unlikely(ret == 0)) { ++ btrfs_err(fs_info, ++ "unexpected exact match of CHUNK_ITEM in chunk tree, offset 0x%llx", ++ key.offset); ++ mutex_unlock(&fs_info->reclaim_bgs_lock); ++ ret = -EUCLEAN; ++ goto error; ++ } + + ret = btrfs_previous_item(chunk_root, path, 0, + BTRFS_CHUNK_ITEM_KEY); +-- +2.51.0 + diff --git a/queue-5.15/char-tpm-cr50-remove-irqf_oneshot.patch b/queue-5.15/char-tpm-cr50-remove-irqf_oneshot.patch new file mode 100644 index 00000000000..3fec25fc56a --- /dev/null +++ b/queue-5.15/char-tpm-cr50-remove-irqf_oneshot.patch @@ -0,0 +1,59 @@ +From 20ed5b052a988e606937406454c7118b03d25f5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:29 +0100 +Subject: char: tpm: cr50: Remove IRQF_ONESHOT + +From: Sebastian Andrzej Siewior + +[ Upstream commit 1affd29ffbd50125a5492c6be1dbb1f04be18d4f ] + +Passing IRQF_ONESHOT ensures that the interrupt source is masked until +the secondary (threaded) handler is done. If only a primary handler is +used then the flag makes no sense because the interrupt can not fire +(again) while its handler is running. + +The flag also prevents force-threading of the primary handler and the +irq-core will warn about this. + +Remove IRQF_ONESHOT from irqflags. + +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Thomas Gleixner +Reviewed-by: Jarkko Sakkinen +Link: https://patch.msgid.link/20260128095540.863589-10-bigeasy@linutronix.de +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_i2c_cr50.c | 3 +-- + drivers/char/tpm/tpm_tis_spi_cr50.c | 2 +- + 2 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_i2c_cr50.c b/drivers/char/tpm/tpm_tis_i2c_cr50.c +index e2ab6a329732b..beb338722d20c 100644 +--- a/drivers/char/tpm/tpm_tis_i2c_cr50.c ++++ b/drivers/char/tpm/tpm_tis_i2c_cr50.c +@@ -699,8 +699,7 @@ static int tpm_cr50_i2c_probe(struct i2c_client *client) + + if (client->irq > 0) { + rc = devm_request_irq(dev, client->irq, tpm_cr50_i2c_int_handler, +- IRQF_TRIGGER_FALLING | IRQF_ONESHOT | +- IRQF_NO_AUTOEN, ++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN, + dev->driver->name, chip); + if (rc < 0) { + dev_err(dev, "Failed to probe IRQ %d\n", client->irq); +diff --git a/drivers/char/tpm/tpm_tis_spi_cr50.c b/drivers/char/tpm/tpm_tis_spi_cr50.c +index ea759af256345..c1188a6368288 100644 +--- a/drivers/char/tpm/tpm_tis_spi_cr50.c ++++ b/drivers/char/tpm/tpm_tis_spi_cr50.c +@@ -273,7 +273,7 @@ int cr50_spi_probe(struct spi_device *spi) + if (spi->irq > 0) { + ret = devm_request_irq(&spi->dev, spi->irq, + cr50_spi_irq_handler, +- IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ IRQF_TRIGGER_RISING, + "cr50_spi", cr50_phy); + if (ret < 0) { + if (ret == -EPROBE_DEFER) +-- +2.51.0 + diff --git a/queue-5.15/clk-microchip-core-correct-return-value-on-_get_pare.patch b/queue-5.15/clk-microchip-core-correct-return-value-on-_get_pare.patch new file mode 100644 index 00000000000..84e55c39907 --- /dev/null +++ b/queue-5.15/clk-microchip-core-correct-return-value-on-_get_pare.patch @@ -0,0 +1,80 @@ +From ba60295e1b90288ffb65c0a2e66872ac60ef9f41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 14:46:28 -0500 +Subject: clk: microchip: core: correct return value on *_get_parent() + +From: Brian Masney + +[ Upstream commit 5df96d141cccb37f0c3112a22fc1112ea48e9246 ] + +roclk_get_parent() and sclk_get_parent() has the possibility of +returning -EINVAL, however the framework expects this call to always +succeed since the return value is unsigned. + +If there is no parent map defined, then the current value programmed in +the hardware is used. Let's use that same value in the case where +-EINVAL is currently returned. + +This index is only used by clk_core_get_parent_by_index(), and it +validates that it doesn't overflow the number of available parents. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202512050233.R9hAWsJN-lkp@intel.com/ +Signed-off-by: Brian Masney +Reviewed-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20251205-clk-microchip-fixes-v3-2-a02190705e47@redhat.com +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + drivers/clk/microchip/clk-core.c | 25 ++++++++++++------------- + 1 file changed, 12 insertions(+), 13 deletions(-) + +diff --git a/drivers/clk/microchip/clk-core.c b/drivers/clk/microchip/clk-core.c +index 1b4f023cdc8be..71fbaf8318f22 100644 +--- a/drivers/clk/microchip/clk-core.c ++++ b/drivers/clk/microchip/clk-core.c +@@ -281,14 +281,13 @@ static u8 roclk_get_parent(struct clk_hw *hw) + + v = (readl(refo->ctrl_reg) >> REFO_SEL_SHIFT) & REFO_SEL_MASK; + +- if (!refo->parent_map) +- return v; +- +- for (i = 0; i < clk_hw_get_num_parents(hw); i++) +- if (refo->parent_map[i] == v) +- return i; ++ if (refo->parent_map) { ++ for (i = 0; i < clk_hw_get_num_parents(hw); i++) ++ if (refo->parent_map[i] == v) ++ return i; ++ } + +- return -EINVAL; ++ return v; + } + + static unsigned long roclk_calc_rate(unsigned long parent_rate, +@@ -823,13 +822,13 @@ static u8 sclk_get_parent(struct clk_hw *hw) + + v = (readl(sclk->mux_reg) >> OSC_CUR_SHIFT) & OSC_CUR_MASK; + +- if (!sclk->parent_map) +- return v; ++ if (sclk->parent_map) { ++ for (i = 0; i < clk_hw_get_num_parents(hw); i++) ++ if (sclk->parent_map[i] == v) ++ return i; ++ } + +- for (i = 0; i < clk_hw_get_num_parents(hw); i++) +- if (sclk->parent_map[i] == v) +- return i; +- return -EINVAL; ++ return v; + } + + static int sclk_set_parent(struct clk_hw *hw, u8 index) +-- +2.51.0 + diff --git a/queue-5.15/clocksource-drivers-sh_tmu-always-leave-device-runni.patch b/queue-5.15/clocksource-drivers-sh_tmu-always-leave-device-runni.patch new file mode 100644 index 00000000000..5ecd9b71baa --- /dev/null +++ b/queue-5.15/clocksource-drivers-sh_tmu-always-leave-device-runni.patch @@ -0,0 +1,149 @@ +From f37833a37b8e061add99587afeb35bf93661e1fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 23:13:41 +0100 +Subject: clocksource/drivers/sh_tmu: Always leave device running after probe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Niklas Söderlund + +[ Upstream commit b1278972b08e480990e2789bdc6a7c918bc349be ] + +The TMU device can be used as both a clocksource and a clockevent +provider. The driver tries to be smart and power itself on and off, as +well as enabling and disabling its clock when it's not in operation. +This behavior is slightly altered if the TMU is used as an early +platform device in which case the device is left powered on after probe, +but the clock is still enabled and disabled at runtime. + +This has worked for a long time, but recent improvements in PREEMPT_RT +and PROVE_LOCKING have highlighted an issue. As the TMU registers itself +as a clockevent provider, clockevents_register_device(), it needs to use +raw spinlocks internally as this is the context of which the clockevent +framework interacts with the TMU driver. However in the context of +holding a raw spinlock the TMU driver can't really manage its power +state or clock with calls to pm_runtime_*() and clk_*() as these calls +end up in other platform drivers using regular spinlocks to control +power and clocks. + +This mix of spinlock contexts trips a lockdep warning. + + ============================= + [ BUG: Invalid wait context ] + 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 Not tainted + ----------------------------- + swapper/0/0 is trying to lock: + ffff000008c9e180 (&dev->power.lock){-...}-{3:3}, at: __pm_runtime_resume+0x38/0x88 + other info that might help us debug this: + context-{5:5} + 1 lock held by swapper/0/0: + ccree e6601000.crypto: ARM CryptoCell 630P Driver: HW version 0xAF400001/0xDCC63000, Driver version 5.0 + #0: ffff8000817ec298 + ccree e6601000.crypto: ARM ccree device initialized + (tick_broadcast_lock){-...}-{2:2}, at: __tick_broadcast_oneshot_control+0xa4/0x3a8 + stack backtrace: + CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 PREEMPT + Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT) + Call trace: + show_stack+0x14/0x1c (C) + dump_stack_lvl+0x6c/0x90 + dump_stack+0x14/0x1c + __lock_acquire+0x904/0x1584 + lock_acquire+0x220/0x34c + _raw_spin_lock_irqsave+0x58/0x80 + __pm_runtime_resume+0x38/0x88 + sh_tmu_clock_event_set_oneshot+0x84/0xd4 + clockevents_switch_state+0xfc/0x13c + tick_broadcast_set_event+0x30/0xa4 + __tick_broadcast_oneshot_control+0x1e0/0x3a8 + tick_broadcast_oneshot_control+0x30/0x40 + cpuidle_enter_state+0x40c/0x680 + cpuidle_enter+0x30/0x40 + do_idle+0x1f4/0x280 + cpu_startup_entry+0x34/0x40 + kernel_init+0x0/0x130 + do_one_initcall+0x0/0x230 + __primary_switched+0x88/0x90 + +For non-PREEMPT_RT builds this is not really an issue, but for +PREEMPT_RT builds where normal spinlocks can sleep this might be an +issue. Be cautious and always leave the power and clock running after +probe. + +Signed-off-by: Niklas Söderlund +Signed-off-by: Daniel Lezcano +Tested-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20251202221341.1856773-1-niklas.soderlund+renesas@ragnatech.se +Signed-off-by: Sasha Levin +--- + drivers/clocksource/sh_tmu.c | 18 ------------------ + 1 file changed, 18 deletions(-) + +diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c +index b00dec0655cb2..2e35bb39ef42f 100644 +--- a/drivers/clocksource/sh_tmu.c ++++ b/drivers/clocksource/sh_tmu.c +@@ -143,16 +143,6 @@ static void sh_tmu_start_stop_ch(struct sh_tmu_channel *ch, int start) + + static int __sh_tmu_enable(struct sh_tmu_channel *ch) + { +- int ret; +- +- /* enable clock */ +- ret = clk_enable(ch->tmu->clk); +- if (ret) { +- dev_err(&ch->tmu->pdev->dev, "ch%u: cannot enable clock\n", +- ch->index); +- return ret; +- } +- + /* make sure channel is disabled */ + sh_tmu_start_stop_ch(ch, 0); + +@@ -174,7 +164,6 @@ static int sh_tmu_enable(struct sh_tmu_channel *ch) + if (ch->enable_count++ > 0) + return 0; + +- pm_runtime_get_sync(&ch->tmu->pdev->dev); + dev_pm_syscore_device(&ch->tmu->pdev->dev, true); + + return __sh_tmu_enable(ch); +@@ -187,9 +176,6 @@ static void __sh_tmu_disable(struct sh_tmu_channel *ch) + + /* disable interrupts in TMU block */ + sh_tmu_write(ch, TCR, TCR_TPSC_CLK4); +- +- /* stop clock */ +- clk_disable(ch->tmu->clk); + } + + static void sh_tmu_disable(struct sh_tmu_channel *ch) +@@ -203,7 +189,6 @@ static void sh_tmu_disable(struct sh_tmu_channel *ch) + __sh_tmu_disable(ch); + + dev_pm_syscore_device(&ch->tmu->pdev->dev, false); +- pm_runtime_put(&ch->tmu->pdev->dev); + } + + static void sh_tmu_set_next(struct sh_tmu_channel *ch, unsigned long delta, +@@ -552,7 +537,6 @@ static int sh_tmu_setup(struct sh_tmu_device *tmu, struct platform_device *pdev) + goto err_clk_unprepare; + + tmu->rate = clk_get_rate(tmu->clk) / 4; +- clk_disable(tmu->clk); + + /* Map the memory resource. */ + ret = sh_tmu_map_memory(tmu); +@@ -626,8 +610,6 @@ static int sh_tmu_probe(struct platform_device *pdev) + out: + if (tmu->has_clockevent || tmu->has_clocksource) + pm_runtime_irq_safe(&pdev->dev); +- else +- pm_runtime_idle(&pdev->dev); + + return 0; + } +-- +2.51.0 + diff --git a/queue-5.15/clocksource-drivers-timer-integrator-ap-add-missing-.patch b/queue-5.15/clocksource-drivers-timer-integrator-ap-add-missing-.patch new file mode 100644 index 00000000000..da1c85a7674 --- /dev/null +++ b/queue-5.15/clocksource-drivers-timer-integrator-ap-add-missing-.patch @@ -0,0 +1,38 @@ +From 236eddaab66e225b1535fee4e43d982cfc0b5c77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jan 2026 12:17:23 +0100 +Subject: clocksource/drivers/timer-integrator-ap: Add missing Kconfig + dependency on OF + +From: Bartosz Golaszewski + +[ Upstream commit 2246464821e2820572e6feefca2029f17629cc50 ] + +This driver accesses the of_aliases global variable declared in +linux/of.h and defined in drivers/base/of.c. It requires OF support or +will cause a link failure. Add the missing Kconfig dependency. + +Closes: https://lore.kernel.org/oe-kbuild-all/202601152233.og6LdeUo-lkp@intel.com/ +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Daniel Lezcano +Link: https://patch.msgid.link/20260116111723.10585-1-bartosz.golaszewski@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/clocksource/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig +index 6382dad202207..133ee5c3c0bf8 100644 +--- a/drivers/clocksource/Kconfig ++++ b/drivers/clocksource/Kconfig +@@ -221,6 +221,7 @@ config KEYSTONE_TIMER + + config INTEGRATOR_AP_TIMER + bool "Integrator-AP timer driver" if COMPILE_TEST ++ depends on OF + select CLKSRC_MMIO + help + Enables support for the Integrator-AP timer. +-- +2.51.0 + diff --git a/queue-5.15/dm-remove-fake-timeout-to-avoid-leak-request.patch b/queue-5.15/dm-remove-fake-timeout-to-avoid-leak-request.patch new file mode 100644 index 00000000000..bd96a260153 --- /dev/null +++ b/queue-5.15/dm-remove-fake-timeout-to-avoid-leak-request.patch @@ -0,0 +1,86 @@ +From a45ac40a6c719005616413332f07f82c203270e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Dec 2025 20:03:50 +0800 +Subject: dm: remove fake timeout to avoid leak request + +From: Ding Hui + +[ Upstream commit f3a9c95a15d2f4466acad5c68faeff79ca5e9f47 ] + +Since commit 15f73f5b3e59 ("blk-mq: move failure injection out of +blk_mq_complete_request"), drivers are responsible for calling +blk_should_fake_timeout() at appropriate code paths and opportunities. + +However, the dm driver does not implement its own timeout handler and +relies on the timeout handling of its slave devices. + +If an io-timeout-fail error is injected to a dm device, the request +will be leaked and never completed, causing tasks to hang indefinitely. + +Reproduce: +1. prepare dm which has iscsi slave device +2. inject io-timeout-fail to dm + echo 1 >/sys/class/block/dm-0/io-timeout-fail + echo 100 >/sys/kernel/debug/fail_io_timeout/probability + echo 10 >/sys/kernel/debug/fail_io_timeout/times +3. read/write dm +4. iscsiadm -m node -u + +Result: hang task like below +[ 862.243768] INFO: task kworker/u514:2:151 blocked for more than 122 seconds. +[ 862.244133] Tainted: G E 6.19.0-rc1+ #51 +[ 862.244337] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 862.244718] task:kworker/u514:2 state:D stack:0 pid:151 tgid:151 ppid:2 task_flags:0x4288060 flags:0x00080000 +[ 862.245024] Workqueue: iscsi_ctrl_3:1 __iscsi_unbind_session [scsi_transport_iscsi] +[ 862.245264] Call Trace: +[ 862.245587] +[ 862.245814] __schedule+0x810/0x15c0 +[ 862.246557] schedule+0x69/0x180 +[ 862.246760] blk_mq_freeze_queue_wait+0xde/0x120 +[ 862.247688] elevator_change+0x16d/0x460 +[ 862.247893] elevator_set_none+0x87/0xf0 +[ 862.248798] blk_unregister_queue+0x12e/0x2a0 +[ 862.248995] __del_gendisk+0x231/0x7e0 +[ 862.250143] del_gendisk+0x12f/0x1d0 +[ 862.250339] sd_remove+0x85/0x130 [sd_mod] +[ 862.250650] device_release_driver_internal+0x36d/0x530 +[ 862.250849] bus_remove_device+0x1dd/0x3f0 +[ 862.251042] device_del+0x38a/0x930 +[ 862.252095] __scsi_remove_device+0x293/0x360 +[ 862.252291] scsi_remove_target+0x486/0x760 +[ 862.252654] __iscsi_unbind_session+0x18a/0x3e0 [scsi_transport_iscsi] +[ 862.252886] process_one_work+0x633/0xe50 +[ 862.253101] worker_thread+0x6df/0xf10 +[ 862.253647] kthread+0x36d/0x720 +[ 862.254533] ret_from_fork+0x2a6/0x470 +[ 862.255852] ret_from_fork_asm+0x1a/0x30 +[ 862.256037] + +Remove the blk_should_fake_timeout() check from dm, as dm has no +native timeout handling and should not attempt to fake timeouts. + +Signed-off-by: Ding Hui +Reviewed-by: Christoph Hellwig +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + drivers/md/dm-rq.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c +index 7eedcd012f45f..bcbf5081887a9 100644 +--- a/drivers/md/dm-rq.c ++++ b/drivers/md/dm-rq.c +@@ -281,8 +281,7 @@ static void dm_complete_request(struct request *rq, blk_status_t error) + struct dm_rq_target_io *tio = tio_from_request(rq); + + tio->error = error; +- if (likely(!blk_should_fake_timeout(rq->q))) +- blk_mq_complete_request(rq); ++ blk_mq_complete_request(rq); + } + + /* +-- +2.51.0 + diff --git a/queue-5.15/drm-account-property-blob-allocations-to-memcg.patch b/queue-5.15/drm-account-property-blob-allocations-to-memcg.patch new file mode 100644 index 00000000000..73d2bd1e42a --- /dev/null +++ b/queue-5.15/drm-account-property-blob-allocations-to-memcg.patch @@ -0,0 +1,46 @@ +From 4956d3e0f0dc201852a3a1d3d2198458d5458a97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 08:22:26 -0500 +Subject: drm: Account property blob allocations to memcg + +From: Xiao Kan <814091656@qq.com> + +[ Upstream commit 26b4309a3ab82a0697751cde52eb336c29c19035 ] + +DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized +property blobs backed by kernel memory. + +Currently, the blob data allocation is not accounted to the allocating +process's memory cgroup, allowing unprivileged users to trigger unbounded +kernel memory consumption and potentially cause system-wide OOM. + +Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory +is properly charged to the caller's memcg. This ensures existing cgroup +memory limits apply and prevents uncontrolled kernel memory growth without +introducing additional policy or per-file limits. + +Signed-off-by: Xiao Kan <814091656@qq.com> +Signed-off-by: Xiao Kan +Link: https://patch.msgid.link/tencent_D12AA2DEDE6F359E1AF59405242FB7A5FD05@qq.com +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_property.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c +index 6c353c9dc772e..125a807e6e0ec 100644 +--- a/drivers/gpu/drm/drm_property.c ++++ b/drivers/gpu/drm/drm_property.c +@@ -564,7 +564,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length, + if (!length || length > INT_MAX - sizeof(struct drm_property_blob)) + return ERR_PTR(-EINVAL); + +- blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL); ++ blob = kvzalloc(sizeof(struct drm_property_blob) + length, GFP_KERNEL_ACCOUNT); + if (!blob) + return ERR_PTR(-ENOMEM); + +-- +2.51.0 + diff --git a/queue-5.15/drm-amd-display-avoid-updating-surface-with-the-same.patch b/queue-5.15/drm-amd-display-avoid-updating-surface-with-the-same.patch new file mode 100644 index 00000000000..b08f34d47e7 --- /dev/null +++ b/queue-5.15/drm-amd-display-avoid-updating-surface-with-the-same.patch @@ -0,0 +1,43 @@ +From 16b7c441403ac38d5d779757846ca948a6ac8b38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 14:47:01 +0800 +Subject: drm/amd/display: Avoid updating surface with the same surface under + MPO + +From: Wayne Lin + +[ Upstream commit 1a38ded4bc8ac09fd029ec656b1e2c98cc0d238c ] + +[Why & How] +Although it's dummy updates of surface update for committing stream +updates, we should not have dummy_updates[j].surface all indicating +to the same surface under multiple surfaces case. Otherwise, +copy_surface_update_to_plane() in update_planes_and_stream_state() +will update to the same surface only. + +Reviewed-by: Harry Wentland +Signed-off-by: Wayne Lin +Signed-off-by: Tom Chung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 5d22622f9c1a8..9a6c0b17745e5 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -9875,7 +9875,7 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state) + * To fix this, DC should permit updating only stream properties. + */ + for (j = 0; j < status->plane_count; j++) +- dummy_updates[j].surface = status->plane_states[0]; ++ dummy_updates[j].surface = status->plane_states[j]; + + + mutex_lock(&dm->dc_lock); +-- +2.51.0 + diff --git a/queue-5.15/drm-amdgpu-add-hainan-clock-adjustment.patch b/queue-5.15/drm-amdgpu-add-hainan-clock-adjustment.patch new file mode 100644 index 00000000000..f0ade0a6945 --- /dev/null +++ b/queue-5.15/drm-amdgpu-add-hainan-clock-adjustment.patch @@ -0,0 +1,39 @@ +From 5297a3cbb43d574cf4dbf6fb2e8d42068101a9db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Feb 2026 07:24:01 +0000 +Subject: drm/amdgpu: Add HAINAN clock adjustment + +From: decce6 + +[ Upstream commit 49fe2c57bdc0acff9d2551ae337270b6fd8119d9 ] + +This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from +850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This +patch is for amdgpu. + +Signed-off-by: decce6 +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c b/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c +index a6ed28ab07083..35160f1f323be 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c +@@ -3426,6 +3426,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + max_sclk = 60000; + max_mclk = 80000; + } ++ if ((adev->pdev->device == 0x666f) && ++ (adev->pdev->revision == 0x00)) { ++ max_sclk = 80000; ++ max_mclk = 95000; ++ } + } else if (adev->asic_type == CHIP_OLAND) { + if ((adev->pdev->revision == 0xC7) || + (adev->pdev->revision == 0x80) || +-- +2.51.0 + diff --git a/queue-5.15/drm-amdgpu-adjust-usleep_range-in-fence-wait.patch b/queue-5.15/drm-amdgpu-adjust-usleep_range-in-fence-wait.patch new file mode 100644 index 00000000000..52d647a3992 --- /dev/null +++ b/queue-5.15/drm-amdgpu-adjust-usleep_range-in-fence-wait.patch @@ -0,0 +1,38 @@ +From 52c4247d8afac1da296a848c066fa65d3c9a7c48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Feb 2026 15:32:01 +0800 +Subject: drm/amdgpu: Adjust usleep_range in fence wait + +From: Ce Sun + +[ Upstream commit 3ee1c72606bd2842f0f377fd4b118362af0323ae ] + +Tune the sleep interval in the PSP fence wait loop from 10-100us to +60-100us.This adjustment results in an overall wait window of 1.2s +(60us * 20000 iterations) to 2 seconds (100us * 20000 iterations), +which guarantees that we can retrieve the correct fence value + +Signed-off-by: Ce Sun +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index 64bf24b64446b..7f84c202aeb7f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -488,7 +488,7 @@ psp_cmd_submit_buf(struct psp_context *psp, + ras_intr = amdgpu_ras_intr_triggered(); + if (ras_intr) + break; +- usleep_range(10, 100); ++ usleep_range(60, 100); + amdgpu_device_invalidate_hdp(psp->adev, NULL); + } + +-- +2.51.0 + diff --git a/queue-5.15/drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch b/queue-5.15/drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch new file mode 100644 index 00000000000..8b6523d9c1e --- /dev/null +++ b/queue-5.15/drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch @@ -0,0 +1,51 @@ +From 195fc7919a17d2bfd93ef363d720375b7668b437 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 19:36:56 +0530 +Subject: drm/amdkfd: Fix GART PTE for non-4K pagesize in + svm_migrate_gart_map() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Donet Tom + +[ Upstream commit 6c160001661b6c4e20f5c31909c722741e14c2d8 ] + +In svm_migrate_gart_map(), while migrating GART mapping, the number of +bytes copied for the GART table only accounts for CPU pages. On non-4K +systems, each CPU page can contain multiple GPU pages, and the GART +requires one 8-byte PTE per GPU page. As a result, an incorrect size was +passed to the DMA, causing only a partial update of the GART table. + +Fix this function to work correctly on non-4K page-size systems by +accounting for the number of GPU pages per CPU page when calculating the +number of bytes to be copied. + +Acked-by: Christian König +Reviewed-by: Philip Yang +Signed-off-by: Ritesh Harjani (IBM) +Signed-off-by: Donet Tom +Signed-off-by: Felix Kuehling +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +index 013749cd3ae29..2396f79470d9b 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +@@ -57,7 +57,7 @@ svm_migrate_gart_map(struct amdgpu_ring *ring, uint64_t npages, + *gart_addr = adev->gmc.gart_start; + + num_dw = ALIGN(adev->mman.buffer_funcs->copy_num_dw, 8); +- num_bytes = npages * 8; ++ num_bytes = npages * 8 * AMDGPU_GPU_PAGES_IN_CPU_PAGE; + + r = amdgpu_job_alloc_with_ib(adev, num_dw * 4 + num_bytes, + AMDGPU_IB_POOL_DELAYED, &job); +-- +2.51.0 + diff --git a/queue-5.15/drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch b/queue-5.15/drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch new file mode 100644 index 00000000000..5af8a45b623 --- /dev/null +++ b/queue-5.15/drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch @@ -0,0 +1,73 @@ +From 1fcb858d02c2e8047e599f848776f70691c41005 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Nov 2025 11:38:25 +0100 +Subject: drm/atmel-hlcdc: don't reject the commit if the src rect has + fractional parts +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ludovic Desroches + +[ Upstream commit 06682206e2a1883354ed758c09efeb51f435adbd ] + +Don’t reject the commit when the source rectangle has fractional parts. +This can occur due to scaling: drm_atomic_helper_check_plane_state() calls +drm_rect_clip_scaled(), which may introduce fractional parts while +computing the clipped source rectangle. This does not imply the commit is +invalid, so we should accept it instead of discarding it. + +Signed-off-by: Ludovic Desroches +Reviewed-by: Manikandan Muralidharan +Link: https://patch.msgid.link/20251120-lcd_scaling_fix-v1-1-5ffc98557923@microchip.com +Signed-off-by: Manikandan Muralidharan +Signed-off-by: Sasha Levin +--- + .../gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 19 ++++--------------- + 1 file changed, 4 insertions(+), 15 deletions(-) + +diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +index 594999d67c808..79e04c53a642e 100644 +--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c ++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +@@ -77,8 +77,6 @@ drm_plane_state_to_atmel_hlcdc_plane_state(struct drm_plane_state *s) + return container_of(s, struct atmel_hlcdc_plane_state, base); + } + +-#define SUBPIXEL_MASK 0xffff +- + static uint32_t rgb_formats[] = { + DRM_FORMAT_C8, + DRM_FORMAT_XRGB4444, +@@ -618,24 +616,15 @@ static int atmel_hlcdc_plane_atomic_check(struct drm_plane *p, + if (ret || !s->visible) + return ret; + +- hstate->src_x = s->src.x1; +- hstate->src_y = s->src.y1; +- hstate->src_w = drm_rect_width(&s->src); +- hstate->src_h = drm_rect_height(&s->src); ++ hstate->src_x = s->src.x1 >> 16; ++ hstate->src_y = s->src.y1 >> 16; ++ hstate->src_w = drm_rect_width(&s->src) >> 16; ++ hstate->src_h = drm_rect_height(&s->src) >> 16; + hstate->crtc_x = s->dst.x1; + hstate->crtc_y = s->dst.y1; + hstate->crtc_w = drm_rect_width(&s->dst); + hstate->crtc_h = drm_rect_height(&s->dst); + +- if ((hstate->src_x | hstate->src_y | hstate->src_w | hstate->src_h) & +- SUBPIXEL_MASK) +- return -EINVAL; +- +- hstate->src_x >>= 16; +- hstate->src_y >>= 16; +- hstate->src_w >>= 16; +- hstate->src_h >>= 16; +- + hstate->nplanes = fb->format->num_planes; + if (hstate->nplanes > ATMEL_HLCDC_LAYER_MAX_PLANES) + return -EINVAL; +-- +2.51.0 + diff --git a/queue-5.15/drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch b/queue-5.15/drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch new file mode 100644 index 00000000000..ef56332024c --- /dev/null +++ b/queue-5.15/drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch @@ -0,0 +1,61 @@ +From 60f4f03d7c32c36b4ab434a42d9eeaebc9ae0cd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Oct 2025 18:14:52 +0200 +Subject: drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state + callback + +From: Ludovic Desroches + +[ Upstream commit f12352471061df83a36edf54bbb16284793284e4 ] + +After several commits, the slab memory increases. Some drm_crtc_commit +objects are not freed. The atomic_destroy_state callback only put the +framebuffer. Use the __drm_atomic_helper_plane_destroy_state() function +to put all the objects that are no longer needed. + +It has been seen after hours of usage of a graphics application or using +kmemleak: + +unreferenced object 0xc63a6580 (size 64): + comm "egt_basic", pid 171, jiffies 4294940784 + hex dump (first 32 bytes): + 40 50 34 c5 01 00 00 00 ff ff ff ff 8c 65 3a c6 @P4..........e:. + 8c 65 3a c6 ff ff ff ff 98 65 3a c6 98 65 3a c6 .e:......e:..e:. + backtrace (crc c25aa925): + kmemleak_alloc+0x34/0x3c + __kmalloc_cache_noprof+0x150/0x1a4 + drm_atomic_helper_setup_commit+0x1e8/0x7bc + drm_atomic_helper_commit+0x3c/0x15c + drm_atomic_commit+0xc0/0xf4 + drm_atomic_helper_set_config+0x84/0xb8 + drm_mode_setcrtc+0x32c/0x810 + drm_ioctl+0x20c/0x488 + sys_ioctl+0x14c/0xc20 + ret_fast_syscall+0x0/0x54 + +Signed-off-by: Ludovic Desroches +Reviewed-by: Manikandan Muralidharan +Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-1-79b615130dc3@microchip.com +Signed-off-by: Manikandan Muralidharan +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +index a077d93c78d7b..594999d67c808 100644 +--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c ++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +@@ -933,8 +933,7 @@ static void atmel_hlcdc_plane_atomic_destroy_state(struct drm_plane *p, + state->dscrs[i]->self); + } + +- if (s->fb) +- drm_framebuffer_put(s->fb); ++ __drm_atomic_helper_plane_destroy_state(s); + + kfree(state); + } +-- +2.51.0 + diff --git a/queue-5.15/drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch b/queue-5.15/drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch new file mode 100644 index 00000000000..b1be719e4a4 --- /dev/null +++ b/queue-5.15/drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch @@ -0,0 +1,81 @@ +From 544c46c4bb7823483bf775d02d5b5d3880ac27ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Oct 2025 18:14:53 +0200 +Subject: drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release + +From: Ludovic Desroches + +[ Upstream commit bc847787233277a337788568e90a6ee1557595eb ] + +The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying +the atmel_hlcdc_plane state structure without properly duplicating the +drm_plane_state. In particular, state->commit remained set to the old +state commit, which can lead to a use-after-free in the next +drm_atomic_commit() call. + +Fix this by calling +__drm_atomic_helper_duplicate_plane_state(), which correctly clones +the base drm_plane_state (including the ->commit pointer). + +It has been seen when closing and re-opening the device node while +another DRM client (e.g. fbdev) is still attached: + +============================================================================= +BUG kmalloc-64 (Not tainted): Poison overwritten +----------------------------------------------------------------------------- + +0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b +FIX kmalloc-64: Restoring Poison 0xc611b344-0xc611b344=0x6b +Allocated in drm_atomic_helper_setup_commit+0x1e8/0x7bc age=178 cpu=0 +pid=29 + drm_atomic_helper_setup_commit+0x1e8/0x7bc + drm_atomic_helper_commit+0x3c/0x15c + drm_atomic_commit+0xc0/0xf4 + drm_framebuffer_remove+0x4cc/0x5a8 + drm_mode_rmfb_work_fn+0x6c/0x80 + process_one_work+0x12c/0x2cc + worker_thread+0x2a8/0x400 + kthread+0xc0/0xdc + ret_from_fork+0x14/0x28 +Freed in drm_atomic_helper_commit_hw_done+0x100/0x150 age=8 cpu=0 +pid=169 + drm_atomic_helper_commit_hw_done+0x100/0x150 + drm_atomic_helper_commit_tail+0x64/0x8c + commit_tail+0x168/0x18c + drm_atomic_helper_commit+0x138/0x15c + drm_atomic_commit+0xc0/0xf4 + drm_atomic_helper_set_config+0x84/0xb8 + drm_mode_setcrtc+0x32c/0x810 + drm_ioctl+0x20c/0x488 + sys_ioctl+0x14c/0xc20 + ret_fast_syscall+0x0/0x54 +Slab 0xef8bc360 objects=21 used=16 fp=0xc611b7c0 +flags=0x200(workingset|zone=0) +Object 0xc611b340 @offset=832 fp=0xc611b7c0 + +Signed-off-by: Ludovic Desroches +Reviewed-by: Manikandan Muralidharan +Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-2-79b615130dc3@microchip.com +Signed-off-by: Manikandan Muralidharan +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +index 79e04c53a642e..fba7e4b52e978 100644 +--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c ++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +@@ -903,8 +903,7 @@ atmel_hlcdc_plane_atomic_duplicate_state(struct drm_plane *p) + return NULL; + } + +- if (copy->base.fb) +- drm_framebuffer_get(copy->base.fb); ++ __drm_atomic_helper_plane_duplicate_state(p, ©->base); + + return ©->base; + } +-- +2.51.0 + diff --git a/queue-5.15/drm-radeon-add-hainan-clock-adjustment.patch b/queue-5.15/drm-radeon-add-hainan-clock-adjustment.patch new file mode 100644 index 00000000000..b417a9f85e5 --- /dev/null +++ b/queue-5.15/drm-radeon-add-hainan-clock-adjustment.patch @@ -0,0 +1,39 @@ +From 18ac0f9baa7bac3df3436bd8af251a279ca38f3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Feb 2026 07:26:00 +0000 +Subject: drm/radeon: Add HAINAN clock adjustment + +From: decce6 + +[ Upstream commit 908d318f23d6b5d625bea093c5fc056238cdb7ff ] + +This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from +850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This +patch is for radeon. + +Signed-off-by: decce6 +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/si_dpm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c +index 3add39c1a6897..82a93f7aeafb4 100644 +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -2969,6 +2969,11 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev, + max_sclk = 60000; + max_mclk = 80000; + } ++ if ((rdev->pdev->device == 0x666f) && ++ (rdev->pdev->revision == 0x00)) { ++ max_sclk = 80000; ++ max_mclk = 95000; ++ } + } else if (rdev->family == CHIP_OLAND) { + if ((rdev->pdev->revision == 0xC7) || + (rdev->pdev->revision == 0x80) || +-- +2.51.0 + diff --git a/queue-5.15/drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch b/queue-5.15/drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch new file mode 100644 index 00000000000..6f4deb43855 --- /dev/null +++ b/queue-5.15/drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch @@ -0,0 +1,71 @@ +From 1ef1337339bcf847b54c949e962001d82635cdc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Dec 2025 21:03:23 +0800 +Subject: drm/v3d: Set DMA segment size to avoid debug warnings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Xiaolei Wang + +[ Upstream commit 9eb018828b1b30dfba689c060735c50fc5b9f704 ] + +When using V3D rendering with CONFIG_DMA_API_DEBUG enabled, the +kernel occasionally reports a segment size mismatch. This is because +'max_seg_size' is not set. The kernel defaults to 64K. setting +'max_seg_size' to the maximum will prevent 'debug_dma_map_sg()' +from complaining about the over-mapping of the V3D segment length. + +DMA-API: v3d 1002000000.v3d: mapping sg segment longer than device + claims to support [len=8290304] [max=65536] +WARNING: CPU: 0 PID: 493 at kernel/dma/debug.c:1179 debug_dma_map_sg+0x330/0x388 +CPU: 0 UID: 0 PID: 493 Comm: Xorg Not tainted 6.12.53-yocto-standard #1 +Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT) +pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : debug_dma_map_sg+0x330/0x388 +lr : debug_dma_map_sg+0x330/0x388 +sp : ffff8000829a3ac0 +x29: ffff8000829a3ac0 x28: 0000000000000001 x27: ffff8000813fe000 +x26: ffffc1ffc0000000 x25: ffff00010fdeb760 x24: 0000000000000000 +x23: ffff8000816a9bf0 x22: 0000000000000001 x21: 0000000000000002 +x20: 0000000000000002 x19: ffff00010185e810 x18: ffffffffffffffff +x17: 69766564206e6168 x16: 74207265676e6f6c x15: 20746e656d676573 +x14: 20677320676e6970 x13: 5d34303334393134 x12: 0000000000000000 +x11: 00000000000000c0 x10: 00000000000009c0 x9 : ffff8000800e0b7c +x8 : ffff00010a315ca0 x7 : ffff8000816a5110 x6 : 0000000000000001 +x5 : 000000000000002b x4 : 0000000000000002 x3 : 0000000000000008 +x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00010a315280 +Call trace: + debug_dma_map_sg+0x330/0x388 + __dma_map_sg_attrs+0xc0/0x278 + dma_map_sgtable+0x30/0x58 + drm_gem_shmem_get_pages_sgt+0xb4/0x140 + v3d_bo_create_finish+0x28/0x130 [v3d] + v3d_create_bo_ioctl+0x54/0x180 [v3d] + drm_ioctl_kernel+0xc8/0x140 + drm_ioctl+0x2d4/0x4d8 + +Signed-off-by: Xiaolei Wang +Link: https://patch.msgid.link/20251203130323.2247072-1-xiaolei.wang@windriver.com +Signed-off-by: Maíra Canal +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/v3d/v3d_drv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c +index 6407a006d6ec4..692131c7fa36d 100644 +--- a/drivers/gpu/drm/v3d/v3d_drv.c ++++ b/drivers/gpu/drm/v3d/v3d_drv.c +@@ -246,6 +246,8 @@ static int v3d_platform_drm_probe(struct platform_device *pdev) + if (ret) + return ret; + ++ dma_set_max_seg_size(&pdev->dev, UINT_MAX); ++ + v3d->va_width = 30 + V3D_GET_FIELD(mmu_debug, V3D_MMU_VA_WIDTH); + + ident1 = V3D_READ(V3D_HUB_IDENT1); +-- +2.51.0 + diff --git a/queue-5.15/efi-cper-don-t-dump-the-entire-memory-region.patch b/queue-5.15/efi-cper-don-t-dump-the-entire-memory-region.patch new file mode 100644 index 00000000000..694746e290d --- /dev/null +++ b/queue-5.15/efi-cper-don-t-dump-the-entire-memory-region.patch @@ -0,0 +1,54 @@ +From bb4636e71ecf636e53ab55ed52b36353cf28ebdd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:35:06 +0100 +Subject: EFI/CPER: don't dump the entire memory region + +From: Mauro Carvalho Chehab + +[ Upstream commit 55cc6fe5716f678f06bcb95140882dfa684464ec ] + +The current logic at cper_print_fw_err() doesn't check if the +error record length is big enough to handle offset. On a bad firmware, +if the ofset is above the actual record, length -= offset will +underflow, making it dump the entire memory. + +The end result can be: + + - the logic taking a lot of time dumping large regions of memory; + - data disclosure due to the memory dumps; + - an OOPS, if it tries to dump an unmapped memory region. + +Fix it by checking if the section length is too small before doing +a hex dump. + +Signed-off-by: Mauro Carvalho Chehab +Reviewed-by: Jonathan Cameron +Acked-by: Ard Biesheuvel +Reviewed-by: Hanjun Guo +[ rjw: Subject tweaks ] +Link: https://patch.msgid.link/1752b5ba63a3e2f148ddee813b36c996cc617e86.1767871950.git.mchehab+huawei@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/cper.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c +index f00ee3eef71b8..22cc0fc35b417 100644 +--- a/drivers/firmware/efi/cper.c ++++ b/drivers/firmware/efi/cper.c +@@ -523,6 +523,11 @@ static void cper_print_fw_err(const char *pfx, + } else { + offset = sizeof(*fw_err); + } ++ if (offset > length) { ++ printk("%s""error section length is too small: offset=%d, length=%d\n", ++ pfx, offset, length); ++ return; ++ } + + buf += offset; + length -= offset; +-- +2.51.0 + diff --git a/queue-5.15/efi-cper-don-t-go-past-the-arm-processor-cper-record.patch b/queue-5.15/efi-cper-don-t-go-past-the-arm-processor-cper-record.patch new file mode 100644 index 00000000000..8203f88b715 --- /dev/null +++ b/queue-5.15/efi-cper-don-t-go-past-the-arm-processor-cper-record.patch @@ -0,0 +1,107 @@ +From 527360d45cbdd020e5215d057bbabf50841e4a25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:35:04 +0100 +Subject: EFI/CPER: don't go past the ARM processor CPER record buffer + +From: Mauro Carvalho Chehab + +[ Upstream commit eae21beecb95a3b69ee5c38a659f774e171d730e ] + +There's a logic inside GHES/CPER to detect if the section_length +is too small, but it doesn't detect if it is too big. + +Currently, if the firmware receives an ARM processor CPER record +stating that a section length is big, kernel will blindly trust +section_length, producing a very long dump. For instance, a 67 +bytes record with ERR_INFO_NUM set 46198 and section length +set to 854918320 would dump a lot of data going a way past the +firmware memory-mapped area. + +Fix it by adding a logic to prevent it to go past the buffer +if ERR_INFO_NUM is too big, making it report instead: + + [Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1 + [Hardware Error]: event severity: recoverable + [Hardware Error]: Error 0, type: recoverable + [Hardware Error]: section_type: ARM processor error + [Hardware Error]: MIDR: 0xff304b2f8476870a + [Hardware Error]: section length: 854918320, CPER size: 67 + [Hardware Error]: section length is too big + [Hardware Error]: firmware-generated error record is incorrect + [Hardware Error]: ERR_INFO_NUM is 46198 + +Signed-off-by: Mauro Carvalho Chehab +Reviewed-by: Jonathan Cameron +Acked-by: Ard Biesheuvel +Reviewed-by: Hanjun Guo +[ rjw: Subject and changelog tweaks ] +Link: https://patch.msgid.link/41cd9f6b3ace3cdff7a5e864890849e4b1c58b63.1767871950.git.mchehab+huawei@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/cper-arm.c | 12 ++++++++---- + drivers/firmware/efi/cper.c | 3 ++- + include/linux/cper.h | 3 ++- + 3 files changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/firmware/efi/cper-arm.c b/drivers/firmware/efi/cper-arm.c +index ea43589944ba5..26a12f8076359 100644 +--- a/drivers/firmware/efi/cper-arm.c ++++ b/drivers/firmware/efi/cper-arm.c +@@ -227,7 +227,8 @@ static void cper_print_arm_err_info(const char *pfx, u32 type, + } + + void cper_print_proc_arm(const char *pfx, +- const struct cper_sec_proc_arm *proc) ++ const struct cper_sec_proc_arm *proc, ++ u32 length) + { + int i, len, max_ctx_type; + struct cper_arm_err_info *err_info; +@@ -239,9 +240,12 @@ void cper_print_proc_arm(const char *pfx, + + len = proc->section_length - (sizeof(*proc) + + proc->err_info_num * (sizeof(*err_info))); +- if (len < 0) { +- printk("%ssection length: %d\n", pfx, proc->section_length); +- printk("%ssection length is too small\n", pfx); ++ ++ if (len < 0 || proc->section_length > length) { ++ printk("%ssection length: %d, CPER size: %d\n", ++ pfx, proc->section_length, length); ++ printk("%ssection length is too %s\n", pfx, ++ (len < 0) ? "small" : "big"); + printk("%sfirmware-generated error record is incorrect\n", pfx); + printk("%sERR_INFO_NUM is %d\n", pfx, proc->err_info_num); + return; +diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c +index 22cc0fc35b417..d45f653502206 100644 +--- a/drivers/firmware/efi/cper.c ++++ b/drivers/firmware/efi/cper.c +@@ -608,7 +608,8 @@ cper_estatus_print_section(const char *pfx, struct acpi_hest_generic_data *gdata + + printk("%ssection_type: ARM processor error\n", newpfx); + if (gdata->error_data_length >= sizeof(*arm_err)) +- cper_print_proc_arm(newpfx, arm_err); ++ cper_print_proc_arm(newpfx, arm_err, ++ gdata->error_data_length); + else + goto err_section_too_small; + #endif +diff --git a/include/linux/cper.h b/include/linux/cper.h +index a31e22cc839eb..b3079f687c5c6 100644 +--- a/include/linux/cper.h ++++ b/include/linux/cper.h +@@ -567,7 +567,8 @@ void cper_mem_err_pack(const struct cper_sec_mem_err *, + const char *cper_mem_err_unpack(struct trace_seq *, + struct cper_mem_err_compact *); + void cper_print_proc_arm(const char *pfx, +- const struct cper_sec_proc_arm *proc); ++ const struct cper_sec_proc_arm *proc, ++ u32 length); + void cper_print_proc_ia(const char *pfx, + const struct cper_sec_proc_ia *proc); + +-- +2.51.0 + diff --git a/queue-5.15/ext4-mark-group-add-fast-commit-ineligible.patch b/queue-5.15/ext4-mark-group-add-fast-commit-ineligible.patch new file mode 100644 index 00000000000..4e0208cf671 --- /dev/null +++ b/queue-5.15/ext4-mark-group-add-fast-commit-ineligible.patch @@ -0,0 +1,68 @@ +From f49738670540424f4c22c79e71df79560aeed664 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 19:51:41 +0800 +Subject: ext4: mark group add fast-commit ineligible + +From: Li Chen + +[ Upstream commit 89b4336fd5ec78f51f9d3a1d100f3ffa3228e604 ] + +Fast commits only log operations that have dedicated replay support. +Online resize via EXT4_IOC_GROUP_ADD updates the superblock and group +descriptor metadata without going through the fast commit tracking +paths. +In practice these operations are rare and usually followed by further +updates, but mixing them into a fast commit makes the overall +semantics harder to reason about and risks replay gaps if new call +sites appear. + +Teach ext4 to mark the filesystem fast-commit ineligible when +ext4_ioctl_group_add() adds new block groups. +This forces those transactions to fall back to a full commit, +ensuring that the filesystem geometry updates are captured by the +normal journal rather than partially encoded in fast commit TLVs. +This change should not affect common workloads but makes online +resize via GROUP_ADD safer and easier to reason about under fast +commit. + +Testing: +1. prepare: + dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256 + mkfs.ext4 -O fast_commit -F /root/fc_resize.img + mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize +2. Ran a helper that issues EXT4_IOC_GROUP_ADD on the mounted + filesystem and checked the resize ineligible reason: + ./group_add_helper /mnt/fc_resize + cat /proc/fs/ext4/loop0/fc_info + shows "Resize": > 0. +3. Fsynced a file on the resized filesystem and verified that the fast + commit stats report at least one ineligible commit: + touch /mnt/fc_resize/file + /root/fsync_file /mnt/fc_resize/file + sync + cat /proc/fs/ext4/loop0/fc_info + shows fc stats ineligible > 0. + +Signed-off-by: Li Chen +Link: https://patch.msgid.link/20251211115146.897420-5-me@linux.beauty +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/ioctl.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c +index bd90b454c6213..889eadb87520e 100644 +--- a/fs/ext4/ioctl.c ++++ b/fs/ext4/ioctl.c +@@ -709,6 +709,7 @@ static long ext4_ioctl_group_add(struct file *file, + + err = ext4_group_add(sb, input); + if (EXT4_SB(sb)->s_journal) { ++ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE, NULL); + jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal); + err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0); + jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal); +-- +2.51.0 + diff --git a/queue-5.15/ext4-mark-group-extend-fast-commit-ineligible.patch b/queue-5.15/ext4-mark-group-extend-fast-commit-ineligible.patch new file mode 100644 index 00000000000..2b4b87e160f --- /dev/null +++ b/queue-5.15/ext4-mark-group-extend-fast-commit-ineligible.patch @@ -0,0 +1,69 @@ +From 9e67f66ba4201b156fe72707df4c34b9d536e736 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 19:51:42 +0800 +Subject: ext4: mark group extend fast-commit ineligible + +From: Li Chen + +[ Upstream commit 1f8dd813a1c771b13c303f73d876164bc9b327cc ] + +Fast commits only log operations that have dedicated replay support. +EXT4_IOC_GROUP_EXTEND grows the filesystem to the end of the last +block group and updates the same on-disk metadata without going +through the fast commit tracking paths. +In practice these operations are rare and usually followed by further +updates, but mixing them into a fast commit makes the overall +semantics harder to reason about and risks replay gaps if new call +sites appear. + +Teach ext4 to mark the filesystem fast-commit ineligible when +EXT4_IOC_GROUP_EXTEND grows the filesystem. +This forces those transactions to fall back to a full commit, +ensuring that the group extension changes are captured by the normal +journal rather than partially encoded in fast commit TLVs. +This change should not affect common workloads but makes online +resize via GROUP_EXTEND safer and easier to reason about under fast +commit. + +Testing: +1. prepare: + dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256 + mkfs.ext4 -O fast_commit -F /root/fc_resize.img + mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize +2. Extended the filesystem to the end of the last block group using a + helper that calls EXT4_IOC_GROUP_EXTEND on the mounted filesystem + and checked fc_info: + ./group_extend_helper /mnt/fc_resize + cat /proc/fs/ext4/loop0/fc_info + shows the "Resize" ineligible reason increased. +3. Fsynced a file on the resized filesystem and confirmed that the fast + commit ineligible counter incremented for the resize transaction: + touch /mnt/fc_resize/file + /root/fsync_file /mnt/fc_resize/file + sync + cat /proc/fs/ext4/loop0/fc_info + +Signed-off-by: Li Chen +Link: https://patch.msgid.link/20251211115146.897420-6-me@linux.beauty +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/ioctl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c +index 889eadb87520e..4d1e5d8055231 100644 +--- a/fs/ext4/ioctl.c ++++ b/fs/ext4/ioctl.c +@@ -937,6 +937,8 @@ static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) + + err = ext4_group_extend(sb, EXT4_SB(sb)->s_es, n_blocks_count); + if (EXT4_SB(sb)->s_journal) { ++ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE, ++ NULL); + jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal); + err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0); + jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal); +-- +2.51.0 + diff --git a/queue-5.15/fix-it87_wdt-early-reboot-by-reporting-running-timer.patch b/queue-5.15/fix-it87_wdt-early-reboot-by-reporting-running-timer.patch new file mode 100644 index 00000000000..ed2e9ea4872 --- /dev/null +++ b/queue-5.15/fix-it87_wdt-early-reboot-by-reporting-running-timer.patch @@ -0,0 +1,60 @@ +From bfd08d39485f3f98a30ad06f88f1de25b4ab9d57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 13:11:24 +0100 +Subject: fix it87_wdt early reboot by reporting running timer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: René Rebe + +[ Upstream commit 88b2ab346436f799b99894a3e9518a3ffa344524 ] + +Some products, such as the Ugreen DXP4800 Plus NAS, ship with the it87 +wdt enabled by the firmware and a broken BIOS option that does not +allow to change the time or turn it off. As this makes installing +Linux rather difficult, change the it87_wdt to report it running to +the watchdog core. + +Signed-off-by: René Rebe +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/it87_wdt.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/watchdog/it87_wdt.c b/drivers/watchdog/it87_wdt.c +index 239947df613db..1392e557fa371 100644 +--- a/drivers/watchdog/it87_wdt.c ++++ b/drivers/watchdog/it87_wdt.c +@@ -183,6 +183,12 @@ static void _wdt_update_timeout(unsigned int t) + superio_outb(t >> 8, WDTVALMSB); + } + ++/* Internal function, should be called after superio_select(GPIO) */ ++static bool _wdt_running(void) ++{ ++ return superio_inb(WDTVALLSB) || (max_units > 255 && superio_inb(WDTVALMSB)); ++} ++ + static int wdt_update_timeout(unsigned int t) + { + int ret; +@@ -365,6 +371,12 @@ static int __init it87_wdt_init(void) + } + } + ++ /* wdt already left running by firmware? */ ++ if (_wdt_running()) { ++ pr_info("Left running by firmware.\n"); ++ set_bit(WDOG_HW_RUNNING, &wdt_dev.status); ++ } ++ + superio_exit(); + + if (timeout < 1 || timeout > max_units * 60) { +-- +2.51.0 + diff --git a/queue-5.15/fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch b/queue-5.15/fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch new file mode 100644 index 00000000000..d0f32a3ba3d --- /dev/null +++ b/queue-5.15/fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch @@ -0,0 +1,45 @@ +From 0b9fd1c4375d90e69347e110d76f0ee58f804c45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 16:07:32 +0100 +Subject: fs/ntfs3: avoid calling run_get_entry() when run == NULL in + ntfs_read_run_nb_ra() + +From: Konstantin Komarov + +[ Upstream commit c5226b96c08a010ebef5fdf4c90572bcd89e4299 ] + +When ntfs_read_run_nb_ra() is invoked with run == NULL the code later +assumes run is valid and may call run_get_entry(NULL, ...), and also +uses clen/idx without initializing them. Smatch reported uninitialized +variable warnings and this can lead to undefined behaviour. This patch +fixes it. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202512230646.v5hrYXL0-lkp@intel.com/ +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/fsntfs.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c +index 7dc2ae7dec591..566dd9083b8ff 100644 +--- a/fs/ntfs3/fsntfs.c ++++ b/fs/ntfs3/fsntfs.c +@@ -1249,6 +1249,12 @@ int ntfs_read_run_nb(struct ntfs_sb_info *sbi, const struct runs_tree *run, + + } while (len32); + ++ if (!run) { ++ err = -EINVAL; ++ goto out; ++ } ++ ++ /* Get next fragment to read. */ + vcn_next = vcn + clen; + if (!run_get_entry(run, ++idx, &vcn, &lcn, &clen) || + vcn != vcn_next) { +-- +2.51.0 + diff --git a/queue-5.15/fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch b/queue-5.15/fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch new file mode 100644 index 00000000000..59de7939117 --- /dev/null +++ b/queue-5.15/fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch @@ -0,0 +1,58 @@ +From 21230cafe02631de06dc81727f18a90be0582331 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 19:59:59 +0900 +Subject: fs: ntfs3: check return value of indx_find to avoid infinite loop + +From: Jaehun Gou + +[ Upstream commit 1732053c8a6b360e2d5afb1b34fe9779398b072c ] + +We found an infinite loop bug in the ntfs3 file system that can lead to a +Denial-of-Service (DoS) condition. + +A malformed dentry in the ntfs3 filesystem can cause the kernel to hang +during the lookup operations. By setting the HAS_SUB_NODE flag in an +INDEX_ENTRY within a directory's INDEX_ALLOCATION block and manipulating the +VCN pointer, an attacker can cause the indx_find() function to repeatedly +read the same block, allocating 4 KB of memory each time. The kernel lacks +VCN loop detection and depth limits, causing memory exhaustion and an OOM +crash. + +This patch adds a return value check for fnd_push() to prevent a memory +exhaustion vulnerability caused by infinite loops. When the index exceeds the +size of the fnd->nodes array, fnd_push() returns -EINVAL. The indx_find() +function checks this return value and stops processing, preventing further +memory allocation. + +Co-developed-by: Seunghun Han +Signed-off-by: Seunghun Han +Co-developed-by: Jihoon Kwon +Signed-off-by: Jihoon Kwon +Signed-off-by: Jaehun Gou +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/index.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c +index 0fe1b5696e855..b0aa5cc63b507 100644 +--- a/fs/ntfs3/index.c ++++ b/fs/ntfs3/index.c +@@ -1197,7 +1197,12 @@ int indx_find(struct ntfs_index *indx, struct ntfs_inode *ni, + goto out; + } + +- fnd_push(fnd, node, e); ++ err = fnd_push(fnd, node, e); ++ ++ if (err) { ++ put_indx_node(node); ++ return err; ++ } + } + + out: +-- +2.51.0 + diff --git a/queue-5.15/fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch b/queue-5.15/fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch new file mode 100644 index 00000000000..24231138eff --- /dev/null +++ b/queue-5.15/fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch @@ -0,0 +1,83 @@ +From c3b51225566a45c6fbe6734ddd06eb9678b7b13d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 20:01:09 +0900 +Subject: fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent + metadata + +From: Jaehun Gou + +[ Upstream commit 4b90f16e4bb5607fb35e7802eb67874038da4640 ] + +We found an infinite loop bug in the ntfs3 file system that can lead to a +Denial-of-Service (DoS) condition. + +A malformed NTFS image can cause an infinite loop when an attribute header +indicates an empty run list, while directory entries reference it as +containing actual data. In NTFS, setting evcn=-1 with svcn=0 is a valid way +to represent an empty run list, and run_unpack() correctly handles this by +checking if evcn + 1 equals svcn and returning early without parsing any run +data. However, this creates a problem when there is metadata inconsistency, +where the attribute header claims to be empty (evcn=-1) but the caller +expects to read actual data. When run_unpack() immediately returns success +upon seeing this condition, it leaves the runs_tree uninitialized with +run->runs as a NULL. The calling function attr_load_runs_range() assumes +that a successful return means that the runs were loaded and sets clen to 0, +expecting the next run_lookup_entry() call to succeed. Because runs_tree +remains uninitialized, run_lookup_entry() continues to fail, and the loop +increments vcn by zero (vcn += 0), leading to an infinite loop. + +This patch adds a retry counter to detect when run_lookup_entry() fails +consecutively after attr_load_runs_vcn(). If the run is still not found on +the second attempt, it indicates corrupted metadata and returns -EINVAL, +preventing the Denial-of-Service (DoS) vulnerability. + +Co-developed-by: Seunghun Han +Signed-off-by: Seunghun Han +Co-developed-by: Jihoon Kwon +Signed-off-by: Jihoon Kwon +Signed-off-by: Jaehun Gou +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index 83c15c70f5945..872586e9598a7 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -1192,19 +1192,28 @@ int attr_load_runs_range(struct ntfs_inode *ni, enum ATTR_TYPE type, + CLST vcn = from >> cluster_bits; + CLST vcn_last = (to - 1) >> cluster_bits; + CLST lcn, clen; +- int err; ++ int err = 0; ++ int retry = 0; + + for (vcn = from >> cluster_bits; vcn <= vcn_last; vcn += clen) { + if (!run_lookup_entry(run, vcn, &lcn, &clen, NULL)) { ++ if (retry != 0) { /* Next run_lookup_entry(vcn) also failed. */ ++ err = -EINVAL; ++ break; ++ } + err = attr_load_runs_vcn(ni, type, name, name_len, run, + vcn); + if (err) +- return err; ++ break; ++ + clen = 0; /* Next run_lookup_entry(vcn) must be success. */ ++ retry++; + } ++ else ++ retry = 0; + } + +- return 0; ++ return err; + } + + #ifdef CONFIG_NTFS3_LZX_XPRESS +-- +2.51.0 + diff --git a/queue-5.15/fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch b/queue-5.15/fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch new file mode 100644 index 00000000000..51725c97c9f --- /dev/null +++ b/queue-5.15/fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch @@ -0,0 +1,68 @@ +From 2f83ccf0f5283179e8a35e4a58672d4330e34533 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 20:01:46 +0900 +Subject: fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST + +From: Jaehun Gou + +[ Upstream commit 06909b2549d631a47fcda249d34be26f7ca1711d ] + +We found an infinite loop bug in the ntfs3 file system that can lead to a +Denial-of-Service (DoS) condition. + +A malformed NTFS image can cause an infinite loop when an ATTR_LIST attribute +indicates a zero data size while the driver allocates memory for it. + +When ntfs_load_attr_list() processes a resident ATTR_LIST with data_size set +to zero, it still allocates memory because of al_aligned(0). This creates an +inconsistent state where ni->attr_list.size is zero, but ni->attr_list.le is +non-null. This causes ni_enum_attr_ex to incorrectly assume that no attribute +list exists and enumerates only the primary MFT record. When it finds +ATTR_LIST, the code reloads it and restarts the enumeration, repeating +indefinitely. The mount operation never completes, hanging the kernel thread. + +This patch adds validation to ensure that data_size is non-zero before memory +allocation. When a zero-sized ATTR_LIST is detected, the function returns +-EINVAL, preventing a DoS vulnerability. + +Co-developed-by: Seunghun Han +Signed-off-by: Seunghun Han +Co-developed-by: Jihoon Kwon +Signed-off-by: Jihoon Kwon +Signed-off-by: Jaehun Gou +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrlist.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/fs/ntfs3/attrlist.c b/fs/ntfs3/attrlist.c +index 82bd9b5d9bd80..64da2196711ed 100644 +--- a/fs/ntfs3/attrlist.c ++++ b/fs/ntfs3/attrlist.c +@@ -52,6 +52,11 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr) + + if (!attr->non_res) { + lsize = le32_to_cpu(attr->res.data_size); ++ if (!lsize) { ++ err = -EINVAL; ++ goto out; ++ } ++ + /* attr is resident: lsize < record_size (1K or 4K) */ + le = kvmalloc(al_aligned(lsize), GFP_KERNEL); + if (!le) { +@@ -66,6 +71,10 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr) + u16 run_off = le16_to_cpu(attr->nres.run_off); + + lsize = le64_to_cpu(attr->nres.data_size); ++ if (!lsize) { ++ err = -EINVAL; ++ goto out; ++ } + + run_init(&ni->attr_list.run); + +-- +2.51.0 + diff --git a/queue-5.15/gfs2-fiemap-page-fault-fix.patch b/queue-5.15/gfs2-fiemap-page-fault-fix.patch new file mode 100644 index 00000000000..6ba7972cb47 --- /dev/null +++ b/queue-5.15/gfs2-fiemap-page-fault-fix.patch @@ -0,0 +1,69 @@ +From 124ecccfe1a97703ef8b1cad0398b9b4dae0a603 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Feb 2026 15:52:57 +0100 +Subject: gfs2: fiemap page fault fix + +From: Andreas Gruenbacher + +[ Upstream commit e411d74cc5ba290f85d0dd5e4d1df8f1d6d975d2 ] + +In gfs2_fiemap(), we are calling iomap_fiemap() while holding the inode +glock. This can lead to recursive glock taking if the fiemap buffer is +memory mapped to the same inode and accessing it triggers a page fault. + +Fix by disabling page faults for iomap_fiemap() and faulting in the +buffer by hand if necessary. + +Fixes xfstest generic/742. + +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/inode.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c +index a7af9904e3edb..061372f84a64c 100644 +--- a/fs/gfs2/inode.c ++++ b/fs/gfs2/inode.c +@@ -2076,6 +2076,14 @@ static int gfs2_getattr(struct user_namespace *mnt_userns, + return 0; + } + ++static bool fault_in_fiemap(struct fiemap_extent_info *fi) ++{ ++ struct fiemap_extent __user *dest = fi->fi_extents_start; ++ size_t size = sizeof(*dest) * fi->fi_extents_max; ++ ++ return fault_in_safe_writeable((char __user *)dest, size) == 0; ++} ++ + static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, + u64 start, u64 len) + { +@@ -2085,14 +2093,22 @@ static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, + + inode_lock_shared(inode); + ++retry: + ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_SHARED, 0, &gh); + if (ret) + goto out; + ++ pagefault_disable(); + ret = iomap_fiemap(inode, fieinfo, start, len, &gfs2_iomap_ops); ++ pagefault_enable(); + + gfs2_glock_dq_uninit(&gh); + ++ if (ret == -EFAULT && fault_in_fiemap(fieinfo)) { ++ fieinfo->fi_extents_mapped = 0; ++ goto retry; ++ } ++ + out: + inode_unlock_shared(inode); + return ret; +-- +2.51.0 + diff --git a/queue-5.15/gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch b/queue-5.15/gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch new file mode 100644 index 00000000000..dcbc6137262 --- /dev/null +++ b/queue-5.15/gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch @@ -0,0 +1,57 @@ +From 81e572e42730d9562e6644dace15590da99a22ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 17:26:26 +0800 +Subject: gpio: aspeed-sgpio: Change the macro to support deferred probe + +From: Billy Tsai + +[ Upstream commit e18533b023ec7a33488bcf33140ce69bbba2894f ] + +Use module_platform_driver() to replace module_platform_driver_probe(). +The former utilizes platform_driver_register(), which allows the driver to +defer probing when it doesn't acquire the necessary resources due to probe +order. In contrast, the latter uses __platform_driver_probe(), which +includes the comment "Note that this is incompatible with deferred +probing." Since our SGPIO driver requires access to the clock resource, the +former is more suitable. + +Reviewed-by: Linus Walleij +Signed-off-by: Billy Tsai +Link: https://lore.kernel.org/r/20260123-upstream_sgpio-v2-1-69cfd1631400@aspeedtech.com +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-aspeed-sgpio.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpio/gpio-aspeed-sgpio.c b/drivers/gpio/gpio-aspeed-sgpio.c +index 454cefbeecf0e..e523a539410a8 100644 +--- a/drivers/gpio/gpio-aspeed-sgpio.c ++++ b/drivers/gpio/gpio-aspeed-sgpio.c +@@ -508,7 +508,7 @@ static const struct of_device_id aspeed_sgpio_of_table[] = { + + MODULE_DEVICE_TABLE(of, aspeed_sgpio_of_table); + +-static int __init aspeed_sgpio_probe(struct platform_device *pdev) ++static int aspeed_sgpio_probe(struct platform_device *pdev) + { + u32 nr_gpios, sgpio_freq, sgpio_clk_div, gpio_cnt_regval, pin_mask; + const struct aspeed_sgpio_pdata *pdata; +@@ -601,12 +601,13 @@ static int __init aspeed_sgpio_probe(struct platform_device *pdev) + } + + static struct platform_driver aspeed_sgpio_driver = { ++ .probe = aspeed_sgpio_probe, + .driver = { + .name = KBUILD_MODNAME, + .of_match_table = aspeed_sgpio_of_table, + }, + }; + +-module_platform_driver_probe(aspeed_sgpio_driver, aspeed_sgpio_probe); ++module_platform_driver(aspeed_sgpio_driver); + MODULE_DESCRIPTION("Aspeed Serial GPIO Driver"); + MODULE_LICENSE("GPL"); +-- +2.51.0 + diff --git a/queue-5.15/hfsplus-fix-volume-corruption-issue-for-generic-498.patch b/queue-5.15/hfsplus-fix-volume-corruption-issue-for-generic-498.patch new file mode 100644 index 00000000000..81f81ff18cb --- /dev/null +++ b/queue-5.15/hfsplus-fix-volume-corruption-issue-for-generic-498.patch @@ -0,0 +1,150 @@ +From 593c66839963f17413eca90aa0e8aa63795cc7b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Dec 2025 19:58:22 -0800 +Subject: hfsplus: fix volume corruption issue for generic/498 + +From: Viacheslav Dubeyko + +[ Upstream commit 9a8c4ad44721da4c48e1ff240ac76286c82837fe ] + +The xfstests' test-case generic/498 leaves HFS+ volume +in corrupted state: + +sudo ./check generic/498 +FSTYP -- hfsplus +PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #18 SMP PREEMPT_DYNAMIC Thu Dec 4 12:24:45 PST 2025 +MKFS_OPTIONS -- /dev/loop51 +MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch + +generic/498 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent +(see XFSTESTS-2/xfstests-dev/results//generic/498.full for details) + +Ran: generic/498 +Failures: generic/498 +Failed 1 of 1 tests + +sudo fsck.hfsplus -d /dev/loop51 +** /dev/loop51 +Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K. +Executing fsck_hfs (version 540.1-Linux). +** Checking non-journaled HFS Plus Volume. +The volume name is untitled +** Checking extents overflow file. +** Checking catalog file. +Invalid leaf record count +(It should be 16 instead of 2) +** Checking multi-linked files. +CheckHardLinks: found 1 pre-Leopard file inodes. +** Checking catalog hierarchy. +** Checking extended attributes file. +** Checking volume bitmap. +** Checking volume information. +Verify Status: VIStat = 0x0000, ABTStat = 0x0000 EBTStat = 0x0000 +CBTStat = 0x8000 CatStat = 0x00000000 +** Repairing volume. +** Rechecking volume. +** Checking non-journaled HFS Plus Volume. +The volume name is untitled +** Checking extents overflow file. +** Checking catalog file. +** Checking multi-linked files. +CheckHardLinks: found 1 pre-Leopard file inodes. +** Checking catalog hierarchy. +** Checking extended attributes file. +** Checking volume bitmap. +** Checking volume information. +** The volume untitled was repaired successfully. + +The generic/498 test executes such steps on final phase: + +mkdir $SCRATCH_MNT/A +mkdir $SCRATCH_MNT/B +mkdir $SCRATCH_MNT/A/C +touch $SCRATCH_MNT/B/foo +$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/B/foo + +ln $SCRATCH_MNT/B/foo $SCRATCH_MNT/A/C/foo +$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/A + +"Simulate a power failure and mount the filesystem +to check that what we explicitly fsync'ed exists." + +_flakey_drop_and_remount + +The FSCK tool complains about "Invalid leaf record count". +HFS+ b-tree header contains leaf_count field is updated +by hfs_brec_insert() and hfs_brec_remove(). The hfs_brec_insert() +is involved into hard link creation process. However, +modified in-core leaf_count field is stored into HFS+ +b-tree header by hfs_btree_write() method. But, +unfortunately, hfs_btree_write() hasn't been called +by hfsplus_cat_write_inode() and hfsplus_file_fsync() +stores not fully consistent state of the Catalog File's +b-tree. + +This patch adds calling hfs_btree_write() method in +the hfsplus_cat_write_inode() with the goal of +storing consistent state of Catalog File's b-tree. +Finally, it makes FSCK tool happy. + +sudo ./check generic/498 +FSTYP -- hfsplus +PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #22 SMP PREEMPT_DYNAMIC Sat Dec 6 17:01:31 PST 2025 +MKFS_OPTIONS -- /dev/loop51 +MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch + +generic/498 33s ... 31s +Ran: generic/498 +Passed all 1 tests + +Signed-off-by: Viacheslav Dubeyko +cc: John Paul Adrian Glaubitz +cc: Yangtao Li +cc: linux-fsdevel@vger.kernel.org +Link: https://lore.kernel.org/r/20251207035821.3863657-1-slava@dubeyko.com +Signed-off-by: Viacheslav Dubeyko +Signed-off-by: Sasha Levin +--- + fs/hfsplus/inode.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c +index 98a80ec5faa91..4310b9105d0fa 100644 +--- a/fs/hfsplus/inode.c ++++ b/fs/hfsplus/inode.c +@@ -599,6 +599,7 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd) + int hfsplus_cat_write_inode(struct inode *inode) + { + struct inode *main_inode = inode; ++ struct hfs_btree *tree = HFSPLUS_SB(inode->i_sb)->cat_tree; + struct hfs_find_data fd; + hfsplus_cat_entry entry; + int res = 0; +@@ -609,7 +610,7 @@ int hfsplus_cat_write_inode(struct inode *inode) + if (!main_inode->i_nlink) + return 0; + +- if (hfs_find_init(HFSPLUS_SB(main_inode->i_sb)->cat_tree, &fd)) ++ if (hfs_find_init(tree, &fd)) + /* panic? */ + return -EIO; + +@@ -674,6 +675,15 @@ int hfsplus_cat_write_inode(struct inode *inode) + set_bit(HFSPLUS_I_CAT_DIRTY, &HFSPLUS_I(inode)->flags); + out: + hfs_find_exit(&fd); ++ ++ if (!res) { ++ res = hfs_btree_write(tree); ++ if (res) { ++ pr_err("b-tree write err: %d, ino %lu\n", ++ res, inode->i_ino); ++ } ++ } ++ + return res; + } + +-- +2.51.0 + diff --git a/queue-5.15/hfsplus-pretend-special-inodes-as-regular-files.patch b/queue-5.15/hfsplus-pretend-special-inodes-as-regular-files.patch new file mode 100644 index 00000000000..edf0b3193c9 --- /dev/null +++ b/queue-5.15/hfsplus-pretend-special-inodes-as-regular-files.patch @@ -0,0 +1,45 @@ +From 6097a0a15b05889506162ae5ebf35361c57c96b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 18:39:33 +0900 +Subject: hfsplus: pretend special inodes as regular files + +From: Tetsuo Handa + +[ Upstream commit ed8889ca21b6ab37bc1435c4009ce37a79acb9e6 ] + +Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()") +requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/ +S_IFIFO/S_IFSOCK type, use S_IFREG for special inodes. + +Reported-by: syzbot +Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d +Signed-off-by: Tetsuo Handa +Reviewed-by: Viacheslav Dubeyko +Signed-off-by: Viacheslav Dubeyko +Link: https://lore.kernel.org/r/d0a07b1b-8b73-4002-8e29-e2bd56871262@I-love.SAKURA.ne.jp +Signed-off-by: Viacheslav Dubeyko +Signed-off-by: Sasha Levin +--- + fs/hfsplus/super.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c +index cb703b3e99fc2..8d2155ef7e811 100644 +--- a/fs/hfsplus/super.c ++++ b/fs/hfsplus/super.c +@@ -52,6 +52,12 @@ static int hfsplus_system_read_inode(struct inode *inode) + return -EIO; + } + ++ /* ++ * Assign a dummy file type, for may_open() requires that ++ * an inode has a valid file type. ++ */ ++ inode->i_mode = S_IFREG; ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-5.15/hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch b/queue-5.15/hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch new file mode 100644 index 00000000000..9d09e3235d1 --- /dev/null +++ b/queue-5.15/hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch @@ -0,0 +1,141 @@ +From c0e244c564291b63da7ede5b8f54e93e41f92e04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 12:56:09 +0900 +Subject: HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK + +From: David Phillips + +[ Upstream commit b8e5fdf0bd022cd5493a5987ef66f5a24f8352d8 ] + +New model in the ELECOM HUGE trackball line that has 8 buttons but the +report descriptor specifies only 5. The HUGE Plus supports connecting via +Bluetooth, 2.4GHz wireless USB dongle, and directly via a USB-C cable. +Each connection type reports a different device id, 01AA for cable, +01AB for USB dongle, and 01AC for Bluetooth. + +This patch adds these device IDs and applies the fixups similar to the +other ELECOM devices to get all 8 buttons working for all 3 connection +types. + +For reference, the usbhid-dump output: +001:013:001:DESCRIPTOR 1769085639.598405 + 05 01 09 02 A1 01 85 01 09 01 A1 00 05 09 19 01 + 29 05 15 00 25 01 75 01 95 05 81 02 75 03 95 01 + 81 01 05 01 09 30 09 31 16 01 80 26 FF 7F 75 10 + 95 02 81 06 09 38 15 81 25 7F 75 08 95 01 81 06 + 05 0C 0A 38 02 15 81 25 7F 75 08 95 01 81 06 C0 + C0 05 0C 09 01 A1 01 85 02 15 01 26 8C 02 19 01 + 2A 8C 02 75 10 95 01 81 00 C0 05 01 09 80 A1 01 + 85 03 09 82 09 81 09 83 15 00 25 01 19 01 29 03 + 75 01 95 03 81 02 95 05 81 01 C0 06 01 FF 09 00 + A1 01 85 08 09 00 15 00 26 FF 00 75 08 95 07 81 + 02 C0 06 02 FF 09 02 A1 01 85 06 09 02 15 00 26 + FF 00 75 08 95 07 B1 02 C0 + +Signed-off-by: David Phillips +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/Kconfig | 1 + + drivers/hid/hid-elecom.c | 16 ++++++++++++++++ + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/hid-quirks.c | 3 +++ + 4 files changed, 23 insertions(+) + +diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig +index 9235ab7161e3a..e1bd249666a2b 100644 +--- a/drivers/hid/Kconfig ++++ b/drivers/hid/Kconfig +@@ -337,6 +337,7 @@ config HID_ELECOM + - EX-G Trackballs (M-XT3DRBK, M-XT3URBK) + - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK) + - HUGE Trackballs (M-HT1DRBK, M-HT1URBK) ++ - HUGE Plus Trackball (M-HT1MRBK) + + config HID_ELO + tristate "ELO USB 4000/4500 touchscreen" +diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c +index f76fec79e8903..9aeb2d2b43a43 100644 +--- a/drivers/hid/hid-elecom.c ++++ b/drivers/hid/hid-elecom.c +@@ -5,6 +5,7 @@ + * - EX-G Trackballs (M-XT3DRBK, M-XT3URBK, M-XT4DRBK) + * - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK) + * - HUGE Trackballs (M-HT1DRBK, M-HT1URBK) ++ * - HUGE Plus Trackball (M-HT1MRBK) + * + * Copyright (c) 2010 Richard Nauber + * Copyright (c) 2016 Yuxuan Shui +@@ -111,12 +112,25 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc, + */ + mouse_button_fixup(hdev, rdesc, *rsize, 22, 30, 24, 16, 8); + break; ++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK: ++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB: ++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC: ++ /* ++ * Report descriptor format: ++ * 24: button bit count ++ * 28: padding bit count ++ * 22: button report size ++ * 16: button usage maximum ++ */ ++ mouse_button_fixup(hdev, rdesc, *rsize, 24, 28, 22, 16, 8); ++ break; + } + return rdesc; + } + + static const struct hid_device_id elecom_devices[] = { + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, ++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, +@@ -127,6 +141,8 @@ static const struct hid_device_id elecom_devices[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) }, + { } + }; + MODULE_DEVICE_TABLE(hid, elecom_devices); +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index caa2a5a122c7f..37beb969268c3 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -429,6 +429,9 @@ + #define USB_DEVICE_ID_ELECOM_M_HT1URBK 0x010c + #define USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D 0x010d + #define USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C 0x011c ++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK 0x01aa ++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB 0x01ab ++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC 0x01ac + + #define USB_VENDOR_ID_DREAM_CHEEKY 0x1d34 + #define USB_DEVICE_ID_DREAM_CHEEKY_WN 0x0004 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index b4f4f6823c5f6..2a07db02ad932 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -392,6 +392,7 @@ static const struct hid_device_id hid_have_special_driver[] = { + #if IS_ENABLED(CONFIG_HID_ELECOM) + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, ++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) }, +@@ -401,6 +402,8 @@ static const struct hid_device_id hid_have_special_driver[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) }, + #endif + #if IS_ENABLED(CONFIG_HID_ELO) + { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) }, +-- +2.51.0 + diff --git a/queue-5.15/hid-multitouch-add-egalaxtouch-exc3188-support.patch b/queue-5.15/hid-multitouch-add-egalaxtouch-exc3188-support.patch new file mode 100644 index 00000000000..66d43096665 --- /dev/null +++ b/queue-5.15/hid-multitouch-add-egalaxtouch-exc3188-support.patch @@ -0,0 +1,49 @@ +From b14411b305528461f6e0cf3327ba62e79b8ec0a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 09:57:05 +0100 +Subject: HID: multitouch: add eGalaxTouch EXC3188 support + +From: Thorsten Schmelzer + +[ Upstream commit 8e4ac86b2ddd36fe501e20ecfcc080e536df1f48 ] + +Add support for the for the EXC3188 touchscreen from eGalaxy. + +Signed-off-by: Thorsten Schmelzer +Signed-off-by: Michael Tretter +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-multitouch.c | 3 +++ + 2 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 1dc28cabd71d5..caa2a5a122c7f 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -399,6 +399,7 @@ + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7349 0x7349 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7 0x73f7 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001 ++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000 0xc000 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002 0xc002 + + #define USB_VENDOR_ID_EDIFIER 0x2d99 +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 5c40790b977ee..30769b37aabe7 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -2017,6 +2017,9 @@ static const struct hid_device_id mt_devices[] = { + { .driver_data = MT_CLS_EGALAX_SERIAL, + MT_USB_DEVICE(USB_VENDOR_ID_DWAV, + USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) }, ++ { .driver_data = MT_CLS_EGALAX_SERIAL, ++ MT_USB_DEVICE(USB_VENDOR_ID_DWAV, ++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000) }, + { .driver_data = MT_CLS_EGALAX, + MT_USB_DEVICE(USB_VENDOR_ID_DWAV, + USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002) }, +-- +2.51.0 + diff --git a/queue-5.15/hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch b/queue-5.15/hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch new file mode 100644 index 00000000000..06aaed6f5e6 --- /dev/null +++ b/queue-5.15/hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch @@ -0,0 +1,61 @@ +From cb2a3bfb3c9c7442b3b147d28c6c3ab11df3e4bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 08:35:44 +0100 +Subject: hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 1e5271393d777f6159d896943b4c44c4f3ecff52 ] + +The unpacked union within a packed struct generates alignment warnings +on clang for 32-bit ARM: + +./usr/include/linux/hyperv.h:361:2: error: field within 'struct hv_kvp_exchg_msg_value' + is less aligned than 'union hv_kvp_exchg_msg_value::(anonymous at ./usr/include/linux/hyperv.h:361:2)' + and is usually due to 'struct hv_kvp_exchg_msg_value' being packed, + which can lead to unaligned accesses [-Werror,-Wunaligned-access] + 361 | union { + | ^ + +With the recent changes to compile-test the UAPI headers in more cases, +this warning in combination with CONFIG_WERROR breaks the build. + +Fix the warning. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/ +Reported-by: Nathan Chancellor +Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/ +Suggested-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/ +Signed-off-by: Thomas Weißschuh +Acked-by: Wei Liu (Microsoft) +Tested-by: Nicolas Schier +Reviewed-by: Nicolas Schier +Acked-by: Greg Kroah-Hartman +Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-1-076aed1623ff@linutronix.de +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + include/uapi/linux/hyperv.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/hyperv.h b/include/uapi/linux/hyperv.h +index daf82a230c0e7..15f3415415d2c 100644 +--- a/include/uapi/linux/hyperv.h ++++ b/include/uapi/linux/hyperv.h +@@ -351,7 +351,7 @@ struct hv_kvp_exchg_msg_value { + __u8 value[HV_KVP_EXCHANGE_MAX_VALUE_SIZE]; + __u32 value_u32; + __u64 value_u64; +- }; ++ } __attribute__((packed)); + } __attribute__((packed)); + + struct hv_kvp_msg_enumerate { +-- +2.51.0 + diff --git a/queue-5.15/i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch b/queue-5.15/i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch new file mode 100644 index 00000000000..9be943835c0 --- /dev/null +++ b/queue-5.15/i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch @@ -0,0 +1,49 @@ +From 671e862c2611edbc5cd1f89bf9d2cfc1f62f4e39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 15:08:51 -0500 +Subject: i3c: master: svc: Initialize 'dev' to NULL in + svc_i3c_master_ibi_isr() + +From: Frank Li + +[ Upstream commit 3c9ffb4db787428a5851d5865823ab23842d5103 ] + +Initialize the 'dev' pointer to NULL in svc_i3c_master_ibi_isr() and add +a NULL check in the error path. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/r/202512131016.YCKIsDXM-lkp@intel.com/ +Signed-off-by: Frank Li +Link: https://patch.msgid.link/20251215200852.3079073-1-Frank.Li@nxp.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/svc-i3c-master.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c +index d12b4ff2a4495..c1aa01d8b162e 100644 +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -357,8 +357,8 @@ static void svc_i3c_master_ibi_work(struct work_struct *work) + { + struct svc_i3c_master *master = container_of(work, struct svc_i3c_master, ibi_work); + struct svc_i3c_i2c_dev_data *data; ++ struct i3c_dev_desc *dev = NULL; + unsigned int ibitype, ibiaddr; +- struct i3c_dev_desc *dev; + u32 status, val; + int ret; + +@@ -419,7 +419,7 @@ static void svc_i3c_master_ibi_work(struct work_struct *work) + * for the slave to interrupt again. + */ + if (svc_i3c_master_error(master)) { +- if (master->ibi.tbq_slot) { ++ if (master->ibi.tbq_slot && dev) { + data = i3c_dev_get_master_data(dev); + i3c_generic_ibi_recycle_slot(data->ibi_pool, + master->ibi.tbq_slot); +-- +2.51.0 + diff --git a/queue-5.15/iio-magnetometer-remove-irqf_oneshot.patch b/queue-5.15/iio-magnetometer-remove-irqf_oneshot.patch new file mode 100644 index 00000000000..a8d03247dd5 --- /dev/null +++ b/queue-5.15/iio-magnetometer-remove-irqf_oneshot.patch @@ -0,0 +1,49 @@ +From 8ffa52d51dbe75bc0a6eb007f8905c21c510fbd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:38 +0100 +Subject: iio: magnetometer: Remove IRQF_ONESHOT +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sebastian Andrzej Siewior + +[ Upstream commit a54e9440925e6617c98669066b4753c4cdcea8a0 ] + +Passing IRQF_ONESHOT ensures that the interrupt source is masked until +the secondary (threaded) handler is done. If only a primary handler is +used then the flag makes no sense because the interrupt can not fire +(again) while its handler is running. +The flag also disallows force-threading of the primary handler and the +irq-core will warn about this. +The force-threading functionality is required on PREEMPT_RT because the +handler is using locks with can sleep on PREEMPT_RT. + +Remove IRQF_ONESHOT from irqflags. + +Tested-by: Geert Uytterhoeven +Signed-off-by: Sebastian Andrzej Siewior +Reviewed-by: Andy Shevchenko +Reviewed-by: Nuno Sá +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/magnetometer/ak8975.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c +index c12bcee912424..565f64e1cb17a 100644 +--- a/drivers/iio/magnetometer/ak8975.c ++++ b/drivers/iio/magnetometer/ak8975.c +@@ -511,7 +511,7 @@ static int ak8975_setup_irq(struct ak8975_data *data) + irq = gpiod_to_irq(data->eoc_gpiod); + + rc = devm_request_irq(&client->dev, irq, ak8975_irq_handler, +- IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ IRQF_TRIGGER_RISING, + dev_name(&client->dev), data); + if (rc < 0) { + dev_err(&client->dev, "irq %d request failed: %d\n", irq, rc); +-- +2.51.0 + diff --git a/queue-5.15/iio-use-irqf_no_thread.patch b/queue-5.15/iio-use-irqf_no_thread.patch new file mode 100644 index 00000000000..4278e7e016a --- /dev/null +++ b/queue-5.15/iio-use-irqf_no_thread.patch @@ -0,0 +1,90 @@ +From 7e9731b3a86e4bfc8df1ba962a89f6b86d88f325 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:36 +0100 +Subject: iio: Use IRQF_NO_THREAD + +From: Sebastian Andrzej Siewior + +[ Upstream commit 04d390af97f2c28166f7ddfe1a6bda622e3a4766 ] + +The interrupt handler iio_trigger_generic_data_rdy_poll() will invoke +other interrupt handler and this supposed to happen from within the +hardirq. + +Use IRQF_NO_THREAD to forbid forced-threading. + +Signed-off-by: Sebastian Andrzej Siewior +Reviewed-by: Andy Shevchenko +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/accel/bma180.c | 5 +++-- + drivers/iio/adc/ad7766.c | 2 +- + drivers/iio/gyro/itg3200_buffer.c | 8 +++----- + drivers/iio/light/si1145.c | 2 +- + 4 files changed, 8 insertions(+), 9 deletions(-) + +diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c +index 3a1f47c7288ff..ea453087b8ed5 100644 +--- a/drivers/iio/accel/bma180.c ++++ b/drivers/iio/accel/bma180.c +@@ -997,8 +997,9 @@ static int bma180_probe(struct i2c_client *client, + } + + ret = devm_request_irq(dev, client->irq, +- iio_trigger_generic_data_rdy_poll, IRQF_TRIGGER_RISING, +- "bma180_event", data->trig); ++ iio_trigger_generic_data_rdy_poll, ++ IRQF_TRIGGER_RISING | IRQF_NO_THREAD, ++ "bma180_event", data->trig); + if (ret) { + dev_err(dev, "unable to request IRQ\n"); + goto err_trigger_free; +diff --git a/drivers/iio/adc/ad7766.c b/drivers/iio/adc/ad7766.c +index 51ee9482e0df9..cd4283c32349b 100644 +--- a/drivers/iio/adc/ad7766.c ++++ b/drivers/iio/adc/ad7766.c +@@ -262,7 +262,7 @@ static int ad7766_probe(struct spi_device *spi) + * don't enable the interrupt to avoid extra load on the system + */ + ret = devm_request_irq(&spi->dev, spi->irq, ad7766_irq, +- IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN, ++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN | IRQF_NO_THREAD, + dev_name(&spi->dev), + ad7766->trig); + if (ret < 0) +diff --git a/drivers/iio/gyro/itg3200_buffer.c b/drivers/iio/gyro/itg3200_buffer.c +index 4cfa0d4395605..d1c125a77308a 100644 +--- a/drivers/iio/gyro/itg3200_buffer.c ++++ b/drivers/iio/gyro/itg3200_buffer.c +@@ -118,11 +118,9 @@ int itg3200_probe_trigger(struct iio_dev *indio_dev) + if (!st->trig) + return -ENOMEM; + +- ret = request_irq(st->i2c->irq, +- &iio_trigger_generic_data_rdy_poll, +- IRQF_TRIGGER_RISING, +- "itg3200_data_rdy", +- st->trig); ++ ret = request_irq(st->i2c->irq, &iio_trigger_generic_data_rdy_poll, ++ IRQF_TRIGGER_RISING | IRQF_NO_THREAD, ++ "itg3200_data_rdy", st->trig); + if (ret) + goto error_free_trig; + +diff --git a/drivers/iio/light/si1145.c b/drivers/iio/light/si1145.c +index e8f6cdf26f22a..50b424b4f23b9 100644 +--- a/drivers/iio/light/si1145.c ++++ b/drivers/iio/light/si1145.c +@@ -1251,7 +1251,7 @@ static int si1145_probe_trigger(struct iio_dev *indio_dev) + + ret = devm_request_irq(&client->dev, client->irq, + iio_trigger_generic_data_rdy_poll, +- IRQF_TRIGGER_FALLING, ++ IRQF_TRIGGER_FALLING | IRQF_NO_THREAD, + "si1145_irq", + trig); + if (ret < 0) { +-- +2.51.0 + diff --git a/queue-5.15/include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch b/queue-5.15/include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch new file mode 100644 index 00000000000..fc97aa07272 --- /dev/null +++ b/queue-5.15/include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch @@ -0,0 +1,42 @@ +From 44403dbb8229d0944572bf1fd08b12412de9f493 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Feb 2026 15:54:06 +0100 +Subject: include: uapi: netfilter_bridge.h: Cover for musl libc + +From: Phil Sutter + +[ Upstream commit 4edd4ba71ce0df015303dba75ea9d20d1a217546 ] + +Musl defines its own struct ethhdr and thus defines __UAPI_DEF_ETHHDR to +zero. To avoid struct redefinition errors, user space is therefore +supposed to include netinet/if_ether.h before (or instead of) +linux/if_ether.h. To relieve them from this burden, include the libc +header here if not building for kernel space. + +Reported-by: Alyssa Ross +Suggested-by: Florian Westphal +Signed-off-by: Phil Sutter +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + include/uapi/linux/netfilter_bridge.h | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/include/uapi/linux/netfilter_bridge.h b/include/uapi/linux/netfilter_bridge.h +index 1610fdbab98df..ad520d3e9df8f 100644 +--- a/include/uapi/linux/netfilter_bridge.h ++++ b/include/uapi/linux/netfilter_bridge.h +@@ -5,6 +5,10 @@ + /* bridge-specific defines for netfilter. + */ + ++#ifndef __KERNEL__ ++#include /* for __UAPI_DEF_ETHHDR if defined */ ++#endif ++ + #include + #include + #include +-- +2.51.0 + diff --git a/queue-5.15/iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch b/queue-5.15/iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch new file mode 100644 index 00000000000..d9d907a67a6 --- /dev/null +++ b/queue-5.15/iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch @@ -0,0 +1,134 @@ +From 4a20d909eec4cf919ccdc28132d2f544db282a1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 13:28:57 -0800 +Subject: iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency + +From: Alexander Grest + +[ Upstream commit df180b1a4cc51011c5f8c52c7ec02ad2e42962de ] + +The SMMU CMDQ lock is highly contentious when there are multiple CPUs +issuing commands and the queue is nearly full. + +The lock has the following states: + - 0: Unlocked + - >0: Shared lock held with count + - INT_MIN+N: Exclusive lock held, where N is the # of shared waiters + - INT_MIN: Exclusive lock held, no shared waiters + +When multiple CPUs are polling for space in the queue, they attempt to +grab the exclusive lock to update the cons pointer from the hardware. If +they fail to get the lock, they will spin until either the cons pointer +is updated by another CPU. + +The current code allows the possibility of shared lock starvation +if there is a constant stream of CPUs trying to grab the exclusive lock. +This leads to severe latency issues and soft lockups. + +Consider the following scenario where CPU1's attempt to acquire the +shared lock is starved by CPU2 and CPU0 contending for the exclusive +lock. + +CPU0 (exclusive) | CPU1 (shared) | CPU2 (exclusive) | `cmdq->lock` +-------------------------------------------------------------------------- +trylock() //takes | | | 0 + | shared_lock() | | INT_MIN + | fetch_inc() | | INT_MIN + | no return | | INT_MIN + 1 + | spins // VAL >= 0 | | INT_MIN + 1 +unlock() | spins... | | INT_MIN + 1 +set_release(0) | spins... | | 0 see[NOTE] +(done) | (sees 0) | trylock() // takes | 0 + | *exits loop* | cmpxchg(0, INT_MIN) | 0 + | | *cuts in* | INT_MIN + | cmpxchg(0, 1) | | INT_MIN + | fails // != 0 | | INT_MIN + | spins // VAL >= 0 | | INT_MIN + | *starved* | | INT_MIN + +[NOTE] The current code resets the exclusive lock to 0 regardless of the +state of the lock. This causes two problems: +1. It opens the possibility of back-to-back exclusive locks and the + downstream effect of starving shared lock. +2. The count of shared lock waiters are lost. + +To mitigate this, we release the exclusive lock by only clearing the sign +bit while retaining the shared lock waiter count as a way to avoid +starving the shared lock waiters. + +Also deleted cmpxchg loop while trying to acquire the shared lock as it +is not needed. The waiters can see the positive lock count and proceed +immediately after the exclusive lock is released. + +Exclusive lock is not starved in that submitters will try exclusive lock +first when new spaces become available. + +Reviewed-by: Mostafa Saleh +Reviewed-by: Nicolin Chen +Signed-off-by: Alexander Grest +Signed-off-by: Jacob Pan +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 31 ++++++++++++++------- + 1 file changed, 21 insertions(+), 10 deletions(-) + +diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +index bc65e7b4f0045..b12e23800844a 100644 +--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c ++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +@@ -448,20 +448,26 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu) + */ + static void arm_smmu_cmdq_shared_lock(struct arm_smmu_cmdq *cmdq) + { +- int val; +- + /* +- * We can try to avoid the cmpxchg() loop by simply incrementing the +- * lock counter. When held in exclusive state, the lock counter is set +- * to INT_MIN so these increments won't hurt as the value will remain +- * negative. ++ * When held in exclusive state, the lock counter is set to INT_MIN ++ * so these increments won't hurt as the value will remain negative. ++ * The increment will also signal the exclusive locker that there are ++ * shared waiters. + */ + if (atomic_fetch_inc_relaxed(&cmdq->lock) >= 0) + return; + +- do { +- val = atomic_cond_read_relaxed(&cmdq->lock, VAL >= 0); +- } while (atomic_cmpxchg_relaxed(&cmdq->lock, val, val + 1) != val); ++ /* ++ * Someone else is holding the lock in exclusive state, so wait ++ * for them to finish. Since we already incremented the lock counter, ++ * no exclusive lock can be acquired until we finish. We don't need ++ * the return value since we only care that the exclusive lock is ++ * released (i.e. the lock counter is non-negative). ++ * Once the exclusive locker releases the lock, the sign bit will ++ * be cleared and our increment will make the lock counter positive, ++ * allowing us to proceed. ++ */ ++ atomic_cond_read_relaxed(&cmdq->lock, VAL > 0); + } + + static void arm_smmu_cmdq_shared_unlock(struct arm_smmu_cmdq *cmdq) +@@ -488,9 +494,14 @@ static bool arm_smmu_cmdq_shared_tryunlock(struct arm_smmu_cmdq *cmdq) + __ret; \ + }) + ++/* ++ * Only clear the sign bit when releasing the exclusive lock this will ++ * allow any shared_lock() waiters to proceed without the possibility ++ * of entering the exclusive lock in a tight loop. ++ */ + #define arm_smmu_cmdq_exclusive_unlock_irqrestore(cmdq, flags) \ + ({ \ +- atomic_set_release(&cmdq->lock, 0); \ ++ atomic_fetch_andnot_release(INT_MIN, &cmdq->lock); \ + local_irq_restore(flags); \ + }) + +-- +2.51.0 + diff --git a/queue-5.15/ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch b/queue-5.15/ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch new file mode 100644 index 00000000000..ae9994a85fc --- /dev/null +++ b/queue-5.15/ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch @@ -0,0 +1,123 @@ +From f3cba7ba2f7119e4634cd4cb5ec6f32bc96fcc4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 04:35:24 +0000 +Subject: ipv4: fib: Annotate access to struct fib_alias.fa_state. + +From: Kuniyuki Iwashima + +[ Upstream commit 6e84fc395e90465f1418f582a9f7d53c87ab010e ] + +syzbot reported that struct fib_alias.fa_state can be +modified locklessly by RCU readers. [0] + +Let's use READ_ONCE()/WRITE_ONCE() properly. + +[0]: +BUG: KCSAN: data-race in fib_table_lookup / fib_table_lookup + +write to 0xffff88811b06a7fa of 1 bytes by task 4167 on cpu 0: + fib_alias_accessed net/ipv4/fib_lookup.h:32 [inline] + fib_table_lookup+0x361/0xd60 net/ipv4/fib_trie.c:1565 + fib_lookup include/net/ip_fib.h:390 [inline] + ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814 + ip_route_output_key_hash net/ipv4/route.c:2705 [inline] + __ip_route_output_key include/net/route.h:169 [inline] + ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932 + udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450 + inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859 + sock_sendmsg_nosec net/socket.c:727 [inline] + __sock_sendmsg net/socket.c:742 [inline] + ____sys_sendmsg+0x53a/0x600 net/socket.c:2592 + ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646 + __sys_sendmmsg+0x185/0x320 net/socket.c:2735 + __do_sys_sendmmsg net/socket.c:2762 [inline] + __se_sys_sendmmsg net/socket.c:2759 [inline] + __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759 + x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +read to 0xffff88811b06a7fa of 1 bytes by task 4168 on cpu 1: + fib_alias_accessed net/ipv4/fib_lookup.h:31 [inline] + fib_table_lookup+0x338/0xd60 net/ipv4/fib_trie.c:1565 + fib_lookup include/net/ip_fib.h:390 [inline] + ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814 + ip_route_output_key_hash net/ipv4/route.c:2705 [inline] + __ip_route_output_key include/net/route.h:169 [inline] + ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932 + udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450 + inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859 + sock_sendmsg_nosec net/socket.c:727 [inline] + __sock_sendmsg net/socket.c:742 [inline] + ____sys_sendmsg+0x53a/0x600 net/socket.c:2592 + ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646 + __sys_sendmmsg+0x185/0x320 net/socket.c:2735 + __do_sys_sendmmsg net/socket.c:2762 [inline] + __se_sys_sendmmsg net/socket.c:2759 [inline] + __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759 + x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +value changed: 0x00 -> 0x01 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 1 UID: 0 PID: 4168 Comm: syz.4.206 Not tainted syzkaller #0 PREEMPT(voluntary) +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 + +Reported-by: syzbot+d24f940f770afda885cf@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/69783ead.050a0220.c9109.0013.GAE@google.com/ +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260127043528.514160-1-kuniyu@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/fib_lookup.h | 6 ++++-- + net/ipv4/fib_trie.c | 4 ++-- + 2 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h +index 78e40ea42e58d..82e77516ca8d2 100644 +--- a/net/ipv4/fib_lookup.h ++++ b/net/ipv4/fib_lookup.h +@@ -27,8 +27,10 @@ struct fib_alias { + /* Don't write on fa_state unless needed, to keep it shared on all cpus */ + static inline void fib_alias_accessed(struct fib_alias *fa) + { +- if (!(fa->fa_state & FA_S_ACCESSED)) +- fa->fa_state |= FA_S_ACCESSED; ++ u8 fa_state = READ_ONCE(fa->fa_state); ++ ++ if (!(fa_state & FA_S_ACCESSED)) ++ WRITE_ONCE(fa->fa_state, fa_state | FA_S_ACCESSED); + } + + /* Exported by fib_semantics.c */ +diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c +index 2cec18cb5c488..3f43851f87e39 100644 +--- a/net/ipv4/fib_trie.c ++++ b/net/ipv4/fib_trie.c +@@ -1279,7 +1279,7 @@ int fib_table_insert(struct net *net, struct fib_table *tb, + new_fa->fa_tos = fa->fa_tos; + new_fa->fa_info = fi; + new_fa->fa_type = cfg->fc_type; +- state = fa->fa_state; ++ state = READ_ONCE(fa->fa_state); + new_fa->fa_state = state & ~FA_S_ACCESSED; + new_fa->fa_slen = fa->fa_slen; + new_fa->tb_id = tb->tb_id; +@@ -1741,7 +1741,7 @@ int fib_table_delete(struct net *net, struct fib_table *tb, + + fib_remove_alias(t, tp, l, fa_to_delete); + +- if (fa_to_delete->fa_state & FA_S_ACCESSED) ++ if (READ_ONCE(fa_to_delete->fa_state) & FA_S_ACCESSED) + rt_cache_flush(cfg->fc_nlinfo.nl_net); + + fib_release_info(fa_to_delete->fa_info); +-- +2.51.0 + diff --git a/queue-5.15/ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch b/queue-5.15/ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch new file mode 100644 index 00000000000..99e9b69383b --- /dev/null +++ b/queue-5.15/ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch @@ -0,0 +1,41 @@ +From 4649d69f120a12d16dc70f16b4b7804a55ad1e0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 09:41:37 +0000 +Subject: ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() + +From: Eric Dumazet + +[ Upstream commit 03e9d91dd64e2f5ea632df5d59568d91757efc4d ] + +Add missing READ_ONCE() when reading sysctl values. + +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260115094141.3124990-5-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/ipv6.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/net/ipv6.h b/include/net/ipv6.h +index dcae37154d3c2..0a1c9366cc81e 100644 +--- a/include/net/ipv6.h ++++ b/include/net/ipv6.h +@@ -923,11 +923,11 @@ static inline int ip6_default_np_autolabel(struct net *net) + #if IS_ENABLED(CONFIG_IPV6) + static inline int ip6_multipath_hash_policy(const struct net *net) + { +- return net->ipv6.sysctl.multipath_hash_policy; ++ return READ_ONCE(net->ipv6.sysctl.multipath_hash_policy); + } + static inline u32 ip6_multipath_hash_fields(const struct net *net) + { +- return net->ipv6.sysctl.multipath_hash_fields; ++ return READ_ONCE(net->ipv6.sysctl.multipath_hash_fields); + } + #else + static inline int ip6_multipath_hash_policy(const struct net *net) +-- +2.51.0 + diff --git a/queue-5.15/ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch b/queue-5.15/ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch new file mode 100644 index 00000000000..bb33b2f2196 --- /dev/null +++ b/queue-5.15/ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch @@ -0,0 +1,66 @@ +From c40c0b5ee2f0fbc35be0778a6ee4591523ab441d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 09:41:40 +0000 +Subject: ipv6: exthdrs: annotate data-race over multiple sysctl + +From: Eric Dumazet + +[ Upstream commit 978b67d28358b0b4eacfa94453d1ad4e09b123ad ] + +Following four sysctls can change under us, add missing READ_ONCE(). + +- ipv6.sysctl.max_dst_opts_len +- ipv6.sysctl.max_dst_opts_cnt +- ipv6.sysctl.max_hbh_opts_len +- ipv6.sysctl.max_hbh_opts_cnt + +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260115094141.3124990-8-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/exthdrs.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c +index d273f6fe19c20..7907056db1008 100644 +--- a/net/ipv6/exthdrs.c ++++ b/net/ipv6/exthdrs.c +@@ -308,7 +308,7 @@ static int ipv6_destopt_rcv(struct sk_buff *skb) + } + + extlen = (skb_transport_header(skb)[1] + 1) << 3; +- if (extlen > net->ipv6.sysctl.max_dst_opts_len) ++ if (extlen > READ_ONCE(net->ipv6.sysctl.max_dst_opts_len)) + goto fail_and_free; + + opt->lastopt = opt->dst1 = skb_network_header_len(skb); +@@ -316,7 +316,8 @@ static int ipv6_destopt_rcv(struct sk_buff *skb) + dstbuf = opt->dst1; + #endif + +- if (ip6_parse_tlv(false, skb, net->ipv6.sysctl.max_dst_opts_cnt)) { ++ if (ip6_parse_tlv(false, skb, ++ READ_ONCE(net->ipv6.sysctl.max_dst_opts_cnt))) { + skb->transport_header += extlen; + opt = IP6CB(skb); + #if IS_ENABLED(CONFIG_IPV6_MIP6) +@@ -1073,11 +1074,12 @@ int ipv6_parse_hopopts(struct sk_buff *skb) + } + + extlen = (skb_transport_header(skb)[1] + 1) << 3; +- if (extlen > net->ipv6.sysctl.max_hbh_opts_len) ++ if (extlen > READ_ONCE(net->ipv6.sysctl.max_hbh_opts_len)) + goto fail_and_free; + + opt->flags |= IP6SKB_HOPBYHOP; +- if (ip6_parse_tlv(true, skb, net->ipv6.sysctl.max_hbh_opts_cnt)) { ++ if (ip6_parse_tlv(true, skb, ++ READ_ONCE(net->ipv6.sysctl.max_hbh_opts_cnt))) { + skb->transport_header += extlen; + opt = IP6CB(skb); + opt->nhoff = sizeof(struct ipv6hdr); +-- +2.51.0 + diff --git a/queue-5.15/jfs-add-missing-set_freezable-for-freezable-kthread.patch b/queue-5.15/jfs-add-missing-set_freezable-for-freezable-kthread.patch new file mode 100644 index 00000000000..aa24fcc2b24 --- /dev/null +++ b/queue-5.15/jfs-add-missing-set_freezable-for-freezable-kthread.patch @@ -0,0 +1,37 @@ +From bac45156db39836a2e3576d9b204891867ddb86a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 19:38:01 +0800 +Subject: jfs: Add missing set_freezable() for freezable kthread + +From: Haotian Zhang + +[ Upstream commit eb0cfcf265714b419cc3549895a00632e76732ae ] + +The jfsIOWait() thread calls try_to_freeze() but lacks set_freezable(), +causing it to remain non-freezable by default. This prevents proper +freezing during system suspend. + +Add set_freezable() to make the thread freezable as intended. + +Signed-off-by: Haotian Zhang +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_logmgr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c +index 78fd136ac13b9..d02bca48bc7b0 100644 +--- a/fs/jfs/jfs_logmgr.c ++++ b/fs/jfs/jfs_logmgr.c +@@ -2322,6 +2322,7 @@ int jfsIOWait(void *arg) + { + struct lbuf *bp; + ++ set_freezable(); + do { + spin_lock_irq(&log_redrive_lock); + while ((bp = log_redrive_list)) { +-- +2.51.0 + diff --git a/queue-5.15/jfs-nlink-overflow-in-jfs_rename.patch b/queue-5.15/jfs-nlink-overflow-in-jfs_rename.patch new file mode 100644 index 00000000000..e21a1f7f147 --- /dev/null +++ b/queue-5.15/jfs-nlink-overflow-in-jfs_rename.patch @@ -0,0 +1,54 @@ +From 244a6992d2effa4fd236de8cf1d39e4d43257e69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Oct 2025 13:22:12 +0100 +Subject: jfs: nlink overflow in jfs_rename + +From: Jori Koolstra + +[ Upstream commit 9218dc26fd922b09858ecd3666ed57dfd8098da8 ] + +If nlink is maximal for a directory (-1) and inside that directory you +perform a rename for some child directory (not moving from the parent), +then the nlink of the first directory is first incremented and later +decremented. Normally this is fine, but when nlink = -1 this causes a +wrap around to 0, and then drop_nlink issues a warning. + +After applying the patch syzbot no longer issues any warnings. I also +ran some basic fs tests to look for any regressions. + +Signed-off-by: Jori Koolstra +Reported-by: syzbot+9131ddfd7870623b719f@syzkaller.appspotmail.com +Closes: https://syzbot.org/bug?extid=9131ddfd7870623b719f +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/namei.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c +index b3a0fe0649c49..df6bde0206bb4 100644 +--- a/fs/jfs/namei.c ++++ b/fs/jfs/namei.c +@@ -1227,7 +1227,7 @@ static int jfs_rename(struct user_namespace *mnt_userns, struct inode *old_dir, + jfs_err("jfs_rename: dtInsert returned -EIO"); + goto out_tx; + } +- if (S_ISDIR(old_ip->i_mode)) ++ if (S_ISDIR(old_ip->i_mode) && old_dir != new_dir) + inc_nlink(new_dir); + } + /* +@@ -1243,7 +1243,9 @@ static int jfs_rename(struct user_namespace *mnt_userns, struct inode *old_dir, + goto out_tx; + } + if (S_ISDIR(old_ip->i_mode)) { +- drop_nlink(old_dir); ++ if (new_ip || old_dir != new_dir) ++ drop_nlink(old_dir); ++ + if (old_dir != new_dir) { + /* + * Change inode number of parent for moved directory +-- +2.51.0 + diff --git a/queue-5.15/libceph-define-and-enforce-ceph_max_key_len.patch b/queue-5.15/libceph-define-and-enforce-ceph_max_key_len.patch new file mode 100644 index 00000000000..612a31f78a6 --- /dev/null +++ b/queue-5.15/libceph-define-and-enforce-ceph_max_key_len.patch @@ -0,0 +1,82 @@ +From b5ad91fca4a15feac4dc5eab0b3e794a6cc365c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jul 2025 16:30:50 +0200 +Subject: libceph: define and enforce CEPH_MAX_KEY_LEN + +From: Ilya Dryomov + +[ Upstream commit ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf ] + +When decoding the key, verify that the key material would fit into +a fixed-size buffer in process_auth_done() and generally has a sane +length. + +The new CEPH_MAX_KEY_LEN check replaces the existing check for a key +with no key material which is a) not universal since CEPH_CRYPTO_NONE +has to be excluded and b) doesn't provide much value since a smaller +than needed key is just as invalid as no key -- this has to be handled +elsewhere anyway. + +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + net/ceph/crypto.c | 8 +++++--- + net/ceph/crypto.h | 2 +- + net/ceph/messenger_v2.c | 2 +- + 3 files changed, 7 insertions(+), 5 deletions(-) + +diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c +index 92d89b3316459..4c6cc4e855d36 100644 +--- a/net/ceph/crypto.c ++++ b/net/ceph/crypto.c +@@ -37,9 +37,6 @@ static int set_secret(struct ceph_crypto_key *key, void *buf) + return -ENOTSUPP; + } + +- if (!key->len) +- return -EINVAL; +- + key->key = kmemdup(buf, key->len, GFP_NOIO); + if (!key->key) { + ret = -ENOMEM; +@@ -95,6 +92,11 @@ int ceph_crypto_key_decode(struct ceph_crypto_key *key, void **p, void *end) + ceph_decode_copy(p, &key->created, sizeof(key->created)); + key->len = ceph_decode_16(p); + ceph_decode_need(p, end, key->len, bad); ++ if (key->len > CEPH_MAX_KEY_LEN) { ++ pr_err("secret too big %d\n", key->len); ++ return -EINVAL; ++ } ++ + ret = set_secret(key, *p); + memzero_explicit(*p, key->len); + *p += key->len; +diff --git a/net/ceph/crypto.h b/net/ceph/crypto.h +index 13bd526349fa1..0d32f1649f3d0 100644 +--- a/net/ceph/crypto.h ++++ b/net/ceph/crypto.h +@@ -5,7 +5,7 @@ + #include + #include + +-#define CEPH_KEY_LEN 16 ++#define CEPH_MAX_KEY_LEN 16 + #define CEPH_MAX_CON_SECRET_LEN 64 + + /* +diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c +index d7c61058fa0f8..a35ff372d4230 100644 +--- a/net/ceph/messenger_v2.c ++++ b/net/ceph/messenger_v2.c +@@ -2052,7 +2052,7 @@ static int process_auth_reply_more(struct ceph_connection *con, + */ + static int process_auth_done(struct ceph_connection *con, void *p, void *end) + { +- u8 session_key_buf[CEPH_KEY_LEN + 16]; ++ u8 session_key_buf[CEPH_MAX_KEY_LEN + 16]; + u8 con_secret_buf[CEPH_MAX_CON_SECRET_LEN + 16]; + u8 *session_key = PTR_ALIGN(&session_key_buf[0], 16); + u8 *con_secret = PTR_ALIGN(&con_secret_buf[0], 16); +-- +2.51.0 + diff --git a/queue-5.15/libperf-build-always-place-libperf-includes-first.patch b/queue-5.15/libperf-build-always-place-libperf-includes-first.patch new file mode 100644 index 00000000000..87e1f6fb84d --- /dev/null +++ b/queue-5.15/libperf-build-always-place-libperf-includes-first.patch @@ -0,0 +1,56 @@ +From f7fc393c70a3b18d7417481b78082c2c5937b7aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 22:09:18 -0800 +Subject: libperf build: Always place libperf includes first + +From: Ian Rogers + +[ Upstream commit 8c5b40678c63be6b85f1c2dc8c8b89d632faf988 ] + +When building tools/perf the CFLAGS can contain a directory for the +installed headers. + +As the headers may be being installed while building libperf.a this can +cause headers to be partially installed and found in the include path +while building an object file for libperf.a. + +The installed header may reference other installed headers that are +missing given the partial nature of the install and then the build fails +with a missing header file. + +Avoid this by ensuring the libperf source headers are always first in +the CFLAGS. + +Fixes: 3143504918105156 ("libperf: Make libperf.a part of the perf build") +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/perf/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/perf/Makefile b/tools/lib/perf/Makefile +index 143d566cc6a56..c8d5a434c2ab9 100644 +--- a/tools/lib/perf/Makefile ++++ b/tools/lib/perf/Makefile +@@ -63,9 +63,9 @@ INCLUDES = \ + -I$(srctree)/tools/include/uapi + + # Append required CFLAGS ++override CFLAGS := $(INCLUDES) $(CFLAGS) + override CFLAGS += -g -Werror -Wall + override CFLAGS += -fPIC +-override CFLAGS += $(INCLUDES) + override CFLAGS += -fvisibility=hidden + override CFLAGS += $(EXTRA_WARNINGS) + override CFLAGS += $(EXTRA_CFLAGS) +-- +2.51.0 + diff --git a/queue-5.15/libperf-don-t-remove-g-when-extra_cflags-are-used.patch b/queue-5.15/libperf-don-t-remove-g-when-extra_cflags-are-used.patch new file mode 100644 index 00000000000..fac0e56fa53 --- /dev/null +++ b/queue-5.15/libperf-don-t-remove-g-when-extra_cflags-are-used.patch @@ -0,0 +1,66 @@ +From 721a16abbfad5b2c7f34d507044782448605bdfa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Mar 2025 11:40:09 +0000 +Subject: libperf: Don't remove -g when EXTRA_CFLAGS are used + +From: James Clark + +[ Upstream commit f5b07010c13c77541e8ade167d05bef3b8a63739 ] + +When using EXTRA_CFLAGS, for example "EXTRA_CFLAGS=-DREFCNT_CHECKING=1", +this construct stops setting -g which you'd expect would not be affected +by adding extra flags. Additionally, EXTRA_CFLAGS should be the last +thing to be appended so that it can be used to undo any defaults. And no +condition is required, just += appends to any existing CFLAGS and also +appends or doesn't append EXTRA_CFLAGS if they are or aren't set. + +It's not clear why DEBUG=1 is required for -g in Perf when in libperf +it's always on, but I don't think we need to change that behavior now +because someone may be depending on it. + +Signed-off-by: James Clark +Reviewed-by: Ian Rogers +Link: https://lore.kernel.org/r/20250319114009.417865-1-james.clark@linaro.org +Signed-off-by: Namhyung Kim +Stable-dep-of: 8c5b40678c63 ("libperf build: Always place libperf includes first") +Signed-off-by: Sasha Levin +--- + tools/lib/perf/Makefile | 12 +++--------- + 1 file changed, 3 insertions(+), 9 deletions(-) + +diff --git a/tools/lib/perf/Makefile b/tools/lib/perf/Makefile +index 08fe6e3c4089f..143d566cc6a56 100644 +--- a/tools/lib/perf/Makefile ++++ b/tools/lib/perf/Makefile +@@ -54,13 +54,6 @@ endif + + TEST_ARGS := $(if $(V),-v) + +-# Set compile option CFLAGS +-ifdef EXTRA_CFLAGS +- CFLAGS := $(EXTRA_CFLAGS) +-else +- CFLAGS := -g -Wall +-endif +- + INCLUDES = \ + -I$(srctree)/tools/lib/perf/include \ + -I$(srctree)/tools/lib/ \ +@@ -70,11 +63,12 @@ INCLUDES = \ + -I$(srctree)/tools/include/uapi + + # Append required CFLAGS +-override CFLAGS += $(EXTRA_WARNINGS) +-override CFLAGS += -Werror -Wall ++override CFLAGS += -g -Werror -Wall + override CFLAGS += -fPIC + override CFLAGS += $(INCLUDES) + override CFLAGS += -fvisibility=hidden ++override CFLAGS += $(EXTRA_WARNINGS) ++override CFLAGS += $(EXTRA_CFLAGS) + + all: + +-- +2.51.0 + diff --git a/queue-5.15/m68k-nommu-fix-memmove-with-differently-aligned-src-.patch b/queue-5.15/m68k-nommu-fix-memmove-with-differently-aligned-src-.patch new file mode 100644 index 00000000000..09496049f88 --- /dev/null +++ b/queue-5.15/m68k-nommu-fix-memmove-with-differently-aligned-src-.patch @@ -0,0 +1,69 @@ +From 0d2168ae1fa20174c864c0030cb30993aaa810d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Dec 2025 21:04:01 +0900 +Subject: m68k: nommu: fix memmove() with differently aligned src and dest for + 68000 + +From: Daniel Palmer + +[ Upstream commit 590fe2f46c8698bb758f9002cb247ca10ce95569 ] + +68000 has different alignment needs to 68020+. +memcpy() checks if the destination is aligned and does a smaller copy +to fix the alignment and then critically for 68000 it checks if the +source is still unaligned and if it is reverts to smaller copies. + +memmove() does not currently do the second part and malfunctions if +one of the pointers is aligned and the other isn't. + +This is apparently getting triggered by printk. If I put breakpoints +into the new checks added by this commit the first hit looks like this: + +memmove (n=205, src=0x2f3971 , dest=0x2f3980 ) at arch/m68k/lib/memmove.c:82 + +Signed-off-by: Daniel Palmer +Signed-off-by: Greg Ungerer +Signed-off-by: Sasha Levin +--- + arch/m68k/lib/memmove.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/arch/m68k/lib/memmove.c b/arch/m68k/lib/memmove.c +index 6519f7f349f66..e33f00b02e4c0 100644 +--- a/arch/m68k/lib/memmove.c ++++ b/arch/m68k/lib/memmove.c +@@ -24,6 +24,15 @@ void *memmove(void *dest, const void *src, size_t n) + src = csrc; + n--; + } ++#if defined(CONFIG_M68000) ++ if ((long)src & 1) { ++ char *cdest = dest; ++ const char *csrc = src; ++ for (; n; n--) ++ *cdest++ = *csrc++; ++ return xdest; ++ } ++#endif + if (n > 2 && (long)dest & 2) { + short *sdest = dest; + const short *ssrc = src; +@@ -66,6 +75,15 @@ void *memmove(void *dest, const void *src, size_t n) + src = csrc; + n--; + } ++#if defined(CONFIG_M68000) ++ if ((long)src & 1) { ++ char *cdest = dest; ++ const char *csrc = src; ++ for (; n; n--) ++ *--cdest = *--csrc; ++ return xdest; ++ } ++#endif + if (n > 2 && (long)dest & 2) { + short *sdest = dest; + const short *ssrc = src; +-- +2.51.0 + diff --git a/queue-5.15/mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch b/queue-5.15/mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch new file mode 100644 index 00000000000..2e0ad05ad82 --- /dev/null +++ b/queue-5.15/mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch @@ -0,0 +1,66 @@ +From 3bf18c2d7af21a902718a1489326c94e642396fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:24 +0100 +Subject: mailbox: bcm-ferxrm-mailbox: Use default primary handler + +From: Sebastian Andrzej Siewior + +[ Upstream commit 03843d95a4a4e0ba22ad4fcda65ccf21822b104c ] + +request_threaded_irq() is invoked with a primary and a secondary handler +and no flags are passed. The primary handler is the same as +irq_default_primary_handler() so there is no need to have an identical +copy. + +The lack of the IRQF_ONESHOT flag can be dangerous because the interrupt +source is not masked while the threaded handler is active. This means, +especially on LEVEL typed interrupt lines, the interrupt can fire again +before the threaded handler had a chance to run. + +Use the default primary interrupt handler by specifying NULL and set +IRQF_ONESHOT so the interrupt source is masked until the secondary handler +is done. + +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Thomas Gleixner +Link: https://patch.msgid.link/20260128095540.863589-5-bigeasy@linutronix.de +Signed-off-by: Sasha Levin +--- + drivers/mailbox/bcm-flexrm-mailbox.c | 14 ++------------ + 1 file changed, 2 insertions(+), 12 deletions(-) + +diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c +index b7e9fd53d47db..08870ed12a271 100644 +--- a/drivers/mailbox/bcm-flexrm-mailbox.c ++++ b/drivers/mailbox/bcm-flexrm-mailbox.c +@@ -1183,14 +1183,6 @@ static int flexrm_debugfs_stats_show(struct seq_file *file, void *offset) + + /* ====== FlexRM interrupt handler ===== */ + +-static irqreturn_t flexrm_irq_event(int irq, void *dev_id) +-{ +- /* We only have MSI for completions so just wakeup IRQ thread */ +- /* Ring related errors will be informed via completion descriptors */ +- +- return IRQ_WAKE_THREAD; +-} +- + static irqreturn_t flexrm_irq_thread(int irq, void *dev_id) + { + flexrm_process_completions(dev_id); +@@ -1281,10 +1273,8 @@ static int flexrm_startup(struct mbox_chan *chan) + ret = -ENODEV; + goto fail_free_cmpl_memory; + } +- ret = request_threaded_irq(ring->irq, +- flexrm_irq_event, +- flexrm_irq_thread, +- 0, dev_name(ring->mbox->dev), ring); ++ ret = request_threaded_irq(ring->irq, NULL, flexrm_irq_thread, ++ IRQF_ONESHOT, dev_name(ring->mbox->dev), ring); + if (ret) { + dev_err(ring->mbox->dev, + "failed to request ring%d IRQ\n", ring->num); +-- +2.51.0 + diff --git a/queue-5.15/mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch b/queue-5.15/mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch new file mode 100644 index 00000000000..03b5bf081db --- /dev/null +++ b/queue-5.15/mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch @@ -0,0 +1,57 @@ +From 4176b8150cf44ab0185ea7830d6fb2f4fe359d0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 16:43:36 +0100 +Subject: mailbox: sprd: clear delivery flag before handling TX done +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Otto Pflüger + +[ Upstream commit c77661d60d4223bf2ff10d409beb0c3b2021183b ] + +If there are any pending messages in the mailbox queue, they are sent +as soon as a TX done event arrives from the driver. This may trigger a +new delivery interrupt while the previous one is still being handled. +If the delivery status is cleared after this, the interrupt is lost. +To prevent this from happening, clear the delivery status immediately +after checking it and before any new messages are sent. + +Signed-off-by: Otto Pflüger +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/sprd-mailbox.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c +index 0dc609592c46a..2a43fb375bcb9 100644 +--- a/drivers/mailbox/sprd-mailbox.c ++++ b/drivers/mailbox/sprd-mailbox.c +@@ -167,6 +167,11 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data) + return IRQ_NONE; + } + ++ /* Clear FIFO delivery and overflow status first */ ++ writel(fifo_sts & ++ (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK), ++ priv->inbox_base + SPRD_MBOX_FIFO_RST); ++ + while (send_sts) { + id = __ffs(send_sts); + send_sts &= (send_sts - 1); +@@ -182,11 +187,6 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data) + mbox_chan_txdone(chan, 0); + } + +- /* Clear FIFO delivery and overflow status */ +- writel(fifo_sts & +- (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK), +- priv->inbox_base + SPRD_MBOX_FIFO_RST); +- + /* Clear irq status */ + writel(SPRD_MBOX_IRQ_CLR, priv->inbox_base + SPRD_MBOX_IRQ_STS); + +-- +2.51.0 + diff --git a/queue-5.15/mailbox-sprd-mask-interrupts-that-are-not-handled.patch b/queue-5.15/mailbox-sprd-mask-interrupts-that-are-not-handled.patch new file mode 100644 index 00000000000..5f81129d79a --- /dev/null +++ b/queue-5.15/mailbox-sprd-mask-interrupts-that-are-not-handled.patch @@ -0,0 +1,55 @@ +From 39ac475ad8926a46de37bc97f1c241d95bd4c982 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 16:43:38 +0100 +Subject: mailbox: sprd: mask interrupts that are not handled +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Otto Pflüger + +[ Upstream commit 75df94d05fc03fd9d861eaf79ce10fbb7a548bd8 ] + +To reduce the amount of spurious interrupts, disable the interrupts that +are not handled in this driver. + +Signed-off-by: Otto Pflüger +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/sprd-mailbox.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c +index e3c899abeed8b..0dc609592c46a 100644 +--- a/drivers/mailbox/sprd-mailbox.c ++++ b/drivers/mailbox/sprd-mailbox.c +@@ -244,21 +244,19 @@ static int sprd_mbox_startup(struct mbox_chan *chan) + /* Select outbox FIFO mode and reset the outbox FIFO status */ + writel(0x0, priv->outbox_base + SPRD_MBOX_FIFO_RST); + +- /* Enable inbox FIFO overflow and delivery interrupt */ +- val = readl(priv->inbox_base + SPRD_MBOX_IRQ_MSK); +- val &= ~(SPRD_INBOX_FIFO_OVERFLOW_IRQ | SPRD_INBOX_FIFO_DELIVER_IRQ); ++ /* Enable inbox FIFO delivery interrupt */ ++ val = SPRD_INBOX_FIFO_IRQ_MASK; ++ val &= ~SPRD_INBOX_FIFO_DELIVER_IRQ; + writel(val, priv->inbox_base + SPRD_MBOX_IRQ_MSK); + + /* Enable outbox FIFO not empty interrupt */ +- val = readl(priv->outbox_base + SPRD_MBOX_IRQ_MSK); ++ val = SPRD_OUTBOX_FIFO_IRQ_MASK; + val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ; + writel(val, priv->outbox_base + SPRD_MBOX_IRQ_MSK); + + /* Enable supplementary outbox as the fundamental one */ + if (priv->supp_base) { + writel(0x0, priv->supp_base + SPRD_MBOX_FIFO_RST); +- val = readl(priv->supp_base + SPRD_MBOX_IRQ_MSK); +- val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ; + writel(val, priv->supp_base + SPRD_MBOX_IRQ_MSK); + } + } +-- +2.51.0 + diff --git a/queue-5.15/media-adv7180-fix-frame-interval-in-progressive-mode.patch b/queue-5.15/media-adv7180-fix-frame-interval-in-progressive-mode.patch new file mode 100644 index 00000000000..f8e9cb2145f --- /dev/null +++ b/queue-5.15/media-adv7180-fix-frame-interval-in-progressive-mode.patch @@ -0,0 +1,49 @@ +From 794c46cbfdaea7cdbb5a0ae8815c9f6afddf2d51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 15:29:57 +0100 +Subject: media: adv7180: fix frame interval in progressive mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thorsten Schmelzer + +[ Upstream commit 90289b67c5c1d4c18784059b27460d292e16d208 ] + +The ADV7280-M may internally convert interlaced video input to +progressive video. If this mode is enabled, the ADV7280-M delivers +progressive video frames at the field rate of 50 fields per second (PAL) +or 60 fields per second (NTSC). + +Fix the reported frame interval if progressive video is enabled. + +Signed-off-by: Thorsten Schmelzer +Reviewed-by: Niklas Söderlund +Signed-off-by: Michael Tretter +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/adv7180.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c +index d9a99fcfacb17..930ab969cc742 100644 +--- a/drivers/media/i2c/adv7180.c ++++ b/drivers/media/i2c/adv7180.c +@@ -471,6 +471,13 @@ static int adv7180_g_frame_interval(struct v4l2_subdev *sd, + fi->interval.denominator = 25; + } + ++ /* ++ * If the de-interlacer is active, the chip produces full video frames ++ * at the field rate. ++ */ ++ if (state->field == V4L2_FIELD_NONE) ++ fi->interval.denominator *= 2; ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-5.15/media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch b/queue-5.15/media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch new file mode 100644 index 00000000000..c861628a8cf --- /dev/null +++ b/queue-5.15/media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch @@ -0,0 +1,34 @@ +From ce17b418524313ef2522d3eb62476fc33c401a4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Jan 2026 15:46:47 +0800 +Subject: media: cx25821: Fix a resource leak in cx25821_dev_setup() + +From: Haoxiang Li + +[ Upstream commit 68cd8ac994cac38a305200f638b30e13c690753b ] + +Add release_mem_region() if ioremap() fails to release the memory +region obtained by cx25821_get_resources(). + +Signed-off-by: Haoxiang Li +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/cx25821/cx25821-core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c +index a4192e80e9a07..bce4fe15dce57 100644 +--- a/drivers/media/pci/cx25821/cx25821-core.c ++++ b/drivers/media/pci/cx25821/cx25821-core.c +@@ -915,6 +915,7 @@ static int cx25821_dev_setup(struct cx25821_dev *dev) + + if (!dev->lmmio) { + CX25821_ERR("ioremap failed, maybe increasing __VMALLOC_RESERVE in page.h\n"); ++ release_mem_region(dev->base_io_addr, pci_resource_len(dev->pci, 0)); + cx25821_iounmap(dev); + return -ENOMEM; + } +-- +2.51.0 + diff --git a/queue-5.15/media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch b/queue-5.15/media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch new file mode 100644 index 00000000000..bf236fb9a79 --- /dev/null +++ b/queue-5.15/media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch @@ -0,0 +1,110 @@ +From a7db05c2a035e1dea955bf0c0c447dafbca61302 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Jun 2025 08:57:35 +0200 +Subject: media: dvb-core: dmxdevfilter must always flush bufs + +From: Hans Verkuil + +[ Upstream commit c4e620eccbef76aa5564ebb295e23d6540e27215 ] + +Currently the buffers are being filled until full, which works fine +for the transport stream, but not when reading sections, those have +to be returned to userspace immediately, otherwise dvbv5-scan will +just wait forever. + +Add a 'flush' argument to dvb_vb2_fill_buffer to indicate whether +the buffer must be flushed or wait until it is full. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-core/dmxdev.c | 8 ++++---- + drivers/media/dvb-core/dvb_vb2.c | 5 +++-- + include/media/dvb_vb2.h | 6 ++++-- + 3 files changed, 11 insertions(+), 8 deletions(-) + +diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c +index 8abf7f44d96bc..4989ffe2477ea 100644 +--- a/drivers/media/dvb-core/dmxdev.c ++++ b/drivers/media/dvb-core/dmxdev.c +@@ -406,11 +406,11 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len, + if (dvb_vb2_is_streaming(&dmxdevfilter->vb2_ctx)) { + ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx, + buffer1, buffer1_len, +- buffer_flags); ++ buffer_flags, true); + if (ret == buffer1_len) + ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx, + buffer2, buffer2_len, +- buffer_flags); ++ buffer_flags, true); + } else { + ret = dvb_dmxdev_buffer_write(&dmxdevfilter->buffer, + buffer1, buffer1_len); +@@ -461,10 +461,10 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len, + + if (dvb_vb2_is_streaming(ctx)) { + ret = dvb_vb2_fill_buffer(ctx, buffer1, buffer1_len, +- buffer_flags); ++ buffer_flags, false); + if (ret == buffer1_len) + ret = dvb_vb2_fill_buffer(ctx, buffer2, buffer2_len, +- buffer_flags); ++ buffer_flags, false); + } else { + if (buffer->error) { + spin_unlock(&dmxdevfilter->dev->lock); +diff --git a/drivers/media/dvb-core/dvb_vb2.c b/drivers/media/dvb-core/dvb_vb2.c +index 1331f2c2237e6..c1aaa0b46c37e 100644 +--- a/drivers/media/dvb-core/dvb_vb2.c ++++ b/drivers/media/dvb-core/dvb_vb2.c +@@ -256,7 +256,8 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx) + + int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx, + const unsigned char *src, int len, +- enum dmx_buffer_flags *buffer_flags) ++ enum dmx_buffer_flags *buffer_flags, ++ bool flush) + { + unsigned long flags = 0; + void *vbuf = NULL; +@@ -313,7 +314,7 @@ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx, + } + } + +- if (ctx->nonblocking && ctx->buf) { ++ if (flush && ctx->buf) { + vb2_set_plane_payload(&ctx->buf->vb, 0, ll); + vb2_buffer_done(&ctx->buf->vb, VB2_BUF_STATE_DONE); + list_del(&ctx->buf->list); +diff --git a/include/media/dvb_vb2.h b/include/media/dvb_vb2.h +index 8cb88452cd6c2..0fbbfc65157e6 100644 +--- a/include/media/dvb_vb2.h ++++ b/include/media/dvb_vb2.h +@@ -124,7 +124,7 @@ static inline int dvb_vb2_release(struct dvb_vb2_ctx *ctx) + return 0; + }; + #define dvb_vb2_is_streaming(ctx) (0) +-#define dvb_vb2_fill_buffer(ctx, file, wait, flags) (0) ++#define dvb_vb2_fill_buffer(ctx, file, wait, flags, flush) (0) + + static inline __poll_t dvb_vb2_poll(struct dvb_vb2_ctx *ctx, + struct file *file, +@@ -166,10 +166,12 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx); + * @buffer_flags: + * pointer to buffer flags as defined by &enum dmx_buffer_flags. + * can be NULL. ++ * @flush: flush the buffer, even if it isn't full. + */ + int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx, + const unsigned char *src, int len, +- enum dmx_buffer_flags *buffer_flags); ++ enum dmx_buffer_flags *buffer_flags, ++ bool flush); + + /** + * dvb_vb2_poll - Wrapper to vb2_core_streamon() for Digital TV +-- +2.51.0 + diff --git a/queue-5.15/media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch b/queue-5.15/media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch new file mode 100644 index 00000000000..d4a89142860 --- /dev/null +++ b/queue-5.15/media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch @@ -0,0 +1,53 @@ +From bee20913a36cbc056f651e10c0f4011d718cc5e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Oct 2025 15:26:40 +0200 +Subject: media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes + +From: Hans Verkuil + +[ Upstream commit 44c03802a5191626996ee9db4bac090b164ca340 ] + +The isp_video_mbus_to_pix/pix_to_mbus functions did not take +the last empty entry { 0, } of the formats array into account. + +As a result, isp_video_mbus_to_pix would accept code 0 and +isp_video_pix_to_mbus would select code 0 if no match was found. + +Signed-off-by: Hans Verkuil +Acked-by: Sakari Ailus +Signed-off-by: Sasha Levin +--- + drivers/media/platform/omap3isp/ispvideo.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/omap3isp/ispvideo.c b/drivers/media/platform/omap3isp/ispvideo.c +index 8811d6dd4ee74..f7e1ef11cdc4a 100644 +--- a/drivers/media/platform/omap3isp/ispvideo.c ++++ b/drivers/media/platform/omap3isp/ispvideo.c +@@ -148,12 +148,12 @@ static unsigned int isp_video_mbus_to_pix(const struct isp_video *video, + pix->width = mbus->width; + pix->height = mbus->height; + +- for (i = 0; i < ARRAY_SIZE(formats); ++i) { ++ for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) { + if (formats[i].code == mbus->code) + break; + } + +- if (WARN_ON(i == ARRAY_SIZE(formats))) ++ if (WARN_ON(i == ARRAY_SIZE(formats) - 1)) + return 0; + + min_bpl = pix->width * formats[i].bpp; +@@ -191,7 +191,7 @@ static void isp_video_pix_to_mbus(const struct v4l2_pix_format *pix, + /* Skip the last format in the loop so that it will be selected if no + * match is found. + */ +- for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) { ++ for (i = 0; i < ARRAY_SIZE(formats) - 2; ++i) { + if (formats[i].pixelformat == pix->pixelformat) + break; + } +-- +2.51.0 + diff --git a/queue-5.15/media-omap3isp-isppreview-always-clamp-in-preview_tr.patch b/queue-5.15/media-omap3isp-isppreview-always-clamp-in-preview_tr.patch new file mode 100644 index 00000000000..1e55112a10a --- /dev/null +++ b/queue-5.15/media-omap3isp-isppreview-always-clamp-in-preview_tr.patch @@ -0,0 +1,63 @@ +From f8791547ae10aeb1eb257da1888ee8c530adf1e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 17:09:18 +0200 +Subject: media: omap3isp: isppreview: always clamp in preview_try_format() + +From: Hans Verkuil + +[ Upstream commit 17e1e1641f74a89824d4de3aa38c78daa5686cc1 ] + +If prev->input != PREVIEW_INPUT_MEMORY the width and height weren't +clamped. Just always clamp. + +This fixes a v4l2-compliance error: + + fail: v4l2-test-subdevs.cpp(171): fse.max_width == ~0U || fse.max_height == ~0U + fail: v4l2-test-subdevs.cpp(270): ret && ret != ENOTTY +test Try VIDIOC_SUBDEV_ENUM_MBUS_CODE/FRAME_SIZE/FRAME_INTERVAL: FAIL + +Signed-off-by: Hans Verkuil +Acked-by: Sakari Ailus +Signed-off-by: Sasha Levin +--- + drivers/media/platform/omap3isp/isppreview.c | 21 ++++++++------------ + 1 file changed, 8 insertions(+), 13 deletions(-) + +diff --git a/drivers/media/platform/omap3isp/isppreview.c b/drivers/media/platform/omap3isp/isppreview.c +index 53aedec7990da..32e4348e6837a 100644 +--- a/drivers/media/platform/omap3isp/isppreview.c ++++ b/drivers/media/platform/omap3isp/isppreview.c +@@ -1744,22 +1744,17 @@ static void preview_try_format(struct isp_prev_device *prev, + + switch (pad) { + case PREV_PAD_SINK: +- /* When reading data from the CCDC, the input size has already +- * been mangled by the CCDC output pad so it can be accepted +- * as-is. +- * +- * When reading data from memory, clamp the requested width and +- * height. The TRM doesn't specify a minimum input height, make ++ /* ++ * Clamp the requested width and height. ++ * The TRM doesn't specify a minimum input height, make + * sure we got enough lines to enable the noise filter and color + * filter array interpolation. + */ +- if (prev->input == PREVIEW_INPUT_MEMORY) { +- fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH, +- preview_max_out_width(prev)); +- fmt->height = clamp_t(u32, fmt->height, +- PREV_MIN_IN_HEIGHT, +- PREV_MAX_IN_HEIGHT); +- } ++ fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH, ++ preview_max_out_width(prev)); ++ fmt->height = clamp_t(u32, fmt->height, ++ PREV_MIN_IN_HEIGHT, ++ PREV_MAX_IN_HEIGHT); + + fmt->colorspace = V4L2_COLORSPACE_SRGB; + +-- +2.51.0 + diff --git a/queue-5.15/media-omap3isp-set-initial-format.patch b/queue-5.15/media-omap3isp-set-initial-format.patch new file mode 100644 index 00000000000..1d3d69bcbb1 --- /dev/null +++ b/queue-5.15/media-omap3isp-set-initial-format.patch @@ -0,0 +1,51 @@ +From c137a1c9581e28d0979464ef09a05482786e9d13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Apr 2025 09:21:53 +0200 +Subject: media: omap3isp: set initial format + +From: Hans Verkuil + +[ Upstream commit 7575b8dfa91f82fcb34ffd5568ff415ac4685794 ] + +Initialize the v4l2_format to a default. Empty formats are +not allowed in V4L2, so this fixes v4l2-compliance issues: + + fail: v4l2-test-formats.cpp(514): !pix.width || !pix.height +test VIDIOC_G_FMT: FAIL + +Signed-off-by: Hans Verkuil +Acked-by: Sakari Ailus +Signed-off-by: Sasha Levin +--- + drivers/media/platform/omap3isp/ispvideo.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/media/platform/omap3isp/ispvideo.c b/drivers/media/platform/omap3isp/ispvideo.c +index f7e1ef11cdc4a..3304457716450 100644 +--- a/drivers/media/platform/omap3isp/ispvideo.c ++++ b/drivers/media/platform/omap3isp/ispvideo.c +@@ -1293,6 +1293,7 @@ static const struct v4l2_ioctl_ops isp_video_ioctl_ops = { + static int isp_video_open(struct file *file) + { + struct isp_video *video = video_drvdata(file); ++ struct v4l2_mbus_framefmt fmt; + struct isp_video_fh *handle; + struct vb2_queue *queue; + int ret = 0; +@@ -1334,6 +1335,13 @@ static int isp_video_open(struct file *file) + + memset(&handle->format, 0, sizeof(handle->format)); + handle->format.type = video->type; ++ handle->format.fmt.pix.width = 720; ++ handle->format.fmt.pix.height = 480; ++ handle->format.fmt.pix.pixelformat = V4L2_PIX_FMT_UYVY; ++ handle->format.fmt.pix.field = V4L2_FIELD_NONE; ++ handle->format.fmt.pix.colorspace = V4L2_COLORSPACE_SRGB; ++ isp_video_pix_to_mbus(&handle->format.fmt.pix, &fmt); ++ isp_video_mbus_to_pix(video, &fmt, &handle->format.fmt.pix); + handle->timeperframe.denominator = 1; + + handle->video = video; +-- +2.51.0 + diff --git a/queue-5.15/media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch b/queue-5.15/media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch new file mode 100644 index 00000000000..fad369dca3f --- /dev/null +++ b/queue-5.15/media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch @@ -0,0 +1,48 @@ +From 9e32e65e79437c17ae8da62a550629b2b3345fce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Dec 2025 19:24:19 +0100 +Subject: media: pvrusb2: fix URB leak in pvr2_send_request_ex + +From: Szymon Wilczek + +[ Upstream commit a8333c8262aed2aedf608c18edd39cf5342680a7 ] + +When pvr2_send_request_ex() submits a write URB successfully but fails to +submit the read URB (e.g. returns -ENOMEM), it returns immediately without +waiting for the write URB to complete. Since the driver reuses the same +URB structure, a subsequent call to pvr2_send_request_ex() attempts to +submit the still-active write URB, triggering a 'URB submitted while +active' warning in usb_submit_urb(). + +Fix this by ensuring the write URB is unlinked and waited upon if the read +URB submission fails. + +Reported-by: syzbot+405dcd13121ff75a9e16@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=405dcd13121ff75a9e16 +Signed-off-by: Szymon Wilczek +Acked-by: Mike Isely +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +index 10c21580a827b..fc7eb59aa2c80 100644 +--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c ++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +@@ -3704,6 +3704,11 @@ status); + "Failed to submit read-control URB status=%d", + status); + hdw->ctl_read_pend_flag = 0; ++ if (hdw->ctl_write_pend_flag) { ++ usb_unlink_urb(hdw->ctl_write_urb); ++ while (hdw->ctl_write_pend_flag) ++ wait_for_completion(&hdw->ctl_done); ++ } + goto done; + } + } +-- +2.51.0 + diff --git a/queue-5.15/media-solo6x10-check-for-out-of-bounds-chip_id.patch b/queue-5.15/media-solo6x10-check-for-out-of-bounds-chip_id.patch new file mode 100644 index 00000000000..d44cec4b501 --- /dev/null +++ b/queue-5.15/media-solo6x10-check-for-out-of-bounds-chip_id.patch @@ -0,0 +1,68 @@ +From b1160e8f81f598ab96216695a885c4735c4760fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 19:00:35 -0800 +Subject: media: solo6x10: Check for out of bounds chip_id + +From: Kees Cook + +[ Upstream commit 0fdf6323c35a134f206dcad5babb4ff488552076 ] + +Clang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type +(literal "1" is an "int") could end up being shifted beyond 32 bits, +so instrumentation was added (and due to the double is_tw286x() call +seen via inlining), Clang decides the second one must now be undefined +behavior and elides the rest of the function[1]. This is a known problem +with Clang (that is still being worked on), but we can avoid the entire +problem by actually checking the existing max chip ID, and now there is +no runtime instrumentation added at all since everything is known to be +within bounds. + +Additionally use an unsigned value for the shift to remove the +instrumentation even without the explicit bounds checking. + +Link: https://github.com/ClangBuiltLinux/linux/issues/2144 [1] +Suggested-by: Nathan Chancellor +Signed-off-by: Kees Cook +Signed-off-by: Hans Verkuil +[hverkuil: fix checkpatch warning for is_tw286x] +Signed-off-by: Sasha Levin +--- + drivers/media/pci/solo6x10/solo6x10-tw28.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/pci/solo6x10/solo6x10-tw28.c b/drivers/media/pci/solo6x10/solo6x10-tw28.c +index 1b7c22a9bc94f..8f53946c67928 100644 +--- a/drivers/media/pci/solo6x10/solo6x10-tw28.c ++++ b/drivers/media/pci/solo6x10/solo6x10-tw28.c +@@ -166,7 +166,7 @@ static const u8 tbl_tw2865_pal_template[] = { + 0x64, 0x51, 0x40, 0xaf, 0xFF, 0xF0, 0x00, 0xC0, + }; + +-#define is_tw286x(__solo, __id) (!(__solo->tw2815 & (1 << __id))) ++#define is_tw286x(__solo, __id) (!((__solo)->tw2815 & (1U << (__id)))) + + static u8 tw_readbyte(struct solo_dev *solo_dev, int chip_id, u8 tw6x_off, + u8 tw_off) +@@ -686,6 +686,9 @@ int tw28_set_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch, + chip_num = ch / 4; + ch %= 4; + ++ if (chip_num >= TW_NUM_CHIP) ++ return -EINVAL; ++ + if (val > 255 || val < 0) + return -ERANGE; + +@@ -758,6 +761,9 @@ int tw28_get_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch, + chip_num = ch / 4; + ch %= 4; + ++ if (chip_num >= TW_NUM_CHIP) ++ return -EINVAL; ++ + switch (ctrl) { + case V4L2_CID_SHARPNESS: + /* Only 286x has sharpness */ +-- +2.51.0 + diff --git a/queue-5.15/minix-add-required-sanity-checking-to-minix_check_su.patch b/queue-5.15/minix-add-required-sanity-checking-to-minix_check_su.patch new file mode 100644 index 00000000000..4372c9ccb76 --- /dev/null +++ b/queue-5.15/minix-add-required-sanity-checking-to-minix_check_su.patch @@ -0,0 +1,103 @@ +From c3055bc0715194c45d65c19f3cc389a867aa7089 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 16:39:47 +0100 +Subject: minix: Add required sanity checking to minix_check_superblock() + +From: Jori Koolstra + +[ Upstream commit 8c97a6ddc95690a938ded44b4e3202f03f15078c ] + +The fs/minix implementation of the minix filesystem does not currently +support any other value for s_log_zone_size than 0. This is also the +only value supported in util-linux; see mkfs.minix.c line 511. In +addition, this patch adds some sanity checking for the other minix +superblock fields, and moves the minix_blocks_needed() checks for the +zmap and imap also to minix_check_super_block(). + +This also closes a related syzbot bug report. + +Signed-off-by: Jori Koolstra +Link: https://patch.msgid.link/20251208153947.108343-1-jkoolstra@xs4all.nl +Reviewed-by: Jan Kara +Reported-by: syzbot+5ad0824204c7bf9b67f2@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=5ad0824204c7bf9b67f2 +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/minix/inode.c | 50 ++++++++++++++++++++++++++++-------------------- + 1 file changed, 29 insertions(+), 21 deletions(-) + +diff --git a/fs/minix/inode.c b/fs/minix/inode.c +index 807ae40b64b06..95705305d358a 100644 +--- a/fs/minix/inode.c ++++ b/fs/minix/inode.c +@@ -153,10 +153,38 @@ static int minix_remount (struct super_block * sb, int * flags, char * data) + static bool minix_check_superblock(struct super_block *sb) + { + struct minix_sb_info *sbi = minix_sb(sb); ++ unsigned long block; + +- if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0) ++ if (sbi->s_log_zone_size != 0) { ++ printk("minix-fs error: zone size must equal block size. " ++ "s_log_zone_size > 0 is not supported.\n"); ++ return false; ++ } ++ ++ if (sbi->s_ninodes < 1 || sbi->s_firstdatazone <= 4 || ++ sbi->s_firstdatazone >= sbi->s_nzones) + return false; + ++ /* Apparently minix can create filesystems that allocate more blocks for ++ * the bitmaps than needed. We simply ignore that, but verify it didn't ++ * create one with not enough blocks and bail out if so. ++ */ ++ block = minix_blocks_needed(sbi->s_ninodes, sb->s_blocksize); ++ if (sbi->s_imap_blocks < block) { ++ printk("MINIX-fs: file system does not have enough " ++ "imap blocks allocated. Refusing to mount.\n"); ++ return false; ++ } ++ ++ block = minix_blocks_needed( ++ (sbi->s_nzones - sbi->s_firstdatazone + 1), ++ sb->s_blocksize); ++ if (sbi->s_zmap_blocks < block) { ++ printk("MINIX-fs: file system does not have enough " ++ "zmap blocks allocated. Refusing to mount.\n"); ++ return false; ++ } ++ + /* + * s_max_size must not exceed the block mapping limitation. This check + * is only needed for V1 filesystems, since V2/V3 support an extra level +@@ -275,26 +303,6 @@ static int minix_fill_super(struct super_block *s, void *data, int silent) + minix_set_bit(0,sbi->s_imap[0]->b_data); + minix_set_bit(0,sbi->s_zmap[0]->b_data); + +- /* Apparently minix can create filesystems that allocate more blocks for +- * the bitmaps than needed. We simply ignore that, but verify it didn't +- * create one with not enough blocks and bail out if so. +- */ +- block = minix_blocks_needed(sbi->s_ninodes, s->s_blocksize); +- if (sbi->s_imap_blocks < block) { +- printk("MINIX-fs: file system does not have enough " +- "imap blocks allocated. Refusing to mount.\n"); +- goto out_no_bitmap; +- } +- +- block = minix_blocks_needed( +- (sbi->s_nzones - sbi->s_firstdatazone + 1), +- s->s_blocksize); +- if (sbi->s_zmap_blocks < block) { +- printk("MINIX-fs: file system does not have enough " +- "zmap blocks allocated. Refusing to mount.\n"); +- goto out_no_bitmap; +- } +- + /* set up enough so that it can read an inode */ + s->s_op = &minix_sops; + s->s_time_min = 0; +-- +2.51.0 + diff --git a/queue-5.15/mips-loongson-make-cpumask_of_node-robust-against-nu.patch b/queue-5.15/mips-loongson-make-cpumask_of_node-robust-against-nu.patch new file mode 100644 index 00000000000..18d6a9a3fbb --- /dev/null +++ b/queue-5.15/mips-loongson-make-cpumask_of_node-robust-against-nu.patch @@ -0,0 +1,36 @@ +From 38923a7905ce3e1df82cdb8a416005d638942731 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 09:40:06 +0000 +Subject: MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE + +From: John Garry + +[ Upstream commit d55d3fe2d1470ac5b6e93efe7998b728013c9fc8 ] + +The arch definition of cpumask_of_node() cannot handle NUMA_NO_NODE - which +is a valid index - so add a check for this. + +Signed-off-by: John Garry +Reviewed-by: Huacai Chen +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/mach-loongson64/topology.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/include/asm/mach-loongson64/topology.h b/arch/mips/include/asm/mach-loongson64/topology.h +index 3414a1fd17835..89bb4deab98a6 100644 +--- a/arch/mips/include/asm/mach-loongson64/topology.h ++++ b/arch/mips/include/asm/mach-loongson64/topology.h +@@ -7,7 +7,7 @@ + #define cpu_to_node(cpu) (cpu_logical_map(cpu) >> 2) + + extern cpumask_t __node_cpumask[]; +-#define cpumask_of_node(node) (&__node_cpumask[node]) ++#define cpumask_of_node(node) ((node) == NUMA_NO_NODE ? cpu_all_mask : &__node_cpumask[node]) + + struct pci_bus; + extern int pcibus_to_node(struct pci_bus *); +-- +2.51.0 + diff --git a/queue-5.15/misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch b/queue-5.15/misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch new file mode 100644 index 00000000000..d2ff6137f50 --- /dev/null +++ b/queue-5.15/misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch @@ -0,0 +1,67 @@ +From 7f1b89da5d0048bf9444828cd00fb9e6ac42b9f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 11:48:24 +0100 +Subject: misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 + +From: Markus Perkins + +[ Upstream commit b54c82d6cbfc76647ba558e8e3647eb2b0ba0e2b ] + +commit 14374fbb3f06 ("misc: eeprom_93xx46: Add new 93c56 and 93c66 +compatible strings") added support for 93xx56 and 93xx66 eeproms, but +didn't take into account that the write enable/disable + erase all +commands are hardcoded for the 6-bit address of the 93xx46. + +This commit fixes the command word generation by increasing the number +of shifts as the address field grows, keeping the command intact. + +Also, the check for 8-bit or 16-bit mode is no longer required as this +is already taken into account in the edev->addrlen field. + +Signed-off-by: Markus Perkins +Link: https://patch.msgid.link/20251202104823.429869-3-markus@notsyncing.net +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/eeprom/eeprom_93xx46.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c +index 1f15399e5cb49..fb8c054321a38 100644 +--- a/drivers/misc/eeprom/eeprom_93xx46.c ++++ b/drivers/misc/eeprom/eeprom_93xx46.c +@@ -23,6 +23,7 @@ + #define OP_START 0x4 + #define OP_WRITE (OP_START | 0x1) + #define OP_READ (OP_START | 0x2) ++/* The following addresses are offset for the 1K EEPROM variant in 16-bit mode */ + #define ADDR_EWDS 0x00 + #define ADDR_ERAL 0x20 + #define ADDR_EWEN 0x30 +@@ -173,10 +174,7 @@ static int eeprom_93xx46_ew(struct eeprom_93xx46_dev *edev, int is_on) + bits = edev->addrlen + 3; + + cmd_addr = OP_START << edev->addrlen; +- if (edev->pdata->flags & EE_ADDR8) +- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << 1; +- else +- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS); ++ cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << (edev->addrlen - 6); + + if (has_quirk_instruction_length(edev)) { + cmd_addr <<= 2; +@@ -320,10 +318,7 @@ static int eeprom_93xx46_eral(struct eeprom_93xx46_dev *edev) + bits = edev->addrlen + 3; + + cmd_addr = OP_START << edev->addrlen; +- if (edev->pdata->flags & EE_ADDR8) +- cmd_addr |= ADDR_ERAL << 1; +- else +- cmd_addr |= ADDR_ERAL; ++ cmd_addr |= ADDR_ERAL << (edev->addrlen - 6); + + if (has_quirk_instruction_length(edev)) { + cmd_addr <<= 2; +-- +2.51.0 + diff --git a/queue-5.15/modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch b/queue-5.15/modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch new file mode 100644 index 00000000000..ee58ae6eb76 --- /dev/null +++ b/queue-5.15/modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch @@ -0,0 +1,56 @@ +From b60b94455d11af0d6f4035e3a0978e7a5ac83d42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Nov 2025 13:13:30 +0100 +Subject: modpost: Amend ppc64 save/restfpr symnames for -Os build +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: René Rebe + +[ Upstream commit 3cd9763ce4ad999d015cf0734e6b968cead95077 ] + +Building a size optimized ppc64 kernel (-Os), gcc emits more FP +save/restore symbols, that the linker generates on demand into the +.sfpr section. Explicitly allow-list those in scripts/mod/modpost.c, +too. They are needed for the amdgpu in-kernel floating point support. + +MODPOST Module.symvers +ERROR: modpost: "_restfpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_26" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savegpr1_27" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savegpr1_25" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_28" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savegpr1_29" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savefpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savefpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_15" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +WARNING: modpost: suppressed 56 unresolved symbol warnings because there were too many) + +Signed-off-by: René Rebe +Link: https://patch.msgid.link/20251123.131330.407910684435629198.rene@exactco.de +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + scripts/mod/modpost.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index a663a0ea4066b..2fa333fca1f7b 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -654,6 +654,10 @@ static int ignore_undef_symbol(struct elf_info *info, const char *symname) + /* Special register function linked on all modules during final link of .ko */ + if (strstarts(symname, "_restgpr0_") || + strstarts(symname, "_savegpr0_") || ++ strstarts(symname, "_restgpr1_") || ++ strstarts(symname, "_savegpr1_") || ++ strstarts(symname, "_restfpr_") || ++ strstarts(symname, "_savefpr_") || + strstarts(symname, "_restvr_") || + strstarts(symname, "_savevr_") || + strcmp(symname, ".TOC.") == 0) +-- +2.51.0 + diff --git a/queue-5.15/myri10ge-avoid-uninitialized-variable-use.patch b/queue-5.15/myri10ge-avoid-uninitialized-variable-use.patch new file mode 100644 index 00000000000..b418f2de445 --- /dev/null +++ b/queue-5.15/myri10ge-avoid-uninitialized-variable-use.patch @@ -0,0 +1,162 @@ +From b7039214d10137bb585d8ab3e14fa5ca0d393f4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Feb 2026 17:28:09 +0100 +Subject: myri10ge: avoid uninitialized variable use + +From: Arnd Bergmann + +[ Upstream commit fd24173439c033ffb3c2a2628fcbc9cb65e62bdb ] + +While compile testing on less common architectures, I noticed that gcc-10 on +s390 finds a bug that all other configurations seem to miss: + +drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_set_multicast_list': +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:391:25: error: 'cmd.data0' is used uninitialized in this function [-Werror=uninitialized] + 391 | buf->data0 = htonl(data->data0); + | ^~ +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:25: error: '*((void *)&cmd+4)' is used uninitialized in this function [-Werror=uninitialized] + 392 | buf->data1 = htonl(data->data1); + | ^~ +drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_allocate_rings': +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:13: error: 'cmd.data1' is used uninitialized in this function [-Werror=uninitialized] + 392 | buf->data1 = htonl(data->data1); +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data1' was declared here + 1939 | struct myri10ge_cmd cmd; + | ^~~ +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:393:13: error: 'cmd.data2' is used uninitialized in this function [-Werror=uninitialized] + 393 | buf->data2 = htonl(data->data2); +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data2' was declared here + 1939 | struct myri10ge_cmd cmd; + +It would be nice to understand how to make other compilers catch this as +well, but for the moment I'll just shut up the warning by fixing the +undefined behavior in this driver. + +Signed-off-by: Arnd Bergmann +Link: https://patch.msgid.link/20260205162935.2126442-1-arnd@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/myricom/myri10ge/myri10ge.c | 28 ++++++++++++++++++- + 1 file changed, 27 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c +index e6f18e004036a..30a523e03c806 100644 +--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c ++++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c +@@ -688,6 +688,9 @@ static int myri10ge_get_firmware_capabilities(struct myri10ge_priv *mgp) + + /* probe for IPv6 TSO support */ + mgp->features = NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_TSO; ++ cmd.data0 = 0, ++ cmd.data1 = 0, ++ cmd.data2 = 0, + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_MAX_TSO6_HDR_SIZE, + &cmd, 0); + if (status == 0) { +@@ -806,6 +809,7 @@ static int myri10ge_update_mac_address(struct myri10ge_priv *mgp, + | (addr[2] << 8) | addr[3]); + + cmd.data1 = ((addr[4] << 8) | (addr[5])); ++ cmd.data2 = 0; + + status = myri10ge_send_cmd(mgp, MXGEFW_SET_MAC_ADDRESS, &cmd, 0); + return status; +@@ -817,6 +821,9 @@ static int myri10ge_change_pause(struct myri10ge_priv *mgp, int pause) + int status, ctl; + + ctl = pause ? MXGEFW_ENABLE_FLOW_CONTROL : MXGEFW_DISABLE_FLOW_CONTROL; ++ cmd.data0 = 0, ++ cmd.data1 = 0, ++ cmd.data2 = 0, + status = myri10ge_send_cmd(mgp, ctl, &cmd, 0); + + if (status) { +@@ -834,6 +841,9 @@ myri10ge_change_promisc(struct myri10ge_priv *mgp, int promisc, int atomic) + int status, ctl; + + ctl = promisc ? MXGEFW_ENABLE_PROMISC : MXGEFW_DISABLE_PROMISC; ++ cmd.data0 = 0; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, ctl, &cmd, atomic); + if (status) + netdev_err(mgp->dev, "Failed to set promisc mode\n"); +@@ -1944,6 +1954,8 @@ static int myri10ge_allocate_rings(struct myri10ge_slice_state *ss) + /* get ring sizes */ + slice = ss - mgp->ss; + cmd.data0 = slice; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_RING_SIZE, &cmd, 0); + tx_ring_size = cmd.data0; + cmd.data0 = slice; +@@ -2236,12 +2248,16 @@ static int myri10ge_get_txrx(struct myri10ge_priv *mgp, int slice) + status = 0; + if (slice == 0 || (mgp->dev->real_num_tx_queues > 1)) { + cmd.data0 = slice; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_OFFSET, + &cmd, 0); + ss->tx.lanai = (struct mcp_kreq_ether_send __iomem *) + (mgp->sram + cmd.data0); + } + cmd.data0 = slice; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status |= myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SMALL_RX_OFFSET, + &cmd, 0); + ss->rx_small.lanai = (struct mcp_kreq_ether_recv __iomem *) +@@ -2310,6 +2326,7 @@ static int myri10ge_open(struct net_device *dev) + if (mgp->num_slices > 1) { + cmd.data0 = mgp->num_slices; + cmd.data1 = MXGEFW_SLICE_INTR_MODE_ONE_PER_SLICE; ++ cmd.data2 = 0; + if (mgp->dev->real_num_tx_queues > 1) + cmd.data1 |= MXGEFW_SLICE_ENABLE_MULTIPLE_TX_QUEUES; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_ENABLE_RSS_QUEUES, +@@ -2412,6 +2429,8 @@ static int myri10ge_open(struct net_device *dev) + + /* now give firmware buffers sizes, and MTU */ + cmd.data0 = dev->mtu + ETH_HLEN + VLAN_HLEN; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_SET_MTU, &cmd, 0); + cmd.data0 = mgp->small_bytes; + status |= +@@ -2470,7 +2489,6 @@ static int myri10ge_open(struct net_device *dev) + static int myri10ge_close(struct net_device *dev) + { + struct myri10ge_priv *mgp = netdev_priv(dev); +- struct myri10ge_cmd cmd; + int status, old_down_cnt; + int i; + +@@ -2489,8 +2507,13 @@ static int myri10ge_close(struct net_device *dev) + + netif_tx_stop_all_queues(dev); + if (mgp->rebooted == 0) { ++ struct myri10ge_cmd cmd; ++ + old_down_cnt = mgp->down_cnt; + mb(); ++ cmd.data0 = 0; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = + myri10ge_send_cmd(mgp, MXGEFW_CMD_ETHERNET_DOWN, &cmd, 0); + if (status) +@@ -2954,6 +2977,9 @@ static void myri10ge_set_multicast_list(struct net_device *dev) + + /* Disable multicast filtering */ + ++ cmd.data0 = 0; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + err = myri10ge_send_cmd(mgp, MXGEFW_ENABLE_ALLMULTI, &cmd, 1); + if (err != 0) { + netdev_err(dev, "Failed MXGEFW_ENABLE_ALLMULTI, error status: %d\n", +-- +2.51.0 + diff --git a/queue-5.15/net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch b/queue-5.15/net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch new file mode 100644 index 00000000000..d5b59493d59 --- /dev/null +++ b/queue-5.15/net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch @@ -0,0 +1,70 @@ +From fcf61e38363309f6b16aa1de6e9e7fd5e0c463ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 17:47:55 +0800 +Subject: net: hns3: extend HCLGE_FD_AD_QID to 11 bits + +From: Jijie Shao + +[ Upstream commit 878406d4d6ef85c37fab52074771cc916e532c16 ] + +Currently, HCLGE_FD_AD_QID has only 10 bits and supports a +maximum of 1023 queues. However, there are actually scenarios +where the queue_id exceeds 1023. + +This patch adds an additional bit to HCLGE_FD_AD_QID to ensure +that queue_id greater than 1023 are supported. + +Signed-off-by: Jijie Shao +Link: https://patch.msgid.link/20260123094756.3718516-2-shaojijie@huawei.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 5 +++-- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 +++- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +index 7d96aa361f633..fb0dc5833af1a 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +@@ -1032,8 +1032,8 @@ struct hclge_fd_tcam_config_3_cmd { + + #define HCLGE_FD_AD_DROP_B 0 + #define HCLGE_FD_AD_DIRECT_QID_B 1 +-#define HCLGE_FD_AD_QID_S 2 +-#define HCLGE_FD_AD_QID_M GENMASK(11, 2) ++#define HCLGE_FD_AD_QID_L_S 2 ++#define HCLGE_FD_AD_QID_L_M GENMASK(11, 2) + #define HCLGE_FD_AD_USE_COUNTER_B 12 + #define HCLGE_FD_AD_COUNTER_NUM_S 13 + #define HCLGE_FD_AD_COUNTER_NUM_M GENMASK(19, 13) +@@ -1046,6 +1046,7 @@ struct hclge_fd_tcam_config_3_cmd { + #define HCLGE_FD_AD_TC_OVRD_B 16 + #define HCLGE_FD_AD_TC_SIZE_S 17 + #define HCLGE_FD_AD_TC_SIZE_M GENMASK(20, 17) ++#define HCLGE_FD_AD_QID_H_B 21 + + struct hclge_fd_ad_config_cmd { + u8 stage; +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 1dae7500fa57c..4fcb08684ee09 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -5845,11 +5845,13 @@ static int hclge_fd_ad_config(struct hclge_dev *hdev, u8 stage, int loc, + hnae3_set_field(ad_data, HCLGE_FD_AD_TC_SIZE_M, + HCLGE_FD_AD_TC_SIZE_S, (u32)action->tc_size); + } ++ hnae3_set_bit(ad_data, HCLGE_FD_AD_QID_H_B, ++ action->queue_id >= HCLGE_TQP_MAX_SIZE_DEV_V2 ? 1 : 0); + ad_data <<= 32; + hnae3_set_bit(ad_data, HCLGE_FD_AD_DROP_B, action->drop_packet); + hnae3_set_bit(ad_data, HCLGE_FD_AD_DIRECT_QID_B, + action->forward_to_direct_queue); +- hnae3_set_field(ad_data, HCLGE_FD_AD_QID_M, HCLGE_FD_AD_QID_S, ++ hnae3_set_field(ad_data, HCLGE_FD_AD_QID_L_M, HCLGE_FD_AD_QID_L_S, + action->queue_id); + hnae3_set_bit(ad_data, HCLGE_FD_AD_USE_COUNTER_B, action->use_counter); + hnae3_set_field(ad_data, HCLGE_FD_AD_COUNTER_NUM_M, +-- +2.51.0 + diff --git a/queue-5.15/net-rds-clear-reconnect-pending-bit.patch b/queue-5.15/net-rds-clear-reconnect-pending-bit.patch new file mode 100644 index 00000000000..6bb7601ab36 --- /dev/null +++ b/queue-5.15/net-rds-clear-reconnect-pending-bit.patch @@ -0,0 +1,42 @@ +From 9721572baa84813482a3c0c300797b2f4689f5af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 22:57:20 -0700 +Subject: net/rds: Clear reconnect pending bit +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: HÃ¥kon Bugge + +[ Upstream commit b89fc7c2523b2b0750d91840f4e52521270d70ed ] + +When canceling the reconnect worker, care must be taken to reset the +reconnect-pending bit. If the reconnect worker has not yet been +scheduled before it is canceled, the reconnect-pending bit will stay +on forever. + +Signed-off-by: HÃ¥kon Bugge +Signed-off-by: Allison Henderson +Link: https://patch.msgid.link/20260203055723.1085751-6-achender@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/rds/connection.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/rds/connection.c b/net/rds/connection.c +index 00bda534b9ce2..98c0d5ff9de9c 100644 +--- a/net/rds/connection.c ++++ b/net/rds/connection.c +@@ -428,6 +428,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp) + * to the conn hash, so we never trigger a reconnect on this + * conn - the reconnect is always triggered by the active peer. */ + cancel_delayed_work_sync(&cp->cp_conn_w); ++ ++ clear_bit(RDS_RECONNECT_PENDING, &cp->cp_flags); + rcu_read_lock(); + if (!hlist_unhashed(&conn->c_hash_node)) { + rcu_read_unlock(); +-- +2.51.0 + diff --git a/queue-5.15/net-rds-no-shortcut-out-of-rds_conn_error.patch b/queue-5.15/net-rds-no-shortcut-out-of-rds_conn_error.patch new file mode 100644 index 00000000000..7af15acb0c1 --- /dev/null +++ b/queue-5.15/net-rds-no-shortcut-out-of-rds_conn_error.patch @@ -0,0 +1,92 @@ +From ab790526f993afc681a0b05109321f539e118166 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jan 2026 22:52:12 -0700 +Subject: net/rds: No shortcut out of RDS_CONN_ERROR + +From: Gerd Rausch + +[ Upstream commit ad22d24be635c6beab6a1fdd3f8b1f3c478d15da ] + +RDS connections carry a state "rds_conn_path::cp_state" +and transitions from one state to another and are conditional +upon an expected state: "rds_conn_path_transition." + +There is one exception to this conditionality, which is +"RDS_CONN_ERROR" that can be enforced by "rds_conn_path_drop" +regardless of what state the condition is currently in. + +But as soon as a connection enters state "RDS_CONN_ERROR", +the connection handling code expects it to go through the +shutdown-path. + +The RDS/TCP multipath changes added a shortcut out of +"RDS_CONN_ERROR" straight back to "RDS_CONN_CONNECTING" +via "rds_tcp_accept_one_path" (e.g. after "rds_tcp_state_change"). + +A subsequent "rds_tcp_reset_callbacks" can then transition +the state to "RDS_CONN_RESETTING" with a shutdown-worker queued. + +That'll trip up "rds_conn_init_shutdown", which was +never adjusted to handle "RDS_CONN_RESETTING" and subsequently +drops the connection with the dreaded "DR_INV_CONN_STATE", +which leaves "RDS_SHUTDOWN_WORK_QUEUED" on forever. + +So we do two things here: + +a) Don't shortcut "RDS_CONN_ERROR", but take the longer + path through the shutdown code. + +b) Add "RDS_CONN_RESETTING" to the expected states in + "rds_conn_init_shutdown" so that we won't error out + and get stuck, if we ever hit weird state transitions + like this again." + +Signed-off-by: Gerd Rausch +Signed-off-by: Allison Henderson +Link: https://patch.msgid.link/20260122055213.83608-2-achender@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/rds/connection.c | 2 ++ + net/rds/tcp_listen.c | 5 ----- + 2 files changed, 2 insertions(+), 5 deletions(-) + +diff --git a/net/rds/connection.c b/net/rds/connection.c +index b4cc699c5fad3..00bda534b9ce2 100644 +--- a/net/rds/connection.c ++++ b/net/rds/connection.c +@@ -381,6 +381,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp) + if (!rds_conn_path_transition(cp, RDS_CONN_UP, + RDS_CONN_DISCONNECTING) && + !rds_conn_path_transition(cp, RDS_CONN_ERROR, ++ RDS_CONN_DISCONNECTING) && ++ !rds_conn_path_transition(cp, RDS_CONN_RESETTING, + RDS_CONN_DISCONNECTING)) { + rds_conn_path_error(cp, + "shutdown called in state %d\n", +diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c +index 3994eeef95a3c..7b6d0088ae33e 100644 +--- a/net/rds/tcp_listen.c ++++ b/net/rds/tcp_listen.c +@@ -58,9 +58,6 @@ void rds_tcp_keepalive(struct socket *sock) + * socket and force a reconneect from smaller -> larger ip addr. The reason + * we special case cp_index 0 is to allow the rds probe ping itself to itself + * get through efficiently. +- * Since reconnects are only initiated from the node with the numerically +- * smaller ip address, we recycle conns in RDS_CONN_ERROR on the passive side +- * by moving them to CONNECTING in this function. + */ + static + struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn) +@@ -85,8 +82,6 @@ struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn) + struct rds_conn_path *cp = &conn->c_path[i]; + + if (rds_conn_path_transition(cp, RDS_CONN_DOWN, +- RDS_CONN_CONNECTING) || +- rds_conn_path_transition(cp, RDS_CONN_ERROR, + RDS_CONN_CONNECTING)) { + return cp->cp_transport_data; + } +-- +2.51.0 + diff --git a/queue-5.15/net-usb-r8152-fix-transmit-queue-timeout.patch b/queue-5.15/net-usb-r8152-fix-transmit-queue-timeout.patch new file mode 100644 index 00000000000..336481f2226 --- /dev/null +++ b/queue-5.15/net-usb-r8152-fix-transmit-queue-timeout.patch @@ -0,0 +1,42 @@ +From 242bae2e542f420ed958d5220a65d0fd1cd77440 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 09:59:49 +0800 +Subject: net: usb: r8152: fix transmit queue timeout + +From: Mingj Ye + +[ Upstream commit 833dcd75d54f0bf5aa0a0781ff57456b421fbb40 ] + +When the TX queue length reaches the threshold, the netdev watchdog +immediately detects a TX queue timeout. + +This patch updates the trans_start timestamp of the transmit queue +on every asynchronous USB URB submission along the transmit path, +ensuring that the network watchdog accurately reflects ongoing +transmission activity. + +Signed-off-by: Mingj Ye +Reviewed-by: Hayes Wang +Link: https://patch.msgid.link/20260120015949.84996-1-insyelu@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 1bd18a6292803..e70f3cb8bad94 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -2339,6 +2339,8 @@ static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg) + ret = usb_submit_urb(agg->urb, GFP_ATOMIC); + if (ret < 0) + usb_autopm_put_interface_async(tp->intf); ++ else ++ netif_trans_update(tp->netdev); + + out_tx_fill: + return ret; +-- +2.51.0 + diff --git a/queue-5.15/net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch b/queue-5.15/net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch new file mode 100644 index 00000000000..bcc9fbc546a --- /dev/null +++ b/queue-5.15/net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch @@ -0,0 +1,117 @@ +From aa6363d6409eeacead6e0b627c5605c88f7d4dc2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 17:39:09 -0800 +Subject: net: usb: sr9700: remove code to drive nonexistent multicast filter + +From: Ethan Nelson-Moore + +[ Upstream commit 9a9424c756feee9ee6e717405a9d6fa7bacdef08 ] + +Several registers referenced in this driver's source code do not +actually exist (they are not writable and read as zero in my testing). +They exist in this driver because it originated as a copy of the dm9601 +driver. Notably, these include the multicast filter registers - this +causes the driver to not support multicast packets correctly. Remove +the multicast filter code and register definitions. Instead, set the +chip to receive all multicast filter packets when any multicast +addresses are in the list. + +Reviewed-by: Simon Horman (from v1) +Signed-off-by: Ethan Nelson-Moore +Link: https://patch.msgid.link/20260203013924.28582-1-enelsonmoore@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/Kconfig | 1 - + drivers/net/usb/sr9700.c | 25 ++++--------------------- + drivers/net/usb/sr9700.h | 7 +------ + 3 files changed, 5 insertions(+), 28 deletions(-) + +diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig +index 8939e5fbd50a8..4143714f2b7d5 100644 +--- a/drivers/net/usb/Kconfig ++++ b/drivers/net/usb/Kconfig +@@ -320,7 +320,6 @@ config USB_NET_DM9601 + config USB_NET_SR9700 + tristate "CoreChip-sz SR9700 based USB 1.1 10/100 ethernet devices" + depends on USB_USBNET +- select CRC32 + help + This option adds support for CoreChip-sz SR9700 based USB 1.1 + 10/100 Ethernet adapters. +diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c +index 86d14fad318c3..07a018585b30f 100644 +--- a/drivers/net/usb/sr9700.c ++++ b/drivers/net/usb/sr9700.c +@@ -18,7 +18,6 @@ + #include + #include + #include +-#include + #include + + #include "sr9700.h" +@@ -265,31 +264,15 @@ static const struct ethtool_ops sr9700_ethtool_ops = { + static void sr9700_set_multicast(struct net_device *netdev) + { + struct usbnet *dev = netdev_priv(netdev); +- /* We use the 20 byte dev->data for our 8 byte filter buffer +- * to avoid allocating memory that is tricky to free later +- */ +- u8 *hashes = (u8 *)&dev->data; + /* rx_ctl setting : enable, disable_long, disable_crc */ + u8 rx_ctl = RCR_RXEN | RCR_DIS_CRC | RCR_DIS_LONG; + +- memset(hashes, 0x00, SR_MCAST_SIZE); +- /* broadcast address */ +- hashes[SR_MCAST_SIZE - 1] |= SR_MCAST_ADDR_FLAG; +- if (netdev->flags & IFF_PROMISC) { ++ if (netdev->flags & IFF_PROMISC) + rx_ctl |= RCR_PRMSC; +- } else if (netdev->flags & IFF_ALLMULTI || +- netdev_mc_count(netdev) > SR_MCAST_MAX) { +- rx_ctl |= RCR_RUNT; +- } else if (!netdev_mc_empty(netdev)) { +- struct netdev_hw_addr *ha; +- +- netdev_for_each_mc_addr(ha, netdev) { +- u32 crc = ether_crc(ETH_ALEN, ha->addr) >> 26; +- hashes[crc >> 3] |= 1 << (crc & 0x7); +- } +- } ++ else if (netdev->flags & IFF_ALLMULTI || !netdev_mc_empty(netdev)) ++ /* The chip has no multicast filter */ ++ rx_ctl |= RCR_ALL; + +- sr_write_async(dev, SR_MAR, SR_MCAST_SIZE, hashes); + sr_write_reg_async(dev, SR_RCR, rx_ctl); + } + +diff --git a/drivers/net/usb/sr9700.h b/drivers/net/usb/sr9700.h +index ea2b4de621c86..c479908f7d823 100644 +--- a/drivers/net/usb/sr9700.h ++++ b/drivers/net/usb/sr9700.h +@@ -104,9 +104,7 @@ + #define WCR_LINKEN (1 << 5) + /* Physical Address Reg */ + #define SR_PAR 0x10 /* 0x10 ~ 0x15 6 bytes for PAR */ +-/* Multicast Address Reg */ +-#define SR_MAR 0x16 /* 0x16 ~ 0x1D 8 bytes for MAR */ +-/* 0x1e unused */ ++/* 0x16 --> 0x1E unused */ + /* Phy Reset Reg */ + #define SR_PRR 0x1F + #define PRR_PHY_RST (1 << 0) +@@ -161,9 +159,6 @@ + /* parameters */ + #define SR_SHARE_TIMEOUT 1000 + #define SR_EEPROM_LEN 256 +-#define SR_MCAST_SIZE 8 +-#define SR_MCAST_ADDR_FLAG 0x80 +-#define SR_MCAST_MAX 64 + #define SR_TX_OVERHEAD 2 /* 2bytes header */ + #define SR_RX_OVERHEAD 7 /* 3bytes header + 4crc tail */ + +-- +2.51.0 + diff --git a/queue-5.15/netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch b/queue-5.15/netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch new file mode 100644 index 00000000000..8d4d9397e3b --- /dev/null +++ b/queue-5.15/netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch @@ -0,0 +1,41 @@ +From fd499ced0a32497e7e77b4ddbaf33f0277b8c2d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Dec 2025 20:53:51 +0900 +Subject: netfilter: nf_conntrack: Add allow_clash to generic protocol handler + +From: Yuto Hamaguchi + +[ Upstream commit 8a49fc8d8a3e83dc51ec05bcd4007bdea3c56eec ] + +The upstream commit, 71d8c47fc653711c41bc3282e5b0e605b3727956 + ("netfilter: conntrack: introduce clash resolution on insertion race"), +sets allow_clash=true in the UDP/UDPLITE protocol handler +but does not set it in the generic protocol handler. + +As a result, packets composed of connectionless protocols at each layer, +such as UDP over IP-in-IP, still drop packets due to conflicts during conntrack insertion. + +To resolve this, this patch sets allow_clash in the nf_conntrack_l4proto_generic. + +Signed-off-by: Yuto Hamaguchi +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_proto_generic.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c +index e831637bc8ca8..cb260eb3d012c 100644 +--- a/net/netfilter/nf_conntrack_proto_generic.c ++++ b/net/netfilter/nf_conntrack_proto_generic.c +@@ -67,6 +67,7 @@ void nf_conntrack_generic_init_net(struct net *net) + const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic = + { + .l4proto = 255, ++ .allow_clash = true, + #ifdef CONFIG_NF_CONNTRACK_TIMEOUT + .ctnl_timeout = { + .nlattr_to_obj = generic_timeout_nlattr_to_obj, +-- +2.51.0 + diff --git a/queue-5.15/netfilter-xt_tcpmss-check-remaining-length-before-re.patch b/queue-5.15/netfilter-xt_tcpmss-check-remaining-length-before-re.patch new file mode 100644 index 00000000000..df78d9121f2 --- /dev/null +++ b/queue-5.15/netfilter-xt_tcpmss-check-remaining-length-before-re.patch @@ -0,0 +1,42 @@ +From cef02aa5e7489575746a2a6ef14bf6cd80ea6245 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 12:30:42 +0100 +Subject: netfilter: xt_tcpmss: check remaining length before reading optlen + +From: Florian Westphal + +[ Upstream commit 735ee8582da3d239eb0c7a53adca61b79fb228b3 ] + +Quoting reporter: + In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads + op[i+1] directly without validating the remaining option length. + + If the last byte of the option field is not EOL/NOP (0/1), the code attempts + to index op[i+1]. In the case where i + 1 == optlen, this causes an + out-of-bounds read, accessing memory past the optlen boundary + (either reading beyond the stack buffer _opt or the + following payload). + +Reported-by: sungzii +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/xt_tcpmss.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c +index 37704ab017992..0d32d4841cb32 100644 +--- a/net/netfilter/xt_tcpmss.c ++++ b/net/netfilter/xt_tcpmss.c +@@ -61,7 +61,7 @@ tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par) + return (mssval >= info->mss_min && + mssval <= info->mss_max) ^ info->invert; + } +- if (op[i] < 2) ++ if (op[i] < 2 || i == optlen - 1) + i++; + else + i += op[i+1] ? : 1; +-- +2.51.0 + diff --git a/queue-5.15/nfc-nxp-nci-remove-interrupt-trigger-type.patch b/queue-5.15/nfc-nxp-nci-remove-interrupt-trigger-type.patch new file mode 100644 index 00000000000..6490a78355b --- /dev/null +++ b/queue-5.15/nfc-nxp-nci-remove-interrupt-trigger-type.patch @@ -0,0 +1,42 @@ +From 11ce536a1c6298e37a9b268a4ffc450227f2e442 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Feb 2026 19:11:39 +0800 +Subject: nfc: nxp-nci: remove interrupt trigger type + +From: Carl Lee + +[ Upstream commit 57be33f85e369ce9f69f61eaa34734e0d3bd47a7 ] + +For NXP NCI devices (e.g. PN7150), the interrupt is level-triggered and +active high, not edge-triggered. + +Using IRQF_TRIGGER_RISING in the driver can cause interrupts to fail +to trigger correctly. + +Remove IRQF_TRIGGER_RISING and rely on the IRQ trigger type configured +via Device Tree. + +Signed-off-by: Carl Lee +Link: https://patch.msgid.link/20260205-fc-nxp-nci-remove-interrupt-trigger-type-v2-1-79d2ed4a7e42@amd.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/nfc/nxp-nci/i2c.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c +index ae2ba08d8ac3f..152c9065e730d 100644 +--- a/drivers/nfc/nxp-nci/i2c.c ++++ b/drivers/nfc/nxp-nci/i2c.c +@@ -306,7 +306,7 @@ static int nxp_nci_i2c_probe(struct i2c_client *client, + + r = request_threaded_irq(client->irq, NULL, + nxp_nci_i2c_irq_thread_fn, +- IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ IRQF_ONESHOT, + NXP_NCI_I2C_DRIVER_NAME, phy); + if (r < 0) + nfc_err(&client->dev, "Unable to register IRQ handler\n"); +-- +2.51.0 + diff --git a/queue-5.15/ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch b/queue-5.15/ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch new file mode 100644 index 00000000000..3b0529528da --- /dev/null +++ b/queue-5.15/ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch @@ -0,0 +1,40 @@ +From 911b8701956da149096805fa7e28cad8d2250b89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2025 14:53:18 -0800 +Subject: ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access + +From: Maciej Grochowski + +[ Upstream commit c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface ] + +Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS, +This patch protects against invalid index out of bounds access to mw_sizes +When invalid access print message to user that configuration is not valid. + +Signed-off-by: Maciej Grochowski +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +index c9351063aaf15..3fdde852c3b54 100644 +--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c ++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +@@ -1314,6 +1314,12 @@ static void switchtec_ntb_init_shared(struct switchtec_ntb *sndev) + for (i = 0; i < sndev->nr_lut_mw; i++) { + int idx = sndev->nr_direct_mw + i; + ++ if (idx >= MAX_MWS) { ++ dev_err(&sndev->stdev->dev, ++ "Total number of MW cannot be bigger than %d", MAX_MWS); ++ break; ++ } ++ + sndev->self_shared->mw_sizes[idx] = LUT_SIZE; + } + } +-- +2.51.0 + diff --git a/queue-5.15/ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch b/queue-5.15/ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch new file mode 100644 index 00000000000..27a61ec401f --- /dev/null +++ b/queue-5.15/ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch @@ -0,0 +1,48 @@ +From 1a8619ea4950c457d283716b28c5467b72a2ef19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2025 14:53:17 -0800 +Subject: ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut + +From: Maciej Grochowski + +[ Upstream commit 186615f8855a0be4ee7d3fcd09a8ecc10e783b08 ] + +Number of MW LUTs depends on NTB configuration and can be set to zero, +in such scenario rounddown_pow_of_two will cause undefined behaviour and +should not be performed. +This patch ensures that rounddown_pow_of_two is called on valid value. + +Signed-off-by: Maciej Grochowski +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +index 3fdde852c3b54..da1e32edadc8e 100644 +--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c ++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +@@ -1202,7 +1202,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev) + sndev->mmio_self_ctrl); + + sndev->nr_lut_mw = ioread16(&sndev->mmio_self_ctrl->lut_table_entries); +- sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw); ++ if (sndev->nr_lut_mw) ++ sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw); + + dev_dbg(&sndev->stdev->dev, "MWs: %d direct, %d lut\n", + sndev->nr_direct_mw, sndev->nr_lut_mw); +@@ -1212,7 +1213,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev) + + sndev->peer_nr_lut_mw = + ioread16(&sndev->mmio_peer_ctrl->lut_table_entries); +- sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw); ++ if (sndev->peer_nr_lut_mw) ++ sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw); + + dev_dbg(&sndev->stdev->dev, "Peer MWs: %d direct, %d lut\n", + sndev->peer_nr_direct_mw, sndev->peer_nr_lut_mw); +-- +2.51.0 + diff --git a/queue-5.15/octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch b/queue-5.15/octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch new file mode 100644 index 00000000000..f454a751224 --- /dev/null +++ b/queue-5.15/octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch @@ -0,0 +1,69 @@ +From 12834979f1d1f912f260dc112a7caf3e8f2e13fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 18:21:47 +0530 +Subject: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geetha sowjanya + +[ Upstream commit 70e9a5760abfb6338d63994d4de6b0778ec795d6 ] + +NIX SQ manager sticky mode is known to cause stalls when multiple SQs +share an SMQ and transmit concurrently. Additionally, PSE may deadlock +on transitions between sticky and non-sticky transmissions. There is +also a credit drop issue observed when certain condition clocks are +gated. + +work around these hardware errata by: +- Disabling SQM sticky operation: + - Clear TM6 (bit 15) + - Clear TM11 (bit 14) +- Disabling sticky → non-sticky transition path that can deadlock PSE: + - Clear TM5 (bit 23) +- Preventing credit drops by keeping the control-flow clock enabled: + - Set TM9 (bit 21) + +These changes are applied via NIX_AF_SQM_DBG_CTL_STATUS. With this +configuration the SQM/PSE maintain forward progress under load without +credit loss, at the cost of disabling sticky optimizations. + +Signed-off-by: Geetha sowjanya +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260127125147.1642-1-gakula@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +index 8bdde74b34b6d..e91b4d27ce759 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +@@ -4411,12 +4411,18 @@ static int rvu_nix_block_init(struct rvu *rvu, struct nix_hw *nix_hw) + /* Set chan/link to backpressure TL3 instead of TL2 */ + rvu_write64(rvu, blkaddr, NIX_AF_PSE_CHANNEL_LEVEL, 0x01); + +- /* Disable SQ manager's sticky mode operation (set TM6 = 0) ++ /* Disable SQ manager's sticky mode operation (set TM6 = 0, TM11 = 0) + * This sticky mode is known to cause SQ stalls when multiple +- * SQs are mapped to same SMQ and transmitting pkts at a time. ++ * SQs are mapped to same SMQ and transmitting pkts simultaneously. ++ * NIX PSE may deadlock when there are any sticky to non-sticky ++ * transmission. Hence disable it (TM5 = 0). + */ + cfg = rvu_read64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS); +- cfg &= ~BIT_ULL(15); ++ cfg &= ~(BIT_ULL(15) | BIT_ULL(14) | BIT_ULL(23)); ++ /* NIX may drop credits when condition clocks are turned off. ++ * Hence enable control flow clk (set TM9 = 1). ++ */ ++ cfg |= BIT_ULL(21); + rvu_write64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS, cfg); + + ltdefs = rvu->kpu.lt_def; +-- +2.51.0 + diff --git a/queue-5.15/openrisc-define-arch-specific-version-of-nop.patch b/queue-5.15/openrisc-define-arch-specific-version-of-nop.patch new file mode 100644 index 00000000000..5a92314c545 --- /dev/null +++ b/queue-5.15/openrisc-define-arch-specific-version-of-nop.patch @@ -0,0 +1,53 @@ +From 15a5d8d0e5737aaa976cfa5d11035d486cc68867 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 12:07:23 -0500 +Subject: openrisc: define arch-specific version of nop() + +From: Brian Masney + +[ Upstream commit 0dfffa5479d6260d04d021f69203b1926f73d889 ] + +When compiling a driver written for MIPS on OpenRISC that uses the nop() +function, it fails due to the following error: + + drivers/watchdog/pic32-wdt.c: Assembler messages: + drivers/watchdog/pic32-wdt.c:125: Error: unrecognized instruction `nop' + +The driver currently uses the generic version of nop() from +include/asm-generic/barrier.h: + + #ifndef nop + #define nop() asm volatile ("nop") + #endif + +Let's fix this on OpenRISC by defining an architecture-specific version +of nop(). + +This was tested by performing an allmodconfig openrisc cross compile on +an aarch64 host. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202601180236.BVy480We-lkp@intel.com/ +Signed-off-by: Brian Masney +Signed-off-by: Stafford Horne +Signed-off-by: Sasha Levin +--- + arch/openrisc/include/asm/barrier.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h +index 7538294721bed..8e592c9909023 100644 +--- a/arch/openrisc/include/asm/barrier.h ++++ b/arch/openrisc/include/asm/barrier.h +@@ -4,6 +4,8 @@ + + #define mb() asm volatile ("l.msync" ::: "memory") + ++#define nop() asm volatile ("l.nop") ++ + #include + + #endif /* __ASM_BARRIER_H */ +-- +2.51.0 + diff --git a/queue-5.15/parisc-prevent-interrupts-during-reboot.patch b/queue-5.15/parisc-prevent-interrupts-during-reboot.patch new file mode 100644 index 00000000000..876023e4f29 --- /dev/null +++ b/queue-5.15/parisc-prevent-interrupts-during-reboot.patch @@ -0,0 +1,32 @@ +From bb9ca966d4551994a5832d7358a77439df2c40c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 17:58:55 +0100 +Subject: parisc: Prevent interrupts during reboot + +From: Helge Deller + +[ Upstream commit 35ac5a728c878594f2ea6c43b57652a16be3c968 ] + +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/kernel/process.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c +index f393d24e4b1c3..e5cbdd17cdd53 100644 +--- a/arch/parisc/kernel/process.c ++++ b/arch/parisc/kernel/process.c +@@ -82,6 +82,9 @@ void machine_restart(char *cmd) + #endif + /* set up a new led state on systems shipped with a LED State panel */ + pdc_chassis_send_status(PDC_CHASSIS_DIRECT_SHUTDOWN); ++ ++ /* prevent interrupts during reboot */ ++ set_eiem(0); + + /* "Normal" system reset */ + pdc_do_reset(); +-- +2.51.0 + diff --git a/queue-5.15/pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch b/queue-5.15/pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch new file mode 100644 index 00000000000..03e763a1276 --- /dev/null +++ b/queue-5.15/pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch @@ -0,0 +1,41 @@ +From 28030e6ad9ab665cb81a563e11d35dc58b1e5057 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jan 2026 13:53:32 +0530 +Subject: PCI: Add ACS quirk for Qualcomm Hamoa & Glymur + +From: Krishna Chaitanya Chundru + +[ Upstream commit 44d2f70b1fd72c339c72983fcffa181beae3e113 ] + +The Qualcomm Hamoa & Glymur Root Ports don't advertise an ACS capability, +but they do provide ACS-like features to disable peer transactions and +validate bus numbers in requests. + +Add an ACS quirk for Hamoa & Glymur. + +Signed-off-by: Krishna Chaitanya Chundru +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20260109-acs_quirk-v1-1-82adf95a89ae@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 8ea3d2c9676d5..7a94236f1c2c6 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -4976,6 +4976,10 @@ static const struct pci_dev_acs_enabled { + { PCI_VENDOR_ID_QCOM, 0x0401, pci_quirk_qcom_rp_acs }, + /* QCOM SA8775P root port */ + { PCI_VENDOR_ID_QCOM, 0x0115, pci_quirk_qcom_rp_acs }, ++ /* QCOM Hamoa root port */ ++ { PCI_VENDOR_ID_QCOM, 0x0111, pci_quirk_qcom_rp_acs }, ++ /* QCOM Glymur root port */ ++ { PCI_VENDOR_ID_QCOM, 0x0120, pci_quirk_qcom_rp_acs }, + /* HXT SD4800 root ports. The ACS design is same as QCOM QDF2xxx */ + { PCI_VENDOR_ID_HXT, 0x0401, pci_quirk_qcom_rp_acs }, + /* Intel PCH root ports */ +-- +2.51.0 + diff --git a/queue-5.15/pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch b/queue-5.15/pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch new file mode 100644 index 00000000000..bf0f7466efb --- /dev/null +++ b/queue-5.15/pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch @@ -0,0 +1,94 @@ +From f00601bfd418c766c98e8a7678189f70c04a372d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 10:25:51 +0100 +Subject: PCI/AER: Clear stale errors on reporting agents upon probe + +From: Lukas Wunner + +[ Upstream commit e242d09b58e869f86071b7889acace4cff215935 ] + +Correctable and Uncorrectable Error Status Registers on reporting agents +are cleared upon PCI device enumeration in pci_aer_init() to flush past +events. They're cleared again when an error is handled by the AER driver. + +If an agent reports a new error after pci_aer_init() and before the AER +driver has probed on the corresponding Root Port or Root Complex Event +Collector, that error is not handled by the AER driver: It clears the +Root Error Status Register on probe, but neglects to re-clear the +Correctable and Uncorrectable Error Status Registers on reporting agents. + +The error will eventually be reported when another error occurs. Which +is irritating because to an end user it appears as if the earlier error +has just happened. + +Amend the AER driver to clear stale errors on reporting agents upon probe. + +Skip reporting agents which have not invoked pci_aer_init() yet to avoid +using an uninitialized pdev->aer_cap. They're recognizable by the error +bits in the Device Control register still being clear. + +Reporting agents may execute pci_aer_init() after the AER driver has +probed, particularly when devices are hotplugged or removed/rescanned via +sysfs. For this reason, it continues to be necessary that pci_aer_init() +clears Correctable and Uncorrectable Error Status Registers. + +Reported-by: Lucas Van # off-list +Signed-off-by: Lukas Wunner +Signed-off-by: Bjorn Helgaas +Tested-by: Lucas Van +Reviewed-by: Kuppuswamy Sathyanarayanan +Link: https://patch.msgid.link/3011c2ed30c11f858e35e29939add754adea7478.1769332702.git.lukas@wunner.de +Signed-off-by: Sasha Levin +--- + drivers/pci/pcie/aer.c | 26 +++++++++++++++++++++++++- + 1 file changed, 25 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c +index 81ea196ce843e..a8bec1c3c769a 100644 +--- a/drivers/pci/pcie/aer.c ++++ b/drivers/pci/pcie/aer.c +@@ -1257,6 +1257,20 @@ static void set_downstream_devices_error_reporting(struct pci_dev *dev, + + } + ++static int clear_status_iter(struct pci_dev *dev, void *data) ++{ ++ u16 devctl; ++ ++ /* Skip if pci_enable_pcie_error_reporting() hasn't been called yet */ ++ pcie_capability_read_word(dev, PCI_EXP_DEVCTL, &devctl); ++ if (!(devctl & PCI_EXP_AER_FLAGS)) ++ return 0; ++ ++ pci_aer_clear_status(dev); ++ pcie_clear_device_status(dev); ++ return 0; ++} ++ + /** + * aer_enable_rootport - enable Root Port's interrupts when receiving messages + * @rpc: pointer to a Root Port data structure +@@ -1278,9 +1292,19 @@ static void aer_enable_rootport(struct aer_rpc *rpc) + pcie_capability_clear_word(pdev, PCI_EXP_RTCTL, + SYSTEM_ERROR_INTR_ON_MESG_MASK); + +- /* Clear error status */ ++ /* Clear error status of this Root Port or RCEC */ + pci_read_config_dword(pdev, aer + PCI_ERR_ROOT_STATUS, ®32); + pci_write_config_dword(pdev, aer + PCI_ERR_ROOT_STATUS, reg32); ++ ++ /* Clear error status of agents reporting to this Root Port or RCEC */ ++ if (reg32 & AER_ERR_STATUS_MASK) { ++ if (pci_pcie_type(pdev) == PCI_EXP_TYPE_RC_EC) ++ pcie_walk_rcec(pdev, clear_status_iter, NULL); ++ else if (pdev->subordinate) ++ pci_walk_bus(pdev->subordinate, clear_status_iter, ++ NULL); ++ } ++ + pci_read_config_dword(pdev, aer + PCI_ERR_COR_STATUS, ®32); + pci_write_config_dword(pdev, aer + PCI_ERR_COR_STATUS, reg32); + pci_read_config_dword(pdev, aer + PCI_ERR_UNCOR_STATUS, ®32); +-- +2.51.0 + diff --git a/queue-5.15/pci-enable-acs-after-configuring-iommu-for-of-platfo.patch b/queue-5.15/pci-enable-acs-after-configuring-iommu-for-of-platfo.patch new file mode 100644 index 00000000000..1b2e7421da2 --- /dev/null +++ b/queue-5.15/pci-enable-acs-after-configuring-iommu-for-of-platfo.patch @@ -0,0 +1,136 @@ +From df05713e38db3cea4779ac2ef586636cf320a938 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jan 2026 21:04:47 +0530 +Subject: PCI: Enable ACS after configuring IOMMU for OF platforms + +From: Manivannan Sadhasivam + +[ Upstream commit c41e2fb67e26b04d919257875fa954aa5f6e392e ] + +Platform, ACPI, or IOMMU drivers call pci_request_acs(), which sets +'pci_acs_enable' to request that ACS be enabled for any devices enumerated +in the future. + +OF platforms called pci_enable_acs() for the first device before +of_iommu_configure() called pci_request_acs(), so ACS was never enabled for +that device (typically a Root Port). + +Call pci_enable_acs() later, from pci_dma_configure(), after +of_dma_configure() has had a chance to call pci_request_acs(). + +Here's the call path, showing the move of pci_enable_acs() from +pci_acs_init() to pci_dma_configure(), where it always happens after +pci_request_acs(): + + pci_device_add + pci_init_capabilities + pci_acs_init + - pci_enable_acs + - if (pci_acs_enable) <-- previous test + - ... + device_add + bus_notify(BUS_NOTIFY_ADD_DEVICE) + iommu_bus_notifier + iommu_probe_device + iommu_init_device + dev->bus->dma_configure + pci_dma_configure # pci_bus_type.dma_configure + of_dma_configure + of_iommu_configure + pci_request_acs + pci_acs_enable = 1 <-- set + + pci_enable_acs + + if (pci_acs_enable) <-- new test + + ... + bus_probe_device + device_initial_probe + ... + really_probe + dev->bus->dma_configure + pci_dma_configure # pci_bus_type.dma_configure + ... + pci_enable_acs + +Note that we will now call pci_enable_acs() twice for every device, first +from the iommu_probe_device() path and again from the really_probe() path. +Presumably that's not an issue since we also call dev->bus->dma_configure() +twice. + +For the ACPI platforms, pci_request_acs() is called during ACPI +initialization time itself, independent of the IOMMU framework. + +Signed-off-by: Manivannan Sadhasivam +[bhelgaas: commit log] +Signed-off-by: Bjorn Helgaas +Tested-by: Marek Szyprowski +Tested-by: Naresh Kamboju +Link: https://patch.msgid.link/20260102-pci_acs-v3-1-72280b94d288@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/pci/pci-driver.c | 8 ++++++++ + drivers/pci/pci.c | 10 +--------- + drivers/pci/pci.h | 1 + + 3 files changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c +index 08c985478b8ff..ecbe382b56be9 100644 +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -1616,6 +1616,14 @@ static int pci_dma_configure(struct device *dev) + ret = acpi_dma_configure(dev, acpi_get_dma_attr(adev)); + } + ++ /* ++ * Attempt to enable ACS regardless of capability because some Root ++ * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have ++ * the standard ACS capability but still support ACS via those ++ * quirks. ++ */ ++ pci_enable_acs(to_pci_dev(dev)); ++ + pci_put_host_bridge_device(bridge); + return ret; + } +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index b1690622f4235..220cef46989e8 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -936,7 +936,7 @@ static void pci_std_enable_acs(struct pci_dev *dev) + * pci_enable_acs - enable ACS if hardware support it + * @dev: the PCI device + */ +-static void pci_enable_acs(struct pci_dev *dev) ++void pci_enable_acs(struct pci_dev *dev) + { + if (!pci_acs_enable) + goto disable_acs_redir; +@@ -3609,14 +3609,6 @@ bool pci_acs_path_enabled(struct pci_dev *start, + void pci_acs_init(struct pci_dev *dev) + { + dev->acs_cap = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ACS); +- +- /* +- * Attempt to enable ACS regardless of capability because some Root +- * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have +- * the standard ACS capability but still support ACS via those +- * quirks. +- */ +- pci_enable_acs(dev); + } + + /** +diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h +index 4a8f499d278be..d9d7a79e3563e 100644 +--- a/drivers/pci/pci.h ++++ b/drivers/pci/pci.h +@@ -562,6 +562,7 @@ static inline resource_size_t pci_resource_alignment(struct pci_dev *dev, + } + + void pci_acs_init(struct pci_dev *dev); ++void pci_enable_acs(struct pci_dev *dev); + #ifdef CONFIG_PCI_QUIRKS + int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags); + int pci_dev_specific_enable_acs(struct pci_dev *dev); +-- +2.51.0 + diff --git a/queue-5.15/pci-fix-pci_slot_lock-device-locking.patch b/queue-5.15/pci-fix-pci_slot_lock-device-locking.patch new file mode 100644 index 00000000000..8646fff68ad --- /dev/null +++ b/queue-5.15/pci-fix-pci_slot_lock-device-locking.patch @@ -0,0 +1,97 @@ +From a7b5b8c32dded84fef4ba55a08011c8f77225b71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 08:59:51 -0800 +Subject: PCI: Fix pci_slot_lock () device locking + +From: Keith Busch + +[ Upstream commit 1f5e57c622b4dc9b8e7d291d560138d92cfbe5bf ] + +Like pci_bus_lock(), pci_slot_lock() needs to lock the bridge device to +prevent warnings like: + + pcieport 0000:e2:05.0: unlocked secondary bus reset via: pciehp_reset_slot+0x55/0xa0 + +Take and release the lock for the bridge providing the slot for the +lock/trylock and unlock routines. + +Signed-off-by: Keith Busch +Signed-off-by: Bjorn Helgaas +Reviewed-by: Dan Williams +Link: https://patch.msgid.link/20260130165953.751063-3-kbusch@meta.com +Signed-off-by: Sasha Levin +--- + drivers/pci/pci.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 9cf46bf7e1e7b..b1690622f4235 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -5555,10 +5555,9 @@ static int pci_bus_trylock(struct pci_bus *bus) + /* Do any devices on or below this slot prevent a bus reset? */ + static bool pci_slot_resetable(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; + +- if (slot->bus->self && +- (slot->bus->self->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET)) ++ if (bridge && (bridge->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET)) + return false; + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { +@@ -5575,7 +5574,10 @@ static bool pci_slot_resetable(struct pci_slot *slot) + /* Lock devices from the top of the tree down */ + static void pci_slot_lock(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; ++ ++ if (bridge) ++ pci_dev_lock(bridge); + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { + if (!dev->slot || dev->slot != slot) +@@ -5590,7 +5592,7 @@ static void pci_slot_lock(struct pci_slot *slot) + /* Unlock devices from the bottom of the tree up */ + static void pci_slot_unlock(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { + if (!dev->slot || dev->slot != slot) +@@ -5600,12 +5602,18 @@ static void pci_slot_unlock(struct pci_slot *slot) + else + pci_dev_unlock(dev); + } ++ ++ if (bridge) ++ pci_dev_unlock(bridge); + } + + /* Return 1 on successful lock, 0 on contention */ + static int pci_slot_trylock(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; ++ ++ if (bridge && !pci_dev_trylock(bridge)) ++ return 0; + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { + if (!dev->slot || dev->slot != slot) +@@ -5630,6 +5638,9 @@ static int pci_slot_trylock(struct pci_slot *slot) + else + pci_dev_unlock(dev); + } ++ ++ if (bridge) ++ pci_dev_unlock(bridge); + return 0; + } + +-- +2.51.0 + diff --git a/queue-5.15/pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch b/queue-5.15/pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch new file mode 100644 index 00000000000..cecc256fe9c --- /dev/null +++ b/queue-5.15/pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch @@ -0,0 +1,51 @@ +From 42b2a8df3dbbbb89e4307977a964218202809ed5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 17:02:08 -0700 +Subject: PCI: Mark ASM1164 SATA controller to avoid bus reset + +From: Alex Williamson + +[ Upstream commit beb2f81792a8a619e5122b6b24a374861309c54b ] + +User forums report issues when assigning ASM1164 SATA controllers to VMs, +especially in configurations with multiple controllers. Logs show the +device fails to retrain after bus reset. Reports suggest this is an issue +across multiple platforms. The device indicates support for PM reset, +therefore the device still has a viable function level reset mechanism. +The reporting user confirms the device is well behaved in this use case +with bus reset disabled. + +Reported-by: Patrick Bianchi +Link: https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/ +Signed-off-by: Alex Williamson +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20260109000211.398300-1-alex.williamson@nvidia.com +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 88922e21d440a..8ea3d2c9676d5 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3652,6 +3652,16 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_CAVIUM, 0xa100, quirk_no_bus_reset); + */ + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TI, 0xb005, quirk_no_bus_reset); + ++/* ++ * Reports from users making use of PCI device assignment with ASM1164 ++ * controllers indicate an issue with bus reset where the device fails to ++ * retrain. The issue appears more common in configurations with multiple ++ * controllers. The device does indicate PM reset support (NoSoftRst-), ++ * therefore this still leaves a viable reset method. ++ * https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/ ++ */ ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ASMEDIA, 0x1164, quirk_no_bus_reset); ++ + static void quirk_no_pm_reset(struct pci_dev *dev) + { + /* +-- +2.51.0 + diff --git a/queue-5.15/pci-mark-nvidia-gb10-to-avoid-bus-reset.patch b/queue-5.15/pci-mark-nvidia-gb10-to-avoid-bus-reset.patch new file mode 100644 index 00000000000..ec330c3a9de --- /dev/null +++ b/queue-5.15/pci-mark-nvidia-gb10-to-avoid-bus-reset.patch @@ -0,0 +1,47 @@ +From 6c1bdb63f6af8aba786aa833435e06efe29f3954 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Nov 2025 16:44:06 +0800 +Subject: PCI: Mark Nvidia GB10 to avoid bus reset + +From: Johnny-CC Chang + +[ Upstream commit c81a2ce6b6a844d1a57d2a69833a9d0f00403f00 ] + +After asserting Secondary Bus Reset to downstream devices via a GB10 Root +Port, the link may not retrain correctly, e.g., the link may retrain with a +lower lane count or config accesses to downstream devices may fail. + +Prevent use of Secondary Bus Reset for devices below GB10. + +Signed-off-by: Johnny-CC Chang +[bhelgaas: drop pci_ids.h update (only used once), update commit log] +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Link: https://patch.msgid.link/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 7a94236f1c2c6..d4a300766cbc3 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3609,6 +3609,14 @@ static void quirk_no_bus_reset(struct pci_dev *dev) + dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET; + } + ++/* ++ * After asserting Secondary Bus Reset to downstream devices via a GB10 ++ * Root Port, the link may not retrain correctly. ++ * https://lore.kernel.org/r/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com ++ */ ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22CE, quirk_no_bus_reset); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22D0, quirk_no_bus_reset); ++ + /* + * Some NVIDIA GPU devices do not work with bus reset, SBR needs to be + * prevented for those affected devices. +-- +2.51.0 + diff --git a/queue-5.15/perf-callchain-fix-srcline-printing-with-inlines.patch b/queue-5.15/perf-callchain-fix-srcline-printing-with-inlines.patch new file mode 100644 index 00000000000..a25c2ce5fba --- /dev/null +++ b/queue-5.15/perf-callchain-fix-srcline-printing-with-inlines.patch @@ -0,0 +1,55 @@ +From d0f7af75154e8a9c410eb585126fb3022ee62c50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 20:13:36 -0800 +Subject: perf callchain: Fix srcline printing with inlines + +From: Ian Rogers + +[ Upstream commit abec464767b5d26f0612250d511c18f420826ca1 ] + +sample__fprintf_callchain() was using map__fprintf_srcline() which won't +report inline line numbers. + +Fix by using the srcline from the callchain and falling back to the map +variant. + +Fixes: 25da4fab5f66e659 ("perf evsel: Move fprintf methods to separate source file") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Stephen Brennan +Cc: Tony Jones +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/evsel_fprintf.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/evsel_fprintf.c b/tools/perf/util/evsel_fprintf.c +index bfedd7b235211..2ef8e7cb0c86c 100644 +--- a/tools/perf/util/evsel_fprintf.c ++++ b/tools/perf/util/evsel_fprintf.c +@@ -171,8 +171,12 @@ int sample__fprintf_callchain(struct perf_sample *sample, int left_alignment, + printed += fprintf(fp, ")"); + } + +- if (print_srcline) +- printed += map__fprintf_srcline(map, addr, "\n ", fp); ++ if (print_srcline) { ++ if (node->srcline) ++ printed += fprintf(fp, "\n %s", node->srcline); ++ else ++ printed += map__fprintf_srcline(map, addr, "\n ", fp); ++ } + + if (sym && sym->inlined) + printed += fprintf(fp, " (inlined)"); +-- +2.51.0 + diff --git a/queue-5.15/phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch b/queue-5.15/phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch new file mode 100644 index 00000000000..6fcf7fd822c --- /dev/null +++ b/queue-5.15/phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch @@ -0,0 +1,38 @@ +From 1a54ef9d860aa62fe93b7329afbf87e14f24bc89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 19:17:12 +0800 +Subject: phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature + +From: Xu Yang + +[ Upstream commit 27ee0869d77b2cb404770ac49bdceae3aedf658b ] + +Disabling PHYs in runtime usually causes the client with external abort +exception or similar issue due to lack of API to notify clients about PHY +removal. This patch removes the possibility to unbind i.MX PHY drivers in +runtime. + +Signed-off-by: Xu Yang +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20260120111712.3159782-1-xu.yang_2@nxp.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c +index a29b4a6f7c249..c2a6e70493ff7 100644 +--- a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c ++++ b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c +@@ -192,6 +192,7 @@ static struct platform_driver imx8mq_usb_phy_driver = { + .driver = { + .name = "imx8mq-usb-phy", + .of_match_table = imx8mq_usb_phy_of_match, ++ .suppress_bind_attrs = true, + } + }; + module_platform_driver(imx8mq_usb_phy_driver); +-- +2.51.0 + diff --git a/queue-5.15/phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch b/queue-5.15/phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch new file mode 100644 index 00000000000..501232f80d3 --- /dev/null +++ b/queue-5.15/phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch @@ -0,0 +1,43 @@ +From 27446a91d60c6a885ecda0dcf7eeafe98396755a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 15:06:43 +0000 +Subject: phy: mvebu-cp110-utmi: fix dr_mode property read from dts + +From: Aleksandar Gerasimovski + +[ Upstream commit e2ce913452ab56b3330539cc443b97b7ea8c3a1a ] + +The problem with the current implementation is that it does not consider +that the USB controller can have multiple PHY handles with different +arguments count, as for example we have in our cn9131 based platform: +"phys = <&cp0_comphy1 0>, <&cp0_utmi0>;". + +In such case calling "of_usb_get_dr_mode_by_phy" with -1 (no phy-cells) +leads to not proper phy detection, taking the "marvell,cp110-utmi-phy" +dts definition we can call the "of_usb_get_dr_mode_by_phy" with 0 +(#phy-cells = <0>) and safely look for that phy. + +Signed-off-by: Aleksandar Gerasimovski +Link: https://patch.msgid.link/20260106150643.922110-1-aleksandar.gerasimovski@belden.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/marvell/phy-mvebu-cp110-utmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c +index 08d178a4dc13f..d5761681a253f 100644 +--- a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c ++++ b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c +@@ -326,7 +326,7 @@ static int mvebu_cp110_utmi_phy_probe(struct platform_device *pdev) + return -ENOMEM; + } + +- port->dr_mode = of_usb_get_dr_mode_by_phy(child, -1); ++ port->dr_mode = of_usb_get_dr_mode_by_phy(child, 0); + if ((port->dr_mode != USB_DR_MODE_HOST) && + (port->dr_mode != USB_DR_MODE_PERIPHERAL)) { + dev_err(&pdev->dev, +-- +2.51.0 + diff --git a/queue-5.15/pstore-ram_core-fix-incorrect-success-return-when-vm.patch b/queue-5.15/pstore-ram_core-fix-incorrect-success-return-when-vm.patch new file mode 100644 index 00000000000..5a1f311dd0c --- /dev/null +++ b/queue-5.15/pstore-ram_core-fix-incorrect-success-return-when-vm.patch @@ -0,0 +1,49 @@ +From 18ef846a00d1b49ffa16480b21f12171c5a0c831 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 10:03:58 +0800 +Subject: pstore: ram_core: fix incorrect success return when vmap() fails + +From: Ruipeng Qi + +[ Upstream commit 05363abc7625cf18c96e67f50673cd07f11da5e9 ] + +In persistent_ram_vmap(), vmap() may return NULL on failure. + +If offset is non-zero, adding offset_in_page(start) causes the function +to return a non-NULL pointer even though the mapping failed. +persistent_ram_buffer_map() therefore incorrectly returns success. + +Subsequent access to prz->buffer may dereference an invalid address +and cause crashes. + +Add proper NULL checking for vmap() failures. + +Signed-off-by: Ruipeng Qi +Link: https://patch.msgid.link/20260203020358.3315299-1-ruipengqi3@gmail.com +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + fs/pstore/ram_core.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c +index 8eb4bea7295b4..c0b3b9c6892d1 100644 +--- a/fs/pstore/ram_core.c ++++ b/fs/pstore/ram_core.c +@@ -457,6 +457,13 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size, + vaddr = vmap(pages, page_count, VM_MAP | VM_IOREMAP, prot); + kfree(pages); + ++ /* ++ * vmap() may fail and return NULL. Do not add the offset in this ++ * case, otherwise a NULL mapping would appear successful. ++ */ ++ if (!vaddr) ++ return NULL; ++ + /* + * Since vmap() uses page granularity, we must add the offset + * into the page here, to get the byte granularity address +-- +2.51.0 + diff --git a/queue-5.15/rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch b/queue-5.15/rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch new file mode 100644 index 00000000000..e3b48dd5342 --- /dev/null +++ b/queue-5.15/rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch @@ -0,0 +1,47 @@ +From b8a78bba356a7a20889438086d5309b080f9bb4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 17:15:16 +0100 +Subject: RDMA/rtrs-clt: For conn rejection use actual err number + +From: Md Haris Iqbal + +[ Upstream commit fc290630702b530c2969061e7ef0d869a5b6dc4f ] + +When the connection establishment request is rejected from the server +side, then the actual error number sent back should be used. + +Signed-off-by: Md Haris Iqbal +Link: https://patch.msgid.link/20260107161517.56357-10-haris.iqbal@ionos.com +Reviewed-by: Grzegorz Prajsner +Reviewed-by: Jack Wang +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +index cda7849e2133c..dbd51e5be3a6b 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +@@ -1911,7 +1911,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con, + struct rtrs_path *s = con->c.path; + const struct rtrs_msg_conn_rsp *msg; + const char *rej_msg; +- int status, errno; ++ int status, errno = -ECONNRESET; + u8 data_len; + + status = ev->status; +@@ -1933,7 +1933,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con, + status, rej_msg); + } + +- return -ECONNRESET; ++ return errno; + } + + void rtrs_clt_close_conns(struct rtrs_clt_path *clt_path, bool wait) +-- +2.51.0 + diff --git a/queue-5.15/remoteproc-mediatek-break-lock-dependency-to-prepare.patch b/queue-5.15/remoteproc-mediatek-break-lock-dependency-to-prepare.patch new file mode 100644 index 00000000000..a5fe0c06fe5 --- /dev/null +++ b/queue-5.15/remoteproc-mediatek-break-lock-dependency-to-prepare.patch @@ -0,0 +1,261 @@ +From 9cd2b20052283b2fe1953f46ee78eaba6a15805f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 11:07:55 +0000 +Subject: remoteproc: mediatek: Break lock dependency to `prepare_lock` + +From: Tzung-Bi Shih + +[ Upstream commit d935187cfb27fc4168f78f3959aef4eafaae76bb ] + +A potential circular locking dependency (ABBA deadlock) exists between +`ec_dev->lock` and the clock framework's `prepare_lock`. + +The first order (A -> B) occurs when scp_ipi_send() is called while +`ec_dev->lock` is held (e.g., within cros_ec_cmd_xfer()): +1. cros_ec_cmd_xfer() acquires `ec_dev->lock` and calls scp_ipi_send(). +2. scp_ipi_send() calls clk_prepare_enable(), which acquires + `prepare_lock`. +See #0 in the following example calling trace. +(Lock Order: `ec_dev->lock` -> `prepare_lock`) + +The reverse order (B -> A) is more complex and has been observed +(learned) by lockdep. It involves the clock prepare operation +triggering power domain changes, which then propagates through sysfs +and power supply uevents, eventually calling back into the ChromeOS EC +driver and attempting to acquire `ec_dev->lock`: +1. Something calls clk_prepare(), which acquires `prepare_lock`. It + then triggers genpd operations like genpd_runtime_resume(), which + takes `&genpd->mlock`. +2. Power domain changes can trigger regulator changes; regulator + changes can then trigger device link changes; device link changes + can then trigger sysfs changes. Eventually, power_supply_uevent() + is called. +3. This leads to calls like cros_usbpd_charger_get_prop(), which calls + cros_ec_cmd_xfer_status(), which then attempts to acquire + `ec_dev->lock`. +See #1 ~ #6 in the following example calling trace. +(Lock Order: `prepare_lock` -> `&genpd->mlock` -> ... -> `&ec_dev->lock`) + +Move the clk_prepare()/clk_unprepare() operations for `scp->clk` to the +remoteproc prepare()/unprepare() callbacks. This ensures `prepare_lock` +is only acquired in prepare()/unprepare() callbacks. Since +`ec_dev->lock` is not involved in the callbacks, the dependency loop is +broken. + +This means the clock is always "prepared" when the SCP is running. The +prolonged "prepared time" for the clock should be acceptable as SCP is +designed to be a very power efficient processor. The power consumption +impact can be negligible. + +A simplified calling trace reported by lockdep: +> -> #6 (&ec_dev->lock) +> cros_ec_cmd_xfer +> cros_ec_cmd_xfer_status +> cros_usbpd_charger_get_port_status +> cros_usbpd_charger_get_prop +> power_supply_get_property +> power_supply_show_property +> power_supply_uevent +> dev_uevent +> uevent_show +> dev_attr_show +> sysfs_kf_seq_show +> kernfs_seq_show +> -> #5 (kn->active#2) +> kernfs_drain +> __kernfs_remove +> kernfs_remove_by_name_ns +> sysfs_remove_file_ns +> device_del +> __device_link_del +> device_links_driver_bound +> -> #4 (device_links_lock) +> device_link_remove +> _regulator_put +> regulator_put +> -> #3 (regulator_list_mutex) +> regulator_lock_dependent +> regulator_disable +> scpsys_power_off +> _genpd_power_off +> genpd_power_off +> -> #2 (&genpd->mlock/1) +> genpd_add_subdomain +> pm_genpd_add_subdomain +> scpsys_add_subdomain +> scpsys_probe +> -> #1 (&genpd->mlock) +> genpd_runtime_resume +> __rpm_callback +> rpm_callback +> rpm_resume +> __pm_runtime_resume +> clk_core_prepare +> clk_prepare +> -> #0 (prepare_lock) +> clk_prepare +> scp_ipi_send +> scp_send_ipi +> mtk_rpmsg_send +> rpmsg_send +> cros_ec_pkt_xfer_rpmsg + +Signed-off-by: Tzung-Bi Shih +Reviewed-by: Chen-Yu Tsai +Tested-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20260112110755.2435899-1-tzungbi@kernel.org +Signed-off-by: Mathieu Poirier +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/mtk_scp.c | 39 +++++++++++++++++++++++--------- + drivers/remoteproc/mtk_scp_ipi.c | 4 ++-- + 2 files changed, 30 insertions(+), 13 deletions(-) + +diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c +index 211c7e3b848e4..bf9228bd5090f 100644 +--- a/drivers/remoteproc/mtk_scp.c ++++ b/drivers/remoteproc/mtk_scp.c +@@ -225,7 +225,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv) + struct mtk_scp *scp = priv; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(scp->dev, "failed to enable clocks\n"); + return IRQ_NONE; +@@ -233,7 +233,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv) + + scp->data->scp_irq_handler(scp); + +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + + return IRQ_HANDLED; + } +@@ -391,7 +391,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw) + struct device *dev = scp->dev; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(dev, "failed to enable clocks\n"); + return ret; +@@ -406,7 +406,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw) + + ret = scp_elf_load_segments(rproc, fw); + leave: +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + + return ret; + } +@@ -417,14 +417,14 @@ static int scp_parse_fw(struct rproc *rproc, const struct firmware *fw) + struct device *dev = scp->dev; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(dev, "failed to enable clocks\n"); + return ret; + } + + ret = scp_ipi_init(scp, fw); +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + return ret; + } + +@@ -435,7 +435,7 @@ static int scp_start(struct rproc *rproc) + struct scp_run *run = &scp->run; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(dev, "failed to enable clocks\n"); + return ret; +@@ -460,14 +460,14 @@ static int scp_start(struct rproc *rproc) + goto stop; + } + +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + dev_info(dev, "SCP is ready. FW version %s\n", run->fw_ver); + + return 0; + + stop: + scp->data->scp_reset_assert(scp); +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + return ret; + } + +@@ -548,7 +548,7 @@ static int scp_stop(struct rproc *rproc) + struct mtk_scp *scp = (struct mtk_scp *)rproc->priv; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(scp->dev, "failed to enable clocks\n"); + return ret; +@@ -556,12 +556,29 @@ static int scp_stop(struct rproc *rproc) + + scp->data->scp_reset_assert(scp); + scp->data->scp_stop(scp); +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + + return 0; + } + ++static int scp_prepare(struct rproc *rproc) ++{ ++ struct mtk_scp *scp = rproc->priv; ++ ++ return clk_prepare(scp->clk); ++} ++ ++static int scp_unprepare(struct rproc *rproc) ++{ ++ struct mtk_scp *scp = rproc->priv; ++ ++ clk_unprepare(scp->clk); ++ return 0; ++} ++ + static const struct rproc_ops scp_ops = { ++ .prepare = scp_prepare, ++ .unprepare = scp_unprepare, + .start = scp_start, + .stop = scp_stop, + .load = scp_load, +diff --git a/drivers/remoteproc/mtk_scp_ipi.c b/drivers/remoteproc/mtk_scp_ipi.c +index 968128b78e59c..3f657a662cc0e 100644 +--- a/drivers/remoteproc/mtk_scp_ipi.c ++++ b/drivers/remoteproc/mtk_scp_ipi.c +@@ -164,7 +164,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len, + WARN_ON(len > sizeof(send_obj->share_buf)) || WARN_ON(!buf)) + return -EINVAL; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(scp->dev, "failed to enable clock\n"); + return ret; +@@ -207,7 +207,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len, + + unlock_mutex: + mutex_unlock(&scp->send_lock); +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + + return ret; + } +-- +2.51.0 + diff --git a/queue-5.15/revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch b/queue-5.15/revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch new file mode 100644 index 00000000000..6662595abab --- /dev/null +++ b/queue-5.15/revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch @@ -0,0 +1,42 @@ +From 008b07bfb17cb7afb93104c097dcb1a54a847f36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 17:16:51 +0100 +Subject: Revert "mfd: da9052-spi: Change read-mask to write-mask" + +From: Marcus Folkesson + +[ Upstream commit 12daa9c1954542bf98bb942fb2dadf19de79a44b ] + +This reverts commit 2e3378f6c79a1b3f7855ded1ef306ea4406352ed. + +Almost every register in this chip can be customized via OTP +memory. Somehow the value for R19, which decide if the flag is set +on read or write operation, seems to have been overwritten for the chip +the original patch were written for. + +Revert the change to follow the default behavior. + +Signed-off-by: Marcus Folkesson +Link: https://patch.msgid.link/20251124-da9052-revert-v1-1-fbeb2c894002@gmail.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/da9052-spi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mfd/da9052-spi.c b/drivers/mfd/da9052-spi.c +index 06c500bf4d57e..5faf3766a5e20 100644 +--- a/drivers/mfd/da9052-spi.c ++++ b/drivers/mfd/da9052-spi.c +@@ -37,7 +37,7 @@ static int da9052_spi_probe(struct spi_device *spi) + spi_set_drvdata(spi, da9052); + + config = da9052_regmap_config; +- config.write_flag_mask = 1; ++ config.read_flag_mask = 1; + config.reg_bits = 7; + config.pad_bits = 1; + config.val_bits = 8; +-- +2.51.0 + diff --git a/queue-5.15/rnbd-srv-zero-the-rsp-buffer-before-using-it.patch b/queue-5.15/rnbd-srv-zero-the-rsp-buffer-before-using-it.patch new file mode 100644 index 00000000000..6f9f9e87b6f --- /dev/null +++ b/queue-5.15/rnbd-srv-zero-the-rsp-buffer-before-using-it.patch @@ -0,0 +1,47 @@ +From 1713229227e906a052245bdeeabf9d49b68f05df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 13:47:33 +0100 +Subject: rnbd-srv: Zero the rsp buffer before using it + +From: Md Haris Iqbal + +[ Upstream commit 69d26698e4fd44935510553809007151b2fe4db5 ] + +Before using the data buffer to send back the response message, zero it +completely. This prevents any stray bytes to be picked up by the client +side when there the message is exchanged between different protocol +versions. + +Signed-off-by: Md Haris Iqbal +Signed-off-by: Jack Wang +Signed-off-by: Grzegorz Prajsner +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/rnbd/rnbd-srv.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c +index 86a6242d9c205..3af8c4e49fe4c 100644 +--- a/drivers/block/rnbd/rnbd-srv.c ++++ b/drivers/block/rnbd/rnbd-srv.c +@@ -546,6 +546,8 @@ static void rnbd_srv_fill_msg_open_rsp(struct rnbd_msg_open_rsp *rsp, + struct rnbd_dev *rnbd_dev = sess_dev->rnbd_dev; + struct request_queue *q = bdev_get_queue(rnbd_dev->bdev); + ++ memset(rsp, 0, sizeof(*rsp)); ++ + rsp->hdr.type = cpu_to_le16(RNBD_MSG_OPEN_RSP); + rsp->device_id = + cpu_to_le32(sess_dev->device_id); +@@ -663,6 +665,7 @@ static int process_msg_sess_info(struct rnbd_srv_session *srv_sess, + srv_sess->sessname, srv_sess->ver, + sess_info_msg->ver, RNBD_PROTO_VER_MAJOR); + ++ memset(rsp, 0, sizeof(*rsp)); + rsp->hdr.type = cpu_to_le16(RNBD_MSG_SESS_INFO_RSP); + rsp->ver = srv_sess->ver; + +-- +2.51.0 + diff --git a/queue-5.15/rtc-interface-alarm-race-handling-should-not-discard.patch b/queue-5.15/rtc-interface-alarm-race-handling-should-not-discard.patch new file mode 100644 index 00000000000..a363835dae7 --- /dev/null +++ b/queue-5.15/rtc-interface-alarm-race-handling-should-not-discard.patch @@ -0,0 +1,53 @@ +From 16c7a73b9f4222a8b5e8f8421e5083b3e3dea7bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 17:35:19 +0000 +Subject: rtc: interface: Alarm race handling should not discard preceding + error + +From: Anthony Pighin (Nokia) + +[ Upstream commit 81be22cd4ace020045cc6d31255c6f7c071eb7c0 ] + +Commit 795cda8338ea ("rtc: interface: Fix long-standing race when setting +alarm") should not discard any errors from the preceding validations. + +Prior to that commit, if the alarm feature was disabled, or the +set_alarm failed, a meaningful error code would be returned to the +caller for further action. + +After, more often than not, the __rtc_read_time will cause a success +return code instead, misleading the caller. + +An example of this is when timer_enqueue is called for a rtc-abx080x +device. Since that driver does not clear the alarm feature bit, but +instead relies on the set_alarm operation to return invalid, the discard +of the return code causes very different behaviour; i.e. + hwclock: select() to /dev/rtc0 to wait for clock tick timed out + +Fixes: 795cda8338ea ("rtc: interface: Fix long-standing race when setting alarm") +Signed-off-by: Anthony Pighin (Nokia) +Reviewed-by: Esben Haabendal +Tested-by: Nick Bowler +Link: https://patch.msgid.link/BN0PR08MB6951415A751F236375A2945683D1A@BN0PR08MB6951.namprd08.prod.outlook.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/interface.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c +index e91ab1df4c6b8..5a3e0f3fcd8d7 100644 +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -456,7 +456,7 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm) + * are in, we can return -ETIME to signal that the timer has already + * expired, which is true in both cases. + */ +- if ((scheduled - now) <= 1) { ++ if (!err && (scheduled - now) <= 1) { + err = __rtc_read_time(rtc, &tm); + if (err) + return err; +-- +2.51.0 + diff --git a/queue-5.15/s390-perf-disable-register-readout-on-sampling-event.patch b/queue-5.15/s390-perf-disable-register-readout-on-sampling-event.patch new file mode 100644 index 00000000000..91b2d039297 --- /dev/null +++ b/queue-5.15/s390-perf-disable-register-readout-on-sampling-event.patch @@ -0,0 +1,53 @@ +From a69e977bd6b096422063874c5ce7d55da7a9442c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 10:14:12 +0100 +Subject: s390/perf: Disable register readout on sampling events + +From: Thomas Richter + +[ Upstream commit b2c04fc1239062b39ddfdd8731ee1a10810dfb74 ] + +Running commands + # ./perf record -IR0,R1 -a sleep 1 +extracts and displays register value of general purpose register r1 and r0. +However the value displayed of any register is random and does not +reflect the register value recorded at the time of the sample interrupt. + +The sampling device driver on s390 creates a very large buffer +for the hardware to store the samples. Only when that large buffer +gets full an interrupt is generated and many hundreds of sample +entries are processed and copied to the kernel ring buffer and +eventually get copied to the perf tool. It is during the copy +to the kernel ring buffer that each sample is processed (on s390) +and at that time the register values are extracted. +This is not the original goal, the register values should be read +when the samples are created not when the samples are copied to the +kernel ring buffer. + +Prevent this event from being installed in the first place and +return -EOPNOTSUPP. This is already the case for PERF_SAMPLE_REGS_USER. + +Signed-off-by: Thomas Richter +Reviewed-by: Jan Polensky +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/perf_cpum_sf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c +index 22893bf86f650..b7606b80388bc 100644 +--- a/arch/s390/kernel/perf_cpum_sf.c ++++ b/arch/s390/kernel/perf_cpum_sf.c +@@ -887,7 +887,7 @@ static bool is_callchain_event(struct perf_event *event) + u64 sample_type = event->attr.sample_type; + + return sample_type & (PERF_SAMPLE_CALLCHAIN | PERF_SAMPLE_REGS_USER | +- PERF_SAMPLE_STACK_USER); ++ PERF_SAMPLE_REGS_INTR | PERF_SAMPLE_STACK_USER); + } + + static int cpumsf_pmu_event_init(struct perf_event *event) +-- +2.51.0 + diff --git a/queue-5.15/s390-purgatory-add-wno-default-const-init-unsafe-to-.patch b/queue-5.15/s390-purgatory-add-wno-default-const-init-unsafe-to-.patch new file mode 100644 index 00000000000..f19254095bb --- /dev/null +++ b/queue-5.15/s390-purgatory-add-wno-default-const-init-unsafe-to-.patch @@ -0,0 +1,45 @@ +From 3929b439716804ceba487013a59ffe7933228082 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Dec 2025 16:47:07 +0100 +Subject: s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS + +From: Heiko Carstens + +[ Upstream commit b4780fe4ddf04b51127a33d705f4a2e224df00fa ] + +Add -Wno-default-const-init-unsafe to purgatory KBUILD_CFLAGS, similar +to scripts/Makefile.extrawarn, since clang generates warnings for the +dummy variable in typecheck(): + + CC arch/s390/purgatory/purgatory.o + arch/s390/include/asm/ptrace.h:221:9: warning: default initialization of an object of type 'typeof (regs->psw)' (aka 'const psw_t') leaves the object uninitialized [-Wdefault-const-init-var-unsafe] + 221 | return psw_bits(regs->psw).pstate; + | ^ + arch/s390/include/asm/ptrace.h:98:2: note: expanded from macro 'psw_bits' + 98 | typecheck(psw_t, __psw); \ + | ^ + include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck' + 11 | typeof(x) __dummy2; \ + | ^ + +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/purgatory/Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/s390/purgatory/Makefile b/arch/s390/purgatory/Makefile +index 414ba87e038b6..c5e4a1ed820df 100644 +--- a/arch/s390/purgatory/Makefile ++++ b/arch/s390/purgatory/Makefile +@@ -29,6 +29,7 @@ KBUILD_CFLAGS += -fno-stack-protector + KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING + KBUILD_CFLAGS += $(CLANG_FLAGS) + KBUILD_CFLAGS += $(call cc-option,-fno-PIE) ++KBUILD_CFLAGS += $(call cc-option, -Wno-default-const-init-unsafe) + KBUILD_AFLAGS := $(filter-out -DCC_USING_EXPOLINE,$(KBUILD_AFLAGS)) + + # Since we link purgatory with -r unresolved symbols are not checked, so we +-- +2.51.0 + diff --git a/queue-5.15/scsi-buslogic-reduce-stack-usage.patch b/queue-5.15/scsi-buslogic-reduce-stack-usage.patch new file mode 100644 index 00000000000..79d25c47dee --- /dev/null +++ b/queue-5.15/scsi-buslogic-reduce-stack-usage.patch @@ -0,0 +1,66 @@ +From ac4f3e71049e780654a494f0b5aa4974d308033d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 17:33:15 +0100 +Subject: scsi: buslogic: Reduce stack usage + +From: Arnd Bergmann + +[ Upstream commit e17f0d4cc006265dd92129db4bf9da3a2e4a4f66 ] + +Some randconfig builds run into excessive stack usage with gcc-14 or +higher, which use __attribute__((cold)) where earlier versions did not do +that: + +drivers/scsi/BusLogic.c: In function 'blogic_init': +drivers/scsi/BusLogic.c:2398:1: error: the frame size of 1680 bytes is larger than 1536 bytes [-Werror=frame-larger-than=] + +The problem is that a lot of code gets inlined into blogic_init() here. Two +functions stick out, but they are a bit different: + + - blogic_init_probeinfo_list() actually uses a few hundred bytes of kernel + stack, which is a problem in combination with other functions that also + do. Marking this one as noinline means that the stack slots get get + reused between function calls + + - blogic_reportconfig() has a few large variables, but whenever it is not + inlined into its caller, the compiler is actually smart enough to reuse + stack slots for these automatically, so marking it as noinline saves + most of the stack space by itself. + +The combination of both of these should avoid the problem entirely. + +Signed-off-by: Arnd Bergmann +Link: https://patch.msgid.link/20260203163321.2598593-1-arnd@kernel.org +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/BusLogic.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c +index 40088dcb98cd8..ee90509b5c760 100644 +--- a/drivers/scsi/BusLogic.c ++++ b/drivers/scsi/BusLogic.c +@@ -919,7 +919,8 @@ static int __init blogic_init_fp_probeinfo(struct blogic_adapter *adapter) + a particular probe order. + */ + +-static void __init blogic_init_probeinfo_list(struct blogic_adapter *adapter) ++static noinline_for_stack void __init ++blogic_init_probeinfo_list(struct blogic_adapter *adapter) + { + /* + If a PCI BIOS is present, interrogate it for MultiMaster and +@@ -1689,7 +1690,8 @@ static bool __init blogic_rdconfig(struct blogic_adapter *adapter) + blogic_reportconfig reports the configuration of Host Adapter. + */ + +-static bool __init blogic_reportconfig(struct blogic_adapter *adapter) ++static noinline_for_stack bool __init ++blogic_reportconfig(struct blogic_adapter *adapter) + { + unsigned short alltgt_mask = (1 << adapter->maxdev) - 1; + unsigned short sync_ok, fast_ok; +-- +2.51.0 + diff --git a/queue-5.15/serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch b/queue-5.15/serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch new file mode 100644 index 00000000000..9706d34047f --- /dev/null +++ b/queue-5.15/serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch @@ -0,0 +1,46 @@ +From e8906219d62caa77af4fea960fbbac24cc534e5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 13:48:29 +0530 +Subject: serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA + termination is done + +From: Moteen Shah + +[ Upstream commit a5fd8945a478ff9be14812693891d7c9b4185a50 ] + +Clear rx_running flag only after DMA teardown polling completes. In the +previous implementation the flag was being cleared while hardware teardown +was still in progress, creating a mismatch between software state +(flag = 0, "ready") and hardware state (still terminating). + +Signed-off-by: Moteen Shah +Link: https://patch.msgid.link/20260112081829.63049-3-m-shah@ti.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 3baa37d26bc64..0d9fd4837ce96 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -849,7 +849,6 @@ static void __dma_rx_do_complete(struct uart_8250_port *p) + goto out; + + cookie = dma->rx_cookie; +- dma->rx_running = 0; + + /* Re-enable RX FIFO interrupt now that transfer is complete */ + if (priv->habit & UART_HAS_RHR_IT_DIS) { +@@ -883,6 +882,7 @@ static void __dma_rx_do_complete(struct uart_8250_port *p) + goto out; + ret = tty_insert_flip_string(tty_port, dma->rx_buf, count); + ++ dma->rx_running = 0; + p->port.icount.rx += ret; + p->port.icount.buf_overrun += count - ret; + out: +-- +2.51.0 + diff --git a/queue-5.15/serial-8250_dw-handle-clock-enable-errors-in-runtime.patch b/queue-5.15/serial-8250_dw-handle-clock-enable-errors-in-runtime.patch new file mode 100644 index 00000000000..7abb0e70265 --- /dev/null +++ b/queue-5.15/serial-8250_dw-handle-clock-enable-errors-in-runtime.patch @@ -0,0 +1,57 @@ +From 3d7faf36fb83fe75b1d6ca3395a7f3ffee430e46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 17:54:25 +0300 +Subject: serial: 8250_dw: handle clock enable errors in runtime_resume + +From: Artem Shimko + +[ Upstream commit d31228143a489ba6ba797896a07541ce06828c09 ] + +Add error checking for clk_prepare_enable() calls in +dw8250_runtime_resume(). Currently if either clock fails to enable, +the function returns success while leaving clocks in inconsistent state. + +This change implements comprehensive error handling by checking the return +values of both clk_prepare_enable() calls. If the second clock enable +operation fails after the first clock has already been successfully +enabled, the code now properly cleans up by disabling and unpreparing +the first clock before returning. The error code is then propagated to +the caller, ensuring that clock enable failures are properly reported +rather than being silently ignored. + +Signed-off-by: Artem Shimko +Link: https://patch.msgid.link/20251104145433.2316165-2-a.shimko.dev@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_dw.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c +index bcf770f344dac..211dc88ce4e2c 100644 +--- a/drivers/tty/serial/8250/8250_dw.c ++++ b/drivers/tty/serial/8250/8250_dw.c +@@ -684,11 +684,18 @@ static int dw8250_runtime_suspend(struct device *dev) + + static int dw8250_runtime_resume(struct device *dev) + { ++ int ret; + struct dw8250_data *data = dev_get_drvdata(dev); + +- clk_prepare_enable(data->pclk); ++ ret = clk_prepare_enable(data->pclk); ++ if (ret) ++ return ret; + +- clk_prepare_enable(data->clk); ++ ret = clk_prepare_enable(data->clk); ++ if (ret) { ++ clk_disable_unprepare(data->pclk); ++ return ret; ++ } + + return 0; + } +-- +2.51.0 + diff --git a/queue-5.15/series b/queue-5.15/series index ae596c721d0..cd5e3c32e4f 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -178,3 +178,133 @@ ext4-use-optimized-mballoc-scanning-regardless-of-inode-format.patch ata-pata_ftide010-fix-some-dma-timings.patch sunrpc-auth_gss-fix-memory-leaks-in-xdr-decoding-error-paths.patch sunrpc-fix-gss_auth-kref-leak-in-gss_alloc_msg-error-path.patch +perf-callchain-fix-srcline-printing-with-inlines.patch +libperf-don-t-remove-g-when-extra_cflags-are-used.patch +libperf-build-always-place-libperf-includes-first.patch +rtc-interface-alarm-race-handling-should-not-discard.patch +audit-add-fchmodat2-to-change-attributes-class.patch +hfsplus-fix-volume-corruption-issue-for-generic-498.patch +audit-add-missing-syscalls-to-read-class.patch +hfsplus-pretend-special-inodes-as-regular-files.patch +i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch +minix-add-required-sanity-checking-to-minix_check_su.patch +gfs2-fiemap-page-fault-fix.patch +tools-power-cpupower-reset-errno-before-strtoull.patch +s390-purgatory-add-wno-default-const-init-unsafe-to-.patch +arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch +rnbd-srv-zero-the-rsp-buffer-before-using-it.patch +x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch +efi-cper-don-t-dump-the-entire-memory-region.patch +apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch +efi-cper-don-t-go-past-the-arm-processor-cper-record.patch +acpi-processor-fix-null-pointer-dereference-in-acpi_.patch +acpica-abort-aml-bytecode-execution-when-executing-a.patch +s390-perf-disable-register-readout-on-sampling-event.patch +xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch +blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch +sparc-synchronize-user-stack-on-fork-and-clone.patch +sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch +bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch +clocksource-drivers-sh_tmu-always-leave-device-runni.patch +clocksource-drivers-timer-integrator-ap-add-missing-.patch +mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch +char-tpm-cr50-remove-irqf_oneshot.patch +pstore-ram_core-fix-incorrect-success-return-when-vm.patch +arm64-tegra-smaug-add-usb-role-switch-support.patch +parisc-prevent-interrupts-during-reboot.patch +media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch +spi-stm32-fix-overrun-issue-at-8bpw.patch +drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch +media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch +media-omap3isp-isppreview-always-clamp-in-preview_tr.patch +media-omap3isp-set-initial-format.patch +asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch +asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch +media-adv7180-fix-frame-interval-in-progressive-mode.patch +media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch +media-solo6x10-check-for-out-of-bounds-chip_id.patch +media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch +drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch +drm-account-property-blob-allocations-to-memcg.patch +hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch +virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch +drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch +drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch +drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch +hid-multitouch-add-egalaxtouch-exc3188-support.patch +hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch +gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch +spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch +asoc-es8328-add-error-unwind-in-resume.patch +modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch +alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch +jfs-add-missing-set_freezable-for-freezable-kthread.patch +jfs-nlink-overflow-in-jfs_rename.patch +dm-remove-fake-timeout-to-avoid-leak-request.patch +iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch +wifi-libertas-fix-warning-in-usb_tx_block.patch +ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch +ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch +ext4-mark-group-add-fast-commit-ineligible.patch +ext4-mark-group-extend-fast-commit-ineligible.patch +netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch +netfilter-xt_tcpmss-check-remaining-length-before-re.patch +openrisc-define-arch-specific-version-of-nop.patch +net-usb-r8152-fix-transmit-queue-timeout.patch +net-rds-no-shortcut-out-of-rds_conn_error.patch +net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch +wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch +wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch +ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch +bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch +bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch +octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch +wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch +net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch +vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch +net-rds-clear-reconnect-pending-bit.patch +pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch +pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch +pci-fix-pci_slot_lock-device-locking.patch +pci-enable-acs-after-configuring-iommu-for-of-platfo.patch +pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch +pci-mark-nvidia-gb10-to-avoid-bus-reset.patch +myri10ge-avoid-uninitialized-variable-use.patch +nfc-nxp-nci-remove-interrupt-trigger-type.patch +rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch +scsi-buslogic-reduce-stack-usage.patch +tracing-fix-false-sharing-in-hwlat-get_sample.patch +mailbox-sprd-mask-interrupts-that-are-not-handled.patch +remoteproc-mediatek-break-lock-dependency-to-prepare.patch +mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch +clk-microchip-core-correct-return-value-on-_get_pare.patch +m68k-nommu-fix-memmove-with-differently-aligned-src-.patch +staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch +serial-8250_dw-handle-clock-enable-errors-in-runtime.patch +misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch +staging-rtl8723bs-fix-memory-leak-on-failure-path.patch +serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch +fix-it87_wdt-early-reboot-by-reporting-running-timer.patch +binder-don-t-use-pk-through-printk.patch +phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch +phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch +revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch +iio-use-irqf_no_thread.patch +iio-magnetometer-remove-irqf_oneshot.patch +mips-loongson-make-cpumask_of_node-robust-against-nu.patch +fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch +fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch +fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch +fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch +libceph-define-and-enforce-ceph_max_key_len.patch +include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch +arm-9467-1-mm-don-t-use-pk-through-printk.patch +drm-amd-display-avoid-updating-surface-with-the-same.patch +drm-amdgpu-adjust-usleep_range-in-fence-wait.patch +alsa-usb-audio-update-the-number-of-packets-properly.patch +drm-amdgpu-add-hainan-clock-adjustment.patch +drm-radeon-add-hainan-clock-adjustment.patch +alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch +btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch +ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch +ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch diff --git a/queue-5.15/sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch b/queue-5.15/sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch new file mode 100644 index 00000000000..b92fd5428c7 --- /dev/null +++ b/queue-5.15/sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch @@ -0,0 +1,50 @@ +From cce34539e29c56a7d6cb30545a274640e2beab56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 13:40:29 +0000 +Subject: sparc: don't reference obsolete termio struct for TC* constants + +From: Sam James + +[ Upstream commit be0bccffcde3308150d2a90e55fc10e249098909 ] + +Similar in nature to commit ab107276607a ("powerpc: Fix struct termio related ioctl macros"). + +glibc-2.42 drops the legacy termio struct, but the ioctls.h header still +defines some TC* constants in terms of termio (via sizeof). Hardcode the +values instead. + +This fixes building Python for example, which falls over like: + ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio' + +Link: https://bugs.gentoo.org/961769 +Link: https://bugs.gentoo.org/962600 +Signed-off-by: Sam James +Reviewed-by: Andreas Larsson +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/include/uapi/asm/ioctls.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/sparc/include/uapi/asm/ioctls.h b/arch/sparc/include/uapi/asm/ioctls.h +index 7fd2f5873c9e7..a8bbdf9877a41 100644 +--- a/arch/sparc/include/uapi/asm/ioctls.h ++++ b/arch/sparc/include/uapi/asm/ioctls.h +@@ -5,10 +5,10 @@ + #include + + /* Big T */ +-#define TCGETA _IOR('T', 1, struct termio) +-#define TCSETA _IOW('T', 2, struct termio) +-#define TCSETAW _IOW('T', 3, struct termio) +-#define TCSETAF _IOW('T', 4, struct termio) ++#define TCGETA 0x40125401 /* _IOR('T', 1, struct termio) */ ++#define TCSETA 0x80125402 /* _IOW('T', 2, struct termio) */ ++#define TCSETAW 0x80125403 /* _IOW('T', 3, struct termio) */ ++#define TCSETAF 0x80125404 /* _IOW('T', 4, struct termio) */ + #define TCSBRK _IO('T', 5) + #define TCXONC _IO('T', 6) + #define TCFLSH _IO('T', 7) +-- +2.51.0 + diff --git a/queue-5.15/sparc-synchronize-user-stack-on-fork-and-clone.patch b/queue-5.15/sparc-synchronize-user-stack-on-fork-and-clone.patch new file mode 100644 index 00000000000..23afa8f9827 --- /dev/null +++ b/queue-5.15/sparc-synchronize-user-stack-on-fork-and-clone.patch @@ -0,0 +1,114 @@ +From 8e29f0a07c5241b552e0c1c549dcb17fed80e0eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 15:47:52 +0100 +Subject: sparc: Synchronize user stack on fork and clone + +From: Andreas Larsson + +[ Upstream commit e38eba3b77878ada327a572a41596a3b0b44e522 ] + +Flush all uncommitted user windows before calling the generic syscall +handlers for clone, fork, and vfork. + +Prior to entering the arch common handlers sparc_{clone|fork|vfork}, the +arch-specific syscall wrappers for these syscalls will attempt to flush +all windows (including user windows). + +In the window overflow trap handlers on both SPARC{32|64}, +if the window can't be stored (i.e due to MMU related faults) the routine +backups the user window and increments a thread counter (wsaved). + +By adding a synchronization point after the flush attempt, when fault +handling is enabled, any uncommitted user windows will be flushed. + +Link: https://sourceware.org/bugzilla/show_bug.cgi?id=31394 +Closes: https://lore.kernel.org/sparclinux/fe5cc47167430007560501aabb28ba154985b661.camel@physik.fu-berlin.de/ +Signed-off-by: Andreas Larsson +Signed-off-by: Ludwig Rydberg +Tested-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/20260119144753.27945-2-ludwig.rydberg@gaisler.com +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/kernel/process.c | 38 +++++++++++++++++++++++-------------- + 1 file changed, 24 insertions(+), 14 deletions(-) + +diff --git a/arch/sparc/kernel/process.c b/arch/sparc/kernel/process.c +index 0442ab00518d3..7d69877511fac 100644 +--- a/arch/sparc/kernel/process.c ++++ b/arch/sparc/kernel/process.c +@@ -17,14 +17,18 @@ + + asmlinkage long sparc_fork(struct pt_regs *regs) + { +- unsigned long orig_i1 = regs->u_regs[UREG_I1]; ++ unsigned long orig_i1; + long ret; + struct kernel_clone_args args = { + .exit_signal = SIGCHLD, +- /* Reuse the parent's stack for the child. */ +- .stack = regs->u_regs[UREG_FP], + }; + ++ synchronize_user_stack(); ++ ++ orig_i1 = regs->u_regs[UREG_I1]; ++ /* Reuse the parent's stack for the child. */ ++ args.stack = regs->u_regs[UREG_FP]; ++ + ret = kernel_clone(&args); + + /* If we get an error and potentially restart the system +@@ -40,16 +44,19 @@ asmlinkage long sparc_fork(struct pt_regs *regs) + + asmlinkage long sparc_vfork(struct pt_regs *regs) + { +- unsigned long orig_i1 = regs->u_regs[UREG_I1]; ++ unsigned long orig_i1; + long ret; +- + struct kernel_clone_args args = { + .flags = CLONE_VFORK | CLONE_VM, + .exit_signal = SIGCHLD, +- /* Reuse the parent's stack for the child. */ +- .stack = regs->u_regs[UREG_FP], + }; + ++ synchronize_user_stack(); ++ ++ orig_i1 = regs->u_regs[UREG_I1]; ++ /* Reuse the parent's stack for the child. */ ++ args.stack = regs->u_regs[UREG_FP]; ++ + ret = kernel_clone(&args); + + /* If we get an error and potentially restart the system +@@ -65,15 +72,18 @@ asmlinkage long sparc_vfork(struct pt_regs *regs) + + asmlinkage long sparc_clone(struct pt_regs *regs) + { +- unsigned long orig_i1 = regs->u_regs[UREG_I1]; +- unsigned int flags = lower_32_bits(regs->u_regs[UREG_I0]); ++ unsigned long orig_i1; ++ unsigned int flags; + long ret; ++ struct kernel_clone_args args = {0}; + +- struct kernel_clone_args args = { +- .flags = (flags & ~CSIGNAL), +- .exit_signal = (flags & CSIGNAL), +- .tls = regs->u_regs[UREG_I3], +- }; ++ synchronize_user_stack(); ++ ++ orig_i1 = regs->u_regs[UREG_I1]; ++ flags = lower_32_bits(regs->u_regs[UREG_I0]); ++ args.flags = (flags & ~CSIGNAL); ++ args.exit_signal = (flags & CSIGNAL); ++ args.tls = regs->u_regs[UREG_I3]; + + #ifdef CONFIG_COMPAT + if (test_thread_flag(TIF_32BIT)) { +-- +2.51.0 + diff --git a/queue-5.15/spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch b/queue-5.15/spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch new file mode 100644 index 00000000000..97ad734c3a8 --- /dev/null +++ b/queue-5.15/spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch @@ -0,0 +1,60 @@ +From 484ddfaeec55ce95440c17ecd874722658e304de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 20:30:04 +0800 +Subject: spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end + +From: Chin-Ting Kuo + +[ Upstream commit 53f826ff5e0e3ecb279862ca7cce1491b94bb017 ] + +spi_mem_dirmap_create() may reconfigure controller-wide settings, +which can interfere with concurrent transfers to other devices +sharing the same SPI controller but using different chip selects. + +Wrap the ->dirmap_create() callback with spi_mem_access_start() and +spi_mem_access_end() to serialize access and prevent cross-CS +interference during dirmap creation. + +This patch has been verified on a setup where a SPI TPM is connected +to CS0 of a SPI controller, while a SPI NOR flash is connected to CS1 +of the same controller. Without this patch, spi_mem_dirmap_create() +for the SPI NOR flash interferes with ongoing SPI TPM data transfers, +resulting in failure to create the TPM device. This was tested on an +ASPEED AST2700 EVB. + +Signed-off-by: Chin-Ting Kuo +Reviewed-by: Paul Menzel +Link: https://patch.msgid.link/20260120123005.1392071-2-chin-ting_kuo@aspeedtech.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-mem.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c +index 37f4443ce9a09..fa1cd68625553 100644 +--- a/drivers/spi/spi-mem.c ++++ b/drivers/spi/spi-mem.c +@@ -540,9 +540,18 @@ spi_mem_dirmap_create(struct spi_mem *mem, + + desc->mem = mem; + desc->info = *info; +- if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create) ++ if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create) { ++ ret = spi_mem_access_start(mem); ++ if (ret) { ++ kfree(desc); ++ return ERR_PTR(ret); ++ } ++ + ret = ctlr->mem_ops->dirmap_create(desc); + ++ spi_mem_access_end(mem); ++ } ++ + if (ret) { + desc->nodirmap = true; + if (!spi_mem_supports_op(desc->mem, &desc->info.op_tmpl)) +-- +2.51.0 + diff --git a/queue-5.15/spi-stm32-fix-overrun-issue-at-8bpw.patch b/queue-5.15/spi-stm32-fix-overrun-issue-at-8bpw.patch new file mode 100644 index 00000000000..46518730aa8 --- /dev/null +++ b/queue-5.15/spi-stm32-fix-overrun-issue-at-8bpw.patch @@ -0,0 +1,53 @@ +From 619d66e6841a985fc5eb204e1a1180ab0cff97fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Dec 2025 11:48:28 +0100 +Subject: spi: stm32: fix Overrun issue at < 8bpw + +From: Deepak Kumar + +[ Upstream commit 1ac3be217c01d5df55ec5052f81e4f1708f46552 ] + +When SPI communication is suspended by hardware automatically, it could +happen that few bits of next frame are already clocked out due to +internal synchronization delay. + +To achieve a safe suspension, we need to ensure that each word must be +at least 8 SPI clock cycles long. That's why, if bpw is less than 8 +bits, we need to use midi to reach 8 SPI clock cycles at least. + +This will ensure that each word achieve safe suspension and prevent +overrun condition. + +Signed-off-by: Deepak Kumar +Signed-off-by: Alain Volmat +Link: https://patch.msgid.link/20251218-stm32-spi-enhancements-v2-2-3b69901ca9fe@foss.st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index e8d21c93ed7ef..4500c4a4aed0c 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -1486,11 +1486,12 @@ static void stm32h7_spi_data_idleness(struct stm32_spi *spi, u32 len) + cfg2_clrb |= STM32H7_SPI_CFG2_MIDI; + if ((len > 1) && (spi->cur_midi > 0)) { + u32 sck_period_ns = DIV_ROUND_UP(NSEC_PER_SEC, spi->cur_speed); +- u32 midi = min_t(u32, +- DIV_ROUND_UP(spi->cur_midi, sck_period_ns), +- FIELD_GET(STM32H7_SPI_CFG2_MIDI, +- STM32H7_SPI_CFG2_MIDI)); ++ u32 midi = DIV_ROUND_UP(spi->cur_midi, sck_period_ns); + ++ if ((spi->cur_bpw + midi) < 8) ++ midi = 8 - spi->cur_bpw; ++ ++ midi = min_t(u32, midi, FIELD_MAX(STM32H7_SPI_CFG2_MIDI)); + + dev_dbg(spi->dev, "period=%dns, midi=%d(=%dns)\n", + sck_period_ns, midi, midi * sck_period_ns); +-- +2.51.0 + diff --git a/queue-5.15/staging-rtl8723bs-fix-memory-leak-on-failure-path.patch b/queue-5.15/staging-rtl8723bs-fix-memory-leak-on-failure-path.patch new file mode 100644 index 00000000000..4aea4e0442a --- /dev/null +++ b/queue-5.15/staging-rtl8723bs-fix-memory-leak-on-failure-path.patch @@ -0,0 +1,42 @@ +From fdd48a9e4b3cf0c725bf3c56bff796d8214a62f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 14:47:12 +0530 +Subject: staging: rtl8723bs: fix memory leak on failure path + +From: Diksha Kumari + +[ Upstream commit abe850d82c8cb72d28700673678724e779b1826e ] + +cfg80211_inform_bss_frame() may return NULL on failure. In that case, +the allocated buffer 'buf' is not freed and the function returns early, +leading to potential memory leak. +Fix this by ensuring that 'buf' is freed on both success and failure paths. + +Signed-off-by: Diksha Kumari +Reviewed-by: Mukesh Kumar Chaurasiya +Link: https://patch.msgid.link/20260113091712.7071-1-dikshakdevgan@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +index b33424a9e83b7..6ac79b430acc9 100644 +--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c ++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +@@ -318,9 +318,10 @@ struct cfg80211_bss *rtw_cfg80211_inform_bss(struct adapter *padapter, struct wl + len, notify_signal, GFP_ATOMIC); + + if (unlikely(!bss)) +- goto exit; ++ goto free_buf; + + cfg80211_put_bss(wiphy, bss); ++free_buf: + kfree(buf); + + exit: +-- +2.51.0 + diff --git a/queue-5.15/staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch b/queue-5.15/staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch new file mode 100644 index 00000000000..f5e80f63254 --- /dev/null +++ b/queue-5.15/staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch @@ -0,0 +1,44 @@ +From 63453f14006d9f64223ef68037d4a8ff5d3bb9d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 17:27:28 +0800 +Subject: staging: rtl8723bs: fix missing status update on sdio_alloc_irq() + failure + +From: Liang Jie + +[ Upstream commit 618b4aec12faabc7579a6b0df046842d798a4c7c ] + +The return value of sdio_alloc_irq() was not stored in status. +If sdio_alloc_irq() fails after rtw_drv_register_netdev() succeeds, +status remains _SUCCESS and the error path skips resource cleanup, +while rtw_drv_init() still returns success. + +Store the return value of sdio_alloc_irq() in status and reuse the +existing error handling which relies on status. + +Reviewed-by: fanggeng +Signed-off-by: Liang Jie +Link: https://patch.msgid.link/20251208092730.262499-1-buaajxlj@163.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c +index 4904314845242..335e6002df70f 100644 +--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c ++++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c +@@ -380,7 +380,8 @@ static int rtw_drv_init( + if (status != _SUCCESS) + goto free_if1; + +- if (sdio_alloc_irq(dvobj) != _SUCCESS) ++ status = sdio_alloc_irq(dvobj); ++ if (status != _SUCCESS) + goto free_if1; + + rtw_ndev_notifier_register(); +-- +2.51.0 + diff --git a/queue-5.15/tools-power-cpupower-reset-errno-before-strtoull.patch b/queue-5.15/tools-power-cpupower-reset-errno-before-strtoull.patch new file mode 100644 index 00000000000..9d2113f84f1 --- /dev/null +++ b/queue-5.15/tools-power-cpupower-reset-errno-before-strtoull.patch @@ -0,0 +1,37 @@ +From 3f96d910faad2ab252085913f72b20a618d20363 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 17:47:45 +0530 +Subject: tools/power cpupower: Reset errno before strtoull() + +From: Kaushlendra Kumar + +[ Upstream commit f9bd3762cf1bd0c2465f2e6121b340883471d1bf ] + +cpuidle_state_get_one_value() never cleared errno before calling +strtoull(), so a prior ERANGE caused every cpuidle counter read to +return zero. Reset errno to 0 before the conversion so each sysfs read +is evaluated independently. + +Link: https://lore.kernel.org/r/20251201121745.3776703-1-kaushlendra.kumar@intel.com +Signed-off-by: Kaushlendra Kumar +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/power/cpupower/lib/cpuidle.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c +index c15d0de12357f..e7b8c56638370 100644 +--- a/tools/power/cpupower/lib/cpuidle.c ++++ b/tools/power/cpupower/lib/cpuidle.c +@@ -148,6 +148,7 @@ unsigned long long cpuidle_state_get_one_value(unsigned int cpu, + if (len == 0) + return 0; + ++ errno = 0; + value = strtoull(linebuf, &endp, 0); + + if (endp == linebuf || errno == ERANGE) +-- +2.51.0 + diff --git a/queue-5.15/tracing-fix-false-sharing-in-hwlat-get_sample.patch b/queue-5.15/tracing-fix-false-sharing-in-hwlat-get_sample.patch new file mode 100644 index 00000000000..2e0c740c8c1 --- /dev/null +++ b/queue-5.15/tracing-fix-false-sharing-in-hwlat-get_sample.patch @@ -0,0 +1,113 @@ +From d42f32ead499c3a996d0edbd0836ef9775b1b1e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 23:48:10 -0800 +Subject: tracing: Fix false sharing in hwlat get_sample() + +From: Colin Lord + +[ Upstream commit f743435f988cb0cf1f521035aee857851b25e06d ] + +The get_sample() function in the hwlat tracer assumes the caller holds +hwlat_data.lock, but this is not actually happening. The result is +unprotected data access to hwlat_data, and in per-cpu mode can result in +false sharing which may show up as false positive latency events. + +The specific case of false sharing observed was primarily between +hwlat_data.sample_width and hwlat_data.count. These are separated by +just 8B and are therefore likely to share a cache line. When one thread +modifies count, the cache line is in a modified state so when other +threads read sample_width in the main latency detection loop, they fetch +the modified cache line. On some systems, the fetch itself may be slow +enough to count as a latency event, which could set up a self +reinforcing cycle of latency events as each event increments count which +then causes more latency events, continuing the cycle. + +The other result of the unprotected data access is that hwlat_data.count +can end up with duplicate or missed values, which was observed on some +systems in testing. + +Convert hwlat_data.count to atomic64_t so it can be safely modified +without locking, and prevent false sharing by pulling sample_width into +a local variable. + +One system this was tested on was a dual socket server with 32 CPUs on +each numa node. With settings of 1us threshold, 1000us width, and +2000us window, this change reduced the number of latency events from +500 per second down to approximately 1 event per minute. Some machines +tested did not exhibit measurable latency from the false sharing. + +Cc: Masami Hiramatsu +Cc: Mathieu Desnoyers +Link: https://patch.msgid.link/20260210074810.6328-1-clord@mykolab.com +Signed-off-by: Colin Lord +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_hwlat.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c +index 77a5a05544fce..31ce3d137307e 100644 +--- a/kernel/trace/trace_hwlat.c ++++ b/kernel/trace/trace_hwlat.c +@@ -102,9 +102,9 @@ struct hwlat_sample { + /* keep the global state somewhere. */ + static struct hwlat_data { + +- struct mutex lock; /* protect changes */ ++ struct mutex lock; /* protect changes */ + +- u64 count; /* total since reset */ ++ atomic64_t count; /* total since reset */ + + u64 sample_window; /* total sampling window (on+off) */ + u64 sample_width; /* active sampling portion of window */ +@@ -195,8 +195,7 @@ void trace_hwlat_callback(bool enter) + * get_sample - sample the CPU TSC and look for likely hardware latencies + * + * Used to repeatedly capture the CPU TSC (or similar), looking for potential +- * hardware-induced latency. Called with interrupts disabled and with +- * hwlat_data.lock held. ++ * hardware-induced latency. Called with interrupts disabled. + */ + static int get_sample(void) + { +@@ -206,6 +205,7 @@ static int get_sample(void) + time_type start, t1, t2, last_t2; + s64 diff, outer_diff, total, last_total = 0; + u64 sample = 0; ++ u64 sample_width = READ_ONCE(hwlat_data.sample_width); + u64 thresh = tracing_thresh; + u64 outer_sample = 0; + int ret = -1; +@@ -269,7 +269,7 @@ static int get_sample(void) + if (diff > sample) + sample = diff; /* only want highest value */ + +- } while (total <= hwlat_data.sample_width); ++ } while (total <= sample_width); + + barrier(); /* finish the above in the view for NMIs */ + trace_hwlat_callback_enabled = false; +@@ -287,8 +287,7 @@ static int get_sample(void) + if (kdata->nmi_total_ts) + do_div(kdata->nmi_total_ts, NSEC_PER_USEC); + +- hwlat_data.count++; +- s.seqnum = hwlat_data.count; ++ s.seqnum = atomic64_inc_return(&hwlat_data.count); + s.duration = sample; + s.outer_duration = outer_sample; + s.nmi_total_ts = kdata->nmi_total_ts; +@@ -837,7 +836,7 @@ static int hwlat_tracer_init(struct trace_array *tr) + + hwlat_trace = tr; + +- hwlat_data.count = 0; ++ atomic64_set(&hwlat_data.count, 0); + tr->max_latency = 0; + save_tracing_thresh = tracing_thresh; + +-- +2.51.0 + diff --git a/queue-5.15/virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch b/queue-5.15/virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch new file mode 100644 index 00000000000..b40789477e8 --- /dev/null +++ b/queue-5.15/virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch @@ -0,0 +1,75 @@ +From ebe545d4d3b8cbb3d883b12b22eab61b900b6238 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 08:35:45 +0100 +Subject: virt: vbox: uapi: Mark inner unions in packed structs as packed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit c25d01e1c4f2d43f47af87c00e223f5ca7c71792 ] + +The unpacked unions within a packed struct generates alignment warnings +on clang for 32-bit ARM: + +./usr/include/linux/vbox_vmmdev_types.h:239:4: error: field u within 'struct vmmdev_hgcm_function_parameter32' + is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:223:2)' + and is usually due to 'struct vmmdev_hgcm_function_parameter32' being packed, + which can lead to unaligned accesses [-Werror,-Wunaligned-access] + 239 | } u; + | ^ + +./usr/include/linux/vbox_vmmdev_types.h:254:6: error: field u within + 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)' + is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:251:4)' and is usually due to + 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)' + being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] + +With the recent changes to compile-test the UAPI headers in more cases, +these warning in combination with CONFIG_WERROR breaks the build. + +Fix the warnings. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/ +Reported-by: Nathan Chancellor +Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/ +Suggested-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/ +Signed-off-by: Thomas Weißschuh +Tested-by: Nicolas Schier +Reviewed-by: Nicolas Schier +Acked-by: Greg Kroah-Hartman +Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-2-076aed1623ff@linutronix.de +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + include/uapi/linux/vbox_vmmdev_types.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/uapi/linux/vbox_vmmdev_types.h b/include/uapi/linux/vbox_vmmdev_types.h +index f8a8d6b3c5219..436678d4fb24f 100644 +--- a/include/uapi/linux/vbox_vmmdev_types.h ++++ b/include/uapi/linux/vbox_vmmdev_types.h +@@ -236,7 +236,7 @@ struct vmmdev_hgcm_function_parameter32 { + /** Relative to the request header. */ + __u32 offset; + } page_list; +- } u; ++ } __packed u; + } __packed; + VMMDEV_ASSERT_SIZE(vmmdev_hgcm_function_parameter32, 4 + 8); + +@@ -251,7 +251,7 @@ struct vmmdev_hgcm_function_parameter64 { + union { + __u64 phys_addr; + __u64 linear_addr; +- } u; ++ } __packed u; + } __packed pointer; + struct { + /** Size of the buffer described by the page list. */ +-- +2.51.0 + diff --git a/queue-5.15/vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch b/queue-5.15/vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch new file mode 100644 index 00000000000..fab1c9037a7 --- /dev/null +++ b/queue-5.15/vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch @@ -0,0 +1,62 @@ +From c21b821b3c904a0bde549d2c5b74acf097c47e01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 17:34:00 +0100 +Subject: vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 + +From: Arnd Bergmann + +[ Upstream commit e25dbf561e03c0c5e36228e3b8b784392819ce85 ] + +The gcc-16.0.1 snapshot produces a false-positive warning that turns +into a build failure with CONFIG_WERROR: + +In file included from arch/x86/include/asm/string.h:6, + from net/vmw_vsock/vmci_transport.c:10: +In function 'vmci_transport_packet_init', + inlined from '__vmci_transport_send_control_pkt.constprop' at net/vmw_vsock/vmci_transport.c:198:2: +arch/x86/include/asm/string_32.h:150:25: error: argument 2 null where non-null expected because argument 3 is nonzero [-Werror=nonnull] + 150 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n) + | ^~~~~~~~~~~~~~~~~~~~~~~~~ +net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy' + 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait)); + | ^~~~~~ +arch/x86/include/asm/string_32.h:150:25: note: in a call to built-in function '__builtin_memcpy' +net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy' + 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait)); + | ^~~~~~ + +This seems relatively harmless, and it so far the only instance of this +warning I have found. The __vmci_transport_send_control_pkt function +is called either with wait=NULL or with one of the type values that +pass 'wait' into memcpy() here, but not from the same caller. + +Replacing the memcpy with a struct assignment is otherwise the same +but avoids the warning. + +Signed-off-by: Arnd Bergmann +Reviewed-by: Bobby Eshleman +Reviewed-by: Stefano Garzarella +Reviewed-by: Bryan Tan +Link: https://patch.msgid.link/20260203163406.2636463-1-arnd@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/vmw_vsock/vmci_transport.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c +index 6910b5ce9a183..35585e9f1af4c 100644 +--- a/net/vmw_vsock/vmci_transport.c ++++ b/net/vmw_vsock/vmci_transport.c +@@ -161,7 +161,7 @@ vmci_transport_packet_init(struct vmci_transport_packet *pkt, + + case VMCI_TRANSPORT_PACKET_TYPE_WAITING_READ: + case VMCI_TRANSPORT_PACKET_TYPE_WAITING_WRITE: +- memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait)); ++ pkt->u.wait = *wait; + break; + + case VMCI_TRANSPORT_PACKET_TYPE_REQUEST2: +-- +2.51.0 + diff --git a/queue-5.15/wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch b/queue-5.15/wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch new file mode 100644 index 00000000000..0c71fa9764a --- /dev/null +++ b/queue-5.15/wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch @@ -0,0 +1,59 @@ +From fcad7ef366f0288432546ee309f99e910ff68614 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 17:56:11 +0000 +Subject: wifi: ath10k: fix lock protection in + ath10k_wmi_event_peer_sta_ps_state_chg() + +From: Ziyi Guo + +[ Upstream commit 820ba7dd6859ef8b1eaf6014897e7aa4756fc65d ] + +ath10k_wmi_event_peer_sta_ps_state_chg() uses lockdep_assert_held() to +assert that ar->data_lock should be held by the caller, but neither +ath10k_wmi_10_2_op_rx() nor ath10k_wmi_10_4_op_rx() acquire this lock +before calling this function. + +The field arsta->peer_ps_state is documented as protected by +ar->data_lock in core.h, and other accessors (ath10k_peer_ps_state_disable, +ath10k_dbg_sta_read_peer_ps_state) properly acquire this lock. + +Add spin_lock_bh()/spin_unlock_bh() around the peer_ps_state update, +and remove the lockdep_assert_held() to be aligned with new locking, +following the pattern used by other WMI event handlers in the driver. + +Signed-off-by: Ziyi Guo +Reviewed-by: Baochen Qiang +Link: https://patch.msgid.link/20260123175611.767731-1-n7l8m4@u.northwestern.edu +[removed excess blank line] +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/wmi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c +index e018f732fa267..e3d4505d7615e 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -5282,8 +5282,6 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb) + struct ath10k_sta *arsta; + u8 peer_addr[ETH_ALEN]; + +- lockdep_assert_held(&ar->data_lock); +- + ev = (struct wmi_peer_sta_ps_state_chg_event *)skb->data; + ether_addr_copy(peer_addr, ev->peer_macaddr.addr); + +@@ -5298,7 +5296,9 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb) + } + + arsta = (struct ath10k_sta *)sta->drv_priv; ++ spin_lock_bh(&ar->data_lock); + arsta->peer_ps_state = __le32_to_cpu(ev->peer_ps_state); ++ spin_unlock_bh(&ar->data_lock); + + exit: + rcu_read_unlock(); +-- +2.51.0 + diff --git a/queue-5.15/wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch b/queue-5.15/wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch new file mode 100644 index 00000000000..0375f1bb61e --- /dev/null +++ b/queue-5.15/wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch @@ -0,0 +1,48 @@ +From bd5cd2076f3160f2b811fd0a750832e2700f4f16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 19:30:05 +0000 +Subject: wifi: iwlegacy: add missing mutex protection in + il3945_store_measurement() + +From: Ziyi Guo + +[ Upstream commit 4dd1dda65265ecbc9f43ffc08e333684cf715152 ] + +il3945_store_measurement() calls il3945_get_measurement() which internally +calls il_send_cmd_sync() without holding il->mutex. However, +il_send_cmd_sync() has lockdep_assert_held(&il->mutex) indicating that +callers must hold this lock. + +Other sysfs store functions in the same file properly acquire the mutex: +- il3945_store_flags() acquires mutex at 3945-mac.c:3110 +- il3945_store_filter_flags() acquires mutex at 3945-mac.c:3144 + +Add mutex_lock()/mutex_unlock() around the il3945_get_measurement() call +in the sysfs store function to fix the missing lock protection. + +Signed-off-by: Ziyi Guo +Acked-by: Stanislaw Gruszka +Link: https://patch.msgid.link/20260125193005.1090429-1-n7l8m4@u.northwestern.edu +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlegacy/3945-mac.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c +index dea0012fcdc79..1f2d089e1fdf8 100644 +--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c ++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c +@@ -3268,7 +3268,9 @@ il3945_store_measurement(struct device *d, struct device_attribute *attr, + + D_INFO("Invoking measurement of type %d on " "channel %d (for '%s')\n", + type, params.channel, buf); ++ mutex_lock(&il->mutex); + il3945_get_measurement(il, ¶ms, type); ++ mutex_unlock(&il->mutex); + + return count; + } +-- +2.51.0 + diff --git a/queue-5.15/wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch b/queue-5.15/wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch new file mode 100644 index 00000000000..98b1f820301 --- /dev/null +++ b/queue-5.15/wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch @@ -0,0 +1,49 @@ +From a14a9d55aa22a74e7a4910ccb1254cc13f022056 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 19:40:39 +0000 +Subject: wifi: iwlegacy: add missing mutex protection in + il4965_store_tx_power() + +From: Ziyi Guo + +[ Upstream commit e31fa691d0b1c07b6094a6cf0cce894192c462b3 ] + +il4965_store_tx_power() calls il_set_tx_power() without holding il->mutex. +However, il_set_tx_power() has lockdep_assert_held(&il->mutex) indicating +that callers must hold this lock. + +All other callers of il_set_tx_power() properly acquire the mutex: +- il_bg_scan_completed() acquires mutex at common.c:1683 +- il_mac_config() acquires mutex at common.c:5006 +- il3945_commit_rxon() and il4965_commit_rxon() are called via work + queues that hold the mutex (like il4965_bg_alive_start) + +Add mutex_lock()/mutex_unlock() around the il_set_tx_power() call in +the sysfs store function to fix the missing lock protection. + +Signed-off-by: Ziyi Guo +Acked-by: Stanislaw Gruszka +Link: https://patch.msgid.link/20260125194039.1196488-1-n7l8m4@u.northwestern.edu +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c +index df9d139a008eb..7bf2e3a35cd8c 100644 +--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c ++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c +@@ -4612,7 +4612,9 @@ il4965_store_tx_power(struct device *d, struct device_attribute *attr, + if (ret) + IL_INFO("%s is not in decimal form.\n", buf); + else { ++ mutex_lock(&il->mutex); + ret = il_set_tx_power(il, val, false); ++ mutex_unlock(&il->mutex); + if (ret) + IL_ERR("failed setting tx power (0x%08x).\n", ret); + else +-- +2.51.0 + diff --git a/queue-5.15/wifi-libertas-fix-warning-in-usb_tx_block.patch b/queue-5.15/wifi-libertas-fix-warning-in-usb_tx_block.patch new file mode 100644 index 00000000000..51cad094dff --- /dev/null +++ b/queue-5.15/wifi-libertas-fix-warning-in-usb_tx_block.patch @@ -0,0 +1,44 @@ +From 5c71408ce41b2b8540fecbdbc94e8cae6965dc83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Dec 2025 16:58:06 +0100 +Subject: wifi: libertas: fix WARNING in usb_tx_block + +From: Szymon Wilczek + +[ Upstream commit d66676e6ca96bf8680f869a9bd6573b26c634622 ] + +The function usb_tx_block() submits cardp->tx_urb without ensuring that +any previous transmission on this URB has completed. If a second call +occurs while the URB is still active (e.g. during rapid firmware loading), +usb_submit_urb() detects the active state and triggers a warning: +'URB submitted while active'. + +Fix this by enforcing serialization: call usb_kill_urb() before +submitting the new request. This ensures the URB is idle and safe to reuse. + +Reported-by: syzbot+67969ab6a2551c27f71b@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=67969ab6a2551c27f71b +Signed-off-by: Szymon Wilczek +Link: https://patch.msgid.link/20251221155806.23925-1-swilczek.lx@gmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/libertas/if_usb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c +index 2240b4db8c036..d98c81539ba53 100644 +--- a/drivers/net/wireless/marvell/libertas/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas/if_usb.c +@@ -426,6 +426,8 @@ static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload, uint16_t nb + goto tx_ret; + } + ++ usb_kill_urb(cardp->tx_urb); ++ + usb_fill_bulk_urb(cardp->tx_urb, cardp->udev, + usb_sndbulkpipe(cardp->udev, + cardp->ep_out), +-- +2.51.0 + diff --git a/queue-5.15/x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch b/queue-5.15/x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch new file mode 100644 index 00000000000..bf9fecfa198 --- /dev/null +++ b/queue-5.15/x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch @@ -0,0 +1,46 @@ +From 17a17d0ebc8fc50e4a0f9bfd0dae8bfa7d7e81a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 12:00:08 +0800 +Subject: x86/xen/pvh: Enable PAE mode for 32-bit guest only when + CONFIG_X86_PAE is set + +From: Hou Wenlong + +[ Upstream commit db9aded979b491a24871e1621cd4e8822dbca859 ] + +The PVH entry is available for 32-bit KVM guests, and 32-bit KVM guests +do not depend on CONFIG_X86_PAE. However, mk_early_pgtbl_32() builds +different pagetables depending on whether CONFIG_X86_PAE is set. +Therefore, enabling PAE mode for 32-bit KVM guests without +CONFIG_X86_PAE being set would result in a boot failure during CR3 +loading. + +Signed-off-by: Hou Wenlong +Reviewed-by: Juergen Gross +Signed-off-by: Juergen Gross +Message-ID: +Signed-off-by: Sasha Levin +--- + arch/x86/platform/pvh/head.S | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/x86/platform/pvh/head.S b/arch/x86/platform/pvh/head.S +index b3e3f64d436d8..56376fb4b3ae8 100644 +--- a/arch/x86/platform/pvh/head.S ++++ b/arch/x86/platform/pvh/head.S +@@ -69,10 +69,12 @@ SYM_CODE_START_LOCAL(pvh_start_xen) + + mov $_pa(early_stack_end), %esp + ++#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE) + /* Enable PAE mode. */ + mov %cr4, %eax + orl $X86_CR4_PAE, %eax + mov %eax, %cr4 ++#endif + + #ifdef CONFIG_X86_64 + /* Enable Long mode. */ +-- +2.51.0 + diff --git a/queue-5.15/xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch b/queue-5.15/xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch new file mode 100644 index 00000000000..c5493c06a04 --- /dev/null +++ b/queue-5.15/xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch @@ -0,0 +1,61 @@ +From 42c73481bf13491cb072b1e17a167cb9c2fd1e6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 17:47:29 -0500 +Subject: xenbus: Use .freeze/.thaw to handle xenbus devices + +From: Jason Andryuk + +[ Upstream commit e08dd1ee49838750a514e83c0aa60cd12ba6ecbb ] + +The goal is to fix s2idle and S3 for Xen PV devices. A domain resuming +from s3 or s2idle disconnects its PV devices during resume. The +backends are not expecting this and do not reconnect. + +b3e96c0c7562 ("xen: use freeze/restore/thaw PM events for suspend/ +resume/chkpt") changed xen_suspend()/do_suspend() from +PMSG_SUSPEND/PMSG_RESUME to PMSG_FREEZE/PMSG_THAW/PMSG_RESTORE, but the +suspend/resume callbacks remained. + +.freeze/restore are used with hiberation where Linux restarts in a new +place in the future. .suspend/resume are useful for runtime power +management for the duration of a boot. + +The current behavior of the callbacks works for an xl save/restore or +live migration where the domain is restored/migrated to a new location +and connecting to a not-already-connected backend. + +Change xenbus_pm_ops to use .freeze/thaw/restore and drop the +.suspend/resume hook. This matches the use in drivers/xen/manage.c for +save/restore and live migration. With .suspend/resume empty, PV devices +are left connected during s2idle and s3, so PV devices are not changed +and work after resume. + +Signed-off-by: Jason Andryuk +Acked-by: Juergen Gross +Signed-off-by: Juergen Gross +Message-ID: <20251119224731.61497-2-jason.andryuk@amd.com> +Signed-off-by: Sasha Levin +--- + drivers/xen/xenbus/xenbus_probe_frontend.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c +index 480944606a3c9..73cf4810715e4 100644 +--- a/drivers/xen/xenbus/xenbus_probe_frontend.c ++++ b/drivers/xen/xenbus/xenbus_probe_frontend.c +@@ -148,11 +148,9 @@ static void xenbus_frontend_dev_shutdown(struct device *_dev) + } + + static const struct dev_pm_ops xenbus_pm_ops = { +- .suspend = xenbus_dev_suspend, +- .resume = xenbus_frontend_dev_resume, + .freeze = xenbus_dev_suspend, + .thaw = xenbus_dev_cancel, +- .restore = xenbus_dev_resume, ++ .restore = xenbus_frontend_dev_resume, + }; + + static struct xen_bus_type xenbus_frontend = { +-- +2.51.0 + diff --git a/queue-6.1/acpi-processor-fix-null-pointer-dereference-in-acpi_.patch b/queue-6.1/acpi-processor-fix-null-pointer-dereference-in-acpi_.patch new file mode 100644 index 00000000000..5a903f4e66a --- /dev/null +++ b/queue-6.1/acpi-processor-fix-null-pointer-dereference-in-acpi_.patch @@ -0,0 +1,101 @@ +From 7270aae67b839766005aed7e81e5d421d5c74d91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 00:32:14 +0800 +Subject: ACPI: processor: Fix NULL-pointer dereference in + acpi_processor_errata_piix4() + +From: Tuo Li + +[ Upstream commit f132e089fe89cadc2098991f0a3cb05c3f824ac6 ] + +In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE +device and then reassigned an ISA device: + + dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...); + dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...); + +If the first lookup succeeds but the second fails, dev becomes NULL. This +leads to a potential null-pointer dereference when dev_dbg() is called: + + if (errata.piix4.bmisx) + dev_dbg(&dev->dev, ...); + +To prevent this, use two temporary pointers and retrieve each device +independently, avoiding overwriting dev with a possible NULL value. + +Signed-off-by: Tuo Li +[ rjw: Subject adjustment, added an empty code line ] +Link: https://patch.msgid.link/20260111163214.202262-1-islituo@gmail.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpi_processor.c | 28 +++++++++++++++------------- + 1 file changed, 15 insertions(+), 13 deletions(-) + +diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c +index cfa75b14caa2b..669398045c0fd 100644 +--- a/drivers/acpi/acpi_processor.c ++++ b/drivers/acpi/acpi_processor.c +@@ -33,6 +33,7 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev) + { + u8 value1 = 0; + u8 value2 = 0; ++ struct pci_dev *ide_dev = NULL, *isa_dev = NULL; + + + if (!dev) +@@ -90,12 +91,12 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev) + * each IDE controller's DMA status to make sure we catch all + * DMA activity. + */ +- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, ++ ide_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, + PCI_DEVICE_ID_INTEL_82371AB, + PCI_ANY_ID, PCI_ANY_ID, NULL); +- if (dev) { +- errata.piix4.bmisx = pci_resource_start(dev, 4); +- pci_dev_put(dev); ++ if (ide_dev) { ++ errata.piix4.bmisx = pci_resource_start(ide_dev, 4); ++ pci_dev_put(ide_dev); + } + + /* +@@ -107,24 +108,25 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev) + * disable C3 support if this is enabled, as some legacy + * devices won't operate well if fast DMA is disabled. + */ +- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, ++ isa_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, + PCI_DEVICE_ID_INTEL_82371AB_0, + PCI_ANY_ID, PCI_ANY_ID, NULL); +- if (dev) { +- pci_read_config_byte(dev, 0x76, &value1); +- pci_read_config_byte(dev, 0x77, &value2); ++ if (isa_dev) { ++ pci_read_config_byte(isa_dev, 0x76, &value1); ++ pci_read_config_byte(isa_dev, 0x77, &value2); + if ((value1 & 0x80) || (value2 & 0x80)) + errata.piix4.fdma = 1; +- pci_dev_put(dev); ++ pci_dev_put(isa_dev); + } + + break; + } + +- if (errata.piix4.bmisx) +- dev_dbg(&dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n"); +- if (errata.piix4.fdma) +- dev_dbg(&dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n"); ++ if (ide_dev) ++ dev_dbg(&ide_dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n"); ++ ++ if (isa_dev) ++ dev_dbg(&isa_dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n"); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.1/acpica-abort-aml-bytecode-execution-when-executing-a.patch b/queue-6.1/acpica-abort-aml-bytecode-execution-when-executing-a.patch new file mode 100644 index 00000000000..5b9835ca49f --- /dev/null +++ b/queue-6.1/acpica-abort-aml-bytecode-execution-when-executing-a.patch @@ -0,0 +1,129 @@ +From 32db5ad7bcd2783092cf5c6cf020ed5724b2abdd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 13:25:33 +0100 +Subject: ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP + +From: Armin Wolf + +[ Upstream commit 026ad376a6a48538b576f3589331daa94daae6f0 ] + +The ACPI specification states that when executing AML_FATAL_OP, +the OS should log the fatal error event and shutdown in a timely +fashion. + +Windows complies with this requirement by immediatly entering a +Bso_d, effectively aborting the execution of the AML bytecode in +question. + +ACPICA however might continue with the AML bytecode execution +should acpi_os_signal() simply return AE_OK. This will cause issues +because ACPI BIOS implementations might assume that the Fatal() +operator does not return. + +Fix this by aborting the AML bytecode execution in such a case +by returning AE_ERROR. Also turn struct acpi_signal_fatal_info into a +local variable because of its small size (12 bytes) and to ensure +that acpi_os_signal() always receives valid information about the +fatal ACPI BIOS error. + +Link: https://github.com/acpica/acpica/commit/d516c7758ba6 +Signed-off-by: Armin Wolf +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/3325491.5fSG56mABF@rafael.j.wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/exoparg3.c | 46 +++++++++++++--------------------- + 1 file changed, 18 insertions(+), 28 deletions(-) + +diff --git a/drivers/acpi/acpica/exoparg3.c b/drivers/acpi/acpica/exoparg3.c +index 4b069bd6bc71e..198da79c0cd48 100644 +--- a/drivers/acpi/acpica/exoparg3.c ++++ b/drivers/acpi/acpica/exoparg3.c +@@ -10,6 +10,7 @@ + #include + #include "accommon.h" + #include "acinterp.h" ++#include + #include "acparser.h" + #include "amlcode.h" + +@@ -51,8 +52,7 @@ ACPI_MODULE_NAME("exoparg3") + acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state) + { + union acpi_operand_object **operand = &walk_state->operands[0]; +- struct acpi_signal_fatal_info *fatal; +- acpi_status status = AE_OK; ++ struct acpi_signal_fatal_info fatal; + + ACPI_FUNCTION_TRACE_STR(ex_opcode_3A_0T_0R, + acpi_ps_get_opcode_name(walk_state->opcode)); +@@ -60,28 +60,23 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state) + switch (walk_state->opcode) { + case AML_FATAL_OP: /* Fatal (fatal_type fatal_code fatal_arg) */ + +- ACPI_DEBUG_PRINT((ACPI_DB_INFO, +- "FatalOp: Type %X Code %X Arg %X " +- "<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n", +- (u32)operand[0]->integer.value, +- (u32)operand[1]->integer.value, +- (u32)operand[2]->integer.value)); +- +- fatal = ACPI_ALLOCATE(sizeof(struct acpi_signal_fatal_info)); +- if (fatal) { +- fatal->type = (u32) operand[0]->integer.value; +- fatal->code = (u32) operand[1]->integer.value; +- fatal->argument = (u32) operand[2]->integer.value; +- } ++ fatal.type = (u32)operand[0]->integer.value; ++ fatal.code = (u32)operand[1]->integer.value; ++ fatal.argument = (u32)operand[2]->integer.value; + +- /* Always signal the OS! */ ++ ACPI_BIOS_ERROR((AE_INFO, ++ "Fatal ACPI BIOS error (Type 0x%X Code 0x%X Arg 0x%X)\n", ++ fatal.type, fatal.code, fatal.argument)); + +- status = acpi_os_signal(ACPI_SIGNAL_FATAL, fatal); ++ /* Always signal the OS! */ + +- /* Might return while OS is shutting down, just continue */ ++ acpi_os_signal(ACPI_SIGNAL_FATAL, &fatal); + +- ACPI_FREE(fatal); +- goto cleanup; ++ /* ++ * Might return while OS is shutting down, so abort the AML execution ++ * by returning an error. ++ */ ++ return_ACPI_STATUS(AE_ERROR); + + case AML_EXTERNAL_OP: + /* +@@ -93,21 +88,16 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state) + * wrong if an external opcode ever gets here. + */ + ACPI_ERROR((AE_INFO, "Executed External Op")); +- status = AE_OK; +- goto cleanup; ++ ++ return_ACPI_STATUS(AE_OK); + + default: + + ACPI_ERROR((AE_INFO, "Unknown AML opcode 0x%X", + walk_state->opcode)); + +- status = AE_AML_BAD_OPCODE; +- goto cleanup; ++ return_ACPI_STATUS(AE_AML_BAD_OPCODE); + } +- +-cleanup: +- +- return_ACPI_STATUS(status); + } + + /******************************************************************************* +-- +2.51.0 + diff --git a/queue-6.1/alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch b/queue-6.1/alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch new file mode 100644 index 00000000000..3933cf61c48 --- /dev/null +++ b/queue-6.1/alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch @@ -0,0 +1,42 @@ +From 3d2e897483354908a35c3b703e78a877ac6ae9ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 08:38:29 +0000 +Subject: ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio + +From: Lianqin Hu + +[ Upstream commit ac656d7d7c70f7c352c7652bc2bb0c1c8c2dde08 ] + +Setting up the interface when suspended/resumeing fail on this card. +Adding a reset and delay quirk will eliminate this problem. + +usb 1-1: New USB device found, idVendor=001f, idProduct=0b21 +usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 +usb 1-1: Product: AB13X USB Audio +usb 1-1: Manufacturer: Generic +usb 1-1: SerialNumber: 20210926172016 + +Signed-off-by: Lianqin Hu +Link: https://patch.msgid.link/TYUPR06MB6217522D0DB6E2C9DF46B56ED265A@TYUPR06MB6217.apcprd06.prod.outlook.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/quirks.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 286ec4580718c..755ba2fe05b5a 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -2045,6 +2045,8 @@ struct usb_audio_quirk_flags_table { + + static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + /* Device matches */ ++ DEVICE_FLG(0x001f, 0x0b21, /* AB13X USB Audio */ ++ QUIRK_FLAG_FORCE_IFACE_RESET | QUIRK_FLAG_IFACE_DELAY), + DEVICE_FLG(0x03f0, 0x654a, /* HP 320 FHD Webcam */ + QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16), + DEVICE_FLG(0x041e, 0x3000, /* Creative SB Extigy */ +-- +2.51.0 + diff --git a/queue-6.1/alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch b/queue-6.1/alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch new file mode 100644 index 00000000000..ab14b33b00b --- /dev/null +++ b/queue-6.1/alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch @@ -0,0 +1,108 @@ +From 93235bc6944a417c3130ae62d7aaee56c1027838 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Feb 2026 15:12:07 +0100 +Subject: ALSA: usb-audio: Add sanity check for OOB writes at silencing + +From: Takashi Iwai + +[ Upstream commit fba2105a157fffcf19825e4eea498346738c9948 ] + +At silencing the playback URB packets in the implicit fb mode before +the actual playback, we blindly assume that the received packets fit +with the buffer size. But when the setup in the capture stream +differs from the playback stream (e.g. due to the USB core limitation +of max packet size), such an inconsistency may lead to OOB writes to +the buffer, resulting in a crash. + +For addressing it, add a sanity check of the transfer buffer size at +prepare_silent_urb(), and stop the data copy if the received data +overflows. Also, report back the transfer error properly from there, +too. + +Note that this doesn't fix the root cause of the playback error +itself, but this merely covers the kernel Oops. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076 +Link: https://patch.msgid.link/20260216141209.1849200-4-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/endpoint.c | 39 ++++++++++++++++++++++----------------- + 1 file changed, 22 insertions(+), 17 deletions(-) + +diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c +index d0e07e7001632..86a8624e8781e 100644 +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -278,8 +278,8 @@ static inline bool has_tx_length_quirk(struct snd_usb_audio *chip) + return chip->quirk_flags & QUIRK_FLAG_TX_LENGTH; + } + +-static void prepare_silent_urb(struct snd_usb_endpoint *ep, +- struct snd_urb_ctx *ctx) ++static int prepare_silent_urb(struct snd_usb_endpoint *ep, ++ struct snd_urb_ctx *ctx) + { + struct urb *urb = ctx->urb; + unsigned int offs = 0; +@@ -292,28 +292,34 @@ static void prepare_silent_urb(struct snd_usb_endpoint *ep, + extra = sizeof(packet_length); + + for (i = 0; i < ctx->packets; ++i) { +- unsigned int offset; +- unsigned int length; +- int counts; +- +- counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0); +- length = counts * ep->stride; /* number of silent bytes */ +- offset = offs * ep->stride + extra * i; +- urb->iso_frame_desc[i].offset = offset; ++ int length; ++ ++ length = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0); ++ if (length < 0) ++ return length; ++ length *= ep->stride; /* number of silent bytes */ ++ if (offs + length + extra > ctx->buffer_size) ++ break; ++ urb->iso_frame_desc[i].offset = offs; + urb->iso_frame_desc[i].length = length + extra; + if (extra) { + packet_length = cpu_to_le32(length); +- memcpy(urb->transfer_buffer + offset, ++ memcpy(urb->transfer_buffer + offs, + &packet_length, sizeof(packet_length)); ++ offs += extra; + } +- memset(urb->transfer_buffer + offset + extra, ++ memset(urb->transfer_buffer + offs, + ep->silence_value, length); +- offs += counts; ++ offs += length; + } + +- urb->number_of_packets = ctx->packets; +- urb->transfer_buffer_length = offs * ep->stride + ctx->packets * extra; ++ if (!offs) ++ return -EPIPE; ++ ++ urb->number_of_packets = i; ++ urb->transfer_buffer_length = offs; + ctx->queued = 0; ++ return 0; + } + + /* +@@ -335,8 +341,7 @@ static int prepare_outbound_urb(struct snd_usb_endpoint *ep, + if (data_subs && ep->prepare_data_urb) + return ep->prepare_data_urb(data_subs, urb, in_stream_lock); + /* no data provider, so send silence */ +- prepare_silent_urb(ep, ctx); +- break; ++ return prepare_silent_urb(ep, ctx); + + case SND_USB_ENDPOINT_TYPE_SYNC: + if (snd_usb_get_speed(ep->chip->dev) >= USB_SPEED_HIGH) { +-- +2.51.0 + diff --git a/queue-6.1/alsa-usb-audio-update-the-number-of-packets-properly.patch b/queue-6.1/alsa-usb-audio-update-the-number-of-packets-properly.patch new file mode 100644 index 00000000000..d17f0722233 --- /dev/null +++ b/queue-6.1/alsa-usb-audio-update-the-number-of-packets-properly.patch @@ -0,0 +1,37 @@ +From 4925070dbd4dcb9587dc44b2d6b1665a725f1068 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Feb 2026 15:12:05 +0100 +Subject: ALSA: usb-audio: Update the number of packets properly at receiving + +From: Takashi Iwai + +[ Upstream commit cf044e44190234a41a788de1cdbb6c21f4a52e1e ] + +At receiving the packets from the implicit feedback source, we didn't +update ctx->packets field but only the ctx->packet_size[] data. +In exceptional cases, this might lead to unexpectedly superfluous data +transfer (although this won't happen usually due to the nature of USB +isochronous transfer). Fix it to update the field properly. + +Link: https://patch.msgid.link/20260216141209.1849200-2-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/endpoint.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c +index 4ac1af844b2b7..d0e07e7001632 100644 +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -489,6 +489,7 @@ int snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep, + + /* copy over the length information */ + if (implicit_fb) { ++ ctx->packets = packet->packets; + for (i = 0; i < packet->packets; i++) + ctx->packet_size[i] = packet->packet_size[i]; + } +-- +2.51.0 + diff --git a/queue-6.1/apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch b/queue-6.1/apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch new file mode 100644 index 00000000000..81e4af91e4d --- /dev/null +++ b/queue-6.1/apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch @@ -0,0 +1,137 @@ +From 958404d09c868f6bb3ac09d5a1a3e30d00aab70a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:35:05 +0100 +Subject: APEI/GHES: ensure that won't go past CPER allocated record + +From: Mauro Carvalho Chehab + +[ Upstream commit fa2408a24f8f0db14d9cfc613ef162dc267d7ad4 ] + +The logic at ghes_new() prevents allocating too large records, by +checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB). +Yet, the allocation is done with the actual number of pages from the +CPER bios table location, which can be smaller. + +Yet, a bad firmware could send data with a different size, which might +be bigger than the allocated memory, causing an OOPS: + + Unable to handle kernel paging request at virtual address fff00000f9b40000 + Mem abort info: + ESR = 0x0000000096000007 + EC = 0x25: DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 + FSC = 0x07: level 3 translation fault + Data abort info: + ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 + CM = 0, WnR = 0, TnD = 0, TagAccess = 0 + GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 + swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000 + [fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000 + Internal error: Oops: 0000000096000007 [#1] SMP + Modules linked in: + CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT + Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022 + Workqueue: kacpi_notify acpi_os_execute_deferred + pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) + pc : hex_dump_to_buffer+0x30c/0x4a0 + lr : hex_dump_to_buffer+0x328/0x4a0 + sp : ffff800080e13880 + x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083 + x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004 + x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083 + x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010 + x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020 + x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008 + x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000 + x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020 + x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000 + x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008 + Call trace: + hex_dump_to_buffer+0x30c/0x4a0 (P) + print_hex_dump+0xac/0x170 + cper_estatus_print_section+0x90c/0x968 + cper_estatus_print+0xf0/0x158 + __ghes_print_estatus+0xa0/0x148 + ghes_proc+0x1bc/0x220 + ghes_notify_hed+0x5c/0xb8 + notifier_call_chain+0x78/0x148 + blocking_notifier_call_chain+0x4c/0x80 + acpi_hed_notify+0x28/0x40 + acpi_ev_notify_dispatch+0x50/0x80 + acpi_os_execute_deferred+0x24/0x48 + process_one_work+0x15c/0x3b0 + worker_thread+0x2d0/0x400 + kthread+0x148/0x228 + ret_from_fork+0x10/0x20 + Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44) + ---[ end trace 0000000000000000 ]--- + +Prevent that by taking the actual allocated are into account when +checking for CPER length. + +Signed-off-by: Mauro Carvalho Chehab +Reviewed-by: Jonathan Cameron +Acked-by: Ard Biesheuvel +Reviewed-by: Hanjun Guo +[ rjw: Subject tweaks ] +Link: https://patch.msgid.link/4e70310a816577fabf37d94ed36cde4ad62b1e0a.1767871950.git.mchehab+huawei@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/apei/ghes.c | 6 +++++- + include/acpi/ghes.h | 1 + + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c +index 9fb86d0c4ff05..3b7f348dc608a 100644 +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -262,6 +263,7 @@ static struct ghes *ghes_new(struct acpi_hest_generic *generic) + error_block_length = GHES_ESTATUS_MAX_SIZE; + } + ghes->estatus = kmalloc(error_block_length, GFP_KERNEL); ++ ghes->estatus_length = error_block_length; + if (!ghes->estatus) { + rc = -ENOMEM; + goto err_unmap_status_addr; +@@ -333,13 +335,15 @@ static int __ghes_check_estatus(struct ghes *ghes, + struct acpi_hest_generic_status *estatus) + { + u32 len = cper_estatus_len(estatus); ++ u32 max_len = min(ghes->generic->error_block_length, ++ ghes->estatus_length); + + if (len < sizeof(*estatus)) { + pr_warn_ratelimited(FW_WARN GHES_PFX "Truncated error status block!\n"); + return -EIO; + } + +- if (len > ghes->generic->error_block_length) { ++ if (!len || len > max_len) { + pr_warn_ratelimited(FW_WARN GHES_PFX "Invalid error status block length!\n"); + return -EIO; + } +diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h +index 292a5c40bd0c6..259ae345849f0 100644 +--- a/include/acpi/ghes.h ++++ b/include/acpi/ghes.h +@@ -21,6 +21,7 @@ struct ghes { + struct acpi_hest_generic_v2 *generic_v2; + }; + struct acpi_hest_generic_status *estatus; ++ unsigned int estatus_length; + unsigned long flags; + union { + struct list_head list; +-- +2.51.0 + diff --git a/queue-6.1/arm-9467-1-mm-don-t-use-pk-through-printk.patch b/queue-6.1/arm-9467-1-mm-don-t-use-pk-through-printk.patch new file mode 100644 index 00000000000..1747119a752 --- /dev/null +++ b/queue-6.1/arm-9467-1-mm-don-t-use-pk-through-printk.patch @@ -0,0 +1,42 @@ +From 35b1569d28e0743b0809bd33622f5fd02b0d8f88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 10:56:33 +0100 +Subject: ARM: 9467/1: mm: Don't use %pK through printk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weissschuh + +[ Upstream commit 012ea376a5948b025f260aa45d2a6ec5d96674ea ] + +Restricted pointers ("%pK") were never meant to be used +through printk(). They can acquire sleeping locks in atomic contexts. + +Switch to %px over the more secure %p as this usage is a debugging aid, +gated behind CONFIG_DEBUG_VIRTUAL and used by WARN(). + +Link: https://lore.kernel.org/lkml/20250113171731-dc10e3c1-da64-4af0-b767-7c7070468023@linutronix.de/ +Signed-off-by: Thomas Weißschuh +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/mm/physaddr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/mm/physaddr.c b/arch/arm/mm/physaddr.c +index cf75819e4c137..4ae327bf7aa29 100644 +--- a/arch/arm/mm/physaddr.c ++++ b/arch/arm/mm/physaddr.c +@@ -38,7 +38,7 @@ static inline bool __virt_addr_valid(unsigned long x) + phys_addr_t __virt_to_phys(unsigned long x) + { + WARN(!__virt_addr_valid(x), +- "virt_to_phys used for non-linear address: %pK (%pS)\n", ++ "virt_to_phys used for non-linear address: %px (%pS)\n", + (void *)x, (void *)x); + + return __virt_to_phys_nodebug(x); +-- +2.51.0 + diff --git a/queue-6.1/arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch b/queue-6.1/arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch new file mode 100644 index 00000000000..c9e7be14f45 --- /dev/null +++ b/queue-6.1/arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch @@ -0,0 +1,37 @@ +From bcc77c47aebd7ebc8a60b4415433248ed6a020d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Dec 2025 17:24:48 +0800 +Subject: arm64: Add support for TSV110 Spectre-BHB mitigation + +From: Jinqian Yang + +[ Upstream commit e3baa5d4b361276efeb87b20d8beced451a7dbd5 ] + +The TSV110 processor is vulnerable to the Spectre-BHB (Branch History +Buffer) attack, which can be exploited to leak information through +branch prediction side channels. This commit adds the MIDR of TSV110 +to the list for software mitigation. + +Signed-off-by: Jinqian Yang +Reviewed-by: Zenghui Yu +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/proton-pack.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c +index 4978c466e325d..21105c725c34e 100644 +--- a/arch/arm64/kernel/proton-pack.c ++++ b/arch/arm64/kernel/proton-pack.c +@@ -908,6 +908,7 @@ static u8 spectre_bhb_loop_affected(void) + MIDR_ALL_VERSIONS(MIDR_CORTEX_X2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), ++ MIDR_ALL_VERSIONS(MIDR_HISI_TSV110), + {}, + }; + static const struct midr_range spectre_bhb_k24_list[] = { +-- +2.51.0 + diff --git a/queue-6.1/arm64-tegra-smaug-add-usb-role-switch-support.patch b/queue-6.1/arm64-tegra-smaug-add-usb-role-switch-support.patch new file mode 100644 index 00000000000..5af8de56fad --- /dev/null +++ b/queue-6.1/arm64-tegra-smaug-add-usb-role-switch-support.patch @@ -0,0 +1,37 @@ +From f85145963feddb968d1238a5e05eb54ae6ee61f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Dec 2025 21:27:21 +0000 +Subject: arm64: tegra: smaug: Add usb-role-switch support + +From: Diogo Ivo + +[ Upstream commit dfa93788dd8b2f9c59adf45ecf592082b1847b7b ] + +The USB2 port on Smaug is configured for OTG operation but lacked the +required 'usb-role-switch' property, leading to a failed probe and a +non-functioning USB port. Add the property along with setting the default +role to host. + +Signed-off-by: Diogo Ivo +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/nvidia/tegra210-smaug.dts | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts +index 2b4dbfac84a70..43b2409ad7e5f 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts ++++ b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts +@@ -1701,6 +1701,8 @@ usb2-0 { + status = "okay"; + vbus-supply = <&usbc_vbus>; + mode = "otg"; ++ usb-role-switch; ++ role-switch-default-mode = "host"; + }; + + usb3-0 { +-- +2.51.0 + diff --git a/queue-6.1/asoc-codecs-max98390-check-return-value-of-devm_gpio.patch b/queue-6.1/asoc-codecs-max98390-check-return-value-of-devm_gpio.patch new file mode 100644 index 00000000000..631a5b57cab --- /dev/null +++ b/queue-6.1/asoc-codecs-max98390-check-return-value-of-devm_gpio.patch @@ -0,0 +1,44 @@ +From 2b88c5c88b948872e571222e2c2c53c1b5061eb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 17:19:04 +0800 +Subject: ASoC: codecs: max98390: Check return value of + devm_gpiod_get_optional() in max98390_i2c_probe() + +From: Chen Ni + +[ Upstream commit a1d14d8364eac2611fe1391c73ff0e5b26064f0e ] + +The devm_gpiod_get_optional() function may return an error pointer +(ERR_PTR) in case of a genuine failure during GPIO acquisition, +not just NULL which indicates the legitimate absence of an optional +GPIO. + +Add an IS_ERR() check after the function call to catch such errors and +propagate them to the probe function, ensuring the driver fails to load +safely rather than proceeding with an invalid pointer. + +Signed-off-by: Chen Ni +Link: https://patch.msgid.link/20260130091904.3426149-1-nichen@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98390.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/codecs/max98390.c b/sound/soc/codecs/max98390.c +index 7a5260ff8d6b0..09fae6ee2b442 100644 +--- a/sound/soc/codecs/max98390.c ++++ b/sound/soc/codecs/max98390.c +@@ -1076,6 +1076,9 @@ static int max98390_i2c_probe(struct i2c_client *i2c) + + reset_gpio = devm_gpiod_get_optional(&i2c->dev, + "reset", GPIOD_OUT_HIGH); ++ if (IS_ERR(reset_gpio)) ++ return dev_err_probe(&i2c->dev, PTR_ERR(reset_gpio), ++ "Failed to get reset gpio\n"); + + /* Power on device */ + if (reset_gpio) { +-- +2.51.0 + diff --git a/queue-6.1/asoc-es8328-add-error-unwind-in-resume.patch b/queue-6.1/asoc-es8328-add-error-unwind-in-resume.patch new file mode 100644 index 00000000000..1bbea33f5e5 --- /dev/null +++ b/queue-6.1/asoc-es8328-add-error-unwind-in-resume.patch @@ -0,0 +1,57 @@ +From 60d0eafc2ce0c35619766a83dd3f394825340f75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Jan 2026 00:00:17 +0800 +Subject: ASoC: es8328: Add error unwind in resume + +From: Hsieh Hung-En + +[ Upstream commit 8232e6079ae6f8d3a61d87973cb427385aa469b9 ] + +Handle failures in the resume path by unwinding previously enabled +resources. + +If enabling regulators or syncing the regcache fails, disable regulators +and unprepare the clock to avoid leaking resources and leaving the device +in a partially resumed state. + +Signed-off-by: Hsieh Hung-En +Link: https://patch.msgid.link/20260130160017.2630-6-hungen3108@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/es8328.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c +index 8182e9b37c03d..5c9ba2a0e759f 100644 +--- a/sound/soc/codecs/es8328.c ++++ b/sound/soc/codecs/es8328.c +@@ -750,17 +750,23 @@ static int es8328_resume(struct snd_soc_component *component) + es8328->supplies); + if (ret) { + dev_err(component->dev, "unable to enable regulators\n"); +- return ret; ++ goto err_clk; + } + + regcache_mark_dirty(regmap); + ret = regcache_sync(regmap); + if (ret) { + dev_err(component->dev, "unable to sync regcache\n"); +- return ret; ++ goto err_regulators; + } + + return 0; ++ ++err_regulators: ++ regulator_bulk_disable(ARRAY_SIZE(es8328->supplies), es8328->supplies); ++err_clk: ++ clk_disable_unprepare(es8328->clk); ++ return ret; + } + + static int es8328_component_probe(struct snd_soc_component *component) +-- +2.51.0 + diff --git a/queue-6.1/asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch b/queue-6.1/asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch new file mode 100644 index 00000000000..b94238b6c4c --- /dev/null +++ b/queue-6.1/asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch @@ -0,0 +1,37 @@ +From 0d6570d5c81ea60682719179925a4ddd958b65de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 11:32:50 +0800 +Subject: ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio + +From: Chen Ni + +[ Upstream commit 74823db9ba2e13f3ec007b354759b3d8125e462c ] + +Add check for the return value of devm_regmap_init_mmio() and return the +error if it fails in order to catch the error. + +Signed-off-by: Chen Ni +Link: https://patch.msgid.link/20260127033250.2044608-1-nichen@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sunxi/sun50i-dmic.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/sunxi/sun50i-dmic.c b/sound/soc/sunxi/sun50i-dmic.c +index 86cff5a5b1bd6..e2735bd4f369a 100644 +--- a/sound/soc/sunxi/sun50i-dmic.c ++++ b/sound/soc/sunxi/sun50i-dmic.c +@@ -325,6 +325,9 @@ static int sun50i_dmic_probe(struct platform_device *pdev) + + host->regmap = devm_regmap_init_mmio(&pdev->dev, base, + &sun50i_dmic_regmap_config); ++ if (IS_ERR(host->regmap)) ++ return dev_err_probe(&pdev->dev, PTR_ERR(host->regmap), ++ "failed to initialise regmap\n"); + + /* Clocks */ + host->bus_clk = devm_clk_get(&pdev->dev, "bus"); +-- +2.51.0 + diff --git a/queue-6.1/asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch b/queue-6.1/asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch new file mode 100644 index 00000000000..0a724c08845 --- /dev/null +++ b/queue-6.1/asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch @@ -0,0 +1,36 @@ +From 9101f3e31e279e3f7d5b8f0e5307f83f29e65935 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 04:02:08 +0100 +Subject: ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask + +From: Sebastian Krzyszkowiak + +[ Upstream commit 66c26346ae30c883eef70acf9cf9054dfdb4fb2f ] + +This bit is handled by a separate control. + +Signed-off-by: Sebastian Krzyszkowiak +Reviewed-by: Charles Keepax +Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-1-f4f4eeacf089@puri.sm +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index d215e58c4a7b3..dbab41fb22f5b 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -1759,7 +1759,7 @@ SND_SOC_BYTES("EQR Coefficients", WM8962_EQ24, 18), + + + SOC_SINGLE("3D Switch", WM8962_THREED1, 0, 1, 0), +-SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA), ++SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA | WM8962_ADC_MONOMIX), + + SOC_SINGLE("DF1 Switch", WM8962_DF1, 0, 1, 0), + SND_SOC_BYTES_MASK("DF1 Coefficients", WM8962_DF1, 7, WM8962_DF1_ENA), +-- +2.51.0 + diff --git a/queue-6.1/asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch b/queue-6.1/asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch new file mode 100644 index 00000000000..34f5a7126f5 --- /dev/null +++ b/queue-6.1/asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch @@ -0,0 +1,58 @@ +From e58e43f2f6136432719c782a5810a132221c7ba4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 04:02:10 +0100 +Subject: ASoC: wm8962: Don't report a microphone if it's shorted to ground on + plug + +From: Sebastian Krzyszkowiak + +[ Upstream commit e590752119029d87ce46d725e11245a52d22e1fe ] + +This usually means that a TRS plug with no microphone pin has been plugged +into a TRRS socket. Cases where a user is plugging in a microphone while +pressing a button will be handled via incoming interrupt after the user +releases the button, so the microphone will still be detected once it +becomes usable. + +Signed-off-by: Sebastian Krzyszkowiak +Reviewed-by: Charles Keepax +Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-3-f4f4eeacf089@puri.sm +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index dbab41fb22f5b..a7cd6ee82d7a8 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -67,6 +67,8 @@ struct wm8962_priv { + struct mutex dsp2_ena_lock; + u16 dsp2_ena; + ++ int mic_status; ++ + struct delayed_work mic_work; + struct snd_soc_jack *jack; + +@@ -3073,8 +3075,16 @@ static void wm8962_mic_work(struct work_struct *work) + if (reg & WM8962_MICSHORT_STS) { + status |= SND_JACK_BTN_0; + irq_pol |= WM8962_MICSCD_IRQ_POL; ++ ++ /* Don't report a microphone if it's shorted right after ++ * plugging in, as this may be a TRS plug in a TRRS socket. ++ */ ++ if (!(wm8962->mic_status & WM8962_MICDET_STS)) ++ status = 0; + } + ++ wm8962->mic_status = status; ++ + snd_soc_jack_report(wm8962->jack, status, + SND_JACK_MICROPHONE | SND_JACK_BTN_0); + +-- +2.51.0 + diff --git a/queue-6.1/audit-add-fchmodat2-to-change-attributes-class.patch b/queue-6.1/audit-add-fchmodat2-to-change-attributes-class.patch new file mode 100644 index 00000000000..33e4cd7dd88 --- /dev/null +++ b/queue-6.1/audit-add-fchmodat2-to-change-attributes-class.patch @@ -0,0 +1,42 @@ +From 5bc886737004b0b1e4ec314823eaccf7e70ce8f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 20:49:30 +0100 +Subject: audit: add fchmodat2() to change attributes class + +From: Jeffrey Bencteux + +[ Upstream commit 4f493a6079b588cf1f04ce5ed6cdad45ab0d53dc ] + +fchmodat2(), introduced in version 6.6 is currently not in the change +attribute class of audit. Calling fchmodat2() to change a file +attribute in the same fashion than chmod() or fchmodat() will bypass +audit rules such as: + +-w /tmp/test -p rwa -k test_rwa + +The current patch adds fchmodat2() to the change attributes class. + +Signed-off-by: Jeffrey Bencteux +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + include/asm-generic/audit_change_attr.h | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/include/asm-generic/audit_change_attr.h b/include/asm-generic/audit_change_attr.h +index 331670807cf01..6c311d4d37f4e 100644 +--- a/include/asm-generic/audit_change_attr.h ++++ b/include/asm-generic/audit_change_attr.h +@@ -20,6 +20,9 @@ __NR_fremovexattr, + __NR_fchownat, + __NR_fchmodat, + #endif ++#ifdef __NR_fchmodat2 ++__NR_fchmodat2, ++#endif + #ifdef __NR_chown32 + __NR_chown32, + __NR_fchown32, +-- +2.51.0 + diff --git a/queue-6.1/audit-add-missing-syscalls-to-read-class.patch b/queue-6.1/audit-add-missing-syscalls-to-read-class.patch new file mode 100644 index 00000000000..12bc4bd2448 --- /dev/null +++ b/queue-6.1/audit-add-missing-syscalls-to-read-class.patch @@ -0,0 +1,47 @@ +From 0a644d8c4fd6871eba72d3717b38282b94cf4318 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Dec 2025 09:39:24 +0100 +Subject: audit: add missing syscalls to read class + +From: Jeffrey Bencteux + +[ Upstream commit bcb90a2834c7393c26df9609b889a3097b7700cd ] + +The "at" variant of getxattr() and listxattr() are missing from the +audit read class. Calling getxattrat() or listxattrat() on a file to +read its extended attributes will bypass audit rules such as: + +-w /tmp/test -p rwa -k test_rwa + +The current patch adds missing syscalls to the audit read class. + +Signed-off-by: Jeffrey Bencteux +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + include/asm-generic/audit_read.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/include/asm-generic/audit_read.h b/include/asm-generic/audit_read.h +index 7bb7b5a83ae2e..fb9991f53fb6f 100644 +--- a/include/asm-generic/audit_read.h ++++ b/include/asm-generic/audit_read.h +@@ -4,9 +4,15 @@ __NR_readlink, + #endif + __NR_quotactl, + __NR_listxattr, ++#ifdef __NR_listxattrat ++__NR_listxattrat, ++#endif + __NR_llistxattr, + __NR_flistxattr, + __NR_getxattr, ++#ifdef __NR_getxattrat ++__NR_getxattrat, ++#endif + __NR_lgetxattr, + __NR_fgetxattr, + #ifdef __NR_readlinkat +-- +2.51.0 + diff --git a/queue-6.1/binder-don-t-use-pk-through-printk.patch b/queue-6.1/binder-don-t-use-pk-through-printk.patch new file mode 100644 index 00000000000..415141e0272 --- /dev/null +++ b/queue-6.1/binder-don-t-use-pk-through-printk.patch @@ -0,0 +1,83 @@ +From 800dec1013e00be540a14c46864e2a0d96d5b106 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 15:29:50 +0100 +Subject: binder: don't use %pK through printk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 56d21267663bad91e8b10121224ec46366a7937e ] + +In the past %pK was preferable to %p as it would not leak raw pointer +values into the kernel log. Since commit ad67b74d2469 ("printk: hash +addresses printed with %p") the regular %p has been improved to avoid +this issue. Furthermore, restricted pointers ("%pK") were never meant +to be used through printk(). They can still unintentionally leak raw +pointers or acquire sleeping locks in atomic contexts. + +Switch to the regular pointer formatting which is safer and +easier to reason about. + +There are still a few users of %pK left, but these use it through +seq_file, for which its usage is safe. + +Signed-off-by: Thomas Weißschuh +Acked-by: Carlos Llamas +Reviewed-by: Alice Ryhl +Link: https://patch.msgid.link/20260107-restricted-pointers-binder-v1-1-181018bf3812@linutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/android/binder.c | 2 +- + drivers/android/binder_alloc.c | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/android/binder.c b/drivers/android/binder.c +index 07ff4c1477f82..115791f3bb8c9 100644 +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -4190,7 +4190,7 @@ static int binder_thread_write(struct binder_proc *proc, + } + } + binder_debug(BINDER_DEBUG_DEAD_BINDER, +- "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n", ++ "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n", + proc->pid, thread->pid, (u64)cookie, + death); + if (death == NULL) { +diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c +index fcbb750b1ccc3..f63a46626bab2 100644 +--- a/drivers/android/binder_alloc.c ++++ b/drivers/android/binder_alloc.c +@@ -79,7 +79,7 @@ static void binder_insert_free_buffer(struct binder_alloc *alloc, + new_buffer_size = binder_alloc_buffer_size(alloc, new_buffer); + + binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC, +- "%d: add free buffer, size %zd, at %pK\n", ++ "%d: add free buffer, size %zd, at %p\n", + alloc->pid, new_buffer_size, new_buffer); + + while (*p) { +@@ -474,7 +474,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked( + } + + binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC, +- "%d: binder_alloc_buf size %zd got buffer %pK size %zd\n", ++ "%d: binder_alloc_buf size %zd got buffer %p size %zd\n", + alloc->pid, size, buffer, buffer_size); + + has_page_addr = (void __user *) +@@ -646,7 +646,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc, + ALIGN(buffer->extra_buffers_size, sizeof(void *)); + + binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC, +- "%d: binder_free_buf %pK size %zd buffer_size %zd\n", ++ "%d: binder_free_buf %p size %zd buffer_size %zd\n", + alloc->pid, buffer, size, buffer_size); + + BUG_ON(buffer->free); +-- +2.51.0 + diff --git a/queue-6.1/blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch b/queue-6.1/blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch new file mode 100644 index 00000000000..d031f43fdec --- /dev/null +++ b/queue-6.1/blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch @@ -0,0 +1,42 @@ +From 847aafb092a34f8bd8db68b8f35d0809781846ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 16:05:22 +0800 +Subject: blk-mq-debugfs: add missing debugfs_mutex in + blk_mq_debugfs_register_hctxs() + +From: Yu Kuai + +[ Upstream commit 9d20fd6ce1ba9733cd5ac96fcab32faa9fc404dd ] + +In blk_mq_update_nr_hw_queues(), debugfs_mutex is not held while +creating debugfs entries for hctxs. Hence add debugfs_mutex there, +it's safe because queue is not frozen. + +Signed-off-by: Yu Kuai +Reviewed-by: Nilay Shroff +Reviewed-by: Ming Lei +Reviewed-by: Hannes Reinecke +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-debugfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c +index 7675e663df365..7e149db646dc0 100644 +--- a/block/blk-mq-debugfs.c ++++ b/block/blk-mq-debugfs.c +@@ -756,8 +756,10 @@ void blk_mq_debugfs_register_hctxs(struct request_queue *q) + struct blk_mq_hw_ctx *hctx; + unsigned long i; + ++ mutex_lock(&q->debugfs_mutex); + queue_for_each_hw_ctx(q, hctx, i) + blk_mq_debugfs_register_hctx(q, hctx); ++ mutex_unlock(&q->debugfs_mutex); + } + + void blk_mq_debugfs_unregister_hctxs(struct request_queue *q) +-- +2.51.0 + diff --git a/queue-6.1/bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch b/queue-6.1/bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch new file mode 100644 index 00000000000..cc70899f445 --- /dev/null +++ b/queue-6.1/bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch @@ -0,0 +1,37 @@ +From 64f9c09f89b2d82e1081b397273d67b738b9828a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 10:13:04 +0100 +Subject: Bluetooth: btusb: Add device ID for Realtek RTL8761BU + +From: Jacopo Scannella + +[ Upstream commit cc6383d4f0cf6127c0552f94cae517a06ccc6b17 ] + +Add USB device ID 0x2c0a:0x8761 to the btusb driver fo the Realtek +RTL8761BU Bluetooth adapter. + +Reference: +https://www.startech.com/en-us/networking-io/av53c1-usb-bluetooth + +Signed-off-by: Jacopo Scannella +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 2dc686ac3a15e..cc5ce7a984f6c 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -652,6 +652,7 @@ static const struct usb_device_id blacklist_table[] = { + + /* Additional Realtek 8723BU Bluetooth devices */ + { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK }, ++ { USB_DEVICE(0x2c0a, 0x8761), .driver_info = BTUSB_REALTEK }, + + /* Additional Realtek 8723DE Bluetooth devices */ + { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK }, +-- +2.51.0 + diff --git a/queue-6.1/bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch b/queue-6.1/bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch new file mode 100644 index 00000000000..768c41e2d73 --- /dev/null +++ b/queue-6.1/bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch @@ -0,0 +1,74 @@ +From bf48f510c56f047cc96ff823e32e7a42dd4a27ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 15:03:35 +1100 +Subject: Bluetooth: btusb: Add new VID/PID for RTL8852CE + +From: Shell Chen + +[ Upstream commit d9f7c39c6b7548bd70519b241b6c2d1bcc658d4b ] + +Add VID:PID 13d3:3612 to the quirks_table. + +This ID pair is found in the Realtek RTL8852CE PCIe module +in an ASUS TUF A14 2025 (FA401KM) laptop. + +Tested on aforementioned laptop. + +The device info from /sys/kernel/debug/usb/devices is listed as below. + +T: Bus=03 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 +D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=13d3 ProdID=3612 Rev= 0.00 +S: Manufacturer=Realtek +S: Product=Bluetooth Radio +S: SerialNumber=00e04c000001 +C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms + +Signed-off-by: Shell Chen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index c6ac351209c0e..2dc686ac3a15e 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -534,6 +534,8 @@ static const struct usb_device_id blacklist_table[] = { + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x13d3, 0x3592), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, ++ { USB_DEVICE(0x13d3, 0x3612), .driver_info = BTUSB_REALTEK | ++ BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0489, 0xe122), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, + +-- +2.51.0 + diff --git a/queue-6.1/bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch b/queue-6.1/bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch new file mode 100644 index 00000000000..2d6f7af321d --- /dev/null +++ b/queue-6.1/bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch @@ -0,0 +1,46 @@ +From 149302ad1c2e22cc586c047a205e97d312e287e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 10:20:09 +0100 +Subject: Bluetooth: hci_conn: use mod_delayed_work for active mode timeout +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stefan Sørensen + +[ Upstream commit 49d0901e260739de2fcc90c0c29f9e31e39a2d9b ] + +hci_conn_enter_active_mode() uses queue_delayed_work() with the +intention that the work will run after the given timeout. However, +queue_delayed_work() does nothing if the work is already queued, so +depending on the link policy we may end up putting the connection +into idle mode every hdev->idle_timeout ms. + +Use mod_delayed_work() instead so the work is queued if not already +queued, and the timeout is updated otherwise. + +Signed-off-by: Stefan Sørensen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_conn.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 5f6785fd6af52..8d659aec172b3 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -2486,8 +2486,8 @@ void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active) + + timer: + if (hdev->idle_timeout > 0) +- queue_delayed_work(hdev->workqueue, &conn->idle_work, +- msecs_to_jiffies(hdev->idle_timeout)); ++ mod_delayed_work(hdev->workqueue, &conn->idle_work, ++ msecs_to_jiffies(hdev->idle_timeout)); + } + + /* Drop all connection on the device */ +-- +2.51.0 + diff --git a/queue-6.1/bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch b/queue-6.1/bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch new file mode 100644 index 00000000000..a3446496793 --- /dev/null +++ b/queue-6.1/bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch @@ -0,0 +1,72 @@ +From eb5ecbb0e1bfce8e4bb5b9e2725150fdae87371c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 18:02:19 +0000 +Subject: bpf: verifier improvement in 32bit shift sign extension pattern + +From: Cupertino Miranda + +[ Upstream commit d18dec4b8990048ce75f0ece32bb96b3fbd3f422 ] + +This patch improves the verifier to correctly compute bounds for +sign extension compiler pattern composed of left shift by 32bits +followed by a sign right shift by 32bits. Pattern in the verifier was +limitted to positive value bounds and would reset bound computation for +negative values. New code allows both positive and negative values for +sign extension without compromising bound computation and verifier to +pass. + +This change is required by GCC which generate such pattern, and was +detected in the context of systemd, as described in the following GCC +bugzilla: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119731 + +Three new tests were added in verifier_subreg.c. + +Signed-off-by: Cupertino Miranda +Signed-off-by: Andrew Pinski +Acked-by: Eduard Zingerman +Cc: David Faust +Cc: Jose Marchesi +Cc: Elena Zannoni +Link: https://lore.kernel.org/r/20251202180220.11128-2-cupertino.miranda@oracle.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 18 +++++++----------- + 1 file changed, 7 insertions(+), 11 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 276a0de9a1bb2..42bbc97fab71a 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -9059,21 +9059,17 @@ static void __scalar64_min_max_lsh(struct bpf_reg_state *dst_reg, + u64 umin_val, u64 umax_val) + { + /* Special case <<32 because it is a common compiler pattern to sign +- * extend subreg by doing <<32 s>>32. In this case if 32bit bounds are +- * positive we know this shift will also be positive so we can track +- * bounds correctly. Otherwise we lose all sign bit information except +- * what we can pick up from var_off. Perhaps we can generalize this +- * later to shifts of any length. ++ * extend subreg by doing <<32 s>>32. smin/smax assignments are correct ++ * because s32 bounds don't flip sign when shifting to the left by ++ * 32bits. + */ +- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_max_value >= 0) ++ if (umin_val == 32 && umax_val == 32) { + dst_reg->smax_value = (s64)dst_reg->s32_max_value << 32; +- else +- dst_reg->smax_value = S64_MAX; +- +- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_min_value >= 0) + dst_reg->smin_value = (s64)dst_reg->s32_min_value << 32; +- else ++ } else { ++ dst_reg->smax_value = S64_MAX; + dst_reg->smin_value = S64_MIN; ++ } + + /* If we might shift our top bit out, then we know nothing */ + if (dst_reg->umax_value > 1ULL << (63 - umax_val)) { +-- +2.51.0 + diff --git a/queue-6.1/btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch b/queue-6.1/btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch new file mode 100644 index 00000000000..ae3ccd06dc1 --- /dev/null +++ b/queue-6.1/btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch @@ -0,0 +1,46 @@ +From 8f7e8df99257e000cff7134a23cba61f97499937 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 22:53:57 +0530 +Subject: btrfs: replace BUG() with error handling in __btrfs_balance() + +From: Adarsh Das + +[ Upstream commit be6324a809dbda76d5fdb23720ad9b20e5c1905c ] + +We search with offset (u64)-1 which should never match exactly. +Previously this was handled with BUG(). Now logs an error +and return -EUCLEAN. + +Reviewed-by: Qu Wenruo +Signed-off-by: Adarsh Das +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/volumes.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 366cf2e8c51cb..d06709ced0f36 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -4011,8 +4011,14 @@ static int __btrfs_balance(struct btrfs_fs_info *fs_info) + * this shouldn't happen, it means the last relocate + * failed + */ +- if (ret == 0) +- BUG(); /* FIXME break ? */ ++ if (unlikely(ret == 0)) { ++ btrfs_err(fs_info, ++ "unexpected exact match of CHUNK_ITEM in chunk tree, offset 0x%llx", ++ key.offset); ++ mutex_unlock(&fs_info->reclaim_bgs_lock); ++ ret = -EUCLEAN; ++ goto error; ++ } + + ret = btrfs_previous_item(chunk_root, path, 0, + BTRFS_CHUNK_ITEM_KEY); +-- +2.51.0 + diff --git a/queue-6.1/ceph-supply-snapshot-context-in-ceph_uninline_data.patch b/queue-6.1/ceph-supply-snapshot-context-in-ceph_uninline_data.patch new file mode 100644 index 00000000000..fcf1bfe525d --- /dev/null +++ b/queue-6.1/ceph-supply-snapshot-context-in-ceph_uninline_data.patch @@ -0,0 +1,127 @@ +From 8c54e7f908eea1454e95083ce07a6dfc5e790777 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 18:42:06 +0800 +Subject: ceph: supply snapshot context in ceph_uninline_data() + +From: ethanwu + +[ Upstream commit 305ff6b3a03c230d3c07b61457e961406d979693 ] + +The ceph_uninline_data function was missing proper snapshot context +handling for its OSD write operations. Both CEPH_OSD_OP_CREATE and +CEPH_OSD_OP_WRITE requests were passing NULL instead of the appropriate +snapshot context, which could lead to unnecessary object clone. + +Reproducer: +../src/vstart.sh --new -x --localhost --bluestore +// turn on cephfs inline data +./bin/ceph fs set a inline_data true --yes-i-really-really-mean-it +// allow fs_a client to take snapshot +./bin/ceph auth caps client.fs_a mds 'allow rwps fsname=a' mon 'allow r fsname=a' osd 'allow rw tag cephfs data=a' +// mount cephfs with fuse, since kernel cephfs doesn't support inline write +ceph-fuse --id fs_a -m 127.0.0.1:40318 --conf ceph.conf -d /mnt/mycephfs/ +// bump snapshot seq +mkdir /mnt/mycephfs/.snap/snap1 +echo "foo" > /mnt/mycephfs/test +// umount and mount it again using kernel cephfs client +umount /mnt/mycephfs +mount -t ceph fs_a@.a=/ /mnt/mycephfs/ -o conf=./ceph.conf +echo "bar" >> /mnt/mycephfs/test +./bin/rados listsnaps -p cephfs.a.data $(printf "%x\n" $(stat -c %i /mnt/mycephfs/test)).00000000 + +will see this object does unnecessary clone +1000000000a.00000000 (seq:2): +cloneid snaps size overlap +2 2 4 [] +head - 8 + +but it's expected to see +10000000000.00000000 (seq:2): +cloneid snaps size overlap +head - 8 + +since there's no snapshot between these 2 writes + +clone happened because the first osd request CEPH_OSD_OP_CREATE doesn't +pass snap context so object is created with snap seq 0, but later data +writeback is equipped with snapshot context. +snap.seq(1) > object snap seq(0), so osd does object clone. + +This fix properly acquiring the snapshot context before performing +write operations. + +Signed-off-by: ethanwu +Reviewed-by: Viacheslav Dubeyko +Tested-by: Viacheslav Dubeyko +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/addr.c | 24 ++++++++++++++++++++++-- + 1 file changed, 22 insertions(+), 2 deletions(-) + +diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c +index f92c7dc9d9bf1..b1d6ca50e1222 100644 +--- a/fs/ceph/addr.c ++++ b/fs/ceph/addr.c +@@ -1704,6 +1704,7 @@ int ceph_uninline_data(struct file *file) + struct ceph_osd_request *req = NULL; + struct ceph_cap_flush *prealloc_cf = NULL; + struct folio *folio = NULL; ++ struct ceph_snap_context *snapc = NULL; + u64 inline_version = CEPH_INLINE_NONE; + struct page *pages[1]; + int err = 0; +@@ -1731,6 +1732,24 @@ int ceph_uninline_data(struct file *file) + if (inline_version == 1) /* initial version, no data */ + goto out_uninline; + ++ down_read(&fsc->mdsc->snap_rwsem); ++ spin_lock(&ci->i_ceph_lock); ++ if (__ceph_have_pending_cap_snap(ci)) { ++ struct ceph_cap_snap *capsnap = ++ list_last_entry(&ci->i_cap_snaps, ++ struct ceph_cap_snap, ++ ci_item); ++ snapc = ceph_get_snap_context(capsnap->context); ++ } else { ++ if (!ci->i_head_snapc) { ++ ci->i_head_snapc = ceph_get_snap_context( ++ ci->i_snap_realm->cached_context); ++ } ++ snapc = ceph_get_snap_context(ci->i_head_snapc); ++ } ++ spin_unlock(&ci->i_ceph_lock); ++ up_read(&fsc->mdsc->snap_rwsem); ++ + folio = read_mapping_folio(inode->i_mapping, 0, file); + if (IS_ERR(folio)) { + err = PTR_ERR(folio); +@@ -1746,7 +1765,7 @@ int ceph_uninline_data(struct file *file) + req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout, + ceph_vino(inode), 0, &len, 0, 1, + CEPH_OSD_OP_CREATE, CEPH_OSD_FLAG_WRITE, +- NULL, 0, 0, false); ++ snapc, 0, 0, false); + if (IS_ERR(req)) { + err = PTR_ERR(req); + goto out_unlock; +@@ -1762,7 +1781,7 @@ int ceph_uninline_data(struct file *file) + req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout, + ceph_vino(inode), 0, &len, 1, 3, + CEPH_OSD_OP_WRITE, CEPH_OSD_FLAG_WRITE, +- NULL, ci->i_truncate_seq, ++ snapc, ci->i_truncate_seq, + ci->i_truncate_size, false); + if (IS_ERR(req)) { + err = PTR_ERR(req); +@@ -1825,6 +1844,7 @@ int ceph_uninline_data(struct file *file) + folio_put(folio); + } + out: ++ ceph_put_snap_context(snapc); + ceph_free_cap_flush(prealloc_cf); + dout("uninline_data %p %llx.%llx inline_version %llu = %d\n", + inode, ceph_vinop(inode), inline_version, err); +-- +2.51.0 + diff --git a/queue-6.1/char-tpm-cr50-remove-irqf_oneshot.patch b/queue-6.1/char-tpm-cr50-remove-irqf_oneshot.patch new file mode 100644 index 00000000000..aa69c7d2f6b --- /dev/null +++ b/queue-6.1/char-tpm-cr50-remove-irqf_oneshot.patch @@ -0,0 +1,59 @@ +From 0d1017da273b867df94f4b030cc14735c12c7dbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:29 +0100 +Subject: char: tpm: cr50: Remove IRQF_ONESHOT + +From: Sebastian Andrzej Siewior + +[ Upstream commit 1affd29ffbd50125a5492c6be1dbb1f04be18d4f ] + +Passing IRQF_ONESHOT ensures that the interrupt source is masked until +the secondary (threaded) handler is done. If only a primary handler is +used then the flag makes no sense because the interrupt can not fire +(again) while its handler is running. + +The flag also prevents force-threading of the primary handler and the +irq-core will warn about this. + +Remove IRQF_ONESHOT from irqflags. + +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Thomas Gleixner +Reviewed-by: Jarkko Sakkinen +Link: https://patch.msgid.link/20260128095540.863589-10-bigeasy@linutronix.de +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_i2c_cr50.c | 3 +-- + drivers/char/tpm/tpm_tis_spi_cr50.c | 2 +- + 2 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_i2c_cr50.c b/drivers/char/tpm/tpm_tis_i2c_cr50.c +index 77cea5b31c6e4..99e05c517673d 100644 +--- a/drivers/char/tpm/tpm_tis_i2c_cr50.c ++++ b/drivers/char/tpm/tpm_tis_i2c_cr50.c +@@ -714,8 +714,7 @@ static int tpm_cr50_i2c_probe(struct i2c_client *client) + + if (client->irq > 0) { + rc = devm_request_irq(dev, client->irq, tpm_cr50_i2c_int_handler, +- IRQF_TRIGGER_FALLING | IRQF_ONESHOT | +- IRQF_NO_AUTOEN, ++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN, + dev->driver->name, chip); + if (rc < 0) { + dev_err(dev, "Failed to probe IRQ %d\n", client->irq); +diff --git a/drivers/char/tpm/tpm_tis_spi_cr50.c b/drivers/char/tpm/tpm_tis_spi_cr50.c +index f4937280e9406..32920b4cecfb4 100644 +--- a/drivers/char/tpm/tpm_tis_spi_cr50.c ++++ b/drivers/char/tpm/tpm_tis_spi_cr50.c +@@ -287,7 +287,7 @@ int cr50_spi_probe(struct spi_device *spi) + if (spi->irq > 0) { + ret = devm_request_irq(&spi->dev, spi->irq, + cr50_spi_irq_handler, +- IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ IRQF_TRIGGER_RISING, + "cr50_spi", cr50_phy); + if (ret < 0) { + if (ret == -EPROBE_DEFER) +-- +2.51.0 + diff --git a/queue-6.1/clk-microchip-core-correct-return-value-on-_get_pare.patch b/queue-6.1/clk-microchip-core-correct-return-value-on-_get_pare.patch new file mode 100644 index 00000000000..9685f0fba60 --- /dev/null +++ b/queue-6.1/clk-microchip-core-correct-return-value-on-_get_pare.patch @@ -0,0 +1,80 @@ +From 89d8c23b86b2333b314914b83da4b0bac40f8acf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 14:46:28 -0500 +Subject: clk: microchip: core: correct return value on *_get_parent() + +From: Brian Masney + +[ Upstream commit 5df96d141cccb37f0c3112a22fc1112ea48e9246 ] + +roclk_get_parent() and sclk_get_parent() has the possibility of +returning -EINVAL, however the framework expects this call to always +succeed since the return value is unsigned. + +If there is no parent map defined, then the current value programmed in +the hardware is used. Let's use that same value in the case where +-EINVAL is currently returned. + +This index is only used by clk_core_get_parent_by_index(), and it +validates that it doesn't overflow the number of available parents. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202512050233.R9hAWsJN-lkp@intel.com/ +Signed-off-by: Brian Masney +Reviewed-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20251205-clk-microchip-fixes-v3-2-a02190705e47@redhat.com +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + drivers/clk/microchip/clk-core.c | 25 ++++++++++++------------- + 1 file changed, 12 insertions(+), 13 deletions(-) + +diff --git a/drivers/clk/microchip/clk-core.c b/drivers/clk/microchip/clk-core.c +index 1b4f023cdc8be..71fbaf8318f22 100644 +--- a/drivers/clk/microchip/clk-core.c ++++ b/drivers/clk/microchip/clk-core.c +@@ -281,14 +281,13 @@ static u8 roclk_get_parent(struct clk_hw *hw) + + v = (readl(refo->ctrl_reg) >> REFO_SEL_SHIFT) & REFO_SEL_MASK; + +- if (!refo->parent_map) +- return v; +- +- for (i = 0; i < clk_hw_get_num_parents(hw); i++) +- if (refo->parent_map[i] == v) +- return i; ++ if (refo->parent_map) { ++ for (i = 0; i < clk_hw_get_num_parents(hw); i++) ++ if (refo->parent_map[i] == v) ++ return i; ++ } + +- return -EINVAL; ++ return v; + } + + static unsigned long roclk_calc_rate(unsigned long parent_rate, +@@ -823,13 +822,13 @@ static u8 sclk_get_parent(struct clk_hw *hw) + + v = (readl(sclk->mux_reg) >> OSC_CUR_SHIFT) & OSC_CUR_MASK; + +- if (!sclk->parent_map) +- return v; ++ if (sclk->parent_map) { ++ for (i = 0; i < clk_hw_get_num_parents(hw); i++) ++ if (sclk->parent_map[i] == v) ++ return i; ++ } + +- for (i = 0; i < clk_hw_get_num_parents(hw); i++) +- if (sclk->parent_map[i] == v) +- return i; +- return -EINVAL; ++ return v; + } + + static int sclk_set_parent(struct clk_hw *hw, u8 index) +-- +2.51.0 + diff --git a/queue-6.1/clocksource-drivers-sh_tmu-always-leave-device-runni.patch b/queue-6.1/clocksource-drivers-sh_tmu-always-leave-device-runni.patch new file mode 100644 index 00000000000..77c4779432e --- /dev/null +++ b/queue-6.1/clocksource-drivers-sh_tmu-always-leave-device-runni.patch @@ -0,0 +1,149 @@ +From 309e247823a601a66470e743d4dbda277c01c76e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 23:13:41 +0100 +Subject: clocksource/drivers/sh_tmu: Always leave device running after probe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Niklas Söderlund + +[ Upstream commit b1278972b08e480990e2789bdc6a7c918bc349be ] + +The TMU device can be used as both a clocksource and a clockevent +provider. The driver tries to be smart and power itself on and off, as +well as enabling and disabling its clock when it's not in operation. +This behavior is slightly altered if the TMU is used as an early +platform device in which case the device is left powered on after probe, +but the clock is still enabled and disabled at runtime. + +This has worked for a long time, but recent improvements in PREEMPT_RT +and PROVE_LOCKING have highlighted an issue. As the TMU registers itself +as a clockevent provider, clockevents_register_device(), it needs to use +raw spinlocks internally as this is the context of which the clockevent +framework interacts with the TMU driver. However in the context of +holding a raw spinlock the TMU driver can't really manage its power +state or clock with calls to pm_runtime_*() and clk_*() as these calls +end up in other platform drivers using regular spinlocks to control +power and clocks. + +This mix of spinlock contexts trips a lockdep warning. + + ============================= + [ BUG: Invalid wait context ] + 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 Not tainted + ----------------------------- + swapper/0/0 is trying to lock: + ffff000008c9e180 (&dev->power.lock){-...}-{3:3}, at: __pm_runtime_resume+0x38/0x88 + other info that might help us debug this: + context-{5:5} + 1 lock held by swapper/0/0: + ccree e6601000.crypto: ARM CryptoCell 630P Driver: HW version 0xAF400001/0xDCC63000, Driver version 5.0 + #0: ffff8000817ec298 + ccree e6601000.crypto: ARM ccree device initialized + (tick_broadcast_lock){-...}-{2:2}, at: __tick_broadcast_oneshot_control+0xa4/0x3a8 + stack backtrace: + CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 PREEMPT + Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT) + Call trace: + show_stack+0x14/0x1c (C) + dump_stack_lvl+0x6c/0x90 + dump_stack+0x14/0x1c + __lock_acquire+0x904/0x1584 + lock_acquire+0x220/0x34c + _raw_spin_lock_irqsave+0x58/0x80 + __pm_runtime_resume+0x38/0x88 + sh_tmu_clock_event_set_oneshot+0x84/0xd4 + clockevents_switch_state+0xfc/0x13c + tick_broadcast_set_event+0x30/0xa4 + __tick_broadcast_oneshot_control+0x1e0/0x3a8 + tick_broadcast_oneshot_control+0x30/0x40 + cpuidle_enter_state+0x40c/0x680 + cpuidle_enter+0x30/0x40 + do_idle+0x1f4/0x280 + cpu_startup_entry+0x34/0x40 + kernel_init+0x0/0x130 + do_one_initcall+0x0/0x230 + __primary_switched+0x88/0x90 + +For non-PREEMPT_RT builds this is not really an issue, but for +PREEMPT_RT builds where normal spinlocks can sleep this might be an +issue. Be cautious and always leave the power and clock running after +probe. + +Signed-off-by: Niklas Söderlund +Signed-off-by: Daniel Lezcano +Tested-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20251202221341.1856773-1-niklas.soderlund+renesas@ragnatech.se +Signed-off-by: Sasha Levin +--- + drivers/clocksource/sh_tmu.c | 18 ------------------ + 1 file changed, 18 deletions(-) + +diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c +index b00dec0655cb2..2e35bb39ef42f 100644 +--- a/drivers/clocksource/sh_tmu.c ++++ b/drivers/clocksource/sh_tmu.c +@@ -143,16 +143,6 @@ static void sh_tmu_start_stop_ch(struct sh_tmu_channel *ch, int start) + + static int __sh_tmu_enable(struct sh_tmu_channel *ch) + { +- int ret; +- +- /* enable clock */ +- ret = clk_enable(ch->tmu->clk); +- if (ret) { +- dev_err(&ch->tmu->pdev->dev, "ch%u: cannot enable clock\n", +- ch->index); +- return ret; +- } +- + /* make sure channel is disabled */ + sh_tmu_start_stop_ch(ch, 0); + +@@ -174,7 +164,6 @@ static int sh_tmu_enable(struct sh_tmu_channel *ch) + if (ch->enable_count++ > 0) + return 0; + +- pm_runtime_get_sync(&ch->tmu->pdev->dev); + dev_pm_syscore_device(&ch->tmu->pdev->dev, true); + + return __sh_tmu_enable(ch); +@@ -187,9 +176,6 @@ static void __sh_tmu_disable(struct sh_tmu_channel *ch) + + /* disable interrupts in TMU block */ + sh_tmu_write(ch, TCR, TCR_TPSC_CLK4); +- +- /* stop clock */ +- clk_disable(ch->tmu->clk); + } + + static void sh_tmu_disable(struct sh_tmu_channel *ch) +@@ -203,7 +189,6 @@ static void sh_tmu_disable(struct sh_tmu_channel *ch) + __sh_tmu_disable(ch); + + dev_pm_syscore_device(&ch->tmu->pdev->dev, false); +- pm_runtime_put(&ch->tmu->pdev->dev); + } + + static void sh_tmu_set_next(struct sh_tmu_channel *ch, unsigned long delta, +@@ -552,7 +537,6 @@ static int sh_tmu_setup(struct sh_tmu_device *tmu, struct platform_device *pdev) + goto err_clk_unprepare; + + tmu->rate = clk_get_rate(tmu->clk) / 4; +- clk_disable(tmu->clk); + + /* Map the memory resource. */ + ret = sh_tmu_map_memory(tmu); +@@ -626,8 +610,6 @@ static int sh_tmu_probe(struct platform_device *pdev) + out: + if (tmu->has_clockevent || tmu->has_clocksource) + pm_runtime_irq_safe(&pdev->dev); +- else +- pm_runtime_idle(&pdev->dev); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.1/clocksource-drivers-timer-integrator-ap-add-missing-.patch b/queue-6.1/clocksource-drivers-timer-integrator-ap-add-missing-.patch new file mode 100644 index 00000000000..2cdfd63fa56 --- /dev/null +++ b/queue-6.1/clocksource-drivers-timer-integrator-ap-add-missing-.patch @@ -0,0 +1,38 @@ +From 87cdca6ee9c0b11d319be0be46cc6efc2ffd75ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jan 2026 12:17:23 +0100 +Subject: clocksource/drivers/timer-integrator-ap: Add missing Kconfig + dependency on OF + +From: Bartosz Golaszewski + +[ Upstream commit 2246464821e2820572e6feefca2029f17629cc50 ] + +This driver accesses the of_aliases global variable declared in +linux/of.h and defined in drivers/base/of.c. It requires OF support or +will cause a link failure. Add the missing Kconfig dependency. + +Closes: https://lore.kernel.org/oe-kbuild-all/202601152233.og6LdeUo-lkp@intel.com/ +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Daniel Lezcano +Link: https://patch.msgid.link/20260116111723.10585-1-bartosz.golaszewski@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/clocksource/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig +index c957bd470507e..18283d9879025 100644 +--- a/drivers/clocksource/Kconfig ++++ b/drivers/clocksource/Kconfig +@@ -236,6 +236,7 @@ config KEYSTONE_TIMER + + config INTEGRATOR_AP_TIMER + bool "Integrator-AP timer driver" if COMPILE_TEST ++ depends on OF + select CLKSRC_MMIO + help + Enables support for the Integrator-AP timer. +-- +2.51.0 + diff --git a/queue-6.1/dm-remove-fake-timeout-to-avoid-leak-request.patch b/queue-6.1/dm-remove-fake-timeout-to-avoid-leak-request.patch new file mode 100644 index 00000000000..a5f41a4e932 --- /dev/null +++ b/queue-6.1/dm-remove-fake-timeout-to-avoid-leak-request.patch @@ -0,0 +1,86 @@ +From 821fd9c58083cb54cabf6085e25556ebd8de21da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Dec 2025 20:03:50 +0800 +Subject: dm: remove fake timeout to avoid leak request + +From: Ding Hui + +[ Upstream commit f3a9c95a15d2f4466acad5c68faeff79ca5e9f47 ] + +Since commit 15f73f5b3e59 ("blk-mq: move failure injection out of +blk_mq_complete_request"), drivers are responsible for calling +blk_should_fake_timeout() at appropriate code paths and opportunities. + +However, the dm driver does not implement its own timeout handler and +relies on the timeout handling of its slave devices. + +If an io-timeout-fail error is injected to a dm device, the request +will be leaked and never completed, causing tasks to hang indefinitely. + +Reproduce: +1. prepare dm which has iscsi slave device +2. inject io-timeout-fail to dm + echo 1 >/sys/class/block/dm-0/io-timeout-fail + echo 100 >/sys/kernel/debug/fail_io_timeout/probability + echo 10 >/sys/kernel/debug/fail_io_timeout/times +3. read/write dm +4. iscsiadm -m node -u + +Result: hang task like below +[ 862.243768] INFO: task kworker/u514:2:151 blocked for more than 122 seconds. +[ 862.244133] Tainted: G E 6.19.0-rc1+ #51 +[ 862.244337] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 862.244718] task:kworker/u514:2 state:D stack:0 pid:151 tgid:151 ppid:2 task_flags:0x4288060 flags:0x00080000 +[ 862.245024] Workqueue: iscsi_ctrl_3:1 __iscsi_unbind_session [scsi_transport_iscsi] +[ 862.245264] Call Trace: +[ 862.245587] +[ 862.245814] __schedule+0x810/0x15c0 +[ 862.246557] schedule+0x69/0x180 +[ 862.246760] blk_mq_freeze_queue_wait+0xde/0x120 +[ 862.247688] elevator_change+0x16d/0x460 +[ 862.247893] elevator_set_none+0x87/0xf0 +[ 862.248798] blk_unregister_queue+0x12e/0x2a0 +[ 862.248995] __del_gendisk+0x231/0x7e0 +[ 862.250143] del_gendisk+0x12f/0x1d0 +[ 862.250339] sd_remove+0x85/0x130 [sd_mod] +[ 862.250650] device_release_driver_internal+0x36d/0x530 +[ 862.250849] bus_remove_device+0x1dd/0x3f0 +[ 862.251042] device_del+0x38a/0x930 +[ 862.252095] __scsi_remove_device+0x293/0x360 +[ 862.252291] scsi_remove_target+0x486/0x760 +[ 862.252654] __iscsi_unbind_session+0x18a/0x3e0 [scsi_transport_iscsi] +[ 862.252886] process_one_work+0x633/0xe50 +[ 862.253101] worker_thread+0x6df/0xf10 +[ 862.253647] kthread+0x36d/0x720 +[ 862.254533] ret_from_fork+0x2a6/0x470 +[ 862.255852] ret_from_fork_asm+0x1a/0x30 +[ 862.256037] + +Remove the blk_should_fake_timeout() check from dm, as dm has no +native timeout handling and should not attempt to fake timeouts. + +Signed-off-by: Ding Hui +Reviewed-by: Christoph Hellwig +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + drivers/md/dm-rq.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c +index 6685dc3b8b448..53e3d0e8a99af 100644 +--- a/drivers/md/dm-rq.c ++++ b/drivers/md/dm-rq.c +@@ -276,8 +276,7 @@ static void dm_complete_request(struct request *rq, blk_status_t error) + struct dm_rq_target_io *tio = tio_from_request(rq); + + tio->error = error; +- if (likely(!blk_should_fake_timeout(rq->q))) +- blk_mq_complete_request(rq); ++ blk_mq_complete_request(rq); + } + + /* +-- +2.51.0 + diff --git a/queue-6.1/dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch b/queue-6.1/dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch new file mode 100644 index 00000000000..f558a2b601d --- /dev/null +++ b/queue-6.1/dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch @@ -0,0 +1,51 @@ +From 8cf5fd9cd9aa55ba2dba0c3694e22a30aed2b5f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Dec 2025 09:15:03 +0100 +Subject: dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix + warnings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Le Goffic + +[ Upstream commit aaf3bc0265744adbc2d364964ef409cf118d193d ] + +m2m_hw_period is initialized only when chan_config->m2m_hw is true. This +triggers a warning: +‘m2m_hw_period’ may be used uninitialized [-Wmaybe-uninitialized] +Although m2m_hw_period is only used when chan_config->m2m_hw is true and +ignored otherwise, initialize it unconditionally to 0. + +ccr is initialized by stm32_mdma_set_xfer_param() when the sg list is not +empty. This triggers a warning: +‘ccr’ may be used uninitialized [-Wmaybe-uninitialized] +Indeed, it could be used uninitialized if the sg list is empty. Initialize +it to 0. + +Signed-off-by: Clément Le Goffic +Reviewed-by: Clément Le Goffic +Signed-off-by: Amelie Delaunay +Link: https://patch.msgid.link/20251217-mdma_warnings_fix-v2-1-340200e0bb55@foss.st.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/stm32-mdma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c +index 65ef1f5ca6b89..405c1fe2d6a3e 100644 +--- a/drivers/dma/stm32-mdma.c ++++ b/drivers/dma/stm32-mdma.c +@@ -733,7 +733,7 @@ static int stm32_mdma_setup_xfer(struct stm32_mdma_chan *chan, + struct stm32_mdma_chan_config *chan_config = &chan->chan_config; + struct scatterlist *sg; + dma_addr_t src_addr, dst_addr; +- u32 m2m_hw_period, ccr, ctcr, ctbr; ++ u32 m2m_hw_period = 0, ccr = 0, ctcr, ctbr; + int i, ret = 0; + + if (chan_config->m2m_hw) +-- +2.51.0 + diff --git a/queue-6.1/dmaengine-sun6i-choose-appropriate-burst-length-unde.patch b/queue-6.1/dmaengine-sun6i-choose-appropriate-burst-length-unde.patch new file mode 100644 index 00000000000..fe037b01be8 --- /dev/null +++ b/queue-6.1/dmaengine-sun6i-choose-appropriate-burst-length-unde.patch @@ -0,0 +1,80 @@ +From 8695c9fd215f0460cf8e11de170dd02dd44a66f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Dec 2025 16:04:48 +0800 +Subject: dmaengine: sun6i: Choose appropriate burst length under maxburst + +From: Chen-Yu Tsai + +[ Upstream commit 7178c3586ab42693b28bb81014320a7783e5c435 ] + +maxburst, as provided by the client, specifies the largest amount of +data that is allowed to be transferred in one burst. This limit is +normally provided to avoid a data burst overflowing the target FIFO. +It does not mean that the DMA engine can only do bursts in that size. + +Let the driver pick the largest supported burst length within the +given limit. This lets the driver work correctly with some clients that +give a large maxburst value. In particular, the 8250_dw driver will give +a quarter of the UART's FIFO size as maxburst. On some systems the FIFO +size is 256 bytes, giving a maxburst of 64 bytes, while the hardware +only supports bursts of up to 16 bytes. + +Signed-off-by: Chen-Yu Tsai +Reviewed-by: Jernej Skrabec +Link: https://patch.msgid.link/20251221080450.1813479-1-wens@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/sun6i-dma.c | 26 ++++++++++++++++++++------ + 1 file changed, 20 insertions(+), 6 deletions(-) + +diff --git a/drivers/dma/sun6i-dma.c b/drivers/dma/sun6i-dma.c +index b7557f4379362..7ca0c26f9e872 100644 +--- a/drivers/dma/sun6i-dma.c ++++ b/drivers/dma/sun6i-dma.c +@@ -581,6 +581,22 @@ static irqreturn_t sun6i_dma_interrupt(int irq, void *dev_id) + return ret; + } + ++static u32 find_burst_size(const u32 burst_lengths, u32 maxburst) ++{ ++ if (!maxburst) ++ return 1; ++ ++ if (BIT(maxburst) & burst_lengths) ++ return maxburst; ++ ++ /* Hardware only does power-of-two bursts. */ ++ for (u32 burst = rounddown_pow_of_two(maxburst); burst > 0; burst /= 2) ++ if (BIT(burst) & burst_lengths) ++ return burst; ++ ++ return 1; ++} ++ + static int set_config(struct sun6i_dma_dev *sdev, + struct dma_slave_config *sconfig, + enum dma_transfer_direction direction, +@@ -614,15 +630,13 @@ static int set_config(struct sun6i_dma_dev *sdev, + return -EINVAL; + if (!(BIT(dst_addr_width) & sdev->slave.dst_addr_widths)) + return -EINVAL; +- if (!(BIT(src_maxburst) & sdev->cfg->src_burst_lengths)) +- return -EINVAL; +- if (!(BIT(dst_maxburst) & sdev->cfg->dst_burst_lengths)) +- return -EINVAL; + + src_width = convert_buswidth(src_addr_width); + dst_width = convert_buswidth(dst_addr_width); +- dst_burst = convert_burst(dst_maxburst); +- src_burst = convert_burst(src_maxburst); ++ src_burst = find_burst_size(sdev->cfg->src_burst_lengths, src_maxburst); ++ dst_burst = find_burst_size(sdev->cfg->dst_burst_lengths, dst_maxburst); ++ dst_burst = convert_burst(dst_burst); ++ src_burst = convert_burst(src_burst); + + *p_cfg = DMA_CHAN_CFG_SRC_WIDTH(src_width) | + DMA_CHAN_CFG_DST_WIDTH(dst_width); +-- +2.51.0 + diff --git a/queue-6.1/drm-account-property-blob-allocations-to-memcg.patch b/queue-6.1/drm-account-property-blob-allocations-to-memcg.patch new file mode 100644 index 00000000000..d72b62a8706 --- /dev/null +++ b/queue-6.1/drm-account-property-blob-allocations-to-memcg.patch @@ -0,0 +1,46 @@ +From 5b0a3d54428e717b5a61d95168fb4c1f4e0875f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 08:22:26 -0500 +Subject: drm: Account property blob allocations to memcg + +From: Xiao Kan <814091656@qq.com> + +[ Upstream commit 26b4309a3ab82a0697751cde52eb336c29c19035 ] + +DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized +property blobs backed by kernel memory. + +Currently, the blob data allocation is not accounted to the allocating +process's memory cgroup, allowing unprivileged users to trigger unbounded +kernel memory consumption and potentially cause system-wide OOM. + +Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory +is properly charged to the caller's memcg. This ensures existing cgroup +memory limits apply and prevents uncontrolled kernel memory growth without +introducing additional policy or per-file limits. + +Signed-off-by: Xiao Kan <814091656@qq.com> +Signed-off-by: Xiao Kan +Link: https://patch.msgid.link/tencent_D12AA2DEDE6F359E1AF59405242FB7A5FD05@qq.com +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_property.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c +index dfec479830e49..b4ee7d4110f84 100644 +--- a/drivers/gpu/drm/drm_property.c ++++ b/drivers/gpu/drm/drm_property.c +@@ -561,7 +561,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length, + if (!length || length > INT_MAX - sizeof(struct drm_property_blob)) + return ERR_PTR(-EINVAL); + +- blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL); ++ blob = kvzalloc(sizeof(struct drm_property_blob) + length, GFP_KERNEL_ACCOUNT); + if (!blob) + return ERR_PTR(-ENOMEM); + +-- +2.51.0 + diff --git a/queue-6.1/drm-amd-display-avoid-updating-surface-with-the-same.patch b/queue-6.1/drm-amd-display-avoid-updating-surface-with-the-same.patch new file mode 100644 index 00000000000..ba084d86ab8 --- /dev/null +++ b/queue-6.1/drm-amd-display-avoid-updating-surface-with-the-same.patch @@ -0,0 +1,43 @@ +From a997ecde706afe2b8d67982d21afe6d1fd953cbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 14:47:01 +0800 +Subject: drm/amd/display: Avoid updating surface with the same surface under + MPO + +From: Wayne Lin + +[ Upstream commit 1a38ded4bc8ac09fd029ec656b1e2c98cc0d238c ] + +[Why & How] +Although it's dummy updates of surface update for committing stream +updates, we should not have dummy_updates[j].surface all indicating +to the same surface under multiple surfaces case. Otherwise, +copy_surface_update_to_plane() in update_planes_and_stream_state() +will update to the same surface only. + +Reviewed-by: Harry Wentland +Signed-off-by: Wayne Lin +Signed-off-by: Tom Chung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index f7fbc7932bb5b..2130540719043 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -8695,7 +8695,7 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state) + * To fix this, DC should permit updating only stream properties. + */ + for (j = 0; j < status->plane_count; j++) +- dummy_updates[j].surface = status->plane_states[0]; ++ dummy_updates[j].surface = status->plane_states[j]; + + + mutex_lock(&dm->dc_lock); +-- +2.51.0 + diff --git a/queue-6.1/drm-amd-display-remove-conditional-for-shaper-3dlut-.patch b/queue-6.1/drm-amd-display-remove-conditional-for-shaper-3dlut-.patch new file mode 100644 index 00000000000..83d76c9bf78 --- /dev/null +++ b/queue-6.1/drm-amd-display-remove-conditional-for-shaper-3dlut-.patch @@ -0,0 +1,44 @@ +From 600a8b74d0c7c072ac25ddcddab9a643eb5f73fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 22:05:16 -0700 +Subject: drm/amd/display: Remove conditional for shaper 3DLUT power-on + +From: Alex Hung + +[ Upstream commit 1b38a87b8f8020e8ef4563e7752a64182b5a39b9 ] + +[Why] +Shaper programming has high chance to fail on first time after +power-on or reboot. This can be verified by running IGT's kms_colorop. + +[How] +Always power on the shaper and 3DLUT before programming by +removing the debug flag of low power mode. + +Reviewed-by: Aurabindo Pillai +Signed-off-by: Alex Hung +Signed-off-by: Ray Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c +index 4edd0655965b8..34c10cffd3061 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c +@@ -716,8 +716,7 @@ static bool mpc32_program_shaper( + return false; + } + +- if (mpc->ctx->dc->debug.enable_mem_low_power.bits.mpc) +- mpc32_power_on_shaper_3dlut(mpc, mpcc_id, true); ++ mpc32_power_on_shaper_3dlut(mpc, mpcc_id, true); + + current_mode = mpc32_get_shaper_current(mpc, mpcc_id); + +-- +2.51.0 + diff --git a/queue-6.1/drm-amdgpu-add-hainan-clock-adjustment.patch b/queue-6.1/drm-amdgpu-add-hainan-clock-adjustment.patch new file mode 100644 index 00000000000..301e531505c --- /dev/null +++ b/queue-6.1/drm-amdgpu-add-hainan-clock-adjustment.patch @@ -0,0 +1,39 @@ +From 05a92a93d7e4b7155dedfad54734c12f32313065 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Feb 2026 07:24:01 +0000 +Subject: drm/amdgpu: Add HAINAN clock adjustment + +From: decce6 + +[ Upstream commit 49fe2c57bdc0acff9d2551ae337270b6fd8119d9 ] + +This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from +850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This +patch is for amdgpu. + +Signed-off-by: decce6 +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index bcc4d9fa5b0d2..0972d1a58579b 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -3449,6 +3449,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + max_sclk = 60000; + max_mclk = 80000; + } ++ if ((adev->pdev->device == 0x666f) && ++ (adev->pdev->revision == 0x00)) { ++ max_sclk = 80000; ++ max_mclk = 95000; ++ } + } else if (adev->asic_type == CHIP_OLAND) { + if ((adev->pdev->revision == 0xC7) || + (adev->pdev->revision == 0x80) || +-- +2.51.0 + diff --git a/queue-6.1/drm-amdgpu-adjust-usleep_range-in-fence-wait.patch b/queue-6.1/drm-amdgpu-adjust-usleep_range-in-fence-wait.patch new file mode 100644 index 00000000000..38106b79047 --- /dev/null +++ b/queue-6.1/drm-amdgpu-adjust-usleep_range-in-fence-wait.patch @@ -0,0 +1,38 @@ +From df03175bc251da7ae6e6bb4bb76647d8b8e56eef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Feb 2026 15:32:01 +0800 +Subject: drm/amdgpu: Adjust usleep_range in fence wait + +From: Ce Sun + +[ Upstream commit 3ee1c72606bd2842f0f377fd4b118362af0323ae ] + +Tune the sleep interval in the PSP fence wait loop from 10-100us to +60-100us.This adjustment results in an overall wait window of 1.2s +(60us * 20000 iterations) to 2 seconds (100us * 20000 iterations), +which guarantees that we can retrieve the correct fence value + +Signed-off-by: Ce Sun +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index 9153459455910..c85c5c159554b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -633,7 +633,7 @@ psp_cmd_submit_buf(struct psp_context *psp, + ras_intr = amdgpu_ras_intr_triggered(); + if (ras_intr) + break; +- usleep_range(10, 100); ++ usleep_range(60, 100); + amdgpu_device_invalidate_hdp(psp->adev, NULL); + } + +-- +2.51.0 + diff --git a/queue-6.1/drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch b/queue-6.1/drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch new file mode 100644 index 00000000000..d79c2a1470f --- /dev/null +++ b/queue-6.1/drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch @@ -0,0 +1,51 @@ +From 3a1bb96ead1cb5943eec5e3b2eb673f5cd02967d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 19:36:56 +0530 +Subject: drm/amdkfd: Fix GART PTE for non-4K pagesize in + svm_migrate_gart_map() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Donet Tom + +[ Upstream commit 6c160001661b6c4e20f5c31909c722741e14c2d8 ] + +In svm_migrate_gart_map(), while migrating GART mapping, the number of +bytes copied for the GART table only accounts for CPU pages. On non-4K +systems, each CPU page can contain multiple GPU pages, and the GART +requires one 8-byte PTE per GPU page. As a result, an incorrect size was +passed to the DMA, causing only a partial update of the GART table. + +Fix this function to work correctly on non-4K page-size systems by +accounting for the number of GPU pages per CPU page when calculating the +number of bytes to be copied. + +Acked-by: Christian König +Reviewed-by: Philip Yang +Signed-off-by: Ritesh Harjani (IBM) +Signed-off-by: Donet Tom +Signed-off-by: Felix Kuehling +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +index 730746512af84..72e84b26370ef 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +@@ -63,7 +63,7 @@ svm_migrate_gart_map(struct amdgpu_ring *ring, uint64_t npages, + *gart_addr = adev->gmc.gart_start; + + num_dw = ALIGN(adev->mman.buffer_funcs->copy_num_dw, 8); +- num_bytes = npages * 8; ++ num_bytes = npages * 8 * AMDGPU_GPU_PAGES_IN_CPU_PAGE; + + r = amdgpu_job_alloc_with_ib(adev, &adev->mman.entity, + AMDGPU_FENCE_OWNER_UNDEFINED, +-- +2.51.0 + diff --git a/queue-6.1/drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch b/queue-6.1/drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch new file mode 100644 index 00000000000..553573df8bc --- /dev/null +++ b/queue-6.1/drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch @@ -0,0 +1,73 @@ +From 43332636314f4b722005ebe76a08a93e3818f0d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Nov 2025 11:38:25 +0100 +Subject: drm/atmel-hlcdc: don't reject the commit if the src rect has + fractional parts +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ludovic Desroches + +[ Upstream commit 06682206e2a1883354ed758c09efeb51f435adbd ] + +Don’t reject the commit when the source rectangle has fractional parts. +This can occur due to scaling: drm_atomic_helper_check_plane_state() calls +drm_rect_clip_scaled(), which may introduce fractional parts while +computing the clipped source rectangle. This does not imply the commit is +invalid, so we should accept it instead of discarding it. + +Signed-off-by: Ludovic Desroches +Reviewed-by: Manikandan Muralidharan +Link: https://patch.msgid.link/20251120-lcd_scaling_fix-v1-1-5ffc98557923@microchip.com +Signed-off-by: Manikandan Muralidharan +Signed-off-by: Sasha Levin +--- + .../gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 19 ++++--------------- + 1 file changed, 4 insertions(+), 15 deletions(-) + +diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +index 390c4fc62af7c..ec4fe0de989d4 100644 +--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c ++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +@@ -78,8 +78,6 @@ drm_plane_state_to_atmel_hlcdc_plane_state(struct drm_plane_state *s) + return container_of(s, struct atmel_hlcdc_plane_state, base); + } + +-#define SUBPIXEL_MASK 0xffff +- + static uint32_t rgb_formats[] = { + DRM_FORMAT_C8, + DRM_FORMAT_XRGB4444, +@@ -619,24 +617,15 @@ static int atmel_hlcdc_plane_atomic_check(struct drm_plane *p, + if (ret || !s->visible) + return ret; + +- hstate->src_x = s->src.x1; +- hstate->src_y = s->src.y1; +- hstate->src_w = drm_rect_width(&s->src); +- hstate->src_h = drm_rect_height(&s->src); ++ hstate->src_x = s->src.x1 >> 16; ++ hstate->src_y = s->src.y1 >> 16; ++ hstate->src_w = drm_rect_width(&s->src) >> 16; ++ hstate->src_h = drm_rect_height(&s->src) >> 16; + hstate->crtc_x = s->dst.x1; + hstate->crtc_y = s->dst.y1; + hstate->crtc_w = drm_rect_width(&s->dst); + hstate->crtc_h = drm_rect_height(&s->dst); + +- if ((hstate->src_x | hstate->src_y | hstate->src_w | hstate->src_h) & +- SUBPIXEL_MASK) +- return -EINVAL; +- +- hstate->src_x >>= 16; +- hstate->src_y >>= 16; +- hstate->src_w >>= 16; +- hstate->src_h >>= 16; +- + hstate->nplanes = fb->format->num_planes; + if (hstate->nplanes > ATMEL_HLCDC_LAYER_MAX_PLANES) + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.1/drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch b/queue-6.1/drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch new file mode 100644 index 00000000000..699f587ae02 --- /dev/null +++ b/queue-6.1/drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch @@ -0,0 +1,61 @@ +From 638efb1dbc6502fe920a073142a3cec5f85782fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Oct 2025 18:14:52 +0200 +Subject: drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state + callback + +From: Ludovic Desroches + +[ Upstream commit f12352471061df83a36edf54bbb16284793284e4 ] + +After several commits, the slab memory increases. Some drm_crtc_commit +objects are not freed. The atomic_destroy_state callback only put the +framebuffer. Use the __drm_atomic_helper_plane_destroy_state() function +to put all the objects that are no longer needed. + +It has been seen after hours of usage of a graphics application or using +kmemleak: + +unreferenced object 0xc63a6580 (size 64): + comm "egt_basic", pid 171, jiffies 4294940784 + hex dump (first 32 bytes): + 40 50 34 c5 01 00 00 00 ff ff ff ff 8c 65 3a c6 @P4..........e:. + 8c 65 3a c6 ff ff ff ff 98 65 3a c6 98 65 3a c6 .e:......e:..e:. + backtrace (crc c25aa925): + kmemleak_alloc+0x34/0x3c + __kmalloc_cache_noprof+0x150/0x1a4 + drm_atomic_helper_setup_commit+0x1e8/0x7bc + drm_atomic_helper_commit+0x3c/0x15c + drm_atomic_commit+0xc0/0xf4 + drm_atomic_helper_set_config+0x84/0xb8 + drm_mode_setcrtc+0x32c/0x810 + drm_ioctl+0x20c/0x488 + sys_ioctl+0x14c/0xc20 + ret_fast_syscall+0x0/0x54 + +Signed-off-by: Ludovic Desroches +Reviewed-by: Manikandan Muralidharan +Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-1-79b615130dc3@microchip.com +Signed-off-by: Manikandan Muralidharan +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +index daa508504f47d..390c4fc62af7c 100644 +--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c ++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +@@ -934,8 +934,7 @@ static void atmel_hlcdc_plane_atomic_destroy_state(struct drm_plane *p, + state->dscrs[i]->self); + } + +- if (s->fb) +- drm_framebuffer_put(s->fb); ++ __drm_atomic_helper_plane_destroy_state(s); + + kfree(state); + } +-- +2.51.0 + diff --git a/queue-6.1/drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch b/queue-6.1/drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch new file mode 100644 index 00000000000..756c72554ce --- /dev/null +++ b/queue-6.1/drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch @@ -0,0 +1,81 @@ +From ed54d60d095b74a5a46b8228c782f1f26df16aa0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Oct 2025 18:14:53 +0200 +Subject: drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release + +From: Ludovic Desroches + +[ Upstream commit bc847787233277a337788568e90a6ee1557595eb ] + +The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying +the atmel_hlcdc_plane state structure without properly duplicating the +drm_plane_state. In particular, state->commit remained set to the old +state commit, which can lead to a use-after-free in the next +drm_atomic_commit() call. + +Fix this by calling +__drm_atomic_helper_duplicate_plane_state(), which correctly clones +the base drm_plane_state (including the ->commit pointer). + +It has been seen when closing and re-opening the device node while +another DRM client (e.g. fbdev) is still attached: + +============================================================================= +BUG kmalloc-64 (Not tainted): Poison overwritten +----------------------------------------------------------------------------- + +0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b +FIX kmalloc-64: Restoring Poison 0xc611b344-0xc611b344=0x6b +Allocated in drm_atomic_helper_setup_commit+0x1e8/0x7bc age=178 cpu=0 +pid=29 + drm_atomic_helper_setup_commit+0x1e8/0x7bc + drm_atomic_helper_commit+0x3c/0x15c + drm_atomic_commit+0xc0/0xf4 + drm_framebuffer_remove+0x4cc/0x5a8 + drm_mode_rmfb_work_fn+0x6c/0x80 + process_one_work+0x12c/0x2cc + worker_thread+0x2a8/0x400 + kthread+0xc0/0xdc + ret_from_fork+0x14/0x28 +Freed in drm_atomic_helper_commit_hw_done+0x100/0x150 age=8 cpu=0 +pid=169 + drm_atomic_helper_commit_hw_done+0x100/0x150 + drm_atomic_helper_commit_tail+0x64/0x8c + commit_tail+0x168/0x18c + drm_atomic_helper_commit+0x138/0x15c + drm_atomic_commit+0xc0/0xf4 + drm_atomic_helper_set_config+0x84/0xb8 + drm_mode_setcrtc+0x32c/0x810 + drm_ioctl+0x20c/0x488 + sys_ioctl+0x14c/0xc20 + ret_fast_syscall+0x0/0x54 +Slab 0xef8bc360 objects=21 used=16 fp=0xc611b7c0 +flags=0x200(workingset|zone=0) +Object 0xc611b340 @offset=832 fp=0xc611b7c0 + +Signed-off-by: Ludovic Desroches +Reviewed-by: Manikandan Muralidharan +Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-2-79b615130dc3@microchip.com +Signed-off-by: Manikandan Muralidharan +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +index ec4fe0de989d4..b35d367b86141 100644 +--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c ++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +@@ -904,8 +904,7 @@ atmel_hlcdc_plane_atomic_duplicate_state(struct drm_plane *p) + return NULL; + } + +- if (copy->base.fb) +- drm_framebuffer_get(copy->base.fb); ++ __drm_atomic_helper_plane_duplicate_state(p, ©->base); + + return ©->base; + } +-- +2.51.0 + diff --git a/queue-6.1/drm-display-dp_mst-add-protection-against-0-vcpi.patch b/queue-6.1/drm-display-dp_mst-add-protection-against-0-vcpi.patch new file mode 100644 index 00000000000..e0250092811 --- /dev/null +++ b/queue-6.1/drm-display-dp_mst-add-protection-against-0-vcpi.patch @@ -0,0 +1,96 @@ +From b08f9827229531360e6dc77f7c43c12fb8f77625 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 15:16:50 +0530 +Subject: drm/display/dp_mst: Add protection against 0 vcpi + +From: Suraj Kandpal + +[ Upstream commit 342ccffd9f77fc29fe1c05fd145e4d842bd2feaa ] + +When releasing a timeslot there is a slight chance we may end up +with the wrong payload mask due to overflow if the delayed_destroy_work +ends up coming into play after a DP 2.1 monitor gets disconnected +which causes vcpi to become 0 then we try to make the payload = +~BIT(vcpi - 1) which is a negative shift. VCPI id should never +really be 0 hence skip changing the payload mask if VCPI is 0. + +Otherwise it leads to +<7> [515.287237] xe 0000:03:00.0: [drm:drm_dp_mst_get_port_malloc +[drm_display_helper]] port ffff888126ce9000 (3) +<4> [515.287267] -----------[ cut here ]----------- +<3> [515.287268] UBSAN: shift-out-of-bounds in +../drivers/gpu/drm/display/drm_dp_mst_topology.c:4575:36 +<3> [515.287271] shift exponent -1 is negative +<4> [515.287275] CPU: 7 UID: 0 PID: 3108 Comm: kworker/u64:33 Tainted: G +S U 6.17.0-rc6-lgci-xe-xe-3795-3e79699fa1b216e92+ #1 PREEMPT(voluntary) +<4> [515.287279] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER +<4> [515.287279] Hardware name: ASUS System Product Name/PRIME Z790-P +WIFI, BIOS 1645 03/15/2024 +<4> [515.287281] Workqueue: drm_dp_mst_wq drm_dp_delayed_destroy_work +[drm_display_helper] +<4> [515.287303] Call Trace: +<4> [515.287304] +<4> [515.287306] dump_stack_lvl+0xc1/0xf0 +<4> [515.287313] dump_stack+0x10/0x20 +<4> [515.287316] __ubsan_handle_shift_out_of_bounds+0x133/0x2e0 +<4> [515.287324] ? drm_atomic_get_private_obj_state+0x186/0x1d0 +<4> [515.287333] drm_dp_atomic_release_time_slots.cold+0x17/0x3d +[drm_display_helper] +<4> [515.287355] mst_connector_atomic_check+0x159/0x180 [xe] +<4> [515.287546] drm_atomic_helper_check_modeset+0x4d9/0xfa0 +<4> [515.287550] ? __ww_mutex_lock.constprop.0+0x6f/0x1a60 +<4> [515.287562] intel_atomic_check+0x119/0x2b80 [xe] +<4> [515.287740] ? find_held_lock+0x31/0x90 +<4> [515.287747] ? lock_release+0xce/0x2a0 +<4> [515.287754] drm_atomic_check_only+0x6a2/0xb40 +<4> [515.287758] ? drm_atomic_add_affected_connectors+0x12b/0x140 +<4> [515.287765] drm_atomic_commit+0x6e/0xf0 +<4> [515.287766] ? _pfx__drm_printfn_info+0x10/0x10 +<4> [515.287774] drm_client_modeset_commit_atomic+0x25c/0x2b0 +<4> [515.287794] drm_client_modeset_commit_locked+0x60/0x1b0 +<4> [515.287795] ? mutex_lock_nested+0x1b/0x30 +<4> [515.287801] drm_client_modeset_commit+0x26/0x50 +<4> [515.287804] __drm_fb_helper_restore_fbdev_mode_unlocked+0xdc/0x110 +<4> [515.287810] drm_fb_helper_hotplug_event+0x120/0x140 +<4> [515.287814] drm_fbdev_client_hotplug+0x28/0xd0 +<4> [515.287819] drm_client_hotplug+0x6c/0xf0 +<4> [515.287824] drm_client_dev_hotplug+0x9e/0xd0 +<4> [515.287829] drm_kms_helper_hotplug_event+0x1a/0x30 +<4> [515.287834] drm_dp_delayed_destroy_work+0x3df/0x410 +[drm_display_helper] +<4> [515.287861] process_one_work+0x22b/0x6f0 +<4> [515.287874] worker_thread+0x1e8/0x3d0 +<4> [515.287879] ? __pfx_worker_thread+0x10/0x10 +<4> [515.287882] kthread+0x11c/0x250 +<4> [515.287886] ? __pfx_kthread+0x10/0x10 +<4> [515.287890] ret_from_fork+0x2d7/0x310 +<4> [515.287894] ? __pfx_kthread+0x10/0x10 +<4> [515.287897] ret_from_fork_asm+0x1a/0x30 + +Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6303 +Signed-off-by: Suraj Kandpal +Reviewed-by: Imre Deak +Reviewed-by: Lyude Paul +Link: https://patch.msgid.link/20251119094650.799135-1-suraj.kandpal@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/display/drm_dp_mst_topology.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c +index a4d84a2c8b4ec..65722f4b30ae8 100644 +--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c +@@ -4464,7 +4464,8 @@ int drm_dp_atomic_release_time_slots(struct drm_atomic_state *state, + if (!payload->delete) { + payload->pbn = 0; + payload->delete = true; +- topology_state->payload_mask &= ~BIT(payload->vcpi - 1); ++ if (payload->vcpi > 0) ++ topology_state->payload_mask &= ~BIT(payload->vcpi - 1); + } + + return 0; +-- +2.51.0 + diff --git a/queue-6.1/drm-radeon-add-hainan-clock-adjustment.patch b/queue-6.1/drm-radeon-add-hainan-clock-adjustment.patch new file mode 100644 index 00000000000..b10a3446792 --- /dev/null +++ b/queue-6.1/drm-radeon-add-hainan-clock-adjustment.patch @@ -0,0 +1,39 @@ +From f4412a64756a748ab65ed8fa69356ac874346b2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Feb 2026 07:26:00 +0000 +Subject: drm/radeon: Add HAINAN clock adjustment + +From: decce6 + +[ Upstream commit 908d318f23d6b5d625bea093c5fc056238cdb7ff ] + +This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from +850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This +patch is for radeon. + +Signed-off-by: decce6 +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/si_dpm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c +index fbf968e3f6d78..c688b4d914819 100644 +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -2969,6 +2969,11 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev, + max_sclk = 60000; + max_mclk = 80000; + } ++ if ((rdev->pdev->device == 0x666f) && ++ (rdev->pdev->revision == 0x00)) { ++ max_sclk = 80000; ++ max_mclk = 95000; ++ } + } else if (rdev->family == CHIP_OLAND) { + if ((rdev->pdev->revision == 0xC7) || + (rdev->pdev->revision == 0x80) || +-- +2.51.0 + diff --git a/queue-6.1/drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch b/queue-6.1/drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch new file mode 100644 index 00000000000..325a2805503 --- /dev/null +++ b/queue-6.1/drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch @@ -0,0 +1,71 @@ +From 042713006366fc9539b45270860950fa4a9a0b44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Dec 2025 21:03:23 +0800 +Subject: drm/v3d: Set DMA segment size to avoid debug warnings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Xiaolei Wang + +[ Upstream commit 9eb018828b1b30dfba689c060735c50fc5b9f704 ] + +When using V3D rendering with CONFIG_DMA_API_DEBUG enabled, the +kernel occasionally reports a segment size mismatch. This is because +'max_seg_size' is not set. The kernel defaults to 64K. setting +'max_seg_size' to the maximum will prevent 'debug_dma_map_sg()' +from complaining about the over-mapping of the V3D segment length. + +DMA-API: v3d 1002000000.v3d: mapping sg segment longer than device + claims to support [len=8290304] [max=65536] +WARNING: CPU: 0 PID: 493 at kernel/dma/debug.c:1179 debug_dma_map_sg+0x330/0x388 +CPU: 0 UID: 0 PID: 493 Comm: Xorg Not tainted 6.12.53-yocto-standard #1 +Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT) +pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : debug_dma_map_sg+0x330/0x388 +lr : debug_dma_map_sg+0x330/0x388 +sp : ffff8000829a3ac0 +x29: ffff8000829a3ac0 x28: 0000000000000001 x27: ffff8000813fe000 +x26: ffffc1ffc0000000 x25: ffff00010fdeb760 x24: 0000000000000000 +x23: ffff8000816a9bf0 x22: 0000000000000001 x21: 0000000000000002 +x20: 0000000000000002 x19: ffff00010185e810 x18: ffffffffffffffff +x17: 69766564206e6168 x16: 74207265676e6f6c x15: 20746e656d676573 +x14: 20677320676e6970 x13: 5d34303334393134 x12: 0000000000000000 +x11: 00000000000000c0 x10: 00000000000009c0 x9 : ffff8000800e0b7c +x8 : ffff00010a315ca0 x7 : ffff8000816a5110 x6 : 0000000000000001 +x5 : 000000000000002b x4 : 0000000000000002 x3 : 0000000000000008 +x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00010a315280 +Call trace: + debug_dma_map_sg+0x330/0x388 + __dma_map_sg_attrs+0xc0/0x278 + dma_map_sgtable+0x30/0x58 + drm_gem_shmem_get_pages_sgt+0xb4/0x140 + v3d_bo_create_finish+0x28/0x130 [v3d] + v3d_create_bo_ioctl+0x54/0x180 [v3d] + drm_ioctl_kernel+0xc8/0x140 + drm_ioctl+0x2d4/0x4d8 + +Signed-off-by: Xiaolei Wang +Link: https://patch.msgid.link/20251203130323.2247072-1-xiaolei.wang@windriver.com +Signed-off-by: Maíra Canal +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/v3d/v3d_drv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c +index e8c975b815859..d51910a42570f 100644 +--- a/drivers/gpu/drm/v3d/v3d_drv.c ++++ b/drivers/gpu/drm/v3d/v3d_drv.c +@@ -236,6 +236,8 @@ static int v3d_platform_drm_probe(struct platform_device *pdev) + if (ret) + return ret; + ++ dma_set_max_seg_size(&pdev->dev, UINT_MAX); ++ + v3d->va_width = 30 + V3D_GET_FIELD(mmu_debug, V3D_MMU_VA_WIDTH); + + ident1 = V3D_READ(V3D_HUB_IDENT1); +-- +2.51.0 + diff --git a/queue-6.1/efi-cper-don-t-dump-the-entire-memory-region.patch b/queue-6.1/efi-cper-don-t-dump-the-entire-memory-region.patch new file mode 100644 index 00000000000..e6d793e0195 --- /dev/null +++ b/queue-6.1/efi-cper-don-t-dump-the-entire-memory-region.patch @@ -0,0 +1,54 @@ +From 9caa0a68d4d29177fd19e4baac488354cd95025a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:35:06 +0100 +Subject: EFI/CPER: don't dump the entire memory region + +From: Mauro Carvalho Chehab + +[ Upstream commit 55cc6fe5716f678f06bcb95140882dfa684464ec ] + +The current logic at cper_print_fw_err() doesn't check if the +error record length is big enough to handle offset. On a bad firmware, +if the ofset is above the actual record, length -= offset will +underflow, making it dump the entire memory. + +The end result can be: + + - the logic taking a lot of time dumping large regions of memory; + - data disclosure due to the memory dumps; + - an OOPS, if it tries to dump an unmapped memory region. + +Fix it by checking if the section length is too small before doing +a hex dump. + +Signed-off-by: Mauro Carvalho Chehab +Reviewed-by: Jonathan Cameron +Acked-by: Ard Biesheuvel +Reviewed-by: Hanjun Guo +[ rjw: Subject tweaks ] +Link: https://patch.msgid.link/1752b5ba63a3e2f148ddee813b36c996cc617e86.1767871950.git.mchehab+huawei@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/cper.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c +index 9d6650f50ffe7..f0e8ee2641b89 100644 +--- a/drivers/firmware/efi/cper.c ++++ b/drivers/firmware/efi/cper.c +@@ -551,6 +551,11 @@ static void cper_print_fw_err(const char *pfx, + } else { + offset = sizeof(*fw_err); + } ++ if (offset > length) { ++ printk("%s""error section length is too small: offset=%d, length=%d\n", ++ pfx, offset, length); ++ return; ++ } + + buf += offset; + length -= offset; +-- +2.51.0 + diff --git a/queue-6.1/efi-cper-don-t-go-past-the-arm-processor-cper-record.patch b/queue-6.1/efi-cper-don-t-go-past-the-arm-processor-cper-record.patch new file mode 100644 index 00000000000..4e3e0ca86b5 --- /dev/null +++ b/queue-6.1/efi-cper-don-t-go-past-the-arm-processor-cper-record.patch @@ -0,0 +1,107 @@ +From 1d86aa8ebe3d47bef699088bf4aa02e6fcbad805 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:35:04 +0100 +Subject: EFI/CPER: don't go past the ARM processor CPER record buffer + +From: Mauro Carvalho Chehab + +[ Upstream commit eae21beecb95a3b69ee5c38a659f774e171d730e ] + +There's a logic inside GHES/CPER to detect if the section_length +is too small, but it doesn't detect if it is too big. + +Currently, if the firmware receives an ARM processor CPER record +stating that a section length is big, kernel will blindly trust +section_length, producing a very long dump. For instance, a 67 +bytes record with ERR_INFO_NUM set 46198 and section length +set to 854918320 would dump a lot of data going a way past the +firmware memory-mapped area. + +Fix it by adding a logic to prevent it to go past the buffer +if ERR_INFO_NUM is too big, making it report instead: + + [Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1 + [Hardware Error]: event severity: recoverable + [Hardware Error]: Error 0, type: recoverable + [Hardware Error]: section_type: ARM processor error + [Hardware Error]: MIDR: 0xff304b2f8476870a + [Hardware Error]: section length: 854918320, CPER size: 67 + [Hardware Error]: section length is too big + [Hardware Error]: firmware-generated error record is incorrect + [Hardware Error]: ERR_INFO_NUM is 46198 + +Signed-off-by: Mauro Carvalho Chehab +Reviewed-by: Jonathan Cameron +Acked-by: Ard Biesheuvel +Reviewed-by: Hanjun Guo +[ rjw: Subject and changelog tweaks ] +Link: https://patch.msgid.link/41cd9f6b3ace3cdff7a5e864890849e4b1c58b63.1767871950.git.mchehab+huawei@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/cper-arm.c | 12 ++++++++---- + drivers/firmware/efi/cper.c | 3 ++- + include/linux/cper.h | 3 ++- + 3 files changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/firmware/efi/cper-arm.c b/drivers/firmware/efi/cper-arm.c +index ea43589944ba5..26a12f8076359 100644 +--- a/drivers/firmware/efi/cper-arm.c ++++ b/drivers/firmware/efi/cper-arm.c +@@ -227,7 +227,8 @@ static void cper_print_arm_err_info(const char *pfx, u32 type, + } + + void cper_print_proc_arm(const char *pfx, +- const struct cper_sec_proc_arm *proc) ++ const struct cper_sec_proc_arm *proc, ++ u32 length) + { + int i, len, max_ctx_type; + struct cper_arm_err_info *err_info; +@@ -239,9 +240,12 @@ void cper_print_proc_arm(const char *pfx, + + len = proc->section_length - (sizeof(*proc) + + proc->err_info_num * (sizeof(*err_info))); +- if (len < 0) { +- printk("%ssection length: %d\n", pfx, proc->section_length); +- printk("%ssection length is too small\n", pfx); ++ ++ if (len < 0 || proc->section_length > length) { ++ printk("%ssection length: %d, CPER size: %d\n", ++ pfx, proc->section_length, length); ++ printk("%ssection length is too %s\n", pfx, ++ (len < 0) ? "small" : "big"); + printk("%sfirmware-generated error record is incorrect\n", pfx); + printk("%sERR_INFO_NUM is %d\n", pfx, proc->err_info_num); + return; +diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c +index f0e8ee2641b89..8669d1e8d84df 100644 +--- a/drivers/firmware/efi/cper.c ++++ b/drivers/firmware/efi/cper.c +@@ -636,7 +636,8 @@ cper_estatus_print_section(const char *pfx, struct acpi_hest_generic_data *gdata + + printk("%ssection_type: ARM processor error\n", newpfx); + if (gdata->error_data_length >= sizeof(*arm_err)) +- cper_print_proc_arm(newpfx, arm_err); ++ cper_print_proc_arm(newpfx, arm_err, ++ gdata->error_data_length); + else + goto err_section_too_small; + #endif +diff --git a/include/linux/cper.h b/include/linux/cper.h +index ff84d72cdee82..efd076715bb7f 100644 +--- a/include/linux/cper.h ++++ b/include/linux/cper.h +@@ -568,7 +568,8 @@ void cper_mem_err_pack(const struct cper_sec_mem_err *, + const char *cper_mem_err_unpack(struct trace_seq *, + struct cper_mem_err_compact *); + void cper_print_proc_arm(const char *pfx, +- const struct cper_sec_proc_arm *proc); ++ const struct cper_sec_proc_arm *proc, ++ u32 length); + void cper_print_proc_ia(const char *pfx, + const struct cper_sec_proc_ia *proc); + int cper_mem_err_location(struct cper_mem_err_compact *mem, char *msg); +-- +2.51.0 + diff --git a/queue-6.1/ext4-mark-group-add-fast-commit-ineligible.patch b/queue-6.1/ext4-mark-group-add-fast-commit-ineligible.patch new file mode 100644 index 00000000000..0234040624d --- /dev/null +++ b/queue-6.1/ext4-mark-group-add-fast-commit-ineligible.patch @@ -0,0 +1,68 @@ +From bf16fa8572ba23c809eaeb51cb39123c171c0726 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 19:51:41 +0800 +Subject: ext4: mark group add fast-commit ineligible + +From: Li Chen + +[ Upstream commit 89b4336fd5ec78f51f9d3a1d100f3ffa3228e604 ] + +Fast commits only log operations that have dedicated replay support. +Online resize via EXT4_IOC_GROUP_ADD updates the superblock and group +descriptor metadata without going through the fast commit tracking +paths. +In practice these operations are rare and usually followed by further +updates, but mixing them into a fast commit makes the overall +semantics harder to reason about and risks replay gaps if new call +sites appear. + +Teach ext4 to mark the filesystem fast-commit ineligible when +ext4_ioctl_group_add() adds new block groups. +This forces those transactions to fall back to a full commit, +ensuring that the filesystem geometry updates are captured by the +normal journal rather than partially encoded in fast commit TLVs. +This change should not affect common workloads but makes online +resize via GROUP_ADD safer and easier to reason about under fast +commit. + +Testing: +1. prepare: + dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256 + mkfs.ext4 -O fast_commit -F /root/fc_resize.img + mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize +2. Ran a helper that issues EXT4_IOC_GROUP_ADD on the mounted + filesystem and checked the resize ineligible reason: + ./group_add_helper /mnt/fc_resize + cat /proc/fs/ext4/loop0/fc_info + shows "Resize": > 0. +3. Fsynced a file on the resized filesystem and verified that the fast + commit stats report at least one ineligible commit: + touch /mnt/fc_resize/file + /root/fsync_file /mnt/fc_resize/file + sync + cat /proc/fs/ext4/loop0/fc_info + shows fc stats ineligible > 0. + +Signed-off-by: Li Chen +Link: https://patch.msgid.link/20251211115146.897420-5-me@linux.beauty +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/ioctl.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c +index 3784f70416492..8a10d028c0a32 100644 +--- a/fs/ext4/ioctl.c ++++ b/fs/ext4/ioctl.c +@@ -950,6 +950,7 @@ static long ext4_ioctl_group_add(struct file *file, + + err = ext4_group_add(sb, input); + if (EXT4_SB(sb)->s_journal) { ++ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE, NULL); + jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal); + err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0); + jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal); +-- +2.51.0 + diff --git a/queue-6.1/ext4-mark-group-extend-fast-commit-ineligible.patch b/queue-6.1/ext4-mark-group-extend-fast-commit-ineligible.patch new file mode 100644 index 00000000000..f10a87c40b6 --- /dev/null +++ b/queue-6.1/ext4-mark-group-extend-fast-commit-ineligible.patch @@ -0,0 +1,69 @@ +From 203e85b6dd2e8ea59d3b2794faa2046dbbbc8061 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 19:51:42 +0800 +Subject: ext4: mark group extend fast-commit ineligible + +From: Li Chen + +[ Upstream commit 1f8dd813a1c771b13c303f73d876164bc9b327cc ] + +Fast commits only log operations that have dedicated replay support. +EXT4_IOC_GROUP_EXTEND grows the filesystem to the end of the last +block group and updates the same on-disk metadata without going +through the fast commit tracking paths. +In practice these operations are rare and usually followed by further +updates, but mixing them into a fast commit makes the overall +semantics harder to reason about and risks replay gaps if new call +sites appear. + +Teach ext4 to mark the filesystem fast-commit ineligible when +EXT4_IOC_GROUP_EXTEND grows the filesystem. +This forces those transactions to fall back to a full commit, +ensuring that the group extension changes are captured by the normal +journal rather than partially encoded in fast commit TLVs. +This change should not affect common workloads but makes online +resize via GROUP_EXTEND safer and easier to reason about under fast +commit. + +Testing: +1. prepare: + dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256 + mkfs.ext4 -O fast_commit -F /root/fc_resize.img + mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize +2. Extended the filesystem to the end of the last block group using a + helper that calls EXT4_IOC_GROUP_EXTEND on the mounted filesystem + and checked fc_info: + ./group_extend_helper /mnt/fc_resize + cat /proc/fs/ext4/loop0/fc_info + shows the "Resize" ineligible reason increased. +3. Fsynced a file on the resized filesystem and confirmed that the fast + commit ineligible counter incremented for the resize transaction: + touch /mnt/fc_resize/file + /root/fsync_file /mnt/fc_resize/file + sync + cat /proc/fs/ext4/loop0/fc_info + +Signed-off-by: Li Chen +Link: https://patch.msgid.link/20251211115146.897420-6-me@linux.beauty +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/ioctl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c +index 8a10d028c0a32..8447076eae676 100644 +--- a/fs/ext4/ioctl.c ++++ b/fs/ext4/ioctl.c +@@ -1303,6 +1303,8 @@ static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) + + err = ext4_group_extend(sb, EXT4_SB(sb)->s_es, n_blocks_count); + if (EXT4_SB(sb)->s_journal) { ++ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE, ++ NULL); + jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal); + err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0); + jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal); +-- +2.51.0 + diff --git a/queue-6.1/fix-it87_wdt-early-reboot-by-reporting-running-timer.patch b/queue-6.1/fix-it87_wdt-early-reboot-by-reporting-running-timer.patch new file mode 100644 index 00000000000..bf545fb6ecb --- /dev/null +++ b/queue-6.1/fix-it87_wdt-early-reboot-by-reporting-running-timer.patch @@ -0,0 +1,60 @@ +From e09852349d803f34f5fc9fb06547a0d6ca162e70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 13:11:24 +0100 +Subject: fix it87_wdt early reboot by reporting running timer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: René Rebe + +[ Upstream commit 88b2ab346436f799b99894a3e9518a3ffa344524 ] + +Some products, such as the Ugreen DXP4800 Plus NAS, ship with the it87 +wdt enabled by the firmware and a broken BIOS option that does not +allow to change the time or turn it off. As this makes installing +Linux rather difficult, change the it87_wdt to report it running to +the watchdog core. + +Signed-off-by: René Rebe +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/it87_wdt.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/watchdog/it87_wdt.c b/drivers/watchdog/it87_wdt.c +index 239947df613db..1392e557fa371 100644 +--- a/drivers/watchdog/it87_wdt.c ++++ b/drivers/watchdog/it87_wdt.c +@@ -183,6 +183,12 @@ static void _wdt_update_timeout(unsigned int t) + superio_outb(t >> 8, WDTVALMSB); + } + ++/* Internal function, should be called after superio_select(GPIO) */ ++static bool _wdt_running(void) ++{ ++ return superio_inb(WDTVALLSB) || (max_units > 255 && superio_inb(WDTVALMSB)); ++} ++ + static int wdt_update_timeout(unsigned int t) + { + int ret; +@@ -365,6 +371,12 @@ static int __init it87_wdt_init(void) + } + } + ++ /* wdt already left running by firmware? */ ++ if (_wdt_running()) { ++ pr_info("Left running by firmware.\n"); ++ set_bit(WDOG_HW_RUNNING, &wdt_dev.status); ++ } ++ + superio_exit(); + + if (timeout < 1 || timeout > max_units * 60) { +-- +2.51.0 + diff --git a/queue-6.1/fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch b/queue-6.1/fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch new file mode 100644 index 00000000000..61a22cd6be9 --- /dev/null +++ b/queue-6.1/fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch @@ -0,0 +1,58 @@ +From 58f10eab6622c3f9809cfe01d9d44412e9767b6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Nov 2025 16:58:48 +0100 +Subject: fpga: of-fpga-region: Fail if any bridge is missing + +From: Romain Gantois + +[ Upstream commit c141c8221bc5089de915d9f26044df892c343c7e ] + +When parsing the region bridge list from the "fpga-bridges" device tree +property, the of-fpga-region driver will silently ignore bridges which fail +to be obtained, for example due to a missing bridge driver or invalid +phandle. + +This can lead to hardware issues if a region bridge stays coupled when +partial programming is performed. + +Fail if any of the bridges specified in "fpga-bridges" cannot be obtained. + +Signed-off-by: Romain Gantois +Link: https://lore.kernel.org/r/20251127-of-fpga-region-fail-if-bridges-not-found-v1-1-ca674f8d07eb@bootlin.com +Reviewed-by: Xu Yilun +Signed-off-by: Xu Yilun +Signed-off-by: Sasha Levin +--- + drivers/fpga/of-fpga-region.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/fpga/of-fpga-region.c b/drivers/fpga/of-fpga-region.c +index ae82532fc127c..4a7b3f0059c3f 100644 +--- a/drivers/fpga/of-fpga-region.c ++++ b/drivers/fpga/of-fpga-region.c +@@ -81,7 +81,7 @@ static struct fpga_manager *of_fpga_region_get_mgr(struct device_node *np) + * done with the bridges. + * + * Return: 0 for success (even if there are no bridges specified) +- * or -EBUSY if any of the bridges are in use. ++ * or an error code if any of the bridges are not available. + */ + static int of_fpga_region_get_bridges(struct fpga_region *region) + { +@@ -128,10 +128,10 @@ static int of_fpga_region_get_bridges(struct fpga_region *region) + ®ion->bridge_list); + of_node_put(br); + +- /* If any of the bridges are in use, give up */ +- if (ret == -EBUSY) { ++ /* If any of the bridges are not available, give up */ ++ if (ret) { + fpga_bridges_put(®ion->bridge_list); +- return -EBUSY; ++ return ret; + } + } + +-- +2.51.0 + diff --git a/queue-6.1/fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch b/queue-6.1/fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch new file mode 100644 index 00000000000..49b8df1badb --- /dev/null +++ b/queue-6.1/fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch @@ -0,0 +1,50 @@ +From 1fc5e656749406631ca700e747c4c25c5491ed26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 18:42:11 +0530 +Subject: fs/buffer: add alert in try_to_free_buffers() for folios without + buffers + +From: Deepakkumar Karn + +[ Upstream commit b68f91ef3b3fe82ad78c417de71b675699a8467c ] + +try_to_free_buffers() can be called on folios with no buffers attached +when filemap_release_folio() is invoked on a folio belonging to a mapping +with AS_RELEASE_ALWAYS set but no release_folio operation defined. + +In such cases, folio_needs_release() returns true because of the +AS_RELEASE_ALWAYS flag, but the folio has no private buffer data. This +causes try_to_free_buffers() to call drop_buffers() on a folio with no +buffers, leading to a null pointer dereference. + +Adding a check in try_to_free_buffers() to return early if the folio has no +buffers attached, with WARN_ON_ONCE() to alert about the misconfiguration. +This provides defensive hardening. + +Signed-off-by: Deepakkumar Karn +Link: https://patch.msgid.link/20251211131211.308021-1-dkarn@redhat.com +Reviewed-by: Jan Kara +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/buffer.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/buffer.c b/fs/buffer.c +index 3033a937e3a56..8bcb421d2816e 100644 +--- a/fs/buffer.c ++++ b/fs/buffer.c +@@ -2822,6 +2822,10 @@ bool try_to_free_buffers(struct folio *folio) + if (folio_test_writeback(folio)) + return false; + ++ /* Misconfigured folio check */ ++ if (WARN_ON_ONCE(!folio_buffers(folio))) ++ return true; ++ + if (mapping == NULL) { /* can this still happen? */ + ret = drop_buffers(folio, &buffers_to_free); + goto out; +-- +2.51.0 + diff --git a/queue-6.1/fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch b/queue-6.1/fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch new file mode 100644 index 00000000000..4be03759472 --- /dev/null +++ b/queue-6.1/fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch @@ -0,0 +1,45 @@ +From d29589dbacb0545576009faef2367b81a339c967 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 16:07:32 +0100 +Subject: fs/ntfs3: avoid calling run_get_entry() when run == NULL in + ntfs_read_run_nb_ra() + +From: Konstantin Komarov + +[ Upstream commit c5226b96c08a010ebef5fdf4c90572bcd89e4299 ] + +When ntfs_read_run_nb_ra() is invoked with run == NULL the code later +assumes run is valid and may call run_get_entry(NULL, ...), and also +uses clen/idx without initializing them. Smatch reported uninitialized +variable warnings and this can lead to undefined behaviour. This patch +fixes it. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202512230646.v5hrYXL0-lkp@intel.com/ +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/fsntfs.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c +index 8c165b791a1c8..f28bbec5fab45 100644 +--- a/fs/ntfs3/fsntfs.c ++++ b/fs/ntfs3/fsntfs.c +@@ -1241,6 +1241,12 @@ int ntfs_read_run_nb(struct ntfs_sb_info *sbi, const struct runs_tree *run, + + } while (len32); + ++ if (!run) { ++ err = -EINVAL; ++ goto out; ++ } ++ ++ /* Get next fragment to read. */ + vcn_next = vcn + clen; + if (!run_get_entry(run, ++idx, &vcn, &lcn, &clen) || + vcn != vcn_next) { +-- +2.51.0 + diff --git a/queue-6.1/fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch b/queue-6.1/fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch new file mode 100644 index 00000000000..9f3d2c05627 --- /dev/null +++ b/queue-6.1/fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch @@ -0,0 +1,58 @@ +From ab8001f8ab7c199f3f17d341f2b4369ed63cf0d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 19:59:59 +0900 +Subject: fs: ntfs3: check return value of indx_find to avoid infinite loop + +From: Jaehun Gou + +[ Upstream commit 1732053c8a6b360e2d5afb1b34fe9779398b072c ] + +We found an infinite loop bug in the ntfs3 file system that can lead to a +Denial-of-Service (DoS) condition. + +A malformed dentry in the ntfs3 filesystem can cause the kernel to hang +during the lookup operations. By setting the HAS_SUB_NODE flag in an +INDEX_ENTRY within a directory's INDEX_ALLOCATION block and manipulating the +VCN pointer, an attacker can cause the indx_find() function to repeatedly +read the same block, allocating 4 KB of memory each time. The kernel lacks +VCN loop detection and depth limits, causing memory exhaustion and an OOM +crash. + +This patch adds a return value check for fnd_push() to prevent a memory +exhaustion vulnerability caused by infinite loops. When the index exceeds the +size of the fnd->nodes array, fnd_push() returns -EINVAL. The indx_find() +function checks this return value and stops processing, preventing further +memory allocation. + +Co-developed-by: Seunghun Han +Signed-off-by: Seunghun Han +Co-developed-by: Jihoon Kwon +Signed-off-by: Jihoon Kwon +Signed-off-by: Jaehun Gou +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/index.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c +index ee6de53d2ad12..8ceef90ee5a50 100644 +--- a/fs/ntfs3/index.c ++++ b/fs/ntfs3/index.c +@@ -1190,7 +1190,12 @@ int indx_find(struct ntfs_index *indx, struct ntfs_inode *ni, + return -EINVAL; + } + +- fnd_push(fnd, node, e); ++ err = fnd_push(fnd, node, e); ++ ++ if (err) { ++ put_indx_node(node); ++ return err; ++ } + } + + *entry = e; +-- +2.51.0 + diff --git a/queue-6.1/fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch b/queue-6.1/fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch new file mode 100644 index 00000000000..750e1bd2b91 --- /dev/null +++ b/queue-6.1/fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch @@ -0,0 +1,38 @@ +From 2a467d6ed1ab0b6ffd66b114726fca0bf9e51cdf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Dec 2025 14:27:48 +0300 +Subject: fs/ntfs3: drop preallocated clusters for sparse and compressed files + +From: Konstantin Komarov + +[ Upstream commit 3a6aba7f3cf2b46816e08548c254d98de9c74eba ] + +Do not keep preallocated clusters for sparsed and compressed files. +Preserving preallocation in these cases causes fsx failures when running +with sparse files and preallocation enabled. + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index 96a6ebce0928a..f4573d276a2cc 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -473,8 +473,10 @@ int attr_set_size(struct ntfs_inode *ni, enum ATTR_TYPE type, + + is_ext = is_attr_ext(attr_b); + align = sbi->cluster_size; +- if (is_ext) ++ if (is_ext) { + align <<= attr_b->nres.c_unit; ++ keep_prealloc = false; ++ } + + old_valid = le64_to_cpu(attr_b->nres.valid_size); + old_size = le64_to_cpu(attr_b->nres.data_size); +-- +2.51.0 + diff --git a/queue-6.1/fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch b/queue-6.1/fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch new file mode 100644 index 00000000000..c0caaa5fb17 --- /dev/null +++ b/queue-6.1/fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch @@ -0,0 +1,83 @@ +From b7953432f90017833fafeb7c282feb6c7568a9c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 20:01:09 +0900 +Subject: fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent + metadata + +From: Jaehun Gou + +[ Upstream commit 4b90f16e4bb5607fb35e7802eb67874038da4640 ] + +We found an infinite loop bug in the ntfs3 file system that can lead to a +Denial-of-Service (DoS) condition. + +A malformed NTFS image can cause an infinite loop when an attribute header +indicates an empty run list, while directory entries reference it as +containing actual data. In NTFS, setting evcn=-1 with svcn=0 is a valid way +to represent an empty run list, and run_unpack() correctly handles this by +checking if evcn + 1 equals svcn and returning early without parsing any run +data. However, this creates a problem when there is metadata inconsistency, +where the attribute header claims to be empty (evcn=-1) but the caller +expects to read actual data. When run_unpack() immediately returns success +upon seeing this condition, it leaves the runs_tree uninitialized with +run->runs as a NULL. The calling function attr_load_runs_range() assumes +that a successful return means that the runs were loaded and sets clen to 0, +expecting the next run_lookup_entry() call to succeed. Because runs_tree +remains uninitialized, run_lookup_entry() continues to fail, and the loop +increments vcn by zero (vcn += 0), leading to an infinite loop. + +This patch adds a retry counter to detect when run_lookup_entry() fails +consecutively after attr_load_runs_vcn(). If the run is still not found on +the second attempt, it indicates corrupted metadata and returns -EINVAL, +preventing the Denial-of-Service (DoS) vulnerability. + +Co-developed-by: Seunghun Han +Signed-off-by: Seunghun Han +Co-developed-by: Jihoon Kwon +Signed-off-by: Jihoon Kwon +Signed-off-by: Jaehun Gou +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index feda45c7ca8e3..96a6ebce0928a 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -1335,19 +1335,28 @@ int attr_load_runs_range(struct ntfs_inode *ni, enum ATTR_TYPE type, + CLST vcn; + CLST vcn_last = (to - 1) >> cluster_bits; + CLST lcn, clen; +- int err; ++ int err = 0; ++ int retry = 0; + + for (vcn = from >> cluster_bits; vcn <= vcn_last; vcn += clen) { + if (!run_lookup_entry(run, vcn, &lcn, &clen, NULL)) { ++ if (retry != 0) { /* Next run_lookup_entry(vcn) also failed. */ ++ err = -EINVAL; ++ break; ++ } + err = attr_load_runs_vcn(ni, type, name, name_len, run, + vcn); + if (err) +- return err; ++ break; ++ + clen = 0; /* Next run_lookup_entry(vcn) must be success. */ ++ retry++; + } ++ else ++ retry = 0; + } + +- return 0; ++ return err; + } + + #ifdef CONFIG_NTFS3_LZX_XPRESS +-- +2.51.0 + diff --git a/queue-6.1/fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch b/queue-6.1/fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch new file mode 100644 index 00000000000..9e9aac48ba8 --- /dev/null +++ b/queue-6.1/fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch @@ -0,0 +1,68 @@ +From a06d46e9174588728da20b6f0e27823759858d3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 20:01:46 +0900 +Subject: fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST + +From: Jaehun Gou + +[ Upstream commit 06909b2549d631a47fcda249d34be26f7ca1711d ] + +We found an infinite loop bug in the ntfs3 file system that can lead to a +Denial-of-Service (DoS) condition. + +A malformed NTFS image can cause an infinite loop when an ATTR_LIST attribute +indicates a zero data size while the driver allocates memory for it. + +When ntfs_load_attr_list() processes a resident ATTR_LIST with data_size set +to zero, it still allocates memory because of al_aligned(0). This creates an +inconsistent state where ni->attr_list.size is zero, but ni->attr_list.le is +non-null. This causes ni_enum_attr_ex to incorrectly assume that no attribute +list exists and enumerates only the primary MFT record. When it finds +ATTR_LIST, the code reloads it and restarts the enumeration, repeating +indefinitely. The mount operation never completes, hanging the kernel thread. + +This patch adds validation to ensure that data_size is non-zero before memory +allocation. When a zero-sized ATTR_LIST is detected, the function returns +-EINVAL, preventing a DoS vulnerability. + +Co-developed-by: Seunghun Han +Signed-off-by: Seunghun Han +Co-developed-by: Jihoon Kwon +Signed-off-by: Jihoon Kwon +Signed-off-by: Jaehun Gou +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrlist.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/fs/ntfs3/attrlist.c b/fs/ntfs3/attrlist.c +index 82bd9b5d9bd80..64da2196711ed 100644 +--- a/fs/ntfs3/attrlist.c ++++ b/fs/ntfs3/attrlist.c +@@ -52,6 +52,11 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr) + + if (!attr->non_res) { + lsize = le32_to_cpu(attr->res.data_size); ++ if (!lsize) { ++ err = -EINVAL; ++ goto out; ++ } ++ + /* attr is resident: lsize < record_size (1K or 4K) */ + le = kvmalloc(al_aligned(lsize), GFP_KERNEL); + if (!le) { +@@ -66,6 +71,10 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr) + u16 run_off = le16_to_cpu(attr->nres.run_off); + + lsize = le64_to_cpu(attr->nres.data_size); ++ if (!lsize) { ++ err = -EINVAL; ++ goto out; ++ } + + run_init(&ni->attr_list.run); + +-- +2.51.0 + diff --git a/queue-6.1/gfs2-fiemap-page-fault-fix.patch b/queue-6.1/gfs2-fiemap-page-fault-fix.patch new file mode 100644 index 00000000000..b75e80b7ba7 --- /dev/null +++ b/queue-6.1/gfs2-fiemap-page-fault-fix.patch @@ -0,0 +1,69 @@ +From 6c34b841761c0ce99dbae5461cc1a44f4cf7fe2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Feb 2026 15:52:57 +0100 +Subject: gfs2: fiemap page fault fix + +From: Andreas Gruenbacher + +[ Upstream commit e411d74cc5ba290f85d0dd5e4d1df8f1d6d975d2 ] + +In gfs2_fiemap(), we are calling iomap_fiemap() while holding the inode +glock. This can lead to recursive glock taking if the fiemap buffer is +memory mapped to the same inode and accessing it triggers a page fault. + +Fix by disabling page faults for iomap_fiemap() and faulting in the +buffer by hand if necessary. + +Fixes xfstest generic/742. + +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/inode.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c +index 06629aeefbe6f..3048e3ca4b382 100644 +--- a/fs/gfs2/inode.c ++++ b/fs/gfs2/inode.c +@@ -2073,6 +2073,14 @@ static int gfs2_getattr(struct user_namespace *mnt_userns, + return 0; + } + ++static bool fault_in_fiemap(struct fiemap_extent_info *fi) ++{ ++ struct fiemap_extent __user *dest = fi->fi_extents_start; ++ size_t size = sizeof(*dest) * fi->fi_extents_max; ++ ++ return fault_in_safe_writeable((char __user *)dest, size) == 0; ++} ++ + static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, + u64 start, u64 len) + { +@@ -2082,14 +2090,22 @@ static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, + + inode_lock_shared(inode); + ++retry: + ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_SHARED, 0, &gh); + if (ret) + goto out; + ++ pagefault_disable(); + ret = iomap_fiemap(inode, fieinfo, start, len, &gfs2_iomap_ops); ++ pagefault_enable(); + + gfs2_glock_dq_uninit(&gh); + ++ if (ret == -EFAULT && fault_in_fiemap(fieinfo)) { ++ fieinfo->fi_extents_mapped = 0; ++ goto retry; ++ } ++ + out: + inode_unlock_shared(inode); + return ret; +-- +2.51.0 + diff --git a/queue-6.1/gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch b/queue-6.1/gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch new file mode 100644 index 00000000000..ef3a8b8e00c --- /dev/null +++ b/queue-6.1/gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch @@ -0,0 +1,57 @@ +From 90124111993c5d7859e5b0d769710189a9ba7ee3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 17:26:26 +0800 +Subject: gpio: aspeed-sgpio: Change the macro to support deferred probe + +From: Billy Tsai + +[ Upstream commit e18533b023ec7a33488bcf33140ce69bbba2894f ] + +Use module_platform_driver() to replace module_platform_driver_probe(). +The former utilizes platform_driver_register(), which allows the driver to +defer probing when it doesn't acquire the necessary resources due to probe +order. In contrast, the latter uses __platform_driver_probe(), which +includes the comment "Note that this is incompatible with deferred +probing." Since our SGPIO driver requires access to the clock resource, the +former is more suitable. + +Reviewed-by: Linus Walleij +Signed-off-by: Billy Tsai +Link: https://lore.kernel.org/r/20260123-upstream_sgpio-v2-1-69cfd1631400@aspeedtech.com +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-aspeed-sgpio.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpio/gpio-aspeed-sgpio.c b/drivers/gpio/gpio-aspeed-sgpio.c +index 454cefbeecf0e..e523a539410a8 100644 +--- a/drivers/gpio/gpio-aspeed-sgpio.c ++++ b/drivers/gpio/gpio-aspeed-sgpio.c +@@ -508,7 +508,7 @@ static const struct of_device_id aspeed_sgpio_of_table[] = { + + MODULE_DEVICE_TABLE(of, aspeed_sgpio_of_table); + +-static int __init aspeed_sgpio_probe(struct platform_device *pdev) ++static int aspeed_sgpio_probe(struct platform_device *pdev) + { + u32 nr_gpios, sgpio_freq, sgpio_clk_div, gpio_cnt_regval, pin_mask; + const struct aspeed_sgpio_pdata *pdata; +@@ -601,12 +601,13 @@ static int __init aspeed_sgpio_probe(struct platform_device *pdev) + } + + static struct platform_driver aspeed_sgpio_driver = { ++ .probe = aspeed_sgpio_probe, + .driver = { + .name = KBUILD_MODNAME, + .of_match_table = aspeed_sgpio_of_table, + }, + }; + +-module_platform_driver_probe(aspeed_sgpio_driver, aspeed_sgpio_probe); ++module_platform_driver(aspeed_sgpio_driver); + MODULE_DESCRIPTION("Aspeed Serial GPIO Driver"); + MODULE_LICENSE("GPL"); +-- +2.51.0 + diff --git a/queue-6.1/gro-change-the-bug_on-in-gro_pull_from_frag0.patch b/queue-6.1/gro-change-the-bug_on-in-gro_pull_from_frag0.patch new file mode 100644 index 00000000000..5ed04dfbd45 --- /dev/null +++ b/queue-6.1/gro-change-the-bug_on-in-gro_pull_from_frag0.patch @@ -0,0 +1,46 @@ +From 356584ca63ab1746e138496e40304e61d260003a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 04:57:17 +0000 +Subject: gro: change the BUG_ON() in gro_pull_from_frag0() + +From: Eric Dumazet + +[ Upstream commit cbe41362be2c27e0237a94a404ae413cec9c2ad9 ] + +Replace the BUG_ON() which never fired with a DEBUG_NET_WARN_ON_ONCE() + +$ scripts/bloat-o-meter -t vmlinux.1 vmlinux.2 +add/remove: 2/2 grow/shrink: 1/1 up/down: 370/-254 (116) +Function old new delta +gro_try_pull_from_frag0 - 196 +196 +napi_gro_frags 771 929 +158 +__pfx_gro_try_pull_from_frag0 - 16 +16 +__pfx_gro_pull_from_frag0 16 - -16 +dev_gro_receive 1514 1464 -50 +gro_pull_from_frag0 188 - -188 +Total: Before=22565899, After=22566015, chg +0.00% + +Signed-off-by: Eric Dumazet +Link: https://patch.msgid.link/20260122045720.1221017-3-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/gro.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/gro.c b/net/core/gro.c +index c4cbf398c5f78..52b91cfb3bf19 100644 +--- a/net/core/gro.c ++++ b/net/core/gro.c +@@ -444,7 +444,7 @@ static void gro_pull_from_frag0(struct sk_buff *skb, int grow) + { + struct skb_shared_info *pinfo = skb_shinfo(skb); + +- BUG_ON(skb->end - skb->tail < grow); ++ DEBUG_NET_WARN_ON_ONCE(skb->end - skb->tail < grow); + + memcpy(skb_tail_pointer(skb), NAPI_GRO_CB(skb)->frag0, grow); + +-- +2.51.0 + diff --git a/queue-6.1/hfsplus-fix-volume-corruption-issue-for-generic-498.patch b/queue-6.1/hfsplus-fix-volume-corruption-issue-for-generic-498.patch new file mode 100644 index 00000000000..f9197d1f778 --- /dev/null +++ b/queue-6.1/hfsplus-fix-volume-corruption-issue-for-generic-498.patch @@ -0,0 +1,150 @@ +From 397afd95d085f42b105b2cfc59cf620d62bf34fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Dec 2025 19:58:22 -0800 +Subject: hfsplus: fix volume corruption issue for generic/498 + +From: Viacheslav Dubeyko + +[ Upstream commit 9a8c4ad44721da4c48e1ff240ac76286c82837fe ] + +The xfstests' test-case generic/498 leaves HFS+ volume +in corrupted state: + +sudo ./check generic/498 +FSTYP -- hfsplus +PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #18 SMP PREEMPT_DYNAMIC Thu Dec 4 12:24:45 PST 2025 +MKFS_OPTIONS -- /dev/loop51 +MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch + +generic/498 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent +(see XFSTESTS-2/xfstests-dev/results//generic/498.full for details) + +Ran: generic/498 +Failures: generic/498 +Failed 1 of 1 tests + +sudo fsck.hfsplus -d /dev/loop51 +** /dev/loop51 +Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K. +Executing fsck_hfs (version 540.1-Linux). +** Checking non-journaled HFS Plus Volume. +The volume name is untitled +** Checking extents overflow file. +** Checking catalog file. +Invalid leaf record count +(It should be 16 instead of 2) +** Checking multi-linked files. +CheckHardLinks: found 1 pre-Leopard file inodes. +** Checking catalog hierarchy. +** Checking extended attributes file. +** Checking volume bitmap. +** Checking volume information. +Verify Status: VIStat = 0x0000, ABTStat = 0x0000 EBTStat = 0x0000 +CBTStat = 0x8000 CatStat = 0x00000000 +** Repairing volume. +** Rechecking volume. +** Checking non-journaled HFS Plus Volume. +The volume name is untitled +** Checking extents overflow file. +** Checking catalog file. +** Checking multi-linked files. +CheckHardLinks: found 1 pre-Leopard file inodes. +** Checking catalog hierarchy. +** Checking extended attributes file. +** Checking volume bitmap. +** Checking volume information. +** The volume untitled was repaired successfully. + +The generic/498 test executes such steps on final phase: + +mkdir $SCRATCH_MNT/A +mkdir $SCRATCH_MNT/B +mkdir $SCRATCH_MNT/A/C +touch $SCRATCH_MNT/B/foo +$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/B/foo + +ln $SCRATCH_MNT/B/foo $SCRATCH_MNT/A/C/foo +$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/A + +"Simulate a power failure and mount the filesystem +to check that what we explicitly fsync'ed exists." + +_flakey_drop_and_remount + +The FSCK tool complains about "Invalid leaf record count". +HFS+ b-tree header contains leaf_count field is updated +by hfs_brec_insert() and hfs_brec_remove(). The hfs_brec_insert() +is involved into hard link creation process. However, +modified in-core leaf_count field is stored into HFS+ +b-tree header by hfs_btree_write() method. But, +unfortunately, hfs_btree_write() hasn't been called +by hfsplus_cat_write_inode() and hfsplus_file_fsync() +stores not fully consistent state of the Catalog File's +b-tree. + +This patch adds calling hfs_btree_write() method in +the hfsplus_cat_write_inode() with the goal of +storing consistent state of Catalog File's b-tree. +Finally, it makes FSCK tool happy. + +sudo ./check generic/498 +FSTYP -- hfsplus +PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #22 SMP PREEMPT_DYNAMIC Sat Dec 6 17:01:31 PST 2025 +MKFS_OPTIONS -- /dev/loop51 +MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch + +generic/498 33s ... 31s +Ran: generic/498 +Passed all 1 tests + +Signed-off-by: Viacheslav Dubeyko +cc: John Paul Adrian Glaubitz +cc: Yangtao Li +cc: linux-fsdevel@vger.kernel.org +Link: https://lore.kernel.org/r/20251207035821.3863657-1-slava@dubeyko.com +Signed-off-by: Viacheslav Dubeyko +Signed-off-by: Sasha Levin +--- + fs/hfsplus/inode.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c +index 98291bd73b65f..f065015f237c4 100644 +--- a/fs/hfsplus/inode.c ++++ b/fs/hfsplus/inode.c +@@ -601,6 +601,7 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd) + int hfsplus_cat_write_inode(struct inode *inode) + { + struct inode *main_inode = inode; ++ struct hfs_btree *tree = HFSPLUS_SB(inode->i_sb)->cat_tree; + struct hfs_find_data fd; + hfsplus_cat_entry entry; + int res = 0; +@@ -611,7 +612,7 @@ int hfsplus_cat_write_inode(struct inode *inode) + if (!main_inode->i_nlink) + return 0; + +- if (hfs_find_init(HFSPLUS_SB(main_inode->i_sb)->cat_tree, &fd)) ++ if (hfs_find_init(tree, &fd)) + /* panic? */ + return -EIO; + +@@ -676,6 +677,15 @@ int hfsplus_cat_write_inode(struct inode *inode) + set_bit(HFSPLUS_I_CAT_DIRTY, &HFSPLUS_I(inode)->flags); + out: + hfs_find_exit(&fd); ++ ++ if (!res) { ++ res = hfs_btree_write(tree); ++ if (res) { ++ pr_err("b-tree write err: %d, ino %lu\n", ++ res, inode->i_ino); ++ } ++ } ++ + return res; + } + +-- +2.51.0 + diff --git a/queue-6.1/hfsplus-pretend-special-inodes-as-regular-files.patch b/queue-6.1/hfsplus-pretend-special-inodes-as-regular-files.patch new file mode 100644 index 00000000000..efd7b863d32 --- /dev/null +++ b/queue-6.1/hfsplus-pretend-special-inodes-as-regular-files.patch @@ -0,0 +1,45 @@ +From a6b832bbc4f4e25dccef71509a1dc2bc0fa23dcf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 18:39:33 +0900 +Subject: hfsplus: pretend special inodes as regular files + +From: Tetsuo Handa + +[ Upstream commit ed8889ca21b6ab37bc1435c4009ce37a79acb9e6 ] + +Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()") +requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/ +S_IFIFO/S_IFSOCK type, use S_IFREG for special inodes. + +Reported-by: syzbot +Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d +Signed-off-by: Tetsuo Handa +Reviewed-by: Viacheslav Dubeyko +Signed-off-by: Viacheslav Dubeyko +Link: https://lore.kernel.org/r/d0a07b1b-8b73-4002-8e29-e2bd56871262@I-love.SAKURA.ne.jp +Signed-off-by: Viacheslav Dubeyko +Signed-off-by: Sasha Levin +--- + fs/hfsplus/super.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c +index 7e889820a63d0..954ceaa748e62 100644 +--- a/fs/hfsplus/super.c ++++ b/fs/hfsplus/super.c +@@ -52,6 +52,12 @@ static int hfsplus_system_read_inode(struct inode *inode) + return -EIO; + } + ++ /* ++ * Assign a dummy file type, for may_open() requires that ++ * an inode has a valid file type. ++ */ ++ inode->i_mode = S_IFREG; ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.1/hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch b/queue-6.1/hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch new file mode 100644 index 00000000000..3fe22154f32 --- /dev/null +++ b/queue-6.1/hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch @@ -0,0 +1,37 @@ +From caed7c2435a164ba001565bb7a4d88c9be379654 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Nov 2025 06:06:23 +0000 +Subject: HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple + keyboards + +From: Joey Bednar + +[ Upstream commit 7273acfd0aef106093a8ffa3b4973eb70e5a3799 ] + +The SoNiX KN85 keyboard identifies as the "Apple, Inc. Aluminium +Keyboard" and is not recognized as a non-apple keyboard. Adding "SoNiX +KN85 Keyboard" to the list of non-apple keyboards fixes the function +keys. + +Signed-off-by: Joey Bednar +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-apple.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c +index 2de1a97eafc14..0dff3f557e632 100644 +--- a/drivers/hid/hid-apple.c ++++ b/drivers/hid/hid-apple.c +@@ -319,6 +319,7 @@ static const struct apple_key_translation swapped_fn_leftctrl_keys[] = { + }; + + static const struct apple_non_apple_keyboard non_apple_keyboards[] = { ++ { "SONiX KN85 Keyboard" }, + { "SONiX USB DEVICE" }, + { "SONiX AK870 PRO" }, + { "Keychron" }, +-- +2.51.0 + diff --git a/queue-6.1/hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch b/queue-6.1/hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch new file mode 100644 index 00000000000..c837d6f57af --- /dev/null +++ b/queue-6.1/hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch @@ -0,0 +1,141 @@ +From 11103e5e93101cba43425a2fce38a541453a33ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 12:56:09 +0900 +Subject: HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK + +From: David Phillips + +[ Upstream commit b8e5fdf0bd022cd5493a5987ef66f5a24f8352d8 ] + +New model in the ELECOM HUGE trackball line that has 8 buttons but the +report descriptor specifies only 5. The HUGE Plus supports connecting via +Bluetooth, 2.4GHz wireless USB dongle, and directly via a USB-C cable. +Each connection type reports a different device id, 01AA for cable, +01AB for USB dongle, and 01AC for Bluetooth. + +This patch adds these device IDs and applies the fixups similar to the +other ELECOM devices to get all 8 buttons working for all 3 connection +types. + +For reference, the usbhid-dump output: +001:013:001:DESCRIPTOR 1769085639.598405 + 05 01 09 02 A1 01 85 01 09 01 A1 00 05 09 19 01 + 29 05 15 00 25 01 75 01 95 05 81 02 75 03 95 01 + 81 01 05 01 09 30 09 31 16 01 80 26 FF 7F 75 10 + 95 02 81 06 09 38 15 81 25 7F 75 08 95 01 81 06 + 05 0C 0A 38 02 15 81 25 7F 75 08 95 01 81 06 C0 + C0 05 0C 09 01 A1 01 85 02 15 01 26 8C 02 19 01 + 2A 8C 02 75 10 95 01 81 00 C0 05 01 09 80 A1 01 + 85 03 09 82 09 81 09 83 15 00 25 01 19 01 29 03 + 75 01 95 03 81 02 95 05 81 01 C0 06 01 FF 09 00 + A1 01 85 08 09 00 15 00 26 FF 00 75 08 95 07 81 + 02 C0 06 02 FF 09 02 A1 01 85 06 09 02 15 00 26 + FF 00 75 08 95 07 B1 02 C0 + +Signed-off-by: David Phillips +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/Kconfig | 1 + + drivers/hid/hid-elecom.c | 16 ++++++++++++++++ + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/hid-quirks.c | 3 +++ + 4 files changed, 23 insertions(+) + +diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig +index 9ad5e43d9961b..2693675824880 100644 +--- a/drivers/hid/Kconfig ++++ b/drivers/hid/Kconfig +@@ -321,6 +321,7 @@ config HID_ELECOM + - EX-G Trackballs (M-XT3DRBK, M-XT3URBK) + - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK) + - HUGE Trackballs (M-HT1DRBK, M-HT1URBK) ++ - HUGE Plus Trackball (M-HT1MRBK) + + config HID_ELO + tristate "ELO USB 4000/4500 touchscreen" +diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c +index f76fec79e8903..9aeb2d2b43a43 100644 +--- a/drivers/hid/hid-elecom.c ++++ b/drivers/hid/hid-elecom.c +@@ -5,6 +5,7 @@ + * - EX-G Trackballs (M-XT3DRBK, M-XT3URBK, M-XT4DRBK) + * - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK) + * - HUGE Trackballs (M-HT1DRBK, M-HT1URBK) ++ * - HUGE Plus Trackball (M-HT1MRBK) + * + * Copyright (c) 2010 Richard Nauber + * Copyright (c) 2016 Yuxuan Shui +@@ -111,12 +112,25 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc, + */ + mouse_button_fixup(hdev, rdesc, *rsize, 22, 30, 24, 16, 8); + break; ++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK: ++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB: ++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC: ++ /* ++ * Report descriptor format: ++ * 24: button bit count ++ * 28: padding bit count ++ * 22: button report size ++ * 16: button usage maximum ++ */ ++ mouse_button_fixup(hdev, rdesc, *rsize, 24, 28, 22, 16, 8); ++ break; + } + return rdesc; + } + + static const struct hid_device_id elecom_devices[] = { + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, ++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, +@@ -127,6 +141,8 @@ static const struct hid_device_id elecom_devices[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) }, + { } + }; + MODULE_DEVICE_TABLE(hid, elecom_devices); +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 8b4e146fdd6ce..fd3198d4b7c5b 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -453,6 +453,9 @@ + #define USB_DEVICE_ID_ELECOM_M_HT1URBK 0x010c + #define USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D 0x010d + #define USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C 0x011c ++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK 0x01aa ++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB 0x01ab ++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC 0x01ac + + #define USB_VENDOR_ID_DREAM_CHEEKY 0x1d34 + #define USB_DEVICE_ID_DREAM_CHEEKY_WN 0x0004 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 457a52cfa17c6..030ad260e7566 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -403,6 +403,7 @@ static const struct hid_device_id hid_have_special_driver[] = { + #if IS_ENABLED(CONFIG_HID_ELECOM) + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, ++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) }, +@@ -412,6 +413,8 @@ static const struct hid_device_id hid_have_special_driver[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) }, + #endif + #if IS_ENABLED(CONFIG_HID_ELO) + { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) }, +-- +2.51.0 + diff --git a/queue-6.1/hid-multitouch-add-egalaxtouch-exc3188-support.patch b/queue-6.1/hid-multitouch-add-egalaxtouch-exc3188-support.patch new file mode 100644 index 00000000000..512b5558f14 --- /dev/null +++ b/queue-6.1/hid-multitouch-add-egalaxtouch-exc3188-support.patch @@ -0,0 +1,49 @@ +From fb01ae5b9c69d5f363885a8dc40895183e718395 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 09:57:05 +0100 +Subject: HID: multitouch: add eGalaxTouch EXC3188 support + +From: Thorsten Schmelzer + +[ Upstream commit 8e4ac86b2ddd36fe501e20ecfcc080e536df1f48 ] + +Add support for the for the EXC3188 touchscreen from eGalaxy. + +Signed-off-by: Thorsten Schmelzer +Signed-off-by: Michael Tretter +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-multitouch.c | 3 +++ + 2 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index bac298a4930a4..8b4e146fdd6ce 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -416,6 +416,7 @@ + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7349 0x7349 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7 0x73f7 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001 ++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000 0xc000 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002 0xc002 + + #define USB_VENDOR_ID_EDIFIER 0x2d99 +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 6d9a85c5fc409..b6c2cb7153fde 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -2020,6 +2020,9 @@ static const struct hid_device_id mt_devices[] = { + { .driver_data = MT_CLS_EGALAX_SERIAL, + MT_USB_DEVICE(USB_VENDOR_ID_DWAV, + USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) }, ++ { .driver_data = MT_CLS_EGALAX_SERIAL, ++ MT_USB_DEVICE(USB_VENDOR_ID_DWAV, ++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000) }, + { .driver_data = MT_CLS_EGALAX, + MT_USB_DEVICE(USB_VENDOR_ID_DWAV, + USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002) }, +-- +2.51.0 + diff --git a/queue-6.1/hisi_acc_vfio_pci-update-status-after-ras-error.patch b/queue-6.1/hisi_acc_vfio_pci-update-status-after-ras-error.patch new file mode 100644 index 00000000000..83bb4a18650 --- /dev/null +++ b/queue-6.1/hisi_acc_vfio_pci-update-status-after-ras-error.patch @@ -0,0 +1,41 @@ +From 762c5494271c6e3accd617e2a6c4201b2b59b388 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 10:02:03 +0800 +Subject: hisi_acc_vfio_pci: update status after RAS error + +From: Longfang Liu + +[ Upstream commit 8be14dd48dfee0df91e511acceb4beeb2461a083 ] + +After a RAS error occurs on the accelerator device, the accelerator +device will be reset. The live migration state will be abnormal +after reset, and the original state needs to be restored during +the reset process. +Therefore, reset processing needs to be performed in a live +migration scenario. + +Signed-off-by: Longfang Liu +Link: https://lore.kernel.org/r/20260122020205.2884497-3-liulongfang@huawei.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c +index de3e1a148ddab..e682c14614998 100644 +--- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c ++++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c +@@ -1019,8 +1019,7 @@ static void hisi_acc_vf_pci_aer_reset_done(struct pci_dev *pdev) + { + struct hisi_acc_vf_core_device *hisi_acc_vdev = hisi_acc_drvdata(pdev); + +- if (hisi_acc_vdev->core_device.vdev.migration_flags != +- VFIO_MIGRATION_STOP_COPY) ++ if (!hisi_acc_vdev->core_device.vdev.mig_ops) + return; + + /* +-- +2.51.0 + diff --git a/queue-6.1/hwmon-f71882fg-add-f81968-support.patch b/queue-6.1/hwmon-f71882fg-add-f81968-support.patch new file mode 100644 index 00000000000..d6bcea7708a --- /dev/null +++ b/queue-6.1/hwmon-f71882fg-add-f81968-support.patch @@ -0,0 +1,59 @@ +From a7c4d72988b3b365d4469082c8b52ee7edaa1831 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Dec 2025 13:10:40 +0800 +Subject: hwmon: (f71882fg) Add F81968 support + +From: Ji-Ze Hong (Peter Hong) + +[ Upstream commit e4a3d6f79c9933fece64368168c46d6cf5fc2e52 ] + +Add hardware monitoring support for the Fintek F81968 Super I/O chip. +It is fully compatible with F81866. + +Several products share compatibility with the F81866. To better distinguish +between them, ensure that the Product ID is displayed when the device is +probed. + +Signed-off-by: Ji-Ze Hong (Peter Hong) +Link: https://lore.kernel.org/r/20251223051040.10227-1-peter_hong@fintek.com.tw +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/f71882fg.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c +index 27207ec6f7feb..5e3c8be255e87 100644 +--- a/drivers/hwmon/f71882fg.c ++++ b/drivers/hwmon/f71882fg.c +@@ -51,6 +51,7 @@ + #define SIO_F81866_ID 0x1010 /* Chipset ID */ + #define SIO_F71858AD_ID 0x0903 /* Chipset ID */ + #define SIO_F81966_ID 0x1502 /* Chipset ID */ ++#define SIO_F81968_ID 0x1806 /* Chipset ID */ + + #define REGION_LENGTH 8 + #define ADDR_REG_OFFSET 5 +@@ -2571,6 +2572,7 @@ static int __init f71882fg_find(int sioaddr, struct f71882fg_sio_data *sio_data) + break; + case SIO_F81866_ID: + case SIO_F81966_ID: ++ case SIO_F81968_ID: + sio_data->type = f81866a; + break; + default: +@@ -2600,9 +2602,9 @@ static int __init f71882fg_find(int sioaddr, struct f71882fg_sio_data *sio_data) + address &= ~(REGION_LENGTH - 1); /* Ignore 3 LSB */ + + err = address; +- pr_info("Found %s chip at %#x, revision %d\n", ++ pr_info("Found %s chip at %#x, revision %d, devid: %04x\n", + f71882fg_names[sio_data->type], (unsigned int)address, +- (int)superio_inb(sioaddr, SIO_REG_DEVREV)); ++ (int)superio_inb(sioaddr, SIO_REG_DEVREV), devid); + exit: + superio_exit(sioaddr); + return err; +-- +2.51.0 + diff --git a/queue-6.1/hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch b/queue-6.1/hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch new file mode 100644 index 00000000000..9c8791bd8c6 --- /dev/null +++ b/queue-6.1/hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch @@ -0,0 +1,61 @@ +From eff757f66496da87235817785e4d6f16cceadfe5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 08:35:44 +0100 +Subject: hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 1e5271393d777f6159d896943b4c44c4f3ecff52 ] + +The unpacked union within a packed struct generates alignment warnings +on clang for 32-bit ARM: + +./usr/include/linux/hyperv.h:361:2: error: field within 'struct hv_kvp_exchg_msg_value' + is less aligned than 'union hv_kvp_exchg_msg_value::(anonymous at ./usr/include/linux/hyperv.h:361:2)' + and is usually due to 'struct hv_kvp_exchg_msg_value' being packed, + which can lead to unaligned accesses [-Werror,-Wunaligned-access] + 361 | union { + | ^ + +With the recent changes to compile-test the UAPI headers in more cases, +this warning in combination with CONFIG_WERROR breaks the build. + +Fix the warning. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/ +Reported-by: Nathan Chancellor +Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/ +Suggested-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/ +Signed-off-by: Thomas Weißschuh +Acked-by: Wei Liu (Microsoft) +Tested-by: Nicolas Schier +Reviewed-by: Nicolas Schier +Acked-by: Greg Kroah-Hartman +Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-1-076aed1623ff@linutronix.de +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + include/uapi/linux/hyperv.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/hyperv.h b/include/uapi/linux/hyperv.h +index aaa502a7bff46..1749b35ab2c21 100644 +--- a/include/uapi/linux/hyperv.h ++++ b/include/uapi/linux/hyperv.h +@@ -362,7 +362,7 @@ struct hv_kvp_exchg_msg_value { + __u8 value[HV_KVP_EXCHANGE_MAX_VALUE_SIZE]; + __u32 value_u32; + __u64 value_u64; +- }; ++ } __attribute__((packed)); + } __attribute__((packed)); + + struct hv_kvp_msg_enumerate { +-- +2.51.0 + diff --git a/queue-6.1/i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch b/queue-6.1/i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch new file mode 100644 index 00000000000..84593cf84e5 --- /dev/null +++ b/queue-6.1/i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch @@ -0,0 +1,49 @@ +From 70926b7e15c10b831c7b51a8793685856fac8aee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 15:08:51 -0500 +Subject: i3c: master: svc: Initialize 'dev' to NULL in + svc_i3c_master_ibi_isr() + +From: Frank Li + +[ Upstream commit 3c9ffb4db787428a5851d5865823ab23842d5103 ] + +Initialize the 'dev' pointer to NULL in svc_i3c_master_ibi_isr() and add +a NULL check in the error path. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/r/202512131016.YCKIsDXM-lkp@intel.com/ +Signed-off-by: Frank Li +Link: https://patch.msgid.link/20251215200852.3079073-1-Frank.Li@nxp.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/svc-i3c-master.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c +index 21ea4166057d8..e533847f058b2 100644 +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -410,8 +410,8 @@ static void svc_i3c_master_ibi_work(struct work_struct *work) + { + struct svc_i3c_master *master = container_of(work, struct svc_i3c_master, ibi_work); + struct svc_i3c_i2c_dev_data *data; ++ struct i3c_dev_desc *dev = NULL; + unsigned int ibitype, ibiaddr; +- struct i3c_dev_desc *dev; + u32 status, val; + int ret; + +@@ -495,7 +495,7 @@ static void svc_i3c_master_ibi_work(struct work_struct *work) + * for the slave to interrupt again. + */ + if (svc_i3c_master_error(master)) { +- if (master->ibi.tbq_slot) { ++ if (master->ibi.tbq_slot && dev) { + data = i3c_dev_get_master_data(dev); + i3c_generic_ibi_recycle_slot(data->ibi_pool, + master->ibi.tbq_slot); +-- +2.51.0 + diff --git a/queue-6.1/iio-magnetometer-remove-irqf_oneshot.patch b/queue-6.1/iio-magnetometer-remove-irqf_oneshot.patch new file mode 100644 index 00000000000..ccc610a925d --- /dev/null +++ b/queue-6.1/iio-magnetometer-remove-irqf_oneshot.patch @@ -0,0 +1,49 @@ +From 1d8380e002f9a56b515106197136a547b1752877 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:38 +0100 +Subject: iio: magnetometer: Remove IRQF_ONESHOT +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sebastian Andrzej Siewior + +[ Upstream commit a54e9440925e6617c98669066b4753c4cdcea8a0 ] + +Passing IRQF_ONESHOT ensures that the interrupt source is masked until +the secondary (threaded) handler is done. If only a primary handler is +used then the flag makes no sense because the interrupt can not fire +(again) while its handler is running. +The flag also disallows force-threading of the primary handler and the +irq-core will warn about this. +The force-threading functionality is required on PREEMPT_RT because the +handler is using locks with can sleep on PREEMPT_RT. + +Remove IRQF_ONESHOT from irqflags. + +Tested-by: Geert Uytterhoeven +Signed-off-by: Sebastian Andrzej Siewior +Reviewed-by: Andy Shevchenko +Reviewed-by: Nuno Sá +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/magnetometer/ak8975.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c +index 13929b77f8c84..88396232c70b6 100644 +--- a/drivers/iio/magnetometer/ak8975.c ++++ b/drivers/iio/magnetometer/ak8975.c +@@ -542,7 +542,7 @@ static int ak8975_setup_irq(struct ak8975_data *data) + irq = gpiod_to_irq(data->eoc_gpiod); + + rc = devm_request_irq(&client->dev, irq, ak8975_irq_handler, +- IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ IRQF_TRIGGER_RISING, + dev_name(&client->dev), data); + if (rc < 0) { + dev_err(&client->dev, "irq %d request failed: %d\n", irq, rc); +-- +2.51.0 + diff --git a/queue-6.1/iio-use-irqf_no_thread.patch b/queue-6.1/iio-use-irqf_no_thread.patch new file mode 100644 index 00000000000..a450f36d2cc --- /dev/null +++ b/queue-6.1/iio-use-irqf_no_thread.patch @@ -0,0 +1,90 @@ +From 6c18a5ba26abf24a155733f61a39fce21dc7074a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:36 +0100 +Subject: iio: Use IRQF_NO_THREAD + +From: Sebastian Andrzej Siewior + +[ Upstream commit 04d390af97f2c28166f7ddfe1a6bda622e3a4766 ] + +The interrupt handler iio_trigger_generic_data_rdy_poll() will invoke +other interrupt handler and this supposed to happen from within the +hardirq. + +Use IRQF_NO_THREAD to forbid forced-threading. + +Signed-off-by: Sebastian Andrzej Siewior +Reviewed-by: Andy Shevchenko +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/accel/bma180.c | 5 +++-- + drivers/iio/adc/ad7766.c | 2 +- + drivers/iio/gyro/itg3200_buffer.c | 8 +++----- + drivers/iio/light/si1145.c | 2 +- + 4 files changed, 8 insertions(+), 9 deletions(-) + +diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c +index d03fc3400f94e..1667f38aa7bb8 100644 +--- a/drivers/iio/accel/bma180.c ++++ b/drivers/iio/accel/bma180.c +@@ -997,8 +997,9 @@ static int bma180_probe(struct i2c_client *client, + } + + ret = devm_request_irq(dev, client->irq, +- iio_trigger_generic_data_rdy_poll, IRQF_TRIGGER_RISING, +- "bma180_event", data->trig); ++ iio_trigger_generic_data_rdy_poll, ++ IRQF_TRIGGER_RISING | IRQF_NO_THREAD, ++ "bma180_event", data->trig); + if (ret) { + dev_err(dev, "unable to request IRQ\n"); + goto err_trigger_free; +diff --git a/drivers/iio/adc/ad7766.c b/drivers/iio/adc/ad7766.c +index 3079a0872947e..d1d010c1dbf6c 100644 +--- a/drivers/iio/adc/ad7766.c ++++ b/drivers/iio/adc/ad7766.c +@@ -261,7 +261,7 @@ static int ad7766_probe(struct spi_device *spi) + * don't enable the interrupt to avoid extra load on the system + */ + ret = devm_request_irq(&spi->dev, spi->irq, ad7766_irq, +- IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN, ++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN | IRQF_NO_THREAD, + dev_name(&spi->dev), + ad7766->trig); + if (ret < 0) +diff --git a/drivers/iio/gyro/itg3200_buffer.c b/drivers/iio/gyro/itg3200_buffer.c +index 4cfa0d4395605..d1c125a77308a 100644 +--- a/drivers/iio/gyro/itg3200_buffer.c ++++ b/drivers/iio/gyro/itg3200_buffer.c +@@ -118,11 +118,9 @@ int itg3200_probe_trigger(struct iio_dev *indio_dev) + if (!st->trig) + return -ENOMEM; + +- ret = request_irq(st->i2c->irq, +- &iio_trigger_generic_data_rdy_poll, +- IRQF_TRIGGER_RISING, +- "itg3200_data_rdy", +- st->trig); ++ ret = request_irq(st->i2c->irq, &iio_trigger_generic_data_rdy_poll, ++ IRQF_TRIGGER_RISING | IRQF_NO_THREAD, ++ "itg3200_data_rdy", st->trig); + if (ret) + goto error_free_trig; + +diff --git a/drivers/iio/light/si1145.c b/drivers/iio/light/si1145.c +index e8f6cdf26f22a..50b424b4f23b9 100644 +--- a/drivers/iio/light/si1145.c ++++ b/drivers/iio/light/si1145.c +@@ -1251,7 +1251,7 @@ static int si1145_probe_trigger(struct iio_dev *indio_dev) + + ret = devm_request_irq(&client->dev, client->irq, + iio_trigger_generic_data_rdy_poll, +- IRQF_TRIGGER_FALLING, ++ IRQF_TRIGGER_FALLING | IRQF_NO_THREAD, + "si1145_irq", + trig); + if (ret < 0) { +-- +2.51.0 + diff --git a/queue-6.1/include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch b/queue-6.1/include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch new file mode 100644 index 00000000000..b290944ee0e --- /dev/null +++ b/queue-6.1/include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch @@ -0,0 +1,42 @@ +From 8c6cab2d9258e3b02ad11ebadce7276eaa32d14a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Feb 2026 15:54:06 +0100 +Subject: include: uapi: netfilter_bridge.h: Cover for musl libc + +From: Phil Sutter + +[ Upstream commit 4edd4ba71ce0df015303dba75ea9d20d1a217546 ] + +Musl defines its own struct ethhdr and thus defines __UAPI_DEF_ETHHDR to +zero. To avoid struct redefinition errors, user space is therefore +supposed to include netinet/if_ether.h before (or instead of) +linux/if_ether.h. To relieve them from this burden, include the libc +header here if not building for kernel space. + +Reported-by: Alyssa Ross +Suggested-by: Florian Westphal +Signed-off-by: Phil Sutter +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + include/uapi/linux/netfilter_bridge.h | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/include/uapi/linux/netfilter_bridge.h b/include/uapi/linux/netfilter_bridge.h +index 1610fdbab98df..ad520d3e9df8f 100644 +--- a/include/uapi/linux/netfilter_bridge.h ++++ b/include/uapi/linux/netfilter_bridge.h +@@ -5,6 +5,10 @@ + /* bridge-specific defines for netfilter. + */ + ++#ifndef __KERNEL__ ++#include /* for __UAPI_DEF_ETHHDR if defined */ ++#endif ++ + #include + #include + #include +-- +2.51.0 + diff --git a/queue-6.1/iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch b/queue-6.1/iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch new file mode 100644 index 00000000000..3432234d2f4 --- /dev/null +++ b/queue-6.1/iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch @@ -0,0 +1,134 @@ +From a2a799267ec62cb048d83e1c5473f670b55995ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 13:28:57 -0800 +Subject: iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency + +From: Alexander Grest + +[ Upstream commit df180b1a4cc51011c5f8c52c7ec02ad2e42962de ] + +The SMMU CMDQ lock is highly contentious when there are multiple CPUs +issuing commands and the queue is nearly full. + +The lock has the following states: + - 0: Unlocked + - >0: Shared lock held with count + - INT_MIN+N: Exclusive lock held, where N is the # of shared waiters + - INT_MIN: Exclusive lock held, no shared waiters + +When multiple CPUs are polling for space in the queue, they attempt to +grab the exclusive lock to update the cons pointer from the hardware. If +they fail to get the lock, they will spin until either the cons pointer +is updated by another CPU. + +The current code allows the possibility of shared lock starvation +if there is a constant stream of CPUs trying to grab the exclusive lock. +This leads to severe latency issues and soft lockups. + +Consider the following scenario where CPU1's attempt to acquire the +shared lock is starved by CPU2 and CPU0 contending for the exclusive +lock. + +CPU0 (exclusive) | CPU1 (shared) | CPU2 (exclusive) | `cmdq->lock` +-------------------------------------------------------------------------- +trylock() //takes | | | 0 + | shared_lock() | | INT_MIN + | fetch_inc() | | INT_MIN + | no return | | INT_MIN + 1 + | spins // VAL >= 0 | | INT_MIN + 1 +unlock() | spins... | | INT_MIN + 1 +set_release(0) | spins... | | 0 see[NOTE] +(done) | (sees 0) | trylock() // takes | 0 + | *exits loop* | cmpxchg(0, INT_MIN) | 0 + | | *cuts in* | INT_MIN + | cmpxchg(0, 1) | | INT_MIN + | fails // != 0 | | INT_MIN + | spins // VAL >= 0 | | INT_MIN + | *starved* | | INT_MIN + +[NOTE] The current code resets the exclusive lock to 0 regardless of the +state of the lock. This causes two problems: +1. It opens the possibility of back-to-back exclusive locks and the + downstream effect of starving shared lock. +2. The count of shared lock waiters are lost. + +To mitigate this, we release the exclusive lock by only clearing the sign +bit while retaining the shared lock waiter count as a way to avoid +starving the shared lock waiters. + +Also deleted cmpxchg loop while trying to acquire the shared lock as it +is not needed. The waiters can see the positive lock count and proceed +immediately after the exclusive lock is released. + +Exclusive lock is not starved in that submitters will try exclusive lock +first when new spaces become available. + +Reviewed-by: Mostafa Saleh +Reviewed-by: Nicolin Chen +Signed-off-by: Alexander Grest +Signed-off-by: Jacob Pan +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 31 ++++++++++++++------- + 1 file changed, 21 insertions(+), 10 deletions(-) + +diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +index 6a60bad48b277..eba2b2e2da0b9 100644 +--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c ++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +@@ -443,20 +443,26 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu) + */ + static void arm_smmu_cmdq_shared_lock(struct arm_smmu_cmdq *cmdq) + { +- int val; +- + /* +- * We can try to avoid the cmpxchg() loop by simply incrementing the +- * lock counter. When held in exclusive state, the lock counter is set +- * to INT_MIN so these increments won't hurt as the value will remain +- * negative. ++ * When held in exclusive state, the lock counter is set to INT_MIN ++ * so these increments won't hurt as the value will remain negative. ++ * The increment will also signal the exclusive locker that there are ++ * shared waiters. + */ + if (atomic_fetch_inc_relaxed(&cmdq->lock) >= 0) + return; + +- do { +- val = atomic_cond_read_relaxed(&cmdq->lock, VAL >= 0); +- } while (atomic_cmpxchg_relaxed(&cmdq->lock, val, val + 1) != val); ++ /* ++ * Someone else is holding the lock in exclusive state, so wait ++ * for them to finish. Since we already incremented the lock counter, ++ * no exclusive lock can be acquired until we finish. We don't need ++ * the return value since we only care that the exclusive lock is ++ * released (i.e. the lock counter is non-negative). ++ * Once the exclusive locker releases the lock, the sign bit will ++ * be cleared and our increment will make the lock counter positive, ++ * allowing us to proceed. ++ */ ++ atomic_cond_read_relaxed(&cmdq->lock, VAL > 0); + } + + static void arm_smmu_cmdq_shared_unlock(struct arm_smmu_cmdq *cmdq) +@@ -483,9 +489,14 @@ static bool arm_smmu_cmdq_shared_tryunlock(struct arm_smmu_cmdq *cmdq) + __ret; \ + }) + ++/* ++ * Only clear the sign bit when releasing the exclusive lock this will ++ * allow any shared_lock() waiters to proceed without the possibility ++ * of entering the exclusive lock in a tight loop. ++ */ + #define arm_smmu_cmdq_exclusive_unlock_irqrestore(cmdq, flags) \ + ({ \ +- atomic_set_release(&cmdq->lock, 0); \ ++ atomic_fetch_andnot_release(INT_MIN, &cmdq->lock); \ + local_irq_restore(flags); \ + }) + +-- +2.51.0 + diff --git a/queue-6.1/ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch b/queue-6.1/ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch new file mode 100644 index 00000000000..7571cfce540 --- /dev/null +++ b/queue-6.1/ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch @@ -0,0 +1,123 @@ +From 6eeea76a41bf1650b2d090df85bcfcd6bf246bd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 04:35:24 +0000 +Subject: ipv4: fib: Annotate access to struct fib_alias.fa_state. + +From: Kuniyuki Iwashima + +[ Upstream commit 6e84fc395e90465f1418f582a9f7d53c87ab010e ] + +syzbot reported that struct fib_alias.fa_state can be +modified locklessly by RCU readers. [0] + +Let's use READ_ONCE()/WRITE_ONCE() properly. + +[0]: +BUG: KCSAN: data-race in fib_table_lookup / fib_table_lookup + +write to 0xffff88811b06a7fa of 1 bytes by task 4167 on cpu 0: + fib_alias_accessed net/ipv4/fib_lookup.h:32 [inline] + fib_table_lookup+0x361/0xd60 net/ipv4/fib_trie.c:1565 + fib_lookup include/net/ip_fib.h:390 [inline] + ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814 + ip_route_output_key_hash net/ipv4/route.c:2705 [inline] + __ip_route_output_key include/net/route.h:169 [inline] + ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932 + udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450 + inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859 + sock_sendmsg_nosec net/socket.c:727 [inline] + __sock_sendmsg net/socket.c:742 [inline] + ____sys_sendmsg+0x53a/0x600 net/socket.c:2592 + ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646 + __sys_sendmmsg+0x185/0x320 net/socket.c:2735 + __do_sys_sendmmsg net/socket.c:2762 [inline] + __se_sys_sendmmsg net/socket.c:2759 [inline] + __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759 + x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +read to 0xffff88811b06a7fa of 1 bytes by task 4168 on cpu 1: + fib_alias_accessed net/ipv4/fib_lookup.h:31 [inline] + fib_table_lookup+0x338/0xd60 net/ipv4/fib_trie.c:1565 + fib_lookup include/net/ip_fib.h:390 [inline] + ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814 + ip_route_output_key_hash net/ipv4/route.c:2705 [inline] + __ip_route_output_key include/net/route.h:169 [inline] + ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932 + udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450 + inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859 + sock_sendmsg_nosec net/socket.c:727 [inline] + __sock_sendmsg net/socket.c:742 [inline] + ____sys_sendmsg+0x53a/0x600 net/socket.c:2592 + ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646 + __sys_sendmmsg+0x185/0x320 net/socket.c:2735 + __do_sys_sendmmsg net/socket.c:2762 [inline] + __se_sys_sendmmsg net/socket.c:2759 [inline] + __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759 + x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +value changed: 0x00 -> 0x01 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 1 UID: 0 PID: 4168 Comm: syz.4.206 Not tainted syzkaller #0 PREEMPT(voluntary) +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 + +Reported-by: syzbot+d24f940f770afda885cf@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/69783ead.050a0220.c9109.0013.GAE@google.com/ +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260127043528.514160-1-kuniyu@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/fib_lookup.h | 6 ++++-- + net/ipv4/fib_trie.c | 4 ++-- + 2 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h +index f9b9e26c32c19..0b72796dd1ad3 100644 +--- a/net/ipv4/fib_lookup.h ++++ b/net/ipv4/fib_lookup.h +@@ -28,8 +28,10 @@ struct fib_alias { + /* Don't write on fa_state unless needed, to keep it shared on all cpus */ + static inline void fib_alias_accessed(struct fib_alias *fa) + { +- if (!(fa->fa_state & FA_S_ACCESSED)) +- fa->fa_state |= FA_S_ACCESSED; ++ u8 fa_state = READ_ONCE(fa->fa_state); ++ ++ if (!(fa_state & FA_S_ACCESSED)) ++ WRITE_ONCE(fa->fa_state, fa_state | FA_S_ACCESSED); + } + + /* Exported by fib_semantics.c */ +diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c +index 4d148d0892327..c9e1526e749b2 100644 +--- a/net/ipv4/fib_trie.c ++++ b/net/ipv4/fib_trie.c +@@ -1285,7 +1285,7 @@ int fib_table_insert(struct net *net, struct fib_table *tb, + new_fa->fa_dscp = fa->fa_dscp; + new_fa->fa_info = fi; + new_fa->fa_type = cfg->fc_type; +- state = fa->fa_state; ++ state = READ_ONCE(fa->fa_state); + new_fa->fa_state = state & ~FA_S_ACCESSED; + new_fa->fa_slen = fa->fa_slen; + new_fa->tb_id = tb->tb_id; +@@ -1751,7 +1751,7 @@ int fib_table_delete(struct net *net, struct fib_table *tb, + + fib_remove_alias(t, tp, l, fa_to_delete); + +- if (fa_to_delete->fa_state & FA_S_ACCESSED) ++ if (READ_ONCE(fa_to_delete->fa_state) & FA_S_ACCESSED) + rt_cache_flush(cfg->fc_nlinfo.nl_net); + + fib_release_info(fa_to_delete->fa_info); +-- +2.51.0 + diff --git a/queue-6.1/ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch b/queue-6.1/ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch new file mode 100644 index 00000000000..053ce49255b --- /dev/null +++ b/queue-6.1/ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch @@ -0,0 +1,41 @@ +From a7d69196f43dfdc6fa653d04ce6a04a0dd5e3f69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 09:41:37 +0000 +Subject: ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() + +From: Eric Dumazet + +[ Upstream commit 03e9d91dd64e2f5ea632df5d59568d91757efc4d ] + +Add missing READ_ONCE() when reading sysctl values. + +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260115094141.3124990-5-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/ipv6.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/net/ipv6.h b/include/net/ipv6.h +index 3bf743d601e1c..f4307b35294cf 100644 +--- a/include/net/ipv6.h ++++ b/include/net/ipv6.h +@@ -982,11 +982,11 @@ static inline int ip6_default_np_autolabel(struct net *net) + #if IS_ENABLED(CONFIG_IPV6) + static inline int ip6_multipath_hash_policy(const struct net *net) + { +- return net->ipv6.sysctl.multipath_hash_policy; ++ return READ_ONCE(net->ipv6.sysctl.multipath_hash_policy); + } + static inline u32 ip6_multipath_hash_fields(const struct net *net) + { +- return net->ipv6.sysctl.multipath_hash_fields; ++ return READ_ONCE(net->ipv6.sysctl.multipath_hash_fields); + } + #else + static inline int ip6_multipath_hash_policy(const struct net *net) +-- +2.51.0 + diff --git a/queue-6.1/ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch b/queue-6.1/ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch new file mode 100644 index 00000000000..4d686183ffa --- /dev/null +++ b/queue-6.1/ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch @@ -0,0 +1,66 @@ +From 77af213b2e97fdec1c46b794ee0290ad76f9df63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 09:41:40 +0000 +Subject: ipv6: exthdrs: annotate data-race over multiple sysctl + +From: Eric Dumazet + +[ Upstream commit 978b67d28358b0b4eacfa94453d1ad4e09b123ad ] + +Following four sysctls can change under us, add missing READ_ONCE(). + +- ipv6.sysctl.max_dst_opts_len +- ipv6.sysctl.max_dst_opts_cnt +- ipv6.sysctl.max_hbh_opts_len +- ipv6.sysctl.max_hbh_opts_cnt + +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260115094141.3124990-8-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/exthdrs.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c +index 1cfdd9d950123..a64281cc3a0cc 100644 +--- a/net/ipv6/exthdrs.c ++++ b/net/ipv6/exthdrs.c +@@ -316,7 +316,7 @@ static int ipv6_destopt_rcv(struct sk_buff *skb) + } + + extlen = (skb_transport_header(skb)[1] + 1) << 3; +- if (extlen > net->ipv6.sysctl.max_dst_opts_len) ++ if (extlen > READ_ONCE(net->ipv6.sysctl.max_dst_opts_len)) + goto fail_and_free; + + opt->lastopt = opt->dst1 = skb_network_header_len(skb); +@@ -324,7 +324,8 @@ static int ipv6_destopt_rcv(struct sk_buff *skb) + dstbuf = opt->dst1; + #endif + +- if (ip6_parse_tlv(false, skb, net->ipv6.sysctl.max_dst_opts_cnt)) { ++ if (ip6_parse_tlv(false, skb, ++ READ_ONCE(net->ipv6.sysctl.max_dst_opts_cnt))) { + skb->transport_header += extlen; + opt = IP6CB(skb); + #if IS_ENABLED(CONFIG_IPV6_MIP6) +@@ -1084,11 +1085,12 @@ int ipv6_parse_hopopts(struct sk_buff *skb) + } + + extlen = (skb_transport_header(skb)[1] + 1) << 3; +- if (extlen > net->ipv6.sysctl.max_hbh_opts_len) ++ if (extlen > READ_ONCE(net->ipv6.sysctl.max_hbh_opts_len)) + goto fail_and_free; + + opt->flags |= IP6SKB_HOPBYHOP; +- if (ip6_parse_tlv(true, skb, net->ipv6.sysctl.max_hbh_opts_cnt)) { ++ if (ip6_parse_tlv(true, skb, ++ READ_ONCE(net->ipv6.sysctl.max_hbh_opts_cnt))) { + skb->transport_header += extlen; + opt = IP6CB(skb); + opt->nhoff = sizeof(struct ipv6hdr); +-- +2.51.0 + diff --git a/queue-6.1/jfs-add-missing-set_freezable-for-freezable-kthread.patch b/queue-6.1/jfs-add-missing-set_freezable-for-freezable-kthread.patch new file mode 100644 index 00000000000..ad778d8882b --- /dev/null +++ b/queue-6.1/jfs-add-missing-set_freezable-for-freezable-kthread.patch @@ -0,0 +1,37 @@ +From fab177650e1ec7a11a739b5c343cf6aa7ca70c8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 19:38:01 +0800 +Subject: jfs: Add missing set_freezable() for freezable kthread + +From: Haotian Zhang + +[ Upstream commit eb0cfcf265714b419cc3549895a00632e76732ae ] + +The jfsIOWait() thread calls try_to_freeze() but lacks set_freezable(), +causing it to remain non-freezable by default. This prevents proper +freezing during system suspend. + +Add set_freezable() to make the thread freezable as intended. + +Signed-off-by: Haotian Zhang +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_logmgr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c +index 695415cbfe985..409fa6d92fce1 100644 +--- a/fs/jfs/jfs_logmgr.c ++++ b/fs/jfs/jfs_logmgr.c +@@ -2307,6 +2307,7 @@ int jfsIOWait(void *arg) + { + struct lbuf *bp; + ++ set_freezable(); + do { + spin_lock_irq(&log_redrive_lock); + while ((bp = log_redrive_list)) { +-- +2.51.0 + diff --git a/queue-6.1/jfs-nlink-overflow-in-jfs_rename.patch b/queue-6.1/jfs-nlink-overflow-in-jfs_rename.patch new file mode 100644 index 00000000000..5e8e75e4b1e --- /dev/null +++ b/queue-6.1/jfs-nlink-overflow-in-jfs_rename.patch @@ -0,0 +1,54 @@ +From 8c161eb540d499cc276b767610febc9898070b15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Oct 2025 13:22:12 +0100 +Subject: jfs: nlink overflow in jfs_rename + +From: Jori Koolstra + +[ Upstream commit 9218dc26fd922b09858ecd3666ed57dfd8098da8 ] + +If nlink is maximal for a directory (-1) and inside that directory you +perform a rename for some child directory (not moving from the parent), +then the nlink of the first directory is first incremented and later +decremented. Normally this is fine, but when nlink = -1 this causes a +wrap around to 0, and then drop_nlink issues a warning. + +After applying the patch syzbot no longer issues any warnings. I also +ran some basic fs tests to look for any regressions. + +Signed-off-by: Jori Koolstra +Reported-by: syzbot+9131ddfd7870623b719f@syzkaller.appspotmail.com +Closes: https://syzbot.org/bug?extid=9131ddfd7870623b719f +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/namei.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c +index b3a0fe0649c49..df6bde0206bb4 100644 +--- a/fs/jfs/namei.c ++++ b/fs/jfs/namei.c +@@ -1227,7 +1227,7 @@ static int jfs_rename(struct user_namespace *mnt_userns, struct inode *old_dir, + jfs_err("jfs_rename: dtInsert returned -EIO"); + goto out_tx; + } +- if (S_ISDIR(old_ip->i_mode)) ++ if (S_ISDIR(old_ip->i_mode) && old_dir != new_dir) + inc_nlink(new_dir); + } + /* +@@ -1243,7 +1243,9 @@ static int jfs_rename(struct user_namespace *mnt_userns, struct inode *old_dir, + goto out_tx; + } + if (S_ISDIR(old_ip->i_mode)) { +- drop_nlink(old_dir); ++ if (new_ip || old_dir != new_dir) ++ drop_nlink(old_dir); ++ + if (old_dir != new_dir) { + /* + * Change inode number of parent for moved directory +-- +2.51.0 + diff --git a/queue-6.1/libceph-define-and-enforce-ceph_max_key_len.patch b/queue-6.1/libceph-define-and-enforce-ceph_max_key_len.patch new file mode 100644 index 00000000000..b8e5d34836b --- /dev/null +++ b/queue-6.1/libceph-define-and-enforce-ceph_max_key_len.patch @@ -0,0 +1,82 @@ +From 3ad5eb83c45173e21dcd43560e3e9d6968f8f8f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jul 2025 16:30:50 +0200 +Subject: libceph: define and enforce CEPH_MAX_KEY_LEN + +From: Ilya Dryomov + +[ Upstream commit ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf ] + +When decoding the key, verify that the key material would fit into +a fixed-size buffer in process_auth_done() and generally has a sane +length. + +The new CEPH_MAX_KEY_LEN check replaces the existing check for a key +with no key material which is a) not universal since CEPH_CRYPTO_NONE +has to be excluded and b) doesn't provide much value since a smaller +than needed key is just as invalid as no key -- this has to be handled +elsewhere anyway. + +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + net/ceph/crypto.c | 8 +++++--- + net/ceph/crypto.h | 2 +- + net/ceph/messenger_v2.c | 2 +- + 3 files changed, 7 insertions(+), 5 deletions(-) + +diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c +index 051d22c0e4ad4..3397d105f74f9 100644 +--- a/net/ceph/crypto.c ++++ b/net/ceph/crypto.c +@@ -37,9 +37,6 @@ static int set_secret(struct ceph_crypto_key *key, void *buf) + return -ENOTSUPP; + } + +- if (!key->len) +- return -EINVAL; +- + key->key = kmemdup(buf, key->len, GFP_NOIO); + if (!key->key) { + ret = -ENOMEM; +@@ -95,6 +92,11 @@ int ceph_crypto_key_decode(struct ceph_crypto_key *key, void **p, void *end) + ceph_decode_copy(p, &key->created, sizeof(key->created)); + key->len = ceph_decode_16(p); + ceph_decode_need(p, end, key->len, bad); ++ if (key->len > CEPH_MAX_KEY_LEN) { ++ pr_err("secret too big %d\n", key->len); ++ return -EINVAL; ++ } ++ + ret = set_secret(key, *p); + memzero_explicit(*p, key->len); + *p += key->len; +diff --git a/net/ceph/crypto.h b/net/ceph/crypto.h +index 13bd526349fa1..0d32f1649f3d0 100644 +--- a/net/ceph/crypto.h ++++ b/net/ceph/crypto.h +@@ -5,7 +5,7 @@ + #include + #include + +-#define CEPH_KEY_LEN 16 ++#define CEPH_MAX_KEY_LEN 16 + #define CEPH_MAX_CON_SECRET_LEN 64 + + /* +diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c +index 787cde055ab17..4fbd820a53502 100644 +--- a/net/ceph/messenger_v2.c ++++ b/net/ceph/messenger_v2.c +@@ -2171,7 +2171,7 @@ static int process_auth_reply_more(struct ceph_connection *con, + */ + static int process_auth_done(struct ceph_connection *con, void *p, void *end) + { +- u8 session_key_buf[CEPH_KEY_LEN + 16]; ++ u8 session_key_buf[CEPH_MAX_KEY_LEN + 16]; + u8 con_secret_buf[CEPH_MAX_CON_SECRET_LEN + 16]; + u8 *session_key = PTR_ALIGN(&session_key_buf[0], 16); + u8 *con_secret = PTR_ALIGN(&con_secret_buf[0], 16); +-- +2.51.0 + diff --git a/queue-6.1/libperf-build-always-place-libperf-includes-first.patch b/queue-6.1/libperf-build-always-place-libperf-includes-first.patch new file mode 100644 index 00000000000..6b332452164 --- /dev/null +++ b/queue-6.1/libperf-build-always-place-libperf-includes-first.patch @@ -0,0 +1,56 @@ +From 27e71b7c269ba0e9df6a5c6936fd1f79ad361ad0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 22:09:18 -0800 +Subject: libperf build: Always place libperf includes first + +From: Ian Rogers + +[ Upstream commit 8c5b40678c63be6b85f1c2dc8c8b89d632faf988 ] + +When building tools/perf the CFLAGS can contain a directory for the +installed headers. + +As the headers may be being installed while building libperf.a this can +cause headers to be partially installed and found in the include path +while building an object file for libperf.a. + +The installed header may reference other installed headers that are +missing given the partial nature of the install and then the build fails +with a missing header file. + +Avoid this by ensuring the libperf source headers are always first in +the CFLAGS. + +Fixes: 3143504918105156 ("libperf: Make libperf.a part of the perf build") +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/perf/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/perf/Makefile b/tools/lib/perf/Makefile +index b7a17e0bc8758..b6456cd8d569f 100644 +--- a/tools/lib/perf/Makefile ++++ b/tools/lib/perf/Makefile +@@ -63,9 +63,9 @@ INCLUDES = \ + -I$(srctree)/tools/include/uapi + + # Append required CFLAGS ++override CFLAGS := $(INCLUDES) $(CFLAGS) + override CFLAGS += -g -Werror -Wall + override CFLAGS += -fPIC +-override CFLAGS += $(INCLUDES) + override CFLAGS += -fvisibility=hidden + override CFLAGS += $(EXTRA_WARNINGS) + override CFLAGS += $(EXTRA_CFLAGS) +-- +2.51.0 + diff --git a/queue-6.1/libperf-don-t-remove-g-when-extra_cflags-are-used.patch b/queue-6.1/libperf-don-t-remove-g-when-extra_cflags-are-used.patch new file mode 100644 index 00000000000..1dfc9cfb082 --- /dev/null +++ b/queue-6.1/libperf-don-t-remove-g-when-extra_cflags-are-used.patch @@ -0,0 +1,66 @@ +From ec7286355a3a813efb57504dd2f6e41e3f62fed1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Mar 2025 11:40:09 +0000 +Subject: libperf: Don't remove -g when EXTRA_CFLAGS are used + +From: James Clark + +[ Upstream commit f5b07010c13c77541e8ade167d05bef3b8a63739 ] + +When using EXTRA_CFLAGS, for example "EXTRA_CFLAGS=-DREFCNT_CHECKING=1", +this construct stops setting -g which you'd expect would not be affected +by adding extra flags. Additionally, EXTRA_CFLAGS should be the last +thing to be appended so that it can be used to undo any defaults. And no +condition is required, just += appends to any existing CFLAGS and also +appends or doesn't append EXTRA_CFLAGS if they are or aren't set. + +It's not clear why DEBUG=1 is required for -g in Perf when in libperf +it's always on, but I don't think we need to change that behavior now +because someone may be depending on it. + +Signed-off-by: James Clark +Reviewed-by: Ian Rogers +Link: https://lore.kernel.org/r/20250319114009.417865-1-james.clark@linaro.org +Signed-off-by: Namhyung Kim +Stable-dep-of: 8c5b40678c63 ("libperf build: Always place libperf includes first") +Signed-off-by: Sasha Levin +--- + tools/lib/perf/Makefile | 12 +++--------- + 1 file changed, 3 insertions(+), 9 deletions(-) + +diff --git a/tools/lib/perf/Makefile b/tools/lib/perf/Makefile +index 21df023a2103e..b7a17e0bc8758 100644 +--- a/tools/lib/perf/Makefile ++++ b/tools/lib/perf/Makefile +@@ -54,13 +54,6 @@ endif + + TEST_ARGS := $(if $(V),-v) + +-# Set compile option CFLAGS +-ifdef EXTRA_CFLAGS +- CFLAGS := $(EXTRA_CFLAGS) +-else +- CFLAGS := -g -Wall +-endif +- + INCLUDES = \ + -I$(srctree)/tools/lib/perf/include \ + -I$(srctree)/tools/lib/ \ +@@ -70,11 +63,12 @@ INCLUDES = \ + -I$(srctree)/tools/include/uapi + + # Append required CFLAGS +-override CFLAGS += $(EXTRA_WARNINGS) +-override CFLAGS += -Werror -Wall ++override CFLAGS += -g -Werror -Wall + override CFLAGS += -fPIC + override CFLAGS += $(INCLUDES) + override CFLAGS += -fvisibility=hidden ++override CFLAGS += $(EXTRA_WARNINGS) ++override CFLAGS += $(EXTRA_CFLAGS) + + all: + +-- +2.51.0 + diff --git a/queue-6.1/m68k-nommu-fix-memmove-with-differently-aligned-src-.patch b/queue-6.1/m68k-nommu-fix-memmove-with-differently-aligned-src-.patch new file mode 100644 index 00000000000..47c3d9964d4 --- /dev/null +++ b/queue-6.1/m68k-nommu-fix-memmove-with-differently-aligned-src-.patch @@ -0,0 +1,69 @@ +From 407c2731acdc31bb2230f9513be5de0676ccab9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Dec 2025 21:04:01 +0900 +Subject: m68k: nommu: fix memmove() with differently aligned src and dest for + 68000 + +From: Daniel Palmer + +[ Upstream commit 590fe2f46c8698bb758f9002cb247ca10ce95569 ] + +68000 has different alignment needs to 68020+. +memcpy() checks if the destination is aligned and does a smaller copy +to fix the alignment and then critically for 68000 it checks if the +source is still unaligned and if it is reverts to smaller copies. + +memmove() does not currently do the second part and malfunctions if +one of the pointers is aligned and the other isn't. + +This is apparently getting triggered by printk. If I put breakpoints +into the new checks added by this commit the first hit looks like this: + +memmove (n=205, src=0x2f3971 , dest=0x2f3980 ) at arch/m68k/lib/memmove.c:82 + +Signed-off-by: Daniel Palmer +Signed-off-by: Greg Ungerer +Signed-off-by: Sasha Levin +--- + arch/m68k/lib/memmove.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/arch/m68k/lib/memmove.c b/arch/m68k/lib/memmove.c +index 6519f7f349f66..e33f00b02e4c0 100644 +--- a/arch/m68k/lib/memmove.c ++++ b/arch/m68k/lib/memmove.c +@@ -24,6 +24,15 @@ void *memmove(void *dest, const void *src, size_t n) + src = csrc; + n--; + } ++#if defined(CONFIG_M68000) ++ if ((long)src & 1) { ++ char *cdest = dest; ++ const char *csrc = src; ++ for (; n; n--) ++ *cdest++ = *csrc++; ++ return xdest; ++ } ++#endif + if (n > 2 && (long)dest & 2) { + short *sdest = dest; + const short *ssrc = src; +@@ -66,6 +75,15 @@ void *memmove(void *dest, const void *src, size_t n) + src = csrc; + n--; + } ++#if defined(CONFIG_M68000) ++ if ((long)src & 1) { ++ char *cdest = dest; ++ const char *csrc = src; ++ for (; n; n--) ++ *--cdest = *--csrc; ++ return xdest; ++ } ++#endif + if (n > 2 && (long)dest & 2) { + short *sdest = dest; + const short *ssrc = src; +-- +2.51.0 + diff --git a/queue-6.1/mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch b/queue-6.1/mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch new file mode 100644 index 00000000000..952303c7cf2 --- /dev/null +++ b/queue-6.1/mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch @@ -0,0 +1,66 @@ +From 8d0e06a8318e8bc51a3717c08ed59234e10f94c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:24 +0100 +Subject: mailbox: bcm-ferxrm-mailbox: Use default primary handler + +From: Sebastian Andrzej Siewior + +[ Upstream commit 03843d95a4a4e0ba22ad4fcda65ccf21822b104c ] + +request_threaded_irq() is invoked with a primary and a secondary handler +and no flags are passed. The primary handler is the same as +irq_default_primary_handler() so there is no need to have an identical +copy. + +The lack of the IRQF_ONESHOT flag can be dangerous because the interrupt +source is not masked while the threaded handler is active. This means, +especially on LEVEL typed interrupt lines, the interrupt can fire again +before the threaded handler had a chance to run. + +Use the default primary interrupt handler by specifying NULL and set +IRQF_ONESHOT so the interrupt source is masked until the secondary handler +is done. + +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Thomas Gleixner +Link: https://patch.msgid.link/20260128095540.863589-5-bigeasy@linutronix.de +Signed-off-by: Sasha Levin +--- + drivers/mailbox/bcm-flexrm-mailbox.c | 14 ++------------ + 1 file changed, 2 insertions(+), 12 deletions(-) + +diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c +index bf6e86b0ed09c..d58c0ece437d0 100644 +--- a/drivers/mailbox/bcm-flexrm-mailbox.c ++++ b/drivers/mailbox/bcm-flexrm-mailbox.c +@@ -1173,14 +1173,6 @@ static int flexrm_debugfs_stats_show(struct seq_file *file, void *offset) + + /* ====== FlexRM interrupt handler ===== */ + +-static irqreturn_t flexrm_irq_event(int irq, void *dev_id) +-{ +- /* We only have MSI for completions so just wakeup IRQ thread */ +- /* Ring related errors will be informed via completion descriptors */ +- +- return IRQ_WAKE_THREAD; +-} +- + static irqreturn_t flexrm_irq_thread(int irq, void *dev_id) + { + flexrm_process_completions(dev_id); +@@ -1271,10 +1263,8 @@ static int flexrm_startup(struct mbox_chan *chan) + ret = -ENODEV; + goto fail_free_cmpl_memory; + } +- ret = request_threaded_irq(ring->irq, +- flexrm_irq_event, +- flexrm_irq_thread, +- 0, dev_name(ring->mbox->dev), ring); ++ ret = request_threaded_irq(ring->irq, NULL, flexrm_irq_thread, ++ IRQF_ONESHOT, dev_name(ring->mbox->dev), ring); + if (ret) { + dev_err(ring->mbox->dev, + "failed to request ring%d IRQ\n", ring->num); +-- +2.51.0 + diff --git a/queue-6.1/mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch b/queue-6.1/mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch new file mode 100644 index 00000000000..97bb065cd98 --- /dev/null +++ b/queue-6.1/mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch @@ -0,0 +1,77 @@ +From 5ade5b7f8c084298149ce5e0b673835172445a8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 16:00:54 +0800 +Subject: mailbox: imx: Skip the suspend flag for i.MX7ULP + +From: Jacky Bai + +[ Upstream commit 673b570825ace0dcb2ac0c676080559d505c6f40 ] + +In current imx-mailbox driver, the MU IRQ is configured with +'IRQF_NO_SUSPEND' flag set. So during linux suspend/resume flow, +the MU IRQ is always enabled. With commit 892cb524ae8a ("mailbox: imx: +fix wakeup failure from freeze mode"), if the MU IRQ is triggered after +the priv->suspended flag has been set, the system suspend will be +aborted. + +On i.MX7ULP platform, certain drivers that depend on rpmsg may need +to send rpmsg request and receive an acknowledgment from the remote +core during the late_suspend stage. Early suspend abort is not +expected, and the i.MX7ULP already has additional hardware and +software to make sure the system can be wakeup from freeze mode +correctly when MU IRQ is trigger. + +Skip the 'suspend' flag handling logic on i.MX7ULP to avoid the +early abort when doing suspend. + +Signed-off-by: Jacky Bai +Reviewed-by: Peng Fan +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/imx-mailbox.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/mailbox/imx-mailbox.c b/drivers/mailbox/imx-mailbox.c +index 20f2ec880ad69..3292fb2dc3bf2 100644 +--- a/drivers/mailbox/imx-mailbox.c ++++ b/drivers/mailbox/imx-mailbox.c +@@ -112,6 +112,7 @@ struct imx_mu_dcfg { + u32 xRR; /* Receive Register0 */ + u32 xSR[IMX_MU_xSR_MAX]; /* Status Registers */ + u32 xCR[IMX_MU_xCR_MAX]; /* Control Registers */ ++ bool skip_suspend_flag; + }; + + #define IMX_MU_xSR_GIPn(type, x) (type & IMX_MU_V2 ? BIT(x) : BIT(28 + (3 - (x)))) +@@ -905,6 +906,7 @@ static const struct imx_mu_dcfg imx_mu_cfg_imx7ulp = { + .xRR = 0x40, + .xSR = {0x60, 0x60, 0x60, 0x60}, + .xCR = {0x64, 0x64, 0x64, 0x64, 0x64}, ++ .skip_suspend_flag = true, + }; + + static const struct imx_mu_dcfg imx_mu_cfg_imx8ulp = { +@@ -985,7 +987,8 @@ static int __maybe_unused imx_mu_suspend_noirq(struct device *dev) + priv->xcr[i] = imx_mu_read(priv, priv->dcfg->xCR[i]); + } + +- priv->suspend = true; ++ if (!priv->dcfg->skip_suspend_flag) ++ priv->suspend = true; + + return 0; + } +@@ -1008,7 +1011,8 @@ static int __maybe_unused imx_mu_resume_noirq(struct device *dev) + imx_mu_write(priv, priv->xcr[i], priv->dcfg->xCR[i]); + } + +- priv->suspend = false; ++ if (!priv->dcfg->skip_suspend_flag) ++ priv->suspend = false; + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.1/mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch b/queue-6.1/mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch new file mode 100644 index 00000000000..ae6328758ed --- /dev/null +++ b/queue-6.1/mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch @@ -0,0 +1,41 @@ +From 127aaa522a082cdbb7878e3659ba86bffc81bc89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jan 2026 14:07:40 +0000 +Subject: mailbox: pcc: Remove spurious IRQF_ONESHOT usage + +From: Mark Brown + +[ Upstream commit 673327028cd61db68a1e0c708be2e302c082adf9 ] + +The PCC code currently specifies IRQF_ONESHOT if the interrupt could +potentially be shared but doesn't actually use request_threaded_irq() and +the interrupt handler does not use IRQ_WAKE_THREAD so IRQF_ONESHOT is +never relevant. Since commit aef30c8d569c ("genirq: Warn about using +IRQF_ONESHOT without a threaded handler") specifying it has resulted in a +WARN_ON(), fix this by removing IRQF_ONESHOT. + +Reported-by: Aishwarya TCV +Signed-off-by: Mark Brown +Reviewed-by: Sudeep Holla +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/pcc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c +index 0729988467554..be295313119cb 100644 +--- a/drivers/mailbox/pcc.c ++++ b/drivers/mailbox/pcc.c +@@ -470,7 +470,7 @@ static int pcc_startup(struct mbox_chan *chan) + + if (pchan->plat_irq > 0) { + irqflags = pcc_chan_plat_irq_can_be_shared(pchan) ? +- IRQF_SHARED | IRQF_ONESHOT : 0; ++ IRQF_SHARED : 0; + rc = devm_request_irq(chan->mbox->dev, pchan->plat_irq, pcc_mbox_irq, + irqflags, MBOX_IRQ_NAME, chan); + if (unlikely(rc)) { +-- +2.51.0 + diff --git a/queue-6.1/mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch b/queue-6.1/mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch new file mode 100644 index 00000000000..a2ea1a2a1bb --- /dev/null +++ b/queue-6.1/mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch @@ -0,0 +1,57 @@ +From b15669257e510db7929b466998d5a7f4662f8425 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 16:43:36 +0100 +Subject: mailbox: sprd: clear delivery flag before handling TX done +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Otto Pflüger + +[ Upstream commit c77661d60d4223bf2ff10d409beb0c3b2021183b ] + +If there are any pending messages in the mailbox queue, they are sent +as soon as a TX done event arrives from the driver. This may trigger a +new delivery interrupt while the previous one is still being handled. +If the delivery status is cleared after this, the interrupt is lost. +To prevent this from happening, clear the delivery status immediately +after checking it and before any new messages are sent. + +Signed-off-by: Otto Pflüger +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/sprd-mailbox.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c +index 0dc609592c46a..2a43fb375bcb9 100644 +--- a/drivers/mailbox/sprd-mailbox.c ++++ b/drivers/mailbox/sprd-mailbox.c +@@ -167,6 +167,11 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data) + return IRQ_NONE; + } + ++ /* Clear FIFO delivery and overflow status first */ ++ writel(fifo_sts & ++ (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK), ++ priv->inbox_base + SPRD_MBOX_FIFO_RST); ++ + while (send_sts) { + id = __ffs(send_sts); + send_sts &= (send_sts - 1); +@@ -182,11 +187,6 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data) + mbox_chan_txdone(chan, 0); + } + +- /* Clear FIFO delivery and overflow status */ +- writel(fifo_sts & +- (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK), +- priv->inbox_base + SPRD_MBOX_FIFO_RST); +- + /* Clear irq status */ + writel(SPRD_MBOX_IRQ_CLR, priv->inbox_base + SPRD_MBOX_IRQ_STS); + +-- +2.51.0 + diff --git a/queue-6.1/mailbox-sprd-mask-interrupts-that-are-not-handled.patch b/queue-6.1/mailbox-sprd-mask-interrupts-that-are-not-handled.patch new file mode 100644 index 00000000000..699aaec81cc --- /dev/null +++ b/queue-6.1/mailbox-sprd-mask-interrupts-that-are-not-handled.patch @@ -0,0 +1,55 @@ +From a34f5fb4da3b695605f5bad895aec521d2c22429 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 16:43:38 +0100 +Subject: mailbox: sprd: mask interrupts that are not handled +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Otto Pflüger + +[ Upstream commit 75df94d05fc03fd9d861eaf79ce10fbb7a548bd8 ] + +To reduce the amount of spurious interrupts, disable the interrupts that +are not handled in this driver. + +Signed-off-by: Otto Pflüger +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/sprd-mailbox.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c +index e3c899abeed8b..0dc609592c46a 100644 +--- a/drivers/mailbox/sprd-mailbox.c ++++ b/drivers/mailbox/sprd-mailbox.c +@@ -244,21 +244,19 @@ static int sprd_mbox_startup(struct mbox_chan *chan) + /* Select outbox FIFO mode and reset the outbox FIFO status */ + writel(0x0, priv->outbox_base + SPRD_MBOX_FIFO_RST); + +- /* Enable inbox FIFO overflow and delivery interrupt */ +- val = readl(priv->inbox_base + SPRD_MBOX_IRQ_MSK); +- val &= ~(SPRD_INBOX_FIFO_OVERFLOW_IRQ | SPRD_INBOX_FIFO_DELIVER_IRQ); ++ /* Enable inbox FIFO delivery interrupt */ ++ val = SPRD_INBOX_FIFO_IRQ_MASK; ++ val &= ~SPRD_INBOX_FIFO_DELIVER_IRQ; + writel(val, priv->inbox_base + SPRD_MBOX_IRQ_MSK); + + /* Enable outbox FIFO not empty interrupt */ +- val = readl(priv->outbox_base + SPRD_MBOX_IRQ_MSK); ++ val = SPRD_OUTBOX_FIFO_IRQ_MASK; + val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ; + writel(val, priv->outbox_base + SPRD_MBOX_IRQ_MSK); + + /* Enable supplementary outbox as the fundamental one */ + if (priv->supp_base) { + writel(0x0, priv->supp_base + SPRD_MBOX_FIFO_RST); +- val = readl(priv->supp_base + SPRD_MBOX_IRQ_MSK); +- val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ; + writel(val, priv->supp_base + SPRD_MBOX_IRQ_MSK); + } + } +-- +2.51.0 + diff --git a/queue-6.1/media-adv7180-fix-frame-interval-in-progressive-mode.patch b/queue-6.1/media-adv7180-fix-frame-interval-in-progressive-mode.patch new file mode 100644 index 00000000000..b0ffd3d08b0 --- /dev/null +++ b/queue-6.1/media-adv7180-fix-frame-interval-in-progressive-mode.patch @@ -0,0 +1,49 @@ +From c885a85ac6fe95abc757172f4a81e1152b75faa0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 15:29:57 +0100 +Subject: media: adv7180: fix frame interval in progressive mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thorsten Schmelzer + +[ Upstream commit 90289b67c5c1d4c18784059b27460d292e16d208 ] + +The ADV7280-M may internally convert interlaced video input to +progressive video. If this mode is enabled, the ADV7280-M delivers +progressive video frames at the field rate of 50 fields per second (PAL) +or 60 fields per second (NTSC). + +Fix the reported frame interval if progressive video is enabled. + +Signed-off-by: Thorsten Schmelzer +Reviewed-by: Niklas Söderlund +Signed-off-by: Michael Tretter +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/adv7180.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c +index 5d10edcfcc3b5..b34e1a7bd2c45 100644 +--- a/drivers/media/i2c/adv7180.c ++++ b/drivers/media/i2c/adv7180.c +@@ -471,6 +471,13 @@ static int adv7180_g_frame_interval(struct v4l2_subdev *sd, + fi->interval.denominator = 25; + } + ++ /* ++ * If the de-interlacer is active, the chip produces full video frames ++ * at the field rate. ++ */ ++ if (state->field == V4L2_FIELD_NONE) ++ fi->interval.denominator *= 2; ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.1/media-amphion-clear-last_buffer_dequeued-flag-for-de.patch b/queue-6.1/media-amphion-clear-last_buffer_dequeued-flag-for-de.patch new file mode 100644 index 00000000000..ad87ff14725 --- /dev/null +++ b/queue-6.1/media-amphion-clear-last_buffer_dequeued-flag-for-de.patch @@ -0,0 +1,38 @@ +From 116ecc72f5e93318bc4ac94ae8718b8b0cef87db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Dec 2025 11:02:22 +0800 +Subject: media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START + +From: Ming Qian + +[ Upstream commit d85f3207d75df6d7a08be6526b15ff398668206c ] + +The V4L2_DEC_CMD_START command may be used to handle the dynamic source +change, which will triggers an implicit decoder drain. +The last_buffer_dequeued flag is set in the implicit decoder drain, +so driver need to clear it to continue the following decoding flow. + +Signed-off-by: Ming Qian +Reviewed-by: Nicolas Dufresne +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/amphion/vdec.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/platform/amphion/vdec.c b/drivers/media/platform/amphion/vdec.c +index 2bfab4467b81c..ac71eae9ef10a 100644 +--- a/drivers/media/platform/amphion/vdec.c ++++ b/drivers/media/platform/amphion/vdec.c +@@ -578,6 +578,7 @@ static int vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd + switch (cmd->cmd) { + case V4L2_DEC_CMD_START: + vdec_cmd_start(inst); ++ vb2_clear_last_buffer_dequeued(v4l2_m2m_get_dst_vq(inst->fh.m2m_ctx)); + break; + case V4L2_DEC_CMD_STOP: + vdec_cmd_stop(inst); +-- +2.51.0 + diff --git a/queue-6.1/media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch b/queue-6.1/media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch new file mode 100644 index 00000000000..83f54441a5b --- /dev/null +++ b/queue-6.1/media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch @@ -0,0 +1,34 @@ +From 31d9ccf34a734e24512b19d749c3502fdf97edab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Jan 2026 15:46:47 +0800 +Subject: media: cx25821: Fix a resource leak in cx25821_dev_setup() + +From: Haoxiang Li + +[ Upstream commit 68cd8ac994cac38a305200f638b30e13c690753b ] + +Add release_mem_region() if ioremap() fails to release the memory +region obtained by cx25821_get_resources(). + +Signed-off-by: Haoxiang Li +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/cx25821/cx25821-core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c +index 6627fa9166d30..a7336be444748 100644 +--- a/drivers/media/pci/cx25821/cx25821-core.c ++++ b/drivers/media/pci/cx25821/cx25821-core.c +@@ -908,6 +908,7 @@ static int cx25821_dev_setup(struct cx25821_dev *dev) + + if (!dev->lmmio) { + CX25821_ERR("ioremap failed, maybe increasing __VMALLOC_RESERVE in page.h\n"); ++ release_mem_region(dev->base_io_addr, pci_resource_len(dev->pci, 0)); + cx25821_iounmap(dev); + return -ENOMEM; + } +-- +2.51.0 + diff --git a/queue-6.1/media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch b/queue-6.1/media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch new file mode 100644 index 00000000000..5a665962e56 --- /dev/null +++ b/queue-6.1/media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch @@ -0,0 +1,110 @@ +From 4df61dd4aa94b95c6ac108bb13683c3c65fecf3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Jun 2025 08:57:35 +0200 +Subject: media: dvb-core: dmxdevfilter must always flush bufs + +From: Hans Verkuil + +[ Upstream commit c4e620eccbef76aa5564ebb295e23d6540e27215 ] + +Currently the buffers are being filled until full, which works fine +for the transport stream, but not when reading sections, those have +to be returned to userspace immediately, otherwise dvbv5-scan will +just wait forever. + +Add a 'flush' argument to dvb_vb2_fill_buffer to indicate whether +the buffer must be flushed or wait until it is full. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-core/dmxdev.c | 8 ++++---- + drivers/media/dvb-core/dvb_vb2.c | 5 +++-- + include/media/dvb_vb2.h | 6 ++++-- + 3 files changed, 11 insertions(+), 8 deletions(-) + +diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c +index 9ce5f010de3f8..804fb339f7355 100644 +--- a/drivers/media/dvb-core/dmxdev.c ++++ b/drivers/media/dvb-core/dmxdev.c +@@ -396,11 +396,11 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len, + if (dvb_vb2_is_streaming(&dmxdevfilter->vb2_ctx)) { + ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx, + buffer1, buffer1_len, +- buffer_flags); ++ buffer_flags, true); + if (ret == buffer1_len) + ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx, + buffer2, buffer2_len, +- buffer_flags); ++ buffer_flags, true); + } else { + ret = dvb_dmxdev_buffer_write(&dmxdevfilter->buffer, + buffer1, buffer1_len); +@@ -451,10 +451,10 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len, + + if (dvb_vb2_is_streaming(ctx)) { + ret = dvb_vb2_fill_buffer(ctx, buffer1, buffer1_len, +- buffer_flags); ++ buffer_flags, false); + if (ret == buffer1_len) + ret = dvb_vb2_fill_buffer(ctx, buffer2, buffer2_len, +- buffer_flags); ++ buffer_flags, false); + } else { + if (buffer->error) { + spin_unlock(&dmxdevfilter->dev->lock); +diff --git a/drivers/media/dvb-core/dvb_vb2.c b/drivers/media/dvb-core/dvb_vb2.c +index 909df82fed332..8950e608a87a4 100644 +--- a/drivers/media/dvb-core/dvb_vb2.c ++++ b/drivers/media/dvb-core/dvb_vb2.c +@@ -252,7 +252,8 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx) + + int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx, + const unsigned char *src, int len, +- enum dmx_buffer_flags *buffer_flags) ++ enum dmx_buffer_flags *buffer_flags, ++ bool flush) + { + unsigned long flags = 0; + void *vbuf = NULL; +@@ -309,7 +310,7 @@ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx, + } + } + +- if (ctx->nonblocking && ctx->buf) { ++ if (flush && ctx->buf) { + vb2_set_plane_payload(&ctx->buf->vb, 0, ll); + vb2_buffer_done(&ctx->buf->vb, VB2_BUF_STATE_DONE); + list_del(&ctx->buf->list); +diff --git a/include/media/dvb_vb2.h b/include/media/dvb_vb2.h +index 8cb88452cd6c2..0fbbfc65157e6 100644 +--- a/include/media/dvb_vb2.h ++++ b/include/media/dvb_vb2.h +@@ -124,7 +124,7 @@ static inline int dvb_vb2_release(struct dvb_vb2_ctx *ctx) + return 0; + }; + #define dvb_vb2_is_streaming(ctx) (0) +-#define dvb_vb2_fill_buffer(ctx, file, wait, flags) (0) ++#define dvb_vb2_fill_buffer(ctx, file, wait, flags, flush) (0) + + static inline __poll_t dvb_vb2_poll(struct dvb_vb2_ctx *ctx, + struct file *file, +@@ -166,10 +166,12 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx); + * @buffer_flags: + * pointer to buffer flags as defined by &enum dmx_buffer_flags. + * can be NULL. ++ * @flush: flush the buffer, even if it isn't full. + */ + int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx, + const unsigned char *src, int len, +- enum dmx_buffer_flags *buffer_flags); ++ enum dmx_buffer_flags *buffer_flags, ++ bool flush); + + /** + * dvb_vb2_poll - Wrapper to vb2_core_streamon() for Digital TV +-- +2.51.0 + diff --git a/queue-6.1/media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch b/queue-6.1/media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch new file mode 100644 index 00000000000..b9a813a1229 --- /dev/null +++ b/queue-6.1/media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch @@ -0,0 +1,53 @@ +From 50b41c93c4892d5d66d939a180fd48ae37a70623 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Oct 2025 15:26:40 +0200 +Subject: media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes + +From: Hans Verkuil + +[ Upstream commit 44c03802a5191626996ee9db4bac090b164ca340 ] + +The isp_video_mbus_to_pix/pix_to_mbus functions did not take +the last empty entry { 0, } of the formats array into account. + +As a result, isp_video_mbus_to_pix would accept code 0 and +isp_video_pix_to_mbus would select code 0 if no match was found. + +Signed-off-by: Hans Verkuil +Acked-by: Sakari Ailus +Signed-off-by: Sasha Levin +--- + drivers/media/platform/ti/omap3isp/ispvideo.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/ti/omap3isp/ispvideo.c b/drivers/media/platform/ti/omap3isp/ispvideo.c +index 3e5348c63773a..7094379a705fa 100644 +--- a/drivers/media/platform/ti/omap3isp/ispvideo.c ++++ b/drivers/media/platform/ti/omap3isp/ispvideo.c +@@ -148,12 +148,12 @@ static unsigned int isp_video_mbus_to_pix(const struct isp_video *video, + pix->width = mbus->width; + pix->height = mbus->height; + +- for (i = 0; i < ARRAY_SIZE(formats); ++i) { ++ for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) { + if (formats[i].code == mbus->code) + break; + } + +- if (WARN_ON(i == ARRAY_SIZE(formats))) ++ if (WARN_ON(i == ARRAY_SIZE(formats) - 1)) + return 0; + + min_bpl = pix->width * formats[i].bpp; +@@ -191,7 +191,7 @@ static void isp_video_pix_to_mbus(const struct v4l2_pix_format *pix, + /* Skip the last format in the loop so that it will be selected if no + * match is found. + */ +- for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) { ++ for (i = 0; i < ARRAY_SIZE(formats) - 2; ++i) { + if (formats[i].pixelformat == pix->pixelformat) + break; + } +-- +2.51.0 + diff --git a/queue-6.1/media-omap3isp-isppreview-always-clamp-in-preview_tr.patch b/queue-6.1/media-omap3isp-isppreview-always-clamp-in-preview_tr.patch new file mode 100644 index 00000000000..3150135de4f --- /dev/null +++ b/queue-6.1/media-omap3isp-isppreview-always-clamp-in-preview_tr.patch @@ -0,0 +1,63 @@ +From 1b0e943a69379cd7beec13bcb10bcc35b28fc73c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 17:09:18 +0200 +Subject: media: omap3isp: isppreview: always clamp in preview_try_format() + +From: Hans Verkuil + +[ Upstream commit 17e1e1641f74a89824d4de3aa38c78daa5686cc1 ] + +If prev->input != PREVIEW_INPUT_MEMORY the width and height weren't +clamped. Just always clamp. + +This fixes a v4l2-compliance error: + + fail: v4l2-test-subdevs.cpp(171): fse.max_width == ~0U || fse.max_height == ~0U + fail: v4l2-test-subdevs.cpp(270): ret && ret != ENOTTY +test Try VIDIOC_SUBDEV_ENUM_MBUS_CODE/FRAME_SIZE/FRAME_INTERVAL: FAIL + +Signed-off-by: Hans Verkuil +Acked-by: Sakari Ailus +Signed-off-by: Sasha Levin +--- + .../media/platform/ti/omap3isp/isppreview.c | 21 +++++++------------ + 1 file changed, 8 insertions(+), 13 deletions(-) + +diff --git a/drivers/media/platform/ti/omap3isp/isppreview.c b/drivers/media/platform/ti/omap3isp/isppreview.c +index 53aedec7990da..32e4348e6837a 100644 +--- a/drivers/media/platform/ti/omap3isp/isppreview.c ++++ b/drivers/media/platform/ti/omap3isp/isppreview.c +@@ -1744,22 +1744,17 @@ static void preview_try_format(struct isp_prev_device *prev, + + switch (pad) { + case PREV_PAD_SINK: +- /* When reading data from the CCDC, the input size has already +- * been mangled by the CCDC output pad so it can be accepted +- * as-is. +- * +- * When reading data from memory, clamp the requested width and +- * height. The TRM doesn't specify a minimum input height, make ++ /* ++ * Clamp the requested width and height. ++ * The TRM doesn't specify a minimum input height, make + * sure we got enough lines to enable the noise filter and color + * filter array interpolation. + */ +- if (prev->input == PREVIEW_INPUT_MEMORY) { +- fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH, +- preview_max_out_width(prev)); +- fmt->height = clamp_t(u32, fmt->height, +- PREV_MIN_IN_HEIGHT, +- PREV_MAX_IN_HEIGHT); +- } ++ fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH, ++ preview_max_out_width(prev)); ++ fmt->height = clamp_t(u32, fmt->height, ++ PREV_MIN_IN_HEIGHT, ++ PREV_MAX_IN_HEIGHT); + + fmt->colorspace = V4L2_COLORSPACE_SRGB; + +-- +2.51.0 + diff --git a/queue-6.1/media-omap3isp-set-initial-format.patch b/queue-6.1/media-omap3isp-set-initial-format.patch new file mode 100644 index 00000000000..9473cfdac16 --- /dev/null +++ b/queue-6.1/media-omap3isp-set-initial-format.patch @@ -0,0 +1,51 @@ +From 0dd33582765558fe8682650bb74d389ee646a717 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Apr 2025 09:21:53 +0200 +Subject: media: omap3isp: set initial format + +From: Hans Verkuil + +[ Upstream commit 7575b8dfa91f82fcb34ffd5568ff415ac4685794 ] + +Initialize the v4l2_format to a default. Empty formats are +not allowed in V4L2, so this fixes v4l2-compliance issues: + + fail: v4l2-test-formats.cpp(514): !pix.width || !pix.height +test VIDIOC_G_FMT: FAIL + +Signed-off-by: Hans Verkuil +Acked-by: Sakari Ailus +Signed-off-by: Sasha Levin +--- + drivers/media/platform/ti/omap3isp/ispvideo.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/media/platform/ti/omap3isp/ispvideo.c b/drivers/media/platform/ti/omap3isp/ispvideo.c +index 7094379a705fa..c0c7a743d8813 100644 +--- a/drivers/media/platform/ti/omap3isp/ispvideo.c ++++ b/drivers/media/platform/ti/omap3isp/ispvideo.c +@@ -1292,6 +1292,7 @@ static const struct v4l2_ioctl_ops isp_video_ioctl_ops = { + static int isp_video_open(struct file *file) + { + struct isp_video *video = video_drvdata(file); ++ struct v4l2_mbus_framefmt fmt; + struct isp_video_fh *handle; + struct vb2_queue *queue; + int ret = 0; +@@ -1333,6 +1334,13 @@ static int isp_video_open(struct file *file) + + memset(&handle->format, 0, sizeof(handle->format)); + handle->format.type = video->type; ++ handle->format.fmt.pix.width = 720; ++ handle->format.fmt.pix.height = 480; ++ handle->format.fmt.pix.pixelformat = V4L2_PIX_FMT_UYVY; ++ handle->format.fmt.pix.field = V4L2_FIELD_NONE; ++ handle->format.fmt.pix.colorspace = V4L2_COLORSPACE_SRGB; ++ isp_video_pix_to_mbus(&handle->format.fmt.pix, &fmt); ++ isp_video_mbus_to_pix(video, &fmt, &handle->format.fmt.pix); + handle->timeperframe.denominator = 1; + + handle->video = video; +-- +2.51.0 + diff --git a/queue-6.1/media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch b/queue-6.1/media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch new file mode 100644 index 00000000000..272e6f53b28 --- /dev/null +++ b/queue-6.1/media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch @@ -0,0 +1,48 @@ +From f2c077d939a73f52975009ae5e64cb484d279d35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Dec 2025 19:24:19 +0100 +Subject: media: pvrusb2: fix URB leak in pvr2_send_request_ex + +From: Szymon Wilczek + +[ Upstream commit a8333c8262aed2aedf608c18edd39cf5342680a7 ] + +When pvr2_send_request_ex() submits a write URB successfully but fails to +submit the read URB (e.g. returns -ENOMEM), it returns immediately without +waiting for the write URB to complete. Since the driver reuses the same +URB structure, a subsequent call to pvr2_send_request_ex() attempts to +submit the still-active write URB, triggering a 'URB submitted while +active' warning in usb_submit_urb(). + +Fix this by ensuring the write URB is unlinked and waited upon if the read +URB submission fails. + +Reported-by: syzbot+405dcd13121ff75a9e16@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=405dcd13121ff75a9e16 +Signed-off-by: Szymon Wilczek +Acked-by: Mike Isely +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +index 9bec1435f357e..9acc0c8eb1194 100644 +--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c ++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +@@ -3707,6 +3707,11 @@ status); + "Failed to submit read-control URB status=%d", + status); + hdw->ctl_read_pend_flag = 0; ++ if (hdw->ctl_write_pend_flag) { ++ usb_unlink_urb(hdw->ctl_write_urb); ++ while (hdw->ctl_write_pend_flag) ++ wait_for_completion(&hdw->ctl_done); ++ } + goto done; + } + } +-- +2.51.0 + diff --git a/queue-6.1/media-rkisp1-fix-filter-mode-register-configuration.patch b/queue-6.1/media-rkisp1-fix-filter-mode-register-configuration.patch new file mode 100644 index 00000000000..90896ffe2aa --- /dev/null +++ b/queue-6.1/media-rkisp1-fix-filter-mode-register-configuration.patch @@ -0,0 +1,53 @@ +From 3de7cf7ef0e84327586dad88680fbcc7479d9f1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 12:11:42 -0500 +Subject: media: rkisp1: Fix filter mode register configuration + +From: Rui Wang + +[ Upstream commit 5a50f2b61104d0d351b59ec179f67abab7870453 ] + +The rkisp1_flt_config() function performs an initial direct write to +RKISP1_CIF_ISP_FILT_MODE without including the RKISP1_CIF_ISP_FLT_ENA +bit, which clears the filter enable bit in the hardware. + +The subsequent read/modify/write sequence then reads back the register +with the enable bit already cleared and cannot restore it, resulting in +the filter being inadvertently disabled. + +Remove the redundant direct write. The read/modify/write sequence alone +correctly preserves the existing enable bit state while updating the +DNR mode and filter configuration bits. + +Signed-off-by: Rui Wang +Reviewed-by: Stefan Klug +Reviewed-by: Kieran Bingham +Reviewed-by: Laurent Pinchart +Link: https://patch.msgid.link/20260105171142.147792-2-rui.wang@ideasonboard.com +Signed-off-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rockchip/rkisp1/rkisp1-params.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c +index d8731ebbf479e..0e670aa70de89 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c +@@ -385,12 +385,6 @@ static void rkisp1_flt_config(struct rkisp1_params *params, + rkisp1_write(params->rkisp1, RKISP1_CIF_ISP_FILT_LUM_WEIGHT, + arg->lum_weight); + +- rkisp1_write(params->rkisp1, RKISP1_CIF_ISP_FILT_MODE, +- (arg->mode ? RKISP1_CIF_ISP_FLT_MODE_DNR : 0) | +- RKISP1_CIF_ISP_FLT_CHROMA_V_MODE(arg->chr_v_mode) | +- RKISP1_CIF_ISP_FLT_CHROMA_H_MODE(arg->chr_h_mode) | +- RKISP1_CIF_ISP_FLT_GREEN_STAGE1(arg->grn_stage1)); +- + /* avoid to override the old enable value */ + filt_mode = rkisp1_read(params->rkisp1, RKISP1_CIF_ISP_FILT_MODE); + filt_mode &= RKISP1_CIF_ISP_FLT_ENA; +-- +2.51.0 + diff --git a/queue-6.1/media-solo6x10-check-for-out-of-bounds-chip_id.patch b/queue-6.1/media-solo6x10-check-for-out-of-bounds-chip_id.patch new file mode 100644 index 00000000000..c80cc9a2f7a --- /dev/null +++ b/queue-6.1/media-solo6x10-check-for-out-of-bounds-chip_id.patch @@ -0,0 +1,68 @@ +From b648c28e14f866a66b8e3938909036c7c83f891e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 19:00:35 -0800 +Subject: media: solo6x10: Check for out of bounds chip_id + +From: Kees Cook + +[ Upstream commit 0fdf6323c35a134f206dcad5babb4ff488552076 ] + +Clang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type +(literal "1" is an "int") could end up being shifted beyond 32 bits, +so instrumentation was added (and due to the double is_tw286x() call +seen via inlining), Clang decides the second one must now be undefined +behavior and elides the rest of the function[1]. This is a known problem +with Clang (that is still being worked on), but we can avoid the entire +problem by actually checking the existing max chip ID, and now there is +no runtime instrumentation added at all since everything is known to be +within bounds. + +Additionally use an unsigned value for the shift to remove the +instrumentation even without the explicit bounds checking. + +Link: https://github.com/ClangBuiltLinux/linux/issues/2144 [1] +Suggested-by: Nathan Chancellor +Signed-off-by: Kees Cook +Signed-off-by: Hans Verkuil +[hverkuil: fix checkpatch warning for is_tw286x] +Signed-off-by: Sasha Levin +--- + drivers/media/pci/solo6x10/solo6x10-tw28.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/pci/solo6x10/solo6x10-tw28.c b/drivers/media/pci/solo6x10/solo6x10-tw28.c +index 1b7c22a9bc94f..8f53946c67928 100644 +--- a/drivers/media/pci/solo6x10/solo6x10-tw28.c ++++ b/drivers/media/pci/solo6x10/solo6x10-tw28.c +@@ -166,7 +166,7 @@ static const u8 tbl_tw2865_pal_template[] = { + 0x64, 0x51, 0x40, 0xaf, 0xFF, 0xF0, 0x00, 0xC0, + }; + +-#define is_tw286x(__solo, __id) (!(__solo->tw2815 & (1 << __id))) ++#define is_tw286x(__solo, __id) (!((__solo)->tw2815 & (1U << (__id)))) + + static u8 tw_readbyte(struct solo_dev *solo_dev, int chip_id, u8 tw6x_off, + u8 tw_off) +@@ -686,6 +686,9 @@ int tw28_set_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch, + chip_num = ch / 4; + ch %= 4; + ++ if (chip_num >= TW_NUM_CHIP) ++ return -EINVAL; ++ + if (val > 255 || val < 0) + return -ERANGE; + +@@ -758,6 +761,9 @@ int tw28_get_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch, + chip_num = ch / 4; + ch %= 4; + ++ if (chip_num >= TW_NUM_CHIP) ++ return -EINVAL; ++ + switch (ctrl) { + case V4L2_CID_SHARPNESS: + /* Only 286x has sharpness */ +-- +2.51.0 + diff --git a/queue-6.1/minix-add-required-sanity-checking-to-minix_check_su.patch b/queue-6.1/minix-add-required-sanity-checking-to-minix_check_su.patch new file mode 100644 index 00000000000..a43b31f5c1e --- /dev/null +++ b/queue-6.1/minix-add-required-sanity-checking-to-minix_check_su.patch @@ -0,0 +1,103 @@ +From 1137e5746a6836e4f8b2404c01df0e62690ebc76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 16:39:47 +0100 +Subject: minix: Add required sanity checking to minix_check_superblock() + +From: Jori Koolstra + +[ Upstream commit 8c97a6ddc95690a938ded44b4e3202f03f15078c ] + +The fs/minix implementation of the minix filesystem does not currently +support any other value for s_log_zone_size than 0. This is also the +only value supported in util-linux; see mkfs.minix.c line 511. In +addition, this patch adds some sanity checking for the other minix +superblock fields, and moves the minix_blocks_needed() checks for the +zmap and imap also to minix_check_super_block(). + +This also closes a related syzbot bug report. + +Signed-off-by: Jori Koolstra +Link: https://patch.msgid.link/20251208153947.108343-1-jkoolstra@xs4all.nl +Reviewed-by: Jan Kara +Reported-by: syzbot+5ad0824204c7bf9b67f2@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=5ad0824204c7bf9b67f2 +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/minix/inode.c | 50 ++++++++++++++++++++++++++++-------------------- + 1 file changed, 29 insertions(+), 21 deletions(-) + +diff --git a/fs/minix/inode.c b/fs/minix/inode.c +index 9da6903e306c6..fbbc4ef1b7a2e 100644 +--- a/fs/minix/inode.c ++++ b/fs/minix/inode.c +@@ -153,10 +153,38 @@ static int minix_remount (struct super_block * sb, int * flags, char * data) + static bool minix_check_superblock(struct super_block *sb) + { + struct minix_sb_info *sbi = minix_sb(sb); ++ unsigned long block; + +- if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0) ++ if (sbi->s_log_zone_size != 0) { ++ printk("minix-fs error: zone size must equal block size. " ++ "s_log_zone_size > 0 is not supported.\n"); ++ return false; ++ } ++ ++ if (sbi->s_ninodes < 1 || sbi->s_firstdatazone <= 4 || ++ sbi->s_firstdatazone >= sbi->s_nzones) + return false; + ++ /* Apparently minix can create filesystems that allocate more blocks for ++ * the bitmaps than needed. We simply ignore that, but verify it didn't ++ * create one with not enough blocks and bail out if so. ++ */ ++ block = minix_blocks_needed(sbi->s_ninodes, sb->s_blocksize); ++ if (sbi->s_imap_blocks < block) { ++ printk("MINIX-fs: file system does not have enough " ++ "imap blocks allocated. Refusing to mount.\n"); ++ return false; ++ } ++ ++ block = minix_blocks_needed( ++ (sbi->s_nzones - sbi->s_firstdatazone + 1), ++ sb->s_blocksize); ++ if (sbi->s_zmap_blocks < block) { ++ printk("MINIX-fs: file system does not have enough " ++ "zmap blocks allocated. Refusing to mount.\n"); ++ return false; ++ } ++ + /* + * s_max_size must not exceed the block mapping limitation. This check + * is only needed for V1 filesystems, since V2/V3 support an extra level +@@ -275,26 +303,6 @@ static int minix_fill_super(struct super_block *s, void *data, int silent) + minix_set_bit(0,sbi->s_imap[0]->b_data); + minix_set_bit(0,sbi->s_zmap[0]->b_data); + +- /* Apparently minix can create filesystems that allocate more blocks for +- * the bitmaps than needed. We simply ignore that, but verify it didn't +- * create one with not enough blocks and bail out if so. +- */ +- block = minix_blocks_needed(sbi->s_ninodes, s->s_blocksize); +- if (sbi->s_imap_blocks < block) { +- printk("MINIX-fs: file system does not have enough " +- "imap blocks allocated. Refusing to mount.\n"); +- goto out_no_bitmap; +- } +- +- block = minix_blocks_needed( +- (sbi->s_nzones - sbi->s_firstdatazone + 1), +- s->s_blocksize); +- if (sbi->s_zmap_blocks < block) { +- printk("MINIX-fs: file system does not have enough " +- "zmap blocks allocated. Refusing to mount.\n"); +- goto out_no_bitmap; +- } +- + /* set up enough so that it can read an inode */ + s->s_op = &minix_sops; + s->s_time_min = 0; +-- +2.51.0 + diff --git a/queue-6.1/mips-loongson-make-cpumask_of_node-robust-against-nu.patch b/queue-6.1/mips-loongson-make-cpumask_of_node-robust-against-nu.patch new file mode 100644 index 00000000000..43331d7aae5 --- /dev/null +++ b/queue-6.1/mips-loongson-make-cpumask_of_node-robust-against-nu.patch @@ -0,0 +1,36 @@ +From 50c3a7c4a28cc03b9ea009f8e5e25c6f772e3fe7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 09:40:06 +0000 +Subject: MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE + +From: John Garry + +[ Upstream commit d55d3fe2d1470ac5b6e93efe7998b728013c9fc8 ] + +The arch definition of cpumask_of_node() cannot handle NUMA_NO_NODE - which +is a valid index - so add a check for this. + +Signed-off-by: John Garry +Reviewed-by: Huacai Chen +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/mach-loongson64/topology.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/include/asm/mach-loongson64/topology.h b/arch/mips/include/asm/mach-loongson64/topology.h +index 3414a1fd17835..89bb4deab98a6 100644 +--- a/arch/mips/include/asm/mach-loongson64/topology.h ++++ b/arch/mips/include/asm/mach-loongson64/topology.h +@@ -7,7 +7,7 @@ + #define cpu_to_node(cpu) (cpu_logical_map(cpu) >> 2) + + extern cpumask_t __node_cpumask[]; +-#define cpumask_of_node(node) (&__node_cpumask[node]) ++#define cpumask_of_node(node) ((node) == NUMA_NO_NODE ? cpu_all_mask : &__node_cpumask[node]) + + struct pci_bus; + extern int pcibus_to_node(struct pci_bus *); +-- +2.51.0 + diff --git a/queue-6.1/misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch b/queue-6.1/misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch new file mode 100644 index 00000000000..7314f4399e1 --- /dev/null +++ b/queue-6.1/misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch @@ -0,0 +1,75 @@ +From 9e176b30d87f7d8d9ad0ccc4bebcfd77ced97d51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 14:36:37 +0800 +Subject: misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() + +From: Tuo Li + +[ Upstream commit ba75ecb97d3f4e95d59002c13afb6519205be6cb ] + +In the function bcm_vk_read(), the pointer entry is checked, indicating +that it can be NULL. If entry is NULL and rc is set to -EMSGSIZE, the +following code may cause null-pointer dereferences: + + struct vk_msg_blk tmp_msg = entry->to_h_msg[0]; + set_msg_id(&tmp_msg, entry->usr_msg_id); + tmp_msg.size = entry->to_h_blks - 1; + +To prevent these possible null-pointer dereferences, copy to_h_msg, +usr_msg_id, and to_h_blks from iter into temporary variables, and return +these temporary variables to the application instead of accessing them +through a potentially NULL entry. + +Signed-off-by: Tuo Li +Reviewed-by: Scott Branden +Link: https://patch.msgid.link/20251211063637.3987937-1-islituo@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/bcm-vk/bcm_vk_msg.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/misc/bcm-vk/bcm_vk_msg.c b/drivers/misc/bcm-vk/bcm_vk_msg.c +index 3c081504f38ca..97888c83c5ef3 100644 +--- a/drivers/misc/bcm-vk/bcm_vk_msg.c ++++ b/drivers/misc/bcm-vk/bcm_vk_msg.c +@@ -1010,6 +1010,9 @@ ssize_t bcm_vk_read(struct file *p_file, + struct device *dev = &vk->pdev->dev; + struct bcm_vk_msg_chan *chan = &vk->to_h_msg_chan; + struct bcm_vk_wkent *entry = NULL, *iter; ++ struct vk_msg_blk tmp_msg; ++ u32 tmp_usr_msg_id; ++ u32 tmp_blks; + u32 q_num; + u32 rsp_length; + +@@ -1034,6 +1037,9 @@ ssize_t bcm_vk_read(struct file *p_file, + entry = iter; + } else { + /* buffer not big enough */ ++ tmp_msg = iter->to_h_msg[0]; ++ tmp_usr_msg_id = iter->usr_msg_id; ++ tmp_blks = iter->to_h_blks; + rc = -EMSGSIZE; + } + goto read_loop_exit; +@@ -1052,14 +1058,12 @@ ssize_t bcm_vk_read(struct file *p_file, + + bcm_vk_free_wkent(dev, entry); + } else if (rc == -EMSGSIZE) { +- struct vk_msg_blk tmp_msg = entry->to_h_msg[0]; +- + /* + * in this case, return just the first block, so + * that app knows what size it is looking for. + */ +- set_msg_id(&tmp_msg, entry->usr_msg_id); +- tmp_msg.size = entry->to_h_blks - 1; ++ set_msg_id(&tmp_msg, tmp_usr_msg_id); ++ tmp_msg.size = tmp_blks - 1; + if (copy_to_user(buf, &tmp_msg, VK_MSGQ_BLK_SIZE) != 0) { + dev_err(dev, "Error return 1st block in -EMSGSIZE\n"); + rc = -EFAULT; +-- +2.51.0 + diff --git a/queue-6.1/misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch b/queue-6.1/misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch new file mode 100644 index 00000000000..197b1885948 --- /dev/null +++ b/queue-6.1/misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch @@ -0,0 +1,67 @@ +From 8e33a7f5cf4ecd8c990e4170330bec0141c4277f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 11:48:24 +0100 +Subject: misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 + +From: Markus Perkins + +[ Upstream commit b54c82d6cbfc76647ba558e8e3647eb2b0ba0e2b ] + +commit 14374fbb3f06 ("misc: eeprom_93xx46: Add new 93c56 and 93c66 +compatible strings") added support for 93xx56 and 93xx66 eeproms, but +didn't take into account that the write enable/disable + erase all +commands are hardcoded for the 6-bit address of the 93xx46. + +This commit fixes the command word generation by increasing the number +of shifts as the address field grows, keeping the command intact. + +Also, the check for 8-bit or 16-bit mode is no longer required as this +is already taken into account in the edev->addrlen field. + +Signed-off-by: Markus Perkins +Link: https://patch.msgid.link/20251202104823.429869-3-markus@notsyncing.net +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/eeprom/eeprom_93xx46.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c +index b630625b3024b..b510d0b5ddfa7 100644 +--- a/drivers/misc/eeprom/eeprom_93xx46.c ++++ b/drivers/misc/eeprom/eeprom_93xx46.c +@@ -23,6 +23,7 @@ + #define OP_START 0x4 + #define OP_WRITE (OP_START | 0x1) + #define OP_READ (OP_START | 0x2) ++/* The following addresses are offset for the 1K EEPROM variant in 16-bit mode */ + #define ADDR_EWDS 0x00 + #define ADDR_ERAL 0x20 + #define ADDR_EWEN 0x30 +@@ -173,10 +174,7 @@ static int eeprom_93xx46_ew(struct eeprom_93xx46_dev *edev, int is_on) + bits = edev->addrlen + 3; + + cmd_addr = OP_START << edev->addrlen; +- if (edev->pdata->flags & EE_ADDR8) +- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << 1; +- else +- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS); ++ cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << (edev->addrlen - 6); + + if (has_quirk_instruction_length(edev)) { + cmd_addr <<= 2; +@@ -320,10 +318,7 @@ static int eeprom_93xx46_eral(struct eeprom_93xx46_dev *edev) + bits = edev->addrlen + 3; + + cmd_addr = OP_START << edev->addrlen; +- if (edev->pdata->flags & EE_ADDR8) +- cmd_addr |= ADDR_ERAL << 1; +- else +- cmd_addr |= ADDR_ERAL; ++ cmd_addr |= ADDR_ERAL << (edev->addrlen - 6); + + if (has_quirk_instruction_length(edev)) { + cmd_addr <<= 2; +-- +2.51.0 + diff --git a/queue-6.1/modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch b/queue-6.1/modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch new file mode 100644 index 00000000000..d1352df039d --- /dev/null +++ b/queue-6.1/modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch @@ -0,0 +1,56 @@ +From fc842c9dc08a1d55888ab8d74d0bf7f5c2f46ada Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Nov 2025 13:13:30 +0100 +Subject: modpost: Amend ppc64 save/restfpr symnames for -Os build +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: René Rebe + +[ Upstream commit 3cd9763ce4ad999d015cf0734e6b968cead95077 ] + +Building a size optimized ppc64 kernel (-Os), gcc emits more FP +save/restore symbols, that the linker generates on demand into the +.sfpr section. Explicitly allow-list those in scripts/mod/modpost.c, +too. They are needed for the amdgpu in-kernel floating point support. + +MODPOST Module.symvers +ERROR: modpost: "_restfpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_26" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savegpr1_27" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savegpr1_25" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_28" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savegpr1_29" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savefpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savefpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_15" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +WARNING: modpost: suppressed 56 unresolved symbol warnings because there were too many) + +Signed-off-by: René Rebe +Link: https://patch.msgid.link/20251123.131330.407910684435629198.rene@exactco.de +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + scripts/mod/modpost.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index c2161d77672de..06adeff43b5eb 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -608,6 +608,10 @@ static int ignore_undef_symbol(struct elf_info *info, const char *symname) + /* Special register function linked on all modules during final link of .ko */ + if (strstarts(symname, "_restgpr0_") || + strstarts(symname, "_savegpr0_") || ++ strstarts(symname, "_restgpr1_") || ++ strstarts(symname, "_savegpr1_") || ++ strstarts(symname, "_restfpr_") || ++ strstarts(symname, "_savefpr_") || + strstarts(symname, "_restvr_") || + strstarts(symname, "_savevr_") || + strcmp(symname, ".TOC.") == 0) +-- +2.51.0 + diff --git a/queue-6.1/myri10ge-avoid-uninitialized-variable-use.patch b/queue-6.1/myri10ge-avoid-uninitialized-variable-use.patch new file mode 100644 index 00000000000..65886ad4196 --- /dev/null +++ b/queue-6.1/myri10ge-avoid-uninitialized-variable-use.patch @@ -0,0 +1,162 @@ +From 85126a8434298932510dd52de37f3410ff51caa6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Feb 2026 17:28:09 +0100 +Subject: myri10ge: avoid uninitialized variable use + +From: Arnd Bergmann + +[ Upstream commit fd24173439c033ffb3c2a2628fcbc9cb65e62bdb ] + +While compile testing on less common architectures, I noticed that gcc-10 on +s390 finds a bug that all other configurations seem to miss: + +drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_set_multicast_list': +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:391:25: error: 'cmd.data0' is used uninitialized in this function [-Werror=uninitialized] + 391 | buf->data0 = htonl(data->data0); + | ^~ +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:25: error: '*((void *)&cmd+4)' is used uninitialized in this function [-Werror=uninitialized] + 392 | buf->data1 = htonl(data->data1); + | ^~ +drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_allocate_rings': +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:13: error: 'cmd.data1' is used uninitialized in this function [-Werror=uninitialized] + 392 | buf->data1 = htonl(data->data1); +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data1' was declared here + 1939 | struct myri10ge_cmd cmd; + | ^~~ +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:393:13: error: 'cmd.data2' is used uninitialized in this function [-Werror=uninitialized] + 393 | buf->data2 = htonl(data->data2); +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data2' was declared here + 1939 | struct myri10ge_cmd cmd; + +It would be nice to understand how to make other compilers catch this as +well, but for the moment I'll just shut up the warning by fixing the +undefined behavior in this driver. + +Signed-off-by: Arnd Bergmann +Link: https://patch.msgid.link/20260205162935.2126442-1-arnd@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/myricom/myri10ge/myri10ge.c | 28 ++++++++++++++++++- + 1 file changed, 27 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c +index 9a9341a348c00..4e39f948952ee 100644 +--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c ++++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c +@@ -688,6 +688,9 @@ static int myri10ge_get_firmware_capabilities(struct myri10ge_priv *mgp) + + /* probe for IPv6 TSO support */ + mgp->features = NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_TSO; ++ cmd.data0 = 0, ++ cmd.data1 = 0, ++ cmd.data2 = 0, + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_MAX_TSO6_HDR_SIZE, + &cmd, 0); + if (status == 0) { +@@ -806,6 +809,7 @@ static int myri10ge_update_mac_address(struct myri10ge_priv *mgp, + | (addr[2] << 8) | addr[3]); + + cmd.data1 = ((addr[4] << 8) | (addr[5])); ++ cmd.data2 = 0; + + status = myri10ge_send_cmd(mgp, MXGEFW_SET_MAC_ADDRESS, &cmd, 0); + return status; +@@ -817,6 +821,9 @@ static int myri10ge_change_pause(struct myri10ge_priv *mgp, int pause) + int status, ctl; + + ctl = pause ? MXGEFW_ENABLE_FLOW_CONTROL : MXGEFW_DISABLE_FLOW_CONTROL; ++ cmd.data0 = 0, ++ cmd.data1 = 0, ++ cmd.data2 = 0, + status = myri10ge_send_cmd(mgp, ctl, &cmd, 0); + + if (status) { +@@ -834,6 +841,9 @@ myri10ge_change_promisc(struct myri10ge_priv *mgp, int promisc, int atomic) + int status, ctl; + + ctl = promisc ? MXGEFW_ENABLE_PROMISC : MXGEFW_DISABLE_PROMISC; ++ cmd.data0 = 0; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, ctl, &cmd, atomic); + if (status) + netdev_err(mgp->dev, "Failed to set promisc mode\n"); +@@ -1946,6 +1956,8 @@ static int myri10ge_allocate_rings(struct myri10ge_slice_state *ss) + /* get ring sizes */ + slice = ss - mgp->ss; + cmd.data0 = slice; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_RING_SIZE, &cmd, 0); + tx_ring_size = cmd.data0; + cmd.data0 = slice; +@@ -2238,12 +2250,16 @@ static int myri10ge_get_txrx(struct myri10ge_priv *mgp, int slice) + status = 0; + if (slice == 0 || (mgp->dev->real_num_tx_queues > 1)) { + cmd.data0 = slice; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_OFFSET, + &cmd, 0); + ss->tx.lanai = (struct mcp_kreq_ether_send __iomem *) + (mgp->sram + cmd.data0); + } + cmd.data0 = slice; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status |= myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SMALL_RX_OFFSET, + &cmd, 0); + ss->rx_small.lanai = (struct mcp_kreq_ether_recv __iomem *) +@@ -2312,6 +2328,7 @@ static int myri10ge_open(struct net_device *dev) + if (mgp->num_slices > 1) { + cmd.data0 = mgp->num_slices; + cmd.data1 = MXGEFW_SLICE_INTR_MODE_ONE_PER_SLICE; ++ cmd.data2 = 0; + if (mgp->dev->real_num_tx_queues > 1) + cmd.data1 |= MXGEFW_SLICE_ENABLE_MULTIPLE_TX_QUEUES; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_ENABLE_RSS_QUEUES, +@@ -2414,6 +2431,8 @@ static int myri10ge_open(struct net_device *dev) + + /* now give firmware buffers sizes, and MTU */ + cmd.data0 = dev->mtu + ETH_HLEN + VLAN_HLEN; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_SET_MTU, &cmd, 0); + cmd.data0 = mgp->small_bytes; + status |= +@@ -2472,7 +2491,6 @@ static int myri10ge_open(struct net_device *dev) + static int myri10ge_close(struct net_device *dev) + { + struct myri10ge_priv *mgp = netdev_priv(dev); +- struct myri10ge_cmd cmd; + int status, old_down_cnt; + int i; + +@@ -2491,8 +2509,13 @@ static int myri10ge_close(struct net_device *dev) + + netif_tx_stop_all_queues(dev); + if (mgp->rebooted == 0) { ++ struct myri10ge_cmd cmd; ++ + old_down_cnt = mgp->down_cnt; + mb(); ++ cmd.data0 = 0; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = + myri10ge_send_cmd(mgp, MXGEFW_CMD_ETHERNET_DOWN, &cmd, 0); + if (status) +@@ -2956,6 +2979,9 @@ static void myri10ge_set_multicast_list(struct net_device *dev) + + /* Disable multicast filtering */ + ++ cmd.data0 = 0; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + err = myri10ge_send_cmd(mgp, MXGEFW_ENABLE_ALLMULTI, &cmd, 1); + if (err != 0) { + netdev_err(dev, "Failed MXGEFW_ENABLE_ALLMULTI, error status: %d\n", +-- +2.51.0 + diff --git a/queue-6.1/net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch b/queue-6.1/net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch new file mode 100644 index 00000000000..64b1a8ac9a9 --- /dev/null +++ b/queue-6.1/net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch @@ -0,0 +1,70 @@ +From d7576d87b716e0691b83190229394c16c884c760 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 17:47:55 +0800 +Subject: net: hns3: extend HCLGE_FD_AD_QID to 11 bits + +From: Jijie Shao + +[ Upstream commit 878406d4d6ef85c37fab52074771cc916e532c16 ] + +Currently, HCLGE_FD_AD_QID has only 10 bits and supports a +maximum of 1023 queues. However, there are actually scenarios +where the queue_id exceeds 1023. + +This patch adds an additional bit to HCLGE_FD_AD_QID to ensure +that queue_id greater than 1023 are supported. + +Signed-off-by: Jijie Shao +Link: https://patch.msgid.link/20260123094756.3718516-2-shaojijie@huawei.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 5 +++-- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 +++- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +index 0b9d3fc749b95..cbc8ba429820a 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +@@ -727,8 +727,8 @@ struct hclge_fd_tcam_config_3_cmd { + + #define HCLGE_FD_AD_DROP_B 0 + #define HCLGE_FD_AD_DIRECT_QID_B 1 +-#define HCLGE_FD_AD_QID_S 2 +-#define HCLGE_FD_AD_QID_M GENMASK(11, 2) ++#define HCLGE_FD_AD_QID_L_S 2 ++#define HCLGE_FD_AD_QID_L_M GENMASK(11, 2) + #define HCLGE_FD_AD_USE_COUNTER_B 12 + #define HCLGE_FD_AD_COUNTER_NUM_S 13 + #define HCLGE_FD_AD_COUNTER_NUM_M GENMASK(19, 13) +@@ -741,6 +741,7 @@ struct hclge_fd_tcam_config_3_cmd { + #define HCLGE_FD_AD_TC_OVRD_B 16 + #define HCLGE_FD_AD_TC_SIZE_S 17 + #define HCLGE_FD_AD_TC_SIZE_M GENMASK(20, 17) ++#define HCLGE_FD_AD_QID_H_B 21 + + struct hclge_fd_ad_config_cmd { + u8 stage; +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 42173a076163f..0a5b1c83cbea8 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -5706,11 +5706,13 @@ static int hclge_fd_ad_config(struct hclge_dev *hdev, u8 stage, int loc, + hnae3_set_field(ad_data, HCLGE_FD_AD_TC_SIZE_M, + HCLGE_FD_AD_TC_SIZE_S, (u32)action->tc_size); + } ++ hnae3_set_bit(ad_data, HCLGE_FD_AD_QID_H_B, ++ action->queue_id >= HCLGE_TQP_MAX_SIZE_DEV_V2 ? 1 : 0); + ad_data <<= 32; + hnae3_set_bit(ad_data, HCLGE_FD_AD_DROP_B, action->drop_packet); + hnae3_set_bit(ad_data, HCLGE_FD_AD_DIRECT_QID_B, + action->forward_to_direct_queue); +- hnae3_set_field(ad_data, HCLGE_FD_AD_QID_M, HCLGE_FD_AD_QID_S, ++ hnae3_set_field(ad_data, HCLGE_FD_AD_QID_L_M, HCLGE_FD_AD_QID_L_S, + action->queue_id); + hnae3_set_bit(ad_data, HCLGE_FD_AD_USE_COUNTER_B, action->use_counter); + hnae3_set_field(ad_data, HCLGE_FD_AD_COUNTER_NUM_M, +-- +2.51.0 + diff --git a/queue-6.1/net-rds-clear-reconnect-pending-bit.patch b/queue-6.1/net-rds-clear-reconnect-pending-bit.patch new file mode 100644 index 00000000000..4cf2637e424 --- /dev/null +++ b/queue-6.1/net-rds-clear-reconnect-pending-bit.patch @@ -0,0 +1,42 @@ +From 67373755f09580639d96d32c0f4580ba2baef576 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 22:57:20 -0700 +Subject: net/rds: Clear reconnect pending bit +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: HÃ¥kon Bugge + +[ Upstream commit b89fc7c2523b2b0750d91840f4e52521270d70ed ] + +When canceling the reconnect worker, care must be taken to reset the +reconnect-pending bit. If the reconnect worker has not yet been +scheduled before it is canceled, the reconnect-pending bit will stay +on forever. + +Signed-off-by: HÃ¥kon Bugge +Signed-off-by: Allison Henderson +Link: https://patch.msgid.link/20260203055723.1085751-6-achender@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/rds/connection.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/rds/connection.c b/net/rds/connection.c +index 00bda534b9ce2..98c0d5ff9de9c 100644 +--- a/net/rds/connection.c ++++ b/net/rds/connection.c +@@ -428,6 +428,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp) + * to the conn hash, so we never trigger a reconnect on this + * conn - the reconnect is always triggered by the active peer. */ + cancel_delayed_work_sync(&cp->cp_conn_w); ++ ++ clear_bit(RDS_RECONNECT_PENDING, &cp->cp_flags); + rcu_read_lock(); + if (!hlist_unhashed(&conn->c_hash_node)) { + rcu_read_unlock(); +-- +2.51.0 + diff --git a/queue-6.1/net-rds-no-shortcut-out-of-rds_conn_error.patch b/queue-6.1/net-rds-no-shortcut-out-of-rds_conn_error.patch new file mode 100644 index 00000000000..20a5c041435 --- /dev/null +++ b/queue-6.1/net-rds-no-shortcut-out-of-rds_conn_error.patch @@ -0,0 +1,92 @@ +From 334ed6d43beb7a4f3e87f536fc5a1b123a6df9c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jan 2026 22:52:12 -0700 +Subject: net/rds: No shortcut out of RDS_CONN_ERROR + +From: Gerd Rausch + +[ Upstream commit ad22d24be635c6beab6a1fdd3f8b1f3c478d15da ] + +RDS connections carry a state "rds_conn_path::cp_state" +and transitions from one state to another and are conditional +upon an expected state: "rds_conn_path_transition." + +There is one exception to this conditionality, which is +"RDS_CONN_ERROR" that can be enforced by "rds_conn_path_drop" +regardless of what state the condition is currently in. + +But as soon as a connection enters state "RDS_CONN_ERROR", +the connection handling code expects it to go through the +shutdown-path. + +The RDS/TCP multipath changes added a shortcut out of +"RDS_CONN_ERROR" straight back to "RDS_CONN_CONNECTING" +via "rds_tcp_accept_one_path" (e.g. after "rds_tcp_state_change"). + +A subsequent "rds_tcp_reset_callbacks" can then transition +the state to "RDS_CONN_RESETTING" with a shutdown-worker queued. + +That'll trip up "rds_conn_init_shutdown", which was +never adjusted to handle "RDS_CONN_RESETTING" and subsequently +drops the connection with the dreaded "DR_INV_CONN_STATE", +which leaves "RDS_SHUTDOWN_WORK_QUEUED" on forever. + +So we do two things here: + +a) Don't shortcut "RDS_CONN_ERROR", but take the longer + path through the shutdown code. + +b) Add "RDS_CONN_RESETTING" to the expected states in + "rds_conn_init_shutdown" so that we won't error out + and get stuck, if we ever hit weird state transitions + like this again." + +Signed-off-by: Gerd Rausch +Signed-off-by: Allison Henderson +Link: https://patch.msgid.link/20260122055213.83608-2-achender@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/rds/connection.c | 2 ++ + net/rds/tcp_listen.c | 5 ----- + 2 files changed, 2 insertions(+), 5 deletions(-) + +diff --git a/net/rds/connection.c b/net/rds/connection.c +index b4cc699c5fad3..00bda534b9ce2 100644 +--- a/net/rds/connection.c ++++ b/net/rds/connection.c +@@ -381,6 +381,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp) + if (!rds_conn_path_transition(cp, RDS_CONN_UP, + RDS_CONN_DISCONNECTING) && + !rds_conn_path_transition(cp, RDS_CONN_ERROR, ++ RDS_CONN_DISCONNECTING) && ++ !rds_conn_path_transition(cp, RDS_CONN_RESETTING, + RDS_CONN_DISCONNECTING)) { + rds_conn_path_error(cp, + "shutdown called in state %d\n", +diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c +index b576bd252fecb..353b88833f787 100644 +--- a/net/rds/tcp_listen.c ++++ b/net/rds/tcp_listen.c +@@ -58,9 +58,6 @@ void rds_tcp_keepalive(struct socket *sock) + * socket and force a reconneect from smaller -> larger ip addr. The reason + * we special case cp_index 0 is to allow the rds probe ping itself to itself + * get through efficiently. +- * Since reconnects are only initiated from the node with the numerically +- * smaller ip address, we recycle conns in RDS_CONN_ERROR on the passive side +- * by moving them to CONNECTING in this function. + */ + static + struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn) +@@ -85,8 +82,6 @@ struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn) + struct rds_conn_path *cp = &conn->c_path[i]; + + if (rds_conn_path_transition(cp, RDS_CONN_DOWN, +- RDS_CONN_CONNECTING) || +- rds_conn_path_transition(cp, RDS_CONN_ERROR, + RDS_CONN_CONNECTING)) { + return cp->cp_transport_data; + } +-- +2.51.0 + diff --git a/queue-6.1/net-usb-r8152-fix-transmit-queue-timeout.patch b/queue-6.1/net-usb-r8152-fix-transmit-queue-timeout.patch new file mode 100644 index 00000000000..2ce88165455 --- /dev/null +++ b/queue-6.1/net-usb-r8152-fix-transmit-queue-timeout.patch @@ -0,0 +1,42 @@ +From 440786395eab682e5dd97c27804bf6e1be428967 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 09:59:49 +0800 +Subject: net: usb: r8152: fix transmit queue timeout + +From: Mingj Ye + +[ Upstream commit 833dcd75d54f0bf5aa0a0781ff57456b421fbb40 ] + +When the TX queue length reaches the threshold, the netdev watchdog +immediately detects a TX queue timeout. + +This patch updates the trans_start timestamp of the transmit queue +on every asynchronous USB URB submission along the transmit path, +ensuring that the network watchdog accurately reflects ongoing +transmission activity. + +Signed-off-by: Mingj Ye +Reviewed-by: Hayes Wang +Link: https://patch.msgid.link/20260120015949.84996-1-insyelu@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 63f418299c3ee..fef3e3fd26e6b 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -2342,6 +2342,8 @@ static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg) + ret = usb_submit_urb(agg->urb, GFP_ATOMIC); + if (ret < 0) + usb_autopm_put_interface_async(tp->intf); ++ else ++ netif_trans_update(tp->netdev); + + out_tx_fill: + return ret; +-- +2.51.0 + diff --git a/queue-6.1/net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch b/queue-6.1/net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch new file mode 100644 index 00000000000..243651ac6d5 --- /dev/null +++ b/queue-6.1/net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch @@ -0,0 +1,117 @@ +From 85008bf59d4b005ad550842652c419d525f27e73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 17:39:09 -0800 +Subject: net: usb: sr9700: remove code to drive nonexistent multicast filter + +From: Ethan Nelson-Moore + +[ Upstream commit 9a9424c756feee9ee6e717405a9d6fa7bacdef08 ] + +Several registers referenced in this driver's source code do not +actually exist (they are not writable and read as zero in my testing). +They exist in this driver because it originated as a copy of the dm9601 +driver. Notably, these include the multicast filter registers - this +causes the driver to not support multicast packets correctly. Remove +the multicast filter code and register definitions. Instead, set the +chip to receive all multicast filter packets when any multicast +addresses are in the list. + +Reviewed-by: Simon Horman (from v1) +Signed-off-by: Ethan Nelson-Moore +Link: https://patch.msgid.link/20260203013924.28582-1-enelsonmoore@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/Kconfig | 1 - + drivers/net/usb/sr9700.c | 25 ++++--------------------- + drivers/net/usb/sr9700.h | 7 +------ + 3 files changed, 5 insertions(+), 28 deletions(-) + +diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig +index 4402eedb3d1a2..729b78ef78bee 100644 +--- a/drivers/net/usb/Kconfig ++++ b/drivers/net/usb/Kconfig +@@ -320,7 +320,6 @@ config USB_NET_DM9601 + config USB_NET_SR9700 + tristate "CoreChip-sz SR9700 based USB 1.1 10/100 ethernet devices" + depends on USB_USBNET +- select CRC32 + help + This option adds support for CoreChip-sz SR9700 based USB 1.1 + 10/100 Ethernet adapters. +diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c +index 213b4817cfdf6..e4d7bcd0d99c2 100644 +--- a/drivers/net/usb/sr9700.c ++++ b/drivers/net/usb/sr9700.c +@@ -18,7 +18,6 @@ + #include + #include + #include +-#include + #include + + #include "sr9700.h" +@@ -265,31 +264,15 @@ static const struct ethtool_ops sr9700_ethtool_ops = { + static void sr9700_set_multicast(struct net_device *netdev) + { + struct usbnet *dev = netdev_priv(netdev); +- /* We use the 20 byte dev->data for our 8 byte filter buffer +- * to avoid allocating memory that is tricky to free later +- */ +- u8 *hashes = (u8 *)&dev->data; + /* rx_ctl setting : enable, disable_long, disable_crc */ + u8 rx_ctl = RCR_RXEN | RCR_DIS_CRC | RCR_DIS_LONG; + +- memset(hashes, 0x00, SR_MCAST_SIZE); +- /* broadcast address */ +- hashes[SR_MCAST_SIZE - 1] |= SR_MCAST_ADDR_FLAG; +- if (netdev->flags & IFF_PROMISC) { ++ if (netdev->flags & IFF_PROMISC) + rx_ctl |= RCR_PRMSC; +- } else if (netdev->flags & IFF_ALLMULTI || +- netdev_mc_count(netdev) > SR_MCAST_MAX) { +- rx_ctl |= RCR_RUNT; +- } else if (!netdev_mc_empty(netdev)) { +- struct netdev_hw_addr *ha; +- +- netdev_for_each_mc_addr(ha, netdev) { +- u32 crc = ether_crc(ETH_ALEN, ha->addr) >> 26; +- hashes[crc >> 3] |= 1 << (crc & 0x7); +- } +- } ++ else if (netdev->flags & IFF_ALLMULTI || !netdev_mc_empty(netdev)) ++ /* The chip has no multicast filter */ ++ rx_ctl |= RCR_ALL; + +- sr_write_async(dev, SR_MAR, SR_MCAST_SIZE, hashes); + sr_write_reg_async(dev, SR_RCR, rx_ctl); + } + +diff --git a/drivers/net/usb/sr9700.h b/drivers/net/usb/sr9700.h +index ea2b4de621c86..c479908f7d823 100644 +--- a/drivers/net/usb/sr9700.h ++++ b/drivers/net/usb/sr9700.h +@@ -104,9 +104,7 @@ + #define WCR_LINKEN (1 << 5) + /* Physical Address Reg */ + #define SR_PAR 0x10 /* 0x10 ~ 0x15 6 bytes for PAR */ +-/* Multicast Address Reg */ +-#define SR_MAR 0x16 /* 0x16 ~ 0x1D 8 bytes for MAR */ +-/* 0x1e unused */ ++/* 0x16 --> 0x1E unused */ + /* Phy Reset Reg */ + #define SR_PRR 0x1F + #define PRR_PHY_RST (1 << 0) +@@ -161,9 +159,6 @@ + /* parameters */ + #define SR_SHARE_TIMEOUT 1000 + #define SR_EEPROM_LEN 256 +-#define SR_MCAST_SIZE 8 +-#define SR_MCAST_ADDR_FLAG 0x80 +-#define SR_MCAST_MAX 64 + #define SR_TX_OVERHEAD 2 /* 2bytes header */ + #define SR_RX_OVERHEAD 7 /* 3bytes header + 4crc tail */ + +-- +2.51.0 + diff --git a/queue-6.1/netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch b/queue-6.1/netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch new file mode 100644 index 00000000000..c758c0f8982 --- /dev/null +++ b/queue-6.1/netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch @@ -0,0 +1,41 @@ +From e28f260b403ac4aa476d5d9b06e0478cda8a84a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Dec 2025 20:53:51 +0900 +Subject: netfilter: nf_conntrack: Add allow_clash to generic protocol handler + +From: Yuto Hamaguchi + +[ Upstream commit 8a49fc8d8a3e83dc51ec05bcd4007bdea3c56eec ] + +The upstream commit, 71d8c47fc653711c41bc3282e5b0e605b3727956 + ("netfilter: conntrack: introduce clash resolution on insertion race"), +sets allow_clash=true in the UDP/UDPLITE protocol handler +but does not set it in the generic protocol handler. + +As a result, packets composed of connectionless protocols at each layer, +such as UDP over IP-in-IP, still drop packets due to conflicts during conntrack insertion. + +To resolve this, this patch sets allow_clash in the nf_conntrack_l4proto_generic. + +Signed-off-by: Yuto Hamaguchi +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_proto_generic.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c +index e831637bc8ca8..cb260eb3d012c 100644 +--- a/net/netfilter/nf_conntrack_proto_generic.c ++++ b/net/netfilter/nf_conntrack_proto_generic.c +@@ -67,6 +67,7 @@ void nf_conntrack_generic_init_net(struct net *net) + const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic = + { + .l4proto = 255, ++ .allow_clash = true, + #ifdef CONFIG_NF_CONNTRACK_TIMEOUT + .ctnl_timeout = { + .nlattr_to_obj = generic_timeout_nlattr_to_obj, +-- +2.51.0 + diff --git a/queue-6.1/netfilter-xt_tcpmss-check-remaining-length-before-re.patch b/queue-6.1/netfilter-xt_tcpmss-check-remaining-length-before-re.patch new file mode 100644 index 00000000000..4225ceaa28d --- /dev/null +++ b/queue-6.1/netfilter-xt_tcpmss-check-remaining-length-before-re.patch @@ -0,0 +1,42 @@ +From 0249b60b8ad651239ceeb1727b0ee710816ca197 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 12:30:42 +0100 +Subject: netfilter: xt_tcpmss: check remaining length before reading optlen + +From: Florian Westphal + +[ Upstream commit 735ee8582da3d239eb0c7a53adca61b79fb228b3 ] + +Quoting reporter: + In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads + op[i+1] directly without validating the remaining option length. + + If the last byte of the option field is not EOL/NOP (0/1), the code attempts + to index op[i+1]. In the case where i + 1 == optlen, this causes an + out-of-bounds read, accessing memory past the optlen boundary + (either reading beyond the stack buffer _opt or the + following payload). + +Reported-by: sungzii +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/xt_tcpmss.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c +index 37704ab017992..0d32d4841cb32 100644 +--- a/net/netfilter/xt_tcpmss.c ++++ b/net/netfilter/xt_tcpmss.c +@@ -61,7 +61,7 @@ tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par) + return (mssval >= info->mss_min && + mssval <= info->mss_max) ^ info->invert; + } +- if (op[i] < 2) ++ if (op[i] < 2 || i == optlen - 1) + i++; + else + i += op[i+1] ? : 1; +-- +2.51.0 + diff --git a/queue-6.1/nfc-nxp-nci-remove-interrupt-trigger-type.patch b/queue-6.1/nfc-nxp-nci-remove-interrupt-trigger-type.patch new file mode 100644 index 00000000000..3edf73a814c --- /dev/null +++ b/queue-6.1/nfc-nxp-nci-remove-interrupt-trigger-type.patch @@ -0,0 +1,42 @@ +From 6767b84b14d9bbbdbadb88c5d1383af13a0c4d00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Feb 2026 19:11:39 +0800 +Subject: nfc: nxp-nci: remove interrupt trigger type + +From: Carl Lee + +[ Upstream commit 57be33f85e369ce9f69f61eaa34734e0d3bd47a7 ] + +For NXP NCI devices (e.g. PN7150), the interrupt is level-triggered and +active high, not edge-triggered. + +Using IRQF_TRIGGER_RISING in the driver can cause interrupts to fail +to trigger correctly. + +Remove IRQF_TRIGGER_RISING and rely on the IRQ trigger type configured +via Device Tree. + +Signed-off-by: Carl Lee +Link: https://patch.msgid.link/20260205-fc-nxp-nci-remove-interrupt-trigger-type-v2-1-79d2ed4a7e42@amd.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/nfc/nxp-nci/i2c.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c +index ec6446511984d..b9d311acfbfb2 100644 +--- a/drivers/nfc/nxp-nci/i2c.c ++++ b/drivers/nfc/nxp-nci/i2c.c +@@ -306,7 +306,7 @@ static int nxp_nci_i2c_probe(struct i2c_client *client, + + r = request_threaded_irq(client->irq, NULL, + nxp_nci_i2c_irq_thread_fn, +- IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ IRQF_ONESHOT, + NXP_NCI_I2C_DRIVER_NAME, phy); + if (r < 0) + nfc_err(&client->dev, "Unable to register IRQ handler\n"); +-- +2.51.0 + diff --git a/queue-6.1/ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch b/queue-6.1/ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch new file mode 100644 index 00000000000..4c2e9bc1dbf --- /dev/null +++ b/queue-6.1/ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch @@ -0,0 +1,40 @@ +From 7818cb2e26390a8a13e93247ba89f1ac2dd7bd47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2025 14:53:18 -0800 +Subject: ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access + +From: Maciej Grochowski + +[ Upstream commit c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface ] + +Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS, +This patch protects against invalid index out of bounds access to mw_sizes +When invalid access print message to user that configuration is not valid. + +Signed-off-by: Maciej Grochowski +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +index 1bdec59100019..d7de52720209f 100644 +--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c ++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +@@ -1314,6 +1314,12 @@ static void switchtec_ntb_init_shared(struct switchtec_ntb *sndev) + for (i = 0; i < sndev->nr_lut_mw; i++) { + int idx = sndev->nr_direct_mw + i; + ++ if (idx >= MAX_MWS) { ++ dev_err(&sndev->stdev->dev, ++ "Total number of MW cannot be bigger than %d", MAX_MWS); ++ break; ++ } ++ + sndev->self_shared->mw_sizes[idx] = LUT_SIZE; + } + } +-- +2.51.0 + diff --git a/queue-6.1/ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch b/queue-6.1/ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch new file mode 100644 index 00000000000..5dd6a854d4d --- /dev/null +++ b/queue-6.1/ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch @@ -0,0 +1,48 @@ +From 66d477c4d3e8403fe647d0bf88283a4adf0572ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2025 14:53:17 -0800 +Subject: ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut + +From: Maciej Grochowski + +[ Upstream commit 186615f8855a0be4ee7d3fcd09a8ecc10e783b08 ] + +Number of MW LUTs depends on NTB configuration and can be set to zero, +in such scenario rounddown_pow_of_two will cause undefined behaviour and +should not be performed. +This patch ensures that rounddown_pow_of_two is called on valid value. + +Signed-off-by: Maciej Grochowski +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +index d7de52720209f..0f3f79f310ae3 100644 +--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c ++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +@@ -1202,7 +1202,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev) + sndev->mmio_self_ctrl); + + sndev->nr_lut_mw = ioread16(&sndev->mmio_self_ctrl->lut_table_entries); +- sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw); ++ if (sndev->nr_lut_mw) ++ sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw); + + dev_dbg(&sndev->stdev->dev, "MWs: %d direct, %d lut\n", + sndev->nr_direct_mw, sndev->nr_lut_mw); +@@ -1212,7 +1213,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev) + + sndev->peer_nr_lut_mw = + ioread16(&sndev->mmio_peer_ctrl->lut_table_entries); +- sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw); ++ if (sndev->peer_nr_lut_mw) ++ sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw); + + dev_dbg(&sndev->stdev->dev, "Peer MWs: %d direct, %d lut\n", + sndev->peer_nr_direct_mw, sndev->peer_nr_lut_mw); +-- +2.51.0 + diff --git a/queue-6.1/octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch b/queue-6.1/octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch new file mode 100644 index 00000000000..7fe238c73d1 --- /dev/null +++ b/queue-6.1/octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch @@ -0,0 +1,69 @@ +From 80d22dde6e0a3f29d4381dd0d534537cea21deb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 18:21:47 +0530 +Subject: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geetha sowjanya + +[ Upstream commit 70e9a5760abfb6338d63994d4de6b0778ec795d6 ] + +NIX SQ manager sticky mode is known to cause stalls when multiple SQs +share an SMQ and transmit concurrently. Additionally, PSE may deadlock +on transitions between sticky and non-sticky transmissions. There is +also a credit drop issue observed when certain condition clocks are +gated. + +work around these hardware errata by: +- Disabling SQM sticky operation: + - Clear TM6 (bit 15) + - Clear TM11 (bit 14) +- Disabling sticky → non-sticky transition path that can deadlock PSE: + - Clear TM5 (bit 23) +- Preventing credit drops by keeping the control-flow clock enabled: + - Set TM9 (bit 21) + +These changes are applied via NIX_AF_SQM_DBG_CTL_STATUS. With this +configuration the SQM/PSE maintain forward progress under load without +credit loss, at the cost of disabling sticky optimizations. + +Signed-off-by: Geetha sowjanya +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260127125147.1642-1-gakula@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +index 95a8ccd18a4f7..f56ffb587fc53 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +@@ -4464,12 +4464,18 @@ static int rvu_nix_block_init(struct rvu *rvu, struct nix_hw *nix_hw) + /* Set chan/link to backpressure TL3 instead of TL2 */ + rvu_write64(rvu, blkaddr, NIX_AF_PSE_CHANNEL_LEVEL, 0x01); + +- /* Disable SQ manager's sticky mode operation (set TM6 = 0) ++ /* Disable SQ manager's sticky mode operation (set TM6 = 0, TM11 = 0) + * This sticky mode is known to cause SQ stalls when multiple +- * SQs are mapped to same SMQ and transmitting pkts at a time. ++ * SQs are mapped to same SMQ and transmitting pkts simultaneously. ++ * NIX PSE may deadlock when there are any sticky to non-sticky ++ * transmission. Hence disable it (TM5 = 0). + */ + cfg = rvu_read64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS); +- cfg &= ~BIT_ULL(15); ++ cfg &= ~(BIT_ULL(15) | BIT_ULL(14) | BIT_ULL(23)); ++ /* NIX may drop credits when condition clocks are turned off. ++ * Hence enable control flow clk (set TM9 = 1). ++ */ ++ cfg |= BIT_ULL(21); + rvu_write64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS, cfg); + + ltdefs = rvu->kpu.lt_def; +-- +2.51.0 + diff --git a/queue-6.1/openrisc-define-arch-specific-version-of-nop.patch b/queue-6.1/openrisc-define-arch-specific-version-of-nop.patch new file mode 100644 index 00000000000..857f738264b --- /dev/null +++ b/queue-6.1/openrisc-define-arch-specific-version-of-nop.patch @@ -0,0 +1,53 @@ +From 005e54033c8d60a9cba2141662d1931f8fadb395 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 12:07:23 -0500 +Subject: openrisc: define arch-specific version of nop() + +From: Brian Masney + +[ Upstream commit 0dfffa5479d6260d04d021f69203b1926f73d889 ] + +When compiling a driver written for MIPS on OpenRISC that uses the nop() +function, it fails due to the following error: + + drivers/watchdog/pic32-wdt.c: Assembler messages: + drivers/watchdog/pic32-wdt.c:125: Error: unrecognized instruction `nop' + +The driver currently uses the generic version of nop() from +include/asm-generic/barrier.h: + + #ifndef nop + #define nop() asm volatile ("nop") + #endif + +Let's fix this on OpenRISC by defining an architecture-specific version +of nop(). + +This was tested by performing an allmodconfig openrisc cross compile on +an aarch64 host. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202601180236.BVy480We-lkp@intel.com/ +Signed-off-by: Brian Masney +Signed-off-by: Stafford Horne +Signed-off-by: Sasha Levin +--- + arch/openrisc/include/asm/barrier.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h +index 7538294721bed..8e592c9909023 100644 +--- a/arch/openrisc/include/asm/barrier.h ++++ b/arch/openrisc/include/asm/barrier.h +@@ -4,6 +4,8 @@ + + #define mb() asm volatile ("l.msync" ::: "memory") + ++#define nop() asm volatile ("l.nop") ++ + #include + + #endif /* __ASM_BARRIER_H */ +-- +2.51.0 + diff --git a/queue-6.1/parisc-prevent-interrupts-during-reboot.patch b/queue-6.1/parisc-prevent-interrupts-during-reboot.patch new file mode 100644 index 00000000000..3a69aa92079 --- /dev/null +++ b/queue-6.1/parisc-prevent-interrupts-during-reboot.patch @@ -0,0 +1,32 @@ +From 283c68bdec255414aecfc81edc4249887403e6aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 17:58:55 +0100 +Subject: parisc: Prevent interrupts during reboot + +From: Helge Deller + +[ Upstream commit 35ac5a728c878594f2ea6c43b57652a16be3c968 ] + +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/kernel/process.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c +index b62d60009fac9..fd753a0e75d79 100644 +--- a/arch/parisc/kernel/process.c ++++ b/arch/parisc/kernel/process.c +@@ -85,6 +85,9 @@ void machine_restart(char *cmd) + #endif + /* set up a new led state on systems shipped with a LED State panel */ + pdc_chassis_send_status(PDC_CHASSIS_DIRECT_SHUTDOWN); ++ ++ /* prevent interrupts during reboot */ ++ set_eiem(0); + + /* "Normal" system reset */ + pdc_do_reset(); +-- +2.51.0 + diff --git a/queue-6.1/pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch b/queue-6.1/pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch new file mode 100644 index 00000000000..da3f4c21ea2 --- /dev/null +++ b/queue-6.1/pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch @@ -0,0 +1,41 @@ +From e7db3e9fc03249ec477d9eea19db935e2d7971e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jan 2026 13:53:32 +0530 +Subject: PCI: Add ACS quirk for Qualcomm Hamoa & Glymur + +From: Krishna Chaitanya Chundru + +[ Upstream commit 44d2f70b1fd72c339c72983fcffa181beae3e113 ] + +The Qualcomm Hamoa & Glymur Root Ports don't advertise an ACS capability, +but they do provide ACS-like features to disable peer transactions and +validate bus numbers in requests. + +Add an ACS quirk for Hamoa & Glymur. + +Signed-off-by: Krishna Chaitanya Chundru +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20260109-acs_quirk-v1-1-82adf95a89ae@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 28f8add367c00..11041831ed3c2 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -5002,6 +5002,10 @@ static const struct pci_dev_acs_enabled { + { PCI_VENDOR_ID_QCOM, 0x0401, pci_quirk_qcom_rp_acs }, + /* QCOM SA8775P root port */ + { PCI_VENDOR_ID_QCOM, 0x0115, pci_quirk_qcom_rp_acs }, ++ /* QCOM Hamoa root port */ ++ { PCI_VENDOR_ID_QCOM, 0x0111, pci_quirk_qcom_rp_acs }, ++ /* QCOM Glymur root port */ ++ { PCI_VENDOR_ID_QCOM, 0x0120, pci_quirk_qcom_rp_acs }, + /* HXT SD4800 root ports. The ACS design is same as QCOM QDF2xxx */ + { PCI_VENDOR_ID_HXT, 0x0401, pci_quirk_qcom_rp_acs }, + /* Intel PCH root ports */ +-- +2.51.0 + diff --git a/queue-6.1/pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch b/queue-6.1/pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch new file mode 100644 index 00000000000..e71f1cf506e --- /dev/null +++ b/queue-6.1/pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch @@ -0,0 +1,94 @@ +From 839f849fcd838b377c047721a667ef21f9cf007f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 10:25:51 +0100 +Subject: PCI/AER: Clear stale errors on reporting agents upon probe + +From: Lukas Wunner + +[ Upstream commit e242d09b58e869f86071b7889acace4cff215935 ] + +Correctable and Uncorrectable Error Status Registers on reporting agents +are cleared upon PCI device enumeration in pci_aer_init() to flush past +events. They're cleared again when an error is handled by the AER driver. + +If an agent reports a new error after pci_aer_init() and before the AER +driver has probed on the corresponding Root Port or Root Complex Event +Collector, that error is not handled by the AER driver: It clears the +Root Error Status Register on probe, but neglects to re-clear the +Correctable and Uncorrectable Error Status Registers on reporting agents. + +The error will eventually be reported when another error occurs. Which +is irritating because to an end user it appears as if the earlier error +has just happened. + +Amend the AER driver to clear stale errors on reporting agents upon probe. + +Skip reporting agents which have not invoked pci_aer_init() yet to avoid +using an uninitialized pdev->aer_cap. They're recognizable by the error +bits in the Device Control register still being clear. + +Reporting agents may execute pci_aer_init() after the AER driver has +probed, particularly when devices are hotplugged or removed/rescanned via +sysfs. For this reason, it continues to be necessary that pci_aer_init() +clears Correctable and Uncorrectable Error Status Registers. + +Reported-by: Lucas Van # off-list +Signed-off-by: Lukas Wunner +Signed-off-by: Bjorn Helgaas +Tested-by: Lucas Van +Reviewed-by: Kuppuswamy Sathyanarayanan +Link: https://patch.msgid.link/3011c2ed30c11f858e35e29939add754adea7478.1769332702.git.lukas@wunner.de +Signed-off-by: Sasha Levin +--- + drivers/pci/pcie/aer.c | 26 +++++++++++++++++++++++++- + 1 file changed, 25 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c +index 866426a8fb862..fe3a4a3cb46d4 100644 +--- a/drivers/pci/pcie/aer.c ++++ b/drivers/pci/pcie/aer.c +@@ -1259,6 +1259,20 @@ static void set_downstream_devices_error_reporting(struct pci_dev *dev, + + } + ++static int clear_status_iter(struct pci_dev *dev, void *data) ++{ ++ u16 devctl; ++ ++ /* Skip if pci_enable_pcie_error_reporting() hasn't been called yet */ ++ pcie_capability_read_word(dev, PCI_EXP_DEVCTL, &devctl); ++ if (!(devctl & PCI_EXP_AER_FLAGS)) ++ return 0; ++ ++ pci_aer_clear_status(dev); ++ pcie_clear_device_status(dev); ++ return 0; ++} ++ + /** + * aer_enable_rootport - enable Root Port's interrupts when receiving messages + * @rpc: pointer to a Root Port data structure +@@ -1280,9 +1294,19 @@ static void aer_enable_rootport(struct aer_rpc *rpc) + pcie_capability_clear_word(pdev, PCI_EXP_RTCTL, + SYSTEM_ERROR_INTR_ON_MESG_MASK); + +- /* Clear error status */ ++ /* Clear error status of this Root Port or RCEC */ + pci_read_config_dword(pdev, aer + PCI_ERR_ROOT_STATUS, ®32); + pci_write_config_dword(pdev, aer + PCI_ERR_ROOT_STATUS, reg32); ++ ++ /* Clear error status of agents reporting to this Root Port or RCEC */ ++ if (reg32 & AER_ERR_STATUS_MASK) { ++ if (pci_pcie_type(pdev) == PCI_EXP_TYPE_RC_EC) ++ pcie_walk_rcec(pdev, clear_status_iter, NULL); ++ else if (pdev->subordinate) ++ pci_walk_bus(pdev->subordinate, clear_status_iter, ++ NULL); ++ } ++ + pci_read_config_dword(pdev, aer + PCI_ERR_COR_STATUS, ®32); + pci_write_config_dword(pdev, aer + PCI_ERR_COR_STATUS, reg32); + pci_read_config_dword(pdev, aer + PCI_ERR_UNCOR_STATUS, ®32); +-- +2.51.0 + diff --git a/queue-6.1/pci-dw-rockchip-disable-bar-0-and-bar-1-for-root-por.patch b/queue-6.1/pci-dw-rockchip-disable-bar-0-and-bar-1-for-root-por.patch new file mode 100644 index 00000000000..a0f286b0323 --- /dev/null +++ b/queue-6.1/pci-dw-rockchip-disable-bar-0-and-bar-1-for-root-por.patch @@ -0,0 +1,74 @@ +From 51cc51433d0e96603710207c58252aa38f359aaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Dec 2025 18:01:01 +0800 +Subject: PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port + +From: Shawn Lin + +[ Upstream commit b5d712e5b87fc56ff838684afb1bae359eb8069f ] + +Some Rockchip PCIe Root Ports report bogus size of 1GiB for the BAR +memories and they cause below resource allocation issue during probe. + + pci 0000:00:00.0: [1d87:3588] type 01 class 0x060400 PCIe Root Port + pci 0000:00:00.0: BAR 0 [mem 0x00000000-0x3fffffff] + pci 0000:00:00.0: BAR 1 [mem 0x00000000-0x3fffffff] + pci 0000:00:00.0: ROM [mem 0x00000000-0x0000ffff pref] + ... + pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: assigned + pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: can't assign; no space + pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: failed to assign + pci 0000:00:00.0: ROM [mem 0xf0200000-0xf020ffff pref]: assigned + pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: releasing + pci 0000:00:00.0: ROM [mem 0xf0200000-0xf020ffff pref]: releasing + pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: assigned + pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: can't assign; no space + pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: failed to assign + +Since there is no use of the Root Port BAR memories, disable both of them. + +Signed-off-by: Shawn Lin +[mani: reworded the description and comment] +Signed-off-by: Manivannan Sadhasivam +Link: https://patch.msgid.link/1766570461-138256-1-git-send-email-shawn.lin@rock-chips.com +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-dw-rockchip.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/pci/controller/dwc/pcie-dw-rockchip.c b/drivers/pci/controller/dwc/pcie-dw-rockchip.c +index df0b9eb19c4de..02f781c886035 100644 +--- a/drivers/pci/controller/dwc/pcie-dw-rockchip.c ++++ b/drivers/pci/controller/dwc/pcie-dw-rockchip.c +@@ -48,6 +48,8 @@ + #define PCIE_LTSSM_ENABLE_ENHANCE BIT(4) + #define PCIE_LTSSM_STATUS_MASK GENMASK(5, 0) + ++#define PCIE_TYPE0_HDR_DBI2_OFFSET 0x100000 ++ + struct rockchip_pcie { + struct dw_pcie pci; + void __iomem *apb_base; +@@ -198,6 +200,8 @@ static int rockchip_pcie_host_init(struct dw_pcie_rp *pp) + if (irq < 0) + return irq; + ++ pci->dbi_base2 = pci->dbi_base + PCIE_TYPE0_HDR_DBI2_OFFSET; ++ + ret = rockchip_pcie_init_irq_domain(rockchip); + if (ret < 0) + dev_err(dev, "failed to init irq domain\n"); +@@ -211,6 +215,10 @@ static int rockchip_pcie_host_init(struct dw_pcie_rp *pp) + rockchip_pcie_writel_apb(rockchip, PCIE_CLIENT_RC_MODE, + PCIE_CLIENT_GENERAL_CONTROL); + ++ /* Disable Root Ports BAR0 and BAR1 as they report bogus size */ ++ dw_pcie_writel_dbi2(pci, PCI_BASE_ADDRESS_0, 0x0); ++ dw_pcie_writel_dbi2(pci, PCI_BASE_ADDRESS_1, 0x0); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.1/pci-enable-acs-after-configuring-iommu-for-of-platfo.patch b/queue-6.1/pci-enable-acs-after-configuring-iommu-for-of-platfo.patch new file mode 100644 index 00000000000..e351f8a80f9 --- /dev/null +++ b/queue-6.1/pci-enable-acs-after-configuring-iommu-for-of-platfo.patch @@ -0,0 +1,136 @@ +From 3759237da48f6a9ddf536501b883e7f03d3e0118 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jan 2026 21:04:47 +0530 +Subject: PCI: Enable ACS after configuring IOMMU for OF platforms + +From: Manivannan Sadhasivam + +[ Upstream commit c41e2fb67e26b04d919257875fa954aa5f6e392e ] + +Platform, ACPI, or IOMMU drivers call pci_request_acs(), which sets +'pci_acs_enable' to request that ACS be enabled for any devices enumerated +in the future. + +OF platforms called pci_enable_acs() for the first device before +of_iommu_configure() called pci_request_acs(), so ACS was never enabled for +that device (typically a Root Port). + +Call pci_enable_acs() later, from pci_dma_configure(), after +of_dma_configure() has had a chance to call pci_request_acs(). + +Here's the call path, showing the move of pci_enable_acs() from +pci_acs_init() to pci_dma_configure(), where it always happens after +pci_request_acs(): + + pci_device_add + pci_init_capabilities + pci_acs_init + - pci_enable_acs + - if (pci_acs_enable) <-- previous test + - ... + device_add + bus_notify(BUS_NOTIFY_ADD_DEVICE) + iommu_bus_notifier + iommu_probe_device + iommu_init_device + dev->bus->dma_configure + pci_dma_configure # pci_bus_type.dma_configure + of_dma_configure + of_iommu_configure + pci_request_acs + pci_acs_enable = 1 <-- set + + pci_enable_acs + + if (pci_acs_enable) <-- new test + + ... + bus_probe_device + device_initial_probe + ... + really_probe + dev->bus->dma_configure + pci_dma_configure # pci_bus_type.dma_configure + ... + pci_enable_acs + +Note that we will now call pci_enable_acs() twice for every device, first +from the iommu_probe_device() path and again from the really_probe() path. +Presumably that's not an issue since we also call dev->bus->dma_configure() +twice. + +For the ACPI platforms, pci_request_acs() is called during ACPI +initialization time itself, independent of the IOMMU framework. + +Signed-off-by: Manivannan Sadhasivam +[bhelgaas: commit log] +Signed-off-by: Bjorn Helgaas +Tested-by: Marek Szyprowski +Tested-by: Naresh Kamboju +Link: https://patch.msgid.link/20260102-pci_acs-v3-1-72280b94d288@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/pci/pci-driver.c | 8 ++++++++ + drivers/pci/pci.c | 10 +--------- + drivers/pci/pci.h | 1 + + 3 files changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c +index fe6e5f716543a..8b5796a6ed5ff 100644 +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -1667,6 +1667,14 @@ static int pci_dma_configure(struct device *dev) + ret = acpi_dma_configure(dev, acpi_get_dma_attr(adev)); + } + ++ /* ++ * Attempt to enable ACS regardless of capability because some Root ++ * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have ++ * the standard ACS capability but still support ACS via those ++ * quirks. ++ */ ++ pci_enable_acs(to_pci_dev(dev)); ++ + pci_put_host_bridge_device(bridge); + + if (!ret && !driver->driver_managed_dma) { +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index c702d9feb905e..516c9f6dea202 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -980,7 +980,7 @@ static void pci_std_enable_acs(struct pci_dev *dev) + * pci_enable_acs - enable ACS if hardware support it + * @dev: the PCI device + */ +-static void pci_enable_acs(struct pci_dev *dev) ++void pci_enable_acs(struct pci_dev *dev) + { + if (!pci_acs_enable) + goto disable_acs_redir; +@@ -3715,14 +3715,6 @@ bool pci_acs_path_enabled(struct pci_dev *start, + void pci_acs_init(struct pci_dev *dev) + { + dev->acs_cap = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ACS); +- +- /* +- * Attempt to enable ACS regardless of capability because some Root +- * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have +- * the standard ACS capability but still support ACS via those +- * quirks. +- */ +- pci_enable_acs(dev); + } + + /** +diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h +index 38ad75ce52c32..fc760fd3ad948 100644 +--- a/drivers/pci/pci.h ++++ b/drivers/pci/pci.h +@@ -521,6 +521,7 @@ static inline resource_size_t pci_resource_alignment(struct pci_dev *dev, + } + + void pci_acs_init(struct pci_dev *dev); ++void pci_enable_acs(struct pci_dev *dev); + #ifdef CONFIG_PCI_QUIRKS + int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags); + int pci_dev_specific_enable_acs(struct pci_dev *dev); +-- +2.51.0 + diff --git a/queue-6.1/pci-fix-pci_slot_lock-device-locking.patch b/queue-6.1/pci-fix-pci_slot_lock-device-locking.patch new file mode 100644 index 00000000000..140a3109490 --- /dev/null +++ b/queue-6.1/pci-fix-pci_slot_lock-device-locking.patch @@ -0,0 +1,97 @@ +From b1afe02078fa8ac285d89605a3ac4cf654761b87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 08:59:51 -0800 +Subject: PCI: Fix pci_slot_lock () device locking + +From: Keith Busch + +[ Upstream commit 1f5e57c622b4dc9b8e7d291d560138d92cfbe5bf ] + +Like pci_bus_lock(), pci_slot_lock() needs to lock the bridge device to +prevent warnings like: + + pcieport 0000:e2:05.0: unlocked secondary bus reset via: pciehp_reset_slot+0x55/0xa0 + +Take and release the lock for the bridge providing the slot for the +lock/trylock and unlock routines. + +Signed-off-by: Keith Busch +Signed-off-by: Bjorn Helgaas +Reviewed-by: Dan Williams +Link: https://patch.msgid.link/20260130165953.751063-3-kbusch@meta.com +Signed-off-by: Sasha Levin +--- + drivers/pci/pci.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index bafa695bd7ec7..c702d9feb905e 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -5657,10 +5657,9 @@ static int pci_bus_trylock(struct pci_bus *bus) + /* Do any devices on or below this slot prevent a bus reset? */ + static bool pci_slot_resetable(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; + +- if (slot->bus->self && +- (slot->bus->self->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET)) ++ if (bridge && (bridge->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET)) + return false; + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { +@@ -5677,7 +5676,10 @@ static bool pci_slot_resetable(struct pci_slot *slot) + /* Lock devices from the top of the tree down */ + static void pci_slot_lock(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; ++ ++ if (bridge) ++ pci_dev_lock(bridge); + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { + if (!dev->slot || dev->slot != slot) +@@ -5692,7 +5694,7 @@ static void pci_slot_lock(struct pci_slot *slot) + /* Unlock devices from the bottom of the tree up */ + static void pci_slot_unlock(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { + if (!dev->slot || dev->slot != slot) +@@ -5702,12 +5704,18 @@ static void pci_slot_unlock(struct pci_slot *slot) + else + pci_dev_unlock(dev); + } ++ ++ if (bridge) ++ pci_dev_unlock(bridge); + } + + /* Return 1 on successful lock, 0 on contention */ + static int pci_slot_trylock(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; ++ ++ if (bridge && !pci_dev_trylock(bridge)) ++ return 0; + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { + if (!dev->slot || dev->slot != slot) +@@ -5732,6 +5740,9 @@ static int pci_slot_trylock(struct pci_slot *slot) + else + pci_dev_unlock(dev); + } ++ ++ if (bridge) ++ pci_dev_unlock(bridge); + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.1/pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch b/queue-6.1/pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch new file mode 100644 index 00000000000..5cf3129d4d0 --- /dev/null +++ b/queue-6.1/pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch @@ -0,0 +1,51 @@ +From 65b781b9cf8bced1d984842b661748b4f778b73d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 17:02:08 -0700 +Subject: PCI: Mark ASM1164 SATA controller to avoid bus reset + +From: Alex Williamson + +[ Upstream commit beb2f81792a8a619e5122b6b24a374861309c54b ] + +User forums report issues when assigning ASM1164 SATA controllers to VMs, +especially in configurations with multiple controllers. Logs show the +device fails to retrain after bus reset. Reports suggest this is an issue +across multiple platforms. The device indicates support for PM reset, +therefore the device still has a viable function level reset mechanism. +The reporting user confirms the device is well behaved in this use case +with bus reset disabled. + +Reported-by: Patrick Bianchi +Link: https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/ +Signed-off-by: Alex Williamson +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20260109000211.398300-1-alex.williamson@nvidia.com +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 9a2076ddfe4e1..28f8add367c00 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3676,6 +3676,16 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_CAVIUM, 0xa100, quirk_no_bus_reset); + */ + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TI, 0xb005, quirk_no_bus_reset); + ++/* ++ * Reports from users making use of PCI device assignment with ASM1164 ++ * controllers indicate an issue with bus reset where the device fails to ++ * retrain. The issue appears more common in configurations with multiple ++ * controllers. The device does indicate PM reset support (NoSoftRst-), ++ * therefore this still leaves a viable reset method. ++ * https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/ ++ */ ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ASMEDIA, 0x1164, quirk_no_bus_reset); ++ + static void quirk_no_pm_reset(struct pci_dev *dev) + { + /* +-- +2.51.0 + diff --git a/queue-6.1/pci-mark-nvidia-gb10-to-avoid-bus-reset.patch b/queue-6.1/pci-mark-nvidia-gb10-to-avoid-bus-reset.patch new file mode 100644 index 00000000000..28758b1fde6 --- /dev/null +++ b/queue-6.1/pci-mark-nvidia-gb10-to-avoid-bus-reset.patch @@ -0,0 +1,47 @@ +From e44aa8fb945d0e543a9293b3873d870a33743ff6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Nov 2025 16:44:06 +0800 +Subject: PCI: Mark Nvidia GB10 to avoid bus reset + +From: Johnny-CC Chang + +[ Upstream commit c81a2ce6b6a844d1a57d2a69833a9d0f00403f00 ] + +After asserting Secondary Bus Reset to downstream devices via a GB10 Root +Port, the link may not retrain correctly, e.g., the link may retrain with a +lower lane count or config accesses to downstream devices may fail. + +Prevent use of Secondary Bus Reset for devices below GB10. + +Signed-off-by: Johnny-CC Chang +[bhelgaas: drop pci_ids.h update (only used once), update commit log] +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Link: https://patch.msgid.link/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 11041831ed3c2..ce57d59a047e4 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3633,6 +3633,14 @@ static void quirk_no_bus_reset(struct pci_dev *dev) + dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET; + } + ++/* ++ * After asserting Secondary Bus Reset to downstream devices via a GB10 ++ * Root Port, the link may not retrain correctly. ++ * https://lore.kernel.org/r/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com ++ */ ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22CE, quirk_no_bus_reset); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22D0, quirk_no_bus_reset); ++ + /* + * Some NVIDIA GPU devices do not work with bus reset, SBR needs to be + * prevented for those affected devices. +-- +2.51.0 + diff --git a/queue-6.1/pci-msi-unmap-msi-x-region-on-error.patch b/queue-6.1/pci-msi-unmap-msi-x-region-on-error.patch new file mode 100644 index 00000000000..3ab13b34cd3 --- /dev/null +++ b/queue-6.1/pci-msi-unmap-msi-x-region-on-error.patch @@ -0,0 +1,49 @@ +From fafdf5f8f12c68e8a59dfab34d96756a5eb7c0e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 22:44:52 +0800 +Subject: PCI/MSI: Unmap MSI-X region on error + +From: Haoxiang Li + +[ Upstream commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202 ] + +msix_capability_init() fails to unmap the MSI-X region if +msix_setup_interrupts() fails. + +Add the missing iounmap() for that error path. + +[ tglx: Massaged change log ] + +Signed-off-by: Haoxiang Li +Signed-off-by: Thomas Gleixner +Link: https://patch.msgid.link/20260125144452.2103812-1-lihaoxiang@isrc.iscas.ac.cn +Signed-off-by: Sasha Levin +--- + drivers/pci/msi/msi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c +index 7110aed956c75..7a2375585338b 100644 +--- a/drivers/pci/msi/msi.c ++++ b/drivers/pci/msi/msi.c +@@ -648,7 +648,7 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries, + + ret = msix_setup_interrupts(dev, base, entries, nvec, affd); + if (ret) +- goto out_disable; ++ goto out_unmap; + + /* Disable INTX */ + pci_intx_for_msi(dev, 0); +@@ -667,6 +667,8 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries, + pcibios_free_irq(dev); + return 0; + ++out_unmap: ++ iounmap(dev->msix_base); + out_disable: + dev->msix_enabled = 0; + pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL | PCI_MSIX_FLAGS_ENABLE, 0); +-- +2.51.0 + diff --git a/queue-6.1/perf-arm-cmn-support-cmn-600ae.patch b/queue-6.1/perf-arm-cmn-support-cmn-600ae.patch new file mode 100644 index 00000000000..72fc0d9c07e --- /dev/null +++ b/queue-6.1/perf-arm-cmn-support-cmn-600ae.patch @@ -0,0 +1,50 @@ +From f5ccb4145327e7fdf90edf71a60eea9194cb3299 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 16:39:54 +0000 +Subject: perf/arm-cmn: Support CMN-600AE + +From: Robin Murphy + +[ Upstream commit 12a94953c37e834c3eabb839ce057094946fe67a ] + +The functional safety features of CMN-600AE have little to no impact on +the PMU relative to the base CMN-600 design, so for simplicity we can +reasonably just treat it as the same thing. The only obvious difference +is that the revision numbers aren't aligned, so we may hide some aliases +for events which do actually exist, but those can still be specified via +the underlying "type,eventid" format so it's not too big a deal. + +Signed-off-by: Robin Murphy +Reviewed-by: Ilkka Koskinen +Tested-by: Michal Simek +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm-cmn.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c +index b2e0a79254f1e..1270e40c95226 100644 +--- a/drivers/perf/arm-cmn.c ++++ b/drivers/perf/arm-cmn.c +@@ -202,6 +202,7 @@ enum cmn_model { + enum cmn_part { + PART_CMN600 = 0x434, + PART_CMN650 = 0x436, ++ PART_CMN600AE = 0x438, + PART_CMN700 = 0x43c, + PART_CI700 = 0x43a, + }; +@@ -2043,6 +2044,9 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset) + reg = readq_relaxed(cfg_region + CMN_CFGM_PERIPH_ID_01); + part = FIELD_GET(CMN_CFGM_PID0_PART_0, reg); + part |= FIELD_GET(CMN_CFGM_PID1_PART_1, reg) << 8; ++ /* 600AE is close enough that it's not really worth more complexity */ ++ if (part == PART_CMN600AE) ++ part = PART_CMN600; + if (cmn->part && cmn->part != part) + dev_warn(cmn->dev, + "Firmware binding mismatch: expected part number 0x%x, found 0x%x\n", +-- +2.51.0 + diff --git a/queue-6.1/perf-callchain-fix-srcline-printing-with-inlines.patch b/queue-6.1/perf-callchain-fix-srcline-printing-with-inlines.patch new file mode 100644 index 00000000000..2c4509036ed --- /dev/null +++ b/queue-6.1/perf-callchain-fix-srcline-printing-with-inlines.patch @@ -0,0 +1,55 @@ +From 225f51313f0d325684ecfb3aef86590fad274b45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 20:13:36 -0800 +Subject: perf callchain: Fix srcline printing with inlines + +From: Ian Rogers + +[ Upstream commit abec464767b5d26f0612250d511c18f420826ca1 ] + +sample__fprintf_callchain() was using map__fprintf_srcline() which won't +report inline line numbers. + +Fix by using the srcline from the callchain and falling back to the map +variant. + +Fixes: 25da4fab5f66e659 ("perf evsel: Move fprintf methods to separate source file") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Stephen Brennan +Cc: Tony Jones +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/evsel_fprintf.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/evsel_fprintf.c b/tools/perf/util/evsel_fprintf.c +index 8c2ea80013291..1f672449cb513 100644 +--- a/tools/perf/util/evsel_fprintf.c ++++ b/tools/perf/util/evsel_fprintf.c +@@ -177,8 +177,12 @@ int sample__fprintf_callchain(struct perf_sample *sample, int left_alignment, + printed += fprintf(fp, ")"); + } + +- if (print_srcline) +- printed += map__fprintf_srcline(map, addr, "\n ", fp); ++ if (print_srcline) { ++ if (node->srcline) ++ printed += fprintf(fp, "\n %s", node->srcline); ++ else ++ printed += map__fprintf_srcline(map, addr, "\n ", fp); ++ } + + if (sym && sym->inlined) + printed += fprintf(fp, " (inlined)"); +-- +2.51.0 + diff --git a/queue-6.1/phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch b/queue-6.1/phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch new file mode 100644 index 00000000000..f1789d41235 --- /dev/null +++ b/queue-6.1/phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch @@ -0,0 +1,38 @@ +From 0b784b67477ac2665207e7589e41373d29c55312 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 19:17:12 +0800 +Subject: phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature + +From: Xu Yang + +[ Upstream commit 27ee0869d77b2cb404770ac49bdceae3aedf658b ] + +Disabling PHYs in runtime usually causes the client with external abort +exception or similar issue due to lack of API to notify clients about PHY +removal. This patch removes the possibility to unbind i.MX PHY drivers in +runtime. + +Signed-off-by: Xu Yang +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20260120111712.3159782-1-xu.yang_2@nxp.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c +index a29b4a6f7c249..c2a6e70493ff7 100644 +--- a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c ++++ b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c +@@ -192,6 +192,7 @@ static struct platform_driver imx8mq_usb_phy_driver = { + .driver = { + .name = "imx8mq-usb-phy", + .of_match_table = imx8mq_usb_phy_of_match, ++ .suppress_bind_attrs = true, + } + }; + module_platform_driver(imx8mq_usb_phy_driver); +-- +2.51.0 + diff --git a/queue-6.1/phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch b/queue-6.1/phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch new file mode 100644 index 00000000000..2ba18d1311a --- /dev/null +++ b/queue-6.1/phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch @@ -0,0 +1,43 @@ +From 633bf4e37f7d7b68fac9c751427156201edf0fe2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 15:06:43 +0000 +Subject: phy: mvebu-cp110-utmi: fix dr_mode property read from dts + +From: Aleksandar Gerasimovski + +[ Upstream commit e2ce913452ab56b3330539cc443b97b7ea8c3a1a ] + +The problem with the current implementation is that it does not consider +that the USB controller can have multiple PHY handles with different +arguments count, as for example we have in our cn9131 based platform: +"phys = <&cp0_comphy1 0>, <&cp0_utmi0>;". + +In such case calling "of_usb_get_dr_mode_by_phy" with -1 (no phy-cells) +leads to not proper phy detection, taking the "marvell,cp110-utmi-phy" +dts definition we can call the "of_usb_get_dr_mode_by_phy" with 0 +(#phy-cells = <0>) and safely look for that phy. + +Signed-off-by: Aleksandar Gerasimovski +Link: https://patch.msgid.link/20260106150643.922110-1-aleksandar.gerasimovski@belden.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/marvell/phy-mvebu-cp110-utmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c +index aa27c79946104..1f4ead2583a47 100644 +--- a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c ++++ b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c +@@ -326,7 +326,7 @@ static int mvebu_cp110_utmi_phy_probe(struct platform_device *pdev) + return -ENOMEM; + } + +- port->dr_mode = of_usb_get_dr_mode_by_phy(child, -1); ++ port->dr_mode = of_usb_get_dr_mode_by_phy(child, 0); + if ((port->dr_mode != USB_DR_MODE_HOST) && + (port->dr_mode != USB_DR_MODE_PERIPHERAL)) { + dev_err(&pdev->dev, +-- +2.51.0 + diff --git a/queue-6.1/pstore-ram_core-fix-incorrect-success-return-when-vm.patch b/queue-6.1/pstore-ram_core-fix-incorrect-success-return-when-vm.patch new file mode 100644 index 00000000000..cbfba8bbdea --- /dev/null +++ b/queue-6.1/pstore-ram_core-fix-incorrect-success-return-when-vm.patch @@ -0,0 +1,49 @@ +From 0c7acbb806ae97bdb6fa9f287132dbb5305ebe54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 10:03:58 +0800 +Subject: pstore: ram_core: fix incorrect success return when vmap() fails + +From: Ruipeng Qi + +[ Upstream commit 05363abc7625cf18c96e67f50673cd07f11da5e9 ] + +In persistent_ram_vmap(), vmap() may return NULL on failure. + +If offset is non-zero, adding offset_in_page(start) causes the function +to return a non-NULL pointer even though the mapping failed. +persistent_ram_buffer_map() therefore incorrectly returns success. + +Subsequent access to prz->buffer may dereference an invalid address +and cause crashes. + +Add proper NULL checking for vmap() failures. + +Signed-off-by: Ruipeng Qi +Link: https://patch.msgid.link/20260203020358.3315299-1-ruipengqi3@gmail.com +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + fs/pstore/ram_core.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c +index 03d586f1ebc8c..0e58eb7ffac84 100644 +--- a/fs/pstore/ram_core.c ++++ b/fs/pstore/ram_core.c +@@ -457,6 +457,13 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size, + vaddr = vmap(pages, page_count, VM_MAP | VM_IOREMAP, prot); + kfree(pages); + ++ /* ++ * vmap() may fail and return NULL. Do not add the offset in this ++ * case, otherwise a NULL mapping would appear successful. ++ */ ++ if (!vaddr) ++ return NULL; ++ + /* + * Since vmap() uses page granularity, we must add the offset + * into the page here, to get the byte granularity address +-- +2.51.0 + diff --git a/queue-6.1/rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch b/queue-6.1/rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch new file mode 100644 index 00000000000..470cc89c52b --- /dev/null +++ b/queue-6.1/rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch @@ -0,0 +1,47 @@ +From aacd99f9b7b552f359e20835406161634c6d5e92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 17:15:16 +0100 +Subject: RDMA/rtrs-clt: For conn rejection use actual err number + +From: Md Haris Iqbal + +[ Upstream commit fc290630702b530c2969061e7ef0d869a5b6dc4f ] + +When the connection establishment request is rejected from the server +side, then the actual error number sent back should be used. + +Signed-off-by: Md Haris Iqbal +Link: https://patch.msgid.link/20260107161517.56357-10-haris.iqbal@ionos.com +Reviewed-by: Grzegorz Prajsner +Reviewed-by: Jack Wang +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +index 7c81452d73cfa..905693c686413 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +@@ -1923,7 +1923,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con, + struct rtrs_path *s = con->c.path; + const struct rtrs_msg_conn_rsp *msg; + const char *rej_msg; +- int status, errno; ++ int status, errno = -ECONNRESET; + u8 data_len; + + status = ev->status; +@@ -1945,7 +1945,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con, + status, rej_msg); + } + +- return -ECONNRESET; ++ return errno; + } + + void rtrs_clt_close_conns(struct rtrs_clt_path *clt_path, bool wait) +-- +2.51.0 + diff --git a/queue-6.1/remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch b/queue-6.1/remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch new file mode 100644 index 00000000000..b49e15aec08 --- /dev/null +++ b/queue-6.1/remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch @@ -0,0 +1,51 @@ +From 1175aac12eb6243421d8630fb3d02f3a4c610c60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Dec 2025 14:28:23 +0200 +Subject: remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox + TX channel is uninitialized + +From: Iuliana Prodan + +[ Upstream commit d62e0e92e589c53c4320ed5914af5fe103f5ce7e ] + +Firmwares that do not use mailbox communication (e.g., the hello_world +sample) leave priv->tx_ch as NULL. The current suspend logic +unconditionally sends RP_MBOX_SUSPEND_SYSTEM, which is invalid without +an initialized TX channel. + +Detect the no_mailboxes case early and skip sending the suspend +message. Instead, proceed directly to the runtime PM suspend path, +which is the correct behavior for firmwares that cannot respond to +mailbox requests. + +Signed-off-by: Iuliana Prodan +Link: https://lore.kernel.org/r/20251204122825.756106-1-iuliana.prodan@oss.nxp.com +Signed-off-by: Mathieu Poirier +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/imx_dsp_rproc.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/remoteproc/imx_dsp_rproc.c b/drivers/remoteproc/imx_dsp_rproc.c +index dcd07a6a5e945..7853d1a4ded85 100644 +--- a/drivers/remoteproc/imx_dsp_rproc.c ++++ b/drivers/remoteproc/imx_dsp_rproc.c +@@ -1229,6 +1229,15 @@ static __maybe_unused int imx_dsp_suspend(struct device *dev) + if (rproc->state != RPROC_RUNNING) + goto out; + ++ /* ++ * No channel available for sending messages; ++ * indicates no mailboxes present, so trigger PM runtime suspend ++ */ ++ if (!priv->tx_ch) { ++ dev_dbg(dev, "No initialized mbox tx channel, suspend directly.\n"); ++ goto out; ++ } ++ + reinit_completion(&priv->pm_comp); + + /* Tell DSP that suspend is happening */ +-- +2.51.0 + diff --git a/queue-6.1/remoteproc-mediatek-break-lock-dependency-to-prepare.patch b/queue-6.1/remoteproc-mediatek-break-lock-dependency-to-prepare.patch new file mode 100644 index 00000000000..109a97a7bf8 --- /dev/null +++ b/queue-6.1/remoteproc-mediatek-break-lock-dependency-to-prepare.patch @@ -0,0 +1,261 @@ +From 41c4c2c5d205b18ef766ab82a1c8443bfee84cf0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 11:07:55 +0000 +Subject: remoteproc: mediatek: Break lock dependency to `prepare_lock` + +From: Tzung-Bi Shih + +[ Upstream commit d935187cfb27fc4168f78f3959aef4eafaae76bb ] + +A potential circular locking dependency (ABBA deadlock) exists between +`ec_dev->lock` and the clock framework's `prepare_lock`. + +The first order (A -> B) occurs when scp_ipi_send() is called while +`ec_dev->lock` is held (e.g., within cros_ec_cmd_xfer()): +1. cros_ec_cmd_xfer() acquires `ec_dev->lock` and calls scp_ipi_send(). +2. scp_ipi_send() calls clk_prepare_enable(), which acquires + `prepare_lock`. +See #0 in the following example calling trace. +(Lock Order: `ec_dev->lock` -> `prepare_lock`) + +The reverse order (B -> A) is more complex and has been observed +(learned) by lockdep. It involves the clock prepare operation +triggering power domain changes, which then propagates through sysfs +and power supply uevents, eventually calling back into the ChromeOS EC +driver and attempting to acquire `ec_dev->lock`: +1. Something calls clk_prepare(), which acquires `prepare_lock`. It + then triggers genpd operations like genpd_runtime_resume(), which + takes `&genpd->mlock`. +2. Power domain changes can trigger regulator changes; regulator + changes can then trigger device link changes; device link changes + can then trigger sysfs changes. Eventually, power_supply_uevent() + is called. +3. This leads to calls like cros_usbpd_charger_get_prop(), which calls + cros_ec_cmd_xfer_status(), which then attempts to acquire + `ec_dev->lock`. +See #1 ~ #6 in the following example calling trace. +(Lock Order: `prepare_lock` -> `&genpd->mlock` -> ... -> `&ec_dev->lock`) + +Move the clk_prepare()/clk_unprepare() operations for `scp->clk` to the +remoteproc prepare()/unprepare() callbacks. This ensures `prepare_lock` +is only acquired in prepare()/unprepare() callbacks. Since +`ec_dev->lock` is not involved in the callbacks, the dependency loop is +broken. + +This means the clock is always "prepared" when the SCP is running. The +prolonged "prepared time" for the clock should be acceptable as SCP is +designed to be a very power efficient processor. The power consumption +impact can be negligible. + +A simplified calling trace reported by lockdep: +> -> #6 (&ec_dev->lock) +> cros_ec_cmd_xfer +> cros_ec_cmd_xfer_status +> cros_usbpd_charger_get_port_status +> cros_usbpd_charger_get_prop +> power_supply_get_property +> power_supply_show_property +> power_supply_uevent +> dev_uevent +> uevent_show +> dev_attr_show +> sysfs_kf_seq_show +> kernfs_seq_show +> -> #5 (kn->active#2) +> kernfs_drain +> __kernfs_remove +> kernfs_remove_by_name_ns +> sysfs_remove_file_ns +> device_del +> __device_link_del +> device_links_driver_bound +> -> #4 (device_links_lock) +> device_link_remove +> _regulator_put +> regulator_put +> -> #3 (regulator_list_mutex) +> regulator_lock_dependent +> regulator_disable +> scpsys_power_off +> _genpd_power_off +> genpd_power_off +> -> #2 (&genpd->mlock/1) +> genpd_add_subdomain +> pm_genpd_add_subdomain +> scpsys_add_subdomain +> scpsys_probe +> -> #1 (&genpd->mlock) +> genpd_runtime_resume +> __rpm_callback +> rpm_callback +> rpm_resume +> __pm_runtime_resume +> clk_core_prepare +> clk_prepare +> -> #0 (prepare_lock) +> clk_prepare +> scp_ipi_send +> scp_send_ipi +> mtk_rpmsg_send +> rpmsg_send +> cros_ec_pkt_xfer_rpmsg + +Signed-off-by: Tzung-Bi Shih +Reviewed-by: Chen-Yu Tsai +Tested-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20260112110755.2435899-1-tzungbi@kernel.org +Signed-off-by: Mathieu Poirier +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/mtk_scp.c | 39 +++++++++++++++++++++++--------- + drivers/remoteproc/mtk_scp_ipi.c | 4 ++-- + 2 files changed, 30 insertions(+), 13 deletions(-) + +diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c +index ffec5299b5c1d..8f513e66ef6bb 100644 +--- a/drivers/remoteproc/mtk_scp.c ++++ b/drivers/remoteproc/mtk_scp.c +@@ -225,7 +225,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv) + struct mtk_scp *scp = priv; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(scp->dev, "failed to enable clocks\n"); + return IRQ_NONE; +@@ -233,7 +233,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv) + + scp->data->scp_irq_handler(scp); + +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + + return IRQ_HANDLED; + } +@@ -467,7 +467,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw) + struct device *dev = scp->dev; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(dev, "failed to enable clocks\n"); + return ret; +@@ -482,7 +482,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw) + + ret = scp_elf_load_segments(rproc, fw); + leave: +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + + return ret; + } +@@ -493,14 +493,14 @@ static int scp_parse_fw(struct rproc *rproc, const struct firmware *fw) + struct device *dev = scp->dev; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(dev, "failed to enable clocks\n"); + return ret; + } + + ret = scp_ipi_init(scp, fw); +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + return ret; + } + +@@ -511,7 +511,7 @@ static int scp_start(struct rproc *rproc) + struct scp_run *run = &scp->run; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(dev, "failed to enable clocks\n"); + return ret; +@@ -536,14 +536,14 @@ static int scp_start(struct rproc *rproc) + goto stop; + } + +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + dev_info(dev, "SCP is ready. FW version %s\n", run->fw_ver); + + return 0; + + stop: + scp->data->scp_reset_assert(scp); +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + return ret; + } + +@@ -638,7 +638,7 @@ static int scp_stop(struct rproc *rproc) + struct mtk_scp *scp = (struct mtk_scp *)rproc->priv; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(scp->dev, "failed to enable clocks\n"); + return ret; +@@ -646,12 +646,29 @@ static int scp_stop(struct rproc *rproc) + + scp->data->scp_reset_assert(scp); + scp->data->scp_stop(scp); +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + + return 0; + } + ++static int scp_prepare(struct rproc *rproc) ++{ ++ struct mtk_scp *scp = rproc->priv; ++ ++ return clk_prepare(scp->clk); ++} ++ ++static int scp_unprepare(struct rproc *rproc) ++{ ++ struct mtk_scp *scp = rproc->priv; ++ ++ clk_unprepare(scp->clk); ++ return 0; ++} ++ + static const struct rproc_ops scp_ops = { ++ .prepare = scp_prepare, ++ .unprepare = scp_unprepare, + .start = scp_start, + .stop = scp_stop, + .load = scp_load, +diff --git a/drivers/remoteproc/mtk_scp_ipi.c b/drivers/remoteproc/mtk_scp_ipi.c +index 4c0d121c2f54d..156447dc59bbc 100644 +--- a/drivers/remoteproc/mtk_scp_ipi.c ++++ b/drivers/remoteproc/mtk_scp_ipi.c +@@ -164,7 +164,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len, + WARN_ON(len > sizeof(send_obj->share_buf)) || WARN_ON(!buf)) + return -EINVAL; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(scp->dev, "failed to enable clock\n"); + return ret; +@@ -207,7 +207,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len, + + unlock_mutex: + mutex_unlock(&scp->send_lock); +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + + return ret; + } +-- +2.51.0 + diff --git a/queue-6.1/revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch b/queue-6.1/revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch new file mode 100644 index 00000000000..32ff38b510d --- /dev/null +++ b/queue-6.1/revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch @@ -0,0 +1,42 @@ +From da9f6acd74c5a6a8f745c7c43e1ed993a3643ffb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 17:16:51 +0100 +Subject: Revert "mfd: da9052-spi: Change read-mask to write-mask" + +From: Marcus Folkesson + +[ Upstream commit 12daa9c1954542bf98bb942fb2dadf19de79a44b ] + +This reverts commit 2e3378f6c79a1b3f7855ded1ef306ea4406352ed. + +Almost every register in this chip can be customized via OTP +memory. Somehow the value for R19, which decide if the flag is set +on read or write operation, seems to have been overwritten for the chip +the original patch were written for. + +Revert the change to follow the default behavior. + +Signed-off-by: Marcus Folkesson +Link: https://patch.msgid.link/20251124-da9052-revert-v1-1-fbeb2c894002@gmail.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/da9052-spi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mfd/da9052-spi.c b/drivers/mfd/da9052-spi.c +index 458f919de4cb4..b79a57b45c1e8 100644 +--- a/drivers/mfd/da9052-spi.c ++++ b/drivers/mfd/da9052-spi.c +@@ -37,7 +37,7 @@ static int da9052_spi_probe(struct spi_device *spi) + spi_set_drvdata(spi, da9052); + + config = da9052_regmap_config; +- config.write_flag_mask = 1; ++ config.read_flag_mask = 1; + config.reg_bits = 7; + config.pad_bits = 1; + config.val_bits = 8; +-- +2.51.0 + diff --git a/queue-6.1/rnbd-srv-zero-the-rsp-buffer-before-using-it.patch b/queue-6.1/rnbd-srv-zero-the-rsp-buffer-before-using-it.patch new file mode 100644 index 00000000000..6e5bbaf1eb7 --- /dev/null +++ b/queue-6.1/rnbd-srv-zero-the-rsp-buffer-before-using-it.patch @@ -0,0 +1,47 @@ +From 84a0026c17a224ac365bca5c3010789f370f2536 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 13:47:33 +0100 +Subject: rnbd-srv: Zero the rsp buffer before using it + +From: Md Haris Iqbal + +[ Upstream commit 69d26698e4fd44935510553809007151b2fe4db5 ] + +Before using the data buffer to send back the response message, zero it +completely. This prevents any stray bytes to be picked up by the client +side when there the message is exchanged between different protocol +versions. + +Signed-off-by: Md Haris Iqbal +Signed-off-by: Jack Wang +Signed-off-by: Grzegorz Prajsner +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/rnbd/rnbd-srv.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c +index ad451224e6634..549b6581b7fea 100644 +--- a/drivers/block/rnbd/rnbd-srv.c ++++ b/drivers/block/rnbd/rnbd-srv.c +@@ -538,6 +538,8 @@ static void rnbd_srv_fill_msg_open_rsp(struct rnbd_msg_open_rsp *rsp, + { + struct block_device *bdev = sess_dev->bdev; + ++ memset(rsp, 0, sizeof(*rsp)); ++ + rsp->hdr.type = cpu_to_le16(RNBD_MSG_OPEN_RSP); + rsp->device_id = cpu_to_le32(sess_dev->device_id); + rsp->nsectors = cpu_to_le64(bdev_nr_sectors(bdev)); +@@ -643,6 +645,7 @@ static int process_msg_sess_info(struct rnbd_srv_session *srv_sess, + + trace_process_msg_sess_info(srv_sess, sess_info_msg); + ++ memset(rsp, 0, sizeof(*rsp)); + rsp->hdr.type = cpu_to_le16(RNBD_MSG_SESS_INFO_RSP); + rsp->ver = srv_sess->ver; + +-- +2.51.0 + diff --git a/queue-6.1/rtc-interface-alarm-race-handling-should-not-discard.patch b/queue-6.1/rtc-interface-alarm-race-handling-should-not-discard.patch new file mode 100644 index 00000000000..d281d3a17b2 --- /dev/null +++ b/queue-6.1/rtc-interface-alarm-race-handling-should-not-discard.patch @@ -0,0 +1,53 @@ +From d5dbdf8e0e7497e84aa7f6d059cd54b37000b507 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 17:35:19 +0000 +Subject: rtc: interface: Alarm race handling should not discard preceding + error + +From: Anthony Pighin (Nokia) + +[ Upstream commit 81be22cd4ace020045cc6d31255c6f7c071eb7c0 ] + +Commit 795cda8338ea ("rtc: interface: Fix long-standing race when setting +alarm") should not discard any errors from the preceding validations. + +Prior to that commit, if the alarm feature was disabled, or the +set_alarm failed, a meaningful error code would be returned to the +caller for further action. + +After, more often than not, the __rtc_read_time will cause a success +return code instead, misleading the caller. + +An example of this is when timer_enqueue is called for a rtc-abx080x +device. Since that driver does not clear the alarm feature bit, but +instead relies on the set_alarm operation to return invalid, the discard +of the return code causes very different behaviour; i.e. + hwclock: select() to /dev/rtc0 to wait for clock tick timed out + +Fixes: 795cda8338ea ("rtc: interface: Fix long-standing race when setting alarm") +Signed-off-by: Anthony Pighin (Nokia) +Reviewed-by: Esben Haabendal +Tested-by: Nick Bowler +Link: https://patch.msgid.link/BN0PR08MB6951415A751F236375A2945683D1A@BN0PR08MB6951.namprd08.prod.outlook.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/interface.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c +index 6cfeaed49d076..36642471c4a0c 100644 +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -457,7 +457,7 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm) + * are in, we can return -ETIME to signal that the timer has already + * expired, which is true in both cases. + */ +- if ((scheduled - now) <= 1) { ++ if (!err && (scheduled - now) <= 1) { + err = __rtc_read_time(rtc, &tm); + if (err) + return err; +-- +2.51.0 + diff --git a/queue-6.1/rtc-zynqmp-correct-frequency-value.patch b/queue-6.1/rtc-zynqmp-correct-frequency-value.patch new file mode 100644 index 00000000000..3a567a0fb07 --- /dev/null +++ b/queue-6.1/rtc-zynqmp-correct-frequency-value.patch @@ -0,0 +1,42 @@ +From fc25185d56b800a7092e590560396b9d0b9c4163 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 13:53:45 +0000 +Subject: rtc: zynqmp: correct frequency value + +From: Tomas Melin + +[ Upstream commit 2724fb4d429cbb724dcb6fa17953040918ebe3a2 ] + +Fix calibration value in case a clock reference is provided. +The actual calibration value written into register is +frequency - 1. + +Reviewed-by: Harini T +Tested-by: Harini T +Signed-off-by: Tomas Melin +Acked-by: Michal Simek +Link: https://patch.msgid.link/20260122-zynqmp-rtc-updates-v4-1-d4edb966b499@vaisala.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-zynqmp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/rtc/rtc-zynqmp.c b/drivers/rtc/rtc-zynqmp.c +index e8a2cad05e505..d87f2f527b977 100644 +--- a/drivers/rtc/rtc-zynqmp.c ++++ b/drivers/rtc/rtc-zynqmp.c +@@ -330,7 +330,10 @@ static int xlnx_rtc_probe(struct platform_device *pdev) + &xrtcdev->freq); + if (ret) + xrtcdev->freq = RTC_CALIB_DEF; ++ } else { ++ xrtcdev->freq--; + } ++ + ret = readl(xrtcdev->reg_base + RTC_CALIB_RD); + if (!ret) + writel(xrtcdev->freq, (xrtcdev->reg_base + RTC_CALIB_WR)); +-- +2.51.0 + diff --git a/queue-6.1/s390-perf-disable-register-readout-on-sampling-event.patch b/queue-6.1/s390-perf-disable-register-readout-on-sampling-event.patch new file mode 100644 index 00000000000..b2e49795c58 --- /dev/null +++ b/queue-6.1/s390-perf-disable-register-readout-on-sampling-event.patch @@ -0,0 +1,53 @@ +From f19be146bb04370a106f87d478f4e8d3109edc6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 10:14:12 +0100 +Subject: s390/perf: Disable register readout on sampling events + +From: Thomas Richter + +[ Upstream commit b2c04fc1239062b39ddfdd8731ee1a10810dfb74 ] + +Running commands + # ./perf record -IR0,R1 -a sleep 1 +extracts and displays register value of general purpose register r1 and r0. +However the value displayed of any register is random and does not +reflect the register value recorded at the time of the sample interrupt. + +The sampling device driver on s390 creates a very large buffer +for the hardware to store the samples. Only when that large buffer +gets full an interrupt is generated and many hundreds of sample +entries are processed and copied to the kernel ring buffer and +eventually get copied to the perf tool. It is during the copy +to the kernel ring buffer that each sample is processed (on s390) +and at that time the register values are extracted. +This is not the original goal, the register values should be read +when the samples are created not when the samples are copied to the +kernel ring buffer. + +Prevent this event from being installed in the first place and +return -EOPNOTSUPP. This is already the case for PERF_SAMPLE_REGS_USER. + +Signed-off-by: Thomas Richter +Reviewed-by: Jan Polensky +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/perf_cpum_sf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c +index 46a1a85a0e440..96fd3654abda4 100644 +--- a/arch/s390/kernel/perf_cpum_sf.c ++++ b/arch/s390/kernel/perf_cpum_sf.c +@@ -887,7 +887,7 @@ static bool is_callchain_event(struct perf_event *event) + u64 sample_type = event->attr.sample_type; + + return sample_type & (PERF_SAMPLE_CALLCHAIN | PERF_SAMPLE_REGS_USER | +- PERF_SAMPLE_STACK_USER); ++ PERF_SAMPLE_REGS_INTR | PERF_SAMPLE_STACK_USER); + } + + static int cpumsf_pmu_event_init(struct perf_event *event) +-- +2.51.0 + diff --git a/queue-6.1/s390-purgatory-add-wno-default-const-init-unsafe-to-.patch b/queue-6.1/s390-purgatory-add-wno-default-const-init-unsafe-to-.patch new file mode 100644 index 00000000000..dcbf25d4537 --- /dev/null +++ b/queue-6.1/s390-purgatory-add-wno-default-const-init-unsafe-to-.patch @@ -0,0 +1,45 @@ +From be2c6998baf4ed79f5beea0831890465d338bb5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Dec 2025 16:47:07 +0100 +Subject: s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS + +From: Heiko Carstens + +[ Upstream commit b4780fe4ddf04b51127a33d705f4a2e224df00fa ] + +Add -Wno-default-const-init-unsafe to purgatory KBUILD_CFLAGS, similar +to scripts/Makefile.extrawarn, since clang generates warnings for the +dummy variable in typecheck(): + + CC arch/s390/purgatory/purgatory.o + arch/s390/include/asm/ptrace.h:221:9: warning: default initialization of an object of type 'typeof (regs->psw)' (aka 'const psw_t') leaves the object uninitialized [-Wdefault-const-init-var-unsafe] + 221 | return psw_bits(regs->psw).pstate; + | ^ + arch/s390/include/asm/ptrace.h:98:2: note: expanded from macro 'psw_bits' + 98 | typecheck(psw_t, __psw); \ + | ^ + include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck' + 11 | typeof(x) __dummy2; \ + | ^ + +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/purgatory/Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/s390/purgatory/Makefile b/arch/s390/purgatory/Makefile +index be0626a07dd85..a8c2228b08bc3 100644 +--- a/arch/s390/purgatory/Makefile ++++ b/arch/s390/purgatory/Makefile +@@ -29,6 +29,7 @@ KBUILD_CFLAGS += -fno-stack-protector + KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING + KBUILD_CFLAGS += $(CLANG_FLAGS) + KBUILD_CFLAGS += $(call cc-option,-fno-PIE) ++KBUILD_CFLAGS += $(call cc-option, -Wno-default-const-init-unsafe) + KBUILD_AFLAGS := $(filter-out -DCC_USING_EXPOLINE,$(KBUILD_AFLAGS)) + + # Since we link purgatory with -r unresolved symbols are not checked, so we +-- +2.51.0 + diff --git a/queue-6.1/scsi-buslogic-reduce-stack-usage.patch b/queue-6.1/scsi-buslogic-reduce-stack-usage.patch new file mode 100644 index 00000000000..a1994715b4f --- /dev/null +++ b/queue-6.1/scsi-buslogic-reduce-stack-usage.patch @@ -0,0 +1,66 @@ +From 30a93021f98ee4ca6171ab6c8ca5e0e960643641 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 17:33:15 +0100 +Subject: scsi: buslogic: Reduce stack usage + +From: Arnd Bergmann + +[ Upstream commit e17f0d4cc006265dd92129db4bf9da3a2e4a4f66 ] + +Some randconfig builds run into excessive stack usage with gcc-14 or +higher, which use __attribute__((cold)) where earlier versions did not do +that: + +drivers/scsi/BusLogic.c: In function 'blogic_init': +drivers/scsi/BusLogic.c:2398:1: error: the frame size of 1680 bytes is larger than 1536 bytes [-Werror=frame-larger-than=] + +The problem is that a lot of code gets inlined into blogic_init() here. Two +functions stick out, but they are a bit different: + + - blogic_init_probeinfo_list() actually uses a few hundred bytes of kernel + stack, which is a problem in combination with other functions that also + do. Marking this one as noinline means that the stack slots get get + reused between function calls + + - blogic_reportconfig() has a few large variables, but whenever it is not + inlined into its caller, the compiler is actually smart enough to reuse + stack slots for these automatically, so marking it as noinline saves + most of the stack space by itself. + +The combination of both of these should avoid the problem entirely. + +Signed-off-by: Arnd Bergmann +Link: https://patch.msgid.link/20260203163321.2598593-1-arnd@kernel.org +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/BusLogic.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c +index f2abffce26599..c4bd4d18a0440 100644 +--- a/drivers/scsi/BusLogic.c ++++ b/drivers/scsi/BusLogic.c +@@ -919,7 +919,8 @@ static int __init blogic_init_fp_probeinfo(struct blogic_adapter *adapter) + a particular probe order. + */ + +-static void __init blogic_init_probeinfo_list(struct blogic_adapter *adapter) ++static noinline_for_stack void __init ++blogic_init_probeinfo_list(struct blogic_adapter *adapter) + { + /* + If a PCI BIOS is present, interrogate it for MultiMaster and +@@ -1689,7 +1690,8 @@ static bool __init blogic_rdconfig(struct blogic_adapter *adapter) + blogic_reportconfig reports the configuration of Host Adapter. + */ + +-static bool __init blogic_reportconfig(struct blogic_adapter *adapter) ++static noinline_for_stack bool __init ++blogic_reportconfig(struct blogic_adapter *adapter) + { + unsigned short alltgt_mask = (1 << adapter->maxdev) - 1; + unsigned short sync_ok, fast_ok; +-- +2.51.0 + diff --git a/queue-6.1/serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch b/queue-6.1/serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch new file mode 100644 index 00000000000..910425ed2c6 --- /dev/null +++ b/queue-6.1/serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch @@ -0,0 +1,46 @@ +From f48e4e94adc919d68a2550ffe5bbbc8e0f4ef9ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 13:48:29 +0530 +Subject: serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA + termination is done + +From: Moteen Shah + +[ Upstream commit a5fd8945a478ff9be14812693891d7c9b4185a50 ] + +Clear rx_running flag only after DMA teardown polling completes. In the +previous implementation the flag was being cleared while hardware teardown +was still in progress, creating a mismatch between software state +(flag = 0, "ready") and hardware state (still terminating). + +Signed-off-by: Moteen Shah +Link: https://patch.msgid.link/20260112081829.63049-3-m-shah@ti.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 66fbc5ad8c72a..5b5debb1f30d8 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -835,7 +835,6 @@ static void __dma_rx_do_complete(struct uart_8250_port *p) + goto out; + + cookie = dma->rx_cookie; +- dma->rx_running = 0; + + /* Re-enable RX FIFO interrupt now that transfer is complete */ + if (priv->habit & UART_HAS_RHR_IT_DIS) { +@@ -869,6 +868,7 @@ static void __dma_rx_do_complete(struct uart_8250_port *p) + goto out; + ret = tty_insert_flip_string(tty_port, dma->rx_buf, count); + ++ dma->rx_running = 0; + p->port.icount.rx += ret; + p->port.icount.buf_overrun += count - ret; + out: +-- +2.51.0 + diff --git a/queue-6.1/serial-8250_dw-handle-clock-enable-errors-in-runtime.patch b/queue-6.1/serial-8250_dw-handle-clock-enable-errors-in-runtime.patch new file mode 100644 index 00000000000..e2de6301b5e --- /dev/null +++ b/queue-6.1/serial-8250_dw-handle-clock-enable-errors-in-runtime.patch @@ -0,0 +1,57 @@ +From 1011c61392da6d1fb42f84f2f41b9d3b55f2b4e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 17:54:25 +0300 +Subject: serial: 8250_dw: handle clock enable errors in runtime_resume + +From: Artem Shimko + +[ Upstream commit d31228143a489ba6ba797896a07541ce06828c09 ] + +Add error checking for clk_prepare_enable() calls in +dw8250_runtime_resume(). Currently if either clock fails to enable, +the function returns success while leaving clocks in inconsistent state. + +This change implements comprehensive error handling by checking the return +values of both clk_prepare_enable() calls. If the second clock enable +operation fails after the first clock has already been successfully +enabled, the code now properly cleans up by disabling and unpreparing +the first clock before returning. The error code is then propagated to +the caller, ensuring that clock enable failures are properly reported +rather than being silently ignored. + +Signed-off-by: Artem Shimko +Link: https://patch.msgid.link/20251104145433.2316165-2-a.shimko.dev@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_dw.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c +index c9ea854764778..ee589ad526699 100644 +--- a/drivers/tty/serial/8250/8250_dw.c ++++ b/drivers/tty/serial/8250/8250_dw.c +@@ -738,11 +738,18 @@ static int dw8250_runtime_suspend(struct device *dev) + + static int dw8250_runtime_resume(struct device *dev) + { ++ int ret; + struct dw8250_data *data = dev_get_drvdata(dev); + +- clk_prepare_enable(data->pclk); ++ ret = clk_prepare_enable(data->pclk); ++ if (ret) ++ return ret; + +- clk_prepare_enable(data->clk); ++ ret = clk_prepare_enable(data->clk); ++ if (ret) { ++ clk_disable_unprepare(data->pclk); ++ return ret; ++ } + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.1/series b/queue-6.1/series index 260941ace1a..3132abf6abb 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -244,3 +244,166 @@ drm-i915-acpi-free-_dsm-package-when-no-connectors.patch btrfs-fix-invalid-leaf-access-in-btrfs_quota_enable-.patch asoc-rockchip-i2s-tdm-use-param-rate-if-not-provided.patch drm-amd-display-use-same-max-plane-scaling-limits-fo.patch +perf-callchain-fix-srcline-printing-with-inlines.patch +libperf-don-t-remove-g-when-extra_cflags-are-used.patch +libperf-build-always-place-libperf-includes-first.patch +rtc-interface-alarm-race-handling-should-not-discard.patch +audit-add-fchmodat2-to-change-attributes-class.patch +hfsplus-fix-volume-corruption-issue-for-generic-498.patch +fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch +audit-add-missing-syscalls-to-read-class.patch +hfsplus-pretend-special-inodes-as-regular-files.patch +i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch +minix-add-required-sanity-checking-to-minix_check_su.patch +smb-client-add-proper-locking-around-ses-iface_last_.patch +gfs2-fiemap-page-fault-fix.patch +tools-power-cpupower-reset-errno-before-strtoull.patch +s390-purgatory-add-wno-default-const-init-unsafe-to-.patch +perf-arm-cmn-support-cmn-600ae.patch +arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch +rnbd-srv-zero-the-rsp-buffer-before-using-it.patch +x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch +efi-cper-don-t-dump-the-entire-memory-region.patch +apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch +efi-cper-don-t-go-past-the-arm-processor-cper-record.patch +acpi-processor-fix-null-pointer-dereference-in-acpi_.patch +acpica-abort-aml-bytecode-execution-when-executing-a.patch +s390-perf-disable-register-readout-on-sampling-event.patch +xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch +blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch +sparc-synchronize-user-stack-on-fork-and-clone.patch +sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch +bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch +clocksource-drivers-sh_tmu-always-leave-device-runni.patch +clocksource-drivers-timer-integrator-ap-add-missing-.patch +pci-msi-unmap-msi-x-region-on-error.patch +mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch +char-tpm-cr50-remove-irqf_oneshot.patch +pstore-ram_core-fix-incorrect-success-return-when-vm.patch +arm64-tegra-smaug-add-usb-role-switch-support.patch +parisc-prevent-interrupts-during-reboot.patch +drm-display-dp_mst-add-protection-against-0-vcpi.patch +spi-geni-qcom-initialize-mode-related-registers-to-0.patch +media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch +spi-stm32-fix-overrun-issue-at-8bpw.patch +drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch +media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch +media-omap3isp-isppreview-always-clamp-in-preview_tr.patch +media-omap3isp-set-initial-format.patch +hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch +asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch +asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch +media-amphion-clear-last_buffer_dequeued-flag-for-de.patch +media-adv7180-fix-frame-interval-in-progressive-mode.patch +media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch +media-solo6x10-check-for-out-of-bounds-chip_id.patch +media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch +drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch +drm-account-property-blob-allocations-to-memcg.patch +hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch +virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch +drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch +drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch +drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch +media-rkisp1-fix-filter-mode-register-configuration.patch +hid-multitouch-add-egalaxtouch-exc3188-support.patch +hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch +gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch +asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch +spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch +asoc-codecs-max98390-check-return-value-of-devm_gpio.patch +hwmon-f71882fg-add-f81968-support.patch +asoc-es8328-add-error-unwind-in-resume.patch +modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch +alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch +jfs-add-missing-set_freezable-for-freezable-kthread.patch +jfs-nlink-overflow-in-jfs_rename.patch +wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch +wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch +dm-remove-fake-timeout-to-avoid-leak-request.patch +iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch +wifi-libertas-fix-warning-in-usb_tx_block.patch +pci-dw-rockchip-disable-bar-0-and-bar-1-for-root-por.patch +ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch +ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch +ext4-mark-group-add-fast-commit-ineligible.patch +ext4-mark-group-extend-fast-commit-ineligible.patch +netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch +netfilter-xt_tcpmss-check-remaining-length-before-re.patch +openrisc-define-arch-specific-version-of-nop.patch +net-usb-r8152-fix-transmit-queue-timeout.patch +net-rds-no-shortcut-out-of-rds_conn_error.patch +gro-change-the-bug_on-in-gro_pull_from_frag0.patch +net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch +wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch +wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch +ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch +bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch +bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch +bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch +octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch +wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch +wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch +net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch +vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch +net-rds-clear-reconnect-pending-bit.patch +pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch +pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch +pci-fix-pci_slot_lock-device-locking.patch +pci-enable-acs-after-configuring-iommu-for-of-platfo.patch +pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch +pci-mark-nvidia-gb10-to-avoid-bus-reset.patch +myri10ge-avoid-uninitialized-variable-use.patch +nfc-nxp-nci-remove-interrupt-trigger-type.patch +rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch +hisi_acc_vfio_pci-update-status-after-ras-error.patch +scsi-buslogic-reduce-stack-usage.patch +tracing-fix-false-sharing-in-hwlat-get_sample.patch +remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch +mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch +mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch +mailbox-sprd-mask-interrupts-that-are-not-handled.patch +remoteproc-mediatek-break-lock-dependency-to-prepare.patch +mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch +clk-microchip-core-correct-return-value-on-_get_pare.patch +m68k-nommu-fix-memmove-with-differently-aligned-src-.patch +soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch +staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch +serial-8250_dw-handle-clock-enable-errors-in-runtime.patch +usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch +fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch +dmaengine-sun6i-choose-appropriate-burst-length-unde.patch +dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch +misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch +misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch +staging-rtl8723bs-fix-memory-leak-on-failure-path.patch +serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch +fix-it87_wdt-early-reboot-by-reporting-running-timer.patch +binder-don-t-use-pk-through-printk.patch +watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch +phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch +phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch +revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch +iio-use-irqf_no_thread.patch +iio-magnetometer-remove-irqf_oneshot.patch +mips-loongson-make-cpumask_of_node-robust-against-nu.patch +fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch +fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch +fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch +fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch +fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch +ceph-supply-snapshot-context-in-ceph_uninline_data.patch +libceph-define-and-enforce-ceph_max_key_len.patch +include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch +arm-9467-1-mm-don-t-use-pk-through-printk.patch +drm-amd-display-avoid-updating-surface-with-the-same.patch +drm-amdgpu-adjust-usleep_range-in-fence-wait.patch +alsa-usb-audio-update-the-number-of-packets-properly.patch +drm-amdgpu-add-hainan-clock-adjustment.patch +drm-radeon-add-hainan-clock-adjustment.patch +alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch +btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch +drm-amd-display-remove-conditional-for-shaper-3dlut-.patch +rtc-zynqmp-correct-frequency-value.patch +ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch +ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch diff --git a/queue-6.1/smb-client-add-proper-locking-around-ses-iface_last_.patch b/queue-6.1/smb-client-add-proper-locking-around-ses-iface_last_.patch new file mode 100644 index 00000000000..368ba024a64 --- /dev/null +++ b/queue-6.1/smb-client-add-proper-locking-around-ses-iface_last_.patch @@ -0,0 +1,36 @@ +From 383ae05dd8b5a60e97f16396888d4915334563ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 14:54:45 -0300 +Subject: smb: client: add proper locking around ses->iface_last_update + +From: Henrique Carvalho + +[ Upstream commit e97dcac3dc0bd37e4b56aaa6874b572a3a461102 ] + +There is a missing ses->iface_lock in cifs_setup_session, +around ses->iface_last_update. + +Signed-off-by: Henrique Carvalho +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/connect.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c +index fba6471973ef0..e909f8d720147 100644 +--- a/fs/smb/client/connect.c ++++ b/fs/smb/client/connect.c +@@ -4287,7 +4287,9 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses, + ses->ses_status = SES_IN_SETUP; + + /* force iface_list refresh */ ++ spin_lock(&ses->iface_lock); + ses->iface_last_update = 0; ++ spin_unlock(&ses->iface_lock); + } + spin_unlock(&ses->ses_lock); + +-- +2.51.0 + diff --git a/queue-6.1/soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch b/queue-6.1/soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch new file mode 100644 index 00000000000..f350f445136 --- /dev/null +++ b/queue-6.1/soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch @@ -0,0 +1,49 @@ +From 725fa052aabf336973c6e7e154ebf7346236e472 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 15:09:47 +0200 +Subject: soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of + NUC15) + +From: Peter Ujfalusi + +[ Upstream commit 59946373755d71dbd7614ba235e0093159f80b69 ] + +Avell B.ON is an OEM re-branded NUC15 'Bishop County' LAPBC510 and +LAPBC710. + +Link: https://github.com/thesofproject/linux/issues/5529 +Signed-off-by: Peter Ujfalusi +Reviewed-by: Kai Vehmanen +Reviewed-by: Bard Liao +Link: https://patch.msgid.link/20251215130947.31385-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/dmi-quirks.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/soundwire/dmi-quirks.c b/drivers/soundwire/dmi-quirks.c +index 91ab97a456fa9..5854218e1a274 100644 +--- a/drivers/soundwire/dmi-quirks.c ++++ b/drivers/soundwire/dmi-quirks.c +@@ -122,6 +122,17 @@ static const struct dmi_system_id adr_remap_quirk_table[] = { + }, + .driver_data = (void *)intel_tgl_bios, + }, ++ { ++ /* ++ * quirk used for Avell B.ON (OEM rebrand of NUC15 'Bishop County' ++ * LAPBC510 and LAPBC710) ++ */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Avell High Performance"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "B.ON"), ++ }, ++ .driver_data = (void *)intel_tgl_bios, ++ }, + { + /* quirk used for NUC15 'Rooks County' LAPRC510 and LAPRC710 skews */ + .matches = { +-- +2.51.0 + diff --git a/queue-6.1/sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch b/queue-6.1/sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch new file mode 100644 index 00000000000..b6a7d5b3965 --- /dev/null +++ b/queue-6.1/sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch @@ -0,0 +1,50 @@ +From b5be324ebaece5215608186dd7c812861f1293cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 13:40:29 +0000 +Subject: sparc: don't reference obsolete termio struct for TC* constants + +From: Sam James + +[ Upstream commit be0bccffcde3308150d2a90e55fc10e249098909 ] + +Similar in nature to commit ab107276607a ("powerpc: Fix struct termio related ioctl macros"). + +glibc-2.42 drops the legacy termio struct, but the ioctls.h header still +defines some TC* constants in terms of termio (via sizeof). Hardcode the +values instead. + +This fixes building Python for example, which falls over like: + ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio' + +Link: https://bugs.gentoo.org/961769 +Link: https://bugs.gentoo.org/962600 +Signed-off-by: Sam James +Reviewed-by: Andreas Larsson +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/include/uapi/asm/ioctls.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/sparc/include/uapi/asm/ioctls.h b/arch/sparc/include/uapi/asm/ioctls.h +index 7fd2f5873c9e7..a8bbdf9877a41 100644 +--- a/arch/sparc/include/uapi/asm/ioctls.h ++++ b/arch/sparc/include/uapi/asm/ioctls.h +@@ -5,10 +5,10 @@ + #include + + /* Big T */ +-#define TCGETA _IOR('T', 1, struct termio) +-#define TCSETA _IOW('T', 2, struct termio) +-#define TCSETAW _IOW('T', 3, struct termio) +-#define TCSETAF _IOW('T', 4, struct termio) ++#define TCGETA 0x40125401 /* _IOR('T', 1, struct termio) */ ++#define TCSETA 0x80125402 /* _IOW('T', 2, struct termio) */ ++#define TCSETAW 0x80125403 /* _IOW('T', 3, struct termio) */ ++#define TCSETAF 0x80125404 /* _IOW('T', 4, struct termio) */ + #define TCSBRK _IO('T', 5) + #define TCXONC _IO('T', 6) + #define TCFLSH _IO('T', 7) +-- +2.51.0 + diff --git a/queue-6.1/sparc-synchronize-user-stack-on-fork-and-clone.patch b/queue-6.1/sparc-synchronize-user-stack-on-fork-and-clone.patch new file mode 100644 index 00000000000..ded9fefb7ca --- /dev/null +++ b/queue-6.1/sparc-synchronize-user-stack-on-fork-and-clone.patch @@ -0,0 +1,114 @@ +From 13846c291a2df2661794866d72b7d47a56e7cad8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 15:47:52 +0100 +Subject: sparc: Synchronize user stack on fork and clone + +From: Andreas Larsson + +[ Upstream commit e38eba3b77878ada327a572a41596a3b0b44e522 ] + +Flush all uncommitted user windows before calling the generic syscall +handlers for clone, fork, and vfork. + +Prior to entering the arch common handlers sparc_{clone|fork|vfork}, the +arch-specific syscall wrappers for these syscalls will attempt to flush +all windows (including user windows). + +In the window overflow trap handlers on both SPARC{32|64}, +if the window can't be stored (i.e due to MMU related faults) the routine +backups the user window and increments a thread counter (wsaved). + +By adding a synchronization point after the flush attempt, when fault +handling is enabled, any uncommitted user windows will be flushed. + +Link: https://sourceware.org/bugzilla/show_bug.cgi?id=31394 +Closes: https://lore.kernel.org/sparclinux/fe5cc47167430007560501aabb28ba154985b661.camel@physik.fu-berlin.de/ +Signed-off-by: Andreas Larsson +Signed-off-by: Ludwig Rydberg +Tested-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/20260119144753.27945-2-ludwig.rydberg@gaisler.com +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/kernel/process.c | 38 +++++++++++++++++++++++-------------- + 1 file changed, 24 insertions(+), 14 deletions(-) + +diff --git a/arch/sparc/kernel/process.c b/arch/sparc/kernel/process.c +index 0442ab00518d3..7d69877511fac 100644 +--- a/arch/sparc/kernel/process.c ++++ b/arch/sparc/kernel/process.c +@@ -17,14 +17,18 @@ + + asmlinkage long sparc_fork(struct pt_regs *regs) + { +- unsigned long orig_i1 = regs->u_regs[UREG_I1]; ++ unsigned long orig_i1; + long ret; + struct kernel_clone_args args = { + .exit_signal = SIGCHLD, +- /* Reuse the parent's stack for the child. */ +- .stack = regs->u_regs[UREG_FP], + }; + ++ synchronize_user_stack(); ++ ++ orig_i1 = regs->u_regs[UREG_I1]; ++ /* Reuse the parent's stack for the child. */ ++ args.stack = regs->u_regs[UREG_FP]; ++ + ret = kernel_clone(&args); + + /* If we get an error and potentially restart the system +@@ -40,16 +44,19 @@ asmlinkage long sparc_fork(struct pt_regs *regs) + + asmlinkage long sparc_vfork(struct pt_regs *regs) + { +- unsigned long orig_i1 = regs->u_regs[UREG_I1]; ++ unsigned long orig_i1; + long ret; +- + struct kernel_clone_args args = { + .flags = CLONE_VFORK | CLONE_VM, + .exit_signal = SIGCHLD, +- /* Reuse the parent's stack for the child. */ +- .stack = regs->u_regs[UREG_FP], + }; + ++ synchronize_user_stack(); ++ ++ orig_i1 = regs->u_regs[UREG_I1]; ++ /* Reuse the parent's stack for the child. */ ++ args.stack = regs->u_regs[UREG_FP]; ++ + ret = kernel_clone(&args); + + /* If we get an error and potentially restart the system +@@ -65,15 +72,18 @@ asmlinkage long sparc_vfork(struct pt_regs *regs) + + asmlinkage long sparc_clone(struct pt_regs *regs) + { +- unsigned long orig_i1 = regs->u_regs[UREG_I1]; +- unsigned int flags = lower_32_bits(regs->u_regs[UREG_I0]); ++ unsigned long orig_i1; ++ unsigned int flags; + long ret; ++ struct kernel_clone_args args = {0}; + +- struct kernel_clone_args args = { +- .flags = (flags & ~CSIGNAL), +- .exit_signal = (flags & CSIGNAL), +- .tls = regs->u_regs[UREG_I3], +- }; ++ synchronize_user_stack(); ++ ++ orig_i1 = regs->u_regs[UREG_I1]; ++ flags = lower_32_bits(regs->u_regs[UREG_I0]); ++ args.flags = (flags & ~CSIGNAL); ++ args.exit_signal = (flags & CSIGNAL); ++ args.tls = regs->u_regs[UREG_I3]; + + #ifdef CONFIG_COMPAT + if (test_thread_flag(TIF_32BIT)) { +-- +2.51.0 + diff --git a/queue-6.1/spi-geni-qcom-initialize-mode-related-registers-to-0.patch b/queue-6.1/spi-geni-qcom-initialize-mode-related-registers-to-0.patch new file mode 100644 index 00000000000..104f287af51 --- /dev/null +++ b/queue-6.1/spi-geni-qcom-initialize-mode-related-registers-to-0.patch @@ -0,0 +1,40 @@ +From 5862947cc7057d56ea0fe712ec9370f123d9a658 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Nov 2025 16:12:01 -0500 +Subject: spi-geni-qcom: initialize mode related registers to 0 + +From: Jonathan Marek + +[ Upstream commit 739062a9f1e9a77a9687c8fd30f8e5dd12ec70be ] + +setup_fifo_params assumes these will be zero, it won't write these +registers if the initial mode is zero. + +Signed-off-by: Jonathan Marek +Link: https://patch.msgid.link/20251120211204.24078-4-jonathan@marek.ca +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-geni-qcom.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c +index 17b5299c18c73..61c50adac0435 100644 +--- a/drivers/spi/spi-geni-qcom.c ++++ b/drivers/spi/spi-geni-qcom.c +@@ -608,6 +608,12 @@ static int spi_geni_init(struct spi_geni_master *mas) + case 0: + mas->cur_xfer_mode = GENI_SE_FIFO; + geni_se_select_mode(se, GENI_SE_FIFO); ++ /* setup_fifo_params assumes that these registers start with a zero value */ ++ writel(0, se->base + SE_SPI_LOOPBACK); ++ writel(0, se->base + SE_SPI_DEMUX_SEL); ++ writel(0, se->base + SE_SPI_CPHA); ++ writel(0, se->base + SE_SPI_CPOL); ++ writel(0, se->base + SE_SPI_DEMUX_OUTPUT_INV); + ret = 0; + break; + } +-- +2.51.0 + diff --git a/queue-6.1/spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch b/queue-6.1/spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch new file mode 100644 index 00000000000..fa300c96a4b --- /dev/null +++ b/queue-6.1/spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch @@ -0,0 +1,60 @@ +From bcb95afa81bbbf4c1333d806108371f92f8b7fe1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 20:30:04 +0800 +Subject: spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end + +From: Chin-Ting Kuo + +[ Upstream commit 53f826ff5e0e3ecb279862ca7cce1491b94bb017 ] + +spi_mem_dirmap_create() may reconfigure controller-wide settings, +which can interfere with concurrent transfers to other devices +sharing the same SPI controller but using different chip selects. + +Wrap the ->dirmap_create() callback with spi_mem_access_start() and +spi_mem_access_end() to serialize access and prevent cross-CS +interference during dirmap creation. + +This patch has been verified on a setup where a SPI TPM is connected +to CS0 of a SPI controller, while a SPI NOR flash is connected to CS1 +of the same controller. Without this patch, spi_mem_dirmap_create() +for the SPI NOR flash interferes with ongoing SPI TPM data transfers, +resulting in failure to create the TPM device. This was tested on an +ASPEED AST2700 EVB. + +Signed-off-by: Chin-Ting Kuo +Reviewed-by: Paul Menzel +Link: https://patch.msgid.link/20260120123005.1392071-2-chin-ting_kuo@aspeedtech.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-mem.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c +index 0c79193d96972..b33ccb20598e1 100644 +--- a/drivers/spi/spi-mem.c ++++ b/drivers/spi/spi-mem.c +@@ -553,9 +553,18 @@ spi_mem_dirmap_create(struct spi_mem *mem, + + desc->mem = mem; + desc->info = *info; +- if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create) ++ if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create) { ++ ret = spi_mem_access_start(mem); ++ if (ret) { ++ kfree(desc); ++ return ERR_PTR(ret); ++ } ++ + ret = ctlr->mem_ops->dirmap_create(desc); + ++ spi_mem_access_end(mem); ++ } ++ + if (ret) { + desc->nodirmap = true; + if (!spi_mem_supports_op(desc->mem, &desc->info.op_tmpl)) +-- +2.51.0 + diff --git a/queue-6.1/spi-stm32-fix-overrun-issue-at-8bpw.patch b/queue-6.1/spi-stm32-fix-overrun-issue-at-8bpw.patch new file mode 100644 index 00000000000..929705b9a73 --- /dev/null +++ b/queue-6.1/spi-stm32-fix-overrun-issue-at-8bpw.patch @@ -0,0 +1,53 @@ +From 2ec0a113cb60060d5670f29d34a4adaf63e41044 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Dec 2025 11:48:28 +0100 +Subject: spi: stm32: fix Overrun issue at < 8bpw + +From: Deepak Kumar + +[ Upstream commit 1ac3be217c01d5df55ec5052f81e4f1708f46552 ] + +When SPI communication is suspended by hardware automatically, it could +happen that few bits of next frame are already clocked out due to +internal synchronization delay. + +To achieve a safe suspension, we need to ensure that each word must be +at least 8 SPI clock cycles long. That's why, if bpw is less than 8 +bits, we need to use midi to reach 8 SPI clock cycles at least. + +This will ensure that each word achieve safe suspension and prevent +overrun condition. + +Signed-off-by: Deepak Kumar +Signed-off-by: Alain Volmat +Link: https://patch.msgid.link/20251218-stm32-spi-enhancements-v2-2-3b69901ca9fe@foss.st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index c37d557f7d03c..f42fb3be66548 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -1486,11 +1486,12 @@ static void stm32h7_spi_data_idleness(struct stm32_spi *spi, u32 len) + cfg2_clrb |= STM32H7_SPI_CFG2_MIDI; + if ((len > 1) && (spi->cur_midi > 0)) { + u32 sck_period_ns = DIV_ROUND_UP(NSEC_PER_SEC, spi->cur_speed); +- u32 midi = min_t(u32, +- DIV_ROUND_UP(spi->cur_midi, sck_period_ns), +- FIELD_GET(STM32H7_SPI_CFG2_MIDI, +- STM32H7_SPI_CFG2_MIDI)); ++ u32 midi = DIV_ROUND_UP(spi->cur_midi, sck_period_ns); + ++ if ((spi->cur_bpw + midi) < 8) ++ midi = 8 - spi->cur_bpw; ++ ++ midi = min_t(u32, midi, FIELD_MAX(STM32H7_SPI_CFG2_MIDI)); + + dev_dbg(spi->dev, "period=%dns, midi=%d(=%dns)\n", + sck_period_ns, midi, midi * sck_period_ns); +-- +2.51.0 + diff --git a/queue-6.1/staging-rtl8723bs-fix-memory-leak-on-failure-path.patch b/queue-6.1/staging-rtl8723bs-fix-memory-leak-on-failure-path.patch new file mode 100644 index 00000000000..dea177e6d1c --- /dev/null +++ b/queue-6.1/staging-rtl8723bs-fix-memory-leak-on-failure-path.patch @@ -0,0 +1,42 @@ +From cdfbb17435667b2a095e72d0bdb6478160cf337e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 14:47:12 +0530 +Subject: staging: rtl8723bs: fix memory leak on failure path + +From: Diksha Kumari + +[ Upstream commit abe850d82c8cb72d28700673678724e779b1826e ] + +cfg80211_inform_bss_frame() may return NULL on failure. In that case, +the allocated buffer 'buf' is not freed and the function returns early, +leading to potential memory leak. +Fix this by ensuring that 'buf' is freed on both success and failure paths. + +Signed-off-by: Diksha Kumari +Reviewed-by: Mukesh Kumar Chaurasiya +Link: https://patch.msgid.link/20260113091712.7071-1-dikshakdevgan@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +index 5c738011322fc..08b8307b96d9e 100644 +--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c ++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +@@ -318,9 +318,10 @@ struct cfg80211_bss *rtw_cfg80211_inform_bss(struct adapter *padapter, struct wl + len, notify_signal, GFP_ATOMIC); + + if (unlikely(!bss)) +- goto exit; ++ goto free_buf; + + cfg80211_put_bss(wiphy, bss); ++free_buf: + kfree(buf); + + exit: +-- +2.51.0 + diff --git a/queue-6.1/staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch b/queue-6.1/staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch new file mode 100644 index 00000000000..af5f2545ec8 --- /dev/null +++ b/queue-6.1/staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch @@ -0,0 +1,44 @@ +From ffc120b84d6aefc99cc646fa1f9083dd16d3e81f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 17:27:28 +0800 +Subject: staging: rtl8723bs: fix missing status update on sdio_alloc_irq() + failure + +From: Liang Jie + +[ Upstream commit 618b4aec12faabc7579a6b0df046842d798a4c7c ] + +The return value of sdio_alloc_irq() was not stored in status. +If sdio_alloc_irq() fails after rtw_drv_register_netdev() succeeds, +status remains _SUCCESS and the error path skips resource cleanup, +while rtw_drv_init() still returns success. + +Store the return value of sdio_alloc_irq() in status and reuse the +existing error handling which relies on status. + +Reviewed-by: fanggeng +Signed-off-by: Liang Jie +Link: https://patch.msgid.link/20251208092730.262499-1-buaajxlj@163.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c +index 4904314845242..335e6002df70f 100644 +--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c ++++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c +@@ -380,7 +380,8 @@ static int rtw_drv_init( + if (status != _SUCCESS) + goto free_if1; + +- if (sdio_alloc_irq(dvobj) != _SUCCESS) ++ status = sdio_alloc_irq(dvobj); ++ if (status != _SUCCESS) + goto free_if1; + + rtw_ndev_notifier_register(); +-- +2.51.0 + diff --git a/queue-6.1/tools-power-cpupower-reset-errno-before-strtoull.patch b/queue-6.1/tools-power-cpupower-reset-errno-before-strtoull.patch new file mode 100644 index 00000000000..bf8b853a2ff --- /dev/null +++ b/queue-6.1/tools-power-cpupower-reset-errno-before-strtoull.patch @@ -0,0 +1,37 @@ +From e941b2377b9d493ffefa4c0323453033bc21b09f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 17:47:45 +0530 +Subject: tools/power cpupower: Reset errno before strtoull() + +From: Kaushlendra Kumar + +[ Upstream commit f9bd3762cf1bd0c2465f2e6121b340883471d1bf ] + +cpuidle_state_get_one_value() never cleared errno before calling +strtoull(), so a prior ERANGE caused every cpuidle counter read to +return zero. Reset errno to 0 before the conversion so each sysfs read +is evaluated independently. + +Link: https://lore.kernel.org/r/20251201121745.3776703-1-kaushlendra.kumar@intel.com +Signed-off-by: Kaushlendra Kumar +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/power/cpupower/lib/cpuidle.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c +index c15d0de12357f..e7b8c56638370 100644 +--- a/tools/power/cpupower/lib/cpuidle.c ++++ b/tools/power/cpupower/lib/cpuidle.c +@@ -148,6 +148,7 @@ unsigned long long cpuidle_state_get_one_value(unsigned int cpu, + if (len == 0) + return 0; + ++ errno = 0; + value = strtoull(linebuf, &endp, 0); + + if (endp == linebuf || errno == ERANGE) +-- +2.51.0 + diff --git a/queue-6.1/tracing-fix-false-sharing-in-hwlat-get_sample.patch b/queue-6.1/tracing-fix-false-sharing-in-hwlat-get_sample.patch new file mode 100644 index 00000000000..5e9eb3805f0 --- /dev/null +++ b/queue-6.1/tracing-fix-false-sharing-in-hwlat-get_sample.patch @@ -0,0 +1,113 @@ +From b801516416c62aba0474422f3cd124e108991303 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 23:48:10 -0800 +Subject: tracing: Fix false sharing in hwlat get_sample() + +From: Colin Lord + +[ Upstream commit f743435f988cb0cf1f521035aee857851b25e06d ] + +The get_sample() function in the hwlat tracer assumes the caller holds +hwlat_data.lock, but this is not actually happening. The result is +unprotected data access to hwlat_data, and in per-cpu mode can result in +false sharing which may show up as false positive latency events. + +The specific case of false sharing observed was primarily between +hwlat_data.sample_width and hwlat_data.count. These are separated by +just 8B and are therefore likely to share a cache line. When one thread +modifies count, the cache line is in a modified state so when other +threads read sample_width in the main latency detection loop, they fetch +the modified cache line. On some systems, the fetch itself may be slow +enough to count as a latency event, which could set up a self +reinforcing cycle of latency events as each event increments count which +then causes more latency events, continuing the cycle. + +The other result of the unprotected data access is that hwlat_data.count +can end up with duplicate or missed values, which was observed on some +systems in testing. + +Convert hwlat_data.count to atomic64_t so it can be safely modified +without locking, and prevent false sharing by pulling sample_width into +a local variable. + +One system this was tested on was a dual socket server with 32 CPUs on +each numa node. With settings of 1us threshold, 1000us width, and +2000us window, this change reduced the number of latency events from +500 per second down to approximately 1 event per minute. Some machines +tested did not exhibit measurable latency from the false sharing. + +Cc: Masami Hiramatsu +Cc: Mathieu Desnoyers +Link: https://patch.msgid.link/20260210074810.6328-1-clord@mykolab.com +Signed-off-by: Colin Lord +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_hwlat.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c +index 3bd6071441ade..bc437b6ce8969 100644 +--- a/kernel/trace/trace_hwlat.c ++++ b/kernel/trace/trace_hwlat.c +@@ -102,9 +102,9 @@ struct hwlat_sample { + /* keep the global state somewhere. */ + static struct hwlat_data { + +- struct mutex lock; /* protect changes */ ++ struct mutex lock; /* protect changes */ + +- u64 count; /* total since reset */ ++ atomic64_t count; /* total since reset */ + + u64 sample_window; /* total sampling window (on+off) */ + u64 sample_width; /* active sampling portion of window */ +@@ -195,8 +195,7 @@ void trace_hwlat_callback(bool enter) + * get_sample - sample the CPU TSC and look for likely hardware latencies + * + * Used to repeatedly capture the CPU TSC (or similar), looking for potential +- * hardware-induced latency. Called with interrupts disabled and with +- * hwlat_data.lock held. ++ * hardware-induced latency. Called with interrupts disabled. + */ + static int get_sample(void) + { +@@ -206,6 +205,7 @@ static int get_sample(void) + time_type start, t1, t2, last_t2; + s64 diff, outer_diff, total, last_total = 0; + u64 sample = 0; ++ u64 sample_width = READ_ONCE(hwlat_data.sample_width); + u64 thresh = tracing_thresh; + u64 outer_sample = 0; + int ret = -1; +@@ -269,7 +269,7 @@ static int get_sample(void) + if (diff > sample) + sample = diff; /* only want highest value */ + +- } while (total <= hwlat_data.sample_width); ++ } while (total <= sample_width); + + barrier(); /* finish the above in the view for NMIs */ + trace_hwlat_callback_enabled = false; +@@ -287,8 +287,7 @@ static int get_sample(void) + if (kdata->nmi_total_ts) + do_div(kdata->nmi_total_ts, NSEC_PER_USEC); + +- hwlat_data.count++; +- s.seqnum = hwlat_data.count; ++ s.seqnum = atomic64_inc_return(&hwlat_data.count); + s.duration = sample; + s.outer_duration = outer_sample; + s.nmi_total_ts = kdata->nmi_total_ts; +@@ -837,7 +836,7 @@ static int hwlat_tracer_init(struct trace_array *tr) + + hwlat_trace = tr; + +- hwlat_data.count = 0; ++ atomic64_set(&hwlat_data.count, 0); + tr->max_latency = 0; + save_tracing_thresh = tracing_thresh; + +-- +2.51.0 + diff --git a/queue-6.1/usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch b/queue-6.1/usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch new file mode 100644 index 00000000000..1835cc477c5 --- /dev/null +++ b/queue-6.1/usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch @@ -0,0 +1,122 @@ +From f68850d06b1adcfe6e563211e650830e89d7ca17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 17:48:48 +0000 +Subject: usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs + +From: Benson Leung + +[ Upstream commit 6811e0a08bdce6b2767414caf17fda24c2e4e032 ] + +ucsi_psy_get_voltage_max and ucsi_psy_get_current_max are calculated +using whichever pdo is in the last position of the src_pdos array, presuming +it to be a fixed pdo, so the pdo_fixed_voltage or pdo_max_current +helpers are used on that last pdo. + +However, non-Fixed PDOs such as Battery PDOs, Augmented PDOs (used for AVS and +for PPS) may exist, and are always at the end of the array if they do. +In the event one of these more advanced chargers are attached the helpers for +fixed return mangled values. + +Here's an example case of a Google Pixel Flex Dual Port 67W USB-C Fast Charger +with PPS support: +POWER_SUPPLY_NAME=ucsi-source-psy-cros_ec_ucsi.4.auto2 +POWER_SUPPLY_TYPE=USB +POWER_SUPPLY_CHARGE_TYPE=Standard +POWER_SUPPLY_USB_TYPE=C [PD] PD_PPS PD_DRP +POWER_SUPPLY_ONLINE=1 +POWER_SUPPLY_VOLTAGE_MIN=5000000 +POWER_SUPPLY_VOLTAGE_MAX=13400000 +POWER_SUPPLY_VOLTAGE_NOW=20000000 +POWER_SUPPLY_CURRENT_MAX=5790000 +POWER_SUPPLY_CURRENT_NOW=3250000 + +Voltage Max is reading as 13.4V, but that's an incorrect decode of the PPS +APDO in the last position. Same goes for CURRENT_MAX. 5.79A is incorrect. + +Instead, enumerate through the src_pdos and filter just for Fixed PDOs for +now, and find the one with the highest voltage and current respectively. + +After, from the same charger: +POWER_SUPPLY_NAME=ucsi-source-psy-cros_ec_ucsi.4.auto2 +POWER_SUPPLY_TYPE=USB +POWER_SUPPLY_CHARGE_TYPE=Standard +POWER_SUPPLY_USB_TYPE=C [PD] PD_PPS PD_DRP +POWER_SUPPLY_ONLINE=1 +POWER_SUPPLY_VOLTAGE_MIN=5000000 +POWER_SUPPLY_VOLTAGE_MAX=20000000 +POWER_SUPPLY_VOLTAGE_NOW=20000000 +POWER_SUPPLY_CURRENT_MAX=4000000 +POWER_SUPPLY_CURRENT_NOW=3250000 + +Signed-off-by: Benson Leung +Reviewed-by: Heikki Krogerus +Link: https://patch.msgid.link/20251208174918.289394-3-bleung@chromium.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/ucsi/psy.c | 30 ++++++++++++++++++++---------- + 1 file changed, 20 insertions(+), 10 deletions(-) + +diff --git a/drivers/usb/typec/ucsi/psy.c b/drivers/usb/typec/ucsi/psy.c +index c80c23d3384e8..3fc524190baf6 100644 +--- a/drivers/usb/typec/ucsi/psy.c ++++ b/drivers/usb/typec/ucsi/psy.c +@@ -87,15 +87,20 @@ static int ucsi_psy_get_voltage_max(struct ucsi_connector *con, + union power_supply_propval *val) + { + u32 pdo; ++ int max_voltage = 0; + + switch (UCSI_CONSTAT_PWR_OPMODE(con->status.flags)) { + case UCSI_CONSTAT_PWR_OPMODE_PD: +- if (con->num_pdos > 0) { +- pdo = con->src_pdos[con->num_pdos - 1]; +- val->intval = pdo_fixed_voltage(pdo) * 1000; +- } else { +- val->intval = 0; ++ for (int i = 0; i < con->num_pdos; i++) { ++ int pdo_voltage = 0; ++ ++ pdo = con->src_pdos[i]; ++ if (pdo_type(pdo) == PDO_TYPE_FIXED) ++ pdo_voltage = pdo_fixed_voltage(pdo) * 1000; ++ max_voltage = (pdo_voltage > max_voltage) ? pdo_voltage ++ : max_voltage; + } ++ val->intval = max_voltage; + break; + case UCSI_CONSTAT_PWR_OPMODE_TYPEC3_0: + case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5: +@@ -143,6 +148,7 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con, + union power_supply_propval *val) + { + u32 pdo; ++ int max_current = 0; + + if (!(con->status.flags & UCSI_CONSTAT_CONNECTED)) { + val->intval = 0; +@@ -151,12 +157,16 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con, + + switch (UCSI_CONSTAT_PWR_OPMODE(con->status.flags)) { + case UCSI_CONSTAT_PWR_OPMODE_PD: +- if (con->num_pdos > 0) { +- pdo = con->src_pdos[con->num_pdos - 1]; +- val->intval = pdo_max_current(pdo) * 1000; +- } else { +- val->intval = 0; ++ for (int i = 0; i < con->num_pdos; i++) { ++ int pdo_current = 0; ++ ++ pdo = con->src_pdos[i]; ++ if (pdo_type(pdo) == PDO_TYPE_FIXED) ++ pdo_current = pdo_max_current(pdo) * 1000; ++ max_current = (pdo_current > max_current) ? pdo_current ++ : max_current; + } ++ val->intval = max_current; + break; + case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5: + val->intval = UCSI_TYPEC_1_5_CURRENT * 1000; +-- +2.51.0 + diff --git a/queue-6.1/virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch b/queue-6.1/virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch new file mode 100644 index 00000000000..c509d4053dc --- /dev/null +++ b/queue-6.1/virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch @@ -0,0 +1,75 @@ +From 0991f45d8fb2802c257f8eecb6310a741bf7ec32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 08:35:45 +0100 +Subject: virt: vbox: uapi: Mark inner unions in packed structs as packed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit c25d01e1c4f2d43f47af87c00e223f5ca7c71792 ] + +The unpacked unions within a packed struct generates alignment warnings +on clang for 32-bit ARM: + +./usr/include/linux/vbox_vmmdev_types.h:239:4: error: field u within 'struct vmmdev_hgcm_function_parameter32' + is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:223:2)' + and is usually due to 'struct vmmdev_hgcm_function_parameter32' being packed, + which can lead to unaligned accesses [-Werror,-Wunaligned-access] + 239 | } u; + | ^ + +./usr/include/linux/vbox_vmmdev_types.h:254:6: error: field u within + 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)' + is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:251:4)' and is usually due to + 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)' + being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] + +With the recent changes to compile-test the UAPI headers in more cases, +these warning in combination with CONFIG_WERROR breaks the build. + +Fix the warnings. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/ +Reported-by: Nathan Chancellor +Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/ +Suggested-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/ +Signed-off-by: Thomas Weißschuh +Tested-by: Nicolas Schier +Reviewed-by: Nicolas Schier +Acked-by: Greg Kroah-Hartman +Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-2-076aed1623ff@linutronix.de +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + include/uapi/linux/vbox_vmmdev_types.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/uapi/linux/vbox_vmmdev_types.h b/include/uapi/linux/vbox_vmmdev_types.h +index f8a8d6b3c5219..436678d4fb24f 100644 +--- a/include/uapi/linux/vbox_vmmdev_types.h ++++ b/include/uapi/linux/vbox_vmmdev_types.h +@@ -236,7 +236,7 @@ struct vmmdev_hgcm_function_parameter32 { + /** Relative to the request header. */ + __u32 offset; + } page_list; +- } u; ++ } __packed u; + } __packed; + VMMDEV_ASSERT_SIZE(vmmdev_hgcm_function_parameter32, 4 + 8); + +@@ -251,7 +251,7 @@ struct vmmdev_hgcm_function_parameter64 { + union { + __u64 phys_addr; + __u64 linear_addr; +- } u; ++ } __packed u; + } __packed pointer; + struct { + /** Size of the buffer described by the page list. */ +-- +2.51.0 + diff --git a/queue-6.1/vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch b/queue-6.1/vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch new file mode 100644 index 00000000000..0370d6df176 --- /dev/null +++ b/queue-6.1/vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch @@ -0,0 +1,62 @@ +From 0efdf725057a5bb03957b40787c0f3db69ff97ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 17:34:00 +0100 +Subject: vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 + +From: Arnd Bergmann + +[ Upstream commit e25dbf561e03c0c5e36228e3b8b784392819ce85 ] + +The gcc-16.0.1 snapshot produces a false-positive warning that turns +into a build failure with CONFIG_WERROR: + +In file included from arch/x86/include/asm/string.h:6, + from net/vmw_vsock/vmci_transport.c:10: +In function 'vmci_transport_packet_init', + inlined from '__vmci_transport_send_control_pkt.constprop' at net/vmw_vsock/vmci_transport.c:198:2: +arch/x86/include/asm/string_32.h:150:25: error: argument 2 null where non-null expected because argument 3 is nonzero [-Werror=nonnull] + 150 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n) + | ^~~~~~~~~~~~~~~~~~~~~~~~~ +net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy' + 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait)); + | ^~~~~~ +arch/x86/include/asm/string_32.h:150:25: note: in a call to built-in function '__builtin_memcpy' +net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy' + 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait)); + | ^~~~~~ + +This seems relatively harmless, and it so far the only instance of this +warning I have found. The __vmci_transport_send_control_pkt function +is called either with wait=NULL or with one of the type values that +pass 'wait' into memcpy() here, but not from the same caller. + +Replacing the memcpy with a struct assignment is otherwise the same +but avoids the warning. + +Signed-off-by: Arnd Bergmann +Reviewed-by: Bobby Eshleman +Reviewed-by: Stefano Garzarella +Reviewed-by: Bryan Tan +Link: https://patch.msgid.link/20260203163406.2636463-1-arnd@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/vmw_vsock/vmci_transport.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c +index 95f34dffe3c22..607b3dc599a73 100644 +--- a/net/vmw_vsock/vmci_transport.c ++++ b/net/vmw_vsock/vmci_transport.c +@@ -161,7 +161,7 @@ vmci_transport_packet_init(struct vmci_transport_packet *pkt, + + case VMCI_TRANSPORT_PACKET_TYPE_WAITING_READ: + case VMCI_TRANSPORT_PACKET_TYPE_WAITING_WRITE: +- memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait)); ++ pkt->u.wait = *wait; + break; + + case VMCI_TRANSPORT_PACKET_TYPE_REQUEST2: +-- +2.51.0 + diff --git a/queue-6.1/watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch b/queue-6.1/watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch new file mode 100644 index 00000000000..ee8832ea1be --- /dev/null +++ b/queue-6.1/watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch @@ -0,0 +1,40 @@ +From d3048d8288caf09587172e8dd6048fa1340b417f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Nov 2025 22:24:33 +0200 +Subject: watchdog: imx7ulp_wdt: handle the nowayout option + +From: Oleksandr Suvorov + +[ Upstream commit d303d37ef5cf86c8c3b2daefd2a7d7fd8ca1ec14 ] + +The module parameter `nowayout` indicates whether the watchdog should ever +be allowed to stop, but the driver currently ignores this option. + +Pass the `nowayout` parameter to the watchdog core by setting the +WDOG_NO_WAY_OUT flag accordingly. + +Signed-off-by: Oleksandr Suvorov +Reviewed-by: Guenter Roeck +Reviewed-by: Frank Li +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/imx7ulp_wdt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/watchdog/imx7ulp_wdt.c b/drivers/watchdog/imx7ulp_wdt.c +index 2897902090b39..7ab832b2d9c5a 100644 +--- a/drivers/watchdog/imx7ulp_wdt.c ++++ b/drivers/watchdog/imx7ulp_wdt.c +@@ -356,6 +356,7 @@ static int imx7ulp_wdt_probe(struct platform_device *pdev) + watchdog_stop_on_reboot(wdog); + watchdog_stop_on_unregister(wdog); + watchdog_set_drvdata(wdog, imx7ulp_wdt); ++ watchdog_set_nowayout(wdog, nowayout); + + imx7ulp_wdt->hw = of_device_get_match_data(dev); + ret = imx7ulp_wdt_init(imx7ulp_wdt, wdog->timeout * imx7ulp_wdt->hw->wdog_clock_rate); +-- +2.51.0 + diff --git a/queue-6.1/wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch b/queue-6.1/wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch new file mode 100644 index 00000000000..e7f57fdcae6 --- /dev/null +++ b/queue-6.1/wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch @@ -0,0 +1,59 @@ +From f57f071c222e8f3de99ecdc5ef152c0030e2cb6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 17:56:11 +0000 +Subject: wifi: ath10k: fix lock protection in + ath10k_wmi_event_peer_sta_ps_state_chg() + +From: Ziyi Guo + +[ Upstream commit 820ba7dd6859ef8b1eaf6014897e7aa4756fc65d ] + +ath10k_wmi_event_peer_sta_ps_state_chg() uses lockdep_assert_held() to +assert that ar->data_lock should be held by the caller, but neither +ath10k_wmi_10_2_op_rx() nor ath10k_wmi_10_4_op_rx() acquire this lock +before calling this function. + +The field arsta->peer_ps_state is documented as protected by +ar->data_lock in core.h, and other accessors (ath10k_peer_ps_state_disable, +ath10k_dbg_sta_read_peer_ps_state) properly acquire this lock. + +Add spin_lock_bh()/spin_unlock_bh() around the peer_ps_state update, +and remove the lockdep_assert_held() to be aligned with new locking, +following the pattern used by other WMI event handlers in the driver. + +Signed-off-by: Ziyi Guo +Reviewed-by: Baochen Qiang +Link: https://patch.msgid.link/20260123175611.767731-1-n7l8m4@u.northwestern.edu +[removed excess blank line] +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/wmi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c +index 28bb8e37033f2..e1909e91271ad 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -5282,8 +5282,6 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb) + struct ath10k_sta *arsta; + u8 peer_addr[ETH_ALEN]; + +- lockdep_assert_held(&ar->data_lock); +- + ev = (struct wmi_peer_sta_ps_state_chg_event *)skb->data; + ether_addr_copy(peer_addr, ev->peer_macaddr.addr); + +@@ -5298,7 +5296,9 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb) + } + + arsta = (struct ath10k_sta *)sta->drv_priv; ++ spin_lock_bh(&ar->data_lock); + arsta->peer_ps_state = __le32_to_cpu(ev->peer_ps_state); ++ spin_unlock_bh(&ar->data_lock); + + exit: + rcu_read_unlock(); +-- +2.51.0 + diff --git a/queue-6.1/wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch b/queue-6.1/wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch new file mode 100644 index 00000000000..3698a448ca8 --- /dev/null +++ b/queue-6.1/wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch @@ -0,0 +1,48 @@ +From a0b1439153b0ec508497fa6b12df649c8a4d7f0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 19:30:05 +0000 +Subject: wifi: iwlegacy: add missing mutex protection in + il3945_store_measurement() + +From: Ziyi Guo + +[ Upstream commit 4dd1dda65265ecbc9f43ffc08e333684cf715152 ] + +il3945_store_measurement() calls il3945_get_measurement() which internally +calls il_send_cmd_sync() without holding il->mutex. However, +il_send_cmd_sync() has lockdep_assert_held(&il->mutex) indicating that +callers must hold this lock. + +Other sysfs store functions in the same file properly acquire the mutex: +- il3945_store_flags() acquires mutex at 3945-mac.c:3110 +- il3945_store_filter_flags() acquires mutex at 3945-mac.c:3144 + +Add mutex_lock()/mutex_unlock() around the il3945_get_measurement() call +in the sysfs store function to fix the missing lock protection. + +Signed-off-by: Ziyi Guo +Acked-by: Stanislaw Gruszka +Link: https://patch.msgid.link/20260125193005.1090429-1-n7l8m4@u.northwestern.edu +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlegacy/3945-mac.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c +index 9054a910ca357..32dd217529a6c 100644 +--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c ++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c +@@ -3268,7 +3268,9 @@ il3945_store_measurement(struct device *d, struct device_attribute *attr, + + D_INFO("Invoking measurement of type %d on " "channel %d (for '%s')\n", + type, params.channel, buf); ++ mutex_lock(&il->mutex); + il3945_get_measurement(il, ¶ms, type); ++ mutex_unlock(&il->mutex); + + return count; + } +-- +2.51.0 + diff --git a/queue-6.1/wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch b/queue-6.1/wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch new file mode 100644 index 00000000000..83fcdb063d6 --- /dev/null +++ b/queue-6.1/wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch @@ -0,0 +1,49 @@ +From 30765400545a348e3a2a64510c8f0ecc8c02e947 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 19:40:39 +0000 +Subject: wifi: iwlegacy: add missing mutex protection in + il4965_store_tx_power() + +From: Ziyi Guo + +[ Upstream commit e31fa691d0b1c07b6094a6cf0cce894192c462b3 ] + +il4965_store_tx_power() calls il_set_tx_power() without holding il->mutex. +However, il_set_tx_power() has lockdep_assert_held(&il->mutex) indicating +that callers must hold this lock. + +All other callers of il_set_tx_power() properly acquire the mutex: +- il_bg_scan_completed() acquires mutex at common.c:1683 +- il_mac_config() acquires mutex at common.c:5006 +- il3945_commit_rxon() and il4965_commit_rxon() are called via work + queues that hold the mutex (like il4965_bg_alive_start) + +Add mutex_lock()/mutex_unlock() around the il_set_tx_power() call in +the sysfs store function to fix the missing lock protection. + +Signed-off-by: Ziyi Guo +Acked-by: Stanislaw Gruszka +Link: https://patch.msgid.link/20260125194039.1196488-1-n7l8m4@u.northwestern.edu +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c +index 1c22a29d20d6a..f39c4d5d0a18a 100644 +--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c ++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c +@@ -4612,7 +4612,9 @@ il4965_store_tx_power(struct device *d, struct device_attribute *attr, + if (ret) + IL_INFO("%s is not in decimal form.\n", buf); + else { ++ mutex_lock(&il->mutex); + ret = il_set_tx_power(il, val, false); ++ mutex_unlock(&il->mutex); + if (ret) + IL_ERR("failed setting tx power (0x%08x).\n", ret); + else +-- +2.51.0 + diff --git a/queue-6.1/wifi-libertas-fix-warning-in-usb_tx_block.patch b/queue-6.1/wifi-libertas-fix-warning-in-usb_tx_block.patch new file mode 100644 index 00000000000..e445f5cb547 --- /dev/null +++ b/queue-6.1/wifi-libertas-fix-warning-in-usb_tx_block.patch @@ -0,0 +1,44 @@ +From 316f26333eaacb8d1b394173115fe2748dc572b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Dec 2025 16:58:06 +0100 +Subject: wifi: libertas: fix WARNING in usb_tx_block + +From: Szymon Wilczek + +[ Upstream commit d66676e6ca96bf8680f869a9bd6573b26c634622 ] + +The function usb_tx_block() submits cardp->tx_urb without ensuring that +any previous transmission on this URB has completed. If a second call +occurs while the URB is still active (e.g. during rapid firmware loading), +usb_submit_urb() detects the active state and triggers a warning: +'URB submitted while active'. + +Fix this by enforcing serialization: call usb_kill_urb() before +submitting the new request. This ensures the URB is idle and safe to reuse. + +Reported-by: syzbot+67969ab6a2551c27f71b@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=67969ab6a2551c27f71b +Signed-off-by: Szymon Wilczek +Link: https://patch.msgid.link/20251221155806.23925-1-swilczek.lx@gmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/libertas/if_usb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c +index 2240b4db8c036..d98c81539ba53 100644 +--- a/drivers/net/wireless/marvell/libertas/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas/if_usb.c +@@ -426,6 +426,8 @@ static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload, uint16_t nb + goto tx_ret; + } + ++ usb_kill_urb(cardp->tx_urb); ++ + usb_fill_bulk_urb(cardp->tx_urb, cardp->udev, + usb_sndbulkpipe(cardp->udev, + cardp->ep_out), +-- +2.51.0 + diff --git a/queue-6.1/wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch b/queue-6.1/wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch new file mode 100644 index 00000000000..2dce8864dc6 --- /dev/null +++ b/queue-6.1/wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch @@ -0,0 +1,86 @@ +From b9d08ddedb8db123297fa7cdde41f2e993eda5b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Nov 2025 16:50:31 +0200 +Subject: wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() + +From: Bitterblue Smith + +[ Upstream commit 44d1f624bbdd2d60319374ba85f7195a28d00c90 ] + +rtw8822b_set_antenna() can be called from userspace when the chip is +powered off. In that case a WARNING is triggered in +rtw8822b_config_trx_mode() because trying to read the RF registers +when the chip is powered off returns an unexpected value. + +Call rtw8822b_config_trx_mode() in rtw8822b_set_antenna() only when +the chip is powered on. + +------------[ cut here ]------------ +write RF mode table fail +WARNING: CPU: 0 PID: 7183 at rtw8822b.c:824 rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b] +CPU: 0 UID: 0 PID: 7183 Comm: iw Tainted: G W OE 6.17.5-arch1-1 #1 PREEMPT(full) 01c39fc421df2af799dd5e9180b572af860b40c1 +Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE +Hardware name: LENOVO 82KR/LNVNB161216, BIOS HBCN18WW 08/27/2021 +RIP: 0010:rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b] +Call Trace: + + rtw8822b_set_antenna+0x57/0x70 [rtw88_8822b 370206f42e5890d8d5f48eb358b759efa37c422b] + rtw_ops_set_antenna+0x50/0x80 [rtw88_core 711c8fb4f686162be4625b1d0b8e8c6a5ac850fb] + ieee80211_set_antenna+0x60/0x100 [mac80211 f1845d85d2ecacf3b71867635a050ece90486cf3] + nl80211_set_wiphy+0x384/0xe00 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] + ? netdev_run_todo+0x63/0x550 + genl_family_rcv_msg_doit+0xfc/0x160 + genl_rcv_msg+0x1aa/0x2b0 + ? __pfx_nl80211_pre_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] + ? __pfx_nl80211_set_wiphy+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] + ? __pfx_nl80211_post_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] + ? __pfx_genl_rcv_msg+0x10/0x10 + netlink_rcv_skb+0x59/0x110 + genl_rcv+0x28/0x40 + netlink_unicast+0x285/0x3c0 + ? __alloc_skb+0xdb/0x1a0 + netlink_sendmsg+0x20d/0x430 + ____sys_sendmsg+0x39f/0x3d0 + ? import_iovec+0x2f/0x40 + ___sys_sendmsg+0x99/0xe0 + ? refill_obj_stock+0x12e/0x240 + __sys_sendmsg+0x8a/0xf0 + do_syscall_64+0x81/0x970 + ? do_syscall_64+0x81/0x970 + ? ksys_read+0x73/0xf0 + ? do_syscall_64+0x81/0x970 + ? count_memcg_events+0xc2/0x190 + ? handle_mm_fault+0x1d7/0x2d0 + ? do_user_addr_fault+0x21a/0x690 + ? exc_page_fault+0x7e/0x1a0 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +---[ end trace 0000000000000000 ]--- + +Link: https://github.com/lwfinger/rtw88/issues/366 +Signed-off-by: Bitterblue Smith +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/fb9a3444-9319-4aa2-8719-35a6308bf568@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/rtw8822b.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822b.c b/drivers/net/wireless/realtek/rtw88/rtw8822b.c +index 0b071a116c58e..35bab31a81b06 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c ++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c +@@ -1026,7 +1026,8 @@ static int rtw8822b_set_antenna(struct rtw_dev *rtwdev, + hal->antenna_tx = antenna_tx; + hal->antenna_rx = antenna_rx; + +- rtw8822b_config_trx_mode(rtwdev, antenna_tx, antenna_rx, false); ++ if (test_bit(RTW_FLAG_POWERON, rtwdev->flags)) ++ rtw8822b_config_trx_mode(rtwdev, antenna_tx, antenna_rx, false); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.1/wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch b/queue-6.1/wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch new file mode 100644 index 00000000000..d4687faee72 --- /dev/null +++ b/queue-6.1/wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch @@ -0,0 +1,65 @@ +From 615cefa5fd4b888d9c67895ca9afff805f872680 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 23:09:37 +0500 +Subject: wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero + +From: Roman Peshkichev + +[ Upstream commit 9f68fdcdc9dbf21be2a48feced90ff7f77d07443 ] + +The function rtw_set_dtim_period() accepted an 'int' dtim_period parameter, +while mac80211 provides dtim_period as 'u8' in struct ieee80211_bss_conf. +In IBSS (ad-hoc) mode mac80211 may set dtim_period to 0. + +The driver unconditionally wrote (dtim_period - 1) to +REG_DTIM_COUNTER_ROOT, which resulted in 0xFF when dtim_period was 0. This +caused delays in broadcast/multicast traffic processing and issues with +ad-hoc operation. + +Convert the function parameter to u8 to match ieee80211_bss_conf and avoid +the underflow by writing 0 when dtim_period is 0. + +Link: https://github.com/lwfinger/rtw88/issues/406 +Signed-off-by: Roman Peshkichev +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20251125180937.22977-1-roman.peshkichev@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/main.c | 4 ++-- + drivers/net/wireless/realtek/rtw88/main.h | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c +index 0a913cf6a615b..8f486152fbd9f 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.c ++++ b/drivers/net/wireless/realtek/rtw88/main.c +@@ -684,10 +684,10 @@ void rtw_set_rx_freq_band(struct rtw_rx_pkt_stat *pkt_stat, u8 channel) + } + EXPORT_SYMBOL(rtw_set_rx_freq_band); + +-void rtw_set_dtim_period(struct rtw_dev *rtwdev, int dtim_period) ++void rtw_set_dtim_period(struct rtw_dev *rtwdev, u8 dtim_period) + { + rtw_write32_set(rtwdev, REG_TCR, BIT_TCR_UPDATE_TIMIE); +- rtw_write8(rtwdev, REG_DTIM_COUNTER_ROOT, dtim_period - 1); ++ rtw_write8(rtwdev, REG_DTIM_COUNTER_ROOT, dtim_period ? dtim_period - 1 : 0); + } + + void rtw_update_channel(struct rtw_dev *rtwdev, u8 center_channel, +diff --git a/drivers/net/wireless/realtek/rtw88/main.h b/drivers/net/wireless/realtek/rtw88/main.h +index f8714f4492440..2976e3fd72885 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.h ++++ b/drivers/net/wireless/realtek/rtw88/main.h +@@ -2150,7 +2150,7 @@ enum nl80211_band rtw_hw_to_nl80211_band(enum rtw_supported_band hw_band) + } + + void rtw_set_rx_freq_band(struct rtw_rx_pkt_stat *pkt_stat, u8 channel); +-void rtw_set_dtim_period(struct rtw_dev *rtwdev, int dtim_period); ++void rtw_set_dtim_period(struct rtw_dev *rtwdev, u8 dtim_period); + void rtw_get_channel_params(struct cfg80211_chan_def *chandef, + struct rtw_channel_params *ch_param); + bool check_hw_ready(struct rtw_dev *rtwdev, u32 addr, u32 mask, u32 target); +-- +2.51.0 + diff --git a/queue-6.1/wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch b/queue-6.1/wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch new file mode 100644 index 00000000000..a042253fed2 --- /dev/null +++ b/queue-6.1/wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch @@ -0,0 +1,36 @@ +From 384417ea1e70c26891472846d697a91e40c61e3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 16:50:35 +0800 +Subject: wifi: rtw89: pci: restore LDO setting after device resume + +From: Dian-Syuan Yang + +[ Upstream commit af1e82232b988f8fc6d635c60609765e49221a64 ] + +The LDO (Low Dropout Regulator) setting is missing after suspend/resume +in some platforms, and it will cause card loss. Therefore, reconfigure +this setting to avoid it. + +Signed-off-by: Dian-Syuan Yang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260127085036.44060-6-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c +index 58b6f7d4cab8b..cc553ca287d62 100644 +--- a/drivers/net/wireless/realtek/rtw89/pci.c ++++ b/drivers/net/wireless/realtek/rtw89/pci.c +@@ -3732,6 +3732,7 @@ static int __maybe_unused rtw89_pci_resume(struct device *dev) + rtw89_write32_clr(rtwdev, R_AX_PCIE_PS_CTRL_V1, + B_AX_SEL_REQ_ENTR_L1); + } ++ rtw89_pci_hci_ldo(rtwdev); + rtw89_pci_l2_hci_ldo(rtwdev); + rtw89_pci_filter_out(rtwdev); + rtw89_pci_link_cfg(rtwdev); +-- +2.51.0 + diff --git a/queue-6.1/x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch b/queue-6.1/x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch new file mode 100644 index 00000000000..6177917ddde --- /dev/null +++ b/queue-6.1/x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch @@ -0,0 +1,46 @@ +From 7c782c53b63a65190ed4cdd6e9439953f3284ff9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 12:00:08 +0800 +Subject: x86/xen/pvh: Enable PAE mode for 32-bit guest only when + CONFIG_X86_PAE is set + +From: Hou Wenlong + +[ Upstream commit db9aded979b491a24871e1621cd4e8822dbca859 ] + +The PVH entry is available for 32-bit KVM guests, and 32-bit KVM guests +do not depend on CONFIG_X86_PAE. However, mk_early_pgtbl_32() builds +different pagetables depending on whether CONFIG_X86_PAE is set. +Therefore, enabling PAE mode for 32-bit KVM guests without +CONFIG_X86_PAE being set would result in a boot failure during CR3 +loading. + +Signed-off-by: Hou Wenlong +Reviewed-by: Juergen Gross +Signed-off-by: Juergen Gross +Message-ID: +Signed-off-by: Sasha Levin +--- + arch/x86/platform/pvh/head.S | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/x86/platform/pvh/head.S b/arch/x86/platform/pvh/head.S +index 9e6a27018d0f6..244275df62c1f 100644 +--- a/arch/x86/platform/pvh/head.S ++++ b/arch/x86/platform/pvh/head.S +@@ -70,10 +70,12 @@ SYM_CODE_START_LOCAL(pvh_start_xen) + + mov $_pa(early_stack_end), %esp + ++#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE) + /* Enable PAE mode. */ + mov %cr4, %eax + orl $X86_CR4_PAE, %eax + mov %eax, %cr4 ++#endif + + #ifdef CONFIG_X86_64 + /* Enable Long mode. */ +-- +2.51.0 + diff --git a/queue-6.1/xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch b/queue-6.1/xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch new file mode 100644 index 00000000000..6c4868d70d7 --- /dev/null +++ b/queue-6.1/xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch @@ -0,0 +1,61 @@ +From 369e4a10e6acc8842b537628876c8ce5a4038f3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 17:47:29 -0500 +Subject: xenbus: Use .freeze/.thaw to handle xenbus devices + +From: Jason Andryuk + +[ Upstream commit e08dd1ee49838750a514e83c0aa60cd12ba6ecbb ] + +The goal is to fix s2idle and S3 for Xen PV devices. A domain resuming +from s3 or s2idle disconnects its PV devices during resume. The +backends are not expecting this and do not reconnect. + +b3e96c0c7562 ("xen: use freeze/restore/thaw PM events for suspend/ +resume/chkpt") changed xen_suspend()/do_suspend() from +PMSG_SUSPEND/PMSG_RESUME to PMSG_FREEZE/PMSG_THAW/PMSG_RESTORE, but the +suspend/resume callbacks remained. + +.freeze/restore are used with hiberation where Linux restarts in a new +place in the future. .suspend/resume are useful for runtime power +management for the duration of a boot. + +The current behavior of the callbacks works for an xl save/restore or +live migration where the domain is restored/migrated to a new location +and connecting to a not-already-connected backend. + +Change xenbus_pm_ops to use .freeze/thaw/restore and drop the +.suspend/resume hook. This matches the use in drivers/xen/manage.c for +save/restore and live migration. With .suspend/resume empty, PV devices +are left connected during s2idle and s3, so PV devices are not changed +and work after resume. + +Signed-off-by: Jason Andryuk +Acked-by: Juergen Gross +Signed-off-by: Juergen Gross +Message-ID: <20251119224731.61497-2-jason.andryuk@amd.com> +Signed-off-by: Sasha Levin +--- + drivers/xen/xenbus/xenbus_probe_frontend.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c +index f44d5a64351e4..f07a2063beb1f 100644 +--- a/drivers/xen/xenbus/xenbus_probe_frontend.c ++++ b/drivers/xen/xenbus/xenbus_probe_frontend.c +@@ -148,11 +148,9 @@ static void xenbus_frontend_dev_shutdown(struct device *_dev) + } + + static const struct dev_pm_ops xenbus_pm_ops = { +- .suspend = xenbus_dev_suspend, +- .resume = xenbus_frontend_dev_resume, + .freeze = xenbus_dev_suspend, + .thaw = xenbus_dev_cancel, +- .restore = xenbus_dev_resume, ++ .restore = xenbus_frontend_dev_resume, + }; + + static struct xen_bus_type xenbus_frontend = { +-- +2.51.0 + diff --git a/queue-6.12/9p-xen-protect-xen_9pfs_front_free-against-concurren.patch b/queue-6.12/9p-xen-protect-xen_9pfs_front_free-against-concurren.patch new file mode 100644 index 00000000000..83d967e3557 --- /dev/null +++ b/queue-6.12/9p-xen-protect-xen_9pfs_front_free-against-concurren.patch @@ -0,0 +1,194 @@ +From 9f71f65ef82607e30b603370357a8752c02e6464 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jan 2026 15:03:48 -0800 +Subject: 9p/xen: protect xen_9pfs_front_free against concurrent calls + +From: Stefano Stabellini + +[ Upstream commit ce8ded2e61f47747e31eeefb44dc24a2160a7e32 ] + +The xenwatch thread can race with other back-end change notifications +and call xen_9pfs_front_free() twice, hitting the observed general +protection fault due to a double-free. Guard the teardown path so only +one caller can release the front-end state at a time, preventing the +crash. + +This is a fix for the following double-free: + +[ 27.052347] Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI +[ 27.052357] CPU: 0 UID: 0 PID: 32 Comm: xenwatch Not tainted 6.18.0-02087-g51ab33fc0a8b-dirty #60 PREEMPT(none) +[ 27.052363] RIP: e030:xen_9pfs_front_free+0x1d/0x150 +[ 27.052368] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 41 55 41 54 55 48 89 fd 48 c7 c7 48 d0 92 85 53 e8 cb cb 05 00 48 8b 45 08 48 8b 55 00 <48> 3b 28 0f 85 f9 28 35 fe 48 3b 6a 08 0f 85 ef 28 35 fe 48 89 42 +[ 27.052377] RSP: e02b:ffffc9004016fdd0 EFLAGS: 00010246 +[ 27.052381] RAX: 6b6b6b6b6b6b6b6b RBX: ffff88800d66e400 RCX: 0000000000000000 +[ 27.052385] RDX: 6b6b6b6b6b6b6b6b RSI: 0000000000000000 RDI: 0000000000000000 +[ 27.052389] RBP: ffff88800a887040 R08: 0000000000000000 R09: 0000000000000000 +[ 27.052393] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888009e46b68 +[ 27.052397] R13: 0000000000000200 R14: 0000000000000000 R15: ffff88800a887040 +[ 27.052404] FS: 0000000000000000(0000) GS:ffff88808ca57000(0000) knlGS:0000000000000000 +[ 27.052408] CS: e030 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 27.052412] CR2: 00007f9714004360 CR3: 0000000004834000 CR4: 0000000000050660 +[ 27.052418] Call Trace: +[ 27.052420] +[ 27.052422] xen_9pfs_front_changed+0x5d5/0x720 +[ 27.052426] ? xenbus_otherend_changed+0x72/0x140 +[ 27.052430] ? __pfx_xenwatch_thread+0x10/0x10 +[ 27.052434] xenwatch_thread+0x94/0x1c0 +[ 27.052438] ? __pfx_autoremove_wake_function+0x10/0x10 +[ 27.052442] kthread+0xf8/0x240 +[ 27.052445] ? __pfx_kthread+0x10/0x10 +[ 27.052449] ? __pfx_kthread+0x10/0x10 +[ 27.052452] ret_from_fork+0x16b/0x1a0 +[ 27.052456] ? __pfx_kthread+0x10/0x10 +[ 27.052459] ret_from_fork_asm+0x1a/0x30 +[ 27.052463] +[ 27.052465] Modules linked in: +[ 27.052471] ---[ end trace 0000000000000000 ]--- + +Signed-off-by: Stefano Stabellini +Message-ID: <20260129230348.2390470-1-stefano.stabellini@amd.com> +Signed-off-by: Dominique Martinet +Signed-off-by: Sasha Levin +--- + net/9p/trans_xen.c | 85 ++++++++++++++++++++++++---------------------- + 1 file changed, 44 insertions(+), 41 deletions(-) + +diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c +index b9ff69c7522a1..068d57515dd58 100644 +--- a/net/9p/trans_xen.c ++++ b/net/9p/trans_xen.c +@@ -274,45 +274,52 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv) + { + int i, j; + +- write_lock(&xen_9pfs_lock); +- list_del(&priv->list); +- write_unlock(&xen_9pfs_lock); +- +- for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) { +- struct xen_9pfs_dataring *ring = &priv->rings[i]; +- +- cancel_work_sync(&ring->work); +- +- if (!priv->rings[i].intf) +- break; +- if (priv->rings[i].irq > 0) +- unbind_from_irqhandler(priv->rings[i].irq, ring); +- if (priv->rings[i].data.in) { +- for (j = 0; +- j < (1 << priv->rings[i].intf->ring_order); +- j++) { +- grant_ref_t ref; +- +- ref = priv->rings[i].intf->ref[j]; +- gnttab_end_foreign_access(ref, NULL); +- } +- free_pages_exact(priv->rings[i].data.in, ++ if (priv->rings) { ++ for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) { ++ struct xen_9pfs_dataring *ring = &priv->rings[i]; ++ ++ cancel_work_sync(&ring->work); ++ ++ if (!priv->rings[i].intf) ++ break; ++ if (priv->rings[i].irq > 0) ++ unbind_from_irqhandler(priv->rings[i].irq, ring); ++ if (priv->rings[i].data.in) { ++ for (j = 0; ++ j < (1 << priv->rings[i].intf->ring_order); ++ j++) { ++ grant_ref_t ref; ++ ++ ref = priv->rings[i].intf->ref[j]; ++ gnttab_end_foreign_access(ref, NULL); ++ } ++ free_pages_exact(priv->rings[i].data.in, + 1UL << (priv->rings[i].intf->ring_order + + XEN_PAGE_SHIFT)); ++ } ++ gnttab_end_foreign_access(priv->rings[i].ref, NULL); ++ free_page((unsigned long)priv->rings[i].intf); + } +- gnttab_end_foreign_access(priv->rings[i].ref, NULL); +- free_page((unsigned long)priv->rings[i].intf); ++ kfree(priv->rings); + } +- kfree(priv->rings); + kfree(priv->tag); + kfree(priv); + } + + static void xen_9pfs_front_remove(struct xenbus_device *dev) + { +- struct xen_9pfs_front_priv *priv = dev_get_drvdata(&dev->dev); ++ struct xen_9pfs_front_priv *priv; + ++ write_lock(&xen_9pfs_lock); ++ priv = dev_get_drvdata(&dev->dev); ++ if (priv == NULL) { ++ write_unlock(&xen_9pfs_lock); ++ return; ++ } + dev_set_drvdata(&dev->dev, NULL); ++ list_del(&priv->list); ++ write_unlock(&xen_9pfs_lock); ++ + xen_9pfs_front_free(priv); + } + +@@ -379,7 +386,7 @@ static int xen_9pfs_front_init(struct xenbus_device *dev) + { + int ret, i; + struct xenbus_transaction xbt; +- struct xen_9pfs_front_priv *priv = dev_get_drvdata(&dev->dev); ++ struct xen_9pfs_front_priv *priv; + char *versions, *v; + unsigned int max_rings, max_ring_order, len = 0; + +@@ -407,6 +414,10 @@ static int xen_9pfs_front_init(struct xenbus_device *dev) + if (p9_xen_trans.maxsize > XEN_FLEX_RING_SIZE(max_ring_order)) + p9_xen_trans.maxsize = XEN_FLEX_RING_SIZE(max_ring_order) / 2; + ++ priv = kzalloc(sizeof(*priv), GFP_KERNEL); ++ if (!priv) ++ return -ENOMEM; ++ priv->dev = dev; + priv->rings = kcalloc(XEN_9PFS_NUM_RINGS, sizeof(*priv->rings), + GFP_KERNEL); + if (!priv->rings) { +@@ -465,6 +476,11 @@ static int xen_9pfs_front_init(struct xenbus_device *dev) + goto error; + } + ++ write_lock(&xen_9pfs_lock); ++ dev_set_drvdata(&dev->dev, priv); ++ list_add_tail(&priv->list, &xen_9pfs_devs); ++ write_unlock(&xen_9pfs_lock); ++ + xenbus_switch_state(dev, XenbusStateInitialised); + return 0; + +@@ -479,19 +495,6 @@ static int xen_9pfs_front_init(struct xenbus_device *dev) + static int xen_9pfs_front_probe(struct xenbus_device *dev, + const struct xenbus_device_id *id) + { +- struct xen_9pfs_front_priv *priv = NULL; +- +- priv = kzalloc(sizeof(*priv), GFP_KERNEL); +- if (!priv) +- return -ENOMEM; +- +- priv->dev = dev; +- dev_set_drvdata(&dev->dev, priv); +- +- write_lock(&xen_9pfs_lock); +- list_add_tail(&priv->list, &xen_9pfs_devs); +- write_unlock(&xen_9pfs_lock); +- + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.12/acpi-battery-fix-incorrect-charging-status-when-curr.patch b/queue-6.12/acpi-battery-fix-incorrect-charging-status-when-curr.patch new file mode 100644 index 00000000000..705e79852b1 --- /dev/null +++ b/queue-6.12/acpi-battery-fix-incorrect-charging-status-when-curr.patch @@ -0,0 +1,57 @@ +From 2dc1cb8708d3698c198fa5a69bc4369be0617f71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jan 2026 17:48:56 +0300 +Subject: ACPI: battery: fix incorrect charging status when current is zero +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ata Ä°lhan Köktürk + +[ Upstream commit bb1256e0ddc7e9e406164319769b9f8d8389f056 ] + +On some laptops, such as the Huawei Matebook series, the embedded +controller continues to report "Charging" status even when the +charge threshold is reached and no current is being drawn. + +This incorrect reporting prevents the system from switching to battery +power profiles, leading to significantly higher power (e.g., 18W instead +of 7W during browsing) and missed remaining battery time estimation. + +Validate the "Charging" state by checking if rate_now is zero. If the +hardware reports charging but the current is zero, report "Not Charging" +to user space. + +Signed-off-by: Ata Ä°lhan Köktürk +[ rjw: Whitespace fix, braces added to an inner if (), new comment rewrite ] +[ rjw: Changelog edits ] +Link: https://patch.msgid.link/20260129144856.43058-1-atailhan2006@gmail.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/battery.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c +index 11c7e35fafa25..a33d60e625f81 100644 +--- a/drivers/acpi/battery.c ++++ b/drivers/acpi/battery.c +@@ -212,7 +212,14 @@ static int acpi_battery_get_property(struct power_supply *psy, + if (battery->state & ACPI_BATTERY_STATE_DISCHARGING) + val->intval = acpi_battery_handle_discharging(battery); + else if (battery->state & ACPI_BATTERY_STATE_CHARGING) +- val->intval = POWER_SUPPLY_STATUS_CHARGING; ++ /* Validate the status by checking the current. */ ++ if (battery->rate_now != ACPI_BATTERY_VALUE_UNKNOWN && ++ battery->rate_now == 0) { ++ /* On charge but no current (0W/0mA). */ ++ val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING; ++ } else { ++ val->intval = POWER_SUPPLY_STATUS_CHARGING; ++ } + else if (battery->state & ACPI_BATTERY_STATE_CHARGE_LIMITING) + val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING; + else if (acpi_battery_is_charged(battery)) +-- +2.51.0 + diff --git a/queue-6.12/acpi-processor-fix-null-pointer-dereference-in-acpi_.patch b/queue-6.12/acpi-processor-fix-null-pointer-dereference-in-acpi_.patch new file mode 100644 index 00000000000..0e73b4c44fe --- /dev/null +++ b/queue-6.12/acpi-processor-fix-null-pointer-dereference-in-acpi_.patch @@ -0,0 +1,101 @@ +From 545377dbf6af50ac259fc79ec1882579ad564b5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 00:32:14 +0800 +Subject: ACPI: processor: Fix NULL-pointer dereference in + acpi_processor_errata_piix4() + +From: Tuo Li + +[ Upstream commit f132e089fe89cadc2098991f0a3cb05c3f824ac6 ] + +In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE +device and then reassigned an ISA device: + + dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...); + dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...); + +If the first lookup succeeds but the second fails, dev becomes NULL. This +leads to a potential null-pointer dereference when dev_dbg() is called: + + if (errata.piix4.bmisx) + dev_dbg(&dev->dev, ...); + +To prevent this, use two temporary pointers and retrieve each device +independently, avoiding overwriting dev with a possible NULL value. + +Signed-off-by: Tuo Li +[ rjw: Subject adjustment, added an empty code line ] +Link: https://patch.msgid.link/20260111163214.202262-1-islituo@gmail.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpi_processor.c | 28 +++++++++++++++------------- + 1 file changed, 15 insertions(+), 13 deletions(-) + +diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c +index 2a99f5eb69629..d8674aee28c2e 100644 +--- a/drivers/acpi/acpi_processor.c ++++ b/drivers/acpi/acpi_processor.c +@@ -50,6 +50,7 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev) + { + u8 value1 = 0; + u8 value2 = 0; ++ struct pci_dev *ide_dev = NULL, *isa_dev = NULL; + + + if (!dev) +@@ -107,12 +108,12 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev) + * each IDE controller's DMA status to make sure we catch all + * DMA activity. + */ +- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, ++ ide_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, + PCI_DEVICE_ID_INTEL_82371AB, + PCI_ANY_ID, PCI_ANY_ID, NULL); +- if (dev) { +- errata.piix4.bmisx = pci_resource_start(dev, 4); +- pci_dev_put(dev); ++ if (ide_dev) { ++ errata.piix4.bmisx = pci_resource_start(ide_dev, 4); ++ pci_dev_put(ide_dev); + } + + /* +@@ -124,24 +125,25 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev) + * disable C3 support if this is enabled, as some legacy + * devices won't operate well if fast DMA is disabled. + */ +- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, ++ isa_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, + PCI_DEVICE_ID_INTEL_82371AB_0, + PCI_ANY_ID, PCI_ANY_ID, NULL); +- if (dev) { +- pci_read_config_byte(dev, 0x76, &value1); +- pci_read_config_byte(dev, 0x77, &value2); ++ if (isa_dev) { ++ pci_read_config_byte(isa_dev, 0x76, &value1); ++ pci_read_config_byte(isa_dev, 0x77, &value2); + if ((value1 & 0x80) || (value2 & 0x80)) + errata.piix4.fdma = 1; +- pci_dev_put(dev); ++ pci_dev_put(isa_dev); + } + + break; + } + +- if (errata.piix4.bmisx) +- dev_dbg(&dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n"); +- if (errata.piix4.fdma) +- dev_dbg(&dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n"); ++ if (ide_dev) ++ dev_dbg(&ide_dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n"); ++ ++ if (isa_dev) ++ dev_dbg(&isa_dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n"); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.12/acpi-resource-add-jwipc-jvc9100-to-irq1_level_low_sk.patch b/queue-6.12/acpi-resource-add-jwipc-jvc9100-to-irq1_level_low_sk.patch new file mode 100644 index 00000000000..22a421d598e --- /dev/null +++ b/queue-6.12/acpi-resource-add-jwipc-jvc9100-to-irq1_level_low_sk.patch @@ -0,0 +1,56 @@ +From c57d3f440a1f110e5db1cb547b517561d0a012b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 15:27:19 +0800 +Subject: ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] + +From: Ai Chao + +[ Upstream commit ba6ded26dffe511b862a98a25955955e7154bfa8 ] + +Like the JWIPC JVC9100 has its serial IRQ (10 and 11) described +as ActiveLow in the DSDT, which the kernel overrides to EdgeHigh which +breaks the serial. + +irq 10, level, active-low, shared, skip-override +irq 11, level, active-low, shared, skip-override + +Add the JVC9100 to the irq1_level_low_skip_override[] quirk table to fix +this. + +Signed-off-by: Ai Chao +Link: https://patch.msgid.link/20260113072719.4154485-1-aichao@kylinos.cn +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/resource.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c +index 4937032490689..8a01a3718aa94 100644 +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -531,6 +531,12 @@ static const struct dmi_system_id irq1_level_low_skip_override[] = { + DMI_MATCH(DMI_BOARD_NAME, "16T90SP"), + }, + }, ++ { ++ /* JWIPC JVC9100 */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "JVC9100"), ++ }, ++ }, + { } + }; + +@@ -698,6 +704,8 @@ struct irq_override_cmp { + + static const struct irq_override_cmp override_table[] = { + { irq1_level_low_skip_override, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, false }, ++ { irq1_level_low_skip_override, 10, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 1, false }, ++ { irq1_level_low_skip_override, 11, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 1, false }, + { irq1_edge_low_force_override, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, + }; + +-- +2.51.0 + diff --git a/queue-6.12/acpi-x86-force-enabling-of-pwm2-on-the-yogabook-yb1-.patch b/queue-6.12/acpi-x86-force-enabling-of-pwm2-on-the-yogabook-yb1-.patch new file mode 100644 index 00000000000..64ff182467f --- /dev/null +++ b/queue-6.12/acpi-x86-force-enabling-of-pwm2-on-the-yogabook-yb1-.patch @@ -0,0 +1,48 @@ +From c38941e12074d8aa2c713d2ea3c3548cd5795790 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Feb 2026 00:22:42 +0200 +Subject: ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 + +From: Yauhen Kharuzhy + +[ Upstream commit a8c975302868c716afef0f50467bebbd069a35b8 ] + +The PWM2 on YB1-X90 tablets is used for keyboard backlight control but +it is disabled in the ACPI DSDT table. Add it to the override_status_ids +list to allow keyboard function control driver +(drivers/platform/x86/lenovo/yogabook.c) to use it. + +Signed-off-by: Yauhen Kharuzhy +Link: https://patch.msgid.link/20260211222242.4101162-1-jekhor@gmail.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/x86/utils.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c +index 4ee30c2897a2b..418951639f511 100644 +--- a/drivers/acpi/x86/utils.c ++++ b/drivers/acpi/x86/utils.c +@@ -81,6 +81,18 @@ static const struct override_status_id override_status_ids[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "Mipad2"), + }), + ++ /* ++ * Lenovo Yoga Book uses PWM2 for touch keyboard backlight control. ++ * It needs to be enabled only for the Android device version (YB1-X90* ++ * aka YETI-11); the Windows version (YB1-X91*) uses ACPI control ++ * methods. ++ */ ++ PRESENT_ENTRY_HID("80862289", "2", INTEL_ATOM_AIRMONT, { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "CHERRYVIEW D1 PLATFORM"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "YETI-11"), ++ }), ++ + /* + * The INT0002 device is necessary to clear wakeup interrupt sources + * on Cherry Trail devices, without it we get nobody cared IRQ msgs. +-- +2.51.0 + diff --git a/queue-6.12/acpi-x86-s2idle-invoke-microsoft-_dsm-function-9-tur.patch b/queue-6.12/acpi-x86-s2idle-invoke-microsoft-_dsm-function-9-tur.patch new file mode 100644 index 00000000000..eaa2629ee10 --- /dev/null +++ b/queue-6.12/acpi-x86-s2idle-invoke-microsoft-_dsm-function-9-tur.patch @@ -0,0 +1,80 @@ +From 8270311389ab48b53260387867e12c8c22a80f23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 21:01:21 +0100 +Subject: ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) + +From: Jakob Riemenschneider + +[ Upstream commit 229ecbaac6b31f89c554b77eb407377a5eade7d4 ] + +Windows 11, version 22H2 introduced a new function index (Function 9) to +the Microsoft LPS0 _DSM, titled "Turn On Display Notification". + +According to Microsoft documentation, this function signals to the system +firmware that the OS intends to turn on the display when exiting Modern +Standby. This allows the firmware to release Power Limits (PLx) earlier. + +Crucially, this patch fixes a functional issue observed on the Lenovo Yoga +Slim 7i Aura (15ILL9), where system fans and keyboard backlights fail to +resume after suspend. Investigation linked shows the EC on this device +turns off these components during sleep but requires the Function 9 +notification to wake them up again. + +This patch defines the new function index (ACPI_MS_TURN_ON_DISPLAY) and +invokes it in acpi_s2idle_restore_early_lps0(). The execution order is +updated to match the logic of an "intent" signal: + + 1. LPS0 Exit (Function 6) + 2. Turn On Display Intent (Function 9) + 3. Modern Standby Exit (Function 8) + 4. Screen On (Function 4) + +Invoking Function 9 before the Modern Standby Exit ensures the firmware +has time to restore power rails and functionality (like fans) before the +software fully exits the sleep state. + +Link: https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/modern-standby-firmware-notifications#turn-on-display-notification-function-9 +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220505 +Suggested-by: Antheas Kapenekakis +Signed-off-by: Jakob Riemenschneider +Link: https://patch.msgid.link/20260127200121.1292216-1-riemenschneiderjakob@gmail.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/x86/s2idle.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/acpi/x86/s2idle.c b/drivers/acpi/x86/s2idle.c +index dd0b40b9bbe8b..377a268867c21 100644 +--- a/drivers/acpi/x86/s2idle.c ++++ b/drivers/acpi/x86/s2idle.c +@@ -45,6 +45,7 @@ static const struct acpi_device_id lps0_device_ids[] = { + #define ACPI_LPS0_EXIT 6 + #define ACPI_LPS0_MS_ENTRY 7 + #define ACPI_LPS0_MS_EXIT 8 ++#define ACPI_MS_TURN_ON_DISPLAY 9 + + /* AMD */ + #define ACPI_LPS0_DSM_UUID_AMD "e3f32452-febc-43ce-9039-932122d37721" +@@ -373,6 +374,8 @@ static const char *acpi_sleep_dsm_state_to_str(unsigned int state) + return "lps0 ms entry"; + case ACPI_LPS0_MS_EXIT: + return "lps0 ms exit"; ++ case ACPI_MS_TURN_ON_DISPLAY: ++ return "lps0 ms turn on display"; + } + } else { + switch (state) { +@@ -619,6 +622,9 @@ void acpi_s2idle_restore_early(void) + if (lps0_dsm_func_mask_microsoft > 0) { + acpi_sleep_run_lps0_dsm(ACPI_LPS0_EXIT, + lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft); ++ /* Intent to turn on display */ ++ acpi_sleep_run_lps0_dsm(ACPI_MS_TURN_ON_DISPLAY, ++ lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft); + /* Modern Standby exit */ + acpi_sleep_run_lps0_dsm(ACPI_LPS0_MS_EXIT, + lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft); +-- +2.51.0 + diff --git a/queue-6.12/acpica-abort-aml-bytecode-execution-when-executing-a.patch b/queue-6.12/acpica-abort-aml-bytecode-execution-when-executing-a.patch new file mode 100644 index 00000000000..5fe711e9004 --- /dev/null +++ b/queue-6.12/acpica-abort-aml-bytecode-execution-when-executing-a.patch @@ -0,0 +1,129 @@ +From a4099df580e7aab28e1aeed0adcd9485db55f14c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 13:25:33 +0100 +Subject: ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP + +From: Armin Wolf + +[ Upstream commit 026ad376a6a48538b576f3589331daa94daae6f0 ] + +The ACPI specification states that when executing AML_FATAL_OP, +the OS should log the fatal error event and shutdown in a timely +fashion. + +Windows complies with this requirement by immediatly entering a +Bso_d, effectively aborting the execution of the AML bytecode in +question. + +ACPICA however might continue with the AML bytecode execution +should acpi_os_signal() simply return AE_OK. This will cause issues +because ACPI BIOS implementations might assume that the Fatal() +operator does not return. + +Fix this by aborting the AML bytecode execution in such a case +by returning AE_ERROR. Also turn struct acpi_signal_fatal_info into a +local variable because of its small size (12 bytes) and to ensure +that acpi_os_signal() always receives valid information about the +fatal ACPI BIOS error. + +Link: https://github.com/acpica/acpica/commit/d516c7758ba6 +Signed-off-by: Armin Wolf +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/3325491.5fSG56mABF@rafael.j.wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/exoparg3.c | 46 +++++++++++++--------------------- + 1 file changed, 18 insertions(+), 28 deletions(-) + +diff --git a/drivers/acpi/acpica/exoparg3.c b/drivers/acpi/acpica/exoparg3.c +index d3091f619909e..41758343657dd 100644 +--- a/drivers/acpi/acpica/exoparg3.c ++++ b/drivers/acpi/acpica/exoparg3.c +@@ -10,6 +10,7 @@ + #include + #include "accommon.h" + #include "acinterp.h" ++#include + #include "acparser.h" + #include "amlcode.h" + +@@ -51,8 +52,7 @@ ACPI_MODULE_NAME("exoparg3") + acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state) + { + union acpi_operand_object **operand = &walk_state->operands[0]; +- struct acpi_signal_fatal_info *fatal; +- acpi_status status = AE_OK; ++ struct acpi_signal_fatal_info fatal; + + ACPI_FUNCTION_TRACE_STR(ex_opcode_3A_0T_0R, + acpi_ps_get_opcode_name(walk_state->opcode)); +@@ -60,28 +60,23 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state) + switch (walk_state->opcode) { + case AML_FATAL_OP: /* Fatal (fatal_type fatal_code fatal_arg) */ + +- ACPI_DEBUG_PRINT((ACPI_DB_INFO, +- "FatalOp: Type %X Code %X Arg %X " +- "<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n", +- (u32)operand[0]->integer.value, +- (u32)operand[1]->integer.value, +- (u32)operand[2]->integer.value)); +- +- fatal = ACPI_ALLOCATE(sizeof(struct acpi_signal_fatal_info)); +- if (fatal) { +- fatal->type = (u32) operand[0]->integer.value; +- fatal->code = (u32) operand[1]->integer.value; +- fatal->argument = (u32) operand[2]->integer.value; +- } ++ fatal.type = (u32)operand[0]->integer.value; ++ fatal.code = (u32)operand[1]->integer.value; ++ fatal.argument = (u32)operand[2]->integer.value; + +- /* Always signal the OS! */ ++ ACPI_BIOS_ERROR((AE_INFO, ++ "Fatal ACPI BIOS error (Type 0x%X Code 0x%X Arg 0x%X)\n", ++ fatal.type, fatal.code, fatal.argument)); + +- status = acpi_os_signal(ACPI_SIGNAL_FATAL, fatal); ++ /* Always signal the OS! */ + +- /* Might return while OS is shutting down, just continue */ ++ acpi_os_signal(ACPI_SIGNAL_FATAL, &fatal); + +- ACPI_FREE(fatal); +- goto cleanup; ++ /* ++ * Might return while OS is shutting down, so abort the AML execution ++ * by returning an error. ++ */ ++ return_ACPI_STATUS(AE_ERROR); + + case AML_EXTERNAL_OP: + /* +@@ -93,21 +88,16 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state) + * wrong if an external opcode ever gets here. + */ + ACPI_ERROR((AE_INFO, "Executed External Op")); +- status = AE_OK; +- goto cleanup; ++ ++ return_ACPI_STATUS(AE_OK); + + default: + + ACPI_ERROR((AE_INFO, "Unknown AML opcode 0x%X", + walk_state->opcode)); + +- status = AE_AML_BAD_OPCODE; +- goto cleanup; ++ return_ACPI_STATUS(AE_AML_BAD_OPCODE); + } +- +-cleanup: +- +- return_ACPI_STATUS(status); + } + + /******************************************************************************* +-- +2.51.0 + diff --git a/queue-6.12/alpha-fix-user-space-corruption-during-memory-compac.patch b/queue-6.12/alpha-fix-user-space-corruption-during-memory-compac.patch new file mode 100644 index 00000000000..811bf55d02b --- /dev/null +++ b/queue-6.12/alpha-fix-user-space-corruption-during-memory-compac.patch @@ -0,0 +1,260 @@ +From 51882d007ede18ae2306df82a22c6dfe1b0bcd12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jan 2026 18:30:43 +0100 +Subject: alpha: fix user-space corruption during memory compaction + +From: Magnus Lindholm + +[ Upstream commit dd5712f3379cfe760267cdd28ff957d9ab4e51c7 ] + +Alpha systems can suffer sporadic user-space crashes and heap +corruption when memory compaction is enabled. + +Symptoms include SIGSEGV, glibc allocator failures (e.g. "unaligned +tcache chunk"), and compiler internal errors. The failures disappear +when compaction is disabled or when using global TLB invalidation. + +The root cause is insufficient TLB shootdown during page migration. +Alpha relies on ASN-based MM context rollover for instruction cache +coherency, but this alone is not sufficient to prevent stale data or +instruction translations from surviving migration. + +Fix this by introducing a migration-specific helper that combines: + - MM context invalidation (ASN rollover), + - immediate per-CPU TLB invalidation (TBI), + - synchronous cross-CPU shootdown when required. + +The helper is used only by migration/compaction paths to avoid changing +global TLB semantics. + +Additionally, update flush_tlb_other(), pte_clear(), to use +READ_ONCE()/WRITE_ONCE() for correct SMP memory ordering. + +This fixes observed crashes on both UP and SMP Alpha systems. + +Reviewed-by: Ivan Kokshaysky +Tested-by: Matoro Mahri +Tested-by: Michael Cree +Signed-off-by: Magnus Lindholm +Link: https://lore.kernel.org/r/20260102173603.18247-2-linmag7@gmail.com +Signed-off-by: Magnus Lindholm +Signed-off-by: Sasha Levin +--- + arch/alpha/include/asm/pgtable.h | 33 ++++++++- + arch/alpha/include/asm/tlbflush.h | 4 +- + arch/alpha/mm/Makefile | 2 +- + arch/alpha/mm/tlbflush.c | 112 ++++++++++++++++++++++++++++++ + 4 files changed, 148 insertions(+), 3 deletions(-) + create mode 100644 arch/alpha/mm/tlbflush.c + +diff --git a/arch/alpha/include/asm/pgtable.h b/arch/alpha/include/asm/pgtable.h +index 02e8817a89212..8b620551304e9 100644 +--- a/arch/alpha/include/asm/pgtable.h ++++ b/arch/alpha/include/asm/pgtable.h +@@ -17,6 +17,7 @@ + #include /* For TASK_SIZE */ + #include + #include ++#include + + struct mm_struct; + struct vm_area_struct; +@@ -213,6 +214,9 @@ extern inline void pud_set(pud_t * pudp, pmd_t * pmdp) + { pud_val(*pudp) = _PAGE_TABLE | ((((unsigned long) pmdp) - PAGE_OFFSET) << (32-PAGE_SHIFT)); } + + ++extern void migrate_flush_tlb_page(struct vm_area_struct *vma, ++ unsigned long addr); ++ + extern inline unsigned long + pmd_page_vaddr(pmd_t pmd) + { +@@ -232,7 +236,7 @@ extern inline int pte_none(pte_t pte) { return !pte_val(pte); } + extern inline int pte_present(pte_t pte) { return pte_val(pte) & _PAGE_VALID; } + extern inline void pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep) + { +- pte_val(*ptep) = 0; ++ WRITE_ONCE(pte_val(*ptep), 0); + } + + extern inline int pmd_none(pmd_t pmd) { return !pmd_val(pmd); } +@@ -294,6 +298,33 @@ extern inline pte_t * pte_offset_kernel(pmd_t * dir, unsigned long address) + + extern pgd_t swapper_pg_dir[1024]; + ++#ifdef CONFIG_COMPACTION ++#define __HAVE_ARCH_PTEP_GET_AND_CLEAR ++ ++static inline pte_t ptep_get_and_clear(struct mm_struct *mm, ++ unsigned long address, ++ pte_t *ptep) ++{ ++ pte_t pte = READ_ONCE(*ptep); ++ ++ pte_clear(mm, address, ptep); ++ return pte; ++} ++ ++#define __HAVE_ARCH_PTEP_CLEAR_FLUSH ++ ++static inline pte_t ptep_clear_flush(struct vm_area_struct *vma, ++ unsigned long addr, pte_t *ptep) ++{ ++ struct mm_struct *mm = vma->vm_mm; ++ pte_t pte = ptep_get_and_clear(mm, addr, ptep); ++ ++ page_table_check_pte_clear(mm, pte); ++ migrate_flush_tlb_page(vma, addr); ++ return pte; ++} ++ ++#endif + /* + * The Alpha doesn't have any external MMU info: the kernel page + * tables contain all the necessary information. +diff --git a/arch/alpha/include/asm/tlbflush.h b/arch/alpha/include/asm/tlbflush.h +index ba4b359d6c395..0c8529997f54e 100644 +--- a/arch/alpha/include/asm/tlbflush.h ++++ b/arch/alpha/include/asm/tlbflush.h +@@ -58,7 +58,9 @@ flush_tlb_other(struct mm_struct *mm) + unsigned long *mmc = &mm->context[smp_processor_id()]; + /* Check it's not zero first to avoid cacheline ping pong + when possible. */ +- if (*mmc) *mmc = 0; ++ ++ if (READ_ONCE(*mmc)) ++ WRITE_ONCE(*mmc, 0); + } + + #ifndef CONFIG_SMP +diff --git a/arch/alpha/mm/Makefile b/arch/alpha/mm/Makefile +index 101dbd06b4ceb..2d05664058f64 100644 +--- a/arch/alpha/mm/Makefile ++++ b/arch/alpha/mm/Makefile +@@ -3,4 +3,4 @@ + # Makefile for the linux alpha-specific parts of the memory manager. + # + +-obj-y := init.o fault.o ++obj-y := init.o fault.o tlbflush.o +diff --git a/arch/alpha/mm/tlbflush.c b/arch/alpha/mm/tlbflush.c +new file mode 100644 +index 0000000000000..ccbc317b9a348 +--- /dev/null ++++ b/arch/alpha/mm/tlbflush.c +@@ -0,0 +1,112 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* ++ * Alpha TLB shootdown helpers ++ * ++ * Copyright (C) 2025 Magnus Lindholm ++ * ++ * Alpha-specific TLB flush helpers that cannot be expressed purely ++ * as inline functions. ++ * ++ * These helpers provide combined MM context handling (ASN rollover) ++ * and immediate TLB invalidation for page migration and memory ++ * compaction paths, where lazy shootdowns are insufficient. ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#define asn_locked() (cpu_data[smp_processor_id()].asn_lock) ++ ++/* ++ * Migration/compaction helper: combine mm context (ASN) handling with an ++ * immediate per-page TLB invalidate and (for exec) an instruction barrier. ++ * ++ * This mirrors the SMP combined IPI handler semantics, but runs locally on UP. ++ */ ++#ifndef CONFIG_SMP ++void migrate_flush_tlb_page(struct vm_area_struct *vma, ++ unsigned long addr) ++{ ++ struct mm_struct *mm = vma->vm_mm; ++ int tbi_type = (vma->vm_flags & VM_EXEC) ? 3 : 2; ++ ++ /* ++ * First do the mm-context side: ++ * If we're currently running this mm, reload a fresh context ASN. ++ * Otherwise, mark context invalid. ++ * ++ * On UP, this is mostly about matching the SMP semantics and ensuring ++ * exec/i-cache tagging assumptions hold when compaction migrates pages. ++ */ ++ if (mm == current->active_mm) ++ flush_tlb_current(mm); ++ else ++ flush_tlb_other(mm); ++ ++ /* ++ * Then do the immediate translation kill for this VA. ++ * For exec mappings, order instruction fetch after invalidation. ++ */ ++ tbi(tbi_type, addr); ++} ++ ++#else ++struct tlb_mm_and_addr { ++ struct mm_struct *mm; ++ unsigned long addr; ++ int tbi_type; /* 2 = DTB, 3 = ITB+DTB */ ++}; ++ ++static void ipi_flush_mm_and_page(void *x) ++{ ++ struct tlb_mm_and_addr *d = x; ++ ++ /* Part 1: mm context side (Alpha uses ASN/context as a key mechanism). */ ++ if (d->mm == current->active_mm && !asn_locked()) ++ __load_new_mm_context(d->mm); ++ else ++ flush_tlb_other(d->mm); ++ ++ /* Part 2: immediate per-VA invalidation on this CPU. */ ++ tbi(d->tbi_type, d->addr); ++} ++ ++void migrate_flush_tlb_page(struct vm_area_struct *vma, unsigned long addr) ++{ ++ struct mm_struct *mm = vma->vm_mm; ++ struct tlb_mm_and_addr d = { ++ .mm = mm, ++ .addr = addr, ++ .tbi_type = (vma->vm_flags & VM_EXEC) ? 3 : 2, ++ }; ++ ++ /* ++ * One synchronous rendezvous: every CPU runs ipi_flush_mm_and_page(). ++ * This is the "combined" version of flush_tlb_mm + per-page invalidate. ++ */ ++ preempt_disable(); ++ on_each_cpu(ipi_flush_mm_and_page, &d, 1); ++ ++ /* ++ * mimic flush_tlb_mm()'s mm_users<=1 optimization. ++ */ ++ if (atomic_read(&mm->mm_users) <= 1) { ++ ++ int cpu, this_cpu; ++ this_cpu = smp_processor_id(); ++ ++ for (cpu = 0; cpu < NR_CPUS; cpu++) { ++ if (!cpu_online(cpu) || cpu == this_cpu) ++ continue; ++ if (READ_ONCE(mm->context[cpu])) ++ WRITE_ONCE(mm->context[cpu], 0); ++ } ++ } ++ preempt_enable(); ++} ++ ++#endif +-- +2.51.0 + diff --git a/queue-6.12/alsa-hda-conexant-add-headset-mic-fix-for-mechrevo-w.patch b/queue-6.12/alsa-hda-conexant-add-headset-mic-fix-for-mechrevo-w.patch new file mode 100644 index 00000000000..1211dbd84aa --- /dev/null +++ b/queue-6.12/alsa-hda-conexant-add-headset-mic-fix-for-mechrevo-w.patch @@ -0,0 +1,36 @@ +From 5027e7d1e41cdae71b6e493b0235bb69cdc32c4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 23:55:01 +0800 +Subject: ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro + +From: gongqi <550230171hxy@gmail.com> + +[ Upstream commit f2581ea2d9f30844c437e348a462027ea25c12e9 ] + +The headset microphone on the MECHREVO Wujie 15X Pro requires the +CXT_FIXUP_HEADSET_MIC quirk to function properly. Add the PCI SSID +(0x1d05:0x3012) to the quirk table. + +Signed-off-by: gongqi <550230171hxy@gmail.com> +Link: https://patch.msgid.link/20260122155501.376199-5-550230171hxy@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_conexant.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index 84ab357b840d6..482e801a496a1 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -1123,6 +1123,7 @@ static const struct hda_quirk cxt5066_fixups[] = { + SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", CXT_FIXUP_THINKPAD_ACPI), + SND_PCI_QUIRK(0x1c06, 0x2011, "Lemote A1004", CXT_PINCFG_LEMOTE_A1004), + SND_PCI_QUIRK(0x1c06, 0x2012, "Lemote A1205", CXT_PINCFG_LEMOTE_A1205), ++ SND_PCI_QUIRK(0x1d05, 0x3012, "MECHREVO Wujie 15X Pro", CXT_FIXUP_HEADSET_MIC), + HDA_CODEC_QUIRK(0x2782, 0x12c3, "Sirius Gen1", CXT_PINCFG_TOP_SPEAKER), + HDA_CODEC_QUIRK(0x2782, 0x12c5, "Sirius Gen2", CXT_PINCFG_TOP_SPEAKER), + {} +-- +2.51.0 + diff --git a/queue-6.12/alsa-hda-realtek-add-hp-victus-16-e0xxx-mute-led-qui.patch b/queue-6.12/alsa-hda-realtek-add-hp-victus-16-e0xxx-mute-led-qui.patch new file mode 100644 index 00000000000..10724057fc1 --- /dev/null +++ b/queue-6.12/alsa-hda-realtek-add-hp-victus-16-e0xxx-mute-led-qui.patch @@ -0,0 +1,80 @@ +From 54bd2c487e061072c74648b83c52b1367bca691a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 00:12:40 +0530 +Subject: ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk + +From: Bharat Dev Burman + +[ Upstream commit 72919c57a055f6d7b79d66731dc398e9b433f47c ] + +HP Victus 16-e0xxx with ALC245 codec does not handle the toggling of +the mute LED. +This patch adds a quirk entry for subsystem ID 0x88eb using a new +ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT fixup, enabling correct mute LED +behavior. + +Signed-off-by: Bharat Dev Burman +Link: https://patch.msgid.link/20260112184253.33376-1-bharat.singh7924@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 5c2f442fca79a..b680646643b97 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4763,6 +4763,22 @@ static void alc245_fixup_hp_mute_led_v1_coefbit(struct hda_codec *codec, + } + } + ++static void alc245_fixup_hp_mute_led_v2_coefbit(struct hda_codec *codec, ++ const struct hda_fixup *fix, ++ int action) ++{ ++ struct alc_spec *spec = codec->spec; ++ ++ if (action == HDA_FIXUP_ACT_PRE_PROBE) { ++ spec->mute_led_polarity = 0; ++ spec->mute_led_coef.idx = 0x0b; ++ spec->mute_led_coef.mask = 1 << 3; ++ spec->mute_led_coef.on = 1 << 3; ++ spec->mute_led_coef.off = 0; ++ snd_hda_gen_add_mute_led_cdev(codec, coef_mute_led_set); ++ } ++} ++ + /* turn on/off mic-mute LED per capture hook by coef bit */ + static int coef_micmute_led_set(struct led_classdev *led_cdev, + enum led_brightness brightness) +@@ -7992,6 +8008,7 @@ enum { + ALC287_FIXUP_YOGA7_14ARB7_I2C, + ALC245_FIXUP_HP_MUTE_LED_COEFBIT, + ALC245_FIXUP_HP_MUTE_LED_V1_COEFBIT, ++ ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT, + ALC245_FIXUP_HP_X360_MUTE_LEDS, + ALC287_FIXUP_THINKPAD_I2S_SPK, + ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD, +@@ -10268,6 +10285,10 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc245_fixup_hp_mute_led_v1_coefbit, + }, ++ [ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc245_fixup_hp_mute_led_v2_coefbit, ++ }, + [ALC245_FIXUP_HP_X360_MUTE_LEDS] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc245_fixup_hp_mute_led_coefbit, +@@ -10694,6 +10715,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x8898, "HP EliteBook 845 G8 Notebook PC", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x103c, 0x88d0, "HP Pavilion 15-eh1xxx (mainboard 88D0)", ALC287_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x88dd, "HP Pavilion 15z-ec200", ALC285_FIXUP_HP_MUTE_LED), ++ SND_PCI_QUIRK(0x103c, 0x88eb, "HP Victus 16-e0xxx", ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT), + SND_PCI_QUIRK(0x103c, 0x8902, "HP OMEN 16", ALC285_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x890e, "HP 255 G8 Notebook PC", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2), + SND_PCI_QUIRK(0x103c, 0x8919, "HP Pavilion Aero Laptop 13-be0xxx", ALC287_FIXUP_HP_GPIO_LED), +-- +2.51.0 + diff --git a/queue-6.12/alsa-hda-realtek-enable-mute-leds-on-hp-envy-x360-15.patch b/queue-6.12/alsa-hda-realtek-enable-mute-leds-on-hp-envy-x360-15.patch new file mode 100644 index 00000000000..742f88735a0 --- /dev/null +++ b/queue-6.12/alsa-hda-realtek-enable-mute-leds-on-hp-envy-x360-15.patch @@ -0,0 +1,72 @@ +From 8e1b4a0924cb9bcd05bd05fedf71fa603d7d5d06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Feb 2026 23:19:37 +0100 +Subject: ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx + +From: Illia Barbashyn <04baril@gmail.com> + +[ Upstream commit ac1ff574bbc09a6c90f4fe8f9e6b8d66c983064c ] + +The mute and mic-mute LEDs on HP ENVY x360 Convertible 15-es0xxx +(PCI SSID 103c:88b3) do not work with the current driver. + +This model requires a combination of COEFBIT and GPIO fixups to +correctly control the LEDs. Introduce a new fixup function +alc245_fixup_hp_envy_x360_mute_led and add a quirk to apply it. + +Signed-off-by: Illia Barbashyn <04baril@gmail.com> +Link: https://patch.msgid.link/20260207221955.24132-1-04baril@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 371538937434c..85178a0303a57 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4858,6 +4858,13 @@ static void alc285_fixup_hp_spectre_x360_mute_led(struct hda_codec *codec, + alc285_fixup_hp_gpio_micmute_led(codec, fix, action); + } + ++static void alc245_fixup_hp_envy_x360_mute_led(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ alc245_fixup_hp_mute_led_v1_coefbit(codec, fix, action); ++ alc245_fixup_hp_gpio_led(codec, fix, action); ++} ++ + static void alc236_fixup_hp_mute_led(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { +@@ -8087,6 +8094,7 @@ enum { + ALC285_FIXUP_HP_GPIO_LED, + ALC285_FIXUP_HP_MUTE_LED, + ALC285_FIXUP_HP_SPECTRE_X360_MUTE_LED, ++ ALC245_FIXUP_HP_ENVY_X360_MUTE_LED, + ALC285_FIXUP_HP_BEEP_MICMUTE_LED, + ALC236_FIXUP_HP_MUTE_LED_COEFBIT2, + ALC236_FIXUP_HP_GPIO_LED, +@@ -9699,6 +9707,10 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_hp_spectre_x360_mute_led, + }, ++ [ALC245_FIXUP_HP_ENVY_X360_MUTE_LED] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc245_fixup_hp_envy_x360_mute_led, ++ }, + [ALC285_FIXUP_HP_BEEP_MICMUTE_LED] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_hp_beep, +@@ -10882,6 +10894,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x8895, "HP EliteBook 855 G8 Notebook PC", ALC285_FIXUP_HP_SPEAKERS_MICMUTE_LED), + SND_PCI_QUIRK(0x103c, 0x8896, "HP EliteBook 855 G8 Notebook PC", ALC285_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x8898, "HP EliteBook 845 G8 Notebook PC", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST), ++ SND_PCI_QUIRK(0x103c, 0x88b3, "HP ENVY x360 Convertible 15-es0xxx", ALC245_FIXUP_HP_ENVY_X360_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x88d0, "HP Pavilion 15-eh1xxx (mainboard 88D0)", ALC287_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x88dd, "HP Pavilion 15z-ec200", ALC285_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x88eb, "HP Victus 16-e0xxx", ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT), +-- +2.51.0 + diff --git a/queue-6.12/alsa-hda-realtek-fix-lg-gram-style-14-speakers.patch b/queue-6.12/alsa-hda-realtek-fix-lg-gram-style-14-speakers.patch new file mode 100644 index 00000000000..e59e4ce27bf --- /dev/null +++ b/queue-6.12/alsa-hda-realtek-fix-lg-gram-style-14-speakers.patch @@ -0,0 +1,238 @@ +From a7862ad178676b7b11b45e55c04ba426bad28ea3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 18:14:52 +0100 +Subject: ALSA: hda/realtek: fix LG Gram Style 14 speakers + +From: Damien Dagorn + +[ Upstream commit cc051fbd7f40226cc407558bc97c5099513e8657 ] + +The LG Gram Style 14 (14Z90RS-G.AD77F, SSID 1854:0490) with Realtek ALC298 +shows normal routing and volume changes, but internal speakers stay silent +unless a userland HDA-verb workaround is applied. + +Add a dedicated quirk for the LG Gram Style 14 that programs the codec +coefficient sequence used by the known workaround and enables the speaker +amps only during playback. + +Tested-by: Damien Dagorn +Signed-off-by: Damien Dagorn +Link: https://lore.kernel.org/CAN59QMUhd4kHrkRoJA6VzEr2VKezN2yjHnANaQoZn2-Bnwe3bQ@mail.gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 170 ++++++++++++++++++++++++++++++++++ + 1 file changed, 170 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index b680646643b97..371538937434c 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5040,6 +5040,163 @@ static void alc298_samsung_v2_init_amps(struct hda_codec *codec, + spec->gen.pcm_playback_hook = alc298_samsung_v2_playback_hook; + } + ++/* LG Gram Style 14: program vendor coef sequence used by HDA-verb workaround */ ++struct alc298_lg_gram_style_seq { ++ unsigned short verb; ++ unsigned short idx; ++ unsigned short val; ++}; ++ ++static void alc298_lg_gram_style_coef_write(struct hda_codec *codec, ++ unsigned int verb, ++ unsigned int idx, ++ unsigned int val) ++{ ++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_COEF_INDEX, 0x23); ++ snd_hda_codec_write(codec, 0x20, 0, verb, idx); ++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_PROC_COEF, 0x00); ++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_PROC_COEF, val); ++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_PROC_COEF, 0xb011); ++} ++ ++static void alc298_lg_gram_style_run_seq(struct hda_codec *codec, ++ const struct alc298_lg_gram_style_seq *seq, ++ int seq_size) ++{ ++ int i; ++ ++ for (i = 0; i < seq_size; i++) ++ alc298_lg_gram_style_coef_write(codec, seq[i].verb, ++ seq[i].idx, seq[i].val); ++} ++ ++/* Coef sequences derived from the HDA-verb workaround for this model. */ ++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_preinit_seq[] = { ++ { 0x420, 0x00, 0x01 }, ++}; ++ ++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_disable_seq[] = { ++ { 0x423, 0xff, 0x00 }, ++ { 0x420, 0x3a, 0x80 }, ++}; ++ ++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_enable_seq[] = { ++ { 0x420, 0x3a, 0x81 }, ++ { 0x423, 0xff, 0x01 }, ++}; ++ ++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_38[] = { ++ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 }, ++ { 0x420, 0x1b, 0x01 }, { 0x420, 0x1d, 0x01 }, { 0x420, 0x1f, 0xfe }, ++ { 0x420, 0x21, 0x00 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 }, ++ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e }, ++ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0x99, 0x03 }, ++ { 0x423, 0xa4, 0xb5 }, { 0x423, 0xa5, 0x01 }, { 0x423, 0xba, 0x94 }, ++}; ++ ++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_39[] = { ++ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 }, ++ { 0x420, 0x1b, 0x02 }, { 0x420, 0x1d, 0x02 }, { 0x420, 0x1f, 0xfd }, ++ { 0x420, 0x21, 0x01 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 }, ++ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e }, ++ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0x99, 0x03 }, ++ { 0x423, 0xa4, 0xb5 }, { 0x423, 0xa5, 0x01 }, { 0x423, 0xba, 0x94 }, ++}; ++ ++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_3c[] = { ++ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 }, ++ { 0x420, 0x1b, 0x01 }, { 0x420, 0x1d, 0x01 }, { 0x420, 0x1f, 0xfe }, ++ { 0x420, 0x21, 0x00 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 }, ++ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e }, ++ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0xba, 0x8d }, ++}; ++ ++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_3d[] = { ++ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 }, ++ { 0x420, 0x1b, 0x02 }, { 0x420, 0x1d, 0x02 }, { 0x420, 0x1f, 0xfd }, ++ { 0x420, 0x21, 0x01 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 }, ++ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e }, ++ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0xba, 0x8d }, ++}; ++ ++struct alc298_lg_gram_style_amp_desc { ++ unsigned char nid; ++ const struct alc298_lg_gram_style_seq *init_seq; ++ int init_seq_size; ++}; ++ ++static const struct alc298_lg_gram_style_amp_desc alc298_lg_gram_style_amps[] = { ++ { 0x38, alc298_lg_gram_style_init_seq_38, ++ ARRAY_SIZE(alc298_lg_gram_style_init_seq_38) }, ++ { 0x39, alc298_lg_gram_style_init_seq_39, ++ ARRAY_SIZE(alc298_lg_gram_style_init_seq_39) }, ++ { 0x3c, alc298_lg_gram_style_init_seq_3c, ++ ARRAY_SIZE(alc298_lg_gram_style_init_seq_3c) }, ++ { 0x3d, alc298_lg_gram_style_init_seq_3d, ++ ARRAY_SIZE(alc298_lg_gram_style_init_seq_3d) }, ++}; ++ ++static void alc298_lg_gram_style_enable_amps(struct hda_codec *codec) ++{ ++ struct alc_spec *spec = codec->spec; ++ int i; ++ ++ for (i = 0; i < spec->num_speaker_amps; i++) { ++ alc_write_coef_idx(codec, 0x22, alc298_lg_gram_style_amps[i].nid); ++ alc298_lg_gram_style_run_seq(codec, ++ alc298_lg_gram_style_enable_seq, ++ ARRAY_SIZE(alc298_lg_gram_style_enable_seq)); ++ } ++} ++ ++static void alc298_lg_gram_style_disable_amps(struct hda_codec *codec) ++{ ++ struct alc_spec *spec = codec->spec; ++ int i; ++ ++ for (i = 0; i < spec->num_speaker_amps; i++) { ++ alc_write_coef_idx(codec, 0x22, alc298_lg_gram_style_amps[i].nid); ++ alc298_lg_gram_style_run_seq(codec, ++ alc298_lg_gram_style_disable_seq, ++ ARRAY_SIZE(alc298_lg_gram_style_disable_seq)); ++ } ++} ++ ++static void alc298_lg_gram_style_playback_hook(struct hda_pcm_stream *hinfo, ++ struct hda_codec *codec, ++ struct snd_pcm_substream *substream, ++ int action) ++{ ++ if (action == HDA_GEN_PCM_ACT_OPEN) ++ alc298_lg_gram_style_enable_amps(codec); ++ if (action == HDA_GEN_PCM_ACT_CLOSE) ++ alc298_lg_gram_style_disable_amps(codec); ++} ++ ++static void alc298_lg_gram_style_init_amps(struct hda_codec *codec) ++{ ++ struct alc_spec *spec = codec->spec; ++ int i; ++ ++ spec->num_speaker_amps = ARRAY_SIZE(alc298_lg_gram_style_amps); ++ ++ for (i = 0; i < spec->num_speaker_amps; i++) { ++ alc_write_coef_idx(codec, 0x22, alc298_lg_gram_style_amps[i].nid); ++ alc298_lg_gram_style_run_seq(codec, ++ alc298_lg_gram_style_preinit_seq, ++ ARRAY_SIZE(alc298_lg_gram_style_preinit_seq)); ++ alc298_lg_gram_style_run_seq(codec, ++ alc298_lg_gram_style_disable_seq, ++ ARRAY_SIZE(alc298_lg_gram_style_disable_seq)); ++ alc298_lg_gram_style_run_seq(codec, ++ alc298_lg_gram_style_amps[i].init_seq, ++ alc298_lg_gram_style_amps[i].init_seq_size); ++ alc_write_coef_idx(codec, 0x89, 0x0); ++ } ++ ++ spec->gen.pcm_playback_hook = alc298_lg_gram_style_playback_hook; ++} ++ + static void alc298_fixup_samsung_amp_v2_2_amps(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { +@@ -5054,6 +5211,13 @@ static void alc298_fixup_samsung_amp_v2_4_amps(struct hda_codec *codec, + alc298_samsung_v2_init_amps(codec, 4); + } + ++static void alc298_fixup_lg_gram_style_14(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ if (action == HDA_FIXUP_ACT_PROBE) ++ alc298_lg_gram_style_init_amps(codec); ++} ++ + static void gpio2_mic_hotkey_event(struct hda_codec *codec, + struct hda_jack_callback *event) + { +@@ -7932,6 +8096,7 @@ enum { + ALC298_FIXUP_SAMSUNG_AMP, + ALC298_FIXUP_SAMSUNG_AMP_V2_2_AMPS, + ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS, ++ ALC298_FIXUP_LG_GRAM_STYLE_14, + ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, + ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, + ALC295_FIXUP_ASUS_MIC_NO_PRESENCE, +@@ -9580,6 +9745,10 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc298_fixup_samsung_amp_v2_4_amps + }, ++ [ALC298_FIXUP_LG_GRAM_STYLE_14] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc298_fixup_lg_gram_style_14 ++ }, + [ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb[]) { +@@ -11378,6 +11547,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1854, 0x0488, "LG gram 16 (16Z90R)", ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS), + SND_PCI_QUIRK(0x1854, 0x0489, "LG gram 16 (16Z90R-A)", ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS), + SND_PCI_QUIRK(0x1854, 0x048a, "LG gram 17 (17ZD90R)", ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS), ++ SND_PCI_QUIRK(0x1854, 0x0490, "LG Gram Style 14 (14Z90RS)", ALC298_FIXUP_LG_GRAM_STYLE_14), + SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MACH-WX9", ALC256_FIXUP_HUAWEI_MACH_WX9_PINS), + SND_PCI_QUIRK(0x19e5, 0x320f, "Huawei WRT-WX9 ", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x19e5, 0x3212, "Huawei KLV-WX9 ", ALC256_FIXUP_ACER_HEADSET_MIC), +-- +2.51.0 + diff --git a/queue-6.12/alsa-mixer-oss-add-card-disconnect-checkpoints.patch b/queue-6.12/alsa-mixer-oss-add-card-disconnect-checkpoints.patch new file mode 100644 index 00000000000..35d510534c0 --- /dev/null +++ b/queue-6.12/alsa-mixer-oss-add-card-disconnect-checkpoints.patch @@ -0,0 +1,103 @@ +From e7789b495edb2992e02ca5908ae90275177e54bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 13:12:11 +0100 +Subject: ALSA: mixer: oss: Add card disconnect checkpoints + +From: Takashi Iwai + +[ Upstream commit 084d5d44418148662365eced3e126ad1a81ee3e2 ] + +ALSA OSS mixer layer calls the kcontrol ops rather individually, and +pending calls might be not always caught at disconnecting the device. + +For avoiding the potential UAF scenarios, add sanity checks of the +card disconnection at each entry point of OSS mixer accesses. The +rwsem is taken just before that check, hence the rest context should +be covered by that properly. + +Link: https://patch.msgid.link/20260209121212.171430-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/oss/mixer_oss.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c +index 05fc8911479c1..a6cc74bb25fd4 100644 +--- a/sound/core/oss/mixer_oss.c ++++ b/sound/core/oss/mixer_oss.c +@@ -525,6 +525,8 @@ static void snd_mixer_oss_get_volume1_vol(struct snd_mixer_oss_file *fmixer, + if (numid == ID_UNKNOWN) + return; + guard(rwsem_read)(&card->controls_rwsem); ++ if (card->shutdown) ++ return; + kctl = snd_ctl_find_numid(card, numid); + if (!kctl) + return; +@@ -558,6 +560,8 @@ static void snd_mixer_oss_get_volume1_sw(struct snd_mixer_oss_file *fmixer, + if (numid == ID_UNKNOWN) + return; + guard(rwsem_read)(&card->controls_rwsem); ++ if (card->shutdown) ++ return; + kctl = snd_ctl_find_numid(card, numid); + if (!kctl) + return; +@@ -618,6 +622,8 @@ static void snd_mixer_oss_put_volume1_vol(struct snd_mixer_oss_file *fmixer, + if (numid == ID_UNKNOWN) + return; + guard(rwsem_read)(&card->controls_rwsem); ++ if (card->shutdown) ++ return; + kctl = snd_ctl_find_numid(card, numid); + if (!kctl) + return; +@@ -655,6 +661,8 @@ static void snd_mixer_oss_put_volume1_sw(struct snd_mixer_oss_file *fmixer, + if (numid == ID_UNKNOWN) + return; + guard(rwsem_read)(&card->controls_rwsem); ++ if (card->shutdown) ++ return; + kctl = snd_ctl_find_numid(card, numid); + if (!kctl) + return; +@@ -792,6 +800,8 @@ static int snd_mixer_oss_get_recsrc2(struct snd_mixer_oss_file *fmixer, unsigned + if (uinfo == NULL || uctl == NULL) + return -ENOMEM; + guard(rwsem_read)(&card->controls_rwsem); ++ if (card->shutdown) ++ return -ENODEV; + kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0); + if (!kctl) + return -ENOENT; +@@ -835,6 +845,8 @@ static int snd_mixer_oss_put_recsrc2(struct snd_mixer_oss_file *fmixer, unsigned + if (uinfo == NULL || uctl == NULL) + return -ENOMEM; + guard(rwsem_read)(&card->controls_rwsem); ++ if (card->shutdown) ++ return -ENODEV; + kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0); + if (!kctl) + return -ENOENT; +@@ -878,6 +890,8 @@ static int snd_mixer_oss_build_test(struct snd_mixer_oss *mixer, struct slot *sl + int err; + + scoped_guard(rwsem_read, &card->controls_rwsem) { ++ if (card->shutdown) ++ return -ENODEV; + kcontrol = snd_mixer_oss_test_id(mixer, name, index); + if (kcontrol == NULL) + return 0; +@@ -1002,6 +1016,8 @@ static int snd_mixer_oss_build_input(struct snd_mixer_oss *mixer, + if (snd_mixer_oss_build_test_all(mixer, ptr, &slot)) + return 0; + guard(rwsem_read)(&mixer->card->controls_rwsem); ++ if (mixer->card->shutdown) ++ return -ENODEV; + kctl = NULL; + if (!ptr->index) + kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0); +-- +2.51.0 + diff --git a/queue-6.12/alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch b/queue-6.12/alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch new file mode 100644 index 00000000000..8ffc31194d7 --- /dev/null +++ b/queue-6.12/alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch @@ -0,0 +1,42 @@ +From aaf124e358927b5afe6f8d4fdfff0cbd2e29f377 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 08:38:29 +0000 +Subject: ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio + +From: Lianqin Hu + +[ Upstream commit ac656d7d7c70f7c352c7652bc2bb0c1c8c2dde08 ] + +Setting up the interface when suspended/resumeing fail on this card. +Adding a reset and delay quirk will eliminate this problem. + +usb 1-1: New USB device found, idVendor=001f, idProduct=0b21 +usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 +usb 1-1: Product: AB13X USB Audio +usb 1-1: Manufacturer: Generic +usb 1-1: SerialNumber: 20210926172016 + +Signed-off-by: Lianqin Hu +Link: https://patch.msgid.link/TYUPR06MB6217522D0DB6E2C9DF46B56ED265A@TYUPR06MB6217.apcprd06.prod.outlook.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/quirks.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 8fa840df46210..947467112409a 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -2147,6 +2147,8 @@ struct usb_audio_quirk_flags_table { + + static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + /* Device matches */ ++ DEVICE_FLG(0x001f, 0x0b21, /* AB13X USB Audio */ ++ QUIRK_FLAG_FORCE_IFACE_RESET | QUIRK_FLAG_IFACE_DELAY), + DEVICE_FLG(0x03f0, 0x654a, /* HP 320 FHD Webcam */ + QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16), + DEVICE_FLG(0x041e, 0x3000, /* Creative SB Extigy */ +-- +2.51.0 + diff --git a/queue-6.12/alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch b/queue-6.12/alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch new file mode 100644 index 00000000000..ec953bd042f --- /dev/null +++ b/queue-6.12/alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch @@ -0,0 +1,108 @@ +From 25822c656ddeb8d19a5cbeeb7bafd776e4f15efb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Feb 2026 15:12:07 +0100 +Subject: ALSA: usb-audio: Add sanity check for OOB writes at silencing + +From: Takashi Iwai + +[ Upstream commit fba2105a157fffcf19825e4eea498346738c9948 ] + +At silencing the playback URB packets in the implicit fb mode before +the actual playback, we blindly assume that the received packets fit +with the buffer size. But when the setup in the capture stream +differs from the playback stream (e.g. due to the USB core limitation +of max packet size), such an inconsistency may lead to OOB writes to +the buffer, resulting in a crash. + +For addressing it, add a sanity check of the transfer buffer size at +prepare_silent_urb(), and stop the data copy if the received data +overflows. Also, report back the transfer error properly from there, +too. + +Note that this doesn't fix the root cause of the playback error +itself, but this merely covers the kernel Oops. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076 +Link: https://patch.msgid.link/20260216141209.1849200-4-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/endpoint.c | 39 ++++++++++++++++++++++----------------- + 1 file changed, 22 insertions(+), 17 deletions(-) + +diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c +index 35165f7865673..cb94c2cad2213 100644 +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -278,8 +278,8 @@ static inline bool has_tx_length_quirk(struct snd_usb_audio *chip) + return chip->quirk_flags & QUIRK_FLAG_TX_LENGTH; + } + +-static void prepare_silent_urb(struct snd_usb_endpoint *ep, +- struct snd_urb_ctx *ctx) ++static int prepare_silent_urb(struct snd_usb_endpoint *ep, ++ struct snd_urb_ctx *ctx) + { + struct urb *urb = ctx->urb; + unsigned int offs = 0; +@@ -292,28 +292,34 @@ static void prepare_silent_urb(struct snd_usb_endpoint *ep, + extra = sizeof(packet_length); + + for (i = 0; i < ctx->packets; ++i) { +- unsigned int offset; +- unsigned int length; +- int counts; +- +- counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0); +- length = counts * ep->stride; /* number of silent bytes */ +- offset = offs * ep->stride + extra * i; +- urb->iso_frame_desc[i].offset = offset; ++ int length; ++ ++ length = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0); ++ if (length < 0) ++ return length; ++ length *= ep->stride; /* number of silent bytes */ ++ if (offs + length + extra > ctx->buffer_size) ++ break; ++ urb->iso_frame_desc[i].offset = offs; + urb->iso_frame_desc[i].length = length + extra; + if (extra) { + packet_length = cpu_to_le32(length); +- memcpy(urb->transfer_buffer + offset, ++ memcpy(urb->transfer_buffer + offs, + &packet_length, sizeof(packet_length)); ++ offs += extra; + } +- memset(urb->transfer_buffer + offset + extra, ++ memset(urb->transfer_buffer + offs, + ep->silence_value, length); +- offs += counts; ++ offs += length; + } + +- urb->number_of_packets = ctx->packets; +- urb->transfer_buffer_length = offs * ep->stride + ctx->packets * extra; ++ if (!offs) ++ return -EPIPE; ++ ++ urb->number_of_packets = i; ++ urb->transfer_buffer_length = offs; + ctx->queued = 0; ++ return 0; + } + + /* +@@ -335,8 +341,7 @@ static int prepare_outbound_urb(struct snd_usb_endpoint *ep, + if (data_subs && ep->prepare_data_urb) + return ep->prepare_data_urb(data_subs, urb, in_stream_lock); + /* no data provider, so send silence */ +- prepare_silent_urb(ep, ctx); +- break; ++ return prepare_silent_urb(ep, ctx); + + case SND_USB_ENDPOINT_TYPE_SYNC: + if (snd_usb_get_speed(ep->chip->dev) >= USB_SPEED_HIGH) { +-- +2.51.0 + diff --git a/queue-6.12/alsa-usb-audio-update-the-number-of-packets-properly.patch b/queue-6.12/alsa-usb-audio-update-the-number-of-packets-properly.patch new file mode 100644 index 00000000000..4847321de92 --- /dev/null +++ b/queue-6.12/alsa-usb-audio-update-the-number-of-packets-properly.patch @@ -0,0 +1,37 @@ +From ac7eaf59d6acf8b77f12e5610e1a7781046b93ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Feb 2026 15:12:05 +0100 +Subject: ALSA: usb-audio: Update the number of packets properly at receiving + +From: Takashi Iwai + +[ Upstream commit cf044e44190234a41a788de1cdbb6c21f4a52e1e ] + +At receiving the packets from the implicit feedback source, we didn't +update ctx->packets field but only the ctx->packet_size[] data. +In exceptional cases, this might lead to unexpectedly superfluous data +transfer (although this won't happen usually due to the nature of USB +isochronous transfer). Fix it to update the field properly. + +Link: https://patch.msgid.link/20260216141209.1849200-2-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/endpoint.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c +index aa201e4744bf6..35165f7865673 100644 +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -489,6 +489,7 @@ int snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep, + + /* copy over the length information */ + if (implicit_fb) { ++ ctx->packets = packet->packets; + for (i = 0; i < packet->packets; i++) + ctx->packet_size[i] = packet->packet_size[i]; + } +-- +2.51.0 + diff --git a/queue-6.12/apei-ghes-arm-processor-error-don-t-go-past-allocate.patch b/queue-6.12/apei-ghes-arm-processor-error-don-t-go-past-allocate.patch new file mode 100644 index 00000000000..11cdc768e12 --- /dev/null +++ b/queue-6.12/apei-ghes-arm-processor-error-don-t-go-past-allocate.patch @@ -0,0 +1,130 @@ +From b9865d5b50a28ec18f492a07d2e3ca63a767e37a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:35:03 +0100 +Subject: APEI/GHES: ARM processor Error: don't go past allocated memory + +From: Mauro Carvalho Chehab + +[ Upstream commit 87880af2d24e62a84ed19943dbdd524f097172f2 ] + +If the BIOS generates a very small ARM Processor Error, or +an incomplete one, the current logic will fail to deferrence + + err->section_length +and + ctx_info->size + +Add checks to avoid that. With such changes, such GHESv2 +records won't cause OOPSes like this: + +[ 1.492129] Internal error: Oops: 0000000096000005 [#1] SMP +[ 1.495449] Modules linked in: +[ 1.495820] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.18.0-rc1-00017-gabadcc3553dd-dirty #18 PREEMPT +[ 1.496125] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022 +[ 1.496433] Workqueue: kacpi_notify acpi_os_execute_deferred +[ 1.496967] pstate: 814000c5 (Nzcv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) +[ 1.497199] pc : log_arm_hw_error+0x5c/0x200 +[ 1.497380] lr : ghes_handle_arm_hw_error+0x94/0x220 + +0xffff8000811c5324 is in log_arm_hw_error (../drivers/ras/ras.c:75). +70 err_info = (struct cper_arm_err_info *)(err + 1); +71 ctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num); +72 ctx_err = (u8 *)ctx_info; +73 +74 for (n = 0; n < err->context_info_num; n++) { +75 sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size; +76 ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz); +77 ctx_len += sz; +78 } +79 + +and similar ones while trying to access section_length on an +error dump with too small size. + +Signed-off-by: Mauro Carvalho Chehab +Reviewed-by: Jonathan Cameron +Acked-by: Ard Biesheuvel +Reviewed-by: Hanjun Guo +[ rjw: Subject tweaks ] +Link: https://patch.msgid.link/7fd9f38413be05ee2d7cfdb0dc31ea2274cf1a54.1767871950.git.mchehab+huawei@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/apei/ghes.c | 32 ++++++++++++++++++++++++++++---- + drivers/ras/ras.c | 6 +++++- + 2 files changed, 33 insertions(+), 5 deletions(-) + +diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c +index cefa2ae4fa246..98901fbe2f7b7 100644 +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -536,21 +536,45 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, + { + struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata); + int flags = sync ? MF_ACTION_REQUIRED : 0; ++ int length = gdata->error_data_length; + char error_type[120]; + bool queued = false; + int sec_sev, i; + char *p; + + sec_sev = ghes_severity(gdata->error_severity); +- log_arm_hw_error(err, sec_sev); ++ if (length >= sizeof(*err)) { ++ log_arm_hw_error(err, sec_sev); ++ } else { ++ pr_warn(FW_BUG "arm error length: %d\n", length); ++ pr_warn(FW_BUG "length is too small\n"); ++ pr_warn(FW_BUG "firmware-generated error record is incorrect\n"); ++ return false; ++ } ++ + if (sev != GHES_SEV_RECOVERABLE || sec_sev != GHES_SEV_RECOVERABLE) + return false; + + p = (char *)(err + 1); ++ length -= sizeof(err); ++ + for (i = 0; i < err->err_info_num; i++) { +- struct cper_arm_err_info *err_info = (struct cper_arm_err_info *)p; +- bool is_cache = err_info->type & CPER_ARM_CACHE_ERROR; +- bool has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR); ++ struct cper_arm_err_info *err_info; ++ bool is_cache, has_pa; ++ ++ /* Ensure we have enough data for the error info header */ ++ if (length < sizeof(*err_info)) ++ break; ++ ++ err_info = (struct cper_arm_err_info *)p; ++ ++ /* Validate the claimed length before using it */ ++ length -= err_info->length; ++ if (length < 0) ++ break; ++ ++ is_cache = err_info->type & CPER_ARM_CACHE_ERROR; ++ has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR); + + /* + * The field (err_info->error_info & BIT(26)) is fixed to set to +diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c +index c1b36a5601c4b..ae993db1f9c16 100644 +--- a/drivers/ras/ras.c ++++ b/drivers/ras/ras.c +@@ -71,7 +71,11 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev) + ctx_err = (u8 *)ctx_info; + + for (n = 0; n < err->context_info_num; n++) { +- sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size; ++ sz = sizeof(struct cper_arm_ctx_info); ++ ++ if (sz + (long)ctx_info - (long)err >= err->section_length) ++ sz += ctx_info->size; ++ + ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz); + ctx_len += sz; + } +-- +2.51.0 + diff --git a/queue-6.12/apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch b/queue-6.12/apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch new file mode 100644 index 00000000000..53a9d11068b --- /dev/null +++ b/queue-6.12/apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch @@ -0,0 +1,137 @@ +From 9a6b8e3294aba80ad18495c477b834f9a56b3b6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:35:05 +0100 +Subject: APEI/GHES: ensure that won't go past CPER allocated record + +From: Mauro Carvalho Chehab + +[ Upstream commit fa2408a24f8f0db14d9cfc613ef162dc267d7ad4 ] + +The logic at ghes_new() prevents allocating too large records, by +checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB). +Yet, the allocation is done with the actual number of pages from the +CPER bios table location, which can be smaller. + +Yet, a bad firmware could send data with a different size, which might +be bigger than the allocated memory, causing an OOPS: + + Unable to handle kernel paging request at virtual address fff00000f9b40000 + Mem abort info: + ESR = 0x0000000096000007 + EC = 0x25: DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 + FSC = 0x07: level 3 translation fault + Data abort info: + ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 + CM = 0, WnR = 0, TnD = 0, TagAccess = 0 + GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 + swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000 + [fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000 + Internal error: Oops: 0000000096000007 [#1] SMP + Modules linked in: + CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT + Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022 + Workqueue: kacpi_notify acpi_os_execute_deferred + pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) + pc : hex_dump_to_buffer+0x30c/0x4a0 + lr : hex_dump_to_buffer+0x328/0x4a0 + sp : ffff800080e13880 + x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083 + x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004 + x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083 + x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010 + x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020 + x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008 + x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000 + x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020 + x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000 + x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008 + Call trace: + hex_dump_to_buffer+0x30c/0x4a0 (P) + print_hex_dump+0xac/0x170 + cper_estatus_print_section+0x90c/0x968 + cper_estatus_print+0xf0/0x158 + __ghes_print_estatus+0xa0/0x148 + ghes_proc+0x1bc/0x220 + ghes_notify_hed+0x5c/0xb8 + notifier_call_chain+0x78/0x148 + blocking_notifier_call_chain+0x4c/0x80 + acpi_hed_notify+0x28/0x40 + acpi_ev_notify_dispatch+0x50/0x80 + acpi_os_execute_deferred+0x24/0x48 + process_one_work+0x15c/0x3b0 + worker_thread+0x2d0/0x400 + kthread+0x148/0x228 + ret_from_fork+0x10/0x20 + Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44) + ---[ end trace 0000000000000000 ]--- + +Prevent that by taking the actual allocated are into account when +checking for CPER length. + +Signed-off-by: Mauro Carvalho Chehab +Reviewed-by: Jonathan Cameron +Acked-by: Ard Biesheuvel +Reviewed-by: Hanjun Guo +[ rjw: Subject tweaks ] +Link: https://patch.msgid.link/4e70310a816577fabf37d94ed36cde4ad62b1e0a.1767871950.git.mchehab+huawei@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/apei/ghes.c | 6 +++++- + include/acpi/ghes.h | 1 + + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c +index 45fa2510e4cf5..cefa2ae4fa246 100644 +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -293,6 +294,7 @@ static struct ghes *ghes_new(struct acpi_hest_generic *generic) + error_block_length = GHES_ESTATUS_MAX_SIZE; + } + ghes->estatus = kmalloc(error_block_length, GFP_KERNEL); ++ ghes->estatus_length = error_block_length; + if (!ghes->estatus) { + rc = -ENOMEM; + goto err_unmap_status_addr; +@@ -364,13 +366,15 @@ static int __ghes_check_estatus(struct ghes *ghes, + struct acpi_hest_generic_status *estatus) + { + u32 len = cper_estatus_len(estatus); ++ u32 max_len = min(ghes->generic->error_block_length, ++ ghes->estatus_length); + + if (len < sizeof(*estatus)) { + pr_warn_ratelimited(FW_WARN GHES_PFX "Truncated error status block!\n"); + return -EIO; + } + +- if (len > ghes->generic->error_block_length) { ++ if (!len || len > max_len) { + pr_warn_ratelimited(FW_WARN GHES_PFX "Invalid error status block length!\n"); + return -EIO; + } +diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h +index be1dd4c1a9174..16646fdd1f841 100644 +--- a/include/acpi/ghes.h ++++ b/include/acpi/ghes.h +@@ -21,6 +21,7 @@ struct ghes { + struct acpi_hest_generic_v2 *generic_v2; + }; + struct acpi_hest_generic_status *estatus; ++ unsigned int estatus_length; + unsigned long flags; + union { + struct list_head list; +-- +2.51.0 + diff --git a/queue-6.12/arm-9467-1-mm-don-t-use-pk-through-printk.patch b/queue-6.12/arm-9467-1-mm-don-t-use-pk-through-printk.patch new file mode 100644 index 00000000000..bfd5b4a031b --- /dev/null +++ b/queue-6.12/arm-9467-1-mm-don-t-use-pk-through-printk.patch @@ -0,0 +1,42 @@ +From 672246fbcdd53347df176a5ca62533dac2a866dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 10:56:33 +0100 +Subject: ARM: 9467/1: mm: Don't use %pK through printk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weissschuh + +[ Upstream commit 012ea376a5948b025f260aa45d2a6ec5d96674ea ] + +Restricted pointers ("%pK") were never meant to be used +through printk(). They can acquire sleeping locks in atomic contexts. + +Switch to %px over the more secure %p as this usage is a debugging aid, +gated behind CONFIG_DEBUG_VIRTUAL and used by WARN(). + +Link: https://lore.kernel.org/lkml/20250113171731-dc10e3c1-da64-4af0-b767-7c7070468023@linutronix.de/ +Signed-off-by: Thomas Weißschuh +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/mm/physaddr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/mm/physaddr.c b/arch/arm/mm/physaddr.c +index 3f263c840ebc4..1a37ebfacbba9 100644 +--- a/arch/arm/mm/physaddr.c ++++ b/arch/arm/mm/physaddr.c +@@ -38,7 +38,7 @@ static inline bool __virt_addr_valid(unsigned long x) + phys_addr_t __virt_to_phys(unsigned long x) + { + WARN(!__virt_addr_valid(x), +- "virt_to_phys used for non-linear address: %pK (%pS)\n", ++ "virt_to_phys used for non-linear address: %px (%pS)\n", + (void *)x, (void *)x); + + return __virt_to_phys_nodebug(x); +-- +2.51.0 + diff --git a/queue-6.12/arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch b/queue-6.12/arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch new file mode 100644 index 00000000000..fe4eadb9b6a --- /dev/null +++ b/queue-6.12/arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch @@ -0,0 +1,37 @@ +From 237b45b3598bced3dd3e3d4047a0c73ce938cded Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Dec 2025 17:24:48 +0800 +Subject: arm64: Add support for TSV110 Spectre-BHB mitigation + +From: Jinqian Yang + +[ Upstream commit e3baa5d4b361276efeb87b20d8beced451a7dbd5 ] + +The TSV110 processor is vulnerable to the Spectre-BHB (Branch History +Buffer) attack, which can be exploited to leak information through +branch prediction side channels. This commit adds the MIDR of TSV110 +to the list for software mitigation. + +Signed-off-by: Jinqian Yang +Reviewed-by: Zenghui Yu +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/proton-pack.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c +index 31eaf15d2079a..ea8ca0714156b 100644 +--- a/arch/arm64/kernel/proton-pack.c ++++ b/arch/arm64/kernel/proton-pack.c +@@ -896,6 +896,7 @@ static u8 spectre_bhb_loop_affected(void) + MIDR_ALL_VERSIONS(MIDR_CORTEX_X2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), ++ MIDR_ALL_VERSIONS(MIDR_HISI_TSV110), + {}, + }; + static const struct midr_range spectre_bhb_k24_list[] = { +-- +2.51.0 + diff --git a/queue-6.12/arm64-hugetlbpage-avoid-unused-but-set-parameter-war.patch b/queue-6.12/arm64-hugetlbpage-avoid-unused-but-set-parameter-war.patch new file mode 100644 index 00000000000..95fbfc826d1 --- /dev/null +++ b/queue-6.12/arm64-hugetlbpage-avoid-unused-but-set-parameter-war.patch @@ -0,0 +1,60 @@ +From cceacaa6ccddc25230d8f61facf08b41b2f6db25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Feb 2026 11:54:21 +0100 +Subject: arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) + +From: Arnd Bergmann + +[ Upstream commit 729a2e8e9ac47099a967567389cc9d73ef4194ca ] + +gcc-16 warns about an instance that older compilers did not: + +arch/arm64/mm/hugetlbpage.c: In function 'huge_pte_clear': +arch/arm64/mm/hugetlbpage.c:369:57: error: parameter 'addr' set but not used [-Werror=unused-but-set-parameter=] + +The issue here is that __pte_clear() does not actually use its second +argument, but when CONFIG_ARM64_CONTPTE is enabled it still gets +updated. + +Replace the macro with an inline function to let the compiler see +the argument getting passed down. + +Suggested-by: Catalin Marinas +Signed-off-by: Arnd Bergmann +Reviewed-by: Dev Jain +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/pgtable.h | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h +index eb57ddb5ecc53..2de5a70a47ce3 100644 +--- a/arch/arm64/include/asm/pgtable.h ++++ b/arch/arm64/include/asm/pgtable.h +@@ -93,8 +93,6 @@ static inline pteval_t __phys_to_pte_val(phys_addr_t phys) + __pte(__phys_to_pte_val((phys_addr_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot)) + + #define pte_none(pte) (!pte_val(pte)) +-#define __pte_clear(mm, addr, ptep) \ +- __set_pte(ptep, __pte(0)) + #define pte_page(pte) (pfn_to_page(pte_pfn(pte))) + + /* +@@ -1224,6 +1222,13 @@ static inline bool pud_user_accessible_page(pud_t pud) + /* + * Atomic pte/pmd modifications. + */ ++ ++static inline void __pte_clear(struct mm_struct *mm, ++ unsigned long addr, pte_t *ptep) ++{ ++ __set_pte(ptep, __pte(0)); ++} ++ + static inline int __ptep_test_and_clear_young(struct vm_area_struct *vma, + unsigned long address, + pte_t *ptep) +-- +2.51.0 + diff --git a/queue-6.12/arm64-tegra-smaug-add-usb-role-switch-support.patch b/queue-6.12/arm64-tegra-smaug-add-usb-role-switch-support.patch new file mode 100644 index 00000000000..8e284bb580d --- /dev/null +++ b/queue-6.12/arm64-tegra-smaug-add-usb-role-switch-support.patch @@ -0,0 +1,37 @@ +From e0a0d03b8fbd907e11ffe6c2e8958b7fdf434176 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Dec 2025 21:27:21 +0000 +Subject: arm64: tegra: smaug: Add usb-role-switch support + +From: Diogo Ivo + +[ Upstream commit dfa93788dd8b2f9c59adf45ecf592082b1847b7b ] + +The USB2 port on Smaug is configured for OTG operation but lacked the +required 'usb-role-switch' property, leading to a failed probe and a +non-functioning USB port. Add the property along with setting the default +role to host. + +Signed-off-by: Diogo Ivo +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/nvidia/tegra210-smaug.dts | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts +index 2e5b6b2c1f56b..ff2952fae35c9 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts ++++ b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts +@@ -1782,6 +1782,8 @@ usb2-0 { + status = "okay"; + vbus-supply = <&usbc_vbus>; + mode = "otg"; ++ usb-role-switch; ++ role-switch-default-mode = "host"; + }; + + usb3-0 { +-- +2.51.0 + diff --git a/queue-6.12/asoc-codecs-max98390-check-return-value-of-devm_gpio.patch b/queue-6.12/asoc-codecs-max98390-check-return-value-of-devm_gpio.patch new file mode 100644 index 00000000000..50eff60af7e --- /dev/null +++ b/queue-6.12/asoc-codecs-max98390-check-return-value-of-devm_gpio.patch @@ -0,0 +1,44 @@ +From d086f4818065dfc29d22466888d02a48a424e7f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 17:19:04 +0800 +Subject: ASoC: codecs: max98390: Check return value of + devm_gpiod_get_optional() in max98390_i2c_probe() + +From: Chen Ni + +[ Upstream commit a1d14d8364eac2611fe1391c73ff0e5b26064f0e ] + +The devm_gpiod_get_optional() function may return an error pointer +(ERR_PTR) in case of a genuine failure during GPIO acquisition, +not just NULL which indicates the legitimate absence of an optional +GPIO. + +Add an IS_ERR() check after the function call to catch such errors and +propagate them to the probe function, ensuring the driver fails to load +safely rather than proceeding with an invalid pointer. + +Signed-off-by: Chen Ni +Link: https://patch.msgid.link/20260130091904.3426149-1-nichen@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98390.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/codecs/max98390.c b/sound/soc/codecs/max98390.c +index 1bae253618fd0..3a2befb3fab39 100644 +--- a/sound/soc/codecs/max98390.c ++++ b/sound/soc/codecs/max98390.c +@@ -1075,6 +1075,9 @@ static int max98390_i2c_probe(struct i2c_client *i2c) + + reset_gpio = devm_gpiod_get_optional(&i2c->dev, + "reset", GPIOD_OUT_HIGH); ++ if (IS_ERR(reset_gpio)) ++ return dev_err_probe(&i2c->dev, PTR_ERR(reset_gpio), ++ "Failed to get reset gpio\n"); + + /* Power on device */ + if (reset_gpio) { +-- +2.51.0 + diff --git a/queue-6.12/asoc-es8328-add-error-unwind-in-resume.patch b/queue-6.12/asoc-es8328-add-error-unwind-in-resume.patch new file mode 100644 index 00000000000..3308f14e77f --- /dev/null +++ b/queue-6.12/asoc-es8328-add-error-unwind-in-resume.patch @@ -0,0 +1,57 @@ +From cd6197f38d1b8938ae187429ee033cbc4ebc7768 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Jan 2026 00:00:17 +0800 +Subject: ASoC: es8328: Add error unwind in resume + +From: Hsieh Hung-En + +[ Upstream commit 8232e6079ae6f8d3a61d87973cb427385aa469b9 ] + +Handle failures in the resume path by unwinding previously enabled +resources. + +If enabling regulators or syncing the regcache fails, disable regulators +and unprepare the clock to avoid leaking resources and leaving the device +in a partially resumed state. + +Signed-off-by: Hsieh Hung-En +Link: https://patch.msgid.link/20260130160017.2630-6-hungen3108@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/es8328.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c +index 76159c45e6b52..c0d7ce64b2d96 100644 +--- a/sound/soc/codecs/es8328.c ++++ b/sound/soc/codecs/es8328.c +@@ -756,17 +756,23 @@ static int es8328_resume(struct snd_soc_component *component) + es8328->supplies); + if (ret) { + dev_err(component->dev, "unable to enable regulators\n"); +- return ret; ++ goto err_clk; + } + + regcache_mark_dirty(regmap); + ret = regcache_sync(regmap); + if (ret) { + dev_err(component->dev, "unable to sync regcache\n"); +- return ret; ++ goto err_regulators; + } + + return 0; ++ ++err_regulators: ++ regulator_bulk_disable(ARRAY_SIZE(es8328->supplies), es8328->supplies); ++err_clk: ++ clk_disable_unprepare(es8328->clk); ++ return ret; + } + + static int es8328_component_probe(struct snd_soc_component *component) +-- +2.51.0 + diff --git a/queue-6.12/asoc-fsl-imx-rpmsg-use-snd_soc_find_dai_with_mutex-i.patch b/queue-6.12/asoc-fsl-imx-rpmsg-use-snd_soc_find_dai_with_mutex-i.patch new file mode 100644 index 00000000000..22dcb8bbd20 --- /dev/null +++ b/queue-6.12/asoc-fsl-imx-rpmsg-use-snd_soc_find_dai_with_mutex-i.patch @@ -0,0 +1,45 @@ +From 0032df2633b8be033bae6b1dfefb5bff2086f1d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Feb 2026 05:24:29 +0000 +Subject: ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe + +From: Ziyi Guo + +[ Upstream commit 84faa91585fa22a161763f2fe8f84a602a196c87 ] + +imx_rpmsg_probe() calls snd_soc_find_dai() without holding client_mutex. +However, snd_soc_find_dai() has lockdep_assert_held(&client_mutex) +indicating callers must hold this lock, as the function iterates over the +global component list. + +All other callers of snd_soc_find_dai() either hold client_mutex via the +snd_soc_bind_card() path or use the snd_soc_find_dai_with_mutex() wrapper. + +Use snd_soc_find_dai_with_mutex() instead to fix the missing lock +protection. + +Signed-off-by: Ziyi Guo +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20260205052429.4046903-1-n7l8m4@u.northwestern.edu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/imx-rpmsg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/fsl/imx-rpmsg.c b/sound/soc/fsl/imx-rpmsg.c +index ce98d2288193b..b4d6ad563445f 100644 +--- a/sound/soc/fsl/imx-rpmsg.c ++++ b/sound/soc/fsl/imx-rpmsg.c +@@ -145,7 +145,7 @@ static int imx_rpmsg_probe(struct platform_device *pdev) + data->dai.ignore_pmdown_time = 1; + + data->dai.cpus->dai_name = pdev->dev.platform_data; +- cpu_dai = snd_soc_find_dai(data->dai.cpus); ++ cpu_dai = snd_soc_find_dai_with_mutex(data->dai.cpus); + if (!cpu_dai) { + ret = -EPROBE_DEFER; + goto fail; +-- +2.51.0 + diff --git a/queue-6.12/asoc-soc-acpi-intel-arl-match-change-rt722-amp-endpo.patch b/queue-6.12/asoc-soc-acpi-intel-arl-match-change-rt722-amp-endpo.patch new file mode 100644 index 00000000000..39d99908b16 --- /dev/null +++ b/queue-6.12/asoc-soc-acpi-intel-arl-match-change-rt722-amp-endpo.patch @@ -0,0 +1,87 @@ +From db6da7beca9a5f57b9aad6eddf47c86effda7600 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 17:17:48 +0800 +Subject: ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to + aggregated + +From: Bard Liao + +[ Upstream commit 08c09899960118ffb01417242e659eb6cc067d6a ] + +rt722 is aggregated with rt1320 amp in arl_rt722_l0_rt1320_l2 and it is +the only audio configuration in the ARL platform. Set .aggregated = 1 to +represent the fact and avoid unexpected issue. + +Signed-off-by: Bard Liao +Reviewed-by: Liam Girdwood +Reviewed-by: Ranjani Sridharan +Link: https://patch.msgid.link/20260119091749.1752088-2-yung-chuan.liao@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + .../intel/common/soc-acpi-intel-arl-match.c | 23 +++++++++---------- + 1 file changed, 11 insertions(+), 12 deletions(-) + +diff --git a/sound/soc/intel/common/soc-acpi-intel-arl-match.c b/sound/soc/intel/common/soc-acpi-intel-arl-match.c +index 1ad704ca2c5f2..36d73623fb161 100644 +--- a/sound/soc/intel/common/soc-acpi-intel-arl-match.c ++++ b/sound/soc/intel/common/soc-acpi-intel-arl-match.c +@@ -45,23 +45,22 @@ static const struct snd_soc_acpi_endpoint spk_3_endpoint = { + .group_id = 1, + }; + +-/* +- * RT722 is a multi-function codec, three endpoints are created for +- * its headset, amp and dmic functions. +- */ +-static const struct snd_soc_acpi_endpoint rt722_endpoints[] = { ++static const struct snd_soc_acpi_endpoint jack_amp_g1_dmic_endpoints[] = { ++ /* Jack Endpoint */ + { + .num = 0, + .aggregated = 0, + .group_position = 0, + .group_id = 0, + }, ++ /* Amp Endpoint, work as spk_l_endpoint */ + { + .num = 1, +- .aggregated = 0, ++ .aggregated = 1, + .group_position = 0, +- .group_id = 0, ++ .group_id = 1, + }, ++ /* DMIC Endpoint */ + { + .num = 2, + .aggregated = 0, +@@ -229,11 +228,11 @@ static const struct snd_soc_acpi_adr_device rt711_sdca_0_adr[] = { + } + }; + +-static const struct snd_soc_acpi_adr_device rt722_0_single_adr[] = { ++static const struct snd_soc_acpi_adr_device rt722_0_agg_adr[] = { + { + .adr = 0x000030025D072201ull, +- .num_endpoints = ARRAY_SIZE(rt722_endpoints), +- .endpoints = rt722_endpoints, ++ .num_endpoints = ARRAY_SIZE(jack_amp_g1_dmic_endpoints), ++ .endpoints = jack_amp_g1_dmic_endpoints, + .name_prefix = "rt722" + } + }; +@@ -371,8 +370,8 @@ static const struct snd_soc_acpi_link_adr arl_sdca_rvp[] = { + static const struct snd_soc_acpi_link_adr arl_rt722_l0_rt1320_l2[] = { + { + .mask = BIT(0), +- .num_adr = ARRAY_SIZE(rt722_0_single_adr), +- .adr_d = rt722_0_single_adr, ++ .num_adr = ARRAY_SIZE(rt722_0_agg_adr), ++ .adr_d = rt722_0_agg_adr, + }, + { + .mask = BIT(2), +-- +2.51.0 + diff --git a/queue-6.12/asoc-sof-intel-hda-fix-null-pointer-dereference.patch b/queue-6.12/asoc-sof-intel-hda-fix-null-pointer-dereference.patch new file mode 100644 index 00000000000..db4ba345881 --- /dev/null +++ b/queue-6.12/asoc-sof-intel-hda-fix-null-pointer-dereference.patch @@ -0,0 +1,62 @@ +From 3736fb21b1b9b07e723fff4b7db0fb2d6f6c3cd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 10:18:32 +0200 +Subject: ASoC: SOF: Intel: hda: Fix NULL pointer dereference + +From: Ranjani Sridharan + +[ Upstream commit 16c589567a956d46a7c1363af3f64de3d420af20 ] + +If there's a mismatch between the DAI links in the machine driver and +the topology, it is possible that the playback/capture widget is not +set, especially in the case of loopback capture for echo reference +where we use the dummy DAI link. Return the error when the widget is not +set to avoid a null pointer dereference like below when the topology is +broken. + +RIP: 0010:hda_dai_get_ops.isra.0+0x14/0xa0 [snd_sof_intel_hda_common] + +Signed-off-by: Ranjani Sridharan +Reviewed-by: Bard Liao +Reviewed-by: Liam Girdwood +Reviewed-by: Mateusz Redzynia +Signed-off-by: Peter Ujfalusi +Link: https://patch.msgid.link/20260204081833.16630-10-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-dai.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sof/intel/hda-dai.c b/sound/soc/sof/intel/hda-dai.c +index 2e58a264da556..169bfd23f1b93 100644 +--- a/sound/soc/sof/intel/hda-dai.c ++++ b/sound/soc/sof/intel/hda-dai.c +@@ -70,12 +70,22 @@ static const struct hda_dai_widget_dma_ops * + hda_dai_get_ops(struct snd_pcm_substream *substream, struct snd_soc_dai *cpu_dai) + { + struct snd_soc_dapm_widget *w = snd_soc_dai_get_widget(cpu_dai, substream->stream); +- struct snd_sof_widget *swidget = w->dobj.private; ++ struct snd_sof_widget *swidget; + struct snd_sof_dev *sdev; + struct snd_sof_dai *sdai; + +- sdev = widget_to_sdev(w); ++ /* ++ * this is unlikely if the topology and the machine driver DAI links match. ++ * But if there's a missing DAI link in topology, this will prevent a NULL pointer ++ * dereference later on. ++ */ ++ if (!w) { ++ dev_err(cpu_dai->dev, "%s: widget is NULL\n", __func__); ++ return NULL; ++ } + ++ sdev = widget_to_sdev(w); ++ swidget = w->dobj.private; + if (!swidget) { + dev_err(sdev->dev, "%s: swidget is NULL\n", __func__); + return NULL; +-- +2.51.0 + diff --git a/queue-6.12/asoc-sof-ipc4-support-for-sending-payload-along-with.patch b/queue-6.12/asoc-sof-ipc4-support-for-sending-payload-along-with.patch new file mode 100644 index 00000000000..48912c1464d --- /dev/null +++ b/queue-6.12/asoc-sof-ipc4-support-for-sending-payload-along-with.patch @@ -0,0 +1,130 @@ +From f43d54536c8f0e3c2ceafd36338f99e52065b048 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Dec 2025 16:39:43 +0200 +Subject: ASoC: SOF: ipc4: Support for sending payload along with + LARGE_CONFIG_GET + +From: Peter Ujfalusi + +[ Upstream commit d96cb0b86d6e8bbbbfa425771606f6c1aebc318e ] + +There are message types when we would need to send a payload along with +the LARGE_CONFIG_GET message to provide information to the firmware on +what data is requested. +Such cases are the ALSA Kcontrol related messages when the high level +param_id tells only the type of the control, but the ID/index of the exact +control is specified in the payload area. + +The caller must place the payload for TX before calling the set_get_data() +and this payload will be sent alongside with the message to the firmware. + +The data area will be overwritten by the received data from firmware. + +Signed-off-by: Peter Ujfalusi +Reviewed-by: Seppo Ingalsuo +Reviewed-by: Ranjani Sridharan +Reviewed-by: Bard Liao +Reviewed-by: Kai Vehmanen +Link: https://patch.msgid.link/20251217143945.2667-7-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/ipc4.c | 44 ++++++++++++++++++++++++++++++++++++++++++-- + 1 file changed, 42 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sof/ipc4.c b/sound/soc/sof/ipc4.c +index 4386cbae16d4e..e4eb8e004885e 100644 +--- a/sound/soc/sof/ipc4.c ++++ b/sound/soc/sof/ipc4.c +@@ -15,6 +15,7 @@ + #include "sof-audio.h" + #include "ipc4-fw-reg.h" + #include "ipc4-priv.h" ++#include "ipc4-topology.h" + #include "ipc4-telemetry.h" + #include "ops.h" + +@@ -408,6 +409,23 @@ static int sof_ipc4_tx_msg(struct snd_sof_dev *sdev, void *msg_data, size_t msg_ + return ret; + } + ++static bool sof_ipc4_tx_payload_for_get_data(struct sof_ipc4_msg *tx) ++{ ++ /* ++ * Messages that require TX payload with LARGE_CONFIG_GET. ++ * The TX payload is placed into the IPC message data section by caller, ++ * which needs to be copied to temporary buffer since the received data ++ * will overwrite it. ++ */ ++ switch (tx->extension & SOF_IPC4_MOD_EXT_MSG_PARAM_ID_MASK) { ++ case SOF_IPC4_MOD_EXT_MSG_PARAM_ID(SOF_IPC4_SWITCH_CONTROL_PARAM_ID): ++ case SOF_IPC4_MOD_EXT_MSG_PARAM_ID(SOF_IPC4_ENUM_CONTROL_PARAM_ID): ++ return true; ++ default: ++ return false; ++ } ++} ++ + static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data, + size_t payload_bytes, bool set) + { +@@ -419,6 +437,8 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data, + struct sof_ipc4_msg tx = {{ 0 }}; + struct sof_ipc4_msg rx = {{ 0 }}; + size_t remaining = payload_bytes; ++ void *tx_payload_for_get = NULL; ++ size_t tx_data_size = 0; + size_t offset = 0; + size_t chunk_size; + int ret; +@@ -444,10 +464,20 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data, + + tx.extension |= SOF_IPC4_MOD_EXT_MSG_FIRST_BLOCK(1); + ++ if (sof_ipc4_tx_payload_for_get_data(&tx)) { ++ tx_data_size = min(ipc4_msg->data_size, payload_limit); ++ tx_payload_for_get = kmemdup(ipc4_msg->data_ptr, tx_data_size, ++ GFP_KERNEL); ++ if (!tx_payload_for_get) ++ return -ENOMEM; ++ } ++ + /* ensure the DSP is in D0i0 before sending IPC */ + ret = snd_sof_dsp_set_power_state(sdev, &target_state); +- if (ret < 0) ++ if (ret < 0) { ++ kfree(tx_payload_for_get); + return ret; ++ } + + /* Serialise IPC TX */ + mutex_lock(&sdev->ipc->tx_mutex); +@@ -481,7 +511,15 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data, + rx.data_size = chunk_size; + rx.data_ptr = ipc4_msg->data_ptr + offset; + +- tx_size = 0; ++ if (tx_payload_for_get) { ++ tx_size = tx_data_size; ++ tx.data_size = tx_size; ++ tx.data_ptr = tx_payload_for_get; ++ } else { ++ tx_size = 0; ++ tx.data_size = 0; ++ tx.data_ptr = NULL; ++ } + rx_size = chunk_size; + } + +@@ -528,6 +566,8 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data, + + mutex_unlock(&sdev->ipc->tx_mutex); + ++ kfree(tx_payload_for_get); ++ + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.12/asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch b/queue-6.12/asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch new file mode 100644 index 00000000000..ae853f4dcb4 --- /dev/null +++ b/queue-6.12/asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch @@ -0,0 +1,37 @@ +From 643a4f6ec1786590e81d0ca226f68147b7002f19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 11:32:50 +0800 +Subject: ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio + +From: Chen Ni + +[ Upstream commit 74823db9ba2e13f3ec007b354759b3d8125e462c ] + +Add check for the return value of devm_regmap_init_mmio() and return the +error if it fails in order to catch the error. + +Signed-off-by: Chen Ni +Link: https://patch.msgid.link/20260127033250.2044608-1-nichen@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sunxi/sun50i-dmic.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/sunxi/sun50i-dmic.c b/sound/soc/sunxi/sun50i-dmic.c +index 3e751b5694fe3..e8e03a5e35bc7 100644 +--- a/sound/soc/sunxi/sun50i-dmic.c ++++ b/sound/soc/sunxi/sun50i-dmic.c +@@ -358,6 +358,9 @@ static int sun50i_dmic_probe(struct platform_device *pdev) + + host->regmap = devm_regmap_init_mmio(&pdev->dev, base, + &sun50i_dmic_regmap_config); ++ if (IS_ERR(host->regmap)) ++ return dev_err_probe(&pdev->dev, PTR_ERR(host->regmap), ++ "failed to initialise regmap\n"); + + /* Clocks */ + host->bus_clk = devm_clk_get(&pdev->dev, "bus"); +-- +2.51.0 + diff --git a/queue-6.12/asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch b/queue-6.12/asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch new file mode 100644 index 00000000000..5a531d27cf5 --- /dev/null +++ b/queue-6.12/asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch @@ -0,0 +1,36 @@ +From 4c70e75e3752ba7b67792bdd465696a14505bdf3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 04:02:08 +0100 +Subject: ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask + +From: Sebastian Krzyszkowiak + +[ Upstream commit 66c26346ae30c883eef70acf9cf9054dfdb4fb2f ] + +This bit is handled by a separate control. + +Signed-off-by: Sebastian Krzyszkowiak +Reviewed-by: Charles Keepax +Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-1-f4f4eeacf089@puri.sm +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index 08d164ce3e49c..a19ee5ad5d35a 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -1759,7 +1759,7 @@ SND_SOC_BYTES("EQR Coefficients", WM8962_EQ24, 18), + + + SOC_SINGLE("3D Switch", WM8962_THREED1, 0, 1, 0), +-SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA), ++SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA | WM8962_ADC_MONOMIX), + + SOC_SINGLE("DF1 Switch", WM8962_DF1, 0, 1, 0), + SND_SOC_BYTES_MASK("DF1 Coefficients", WM8962_DF1, 7, WM8962_DF1_ENA), +-- +2.51.0 + diff --git a/queue-6.12/asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch b/queue-6.12/asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch new file mode 100644 index 00000000000..39a6d9824be --- /dev/null +++ b/queue-6.12/asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch @@ -0,0 +1,58 @@ +From b85dbdd073b9972d8b4bd4a9c5f6ebf3ca592800 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 04:02:10 +0100 +Subject: ASoC: wm8962: Don't report a microphone if it's shorted to ground on + plug + +From: Sebastian Krzyszkowiak + +[ Upstream commit e590752119029d87ce46d725e11245a52d22e1fe ] + +This usually means that a TRS plug with no microphone pin has been plugged +into a TRRS socket. Cases where a user is plugging in a microphone while +pressing a button will be handled via incoming interrupt after the user +releases the button, so the microphone will still be detected once it +becomes usable. + +Signed-off-by: Sebastian Krzyszkowiak +Reviewed-by: Charles Keepax +Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-3-f4f4eeacf089@puri.sm +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index a19ee5ad5d35a..95143472c9e4f 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -67,6 +67,8 @@ struct wm8962_priv { + struct mutex dsp2_ena_lock; + u16 dsp2_ena; + ++ int mic_status; ++ + struct delayed_work mic_work; + struct snd_soc_jack *jack; + +@@ -3073,8 +3075,16 @@ static void wm8962_mic_work(struct work_struct *work) + if (reg & WM8962_MICSHORT_STS) { + status |= SND_JACK_BTN_0; + irq_pol |= WM8962_MICSCD_IRQ_POL; ++ ++ /* Don't report a microphone if it's shorted right after ++ * plugging in, as this may be a TRS plug in a TRRS socket. ++ */ ++ if (!(wm8962->mic_status & WM8962_MICDET_STS)) ++ status = 0; + } + ++ wm8962->mic_status = status; ++ + snd_soc_jack_report(wm8962->jack, status, + SND_JACK_MICROPHONE | SND_JACK_BTN_0); + +-- +2.51.0 + diff --git a/queue-6.12/ata-libata-avoid-long-timeouts-on-hot-unplugged-sata.patch b/queue-6.12/ata-libata-avoid-long-timeouts-on-hot-unplugged-sata.patch new file mode 100644 index 00000000000..a288a0850f0 --- /dev/null +++ b/queue-6.12/ata-libata-avoid-long-timeouts-on-hot-unplugged-sata.patch @@ -0,0 +1,160 @@ +From 88cfada8d0f1be03373020a1100ab3ed22714e64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 17:46:22 +0800 +Subject: ata: libata: avoid long timeouts on hot-unplugged SATA DAS + +From: Henry Tseng + +[ Upstream commit 151cabd140322205e27dae5c4bbf261ede0056e3 ] + +When a SATA DAS enclosure is connected behind a Thunderbolt PCIe +switch, hot-unplugging the whole enclosure causes pciehp to tear down +the PCI hierarchy before the SCSI layer issues SYNCHRONIZE CACHE and +START STOP UNIT for the disks. + +libata still queues these commands and the AHCI driver tries to access +the HBA registers even though the PCI channel is already offline. This +results in a series of timeouts and error recovery attempts, e.g.: + + [ 824.778346] pcieport 0000:00:07.0: pciehp: Slot(14): Link Down + [ 891.612720] ata8.00: qc timeout after 5000 msecs (cmd 0xec) + [ 902.876501] ata8.00: qc timeout after 10000 msecs (cmd 0xec) + [ 934.107998] ata8.00: qc timeout after 30000 msecs (cmd 0xec) + [ 936.206431] sd 7:0:0:0: [sda] Synchronize Cache(10) failed: + Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK + ... + [ 1006.298356] ata1.00: qc timeout after 5000 msecs (cmd 0xec) + [ 1017.561926] ata1.00: qc timeout after 10000 msecs (cmd 0xec) + [ 1048.791790] ata1.00: qc timeout after 30000 msecs (cmd 0xec) + [ 1050.890035] sd 0:0:0:0: [sdb] Synchronize Cache(10) failed: + Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK + +With this patch applied, the same hot-unplug looks like: + + [ 59.965496] pcieport 0000:00:07.0: pciehp: Slot(14): Link Down + [ 60.002502] sd 7:0:0:0: [sda] Synchronize Cache(10) failed: + Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK + ... + [ 60.103050] sd 0:0:0:0: [sdb] Synchronize Cache(10) failed: + Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK + +In this test setup with two disks, the hot-unplug sequence shrinks from +about 226 seconds (~3.8 minutes) between the Link Down event and the +last SYNCHRONIZE CACHE failure to under a second. Without this patch the +total delay grows roughly with the number of disks, because each disk +gets its own SYNCHRONIZE CACHE and qc timeout series. + +If the underlying PCI device is already gone, these commands cannot +succeed anyway. Avoid issuing them by introducing +ata_adapter_is_online(), which checks pci_channel_offline() for +PCI-based hosts. It is used from ata_scsi_find_dev() to return NULL, +causing the SCSI layer to fail new commands with DID_BAD_TARGET +immediately, and from ata_qc_issue() to bail out before touching the +HBA registers. + +Since such failures would otherwise trigger libata error handling, +ata_adapter_is_online() is also consulted from ata_scsi_port_error_handler(). +When the adapter is offline, libata skips ap->ops->error_handler(ap) and +completes error handling using the existing path, rather than running +a full EH sequence against a dead adapter. + +With this change, SYNCHRONIZE CACHE and START STOP UNIT commands +issued during hot-unplug fail quickly once the PCI channel is offline, +without qc timeout spam or long libata EH delays. + +Suggested-by: Damien Le Moal +Signed-off-by: Henry Tseng +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/libata-core.c | 24 ++++++++++++++++++++++++ + drivers/ata/libata-eh.c | 3 ++- + drivers/ata/libata-scsi.c | 3 +++ + drivers/ata/libata.h | 1 + + 4 files changed, 30 insertions(+), 1 deletion(-) + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 33454d01c2044..39dcefb1fdd54 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -2329,6 +2329,24 @@ static bool ata_dev_check_adapter(struct ata_device *dev, + return false; + } + ++bool ata_adapter_is_online(struct ata_port *ap) ++{ ++ struct device *dev; ++ ++ if (!ap || !ap->host) ++ return false; ++ ++ dev = ap->host->dev; ++ if (!dev) ++ return false; ++ ++ if (dev_is_pci(dev) && ++ pci_channel_offline(to_pci_dev(dev))) ++ return false; ++ ++ return true; ++} ++ + static int ata_dev_config_ncq(struct ata_device *dev, + char *desc, size_t desc_sz) + { +@@ -5023,6 +5041,12 @@ void ata_qc_issue(struct ata_queued_cmd *qc) + qc->flags |= ATA_QCFLAG_ACTIVE; + ap->qc_active |= 1ULL << qc->tag; + ++ /* Make sure the device is still accessible. */ ++ if (!ata_adapter_is_online(ap)) { ++ qc->err_mask |= AC_ERR_HOST_BUS; ++ goto sys_err; ++ } ++ + /* + * We guarantee to LLDs that they will have at least one + * non-zero sg if the command is a data command. +diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c +index 16cd676eae1f9..205c62cf9e32d 100644 +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -738,7 +738,8 @@ void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap) + spin_unlock_irqrestore(ap->lock, flags); + + /* invoke EH, skip if unloading or suspended */ +- if (!(ap->pflags & (ATA_PFLAG_UNLOADING | ATA_PFLAG_SUSPENDED))) ++ if (!(ap->pflags & (ATA_PFLAG_UNLOADING | ATA_PFLAG_SUSPENDED)) && ++ ata_adapter_is_online(ap)) + ap->ops->error_handler(ap); + else { + /* if unloading, commence suicide */ +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index 74842750b2ed4..e39f1b3f6cb4e 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -2838,6 +2838,9 @@ ata_scsi_find_dev(struct ata_port *ap, const struct scsi_device *scsidev) + { + struct ata_device *dev = __ata_scsi_find_dev(ap, scsidev); + ++ if (!ata_adapter_is_online(ap)) ++ return NULL; ++ + if (unlikely(!dev || !ata_dev_enabled(dev))) + return NULL; + +diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h +index 0337be4faec7c..d07693bd054eb 100644 +--- a/drivers/ata/libata.h ++++ b/drivers/ata/libata.h +@@ -82,6 +82,7 @@ extern int atapi_check_dma(struct ata_queued_cmd *qc); + extern void swap_buf_le16(u16 *buf, unsigned int buf_words); + extern bool ata_phys_link_online(struct ata_link *link); + extern bool ata_phys_link_offline(struct ata_link *link); ++bool ata_adapter_is_online(struct ata_port *ap); + extern void ata_dev_init(struct ata_device *dev); + extern void ata_link_init(struct ata_port *ap, struct ata_link *link, int pmp); + extern int sata_link_init_spd(struct ata_link *link); +-- +2.51.0 + diff --git a/queue-6.12/audit-add-fchmodat2-to-change-attributes-class.patch b/queue-6.12/audit-add-fchmodat2-to-change-attributes-class.patch new file mode 100644 index 00000000000..805a80978a0 --- /dev/null +++ b/queue-6.12/audit-add-fchmodat2-to-change-attributes-class.patch @@ -0,0 +1,42 @@ +From 4d9d29f2b3cbe1ce60bf2b76634ccfa72fb7af4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 20:49:30 +0100 +Subject: audit: add fchmodat2() to change attributes class + +From: Jeffrey Bencteux + +[ Upstream commit 4f493a6079b588cf1f04ce5ed6cdad45ab0d53dc ] + +fchmodat2(), introduced in version 6.6 is currently not in the change +attribute class of audit. Calling fchmodat2() to change a file +attribute in the same fashion than chmod() or fchmodat() will bypass +audit rules such as: + +-w /tmp/test -p rwa -k test_rwa + +The current patch adds fchmodat2() to the change attributes class. + +Signed-off-by: Jeffrey Bencteux +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + include/asm-generic/audit_change_attr.h | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/include/asm-generic/audit_change_attr.h b/include/asm-generic/audit_change_attr.h +index 331670807cf01..6c311d4d37f4e 100644 +--- a/include/asm-generic/audit_change_attr.h ++++ b/include/asm-generic/audit_change_attr.h +@@ -20,6 +20,9 @@ __NR_fremovexattr, + __NR_fchownat, + __NR_fchmodat, + #endif ++#ifdef __NR_fchmodat2 ++__NR_fchmodat2, ++#endif + #ifdef __NR_chown32 + __NR_chown32, + __NR_fchown32, +-- +2.51.0 + diff --git a/queue-6.12/audit-add-missing-syscalls-to-read-class.patch b/queue-6.12/audit-add-missing-syscalls-to-read-class.patch new file mode 100644 index 00000000000..1cc8dbb4abe --- /dev/null +++ b/queue-6.12/audit-add-missing-syscalls-to-read-class.patch @@ -0,0 +1,47 @@ +From 0607c835ac439b6d7da1ea340a5693946b3ce4ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Dec 2025 09:39:24 +0100 +Subject: audit: add missing syscalls to read class + +From: Jeffrey Bencteux + +[ Upstream commit bcb90a2834c7393c26df9609b889a3097b7700cd ] + +The "at" variant of getxattr() and listxattr() are missing from the +audit read class. Calling getxattrat() or listxattrat() on a file to +read its extended attributes will bypass audit rules such as: + +-w /tmp/test -p rwa -k test_rwa + +The current patch adds missing syscalls to the audit read class. + +Signed-off-by: Jeffrey Bencteux +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + include/asm-generic/audit_read.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/include/asm-generic/audit_read.h b/include/asm-generic/audit_read.h +index 7bb7b5a83ae2e..fb9991f53fb6f 100644 +--- a/include/asm-generic/audit_read.h ++++ b/include/asm-generic/audit_read.h +@@ -4,9 +4,15 @@ __NR_readlink, + #endif + __NR_quotactl, + __NR_listxattr, ++#ifdef __NR_listxattrat ++__NR_listxattrat, ++#endif + __NR_llistxattr, + __NR_flistxattr, + __NR_getxattr, ++#ifdef __NR_getxattrat ++__NR_getxattrat, ++#endif + __NR_lgetxattr, + __NR_fgetxattr, + #ifdef __NR_readlinkat +-- +2.51.0 + diff --git a/queue-6.12/binder-don-t-use-pk-through-printk.patch b/queue-6.12/binder-don-t-use-pk-through-printk.patch new file mode 100644 index 00000000000..1343883f2fc --- /dev/null +++ b/queue-6.12/binder-don-t-use-pk-through-printk.patch @@ -0,0 +1,83 @@ +From afb67af1336fc103f6e1b8091bdc6551f7753830 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 15:29:50 +0100 +Subject: binder: don't use %pK through printk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 56d21267663bad91e8b10121224ec46366a7937e ] + +In the past %pK was preferable to %p as it would not leak raw pointer +values into the kernel log. Since commit ad67b74d2469 ("printk: hash +addresses printed with %p") the regular %p has been improved to avoid +this issue. Furthermore, restricted pointers ("%pK") were never meant +to be used through printk(). They can still unintentionally leak raw +pointers or acquire sleeping locks in atomic contexts. + +Switch to the regular pointer formatting which is safer and +easier to reason about. + +There are still a few users of %pK left, but these use it through +seq_file, for which its usage is safe. + +Signed-off-by: Thomas Weißschuh +Acked-by: Carlos Llamas +Reviewed-by: Alice Ryhl +Link: https://patch.msgid.link/20260107-restricted-pointers-binder-v1-1-181018bf3812@linutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/android/binder.c | 2 +- + drivers/android/binder_alloc.c | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/android/binder.c b/drivers/android/binder.c +index 9a6d1822dc3be..c470f5cce9911 100644 +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -4444,7 +4444,7 @@ static int binder_thread_write(struct binder_proc *proc, + } + } + binder_debug(BINDER_DEBUG_DEAD_BINDER, +- "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n", ++ "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n", + proc->pid, thread->pid, (u64)cookie, + death); + if (death == NULL) { +diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c +index b3acbc4174fb1..7556f470f921b 100644 +--- a/drivers/android/binder_alloc.c ++++ b/drivers/android/binder_alloc.c +@@ -79,7 +79,7 @@ static void binder_insert_free_buffer(struct binder_alloc *alloc, + new_buffer_size = binder_alloc_buffer_size(alloc, new_buffer); + + binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC, +- "%d: add free buffer, size %zd, at %pK\n", ++ "%d: add free buffer, size %zd, at %p\n", + alloc->pid, new_buffer_size, new_buffer); + + while (*p) { +@@ -493,7 +493,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked( + } + + binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC, +- "%d: binder_alloc_buf size %zd got buffer %pK size %zd\n", ++ "%d: binder_alloc_buf size %zd got buffer %p size %zd\n", + alloc->pid, size, buffer, buffer_size); + + /* +@@ -668,7 +668,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc, + ALIGN(buffer->extra_buffers_size, sizeof(void *)); + + binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC, +- "%d: binder_free_buf %pK size %zd buffer_size %zd\n", ++ "%d: binder_free_buf %p size %zd buffer_size %zd\n", + alloc->pid, buffer, size, buffer_size); + + BUG_ON(buffer->free); +-- +2.51.0 + diff --git a/queue-6.12/blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch b/queue-6.12/blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch new file mode 100644 index 00000000000..f3137aadeaa --- /dev/null +++ b/queue-6.12/blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch @@ -0,0 +1,42 @@ +From e203661dc6a79e94771b43707a0ae35bfa9d1cda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 16:05:22 +0800 +Subject: blk-mq-debugfs: add missing debugfs_mutex in + blk_mq_debugfs_register_hctxs() + +From: Yu Kuai + +[ Upstream commit 9d20fd6ce1ba9733cd5ac96fcab32faa9fc404dd ] + +In blk_mq_update_nr_hw_queues(), debugfs_mutex is not held while +creating debugfs entries for hctxs. Hence add debugfs_mutex there, +it's safe because queue is not frozen. + +Signed-off-by: Yu Kuai +Reviewed-by: Nilay Shroff +Reviewed-by: Ming Lei +Reviewed-by: Hannes Reinecke +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-debugfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c +index 5463697a84428..cbc8bbde3a2bb 100644 +--- a/block/blk-mq-debugfs.c ++++ b/block/blk-mq-debugfs.c +@@ -713,8 +713,10 @@ void blk_mq_debugfs_register_hctxs(struct request_queue *q) + struct blk_mq_hw_ctx *hctx; + unsigned long i; + ++ mutex_lock(&q->debugfs_mutex); + queue_for_each_hw_ctx(q, hctx, i) + blk_mq_debugfs_register_hctx(q, hctx); ++ mutex_unlock(&q->debugfs_mutex); + } + + void blk_mq_debugfs_unregister_hctxs(struct request_queue *q) +-- +2.51.0 + diff --git a/queue-6.12/block-decouple-secure-erase-size-limit-from-discard-.patch b/queue-6.12/block-decouple-secure-erase-size-limit-from-discard-.patch new file mode 100644 index 00000000000..5e26dd8d1a5 --- /dev/null +++ b/queue-6.12/block-decouple-secure-erase-size-limit-from-discard-.patch @@ -0,0 +1,91 @@ +From acfaa9f648652ab57a1f429c783a1f720a803336 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 11:40:02 +0800 +Subject: block: decouple secure erase size limit from discard size limit + +From: Luke Wang + +[ Upstream commit ee81212f74a57c5d2b56cf504f40d528dac6faaf ] + +Secure erase should use max_secure_erase_sectors instead of being limited +by max_discard_sectors. Separate the handling of REQ_OP_SECURE_ERASE from +REQ_OP_DISCARD to allow each operation to use its own size limit. + +Signed-off-by: Luke Wang +Reviewed-by: Ulf Hansson +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-merge.c | 21 +++++++++++++++++---- + block/blk.h | 6 +++++- + 2 files changed, 22 insertions(+), 5 deletions(-) + +diff --git a/block/blk-merge.c b/block/blk-merge.c +index 7ddd7dd23dda8..68dc8076d8cbc 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -130,8 +130,9 @@ static struct bio *bio_submit_split(struct bio *bio, int split_sectors) + return bio; + } + +-struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim, +- unsigned *nsegs) ++static struct bio *__bio_split_discard(struct bio *bio, ++ const struct queue_limits *lim, unsigned *nsegs, ++ unsigned int max_sectors) + { + unsigned int max_discard_sectors, granularity; + sector_t tmp; +@@ -141,8 +142,7 @@ struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim, + + granularity = max(lim->discard_granularity >> 9, 1U); + +- max_discard_sectors = +- min(lim->max_discard_sectors, bio_allowed_max_sectors(lim)); ++ max_discard_sectors = min(max_sectors, bio_allowed_max_sectors(lim)); + max_discard_sectors -= max_discard_sectors % granularity; + if (unlikely(!max_discard_sectors)) + return bio; +@@ -166,6 +166,19 @@ struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim, + return bio_submit_split(bio, split_sectors); + } + ++struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim, ++ unsigned *nsegs) ++{ ++ unsigned int max_sectors; ++ ++ if (bio_op(bio) == REQ_OP_SECURE_ERASE) ++ max_sectors = lim->max_secure_erase_sectors; ++ else ++ max_sectors = lim->max_discard_sectors; ++ ++ return __bio_split_discard(bio, lim, nsegs, max_sectors); ++} ++ + static inline unsigned int blk_boundary_sectors(const struct queue_limits *lim, + bool is_atomic) + { +diff --git a/block/blk.h b/block/blk.h +index 63c92db0a5079..e7d7c5c636524 100644 +--- a/block/blk.h ++++ b/block/blk.h +@@ -193,10 +193,14 @@ static inline unsigned int blk_queue_get_max_sectors(struct request *rq) + struct request_queue *q = rq->q; + enum req_op op = req_op(rq); + +- if (unlikely(op == REQ_OP_DISCARD || op == REQ_OP_SECURE_ERASE)) ++ if (unlikely(op == REQ_OP_DISCARD)) + return min(q->limits.max_discard_sectors, + UINT_MAX >> SECTOR_SHIFT); + ++ if (unlikely(op == REQ_OP_SECURE_ERASE)) ++ return min(q->limits.max_secure_erase_sectors, ++ UINT_MAX >> SECTOR_SHIFT); ++ + if (unlikely(op == REQ_OP_WRITE_ZEROES)) + return q->limits.max_write_zeroes_sectors; + +-- +2.51.0 + diff --git a/queue-6.12/bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch b/queue-6.12/bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch new file mode 100644 index 00000000000..6c79558ba91 --- /dev/null +++ b/queue-6.12/bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch @@ -0,0 +1,37 @@ +From 9fd53e10f9914f3e3f1c4b4ad4fa54edfdb9c19e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 10:13:04 +0100 +Subject: Bluetooth: btusb: Add device ID for Realtek RTL8761BU + +From: Jacopo Scannella + +[ Upstream commit cc6383d4f0cf6127c0552f94cae517a06ccc6b17 ] + +Add USB device ID 0x2c0a:0x8761 to the btusb driver fo the Realtek +RTL8761BU Bluetooth adapter. + +Reference: +https://www.startech.com/en-us/networking-io/av53c1-usb-bluetooth + +Signed-off-by: Jacopo Scannella +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 147d4fcdea3c0..9d3236321056b 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -757,6 +757,7 @@ static const struct usb_device_id quirks_table[] = { + + /* Additional Realtek 8723BU Bluetooth devices */ + { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK }, ++ { USB_DEVICE(0x2c0a, 0x8761), .driver_info = BTUSB_REALTEK }, + + /* Additional Realtek 8723DE Bluetooth devices */ + { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK }, +-- +2.51.0 + diff --git a/queue-6.12/bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch b/queue-6.12/bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch new file mode 100644 index 00000000000..d16e49e884a --- /dev/null +++ b/queue-6.12/bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch @@ -0,0 +1,74 @@ +From 998b87f9b4d97781a298a914b1210993c61628bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 15:03:35 +1100 +Subject: Bluetooth: btusb: Add new VID/PID for RTL8852CE + +From: Shell Chen + +[ Upstream commit d9f7c39c6b7548bd70519b241b6c2d1bcc658d4b ] + +Add VID:PID 13d3:3612 to the quirks_table. + +This ID pair is found in the Realtek RTL8852CE PCIe module +in an ASUS TUF A14 2025 (FA401KM) laptop. + +Tested on aforementioned laptop. + +The device info from /sys/kernel/debug/usb/devices is listed as below. + +T: Bus=03 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 +D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=13d3 ProdID=3612 Rev= 0.00 +S: Manufacturer=Realtek +S: Product=Bluetooth Radio +S: SerialNumber=00e04c000001 +C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms + +Signed-off-by: Shell Chen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 4a12332917c5c..147d4fcdea3c0 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -551,6 +551,8 @@ static const struct usb_device_id quirks_table[] = { + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x13d3, 0x3592), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, ++ { USB_DEVICE(0x13d3, 0x3612), .driver_info = BTUSB_REALTEK | ++ BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0489, 0xe122), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, + +-- +2.51.0 + diff --git a/queue-6.12/bluetooth-btusb-add-support-for-mediatek7920-0489-e1.patch b/queue-6.12/bluetooth-btusb-add-support-for-mediatek7920-0489-e1.patch new file mode 100644 index 00000000000..33fb249f4a2 --- /dev/null +++ b/queue-6.12/bluetooth-btusb-add-support-for-mediatek7920-0489-e1.patch @@ -0,0 +1,76 @@ +From 1b49f234a966881c56e2e5b78b514fe7b85d4a78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Dec 2025 23:22:25 +0300 +Subject: Bluetooth: btusb: Add support for MediaTek7920 0489:e158 + +From: Bluecross + +[ Upstream commit 2630bcc8343a9d2a38dc1793068e6754b3156811 ] + +Add support for MediaTek7920 0489:e158 + +/sys/kernel/debug/usb/devices reports for that device: + +T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=03 Dev#= 5 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=0489 ProdID=e158 Rev= 1.00 +S: Manufacturer=MediaTek Inc. +S: Product=Wireless_Device +S: SerialNumber=000000000 +C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA +A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) +E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us +E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us +I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) +E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us +E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us + +Signed-off-by: Andrew Elatsev +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 490efe4d67a97..4a12332917c5c 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -625,6 +625,8 @@ static const struct usb_device_id quirks_table[] = { + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x13d3, 0x3622), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH }, ++ { USB_DEVICE(0x0489, 0xe158), .driver_info = BTUSB_MEDIATEK | ++ BTUSB_WIDEBAND_SPEECH }, + + /* Additional MediaTek MT7921 Bluetooth devices */ + { USB_DEVICE(0x0489, 0xe0c8), .driver_info = BTUSB_MEDIATEK | +-- +2.51.0 + diff --git a/queue-6.12/bluetooth-hci_conn-set-link_policy-on-incoming-acl-c.patch b/queue-6.12/bluetooth-hci_conn-set-link_policy-on-incoming-acl-c.patch new file mode 100644 index 00000000000..dd269d401fa --- /dev/null +++ b/queue-6.12/bluetooth-hci_conn-set-link_policy-on-incoming-acl-c.patch @@ -0,0 +1,54 @@ +From 9469b3b5757c702e54bb446a4cfa38148067f78b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 10:20:10 +0100 +Subject: Bluetooth: hci_conn: Set link_policy on incoming ACL connections +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stefan Sørensen + +[ Upstream commit 4bb091013ab0f2edfed3f58bebe658a798cbcc4d ] + +The connection link policy is only set when establishing an outgoing +ACL connection causing connection idle modes not to be available on +incoming connections. Move the setting of the link policy to the +creation of the connection so all ACL connection will use the link +policy set on the HCI device. + +Signed-off-by: Stefan Sørensen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_conn.c | 1 + + net/bluetooth/hci_sync.c | 2 -- + 2 files changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index dad9020474149..9d735f54f19ca 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -967,6 +967,7 @@ static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t + switch (type) { + case ACL_LINK: + conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK; ++ conn->link_policy = hdev->link_policy; + conn->mtu = hdev->acl_mtu; + break; + case LE_LINK: +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index f79b38603205c..00de90fee44a7 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -6853,8 +6853,6 @@ static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data) + + conn->attempt++; + +- conn->link_policy = hdev->link_policy; +- + memset(&cp, 0, sizeof(cp)); + bacpy(&cp.bdaddr, &conn->dst); + cp.pscan_rep_mode = 0x02; +-- +2.51.0 + diff --git a/queue-6.12/bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch b/queue-6.12/bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch new file mode 100644 index 00000000000..22e0ef8f255 --- /dev/null +++ b/queue-6.12/bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch @@ -0,0 +1,46 @@ +From 7ace02daa1c48d3303551b63386fbd091513209e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 10:20:09 +0100 +Subject: Bluetooth: hci_conn: use mod_delayed_work for active mode timeout +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stefan Sørensen + +[ Upstream commit 49d0901e260739de2fcc90c0c29f9e31e39a2d9b ] + +hci_conn_enter_active_mode() uses queue_delayed_work() with the +intention that the work will run after the given timeout. However, +queue_delayed_work() does nothing if the work is already queued, so +depending on the link policy we may end up putting the connection +into idle mode every hdev->idle_timeout ms. + +Use mod_delayed_work() instead so the work is queued if not already +queued, and the timeout is updated otherwise. + +Signed-off-by: Stefan Sørensen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_conn.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 9d735f54f19ca..fa74fac5af778 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -2512,8 +2512,8 @@ void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active) + + timer: + if (hdev->idle_timeout > 0) +- queue_delayed_work(hdev->workqueue, &conn->idle_work, +- msecs_to_jiffies(hdev->idle_timeout)); ++ mod_delayed_work(hdev->workqueue, &conn->idle_work, ++ msecs_to_jiffies(hdev->idle_timeout)); + } + + /* Drop all connection on the device */ +-- +2.51.0 + diff --git a/queue-6.12/bnxt_en-allow-ntuple-filters-for-drops.patch b/queue-6.12/bnxt_en-allow-ntuple-filters-for-drops.patch new file mode 100644 index 00000000000..d6140210ad5 --- /dev/null +++ b/queue-6.12/bnxt_en-allow-ntuple-filters-for-drops.patch @@ -0,0 +1,94 @@ +From acd2aa398d827fd2c38558371cc09d2ebcb58ca7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 16:30:41 -0800 +Subject: bnxt_en: Allow ntuple filters for drops + +From: Joe Damato + +[ Upstream commit 61cef6454cfbb9fcdbe41401fb53895f86603081 ] + +It appears that in commit 7efd79c0e689 ("bnxt_en: Add drop action +support for ntuple"), bnxt gained support for ntuple filters for packet +drops. + +However, support for this does not seem to work in recent kernels or +against net-next: + + % sudo ethtool -U eth0 flow-type udp4 src-ip 1.1.1.1 action -1 + rmgr: Cannot insert RX class rule: Operation not supported + Cannot insert classification rule + +The issue is that the existing code uses ethtool_get_flow_spec_ring_vf, +which will return a non-zero value if the ring_cookie is set to +RX_CLS_FLOW_DISC, which then causes bnxt_add_ntuple_cls_rule to return +-EOPNOTSUPP because it thinks the user is trying to set an ntuple filter +for a vf. + +Fix this by first checking that the ring_cookie is not RX_CLS_FLOW_DISC. + +After this patch, ntuple filters for drops can be added: + + % sudo ethtool -U eth0 flow-type udp4 src-ip 1.1.1.1 action -1 + Added rule with ID 0 + + % ethtool -n eth0 + 44 RX rings available + Total 1 rules + + Filter: 0 + Rule Type: UDP over IPv4 + Src IP addr: 1.1.1.1 mask: 0.0.0.0 + Dest IP addr: 0.0.0.0 mask: 255.255.255.255 + TOS: 0x0 mask: 0xff + Src port: 0 mask: 0xffff + Dest port: 0 mask: 0xffff + Action: Drop + +Reviewed-by: Michael Chan +Signed-off-by: Joe Damato +Link: https://patch.msgid.link/20260131003042.2570434-1-joe@dama.to +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 54ae90526d8ff..0a8f3dc3c2f01 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -1321,16 +1321,17 @@ static int bnxt_add_ntuple_cls_rule(struct bnxt *bp, + struct bnxt_l2_filter *l2_fltr; + struct bnxt_flow_masks *fmasks; + struct flow_keys *fkeys; +- u32 idx, ring; ++ u32 idx; + int rc; +- u8 vf; + + if (!bp->vnic_info) + return -EAGAIN; + +- vf = ethtool_get_flow_spec_ring_vf(fs->ring_cookie); +- ring = ethtool_get_flow_spec_ring(fs->ring_cookie); +- if ((fs->flow_type & (FLOW_MAC_EXT | FLOW_EXT)) || vf) ++ if (fs->flow_type & (FLOW_MAC_EXT | FLOW_EXT)) ++ return -EOPNOTSUPP; ++ ++ if (fs->ring_cookie != RX_CLS_FLOW_DISC && ++ ethtool_get_flow_spec_ring_vf(fs->ring_cookie)) + return -EOPNOTSUPP; + + if (flow_type == IP_USER_FLOW) { +@@ -1454,7 +1455,7 @@ static int bnxt_add_ntuple_cls_rule(struct bnxt *bp, + if (fs->ring_cookie == RX_CLS_FLOW_DISC) + new_fltr->base.flags |= BNXT_ACT_DROP; + else +- new_fltr->base.rxq = ring; ++ new_fltr->base.rxq = ethtool_get_flow_spec_ring(fs->ring_cookie); + __set_bit(BNXT_FLTR_VALID, &new_fltr->base.state); + rc = bnxt_insert_ntp_filter(bp, new_fltr, idx); + if (!rc) { +-- +2.51.0 + diff --git a/queue-6.12/bpf-crypto-use-the-correct-destructor-kfunc-type.patch b/queue-6.12/bpf-crypto-use-the-correct-destructor-kfunc-type.patch new file mode 100644 index 00000000000..db64755f268 --- /dev/null +++ b/queue-6.12/bpf-crypto-use-the-correct-destructor-kfunc-type.patch @@ -0,0 +1,63 @@ +From 773f7a7d3ec7b32c9436ba6fe017bbb9a1f3447b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 08:25:50 +0000 +Subject: bpf: crypto: Use the correct destructor kfunc type + +From: Sami Tolvanen + +[ Upstream commit b40a5d724f29fc2eed23ff353808a9aae616b48a ] + +With CONFIG_CFI enabled, the kernel strictly enforces that indirect +function calls use a function pointer type that matches the target +function. I ran into the following type mismatch when running BPF +self-tests: + + CFI failure at bpf_obj_free_fields+0x190/0x238 (target: + bpf_crypto_ctx_release+0x0/0x94; expected type: 0xa488ebfc) + Internal error: Oops - CFI: 00000000f2008228 [#1] SMP + ... + +As bpf_crypto_ctx_release() is also used in BPF programs and using +a void pointer as the argument would make the verifier unhappy, add +a simple stub function with the correct type and register it as the +destructor kfunc instead. + +Signed-off-by: Sami Tolvanen +Acked-by: Yonghong Song +Tested-by: Viktor Malik +Link: https://lore.kernel.org/r/20260110082548.113748-7-samitolvanen@google.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/crypto.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/kernel/bpf/crypto.c b/kernel/bpf/crypto.c +index 83c4d9943084b..1d024fe7248ac 100644 +--- a/kernel/bpf/crypto.c ++++ b/kernel/bpf/crypto.c +@@ -261,6 +261,12 @@ __bpf_kfunc void bpf_crypto_ctx_release(struct bpf_crypto_ctx *ctx) + call_rcu(&ctx->rcu, crypto_free_cb); + } + ++__bpf_kfunc void bpf_crypto_ctx_release_dtor(void *ctx) ++{ ++ bpf_crypto_ctx_release(ctx); ++} ++CFI_NOSEAL(bpf_crypto_ctx_release_dtor); ++ + static int bpf_crypto_crypt(const struct bpf_crypto_ctx *ctx, + const struct bpf_dynptr_kern *src, + const struct bpf_dynptr_kern *dst, +@@ -368,7 +374,7 @@ static const struct btf_kfunc_id_set crypt_kfunc_set = { + + BTF_ID_LIST(bpf_crypto_dtor_ids) + BTF_ID(struct, bpf_crypto_ctx) +-BTF_ID(func, bpf_crypto_ctx_release) ++BTF_ID(func, bpf_crypto_ctx_release_dtor) + + static int __init crypto_kfunc_init(void) + { +-- +2.51.0 + diff --git a/queue-6.12/bpf-recognize-special-arithmetic-shift-in-the-verifi.patch b/queue-6.12/bpf-recognize-special-arithmetic-shift-in-the-verifi.patch new file mode 100644 index 00000000000..59e845a2002 --- /dev/null +++ b/queue-6.12/bpf-recognize-special-arithmetic-shift-in-the-verifi.patch @@ -0,0 +1,181 @@ +From 034c59a3559f8045b49b94477d596c9259b4631c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 12:13:57 -0800 +Subject: bpf: Recognize special arithmetic shift in the verifier + +From: Alexei Starovoitov + +[ Upstream commit bffacdb80b93b7b5e96b26fad64cc490a6c7d6c7 ] + +cilium bpf_wiregard.bpf.c when compiled with -O1 fails to load +with the following verifier log: + +192: (79) r2 = *(u64 *)(r10 -304) ; R2=pkt(r=40) R10=fp0 fp-304=pkt(r=40) +... +227: (85) call bpf_skb_store_bytes#9 ; R0=scalar() +228: (bc) w2 = w0 ; R0=scalar() R2=scalar(smin=0,smax=umax=0xffffffff,var_off=(0x0; 0xffffffff)) +229: (c4) w2 s>>= 31 ; R2=scalar(smin=0,smax=umax=0xffffffff,smin32=-1,smax32=0,var_off=(0x0; 0xffffffff)) +230: (54) w2 &= -134 ; R2=scalar(smin=0,smax=umax=umax32=0xffffff7a,smax32=0x7fffff7a,var_off=(0x0; 0xffffff7a)) +... +232: (66) if w2 s> 0xffffffff goto pc+125 ; R2=scalar(smin=umin=umin32=0x80000000,smax=umax=umax32=0xffffff7a,smax32=-134,var_off=(0x80000000; 0x7fffff7a)) +... +238: (79) r4 = *(u64 *)(r10 -304) ; R4=scalar() R10=fp0 fp-304=scalar() +239: (56) if w2 != 0xffffff78 goto pc+210 ; R2=0xffffff78 // -136 +... +258: (71) r1 = *(u8 *)(r4 +0) +R4 invalid mem access 'scalar' + +The error might confuse most bpf authors, since fp-304 slot had 'pkt' +pointer at insn 192 and became 'scalar' at 238. That happened because +bpf_skb_store_bytes() clears all packet pointers including those in +the stack. On the first glance it might look like a bug in the source +code, since ctx->data pointer should have been reloaded after the call +to bpf_skb_store_bytes(). + +The relevant part of cilium source code looks like this: + +// bpf/lib/nodeport.h +int dsr_set_ipip6() +{ + if (ctx_adjust_hroom(...)) + return DROP_INVALID; // -134 + if (ctx_store_bytes(...)) + return DROP_WRITE_ERROR; // -141 + return 0; +} + +bool dsr_fail_needs_reply(int code) +{ + if (code == DROP_FRAG_NEEDED) // -136 + return true; + return false; +} + +tail_nodeport_ipv6_dsr() +{ + ret = dsr_set_ipip6(...); + if (!IS_ERR(ret)) { + ... + } else { + if (dsr_fail_needs_reply(ret)) + return dsr_reply_icmp6(...); + } +} + +The code doesn't have arithmetic shift by 31 and it reloads ctx->data +every time it needs to access it. So it's not a bug in the source code. + +The reason is DAGCombiner::foldSelectCCToShiftAnd() LLVM transformation: + + // If this is a select where the false operand is zero and the compare is a + // check of the sign bit, see if we can perform the "gzip trick": + // select_cc setlt X, 0, A, 0 -> and (sra X, size(X)-1), A + // select_cc setgt X, 0, A, 0 -> and (not (sra X, size(X)-1)), A + +The conditional branch in dsr_set_ipip6() and its return values +are optimized into BPF_ARSH plus BPF_AND: + +227: (85) call bpf_skb_store_bytes#9 +228: (bc) w2 = w0 +229: (c4) w2 s>>= 31 ; R2=scalar(smin=0,smax=umax=0xffffffff,smin32=-1,smax32=0,var_off=(0x0; 0xffffffff)) +230: (54) w2 &= -134 ; R2=scalar(smin=0,smax=umax=umax32=0xffffff7a,smax32=0x7fffff7a,var_off=(0x0; 0xffffff7a)) + +after insn 230 the register w2 can only be 0 or -134, +but the verifier approximates it, since there is no way to +represent two scalars in bpf_reg_state. +After fallthough at insn 232 the w2 can only be -134, +hence the branch at insn +239: (56) if w2 != -136 goto pc+210 +should be always taken, and trapping insn 258 should never execute. +LLVM generated correct code, but the verifier follows impossible +path and rejects valid program. To fix this issue recognize this +special LLVM optimization and fork the verifier state. +So after insn 229: (c4) w2 s>>= 31 +the verifier has two states to explore: +one with w2 = 0 and another with w2 = 0xffffffff +which makes the verifier accept bpf_wiregard.c + +A similar pattern exists were OR operation is used in place of the AND +operation, the verifier detects that pattern as well by forking the +state before the OR operation with a scalar in range [-1,0]. + +Note there are 20+ such patterns in bpf_wiregard.o compiled +with -O1 and -O2, but they're rarely seen in other production +bpf programs, so push_stack() approach is not a concern. + +Reported-by: Hao Sun +Signed-off-by: Alexei Starovoitov +Co-developed-by: Puranjay Mohan +Signed-off-by: Puranjay Mohan +Link: https://lore.kernel.org/r/20260112201424.816836-2-puranjay@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 39 +++++++++++++++++++++++++++++++++++++++ + 1 file changed, 39 insertions(+) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index aa6f536355767..a9e2380327b45 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -14192,6 +14192,35 @@ static bool is_safe_to_compute_dst_reg_range(struct bpf_insn *insn, + } + } + ++static int maybe_fork_scalars(struct bpf_verifier_env *env, struct bpf_insn *insn, ++ struct bpf_reg_state *dst_reg) ++{ ++ struct bpf_verifier_state *branch; ++ struct bpf_reg_state *regs; ++ bool alu32; ++ ++ if (dst_reg->smin_value == -1 && dst_reg->smax_value == 0) ++ alu32 = false; ++ else if (dst_reg->s32_min_value == -1 && dst_reg->s32_max_value == 0) ++ alu32 = true; ++ else ++ return 0; ++ ++ branch = push_stack(env, env->insn_idx + 1, env->insn_idx, false); ++ if (IS_ERR(branch)) ++ return PTR_ERR(branch); ++ ++ regs = branch->frame[branch->curframe]->regs; ++ if (alu32) { ++ __mark_reg32_known(®s[insn->dst_reg], 0); ++ __mark_reg32_known(dst_reg, -1ull); ++ } else { ++ __mark_reg_known(®s[insn->dst_reg], 0); ++ __mark_reg_known(dst_reg, -1ull); ++ } ++ return 0; ++} ++ + /* WARNING: This function does calculations on 64-bit values, but the actual + * execution may occur on 32-bit values. Therefore, things like bitshifts + * need extra checks in the 32-bit case. +@@ -14247,11 +14276,21 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env, + scalar_min_max_mul(dst_reg, &src_reg); + break; + case BPF_AND: ++ if (tnum_is_const(src_reg.var_off)) { ++ ret = maybe_fork_scalars(env, insn, dst_reg); ++ if (ret) ++ return ret; ++ } + dst_reg->var_off = tnum_and(dst_reg->var_off, src_reg.var_off); + scalar32_min_max_and(dst_reg, &src_reg); + scalar_min_max_and(dst_reg, &src_reg); + break; + case BPF_OR: ++ if (tnum_is_const(src_reg.var_off)) { ++ ret = maybe_fork_scalars(env, insn, dst_reg); ++ if (ret) ++ return ret; ++ } + dst_reg->var_off = tnum_or(dst_reg->var_off, src_reg.var_off); + scalar32_min_max_or(dst_reg, &src_reg); + scalar_min_max_or(dst_reg, &src_reg); +-- +2.51.0 + diff --git a/queue-6.12/bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch b/queue-6.12/bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch new file mode 100644 index 00000000000..0c03c3f82fb --- /dev/null +++ b/queue-6.12/bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch @@ -0,0 +1,72 @@ +From 7ae43d968cda2ce933e72c728b8a732588d53e61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 18:02:19 +0000 +Subject: bpf: verifier improvement in 32bit shift sign extension pattern + +From: Cupertino Miranda + +[ Upstream commit d18dec4b8990048ce75f0ece32bb96b3fbd3f422 ] + +This patch improves the verifier to correctly compute bounds for +sign extension compiler pattern composed of left shift by 32bits +followed by a sign right shift by 32bits. Pattern in the verifier was +limitted to positive value bounds and would reset bound computation for +negative values. New code allows both positive and negative values for +sign extension without compromising bound computation and verifier to +pass. + +This change is required by GCC which generate such pattern, and was +detected in the context of systemd, as described in the following GCC +bugzilla: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119731 + +Three new tests were added in verifier_subreg.c. + +Signed-off-by: Cupertino Miranda +Signed-off-by: Andrew Pinski +Acked-by: Eduard Zingerman +Cc: David Faust +Cc: Jose Marchesi +Cc: Elena Zannoni +Link: https://lore.kernel.org/r/20251202180220.11128-2-cupertino.miranda@oracle.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 18 +++++++----------- + 1 file changed, 7 insertions(+), 11 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 08cdf6ace02ac..aa6f536355767 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -13999,21 +13999,17 @@ static void __scalar64_min_max_lsh(struct bpf_reg_state *dst_reg, + u64 umin_val, u64 umax_val) + { + /* Special case <<32 because it is a common compiler pattern to sign +- * extend subreg by doing <<32 s>>32. In this case if 32bit bounds are +- * positive we know this shift will also be positive so we can track +- * bounds correctly. Otherwise we lose all sign bit information except +- * what we can pick up from var_off. Perhaps we can generalize this +- * later to shifts of any length. ++ * extend subreg by doing <<32 s>>32. smin/smax assignments are correct ++ * because s32 bounds don't flip sign when shifting to the left by ++ * 32bits. + */ +- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_max_value >= 0) ++ if (umin_val == 32 && umax_val == 32) { + dst_reg->smax_value = (s64)dst_reg->s32_max_value << 32; +- else +- dst_reg->smax_value = S64_MAX; +- +- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_min_value >= 0) + dst_reg->smin_value = (s64)dst_reg->s32_min_value << 32; +- else ++ } else { ++ dst_reg->smax_value = S64_MAX; + dst_reg->smin_value = S64_MIN; ++ } + + /* If we might shift our top bit out, then we know nothing */ + if (dst_reg->umax_value > 1ULL << (63 - umax_val)) { +-- +2.51.0 + diff --git a/queue-6.12/btrfs-fallback-to-buffered-io-if-the-data-profile-ha.patch b/queue-6.12/btrfs-fallback-to-buffered-io-if-the-data-profile-ha.patch new file mode 100644 index 00000000000..edb29568ee1 --- /dev/null +++ b/queue-6.12/btrfs-fallback-to-buffered-io-if-the-data-profile-ha.patch @@ -0,0 +1,108 @@ +From be329b44dc345c110279260701df0facbf5baed0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Nov 2025 10:22:16 +1030 +Subject: btrfs: fallback to buffered IO if the data profile has duplication + +From: Qu Wenruo + +[ Upstream commit 7c2830f00c3e086292c1ee9f27b61efaf8e76c9a ] + +[BACKGROUND] +Inspired by a recent kernel bug report, which is related to direct IO +buffer modification during writeback, that leads to contents mismatch of +different RAID1 mirrors. + +[CAUSE AND PROBLEMS] +The root cause is exactly the same explained in commit 968f19c5b1b7 +("btrfs: always fallback to buffered write if the inode requires +checksum"), that we can not trust direct IO buffer which can be modified +halfway during writeback. + +Unlike data checksum verification, if this happened on inodes without +data checksum but has the data has extra mirrors, it will lead to +stealth data mismatch on different mirrors. + +This will be way harder to detect without data checksum. + +Furthermore for RAID56, we can even have data without checksum and data +with checksum mixed inside the same full stripe. + +In that case if the direct IO buffer got changed halfway for the +nodatasum part, the data with checksum immediately lost its ability to +recover, e.g.: + +" " = Good old data or parity calculated using good old data +"X" = Data modified during writeback + + 0 32K 64K + Data 1 | | Has csum + Data 2 |XXXXXXXXXXXXXXXX | No csum + Parity | | + +In above case, the parity is calculated using data 1 (has csum, from +page cache, won't change during writeback), and old data 2 (has no csum, +direct IO write). + +After parity is calculated, but before submission to the storage, direct +IO buffer of data 2 is modified, causing the range [0, 32K) of data 2 +has a different content. + +Now all data is submitted to the storage, and the fs got fully synced. + +Then the device of data 1 is lost, has to be rebuilt from data 2 and +parity. But since the data 2 has some modified data, and the parity is +calculated using old data, the recovered data is no the same for data 1, +causing data checksum mismatch. + +[FIX] +Fix the problem by checking the data allocation profile. +If our data allocation profile is either RAID0 or SINGLE, we can allow +true zero-copy direct IO and the end user is fully responsible for any +race. + +However this is not going to fix all situations, as it's still possible +to race with balance where the fs got a new data profile after the data +allocation profile check. +But this fix should still greatly reduce the window of the original bug. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=99171 +Signed-off-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/direct-io.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/fs/btrfs/direct-io.c b/fs/btrfs/direct-io.c +index 71984d7db839b..fb414643f223d 100644 +--- a/fs/btrfs/direct-io.c ++++ b/fs/btrfs/direct-io.c +@@ -803,6 +803,8 @@ ssize_t btrfs_direct_write(struct kiocb *iocb, struct iov_iter *from) + ssize_t ret; + unsigned int ilock_flags = 0; + struct iomap_dio *dio; ++ const u64 data_profile = btrfs_data_alloc_profile(fs_info) & ++ BTRFS_BLOCK_GROUP_PROFILE_MASK; + + if (iocb->ki_flags & IOCB_NOWAIT) + ilock_flags |= BTRFS_ILOCK_TRY; +@@ -816,6 +818,16 @@ ssize_t btrfs_direct_write(struct kiocb *iocb, struct iov_iter *from) + if (iocb->ki_pos + iov_iter_count(from) <= i_size_read(inode) && IS_NOSEC(inode)) + ilock_flags |= BTRFS_ILOCK_SHARED; + ++ /* ++ * If our data profile has duplication (either extra mirrors or RAID56), ++ * we can not trust the direct IO buffer, the content may change during ++ * writeback and cause different contents written to different mirrors. ++ * ++ * Thus only RAID0 and SINGLE can go true zero-copy direct IO. ++ */ ++ if (data_profile != BTRFS_BLOCK_GROUP_RAID0 && data_profile != 0) ++ goto buffered; ++ + relock: + ret = btrfs_inode_lock(BTRFS_I(inode), ilock_flags); + if (ret < 0) +-- +2.51.0 + diff --git a/queue-6.12/btrfs-handle-user-interrupt-properly-in-btrfs_trim_f.patch b/queue-6.12/btrfs-handle-user-interrupt-properly-in-btrfs_trim_f.patch new file mode 100644 index 00000000000..56458dca71c --- /dev/null +++ b/queue-6.12/btrfs-handle-user-interrupt-properly-in-btrfs_trim_f.patch @@ -0,0 +1,76 @@ +From c866003182c8559dffee1726f7c6150cae1b24d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 07:06:40 +0000 +Subject: btrfs: handle user interrupt properly in btrfs_trim_fs() + +From: jinbaohong + +[ Upstream commit bfb670b9183b0e4ba660aff2e396ec1cc01d0761 ] + +When a fatal signal is pending or the process is freezing, +btrfs_trim_block_group() and btrfs_trim_free_extents() return -ERESTARTSYS. +Currently this is treated as a regular error: the loops continue to the +next iteration and count it as a block group or device failure. + +Instead, break out of the loops immediately and return -ERESTARTSYS to +userspace without counting it as a failure. Also skip the device loop +entirely if the block group loop was interrupted. + +Reviewed-by: Qu Wenruo +Signed-off-by: Robbie Ko +Signed-off-by: jinbaohong +Reviewed-by: Filipe Manana +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/extent-tree.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 7bab2512468d5..5dd7ac7cbb0b4 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -6559,6 +6559,10 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range) + range->minlen); + + trimmed += group_trimmed; ++ if (ret == -ERESTARTSYS || ret == -EINTR) { ++ btrfs_put_block_group(cache); ++ break; ++ } + if (ret) { + bg_failed++; + bg_ret = ret; +@@ -6572,6 +6576,9 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range) + "failed to trim %llu block group(s), last error %d", + bg_failed, bg_ret); + ++ if (ret == -ERESTARTSYS || ret == -EINTR) ++ return ret; ++ + mutex_lock(&fs_devices->device_list_mutex); + list_for_each_entry(device, &fs_devices->devices, dev_list) { + if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state)) +@@ -6580,6 +6587,8 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range) + ret = btrfs_trim_free_extents(device, &group_trimmed); + + trimmed += group_trimmed; ++ if (ret == -ERESTARTSYS || ret == -EINTR) ++ break; + if (ret) { + dev_failed++; + dev_ret = ret; +@@ -6593,6 +6602,8 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range) + "failed to trim %llu device(s), last error %d", + dev_failed, dev_ret); + range->len = trimmed; ++ if (ret == -ERESTARTSYS || ret == -EINTR) ++ return ret; + if (bg_ret) + return bg_ret; + return dev_ret; +-- +2.51.0 + diff --git a/queue-6.12/btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch b/queue-6.12/btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch new file mode 100644 index 00000000000..a27df4f65f4 --- /dev/null +++ b/queue-6.12/btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch @@ -0,0 +1,46 @@ +From f11af4bdf73b075dca1304afe9344f448f4f0006 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 22:53:57 +0530 +Subject: btrfs: replace BUG() with error handling in __btrfs_balance() + +From: Adarsh Das + +[ Upstream commit be6324a809dbda76d5fdb23720ad9b20e5c1905c ] + +We search with offset (u64)-1 which should never match exactly. +Previously this was handled with BUG(). Now logs an error +and return -EUCLEAN. + +Reviewed-by: Qu Wenruo +Signed-off-by: Adarsh Das +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/volumes.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 9c6e96f630132..24b6a7f83f935 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -4117,8 +4117,14 @@ static int __btrfs_balance(struct btrfs_fs_info *fs_info) + * this shouldn't happen, it means the last relocate + * failed + */ +- if (ret == 0) +- BUG(); /* FIXME break ? */ ++ if (unlikely(ret == 0)) { ++ btrfs_err(fs_info, ++ "unexpected exact match of CHUNK_ITEM in chunk tree, offset 0x%llx", ++ key.offset); ++ mutex_unlock(&fs_info->reclaim_bgs_lock); ++ ret = -EUCLEAN; ++ goto error; ++ } + + ret = btrfs_previous_item(chunk_root, path, 0, + BTRFS_CHUNK_ITEM_KEY); +-- +2.51.0 + diff --git a/queue-6.12/ceph-supply-snapshot-context-in-ceph_uninline_data.patch b/queue-6.12/ceph-supply-snapshot-context-in-ceph_uninline_data.patch new file mode 100644 index 00000000000..52eca7225af --- /dev/null +++ b/queue-6.12/ceph-supply-snapshot-context-in-ceph_uninline_data.patch @@ -0,0 +1,127 @@ +From 0229458dcb21024887adb01ec6d8b1bb46a52f05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 18:42:06 +0800 +Subject: ceph: supply snapshot context in ceph_uninline_data() + +From: ethanwu + +[ Upstream commit 305ff6b3a03c230d3c07b61457e961406d979693 ] + +The ceph_uninline_data function was missing proper snapshot context +handling for its OSD write operations. Both CEPH_OSD_OP_CREATE and +CEPH_OSD_OP_WRITE requests were passing NULL instead of the appropriate +snapshot context, which could lead to unnecessary object clone. + +Reproducer: +../src/vstart.sh --new -x --localhost --bluestore +// turn on cephfs inline data +./bin/ceph fs set a inline_data true --yes-i-really-really-mean-it +// allow fs_a client to take snapshot +./bin/ceph auth caps client.fs_a mds 'allow rwps fsname=a' mon 'allow r fsname=a' osd 'allow rw tag cephfs data=a' +// mount cephfs with fuse, since kernel cephfs doesn't support inline write +ceph-fuse --id fs_a -m 127.0.0.1:40318 --conf ceph.conf -d /mnt/mycephfs/ +// bump snapshot seq +mkdir /mnt/mycephfs/.snap/snap1 +echo "foo" > /mnt/mycephfs/test +// umount and mount it again using kernel cephfs client +umount /mnt/mycephfs +mount -t ceph fs_a@.a=/ /mnt/mycephfs/ -o conf=./ceph.conf +echo "bar" >> /mnt/mycephfs/test +./bin/rados listsnaps -p cephfs.a.data $(printf "%x\n" $(stat -c %i /mnt/mycephfs/test)).00000000 + +will see this object does unnecessary clone +1000000000a.00000000 (seq:2): +cloneid snaps size overlap +2 2 4 [] +head - 8 + +but it's expected to see +10000000000.00000000 (seq:2): +cloneid snaps size overlap +head - 8 + +since there's no snapshot between these 2 writes + +clone happened because the first osd request CEPH_OSD_OP_CREATE doesn't +pass snap context so object is created with snap seq 0, but later data +writeback is equipped with snapshot context. +snap.seq(1) > object snap seq(0), so osd does object clone. + +This fix properly acquiring the snapshot context before performing +write operations. + +Signed-off-by: ethanwu +Reviewed-by: Viacheslav Dubeyko +Tested-by: Viacheslav Dubeyko +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/addr.c | 24 ++++++++++++++++++++++-- + 1 file changed, 22 insertions(+), 2 deletions(-) + +diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c +index 6828a2cff02c8..5addf09cb6e6e 100644 +--- a/fs/ceph/addr.c ++++ b/fs/ceph/addr.c +@@ -1867,6 +1867,7 @@ int ceph_uninline_data(struct file *file) + struct ceph_osd_request *req = NULL; + struct ceph_cap_flush *prealloc_cf = NULL; + struct folio *folio = NULL; ++ struct ceph_snap_context *snapc = NULL; + u64 inline_version = CEPH_INLINE_NONE; + struct page *pages[1]; + int err = 0; +@@ -1894,6 +1895,24 @@ int ceph_uninline_data(struct file *file) + if (inline_version == 1) /* initial version, no data */ + goto out_uninline; + ++ down_read(&fsc->mdsc->snap_rwsem); ++ spin_lock(&ci->i_ceph_lock); ++ if (__ceph_have_pending_cap_snap(ci)) { ++ struct ceph_cap_snap *capsnap = ++ list_last_entry(&ci->i_cap_snaps, ++ struct ceph_cap_snap, ++ ci_item); ++ snapc = ceph_get_snap_context(capsnap->context); ++ } else { ++ if (!ci->i_head_snapc) { ++ ci->i_head_snapc = ceph_get_snap_context( ++ ci->i_snap_realm->cached_context); ++ } ++ snapc = ceph_get_snap_context(ci->i_head_snapc); ++ } ++ spin_unlock(&ci->i_ceph_lock); ++ up_read(&fsc->mdsc->snap_rwsem); ++ + folio = read_mapping_folio(inode->i_mapping, 0, file); + if (IS_ERR(folio)) { + err = PTR_ERR(folio); +@@ -1909,7 +1928,7 @@ int ceph_uninline_data(struct file *file) + req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout, + ceph_vino(inode), 0, &len, 0, 1, + CEPH_OSD_OP_CREATE, CEPH_OSD_FLAG_WRITE, +- NULL, 0, 0, false); ++ snapc, 0, 0, false); + if (IS_ERR(req)) { + err = PTR_ERR(req); + goto out_unlock; +@@ -1925,7 +1944,7 @@ int ceph_uninline_data(struct file *file) + req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout, + ceph_vino(inode), 0, &len, 1, 3, + CEPH_OSD_OP_WRITE, CEPH_OSD_FLAG_WRITE, +- NULL, ci->i_truncate_seq, ++ snapc, ci->i_truncate_seq, + ci->i_truncate_size, false); + if (IS_ERR(req)) { + err = PTR_ERR(req); +@@ -1988,6 +2007,7 @@ int ceph_uninline_data(struct file *file) + folio_put(folio); + } + out: ++ ceph_put_snap_context(snapc); + ceph_free_cap_flush(prealloc_cf); + doutc(cl, "%llx.%llx inline_version %llu = %d\n", + ceph_vinop(inode), inline_version, err); +-- +2.51.0 + diff --git a/queue-6.12/char-tpm-cr50-remove-irqf_oneshot.patch b/queue-6.12/char-tpm-cr50-remove-irqf_oneshot.patch new file mode 100644 index 00000000000..1882f16d508 --- /dev/null +++ b/queue-6.12/char-tpm-cr50-remove-irqf_oneshot.patch @@ -0,0 +1,59 @@ +From 75b918b4e6025e852f57f376ad7a8a40d1acf8b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:29 +0100 +Subject: char: tpm: cr50: Remove IRQF_ONESHOT + +From: Sebastian Andrzej Siewior + +[ Upstream commit 1affd29ffbd50125a5492c6be1dbb1f04be18d4f ] + +Passing IRQF_ONESHOT ensures that the interrupt source is masked until +the secondary (threaded) handler is done. If only a primary handler is +used then the flag makes no sense because the interrupt can not fire +(again) while its handler is running. + +The flag also prevents force-threading of the primary handler and the +irq-core will warn about this. + +Remove IRQF_ONESHOT from irqflags. + +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Thomas Gleixner +Reviewed-by: Jarkko Sakkinen +Link: https://patch.msgid.link/20260128095540.863589-10-bigeasy@linutronix.de +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_i2c_cr50.c | 3 +-- + drivers/char/tpm/tpm_tis_spi_cr50.c | 2 +- + 2 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_i2c_cr50.c b/drivers/char/tpm/tpm_tis_i2c_cr50.c +index adf22992138e5..d51ef9c880832 100644 +--- a/drivers/char/tpm/tpm_tis_i2c_cr50.c ++++ b/drivers/char/tpm/tpm_tis_i2c_cr50.c +@@ -712,8 +712,7 @@ static int tpm_cr50_i2c_probe(struct i2c_client *client) + + if (client->irq > 0) { + rc = devm_request_irq(dev, client->irq, tpm_cr50_i2c_int_handler, +- IRQF_TRIGGER_FALLING | IRQF_ONESHOT | +- IRQF_NO_AUTOEN, ++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN, + dev->driver->name, chip); + if (rc < 0) { + dev_err(dev, "Failed to probe IRQ %d\n", client->irq); +diff --git a/drivers/char/tpm/tpm_tis_spi_cr50.c b/drivers/char/tpm/tpm_tis_spi_cr50.c +index f4937280e9406..32920b4cecfb4 100644 +--- a/drivers/char/tpm/tpm_tis_spi_cr50.c ++++ b/drivers/char/tpm/tpm_tis_spi_cr50.c +@@ -287,7 +287,7 @@ int cr50_spi_probe(struct spi_device *spi) + if (spi->irq > 0) { + ret = devm_request_irq(&spi->dev, spi->irq, + cr50_spi_irq_handler, +- IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ IRQF_TRIGGER_RISING, + "cr50_spi", cr50_phy); + if (ret < 0) { + if (ret == -EPROBE_DEFER) +-- +2.51.0 + diff --git a/queue-6.12/clk-microchip-core-correct-return-value-on-_get_pare.patch b/queue-6.12/clk-microchip-core-correct-return-value-on-_get_pare.patch new file mode 100644 index 00000000000..a1fb5b4f087 --- /dev/null +++ b/queue-6.12/clk-microchip-core-correct-return-value-on-_get_pare.patch @@ -0,0 +1,80 @@ +From c46a3e00139607f9574b33eb01b716f7dfeab791 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 14:46:28 -0500 +Subject: clk: microchip: core: correct return value on *_get_parent() + +From: Brian Masney + +[ Upstream commit 5df96d141cccb37f0c3112a22fc1112ea48e9246 ] + +roclk_get_parent() and sclk_get_parent() has the possibility of +returning -EINVAL, however the framework expects this call to always +succeed since the return value is unsigned. + +If there is no parent map defined, then the current value programmed in +the hardware is used. Let's use that same value in the case where +-EINVAL is currently returned. + +This index is only used by clk_core_get_parent_by_index(), and it +validates that it doesn't overflow the number of available parents. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202512050233.R9hAWsJN-lkp@intel.com/ +Signed-off-by: Brian Masney +Reviewed-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20251205-clk-microchip-fixes-v3-2-a02190705e47@redhat.com +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + drivers/clk/microchip/clk-core.c | 25 ++++++++++++------------- + 1 file changed, 12 insertions(+), 13 deletions(-) + +diff --git a/drivers/clk/microchip/clk-core.c b/drivers/clk/microchip/clk-core.c +index 1b4f023cdc8be..71fbaf8318f22 100644 +--- a/drivers/clk/microchip/clk-core.c ++++ b/drivers/clk/microchip/clk-core.c +@@ -281,14 +281,13 @@ static u8 roclk_get_parent(struct clk_hw *hw) + + v = (readl(refo->ctrl_reg) >> REFO_SEL_SHIFT) & REFO_SEL_MASK; + +- if (!refo->parent_map) +- return v; +- +- for (i = 0; i < clk_hw_get_num_parents(hw); i++) +- if (refo->parent_map[i] == v) +- return i; ++ if (refo->parent_map) { ++ for (i = 0; i < clk_hw_get_num_parents(hw); i++) ++ if (refo->parent_map[i] == v) ++ return i; ++ } + +- return -EINVAL; ++ return v; + } + + static unsigned long roclk_calc_rate(unsigned long parent_rate, +@@ -823,13 +822,13 @@ static u8 sclk_get_parent(struct clk_hw *hw) + + v = (readl(sclk->mux_reg) >> OSC_CUR_SHIFT) & OSC_CUR_MASK; + +- if (!sclk->parent_map) +- return v; ++ if (sclk->parent_map) { ++ for (i = 0; i < clk_hw_get_num_parents(hw); i++) ++ if (sclk->parent_map[i] == v) ++ return i; ++ } + +- for (i = 0; i < clk_hw_get_num_parents(hw); i++) +- if (sclk->parent_map[i] == v) +- return i; +- return -EINVAL; ++ return v; + } + + static int sclk_set_parent(struct clk_hw *hw, u8 index) +-- +2.51.0 + diff --git a/queue-6.12/clocksource-drivers-sh_tmu-always-leave-device-runni.patch b/queue-6.12/clocksource-drivers-sh_tmu-always-leave-device-runni.patch new file mode 100644 index 00000000000..2fcfb7b8b93 --- /dev/null +++ b/queue-6.12/clocksource-drivers-sh_tmu-always-leave-device-runni.patch @@ -0,0 +1,149 @@ +From 8b348070220ce4527f7e0927602c06e0fb1435a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 23:13:41 +0100 +Subject: clocksource/drivers/sh_tmu: Always leave device running after probe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Niklas Söderlund + +[ Upstream commit b1278972b08e480990e2789bdc6a7c918bc349be ] + +The TMU device can be used as both a clocksource and a clockevent +provider. The driver tries to be smart and power itself on and off, as +well as enabling and disabling its clock when it's not in operation. +This behavior is slightly altered if the TMU is used as an early +platform device in which case the device is left powered on after probe, +but the clock is still enabled and disabled at runtime. + +This has worked for a long time, but recent improvements in PREEMPT_RT +and PROVE_LOCKING have highlighted an issue. As the TMU registers itself +as a clockevent provider, clockevents_register_device(), it needs to use +raw spinlocks internally as this is the context of which the clockevent +framework interacts with the TMU driver. However in the context of +holding a raw spinlock the TMU driver can't really manage its power +state or clock with calls to pm_runtime_*() and clk_*() as these calls +end up in other platform drivers using regular spinlocks to control +power and clocks. + +This mix of spinlock contexts trips a lockdep warning. + + ============================= + [ BUG: Invalid wait context ] + 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 Not tainted + ----------------------------- + swapper/0/0 is trying to lock: + ffff000008c9e180 (&dev->power.lock){-...}-{3:3}, at: __pm_runtime_resume+0x38/0x88 + other info that might help us debug this: + context-{5:5} + 1 lock held by swapper/0/0: + ccree e6601000.crypto: ARM CryptoCell 630P Driver: HW version 0xAF400001/0xDCC63000, Driver version 5.0 + #0: ffff8000817ec298 + ccree e6601000.crypto: ARM ccree device initialized + (tick_broadcast_lock){-...}-{2:2}, at: __tick_broadcast_oneshot_control+0xa4/0x3a8 + stack backtrace: + CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 PREEMPT + Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT) + Call trace: + show_stack+0x14/0x1c (C) + dump_stack_lvl+0x6c/0x90 + dump_stack+0x14/0x1c + __lock_acquire+0x904/0x1584 + lock_acquire+0x220/0x34c + _raw_spin_lock_irqsave+0x58/0x80 + __pm_runtime_resume+0x38/0x88 + sh_tmu_clock_event_set_oneshot+0x84/0xd4 + clockevents_switch_state+0xfc/0x13c + tick_broadcast_set_event+0x30/0xa4 + __tick_broadcast_oneshot_control+0x1e0/0x3a8 + tick_broadcast_oneshot_control+0x30/0x40 + cpuidle_enter_state+0x40c/0x680 + cpuidle_enter+0x30/0x40 + do_idle+0x1f4/0x280 + cpu_startup_entry+0x34/0x40 + kernel_init+0x0/0x130 + do_one_initcall+0x0/0x230 + __primary_switched+0x88/0x90 + +For non-PREEMPT_RT builds this is not really an issue, but for +PREEMPT_RT builds where normal spinlocks can sleep this might be an +issue. Be cautious and always leave the power and clock running after +probe. + +Signed-off-by: Niklas Söderlund +Signed-off-by: Daniel Lezcano +Tested-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20251202221341.1856773-1-niklas.soderlund+renesas@ragnatech.se +Signed-off-by: Sasha Levin +--- + drivers/clocksource/sh_tmu.c | 18 ------------------ + 1 file changed, 18 deletions(-) + +diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c +index beffff81c00f3..3fc6ed9b56300 100644 +--- a/drivers/clocksource/sh_tmu.c ++++ b/drivers/clocksource/sh_tmu.c +@@ -143,16 +143,6 @@ static void sh_tmu_start_stop_ch(struct sh_tmu_channel *ch, int start) + + static int __sh_tmu_enable(struct sh_tmu_channel *ch) + { +- int ret; +- +- /* enable clock */ +- ret = clk_enable(ch->tmu->clk); +- if (ret) { +- dev_err(&ch->tmu->pdev->dev, "ch%u: cannot enable clock\n", +- ch->index); +- return ret; +- } +- + /* make sure channel is disabled */ + sh_tmu_start_stop_ch(ch, 0); + +@@ -174,7 +164,6 @@ static int sh_tmu_enable(struct sh_tmu_channel *ch) + if (ch->enable_count++ > 0) + return 0; + +- pm_runtime_get_sync(&ch->tmu->pdev->dev); + dev_pm_syscore_device(&ch->tmu->pdev->dev, true); + + return __sh_tmu_enable(ch); +@@ -187,9 +176,6 @@ static void __sh_tmu_disable(struct sh_tmu_channel *ch) + + /* disable interrupts in TMU block */ + sh_tmu_write(ch, TCR, TCR_TPSC_CLK4); +- +- /* stop clock */ +- clk_disable(ch->tmu->clk); + } + + static void sh_tmu_disable(struct sh_tmu_channel *ch) +@@ -203,7 +189,6 @@ static void sh_tmu_disable(struct sh_tmu_channel *ch) + __sh_tmu_disable(ch); + + dev_pm_syscore_device(&ch->tmu->pdev->dev, false); +- pm_runtime_put(&ch->tmu->pdev->dev); + } + + static void sh_tmu_set_next(struct sh_tmu_channel *ch, unsigned long delta, +@@ -552,7 +537,6 @@ static int sh_tmu_setup(struct sh_tmu_device *tmu, struct platform_device *pdev) + goto err_clk_unprepare; + + tmu->rate = clk_get_rate(tmu->clk) / 4; +- clk_disable(tmu->clk); + + /* Map the memory resource. */ + ret = sh_tmu_map_memory(tmu); +@@ -626,8 +610,6 @@ static int sh_tmu_probe(struct platform_device *pdev) + out: + if (tmu->has_clockevent || tmu->has_clocksource) + pm_runtime_irq_safe(&pdev->dev); +- else +- pm_runtime_idle(&pdev->dev); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.12/clocksource-drivers-timer-integrator-ap-add-missing-.patch b/queue-6.12/clocksource-drivers-timer-integrator-ap-add-missing-.patch new file mode 100644 index 00000000000..af0e87bb30c --- /dev/null +++ b/queue-6.12/clocksource-drivers-timer-integrator-ap-add-missing-.patch @@ -0,0 +1,38 @@ +From ec27826b6b98ab3655b79ed8b4bdf625639f14c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jan 2026 12:17:23 +0100 +Subject: clocksource/drivers/timer-integrator-ap: Add missing Kconfig + dependency on OF + +From: Bartosz Golaszewski + +[ Upstream commit 2246464821e2820572e6feefca2029f17629cc50 ] + +This driver accesses the of_aliases global variable declared in +linux/of.h and defined in drivers/base/of.c. It requires OF support or +will cause a link failure. Add the missing Kconfig dependency. + +Closes: https://lore.kernel.org/oe-kbuild-all/202601152233.og6LdeUo-lkp@intel.com/ +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Daniel Lezcano +Link: https://patch.msgid.link/20260116111723.10585-1-bartosz.golaszewski@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/clocksource/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig +index d546903dba4f3..abfc2aa857678 100644 +--- a/drivers/clocksource/Kconfig ++++ b/drivers/clocksource/Kconfig +@@ -246,6 +246,7 @@ config KEYSTONE_TIMER + + config INTEGRATOR_AP_TIMER + bool "Integrator-AP timer driver" if COMPILE_TEST ++ depends on OF + select CLKSRC_MMIO + help + Enables support for the Integrator-AP timer. +-- +2.51.0 + diff --git a/queue-6.12/cpufreq-dt-platdev-block-the-driver-from-probing-on-.patch b/queue-6.12/cpufreq-dt-platdev-block-the-driver-from-probing-on-.patch new file mode 100644 index 00000000000..32e2b8fb035 --- /dev/null +++ b/queue-6.12/cpufreq-dt-platdev-block-the-driver-from-probing-on-.patch @@ -0,0 +1,39 @@ +From 51fb74525d18e27a490e61c1d7477eeb7b1c457e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 16:25:35 +0100 +Subject: cpufreq: dt-platdev: Block the driver from probing on more QC + platforms + +From: Konrad Dybcio + +[ Upstream commit 7b781899072c5701ef9538c365757ee9ab9c00bd ] + +Add a number of QC platforms to the blocklist, they all use either the +qcom-cpufreq-hw driver. + +Signed-off-by: Konrad Dybcio +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq-dt-platdev.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c +index dbd73cd0cf535..9e86a0e8b9e86 100644 +--- a/drivers/cpufreq/cpufreq-dt-platdev.c ++++ b/drivers/cpufreq/cpufreq-dt-platdev.c +@@ -164,8 +164,11 @@ static const struct of_device_id blocklist[] __initconst = { + { .compatible = "qcom,sdm845", }, + { .compatible = "qcom,sdx75", }, + { .compatible = "qcom,sm6115", }, ++ { .compatible = "qcom,sm6125", }, ++ { .compatible = "qcom,sm6150", }, + { .compatible = "qcom,sm6350", }, + { .compatible = "qcom,sm6375", }, ++ { .compatible = "qcom,sm7125", }, + { .compatible = "qcom,sm7225", }, + { .compatible = "qcom,sm7325", }, + { .compatible = "qcom,sm8150", }, +-- +2.51.0 + diff --git a/queue-6.12/crypto-hisilicon-qm-move-the-barrier-before-writing-.patch b/queue-6.12/crypto-hisilicon-qm-move-the-barrier-before-writing-.patch new file mode 100644 index 00000000000..d199939df5d --- /dev/null +++ b/queue-6.12/crypto-hisilicon-qm-move-the-barrier-before-writing-.patch @@ -0,0 +1,45 @@ +From c7d696cef7fec98e80c39b494695d4cbe988a498 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jan 2026 18:18:03 +0800 +Subject: crypto: hisilicon/qm - move the barrier before writing to the mailbox + register + +From: Chenghai Huang + +[ Upstream commit ebf35d8f9368816c930f5d70783a72716fab5e19 ] + +Before sending the data via the mailbox to the hardware, to ensure +that the data accessed by the hardware is the most up-to-date, +a write barrier should be added before writing to the mailbox register. +The current memory barrier is placed after writing to the register, +the barrier order should be modified to be before writing to the register. + +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/qm.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c +index d0b154d13f445..2c64bf4cdf0dc 100644 +--- a/drivers/crypto/hisilicon/qm.c ++++ b/drivers/crypto/hisilicon/qm.c +@@ -551,9 +551,13 @@ static void qm_mb_write(struct hisi_qm *qm, const void *src) + } + + #if IS_ENABLED(CONFIG_ARM64) ++ /* ++ * The dmb oshst instruction ensures that the data in the ++ * mailbox is written before it is sent to the hardware. ++ */ + asm volatile("ldp %0, %1, %3\n" +- "stp %0, %1, %2\n" + "dmb oshst\n" ++ "stp %0, %1, %2\n" + : "=&r" (tmp0), + "=&r" (tmp1), + "+Q" (*((char __iomem *)fun_base)) +-- +2.51.0 + diff --git a/queue-6.12/dlm-validate-length-in-dlm_search_rsb_tree.patch b/queue-6.12/dlm-validate-length-in-dlm_search_rsb_tree.patch new file mode 100644 index 00000000000..3529c6388ae --- /dev/null +++ b/queue-6.12/dlm-validate-length-in-dlm_search_rsb_tree.patch @@ -0,0 +1,40 @@ +From a608ee069873e26643d900743c24cecdf4d22ca6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 10:35:06 -0500 +Subject: dlm: validate length in dlm_search_rsb_tree + +From: Ezrak1e + +[ Upstream commit 080e5563f878c64e697b89e7439d730d0daad882 ] + +The len parameter in dlm_dump_rsb_name() is not validated and comes +from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can +cause out-of-bounds write in dlm_search_rsb_tree(). + +Add length validation to prevent potential buffer overflow. + +Signed-off-by: Ezrak1e +Signed-off-by: Alexander Aring +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/lock.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c +index 0ad496ceb638d..195e4ce22a824 100644 +--- a/fs/dlm/lock.c ++++ b/fs/dlm/lock.c +@@ -626,7 +626,8 @@ int dlm_search_rsb_tree(struct rhashtable *rhash, const void *name, int len, + struct dlm_rsb **r_ret) + { + char key[DLM_RESNAME_MAXLEN] = {}; +- ++ if (len > DLM_RESNAME_MAXLEN) ++ return -EINVAL; + memcpy(key, name, len); + *r_ret = rhashtable_lookup_fast(rhash, &key, dlm_rhash_rsb_params); + if (*r_ret) +-- +2.51.0 + diff --git a/queue-6.12/dm-remove-fake-timeout-to-avoid-leak-request.patch b/queue-6.12/dm-remove-fake-timeout-to-avoid-leak-request.patch new file mode 100644 index 00000000000..cae9ec3d4a0 --- /dev/null +++ b/queue-6.12/dm-remove-fake-timeout-to-avoid-leak-request.patch @@ -0,0 +1,86 @@ +From 5607159248a85137813a6e6afaa3601e18d602ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Dec 2025 20:03:50 +0800 +Subject: dm: remove fake timeout to avoid leak request + +From: Ding Hui + +[ Upstream commit f3a9c95a15d2f4466acad5c68faeff79ca5e9f47 ] + +Since commit 15f73f5b3e59 ("blk-mq: move failure injection out of +blk_mq_complete_request"), drivers are responsible for calling +blk_should_fake_timeout() at appropriate code paths and opportunities. + +However, the dm driver does not implement its own timeout handler and +relies on the timeout handling of its slave devices. + +If an io-timeout-fail error is injected to a dm device, the request +will be leaked and never completed, causing tasks to hang indefinitely. + +Reproduce: +1. prepare dm which has iscsi slave device +2. inject io-timeout-fail to dm + echo 1 >/sys/class/block/dm-0/io-timeout-fail + echo 100 >/sys/kernel/debug/fail_io_timeout/probability + echo 10 >/sys/kernel/debug/fail_io_timeout/times +3. read/write dm +4. iscsiadm -m node -u + +Result: hang task like below +[ 862.243768] INFO: task kworker/u514:2:151 blocked for more than 122 seconds. +[ 862.244133] Tainted: G E 6.19.0-rc1+ #51 +[ 862.244337] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 862.244718] task:kworker/u514:2 state:D stack:0 pid:151 tgid:151 ppid:2 task_flags:0x4288060 flags:0x00080000 +[ 862.245024] Workqueue: iscsi_ctrl_3:1 __iscsi_unbind_session [scsi_transport_iscsi] +[ 862.245264] Call Trace: +[ 862.245587] +[ 862.245814] __schedule+0x810/0x15c0 +[ 862.246557] schedule+0x69/0x180 +[ 862.246760] blk_mq_freeze_queue_wait+0xde/0x120 +[ 862.247688] elevator_change+0x16d/0x460 +[ 862.247893] elevator_set_none+0x87/0xf0 +[ 862.248798] blk_unregister_queue+0x12e/0x2a0 +[ 862.248995] __del_gendisk+0x231/0x7e0 +[ 862.250143] del_gendisk+0x12f/0x1d0 +[ 862.250339] sd_remove+0x85/0x130 [sd_mod] +[ 862.250650] device_release_driver_internal+0x36d/0x530 +[ 862.250849] bus_remove_device+0x1dd/0x3f0 +[ 862.251042] device_del+0x38a/0x930 +[ 862.252095] __scsi_remove_device+0x293/0x360 +[ 862.252291] scsi_remove_target+0x486/0x760 +[ 862.252654] __iscsi_unbind_session+0x18a/0x3e0 [scsi_transport_iscsi] +[ 862.252886] process_one_work+0x633/0xe50 +[ 862.253101] worker_thread+0x6df/0xf10 +[ 862.253647] kthread+0x36d/0x720 +[ 862.254533] ret_from_fork+0x2a6/0x470 +[ 862.255852] ret_from_fork_asm+0x1a/0x30 +[ 862.256037] + +Remove the blk_should_fake_timeout() check from dm, as dm has no +native timeout handling and should not attempt to fake timeouts. + +Signed-off-by: Ding Hui +Reviewed-by: Christoph Hellwig +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + drivers/md/dm-rq.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c +index 499f8cc8a39fb..92d3d3de37ca6 100644 +--- a/drivers/md/dm-rq.c ++++ b/drivers/md/dm-rq.c +@@ -278,8 +278,7 @@ static void dm_complete_request(struct request *rq, blk_status_t error) + struct dm_rq_target_io *tio = tio_from_request(rq); + + tio->error = error; +- if (likely(!blk_should_fake_timeout(rq->q))) +- blk_mq_complete_request(rq); ++ blk_mq_complete_request(rq); + } + + /* +-- +2.51.0 + diff --git a/queue-6.12/dm-replace-eexist-with-ebusy.patch b/queue-6.12/dm-replace-eexist-with-ebusy.patch new file mode 100644 index 00000000000..18d3cc392d1 --- /dev/null +++ b/queue-6.12/dm-replace-eexist-with-ebusy.patch @@ -0,0 +1,89 @@ +From 1cba2f1fd95340d29cc0c09ec729f85668419e89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Dec 2025 04:49:37 +0100 +Subject: dm: replace -EEXIST with -EBUSY + +From: Daniel Gomez + +[ Upstream commit b13ef361d47f09b7aecd18e0383ecc83ff61057e ] + +The -EEXIST error code is reserved by the module loading infrastructure +to indicate that a module is already loaded. When a module's init +function returns -EEXIST, userspace tools like kmod interpret this as +"module already loaded" and treat the operation as successful, returning +0 to the user even though the module initialization actually failed. + +This follows the precedent set by commit 54416fd76770 ("netfilter: +conntrack: helper: Replace -EEXIST by -EBUSY") which fixed the same +issue in nf_conntrack_helper_register(). + +Affected modules: + * dm_cache dm_clone dm_integrity dm_mirror dm_multipath dm_pcache + * dm_vdo dm-ps-round-robin dm_historical_service_time dm_io_affinity + * dm_queue_length dm_service_time dm_snapshot + +Signed-off-by: Daniel Gomez +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + drivers/md/dm-exception-store.c | 2 +- + drivers/md/dm-log.c | 2 +- + drivers/md/dm-path-selector.c | 2 +- + drivers/md/dm-target.c | 2 +- + 4 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c +index c3799757bf4a0..88f119a0a2ae0 100644 +--- a/drivers/md/dm-exception-store.c ++++ b/drivers/md/dm-exception-store.c +@@ -116,7 +116,7 @@ int dm_exception_store_type_register(struct dm_exception_store_type *type) + if (!__find_exception_store_type(type->name)) + list_add(&type->list, &_exception_store_types); + else +- r = -EEXIST; ++ r = -EBUSY; + spin_unlock(&_lock); + + return r; +diff --git a/drivers/md/dm-log.c b/drivers/md/dm-log.c +index 9d85d045f9d9d..bced5a783ee33 100644 +--- a/drivers/md/dm-log.c ++++ b/drivers/md/dm-log.c +@@ -121,7 +121,7 @@ int dm_dirty_log_type_register(struct dm_dirty_log_type *type) + if (!__find_dirty_log_type(type->name)) + list_add(&type->list, &_log_types); + else +- r = -EEXIST; ++ r = -EBUSY; + spin_unlock(&_lock); + + return r; +diff --git a/drivers/md/dm-path-selector.c b/drivers/md/dm-path-selector.c +index 3e4cb81ce512c..78f98545ca72d 100644 +--- a/drivers/md/dm-path-selector.c ++++ b/drivers/md/dm-path-selector.c +@@ -107,7 +107,7 @@ int dm_register_path_selector(struct path_selector_type *pst) + + if (__find_path_selector_type(pst->name)) { + kfree(psi); +- r = -EEXIST; ++ r = -EBUSY; + } else + list_add(&psi->list, &_path_selectors); + +diff --git a/drivers/md/dm-target.c b/drivers/md/dm-target.c +index b676fd01a0227..33f81611bdefd 100644 +--- a/drivers/md/dm-target.c ++++ b/drivers/md/dm-target.c +@@ -88,7 +88,7 @@ int dm_register_target(struct target_type *tt) + if (__find_target_type(tt->name)) { + DMERR("%s: '%s' target already registered", + __func__, tt->name); +- rv = -EEXIST; ++ rv = -EBUSY; + } else { + list_add(&tt->list, &_targets); + } +-- +2.51.0 + diff --git a/queue-6.12/dmaengine-stm32-dma3-use-module_platform_driver.patch b/queue-6.12/dmaengine-stm32-dma3-use-module_platform_driver.patch new file mode 100644 index 00000000000..5a7550c4e61 --- /dev/null +++ b/queue-6.12/dmaengine-stm32-dma3-use-module_platform_driver.patch @@ -0,0 +1,45 @@ +From 04860b703e1fd7189d071166c0bf492a2b176a07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 14:36:56 +0100 +Subject: dmaengine: stm32-dma3: use module_platform_driver + +From: Amelie Delaunay + +[ Upstream commit 0d41ed4ea496fabbb4dc21171e32d9a924c2a661 ] + +Without module_platform_driver(), stm32-dma3 doesn't have a +module_exit procedure. Once stm32-dma3 module is inserted, it +can't be removed, marked busy. +Use module_platform_driver() instead of subsys_initcall() to register +(insmod) and unregister (rmmod) stm32-dma3 driver. + +Reviewed-by: Eugen Hristev +Signed-off-by: Amelie Delaunay +Link: https://patch.msgid.link/20251121-dma3_improv-v2-1-76a207b13ea6@foss.st.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/stm32/stm32-dma3.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +diff --git a/drivers/dma/stm32/stm32-dma3.c b/drivers/dma/stm32/stm32-dma3.c +index 0be6e944df6fd..fde1b10d3532c 100644 +--- a/drivers/dma/stm32/stm32-dma3.c ++++ b/drivers/dma/stm32/stm32-dma3.c +@@ -1835,12 +1835,7 @@ static struct platform_driver stm32_dma3_driver = { + }, + }; + +-static int __init stm32_dma3_init(void) +-{ +- return platform_driver_register(&stm32_dma3_driver); +-} +- +-subsys_initcall(stm32_dma3_init); ++module_platform_driver(stm32_dma3_driver); + + MODULE_DESCRIPTION("STM32 DMA3 controller driver"); + MODULE_AUTHOR("Amelie Delaunay "); +-- +2.51.0 + diff --git a/queue-6.12/dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch b/queue-6.12/dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch new file mode 100644 index 00000000000..b9cfca418a4 --- /dev/null +++ b/queue-6.12/dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch @@ -0,0 +1,51 @@ +From bfb6b0844ab83aab4f79937bc865e5f0984ee1ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Dec 2025 09:15:03 +0100 +Subject: dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix + warnings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Le Goffic + +[ Upstream commit aaf3bc0265744adbc2d364964ef409cf118d193d ] + +m2m_hw_period is initialized only when chan_config->m2m_hw is true. This +triggers a warning: +‘m2m_hw_period’ may be used uninitialized [-Wmaybe-uninitialized] +Although m2m_hw_period is only used when chan_config->m2m_hw is true and +ignored otherwise, initialize it unconditionally to 0. + +ccr is initialized by stm32_mdma_set_xfer_param() when the sg list is not +empty. This triggers a warning: +‘ccr’ may be used uninitialized [-Wmaybe-uninitialized] +Indeed, it could be used uninitialized if the sg list is empty. Initialize +it to 0. + +Signed-off-by: Clément Le Goffic +Reviewed-by: Clément Le Goffic +Signed-off-by: Amelie Delaunay +Link: https://patch.msgid.link/20251217-mdma_warnings_fix-v2-1-340200e0bb55@foss.st.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/stm32/stm32-mdma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/stm32/stm32-mdma.c b/drivers/dma/stm32/stm32-mdma.c +index e6d525901de7e..3560a6945fbfc 100644 +--- a/drivers/dma/stm32/stm32-mdma.c ++++ b/drivers/dma/stm32/stm32-mdma.c +@@ -731,7 +731,7 @@ static int stm32_mdma_setup_xfer(struct stm32_mdma_chan *chan, + struct stm32_mdma_chan_config *chan_config = &chan->chan_config; + struct scatterlist *sg; + dma_addr_t src_addr, dst_addr; +- u32 m2m_hw_period, ccr, ctcr, ctbr; ++ u32 m2m_hw_period = 0, ccr = 0, ctcr, ctbr; + int i, ret = 0; + + if (chan_config->m2m_hw) +-- +2.51.0 + diff --git a/queue-6.12/dmaengine-sun6i-choose-appropriate-burst-length-unde.patch b/queue-6.12/dmaengine-sun6i-choose-appropriate-burst-length-unde.patch new file mode 100644 index 00000000000..f36fb650ba7 --- /dev/null +++ b/queue-6.12/dmaengine-sun6i-choose-appropriate-burst-length-unde.patch @@ -0,0 +1,80 @@ +From f076b1d1da78c879f680de487603e44f2e79b80e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Dec 2025 16:04:48 +0800 +Subject: dmaengine: sun6i: Choose appropriate burst length under maxburst + +From: Chen-Yu Tsai + +[ Upstream commit 7178c3586ab42693b28bb81014320a7783e5c435 ] + +maxburst, as provided by the client, specifies the largest amount of +data that is allowed to be transferred in one burst. This limit is +normally provided to avoid a data burst overflowing the target FIFO. +It does not mean that the DMA engine can only do bursts in that size. + +Let the driver pick the largest supported burst length within the +given limit. This lets the driver work correctly with some clients that +give a large maxburst value. In particular, the 8250_dw driver will give +a quarter of the UART's FIFO size as maxburst. On some systems the FIFO +size is 256 bytes, giving a maxburst of 64 bytes, while the hardware +only supports bursts of up to 16 bytes. + +Signed-off-by: Chen-Yu Tsai +Reviewed-by: Jernej Skrabec +Link: https://patch.msgid.link/20251221080450.1813479-1-wens@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/sun6i-dma.c | 26 ++++++++++++++++++++------ + 1 file changed, 20 insertions(+), 6 deletions(-) + +diff --git a/drivers/dma/sun6i-dma.c b/drivers/dma/sun6i-dma.c +index 583bf49031cf2..c97027379263d 100644 +--- a/drivers/dma/sun6i-dma.c ++++ b/drivers/dma/sun6i-dma.c +@@ -582,6 +582,22 @@ static irqreturn_t sun6i_dma_interrupt(int irq, void *dev_id) + return ret; + } + ++static u32 find_burst_size(const u32 burst_lengths, u32 maxburst) ++{ ++ if (!maxburst) ++ return 1; ++ ++ if (BIT(maxburst) & burst_lengths) ++ return maxburst; ++ ++ /* Hardware only does power-of-two bursts. */ ++ for (u32 burst = rounddown_pow_of_two(maxburst); burst > 0; burst /= 2) ++ if (BIT(burst) & burst_lengths) ++ return burst; ++ ++ return 1; ++} ++ + static int set_config(struct sun6i_dma_dev *sdev, + struct dma_slave_config *sconfig, + enum dma_transfer_direction direction, +@@ -615,15 +631,13 @@ static int set_config(struct sun6i_dma_dev *sdev, + return -EINVAL; + if (!(BIT(dst_addr_width) & sdev->slave.dst_addr_widths)) + return -EINVAL; +- if (!(BIT(src_maxburst) & sdev->cfg->src_burst_lengths)) +- return -EINVAL; +- if (!(BIT(dst_maxburst) & sdev->cfg->dst_burst_lengths)) +- return -EINVAL; + + src_width = convert_buswidth(src_addr_width); + dst_width = convert_buswidth(dst_addr_width); +- dst_burst = convert_burst(dst_maxburst); +- src_burst = convert_burst(src_maxburst); ++ src_burst = find_burst_size(sdev->cfg->src_burst_lengths, src_maxburst); ++ dst_burst = find_burst_size(sdev->cfg->dst_burst_lengths, dst_maxburst); ++ dst_burst = convert_burst(dst_burst); ++ src_burst = convert_burst(src_burst); + + *p_cfg = DMA_CHAN_CFG_SRC_WIDTH(src_width) | + DMA_CHAN_CFG_DST_WIDTH(dst_width); +-- +2.51.0 + diff --git a/queue-6.12/drm-account-property-blob-allocations-to-memcg.patch b/queue-6.12/drm-account-property-blob-allocations-to-memcg.patch new file mode 100644 index 00000000000..bdfc80c24d7 --- /dev/null +++ b/queue-6.12/drm-account-property-blob-allocations-to-memcg.patch @@ -0,0 +1,46 @@ +From ce1bc907f6a63f4de0fbdf9f0d4a88817c9d2959 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 08:22:26 -0500 +Subject: drm: Account property blob allocations to memcg + +From: Xiao Kan <814091656@qq.com> + +[ Upstream commit 26b4309a3ab82a0697751cde52eb336c29c19035 ] + +DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized +property blobs backed by kernel memory. + +Currently, the blob data allocation is not accounted to the allocating +process's memory cgroup, allowing unprivileged users to trigger unbounded +kernel memory consumption and potentially cause system-wide OOM. + +Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory +is properly charged to the caller's memcg. This ensures existing cgroup +memory limits apply and prevents uncontrolled kernel memory growth without +introducing additional policy or per-file limits. + +Signed-off-by: Xiao Kan <814091656@qq.com> +Signed-off-by: Xiao Kan +Link: https://patch.msgid.link/tencent_D12AA2DEDE6F359E1AF59405242FB7A5FD05@qq.com +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_property.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c +index 596272149a359..3c88b5fbdf28c 100644 +--- a/drivers/gpu/drm/drm_property.c ++++ b/drivers/gpu/drm/drm_property.c +@@ -562,7 +562,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length, + if (!length || length > INT_MAX - sizeof(struct drm_property_blob)) + return ERR_PTR(-EINVAL); + +- blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL); ++ blob = kvzalloc(sizeof(struct drm_property_blob) + length, GFP_KERNEL_ACCOUNT); + if (!blob) + return ERR_PTR(-ENOMEM); + +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-display-add-signal-type-check-for-dcn401-get.patch b/queue-6.12/drm-amd-display-add-signal-type-check-for-dcn401-get.patch new file mode 100644 index 00000000000..dd6b787c702 --- /dev/null +++ b/queue-6.12/drm-amd-display-add-signal-type-check-for-dcn401-get.patch @@ -0,0 +1,42 @@ +From 6d13eed67fe5e86c8cf088679a95cd9ab8e5bb93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Dec 2025 15:52:39 -0500 +Subject: drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src + +From: Dmytro Laktyushkin + +[ Upstream commit c979d8db7b0f293111f2e83795ea353c8ed75de9 ] + +Trying to access link enc on a dpia link will cause a crash otherwise + +Reviewed-by: Charlene Liu +Signed-off-by: Dmytro Laktyushkin +Signed-off-by: Chenyu Chen +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +index f805803be55e4..bf2a9d8d3bd2d 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +@@ -965,10 +965,10 @@ static void dcn401_enable_stream_calc( + pipe_ctx->stream->link->cur_link_settings.lane_count; + uint32_t active_total_with_borders; + +- if (dc->link_srv->dp_is_128b_132b_signal(pipe_ctx)) ++ if (dc->link_srv->dp_is_128b_132b_signal(pipe_ctx)) { + *dp_hpo_inst = pipe_ctx->stream_res.hpo_dp_stream_enc->inst; +- +- *phyd32clk = get_phyd32clk_src(pipe_ctx->stream->link); ++ *phyd32clk = get_phyd32clk_src(pipe_ctx->stream->link); ++ } + + if (dc_is_tmds_signal(pipe_ctx->stream->signal)) + dcn401_calculate_dccg_tmds_div_value(pipe_ctx, tmds_div); +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-display-add-usb-c-dp-alt-mode-lane-limitatio.patch b/queue-6.12/drm-amd-display-add-usb-c-dp-alt-mode-lane-limitatio.patch new file mode 100644 index 00000000000..6d1a0e9961c --- /dev/null +++ b/queue-6.12/drm-amd-display-add-usb-c-dp-alt-mode-lane-limitatio.patch @@ -0,0 +1,59 @@ +From 9b22bd4823d26ec1fc0fe1c4a7972c218ceaebc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Dec 2025 10:18:16 +0800 +Subject: drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 + +From: LinCheng Ku + +[ Upstream commit cea573a8e1ed83840a2173d153dd68e172849d44 ] + +[Why] +USB-C DisplayPort Alt Mode with concurrent USB data needs lane count +limitation to prevent incorrect 4-lane DP configuration when only 2 lanes +are available due to hardware lane sharing between DP and USB3. + +[How] +Query DMUB for Alt Mode status (is_dp_alt_disable, is_usb, is_dp4) in +dcn32_link_encoder_get_max_link_cap() and cap DP to 2 lanes when USB is +active on USB-C port. Added inline documentation explaining the USB-C +lane sharing constraint. + +Reviewed-by: PeiChen Huang +Signed-off-by: LinCheng Ku +Signed-off-by: Chenyu Chen +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../display/dc/dio/dcn32/dcn32_dio_link_encoder.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c +index 06907e8a4eda1..ddc736af776c9 100644 +--- a/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c ++++ b/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c +@@ -188,9 +188,18 @@ void dcn32_link_encoder_get_max_link_cap(struct link_encoder *enc, + if (!query_dp_alt_from_dmub(enc, &cmd)) + return; + +- if (cmd.query_dp_alt.data.is_usb && +- cmd.query_dp_alt.data.is_dp4 == 0) +- link_settings->lane_count = MIN(LANE_COUNT_TWO, link_settings->lane_count); ++ /* ++ * USB-C DisplayPort Alt Mode lane count limitation logic: ++ * When USB and DP share the same USB-C connector, hardware must allocate ++ * some lanes for USB data, limiting DP to maximum 2 lanes instead of 4. ++ * This ensures USB functionality remains available while DP is active. ++ */ ++ if (cmd.query_dp_alt.data.is_dp_alt_disable == 0 && ++ cmd.query_dp_alt.data.is_usb && ++ cmd.query_dp_alt.data.is_dp4 == 0) { ++ link_settings->lane_count = ++ MIN(LANE_COUNT_TWO, link_settings->lane_count); ++ } + } + + +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-display-avoid-dig-reg-access-timeout-on-usb4.patch b/queue-6.12/drm-amd-display-avoid-dig-reg-access-timeout-on-usb4.patch new file mode 100644 index 00000000000..7fe320d6147 --- /dev/null +++ b/queue-6.12/drm-amd-display-avoid-dig-reg-access-timeout-on-usb4.patch @@ -0,0 +1,58 @@ +From d63af7f0710e24b0ce69fe1c6401121b55e538fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 15:51:42 +0800 +Subject: drm/amd/display: avoid dig reg access timeout on usb4 link training + fail + +From: Zhongwei + +[ Upstream commit 15b1d7b77e9836ff4184093163174a1ef28bbdd7 ] + +[Why] +When usb4 link training fails, the dpia sym clock will be disabled and SYMCLK +source should be changed back to phy clock. In enable_streams, it is +assumed that link training succeeded and will switch from refclk to +phy clock. But phy clk here might not be on. Dig reg access timeout +will occur. + +[How] +When enable_stream is hit, check if link training failed for usb4. +If it did, fall back to the ref clock to avoid reg access timeout. + +Reviewed-by: Wenjing Liu +Signed-off-by: Zhongwei +Signed-off-by: Aurabindo Pillai +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c +index b94fe14f4b935..a113085385d15 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c +@@ -3012,9 +3012,17 @@ void dcn20_enable_stream(struct pipe_ctx *pipe_ctx) + dccg->funcs->enable_symclk32_se(dccg, dp_hpo_inst, phyd32clk); + } + } else { +- if (dccg->funcs->enable_symclk_se) +- dccg->funcs->enable_symclk_se(dccg, stream_enc->stream_enc_inst, ++ if (dccg->funcs->enable_symclk_se && link_enc) { ++ if (link->ep_type == DISPLAY_ENDPOINT_USB4_DPIA ++ && link->cur_link_settings.link_rate == LINK_RATE_UNKNOWN ++ && !link->link_status.link_active) { ++ if (dccg->funcs->disable_symclk_se) ++ dccg->funcs->disable_symclk_se(dccg, stream_enc->stream_enc_inst, + link_enc->transmitter - TRANSMITTER_UNIPHY_A); ++ } else ++ dccg->funcs->enable_symclk_se(dccg, stream_enc->stream_enc_inst, ++ link_enc->transmitter - TRANSMITTER_UNIPHY_A); ++ } + } + + if (dc->res_pool->dccg->funcs->set_pixel_rate_div) +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-display-avoid-updating-surface-with-the-same.patch b/queue-6.12/drm-amd-display-avoid-updating-surface-with-the-same.patch new file mode 100644 index 00000000000..6d36c84ca93 --- /dev/null +++ b/queue-6.12/drm-amd-display-avoid-updating-surface-with-the-same.patch @@ -0,0 +1,43 @@ +From 72649e13b0b0c00f95d3d6616c7312d3d091189d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 14:47:01 +0800 +Subject: drm/amd/display: Avoid updating surface with the same surface under + MPO + +From: Wayne Lin + +[ Upstream commit 1a38ded4bc8ac09fd029ec656b1e2c98cc0d238c ] + +[Why & How] +Although it's dummy updates of surface update for committing stream +updates, we should not have dummy_updates[j].surface all indicating +to the same surface under multiple surfaces case. Otherwise, +copy_surface_update_to_plane() in update_planes_and_stream_state() +will update to the same surface only. + +Reviewed-by: Harry Wentland +Signed-off-by: Wayne Lin +Signed-off-by: Tom Chung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index f4693136a2ebf..9181a97fdb1b8 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -10195,7 +10195,7 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state) + continue; + } + for (j = 0; j < status->plane_count; j++) +- dummy_updates[j].surface = status->plane_states[0]; ++ dummy_updates[j].surface = status->plane_states[j]; + + sort(dummy_updates, status->plane_count, + sizeof(*dummy_updates), dm_plane_layer_index_cmp, NULL); +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-display-bypass-post-csc-for-additional-color.patch b/queue-6.12/drm-amd-display-bypass-post-csc-for-additional-color.patch new file mode 100644 index 00000000000..80771e0274e --- /dev/null +++ b/queue-6.12/drm-amd-display-bypass-post-csc-for-additional-color.patch @@ -0,0 +1,100 @@ +From 20922e2aa4b6d6dd4fc8945073a8f566c3c8d713 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 11:40:06 -0500 +Subject: drm/amd/display: bypass post csc for additional color spaces in dal + +From: Clay King + +[ Upstream commit 7d9ec9dc20ecdb1661f4538cd9112cd3d6a5f15a ] + +[Why] +For RGB BT2020 full and limited color spaces, overlay adjustments were +applied twice (once by MM and once by DAL). This results in incorrect +colours and a noticeable difference between mpo and non-mpo cases. + +[How] +Add RGB BT2020 full and limited color spaces to list that bypasses post +csc adjustment. + +Reviewed-by: Aric Cyr +Signed-off-by: Clay King +Signed-off-by: Tom Chung +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c | 21 ++++++++++++++++--- + .../drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h | 4 ++++ + .../amd/display/dc/dpp/dcn401/dcn401_dpp.c | 6 +++--- + 3 files changed, 25 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c +index 6c3cae593ad54..ba12c294f971a 100644 +--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c ++++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c +@@ -360,10 +360,10 @@ void dpp3_cnv_setup ( + + tbl_entry.color_space = input_color_space; + +- if (color_space >= COLOR_SPACE_YCBCR601) +- select = INPUT_CSC_SELECT_ICSC; +- else ++ if (dpp3_should_bypass_post_csc_for_colorspace(color_space)) + select = INPUT_CSC_SELECT_BYPASS; ++ else ++ select = INPUT_CSC_SELECT_ICSC; + + dpp3_program_post_csc(dpp_base, color_space, select, + &tbl_entry); +@@ -1527,3 +1527,18 @@ bool dpp3_construct( + return true; + } + ++bool dpp3_should_bypass_post_csc_for_colorspace(enum dc_color_space dc_color_space) ++{ ++ switch (dc_color_space) { ++ case COLOR_SPACE_UNKNOWN: ++ case COLOR_SPACE_SRGB: ++ case COLOR_SPACE_XR_RGB: ++ case COLOR_SPACE_SRGB_LIMITED: ++ case COLOR_SPACE_MSREF_SCRGB: ++ case COLOR_SPACE_2020_RGB_FULLRANGE: ++ case COLOR_SPACE_2020_RGB_LIMITEDRANGE: ++ return true; ++ default: ++ return false; ++ } ++} +diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h +index b110f35ef66bd..d183875b13302 100644 +--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h ++++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h +@@ -641,4 +641,8 @@ void dpp3_program_cm_dealpha( + + void dpp3_cm_get_gamut_remap(struct dpp *dpp_base, + struct dpp_grph_csc_adjustment *adjust); ++ ++bool dpp3_should_bypass_post_csc_for_colorspace( ++ enum dc_color_space dc_color_space); ++ + #endif /* __DC_HWSS_DCN30_H__ */ +diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c +index 97bf26fa35738..3e24ac07eebd9 100644 +--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c ++++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c +@@ -206,10 +206,10 @@ void dpp401_dpp_setup( + + tbl_entry.color_space = input_color_space; + +- if (color_space >= COLOR_SPACE_YCBCR601) +- select = INPUT_CSC_SELECT_ICSC; +- else ++ if (dpp3_should_bypass_post_csc_for_colorspace(color_space)) + select = INPUT_CSC_SELECT_BYPASS; ++ else ++ select = INPUT_CSC_SELECT_ICSC; + + dpp3_program_post_csc(dpp_base, color_space, select, + &tbl_entry); +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-display-disable-fec-when-powering-down-encod.patch b/queue-6.12/drm-amd-display-disable-fec-when-powering-down-encod.patch new file mode 100644 index 00000000000..d5384c53bdf --- /dev/null +++ b/queue-6.12/drm-amd-display-disable-fec-when-powering-down-encod.patch @@ -0,0 +1,79 @@ +From 943309e16fd5d4e0dd0a15bd6e9fe5eeddb733cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jan 2026 17:48:59 -0500 +Subject: drm/amd/display: Disable FEC when powering down encoders + +From: Ovidiu Bunea + +[ Upstream commit 8cee62904caf95e5698fa0f2d420f5f22b4dea15 ] + +[why & how] +VBIOS DMCUB FW can enable FEC for capable eDPs, but S/W DC state is +only updated for link0 when transitioning into OS with driver loaded. +This causes issues when the eDP is immediately hidden and DIG0 is +assigned to another link that does not support FEC. Driver will +attempt to disable FEC but FEC enablement occurs based on the link +state, which does not have fec_state updated since it is a different +link. Thus, FEC disablement on DIG0 will get skipped and cause no +light up. + +Reviewed-by: Karen Chen +Signed-off-by: Ovidiu Bunea +Signed-off-by: Matthew Stewart +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../amd/display/dc/hwss/dce110/dce110_hwseq.c | 24 ++++++++++++------- + 1 file changed, 15 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +index 924a425a1b76d..df69e0cebf785 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +@@ -58,6 +58,7 @@ + #include "dc_state_priv.h" + #include "dpcd_defs.h" + #include "dsc.h" ++#include "dc_dp_types.h" + /* include DCE11 register header files */ + #include "dce/dce_11_0_d.h" + #include "dce/dce_11_0_sh_mask.h" +@@ -1706,20 +1707,25 @@ static void power_down_encoders(struct dc *dc) + int i; + + for (i = 0; i < dc->link_count; i++) { +- enum signal_type signal = dc->links[i]->connector_signal; +- +- dc->link_srv->blank_dp_stream(dc->links[i], false); ++ struct dc_link *link = dc->links[i]; ++ struct link_encoder *link_enc = link->link_enc; ++ enum signal_type signal = link->connector_signal; + ++ dc->link_srv->blank_dp_stream(link, false); + if (signal != SIGNAL_TYPE_EDP) + signal = SIGNAL_TYPE_NONE; + +- if (dc->links[i]->ep_type == DISPLAY_ENDPOINT_PHY) +- dc->links[i]->link_enc->funcs->disable_output( +- dc->links[i]->link_enc, signal); ++ if (link->ep_type == DISPLAY_ENDPOINT_PHY) ++ link_enc->funcs->disable_output(link_enc, signal); ++ ++ if (link->fec_state == dc_link_fec_enabled) { ++ link_enc->funcs->fec_set_enable(link_enc, false); ++ link_enc->funcs->fec_set_ready(link_enc, false); ++ link->fec_state = dc_link_fec_not_ready; ++ } + +- dc->links[i]->link_status.link_active = false; +- memset(&dc->links[i]->cur_link_settings, 0, +- sizeof(dc->links[i]->cur_link_settings)); ++ link->link_status.link_active = false; ++ memset(&link->cur_link_settings, 0, sizeof(link->cur_link_settings)); + } + } + +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-display-ensure-link-output-is-disabled-in-ba.patch b/queue-6.12/drm-amd-display-ensure-link-output-is-disabled-in-ba.patch new file mode 100644 index 00000000000..e35a2831576 --- /dev/null +++ b/queue-6.12/drm-amd-display-ensure-link-output-is-disabled-in-ba.patch @@ -0,0 +1,59 @@ +From a3efb7fb7ef93daa2e902171958ef6c9a7df1616 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 11:11:19 -0500 +Subject: drm/amd/display: Ensure link output is disabled in backend reset for + PLL_ON + +From: Nicholas Kazlauskas + +[ Upstream commit 4589712e0111352973131bad975023b25569287c ] + +[Why] +We're missing the code to actually disable the link output when we have +to leave the SYMCLK_ON but the TX remains OFF. + +[How] +Port the code from DCN401 that detects SYMCLK_ON_TX_OFF and disable +the link output when the backend is reset. + +Reviewed-by: Ovidiu (Ovi) Bunea +Signed-off-by: Nicholas Kazlauskas +Signed-off-by: Matthew Stewart +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c +index 9aa925a0b3b43..322515aee728e 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c +@@ -525,8 +525,22 @@ static void dcn31_reset_back_end_for_pipe( + if (pipe_ctx->stream_res.tg->funcs->set_odm_bypass) + pipe_ctx->stream_res.tg->funcs->set_odm_bypass( + pipe_ctx->stream_res.tg, &pipe_ctx->stream->timing); ++ /* ++ * TODO - convert symclk_ref_cnts for otg to a bit map to solve ++ * the case where the same symclk is shared across multiple otg ++ * instances ++ */ + if (dc_is_hdmi_tmds_signal(pipe_ctx->stream->signal)) +- pipe_ctx->stream->link->phy_state.symclk_ref_cnts.otg = 0; ++ link->phy_state.symclk_ref_cnts.otg = 0; ++ ++ if (pipe_ctx->top_pipe == NULL) { ++ if (link->phy_state.symclk_state == SYMCLK_ON_TX_OFF) { ++ const struct link_hwss *link_hwss = get_link_hwss(link, &pipe_ctx->link_res); ++ ++ link_hwss->disable_link_output(link, &pipe_ctx->link_res, pipe_ctx->stream->signal); ++ link->phy_state.symclk_state = SYMCLK_OFF_TX_OFF; ++ } ++ } + + set_drr_and_clear_adjust_pending(pipe_ctx, pipe_ctx->stream, NULL); + +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-display-fix-dsc-edp-issue.patch b/queue-6.12/drm-amd-display-fix-dsc-edp-issue.patch new file mode 100644 index 00000000000..a4375579f51 --- /dev/null +++ b/queue-6.12/drm-amd-display-fix-dsc-edp-issue.patch @@ -0,0 +1,59 @@ +From fa17121e3794a914246b0ce0ee313a987310c894 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Dec 2025 17:01:17 -0500 +Subject: drm/amd/display: Fix dsc eDP issue + +From: Charlene Liu + +[ Upstream commit 878a4b73c11111ff5f820730f59a7f8c6fd59374 ] + +[why] +Need to add function hook check before use + +Reviewed-by: Mohit Bawa +Signed-off-by: Charlene Liu +Signed-off-by: Chenyu Chen +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +index 31c7dfff27cbb..924a425a1b76d 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +@@ -1767,6 +1767,9 @@ static void disable_vga_and_power_gate_all_controllers( + struct timing_generator *tg; + struct dc_context *ctx = dc->ctx; + ++ if (dc->caps.ips_support) ++ return; ++ + for (i = 0; i < dc->res_pool->timing_generator_count; i++) { + tg = dc->res_pool->timing_generators[i]; + +@@ -1843,13 +1846,16 @@ static void clean_up_dsc_blocks(struct dc *dc) + /* disable DSC in OPTC */ + if (i < dc->res_pool->timing_generator_count) { + tg = dc->res_pool->timing_generators[i]; +- tg->funcs->set_dsc_config(tg, OPTC_DSC_DISABLED, 0, 0); ++ if (tg->funcs->set_dsc_config) ++ tg->funcs->set_dsc_config(tg, OPTC_DSC_DISABLED, 0, 0); + } + /* disable DSC in stream encoder */ + if (i < dc->res_pool->stream_enc_count) { + se = dc->res_pool->stream_enc[i]; +- se->funcs->dp_set_dsc_config(se, OPTC_DSC_DISABLED, 0, 0); +- se->funcs->dp_set_dsc_pps_info_packet(se, false, NULL, true); ++ if (se->funcs->dp_set_dsc_config) ++ se->funcs->dp_set_dsc_config(se, OPTC_DSC_DISABLED, 0, 0); ++ if (se->funcs->dp_set_dsc_pps_info_packet) ++ se->funcs->dp_set_dsc_pps_info_packet(se, false, NULL, true); + } + /* disable DSC block */ + if (dccg->funcs->set_ref_dscclk) +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-display-fix-gfx12-family-constant-checks.patch b/queue-6.12/drm-amd-display-fix-gfx12-family-constant-checks.patch new file mode 100644 index 00000000000..cbccada0391 --- /dev/null +++ b/queue-6.12/drm-amd-display-fix-gfx12-family-constant-checks.patch @@ -0,0 +1,59 @@ +From a38a0bb9011ff7c8c645b889a075dd33b5af3fe8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jan 2026 13:32:42 -0500 +Subject: drm/amd/display: Fix GFX12 family constant checks + +From: Matthew Stewart + +[ Upstream commit bdad08670278829771626ea7b57c4db531e2544f ] + +Using >=, <= for checking the family is not always correct. + +Reviewed-by: Aurabindo Pillai +Signed-off-by: Matthew Stewart +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index b146b0529ae7f..87ecab0298aa1 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -11070,7 +11070,7 @@ static int dm_check_cursor_fb(struct amdgpu_crtc *new_acrtc, + * check tiling flags when the FB doesn't have a modifier. + */ + if (!(fb->flags & DRM_MODE_FB_MODIFIERS)) { +- if (adev->family >= AMDGPU_FAMILY_GC_12_0_0) { ++ if (adev->family == AMDGPU_FAMILY_GC_12_0_0) { + linear = AMDGPU_TILING_GET(afb->tiling_flags, GFX12_SWIZZLE_MODE) == 0; + } else if (adev->family >= AMDGPU_FAMILY_AI) { + linear = AMDGPU_TILING_GET(afb->tiling_flags, SWIZZLE_MODE) == 0; +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c +index 62e30942f735d..a283f34523ed0 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c +@@ -275,7 +275,7 @@ static int amdgpu_dm_plane_validate_dcc(struct amdgpu_device *adev, + if (!dcc->enable) + return 0; + +- if (adev->family < AMDGPU_FAMILY_GC_12_0_0 && ++ if (adev->family != AMDGPU_FAMILY_GC_12_0_0 && + format >= SURFACE_PIXEL_FORMAT_VIDEO_BEGIN) + return -EINVAL; + +@@ -896,7 +896,7 @@ int amdgpu_dm_plane_fill_plane_buffer_attributes(struct amdgpu_device *adev, + upper_32_bits(chroma_addr); + } + +- if (adev->family >= AMDGPU_FAMILY_GC_12_0_0) { ++ if (adev->family == AMDGPU_FAMILY_GC_12_0_0) { + ret = amdgpu_dm_plane_fill_gfx12_plane_attributes_from_modifiers(adev, afb, format, + rotation, plane_size, + tiling_info, dcc, +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-display-fix-system-resume-lag-issue.patch b/queue-6.12/drm-amd-display-fix-system-resume-lag-issue.patch new file mode 100644 index 00000000000..cc7eabd4478 --- /dev/null +++ b/queue-6.12/drm-amd-display-fix-system-resume-lag-issue.patch @@ -0,0 +1,54 @@ +From ff60ad02fdd8c2c84917214e2399707e07c9e1e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 18:10:31 +0800 +Subject: drm/amd/display: Fix system resume lag issue + +From: Tom Chung + +[ Upstream commit 64c94cd9be2e188ed07efeafa6a109bce638c967 ] + +[Why] +System will try to apply idle power optimizations setting during +system resume. But system power state is still in D3 state, and +it will cause the idle power optimizations command not actually +to be sent to DMUB and cause some platforms to go into IPS. + +[How] +Set power state to D0 first before calling the +dc_dmub_srv_apply_idle_power_optimizations(dm->dc, false) + +Reviewed-by: Nicholas Kazlauskas +Signed-off-by: Tom Chung +Signed-off-by: Wayne Lin +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index de91fed0e850d..f4693136a2ebf 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -3243,7 +3243,17 @@ static int dm_resume(void *handle) + struct dc_commit_streams_params commit_params = {}; + + if (dm->dc->caps.ips_support) { ++ if (!amdgpu_in_reset(adev)) ++ mutex_lock(&dm->dc_lock); ++ ++ /* Need to set POWER_STATE_D0 first or it will not execute ++ * idle_power_optimizations command to DMUB. ++ */ ++ dc_dmub_srv_set_power_state(dm->dc->ctx->dmub_srv, DC_ACPI_CM_POWER_STATE_D0); + dc_dmub_srv_apply_idle_power_optimizations(dm->dc, false); ++ ++ if (!amdgpu_in_reset(adev)) ++ mutex_unlock(&dm->dc_lock); + } + + if (amdgpu_in_reset(adev)) { +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-display-fix-writeback-on-dcn-3.2.patch b/queue-6.12/drm-amd-display-fix-writeback-on-dcn-3.2.patch new file mode 100644 index 00000000000..e28f68ae532 --- /dev/null +++ b/queue-6.12/drm-amd-display-fix-writeback-on-dcn-3.2.patch @@ -0,0 +1,70 @@ +From ca55474c4e6c60156a2572c05f7bd9e68ddcdeda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 17:20:31 -0700 +Subject: drm/amd/display: Fix writeback on DCN 3.2+ + +From: Alex Hung + +[ Upstream commit 9ef84a307582a92ef055ef0bd3db10fd8ac75960 ] + +[WHAT] +1. Set no scaling for writeback as they are hardcoded in DCN3.2+. +2. Set no fast plane update for writeback commits. + +Reviewed-by: Harry Wentland +Signed-off-by: Alex Hung +Signed-off-by: Wayne Lin +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 87ecab0298aa1..de91fed0e850d 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -9888,10 +9888,10 @@ static void dm_set_writeback(struct amdgpu_display_manager *dm, + + wb_info->dwb_params.capture_rate = dwb_capture_rate_0; + +- wb_info->dwb_params.scaler_taps.h_taps = 4; +- wb_info->dwb_params.scaler_taps.v_taps = 4; +- wb_info->dwb_params.scaler_taps.h_taps_c = 2; +- wb_info->dwb_params.scaler_taps.v_taps_c = 2; ++ wb_info->dwb_params.scaler_taps.h_taps = 1; ++ wb_info->dwb_params.scaler_taps.v_taps = 1; ++ wb_info->dwb_params.scaler_taps.h_taps_c = 1; ++ wb_info->dwb_params.scaler_taps.v_taps_c = 1; + wb_info->dwb_params.subsample_position = DWB_INTERSTITIAL_SUBSAMPLING; + + wb_info->mcif_buf_params.luma_pitch = afb->base.pitches[0]; +@@ -10884,6 +10884,8 @@ static bool should_reset_plane(struct drm_atomic_state *state, + struct drm_crtc_state *old_crtc_state, *new_crtc_state; + struct dm_crtc_state *old_dm_crtc_state, *new_dm_crtc_state; + struct amdgpu_device *adev = drm_to_adev(plane->dev); ++ struct drm_connector_state *new_con_state; ++ struct drm_connector *connector; + int i; + + /* +@@ -10894,6 +10896,15 @@ static bool should_reset_plane(struct drm_atomic_state *state, + state->allow_modeset) + return true; + ++ /* Check for writeback commit */ ++ for_each_new_connector_in_state(state, connector, new_con_state, i) { ++ if (connector->connector_type != DRM_MODE_CONNECTOR_WRITEBACK) ++ continue; ++ ++ if (new_con_state->writeback_job) ++ return true; ++ } ++ + if (amdgpu_in_reset(adev) && state->allow_modeset) + return true; + +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-display-only-power-down-dig-on-phy-endpoints.patch b/queue-6.12/drm-amd-display-only-power-down-dig-on-phy-endpoints.patch new file mode 100644 index 00000000000..47fcd45fc43 --- /dev/null +++ b/queue-6.12/drm-amd-display-only-power-down-dig-on-phy-endpoints.patch @@ -0,0 +1,37 @@ +From d8f237f4f325d0ad0478f0ba173f7d7114dca3ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 16:38:50 -0500 +Subject: drm/amd/display: only power down dig on phy endpoints + +From: Dmytro Laktyushkin + +[ Upstream commit 0839d8d24e6f1fc2587c4a976f44da9fa69ae3d0 ] + +This avoids any issues with dpia endpoints + +Reviewed-by: Charlene Liu +Signed-off-by: Dmytro Laktyushkin +Signed-off-by: Matthew Stewart +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +index bf2a9d8d3bd2d..e62d415b16004 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +@@ -371,6 +371,8 @@ void dcn401_init_hw(struct dc *dc) + for (i = 0; i < dc->link_count; i++) { + struct dc_link *link = dc->links[i]; + ++ if (link->ep_type != DISPLAY_ENDPOINT_PHY) ++ continue; + if (link->link_enc->funcs->is_dig_enabled && + link->link_enc->funcs->is_dig_enabled(link->link_enc) && + hws->funcs.power_down) { +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-display-remove-conditional-for-shaper-3dlut-.patch b/queue-6.12/drm-amd-display-remove-conditional-for-shaper-3dlut-.patch new file mode 100644 index 00000000000..c5f957fb44c --- /dev/null +++ b/queue-6.12/drm-amd-display-remove-conditional-for-shaper-3dlut-.patch @@ -0,0 +1,44 @@ +From cf8abe60208fa207c452bf66c7d7c4cf424c06bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 22:05:16 -0700 +Subject: drm/amd/display: Remove conditional for shaper 3DLUT power-on + +From: Alex Hung + +[ Upstream commit 1b38a87b8f8020e8ef4563e7752a64182b5a39b9 ] + +[Why] +Shaper programming has high chance to fail on first time after +power-on or reboot. This can be verified by running IGT's kms_colorop. + +[How] +Always power on the shaper and 3DLUT before programming by +removing the debug flag of low power mode. + +Reviewed-by: Aurabindo Pillai +Signed-off-by: Alex Hung +Signed-off-by: Ray Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c b/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c +index a0e9e9f0441a4..acf726137488d 100644 +--- a/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c ++++ b/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c +@@ -721,8 +721,7 @@ bool mpc32_program_shaper( + return false; + } + +- if (mpc->ctx->dc->debug.enable_mem_low_power.bits.mpc) +- mpc32_power_on_shaper_3dlut(mpc, mpcc_id, true); ++ mpc32_power_on_shaper_3dlut(mpc, mpcc_id, true); + + current_mode = mpc32_get_shaper_current(mpc, mpcc_id); + +-- +2.51.0 + diff --git a/queue-6.12/drm-amdgpu-add-hainan-clock-adjustment.patch b/queue-6.12/drm-amdgpu-add-hainan-clock-adjustment.patch new file mode 100644 index 00000000000..78410f8e88e --- /dev/null +++ b/queue-6.12/drm-amdgpu-add-hainan-clock-adjustment.patch @@ -0,0 +1,39 @@ +From ec96d731f9242ea677e1392c3a2adddb70f67a72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Feb 2026 07:24:01 +0000 +Subject: drm/amdgpu: Add HAINAN clock adjustment + +From: decce6 + +[ Upstream commit 49fe2c57bdc0acff9d2551ae337270b6fd8119d9 ] + +This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from +850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This +patch is for amdgpu. + +Signed-off-by: decce6 +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index 29cecfab07042..37a91a76208e5 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -3449,6 +3449,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + max_sclk = 60000; + max_mclk = 80000; + } ++ if ((adev->pdev->device == 0x666f) && ++ (adev->pdev->revision == 0x00)) { ++ max_sclk = 80000; ++ max_mclk = 95000; ++ } + } else if (adev->asic_type == CHIP_OLAND) { + if ((adev->pdev->revision == 0xC7) || + (adev->pdev->revision == 0x80) || +-- +2.51.0 + diff --git a/queue-6.12/drm-amdgpu-add-support-for-hdp-ip-version-6.1.1.patch b/queue-6.12/drm-amdgpu-add-support-for-hdp-ip-version-6.1.1.patch new file mode 100644 index 00000000000..7e98ed9ec3e --- /dev/null +++ b/queue-6.12/drm-amdgpu-add-support-for-hdp-ip-version-6.1.1.patch @@ -0,0 +1,34 @@ +From c59acc064275e085fe086953fdc4e661d208f709 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Dec 2024 10:46:47 +0800 +Subject: drm/amdgpu: add support for HDP IP version 6.1.1 + +From: Tim Huang + +[ Upstream commit e2fd14f579b841f54a9b7162fef15234d8c0627a ] + +This initializes HDP IP version 6.1.1. + +Reviewed-by: Mario Limonciello +Signed-off-by: Tim Huang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +index e09db65880e1a..f62ac736ed76c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +@@ -2895,6 +2895,7 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev) + case IP_VERSION(6, 0, 0): + case IP_VERSION(6, 0, 1): + case IP_VERSION(6, 1, 0): ++ case IP_VERSION(6, 1, 1): + adev->hdp.funcs = &hdp_v6_0_funcs; + break; + case IP_VERSION(7, 0, 0): +-- +2.51.0 + diff --git a/queue-6.12/drm-amdgpu-adjust-usleep_range-in-fence-wait.patch b/queue-6.12/drm-amdgpu-adjust-usleep_range-in-fence-wait.patch new file mode 100644 index 00000000000..8099857a361 --- /dev/null +++ b/queue-6.12/drm-amdgpu-adjust-usleep_range-in-fence-wait.patch @@ -0,0 +1,38 @@ +From 226409cd7945fce458eb7c64bf1e087f1257d006 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Feb 2026 15:32:01 +0800 +Subject: drm/amdgpu: Adjust usleep_range in fence wait + +From: Ce Sun + +[ Upstream commit 3ee1c72606bd2842f0f377fd4b118362af0323ae ] + +Tune the sleep interval in the PSP fence wait loop from 10-100us to +60-100us.This adjustment results in an overall wait window of 1.2s +(60us * 20000 iterations) to 2 seconds (100us * 20000 iterations), +which guarantees that we can retrieve the correct fence value + +Signed-off-by: Ce Sun +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index fa84208eed18e..26260873f6a15 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -694,7 +694,7 @@ psp_cmd_submit_buf(struct psp_context *psp, + ras_intr = amdgpu_ras_intr_triggered(); + if (ras_intr) + break; +- usleep_range(10, 100); ++ usleep_range(60, 100); + amdgpu_device_invalidate_hdp(psp->adev, NULL); + } + +-- +2.51.0 + diff --git a/queue-6.12/drm-amdgpu-avoid-a-warning-in-timedout-job-handler.patch b/queue-6.12/drm-amdgpu-avoid-a-warning-in-timedout-job-handler.patch new file mode 100644 index 00000000000..0740262461f --- /dev/null +++ b/queue-6.12/drm-amdgpu-avoid-a-warning-in-timedout-job-handler.patch @@ -0,0 +1,41 @@ +From 13c8cbc93c4eccfa005b2374eb97ea723be2304b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Dec 2025 11:46:48 -0500 +Subject: drm/amdgpu: avoid a warning in timedout job handler +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +[ Upstream commit c8cf9ddc549fb93cb5a35f3fe23487b1e6707e74 ] + +Only set an error on the fence if the fence is not +signalled. We can end up with a warning if the +per queue reset path signals the fence and sets an error +as part of the reset, but fails to recover. + +Reviewed-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c +index 7e6057a6e7f17..ba9a9adca0bff 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c +@@ -132,7 +132,8 @@ static enum drm_gpu_sched_stat amdgpu_job_timedout(struct drm_sched_job *s_job) + amdgpu_vm_put_task_info(ti); + } + +- dma_fence_set_error(&s_job->s_fence->finished, -ETIME); ++ if (dma_fence_get_status(&s_job->s_fence->finished) == 0) ++ dma_fence_set_error(&s_job->s_fence->finished, -ETIME); + + /* attempt a per ring reset */ + if (amdgpu_gpu_recovery && +-- +2.51.0 + diff --git a/queue-6.12/drm-amdgpu-fix-null-pointer-issue-buffer-funcs.patch b/queue-6.12/drm-amdgpu-fix-null-pointer-issue-buffer-funcs.patch new file mode 100644 index 00000000000..9ce6143b65e --- /dev/null +++ b/queue-6.12/drm-amdgpu-fix-null-pointer-issue-buffer-funcs.patch @@ -0,0 +1,37 @@ +From 04caaa9c34ae11eac4e15fe11f1b1e76275cb570 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Jul 2024 11:07:40 +0800 +Subject: drm/amdgpu: fix NULL pointer issue buffer funcs + +From: Likun Gao + +[ Upstream commit 9877a865d62c9c3e0f4cc369dc9ca9f7f24f5ee9 ] + +If SDMA block not enabled, buffer_funcs will not initialize, +fix the null pointer issue if buffer_funcs not initialized. + +Signed-off-by: Likun Gao +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index 1cf90557b310b..cab75f5c9f2fd 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -2963,7 +2963,8 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev) + if (r) + goto init_failed; + +- if (adev->mman.buffer_funcs_ring->sched.ready) ++ if (adev->mman.buffer_funcs_ring && ++ adev->mman.buffer_funcs_ring->sched.ready) + amdgpu_ttm_set_buffer_funcs_status(adev, true); + + /* Don't init kfd if whole hive need to be reset during init */ +-- +2.51.0 + diff --git a/queue-6.12/drm-amdgpu-skip-loading-sdma_rs64-in-vf.patch b/queue-6.12/drm-amdgpu-skip-loading-sdma_rs64-in-vf.patch new file mode 100644 index 00000000000..7bf7d8e242f --- /dev/null +++ b/queue-6.12/drm-amdgpu-skip-loading-sdma_rs64-in-vf.patch @@ -0,0 +1,35 @@ +From d84f10ad344b5c0994a73f89cf221977ea0321c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Nov 2025 15:16:27 +0800 +Subject: drm/amdgpu: Skip loading SDMA_RS64 in VF + +From: YuBiao Wang + +[ Upstream commit 39c21b81112321cbe1267b02c77ecd2161ce19aa ] + +VFs use the PF SDMA ucode and are unable to load SDMA_RS64. + +Signed-off-by: YuBiao Wang +Signed-off-by: Victor Skvortsov +Reviewed-by: Gavin Wan +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +index 9247cd7b1868c..78af6e9282256 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +@@ -923,6 +923,7 @@ bool amdgpu_virt_fw_load_skip_check(struct amdgpu_device *adev, uint32_t ucode_i + || ucode_id == AMDGPU_UCODE_ID_SDMA5 + || ucode_id == AMDGPU_UCODE_ID_SDMA6 + || ucode_id == AMDGPU_UCODE_ID_SDMA7 ++ || ucode_id == AMDGPU_UCODE_ID_SDMA_RS64 + || ucode_id == AMDGPU_UCODE_ID_RLC_G + || ucode_id == AMDGPU_UCODE_ID_RLC_RESTORE_LIST_CNTL + || ucode_id == AMDGPU_UCODE_ID_RLC_RESTORE_LIST_GPM_MEM +-- +2.51.0 + diff --git a/queue-6.12/drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch b/queue-6.12/drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch new file mode 100644 index 00000000000..c3bb3a40a21 --- /dev/null +++ b/queue-6.12/drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch @@ -0,0 +1,51 @@ +From 2efbfea1cb4bf59e5e1fe989872e591cf0951a4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 19:36:56 +0530 +Subject: drm/amdkfd: Fix GART PTE for non-4K pagesize in + svm_migrate_gart_map() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Donet Tom + +[ Upstream commit 6c160001661b6c4e20f5c31909c722741e14c2d8 ] + +In svm_migrate_gart_map(), while migrating GART mapping, the number of +bytes copied for the GART table only accounts for CPU pages. On non-4K +systems, each CPU page can contain multiple GPU pages, and the GART +requires one 8-byte PTE per GPU page. As a result, an incorrect size was +passed to the DMA, causing only a partial update of the GART table. + +Fix this function to work correctly on non-4K page-size systems by +accounting for the number of GPU pages per CPU page when calculating the +number of bytes to be copied. + +Acked-by: Christian König +Reviewed-by: Philip Yang +Signed-off-by: Ritesh Harjani (IBM) +Signed-off-by: Donet Tom +Signed-off-by: Felix Kuehling +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +index f31e9fbf634a0..52246f16cc242 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +@@ -62,7 +62,7 @@ svm_migrate_gart_map(struct amdgpu_ring *ring, uint64_t npages, + *gart_addr = adev->gmc.gart_start; + + num_dw = ALIGN(adev->mman.buffer_funcs->copy_num_dw, 8); +- num_bytes = npages * 8; ++ num_bytes = npages * 8 * AMDGPU_GPU_PAGES_IN_CPU_PAGE; + + r = amdgpu_job_alloc_with_ib(adev, &adev->mman.high_pr, + AMDGPU_FENCE_OWNER_UNDEFINED, +-- +2.51.0 + diff --git a/queue-6.12/drm-amdkfd-handle-gpu-reset-and-drain-retry-fault-ra.patch b/queue-6.12/drm-amdkfd-handle-gpu-reset-and-drain-retry-fault-ra.patch new file mode 100644 index 00000000000..550f452decf --- /dev/null +++ b/queue-6.12/drm-amdkfd-handle-gpu-reset-and-drain-retry-fault-ra.patch @@ -0,0 +1,63 @@ +From f85f02f037897ae4a1d19730998ba295e802a0f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 16:32:45 -0500 +Subject: drm/amdkfd: Handle GPU reset and drain retry fault race + +From: Philip Yang + +[ Upstream commit 5b57c3c3f22336e8fd5edb7f0fef3c7823f8eac1 ] + +Only check and drain IH1 ring if CAM is not enabled. + +If GPU is under reset, don't access IH to drain retry fault. + +Signed-off-by: Philip Yang +Reviewed-by: Harish Kasiviswanathan +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +index d65b0b23ec7b8..7f2dbb6c2cbf8 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +@@ -33,6 +33,7 @@ + #include "amdgpu_hmm.h" + #include "amdgpu.h" + #include "amdgpu_xgmi.h" ++#include "amdgpu_reset.h" + #include "kfd_priv.h" + #include "kfd_svm.h" + #include "kfd_migrate.h" +@@ -2334,6 +2335,9 @@ static void svm_range_drain_retry_fault(struct svm_range_list *svms) + + pr_debug("drain retry fault gpu %d svms %p\n", i, svms); + ++ if (!down_read_trylock(&pdd->dev->adev->reset_domain->sem)) ++ continue; ++ + amdgpu_ih_wait_on_checkpoint_process_ts(pdd->dev->adev, + pdd->dev->adev->irq.retry_cam_enabled ? + &pdd->dev->adev->irq.ih : +@@ -2343,6 +2347,7 @@ static void svm_range_drain_retry_fault(struct svm_range_list *svms) + amdgpu_ih_wait_on_checkpoint_process_ts(pdd->dev->adev, + &pdd->dev->adev->irq.ih_soft); + ++ up_read(&pdd->dev->adev->reset_domain->sem); + + pr_debug("drain retry fault gpu %d svms 0x%p done\n", i, svms); + } +@@ -2526,7 +2531,7 @@ svm_range_unmap_from_cpu(struct mm_struct *mm, struct svm_range *prange, + adev = pdd->dev->adev; + + /* Check and drain ih1 ring if cam not available */ +- if (adev->irq.ih1.ring_size) { ++ if (!adev->irq.retry_cam_enabled && adev->irq.ih1.ring_size) { + ih = &adev->irq.ih1; + checkpoint_wptr = amdgpu_ih_get_wptr(adev, ih); + if (ih->rptr != checkpoint_wptr) { +-- +2.51.0 + diff --git a/queue-6.12/drm-amdkfd-relax-size-checking-during-queue-buffer-g.patch b/queue-6.12/drm-amdkfd-relax-size-checking-during-queue-buffer-g.patch new file mode 100644 index 00000000000..341f412f2a9 --- /dev/null +++ b/queue-6.12/drm-amdkfd-relax-size-checking-during-queue-buffer-g.patch @@ -0,0 +1,61 @@ +From 69c438060da4fd6f7a0983ae9cddcfdd6f54689f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 19:36:54 +0530 +Subject: drm/amdkfd: Relax size checking during queue buffer get +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Donet Tom + +[ Upstream commit 42ea9cf2f16b7131cb7302acb3dac510968f8bdc ] + +HW-supported EOP buffer sizes are 4K and 32K. On systems that do not +use 4K pages, the minimum buffer object (BO) allocation size is +PAGE_SIZE (for example, 64K). During queue buffer acquisition, the driver +currently checks the allocated BO size against the supported EOP buffer +size. Since the allocated BO is larger than the expected size, this check +fails, preventing queue creation. + +Relax the strict size validation and allow PAGE_SIZE-sized BOs to be used. +Only the required 4K region of the buffer will be used as the EOP buffer +and avoids queue creation failures on non-4K page systems. + +Acked-by: Christian König +Suggested-by: Philip Yang +Signed-off-by: Donet Tom +Signed-off-by: Felix Kuehling +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c +index 0c6ef2919d870..1f1169a4d1540 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c +@@ -275,8 +275,8 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope + + /* EOP buffer is not required for all ASICs */ + if (properties->eop_ring_buffer_address) { +- if (properties->eop_ring_buffer_size != topo_dev->node_props.eop_buffer_size) { +- pr_debug("queue eop bo size 0x%x not equal to node eop buf size 0x%x\n", ++ if (properties->eop_ring_buffer_size < topo_dev->node_props.eop_buffer_size) { ++ pr_debug("queue eop bo size 0x%x is less than node eop buf size 0x%x\n", + properties->eop_ring_buffer_size, + topo_dev->node_props.eop_buffer_size); + err = -EINVAL; +@@ -284,7 +284,7 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope + } + err = kfd_queue_buffer_get(vm, (void *)properties->eop_ring_buffer_address, + &properties->eop_buf_bo, +- properties->eop_ring_buffer_size); ++ ALIGN(properties->eop_ring_buffer_size, PAGE_SIZE)); + if (err) + goto out_err_unreserve; + } +-- +2.51.0 + diff --git a/queue-6.12/drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch b/queue-6.12/drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch new file mode 100644 index 00000000000..95e27432f68 --- /dev/null +++ b/queue-6.12/drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch @@ -0,0 +1,73 @@ +From c1427eb9d47ab0cb59201acfc17a5ad8df6757e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Nov 2025 11:38:25 +0100 +Subject: drm/atmel-hlcdc: don't reject the commit if the src rect has + fractional parts +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ludovic Desroches + +[ Upstream commit 06682206e2a1883354ed758c09efeb51f435adbd ] + +Don’t reject the commit when the source rectangle has fractional parts. +This can occur due to scaling: drm_atomic_helper_check_plane_state() calls +drm_rect_clip_scaled(), which may introduce fractional parts while +computing the clipped source rectangle. This does not imply the commit is +invalid, so we should accept it instead of discarding it. + +Signed-off-by: Ludovic Desroches +Reviewed-by: Manikandan Muralidharan +Link: https://patch.msgid.link/20251120-lcd_scaling_fix-v1-1-5ffc98557923@microchip.com +Signed-off-by: Manikandan Muralidharan +Signed-off-by: Sasha Levin +--- + .../gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 19 ++++--------------- + 1 file changed, 4 insertions(+), 15 deletions(-) + +diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +index 410ec747cc7e0..caf6deda717ce 100644 +--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c ++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +@@ -78,8 +78,6 @@ drm_plane_state_to_atmel_hlcdc_plane_state(struct drm_plane_state *s) + return container_of(s, struct atmel_hlcdc_plane_state, base); + } + +-#define SUBPIXEL_MASK 0xffff +- + static uint32_t rgb_formats[] = { + DRM_FORMAT_C8, + DRM_FORMAT_XRGB4444, +@@ -744,24 +742,15 @@ static int atmel_hlcdc_plane_atomic_check(struct drm_plane *p, + if (ret || !s->visible) + return ret; + +- hstate->src_x = s->src.x1; +- hstate->src_y = s->src.y1; +- hstate->src_w = drm_rect_width(&s->src); +- hstate->src_h = drm_rect_height(&s->src); ++ hstate->src_x = s->src.x1 >> 16; ++ hstate->src_y = s->src.y1 >> 16; ++ hstate->src_w = drm_rect_width(&s->src) >> 16; ++ hstate->src_h = drm_rect_height(&s->src) >> 16; + hstate->crtc_x = s->dst.x1; + hstate->crtc_y = s->dst.y1; + hstate->crtc_w = drm_rect_width(&s->dst); + hstate->crtc_h = drm_rect_height(&s->dst); + +- if ((hstate->src_x | hstate->src_y | hstate->src_w | hstate->src_h) & +- SUBPIXEL_MASK) +- return -EINVAL; +- +- hstate->src_x >>= 16; +- hstate->src_y >>= 16; +- hstate->src_w >>= 16; +- hstate->src_h >>= 16; +- + hstate->nplanes = fb->format->num_planes; + if (hstate->nplanes > ATMEL_HLCDC_LAYER_MAX_PLANES) + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.12/drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch b/queue-6.12/drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch new file mode 100644 index 00000000000..bba31e154de --- /dev/null +++ b/queue-6.12/drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch @@ -0,0 +1,61 @@ +From a7cc4e219db3a4d7ac152fc6dc4e144f6862d72e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Oct 2025 18:14:52 +0200 +Subject: drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state + callback + +From: Ludovic Desroches + +[ Upstream commit f12352471061df83a36edf54bbb16284793284e4 ] + +After several commits, the slab memory increases. Some drm_crtc_commit +objects are not freed. The atomic_destroy_state callback only put the +framebuffer. Use the __drm_atomic_helper_plane_destroy_state() function +to put all the objects that are no longer needed. + +It has been seen after hours of usage of a graphics application or using +kmemleak: + +unreferenced object 0xc63a6580 (size 64): + comm "egt_basic", pid 171, jiffies 4294940784 + hex dump (first 32 bytes): + 40 50 34 c5 01 00 00 00 ff ff ff ff 8c 65 3a c6 @P4..........e:. + 8c 65 3a c6 ff ff ff ff 98 65 3a c6 98 65 3a c6 .e:......e:..e:. + backtrace (crc c25aa925): + kmemleak_alloc+0x34/0x3c + __kmalloc_cache_noprof+0x150/0x1a4 + drm_atomic_helper_setup_commit+0x1e8/0x7bc + drm_atomic_helper_commit+0x3c/0x15c + drm_atomic_commit+0xc0/0xf4 + drm_atomic_helper_set_config+0x84/0xb8 + drm_mode_setcrtc+0x32c/0x810 + drm_ioctl+0x20c/0x488 + sys_ioctl+0x14c/0xc20 + ret_fast_syscall+0x0/0x54 + +Signed-off-by: Ludovic Desroches +Reviewed-by: Manikandan Muralidharan +Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-1-79b615130dc3@microchip.com +Signed-off-by: Manikandan Muralidharan +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +index 3787db014501e..410ec747cc7e0 100644 +--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c ++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +@@ -1204,8 +1204,7 @@ static void atmel_hlcdc_plane_atomic_destroy_state(struct drm_plane *p, + state->dscrs[i]->self); + } + +- if (s->fb) +- drm_framebuffer_put(s->fb); ++ __drm_atomic_helper_plane_destroy_state(s); + + kfree(state); + } +-- +2.51.0 + diff --git a/queue-6.12/drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch b/queue-6.12/drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch new file mode 100644 index 00000000000..9894347ec75 --- /dev/null +++ b/queue-6.12/drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch @@ -0,0 +1,81 @@ +From fcfaa8952ac404adf2106ad604ea5c7a941b238b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Oct 2025 18:14:53 +0200 +Subject: drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release + +From: Ludovic Desroches + +[ Upstream commit bc847787233277a337788568e90a6ee1557595eb ] + +The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying +the atmel_hlcdc_plane state structure without properly duplicating the +drm_plane_state. In particular, state->commit remained set to the old +state commit, which can lead to a use-after-free in the next +drm_atomic_commit() call. + +Fix this by calling +__drm_atomic_helper_duplicate_plane_state(), which correctly clones +the base drm_plane_state (including the ->commit pointer). + +It has been seen when closing and re-opening the device node while +another DRM client (e.g. fbdev) is still attached: + +============================================================================= +BUG kmalloc-64 (Not tainted): Poison overwritten +----------------------------------------------------------------------------- + +0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b +FIX kmalloc-64: Restoring Poison 0xc611b344-0xc611b344=0x6b +Allocated in drm_atomic_helper_setup_commit+0x1e8/0x7bc age=178 cpu=0 +pid=29 + drm_atomic_helper_setup_commit+0x1e8/0x7bc + drm_atomic_helper_commit+0x3c/0x15c + drm_atomic_commit+0xc0/0xf4 + drm_framebuffer_remove+0x4cc/0x5a8 + drm_mode_rmfb_work_fn+0x6c/0x80 + process_one_work+0x12c/0x2cc + worker_thread+0x2a8/0x400 + kthread+0xc0/0xdc + ret_from_fork+0x14/0x28 +Freed in drm_atomic_helper_commit_hw_done+0x100/0x150 age=8 cpu=0 +pid=169 + drm_atomic_helper_commit_hw_done+0x100/0x150 + drm_atomic_helper_commit_tail+0x64/0x8c + commit_tail+0x168/0x18c + drm_atomic_helper_commit+0x138/0x15c + drm_atomic_commit+0xc0/0xf4 + drm_atomic_helper_set_config+0x84/0xb8 + drm_mode_setcrtc+0x32c/0x810 + drm_ioctl+0x20c/0x488 + sys_ioctl+0x14c/0xc20 + ret_fast_syscall+0x0/0x54 +Slab 0xef8bc360 objects=21 used=16 fp=0xc611b7c0 +flags=0x200(workingset|zone=0) +Object 0xc611b340 @offset=832 fp=0xc611b7c0 + +Signed-off-by: Ludovic Desroches +Reviewed-by: Manikandan Muralidharan +Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-2-79b615130dc3@microchip.com +Signed-off-by: Manikandan Muralidharan +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +index caf6deda717ce..ae8d7b017968d 100644 +--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c ++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +@@ -1174,8 +1174,7 @@ atmel_hlcdc_plane_atomic_duplicate_state(struct drm_plane *p) + return NULL; + } + +- if (copy->base.fb) +- drm_framebuffer_get(copy->base.fb); ++ __drm_atomic_helper_plane_duplicate_state(p, ©->base); + + return ©->base; + } +-- +2.51.0 + diff --git a/queue-6.12/drm-display-dp_mst-add-protection-against-0-vcpi.patch b/queue-6.12/drm-display-dp_mst-add-protection-against-0-vcpi.patch new file mode 100644 index 00000000000..24c631670b3 --- /dev/null +++ b/queue-6.12/drm-display-dp_mst-add-protection-against-0-vcpi.patch @@ -0,0 +1,96 @@ +From a9601449b68e4b73ad99d49517fb7a184b2a2e37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 15:16:50 +0530 +Subject: drm/display/dp_mst: Add protection against 0 vcpi + +From: Suraj Kandpal + +[ Upstream commit 342ccffd9f77fc29fe1c05fd145e4d842bd2feaa ] + +When releasing a timeslot there is a slight chance we may end up +with the wrong payload mask due to overflow if the delayed_destroy_work +ends up coming into play after a DP 2.1 monitor gets disconnected +which causes vcpi to become 0 then we try to make the payload = +~BIT(vcpi - 1) which is a negative shift. VCPI id should never +really be 0 hence skip changing the payload mask if VCPI is 0. + +Otherwise it leads to +<7> [515.287237] xe 0000:03:00.0: [drm:drm_dp_mst_get_port_malloc +[drm_display_helper]] port ffff888126ce9000 (3) +<4> [515.287267] -----------[ cut here ]----------- +<3> [515.287268] UBSAN: shift-out-of-bounds in +../drivers/gpu/drm/display/drm_dp_mst_topology.c:4575:36 +<3> [515.287271] shift exponent -1 is negative +<4> [515.287275] CPU: 7 UID: 0 PID: 3108 Comm: kworker/u64:33 Tainted: G +S U 6.17.0-rc6-lgci-xe-xe-3795-3e79699fa1b216e92+ #1 PREEMPT(voluntary) +<4> [515.287279] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER +<4> [515.287279] Hardware name: ASUS System Product Name/PRIME Z790-P +WIFI, BIOS 1645 03/15/2024 +<4> [515.287281] Workqueue: drm_dp_mst_wq drm_dp_delayed_destroy_work +[drm_display_helper] +<4> [515.287303] Call Trace: +<4> [515.287304] +<4> [515.287306] dump_stack_lvl+0xc1/0xf0 +<4> [515.287313] dump_stack+0x10/0x20 +<4> [515.287316] __ubsan_handle_shift_out_of_bounds+0x133/0x2e0 +<4> [515.287324] ? drm_atomic_get_private_obj_state+0x186/0x1d0 +<4> [515.287333] drm_dp_atomic_release_time_slots.cold+0x17/0x3d +[drm_display_helper] +<4> [515.287355] mst_connector_atomic_check+0x159/0x180 [xe] +<4> [515.287546] drm_atomic_helper_check_modeset+0x4d9/0xfa0 +<4> [515.287550] ? __ww_mutex_lock.constprop.0+0x6f/0x1a60 +<4> [515.287562] intel_atomic_check+0x119/0x2b80 [xe] +<4> [515.287740] ? find_held_lock+0x31/0x90 +<4> [515.287747] ? lock_release+0xce/0x2a0 +<4> [515.287754] drm_atomic_check_only+0x6a2/0xb40 +<4> [515.287758] ? drm_atomic_add_affected_connectors+0x12b/0x140 +<4> [515.287765] drm_atomic_commit+0x6e/0xf0 +<4> [515.287766] ? _pfx__drm_printfn_info+0x10/0x10 +<4> [515.287774] drm_client_modeset_commit_atomic+0x25c/0x2b0 +<4> [515.287794] drm_client_modeset_commit_locked+0x60/0x1b0 +<4> [515.287795] ? mutex_lock_nested+0x1b/0x30 +<4> [515.287801] drm_client_modeset_commit+0x26/0x50 +<4> [515.287804] __drm_fb_helper_restore_fbdev_mode_unlocked+0xdc/0x110 +<4> [515.287810] drm_fb_helper_hotplug_event+0x120/0x140 +<4> [515.287814] drm_fbdev_client_hotplug+0x28/0xd0 +<4> [515.287819] drm_client_hotplug+0x6c/0xf0 +<4> [515.287824] drm_client_dev_hotplug+0x9e/0xd0 +<4> [515.287829] drm_kms_helper_hotplug_event+0x1a/0x30 +<4> [515.287834] drm_dp_delayed_destroy_work+0x3df/0x410 +[drm_display_helper] +<4> [515.287861] process_one_work+0x22b/0x6f0 +<4> [515.287874] worker_thread+0x1e8/0x3d0 +<4> [515.287879] ? __pfx_worker_thread+0x10/0x10 +<4> [515.287882] kthread+0x11c/0x250 +<4> [515.287886] ? __pfx_kthread+0x10/0x10 +<4> [515.287890] ret_from_fork+0x2d7/0x310 +<4> [515.287894] ? __pfx_kthread+0x10/0x10 +<4> [515.287897] ret_from_fork_asm+0x1a/0x30 + +Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6303 +Signed-off-by: Suraj Kandpal +Reviewed-by: Imre Deak +Reviewed-by: Lyude Paul +Link: https://patch.msgid.link/20251119094650.799135-1-suraj.kandpal@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/display/drm_dp_mst_topology.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c +index 3e5f721d75400..997f2489f00f3 100644 +--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c +@@ -4571,7 +4571,8 @@ int drm_dp_atomic_release_time_slots(struct drm_atomic_state *state, + if (!payload->delete) { + payload->pbn = 0; + payload->delete = true; +- topology_state->payload_mask &= ~BIT(payload->vcpi - 1); ++ if (payload->vcpi > 0) ++ topology_state->payload_mask &= ~BIT(payload->vcpi - 1); + } + + return 0; +-- +2.51.0 + diff --git a/queue-6.12/drm-panel-fix-a-possible-null-pointer-dereference-in.patch b/queue-6.12/drm-panel-fix-a-possible-null-pointer-dereference-in.patch new file mode 100644 index 00000000000..58192db8a70 --- /dev/null +++ b/queue-6.12/drm-panel-fix-a-possible-null-pointer-dereference-in.patch @@ -0,0 +1,58 @@ +From 5f7e2c9010a1578bd22061f7747a02da72a20f58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Dec 2025 20:09:55 +0800 +Subject: drm/panel: Fix a possible null-pointer dereference in + jdi_panel_dsi_remove() + +From: Tuo Li + +[ Upstream commit 95eed73b871111123a8b1d31cb1fce7e902e49ea ] + +In jdi_panel_dsi_remove(), jdi is explicitly checked, indicating that it +may be NULL: + + if (!jdi) + mipi_dsi_detach(dsi); + +However, when jdi is NULL, the function does not return and continues by +calling jdi_panel_disable(): + + err = jdi_panel_disable(&jdi->base); + +Inside jdi_panel_disable(), jdi is dereferenced unconditionally, which can +lead to a NULL-pointer dereference: + + struct jdi_panel *jdi = to_panel_jdi(panel); + backlight_disable(jdi->backlight); + +To prevent such a potential NULL-pointer dereference, return early from +jdi_panel_dsi_remove() when jdi is NULL. + +Signed-off-by: Tuo Li +Reviewed-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://patch.msgid.link/20251218120955.11185-1-islituo@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c b/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c +index 5b5082efb282b..eba560e422e8b 100644 +--- a/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c ++++ b/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c +@@ -510,8 +510,10 @@ static void jdi_panel_dsi_remove(struct mipi_dsi_device *dsi) + int err; + + /* only detach from host for the DSI-LINK2 interface */ +- if (!jdi) ++ if (!jdi) { + mipi_dsi_detach(dsi); ++ return; ++ } + + err = jdi_panel_disable(&jdi->base); + if (err < 0) +-- +2.51.0 + diff --git a/queue-6.12/drm-radeon-add-hainan-clock-adjustment.patch b/queue-6.12/drm-radeon-add-hainan-clock-adjustment.patch new file mode 100644 index 00000000000..7217f3e052f --- /dev/null +++ b/queue-6.12/drm-radeon-add-hainan-clock-adjustment.patch @@ -0,0 +1,39 @@ +From e3c782ce832a02697f3a44e3f99aa3c2c8d2473c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Feb 2026 07:26:00 +0000 +Subject: drm/radeon: Add HAINAN clock adjustment + +From: decce6 + +[ Upstream commit 908d318f23d6b5d625bea093c5fc056238cdb7ff ] + +This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from +850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This +patch is for radeon. + +Signed-off-by: decce6 +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/si_dpm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c +index 9deb91970d4df..f12227145ef08 100644 +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -2925,6 +2925,11 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev, + max_sclk = 60000; + max_mclk = 80000; + } ++ if ((rdev->pdev->device == 0x666f) && ++ (rdev->pdev->revision == 0x00)) { ++ max_sclk = 80000; ++ max_mclk = 95000; ++ } + } else if (rdev->family == CHIP_OLAND) { + if ((rdev->pdev->revision == 0xC7) || + (rdev->pdev->revision == 0x80) || +-- +2.51.0 + diff --git a/queue-6.12/drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch b/queue-6.12/drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch new file mode 100644 index 00000000000..523c893039b --- /dev/null +++ b/queue-6.12/drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch @@ -0,0 +1,71 @@ +From c0167ebdcd3bec43a9e6b79ea159524e81cd4a9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Dec 2025 21:03:23 +0800 +Subject: drm/v3d: Set DMA segment size to avoid debug warnings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Xiaolei Wang + +[ Upstream commit 9eb018828b1b30dfba689c060735c50fc5b9f704 ] + +When using V3D rendering with CONFIG_DMA_API_DEBUG enabled, the +kernel occasionally reports a segment size mismatch. This is because +'max_seg_size' is not set. The kernel defaults to 64K. setting +'max_seg_size' to the maximum will prevent 'debug_dma_map_sg()' +from complaining about the over-mapping of the V3D segment length. + +DMA-API: v3d 1002000000.v3d: mapping sg segment longer than device + claims to support [len=8290304] [max=65536] +WARNING: CPU: 0 PID: 493 at kernel/dma/debug.c:1179 debug_dma_map_sg+0x330/0x388 +CPU: 0 UID: 0 PID: 493 Comm: Xorg Not tainted 6.12.53-yocto-standard #1 +Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT) +pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : debug_dma_map_sg+0x330/0x388 +lr : debug_dma_map_sg+0x330/0x388 +sp : ffff8000829a3ac0 +x29: ffff8000829a3ac0 x28: 0000000000000001 x27: ffff8000813fe000 +x26: ffffc1ffc0000000 x25: ffff00010fdeb760 x24: 0000000000000000 +x23: ffff8000816a9bf0 x22: 0000000000000001 x21: 0000000000000002 +x20: 0000000000000002 x19: ffff00010185e810 x18: ffffffffffffffff +x17: 69766564206e6168 x16: 74207265676e6f6c x15: 20746e656d676573 +x14: 20677320676e6970 x13: 5d34303334393134 x12: 0000000000000000 +x11: 00000000000000c0 x10: 00000000000009c0 x9 : ffff8000800e0b7c +x8 : ffff00010a315ca0 x7 : ffff8000816a5110 x6 : 0000000000000001 +x5 : 000000000000002b x4 : 0000000000000002 x3 : 0000000000000008 +x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00010a315280 +Call trace: + debug_dma_map_sg+0x330/0x388 + __dma_map_sg_attrs+0xc0/0x278 + dma_map_sgtable+0x30/0x58 + drm_gem_shmem_get_pages_sgt+0xb4/0x140 + v3d_bo_create_finish+0x28/0x130 [v3d] + v3d_create_bo_ioctl+0x54/0x180 [v3d] + drm_ioctl_kernel+0xc8/0x140 + drm_ioctl+0x2d4/0x4d8 + +Signed-off-by: Xiaolei Wang +Link: https://patch.msgid.link/20251203130323.2247072-1-xiaolei.wang@windriver.com +Signed-off-by: Maíra Canal +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/v3d/v3d_drv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c +index 7c17108da7d2d..f45fdd7d542f6 100644 +--- a/drivers/gpu/drm/v3d/v3d_drv.c ++++ b/drivers/gpu/drm/v3d/v3d_drv.c +@@ -302,6 +302,8 @@ static int v3d_platform_drm_probe(struct platform_device *pdev) + if (ret) + goto clk_disable; + ++ dma_set_max_seg_size(&pdev->dev, UINT_MAX); ++ + v3d->va_width = 30 + V3D_GET_FIELD(mmu_debug, V3D_MMU_VA_WIDTH); + + ident1 = V3D_READ(V3D_HUB_IDENT1); +-- +2.51.0 + diff --git a/queue-6.12/drm-xe-only-toggle-scheduling-in-tdr-if-guc-is-runni.patch b/queue-6.12/drm-xe-only-toggle-scheduling-in-tdr-if-guc-is-runni.patch new file mode 100644 index 00000000000..ab4c2cad36b --- /dev/null +++ b/queue-6.12/drm-xe-only-toggle-scheduling-in-tdr-if-guc-is-runni.patch @@ -0,0 +1,48 @@ +From 76d8d266ef902dbd4aed660fd6752f44460b244c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jan 2026 17:27:35 -0800 +Subject: drm/xe: Only toggle scheduling in TDR if GuC is running + +From: Matthew Brost + +[ Upstream commit dd1ef5e2456558876244795bb22a4d90cb24f160 ] + +If the firmware is not running during TDR (e.g., when the driver is +unloading), there's no need to toggle scheduling in the GuC. In such +cases, skip this step. + +v4: + - Bail on wait UC not running (Niranjana) + +Signed-off-by: Matthew Brost +Reviewed-by: Niranjana Vishwanathapura +Link: https://patch.msgid.link/20260110012739.2888434-4-matthew.brost@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_guc_submit.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c +index f316be1e96452..d0ef3a6a68d2c 100644 +--- a/drivers/gpu/drm/xe/xe_guc_submit.c ++++ b/drivers/gpu/drm/xe/xe_guc_submit.c +@@ -1112,7 +1112,7 @@ guc_exec_queue_timedout_job(struct drm_sched_job *drm_job) + if (exec_queue_reset(q)) + err = -EIO; + +- if (!exec_queue_destroyed(q)) { ++ if (!exec_queue_destroyed(q) && xe_uc_fw_is_running(&guc->fw)) { + /* + * Wait for any pending G2H to flush out before + * modifying state +@@ -1143,6 +1143,7 @@ guc_exec_queue_timedout_job(struct drm_sched_job *drm_job) + */ + smp_rmb(); + ret = wait_event_timeout(guc->ct.wq, ++ !xe_uc_fw_is_running(&guc->fw) || + !exec_queue_pending_disable(q) || + guc_read_stopped(guc), HZ * 5); + if (!ret || guc_read_stopped(guc)) { +-- +2.51.0 + diff --git a/queue-6.12/efi-cper-don-t-dump-the-entire-memory-region.patch b/queue-6.12/efi-cper-don-t-dump-the-entire-memory-region.patch new file mode 100644 index 00000000000..454117fb044 --- /dev/null +++ b/queue-6.12/efi-cper-don-t-dump-the-entire-memory-region.patch @@ -0,0 +1,54 @@ +From e0d0a80cfe0f32c7c48edf2210385be6af7e8936 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:35:06 +0100 +Subject: EFI/CPER: don't dump the entire memory region + +From: Mauro Carvalho Chehab + +[ Upstream commit 55cc6fe5716f678f06bcb95140882dfa684464ec ] + +The current logic at cper_print_fw_err() doesn't check if the +error record length is big enough to handle offset. On a bad firmware, +if the ofset is above the actual record, length -= offset will +underflow, making it dump the entire memory. + +The end result can be: + + - the logic taking a lot of time dumping large regions of memory; + - data disclosure due to the memory dumps; + - an OOPS, if it tries to dump an unmapped memory region. + +Fix it by checking if the section length is too small before doing +a hex dump. + +Signed-off-by: Mauro Carvalho Chehab +Reviewed-by: Jonathan Cameron +Acked-by: Ard Biesheuvel +Reviewed-by: Hanjun Guo +[ rjw: Subject tweaks ] +Link: https://patch.msgid.link/1752b5ba63a3e2f148ddee813b36c996cc617e86.1767871950.git.mchehab+huawei@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/cper.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c +index 16b27fe9608fd..e7fa5efea0d17 100644 +--- a/drivers/firmware/efi/cper.c ++++ b/drivers/firmware/efi/cper.c +@@ -560,6 +560,11 @@ static void cper_print_fw_err(const char *pfx, + } else { + offset = sizeof(*fw_err); + } ++ if (offset > length) { ++ printk("%s""error section length is too small: offset=%d, length=%d\n", ++ pfx, offset, length); ++ return; ++ } + + buf += offset; + length -= offset; +-- +2.51.0 + diff --git a/queue-6.12/efi-cper-don-t-go-past-the-arm-processor-cper-record.patch b/queue-6.12/efi-cper-don-t-go-past-the-arm-processor-cper-record.patch new file mode 100644 index 00000000000..34164965a53 --- /dev/null +++ b/queue-6.12/efi-cper-don-t-go-past-the-arm-processor-cper-record.patch @@ -0,0 +1,107 @@ +From 4d9b2d57276e3e068a3b0f37304461d57826b61e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:35:04 +0100 +Subject: EFI/CPER: don't go past the ARM processor CPER record buffer + +From: Mauro Carvalho Chehab + +[ Upstream commit eae21beecb95a3b69ee5c38a659f774e171d730e ] + +There's a logic inside GHES/CPER to detect if the section_length +is too small, but it doesn't detect if it is too big. + +Currently, if the firmware receives an ARM processor CPER record +stating that a section length is big, kernel will blindly trust +section_length, producing a very long dump. For instance, a 67 +bytes record with ERR_INFO_NUM set 46198 and section length +set to 854918320 would dump a lot of data going a way past the +firmware memory-mapped area. + +Fix it by adding a logic to prevent it to go past the buffer +if ERR_INFO_NUM is too big, making it report instead: + + [Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1 + [Hardware Error]: event severity: recoverable + [Hardware Error]: Error 0, type: recoverable + [Hardware Error]: section_type: ARM processor error + [Hardware Error]: MIDR: 0xff304b2f8476870a + [Hardware Error]: section length: 854918320, CPER size: 67 + [Hardware Error]: section length is too big + [Hardware Error]: firmware-generated error record is incorrect + [Hardware Error]: ERR_INFO_NUM is 46198 + +Signed-off-by: Mauro Carvalho Chehab +Reviewed-by: Jonathan Cameron +Acked-by: Ard Biesheuvel +Reviewed-by: Hanjun Guo +[ rjw: Subject and changelog tweaks ] +Link: https://patch.msgid.link/41cd9f6b3ace3cdff7a5e864890849e4b1c58b63.1767871950.git.mchehab+huawei@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/cper-arm.c | 12 ++++++++---- + drivers/firmware/efi/cper.c | 3 ++- + include/linux/cper.h | 3 ++- + 3 files changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/firmware/efi/cper-arm.c b/drivers/firmware/efi/cper-arm.c +index 52d18490b59e3..70e1735dfcdd4 100644 +--- a/drivers/firmware/efi/cper-arm.c ++++ b/drivers/firmware/efi/cper-arm.c +@@ -226,7 +226,8 @@ static void cper_print_arm_err_info(const char *pfx, u32 type, + } + + void cper_print_proc_arm(const char *pfx, +- const struct cper_sec_proc_arm *proc) ++ const struct cper_sec_proc_arm *proc, ++ u32 length) + { + int i, len, max_ctx_type; + struct cper_arm_err_info *err_info; +@@ -238,9 +239,12 @@ void cper_print_proc_arm(const char *pfx, + + len = proc->section_length - (sizeof(*proc) + + proc->err_info_num * (sizeof(*err_info))); +- if (len < 0) { +- printk("%ssection length: %d\n", pfx, proc->section_length); +- printk("%ssection length is too small\n", pfx); ++ ++ if (len < 0 || proc->section_length > length) { ++ printk("%ssection length: %d, CPER size: %d\n", ++ pfx, proc->section_length, length); ++ printk("%ssection length is too %s\n", pfx, ++ (len < 0) ? "small" : "big"); + printk("%sfirmware-generated error record is incorrect\n", pfx); + printk("%sERR_INFO_NUM is %d\n", pfx, proc->err_info_num); + return; +diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c +index e7fa5efea0d17..3587295cd0206 100644 +--- a/drivers/firmware/efi/cper.c ++++ b/drivers/firmware/efi/cper.c +@@ -664,7 +664,8 @@ cper_estatus_print_section(const char *pfx, struct acpi_hest_generic_data *gdata + + printk("%ssection_type: ARM processor error\n", newpfx); + if (gdata->error_data_length >= sizeof(*arm_err)) +- cper_print_proc_arm(newpfx, arm_err); ++ cper_print_proc_arm(newpfx, arm_err, ++ gdata->error_data_length); + else + goto err_section_too_small; + #endif +diff --git a/include/linux/cper.h b/include/linux/cper.h +index 3670b866ac119..951291fa50d4f 100644 +--- a/include/linux/cper.h ++++ b/include/linux/cper.h +@@ -591,7 +591,8 @@ void cper_mem_err_pack(const struct cper_sec_mem_err *, + const char *cper_mem_err_unpack(struct trace_seq *, + struct cper_mem_err_compact *); + void cper_print_proc_arm(const char *pfx, +- const struct cper_sec_proc_arm *proc); ++ const struct cper_sec_proc_arm *proc, ++ u32 length); + void cper_print_proc_ia(const char *pfx, + const struct cper_sec_proc_ia *proc); + int cper_mem_err_location(struct cper_mem_err_compact *mem, char *msg); +-- +2.51.0 + diff --git a/queue-6.12/ext4-mark-group-add-fast-commit-ineligible.patch b/queue-6.12/ext4-mark-group-add-fast-commit-ineligible.patch new file mode 100644 index 00000000000..fb0e10db801 --- /dev/null +++ b/queue-6.12/ext4-mark-group-add-fast-commit-ineligible.patch @@ -0,0 +1,68 @@ +From d17321030e936b4e2b0a54926f3eeb2cd93ca67b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 19:51:41 +0800 +Subject: ext4: mark group add fast-commit ineligible + +From: Li Chen + +[ Upstream commit 89b4336fd5ec78f51f9d3a1d100f3ffa3228e604 ] + +Fast commits only log operations that have dedicated replay support. +Online resize via EXT4_IOC_GROUP_ADD updates the superblock and group +descriptor metadata without going through the fast commit tracking +paths. +In practice these operations are rare and usually followed by further +updates, but mixing them into a fast commit makes the overall +semantics harder to reason about and risks replay gaps if new call +sites appear. + +Teach ext4 to mark the filesystem fast-commit ineligible when +ext4_ioctl_group_add() adds new block groups. +This forces those transactions to fall back to a full commit, +ensuring that the filesystem geometry updates are captured by the +normal journal rather than partially encoded in fast commit TLVs. +This change should not affect common workloads but makes online +resize via GROUP_ADD safer and easier to reason about under fast +commit. + +Testing: +1. prepare: + dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256 + mkfs.ext4 -O fast_commit -F /root/fc_resize.img + mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize +2. Ran a helper that issues EXT4_IOC_GROUP_ADD on the mounted + filesystem and checked the resize ineligible reason: + ./group_add_helper /mnt/fc_resize + cat /proc/fs/ext4/loop0/fc_info + shows "Resize": > 0. +3. Fsynced a file on the resized filesystem and verified that the fast + commit stats report at least one ineligible commit: + touch /mnt/fc_resize/file + /root/fsync_file /mnt/fc_resize/file + sync + cat /proc/fs/ext4/loop0/fc_info + shows fc stats ineligible > 0. + +Signed-off-by: Li Chen +Link: https://patch.msgid.link/20251211115146.897420-5-me@linux.beauty +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/ioctl.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c +index 1c77400bd88e1..9bfd0ccee6983 100644 +--- a/fs/ext4/ioctl.c ++++ b/fs/ext4/ioctl.c +@@ -963,6 +963,7 @@ static long ext4_ioctl_group_add(struct file *file, + + err = ext4_group_add(sb, input); + if (EXT4_SB(sb)->s_journal) { ++ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE, NULL); + jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal); + err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0); + jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal); +-- +2.51.0 + diff --git a/queue-6.12/ext4-mark-group-extend-fast-commit-ineligible.patch b/queue-6.12/ext4-mark-group-extend-fast-commit-ineligible.patch new file mode 100644 index 00000000000..7d1f0404245 --- /dev/null +++ b/queue-6.12/ext4-mark-group-extend-fast-commit-ineligible.patch @@ -0,0 +1,69 @@ +From 307d051a203be11df8b59b0b609a80f2518fa316 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 19:51:42 +0800 +Subject: ext4: mark group extend fast-commit ineligible + +From: Li Chen + +[ Upstream commit 1f8dd813a1c771b13c303f73d876164bc9b327cc ] + +Fast commits only log operations that have dedicated replay support. +EXT4_IOC_GROUP_EXTEND grows the filesystem to the end of the last +block group and updates the same on-disk metadata without going +through the fast commit tracking paths. +In practice these operations are rare and usually followed by further +updates, but mixing them into a fast commit makes the overall +semantics harder to reason about and risks replay gaps if new call +sites appear. + +Teach ext4 to mark the filesystem fast-commit ineligible when +EXT4_IOC_GROUP_EXTEND grows the filesystem. +This forces those transactions to fall back to a full commit, +ensuring that the group extension changes are captured by the normal +journal rather than partially encoded in fast commit TLVs. +This change should not affect common workloads but makes online +resize via GROUP_EXTEND safer and easier to reason about under fast +commit. + +Testing: +1. prepare: + dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256 + mkfs.ext4 -O fast_commit -F /root/fc_resize.img + mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize +2. Extended the filesystem to the end of the last block group using a + helper that calls EXT4_IOC_GROUP_EXTEND on the mounted filesystem + and checked fc_info: + ./group_extend_helper /mnt/fc_resize + cat /proc/fs/ext4/loop0/fc_info + shows the "Resize" ineligible reason increased. +3. Fsynced a file on the resized filesystem and confirmed that the fast + commit ineligible counter incremented for the resize transaction: + touch /mnt/fc_resize/file + /root/fsync_file /mnt/fc_resize/file + sync + cat /proc/fs/ext4/loop0/fc_info + +Signed-off-by: Li Chen +Link: https://patch.msgid.link/20251211115146.897420-6-me@linux.beauty +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/ioctl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c +index 9bfd0ccee6983..99d185d00f377 100644 +--- a/fs/ext4/ioctl.c ++++ b/fs/ext4/ioctl.c +@@ -1315,6 +1315,8 @@ static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) + + err = ext4_group_extend(sb, EXT4_SB(sb)->s_es, n_blocks_count); + if (EXT4_SB(sb)->s_journal) { ++ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE, ++ NULL); + jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal); + err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0); + jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal); +-- +2.51.0 + diff --git a/queue-6.12/ext4-move-ext4_percpu_param_init-before-ext4_mb_init.patch b/queue-6.12/ext4-move-ext4_percpu_param_init-before-ext4_mb_init.patch new file mode 100644 index 00000000000..865ac3a1aa9 --- /dev/null +++ b/queue-6.12/ext4-move-ext4_percpu_param_init-before-ext4_mb_init.patch @@ -0,0 +1,104 @@ +From 3e35338c66a45bbb14e2a148c3bf1b07894fc7c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Dec 2025 21:31:16 +0800 +Subject: ext4: move ext4_percpu_param_init() before ext4_mb_init() + +From: Baokun Li + +[ Upstream commit 270564513489d98b721a1e4a10017978d5213bff ] + +When running `kvm-xfstests -c ext4/1k -C 1 generic/383` with the +`DOUBLE_CHECK` macro defined, the following panic is triggered: + +================================================================== +EXT4-fs error (device vdc): ext4_validate_block_bitmap:423: + comm mount: bg 0: bad block bitmap checksum +BUG: unable to handle page fault for address: ff110000fa2cc000 +PGD 3e01067 P4D 3e02067 PUD 0 +Oops: Oops: 0000 [#1] SMP NOPTI +CPU: 0 UID: 0 PID: 2386 Comm: mount Tainted: G W + 6.18.0-gba65a4e7120a-dirty #1152 PREEMPT(none) +RIP: 0010:percpu_counter_add_batch+0x13/0xa0 +Call Trace: + + ext4_mark_group_bitmap_corrupted+0xcb/0xe0 + ext4_validate_block_bitmap+0x2a1/0x2f0 + ext4_read_block_bitmap+0x33/0x50 + mb_group_bb_bitmap_alloc+0x33/0x80 + ext4_mb_add_groupinfo+0x190/0x250 + ext4_mb_init_backend+0x87/0x290 + ext4_mb_init+0x456/0x640 + __ext4_fill_super+0x1072/0x1680 + ext4_fill_super+0xd3/0x280 + get_tree_bdev_flags+0x132/0x1d0 + vfs_get_tree+0x29/0xd0 + vfs_cmd_create+0x59/0xe0 + __do_sys_fsconfig+0x4f6/0x6b0 + do_syscall_64+0x50/0x1f0 + entry_SYSCALL_64_after_hwframe+0x76/0x7e +================================================================== + +This issue can be reproduced using the following commands: + mkfs.ext4 -F -q -b 1024 /dev/sda 5G + tune2fs -O quota,project /dev/sda + mount /dev/sda /tmp/test + +With DOUBLE_CHECK defined, mb_group_bb_bitmap_alloc() reads +and validates the block bitmap. When the validation fails, +ext4_mark_group_bitmap_corrupted() attempts to update +sbi->s_freeclusters_counter. However, this percpu_counter has not been +initialized yet at this point, which leads to the panic described above. + +Fix this by moving the execution of ext4_percpu_param_init() to occur +before ext4_mb_init(), ensuring the per-CPU counters are initialized +before they are used. + +Signed-off-by: Baokun Li +Reviewed-by: Zhang Yi +Reviewed-by: Jan Kara +Link: https://patch.msgid.link/20251209133116.731350-1-libaokun@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/super.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index d26a754bb9c83..9eec13f88d5a5 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -5534,6 +5534,10 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb) + clear_opt2(sb, MB_OPTIMIZE_SCAN); + } + ++ err = ext4_percpu_param_init(sbi); ++ if (err) ++ goto failed_mount5; ++ + err = ext4_mb_init(sb); + if (err) { + ext4_msg(sb, KERN_ERR, "failed to initialize mballoc (%d)", +@@ -5549,10 +5553,6 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb) + sbi->s_journal->j_commit_callback = + ext4_journal_commit_callback; + +- err = ext4_percpu_param_init(sbi); +- if (err) +- goto failed_mount6; +- + if (ext4_has_feature_flex_bg(sb)) + if (!ext4_fill_flex_info(sb)) { + ext4_msg(sb, KERN_ERR, +@@ -5632,8 +5632,8 @@ failed_mount8: __maybe_unused + failed_mount6: + ext4_mb_release(sb); + ext4_flex_groups_free(sbi); +- ext4_percpu_param_destroy(sbi); + failed_mount5: ++ ext4_percpu_param_destroy(sbi); + ext4_ext_release(sb); + ext4_release_system_zone(sb); + failed_mount4a: +-- +2.51.0 + diff --git a/queue-6.12/ext4-propagate-flags-to-convert_initialized_extent.patch b/queue-6.12/ext4-propagate-flags-to-convert_initialized_extent.patch new file mode 100644 index 00000000000..2bba30dfc7e --- /dev/null +++ b/queue-6.12/ext4-propagate-flags-to-convert_initialized_extent.patch @@ -0,0 +1,66 @@ +From de0351f4d98fdf08c79e69bfb96f2d8ac2ae07e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 11:55:35 +0530 +Subject: ext4: propagate flags to convert_initialized_extent() + +From: Ojaswin Mujoo + +[ Upstream commit 3fffa44b6ebf65be92a562a5063303979385a1c9 ] + +Currently, ext4_zero_range passes EXT4_EX_NOCACHE flag to avoid caching +extents however this is not respected by convert_initialized_extent(). +Hence, modify it to accept flags from the caller and to pass the flags +on to other extent manipulation functions it calls. This makes +sure the NOCACHE flag is respected throughout the code path. + +Also, we no longer explicitly pass CONVERT_UNWRITTEN as the caller takes +care of this. + +Reviewed-by: Zhang Yi +Reviewed-by: Jan Kara +Signed-off-by: Ojaswin Mujoo +Link: https://patch.msgid.link/07008fbb14db727fddcaf4c30e2346c49f6c8fe0.1769149131.git.ojaswin@linux.ibm.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/extents.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index da68c3726ddaf..b4ea8d3745a52 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -3816,6 +3816,7 @@ static struct ext4_ext_path * + convert_initialized_extent(handle_t *handle, struct inode *inode, + struct ext4_map_blocks *map, + struct ext4_ext_path *path, ++ int flags, + unsigned int *allocated) + { + struct ext4_extent *ex; +@@ -3841,11 +3842,11 @@ convert_initialized_extent(handle_t *handle, struct inode *inode, + + if (ee_block != map->m_lblk || ee_len > map->m_len) { + path = ext4_split_convert_extents(handle, inode, map, path, +- EXT4_GET_BLOCKS_CONVERT_UNWRITTEN, NULL); ++ flags, NULL); + if (IS_ERR(path)) + return path; + +- path = ext4_find_extent(inode, map->m_lblk, path, 0); ++ path = ext4_find_extent(inode, map->m_lblk, path, flags); + if (IS_ERR(path)) + return path; + depth = ext_depth(inode); +@@ -4257,7 +4258,7 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode, + if ((!ext4_ext_is_unwritten(ex)) && + (flags & EXT4_GET_BLOCKS_CONVERT_UNWRITTEN)) { + path = convert_initialized_extent(handle, +- inode, map, path, &allocated); ++ inode, map, path, flags, &allocated); + if (IS_ERR(path)) + err = PTR_ERR(path); + goto out; +-- +2.51.0 + diff --git a/queue-6.12/ext4-use-reserved-metadata-blocks-when-splitting-ext.patch b/queue-6.12/ext4-use-reserved-metadata-blocks-when-splitting-ext.patch new file mode 100644 index 00000000000..a5f8e26f26d --- /dev/null +++ b/queue-6.12/ext4-use-reserved-metadata-blocks-when-splitting-ext.patch @@ -0,0 +1,64 @@ +From 10a425bd24448013c7526eb1efc00190ea79561f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 09:45:16 +0800 +Subject: ext4: use reserved metadata blocks when splitting extent on endio + +From: Zhang Yi + +[ Upstream commit 01942af95ab6c9d98e64ae01fdc243a03e4b973f ] + +When performing buffered writes, we may need to split and convert an +unwritten extent into a written one during the end I/O process. However, +we do not reserve space specifically for these metadata changes, we only +reserve 2% of space or 4096 blocks. To address this, we use +EXT4_GET_BLOCKS_PRE_IO to potentially split extents in advance and +EXT4_GET_BLOCKS_METADATA_NOFAIL to utilize reserved space if necessary. + +These two approaches can reduce the likelihood of running out of space +and losing data. However, these methods are merely best efforts, we +could still run out of space, and there is not much difference between +converting an extent during the writeback process and the end I/O +process, it won't increase the risk of losing data if we postpone the +conversion. + +Therefore, also use EXT4_GET_BLOCKS_METADATA_NOFAIL in +ext4_convert_unwritten_extents_endio() to prepare for the buffered I/O +iomap conversion, which may perform extent conversion during the end I/O +process. + +Signed-off-by: Zhang Yi +Reviewed-by: Jan Kara +Reviewed-by: Baokun Li +Reviewed-by: Ojaswin Mujoo +Link: https://patch.msgid.link/20260105014522.1937690-2-yi.zhang@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/extents.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 2f9c3cd4f26cc..da68c3726ddaf 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -3768,6 +3768,8 @@ ext4_convert_unwritten_extents_endio(handle_t *handle, struct inode *inode, + * illegal. + */ + if (ee_block != map->m_lblk || ee_len > map->m_len) { ++ int flags = EXT4_GET_BLOCKS_CONVERT | ++ EXT4_GET_BLOCKS_METADATA_NOFAIL; + #ifdef CONFIG_EXT4_DEBUG + ext4_warning(inode->i_sb, "Inode (%ld) finished: extent logical block %llu," + " len %u; IO logical block %llu, len %u", +@@ -3775,7 +3777,7 @@ ext4_convert_unwritten_extents_endio(handle_t *handle, struct inode *inode, + (unsigned long long)map->m_lblk, map->m_len); + #endif + path = ext4_split_convert_extents(handle, inode, map, path, +- EXT4_GET_BLOCKS_CONVERT, NULL); ++ flags, NULL); + if (IS_ERR(path)) + return path; + +-- +2.51.0 + diff --git a/queue-6.12/firmware-arm_ffa-unmap-rx-tx-buffers-on-init-failure.patch b/queue-6.12/firmware-arm_ffa-unmap-rx-tx-buffers-on-init-failure.patch new file mode 100644 index 00000000000..58c76e3c310 --- /dev/null +++ b/queue-6.12/firmware-arm_ffa-unmap-rx-tx-buffers-on-init-failure.patch @@ -0,0 +1,39 @@ +From 7aa9d8559190316b117133bc8284378f623d6aea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Dec 2025 11:16:56 +0800 +Subject: firmware: arm_ffa: Unmap Rx/Tx buffers on init failure + +From: Haoxiang Li + +[ Upstream commit 9fda364cb78c8b9e1abe4029f877300c94655742 ] + +ffa_init() maps the Rx/Tx buffers via ffa_rxtx_map() but on the +partition setup failure path it never unmaps them. + +Add the missing ffa_rxtx_unmap() call in the error path so that +the Rx/Tx buffers are properly released before freeing the backing +pages. + +Signed-off-by: Haoxiang Li +Message-Id: <20251210031656.56194-1-lihaoxiang@isrc.iscas.ac.cn> +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_ffa/driver.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c +index 7e486e49d1eed..9516ee870cd25 100644 +--- a/drivers/firmware/arm_ffa/driver.c ++++ b/drivers/firmware/arm_ffa/driver.c +@@ -1832,6 +1832,7 @@ static int __init ffa_init(void) + + cleanup_notifs: + ffa_notifications_cleanup(); ++ ffa_rxtx_unmap(drv_info->vm_id); + free_pages: + if (drv_info->tx_buffer) + free_pages_exact(drv_info->tx_buffer, rxtx_bufsz); +-- +2.51.0 + diff --git a/queue-6.12/fix-it87_wdt-early-reboot-by-reporting-running-timer.patch b/queue-6.12/fix-it87_wdt-early-reboot-by-reporting-running-timer.patch new file mode 100644 index 00000000000..f5eaa2fa79f --- /dev/null +++ b/queue-6.12/fix-it87_wdt-early-reboot-by-reporting-running-timer.patch @@ -0,0 +1,60 @@ +From 3cf8535b0c7904c628b50a51c071806d4d09ae74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 13:11:24 +0100 +Subject: fix it87_wdt early reboot by reporting running timer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: René Rebe + +[ Upstream commit 88b2ab346436f799b99894a3e9518a3ffa344524 ] + +Some products, such as the Ugreen DXP4800 Plus NAS, ship with the it87 +wdt enabled by the firmware and a broken BIOS option that does not +allow to change the time or turn it off. As this makes installing +Linux rather difficult, change the it87_wdt to report it running to +the watchdog core. + +Signed-off-by: René Rebe +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/it87_wdt.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/watchdog/it87_wdt.c b/drivers/watchdog/it87_wdt.c +index 1a5a0a2c3f2e3..8c42cb41fa230 100644 +--- a/drivers/watchdog/it87_wdt.c ++++ b/drivers/watchdog/it87_wdt.c +@@ -186,6 +186,12 @@ static void _wdt_update_timeout(unsigned int t) + superio_outb(t >> 8, WDTVALMSB); + } + ++/* Internal function, should be called after superio_select(GPIO) */ ++static bool _wdt_running(void) ++{ ++ return superio_inb(WDTVALLSB) || (max_units > 255 && superio_inb(WDTVALMSB)); ++} ++ + static int wdt_update_timeout(unsigned int t) + { + int ret; +@@ -372,6 +378,12 @@ static int __init it87_wdt_init(void) + } + } + ++ /* wdt already left running by firmware? */ ++ if (_wdt_running()) { ++ pr_info("Left running by firmware.\n"); ++ set_bit(WDOG_HW_RUNNING, &wdt_dev.status); ++ } ++ + superio_exit(); + + if (timeout < 1 || timeout > max_units * 60) { +-- +2.51.0 + diff --git a/queue-6.12/fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch b/queue-6.12/fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch new file mode 100644 index 00000000000..547b6b86109 --- /dev/null +++ b/queue-6.12/fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch @@ -0,0 +1,58 @@ +From 040616bf37a64fb9633109ab71bed474533c3f80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Nov 2025 16:58:48 +0100 +Subject: fpga: of-fpga-region: Fail if any bridge is missing + +From: Romain Gantois + +[ Upstream commit c141c8221bc5089de915d9f26044df892c343c7e ] + +When parsing the region bridge list from the "fpga-bridges" device tree +property, the of-fpga-region driver will silently ignore bridges which fail +to be obtained, for example due to a missing bridge driver or invalid +phandle. + +This can lead to hardware issues if a region bridge stays coupled when +partial programming is performed. + +Fail if any of the bridges specified in "fpga-bridges" cannot be obtained. + +Signed-off-by: Romain Gantois +Link: https://lore.kernel.org/r/20251127-of-fpga-region-fail-if-bridges-not-found-v1-1-ca674f8d07eb@bootlin.com +Reviewed-by: Xu Yilun +Signed-off-by: Xu Yilun +Signed-off-by: Sasha Levin +--- + drivers/fpga/of-fpga-region.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/fpga/of-fpga-region.c b/drivers/fpga/of-fpga-region.c +index 8526a5a86f0cb..efc35dad6aaa3 100644 +--- a/drivers/fpga/of-fpga-region.c ++++ b/drivers/fpga/of-fpga-region.c +@@ -83,7 +83,7 @@ static struct fpga_manager *of_fpga_region_get_mgr(struct device_node *np) + * done with the bridges. + * + * Return: 0 for success (even if there are no bridges specified) +- * or -EBUSY if any of the bridges are in use. ++ * or an error code if any of the bridges are not available. + */ + static int of_fpga_region_get_bridges(struct fpga_region *region) + { +@@ -130,10 +130,10 @@ static int of_fpga_region_get_bridges(struct fpga_region *region) + ®ion->bridge_list); + of_node_put(br); + +- /* If any of the bridges are in use, give up */ +- if (ret == -EBUSY) { ++ /* If any of the bridges are not available, give up */ ++ if (ret) { + fpga_bridges_put(®ion->bridge_list); +- return -EBUSY; ++ return ret; + } + } + +-- +2.51.0 + diff --git a/queue-6.12/fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch b/queue-6.12/fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch new file mode 100644 index 00000000000..fd57a68a065 --- /dev/null +++ b/queue-6.12/fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch @@ -0,0 +1,50 @@ +From 6b8277469e4dc089b221899204c544b1b7581eb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 18:42:11 +0530 +Subject: fs/buffer: add alert in try_to_free_buffers() for folios without + buffers + +From: Deepakkumar Karn + +[ Upstream commit b68f91ef3b3fe82ad78c417de71b675699a8467c ] + +try_to_free_buffers() can be called on folios with no buffers attached +when filemap_release_folio() is invoked on a folio belonging to a mapping +with AS_RELEASE_ALWAYS set but no release_folio operation defined. + +In such cases, folio_needs_release() returns true because of the +AS_RELEASE_ALWAYS flag, but the folio has no private buffer data. This +causes try_to_free_buffers() to call drop_buffers() on a folio with no +buffers, leading to a null pointer dereference. + +Adding a check in try_to_free_buffers() to return early if the folio has no +buffers attached, with WARN_ON_ONCE() to alert about the misconfiguration. +This provides defensive hardening. + +Signed-off-by: Deepakkumar Karn +Link: https://patch.msgid.link/20251211131211.308021-1-dkarn@redhat.com +Reviewed-by: Jan Kara +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/buffer.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/buffer.c b/fs/buffer.c +index 79c19ffa44015..c5aaf1419d341 100644 +--- a/fs/buffer.c ++++ b/fs/buffer.c +@@ -2968,6 +2968,10 @@ bool try_to_free_buffers(struct folio *folio) + if (folio_test_writeback(folio)) + return false; + ++ /* Misconfigured folio check */ ++ if (WARN_ON_ONCE(!folio_buffers(folio))) ++ return true; ++ + if (mapping == NULL) { /* can this still happen? */ + ret = drop_buffers(folio, &buffers_to_free); + goto out; +-- +2.51.0 + diff --git a/queue-6.12/fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch b/queue-6.12/fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch new file mode 100644 index 00000000000..2e6393a390b --- /dev/null +++ b/queue-6.12/fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch @@ -0,0 +1,45 @@ +From 83e40040dbc00cb069932b45c02e2fcc3368dc8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 16:07:32 +0100 +Subject: fs/ntfs3: avoid calling run_get_entry() when run == NULL in + ntfs_read_run_nb_ra() + +From: Konstantin Komarov + +[ Upstream commit c5226b96c08a010ebef5fdf4c90572bcd89e4299 ] + +When ntfs_read_run_nb_ra() is invoked with run == NULL the code later +assumes run is valid and may call run_get_entry(NULL, ...), and also +uses clen/idx without initializing them. Smatch reported uninitialized +variable warnings and this can lead to undefined behaviour. This patch +fixes it. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202512230646.v5hrYXL0-lkp@intel.com/ +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/fsntfs.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c +index 57933576212bb..37c5d9a1f77b7 100644 +--- a/fs/ntfs3/fsntfs.c ++++ b/fs/ntfs3/fsntfs.c +@@ -1276,6 +1276,12 @@ int ntfs_read_run_nb(struct ntfs_sb_info *sbi, const struct runs_tree *run, + + } while (len32); + ++ if (!run) { ++ err = -EINVAL; ++ goto out; ++ } ++ ++ /* Get next fragment to read. */ + vcn_next = vcn + clen; + if (!run_get_entry(run, ++idx, &vcn, &lcn, &clen) || + vcn != vcn_next) { +-- +2.51.0 + diff --git a/queue-6.12/fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch b/queue-6.12/fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch new file mode 100644 index 00000000000..92180bd4094 --- /dev/null +++ b/queue-6.12/fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch @@ -0,0 +1,58 @@ +From 415ccad2fb66aee3229788b8ff96c64ee9593090 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 19:59:59 +0900 +Subject: fs: ntfs3: check return value of indx_find to avoid infinite loop + +From: Jaehun Gou + +[ Upstream commit 1732053c8a6b360e2d5afb1b34fe9779398b072c ] + +We found an infinite loop bug in the ntfs3 file system that can lead to a +Denial-of-Service (DoS) condition. + +A malformed dentry in the ntfs3 filesystem can cause the kernel to hang +during the lookup operations. By setting the HAS_SUB_NODE flag in an +INDEX_ENTRY within a directory's INDEX_ALLOCATION block and manipulating the +VCN pointer, an attacker can cause the indx_find() function to repeatedly +read the same block, allocating 4 KB of memory each time. The kernel lacks +VCN loop detection and depth limits, causing memory exhaustion and an OOM +crash. + +This patch adds a return value check for fnd_push() to prevent a memory +exhaustion vulnerability caused by infinite loops. When the index exceeds the +size of the fnd->nodes array, fnd_push() returns -EINVAL. The indx_find() +function checks this return value and stops processing, preventing further +memory allocation. + +Co-developed-by: Seunghun Han +Signed-off-by: Seunghun Han +Co-developed-by: Jihoon Kwon +Signed-off-by: Jihoon Kwon +Signed-off-by: Jaehun Gou +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/index.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c +index 6d1bf890929d9..050b3709e0204 100644 +--- a/fs/ntfs3/index.c ++++ b/fs/ntfs3/index.c +@@ -1190,7 +1190,12 @@ int indx_find(struct ntfs_index *indx, struct ntfs_inode *ni, + return -EINVAL; + } + +- fnd_push(fnd, node, e); ++ err = fnd_push(fnd, node, e); ++ ++ if (err) { ++ put_indx_node(node); ++ return err; ++ } + } + + *entry = e; +-- +2.51.0 + diff --git a/queue-6.12/fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch b/queue-6.12/fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch new file mode 100644 index 00000000000..2b5fb5b03d2 --- /dev/null +++ b/queue-6.12/fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch @@ -0,0 +1,38 @@ +From f17337fa99c6c49aa49d8370ce5528dc17c748fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Dec 2025 14:27:48 +0300 +Subject: fs/ntfs3: drop preallocated clusters for sparse and compressed files + +From: Konstantin Komarov + +[ Upstream commit 3a6aba7f3cf2b46816e08548c254d98de9c74eba ] + +Do not keep preallocated clusters for sparsed and compressed files. +Preserving preallocation in these cases causes fsx failures when running +with sparse files and preallocation enabled. + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index 873d14a5174a9..4390c0e4bfb78 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -448,8 +448,10 @@ int attr_set_size(struct ntfs_inode *ni, enum ATTR_TYPE type, + + is_ext = is_attr_ext(attr_b); + align = sbi->cluster_size; +- if (is_ext) ++ if (is_ext) { + align <<= attr_b->nres.c_unit; ++ keep_prealloc = false; ++ } + + old_valid = le64_to_cpu(attr_b->nres.valid_size); + old_size = le64_to_cpu(attr_b->nres.data_size); +-- +2.51.0 + diff --git a/queue-6.12/fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch b/queue-6.12/fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch new file mode 100644 index 00000000000..9993c6573ef --- /dev/null +++ b/queue-6.12/fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch @@ -0,0 +1,83 @@ +From 292dc6ccfd914e137ed20b58f5f2e1bdf9283d9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 20:01:09 +0900 +Subject: fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent + metadata + +From: Jaehun Gou + +[ Upstream commit 4b90f16e4bb5607fb35e7802eb67874038da4640 ] + +We found an infinite loop bug in the ntfs3 file system that can lead to a +Denial-of-Service (DoS) condition. + +A malformed NTFS image can cause an infinite loop when an attribute header +indicates an empty run list, while directory entries reference it as +containing actual data. In NTFS, setting evcn=-1 with svcn=0 is a valid way +to represent an empty run list, and run_unpack() correctly handles this by +checking if evcn + 1 equals svcn and returning early without parsing any run +data. However, this creates a problem when there is metadata inconsistency, +where the attribute header claims to be empty (evcn=-1) but the caller +expects to read actual data. When run_unpack() immediately returns success +upon seeing this condition, it leaves the runs_tree uninitialized with +run->runs as a NULL. The calling function attr_load_runs_range() assumes +that a successful return means that the runs were loaded and sets clen to 0, +expecting the next run_lookup_entry() call to succeed. Because runs_tree +remains uninitialized, run_lookup_entry() continues to fail, and the loop +increments vcn by zero (vcn += 0), leading to an infinite loop. + +This patch adds a retry counter to detect when run_lookup_entry() fails +consecutively after attr_load_runs_vcn(). If the run is still not found on +the second attempt, it indicates corrupted metadata and returns -EINVAL, +preventing the Denial-of-Service (DoS) vulnerability. + +Co-developed-by: Seunghun Han +Signed-off-by: Seunghun Han +Co-developed-by: Jihoon Kwon +Signed-off-by: Jihoon Kwon +Signed-off-by: Jaehun Gou +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index dd459316529e8..873d14a5174a9 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -1353,19 +1353,28 @@ int attr_load_runs_range(struct ntfs_inode *ni, enum ATTR_TYPE type, + CLST vcn; + CLST vcn_last = (to - 1) >> cluster_bits; + CLST lcn, clen; +- int err; ++ int err = 0; ++ int retry = 0; + + for (vcn = from >> cluster_bits; vcn <= vcn_last; vcn += clen) { + if (!run_lookup_entry(run, vcn, &lcn, &clen, NULL)) { ++ if (retry != 0) { /* Next run_lookup_entry(vcn) also failed. */ ++ err = -EINVAL; ++ break; ++ } + err = attr_load_runs_vcn(ni, type, name, name_len, run, + vcn); + if (err) +- return err; ++ break; ++ + clen = 0; /* Next run_lookup_entry(vcn) must be success. */ ++ retry++; + } ++ else ++ retry = 0; + } + +- return 0; ++ return err; + } + + #ifdef CONFIG_NTFS3_LZX_XPRESS +-- +2.51.0 + diff --git a/queue-6.12/fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch b/queue-6.12/fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch new file mode 100644 index 00000000000..c40663cb772 --- /dev/null +++ b/queue-6.12/fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch @@ -0,0 +1,68 @@ +From 12e04e20b3275c64e59fea4f113d45756188ce1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 20:01:46 +0900 +Subject: fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST + +From: Jaehun Gou + +[ Upstream commit 06909b2549d631a47fcda249d34be26f7ca1711d ] + +We found an infinite loop bug in the ntfs3 file system that can lead to a +Denial-of-Service (DoS) condition. + +A malformed NTFS image can cause an infinite loop when an ATTR_LIST attribute +indicates a zero data size while the driver allocates memory for it. + +When ntfs_load_attr_list() processes a resident ATTR_LIST with data_size set +to zero, it still allocates memory because of al_aligned(0). This creates an +inconsistent state where ni->attr_list.size is zero, but ni->attr_list.le is +non-null. This causes ni_enum_attr_ex to incorrectly assume that no attribute +list exists and enumerates only the primary MFT record. When it finds +ATTR_LIST, the code reloads it and restarts the enumeration, repeating +indefinitely. The mount operation never completes, hanging the kernel thread. + +This patch adds validation to ensure that data_size is non-zero before memory +allocation. When a zero-sized ATTR_LIST is detected, the function returns +-EINVAL, preventing a DoS vulnerability. + +Co-developed-by: Seunghun Han +Signed-off-by: Seunghun Han +Co-developed-by: Jihoon Kwon +Signed-off-by: Jihoon Kwon +Signed-off-by: Jaehun Gou +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrlist.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/fs/ntfs3/attrlist.c b/fs/ntfs3/attrlist.c +index a4d74bed74fab..098bd7e8c3d64 100644 +--- a/fs/ntfs3/attrlist.c ++++ b/fs/ntfs3/attrlist.c +@@ -52,6 +52,11 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr) + + if (!attr->non_res) { + lsize = le32_to_cpu(attr->res.data_size); ++ if (!lsize) { ++ err = -EINVAL; ++ goto out; ++ } ++ + /* attr is resident: lsize < record_size (1K or 4K) */ + le = kvmalloc(al_aligned(lsize), GFP_KERNEL); + if (!le) { +@@ -66,6 +71,10 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr) + u16 run_off = le16_to_cpu(attr->nres.run_off); + + lsize = le64_to_cpu(attr->nres.data_size); ++ if (!lsize) { ++ err = -EINVAL; ++ goto out; ++ } + + run_init(&ni->attr_list.run); + +-- +2.51.0 + diff --git a/queue-6.12/gfs2-fiemap-page-fault-fix.patch b/queue-6.12/gfs2-fiemap-page-fault-fix.patch new file mode 100644 index 00000000000..c10b964b912 --- /dev/null +++ b/queue-6.12/gfs2-fiemap-page-fault-fix.patch @@ -0,0 +1,69 @@ +From fff23144e4666d4e493e01dcd4be7ee5b29f8645 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Feb 2026 15:52:57 +0100 +Subject: gfs2: fiemap page fault fix + +From: Andreas Gruenbacher + +[ Upstream commit e411d74cc5ba290f85d0dd5e4d1df8f1d6d975d2 ] + +In gfs2_fiemap(), we are calling iomap_fiemap() while holding the inode +glock. This can lead to recursive glock taking if the fiemap buffer is +memory mapped to the same inode and accessing it triggers a page fault. + +Fix by disabling page faults for iomap_fiemap() and faulting in the +buffer by hand if necessary. + +Fixes xfstest generic/742. + +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/inode.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c +index c8a59bc1714bf..c37079718fdd5 100644 +--- a/fs/gfs2/inode.c ++++ b/fs/gfs2/inode.c +@@ -2201,6 +2201,14 @@ static int gfs2_getattr(struct mnt_idmap *idmap, + return 0; + } + ++static bool fault_in_fiemap(struct fiemap_extent_info *fi) ++{ ++ struct fiemap_extent __user *dest = fi->fi_extents_start; ++ size_t size = sizeof(*dest) * fi->fi_extents_max; ++ ++ return fault_in_safe_writeable((char __user *)dest, size) == 0; ++} ++ + static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, + u64 start, u64 len) + { +@@ -2210,14 +2218,22 @@ static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, + + inode_lock_shared(inode); + ++retry: + ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_SHARED, 0, &gh); + if (ret) + goto out; + ++ pagefault_disable(); + ret = iomap_fiemap(inode, fieinfo, start, len, &gfs2_iomap_ops); ++ pagefault_enable(); + + gfs2_glock_dq_uninit(&gh); + ++ if (ret == -EFAULT && fault_in_fiemap(fieinfo)) { ++ fieinfo->fi_extents_mapped = 0; ++ goto retry; ++ } ++ + out: + inode_unlock_shared(inode); + return ret; +-- +2.51.0 + diff --git a/queue-6.12/gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch b/queue-6.12/gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch new file mode 100644 index 00000000000..0749247458b --- /dev/null +++ b/queue-6.12/gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch @@ -0,0 +1,56 @@ +From 7ebc7819dcf03adc9e15323a77f9d7f7951d1a29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 17:26:26 +0800 +Subject: gpio: aspeed-sgpio: Change the macro to support deferred probe + +From: Billy Tsai + +[ Upstream commit e18533b023ec7a33488bcf33140ce69bbba2894f ] + +Use module_platform_driver() to replace module_platform_driver_probe(). +The former utilizes platform_driver_register(), which allows the driver to +defer probing when it doesn't acquire the necessary resources due to probe +order. In contrast, the latter uses __platform_driver_probe(), which +includes the comment "Note that this is incompatible with deferred +probing." Since our SGPIO driver requires access to the clock resource, the +former is more suitable. + +Reviewed-by: Linus Walleij +Signed-off-by: Billy Tsai +Link: https://lore.kernel.org/r/20260123-upstream_sgpio-v2-1-69cfd1631400@aspeedtech.com +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-aspeed-sgpio.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpio/gpio-aspeed-sgpio.c b/drivers/gpio/gpio-aspeed-sgpio.c +index 72755fee64784..e69a6ce7be3fb 100644 +--- a/drivers/gpio/gpio-aspeed-sgpio.c ++++ b/drivers/gpio/gpio-aspeed-sgpio.c +@@ -534,7 +534,7 @@ static const struct of_device_id aspeed_sgpio_of_table[] = { + + MODULE_DEVICE_TABLE(of, aspeed_sgpio_of_table); + +-static int __init aspeed_sgpio_probe(struct platform_device *pdev) ++static int aspeed_sgpio_probe(struct platform_device *pdev) + { + u32 nr_gpios, sgpio_freq, sgpio_clk_div, gpio_cnt_regval, pin_mask; + const struct aspeed_sgpio_pdata *pdata; +@@ -629,11 +629,12 @@ static int __init aspeed_sgpio_probe(struct platform_device *pdev) + } + + static struct platform_driver aspeed_sgpio_driver = { ++ .probe = aspeed_sgpio_probe, + .driver = { + .name = KBUILD_MODNAME, + .of_match_table = aspeed_sgpio_of_table, + }, + }; + +-module_platform_driver_probe(aspeed_sgpio_driver, aspeed_sgpio_probe); ++module_platform_driver(aspeed_sgpio_driver); + MODULE_DESCRIPTION("Aspeed Serial GPIO Driver"); +-- +2.51.0 + diff --git a/queue-6.12/gpu-panel-edp-add-auo-panel-entry-for-b140han06.4.patch b/queue-6.12/gpu-panel-edp-add-auo-panel-entry-for-b140han06.4.patch new file mode 100644 index 00000000000..22820d0af9e --- /dev/null +++ b/queue-6.12/gpu-panel-edp-add-auo-panel-entry-for-b140han06.4.patch @@ -0,0 +1,53 @@ +From 161ee904752a18544c9d714f2ed6845d1807374c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Dec 2025 07:45:55 +0000 +Subject: gpu/panel-edp: add AUO panel entry for B140HAN06.4 + +From: Alexey Klimov + +[ Upstream commit 2976aeb0de77da599ad37691963efbdcb07435ce ] + +Add an eDP panel entry for AUO B140HAN06.4 that is also used in +some variants of Lenovo Flex 5G with Qcom SC8180 SoC. + +The raw edid of the panel is: + +00 ff ff ff ff ff ff 00 06 af 3d 64 00 00 00 00 +2b 1d 01 04 a5 1f 11 78 03 b8 1a a6 54 4a 9b 26 +0e 52 55 00 00 00 01 01 01 01 01 01 01 01 01 01 +01 01 01 01 01 01 14 37 80 b8 70 38 24 40 10 10 +3e 00 35 ae 10 00 00 18 10 2c 80 b8 70 38 24 40 +10 10 3e 00 35 ae 10 00 00 18 00 00 00 fe 00 41 +55 4f 0a 20 20 20 20 20 20 20 20 20 00 00 00 fe +00 42 31 34 30 48 41 4e 30 36 2e 34 20 0a 00 eb + +I do not have access to the datasheet and but it is tested on above +mentioned laptop for a few weeks and seems to work just fine with +timing info of similar panels. + +Cc: Bjorn Andersson +Cc: Vinod Koul +Signed-off-by: Alexey Klimov +Reviewed-by: Douglas Anderson +Signed-off-by: Douglas Anderson +Link: https://patch.msgid.link/20251203074555.690613-1-alexey.klimov@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-edp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c +index 663af985d1b38..d6806956f63e9 100644 +--- a/drivers/gpu/drm/panel/panel-edp.c ++++ b/drivers/gpu/drm/panel/panel-edp.c +@@ -1852,6 +1852,7 @@ static const struct edp_panel_entry edp_panels[] = { + EDP_PANEL_ENTRY('A', 'U', 'O', 0x615c, &delay_200_500_e50, "B116XAN06.1"), + EDP_PANEL_ENTRY('A', 'U', 'O', 0x635c, &delay_200_500_e50, "B116XAN06.3"), + EDP_PANEL_ENTRY('A', 'U', 'O', 0x639c, &delay_200_500_e50, "B140HAK02.7"), ++ EDP_PANEL_ENTRY('A', 'U', 'O', 0x643d, &delay_200_500_e50, "B140HAN06.4"), + EDP_PANEL_ENTRY('A', 'U', 'O', 0x723c, &delay_200_500_e50, "B140XTN07.2"), + EDP_PANEL_ENTRY('A', 'U', 'O', 0x73aa, &delay_200_500_e50, "B116XTN02.3"), + EDP_PANEL_ENTRY('A', 'U', 'O', 0x8594, &delay_200_500_e50, "B133UAN01.0"), +-- +2.51.0 + diff --git a/queue-6.12/gro-change-the-bug_on-in-gro_pull_from_frag0.patch b/queue-6.12/gro-change-the-bug_on-in-gro_pull_from_frag0.patch new file mode 100644 index 00000000000..5597ee17b21 --- /dev/null +++ b/queue-6.12/gro-change-the-bug_on-in-gro_pull_from_frag0.patch @@ -0,0 +1,46 @@ +From 28a0e1486412fa0e7c4bb0240b0b90983db4d4f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 04:57:17 +0000 +Subject: gro: change the BUG_ON() in gro_pull_from_frag0() + +From: Eric Dumazet + +[ Upstream commit cbe41362be2c27e0237a94a404ae413cec9c2ad9 ] + +Replace the BUG_ON() which never fired with a DEBUG_NET_WARN_ON_ONCE() + +$ scripts/bloat-o-meter -t vmlinux.1 vmlinux.2 +add/remove: 2/2 grow/shrink: 1/1 up/down: 370/-254 (116) +Function old new delta +gro_try_pull_from_frag0 - 196 +196 +napi_gro_frags 771 929 +158 +__pfx_gro_try_pull_from_frag0 - 16 +16 +__pfx_gro_pull_from_frag0 16 - -16 +dev_gro_receive 1514 1464 -50 +gro_pull_from_frag0 188 - -188 +Total: Before=22565899, After=22566015, chg +0.00% + +Signed-off-by: Eric Dumazet +Link: https://patch.msgid.link/20260122045720.1221017-3-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/gro.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/gro.c b/net/core/gro.c +index 40aaac4e04f34..ac498c9f82cf5 100644 +--- a/net/core/gro.c ++++ b/net/core/gro.c +@@ -416,7 +416,7 @@ static void gro_pull_from_frag0(struct sk_buff *skb, int grow) + { + struct skb_shared_info *pinfo = skb_shinfo(skb); + +- BUG_ON(skb->end - skb->tail < grow); ++ DEBUG_NET_WARN_ON_ONCE(skb->end - skb->tail < grow); + + memcpy(skb_tail_pointer(skb), NAPI_GRO_CB(skb)->frag0, grow); + +-- +2.51.0 + diff --git a/queue-6.12/hfsplus-fix-volume-corruption-issue-for-generic-498.patch b/queue-6.12/hfsplus-fix-volume-corruption-issue-for-generic-498.patch new file mode 100644 index 00000000000..0ad3c2a2572 --- /dev/null +++ b/queue-6.12/hfsplus-fix-volume-corruption-issue-for-generic-498.patch @@ -0,0 +1,150 @@ +From fa17d61a509260ea2764450ade51ccf9f9f2ee60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Dec 2025 19:58:22 -0800 +Subject: hfsplus: fix volume corruption issue for generic/498 + +From: Viacheslav Dubeyko + +[ Upstream commit 9a8c4ad44721da4c48e1ff240ac76286c82837fe ] + +The xfstests' test-case generic/498 leaves HFS+ volume +in corrupted state: + +sudo ./check generic/498 +FSTYP -- hfsplus +PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #18 SMP PREEMPT_DYNAMIC Thu Dec 4 12:24:45 PST 2025 +MKFS_OPTIONS -- /dev/loop51 +MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch + +generic/498 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent +(see XFSTESTS-2/xfstests-dev/results//generic/498.full for details) + +Ran: generic/498 +Failures: generic/498 +Failed 1 of 1 tests + +sudo fsck.hfsplus -d /dev/loop51 +** /dev/loop51 +Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K. +Executing fsck_hfs (version 540.1-Linux). +** Checking non-journaled HFS Plus Volume. +The volume name is untitled +** Checking extents overflow file. +** Checking catalog file. +Invalid leaf record count +(It should be 16 instead of 2) +** Checking multi-linked files. +CheckHardLinks: found 1 pre-Leopard file inodes. +** Checking catalog hierarchy. +** Checking extended attributes file. +** Checking volume bitmap. +** Checking volume information. +Verify Status: VIStat = 0x0000, ABTStat = 0x0000 EBTStat = 0x0000 +CBTStat = 0x8000 CatStat = 0x00000000 +** Repairing volume. +** Rechecking volume. +** Checking non-journaled HFS Plus Volume. +The volume name is untitled +** Checking extents overflow file. +** Checking catalog file. +** Checking multi-linked files. +CheckHardLinks: found 1 pre-Leopard file inodes. +** Checking catalog hierarchy. +** Checking extended attributes file. +** Checking volume bitmap. +** Checking volume information. +** The volume untitled was repaired successfully. + +The generic/498 test executes such steps on final phase: + +mkdir $SCRATCH_MNT/A +mkdir $SCRATCH_MNT/B +mkdir $SCRATCH_MNT/A/C +touch $SCRATCH_MNT/B/foo +$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/B/foo + +ln $SCRATCH_MNT/B/foo $SCRATCH_MNT/A/C/foo +$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/A + +"Simulate a power failure and mount the filesystem +to check that what we explicitly fsync'ed exists." + +_flakey_drop_and_remount + +The FSCK tool complains about "Invalid leaf record count". +HFS+ b-tree header contains leaf_count field is updated +by hfs_brec_insert() and hfs_brec_remove(). The hfs_brec_insert() +is involved into hard link creation process. However, +modified in-core leaf_count field is stored into HFS+ +b-tree header by hfs_btree_write() method. But, +unfortunately, hfs_btree_write() hasn't been called +by hfsplus_cat_write_inode() and hfsplus_file_fsync() +stores not fully consistent state of the Catalog File's +b-tree. + +This patch adds calling hfs_btree_write() method in +the hfsplus_cat_write_inode() with the goal of +storing consistent state of Catalog File's b-tree. +Finally, it makes FSCK tool happy. + +sudo ./check generic/498 +FSTYP -- hfsplus +PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #22 SMP PREEMPT_DYNAMIC Sat Dec 6 17:01:31 PST 2025 +MKFS_OPTIONS -- /dev/loop51 +MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch + +generic/498 33s ... 31s +Ran: generic/498 +Passed all 1 tests + +Signed-off-by: Viacheslav Dubeyko +cc: John Paul Adrian Glaubitz +cc: Yangtao Li +cc: linux-fsdevel@vger.kernel.org +Link: https://lore.kernel.org/r/20251207035821.3863657-1-slava@dubeyko.com +Signed-off-by: Viacheslav Dubeyko +Signed-off-by: Sasha Levin +--- + fs/hfsplus/inode.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c +index 2d68c52f894f9..3f64f68d625c1 100644 +--- a/fs/hfsplus/inode.c ++++ b/fs/hfsplus/inode.c +@@ -601,6 +601,7 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd) + int hfsplus_cat_write_inode(struct inode *inode) + { + struct inode *main_inode = inode; ++ struct hfs_btree *tree = HFSPLUS_SB(inode->i_sb)->cat_tree; + struct hfs_find_data fd; + hfsplus_cat_entry entry; + int res = 0; +@@ -611,7 +612,7 @@ int hfsplus_cat_write_inode(struct inode *inode) + if (!main_inode->i_nlink) + return 0; + +- if (hfs_find_init(HFSPLUS_SB(main_inode->i_sb)->cat_tree, &fd)) ++ if (hfs_find_init(tree, &fd)) + /* panic? */ + return -EIO; + +@@ -676,6 +677,15 @@ int hfsplus_cat_write_inode(struct inode *inode) + set_bit(HFSPLUS_I_CAT_DIRTY, &HFSPLUS_I(inode)->flags); + out: + hfs_find_exit(&fd); ++ ++ if (!res) { ++ res = hfs_btree_write(tree); ++ if (res) { ++ pr_err("b-tree write err: %d, ino %lu\n", ++ res, inode->i_ino); ++ } ++ } ++ + return res; + } + +-- +2.51.0 + diff --git a/queue-6.12/hfsplus-pretend-special-inodes-as-regular-files.patch b/queue-6.12/hfsplus-pretend-special-inodes-as-regular-files.patch new file mode 100644 index 00000000000..beb634a6334 --- /dev/null +++ b/queue-6.12/hfsplus-pretend-special-inodes-as-regular-files.patch @@ -0,0 +1,45 @@ +From a5b42a499f88eab116840c91cdb1e7b59eef0708 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 18:39:33 +0900 +Subject: hfsplus: pretend special inodes as regular files + +From: Tetsuo Handa + +[ Upstream commit ed8889ca21b6ab37bc1435c4009ce37a79acb9e6 ] + +Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()") +requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/ +S_IFIFO/S_IFSOCK type, use S_IFREG for special inodes. + +Reported-by: syzbot +Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d +Signed-off-by: Tetsuo Handa +Reviewed-by: Viacheslav Dubeyko +Signed-off-by: Viacheslav Dubeyko +Link: https://lore.kernel.org/r/d0a07b1b-8b73-4002-8e29-e2bd56871262@I-love.SAKURA.ne.jp +Signed-off-by: Viacheslav Dubeyko +Signed-off-by: Sasha Levin +--- + fs/hfsplus/super.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c +index 0831cd7aa5deb..b4c7748c4cf98 100644 +--- a/fs/hfsplus/super.c ++++ b/fs/hfsplus/super.c +@@ -52,6 +52,12 @@ static int hfsplus_system_read_inode(struct inode *inode) + return -EIO; + } + ++ /* ++ * Assign a dummy file type, for may_open() requires that ++ * an inode has a valid file type. ++ */ ++ inode->i_mode = S_IFREG; ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.12/hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch b/queue-6.12/hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch new file mode 100644 index 00000000000..f5a120c8283 --- /dev/null +++ b/queue-6.12/hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch @@ -0,0 +1,37 @@ +From f94dee4575229c663e9c9527ad691c0cdc4b06a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Nov 2025 06:06:23 +0000 +Subject: HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple + keyboards + +From: Joey Bednar + +[ Upstream commit 7273acfd0aef106093a8ffa3b4973eb70e5a3799 ] + +The SoNiX KN85 keyboard identifies as the "Apple, Inc. Aluminium +Keyboard" and is not recognized as a non-apple keyboard. Adding "SoNiX +KN85 Keyboard" to the list of non-apple keyboards fixes the function +keys. + +Signed-off-by: Joey Bednar +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-apple.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c +index a0f79803df3bd..b0cf13cd292bd 100644 +--- a/drivers/hid/hid-apple.c ++++ b/drivers/hid/hid-apple.c +@@ -353,6 +353,7 @@ static const struct apple_key_translation swapped_fn_leftctrl_keys[] = { + }; + + static const struct apple_non_apple_keyboard non_apple_keyboards[] = { ++ { "SONiX KN85 Keyboard" }, + { "SONiX USB DEVICE" }, + { "SONiX AK870 PRO" }, + { "Keychron" }, +-- +2.51.0 + diff --git a/queue-6.12/hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch b/queue-6.12/hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch new file mode 100644 index 00000000000..beddde07b01 --- /dev/null +++ b/queue-6.12/hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch @@ -0,0 +1,141 @@ +From 43b67aa3b878446fe2499e76cc52083581fb3bfd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 12:56:09 +0900 +Subject: HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK + +From: David Phillips + +[ Upstream commit b8e5fdf0bd022cd5493a5987ef66f5a24f8352d8 ] + +New model in the ELECOM HUGE trackball line that has 8 buttons but the +report descriptor specifies only 5. The HUGE Plus supports connecting via +Bluetooth, 2.4GHz wireless USB dongle, and directly via a USB-C cable. +Each connection type reports a different device id, 01AA for cable, +01AB for USB dongle, and 01AC for Bluetooth. + +This patch adds these device IDs and applies the fixups similar to the +other ELECOM devices to get all 8 buttons working for all 3 connection +types. + +For reference, the usbhid-dump output: +001:013:001:DESCRIPTOR 1769085639.598405 + 05 01 09 02 A1 01 85 01 09 01 A1 00 05 09 19 01 + 29 05 15 00 25 01 75 01 95 05 81 02 75 03 95 01 + 81 01 05 01 09 30 09 31 16 01 80 26 FF 7F 75 10 + 95 02 81 06 09 38 15 81 25 7F 75 08 95 01 81 06 + 05 0C 0A 38 02 15 81 25 7F 75 08 95 01 81 06 C0 + C0 05 0C 09 01 A1 01 85 02 15 01 26 8C 02 19 01 + 2A 8C 02 75 10 95 01 81 00 C0 05 01 09 80 A1 01 + 85 03 09 82 09 81 09 83 15 00 25 01 19 01 29 03 + 75 01 95 03 81 02 95 05 81 01 C0 06 01 FF 09 00 + A1 01 85 08 09 00 15 00 26 FF 00 75 08 95 07 81 + 02 C0 06 02 FF 09 02 A1 01 85 06 09 02 15 00 26 + FF 00 75 08 95 07 B1 02 C0 + +Signed-off-by: David Phillips +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/Kconfig | 1 + + drivers/hid/hid-elecom.c | 16 ++++++++++++++++ + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/hid-quirks.c | 3 +++ + 4 files changed, 23 insertions(+) + +diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig +index 95a4ede270991..f283f271d87e7 100644 +--- a/drivers/hid/Kconfig ++++ b/drivers/hid/Kconfig +@@ -328,6 +328,7 @@ config HID_ELECOM + - EX-G Trackballs (M-XT3DRBK, M-XT3URBK) + - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK) + - HUGE Trackballs (M-HT1DRBK, M-HT1URBK) ++ - HUGE Plus Trackball (M-HT1MRBK) + + config HID_ELO + tristate "ELO USB 4000/4500 touchscreen" +diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c +index b57b6deb36f42..f1e3fc374a1d5 100644 +--- a/drivers/hid/hid-elecom.c ++++ b/drivers/hid/hid-elecom.c +@@ -5,6 +5,7 @@ + * - EX-G Trackballs (M-XT3DRBK, M-XT3URBK, M-XT4DRBK) + * - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK) + * - HUGE Trackballs (M-HT1DRBK, M-HT1URBK) ++ * - HUGE Plus Trackball (M-HT1MRBK) + * + * Copyright (c) 2010 Richard Nauber + * Copyright (c) 2016 Yuxuan Shui +@@ -111,12 +112,25 @@ static const __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc, + */ + mouse_button_fixup(hdev, rdesc, *rsize, 22, 30, 24, 16, 8); + break; ++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK: ++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB: ++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC: ++ /* ++ * Report descriptor format: ++ * 24: button bit count ++ * 28: padding bit count ++ * 22: button report size ++ * 16: button usage maximum ++ */ ++ mouse_button_fixup(hdev, rdesc, *rsize, 24, 28, 22, 16, 8); ++ break; + } + return rdesc; + } + + static const struct hid_device_id elecom_devices[] = { + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, ++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, +@@ -127,6 +141,8 @@ static const struct hid_device_id elecom_devices[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) }, + { } + }; + MODULE_DEVICE_TABLE(hid, elecom_devices); +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 9ed994e34211d..dfa39a37405e3 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -459,6 +459,9 @@ + #define USB_DEVICE_ID_ELECOM_M_HT1URBK 0x010c + #define USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D 0x010d + #define USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C 0x011c ++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK 0x01aa ++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB 0x01ab ++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC 0x01ac + + #define USB_VENDOR_ID_DREAM_CHEEKY 0x1d34 + #define USB_DEVICE_ID_DREAM_CHEEKY_WN 0x0004 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 1f531626192cd..7a3e0675d9ba2 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -415,6 +415,7 @@ static const struct hid_device_id hid_have_special_driver[] = { + #if IS_ENABLED(CONFIG_HID_ELECOM) + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, ++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) }, +@@ -424,6 +425,8 @@ static const struct hid_device_id hid_have_special_driver[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) }, + #endif + #if IS_ENABLED(CONFIG_HID_ELO) + { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) }, +-- +2.51.0 + diff --git a/queue-6.12/hid-i2c-hid-add-focaltech-ft8112.patch b/queue-6.12/hid-i2c-hid-add-focaltech-ft8112.patch new file mode 100644 index 00000000000..176e714fded --- /dev/null +++ b/queue-6.12/hid-i2c-hid-add-focaltech-ft8112.patch @@ -0,0 +1,55 @@ +From c07000ee8cfb63cb7d108b5ef93a2a61a8b219ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 17:40:41 +0800 +Subject: HID: i2c-hid: Add FocalTech FT8112 + +From: Daniel Peng + +[ Upstream commit 3d9586f1f90c9101b1abf5b0e9d70ca45f5f16db ] + +Information for touchscreen model HKO/RB116AS01-2 as below: +- HID :FTSC1000 +- slave address:0X38 +- Interface:HID over I2C +- Touch control lC:FT8112 +- I2C ID: PNP0C50 + +Signed-off-by: Daniel Peng +Acked-by: Jiri Kosina +Reviewed-by: Douglas Anderson +Link: https://patch.msgid.link/20251117094041.300083-2-Daniel_Peng@pegatron.corp-partner.google.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/hid/i2c-hid/i2c-hid-of-elan.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/hid/i2c-hid/i2c-hid-of-elan.c b/drivers/hid/i2c-hid/i2c-hid-of-elan.c +index 3fcff6daa0d3a..f215bad8b3ab1 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-of-elan.c ++++ b/drivers/hid/i2c-hid/i2c-hid-of-elan.c +@@ -159,6 +159,13 @@ static const struct elan_i2c_hid_chip_data elan_ekth6a12nay_chip_data = { + .main_supply_name = "vcc33", + }; + ++static const struct elan_i2c_hid_chip_data focaltech_ft8112_chip_data = { ++ .post_power_delay_ms = 10, ++ .post_gpio_reset_on_delay_ms = 150, ++ .hid_descriptor_address = 0x0001, ++ .main_supply_name = "vcc33", ++}; ++ + static const struct elan_i2c_hid_chip_data ilitek_ili9882t_chip_data = { + .post_power_delay_ms = 1, + .post_gpio_reset_on_delay_ms = 200, +@@ -182,6 +189,7 @@ static const struct elan_i2c_hid_chip_data ilitek_ili2901_chip_data = { + static const struct of_device_id elan_i2c_hid_of_match[] = { + { .compatible = "elan,ekth6915", .data = &elan_ekth6915_chip_data }, + { .compatible = "elan,ekth6a12nay", .data = &elan_ekth6a12nay_chip_data }, ++ { .compatible = "focaltech,ft8112", .data = &focaltech_ft8112_chip_data }, + { .compatible = "ilitek,ili9882t", .data = &ilitek_ili9882t_chip_data }, + { .compatible = "ilitek,ili2901", .data = &ilitek_ili2901_chip_data }, + { } +-- +2.51.0 + diff --git a/queue-6.12/hid-logitech-hidpp-add-support-for-logitech-k980.patch b/queue-6.12/hid-logitech-hidpp-add-support-for-logitech-k980.patch new file mode 100644 index 00000000000..0466bd4675a --- /dev/null +++ b/queue-6.12/hid-logitech-hidpp-add-support-for-logitech-k980.patch @@ -0,0 +1,36 @@ +From c3cb4d3673ac4aae7b4c05ee54b366ee225131d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 13:12:02 +0100 +Subject: HID: logitech-hidpp: Add support for Logitech K980 + +From: Bastien Nocera + +[ Upstream commit af4fe07a9d963a72438ade96cf090e84b3399d0c ] + +Add support for the solar-charging Logitech K980 keyboard, over +Bluetooth. Bolt traffic doesn't get routed through logitech-dj, so +this code isn't triggered when Bolt is used. + +Signed-off-by: Bastien Nocera +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-logitech-hidpp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index c470b4f0e9211..b4cc402787397 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -4693,6 +4693,8 @@ static const struct hid_device_id hidpp_devices[] = { + HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb037) }, + { /* MX Anywhere 3SB mouse over Bluetooth */ + HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb038) }, ++ { /* Slim Solar+ K980 Keyboard over Bluetooth */ ++ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb391) }, + {} + }; + +-- +2.51.0 + diff --git a/queue-6.12/hid-multitouch-add-egalaxtouch-exc3188-support.patch b/queue-6.12/hid-multitouch-add-egalaxtouch-exc3188-support.patch new file mode 100644 index 00000000000..556972a75e5 --- /dev/null +++ b/queue-6.12/hid-multitouch-add-egalaxtouch-exc3188-support.patch @@ -0,0 +1,49 @@ +From e85689ec9cbffd7624072c099374ce4858e9e5e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 09:57:05 +0100 +Subject: HID: multitouch: add eGalaxTouch EXC3188 support + +From: Thorsten Schmelzer + +[ Upstream commit 8e4ac86b2ddd36fe501e20ecfcc080e536df1f48 ] + +Add support for the for the EXC3188 touchscreen from eGalaxy. + +Signed-off-by: Thorsten Schmelzer +Signed-off-by: Michael Tretter +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-multitouch.c | 3 +++ + 2 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 9d0a97a3b06a2..9ed994e34211d 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -433,6 +433,7 @@ + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7349 0x7349 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7 0x73f7 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001 ++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000 0xc000 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002 0xc002 + + #define USB_VENDOR_ID_EDIFIER 0x2d99 +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index fcfc508d1b54d..c3a914458358c 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -2026,6 +2026,9 @@ static const struct hid_device_id mt_devices[] = { + { .driver_data = MT_CLS_EGALAX_SERIAL, + MT_USB_DEVICE(USB_VENDOR_ID_DWAV, + USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) }, ++ { .driver_data = MT_CLS_EGALAX_SERIAL, ++ MT_USB_DEVICE(USB_VENDOR_ID_DWAV, ++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000) }, + { .driver_data = MT_CLS_EGALAX, + MT_USB_DEVICE(USB_VENDOR_ID_DWAV, + USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002) }, +-- +2.51.0 + diff --git a/queue-6.12/hisi_acc_vfio_pci-update-status-after-ras-error.patch b/queue-6.12/hisi_acc_vfio_pci-update-status-after-ras-error.patch new file mode 100644 index 00000000000..1f443441592 --- /dev/null +++ b/queue-6.12/hisi_acc_vfio_pci-update-status-after-ras-error.patch @@ -0,0 +1,41 @@ +From c1ecb8dc8b7b71d54012d999d2a6126daa1e8f7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 10:02:03 +0800 +Subject: hisi_acc_vfio_pci: update status after RAS error + +From: Longfang Liu + +[ Upstream commit 8be14dd48dfee0df91e511acceb4beeb2461a083 ] + +After a RAS error occurs on the accelerator device, the accelerator +device will be reset. The live migration state will be abnormal +after reset, and the original state needs to be restored during +the reset process. +Therefore, reset processing needs to be performed in a live +migration scenario. + +Signed-off-by: Longfang Liu +Link: https://lore.kernel.org/r/20260122020205.2884497-3-liulongfang@huawei.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c +index dda8cb3262e0b..1a36b687e0085 100644 +--- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c ++++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c +@@ -1139,8 +1139,7 @@ static void hisi_acc_vf_pci_aer_reset_done(struct pci_dev *pdev) + { + struct hisi_acc_vf_core_device *hisi_acc_vdev = hisi_acc_drvdata(pdev); + +- if (hisi_acc_vdev->core_device.vdev.migration_flags != +- VFIO_MIGRATION_STOP_COPY) ++ if (!hisi_acc_vdev->core_device.vdev.mig_ops) + return; + + mutex_lock(&hisi_acc_vdev->state_mutex); +-- +2.51.0 + diff --git a/queue-6.12/hwmon-dell-smm-add-support-for-dell-optiplex-7080.patch b/queue-6.12/hwmon-dell-smm-add-support-for-dell-optiplex-7080.patch new file mode 100644 index 00000000000..8849c491d02 --- /dev/null +++ b/queue-6.12/hwmon-dell-smm-add-support-for-dell-optiplex-7080.patch @@ -0,0 +1,47 @@ +From ea7748cb2e5fab1fe8249e4665604906d44b8628 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jan 2026 01:06:10 +0100 +Subject: hwmon: (dell-smm) Add support for Dell OptiPlex 7080 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit 46c3e87a79179454f741f797c274dd25f5c6125e ] + +The Dell OptiPlex 7080 supports the legacy SMM interface for reading +sensors and performing fan control. Whitelist this machine so that +this driver loads automatically. + +Closes: https://github.com/Wer-Wolf/i8kutils/issues/16 +Signed-off-by: Armin Wolf +Acked-by: Pali Rohár +Link: https://lore.kernel.org/r/20260104000654.6406-1-W_Armin@gmx.de +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/dell-smm-hwmon.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c +index 9df78861f5f88..2cb92a53e7c2c 100644 +--- a/drivers/hwmon/dell-smm-hwmon.c ++++ b/drivers/hwmon/dell-smm-hwmon.c +@@ -1275,6 +1275,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = { + DMI_MATCH(DMI_PRODUCT_NAME, "MP061"), + }, + }, ++ { ++ .ident = "Dell OptiPlex 7080", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7080"), ++ }, ++ }, + { + .ident = "Dell OptiPlex 7060", + .matches = { +-- +2.51.0 + diff --git a/queue-6.12/hwmon-f71882fg-add-f81968-support.patch b/queue-6.12/hwmon-f71882fg-add-f81968-support.patch new file mode 100644 index 00000000000..3293f09f758 --- /dev/null +++ b/queue-6.12/hwmon-f71882fg-add-f81968-support.patch @@ -0,0 +1,59 @@ +From fa1fb38ff4ea9b55b442595c053be579f5a02824 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Dec 2025 13:10:40 +0800 +Subject: hwmon: (f71882fg) Add F81968 support + +From: Ji-Ze Hong (Peter Hong) + +[ Upstream commit e4a3d6f79c9933fece64368168c46d6cf5fc2e52 ] + +Add hardware monitoring support for the Fintek F81968 Super I/O chip. +It is fully compatible with F81866. + +Several products share compatibility with the F81866. To better distinguish +between them, ensure that the Product ID is displayed when the device is +probed. + +Signed-off-by: Ji-Ze Hong (Peter Hong) +Link: https://lore.kernel.org/r/20251223051040.10227-1-peter_hong@fintek.com.tw +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/f71882fg.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c +index 7c941d320a186..734df959276af 100644 +--- a/drivers/hwmon/f71882fg.c ++++ b/drivers/hwmon/f71882fg.c +@@ -51,6 +51,7 @@ + #define SIO_F81866_ID 0x1010 /* Chipset ID */ + #define SIO_F71858AD_ID 0x0903 /* Chipset ID */ + #define SIO_F81966_ID 0x1502 /* Chipset ID */ ++#define SIO_F81968_ID 0x1806 /* Chipset ID */ + + #define REGION_LENGTH 8 + #define ADDR_REG_OFFSET 5 +@@ -2570,6 +2571,7 @@ static int __init f71882fg_find(int sioaddr, struct f71882fg_sio_data *sio_data) + break; + case SIO_F81866_ID: + case SIO_F81966_ID: ++ case SIO_F81968_ID: + sio_data->type = f81866a; + break; + default: +@@ -2599,9 +2601,9 @@ static int __init f71882fg_find(int sioaddr, struct f71882fg_sio_data *sio_data) + address &= ~(REGION_LENGTH - 1); /* Ignore 3 LSB */ + + err = address; +- pr_info("Found %s chip at %#x, revision %d\n", ++ pr_info("Found %s chip at %#x, revision %d, devid: %04x\n", + f71882fg_names[sio_data->type], (unsigned int)address, +- (int)superio_inb(sioaddr, SIO_REG_DEVREV)); ++ (int)superio_inb(sioaddr, SIO_REG_DEVREV), devid); + exit: + superio_exit(sioaddr); + return err; +-- +2.51.0 + diff --git a/queue-6.12/hwmon-nct6775-add-asus-pro-ws-wrx90e-sage-se.patch b/queue-6.12/hwmon-nct6775-add-asus-pro-ws-wrx90e-sage-se.patch new file mode 100644 index 00000000000..8160f0e573d --- /dev/null +++ b/queue-6.12/hwmon-nct6775-add-asus-pro-ws-wrx90e-sage-se.patch @@ -0,0 +1,39 @@ +From eace774b3b4a6e56a6bf4c3c0c2e21d3cc498dae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Dec 2025 17:53:14 +0200 +Subject: hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE + +From: Denis Pauk + +[ Upstream commit 246167b17c14e8a5142368ac6457e81622055e0a ] + +Boards Pro WS WRX90E-SAGE SE has got a nct6775 chip, but by default there's +no use of it because of resource conflict with WMI method. + +Add the board to the WMI monitoring list. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=204807 +Signed-off-by: Denis Pauk +Tested-by: Marcus +Link: https://lore.kernel.org/r/20251231155316.2048-1-pauk.denis@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/nct6775-platform.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hwmon/nct6775-platform.c b/drivers/hwmon/nct6775-platform.c +index 1218a3b449a80..ece183a0d4e91 100644 +--- a/drivers/hwmon/nct6775-platform.c ++++ b/drivers/hwmon/nct6775-platform.c +@@ -1356,6 +1356,7 @@ static const char * const asus_msi_boards[] = { + "Pro WS W680-ACE IPMI", + "Pro WS W790-ACE", + "Pro WS W790E-SAGE SE", ++ "Pro WS WRX90E-SAGE SE", + "ProArt B650-CREATOR", + "ProArt B660-CREATOR D4", + "ProArt B760-CREATOR D4", +-- +2.51.0 + diff --git a/queue-6.12/hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch b/queue-6.12/hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch new file mode 100644 index 00000000000..cd1aff9b88b --- /dev/null +++ b/queue-6.12/hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch @@ -0,0 +1,61 @@ +From 7ce85ac1aa836ec2253282af9ca308da75a73883 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 08:35:44 +0100 +Subject: hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 1e5271393d777f6159d896943b4c44c4f3ecff52 ] + +The unpacked union within a packed struct generates alignment warnings +on clang for 32-bit ARM: + +./usr/include/linux/hyperv.h:361:2: error: field within 'struct hv_kvp_exchg_msg_value' + is less aligned than 'union hv_kvp_exchg_msg_value::(anonymous at ./usr/include/linux/hyperv.h:361:2)' + and is usually due to 'struct hv_kvp_exchg_msg_value' being packed, + which can lead to unaligned accesses [-Werror,-Wunaligned-access] + 361 | union { + | ^ + +With the recent changes to compile-test the UAPI headers in more cases, +this warning in combination with CONFIG_WERROR breaks the build. + +Fix the warning. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/ +Reported-by: Nathan Chancellor +Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/ +Suggested-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/ +Signed-off-by: Thomas Weißschuh +Acked-by: Wei Liu (Microsoft) +Tested-by: Nicolas Schier +Reviewed-by: Nicolas Schier +Acked-by: Greg Kroah-Hartman +Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-1-076aed1623ff@linutronix.de +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + include/uapi/linux/hyperv.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/hyperv.h b/include/uapi/linux/hyperv.h +index aaa502a7bff46..1749b35ab2c21 100644 +--- a/include/uapi/linux/hyperv.h ++++ b/include/uapi/linux/hyperv.h +@@ -362,7 +362,7 @@ struct hv_kvp_exchg_msg_value { + __u8 value[HV_KVP_EXCHANGE_MAX_VALUE_SIZE]; + __u32 value_u32; + __u64 value_u64; +- }; ++ } __attribute__((packed)); + } __attribute__((packed)); + + struct hv_kvp_msg_enumerate { +-- +2.51.0 + diff --git a/queue-6.12/i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch b/queue-6.12/i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch new file mode 100644 index 00000000000..bce098433c8 --- /dev/null +++ b/queue-6.12/i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch @@ -0,0 +1,49 @@ +From 871003ed83e11c651b3c6b398f07cd6d15e409c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 15:08:51 -0500 +Subject: i3c: master: svc: Initialize 'dev' to NULL in + svc_i3c_master_ibi_isr() + +From: Frank Li + +[ Upstream commit 3c9ffb4db787428a5851d5865823ab23842d5103 ] + +Initialize the 'dev' pointer to NULL in svc_i3c_master_ibi_isr() and add +a NULL check in the error path. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/r/202512131016.YCKIsDXM-lkp@intel.com/ +Signed-off-by: Frank Li +Link: https://patch.msgid.link/20251215200852.3079073-1-Frank.Li@nxp.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/svc-i3c-master.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c +index 985f30ef0c939..cc13892e45963 100644 +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -426,8 +426,8 @@ static void svc_i3c_master_ibi_work(struct work_struct *work) + { + struct svc_i3c_master *master = container_of(work, struct svc_i3c_master, ibi_work); + struct svc_i3c_i2c_dev_data *data; ++ struct i3c_dev_desc *dev = NULL; + unsigned int ibitype, ibiaddr; +- struct i3c_dev_desc *dev; + u32 status, val; + int ret; + +@@ -511,7 +511,7 @@ static void svc_i3c_master_ibi_work(struct work_struct *work) + * for the slave to interrupt again. + */ + if (svc_i3c_master_error(master)) { +- if (master->ibi.tbq_slot) { ++ if (master->ibi.tbq_slot && dev) { + data = i3c_dev_get_master_data(dev); + i3c_generic_ibi_recycle_slot(data->ibi_pool, + master->ibi.tbq_slot); +-- +2.51.0 + diff --git a/queue-6.12/i3c-mipi-i3c-hci-reset-ring_operation1-fields-during.patch b/queue-6.12/i3c-mipi-i3c-hci-reset-ring_operation1-fields-during.patch new file mode 100644 index 00000000000..a03c02a7e35 --- /dev/null +++ b/queue-6.12/i3c-mipi-i3c-hci-reset-ring_operation1-fields-during.patch @@ -0,0 +1,45 @@ +From 34a6d6d912e05b71fda712b1cbdf1ec8c61dc9cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 09:26:42 +0200 +Subject: i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init + +From: Adrian Hunter + +[ Upstream commit 78f63ae4a82db173f93adca462e63d11ba06b126 ] + +The MIPI I3C HCI specification does not define reset values for +RING_OPERATION1 fields, and some controllers (e.g., Intel) do not clear +them during a software reset. Ensure the ring pointers are explicitly +set to zero during bus initialization to avoid inconsistent state. + +Signed-off-by: Adrian Hunter +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20260113072702.16268-2-adrian.hunter@intel.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/mipi-i3c-hci/dma.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c +index fe955703e59b5..68c2923f55664 100644 +--- a/drivers/i3c/master/mipi-i3c-hci/dma.c ++++ b/drivers/i3c/master/mipi-i3c-hci/dma.c +@@ -328,6 +328,14 @@ static int hci_dma_init(struct i3c_hci *hci) + rh_reg_write(INTR_SIGNAL_ENABLE, regval); + + ring_ready: ++ /* ++ * The MIPI I3C HCI specification does not document reset values for ++ * RING_OPERATION1 fields and some controllers (e.g. Intel controllers) ++ * do not reset the values, so ensure the ring pointers are set to zero ++ * here. ++ */ ++ rh_reg_write(RING_OPERATION1, 0); ++ + rh_reg_write(RING_CONTROL, RING_CTRL_ENABLE | + RING_CTRL_RUN_STOP); + } +-- +2.51.0 + diff --git a/queue-6.12/iio-magnetometer-remove-irqf_oneshot.patch b/queue-6.12/iio-magnetometer-remove-irqf_oneshot.patch new file mode 100644 index 00000000000..7c575457f38 --- /dev/null +++ b/queue-6.12/iio-magnetometer-remove-irqf_oneshot.patch @@ -0,0 +1,49 @@ +From 0dc93d34bbc0772d4b5b3313799cc36f49a4fd1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:38 +0100 +Subject: iio: magnetometer: Remove IRQF_ONESHOT +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sebastian Andrzej Siewior + +[ Upstream commit a54e9440925e6617c98669066b4753c4cdcea8a0 ] + +Passing IRQF_ONESHOT ensures that the interrupt source is masked until +the secondary (threaded) handler is done. If only a primary handler is +used then the flag makes no sense because the interrupt can not fire +(again) while its handler is running. +The flag also disallows force-threading of the primary handler and the +irq-core will warn about this. +The force-threading functionality is required on PREEMPT_RT because the +handler is using locks with can sleep on PREEMPT_RT. + +Remove IRQF_ONESHOT from irqflags. + +Tested-by: Geert Uytterhoeven +Signed-off-by: Sebastian Andrzej Siewior +Reviewed-by: Andy Shevchenko +Reviewed-by: Nuno Sá +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/magnetometer/ak8975.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c +index 18077fb463a91..6975e0af50536 100644 +--- a/drivers/iio/magnetometer/ak8975.c ++++ b/drivers/iio/magnetometer/ak8975.c +@@ -581,7 +581,7 @@ static int ak8975_setup_irq(struct ak8975_data *data) + irq = gpiod_to_irq(data->eoc_gpiod); + + rc = devm_request_irq(&client->dev, irq, ak8975_irq_handler, +- IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ IRQF_TRIGGER_RISING, + dev_name(&client->dev), data); + if (rc < 0) { + dev_err(&client->dev, "irq %d request failed: %d\n", irq, rc); +-- +2.51.0 + diff --git a/queue-6.12/iio-use-irqf_no_thread.patch b/queue-6.12/iio-use-irqf_no_thread.patch new file mode 100644 index 00000000000..6114e237802 --- /dev/null +++ b/queue-6.12/iio-use-irqf_no_thread.patch @@ -0,0 +1,90 @@ +From 4153c2a0624db26f605e3a52a7adf982413b278c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:36 +0100 +Subject: iio: Use IRQF_NO_THREAD + +From: Sebastian Andrzej Siewior + +[ Upstream commit 04d390af97f2c28166f7ddfe1a6bda622e3a4766 ] + +The interrupt handler iio_trigger_generic_data_rdy_poll() will invoke +other interrupt handler and this supposed to happen from within the +hardirq. + +Use IRQF_NO_THREAD to forbid forced-threading. + +Signed-off-by: Sebastian Andrzej Siewior +Reviewed-by: Andy Shevchenko +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/accel/bma180.c | 5 +++-- + drivers/iio/adc/ad7766.c | 2 +- + drivers/iio/gyro/itg3200_buffer.c | 8 +++----- + drivers/iio/light/si1145.c | 2 +- + 4 files changed, 8 insertions(+), 9 deletions(-) + +diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c +index 2445a0f7bc2ba..ff64bfb348ed8 100644 +--- a/drivers/iio/accel/bma180.c ++++ b/drivers/iio/accel/bma180.c +@@ -990,8 +990,9 @@ static int bma180_probe(struct i2c_client *client) + } + + ret = devm_request_irq(dev, client->irq, +- iio_trigger_generic_data_rdy_poll, IRQF_TRIGGER_RISING, +- "bma180_event", data->trig); ++ iio_trigger_generic_data_rdy_poll, ++ IRQF_TRIGGER_RISING | IRQF_NO_THREAD, ++ "bma180_event", data->trig); + if (ret) { + dev_err(dev, "unable to request IRQ\n"); + goto err_trigger_free; +diff --git a/drivers/iio/adc/ad7766.c b/drivers/iio/adc/ad7766.c +index 4d570383ef025..1e6bfe8765ab3 100644 +--- a/drivers/iio/adc/ad7766.c ++++ b/drivers/iio/adc/ad7766.c +@@ -261,7 +261,7 @@ static int ad7766_probe(struct spi_device *spi) + * don't enable the interrupt to avoid extra load on the system + */ + ret = devm_request_irq(&spi->dev, spi->irq, ad7766_irq, +- IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN, ++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN | IRQF_NO_THREAD, + dev_name(&spi->dev), + ad7766->trig); + if (ret < 0) +diff --git a/drivers/iio/gyro/itg3200_buffer.c b/drivers/iio/gyro/itg3200_buffer.c +index 4cfa0d4395605..d1c125a77308a 100644 +--- a/drivers/iio/gyro/itg3200_buffer.c ++++ b/drivers/iio/gyro/itg3200_buffer.c +@@ -118,11 +118,9 @@ int itg3200_probe_trigger(struct iio_dev *indio_dev) + if (!st->trig) + return -ENOMEM; + +- ret = request_irq(st->i2c->irq, +- &iio_trigger_generic_data_rdy_poll, +- IRQF_TRIGGER_RISING, +- "itg3200_data_rdy", +- st->trig); ++ ret = request_irq(st->i2c->irq, &iio_trigger_generic_data_rdy_poll, ++ IRQF_TRIGGER_RISING | IRQF_NO_THREAD, ++ "itg3200_data_rdy", st->trig); + if (ret) + goto error_free_trig; + +diff --git a/drivers/iio/light/si1145.c b/drivers/iio/light/si1145.c +index 66abda021696a..1050bf68e076e 100644 +--- a/drivers/iio/light/si1145.c ++++ b/drivers/iio/light/si1145.c +@@ -1250,7 +1250,7 @@ static int si1145_probe_trigger(struct iio_dev *indio_dev) + + ret = devm_request_irq(&client->dev, client->irq, + iio_trigger_generic_data_rdy_poll, +- IRQF_TRIGGER_FALLING, ++ IRQF_TRIGGER_FALLING | IRQF_NO_THREAD, + "si1145_irq", + trig); + if (ret < 0) { +-- +2.51.0 + diff --git a/queue-6.12/include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch b/queue-6.12/include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch new file mode 100644 index 00000000000..99a112a2204 --- /dev/null +++ b/queue-6.12/include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch @@ -0,0 +1,42 @@ +From 834ee5ebedfe6437d623ad0d97ae74c04362805c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Feb 2026 15:54:06 +0100 +Subject: include: uapi: netfilter_bridge.h: Cover for musl libc + +From: Phil Sutter + +[ Upstream commit 4edd4ba71ce0df015303dba75ea9d20d1a217546 ] + +Musl defines its own struct ethhdr and thus defines __UAPI_DEF_ETHHDR to +zero. To avoid struct redefinition errors, user space is therefore +supposed to include netinet/if_ether.h before (or instead of) +linux/if_ether.h. To relieve them from this burden, include the libc +header here if not building for kernel space. + +Reported-by: Alyssa Ross +Suggested-by: Florian Westphal +Signed-off-by: Phil Sutter +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + include/uapi/linux/netfilter_bridge.h | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/include/uapi/linux/netfilter_bridge.h b/include/uapi/linux/netfilter_bridge.h +index 1610fdbab98df..ad520d3e9df8f 100644 +--- a/include/uapi/linux/netfilter_bridge.h ++++ b/include/uapi/linux/netfilter_bridge.h +@@ -5,6 +5,10 @@ + /* bridge-specific defines for netfilter. + */ + ++#ifndef __KERNEL__ ++#include /* for __UAPI_DEF_ETHHDR if defined */ ++#endif ++ + #include + #include + #include +-- +2.51.0 + diff --git a/queue-6.12/iommu-amd-move-wait_on_sem-out-of-spinlock.patch b/queue-6.12/iommu-amd-move-wait_on_sem-out-of-spinlock.patch new file mode 100644 index 00000000000..261ba16f66c --- /dev/null +++ b/queue-6.12/iommu-amd-move-wait_on_sem-out-of-spinlock.patch @@ -0,0 +1,87 @@ +From 4943cba666c1e05b6b920cb67833325938863b81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 14:39:40 +0000 +Subject: iommu/amd: move wait_on_sem() out of spinlock + +From: Ankit Soni + +[ Upstream commit d2a0cac10597068567d336e85fa3cbdbe8ca62bf ] + +With iommu.strict=1, the existing completion wait path can cause soft +lockups under stressed environment, as wait_on_sem() busy-waits under the +spinlock with interrupts disabled. + +Move the completion wait in iommu_completion_wait() out of the spinlock. +wait_on_sem() only polls the hardware-updated cmd_sem and does not require +iommu->lock, so holding the lock during the busy wait unnecessarily +increases contention and extends the time with interrupts disabled. + +Signed-off-by: Ankit Soni +Reviewed-by: Vasant Hegde +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd/iommu.c | 25 +++++++++++++++++-------- + 1 file changed, 17 insertions(+), 8 deletions(-) + +diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c +index 5fb7bb7a84f41..fecca5c32e8a2 100644 +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -1022,7 +1022,12 @@ static int wait_on_sem(struct amd_iommu *iommu, u64 data) + { + int i = 0; + +- while (*iommu->cmd_sem != data && i < LOOP_TIMEOUT) { ++ /* ++ * cmd_sem holds a monotonically non-decreasing completion sequence ++ * number. ++ */ ++ while ((__s64)(READ_ONCE(*iommu->cmd_sem) - data) < 0 && ++ i < LOOP_TIMEOUT) { + udelay(1); + i += 1; + } +@@ -1267,14 +1272,13 @@ static int iommu_completion_wait(struct amd_iommu *iommu) + raw_spin_lock_irqsave(&iommu->lock, flags); + + ret = __iommu_queue_command_sync(iommu, &cmd, false); ++ raw_spin_unlock_irqrestore(&iommu->lock, flags); ++ + if (ret) +- goto out_unlock; ++ return ret; + + ret = wait_on_sem(iommu, data); + +-out_unlock: +- raw_spin_unlock_irqrestore(&iommu->lock, flags); +- + return ret; + } + +@@ -2931,13 +2935,18 @@ static void iommu_flush_irt_and_complete(struct amd_iommu *iommu, u16 devid) + raw_spin_lock_irqsave(&iommu->lock, flags); + ret = __iommu_queue_command_sync(iommu, &cmd, true); + if (ret) +- goto out; ++ goto out_err; + ret = __iommu_queue_command_sync(iommu, &cmd2, false); + if (ret) +- goto out; ++ goto out_err; ++ raw_spin_unlock_irqrestore(&iommu->lock, flags); ++ + wait_on_sem(iommu, data); +-out: ++ return; ++ ++out_err: + raw_spin_unlock_irqrestore(&iommu->lock, flags); ++ return; + } + + static void set_dte_irq_entry(struct amd_iommu *iommu, u16 devid, +-- +2.51.0 + diff --git a/queue-6.12/iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch b/queue-6.12/iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch new file mode 100644 index 00000000000..8343ecccf3c --- /dev/null +++ b/queue-6.12/iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch @@ -0,0 +1,134 @@ +From 34bfb60c6eb5ce510fbdbd458ea504d76b9a614d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 13:28:57 -0800 +Subject: iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency + +From: Alexander Grest + +[ Upstream commit df180b1a4cc51011c5f8c52c7ec02ad2e42962de ] + +The SMMU CMDQ lock is highly contentious when there are multiple CPUs +issuing commands and the queue is nearly full. + +The lock has the following states: + - 0: Unlocked + - >0: Shared lock held with count + - INT_MIN+N: Exclusive lock held, where N is the # of shared waiters + - INT_MIN: Exclusive lock held, no shared waiters + +When multiple CPUs are polling for space in the queue, they attempt to +grab the exclusive lock to update the cons pointer from the hardware. If +they fail to get the lock, they will spin until either the cons pointer +is updated by another CPU. + +The current code allows the possibility of shared lock starvation +if there is a constant stream of CPUs trying to grab the exclusive lock. +This leads to severe latency issues and soft lockups. + +Consider the following scenario where CPU1's attempt to acquire the +shared lock is starved by CPU2 and CPU0 contending for the exclusive +lock. + +CPU0 (exclusive) | CPU1 (shared) | CPU2 (exclusive) | `cmdq->lock` +-------------------------------------------------------------------------- +trylock() //takes | | | 0 + | shared_lock() | | INT_MIN + | fetch_inc() | | INT_MIN + | no return | | INT_MIN + 1 + | spins // VAL >= 0 | | INT_MIN + 1 +unlock() | spins... | | INT_MIN + 1 +set_release(0) | spins... | | 0 see[NOTE] +(done) | (sees 0) | trylock() // takes | 0 + | *exits loop* | cmpxchg(0, INT_MIN) | 0 + | | *cuts in* | INT_MIN + | cmpxchg(0, 1) | | INT_MIN + | fails // != 0 | | INT_MIN + | spins // VAL >= 0 | | INT_MIN + | *starved* | | INT_MIN + +[NOTE] The current code resets the exclusive lock to 0 regardless of the +state of the lock. This causes two problems: +1. It opens the possibility of back-to-back exclusive locks and the + downstream effect of starving shared lock. +2. The count of shared lock waiters are lost. + +To mitigate this, we release the exclusive lock by only clearing the sign +bit while retaining the shared lock waiter count as a way to avoid +starving the shared lock waiters. + +Also deleted cmpxchg loop while trying to acquire the shared lock as it +is not needed. The waiters can see the positive lock count and proceed +immediately after the exclusive lock is released. + +Exclusive lock is not starved in that submitters will try exclusive lock +first when new spaces become available. + +Reviewed-by: Mostafa Saleh +Reviewed-by: Nicolin Chen +Signed-off-by: Alexander Grest +Signed-off-by: Jacob Pan +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 31 ++++++++++++++------- + 1 file changed, 21 insertions(+), 10 deletions(-) + +diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +index 560a670ee7911..5d11e5177a3c9 100644 +--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c ++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +@@ -465,20 +465,26 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu) + */ + static void arm_smmu_cmdq_shared_lock(struct arm_smmu_cmdq *cmdq) + { +- int val; +- + /* +- * We can try to avoid the cmpxchg() loop by simply incrementing the +- * lock counter. When held in exclusive state, the lock counter is set +- * to INT_MIN so these increments won't hurt as the value will remain +- * negative. ++ * When held in exclusive state, the lock counter is set to INT_MIN ++ * so these increments won't hurt as the value will remain negative. ++ * The increment will also signal the exclusive locker that there are ++ * shared waiters. + */ + if (atomic_fetch_inc_relaxed(&cmdq->lock) >= 0) + return; + +- do { +- val = atomic_cond_read_relaxed(&cmdq->lock, VAL >= 0); +- } while (atomic_cmpxchg_relaxed(&cmdq->lock, val, val + 1) != val); ++ /* ++ * Someone else is holding the lock in exclusive state, so wait ++ * for them to finish. Since we already incremented the lock counter, ++ * no exclusive lock can be acquired until we finish. We don't need ++ * the return value since we only care that the exclusive lock is ++ * released (i.e. the lock counter is non-negative). ++ * Once the exclusive locker releases the lock, the sign bit will ++ * be cleared and our increment will make the lock counter positive, ++ * allowing us to proceed. ++ */ ++ atomic_cond_read_relaxed(&cmdq->lock, VAL > 0); + } + + static void arm_smmu_cmdq_shared_unlock(struct arm_smmu_cmdq *cmdq) +@@ -505,9 +511,14 @@ static bool arm_smmu_cmdq_shared_tryunlock(struct arm_smmu_cmdq *cmdq) + __ret; \ + }) + ++/* ++ * Only clear the sign bit when releasing the exclusive lock this will ++ * allow any shared_lock() waiters to proceed without the possibility ++ * of entering the exclusive lock in a tight loop. ++ */ + #define arm_smmu_cmdq_exclusive_unlock_irqrestore(cmdq, flags) \ + ({ \ +- atomic_set_release(&cmdq->lock, 0); \ ++ atomic_fetch_andnot_release(INT_MIN, &cmdq->lock); \ + local_irq_restore(flags); \ + }) + +-- +2.51.0 + diff --git a/queue-6.12/ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch b/queue-6.12/ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch new file mode 100644 index 00000000000..81a84ddc901 --- /dev/null +++ b/queue-6.12/ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch @@ -0,0 +1,123 @@ +From 854385bd7004884eb298f201082cb75c8f3e1baa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 04:35:24 +0000 +Subject: ipv4: fib: Annotate access to struct fib_alias.fa_state. + +From: Kuniyuki Iwashima + +[ Upstream commit 6e84fc395e90465f1418f582a9f7d53c87ab010e ] + +syzbot reported that struct fib_alias.fa_state can be +modified locklessly by RCU readers. [0] + +Let's use READ_ONCE()/WRITE_ONCE() properly. + +[0]: +BUG: KCSAN: data-race in fib_table_lookup / fib_table_lookup + +write to 0xffff88811b06a7fa of 1 bytes by task 4167 on cpu 0: + fib_alias_accessed net/ipv4/fib_lookup.h:32 [inline] + fib_table_lookup+0x361/0xd60 net/ipv4/fib_trie.c:1565 + fib_lookup include/net/ip_fib.h:390 [inline] + ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814 + ip_route_output_key_hash net/ipv4/route.c:2705 [inline] + __ip_route_output_key include/net/route.h:169 [inline] + ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932 + udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450 + inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859 + sock_sendmsg_nosec net/socket.c:727 [inline] + __sock_sendmsg net/socket.c:742 [inline] + ____sys_sendmsg+0x53a/0x600 net/socket.c:2592 + ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646 + __sys_sendmmsg+0x185/0x320 net/socket.c:2735 + __do_sys_sendmmsg net/socket.c:2762 [inline] + __se_sys_sendmmsg net/socket.c:2759 [inline] + __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759 + x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +read to 0xffff88811b06a7fa of 1 bytes by task 4168 on cpu 1: + fib_alias_accessed net/ipv4/fib_lookup.h:31 [inline] + fib_table_lookup+0x338/0xd60 net/ipv4/fib_trie.c:1565 + fib_lookup include/net/ip_fib.h:390 [inline] + ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814 + ip_route_output_key_hash net/ipv4/route.c:2705 [inline] + __ip_route_output_key include/net/route.h:169 [inline] + ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932 + udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450 + inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859 + sock_sendmsg_nosec net/socket.c:727 [inline] + __sock_sendmsg net/socket.c:742 [inline] + ____sys_sendmsg+0x53a/0x600 net/socket.c:2592 + ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646 + __sys_sendmmsg+0x185/0x320 net/socket.c:2735 + __do_sys_sendmmsg net/socket.c:2762 [inline] + __se_sys_sendmmsg net/socket.c:2759 [inline] + __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759 + x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +value changed: 0x00 -> 0x01 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 1 UID: 0 PID: 4168 Comm: syz.4.206 Not tainted syzkaller #0 PREEMPT(voluntary) +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 + +Reported-by: syzbot+d24f940f770afda885cf@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/69783ead.050a0220.c9109.0013.GAE@google.com/ +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260127043528.514160-1-kuniyu@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/fib_lookup.h | 6 ++++-- + net/ipv4/fib_trie.c | 4 ++-- + 2 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h +index f9b9e26c32c19..0b72796dd1ad3 100644 +--- a/net/ipv4/fib_lookup.h ++++ b/net/ipv4/fib_lookup.h +@@ -28,8 +28,10 @@ struct fib_alias { + /* Don't write on fa_state unless needed, to keep it shared on all cpus */ + static inline void fib_alias_accessed(struct fib_alias *fa) + { +- if (!(fa->fa_state & FA_S_ACCESSED)) +- fa->fa_state |= FA_S_ACCESSED; ++ u8 fa_state = READ_ONCE(fa->fa_state); ++ ++ if (!(fa_state & FA_S_ACCESSED)) ++ WRITE_ONCE(fa->fa_state, fa_state | FA_S_ACCESSED); + } + + /* Exported by fib_semantics.c */ +diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c +index 658f26d9a9ec5..ee47b67a08703 100644 +--- a/net/ipv4/fib_trie.c ++++ b/net/ipv4/fib_trie.c +@@ -1286,7 +1286,7 @@ int fib_table_insert(struct net *net, struct fib_table *tb, + new_fa->fa_dscp = fa->fa_dscp; + new_fa->fa_info = fi; + new_fa->fa_type = cfg->fc_type; +- state = fa->fa_state; ++ state = READ_ONCE(fa->fa_state); + new_fa->fa_state = state & ~FA_S_ACCESSED; + new_fa->fa_slen = fa->fa_slen; + new_fa->tb_id = tb->tb_id; +@@ -1751,7 +1751,7 @@ int fib_table_delete(struct net *net, struct fib_table *tb, + + fib_remove_alias(t, tp, l, fa_to_delete); + +- if (fa_to_delete->fa_state & FA_S_ACCESSED) ++ if (READ_ONCE(fa_to_delete->fa_state) & FA_S_ACCESSED) + rt_cache_flush(cfg->fc_nlinfo.nl_net); + + fib_release_info(fa_to_delete->fa_info); +-- +2.51.0 + diff --git a/queue-6.12/ipv4-igmp-annotate-data-races-around-idev-mr_maxdela.patch b/queue-6.12/ipv4-igmp-annotate-data-races-around-idev-mr_maxdela.patch new file mode 100644 index 00000000000..0f2d8abb743 --- /dev/null +++ b/queue-6.12/ipv4-igmp-annotate-data-races-around-idev-mr_maxdela.patch @@ -0,0 +1,66 @@ +From 11ffcef49824e8dc9c4a74d347f2326541f51534 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 17:22:47 +0000 +Subject: ipv4: igmp: annotate data-races around idev->mr_maxdelay + +From: Eric Dumazet + +[ Upstream commit e4faaf65a75f650ac4366ddff5dabb826029ca5a ] + +idev->mr_maxdelay is read and written locklessly, +add READ_ONCE()/WRITE_ONCE() annotations. + +While we are at it, make this field an u32. + +Signed-off-by: Eric Dumazet +Reviewed-by: David Ahern +Link: https://patch.msgid.link/20260122172247.2429403-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/linux/inetdevice.h | 2 +- + net/ipv4/igmp.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h +index cb5280e6cc219..9c0f263e2cd28 100644 +--- a/include/linux/inetdevice.h ++++ b/include/linux/inetdevice.h +@@ -38,11 +38,11 @@ struct in_device { + struct ip_mc_list *mc_tomb; + unsigned long mr_v1_seen; + unsigned long mr_v2_seen; +- unsigned long mr_maxdelay; + unsigned long mr_qi; /* Query Interval */ + unsigned long mr_qri; /* Query Response Interval */ + unsigned char mr_qrv; /* Query Robustness Variable */ + unsigned char mr_gq_running; ++ u32 mr_maxdelay; + u32 mr_ifc_count; + struct timer_list mr_gq_timer; /* general query timer */ + struct timer_list mr_ifc_timer; /* interface change timer */ +diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c +index f4a87b90351e9..52c661c6749f3 100644 +--- a/net/ipv4/igmp.c ++++ b/net/ipv4/igmp.c +@@ -224,7 +224,7 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay) + + static void igmp_gq_start_timer(struct in_device *in_dev) + { +- int tv = get_random_u32_below(in_dev->mr_maxdelay); ++ int tv = get_random_u32_below(READ_ONCE(in_dev->mr_maxdelay)); + unsigned long exp = jiffies + tv + 2; + + if (in_dev->mr_gq_running && +@@ -1006,7 +1006,7 @@ static bool igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb, + max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE); + if (!max_delay) + max_delay = 1; /* can't mod w/ 0 */ +- in_dev->mr_maxdelay = max_delay; ++ WRITE_ONCE(in_dev->mr_maxdelay, max_delay); + + /* RFC3376, 4.1.6. QRV and 4.1.7. QQIC, when the most recently + * received value was zero, use the default or statically +-- +2.51.0 + diff --git a/queue-6.12/ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch b/queue-6.12/ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch new file mode 100644 index 00000000000..c9e2803e326 --- /dev/null +++ b/queue-6.12/ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch @@ -0,0 +1,41 @@ +From 2fd676987ca4d44f2f37836aa6d8f0f1b5a455d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 09:41:37 +0000 +Subject: ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() + +From: Eric Dumazet + +[ Upstream commit 03e9d91dd64e2f5ea632df5d59568d91757efc4d ] + +Add missing READ_ONCE() when reading sysctl values. + +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260115094141.3124990-5-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/ipv6.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/net/ipv6.h b/include/net/ipv6.h +index 2651bd76e5b75..e843eb7efbccd 100644 +--- a/include/net/ipv6.h ++++ b/include/net/ipv6.h +@@ -1005,11 +1005,11 @@ static inline int ip6_default_np_autolabel(struct net *net) + #if IS_ENABLED(CONFIG_IPV6) + static inline int ip6_multipath_hash_policy(const struct net *net) + { +- return net->ipv6.sysctl.multipath_hash_policy; ++ return READ_ONCE(net->ipv6.sysctl.multipath_hash_policy); + } + static inline u32 ip6_multipath_hash_fields(const struct net *net) + { +- return net->ipv6.sysctl.multipath_hash_fields; ++ return READ_ONCE(net->ipv6.sysctl.multipath_hash_fields); + } + #else + static inline int ip6_multipath_hash_policy(const struct net *net) +-- +2.51.0 + diff --git a/queue-6.12/ipv6-annotate-data-races-over-sysctl.flowlabel_refle.patch b/queue-6.12/ipv6-annotate-data-races-over-sysctl.flowlabel_refle.patch new file mode 100644 index 00000000000..be56a475ad1 --- /dev/null +++ b/queue-6.12/ipv6-annotate-data-races-over-sysctl.flowlabel_refle.patch @@ -0,0 +1,69 @@ +From 6ca84df0622f9bcfd8d0d0e69dc7c1323595ed23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 09:41:38 +0000 +Subject: ipv6: annotate data-races over sysctl.flowlabel_reflect + +From: Eric Dumazet + +[ Upstream commit 5ade47c974b46eb2a1279185962a0ffa15dc5450 ] + +Add missing READ_ONCE() when reading ipv6.sysctl.flowlabel_reflect, +as its value can be changed under us. + +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260115094141.3124990-6-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/af_inet6.c | 4 ++-- + net/ipv6/icmp.c | 3 ++- + net/ipv6/tcp_ipv6.c | 3 ++- + 3 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c +index f60ec8b0f8ea4..0786155715249 100644 +--- a/net/ipv6/af_inet6.c ++++ b/net/ipv6/af_inet6.c +@@ -224,8 +224,8 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol, + inet6_set_bit(MC6_LOOP, sk); + inet6_set_bit(MC6_ALL, sk); + np->pmtudisc = IPV6_PMTUDISC_WANT; +- inet6_assign_bit(REPFLOW, sk, net->ipv6.sysctl.flowlabel_reflect & +- FLOWLABEL_REFLECT_ESTABLISHED); ++ inet6_assign_bit(REPFLOW, sk, READ_ONCE(net->ipv6.sysctl.flowlabel_reflect) & ++ FLOWLABEL_REFLECT_ESTABLISHED); + sk->sk_ipv6only = net->ipv6.sysctl.bindv6only; + sk->sk_txrehash = READ_ONCE(net->core.sysctl_txrehash); + +diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c +index c8609147fce89..e43b49f1ddbb2 100644 +--- a/net/ipv6/icmp.c ++++ b/net/ipv6/icmp.c +@@ -763,7 +763,8 @@ static enum skb_drop_reason icmpv6_echo_reply(struct sk_buff *skb) + tmp_hdr.icmp6_type = type; + + memset(&fl6, 0, sizeof(fl6)); +- if (net->ipv6.sysctl.flowlabel_reflect & FLOWLABEL_REFLECT_ICMPV6_ECHO_REPLIES) ++ if (READ_ONCE(net->ipv6.sysctl.flowlabel_reflect) & ++ FLOWLABEL_REFLECT_ICMPV6_ECHO_REPLIES) + fl6.flowlabel = ip6_flowlabel(ipv6_hdr(skb)); + + fl6.flowi6_proto = IPPROTO_ICMPV6; +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index 06edfe0b2db90..c90b20c218bff 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -1123,7 +1123,8 @@ static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb, + txhash = inet_twsk(sk)->tw_txhash; + } + } else { +- if (net->ipv6.sysctl.flowlabel_reflect & FLOWLABEL_REFLECT_TCP_RESET) ++ if (READ_ONCE(net->ipv6.sysctl.flowlabel_reflect) & ++ FLOWLABEL_REFLECT_TCP_RESET) + label = ip6_flowlabel(ipv6h); + } + +-- +2.51.0 + diff --git a/queue-6.12/ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch b/queue-6.12/ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch new file mode 100644 index 00000000000..17ec2bb0c80 --- /dev/null +++ b/queue-6.12/ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch @@ -0,0 +1,66 @@ +From 550be03e4b28575319f14e331b2690db006c77ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 09:41:40 +0000 +Subject: ipv6: exthdrs: annotate data-race over multiple sysctl + +From: Eric Dumazet + +[ Upstream commit 978b67d28358b0b4eacfa94453d1ad4e09b123ad ] + +Following four sysctls can change under us, add missing READ_ONCE(). + +- ipv6.sysctl.max_dst_opts_len +- ipv6.sysctl.max_dst_opts_cnt +- ipv6.sysctl.max_hbh_opts_len +- ipv6.sysctl.max_hbh_opts_cnt + +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260115094141.3124990-8-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/exthdrs.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c +index 20f77fdfb73da..fb1aa587a0d6a 100644 +--- a/net/ipv6/exthdrs.c ++++ b/net/ipv6/exthdrs.c +@@ -314,7 +314,7 @@ static int ipv6_destopt_rcv(struct sk_buff *skb) + } + + extlen = (skb_transport_header(skb)[1] + 1) << 3; +- if (extlen > net->ipv6.sysctl.max_dst_opts_len) ++ if (extlen > READ_ONCE(net->ipv6.sysctl.max_dst_opts_len)) + goto fail_and_free; + + opt->lastopt = opt->dst1 = skb_network_header_len(skb); +@@ -322,7 +322,8 @@ static int ipv6_destopt_rcv(struct sk_buff *skb) + dstbuf = opt->dst1; + #endif + +- if (ip6_parse_tlv(false, skb, net->ipv6.sysctl.max_dst_opts_cnt)) { ++ if (ip6_parse_tlv(false, skb, ++ READ_ONCE(net->ipv6.sysctl.max_dst_opts_cnt))) { + skb->transport_header += extlen; + opt = IP6CB(skb); + #if IS_ENABLED(CONFIG_IPV6_MIP6) +@@ -1051,11 +1052,12 @@ int ipv6_parse_hopopts(struct sk_buff *skb) + } + + extlen = (skb_transport_header(skb)[1] + 1) << 3; +- if (extlen > net->ipv6.sysctl.max_hbh_opts_len) ++ if (extlen > READ_ONCE(net->ipv6.sysctl.max_hbh_opts_len)) + goto fail_and_free; + + opt->flags |= IP6SKB_HOPBYHOP; +- if (ip6_parse_tlv(true, skb, net->ipv6.sysctl.max_hbh_opts_cnt)) { ++ if (ip6_parse_tlv(true, skb, ++ READ_ONCE(net->ipv6.sysctl.max_hbh_opts_cnt))) { + skb->transport_header += extlen; + opt = IP6CB(skb); + opt->nhoff = sizeof(struct ipv6hdr); +-- +2.51.0 + diff --git a/queue-6.12/jfs-add-missing-set_freezable-for-freezable-kthread.patch b/queue-6.12/jfs-add-missing-set_freezable-for-freezable-kthread.patch new file mode 100644 index 00000000000..910f9652007 --- /dev/null +++ b/queue-6.12/jfs-add-missing-set_freezable-for-freezable-kthread.patch @@ -0,0 +1,37 @@ +From 56238c05c6ff7ea24a06a844a5919470fdfee823 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 19:38:01 +0800 +Subject: jfs: Add missing set_freezable() for freezable kthread + +From: Haotian Zhang + +[ Upstream commit eb0cfcf265714b419cc3549895a00632e76732ae ] + +The jfsIOWait() thread calls try_to_freeze() but lacks set_freezable(), +causing it to remain non-freezable by default. This prevents proper +freezing during system suspend. + +Add set_freezable() to make the thread freezable as intended. + +Signed-off-by: Haotian Zhang +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_logmgr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c +index 270808b6219be..a9cfa6307252d 100644 +--- a/fs/jfs/jfs_logmgr.c ++++ b/fs/jfs/jfs_logmgr.c +@@ -2312,6 +2312,7 @@ int jfsIOWait(void *arg) + { + struct lbuf *bp; + ++ set_freezable(); + do { + spin_lock_irq(&log_redrive_lock); + while ((bp = log_redrive_list)) { +-- +2.51.0 + diff --git a/queue-6.12/jfs-nlink-overflow-in-jfs_rename.patch b/queue-6.12/jfs-nlink-overflow-in-jfs_rename.patch new file mode 100644 index 00000000000..15c8b19711d --- /dev/null +++ b/queue-6.12/jfs-nlink-overflow-in-jfs_rename.patch @@ -0,0 +1,54 @@ +From 79b49439e99045693205fc3b8aaea63215b9c2dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Oct 2025 13:22:12 +0100 +Subject: jfs: nlink overflow in jfs_rename + +From: Jori Koolstra + +[ Upstream commit 9218dc26fd922b09858ecd3666ed57dfd8098da8 ] + +If nlink is maximal for a directory (-1) and inside that directory you +perform a rename for some child directory (not moving from the parent), +then the nlink of the first directory is first incremented and later +decremented. Normally this is fine, but when nlink = -1 this causes a +wrap around to 0, and then drop_nlink issues a warning. + +After applying the patch syzbot no longer issues any warnings. I also +ran some basic fs tests to look for any regressions. + +Signed-off-by: Jori Koolstra +Reported-by: syzbot+9131ddfd7870623b719f@syzkaller.appspotmail.com +Closes: https://syzbot.org/bug?extid=9131ddfd7870623b719f +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/namei.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c +index d68a4e6ac3454..e9bd7d3e61e9a 100644 +--- a/fs/jfs/namei.c ++++ b/fs/jfs/namei.c +@@ -1228,7 +1228,7 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir, + jfs_err("jfs_rename: dtInsert returned -EIO"); + goto out_tx; + } +- if (S_ISDIR(old_ip->i_mode)) ++ if (S_ISDIR(old_ip->i_mode) && old_dir != new_dir) + inc_nlink(new_dir); + } + /* +@@ -1244,7 +1244,9 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir, + goto out_tx; + } + if (S_ISDIR(old_ip->i_mode)) { +- drop_nlink(old_dir); ++ if (new_ip || old_dir != new_dir) ++ drop_nlink(old_dir); ++ + if (old_dir != new_dir) { + /* + * Change inode number of parent for moved directory +-- +2.51.0 + diff --git a/queue-6.12/libceph-define-and-enforce-ceph_max_key_len.patch b/queue-6.12/libceph-define-and-enforce-ceph_max_key_len.patch new file mode 100644 index 00000000000..905c0915343 --- /dev/null +++ b/queue-6.12/libceph-define-and-enforce-ceph_max_key_len.patch @@ -0,0 +1,82 @@ +From f3b4fc098af18e663f65b8e14327fb5089202724 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jul 2025 16:30:50 +0200 +Subject: libceph: define and enforce CEPH_MAX_KEY_LEN + +From: Ilya Dryomov + +[ Upstream commit ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf ] + +When decoding the key, verify that the key material would fit into +a fixed-size buffer in process_auth_done() and generally has a sane +length. + +The new CEPH_MAX_KEY_LEN check replaces the existing check for a key +with no key material which is a) not universal since CEPH_CRYPTO_NONE +has to be excluded and b) doesn't provide much value since a smaller +than needed key is just as invalid as no key -- this has to be handled +elsewhere anyway. + +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + net/ceph/crypto.c | 8 +++++--- + net/ceph/crypto.h | 2 +- + net/ceph/messenger_v2.c | 2 +- + 3 files changed, 7 insertions(+), 5 deletions(-) + +diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c +index 051d22c0e4ad4..3397d105f74f9 100644 +--- a/net/ceph/crypto.c ++++ b/net/ceph/crypto.c +@@ -37,9 +37,6 @@ static int set_secret(struct ceph_crypto_key *key, void *buf) + return -ENOTSUPP; + } + +- if (!key->len) +- return -EINVAL; +- + key->key = kmemdup(buf, key->len, GFP_NOIO); + if (!key->key) { + ret = -ENOMEM; +@@ -95,6 +92,11 @@ int ceph_crypto_key_decode(struct ceph_crypto_key *key, void **p, void *end) + ceph_decode_copy(p, &key->created, sizeof(key->created)); + key->len = ceph_decode_16(p); + ceph_decode_need(p, end, key->len, bad); ++ if (key->len > CEPH_MAX_KEY_LEN) { ++ pr_err("secret too big %d\n", key->len); ++ return -EINVAL; ++ } ++ + ret = set_secret(key, *p); + memzero_explicit(*p, key->len); + *p += key->len; +diff --git a/net/ceph/crypto.h b/net/ceph/crypto.h +index 13bd526349fa1..0d32f1649f3d0 100644 +--- a/net/ceph/crypto.h ++++ b/net/ceph/crypto.h +@@ -5,7 +5,7 @@ + #include + #include + +-#define CEPH_KEY_LEN 16 ++#define CEPH_MAX_KEY_LEN 16 + #define CEPH_MAX_CON_SECRET_LEN 64 + + /* +diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c +index f163283abc4e9..83c29714226fd 100644 +--- a/net/ceph/messenger_v2.c ++++ b/net/ceph/messenger_v2.c +@@ -2389,7 +2389,7 @@ static int process_auth_reply_more(struct ceph_connection *con, + */ + static int process_auth_done(struct ceph_connection *con, void *p, void *end) + { +- u8 session_key_buf[CEPH_KEY_LEN + 16]; ++ u8 session_key_buf[CEPH_MAX_KEY_LEN + 16]; + u8 con_secret_buf[CEPH_MAX_CON_SECRET_LEN + 16]; + u8 *session_key = PTR_ALIGN(&session_key_buf[0], 16); + u8 *con_secret = PTR_ALIGN(&con_secret_buf[0], 16); +-- +2.51.0 + diff --git a/queue-6.12/libperf-build-always-place-libperf-includes-first.patch b/queue-6.12/libperf-build-always-place-libperf-includes-first.patch new file mode 100644 index 00000000000..fdbc93eddc8 --- /dev/null +++ b/queue-6.12/libperf-build-always-place-libperf-includes-first.patch @@ -0,0 +1,56 @@ +From 5136e668792a33573c1401b511231d2fee0ef299 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 22:09:18 -0800 +Subject: libperf build: Always place libperf includes first + +From: Ian Rogers + +[ Upstream commit 8c5b40678c63be6b85f1c2dc8c8b89d632faf988 ] + +When building tools/perf the CFLAGS can contain a directory for the +installed headers. + +As the headers may be being installed while building libperf.a this can +cause headers to be partially installed and found in the include path +while building an object file for libperf.a. + +The installed header may reference other installed headers that are +missing given the partial nature of the install and then the build fails +with a missing header file. + +Avoid this by ensuring the libperf source headers are always first in +the CFLAGS. + +Fixes: 3143504918105156 ("libperf: Make libperf.a part of the perf build") +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/perf/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/perf/Makefile b/tools/lib/perf/Makefile +index 478fe57bf8cee..703a8ff0b3430 100644 +--- a/tools/lib/perf/Makefile ++++ b/tools/lib/perf/Makefile +@@ -63,9 +63,9 @@ INCLUDES = \ + -I$(srctree)/tools/include/uapi + + # Append required CFLAGS ++override CFLAGS := $(INCLUDES) $(CFLAGS) + override CFLAGS += -g -Werror -Wall + override CFLAGS += -fPIC +-override CFLAGS += $(INCLUDES) + override CFLAGS += -fvisibility=hidden + override CFLAGS += $(EXTRA_WARNINGS) + override CFLAGS += $(EXTRA_CFLAGS) +-- +2.51.0 + diff --git a/queue-6.12/libperf-don-t-remove-g-when-extra_cflags-are-used.patch b/queue-6.12/libperf-don-t-remove-g-when-extra_cflags-are-used.patch new file mode 100644 index 00000000000..2c3e8489f64 --- /dev/null +++ b/queue-6.12/libperf-don-t-remove-g-when-extra_cflags-are-used.patch @@ -0,0 +1,66 @@ +From 0ac8084fe715c4e0eb8a648eae0284fb2461c29d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Mar 2025 11:40:09 +0000 +Subject: libperf: Don't remove -g when EXTRA_CFLAGS are used + +From: James Clark + +[ Upstream commit f5b07010c13c77541e8ade167d05bef3b8a63739 ] + +When using EXTRA_CFLAGS, for example "EXTRA_CFLAGS=-DREFCNT_CHECKING=1", +this construct stops setting -g which you'd expect would not be affected +by adding extra flags. Additionally, EXTRA_CFLAGS should be the last +thing to be appended so that it can be used to undo any defaults. And no +condition is required, just += appends to any existing CFLAGS and also +appends or doesn't append EXTRA_CFLAGS if they are or aren't set. + +It's not clear why DEBUG=1 is required for -g in Perf when in libperf +it's always on, but I don't think we need to change that behavior now +because someone may be depending on it. + +Signed-off-by: James Clark +Reviewed-by: Ian Rogers +Link: https://lore.kernel.org/r/20250319114009.417865-1-james.clark@linaro.org +Signed-off-by: Namhyung Kim +Stable-dep-of: 8c5b40678c63 ("libperf build: Always place libperf includes first") +Signed-off-by: Sasha Levin +--- + tools/lib/perf/Makefile | 12 +++--------- + 1 file changed, 3 insertions(+), 9 deletions(-) + +diff --git a/tools/lib/perf/Makefile b/tools/lib/perf/Makefile +index 3a9b2140aa048..478fe57bf8cee 100644 +--- a/tools/lib/perf/Makefile ++++ b/tools/lib/perf/Makefile +@@ -54,13 +54,6 @@ endif + + TEST_ARGS := $(if $(V),-v) + +-# Set compile option CFLAGS +-ifdef EXTRA_CFLAGS +- CFLAGS := $(EXTRA_CFLAGS) +-else +- CFLAGS := -g -Wall +-endif +- + INCLUDES = \ + -I$(srctree)/tools/lib/perf/include \ + -I$(srctree)/tools/lib/ \ +@@ -70,11 +63,12 @@ INCLUDES = \ + -I$(srctree)/tools/include/uapi + + # Append required CFLAGS +-override CFLAGS += $(EXTRA_WARNINGS) +-override CFLAGS += -Werror -Wall ++override CFLAGS += -g -Werror -Wall + override CFLAGS += -fPIC + override CFLAGS += $(INCLUDES) + override CFLAGS += -fvisibility=hidden ++override CFLAGS += $(EXTRA_WARNINGS) ++override CFLAGS += $(EXTRA_CFLAGS) + + all: + +-- +2.51.0 + diff --git a/queue-6.12/libsubcmd-fix-null-intersection-case-in-exclude_cmds.patch b/queue-6.12/libsubcmd-fix-null-intersection-case-in-exclude_cmds.patch new file mode 100644 index 00000000000..a28785a59b7 --- /dev/null +++ b/queue-6.12/libsubcmd-fix-null-intersection-case-in-exclude_cmds.patch @@ -0,0 +1,67 @@ +From a485ef06f4ec3191518b9b109d9631812b22ccb3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 16:36:32 -0500 +Subject: libsubcmd: Fix null intersection case in exclude_cmds() + +From: Sri Jayaramappa + +[ Upstream commit b6ee9b6e206b288921c14c906eebf4b32fe0c0d8 ] + +When there is no exclusion occurring from the cmds list - for example - +cmds contains ["read-vdso32"] and excludes contains ["archive"] - the +main loop completes with ci == cj == 0. In the original code the loop +processing the remaining elements in the list was conditional: + + if (ci != cj) { ...} + +So we end up in the assertion loop since ci < cmds->cnt and we +incorrectly try to assert the list elements to be NULL and fail with +the following error + + help.c:104: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed. + +Fix this by moving the if (ci != cj) check inside of a broader loop. +If ci != cj, left shift the list elements, as before, and then +unconditionally advance the ci and cj indicies which also covers the +ci == cj case. + +Fixes: 1fdf938168c4d26f ("perf tools: Fix use-after-free in help_unknown_cmd()") +Reviewed-by: Guilherme Amadio +Signed-off-by: Sri Jayaramappa +Tested-by: Guilherme Amadio +Tested-by: Ian Rogers +Cc: Joshua Hunt +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20251202213632.2873731-1-sjayaram@akamai.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/subcmd/help.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c +index ddaeb4eb3e249..db94aa685b73b 100644 +--- a/tools/lib/subcmd/help.c ++++ b/tools/lib/subcmd/help.c +@@ -97,11 +97,13 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes) + ei++; + } + } +- if (ci != cj) { +- while (ci < cmds->cnt) { +- cmds->names[cj++] = cmds->names[ci]; +- cmds->names[ci++] = NULL; ++ while (ci < cmds->cnt) { ++ if (ci != cj) { ++ cmds->names[cj] = cmds->names[ci]; ++ cmds->names[ci] = NULL; + } ++ ci++; ++ cj++; + } + for (ci = cj; ci < cmds->cnt; ci++) + assert(cmds->names[ci] == NULL); +-- +2.51.0 + diff --git a/queue-6.12/m68k-nommu-fix-memmove-with-differently-aligned-src-.patch b/queue-6.12/m68k-nommu-fix-memmove-with-differently-aligned-src-.patch new file mode 100644 index 00000000000..4d310ec41b6 --- /dev/null +++ b/queue-6.12/m68k-nommu-fix-memmove-with-differently-aligned-src-.patch @@ -0,0 +1,69 @@ +From d8cd0ba55dd66a15613fe3074e421f94ff89f053 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Dec 2025 21:04:01 +0900 +Subject: m68k: nommu: fix memmove() with differently aligned src and dest for + 68000 + +From: Daniel Palmer + +[ Upstream commit 590fe2f46c8698bb758f9002cb247ca10ce95569 ] + +68000 has different alignment needs to 68020+. +memcpy() checks if the destination is aligned and does a smaller copy +to fix the alignment and then critically for 68000 it checks if the +source is still unaligned and if it is reverts to smaller copies. + +memmove() does not currently do the second part and malfunctions if +one of the pointers is aligned and the other isn't. + +This is apparently getting triggered by printk. If I put breakpoints +into the new checks added by this commit the first hit looks like this: + +memmove (n=205, src=0x2f3971 , dest=0x2f3980 ) at arch/m68k/lib/memmove.c:82 + +Signed-off-by: Daniel Palmer +Signed-off-by: Greg Ungerer +Signed-off-by: Sasha Levin +--- + arch/m68k/lib/memmove.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/arch/m68k/lib/memmove.c b/arch/m68k/lib/memmove.c +index 6519f7f349f66..e33f00b02e4c0 100644 +--- a/arch/m68k/lib/memmove.c ++++ b/arch/m68k/lib/memmove.c +@@ -24,6 +24,15 @@ void *memmove(void *dest, const void *src, size_t n) + src = csrc; + n--; + } ++#if defined(CONFIG_M68000) ++ if ((long)src & 1) { ++ char *cdest = dest; ++ const char *csrc = src; ++ for (; n; n--) ++ *cdest++ = *csrc++; ++ return xdest; ++ } ++#endif + if (n > 2 && (long)dest & 2) { + short *sdest = dest; + const short *ssrc = src; +@@ -66,6 +75,15 @@ void *memmove(void *dest, const void *src, size_t n) + src = csrc; + n--; + } ++#if defined(CONFIG_M68000) ++ if ((long)src & 1) { ++ char *cdest = dest; ++ const char *csrc = src; ++ for (; n; n--) ++ *--cdest = *--csrc; ++ return xdest; ++ } ++#endif + if (n > 2 && (long)dest & 2) { + short *sdest = dest; + const short *ssrc = src; +-- +2.51.0 + diff --git a/queue-6.12/mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch b/queue-6.12/mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch new file mode 100644 index 00000000000..5a57c79484e --- /dev/null +++ b/queue-6.12/mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch @@ -0,0 +1,66 @@ +From 402bc6c940d43d90ebad1745f949f419c08feaae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:24 +0100 +Subject: mailbox: bcm-ferxrm-mailbox: Use default primary handler + +From: Sebastian Andrzej Siewior + +[ Upstream commit 03843d95a4a4e0ba22ad4fcda65ccf21822b104c ] + +request_threaded_irq() is invoked with a primary and a secondary handler +and no flags are passed. The primary handler is the same as +irq_default_primary_handler() so there is no need to have an identical +copy. + +The lack of the IRQF_ONESHOT flag can be dangerous because the interrupt +source is not masked while the threaded handler is active. This means, +especially on LEVEL typed interrupt lines, the interrupt can fire again +before the threaded handler had a chance to run. + +Use the default primary interrupt handler by specifying NULL and set +IRQF_ONESHOT so the interrupt source is masked until the secondary handler +is done. + +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Thomas Gleixner +Link: https://patch.msgid.link/20260128095540.863589-5-bigeasy@linutronix.de +Signed-off-by: Sasha Levin +--- + drivers/mailbox/bcm-flexrm-mailbox.c | 14 ++------------ + 1 file changed, 2 insertions(+), 12 deletions(-) + +diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c +index b1abc2a0c971a..b616a8eacc0ee 100644 +--- a/drivers/mailbox/bcm-flexrm-mailbox.c ++++ b/drivers/mailbox/bcm-flexrm-mailbox.c +@@ -1173,14 +1173,6 @@ static int flexrm_debugfs_stats_show(struct seq_file *file, void *offset) + + /* ====== FlexRM interrupt handler ===== */ + +-static irqreturn_t flexrm_irq_event(int irq, void *dev_id) +-{ +- /* We only have MSI for completions so just wakeup IRQ thread */ +- /* Ring related errors will be informed via completion descriptors */ +- +- return IRQ_WAKE_THREAD; +-} +- + static irqreturn_t flexrm_irq_thread(int irq, void *dev_id) + { + flexrm_process_completions(dev_id); +@@ -1271,10 +1263,8 @@ static int flexrm_startup(struct mbox_chan *chan) + ret = -ENODEV; + goto fail_free_cmpl_memory; + } +- ret = request_threaded_irq(ring->irq, +- flexrm_irq_event, +- flexrm_irq_thread, +- 0, dev_name(ring->mbox->dev), ring); ++ ret = request_threaded_irq(ring->irq, NULL, flexrm_irq_thread, ++ IRQF_ONESHOT, dev_name(ring->mbox->dev), ring); + if (ret) { + dev_err(ring->mbox->dev, + "failed to request ring%d IRQ\n", ring->num); +-- +2.51.0 + diff --git a/queue-6.12/mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch b/queue-6.12/mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch new file mode 100644 index 00000000000..ab02067c85d --- /dev/null +++ b/queue-6.12/mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch @@ -0,0 +1,77 @@ +From bdfe713db358b1f15e873f3c499484ea39d5a650 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 16:00:54 +0800 +Subject: mailbox: imx: Skip the suspend flag for i.MX7ULP + +From: Jacky Bai + +[ Upstream commit 673b570825ace0dcb2ac0c676080559d505c6f40 ] + +In current imx-mailbox driver, the MU IRQ is configured with +'IRQF_NO_SUSPEND' flag set. So during linux suspend/resume flow, +the MU IRQ is always enabled. With commit 892cb524ae8a ("mailbox: imx: +fix wakeup failure from freeze mode"), if the MU IRQ is triggered after +the priv->suspended flag has been set, the system suspend will be +aborted. + +On i.MX7ULP platform, certain drivers that depend on rpmsg may need +to send rpmsg request and receive an acknowledgment from the remote +core during the late_suspend stage. Early suspend abort is not +expected, and the i.MX7ULP already has additional hardware and +software to make sure the system can be wakeup from freeze mode +correctly when MU IRQ is trigger. + +Skip the 'suspend' flag handling logic on i.MX7ULP to avoid the +early abort when doing suspend. + +Signed-off-by: Jacky Bai +Reviewed-by: Peng Fan +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/imx-mailbox.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/mailbox/imx-mailbox.c b/drivers/mailbox/imx-mailbox.c +index 0657bd3d8f97b..aa9a299859d6a 100644 +--- a/drivers/mailbox/imx-mailbox.c ++++ b/drivers/mailbox/imx-mailbox.c +@@ -122,6 +122,7 @@ struct imx_mu_dcfg { + u32 xRR; /* Receive Register0 */ + u32 xSR[IMX_MU_xSR_MAX]; /* Status Registers */ + u32 xCR[IMX_MU_xCR_MAX]; /* Control Registers */ ++ bool skip_suspend_flag; + }; + + #define IMX_MU_xSR_GIPn(type, x) (type & IMX_MU_V2 ? BIT(x) : BIT(28 + (3 - (x)))) +@@ -988,6 +989,7 @@ static const struct imx_mu_dcfg imx_mu_cfg_imx7ulp = { + .xRR = 0x40, + .xSR = {0x60, 0x60, 0x60, 0x60}, + .xCR = {0x64, 0x64, 0x64, 0x64, 0x64}, ++ .skip_suspend_flag = true, + }; + + static const struct imx_mu_dcfg imx_mu_cfg_imx8ulp = { +@@ -1071,7 +1073,8 @@ static int __maybe_unused imx_mu_suspend_noirq(struct device *dev) + priv->xcr[i] = imx_mu_read(priv, priv->dcfg->xCR[i]); + } + +- priv->suspend = true; ++ if (!priv->dcfg->skip_suspend_flag) ++ priv->suspend = true; + + return 0; + } +@@ -1094,7 +1097,8 @@ static int __maybe_unused imx_mu_resume_noirq(struct device *dev) + imx_mu_write(priv, priv->xcr[i], priv->dcfg->xCR[i]); + } + +- priv->suspend = false; ++ if (!priv->dcfg->skip_suspend_flag) ++ priv->suspend = false; + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.12/mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch b/queue-6.12/mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch new file mode 100644 index 00000000000..465a5f4846f --- /dev/null +++ b/queue-6.12/mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch @@ -0,0 +1,41 @@ +From 01ea7d8b81f3e46c9605a0ffcab29b965ee1c54f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jan 2026 14:07:40 +0000 +Subject: mailbox: pcc: Remove spurious IRQF_ONESHOT usage + +From: Mark Brown + +[ Upstream commit 673327028cd61db68a1e0c708be2e302c082adf9 ] + +The PCC code currently specifies IRQF_ONESHOT if the interrupt could +potentially be shared but doesn't actually use request_threaded_irq() and +the interrupt handler does not use IRQ_WAKE_THREAD so IRQF_ONESHOT is +never relevant. Since commit aef30c8d569c ("genirq: Warn about using +IRQF_ONESHOT without a threaded handler") specifying it has resulted in a +WARN_ON(), fix this by removing IRQF_ONESHOT. + +Reported-by: Aishwarya TCV +Signed-off-by: Mark Brown +Reviewed-by: Sudeep Holla +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/pcc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c +index 2b7d0bc920726..1d4191cb91380 100644 +--- a/drivers/mailbox/pcc.c ++++ b/drivers/mailbox/pcc.c +@@ -481,7 +481,7 @@ static int pcc_startup(struct mbox_chan *chan) + + if (pchan->plat_irq > 0) { + irqflags = pcc_chan_plat_irq_can_be_shared(pchan) ? +- IRQF_SHARED | IRQF_ONESHOT : 0; ++ IRQF_SHARED : 0; + rc = devm_request_irq(chan->mbox->dev, pchan->plat_irq, pcc_mbox_irq, + irqflags, MBOX_IRQ_NAME, chan); + if (unlikely(rc)) { +-- +2.51.0 + diff --git a/queue-6.12/mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch b/queue-6.12/mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch new file mode 100644 index 00000000000..fa1cd5912c7 --- /dev/null +++ b/queue-6.12/mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch @@ -0,0 +1,57 @@ +From 33dd593d62c373b405b2944cc5b048fcbb19b721 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 16:43:36 +0100 +Subject: mailbox: sprd: clear delivery flag before handling TX done +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Otto Pflüger + +[ Upstream commit c77661d60d4223bf2ff10d409beb0c3b2021183b ] + +If there are any pending messages in the mailbox queue, they are sent +as soon as a TX done event arrives from the driver. This may trigger a +new delivery interrupt while the previous one is still being handled. +If the delivery status is cleared after this, the interrupt is lost. +To prevent this from happening, clear the delivery status immediately +after checking it and before any new messages are sent. + +Signed-off-by: Otto Pflüger +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/sprd-mailbox.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c +index c1a5fe6cc8771..46d0c34177ab9 100644 +--- a/drivers/mailbox/sprd-mailbox.c ++++ b/drivers/mailbox/sprd-mailbox.c +@@ -166,6 +166,11 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data) + return IRQ_NONE; + } + ++ /* Clear FIFO delivery and overflow status first */ ++ writel(fifo_sts & ++ (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK), ++ priv->inbox_base + SPRD_MBOX_FIFO_RST); ++ + while (send_sts) { + id = __ffs(send_sts); + send_sts &= (send_sts - 1); +@@ -181,11 +186,6 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data) + mbox_chan_txdone(chan, 0); + } + +- /* Clear FIFO delivery and overflow status */ +- writel(fifo_sts & +- (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK), +- priv->inbox_base + SPRD_MBOX_FIFO_RST); +- + /* Clear irq status */ + writel(SPRD_MBOX_IRQ_CLR, priv->inbox_base + SPRD_MBOX_IRQ_STS); + +-- +2.51.0 + diff --git a/queue-6.12/mailbox-sprd-mask-interrupts-that-are-not-handled.patch b/queue-6.12/mailbox-sprd-mask-interrupts-that-are-not-handled.patch new file mode 100644 index 00000000000..2a9eb73712a --- /dev/null +++ b/queue-6.12/mailbox-sprd-mask-interrupts-that-are-not-handled.patch @@ -0,0 +1,55 @@ +From cba2fb6b669c552726f644801656df3e3d71f453 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 16:43:38 +0100 +Subject: mailbox: sprd: mask interrupts that are not handled +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Otto Pflüger + +[ Upstream commit 75df94d05fc03fd9d861eaf79ce10fbb7a548bd8 ] + +To reduce the amount of spurious interrupts, disable the interrupts that +are not handled in this driver. + +Signed-off-by: Otto Pflüger +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/sprd-mailbox.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c +index ee8539dfcef54..c1a5fe6cc8771 100644 +--- a/drivers/mailbox/sprd-mailbox.c ++++ b/drivers/mailbox/sprd-mailbox.c +@@ -243,21 +243,19 @@ static int sprd_mbox_startup(struct mbox_chan *chan) + /* Select outbox FIFO mode and reset the outbox FIFO status */ + writel(0x0, priv->outbox_base + SPRD_MBOX_FIFO_RST); + +- /* Enable inbox FIFO overflow and delivery interrupt */ +- val = readl(priv->inbox_base + SPRD_MBOX_IRQ_MSK); +- val &= ~(SPRD_INBOX_FIFO_OVERFLOW_IRQ | SPRD_INBOX_FIFO_DELIVER_IRQ); ++ /* Enable inbox FIFO delivery interrupt */ ++ val = SPRD_INBOX_FIFO_IRQ_MASK; ++ val &= ~SPRD_INBOX_FIFO_DELIVER_IRQ; + writel(val, priv->inbox_base + SPRD_MBOX_IRQ_MSK); + + /* Enable outbox FIFO not empty interrupt */ +- val = readl(priv->outbox_base + SPRD_MBOX_IRQ_MSK); ++ val = SPRD_OUTBOX_FIFO_IRQ_MASK; + val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ; + writel(val, priv->outbox_base + SPRD_MBOX_IRQ_MSK); + + /* Enable supplementary outbox as the fundamental one */ + if (priv->supp_base) { + writel(0x0, priv->supp_base + SPRD_MBOX_FIFO_RST); +- val = readl(priv->supp_base + SPRD_MBOX_IRQ_MSK); +- val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ; + writel(val, priv->supp_base + SPRD_MBOX_IRQ_MSK); + } + } +-- +2.51.0 + diff --git a/queue-6.12/md-cluster-fix-null-pointer-dereference-in-process_m.patch b/queue-6.12/md-cluster-fix-null-pointer-dereference-in-process_m.patch new file mode 100644 index 00000000000..26b4212e900 --- /dev/null +++ b/queue-6.12/md-cluster-fix-null-pointer-dereference-in-process_m.patch @@ -0,0 +1,61 @@ +From b68d34fb39900dcf3227d5a2732da544b77af9d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jan 2026 14:59:03 +0000 +Subject: md-cluster: fix NULL pointer dereference in process_metadata_update + +From: Jiasheng Jiang + +[ Upstream commit f150e753cb8dd756085f46e86f2c35ce472e0a3c ] + +The function process_metadata_update() blindly dereferences the 'thread' +pointer (acquired via rcu_dereference_protected) within the wait_event() +macro. + +While the code comment states "daemon thread must exist", there is a valid +race condition window during the MD array startup sequence (md_run): + +1. bitmap_load() is called, which invokes md_cluster_ops->join(). +2. join() starts the "cluster_recv" thread (recv_daemon). +3. At this point, recv_daemon is active and processing messages. +4. However, mddev->thread (the main MD thread) is not initialized until + later in md_run(). + +If a METADATA_UPDATED message is received from a remote node during this +specific window, process_metadata_update() will be called while +mddev->thread is still NULL, leading to a kernel panic. + +To fix this, we must validate the 'thread' pointer. If it is NULL, we +release the held lock (no_new_dev_lockres) and return early, safely +ignoring the update request as the array is not yet fully ready to +process it. + +Link: https://lore.kernel.org/linux-raid/20260117145903.28921-1-jiashengjiangcool@gmail.com +Signed-off-by: Jiasheng Jiang +Signed-off-by: Yu Kuai +Signed-off-by: Sasha Levin +--- + drivers/md/md-cluster.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c +index 6595f89becdb7..bf9ab478df2c0 100644 +--- a/drivers/md/md-cluster.c ++++ b/drivers/md/md-cluster.c +@@ -549,8 +549,13 @@ static void process_metadata_update(struct mddev *mddev, struct cluster_msg *msg + + dlm_lock_sync(cinfo->no_new_dev_lockres, DLM_LOCK_CR); + +- /* daemaon thread must exist */ + thread = rcu_dereference_protected(mddev->thread, true); ++ if (!thread) { ++ pr_warn("md-cluster: Received metadata update but MD thread is not ready\n"); ++ dlm_unlock_sync(cinfo->no_new_dev_lockres); ++ return; ++ } ++ + wait_event(thread->wqueue, + (got_lock = mddev_trylock(mddev)) || + test_bit(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD, &cinfo->state)); +-- +2.51.0 + diff --git a/queue-6.12/media-adv7180-fix-frame-interval-in-progressive-mode.patch b/queue-6.12/media-adv7180-fix-frame-interval-in-progressive-mode.patch new file mode 100644 index 00000000000..94c35acad52 --- /dev/null +++ b/queue-6.12/media-adv7180-fix-frame-interval-in-progressive-mode.patch @@ -0,0 +1,49 @@ +From eb7526c6704068996bef89c09a3bb63fd11fe65b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 15:29:57 +0100 +Subject: media: adv7180: fix frame interval in progressive mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thorsten Schmelzer + +[ Upstream commit 90289b67c5c1d4c18784059b27460d292e16d208 ] + +The ADV7280-M may internally convert interlaced video input to +progressive video. If this mode is enabled, the ADV7280-M delivers +progressive video frames at the field rate of 50 fields per second (PAL) +or 60 fields per second (NTSC). + +Fix the reported frame interval if progressive video is enabled. + +Signed-off-by: Thorsten Schmelzer +Reviewed-by: Niklas Söderlund +Signed-off-by: Michael Tretter +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/adv7180.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c +index f3f47beff76bb..36e0f7a8c6d57 100644 +--- a/drivers/media/i2c/adv7180.c ++++ b/drivers/media/i2c/adv7180.c +@@ -480,6 +480,13 @@ static int adv7180_get_frame_interval(struct v4l2_subdev *sd, + fi->interval.denominator = 25; + } + ++ /* ++ * If the de-interlacer is active, the chip produces full video frames ++ * at the field rate. ++ */ ++ if (state->field == V4L2_FIELD_NONE) ++ fi->interval.denominator *= 2; ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.12/media-amphion-clear-last_buffer_dequeued-flag-for-de.patch b/queue-6.12/media-amphion-clear-last_buffer_dequeued-flag-for-de.patch new file mode 100644 index 00000000000..4063ccbf2d5 --- /dev/null +++ b/queue-6.12/media-amphion-clear-last_buffer_dequeued-flag-for-de.patch @@ -0,0 +1,38 @@ +From 2fce3a226e9c4683ab2ecdf359b6a9836c9bf122 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Dec 2025 11:02:22 +0800 +Subject: media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START + +From: Ming Qian + +[ Upstream commit d85f3207d75df6d7a08be6526b15ff398668206c ] + +The V4L2_DEC_CMD_START command may be used to handle the dynamic source +change, which will triggers an implicit decoder drain. +The last_buffer_dequeued flag is set in the implicit decoder drain, +so driver need to clear it to continue the following decoding flow. + +Signed-off-by: Ming Qian +Reviewed-by: Nicolas Dufresne +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/amphion/vdec.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/platform/amphion/vdec.c b/drivers/media/platform/amphion/vdec.c +index 6a38a0fa0e2d4..86abc1ca202c6 100644 +--- a/drivers/media/platform/amphion/vdec.c ++++ b/drivers/media/platform/amphion/vdec.c +@@ -630,6 +630,7 @@ static int vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd + switch (cmd->cmd) { + case V4L2_DEC_CMD_START: + vdec_cmd_start(inst); ++ vb2_clear_last_buffer_dequeued(v4l2_m2m_get_dst_vq(inst->fh.m2m_ctx)); + break; + case V4L2_DEC_CMD_STOP: + vdec_cmd_stop(inst); +-- +2.51.0 + diff --git a/queue-6.12/media-chips-media-wave5-fix-conditional-in-start_str.patch b/queue-6.12/media-chips-media-wave5-fix-conditional-in-start_str.patch new file mode 100644 index 00000000000..f68a9dfb277 --- /dev/null +++ b/queue-6.12/media-chips-media-wave5-fix-conditional-in-start_str.patch @@ -0,0 +1,43 @@ +From 6f657a57aed2ad53bad856aa3b511bf1ee186780 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Oct 2025 15:46:17 -0500 +Subject: media: chips-media: wave5: Fix conditional in start_streaming + +From: Brandon Brnich + +[ Upstream commit b4e26c6fc1b3c225caf80d4a95c6f9fcbe959e17 ] + +When STREAMON(CAP) is called after STREAMON(OUT), the driver was failing to +switch states from VPU_INST_STATE_OPEN to VPU_INST_STATE_INIT_SEQ and +VPU_INST_STATE_PIC_RUN because the capture queue streaming boolean had not +yet been set to true. This led to a hang in the encoder since the state +was stuck in VPU_INST_STATE_OPEN. During the second call to +start_streaming, the sequence initialization and frame buffer allocation +should occur. + +Signed-off-by: Brandon Brnich +Reviewed-by: Nicolas Dufresne +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c +index a1330c54b17e6..d62e8976bc52e 100644 +--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c ++++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c +@@ -1336,7 +1336,8 @@ static int wave5_vpu_enc_start_streaming(struct vb2_queue *q, unsigned int count + if (ret) + goto return_buffers; + } +- if (inst->state == VPU_INST_STATE_OPEN && m2m_ctx->cap_q_ctx.q.streaming) { ++ if (inst->state == VPU_INST_STATE_OPEN && ++ (m2m_ctx->cap_q_ctx.q.streaming || q->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE)) { + ret = initialize_sequence(inst); + if (ret) { + dev_warn(inst->dev->dev, "Sequence not found: %d\n", ret); +-- +2.51.0 + diff --git a/queue-6.12/media-chips-media-wave5-process-ready-frames-when-cm.patch b/queue-6.12/media-chips-media-wave5-process-ready-frames-when-cm.patch new file mode 100644 index 00000000000..ab2b0db8a85 --- /dev/null +++ b/queue-6.12/media-chips-media-wave5-process-ready-frames-when-cm.patch @@ -0,0 +1,39 @@ +From 6e61c3ac314b49159fd6268dbe664751a1757a8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Oct 2025 15:46:18 -0500 +Subject: media: chips-media: wave5: Process ready frames when CMD_STOP sent to + Encoder + +From: Brandon Brnich + +[ Upstream commit 5da0380de41439ed64ed9a5218850db38544e315 ] + +CMD_STOP being sent to encoder before last job is executed by device_run +can lead to an occasional dropped frame. Ensure that remaining ready +buffers are drained by making a call to v4l2_m2m_try_schedule. + +Signed-off-by: Brandon Brnich +Reviewed-by: Nicolas Dufresne +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c +index d62e8976bc52e..dd34946873ace 100644 +--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c ++++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c +@@ -640,6 +640,8 @@ static int wave5_vpu_enc_encoder_cmd(struct file *file, void *fh, struct v4l2_en + + m2m_ctx->last_src_buf = v4l2_m2m_last_src_buf(m2m_ctx); + m2m_ctx->is_draining = true; ++ ++ v4l2_m2m_try_schedule(m2m_ctx); + break; + case V4L2_ENC_CMD_START: + break; +-- +2.51.0 + diff --git a/queue-6.12/media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch b/queue-6.12/media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch new file mode 100644 index 00000000000..c7bae820b0f --- /dev/null +++ b/queue-6.12/media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch @@ -0,0 +1,34 @@ +From c56a6335112c573b25c2eeb1f4ec303a92dd5678 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Jan 2026 15:46:47 +0800 +Subject: media: cx25821: Fix a resource leak in cx25821_dev_setup() + +From: Haoxiang Li + +[ Upstream commit 68cd8ac994cac38a305200f638b30e13c690753b ] + +Add release_mem_region() if ioremap() fails to release the memory +region obtained by cx25821_get_resources(). + +Signed-off-by: Haoxiang Li +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/cx25821/cx25821-core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c +index 6627fa9166d30..a7336be444748 100644 +--- a/drivers/media/pci/cx25821/cx25821-core.c ++++ b/drivers/media/pci/cx25821/cx25821-core.c +@@ -908,6 +908,7 @@ static int cx25821_dev_setup(struct cx25821_dev *dev) + + if (!dev->lmmio) { + CX25821_ERR("ioremap failed, maybe increasing __VMALLOC_RESERVE in page.h\n"); ++ release_mem_region(dev->base_io_addr, pci_resource_len(dev->pci, 0)); + cx25821_iounmap(dev); + return -ENOMEM; + } +-- +2.51.0 + diff --git a/queue-6.12/media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch b/queue-6.12/media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch new file mode 100644 index 00000000000..53cbd986210 --- /dev/null +++ b/queue-6.12/media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch @@ -0,0 +1,110 @@ +From 02c74b4adbb81830c8ea3596dc9418d19ccd58ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Jun 2025 08:57:35 +0200 +Subject: media: dvb-core: dmxdevfilter must always flush bufs + +From: Hans Verkuil + +[ Upstream commit c4e620eccbef76aa5564ebb295e23d6540e27215 ] + +Currently the buffers are being filled until full, which works fine +for the transport stream, but not when reading sections, those have +to be returned to userspace immediately, otherwise dvbv5-scan will +just wait forever. + +Add a 'flush' argument to dvb_vb2_fill_buffer to indicate whether +the buffer must be flushed or wait until it is full. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-core/dmxdev.c | 8 ++++---- + drivers/media/dvb-core/dvb_vb2.c | 5 +++-- + include/media/dvb_vb2.h | 6 ++++-- + 3 files changed, 11 insertions(+), 8 deletions(-) + +diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c +index 9ce5f010de3f8..804fb339f7355 100644 +--- a/drivers/media/dvb-core/dmxdev.c ++++ b/drivers/media/dvb-core/dmxdev.c +@@ -396,11 +396,11 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len, + if (dvb_vb2_is_streaming(&dmxdevfilter->vb2_ctx)) { + ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx, + buffer1, buffer1_len, +- buffer_flags); ++ buffer_flags, true); + if (ret == buffer1_len) + ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx, + buffer2, buffer2_len, +- buffer_flags); ++ buffer_flags, true); + } else { + ret = dvb_dmxdev_buffer_write(&dmxdevfilter->buffer, + buffer1, buffer1_len); +@@ -451,10 +451,10 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len, + + if (dvb_vb2_is_streaming(ctx)) { + ret = dvb_vb2_fill_buffer(ctx, buffer1, buffer1_len, +- buffer_flags); ++ buffer_flags, false); + if (ret == buffer1_len) + ret = dvb_vb2_fill_buffer(ctx, buffer2, buffer2_len, +- buffer_flags); ++ buffer_flags, false); + } else { + if (buffer->error) { + spin_unlock(&dmxdevfilter->dev->lock); +diff --git a/drivers/media/dvb-core/dvb_vb2.c b/drivers/media/dvb-core/dvb_vb2.c +index 29edaaff7a5c9..7444bbc2f24d9 100644 +--- a/drivers/media/dvb-core/dvb_vb2.c ++++ b/drivers/media/dvb-core/dvb_vb2.c +@@ -249,7 +249,8 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx) + + int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx, + const unsigned char *src, int len, +- enum dmx_buffer_flags *buffer_flags) ++ enum dmx_buffer_flags *buffer_flags, ++ bool flush) + { + unsigned long flags = 0; + void *vbuf = NULL; +@@ -306,7 +307,7 @@ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx, + } + } + +- if (ctx->nonblocking && ctx->buf) { ++ if (flush && ctx->buf) { + vb2_set_plane_payload(&ctx->buf->vb, 0, ll); + vb2_buffer_done(&ctx->buf->vb, VB2_BUF_STATE_DONE); + list_del(&ctx->buf->list); +diff --git a/include/media/dvb_vb2.h b/include/media/dvb_vb2.h +index 8cb88452cd6c2..0fbbfc65157e6 100644 +--- a/include/media/dvb_vb2.h ++++ b/include/media/dvb_vb2.h +@@ -124,7 +124,7 @@ static inline int dvb_vb2_release(struct dvb_vb2_ctx *ctx) + return 0; + }; + #define dvb_vb2_is_streaming(ctx) (0) +-#define dvb_vb2_fill_buffer(ctx, file, wait, flags) (0) ++#define dvb_vb2_fill_buffer(ctx, file, wait, flags, flush) (0) + + static inline __poll_t dvb_vb2_poll(struct dvb_vb2_ctx *ctx, + struct file *file, +@@ -166,10 +166,12 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx); + * @buffer_flags: + * pointer to buffer flags as defined by &enum dmx_buffer_flags. + * can be NULL. ++ * @flush: flush the buffer, even if it isn't full. + */ + int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx, + const unsigned char *src, int len, +- enum dmx_buffer_flags *buffer_flags); ++ enum dmx_buffer_flags *buffer_flags, ++ bool flush); + + /** + * dvb_vb2_poll - Wrapper to vb2_core_streamon() for Digital TV +-- +2.51.0 + diff --git a/queue-6.12/media-ipu6-always-close-firmware-stream.patch b/queue-6.12/media-ipu6-always-close-firmware-stream.patch new file mode 100644 index 00000000000..d3bb62fbfd9 --- /dev/null +++ b/queue-6.12/media-ipu6-always-close-firmware-stream.patch @@ -0,0 +1,45 @@ +From 63fe87a869a4fb33677499338e37bf1675c3e687 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 23:55:31 +0200 +Subject: media: ipu6: Always close firmware stream + +From: Sakari Ailus + +[ Upstream commit 2b08b7007e55bd1793a58478d3ecea4fd95849a5 ] + +Close the firmware stream even when disabling a stream on an upstream +sub-device fails. This allows the firmware to release resources related to +a stream that is stopped in any case. + +Suggested-by: Bingbu Cao +Signed-off-by: Sakari Ailus +Reviewed-by: Bingbu Cao +Tested-by: Mehdi Djait # Dell XPS 9315 +Reviewed-by: Mehdi Djait +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/intel/ipu6/ipu6-isys-video.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c +index 0ea892d1f51e1..f25ea042598b0 100644 +--- a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c ++++ b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c +@@ -1023,11 +1023,10 @@ int ipu6_isys_video_set_streaming(struct ipu6_isys_video *av, int state, + sd->name, r_pad->index, stream_mask); + ret = v4l2_subdev_disable_streams(sd, r_pad->index, + stream_mask); +- if (ret) { ++ if (ret) + dev_err(dev, "stream off %s failed with %d\n", sd->name, + ret); +- return ret; +- } ++ + close_streaming_firmware(av); + } else { + ret = start_stream_firmware(av, bl); +-- +2.51.0 + diff --git a/queue-6.12/media-ipu6-close-firmware-streams-on-streaming-enabl.patch b/queue-6.12/media-ipu6-close-firmware-streams-on-streaming-enabl.patch new file mode 100644 index 00000000000..368642aab44 --- /dev/null +++ b/queue-6.12/media-ipu6-close-firmware-streams-on-streaming-enabl.patch @@ -0,0 +1,37 @@ +From 803ec859d91c7f28044cc3ffb811848f621462dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Dec 2025 00:05:38 +0200 +Subject: media: ipu6: Close firmware streams on streaming enable failure + +From: Sakari Ailus + +[ Upstream commit 5925a92cc70d10c7d3124923c36da09b9c1a6eeb ] + +When enabling streaming fails, the stream is stopped in firmware but not +closed. Do this to release resources on firmware side. + +Signed-off-by: Sakari Ailus +Reviewed-by: Bingbu Cao +Tested-by: Mehdi Djait # Dell XPS 9315 +Reviewed-by: Mehdi Djait +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/intel/ipu6/ipu6-isys-video.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c +index 48388c0c851ca..0ea892d1f51e1 100644 +--- a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c ++++ b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c +@@ -1053,6 +1053,7 @@ int ipu6_isys_video_set_streaming(struct ipu6_isys_video *av, int state, + + out_media_entity_stop_streaming_firmware: + stop_streaming_firmware(av); ++ close_streaming_firmware(av); + + return ret; + } +-- +2.51.0 + diff --git a/queue-6.12/media-ipu6-ensure-stream_mutex-is-acquired-when-deal.patch b/queue-6.12/media-ipu6-ensure-stream_mutex-is-acquired-when-deal.patch new file mode 100644 index 00000000000..4588d966666 --- /dev/null +++ b/queue-6.12/media-ipu6-ensure-stream_mutex-is-acquired-when-deal.patch @@ -0,0 +1,73 @@ +From 3fe4a522038f4f1155412fec816001687e32e24f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Nov 2025 14:14:22 +0200 +Subject: media: ipu6: Ensure stream_mutex is acquired when dealing with node + list + +From: Sakari Ailus + +[ Upstream commit 779bdaad2abf718fb8116839e818e58852874b4d ] + +The ipu6 isys driver maintains the list of video buffer queues related to +a stream (in ipu6 context streams on the same CSI-2 virtual channel) and +this list is modified through VIDIOC_STREAMON and VIDIOC_STREAMOFF IOCTLs. +Ensure the common mutex is acquired when accessing the linked list, i.e. +the isys device context's stream_mutex. + +Add a lockdep assert to ipu6_isys_get_buffer_list() and switch to guard() +while at it as the error handling becomes more simple this way. + +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/intel/ipu6/ipu6-isys-queue.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c b/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c +index bbb66b56ee88c..c2acf70af347e 100644 +--- a/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c ++++ b/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c +@@ -3,6 +3,7 @@ + * Copyright (C) 2013--2024 Intel Corporation + */ + #include ++#include + #include + #include + #include +@@ -201,6 +202,8 @@ static int buffer_list_get(struct ipu6_isys_stream *stream, + unsigned long flags; + unsigned long buf_flag = IPU6_ISYS_BUFFER_LIST_FL_INCOMING; + ++ lockdep_assert_held(&stream->mutex); ++ + bl->nbufs = 0; + INIT_LIST_HEAD(&bl->head); + +@@ -294,9 +297,8 @@ static int ipu6_isys_stream_start(struct ipu6_isys_video *av, + struct ipu6_isys_buffer_list __bl; + int ret; + +- mutex_lock(&stream->isys->stream_mutex); ++ guard(mutex)(&stream->isys->stream_mutex); + ret = ipu6_isys_video_set_streaming(av, 1, bl); +- mutex_unlock(&stream->isys->stream_mutex); + if (ret) + goto out_requeue; + +@@ -637,10 +639,10 @@ static void stop_streaming(struct vb2_queue *q) + mutex_lock(&av->isys->stream_mutex); + if (stream->nr_streaming == stream->nr_queues && stream->streaming) + ipu6_isys_video_set_streaming(av, 0, NULL); ++ list_del(&aq->node); + mutex_unlock(&av->isys->stream_mutex); + + stream->nr_streaming--; +- list_del(&aq->node); + stream->streaming = 0; + mutex_unlock(&stream->mutex); + +-- +2.51.0 + diff --git a/queue-6.12/media-mediatek-vcodec-don-t-try-to-decode-422-444-vp.patch b/queue-6.12/media-mediatek-vcodec-don-t-try-to-decode-422-444-vp.patch new file mode 100644 index 00000000000..75f1e1ada3e --- /dev/null +++ b/queue-6.12/media-mediatek-vcodec-don-t-try-to-decode-422-444-vp.patch @@ -0,0 +1,40 @@ +From 573511d91a9a23ab458ec97fe898f4fb93ae8565 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Nov 2025 14:16:16 -0500 +Subject: media: mediatek: vcodec: Don't try to decode 422/444 VP9 + +From: Nicolas Dufresne + +[ Upstream commit 3e92d7e4935084ecdbdc88880cc4688618ae1557 ] + +This is not supported by the hardware and trying to decode +these leads to LAT timeout errors. + +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c +index 3307dc15fc1df..f5aa0b06f9e70 100644 +--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c ++++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c +@@ -504,6 +504,12 @@ static int mtk_vdec_s_ctrl(struct v4l2_ctrl *ctrl) + mtk_v4l2_vdec_err(ctx, "VP9: bit_depth:%d", frame->bit_depth); + return -EINVAL; + } ++ ++ if (!(frame->flags & V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING) || ++ !(frame->flags & V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING)) { ++ mtk_v4l2_vdec_err(ctx, "VP9: only 420 subsampling is supported"); ++ return -EINVAL; ++ } + break; + case V4L2_CID_STATELESS_AV1_SEQUENCE: + seq = (struct v4l2_ctrl_av1_sequence *)hdr_ctrl->p_new.p; +-- +2.51.0 + diff --git a/queue-6.12/media-mt9m114-avoid-a-reset-low-spike-during-probe.patch b/queue-6.12/media-mt9m114-avoid-a-reset-low-spike-during-probe.patch new file mode 100644 index 00000000000..6a63b8fd6ec --- /dev/null +++ b/queue-6.12/media-mt9m114-avoid-a-reset-low-spike-during-probe.patch @@ -0,0 +1,55 @@ +From f34cec7681f0f031f55650481dc2ab479b3cef55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Dec 2025 18:03:03 +0100 +Subject: media: mt9m114: Avoid a reset low spike during probe() + +From: Hans de Goede + +[ Upstream commit 84359d0a5e3afce5e3e3b6562efadff690614d5b ] + +mt9m114_probe() requests the reset GPIO in output low state: + + sensor->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW); + +and then almost immediately afterwards calls mt9m114_power_on() which does: + + gpiod_set_value(sensor->reset, 1); + fsleep(duration); + gpiod_set_value(sensor->reset, 0); + +which means that if the reset pin was high before this code runs that +it will very briefly be driven low because of passing GPIOD_OUT_LOW when +requesting the GPIO only to be driven high again possibly directly after +that. Such a very brief driving low of the reset pin may put the chip in +a confused state. + +Request the GPIO in high (reset the chip) state instead to avoid this, +turning the initial gpiod_set_value() in mt9m114_power_on() into a no-op. +and the fsleep() ensures that it will stay high long enough to properly +reset the chip. + +Reviewed-by: Laurent Pinchart +Signed-off-by: Hans de Goede +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/mt9m114.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/mt9m114.c b/drivers/media/i2c/mt9m114.c +index c00f9412d08eb..de5227bdf7e65 100644 +--- a/drivers/media/i2c/mt9m114.c ++++ b/drivers/media/i2c/mt9m114.c +@@ -2359,7 +2359,7 @@ static int mt9m114_probe(struct i2c_client *client) + goto error_ep_free; + } + +- sensor->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW); ++ sensor->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH); + if (IS_ERR(sensor->reset)) { + ret = PTR_ERR(sensor->reset); + dev_err_probe(dev, ret, "Failed to get reset GPIO\n"); +-- +2.51.0 + diff --git a/queue-6.12/media-mt9m114-return-eprobe_defer-if-no-endpoint-is-.patch b/queue-6.12/media-mt9m114-return-eprobe_defer-if-no-endpoint-is-.patch new file mode 100644 index 00000000000..df1f8aae9c5 --- /dev/null +++ b/queue-6.12/media-mt9m114-return-eprobe_defer-if-no-endpoint-is-.patch @@ -0,0 +1,50 @@ +From 8a7492ef34d9b1b703f051c826a808dd28566c9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Dec 2025 18:03:10 +0100 +Subject: media: mt9m114: Return -EPROBE_DEFER if no endpoint is found + +From: Hans de Goede + +[ Upstream commit 437e1f6a960035166495a5117aacbc596115eeb6 ] + +With IPU# bridges, endpoints may only be created when the IPU bridge is +initialized. This may happen after the sensor driver's first probe(). + +Reviewed-by: Laurent Pinchart +Signed-off-by: Hans de Goede +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/mt9m114.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/i2c/mt9m114.c b/drivers/media/i2c/mt9m114.c +index de5227bdf7e65..4100f7ffe5e16 100644 +--- a/drivers/media/i2c/mt9m114.c ++++ b/drivers/media/i2c/mt9m114.c +@@ -2296,11 +2296,17 @@ static int mt9m114_parse_dt(struct mt9m114 *sensor) + struct fwnode_handle *ep; + int ret; + ++ /* ++ * On ACPI systems the fwnode graph can be initialized by a bridge ++ * driver, which may not have probed yet. Wait for this. ++ * ++ * TODO: Return an error once bridge driver code will have moved ++ * to the ACPI core. ++ */ + ep = fwnode_graph_get_next_endpoint(fwnode, NULL); +- if (!ep) { +- dev_err(&sensor->client->dev, "No endpoint found\n"); +- return -EINVAL; +- } ++ if (!ep) ++ return dev_err_probe(&sensor->client->dev, -EPROBE_DEFER, ++ "waiting for fwnode graph endpoint\n"); + + sensor->bus_cfg.bus_type = V4L2_MBUS_UNKNOWN; + ret = v4l2_fwnode_endpoint_alloc_parse(ep, &sensor->bus_cfg); +-- +2.51.0 + diff --git a/queue-6.12/media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch b/queue-6.12/media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch new file mode 100644 index 00000000000..6dd54e46d50 --- /dev/null +++ b/queue-6.12/media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch @@ -0,0 +1,53 @@ +From d875c2d35c97c20ba36f0e6e7fa950e7e830047f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Oct 2025 15:26:40 +0200 +Subject: media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes + +From: Hans Verkuil + +[ Upstream commit 44c03802a5191626996ee9db4bac090b164ca340 ] + +The isp_video_mbus_to_pix/pix_to_mbus functions did not take +the last empty entry { 0, } of the formats array into account. + +As a result, isp_video_mbus_to_pix would accept code 0 and +isp_video_pix_to_mbus would select code 0 if no match was found. + +Signed-off-by: Hans Verkuil +Acked-by: Sakari Ailus +Signed-off-by: Sasha Levin +--- + drivers/media/platform/ti/omap3isp/ispvideo.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/ti/omap3isp/ispvideo.c b/drivers/media/platform/ti/omap3isp/ispvideo.c +index daca689dc0825..7334e1b4f0b2b 100644 +--- a/drivers/media/platform/ti/omap3isp/ispvideo.c ++++ b/drivers/media/platform/ti/omap3isp/ispvideo.c +@@ -148,12 +148,12 @@ static unsigned int isp_video_mbus_to_pix(const struct isp_video *video, + pix->width = mbus->width; + pix->height = mbus->height; + +- for (i = 0; i < ARRAY_SIZE(formats); ++i) { ++ for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) { + if (formats[i].code == mbus->code) + break; + } + +- if (WARN_ON(i == ARRAY_SIZE(formats))) ++ if (WARN_ON(i == ARRAY_SIZE(formats) - 1)) + return 0; + + min_bpl = pix->width * formats[i].bpp; +@@ -191,7 +191,7 @@ static void isp_video_pix_to_mbus(const struct v4l2_pix_format *pix, + /* Skip the last format in the loop so that it will be selected if no + * match is found. + */ +- for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) { ++ for (i = 0; i < ARRAY_SIZE(formats) - 2; ++i) { + if (formats[i].pixelformat == pix->pixelformat) + break; + } +-- +2.51.0 + diff --git a/queue-6.12/media-omap3isp-isppreview-always-clamp-in-preview_tr.patch b/queue-6.12/media-omap3isp-isppreview-always-clamp-in-preview_tr.patch new file mode 100644 index 00000000000..19446a4a9a9 --- /dev/null +++ b/queue-6.12/media-omap3isp-isppreview-always-clamp-in-preview_tr.patch @@ -0,0 +1,63 @@ +From 78cc08ee22d7c8e441e862753d5227758d42f6a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 17:09:18 +0200 +Subject: media: omap3isp: isppreview: always clamp in preview_try_format() + +From: Hans Verkuil + +[ Upstream commit 17e1e1641f74a89824d4de3aa38c78daa5686cc1 ] + +If prev->input != PREVIEW_INPUT_MEMORY the width and height weren't +clamped. Just always clamp. + +This fixes a v4l2-compliance error: + + fail: v4l2-test-subdevs.cpp(171): fse.max_width == ~0U || fse.max_height == ~0U + fail: v4l2-test-subdevs.cpp(270): ret && ret != ENOTTY +test Try VIDIOC_SUBDEV_ENUM_MBUS_CODE/FRAME_SIZE/FRAME_INTERVAL: FAIL + +Signed-off-by: Hans Verkuil +Acked-by: Sakari Ailus +Signed-off-by: Sasha Levin +--- + .../media/platform/ti/omap3isp/isppreview.c | 21 +++++++------------ + 1 file changed, 8 insertions(+), 13 deletions(-) + +diff --git a/drivers/media/platform/ti/omap3isp/isppreview.c b/drivers/media/platform/ti/omap3isp/isppreview.c +index e383a57654de8..5c492b31b5160 100644 +--- a/drivers/media/platform/ti/omap3isp/isppreview.c ++++ b/drivers/media/platform/ti/omap3isp/isppreview.c +@@ -1742,22 +1742,17 @@ static void preview_try_format(struct isp_prev_device *prev, + + switch (pad) { + case PREV_PAD_SINK: +- /* When reading data from the CCDC, the input size has already +- * been mangled by the CCDC output pad so it can be accepted +- * as-is. +- * +- * When reading data from memory, clamp the requested width and +- * height. The TRM doesn't specify a minimum input height, make ++ /* ++ * Clamp the requested width and height. ++ * The TRM doesn't specify a minimum input height, make + * sure we got enough lines to enable the noise filter and color + * filter array interpolation. + */ +- if (prev->input == PREVIEW_INPUT_MEMORY) { +- fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH, +- preview_max_out_width(prev)); +- fmt->height = clamp_t(u32, fmt->height, +- PREV_MIN_IN_HEIGHT, +- PREV_MAX_IN_HEIGHT); +- } ++ fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH, ++ preview_max_out_width(prev)); ++ fmt->height = clamp_t(u32, fmt->height, ++ PREV_MIN_IN_HEIGHT, ++ PREV_MAX_IN_HEIGHT); + + fmt->colorspace = V4L2_COLORSPACE_SRGB; + +-- +2.51.0 + diff --git a/queue-6.12/media-omap3isp-set-initial-format.patch b/queue-6.12/media-omap3isp-set-initial-format.patch new file mode 100644 index 00000000000..9ea07d44050 --- /dev/null +++ b/queue-6.12/media-omap3isp-set-initial-format.patch @@ -0,0 +1,51 @@ +From 95cbad5e5bc9de4233f3cc1dfa8e6e0cde698c82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Apr 2025 09:21:53 +0200 +Subject: media: omap3isp: set initial format + +From: Hans Verkuil + +[ Upstream commit 7575b8dfa91f82fcb34ffd5568ff415ac4685794 ] + +Initialize the v4l2_format to a default. Empty formats are +not allowed in V4L2, so this fixes v4l2-compliance issues: + + fail: v4l2-test-formats.cpp(514): !pix.width || !pix.height +test VIDIOC_G_FMT: FAIL + +Signed-off-by: Hans Verkuil +Acked-by: Sakari Ailus +Signed-off-by: Sasha Levin +--- + drivers/media/platform/ti/omap3isp/ispvideo.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/media/platform/ti/omap3isp/ispvideo.c b/drivers/media/platform/ti/omap3isp/ispvideo.c +index 7334e1b4f0b2b..b9e0b6215fa04 100644 +--- a/drivers/media/platform/ti/omap3isp/ispvideo.c ++++ b/drivers/media/platform/ti/omap3isp/ispvideo.c +@@ -1288,6 +1288,7 @@ static const struct v4l2_ioctl_ops isp_video_ioctl_ops = { + static int isp_video_open(struct file *file) + { + struct isp_video *video = video_drvdata(file); ++ struct v4l2_mbus_framefmt fmt; + struct isp_video_fh *handle; + struct vb2_queue *queue; + int ret = 0; +@@ -1329,6 +1330,13 @@ static int isp_video_open(struct file *file) + + memset(&handle->format, 0, sizeof(handle->format)); + handle->format.type = video->type; ++ handle->format.fmt.pix.width = 720; ++ handle->format.fmt.pix.height = 480; ++ handle->format.fmt.pix.pixelformat = V4L2_PIX_FMT_UYVY; ++ handle->format.fmt.pix.field = V4L2_FIELD_NONE; ++ handle->format.fmt.pix.colorspace = V4L2_COLORSPACE_SRGB; ++ isp_video_pix_to_mbus(&handle->format.fmt.pix, &fmt); ++ isp_video_mbus_to_pix(video, &fmt, &handle->format.fmt.pix); + handle->timeperframe.denominator = 1; + + handle->video = video; +-- +2.51.0 + diff --git a/queue-6.12/media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch b/queue-6.12/media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch new file mode 100644 index 00000000000..9e39eb1849e --- /dev/null +++ b/queue-6.12/media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch @@ -0,0 +1,48 @@ +From b8548ecf16840e93038e7f1688bbe93543b2590d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Dec 2025 19:24:19 +0100 +Subject: media: pvrusb2: fix URB leak in pvr2_send_request_ex + +From: Szymon Wilczek + +[ Upstream commit a8333c8262aed2aedf608c18edd39cf5342680a7 ] + +When pvr2_send_request_ex() submits a write URB successfully but fails to +submit the read URB (e.g. returns -ENOMEM), it returns immediately without +waiting for the write URB to complete. Since the driver reuses the same +URB structure, a subsequent call to pvr2_send_request_ex() attempts to +submit the still-active write URB, triggering a 'URB submitted while +active' warning in usb_submit_urb(). + +Fix this by ensuring the write URB is unlinked and waited upon if the read +URB submission fails. + +Reported-by: syzbot+405dcd13121ff75a9e16@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=405dcd13121ff75a9e16 +Signed-off-by: Szymon Wilczek +Acked-by: Mike Isely +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +index 2de104736f874..943d56b10251b 100644 +--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c ++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +@@ -3709,6 +3709,11 @@ status); + "Failed to submit read-control URB status=%d", + status); + hdw->ctl_read_pend_flag = 0; ++ if (hdw->ctl_write_pend_flag) { ++ usb_unlink_urb(hdw->ctl_write_urb); ++ while (hdw->ctl_write_pend_flag) ++ wait_for_completion(&hdw->ctl_done); ++ } + goto done; + } + } +-- +2.51.0 + diff --git a/queue-6.12/media-rkisp1-fix-filter-mode-register-configuration.patch b/queue-6.12/media-rkisp1-fix-filter-mode-register-configuration.patch new file mode 100644 index 00000000000..d0772131127 --- /dev/null +++ b/queue-6.12/media-rkisp1-fix-filter-mode-register-configuration.patch @@ -0,0 +1,53 @@ +From 342d841259698197644b2b2834d2b35b15968cc5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 12:11:42 -0500 +Subject: media: rkisp1: Fix filter mode register configuration + +From: Rui Wang + +[ Upstream commit 5a50f2b61104d0d351b59ec179f67abab7870453 ] + +The rkisp1_flt_config() function performs an initial direct write to +RKISP1_CIF_ISP_FILT_MODE without including the RKISP1_CIF_ISP_FLT_ENA +bit, which clears the filter enable bit in the hardware. + +The subsequent read/modify/write sequence then reads back the register +with the enable bit already cleared and cannot restore it, resulting in +the filter being inadvertently disabled. + +Remove the redundant direct write. The read/modify/write sequence alone +correctly preserves the existing enable bit state while updating the +DNR mode and filter configuration bits. + +Signed-off-by: Rui Wang +Reviewed-by: Stefan Klug +Reviewed-by: Kieran Bingham +Reviewed-by: Laurent Pinchart +Link: https://patch.msgid.link/20260105171142.147792-2-rui.wang@ideasonboard.com +Signed-off-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rockchip/rkisp1/rkisp1-params.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c +index 320581a9f866e..ba6fff91fa17a 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c +@@ -407,12 +407,6 @@ static void rkisp1_flt_config(struct rkisp1_params *params, + rkisp1_write(params->rkisp1, RKISP1_CIF_ISP_FILT_LUM_WEIGHT, + arg->lum_weight); + +- rkisp1_write(params->rkisp1, RKISP1_CIF_ISP_FILT_MODE, +- (arg->mode ? RKISP1_CIF_ISP_FLT_MODE_DNR : 0) | +- RKISP1_CIF_ISP_FLT_CHROMA_V_MODE(arg->chr_v_mode) | +- RKISP1_CIF_ISP_FLT_CHROMA_H_MODE(arg->chr_h_mode) | +- RKISP1_CIF_ISP_FLT_GREEN_STAGE1(arg->grn_stage1)); +- + /* avoid to override the old enable value */ + filt_mode = rkisp1_read(params->rkisp1, RKISP1_CIF_ISP_FILT_MODE); + filt_mode &= RKISP1_CIF_ISP_FLT_ENA; +-- +2.51.0 + diff --git a/queue-6.12/media-solo6x10-check-for-out-of-bounds-chip_id.patch b/queue-6.12/media-solo6x10-check-for-out-of-bounds-chip_id.patch new file mode 100644 index 00000000000..e2e30b2e16a --- /dev/null +++ b/queue-6.12/media-solo6x10-check-for-out-of-bounds-chip_id.patch @@ -0,0 +1,68 @@ +From d4c75f79a6f70614189dfdd08e66c0a4bf0fe5f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 19:00:35 -0800 +Subject: media: solo6x10: Check for out of bounds chip_id + +From: Kees Cook + +[ Upstream commit 0fdf6323c35a134f206dcad5babb4ff488552076 ] + +Clang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type +(literal "1" is an "int") could end up being shifted beyond 32 bits, +so instrumentation was added (and due to the double is_tw286x() call +seen via inlining), Clang decides the second one must now be undefined +behavior and elides the rest of the function[1]. This is a known problem +with Clang (that is still being worked on), but we can avoid the entire +problem by actually checking the existing max chip ID, and now there is +no runtime instrumentation added at all since everything is known to be +within bounds. + +Additionally use an unsigned value for the shift to remove the +instrumentation even without the explicit bounds checking. + +Link: https://github.com/ClangBuiltLinux/linux/issues/2144 [1] +Suggested-by: Nathan Chancellor +Signed-off-by: Kees Cook +Signed-off-by: Hans Verkuil +[hverkuil: fix checkpatch warning for is_tw286x] +Signed-off-by: Sasha Levin +--- + drivers/media/pci/solo6x10/solo6x10-tw28.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/pci/solo6x10/solo6x10-tw28.c b/drivers/media/pci/solo6x10/solo6x10-tw28.c +index 1b7c22a9bc94f..8f53946c67928 100644 +--- a/drivers/media/pci/solo6x10/solo6x10-tw28.c ++++ b/drivers/media/pci/solo6x10/solo6x10-tw28.c +@@ -166,7 +166,7 @@ static const u8 tbl_tw2865_pal_template[] = { + 0x64, 0x51, 0x40, 0xaf, 0xFF, 0xF0, 0x00, 0xC0, + }; + +-#define is_tw286x(__solo, __id) (!(__solo->tw2815 & (1 << __id))) ++#define is_tw286x(__solo, __id) (!((__solo)->tw2815 & (1U << (__id)))) + + static u8 tw_readbyte(struct solo_dev *solo_dev, int chip_id, u8 tw6x_off, + u8 tw_off) +@@ -686,6 +686,9 @@ int tw28_set_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch, + chip_num = ch / 4; + ch %= 4; + ++ if (chip_num >= TW_NUM_CHIP) ++ return -EINVAL; ++ + if (val > 255 || val < 0) + return -ERANGE; + +@@ -758,6 +761,9 @@ int tw28_get_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch, + chip_num = ch / 4; + ch %= 4; + ++ if (chip_num >= TW_NUM_CHIP) ++ return -EINVAL; ++ + switch (ctrl) { + case V4L2_CID_SHARPNESS: + /* Only 286x has sharpness */ +-- +2.51.0 + diff --git a/queue-6.12/media-v4l2-async-fix-error-handling-on-steps-after-f.patch b/queue-6.12/media-v4l2-async-fix-error-handling-on-steps-after-f.patch new file mode 100644 index 00000000000..1b89e21377b --- /dev/null +++ b/queue-6.12/media-v4l2-async-fix-error-handling-on-steps-after-f.patch @@ -0,0 +1,131 @@ +From 8fbc239c343fdd362b55a02c6db3de10574b8e62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 13:48:40 +0200 +Subject: media: v4l2-async: Fix error handling on steps after finding a match + +From: Sakari Ailus + +[ Upstream commit 7345d6d356336c448d6b9230ed8704f39679fd12 ] + +Once an async connection is found to be matching with an fwnode, a +sub-device may be registered (in case it wasn't already), its bound +operation is called, ancillary links are created, the async connection +is added to the sub-device's list of connections and removed from the +global waiting connection list. Further on, the sub-device's possible own +notifier is searched for possible additional matches. + +Fix these specific issues: + +- If v4l2_async_match_notify() failed before the sub-notifier handling, + the async connection was unbound and its entry removed from the + sub-device's async connection list. The latter part was also done in + v4l2_async_match_notify(). + +- The async connection's sd field was only set after creating ancillary + links in v4l2_async_match_notify(). It was however dereferenced in + v4l2_async_unbind_subdev_one(), which was called on error path of + v4l2_async_match_notify() failure. + +Signed-off-by: Sakari Ailus +Tested-by: "Yew, Chang Ching" +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-async.c | 45 +++++++++++++++++++--------- + 1 file changed, 31 insertions(+), 14 deletions(-) + +diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c +index ee884a8221fbd..1c08bba9ecb91 100644 +--- a/drivers/media/v4l2-core/v4l2-async.c ++++ b/drivers/media/v4l2-core/v4l2-async.c +@@ -343,7 +343,6 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier, + struct v4l2_subdev *sd, + struct v4l2_async_connection *asc) + { +- struct v4l2_async_notifier *subdev_notifier; + bool registered = false; + int ret; + +@@ -389,6 +388,25 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier, + dev_dbg(notifier_dev(notifier), "v4l2-async: %s bound (ret %d)\n", + dev_name(sd->dev), ret); + ++ return 0; ++ ++err_call_unbind: ++ v4l2_async_nf_call_unbind(notifier, sd, asc); ++ list_del(&asc->asc_subdev_entry); ++ ++err_unregister_subdev: ++ if (registered) ++ v4l2_device_unregister_subdev(sd); ++ ++ return ret; ++} ++ ++static int ++v4l2_async_nf_try_subdev_notifier(struct v4l2_async_notifier *notifier, ++ struct v4l2_subdev *sd) ++{ ++ struct v4l2_async_notifier *subdev_notifier; ++ + /* + * See if the sub-device has a notifier. If not, return here. + */ +@@ -404,16 +422,6 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier, + subdev_notifier->parent = notifier; + + return v4l2_async_nf_try_all_subdevs(subdev_notifier); +- +-err_call_unbind: +- v4l2_async_nf_call_unbind(notifier, sd, asc); +- list_del(&asc->asc_subdev_entry); +- +-err_unregister_subdev: +- if (registered) +- v4l2_device_unregister_subdev(sd); +- +- return ret; + } + + /* Test all async sub-devices in a notifier for a match. */ +@@ -445,6 +453,10 @@ v4l2_async_nf_try_all_subdevs(struct v4l2_async_notifier *notifier) + if (ret < 0) + return ret; + ++ ret = v4l2_async_nf_try_subdev_notifier(notifier, sd); ++ if (ret < 0) ++ return ret; ++ + /* + * v4l2_async_match_notify() may lead to registering a + * new notifier and thus changing the async subdevs +@@ -829,7 +841,11 @@ int __v4l2_async_register_subdev(struct v4l2_subdev *sd, struct module *module) + ret = v4l2_async_match_notify(notifier, v4l2_dev, sd, + asc); + if (ret) +- goto err_unbind; ++ goto err_unlock; ++ ++ ret = v4l2_async_nf_try_subdev_notifier(notifier, sd); ++ if (ret) ++ goto err_unbind_one; + + ret = v4l2_async_nf_try_complete(notifier); + if (ret) +@@ -853,9 +869,10 @@ int __v4l2_async_register_subdev(struct v4l2_subdev *sd, struct module *module) + if (subdev_notifier) + v4l2_async_nf_unbind_all_subdevs(subdev_notifier); + +- if (asc) +- v4l2_async_unbind_subdev_one(notifier, asc); ++err_unbind_one: ++ v4l2_async_unbind_subdev_one(notifier, asc); + ++err_unlock: + mutex_unlock(&list_lock); + + sd->owner = NULL; +-- +2.51.0 + diff --git a/queue-6.12/mfd-intel-lpss-add-intel-nova-lake-s-pci-ids.patch b/queue-6.12/mfd-intel-lpss-add-intel-nova-lake-s-pci-ids.patch new file mode 100644 index 00000000000..9f5cace866a --- /dev/null +++ b/queue-6.12/mfd-intel-lpss-add-intel-nova-lake-s-pci-ids.patch @@ -0,0 +1,50 @@ +From 84eb7c18957d170426c3acef9255920945795b5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 19:21:50 +0200 +Subject: mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit cefd793fa17de708d043adab50e7f96f414b0f1d ] + +Add Intel Nova Lake-S LPSS PCI IDs. + +Signed-off-by: Ilpo Järvinen +Acked-by: Andy Shevchenko +Link: https://patch.msgid.link/20260113172151.48062-1-ilpo.jarvinen@linux.intel.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/intel-lpss-pci.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c +index 5b1c13fb23468..a7feb82c28e3f 100644 +--- a/drivers/mfd/intel-lpss-pci.c ++++ b/drivers/mfd/intel-lpss-pci.c +@@ -437,6 +437,19 @@ static const struct pci_device_id intel_lpss_pci_ids[] = { + { PCI_VDEVICE(INTEL, 0x5ac4), (kernel_ulong_t)&bxt_spi_info }, + { PCI_VDEVICE(INTEL, 0x5ac6), (kernel_ulong_t)&bxt_spi_info }, + { PCI_VDEVICE(INTEL, 0x5aee), (kernel_ulong_t)&bxt_uart_info }, ++ /* NVL-S */ ++ { PCI_VDEVICE(INTEL, 0x6e28), (kernel_ulong_t)&bxt_uart_info }, ++ { PCI_VDEVICE(INTEL, 0x6e29), (kernel_ulong_t)&bxt_uart_info }, ++ { PCI_VDEVICE(INTEL, 0x6e2a), (kernel_ulong_t)&tgl_spi_info }, ++ { PCI_VDEVICE(INTEL, 0x6e2b), (kernel_ulong_t)&tgl_spi_info }, ++ { PCI_VDEVICE(INTEL, 0x6e4c), (kernel_ulong_t)&ehl_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x6e4d), (kernel_ulong_t)&ehl_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x6e4e), (kernel_ulong_t)&ehl_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x6e4f), (kernel_ulong_t)&ehl_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x6e5c), (kernel_ulong_t)&bxt_uart_info }, ++ { PCI_VDEVICE(INTEL, 0x6e5e), (kernel_ulong_t)&tgl_spi_info }, ++ { PCI_VDEVICE(INTEL, 0x6e7a), (kernel_ulong_t)&ehl_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x6e7b), (kernel_ulong_t)&ehl_i2c_info }, + /* ARL-H */ + { PCI_VDEVICE(INTEL, 0x7725), (kernel_ulong_t)&bxt_uart_info }, + { PCI_VDEVICE(INTEL, 0x7726), (kernel_ulong_t)&bxt_uart_info }, +-- +2.51.0 + diff --git a/queue-6.12/minix-add-required-sanity-checking-to-minix_check_su.patch b/queue-6.12/minix-add-required-sanity-checking-to-minix_check_su.patch new file mode 100644 index 00000000000..945d5770294 --- /dev/null +++ b/queue-6.12/minix-add-required-sanity-checking-to-minix_check_su.patch @@ -0,0 +1,103 @@ +From 360a57dea244a8acfa84fda70d7e8cf391905416 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 16:39:47 +0100 +Subject: minix: Add required sanity checking to minix_check_superblock() + +From: Jori Koolstra + +[ Upstream commit 8c97a6ddc95690a938ded44b4e3202f03f15078c ] + +The fs/minix implementation of the minix filesystem does not currently +support any other value for s_log_zone_size than 0. This is also the +only value supported in util-linux; see mkfs.minix.c line 511. In +addition, this patch adds some sanity checking for the other minix +superblock fields, and moves the minix_blocks_needed() checks for the +zmap and imap also to minix_check_super_block(). + +This also closes a related syzbot bug report. + +Signed-off-by: Jori Koolstra +Link: https://patch.msgid.link/20251208153947.108343-1-jkoolstra@xs4all.nl +Reviewed-by: Jan Kara +Reported-by: syzbot+5ad0824204c7bf9b67f2@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=5ad0824204c7bf9b67f2 +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/minix/inode.c | 50 ++++++++++++++++++++++++++++-------------------- + 1 file changed, 29 insertions(+), 21 deletions(-) + +diff --git a/fs/minix/inode.c b/fs/minix/inode.c +index fc01f9dc8c391..b38eec2760699 100644 +--- a/fs/minix/inode.c ++++ b/fs/minix/inode.c +@@ -154,10 +154,38 @@ static int minix_reconfigure(struct fs_context *fc) + static bool minix_check_superblock(struct super_block *sb) + { + struct minix_sb_info *sbi = minix_sb(sb); ++ unsigned long block; + +- if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0) ++ if (sbi->s_log_zone_size != 0) { ++ printk("minix-fs error: zone size must equal block size. " ++ "s_log_zone_size > 0 is not supported.\n"); ++ return false; ++ } ++ ++ if (sbi->s_ninodes < 1 || sbi->s_firstdatazone <= 4 || ++ sbi->s_firstdatazone >= sbi->s_nzones) + return false; + ++ /* Apparently minix can create filesystems that allocate more blocks for ++ * the bitmaps than needed. We simply ignore that, but verify it didn't ++ * create one with not enough blocks and bail out if so. ++ */ ++ block = minix_blocks_needed(sbi->s_ninodes, sb->s_blocksize); ++ if (sbi->s_imap_blocks < block) { ++ printk("MINIX-fs: file system does not have enough " ++ "imap blocks allocated. Refusing to mount.\n"); ++ return false; ++ } ++ ++ block = minix_blocks_needed( ++ (sbi->s_nzones - sbi->s_firstdatazone + 1), ++ sb->s_blocksize); ++ if (sbi->s_zmap_blocks < block) { ++ printk("MINIX-fs: file system does not have enough " ++ "zmap blocks allocated. Refusing to mount.\n"); ++ return false; ++ } ++ + /* + * s_max_size must not exceed the block mapping limitation. This check + * is only needed for V1 filesystems, since V2/V3 support an extra level +@@ -277,26 +305,6 @@ static int minix_fill_super(struct super_block *s, struct fs_context *fc) + minix_set_bit(0,sbi->s_imap[0]->b_data); + minix_set_bit(0,sbi->s_zmap[0]->b_data); + +- /* Apparently minix can create filesystems that allocate more blocks for +- * the bitmaps than needed. We simply ignore that, but verify it didn't +- * create one with not enough blocks and bail out if so. +- */ +- block = minix_blocks_needed(sbi->s_ninodes, s->s_blocksize); +- if (sbi->s_imap_blocks < block) { +- printk("MINIX-fs: file system does not have enough " +- "imap blocks allocated. Refusing to mount.\n"); +- goto out_no_bitmap; +- } +- +- block = minix_blocks_needed( +- (sbi->s_nzones - sbi->s_firstdatazone + 1), +- s->s_blocksize); +- if (sbi->s_zmap_blocks < block) { +- printk("MINIX-fs: file system does not have enough " +- "zmap blocks allocated. Refusing to mount.\n"); +- goto out_no_bitmap; +- } +- + /* set up enough so that it can read an inode */ + s->s_op = &minix_sops; + s->s_time_min = 0; +-- +2.51.0 + diff --git a/queue-6.12/mips-loongson-make-cpumask_of_node-robust-against-nu.patch b/queue-6.12/mips-loongson-make-cpumask_of_node-robust-against-nu.patch new file mode 100644 index 00000000000..4ff9691da08 --- /dev/null +++ b/queue-6.12/mips-loongson-make-cpumask_of_node-robust-against-nu.patch @@ -0,0 +1,36 @@ +From 960e1a4c90afccf0d92d83b8c10534b8ce6ee442 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 09:40:06 +0000 +Subject: MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE + +From: John Garry + +[ Upstream commit d55d3fe2d1470ac5b6e93efe7998b728013c9fc8 ] + +The arch definition of cpumask_of_node() cannot handle NUMA_NO_NODE - which +is a valid index - so add a check for this. + +Signed-off-by: John Garry +Reviewed-by: Huacai Chen +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/mach-loongson64/topology.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/include/asm/mach-loongson64/topology.h b/arch/mips/include/asm/mach-loongson64/topology.h +index 3414a1fd17835..89bb4deab98a6 100644 +--- a/arch/mips/include/asm/mach-loongson64/topology.h ++++ b/arch/mips/include/asm/mach-loongson64/topology.h +@@ -7,7 +7,7 @@ + #define cpu_to_node(cpu) (cpu_logical_map(cpu) >> 2) + + extern cpumask_t __node_cpumask[]; +-#define cpumask_of_node(node) (&__node_cpumask[node]) ++#define cpumask_of_node(node) ((node) == NUMA_NO_NODE ? cpu_all_mask : &__node_cpumask[node]) + + struct pci_bus; + extern int pcibus_to_node(struct pci_bus *); +-- +2.51.0 + diff --git a/queue-6.12/misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch b/queue-6.12/misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch new file mode 100644 index 00000000000..3e65d9003f0 --- /dev/null +++ b/queue-6.12/misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch @@ -0,0 +1,75 @@ +From c700ecfdad9625e4d3ff0605f343ba96790d3ad6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 14:36:37 +0800 +Subject: misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() + +From: Tuo Li + +[ Upstream commit ba75ecb97d3f4e95d59002c13afb6519205be6cb ] + +In the function bcm_vk_read(), the pointer entry is checked, indicating +that it can be NULL. If entry is NULL and rc is set to -EMSGSIZE, the +following code may cause null-pointer dereferences: + + struct vk_msg_blk tmp_msg = entry->to_h_msg[0]; + set_msg_id(&tmp_msg, entry->usr_msg_id); + tmp_msg.size = entry->to_h_blks - 1; + +To prevent these possible null-pointer dereferences, copy to_h_msg, +usr_msg_id, and to_h_blks from iter into temporary variables, and return +these temporary variables to the application instead of accessing them +through a potentially NULL entry. + +Signed-off-by: Tuo Li +Reviewed-by: Scott Branden +Link: https://patch.msgid.link/20251211063637.3987937-1-islituo@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/bcm-vk/bcm_vk_msg.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/misc/bcm-vk/bcm_vk_msg.c b/drivers/misc/bcm-vk/bcm_vk_msg.c +index 1f42d1d5a630a..665a3888708ac 100644 +--- a/drivers/misc/bcm-vk/bcm_vk_msg.c ++++ b/drivers/misc/bcm-vk/bcm_vk_msg.c +@@ -1010,6 +1010,9 @@ ssize_t bcm_vk_read(struct file *p_file, + struct device *dev = &vk->pdev->dev; + struct bcm_vk_msg_chan *chan = &vk->to_h_msg_chan; + struct bcm_vk_wkent *entry = NULL, *iter; ++ struct vk_msg_blk tmp_msg; ++ u32 tmp_usr_msg_id; ++ u32 tmp_blks; + u32 q_num; + u32 rsp_length; + +@@ -1034,6 +1037,9 @@ ssize_t bcm_vk_read(struct file *p_file, + entry = iter; + } else { + /* buffer not big enough */ ++ tmp_msg = iter->to_h_msg[0]; ++ tmp_usr_msg_id = iter->usr_msg_id; ++ tmp_blks = iter->to_h_blks; + rc = -EMSGSIZE; + } + goto read_loop_exit; +@@ -1052,14 +1058,12 @@ ssize_t bcm_vk_read(struct file *p_file, + + bcm_vk_free_wkent(dev, entry); + } else if (rc == -EMSGSIZE) { +- struct vk_msg_blk tmp_msg = entry->to_h_msg[0]; +- + /* + * in this case, return just the first block, so + * that app knows what size it is looking for. + */ +- set_msg_id(&tmp_msg, entry->usr_msg_id); +- tmp_msg.size = entry->to_h_blks - 1; ++ set_msg_id(&tmp_msg, tmp_usr_msg_id); ++ tmp_msg.size = tmp_blks - 1; + if (copy_to_user(buf, &tmp_msg, VK_MSGQ_BLK_SIZE) != 0) { + dev_err(dev, "Error return 1st block in -EMSGSIZE\n"); + rc = -EFAULT; +-- +2.51.0 + diff --git a/queue-6.12/misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch b/queue-6.12/misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch new file mode 100644 index 00000000000..404871e65cd --- /dev/null +++ b/queue-6.12/misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch @@ -0,0 +1,67 @@ +From ed9ced8e8e0f86999ca111b5b937694a166f0ca1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 11:48:24 +0100 +Subject: misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 + +From: Markus Perkins + +[ Upstream commit b54c82d6cbfc76647ba558e8e3647eb2b0ba0e2b ] + +commit 14374fbb3f06 ("misc: eeprom_93xx46: Add new 93c56 and 93c66 +compatible strings") added support for 93xx56 and 93xx66 eeproms, but +didn't take into account that the write enable/disable + erase all +commands are hardcoded for the 6-bit address of the 93xx46. + +This commit fixes the command word generation by increasing the number +of shifts as the address field grows, keeping the command intact. + +Also, the check for 8-bit or 16-bit mode is no longer required as this +is already taken into account in the edev->addrlen field. + +Signed-off-by: Markus Perkins +Link: https://patch.msgid.link/20251202104823.429869-3-markus@notsyncing.net +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/eeprom/eeprom_93xx46.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c +index e2221be884458..cc7599f08b391 100644 +--- a/drivers/misc/eeprom/eeprom_93xx46.c ++++ b/drivers/misc/eeprom/eeprom_93xx46.c +@@ -45,6 +45,7 @@ struct eeprom_93xx46_platform_data { + #define OP_START 0x4 + #define OP_WRITE (OP_START | 0x1) + #define OP_READ (OP_START | 0x2) ++/* The following addresses are offset for the 1K EEPROM variant in 16-bit mode */ + #define ADDR_EWDS 0x00 + #define ADDR_ERAL 0x20 + #define ADDR_EWEN 0x30 +@@ -191,10 +192,7 @@ static int eeprom_93xx46_ew(struct eeprom_93xx46_dev *edev, int is_on) + bits = edev->addrlen + 3; + + cmd_addr = OP_START << edev->addrlen; +- if (edev->pdata->flags & EE_ADDR8) +- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << 1; +- else +- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS); ++ cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << (edev->addrlen - 6); + + if (has_quirk_instruction_length(edev)) { + cmd_addr <<= 2; +@@ -328,10 +326,7 @@ static int eeprom_93xx46_eral(struct eeprom_93xx46_dev *edev) + bits = edev->addrlen + 3; + + cmd_addr = OP_START << edev->addrlen; +- if (edev->pdata->flags & EE_ADDR8) +- cmd_addr |= ADDR_ERAL << 1; +- else +- cmd_addr |= ADDR_ERAL; ++ cmd_addr |= ADDR_ERAL << (edev->addrlen - 6); + + if (has_quirk_instruction_length(edev)) { + cmd_addr <<= 2; +-- +2.51.0 + diff --git a/queue-6.12/modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch b/queue-6.12/modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch new file mode 100644 index 00000000000..d02a850e90c --- /dev/null +++ b/queue-6.12/modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch @@ -0,0 +1,56 @@ +From e2d8395d4ea477f0fd59814f09ab9f6a5d03b4ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Nov 2025 13:13:30 +0100 +Subject: modpost: Amend ppc64 save/restfpr symnames for -Os build +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: René Rebe + +[ Upstream commit 3cd9763ce4ad999d015cf0734e6b968cead95077 ] + +Building a size optimized ppc64 kernel (-Os), gcc emits more FP +save/restore symbols, that the linker generates on demand into the +.sfpr section. Explicitly allow-list those in scripts/mod/modpost.c, +too. They are needed for the amdgpu in-kernel floating point support. + +MODPOST Module.symvers +ERROR: modpost: "_restfpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_26" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savegpr1_27" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savegpr1_25" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_28" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savegpr1_29" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savefpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savefpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_15" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +WARNING: modpost: suppressed 56 unresolved symbol warnings because there were too many) + +Signed-off-by: René Rebe +Link: https://patch.msgid.link/20251123.131330.407910684435629198.rene@exactco.de +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + scripts/mod/modpost.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index 971eda0c6ba73..07e8a4eb71d04 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -593,6 +593,10 @@ static int ignore_undef_symbol(struct elf_info *info, const char *symname) + /* Special register function linked on all modules during final link of .ko */ + if (strstarts(symname, "_restgpr0_") || + strstarts(symname, "_savegpr0_") || ++ strstarts(symname, "_restgpr1_") || ++ strstarts(symname, "_savegpr1_") || ++ strstarts(symname, "_restfpr_") || ++ strstarts(symname, "_savefpr_") || + strstarts(symname, "_restvr_") || + strstarts(symname, "_savevr_") || + strcmp(symname, ".TOC.") == 0) +-- +2.51.0 + diff --git a/queue-6.12/most-core-fix-resource-leak-in-most_register_interfa.patch b/queue-6.12/most-core-fix-resource-leak-in-most_register_interfa.patch new file mode 100644 index 00000000000..76b549baec5 --- /dev/null +++ b/queue-6.12/most-core-fix-resource-leak-in-most_register_interfa.patch @@ -0,0 +1,71 @@ +From df21579ea55dc6e4fc15981a49344aae3dc7b554 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Nov 2025 16:53:37 +0000 +Subject: most: core: fix resource leak in most_register_interface error paths + +From: Navaneeth K + +[ Upstream commit 1f4c9d8a1021281750c6cda126d6f8a40cc24e71 ] + +The function most_register_interface() did not correctly release resources +if it failed early (before registering the device). In these cases, it +returned an error code immediately, leaking the memory allocated for the +interface. + +Fix this by initializing the device early via device_initialize() and +calling put_device() on all error paths. + +The most_register_interface() is expected to call put_device() on +error which frees the resources allocated in the caller. The +put_device() either calls release_mdev() or dim2_release(), +depending on the caller. + +Switch to using device_add() instead of device_register() to handle +the split initialization. + +Acked-by: Abdun Nihaal +Signed-off-by: Navaneeth K +Reviewed-by: Dan Carpenter +Link: https://patch.msgid.link/20251127165337.19172-1-knavaneeth786@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/most/core.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/most/core.c b/drivers/most/core.c +index da319d108ea1d..6277e6702ca8c 100644 +--- a/drivers/most/core.c ++++ b/drivers/most/core.c +@@ -1286,15 +1286,19 @@ int most_register_interface(struct most_interface *iface) + !iface->poison_channel || (iface->num_channels > MAX_CHANNELS)) + return -EINVAL; + ++ device_initialize(iface->dev); ++ + id = ida_alloc(&mdev_id, GFP_KERNEL); + if (id < 0) { + dev_err(iface->dev, "Failed to allocate device ID\n"); ++ put_device(iface->dev); + return id; + } + + iface->p = kzalloc(sizeof(*iface->p), GFP_KERNEL); + if (!iface->p) { + ida_free(&mdev_id, id); ++ put_device(iface->dev); + return -ENOMEM; + } + +@@ -1304,7 +1308,7 @@ int most_register_interface(struct most_interface *iface) + iface->dev->bus = &mostbus; + iface->dev->groups = interface_attr_groups; + dev_set_drvdata(iface->dev, iface); +- if (device_register(iface->dev)) { ++ if (device_add(iface->dev)) { + dev_err(iface->dev, "Failed to register interface device\n"); + kfree(iface->p); + put_device(iface->dev); +-- +2.51.0 + diff --git a/queue-6.12/myri10ge-avoid-uninitialized-variable-use.patch b/queue-6.12/myri10ge-avoid-uninitialized-variable-use.patch new file mode 100644 index 00000000000..a377c07f076 --- /dev/null +++ b/queue-6.12/myri10ge-avoid-uninitialized-variable-use.patch @@ -0,0 +1,162 @@ +From 36e61c56feb48c8c52e4e23531ad751730a3cf06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Feb 2026 17:28:09 +0100 +Subject: myri10ge: avoid uninitialized variable use + +From: Arnd Bergmann + +[ Upstream commit fd24173439c033ffb3c2a2628fcbc9cb65e62bdb ] + +While compile testing on less common architectures, I noticed that gcc-10 on +s390 finds a bug that all other configurations seem to miss: + +drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_set_multicast_list': +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:391:25: error: 'cmd.data0' is used uninitialized in this function [-Werror=uninitialized] + 391 | buf->data0 = htonl(data->data0); + | ^~ +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:25: error: '*((void *)&cmd+4)' is used uninitialized in this function [-Werror=uninitialized] + 392 | buf->data1 = htonl(data->data1); + | ^~ +drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_allocate_rings': +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:13: error: 'cmd.data1' is used uninitialized in this function [-Werror=uninitialized] + 392 | buf->data1 = htonl(data->data1); +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data1' was declared here + 1939 | struct myri10ge_cmd cmd; + | ^~~ +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:393:13: error: 'cmd.data2' is used uninitialized in this function [-Werror=uninitialized] + 393 | buf->data2 = htonl(data->data2); +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data2' was declared here + 1939 | struct myri10ge_cmd cmd; + +It would be nice to understand how to make other compilers catch this as +well, but for the moment I'll just shut up the warning by fixing the +undefined behavior in this driver. + +Signed-off-by: Arnd Bergmann +Link: https://patch.msgid.link/20260205162935.2126442-1-arnd@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/myricom/myri10ge/myri10ge.c | 28 ++++++++++++++++++- + 1 file changed, 27 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c +index b7d9657a7af3d..3f2086873a483 100644 +--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c ++++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c +@@ -688,6 +688,9 @@ static int myri10ge_get_firmware_capabilities(struct myri10ge_priv *mgp) + + /* probe for IPv6 TSO support */ + mgp->features = NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_TSO; ++ cmd.data0 = 0, ++ cmd.data1 = 0, ++ cmd.data2 = 0, + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_MAX_TSO6_HDR_SIZE, + &cmd, 0); + if (status == 0) { +@@ -806,6 +809,7 @@ static int myri10ge_update_mac_address(struct myri10ge_priv *mgp, + | (addr[2] << 8) | addr[3]); + + cmd.data1 = ((addr[4] << 8) | (addr[5])); ++ cmd.data2 = 0; + + status = myri10ge_send_cmd(mgp, MXGEFW_SET_MAC_ADDRESS, &cmd, 0); + return status; +@@ -817,6 +821,9 @@ static int myri10ge_change_pause(struct myri10ge_priv *mgp, int pause) + int status, ctl; + + ctl = pause ? MXGEFW_ENABLE_FLOW_CONTROL : MXGEFW_DISABLE_FLOW_CONTROL; ++ cmd.data0 = 0, ++ cmd.data1 = 0, ++ cmd.data2 = 0, + status = myri10ge_send_cmd(mgp, ctl, &cmd, 0); + + if (status) { +@@ -834,6 +841,9 @@ myri10ge_change_promisc(struct myri10ge_priv *mgp, int promisc, int atomic) + int status, ctl; + + ctl = promisc ? MXGEFW_ENABLE_PROMISC : MXGEFW_DISABLE_PROMISC; ++ cmd.data0 = 0; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, ctl, &cmd, atomic); + if (status) + netdev_err(mgp->dev, "Failed to set promisc mode\n"); +@@ -1946,6 +1956,8 @@ static int myri10ge_allocate_rings(struct myri10ge_slice_state *ss) + /* get ring sizes */ + slice = ss - mgp->ss; + cmd.data0 = slice; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_RING_SIZE, &cmd, 0); + tx_ring_size = cmd.data0; + cmd.data0 = slice; +@@ -2238,12 +2250,16 @@ static int myri10ge_get_txrx(struct myri10ge_priv *mgp, int slice) + status = 0; + if (slice == 0 || (mgp->dev->real_num_tx_queues > 1)) { + cmd.data0 = slice; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_OFFSET, + &cmd, 0); + ss->tx.lanai = (struct mcp_kreq_ether_send __iomem *) + (mgp->sram + cmd.data0); + } + cmd.data0 = slice; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status |= myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SMALL_RX_OFFSET, + &cmd, 0); + ss->rx_small.lanai = (struct mcp_kreq_ether_recv __iomem *) +@@ -2312,6 +2328,7 @@ static int myri10ge_open(struct net_device *dev) + if (mgp->num_slices > 1) { + cmd.data0 = mgp->num_slices; + cmd.data1 = MXGEFW_SLICE_INTR_MODE_ONE_PER_SLICE; ++ cmd.data2 = 0; + if (mgp->dev->real_num_tx_queues > 1) + cmd.data1 |= MXGEFW_SLICE_ENABLE_MULTIPLE_TX_QUEUES; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_ENABLE_RSS_QUEUES, +@@ -2414,6 +2431,8 @@ static int myri10ge_open(struct net_device *dev) + + /* now give firmware buffers sizes, and MTU */ + cmd.data0 = dev->mtu + ETH_HLEN + VLAN_HLEN; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_SET_MTU, &cmd, 0); + cmd.data0 = mgp->small_bytes; + status |= +@@ -2472,7 +2491,6 @@ static int myri10ge_open(struct net_device *dev) + static int myri10ge_close(struct net_device *dev) + { + struct myri10ge_priv *mgp = netdev_priv(dev); +- struct myri10ge_cmd cmd; + int status, old_down_cnt; + int i; + +@@ -2491,8 +2509,13 @@ static int myri10ge_close(struct net_device *dev) + + netif_tx_stop_all_queues(dev); + if (mgp->rebooted == 0) { ++ struct myri10ge_cmd cmd; ++ + old_down_cnt = mgp->down_cnt; + mb(); ++ cmd.data0 = 0; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = + myri10ge_send_cmd(mgp, MXGEFW_CMD_ETHERNET_DOWN, &cmd, 0); + if (status) +@@ -2956,6 +2979,9 @@ static void myri10ge_set_multicast_list(struct net_device *dev) + + /* Disable multicast filtering */ + ++ cmd.data0 = 0; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + err = myri10ge_send_cmd(mgp, MXGEFW_ENABLE_ALLMULTI, &cmd, 1); + if (err != 0) { + netdev_err(dev, "Failed MXGEFW_ENABLE_ALLMULTI, error status: %d\n", +-- +2.51.0 + diff --git a/queue-6.12/net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch b/queue-6.12/net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch new file mode 100644 index 00000000000..d11c2d305bb --- /dev/null +++ b/queue-6.12/net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch @@ -0,0 +1,70 @@ +From 0f6d143f2dc6b7242828b0da7c00329c71d9dd0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 17:47:55 +0800 +Subject: net: hns3: extend HCLGE_FD_AD_QID to 11 bits + +From: Jijie Shao + +[ Upstream commit 878406d4d6ef85c37fab52074771cc916e532c16 ] + +Currently, HCLGE_FD_AD_QID has only 10 bits and supports a +maximum of 1023 queues. However, there are actually scenarios +where the queue_id exceeds 1023. + +This patch adds an additional bit to HCLGE_FD_AD_QID to ensure +that queue_id greater than 1023 are supported. + +Signed-off-by: Jijie Shao +Link: https://patch.msgid.link/20260123094756.3718516-2-shaojijie@huawei.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 5 +++-- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 +++- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +index 416e02e7b995f..bc333d8710ac1 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +@@ -727,8 +727,8 @@ struct hclge_fd_tcam_config_3_cmd { + + #define HCLGE_FD_AD_DROP_B 0 + #define HCLGE_FD_AD_DIRECT_QID_B 1 +-#define HCLGE_FD_AD_QID_S 2 +-#define HCLGE_FD_AD_QID_M GENMASK(11, 2) ++#define HCLGE_FD_AD_QID_L_S 2 ++#define HCLGE_FD_AD_QID_L_M GENMASK(11, 2) + #define HCLGE_FD_AD_USE_COUNTER_B 12 + #define HCLGE_FD_AD_COUNTER_NUM_S 13 + #define HCLGE_FD_AD_COUNTER_NUM_M GENMASK(19, 13) +@@ -741,6 +741,7 @@ struct hclge_fd_tcam_config_3_cmd { + #define HCLGE_FD_AD_TC_OVRD_B 16 + #define HCLGE_FD_AD_TC_SIZE_S 17 + #define HCLGE_FD_AD_TC_SIZE_M GENMASK(20, 17) ++#define HCLGE_FD_AD_QID_H_B 21 + + struct hclge_fd_ad_config_cmd { + u8 stage; +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 7468e03051ea4..434f40ce3062b 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -5689,11 +5689,13 @@ static int hclge_fd_ad_config(struct hclge_dev *hdev, u8 stage, int loc, + hnae3_set_field(ad_data, HCLGE_FD_AD_TC_SIZE_M, + HCLGE_FD_AD_TC_SIZE_S, (u32)action->tc_size); + } ++ hnae3_set_bit(ad_data, HCLGE_FD_AD_QID_H_B, ++ action->queue_id >= HCLGE_TQP_MAX_SIZE_DEV_V2 ? 1 : 0); + ad_data <<= 32; + hnae3_set_bit(ad_data, HCLGE_FD_AD_DROP_B, action->drop_packet); + hnae3_set_bit(ad_data, HCLGE_FD_AD_DIRECT_QID_B, + action->forward_to_direct_queue); +- hnae3_set_field(ad_data, HCLGE_FD_AD_QID_M, HCLGE_FD_AD_QID_S, ++ hnae3_set_field(ad_data, HCLGE_FD_AD_QID_L_M, HCLGE_FD_AD_QID_L_S, + action->queue_id); + hnae3_set_bit(ad_data, HCLGE_FD_AD_USE_COUNTER_B, action->use_counter); + hnae3_set_field(ad_data, HCLGE_FD_AD_COUNTER_NUM_M, +-- +2.51.0 + diff --git a/queue-6.12/net-rds-clear-reconnect-pending-bit.patch b/queue-6.12/net-rds-clear-reconnect-pending-bit.patch new file mode 100644 index 00000000000..d71c017f5f8 --- /dev/null +++ b/queue-6.12/net-rds-clear-reconnect-pending-bit.patch @@ -0,0 +1,42 @@ +From 2c28245515c7a7f74ab9564c2eb672157e4c8a74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 22:57:20 -0700 +Subject: net/rds: Clear reconnect pending bit +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: HÃ¥kon Bugge + +[ Upstream commit b89fc7c2523b2b0750d91840f4e52521270d70ed ] + +When canceling the reconnect worker, care must be taken to reset the +reconnect-pending bit. If the reconnect worker has not yet been +scheduled before it is canceled, the reconnect-pending bit will stay +on forever. + +Signed-off-by: HÃ¥kon Bugge +Signed-off-by: Allison Henderson +Link: https://patch.msgid.link/20260203055723.1085751-6-achender@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/rds/connection.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/rds/connection.c b/net/rds/connection.c +index 8b7199f9ae70c..3a1b548dcdcb2 100644 +--- a/net/rds/connection.c ++++ b/net/rds/connection.c +@@ -428,6 +428,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp) + * to the conn hash, so we never trigger a reconnect on this + * conn - the reconnect is always triggered by the active peer. */ + cancel_delayed_work_sync(&cp->cp_conn_w); ++ ++ clear_bit(RDS_RECONNECT_PENDING, &cp->cp_flags); + rcu_read_lock(); + if (!hlist_unhashed(&conn->c_hash_node)) { + rcu_read_unlock(); +-- +2.51.0 + diff --git a/queue-6.12/net-rds-no-shortcut-out-of-rds_conn_error.patch b/queue-6.12/net-rds-no-shortcut-out-of-rds_conn_error.patch new file mode 100644 index 00000000000..088d06873c8 --- /dev/null +++ b/queue-6.12/net-rds-no-shortcut-out-of-rds_conn_error.patch @@ -0,0 +1,92 @@ +From ea2fd0dbfd4d454da41f1cf76f196af0a41c0188 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jan 2026 22:52:12 -0700 +Subject: net/rds: No shortcut out of RDS_CONN_ERROR + +From: Gerd Rausch + +[ Upstream commit ad22d24be635c6beab6a1fdd3f8b1f3c478d15da ] + +RDS connections carry a state "rds_conn_path::cp_state" +and transitions from one state to another and are conditional +upon an expected state: "rds_conn_path_transition." + +There is one exception to this conditionality, which is +"RDS_CONN_ERROR" that can be enforced by "rds_conn_path_drop" +regardless of what state the condition is currently in. + +But as soon as a connection enters state "RDS_CONN_ERROR", +the connection handling code expects it to go through the +shutdown-path. + +The RDS/TCP multipath changes added a shortcut out of +"RDS_CONN_ERROR" straight back to "RDS_CONN_CONNECTING" +via "rds_tcp_accept_one_path" (e.g. after "rds_tcp_state_change"). + +A subsequent "rds_tcp_reset_callbacks" can then transition +the state to "RDS_CONN_RESETTING" with a shutdown-worker queued. + +That'll trip up "rds_conn_init_shutdown", which was +never adjusted to handle "RDS_CONN_RESETTING" and subsequently +drops the connection with the dreaded "DR_INV_CONN_STATE", +which leaves "RDS_SHUTDOWN_WORK_QUEUED" on forever. + +So we do two things here: + +a) Don't shortcut "RDS_CONN_ERROR", but take the longer + path through the shutdown code. + +b) Add "RDS_CONN_RESETTING" to the expected states in + "rds_conn_init_shutdown" so that we won't error out + and get stuck, if we ever hit weird state transitions + like this again." + +Signed-off-by: Gerd Rausch +Signed-off-by: Allison Henderson +Link: https://patch.msgid.link/20260122055213.83608-2-achender@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/rds/connection.c | 2 ++ + net/rds/tcp_listen.c | 5 ----- + 2 files changed, 2 insertions(+), 5 deletions(-) + +diff --git a/net/rds/connection.c b/net/rds/connection.c +index c749c5525b40f..8b7199f9ae70c 100644 +--- a/net/rds/connection.c ++++ b/net/rds/connection.c +@@ -381,6 +381,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp) + if (!rds_conn_path_transition(cp, RDS_CONN_UP, + RDS_CONN_DISCONNECTING) && + !rds_conn_path_transition(cp, RDS_CONN_ERROR, ++ RDS_CONN_DISCONNECTING) && ++ !rds_conn_path_transition(cp, RDS_CONN_RESETTING, + RDS_CONN_DISCONNECTING)) { + rds_conn_path_error(cp, + "shutdown called in state %d\n", +diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c +index d89bd8d0c3545..fced9e286f79f 100644 +--- a/net/rds/tcp_listen.c ++++ b/net/rds/tcp_listen.c +@@ -59,9 +59,6 @@ void rds_tcp_keepalive(struct socket *sock) + * socket and force a reconneect from smaller -> larger ip addr. The reason + * we special case cp_index 0 is to allow the rds probe ping itself to itself + * get through efficiently. +- * Since reconnects are only initiated from the node with the numerically +- * smaller ip address, we recycle conns in RDS_CONN_ERROR on the passive side +- * by moving them to CONNECTING in this function. + */ + static + struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn) +@@ -86,8 +83,6 @@ struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn) + struct rds_conn_path *cp = &conn->c_path[i]; + + if (rds_conn_path_transition(cp, RDS_CONN_DOWN, +- RDS_CONN_CONNECTING) || +- rds_conn_path_transition(cp, RDS_CONN_ERROR, + RDS_CONN_CONNECTING)) { + return cp->cp_transport_data; + } +-- +2.51.0 + diff --git a/queue-6.12/net-sfp-add-quirk-for-lantech-8330-265d.patch b/queue-6.12/net-sfp-add-quirk-for-lantech-8330-265d.patch new file mode 100644 index 00000000000..3ae08a0e270 --- /dev/null +++ b/queue-6.12/net-sfp-add-quirk-for-lantech-8330-265d.patch @@ -0,0 +1,49 @@ +From 08e8e47f24d24ea83b638a2be3ba6c589d4dd5b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 18:00:44 +0100 +Subject: net: sfp: add quirk for Lantech 8330-265D +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit 86a8e8e0ddbc3d14c799536eb888180b84d002f3 ] + +Similar to Lantech 8330-262D-E, the Lantech 8330-265D also reports +2500MBd instead of 3125MBd. + +Also, all 8330-265D report normal RX_LOS in EEPROM, but some signal +inverted RX_LOS. We therefore need to ignore RX_LOS on these modules. + +Signed-off-by: Marek Behún +Link: https://patch.msgid.link/20260128170044.15576-1-kabel@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/sfp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c +index 6153a35af1070..cae748b762236 100644 +--- a/drivers/net/phy/sfp.c ++++ b/drivers/net/phy/sfp.c +@@ -525,9 +525,13 @@ static const struct sfp_quirk sfp_quirks[] = { + SFP_QUIRK("HUAWEI", "MA5671A", sfp_quirk_2500basex, + sfp_fixup_ignore_tx_fault), + +- // Lantech 8330-262D-E can operate at 2500base-X, but incorrectly report +- // 2500MBd NRZ in their EEPROM ++ // Lantech 8330-262D-E and 8330-265D can operate at 2500base-X, but ++ // incorrectly report 2500MBd NRZ in their EEPROM. ++ // Some 8330-265D modules have inverted LOS, while all of them report ++ // normal LOS in EEPROM. Therefore we need to ignore LOS entirely. + SFP_QUIRK_S("Lantech", "8330-262D-E", sfp_quirk_2500basex), ++ SFP_QUIRK("Lantech", "8330-265D", sfp_quirk_2500basex, ++ sfp_fixup_ignore_los), + + SFP_QUIRK_S("UBNT", "UF-INSTANT", sfp_quirk_ubnt_uf_instant), + +-- +2.51.0 + diff --git a/queue-6.12/net-usb-r8152-fix-transmit-queue-timeout.patch b/queue-6.12/net-usb-r8152-fix-transmit-queue-timeout.patch new file mode 100644 index 00000000000..848ee35ab87 --- /dev/null +++ b/queue-6.12/net-usb-r8152-fix-transmit-queue-timeout.patch @@ -0,0 +1,42 @@ +From 2ec3276bdd07319a2aae62ab414c73ce19ea71ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 09:59:49 +0800 +Subject: net: usb: r8152: fix transmit queue timeout + +From: Mingj Ye + +[ Upstream commit 833dcd75d54f0bf5aa0a0781ff57456b421fbb40 ] + +When the TX queue length reaches the threshold, the netdev watchdog +immediately detects a TX queue timeout. + +This patch updates the trans_start timestamp of the transmit queue +on every asynchronous USB URB submission along the transmit path, +ensuring that the network watchdog accurately reflects ongoing +transmission activity. + +Signed-off-by: Mingj Ye +Reviewed-by: Hayes Wang +Link: https://patch.msgid.link/20260120015949.84996-1-insyelu@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index d27e62939bf13..e4eb4e5425364 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -2447,6 +2447,8 @@ static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg) + ret = usb_submit_urb(agg->urb, GFP_ATOMIC); + if (ret < 0) + usb_autopm_put_interface_async(tp->intf); ++ else ++ netif_trans_update(tp->netdev); + + out_tx_fill: + return ret; +-- +2.51.0 + diff --git a/queue-6.12/net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch b/queue-6.12/net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch new file mode 100644 index 00000000000..94c61001751 --- /dev/null +++ b/queue-6.12/net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch @@ -0,0 +1,117 @@ +From 1e6b8e41569c9f2ca146cfb94791050a389b28b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 17:39:09 -0800 +Subject: net: usb: sr9700: remove code to drive nonexistent multicast filter + +From: Ethan Nelson-Moore + +[ Upstream commit 9a9424c756feee9ee6e717405a9d6fa7bacdef08 ] + +Several registers referenced in this driver's source code do not +actually exist (they are not writable and read as zero in my testing). +They exist in this driver because it originated as a copy of the dm9601 +driver. Notably, these include the multicast filter registers - this +causes the driver to not support multicast packets correctly. Remove +the multicast filter code and register definitions. Instead, set the +chip to receive all multicast filter packets when any multicast +addresses are in the list. + +Reviewed-by: Simon Horman (from v1) +Signed-off-by: Ethan Nelson-Moore +Link: https://patch.msgid.link/20260203013924.28582-1-enelsonmoore@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/Kconfig | 1 - + drivers/net/usb/sr9700.c | 25 ++++--------------------- + drivers/net/usb/sr9700.h | 7 +------ + 3 files changed, 5 insertions(+), 28 deletions(-) + +diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig +index 3c360d4f06352..73498a3ea44ce 100644 +--- a/drivers/net/usb/Kconfig ++++ b/drivers/net/usb/Kconfig +@@ -321,7 +321,6 @@ config USB_NET_DM9601 + config USB_NET_SR9700 + tristate "CoreChip-sz SR9700 based USB 1.1 10/100 ethernet devices" + depends on USB_USBNET +- select CRC32 + help + This option adds support for CoreChip-sz SR9700 based USB 1.1 + 10/100 Ethernet adapters. +diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c +index 213b4817cfdf6..e4d7bcd0d99c2 100644 +--- a/drivers/net/usb/sr9700.c ++++ b/drivers/net/usb/sr9700.c +@@ -18,7 +18,6 @@ + #include + #include + #include +-#include + #include + + #include "sr9700.h" +@@ -265,31 +264,15 @@ static const struct ethtool_ops sr9700_ethtool_ops = { + static void sr9700_set_multicast(struct net_device *netdev) + { + struct usbnet *dev = netdev_priv(netdev); +- /* We use the 20 byte dev->data for our 8 byte filter buffer +- * to avoid allocating memory that is tricky to free later +- */ +- u8 *hashes = (u8 *)&dev->data; + /* rx_ctl setting : enable, disable_long, disable_crc */ + u8 rx_ctl = RCR_RXEN | RCR_DIS_CRC | RCR_DIS_LONG; + +- memset(hashes, 0x00, SR_MCAST_SIZE); +- /* broadcast address */ +- hashes[SR_MCAST_SIZE - 1] |= SR_MCAST_ADDR_FLAG; +- if (netdev->flags & IFF_PROMISC) { ++ if (netdev->flags & IFF_PROMISC) + rx_ctl |= RCR_PRMSC; +- } else if (netdev->flags & IFF_ALLMULTI || +- netdev_mc_count(netdev) > SR_MCAST_MAX) { +- rx_ctl |= RCR_RUNT; +- } else if (!netdev_mc_empty(netdev)) { +- struct netdev_hw_addr *ha; +- +- netdev_for_each_mc_addr(ha, netdev) { +- u32 crc = ether_crc(ETH_ALEN, ha->addr) >> 26; +- hashes[crc >> 3] |= 1 << (crc & 0x7); +- } +- } ++ else if (netdev->flags & IFF_ALLMULTI || !netdev_mc_empty(netdev)) ++ /* The chip has no multicast filter */ ++ rx_ctl |= RCR_ALL; + +- sr_write_async(dev, SR_MAR, SR_MCAST_SIZE, hashes); + sr_write_reg_async(dev, SR_RCR, rx_ctl); + } + +diff --git a/drivers/net/usb/sr9700.h b/drivers/net/usb/sr9700.h +index ea2b4de621c86..c479908f7d823 100644 +--- a/drivers/net/usb/sr9700.h ++++ b/drivers/net/usb/sr9700.h +@@ -104,9 +104,7 @@ + #define WCR_LINKEN (1 << 5) + /* Physical Address Reg */ + #define SR_PAR 0x10 /* 0x10 ~ 0x15 6 bytes for PAR */ +-/* Multicast Address Reg */ +-#define SR_MAR 0x16 /* 0x16 ~ 0x1D 8 bytes for MAR */ +-/* 0x1e unused */ ++/* 0x16 --> 0x1E unused */ + /* Phy Reset Reg */ + #define SR_PRR 0x1F + #define PRR_PHY_RST (1 << 0) +@@ -161,9 +159,6 @@ + /* parameters */ + #define SR_SHARE_TIMEOUT 1000 + #define SR_EEPROM_LEN 256 +-#define SR_MCAST_SIZE 8 +-#define SR_MCAST_ADDR_FLAG 0x80 +-#define SR_MCAST_MAX 64 + #define SR_TX_OVERHEAD 2 /* 2bytes header */ + #define SR_RX_OVERHEAD 7 /* 3bytes header + 4crc tail */ + +-- +2.51.0 + diff --git a/queue-6.12/net-wwan-mhi-add-network-support-for-foxconn-t99w760.patch b/queue-6.12/net-wwan-mhi-add-network-support-for-foxconn-t99w760.patch new file mode 100644 index 00000000000..558fcfd8352 --- /dev/null +++ b/queue-6.12/net-wwan-mhi-add-network-support-for-foxconn-t99w760.patch @@ -0,0 +1,38 @@ +From abfa59333a2841c01a7aa2bfc05ea01d090126af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 10:26:46 +0800 +Subject: net: wwan: mhi: Add network support for Foxconn T99W760 + +From: Slark Xiao + +[ Upstream commit 915a5f60ad947e8dd515d2cc77a96a14dffb3f15 ] + +T99W760 is designed based on Qualcomm SDX35 chip. It use similar +architecture with SDX72/SDX75 chip. So we need to assign initial +link id for this device to make sure network available. + +Signed-off-by: Slark Xiao +Link: https://patch.msgid.link/20260105022646.10630-1-slark_xiao@163.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/wwan/mhi_wwan_mbim.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wwan/mhi_wwan_mbim.c b/drivers/net/wwan/mhi_wwan_mbim.c +index f8bc9a39bfa30..1d7e3ad900c12 100644 +--- a/drivers/net/wwan/mhi_wwan_mbim.c ++++ b/drivers/net/wwan/mhi_wwan_mbim.c +@@ -98,7 +98,8 @@ static struct mhi_mbim_link *mhi_mbim_get_link_rcu(struct mhi_mbim_context *mbim + static int mhi_mbim_get_link_mux_id(struct mhi_controller *cntrl) + { + if (strcmp(cntrl->name, "foxconn-dw5934e") == 0 || +- strcmp(cntrl->name, "foxconn-t99w640") == 0) ++ strcmp(cntrl->name, "foxconn-t99w640") == 0 || ++ strcmp(cntrl->name, "foxconn-t99w760") == 0) + return WDS_BIND_MUX_DATA_PORT_MUX_ID; + + return 0; +-- +2.51.0 + diff --git a/queue-6.12/netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch b/queue-6.12/netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch new file mode 100644 index 00000000000..d49c37998f9 --- /dev/null +++ b/queue-6.12/netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch @@ -0,0 +1,41 @@ +From d28a9aa27312dd29cd04f5d8bf038f266fc036cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Dec 2025 20:53:51 +0900 +Subject: netfilter: nf_conntrack: Add allow_clash to generic protocol handler + +From: Yuto Hamaguchi + +[ Upstream commit 8a49fc8d8a3e83dc51ec05bcd4007bdea3c56eec ] + +The upstream commit, 71d8c47fc653711c41bc3282e5b0e605b3727956 + ("netfilter: conntrack: introduce clash resolution on insertion race"), +sets allow_clash=true in the UDP/UDPLITE protocol handler +but does not set it in the generic protocol handler. + +As a result, packets composed of connectionless protocols at each layer, +such as UDP over IP-in-IP, still drop packets due to conflicts during conntrack insertion. + +To resolve this, this patch sets allow_clash in the nf_conntrack_l4proto_generic. + +Signed-off-by: Yuto Hamaguchi +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_proto_generic.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c +index e831637bc8ca8..cb260eb3d012c 100644 +--- a/net/netfilter/nf_conntrack_proto_generic.c ++++ b/net/netfilter/nf_conntrack_proto_generic.c +@@ -67,6 +67,7 @@ void nf_conntrack_generic_init_net(struct net *net) + const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic = + { + .l4proto = 255, ++ .allow_clash = true, + #ifdef CONFIG_NF_CONNTRACK_TIMEOUT + .ctnl_timeout = { + .nlattr_to_obj = generic_timeout_nlattr_to_obj, +-- +2.51.0 + diff --git a/queue-6.12/netfilter-xt_tcpmss-check-remaining-length-before-re.patch b/queue-6.12/netfilter-xt_tcpmss-check-remaining-length-before-re.patch new file mode 100644 index 00000000000..7af184673bb --- /dev/null +++ b/queue-6.12/netfilter-xt_tcpmss-check-remaining-length-before-re.patch @@ -0,0 +1,42 @@ +From 5701cec8128d88d39b1314f882ce84e9a6387e10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 12:30:42 +0100 +Subject: netfilter: xt_tcpmss: check remaining length before reading optlen + +From: Florian Westphal + +[ Upstream commit 735ee8582da3d239eb0c7a53adca61b79fb228b3 ] + +Quoting reporter: + In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads + op[i+1] directly without validating the remaining option length. + + If the last byte of the option field is not EOL/NOP (0/1), the code attempts + to index op[i+1]. In the case where i + 1 == optlen, this causes an + out-of-bounds read, accessing memory past the optlen boundary + (either reading beyond the stack buffer _opt or the + following payload). + +Reported-by: sungzii +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/xt_tcpmss.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c +index 37704ab017992..0d32d4841cb32 100644 +--- a/net/netfilter/xt_tcpmss.c ++++ b/net/netfilter/xt_tcpmss.c +@@ -61,7 +61,7 @@ tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par) + return (mssval >= info->mss_min && + mssval <= info->mss_max) ^ info->invert; + } +- if (op[i] < 2) ++ if (op[i] < 2 || i == optlen - 1) + i++; + else + i += op[i+1] ? : 1; +-- +2.51.0 + diff --git a/queue-6.12/nfc-nxp-nci-remove-interrupt-trigger-type.patch b/queue-6.12/nfc-nxp-nci-remove-interrupt-trigger-type.patch new file mode 100644 index 00000000000..c1dc524a0c4 --- /dev/null +++ b/queue-6.12/nfc-nxp-nci-remove-interrupt-trigger-type.patch @@ -0,0 +1,42 @@ +From 04314a94b763b14a744a40cce9caa259a22f7db5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Feb 2026 19:11:39 +0800 +Subject: nfc: nxp-nci: remove interrupt trigger type + +From: Carl Lee + +[ Upstream commit 57be33f85e369ce9f69f61eaa34734e0d3bd47a7 ] + +For NXP NCI devices (e.g. PN7150), the interrupt is level-triggered and +active high, not edge-triggered. + +Using IRQF_TRIGGER_RISING in the driver can cause interrupts to fail +to trigger correctly. + +Remove IRQF_TRIGGER_RISING and rely on the IRQ trigger type configured +via Device Tree. + +Signed-off-by: Carl Lee +Link: https://patch.msgid.link/20260205-fc-nxp-nci-remove-interrupt-trigger-type-v2-1-79d2ed4a7e42@amd.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/nfc/nxp-nci/i2c.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c +index 049662ffdf972..6a5ce8ff91f0b 100644 +--- a/drivers/nfc/nxp-nci/i2c.c ++++ b/drivers/nfc/nxp-nci/i2c.c +@@ -305,7 +305,7 @@ static int nxp_nci_i2c_probe(struct i2c_client *client) + + r = request_threaded_irq(client->irq, NULL, + nxp_nci_i2c_irq_thread_fn, +- IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ IRQF_ONESHOT, + NXP_NCI_I2C_DRIVER_NAME, phy); + if (r < 0) + nfc_err(&client->dev, "Unable to register IRQ handler\n"); +-- +2.51.0 + diff --git a/queue-6.12/ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch b/queue-6.12/ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch new file mode 100644 index 00000000000..cc0d3fb9f44 --- /dev/null +++ b/queue-6.12/ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch @@ -0,0 +1,40 @@ +From 41c6c4cde24a4bb9608f6cbda58ac49d1de235b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2025 14:53:18 -0800 +Subject: ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access + +From: Maciej Grochowski + +[ Upstream commit c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface ] + +Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS, +This patch protects against invalid index out of bounds access to mw_sizes +When invalid access print message to user that configuration is not valid. + +Signed-off-by: Maciej Grochowski +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +index f851397b65d6e..f15ebab138144 100644 +--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c ++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +@@ -1314,6 +1314,12 @@ static void switchtec_ntb_init_shared(struct switchtec_ntb *sndev) + for (i = 0; i < sndev->nr_lut_mw; i++) { + int idx = sndev->nr_direct_mw + i; + ++ if (idx >= MAX_MWS) { ++ dev_err(&sndev->stdev->dev, ++ "Total number of MW cannot be bigger than %d", MAX_MWS); ++ break; ++ } ++ + sndev->self_shared->mw_sizes[idx] = LUT_SIZE; + } + } +-- +2.51.0 + diff --git a/queue-6.12/ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch b/queue-6.12/ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch new file mode 100644 index 00000000000..9bbbfebd905 --- /dev/null +++ b/queue-6.12/ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch @@ -0,0 +1,48 @@ +From 69981db3d53bf263d42147a3ecf5d635905f33d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2025 14:53:17 -0800 +Subject: ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut + +From: Maciej Grochowski + +[ Upstream commit 186615f8855a0be4ee7d3fcd09a8ecc10e783b08 ] + +Number of MW LUTs depends on NTB configuration and can be set to zero, +in such scenario rounddown_pow_of_two will cause undefined behaviour and +should not be performed. +This patch ensures that rounddown_pow_of_two is called on valid value. + +Signed-off-by: Maciej Grochowski +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +index f15ebab138144..0536521fa6ccc 100644 +--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c ++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +@@ -1202,7 +1202,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev) + sndev->mmio_self_ctrl); + + sndev->nr_lut_mw = ioread16(&sndev->mmio_self_ctrl->lut_table_entries); +- sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw); ++ if (sndev->nr_lut_mw) ++ sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw); + + dev_dbg(&sndev->stdev->dev, "MWs: %d direct, %d lut\n", + sndev->nr_direct_mw, sndev->nr_lut_mw); +@@ -1212,7 +1213,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev) + + sndev->peer_nr_lut_mw = + ioread16(&sndev->mmio_peer_ctrl->lut_table_entries); +- sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw); ++ if (sndev->peer_nr_lut_mw) ++ sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw); + + dev_dbg(&sndev->stdev->dev, "Peer MWs: %d direct, %d lut\n", + sndev->peer_nr_direct_mw, sndev->peer_nr_lut_mw); +-- +2.51.0 + diff --git a/queue-6.12/octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch b/queue-6.12/octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch new file mode 100644 index 00000000000..f06f721a64b --- /dev/null +++ b/queue-6.12/octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch @@ -0,0 +1,69 @@ +From 925388727682d9c2639a75cdd74dfe6661b1c0df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 18:21:47 +0530 +Subject: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geetha sowjanya + +[ Upstream commit 70e9a5760abfb6338d63994d4de6b0778ec795d6 ] + +NIX SQ manager sticky mode is known to cause stalls when multiple SQs +share an SMQ and transmit concurrently. Additionally, PSE may deadlock +on transitions between sticky and non-sticky transmissions. There is +also a credit drop issue observed when certain condition clocks are +gated. + +work around these hardware errata by: +- Disabling SQM sticky operation: + - Clear TM6 (bit 15) + - Clear TM11 (bit 14) +- Disabling sticky → non-sticky transition path that can deadlock PSE: + - Clear TM5 (bit 23) +- Preventing credit drops by keeping the control-flow clock enabled: + - Set TM9 (bit 21) + +These changes are applied via NIX_AF_SQM_DBG_CTL_STATUS. With this +configuration the SQM/PSE maintain forward progress under load without +credit loss, at the cost of disabling sticky optimizations. + +Signed-off-by: Geetha sowjanya +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260127125147.1642-1-gakula@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +index da69350c6f765..0a23e0a918280 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +@@ -4861,12 +4861,18 @@ static int rvu_nix_block_init(struct rvu *rvu, struct nix_hw *nix_hw) + /* Set chan/link to backpressure TL3 instead of TL2 */ + rvu_write64(rvu, blkaddr, NIX_AF_PSE_CHANNEL_LEVEL, 0x01); + +- /* Disable SQ manager's sticky mode operation (set TM6 = 0) ++ /* Disable SQ manager's sticky mode operation (set TM6 = 0, TM11 = 0) + * This sticky mode is known to cause SQ stalls when multiple +- * SQs are mapped to same SMQ and transmitting pkts at a time. ++ * SQs are mapped to same SMQ and transmitting pkts simultaneously. ++ * NIX PSE may deadlock when there are any sticky to non-sticky ++ * transmission. Hence disable it (TM5 = 0). + */ + cfg = rvu_read64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS); +- cfg &= ~BIT_ULL(15); ++ cfg &= ~(BIT_ULL(15) | BIT_ULL(14) | BIT_ULL(23)); ++ /* NIX may drop credits when condition clocks are turned off. ++ * Hence enable control flow clk (set TM9 = 1). ++ */ ++ cfg |= BIT_ULL(21); + rvu_write64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS, cfg); + + ltdefs = rvu->kpu.lt_def; +-- +2.51.0 + diff --git a/queue-6.12/openrisc-define-arch-specific-version-of-nop.patch b/queue-6.12/openrisc-define-arch-specific-version-of-nop.patch new file mode 100644 index 00000000000..fa241753f27 --- /dev/null +++ b/queue-6.12/openrisc-define-arch-specific-version-of-nop.patch @@ -0,0 +1,53 @@ +From dffd1ec9e0224c644fd6b2d1dfbf488497c2b7e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 12:07:23 -0500 +Subject: openrisc: define arch-specific version of nop() + +From: Brian Masney + +[ Upstream commit 0dfffa5479d6260d04d021f69203b1926f73d889 ] + +When compiling a driver written for MIPS on OpenRISC that uses the nop() +function, it fails due to the following error: + + drivers/watchdog/pic32-wdt.c: Assembler messages: + drivers/watchdog/pic32-wdt.c:125: Error: unrecognized instruction `nop' + +The driver currently uses the generic version of nop() from +include/asm-generic/barrier.h: + + #ifndef nop + #define nop() asm volatile ("nop") + #endif + +Let's fix this on OpenRISC by defining an architecture-specific version +of nop(). + +This was tested by performing an allmodconfig openrisc cross compile on +an aarch64 host. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202601180236.BVy480We-lkp@intel.com/ +Signed-off-by: Brian Masney +Signed-off-by: Stafford Horne +Signed-off-by: Sasha Levin +--- + arch/openrisc/include/asm/barrier.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h +index 7538294721bed..8e592c9909023 100644 +--- a/arch/openrisc/include/asm/barrier.h ++++ b/arch/openrisc/include/asm/barrier.h +@@ -4,6 +4,8 @@ + + #define mb() asm volatile ("l.msync" ::: "memory") + ++#define nop() asm volatile ("l.nop") ++ + #include + + #endif /* __ASM_BARRIER_H */ +-- +2.51.0 + diff --git a/queue-6.12/parisc-prevent-interrupts-during-reboot.patch b/queue-6.12/parisc-prevent-interrupts-during-reboot.patch new file mode 100644 index 00000000000..123ee697a3b --- /dev/null +++ b/queue-6.12/parisc-prevent-interrupts-during-reboot.patch @@ -0,0 +1,32 @@ +From 07c135ba194df719ee370fce1975e010c5e3a5b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 17:58:55 +0100 +Subject: parisc: Prevent interrupts during reboot + +From: Helge Deller + +[ Upstream commit 35ac5a728c878594f2ea6c43b57652a16be3c968 ] + +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/kernel/process.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c +index ed93bd8c15453..d7b0f233f2cc9 100644 +--- a/arch/parisc/kernel/process.c ++++ b/arch/parisc/kernel/process.c +@@ -85,6 +85,9 @@ void machine_restart(char *cmd) + #endif + /* set up a new led state on systems shipped with a LED State panel */ + pdc_chassis_send_status(PDC_CHASSIS_DIRECT_SHUTDOWN); ++ ++ /* prevent interrupts during reboot */ ++ set_eiem(0); + + /* "Normal" system reset */ + pdc_do_reset(); +-- +2.51.0 + diff --git a/queue-6.12/pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch b/queue-6.12/pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch new file mode 100644 index 00000000000..8e781ef1858 --- /dev/null +++ b/queue-6.12/pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch @@ -0,0 +1,41 @@ +From 48468bbb8049cbb0ddea1783978061f8214b6559 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jan 2026 13:53:32 +0530 +Subject: PCI: Add ACS quirk for Qualcomm Hamoa & Glymur + +From: Krishna Chaitanya Chundru + +[ Upstream commit 44d2f70b1fd72c339c72983fcffa181beae3e113 ] + +The Qualcomm Hamoa & Glymur Root Ports don't advertise an ACS capability, +but they do provide ACS-like features to disable peer transactions and +validate bus numbers in requests. + +Add an ACS quirk for Hamoa & Glymur. + +Signed-off-by: Krishna Chaitanya Chundru +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20260109-acs_quirk-v1-1-82adf95a89ae@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 7162bc6d073c8..8f2f8ea9ff9a0 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -5117,6 +5117,10 @@ static const struct pci_dev_acs_enabled { + { PCI_VENDOR_ID_QCOM, 0x0401, pci_quirk_qcom_rp_acs }, + /* QCOM SA8775P root port */ + { PCI_VENDOR_ID_QCOM, 0x0115, pci_quirk_qcom_rp_acs }, ++ /* QCOM Hamoa root port */ ++ { PCI_VENDOR_ID_QCOM, 0x0111, pci_quirk_qcom_rp_acs }, ++ /* QCOM Glymur root port */ ++ { PCI_VENDOR_ID_QCOM, 0x0120, pci_quirk_qcom_rp_acs }, + /* HXT SD4800 root ports. The ACS design is same as QCOM QDF2xxx */ + { PCI_VENDOR_ID_HXT, 0x0401, pci_quirk_qcom_rp_acs }, + /* Intel PCH root ports */ +-- +2.51.0 + diff --git a/queue-6.12/pci-add-intel-nova-lake-audio-device-id.patch b/queue-6.12/pci-add-intel-nova-lake-audio-device-id.patch new file mode 100644 index 00000000000..04c7aaeced5 --- /dev/null +++ b/queue-6.12/pci-add-intel-nova-lake-audio-device-id.patch @@ -0,0 +1,42 @@ +From 918cb544648df9179037eded1fcdc4df9dc85982 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 21:35:04 +0200 +Subject: PCI: Add Intel Nova Lake audio Device ID + +From: Peter Ujfalusi + +[ Upstream commit b190870e0e0cfb375c0d4da02761c32083f3644d ] + +Add Nova Lake (NVL) audio Device ID + +The ID will be used by HDA legacy, SOF audio stack and the driver +to determine which audio stack should be used (intel-dsp-config). + +Signed-off-by: Peter Ujfalusi +Reviewed-by: Kai Vehmanen +Reviewed-by: Liam Girdwood +Reviewed-by: Ranjani Sridharan +Acked-by: Bjorn Helgaas +Acked-by: Takashi Iwai +Link: https://patch.msgid.link/20260120193507.14019-2-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + include/linux/pci_ids.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h +index c395b3c5c05cf..ba1b9617f724a 100644 +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -3134,6 +3134,7 @@ + #define PCI_DEVICE_ID_INTEL_HDA_CML_S 0xa3f0 + #define PCI_DEVICE_ID_INTEL_HDA_LNL_P 0xa828 + #define PCI_DEVICE_ID_INTEL_S21152BB 0xb152 ++#define PCI_DEVICE_ID_INTEL_HDA_NVL 0xd328 + #define PCI_DEVICE_ID_INTEL_HDA_BMG 0xe2f7 + #define PCI_DEVICE_ID_INTEL_HDA_PTL_H 0xe328 + #define PCI_DEVICE_ID_INTEL_HDA_PTL 0xe428 +-- +2.51.0 + diff --git a/queue-6.12/pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch b/queue-6.12/pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch new file mode 100644 index 00000000000..3eef4a7bd95 --- /dev/null +++ b/queue-6.12/pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch @@ -0,0 +1,94 @@ +From 4004bbcf40cb98a1bd74e86170a6c8e430a823b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 10:25:51 +0100 +Subject: PCI/AER: Clear stale errors on reporting agents upon probe + +From: Lukas Wunner + +[ Upstream commit e242d09b58e869f86071b7889acace4cff215935 ] + +Correctable and Uncorrectable Error Status Registers on reporting agents +are cleared upon PCI device enumeration in pci_aer_init() to flush past +events. They're cleared again when an error is handled by the AER driver. + +If an agent reports a new error after pci_aer_init() and before the AER +driver has probed on the corresponding Root Port or Root Complex Event +Collector, that error is not handled by the AER driver: It clears the +Root Error Status Register on probe, but neglects to re-clear the +Correctable and Uncorrectable Error Status Registers on reporting agents. + +The error will eventually be reported when another error occurs. Which +is irritating because to an end user it appears as if the earlier error +has just happened. + +Amend the AER driver to clear stale errors on reporting agents upon probe. + +Skip reporting agents which have not invoked pci_aer_init() yet to avoid +using an uninitialized pdev->aer_cap. They're recognizable by the error +bits in the Device Control register still being clear. + +Reporting agents may execute pci_aer_init() after the AER driver has +probed, particularly when devices are hotplugged or removed/rescanned via +sysfs. For this reason, it continues to be necessary that pci_aer_init() +clears Correctable and Uncorrectable Error Status Registers. + +Reported-by: Lucas Van # off-list +Signed-off-by: Lukas Wunner +Signed-off-by: Bjorn Helgaas +Tested-by: Lucas Van +Reviewed-by: Kuppuswamy Sathyanarayanan +Link: https://patch.msgid.link/3011c2ed30c11f858e35e29939add754adea7478.1769332702.git.lukas@wunner.de +Signed-off-by: Sasha Levin +--- + drivers/pci/pcie/aer.c | 26 +++++++++++++++++++++++++- + 1 file changed, 25 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c +index 36b6188a3a46f..fe7603e7ee8c8 100644 +--- a/drivers/pci/pcie/aer.c ++++ b/drivers/pci/pcie/aer.c +@@ -1386,6 +1386,20 @@ static void aer_disable_irq(struct pci_dev *pdev) + pci_write_config_dword(pdev, aer + PCI_ERR_ROOT_COMMAND, reg32); + } + ++static int clear_status_iter(struct pci_dev *dev, void *data) ++{ ++ u16 devctl; ++ ++ /* Skip if pci_enable_pcie_error_reporting() hasn't been called yet */ ++ pcie_capability_read_word(dev, PCI_EXP_DEVCTL, &devctl); ++ if (!(devctl & PCI_EXP_AER_FLAGS)) ++ return 0; ++ ++ pci_aer_clear_status(dev); ++ pcie_clear_device_status(dev); ++ return 0; ++} ++ + /** + * aer_enable_rootport - enable Root Port's interrupts when receiving messages + * @rpc: pointer to a Root Port data structure +@@ -1407,9 +1421,19 @@ static void aer_enable_rootport(struct aer_rpc *rpc) + pcie_capability_clear_word(pdev, PCI_EXP_RTCTL, + SYSTEM_ERROR_INTR_ON_MESG_MASK); + +- /* Clear error status */ ++ /* Clear error status of this Root Port or RCEC */ + pci_read_config_dword(pdev, aer + PCI_ERR_ROOT_STATUS, ®32); + pci_write_config_dword(pdev, aer + PCI_ERR_ROOT_STATUS, reg32); ++ ++ /* Clear error status of agents reporting to this Root Port or RCEC */ ++ if (reg32 & AER_ERR_STATUS_MASK) { ++ if (pci_pcie_type(pdev) == PCI_EXP_TYPE_RC_EC) ++ pcie_walk_rcec(pdev, clear_status_iter, NULL); ++ else if (pdev->subordinate) ++ pci_walk_bus(pdev->subordinate, clear_status_iter, ++ NULL); ++ } ++ + pci_read_config_dword(pdev, aer + PCI_ERR_COR_STATUS, ®32); + pci_write_config_dword(pdev, aer + PCI_ERR_COR_STATUS, reg32); + pci_read_config_dword(pdev, aer + PCI_ERR_UNCOR_STATUS, ®32); +-- +2.51.0 + diff --git a/queue-6.12/pci-enable-acs-after-configuring-iommu-for-of-platfo.patch b/queue-6.12/pci-enable-acs-after-configuring-iommu-for-of-platfo.patch new file mode 100644 index 00000000000..53ac53e7c70 --- /dev/null +++ b/queue-6.12/pci-enable-acs-after-configuring-iommu-for-of-platfo.patch @@ -0,0 +1,136 @@ +From 8a05b5b9bbc8bfb7dd08b6d3173dbf8946f9a01c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jan 2026 21:04:47 +0530 +Subject: PCI: Enable ACS after configuring IOMMU for OF platforms + +From: Manivannan Sadhasivam + +[ Upstream commit c41e2fb67e26b04d919257875fa954aa5f6e392e ] + +Platform, ACPI, or IOMMU drivers call pci_request_acs(), which sets +'pci_acs_enable' to request that ACS be enabled for any devices enumerated +in the future. + +OF platforms called pci_enable_acs() for the first device before +of_iommu_configure() called pci_request_acs(), so ACS was never enabled for +that device (typically a Root Port). + +Call pci_enable_acs() later, from pci_dma_configure(), after +of_dma_configure() has had a chance to call pci_request_acs(). + +Here's the call path, showing the move of pci_enable_acs() from +pci_acs_init() to pci_dma_configure(), where it always happens after +pci_request_acs(): + + pci_device_add + pci_init_capabilities + pci_acs_init + - pci_enable_acs + - if (pci_acs_enable) <-- previous test + - ... + device_add + bus_notify(BUS_NOTIFY_ADD_DEVICE) + iommu_bus_notifier + iommu_probe_device + iommu_init_device + dev->bus->dma_configure + pci_dma_configure # pci_bus_type.dma_configure + of_dma_configure + of_iommu_configure + pci_request_acs + pci_acs_enable = 1 <-- set + + pci_enable_acs + + if (pci_acs_enable) <-- new test + + ... + bus_probe_device + device_initial_probe + ... + really_probe + dev->bus->dma_configure + pci_dma_configure # pci_bus_type.dma_configure + ... + pci_enable_acs + +Note that we will now call pci_enable_acs() twice for every device, first +from the iommu_probe_device() path and again from the really_probe() path. +Presumably that's not an issue since we also call dev->bus->dma_configure() +twice. + +For the ACPI platforms, pci_request_acs() is called during ACPI +initialization time itself, independent of the IOMMU framework. + +Signed-off-by: Manivannan Sadhasivam +[bhelgaas: commit log] +Signed-off-by: Bjorn Helgaas +Tested-by: Marek Szyprowski +Tested-by: Naresh Kamboju +Link: https://patch.msgid.link/20260102-pci_acs-v3-1-72280b94d288@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/pci/pci-driver.c | 8 ++++++++ + drivers/pci/pci.c | 10 +--------- + drivers/pci/pci.h | 1 + + 3 files changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c +index a00a2ce01045f..9846ab70cff11 100644 +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -1656,6 +1656,14 @@ static int pci_dma_configure(struct device *dev) + ret = acpi_dma_configure(dev, acpi_get_dma_attr(adev)); + } + ++ /* ++ * Attempt to enable ACS regardless of capability because some Root ++ * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have ++ * the standard ACS capability but still support ACS via those ++ * quirks. ++ */ ++ pci_enable_acs(to_pci_dev(dev)); ++ + pci_put_host_bridge_device(bridge); + + if (!ret && !driver->driver_managed_dma) { +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index c1cdc9b717906..e3e7b4008ac98 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -1072,7 +1072,7 @@ static void pci_std_enable_acs(struct pci_dev *dev, struct pci_acs *caps) + * pci_enable_acs - enable ACS if hardware support it + * @dev: the PCI device + */ +-static void pci_enable_acs(struct pci_dev *dev) ++void pci_enable_acs(struct pci_dev *dev) + { + struct pci_acs caps; + bool enable_acs = false; +@@ -3718,14 +3718,6 @@ bool pci_acs_path_enabled(struct pci_dev *start, + void pci_acs_init(struct pci_dev *dev) + { + dev->acs_cap = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ACS); +- +- /* +- * Attempt to enable ACS regardless of capability because some Root +- * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have +- * the standard ACS capability but still support ACS via those +- * quirks. +- */ +- pci_enable_acs(dev); + } + + /** +diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h +index b1f393a42a875..b9b97ec0f836a 100644 +--- a/drivers/pci/pci.h ++++ b/drivers/pci/pci.h +@@ -653,6 +653,7 @@ static inline resource_size_t pci_resource_alignment(struct pci_dev *dev, + } + + void pci_acs_init(struct pci_dev *dev); ++void pci_enable_acs(struct pci_dev *dev); + #ifdef CONFIG_PCI_QUIRKS + int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags); + int pci_dev_specific_enable_acs(struct pci_dev *dev); +-- +2.51.0 + diff --git a/queue-6.12/pci-fix-pci_slot_lock-device-locking.patch b/queue-6.12/pci-fix-pci_slot_lock-device-locking.patch new file mode 100644 index 00000000000..eace35bfc47 --- /dev/null +++ b/queue-6.12/pci-fix-pci_slot_lock-device-locking.patch @@ -0,0 +1,97 @@ +From 4c392570f6861e1218a9a341885396c52546e554 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 08:59:51 -0800 +Subject: PCI: Fix pci_slot_lock () device locking + +From: Keith Busch + +[ Upstream commit 1f5e57c622b4dc9b8e7d291d560138d92cfbe5bf ] + +Like pci_bus_lock(), pci_slot_lock() needs to lock the bridge device to +prevent warnings like: + + pcieport 0000:e2:05.0: unlocked secondary bus reset via: pciehp_reset_slot+0x55/0xa0 + +Take and release the lock for the bridge providing the slot for the +lock/trylock and unlock routines. + +Signed-off-by: Keith Busch +Signed-off-by: Bjorn Helgaas +Reviewed-by: Dan Williams +Link: https://patch.msgid.link/20260130165953.751063-3-kbusch@meta.com +Signed-off-by: Sasha Levin +--- + drivers/pci/pci.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index aad6cb7949ff9..c1cdc9b717906 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -5610,10 +5610,9 @@ static int pci_bus_trylock(struct pci_bus *bus) + /* Do any devices on or below this slot prevent a bus reset? */ + static bool pci_slot_resettable(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; + +- if (slot->bus->self && +- (slot->bus->self->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET)) ++ if (bridge && (bridge->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET)) + return false; + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { +@@ -5630,7 +5629,10 @@ static bool pci_slot_resettable(struct pci_slot *slot) + /* Lock devices from the top of the tree down */ + static void pci_slot_lock(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; ++ ++ if (bridge) ++ pci_dev_lock(bridge); + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { + if (!dev->slot || dev->slot != slot) +@@ -5645,7 +5647,7 @@ static void pci_slot_lock(struct pci_slot *slot) + /* Unlock devices from the bottom of the tree up */ + static void pci_slot_unlock(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { + if (!dev->slot || dev->slot != slot) +@@ -5655,12 +5657,18 @@ static void pci_slot_unlock(struct pci_slot *slot) + else + pci_dev_unlock(dev); + } ++ ++ if (bridge) ++ pci_dev_unlock(bridge); + } + + /* Return 1 on successful lock, 0 on contention */ + static int pci_slot_trylock(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; ++ ++ if (bridge && !pci_dev_trylock(bridge)) ++ return 0; + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { + if (!dev->slot || dev->slot != slot) +@@ -5685,6 +5693,9 @@ static int pci_slot_trylock(struct pci_slot *slot) + else + pci_dev_unlock(dev); + } ++ ++ if (bridge) ++ pci_dev_unlock(bridge); + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.12/pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch b/queue-6.12/pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch new file mode 100644 index 00000000000..603138b7283 --- /dev/null +++ b/queue-6.12/pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch @@ -0,0 +1,51 @@ +From e23b9e580358cd383348b427718b58f00082cd40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 17:02:08 -0700 +Subject: PCI: Mark ASM1164 SATA controller to avoid bus reset + +From: Alex Williamson + +[ Upstream commit beb2f81792a8a619e5122b6b24a374861309c54b ] + +User forums report issues when assigning ASM1164 SATA controllers to VMs, +especially in configurations with multiple controllers. Logs show the +device fails to retrain after bus reset. Reports suggest this is an issue +across multiple platforms. The device indicates support for PM reset, +therefore the device still has a viable function level reset mechanism. +The reporting user confirms the device is well behaved in this use case +with bus reset disabled. + +Reported-by: Patrick Bianchi +Link: https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/ +Signed-off-by: Alex Williamson +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20260109000211.398300-1-alex.williamson@nvidia.com +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index d9ba1786fc1ae..7162bc6d073c8 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3791,6 +3791,16 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_CAVIUM, 0xa100, quirk_no_bus_reset); + */ + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TI, 0xb005, quirk_no_bus_reset); + ++/* ++ * Reports from users making use of PCI device assignment with ASM1164 ++ * controllers indicate an issue with bus reset where the device fails to ++ * retrain. The issue appears more common in configurations with multiple ++ * controllers. The device does indicate PM reset support (NoSoftRst-), ++ * therefore this still leaves a viable reset method. ++ * https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/ ++ */ ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ASMEDIA, 0x1164, quirk_no_bus_reset); ++ + static void quirk_no_pm_reset(struct pci_dev *dev) + { + /* +-- +2.51.0 + diff --git a/queue-6.12/pci-mark-nvidia-gb10-to-avoid-bus-reset.patch b/queue-6.12/pci-mark-nvidia-gb10-to-avoid-bus-reset.patch new file mode 100644 index 00000000000..5857cd2f145 --- /dev/null +++ b/queue-6.12/pci-mark-nvidia-gb10-to-avoid-bus-reset.patch @@ -0,0 +1,47 @@ +From 465c402dcdaac00cc226c069640f951ffabd79b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Nov 2025 16:44:06 +0800 +Subject: PCI: Mark Nvidia GB10 to avoid bus reset + +From: Johnny-CC Chang + +[ Upstream commit c81a2ce6b6a844d1a57d2a69833a9d0f00403f00 ] + +After asserting Secondary Bus Reset to downstream devices via a GB10 Root +Port, the link may not retrain correctly, e.g., the link may retrain with a +lower lane count or config accesses to downstream devices may fail. + +Prevent use of Secondary Bus Reset for devices below GB10. + +Signed-off-by: Johnny-CC Chang +[bhelgaas: drop pci_ids.h update (only used once), update commit log] +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Link: https://patch.msgid.link/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 8f2f8ea9ff9a0..3d05ea35c536f 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3748,6 +3748,14 @@ static void quirk_no_bus_reset(struct pci_dev *dev) + dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET; + } + ++/* ++ * After asserting Secondary Bus Reset to downstream devices via a GB10 ++ * Root Port, the link may not retrain correctly. ++ * https://lore.kernel.org/r/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com ++ */ ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22CE, quirk_no_bus_reset); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22D0, quirk_no_bus_reset); ++ + /* + * Some NVIDIA GPU devices do not work with bus reset, SBR needs to be + * prevented for those affected devices. +-- +2.51.0 + diff --git a/queue-6.12/pci-msi-unmap-msi-x-region-on-error.patch b/queue-6.12/pci-msi-unmap-msi-x-region-on-error.patch new file mode 100644 index 00000000000..aa1c27ab819 --- /dev/null +++ b/queue-6.12/pci-msi-unmap-msi-x-region-on-error.patch @@ -0,0 +1,49 @@ +From c4ff629ac4d9f9673ae5d63c8341c7f90c76cdcb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 22:44:52 +0800 +Subject: PCI/MSI: Unmap MSI-X region on error + +From: Haoxiang Li + +[ Upstream commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202 ] + +msix_capability_init() fails to unmap the MSI-X region if +msix_setup_interrupts() fails. + +Add the missing iounmap() for that error path. + +[ tglx: Massaged change log ] + +Signed-off-by: Haoxiang Li +Signed-off-by: Thomas Gleixner +Link: https://patch.msgid.link/20260125144452.2103812-1-lihaoxiang@isrc.iscas.ac.cn +Signed-off-by: Sasha Levin +--- + drivers/pci/msi/msi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c +index 8b88487886184..54627c3a2dc8c 100644 +--- a/drivers/pci/msi/msi.c ++++ b/drivers/pci/msi/msi.c +@@ -739,7 +739,7 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries, + + ret = msix_setup_interrupts(dev, entries, nvec, affd); + if (ret) +- goto out_disable; ++ goto out_unmap; + + /* Disable INTX */ + pci_intx_for_msi(dev, 0); +@@ -760,6 +760,8 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries, + pcibios_free_irq(dev); + return 0; + ++out_unmap: ++ iounmap(dev->msix_base); + out_disable: + dev->msix_enabled = 0; + pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL | PCI_MSIX_FLAGS_ENABLE, 0); +-- +2.51.0 + diff --git a/queue-6.12/perf-annotate-fix-memcpy-size-in-arch__grow_instruct.patch b/queue-6.12/perf-annotate-fix-memcpy-size-in-arch__grow_instruct.patch new file mode 100644 index 00000000000..fc69f73e75b --- /dev/null +++ b/queue-6.12/perf-annotate-fix-memcpy-size-in-arch__grow_instruct.patch @@ -0,0 +1,52 @@ +From 3b233fcda4dc06e96532fdb20a274abe4f481552 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 22:47:04 +0530 +Subject: perf annotate: Fix memcpy size in arch__grow_instructions() + +From: Suchit Karunakaran + +[ Upstream commit f0d98c78f8bf73ce2a9b7793f66cda240fa9ab10 ] + +The memcpy() in arch__grow_instructions() is copying the wrong number of +bytes when growing from a non-allocated table. + +It should copy arch->nr_instructions * sizeof(struct ins) bytes, not +just arch->nr_instructions bytes. + +This bug causes data corruption as only a partial copy of the +instruction table is made, leading to garbage data in most entries and +potential crashes + +Fixes: 2a1ff812c40be982 ("perf annotate: Introduce alternative method of keeping instructions table") +Reviewed-by: Ian Rogers +Signed-off-by: Suchit Karunakaran +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/disasm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/disasm.c b/tools/perf/util/disasm.c +index a228a7ba30caa..2dc93199ac258 100644 +--- a/tools/perf/util/disasm.c ++++ b/tools/perf/util/disasm.c +@@ -79,7 +79,7 @@ static int arch__grow_instructions(struct arch *arch) + if (new_instructions == NULL) + return -1; + +- memcpy(new_instructions, arch->instructions, arch->nr_instructions); ++ memcpy(new_instructions, arch->instructions, arch->nr_instructions * sizeof(struct ins)); + goto out_update_instructions; + } + +-- +2.51.0 + diff --git a/queue-6.12/perf-arm-cmn-support-cmn-600ae.patch b/queue-6.12/perf-arm-cmn-support-cmn-600ae.patch new file mode 100644 index 00000000000..ec8820d5678 --- /dev/null +++ b/queue-6.12/perf-arm-cmn-support-cmn-600ae.patch @@ -0,0 +1,50 @@ +From 6660f23fb4d810591a5877b4479c686636af29dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 16:39:54 +0000 +Subject: perf/arm-cmn: Support CMN-600AE + +From: Robin Murphy + +[ Upstream commit 12a94953c37e834c3eabb839ce057094946fe67a ] + +The functional safety features of CMN-600AE have little to no impact on +the PMU relative to the base CMN-600 design, so for simplicity we can +reasonably just treat it as the same thing. The only obvious difference +is that the revision numbers aren't aligned, so we may hide some aliases +for events which do actually exist, but those can still be specified via +the underlying "type,eventid" format so it's not too big a deal. + +Signed-off-by: Robin Murphy +Reviewed-by: Ilkka Koskinen +Tested-by: Michal Simek +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm-cmn.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c +index e6b0c8ec9c1fa..3a36cc646c15e 100644 +--- a/drivers/perf/arm-cmn.c ++++ b/drivers/perf/arm-cmn.c +@@ -210,6 +210,7 @@ enum cmn_model { + enum cmn_part { + PART_CMN600 = 0x434, + PART_CMN650 = 0x436, ++ PART_CMN600AE = 0x438, + PART_CMN700 = 0x43c, + PART_CI700 = 0x43a, + PART_CMN_S3 = 0x43e, +@@ -2273,6 +2274,9 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset) + reg = readq_relaxed(cfg_region + CMN_CFGM_PERIPH_ID_01); + part = FIELD_GET(CMN_CFGM_PID0_PART_0, reg); + part |= FIELD_GET(CMN_CFGM_PID1_PART_1, reg) << 8; ++ /* 600AE is close enough that it's not really worth more complexity */ ++ if (part == PART_CMN600AE) ++ part = PART_CMN600; + if (cmn->part && cmn->part != part) + dev_warn(cmn->dev, + "Firmware binding mismatch: expected part number 0x%x, found 0x%x\n", +-- +2.51.0 + diff --git a/queue-6.12/perf-callchain-fix-srcline-printing-with-inlines.patch b/queue-6.12/perf-callchain-fix-srcline-printing-with-inlines.patch new file mode 100644 index 00000000000..dc783d3b296 --- /dev/null +++ b/queue-6.12/perf-callchain-fix-srcline-printing-with-inlines.patch @@ -0,0 +1,55 @@ +From ccc607f7bc4a9fcab0efa939be7c61488824b1c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 20:13:36 -0800 +Subject: perf callchain: Fix srcline printing with inlines + +From: Ian Rogers + +[ Upstream commit abec464767b5d26f0612250d511c18f420826ca1 ] + +sample__fprintf_callchain() was using map__fprintf_srcline() which won't +report inline line numbers. + +Fix by using the srcline from the callchain and falling back to the map +variant. + +Fixes: 25da4fab5f66e659 ("perf evsel: Move fprintf methods to separate source file") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Stephen Brennan +Cc: Tony Jones +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/evsel_fprintf.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/evsel_fprintf.c b/tools/perf/util/evsel_fprintf.c +index c2c0500d5da99..2108e02d4b6cd 100644 +--- a/tools/perf/util/evsel_fprintf.c ++++ b/tools/perf/util/evsel_fprintf.c +@@ -180,8 +180,12 @@ int sample__fprintf_callchain(struct perf_sample *sample, int left_alignment, + if (print_dso && (!sym || !sym->inlined)) + printed += map__fprintf_dsoname_dsoff(map, print_dsoff, addr, fp); + +- if (print_srcline) +- printed += map__fprintf_srcline(map, addr, "\n ", fp); ++ if (print_srcline) { ++ if (node->srcline) ++ printed += fprintf(fp, "\n %s", node->srcline); ++ else ++ printed += map__fprintf_srcline(map, addr, "\n ", fp); ++ } + + if (sym && sym->inlined) + printed += fprintf(fp, " (inlined)"); +-- +2.51.0 + diff --git a/queue-6.12/perf-cxlpmu-replace-irqf_oneshot-with-irqf_no_thread.patch b/queue-6.12/perf-cxlpmu-replace-irqf_oneshot-with-irqf_no_thread.patch new file mode 100644 index 00000000000..429b544d9c9 --- /dev/null +++ b/queue-6.12/perf-cxlpmu-replace-irqf_oneshot-with-irqf_no_thread.patch @@ -0,0 +1,44 @@ +From 7d3f961aeff1a4cece628630fbf6a2132d33505f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:34 +0100 +Subject: perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD + +From: Sebastian Andrzej Siewior + +[ Upstream commit ab26d9c85554c4ff1d95ca8341522880ed9219d6 ] + +Passing IRQF_ONESHOT ensures that the interrupt source is masked until +the secondary (threaded) handler is done. If only a primary handler is +used then the flag makes no sense because the interrupt can not fire +(again) while its handler is running. +The flag also disallows force-threading of the primary handler and the +irq-core will warn about this. + +The intention here was probably not allowing forced-threading. + +Replace IRQF_ONESHOT with IRQF_NO_THREAD. + +Reviewed-by: Jonathan Cameron +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/cxl_pmu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/perf/cxl_pmu.c b/drivers/perf/cxl_pmu.c +index 16328569fde93..24244096f5141 100644 +--- a/drivers/perf/cxl_pmu.c ++++ b/drivers/perf/cxl_pmu.c +@@ -874,7 +874,7 @@ static int cxl_pmu_probe(struct device *dev) + if (!irq_name) + return -ENOMEM; + +- rc = devm_request_irq(dev, irq, cxl_pmu_irq, IRQF_SHARED | IRQF_ONESHOT, ++ rc = devm_request_irq(dev, irq, cxl_pmu_irq, IRQF_SHARED | IRQF_NO_THREAD, + irq_name, info); + if (rc) + return rc; +-- +2.51.0 + diff --git a/queue-6.12/perf-maps-fix-reference-count-leak-in-maps__find_ams.patch b/queue-6.12/perf-maps-fix-reference-count-leak-in-maps__find_ams.patch new file mode 100644 index 00000000000..c01b1148ad7 --- /dev/null +++ b/queue-6.12/perf-maps-fix-reference-count-leak-in-maps__find_ams.patch @@ -0,0 +1,71 @@ +From 0c1c29bc3bada8ba5695482a5646c7338e88b8cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 13:35:07 -0800 +Subject: perf maps: Fix reference count leak in maps__find_ams() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ian Rogers + +[ Upstream commit 6fdd2676db55b503c52dd3f1359b5c57f774ab75 ] + +ams and so ams->ms.map is an in argument, however, it is also +overwritten. As a map is reference counted, ensure a map__put() is done +before overwriting it. + +Fixes: 42fd623b58dbcc48 ("perf maps: Get map before returning in maps__find") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Cc: Aditya Bodkhe +Cc: Adrian Hunter +Cc: Albert Ou +Cc: Alexander Shishkin +Cc: Alexandre Ghiti +Cc: Athira Rajeev +Cc: Bill Wendling +Cc: Dr. David Alan Gilbert +Cc: Guo Ren +Cc: Howard Chu +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: John Garry +Cc: Julia Lawall +Cc: Justin Stitt +Cc: Krzysztof Łopatowski +Cc: Leo Yan +Cc: Namhyung Kim +Cc: Nathan Chancellor +Cc: Nick Desaulniers +Cc: Palmer Dabbelt +Cc: Paul Walmsley +Cc: Peter Zijlstra +Cc: Sergei Trofimovich +Cc: Shimin Guo +Cc: Suchit Karunakaran +Cc: Thomas Falcon +Cc: Tianyou Li +Cc: Will Deacon +Cc: Zecheng Li +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/maps.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/perf/util/maps.c b/tools/perf/util/maps.c +index 09c9cc326c08d..67133b60b03cd 100644 +--- a/tools/perf/util/maps.c ++++ b/tools/perf/util/maps.c +@@ -664,6 +664,7 @@ int maps__find_ams(struct maps *maps, struct addr_map_symbol *ams) + if (ams->addr < map__start(ams->ms.map) || ams->addr >= map__end(ams->ms.map)) { + if (maps == NULL) + return -1; ++ map__put(ams->ms.map); + ams->ms.map = maps__find(maps, ams->addr); + if (ams->ms.map == NULL) + return -1; +-- +2.51.0 + diff --git a/queue-6.12/perf-test-stat-tests-fix-for-virtualized-machines.patch b/queue-6.12/perf-test-stat-tests-fix-for-virtualized-machines.patch new file mode 100644 index 00000000000..aa2b23815b9 --- /dev/null +++ b/queue-6.12/perf-test-stat-tests-fix-for-virtualized-machines.patch @@ -0,0 +1,80 @@ +From 3beeebfdb1fe9a9508ff207062588a772a7fa528 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 14:32:16 +0100 +Subject: perf test stat tests: Fix for virtualized machines + +From: Thomas Richter + +[ Upstream commit e272628902c1c96731e2d9f62a7fc77767686eb0 ] + +On s390 'perf test's 'perf stat tests', subtest test_hybrid fails for +z/VM systems. The root cause is this statement: + + $(perf stat -a -- sleep 0.1 2>&1 |\ + grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* -c) + +The 'perf stat' output on a s390 z/VM system is + + # perf stat -a -- sleep 0.1 2>&1 + Performance counter stats for 'system wide': + + 56 context-switches # 46.3 cs/sec cs_per_second + 1,210.41 msec cpu-clock # 11.9 CPUs CPUs_utilized + 12 cpu-migrations # 9.9 migrations/sec ... + 81 page-faults # 66.9 faults/sec ... + + 0.100891009 seconds time elapsed + +The grep command does not match any single line and exits with error +code 1. + +As the bash script is executed with 'set -e', it aborts with the first +error code being non-zero. + +Fix this and use 'wc -l' to count matching lines instead of 'grep ... -c'. + +Output before: + + # perf test 102 + 102: perf stat tests : FAILED! + # + +Output after: + + # perf test 102 + 102: perf stat tests : Ok + # + +Fixes: bb6e7cb11d97ce19 ("perf tools: Add fallback for exclude_guest") +Reviewed-by: Ian Rogers +Reviewed-by: James Clark +Signed-off-by: Thomas Richter +Cc: Alexander Gordeev +Cc: Heiko Carstens +Cc: Jan Polensky +Cc: linux-s390@vger.kernel.org +Cc: Namhyung Kim +Cc: Sumanth Korikkar +Cc: Vasily Gorbik +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/stat.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh +index a20bf3bdcb9f8..a76ccf2deb563 100755 +--- a/tools/perf/tests/shell/stat.sh ++++ b/tools/perf/tests/shell/stat.sh +@@ -159,7 +159,7 @@ test_hybrid() { + fi + + # Run default Perf stat +- cycles_events=$(perf stat -a -- sleep 0.1 2>&1 | grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* " -c) ++ cycles_events=$(perf stat -a -- sleep 0.1 2>&1 | grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* " | wc -l) + + # The expectation is that default output will have a cycles events on each + # hybrid PMU. In situations with no cycles PMU events, like virtualized, this +-- +2.51.0 + diff --git a/queue-6.12/perf-test-stat-update-test-expectations-and-events.patch b/queue-6.12/perf-test-stat-update-test-expectations-and-events.patch new file mode 100644 index 00000000000..f0e739f5421 --- /dev/null +++ b/queue-6.12/perf-test-stat-update-test-expectations-and-events.patch @@ -0,0 +1,58 @@ +From a3ef83fcc13a4b1cb62b7468b74118778df6bc4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Nov 2025 13:22:04 -0800 +Subject: perf test stat: Update test expectations and events + +From: Ian Rogers + +[ Upstream commit a48cd551d7436be3b1bd65c63a6d00163f7e7706 ] + +test_stat_record_report and test_stat_record_script used default +output which triggers a bug when sending metrics. As this isn't +relevant to the test switch to using named software events. + +Update the match in test_hybrid as the cycles event is now cpu-cycles +to workaround potential ARM issues. + +Signed-off-by: Ian Rogers +Signed-off-by: Namhyung Kim +Stable-dep-of: e272628902c1 ("perf test stat tests: Fix for virtualized machines") +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/stat.sh | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh +index 62f13dfeae8e4..a20bf3bdcb9f8 100755 +--- a/tools/perf/tests/shell/stat.sh ++++ b/tools/perf/tests/shell/stat.sh +@@ -18,7 +18,7 @@ test_default_stat() { + + test_stat_record_report() { + echo "stat record and report test" +- if ! perf stat record -o - true | perf stat report -i - 2>&1 | \ ++ if ! perf stat record -e task-clock -o - true | perf stat report -i - 2>&1 | \ + grep -E -q "Performance counter stats for 'pipe':" + then + echo "stat record and report test [Failed]" +@@ -30,7 +30,7 @@ test_stat_record_report() { + + test_stat_record_script() { + echo "stat record and script test" +- if ! perf stat record -o - true | perf script -i - 2>&1 | \ ++ if ! perf stat record -e task-clock -o - true | perf script -i - 2>&1 | \ + grep -E -q "CPU[[:space:]]+THREAD[[:space:]]+VAL[[:space:]]+ENA[[:space:]]+RUN[[:space:]]+TIME[[:space:]]+EVENT" + then + echo "stat record and script test [Failed]" +@@ -159,7 +159,7 @@ test_hybrid() { + fi + + # Run default Perf stat +- cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/[uH]*| cycles[:uH]* " -c) ++ cycles_events=$(perf stat -a -- sleep 0.1 2>&1 | grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* " -c) + + # The expectation is that default output will have a cycles events on each + # hybrid PMU. In situations with no cycles PMU events, like virtualized, this +-- +2.51.0 + diff --git a/queue-6.12/perf-unwind-libdw-fix-invalid-reference-counts.patch b/queue-6.12/perf-unwind-libdw-fix-invalid-reference-counts.patch new file mode 100644 index 00000000000..f10149b245d --- /dev/null +++ b/queue-6.12/perf-unwind-libdw-fix-invalid-reference-counts.patch @@ -0,0 +1,59 @@ +From ae599a0a20031e4acd3653115e9814e136baaa75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 20:13:32 -0800 +Subject: perf unwind-libdw: Fix invalid reference counts + +From: Ian Rogers + +[ Upstream commit f815fc0c66e777c727689666cfb46b8d461c2f99 ] + +The addition of addr_location__exit() causes use-after put on the maps +and map references in the unwind info. Add the gets and then add the +map_symbol__exit() calls. + +Fixes: 0dd5041c9a0eaf8c ("perf addr_location: Add init/exit/copy functions") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Stephen Brennan +Cc: Tony Jones +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/unwind-libdw.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c +index bde216e630d29..216f0d3762fda 100644 +--- a/tools/perf/util/unwind-libdw.c ++++ b/tools/perf/util/unwind-libdw.c +@@ -133,8 +133,8 @@ static int entry(u64 ip, struct unwind_info *ui) + } + + e->ip = ip; +- e->ms.maps = al.maps; +- e->ms.map = al.map; ++ e->ms.maps = maps__get(al.maps); ++ e->ms.map = map__get(al.map); + e->ms.sym = al.sym; + + pr_debug("unwind: %s:ip = 0x%" PRIx64 " (0x%" PRIx64 ")\n", +@@ -319,6 +319,9 @@ int unwind__get_entries(unwind_entry_cb_t cb, void *arg, + if (err) + pr_debug("unwind: failed with '%s'\n", dwfl_errmsg(-1)); + ++ for (i = 0; i < ui->idx; i++) ++ map_symbol__exit(&ui->entries[i].ms); ++ + dwfl_end(ui->dwfl); + free(ui); + return 0; +-- +2.51.0 + diff --git a/queue-6.12/perf-vendor-events-amd-fix-zen-5-mab-allocation-even.patch b/queue-6.12/perf-vendor-events-amd-fix-zen-5-mab-allocation-even.patch new file mode 100644 index 00000000000..aff947e3c88 --- /dev/null +++ b/queue-6.12/perf-vendor-events-amd-fix-zen-5-mab-allocation-even.patch @@ -0,0 +1,66 @@ +From b79f9eab7cbf3a92318c13a53254b8eb9836d9e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 13:39:46 +0530 +Subject: perf vendor events amd: Fix Zen 5 MAB allocation events + +From: Sandipan Das + +[ Upstream commit 76b2cf07a6d2a836108f9c2486d76599f7adf6e8 ] + +The unit masks for PMCx041 vary across different generations of Zen +processors. + +Fix the Zen 5 events based on PMCx041 as they incorrectly use the same +unit masks as that of Zen 4. + +Fixes: 45c072f2537ab07b ("perf vendor events amd: Add Zen 5 core events") +Reported-by: Suyash Mahar +Reviewed-by: Ian Rogers +Signed-off-by: Sandipan Das +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ananth Narayan +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Ravi Bangoria +Cc: Sandipan Das +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/pmu-events/arch/x86/amdzen5/load-store.json | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json b/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json +index af2fdf1f55d64..917f9d68f85a6 100644 +--- a/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json ++++ b/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json +@@ -70,19 +70,19 @@ + "EventName": "ls_mab_alloc.load_store_allocations", + "EventCode": "0x41", + "BriefDescription": "Miss Address Buffer (MAB) entries allocated by a Load-Store (LS) pipe for load-store allocations.", +- "UMask": "0x3f" ++ "UMask": "0x07" + }, + { + "EventName": "ls_mab_alloc.hardware_prefetcher_allocations", + "EventCode": "0x41", + "BriefDescription": "Miss Address Buffer (MAB) entries allocated by a Load-Store (LS) pipe for hardware prefetcher allocations.", +- "UMask": "0x40" ++ "UMask": "0x08" + }, + { + "EventName": "ls_mab_alloc.all_allocations", + "EventCode": "0x41", + "BriefDescription": "Miss Address Buffer (MAB) entries allocated by a Load-Store (LS) pipe for all types of allocations.", +- "UMask": "0x7f" ++ "UMask": "0x0f" + }, + { + "EventName": "ls_dmnd_fills_from_sys.local_l2", +-- +2.51.0 + diff --git a/queue-6.12/perf-x86-cstate-add-airmont-np.patch b/queue-6.12/perf-x86-cstate-add-airmont-np.patch new file mode 100644 index 00000000000..59f71b7e3a3 --- /dev/null +++ b/queue-6.12/perf-x86-cstate-add-airmont-np.patch @@ -0,0 +1,36 @@ +From aa5a6eff36019e820e36082dc18997111f56f446 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 08:48:46 +0100 +Subject: perf/x86/cstate: Add Airmont NP + +From: Martin Schiller + +[ Upstream commit 3006911f284d769b0f66c12b39da130325ef1440 ] + +From the perspective of Intel cstate residency counters, the Airmont NP +(aka Lightning Mountain) is identical to the Airmont. + +Signed-off-by: Martin Schiller +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Dapeng Mi +Link: https://patch.msgid.link/20251124074846.9653-4-ms@dev.tdt.de +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/cstate.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c +index aee2dfc108408..05bc2b799dd29 100644 +--- a/arch/x86/events/intel/cstate.c ++++ b/arch/x86/events/intel/cstate.c +@@ -597,6 +597,7 @@ static const struct x86_cpu_id intel_cstates_match[] __initconst = { + X86_MATCH_VFM(INTEL_ATOM_SILVERMONT, &slm_cstates), + X86_MATCH_VFM(INTEL_ATOM_SILVERMONT_D, &slm_cstates), + X86_MATCH_VFM(INTEL_ATOM_AIRMONT, &slm_cstates), ++ X86_MATCH_VFM(INTEL_ATOM_AIRMONT_NP, &slm_cstates), + + X86_MATCH_VFM(INTEL_BROADWELL, &snb_cstates), + X86_MATCH_VFM(INTEL_BROADWELL_D, &snb_cstates), +-- +2.51.0 + diff --git a/queue-6.12/perf-x86-msr-add-airmont-np.patch b/queue-6.12/perf-x86-msr-add-airmont-np.patch new file mode 100644 index 00000000000..60942655eda --- /dev/null +++ b/queue-6.12/perf-x86-msr-add-airmont-np.patch @@ -0,0 +1,36 @@ +From f90efc0b20bfd994ccfe25ca726a641f03110a84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 08:48:44 +0100 +Subject: perf/x86/msr: Add Airmont NP + +From: Martin Schiller + +[ Upstream commit 63dbadcafc1f4d1da796a8e2c0aea1e561f79ece ] + +Like Airmont, the Airmont NP (aka Intel / MaxLinear Lightning Mountain) +supports SMI_COUNT MSR. + +Signed-off-by: Martin Schiller +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Dapeng Mi +Link: https://patch.msgid.link/20251124074846.9653-2-ms@dev.tdt.de +Signed-off-by: Sasha Levin +--- + arch/x86/events/msr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/events/msr.c b/arch/x86/events/msr.c +index 45b1866ff0513..3a05ea2871dc5 100644 +--- a/arch/x86/events/msr.c ++++ b/arch/x86/events/msr.c +@@ -76,6 +76,7 @@ static bool test_intel(int idx, void *data) + case INTEL_ATOM_SILVERMONT: + case INTEL_ATOM_SILVERMONT_D: + case INTEL_ATOM_AIRMONT: ++ case INTEL_ATOM_AIRMONT_NP: + + case INTEL_ATOM_GOLDMONT: + case INTEL_ATOM_GOLDMONT_D: +-- +2.51.0 + diff --git a/queue-6.12/phy-cadence-torrent-restore-parent-clock-for-refclk-.patch b/queue-6.12/phy-cadence-torrent-restore-parent-clock-for-refclk-.patch new file mode 100644 index 00000000000..cabcd110620 --- /dev/null +++ b/queue-6.12/phy-cadence-torrent-restore-parent-clock-for-refclk-.patch @@ -0,0 +1,77 @@ +From 6dd2929a7c9510c0df4933cb51127b0133c389d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 15:24:25 +0100 +Subject: phy: cadence-torrent: restore parent clock for refclk during resume + +From: Thomas Richard (TI.com) + +[ Upstream commit 434e1a0ee145d0389b192252be4c993f86cf1134 ] + +While suspend and resume, parent clock config for refclk was getting lost. +So save and restore it in suspend and resume operations. + +Reviewed-by: Neil Armstrong +Signed-off-by: Thomas Richard (TI.com) +Link: https://patch.msgid.link/20251216-phy-cadence-torrent-resume-restore-refclk-parent-v3-1-8a7ed84b47e3@bootlin.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/cadence/phy-cadence-torrent.c | 23 +++++++++++++++++++++++ + 1 file changed, 23 insertions(+) + +diff --git a/drivers/phy/cadence/phy-cadence-torrent.c b/drivers/phy/cadence/phy-cadence-torrent.c +index 8bbbbb87bb22e..92feb45fb56e6 100644 +--- a/drivers/phy/cadence/phy-cadence-torrent.c ++++ b/drivers/phy/cadence/phy-cadence-torrent.c +@@ -392,6 +392,7 @@ struct cdns_torrent_refclk_driver { + struct clk_hw hw; + struct regmap_field *cmn_fields[REFCLK_OUT_NUM_CMN_CONFIG]; + struct clk_init_data clk_data; ++ u8 parent_index; + }; + + #define to_cdns_torrent_refclk_driver(_hw) \ +@@ -3151,11 +3152,29 @@ static const struct cdns_torrent_vals sgmii_qsgmii_xcvr_diag_ln_vals = { + .num_regs = ARRAY_SIZE(sgmii_qsgmii_xcvr_diag_ln_regs), + }; + ++static void cdns_torrent_refclk_driver_suspend(struct cdns_torrent_phy *cdns_phy) ++{ ++ struct clk_hw *hw = cdns_phy->clk_hw_data->hws[CDNS_TORRENT_REFCLK_DRIVER]; ++ struct cdns_torrent_refclk_driver *refclk_driver = to_cdns_torrent_refclk_driver(hw); ++ ++ refclk_driver->parent_index = cdns_torrent_refclk_driver_get_parent(hw); ++} ++ ++static int cdns_torrent_refclk_driver_resume(struct cdns_torrent_phy *cdns_phy) ++{ ++ struct clk_hw *hw = cdns_phy->clk_hw_data->hws[CDNS_TORRENT_REFCLK_DRIVER]; ++ struct cdns_torrent_refclk_driver *refclk_driver = to_cdns_torrent_refclk_driver(hw); ++ ++ return cdns_torrent_refclk_driver_set_parent(hw, refclk_driver->parent_index); ++} ++ + static int cdns_torrent_phy_suspend_noirq(struct device *dev) + { + struct cdns_torrent_phy *cdns_phy = dev_get_drvdata(dev); + int i; + ++ cdns_torrent_refclk_driver_suspend(cdns_phy); ++ + reset_control_assert(cdns_phy->phy_rst); + reset_control_assert(cdns_phy->apb_rst); + for (i = 0; i < cdns_phy->nsubnodes; i++) +@@ -3177,6 +3196,10 @@ static int cdns_torrent_phy_resume_noirq(struct device *dev) + int node = cdns_phy->nsubnodes; + int ret, i; + ++ ret = cdns_torrent_refclk_driver_resume(cdns_phy); ++ if (ret) ++ return ret; ++ + ret = cdns_torrent_clk(cdns_phy); + if (ret) + return ret; +-- +2.51.0 + diff --git a/queue-6.12/phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch b/queue-6.12/phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch new file mode 100644 index 00000000000..d3a1e06b747 --- /dev/null +++ b/queue-6.12/phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch @@ -0,0 +1,38 @@ +From fd9c471d17550012b4b0abcd3f2e476738cf27d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 19:17:12 +0800 +Subject: phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature + +From: Xu Yang + +[ Upstream commit 27ee0869d77b2cb404770ac49bdceae3aedf658b ] + +Disabling PHYs in runtime usually causes the client with external abort +exception or similar issue due to lack of API to notify clients about PHY +removal. This patch removes the possibility to unbind i.MX PHY drivers in +runtime. + +Signed-off-by: Xu Yang +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20260120111712.3159782-1-xu.yang_2@nxp.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c +index 043063699e064..41194083e358c 100644 +--- a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c ++++ b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c +@@ -411,6 +411,7 @@ static struct platform_driver imx8mq_usb_phy_driver = { + .driver = { + .name = "imx8mq-usb-phy", + .of_match_table = imx8mq_usb_phy_of_match, ++ .suppress_bind_attrs = true, + } + }; + module_platform_driver(imx8mq_usb_phy_driver); +-- +2.51.0 + diff --git a/queue-6.12/phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch b/queue-6.12/phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch new file mode 100644 index 00000000000..6147fd0a0e1 --- /dev/null +++ b/queue-6.12/phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch @@ -0,0 +1,43 @@ +From 3dfd041558b8cd705a66e5bca485c09f01030df3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 15:06:43 +0000 +Subject: phy: mvebu-cp110-utmi: fix dr_mode property read from dts + +From: Aleksandar Gerasimovski + +[ Upstream commit e2ce913452ab56b3330539cc443b97b7ea8c3a1a ] + +The problem with the current implementation is that it does not consider +that the USB controller can have multiple PHY handles with different +arguments count, as for example we have in our cn9131 based platform: +"phys = <&cp0_comphy1 0>, <&cp0_utmi0>;". + +In such case calling "of_usb_get_dr_mode_by_phy" with -1 (no phy-cells) +leads to not proper phy detection, taking the "marvell,cp110-utmi-phy" +dts definition we can call the "of_usb_get_dr_mode_by_phy" with 0 +(#phy-cells = <0>) and safely look for that phy. + +Signed-off-by: Aleksandar Gerasimovski +Link: https://patch.msgid.link/20260106150643.922110-1-aleksandar.gerasimovski@belden.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/marvell/phy-mvebu-cp110-utmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c +index 4922a5f3327d5..30391d0d7d4b4 100644 +--- a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c ++++ b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c +@@ -326,7 +326,7 @@ static int mvebu_cp110_utmi_phy_probe(struct platform_device *pdev) + return -ENOMEM; + } + +- port->dr_mode = of_usb_get_dr_mode_by_phy(child, -1); ++ port->dr_mode = of_usb_get_dr_mode_by_phy(child, 0); + if ((port->dr_mode != USB_DR_MODE_HOST) && + (port->dr_mode != USB_DR_MODE_PERIPHERAL)) { + dev_err(&pdev->dev, +-- +2.51.0 + diff --git a/queue-6.12/phy-ti-phy-j721e-wiz-restore-mux-selection-during-re.patch b/queue-6.12/phy-ti-phy-j721e-wiz-restore-mux-selection-during-re.patch new file mode 100644 index 00000000000..993263598ed --- /dev/null +++ b/queue-6.12/phy-ti-phy-j721e-wiz-restore-mux-selection-during-re.patch @@ -0,0 +1,71 @@ +From a38a817cd8e638f4a5be765212fee6b95ba062a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 15:26:20 +0100 +Subject: phy: ti: phy-j721e-wiz: restore mux selection during resume + +From: Thomas Richard (TI.com) + +[ Upstream commit 53f6240e88c9e8715e09fc19942f13450db4cb33 ] + +While suspend and resume mux selection was getting lost. So save and +restore these values in suspend and resume operations. + +Signed-off-by: Thomas Richard (TI.com) +Link: https://patch.msgid.link/20251216-phy-ti-phy-j721e-wiz-resume-restore-mux-sel-v1-1-771d564db966@bootlin.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/ti/phy-j721e-wiz.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/ti/phy-j721e-wiz.c b/drivers/phy/ti/phy-j721e-wiz.c +index c6e846d385d28..cbcc7bd5dde0a 100644 +--- a/drivers/phy/ti/phy-j721e-wiz.c ++++ b/drivers/phy/ti/phy-j721e-wiz.c +@@ -393,6 +393,7 @@ struct wiz { + struct clk *output_clks[WIZ_MAX_OUTPUT_CLOCKS]; + struct clk_onecell_data clk_data; + const struct wiz_data *data; ++ int mux_sel_status[WIZ_MUX_NUM_CLOCKS]; + }; + + static int wiz_reset(struct wiz *wiz) +@@ -1655,11 +1656,25 @@ static void wiz_remove(struct platform_device *pdev) + pm_runtime_disable(dev); + } + ++static int wiz_suspend_noirq(struct device *dev) ++{ ++ struct wiz *wiz = dev_get_drvdata(dev); ++ int i; ++ ++ for (i = 0; i < WIZ_MUX_NUM_CLOCKS; i++) ++ regmap_field_read(wiz->mux_sel_field[i], &wiz->mux_sel_status[i]); ++ ++ return 0; ++} ++ + static int wiz_resume_noirq(struct device *dev) + { + struct device_node *node = dev->of_node; + struct wiz *wiz = dev_get_drvdata(dev); +- int ret; ++ int ret, i; ++ ++ for (i = 0; i < WIZ_MUX_NUM_CLOCKS; i++) ++ regmap_field_write(wiz->mux_sel_field[i], wiz->mux_sel_status[i]); + + /* Enable supplemental Control override if available */ + if (wiz->sup_legacy_clk_override) +@@ -1681,7 +1696,7 @@ static int wiz_resume_noirq(struct device *dev) + return ret; + } + +-static DEFINE_NOIRQ_DEV_PM_OPS(wiz_pm_ops, NULL, wiz_resume_noirq); ++static DEFINE_NOIRQ_DEV_PM_OPS(wiz_pm_ops, wiz_suspend_noirq, wiz_resume_noirq); + + static struct platform_driver wiz_driver = { + .probe = wiz_probe, +-- +2.51.0 + diff --git a/queue-6.12/power-sequencing-fix-missing-state_lock-in-pwrseq_po.patch b/queue-6.12/power-sequencing-fix-missing-state_lock-in-pwrseq_po.patch new file mode 100644 index 00000000000..8df4f909b6c --- /dev/null +++ b/queue-6.12/power-sequencing-fix-missing-state_lock-in-pwrseq_po.patch @@ -0,0 +1,49 @@ +From dcdb021224f816c8893184fa17bcee545a3aefe6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 18:26:51 +0000 +Subject: power: sequencing: fix missing state_lock in pwrseq_power_on() error + path + +From: Ziyi Guo + +[ Upstream commit e1dccb485c2876ac1318f36ccc0155416c633a48 ] + +pwrseq_power_on() calls pwrseq_unit_disable() when the +post_enable callback fails. However, this call is outside the +scoped_guard(mutex, &pwrseq->state_lock) block that ends. + +pwrseq_unit_disable() has lockdep_assert_held(&pwrseq->state_lock), +which will fail when called from this error path. + +Add the scoped_guard block to cover the post_enable callback and its +error handling to ensure the lock is held when pwrseq_unit_disable() is +called. + +Signed-off-by: Ziyi Guo +Link: https://patch.msgid.link/20260130182651.1576579-1-n7l8m4@u.northwestern.edu +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/power/sequencing/core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/power/sequencing/core.c b/drivers/power/sequencing/core.c +index 0ffc259c6bb6c..70b92e1c3ac5e 100644 +--- a/drivers/power/sequencing/core.c ++++ b/drivers/power/sequencing/core.c +@@ -914,8 +914,10 @@ int pwrseq_power_on(struct pwrseq_desc *desc) + if (target->post_enable) { + ret = target->post_enable(pwrseq); + if (ret) { +- pwrseq_unit_disable(pwrseq, unit); +- desc->powered_on = false; ++ scoped_guard(mutex, &pwrseq->state_lock) { ++ pwrseq_unit_disable(pwrseq, unit); ++ desc->powered_on = false; ++ } + } + } + +-- +2.51.0 + diff --git a/queue-6.12/powercap-intel_rapl-add-pl4-support-for-ice-lake.patch b/queue-6.12/powercap-intel_rapl-add-pl4-support-for-ice-lake.patch new file mode 100644 index 00000000000..59d099287d1 --- /dev/null +++ b/queue-6.12/powercap-intel_rapl-add-pl4-support-for-ice-lake.patch @@ -0,0 +1,36 @@ +From 18e39684fec02b54e99b629316e0d5f46df7b003 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 21:01:52 -0500 +Subject: powercap: intel_rapl: Add PL4 support for Ice Lake + +From: Daniel Tang + +[ Upstream commit 54b3cd55a515c7c0fcfa0c1f0b10d62c11d64bcc ] + +Microsoft Surface Pro 7 firmware throttles the processor upon +boot/resume. Userspace needs to be able to restore the correct value. + +Link: https://github.com/linux-surface/linux-surface/issues/706 +Signed-off-by: Daniel Tang +Link: https://patch.msgid.link/6088605.ChMirdbgyp@daniel-desktop3 +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/powercap/intel_rapl_msr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/powercap/intel_rapl_msr.c b/drivers/powercap/intel_rapl_msr.c +index cbe07450de933..458a90a6d57c0 100644 +--- a/drivers/powercap/intel_rapl_msr.c ++++ b/drivers/powercap/intel_rapl_msr.c +@@ -139,6 +139,7 @@ static int rapl_msr_write_raw(int cpu, struct reg_action *ra) + + /* List of verified CPUs. */ + static const struct x86_cpu_id pl4_support_ids[] = { ++ X86_MATCH_VFM(INTEL_ICELAKE_L, NULL), + X86_MATCH_VFM(INTEL_TIGERLAKE_L, NULL), + X86_MATCH_VFM(INTEL_ALDERLAKE, NULL), + X86_MATCH_VFM(INTEL_ALDERLAKE_L, NULL), +-- +2.51.0 + diff --git a/queue-6.12/pstore-ram_core-fix-incorrect-success-return-when-vm.patch b/queue-6.12/pstore-ram_core-fix-incorrect-success-return-when-vm.patch new file mode 100644 index 00000000000..c53f1dd2ef4 --- /dev/null +++ b/queue-6.12/pstore-ram_core-fix-incorrect-success-return-when-vm.patch @@ -0,0 +1,49 @@ +From cbb513091872104ddec198994303c6d65bf55a16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 10:03:58 +0800 +Subject: pstore: ram_core: fix incorrect success return when vmap() fails + +From: Ruipeng Qi + +[ Upstream commit 05363abc7625cf18c96e67f50673cd07f11da5e9 ] + +In persistent_ram_vmap(), vmap() may return NULL on failure. + +If offset is non-zero, adding offset_in_page(start) causes the function +to return a non-NULL pointer even though the mapping failed. +persistent_ram_buffer_map() therefore incorrectly returns success. + +Subsequent access to prz->buffer may dereference an invalid address +and cause crashes. + +Add proper NULL checking for vmap() failures. + +Signed-off-by: Ruipeng Qi +Link: https://patch.msgid.link/20260203020358.3315299-1-ruipengqi3@gmail.com +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + fs/pstore/ram_core.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c +index c9eaacdec37e4..7b6d6378a3b87 100644 +--- a/fs/pstore/ram_core.c ++++ b/fs/pstore/ram_core.c +@@ -457,6 +457,13 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size, + vaddr = vmap(pages, page_count, VM_MAP | VM_IOREMAP, prot); + kfree(pages); + ++ /* ++ * vmap() may fail and return NULL. Do not add the offset in this ++ * case, otherwise a NULL mapping would appear successful. ++ */ ++ if (!vaddr) ++ return NULL; ++ + /* + * Since vmap() uses page granularity, we must add the offset + * into the page here, to get the byte granularity address +-- +2.51.0 + diff --git a/queue-6.12/rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch b/queue-6.12/rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch new file mode 100644 index 00000000000..01d751a84ec --- /dev/null +++ b/queue-6.12/rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch @@ -0,0 +1,47 @@ +From 3b327178778c220719d828cd2c260e01b898a793 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 17:15:16 +0100 +Subject: RDMA/rtrs-clt: For conn rejection use actual err number + +From: Md Haris Iqbal + +[ Upstream commit fc290630702b530c2969061e7ef0d869a5b6dc4f ] + +When the connection establishment request is rejected from the server +side, then the actual error number sent back should be used. + +Signed-off-by: Md Haris Iqbal +Link: https://patch.msgid.link/20260107161517.56357-10-haris.iqbal@ionos.com +Reviewed-by: Grzegorz Prajsner +Reviewed-by: Jack Wang +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +index 2b397a544cb93..8fa1d72bd20a4 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +@@ -1923,7 +1923,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con, + struct rtrs_path *s = con->c.path; + const struct rtrs_msg_conn_rsp *msg; + const char *rej_msg; +- int status, errno; ++ int status, errno = -ECONNRESET; + u8 data_len; + + status = ev->status; +@@ -1945,7 +1945,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con, + status, rej_msg); + } + +- return -ECONNRESET; ++ return errno; + } + + void rtrs_clt_close_conns(struct rtrs_clt_path *clt_path, bool wait) +-- +2.51.0 + diff --git a/queue-6.12/remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch b/queue-6.12/remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch new file mode 100644 index 00000000000..d3228494718 --- /dev/null +++ b/queue-6.12/remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch @@ -0,0 +1,51 @@ +From 4c2cb4c9faa7bda2809ec581ac282c2994e811ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Dec 2025 14:28:23 +0200 +Subject: remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox + TX channel is uninitialized + +From: Iuliana Prodan + +[ Upstream commit d62e0e92e589c53c4320ed5914af5fe103f5ce7e ] + +Firmwares that do not use mailbox communication (e.g., the hello_world +sample) leave priv->tx_ch as NULL. The current suspend logic +unconditionally sends RP_MBOX_SUSPEND_SYSTEM, which is invalid without +an initialized TX channel. + +Detect the no_mailboxes case early and skip sending the suspend +message. Instead, proceed directly to the runtime PM suspend path, +which is the correct behavior for firmwares that cannot respond to +mailbox requests. + +Signed-off-by: Iuliana Prodan +Link: https://lore.kernel.org/r/20251204122825.756106-1-iuliana.prodan@oss.nxp.com +Signed-off-by: Mathieu Poirier +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/imx_dsp_rproc.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/remoteproc/imx_dsp_rproc.c b/drivers/remoteproc/imx_dsp_rproc.c +index 376187ad5754c..713a57200cf09 100644 +--- a/drivers/remoteproc/imx_dsp_rproc.c ++++ b/drivers/remoteproc/imx_dsp_rproc.c +@@ -1184,6 +1184,15 @@ static int imx_dsp_suspend(struct device *dev) + if (rproc->state != RPROC_RUNNING) + goto out; + ++ /* ++ * No channel available for sending messages; ++ * indicates no mailboxes present, so trigger PM runtime suspend ++ */ ++ if (!priv->tx_ch) { ++ dev_dbg(dev, "No initialized mbox tx channel, suspend directly.\n"); ++ goto out; ++ } ++ + reinit_completion(&priv->pm_comp); + + /* Tell DSP that suspend is happening */ +-- +2.51.0 + diff --git a/queue-6.12/remoteproc-mediatek-break-lock-dependency-to-prepare.patch b/queue-6.12/remoteproc-mediatek-break-lock-dependency-to-prepare.patch new file mode 100644 index 00000000000..bb25bdd441f --- /dev/null +++ b/queue-6.12/remoteproc-mediatek-break-lock-dependency-to-prepare.patch @@ -0,0 +1,261 @@ +From afec3484c47211286b946e1285a350a38df2fbd1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 11:07:55 +0000 +Subject: remoteproc: mediatek: Break lock dependency to `prepare_lock` + +From: Tzung-Bi Shih + +[ Upstream commit d935187cfb27fc4168f78f3959aef4eafaae76bb ] + +A potential circular locking dependency (ABBA deadlock) exists between +`ec_dev->lock` and the clock framework's `prepare_lock`. + +The first order (A -> B) occurs when scp_ipi_send() is called while +`ec_dev->lock` is held (e.g., within cros_ec_cmd_xfer()): +1. cros_ec_cmd_xfer() acquires `ec_dev->lock` and calls scp_ipi_send(). +2. scp_ipi_send() calls clk_prepare_enable(), which acquires + `prepare_lock`. +See #0 in the following example calling trace. +(Lock Order: `ec_dev->lock` -> `prepare_lock`) + +The reverse order (B -> A) is more complex and has been observed +(learned) by lockdep. It involves the clock prepare operation +triggering power domain changes, which then propagates through sysfs +and power supply uevents, eventually calling back into the ChromeOS EC +driver and attempting to acquire `ec_dev->lock`: +1. Something calls clk_prepare(), which acquires `prepare_lock`. It + then triggers genpd operations like genpd_runtime_resume(), which + takes `&genpd->mlock`. +2. Power domain changes can trigger regulator changes; regulator + changes can then trigger device link changes; device link changes + can then trigger sysfs changes. Eventually, power_supply_uevent() + is called. +3. This leads to calls like cros_usbpd_charger_get_prop(), which calls + cros_ec_cmd_xfer_status(), which then attempts to acquire + `ec_dev->lock`. +See #1 ~ #6 in the following example calling trace. +(Lock Order: `prepare_lock` -> `&genpd->mlock` -> ... -> `&ec_dev->lock`) + +Move the clk_prepare()/clk_unprepare() operations for `scp->clk` to the +remoteproc prepare()/unprepare() callbacks. This ensures `prepare_lock` +is only acquired in prepare()/unprepare() callbacks. Since +`ec_dev->lock` is not involved in the callbacks, the dependency loop is +broken. + +This means the clock is always "prepared" when the SCP is running. The +prolonged "prepared time" for the clock should be acceptable as SCP is +designed to be a very power efficient processor. The power consumption +impact can be negligible. + +A simplified calling trace reported by lockdep: +> -> #6 (&ec_dev->lock) +> cros_ec_cmd_xfer +> cros_ec_cmd_xfer_status +> cros_usbpd_charger_get_port_status +> cros_usbpd_charger_get_prop +> power_supply_get_property +> power_supply_show_property +> power_supply_uevent +> dev_uevent +> uevent_show +> dev_attr_show +> sysfs_kf_seq_show +> kernfs_seq_show +> -> #5 (kn->active#2) +> kernfs_drain +> __kernfs_remove +> kernfs_remove_by_name_ns +> sysfs_remove_file_ns +> device_del +> __device_link_del +> device_links_driver_bound +> -> #4 (device_links_lock) +> device_link_remove +> _regulator_put +> regulator_put +> -> #3 (regulator_list_mutex) +> regulator_lock_dependent +> regulator_disable +> scpsys_power_off +> _genpd_power_off +> genpd_power_off +> -> #2 (&genpd->mlock/1) +> genpd_add_subdomain +> pm_genpd_add_subdomain +> scpsys_add_subdomain +> scpsys_probe +> -> #1 (&genpd->mlock) +> genpd_runtime_resume +> __rpm_callback +> rpm_callback +> rpm_resume +> __pm_runtime_resume +> clk_core_prepare +> clk_prepare +> -> #0 (prepare_lock) +> clk_prepare +> scp_ipi_send +> scp_send_ipi +> mtk_rpmsg_send +> rpmsg_send +> cros_ec_pkt_xfer_rpmsg + +Signed-off-by: Tzung-Bi Shih +Reviewed-by: Chen-Yu Tsai +Tested-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20260112110755.2435899-1-tzungbi@kernel.org +Signed-off-by: Mathieu Poirier +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/mtk_scp.c | 39 +++++++++++++++++++++++--------- + drivers/remoteproc/mtk_scp_ipi.c | 4 ++-- + 2 files changed, 30 insertions(+), 13 deletions(-) + +diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c +index f98a11d4cf292..ae20d2221c8e0 100644 +--- a/drivers/remoteproc/mtk_scp.c ++++ b/drivers/remoteproc/mtk_scp.c +@@ -282,7 +282,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv) + struct mtk_scp *scp = priv; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(scp->dev, "failed to enable clocks\n"); + return IRQ_NONE; +@@ -290,7 +290,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv) + + scp->data->scp_irq_handler(scp); + +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + + return IRQ_HANDLED; + } +@@ -664,7 +664,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw) + struct device *dev = scp->dev; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(dev, "failed to enable clocks\n"); + return ret; +@@ -679,7 +679,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw) + + ret = scp_elf_load_segments(rproc, fw); + leave: +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + + return ret; + } +@@ -690,14 +690,14 @@ static int scp_parse_fw(struct rproc *rproc, const struct firmware *fw) + struct device *dev = scp->dev; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(dev, "failed to enable clocks\n"); + return ret; + } + + ret = scp_ipi_init(scp, fw); +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + return ret; + } + +@@ -708,7 +708,7 @@ static int scp_start(struct rproc *rproc) + struct scp_run *run = &scp->run; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(dev, "failed to enable clocks\n"); + return ret; +@@ -733,14 +733,14 @@ static int scp_start(struct rproc *rproc) + goto stop; + } + +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + dev_info(dev, "SCP is ready. FW version %s\n", run->fw_ver); + + return 0; + + stop: + scp->data->scp_reset_assert(scp); +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + return ret; + } + +@@ -908,7 +908,7 @@ static int scp_stop(struct rproc *rproc) + struct mtk_scp *scp = rproc->priv; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(scp->dev, "failed to enable clocks\n"); + return ret; +@@ -916,12 +916,29 @@ static int scp_stop(struct rproc *rproc) + + scp->data->scp_reset_assert(scp); + scp->data->scp_stop(scp); +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + + return 0; + } + ++static int scp_prepare(struct rproc *rproc) ++{ ++ struct mtk_scp *scp = rproc->priv; ++ ++ return clk_prepare(scp->clk); ++} ++ ++static int scp_unprepare(struct rproc *rproc) ++{ ++ struct mtk_scp *scp = rproc->priv; ++ ++ clk_unprepare(scp->clk); ++ return 0; ++} ++ + static const struct rproc_ops scp_ops = { ++ .prepare = scp_prepare, ++ .unprepare = scp_unprepare, + .start = scp_start, + .stop = scp_stop, + .load = scp_load, +diff --git a/drivers/remoteproc/mtk_scp_ipi.c b/drivers/remoteproc/mtk_scp_ipi.c +index c068227e251e7..7a37e273b3af8 100644 +--- a/drivers/remoteproc/mtk_scp_ipi.c ++++ b/drivers/remoteproc/mtk_scp_ipi.c +@@ -171,7 +171,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len, + WARN_ON(len > scp_sizes->ipi_share_buffer_size) || WARN_ON(!buf)) + return -EINVAL; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(scp->dev, "failed to enable clock\n"); + return ret; +@@ -211,7 +211,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len, + + unlock_mutex: + mutex_unlock(&scp->send_lock); +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + + return ret; + } +-- +2.51.0 + diff --git a/queue-6.12/revert-arm64-zynqmp-add-an-op-tee-node-to-the-device.patch b/queue-6.12/revert-arm64-zynqmp-add-an-op-tee-node-to-the-device.patch new file mode 100644 index 00000000000..7a2044dc71f --- /dev/null +++ b/queue-6.12/revert-arm64-zynqmp-add-an-op-tee-node-to-the-device.patch @@ -0,0 +1,45 @@ +From 57d9fa398b07af9c87669564291973f6e56087a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 09:53:54 +0200 +Subject: Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" + +From: Tomas Melin + +[ Upstream commit c197179990124f991fca220d97fac56779a02c6d ] + +This reverts commit 06d22ed6b6635b17551f386b50bb5aaff9b75fbe. + +OP-TEE logic in U-Boot automatically injects a reserved-memory +node along with optee firmware node to kernel device tree. +The injection logic is dependent on that there is no manually +defined optee node. Having the node in zynqmp.dtsi effectively +breaks OP-TEE's insertion of the reserved-memory node, causing +memory access violations during runtime. + +Signed-off-by: Tomas Melin +Signed-off-by: Michal Simek +Link: https://lore.kernel.org/r/20251125-revert-zynqmp-optee-v1-1-d2ce4c0fcaf6@vaisala.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi +index e2ad5fb2cb0a4..0ff45540ca874 100644 +--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi ++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi +@@ -187,11 +187,6 @@ psci { + }; + + firmware { +- optee: optee { +- compatible = "linaro,optee-tz"; +- method = "smc"; +- }; +- + zynqmp_firmware: zynqmp-firmware { + compatible = "xlnx,zynqmp-firmware"; + #power-domain-cells = <1>; +-- +2.51.0 + diff --git a/queue-6.12/revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch b/queue-6.12/revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch new file mode 100644 index 00000000000..a3699a3af07 --- /dev/null +++ b/queue-6.12/revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch @@ -0,0 +1,42 @@ +From 29ff7d40ad0bdc26300855ccfd0a8f8045249a31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 17:16:51 +0100 +Subject: Revert "mfd: da9052-spi: Change read-mask to write-mask" + +From: Marcus Folkesson + +[ Upstream commit 12daa9c1954542bf98bb942fb2dadf19de79a44b ] + +This reverts commit 2e3378f6c79a1b3f7855ded1ef306ea4406352ed. + +Almost every register in this chip can be customized via OTP +memory. Somehow the value for R19, which decide if the flag is set +on read or write operation, seems to have been overwritten for the chip +the original patch were written for. + +Revert the change to follow the default behavior. + +Signed-off-by: Marcus Folkesson +Link: https://patch.msgid.link/20251124-da9052-revert-v1-1-fbeb2c894002@gmail.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/da9052-spi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mfd/da9052-spi.c b/drivers/mfd/da9052-spi.c +index 80fc5c0cac2fb..be5f2b34e18ae 100644 +--- a/drivers/mfd/da9052-spi.c ++++ b/drivers/mfd/da9052-spi.c +@@ -37,7 +37,7 @@ static int da9052_spi_probe(struct spi_device *spi) + spi_set_drvdata(spi, da9052); + + config = da9052_regmap_config; +- config.write_flag_mask = 1; ++ config.read_flag_mask = 1; + config.reg_bits = 7; + config.pad_bits = 1; + config.val_bits = 8; +-- +2.51.0 + diff --git a/queue-6.12/riscv-vector-init-vector-context-with-proper-vlenb.patch b/queue-6.12/riscv-vector-init-vector-context-with-proper-vlenb.patch new file mode 100644 index 00000000000..e4af323b110 --- /dev/null +++ b/queue-6.12/riscv-vector-init-vector-context-with-proper-vlenb.patch @@ -0,0 +1,83 @@ +From ec5f9ff04dd06a89c83d7c4dfba5af4781ca358f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 21:09:56 -0700 +Subject: riscv: vector: init vector context with proper vlenb + +From: Sergey Matyukevich + +[ Upstream commit ef3ff40346db8476a9ef7269fc9d1837e7243c40 ] + +The vstate in thread_struct is zeroed when the vector context is +initialized. That includes read-only register vlenb, which holds +the vector register length in bytes. Zeroed state persists until +mstatus.VS becomes 'dirty' and a context switch saves the actual +hardware values. + +This can expose the zero vlenb value to the user-space in early +debug scenarios, e.g. when ptrace attaches to a traced process +early, before any vector instruction except the first one was +executed. + +Fix this by specifying proper vlenb on vector context init. + +Signed-off-by: Sergey Matyukevich +Reviewed-by: Andy Chiu +Tested-by: Andy Chiu +Link: https://patch.msgid.link/20251214163537.1054292-3-geomatsi@gmail.com +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/vector.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/arch/riscv/kernel/vector.c b/arch/riscv/kernel/vector.c +index a30fb2fb8a2b1..2afd5f926155b 100644 +--- a/arch/riscv/kernel/vector.c ++++ b/arch/riscv/kernel/vector.c +@@ -99,8 +99,8 @@ static bool insn_is_vector(u32 insn_buf) + return false; + } + +-static int riscv_v_thread_zalloc(struct kmem_cache *cache, +- struct __riscv_v_ext_state *ctx) ++static int riscv_v_thread_ctx_alloc(struct kmem_cache *cache, ++ struct __riscv_v_ext_state *ctx) + { + void *datap; + +@@ -110,13 +110,15 @@ static int riscv_v_thread_zalloc(struct kmem_cache *cache, + + ctx->datap = datap; + memset(ctx, 0, offsetof(struct __riscv_v_ext_state, datap)); ++ ctx->vlenb = riscv_v_vsize / 32; ++ + return 0; + } + + void riscv_v_thread_alloc(struct task_struct *tsk) + { + #ifdef CONFIG_RISCV_ISA_V_PREEMPTIVE +- riscv_v_thread_zalloc(riscv_v_kernel_cachep, &tsk->thread.kernel_vstate); ++ riscv_v_thread_ctx_alloc(riscv_v_kernel_cachep, &tsk->thread.kernel_vstate); + #endif + } + +@@ -202,12 +204,14 @@ bool riscv_v_first_use_handler(struct pt_regs *regs) + * context where VS has been off. So, try to allocate the user's V + * context and resume execution. + */ +- if (riscv_v_thread_zalloc(riscv_v_user_cachep, ¤t->thread.vstate)) { ++ if (riscv_v_thread_ctx_alloc(riscv_v_user_cachep, ¤t->thread.vstate)) { + force_sig(SIGBUS); + return true; + } ++ + riscv_v_vstate_on(regs); + riscv_v_vstate_set_restore(current, regs); ++ + return true; + } + +-- +2.51.0 + diff --git a/queue-6.12/rnbd-srv-zero-the-rsp-buffer-before-using-it.patch b/queue-6.12/rnbd-srv-zero-the-rsp-buffer-before-using-it.patch new file mode 100644 index 00000000000..4fcdb981108 --- /dev/null +++ b/queue-6.12/rnbd-srv-zero-the-rsp-buffer-before-using-it.patch @@ -0,0 +1,47 @@ +From bd996c395cf9542dbe5a9ee488d11bbd49a61eea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 13:47:33 +0100 +Subject: rnbd-srv: Zero the rsp buffer before using it + +From: Md Haris Iqbal + +[ Upstream commit 69d26698e4fd44935510553809007151b2fe4db5 ] + +Before using the data buffer to send back the response message, zero it +completely. This prevents any stray bytes to be picked up by the client +side when there the message is exchanged between different protocol +versions. + +Signed-off-by: Md Haris Iqbal +Signed-off-by: Jack Wang +Signed-off-by: Grzegorz Prajsner +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/rnbd/rnbd-srv.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c +index ba44018b00af5..0c7d40ed8d199 100644 +--- a/drivers/block/rnbd/rnbd-srv.c ++++ b/drivers/block/rnbd/rnbd-srv.c +@@ -551,6 +551,8 @@ static void rnbd_srv_fill_msg_open_rsp(struct rnbd_msg_open_rsp *rsp, + { + struct block_device *bdev = file_bdev(sess_dev->bdev_file); + ++ memset(rsp, 0, sizeof(*rsp)); ++ + rsp->hdr.type = cpu_to_le16(RNBD_MSG_OPEN_RSP); + rsp->device_id = cpu_to_le32(sess_dev->device_id); + rsp->nsectors = cpu_to_le64(bdev_nr_sectors(bdev)); +@@ -657,6 +659,7 @@ static void process_msg_sess_info(struct rnbd_srv_session *srv_sess, + + trace_process_msg_sess_info(srv_sess, sess_info_msg); + ++ memset(rsp, 0, sizeof(*rsp)); + rsp->hdr.type = cpu_to_le16(RNBD_MSG_SESS_INFO_RSP); + rsp->ver = srv_sess->ver; + } +-- +2.51.0 + diff --git a/queue-6.12/rtc-interface-alarm-race-handling-should-not-discard.patch b/queue-6.12/rtc-interface-alarm-race-handling-should-not-discard.patch new file mode 100644 index 00000000000..98e6f1904be --- /dev/null +++ b/queue-6.12/rtc-interface-alarm-race-handling-should-not-discard.patch @@ -0,0 +1,53 @@ +From 40cb146d4d366b3b3a95ecefcf41eedd957de080 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 17:35:19 +0000 +Subject: rtc: interface: Alarm race handling should not discard preceding + error + +From: Anthony Pighin (Nokia) + +[ Upstream commit 81be22cd4ace020045cc6d31255c6f7c071eb7c0 ] + +Commit 795cda8338ea ("rtc: interface: Fix long-standing race when setting +alarm") should not discard any errors from the preceding validations. + +Prior to that commit, if the alarm feature was disabled, or the +set_alarm failed, a meaningful error code would be returned to the +caller for further action. + +After, more often than not, the __rtc_read_time will cause a success +return code instead, misleading the caller. + +An example of this is when timer_enqueue is called for a rtc-abx080x +device. Since that driver does not clear the alarm feature bit, but +instead relies on the set_alarm operation to return invalid, the discard +of the return code causes very different behaviour; i.e. + hwclock: select() to /dev/rtc0 to wait for clock tick timed out + +Fixes: 795cda8338ea ("rtc: interface: Fix long-standing race when setting alarm") +Signed-off-by: Anthony Pighin (Nokia) +Reviewed-by: Esben Haabendal +Tested-by: Nick Bowler +Link: https://patch.msgid.link/BN0PR08MB6951415A751F236375A2945683D1A@BN0PR08MB6951.namprd08.prod.outlook.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/interface.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c +index 39db12f267cc6..ee185710262ac 100644 +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -457,7 +457,7 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm) + * are in, we can return -ETIME to signal that the timer has already + * expired, which is true in both cases. + */ +- if ((scheduled - now) <= 1) { ++ if (!err && (scheduled - now) <= 1) { + err = __rtc_read_time(rtc, &tm); + if (err) + return err; +-- +2.51.0 + diff --git a/queue-6.12/rtc-zynqmp-correct-frequency-value.patch b/queue-6.12/rtc-zynqmp-correct-frequency-value.patch new file mode 100644 index 00000000000..60760e13eed --- /dev/null +++ b/queue-6.12/rtc-zynqmp-correct-frequency-value.patch @@ -0,0 +1,42 @@ +From b71f955d00011629c9424020791dc406de248218 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 13:53:45 +0000 +Subject: rtc: zynqmp: correct frequency value + +From: Tomas Melin + +[ Upstream commit 2724fb4d429cbb724dcb6fa17953040918ebe3a2 ] + +Fix calibration value in case a clock reference is provided. +The actual calibration value written into register is +frequency - 1. + +Reviewed-by: Harini T +Tested-by: Harini T +Signed-off-by: Tomas Melin +Acked-by: Michal Simek +Link: https://patch.msgid.link/20260122-zynqmp-rtc-updates-v4-1-d4edb966b499@vaisala.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-zynqmp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/rtc/rtc-zynqmp.c b/drivers/rtc/rtc-zynqmp.c +index b6f96c10196ae..f49af7d963fbd 100644 +--- a/drivers/rtc/rtc-zynqmp.c ++++ b/drivers/rtc/rtc-zynqmp.c +@@ -330,7 +330,10 @@ static int xlnx_rtc_probe(struct platform_device *pdev) + &xrtcdev->freq); + if (ret) + xrtcdev->freq = RTC_CALIB_DEF; ++ } else { ++ xrtcdev->freq--; + } ++ + ret = readl(xrtcdev->reg_base + RTC_CALIB_RD); + if (!ret) + writel(xrtcdev->freq, (xrtcdev->reg_base + RTC_CALIB_WR)); +-- +2.51.0 + diff --git a/queue-6.12/s390-perf-disable-register-readout-on-sampling-event.patch b/queue-6.12/s390-perf-disable-register-readout-on-sampling-event.patch new file mode 100644 index 00000000000..daf5456b1ac --- /dev/null +++ b/queue-6.12/s390-perf-disable-register-readout-on-sampling-event.patch @@ -0,0 +1,53 @@ +From cdcc0887163246f605e37977bb3d1035c2f37edf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 10:14:12 +0100 +Subject: s390/perf: Disable register readout on sampling events + +From: Thomas Richter + +[ Upstream commit b2c04fc1239062b39ddfdd8731ee1a10810dfb74 ] + +Running commands + # ./perf record -IR0,R1 -a sleep 1 +extracts and displays register value of general purpose register r1 and r0. +However the value displayed of any register is random and does not +reflect the register value recorded at the time of the sample interrupt. + +The sampling device driver on s390 creates a very large buffer +for the hardware to store the samples. Only when that large buffer +gets full an interrupt is generated and many hundreds of sample +entries are processed and copied to the kernel ring buffer and +eventually get copied to the perf tool. It is during the copy +to the kernel ring buffer that each sample is processed (on s390) +and at that time the register values are extracted. +This is not the original goal, the register values should be read +when the samples are created not when the samples are copied to the +kernel ring buffer. + +Prevent this event from being installed in the first place and +return -EOPNOTSUPP. This is already the case for PERF_SAMPLE_REGS_USER. + +Signed-off-by: Thomas Richter +Reviewed-by: Jan Polensky +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/perf_cpum_sf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c +index efdd6ead7ba81..23a2a49547b7a 100644 +--- a/arch/s390/kernel/perf_cpum_sf.c ++++ b/arch/s390/kernel/perf_cpum_sf.c +@@ -856,7 +856,7 @@ static bool is_callchain_event(struct perf_event *event) + u64 sample_type = event->attr.sample_type; + + return sample_type & (PERF_SAMPLE_CALLCHAIN | PERF_SAMPLE_REGS_USER | +- PERF_SAMPLE_STACK_USER); ++ PERF_SAMPLE_REGS_INTR | PERF_SAMPLE_STACK_USER); + } + + static int cpumsf_pmu_event_init(struct perf_event *event) +-- +2.51.0 + diff --git a/queue-6.12/s390-purgatory-add-wno-default-const-init-unsafe-to-.patch b/queue-6.12/s390-purgatory-add-wno-default-const-init-unsafe-to-.patch new file mode 100644 index 00000000000..d364f71eea0 --- /dev/null +++ b/queue-6.12/s390-purgatory-add-wno-default-const-init-unsafe-to-.patch @@ -0,0 +1,45 @@ +From 0fd32afd75e32844dfac482bcfb3c1f4a788877e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Dec 2025 16:47:07 +0100 +Subject: s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS + +From: Heiko Carstens + +[ Upstream commit b4780fe4ddf04b51127a33d705f4a2e224df00fa ] + +Add -Wno-default-const-init-unsafe to purgatory KBUILD_CFLAGS, similar +to scripts/Makefile.extrawarn, since clang generates warnings for the +dummy variable in typecheck(): + + CC arch/s390/purgatory/purgatory.o + arch/s390/include/asm/ptrace.h:221:9: warning: default initialization of an object of type 'typeof (regs->psw)' (aka 'const psw_t') leaves the object uninitialized [-Wdefault-const-init-var-unsafe] + 221 | return psw_bits(regs->psw).pstate; + | ^ + arch/s390/include/asm/ptrace.h:98:2: note: expanded from macro 'psw_bits' + 98 | typecheck(psw_t, __psw); \ + | ^ + include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck' + 11 | typeof(x) __dummy2; \ + | ^ + +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/purgatory/Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/s390/purgatory/Makefile b/arch/s390/purgatory/Makefile +index bdcf2a3b6c41b..df6636c8b492e 100644 +--- a/arch/s390/purgatory/Makefile ++++ b/arch/s390/purgatory/Makefile +@@ -21,6 +21,7 @@ KBUILD_CFLAGS += -fno-stack-protector + KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING + KBUILD_CFLAGS += $(CLANG_FLAGS) + KBUILD_CFLAGS += $(call cc-option,-fno-PIE) ++KBUILD_CFLAGS += $(call cc-option, -Wno-default-const-init-unsafe) + KBUILD_AFLAGS := $(filter-out -DCC_USING_EXPOLINE,$(KBUILD_AFLAGS)) + + # Since we link purgatory with -r unresolved symbols are not checked, so we +-- +2.51.0 + diff --git a/queue-6.12/sched-debug-fix-updating-of-ppos-on-server-write-ops.patch b/queue-6.12/sched-debug-fix-updating-of-ppos-on-server-write-ops.patch new file mode 100644 index 00000000000..d091e6e1d9d --- /dev/null +++ b/queue-6.12/sched-debug-fix-updating-of-ppos-on-server-write-ops.patch @@ -0,0 +1,65 @@ +From 4ac703128bdcf7772782eb6aebad53fee80cfed5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jan 2026 10:59:00 +0100 +Subject: sched/debug: Fix updating of ppos on server write ops + +From: Joel Fernandes + +[ Upstream commit 6080fb211672aec6ce8f2f5a2e0b4eae736f2027 ] + +Updating "ppos" on error conditions does not make much sense. The pattern +is to return the error code directly without modifying the position, or +modify the position on success and return the number of bytes written. + +Since on success, the return value of apply is 0, there is no point in +modifying ppos either. Fix it by removing all this and just returning +error code or number of bytes written on success. + +Signed-off-by: Joel Fernandes +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Juri Lelli +Reviewed-by: Andrea Righi +Acked-by: Tejun Heo +Tested-by: Christian Loehle +Link: https://patch.msgid.link/20260126100050.3854740-3-arighi@nvidia.com +Signed-off-by: Sasha Levin +--- + kernel/sched/debug.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c +index 72958b31549fb..7d14e9fa53ac3 100644 +--- a/kernel/sched/debug.c ++++ b/kernel/sched/debug.c +@@ -347,8 +347,8 @@ static ssize_t sched_fair_server_write(struct file *filp, const char __user *ubu + long cpu = (long) ((struct seq_file *) filp->private_data)->private; + struct rq *rq = cpu_rq(cpu); + u64 runtime, period; ++ int retval = 0; + size_t err; +- int retval; + u64 value; + + err = kstrtoull_from_user(ubuf, cnt, 10, &value); +@@ -384,8 +384,6 @@ static ssize_t sched_fair_server_write(struct file *filp, const char __user *ubu + } + + retval = dl_server_apply_params(&rq->fair_server, runtime, period, 0); +- if (retval) +- cnt = retval; + + if (!runtime) + printk_deferred("Fair server disabled in CPU %d, system may crash due to starvation.\n", +@@ -393,6 +391,9 @@ static ssize_t sched_fair_server_write(struct file *filp, const char __user *ubu + + if (rq->cfs.h_nr_queued) + dl_server_start(&rq->fair_server); ++ ++ if (retval < 0) ++ return retval; + } + + *ppos += cnt; +-- +2.51.0 + diff --git a/queue-6.12/scsi-buslogic-reduce-stack-usage.patch b/queue-6.12/scsi-buslogic-reduce-stack-usage.patch new file mode 100644 index 00000000000..1d95a5f53b9 --- /dev/null +++ b/queue-6.12/scsi-buslogic-reduce-stack-usage.patch @@ -0,0 +1,66 @@ +From 199c02500d8c071274ccf6283b1ccb01d46f4569 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 17:33:15 +0100 +Subject: scsi: buslogic: Reduce stack usage + +From: Arnd Bergmann + +[ Upstream commit e17f0d4cc006265dd92129db4bf9da3a2e4a4f66 ] + +Some randconfig builds run into excessive stack usage with gcc-14 or +higher, which use __attribute__((cold)) where earlier versions did not do +that: + +drivers/scsi/BusLogic.c: In function 'blogic_init': +drivers/scsi/BusLogic.c:2398:1: error: the frame size of 1680 bytes is larger than 1536 bytes [-Werror=frame-larger-than=] + +The problem is that a lot of code gets inlined into blogic_init() here. Two +functions stick out, but they are a bit different: + + - blogic_init_probeinfo_list() actually uses a few hundred bytes of kernel + stack, which is a problem in combination with other functions that also + do. Marking this one as noinline means that the stack slots get get + reused between function calls + + - blogic_reportconfig() has a few large variables, but whenever it is not + inlined into its caller, the compiler is actually smart enough to reuse + stack slots for these automatically, so marking it as noinline saves + most of the stack space by itself. + +The combination of both of these should avoid the problem entirely. + +Signed-off-by: Arnd Bergmann +Link: https://patch.msgid.link/20260203163321.2598593-1-arnd@kernel.org +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/BusLogic.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c +index 2135a2b3e2d00..c17b09d966f14 100644 +--- a/drivers/scsi/BusLogic.c ++++ b/drivers/scsi/BusLogic.c +@@ -920,7 +920,8 @@ static int __init blogic_init_fp_probeinfo(struct blogic_adapter *adapter) + a particular probe order. + */ + +-static void __init blogic_init_probeinfo_list(struct blogic_adapter *adapter) ++static noinline_for_stack void __init ++blogic_init_probeinfo_list(struct blogic_adapter *adapter) + { + /* + If a PCI BIOS is present, interrogate it for MultiMaster and +@@ -1690,7 +1691,8 @@ static bool __init blogic_rdconfig(struct blogic_adapter *adapter) + blogic_reportconfig reports the configuration of Host Adapter. + */ + +-static bool __init blogic_reportconfig(struct blogic_adapter *adapter) ++static noinline_for_stack bool __init ++blogic_reportconfig(struct blogic_adapter *adapter) + { + unsigned short alltgt_mask = (1 << adapter->maxdev) - 1; + unsigned short sync_ok, fast_ok; +-- +2.51.0 + diff --git a/queue-6.12/scsi-ufs-mediatek-fix-page-faults-in-ufs_mtk_clk_sca.patch b/queue-6.12/scsi-ufs-mediatek-fix-page-faults-in-ufs_mtk_clk_sca.patch new file mode 100644 index 00000000000..56f21953a5b --- /dev/null +++ b/queue-6.12/scsi-ufs-mediatek-fix-page-faults-in-ufs_mtk_clk_sca.patch @@ -0,0 +1,76 @@ +From 304e7a4fcbdf875b103a7195707bad3b5ac55565 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 11:45:26 +0900 +Subject: scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace + event + +From: Keita Morisaki + +[ Upstream commit 9672ed3de7d772ceddd713c769c05e832fc69bae ] + +The ufs_mtk_clk_scale() trace event currently stores the address of the +name string directly via __field(const char *, name). This pointer may +become invalid after the module is unloaded, causing page faults when the +trace buffer is subsequently accessed. + +This can occur because the MediaTek UFS driver can be configured as a +loadable module (tristate in Kconfig), meaning the name string passed to +the trace event may reside in module memory that becomes invalid after +module unload. + +Fix this by using __string() and __assign_str() to copy the string contents +into the ring buffer instead of storing the pointer. This ensures the trace +data remains valid regardless of module state. + +This change increases the memory usage for each ftrace entry by a few bytes +(clock names are typically 7-15 characters like "ufs_sel" or +"ufs_sel_max_src") compared to storing an 8-byte pointer. + +Note that this change does not affect anything unless all of the following +conditions are met: + + - CONFIG_SCSI_UFS_MEDIATEK is enabled + + - ftrace tracing is enabled + + - The ufs_mtk_clk_scale event is enabled in ftrace + +Signed-off-by: Keita Morisaki +Reviewed-by: Peter Wang +Link: https://patch.msgid.link/20260202024526.122515-1-keita.morisaki@tier4.jp +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/host/ufs-mediatek-trace.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/ufs/host/ufs-mediatek-trace.h b/drivers/ufs/host/ufs-mediatek-trace.h +index b5f2ec3140748..0df8ac843379a 100644 +--- a/drivers/ufs/host/ufs-mediatek-trace.h ++++ b/drivers/ufs/host/ufs-mediatek-trace.h +@@ -33,19 +33,19 @@ TRACE_EVENT(ufs_mtk_clk_scale, + TP_ARGS(name, scale_up, clk_rate), + + TP_STRUCT__entry( +- __field(const char*, name) ++ __string(name, name) + __field(bool, scale_up) + __field(unsigned long, clk_rate) + ), + + TP_fast_assign( +- __entry->name = name; ++ __assign_str(name); + __entry->scale_up = scale_up; + __entry->clk_rate = clk_rate; + ), + + TP_printk("ufs: clk (%s) scaled %s @ %lu", +- __entry->name, ++ __get_str(name), + __entry->scale_up ? "up" : "down", + __entry->clk_rate) + ); +-- +2.51.0 + diff --git a/queue-6.12/serial-8250-8250_omap.c-add-support-for-handling-uar.patch b/queue-6.12/serial-8250-8250_omap.c-add-support-for-handling-uar.patch new file mode 100644 index 00000000000..d86baa165b6 --- /dev/null +++ b/queue-6.12/serial-8250-8250_omap.c-add-support-for-handling-uar.patch @@ -0,0 +1,98 @@ +From 710fb9164c82d1a2c318f2df74f0cb21eb6a9a5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 13:48:28 +0530 +Subject: serial: 8250: 8250_omap.c: Add support for handling UART error + conditions + +From: Moteen Shah + +[ Upstream commit 623b07b370e9963122d167e04fdc1dc713ebfbaf ] + +The DMA IRQ handler does not accounts for the overrun(OE) or any other +errors being reported by the IP before triggering a DMA transaction which +leads to the interrupts not being handled resulting into an IRQ storm. + +The way to handle OE is to: +1. Reset the RX FIFO. +2. Read the UART_RESUME register, which clears the internal flag + +Earlier, the driver issued DMA transations even in case of OE which shouldn't +be done according to the OE handling mechanism mentioned above, as we are +resetting the FIFO's, refer section: "12.1.6.4.8.1.3.6 Overrun During +Receive" [0]. + +[0] https://www.ti.com/lit/pdf/spruiu1 + +Signed-off-by: Moteen Shah +Link: https://patch.msgid.link/20260112081829.63049-2-m-shah@ti.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 23 +++++++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 4f57991944dc4..3f85270d16c45 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -98,6 +98,9 @@ + #define OMAP_UART_REV_52 0x0502 + #define OMAP_UART_REV_63 0x0603 + ++/* Resume register */ ++#define UART_OMAP_RESUME 0x0B ++ + /* Interrupt Enable Register 2 */ + #define UART_OMAP_IER2 0x1B + #define UART_OMAP_IER2_RHR_IT_DIS BIT(2) +@@ -117,7 +120,6 @@ + /* Timeout low and High */ + #define UART_OMAP_TO_L 0x26 + #define UART_OMAP_TO_H 0x27 +- + struct omap8250_priv { + void __iomem *membase; + int line; +@@ -1268,6 +1270,20 @@ static u16 omap_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir, u16 status + return status; + } + ++static void am654_8250_handle_uart_errors(struct uart_8250_port *up, u8 iir, u16 status) ++{ ++ if (status & UART_LSR_OE) { ++ serial8250_clear_and_reinit_fifos(up); ++ serial_in(up, UART_LSR); ++ serial_in(up, UART_OMAP_RESUME); ++ } else { ++ if (status & (UART_LSR_FE | UART_LSR_PE | UART_LSR_BI)) ++ serial_in(up, UART_RX); ++ if (iir & UART_IIR_XOFF) ++ serial_in(up, UART_IIR); ++ } ++} ++ + static void am654_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir, + u16 status) + { +@@ -1278,7 +1294,8 @@ static void am654_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir, + * Queue a new transfer if FIFO has data. + */ + if ((status & (UART_LSR_DR | UART_LSR_BI)) && +- (up->ier & UART_IER_RDI)) { ++ (up->ier & UART_IER_RDI) && !(status & UART_LSR_OE)) { ++ am654_8250_handle_uart_errors(up, iir, status); + omap_8250_rx_dma(up); + serial_out(up, UART_OMAP_EFR2, UART_OMAP_EFR2_TIMEOUT_BEHAVE); + } else if ((iir & 0x3f) == UART_IIR_RX_TIMEOUT) { +@@ -1294,6 +1311,8 @@ static void am654_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir, + serial_out(up, UART_OMAP_EFR2, 0x0); + up->ier |= UART_IER_RLSI | UART_IER_RDI; + serial_out(up, UART_IER, up->ier); ++ } else { ++ am654_8250_handle_uart_errors(up, iir, status); + } + } + +-- +2.51.0 + diff --git a/queue-6.12/serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch b/queue-6.12/serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch new file mode 100644 index 00000000000..be64d0b971f --- /dev/null +++ b/queue-6.12/serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch @@ -0,0 +1,46 @@ +From 18ba7a8df0f4333d07054340a85a4ab515657b2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 13:48:29 +0530 +Subject: serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA + termination is done + +From: Moteen Shah + +[ Upstream commit a5fd8945a478ff9be14812693891d7c9b4185a50 ] + +Clear rx_running flag only after DMA teardown polling completes. In the +previous implementation the flag was being cleared while hardware teardown +was still in progress, creating a mismatch between software state +(flag = 0, "ready") and hardware state (still terminating). + +Signed-off-by: Moteen Shah +Link: https://patch.msgid.link/20260112081829.63049-3-m-shah@ti.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 3f85270d16c45..0f4ce0c691147 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -936,7 +936,6 @@ static void __dma_rx_do_complete(struct uart_8250_port *p) + goto out; + + cookie = dma->rx_cookie; +- dma->rx_running = 0; + + /* Re-enable RX FIFO interrupt now that transfer is complete */ + if (priv->habit & UART_HAS_RHR_IT_DIS) { +@@ -970,6 +969,7 @@ static void __dma_rx_do_complete(struct uart_8250_port *p) + goto out; + ret = tty_insert_flip_string(tty_port, dma->rx_buf, count); + ++ dma->rx_running = 0; + p->port.icount.rx += ret; + p->port.icount.buf_overrun += count - ret; + out: +-- +2.51.0 + diff --git a/queue-6.12/serial-8250_dw-handle-clock-enable-errors-in-runtime.patch b/queue-6.12/serial-8250_dw-handle-clock-enable-errors-in-runtime.patch new file mode 100644 index 00000000000..d65b064e5b0 --- /dev/null +++ b/queue-6.12/serial-8250_dw-handle-clock-enable-errors-in-runtime.patch @@ -0,0 +1,57 @@ +From 6293bb26bd8d7a813070a300a4e0839e652282d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 17:54:25 +0300 +Subject: serial: 8250_dw: handle clock enable errors in runtime_resume + +From: Artem Shimko + +[ Upstream commit d31228143a489ba6ba797896a07541ce06828c09 ] + +Add error checking for clk_prepare_enable() calls in +dw8250_runtime_resume(). Currently if either clock fails to enable, +the function returns success while leaving clocks in inconsistent state. + +This change implements comprehensive error handling by checking the return +values of both clk_prepare_enable() calls. If the second clock enable +operation fails after the first clock has already been successfully +enabled, the code now properly cleans up by disabling and unpreparing +the first clock before returning. The error code is then propagated to +the caller, ensuring that clock enable failures are properly reported +rather than being silently ignored. + +Signed-off-by: Artem Shimko +Link: https://patch.msgid.link/20251104145433.2316165-2-a.shimko.dev@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_dw.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c +index 83d186c038cd9..f17dc3de020c1 100644 +--- a/drivers/tty/serial/8250/8250_dw.c ++++ b/drivers/tty/serial/8250/8250_dw.c +@@ -718,11 +718,18 @@ static int dw8250_runtime_suspend(struct device *dev) + + static int dw8250_runtime_resume(struct device *dev) + { ++ int ret; + struct dw8250_data *data = dev_get_drvdata(dev); + +- clk_prepare_enable(data->pclk); ++ ret = clk_prepare_enable(data->pclk); ++ if (ret) ++ return ret; + +- clk_prepare_enable(data->clk); ++ ret = clk_prepare_enable(data->clk); ++ if (ret) { ++ clk_disable_unprepare(data->pclk); ++ return ret; ++ } + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.12/series b/queue-6.12/series index f8290476d9a..0459331e7b9 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -449,3 +449,288 @@ dt-bindings-phy-qcom-edp-add-missing-clock-for-x-elite.patch asoc-dt-bindings-asahi-kasei-ak4458-set-unevaluatedproperties-false.patch asoc-dt-bindings-asahi-kasei-ak4458-fix-the-supply-names.patch asoc-dt-bindings-asahi-kasei-ak5558-fix-the-supply-names.patch +perf-test-stat-update-test-expectations-and-events.patch +perf-test-stat-tests-fix-for-virtualized-machines.patch +perf-unwind-libdw-fix-invalid-reference-counts.patch +perf-callchain-fix-srcline-printing-with-inlines.patch +libsubcmd-fix-null-intersection-case-in-exclude_cmds.patch +perf-maps-fix-reference-count-leak-in-maps__find_ams.patch +perf-annotate-fix-memcpy-size-in-arch__grow_instruct.patch +perf-vendor-events-amd-fix-zen-5-mab-allocation-even.patch +libperf-don-t-remove-g-when-extra_cflags-are-used.patch +libperf-build-always-place-libperf-includes-first.patch +rtc-interface-alarm-race-handling-should-not-discard.patch +statmount-permission-check-should-return-eperm.patch +audit-add-fchmodat2-to-change-attributes-class.patch +hfsplus-fix-volume-corruption-issue-for-generic-498.patch +fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch +audit-add-missing-syscalls-to-read-class.patch +hfsplus-pretend-special-inodes-as-regular-files.patch +i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch +i3c-mipi-i3c-hci-reset-ring_operation1-fields-during.patch +minix-add-required-sanity-checking-to-minix_check_su.patch +dlm-validate-length-in-dlm_search_rsb_tree.patch +btrfs-fallback-to-buffered-io-if-the-data-profile-ha.patch +btrfs-handle-user-interrupt-properly-in-btrfs_trim_f.patch +smb-client-add-proper-locking-around-ses-iface_last_.patch +gfs2-fiemap-page-fault-fix.patch +smb-client-prevent-races-in-query_interfaces.patch +tools-power-cpupower-reset-errno-before-strtoull.patch +s390-purgatory-add-wno-default-const-init-unsafe-to-.patch +perf-arm-cmn-support-cmn-600ae.patch +arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch +rnbd-srv-zero-the-rsp-buffer-before-using-it.patch +x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch +efi-cper-don-t-dump-the-entire-memory-region.patch +apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch +apei-ghes-arm-processor-error-don-t-go-past-allocate.patch +efi-cper-don-t-go-past-the-arm-processor-cper-record.patch +acpi-processor-fix-null-pointer-dereference-in-acpi_.patch +acpi-resource-add-jwipc-jvc9100-to-irq1_level_low_sk.patch +acpica-abort-aml-bytecode-execution-when-executing-a.patch +powercap-intel_rapl-add-pl4-support-for-ice-lake.patch +alpha-fix-user-space-corruption-during-memory-compac.patch +md-cluster-fix-null-pointer-dereference-in-process_m.patch +cpufreq-dt-platdev-block-the-driver-from-probing-on-.patch +s390-perf-disable-register-readout-on-sampling-event.patch +perf-cxlpmu-replace-irqf_oneshot-with-irqf_no_thread.patch +acpi-x86-s2idle-invoke-microsoft-_dsm-function-9-tur.patch +acpi-battery-fix-incorrect-charging-status-when-curr.patch +xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch +blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch +block-decouple-secure-erase-size-limit-from-discard-.patch +sparc-synchronize-user-stack-on-fork-and-clone.patch +sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch +bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch +perf-x86-msr-add-airmont-np.patch +perf-x86-cstate-add-airmont-np.patch +bpf-crypto-use-the-correct-destructor-kfunc-type.patch +bpf-recognize-special-arithmetic-shift-in-the-verifi.patch +clocksource-drivers-sh_tmu-always-leave-device-runni.patch +clocksource-drivers-timer-integrator-ap-add-missing-.patch +pci-msi-unmap-msi-x-region-on-error.patch +crypto-hisilicon-qm-move-the-barrier-before-writing-.patch +mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch +char-tpm-cr50-remove-irqf_oneshot.patch +sched-debug-fix-updating-of-ppos-on-server-write-ops.patch +pstore-ram_core-fix-incorrect-success-return-when-vm.patch +firmware-arm_ffa-unmap-rx-tx-buffers-on-init-failure.patch +revert-arm64-zynqmp-add-an-op-tee-node-to-the-device.patch +arm64-tegra-smaug-add-usb-role-switch-support.patch +parisc-prevent-interrupts-during-reboot.patch +drm-display-dp_mst-add-protection-against-0-vcpi.patch +gpu-panel-edp-add-auo-panel-entry-for-b140han06.4.patch +drm-amdgpu-fix-null-pointer-issue-buffer-funcs.patch +drm-amdkfd-handle-gpu-reset-and-drain-retry-fault-ra.patch +spi-geni-qcom-initialize-mode-related-registers-to-0.patch +spi-geni-qcom-use-xfer-bits_per_word-for-can_dma.patch +drm-amd-display-add-usb-c-dp-alt-mode-lane-limitatio.patch +asoc-sof-ipc4-support-for-sending-payload-along-with.patch +media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch +spi-stm32-fix-overrun-issue-at-8bpw.patch +drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch +media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch +media-omap3isp-isppreview-always-clamp-in-preview_tr.patch +media-omap3isp-set-initial-format.patch +media-chips-media-wave5-fix-conditional-in-start_str.patch +media-chips-media-wave5-process-ready-frames-when-cm.patch +media-mediatek-vcodec-don-t-try-to-decode-422-444-vp.patch +drm-amdgpu-add-support-for-hdp-ip-version-6.1.1.patch +drm-amd-display-fix-dsc-edp-issue.patch +drm-amdgpu-avoid-a-warning-in-timedout-job-handler.patch +drm-amd-display-add-signal-type-check-for-dcn401-get.patch +hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch +drm-amdgpu-skip-loading-sdma_rs64-in-vf.patch +drm-amd-display-only-power-down-dig-on-phy-endpoints.patch +drm-xe-only-toggle-scheduling-in-tdr-if-guc-is-runni.patch +asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch +asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch +spi-spi-mem-limit-octal-dtr-constraints-to-octal-dtr.patch +media-amphion-clear-last_buffer_dequeued-flag-for-de.patch +drm-panel-fix-a-possible-null-pointer-dereference-in.patch +media-adv7180-fix-frame-interval-in-progressive-mode.patch +media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch +media-solo6x10-check-for-out-of-bounds-chip_id.patch +media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch +media-v4l2-async-fix-error-handling-on-steps-after-f.patch +media-mt9m114-avoid-a-reset-low-spike-during-probe.patch +media-mt9m114-return-eprobe_defer-if-no-endpoint-is-.patch +media-ipu6-ensure-stream_mutex-is-acquired-when-deal.patch +media-ipu6-close-firmware-streams-on-streaming-enabl.patch +media-ipu6-always-close-firmware-stream.patch +alsa-hda-realtek-add-hp-victus-16-e0xxx-mute-led-qui.patch +drm-amdkfd-relax-size-checking-during-queue-buffer-g.patch +drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch +drm-account-property-blob-allocations-to-memcg.patch +hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch +virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch +asoc-soc-acpi-intel-arl-match-change-rt722-amp-endpo.patch +pci-add-intel-nova-lake-audio-device-id.patch +drm-amd-display-disable-fec-when-powering-down-encod.patch +drm-amd-display-ensure-link-output-is-disabled-in-ba.patch +drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch +drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch +drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch +media-rkisp1-fix-filter-mode-register-configuration.patch +hid-multitouch-add-egalaxtouch-exc3188-support.patch +hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch +alsa-hda-conexant-add-headset-mic-fix-for-mechrevo-w.patch +alsa-hda-realtek-fix-lg-gram-style-14-speakers.patch +gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch +asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch +spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch +drm-amd-display-fix-gfx12-family-constant-checks.patch +drm-amd-display-avoid-dig-reg-access-timeout-on-usb4.patch +asoc-codecs-max98390-check-return-value-of-devm_gpio.patch +hwmon-dell-smm-add-support-for-dell-optiplex-7080.patch +hwmon-nct6775-add-asus-pro-ws-wrx90e-sage-se.patch +hwmon-f71882fg-add-f81968-support.patch +hid-logitech-hidpp-add-support-for-logitech-k980.patch +asoc-es8328-add-error-unwind-in-resume.patch +modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch +power-sequencing-fix-missing-state_lock-in-pwrseq_po.patch +asoc-sof-intel-hda-fix-null-pointer-dereference.patch +spi-geni-qcom-fix-abort-sequence-execution-for-seria.patch +asoc-fsl-imx-rpmsg-use-snd_soc_find_dai_with_mutex-i.patch +alsa-hda-realtek-enable-mute-leds-on-hp-envy-x360-15.patch +alsa-mixer-oss-add-card-disconnect-checkpoints.patch +alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch +jfs-add-missing-set_freezable-for-freezable-kthread.patch +jfs-nlink-overflow-in-jfs_rename.patch +wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch +wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch +wifi-rtw88-rtw8821cu-add-id-for-mercusys-mu6h.patch +wifi-rtw89-8922a-set-random-mac-if-efuse-contains-ze.patch +wifi-rtw89-ser-enable-error-imr-after-recovering-fro.patch +wifi-rtw88-use-devm_kmemdup-in-rtw_set_supported_ban.patch +wifi-rtw88-fix-inadvertent-sharing-of-struct-ieee802.patch +dm-replace-eexist-with-ebusy.patch +dm-remove-fake-timeout-to-avoid-leak-request.patch +iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch +net-wwan-mhi-add-network-support-for-foxconn-t99w760.patch +wifi-libertas-fix-warning-in-usb_tx_block.patch +iommu-amd-move-wait_on_sem-out-of-spinlock.patch +wifi-rtw89-mac-correct-page-number-for-csi-response.patch +wifi-rtw89-wow-add-reason-codes-for-disassociation-i.patch +wifi-ath11k-add-pm-quirk-for-thinkpad-z13-z16-gen1.patch +wifi-ath11k-fix-failure-to-connect-to-a-6-ghz-ap.patch +wifi-ath12k-fix-preferred-hardware-mode-calculation.patch +wifi-cfg80211-allow-only-one-nan-interface-also-in-m.patch +ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch +ipv6-annotate-data-races-over-sysctl.flowlabel_refle.patch +ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch +ext4-mark-group-add-fast-commit-ineligible.patch +ext4-move-ext4_percpu_param_init-before-ext4_mb_init.patch +ext4-mark-group-extend-fast-commit-ineligible.patch +ext4-use-reserved-metadata-blocks-when-splitting-ext.patch +netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch +netfilter-xt_tcpmss-check-remaining-length-before-re.patch +openrisc-define-arch-specific-version-of-nop.patch +net-usb-r8152-fix-transmit-queue-timeout.patch +wifi-iwlwifi-mvm-check-the-validity-of-noa_len.patch +wifi-rtw89-fix-unable-to-receive-probe-responses-und.patch +wifi-rtw89-8922a-add-digital-compensation-for-2ghz.patch +net-rds-no-shortcut-out-of-rds_conn_error.patch +ext4-propagate-flags-to-convert_initialized_extent.patch +gro-change-the-bug_on-in-gro_pull_from_frag0.patch +ipv4-igmp-annotate-data-races-around-idev-mr_maxdela.patch +net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch +wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch +wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch +ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch +bluetooth-btusb-add-support-for-mediatek7920-0489-e1.patch +bluetooth-hci_conn-set-link_policy-on-incoming-acl-c.patch +bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch +bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch +bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch +octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch +net-sfp-add-quirk-for-lantech-8330-265d.patch +wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch +wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch +bnxt_en-allow-ntuple-filters-for-drops.patch +net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch +vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch +net-rds-clear-reconnect-pending-bit.patch +pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch +pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch +pci-fix-pci_slot_lock-device-locking.patch +pci-enable-acs-after-configuring-iommu-for-of-platfo.patch +pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch +pci-mark-nvidia-gb10-to-avoid-bus-reset.patch +myri10ge-avoid-uninitialized-variable-use.patch +nfc-nxp-nci-remove-interrupt-trigger-type.patch +rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch +ata-libata-avoid-long-timeouts-on-hot-unplugged-sata.patch +hisi_acc_vfio_pci-update-status-after-ras-error.patch +scsi-buslogic-reduce-stack-usage.patch +vhost-fix-caching-attributes-of-mmio-regions-by-sett.patch +scsi-ufs-mediatek-fix-page-faults-in-ufs_mtk_clk_sca.patch +riscv-vector-init-vector-context-with-proper-vlenb.patch +tracing-fix-false-sharing-in-hwlat-get_sample.patch +remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch +mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch +mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch +mailbox-sprd-mask-interrupts-that-are-not-handled.patch +remoteproc-mediatek-break-lock-dependency-to-prepare.patch +mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch +clk-microchip-core-correct-return-value-on-_get_pare.patch +hid-i2c-hid-add-focaltech-ft8112.patch +m68k-nommu-fix-memmove-with-differently-aligned-src-.patch +9p-xen-protect-xen_9pfs_front_free-against-concurren.patch +dmaengine-stm32-dma3-use-module_platform_driver.patch +soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch +soundwire-intel_auxdevice-add-cs42l45-codec-to-wake_.patch +staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch +serial-8250_dw-handle-clock-enable-errors-in-runtime.patch +usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch +fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch +most-core-fix-resource-leak-in-most_register_interfa.patch +dmaengine-sun6i-choose-appropriate-burst-length-unde.patch +dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch +phy-ti-phy-j721e-wiz-restore-mux-selection-during-re.patch +phy-cadence-torrent-restore-parent-clock-for-refclk-.patch +misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch +misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch +usb-gadget-f_fs-fix-dma-buf-out-queues.patch +usb-gadget-f_fs-fix-ioctl-error-handling.patch +usb-chipidea-udc-fix-dma-and-sg-cleanup-in-_ep_nuke.patch +staging-rtl8723bs-fix-memory-leak-on-failure-path.patch +serial-8250-8250_omap.c-add-support-for-handling-uar.patch +serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch +fix-it87_wdt-early-reboot-by-reporting-running-timer.patch +binder-don-t-use-pk-through-printk.patch +watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch +phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch +phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch +revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch +mfd-intel-lpss-add-intel-nova-lake-s-pci-ids.patch +iio-use-irqf_no_thread.patch +iio-magnetometer-remove-irqf_oneshot.patch +mips-loongson-make-cpumask_of_node-robust-against-nu.patch +fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch +fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch +fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch +fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch +fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch +ceph-supply-snapshot-context-in-ceph_uninline_data.patch +libceph-define-and-enforce-ceph_max_key_len.patch +thermal-int340x-fix-sysfs-group-leak-on-dlvr-registr.patch +acpi-x86-force-enabling-of-pwm2-on-the-yogabook-yb1-.patch +include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch +arm-9467-1-mm-don-t-use-pk-through-printk.patch +drm-amd-display-fix-writeback-on-dcn-3.2.patch +drm-amd-display-fix-system-resume-lag-issue.patch +drm-amd-display-avoid-updating-surface-with-the-same.patch +drm-amdgpu-adjust-usleep_range-in-fence-wait.patch +alsa-usb-audio-update-the-number-of-packets-properly.patch +drm-amdgpu-add-hainan-clock-adjustment.patch +drm-amd-display-bypass-post-csc-for-additional-color.patch +spi-spidev-fix-lock-inversion-between-spi_lock-and-b.patch +drm-radeon-add-hainan-clock-adjustment.patch +alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch +btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch +arm64-hugetlbpage-avoid-unused-but-set-parameter-war.patch +drm-amd-display-remove-conditional-for-shaper-3dlut-.patch +rtc-zynqmp-correct-frequency-value.patch +ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch +ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch diff --git a/queue-6.12/smb-client-add-proper-locking-around-ses-iface_last_.patch b/queue-6.12/smb-client-add-proper-locking-around-ses-iface_last_.patch new file mode 100644 index 00000000000..c41513a7a03 --- /dev/null +++ b/queue-6.12/smb-client-add-proper-locking-around-ses-iface_last_.patch @@ -0,0 +1,36 @@ +From ba7c36c253566c2f4b3743179854c4406ad712d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 14:54:45 -0300 +Subject: smb: client: add proper locking around ses->iface_last_update + +From: Henrique Carvalho + +[ Upstream commit e97dcac3dc0bd37e4b56aaa6874b572a3a461102 ] + +There is a missing ses->iface_lock in cifs_setup_session, +around ses->iface_last_update. + +Signed-off-by: Henrique Carvalho +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/connect.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c +index 3b0f63e0a2534..3c83bda8298ee 100644 +--- a/fs/smb/client/connect.c ++++ b/fs/smb/client/connect.c +@@ -4068,7 +4068,9 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses, + ses->ses_status = SES_IN_SETUP; + + /* force iface_list refresh */ ++ spin_lock(&ses->iface_lock); + ses->iface_last_update = 0; ++ spin_unlock(&ses->iface_lock); + } + spin_unlock(&ses->ses_lock); + +-- +2.51.0 + diff --git a/queue-6.12/smb-client-prevent-races-in-query_interfaces.patch b/queue-6.12/smb-client-prevent-races-in-query_interfaces.patch new file mode 100644 index 00000000000..472352ed255 --- /dev/null +++ b/queue-6.12/smb-client-prevent-races-in-query_interfaces.patch @@ -0,0 +1,79 @@ +From 4449b922e466271db605e152ea0514aa2c310c15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 14:54:44 -0300 +Subject: smb: client: prevent races in ->query_interfaces() + +From: Henrique Carvalho + +[ Upstream commit c3c06e42e1527716c54f3ad2ced6a034b5f3a489 ] + +It was possible for two query interface works to be concurrently trying +to update the interfaces. + +Prevent this by checking and updating iface_last_update under +iface_lock. + +Signed-off-by: Henrique Carvalho +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2ops.c | 19 ++++++++----------- + 1 file changed, 8 insertions(+), 11 deletions(-) + +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index 4e7e6ad79966e..300573be10bc1 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -637,13 +637,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, + p = buf; + + spin_lock(&ses->iface_lock); +- /* do not query too frequently, this time with lock held */ +- if (ses->iface_last_update && +- time_before(jiffies, ses->iface_last_update + +- (SMB_INTERFACE_POLL_INTERVAL * HZ))) { +- spin_unlock(&ses->iface_lock); +- return 0; +- } + + /* + * Go through iface_list and mark them as inactive +@@ -666,7 +659,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, + "Empty network interface list returned by server %s\n", + ses->server->hostname); + rc = -EOPNOTSUPP; +- ses->iface_last_update = jiffies; + goto out; + } + +@@ -795,8 +787,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, + + sizeof(p->Next) && p->Next)) + cifs_dbg(VFS, "%s: incomplete interface info\n", __func__); + +- ses->iface_last_update = jiffies; +- + out: + /* + * Go through the list again and put the inactive entries +@@ -825,10 +815,17 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon, bool in_ + struct TCP_Server_Info *pserver; + + /* do not query too frequently */ ++ spin_lock(&ses->iface_lock); + if (ses->iface_last_update && + time_before(jiffies, ses->iface_last_update + +- (SMB_INTERFACE_POLL_INTERVAL * HZ))) ++ (SMB_INTERFACE_POLL_INTERVAL * HZ))) { ++ spin_unlock(&ses->iface_lock); + return 0; ++ } ++ ++ ses->iface_last_update = jiffies; ++ ++ spin_unlock(&ses->iface_lock); + + rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, + FSCTL_QUERY_NETWORK_INTERFACE_INFO, +-- +2.51.0 + diff --git a/queue-6.12/soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch b/queue-6.12/soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch new file mode 100644 index 00000000000..b72c30df695 --- /dev/null +++ b/queue-6.12/soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch @@ -0,0 +1,49 @@ +From 0b3a0c892aa166d7d96ca170c9e00e8e103e5de3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 15:09:47 +0200 +Subject: soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of + NUC15) + +From: Peter Ujfalusi + +[ Upstream commit 59946373755d71dbd7614ba235e0093159f80b69 ] + +Avell B.ON is an OEM re-branded NUC15 'Bishop County' LAPBC510 and +LAPBC710. + +Link: https://github.com/thesofproject/linux/issues/5529 +Signed-off-by: Peter Ujfalusi +Reviewed-by: Kai Vehmanen +Reviewed-by: Bard Liao +Link: https://patch.msgid.link/20251215130947.31385-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/dmi-quirks.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/soundwire/dmi-quirks.c b/drivers/soundwire/dmi-quirks.c +index 91ab97a456fa9..5854218e1a274 100644 +--- a/drivers/soundwire/dmi-quirks.c ++++ b/drivers/soundwire/dmi-quirks.c +@@ -122,6 +122,17 @@ static const struct dmi_system_id adr_remap_quirk_table[] = { + }, + .driver_data = (void *)intel_tgl_bios, + }, ++ { ++ /* ++ * quirk used for Avell B.ON (OEM rebrand of NUC15 'Bishop County' ++ * LAPBC510 and LAPBC710) ++ */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Avell High Performance"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "B.ON"), ++ }, ++ .driver_data = (void *)intel_tgl_bios, ++ }, + { + /* quirk used for NUC15 'Rooks County' LAPRC510 and LAPRC710 skews */ + .matches = { +-- +2.51.0 + diff --git a/queue-6.12/soundwire-intel_auxdevice-add-cs42l45-codec-to-wake_.patch b/queue-6.12/soundwire-intel_auxdevice-add-cs42l45-codec-to-wake_.patch new file mode 100644 index 00000000000..28b65874648 --- /dev/null +++ b/queue-6.12/soundwire-intel_auxdevice-add-cs42l45-codec-to-wake_.patch @@ -0,0 +1,37 @@ +From 30a0cee7be3d6c184f9ece6fade4db7496c680ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 15:17:29 +0000 +Subject: soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list + +From: Maciej Strozek + +[ Upstream commit f87e5575a6bd1925cd55f500b61b661724372e5f ] + +Add cs42l45 to the wake_capable_list because it can generate jack events +whilst the bus is stopped. + +Signed-off-by: Maciej Strozek +Reviewed-by: Bard Liao +Signed-off-by: Charles Keepax +Link: https://patch.msgid.link/20251215151729.3911077-1-ckeepax@opensource.cirrus.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/intel_auxdevice.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/soundwire/intel_auxdevice.c b/drivers/soundwire/intel_auxdevice.c +index ae689d5d1ab9e..61f07d2d75efc 100644 +--- a/drivers/soundwire/intel_auxdevice.c ++++ b/drivers/soundwire/intel_auxdevice.c +@@ -48,6 +48,7 @@ struct wake_capable_part { + + static struct wake_capable_part wake_capable_list[] = { + {0x01fa, 0x4243}, ++ {0x01fa, 0x4245}, + {0x025d, 0x5682}, + {0x025d, 0x700}, + {0x025d, 0x711}, +-- +2.51.0 + diff --git a/queue-6.12/sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch b/queue-6.12/sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch new file mode 100644 index 00000000000..46e82e3f7ee --- /dev/null +++ b/queue-6.12/sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch @@ -0,0 +1,50 @@ +From e72a46db5b8a36767e295e25eed3e0107ca7bdd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 13:40:29 +0000 +Subject: sparc: don't reference obsolete termio struct for TC* constants + +From: Sam James + +[ Upstream commit be0bccffcde3308150d2a90e55fc10e249098909 ] + +Similar in nature to commit ab107276607a ("powerpc: Fix struct termio related ioctl macros"). + +glibc-2.42 drops the legacy termio struct, but the ioctls.h header still +defines some TC* constants in terms of termio (via sizeof). Hardcode the +values instead. + +This fixes building Python for example, which falls over like: + ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio' + +Link: https://bugs.gentoo.org/961769 +Link: https://bugs.gentoo.org/962600 +Signed-off-by: Sam James +Reviewed-by: Andreas Larsson +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/include/uapi/asm/ioctls.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/sparc/include/uapi/asm/ioctls.h b/arch/sparc/include/uapi/asm/ioctls.h +index 7fd2f5873c9e7..a8bbdf9877a41 100644 +--- a/arch/sparc/include/uapi/asm/ioctls.h ++++ b/arch/sparc/include/uapi/asm/ioctls.h +@@ -5,10 +5,10 @@ + #include + + /* Big T */ +-#define TCGETA _IOR('T', 1, struct termio) +-#define TCSETA _IOW('T', 2, struct termio) +-#define TCSETAW _IOW('T', 3, struct termio) +-#define TCSETAF _IOW('T', 4, struct termio) ++#define TCGETA 0x40125401 /* _IOR('T', 1, struct termio) */ ++#define TCSETA 0x80125402 /* _IOW('T', 2, struct termio) */ ++#define TCSETAW 0x80125403 /* _IOW('T', 3, struct termio) */ ++#define TCSETAF 0x80125404 /* _IOW('T', 4, struct termio) */ + #define TCSBRK _IO('T', 5) + #define TCXONC _IO('T', 6) + #define TCFLSH _IO('T', 7) +-- +2.51.0 + diff --git a/queue-6.12/sparc-synchronize-user-stack-on-fork-and-clone.patch b/queue-6.12/sparc-synchronize-user-stack-on-fork-and-clone.patch new file mode 100644 index 00000000000..45b2810a2c4 --- /dev/null +++ b/queue-6.12/sparc-synchronize-user-stack-on-fork-and-clone.patch @@ -0,0 +1,114 @@ +From da3e54a446eb5385b9058c131d7be05ae03e152f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 15:47:52 +0100 +Subject: sparc: Synchronize user stack on fork and clone + +From: Andreas Larsson + +[ Upstream commit e38eba3b77878ada327a572a41596a3b0b44e522 ] + +Flush all uncommitted user windows before calling the generic syscall +handlers for clone, fork, and vfork. + +Prior to entering the arch common handlers sparc_{clone|fork|vfork}, the +arch-specific syscall wrappers for these syscalls will attempt to flush +all windows (including user windows). + +In the window overflow trap handlers on both SPARC{32|64}, +if the window can't be stored (i.e due to MMU related faults) the routine +backups the user window and increments a thread counter (wsaved). + +By adding a synchronization point after the flush attempt, when fault +handling is enabled, any uncommitted user windows will be flushed. + +Link: https://sourceware.org/bugzilla/show_bug.cgi?id=31394 +Closes: https://lore.kernel.org/sparclinux/fe5cc47167430007560501aabb28ba154985b661.camel@physik.fu-berlin.de/ +Signed-off-by: Andreas Larsson +Signed-off-by: Ludwig Rydberg +Tested-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/20260119144753.27945-2-ludwig.rydberg@gaisler.com +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/kernel/process.c | 38 +++++++++++++++++++++++-------------- + 1 file changed, 24 insertions(+), 14 deletions(-) + +diff --git a/arch/sparc/kernel/process.c b/arch/sparc/kernel/process.c +index 0442ab00518d3..7d69877511fac 100644 +--- a/arch/sparc/kernel/process.c ++++ b/arch/sparc/kernel/process.c +@@ -17,14 +17,18 @@ + + asmlinkage long sparc_fork(struct pt_regs *regs) + { +- unsigned long orig_i1 = regs->u_regs[UREG_I1]; ++ unsigned long orig_i1; + long ret; + struct kernel_clone_args args = { + .exit_signal = SIGCHLD, +- /* Reuse the parent's stack for the child. */ +- .stack = regs->u_regs[UREG_FP], + }; + ++ synchronize_user_stack(); ++ ++ orig_i1 = regs->u_regs[UREG_I1]; ++ /* Reuse the parent's stack for the child. */ ++ args.stack = regs->u_regs[UREG_FP]; ++ + ret = kernel_clone(&args); + + /* If we get an error and potentially restart the system +@@ -40,16 +44,19 @@ asmlinkage long sparc_fork(struct pt_regs *regs) + + asmlinkage long sparc_vfork(struct pt_regs *regs) + { +- unsigned long orig_i1 = regs->u_regs[UREG_I1]; ++ unsigned long orig_i1; + long ret; +- + struct kernel_clone_args args = { + .flags = CLONE_VFORK | CLONE_VM, + .exit_signal = SIGCHLD, +- /* Reuse the parent's stack for the child. */ +- .stack = regs->u_regs[UREG_FP], + }; + ++ synchronize_user_stack(); ++ ++ orig_i1 = regs->u_regs[UREG_I1]; ++ /* Reuse the parent's stack for the child. */ ++ args.stack = regs->u_regs[UREG_FP]; ++ + ret = kernel_clone(&args); + + /* If we get an error and potentially restart the system +@@ -65,15 +72,18 @@ asmlinkage long sparc_vfork(struct pt_regs *regs) + + asmlinkage long sparc_clone(struct pt_regs *regs) + { +- unsigned long orig_i1 = regs->u_regs[UREG_I1]; +- unsigned int flags = lower_32_bits(regs->u_regs[UREG_I0]); ++ unsigned long orig_i1; ++ unsigned int flags; + long ret; ++ struct kernel_clone_args args = {0}; + +- struct kernel_clone_args args = { +- .flags = (flags & ~CSIGNAL), +- .exit_signal = (flags & CSIGNAL), +- .tls = regs->u_regs[UREG_I3], +- }; ++ synchronize_user_stack(); ++ ++ orig_i1 = regs->u_regs[UREG_I1]; ++ flags = lower_32_bits(regs->u_regs[UREG_I0]); ++ args.flags = (flags & ~CSIGNAL); ++ args.exit_signal = (flags & CSIGNAL); ++ args.tls = regs->u_regs[UREG_I3]; + + #ifdef CONFIG_COMPAT + if (test_thread_flag(TIF_32BIT)) { +-- +2.51.0 + diff --git a/queue-6.12/spi-geni-qcom-fix-abort-sequence-execution-for-seria.patch b/queue-6.12/spi-geni-qcom-fix-abort-sequence-execution-for-seria.patch new file mode 100644 index 00000000000..37117f35c79 --- /dev/null +++ b/queue-6.12/spi-geni-qcom-fix-abort-sequence-execution-for-seria.patch @@ -0,0 +1,71 @@ +From 92c804ca21e16e2ef6b9992c8ca416c8e703b108 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 21:58:52 +0530 +Subject: spi: geni-qcom: Fix abort sequence execution for serial engine errors + +From: Praveen Talari + +[ Upstream commit 96e041647bb0f9d92f95df1d69cb7442d7408b79 ] + +The driver currently skips the abort sequence for target mode when serial +engine errors occur. This leads to improper error recovery as the serial +engine may remain in an undefined state without proper cleanup, potentially +causing subsequent operations to fail or behave unpredictably. + +Fix this by ensuring the abort sequence and DMA reset always execute during +error recovery, as both are required for proper serial engine error +handling. + +Co-developed-by: Konrad Dybcio +Signed-off-by: Konrad Dybcio +Signed-off-by: Praveen Talari +Reviewed-by: Konrad Dybcio +Link: https://patch.msgid.link/20260204162854.1206323-3-praveen.talari@oss.qualcomm.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-geni-qcom.c | 24 ++++++++++-------------- + 1 file changed, 10 insertions(+), 14 deletions(-) + +diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c +index 05e1b9ae0ed8b..38606c9e12ee8 100644 +--- a/drivers/spi/spi-geni-qcom.c ++++ b/drivers/spi/spi-geni-qcom.c +@@ -160,24 +160,20 @@ static void handle_se_timeout(struct spi_controller *spi, + xfer = mas->cur_xfer; + mas->cur_xfer = NULL; + +- if (spi->target) { +- /* +- * skip CMD Cancel sequnece since spi target +- * doesn`t support CMD Cancel sequnece +- */ ++ /* The controller doesn't support the Cancel commnand in target mode */ ++ if (!spi->target) { ++ reinit_completion(&mas->cancel_done); ++ geni_se_cancel_m_cmd(se); ++ + spin_unlock_irq(&mas->lock); +- goto reset_if_dma; +- } + +- reinit_completion(&mas->cancel_done); +- geni_se_cancel_m_cmd(se); +- spin_unlock_irq(&mas->lock); ++ time_left = wait_for_completion_timeout(&mas->cancel_done, HZ); ++ if (time_left) ++ goto reset_if_dma; + +- time_left = wait_for_completion_timeout(&mas->cancel_done, HZ); +- if (time_left) +- goto reset_if_dma; ++ spin_lock_irq(&mas->lock); ++ } + +- spin_lock_irq(&mas->lock); + reinit_completion(&mas->abort_done); + geni_se_abort_m_cmd(se); + spin_unlock_irq(&mas->lock); +-- +2.51.0 + diff --git a/queue-6.12/spi-geni-qcom-initialize-mode-related-registers-to-0.patch b/queue-6.12/spi-geni-qcom-initialize-mode-related-registers-to-0.patch new file mode 100644 index 00000000000..895dfa983a6 --- /dev/null +++ b/queue-6.12/spi-geni-qcom-initialize-mode-related-registers-to-0.patch @@ -0,0 +1,40 @@ +From 164d4b7e4989d3f93aa472d3dde377a18e66cda5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Nov 2025 16:12:01 -0500 +Subject: spi-geni-qcom: initialize mode related registers to 0 + +From: Jonathan Marek + +[ Upstream commit 739062a9f1e9a77a9687c8fd30f8e5dd12ec70be ] + +setup_fifo_params assumes these will be zero, it won't write these +registers if the initial mode is zero. + +Signed-off-by: Jonathan Marek +Link: https://patch.msgid.link/20251120211204.24078-4-jonathan@marek.ca +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-geni-qcom.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c +index 768d7482102ad..d2f7a46c0910c 100644 +--- a/drivers/spi/spi-geni-qcom.c ++++ b/drivers/spi/spi-geni-qcom.c +@@ -718,6 +718,12 @@ static int spi_geni_init(struct spi_geni_master *mas) + case 0: + mas->cur_xfer_mode = GENI_SE_FIFO; + geni_se_select_mode(se, GENI_SE_FIFO); ++ /* setup_fifo_params assumes that these registers start with a zero value */ ++ writel(0, se->base + SE_SPI_LOOPBACK); ++ writel(0, se->base + SE_SPI_DEMUX_SEL); ++ writel(0, se->base + SE_SPI_CPHA); ++ writel(0, se->base + SE_SPI_CPOL); ++ writel(0, se->base + SE_SPI_DEMUX_OUTPUT_INV); + ret = 0; + break; + } +-- +2.51.0 + diff --git a/queue-6.12/spi-geni-qcom-use-xfer-bits_per_word-for-can_dma.patch b/queue-6.12/spi-geni-qcom-use-xfer-bits_per_word-for-can_dma.patch new file mode 100644 index 00000000000..4f10a86f5bc --- /dev/null +++ b/queue-6.12/spi-geni-qcom-use-xfer-bits_per_word-for-can_dma.patch @@ -0,0 +1,50 @@ +From aa61d28fdb132ac76e41d0415f2e45f8f962bd3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Nov 2025 16:12:00 -0500 +Subject: spi-geni-qcom: use xfer->bits_per_word for can_dma() + +From: Jonathan Marek + +[ Upstream commit fb2bbe3838728f572485706677590e4fc41eec5c ] + +mas->cur_bits_per_word may not reflect the value of xfer->bits_per_word +when can_dma() is called. Use the right value instead. + +Signed-off-by: Jonathan Marek +Link: https://patch.msgid.link/20251120211204.24078-3-jonathan@marek.ca +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-geni-qcom.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c +index d2f7a46c0910c..05e1b9ae0ed8b 100644 +--- a/drivers/spi/spi-geni-qcom.c ++++ b/drivers/spi/spi-geni-qcom.c +@@ -548,10 +548,10 @@ static u32 get_xfer_len_in_words(struct spi_transfer *xfer, + { + u32 len; + +- if (!(mas->cur_bits_per_word % MIN_WORD_LEN)) +- len = xfer->len * BITS_PER_BYTE / mas->cur_bits_per_word; ++ if (!(xfer->bits_per_word % MIN_WORD_LEN)) ++ len = xfer->len * BITS_PER_BYTE / xfer->bits_per_word; + else +- len = xfer->len / (mas->cur_bits_per_word / BITS_PER_BYTE + 1); ++ len = xfer->len / (xfer->bits_per_word / BITS_PER_BYTE + 1); + len &= TRANS_LEN_MSK; + + return len; +@@ -571,7 +571,7 @@ static bool geni_can_dma(struct spi_controller *ctlr, + return true; + + len = get_xfer_len_in_words(xfer, mas); +- fifo_size = mas->tx_fifo_depth * mas->fifo_width_bits / mas->cur_bits_per_word; ++ fifo_size = mas->tx_fifo_depth * mas->fifo_width_bits / xfer->bits_per_word; + + if (len > fifo_size) + return true; +-- +2.51.0 + diff --git a/queue-6.12/spi-spi-mem-limit-octal-dtr-constraints-to-octal-dtr.patch b/queue-6.12/spi-spi-mem-limit-octal-dtr-constraints-to-octal-dtr.patch new file mode 100644 index 00000000000..e2090bb5c8d --- /dev/null +++ b/queue-6.12/spi-spi-mem-limit-octal-dtr-constraints-to-octal-dtr.patch @@ -0,0 +1,62 @@ +From 90e773477843f41804aacf6b470cbaeeb7a479ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jan 2026 18:18:01 +0100 +Subject: spi: spi-mem: Limit octal DTR constraints to octal DTR situations + +From: Miquel Raynal + +[ Upstream commit 8618271887ca10ac5108fe7e1d82ba8f1b152cf9 ] + +In this helper, any operation with a single DTR cycle (like 1S-1S-8D) is +considered requiring a duplicated command opcode. This is wrong as this +constraint only applies to octal DTR operations (8D-8D-8D). + +Narrow the application of this constraint to the concerned bus +interface. + +Note: none of the possible XD-XD-XD pattern, with X being one of {1, 2, +4} would benefit from this check either as there is only in octal DTR +mode that a single clock edge would be enough to transmit the full +opcode. + +Make sure the constraint of expecting two bytes for the command is +applied to the relevant bus interface. + +Reviewed-by: Tudor Ambarus +Signed-off-by: Miquel Raynal +Link: https://patch.msgid.link/20260109-winbond-v6-17-rc1-oddr-v2-3-1fff6a2ddb80@bootlin.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-mem.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c +index 96374afd0193c..402809cc0e09d 100644 +--- a/drivers/spi/spi-mem.c ++++ b/drivers/spi/spi-mem.c +@@ -175,8 +175,19 @@ bool spi_mem_default_supports_op(struct spi_mem *mem, + if (op->data.swap16 && !spi_mem_controller_is_capable(ctlr, swap16)) + return false; + +- if (op->cmd.nbytes != 2) +- return false; ++ /* Extra 8D-8D-8D limitations */ ++ if (op->cmd.dtr && op->cmd.buswidth == 8) { ++ if (op->cmd.nbytes != 2) ++ return false; ++ ++ if ((op->addr.nbytes % 2) || ++ (op->dummy.nbytes % 2) || ++ (op->data.nbytes % 2)) { ++ dev_err(&ctlr->dev, ++ "Even byte numbers not allowed in octal DTR operations\n"); ++ return false; ++ } ++ } + } else { + if (op->cmd.nbytes != 1) + return false; +-- +2.51.0 + diff --git a/queue-6.12/spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch b/queue-6.12/spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch new file mode 100644 index 00000000000..571cb3ab720 --- /dev/null +++ b/queue-6.12/spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch @@ -0,0 +1,60 @@ +From 7d6cbb987e77469829f148aab71949a5ce03bba0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 20:30:04 +0800 +Subject: spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end + +From: Chin-Ting Kuo + +[ Upstream commit 53f826ff5e0e3ecb279862ca7cce1491b94bb017 ] + +spi_mem_dirmap_create() may reconfigure controller-wide settings, +which can interfere with concurrent transfers to other devices +sharing the same SPI controller but using different chip selects. + +Wrap the ->dirmap_create() callback with spi_mem_access_start() and +spi_mem_access_end() to serialize access and prevent cross-CS +interference during dirmap creation. + +This patch has been verified on a setup where a SPI TPM is connected +to CS0 of a SPI controller, while a SPI NOR flash is connected to CS1 +of the same controller. Without this patch, spi_mem_dirmap_create() +for the SPI NOR flash interferes with ongoing SPI TPM data transfers, +resulting in failure to create the TPM device. This was tested on an +ASPEED AST2700 EVB. + +Signed-off-by: Chin-Ting Kuo +Reviewed-by: Paul Menzel +Link: https://patch.msgid.link/20260120123005.1392071-2-chin-ting_kuo@aspeedtech.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-mem.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c +index 402809cc0e09d..ff9f2e9abe619 100644 +--- a/drivers/spi/spi-mem.c ++++ b/drivers/spi/spi-mem.c +@@ -648,9 +648,18 @@ spi_mem_dirmap_create(struct spi_mem *mem, + + desc->mem = mem; + desc->info = *info; +- if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create) ++ if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create) { ++ ret = spi_mem_access_start(mem); ++ if (ret) { ++ kfree(desc); ++ return ERR_PTR(ret); ++ } ++ + ret = ctlr->mem_ops->dirmap_create(desc); + ++ spi_mem_access_end(mem); ++ } ++ + if (ret) { + desc->nodirmap = true; + if (!spi_mem_supports_op(desc->mem, &desc->info.op_tmpl)) +-- +2.51.0 + diff --git a/queue-6.12/spi-spidev-fix-lock-inversion-between-spi_lock-and-b.patch b/queue-6.12/spi-spidev-fix-lock-inversion-between-spi_lock-and-b.patch new file mode 100644 index 00000000000..58c1eacba3c --- /dev/null +++ b/queue-6.12/spi-spidev-fix-lock-inversion-between-spi_lock-and-b.patch @@ -0,0 +1,218 @@ +From 54ac41358d87fa31fe231ee357399688ae6461bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Feb 2026 08:26:16 +0100 +Subject: spi: spidev: fix lock inversion between spi_lock and buf_lock + +From: Fabian Godehardt + +[ Upstream commit 40534d19ed2afb880ecf202dab26a8e7a5808d16 ] + +The spidev driver previously used two mutexes, spi_lock and buf_lock, +but acquired them in different orders depending on the code path: + + write()/read(): buf_lock -> spi_lock + ioctl(): spi_lock -> buf_lock + +This AB-BA locking pattern triggers lockdep warnings and can +cause real deadlocks: + + WARNING: possible circular locking dependency detected + spidev_ioctl() -> mutex_lock(&spidev->buf_lock) + spidev_sync_write() -> mutex_lock(&spidev->spi_lock) + *** DEADLOCK *** + +The issue is reproducible with a simple userspace program that +performs write() and SPI_IOC_WR_MAX_SPEED_HZ ioctl() calls from +separate threads on the same spidev file descriptor. + +Fix this by simplifying the locking model and removing the lock +inversion entirely. spidev_sync() no longer performs any locking, +and all callers serialize access using spi_lock. + +buf_lock is removed since its functionality is fully covered by +spi_lock, eliminating the possibility of lock ordering issues. + +This removes the lock inversion and prevents deadlocks without +changing userspace ABI or behaviour. + +Signed-off-by: Fabian Godehardt +Link: https://patch.msgid.link/20260211072616.489522-1-fg@emlix.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spidev.c | 63 ++++++++++++++++---------------------------- + 1 file changed, 22 insertions(+), 41 deletions(-) + +diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c +index 653f82984216c..661b84f3ee622 100644 +--- a/drivers/spi/spidev.c ++++ b/drivers/spi/spidev.c +@@ -74,7 +74,6 @@ struct spidev_data { + struct list_head device_entry; + + /* TX/RX buffers are NULL unless this device is open (users > 0) */ +- struct mutex buf_lock; + unsigned users; + u8 *tx_buffer; + u8 *rx_buffer; +@@ -102,24 +101,6 @@ spidev_sync_unlocked(struct spi_device *spi, struct spi_message *message) + return status; + } + +-static ssize_t +-spidev_sync(struct spidev_data *spidev, struct spi_message *message) +-{ +- ssize_t status; +- struct spi_device *spi; +- +- mutex_lock(&spidev->spi_lock); +- spi = spidev->spi; +- +- if (spi == NULL) +- status = -ESHUTDOWN; +- else +- status = spidev_sync_unlocked(spi, message); +- +- mutex_unlock(&spidev->spi_lock); +- return status; +-} +- + static inline ssize_t + spidev_sync_write(struct spidev_data *spidev, size_t len) + { +@@ -132,7 +113,8 @@ spidev_sync_write(struct spidev_data *spidev, size_t len) + + spi_message_init(&m); + spi_message_add_tail(&t, &m); +- return spidev_sync(spidev, &m); ++ ++ return spidev_sync_unlocked(spidev->spi, &m); + } + + static inline ssize_t +@@ -147,7 +129,8 @@ spidev_sync_read(struct spidev_data *spidev, size_t len) + + spi_message_init(&m); + spi_message_add_tail(&t, &m); +- return spidev_sync(spidev, &m); ++ ++ return spidev_sync_unlocked(spidev->spi, &m); + } + + /*-------------------------------------------------------------------------*/ +@@ -157,7 +140,7 @@ static ssize_t + spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos) + { + struct spidev_data *spidev; +- ssize_t status; ++ ssize_t status = -ESHUTDOWN; + + /* chipselect only toggles at start or end of operation */ + if (count > bufsiz) +@@ -165,7 +148,11 @@ spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos) + + spidev = filp->private_data; + +- mutex_lock(&spidev->buf_lock); ++ mutex_lock(&spidev->spi_lock); ++ ++ if (spidev->spi == NULL) ++ goto err_spi_removed; ++ + status = spidev_sync_read(spidev, count); + if (status > 0) { + unsigned long missing; +@@ -176,7 +163,9 @@ spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos) + else + status = status - missing; + } +- mutex_unlock(&spidev->buf_lock); ++ ++err_spi_removed: ++ mutex_unlock(&spidev->spi_lock); + + return status; + } +@@ -187,7 +176,7 @@ spidev_write(struct file *filp, const char __user *buf, + size_t count, loff_t *f_pos) + { + struct spidev_data *spidev; +- ssize_t status; ++ ssize_t status = -ESHUTDOWN; + unsigned long missing; + + /* chipselect only toggles at start or end of operation */ +@@ -196,13 +185,19 @@ spidev_write(struct file *filp, const char __user *buf, + + spidev = filp->private_data; + +- mutex_lock(&spidev->buf_lock); ++ mutex_lock(&spidev->spi_lock); ++ ++ if (spidev->spi == NULL) ++ goto err_spi_removed; ++ + missing = copy_from_user(spidev->tx_buffer, buf, count); + if (missing == 0) + status = spidev_sync_write(spidev, count); + else + status = -EFAULT; +- mutex_unlock(&spidev->buf_lock); ++ ++err_spi_removed: ++ mutex_unlock(&spidev->spi_lock); + + return status; + } +@@ -379,14 +374,6 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) + + ctlr = spi->controller; + +- /* use the buffer lock here for triple duty: +- * - prevent I/O (from us) so calling spi_setup() is safe; +- * - prevent concurrent SPI_IOC_WR_* from morphing +- * data fields while SPI_IOC_RD_* reads them; +- * - SPI_IOC_MESSAGE needs the buffer locked "normally". +- */ +- mutex_lock(&spidev->buf_lock); +- + switch (cmd) { + /* read requests */ + case SPI_IOC_RD_MODE: +@@ -510,7 +497,6 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) + break; + } + +- mutex_unlock(&spidev->buf_lock); + spi_dev_put(spi); + mutex_unlock(&spidev->spi_lock); + return retval; +@@ -541,9 +527,6 @@ spidev_compat_ioc_message(struct file *filp, unsigned int cmd, + return -ESHUTDOWN; + } + +- /* SPI_IOC_MESSAGE needs the buffer locked "normally" */ +- mutex_lock(&spidev->buf_lock); +- + /* Check message and copy into scratch area */ + ioc = spidev_get_ioc_message(cmd, u_ioc, &n_ioc); + if (IS_ERR(ioc)) { +@@ -564,7 +547,6 @@ spidev_compat_ioc_message(struct file *filp, unsigned int cmd, + kfree(ioc); + + done: +- mutex_unlock(&spidev->buf_lock); + spi_dev_put(spi); + mutex_unlock(&spidev->spi_lock); + return retval; +@@ -790,7 +772,6 @@ static int spidev_probe(struct spi_device *spi) + /* Initialize the driver data */ + spidev->spi = spi; + mutex_init(&spidev->spi_lock); +- mutex_init(&spidev->buf_lock); + + INIT_LIST_HEAD(&spidev->device_entry); + +-- +2.51.0 + diff --git a/queue-6.12/spi-stm32-fix-overrun-issue-at-8bpw.patch b/queue-6.12/spi-stm32-fix-overrun-issue-at-8bpw.patch new file mode 100644 index 00000000000..f4309026eb8 --- /dev/null +++ b/queue-6.12/spi-stm32-fix-overrun-issue-at-8bpw.patch @@ -0,0 +1,53 @@ +From 9673d543976e2ddaaf98cdcc555125ed7022ae2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Dec 2025 11:48:28 +0100 +Subject: spi: stm32: fix Overrun issue at < 8bpw + +From: Deepak Kumar + +[ Upstream commit 1ac3be217c01d5df55ec5052f81e4f1708f46552 ] + +When SPI communication is suspended by hardware automatically, it could +happen that few bits of next frame are already clocked out due to +internal synchronization delay. + +To achieve a safe suspension, we need to ensure that each word must be +at least 8 SPI clock cycles long. That's why, if bpw is less than 8 +bits, we need to use midi to reach 8 SPI clock cycles at least. + +This will ensure that each word achieve safe suspension and prevent +overrun condition. + +Signed-off-by: Deepak Kumar +Signed-off-by: Alain Volmat +Link: https://patch.msgid.link/20251218-stm32-spi-enhancements-v2-2-3b69901ca9fe@foss.st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index 3b1b810f33bf7..e749ce27267fd 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -1711,11 +1711,12 @@ static void stm32h7_spi_data_idleness(struct stm32_spi *spi, u32 len) + cfg2_clrb |= STM32H7_SPI_CFG2_MIDI; + if ((len > 1) && (spi->cur_midi > 0)) { + u32 sck_period_ns = DIV_ROUND_UP(NSEC_PER_SEC, spi->cur_speed); +- u32 midi = min_t(u32, +- DIV_ROUND_UP(spi->cur_midi, sck_period_ns), +- FIELD_GET(STM32H7_SPI_CFG2_MIDI, +- STM32H7_SPI_CFG2_MIDI)); ++ u32 midi = DIV_ROUND_UP(spi->cur_midi, sck_period_ns); + ++ if ((spi->cur_bpw + midi) < 8) ++ midi = 8 - spi->cur_bpw; ++ ++ midi = min_t(u32, midi, FIELD_MAX(STM32H7_SPI_CFG2_MIDI)); + + dev_dbg(spi->dev, "period=%dns, midi=%d(=%dns)\n", + sck_period_ns, midi, midi * sck_period_ns); +-- +2.51.0 + diff --git a/queue-6.12/staging-rtl8723bs-fix-memory-leak-on-failure-path.patch b/queue-6.12/staging-rtl8723bs-fix-memory-leak-on-failure-path.patch new file mode 100644 index 00000000000..fab5e6c0865 --- /dev/null +++ b/queue-6.12/staging-rtl8723bs-fix-memory-leak-on-failure-path.patch @@ -0,0 +1,42 @@ +From ffc3243f38a4153a9fb3696f297f4493ad473e29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 14:47:12 +0530 +Subject: staging: rtl8723bs: fix memory leak on failure path + +From: Diksha Kumari + +[ Upstream commit abe850d82c8cb72d28700673678724e779b1826e ] + +cfg80211_inform_bss_frame() may return NULL on failure. In that case, +the allocated buffer 'buf' is not freed and the function returns early, +leading to potential memory leak. +Fix this by ensuring that 'buf' is freed on both success and failure paths. + +Signed-off-by: Diksha Kumari +Reviewed-by: Mukesh Kumar Chaurasiya +Link: https://patch.msgid.link/20260113091712.7071-1-dikshakdevgan@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +index b63a74e669bcf..b300d52e241b5 100644 +--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c ++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +@@ -315,9 +315,10 @@ struct cfg80211_bss *rtw_cfg80211_inform_bss(struct adapter *padapter, struct wl + len, notify_signal, GFP_ATOMIC); + + if (unlikely(!bss)) +- goto exit; ++ goto free_buf; + + cfg80211_put_bss(wiphy, bss); ++free_buf: + kfree(buf); + + exit: +-- +2.51.0 + diff --git a/queue-6.12/staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch b/queue-6.12/staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch new file mode 100644 index 00000000000..9dfa0939354 --- /dev/null +++ b/queue-6.12/staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch @@ -0,0 +1,44 @@ +From 04bd2ff13f4db2b78e320189ee8fe441f8a08f04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 17:27:28 +0800 +Subject: staging: rtl8723bs: fix missing status update on sdio_alloc_irq() + failure + +From: Liang Jie + +[ Upstream commit 618b4aec12faabc7579a6b0df046842d798a4c7c ] + +The return value of sdio_alloc_irq() was not stored in status. +If sdio_alloc_irq() fails after rtw_drv_register_netdev() succeeds, +status remains _SUCCESS and the error path skips resource cleanup, +while rtw_drv_init() still returns success. + +Store the return value of sdio_alloc_irq() in status and reuse the +existing error handling which relies on status. + +Reviewed-by: fanggeng +Signed-off-by: Liang Jie +Link: https://patch.msgid.link/20251208092730.262499-1-buaajxlj@163.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c +index d18fde4e5d6ce..d64998be6b2bb 100644 +--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c ++++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c +@@ -379,7 +379,8 @@ static int rtw_drv_init( + if (status != _SUCCESS) + goto free_if1; + +- if (sdio_alloc_irq(dvobj) != _SUCCESS) ++ status = sdio_alloc_irq(dvobj); ++ if (status != _SUCCESS) + goto free_if1; + + rtw_ndev_notifier_register(); +-- +2.51.0 + diff --git a/queue-6.12/statmount-permission-check-should-return-eperm.patch b/queue-6.12/statmount-permission-check-should-return-eperm.patch new file mode 100644 index 00000000000..d5c4cae1bab --- /dev/null +++ b/queue-6.12/statmount-permission-check-should-return-eperm.patch @@ -0,0 +1,38 @@ +From 43879afc7a5671cb9d2813a36f3a7a93eb77fa13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Nov 2025 14:41:20 +0530 +Subject: statmount: permission check should return EPERM + +From: Bhavik Sachdev + +[ Upstream commit fccbe38a5d06dbe44bcd89196fe1d2c2272a1f4a ] + +Currently, statmount() returns ENOENT when caller is not CAP_SYS_ADMIN +in the user namespace owner of target mount namespace. This should be +EPERM instead. + +Suggested-by: Miklos Szeredi +Signed-off-by: Bhavik Sachdev +Link: https://patch.msgid.link/20251129091455.757724-2-b.sachdev1904@gmail.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/namespace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/namespace.c b/fs/namespace.c +index c3702f3303a89..3869d2b32ac21 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -5395,7 +5395,7 @@ SYSCALL_DEFINE4(statmount, const struct mnt_id_req __user *, req, + + if (kreq.mnt_ns_id && (ns != current->nsproxy->mnt_ns) && + !ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN)) +- return -ENOENT; ++ return -EPERM; + + ks = kmalloc(sizeof(*ks), GFP_KERNEL_ACCOUNT); + if (!ks) +-- +2.51.0 + diff --git a/queue-6.12/thermal-int340x-fix-sysfs-group-leak-on-dlvr-registr.patch b/queue-6.12/thermal-int340x-fix-sysfs-group-leak-on-dlvr-registr.patch new file mode 100644 index 00000000000..20525038a21 --- /dev/null +++ b/queue-6.12/thermal-int340x-fix-sysfs-group-leak-on-dlvr-registr.patch @@ -0,0 +1,45 @@ +From ce059c919f12367faa9aee712b03759ea348d409 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Feb 2026 08:23:15 +0000 +Subject: thermal: int340x: Fix sysfs group leak on DLVR registration failure + +From: Kaushlendra Kumar + +[ Upstream commit 15176b818e048ccf6ef4b96db34eda7b7e98938a ] + +When DLVR sysfs group creation fails in proc_thermal_rfim_add(), +the function returns immediately without cleaning up the FIVR group +that may have been created earlier. + +Add proper error unwinding to remove the FIVR group before returning +failure. + +Signed-off-by: Kaushlendra Kumar +Acked-by: Srinivas Pandruvada +Link: https://patch.msgid.link/LV3PR11MB876881B77D32A2854AD2908EF563A@LV3PR11MB8768.namprd11.prod.outlook.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + .../thermal/intel/int340x_thermal/processor_thermal_rfim.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c +index 0e2dc1426282d..c9c7451c34d7e 100644 +--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c ++++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c +@@ -449,8 +449,11 @@ int proc_thermal_rfim_add(struct pci_dev *pdev, struct proc_thermal_device *proc + + if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_DLVR) { + ret = sysfs_create_group(&pdev->dev.kobj, &dlvr_attribute_group); +- if (ret) ++ if (ret) { ++ if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_FIVR) ++ sysfs_remove_group(&pdev->dev.kobj, &fivr_attribute_group); + return ret; ++ } + } + + if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_DVFS) { +-- +2.51.0 + diff --git a/queue-6.12/tools-power-cpupower-reset-errno-before-strtoull.patch b/queue-6.12/tools-power-cpupower-reset-errno-before-strtoull.patch new file mode 100644 index 00000000000..2428c80c99b --- /dev/null +++ b/queue-6.12/tools-power-cpupower-reset-errno-before-strtoull.patch @@ -0,0 +1,37 @@ +From 865f8415697e4e3f29de81e0078de1a87a362a78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 17:47:45 +0530 +Subject: tools/power cpupower: Reset errno before strtoull() + +From: Kaushlendra Kumar + +[ Upstream commit f9bd3762cf1bd0c2465f2e6121b340883471d1bf ] + +cpuidle_state_get_one_value() never cleared errno before calling +strtoull(), so a prior ERANGE caused every cpuidle counter read to +return zero. Reset errno to 0 before the conversion so each sysfs read +is evaluated independently. + +Link: https://lore.kernel.org/r/20251201121745.3776703-1-kaushlendra.kumar@intel.com +Signed-off-by: Kaushlendra Kumar +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/power/cpupower/lib/cpuidle.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c +index f2c1139adf716..bd857ee7541a7 100644 +--- a/tools/power/cpupower/lib/cpuidle.c ++++ b/tools/power/cpupower/lib/cpuidle.c +@@ -150,6 +150,7 @@ unsigned long long cpuidle_state_get_one_value(unsigned int cpu, + if (len == 0) + return 0; + ++ errno = 0; + value = strtoull(linebuf, &endp, 0); + + if (endp == linebuf || errno == ERANGE) +-- +2.51.0 + diff --git a/queue-6.12/tracing-fix-false-sharing-in-hwlat-get_sample.patch b/queue-6.12/tracing-fix-false-sharing-in-hwlat-get_sample.patch new file mode 100644 index 00000000000..6739030e6a5 --- /dev/null +++ b/queue-6.12/tracing-fix-false-sharing-in-hwlat-get_sample.patch @@ -0,0 +1,113 @@ +From d744d89fe77a04619b28047edc533ef2af9665dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 23:48:10 -0800 +Subject: tracing: Fix false sharing in hwlat get_sample() + +From: Colin Lord + +[ Upstream commit f743435f988cb0cf1f521035aee857851b25e06d ] + +The get_sample() function in the hwlat tracer assumes the caller holds +hwlat_data.lock, but this is not actually happening. The result is +unprotected data access to hwlat_data, and in per-cpu mode can result in +false sharing which may show up as false positive latency events. + +The specific case of false sharing observed was primarily between +hwlat_data.sample_width and hwlat_data.count. These are separated by +just 8B and are therefore likely to share a cache line. When one thread +modifies count, the cache line is in a modified state so when other +threads read sample_width in the main latency detection loop, they fetch +the modified cache line. On some systems, the fetch itself may be slow +enough to count as a latency event, which could set up a self +reinforcing cycle of latency events as each event increments count which +then causes more latency events, continuing the cycle. + +The other result of the unprotected data access is that hwlat_data.count +can end up with duplicate or missed values, which was observed on some +systems in testing. + +Convert hwlat_data.count to atomic64_t so it can be safely modified +without locking, and prevent false sharing by pulling sample_width into +a local variable. + +One system this was tested on was a dual socket server with 32 CPUs on +each numa node. With settings of 1us threshold, 1000us width, and +2000us window, this change reduced the number of latency events from +500 per second down to approximately 1 event per minute. Some machines +tested did not exhibit measurable latency from the false sharing. + +Cc: Masami Hiramatsu +Cc: Mathieu Desnoyers +Link: https://patch.msgid.link/20260210074810.6328-1-clord@mykolab.com +Signed-off-by: Colin Lord +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_hwlat.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c +index 3bd6071441ade..bc437b6ce8969 100644 +--- a/kernel/trace/trace_hwlat.c ++++ b/kernel/trace/trace_hwlat.c +@@ -102,9 +102,9 @@ struct hwlat_sample { + /* keep the global state somewhere. */ + static struct hwlat_data { + +- struct mutex lock; /* protect changes */ ++ struct mutex lock; /* protect changes */ + +- u64 count; /* total since reset */ ++ atomic64_t count; /* total since reset */ + + u64 sample_window; /* total sampling window (on+off) */ + u64 sample_width; /* active sampling portion of window */ +@@ -195,8 +195,7 @@ void trace_hwlat_callback(bool enter) + * get_sample - sample the CPU TSC and look for likely hardware latencies + * + * Used to repeatedly capture the CPU TSC (or similar), looking for potential +- * hardware-induced latency. Called with interrupts disabled and with +- * hwlat_data.lock held. ++ * hardware-induced latency. Called with interrupts disabled. + */ + static int get_sample(void) + { +@@ -206,6 +205,7 @@ static int get_sample(void) + time_type start, t1, t2, last_t2; + s64 diff, outer_diff, total, last_total = 0; + u64 sample = 0; ++ u64 sample_width = READ_ONCE(hwlat_data.sample_width); + u64 thresh = tracing_thresh; + u64 outer_sample = 0; + int ret = -1; +@@ -269,7 +269,7 @@ static int get_sample(void) + if (diff > sample) + sample = diff; /* only want highest value */ + +- } while (total <= hwlat_data.sample_width); ++ } while (total <= sample_width); + + barrier(); /* finish the above in the view for NMIs */ + trace_hwlat_callback_enabled = false; +@@ -287,8 +287,7 @@ static int get_sample(void) + if (kdata->nmi_total_ts) + do_div(kdata->nmi_total_ts, NSEC_PER_USEC); + +- hwlat_data.count++; +- s.seqnum = hwlat_data.count; ++ s.seqnum = atomic64_inc_return(&hwlat_data.count); + s.duration = sample; + s.outer_duration = outer_sample; + s.nmi_total_ts = kdata->nmi_total_ts; +@@ -837,7 +836,7 @@ static int hwlat_tracer_init(struct trace_array *tr) + + hwlat_trace = tr; + +- hwlat_data.count = 0; ++ atomic64_set(&hwlat_data.count, 0); + tr->max_latency = 0; + save_tracing_thresh = tracing_thresh; + +-- +2.51.0 + diff --git a/queue-6.12/usb-chipidea-udc-fix-dma-and-sg-cleanup-in-_ep_nuke.patch b/queue-6.12/usb-chipidea-udc-fix-dma-and-sg-cleanup-in-_ep_nuke.patch new file mode 100644 index 00000000000..6708c14109a --- /dev/null +++ b/queue-6.12/usb-chipidea-udc-fix-dma-and-sg-cleanup-in-_ep_nuke.patch @@ -0,0 +1,72 @@ +From ef70b9b66f97304874b8921952a3ab79f1df5949 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 16:59:02 +0000 +Subject: usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() + +From: Mario Peter + +[ Upstream commit cea2a1257a3b5ea3e769a445b34af13e6aa5a123 ] + +The ChipIdea UDC driver can encounter "not page aligned sg buffer" +errors when a USB device is reconnected after being disconnected +during an active transfer. This occurs because _ep_nuke() returns +requests to the gadget layer without properly unmapping DMA buffers +or cleaning up scatter-gather bounce buffers. + +Root cause: +When a disconnect happens during a multi-segment DMA transfer, the +request's num_mapped_sgs field and sgt.sgl pointer remain set with +stale values. The request is returned to the gadget driver with status +-ESHUTDOWN but still has active DMA state. If the gadget driver reuses +this request on reconnect without reinitializing it, the stale DMA +state causes _hardware_enqueue() to skip DMA mapping (seeing non-zero +num_mapped_sgs) and attempt to use freed/invalid DMA addresses, +leading to alignment errors and potential memory corruption. + +The normal completion path via _hardware_dequeue() properly calls +usb_gadget_unmap_request_by_dev() and sglist_do_debounce() before +returning the request. The _ep_nuke() path must do the same cleanup +to ensure requests are returned in a clean, reusable state. + +Fix: +Add DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror +the cleanup sequence in _hardware_dequeue(): +- Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set +- Call sglist_do_debounce() with copy=false if bounce buffer exists + +This ensures that when requests are returned due to endpoint shutdown, +they don't retain stale DMA mappings. The 'false' parameter to +sglist_do_debounce() prevents copying data back (appropriate for +shutdown path where transfer was aborted). + +Signed-off-by: Mario Peter +Reviewed-by: Xu Yang +Acked-by: Peter Chen +Link: https://patch.msgid.link/20260108165902.795354-1-mario.peter@leica-geosystems.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/chipidea/udc.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c +index 8f73bd5057a64..5f28aac85d7d4 100644 +--- a/drivers/usb/chipidea/udc.c ++++ b/drivers/usb/chipidea/udc.c +@@ -919,6 +919,13 @@ __acquires(hwep->lock) + list_del_init(&hwreq->queue); + hwreq->req.status = -ESHUTDOWN; + ++ /* Unmap DMA and clean up bounce buffers before giving back */ ++ usb_gadget_unmap_request_by_dev(hwep->ci->dev->parent, ++ &hwreq->req, hwep->dir); ++ ++ if (hwreq->sgt.sgl) ++ sglist_do_debounce(hwreq, false); ++ + if (hwreq->req.complete != NULL) { + spin_unlock(hwep->lock); + usb_gadget_giveback_request(&hwep->ep, &hwreq->req); +-- +2.51.0 + diff --git a/queue-6.12/usb-gadget-f_fs-fix-dma-buf-out-queues.patch b/queue-6.12/usb-gadget-f_fs-fix-dma-buf-out-queues.patch new file mode 100644 index 00000000000..904bf4572e0 --- /dev/null +++ b/queue-6.12/usb-gadget-f_fs-fix-dma-buf-out-queues.patch @@ -0,0 +1,66 @@ +From 0a8da52b5cb348e809b0115b7de8f4111268cccb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 08:30:21 +1000 +Subject: usb: gadget: f_fs: fix DMA-BUF OUT queues + +From: Sam Day + +[ Upstream commit 0145e7acd29855dfba4a2f387d455b5d9a520f0e ] + +Currently, DMA_FROM_DEVICE is used when attaching DMABUFs to IN +endpoints and DMA_TO_DEVICE for OUT endpoints. This is inverted from +how it should be. + +The result is IOMMU read-only mappings placed on OUT queues, +triggering arm-smmu write faults. + +Put differently, OUT endpoints flow data from host -> gadget, meaning +the UDC peripheral needs to have write access to the buffer to fill it +with the incoming data. + +This commit flips the directions and updates the implicit-sync helpers +so IN endpoints act as readers and OUT endpoints as writers. + +Signed-off-by: Sam Day +Tested-by: David Heidelberg # OnePlus 6T on sdm845-next-20251119 +Link: https://patch.msgid.link/20260108-ffs-dmabuf-ioctl-fix-v1-2-e51633891a81@samcday.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_fs.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index f7be1548cc18a..738c10d83d272 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1499,7 +1499,7 @@ static int ffs_dmabuf_attach(struct file *file, int fd) + goto err_dmabuf_detach; + } + +- dir = epfile->in ? DMA_FROM_DEVICE : DMA_TO_DEVICE; ++ dir = epfile->in ? DMA_TO_DEVICE : DMA_FROM_DEVICE; + + err = ffs_dma_resv_lock(dmabuf, nonblock); + if (err) +@@ -1629,7 +1629,7 @@ static int ffs_dmabuf_transfer(struct file *file, + /* Make sure we don't have writers */ + timeout = nonblock ? 0 : msecs_to_jiffies(DMABUF_ENQUEUE_TIMEOUT_MS); + retl = dma_resv_wait_timeout(dmabuf->resv, +- dma_resv_usage_rw(epfile->in), ++ dma_resv_usage_rw(!epfile->in), + true, timeout); + if (retl == 0) + retl = -EBUSY; +@@ -1674,7 +1674,7 @@ static int ffs_dmabuf_transfer(struct file *file, + dma_fence_init(&fence->base, &ffs_dmabuf_fence_ops, + &priv->lock, priv->context, seqno); + +- resv_dir = epfile->in ? DMA_RESV_USAGE_WRITE : DMA_RESV_USAGE_READ; ++ resv_dir = epfile->in ? DMA_RESV_USAGE_READ : DMA_RESV_USAGE_WRITE; + + dma_resv_add_fence(dmabuf->resv, &fence->base, resv_dir); + dma_resv_unlock(dmabuf->resv); +-- +2.51.0 + diff --git a/queue-6.12/usb-gadget-f_fs-fix-ioctl-error-handling.patch b/queue-6.12/usb-gadget-f_fs-fix-ioctl-error-handling.patch new file mode 100644 index 00000000000..4bae91e32ea --- /dev/null +++ b/queue-6.12/usb-gadget-f_fs-fix-ioctl-error-handling.patch @@ -0,0 +1,77 @@ +From 1b7f5656332d9f4d15f6c0e4a3decd95e5c3ac73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 08:30:20 +1000 +Subject: usb: gadget: f_fs: Fix ioctl error handling + +From: Sam Day + +[ Upstream commit 8e4c1d06183c25022f6b0002a5cab84979ca6337 ] + +When ffs_epfile_ioctl handles FUNCTIONFS_DMABUF_* ioctls, it's currently +falling through when copy_from_user fails. + +However, this fallthrough isn't being checked properly, so the handler +continues executing further than it should. It then tries the secondary +dispatch where it ultimately gives up and returns -ENOTTY. + +The end result is invalid ioctl invocations will yield a -ENOTTY rather +than an -EFAULT. + +It's a common pattern elsewhere in the kernel code to directly return +-EFAULT when copy_from_user fails. So we update ffs_epfile_ioctl to do +the same and fix this issue. + +Signed-off-by: Sam Day +Link: https://patch.msgid.link/20260108-ffs-dmabuf-ioctl-fix-v1-1-e51633891a81@samcday.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_fs.c | 18 ++++++------------ + 1 file changed, 6 insertions(+), 12 deletions(-) + +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 738c10d83d272..e03ac64361cc5 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1734,10 +1734,8 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code, + { + int fd; + +- if (copy_from_user(&fd, (void __user *)value, sizeof(fd))) { +- ret = -EFAULT; +- break; +- } ++ if (copy_from_user(&fd, (void __user *)value, sizeof(fd))) ++ return -EFAULT; + + return ffs_dmabuf_attach(file, fd); + } +@@ -1745,10 +1743,8 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code, + { + int fd; + +- if (copy_from_user(&fd, (void __user *)value, sizeof(fd))) { +- ret = -EFAULT; +- break; +- } ++ if (copy_from_user(&fd, (void __user *)value, sizeof(fd))) ++ return -EFAULT; + + return ffs_dmabuf_detach(file, fd); + } +@@ -1756,10 +1752,8 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code, + { + struct usb_ffs_dmabuf_transfer_req req; + +- if (copy_from_user(&req, (void __user *)value, sizeof(req))) { +- ret = -EFAULT; +- break; +- } ++ if (copy_from_user(&req, (void __user *)value, sizeof(req))) ++ return -EFAULT; + + return ffs_dmabuf_transfer(file, &req); + } +-- +2.51.0 + diff --git a/queue-6.12/usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch b/queue-6.12/usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch new file mode 100644 index 00000000000..08b0cadc402 --- /dev/null +++ b/queue-6.12/usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch @@ -0,0 +1,122 @@ +From da033eeefe0b483d992aa7899491f8709912151a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 17:48:48 +0000 +Subject: usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs + +From: Benson Leung + +[ Upstream commit 6811e0a08bdce6b2767414caf17fda24c2e4e032 ] + +ucsi_psy_get_voltage_max and ucsi_psy_get_current_max are calculated +using whichever pdo is in the last position of the src_pdos array, presuming +it to be a fixed pdo, so the pdo_fixed_voltage or pdo_max_current +helpers are used on that last pdo. + +However, non-Fixed PDOs such as Battery PDOs, Augmented PDOs (used for AVS and +for PPS) may exist, and are always at the end of the array if they do. +In the event one of these more advanced chargers are attached the helpers for +fixed return mangled values. + +Here's an example case of a Google Pixel Flex Dual Port 67W USB-C Fast Charger +with PPS support: +POWER_SUPPLY_NAME=ucsi-source-psy-cros_ec_ucsi.4.auto2 +POWER_SUPPLY_TYPE=USB +POWER_SUPPLY_CHARGE_TYPE=Standard +POWER_SUPPLY_USB_TYPE=C [PD] PD_PPS PD_DRP +POWER_SUPPLY_ONLINE=1 +POWER_SUPPLY_VOLTAGE_MIN=5000000 +POWER_SUPPLY_VOLTAGE_MAX=13400000 +POWER_SUPPLY_VOLTAGE_NOW=20000000 +POWER_SUPPLY_CURRENT_MAX=5790000 +POWER_SUPPLY_CURRENT_NOW=3250000 + +Voltage Max is reading as 13.4V, but that's an incorrect decode of the PPS +APDO in the last position. Same goes for CURRENT_MAX. 5.79A is incorrect. + +Instead, enumerate through the src_pdos and filter just for Fixed PDOs for +now, and find the one with the highest voltage and current respectively. + +After, from the same charger: +POWER_SUPPLY_NAME=ucsi-source-psy-cros_ec_ucsi.4.auto2 +POWER_SUPPLY_TYPE=USB +POWER_SUPPLY_CHARGE_TYPE=Standard +POWER_SUPPLY_USB_TYPE=C [PD] PD_PPS PD_DRP +POWER_SUPPLY_ONLINE=1 +POWER_SUPPLY_VOLTAGE_MIN=5000000 +POWER_SUPPLY_VOLTAGE_MAX=20000000 +POWER_SUPPLY_VOLTAGE_NOW=20000000 +POWER_SUPPLY_CURRENT_MAX=4000000 +POWER_SUPPLY_CURRENT_NOW=3250000 + +Signed-off-by: Benson Leung +Reviewed-by: Heikki Krogerus +Link: https://patch.msgid.link/20251208174918.289394-3-bleung@chromium.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/ucsi/psy.c | 30 ++++++++++++++++++++---------- + 1 file changed, 20 insertions(+), 10 deletions(-) + +diff --git a/drivers/usb/typec/ucsi/psy.c b/drivers/usb/typec/ucsi/psy.c +index 7f176382b1a0f..c7d2fb611be4c 100644 +--- a/drivers/usb/typec/ucsi/psy.c ++++ b/drivers/usb/typec/ucsi/psy.c +@@ -88,15 +88,20 @@ static int ucsi_psy_get_voltage_max(struct ucsi_connector *con, + union power_supply_propval *val) + { + u32 pdo; ++ int max_voltage = 0; + + switch (UCSI_CONSTAT_PWR_OPMODE(con->status.flags)) { + case UCSI_CONSTAT_PWR_OPMODE_PD: +- if (con->num_pdos > 0) { +- pdo = con->src_pdos[con->num_pdos - 1]; +- val->intval = pdo_fixed_voltage(pdo) * 1000; +- } else { +- val->intval = 0; ++ for (int i = 0; i < con->num_pdos; i++) { ++ int pdo_voltage = 0; ++ ++ pdo = con->src_pdos[i]; ++ if (pdo_type(pdo) == PDO_TYPE_FIXED) ++ pdo_voltage = pdo_fixed_voltage(pdo) * 1000; ++ max_voltage = (pdo_voltage > max_voltage) ? pdo_voltage ++ : max_voltage; + } ++ val->intval = max_voltage; + break; + case UCSI_CONSTAT_PWR_OPMODE_TYPEC3_0: + case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5: +@@ -144,6 +149,7 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con, + union power_supply_propval *val) + { + u32 pdo; ++ int max_current = 0; + + if (!(con->status.flags & UCSI_CONSTAT_CONNECTED)) { + val->intval = 0; +@@ -152,12 +158,16 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con, + + switch (UCSI_CONSTAT_PWR_OPMODE(con->status.flags)) { + case UCSI_CONSTAT_PWR_OPMODE_PD: +- if (con->num_pdos > 0) { +- pdo = con->src_pdos[con->num_pdos - 1]; +- val->intval = pdo_max_current(pdo) * 1000; +- } else { +- val->intval = 0; ++ for (int i = 0; i < con->num_pdos; i++) { ++ int pdo_current = 0; ++ ++ pdo = con->src_pdos[i]; ++ if (pdo_type(pdo) == PDO_TYPE_FIXED) ++ pdo_current = pdo_max_current(pdo) * 1000; ++ max_current = (pdo_current > max_current) ? pdo_current ++ : max_current; + } ++ val->intval = max_current; + break; + case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5: + val->intval = UCSI_TYPEC_1_5_CURRENT * 1000; +-- +2.51.0 + diff --git a/queue-6.12/vhost-fix-caching-attributes-of-mmio-regions-by-sett.patch b/queue-6.12/vhost-fix-caching-attributes-of-mmio-regions-by-sett.patch new file mode 100644 index 00000000000..ff0aa1c1d05 --- /dev/null +++ b/queue-6.12/vhost-fix-caching-attributes-of-mmio-regions-by-sett.patch @@ -0,0 +1,42 @@ +From 259dc7b5873f02e72837e75c8f5e65fbf15e9580 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jan 2026 12:27:03 +0530 +Subject: vhost: fix caching attributes of MMIO regions by setting them + explicitly + +From: Kommula Shiva Shankar + +[ Upstream commit 5145b277309f3818e2db507f525d19ac3b910922 ] + +Explicitly set non-cached caching attributes for MMIO regions. +Default write-back mode can cause CPU to cache device memory, +causing invalid reads and unpredictable behavior. + +Invalid read and write issues were observed on ARM64 when mapping the +notification area to userspace via mmap. + +Signed-off-by: Kommula Shiva Shankar +Acked-by: Jason Wang +Reviewed-by: Jason Gunthorpe +Signed-off-by: Michael S. Tsirkin +Message-Id: <20260102065703.656255-1-kshankar@marvell.com> +Signed-off-by: Sasha Levin +--- + drivers/vhost/vdpa.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c +index 5a49b5a6d4964..b8bbf5ef71c0b 100644 +--- a/drivers/vhost/vdpa.c ++++ b/drivers/vhost/vdpa.c +@@ -1527,6 +1527,7 @@ static int vhost_vdpa_mmap(struct file *file, struct vm_area_struct *vma) + if (vma->vm_end - vma->vm_start != notify.size) + return -ENOTSUPP; + ++ vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); + vm_flags_set(vma, VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP); + vma->vm_ops = &vhost_vdpa_vm_ops; + return 0; +-- +2.51.0 + diff --git a/queue-6.12/virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch b/queue-6.12/virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch new file mode 100644 index 00000000000..36471168c2b --- /dev/null +++ b/queue-6.12/virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch @@ -0,0 +1,75 @@ +From 4fcf9b2b0215633c485e03d28ea2c6b6c0c6c3a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 08:35:45 +0100 +Subject: virt: vbox: uapi: Mark inner unions in packed structs as packed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit c25d01e1c4f2d43f47af87c00e223f5ca7c71792 ] + +The unpacked unions within a packed struct generates alignment warnings +on clang for 32-bit ARM: + +./usr/include/linux/vbox_vmmdev_types.h:239:4: error: field u within 'struct vmmdev_hgcm_function_parameter32' + is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:223:2)' + and is usually due to 'struct vmmdev_hgcm_function_parameter32' being packed, + which can lead to unaligned accesses [-Werror,-Wunaligned-access] + 239 | } u; + | ^ + +./usr/include/linux/vbox_vmmdev_types.h:254:6: error: field u within + 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)' + is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:251:4)' and is usually due to + 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)' + being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] + +With the recent changes to compile-test the UAPI headers in more cases, +these warning in combination with CONFIG_WERROR breaks the build. + +Fix the warnings. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/ +Reported-by: Nathan Chancellor +Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/ +Suggested-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/ +Signed-off-by: Thomas Weißschuh +Tested-by: Nicolas Schier +Reviewed-by: Nicolas Schier +Acked-by: Greg Kroah-Hartman +Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-2-076aed1623ff@linutronix.de +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + include/uapi/linux/vbox_vmmdev_types.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/uapi/linux/vbox_vmmdev_types.h b/include/uapi/linux/vbox_vmmdev_types.h +index 6073858d52a2e..11f3627c3729b 100644 +--- a/include/uapi/linux/vbox_vmmdev_types.h ++++ b/include/uapi/linux/vbox_vmmdev_types.h +@@ -236,7 +236,7 @@ struct vmmdev_hgcm_function_parameter32 { + /** Relative to the request header. */ + __u32 offset; + } page_list; +- } u; ++ } __packed u; + } __packed; + VMMDEV_ASSERT_SIZE(vmmdev_hgcm_function_parameter32, 4 + 8); + +@@ -251,7 +251,7 @@ struct vmmdev_hgcm_function_parameter64 { + union { + __u64 phys_addr; + __u64 linear_addr; +- } u; ++ } __packed u; + } __packed pointer; + struct { + /** Size of the buffer described by the page list. */ +-- +2.51.0 + diff --git a/queue-6.12/vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch b/queue-6.12/vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch new file mode 100644 index 00000000000..15794725139 --- /dev/null +++ b/queue-6.12/vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch @@ -0,0 +1,62 @@ +From b1c97d608ca9376548763242d0731da8c749628c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 17:34:00 +0100 +Subject: vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 + +From: Arnd Bergmann + +[ Upstream commit e25dbf561e03c0c5e36228e3b8b784392819ce85 ] + +The gcc-16.0.1 snapshot produces a false-positive warning that turns +into a build failure with CONFIG_WERROR: + +In file included from arch/x86/include/asm/string.h:6, + from net/vmw_vsock/vmci_transport.c:10: +In function 'vmci_transport_packet_init', + inlined from '__vmci_transport_send_control_pkt.constprop' at net/vmw_vsock/vmci_transport.c:198:2: +arch/x86/include/asm/string_32.h:150:25: error: argument 2 null where non-null expected because argument 3 is nonzero [-Werror=nonnull] + 150 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n) + | ^~~~~~~~~~~~~~~~~~~~~~~~~ +net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy' + 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait)); + | ^~~~~~ +arch/x86/include/asm/string_32.h:150:25: note: in a call to built-in function '__builtin_memcpy' +net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy' + 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait)); + | ^~~~~~ + +This seems relatively harmless, and it so far the only instance of this +warning I have found. The __vmci_transport_send_control_pkt function +is called either with wait=NULL or with one of the type values that +pass 'wait' into memcpy() here, but not from the same caller. + +Replacing the memcpy with a struct assignment is otherwise the same +but avoids the warning. + +Signed-off-by: Arnd Bergmann +Reviewed-by: Bobby Eshleman +Reviewed-by: Stefano Garzarella +Reviewed-by: Bryan Tan +Link: https://patch.msgid.link/20260203163406.2636463-1-arnd@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/vmw_vsock/vmci_transport.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c +index 7eccd6708d664..aca3132689cf1 100644 +--- a/net/vmw_vsock/vmci_transport.c ++++ b/net/vmw_vsock/vmci_transport.c +@@ -161,7 +161,7 @@ vmci_transport_packet_init(struct vmci_transport_packet *pkt, + + case VMCI_TRANSPORT_PACKET_TYPE_WAITING_READ: + case VMCI_TRANSPORT_PACKET_TYPE_WAITING_WRITE: +- memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait)); ++ pkt->u.wait = *wait; + break; + + case VMCI_TRANSPORT_PACKET_TYPE_REQUEST2: +-- +2.51.0 + diff --git a/queue-6.12/watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch b/queue-6.12/watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch new file mode 100644 index 00000000000..b58a2bcbe13 --- /dev/null +++ b/queue-6.12/watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch @@ -0,0 +1,40 @@ +From 646eb8ff40c2a838b38e3ebece1fbc98cf3e0bb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Nov 2025 22:24:33 +0200 +Subject: watchdog: imx7ulp_wdt: handle the nowayout option + +From: Oleksandr Suvorov + +[ Upstream commit d303d37ef5cf86c8c3b2daefd2a7d7fd8ca1ec14 ] + +The module parameter `nowayout` indicates whether the watchdog should ever +be allowed to stop, but the driver currently ignores this option. + +Pass the `nowayout` parameter to the watchdog core by setting the +WDOG_NO_WAY_OUT flag accordingly. + +Signed-off-by: Oleksandr Suvorov +Reviewed-by: Guenter Roeck +Reviewed-by: Frank Li +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/imx7ulp_wdt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/watchdog/imx7ulp_wdt.c b/drivers/watchdog/imx7ulp_wdt.c +index 0f13a30533574..03479110453ce 100644 +--- a/drivers/watchdog/imx7ulp_wdt.c ++++ b/drivers/watchdog/imx7ulp_wdt.c +@@ -346,6 +346,7 @@ static int imx7ulp_wdt_probe(struct platform_device *pdev) + watchdog_stop_on_reboot(wdog); + watchdog_stop_on_unregister(wdog); + watchdog_set_drvdata(wdog, imx7ulp_wdt); ++ watchdog_set_nowayout(wdog, nowayout); + + imx7ulp_wdt->hw = of_device_get_match_data(dev); + ret = imx7ulp_wdt_init(imx7ulp_wdt, wdog->timeout * imx7ulp_wdt->hw->wdog_clock_rate); +-- +2.51.0 + diff --git a/queue-6.12/wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch b/queue-6.12/wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch new file mode 100644 index 00000000000..f13f30cfcd1 --- /dev/null +++ b/queue-6.12/wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch @@ -0,0 +1,59 @@ +From ba43d20aa32ef211018daa123fa8da675f7806b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 17:56:11 +0000 +Subject: wifi: ath10k: fix lock protection in + ath10k_wmi_event_peer_sta_ps_state_chg() + +From: Ziyi Guo + +[ Upstream commit 820ba7dd6859ef8b1eaf6014897e7aa4756fc65d ] + +ath10k_wmi_event_peer_sta_ps_state_chg() uses lockdep_assert_held() to +assert that ar->data_lock should be held by the caller, but neither +ath10k_wmi_10_2_op_rx() nor ath10k_wmi_10_4_op_rx() acquire this lock +before calling this function. + +The field arsta->peer_ps_state is documented as protected by +ar->data_lock in core.h, and other accessors (ath10k_peer_ps_state_disable, +ath10k_dbg_sta_read_peer_ps_state) properly acquire this lock. + +Add spin_lock_bh()/spin_unlock_bh() around the peer_ps_state update, +and remove the lockdep_assert_held() to be aligned with new locking, +following the pattern used by other WMI event handlers in the driver. + +Signed-off-by: Ziyi Guo +Reviewed-by: Baochen Qiang +Link: https://patch.msgid.link/20260123175611.767731-1-n7l8m4@u.northwestern.edu +[removed excess blank line] +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/wmi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c +index fef7d9b081963..408f062a4306f 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -5289,8 +5289,6 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb) + struct ath10k_sta *arsta; + u8 peer_addr[ETH_ALEN]; + +- lockdep_assert_held(&ar->data_lock); +- + ev = (struct wmi_peer_sta_ps_state_chg_event *)skb->data; + ether_addr_copy(peer_addr, ev->peer_macaddr.addr); + +@@ -5305,7 +5303,9 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb) + } + + arsta = (struct ath10k_sta *)sta->drv_priv; ++ spin_lock_bh(&ar->data_lock); + arsta->peer_ps_state = __le32_to_cpu(ev->peer_ps_state); ++ spin_unlock_bh(&ar->data_lock); + + exit: + rcu_read_unlock(); +-- +2.51.0 + diff --git a/queue-6.12/wifi-ath11k-add-pm-quirk-for-thinkpad-z13-z16-gen1.patch b/queue-6.12/wifi-ath11k-add-pm-quirk-for-thinkpad-z13-z16-gen1.patch new file mode 100644 index 00000000000..4fd79ad4e14 --- /dev/null +++ b/queue-6.12/wifi-ath11k-add-pm-quirk-for-thinkpad-z13-z16-gen1.patch @@ -0,0 +1,72 @@ +From 079b28f8dd8f6360c7aa180797a0de5fae35fc07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Jan 2026 17:00:34 -0800 +Subject: wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 + +From: Ross Vandegrift + +[ Upstream commit 4015b1972763d7d513172276e51439f37e622a92 ] + +Z16 Gen1 has the wakeup-from-suspend issues from [1] but was never added +to the appropriate quirk list. I've tested this patch on top of 6.18.2, +it fixes the issue for me on 21D4 + +Mark Pearson provided the other product IDs covering the second Z16 Gen1 +and both Z13 Gen1 identifiers. They share the same firmware, and folks +in the bugzilla report do indeed see the problem on Z13. + +[1] - https://bugzilla.kernel.org/show_bug.cgi?id=219196 + +Signed-off-by: Ross Vandegrift +Reviewed-by: Baochen Qiang +Tested-by: Mark Pearson +Reviewed-by: Mark Pearson +Link: https://patch.msgid.link/wj7o2kmb7g54stdjvxp2hjqrnutnq3jbf4s2uh4ctvmlxdq7tf@nbkj2ebakhrd +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/core.c | 28 ++++++++++++++++++++++++++ + 1 file changed, 28 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c +index 735032c353b2d..c6d17dbbdb376 100644 +--- a/drivers/net/wireless/ath/ath11k/core.c ++++ b/drivers/net/wireless/ath/ath11k/core.c +@@ -896,6 +896,34 @@ static const struct dmi_system_id ath11k_pm_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "21F9"), + }, + }, ++ { ++ .driver_data = (void *)ATH11K_PM_WOW, ++ .matches = { /* Z13 G1 */ ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21D2"), ++ }, ++ }, ++ { ++ .driver_data = (void *)ATH11K_PM_WOW, ++ .matches = { /* Z13 G1 */ ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21D3"), ++ }, ++ }, ++ { ++ .driver_data = (void *)ATH11K_PM_WOW, ++ .matches = { /* Z16 G1 */ ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21D4"), ++ }, ++ }, ++ { ++ .driver_data = (void *)ATH11K_PM_WOW, ++ .matches = { /* Z16 G1 */ ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21D5"), ++ }, ++ }, + {} + }; + +-- +2.51.0 + diff --git a/queue-6.12/wifi-ath11k-fix-failure-to-connect-to-a-6-ghz-ap.patch b/queue-6.12/wifi-ath11k-fix-failure-to-connect-to-a-6-ghz-ap.patch new file mode 100644 index 00000000000..23d918889a5 --- /dev/null +++ b/queue-6.12/wifi-ath11k-fix-failure-to-connect-to-a-6-ghz-ap.patch @@ -0,0 +1,61 @@ +From 17c5997c2e0fbda635903ea88ffd4580f4f8a6eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 11:46:07 +0800 +Subject: wifi: ath11k: Fix failure to connect to a 6 GHz AP + +From: Qian Zhang + +[ Upstream commit 0bc8c48de6f06c0cac52dde024ffda4433de6234 ] + +STA fails to connect to a 6 GHz AP with the following errors: + ath11k_pci 0000:01:00.0: failed to handle chan list with power type 1 + wlp1s0: deauthenticating from c8:a3:e8:dd:41:e3 by local choice (Reason: 3=DEAUTH_LEAVING) + +ath11k_reg_handle_chan_list() treats the update as redundant and +returns -EINVAL. That causes the connection attempt to fail. + +Avoid unnecessary validation during association. Apply the regulatory +redundant check only when the power type is IEEE80211_REG_UNSET_AP, +which only occurs during core initialization. + +Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41 + +Signed-off-by: Qian Zhang +Reviewed-by: Baochen Qiang +Link: https://patch.msgid.link/20260108034607.812885-1-qian.zhang@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/reg.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/reg.c b/drivers/net/wireless/ath/ath11k/reg.c +index d62a2014315a0..49b79648752cf 100644 +--- a/drivers/net/wireless/ath/ath11k/reg.c ++++ b/drivers/net/wireless/ath/ath11k/reg.c +@@ -1,7 +1,7 @@ + // SPDX-License-Identifier: BSD-3-Clause-Clear + /* + * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved. +- * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved. ++ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + */ + #include + +@@ -926,8 +926,11 @@ int ath11k_reg_handle_chan_list(struct ath11k_base *ab, + */ + if (ab->default_regd[pdev_idx] && !ab->new_regd[pdev_idx] && + !memcmp((char *)ab->default_regd[pdev_idx]->alpha2, +- (char *)reg_info->alpha2, 2)) +- goto retfail; ++ (char *)reg_info->alpha2, 2) && ++ power_type == IEEE80211_REG_UNSET_AP) { ++ ath11k_reg_reset_info(reg_info); ++ return 0; ++ } + + /* Intersect new rules with default regd if a new country setting was + * requested, i.e a default regd was already set during initialization +-- +2.51.0 + diff --git a/queue-6.12/wifi-ath12k-fix-preferred-hardware-mode-calculation.patch b/queue-6.12/wifi-ath12k-fix-preferred-hardware-mode-calculation.patch new file mode 100644 index 00000000000..d614d5aca70 --- /dev/null +++ b/queue-6.12/wifi-ath12k-fix-preferred-hardware-mode-calculation.patch @@ -0,0 +1,50 @@ +From 6b5b8a9c8098a785b82cd2454704c1b818317cbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 15:36:24 +0800 +Subject: wifi: ath12k: fix preferred hardware mode calculation + +From: Baochen Qiang + +[ Upstream commit 7f852de0003219c431a6f2ffd951fd82a4673660 ] + +For single pdev device like WCN7850/QCC2072, preferred_hw_mode is +initialized to WMI_HOST_HW_MODE_SINGLE. Later when firmware sends +supported modes to host, each mode is compared with the initial one +and if the priority of the new mode is higher, update the parameter +and store mode capability. + +For WCN7850, this does not result in issue, as one of the supported +mode indeed has a higher priority. However the only available mode of +QCC2072 at this stage is WMI_HOST_HW_MODE_SINGLE, which fails the +comparison, hence mode capability is not stored. Subsequently driver +initialization fails. + +Fix it by accepting a mode with the same priority. + +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 + +Signed-off-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-4-fc8ce1e43969@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/wmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c +index 5c5fc2b7642f6..761c169c992f1 100644 +--- a/drivers/net/wireless/ath/ath12k/wmi.c ++++ b/drivers/net/wireless/ath/ath12k/wmi.c +@@ -4047,7 +4047,7 @@ static int ath12k_wmi_hw_mode_caps(struct ath12k_base *soc, + + pref = soc->wmi_ab.preferred_hw_mode; + +- if (ath12k_hw_mode_pri_map[mode] < ath12k_hw_mode_pri_map[pref]) { ++ if (ath12k_hw_mode_pri_map[mode] <= ath12k_hw_mode_pri_map[pref]) { + svc_rdy_ext->pref_hw_mode_caps = *hw_mode_caps; + soc->wmi_ab.preferred_hw_mode = mode; + } +-- +2.51.0 + diff --git a/queue-6.12/wifi-cfg80211-allow-only-one-nan-interface-also-in-m.patch b/queue-6.12/wifi-cfg80211-allow-only-one-nan-interface-also-in-m.patch new file mode 100644 index 00000000000..0646345fd9f --- /dev/null +++ b/queue-6.12/wifi-cfg80211-allow-only-one-nan-interface-also-in-m.patch @@ -0,0 +1,48 @@ +From 8714272a7746379233f25330538f01f6d39d2fe3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 13:51:57 +0200 +Subject: wifi: cfg80211: allow only one NAN interface, also in multi radio + +From: Miri Korenblit + +[ Upstream commit e69fda4d07701373354e52b0321bd40311d743d0 ] + +According to Wi-Fi Aware (TM) 4.0 specification 2.8, A NAN device can +have one NAN management interface. This applies also to multi radio +devices. +The current code allows a driver to support more than one NAN interface, +if those are not in the same radio. + +Fix it. + +Reviewed-by: Johannes Berg +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20260107135129.fdaecec0fe8a.I246b5ba6e9da3ec1481ff197e47f6ce0793d7118@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/core.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/net/wireless/core.c b/net/wireless/core.c +index ad32386ed2e11..73c051f129d33 100644 +--- a/net/wireless/core.c ++++ b/net/wireless/core.c +@@ -665,12 +665,8 @@ int wiphy_verify_iface_combinations(struct wiphy *wiphy, + c->limits[j].max > 1)) + return -EINVAL; + +- /* Only a single NAN can be allowed, avoid this +- * check for multi-radio global combination, since it +- * hold the capabilities of all radio combinations. +- */ +- if (!combined_radio && +- WARN_ON(types & BIT(NL80211_IFTYPE_NAN) && ++ /* Only a single NAN can be allowed */ ++ if (WARN_ON(types & BIT(NL80211_IFTYPE_NAN) && + c->limits[j].max > 1)) + return -EINVAL; + +-- +2.51.0 + diff --git a/queue-6.12/wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch b/queue-6.12/wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch new file mode 100644 index 00000000000..20ea302e726 --- /dev/null +++ b/queue-6.12/wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch @@ -0,0 +1,48 @@ +From f216edd757954c09d72ff769a711bbfc0bbe723d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 19:30:05 +0000 +Subject: wifi: iwlegacy: add missing mutex protection in + il3945_store_measurement() + +From: Ziyi Guo + +[ Upstream commit 4dd1dda65265ecbc9f43ffc08e333684cf715152 ] + +il3945_store_measurement() calls il3945_get_measurement() which internally +calls il_send_cmd_sync() without holding il->mutex. However, +il_send_cmd_sync() has lockdep_assert_held(&il->mutex) indicating that +callers must hold this lock. + +Other sysfs store functions in the same file properly acquire the mutex: +- il3945_store_flags() acquires mutex at 3945-mac.c:3110 +- il3945_store_filter_flags() acquires mutex at 3945-mac.c:3144 + +Add mutex_lock()/mutex_unlock() around the il3945_get_measurement() call +in the sysfs store function to fix the missing lock protection. + +Signed-off-by: Ziyi Guo +Acked-by: Stanislaw Gruszka +Link: https://patch.msgid.link/20260125193005.1090429-1-n7l8m4@u.northwestern.edu +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlegacy/3945-mac.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c +index 74fc76c00ebcf..20d2afe1d55f9 100644 +--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c ++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c +@@ -3262,7 +3262,9 @@ il3945_store_measurement(struct device *d, struct device_attribute *attr, + + D_INFO("Invoking measurement of type %d on " "channel %d (for '%s')\n", + type, params.channel, buf); ++ mutex_lock(&il->mutex); + il3945_get_measurement(il, ¶ms, type); ++ mutex_unlock(&il->mutex); + + return count; + } +-- +2.51.0 + diff --git a/queue-6.12/wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch b/queue-6.12/wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch new file mode 100644 index 00000000000..731007a3598 --- /dev/null +++ b/queue-6.12/wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch @@ -0,0 +1,49 @@ +From 00940e6f5a22035b278ee00d1c88edcbeea8e73f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 19:40:39 +0000 +Subject: wifi: iwlegacy: add missing mutex protection in + il4965_store_tx_power() + +From: Ziyi Guo + +[ Upstream commit e31fa691d0b1c07b6094a6cf0cce894192c462b3 ] + +il4965_store_tx_power() calls il_set_tx_power() without holding il->mutex. +However, il_set_tx_power() has lockdep_assert_held(&il->mutex) indicating +that callers must hold this lock. + +All other callers of il_set_tx_power() properly acquire the mutex: +- il_bg_scan_completed() acquires mutex at common.c:1683 +- il_mac_config() acquires mutex at common.c:5006 +- il3945_commit_rxon() and il4965_commit_rxon() are called via work + queues that hold the mutex (like il4965_bg_alive_start) + +Add mutex_lock()/mutex_unlock() around the il_set_tx_power() call in +the sysfs store function to fix the missing lock protection. + +Signed-off-by: Ziyi Guo +Acked-by: Stanislaw Gruszka +Link: https://patch.msgid.link/20260125194039.1196488-1-n7l8m4@u.northwestern.edu +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c +index a94cf27ffe4b0..ac2cfef737e4f 100644 +--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c ++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c +@@ -4606,7 +4606,9 @@ il4965_store_tx_power(struct device *d, struct device_attribute *attr, + if (ret) + IL_INFO("%s is not in decimal form.\n", buf); + else { ++ mutex_lock(&il->mutex); + ret = il_set_tx_power(il, val, false); ++ mutex_unlock(&il->mutex); + if (ret) + IL_ERR("failed setting tx power (0x%08x).\n", ret); + else +-- +2.51.0 + diff --git a/queue-6.12/wifi-iwlwifi-mvm-check-the-validity-of-noa_len.patch b/queue-6.12/wifi-iwlwifi-mvm-check-the-validity-of-noa_len.patch new file mode 100644 index 00000000000..1eb7c7a2550 --- /dev/null +++ b/queue-6.12/wifi-iwlwifi-mvm-check-the-validity-of-noa_len.patch @@ -0,0 +1,48 @@ +From 03afd340ba65b2edd047b21295818d51bdd97160 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 15:02:15 +0200 +Subject: wifi: iwlwifi: mvm: check the validity of noa_len + +From: Miri Korenblit + +[ Upstream commit 1e3fb3c4a8e6c581d0f4533dba887fabf53d607d ] + +Validate iwl_probe_resp_data_notif::noa_attr::len_low since we are using +its value to determine the noa_len, which is later used for the NoA +attribute. + +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20251110150012.99b663d9b424.I206fd54c990ca9e1160b9b94fa8be44e67bcc1b9@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c +index d013de30e7ed6..28d329ec31b82 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c +@@ -1816,6 +1816,20 @@ void iwl_mvm_probe_resp_data_notif(struct iwl_mvm *mvm, + + mvmvif = iwl_mvm_vif_from_mac80211(vif); + ++ /* ++ * len_low should be 2 + n*13 (where n is the number of descriptors. ++ * 13 is the size of a NoA descriptor). We can have either one or two ++ * descriptors. ++ */ ++ if (IWL_FW_CHECK(mvm, notif->noa_active && ++ notif->noa_attr.len_low != 2 + ++ sizeof(struct ieee80211_p2p_noa_desc) && ++ notif->noa_attr.len_low != 2 + ++ sizeof(struct ieee80211_p2p_noa_desc) * 2, ++ "Invalid noa_attr.len_low (%d)\n", ++ notif->noa_attr.len_low)) ++ return; ++ + new_data = kzalloc(sizeof(*new_data), GFP_KERNEL); + if (!new_data) + return; +-- +2.51.0 + diff --git a/queue-6.12/wifi-libertas-fix-warning-in-usb_tx_block.patch b/queue-6.12/wifi-libertas-fix-warning-in-usb_tx_block.patch new file mode 100644 index 00000000000..405f055cf81 --- /dev/null +++ b/queue-6.12/wifi-libertas-fix-warning-in-usb_tx_block.patch @@ -0,0 +1,44 @@ +From b786a5f22150ddc443bf42f87cd0434d43a13aac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Dec 2025 16:58:06 +0100 +Subject: wifi: libertas: fix WARNING in usb_tx_block + +From: Szymon Wilczek + +[ Upstream commit d66676e6ca96bf8680f869a9bd6573b26c634622 ] + +The function usb_tx_block() submits cardp->tx_urb without ensuring that +any previous transmission on this URB has completed. If a second call +occurs while the URB is still active (e.g. during rapid firmware loading), +usb_submit_urb() detects the active state and triggers a warning: +'URB submitted while active'. + +Fix this by enforcing serialization: call usb_kill_urb() before +submitting the new request. This ensures the URB is idle and safe to reuse. + +Reported-by: syzbot+67969ab6a2551c27f71b@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=67969ab6a2551c27f71b +Signed-off-by: Szymon Wilczek +Link: https://patch.msgid.link/20251221155806.23925-1-swilczek.lx@gmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/libertas/if_usb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c +index 2240b4db8c036..d98c81539ba53 100644 +--- a/drivers/net/wireless/marvell/libertas/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas/if_usb.c +@@ -426,6 +426,8 @@ static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload, uint16_t nb + goto tx_ret; + } + ++ usb_kill_urb(cardp->tx_urb); ++ + usb_fill_bulk_urb(cardp->tx_urb, cardp->udev, + usb_sndbulkpipe(cardp->udev, + cardp->ep_out), +-- +2.51.0 + diff --git a/queue-6.12/wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch b/queue-6.12/wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch new file mode 100644 index 00000000000..c628af7f02b --- /dev/null +++ b/queue-6.12/wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch @@ -0,0 +1,86 @@ +From b5e97f9ecb2cceb18b8ebeac1a4ca8557812633a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Nov 2025 16:50:31 +0200 +Subject: wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() + +From: Bitterblue Smith + +[ Upstream commit 44d1f624bbdd2d60319374ba85f7195a28d00c90 ] + +rtw8822b_set_antenna() can be called from userspace when the chip is +powered off. In that case a WARNING is triggered in +rtw8822b_config_trx_mode() because trying to read the RF registers +when the chip is powered off returns an unexpected value. + +Call rtw8822b_config_trx_mode() in rtw8822b_set_antenna() only when +the chip is powered on. + +------------[ cut here ]------------ +write RF mode table fail +WARNING: CPU: 0 PID: 7183 at rtw8822b.c:824 rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b] +CPU: 0 UID: 0 PID: 7183 Comm: iw Tainted: G W OE 6.17.5-arch1-1 #1 PREEMPT(full) 01c39fc421df2af799dd5e9180b572af860b40c1 +Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE +Hardware name: LENOVO 82KR/LNVNB161216, BIOS HBCN18WW 08/27/2021 +RIP: 0010:rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b] +Call Trace: + + rtw8822b_set_antenna+0x57/0x70 [rtw88_8822b 370206f42e5890d8d5f48eb358b759efa37c422b] + rtw_ops_set_antenna+0x50/0x80 [rtw88_core 711c8fb4f686162be4625b1d0b8e8c6a5ac850fb] + ieee80211_set_antenna+0x60/0x100 [mac80211 f1845d85d2ecacf3b71867635a050ece90486cf3] + nl80211_set_wiphy+0x384/0xe00 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] + ? netdev_run_todo+0x63/0x550 + genl_family_rcv_msg_doit+0xfc/0x160 + genl_rcv_msg+0x1aa/0x2b0 + ? __pfx_nl80211_pre_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] + ? __pfx_nl80211_set_wiphy+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] + ? __pfx_nl80211_post_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] + ? __pfx_genl_rcv_msg+0x10/0x10 + netlink_rcv_skb+0x59/0x110 + genl_rcv+0x28/0x40 + netlink_unicast+0x285/0x3c0 + ? __alloc_skb+0xdb/0x1a0 + netlink_sendmsg+0x20d/0x430 + ____sys_sendmsg+0x39f/0x3d0 + ? import_iovec+0x2f/0x40 + ___sys_sendmsg+0x99/0xe0 + ? refill_obj_stock+0x12e/0x240 + __sys_sendmsg+0x8a/0xf0 + do_syscall_64+0x81/0x970 + ? do_syscall_64+0x81/0x970 + ? ksys_read+0x73/0xf0 + ? do_syscall_64+0x81/0x970 + ? count_memcg_events+0xc2/0x190 + ? handle_mm_fault+0x1d7/0x2d0 + ? do_user_addr_fault+0x21a/0x690 + ? exc_page_fault+0x7e/0x1a0 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +---[ end trace 0000000000000000 ]--- + +Link: https://github.com/lwfinger/rtw88/issues/366 +Signed-off-by: Bitterblue Smith +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/fb9a3444-9319-4aa2-8719-35a6308bf568@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/rtw8822b.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822b.c b/drivers/net/wireless/realtek/rtw88/rtw8822b.c +index 4a6c0a9266a09..0dba4b4c9464e 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c ++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c +@@ -1045,7 +1045,8 @@ static int rtw8822b_set_antenna(struct rtw_dev *rtwdev, + hal->antenna_tx = antenna_tx; + hal->antenna_rx = antenna_rx; + +- rtw8822b_config_trx_mode(rtwdev, antenna_tx, antenna_rx, false); ++ if (test_bit(RTW_FLAG_POWERON, rtwdev->flags)) ++ rtw8822b_config_trx_mode(rtwdev, antenna_tx, antenna_rx, false); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.12/wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch b/queue-6.12/wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch new file mode 100644 index 00000000000..9a8858745d0 --- /dev/null +++ b/queue-6.12/wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch @@ -0,0 +1,65 @@ +From 9fb19a6e2e0b7394111b1af13c6852de5e271ff1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 23:09:37 +0500 +Subject: wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero + +From: Roman Peshkichev + +[ Upstream commit 9f68fdcdc9dbf21be2a48feced90ff7f77d07443 ] + +The function rtw_set_dtim_period() accepted an 'int' dtim_period parameter, +while mac80211 provides dtim_period as 'u8' in struct ieee80211_bss_conf. +In IBSS (ad-hoc) mode mac80211 may set dtim_period to 0. + +The driver unconditionally wrote (dtim_period - 1) to +REG_DTIM_COUNTER_ROOT, which resulted in 0xFF when dtim_period was 0. This +caused delays in broadcast/multicast traffic processing and issues with +ad-hoc operation. + +Convert the function parameter to u8 to match ieee80211_bss_conf and avoid +the underflow by writing 0 when dtim_period is 0. + +Link: https://github.com/lwfinger/rtw88/issues/406 +Signed-off-by: Roman Peshkichev +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20251125180937.22977-1-roman.peshkichev@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/main.c | 4 ++-- + drivers/net/wireless/realtek/rtw88/main.h | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c +index a4416e8986b97..adfe23b28bf69 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.c ++++ b/drivers/net/wireless/realtek/rtw88/main.c +@@ -709,10 +709,10 @@ void rtw_set_rx_freq_band(struct rtw_rx_pkt_stat *pkt_stat, u8 channel) + } + EXPORT_SYMBOL(rtw_set_rx_freq_band); + +-void rtw_set_dtim_period(struct rtw_dev *rtwdev, int dtim_period) ++void rtw_set_dtim_period(struct rtw_dev *rtwdev, u8 dtim_period) + { + rtw_write32_set(rtwdev, REG_TCR, BIT_TCR_UPDATE_TIMIE); +- rtw_write8(rtwdev, REG_DTIM_COUNTER_ROOT, dtim_period - 1); ++ rtw_write8(rtwdev, REG_DTIM_COUNTER_ROOT, dtim_period ? dtim_period - 1 : 0); + } + + void rtw_update_channel(struct rtw_dev *rtwdev, u8 center_channel, +diff --git a/drivers/net/wireless/realtek/rtw88/main.h b/drivers/net/wireless/realtek/rtw88/main.h +index c808bb271e9d0..b70b6e62449cc 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.h ++++ b/drivers/net/wireless/realtek/rtw88/main.h +@@ -2169,7 +2169,7 @@ enum nl80211_band rtw_hw_to_nl80211_band(enum rtw_supported_band hw_band) + } + + void rtw_set_rx_freq_band(struct rtw_rx_pkt_stat *pkt_stat, u8 channel); +-void rtw_set_dtim_period(struct rtw_dev *rtwdev, int dtim_period); ++void rtw_set_dtim_period(struct rtw_dev *rtwdev, u8 dtim_period); + void rtw_get_channel_params(struct cfg80211_chan_def *chandef, + struct rtw_channel_params *ch_param); + bool check_hw_ready(struct rtw_dev *rtwdev, u32 addr, u32 mask, u32 target); +-- +2.51.0 + diff --git a/queue-6.12/wifi-rtw88-fix-inadvertent-sharing-of-struct-ieee802.patch b/queue-6.12/wifi-rtw88-fix-inadvertent-sharing-of-struct-ieee802.patch new file mode 100644 index 00000000000..212151f1e7c --- /dev/null +++ b/queue-6.12/wifi-rtw88-fix-inadvertent-sharing-of-struct-ieee802.patch @@ -0,0 +1,92 @@ +From da2aeb61c4a89a7c3204833961ecbba60fd58e1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Dec 2025 01:26:45 +0200 +Subject: wifi: rtw88: Fix inadvertent sharing of struct + ieee80211_supported_band data + +From: Bitterblue Smith + +[ Upstream commit fcac0f23d4d20b11014a39f8e2527cdc12ec9c82 ] + +Internally wiphy writes to individual channels in this structure, +so we must not share one static definition of channel list between +multiple device instances, because that causes hard to debug +breakage. + +For example, with two rtw88 driven devices in the system, channel +information may get incoherent, preventing channel use. + +Copied from commit 0ae36391c804 ("wifi: rtw89: Fix inadverent sharing +of struct ieee80211_supported_band data"). + +Signed-off-by: Bitterblue Smith +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/e94ad653-2b6d-4284-a33c-8c694f88955b@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/main.c | 34 +++++++++++++++++++---- + 1 file changed, 29 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c +index eee6cba0bfa16..57fe4ece812c8 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.c ++++ b/drivers/net/wireless/realtek/rtw88/main.c +@@ -1629,16 +1629,41 @@ static u16 rtw_get_max_scan_ie_len(struct rtw_dev *rtwdev) + return len; + } + ++static struct ieee80211_supported_band * ++rtw_sband_dup(struct rtw_dev *rtwdev, ++ const struct ieee80211_supported_band *sband) ++{ ++ struct ieee80211_supported_band *dup; ++ ++ dup = devm_kmemdup(rtwdev->dev, sband, sizeof(*sband), GFP_KERNEL); ++ if (!dup) ++ return NULL; ++ ++ dup->channels = devm_kmemdup_array(rtwdev->dev, sband->channels, ++ sband->n_channels, ++ sizeof(*sband->channels), ++ GFP_KERNEL); ++ if (!dup->channels) ++ return NULL; ++ ++ dup->bitrates = devm_kmemdup_array(rtwdev->dev, sband->bitrates, ++ sband->n_bitrates, ++ sizeof(*sband->bitrates), ++ GFP_KERNEL); ++ if (!dup->bitrates) ++ return NULL; ++ ++ return dup; ++} ++ + static void rtw_set_supported_band(struct ieee80211_hw *hw, + const struct rtw_chip_info *chip) + { + struct ieee80211_supported_band *sband; + struct rtw_dev *rtwdev = hw->priv; +- struct device *dev = rtwdev->dev; + + if (chip->band & RTW_BAND_2G) { +- sband = devm_kmemdup(dev, &rtw_band_2ghz, sizeof(*sband), +- GFP_KERNEL); ++ sband = rtw_sband_dup(rtwdev, &rtw_band_2ghz); + if (!sband) + goto err_out; + if (chip->ht_supported) +@@ -1647,8 +1672,7 @@ static void rtw_set_supported_band(struct ieee80211_hw *hw, + } + + if (chip->band & RTW_BAND_5G) { +- sband = devm_kmemdup(dev, &rtw_band_5ghz, sizeof(*sband), +- GFP_KERNEL); ++ sband = rtw_sband_dup(rtwdev, &rtw_band_5ghz); + if (!sband) + goto err_out; + if (chip->ht_supported) +-- +2.51.0 + diff --git a/queue-6.12/wifi-rtw88-rtw8821cu-add-id-for-mercusys-mu6h.patch b/queue-6.12/wifi-rtw88-rtw8821cu-add-id-for-mercusys-mu6h.patch new file mode 100644 index 00000000000..6728fedbd08 --- /dev/null +++ b/queue-6.12/wifi-rtw88-rtw8821cu-add-id-for-mercusys-mu6h.patch @@ -0,0 +1,37 @@ +From 0979d03d7ecabdad38cdb4011d23786a94aaea8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 08:32:04 +0800 +Subject: wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H + +From: Hsiu-Ming Chang + +[ Upstream commit 77653c327e11c71c5363b18a53fbf2b92ed21da4 ] + +Add support for Mercusys MU6H AC650 High Gain Wireless Dual Band USB +Adapter V1.30. It is based on RTL8811CU, usb device ID is 2c4e:0105. + +Signed-off-by: Hsiu-Ming Chang +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20251205003245.5762-1-cges30901@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/rtw8821cu.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8821cu.c b/drivers/net/wireless/realtek/rtw88/rtw8821cu.c +index a019f4085e738..1f5af09aed99f 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8821cu.c ++++ b/drivers/net/wireless/realtek/rtw88/rtw8821cu.c +@@ -37,6 +37,8 @@ static const struct usb_device_id rtw_8821cu_id_table[] = { + .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Edimax */ + { USB_DEVICE_AND_INTERFACE_INFO(0x7392, 0xd811, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Edimax */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2c4e, 0x0105, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Mercusys */ + {}, + }; + MODULE_DEVICE_TABLE(usb, rtw_8821cu_id_table); +-- +2.51.0 + diff --git a/queue-6.12/wifi-rtw88-use-devm_kmemdup-in-rtw_set_supported_ban.patch b/queue-6.12/wifi-rtw88-use-devm_kmemdup-in-rtw_set_supported_ban.patch new file mode 100644 index 00000000000..c2daf2166f7 --- /dev/null +++ b/queue-6.12/wifi-rtw88-use-devm_kmemdup-in-rtw_set_supported_ban.patch @@ -0,0 +1,84 @@ +From 32581a4cfc0bd0407e5b84e47a681bb04bb72938 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Dec 2025 01:25:32 +0200 +Subject: wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() + +From: Bitterblue Smith + +[ Upstream commit 2ba12401cc1f2d970fa2e7d5b15abde3f5abd40d ] + +Simplify the code by using device managed memory allocations. + +This also fixes a memory leak in rtw_register_hw(). The supported bands +were not freed in the error path. + +Copied from commit 145df52a8671 ("wifi: rtw89: Convert +rtw89_core_set_supported_band to use devm_*"). + +Signed-off-by: Bitterblue Smith +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/1aa7fdef-2d5b-4a31-a4e9-fac8257ed30d@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/main.c | 19 ++++++------------- + 1 file changed, 6 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c +index adfe23b28bf69..eee6cba0bfa16 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.c ++++ b/drivers/net/wireless/realtek/rtw88/main.c +@@ -1632,11 +1632,13 @@ static u16 rtw_get_max_scan_ie_len(struct rtw_dev *rtwdev) + static void rtw_set_supported_band(struct ieee80211_hw *hw, + const struct rtw_chip_info *chip) + { +- struct rtw_dev *rtwdev = hw->priv; + struct ieee80211_supported_band *sband; ++ struct rtw_dev *rtwdev = hw->priv; ++ struct device *dev = rtwdev->dev; + + if (chip->band & RTW_BAND_2G) { +- sband = kmemdup(&rtw_band_2ghz, sizeof(*sband), GFP_KERNEL); ++ sband = devm_kmemdup(dev, &rtw_band_2ghz, sizeof(*sband), ++ GFP_KERNEL); + if (!sband) + goto err_out; + if (chip->ht_supported) +@@ -1645,7 +1647,8 @@ static void rtw_set_supported_band(struct ieee80211_hw *hw, + } + + if (chip->band & RTW_BAND_5G) { +- sband = kmemdup(&rtw_band_5ghz, sizeof(*sband), GFP_KERNEL); ++ sband = devm_kmemdup(dev, &rtw_band_5ghz, sizeof(*sband), ++ GFP_KERNEL); + if (!sband) + goto err_out; + if (chip->ht_supported) +@@ -1661,13 +1664,6 @@ static void rtw_set_supported_band(struct ieee80211_hw *hw, + rtw_err(rtwdev, "failed to set supported band\n"); + } + +-static void rtw_unset_supported_band(struct ieee80211_hw *hw, +- const struct rtw_chip_info *chip) +-{ +- kfree(hw->wiphy->bands[NL80211_BAND_2GHZ]); +- kfree(hw->wiphy->bands[NL80211_BAND_5GHZ]); +-} +- + static void rtw_vif_smps_iter(void *data, u8 *mac, + struct ieee80211_vif *vif) + { +@@ -2285,10 +2281,7 @@ EXPORT_SYMBOL(rtw_register_hw); + + void rtw_unregister_hw(struct rtw_dev *rtwdev, struct ieee80211_hw *hw) + { +- const struct rtw_chip_info *chip = rtwdev->chip; +- + ieee80211_unregister_hw(hw); +- rtw_unset_supported_band(hw, chip); + rtw_debugfs_deinit(rtwdev); + } + EXPORT_SYMBOL(rtw_unregister_hw); +-- +2.51.0 + diff --git a/queue-6.12/wifi-rtw89-8922a-add-digital-compensation-for-2ghz.patch b/queue-6.12/wifi-rtw89-8922a-add-digital-compensation-for-2ghz.patch new file mode 100644 index 00000000000..cf4c2c28d6e --- /dev/null +++ b/queue-6.12/wifi-rtw89-8922a-add-digital-compensation-for-2ghz.patch @@ -0,0 +1,123 @@ +From 5c86e367b7d76bb855c61dd8cd391eee8dbc83a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jan 2026 12:41:57 +0800 +Subject: wifi: rtw89: 8922a: add digital compensation for 2GHz + +From: Po-Hao Huang + +[ Upstream commit 8da7e88682d58a7c2e2c2101e49d3c9c9ac481b0 ] + +This fixes transmit power too low under 2GHz connection. Previously +we missed the settings of 2GHz, add the according calibrated tables. + +Signed-off-by: Po-Hao Huang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260117044157.2392958-10-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/rtw8922a.c | 57 +++++++++++++++---- + 1 file changed, 47 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922a.c b/drivers/net/wireless/realtek/rtw89/rtw8922a.c +index a4dce71db61d0..6f7ec37a76573 100644 +--- a/drivers/net/wireless/realtek/rtw89/rtw8922a.c ++++ b/drivers/net/wireless/realtek/rtw89/rtw8922a.c +@@ -1704,6 +1704,32 @@ static int rtw8922a_ctrl_rx_path_tmac(struct rtw89_dev *rtwdev, + } + + #define DIGITAL_PWR_COMP_REG_NUM 22 ++static const u32 rtw8922a_digital_pwr_comp_2g_s0_val[][DIGITAL_PWR_COMP_REG_NUM] = { ++ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320, ++ 0x0D05091D, 0x14D50FA0, 0x00000000, 0x01010000, 0x00000101, ++ 0x01010101, 0x02020201, 0x02010000, 0x03030202, 0x00000303, ++ 0x03020101, 0x06060504, 0x01010000, 0x06050403, 0x01000606, ++ 0x05040202, 0x07070706}, ++ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320, ++ 0x0D05091D, 0x14D50FA0, 0x00000000, 0x01010100, 0x00000101, ++ 0x01000000, 0x01010101, 0x01010000, 0x02020202, 0x00000404, ++ 0x03020101, 0x04040303, 0x02010000, 0x03030303, 0x00000505, ++ 0x03030201, 0x05050303}, ++}; ++ ++static const u32 rtw8922a_digital_pwr_comp_2g_s1_val[][DIGITAL_PWR_COMP_REG_NUM] = { ++ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320, ++ 0x0D05091D, 0x14D50FA0, 0x01010000, 0x01010101, 0x00000101, ++ 0x01010100, 0x01010101, 0x01010000, 0x02020202, 0x01000202, ++ 0x02020101, 0x03030202, 0x02010000, 0x05040403, 0x01000606, ++ 0x05040302, 0x07070605}, ++ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320, ++ 0x0D05091D, 0x14D50FA0, 0x00000000, 0x01010100, 0x00000101, ++ 0x01010000, 0x02020201, 0x02010100, 0x03030202, 0x01000404, ++ 0x04030201, 0x05050404, 0x01010100, 0x04030303, 0x01000505, ++ 0x03030101, 0x05050404}, ++}; ++ + static const u32 rtw8922a_digital_pwr_comp_val[][DIGITAL_PWR_COMP_REG_NUM] = { + {0x012C0096, 0x044C02BC, 0x00322710, 0x015E0096, 0x03C8028A, + 0x0BB80708, 0x17701194, 0x02020100, 0x03030303, 0x01000303, +@@ -1718,7 +1744,7 @@ static const u32 rtw8922a_digital_pwr_comp_val[][DIGITAL_PWR_COMP_REG_NUM] = { + }; + + static void rtw8922a_set_digital_pwr_comp(struct rtw89_dev *rtwdev, +- bool enable, u8 nss, ++ u8 band, u8 nss, + enum rtw89_rf_path path) + { + static const u32 ltpc_t0[2] = {R_BE_LTPC_T0_PATH0, R_BE_LTPC_T0_PATH1}; +@@ -1726,14 +1752,25 @@ static void rtw8922a_set_digital_pwr_comp(struct rtw89_dev *rtwdev, + u32 addr, val; + u32 i; + +- if (nss == 1) +- digital_pwr_comp = rtw8922a_digital_pwr_comp_val[0]; +- else +- digital_pwr_comp = rtw8922a_digital_pwr_comp_val[1]; ++ if (nss == 1) { ++ if (band == RTW89_BAND_2G) ++ digital_pwr_comp = path == RF_PATH_A ? ++ rtw8922a_digital_pwr_comp_2g_s0_val[0] : ++ rtw8922a_digital_pwr_comp_2g_s1_val[0]; ++ else ++ digital_pwr_comp = rtw8922a_digital_pwr_comp_val[0]; ++ } else { ++ if (band == RTW89_BAND_2G) ++ digital_pwr_comp = path == RF_PATH_A ? ++ rtw8922a_digital_pwr_comp_2g_s0_val[1] : ++ rtw8922a_digital_pwr_comp_2g_s1_val[1]; ++ else ++ digital_pwr_comp = rtw8922a_digital_pwr_comp_val[1]; ++ } + + addr = ltpc_t0[path]; + for (i = 0; i < DIGITAL_PWR_COMP_REG_NUM; i++, addr += 4) { +- val = enable ? digital_pwr_comp[i] : 0; ++ val = digital_pwr_comp[i]; + rtw89_phy_write32(rtwdev, addr, val); + } + } +@@ -1742,7 +1779,7 @@ static void rtw8922a_digital_pwr_comp(struct rtw89_dev *rtwdev, + enum rtw89_phy_idx phy_idx) + { + const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, RTW89_CHANCTX_0); +- bool enable = chan->band_type != RTW89_BAND_2G; ++ u8 band = chan->band_type; + u8 path; + + if (rtwdev->mlo_dbcc_mode == MLO_1_PLUS_1_1RF) { +@@ -1750,10 +1787,10 @@ static void rtw8922a_digital_pwr_comp(struct rtw89_dev *rtwdev, + path = RF_PATH_A; + else + path = RF_PATH_B; +- rtw8922a_set_digital_pwr_comp(rtwdev, enable, 1, path); ++ rtw8922a_set_digital_pwr_comp(rtwdev, band, 1, path); + } else { +- rtw8922a_set_digital_pwr_comp(rtwdev, enable, 2, RF_PATH_A); +- rtw8922a_set_digital_pwr_comp(rtwdev, enable, 2, RF_PATH_B); ++ rtw8922a_set_digital_pwr_comp(rtwdev, band, 2, RF_PATH_A); ++ rtw8922a_set_digital_pwr_comp(rtwdev, band, 2, RF_PATH_B); + } + } + +-- +2.51.0 + diff --git a/queue-6.12/wifi-rtw89-8922a-set-random-mac-if-efuse-contains-ze.patch b/queue-6.12/wifi-rtw89-8922a-set-random-mac-if-efuse-contains-ze.patch new file mode 100644 index 00000000000..d9050d7a753 --- /dev/null +++ b/queue-6.12/wifi-rtw89-8922a-set-random-mac-if-efuse-contains-ze.patch @@ -0,0 +1,71 @@ +From f2c053c326dd5c19a6b786886045889ad6bec588 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Nov 2025 10:18:56 +0100 +Subject: wifi: rtw89: 8922a: set random mac if efuse contains zeroes + +From: Jose Ignacio Tornos Martinez + +[ Upstream commit 41be33d3efc120f6a2c02d12742655f2aa09e1b6 ] + +I have some rtl8922ae devices with no permanent mac stored in efuse. + +It could be properly saved and/or configured from user tools like +NetworkManager, but it would be desirable to be able to initialize it +somehow to get the device working by default. + +So, in the same way as with other devices, if the mac address read from +efuse contains zeros, a random mac address is assigned to at least allow +operation, and the user is warned about this in case any action needs to +be considered. + +Signed-off-by: Jose Ignacio Tornos Martinez +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20251126091905.217951-1-jtornosm@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/rtw8922a.c | 22 +++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922a.c b/drivers/net/wireless/realtek/rtw89/rtw8922a.c +index 64a41f24b2adb..a4dce71db61d0 100644 +--- a/drivers/net/wireless/realtek/rtw89/rtw8922a.c ++++ b/drivers/net/wireless/realtek/rtw89/rtw8922a.c +@@ -630,16 +630,30 @@ static int rtw8922a_read_efuse_rf(struct rtw89_dev *rtwdev, u8 *log_map) + static int rtw8922a_read_efuse(struct rtw89_dev *rtwdev, u8 *log_map, + enum rtw89_efuse_block block) + { ++ struct rtw89_efuse *efuse = &rtwdev->efuse; ++ int ret; ++ + switch (block) { + case RTW89_EFUSE_BLOCK_HCI_DIG_PCIE_SDIO: +- return rtw8922a_read_efuse_pci_sdio(rtwdev, log_map); ++ ret = rtw8922a_read_efuse_pci_sdio(rtwdev, log_map); ++ break; + case RTW89_EFUSE_BLOCK_HCI_DIG_USB: +- return rtw8922a_read_efuse_usb(rtwdev, log_map); ++ ret = rtw8922a_read_efuse_usb(rtwdev, log_map); ++ break; + case RTW89_EFUSE_BLOCK_RF: +- return rtw8922a_read_efuse_rf(rtwdev, log_map); ++ ret = rtw8922a_read_efuse_rf(rtwdev, log_map); ++ break; + default: +- return 0; ++ ret = 0; ++ break; ++ } ++ ++ if (!ret && is_zero_ether_addr(efuse->addr)) { ++ rtw89_info(rtwdev, "efuse mac address is zero, using random mac\n"); ++ eth_random_addr(efuse->addr); + } ++ ++ return ret; + } + + #define THM_TRIM_POSITIVE_MASK BIT(6) +-- +2.51.0 + diff --git a/queue-6.12/wifi-rtw89-fix-unable-to-receive-probe-responses-und.patch b/queue-6.12/wifi-rtw89-fix-unable-to-receive-probe-responses-und.patch new file mode 100644 index 00000000000..ae3d5bb6f51 --- /dev/null +++ b/queue-6.12/wifi-rtw89-fix-unable-to-receive-probe-responses-und.patch @@ -0,0 +1,47 @@ +From b28ae91b01d51c6db94689b0c70c6bd73b4567ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 09:39:50 +0800 +Subject: wifi: rtw89: fix unable to receive probe responses under MLO + connection + +From: Po-Hao Huang + +[ Upstream commit 6f6d7a325fbde4f025ee1b1277f6f44727e21223 ] + +During MLO connections, A1 of the probe responses we received are +in link address, these frames will then be dropped by mac80211 due to +not matching the MLD address in ieee80211_scan_accept_presp(). +Fix this by using MLD address to scan when not using random MAC address. + +Signed-off-by: Po-Hao Huang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260114013950.19704-13-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/fw.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c +index ae2c4ff74531a..b62b59bf528e7 100644 +--- a/drivers/net/wireless/realtek/rtw89/fw.c ++++ b/drivers/net/wireless/realtek/rtw89/fw.c +@@ -6696,6 +6696,7 @@ void rtw89_hw_scan_start(struct rtw89_dev *rtwdev, + struct cfg80211_scan_request *req = &scan_req->req; + const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, + rtwvif_link->chanctx_idx); ++ struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link); + struct rtw89_vif *rtwvif = rtwvif_link->rtwvif; + u32 rx_fltr = rtwdev->hal.rx_fltr; + u8 mac_addr[ETH_ALEN]; +@@ -6714,6 +6715,8 @@ void rtw89_hw_scan_start(struct rtw89_dev *rtwdev, + if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) + get_random_mask_addr(mac_addr, req->mac_addr, + req->mac_addr_mask); ++ else if (ieee80211_vif_is_mld(vif)) ++ ether_addr_copy(mac_addr, vif->addr); + else + ether_addr_copy(mac_addr, rtwvif_link->mac_addr); + rtw89_core_scan_start(rtwdev, rtwvif_link, mac_addr, true); +-- +2.51.0 + diff --git a/queue-6.12/wifi-rtw89-mac-correct-page-number-for-csi-response.patch b/queue-6.12/wifi-rtw89-mac-correct-page-number-for-csi-response.patch new file mode 100644 index 00000000000..c4ce7e835aa --- /dev/null +++ b/queue-6.12/wifi-rtw89-mac-correct-page-number-for-csi-response.patch @@ -0,0 +1,35 @@ +From 1304cbefaaa85b89057a044c1bc3d8fbdce78bb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 10:20:17 +0800 +Subject: wifi: rtw89: mac: correct page number for CSI response + +From: Ping-Ke Shih + +[ Upstream commit aa2a44d0d22d45d659b9f01638809b1735e46cff ] + +For beamforming procedure, hardware reserve memory page for CSI response. +The unit of register is (value - 1), so add one accordingly as expected. + +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260110022019.2254969-7-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/mac_be.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/mac_be.c b/drivers/net/wireless/realtek/rtw89/mac_be.c +index fe1964a6fcfb1..2896abce94a3c 100644 +--- a/drivers/net/wireless/realtek/rtw89/mac_be.c ++++ b/drivers/net/wireless/realtek/rtw89/mac_be.c +@@ -1166,7 +1166,7 @@ static int resp_pktctl_init_be(struct rtw89_dev *rtwdev, u8 mac_idx) + + reg = rtw89_mac_reg_by_idx(rtwdev, R_BE_RESP_CSI_RESERVED_PAGE, mac_idx); + rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_START_PAGE_MASK, qt_cfg.pktid); +- rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_PAGE_NUM_MASK, qt_cfg.pg_num); ++ rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_PAGE_NUM_MASK, qt_cfg.pg_num + 1); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.12/wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch b/queue-6.12/wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch new file mode 100644 index 00000000000..b58b0cf51aa --- /dev/null +++ b/queue-6.12/wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch @@ -0,0 +1,36 @@ +From a9e29d4324848e727be68056749efda0a0bc49fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 16:50:35 +0800 +Subject: wifi: rtw89: pci: restore LDO setting after device resume + +From: Dian-Syuan Yang + +[ Upstream commit af1e82232b988f8fc6d635c60609765e49221a64 ] + +The LDO (Low Dropout Regulator) setting is missing after suspend/resume +in some platforms, and it will cause card loss. Therefore, reconfigure +this setting to avoid it. + +Signed-off-by: Dian-Syuan Yang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260127085036.44060-6-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c +index a87e1778a0d41..c3a8a7af06472 100644 +--- a/drivers/net/wireless/realtek/rtw89/pci.c ++++ b/drivers/net/wireless/realtek/rtw89/pci.c +@@ -4250,6 +4250,7 @@ static int __maybe_unused rtw89_pci_resume(struct device *dev) + rtw89_write32_clr(rtwdev, R_AX_PCIE_PS_CTRL_V1, + B_AX_SEL_REQ_ENTR_L1); + } ++ rtw89_pci_hci_ldo(rtwdev); + rtw89_pci_l2_hci_ldo(rtwdev); + rtw89_pci_disable_eq(rtwdev); + rtw89_pci_cfg_dac(rtwdev); +-- +2.51.0 + diff --git a/queue-6.12/wifi-rtw89-ser-enable-error-imr-after-recovering-fro.patch b/queue-6.12/wifi-rtw89-ser-enable-error-imr-after-recovering-fro.patch new file mode 100644 index 00000000000..ff2d3091706 --- /dev/null +++ b/queue-6.12/wifi-rtw89-ser-enable-error-imr-after-recovering-fro.patch @@ -0,0 +1,90 @@ +From 137aa900fe87de4f9a220916aa6bf44ede37171f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Dec 2025 11:06:44 +0800 +Subject: wifi: rtw89: ser: enable error IMR after recovering from L1 + +From: Zong-Zhe Yang + +[ Upstream commit f4de946bdb379f543e3a599f8f048d741ad4a58e ] + +After recovering from L1, explicitly enable error IMR to ensure next +L1 SER (system error recovery) can work normally. + +Signed-off-by: Zong-Zhe Yang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20251223030651.480633-6-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/mac.c | 1 + + drivers/net/wireless/realtek/rtw89/mac.h | 1 + + drivers/net/wireless/realtek/rtw89/mac_be.c | 1 + + drivers/net/wireless/realtek/rtw89/ser.c | 10 ++++++++++ + 4 files changed, 13 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c +index b956ea2add919..31465893f866d 100644 +--- a/drivers/net/wireless/realtek/rtw89/mac.c ++++ b/drivers/net/wireless/realtek/rtw89/mac.c +@@ -6673,6 +6673,7 @@ const struct rtw89_mac_gen_def rtw89_mac_gen_ax = { + .check_mac_en = rtw89_mac_check_mac_en_ax, + .sys_init = sys_init_ax, + .trx_init = trx_init_ax, ++ .err_imr_ctrl = err_imr_ctrl_ax, + .hci_func_en = rtw89_mac_hci_func_en_ax, + .dmac_func_pre_en = rtw89_mac_dmac_func_pre_en_ax, + .dle_func_en = dle_func_en_ax, +diff --git a/drivers/net/wireless/realtek/rtw89/mac.h b/drivers/net/wireless/realtek/rtw89/mac.h +index 7974849f41e25..ad496a4f441aa 100644 +--- a/drivers/net/wireless/realtek/rtw89/mac.h ++++ b/drivers/net/wireless/realtek/rtw89/mac.h +@@ -947,6 +947,7 @@ struct rtw89_mac_gen_def { + enum rtw89_mac_hwmod_sel sel); + int (*sys_init)(struct rtw89_dev *rtwdev); + int (*trx_init)(struct rtw89_dev *rtwdev); ++ void (*err_imr_ctrl)(struct rtw89_dev *rtwdev, bool en); + void (*hci_func_en)(struct rtw89_dev *rtwdev); + void (*dmac_func_pre_en)(struct rtw89_dev *rtwdev); + void (*dle_func_en)(struct rtw89_dev *rtwdev, bool enable); +diff --git a/drivers/net/wireless/realtek/rtw89/mac_be.c b/drivers/net/wireless/realtek/rtw89/mac_be.c +index f22eaa83297fb..fe1964a6fcfb1 100644 +--- a/drivers/net/wireless/realtek/rtw89/mac_be.c ++++ b/drivers/net/wireless/realtek/rtw89/mac_be.c +@@ -2575,6 +2575,7 @@ const struct rtw89_mac_gen_def rtw89_mac_gen_be = { + .check_mac_en = rtw89_mac_check_mac_en_be, + .sys_init = sys_init_be, + .trx_init = trx_init_be, ++ .err_imr_ctrl = err_imr_ctrl_be, + .hci_func_en = rtw89_mac_hci_func_en_be, + .dmac_func_pre_en = rtw89_mac_dmac_func_pre_en_be, + .dle_func_en = dle_func_en_be, +diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c +index 2a303a758e276..43970d0e5b33f 100644 +--- a/drivers/net/wireless/realtek/rtw89/ser.c ++++ b/drivers/net/wireless/realtek/rtw89/ser.c +@@ -429,6 +429,14 @@ static void hal_send_m4_event(struct rtw89_ser *ser) + rtw89_mac_set_err_status(rtwdev, MAC_AX_ERR_L1_RCVY_EN); + } + ++static void hal_enable_err_imr(struct rtw89_ser *ser) ++{ ++ struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser); ++ const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def; ++ ++ mac->err_imr_ctrl(rtwdev, true); ++} ++ + /* state handler */ + static void ser_idle_st_hdl(struct rtw89_ser *ser, u8 evt) + { +@@ -545,6 +553,8 @@ static void ser_do_hci_st_hdl(struct rtw89_ser *ser, u8 evt) + break; + + case SER_EV_MAC_RESET_DONE: ++ hal_enable_err_imr(ser); ++ + ser_state_goto(ser, SER_IDLE_ST); + break; + +-- +2.51.0 + diff --git a/queue-6.12/wifi-rtw89-wow-add-reason-codes-for-disassociation-i.patch b/queue-6.12/wifi-rtw89-wow-add-reason-codes-for-disassociation-i.patch new file mode 100644 index 00000000000..6b0dc90892f --- /dev/null +++ b/queue-6.12/wifi-rtw89-wow-add-reason-codes-for-disassociation-i.patch @@ -0,0 +1,53 @@ +From d436bb78b9e1ab01a1f20cef8cfc547471731c53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 10:20:13 +0800 +Subject: wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode + +From: Chin-Yen Lee + +[ Upstream commit 2fd8f953f25173d14981d8736b6f5bfcd757e51b ] + +Some APs disconnect clients by sending a Disassociation frame +rather than a Deauthentication frame. Since these frames use +different reason codes in WoWLAN mode, this commit adds support +for handling Disassociation to prevent missed disconnection events. + +Signed-off-by: Chin-Yen Lee +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260110022019.2254969-3-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/wow.c | 4 ++++ + drivers/net/wireless/realtek/rtw89/wow.h | 1 + + 2 files changed, 5 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/wow.c b/drivers/net/wireless/realtek/rtw89/wow.c +index fdb715dc175c1..db68ac988cd24 100644 +--- a/drivers/net/wireless/realtek/rtw89/wow.c ++++ b/drivers/net/wireless/realtek/rtw89/wow.c +@@ -759,6 +759,10 @@ static void rtw89_wow_show_wakeup_reason(struct rtw89_dev *rtwdev) + + reason = rtw89_read8(rtwdev, wow_reason_reg); + switch (reason) { ++ case RTW89_WOW_RSN_RX_DISASSOC: ++ wakeup.disconnect = true; ++ rtw89_debug(rtwdev, RTW89_DBG_WOW, "WOW: Rx disassoc\n"); ++ break; + case RTW89_WOW_RSN_RX_DEAUTH: + wakeup.disconnect = true; + rtw89_debug(rtwdev, RTW89_DBG_WOW, "WOW: Rx deauth\n"); +diff --git a/drivers/net/wireless/realtek/rtw89/wow.h b/drivers/net/wireless/realtek/rtw89/wow.h +index f91991e8f2e30..d4b618fa4e3e5 100644 +--- a/drivers/net/wireless/realtek/rtw89/wow.h ++++ b/drivers/net/wireless/realtek/rtw89/wow.h +@@ -28,6 +28,7 @@ + enum rtw89_wake_reason { + RTW89_WOW_RSN_RX_PTK_REKEY = 0x1, + RTW89_WOW_RSN_RX_GTK_REKEY = 0x2, ++ RTW89_WOW_RSN_RX_DISASSOC = 0x4, + RTW89_WOW_RSN_RX_DEAUTH = 0x8, + RTW89_WOW_RSN_DISCONNECT = 0x10, + RTW89_WOW_RSN_RX_MAGIC_PKT = 0x21, +-- +2.51.0 + diff --git a/queue-6.12/x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch b/queue-6.12/x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch new file mode 100644 index 00000000000..ae4fe8a1c96 --- /dev/null +++ b/queue-6.12/x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch @@ -0,0 +1,46 @@ +From 2d3cc908d0617077d9f0958b98b06d6ae0684f16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 12:00:08 +0800 +Subject: x86/xen/pvh: Enable PAE mode for 32-bit guest only when + CONFIG_X86_PAE is set + +From: Hou Wenlong + +[ Upstream commit db9aded979b491a24871e1621cd4e8822dbca859 ] + +The PVH entry is available for 32-bit KVM guests, and 32-bit KVM guests +do not depend on CONFIG_X86_PAE. However, mk_early_pgtbl_32() builds +different pagetables depending on whether CONFIG_X86_PAE is set. +Therefore, enabling PAE mode for 32-bit KVM guests without +CONFIG_X86_PAE being set would result in a boot failure during CR3 +loading. + +Signed-off-by: Hou Wenlong +Reviewed-by: Juergen Gross +Signed-off-by: Juergen Gross +Message-ID: +Signed-off-by: Sasha Levin +--- + arch/x86/platform/pvh/head.S | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/x86/platform/pvh/head.S b/arch/x86/platform/pvh/head.S +index ce4fd8d33da46..2774cf74fa940 100644 +--- a/arch/x86/platform/pvh/head.S ++++ b/arch/x86/platform/pvh/head.S +@@ -91,10 +91,12 @@ SYM_CODE_START_LOCAL(pvh_start_xen) + + leal rva(early_stack_end)(%ebp), %esp + ++#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE) + /* Enable PAE mode. */ + mov %cr4, %eax + orl $X86_CR4_PAE, %eax + mov %eax, %cr4 ++#endif + + #ifdef CONFIG_X86_64 + /* Enable Long mode. */ +-- +2.51.0 + diff --git a/queue-6.12/xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch b/queue-6.12/xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch new file mode 100644 index 00000000000..3e05dc1fd76 --- /dev/null +++ b/queue-6.12/xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch @@ -0,0 +1,61 @@ +From 3a1ed66092b9e37d4d0a2f60b7e155ba67fa56f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 17:47:29 -0500 +Subject: xenbus: Use .freeze/.thaw to handle xenbus devices + +From: Jason Andryuk + +[ Upstream commit e08dd1ee49838750a514e83c0aa60cd12ba6ecbb ] + +The goal is to fix s2idle and S3 for Xen PV devices. A domain resuming +from s3 or s2idle disconnects its PV devices during resume. The +backends are not expecting this and do not reconnect. + +b3e96c0c7562 ("xen: use freeze/restore/thaw PM events for suspend/ +resume/chkpt") changed xen_suspend()/do_suspend() from +PMSG_SUSPEND/PMSG_RESUME to PMSG_FREEZE/PMSG_THAW/PMSG_RESTORE, but the +suspend/resume callbacks remained. + +.freeze/restore are used with hiberation where Linux restarts in a new +place in the future. .suspend/resume are useful for runtime power +management for the duration of a boot. + +The current behavior of the callbacks works for an xl save/restore or +live migration where the domain is restored/migrated to a new location +and connecting to a not-already-connected backend. + +Change xenbus_pm_ops to use .freeze/thaw/restore and drop the +.suspend/resume hook. This matches the use in drivers/xen/manage.c for +save/restore and live migration. With .suspend/resume empty, PV devices +are left connected during s2idle and s3, so PV devices are not changed +and work after resume. + +Signed-off-by: Jason Andryuk +Acked-by: Juergen Gross +Signed-off-by: Juergen Gross +Message-ID: <20251119224731.61497-2-jason.andryuk@amd.com> +Signed-off-by: Sasha Levin +--- + drivers/xen/xenbus/xenbus_probe_frontend.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c +index fcb335bb7b187..1fdf5be193430 100644 +--- a/drivers/xen/xenbus/xenbus_probe_frontend.c ++++ b/drivers/xen/xenbus/xenbus_probe_frontend.c +@@ -148,11 +148,9 @@ static void xenbus_frontend_dev_shutdown(struct device *_dev) + } + + static const struct dev_pm_ops xenbus_pm_ops = { +- .suspend = xenbus_dev_suspend, +- .resume = xenbus_frontend_dev_resume, + .freeze = xenbus_dev_suspend, + .thaw = xenbus_dev_cancel, +- .restore = xenbus_dev_resume, ++ .restore = xenbus_frontend_dev_resume, + }; + + static struct xen_bus_type xenbus_frontend = { +-- +2.51.0 + diff --git a/queue-6.18/9p-xen-protect-xen_9pfs_front_free-against-concurren.patch b/queue-6.18/9p-xen-protect-xen_9pfs_front_free-against-concurren.patch new file mode 100644 index 00000000000..7775f6ce0c2 --- /dev/null +++ b/queue-6.18/9p-xen-protect-xen_9pfs_front_free-against-concurren.patch @@ -0,0 +1,194 @@ +From 0abde905a1da9b389072ba0e185154ff18e1f224 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jan 2026 15:03:48 -0800 +Subject: 9p/xen: protect xen_9pfs_front_free against concurrent calls + +From: Stefano Stabellini + +[ Upstream commit ce8ded2e61f47747e31eeefb44dc24a2160a7e32 ] + +The xenwatch thread can race with other back-end change notifications +and call xen_9pfs_front_free() twice, hitting the observed general +protection fault due to a double-free. Guard the teardown path so only +one caller can release the front-end state at a time, preventing the +crash. + +This is a fix for the following double-free: + +[ 27.052347] Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI +[ 27.052357] CPU: 0 UID: 0 PID: 32 Comm: xenwatch Not tainted 6.18.0-02087-g51ab33fc0a8b-dirty #60 PREEMPT(none) +[ 27.052363] RIP: e030:xen_9pfs_front_free+0x1d/0x150 +[ 27.052368] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 41 55 41 54 55 48 89 fd 48 c7 c7 48 d0 92 85 53 e8 cb cb 05 00 48 8b 45 08 48 8b 55 00 <48> 3b 28 0f 85 f9 28 35 fe 48 3b 6a 08 0f 85 ef 28 35 fe 48 89 42 +[ 27.052377] RSP: e02b:ffffc9004016fdd0 EFLAGS: 00010246 +[ 27.052381] RAX: 6b6b6b6b6b6b6b6b RBX: ffff88800d66e400 RCX: 0000000000000000 +[ 27.052385] RDX: 6b6b6b6b6b6b6b6b RSI: 0000000000000000 RDI: 0000000000000000 +[ 27.052389] RBP: ffff88800a887040 R08: 0000000000000000 R09: 0000000000000000 +[ 27.052393] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888009e46b68 +[ 27.052397] R13: 0000000000000200 R14: 0000000000000000 R15: ffff88800a887040 +[ 27.052404] FS: 0000000000000000(0000) GS:ffff88808ca57000(0000) knlGS:0000000000000000 +[ 27.052408] CS: e030 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 27.052412] CR2: 00007f9714004360 CR3: 0000000004834000 CR4: 0000000000050660 +[ 27.052418] Call Trace: +[ 27.052420] +[ 27.052422] xen_9pfs_front_changed+0x5d5/0x720 +[ 27.052426] ? xenbus_otherend_changed+0x72/0x140 +[ 27.052430] ? __pfx_xenwatch_thread+0x10/0x10 +[ 27.052434] xenwatch_thread+0x94/0x1c0 +[ 27.052438] ? __pfx_autoremove_wake_function+0x10/0x10 +[ 27.052442] kthread+0xf8/0x240 +[ 27.052445] ? __pfx_kthread+0x10/0x10 +[ 27.052449] ? __pfx_kthread+0x10/0x10 +[ 27.052452] ret_from_fork+0x16b/0x1a0 +[ 27.052456] ? __pfx_kthread+0x10/0x10 +[ 27.052459] ret_from_fork_asm+0x1a/0x30 +[ 27.052463] +[ 27.052465] Modules linked in: +[ 27.052471] ---[ end trace 0000000000000000 ]--- + +Signed-off-by: Stefano Stabellini +Message-ID: <20260129230348.2390470-1-stefano.stabellini@amd.com> +Signed-off-by: Dominique Martinet +Signed-off-by: Sasha Levin +--- + net/9p/trans_xen.c | 85 ++++++++++++++++++++++++---------------------- + 1 file changed, 44 insertions(+), 41 deletions(-) + +diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c +index b9ff69c7522a1..068d57515dd58 100644 +--- a/net/9p/trans_xen.c ++++ b/net/9p/trans_xen.c +@@ -274,45 +274,52 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv) + { + int i, j; + +- write_lock(&xen_9pfs_lock); +- list_del(&priv->list); +- write_unlock(&xen_9pfs_lock); +- +- for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) { +- struct xen_9pfs_dataring *ring = &priv->rings[i]; +- +- cancel_work_sync(&ring->work); +- +- if (!priv->rings[i].intf) +- break; +- if (priv->rings[i].irq > 0) +- unbind_from_irqhandler(priv->rings[i].irq, ring); +- if (priv->rings[i].data.in) { +- for (j = 0; +- j < (1 << priv->rings[i].intf->ring_order); +- j++) { +- grant_ref_t ref; +- +- ref = priv->rings[i].intf->ref[j]; +- gnttab_end_foreign_access(ref, NULL); +- } +- free_pages_exact(priv->rings[i].data.in, ++ if (priv->rings) { ++ for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) { ++ struct xen_9pfs_dataring *ring = &priv->rings[i]; ++ ++ cancel_work_sync(&ring->work); ++ ++ if (!priv->rings[i].intf) ++ break; ++ if (priv->rings[i].irq > 0) ++ unbind_from_irqhandler(priv->rings[i].irq, ring); ++ if (priv->rings[i].data.in) { ++ for (j = 0; ++ j < (1 << priv->rings[i].intf->ring_order); ++ j++) { ++ grant_ref_t ref; ++ ++ ref = priv->rings[i].intf->ref[j]; ++ gnttab_end_foreign_access(ref, NULL); ++ } ++ free_pages_exact(priv->rings[i].data.in, + 1UL << (priv->rings[i].intf->ring_order + + XEN_PAGE_SHIFT)); ++ } ++ gnttab_end_foreign_access(priv->rings[i].ref, NULL); ++ free_page((unsigned long)priv->rings[i].intf); + } +- gnttab_end_foreign_access(priv->rings[i].ref, NULL); +- free_page((unsigned long)priv->rings[i].intf); ++ kfree(priv->rings); + } +- kfree(priv->rings); + kfree(priv->tag); + kfree(priv); + } + + static void xen_9pfs_front_remove(struct xenbus_device *dev) + { +- struct xen_9pfs_front_priv *priv = dev_get_drvdata(&dev->dev); ++ struct xen_9pfs_front_priv *priv; + ++ write_lock(&xen_9pfs_lock); ++ priv = dev_get_drvdata(&dev->dev); ++ if (priv == NULL) { ++ write_unlock(&xen_9pfs_lock); ++ return; ++ } + dev_set_drvdata(&dev->dev, NULL); ++ list_del(&priv->list); ++ write_unlock(&xen_9pfs_lock); ++ + xen_9pfs_front_free(priv); + } + +@@ -379,7 +386,7 @@ static int xen_9pfs_front_init(struct xenbus_device *dev) + { + int ret, i; + struct xenbus_transaction xbt; +- struct xen_9pfs_front_priv *priv = dev_get_drvdata(&dev->dev); ++ struct xen_9pfs_front_priv *priv; + char *versions, *v; + unsigned int max_rings, max_ring_order, len = 0; + +@@ -407,6 +414,10 @@ static int xen_9pfs_front_init(struct xenbus_device *dev) + if (p9_xen_trans.maxsize > XEN_FLEX_RING_SIZE(max_ring_order)) + p9_xen_trans.maxsize = XEN_FLEX_RING_SIZE(max_ring_order) / 2; + ++ priv = kzalloc(sizeof(*priv), GFP_KERNEL); ++ if (!priv) ++ return -ENOMEM; ++ priv->dev = dev; + priv->rings = kcalloc(XEN_9PFS_NUM_RINGS, sizeof(*priv->rings), + GFP_KERNEL); + if (!priv->rings) { +@@ -465,6 +476,11 @@ static int xen_9pfs_front_init(struct xenbus_device *dev) + goto error; + } + ++ write_lock(&xen_9pfs_lock); ++ dev_set_drvdata(&dev->dev, priv); ++ list_add_tail(&priv->list, &xen_9pfs_devs); ++ write_unlock(&xen_9pfs_lock); ++ + xenbus_switch_state(dev, XenbusStateInitialised); + return 0; + +@@ -479,19 +495,6 @@ static int xen_9pfs_front_init(struct xenbus_device *dev) + static int xen_9pfs_front_probe(struct xenbus_device *dev, + const struct xenbus_device_id *id) + { +- struct xen_9pfs_front_priv *priv = NULL; +- +- priv = kzalloc(sizeof(*priv), GFP_KERNEL); +- if (!priv) +- return -ENOMEM; +- +- priv->dev = dev; +- dev_set_drvdata(&dev->dev, priv); +- +- write_lock(&xen_9pfs_lock); +- list_add_tail(&priv->list, &xen_9pfs_devs); +- write_unlock(&xen_9pfs_lock); +- + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.18/accel-amdxdna-fix-tail-pointer-polling-in-mailbox_ge.patch b/queue-6.18/accel-amdxdna-fix-tail-pointer-polling-in-mailbox_ge.patch new file mode 100644 index 00000000000..ea64e4df4c7 --- /dev/null +++ b/queue-6.18/accel-amdxdna-fix-tail-pointer-polling-in-mailbox_ge.patch @@ -0,0 +1,63 @@ +From 9637d1d8576613a754750d628ed05b492c044a63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Dec 2025 10:16:03 -0800 +Subject: accel/amdxdna: Fix tail-pointer polling in mailbox_get_msg() + +From: Lizhi Hou + +[ Upstream commit cd77d5a4aaf8c5c1d819f47cf814bf7d4920b0a2 ] + +In mailbox_get_msg(), mailbox_reg_read_non_zero() is called to poll for a +non-zero tail pointer. This assumed that a zero value indicates an error. +However, certain corner cases legitimately produce a zero tail pointer. +To handle these cases, remove mailbox_reg_read_non_zero(). The zero tail +pointer will be treated as a valid rewind event. + +Reviewed-by: Maciej Falkowski +Signed-off-by: Lizhi Hou +Link: https://patch.msgid.link/20251204181603.793824-1-lizhi.hou@amd.com +Signed-off-by: Sasha Levin +--- + drivers/accel/amdxdna/amdxdna_mailbox.c | 19 +------------------ + 1 file changed, 1 insertion(+), 18 deletions(-) + +diff --git a/drivers/accel/amdxdna/amdxdna_mailbox.c b/drivers/accel/amdxdna/amdxdna_mailbox.c +index a80c77a478bff..2bacb89cd80c9 100644 +--- a/drivers/accel/amdxdna/amdxdna_mailbox.c ++++ b/drivers/accel/amdxdna/amdxdna_mailbox.c +@@ -112,22 +112,6 @@ static u32 mailbox_reg_read(struct mailbox_channel *mb_chann, u32 mbox_reg) + return readl(ringbuf_addr); + } + +-static int mailbox_reg_read_non_zero(struct mailbox_channel *mb_chann, u32 mbox_reg, u32 *val) +-{ +- struct xdna_mailbox_res *mb_res = &mb_chann->mb->res; +- void __iomem *ringbuf_addr = mb_res->mbox_base + mbox_reg; +- int ret, value; +- +- /* Poll till value is not zero */ +- ret = readx_poll_timeout(readl, ringbuf_addr, value, +- value, 1 /* us */, 100); +- if (ret < 0) +- return ret; +- +- *val = value; +- return 0; +-} +- + static inline void + mailbox_set_headptr(struct mailbox_channel *mb_chann, u32 headptr_val) + { +@@ -288,8 +272,7 @@ static int mailbox_get_msg(struct mailbox_channel *mb_chann) + u32 start_addr; + int ret; + +- if (mailbox_reg_read_non_zero(mb_chann, mb_chann->res[CHAN_RES_I2X].mb_tail_ptr_reg, &tail)) +- return -EINVAL; ++ tail = mailbox_get_tailptr(mb_chann, CHAN_RES_I2X); + head = mb_chann->i2x_head; + ringbuf_size = mailbox_get_ringbuf_size(mb_chann, CHAN_RES_I2X); + start_addr = mb_chann->res[CHAN_RES_I2X].rb_start_addr; +-- +2.51.0 + diff --git a/queue-6.18/acpi-battery-fix-incorrect-charging-status-when-curr.patch b/queue-6.18/acpi-battery-fix-incorrect-charging-status-when-curr.patch new file mode 100644 index 00000000000..e0fc97c88aa --- /dev/null +++ b/queue-6.18/acpi-battery-fix-incorrect-charging-status-when-curr.patch @@ -0,0 +1,57 @@ +From 4d80009534e94e478afc3e153a62bb98611e2c46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jan 2026 17:48:56 +0300 +Subject: ACPI: battery: fix incorrect charging status when current is zero +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ata Ä°lhan Köktürk + +[ Upstream commit bb1256e0ddc7e9e406164319769b9f8d8389f056 ] + +On some laptops, such as the Huawei Matebook series, the embedded +controller continues to report "Charging" status even when the +charge threshold is reached and no current is being drawn. + +This incorrect reporting prevents the system from switching to battery +power profiles, leading to significantly higher power (e.g., 18W instead +of 7W during browsing) and missed remaining battery time estimation. + +Validate the "Charging" state by checking if rate_now is zero. If the +hardware reports charging but the current is zero, report "Not Charging" +to user space. + +Signed-off-by: Ata Ä°lhan Köktürk +[ rjw: Whitespace fix, braces added to an inner if (), new comment rewrite ] +[ rjw: Changelog edits ] +Link: https://patch.msgid.link/20260129144856.43058-1-atailhan2006@gmail.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/battery.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c +index 67b76492c839c..8196c17b5a970 100644 +--- a/drivers/acpi/battery.c ++++ b/drivers/acpi/battery.c +@@ -212,7 +212,14 @@ static int acpi_battery_get_property(struct power_supply *psy, + if (battery->state & ACPI_BATTERY_STATE_DISCHARGING) + val->intval = acpi_battery_handle_discharging(battery); + else if (battery->state & ACPI_BATTERY_STATE_CHARGING) +- val->intval = POWER_SUPPLY_STATUS_CHARGING; ++ /* Validate the status by checking the current. */ ++ if (battery->rate_now != ACPI_BATTERY_VALUE_UNKNOWN && ++ battery->rate_now == 0) { ++ /* On charge but no current (0W/0mA). */ ++ val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING; ++ } else { ++ val->intval = POWER_SUPPLY_STATUS_CHARGING; ++ } + else if (battery->state & ACPI_BATTERY_STATE_CHARGE_LIMITING) + val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING; + else if (acpi_battery_is_charged(battery)) +-- +2.51.0 + diff --git a/queue-6.18/acpi-processor-fix-null-pointer-dereference-in-acpi_.patch b/queue-6.18/acpi-processor-fix-null-pointer-dereference-in-acpi_.patch new file mode 100644 index 00000000000..4270cd54a19 --- /dev/null +++ b/queue-6.18/acpi-processor-fix-null-pointer-dereference-in-acpi_.patch @@ -0,0 +1,101 @@ +From 08fbd54d930b13f50884a6a9ceb9a6969b301415 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 00:32:14 +0800 +Subject: ACPI: processor: Fix NULL-pointer dereference in + acpi_processor_errata_piix4() + +From: Tuo Li + +[ Upstream commit f132e089fe89cadc2098991f0a3cb05c3f824ac6 ] + +In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE +device and then reassigned an ISA device: + + dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...); + dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...); + +If the first lookup succeeds but the second fails, dev becomes NULL. This +leads to a potential null-pointer dereference when dev_dbg() is called: + + if (errata.piix4.bmisx) + dev_dbg(&dev->dev, ...); + +To prevent this, use two temporary pointers and retrieve each device +independently, avoiding overwriting dev with a possible NULL value. + +Signed-off-by: Tuo Li +[ rjw: Subject adjustment, added an empty code line ] +Link: https://patch.msgid.link/20260111163214.202262-1-islituo@gmail.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpi_processor.c | 28 +++++++++++++++------------- + 1 file changed, 15 insertions(+), 13 deletions(-) + +diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c +index 7ec1dc04fd11b..85096ce7b658b 100644 +--- a/drivers/acpi/acpi_processor.c ++++ b/drivers/acpi/acpi_processor.c +@@ -50,6 +50,7 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev) + { + u8 value1 = 0; + u8 value2 = 0; ++ struct pci_dev *ide_dev = NULL, *isa_dev = NULL; + + + if (!dev) +@@ -107,12 +108,12 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev) + * each IDE controller's DMA status to make sure we catch all + * DMA activity. + */ +- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, ++ ide_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, + PCI_DEVICE_ID_INTEL_82371AB, + PCI_ANY_ID, PCI_ANY_ID, NULL); +- if (dev) { +- errata.piix4.bmisx = pci_resource_start(dev, 4); +- pci_dev_put(dev); ++ if (ide_dev) { ++ errata.piix4.bmisx = pci_resource_start(ide_dev, 4); ++ pci_dev_put(ide_dev); + } + + /* +@@ -124,24 +125,25 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev) + * disable C3 support if this is enabled, as some legacy + * devices won't operate well if fast DMA is disabled. + */ +- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, ++ isa_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, + PCI_DEVICE_ID_INTEL_82371AB_0, + PCI_ANY_ID, PCI_ANY_ID, NULL); +- if (dev) { +- pci_read_config_byte(dev, 0x76, &value1); +- pci_read_config_byte(dev, 0x77, &value2); ++ if (isa_dev) { ++ pci_read_config_byte(isa_dev, 0x76, &value1); ++ pci_read_config_byte(isa_dev, 0x77, &value2); + if ((value1 & 0x80) || (value2 & 0x80)) + errata.piix4.fdma = 1; +- pci_dev_put(dev); ++ pci_dev_put(isa_dev); + } + + break; + } + +- if (errata.piix4.bmisx) +- dev_dbg(&dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n"); +- if (errata.piix4.fdma) +- dev_dbg(&dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n"); ++ if (ide_dev) ++ dev_dbg(&ide_dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n"); ++ ++ if (isa_dev) ++ dev_dbg(&isa_dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n"); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.18/acpi-resource-add-jwipc-jvc9100-to-irq1_level_low_sk.patch b/queue-6.18/acpi-resource-add-jwipc-jvc9100-to-irq1_level_low_sk.patch new file mode 100644 index 00000000000..3aa956f84dd --- /dev/null +++ b/queue-6.18/acpi-resource-add-jwipc-jvc9100-to-irq1_level_low_sk.patch @@ -0,0 +1,56 @@ +From d6db05521a3a14b96f0fc28f5887588bf2ea9346 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 15:27:19 +0800 +Subject: ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] + +From: Ai Chao + +[ Upstream commit ba6ded26dffe511b862a98a25955955e7154bfa8 ] + +Like the JWIPC JVC9100 has its serial IRQ (10 and 11) described +as ActiveLow in the DSDT, which the kernel overrides to EdgeHigh which +breaks the serial. + +irq 10, level, active-low, shared, skip-override +irq 11, level, active-low, shared, skip-override + +Add the JVC9100 to the irq1_level_low_skip_override[] quirk table to fix +this. + +Signed-off-by: Ai Chao +Link: https://patch.msgid.link/20260113072719.4154485-1-aichao@kylinos.cn +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/resource.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c +index d16906f46484d..bc8050d8a6f51 100644 +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -532,6 +532,12 @@ static const struct dmi_system_id irq1_level_low_skip_override[] = { + DMI_MATCH(DMI_BOARD_NAME, "16T90SP"), + }, + }, ++ { ++ /* JWIPC JVC9100 */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "JVC9100"), ++ }, ++ }, + { } + }; + +@@ -706,6 +712,8 @@ struct irq_override_cmp { + + static const struct irq_override_cmp override_table[] = { + { irq1_level_low_skip_override, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, false }, ++ { irq1_level_low_skip_override, 10, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 1, false }, ++ { irq1_level_low_skip_override, 11, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 1, false }, + { irq1_edge_low_force_override, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, + }; + +-- +2.51.0 + diff --git a/queue-6.18/acpi-x86-force-enabling-of-pwm2-on-the-yogabook-yb1-.patch b/queue-6.18/acpi-x86-force-enabling-of-pwm2-on-the-yogabook-yb1-.patch new file mode 100644 index 00000000000..73cd9fa2a58 --- /dev/null +++ b/queue-6.18/acpi-x86-force-enabling-of-pwm2-on-the-yogabook-yb1-.patch @@ -0,0 +1,48 @@ +From fb0a979ee5185488228173c4ad6d98fb35b00943 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Feb 2026 00:22:42 +0200 +Subject: ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 + +From: Yauhen Kharuzhy + +[ Upstream commit a8c975302868c716afef0f50467bebbd069a35b8 ] + +The PWM2 on YB1-X90 tablets is used for keyboard backlight control but +it is disabled in the ACPI DSDT table. Add it to the override_status_ids +list to allow keyboard function control driver +(drivers/platform/x86/lenovo/yogabook.c) to use it. + +Signed-off-by: Yauhen Kharuzhy +Link: https://patch.msgid.link/20260211222242.4101162-1-jekhor@gmail.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/x86/utils.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c +index 4ee30c2897a2b..418951639f511 100644 +--- a/drivers/acpi/x86/utils.c ++++ b/drivers/acpi/x86/utils.c +@@ -81,6 +81,18 @@ static const struct override_status_id override_status_ids[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "Mipad2"), + }), + ++ /* ++ * Lenovo Yoga Book uses PWM2 for touch keyboard backlight control. ++ * It needs to be enabled only for the Android device version (YB1-X90* ++ * aka YETI-11); the Windows version (YB1-X91*) uses ACPI control ++ * methods. ++ */ ++ PRESENT_ENTRY_HID("80862289", "2", INTEL_ATOM_AIRMONT, { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "CHERRYVIEW D1 PLATFORM"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "YETI-11"), ++ }), ++ + /* + * The INT0002 device is necessary to clear wakeup interrupt sources + * on Cherry Trail devices, without it we get nobody cared IRQ msgs. +-- +2.51.0 + diff --git a/queue-6.18/acpi-x86-s2idle-invoke-microsoft-_dsm-function-9-tur.patch b/queue-6.18/acpi-x86-s2idle-invoke-microsoft-_dsm-function-9-tur.patch new file mode 100644 index 00000000000..62cc8c574cb --- /dev/null +++ b/queue-6.18/acpi-x86-s2idle-invoke-microsoft-_dsm-function-9-tur.patch @@ -0,0 +1,80 @@ +From e42212e112e51c164ae4308e0707fb2f31b87d96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 21:01:21 +0100 +Subject: ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) + +From: Jakob Riemenschneider + +[ Upstream commit 229ecbaac6b31f89c554b77eb407377a5eade7d4 ] + +Windows 11, version 22H2 introduced a new function index (Function 9) to +the Microsoft LPS0 _DSM, titled "Turn On Display Notification". + +According to Microsoft documentation, this function signals to the system +firmware that the OS intends to turn on the display when exiting Modern +Standby. This allows the firmware to release Power Limits (PLx) earlier. + +Crucially, this patch fixes a functional issue observed on the Lenovo Yoga +Slim 7i Aura (15ILL9), where system fans and keyboard backlights fail to +resume after suspend. Investigation linked shows the EC on this device +turns off these components during sleep but requires the Function 9 +notification to wake them up again. + +This patch defines the new function index (ACPI_MS_TURN_ON_DISPLAY) and +invokes it in acpi_s2idle_restore_early_lps0(). The execution order is +updated to match the logic of an "intent" signal: + + 1. LPS0 Exit (Function 6) + 2. Turn On Display Intent (Function 9) + 3. Modern Standby Exit (Function 8) + 4. Screen On (Function 4) + +Invoking Function 9 before the Modern Standby Exit ensures the firmware +has time to restore power rails and functionality (like fans) before the +software fully exits the sleep state. + +Link: https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/modern-standby-firmware-notifications#turn-on-display-notification-function-9 +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220505 +Suggested-by: Antheas Kapenekakis +Signed-off-by: Jakob Riemenschneider +Link: https://patch.msgid.link/20260127200121.1292216-1-riemenschneiderjakob@gmail.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/x86/s2idle.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/acpi/x86/s2idle.c b/drivers/acpi/x86/s2idle.c +index dd0b40b9bbe8b..377a268867c21 100644 +--- a/drivers/acpi/x86/s2idle.c ++++ b/drivers/acpi/x86/s2idle.c +@@ -45,6 +45,7 @@ static const struct acpi_device_id lps0_device_ids[] = { + #define ACPI_LPS0_EXIT 6 + #define ACPI_LPS0_MS_ENTRY 7 + #define ACPI_LPS0_MS_EXIT 8 ++#define ACPI_MS_TURN_ON_DISPLAY 9 + + /* AMD */ + #define ACPI_LPS0_DSM_UUID_AMD "e3f32452-febc-43ce-9039-932122d37721" +@@ -373,6 +374,8 @@ static const char *acpi_sleep_dsm_state_to_str(unsigned int state) + return "lps0 ms entry"; + case ACPI_LPS0_MS_EXIT: + return "lps0 ms exit"; ++ case ACPI_MS_TURN_ON_DISPLAY: ++ return "lps0 ms turn on display"; + } + } else { + switch (state) { +@@ -619,6 +622,9 @@ void acpi_s2idle_restore_early(void) + if (lps0_dsm_func_mask_microsoft > 0) { + acpi_sleep_run_lps0_dsm(ACPI_LPS0_EXIT, + lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft); ++ /* Intent to turn on display */ ++ acpi_sleep_run_lps0_dsm(ACPI_MS_TURN_ON_DISPLAY, ++ lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft); + /* Modern Standby exit */ + acpi_sleep_run_lps0_dsm(ACPI_LPS0_MS_EXIT, + lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft); +-- +2.51.0 + diff --git a/queue-6.18/acpica-abort-aml-bytecode-execution-when-executing-a.patch b/queue-6.18/acpica-abort-aml-bytecode-execution-when-executing-a.patch new file mode 100644 index 00000000000..eeafbd45265 --- /dev/null +++ b/queue-6.18/acpica-abort-aml-bytecode-execution-when-executing-a.patch @@ -0,0 +1,129 @@ +From 0fc87ea7500d31500424e1e0558523a0ef1d72a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 13:25:33 +0100 +Subject: ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP + +From: Armin Wolf + +[ Upstream commit 026ad376a6a48538b576f3589331daa94daae6f0 ] + +The ACPI specification states that when executing AML_FATAL_OP, +the OS should log the fatal error event and shutdown in a timely +fashion. + +Windows complies with this requirement by immediatly entering a +Bso_d, effectively aborting the execution of the AML bytecode in +question. + +ACPICA however might continue with the AML bytecode execution +should acpi_os_signal() simply return AE_OK. This will cause issues +because ACPI BIOS implementations might assume that the Fatal() +operator does not return. + +Fix this by aborting the AML bytecode execution in such a case +by returning AE_ERROR. Also turn struct acpi_signal_fatal_info into a +local variable because of its small size (12 bytes) and to ensure +that acpi_os_signal() always receives valid information about the +fatal ACPI BIOS error. + +Link: https://github.com/acpica/acpica/commit/d516c7758ba6 +Signed-off-by: Armin Wolf +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/3325491.5fSG56mABF@rafael.j.wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/exoparg3.c | 46 +++++++++++++--------------------- + 1 file changed, 18 insertions(+), 28 deletions(-) + +diff --git a/drivers/acpi/acpica/exoparg3.c b/drivers/acpi/acpica/exoparg3.c +index bf08110ed6d25..c8c8c4e49563e 100644 +--- a/drivers/acpi/acpica/exoparg3.c ++++ b/drivers/acpi/acpica/exoparg3.c +@@ -10,6 +10,7 @@ + #include + #include "accommon.h" + #include "acinterp.h" ++#include + #include "acparser.h" + #include "amlcode.h" + +@@ -51,8 +52,7 @@ ACPI_MODULE_NAME("exoparg3") + acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state) + { + union acpi_operand_object **operand = &walk_state->operands[0]; +- struct acpi_signal_fatal_info *fatal; +- acpi_status status = AE_OK; ++ struct acpi_signal_fatal_info fatal; + + ACPI_FUNCTION_TRACE_STR(ex_opcode_3A_0T_0R, + acpi_ps_get_opcode_name(walk_state->opcode)); +@@ -60,28 +60,23 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state) + switch (walk_state->opcode) { + case AML_FATAL_OP: /* Fatal (fatal_type fatal_code fatal_arg) */ + +- ACPI_DEBUG_PRINT((ACPI_DB_INFO, +- "FatalOp: Type %X Code %X Arg %X " +- "<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n", +- (u32)operand[0]->integer.value, +- (u32)operand[1]->integer.value, +- (u32)operand[2]->integer.value)); +- +- fatal = ACPI_ALLOCATE(sizeof(struct acpi_signal_fatal_info)); +- if (fatal) { +- fatal->type = (u32) operand[0]->integer.value; +- fatal->code = (u32) operand[1]->integer.value; +- fatal->argument = (u32) operand[2]->integer.value; +- } ++ fatal.type = (u32)operand[0]->integer.value; ++ fatal.code = (u32)operand[1]->integer.value; ++ fatal.argument = (u32)operand[2]->integer.value; + +- /* Always signal the OS! */ ++ ACPI_BIOS_ERROR((AE_INFO, ++ "Fatal ACPI BIOS error (Type 0x%X Code 0x%X Arg 0x%X)\n", ++ fatal.type, fatal.code, fatal.argument)); + +- status = acpi_os_signal(ACPI_SIGNAL_FATAL, fatal); ++ /* Always signal the OS! */ + +- /* Might return while OS is shutting down, just continue */ ++ acpi_os_signal(ACPI_SIGNAL_FATAL, &fatal); + +- ACPI_FREE(fatal); +- goto cleanup; ++ /* ++ * Might return while OS is shutting down, so abort the AML execution ++ * by returning an error. ++ */ ++ return_ACPI_STATUS(AE_ERROR); + + case AML_EXTERNAL_OP: + /* +@@ -93,21 +88,16 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state) + * wrong if an external opcode ever gets here. + */ + ACPI_ERROR((AE_INFO, "Executed External Op")); +- status = AE_OK; +- goto cleanup; ++ ++ return_ACPI_STATUS(AE_OK); + + default: + + ACPI_ERROR((AE_INFO, "Unknown AML opcode 0x%X", + walk_state->opcode)); + +- status = AE_AML_BAD_OPCODE; +- goto cleanup; ++ return_ACPI_STATUS(AE_AML_BAD_OPCODE); + } +- +-cleanup: +- +- return_ACPI_STATUS(status); + } + + /******************************************************************************* +-- +2.51.0 + diff --git a/queue-6.18/alpha-fix-user-space-corruption-during-memory-compac.patch b/queue-6.18/alpha-fix-user-space-corruption-during-memory-compac.patch new file mode 100644 index 00000000000..e40e7ec3ba5 --- /dev/null +++ b/queue-6.18/alpha-fix-user-space-corruption-during-memory-compac.patch @@ -0,0 +1,260 @@ +From 80504fea45d9e98ebcd7b499ecb3fd38c90f3b8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jan 2026 18:30:43 +0100 +Subject: alpha: fix user-space corruption during memory compaction + +From: Magnus Lindholm + +[ Upstream commit dd5712f3379cfe760267cdd28ff957d9ab4e51c7 ] + +Alpha systems can suffer sporadic user-space crashes and heap +corruption when memory compaction is enabled. + +Symptoms include SIGSEGV, glibc allocator failures (e.g. "unaligned +tcache chunk"), and compiler internal errors. The failures disappear +when compaction is disabled or when using global TLB invalidation. + +The root cause is insufficient TLB shootdown during page migration. +Alpha relies on ASN-based MM context rollover for instruction cache +coherency, but this alone is not sufficient to prevent stale data or +instruction translations from surviving migration. + +Fix this by introducing a migration-specific helper that combines: + - MM context invalidation (ASN rollover), + - immediate per-CPU TLB invalidation (TBI), + - synchronous cross-CPU shootdown when required. + +The helper is used only by migration/compaction paths to avoid changing +global TLB semantics. + +Additionally, update flush_tlb_other(), pte_clear(), to use +READ_ONCE()/WRITE_ONCE() for correct SMP memory ordering. + +This fixes observed crashes on both UP and SMP Alpha systems. + +Reviewed-by: Ivan Kokshaysky +Tested-by: Matoro Mahri +Tested-by: Michael Cree +Signed-off-by: Magnus Lindholm +Link: https://lore.kernel.org/r/20260102173603.18247-2-linmag7@gmail.com +Signed-off-by: Magnus Lindholm +Signed-off-by: Sasha Levin +--- + arch/alpha/include/asm/pgtable.h | 33 ++++++++- + arch/alpha/include/asm/tlbflush.h | 4 +- + arch/alpha/mm/Makefile | 2 +- + arch/alpha/mm/tlbflush.c | 112 ++++++++++++++++++++++++++++++ + 4 files changed, 148 insertions(+), 3 deletions(-) + create mode 100644 arch/alpha/mm/tlbflush.c + +diff --git a/arch/alpha/include/asm/pgtable.h b/arch/alpha/include/asm/pgtable.h +index 90e7a95391022..c9508ec37efc4 100644 +--- a/arch/alpha/include/asm/pgtable.h ++++ b/arch/alpha/include/asm/pgtable.h +@@ -17,6 +17,7 @@ + #include /* For TASK_SIZE */ + #include + #include ++#include + + struct mm_struct; + struct vm_area_struct; +@@ -183,6 +184,9 @@ extern inline void pud_set(pud_t * pudp, pmd_t * pmdp) + { pud_val(*pudp) = _PAGE_TABLE | ((((unsigned long) pmdp) - PAGE_OFFSET) << (32-PAGE_SHIFT)); } + + ++extern void migrate_flush_tlb_page(struct vm_area_struct *vma, ++ unsigned long addr); ++ + extern inline unsigned long + pmd_page_vaddr(pmd_t pmd) + { +@@ -202,7 +206,7 @@ extern inline int pte_none(pte_t pte) { return !pte_val(pte); } + extern inline int pte_present(pte_t pte) { return pte_val(pte) & _PAGE_VALID; } + extern inline void pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep) + { +- pte_val(*ptep) = 0; ++ WRITE_ONCE(pte_val(*ptep), 0); + } + + extern inline int pmd_none(pmd_t pmd) { return !pmd_val(pmd); } +@@ -264,6 +268,33 @@ extern inline pte_t * pte_offset_kernel(pmd_t * dir, unsigned long address) + + extern pgd_t swapper_pg_dir[1024]; + ++#ifdef CONFIG_COMPACTION ++#define __HAVE_ARCH_PTEP_GET_AND_CLEAR ++ ++static inline pte_t ptep_get_and_clear(struct mm_struct *mm, ++ unsigned long address, ++ pte_t *ptep) ++{ ++ pte_t pte = READ_ONCE(*ptep); ++ ++ pte_clear(mm, address, ptep); ++ return pte; ++} ++ ++#define __HAVE_ARCH_PTEP_CLEAR_FLUSH ++ ++static inline pte_t ptep_clear_flush(struct vm_area_struct *vma, ++ unsigned long addr, pte_t *ptep) ++{ ++ struct mm_struct *mm = vma->vm_mm; ++ pte_t pte = ptep_get_and_clear(mm, addr, ptep); ++ ++ page_table_check_pte_clear(mm, pte); ++ migrate_flush_tlb_page(vma, addr); ++ return pte; ++} ++ ++#endif + /* + * The Alpha doesn't have any external MMU info: the kernel page + * tables contain all the necessary information. +diff --git a/arch/alpha/include/asm/tlbflush.h b/arch/alpha/include/asm/tlbflush.h +index ba4b359d6c395..0c8529997f54e 100644 +--- a/arch/alpha/include/asm/tlbflush.h ++++ b/arch/alpha/include/asm/tlbflush.h +@@ -58,7 +58,9 @@ flush_tlb_other(struct mm_struct *mm) + unsigned long *mmc = &mm->context[smp_processor_id()]; + /* Check it's not zero first to avoid cacheline ping pong + when possible. */ +- if (*mmc) *mmc = 0; ++ ++ if (READ_ONCE(*mmc)) ++ WRITE_ONCE(*mmc, 0); + } + + #ifndef CONFIG_SMP +diff --git a/arch/alpha/mm/Makefile b/arch/alpha/mm/Makefile +index 101dbd06b4ceb..2d05664058f64 100644 +--- a/arch/alpha/mm/Makefile ++++ b/arch/alpha/mm/Makefile +@@ -3,4 +3,4 @@ + # Makefile for the linux alpha-specific parts of the memory manager. + # + +-obj-y := init.o fault.o ++obj-y := init.o fault.o tlbflush.o +diff --git a/arch/alpha/mm/tlbflush.c b/arch/alpha/mm/tlbflush.c +new file mode 100644 +index 0000000000000..ccbc317b9a348 +--- /dev/null ++++ b/arch/alpha/mm/tlbflush.c +@@ -0,0 +1,112 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* ++ * Alpha TLB shootdown helpers ++ * ++ * Copyright (C) 2025 Magnus Lindholm ++ * ++ * Alpha-specific TLB flush helpers that cannot be expressed purely ++ * as inline functions. ++ * ++ * These helpers provide combined MM context handling (ASN rollover) ++ * and immediate TLB invalidation for page migration and memory ++ * compaction paths, where lazy shootdowns are insufficient. ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#define asn_locked() (cpu_data[smp_processor_id()].asn_lock) ++ ++/* ++ * Migration/compaction helper: combine mm context (ASN) handling with an ++ * immediate per-page TLB invalidate and (for exec) an instruction barrier. ++ * ++ * This mirrors the SMP combined IPI handler semantics, but runs locally on UP. ++ */ ++#ifndef CONFIG_SMP ++void migrate_flush_tlb_page(struct vm_area_struct *vma, ++ unsigned long addr) ++{ ++ struct mm_struct *mm = vma->vm_mm; ++ int tbi_type = (vma->vm_flags & VM_EXEC) ? 3 : 2; ++ ++ /* ++ * First do the mm-context side: ++ * If we're currently running this mm, reload a fresh context ASN. ++ * Otherwise, mark context invalid. ++ * ++ * On UP, this is mostly about matching the SMP semantics and ensuring ++ * exec/i-cache tagging assumptions hold when compaction migrates pages. ++ */ ++ if (mm == current->active_mm) ++ flush_tlb_current(mm); ++ else ++ flush_tlb_other(mm); ++ ++ /* ++ * Then do the immediate translation kill for this VA. ++ * For exec mappings, order instruction fetch after invalidation. ++ */ ++ tbi(tbi_type, addr); ++} ++ ++#else ++struct tlb_mm_and_addr { ++ struct mm_struct *mm; ++ unsigned long addr; ++ int tbi_type; /* 2 = DTB, 3 = ITB+DTB */ ++}; ++ ++static void ipi_flush_mm_and_page(void *x) ++{ ++ struct tlb_mm_and_addr *d = x; ++ ++ /* Part 1: mm context side (Alpha uses ASN/context as a key mechanism). */ ++ if (d->mm == current->active_mm && !asn_locked()) ++ __load_new_mm_context(d->mm); ++ else ++ flush_tlb_other(d->mm); ++ ++ /* Part 2: immediate per-VA invalidation on this CPU. */ ++ tbi(d->tbi_type, d->addr); ++} ++ ++void migrate_flush_tlb_page(struct vm_area_struct *vma, unsigned long addr) ++{ ++ struct mm_struct *mm = vma->vm_mm; ++ struct tlb_mm_and_addr d = { ++ .mm = mm, ++ .addr = addr, ++ .tbi_type = (vma->vm_flags & VM_EXEC) ? 3 : 2, ++ }; ++ ++ /* ++ * One synchronous rendezvous: every CPU runs ipi_flush_mm_and_page(). ++ * This is the "combined" version of flush_tlb_mm + per-page invalidate. ++ */ ++ preempt_disable(); ++ on_each_cpu(ipi_flush_mm_and_page, &d, 1); ++ ++ /* ++ * mimic flush_tlb_mm()'s mm_users<=1 optimization. ++ */ ++ if (atomic_read(&mm->mm_users) <= 1) { ++ ++ int cpu, this_cpu; ++ this_cpu = smp_processor_id(); ++ ++ for (cpu = 0; cpu < NR_CPUS; cpu++) { ++ if (!cpu_online(cpu) || cpu == this_cpu) ++ continue; ++ if (READ_ONCE(mm->context[cpu])) ++ WRITE_ONCE(mm->context[cpu], 0); ++ } ++ } ++ preempt_enable(); ++} ++ ++#endif +-- +2.51.0 + diff --git a/queue-6.18/alsa-hda-conexant-add-headset-mic-fix-for-mechrevo-w.patch b/queue-6.18/alsa-hda-conexant-add-headset-mic-fix-for-mechrevo-w.patch new file mode 100644 index 00000000000..374c75dbae8 --- /dev/null +++ b/queue-6.18/alsa-hda-conexant-add-headset-mic-fix-for-mechrevo-w.patch @@ -0,0 +1,36 @@ +From 0e6ea2eb32f1158e6e85c0004806d69c20e1ec0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 23:55:01 +0800 +Subject: ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro + +From: gongqi <550230171hxy@gmail.com> + +[ Upstream commit f2581ea2d9f30844c437e348a462027ea25c12e9 ] + +The headset microphone on the MECHREVO Wujie 15X Pro requires the +CXT_FIXUP_HEADSET_MIC quirk to function properly. Add the PCI SSID +(0x1d05:0x3012) to the quirk table. + +Signed-off-by: gongqi <550230171hxy@gmail.com> +Link: https://patch.msgid.link/20260122155501.376199-5-550230171hxy@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/codecs/conexant.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/hda/codecs/conexant.c b/sound/hda/codecs/conexant.c +index 0c517378a6d28..f71123a475464 100644 +--- a/sound/hda/codecs/conexant.c ++++ b/sound/hda/codecs/conexant.c +@@ -1134,6 +1134,7 @@ static const struct hda_quirk cxt5066_fixups[] = { + SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad/Ideapad", CXT_FIXUP_LENOVO_XPAD_ACPI), + SND_PCI_QUIRK(0x1c06, 0x2011, "Lemote A1004", CXT_PINCFG_LEMOTE_A1004), + SND_PCI_QUIRK(0x1c06, 0x2012, "Lemote A1205", CXT_PINCFG_LEMOTE_A1205), ++ SND_PCI_QUIRK(0x1d05, 0x3012, "MECHREVO Wujie 15X Pro", CXT_FIXUP_HEADSET_MIC), + HDA_CODEC_QUIRK(0x2782, 0x12c3, "Sirius Gen1", CXT_PINCFG_TOP_SPEAKER), + HDA_CODEC_QUIRK(0x2782, 0x12c5, "Sirius Gen2", CXT_PINCFG_TOP_SPEAKER), + {} +-- +2.51.0 + diff --git a/queue-6.18/alsa-hda-hdmi-add-quirk-for-tuxedo-ibs14g6.patch b/queue-6.18/alsa-hda-hdmi-add-quirk-for-tuxedo-ibs14g6.patch new file mode 100644 index 00000000000..a66b34036a7 --- /dev/null +++ b/queue-6.18/alsa-hda-hdmi-add-quirk-for-tuxedo-ibs14g6.patch @@ -0,0 +1,37 @@ +From 0ad864a57fdd6da36d713f9d0d3867a49c69b48d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Feb 2026 22:32:10 +0100 +Subject: ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 + +From: Aaron Erhardt + +[ Upstream commit d649c58bcad8fb9b749e3837136a201632fa109d ] + +Depending on the timing during boot, the BIOS might report wrong pin +capabilities, which can lead to HDMI audio being disabled. Therefore, +force HDMI audio connection on TUXEDO InfinityBook S 14 Gen6. + +Signed-off-by: Aaron Erhardt +Signed-off-by: Werner Sembach +Link: https://patch.msgid.link/20260218213234.429686-1-wse@tuxedocomputers.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/codecs/hdmi/hdmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/hda/codecs/hdmi/hdmi.c b/sound/hda/codecs/hdmi/hdmi.c +index 111c9b5335afc..c2e3adc7b3c00 100644 +--- a/sound/hda/codecs/hdmi/hdmi.c ++++ b/sound/hda/codecs/hdmi/hdmi.c +@@ -1557,6 +1557,7 @@ static const struct snd_pci_quirk force_connect_list[] = { + SND_PCI_QUIRK(0x1043, 0x86ae, "ASUS", 1), /* Z170 PRO */ + SND_PCI_QUIRK(0x1043, 0x86c7, "ASUS", 1), /* Z170M PLUS */ + SND_PCI_QUIRK(0x1462, 0xec94, "MS-7C94", 1), ++ SND_PCI_QUIRK(0x1558, 0x14a1, "TUXEDO InfinityBook S 14 Gen6", 1), + SND_PCI_QUIRK(0x8086, 0x2060, "Intel NUC5CPYB", 1), + SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", 1), + {} +-- +2.51.0 + diff --git a/queue-6.18/alsa-hda-realtek-add-hp-victus-16-e0xxx-mute-led-qui.patch b/queue-6.18/alsa-hda-realtek-add-hp-victus-16-e0xxx-mute-led-qui.patch new file mode 100644 index 00000000000..b9c2ff95a1a --- /dev/null +++ b/queue-6.18/alsa-hda-realtek-add-hp-victus-16-e0xxx-mute-led-qui.patch @@ -0,0 +1,80 @@ +From 1743ca4241fdf8a80f9736f9b35c7510ed12dbd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 00:12:40 +0530 +Subject: ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk + +From: Bharat Dev Burman + +[ Upstream commit 72919c57a055f6d7b79d66731dc398e9b433f47c ] + +HP Victus 16-e0xxx with ALC245 codec does not handle the toggling of +the mute LED. +This patch adds a quirk entry for subsystem ID 0x88eb using a new +ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT fixup, enabling correct mute LED +behavior. + +Signed-off-by: Bharat Dev Burman +Link: https://patch.msgid.link/20260112184253.33376-1-bharat.singh7924@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/codecs/realtek/alc269.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c +index 66da4584aa7a5..48edf55621854 100644 +--- a/sound/hda/codecs/realtek/alc269.c ++++ b/sound/hda/codecs/realtek/alc269.c +@@ -1551,6 +1551,22 @@ static void alc245_fixup_hp_mute_led_v1_coefbit(struct hda_codec *codec, + } + } + ++static void alc245_fixup_hp_mute_led_v2_coefbit(struct hda_codec *codec, ++ const struct hda_fixup *fix, ++ int action) ++{ ++ struct alc_spec *spec = codec->spec; ++ ++ if (action == HDA_FIXUP_ACT_PRE_PROBE) { ++ spec->mute_led_polarity = 0; ++ spec->mute_led_coef.idx = 0x0b; ++ spec->mute_led_coef.mask = 1 << 3; ++ spec->mute_led_coef.on = 1 << 3; ++ spec->mute_led_coef.off = 0; ++ snd_hda_gen_add_mute_led_cdev(codec, coef_mute_led_set); ++ } ++} ++ + /* turn on/off mic-mute LED per capture hook by coef bit */ + static int coef_micmute_led_set(struct led_classdev *led_cdev, + enum led_brightness brightness) +@@ -3719,6 +3735,7 @@ enum { + ALC287_FIXUP_YOGA7_14ARB7_I2C, + ALC245_FIXUP_HP_MUTE_LED_COEFBIT, + ALC245_FIXUP_HP_MUTE_LED_V1_COEFBIT, ++ ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT, + ALC245_FIXUP_HP_X360_MUTE_LEDS, + ALC287_FIXUP_THINKPAD_I2S_SPK, + ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD, +@@ -6047,6 +6064,10 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc245_fixup_hp_mute_led_v1_coefbit, + }, ++ [ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc245_fixup_hp_mute_led_v2_coefbit, ++ }, + [ALC245_FIXUP_HP_X360_MUTE_LEDS] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc245_fixup_hp_mute_led_coefbit, +@@ -6520,6 +6541,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x8898, "HP EliteBook 845 G8 Notebook PC", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x103c, 0x88d0, "HP Pavilion 15-eh1xxx (mainboard 88D0)", ALC287_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x88dd, "HP Pavilion 15z-ec200", ALC285_FIXUP_HP_MUTE_LED), ++ SND_PCI_QUIRK(0x103c, 0x88eb, "HP Victus 16-e0xxx", ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT), + SND_PCI_QUIRK(0x103c, 0x8902, "HP OMEN 16", ALC285_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x890e, "HP 255 G8 Notebook PC", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2), + SND_PCI_QUIRK(0x103c, 0x8919, "HP Pavilion Aero Laptop 13-be0xxx", ALC287_FIXUP_HP_GPIO_LED), +-- +2.51.0 + diff --git a/queue-6.18/alsa-hda-realtek-enable-mute-leds-on-hp-envy-x360-15.patch b/queue-6.18/alsa-hda-realtek-enable-mute-leds-on-hp-envy-x360-15.patch new file mode 100644 index 00000000000..33c1b531eaf --- /dev/null +++ b/queue-6.18/alsa-hda-realtek-enable-mute-leds-on-hp-envy-x360-15.patch @@ -0,0 +1,72 @@ +From 721dbc0a8f4b32cce2302377e355481059be8085 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Feb 2026 23:19:37 +0100 +Subject: ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx + +From: Illia Barbashyn <04baril@gmail.com> + +[ Upstream commit ac1ff574bbc09a6c90f4fe8f9e6b8d66c983064c ] + +The mute and mic-mute LEDs on HP ENVY x360 Convertible 15-es0xxx +(PCI SSID 103c:88b3) do not work with the current driver. + +This model requires a combination of COEFBIT and GPIO fixups to +correctly control the LEDs. Introduce a new fixup function +alc245_fixup_hp_envy_x360_mute_led and add a quirk to apply it. + +Signed-off-by: Illia Barbashyn <04baril@gmail.com> +Link: https://patch.msgid.link/20260207221955.24132-1-04baril@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/codecs/realtek/alc269.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c +index 138570d2da68e..553ffed048ea7 100644 +--- a/sound/hda/codecs/realtek/alc269.c ++++ b/sound/hda/codecs/realtek/alc269.c +@@ -1646,6 +1646,13 @@ static void alc285_fixup_hp_spectre_x360_mute_led(struct hda_codec *codec, + alc285_fixup_hp_gpio_micmute_led(codec, fix, action); + } + ++static void alc245_fixup_hp_envy_x360_mute_led(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ alc245_fixup_hp_mute_led_v1_coefbit(codec, fix, action); ++ alc245_fixup_hp_gpio_led(codec, fix, action); ++} ++ + static void alc236_fixup_hp_mute_led(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { +@@ -3810,6 +3817,7 @@ enum { + ALC285_FIXUP_HP_GPIO_LED, + ALC285_FIXUP_HP_MUTE_LED, + ALC285_FIXUP_HP_SPECTRE_X360_MUTE_LED, ++ ALC245_FIXUP_HP_ENVY_X360_MUTE_LED, + ALC285_FIXUP_HP_BEEP_MICMUTE_LED, + ALC236_FIXUP_HP_MUTE_LED_COEFBIT2, + ALC236_FIXUP_HP_GPIO_LED, +@@ -5460,6 +5468,10 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_hp_spectre_x360_mute_led, + }, ++ [ALC245_FIXUP_HP_ENVY_X360_MUTE_LED] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc245_fixup_hp_envy_x360_mute_led, ++ }, + [ALC285_FIXUP_HP_BEEP_MICMUTE_LED] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_hp_beep, +@@ -6708,6 +6720,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x8895, "HP EliteBook 855 G8 Notebook PC", ALC285_FIXUP_HP_SPEAKERS_MICMUTE_LED), + SND_PCI_QUIRK(0x103c, 0x8896, "HP EliteBook 855 G8 Notebook PC", ALC285_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x8898, "HP EliteBook 845 G8 Notebook PC", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST), ++ SND_PCI_QUIRK(0x103c, 0x88b3, "HP ENVY x360 Convertible 15-es0xxx", ALC245_FIXUP_HP_ENVY_X360_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x88d0, "HP Pavilion 15-eh1xxx (mainboard 88D0)", ALC287_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x88dd, "HP Pavilion 15z-ec200", ALC285_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x88eb, "HP Victus 16-e0xxx", ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT), +-- +2.51.0 + diff --git a/queue-6.18/alsa-hda-realtek-fix-headset-mic-on-asus-zenbook-14-.patch b/queue-6.18/alsa-hda-realtek-fix-headset-mic-on-asus-zenbook-14-.patch new file mode 100644 index 00000000000..0da13326eda --- /dev/null +++ b/queue-6.18/alsa-hda-realtek-fix-headset-mic-on-asus-zenbook-14-.patch @@ -0,0 +1,69 @@ +From fbb4cf91fc9d54716cf1bb8cc2b482521dfd2c3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Feb 2026 17:21:12 +0700 +Subject: ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 UX3405MA + +From: Erik Sanjaya + +[ Upstream commit 91062e119b4eafde553c894ca072cd615a6dae2e ] + +The ASUS Zenbook 14 UX3405MA uses an ALC294 codec with CS35L41 +amplifiers over SPI. The existing quirk for this model only configured +the amplifiers, leaving the headset microphone on the combo jack +non-functional. + +Introduce a new fixup that configures pin 0x19 as headset mic input +and chains to ALC245_FIXUP_CS35L41_SPI_2 to preserve speaker +functionality. + +Similar to the fix done for the UM3406HA in commit 018f659753fd +("ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14"). + +Signed-off-by: Erik Sanjaya +Link: https://patch.msgid.link/20260217102112.20651-1-sirreidlos@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/codecs/realtek/alc269.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c +index 553ffed048ea7..6d3d464f1f6c6 100644 +--- a/sound/hda/codecs/realtek/alc269.c ++++ b/sound/hda/codecs/realtek/alc269.c +@@ -3777,6 +3777,7 @@ enum { + ALC294_FIXUP_ASUS_MIC, + ALC294_FIXUP_ASUS_HEADSET_MIC, + ALC294_FIXUP_ASUS_I2C_HEADSET_MIC, ++ ALC294_FIXUP_ASUS_SPI_HEADSET_MIC, + ALC294_FIXUP_ASUS_SPK, + ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE, + ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE, +@@ -5121,6 +5122,15 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC287_FIXUP_CS35L41_I2C_2 + }, ++ [ALC294_FIXUP_ASUS_SPI_HEADSET_MIC] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x04a11020 }, /* use as headset mic */ ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC245_FIXUP_CS35L41_SPI_2 ++ }, + [ALC294_FIXUP_ASUS_SPK] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb[]) { +@@ -7027,7 +7037,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x19ce, "ASUS B9450FA", ALC294_FIXUP_ASUS_HPE), + SND_PCI_QUIRK(0x1043, 0x19e1, "ASUS UX581LV", ALC295_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW), +- SND_PCI_QUIRK(0x1043, 0x1a63, "ASUS UX3405MA", ALC245_FIXUP_CS35L41_SPI_2), ++ SND_PCI_QUIRK(0x1043, 0x1a63, "ASUS UX3405MA", ALC294_FIXUP_ASUS_SPI_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x1a83, "ASUS UM5302LA", ALC294_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x1043, 0x1a8e, "ASUS G712LWS", ALC294_FIXUP_LENOVO_MIC_LOCATION), + SND_PCI_QUIRK(0x1043, 0x1a8f, "ASUS UX582ZS", ALC245_FIXUP_CS35L41_SPI_2), +-- +2.51.0 + diff --git a/queue-6.18/alsa-hda-realtek-fix-lg-gram-style-14-speakers.patch b/queue-6.18/alsa-hda-realtek-fix-lg-gram-style-14-speakers.patch new file mode 100644 index 00000000000..71727df6d20 --- /dev/null +++ b/queue-6.18/alsa-hda-realtek-fix-lg-gram-style-14-speakers.patch @@ -0,0 +1,238 @@ +From e6641524278dff45e10a6659c8d305245f715df3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 18:14:52 +0100 +Subject: ALSA: hda/realtek: fix LG Gram Style 14 speakers + +From: Damien Dagorn + +[ Upstream commit cc051fbd7f40226cc407558bc97c5099513e8657 ] + +The LG Gram Style 14 (14Z90RS-G.AD77F, SSID 1854:0490) with Realtek ALC298 +shows normal routing and volume changes, but internal speakers stay silent +unless a userland HDA-verb workaround is applied. + +Add a dedicated quirk for the LG Gram Style 14 that programs the codec +coefficient sequence used by the known workaround and enables the speaker +amps only during playback. + +Tested-by: Damien Dagorn +Signed-off-by: Damien Dagorn +Link: https://lore.kernel.org/CAN59QMUhd4kHrkRoJA6VzEr2VKezN2yjHnANaQoZn2-Bnwe3bQ@mail.gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/codecs/realtek/alc269.c | 170 ++++++++++++++++++++++++++++++ + 1 file changed, 170 insertions(+) + +diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c +index 48edf55621854..138570d2da68e 100644 +--- a/sound/hda/codecs/realtek/alc269.c ++++ b/sound/hda/codecs/realtek/alc269.c +@@ -1828,6 +1828,163 @@ static void alc298_samsung_v2_init_amps(struct hda_codec *codec, + spec->gen.pcm_playback_hook = alc298_samsung_v2_playback_hook; + } + ++/* LG Gram Style 14: program vendor coef sequence used by HDA-verb workaround */ ++struct alc298_lg_gram_style_seq { ++ unsigned short verb; ++ unsigned short idx; ++ unsigned short val; ++}; ++ ++static void alc298_lg_gram_style_coef_write(struct hda_codec *codec, ++ unsigned int verb, ++ unsigned int idx, ++ unsigned int val) ++{ ++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_COEF_INDEX, 0x23); ++ snd_hda_codec_write(codec, 0x20, 0, verb, idx); ++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_PROC_COEF, 0x00); ++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_PROC_COEF, val); ++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_PROC_COEF, 0xb011); ++} ++ ++static void alc298_lg_gram_style_run_seq(struct hda_codec *codec, ++ const struct alc298_lg_gram_style_seq *seq, ++ int seq_size) ++{ ++ int i; ++ ++ for (i = 0; i < seq_size; i++) ++ alc298_lg_gram_style_coef_write(codec, seq[i].verb, ++ seq[i].idx, seq[i].val); ++} ++ ++/* Coef sequences derived from the HDA-verb workaround for this model. */ ++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_preinit_seq[] = { ++ { 0x420, 0x00, 0x01 }, ++}; ++ ++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_disable_seq[] = { ++ { 0x423, 0xff, 0x00 }, ++ { 0x420, 0x3a, 0x80 }, ++}; ++ ++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_enable_seq[] = { ++ { 0x420, 0x3a, 0x81 }, ++ { 0x423, 0xff, 0x01 }, ++}; ++ ++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_38[] = { ++ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 }, ++ { 0x420, 0x1b, 0x01 }, { 0x420, 0x1d, 0x01 }, { 0x420, 0x1f, 0xfe }, ++ { 0x420, 0x21, 0x00 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 }, ++ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e }, ++ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0x99, 0x03 }, ++ { 0x423, 0xa4, 0xb5 }, { 0x423, 0xa5, 0x01 }, { 0x423, 0xba, 0x94 }, ++}; ++ ++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_39[] = { ++ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 }, ++ { 0x420, 0x1b, 0x02 }, { 0x420, 0x1d, 0x02 }, { 0x420, 0x1f, 0xfd }, ++ { 0x420, 0x21, 0x01 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 }, ++ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e }, ++ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0x99, 0x03 }, ++ { 0x423, 0xa4, 0xb5 }, { 0x423, 0xa5, 0x01 }, { 0x423, 0xba, 0x94 }, ++}; ++ ++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_3c[] = { ++ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 }, ++ { 0x420, 0x1b, 0x01 }, { 0x420, 0x1d, 0x01 }, { 0x420, 0x1f, 0xfe }, ++ { 0x420, 0x21, 0x00 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 }, ++ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e }, ++ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0xba, 0x8d }, ++}; ++ ++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_3d[] = { ++ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 }, ++ { 0x420, 0x1b, 0x02 }, { 0x420, 0x1d, 0x02 }, { 0x420, 0x1f, 0xfd }, ++ { 0x420, 0x21, 0x01 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 }, ++ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e }, ++ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0xba, 0x8d }, ++}; ++ ++struct alc298_lg_gram_style_amp_desc { ++ unsigned char nid; ++ const struct alc298_lg_gram_style_seq *init_seq; ++ int init_seq_size; ++}; ++ ++static const struct alc298_lg_gram_style_amp_desc alc298_lg_gram_style_amps[] = { ++ { 0x38, alc298_lg_gram_style_init_seq_38, ++ ARRAY_SIZE(alc298_lg_gram_style_init_seq_38) }, ++ { 0x39, alc298_lg_gram_style_init_seq_39, ++ ARRAY_SIZE(alc298_lg_gram_style_init_seq_39) }, ++ { 0x3c, alc298_lg_gram_style_init_seq_3c, ++ ARRAY_SIZE(alc298_lg_gram_style_init_seq_3c) }, ++ { 0x3d, alc298_lg_gram_style_init_seq_3d, ++ ARRAY_SIZE(alc298_lg_gram_style_init_seq_3d) }, ++}; ++ ++static void alc298_lg_gram_style_enable_amps(struct hda_codec *codec) ++{ ++ struct alc_spec *spec = codec->spec; ++ int i; ++ ++ for (i = 0; i < spec->num_speaker_amps; i++) { ++ alc_write_coef_idx(codec, 0x22, alc298_lg_gram_style_amps[i].nid); ++ alc298_lg_gram_style_run_seq(codec, ++ alc298_lg_gram_style_enable_seq, ++ ARRAY_SIZE(alc298_lg_gram_style_enable_seq)); ++ } ++} ++ ++static void alc298_lg_gram_style_disable_amps(struct hda_codec *codec) ++{ ++ struct alc_spec *spec = codec->spec; ++ int i; ++ ++ for (i = 0; i < spec->num_speaker_amps; i++) { ++ alc_write_coef_idx(codec, 0x22, alc298_lg_gram_style_amps[i].nid); ++ alc298_lg_gram_style_run_seq(codec, ++ alc298_lg_gram_style_disable_seq, ++ ARRAY_SIZE(alc298_lg_gram_style_disable_seq)); ++ } ++} ++ ++static void alc298_lg_gram_style_playback_hook(struct hda_pcm_stream *hinfo, ++ struct hda_codec *codec, ++ struct snd_pcm_substream *substream, ++ int action) ++{ ++ if (action == HDA_GEN_PCM_ACT_OPEN) ++ alc298_lg_gram_style_enable_amps(codec); ++ if (action == HDA_GEN_PCM_ACT_CLOSE) ++ alc298_lg_gram_style_disable_amps(codec); ++} ++ ++static void alc298_lg_gram_style_init_amps(struct hda_codec *codec) ++{ ++ struct alc_spec *spec = codec->spec; ++ int i; ++ ++ spec->num_speaker_amps = ARRAY_SIZE(alc298_lg_gram_style_amps); ++ ++ for (i = 0; i < spec->num_speaker_amps; i++) { ++ alc_write_coef_idx(codec, 0x22, alc298_lg_gram_style_amps[i].nid); ++ alc298_lg_gram_style_run_seq(codec, ++ alc298_lg_gram_style_preinit_seq, ++ ARRAY_SIZE(alc298_lg_gram_style_preinit_seq)); ++ alc298_lg_gram_style_run_seq(codec, ++ alc298_lg_gram_style_disable_seq, ++ ARRAY_SIZE(alc298_lg_gram_style_disable_seq)); ++ alc298_lg_gram_style_run_seq(codec, ++ alc298_lg_gram_style_amps[i].init_seq, ++ alc298_lg_gram_style_amps[i].init_seq_size); ++ alc_write_coef_idx(codec, 0x89, 0x0); ++ } ++ ++ spec->gen.pcm_playback_hook = alc298_lg_gram_style_playback_hook; ++} ++ + static void alc298_fixup_samsung_amp_v2_2_amps(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { +@@ -1842,6 +1999,13 @@ static void alc298_fixup_samsung_amp_v2_4_amps(struct hda_codec *codec, + alc298_samsung_v2_init_amps(codec, 4); + } + ++static void alc298_fixup_lg_gram_style_14(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ if (action == HDA_FIXUP_ACT_PROBE) ++ alc298_lg_gram_style_init_amps(codec); ++} ++ + static void gpio2_mic_hotkey_event(struct hda_codec *codec, + struct hda_jack_callback *event) + { +@@ -3655,6 +3819,7 @@ enum { + ALC298_FIXUP_SAMSUNG_AMP, + ALC298_FIXUP_SAMSUNG_AMP_V2_2_AMPS, + ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS, ++ ALC298_FIXUP_LG_GRAM_STYLE_14, + ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, + ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, + ALC295_FIXUP_ASUS_MIC_NO_PRESENCE, +@@ -5341,6 +5506,10 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc298_fixup_samsung_amp_v2_4_amps + }, ++ [ALC298_FIXUP_LG_GRAM_STYLE_14] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc298_fixup_lg_gram_style_14 ++ }, + [ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb[]) { +@@ -7244,6 +7413,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1854, 0x0488, "LG gram 16 (16Z90R)", ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS), + SND_PCI_QUIRK(0x1854, 0x0489, "LG gram 16 (16Z90R-A)", ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS), + SND_PCI_QUIRK(0x1854, 0x048a, "LG gram 17 (17ZD90R)", ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS), ++ SND_PCI_QUIRK(0x1854, 0x0490, "LG Gram Style 14 (14Z90RS)", ALC298_FIXUP_LG_GRAM_STYLE_14), + SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MACH-WX9", ALC256_FIXUP_HUAWEI_MACH_WX9_PINS), + SND_PCI_QUIRK(0x19e5, 0x320f, "Huawei WRT-WX9 ", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x19e5, 0x3212, "Huawei KLV-WX9 ", ALC256_FIXUP_ACER_HEADSET_MIC), +-- +2.51.0 + diff --git a/queue-6.18/alsa-hda-tas2781-ignore-reset-check-for-spi-device.patch b/queue-6.18/alsa-hda-tas2781-ignore-reset-check-for-spi-device.patch new file mode 100644 index 00000000000..1b5cb86a677 --- /dev/null +++ b/queue-6.18/alsa-hda-tas2781-ignore-reset-check-for-spi-device.patch @@ -0,0 +1,64 @@ +From 9dc1d8fa60274e8de8561ba5c3b50a8b279004b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Feb 2026 11:09:46 +0800 +Subject: ALSA: hda/tas2781: Ignore reset check for SPI device + +From: Baojun Xu + +[ Upstream commit 908ef80e31e4d3bd953a0088fe57640cd9ae7b3e ] + +In the SPI driver probe, the device should be in the default state, so the +device status check is not necessary. It should be forced to do the +firmware download as I2C device. + +Signed-off-by: Baojun Xu +Link: https://patch.msgid.link/20260211030946.2330-1-baojun.xu@ti.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + .../hda/codecs/side-codecs/tas2781_hda_spi.c | 20 +++++++------------ + 1 file changed, 7 insertions(+), 13 deletions(-) + +diff --git a/sound/hda/codecs/side-codecs/tas2781_hda_spi.c b/sound/hda/codecs/side-codecs/tas2781_hda_spi.c +index b9a55672bf15d..488e35dac9524 100644 +--- a/sound/hda/codecs/side-codecs/tas2781_hda_spi.c ++++ b/sound/hda/codecs/side-codecs/tas2781_hda_spi.c +@@ -634,7 +634,7 @@ static void tasdev_fw_ready(const struct firmware *fmw, void *context) + struct tasdevice_priv *tas_priv = context; + struct tas2781_hda *tas_hda = dev_get_drvdata(tas_priv->dev); + struct hda_codec *codec = tas_priv->codec; +- int ret, val; ++ int ret; + + pm_runtime_get_sync(tas_priv->dev); + guard(mutex)(&tas_priv->codec_lock); +@@ -673,20 +673,14 @@ static void tasdev_fw_ready(const struct firmware *fmw, void *context) + tas_priv->rcabin.profile_cfg_id = 0; + + tas_priv->fw_state = TASDEVICE_DSP_FW_ALL_OK; +- ret = tasdevice_spi_dev_read(tas_priv, tas_priv->index, +- TAS2781_REG_CLK_CONFIG, &val); +- if (ret < 0) +- goto out; + +- if (val == TAS2781_REG_CLK_CONFIG_RESET) { +- ret = tasdevice_prmg_load(tas_priv, 0); +- if (ret < 0) { +- dev_err(tas_priv->dev, "FW download failed = %d\n", +- ret); +- goto out; +- } +- tas_priv->fw_state = TASDEVICE_DSP_FW_ALL_OK; ++ ret = tasdevice_prmg_load(tas_priv, 0); ++ if (ret < 0) { ++ dev_err(tas_priv->dev, "FW download failed = %d\n", ret); ++ goto out; + } ++ tas_priv->fw_state = TASDEVICE_DSP_FW_ALL_OK; ++ + if (tas_priv->fmw->nr_programs > 0) + tas_priv->tasdevice[tas_priv->index].cur_prog = 0; + if (tas_priv->fmw->nr_configurations > 0) +-- +2.51.0 + diff --git a/queue-6.18/alsa-mixer-oss-add-card-disconnect-checkpoints.patch b/queue-6.18/alsa-mixer-oss-add-card-disconnect-checkpoints.patch new file mode 100644 index 00000000000..b4ad422d5c3 --- /dev/null +++ b/queue-6.18/alsa-mixer-oss-add-card-disconnect-checkpoints.patch @@ -0,0 +1,103 @@ +From 7baa187e78c47128cb03ee262ff496d8d171d068 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 13:12:11 +0100 +Subject: ALSA: mixer: oss: Add card disconnect checkpoints + +From: Takashi Iwai + +[ Upstream commit 084d5d44418148662365eced3e126ad1a81ee3e2 ] + +ALSA OSS mixer layer calls the kcontrol ops rather individually, and +pending calls might be not always caught at disconnecting the device. + +For avoiding the potential UAF scenarios, add sanity checks of the +card disconnection at each entry point of OSS mixer accesses. The +rwsem is taken just before that check, hence the rest context should +be covered by that properly. + +Link: https://patch.msgid.link/20260209121212.171430-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/oss/mixer_oss.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c +index e839a4bb93f81..aa98caaaea3c5 100644 +--- a/sound/core/oss/mixer_oss.c ++++ b/sound/core/oss/mixer_oss.c +@@ -525,6 +525,8 @@ static void snd_mixer_oss_get_volume1_vol(struct snd_mixer_oss_file *fmixer, + if (numid == ID_UNKNOWN) + return; + guard(rwsem_read)(&card->controls_rwsem); ++ if (card->shutdown) ++ return; + kctl = snd_ctl_find_numid(card, numid); + if (!kctl) + return; +@@ -558,6 +560,8 @@ static void snd_mixer_oss_get_volume1_sw(struct snd_mixer_oss_file *fmixer, + if (numid == ID_UNKNOWN) + return; + guard(rwsem_read)(&card->controls_rwsem); ++ if (card->shutdown) ++ return; + kctl = snd_ctl_find_numid(card, numid); + if (!kctl) + return; +@@ -618,6 +622,8 @@ static void snd_mixer_oss_put_volume1_vol(struct snd_mixer_oss_file *fmixer, + if (numid == ID_UNKNOWN) + return; + guard(rwsem_read)(&card->controls_rwsem); ++ if (card->shutdown) ++ return; + kctl = snd_ctl_find_numid(card, numid); + if (!kctl) + return; +@@ -655,6 +661,8 @@ static void snd_mixer_oss_put_volume1_sw(struct snd_mixer_oss_file *fmixer, + if (numid == ID_UNKNOWN) + return; + guard(rwsem_read)(&card->controls_rwsem); ++ if (card->shutdown) ++ return; + kctl = snd_ctl_find_numid(card, numid); + if (!kctl) + return; +@@ -792,6 +800,8 @@ static int snd_mixer_oss_get_recsrc2(struct snd_mixer_oss_file *fmixer, unsigned + if (uinfo == NULL || uctl == NULL) + return -ENOMEM; + guard(rwsem_read)(&card->controls_rwsem); ++ if (card->shutdown) ++ return -ENODEV; + kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0); + if (!kctl) + return -ENOENT; +@@ -835,6 +845,8 @@ static int snd_mixer_oss_put_recsrc2(struct snd_mixer_oss_file *fmixer, unsigned + if (uinfo == NULL || uctl == NULL) + return -ENOMEM; + guard(rwsem_read)(&card->controls_rwsem); ++ if (card->shutdown) ++ return -ENODEV; + kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0); + if (!kctl) + return -ENOENT; +@@ -878,6 +890,8 @@ static int snd_mixer_oss_build_test(struct snd_mixer_oss *mixer, struct slot *sl + int err; + + scoped_guard(rwsem_read, &card->controls_rwsem) { ++ if (card->shutdown) ++ return -ENODEV; + kcontrol = snd_mixer_oss_test_id(mixer, name, index); + if (kcontrol == NULL) + return 0; +@@ -1002,6 +1016,8 @@ static int snd_mixer_oss_build_input(struct snd_mixer_oss *mixer, + if (snd_mixer_oss_build_test_all(mixer, ptr, &slot)) + return 0; + guard(rwsem_read)(&mixer->card->controls_rwsem); ++ if (mixer->card->shutdown) ++ return -ENODEV; + kctl = NULL; + if (!ptr->index) + kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0); +-- +2.51.0 + diff --git a/queue-6.18/alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch b/queue-6.18/alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch new file mode 100644 index 00000000000..23df53431d6 --- /dev/null +++ b/queue-6.18/alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch @@ -0,0 +1,42 @@ +From 32baae18052548c077fc40e8f1306f27f37d3fcb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 08:38:29 +0000 +Subject: ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio + +From: Lianqin Hu + +[ Upstream commit ac656d7d7c70f7c352c7652bc2bb0c1c8c2dde08 ] + +Setting up the interface when suspended/resumeing fail on this card. +Adding a reset and delay quirk will eliminate this problem. + +usb 1-1: New USB device found, idVendor=001f, idProduct=0b21 +usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 +usb 1-1: Product: AB13X USB Audio +usb 1-1: Manufacturer: Generic +usb 1-1: SerialNumber: 20210926172016 + +Signed-off-by: Lianqin Hu +Link: https://patch.msgid.link/TYUPR06MB6217522D0DB6E2C9DF46B56ED265A@TYUPR06MB6217.apcprd06.prod.outlook.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/quirks.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 8a646891ebb44..6860b5bd55f1e 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -2147,6 +2147,8 @@ struct usb_audio_quirk_flags_table { + + static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + /* Device matches */ ++ DEVICE_FLG(0x001f, 0x0b21, /* AB13X USB Audio */ ++ QUIRK_FLAG_FORCE_IFACE_RESET | QUIRK_FLAG_IFACE_DELAY), + DEVICE_FLG(0x03f0, 0x654a, /* HP 320 FHD Webcam */ + QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16), + DEVICE_FLG(0x041e, 0x3000, /* Creative SB Extigy */ +-- +2.51.0 + diff --git a/queue-6.18/alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch b/queue-6.18/alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch new file mode 100644 index 00000000000..5dbe6ec4a13 --- /dev/null +++ b/queue-6.18/alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch @@ -0,0 +1,108 @@ +From c63ec616850a529c3f399429b7fd8b51adfff7e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Feb 2026 15:12:07 +0100 +Subject: ALSA: usb-audio: Add sanity check for OOB writes at silencing + +From: Takashi Iwai + +[ Upstream commit fba2105a157fffcf19825e4eea498346738c9948 ] + +At silencing the playback URB packets in the implicit fb mode before +the actual playback, we blindly assume that the received packets fit +with the buffer size. But when the setup in the capture stream +differs from the playback stream (e.g. due to the USB core limitation +of max packet size), such an inconsistency may lead to OOB writes to +the buffer, resulting in a crash. + +For addressing it, add a sanity check of the transfer buffer size at +prepare_silent_urb(), and stop the data copy if the received data +overflows. Also, report back the transfer error properly from there, +too. + +Note that this doesn't fix the root cause of the playback error +itself, but this merely covers the kernel Oops. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076 +Link: https://patch.msgid.link/20260216141209.1849200-4-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/endpoint.c | 39 ++++++++++++++++++++++----------------- + 1 file changed, 22 insertions(+), 17 deletions(-) + +diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c +index 6741ce368dd1c..3ac1fbec6327e 100644 +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -275,8 +275,8 @@ static inline bool has_tx_length_quirk(struct snd_usb_audio *chip) + return chip->quirk_flags & QUIRK_FLAG_TX_LENGTH; + } + +-static void prepare_silent_urb(struct snd_usb_endpoint *ep, +- struct snd_urb_ctx *ctx) ++static int prepare_silent_urb(struct snd_usb_endpoint *ep, ++ struct snd_urb_ctx *ctx) + { + struct urb *urb = ctx->urb; + unsigned int offs = 0; +@@ -289,28 +289,34 @@ static void prepare_silent_urb(struct snd_usb_endpoint *ep, + extra = sizeof(packet_length); + + for (i = 0; i < ctx->packets; ++i) { +- unsigned int offset; +- unsigned int length; +- int counts; +- +- counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0); +- length = counts * ep->stride; /* number of silent bytes */ +- offset = offs * ep->stride + extra * i; +- urb->iso_frame_desc[i].offset = offset; ++ int length; ++ ++ length = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0); ++ if (length < 0) ++ return length; ++ length *= ep->stride; /* number of silent bytes */ ++ if (offs + length + extra > ctx->buffer_size) ++ break; ++ urb->iso_frame_desc[i].offset = offs; + urb->iso_frame_desc[i].length = length + extra; + if (extra) { + packet_length = cpu_to_le32(length); +- memcpy(urb->transfer_buffer + offset, ++ memcpy(urb->transfer_buffer + offs, + &packet_length, sizeof(packet_length)); ++ offs += extra; + } +- memset(urb->transfer_buffer + offset + extra, ++ memset(urb->transfer_buffer + offs, + ep->silence_value, length); +- offs += counts; ++ offs += length; + } + +- urb->number_of_packets = ctx->packets; +- urb->transfer_buffer_length = offs * ep->stride + ctx->packets * extra; ++ if (!offs) ++ return -EPIPE; ++ ++ urb->number_of_packets = i; ++ urb->transfer_buffer_length = offs; + ctx->queued = 0; ++ return 0; + } + + /* +@@ -332,8 +338,7 @@ static int prepare_outbound_urb(struct snd_usb_endpoint *ep, + if (data_subs && ep->prepare_data_urb) + return ep->prepare_data_urb(data_subs, urb, in_stream_lock); + /* no data provider, so send silence */ +- prepare_silent_urb(ep, ctx); +- break; ++ return prepare_silent_urb(ep, ctx); + + case SND_USB_ENDPOINT_TYPE_SYNC: + if (snd_usb_get_speed(ep->chip->dev) >= USB_SPEED_HIGH) { +-- +2.51.0 + diff --git a/queue-6.18/alsa-usb-audio-presonus-s18xx-uses-little-endian.patch b/queue-6.18/alsa-usb-audio-presonus-s18xx-uses-little-endian.patch new file mode 100644 index 00000000000..d47f9e0fb07 --- /dev/null +++ b/queue-6.18/alsa-usb-audio-presonus-s18xx-uses-little-endian.patch @@ -0,0 +1,98 @@ +From 2915bc965a1cb403a6d7a4b8e170b77c1e5930ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Jan 2026 16:36:40 -0500 +Subject: ALSA: usb-audio: presonus s18xx uses little-endian + +From: fenugrec + +[ Upstream commit 3ce03297baff0ba116769044e4594fb324d4a551 ] + +Use __le32 types for USB control transfers + +Signed-off-by: fenugrec +Signed-off-by: Takashi Iwai +Link: https://patch.msgid.link/20260111-preso_clean1-v2-1-44b4e5129a75@mail.com +Signed-off-by: Sasha Levin +--- + sound/usb/mixer_s1810c.c | 36 ++++++++++++++++++------------------ + 1 file changed, 18 insertions(+), 18 deletions(-) + +diff --git a/sound/usb/mixer_s1810c.c b/sound/usb/mixer_s1810c.c +index 6e09e074c0e7f..93510aa0dc5ef 100644 +--- a/sound/usb/mixer_s1810c.c ++++ b/sound/usb/mixer_s1810c.c +@@ -82,13 +82,13 @@ + * mixer and output but a different set for device. + */ + struct s1810c_ctl_packet { +- u32 a; +- u32 b; +- u32 fixed1; +- u32 fixed2; +- u32 c; +- u32 d; +- u32 e; ++ __le32 a; ++ __le32 b; ++ __le32 fixed1; ++ __le32 fixed2; ++ __le32 c; ++ __le32 d; ++ __le32 e; + }; + + #define SC1810C_CTL_LINE_SW 0 +@@ -118,7 +118,7 @@ struct s1810c_ctl_packet { + * being zero and different f1/f2. + */ + struct s1810c_state_packet { +- u32 fields[63]; ++ __le32 fields[63]; + }; + + #define SC1810C_STATE_48V_SW 58 +@@ -140,14 +140,14 @@ snd_s1810c_send_ctl_packet(struct usb_device *dev, u32 a, + struct s1810c_ctl_packet pkt = { 0 }; + int ret = 0; + +- pkt.fixed1 = SC1810C_CMD_F1; +- pkt.fixed2 = SC1810C_CMD_F2; ++ pkt.fixed1 = __cpu_to_le32(SC1810C_CMD_F1); ++ pkt.fixed2 = __cpu_to_le32(SC1810C_CMD_F2); + +- pkt.a = a; +- pkt.b = b; +- pkt.c = c; +- pkt.d = d; +- pkt.e = e; ++ pkt.a = __cpu_to_le32(a); ++ pkt.b = __cpu_to_le32(b); ++ pkt.c = __cpu_to_le32(c); ++ pkt.d = __cpu_to_le32(d); ++ pkt.e = __cpu_to_le32(e); + + ret = snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0), + SC1810C_CMD_REQ, +@@ -176,8 +176,8 @@ snd_sc1810c_get_status_field(struct usb_device *dev, + struct s1810c_state_packet pkt_in = { { 0 } }; + int ret = 0; + +- pkt_out.fields[SC1810C_STATE_F1_IDX] = SC1810C_SET_STATE_F1; +- pkt_out.fields[SC1810C_STATE_F2_IDX] = SC1810C_SET_STATE_F2; ++ pkt_out.fields[SC1810C_STATE_F1_IDX] = __cpu_to_le32(SC1810C_SET_STATE_F1); ++ pkt_out.fields[SC1810C_STATE_F2_IDX] = __cpu_to_le32(SC1810C_SET_STATE_F2); + ret = snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0), + SC1810C_SET_STATE_REQ, + SC1810C_SET_STATE_REQTYPE, +@@ -197,7 +197,7 @@ snd_sc1810c_get_status_field(struct usb_device *dev, + return ret; + } + +- (*field) = pkt_in.fields[field_idx]; ++ (*field) = __le32_to_cpu(pkt_in.fields[field_idx]); + (*seqnum)++; + return 0; + } +-- +2.51.0 + diff --git a/queue-6.18/alsa-usb-audio-update-the-number-of-packets-properly.patch b/queue-6.18/alsa-usb-audio-update-the-number-of-packets-properly.patch new file mode 100644 index 00000000000..9cd7d35fe8a --- /dev/null +++ b/queue-6.18/alsa-usb-audio-update-the-number-of-packets-properly.patch @@ -0,0 +1,37 @@ +From f711f4da78695b837a2fe02a7dbd857d14bfc911 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Feb 2026 15:12:05 +0100 +Subject: ALSA: usb-audio: Update the number of packets properly at receiving + +From: Takashi Iwai + +[ Upstream commit cf044e44190234a41a788de1cdbb6c21f4a52e1e ] + +At receiving the packets from the implicit feedback source, we didn't +update ctx->packets field but only the ctx->packet_size[] data. +In exceptional cases, this might lead to unexpectedly superfluous data +transfer (although this won't happen usually due to the nature of USB +isochronous transfer). Fix it to update the field properly. + +Link: https://patch.msgid.link/20260216141209.1849200-2-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/endpoint.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c +index cc15624ecaffe..6741ce368dd1c 100644 +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -481,6 +481,7 @@ int snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep, + + /* copy over the length information */ + if (implicit_fb) { ++ ctx->packets = packet->packets; + for (i = 0; i < packet->packets; i++) + ctx->packet_size[i] = packet->packet_size[i]; + } +-- +2.51.0 + diff --git a/queue-6.18/apei-ghes-arm-processor-error-don-t-go-past-allocate.patch b/queue-6.18/apei-ghes-arm-processor-error-don-t-go-past-allocate.patch new file mode 100644 index 00000000000..f9b825914fa --- /dev/null +++ b/queue-6.18/apei-ghes-arm-processor-error-don-t-go-past-allocate.patch @@ -0,0 +1,130 @@ +From bdcc305fbad06338be184a460960c5fd0ae00ae8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:35:03 +0100 +Subject: APEI/GHES: ARM processor Error: don't go past allocated memory + +From: Mauro Carvalho Chehab + +[ Upstream commit 87880af2d24e62a84ed19943dbdd524f097172f2 ] + +If the BIOS generates a very small ARM Processor Error, or +an incomplete one, the current logic will fail to deferrence + + err->section_length +and + ctx_info->size + +Add checks to avoid that. With such changes, such GHESv2 +records won't cause OOPSes like this: + +[ 1.492129] Internal error: Oops: 0000000096000005 [#1] SMP +[ 1.495449] Modules linked in: +[ 1.495820] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.18.0-rc1-00017-gabadcc3553dd-dirty #18 PREEMPT +[ 1.496125] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022 +[ 1.496433] Workqueue: kacpi_notify acpi_os_execute_deferred +[ 1.496967] pstate: 814000c5 (Nzcv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) +[ 1.497199] pc : log_arm_hw_error+0x5c/0x200 +[ 1.497380] lr : ghes_handle_arm_hw_error+0x94/0x220 + +0xffff8000811c5324 is in log_arm_hw_error (../drivers/ras/ras.c:75). +70 err_info = (struct cper_arm_err_info *)(err + 1); +71 ctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num); +72 ctx_err = (u8 *)ctx_info; +73 +74 for (n = 0; n < err->context_info_num; n++) { +75 sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size; +76 ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz); +77 ctx_len += sz; +78 } +79 + +and similar ones while trying to access section_length on an +error dump with too small size. + +Signed-off-by: Mauro Carvalho Chehab +Reviewed-by: Jonathan Cameron +Acked-by: Ard Biesheuvel +Reviewed-by: Hanjun Guo +[ rjw: Subject tweaks ] +Link: https://patch.msgid.link/7fd9f38413be05ee2d7cfdb0dc31ea2274cf1a54.1767871950.git.mchehab+huawei@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/apei/ghes.c | 32 ++++++++++++++++++++++++++++---- + drivers/ras/ras.c | 6 +++++- + 2 files changed, 33 insertions(+), 5 deletions(-) + +diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c +index 1b34a708e98a4..42872fdc36bfc 100644 +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -561,21 +561,45 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, + { + struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata); + int flags = sync ? MF_ACTION_REQUIRED : 0; ++ int length = gdata->error_data_length; + char error_type[120]; + bool queued = false; + int sec_sev, i; + char *p; + + sec_sev = ghes_severity(gdata->error_severity); +- log_arm_hw_error(err, sec_sev); ++ if (length >= sizeof(*err)) { ++ log_arm_hw_error(err, sec_sev); ++ } else { ++ pr_warn(FW_BUG "arm error length: %d\n", length); ++ pr_warn(FW_BUG "length is too small\n"); ++ pr_warn(FW_BUG "firmware-generated error record is incorrect\n"); ++ return false; ++ } ++ + if (sev != GHES_SEV_RECOVERABLE || sec_sev != GHES_SEV_RECOVERABLE) + return false; + + p = (char *)(err + 1); ++ length -= sizeof(err); ++ + for (i = 0; i < err->err_info_num; i++) { +- struct cper_arm_err_info *err_info = (struct cper_arm_err_info *)p; +- bool is_cache = err_info->type & CPER_ARM_CACHE_ERROR; +- bool has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR); ++ struct cper_arm_err_info *err_info; ++ bool is_cache, has_pa; ++ ++ /* Ensure we have enough data for the error info header */ ++ if (length < sizeof(*err_info)) ++ break; ++ ++ err_info = (struct cper_arm_err_info *)p; ++ ++ /* Validate the claimed length before using it */ ++ length -= err_info->length; ++ if (length < 0) ++ break; ++ ++ is_cache = err_info->type & CPER_ARM_CACHE_ERROR; ++ has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR); + + /* + * The field (err_info->error_info & BIT(26)) is fixed to set to +diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c +index 2a5b5a9fdcb36..03df3db623346 100644 +--- a/drivers/ras/ras.c ++++ b/drivers/ras/ras.c +@@ -72,7 +72,11 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev) + ctx_err = (u8 *)ctx_info; + + for (n = 0; n < err->context_info_num; n++) { +- sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size; ++ sz = sizeof(struct cper_arm_ctx_info); ++ ++ if (sz + (long)ctx_info - (long)err >= err->section_length) ++ sz += ctx_info->size; ++ + ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz); + ctx_len += sz; + } +-- +2.51.0 + diff --git a/queue-6.18/apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch b/queue-6.18/apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch new file mode 100644 index 00000000000..61c43b2abbd --- /dev/null +++ b/queue-6.18/apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch @@ -0,0 +1,137 @@ +From eb3ba00e5320795d99e370604e6dff9d9cef44dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:35:05 +0100 +Subject: APEI/GHES: ensure that won't go past CPER allocated record + +From: Mauro Carvalho Chehab + +[ Upstream commit fa2408a24f8f0db14d9cfc613ef162dc267d7ad4 ] + +The logic at ghes_new() prevents allocating too large records, by +checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB). +Yet, the allocation is done with the actual number of pages from the +CPER bios table location, which can be smaller. + +Yet, a bad firmware could send data with a different size, which might +be bigger than the allocated memory, causing an OOPS: + + Unable to handle kernel paging request at virtual address fff00000f9b40000 + Mem abort info: + ESR = 0x0000000096000007 + EC = 0x25: DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 + FSC = 0x07: level 3 translation fault + Data abort info: + ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 + CM = 0, WnR = 0, TnD = 0, TagAccess = 0 + GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 + swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000 + [fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000 + Internal error: Oops: 0000000096000007 [#1] SMP + Modules linked in: + CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT + Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022 + Workqueue: kacpi_notify acpi_os_execute_deferred + pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) + pc : hex_dump_to_buffer+0x30c/0x4a0 + lr : hex_dump_to_buffer+0x328/0x4a0 + sp : ffff800080e13880 + x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083 + x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004 + x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083 + x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010 + x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020 + x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008 + x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000 + x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020 + x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000 + x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008 + Call trace: + hex_dump_to_buffer+0x30c/0x4a0 (P) + print_hex_dump+0xac/0x170 + cper_estatus_print_section+0x90c/0x968 + cper_estatus_print+0xf0/0x158 + __ghes_print_estatus+0xa0/0x148 + ghes_proc+0x1bc/0x220 + ghes_notify_hed+0x5c/0xb8 + notifier_call_chain+0x78/0x148 + blocking_notifier_call_chain+0x4c/0x80 + acpi_hed_notify+0x28/0x40 + acpi_ev_notify_dispatch+0x50/0x80 + acpi_os_execute_deferred+0x24/0x48 + process_one_work+0x15c/0x3b0 + worker_thread+0x2d0/0x400 + kthread+0x148/0x228 + ret_from_fork+0x10/0x20 + Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44) + ---[ end trace 0000000000000000 ]--- + +Prevent that by taking the actual allocated are into account when +checking for CPER length. + +Signed-off-by: Mauro Carvalho Chehab +Reviewed-by: Jonathan Cameron +Acked-by: Ard Biesheuvel +Reviewed-by: Hanjun Guo +[ rjw: Subject tweaks ] +Link: https://patch.msgid.link/4e70310a816577fabf37d94ed36cde4ad62b1e0a.1767871950.git.mchehab+huawei@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/apei/ghes.c | 6 +++++- + include/acpi/ghes.h | 1 + + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c +index 56107aa002744..1b34a708e98a4 100644 +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -293,6 +294,7 @@ static struct ghes *ghes_new(struct acpi_hest_generic *generic) + error_block_length = GHES_ESTATUS_MAX_SIZE; + } + ghes->estatus = kmalloc(error_block_length, GFP_KERNEL); ++ ghes->estatus_length = error_block_length; + if (!ghes->estatus) { + rc = -ENOMEM; + goto err_unmap_status_addr; +@@ -364,13 +366,15 @@ static int __ghes_check_estatus(struct ghes *ghes, + struct acpi_hest_generic_status *estatus) + { + u32 len = cper_estatus_len(estatus); ++ u32 max_len = min(ghes->generic->error_block_length, ++ ghes->estatus_length); + + if (len < sizeof(*estatus)) { + pr_warn_ratelimited(FW_WARN GHES_PFX "Truncated error status block!\n"); + return -EIO; + } + +- if (len > ghes->generic->error_block_length) { ++ if (!len || len > max_len) { + pr_warn_ratelimited(FW_WARN GHES_PFX "Invalid error status block length!\n"); + return -EIO; + } +diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h +index ebd21b05fe6ed..93db60da5934e 100644 +--- a/include/acpi/ghes.h ++++ b/include/acpi/ghes.h +@@ -21,6 +21,7 @@ struct ghes { + struct acpi_hest_generic_v2 *generic_v2; + }; + struct acpi_hest_generic_status *estatus; ++ unsigned int estatus_length; + unsigned long flags; + union { + struct list_head list; +-- +2.51.0 + diff --git a/queue-6.18/arm-9467-1-mm-don-t-use-pk-through-printk.patch b/queue-6.18/arm-9467-1-mm-don-t-use-pk-through-printk.patch new file mode 100644 index 00000000000..2cef686c945 --- /dev/null +++ b/queue-6.18/arm-9467-1-mm-don-t-use-pk-through-printk.patch @@ -0,0 +1,42 @@ +From df42351467818842af6f303d7ec2d320c75e14e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 10:56:33 +0100 +Subject: ARM: 9467/1: mm: Don't use %pK through printk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weissschuh + +[ Upstream commit 012ea376a5948b025f260aa45d2a6ec5d96674ea ] + +Restricted pointers ("%pK") were never meant to be used +through printk(). They can acquire sleeping locks in atomic contexts. + +Switch to %px over the more secure %p as this usage is a debugging aid, +gated behind CONFIG_DEBUG_VIRTUAL and used by WARN(). + +Link: https://lore.kernel.org/lkml/20250113171731-dc10e3c1-da64-4af0-b767-7c7070468023@linutronix.de/ +Signed-off-by: Thomas Weißschuh +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/mm/physaddr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/mm/physaddr.c b/arch/arm/mm/physaddr.c +index 3f263c840ebc4..1a37ebfacbba9 100644 +--- a/arch/arm/mm/physaddr.c ++++ b/arch/arm/mm/physaddr.c +@@ -38,7 +38,7 @@ static inline bool __virt_addr_valid(unsigned long x) + phys_addr_t __virt_to_phys(unsigned long x) + { + WARN(!__virt_addr_valid(x), +- "virt_to_phys used for non-linear address: %pK (%pS)\n", ++ "virt_to_phys used for non-linear address: %px (%pS)\n", + (void *)x, (void *)x); + + return __virt_to_phys_nodebug(x); +-- +2.51.0 + diff --git a/queue-6.18/arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch b/queue-6.18/arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch new file mode 100644 index 00000000000..11efb3459e2 --- /dev/null +++ b/queue-6.18/arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch @@ -0,0 +1,37 @@ +From 4775cb111db71ce11b588ef2797492a9a43f87fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Dec 2025 17:24:48 +0800 +Subject: arm64: Add support for TSV110 Spectre-BHB mitigation + +From: Jinqian Yang + +[ Upstream commit e3baa5d4b361276efeb87b20d8beced451a7dbd5 ] + +The TSV110 processor is vulnerable to the Spectre-BHB (Branch History +Buffer) attack, which can be exploited to leak information through +branch prediction side channels. This commit adds the MIDR of TSV110 +to the list for software mitigation. + +Signed-off-by: Jinqian Yang +Reviewed-by: Zenghui Yu +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/proton-pack.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c +index 80a580e019c50..b3801f532b10b 100644 +--- a/arch/arm64/kernel/proton-pack.c ++++ b/arch/arm64/kernel/proton-pack.c +@@ -887,6 +887,7 @@ static u8 spectre_bhb_loop_affected(void) + MIDR_ALL_VERSIONS(MIDR_CORTEX_X2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), ++ MIDR_ALL_VERSIONS(MIDR_HISI_TSV110), + {}, + }; + static const struct midr_range spectre_bhb_k24_list[] = { +-- +2.51.0 + diff --git a/queue-6.18/arm64-ftrace-bpf-fix-partial-regs-after-bpf_prog_run.patch b/queue-6.18/arm64-ftrace-bpf-fix-partial-regs-after-bpf_prog_run.patch new file mode 100644 index 00000000000..5a6493776b8 --- /dev/null +++ b/queue-6.18/arm64-ftrace-bpf-fix-partial-regs-after-bpf_prog_run.patch @@ -0,0 +1,83 @@ +From ad7ff381a0f470e5f5a4e1343be5bb0542b86e06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 13:11:56 +0100 +Subject: arm64/ftrace,bpf: Fix partial regs after bpf_prog_run + +From: Jiri Olsa + +[ Upstream commit 276f3b6daf6024ae2742afd161e7418a5584a660 ] + +Mahe reported issue with bpf_override_return helper not working when +executed from kprobe.multi bpf program on arm. + +The problem is that on arm we use alternate storage for pt_regs object +that is passed to bpf_prog_run and if any register is changed (which +is the case of bpf_override_return) it's not propagated back to actual +pt_regs object. + +Fixing this by introducing and calling ftrace_partial_regs_update function +to propagate the values of changed registers (ip and stack). + +Reported-by: Mahe Tardy +Signed-off-by: Jiri Olsa +Signed-off-by: Andrii Nakryiko +Reviewed-by: Steven Rostedt (Google) +Acked-by: Will Deacon +Link: https://lore.kernel.org/bpf/20260112121157.854473-1-jolsa@kernel.org +Signed-off-by: Sasha Levin +--- + include/linux/ftrace_regs.h | 25 +++++++++++++++++++++++++ + kernel/trace/bpf_trace.c | 1 + + 2 files changed, 26 insertions(+) + +diff --git a/include/linux/ftrace_regs.h b/include/linux/ftrace_regs.h +index 15627ceea9bcc..386fa48c4a957 100644 +--- a/include/linux/ftrace_regs.h ++++ b/include/linux/ftrace_regs.h +@@ -33,6 +33,31 @@ struct ftrace_regs; + #define ftrace_regs_get_frame_pointer(fregs) \ + frame_pointer(&arch_ftrace_regs(fregs)->regs) + ++static __always_inline void ++ftrace_partial_regs_update(struct ftrace_regs *fregs, struct pt_regs *regs) { } ++ ++#else ++ ++/* ++ * ftrace_partial_regs_update - update the original ftrace_regs from regs ++ * @fregs: The ftrace_regs to update from @regs ++ * @regs: The partial regs from ftrace_partial_regs() that was updated ++ * ++ * Some architectures have the partial regs living in the ftrace_regs ++ * structure, whereas other architectures need to make a different copy ++ * of the @regs. If a partial @regs is retrieved by ftrace_partial_regs() and ++ * if the code using @regs updates a field (like the instruction pointer or ++ * stack pointer) it may need to propagate that change to the original @fregs ++ * it retrieved the partial @regs from. Use this function to guarantee that ++ * update happens. ++ */ ++static __always_inline void ++ftrace_partial_regs_update(struct ftrace_regs *fregs, struct pt_regs *regs) ++{ ++ ftrace_regs_set_instruction_pointer(fregs, instruction_pointer(regs)); ++ ftrace_regs_set_return_value(fregs, regs_return_value(regs)); ++} ++ + #endif /* HAVE_ARCH_FTRACE_REGS */ + + /* This can be overridden by the architectures */ +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index e7f1fe44352af..ae64b261de8e3 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -2564,6 +2564,7 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link, + old_run_ctx = bpf_set_run_ctx(&run_ctx.session_ctx.run_ctx); + err = bpf_prog_run(link->link.prog, regs); + bpf_reset_run_ctx(old_run_ctx); ++ ftrace_partial_regs_update(fregs, bpf_kprobe_multi_pt_regs_ptr()); + rcu_read_unlock(); + + out: +-- +2.51.0 + diff --git a/queue-6.18/arm64-hugetlbpage-avoid-unused-but-set-parameter-war.patch b/queue-6.18/arm64-hugetlbpage-avoid-unused-but-set-parameter-war.patch new file mode 100644 index 00000000000..9658dffecb0 --- /dev/null +++ b/queue-6.18/arm64-hugetlbpage-avoid-unused-but-set-parameter-war.patch @@ -0,0 +1,60 @@ +From 33d110256dbbc9ff2bb9414857689ff4ad93963f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Feb 2026 11:54:21 +0100 +Subject: arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) + +From: Arnd Bergmann + +[ Upstream commit 729a2e8e9ac47099a967567389cc9d73ef4194ca ] + +gcc-16 warns about an instance that older compilers did not: + +arch/arm64/mm/hugetlbpage.c: In function 'huge_pte_clear': +arch/arm64/mm/hugetlbpage.c:369:57: error: parameter 'addr' set but not used [-Werror=unused-but-set-parameter=] + +The issue here is that __pte_clear() does not actually use its second +argument, but when CONFIG_ARM64_CONTPTE is enabled it still gets +updated. + +Replace the macro with an inline function to let the compiler see +the argument getting passed down. + +Suggested-by: Catalin Marinas +Signed-off-by: Arnd Bergmann +Reviewed-by: Dev Jain +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/pgtable.h | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h +index 0944e296dd4a4..9016ae8de5c9e 100644 +--- a/arch/arm64/include/asm/pgtable.h ++++ b/arch/arm64/include/asm/pgtable.h +@@ -175,8 +175,6 @@ static inline pteval_t __phys_to_pte_val(phys_addr_t phys) + __pte(__phys_to_pte_val((phys_addr_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot)) + + #define pte_none(pte) (!pte_val(pte)) +-#define __pte_clear(mm, addr, ptep) \ +- __set_pte(ptep, __pte(0)) + #define pte_page(pte) (pfn_to_page(pte_pfn(pte))) + + /* +@@ -1316,6 +1314,13 @@ static inline bool pud_user_accessible_page(pud_t pud) + /* + * Atomic pte/pmd modifications. + */ ++ ++static inline void __pte_clear(struct mm_struct *mm, ++ unsigned long addr, pte_t *ptep) ++{ ++ __set_pte(ptep, __pte(0)); ++} ++ + static inline int __ptep_test_and_clear_young(struct vm_area_struct *vma, + unsigned long address, + pte_t *ptep) +-- +2.51.0 + diff --git a/queue-6.18/arm64-tegra-smaug-add-usb-role-switch-support.patch b/queue-6.18/arm64-tegra-smaug-add-usb-role-switch-support.patch new file mode 100644 index 00000000000..3c776f1f79e --- /dev/null +++ b/queue-6.18/arm64-tegra-smaug-add-usb-role-switch-support.patch @@ -0,0 +1,37 @@ +From c1f45b9c440d1016f52dc4e1da7e56546314feea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Dec 2025 21:27:21 +0000 +Subject: arm64: tegra: smaug: Add usb-role-switch support + +From: Diogo Ivo + +[ Upstream commit dfa93788dd8b2f9c59adf45ecf592082b1847b7b ] + +The USB2 port on Smaug is configured for OTG operation but lacked the +required 'usb-role-switch' property, leading to a failed probe and a +non-functioning USB port. Add the property along with setting the default +role to host. + +Signed-off-by: Diogo Ivo +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/nvidia/tegra210-smaug.dts | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts +index 5aa6afd56cbc6..dfbd1c72388c1 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts ++++ b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts +@@ -1809,6 +1809,8 @@ usb2-0 { + status = "okay"; + vbus-supply = <&usbc_vbus>; + mode = "otg"; ++ usb-role-switch; ++ role-switch-default-mode = "host"; + }; + + usb3-0 { +-- +2.51.0 + diff --git a/queue-6.18/asoc-amd-amd_sdw-add-machine-driver-quirk-for-lenovo.patch b/queue-6.18/asoc-amd-amd_sdw-add-machine-driver-quirk-for-lenovo.patch new file mode 100644 index 00000000000..89e9dba39a8 --- /dev/null +++ b/queue-6.18/asoc-amd-amd_sdw-add-machine-driver-quirk-for-lenovo.patch @@ -0,0 +1,54 @@ +From 85ef07af698e7a72b934727be79e9bc4ff8017b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Feb 2026 16:15:34 +0530 +Subject: ASoC: amd: amd_sdw: add machine driver quirk for Lenovo models + +From: Vijendar Mukunda + +[ Upstream commit 3acf517e1ae05ef66561b7a2782690387ce46e21 ] + +This patch adds a quirk to include the codec amplifier function for Lenovo +models listed in the quirk table. + +Note: In these models, the RT722 codec amplifier is excluded, and an +external amplifier is used instead. + +Signed-off-by: Vijendar Mukunda +Link: https://patch.msgid.link/20260218104734.3641481-3-Vijendar.Mukunda@amd.com +Reviewed-by: Mario Limonciello (AMD) +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/acp/acp-sdw-legacy-mach.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/sound/soc/amd/acp/acp-sdw-legacy-mach.c b/sound/soc/amd/acp/acp-sdw-legacy-mach.c +index 5a3cfedacbafd..86c534d827448 100644 +--- a/sound/soc/amd/acp/acp-sdw-legacy-mach.c ++++ b/sound/soc/amd/acp/acp-sdw-legacy-mach.c +@@ -95,6 +95,22 @@ static const struct dmi_system_id soc_sdw_quirk_table[] = { + }, + .driver_data = (void *)(ASOC_SDW_CODEC_SPKR), + }, ++ { ++ .callback = soc_sdw_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "21YW"), ++ }, ++ .driver_data = (void *)(ASOC_SDW_CODEC_SPKR), ++ }, ++ { ++ .callback = soc_sdw_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "21YX"), ++ }, ++ .driver_data = (void *)(ASOC_SDW_CODEC_SPKR), ++ }, + {} + }; + +-- +2.51.0 + diff --git a/queue-6.18/asoc-codecs-max98390-check-return-value-of-devm_gpio.patch b/queue-6.18/asoc-codecs-max98390-check-return-value-of-devm_gpio.patch new file mode 100644 index 00000000000..3ed63381fa4 --- /dev/null +++ b/queue-6.18/asoc-codecs-max98390-check-return-value-of-devm_gpio.patch @@ -0,0 +1,44 @@ +From 79948d8a7d0c1b0e08ea7408de7c05ee35cf812d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 17:19:04 +0800 +Subject: ASoC: codecs: max98390: Check return value of + devm_gpiod_get_optional() in max98390_i2c_probe() + +From: Chen Ni + +[ Upstream commit a1d14d8364eac2611fe1391c73ff0e5b26064f0e ] + +The devm_gpiod_get_optional() function may return an error pointer +(ERR_PTR) in case of a genuine failure during GPIO acquisition, +not just NULL which indicates the legitimate absence of an optional +GPIO. + +Add an IS_ERR() check after the function call to catch such errors and +propagate them to the probe function, ensuring the driver fails to load +safely rather than proceeding with an invalid pointer. + +Signed-off-by: Chen Ni +Link: https://patch.msgid.link/20260130091904.3426149-1-nichen@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98390.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/codecs/max98390.c b/sound/soc/codecs/max98390.c +index a8a282ff9fc5a..b132ef8c1d2c8 100644 +--- a/sound/soc/codecs/max98390.c ++++ b/sound/soc/codecs/max98390.c +@@ -1073,6 +1073,9 @@ static int max98390_i2c_probe(struct i2c_client *i2c) + + reset_gpio = devm_gpiod_get_optional(&i2c->dev, + "reset", GPIOD_OUT_HIGH); ++ if (IS_ERR(reset_gpio)) ++ return dev_err_probe(&i2c->dev, PTR_ERR(reset_gpio), ++ "Failed to get reset gpio\n"); + + /* Power on device */ + if (reset_gpio) { +-- +2.51.0 + diff --git a/queue-6.18/asoc-es8328-add-error-unwind-in-resume.patch b/queue-6.18/asoc-es8328-add-error-unwind-in-resume.patch new file mode 100644 index 00000000000..74a35d18592 --- /dev/null +++ b/queue-6.18/asoc-es8328-add-error-unwind-in-resume.patch @@ -0,0 +1,57 @@ +From 1d88a247ef1484c1b49c25018aa7eda9b1d4d8cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Jan 2026 00:00:17 +0800 +Subject: ASoC: es8328: Add error unwind in resume + +From: Hsieh Hung-En + +[ Upstream commit 8232e6079ae6f8d3a61d87973cb427385aa469b9 ] + +Handle failures in the resume path by unwinding previously enabled +resources. + +If enabling regulators or syncing the regcache fails, disable regulators +and unprepare the clock to avoid leaking resources and leaving the device +in a partially resumed state. + +Signed-off-by: Hsieh Hung-En +Link: https://patch.msgid.link/20260130160017.2630-6-hungen3108@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/es8328.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c +index 76159c45e6b52..c0d7ce64b2d96 100644 +--- a/sound/soc/codecs/es8328.c ++++ b/sound/soc/codecs/es8328.c +@@ -756,17 +756,23 @@ static int es8328_resume(struct snd_soc_component *component) + es8328->supplies); + if (ret) { + dev_err(component->dev, "unable to enable regulators\n"); +- return ret; ++ goto err_clk; + } + + regcache_mark_dirty(regmap); + ret = regcache_sync(regmap); + if (ret) { + dev_err(component->dev, "unable to sync regcache\n"); +- return ret; ++ goto err_regulators; + } + + return 0; ++ ++err_regulators: ++ regulator_bulk_disable(ARRAY_SIZE(es8328->supplies), es8328->supplies); ++err_clk: ++ clk_disable_unprepare(es8328->clk); ++ return ret; + } + + static int es8328_component_probe(struct snd_soc_component *component) +-- +2.51.0 + diff --git a/queue-6.18/asoc-fsl-imx-rpmsg-use-snd_soc_find_dai_with_mutex-i.patch b/queue-6.18/asoc-fsl-imx-rpmsg-use-snd_soc_find_dai_with_mutex-i.patch new file mode 100644 index 00000000000..e54280c5a04 --- /dev/null +++ b/queue-6.18/asoc-fsl-imx-rpmsg-use-snd_soc_find_dai_with_mutex-i.patch @@ -0,0 +1,45 @@ +From 009b38c02f41db196eb30fc2aafea734b560322a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Feb 2026 05:24:29 +0000 +Subject: ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe + +From: Ziyi Guo + +[ Upstream commit 84faa91585fa22a161763f2fe8f84a602a196c87 ] + +imx_rpmsg_probe() calls snd_soc_find_dai() without holding client_mutex. +However, snd_soc_find_dai() has lockdep_assert_held(&client_mutex) +indicating callers must hold this lock, as the function iterates over the +global component list. + +All other callers of snd_soc_find_dai() either hold client_mutex via the +snd_soc_bind_card() path or use the snd_soc_find_dai_with_mutex() wrapper. + +Use snd_soc_find_dai_with_mutex() instead to fix the missing lock +protection. + +Signed-off-by: Ziyi Guo +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20260205052429.4046903-1-n7l8m4@u.northwestern.edu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/imx-rpmsg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/fsl/imx-rpmsg.c b/sound/soc/fsl/imx-rpmsg.c +index 7cd3aa4c87060..39b2d64eb410d 100644 +--- a/sound/soc/fsl/imx-rpmsg.c ++++ b/sound/soc/fsl/imx-rpmsg.c +@@ -145,7 +145,7 @@ static int imx_rpmsg_probe(struct platform_device *pdev) + data->dai.ignore_pmdown_time = 1; + + data->dai.cpus->dai_name = pdev->dev.platform_data; +- cpu_dai = snd_soc_find_dai(data->dai.cpus); ++ cpu_dai = snd_soc_find_dai_with_mutex(data->dai.cpus); + if (!cpu_dai) { + ret = -EPROBE_DEFER; + goto fail; +-- +2.51.0 + diff --git a/queue-6.18/asoc-rt721-sdca-fix-issue-of-fail-to-detect-omtp-jac.patch b/queue-6.18/asoc-rt721-sdca-fix-issue-of-fail-to-detect-omtp-jac.patch new file mode 100644 index 00000000000..b210a3bfbf2 --- /dev/null +++ b/queue-6.18/asoc-rt721-sdca-fix-issue-of-fail-to-detect-omtp-jac.patch @@ -0,0 +1,42 @@ +From 570d65902495faecc97715d0c1de88d6bd6a41fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Feb 2026 15:43:35 +0800 +Subject: ASoC: rt721-sdca: Fix issue of fail to detect OMTP jack type + +From: Jack Yu + +[ Upstream commit 5578da7d957fbaf91f6c39ba2363c2d2e4273183 ] + +Add related HP-JD settings to fix issue of fail to detect +OMTP jack type. + +Signed-off-by: Jack Yu +Link: https://patch.msgid.link/20260210074335.2337830-1-jack.yu@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt721-sdca.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/rt721-sdca.c b/sound/soc/codecs/rt721-sdca.c +index 5f7b505d54147..53cec09d29085 100644 +--- a/sound/soc/codecs/rt721-sdca.c ++++ b/sound/soc/codecs/rt721-sdca.c +@@ -245,12 +245,12 @@ static void rt721_sdca_jack_preset(struct rt721_sdca_priv *rt721) + regmap_write(rt721->mbq_regmap, 0x5b10007, 0x2000); + regmap_write(rt721->mbq_regmap, 0x5B10017, 0x1b0f); + rt_sdca_index_write(rt721->mbq_regmap, RT721_CBJ_CTRL, +- RT721_CBJ_A0_GAT_CTRL1, 0x2a02); ++ RT721_CBJ_A0_GAT_CTRL1, 0x2205); + rt_sdca_index_write(rt721->mbq_regmap, RT721_CAP_PORT_CTRL, + RT721_HP_AMP_2CH_CAL4, 0xa105); + rt_sdca_index_write(rt721->mbq_regmap, RT721_VENDOR_ANA_CTL, + RT721_UAJ_TOP_TCON14, 0x3b33); +- regmap_write(rt721->mbq_regmap, 0x310400, 0x3023); ++ regmap_write(rt721->mbq_regmap, 0x310400, 0x3043); + rt_sdca_index_write(rt721->mbq_regmap, RT721_VENDOR_ANA_CTL, + RT721_UAJ_TOP_TCON14, 0x3f33); + rt_sdca_index_write(rt721->mbq_regmap, RT721_VENDOR_ANA_CTL, +-- +2.51.0 + diff --git a/queue-6.18/asoc-soc-acpi-intel-arl-match-change-rt722-amp-endpo.patch b/queue-6.18/asoc-soc-acpi-intel-arl-match-change-rt722-amp-endpo.patch new file mode 100644 index 00000000000..a2b15a21a2b --- /dev/null +++ b/queue-6.18/asoc-soc-acpi-intel-arl-match-change-rt722-amp-endpo.patch @@ -0,0 +1,87 @@ +From 2e002d1a2a70b00a394896ec6af00140fa4e2788 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 17:17:48 +0800 +Subject: ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to + aggregated + +From: Bard Liao + +[ Upstream commit 08c09899960118ffb01417242e659eb6cc067d6a ] + +rt722 is aggregated with rt1320 amp in arl_rt722_l0_rt1320_l2 and it is +the only audio configuration in the ARL platform. Set .aggregated = 1 to +represent the fact and avoid unexpected issue. + +Signed-off-by: Bard Liao +Reviewed-by: Liam Girdwood +Reviewed-by: Ranjani Sridharan +Link: https://patch.msgid.link/20260119091749.1752088-2-yung-chuan.liao@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + .../intel/common/soc-acpi-intel-arl-match.c | 23 +++++++++---------- + 1 file changed, 11 insertions(+), 12 deletions(-) + +diff --git a/sound/soc/intel/common/soc-acpi-intel-arl-match.c b/sound/soc/intel/common/soc-acpi-intel-arl-match.c +index 6bf7a6250ddc3..c952f7d2b2c0e 100644 +--- a/sound/soc/intel/common/soc-acpi-intel-arl-match.c ++++ b/sound/soc/intel/common/soc-acpi-intel-arl-match.c +@@ -45,23 +45,22 @@ static const struct snd_soc_acpi_endpoint spk_3_endpoint = { + .group_id = 1, + }; + +-/* +- * RT722 is a multi-function codec, three endpoints are created for +- * its headset, amp and dmic functions. +- */ +-static const struct snd_soc_acpi_endpoint rt722_endpoints[] = { ++static const struct snd_soc_acpi_endpoint jack_amp_g1_dmic_endpoints[] = { ++ /* Jack Endpoint */ + { + .num = 0, + .aggregated = 0, + .group_position = 0, + .group_id = 0, + }, ++ /* Amp Endpoint, work as spk_l_endpoint */ + { + .num = 1, +- .aggregated = 0, ++ .aggregated = 1, + .group_position = 0, +- .group_id = 0, ++ .group_id = 1, + }, ++ /* DMIC Endpoint */ + { + .num = 2, + .aggregated = 0, +@@ -229,11 +228,11 @@ static const struct snd_soc_acpi_adr_device rt711_sdca_0_adr[] = { + } + }; + +-static const struct snd_soc_acpi_adr_device rt722_0_single_adr[] = { ++static const struct snd_soc_acpi_adr_device rt722_0_agg_adr[] = { + { + .adr = 0x000030025D072201ull, +- .num_endpoints = ARRAY_SIZE(rt722_endpoints), +- .endpoints = rt722_endpoints, ++ .num_endpoints = ARRAY_SIZE(jack_amp_g1_dmic_endpoints), ++ .endpoints = jack_amp_g1_dmic_endpoints, + .name_prefix = "rt722" + } + }; +@@ -394,8 +393,8 @@ static const struct snd_soc_acpi_link_adr arl_rt711_l0_rt1316_l3[] = { + static const struct snd_soc_acpi_link_adr arl_rt722_l0_rt1320_l2[] = { + { + .mask = BIT(0), +- .num_adr = ARRAY_SIZE(rt722_0_single_adr), +- .adr_d = rt722_0_single_adr, ++ .num_adr = ARRAY_SIZE(rt722_0_agg_adr), ++ .adr_d = rt722_0_agg_adr, + }, + { + .mask = BIT(2), +-- +2.51.0 + diff --git a/queue-6.18/asoc-sof-intel-hda-fix-null-pointer-dereference.patch b/queue-6.18/asoc-sof-intel-hda-fix-null-pointer-dereference.patch new file mode 100644 index 00000000000..e4a2fb37aef --- /dev/null +++ b/queue-6.18/asoc-sof-intel-hda-fix-null-pointer-dereference.patch @@ -0,0 +1,62 @@ +From baa3796008e19924a2b247b4b66889bcb8d32abf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 10:18:32 +0200 +Subject: ASoC: SOF: Intel: hda: Fix NULL pointer dereference + +From: Ranjani Sridharan + +[ Upstream commit 16c589567a956d46a7c1363af3f64de3d420af20 ] + +If there's a mismatch between the DAI links in the machine driver and +the topology, it is possible that the playback/capture widget is not +set, especially in the case of loopback capture for echo reference +where we use the dummy DAI link. Return the error when the widget is not +set to avoid a null pointer dereference like below when the topology is +broken. + +RIP: 0010:hda_dai_get_ops.isra.0+0x14/0xa0 [snd_sof_intel_hda_common] + +Signed-off-by: Ranjani Sridharan +Reviewed-by: Bard Liao +Reviewed-by: Liam Girdwood +Reviewed-by: Mateusz Redzynia +Signed-off-by: Peter Ujfalusi +Link: https://patch.msgid.link/20260204081833.16630-10-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-dai.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sof/intel/hda-dai.c b/sound/soc/sof/intel/hda-dai.c +index 883d0d3bae9ec..3c742d5351333 100644 +--- a/sound/soc/sof/intel/hda-dai.c ++++ b/sound/soc/sof/intel/hda-dai.c +@@ -70,12 +70,22 @@ static const struct hda_dai_widget_dma_ops * + hda_dai_get_ops(struct snd_pcm_substream *substream, struct snd_soc_dai *cpu_dai) + { + struct snd_soc_dapm_widget *w = snd_soc_dai_get_widget(cpu_dai, substream->stream); +- struct snd_sof_widget *swidget = w->dobj.private; ++ struct snd_sof_widget *swidget; + struct snd_sof_dev *sdev; + struct snd_sof_dai *sdai; + +- sdev = widget_to_sdev(w); ++ /* ++ * this is unlikely if the topology and the machine driver DAI links match. ++ * But if there's a missing DAI link in topology, this will prevent a NULL pointer ++ * dereference later on. ++ */ ++ if (!w) { ++ dev_err(cpu_dai->dev, "%s: widget is NULL\n", __func__); ++ return NULL; ++ } + ++ sdev = widget_to_sdev(w); ++ swidget = w->dobj.private; + if (!swidget) { + dev_err(sdev->dev, "%s: swidget is NULL\n", __func__); + return NULL; +-- +2.51.0 + diff --git a/queue-6.18/asoc-sof-ipc4-support-for-sending-payload-along-with.patch b/queue-6.18/asoc-sof-ipc4-support-for-sending-payload-along-with.patch new file mode 100644 index 00000000000..7564f87eb45 --- /dev/null +++ b/queue-6.18/asoc-sof-ipc4-support-for-sending-payload-along-with.patch @@ -0,0 +1,130 @@ +From c229cd51e4cc48889d466a9311e49bf131f418f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Dec 2025 16:39:43 +0200 +Subject: ASoC: SOF: ipc4: Support for sending payload along with + LARGE_CONFIG_GET + +From: Peter Ujfalusi + +[ Upstream commit d96cb0b86d6e8bbbbfa425771606f6c1aebc318e ] + +There are message types when we would need to send a payload along with +the LARGE_CONFIG_GET message to provide information to the firmware on +what data is requested. +Such cases are the ALSA Kcontrol related messages when the high level +param_id tells only the type of the control, but the ID/index of the exact +control is specified in the payload area. + +The caller must place the payload for TX before calling the set_get_data() +and this payload will be sent alongside with the message to the firmware. + +The data area will be overwritten by the received data from firmware. + +Signed-off-by: Peter Ujfalusi +Reviewed-by: Seppo Ingalsuo +Reviewed-by: Ranjani Sridharan +Reviewed-by: Bard Liao +Reviewed-by: Kai Vehmanen +Link: https://patch.msgid.link/20251217143945.2667-7-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/ipc4.c | 44 ++++++++++++++++++++++++++++++++++++++++++-- + 1 file changed, 42 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sof/ipc4.c b/sound/soc/sof/ipc4.c +index a4a090e6724a6..20d723f48fff0 100644 +--- a/sound/soc/sof/ipc4.c ++++ b/sound/soc/sof/ipc4.c +@@ -15,6 +15,7 @@ + #include "sof-audio.h" + #include "ipc4-fw-reg.h" + #include "ipc4-priv.h" ++#include "ipc4-topology.h" + #include "ipc4-telemetry.h" + #include "ops.h" + +@@ -433,6 +434,23 @@ static int sof_ipc4_tx_msg(struct snd_sof_dev *sdev, void *msg_data, size_t msg_ + return ret; + } + ++static bool sof_ipc4_tx_payload_for_get_data(struct sof_ipc4_msg *tx) ++{ ++ /* ++ * Messages that require TX payload with LARGE_CONFIG_GET. ++ * The TX payload is placed into the IPC message data section by caller, ++ * which needs to be copied to temporary buffer since the received data ++ * will overwrite it. ++ */ ++ switch (tx->extension & SOF_IPC4_MOD_EXT_MSG_PARAM_ID_MASK) { ++ case SOF_IPC4_MOD_EXT_MSG_PARAM_ID(SOF_IPC4_SWITCH_CONTROL_PARAM_ID): ++ case SOF_IPC4_MOD_EXT_MSG_PARAM_ID(SOF_IPC4_ENUM_CONTROL_PARAM_ID): ++ return true; ++ default: ++ return false; ++ } ++} ++ + static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data, + size_t payload_bytes, bool set) + { +@@ -444,6 +462,8 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data, + struct sof_ipc4_msg tx = {{ 0 }}; + struct sof_ipc4_msg rx = {{ 0 }}; + size_t remaining = payload_bytes; ++ void *tx_payload_for_get = NULL; ++ size_t tx_data_size = 0; + size_t offset = 0; + size_t chunk_size; + int ret; +@@ -469,10 +489,20 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data, + + tx.extension |= SOF_IPC4_MOD_EXT_MSG_FIRST_BLOCK(1); + ++ if (sof_ipc4_tx_payload_for_get_data(&tx)) { ++ tx_data_size = min(ipc4_msg->data_size, payload_limit); ++ tx_payload_for_get = kmemdup(ipc4_msg->data_ptr, tx_data_size, ++ GFP_KERNEL); ++ if (!tx_payload_for_get) ++ return -ENOMEM; ++ } ++ + /* ensure the DSP is in D0i0 before sending IPC */ + ret = snd_sof_dsp_set_power_state(sdev, &target_state); +- if (ret < 0) ++ if (ret < 0) { ++ kfree(tx_payload_for_get); + return ret; ++ } + + /* Serialise IPC TX */ + mutex_lock(&sdev->ipc->tx_mutex); +@@ -506,7 +536,15 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data, + rx.data_size = chunk_size; + rx.data_ptr = ipc4_msg->data_ptr + offset; + +- tx_size = 0; ++ if (tx_payload_for_get) { ++ tx_size = tx_data_size; ++ tx.data_size = tx_size; ++ tx.data_ptr = tx_payload_for_get; ++ } else { ++ tx_size = 0; ++ tx.data_size = 0; ++ tx.data_ptr = NULL; ++ } + rx_size = chunk_size; + } + +@@ -553,6 +591,8 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data, + + mutex_unlock(&sdev->ipc->tx_mutex); + ++ kfree(tx_payload_for_get); ++ + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.18/asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch b/queue-6.18/asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch new file mode 100644 index 00000000000..52cb43ca320 --- /dev/null +++ b/queue-6.18/asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch @@ -0,0 +1,37 @@ +From 7001a16a3a8ed3666b523d3c2159ba4668c3490b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 11:32:50 +0800 +Subject: ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio + +From: Chen Ni + +[ Upstream commit 74823db9ba2e13f3ec007b354759b3d8125e462c ] + +Add check for the return value of devm_regmap_init_mmio() and return the +error if it fails in order to catch the error. + +Signed-off-by: Chen Ni +Link: https://patch.msgid.link/20260127033250.2044608-1-nichen@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sunxi/sun50i-dmic.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/sunxi/sun50i-dmic.c b/sound/soc/sunxi/sun50i-dmic.c +index bab1e29c99887..eddfebe166169 100644 +--- a/sound/soc/sunxi/sun50i-dmic.c ++++ b/sound/soc/sunxi/sun50i-dmic.c +@@ -358,6 +358,9 @@ static int sun50i_dmic_probe(struct platform_device *pdev) + + host->regmap = devm_regmap_init_mmio(&pdev->dev, base, + &sun50i_dmic_regmap_config); ++ if (IS_ERR(host->regmap)) ++ return dev_err_probe(&pdev->dev, PTR_ERR(host->regmap), ++ "failed to initialise regmap\n"); + + /* Clocks */ + host->bus_clk = devm_clk_get(&pdev->dev, "bus"); +-- +2.51.0 + diff --git a/queue-6.18/asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch b/queue-6.18/asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch new file mode 100644 index 00000000000..aebdc7630e4 --- /dev/null +++ b/queue-6.18/asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch @@ -0,0 +1,36 @@ +From cc06c0ed3420044ce1e0f33c6bded35cf814ee52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 04:02:08 +0100 +Subject: ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask + +From: Sebastian Krzyszkowiak + +[ Upstream commit 66c26346ae30c883eef70acf9cf9054dfdb4fb2f ] + +This bit is handled by a separate control. + +Signed-off-by: Sebastian Krzyszkowiak +Reviewed-by: Charles Keepax +Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-1-f4f4eeacf089@puri.sm +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index 08c8ec3aeb449..6491e098bd212 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -1760,7 +1760,7 @@ SND_SOC_BYTES("EQR Coefficients", WM8962_EQ24, 18), + + + SOC_SINGLE("3D Switch", WM8962_THREED1, 0, 1, 0), +-SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA), ++SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA | WM8962_ADC_MONOMIX), + + SOC_SINGLE("DF1 Switch", WM8962_DF1, 0, 1, 0), + SND_SOC_BYTES_MASK("DF1 Coefficients", WM8962_DF1, 7, WM8962_DF1_ENA), +-- +2.51.0 + diff --git a/queue-6.18/asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch b/queue-6.18/asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch new file mode 100644 index 00000000000..b15b16c2d05 --- /dev/null +++ b/queue-6.18/asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch @@ -0,0 +1,58 @@ +From bdf4036ca323e1bb54ba62622ad87aaedcadbb6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 04:02:10 +0100 +Subject: ASoC: wm8962: Don't report a microphone if it's shorted to ground on + plug + +From: Sebastian Krzyszkowiak + +[ Upstream commit e590752119029d87ce46d725e11245a52d22e1fe ] + +This usually means that a TRS plug with no microphone pin has been plugged +into a TRRS socket. Cases where a user is plugging in a microphone while +pressing a button will be handled via incoming interrupt after the user +releases the button, so the microphone will still be detected once it +becomes usable. + +Signed-off-by: Sebastian Krzyszkowiak +Reviewed-by: Charles Keepax +Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-3-f4f4eeacf089@puri.sm +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index 6491e098bd212..ab8247ae431f8 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -67,6 +67,8 @@ struct wm8962_priv { + struct mutex dsp2_ena_lock; + u16 dsp2_ena; + ++ int mic_status; ++ + struct delayed_work mic_work; + struct snd_soc_jack *jack; + +@@ -3077,8 +3079,16 @@ static void wm8962_mic_work(struct work_struct *work) + if (reg & WM8962_MICSHORT_STS) { + status |= SND_JACK_BTN_0; + irq_pol |= WM8962_MICSCD_IRQ_POL; ++ ++ /* Don't report a microphone if it's shorted right after ++ * plugging in, as this may be a TRS plug in a TRRS socket. ++ */ ++ if (!(wm8962->mic_status & WM8962_MICDET_STS)) ++ status = 0; + } + ++ wm8962->mic_status = status; ++ + snd_soc_jack_report(wm8962->jack, status, + SND_JACK_MICROPHONE | SND_JACK_BTN_0); + +-- +2.51.0 + diff --git a/queue-6.18/ata-libata-avoid-long-timeouts-on-hot-unplugged-sata.patch b/queue-6.18/ata-libata-avoid-long-timeouts-on-hot-unplugged-sata.patch new file mode 100644 index 00000000000..6e4f79b8360 --- /dev/null +++ b/queue-6.18/ata-libata-avoid-long-timeouts-on-hot-unplugged-sata.patch @@ -0,0 +1,160 @@ +From 8293d58c6ead4d688a2a1de06385f19885fc3dd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 17:46:22 +0800 +Subject: ata: libata: avoid long timeouts on hot-unplugged SATA DAS + +From: Henry Tseng + +[ Upstream commit 151cabd140322205e27dae5c4bbf261ede0056e3 ] + +When a SATA DAS enclosure is connected behind a Thunderbolt PCIe +switch, hot-unplugging the whole enclosure causes pciehp to tear down +the PCI hierarchy before the SCSI layer issues SYNCHRONIZE CACHE and +START STOP UNIT for the disks. + +libata still queues these commands and the AHCI driver tries to access +the HBA registers even though the PCI channel is already offline. This +results in a series of timeouts and error recovery attempts, e.g.: + + [ 824.778346] pcieport 0000:00:07.0: pciehp: Slot(14): Link Down + [ 891.612720] ata8.00: qc timeout after 5000 msecs (cmd 0xec) + [ 902.876501] ata8.00: qc timeout after 10000 msecs (cmd 0xec) + [ 934.107998] ata8.00: qc timeout after 30000 msecs (cmd 0xec) + [ 936.206431] sd 7:0:0:0: [sda] Synchronize Cache(10) failed: + Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK + ... + [ 1006.298356] ata1.00: qc timeout after 5000 msecs (cmd 0xec) + [ 1017.561926] ata1.00: qc timeout after 10000 msecs (cmd 0xec) + [ 1048.791790] ata1.00: qc timeout after 30000 msecs (cmd 0xec) + [ 1050.890035] sd 0:0:0:0: [sdb] Synchronize Cache(10) failed: + Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK + +With this patch applied, the same hot-unplug looks like: + + [ 59.965496] pcieport 0000:00:07.0: pciehp: Slot(14): Link Down + [ 60.002502] sd 7:0:0:0: [sda] Synchronize Cache(10) failed: + Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK + ... + [ 60.103050] sd 0:0:0:0: [sdb] Synchronize Cache(10) failed: + Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK + +In this test setup with two disks, the hot-unplug sequence shrinks from +about 226 seconds (~3.8 minutes) between the Link Down event and the +last SYNCHRONIZE CACHE failure to under a second. Without this patch the +total delay grows roughly with the number of disks, because each disk +gets its own SYNCHRONIZE CACHE and qc timeout series. + +If the underlying PCI device is already gone, these commands cannot +succeed anyway. Avoid issuing them by introducing +ata_adapter_is_online(), which checks pci_channel_offline() for +PCI-based hosts. It is used from ata_scsi_find_dev() to return NULL, +causing the SCSI layer to fail new commands with DID_BAD_TARGET +immediately, and from ata_qc_issue() to bail out before touching the +HBA registers. + +Since such failures would otherwise trigger libata error handling, +ata_adapter_is_online() is also consulted from ata_scsi_port_error_handler(). +When the adapter is offline, libata skips ap->ops->error_handler(ap) and +completes error handling using the existing path, rather than running +a full EH sequence against a dead adapter. + +With this change, SYNCHRONIZE CACHE and START STOP UNIT commands +issued during hot-unplug fail quickly once the PCI channel is offline, +without qc timeout spam or long libata EH delays. + +Suggested-by: Damien Le Moal +Signed-off-by: Henry Tseng +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/libata-core.c | 24 ++++++++++++++++++++++++ + drivers/ata/libata-eh.c | 3 ++- + drivers/ata/libata-scsi.c | 3 +++ + drivers/ata/libata.h | 1 + + 4 files changed, 30 insertions(+), 1 deletion(-) + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index b29067759cc27..1a57560ecc90f 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -2358,6 +2358,24 @@ static bool ata_dev_check_adapter(struct ata_device *dev, + return false; + } + ++bool ata_adapter_is_online(struct ata_port *ap) ++{ ++ struct device *dev; ++ ++ if (!ap || !ap->host) ++ return false; ++ ++ dev = ap->host->dev; ++ if (!dev) ++ return false; ++ ++ if (dev_is_pci(dev) && ++ pci_channel_offline(to_pci_dev(dev))) ++ return false; ++ ++ return true; ++} ++ + static int ata_dev_config_ncq(struct ata_device *dev, + char *desc, size_t desc_sz) + { +@@ -5067,6 +5085,12 @@ void ata_qc_issue(struct ata_queued_cmd *qc) + qc->flags |= ATA_QCFLAG_ACTIVE; + ap->qc_active |= 1ULL << qc->tag; + ++ /* Make sure the device is still accessible. */ ++ if (!ata_adapter_is_online(ap)) { ++ qc->err_mask |= AC_ERR_HOST_BUS; ++ goto sys_err; ++ } ++ + /* + * We guarantee to LLDs that they will have at least one + * non-zero sg if the command is a data command. +diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c +index 258e657f3527c..b373cceb95d23 100644 +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -752,7 +752,8 @@ void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap) + spin_unlock_irqrestore(ap->lock, flags); + + /* invoke EH, skip if unloading or suspended */ +- if (!(ap->pflags & (ATA_PFLAG_UNLOADING | ATA_PFLAG_SUSPENDED))) ++ if (!(ap->pflags & (ATA_PFLAG_UNLOADING | ATA_PFLAG_SUSPENDED)) && ++ ata_adapter_is_online(ap)) + ap->ops->error_handler(ap); + else { + /* if unloading, commence suicide */ +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index 27ad145996052..5dc9586d9724e 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -3093,6 +3093,9 @@ ata_scsi_find_dev(struct ata_port *ap, const struct scsi_device *scsidev) + { + struct ata_device *dev = __ata_scsi_find_dev(ap, scsidev); + ++ if (!ata_adapter_is_online(ap)) ++ return NULL; ++ + if (unlikely(!dev || !ata_dev_enabled(dev))) + return NULL; + +diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h +index 612fe59828180..0002994ddfc9b 100644 +--- a/drivers/ata/libata.h ++++ b/drivers/ata/libata.h +@@ -94,6 +94,7 @@ extern int atapi_check_dma(struct ata_queued_cmd *qc); + extern void swap_buf_le16(u16 *buf, unsigned int buf_words); + extern bool ata_phys_link_online(struct ata_link *link); + extern bool ata_phys_link_offline(struct ata_link *link); ++bool ata_adapter_is_online(struct ata_port *ap); + extern void ata_dev_init(struct ata_device *dev); + extern void ata_link_init(struct ata_port *ap, struct ata_link *link, int pmp); + extern int sata_link_init_spd(struct ata_link *link); +-- +2.51.0 + diff --git a/queue-6.18/audit-add-fchmodat2-to-change-attributes-class.patch b/queue-6.18/audit-add-fchmodat2-to-change-attributes-class.patch new file mode 100644 index 00000000000..311997209e6 --- /dev/null +++ b/queue-6.18/audit-add-fchmodat2-to-change-attributes-class.patch @@ -0,0 +1,42 @@ +From f9cdfb4cdb4d532414f7fdf74c743cfdaa121229 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 20:49:30 +0100 +Subject: audit: add fchmodat2() to change attributes class + +From: Jeffrey Bencteux + +[ Upstream commit 4f493a6079b588cf1f04ce5ed6cdad45ab0d53dc ] + +fchmodat2(), introduced in version 6.6 is currently not in the change +attribute class of audit. Calling fchmodat2() to change a file +attribute in the same fashion than chmod() or fchmodat() will bypass +audit rules such as: + +-w /tmp/test -p rwa -k test_rwa + +The current patch adds fchmodat2() to the change attributes class. + +Signed-off-by: Jeffrey Bencteux +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + include/asm-generic/audit_change_attr.h | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/include/asm-generic/audit_change_attr.h b/include/asm-generic/audit_change_attr.h +index cc840537885fb..ddd90bbe40dfc 100644 +--- a/include/asm-generic/audit_change_attr.h ++++ b/include/asm-generic/audit_change_attr.h +@@ -26,6 +26,9 @@ __NR_fremovexattr, + __NR_fchownat, + __NR_fchmodat, + #endif ++#ifdef __NR_fchmodat2 ++__NR_fchmodat2, ++#endif + #ifdef __NR_chown32 + __NR_chown32, + __NR_fchown32, +-- +2.51.0 + diff --git a/queue-6.18/audit-add-missing-syscalls-to-read-class.patch b/queue-6.18/audit-add-missing-syscalls-to-read-class.patch new file mode 100644 index 00000000000..bcc5944a6b9 --- /dev/null +++ b/queue-6.18/audit-add-missing-syscalls-to-read-class.patch @@ -0,0 +1,47 @@ +From 7d39dccc9a96f80a74807ecc0ed226acb39f5c07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Dec 2025 09:39:24 +0100 +Subject: audit: add missing syscalls to read class + +From: Jeffrey Bencteux + +[ Upstream commit bcb90a2834c7393c26df9609b889a3097b7700cd ] + +The "at" variant of getxattr() and listxattr() are missing from the +audit read class. Calling getxattrat() or listxattrat() on a file to +read its extended attributes will bypass audit rules such as: + +-w /tmp/test -p rwa -k test_rwa + +The current patch adds missing syscalls to the audit read class. + +Signed-off-by: Jeffrey Bencteux +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + include/asm-generic/audit_read.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/include/asm-generic/audit_read.h b/include/asm-generic/audit_read.h +index 7bb7b5a83ae2e..fb9991f53fb6f 100644 +--- a/include/asm-generic/audit_read.h ++++ b/include/asm-generic/audit_read.h +@@ -4,9 +4,15 @@ __NR_readlink, + #endif + __NR_quotactl, + __NR_listxattr, ++#ifdef __NR_listxattrat ++__NR_listxattrat, ++#endif + __NR_llistxattr, + __NR_flistxattr, + __NR_getxattr, ++#ifdef __NR_getxattrat ++__NR_getxattrat, ++#endif + __NR_lgetxattr, + __NR_fgetxattr, + #ifdef __NR_readlinkat +-- +2.51.0 + diff --git a/queue-6.18/binder-don-t-use-pk-through-printk.patch b/queue-6.18/binder-don-t-use-pk-through-printk.patch new file mode 100644 index 00000000000..eaed1f33500 --- /dev/null +++ b/queue-6.18/binder-don-t-use-pk-through-printk.patch @@ -0,0 +1,83 @@ +From 6393575c15d4a1169a806f7faaba18bf0469d1e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 15:29:50 +0100 +Subject: binder: don't use %pK through printk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 56d21267663bad91e8b10121224ec46366a7937e ] + +In the past %pK was preferable to %p as it would not leak raw pointer +values into the kernel log. Since commit ad67b74d2469 ("printk: hash +addresses printed with %p") the regular %p has been improved to avoid +this issue. Furthermore, restricted pointers ("%pK") were never meant +to be used through printk(). They can still unintentionally leak raw +pointers or acquire sleeping locks in atomic contexts. + +Switch to the regular pointer formatting which is safer and +easier to reason about. + +There are still a few users of %pK left, but these use it through +seq_file, for which its usage is safe. + +Signed-off-by: Thomas Weißschuh +Acked-by: Carlos Llamas +Reviewed-by: Alice Ryhl +Link: https://patch.msgid.link/20260107-restricted-pointers-binder-v1-1-181018bf3812@linutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/android/binder.c | 2 +- + drivers/android/binder_alloc.c | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/android/binder.c b/drivers/android/binder.c +index 8e2989fb56a71..a6b3bfe0d9b81 100644 +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -4523,7 +4523,7 @@ static int binder_thread_write(struct binder_proc *proc, + } + } + binder_debug(BINDER_DEBUG_DEAD_BINDER, +- "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n", ++ "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n", + proc->pid, thread->pid, (u64)cookie, + death); + if (death == NULL) { +diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c +index 979c96b74cad3..d5ed64543bbf4 100644 +--- a/drivers/android/binder_alloc.c ++++ b/drivers/android/binder_alloc.c +@@ -81,7 +81,7 @@ static void binder_insert_free_buffer(struct binder_alloc *alloc, + new_buffer_size = binder_alloc_buffer_size(alloc, new_buffer); + + binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC, +- "%d: add free buffer, size %zd, at %pK\n", ++ "%d: add free buffer, size %zd, at %p\n", + alloc->pid, new_buffer_size, new_buffer); + + while (*p) { +@@ -572,7 +572,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked( + } + + binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC, +- "%d: binder_alloc_buf size %zd got buffer %pK size %zd\n", ++ "%d: binder_alloc_buf size %zd got buffer %p size %zd\n", + alloc->pid, size, buffer, buffer_size); + + /* +@@ -748,7 +748,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc, + ALIGN(buffer->extra_buffers_size, sizeof(void *)); + + binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC, +- "%d: binder_free_buf %pK size %zd buffer_size %zd\n", ++ "%d: binder_free_buf %p size %zd buffer_size %zd\n", + alloc->pid, buffer, size, buffer_size); + + BUG_ON(buffer->free); +-- +2.51.0 + diff --git a/queue-6.18/blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch b/queue-6.18/blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch new file mode 100644 index 00000000000..618482fb094 --- /dev/null +++ b/queue-6.18/blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch @@ -0,0 +1,42 @@ +From 11512ea13b9b91785d5b9102d63cc4cbd0677f10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 16:05:22 +0800 +Subject: blk-mq-debugfs: add missing debugfs_mutex in + blk_mq_debugfs_register_hctxs() + +From: Yu Kuai + +[ Upstream commit 9d20fd6ce1ba9733cd5ac96fcab32faa9fc404dd ] + +In blk_mq_update_nr_hw_queues(), debugfs_mutex is not held while +creating debugfs entries for hctxs. Hence add debugfs_mutex there, +it's safe because queue is not frozen. + +Signed-off-by: Yu Kuai +Reviewed-by: Nilay Shroff +Reviewed-by: Ming Lei +Reviewed-by: Hannes Reinecke +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-debugfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c +index 4896525b1c054..553d93b88e194 100644 +--- a/block/blk-mq-debugfs.c ++++ b/block/blk-mq-debugfs.c +@@ -686,8 +686,10 @@ void blk_mq_debugfs_register_hctxs(struct request_queue *q) + struct blk_mq_hw_ctx *hctx; + unsigned long i; + ++ mutex_lock(&q->debugfs_mutex); + queue_for_each_hw_ctx(q, hctx, i) + blk_mq_debugfs_register_hctx(q, hctx); ++ mutex_unlock(&q->debugfs_mutex); + } + + void blk_mq_debugfs_unregister_hctxs(struct request_queue *q) +-- +2.51.0 + diff --git a/queue-6.18/blk-mq-sched-unify-elevators-checking-for-async-requ.patch b/queue-6.18/blk-mq-sched-unify-elevators-checking-for-async-requ.patch new file mode 100644 index 00000000000..7c8273d606c --- /dev/null +++ b/queue-6.18/blk-mq-sched-unify-elevators-checking-for-async-requ.patch @@ -0,0 +1,87 @@ +From 656a6cb988461f9a830156d926d5a09890891ab8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 16:19:43 +0800 +Subject: blk-mq-sched: unify elevators checking for async requests + +From: Yu Kuai + +[ Upstream commit 1db61b0afdd7e8aa9289c423fdff002603b520b5 ] + +bfq and mq-deadline consider sync writes as async requests and only +reserve tags for sync reads by async_depth, however, kyber doesn't +consider sync writes as async requests for now. + +Consider the case there are lots of dirty pages, and user use fsync to +flush dirty pages. In this case sched_tags can be exhausted by sync writes +and sync reads can stuck waiting for tag. Hence let kyber follow what +mq-deadline and bfq did, and unify async requests checking for all +elevators. + +Signed-off-by: Yu Kuai +Reviewed-by: Nilay Shroff +Reviewed-by: Hannes Reinecke +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bfq-iosched.c | 2 +- + block/blk-mq-sched.h | 5 +++++ + block/kyber-iosched.c | 2 +- + block/mq-deadline.c | 2 +- + 4 files changed, 8 insertions(+), 3 deletions(-) + +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index 6e54b1d3d8bc2..9e9d081e86bb2 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -697,7 +697,7 @@ static void bfq_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data) + unsigned int limit, act_idx; + + /* Sync reads have full depth available */ +- if (op_is_sync(opf) && !op_is_write(opf)) ++ if (blk_mq_is_sync_read(opf)) + limit = data->q->nr_requests; + else + limit = bfqd->async_depths[!!bfqd->wr_busy_queues][op_is_sync(opf)]; +diff --git a/block/blk-mq-sched.h b/block/blk-mq-sched.h +index 02c40a72e9598..5678e15bd33c4 100644 +--- a/block/blk-mq-sched.h ++++ b/block/blk-mq-sched.h +@@ -137,4 +137,9 @@ static inline void blk_mq_set_min_shallow_depth(struct request_queue *q, + depth); + } + ++static inline bool blk_mq_is_sync_read(blk_opf_t opf) ++{ ++ return op_is_sync(opf) && !op_is_write(opf); ++} ++ + #endif +diff --git a/block/kyber-iosched.c b/block/kyber-iosched.c +index 18efd6ef2a2b9..e3eaeea62e24d 100644 +--- a/block/kyber-iosched.c ++++ b/block/kyber-iosched.c +@@ -544,7 +544,7 @@ static void kyber_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data) + * We use the scheduler tags as per-hardware queue queueing tokens. + * Async requests can be limited at this stage. + */ +- if (!op_is_sync(opf)) { ++ if (!blk_mq_is_sync_read(opf)) { + struct kyber_queue_data *kqd = data->q->elevator->elevator_data; + + data->shallow_depth = kqd->async_depth; +diff --git a/block/mq-deadline.c b/block/mq-deadline.c +index 3e3719093aec7..29d00221fbea6 100644 +--- a/block/mq-deadline.c ++++ b/block/mq-deadline.c +@@ -495,7 +495,7 @@ static void dd_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data) + struct deadline_data *dd = data->q->elevator->elevator_data; + + /* Do not throttle synchronous reads. */ +- if (op_is_sync(opf) && !op_is_write(opf)) ++ if (blk_mq_is_sync_read(opf)) + return; + + /* +-- +2.51.0 + diff --git a/queue-6.18/block-decouple-secure-erase-size-limit-from-discard-.patch b/queue-6.18/block-decouple-secure-erase-size-limit-from-discard-.patch new file mode 100644 index 00000000000..2c9e4bf6346 --- /dev/null +++ b/queue-6.18/block-decouple-secure-erase-size-limit-from-discard-.patch @@ -0,0 +1,91 @@ +From c4573599f67ee2142af626241b98466c2d149089 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 11:40:02 +0800 +Subject: block: decouple secure erase size limit from discard size limit + +From: Luke Wang + +[ Upstream commit ee81212f74a57c5d2b56cf504f40d528dac6faaf ] + +Secure erase should use max_secure_erase_sectors instead of being limited +by max_discard_sectors. Separate the handling of REQ_OP_SECURE_ERASE from +REQ_OP_DISCARD to allow each operation to use its own size limit. + +Signed-off-by: Luke Wang +Reviewed-by: Ulf Hansson +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-merge.c | 21 +++++++++++++++++---- + block/blk.h | 6 +++++- + 2 files changed, 22 insertions(+), 5 deletions(-) + +diff --git a/block/blk-merge.c b/block/blk-merge.c +index 37864c5d287ef..03b61923cf109 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -158,8 +158,9 @@ static struct bio *bio_submit_split(struct bio *bio, int split_sectors) + return bio; + } + +-struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim, +- unsigned *nsegs) ++static struct bio *__bio_split_discard(struct bio *bio, ++ const struct queue_limits *lim, unsigned *nsegs, ++ unsigned int max_sectors) + { + unsigned int max_discard_sectors, granularity; + sector_t tmp; +@@ -169,8 +170,7 @@ struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim, + + granularity = max(lim->discard_granularity >> 9, 1U); + +- max_discard_sectors = +- min(lim->max_discard_sectors, bio_allowed_max_sectors(lim)); ++ max_discard_sectors = min(max_sectors, bio_allowed_max_sectors(lim)); + max_discard_sectors -= max_discard_sectors % granularity; + if (unlikely(!max_discard_sectors)) + return bio; +@@ -194,6 +194,19 @@ struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim, + return bio_submit_split(bio, split_sectors); + } + ++struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim, ++ unsigned *nsegs) ++{ ++ unsigned int max_sectors; ++ ++ if (bio_op(bio) == REQ_OP_SECURE_ERASE) ++ max_sectors = lim->max_secure_erase_sectors; ++ else ++ max_sectors = lim->max_discard_sectors; ++ ++ return __bio_split_discard(bio, lim, nsegs, max_sectors); ++} ++ + static inline unsigned int blk_boundary_sectors(const struct queue_limits *lim, + bool is_atomic) + { +diff --git a/block/blk.h b/block/blk.h +index 37b9b6a95c11c..06dfb5b670179 100644 +--- a/block/blk.h ++++ b/block/blk.h +@@ -208,10 +208,14 @@ static inline unsigned int blk_queue_get_max_sectors(struct request *rq) + struct request_queue *q = rq->q; + enum req_op op = req_op(rq); + +- if (unlikely(op == REQ_OP_DISCARD || op == REQ_OP_SECURE_ERASE)) ++ if (unlikely(op == REQ_OP_DISCARD)) + return min(q->limits.max_discard_sectors, + UINT_MAX >> SECTOR_SHIFT); + ++ if (unlikely(op == REQ_OP_SECURE_ERASE)) ++ return min(q->limits.max_secure_erase_sectors, ++ UINT_MAX >> SECTOR_SHIFT); ++ + if (unlikely(op == REQ_OP_WRITE_ZEROES)) + return q->limits.max_write_zeroes_sectors; + +-- +2.51.0 + diff --git a/queue-6.18/bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch b/queue-6.18/bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch new file mode 100644 index 00000000000..23871575d27 --- /dev/null +++ b/queue-6.18/bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch @@ -0,0 +1,37 @@ +From 43d6b4807a956ee01fce526fabac9aedb40a33e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 10:13:04 +0100 +Subject: Bluetooth: btusb: Add device ID for Realtek RTL8761BU + +From: Jacopo Scannella + +[ Upstream commit cc6383d4f0cf6127c0552f94cae517a06ccc6b17 ] + +Add USB device ID 0x2c0a:0x8761 to the btusb driver fo the Realtek +RTL8761BU Bluetooth adapter. + +Reference: +https://www.startech.com/en-us/networking-io/av53c1-usb-bluetooth + +Signed-off-by: Jacopo Scannella +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index b70cc8d5e0389..7c7955afa8e8a 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -777,6 +777,7 @@ static const struct usb_device_id quirks_table[] = { + + /* Additional Realtek 8723BU Bluetooth devices */ + { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK }, ++ { USB_DEVICE(0x2c0a, 0x8761), .driver_info = BTUSB_REALTEK }, + + /* Additional Realtek 8723DE Bluetooth devices */ + { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK }, +-- +2.51.0 + diff --git a/queue-6.18/bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch b/queue-6.18/bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch new file mode 100644 index 00000000000..5bd63c5ae27 --- /dev/null +++ b/queue-6.18/bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch @@ -0,0 +1,74 @@ +From e3975fe399c94a2d3b1824657ed01fdfe8673663 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 15:03:35 +1100 +Subject: Bluetooth: btusb: Add new VID/PID for RTL8852CE + +From: Shell Chen + +[ Upstream commit d9f7c39c6b7548bd70519b241b6c2d1bcc658d4b ] + +Add VID:PID 13d3:3612 to the quirks_table. + +This ID pair is found in the Realtek RTL8852CE PCIe module +in an ASUS TUF A14 2025 (FA401KM) laptop. + +Tested on aforementioned laptop. + +The device info from /sys/kernel/debug/usb/devices is listed as below. + +T: Bus=03 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 +D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=13d3 ProdID=3612 Rev= 0.00 +S: Manufacturer=Realtek +S: Product=Bluetooth Radio +S: SerialNumber=00e04c000001 +C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms + +Signed-off-by: Shell Chen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 4c802b0f2f516..b70cc8d5e0389 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -561,6 +561,8 @@ static const struct usb_device_id quirks_table[] = { + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x13d3, 0x3592), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, ++ { USB_DEVICE(0x13d3, 0x3612), .driver_info = BTUSB_REALTEK | ++ BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0489, 0xe122), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, + +-- +2.51.0 + diff --git a/queue-6.18/bluetooth-btusb-add-support-for-mediatek7920-0489-e1.patch b/queue-6.18/bluetooth-btusb-add-support-for-mediatek7920-0489-e1.patch new file mode 100644 index 00000000000..df9ea959865 --- /dev/null +++ b/queue-6.18/bluetooth-btusb-add-support-for-mediatek7920-0489-e1.patch @@ -0,0 +1,76 @@ +From 263d1ed045df56fb614f3c6218dbdb64a872eafd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Dec 2025 23:22:25 +0300 +Subject: Bluetooth: btusb: Add support for MediaTek7920 0489:e158 + +From: Bluecross + +[ Upstream commit 2630bcc8343a9d2a38dc1793068e6754b3156811 ] + +Add support for MediaTek7920 0489:e158 + +/sys/kernel/debug/usb/devices reports for that device: + +T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=03 Dev#= 5 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=0489 ProdID=e158 Rev= 1.00 +S: Manufacturer=MediaTek Inc. +S: Product=Wireless_Device +S: SerialNumber=000000000 +C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA +A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) +E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us +E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us +I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) +E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us +E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us + +Signed-off-by: Andrew Elatsev +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index a953fa9af85c6..adc5a686c0f59 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -635,6 +635,8 @@ static const struct usb_device_id quirks_table[] = { + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x13d3, 0x3622), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH }, ++ { USB_DEVICE(0x0489, 0xe158), .driver_info = BTUSB_MEDIATEK | ++ BTUSB_WIDEBAND_SPEECH }, + + /* Additional MediaTek MT7921 Bluetooth devices */ + { USB_DEVICE(0x0489, 0xe0c8), .driver_info = BTUSB_MEDIATEK | +-- +2.51.0 + diff --git a/queue-6.18/bluetooth-btusb-add-usb-id-0489-e112-for-realtek-885.patch b/queue-6.18/bluetooth-btusb-add-usb-id-0489-e112-for-realtek-885.patch new file mode 100644 index 00000000000..7925e64d06c --- /dev/null +++ b/queue-6.18/bluetooth-btusb-add-usb-id-0489-e112-for-realtek-885.patch @@ -0,0 +1,41 @@ +From 217de738dba79b49ca4315f60fffa3bc49c1a5d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Dec 2025 11:31:29 +0800 +Subject: Bluetooth: btusb: Add USB ID 0489:e112 for Realtek 8851BE + +From: Techie Ernie + +[ Upstream commit e07094a51ad8faf98ea64320799ce550828e97cd ] + +Add USB ID 0489:e112 for the Realtek 8851BE Bluetooth adapter. +Without this entry, the device is not handled correctly by btusb and Bluetooth fails to initialise. +Adding the ID enables proper Realtek initialization for Bluetooth to work on various motherboards using this Bluetooth adapter. + +The device identifies as: + Bus 001 Device XXX: ID 0489:e112 Foxconn / Hon Hai Bluetooth Radio + +Tested on Realtek 8851BE. Bluetooth works after this change is made. + +Signed-off-by: Techie Ernie +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index adc5a686c0f59..4c802b0f2f516 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -521,6 +521,8 @@ static const struct usb_device_id quirks_table[] = { + { USB_DEVICE(0x0bda, 0xb850), .driver_info = BTUSB_REALTEK }, + { USB_DEVICE(0x13d3, 0x3600), .driver_info = BTUSB_REALTEK }, + { USB_DEVICE(0x13d3, 0x3601), .driver_info = BTUSB_REALTEK }, ++ { USB_DEVICE(0x0489, 0xe112), .driver_info = BTUSB_REALTEK | ++ BTUSB_WIDEBAND_SPEECH }, + + /* Realtek 8851BU Bluetooth devices */ + { USB_DEVICE(0x3625, 0x010b), .driver_info = BTUSB_REALTEK | +-- +2.51.0 + diff --git a/queue-6.18/bluetooth-hci_conn-set-link_policy-on-incoming-acl-c.patch b/queue-6.18/bluetooth-hci_conn-set-link_policy-on-incoming-acl-c.patch new file mode 100644 index 00000000000..08b9ebbb674 --- /dev/null +++ b/queue-6.18/bluetooth-hci_conn-set-link_policy-on-incoming-acl-c.patch @@ -0,0 +1,54 @@ +From 16155747ea694cd53b45e4fa58749e3923728f4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 10:20:10 +0100 +Subject: Bluetooth: hci_conn: Set link_policy on incoming ACL connections +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stefan Sørensen + +[ Upstream commit 4bb091013ab0f2edfed3f58bebe658a798cbcc4d ] + +The connection link policy is only set when establishing an outgoing +ACL connection causing connection idle modes not to be available on +incoming connections. Move the setting of the link policy to the +creation of the connection so all ACL connection will use the link +policy set on the HCI device. + +Signed-off-by: Stefan Sørensen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_conn.c | 1 + + net/bluetooth/hci_sync.c | 2 -- + 2 files changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 6fc0692abf057..6dbef0cd53037 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -990,6 +990,7 @@ static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t + switch (type) { + case ACL_LINK: + conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK; ++ conn->link_policy = hdev->link_policy; + conn->mtu = hdev->acl_mtu; + break; + case LE_LINK: +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index f5896c023a9fa..cc1d340a32c62 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -6879,8 +6879,6 @@ static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data) + + conn->attempt++; + +- conn->link_policy = hdev->link_policy; +- + memset(&cp, 0, sizeof(cp)); + bacpy(&cp.bdaddr, &conn->dst); + cp.pscan_rep_mode = 0x02; +-- +2.51.0 + diff --git a/queue-6.18/bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch b/queue-6.18/bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch new file mode 100644 index 00000000000..b4c3437526a --- /dev/null +++ b/queue-6.18/bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch @@ -0,0 +1,46 @@ +From d031bfe41bee480d8c1779df80d55007b203f1f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 10:20:09 +0100 +Subject: Bluetooth: hci_conn: use mod_delayed_work for active mode timeout +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stefan Sørensen + +[ Upstream commit 49d0901e260739de2fcc90c0c29f9e31e39a2d9b ] + +hci_conn_enter_active_mode() uses queue_delayed_work() with the +intention that the work will run after the given timeout. However, +queue_delayed_work() does nothing if the work is already queued, so +depending on the link policy we may end up putting the connection +into idle mode every hdev->idle_timeout ms. + +Use mod_delayed_work() instead so the work is queued if not already +queued, and the timeout is updated otherwise. + +Signed-off-by: Stefan Sørensen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_conn.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 6dbef0cd53037..6a27ac5a751ca 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -2592,8 +2592,8 @@ void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active) + + timer: + if (hdev->idle_timeout > 0) +- queue_delayed_work(hdev->workqueue, &conn->idle_work, +- msecs_to_jiffies(hdev->idle_timeout)); ++ mod_delayed_work(hdev->workqueue, &conn->idle_work, ++ msecs_to_jiffies(hdev->idle_timeout)); + } + + /* Drop all connection on the device */ +-- +2.51.0 + diff --git a/queue-6.18/bluetooth-hci_qca-fix-ssr-subsystem-restart-fail-whe.patch b/queue-6.18/bluetooth-hci_qca-fix-ssr-subsystem-restart-fail-whe.patch new file mode 100644 index 00000000000..0ceb2c82158 --- /dev/null +++ b/queue-6.18/bluetooth-hci_qca-fix-ssr-subsystem-restart-fail-whe.patch @@ -0,0 +1,91 @@ +From 80c61470a111e9d1fc019d0fe7152ee36dd0285a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Dec 2025 11:37:12 +0800 +Subject: Bluetooth: hci_qca: Fix SSR (SubSystem Restart) fail when BT_EN is + pulled up by hw + +From: Shuai Zhang + +[ Upstream commit fce1a9244a0f85683be8530e623bc729f24c5067 ] + +On QCS9075 and QCA8275 platforms, the BT_EN pin is always pulled up by hw +and cannot be controlled by the host. As a result, in case of a firmware +crash, the host cannot trigger a cold reset. Instead, the BT controller +performs a warm restart on its own, without reloading the firmware. + +This leads to the controller remaining in IBS_WAKE state, while the host +expects it to be in sleep mode. The mismatch causes HCI reset commands +to time out. Additionally, the driver does not clear internal flags +QCA_SSR_TRIGGERED and QCA_IBS_DISABLED, which blocks the reset sequence. +If the SSR duration exceeds 2 seconds, the host may enter TX sleep mode +due to tx_idle_timeout, further preventing recovery. Also, memcoredump_flag +is not cleared, so only the first SSR generates a coredump. + +Tell the driver that the BT controller has undergone a proper restart sequence: + +- Clear QCA_SSR_TRIGGERED and QCA_IBS_DISABLED flags after SSR. +- Add a 50ms delay to allow the controller to complete its warm reset. +- Reset tx_idle_timer to prevent the host from entering TX sleep mode. +- Clear memcoredump_flag to allow multiple coredump captures. + +Apply these steps only when HCI_QUIRK_NON_PERSISTENT_SETUP is not set, +which indicates that BT_EN is defined in DTS and cannot be toggled. + +Refer to the comment in include/net/bluetooth/hci.h for details on +HCI_QUIRK_NON_PERSISTENT_SETUP. + +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Shuai Zhang +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/hci_qca.c | 33 +++++++++++++++++++++++++++++++++ + 1 file changed, 33 insertions(+) + +diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c +index 888176b0faa90..a3c217571c3c4 100644 +--- a/drivers/bluetooth/hci_qca.c ++++ b/drivers/bluetooth/hci_qca.c +@@ -1653,6 +1653,39 @@ static void qca_hw_error(struct hci_dev *hdev, u8 code) + skb_queue_purge(&qca->rx_memdump_q); + } + ++ /* ++ * If the BT chip's bt_en pin is connected to a 3.3V power supply via ++ * hardware and always stays high, driver cannot control the bt_en pin. ++ * As a result, during SSR (SubSystem Restart), QCA_SSR_TRIGGERED and ++ * QCA_IBS_DISABLED flags cannot be cleared, which leads to a reset ++ * command timeout. ++ * Add an msleep delay to ensure controller completes the SSR process. ++ * ++ * Host will not download the firmware after SSR, controller to remain ++ * in the IBS_WAKE state, and the host needs to synchronize with it ++ * ++ * Since the bluetooth chip has been reset, clear the memdump state. ++ */ ++ if (!hci_test_quirk(hu->hdev, HCI_QUIRK_NON_PERSISTENT_SETUP)) { ++ /* ++ * When the SSR (SubSystem Restart) duration exceeds 2 seconds, ++ * it triggers host tx_idle_delay, which sets host TX state ++ * to sleep. Reset tx_idle_timer after SSR to prevent ++ * host enter TX IBS_Sleep mode. ++ */ ++ mod_timer(&qca->tx_idle_timer, jiffies + ++ msecs_to_jiffies(qca->tx_idle_delay)); ++ ++ /* Controller reset completion time is 50ms */ ++ msleep(50); ++ ++ clear_bit(QCA_SSR_TRIGGERED, &qca->flags); ++ clear_bit(QCA_IBS_DISABLED, &qca->flags); ++ ++ qca->tx_ibs_state = HCI_IBS_TX_AWAKE; ++ qca->memdump_state = QCA_MEMDUMP_IDLE; ++ } ++ + clear_bit(QCA_HW_ERROR_EVENT, &qca->flags); + } + +-- +2.51.0 + diff --git a/queue-6.18/bnxt_en-allow-ntuple-filters-for-drops.patch b/queue-6.18/bnxt_en-allow-ntuple-filters-for-drops.patch new file mode 100644 index 00000000000..746fc7b7ac4 --- /dev/null +++ b/queue-6.18/bnxt_en-allow-ntuple-filters-for-drops.patch @@ -0,0 +1,94 @@ +From 2a87cc47ada34cda55aa87417028b628a6300faa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 16:30:41 -0800 +Subject: bnxt_en: Allow ntuple filters for drops + +From: Joe Damato + +[ Upstream commit 61cef6454cfbb9fcdbe41401fb53895f86603081 ] + +It appears that in commit 7efd79c0e689 ("bnxt_en: Add drop action +support for ntuple"), bnxt gained support for ntuple filters for packet +drops. + +However, support for this does not seem to work in recent kernels or +against net-next: + + % sudo ethtool -U eth0 flow-type udp4 src-ip 1.1.1.1 action -1 + rmgr: Cannot insert RX class rule: Operation not supported + Cannot insert classification rule + +The issue is that the existing code uses ethtool_get_flow_spec_ring_vf, +which will return a non-zero value if the ring_cookie is set to +RX_CLS_FLOW_DISC, which then causes bnxt_add_ntuple_cls_rule to return +-EOPNOTSUPP because it thinks the user is trying to set an ntuple filter +for a vf. + +Fix this by first checking that the ring_cookie is not RX_CLS_FLOW_DISC. + +After this patch, ntuple filters for drops can be added: + + % sudo ethtool -U eth0 flow-type udp4 src-ip 1.1.1.1 action -1 + Added rule with ID 0 + + % ethtool -n eth0 + 44 RX rings available + Total 1 rules + + Filter: 0 + Rule Type: UDP over IPv4 + Src IP addr: 1.1.1.1 mask: 0.0.0.0 + Dest IP addr: 0.0.0.0 mask: 255.255.255.255 + TOS: 0x0 mask: 0xff + Src port: 0 mask: 0xffff + Dest port: 0 mask: 0xffff + Action: Drop + +Reviewed-by: Michael Chan +Signed-off-by: Joe Damato +Link: https://patch.msgid.link/20260131003042.2570434-1-joe@dama.to +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 41686a6f84b58..df4f0d15dd3d8 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -1340,16 +1340,17 @@ static int bnxt_add_ntuple_cls_rule(struct bnxt *bp, + struct bnxt_l2_filter *l2_fltr; + struct bnxt_flow_masks *fmasks; + struct flow_keys *fkeys; +- u32 idx, ring; ++ u32 idx; + int rc; +- u8 vf; + + if (!bp->vnic_info) + return -EAGAIN; + +- vf = ethtool_get_flow_spec_ring_vf(fs->ring_cookie); +- ring = ethtool_get_flow_spec_ring(fs->ring_cookie); +- if ((fs->flow_type & (FLOW_MAC_EXT | FLOW_EXT)) || vf) ++ if (fs->flow_type & (FLOW_MAC_EXT | FLOW_EXT)) ++ return -EOPNOTSUPP; ++ ++ if (fs->ring_cookie != RX_CLS_FLOW_DISC && ++ ethtool_get_flow_spec_ring_vf(fs->ring_cookie)) + return -EOPNOTSUPP; + + if (flow_type == IP_USER_FLOW) { +@@ -1475,7 +1476,7 @@ static int bnxt_add_ntuple_cls_rule(struct bnxt *bp, + if (fs->ring_cookie == RX_CLS_FLOW_DISC) + new_fltr->base.flags |= BNXT_ACT_DROP; + else +- new_fltr->base.rxq = ring; ++ new_fltr->base.rxq = ethtool_get_flow_spec_ring(fs->ring_cookie); + __set_bit(BNXT_FLTR_VALID, &new_fltr->base.state); + rc = bnxt_insert_ntp_filter(bp, new_fltr, idx); + if (!rc) { +-- +2.51.0 + diff --git a/queue-6.18/bpf-crypto-use-the-correct-destructor-kfunc-type.patch b/queue-6.18/bpf-crypto-use-the-correct-destructor-kfunc-type.patch new file mode 100644 index 00000000000..140df491749 --- /dev/null +++ b/queue-6.18/bpf-crypto-use-the-correct-destructor-kfunc-type.patch @@ -0,0 +1,63 @@ +From 4356b82548c68ec996ca434df951b24a2d7ae858 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 08:25:50 +0000 +Subject: bpf: crypto: Use the correct destructor kfunc type + +From: Sami Tolvanen + +[ Upstream commit b40a5d724f29fc2eed23ff353808a9aae616b48a ] + +With CONFIG_CFI enabled, the kernel strictly enforces that indirect +function calls use a function pointer type that matches the target +function. I ran into the following type mismatch when running BPF +self-tests: + + CFI failure at bpf_obj_free_fields+0x190/0x238 (target: + bpf_crypto_ctx_release+0x0/0x94; expected type: 0xa488ebfc) + Internal error: Oops - CFI: 00000000f2008228 [#1] SMP + ... + +As bpf_crypto_ctx_release() is also used in BPF programs and using +a void pointer as the argument would make the verifier unhappy, add +a simple stub function with the correct type and register it as the +destructor kfunc instead. + +Signed-off-by: Sami Tolvanen +Acked-by: Yonghong Song +Tested-by: Viktor Malik +Link: https://lore.kernel.org/r/20260110082548.113748-7-samitolvanen@google.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/crypto.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/kernel/bpf/crypto.c b/kernel/bpf/crypto.c +index 83c4d9943084b..1d024fe7248ac 100644 +--- a/kernel/bpf/crypto.c ++++ b/kernel/bpf/crypto.c +@@ -261,6 +261,12 @@ __bpf_kfunc void bpf_crypto_ctx_release(struct bpf_crypto_ctx *ctx) + call_rcu(&ctx->rcu, crypto_free_cb); + } + ++__bpf_kfunc void bpf_crypto_ctx_release_dtor(void *ctx) ++{ ++ bpf_crypto_ctx_release(ctx); ++} ++CFI_NOSEAL(bpf_crypto_ctx_release_dtor); ++ + static int bpf_crypto_crypt(const struct bpf_crypto_ctx *ctx, + const struct bpf_dynptr_kern *src, + const struct bpf_dynptr_kern *dst, +@@ -368,7 +374,7 @@ static const struct btf_kfunc_id_set crypt_kfunc_set = { + + BTF_ID_LIST(bpf_crypto_dtor_ids) + BTF_ID(struct, bpf_crypto_ctx) +-BTF_ID(func, bpf_crypto_ctx_release) ++BTF_ID(func, bpf_crypto_ctx_release_dtor) + + static int __init crypto_kfunc_init(void) + { +-- +2.51.0 + diff --git a/queue-6.18/bpf-net_sched-use-the-correct-destructor-kfunc-type.patch b/queue-6.18/bpf-net_sched-use-the-correct-destructor-kfunc-type.patch new file mode 100644 index 00000000000..3c6b1336f47 --- /dev/null +++ b/queue-6.18/bpf-net_sched-use-the-correct-destructor-kfunc-type.patch @@ -0,0 +1,54 @@ +From 3e2e9a182a291ebb1c2fc3850d8e385f69fd4375 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 08:25:51 +0000 +Subject: bpf: net_sched: Use the correct destructor kfunc type + +From: Sami Tolvanen + +[ Upstream commit c99d97b46631c4bea0c14b7581b7a59214601e63 ] + +With CONFIG_CFI enabled, the kernel strictly enforces that indirect +function calls use a function pointer type that matches the +target function. As bpf_kfree_skb() signature differs from the +btf_dtor_kfunc_t pointer type used for the destructor calls in +bpf_obj_free_fields(), add a stub function with the correct type to +fix the type mismatch. + +Signed-off-by: Sami Tolvanen +Acked-by: Yonghong Song +Link: https://lore.kernel.org/r/20260110082548.113748-8-samitolvanen@google.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + net/sched/bpf_qdisc.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/net/sched/bpf_qdisc.c b/net/sched/bpf_qdisc.c +index adcb618a2bfca..e9bea9890777d 100644 +--- a/net/sched/bpf_qdisc.c ++++ b/net/sched/bpf_qdisc.c +@@ -202,6 +202,12 @@ __bpf_kfunc void bpf_kfree_skb(struct sk_buff *skb) + kfree_skb(skb); + } + ++__bpf_kfunc void bpf_kfree_skb_dtor(void *skb) ++{ ++ bpf_kfree_skb(skb); ++} ++CFI_NOSEAL(bpf_kfree_skb_dtor); ++ + /* bpf_qdisc_skb_drop - Drop an skb by adding it to a deferred free list. + * @skb: The skb whose reference to be released and dropped. + * @to_free_list: The list of skbs to be dropped. +@@ -449,7 +455,7 @@ static struct bpf_struct_ops bpf_Qdisc_ops = { + .owner = THIS_MODULE, + }; + +-BTF_ID_LIST_SINGLE(bpf_sk_buff_dtor_ids, func, bpf_kfree_skb) ++BTF_ID_LIST_SINGLE(bpf_sk_buff_dtor_ids, func, bpf_kfree_skb_dtor) + + static int __init bpf_qdisc_kfunc_init(void) + { +-- +2.51.0 + diff --git a/queue-6.18/bpf-properly-mark-live-registers-for-indirect-jumps.patch b/queue-6.18/bpf-properly-mark-live-registers-for-indirect-jumps.patch new file mode 100644 index 00000000000..8427aa47bf4 --- /dev/null +++ b/queue-6.18/bpf-properly-mark-live-registers-for-indirect-jumps.patch @@ -0,0 +1,40 @@ +From 45a6fdde25c22ec3d28d1fb13da344f36ae00ee1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 16:25:43 +0000 +Subject: bpf: Properly mark live registers for indirect jumps + +From: Anton Protopopov + +[ Upstream commit d1aab1ca576c90192ba961094d51b0be6355a4d6 ] + +For a `gotox rX` instruction the rX register should be marked as used +in the compute_insn_live_regs() function. Fix this. + +Signed-off-by: Anton Protopopov +Link: https://lore.kernel.org/r/20260114162544.83253-2-a.s.protopopov@gmail.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index e94a02ae3e1cd..dcbf21f61d2e6 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -24292,6 +24292,12 @@ static void compute_insn_live_regs(struct bpf_verifier_env *env, + case BPF_JMP32: + switch (code) { + case BPF_JA: ++ def = 0; ++ if (BPF_SRC(insn->code) == BPF_X) ++ use = dst; ++ else ++ use = 0; ++ break; + case BPF_JCOND: + def = 0; + use = 0; +-- +2.51.0 + diff --git a/queue-6.18/bpf-recognize-special-arithmetic-shift-in-the-verifi.patch b/queue-6.18/bpf-recognize-special-arithmetic-shift-in-the-verifi.patch new file mode 100644 index 00000000000..9bc6e6ffec6 --- /dev/null +++ b/queue-6.18/bpf-recognize-special-arithmetic-shift-in-the-verifi.patch @@ -0,0 +1,181 @@ +From acefb303f5ca25685b0ff86f2fdc0dbafc3a2fdd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 12:13:57 -0800 +Subject: bpf: Recognize special arithmetic shift in the verifier + +From: Alexei Starovoitov + +[ Upstream commit bffacdb80b93b7b5e96b26fad64cc490a6c7d6c7 ] + +cilium bpf_wiregard.bpf.c when compiled with -O1 fails to load +with the following verifier log: + +192: (79) r2 = *(u64 *)(r10 -304) ; R2=pkt(r=40) R10=fp0 fp-304=pkt(r=40) +... +227: (85) call bpf_skb_store_bytes#9 ; R0=scalar() +228: (bc) w2 = w0 ; R0=scalar() R2=scalar(smin=0,smax=umax=0xffffffff,var_off=(0x0; 0xffffffff)) +229: (c4) w2 s>>= 31 ; R2=scalar(smin=0,smax=umax=0xffffffff,smin32=-1,smax32=0,var_off=(0x0; 0xffffffff)) +230: (54) w2 &= -134 ; R2=scalar(smin=0,smax=umax=umax32=0xffffff7a,smax32=0x7fffff7a,var_off=(0x0; 0xffffff7a)) +... +232: (66) if w2 s> 0xffffffff goto pc+125 ; R2=scalar(smin=umin=umin32=0x80000000,smax=umax=umax32=0xffffff7a,smax32=-134,var_off=(0x80000000; 0x7fffff7a)) +... +238: (79) r4 = *(u64 *)(r10 -304) ; R4=scalar() R10=fp0 fp-304=scalar() +239: (56) if w2 != 0xffffff78 goto pc+210 ; R2=0xffffff78 // -136 +... +258: (71) r1 = *(u8 *)(r4 +0) +R4 invalid mem access 'scalar' + +The error might confuse most bpf authors, since fp-304 slot had 'pkt' +pointer at insn 192 and became 'scalar' at 238. That happened because +bpf_skb_store_bytes() clears all packet pointers including those in +the stack. On the first glance it might look like a bug in the source +code, since ctx->data pointer should have been reloaded after the call +to bpf_skb_store_bytes(). + +The relevant part of cilium source code looks like this: + +// bpf/lib/nodeport.h +int dsr_set_ipip6() +{ + if (ctx_adjust_hroom(...)) + return DROP_INVALID; // -134 + if (ctx_store_bytes(...)) + return DROP_WRITE_ERROR; // -141 + return 0; +} + +bool dsr_fail_needs_reply(int code) +{ + if (code == DROP_FRAG_NEEDED) // -136 + return true; + return false; +} + +tail_nodeport_ipv6_dsr() +{ + ret = dsr_set_ipip6(...); + if (!IS_ERR(ret)) { + ... + } else { + if (dsr_fail_needs_reply(ret)) + return dsr_reply_icmp6(...); + } +} + +The code doesn't have arithmetic shift by 31 and it reloads ctx->data +every time it needs to access it. So it's not a bug in the source code. + +The reason is DAGCombiner::foldSelectCCToShiftAnd() LLVM transformation: + + // If this is a select where the false operand is zero and the compare is a + // check of the sign bit, see if we can perform the "gzip trick": + // select_cc setlt X, 0, A, 0 -> and (sra X, size(X)-1), A + // select_cc setgt X, 0, A, 0 -> and (not (sra X, size(X)-1)), A + +The conditional branch in dsr_set_ipip6() and its return values +are optimized into BPF_ARSH plus BPF_AND: + +227: (85) call bpf_skb_store_bytes#9 +228: (bc) w2 = w0 +229: (c4) w2 s>>= 31 ; R2=scalar(smin=0,smax=umax=0xffffffff,smin32=-1,smax32=0,var_off=(0x0; 0xffffffff)) +230: (54) w2 &= -134 ; R2=scalar(smin=0,smax=umax=umax32=0xffffff7a,smax32=0x7fffff7a,var_off=(0x0; 0xffffff7a)) + +after insn 230 the register w2 can only be 0 or -134, +but the verifier approximates it, since there is no way to +represent two scalars in bpf_reg_state. +After fallthough at insn 232 the w2 can only be -134, +hence the branch at insn +239: (56) if w2 != -136 goto pc+210 +should be always taken, and trapping insn 258 should never execute. +LLVM generated correct code, but the verifier follows impossible +path and rejects valid program. To fix this issue recognize this +special LLVM optimization and fork the verifier state. +So after insn 229: (c4) w2 s>>= 31 +the verifier has two states to explore: +one with w2 = 0 and another with w2 = 0xffffffff +which makes the verifier accept bpf_wiregard.c + +A similar pattern exists were OR operation is used in place of the AND +operation, the verifier detects that pattern as well by forking the +state before the OR operation with a scalar in range [-1,0]. + +Note there are 20+ such patterns in bpf_wiregard.o compiled +with -O1 and -O2, but they're rarely seen in other production +bpf programs, so push_stack() approach is not a concern. + +Reported-by: Hao Sun +Signed-off-by: Alexei Starovoitov +Co-developed-by: Puranjay Mohan +Signed-off-by: Puranjay Mohan +Link: https://lore.kernel.org/r/20260112201424.816836-2-puranjay@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 39 +++++++++++++++++++++++++++++++++++++++ + 1 file changed, 39 insertions(+) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index f7ca88fe20e75..e94a02ae3e1cd 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -15418,6 +15418,35 @@ static bool is_safe_to_compute_dst_reg_range(struct bpf_insn *insn, + } + } + ++static int maybe_fork_scalars(struct bpf_verifier_env *env, struct bpf_insn *insn, ++ struct bpf_reg_state *dst_reg) ++{ ++ struct bpf_verifier_state *branch; ++ struct bpf_reg_state *regs; ++ bool alu32; ++ ++ if (dst_reg->smin_value == -1 && dst_reg->smax_value == 0) ++ alu32 = false; ++ else if (dst_reg->s32_min_value == -1 && dst_reg->s32_max_value == 0) ++ alu32 = true; ++ else ++ return 0; ++ ++ branch = push_stack(env, env->insn_idx + 1, env->insn_idx, false); ++ if (IS_ERR(branch)) ++ return PTR_ERR(branch); ++ ++ regs = branch->frame[branch->curframe]->regs; ++ if (alu32) { ++ __mark_reg32_known(®s[insn->dst_reg], 0); ++ __mark_reg32_known(dst_reg, -1ull); ++ } else { ++ __mark_reg_known(®s[insn->dst_reg], 0); ++ __mark_reg_known(dst_reg, -1ull); ++ } ++ return 0; ++} ++ + /* WARNING: This function does calculations on 64-bit values, but the actual + * execution may occur on 32-bit values. Therefore, things like bitshifts + * need extra checks in the 32-bit case. +@@ -15480,11 +15509,21 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env, + scalar_min_max_mul(dst_reg, &src_reg); + break; + case BPF_AND: ++ if (tnum_is_const(src_reg.var_off)) { ++ ret = maybe_fork_scalars(env, insn, dst_reg); ++ if (ret) ++ return ret; ++ } + dst_reg->var_off = tnum_and(dst_reg->var_off, src_reg.var_off); + scalar32_min_max_and(dst_reg, &src_reg); + scalar_min_max_and(dst_reg, &src_reg); + break; + case BPF_OR: ++ if (tnum_is_const(src_reg.var_off)) { ++ ret = maybe_fork_scalars(env, insn, dst_reg); ++ if (ret) ++ return ret; ++ } + dst_reg->var_off = tnum_or(dst_reg->var_off, src_reg.var_off); + scalar32_min_max_or(dst_reg, &src_reg); + scalar_min_max_or(dst_reg, &src_reg); +-- +2.51.0 + diff --git a/queue-6.18/bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch b/queue-6.18/bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch new file mode 100644 index 00000000000..238a7c1af1f --- /dev/null +++ b/queue-6.18/bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch @@ -0,0 +1,72 @@ +From 50a5fd9e87d75db859f62624a815e45d8566f1fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 18:02:19 +0000 +Subject: bpf: verifier improvement in 32bit shift sign extension pattern + +From: Cupertino Miranda + +[ Upstream commit d18dec4b8990048ce75f0ece32bb96b3fbd3f422 ] + +This patch improves the verifier to correctly compute bounds for +sign extension compiler pattern composed of left shift by 32bits +followed by a sign right shift by 32bits. Pattern in the verifier was +limitted to positive value bounds and would reset bound computation for +negative values. New code allows both positive and negative values for +sign extension without compromising bound computation and verifier to +pass. + +This change is required by GCC which generate such pattern, and was +detected in the context of systemd, as described in the following GCC +bugzilla: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119731 + +Three new tests were added in verifier_subreg.c. + +Signed-off-by: Cupertino Miranda +Signed-off-by: Andrew Pinski +Acked-by: Eduard Zingerman +Cc: David Faust +Cc: Jose Marchesi +Cc: Elena Zannoni +Link: https://lore.kernel.org/r/20251202180220.11128-2-cupertino.miranda@oracle.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 18 +++++++----------- + 1 file changed, 7 insertions(+), 11 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index c4fa2268dbbc5..f7ca88fe20e75 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -15224,21 +15224,17 @@ static void __scalar64_min_max_lsh(struct bpf_reg_state *dst_reg, + u64 umin_val, u64 umax_val) + { + /* Special case <<32 because it is a common compiler pattern to sign +- * extend subreg by doing <<32 s>>32. In this case if 32bit bounds are +- * positive we know this shift will also be positive so we can track +- * bounds correctly. Otherwise we lose all sign bit information except +- * what we can pick up from var_off. Perhaps we can generalize this +- * later to shifts of any length. ++ * extend subreg by doing <<32 s>>32. smin/smax assignments are correct ++ * because s32 bounds don't flip sign when shifting to the left by ++ * 32bits. + */ +- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_max_value >= 0) ++ if (umin_val == 32 && umax_val == 32) { + dst_reg->smax_value = (s64)dst_reg->s32_max_value << 32; +- else +- dst_reg->smax_value = S64_MAX; +- +- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_min_value >= 0) + dst_reg->smin_value = (s64)dst_reg->s32_min_value << 32; +- else ++ } else { ++ dst_reg->smax_value = S64_MAX; + dst_reg->smin_value = S64_MIN; ++ } + + /* If we might shift our top bit out, then we know nothing */ + if (dst_reg->umax_value > 1ULL << (63 - umax_val)) { +-- +2.51.0 + diff --git a/queue-6.18/bpftool-fix-dependencies-for-static-build.patch b/queue-6.18/bpftool-fix-dependencies-for-static-build.patch new file mode 100644 index 00000000000..e67647e8fcd --- /dev/null +++ b/queue-6.18/bpftool-fix-dependencies-for-static-build.patch @@ -0,0 +1,52 @@ +From c865dc7c720ef2b61ae15823ac8455172f693670 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 13:12:55 -0800 +Subject: bpftool: Fix dependencies for static build + +From: Ihor Solodrai + +[ Upstream commit 08a7491843224f8b96518fbe70d9e48163046054 ] + +When building selftests/bpf with EXTRA_LDFLAGS=-static the follwoing +error happens: + + LINK /ws/linux/tools/testing/selftests/bpf/tools/build/bpftool/bootstrap/bpftool +/usr/bin/x86_64-linux-gnu-ld.bfd: /usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu/libcrypto.a(libcrypto-lib-dso_dlfcn.o): in function `dlfcn_globallookup': + [...] +/usr/bin/x86_64-linux-gnu-ld.bfd: /usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu/libcrypto.a(libcrypto-lib-c_zlib.o): in function `zlib_oneshot_expand_block': +(.text+0xc64): undefined reference to `uncompress' +/usr/bin/x86_64-linux-gnu-ld.bfd: /usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu/libcrypto.a(libcrypto-lib-c_zlib.o): in function `zlib_oneshot_compress_block': +(.text+0xce4): undefined reference to `compress' +collect2: error: ld returned 1 exit status +make[1]: *** [Makefile:252: /ws/linux/tools/testing/selftests/bpf/tools/build/bpftool/bootstrap/bpftool] Error 1 +make: *** [Makefile:327: /ws/linux/tools/testing/selftests/bpf/tools/sbin/bpftool] Error 2 +make: *** Waiting for unfinished jobs.... + +This is caused by wrong order of dependencies in the Makefile. Fix it. + +Signed-off-by: Ihor Solodrai +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20260128211255.376933-1-ihor.solodrai@linux.dev +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/bpf/bpftool/Makefile b/tools/bpf/bpftool/Makefile +index 586d1b2595d16..fd43e5ea63f38 100644 +--- a/tools/bpf/bpftool/Makefile ++++ b/tools/bpf/bpftool/Makefile +@@ -130,8 +130,8 @@ include $(FEATURES_DUMP) + endif + endif + +-LIBS = $(LIBBPF) -lelf -lz -lcrypto +-LIBS_BOOTSTRAP = $(LIBBPF_BOOTSTRAP) -lelf -lz -lcrypto ++LIBS = $(LIBBPF) -lelf -lcrypto -lz ++LIBS_BOOTSTRAP = $(LIBBPF_BOOTSTRAP) -lelf -lcrypto -lz + + ifeq ($(feature-libelf-zstd),1) + LIBS += -lzstd +-- +2.51.0 + diff --git a/queue-6.18/btrfs-fallback-to-buffered-io-if-the-data-profile-ha.patch b/queue-6.18/btrfs-fallback-to-buffered-io-if-the-data-profile-ha.patch new file mode 100644 index 00000000000..3315a0677fb --- /dev/null +++ b/queue-6.18/btrfs-fallback-to-buffered-io-if-the-data-profile-ha.patch @@ -0,0 +1,108 @@ +From 1b8667538cdd103a0461cda5c4f98b65a83f81f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Nov 2025 10:22:16 +1030 +Subject: btrfs: fallback to buffered IO if the data profile has duplication + +From: Qu Wenruo + +[ Upstream commit 7c2830f00c3e086292c1ee9f27b61efaf8e76c9a ] + +[BACKGROUND] +Inspired by a recent kernel bug report, which is related to direct IO +buffer modification during writeback, that leads to contents mismatch of +different RAID1 mirrors. + +[CAUSE AND PROBLEMS] +The root cause is exactly the same explained in commit 968f19c5b1b7 +("btrfs: always fallback to buffered write if the inode requires +checksum"), that we can not trust direct IO buffer which can be modified +halfway during writeback. + +Unlike data checksum verification, if this happened on inodes without +data checksum but has the data has extra mirrors, it will lead to +stealth data mismatch on different mirrors. + +This will be way harder to detect without data checksum. + +Furthermore for RAID56, we can even have data without checksum and data +with checksum mixed inside the same full stripe. + +In that case if the direct IO buffer got changed halfway for the +nodatasum part, the data with checksum immediately lost its ability to +recover, e.g.: + +" " = Good old data or parity calculated using good old data +"X" = Data modified during writeback + + 0 32K 64K + Data 1 | | Has csum + Data 2 |XXXXXXXXXXXXXXXX | No csum + Parity | | + +In above case, the parity is calculated using data 1 (has csum, from +page cache, won't change during writeback), and old data 2 (has no csum, +direct IO write). + +After parity is calculated, but before submission to the storage, direct +IO buffer of data 2 is modified, causing the range [0, 32K) of data 2 +has a different content. + +Now all data is submitted to the storage, and the fs got fully synced. + +Then the device of data 1 is lost, has to be rebuilt from data 2 and +parity. But since the data 2 has some modified data, and the parity is +calculated using old data, the recovered data is no the same for data 1, +causing data checksum mismatch. + +[FIX] +Fix the problem by checking the data allocation profile. +If our data allocation profile is either RAID0 or SINGLE, we can allow +true zero-copy direct IO and the end user is fully responsible for any +race. + +However this is not going to fix all situations, as it's still possible +to race with balance where the fs got a new data profile after the data +allocation profile check. +But this fix should still greatly reduce the window of the original bug. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=99171 +Signed-off-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/direct-io.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/fs/btrfs/direct-io.c b/fs/btrfs/direct-io.c +index e29ea28ce90b9..3836414cbe371 100644 +--- a/fs/btrfs/direct-io.c ++++ b/fs/btrfs/direct-io.c +@@ -814,6 +814,8 @@ ssize_t btrfs_direct_write(struct kiocb *iocb, struct iov_iter *from) + ssize_t ret; + unsigned int ilock_flags = 0; + struct iomap_dio *dio; ++ const u64 data_profile = btrfs_data_alloc_profile(fs_info) & ++ BTRFS_BLOCK_GROUP_PROFILE_MASK; + + if (iocb->ki_flags & IOCB_NOWAIT) + ilock_flags |= BTRFS_ILOCK_TRY; +@@ -827,6 +829,16 @@ ssize_t btrfs_direct_write(struct kiocb *iocb, struct iov_iter *from) + if (iocb->ki_pos + iov_iter_count(from) <= i_size_read(inode) && IS_NOSEC(inode)) + ilock_flags |= BTRFS_ILOCK_SHARED; + ++ /* ++ * If our data profile has duplication (either extra mirrors or RAID56), ++ * we can not trust the direct IO buffer, the content may change during ++ * writeback and cause different contents written to different mirrors. ++ * ++ * Thus only RAID0 and SINGLE can go true zero-copy direct IO. ++ */ ++ if (data_profile != BTRFS_BLOCK_GROUP_RAID0 && data_profile != 0) ++ goto buffered; ++ + relock: + ret = btrfs_inode_lock(BTRFS_I(inode), ilock_flags); + if (ret < 0) +-- +2.51.0 + diff --git a/queue-6.18/btrfs-handle-user-interrupt-properly-in-btrfs_trim_f.patch b/queue-6.18/btrfs-handle-user-interrupt-properly-in-btrfs_trim_f.patch new file mode 100644 index 00000000000..0bf4f1b7d00 --- /dev/null +++ b/queue-6.18/btrfs-handle-user-interrupt-properly-in-btrfs_trim_f.patch @@ -0,0 +1,76 @@ +From d1d21e463f923d01d656e990f66aa1b7d25d79d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 07:06:40 +0000 +Subject: btrfs: handle user interrupt properly in btrfs_trim_fs() + +From: jinbaohong + +[ Upstream commit bfb670b9183b0e4ba660aff2e396ec1cc01d0761 ] + +When a fatal signal is pending or the process is freezing, +btrfs_trim_block_group() and btrfs_trim_free_extents() return -ERESTARTSYS. +Currently this is treated as a regular error: the loops continue to the +next iteration and count it as a block group or device failure. + +Instead, break out of the loops immediately and return -ERESTARTSYS to +userspace without counting it as a failure. Also skip the device loop +entirely if the block group loop was interrupted. + +Reviewed-by: Qu Wenruo +Signed-off-by: Robbie Ko +Signed-off-by: jinbaohong +Reviewed-by: Filipe Manana +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/extent-tree.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 01337e3f2879c..a48ba97bb3694 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -6568,6 +6568,10 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range) + range->minlen); + + trimmed += group_trimmed; ++ if (ret == -ERESTARTSYS || ret == -EINTR) { ++ btrfs_put_block_group(cache); ++ break; ++ } + if (ret) { + bg_failed++; + bg_ret = ret; +@@ -6581,6 +6585,9 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range) + "failed to trim %llu block group(s), last error %d", + bg_failed, bg_ret); + ++ if (ret == -ERESTARTSYS || ret == -EINTR) ++ return ret; ++ + mutex_lock(&fs_devices->device_list_mutex); + list_for_each_entry(device, &fs_devices->devices, dev_list) { + if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state)) +@@ -6589,6 +6596,8 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range) + ret = btrfs_trim_free_extents(device, &group_trimmed); + + trimmed += group_trimmed; ++ if (ret == -ERESTARTSYS || ret == -EINTR) ++ break; + if (ret) { + dev_failed++; + dev_ret = ret; +@@ -6602,6 +6611,8 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range) + "failed to trim %llu device(s), last error %d", + dev_failed, dev_ret); + range->len = trimmed; ++ if (ret == -ERESTARTSYS || ret == -EINTR) ++ return ret; + if (bg_ret) + return bg_ret; + return dev_ret; +-- +2.51.0 + diff --git a/queue-6.18/btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch b/queue-6.18/btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch new file mode 100644 index 00000000000..0ca2bb4d329 --- /dev/null +++ b/queue-6.18/btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch @@ -0,0 +1,46 @@ +From 9d519a0b239c8495fe6ca93641f3ce6d6202707a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 22:53:57 +0530 +Subject: btrfs: replace BUG() with error handling in __btrfs_balance() + +From: Adarsh Das + +[ Upstream commit be6324a809dbda76d5fdb23720ad9b20e5c1905c ] + +We search with offset (u64)-1 which should never match exactly. +Previously this was handled with BUG(). Now logs an error +and return -EUCLEAN. + +Reviewed-by: Qu Wenruo +Signed-off-by: Adarsh Das +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/volumes.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 645bf98a9571b..4a1dc4720a0ba 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -4264,8 +4264,14 @@ static int __btrfs_balance(struct btrfs_fs_info *fs_info) + * this shouldn't happen, it means the last relocate + * failed + */ +- if (ret == 0) +- BUG(); /* FIXME break ? */ ++ if (unlikely(ret == 0)) { ++ btrfs_err(fs_info, ++ "unexpected exact match of CHUNK_ITEM in chunk tree, offset 0x%llx", ++ key.offset); ++ mutex_unlock(&fs_info->reclaim_bgs_lock); ++ ret = -EUCLEAN; ++ goto error; ++ } + + ret = btrfs_previous_item(chunk_root, path, 0, + BTRFS_CHUNK_ITEM_KEY); +-- +2.51.0 + diff --git a/queue-6.18/ceph-supply-snapshot-context-in-ceph_uninline_data.patch b/queue-6.18/ceph-supply-snapshot-context-in-ceph_uninline_data.patch new file mode 100644 index 00000000000..45c874d034b --- /dev/null +++ b/queue-6.18/ceph-supply-snapshot-context-in-ceph_uninline_data.patch @@ -0,0 +1,127 @@ +From 782eb9341785aaf2e230e6494ea090a22832fe8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 18:42:06 +0800 +Subject: ceph: supply snapshot context in ceph_uninline_data() + +From: ethanwu + +[ Upstream commit 305ff6b3a03c230d3c07b61457e961406d979693 ] + +The ceph_uninline_data function was missing proper snapshot context +handling for its OSD write operations. Both CEPH_OSD_OP_CREATE and +CEPH_OSD_OP_WRITE requests were passing NULL instead of the appropriate +snapshot context, which could lead to unnecessary object clone. + +Reproducer: +../src/vstart.sh --new -x --localhost --bluestore +// turn on cephfs inline data +./bin/ceph fs set a inline_data true --yes-i-really-really-mean-it +// allow fs_a client to take snapshot +./bin/ceph auth caps client.fs_a mds 'allow rwps fsname=a' mon 'allow r fsname=a' osd 'allow rw tag cephfs data=a' +// mount cephfs with fuse, since kernel cephfs doesn't support inline write +ceph-fuse --id fs_a -m 127.0.0.1:40318 --conf ceph.conf -d /mnt/mycephfs/ +// bump snapshot seq +mkdir /mnt/mycephfs/.snap/snap1 +echo "foo" > /mnt/mycephfs/test +// umount and mount it again using kernel cephfs client +umount /mnt/mycephfs +mount -t ceph fs_a@.a=/ /mnt/mycephfs/ -o conf=./ceph.conf +echo "bar" >> /mnt/mycephfs/test +./bin/rados listsnaps -p cephfs.a.data $(printf "%x\n" $(stat -c %i /mnt/mycephfs/test)).00000000 + +will see this object does unnecessary clone +1000000000a.00000000 (seq:2): +cloneid snaps size overlap +2 2 4 [] +head - 8 + +but it's expected to see +10000000000.00000000 (seq:2): +cloneid snaps size overlap +head - 8 + +since there's no snapshot between these 2 writes + +clone happened because the first osd request CEPH_OSD_OP_CREATE doesn't +pass snap context so object is created with snap seq 0, but later data +writeback is equipped with snapshot context. +snap.seq(1) > object snap seq(0), so osd does object clone. + +This fix properly acquiring the snapshot context before performing +write operations. + +Signed-off-by: ethanwu +Reviewed-by: Viacheslav Dubeyko +Tested-by: Viacheslav Dubeyko +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/addr.c | 24 ++++++++++++++++++++++-- + 1 file changed, 22 insertions(+), 2 deletions(-) + +diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c +index 322ed268f14aa..9faeaf1196c5c 100644 +--- a/fs/ceph/addr.c ++++ b/fs/ceph/addr.c +@@ -2203,6 +2203,7 @@ int ceph_uninline_data(struct file *file) + struct ceph_osd_request *req = NULL; + struct ceph_cap_flush *prealloc_cf = NULL; + struct folio *folio = NULL; ++ struct ceph_snap_context *snapc = NULL; + u64 inline_version = CEPH_INLINE_NONE; + struct page *pages[1]; + int err = 0; +@@ -2230,6 +2231,24 @@ int ceph_uninline_data(struct file *file) + if (inline_version == 1) /* initial version, no data */ + goto out_uninline; + ++ down_read(&fsc->mdsc->snap_rwsem); ++ spin_lock(&ci->i_ceph_lock); ++ if (__ceph_have_pending_cap_snap(ci)) { ++ struct ceph_cap_snap *capsnap = ++ list_last_entry(&ci->i_cap_snaps, ++ struct ceph_cap_snap, ++ ci_item); ++ snapc = ceph_get_snap_context(capsnap->context); ++ } else { ++ if (!ci->i_head_snapc) { ++ ci->i_head_snapc = ceph_get_snap_context( ++ ci->i_snap_realm->cached_context); ++ } ++ snapc = ceph_get_snap_context(ci->i_head_snapc); ++ } ++ spin_unlock(&ci->i_ceph_lock); ++ up_read(&fsc->mdsc->snap_rwsem); ++ + folio = read_mapping_folio(inode->i_mapping, 0, file); + if (IS_ERR(folio)) { + err = PTR_ERR(folio); +@@ -2245,7 +2264,7 @@ int ceph_uninline_data(struct file *file) + req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout, + ceph_vino(inode), 0, &len, 0, 1, + CEPH_OSD_OP_CREATE, CEPH_OSD_FLAG_WRITE, +- NULL, 0, 0, false); ++ snapc, 0, 0, false); + if (IS_ERR(req)) { + err = PTR_ERR(req); + goto out_unlock; +@@ -2261,7 +2280,7 @@ int ceph_uninline_data(struct file *file) + req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout, + ceph_vino(inode), 0, &len, 1, 3, + CEPH_OSD_OP_WRITE, CEPH_OSD_FLAG_WRITE, +- NULL, ci->i_truncate_seq, ++ snapc, ci->i_truncate_seq, + ci->i_truncate_size, false); + if (IS_ERR(req)) { + err = PTR_ERR(req); +@@ -2324,6 +2343,7 @@ int ceph_uninline_data(struct file *file) + folio_put(folio); + } + out: ++ ceph_put_snap_context(snapc); + ceph_free_cap_flush(prealloc_cf); + doutc(cl, "%llx.%llx inline_version %llu = %d\n", + ceph_vinop(inode), inline_version, err); +-- +2.51.0 + diff --git a/queue-6.18/cgroup-cpuset-don-t-fail-cpuset.cpus-change-in-v2.patch b/queue-6.18/cgroup-cpuset-don-t-fail-cpuset.cpus-change-in-v2.patch new file mode 100644 index 00000000000..a72ea017e68 --- /dev/null +++ b/queue-6.18/cgroup-cpuset-don-t-fail-cpuset.cpus-change-in-v2.patch @@ -0,0 +1,126 @@ +From ea571d97c3b2578a6e46f4924360eafc5e743b58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 11:00:19 -0500 +Subject: cgroup/cpuset: Don't fail cpuset.cpus change in v2 + +From: Waiman Long + +[ Upstream commit 6e6f13f6d5095f3a432da421e78f4d7d51ef39c8 ] + +Commit fe8cd2736e75 ("cgroup/cpuset: Delay setting of CS_CPU_EXCLUSIVE +until valid partition") introduced a new check to disallow the setting +of a new cpuset.cpus.exclusive value that is a superset of a sibling's +cpuset.cpus value so that there will at least be one CPU left in the +sibling in case the cpuset becomes a valid partition root. This new +check does have the side effect of failing a cpuset.cpus change that +make it a subset of a sibling's cpuset.cpus.exclusive value. + +With v2, users are supposed to be allowed to set whatever value they +want in cpuset.cpus without failure. To maintain this rule, the check +is now restricted to only when cpuset.cpus.exclusive is being changed +not when cpuset.cpus is changed. + +The cgroup-v2.rst doc file is also updated to reflect this change. + +Signed-off-by: Waiman Long +Reviewed-by: Chen Ridong +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + Documentation/admin-guide/cgroup-v2.rst | 8 +++---- + kernel/cgroup/cpuset.c | 30 ++++++++++++------------- + 2 files changed, 19 insertions(+), 19 deletions(-) + +diff --git a/Documentation/admin-guide/cgroup-v2.rst b/Documentation/admin-guide/cgroup-v2.rst +index 0e6c67ac585a0..edcd125d6992f 100644 +--- a/Documentation/admin-guide/cgroup-v2.rst ++++ b/Documentation/admin-guide/cgroup-v2.rst +@@ -2538,10 +2538,10 @@ Cpuset Interface Files + Users can manually set it to a value that is different from + "cpuset.cpus". One constraint in setting it is that the list of + CPUs must be exclusive with respect to "cpuset.cpus.exclusive" +- of its sibling. If "cpuset.cpus.exclusive" of a sibling cgroup +- isn't set, its "cpuset.cpus" value, if set, cannot be a subset +- of it to leave at least one CPU available when the exclusive +- CPUs are taken away. ++ and "cpuset.cpus.exclusive.effective" of its siblings. Another ++ constraint is that it cannot be a superset of "cpuset.cpus" ++ of its sibling in order to leave at least one CPU available to ++ that sibling when the exclusive CPUs are taken away. + + For a parent cgroup, any one of its exclusive CPUs can only + be distributed to at most one of its child cgroups. Having an +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index 1245418cc8b3b..d779e29a9302d 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -599,33 +599,31 @@ static inline bool cpusets_are_exclusive(struct cpuset *cs1, struct cpuset *cs2) + + /** + * cpus_excl_conflict - Check if two cpusets have exclusive CPU conflicts +- * @cs1: first cpuset to check +- * @cs2: second cpuset to check ++ * @trial: the trial cpuset to be checked ++ * @sibling: a sibling cpuset to be checked against ++ * @xcpus_changed: set if exclusive_cpus has been set + * + * Returns: true if CPU exclusivity conflict exists, false otherwise + * + * Conflict detection rules: + * 1. If either cpuset is CPU exclusive, they must be mutually exclusive + * 2. exclusive_cpus masks cannot intersect between cpusets +- * 3. The allowed CPUs of one cpuset cannot be a subset of another's exclusive CPUs ++ * 3. The allowed CPUs of a sibling cpuset cannot be a subset of the new exclusive CPUs + */ +-static inline bool cpus_excl_conflict(struct cpuset *cs1, struct cpuset *cs2) ++static inline bool cpus_excl_conflict(struct cpuset *trial, struct cpuset *sibling, ++ bool xcpus_changed) + { + /* If either cpuset is exclusive, check if they are mutually exclusive */ +- if (is_cpu_exclusive(cs1) || is_cpu_exclusive(cs2)) +- return !cpusets_are_exclusive(cs1, cs2); ++ if (is_cpu_exclusive(trial) || is_cpu_exclusive(sibling)) ++ return !cpusets_are_exclusive(trial, sibling); + + /* Exclusive_cpus cannot intersect */ +- if (cpumask_intersects(cs1->exclusive_cpus, cs2->exclusive_cpus)) ++ if (cpumask_intersects(trial->exclusive_cpus, sibling->exclusive_cpus)) + return true; + +- /* The cpus_allowed of one cpuset cannot be a subset of another cpuset's exclusive_cpus */ +- if (!cpumask_empty(cs1->cpus_allowed) && +- cpumask_subset(cs1->cpus_allowed, cs2->exclusive_cpus)) +- return true; +- +- if (!cpumask_empty(cs2->cpus_allowed) && +- cpumask_subset(cs2->cpus_allowed, cs1->exclusive_cpus)) ++ /* The cpus_allowed of a sibling cpuset cannot be a subset of the new exclusive_cpus */ ++ if (xcpus_changed && !cpumask_empty(sibling->cpus_allowed) && ++ cpumask_subset(sibling->cpus_allowed, trial->exclusive_cpus)) + return true; + + return false; +@@ -662,6 +660,7 @@ static int validate_change(struct cpuset *cur, struct cpuset *trial) + { + struct cgroup_subsys_state *css; + struct cpuset *c, *par; ++ bool xcpus_changed; + int ret = 0; + + rcu_read_lock(); +@@ -718,10 +717,11 @@ static int validate_change(struct cpuset *cur, struct cpuset *trial) + * overlap. exclusive_cpus cannot overlap with each other if set. + */ + ret = -EINVAL; ++ xcpus_changed = !cpumask_equal(cur->exclusive_cpus, trial->exclusive_cpus); + cpuset_for_each_child(c, css, par) { + if (c == cur) + continue; +- if (cpus_excl_conflict(trial, c)) ++ if (cpus_excl_conflict(trial, c, xcpus_changed)) + goto out; + if (mems_excl_conflict(trial, c)) + goto out; +-- +2.51.0 + diff --git a/queue-6.18/char-tpm-cr50-remove-irqf_oneshot.patch b/queue-6.18/char-tpm-cr50-remove-irqf_oneshot.patch new file mode 100644 index 00000000000..4073b8d90f1 --- /dev/null +++ b/queue-6.18/char-tpm-cr50-remove-irqf_oneshot.patch @@ -0,0 +1,59 @@ +From de953ffef3650714155785bf30f180aad5897e91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:29 +0100 +Subject: char: tpm: cr50: Remove IRQF_ONESHOT + +From: Sebastian Andrzej Siewior + +[ Upstream commit 1affd29ffbd50125a5492c6be1dbb1f04be18d4f ] + +Passing IRQF_ONESHOT ensures that the interrupt source is masked until +the secondary (threaded) handler is done. If only a primary handler is +used then the flag makes no sense because the interrupt can not fire +(again) while its handler is running. + +The flag also prevents force-threading of the primary handler and the +irq-core will warn about this. + +Remove IRQF_ONESHOT from irqflags. + +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Thomas Gleixner +Reviewed-by: Jarkko Sakkinen +Link: https://patch.msgid.link/20260128095540.863589-10-bigeasy@linutronix.de +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_i2c_cr50.c | 3 +-- + drivers/char/tpm/tpm_tis_spi_cr50.c | 2 +- + 2 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_i2c_cr50.c b/drivers/char/tpm/tpm_tis_i2c_cr50.c +index fc6891a0b6936..b48cacacc0664 100644 +--- a/drivers/char/tpm/tpm_tis_i2c_cr50.c ++++ b/drivers/char/tpm/tpm_tis_i2c_cr50.c +@@ -749,8 +749,7 @@ static int tpm_cr50_i2c_probe(struct i2c_client *client) + + if (client->irq > 0) { + rc = devm_request_irq(dev, client->irq, tpm_cr50_i2c_int_handler, +- IRQF_TRIGGER_FALLING | IRQF_ONESHOT | +- IRQF_NO_AUTOEN, ++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN, + dev->driver->name, chip); + if (rc < 0) { + dev_err(dev, "Failed to probe IRQ %d\n", client->irq); +diff --git a/drivers/char/tpm/tpm_tis_spi_cr50.c b/drivers/char/tpm/tpm_tis_spi_cr50.c +index f4937280e9406..32920b4cecfb4 100644 +--- a/drivers/char/tpm/tpm_tis_spi_cr50.c ++++ b/drivers/char/tpm/tpm_tis_spi_cr50.c +@@ -287,7 +287,7 @@ int cr50_spi_probe(struct spi_device *spi) + if (spi->irq > 0) { + ret = devm_request_irq(&spi->dev, spi->irq, + cr50_spi_irq_handler, +- IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ IRQF_TRIGGER_RISING, + "cr50_spi", cr50_phy); + if (ret < 0) { + if (ret == -EPROBE_DEFER) +-- +2.51.0 + diff --git a/queue-6.18/clk-amlogic-remove-potentially-unsafe-flags-from-s4-.patch b/queue-6.18/clk-amlogic-remove-potentially-unsafe-flags-from-s4-.patch new file mode 100644 index 00000000000..13156082d6e --- /dev/null +++ b/queue-6.18/clk-amlogic-remove-potentially-unsafe-flags-from-s4-.patch @@ -0,0 +1,60 @@ +From 316c44c881b55d81739c1314c18c425ccc105fdc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 13:59:01 +0800 +Subject: clk: amlogic: remove potentially unsafe flags from S4 video clocks + +From: Chuan Liu + +[ Upstream commit 4aca7e92023cac5018b4053bae324450f884c937 ] + +The video clocks enci, encp, vdac and hdmitx share the same clock +source. Adding CLK_SET_RATE_PARENT to the mux may unintentionally change +the shared parent clock, which could affect other video clocks. + +Signed-off-by: Chuan Liu +Link: https://lore.kernel.org/r/20250919-add_video_clk-v6-3-fe223161fb3f@amlogic.com +Signed-off-by: Jerome Brunet +Signed-off-by: Sasha Levin +--- + drivers/clk/meson/s4-peripherals.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/clk/meson/s4-peripherals.c b/drivers/clk/meson/s4-peripherals.c +index 6d69b132d1e1f..bab4f5700de47 100644 +--- a/drivers/clk/meson/s4-peripherals.c ++++ b/drivers/clk/meson/s4-peripherals.c +@@ -1106,7 +1106,6 @@ static struct clk_regmap s4_cts_enci_sel = { + .ops = &clk_regmap_mux_ops, + .parent_hws = s4_cts_parents, + .num_parents = ARRAY_SIZE(s4_cts_parents), +- .flags = CLK_SET_RATE_PARENT, + }, + }; + +@@ -1122,7 +1121,6 @@ static struct clk_regmap s4_cts_encp_sel = { + .ops = &clk_regmap_mux_ops, + .parent_hws = s4_cts_parents, + .num_parents = ARRAY_SIZE(s4_cts_parents), +- .flags = CLK_SET_RATE_PARENT, + }, + }; + +@@ -1138,7 +1136,6 @@ static struct clk_regmap s4_cts_vdac_sel = { + .ops = &clk_regmap_mux_ops, + .parent_hws = s4_cts_parents, + .num_parents = ARRAY_SIZE(s4_cts_parents), +- .flags = CLK_SET_RATE_PARENT, + }, + }; + +@@ -1169,7 +1166,6 @@ static struct clk_regmap s4_hdmi_tx_sel = { + .ops = &clk_regmap_mux_ops, + .parent_hws = s4_hdmi_tx_parents, + .num_parents = ARRAY_SIZE(s4_hdmi_tx_parents), +- .flags = CLK_SET_RATE_PARENT, + }, + }; + +-- +2.51.0 + diff --git a/queue-6.18/clk-microchip-core-correct-return-value-on-_get_pare.patch b/queue-6.18/clk-microchip-core-correct-return-value-on-_get_pare.patch new file mode 100644 index 00000000000..dbcdfc81c07 --- /dev/null +++ b/queue-6.18/clk-microchip-core-correct-return-value-on-_get_pare.patch @@ -0,0 +1,80 @@ +From 588debd648e0092198ba626c02917baff0f719e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 14:46:28 -0500 +Subject: clk: microchip: core: correct return value on *_get_parent() + +From: Brian Masney + +[ Upstream commit 5df96d141cccb37f0c3112a22fc1112ea48e9246 ] + +roclk_get_parent() and sclk_get_parent() has the possibility of +returning -EINVAL, however the framework expects this call to always +succeed since the return value is unsigned. + +If there is no parent map defined, then the current value programmed in +the hardware is used. Let's use that same value in the case where +-EINVAL is currently returned. + +This index is only used by clk_core_get_parent_by_index(), and it +validates that it doesn't overflow the number of available parents. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202512050233.R9hAWsJN-lkp@intel.com/ +Signed-off-by: Brian Masney +Reviewed-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20251205-clk-microchip-fixes-v3-2-a02190705e47@redhat.com +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + drivers/clk/microchip/clk-core.c | 25 ++++++++++++------------- + 1 file changed, 12 insertions(+), 13 deletions(-) + +diff --git a/drivers/clk/microchip/clk-core.c b/drivers/clk/microchip/clk-core.c +index a0163441dfe5c..82f62731fc0ed 100644 +--- a/drivers/clk/microchip/clk-core.c ++++ b/drivers/clk/microchip/clk-core.c +@@ -283,14 +283,13 @@ static u8 roclk_get_parent(struct clk_hw *hw) + + v = (readl(refo->ctrl_reg) >> REFO_SEL_SHIFT) & REFO_SEL_MASK; + +- if (!refo->parent_map) +- return v; +- +- for (i = 0; i < clk_hw_get_num_parents(hw); i++) +- if (refo->parent_map[i] == v) +- return i; ++ if (refo->parent_map) { ++ for (i = 0; i < clk_hw_get_num_parents(hw); i++) ++ if (refo->parent_map[i] == v) ++ return i; ++ } + +- return -EINVAL; ++ return v; + } + + static unsigned long roclk_calc_rate(unsigned long parent_rate, +@@ -817,13 +816,13 @@ static u8 sclk_get_parent(struct clk_hw *hw) + + v = (readl(sclk->mux_reg) >> OSC_CUR_SHIFT) & OSC_CUR_MASK; + +- if (!sclk->parent_map) +- return v; ++ if (sclk->parent_map) { ++ for (i = 0; i < clk_hw_get_num_parents(hw); i++) ++ if (sclk->parent_map[i] == v) ++ return i; ++ } + +- for (i = 0; i < clk_hw_get_num_parents(hw); i++) +- if (sclk->parent_map[i] == v) +- return i; +- return -EINVAL; ++ return v; + } + + static int sclk_set_parent(struct clk_hw *hw, u8 index) +-- +2.51.0 + diff --git a/queue-6.18/clk-renesas-rzg2l-deassert-reset-on-assert-timeout.patch b/queue-6.18/clk-renesas-rzg2l-deassert-reset-on-assert-timeout.patch new file mode 100644 index 00000000000..8b4fe3c7dcc --- /dev/null +++ b/queue-6.18/clk-renesas-rzg2l-deassert-reset-on-assert-timeout.patch @@ -0,0 +1,53 @@ +From 80a08835b9e4797cb2e41c289caca6ad2180c767 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:34:27 +0000 +Subject: clk: renesas: rzg2l: Deassert reset on assert timeout + +From: Biju Das + +[ Upstream commit 0b0201f259e1158a875c5fd01adf318ae5d32352 ] + +If the assert() fails due to timeout error, set the reset register bit +back to deasserted state. This change is needed especially for handling +assert error in suspend() callback that expect the device to be in +operational state in case of failure. + +Signed-off-by: Biju Das +Reviewed-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20260108123433.104464-2-biju.das.jz@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/clk/renesas/rzg2l-cpg.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c +index 07909e80bae24..db85b1b43737b 100644 +--- a/drivers/clk/renesas/rzg2l-cpg.c ++++ b/drivers/clk/renesas/rzg2l-cpg.c +@@ -1647,6 +1647,7 @@ static int __rzg2l_cpg_assert(struct reset_controller_dev *rcdev, + u32 mask = BIT(info->resets[id].bit); + s8 monbit = info->resets[id].monbit; + u32 value = mask << 16; ++ u32 mon; + int ret; + + dev_dbg(rcdev->dev, "%s id:%ld offset:0x%x\n", +@@ -1667,10 +1668,10 @@ static int __rzg2l_cpg_assert(struct reset_controller_dev *rcdev, + return 0; + } + +- ret = readl_poll_timeout_atomic(priv->base + reg, value, +- assert == !!(value & mask), 10, 200); +- if (ret && !assert) { +- value = mask << 16; ++ ret = readl_poll_timeout_atomic(priv->base + reg, mon, ++ assert == !!(mon & mask), 10, 200); ++ if (ret) { ++ value ^= mask; + writel(value, priv->base + CLK_RST_R(info->resets[id].off)); + } + +-- +2.51.0 + diff --git a/queue-6.18/clocksource-drivers-sh_tmu-always-leave-device-runni.patch b/queue-6.18/clocksource-drivers-sh_tmu-always-leave-device-runni.patch new file mode 100644 index 00000000000..1dfa917a891 --- /dev/null +++ b/queue-6.18/clocksource-drivers-sh_tmu-always-leave-device-runni.patch @@ -0,0 +1,149 @@ +From 2c8c50bb16804151a1d1baf8d9eece02084fc29f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 23:13:41 +0100 +Subject: clocksource/drivers/sh_tmu: Always leave device running after probe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Niklas Söderlund + +[ Upstream commit b1278972b08e480990e2789bdc6a7c918bc349be ] + +The TMU device can be used as both a clocksource and a clockevent +provider. The driver tries to be smart and power itself on and off, as +well as enabling and disabling its clock when it's not in operation. +This behavior is slightly altered if the TMU is used as an early +platform device in which case the device is left powered on after probe, +but the clock is still enabled and disabled at runtime. + +This has worked for a long time, but recent improvements in PREEMPT_RT +and PROVE_LOCKING have highlighted an issue. As the TMU registers itself +as a clockevent provider, clockevents_register_device(), it needs to use +raw spinlocks internally as this is the context of which the clockevent +framework interacts with the TMU driver. However in the context of +holding a raw spinlock the TMU driver can't really manage its power +state or clock with calls to pm_runtime_*() and clk_*() as these calls +end up in other platform drivers using regular spinlocks to control +power and clocks. + +This mix of spinlock contexts trips a lockdep warning. + + ============================= + [ BUG: Invalid wait context ] + 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 Not tainted + ----------------------------- + swapper/0/0 is trying to lock: + ffff000008c9e180 (&dev->power.lock){-...}-{3:3}, at: __pm_runtime_resume+0x38/0x88 + other info that might help us debug this: + context-{5:5} + 1 lock held by swapper/0/0: + ccree e6601000.crypto: ARM CryptoCell 630P Driver: HW version 0xAF400001/0xDCC63000, Driver version 5.0 + #0: ffff8000817ec298 + ccree e6601000.crypto: ARM ccree device initialized + (tick_broadcast_lock){-...}-{2:2}, at: __tick_broadcast_oneshot_control+0xa4/0x3a8 + stack backtrace: + CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 PREEMPT + Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT) + Call trace: + show_stack+0x14/0x1c (C) + dump_stack_lvl+0x6c/0x90 + dump_stack+0x14/0x1c + __lock_acquire+0x904/0x1584 + lock_acquire+0x220/0x34c + _raw_spin_lock_irqsave+0x58/0x80 + __pm_runtime_resume+0x38/0x88 + sh_tmu_clock_event_set_oneshot+0x84/0xd4 + clockevents_switch_state+0xfc/0x13c + tick_broadcast_set_event+0x30/0xa4 + __tick_broadcast_oneshot_control+0x1e0/0x3a8 + tick_broadcast_oneshot_control+0x30/0x40 + cpuidle_enter_state+0x40c/0x680 + cpuidle_enter+0x30/0x40 + do_idle+0x1f4/0x280 + cpu_startup_entry+0x34/0x40 + kernel_init+0x0/0x130 + do_one_initcall+0x0/0x230 + __primary_switched+0x88/0x90 + +For non-PREEMPT_RT builds this is not really an issue, but for +PREEMPT_RT builds where normal spinlocks can sleep this might be an +issue. Be cautious and always leave the power and clock running after +probe. + +Signed-off-by: Niklas Söderlund +Signed-off-by: Daniel Lezcano +Tested-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20251202221341.1856773-1-niklas.soderlund+renesas@ragnatech.se +Signed-off-by: Sasha Levin +--- + drivers/clocksource/sh_tmu.c | 18 ------------------ + 1 file changed, 18 deletions(-) + +diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c +index beffff81c00f3..3fc6ed9b56300 100644 +--- a/drivers/clocksource/sh_tmu.c ++++ b/drivers/clocksource/sh_tmu.c +@@ -143,16 +143,6 @@ static void sh_tmu_start_stop_ch(struct sh_tmu_channel *ch, int start) + + static int __sh_tmu_enable(struct sh_tmu_channel *ch) + { +- int ret; +- +- /* enable clock */ +- ret = clk_enable(ch->tmu->clk); +- if (ret) { +- dev_err(&ch->tmu->pdev->dev, "ch%u: cannot enable clock\n", +- ch->index); +- return ret; +- } +- + /* make sure channel is disabled */ + sh_tmu_start_stop_ch(ch, 0); + +@@ -174,7 +164,6 @@ static int sh_tmu_enable(struct sh_tmu_channel *ch) + if (ch->enable_count++ > 0) + return 0; + +- pm_runtime_get_sync(&ch->tmu->pdev->dev); + dev_pm_syscore_device(&ch->tmu->pdev->dev, true); + + return __sh_tmu_enable(ch); +@@ -187,9 +176,6 @@ static void __sh_tmu_disable(struct sh_tmu_channel *ch) + + /* disable interrupts in TMU block */ + sh_tmu_write(ch, TCR, TCR_TPSC_CLK4); +- +- /* stop clock */ +- clk_disable(ch->tmu->clk); + } + + static void sh_tmu_disable(struct sh_tmu_channel *ch) +@@ -203,7 +189,6 @@ static void sh_tmu_disable(struct sh_tmu_channel *ch) + __sh_tmu_disable(ch); + + dev_pm_syscore_device(&ch->tmu->pdev->dev, false); +- pm_runtime_put(&ch->tmu->pdev->dev); + } + + static void sh_tmu_set_next(struct sh_tmu_channel *ch, unsigned long delta, +@@ -552,7 +537,6 @@ static int sh_tmu_setup(struct sh_tmu_device *tmu, struct platform_device *pdev) + goto err_clk_unprepare; + + tmu->rate = clk_get_rate(tmu->clk) / 4; +- clk_disable(tmu->clk); + + /* Map the memory resource. */ + ret = sh_tmu_map_memory(tmu); +@@ -626,8 +610,6 @@ static int sh_tmu_probe(struct platform_device *pdev) + out: + if (tmu->has_clockevent || tmu->has_clocksource) + pm_runtime_irq_safe(&pdev->dev); +- else +- pm_runtime_idle(&pdev->dev); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.18/clocksource-drivers-timer-integrator-ap-add-missing-.patch b/queue-6.18/clocksource-drivers-timer-integrator-ap-add-missing-.patch new file mode 100644 index 00000000000..7aef2623c13 --- /dev/null +++ b/queue-6.18/clocksource-drivers-timer-integrator-ap-add-missing-.patch @@ -0,0 +1,38 @@ +From 64088d046574d10b5d5667bc8d85f92bffbe6650 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jan 2026 12:17:23 +0100 +Subject: clocksource/drivers/timer-integrator-ap: Add missing Kconfig + dependency on OF + +From: Bartosz Golaszewski + +[ Upstream commit 2246464821e2820572e6feefca2029f17629cc50 ] + +This driver accesses the of_aliases global variable declared in +linux/of.h and defined in drivers/base/of.c. It requires OF support or +will cause a link failure. Add the missing Kconfig dependency. + +Closes: https://lore.kernel.org/oe-kbuild-all/202601152233.og6LdeUo-lkp@intel.com/ +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Daniel Lezcano +Link: https://patch.msgid.link/20260116111723.10585-1-bartosz.golaszewski@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/clocksource/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig +index ffcd23668763f..1119fbd52e1c9 100644 +--- a/drivers/clocksource/Kconfig ++++ b/drivers/clocksource/Kconfig +@@ -254,6 +254,7 @@ config KEYSTONE_TIMER + + config INTEGRATOR_AP_TIMER + bool "Integrator-AP timer driver" if COMPILE_TEST ++ depends on OF + select CLKSRC_MMIO + help + Enables support for the Integrator-AP timer. +-- +2.51.0 + diff --git a/queue-6.18/cpufreq-dt-platdev-block-the-driver-from-probing-on-.patch b/queue-6.18/cpufreq-dt-platdev-block-the-driver-from-probing-on-.patch new file mode 100644 index 00000000000..df85cfa8eba --- /dev/null +++ b/queue-6.18/cpufreq-dt-platdev-block-the-driver-from-probing-on-.patch @@ -0,0 +1,39 @@ +From ad286e3b9bd032d15e0b6036384c98b681748085 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 16:25:35 +0100 +Subject: cpufreq: dt-platdev: Block the driver from probing on more QC + platforms + +From: Konrad Dybcio + +[ Upstream commit 7b781899072c5701ef9538c365757ee9ab9c00bd ] + +Add a number of QC platforms to the blocklist, they all use either the +qcom-cpufreq-hw driver. + +Signed-off-by: Konrad Dybcio +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq-dt-platdev.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c +index dc11b62399ad5..47dd76acd31e5 100644 +--- a/drivers/cpufreq/cpufreq-dt-platdev.c ++++ b/drivers/cpufreq/cpufreq-dt-platdev.c +@@ -169,8 +169,11 @@ static const struct of_device_id blocklist[] __initconst = { + { .compatible = "qcom,sdm845", }, + { .compatible = "qcom,sdx75", }, + { .compatible = "qcom,sm6115", }, ++ { .compatible = "qcom,sm6125", }, ++ { .compatible = "qcom,sm6150", }, + { .compatible = "qcom,sm6350", }, + { .compatible = "qcom,sm6375", }, ++ { .compatible = "qcom,sm7125", }, + { .compatible = "qcom,sm7225", }, + { .compatible = "qcom,sm7325", }, + { .compatible = "qcom,sm8150", }, +-- +2.51.0 + diff --git a/queue-6.18/crypto-hisilicon-qm-move-the-barrier-before-writing-.patch b/queue-6.18/crypto-hisilicon-qm-move-the-barrier-before-writing-.patch new file mode 100644 index 00000000000..7a4584b0fc6 --- /dev/null +++ b/queue-6.18/crypto-hisilicon-qm-move-the-barrier-before-writing-.patch @@ -0,0 +1,45 @@ +From 09c04676758fd64260ccf1adcc048412ed2a27bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jan 2026 18:18:03 +0800 +Subject: crypto: hisilicon/qm - move the barrier before writing to the mailbox + register + +From: Chenghai Huang + +[ Upstream commit ebf35d8f9368816c930f5d70783a72716fab5e19 ] + +Before sending the data via the mailbox to the hardware, to ensure +that the data accessed by the hardware is the most up-to-date, +a write barrier should be added before writing to the mailbox register. +The current memory barrier is placed after writing to the register, +the barrier order should be modified to be before writing to the register. + +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/qm.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c +index a7c8839180ee7..b92ee2fcb18aa 100644 +--- a/drivers/crypto/hisilicon/qm.c ++++ b/drivers/crypto/hisilicon/qm.c +@@ -609,9 +609,13 @@ static void qm_mb_write(struct hisi_qm *qm, const void *src) + } + + #if IS_ENABLED(CONFIG_ARM64) ++ /* ++ * The dmb oshst instruction ensures that the data in the ++ * mailbox is written before it is sent to the hardware. ++ */ + asm volatile("ldp %0, %1, %3\n" +- "stp %0, %1, %2\n" + "dmb oshst\n" ++ "stp %0, %1, %2\n" + : "=&r" (tmp0), + "=&r" (tmp1), + "+Q" (*((char __iomem *)fun_base)) +-- +2.51.0 + diff --git a/queue-6.18/dlm-fix-recovery-pending-middle-conversion.patch b/queue-6.18/dlm-fix-recovery-pending-middle-conversion.patch new file mode 100644 index 00000000000..1d26231f085 --- /dev/null +++ b/queue-6.18/dlm-fix-recovery-pending-middle-conversion.patch @@ -0,0 +1,75 @@ +From 53afc0557df342f90be0b807dce8b9ebf3120bf2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 10:35:05 -0500 +Subject: dlm: fix recovery pending middle conversion + +From: Alexander Aring + +[ Upstream commit 1416bd508c78bdfdb9ae0b4511369e5581f348ea ] + +During a workload involving conversions between lock modes PR and CW, +lock recovery can create a "conversion deadlock" state between locks +that have been recovered. When this occurs, kernel warning messages +are logged, e.g. + + "dlm: WARN: pending deadlock 1e node 0 2 1bf21" + + "dlm: receive_rcom_lock_args 2e middle convert gr 3 rq 2 remote 2 1e" + +After this occurs, the deadlocked conversions both appear on the convert +queue of the resource being locked, and the conversion requests do not +complete. + +Outside of recovery, conversions that would produce a deadlock are +resolved immediately, and return -EDEADLK. The locks are not placed +on the convert queue in the deadlocked state. + +To fix this problem, an lkb under conversion between PR/CW is rebuilt +during recovery on a new master's granted queue, with the currently +granted mode, rather than being rebuilt on the new master's convert +queue, with the currently granted mode and the newly requested mode. +The in-progress convert is then resent to the new master after +recovery, so the conversion deadlock will be processed outside of +the recovery context and handled as described above. + +Signed-off-by: Alexander Aring +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/lock.c | 19 +------------------ + 1 file changed, 1 insertion(+), 18 deletions(-) + +diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c +index be938fdf17d96..c01a291db401b 100644 +--- a/fs/dlm/lock.c ++++ b/fs/dlm/lock.c +@@ -5014,25 +5014,8 @@ void dlm_receive_buffer(const union dlm_packet *p, int nodeid) + static void recover_convert_waiter(struct dlm_ls *ls, struct dlm_lkb *lkb, + struct dlm_message *ms_local) + { +- if (middle_conversion(lkb)) { +- log_rinfo(ls, "%s %x middle convert in progress", __func__, +- lkb->lkb_id); +- +- /* We sent this lock to the new master. The new master will +- * tell us when it's granted. We no longer need a reply, so +- * use a fake reply to put the lkb into the right state. +- */ +- hold_lkb(lkb); +- memset(ms_local, 0, sizeof(struct dlm_message)); +- ms_local->m_type = cpu_to_le32(DLM_MSG_CONVERT_REPLY); +- ms_local->m_result = cpu_to_le32(to_dlm_errno(-EINPROGRESS)); +- ms_local->m_header.h_nodeid = cpu_to_le32(lkb->lkb_nodeid); +- _receive_convert_reply(lkb, ms_local, true); +- unhold_lkb(lkb); +- +- } else if (lkb->lkb_rqmode >= lkb->lkb_grmode) { ++ if (middle_conversion(lkb) || lkb->lkb_rqmode >= lkb->lkb_grmode) + set_bit(DLM_IFL_RESEND_BIT, &lkb->lkb_iflags); +- } + + /* lkb->lkb_rqmode < lkb->lkb_grmode shouldn't happen since down + conversions are async; there's no reply from the remote master */ +-- +2.51.0 + diff --git a/queue-6.18/dlm-validate-length-in-dlm_search_rsb_tree.patch b/queue-6.18/dlm-validate-length-in-dlm_search_rsb_tree.patch new file mode 100644 index 00000000000..0fb01d1c673 --- /dev/null +++ b/queue-6.18/dlm-validate-length-in-dlm_search_rsb_tree.patch @@ -0,0 +1,40 @@ +From fad76dea505506e503035b0efadd8cc910e4f848 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 10:35:06 -0500 +Subject: dlm: validate length in dlm_search_rsb_tree + +From: Ezrak1e + +[ Upstream commit 080e5563f878c64e697b89e7439d730d0daad882 ] + +The len parameter in dlm_dump_rsb_name() is not validated and comes +from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can +cause out-of-bounds write in dlm_search_rsb_tree(). + +Add length validation to prevent potential buffer overflow. + +Signed-off-by: Ezrak1e +Signed-off-by: Alexander Aring +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/lock.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c +index c01a291db401b..a393ecaf3442a 100644 +--- a/fs/dlm/lock.c ++++ b/fs/dlm/lock.c +@@ -626,7 +626,8 @@ int dlm_search_rsb_tree(struct rhashtable *rhash, const void *name, int len, + struct dlm_rsb **r_ret) + { + char key[DLM_RESNAME_MAXLEN] = {}; +- ++ if (len > DLM_RESNAME_MAXLEN) ++ return -EINVAL; + memcpy(key, name, len); + *r_ret = rhashtable_lookup_fast(rhash, &key, dlm_rhash_rsb_params); + if (*r_ret) +-- +2.51.0 + diff --git a/queue-6.18/dm-remove-fake-timeout-to-avoid-leak-request.patch b/queue-6.18/dm-remove-fake-timeout-to-avoid-leak-request.patch new file mode 100644 index 00000000000..089bb02b9b2 --- /dev/null +++ b/queue-6.18/dm-remove-fake-timeout-to-avoid-leak-request.patch @@ -0,0 +1,86 @@ +From 96a4a65c3f53acafc3ea9646d953ee2b1216a472 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Dec 2025 20:03:50 +0800 +Subject: dm: remove fake timeout to avoid leak request + +From: Ding Hui + +[ Upstream commit f3a9c95a15d2f4466acad5c68faeff79ca5e9f47 ] + +Since commit 15f73f5b3e59 ("blk-mq: move failure injection out of +blk_mq_complete_request"), drivers are responsible for calling +blk_should_fake_timeout() at appropriate code paths and opportunities. + +However, the dm driver does not implement its own timeout handler and +relies on the timeout handling of its slave devices. + +If an io-timeout-fail error is injected to a dm device, the request +will be leaked and never completed, causing tasks to hang indefinitely. + +Reproduce: +1. prepare dm which has iscsi slave device +2. inject io-timeout-fail to dm + echo 1 >/sys/class/block/dm-0/io-timeout-fail + echo 100 >/sys/kernel/debug/fail_io_timeout/probability + echo 10 >/sys/kernel/debug/fail_io_timeout/times +3. read/write dm +4. iscsiadm -m node -u + +Result: hang task like below +[ 862.243768] INFO: task kworker/u514:2:151 blocked for more than 122 seconds. +[ 862.244133] Tainted: G E 6.19.0-rc1+ #51 +[ 862.244337] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 862.244718] task:kworker/u514:2 state:D stack:0 pid:151 tgid:151 ppid:2 task_flags:0x4288060 flags:0x00080000 +[ 862.245024] Workqueue: iscsi_ctrl_3:1 __iscsi_unbind_session [scsi_transport_iscsi] +[ 862.245264] Call Trace: +[ 862.245587] +[ 862.245814] __schedule+0x810/0x15c0 +[ 862.246557] schedule+0x69/0x180 +[ 862.246760] blk_mq_freeze_queue_wait+0xde/0x120 +[ 862.247688] elevator_change+0x16d/0x460 +[ 862.247893] elevator_set_none+0x87/0xf0 +[ 862.248798] blk_unregister_queue+0x12e/0x2a0 +[ 862.248995] __del_gendisk+0x231/0x7e0 +[ 862.250143] del_gendisk+0x12f/0x1d0 +[ 862.250339] sd_remove+0x85/0x130 [sd_mod] +[ 862.250650] device_release_driver_internal+0x36d/0x530 +[ 862.250849] bus_remove_device+0x1dd/0x3f0 +[ 862.251042] device_del+0x38a/0x930 +[ 862.252095] __scsi_remove_device+0x293/0x360 +[ 862.252291] scsi_remove_target+0x486/0x760 +[ 862.252654] __iscsi_unbind_session+0x18a/0x3e0 [scsi_transport_iscsi] +[ 862.252886] process_one_work+0x633/0xe50 +[ 862.253101] worker_thread+0x6df/0xf10 +[ 862.253647] kthread+0x36d/0x720 +[ 862.254533] ret_from_fork+0x2a6/0x470 +[ 862.255852] ret_from_fork_asm+0x1a/0x30 +[ 862.256037] + +Remove the blk_should_fake_timeout() check from dm, as dm has no +native timeout handling and should not attempt to fake timeouts. + +Signed-off-by: Ding Hui +Reviewed-by: Christoph Hellwig +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + drivers/md/dm-rq.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c +index a6ca92049c10e..5e08546696145 100644 +--- a/drivers/md/dm-rq.c ++++ b/drivers/md/dm-rq.c +@@ -278,8 +278,7 @@ static void dm_complete_request(struct request *rq, blk_status_t error) + struct dm_rq_target_io *tio = tio_from_request(rq); + + tio->error = error; +- if (likely(!blk_should_fake_timeout(rq->q))) +- blk_mq_complete_request(rq); ++ blk_mq_complete_request(rq); + } + + /* +-- +2.51.0 + diff --git a/queue-6.18/dm-replace-eexist-with-ebusy.patch b/queue-6.18/dm-replace-eexist-with-ebusy.patch new file mode 100644 index 00000000000..8b58b7c884a --- /dev/null +++ b/queue-6.18/dm-replace-eexist-with-ebusy.patch @@ -0,0 +1,89 @@ +From e3ebbc6b21394d02f502e28da9a266b355d83106 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Dec 2025 04:49:37 +0100 +Subject: dm: replace -EEXIST with -EBUSY + +From: Daniel Gomez + +[ Upstream commit b13ef361d47f09b7aecd18e0383ecc83ff61057e ] + +The -EEXIST error code is reserved by the module loading infrastructure +to indicate that a module is already loaded. When a module's init +function returns -EEXIST, userspace tools like kmod interpret this as +"module already loaded" and treat the operation as successful, returning +0 to the user even though the module initialization actually failed. + +This follows the precedent set by commit 54416fd76770 ("netfilter: +conntrack: helper: Replace -EEXIST by -EBUSY") which fixed the same +issue in nf_conntrack_helper_register(). + +Affected modules: + * dm_cache dm_clone dm_integrity dm_mirror dm_multipath dm_pcache + * dm_vdo dm-ps-round-robin dm_historical_service_time dm_io_affinity + * dm_queue_length dm_service_time dm_snapshot + +Signed-off-by: Daniel Gomez +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + drivers/md/dm-exception-store.c | 2 +- + drivers/md/dm-log.c | 2 +- + drivers/md/dm-path-selector.c | 2 +- + drivers/md/dm-target.c | 2 +- + 4 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c +index c3799757bf4a0..88f119a0a2ae0 100644 +--- a/drivers/md/dm-exception-store.c ++++ b/drivers/md/dm-exception-store.c +@@ -116,7 +116,7 @@ int dm_exception_store_type_register(struct dm_exception_store_type *type) + if (!__find_exception_store_type(type->name)) + list_add(&type->list, &_exception_store_types); + else +- r = -EEXIST; ++ r = -EBUSY; + spin_unlock(&_lock); + + return r; +diff --git a/drivers/md/dm-log.c b/drivers/md/dm-log.c +index 9d85d045f9d9d..bced5a783ee33 100644 +--- a/drivers/md/dm-log.c ++++ b/drivers/md/dm-log.c +@@ -121,7 +121,7 @@ int dm_dirty_log_type_register(struct dm_dirty_log_type *type) + if (!__find_dirty_log_type(type->name)) + list_add(&type->list, &_log_types); + else +- r = -EEXIST; ++ r = -EBUSY; + spin_unlock(&_lock); + + return r; +diff --git a/drivers/md/dm-path-selector.c b/drivers/md/dm-path-selector.c +index d0b883fabfeb6..2b0ac200f1c02 100644 +--- a/drivers/md/dm-path-selector.c ++++ b/drivers/md/dm-path-selector.c +@@ -107,7 +107,7 @@ int dm_register_path_selector(struct path_selector_type *pst) + + if (__find_path_selector_type(pst->name)) { + kfree(psi); +- r = -EEXIST; ++ r = -EBUSY; + } else + list_add(&psi->list, &_path_selectors); + +diff --git a/drivers/md/dm-target.c b/drivers/md/dm-target.c +index 8fede41adec00..1fd41289de367 100644 +--- a/drivers/md/dm-target.c ++++ b/drivers/md/dm-target.c +@@ -88,7 +88,7 @@ int dm_register_target(struct target_type *tt) + if (__find_target_type(tt->name)) { + DMERR("%s: '%s' target already registered", + __func__, tt->name); +- rv = -EEXIST; ++ rv = -EBUSY; + } else { + list_add(&tt->list, &_targets); + } +-- +2.51.0 + diff --git a/queue-6.18/dmaengine-stm32-dma3-use-module_platform_driver.patch b/queue-6.18/dmaengine-stm32-dma3-use-module_platform_driver.patch new file mode 100644 index 00000000000..c6c9ab40842 --- /dev/null +++ b/queue-6.18/dmaengine-stm32-dma3-use-module_platform_driver.patch @@ -0,0 +1,45 @@ +From 0f327379a68744265a8c6ce937a778261fd8df5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 14:36:56 +0100 +Subject: dmaengine: stm32-dma3: use module_platform_driver + +From: Amelie Delaunay + +[ Upstream commit 0d41ed4ea496fabbb4dc21171e32d9a924c2a661 ] + +Without module_platform_driver(), stm32-dma3 doesn't have a +module_exit procedure. Once stm32-dma3 module is inserted, it +can't be removed, marked busy. +Use module_platform_driver() instead of subsys_initcall() to register +(insmod) and unregister (rmmod) stm32-dma3 driver. + +Reviewed-by: Eugen Hristev +Signed-off-by: Amelie Delaunay +Link: https://patch.msgid.link/20251121-dma3_improv-v2-1-76a207b13ea6@foss.st.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/stm32/stm32-dma3.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +diff --git a/drivers/dma/stm32/stm32-dma3.c b/drivers/dma/stm32/stm32-dma3.c +index 50e7106c5cb73..9500164c8f688 100644 +--- a/drivers/dma/stm32/stm32-dma3.c ++++ b/drivers/dma/stm32/stm32-dma3.c +@@ -1914,12 +1914,7 @@ static struct platform_driver stm32_dma3_driver = { + }, + }; + +-static int __init stm32_dma3_init(void) +-{ +- return platform_driver_register(&stm32_dma3_driver); +-} +- +-subsys_initcall(stm32_dma3_init); ++module_platform_driver(stm32_dma3_driver); + + MODULE_DESCRIPTION("STM32 DMA3 controller driver"); + MODULE_AUTHOR("Amelie Delaunay "); +-- +2.51.0 + diff --git a/queue-6.18/dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch b/queue-6.18/dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch new file mode 100644 index 00000000000..abd8d4b6fc1 --- /dev/null +++ b/queue-6.18/dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch @@ -0,0 +1,51 @@ +From e3734ce0b27ea8387126f7cd10ac7f16cf8008d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Dec 2025 09:15:03 +0100 +Subject: dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix + warnings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Le Goffic + +[ Upstream commit aaf3bc0265744adbc2d364964ef409cf118d193d ] + +m2m_hw_period is initialized only when chan_config->m2m_hw is true. This +triggers a warning: +‘m2m_hw_period’ may be used uninitialized [-Wmaybe-uninitialized] +Although m2m_hw_period is only used when chan_config->m2m_hw is true and +ignored otherwise, initialize it unconditionally to 0. + +ccr is initialized by stm32_mdma_set_xfer_param() when the sg list is not +empty. This triggers a warning: +‘ccr’ may be used uninitialized [-Wmaybe-uninitialized] +Indeed, it could be used uninitialized if the sg list is empty. Initialize +it to 0. + +Signed-off-by: Clément Le Goffic +Reviewed-by: Clément Le Goffic +Signed-off-by: Amelie Delaunay +Link: https://patch.msgid.link/20251217-mdma_warnings_fix-v2-1-340200e0bb55@foss.st.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/stm32/stm32-mdma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/stm32/stm32-mdma.c b/drivers/dma/stm32/stm32-mdma.c +index 080c1c725216c..b87d41b234df1 100644 +--- a/drivers/dma/stm32/stm32-mdma.c ++++ b/drivers/dma/stm32/stm32-mdma.c +@@ -731,7 +731,7 @@ static int stm32_mdma_setup_xfer(struct stm32_mdma_chan *chan, + struct stm32_mdma_chan_config *chan_config = &chan->chan_config; + struct scatterlist *sg; + dma_addr_t src_addr, dst_addr; +- u32 m2m_hw_period, ccr, ctcr, ctbr; ++ u32 m2m_hw_period = 0, ccr = 0, ctcr, ctbr; + int i, ret = 0; + + if (chan_config->m2m_hw) +-- +2.51.0 + diff --git a/queue-6.18/dmaengine-sun6i-choose-appropriate-burst-length-unde.patch b/queue-6.18/dmaengine-sun6i-choose-appropriate-burst-length-unde.patch new file mode 100644 index 00000000000..4981cb14b82 --- /dev/null +++ b/queue-6.18/dmaengine-sun6i-choose-appropriate-burst-length-unde.patch @@ -0,0 +1,80 @@ +From 27e184de45cc6c4e5f30d8348f72aaa0dab815fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Dec 2025 16:04:48 +0800 +Subject: dmaengine: sun6i: Choose appropriate burst length under maxburst + +From: Chen-Yu Tsai + +[ Upstream commit 7178c3586ab42693b28bb81014320a7783e5c435 ] + +maxburst, as provided by the client, specifies the largest amount of +data that is allowed to be transferred in one burst. This limit is +normally provided to avoid a data burst overflowing the target FIFO. +It does not mean that the DMA engine can only do bursts in that size. + +Let the driver pick the largest supported burst length within the +given limit. This lets the driver work correctly with some clients that +give a large maxburst value. In particular, the 8250_dw driver will give +a quarter of the UART's FIFO size as maxburst. On some systems the FIFO +size is 256 bytes, giving a maxburst of 64 bytes, while the hardware +only supports bursts of up to 16 bytes. + +Signed-off-by: Chen-Yu Tsai +Reviewed-by: Jernej Skrabec +Link: https://patch.msgid.link/20251221080450.1813479-1-wens@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/sun6i-dma.c | 26 ++++++++++++++++++++------ + 1 file changed, 20 insertions(+), 6 deletions(-) + +diff --git a/drivers/dma/sun6i-dma.c b/drivers/dma/sun6i-dma.c +index 2215ff877bf7d..f9d876deb1f05 100644 +--- a/drivers/dma/sun6i-dma.c ++++ b/drivers/dma/sun6i-dma.c +@@ -583,6 +583,22 @@ static irqreturn_t sun6i_dma_interrupt(int irq, void *dev_id) + return ret; + } + ++static u32 find_burst_size(const u32 burst_lengths, u32 maxburst) ++{ ++ if (!maxburst) ++ return 1; ++ ++ if (BIT(maxburst) & burst_lengths) ++ return maxburst; ++ ++ /* Hardware only does power-of-two bursts. */ ++ for (u32 burst = rounddown_pow_of_two(maxburst); burst > 0; burst /= 2) ++ if (BIT(burst) & burst_lengths) ++ return burst; ++ ++ return 1; ++} ++ + static int set_config(struct sun6i_dma_dev *sdev, + struct dma_slave_config *sconfig, + enum dma_transfer_direction direction, +@@ -616,15 +632,13 @@ static int set_config(struct sun6i_dma_dev *sdev, + return -EINVAL; + if (!(BIT(dst_addr_width) & sdev->slave.dst_addr_widths)) + return -EINVAL; +- if (!(BIT(src_maxburst) & sdev->cfg->src_burst_lengths)) +- return -EINVAL; +- if (!(BIT(dst_maxburst) & sdev->cfg->dst_burst_lengths)) +- return -EINVAL; + + src_width = convert_buswidth(src_addr_width); + dst_width = convert_buswidth(dst_addr_width); +- dst_burst = convert_burst(dst_maxburst); +- src_burst = convert_burst(src_maxburst); ++ src_burst = find_burst_size(sdev->cfg->src_burst_lengths, src_maxburst); ++ dst_burst = find_burst_size(sdev->cfg->dst_burst_lengths, dst_maxburst); ++ dst_burst = convert_burst(dst_burst); ++ src_burst = convert_burst(src_burst); + + *p_cfg = DMA_CHAN_CFG_SRC_WIDTH(src_width) | + DMA_CHAN_CFG_DST_WIDTH(dst_width); +-- +2.51.0 + diff --git a/queue-6.18/driver-core-faux-stop-using-static-struct-device.patch b/queue-6.18/driver-core-faux-stop-using-static-struct-device.patch new file mode 100644 index 00000000000..5b7c97a56cd --- /dev/null +++ b/queue-6.18/driver-core-faux-stop-using-static-struct-device.patch @@ -0,0 +1,77 @@ +From ba34d8dffc895c2d5f7874f4d5fdd7307f4ab7b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jan 2026 11:29:45 +0100 +Subject: driver core: faux: stop using static struct device + +From: Greg Kroah-Hartman + +[ Upstream commit 61b76d07d2b46a86ea91267d36449fc78f8a1f6e ] + +faux_bus_root should not have been a static struct device, but rather a +dynamically created structure so that lockdep and other testing tools do +not trip over it (as well as being the right thing overall to do.) Fix +this up by making it properly dynamic. + +Reported-by: Gui-Dong Han +Closes: https://lore.kernel.org/lkml/CALbr=LYKJsj6cbrDLA07qioKhWJcRj+gW8=bq5=4ZvpEe2c4Yg@mail.gmail.com/ +Reviewed-by: Danilo Krummrich +Link: https://patch.msgid.link/2026012145-lapping-countless-ef81@gregkh +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/faux.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/drivers/base/faux.c b/drivers/base/faux.c +index 21dd02124231a..23d7258172325 100644 +--- a/drivers/base/faux.c ++++ b/drivers/base/faux.c +@@ -29,9 +29,7 @@ struct faux_object { + }; + #define to_faux_object(dev) container_of_const(dev, struct faux_object, faux_dev.dev) + +-static struct device faux_bus_root = { +- .init_name = "faux", +-}; ++static struct device *faux_bus_root; + + static int faux_match(struct device *dev, const struct device_driver *drv) + { +@@ -152,7 +150,7 @@ struct faux_device *faux_device_create_with_groups(const char *name, + if (parent) + dev->parent = parent; + else +- dev->parent = &faux_bus_root; ++ dev->parent = faux_bus_root; + dev->bus = &faux_bus_type; + dev_set_name(dev, "%s", name); + device_set_pm_not_required(dev); +@@ -236,9 +234,15 @@ int __init faux_bus_init(void) + { + int ret; + +- ret = device_register(&faux_bus_root); ++ faux_bus_root = kzalloc(sizeof(*faux_bus_root), GFP_KERNEL); ++ if (!faux_bus_root) ++ return -ENOMEM; ++ ++ dev_set_name(faux_bus_root, "faux"); ++ ++ ret = device_register(faux_bus_root); + if (ret) { +- put_device(&faux_bus_root); ++ put_device(faux_bus_root); + return ret; + } + +@@ -256,6 +260,6 @@ int __init faux_bus_init(void) + bus_unregister(&faux_bus_type); + + error_bus: +- device_unregister(&faux_bus_root); ++ device_unregister(faux_bus_root); + return ret; + } +-- +2.51.0 + diff --git a/queue-6.18/drm-account-property-blob-allocations-to-memcg.patch b/queue-6.18/drm-account-property-blob-allocations-to-memcg.patch new file mode 100644 index 00000000000..c6ecd122358 --- /dev/null +++ b/queue-6.18/drm-account-property-blob-allocations-to-memcg.patch @@ -0,0 +1,46 @@ +From acf34f16560a6617d4acf12ca40279703d7d474c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 08:22:26 -0500 +Subject: drm: Account property blob allocations to memcg + +From: Xiao Kan <814091656@qq.com> + +[ Upstream commit 26b4309a3ab82a0697751cde52eb336c29c19035 ] + +DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized +property blobs backed by kernel memory. + +Currently, the blob data allocation is not accounted to the allocating +process's memory cgroup, allowing unprivileged users to trigger unbounded +kernel memory consumption and potentially cause system-wide OOM. + +Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory +is properly charged to the caller's memcg. This ensures existing cgroup +memory limits apply and prevents uncontrolled kernel memory growth without +introducing additional policy or per-file limits. + +Signed-off-by: Xiao Kan <814091656@qq.com> +Signed-off-by: Xiao Kan +Link: https://patch.msgid.link/tencent_D12AA2DEDE6F359E1AF59405242FB7A5FD05@qq.com +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_property.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c +index 596272149a359..3c88b5fbdf28c 100644 +--- a/drivers/gpu/drm/drm_property.c ++++ b/drivers/gpu/drm/drm_property.c +@@ -562,7 +562,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length, + if (!length || length > INT_MAX - sizeof(struct drm_property_blob)) + return ERR_PTR(-EINVAL); + +- blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL); ++ blob = kvzalloc(sizeof(struct drm_property_blob) + length, GFP_KERNEL_ACCOUNT); + if (!blob) + return ERR_PTR(-ENOMEM); + +-- +2.51.0 + diff --git a/queue-6.18/drm-amd-display-add-signal-type-check-for-dcn401-get.patch b/queue-6.18/drm-amd-display-add-signal-type-check-for-dcn401-get.patch new file mode 100644 index 00000000000..17876a176ac --- /dev/null +++ b/queue-6.18/drm-amd-display-add-signal-type-check-for-dcn401-get.patch @@ -0,0 +1,42 @@ +From c6534641600c0a886bd24f5cd1784120d8baba87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Dec 2025 15:52:39 -0500 +Subject: drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src + +From: Dmytro Laktyushkin + +[ Upstream commit c979d8db7b0f293111f2e83795ea353c8ed75de9 ] + +Trying to access link enc on a dpia link will cause a crash otherwise + +Reviewed-by: Charlene Liu +Signed-off-by: Dmytro Laktyushkin +Signed-off-by: Chenyu Chen +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +index bbfefc9edd1f1..483217a91029a 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +@@ -914,10 +914,10 @@ static void dcn401_enable_stream_calc( + pipe_ctx->stream->link->cur_link_settings.lane_count; + uint32_t active_total_with_borders; + +- if (dc->link_srv->dp_is_128b_132b_signal(pipe_ctx)) ++ if (dc->link_srv->dp_is_128b_132b_signal(pipe_ctx)) { + *dp_hpo_inst = pipe_ctx->stream_res.hpo_dp_stream_enc->inst; +- +- *phyd32clk = get_phyd32clk_src(pipe_ctx->stream->link); ++ *phyd32clk = get_phyd32clk_src(pipe_ctx->stream->link); ++ } + + if (dc_is_tmds_signal(pipe_ctx->stream->signal)) + dcn401_calculate_dccg_tmds_div_value(pipe_ctx, tmds_div); +-- +2.51.0 + diff --git a/queue-6.18/drm-amd-display-add-usb-c-dp-alt-mode-lane-limitatio.patch b/queue-6.18/drm-amd-display-add-usb-c-dp-alt-mode-lane-limitatio.patch new file mode 100644 index 00000000000..a4ad0ddf4cc --- /dev/null +++ b/queue-6.18/drm-amd-display-add-usb-c-dp-alt-mode-lane-limitatio.patch @@ -0,0 +1,59 @@ +From c6db5e3ffc19089c88433aa7b6f7da09d4c0d64a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Dec 2025 10:18:16 +0800 +Subject: drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 + +From: LinCheng Ku + +[ Upstream commit cea573a8e1ed83840a2173d153dd68e172849d44 ] + +[Why] +USB-C DisplayPort Alt Mode with concurrent USB data needs lane count +limitation to prevent incorrect 4-lane DP configuration when only 2 lanes +are available due to hardware lane sharing between DP and USB3. + +[How] +Query DMUB for Alt Mode status (is_dp_alt_disable, is_usb, is_dp4) in +dcn32_link_encoder_get_max_link_cap() and cap DP to 2 lanes when USB is +active on USB-C port. Added inline documentation explaining the USB-C +lane sharing constraint. + +Reviewed-by: PeiChen Huang +Signed-off-by: LinCheng Ku +Signed-off-by: Chenyu Chen +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../display/dc/dio/dcn32/dcn32_dio_link_encoder.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c +index 06907e8a4eda1..ddc736af776c9 100644 +--- a/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c ++++ b/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c +@@ -188,9 +188,18 @@ void dcn32_link_encoder_get_max_link_cap(struct link_encoder *enc, + if (!query_dp_alt_from_dmub(enc, &cmd)) + return; + +- if (cmd.query_dp_alt.data.is_usb && +- cmd.query_dp_alt.data.is_dp4 == 0) +- link_settings->lane_count = MIN(LANE_COUNT_TWO, link_settings->lane_count); ++ /* ++ * USB-C DisplayPort Alt Mode lane count limitation logic: ++ * When USB and DP share the same USB-C connector, hardware must allocate ++ * some lanes for USB data, limiting DP to maximum 2 lanes instead of 4. ++ * This ensures USB functionality remains available while DP is active. ++ */ ++ if (cmd.query_dp_alt.data.is_dp_alt_disable == 0 && ++ cmd.query_dp_alt.data.is_usb && ++ cmd.query_dp_alt.data.is_dp4 == 0) { ++ link_settings->lane_count = ++ MIN(LANE_COUNT_TWO, link_settings->lane_count); ++ } + } + + +-- +2.51.0 + diff --git a/queue-6.18/drm-amd-display-avoid-dig-reg-access-timeout-on-usb4.patch b/queue-6.18/drm-amd-display-avoid-dig-reg-access-timeout-on-usb4.patch new file mode 100644 index 00000000000..3d1b7c6d192 --- /dev/null +++ b/queue-6.18/drm-amd-display-avoid-dig-reg-access-timeout-on-usb4.patch @@ -0,0 +1,58 @@ +From 5a20a86b6ba3f40fa0753d980b13d92a0b818232 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 15:51:42 +0800 +Subject: drm/amd/display: avoid dig reg access timeout on usb4 link training + fail + +From: Zhongwei + +[ Upstream commit 15b1d7b77e9836ff4184093163174a1ef28bbdd7 ] + +[Why] +When usb4 link training fails, the dpia sym clock will be disabled and SYMCLK +source should be changed back to phy clock. In enable_streams, it is +assumed that link training succeeded and will switch from refclk to +phy clock. But phy clk here might not be on. Dig reg access timeout +will occur. + +[How] +When enable_stream is hit, check if link training failed for usb4. +If it did, fall back to the ref clock to avoid reg access timeout. + +Reviewed-by: Wenjing Liu +Signed-off-by: Zhongwei +Signed-off-by: Aurabindo Pillai +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c +index 56c1ab6c73308..a4025a09a38a3 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c +@@ -3055,9 +3055,17 @@ void dcn20_enable_stream(struct pipe_ctx *pipe_ctx) + dccg->funcs->enable_symclk32_se(dccg, dp_hpo_inst, phyd32clk); + } + } else { +- if (dccg->funcs->enable_symclk_se) +- dccg->funcs->enable_symclk_se(dccg, stream_enc->stream_enc_inst, ++ if (dccg->funcs->enable_symclk_se && link_enc) { ++ if (link->ep_type == DISPLAY_ENDPOINT_USB4_DPIA ++ && link->cur_link_settings.link_rate == LINK_RATE_UNKNOWN ++ && !link->link_status.link_active) { ++ if (dccg->funcs->disable_symclk_se) ++ dccg->funcs->disable_symclk_se(dccg, stream_enc->stream_enc_inst, + link_enc->transmitter - TRANSMITTER_UNIPHY_A); ++ } else ++ dccg->funcs->enable_symclk_se(dccg, stream_enc->stream_enc_inst, ++ link_enc->transmitter - TRANSMITTER_UNIPHY_A); ++ } + } + + if (dc->res_pool->dccg->funcs->set_pixel_rate_div) +-- +2.51.0 + diff --git a/queue-6.18/drm-amd-display-avoid-updating-surface-with-the-same.patch b/queue-6.18/drm-amd-display-avoid-updating-surface-with-the-same.patch new file mode 100644 index 00000000000..ab9a63a9bbb --- /dev/null +++ b/queue-6.18/drm-amd-display-avoid-updating-surface-with-the-same.patch @@ -0,0 +1,43 @@ +From aac54cd765600bcb380c38bbe1fbe1f42e4edeae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 14:47:01 +0800 +Subject: drm/amd/display: Avoid updating surface with the same surface under + MPO + +From: Wayne Lin + +[ Upstream commit 1a38ded4bc8ac09fd029ec656b1e2c98cc0d238c ] + +[Why & How] +Although it's dummy updates of surface update for committing stream +updates, we should not have dummy_updates[j].surface all indicating +to the same surface under multiple surfaces case. Otherwise, +copy_surface_update_to_plane() in update_planes_and_stream_state() +will update to the same surface only. + +Reviewed-by: Harry Wentland +Signed-off-by: Wayne Lin +Signed-off-by: Tom Chung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index c8415a2840567..7db2d1a3784bd 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -10724,7 +10724,7 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state) + continue; + } + for (j = 0; j < status->plane_count; j++) +- dummy_updates[j].surface = status->plane_states[0]; ++ dummy_updates[j].surface = status->plane_states[j]; + + sort(dummy_updates, status->plane_count, + sizeof(*dummy_updates), dm_plane_layer_index_cmp, NULL); +-- +2.51.0 + diff --git a/queue-6.18/drm-amd-display-bypass-post-csc-for-additional-color.patch b/queue-6.18/drm-amd-display-bypass-post-csc-for-additional-color.patch new file mode 100644 index 00000000000..7f0eec00ac0 --- /dev/null +++ b/queue-6.18/drm-amd-display-bypass-post-csc-for-additional-color.patch @@ -0,0 +1,100 @@ +From ae5a22b0d49180426f6fa26662b9b1792a081130 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 11:40:06 -0500 +Subject: drm/amd/display: bypass post csc for additional color spaces in dal + +From: Clay King + +[ Upstream commit 7d9ec9dc20ecdb1661f4538cd9112cd3d6a5f15a ] + +[Why] +For RGB BT2020 full and limited color spaces, overlay adjustments were +applied twice (once by MM and once by DAL). This results in incorrect +colours and a noticeable difference between mpo and non-mpo cases. + +[How] +Add RGB BT2020 full and limited color spaces to list that bypasses post +csc adjustment. + +Reviewed-by: Aric Cyr +Signed-off-by: Clay King +Signed-off-by: Tom Chung +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c | 21 ++++++++++++++++--- + .../drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h | 4 ++++ + .../amd/display/dc/dpp/dcn401/dcn401_dpp.c | 6 +++--- + 3 files changed, 25 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c +index 4f569cd8a5d61..272ebdd8b9ebd 100644 +--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c ++++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c +@@ -360,10 +360,10 @@ void dpp3_cnv_setup ( + + tbl_entry.color_space = input_color_space; + +- if (color_space >= COLOR_SPACE_YCBCR601) +- select = INPUT_CSC_SELECT_ICSC; +- else ++ if (dpp3_should_bypass_post_csc_for_colorspace(color_space)) + select = INPUT_CSC_SELECT_BYPASS; ++ else ++ select = INPUT_CSC_SELECT_ICSC; + + dpp3_program_post_csc(dpp_base, color_space, select, + &tbl_entry); +@@ -1521,3 +1521,18 @@ bool dpp3_construct( + return true; + } + ++bool dpp3_should_bypass_post_csc_for_colorspace(enum dc_color_space dc_color_space) ++{ ++ switch (dc_color_space) { ++ case COLOR_SPACE_UNKNOWN: ++ case COLOR_SPACE_SRGB: ++ case COLOR_SPACE_XR_RGB: ++ case COLOR_SPACE_SRGB_LIMITED: ++ case COLOR_SPACE_MSREF_SCRGB: ++ case COLOR_SPACE_2020_RGB_FULLRANGE: ++ case COLOR_SPACE_2020_RGB_LIMITEDRANGE: ++ return true; ++ default: ++ return false; ++ } ++} +diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h +index f236824126e94..2a76105fa9b1c 100644 +--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h ++++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h +@@ -642,4 +642,8 @@ void dpp3_program_cm_dealpha( + + void dpp3_cm_get_gamut_remap(struct dpp *dpp_base, + struct dpp_grph_csc_adjustment *adjust); ++ ++bool dpp3_should_bypass_post_csc_for_colorspace( ++ enum dc_color_space dc_color_space); ++ + #endif /* __DC_HWSS_DCN30_H__ */ +diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c +index 36187f890d5d0..b62bbadb0d440 100644 +--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c ++++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c +@@ -206,10 +206,10 @@ void dpp401_dpp_setup( + + tbl_entry.color_space = input_color_space; + +- if (color_space >= COLOR_SPACE_YCBCR601) +- select = INPUT_CSC_SELECT_ICSC; +- else ++ if (dpp3_should_bypass_post_csc_for_colorspace(color_space)) + select = INPUT_CSC_SELECT_BYPASS; ++ else ++ select = INPUT_CSC_SELECT_ICSC; + + dpp3_program_post_csc(dpp_base, color_space, select, + &tbl_entry); +-- +2.51.0 + diff --git a/queue-6.18/drm-amd-display-correct-fixed_vs-link-rate-toggle-co.patch b/queue-6.18/drm-amd-display-correct-fixed_vs-link-rate-toggle-co.patch new file mode 100644 index 00000000000..d4943d83464 --- /dev/null +++ b/queue-6.18/drm-amd-display-correct-fixed_vs-link-rate-toggle-co.patch @@ -0,0 +1,43 @@ +From bd7acb8f1fdbac3fc58005eee8d61028cde38df0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 15:18:50 +0800 +Subject: drm/amd/display: Correct FIXED_VS Link Rate Toggle Condition + +From: Jing Zhou + +[ Upstream commit 531fe6e0fee85a1bdb5b8223a706fff654ed0a61 ] + +[WHY&HOW] +The condition is only perform toggle if FIXED_VS LTTPR reports +no IEEE OUI. +The literal "\x0,\x0,\x0" contains commas changes the +bytes being compared to {0x00,0x2C,0X00}. +The correct literal should be "\x00\x00\x00" without commas. + +Reviewed-by: Charlene Liu +Reviewed-by: Wenjing Liu +Signed-off-by: Jing Zhou +Signed-off-by: Roman Li +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c +index ce174ce5579c0..6a7c4a59ff4c7 100644 +--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c ++++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c +@@ -271,7 +271,7 @@ enum link_training_result dp_perform_fixed_vs_pe_training_sequence( + rate = get_dpcd_link_rate(<_settings->link_settings); + + // Only perform toggle if FIXED_VS LTTPR reports no IEEE OUI +- if (memcmp("\x0,\x0,\x0", &link->dpcd_caps.lttpr_caps.lttpr_ieee_oui[0], 3) == 0) { ++ if (memcmp("\x00\x00\x00", &link->dpcd_caps.lttpr_caps.lttpr_ieee_oui[0], 3) == 0) { + /* Vendor specific: Toggle link rate */ + toggle_rate = (rate == 0x6) ? 0xA : 0x6; + +-- +2.51.0 + diff --git a/queue-6.18/drm-amd-display-disable-fec-when-powering-down-encod.patch b/queue-6.18/drm-amd-display-disable-fec-when-powering-down-encod.patch new file mode 100644 index 00000000000..688eb2cedef --- /dev/null +++ b/queue-6.18/drm-amd-display-disable-fec-when-powering-down-encod.patch @@ -0,0 +1,79 @@ +From ba6ae6b8cecab37a6876f9a76547681c69ac9e67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jan 2026 17:48:59 -0500 +Subject: drm/amd/display: Disable FEC when powering down encoders + +From: Ovidiu Bunea + +[ Upstream commit 8cee62904caf95e5698fa0f2d420f5f22b4dea15 ] + +[why & how] +VBIOS DMCUB FW can enable FEC for capable eDPs, but S/W DC state is +only updated for link0 when transitioning into OS with driver loaded. +This causes issues when the eDP is immediately hidden and DIG0 is +assigned to another link that does not support FEC. Driver will +attempt to disable FEC but FEC enablement occurs based on the link +state, which does not have fec_state updated since it is a different +link. Thus, FEC disablement on DIG0 will get skipped and cause no +light up. + +Reviewed-by: Karen Chen +Signed-off-by: Ovidiu Bunea +Signed-off-by: Matthew Stewart +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../amd/display/dc/hwss/dce110/dce110_hwseq.c | 24 ++++++++++++------- + 1 file changed, 15 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +index 7e36c063f0da5..65e66bfc4161c 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +@@ -59,6 +59,7 @@ + #include "dc_state_priv.h" + #include "dpcd_defs.h" + #include "dsc.h" ++#include "dc_dp_types.h" + /* include DCE11 register header files */ + #include "dce/dce_11_0_d.h" + #include "dce/dce_11_0_sh_mask.h" +@@ -1729,20 +1730,25 @@ static void power_down_encoders(struct dc *dc) + int i; + + for (i = 0; i < dc->link_count; i++) { +- enum signal_type signal = dc->links[i]->connector_signal; +- +- dc->link_srv->blank_dp_stream(dc->links[i], false); ++ struct dc_link *link = dc->links[i]; ++ struct link_encoder *link_enc = link->link_enc; ++ enum signal_type signal = link->connector_signal; + ++ dc->link_srv->blank_dp_stream(link, false); + if (signal != SIGNAL_TYPE_EDP) + signal = SIGNAL_TYPE_NONE; + +- if (dc->links[i]->ep_type == DISPLAY_ENDPOINT_PHY) +- dc->links[i]->link_enc->funcs->disable_output( +- dc->links[i]->link_enc, signal); ++ if (link->ep_type == DISPLAY_ENDPOINT_PHY) ++ link_enc->funcs->disable_output(link_enc, signal); ++ ++ if (link->fec_state == dc_link_fec_enabled) { ++ link_enc->funcs->fec_set_enable(link_enc, false); ++ link_enc->funcs->fec_set_ready(link_enc, false); ++ link->fec_state = dc_link_fec_not_ready; ++ } + +- dc->links[i]->link_status.link_active = false; +- memset(&dc->links[i]->cur_link_settings, 0, +- sizeof(dc->links[i]->cur_link_settings)); ++ link->link_status.link_active = false; ++ memset(&link->cur_link_settings, 0, sizeof(link->cur_link_settings)); + } + } + +-- +2.51.0 + diff --git a/queue-6.18/drm-amd-display-don-t-disable-dpcd-mst_en-if-sink-co.patch b/queue-6.18/drm-amd-display-don-t-disable-dpcd-mst_en-if-sink-co.patch new file mode 100644 index 00000000000..5a3c272f7da --- /dev/null +++ b/queue-6.18/drm-amd-display-don-t-disable-dpcd-mst_en-if-sink-co.patch @@ -0,0 +1,87 @@ +From e38585a9cf1b3763ca525630f5ffe552faa0ba86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Nov 2025 11:19:36 +0800 +Subject: drm/amd/display: Don't disable DPCD mst_en if sink connected + +From: Peichen Huang + +[ Upstream commit 9aeb31b2456452257ad1ff7ec566f21bab1f3e8a ] + +[WHY] +User may connect mst dock with multi monitors and do quick unplug +and plug in one of the monitor. This operatioin may create CSN from +dock to display driver. Then display driver would disable and then enable +mst link and also disable/enable DPCD mst_en bit in dock RX. However, +when mst_en bit being disabled, if dock has another CSN message to +transmit then the message would be removed because of the disabling of +mst_en. In this case, the message is missing and it ends up no display in +the replugged monitor. + +[HOW] +Don't disable mst_en bit when link still has sink connected. + +Reviewed-by: Wenjing Liu +Signed-off-by: Peichen Huang +Signed-off-by: Chenyu Chen +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c +index b66fbcb0040d6..a084c698ed6ef 100644 +--- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c ++++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c +@@ -1928,7 +1928,7 @@ static void disable_link_dp(struct dc_link *link, + link->dc->hwss.edp_power_control(link, false); + } + +- if (signal == SIGNAL_TYPE_DISPLAY_PORT_MST) ++ if (signal == SIGNAL_TYPE_DISPLAY_PORT_MST && link->sink_count == 0) + /* set the sink to SST mode after disabling the link */ + enable_mst_on_sink(link, false); + +@@ -2079,7 +2079,12 @@ static enum dc_status enable_link_dp(struct dc_state *state, + pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT && + link->dc->debug.set_mst_en_for_sst) { + enable_mst_on_sink(link, true); ++ } else if (link->dpcd_caps.is_mst_capable && ++ pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT) { ++ /* disable mst on sink */ ++ enable_mst_on_sink(link, false); + } ++ + if (pipe_ctx->stream->signal == SIGNAL_TYPE_EDP) { + /*in case it is not on*/ + if (!link->dc->config.edp_no_power_sequencing) +@@ -2358,9 +2363,9 @@ void link_set_dpms_off(struct pipe_ctx *pipe_ctx) + if (pipe_ctx->stream->sink) { + if (pipe_ctx->stream->sink->sink_signal != SIGNAL_TYPE_VIRTUAL && + pipe_ctx->stream->sink->sink_signal != SIGNAL_TYPE_NONE) { +- DC_LOG_DC("%s pipe_ctx dispname=%s signal=%x link=%d\n", __func__, ++ DC_LOG_DC("%s pipe_ctx dispname=%s signal=%x link=%d sink_count=%d\n", __func__, + pipe_ctx->stream->sink->edid_caps.display_name, +- pipe_ctx->stream->signal, link->link_index); ++ pipe_ctx->stream->signal, link->link_index, link->sink_count); + } + } + +@@ -2474,10 +2479,11 @@ void link_set_dpms_on( + if (pipe_ctx->stream->sink) { + if (pipe_ctx->stream->sink->sink_signal != SIGNAL_TYPE_VIRTUAL && + pipe_ctx->stream->sink->sink_signal != SIGNAL_TYPE_NONE) { +- DC_LOG_DC("%s pipe_ctx dispname=%s signal=%x link=%d\n", __func__, ++ DC_LOG_DC("%s pipe_ctx dispname=%s signal=%x link=%d sink_count=%d\n", __func__, + pipe_ctx->stream->sink->edid_caps.display_name, + pipe_ctx->stream->signal, +- link->link_index); ++ link->link_index, ++ link->sink_count); + } + } + +-- +2.51.0 + diff --git a/queue-6.18/drm-amd-display-ensure-link-output-is-disabled-in-ba.patch b/queue-6.18/drm-amd-display-ensure-link-output-is-disabled-in-ba.patch new file mode 100644 index 00000000000..ebd5e7d6c3f --- /dev/null +++ b/queue-6.18/drm-amd-display-ensure-link-output-is-disabled-in-ba.patch @@ -0,0 +1,59 @@ +From e9fab2f67bbc2f9b67492e926b04c7a2e03d6621 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 11:11:19 -0500 +Subject: drm/amd/display: Ensure link output is disabled in backend reset for + PLL_ON + +From: Nicholas Kazlauskas + +[ Upstream commit 4589712e0111352973131bad975023b25569287c ] + +[Why] +We're missing the code to actually disable the link output when we have +to leave the SYMCLK_ON but the TX remains OFF. + +[How] +Port the code from DCN401 that detects SYMCLK_ON_TX_OFF and disable +the link output when the backend is reset. + +Reviewed-by: Ovidiu (Ovi) Bunea +Signed-off-by: Nicholas Kazlauskas +Signed-off-by: Matthew Stewart +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c +index b822f2dffff0e..e9bd43a72ce58 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c +@@ -546,8 +546,22 @@ static void dcn31_reset_back_end_for_pipe( + if (pipe_ctx->stream_res.tg->funcs->set_odm_bypass) + pipe_ctx->stream_res.tg->funcs->set_odm_bypass( + pipe_ctx->stream_res.tg, &pipe_ctx->stream->timing); ++ /* ++ * TODO - convert symclk_ref_cnts for otg to a bit map to solve ++ * the case where the same symclk is shared across multiple otg ++ * instances ++ */ + if (dc_is_hdmi_tmds_signal(pipe_ctx->stream->signal)) +- pipe_ctx->stream->link->phy_state.symclk_ref_cnts.otg = 0; ++ link->phy_state.symclk_ref_cnts.otg = 0; ++ ++ if (pipe_ctx->top_pipe == NULL) { ++ if (link->phy_state.symclk_state == SYMCLK_ON_TX_OFF) { ++ const struct link_hwss *link_hwss = get_link_hwss(link, &pipe_ctx->link_res); ++ ++ link_hwss->disable_link_output(link, &pipe_ctx->link_res, pipe_ctx->stream->signal); ++ link->phy_state.symclk_state = SYMCLK_OFF_TX_OFF; ++ } ++ } + + set_drr_and_clear_adjust_pending(pipe_ctx, pipe_ctx->stream, NULL); + +-- +2.51.0 + diff --git a/queue-6.18/drm-amd-display-fix-dsc-edp-issue.patch b/queue-6.18/drm-amd-display-fix-dsc-edp-issue.patch new file mode 100644 index 00000000000..668cdc78ff4 --- /dev/null +++ b/queue-6.18/drm-amd-display-fix-dsc-edp-issue.patch @@ -0,0 +1,59 @@ +From 281fc1c3cb03fffdc54c3c0d6927d5ad39b3cbc5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Dec 2025 17:01:17 -0500 +Subject: drm/amd/display: Fix dsc eDP issue + +From: Charlene Liu + +[ Upstream commit 878a4b73c11111ff5f820730f59a7f8c6fd59374 ] + +[why] +Need to add function hook check before use + +Reviewed-by: Mohit Bawa +Signed-off-by: Charlene Liu +Signed-off-by: Chenyu Chen +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +index 39be5a58f837a..7e36c063f0da5 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +@@ -1790,6 +1790,9 @@ static void disable_vga_and_power_gate_all_controllers( + struct timing_generator *tg; + struct dc_context *ctx = dc->ctx; + ++ if (dc->caps.ips_support) ++ return; ++ + for (i = 0; i < dc->res_pool->timing_generator_count; i++) { + tg = dc->res_pool->timing_generators[i]; + +@@ -1866,13 +1869,16 @@ static void clean_up_dsc_blocks(struct dc *dc) + /* disable DSC in OPTC */ + if (i < dc->res_pool->timing_generator_count) { + tg = dc->res_pool->timing_generators[i]; +- tg->funcs->set_dsc_config(tg, OPTC_DSC_DISABLED, 0, 0); ++ if (tg->funcs->set_dsc_config) ++ tg->funcs->set_dsc_config(tg, OPTC_DSC_DISABLED, 0, 0); + } + /* disable DSC in stream encoder */ + if (i < dc->res_pool->stream_enc_count) { + se = dc->res_pool->stream_enc[i]; +- se->funcs->dp_set_dsc_config(se, OPTC_DSC_DISABLED, 0, 0); +- se->funcs->dp_set_dsc_pps_info_packet(se, false, NULL, true); ++ if (se->funcs->dp_set_dsc_config) ++ se->funcs->dp_set_dsc_config(se, OPTC_DSC_DISABLED, 0, 0); ++ if (se->funcs->dp_set_dsc_pps_info_packet) ++ se->funcs->dp_set_dsc_pps_info_packet(se, false, NULL, true); + } + /* disable DSC block */ + if (dccg->funcs->set_ref_dscclk) +-- +2.51.0 + diff --git a/queue-6.18/drm-amd-display-fix-gfx12-family-constant-checks.patch b/queue-6.18/drm-amd-display-fix-gfx12-family-constant-checks.patch new file mode 100644 index 00000000000..422387dcd57 --- /dev/null +++ b/queue-6.18/drm-amd-display-fix-gfx12-family-constant-checks.patch @@ -0,0 +1,59 @@ +From 19e8142e1973e82bd19bb4f98818ee7467059069 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jan 2026 13:32:42 -0500 +Subject: drm/amd/display: Fix GFX12 family constant checks + +From: Matthew Stewart + +[ Upstream commit bdad08670278829771626ea7b57c4db531e2544f ] + +Using >=, <= for checking the family is not always correct. + +Reviewed-by: Aurabindo Pillai +Signed-off-by: Matthew Stewart +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index a0077fe79ed26..b3cf43eb6e087 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -11616,7 +11616,7 @@ static int dm_check_cursor_fb(struct amdgpu_crtc *new_acrtc, + * check tiling flags when the FB doesn't have a modifier. + */ + if (!(fb->flags & DRM_MODE_FB_MODIFIERS)) { +- if (adev->family >= AMDGPU_FAMILY_GC_12_0_0) { ++ if (adev->family == AMDGPU_FAMILY_GC_12_0_0) { + linear = AMDGPU_TILING_GET(afb->tiling_flags, GFX12_SWIZZLE_MODE) == 0; + } else if (adev->family >= AMDGPU_FAMILY_AI) { + linear = AMDGPU_TILING_GET(afb->tiling_flags, SWIZZLE_MODE) == 0; +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c +index 9bb7475e80bad..2ecebf9a00fa4 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c +@@ -277,7 +277,7 @@ static int amdgpu_dm_plane_validate_dcc(struct amdgpu_device *adev, + if (!dcc->enable) + return 0; + +- if (adev->family < AMDGPU_FAMILY_GC_12_0_0 && ++ if (adev->family != AMDGPU_FAMILY_GC_12_0_0 && + format >= SURFACE_PIXEL_FORMAT_VIDEO_BEGIN) + return -EINVAL; + +@@ -900,7 +900,7 @@ int amdgpu_dm_plane_fill_plane_buffer_attributes(struct amdgpu_device *adev, + upper_32_bits(chroma_addr); + } + +- if (adev->family >= AMDGPU_FAMILY_GC_12_0_0) { ++ if (adev->family == AMDGPU_FAMILY_GC_12_0_0) { + ret = amdgpu_dm_plane_fill_gfx12_plane_attributes_from_modifiers(adev, afb, format, + rotation, plane_size, + tiling_info, dcc, +-- +2.51.0 + diff --git a/queue-6.18/drm-amd-display-fix-system-resume-lag-issue.patch b/queue-6.18/drm-amd-display-fix-system-resume-lag-issue.patch new file mode 100644 index 00000000000..399337895fb --- /dev/null +++ b/queue-6.18/drm-amd-display-fix-system-resume-lag-issue.patch @@ -0,0 +1,54 @@ +From 1d76456c7f92ce8c74ec136d442383bdd1c8934a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 18:10:31 +0800 +Subject: drm/amd/display: Fix system resume lag issue + +From: Tom Chung + +[ Upstream commit 64c94cd9be2e188ed07efeafa6a109bce638c967 ] + +[Why] +System will try to apply idle power optimizations setting during +system resume. But system power state is still in D3 state, and +it will cause the idle power optimizations command not actually +to be sent to DMUB and cause some platforms to go into IPS. + +[How] +Set power state to D0 first before calling the +dc_dmub_srv_apply_idle_power_optimizations(dm->dc, false) + +Reviewed-by: Nicholas Kazlauskas +Signed-off-by: Tom Chung +Signed-off-by: Wayne Lin +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index b527d5764b76b..c8415a2840567 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -3407,7 +3407,17 @@ static int dm_resume(struct amdgpu_ip_block *ip_block) + struct dc_commit_streams_params commit_params = {}; + + if (dm->dc->caps.ips_support) { ++ if (!amdgpu_in_reset(adev)) ++ mutex_lock(&dm->dc_lock); ++ ++ /* Need to set POWER_STATE_D0 first or it will not execute ++ * idle_power_optimizations command to DMUB. ++ */ ++ dc_dmub_srv_set_power_state(dm->dc->ctx->dmub_srv, DC_ACPI_CM_POWER_STATE_D0); + dc_dmub_srv_apply_idle_power_optimizations(dm->dc, false); ++ ++ if (!amdgpu_in_reset(adev)) ++ mutex_unlock(&dm->dc_lock); + } + + if (amdgpu_in_reset(adev)) { +-- +2.51.0 + diff --git a/queue-6.18/drm-amd-display-fix-writeback-on-dcn-3.2.patch b/queue-6.18/drm-amd-display-fix-writeback-on-dcn-3.2.patch new file mode 100644 index 00000000000..8bf428901bd --- /dev/null +++ b/queue-6.18/drm-amd-display-fix-writeback-on-dcn-3.2.patch @@ -0,0 +1,70 @@ +From 6d9174fd27f5744cdf089c34fa24c7685f0adfcd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 17:20:31 -0700 +Subject: drm/amd/display: Fix writeback on DCN 3.2+ + +From: Alex Hung + +[ Upstream commit 9ef84a307582a92ef055ef0bd3db10fd8ac75960 ] + +[WHAT] +1. Set no scaling for writeback as they are hardcoded in DCN3.2+. +2. Set no fast plane update for writeback commits. + +Reviewed-by: Harry Wentland +Signed-off-by: Alex Hung +Signed-off-by: Wayne Lin +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index b3cf43eb6e087..b527d5764b76b 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -10411,10 +10411,10 @@ static void dm_set_writeback(struct amdgpu_display_manager *dm, + + wb_info->dwb_params.capture_rate = dwb_capture_rate_0; + +- wb_info->dwb_params.scaler_taps.h_taps = 4; +- wb_info->dwb_params.scaler_taps.v_taps = 4; +- wb_info->dwb_params.scaler_taps.h_taps_c = 2; +- wb_info->dwb_params.scaler_taps.v_taps_c = 2; ++ wb_info->dwb_params.scaler_taps.h_taps = 1; ++ wb_info->dwb_params.scaler_taps.v_taps = 1; ++ wb_info->dwb_params.scaler_taps.h_taps_c = 1; ++ wb_info->dwb_params.scaler_taps.v_taps_c = 1; + wb_info->dwb_params.subsample_position = DWB_INTERSTITIAL_SUBSAMPLING; + + wb_info->mcif_buf_params.luma_pitch = afb->base.pitches[0]; +@@ -11430,6 +11430,8 @@ static bool should_reset_plane(struct drm_atomic_state *state, + struct drm_crtc_state *old_crtc_state, *new_crtc_state; + struct dm_crtc_state *old_dm_crtc_state, *new_dm_crtc_state; + struct amdgpu_device *adev = drm_to_adev(plane->dev); ++ struct drm_connector_state *new_con_state; ++ struct drm_connector *connector; + int i; + + /* +@@ -11440,6 +11442,15 @@ static bool should_reset_plane(struct drm_atomic_state *state, + state->allow_modeset) + return true; + ++ /* Check for writeback commit */ ++ for_each_new_connector_in_state(state, connector, new_con_state, i) { ++ if (connector->connector_type != DRM_MODE_CONNECTOR_WRITEBACK) ++ continue; ++ ++ if (new_con_state->writeback_job) ++ return true; ++ } ++ + if (amdgpu_in_reset(adev) && state->allow_modeset) + return true; + +-- +2.51.0 + diff --git a/queue-6.18/drm-amd-display-guard-fams2-configuration-updates.patch b/queue-6.18/drm-amd-display-guard-fams2-configuration-updates.patch new file mode 100644 index 00000000000..6bf4bcf75c0 --- /dev/null +++ b/queue-6.18/drm-amd-display-guard-fams2-configuration-updates.patch @@ -0,0 +1,51 @@ +From 83ab343497dc3faedeef2f1bc6125203bc568b11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Nov 2025 20:58:23 +0000 +Subject: drm/amd/display: Guard FAMS2 configuration updates + +From: Dillon Varone + +[ Upstream commit 7dedb906cdfec100061daf41f8e54266e975987d ] + +[WHY&HOW] +If DMCUB is not initialized or FAMS2 is not supported, the +interface should not be called. + +Reviewed-by: Sridevi Arvindekar +Signed-off-by: Dillon Varone +Signed-off-by: Roman Li +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +index 77cdd02a41bdd..bbfefc9edd1f1 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +@@ -1628,7 +1628,8 @@ void dcn401_unblank_stream(struct pipe_ctx *pipe_ctx, + void dcn401_hardware_release(struct dc *dc) + { + if (!dc->debug.disable_force_pstate_allow_on_hw_release) { +- dc_dmub_srv_fams2_update_config(dc, dc->current_state, false); ++ if (dc->ctx->dmub_srv && dc->debug.fams2_config.bits.enable) ++ dc_dmub_srv_fams2_update_config(dc, dc->current_state, false); + + /* If pstate unsupported, or still supported + * by firmware, force it supported by dcn +@@ -1648,7 +1649,9 @@ void dcn401_hardware_release(struct dc *dc) + dc->clk_mgr->clks.p_state_change_support = false; + dc->clk_mgr->funcs->update_clocks(dc->clk_mgr, dc->current_state, true); + } +- dc_dmub_srv_fams2_update_config(dc, dc->current_state, false); ++ ++ if (dc->ctx->dmub_srv && dc->debug.fams2_config.bits.enable) ++ dc_dmub_srv_fams2_update_config(dc, dc->current_state, false); + } + } + +-- +2.51.0 + diff --git a/queue-6.18/drm-amd-display-only-power-down-dig-on-phy-endpoints.patch b/queue-6.18/drm-amd-display-only-power-down-dig-on-phy-endpoints.patch new file mode 100644 index 00000000000..b15aed49b35 --- /dev/null +++ b/queue-6.18/drm-amd-display-only-power-down-dig-on-phy-endpoints.patch @@ -0,0 +1,37 @@ +From f31095e2d011bb97e9ef6b0aaaafc10a4075cebc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 16:38:50 -0500 +Subject: drm/amd/display: only power down dig on phy endpoints + +From: Dmytro Laktyushkin + +[ Upstream commit 0839d8d24e6f1fc2587c4a976f44da9fa69ae3d0 ] + +This avoids any issues with dpia endpoints + +Reviewed-by: Charlene Liu +Signed-off-by: Dmytro Laktyushkin +Signed-off-by: Matthew Stewart +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +index 483217a91029a..d4a0961f6b516 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +@@ -284,6 +284,8 @@ void dcn401_init_hw(struct dc *dc) + for (i = 0; i < dc->link_count; i++) { + struct dc_link *link = dc->links[i]; + ++ if (link->ep_type != DISPLAY_ENDPOINT_PHY) ++ continue; + if (link->link_enc->funcs->is_dig_enabled && + link->link_enc->funcs->is_dig_enabled(link->link_enc) && + hws->funcs.power_down) { +-- +2.51.0 + diff --git a/queue-6.18/drm-amd-display-remove-conditional-for-shaper-3dlut-.patch b/queue-6.18/drm-amd-display-remove-conditional-for-shaper-3dlut-.patch new file mode 100644 index 00000000000..5687f7fa1f6 --- /dev/null +++ b/queue-6.18/drm-amd-display-remove-conditional-for-shaper-3dlut-.patch @@ -0,0 +1,44 @@ +From 7aae51c37dd75c0ef60e33ccb8058186baf6e434 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 22:05:16 -0700 +Subject: drm/amd/display: Remove conditional for shaper 3DLUT power-on + +From: Alex Hung + +[ Upstream commit 1b38a87b8f8020e8ef4563e7752a64182b5a39b9 ] + +[Why] +Shaper programming has high chance to fail on first time after +power-on or reboot. This can be verified by running IGT's kms_colorop. + +[How] +Always power on the shaper and 3DLUT before programming by +removing the debug flag of low power mode. + +Reviewed-by: Aurabindo Pillai +Signed-off-by: Alex Hung +Signed-off-by: Ray Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c b/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c +index 6f0e017a8ae29..a9d2aa0b5390f 100644 +--- a/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c ++++ b/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c +@@ -724,8 +724,7 @@ bool mpc32_program_shaper( + return false; + } + +- if (mpc->ctx->dc->debug.enable_mem_low_power.bits.mpc) +- mpc32_power_on_shaper_3dlut(mpc, mpcc_id, true); ++ mpc32_power_on_shaper_3dlut(mpc, mpcc_id, true); + + current_mode = mpc32_get_shaper_current(mpc, mpcc_id); + +-- +2.51.0 + diff --git a/queue-6.18/drm-amd-display-revert-init-dispclk-from-bootup-cloc.patch b/queue-6.18/drm-amd-display-revert-init-dispclk-from-bootup-cloc.patch new file mode 100644 index 00000000000..5d83d50a9c4 --- /dev/null +++ b/queue-6.18/drm-amd-display-revert-init-dispclk-from-bootup-cloc.patch @@ -0,0 +1,50 @@ +From fb4079538dc01ab72b0f9f28716a068b71cb58a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Dec 2025 11:01:38 +0800 +Subject: drm/amd/display: Revert "init dispclk from bootup clock for DCN315" + +From: Wang, Sung-huai + +[ Upstream commit a625dc4989a2affb8f06e7b418bf30e1474b99c1 ] + +[Why&How] +This reverts commit 14bb17cc37e0. +Due to the change, the display shows garbage on startup. + +We have an alternative solution for the original issue: +d24203bb629f ("drm/amd/display: Re-check seamless boot can be enabled or not") + +Reviewed-by: Nicholas Kazlauskas +Signed-off-by: Wang, Sung-huai +Signed-off-by: Matthew Stewart +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c +index b315ed91e010b..c49268db85f68 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c +@@ -138,7 +138,7 @@ static void dcn315_update_clocks(struct clk_mgr *clk_mgr_base, + if (dc->work_arounds.skip_clock_update) + return; + +- clk_mgr_base->clks.zstate_support = new_clocks->zstate_support; ++ display_count = dcn315_get_active_display_cnt_wa(dc, context); + /* + * if it is safe to lower, but we are already in the lower state, we don't have to do anything + * also if safe to lower is false, we just go in the higher state +@@ -151,7 +151,6 @@ static void dcn315_update_clocks(struct clk_mgr *clk_mgr_base, + } + /* check that we're not already in lower */ + if (clk_mgr_base->clks.pwr_state != DCN_PWR_STATE_LOW_POWER) { +- display_count = dcn315_get_active_display_cnt_wa(dc, context); + /* if we can go lower, go lower */ + if (display_count == 0) { + union display_idle_optimization_u idle_info = { 0 }; +-- +2.51.0 + diff --git a/queue-6.18/drm-amdgpu-add-hainan-clock-adjustment.patch b/queue-6.18/drm-amdgpu-add-hainan-clock-adjustment.patch new file mode 100644 index 00000000000..a5eacc18f42 --- /dev/null +++ b/queue-6.18/drm-amdgpu-add-hainan-clock-adjustment.patch @@ -0,0 +1,39 @@ +From 56272423c6e44dfcf1e016a2f72db13c09dd4eeb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Feb 2026 07:24:01 +0000 +Subject: drm/amdgpu: Add HAINAN clock adjustment + +From: decce6 + +[ Upstream commit 49fe2c57bdc0acff9d2551ae337270b6fd8119d9 ] + +This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from +850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This +patch is for amdgpu. + +Signed-off-by: decce6 +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index a1da3e5812ce3..9342f0b8bab2a 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -3469,6 +3469,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + max_sclk = 60000; + max_mclk = 80000; + } ++ if ((adev->pdev->device == 0x666f) && ++ (adev->pdev->revision == 0x00)) { ++ max_sclk = 80000; ++ max_mclk = 95000; ++ } + } else if (adev->asic_type == CHIP_OLAND) { + if ((adev->pdev->revision == 0xC7) || + (adev->pdev->revision == 0x80) || +-- +2.51.0 + diff --git a/queue-6.18/drm-amdgpu-add-support-for-hdp-ip-version-6.1.1.patch b/queue-6.18/drm-amdgpu-add-support-for-hdp-ip-version-6.1.1.patch new file mode 100644 index 00000000000..1bbce7aeff0 --- /dev/null +++ b/queue-6.18/drm-amdgpu-add-support-for-hdp-ip-version-6.1.1.patch @@ -0,0 +1,34 @@ +From b9a424a0e19e1fdb3c38b479a7745cc1b986b3c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Dec 2024 10:46:47 +0800 +Subject: drm/amdgpu: add support for HDP IP version 6.1.1 + +From: Tim Huang + +[ Upstream commit e2fd14f579b841f54a9b7162fef15234d8c0627a ] + +This initializes HDP IP version 6.1.1. + +Reviewed-by: Mario Limonciello +Signed-off-by: Tim Huang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +index dd7b2b796427c..54a045a0bda96 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +@@ -2995,6 +2995,7 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev) + case IP_VERSION(6, 0, 0): + case IP_VERSION(6, 0, 1): + case IP_VERSION(6, 1, 0): ++ case IP_VERSION(6, 1, 1): + adev->hdp.funcs = &hdp_v6_0_funcs; + break; + case IP_VERSION(7, 0, 0): +-- +2.51.0 + diff --git a/queue-6.18/drm-amdgpu-adjust-usleep_range-in-fence-wait.patch b/queue-6.18/drm-amdgpu-adjust-usleep_range-in-fence-wait.patch new file mode 100644 index 00000000000..cd85b3ec263 --- /dev/null +++ b/queue-6.18/drm-amdgpu-adjust-usleep_range-in-fence-wait.patch @@ -0,0 +1,38 @@ +From a88e7d6b1ac14deb27af0376e5344856cdad5189 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Feb 2026 15:32:01 +0800 +Subject: drm/amdgpu: Adjust usleep_range in fence wait + +From: Ce Sun + +[ Upstream commit 3ee1c72606bd2842f0f377fd4b118362af0323ae ] + +Tune the sleep interval in the PSP fence wait loop from 10-100us to +60-100us.This adjustment results in an overall wait window of 1.2s +(60us * 20000 iterations) to 2 seconds (100us * 20000 iterations), +which guarantees that we can retrieve the correct fence value + +Signed-off-by: Ce Sun +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index aa7987d0806c6..5f7aa840b2151 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -726,7 +726,7 @@ psp_cmd_submit_buf(struct psp_context *psp, + ras_intr = amdgpu_ras_intr_triggered(); + if (ras_intr) + break; +- usleep_range(10, 100); ++ usleep_range(60, 100); + amdgpu_device_invalidate_hdp(psp->adev, NULL); + } + +-- +2.51.0 + diff --git a/queue-6.18/drm-amdgpu-avoid-a-warning-in-timedout-job-handler.patch b/queue-6.18/drm-amdgpu-avoid-a-warning-in-timedout-job-handler.patch new file mode 100644 index 00000000000..c25626a8e2b --- /dev/null +++ b/queue-6.18/drm-amdgpu-avoid-a-warning-in-timedout-job-handler.patch @@ -0,0 +1,41 @@ +From 4aebb578759004586f8352d7efef8f756b3b2dec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Dec 2025 11:46:48 -0500 +Subject: drm/amdgpu: avoid a warning in timedout job handler +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +[ Upstream commit c8cf9ddc549fb93cb5a35f3fe23487b1e6707e74 ] + +Only set an error on the fence if the fence is not +signalled. We can end up with a warning if the +per queue reset path signals the fence and sets an error +as part of the reset, but fails to recover. + +Reviewed-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c +index 630af847f29ff..ffc720d189007 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c +@@ -147,7 +147,8 @@ static enum drm_gpu_sched_stat amdgpu_job_timedout(struct drm_sched_job *s_job) + dev_err(adev->dev, "Ring %s reset failed\n", ring->sched.name); + } + +- dma_fence_set_error(&s_job->s_fence->finished, -ETIME); ++ if (dma_fence_get_status(&s_job->s_fence->finished) == 0) ++ dma_fence_set_error(&s_job->s_fence->finished, -ETIME); + + if (amdgpu_device_should_recover_gpu(ring->adev)) { + struct amdgpu_reset_context reset_context; +-- +2.51.0 + diff --git a/queue-6.18/drm-amdgpu-avoid-sdma-ring-reset-in-sriov.patch b/queue-6.18/drm-amdgpu-avoid-sdma-ring-reset-in-sriov.patch new file mode 100644 index 00000000000..74cc57d838b --- /dev/null +++ b/queue-6.18/drm-amdgpu-avoid-sdma-ring-reset-in-sriov.patch @@ -0,0 +1,39 @@ +From d988398c5d9080ae29d7b8bd653bf8db9e15f7bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 23:15:04 +0800 +Subject: drm/amdgpu: avoid sdma ring reset in sriov + +From: Victor Zhao + +[ Upstream commit 5cc7bbd9f1b74d9fe2f7ac08d6ba0477e8d2d65f ] + +sdma ring reset is not supported in SRIOV. kfd driver does not check +reset mask, and could queue sdma ring reset during unmap_queues_cpsch. + +Avoid the ring reset for sriov. + +Signed-off-by: Victor Zhao +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c +index 8b8a04138711c..321310ba2c08e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c +@@ -558,6 +558,9 @@ int amdgpu_sdma_reset_engine(struct amdgpu_device *adev, uint32_t instance_id, + struct amdgpu_ring *gfx_ring = &sdma_instance->ring; + struct amdgpu_ring *page_ring = &sdma_instance->page; + ++ if (amdgpu_sriov_vf(adev)) ++ return -EOPNOTSUPP; ++ + mutex_lock(&sdma_instance->engine_reset_mutex); + + if (!caller_handles_kernel_queues) { +-- +2.51.0 + diff --git a/queue-6.18/drm-amdgpu-fix-null-pointer-issue-buffer-funcs.patch b/queue-6.18/drm-amdgpu-fix-null-pointer-issue-buffer-funcs.patch new file mode 100644 index 00000000000..21d4972d188 --- /dev/null +++ b/queue-6.18/drm-amdgpu-fix-null-pointer-issue-buffer-funcs.patch @@ -0,0 +1,37 @@ +From 5c366bd04e405d63154b545f8cce1a10cc047b31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Jul 2024 11:07:40 +0800 +Subject: drm/amdgpu: fix NULL pointer issue buffer funcs + +From: Likun Gao + +[ Upstream commit 9877a865d62c9c3e0f4cc369dc9ca9f7f24f5ee9 ] + +If SDMA block not enabled, buffer_funcs will not initialize, +fix the null pointer issue if buffer_funcs not initialized. + +Signed-off-by: Likun Gao +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index 53b33a636971a..c052da36aa9c2 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -3280,7 +3280,8 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev) + if (r) + goto init_failed; + +- if (adev->mman.buffer_funcs_ring->sched.ready) ++ if (adev->mman.buffer_funcs_ring && ++ adev->mman.buffer_funcs_ring->sched.ready) + amdgpu_ttm_set_buffer_funcs_status(adev, true); + + /* Don't init kfd if whole hive need to be reset during init */ +-- +2.51.0 + diff --git a/queue-6.18/drm-amdgpu-fix-the-calculation-of-ras-bad-page-numbe.patch b/queue-6.18/drm-amdgpu-fix-the-calculation-of-ras-bad-page-numbe.patch new file mode 100644 index 00000000000..41637dc91d1 --- /dev/null +++ b/queue-6.18/drm-amdgpu-fix-the-calculation-of-ras-bad-page-numbe.patch @@ -0,0 +1,46 @@ +From 9c6679a2798d04e98f26c5fffa46dcf1268e4e0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 15:21:43 +0800 +Subject: drm/amdgpu: fix the calculation of RAS bad page number + +From: Tao Zhou + +[ Upstream commit f752e79d38857011f1293fcb6c810409c3b669ee ] + +__amdgpu_ras_restore_bad_pages is responsible for the maintenance of bad +page number, drop the unnecessary bad page number update in the error +handling path of add_bad_pages. + +Signed-off-by: Tao Zhou +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +index 3fd19859055a5..ca5f99df1ac20 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +@@ -3056,8 +3056,6 @@ int amdgpu_ras_add_bad_pages(struct amdgpu_device *adev, + /* deal with retire_unit records a time */ + ret = __amdgpu_ras_convert_rec_array_from_rom(adev, + &bps[i], &err_data, nps); +- if (ret) +- con->bad_page_num -= adev->umc.retire_unit; + i += (adev->umc.retire_unit - 1); + } else { + break; +@@ -3070,8 +3068,6 @@ int amdgpu_ras_add_bad_pages(struct amdgpu_device *adev, + for (; i < pages; i++) { + ret = __amdgpu_ras_convert_rec_from_rom(adev, + &bps[i], &err_data, nps); +- if (ret) +- con->bad_page_num -= adev->umc.retire_unit; + } + + con->eh_data->count_saved = con->eh_data->count; +-- +2.51.0 + diff --git a/queue-6.18/drm-amdgpu-ras-move-ras-data-alloc-before-bad-page-c.patch b/queue-6.18/drm-amdgpu-ras-move-ras-data-alloc-before-bad-page-c.patch new file mode 100644 index 00000000000..f48e3ceee12 --- /dev/null +++ b/queue-6.18/drm-amdgpu-ras-move-ras-data-alloc-before-bad-page-c.patch @@ -0,0 +1,89 @@ +From d849895366b8a048160e377f523f21bf568e577e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 00:46:23 +0800 +Subject: drm/amdgpu/ras: Move ras data alloc before bad page check + +From: Asad Kamal + +[ Upstream commit bd68a1404b6fa2e7e9957b38ba22616faba43e75 ] + +In the rare event if eeprom has only invalid address entries, +allocation is skipped, this causes following NULL pointer issue +[ 547.103445] BUG: kernel NULL pointer dereference, address: 0000000000000010 +[ 547.118897] #PF: supervisor read access in kernel mode +[ 547.130292] #PF: error_code(0x0000) - not-present page +[ 547.141689] PGD 124757067 P4D 0 +[ 547.148842] Oops: 0000 [#1] PREEMPT SMP NOPTI +[ 547.158504] CPU: 49 PID: 8167 Comm: cat Tainted: G OE 6.8.0-38-generic #38-Ubuntu +[ 547.177998] Hardware name: Supermicro AS -8126GS-TNMR/H14DSG-OD, BIOS 1.7 09/12/2025 +[ 547.195178] RIP: 0010:amdgpu_ras_sysfs_badpages_read+0x2f2/0x5d0 [amdgpu] +[ 547.210375] Code: e8 63 78 82 c0 45 31 d2 45 3b 75 08 48 8b 45 a0 73 44 44 89 f1 48 8b 7d 88 48 89 ca 48 c1 e2 05 48 29 ca 49 8b 4d 00 48 01 d1 <48> 83 79 10 00 74 17 49 63 f2 48 8b 49 08 41 83 c2 01 48 8d 34 76 +[ 547.252045] RSP: 0018:ffa0000067287ac0 EFLAGS: 00010246 +[ 547.263636] RAX: ff11000167c28130 RBX: ff11000127600000 RCX: 0000000000000000 +[ 547.279467] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ff11000125b1c800 +[ 547.295298] RBP: ffa0000067287b50 R08: 0000000000000000 R09: 0000000000000000 +[ 547.311129] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 +[ 547.326959] R13: ff11000217b1de00 R14: 0000000000000000 R15: 0000000000000092 +[ 547.342790] FS: 0000746e59d14740(0000) GS:ff11017dfda80000(0000) knlGS:0000000000000000 +[ 547.360744] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 547.373489] CR2: 0000000000000010 CR3: 000000019585e001 CR4: 0000000000f71ef0 +[ 547.389321] PKRU: 55555554 +[ 547.395316] Call Trace: +[ 547.400737] +[ 547.405386] ? show_regs+0x6d/0x80 +[ 547.412929] ? __die+0x24/0x80 +[ 547.419697] ? page_fault_oops+0x99/0x1b0 +[ 547.428588] ? do_user_addr_fault+0x2ee/0x6b0 +[ 547.438249] ? exc_page_fault+0x83/0x1b0 +[ 547.446949] ? asm_exc_page_fault+0x27/0x30 +[ 547.456225] ? amdgpu_ras_sysfs_badpages_read+0x2f2/0x5d0 [amdgpu] +[ 547.470040] ? mas_wr_modify+0xcd/0x140 +[ 547.478548] sysfs_kf_bin_read+0x63/0xb0 +[ 547.487248] kernfs_file_read_iter+0xa1/0x190 +[ 547.496909] kernfs_fop_read_iter+0x25/0x40 +[ 547.506182] vfs_read+0x255/0x390 + +This also result in space left assigned to negative values. +Moving data alloc call before bad page check resolves both the issue. + +Signed-off-by: Asad Kamal +Suggested-by: Lijo Lazar +Reviewed-by: Hawking Zhang +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +index ca5f99df1ac20..e9ed1a3b135cc 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +@@ -2892,6 +2892,11 @@ static int __amdgpu_ras_restore_bad_pages(struct amdgpu_device *adev, + struct ras_err_handler_data *data = con->eh_data; + + for (j = 0; j < count; j++) { ++ if (!data->space_left && ++ amdgpu_ras_realloc_eh_data_space(adev, data, 256)) { ++ return -ENOMEM; ++ } ++ + if (amdgpu_ras_check_bad_page_unlock(con, + bps[j].retired_page << AMDGPU_GPU_PAGE_SHIFT)) { + data->count++; +@@ -2899,11 +2904,6 @@ static int __amdgpu_ras_restore_bad_pages(struct amdgpu_device *adev, + continue; + } + +- if (!data->space_left && +- amdgpu_ras_realloc_eh_data_space(adev, data, 256)) { +- return -ENOMEM; +- } +- + amdgpu_ras_reserve_page(adev, bps[j].retired_page); + + memcpy(&data->bps[data->count], &(bps[j]), +-- +2.51.0 + diff --git a/queue-6.18/drm-amdgpu-refactor-amdgpu_gem_va_ioctl-for-handling.patch b/queue-6.18/drm-amdgpu-refactor-amdgpu_gem_va_ioctl-for-handling.patch new file mode 100644 index 00000000000..3e70f9731e4 --- /dev/null +++ b/queue-6.18/drm-amdgpu-refactor-amdgpu_gem_va_ioctl-for-handling.patch @@ -0,0 +1,309 @@ +From 19c459956931aa95ed8f02c781f91103a444a8b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 21:25:20 +0530 +Subject: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence + Update and Timeline Management v4 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Srinivasan Shanmugam + +[ Upstream commit bd8150a1b3370a9f7761c5814202a3fe5a79f44f ] + +This commit simplifies the amdgpu_gem_va_ioctl function, key updates +include: + - Moved the logic for managing the last update fence directly into + amdgpu_gem_va_update_vm. + - Introduced checks for the timeline point to enable conditional + replacement or addition of fences. + +v2: Addressed review comments from Christian. +v3: Updated comments (Christian). +v4: The previous version selected the fence too early and did not manage its + reference correctly, which could lead to stale or freed fences being used. + This resulted in refcount underflows and could crash when updating GPU + timelines. + The fence is now chosen only after the VA mapping work is completed, and its + reference is taken safely. After exporting it to the VM timeline syncobj, the + driver always drops its local fence reference, ensuring balanced refcounting + and avoiding use-after-free on dma_fence. + + Crash signature: + [ 205.828135] refcount_t: underflow; use-after-free. + [ 205.832963] WARNING: CPU: 30 PID: 7274 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110 + ... + [ 206.074014] Call Trace: + [ 206.076488] + [ 206.078608] amdgpu_gem_va_ioctl+0x6ea/0x740 [amdgpu] + [ 206.084040] ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu] + [ 206.089994] drm_ioctl_kernel+0x86/0xe0 [drm] + [ 206.094415] drm_ioctl+0x26e/0x520 [drm] + [ 206.098424] ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu] + [ 206.104402] amdgpu_drm_ioctl+0x4b/0x80 [amdgpu] + [ 206.109387] __x64_sys_ioctl+0x96/0xe0 + [ 206.113156] do_syscall_64+0x66/0x2d0 + ... + [ 206.553351] BUG: unable to handle page fault for address: ffffffffc0dfde90 + ... + [ 206.553378] RIP: 0010:dma_fence_signal_timestamp_locked+0x39/0xe0 + ... + [ 206.553405] Call Trace: + [ 206.553409] + [ 206.553415] ? __pfx_drm_sched_fence_free_rcu+0x10/0x10 [gpu_sched] + [ 206.553424] dma_fence_signal+0x30/0x60 + [ 206.553427] drm_sched_job_done.isra.0+0x123/0x150 [gpu_sched] + [ 206.553434] dma_fence_signal_timestamp_locked+0x6e/0xe0 + [ 206.553437] dma_fence_signal+0x30/0x60 + [ 206.553441] amdgpu_fence_process+0xd8/0x150 [amdgpu] + [ 206.553854] sdma_v4_0_process_trap_irq+0x97/0xb0 [amdgpu] + [ 206.554353] edac_mce_amd(E) ee1004(E) + [ 206.554270] amdgpu_irq_dispatch+0x150/0x230 [amdgpu] + [ 206.554702] amdgpu_ih_process+0x6a/0x180 [amdgpu] + [ 206.555101] amdgpu_irq_handler+0x23/0x60 [amdgpu] + [ 206.555500] __handle_irq_event_percpu+0x4a/0x1c0 + [ 206.555506] handle_irq_event+0x38/0x80 + [ 206.555509] handle_edge_irq+0x92/0x1e0 + [ 206.555513] __common_interrupt+0x3e/0xb0 + [ 206.555519] common_interrupt+0x80/0xa0 + [ 206.555525] + [ 206.555527] + ... + [ 206.555650] RIP: 0010:dma_fence_signal_timestamp_locked+0x39/0xe0 + ... + [ 206.555667] Kernel panic - not syncing: Fatal exception in interrupt + +Link: https://patchwork.freedesktop.org/patch/654669/ +Cc: Alex Deucher +Cc: Christian König +Suggested-by: Christian König +Signed-off-by: Srinivasan Shanmugam +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 135 ++++++++++++++---------- + 1 file changed, 82 insertions(+), 53 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c +index b7ebae289beab..b5eb45d2905be 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c +@@ -112,47 +112,6 @@ amdgpu_gem_update_timeline_node(struct drm_file *filp, + return 0; + } + +-static void +-amdgpu_gem_update_bo_mapping(struct drm_file *filp, +- struct amdgpu_bo_va *bo_va, +- uint32_t operation, +- uint64_t point, +- struct dma_fence *fence, +- struct drm_syncobj *syncobj, +- struct dma_fence_chain *chain) +-{ +- struct amdgpu_bo *bo = bo_va ? bo_va->base.bo : NULL; +- struct amdgpu_fpriv *fpriv = filp->driver_priv; +- struct amdgpu_vm *vm = &fpriv->vm; +- struct dma_fence *last_update; +- +- if (!syncobj) +- return; +- +- /* Find the last update fence */ +- switch (operation) { +- case AMDGPU_VA_OP_MAP: +- case AMDGPU_VA_OP_REPLACE: +- if (bo && (bo->tbo.base.resv == vm->root.bo->tbo.base.resv)) +- last_update = vm->last_update; +- else +- last_update = bo_va->last_pt_update; +- break; +- case AMDGPU_VA_OP_UNMAP: +- case AMDGPU_VA_OP_CLEAR: +- last_update = fence; +- break; +- default: +- return; +- } +- +- /* Add fence to timeline */ +- if (!point) +- drm_syncobj_replace_fence(syncobj, last_update); +- else +- drm_syncobj_add_point(syncobj, chain, last_update, point); +-} +- + static vm_fault_t amdgpu_gem_fault(struct vm_fault *vmf) + { + struct ttm_buffer_object *bo = vmf->vma->vm_private_data; +@@ -761,16 +720,19 @@ amdgpu_gem_va_update_vm(struct amdgpu_device *adev, + struct amdgpu_bo_va *bo_va, + uint32_t operation) + { +- struct dma_fence *fence = dma_fence_get_stub(); ++ struct dma_fence *clear_fence = dma_fence_get_stub(); ++ struct dma_fence *last_update = NULL; + int r; + + if (!amdgpu_vm_ready(vm)) +- return fence; ++ return clear_fence; + +- r = amdgpu_vm_clear_freed(adev, vm, &fence); ++ /* First clear freed BOs and get a fence for that work, if any. */ ++ r = amdgpu_vm_clear_freed(adev, vm, &clear_fence); + if (r) + goto error; + ++ /* For MAP/REPLACE we also need to update the BO mappings. */ + if (operation == AMDGPU_VA_OP_MAP || + operation == AMDGPU_VA_OP_REPLACE) { + r = amdgpu_vm_bo_update(adev, bo_va, false); +@@ -778,13 +740,59 @@ amdgpu_gem_va_update_vm(struct amdgpu_device *adev, + goto error; + } + ++ /* Always update PDEs after we touched the mappings. */ + r = amdgpu_vm_update_pdes(adev, vm, false); ++ if (r) ++ goto error; ++ ++ /* ++ * Decide which fence represents the "last update" for this VM/BO: ++ * ++ * - For MAP/REPLACE we want the PT update fence, which is tracked as ++ * either vm->last_update (for always-valid BOs) or bo_va->last_pt_update ++ * (for per-BO updates). ++ * ++ * - For UNMAP/CLEAR we rely on the fence returned by ++ * amdgpu_vm_clear_freed(), which already covers the page table work ++ * for the removed mappings. ++ */ ++ switch (operation) { ++ case AMDGPU_VA_OP_MAP: ++ case AMDGPU_VA_OP_REPLACE: ++ if (bo_va && bo_va->base.bo) { ++ if (amdgpu_vm_is_bo_always_valid(vm, bo_va->base.bo)) { ++ if (vm->last_update) ++ last_update = dma_fence_get(vm->last_update); ++ } else { ++ if (bo_va->last_pt_update) ++ last_update = dma_fence_get(bo_va->last_pt_update); ++ } ++ } ++ break; ++ case AMDGPU_VA_OP_UNMAP: ++ case AMDGPU_VA_OP_CLEAR: ++ if (clear_fence) ++ last_update = dma_fence_get(clear_fence); ++ break; ++ default: ++ break; ++ } + + error: + if (r && r != -ERESTARTSYS) + DRM_ERROR("Couldn't update BO_VA (%d)\n", r); + +- return fence; ++ /* ++ * If we managed to pick a more specific last-update fence, prefer it ++ * over the generic clear_fence and drop the extra reference to the ++ * latter. ++ */ ++ if (last_update) { ++ dma_fence_put(clear_fence); ++ return last_update; ++ } ++ ++ return clear_fence; + } + + int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data, +@@ -810,6 +818,7 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data, + uint64_t vm_size; + int r = 0; + ++ /* Validate virtual address range against reserved regions. */ + if (args->va_address < AMDGPU_VA_RESERVED_BOTTOM) { + dev_dbg(dev->dev, + "va_address 0x%llx is in reserved area 0x%llx\n", +@@ -843,6 +852,7 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data, + return -EINVAL; + } + ++ /* Validate operation type. */ + switch (args->operation) { + case AMDGPU_VA_OP_MAP: + case AMDGPU_VA_OP_UNMAP: +@@ -866,6 +876,7 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data, + abo = NULL; + } + ++ /* Add input syncobj fences (if any) for synchronization. */ + r = amdgpu_gem_add_input_fence(filp, + args->input_fence_syncobj_handles, + args->num_syncobj_handles); +@@ -888,6 +899,7 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data, + goto error; + } + ++ /* Resolve the BO-VA mapping for this VM/BO combination. */ + if (abo) { + bo_va = amdgpu_vm_bo_find(&fpriv->vm, abo); + if (!bo_va) { +@@ -900,6 +912,11 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data, + bo_va = NULL; + } + ++ /* ++ * Prepare the timeline syncobj node if the user requested a VM ++ * timeline update. This only allocates/looks up the syncobj and ++ * chain node; the actual fence is attached later. ++ */ + r = amdgpu_gem_update_timeline_node(filp, + args->vm_timeline_syncobj_out, + args->vm_timeline_point, +@@ -931,18 +948,30 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data, + default: + break; + } ++ ++ /* ++ * Once the VA operation is done, update the VM and obtain the fence ++ * that represents the last relevant update for this mapping. This ++ * fence can then be exported to the user-visible VM timeline. ++ */ + if (!r && !(args->flags & AMDGPU_VM_DELAY_UPDATE) && !adev->debug_vm) { + fence = amdgpu_gem_va_update_vm(adev, &fpriv->vm, bo_va, + args->operation); + +- if (timeline_syncobj) +- amdgpu_gem_update_bo_mapping(filp, bo_va, +- args->operation, +- args->vm_timeline_point, +- fence, timeline_syncobj, +- timeline_chain); +- else +- dma_fence_put(fence); ++ if (timeline_syncobj && fence) { ++ if (!args->vm_timeline_point) { ++ /* Replace the existing fence when no point is given. */ ++ drm_syncobj_replace_fence(timeline_syncobj, ++ fence); ++ } else { ++ /* Attach the last-update fence at a specific point. */ ++ drm_syncobj_add_point(timeline_syncobj, ++ timeline_chain, ++ fence, ++ args->vm_timeline_point); ++ } ++ } ++ dma_fence_put(fence); + + } + +-- +2.51.0 + diff --git a/queue-6.18/drm-amdgpu-return-when-ras-table-checksum-is-error.patch b/queue-6.18/drm-amdgpu-return-when-ras-table-checksum-is-error.patch new file mode 100644 index 00000000000..32fe6f84b6e --- /dev/null +++ b/queue-6.18/drm-amdgpu-return-when-ras-table-checksum-is-error.patch @@ -0,0 +1,41 @@ +From df161060e87ba844ec9f1d673dc80b1c18bb378c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 17:32:00 +0800 +Subject: drm/amdgpu: return when ras table checksum is error + +From: Gangliang Xie + +[ Upstream commit 044f8d3b1fac6ac89c560f61415000e6bdab3a03 ] + +end the function flow when ras table checksum is error + +Signed-off-by: Gangliang Xie +Reviewed-by: Tao Zhou +Reviewed-by: Kent Russell +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c +index 3eb3fb55ccb05..dafa46a9656ca 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c +@@ -1475,10 +1475,12 @@ int amdgpu_ras_eeprom_check(struct amdgpu_ras_eeprom_control *control) + } + + res = __verify_ras_table_checksum(control); +- if (res) ++ if (res) { + dev_err(adev->dev, + "RAS table incorrect checksum or error:%d\n", + res); ++ return -EINVAL; ++ } + + /* Warn if we are at 90% of the threshold or above + */ +-- +2.51.0 + diff --git a/queue-6.18/drm-amdgpu-skip-loading-sdma_rs64-in-vf.patch b/queue-6.18/drm-amdgpu-skip-loading-sdma_rs64-in-vf.patch new file mode 100644 index 00000000000..31fd7794657 --- /dev/null +++ b/queue-6.18/drm-amdgpu-skip-loading-sdma_rs64-in-vf.patch @@ -0,0 +1,35 @@ +From dacbb8dd5ba9a4a579218e10601a00863b880dd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Nov 2025 15:16:27 +0800 +Subject: drm/amdgpu: Skip loading SDMA_RS64 in VF + +From: YuBiao Wang + +[ Upstream commit 39c21b81112321cbe1267b02c77ecd2161ce19aa ] + +VFs use the PF SDMA ucode and are unable to load SDMA_RS64. + +Signed-off-by: YuBiao Wang +Signed-off-by: Victor Skvortsov +Reviewed-by: Gavin Wan +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +index f96beb96c75cc..38183b4f03dfd 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +@@ -972,6 +972,7 @@ bool amdgpu_virt_fw_load_skip_check(struct amdgpu_device *adev, uint32_t ucode_i + || ucode_id == AMDGPU_UCODE_ID_SDMA5 + || ucode_id == AMDGPU_UCODE_ID_SDMA6 + || ucode_id == AMDGPU_UCODE_ID_SDMA7 ++ || ucode_id == AMDGPU_UCODE_ID_SDMA_RS64 + || ucode_id == AMDGPU_UCODE_ID_RLC_G + || ucode_id == AMDGPU_UCODE_ID_RLC_RESTORE_LIST_CNTL + || ucode_id == AMDGPU_UCODE_ID_RLC_RESTORE_LIST_GPM_MEM +-- +2.51.0 + diff --git a/queue-6.18/drm-amdgpu-skip-vcn-poison-irq-release-on-vf.patch b/queue-6.18/drm-amdgpu-skip-vcn-poison-irq-release-on-vf.patch new file mode 100644 index 00000000000..2990cbf8e2b --- /dev/null +++ b/queue-6.18/drm-amdgpu-skip-vcn-poison-irq-release-on-vf.patch @@ -0,0 +1,60 @@ +From acc4d43a037127bb3af6355d902ed0583cf118e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 12:11:49 +0530 +Subject: drm/amdgpu: Skip vcn poison irq release on VF + +From: Lijo Lazar + +[ Upstream commit 8980be03b3f9a4b58197ef95d3b37efa41a25331 ] + +VF doesn't enable VCN poison irq in VCNv2.5. Skip releasing it and avoid +call trace during deinitialization. + +[ 71.913601] [drm] clean up the vf2pf work item +[ 71.915088] ------------[ cut here ]------------ +[ 71.915092] WARNING: CPU: 3 PID: 1079 at /tmp/amd.aFkFvSQl/amd/amdgpu/amdgpu_irq.c:641 amdgpu_irq_put+0xc6/0xe0 [amdgpu] +[ 71.915355] Modules linked in: amdgpu(OE-) amddrm_ttm_helper(OE) amdttm(OE) amddrm_buddy(OE) amdxcp(OE) amddrm_exec(OE) amd_sched(OE) amdkcl(OE) drm_suballoc_helper drm_display_helper cec rc_core i2c_algo_bit video wmi binfmt_misc nls_iso8859_1 intel_rapl_msr intel_rapl_common input_leds joydev serio_raw mac_hid qemu_fw_cfg sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 hid_generic crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic ghash_clmulni_intel usbhid 8139too sha256_ssse3 sha1_ssse3 hid psmouse bochs i2c_i801 ahci drm_vram_helper libahci i2c_smbus lpc_ich drm_ttm_helper 8139cp mii ttm aesni_intel crypto_simd cryptd +[ 71.915484] CPU: 3 PID: 1079 Comm: rmmod Tainted: G OE 6.8.0-87-generic #88~22.04.1-Ubuntu +[ 71.915489] Hardware name: Red Hat KVM/RHEL, BIOS 1.16.3-2.el9_5.1 04/01/2014 +[ 71.915492] RIP: 0010:amdgpu_irq_put+0xc6/0xe0 [amdgpu] +[ 71.915768] Code: 75 84 b8 ea ff ff ff eb d4 44 89 ea 48 89 de 4c 89 e7 e8 fd fc ff ff 5b 41 5c 41 5d 41 5e 5d 31 d2 31 f6 31 ff e9 55 30 3b c7 <0f> 0b eb d4 b8 fe ff ff ff eb a8 e9 b7 3b 8a 00 66 2e 0f 1f 84 00 +[ 71.915771] RSP: 0018:ffffcf0800eafa30 EFLAGS: 00010246 +[ 71.915775] RAX: 0000000000000000 RBX: ffff891bda4b0668 RCX: 0000000000000000 +[ 71.915777] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 +[ 71.915779] RBP: ffffcf0800eafa50 R08: 0000000000000000 R09: 0000000000000000 +[ 71.915781] R10: 0000000000000000 R11: 0000000000000000 R12: ffff891bda480000 +[ 71.915782] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 +[ 71.915792] FS: 000070cff87c4c40(0000) GS:ffff893abfb80000(0000) knlGS:0000000000000000 +[ 71.915795] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 71.915797] CR2: 00005fa13073e478 CR3: 000000010d634006 CR4: 0000000000770ef0 +[ 71.915800] PKRU: 55555554 +[ 71.915802] Call Trace: +[ 71.915805] +[ 71.915809] vcn_v2_5_hw_fini+0x19e/0x1e0 [amdgpu] + +Signed-off-by: Lijo Lazar +Reviewed-by: Mangesh Gadre +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c +index cebee453871c1..006a154511971 100644 +--- a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c ++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c +@@ -521,7 +521,9 @@ static int vcn_v2_5_hw_fini(struct amdgpu_ip_block *ip_block) + RREG32_SOC15(VCN, i, mmUVD_STATUS))) + vinst->set_pg_state(vinst, AMD_PG_STATE_GATE); + +- if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN)) ++ /* VF doesn't enable interrupt operations for RAS */ ++ if (!amdgpu_sriov_vf(adev) && ++ amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN)) + amdgpu_irq_put(adev, &vinst->ras_poison_irq, 0); + } + +-- +2.51.0 + diff --git a/queue-6.18/drm-amdgpu-validate-user-queue-size-constraints.patch b/queue-6.18/drm-amdgpu-validate-user-queue-size-constraints.patch new file mode 100644 index 00000000000..a24a6e46a3c --- /dev/null +++ b/queue-6.18/drm-amdgpu-validate-user-queue-size-constraints.patch @@ -0,0 +1,52 @@ +From 8a62d0aeeb7992f25b04bb9f25d7decaac269f9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 11:35:57 +0800 +Subject: drm/amdgpu: validate user queue size constraints +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jesse.Zhang + +[ Upstream commit 8079b87c02e531cc91601f72ea8336dd2262fdf1 ] + +Add validation to ensure user queue sizes meet hardware requirements: +- Size must be a power of two for efficient ring buffer wrapping +- Size must be at least AMDGPU_GPU_PAGE_SIZE to prevent undersized allocations + +This prevents invalid configurations that could lead to GPU faults or +unexpected behavior. + +Reviewed-by: Christian König +Signed-off-by: Jesse Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c +index 8c41951feb437..eef65833a1c99 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c +@@ -656,6 +656,17 @@ static int amdgpu_userq_input_args_validate(struct drm_device *dev, + drm_file_err(filp, "invalidate userq queue va or size\n"); + return -EINVAL; + } ++ ++ if (!is_power_of_2(args->in.queue_size)) { ++ drm_file_err(filp, "Queue size must be a power of 2\n"); ++ return -EINVAL; ++ } ++ ++ if (args->in.queue_size < AMDGPU_GPU_PAGE_SIZE) { ++ drm_file_err(filp, "Queue size smaller than AMDGPU_GPU_PAGE_SIZE\n"); ++ return -EINVAL; ++ } ++ + if (!args->in.wptr_va || !args->in.rptr_va) { + drm_file_err(filp, "invalidate userq queue rptr or wptr\n"); + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.18/drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch b/queue-6.18/drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch new file mode 100644 index 00000000000..db3411e2ad7 --- /dev/null +++ b/queue-6.18/drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch @@ -0,0 +1,51 @@ +From 6a3e99c5ca1b24981cd0f343a8ea60890dfc2f25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 19:36:56 +0530 +Subject: drm/amdkfd: Fix GART PTE for non-4K pagesize in + svm_migrate_gart_map() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Donet Tom + +[ Upstream commit 6c160001661b6c4e20f5c31909c722741e14c2d8 ] + +In svm_migrate_gart_map(), while migrating GART mapping, the number of +bytes copied for the GART table only accounts for CPU pages. On non-4K +systems, each CPU page can contain multiple GPU pages, and the GART +requires one 8-byte PTE per GPU page. As a result, an incorrect size was +passed to the DMA, causing only a partial update of the GART table. + +Fix this function to work correctly on non-4K page-size systems by +accounting for the number of GPU pages per CPU page when calculating the +number of bytes to be copied. + +Acked-by: Christian König +Reviewed-by: Philip Yang +Signed-off-by: Ritesh Harjani (IBM) +Signed-off-by: Donet Tom +Signed-off-by: Felix Kuehling +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +index 59a5a3fea65df..ea8377071c390 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +@@ -62,7 +62,7 @@ svm_migrate_gart_map(struct amdgpu_ring *ring, u64 npages, + *gart_addr = adev->gmc.gart_start; + + num_dw = ALIGN(adev->mman.buffer_funcs->copy_num_dw, 8); +- num_bytes = npages * 8; ++ num_bytes = npages * 8 * AMDGPU_GPU_PAGES_IN_CPU_PAGE; + + r = amdgpu_job_alloc_with_ib(adev, &adev->mman.high_pr, + AMDGPU_FENCE_OWNER_UNDEFINED, +-- +2.51.0 + diff --git a/queue-6.18/drm-amdkfd-handle-gpu-reset-and-drain-retry-fault-ra.patch b/queue-6.18/drm-amdkfd-handle-gpu-reset-and-drain-retry-fault-ra.patch new file mode 100644 index 00000000000..26b8c42a5b0 --- /dev/null +++ b/queue-6.18/drm-amdkfd-handle-gpu-reset-and-drain-retry-fault-ra.patch @@ -0,0 +1,63 @@ +From 230da7af6b48b2dee8f968f8a9686be910e66d92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 16:32:45 -0500 +Subject: drm/amdkfd: Handle GPU reset and drain retry fault race + +From: Philip Yang + +[ Upstream commit 5b57c3c3f22336e8fd5edb7f0fef3c7823f8eac1 ] + +Only check and drain IH1 ring if CAM is not enabled. + +If GPU is under reset, don't access IH to drain retry fault. + +Signed-off-by: Philip Yang +Reviewed-by: Harish Kasiviswanathan +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +index 49dd0a81114e4..6daa70ace261f 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +@@ -33,6 +33,7 @@ + #include "amdgpu_hmm.h" + #include "amdgpu.h" + #include "amdgpu_xgmi.h" ++#include "amdgpu_reset.h" + #include "kfd_priv.h" + #include "kfd_svm.h" + #include "kfd_migrate.h" +@@ -2343,6 +2344,9 @@ static void svm_range_drain_retry_fault(struct svm_range_list *svms) + + pr_debug("drain retry fault gpu %d svms %p\n", i, svms); + ++ if (!down_read_trylock(&pdd->dev->adev->reset_domain->sem)) ++ continue; ++ + amdgpu_ih_wait_on_checkpoint_process_ts(pdd->dev->adev, + pdd->dev->adev->irq.retry_cam_enabled ? + &pdd->dev->adev->irq.ih : +@@ -2352,6 +2356,7 @@ static void svm_range_drain_retry_fault(struct svm_range_list *svms) + amdgpu_ih_wait_on_checkpoint_process_ts(pdd->dev->adev, + &pdd->dev->adev->irq.ih_soft); + ++ up_read(&pdd->dev->adev->reset_domain->sem); + + pr_debug("drain retry fault gpu %d svms 0x%p done\n", i, svms); + } +@@ -2535,7 +2540,7 @@ svm_range_unmap_from_cpu(struct mm_struct *mm, struct svm_range *prange, + adev = pdd->dev->adev; + + /* Check and drain ih1 ring if cam not available */ +- if (adev->irq.ih1.ring_size) { ++ if (!adev->irq.retry_cam_enabled && adev->irq.ih1.ring_size) { + ih = &adev->irq.ih1; + checkpoint_wptr = amdgpu_ih_get_wptr(adev, ih); + if (ih->rptr != checkpoint_wptr) { +-- +2.51.0 + diff --git a/queue-6.18/drm-amdkfd-relax-size-checking-during-queue-buffer-g.patch b/queue-6.18/drm-amdkfd-relax-size-checking-during-queue-buffer-g.patch new file mode 100644 index 00000000000..df0f8a4c325 --- /dev/null +++ b/queue-6.18/drm-amdkfd-relax-size-checking-during-queue-buffer-g.patch @@ -0,0 +1,61 @@ +From fba3bbde3f178cf15485603921890a6eb810700e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 19:36:54 +0530 +Subject: drm/amdkfd: Relax size checking during queue buffer get +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Donet Tom + +[ Upstream commit 42ea9cf2f16b7131cb7302acb3dac510968f8bdc ] + +HW-supported EOP buffer sizes are 4K and 32K. On systems that do not +use 4K pages, the minimum buffer object (BO) allocation size is +PAGE_SIZE (for example, 64K). During queue buffer acquisition, the driver +currently checks the allocated BO size against the supported EOP buffer +size. Since the allocated BO is larger than the expected size, this check +fails, preventing queue creation. + +Relax the strict size validation and allow PAGE_SIZE-sized BOs to be used. +Only the required 4K region of the buffer will be used as the EOP buffer +and avoids queue creation failures on non-4K page systems. + +Acked-by: Christian König +Suggested-by: Philip Yang +Signed-off-by: Donet Tom +Signed-off-by: Felix Kuehling +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c +index 80c4fa2b0975d..2822c90bd7be4 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c +@@ -275,8 +275,8 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope + + /* EOP buffer is not required for all ASICs */ + if (properties->eop_ring_buffer_address) { +- if (properties->eop_ring_buffer_size != topo_dev->node_props.eop_buffer_size) { +- pr_debug("queue eop bo size 0x%x not equal to node eop buf size 0x%x\n", ++ if (properties->eop_ring_buffer_size < topo_dev->node_props.eop_buffer_size) { ++ pr_debug("queue eop bo size 0x%x is less than node eop buf size 0x%x\n", + properties->eop_ring_buffer_size, + topo_dev->node_props.eop_buffer_size); + err = -EINVAL; +@@ -284,7 +284,7 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope + } + err = kfd_queue_buffer_get(vm, (void *)properties->eop_ring_buffer_address, + &properties->eop_buf_bo, +- properties->eop_ring_buffer_size); ++ ALIGN(properties->eop_ring_buffer_size, PAGE_SIZE)); + if (err) + goto out_err_unreserve; + } +-- +2.51.0 + diff --git a/queue-6.18/drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch b/queue-6.18/drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch new file mode 100644 index 00000000000..e335d941e34 --- /dev/null +++ b/queue-6.18/drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch @@ -0,0 +1,73 @@ +From 3324a75320e413c337d8d6e7b12962540ad27f98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Nov 2025 11:38:25 +0100 +Subject: drm/atmel-hlcdc: don't reject the commit if the src rect has + fractional parts +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ludovic Desroches + +[ Upstream commit 06682206e2a1883354ed758c09efeb51f435adbd ] + +Don’t reject the commit when the source rectangle has fractional parts. +This can occur due to scaling: drm_atomic_helper_check_plane_state() calls +drm_rect_clip_scaled(), which may introduce fractional parts while +computing the clipped source rectangle. This does not imply the commit is +invalid, so we should accept it instead of discarding it. + +Signed-off-by: Ludovic Desroches +Reviewed-by: Manikandan Muralidharan +Link: https://patch.msgid.link/20251120-lcd_scaling_fix-v1-1-5ffc98557923@microchip.com +Signed-off-by: Manikandan Muralidharan +Signed-off-by: Sasha Levin +--- + .../gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 19 ++++--------------- + 1 file changed, 4 insertions(+), 15 deletions(-) + +diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +index 410ec747cc7e0..caf6deda717ce 100644 +--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c ++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +@@ -78,8 +78,6 @@ drm_plane_state_to_atmel_hlcdc_plane_state(struct drm_plane_state *s) + return container_of(s, struct atmel_hlcdc_plane_state, base); + } + +-#define SUBPIXEL_MASK 0xffff +- + static uint32_t rgb_formats[] = { + DRM_FORMAT_C8, + DRM_FORMAT_XRGB4444, +@@ -744,24 +742,15 @@ static int atmel_hlcdc_plane_atomic_check(struct drm_plane *p, + if (ret || !s->visible) + return ret; + +- hstate->src_x = s->src.x1; +- hstate->src_y = s->src.y1; +- hstate->src_w = drm_rect_width(&s->src); +- hstate->src_h = drm_rect_height(&s->src); ++ hstate->src_x = s->src.x1 >> 16; ++ hstate->src_y = s->src.y1 >> 16; ++ hstate->src_w = drm_rect_width(&s->src) >> 16; ++ hstate->src_h = drm_rect_height(&s->src) >> 16; + hstate->crtc_x = s->dst.x1; + hstate->crtc_y = s->dst.y1; + hstate->crtc_w = drm_rect_width(&s->dst); + hstate->crtc_h = drm_rect_height(&s->dst); + +- if ((hstate->src_x | hstate->src_y | hstate->src_w | hstate->src_h) & +- SUBPIXEL_MASK) +- return -EINVAL; +- +- hstate->src_x >>= 16; +- hstate->src_y >>= 16; +- hstate->src_w >>= 16; +- hstate->src_h >>= 16; +- + hstate->nplanes = fb->format->num_planes; + if (hstate->nplanes > ATMEL_HLCDC_LAYER_MAX_PLANES) + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.18/drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch b/queue-6.18/drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch new file mode 100644 index 00000000000..45cceb38d4e --- /dev/null +++ b/queue-6.18/drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch @@ -0,0 +1,61 @@ +From 04e70a36b92dcdde49de922397eda328a0309135 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Oct 2025 18:14:52 +0200 +Subject: drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state + callback + +From: Ludovic Desroches + +[ Upstream commit f12352471061df83a36edf54bbb16284793284e4 ] + +After several commits, the slab memory increases. Some drm_crtc_commit +objects are not freed. The atomic_destroy_state callback only put the +framebuffer. Use the __drm_atomic_helper_plane_destroy_state() function +to put all the objects that are no longer needed. + +It has been seen after hours of usage of a graphics application or using +kmemleak: + +unreferenced object 0xc63a6580 (size 64): + comm "egt_basic", pid 171, jiffies 4294940784 + hex dump (first 32 bytes): + 40 50 34 c5 01 00 00 00 ff ff ff ff 8c 65 3a c6 @P4..........e:. + 8c 65 3a c6 ff ff ff ff 98 65 3a c6 98 65 3a c6 .e:......e:..e:. + backtrace (crc c25aa925): + kmemleak_alloc+0x34/0x3c + __kmalloc_cache_noprof+0x150/0x1a4 + drm_atomic_helper_setup_commit+0x1e8/0x7bc + drm_atomic_helper_commit+0x3c/0x15c + drm_atomic_commit+0xc0/0xf4 + drm_atomic_helper_set_config+0x84/0xb8 + drm_mode_setcrtc+0x32c/0x810 + drm_ioctl+0x20c/0x488 + sys_ioctl+0x14c/0xc20 + ret_fast_syscall+0x0/0x54 + +Signed-off-by: Ludovic Desroches +Reviewed-by: Manikandan Muralidharan +Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-1-79b615130dc3@microchip.com +Signed-off-by: Manikandan Muralidharan +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +index 3787db014501e..410ec747cc7e0 100644 +--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c ++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +@@ -1204,8 +1204,7 @@ static void atmel_hlcdc_plane_atomic_destroy_state(struct drm_plane *p, + state->dscrs[i]->self); + } + +- if (s->fb) +- drm_framebuffer_put(s->fb); ++ __drm_atomic_helper_plane_destroy_state(s); + + kfree(state); + } +-- +2.51.0 + diff --git a/queue-6.18/drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch b/queue-6.18/drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch new file mode 100644 index 00000000000..c03042c508a --- /dev/null +++ b/queue-6.18/drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch @@ -0,0 +1,81 @@ +From d70859a81d7a03cb97d8b163c781f02040ed3591 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Oct 2025 18:14:53 +0200 +Subject: drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release + +From: Ludovic Desroches + +[ Upstream commit bc847787233277a337788568e90a6ee1557595eb ] + +The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying +the atmel_hlcdc_plane state structure without properly duplicating the +drm_plane_state. In particular, state->commit remained set to the old +state commit, which can lead to a use-after-free in the next +drm_atomic_commit() call. + +Fix this by calling +__drm_atomic_helper_duplicate_plane_state(), which correctly clones +the base drm_plane_state (including the ->commit pointer). + +It has been seen when closing and re-opening the device node while +another DRM client (e.g. fbdev) is still attached: + +============================================================================= +BUG kmalloc-64 (Not tainted): Poison overwritten +----------------------------------------------------------------------------- + +0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b +FIX kmalloc-64: Restoring Poison 0xc611b344-0xc611b344=0x6b +Allocated in drm_atomic_helper_setup_commit+0x1e8/0x7bc age=178 cpu=0 +pid=29 + drm_atomic_helper_setup_commit+0x1e8/0x7bc + drm_atomic_helper_commit+0x3c/0x15c + drm_atomic_commit+0xc0/0xf4 + drm_framebuffer_remove+0x4cc/0x5a8 + drm_mode_rmfb_work_fn+0x6c/0x80 + process_one_work+0x12c/0x2cc + worker_thread+0x2a8/0x400 + kthread+0xc0/0xdc + ret_from_fork+0x14/0x28 +Freed in drm_atomic_helper_commit_hw_done+0x100/0x150 age=8 cpu=0 +pid=169 + drm_atomic_helper_commit_hw_done+0x100/0x150 + drm_atomic_helper_commit_tail+0x64/0x8c + commit_tail+0x168/0x18c + drm_atomic_helper_commit+0x138/0x15c + drm_atomic_commit+0xc0/0xf4 + drm_atomic_helper_set_config+0x84/0xb8 + drm_mode_setcrtc+0x32c/0x810 + drm_ioctl+0x20c/0x488 + sys_ioctl+0x14c/0xc20 + ret_fast_syscall+0x0/0x54 +Slab 0xef8bc360 objects=21 used=16 fp=0xc611b7c0 +flags=0x200(workingset|zone=0) +Object 0xc611b340 @offset=832 fp=0xc611b7c0 + +Signed-off-by: Ludovic Desroches +Reviewed-by: Manikandan Muralidharan +Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-2-79b615130dc3@microchip.com +Signed-off-by: Manikandan Muralidharan +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +index caf6deda717ce..ae8d7b017968d 100644 +--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c ++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +@@ -1174,8 +1174,7 @@ atmel_hlcdc_plane_atomic_duplicate_state(struct drm_plane *p) + return NULL; + } + +- if (copy->base.fb) +- drm_framebuffer_get(copy->base.fb); ++ __drm_atomic_helper_plane_duplicate_state(p, ©->base); + + return ©->base; + } +-- +2.51.0 + diff --git a/queue-6.18/drm-display-dp_mst-add-protection-against-0-vcpi.patch b/queue-6.18/drm-display-dp_mst-add-protection-against-0-vcpi.patch new file mode 100644 index 00000000000..9f38831836c --- /dev/null +++ b/queue-6.18/drm-display-dp_mst-add-protection-against-0-vcpi.patch @@ -0,0 +1,96 @@ +From 3d20fad597eda2a098f2820a115ac93d1b248e02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 15:16:50 +0530 +Subject: drm/display/dp_mst: Add protection against 0 vcpi + +From: Suraj Kandpal + +[ Upstream commit 342ccffd9f77fc29fe1c05fd145e4d842bd2feaa ] + +When releasing a timeslot there is a slight chance we may end up +with the wrong payload mask due to overflow if the delayed_destroy_work +ends up coming into play after a DP 2.1 monitor gets disconnected +which causes vcpi to become 0 then we try to make the payload = +~BIT(vcpi - 1) which is a negative shift. VCPI id should never +really be 0 hence skip changing the payload mask if VCPI is 0. + +Otherwise it leads to +<7> [515.287237] xe 0000:03:00.0: [drm:drm_dp_mst_get_port_malloc +[drm_display_helper]] port ffff888126ce9000 (3) +<4> [515.287267] -----------[ cut here ]----------- +<3> [515.287268] UBSAN: shift-out-of-bounds in +../drivers/gpu/drm/display/drm_dp_mst_topology.c:4575:36 +<3> [515.287271] shift exponent -1 is negative +<4> [515.287275] CPU: 7 UID: 0 PID: 3108 Comm: kworker/u64:33 Tainted: G +S U 6.17.0-rc6-lgci-xe-xe-3795-3e79699fa1b216e92+ #1 PREEMPT(voluntary) +<4> [515.287279] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER +<4> [515.287279] Hardware name: ASUS System Product Name/PRIME Z790-P +WIFI, BIOS 1645 03/15/2024 +<4> [515.287281] Workqueue: drm_dp_mst_wq drm_dp_delayed_destroy_work +[drm_display_helper] +<4> [515.287303] Call Trace: +<4> [515.287304] +<4> [515.287306] dump_stack_lvl+0xc1/0xf0 +<4> [515.287313] dump_stack+0x10/0x20 +<4> [515.287316] __ubsan_handle_shift_out_of_bounds+0x133/0x2e0 +<4> [515.287324] ? drm_atomic_get_private_obj_state+0x186/0x1d0 +<4> [515.287333] drm_dp_atomic_release_time_slots.cold+0x17/0x3d +[drm_display_helper] +<4> [515.287355] mst_connector_atomic_check+0x159/0x180 [xe] +<4> [515.287546] drm_atomic_helper_check_modeset+0x4d9/0xfa0 +<4> [515.287550] ? __ww_mutex_lock.constprop.0+0x6f/0x1a60 +<4> [515.287562] intel_atomic_check+0x119/0x2b80 [xe] +<4> [515.287740] ? find_held_lock+0x31/0x90 +<4> [515.287747] ? lock_release+0xce/0x2a0 +<4> [515.287754] drm_atomic_check_only+0x6a2/0xb40 +<4> [515.287758] ? drm_atomic_add_affected_connectors+0x12b/0x140 +<4> [515.287765] drm_atomic_commit+0x6e/0xf0 +<4> [515.287766] ? _pfx__drm_printfn_info+0x10/0x10 +<4> [515.287774] drm_client_modeset_commit_atomic+0x25c/0x2b0 +<4> [515.287794] drm_client_modeset_commit_locked+0x60/0x1b0 +<4> [515.287795] ? mutex_lock_nested+0x1b/0x30 +<4> [515.287801] drm_client_modeset_commit+0x26/0x50 +<4> [515.287804] __drm_fb_helper_restore_fbdev_mode_unlocked+0xdc/0x110 +<4> [515.287810] drm_fb_helper_hotplug_event+0x120/0x140 +<4> [515.287814] drm_fbdev_client_hotplug+0x28/0xd0 +<4> [515.287819] drm_client_hotplug+0x6c/0xf0 +<4> [515.287824] drm_client_dev_hotplug+0x9e/0xd0 +<4> [515.287829] drm_kms_helper_hotplug_event+0x1a/0x30 +<4> [515.287834] drm_dp_delayed_destroy_work+0x3df/0x410 +[drm_display_helper] +<4> [515.287861] process_one_work+0x22b/0x6f0 +<4> [515.287874] worker_thread+0x1e8/0x3d0 +<4> [515.287879] ? __pfx_worker_thread+0x10/0x10 +<4> [515.287882] kthread+0x11c/0x250 +<4> [515.287886] ? __pfx_kthread+0x10/0x10 +<4> [515.287890] ret_from_fork+0x2d7/0x310 +<4> [515.287894] ? __pfx_kthread+0x10/0x10 +<4> [515.287897] ret_from_fork_asm+0x1a/0x30 + +Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6303 +Signed-off-by: Suraj Kandpal +Reviewed-by: Imre Deak +Reviewed-by: Lyude Paul +Link: https://patch.msgid.link/20251119094650.799135-1-suraj.kandpal@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/display/drm_dp_mst_topology.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c +index 64e5c176d5cce..be749dcad3b58 100644 +--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c +@@ -4572,7 +4572,8 @@ int drm_dp_atomic_release_time_slots(struct drm_atomic_state *state, + if (!payload->delete) { + payload->pbn = 0; + payload->delete = true; +- topology_state->payload_mask &= ~BIT(payload->vcpi - 1); ++ if (payload->vcpi > 0) ++ topology_state->payload_mask &= ~BIT(payload->vcpi - 1); + } + + return 0; +-- +2.51.0 + diff --git a/queue-6.18/drm-panel-edp-add-auo-b140qax01.h-panel.patch b/queue-6.18/drm-panel-edp-add-auo-b140qax01.h-panel.patch new file mode 100644 index 00000000000..acca8c55cb2 --- /dev/null +++ b/queue-6.18/drm-panel-edp-add-auo-b140qax01.h-panel.patch @@ -0,0 +1,52 @@ +From 96866ce621461874bd969d7402258e1a33e46896 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Dec 2025 14:37:28 -0300 +Subject: drm/panel-edp: Add AUO B140QAX01.H panel + +From: Val Packett + +[ Upstream commit bcd752c706c357229185a330ab450b86236d9031 ] + +A 14-inch 2560x1600 60Hz matte touch panel, found on a Dell Latitude 7455 +laptop (second-source with BOE NE14QDM), according to online sources it's +also found on the Latitude 7440 and some ASUS models. + +Raw EDID dump: + +00 ff ff ff ff ff ff 00 06 af a4 0b 00 00 00 00 +00 20 01 04 a5 1e 13 78 03 ad f5 a8 54 47 9c 24 +0e 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 +01 01 01 01 01 01 f0 68 00 a0 a0 40 2e 60 30 20 +35 00 2d bc 10 00 00 1a f3 53 00 a0 a0 40 2e 60 +30 20 35 00 2d bc 10 00 00 1a 00 00 00 fe 00 36 +39 52 31 57 80 42 31 34 30 51 41 58 00 00 00 00 +00 02 41 21 a8 00 01 00 00 1a 41 0a 20 20 00 a1 + +Don't have datasheet access, but the same timing as for other panels from +the same manufacturer works fine. + +Signed-off-by: Val Packett +[dianders: Moved to the right location in the table] +Reviewed-by: Douglas Anderson +Signed-off-by: Douglas Anderson +Link: https://patch.msgid.link/20251206173739.2222940-1-val@packett.cool +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-edp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c +index aad5838cd700a..6a8a4ebc91e21 100644 +--- a/drivers/gpu/drm/panel/panel-edp.c ++++ b/drivers/gpu/drm/panel/panel-edp.c +@@ -1880,6 +1880,7 @@ static const struct panel_delay delay_80_500_e50_d50 = { + */ + static const struct edp_panel_entry edp_panels[] = { + EDP_PANEL_ENTRY('A', 'U', 'O', 0x04a4, &delay_200_500_e50, "B122UAN01.0"), ++ EDP_PANEL_ENTRY('A', 'U', 'O', 0x0ba4, &delay_200_500_e50, "B140QAX01.H"), + EDP_PANEL_ENTRY('A', 'U', 'O', 0x105c, &delay_200_500_e50, "B116XTN01.0"), + EDP_PANEL_ENTRY('A', 'U', 'O', 0x1062, &delay_200_500_e50, "B120XAN01.0"), + EDP_PANEL_ENTRY('A', 'U', 'O', 0x125c, &delay_200_500_e50, "Unknown"), +-- +2.51.0 + diff --git a/queue-6.18/drm-panel-edp-add-boe-nv140wum-t08-panel.patch b/queue-6.18/drm-panel-edp-add-boe-nv140wum-t08-panel.patch new file mode 100644 index 00000000000..3531941278f --- /dev/null +++ b/queue-6.18/drm-panel-edp-add-boe-nv140wum-t08-panel.patch @@ -0,0 +1,60 @@ +From 3216e0a61f3969edfcb15be1ccf1e07b5170ec39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 16:51:34 +0100 +Subject: drm/panel: edp: add BOE NV140WUM-T08 panel + +From: Hans de Goede + +[ Upstream commit 349d4efadc1f831ebc0b872ba1e3a2b7dd58b72b ] + +Add powerseq timing info for the BOE NV140WUM-T08 panel used on Lenovo +Thinkpad T14s gen 6 (Snapdragon X1 Elite) laptops. + +edid-decode (hex): + +00 ff ff ff ff ff ff 00 09 e5 26 0c 00 00 00 00 +0a 21 01 04 a5 1e 13 78 03 d6 62 99 5e 5a 8e 27 +25 53 58 00 00 00 01 01 01 01 01 01 01 01 01 01 +01 01 01 01 01 01 33 3f 80 dc 70 b0 3c 40 30 20 +36 00 2e bc 10 00 00 1a 00 00 00 fd 00 28 3c 4c +4c 10 01 0a 20 20 20 20 20 20 00 00 00 fe 00 42 +4f 45 20 43 51 0a 20 20 20 20 20 20 00 00 00 fe +00 4e 56 31 34 30 57 55 4d 2d 54 30 38 0a 00 fa + +Signed-off-by: Hans de Goede +Reviewed-by: Douglas Anderson +Signed-off-by: Douglas Anderson +Link: https://patch.msgid.link/20260105155134.83266-1-johannes.goede@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-edp.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c +index 6a8a4ebc91e21..d1e68c464e308 100644 +--- a/drivers/gpu/drm/panel/panel-edp.c ++++ b/drivers/gpu/drm/panel/panel-edp.c +@@ -1730,6 +1730,12 @@ static const struct panel_delay delay_200_500_p2e100 = { + .prepare_to_enable = 100, + }; + ++static const struct panel_delay delay_200_500_p2e200 = { ++ .hpd_absent = 200, ++ .unprepare = 500, ++ .prepare_to_enable = 200, ++}; ++ + static const struct panel_delay delay_200_500_e50 = { + .hpd_absent = 200, + .unprepare = 500, +@@ -1974,6 +1980,7 @@ static const struct edp_panel_entry edp_panels[] = { + EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b56, &delay_200_500_e80, "NT140FHM-N47"), + EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b66, &delay_200_500_e80, "NE140WUM-N6G"), + EDP_PANEL_ENTRY('B', 'O', 'E', 0x0c20, &delay_200_500_e80, "NT140FHM-N47"), ++ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0c26, &delay_200_500_p2e200, "NV140WUM-T08"), + EDP_PANEL_ENTRY('B', 'O', 'E', 0x0c93, &delay_200_500_e200, "Unknown"), + EDP_PANEL_ENTRY('B', 'O', 'E', 0x0cb6, &delay_200_500_e200, "NT116WHM-N44"), + EDP_PANEL_ENTRY('B', 'O', 'E', 0x0cf6, &delay_200_500_e200, "NV140WUM-N64"), +-- +2.51.0 + diff --git a/queue-6.18/drm-panel-fix-a-possible-null-pointer-dereference-in.patch b/queue-6.18/drm-panel-fix-a-possible-null-pointer-dereference-in.patch new file mode 100644 index 00000000000..e21064c88c5 --- /dev/null +++ b/queue-6.18/drm-panel-fix-a-possible-null-pointer-dereference-in.patch @@ -0,0 +1,58 @@ +From 5c4bbe7d434972032942d64458182648b4a6b8a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Dec 2025 20:09:55 +0800 +Subject: drm/panel: Fix a possible null-pointer dereference in + jdi_panel_dsi_remove() + +From: Tuo Li + +[ Upstream commit 95eed73b871111123a8b1d31cb1fce7e902e49ea ] + +In jdi_panel_dsi_remove(), jdi is explicitly checked, indicating that it +may be NULL: + + if (!jdi) + mipi_dsi_detach(dsi); + +However, when jdi is NULL, the function does not return and continues by +calling jdi_panel_disable(): + + err = jdi_panel_disable(&jdi->base); + +Inside jdi_panel_disable(), jdi is dereferenced unconditionally, which can +lead to a NULL-pointer dereference: + + struct jdi_panel *jdi = to_panel_jdi(panel); + backlight_disable(jdi->backlight); + +To prevent such a potential NULL-pointer dereference, return early from +jdi_panel_dsi_remove() when jdi is NULL. + +Signed-off-by: Tuo Li +Reviewed-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://patch.msgid.link/20251218120955.11185-1-islituo@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c b/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c +index 23462065d726b..ea975170fafff 100644 +--- a/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c ++++ b/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c +@@ -434,8 +434,10 @@ static void jdi_panel_dsi_remove(struct mipi_dsi_device *dsi) + int err; + + /* only detach from host for the DSI-LINK2 interface */ +- if (!jdi) ++ if (!jdi) { + mipi_dsi_detach(dsi); ++ return; ++ } + + err = jdi_panel_disable(&jdi->base); + if (err < 0) +-- +2.51.0 + diff --git a/queue-6.18/drm-panthor-always-wait-after-sending-a-command-to-a.patch b/queue-6.18/drm-panthor-always-wait-after-sending-a-command-to-a.patch new file mode 100644 index 00000000000..e76b6634e2f --- /dev/null +++ b/queue-6.18/drm-panthor-always-wait-after-sending-a-command-to-a.patch @@ -0,0 +1,124 @@ +From cc45049654faa19b033d0c6739e54312bbfbb345 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Nov 2025 09:48:35 +0100 +Subject: drm/panthor: Always wait after sending a command to an AS + +From: Boris Brezillon + +[ Upstream commit d2c6fde56d451ca48a5e03428535ce3dbc8fc910 ] + +There's currently no situation where we want to issue a command to an +AS and not wait for this command to complete. The wait is either +explicitly done (LOCK, UNLOCK) or it's missing (UPDATE). So let's +turn write_cmd() into as_send_cmd_and_wait() that has the wait after +a command is sent. + +v2: +- New patch + +v3: +- Collect R-b + +v4: +- No changes + +Reviewed-by: Steven Price +Link: https://patch.msgid.link/20251128084841.3804658-2-boris.brezillon@collabora.com +Signed-off-by: Boris Brezillon +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panthor/panthor_mmu.c | 27 ++++++++++++--------------- + 1 file changed, 12 insertions(+), 15 deletions(-) + +diff --git a/drivers/gpu/drm/panthor/panthor_mmu.c b/drivers/gpu/drm/panthor/panthor_mmu.c +index 0fd8ffec92dd0..5647a24741095 100644 +--- a/drivers/gpu/drm/panthor/panthor_mmu.c ++++ b/drivers/gpu/drm/panthor/panthor_mmu.c +@@ -523,27 +523,29 @@ static int wait_ready(struct panthor_device *ptdev, u32 as_nr) + return ret; + } + +-static int write_cmd(struct panthor_device *ptdev, u32 as_nr, u32 cmd) ++static int as_send_cmd_and_wait(struct panthor_device *ptdev, u32 as_nr, u32 cmd) + { + int status; + + /* write AS_COMMAND when MMU is ready to accept another command */ + status = wait_ready(ptdev, as_nr); +- if (!status) ++ if (!status) { + gpu_write(ptdev, AS_COMMAND(as_nr), cmd); ++ status = wait_ready(ptdev, as_nr); ++ } + + return status; + } + +-static void lock_region(struct panthor_device *ptdev, u32 as_nr, +- u64 region_start, u64 size) ++static int lock_region(struct panthor_device *ptdev, u32 as_nr, ++ u64 region_start, u64 size) + { + u8 region_width; + u64 region; + u64 region_end = region_start + size; + + if (!size) +- return; ++ return 0; + + /* + * The locked region is a naturally aligned power of 2 block encoded as +@@ -566,7 +568,7 @@ static void lock_region(struct panthor_device *ptdev, u32 as_nr, + + /* Lock the region that needs to be updated */ + gpu_write64(ptdev, AS_LOCKADDR(as_nr), region); +- write_cmd(ptdev, as_nr, AS_COMMAND_LOCK); ++ return as_send_cmd_and_wait(ptdev, as_nr, AS_COMMAND_LOCK); + } + + static int mmu_hw_do_operation_locked(struct panthor_device *ptdev, int as_nr, +@@ -599,9 +601,7 @@ static int mmu_hw_do_operation_locked(struct panthor_device *ptdev, int as_nr, + * power it up + */ + +- lock_region(ptdev, as_nr, iova, size); +- +- ret = wait_ready(ptdev, as_nr); ++ ret = lock_region(ptdev, as_nr, iova, size); + if (ret) + return ret; + +@@ -614,10 +614,7 @@ static int mmu_hw_do_operation_locked(struct panthor_device *ptdev, int as_nr, + * at the end of the GPU_CONTROL cache flush command, unlike + * AS_COMMAND_FLUSH_MEM or AS_COMMAND_FLUSH_PT. + */ +- write_cmd(ptdev, as_nr, AS_COMMAND_UNLOCK); +- +- /* Wait for the unlock command to complete */ +- return wait_ready(ptdev, as_nr); ++ return as_send_cmd_and_wait(ptdev, as_nr, AS_COMMAND_UNLOCK); + } + + static int mmu_hw_do_operation(struct panthor_vm *vm, +@@ -646,7 +643,7 @@ static int panthor_mmu_as_enable(struct panthor_device *ptdev, u32 as_nr, + gpu_write64(ptdev, AS_MEMATTR(as_nr), memattr); + gpu_write64(ptdev, AS_TRANSCFG(as_nr), transcfg); + +- return write_cmd(ptdev, as_nr, AS_COMMAND_UPDATE); ++ return as_send_cmd_and_wait(ptdev, as_nr, AS_COMMAND_UPDATE); + } + + static int panthor_mmu_as_disable(struct panthor_device *ptdev, u32 as_nr) +@@ -661,7 +658,7 @@ static int panthor_mmu_as_disable(struct panthor_device *ptdev, u32 as_nr) + gpu_write64(ptdev, AS_MEMATTR(as_nr), 0); + gpu_write64(ptdev, AS_TRANSCFG(as_nr), AS_TRANSCFG_ADRMODE_UNMAPPED); + +- return write_cmd(ptdev, as_nr, AS_COMMAND_UPDATE); ++ return as_send_cmd_and_wait(ptdev, as_nr, AS_COMMAND_UPDATE); + } + + static u32 panthor_mmu_fault_mask(struct panthor_device *ptdev, u32 value) +-- +2.51.0 + diff --git a/queue-6.18/drm-radeon-add-hainan-clock-adjustment.patch b/queue-6.18/drm-radeon-add-hainan-clock-adjustment.patch new file mode 100644 index 00000000000..6931b298a19 --- /dev/null +++ b/queue-6.18/drm-radeon-add-hainan-clock-adjustment.patch @@ -0,0 +1,39 @@ +From e15cd347a67358bb60f7a33e82656b684f78ab10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Feb 2026 07:26:00 +0000 +Subject: drm/radeon: Add HAINAN clock adjustment + +From: decce6 + +[ Upstream commit 908d318f23d6b5d625bea093c5fc056238cdb7ff ] + +This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from +850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This +patch is for radeon. + +Signed-off-by: decce6 +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/si_dpm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c +index 9deb91970d4df..f12227145ef08 100644 +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -2925,6 +2925,11 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev, + max_sclk = 60000; + max_mclk = 80000; + } ++ if ((rdev->pdev->device == 0x666f) && ++ (rdev->pdev->revision == 0x00)) { ++ max_sclk = 80000; ++ max_mclk = 95000; ++ } + } else if (rdev->family == CHIP_OLAND) { + if ((rdev->pdev->revision == 0xC7) || + (rdev->pdev->revision == 0x80) || +-- +2.51.0 + diff --git a/queue-6.18/drm-renesas-rz-du-mipi_dsi-fix-kernel-panic-when-reb.patch b/queue-6.18/drm-renesas-rz-du-mipi_dsi-fix-kernel-panic-when-reb.patch new file mode 100644 index 00000000000..3e7b628fee0 --- /dev/null +++ b/queue-6.18/drm-renesas-rz-du-mipi_dsi-fix-kernel-panic-when-reb.patch @@ -0,0 +1,79 @@ +From 1c8eb40a6557880c37cafa9d6b0917ccb6efa1ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 10:43:18 -0500 +Subject: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for + some panels + +From: Hugo Villeneuve + +[ Upstream commit 64aa8b3a60a825134f7d866adf05c024bbe0c24c ] + +Since commit 56de5e305d4b ("clk: renesas: r9a07g044: Add MSTOP for RZ/G2L") +we may get the following kernel panic, for some panels, when rebooting: + + systemd-shutdown[1]: Rebooting. + Call trace: + ... + do_serror+0x28/0x68 + el1h_64_error_handler+0x34/0x50 + el1h_64_error+0x6c/0x70 + rzg2l_mipi_dsi_host_transfer+0x114/0x458 (P) + mipi_dsi_device_transfer+0x44/0x58 + mipi_dsi_dcs_set_display_off_multi+0x9c/0xc4 + ili9881c_unprepare+0x38/0x88 + drm_panel_unprepare+0xbc/0x108 + +This happens for panels that need to send MIPI-DSI commands in their +unprepare() callback. Since the MIPI-DSI interface is stopped at that +point, rzg2l_mipi_dsi_host_transfer() triggers the kernel panic. + +Fix by moving rzg2l_mipi_dsi_stop() to new callback function +rzg2l_mipi_dsi_atomic_post_disable(). + +With this change we now have the correct power-down/stop sequence: + + systemd-shutdown[1]: Rebooting. + rzg2l-mipi-dsi 10850000.dsi: rzg2l_mipi_dsi_atomic_disable(): entry + ili9881c-dsi 10850000.dsi.0: ili9881c_unprepare(): entry + rzg2l-mipi-dsi 10850000.dsi: rzg2l_mipi_dsi_atomic_post_disable(): entry + reboot: Restarting system + +Suggested-by: Biju Das +Signed-off-by: Hugo Villeneuve +Tested-by: Biju Das +Link: https://patch.msgid.link/20260112154333.655352-1-hugo@hugovil.com +Signed-off-by: Biju Das +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c b/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c +index 3b52dfc0ea1e0..b164e3a62cc2f 100644 +--- a/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c ++++ b/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c +@@ -646,6 +646,13 @@ static void rzg2l_mipi_dsi_atomic_disable(struct drm_bridge *bridge, + + rzg2l_mipi_dsi_stop_video(dsi); + rzg2l_mipi_dsi_stop_hs_clock(dsi); ++} ++ ++static void rzg2l_mipi_dsi_atomic_post_disable(struct drm_bridge *bridge, ++ struct drm_atomic_state *state) ++{ ++ struct rzg2l_mipi_dsi *dsi = bridge_to_rzg2l_mipi_dsi(bridge); ++ + rzg2l_mipi_dsi_stop(dsi); + } + +@@ -681,6 +688,7 @@ static const struct drm_bridge_funcs rzg2l_mipi_dsi_bridge_ops = { + .atomic_pre_enable = rzg2l_mipi_dsi_atomic_pre_enable, + .atomic_enable = rzg2l_mipi_dsi_atomic_enable, + .atomic_disable = rzg2l_mipi_dsi_atomic_disable, ++ .atomic_post_disable = rzg2l_mipi_dsi_atomic_post_disable, + .mode_valid = rzg2l_mipi_dsi_bridge_mode_valid, + }; + +-- +2.51.0 + diff --git a/queue-6.18/drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch b/queue-6.18/drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch new file mode 100644 index 00000000000..0fef95ca233 --- /dev/null +++ b/queue-6.18/drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch @@ -0,0 +1,71 @@ +From a5ef082e9f0a036104c2c9d1bc35830ff2ea7711 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Dec 2025 21:03:23 +0800 +Subject: drm/v3d: Set DMA segment size to avoid debug warnings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Xiaolei Wang + +[ Upstream commit 9eb018828b1b30dfba689c060735c50fc5b9f704 ] + +When using V3D rendering with CONFIG_DMA_API_DEBUG enabled, the +kernel occasionally reports a segment size mismatch. This is because +'max_seg_size' is not set. The kernel defaults to 64K. setting +'max_seg_size' to the maximum will prevent 'debug_dma_map_sg()' +from complaining about the over-mapping of the V3D segment length. + +DMA-API: v3d 1002000000.v3d: mapping sg segment longer than device + claims to support [len=8290304] [max=65536] +WARNING: CPU: 0 PID: 493 at kernel/dma/debug.c:1179 debug_dma_map_sg+0x330/0x388 +CPU: 0 UID: 0 PID: 493 Comm: Xorg Not tainted 6.12.53-yocto-standard #1 +Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT) +pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : debug_dma_map_sg+0x330/0x388 +lr : debug_dma_map_sg+0x330/0x388 +sp : ffff8000829a3ac0 +x29: ffff8000829a3ac0 x28: 0000000000000001 x27: ffff8000813fe000 +x26: ffffc1ffc0000000 x25: ffff00010fdeb760 x24: 0000000000000000 +x23: ffff8000816a9bf0 x22: 0000000000000001 x21: 0000000000000002 +x20: 0000000000000002 x19: ffff00010185e810 x18: ffffffffffffffff +x17: 69766564206e6168 x16: 74207265676e6f6c x15: 20746e656d676573 +x14: 20677320676e6970 x13: 5d34303334393134 x12: 0000000000000000 +x11: 00000000000000c0 x10: 00000000000009c0 x9 : ffff8000800e0b7c +x8 : ffff00010a315ca0 x7 : ffff8000816a5110 x6 : 0000000000000001 +x5 : 000000000000002b x4 : 0000000000000002 x3 : 0000000000000008 +x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00010a315280 +Call trace: + debug_dma_map_sg+0x330/0x388 + __dma_map_sg_attrs+0xc0/0x278 + dma_map_sgtable+0x30/0x58 + drm_gem_shmem_get_pages_sgt+0xb4/0x140 + v3d_bo_create_finish+0x28/0x130 [v3d] + v3d_create_bo_ioctl+0x54/0x180 [v3d] + drm_ioctl_kernel+0xc8/0x140 + drm_ioctl+0x2d4/0x4d8 + +Signed-off-by: Xiaolei Wang +Link: https://patch.msgid.link/20251203130323.2247072-1-xiaolei.wang@windriver.com +Signed-off-by: Maíra Canal +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/v3d/v3d_drv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c +index c5a3bbbc74c5c..f4da7a94e4016 100644 +--- a/drivers/gpu/drm/v3d/v3d_drv.c ++++ b/drivers/gpu/drm/v3d/v3d_drv.c +@@ -377,6 +377,8 @@ static int v3d_platform_drm_probe(struct platform_device *pdev) + if (ret) + goto clk_disable; + ++ dma_set_max_seg_size(&pdev->dev, UINT_MAX); ++ + v3d->va_width = 30 + V3D_GET_FIELD(mmu_debug, V3D_MMU_VA_WIDTH); + + ident1 = V3D_READ(V3D_HUB_IDENT1); +-- +2.51.0 + diff --git a/queue-6.18/drm-xe-covert-return-of-ebusy-to-enomem-in-vm-bind-i.patch b/queue-6.18/drm-xe-covert-return-of-ebusy-to-enomem-in-vm-bind-i.patch new file mode 100644 index 00000000000..c8ae8e3c60a --- /dev/null +++ b/queue-6.18/drm-xe-covert-return-of-ebusy-to-enomem-in-vm-bind-i.patch @@ -0,0 +1,48 @@ +From a088685e24ef2d431b04c5deb4b0491e7414bf09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 17:25:02 -0800 +Subject: drm/xe: Covert return of -EBUSY to -ENOMEM in VM bind IOCTL + +From: Matthew Brost + +[ Upstream commit 6028f59620927aee2e15a424004012ae05c50684 ] + +xe_vma_userptr_pin_pages can return -EBUSY but -EBUSY has special +meaning in VM bind IOCTLs that user fence is pending that is attached to +the VMA. Convert -EBUSY to -ENOMEM in this case as -EBUSY in practice +means we are low or out of memory. + +Signed-off-by: Matthew Brost +Reviewed-by: Tejas Upadhyay +Link: https://patch.msgid.link/20251122012502.382587-2-matthew.brost@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_vm.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c +index 145cd9ffa36b3..2444800d0fd35 100644 +--- a/drivers/gpu/drm/xe/xe_vm.c ++++ b/drivers/gpu/drm/xe/xe_vm.c +@@ -2422,8 +2422,17 @@ static struct xe_vma *new_vma(struct xe_vm *vm, struct drm_gpuva_op_map *op, + if (IS_ERR(vma)) + return vma; + +- if (xe_vma_is_userptr(vma)) ++ if (xe_vma_is_userptr(vma)) { + err = xe_vma_userptr_pin_pages(to_userptr_vma(vma)); ++ /* ++ * -EBUSY has dedicated meaning that a user fence ++ * attached to the VMA is busy, in practice ++ * xe_vma_userptr_pin_pages can only fail with -EBUSY if ++ * we are low on memory so convert this to -ENOMEM. ++ */ ++ if (err == -EBUSY) ++ err = -ENOMEM; ++ } + } + if (err) { + prep_vma_destroy(vm, vma, false); +-- +2.51.0 + diff --git a/queue-6.18/drm-xe-ggtt-use-scope-based-runtime-pm.patch b/queue-6.18/drm-xe-ggtt-use-scope-based-runtime-pm.patch new file mode 100644 index 00000000000..ae849105abe --- /dev/null +++ b/queue-6.18/drm-xe-ggtt-use-scope-based-runtime-pm.patch @@ -0,0 +1,38 @@ +From de91bb4c7bff70b969dd6dd27a9fcfd3e70c1ddb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Nov 2025 08:44:01 -0800 +Subject: drm/xe/ggtt: Use scope-based runtime pm + +From: Matt Roper + +[ Upstream commit 8a579f4b2476fd1df07e2bca9fedc82a39a56a65 ] + +Switch the GGTT code to scope-based runtime PM for consistency with +other parts of the driver. + +Reviewed-by: Gustavo Sousa +Link: https://patch.msgid.link/20251118164338.3572146-51-matthew.d.roper@intel.com +Signed-off-by: Matt Roper +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_ggtt.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_ggtt.c b/drivers/gpu/drm/xe/xe_ggtt.c +index 20d9171bd3d0a..2f96983a66b6e 100644 +--- a/drivers/gpu/drm/xe/xe_ggtt.c ++++ b/drivers/gpu/drm/xe/xe_ggtt.c +@@ -365,9 +365,8 @@ static void ggtt_node_remove_work_func(struct work_struct *work) + delayed_removal_work); + struct xe_device *xe = tile_to_xe(node->ggtt->tile); + +- xe_pm_runtime_get(xe); ++ guard(xe_pm_runtime)(xe); + ggtt_node_remove(node); +- xe_pm_runtime_put(xe); + } + + /** +-- +2.51.0 + diff --git a/queue-6.18/drm-xe-only-toggle-scheduling-in-tdr-if-guc-is-runni.patch b/queue-6.18/drm-xe-only-toggle-scheduling-in-tdr-if-guc-is-runni.patch new file mode 100644 index 00000000000..61134c19a98 --- /dev/null +++ b/queue-6.18/drm-xe-only-toggle-scheduling-in-tdr-if-guc-is-runni.patch @@ -0,0 +1,48 @@ +From 3926df04d7cc8a8324094ff9d0077cb87252c5b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jan 2026 17:27:35 -0800 +Subject: drm/xe: Only toggle scheduling in TDR if GuC is running + +From: Matthew Brost + +[ Upstream commit dd1ef5e2456558876244795bb22a4d90cb24f160 ] + +If the firmware is not running during TDR (e.g., when the driver is +unloading), there's no need to toggle scheduling in the GuC. In such +cases, skip this step. + +v4: + - Bail on wait UC not running (Niranjana) + +Signed-off-by: Matthew Brost +Reviewed-by: Niranjana Vishwanathapura +Link: https://patch.msgid.link/20260110012739.2888434-4-matthew.brost@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_guc_submit.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c +index 474789bf6506f..ecee50d827108 100644 +--- a/drivers/gpu/drm/xe/xe_guc_submit.c ++++ b/drivers/gpu/drm/xe/xe_guc_submit.c +@@ -1298,7 +1298,7 @@ guc_exec_queue_timedout_job(struct drm_sched_job *drm_job) + if (exec_queue_reset(q)) + err = -EIO; + +- if (!exec_queue_destroyed(q)) { ++ if (!exec_queue_destroyed(q) && xe_uc_fw_is_running(&guc->fw)) { + /* + * Wait for any pending G2H to flush out before + * modifying state +@@ -1330,6 +1330,7 @@ guc_exec_queue_timedout_job(struct drm_sched_job *drm_job) + */ + smp_rmb(); + ret = wait_event_timeout(guc->ct.wq, ++ !xe_uc_fw_is_running(&guc->fw) || + !exec_queue_pending_disable(q) || + xe_guc_read_stopped(guc), HZ * 5); + if (!ret || xe_guc_read_stopped(guc)) { +-- +2.51.0 + diff --git a/queue-6.18/drm-xe-vm-skip-ufence-association-for-cpu-address-mi.patch b/queue-6.18/drm-xe-vm-skip-ufence-association-for-cpu-address-mi.patch new file mode 100644 index 00000000000..11739601db2 --- /dev/null +++ b/queue-6.18/drm-xe-vm-skip-ufence-association-for-cpu-address-mi.patch @@ -0,0 +1,47 @@ +From d909dcd2524d67af3265ace3ef560373a972af9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 13:26:28 +0530 +Subject: drm/xe/vm: Skip ufence association for CPU address mirror VMA during + MAP +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Himal Prasad Ghimiray + +[ Upstream commit 7f08cc5b3cc3bf6416f8b55bff906f67ed75637d ] + +The MAP operation for a CPU address mirror VMA does not require ufence +association because such mappings are not GPU-synchronized and do not +participate in GPU job completion signaling. + +Remove the unnecessary ufence addition for this case to avoid -EBUSY +failure in check_ufence of unbind ops. + +Cc: Matthew Brost +Cc: Thomas Hellström +Reviewed-by: Matthew Brost +Link: https://patch.msgid.link/20251125075628.1182481-6-himal.prasad.ghimiray@intel.com +Signed-off-by: Himal Prasad Ghimiray +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_vm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c +index 2444800d0fd35..59ff911f8aad0 100644 +--- a/drivers/gpu/drm/xe/xe_vm.c ++++ b/drivers/gpu/drm/xe/xe_vm.c +@@ -3179,7 +3179,8 @@ static void op_add_ufence(struct xe_vm *vm, struct xe_vma_op *op, + { + switch (op->base.op) { + case DRM_GPUVA_OP_MAP: +- vma_add_ufence(op->map.vma, ufence); ++ if (!xe_vma_is_cpu_addr_mirror(op->map.vma)) ++ vma_add_ufence(op->map.vma, ufence); + break; + case DRM_GPUVA_OP_REMAP: + if (op->remap.prev) +-- +2.51.0 + diff --git a/queue-6.18/drm-xe-xe3_lpg-apply-wa_16028005424.patch b/queue-6.18/drm-xe-xe3_lpg-apply-wa_16028005424.patch new file mode 100644 index 00000000000..3290f4d9af1 --- /dev/null +++ b/queue-6.18/drm-xe-xe3_lpg-apply-wa_16028005424.patch @@ -0,0 +1,61 @@ +From 58b77d9b991d775706ba65904e885be82d74f4e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 15:38:23 +0530 +Subject: drm/xe/xe3_lpg: Apply Wa_16028005424 + +From: Balasubramani Vivekanandan + +[ Upstream commit 9d94c1cf6ef938abd4b849b66f8eab11e3c537ef ] + +Applied Wa_16028005424 to Graphics version from 30.00 to 30.05 + +Reviewed-by: Matt Roper +Signed-off-by: Balasubramani Vivekanandan +Link: https://patch.msgid.link/20251121100822.20076-2-balasubramani.vivekanandan@intel.com +Signed-off-by: Matt Roper +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/regs/xe_guc_regs.h | 3 +++ + drivers/gpu/drm/xe/xe_wa.c | 5 +++++ + 2 files changed, 8 insertions(+) + +diff --git a/drivers/gpu/drm/xe/regs/xe_guc_regs.h b/drivers/gpu/drm/xe/regs/xe_guc_regs.h +index 2118f7dec287f..87984713dd126 100644 +--- a/drivers/gpu/drm/xe/regs/xe_guc_regs.h ++++ b/drivers/gpu/drm/xe/regs/xe_guc_regs.h +@@ -90,6 +90,9 @@ + #define GUC_SEND_INTERRUPT XE_REG(0xc4c8) + #define GUC_SEND_TRIGGER REG_BIT(0) + ++#define GUC_INTR_CHICKEN XE_REG(0xc50c) ++#define DISABLE_SIGNALING_ENGINES REG_BIT(1) ++ + #define GUC_BCS_RCS_IER XE_REG(0xc550) + #define GUC_VCS2_VCS1_IER XE_REG(0xc554) + #define GUC_WD_VECS_IER XE_REG(0xc558) +diff --git a/drivers/gpu/drm/xe/xe_wa.c b/drivers/gpu/drm/xe/xe_wa.c +index 2a2e9f2c09163..89472b7362c22 100644 +--- a/drivers/gpu/drm/xe/xe_wa.c ++++ b/drivers/gpu/drm/xe/xe_wa.c +@@ -15,6 +15,7 @@ + + #include "regs/xe_engine_regs.h" + #include "regs/xe_gt_regs.h" ++#include "regs/xe_guc_regs.h" + #include "regs/xe_regs.h" + #include "xe_device_types.h" + #include "xe_force_wake.h" +@@ -315,6 +316,10 @@ static const struct xe_rtp_entry_sr gt_was[] = { + XE_RTP_ACTIONS(SET(VDBOX_CGCTL3F10(0), RAMDFTUNIT_CLKGATE_DIS)), + XE_RTP_ENTRY_FLAG(FOREACH_ENGINE), + }, ++ { XE_RTP_NAME("16028005424"), ++ XE_RTP_RULES(GRAPHICS_VERSION_RANGE(3000, 3005)), ++ XE_RTP_ACTIONS(SET(GUC_INTR_CHICKEN, DISABLE_SIGNALING_ENGINES)) ++ }, + }; + + static const struct xe_rtp_entry_sr engine_was[] = { +-- +2.51.0 + diff --git a/queue-6.18/edac-igen6-add-more-intel-panther-lake-h-socs-suppor.patch b/queue-6.18/edac-igen6-add-more-intel-panther-lake-h-socs-suppor.patch new file mode 100644 index 00000000000..99d8330336d --- /dev/null +++ b/queue-6.18/edac-igen6-add-more-intel-panther-lake-h-socs-suppor.patch @@ -0,0 +1,61 @@ +From 6c45b0becaf62960905b853dea0722e5d5c6e8df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 21:15:37 +0800 +Subject: EDAC/igen6: Add more Intel Panther Lake-H SoCs support + +From: Lili Li + +[ Upstream commit 4c36e6106997b6ad8f4a279b4bdbca3ed6f53c6c ] + +Add more Intel Panther Lake-H SoC compute die IDs for EDAC support. + +Signed-off-by: Lili Li +Signed-off-by: Tony Luck +Reviewed-by: Qiuxu Zhuo +Link: https://patch.msgid.link/20251124131537.3633983-1-qiuxu.zhuo@intel.com +Signed-off-by: Sasha Levin +--- + drivers/edac/igen6_edac.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/edac/igen6_edac.c b/drivers/edac/igen6_edac.c +index 2fc59f9eed691..9202e6e2daf4e 100644 +--- a/drivers/edac/igen6_edac.c ++++ b/drivers/edac/igen6_edac.c +@@ -274,6 +274,16 @@ static struct work_struct ecclog_work; + #define DID_PTL_H_SKU1 0xb000 + #define DID_PTL_H_SKU2 0xb001 + #define DID_PTL_H_SKU3 0xb002 ++#define DID_PTL_H_SKU4 0xb003 ++#define DID_PTL_H_SKU5 0xb004 ++#define DID_PTL_H_SKU6 0xb005 ++#define DID_PTL_H_SKU7 0xb008 ++#define DID_PTL_H_SKU8 0xb011 ++#define DID_PTL_H_SKU9 0xb014 ++#define DID_PTL_H_SKU10 0xb015 ++#define DID_PTL_H_SKU11 0xb028 ++#define DID_PTL_H_SKU12 0xb029 ++#define DID_PTL_H_SKU13 0xb02a + + /* Compute die IDs for Wildcat Lake with IBECC */ + #define DID_WCL_SKU1 0xfd00 +@@ -636,6 +646,16 @@ static struct pci_device_id igen6_pci_tbl[] = { + { PCI_VDEVICE(INTEL, DID_PTL_H_SKU1), (kernel_ulong_t)&mtl_p_cfg }, + { PCI_VDEVICE(INTEL, DID_PTL_H_SKU2), (kernel_ulong_t)&mtl_p_cfg }, + { PCI_VDEVICE(INTEL, DID_PTL_H_SKU3), (kernel_ulong_t)&mtl_p_cfg }, ++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU4), (kernel_ulong_t)&mtl_p_cfg }, ++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU5), (kernel_ulong_t)&mtl_p_cfg }, ++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU6), (kernel_ulong_t)&mtl_p_cfg }, ++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU7), (kernel_ulong_t)&mtl_p_cfg }, ++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU8), (kernel_ulong_t)&mtl_p_cfg }, ++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU9), (kernel_ulong_t)&mtl_p_cfg }, ++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU10), (kernel_ulong_t)&mtl_p_cfg }, ++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU11), (kernel_ulong_t)&mtl_p_cfg }, ++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU12), (kernel_ulong_t)&mtl_p_cfg }, ++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU13), (kernel_ulong_t)&mtl_p_cfg }, + { PCI_VDEVICE(INTEL, DID_WCL_SKU1), (kernel_ulong_t)&wcl_cfg }, + { }, + }; +-- +2.51.0 + diff --git a/queue-6.18/edac-igen6-add-two-intel-amston-lake-socs-support.patch b/queue-6.18/edac-igen6-add-two-intel-amston-lake-socs-support.patch new file mode 100644 index 00000000000..efc49df3704 --- /dev/null +++ b/queue-6.18/edac-igen6-add-two-intel-amston-lake-socs-support.patch @@ -0,0 +1,47 @@ +From d4f0164115efdcae0d06fd979cbdebff3ea300c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 14:54:56 +0800 +Subject: EDAC/igen6: Add two Intel Amston Lake SoCs support + +From: Qiuxu Zhuo + +[ Upstream commit 41ca2155d62b0b0d217f59e1bce18362d0c2446f ] + +Intel Amston Lake SoCs with IBECC (In-Band ECC) capability share the same +IBECC registers as Alder Lake-N SoCs. Add two new compute die IDs for +Amston Lake SoC products to enable EDAC support. + +Signed-off-by: Qiuxu Zhuo +Signed-off-by: Tony Luck +Tested-by: Jianfeng Gao +Link: https://patch.msgid.link/20251124065457.3630949-2-qiuxu.zhuo@intel.com +Signed-off-by: Sasha Levin +--- + drivers/edac/igen6_edac.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/edac/igen6_edac.c b/drivers/edac/igen6_edac.c +index 9202e6e2daf4e..463bbcd484c3c 100644 +--- a/drivers/edac/igen6_edac.c ++++ b/drivers/edac/igen6_edac.c +@@ -246,6 +246,8 @@ static struct work_struct ecclog_work; + + /* Compute did IDs for Amston Lake with IBECC */ + #define DID_ASL_SKU1 0x464a ++#define DID_ASL_SKU2 0x4646 ++#define DID_ASL_SKU3 0x4652 + + /* Compute die IDs for Raptor Lake-P with IBECC */ + #define DID_RPL_P_SKU1 0xa706 +@@ -628,6 +630,8 @@ static struct pci_device_id igen6_pci_tbl[] = { + { PCI_VDEVICE(INTEL, DID_ADL_N_SKU12), (kernel_ulong_t)&adl_n_cfg }, + { PCI_VDEVICE(INTEL, DID_AZB_SKU1), (kernel_ulong_t)&adl_n_cfg }, + { PCI_VDEVICE(INTEL, DID_ASL_SKU1), (kernel_ulong_t)&adl_n_cfg }, ++ { PCI_VDEVICE(INTEL, DID_ASL_SKU2), (kernel_ulong_t)&adl_n_cfg }, ++ { PCI_VDEVICE(INTEL, DID_ASL_SKU3), (kernel_ulong_t)&adl_n_cfg }, + { PCI_VDEVICE(INTEL, DID_RPL_P_SKU1), (kernel_ulong_t)&rpl_p_cfg }, + { PCI_VDEVICE(INTEL, DID_RPL_P_SKU2), (kernel_ulong_t)&rpl_p_cfg }, + { PCI_VDEVICE(INTEL, DID_RPL_P_SKU3), (kernel_ulong_t)&rpl_p_cfg }, +-- +2.51.0 + diff --git a/queue-6.18/efi-cper-don-t-dump-the-entire-memory-region.patch b/queue-6.18/efi-cper-don-t-dump-the-entire-memory-region.patch new file mode 100644 index 00000000000..15d3212a918 --- /dev/null +++ b/queue-6.18/efi-cper-don-t-dump-the-entire-memory-region.patch @@ -0,0 +1,54 @@ +From af117a617d63cbcb12d09966bfece4ef0dd82307 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:35:06 +0100 +Subject: EFI/CPER: don't dump the entire memory region + +From: Mauro Carvalho Chehab + +[ Upstream commit 55cc6fe5716f678f06bcb95140882dfa684464ec ] + +The current logic at cper_print_fw_err() doesn't check if the +error record length is big enough to handle offset. On a bad firmware, +if the ofset is above the actual record, length -= offset will +underflow, making it dump the entire memory. + +The end result can be: + + - the logic taking a lot of time dumping large regions of memory; + - data disclosure due to the memory dumps; + - an OOPS, if it tries to dump an unmapped memory region. + +Fix it by checking if the section length is too small before doing +a hex dump. + +Signed-off-by: Mauro Carvalho Chehab +Reviewed-by: Jonathan Cameron +Acked-by: Ard Biesheuvel +Reviewed-by: Hanjun Guo +[ rjw: Subject tweaks ] +Link: https://patch.msgid.link/1752b5ba63a3e2f148ddee813b36c996cc617e86.1767871950.git.mchehab+huawei@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/cper.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c +index 322c6bdefb611..d58ff956a699c 100644 +--- a/drivers/firmware/efi/cper.c ++++ b/drivers/firmware/efi/cper.c +@@ -560,6 +560,11 @@ static void cper_print_fw_err(const char *pfx, + } else { + offset = sizeof(*fw_err); + } ++ if (offset > length) { ++ printk("%s""error section length is too small: offset=%d, length=%d\n", ++ pfx, offset, length); ++ return; ++ } + + buf += offset; + length -= offset; +-- +2.51.0 + diff --git a/queue-6.18/efi-cper-don-t-go-past-the-arm-processor-cper-record.patch b/queue-6.18/efi-cper-don-t-go-past-the-arm-processor-cper-record.patch new file mode 100644 index 00000000000..d5768873353 --- /dev/null +++ b/queue-6.18/efi-cper-don-t-go-past-the-arm-processor-cper-record.patch @@ -0,0 +1,107 @@ +From 6309d5edb98a9c213d1e0c076757c3a92ad3eca9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:35:04 +0100 +Subject: EFI/CPER: don't go past the ARM processor CPER record buffer + +From: Mauro Carvalho Chehab + +[ Upstream commit eae21beecb95a3b69ee5c38a659f774e171d730e ] + +There's a logic inside GHES/CPER to detect if the section_length +is too small, but it doesn't detect if it is too big. + +Currently, if the firmware receives an ARM processor CPER record +stating that a section length is big, kernel will blindly trust +section_length, producing a very long dump. For instance, a 67 +bytes record with ERR_INFO_NUM set 46198 and section length +set to 854918320 would dump a lot of data going a way past the +firmware memory-mapped area. + +Fix it by adding a logic to prevent it to go past the buffer +if ERR_INFO_NUM is too big, making it report instead: + + [Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1 + [Hardware Error]: event severity: recoverable + [Hardware Error]: Error 0, type: recoverable + [Hardware Error]: section_type: ARM processor error + [Hardware Error]: MIDR: 0xff304b2f8476870a + [Hardware Error]: section length: 854918320, CPER size: 67 + [Hardware Error]: section length is too big + [Hardware Error]: firmware-generated error record is incorrect + [Hardware Error]: ERR_INFO_NUM is 46198 + +Signed-off-by: Mauro Carvalho Chehab +Reviewed-by: Jonathan Cameron +Acked-by: Ard Biesheuvel +Reviewed-by: Hanjun Guo +[ rjw: Subject and changelog tweaks ] +Link: https://patch.msgid.link/41cd9f6b3ace3cdff7a5e864890849e4b1c58b63.1767871950.git.mchehab+huawei@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/cper-arm.c | 12 ++++++++---- + drivers/firmware/efi/cper.c | 3 ++- + include/linux/cper.h | 3 ++- + 3 files changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/firmware/efi/cper-arm.c b/drivers/firmware/efi/cper-arm.c +index 76542a53e2027..b21cb1232d820 100644 +--- a/drivers/firmware/efi/cper-arm.c ++++ b/drivers/firmware/efi/cper-arm.c +@@ -226,7 +226,8 @@ static void cper_print_arm_err_info(const char *pfx, u32 type, + } + + void cper_print_proc_arm(const char *pfx, +- const struct cper_sec_proc_arm *proc) ++ const struct cper_sec_proc_arm *proc, ++ u32 length) + { + int i, len, max_ctx_type; + struct cper_arm_err_info *err_info; +@@ -238,9 +239,12 @@ void cper_print_proc_arm(const char *pfx, + + len = proc->section_length - (sizeof(*proc) + + proc->err_info_num * (sizeof(*err_info))); +- if (len < 0) { +- printk("%ssection length: %d\n", pfx, proc->section_length); +- printk("%ssection length is too small\n", pfx); ++ ++ if (len < 0 || proc->section_length > length) { ++ printk("%ssection length: %d, CPER size: %d\n", ++ pfx, proc->section_length, length); ++ printk("%ssection length is too %s\n", pfx, ++ (len < 0) ? "small" : "big"); + printk("%sfirmware-generated error record is incorrect\n", pfx); + printk("%sERR_INFO_NUM is %d\n", pfx, proc->err_info_num); + return; +diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c +index d58ff956a699c..d4dc69693ece4 100644 +--- a/drivers/firmware/efi/cper.c ++++ b/drivers/firmware/efi/cper.c +@@ -664,7 +664,8 @@ cper_estatus_print_section(const char *pfx, struct acpi_hest_generic_data *gdata + + printk("%ssection_type: ARM processor error\n", newpfx); + if (gdata->error_data_length >= sizeof(*arm_err)) +- cper_print_proc_arm(newpfx, arm_err); ++ cper_print_proc_arm(newpfx, arm_err, ++ gdata->error_data_length); + else + goto err_section_too_small; + #endif +diff --git a/include/linux/cper.h b/include/linux/cper.h +index 5b1236d8c65bb..440b35e459e53 100644 +--- a/include/linux/cper.h ++++ b/include/linux/cper.h +@@ -595,7 +595,8 @@ void cper_mem_err_pack(const struct cper_sec_mem_err *, + const char *cper_mem_err_unpack(struct trace_seq *, + struct cper_mem_err_compact *); + void cper_print_proc_arm(const char *pfx, +- const struct cper_sec_proc_arm *proc); ++ const struct cper_sec_proc_arm *proc, ++ u32 length); + void cper_print_proc_ia(const char *pfx, + const struct cper_sec_proc_ia *proc); + int cper_mem_err_location(struct cper_mem_err_compact *mem, char *msg); +-- +2.51.0 + diff --git a/queue-6.18/ext4-mark-group-add-fast-commit-ineligible.patch b/queue-6.18/ext4-mark-group-add-fast-commit-ineligible.patch new file mode 100644 index 00000000000..e0a4a5a37ca --- /dev/null +++ b/queue-6.18/ext4-mark-group-add-fast-commit-ineligible.patch @@ -0,0 +1,68 @@ +From a3b657cc006e5874eb1a68b51815db573081dfc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 19:51:41 +0800 +Subject: ext4: mark group add fast-commit ineligible + +From: Li Chen + +[ Upstream commit 89b4336fd5ec78f51f9d3a1d100f3ffa3228e604 ] + +Fast commits only log operations that have dedicated replay support. +Online resize via EXT4_IOC_GROUP_ADD updates the superblock and group +descriptor metadata without going through the fast commit tracking +paths. +In practice these operations are rare and usually followed by further +updates, but mixing them into a fast commit makes the overall +semantics harder to reason about and risks replay gaps if new call +sites appear. + +Teach ext4 to mark the filesystem fast-commit ineligible when +ext4_ioctl_group_add() adds new block groups. +This forces those transactions to fall back to a full commit, +ensuring that the filesystem geometry updates are captured by the +normal journal rather than partially encoded in fast commit TLVs. +This change should not affect common workloads but makes online +resize via GROUP_ADD safer and easier to reason about under fast +commit. + +Testing: +1. prepare: + dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256 + mkfs.ext4 -O fast_commit -F /root/fc_resize.img + mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize +2. Ran a helper that issues EXT4_IOC_GROUP_ADD on the mounted + filesystem and checked the resize ineligible reason: + ./group_add_helper /mnt/fc_resize + cat /proc/fs/ext4/loop0/fc_info + shows "Resize": > 0. +3. Fsynced a file on the resized filesystem and verified that the fast + commit stats report at least one ineligible commit: + touch /mnt/fc_resize/file + /root/fsync_file /mnt/fc_resize/file + sync + cat /proc/fs/ext4/loop0/fc_info + shows fc stats ineligible > 0. + +Signed-off-by: Li Chen +Link: https://patch.msgid.link/20251211115146.897420-5-me@linux.beauty +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/ioctl.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c +index 3dec26c939fde..d26914fa0cb46 100644 +--- a/fs/ext4/ioctl.c ++++ b/fs/ext4/ioctl.c +@@ -966,6 +966,7 @@ static long ext4_ioctl_group_add(struct file *file, + + err = ext4_group_add(sb, input); + if (EXT4_SB(sb)->s_journal) { ++ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE, NULL); + jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal); + err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0); + jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal); +-- +2.51.0 + diff --git a/queue-6.18/ext4-mark-group-extend-fast-commit-ineligible.patch b/queue-6.18/ext4-mark-group-extend-fast-commit-ineligible.patch new file mode 100644 index 00000000000..a75aec2efa5 --- /dev/null +++ b/queue-6.18/ext4-mark-group-extend-fast-commit-ineligible.patch @@ -0,0 +1,69 @@ +From 17a4445bd475ea3d6ed49e18b4ab06fdbede6478 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 19:51:42 +0800 +Subject: ext4: mark group extend fast-commit ineligible + +From: Li Chen + +[ Upstream commit 1f8dd813a1c771b13c303f73d876164bc9b327cc ] + +Fast commits only log operations that have dedicated replay support. +EXT4_IOC_GROUP_EXTEND grows the filesystem to the end of the last +block group and updates the same on-disk metadata without going +through the fast commit tracking paths. +In practice these operations are rare and usually followed by further +updates, but mixing them into a fast commit makes the overall +semantics harder to reason about and risks replay gaps if new call +sites appear. + +Teach ext4 to mark the filesystem fast-commit ineligible when +EXT4_IOC_GROUP_EXTEND grows the filesystem. +This forces those transactions to fall back to a full commit, +ensuring that the group extension changes are captured by the normal +journal rather than partially encoded in fast commit TLVs. +This change should not affect common workloads but makes online +resize via GROUP_EXTEND safer and easier to reason about under fast +commit. + +Testing: +1. prepare: + dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256 + mkfs.ext4 -O fast_commit -F /root/fc_resize.img + mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize +2. Extended the filesystem to the end of the last block group using a + helper that calls EXT4_IOC_GROUP_EXTEND on the mounted filesystem + and checked fc_info: + ./group_extend_helper /mnt/fc_resize + cat /proc/fs/ext4/loop0/fc_info + shows the "Resize" ineligible reason increased. +3. Fsynced a file on the resized filesystem and confirmed that the fast + commit ineligible counter incremented for the resize transaction: + touch /mnt/fc_resize/file + /root/fsync_file /mnt/fc_resize/file + sync + cat /proc/fs/ext4/loop0/fc_info + +Signed-off-by: Li Chen +Link: https://patch.msgid.link/20251211115146.897420-6-me@linux.beauty +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/ioctl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c +index d26914fa0cb46..acc28aa5744b1 100644 +--- a/fs/ext4/ioctl.c ++++ b/fs/ext4/ioctl.c +@@ -1612,6 +1612,8 @@ static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) + + err = ext4_group_extend(sb, EXT4_SB(sb)->s_es, n_blocks_count); + if (EXT4_SB(sb)->s_journal) { ++ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE, ++ NULL); + jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal); + err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0); + jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal); +-- +2.51.0 + diff --git a/queue-6.18/ext4-move-ext4_percpu_param_init-before-ext4_mb_init.patch b/queue-6.18/ext4-move-ext4_percpu_param_init-before-ext4_mb_init.patch new file mode 100644 index 00000000000..45700eaecd9 --- /dev/null +++ b/queue-6.18/ext4-move-ext4_percpu_param_init-before-ext4_mb_init.patch @@ -0,0 +1,104 @@ +From 736e8445dd3523e5a232ed6b2b3be32412d66ab2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Dec 2025 21:31:16 +0800 +Subject: ext4: move ext4_percpu_param_init() before ext4_mb_init() + +From: Baokun Li + +[ Upstream commit 270564513489d98b721a1e4a10017978d5213bff ] + +When running `kvm-xfstests -c ext4/1k -C 1 generic/383` with the +`DOUBLE_CHECK` macro defined, the following panic is triggered: + +================================================================== +EXT4-fs error (device vdc): ext4_validate_block_bitmap:423: + comm mount: bg 0: bad block bitmap checksum +BUG: unable to handle page fault for address: ff110000fa2cc000 +PGD 3e01067 P4D 3e02067 PUD 0 +Oops: Oops: 0000 [#1] SMP NOPTI +CPU: 0 UID: 0 PID: 2386 Comm: mount Tainted: G W + 6.18.0-gba65a4e7120a-dirty #1152 PREEMPT(none) +RIP: 0010:percpu_counter_add_batch+0x13/0xa0 +Call Trace: + + ext4_mark_group_bitmap_corrupted+0xcb/0xe0 + ext4_validate_block_bitmap+0x2a1/0x2f0 + ext4_read_block_bitmap+0x33/0x50 + mb_group_bb_bitmap_alloc+0x33/0x80 + ext4_mb_add_groupinfo+0x190/0x250 + ext4_mb_init_backend+0x87/0x290 + ext4_mb_init+0x456/0x640 + __ext4_fill_super+0x1072/0x1680 + ext4_fill_super+0xd3/0x280 + get_tree_bdev_flags+0x132/0x1d0 + vfs_get_tree+0x29/0xd0 + vfs_cmd_create+0x59/0xe0 + __do_sys_fsconfig+0x4f6/0x6b0 + do_syscall_64+0x50/0x1f0 + entry_SYSCALL_64_after_hwframe+0x76/0x7e +================================================================== + +This issue can be reproduced using the following commands: + mkfs.ext4 -F -q -b 1024 /dev/sda 5G + tune2fs -O quota,project /dev/sda + mount /dev/sda /tmp/test + +With DOUBLE_CHECK defined, mb_group_bb_bitmap_alloc() reads +and validates the block bitmap. When the validation fails, +ext4_mark_group_bitmap_corrupted() attempts to update +sbi->s_freeclusters_counter. However, this percpu_counter has not been +initialized yet at this point, which leads to the panic described above. + +Fix this by moving the execution of ext4_percpu_param_init() to occur +before ext4_mb_init(), ensuring the per-CPU counters are initialized +before they are used. + +Signed-off-by: Baokun Li +Reviewed-by: Zhang Yi +Reviewed-by: Jan Kara +Link: https://patch.msgid.link/20251209133116.731350-1-libaokun@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/super.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 4ef5590c73fda..b5774f4101045 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -5565,6 +5565,10 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb) + clear_opt2(sb, MB_OPTIMIZE_SCAN); + } + ++ err = ext4_percpu_param_init(sbi); ++ if (err) ++ goto failed_mount5; ++ + err = ext4_mb_init(sb); + if (err) { + ext4_msg(sb, KERN_ERR, "failed to initialize mballoc (%d)", +@@ -5580,10 +5584,6 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb) + sbi->s_journal->j_commit_callback = + ext4_journal_commit_callback; + +- err = ext4_percpu_param_init(sbi); +- if (err) +- goto failed_mount6; +- + if (ext4_has_feature_flex_bg(sb)) + if (!ext4_fill_flex_info(sb)) { + ext4_msg(sb, KERN_ERR, +@@ -5665,8 +5665,8 @@ failed_mount8: __maybe_unused + failed_mount6: + ext4_mb_release(sb); + ext4_flex_groups_free(sbi); +- ext4_percpu_param_destroy(sbi); + failed_mount5: ++ ext4_percpu_param_destroy(sbi); + ext4_ext_release(sb); + ext4_release_system_zone(sb); + failed_mount4a: +-- +2.51.0 + diff --git a/queue-6.18/ext4-propagate-flags-to-convert_initialized_extent.patch b/queue-6.18/ext4-propagate-flags-to-convert_initialized_extent.patch new file mode 100644 index 00000000000..47cec06b95d --- /dev/null +++ b/queue-6.18/ext4-propagate-flags-to-convert_initialized_extent.patch @@ -0,0 +1,66 @@ +From 25767a59309cf1548efa5412067b67cd7d62b5c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 11:55:35 +0530 +Subject: ext4: propagate flags to convert_initialized_extent() + +From: Ojaswin Mujoo + +[ Upstream commit 3fffa44b6ebf65be92a562a5063303979385a1c9 ] + +Currently, ext4_zero_range passes EXT4_EX_NOCACHE flag to avoid caching +extents however this is not respected by convert_initialized_extent(). +Hence, modify it to accept flags from the caller and to pass the flags +on to other extent manipulation functions it calls. This makes +sure the NOCACHE flag is respected throughout the code path. + +Also, we no longer explicitly pass CONVERT_UNWRITTEN as the caller takes +care of this. + +Reviewed-by: Zhang Yi +Reviewed-by: Jan Kara +Signed-off-by: Ojaswin Mujoo +Link: https://patch.msgid.link/07008fbb14db727fddcaf4c30e2346c49f6c8fe0.1769149131.git.ojaswin@linux.ibm.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/extents.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 7338f93313b61..88187fddc6424 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -3853,6 +3853,7 @@ static struct ext4_ext_path * + convert_initialized_extent(handle_t *handle, struct inode *inode, + struct ext4_map_blocks *map, + struct ext4_ext_path *path, ++ int flags, + unsigned int *allocated) + { + struct ext4_extent *ex; +@@ -3878,11 +3879,11 @@ convert_initialized_extent(handle_t *handle, struct inode *inode, + + if (ee_block != map->m_lblk || ee_len > map->m_len) { + path = ext4_split_convert_extents(handle, inode, map, path, +- EXT4_GET_BLOCKS_CONVERT_UNWRITTEN, NULL); ++ flags, NULL); + if (IS_ERR(path)) + return path; + +- path = ext4_find_extent(inode, map->m_lblk, path, 0); ++ path = ext4_find_extent(inode, map->m_lblk, path, flags); + if (IS_ERR(path)) + return path; + depth = ext_depth(inode); +@@ -4294,7 +4295,7 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode, + if ((!ext4_ext_is_unwritten(ex)) && + (flags & EXT4_GET_BLOCKS_CONVERT_UNWRITTEN)) { + path = convert_initialized_extent(handle, +- inode, map, path, &allocated); ++ inode, map, path, flags, &allocated); + if (IS_ERR(path)) + err = PTR_ERR(path); + goto out; +-- +2.51.0 + diff --git a/queue-6.18/ext4-use-reserved-metadata-blocks-when-splitting-ext.patch b/queue-6.18/ext4-use-reserved-metadata-blocks-when-splitting-ext.patch new file mode 100644 index 00000000000..a0a69578256 --- /dev/null +++ b/queue-6.18/ext4-use-reserved-metadata-blocks-when-splitting-ext.patch @@ -0,0 +1,64 @@ +From 89616dc39d731697db210f88e8273ca6b1b2acae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 09:45:16 +0800 +Subject: ext4: use reserved metadata blocks when splitting extent on endio + +From: Zhang Yi + +[ Upstream commit 01942af95ab6c9d98e64ae01fdc243a03e4b973f ] + +When performing buffered writes, we may need to split and convert an +unwritten extent into a written one during the end I/O process. However, +we do not reserve space specifically for these metadata changes, we only +reserve 2% of space or 4096 blocks. To address this, we use +EXT4_GET_BLOCKS_PRE_IO to potentially split extents in advance and +EXT4_GET_BLOCKS_METADATA_NOFAIL to utilize reserved space if necessary. + +These two approaches can reduce the likelihood of running out of space +and losing data. However, these methods are merely best efforts, we +could still run out of space, and there is not much difference between +converting an extent during the writeback process and the end I/O +process, it won't increase the risk of losing data if we postpone the +conversion. + +Therefore, also use EXT4_GET_BLOCKS_METADATA_NOFAIL in +ext4_convert_unwritten_extents_endio() to prepare for the buffered I/O +iomap conversion, which may perform extent conversion during the end I/O +process. + +Signed-off-by: Zhang Yi +Reviewed-by: Jan Kara +Reviewed-by: Baokun Li +Reviewed-by: Ojaswin Mujoo +Link: https://patch.msgid.link/20260105014522.1937690-2-yi.zhang@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/extents.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index ae7f2d6b32e32..7338f93313b61 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -3805,6 +3805,8 @@ ext4_convert_unwritten_extents_endio(handle_t *handle, struct inode *inode, + * illegal. + */ + if (ee_block != map->m_lblk || ee_len > map->m_len) { ++ int flags = EXT4_GET_BLOCKS_CONVERT | ++ EXT4_GET_BLOCKS_METADATA_NOFAIL; + #ifdef CONFIG_EXT4_DEBUG + ext4_warning(inode->i_sb, "Inode (%ld) finished: extent logical block %llu," + " len %u; IO logical block %llu, len %u", +@@ -3812,7 +3814,7 @@ ext4_convert_unwritten_extents_endio(handle_t *handle, struct inode *inode, + (unsigned long long)map->m_lblk, map->m_len); + #endif + path = ext4_split_convert_extents(handle, inode, map, path, +- EXT4_GET_BLOCKS_CONVERT, NULL); ++ flags, NULL); + if (IS_ERR(path)) + return path; + +-- +2.51.0 + diff --git a/queue-6.18/firmware-arm_ffa-unmap-rx-tx-buffers-on-init-failure.patch b/queue-6.18/firmware-arm_ffa-unmap-rx-tx-buffers-on-init-failure.patch new file mode 100644 index 00000000000..69499055e48 --- /dev/null +++ b/queue-6.18/firmware-arm_ffa-unmap-rx-tx-buffers-on-init-failure.patch @@ -0,0 +1,39 @@ +From a6da2bdfb5b3130e074031be33c2a5d83c63996f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Dec 2025 11:16:56 +0800 +Subject: firmware: arm_ffa: Unmap Rx/Tx buffers on init failure + +From: Haoxiang Li + +[ Upstream commit 9fda364cb78c8b9e1abe4029f877300c94655742 ] + +ffa_init() maps the Rx/Tx buffers via ffa_rxtx_map() but on the +partition setup failure path it never unmaps them. + +Add the missing ffa_rxtx_unmap() call in the error path so that +the Rx/Tx buffers are properly released before freeing the backing +pages. + +Signed-off-by: Haoxiang Li +Message-Id: <20251210031656.56194-1-lihaoxiang@isrc.iscas.ac.cn> +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_ffa/driver.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c +index c501c3104b3a4..11a702e7f641c 100644 +--- a/drivers/firmware/arm_ffa/driver.c ++++ b/drivers/firmware/arm_ffa/driver.c +@@ -2093,6 +2093,7 @@ static int __init ffa_init(void) + + pr_err("failed to setup partitions\n"); + ffa_notifications_cleanup(); ++ ffa_rxtx_unmap(drv_info->vm_id); + free_pages: + if (drv_info->tx_buffer) + free_pages_exact(drv_info->tx_buffer, rxtx_bufsz); +-- +2.51.0 + diff --git a/queue-6.18/fix-it87_wdt-early-reboot-by-reporting-running-timer.patch b/queue-6.18/fix-it87_wdt-early-reboot-by-reporting-running-timer.patch new file mode 100644 index 00000000000..292edb41654 --- /dev/null +++ b/queue-6.18/fix-it87_wdt-early-reboot-by-reporting-running-timer.patch @@ -0,0 +1,60 @@ +From f4fe45158e3136487a99db6772430c66260d9435 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 13:11:24 +0100 +Subject: fix it87_wdt early reboot by reporting running timer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: René Rebe + +[ Upstream commit 88b2ab346436f799b99894a3e9518a3ffa344524 ] + +Some products, such as the Ugreen DXP4800 Plus NAS, ship with the it87 +wdt enabled by the firmware and a broken BIOS option that does not +allow to change the time or turn it off. As this makes installing +Linux rather difficult, change the it87_wdt to report it running to +the watchdog core. + +Signed-off-by: René Rebe +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/it87_wdt.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/watchdog/it87_wdt.c b/drivers/watchdog/it87_wdt.c +index 3b8488c86a2f3..1d9f8591f38d8 100644 +--- a/drivers/watchdog/it87_wdt.c ++++ b/drivers/watchdog/it87_wdt.c +@@ -188,6 +188,12 @@ static void _wdt_update_timeout(unsigned int t) + superio_outb(t >> 8, WDTVALMSB); + } + ++/* Internal function, should be called after superio_select(GPIO) */ ++static bool _wdt_running(void) ++{ ++ return superio_inb(WDTVALLSB) || (max_units > 255 && superio_inb(WDTVALMSB)); ++} ++ + static int wdt_update_timeout(unsigned int t) + { + int ret; +@@ -374,6 +380,12 @@ static int __init it87_wdt_init(void) + } + } + ++ /* wdt already left running by firmware? */ ++ if (_wdt_running()) { ++ pr_info("Left running by firmware.\n"); ++ set_bit(WDOG_HW_RUNNING, &wdt_dev.status); ++ } ++ + superio_exit(); + + if (timeout < 1 || timeout > max_units * 60) { +-- +2.51.0 + diff --git a/queue-6.18/fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch b/queue-6.18/fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch new file mode 100644 index 00000000000..242bb7c88ad --- /dev/null +++ b/queue-6.18/fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch @@ -0,0 +1,58 @@ +From f8d0c4b07d9471e79681210c6ee013aa6c6ae89e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Nov 2025 16:58:48 +0100 +Subject: fpga: of-fpga-region: Fail if any bridge is missing + +From: Romain Gantois + +[ Upstream commit c141c8221bc5089de915d9f26044df892c343c7e ] + +When parsing the region bridge list from the "fpga-bridges" device tree +property, the of-fpga-region driver will silently ignore bridges which fail +to be obtained, for example due to a missing bridge driver or invalid +phandle. + +This can lead to hardware issues if a region bridge stays coupled when +partial programming is performed. + +Fail if any of the bridges specified in "fpga-bridges" cannot be obtained. + +Signed-off-by: Romain Gantois +Link: https://lore.kernel.org/r/20251127-of-fpga-region-fail-if-bridges-not-found-v1-1-ca674f8d07eb@bootlin.com +Reviewed-by: Xu Yilun +Signed-off-by: Xu Yilun +Signed-off-by: Sasha Levin +--- + drivers/fpga/of-fpga-region.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/fpga/of-fpga-region.c b/drivers/fpga/of-fpga-region.c +index 43db4bb77138a..caa091224dc54 100644 +--- a/drivers/fpga/of-fpga-region.c ++++ b/drivers/fpga/of-fpga-region.c +@@ -83,7 +83,7 @@ static struct fpga_manager *of_fpga_region_get_mgr(struct device_node *np) + * done with the bridges. + * + * Return: 0 for success (even if there are no bridges specified) +- * or -EBUSY if any of the bridges are in use. ++ * or an error code if any of the bridges are not available. + */ + static int of_fpga_region_get_bridges(struct fpga_region *region) + { +@@ -130,10 +130,10 @@ static int of_fpga_region_get_bridges(struct fpga_region *region) + ®ion->bridge_list); + of_node_put(br); + +- /* If any of the bridges are in use, give up */ +- if (ret == -EBUSY) { ++ /* If any of the bridges are not available, give up */ ++ if (ret) { + fpga_bridges_put(®ion->bridge_list); +- return -EBUSY; ++ return ret; + } + } + +-- +2.51.0 + diff --git a/queue-6.18/fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch b/queue-6.18/fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch new file mode 100644 index 00000000000..52a4b89758d --- /dev/null +++ b/queue-6.18/fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch @@ -0,0 +1,50 @@ +From 711716d16f2bbd13e51940424d39966b9e64bb96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 18:42:11 +0530 +Subject: fs/buffer: add alert in try_to_free_buffers() for folios without + buffers + +From: Deepakkumar Karn + +[ Upstream commit b68f91ef3b3fe82ad78c417de71b675699a8467c ] + +try_to_free_buffers() can be called on folios with no buffers attached +when filemap_release_folio() is invoked on a folio belonging to a mapping +with AS_RELEASE_ALWAYS set but no release_folio operation defined. + +In such cases, folio_needs_release() returns true because of the +AS_RELEASE_ALWAYS flag, but the folio has no private buffer data. This +causes try_to_free_buffers() to call drop_buffers() on a folio with no +buffers, leading to a null pointer dereference. + +Adding a check in try_to_free_buffers() to return early if the folio has no +buffers attached, with WARN_ON_ONCE() to alert about the misconfiguration. +This provides defensive hardening. + +Signed-off-by: Deepakkumar Karn +Link: https://patch.msgid.link/20251211131211.308021-1-dkarn@redhat.com +Reviewed-by: Jan Kara +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/buffer.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/buffer.c b/fs/buffer.c +index 6a8752f7bbedb..b6b477ff7b75d 100644 +--- a/fs/buffer.c ++++ b/fs/buffer.c +@@ -2948,6 +2948,10 @@ bool try_to_free_buffers(struct folio *folio) + if (folio_test_writeback(folio)) + return false; + ++ /* Misconfigured folio check */ ++ if (WARN_ON_ONCE(!folio_buffers(folio))) ++ return true; ++ + if (mapping == NULL) { /* can this still happen? */ + ret = drop_buffers(folio, &buffers_to_free); + goto out; +-- +2.51.0 + diff --git a/queue-6.18/fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch b/queue-6.18/fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch new file mode 100644 index 00000000000..a09e37ba3c8 --- /dev/null +++ b/queue-6.18/fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch @@ -0,0 +1,45 @@ +From d0e5b7def9a78cab508de704b2e43266fab97820 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 16:07:32 +0100 +Subject: fs/ntfs3: avoid calling run_get_entry() when run == NULL in + ntfs_read_run_nb_ra() + +From: Konstantin Komarov + +[ Upstream commit c5226b96c08a010ebef5fdf4c90572bcd89e4299 ] + +When ntfs_read_run_nb_ra() is invoked with run == NULL the code later +assumes run is valid and may call run_get_entry(NULL, ...), and also +uses clen/idx without initializing them. Smatch reported uninitialized +variable warnings and this can lead to undefined behaviour. This patch +fixes it. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202512230646.v5hrYXL0-lkp@intel.com/ +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/fsntfs.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c +index ef0177b5c6cb0..83df92df1ee0c 100644 +--- a/fs/ntfs3/fsntfs.c ++++ b/fs/ntfs3/fsntfs.c +@@ -1252,6 +1252,12 @@ int ntfs_read_run_nb(struct ntfs_sb_info *sbi, const struct runs_tree *run, + + } while (len32); + ++ if (!run) { ++ err = -EINVAL; ++ goto out; ++ } ++ ++ /* Get next fragment to read. */ + vcn_next = vcn + clen; + if (!run_get_entry(run, ++idx, &vcn, &lcn, &clen) || + vcn != vcn_next) { +-- +2.51.0 + diff --git a/queue-6.18/fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch b/queue-6.18/fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch new file mode 100644 index 00000000000..8c7dbeabcff --- /dev/null +++ b/queue-6.18/fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch @@ -0,0 +1,58 @@ +From 293bc2f0bcef9807d6027a709be25f2df2c4906a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 19:59:59 +0900 +Subject: fs: ntfs3: check return value of indx_find to avoid infinite loop + +From: Jaehun Gou + +[ Upstream commit 1732053c8a6b360e2d5afb1b34fe9779398b072c ] + +We found an infinite loop bug in the ntfs3 file system that can lead to a +Denial-of-Service (DoS) condition. + +A malformed dentry in the ntfs3 filesystem can cause the kernel to hang +during the lookup operations. By setting the HAS_SUB_NODE flag in an +INDEX_ENTRY within a directory's INDEX_ALLOCATION block and manipulating the +VCN pointer, an attacker can cause the indx_find() function to repeatedly +read the same block, allocating 4 KB of memory each time. The kernel lacks +VCN loop detection and depth limits, causing memory exhaustion and an OOM +crash. + +This patch adds a return value check for fnd_push() to prevent a memory +exhaustion vulnerability caused by infinite loops. When the index exceeds the +size of the fnd->nodes array, fnd_push() returns -EINVAL. The indx_find() +function checks this return value and stops processing, preventing further +memory allocation. + +Co-developed-by: Seunghun Han +Signed-off-by: Seunghun Han +Co-developed-by: Jihoon Kwon +Signed-off-by: Jihoon Kwon +Signed-off-by: Jaehun Gou +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/index.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c +index 6d1bf890929d9..050b3709e0204 100644 +--- a/fs/ntfs3/index.c ++++ b/fs/ntfs3/index.c +@@ -1190,7 +1190,12 @@ int indx_find(struct ntfs_index *indx, struct ntfs_inode *ni, + return -EINVAL; + } + +- fnd_push(fnd, node, e); ++ err = fnd_push(fnd, node, e); ++ ++ if (err) { ++ put_indx_node(node); ++ return err; ++ } + } + + *entry = e; +-- +2.51.0 + diff --git a/queue-6.18/fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch b/queue-6.18/fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch new file mode 100644 index 00000000000..8bb71b60633 --- /dev/null +++ b/queue-6.18/fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch @@ -0,0 +1,38 @@ +From c55dac9624cffe791ba89c5b8107bb040088a6ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Dec 2025 14:27:48 +0300 +Subject: fs/ntfs3: drop preallocated clusters for sparse and compressed files + +From: Konstantin Komarov + +[ Upstream commit 3a6aba7f3cf2b46816e08548c254d98de9c74eba ] + +Do not keep preallocated clusters for sparsed and compressed files. +Preserving preallocation in these cases causes fsx failures when running +with sparse files and preallocation enabled. + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index f0ff85b7d76dc..5a7675112e7b8 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -448,8 +448,10 @@ int attr_set_size(struct ntfs_inode *ni, enum ATTR_TYPE type, + + is_ext = is_attr_ext(attr_b); + align = sbi->cluster_size; +- if (is_ext) ++ if (is_ext) { + align <<= attr_b->nres.c_unit; ++ keep_prealloc = false; ++ } + + old_valid = le64_to_cpu(attr_b->nres.valid_size); + old_size = le64_to_cpu(attr_b->nres.data_size); +-- +2.51.0 + diff --git a/queue-6.18/fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch b/queue-6.18/fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch new file mode 100644 index 00000000000..ea546837aff --- /dev/null +++ b/queue-6.18/fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch @@ -0,0 +1,83 @@ +From 271d9d90ae64143f19d4a44d035a039a6c96a873 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 20:01:09 +0900 +Subject: fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent + metadata + +From: Jaehun Gou + +[ Upstream commit 4b90f16e4bb5607fb35e7802eb67874038da4640 ] + +We found an infinite loop bug in the ntfs3 file system that can lead to a +Denial-of-Service (DoS) condition. + +A malformed NTFS image can cause an infinite loop when an attribute header +indicates an empty run list, while directory entries reference it as +containing actual data. In NTFS, setting evcn=-1 with svcn=0 is a valid way +to represent an empty run list, and run_unpack() correctly handles this by +checking if evcn + 1 equals svcn and returning early without parsing any run +data. However, this creates a problem when there is metadata inconsistency, +where the attribute header claims to be empty (evcn=-1) but the caller +expects to read actual data. When run_unpack() immediately returns success +upon seeing this condition, it leaves the runs_tree uninitialized with +run->runs as a NULL. The calling function attr_load_runs_range() assumes +that a successful return means that the runs were loaded and sets clen to 0, +expecting the next run_lookup_entry() call to succeed. Because runs_tree +remains uninitialized, run_lookup_entry() continues to fail, and the loop +increments vcn by zero (vcn += 0), leading to an infinite loop. + +This patch adds a retry counter to detect when run_lookup_entry() fails +consecutively after attr_load_runs_vcn(). If the run is still not found on +the second attempt, it indicates corrupted metadata and returns -EINVAL, +preventing the Denial-of-Service (DoS) vulnerability. + +Co-developed-by: Seunghun Han +Signed-off-by: Seunghun Han +Co-developed-by: Jihoon Kwon +Signed-off-by: Jihoon Kwon +Signed-off-by: Jaehun Gou +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index eced9013a8818..f0ff85b7d76dc 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -1354,19 +1354,28 @@ int attr_load_runs_range(struct ntfs_inode *ni, enum ATTR_TYPE type, + CLST vcn; + CLST vcn_last = (to - 1) >> cluster_bits; + CLST lcn, clen; +- int err; ++ int err = 0; ++ int retry = 0; + + for (vcn = from >> cluster_bits; vcn <= vcn_last; vcn += clen) { + if (!run_lookup_entry(run, vcn, &lcn, &clen, NULL)) { ++ if (retry != 0) { /* Next run_lookup_entry(vcn) also failed. */ ++ err = -EINVAL; ++ break; ++ } + err = attr_load_runs_vcn(ni, type, name, name_len, run, + vcn); + if (err) +- return err; ++ break; ++ + clen = 0; /* Next run_lookup_entry(vcn) must be success. */ ++ retry++; + } ++ else ++ retry = 0; + } + +- return 0; ++ return err; + } + + #ifdef CONFIG_NTFS3_LZX_XPRESS +-- +2.51.0 + diff --git a/queue-6.18/fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch b/queue-6.18/fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch new file mode 100644 index 00000000000..e134e4f1ebe --- /dev/null +++ b/queue-6.18/fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch @@ -0,0 +1,68 @@ +From 3b12d716b43f16bcc279502db47f3c7537489bd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 20:01:46 +0900 +Subject: fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST + +From: Jaehun Gou + +[ Upstream commit 06909b2549d631a47fcda249d34be26f7ca1711d ] + +We found an infinite loop bug in the ntfs3 file system that can lead to a +Denial-of-Service (DoS) condition. + +A malformed NTFS image can cause an infinite loop when an ATTR_LIST attribute +indicates a zero data size while the driver allocates memory for it. + +When ntfs_load_attr_list() processes a resident ATTR_LIST with data_size set +to zero, it still allocates memory because of al_aligned(0). This creates an +inconsistent state where ni->attr_list.size is zero, but ni->attr_list.le is +non-null. This causes ni_enum_attr_ex to incorrectly assume that no attribute +list exists and enumerates only the primary MFT record. When it finds +ATTR_LIST, the code reloads it and restarts the enumeration, repeating +indefinitely. The mount operation never completes, hanging the kernel thread. + +This patch adds validation to ensure that data_size is non-zero before memory +allocation. When a zero-sized ATTR_LIST is detected, the function returns +-EINVAL, preventing a DoS vulnerability. + +Co-developed-by: Seunghun Han +Signed-off-by: Seunghun Han +Co-developed-by: Jihoon Kwon +Signed-off-by: Jihoon Kwon +Signed-off-by: Jaehun Gou +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrlist.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/fs/ntfs3/attrlist.c b/fs/ntfs3/attrlist.c +index a4d74bed74fab..098bd7e8c3d64 100644 +--- a/fs/ntfs3/attrlist.c ++++ b/fs/ntfs3/attrlist.c +@@ -52,6 +52,11 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr) + + if (!attr->non_res) { + lsize = le32_to_cpu(attr->res.data_size); ++ if (!lsize) { ++ err = -EINVAL; ++ goto out; ++ } ++ + /* attr is resident: lsize < record_size (1K or 4K) */ + le = kvmalloc(al_aligned(lsize), GFP_KERNEL); + if (!le) { +@@ -66,6 +71,10 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr) + u16 run_off = le16_to_cpu(attr->nres.run_off); + + lsize = le64_to_cpu(attr->nres.data_size); ++ if (!lsize) { ++ err = -EINVAL; ++ goto out; ++ } + + run_init(&ni->attr_list.run); + +-- +2.51.0 + diff --git a/queue-6.18/gendwarfksyms-fix-build-on-32-bit-hosts.patch b/queue-6.18/gendwarfksyms-fix-build-on-32-bit-hosts.patch new file mode 100644 index 00000000000..6793e0d2339 --- /dev/null +++ b/queue-6.18/gendwarfksyms-fix-build-on-32-bit-hosts.patch @@ -0,0 +1,81 @@ +From 41507582feda27059805e6f26d511bc5f68b9e84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 20:38:07 +0000 +Subject: gendwarfksyms: Fix build on 32-bit hosts +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sami Tolvanen + +[ Upstream commit ddc54f912a551f6eb0bbcfc3880f45fe27a252cb ] + +We have interchangeably used unsigned long for some of the types +defined in elfutils, assuming they're always 64-bit. This obviously +fails when building gendwarfksyms on 32-bit hosts. Fix the types. + +Reported-by: Michal Suchánek +Closes: https://lore.kernel.org/linux-modules/aRcxzPxtJblVSh1y@kitsune.suse.cz/ +Tested-by: Michal Suchánek +Signed-off-by: Sami Tolvanen +Signed-off-by: Sasha Levin +--- + scripts/gendwarfksyms/dwarf.c | 4 +++- + scripts/gendwarfksyms/symbols.c | 5 +++-- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/scripts/gendwarfksyms/dwarf.c b/scripts/gendwarfksyms/dwarf.c +index 3538a7d9cb070..e76d732f5f602 100644 +--- a/scripts/gendwarfksyms/dwarf.c ++++ b/scripts/gendwarfksyms/dwarf.c +@@ -750,6 +750,7 @@ static void process_enumerator_type(struct state *state, struct die *cache, + Dwarf_Die *die) + { + bool overridden = false; ++ unsigned long override; + Dwarf_Word value; + + if (stable) { +@@ -761,7 +762,8 @@ static void process_enumerator_type(struct state *state, struct die *cache, + return; + + overridden = kabi_get_enumerator_value( +- state->expand.current_fqn, cache->fqn, &value); ++ state->expand.current_fqn, cache->fqn, &override); ++ value = override; + } + + process_list_comma(state, cache); +diff --git a/scripts/gendwarfksyms/symbols.c b/scripts/gendwarfksyms/symbols.c +index ecddcb5ffcdfb..42cd27c9cec4f 100644 +--- a/scripts/gendwarfksyms/symbols.c ++++ b/scripts/gendwarfksyms/symbols.c +@@ -3,6 +3,7 @@ + * Copyright (C) 2024 Google LLC + */ + ++#include + #include "gendwarfksyms.h" + + #define SYMBOL_HASH_BITS 12 +@@ -242,7 +243,7 @@ static void elf_for_each_global(int fd, elf_symbol_callback_t func, void *arg) + error("elf_getdata failed: %s", elf_errmsg(-1)); + + if (shdr->sh_entsize != sym_size) +- error("expected sh_entsize (%lu) to be %zu", ++ error("expected sh_entsize (%" PRIu64 ") to be %zu", + shdr->sh_entsize, sym_size); + + nsyms = shdr->sh_size / shdr->sh_entsize; +@@ -292,7 +293,7 @@ static void set_symbol_addr(struct symbol *sym, void *arg) + hash_add(symbol_addrs, &sym->addr_hash, + symbol_addr_hash(&sym->addr)); + +- debug("%s -> { %u, %lx }", sym->name, sym->addr.section, ++ debug("%s -> { %u, %" PRIx64 " }", sym->name, sym->addr.section, + sym->addr.address); + } else if (sym->addr.section != addr->section || + sym->addr.address != addr->address) { +-- +2.51.0 + diff --git a/queue-6.18/genirq-cpuhotplug-notify-about-affinity-changes-brea.patch b/queue-6.18/genirq-cpuhotplug-notify-about-affinity-changes-brea.patch new file mode 100644 index 00000000000..ee161fd0dee --- /dev/null +++ b/queue-6.18/genirq-cpuhotplug-notify-about-affinity-changes-brea.patch @@ -0,0 +1,123 @@ +From de366e3e6ba69a82358ac971dc00e9b6082747f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 22:37:27 +0800 +Subject: genirq/cpuhotplug: Notify about affinity changes breaking the + affinity mask + +From: Imran Khan + +[ Upstream commit dd9f6d30c64001ca4dde973ac04d8d155e856743 ] + +During CPU offlining the interrupts affined to that CPU are moved to other +online CPUs, which might break the original affinity mask if the outgoing +CPU was the last online CPU in that mask. This change is not propagated to +irq_desc::affinity_notify(), which leaves users of the affinity notifier +mechanism with stale information. + +Avoid this by scheduling affinity change notification work for interrupts +that were affined to the CPU being offlined, if the new target CPU is not +part of the original affinity mask. + +Since irq_set_affinity_locked() uses the same logic to schedule affinity +change notification work, split out this logic into a dedicated function +and use that at both places. + +[ tglx: Removed the EXPORT(), removed the !SMP stub, moved the prototype, + added a lockdep assert instead of a comment, fixed up coding style + and name space. Polished and clarified the change log ] + +Signed-off-by: Imran Khan +Signed-off-by: Thomas Gleixner +Link: https://patch.msgid.link/20260113143727.1041265-1-imran.f.khan@oracle.com +Signed-off-by: Sasha Levin +--- + kernel/irq/cpuhotplug.c | 6 ++++-- + kernel/irq/internals.h | 2 +- + kernel/irq/manage.c | 26 ++++++++++++++++++-------- + 3 files changed, 23 insertions(+), 11 deletions(-) + +diff --git a/kernel/irq/cpuhotplug.c b/kernel/irq/cpuhotplug.c +index 755346ea98196..cd5689e383b00 100644 +--- a/kernel/irq/cpuhotplug.c ++++ b/kernel/irq/cpuhotplug.c +@@ -177,9 +177,11 @@ void irq_migrate_all_off_this_cpu(void) + bool affinity_broken; + + desc = irq_to_desc(irq); +- scoped_guard(raw_spinlock, &desc->lock) ++ scoped_guard(raw_spinlock, &desc->lock) { + affinity_broken = migrate_one_irq(desc); +- ++ if (affinity_broken && desc->affinity_notify) ++ irq_affinity_schedule_notify_work(desc); ++ } + if (affinity_broken) { + pr_debug_ratelimited("IRQ %u: no longer affine to CPU%u\n", + irq, smp_processor_id()); +diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h +index 0164ca48da59e..5568ed3a8b852 100644 +--- a/kernel/irq/internals.h ++++ b/kernel/irq/internals.h +@@ -135,6 +135,7 @@ extern bool irq_can_set_affinity_usr(unsigned int irq); + + extern int irq_do_set_affinity(struct irq_data *data, + const struct cpumask *dest, bool force); ++extern void irq_affinity_schedule_notify_work(struct irq_desc *desc); + + #ifdef CONFIG_SMP + extern int irq_setup_affinity(struct irq_desc *desc); +@@ -142,7 +143,6 @@ extern int irq_setup_affinity(struct irq_desc *desc); + static inline int irq_setup_affinity(struct irq_desc *desc) { return 0; } + #endif + +- + #define for_each_action_of_desc(desc, act) \ + for (act = desc->action; act; act = act->next) + +diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c +index 400856abf6721..c09751b7a0c49 100644 +--- a/kernel/irq/manage.c ++++ b/kernel/irq/manage.c +@@ -347,6 +347,21 @@ static bool irq_set_affinity_deactivated(struct irq_data *data, + return true; + } + ++/** ++ * irq_affinity_schedule_notify_work - Schedule work to notify about affinity change ++ * @desc: Interrupt descriptor whose affinity changed ++ */ ++void irq_affinity_schedule_notify_work(struct irq_desc *desc) ++{ ++ lockdep_assert_held(&desc->lock); ++ ++ kref_get(&desc->affinity_notify->kref); ++ if (!schedule_work(&desc->affinity_notify->work)) { ++ /* Work was already scheduled, drop our extra ref */ ++ kref_put(&desc->affinity_notify->kref, desc->affinity_notify->release); ++ } ++} ++ + int irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask, + bool force) + { +@@ -367,14 +382,9 @@ int irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask, + irq_copy_pending(desc, mask); + } + +- if (desc->affinity_notify) { +- kref_get(&desc->affinity_notify->kref); +- if (!schedule_work(&desc->affinity_notify->work)) { +- /* Work was already scheduled, drop our extra ref */ +- kref_put(&desc->affinity_notify->kref, +- desc->affinity_notify->release); +- } +- } ++ if (desc->affinity_notify) ++ irq_affinity_schedule_notify_work(desc); ++ + irqd_set(data, IRQD_AFFINITY_SET); + + return ret; +-- +2.51.0 + diff --git a/queue-6.18/gfs2-fiemap-page-fault-fix.patch b/queue-6.18/gfs2-fiemap-page-fault-fix.patch new file mode 100644 index 00000000000..136d6efbde8 --- /dev/null +++ b/queue-6.18/gfs2-fiemap-page-fault-fix.patch @@ -0,0 +1,69 @@ +From e2b0d0ed0cd526caf69d2f8748922c5179d6d242 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Feb 2026 15:52:57 +0100 +Subject: gfs2: fiemap page fault fix + +From: Andreas Gruenbacher + +[ Upstream commit e411d74cc5ba290f85d0dd5e4d1df8f1d6d975d2 ] + +In gfs2_fiemap(), we are calling iomap_fiemap() while holding the inode +glock. This can lead to recursive glock taking if the fiemap buffer is +memory mapped to the same inode and accessing it triggers a page fault. + +Fix by disabling page faults for iomap_fiemap() and faulting in the +buffer by hand if necessary. + +Fixes xfstest generic/742. + +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/inode.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c +index 63d9fe7464344..03dd54fb7e8c8 100644 +--- a/fs/gfs2/inode.c ++++ b/fs/gfs2/inode.c +@@ -2192,6 +2192,14 @@ static int gfs2_getattr(struct mnt_idmap *idmap, + return 0; + } + ++static bool fault_in_fiemap(struct fiemap_extent_info *fi) ++{ ++ struct fiemap_extent __user *dest = fi->fi_extents_start; ++ size_t size = sizeof(*dest) * fi->fi_extents_max; ++ ++ return fault_in_safe_writeable((char __user *)dest, size) == 0; ++} ++ + static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, + u64 start, u64 len) + { +@@ -2201,14 +2209,22 @@ static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, + + inode_lock_shared(inode); + ++retry: + ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_SHARED, 0, &gh); + if (ret) + goto out; + ++ pagefault_disable(); + ret = iomap_fiemap(inode, fieinfo, start, len, &gfs2_iomap_ops); ++ pagefault_enable(); + + gfs2_glock_dq_uninit(&gh); + ++ if (ret == -EFAULT && fault_in_fiemap(fieinfo)) { ++ fieinfo->fi_extents_mapped = 0; ++ goto retry; ++ } ++ + out: + inode_unlock_shared(inode); + return ret; +-- +2.51.0 + diff --git a/queue-6.18/gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch b/queue-6.18/gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch new file mode 100644 index 00000000000..ebb4158a9af --- /dev/null +++ b/queue-6.18/gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch @@ -0,0 +1,56 @@ +From 2c7081f10b6de31211908b00235534d612a20d36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 17:26:26 +0800 +Subject: gpio: aspeed-sgpio: Change the macro to support deferred probe + +From: Billy Tsai + +[ Upstream commit e18533b023ec7a33488bcf33140ce69bbba2894f ] + +Use module_platform_driver() to replace module_platform_driver_probe(). +The former utilizes platform_driver_register(), which allows the driver to +defer probing when it doesn't acquire the necessary resources due to probe +order. In contrast, the latter uses __platform_driver_probe(), which +includes the comment "Note that this is incompatible with deferred +probing." Since our SGPIO driver requires access to the clock resource, the +former is more suitable. + +Reviewed-by: Linus Walleij +Signed-off-by: Billy Tsai +Link: https://lore.kernel.org/r/20260123-upstream_sgpio-v2-1-69cfd1631400@aspeedtech.com +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-aspeed-sgpio.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpio/gpio-aspeed-sgpio.c b/drivers/gpio/gpio-aspeed-sgpio.c +index 7622f9e9f54af..318cd0e397416 100644 +--- a/drivers/gpio/gpio-aspeed-sgpio.c ++++ b/drivers/gpio/gpio-aspeed-sgpio.c +@@ -516,7 +516,7 @@ static const struct of_device_id aspeed_sgpio_of_table[] = { + + MODULE_DEVICE_TABLE(of, aspeed_sgpio_of_table); + +-static int __init aspeed_sgpio_probe(struct platform_device *pdev) ++static int aspeed_sgpio_probe(struct platform_device *pdev) + { + u32 nr_gpios, sgpio_freq, sgpio_clk_div, gpio_cnt_regval, pin_mask; + const struct aspeed_sgpio_pdata *pdata; +@@ -611,11 +611,12 @@ static int __init aspeed_sgpio_probe(struct platform_device *pdev) + } + + static struct platform_driver aspeed_sgpio_driver = { ++ .probe = aspeed_sgpio_probe, + .driver = { + .name = KBUILD_MODNAME, + .of_match_table = aspeed_sgpio_of_table, + }, + }; + +-module_platform_driver_probe(aspeed_sgpio_driver, aspeed_sgpio_probe); ++module_platform_driver(aspeed_sgpio_driver); + MODULE_DESCRIPTION("Aspeed Serial GPIO Driver"); +-- +2.51.0 + diff --git a/queue-6.18/gpio-pca953x-add-support-for-tcal6408-tcal6416.patch b/queue-6.18/gpio-pca953x-add-support-for-tcal6408-tcal6416.patch new file mode 100644 index 00000000000..36aa35cf646 --- /dev/null +++ b/queue-6.18/gpio-pca953x-add-support-for-tcal6408-tcal6416.patch @@ -0,0 +1,73 @@ +From e03caac652425004ae786cfc3da37c8c635301c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 08:39:35 +0100 +Subject: gpio: pca953x: Add support for TCAL6408 TCAL6416 + +From: Jan Remmet + +[ Upstream commit a30a9cb9bca4296d25f253619883e7013b6be158 ] + +TCAL6408 and TCAL6416 supports latchable inputs and maskable interrupt. +Tested on a TCAL6416, checked datasheets for the TCAL6408. + +They use the same programming model ad the NXP PCAL64xx, but +support a lower supply power (1.08V to 3.6V) compared to PCAL +(1.65V to 5.5V) + +Datasheet: https://www.ti.com/lit/ds/symlink/tcal6408.pdf +Datasheet: https://www.ti.com/lit/ds/symlink/tcal6416.pdf + +Signed-off-by: Jan Remmet +Link: https://lore.kernel.org/r/20251216-wip-jremmet-tcal6416rtw-v2-3-6516d98a9836@phytec.de +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/Kconfig | 4 ++-- + drivers/gpio/gpio-pca953x.c | 6 ++++++ + 2 files changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig +index e053524c5e35f..4d644dcecad93 100644 +--- a/drivers/gpio/Kconfig ++++ b/drivers/gpio/Kconfig +@@ -1194,11 +1194,11 @@ config GPIO_PCA953X + + 8 bits: max7310, max7315, pca6107, pca9534, pca9538, pca9554, + pca9556, pca9557, pca9574, tca6408, tca9554, xra1202, +- pcal6408, pcal9554b, tca9538 ++ pcal6408, pcal9554b, tca9538, tcal6408 + + 16 bits: max7312, max7313, pca9535, pca9539, pca9555, pca9575, + tca6416, pca6416, pcal6416, pcal9535, pcal9555a, max7318, +- tca9539 ++ tca9539, tcal6416 + + 18 bits: tca6418 + +diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c +index 34cadce9b3101..f7daeadaea57c 100644 +--- a/drivers/gpio/gpio-pca953x.c ++++ b/drivers/gpio/gpio-pca953x.c +@@ -126,6 +126,9 @@ static const struct i2c_device_id pca953x_id[] = { + { "tca9539", 16 | PCA953X_TYPE | PCA_INT, }, + { "tca9554", 8 | PCA953X_TYPE | PCA_INT, }, + { "xra1202", 8 | PCA953X_TYPE }, ++ ++ { "tcal6408", 8 | PCA953X_TYPE | PCA_LATCH_INT, }, ++ { "tcal6416", 16 | PCA953X_TYPE | PCA_LATCH_INT, }, + { } + }; + MODULE_DEVICE_TABLE(i2c, pca953x_id); +@@ -1466,6 +1469,9 @@ static const struct of_device_id pca953x_dt_ids[] = { + { .compatible = "ti,tca9538", .data = OF_953X( 8, PCA_INT), }, + { .compatible = "ti,tca9539", .data = OF_953X(16, PCA_INT), }, + ++ { .compatible = "ti,tcal6408", .data = OF_953X( 8, PCA_LATCH_INT), }, ++ { .compatible = "ti,tcal6416", .data = OF_953X(16, PCA_LATCH_INT), }, ++ + { .compatible = "onnn,cat9554", .data = OF_953X( 8, PCA_INT), }, + { .compatible = "onnn,pca9654", .data = OF_953X( 8, PCA_INT), }, + { .compatible = "onnn,pca9655", .data = OF_953X(16, PCA_INT), }, +-- +2.51.0 + diff --git a/queue-6.18/gpu-panel-edp-add-auo-panel-entry-for-b140han06.4.patch b/queue-6.18/gpu-panel-edp-add-auo-panel-entry-for-b140han06.4.patch new file mode 100644 index 00000000000..a4614167e30 --- /dev/null +++ b/queue-6.18/gpu-panel-edp-add-auo-panel-entry-for-b140han06.4.patch @@ -0,0 +1,53 @@ +From 88cd0c204a70eb26fb0946a415dbf3d08e4e506b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Dec 2025 07:45:55 +0000 +Subject: gpu/panel-edp: add AUO panel entry for B140HAN06.4 + +From: Alexey Klimov + +[ Upstream commit 2976aeb0de77da599ad37691963efbdcb07435ce ] + +Add an eDP panel entry for AUO B140HAN06.4 that is also used in +some variants of Lenovo Flex 5G with Qcom SC8180 SoC. + +The raw edid of the panel is: + +00 ff ff ff ff ff ff 00 06 af 3d 64 00 00 00 00 +2b 1d 01 04 a5 1f 11 78 03 b8 1a a6 54 4a 9b 26 +0e 52 55 00 00 00 01 01 01 01 01 01 01 01 01 01 +01 01 01 01 01 01 14 37 80 b8 70 38 24 40 10 10 +3e 00 35 ae 10 00 00 18 10 2c 80 b8 70 38 24 40 +10 10 3e 00 35 ae 10 00 00 18 00 00 00 fe 00 41 +55 4f 0a 20 20 20 20 20 20 20 20 20 00 00 00 fe +00 42 31 34 30 48 41 4e 30 36 2e 34 20 0a 00 eb + +I do not have access to the datasheet and but it is tested on above +mentioned laptop for a few weeks and seems to work just fine with +timing info of similar panels. + +Cc: Bjorn Andersson +Cc: Vinod Koul +Signed-off-by: Alexey Klimov +Reviewed-by: Douglas Anderson +Signed-off-by: Douglas Anderson +Link: https://patch.msgid.link/20251203074555.690613-1-alexey.klimov@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-edp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c +index 62435e3cd9f4d..aad5838cd700a 100644 +--- a/drivers/gpu/drm/panel/panel-edp.c ++++ b/drivers/gpu/drm/panel/panel-edp.c +@@ -1903,6 +1903,7 @@ static const struct edp_panel_entry edp_panels[] = { + EDP_PANEL_ENTRY('A', 'U', 'O', 0x615c, &delay_200_500_e50, "B116XAN06.1"), + EDP_PANEL_ENTRY('A', 'U', 'O', 0x635c, &delay_200_500_e50, "B116XAN06.3"), + EDP_PANEL_ENTRY('A', 'U', 'O', 0x639c, &delay_200_500_e50, "B140HAK02.7"), ++ EDP_PANEL_ENTRY('A', 'U', 'O', 0x643d, &delay_200_500_e50, "B140HAN06.4"), + EDP_PANEL_ENTRY('A', 'U', 'O', 0x723c, &delay_200_500_e50, "B140XTN07.2"), + EDP_PANEL_ENTRY('A', 'U', 'O', 0x73aa, &delay_200_500_e50, "B116XTN02.3"), + EDP_PANEL_ENTRY('A', 'U', 'O', 0x8594, &delay_200_500_e50, "B133UAN01.0"), +-- +2.51.0 + diff --git a/queue-6.18/gro-change-the-bug_on-in-gro_pull_from_frag0.patch b/queue-6.18/gro-change-the-bug_on-in-gro_pull_from_frag0.patch new file mode 100644 index 00000000000..ce023f4f1ba --- /dev/null +++ b/queue-6.18/gro-change-the-bug_on-in-gro_pull_from_frag0.patch @@ -0,0 +1,46 @@ +From 91a4fdce42b95bcf89c66b16101be9e02926d0d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 04:57:17 +0000 +Subject: gro: change the BUG_ON() in gro_pull_from_frag0() + +From: Eric Dumazet + +[ Upstream commit cbe41362be2c27e0237a94a404ae413cec9c2ad9 ] + +Replace the BUG_ON() which never fired with a DEBUG_NET_WARN_ON_ONCE() + +$ scripts/bloat-o-meter -t vmlinux.1 vmlinux.2 +add/remove: 2/2 grow/shrink: 1/1 up/down: 370/-254 (116) +Function old new delta +gro_try_pull_from_frag0 - 196 +196 +napi_gro_frags 771 929 +158 +__pfx_gro_try_pull_from_frag0 - 16 +16 +__pfx_gro_pull_from_frag0 16 - -16 +dev_gro_receive 1514 1464 -50 +gro_pull_from_frag0 188 - -188 +Total: Before=22565899, After=22566015, chg +0.00% + +Signed-off-by: Eric Dumazet +Link: https://patch.msgid.link/20260122045720.1221017-3-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/gro.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/gro.c b/net/core/gro.c +index 482fa7d7f5981..ef61695fbdbb6 100644 +--- a/net/core/gro.c ++++ b/net/core/gro.c +@@ -417,7 +417,7 @@ static void gro_pull_from_frag0(struct sk_buff *skb, int grow) + { + struct skb_shared_info *pinfo = skb_shinfo(skb); + +- BUG_ON(skb->end - skb->tail < grow); ++ DEBUG_NET_WARN_ON_ONCE(skb->end - skb->tail < grow); + + memcpy(skb_tail_pointer(skb), NAPI_GRO_CB(skb)->frag0, grow); + +-- +2.51.0 + diff --git a/queue-6.18/hfsplus-fix-volume-corruption-issue-for-generic-480.patch b/queue-6.18/hfsplus-fix-volume-corruption-issue-for-generic-480.patch new file mode 100644 index 00000000000..854ede4f8f5 --- /dev/null +++ b/queue-6.18/hfsplus-fix-volume-corruption-issue-for-generic-480.patch @@ -0,0 +1,256 @@ +From b22b6e64e267772b74c478792cf0931a364b1ee3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Dec 2025 16:00:55 -0800 +Subject: hfsplus: fix volume corruption issue for generic/480 + +From: Viacheslav Dubeyko + +[ Upstream commit bea4429eb30190c59b5ac7c8ff6c90176c7c110f ] + +The xfstests' test-case generic/480 leaves HFS+ volume +in corrupted state: + +sudo ./check generic/480 +FSTYP -- hfsplus +PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.17.0-rc1+ #4 SMP PREEMPT_DYNAMIC Wed Oct 1 15:02:44 PDT 2025 +MKFS_OPTIONS -- /dev/loop51 +MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch + +generic/480 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent +(see XFSTESTS-2/xfstests-dev/results//generic/480.full for details) + +Ran: generic/480 +Failures: generic/480 +Failed 1 of 1 tests + +sudo fsck.hfsplus -d /dev/loop51 +** /dev/loop51 +Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K. +Executing fsck_hfs (version 540.1-Linux). +** Checking non-journaled HFS Plus Volume. +The volume name is untitled +** Checking extents overflow file. +** Checking catalog file. +** Checking multi-linked files. +CheckHardLinks: found 1 pre-Leopard file inodes. +Incorrect number of file hard links +** Checking catalog hierarchy. +** Checking extended attributes file. +** Checking volume bitmap. +** Checking volume information. +invalid VHB nextCatalogID +Volume header needs minor repair +(2, 0) +Verify Status: VIStat = 0x8000, ABTStat = 0x0000 EBTStat = 0x0000 +CBTStat = 0x0000 CatStat = 0x00000002 +** Repairing volume. +Incorrect flags for file hard link (id = 19) +(It should be 0x22 instead of 0x2) +Incorrect flags for file inode (id = 18) +(It should be 0x22 instead of 0x2) +first link ID=0 is < 16 for fileinode=18 +Error getting first link ID for inode = 18 (result=2) +Invalid first link in hard link chain (id = 18) +(It should be 19 instead of 0) +Indirect node 18 needs link count adjustment +(It should be 1 instead of 2) +** Rechecking volume. +** Checking non-journaled HFS Plus Volume. +The volume name is untitled +** Checking extents overflow file. +** Checking catalog file. +** Checking multi-linked files. +** Checking catalog hierarchy. +** Checking extended attributes file. +** Checking volume bitmap. +** Checking volume information. +** The volume untitled was repaired successfully. + +The generic/480 test executes such steps on final phase: + +"Now remove of the links of our file and create +a new file with the same name and in the same +parent directory, and finally fsync this new file." + +unlink $SCRATCH_MNT/testdir/bar +touch $SCRATCH_MNT/testdir/bar +$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/testdir/bar + +"Simulate a power failure and mount the filesystem +to check that replaying the fsync log/journal +succeeds, that is the mount operation does not fail." + +_flakey_drop_and_remount + +The key issue in HFS+ logic is that hfsplus_link(), +hfsplus_unlink(), hfsplus_rmdir(), hfsplus_symlink(), +and hfsplus_mknod() methods don't call +hfsplus_cat_write_inode() for the case of modified +inode objects. As a result, even if hfsplus_file_fsync() +is trying to flush the dirty Catalog File, but because of +not calling hfsplus_cat_write_inode() not all modified +inodes save the new state into Catalog File's records. +Finally, simulation of power failure results in inconsistent +state of Catalog File and FSCK tool reports about +volume corruption. + +This patch adds calling of hfsplus_cat_write_inode() +method for modified inodes in hfsplus_link(), +hfsplus_unlink(), hfsplus_rmdir(), hfsplus_symlink(), +and hfsplus_mknod() methods. Also, it adds debug output +in several methods. + +sudo ./check generic/480 +FSTYP -- hfsplus +PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #18 SMP PREEMPT_DYNAMIC Thu Dec 4 12:24:45 PST 2025 +MKFS_OPTIONS -- /dev/loop51 +MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch + +generic/480 16s ... 16s +Ran: generic/480 +Passed all 1 tests + +Signed-off-by: Viacheslav Dubeyko +cc: John Paul Adrian Glaubitz +cc: Yangtao Li +cc: linux-fsdevel@vger.kernel.org +Link: https://lore.kernel.org/r/20251205000054.3670326-1-slava@dubeyko.com +Signed-off-by: Viacheslav Dubeyko +Signed-off-by: Sasha Levin +--- + fs/hfsplus/dir.c | 46 +++++++++++++++++++++++++++++++++++++++++++++- + fs/hfsplus/inode.c | 5 +++++ + 2 files changed, 50 insertions(+), 1 deletion(-) + +diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c +index cadf0b5f93422..ca5f74a140ec1 100644 +--- a/fs/hfsplus/dir.c ++++ b/fs/hfsplus/dir.c +@@ -313,6 +313,9 @@ static int hfsplus_link(struct dentry *src_dentry, struct inode *dst_dir, + if (!S_ISREG(inode->i_mode)) + return -EPERM; + ++ hfs_dbg("src_dir->i_ino %lu, dst_dir->i_ino %lu, inode->i_ino %lu\n", ++ src_dir->i_ino, dst_dir->i_ino, inode->i_ino); ++ + mutex_lock(&sbi->vh_mutex); + if (inode->i_ino == (u32)(unsigned long)src_dentry->d_fsdata) { + for (;;) { +@@ -332,7 +335,7 @@ static int hfsplus_link(struct dentry *src_dentry, struct inode *dst_dir, + cnid = sbi->next_cnid++; + src_dentry->d_fsdata = (void *)(unsigned long)cnid; + res = hfsplus_create_cat(cnid, src_dir, +- &src_dentry->d_name, inode); ++ &src_dentry->d_name, inode); + if (res) + /* panic? */ + goto out; +@@ -350,6 +353,21 @@ static int hfsplus_link(struct dentry *src_dentry, struct inode *dst_dir, + mark_inode_dirty(inode); + sbi->file_count++; + hfsplus_mark_mdb_dirty(dst_dir->i_sb); ++ ++ res = hfsplus_cat_write_inode(src_dir); ++ if (res) ++ goto out; ++ ++ res = hfsplus_cat_write_inode(dst_dir); ++ if (res) ++ goto out; ++ ++ res = hfsplus_cat_write_inode(sbi->hidden_dir); ++ if (res) ++ goto out; ++ ++ res = hfsplus_cat_write_inode(inode); ++ + out: + mutex_unlock(&sbi->vh_mutex); + return res; +@@ -367,6 +385,9 @@ static int hfsplus_unlink(struct inode *dir, struct dentry *dentry) + if (HFSPLUS_IS_RSRC(inode)) + return -EPERM; + ++ hfs_dbg("dir->i_ino %lu, inode->i_ino %lu\n", ++ dir->i_ino, inode->i_ino); ++ + mutex_lock(&sbi->vh_mutex); + cnid = (u32)(unsigned long)dentry->d_fsdata; + if (inode->i_ino == cnid && +@@ -408,6 +429,15 @@ static int hfsplus_unlink(struct inode *dir, struct dentry *dentry) + inode_set_ctime_current(inode); + mark_inode_dirty(inode); + out: ++ if (!res) { ++ res = hfsplus_cat_write_inode(dir); ++ if (!res) { ++ res = hfsplus_cat_write_inode(sbi->hidden_dir); ++ if (!res) ++ res = hfsplus_cat_write_inode(inode); ++ } ++ } ++ + mutex_unlock(&sbi->vh_mutex); + return res; + } +@@ -429,6 +459,8 @@ static int hfsplus_rmdir(struct inode *dir, struct dentry *dentry) + inode_set_ctime_current(inode); + hfsplus_delete_inode(inode); + mark_inode_dirty(inode); ++ ++ res = hfsplus_cat_write_inode(dir); + out: + mutex_unlock(&sbi->vh_mutex); + return res; +@@ -465,6 +497,12 @@ static int hfsplus_symlink(struct mnt_idmap *idmap, struct inode *dir, + + hfsplus_instantiate(dentry, inode, inode->i_ino); + mark_inode_dirty(inode); ++ ++ res = hfsplus_cat_write_inode(dir); ++ if (res) ++ goto out; ++ ++ res = hfsplus_cat_write_inode(inode); + goto out; + + out_err: +@@ -506,6 +544,12 @@ static int hfsplus_mknod(struct mnt_idmap *idmap, struct inode *dir, + + hfsplus_instantiate(dentry, inode, inode->i_ino); + mark_inode_dirty(inode); ++ ++ res = hfsplus_cat_write_inode(dir); ++ if (res) ++ goto out; ++ ++ res = hfsplus_cat_write_inode(inode); + goto out; + + failed_mknod: +diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c +index 7ae6745ca7ae1..c762bf909d1aa 100644 +--- a/fs/hfsplus/inode.c ++++ b/fs/hfsplus/inode.c +@@ -328,6 +328,9 @@ int hfsplus_file_fsync(struct file *file, loff_t start, loff_t end, + struct hfsplus_vh *vhdr = sbi->s_vhdr; + int error = 0, error2; + ++ hfs_dbg("inode->i_ino %lu, start %llu, end %llu\n", ++ inode->i_ino, start, end); ++ + error = file_write_and_wait_range(file, start, end); + if (error) + return error; +@@ -616,6 +619,8 @@ int hfsplus_cat_write_inode(struct inode *inode) + hfsplus_cat_entry entry; + int res = 0; + ++ hfs_dbg("inode->i_ino %lu\n", inode->i_ino); ++ + if (HFSPLUS_IS_RSRC(inode)) + main_inode = HFSPLUS_I(inode)->rsrc_inode; + +-- +2.51.0 + diff --git a/queue-6.18/hfsplus-fix-volume-corruption-issue-for-generic-498.patch b/queue-6.18/hfsplus-fix-volume-corruption-issue-for-generic-498.patch new file mode 100644 index 00000000000..afe81e776a5 --- /dev/null +++ b/queue-6.18/hfsplus-fix-volume-corruption-issue-for-generic-498.patch @@ -0,0 +1,150 @@ +From d66074ecf8359c40fc6fffa7b4d51fd7a2342c84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Dec 2025 19:58:22 -0800 +Subject: hfsplus: fix volume corruption issue for generic/498 + +From: Viacheslav Dubeyko + +[ Upstream commit 9a8c4ad44721da4c48e1ff240ac76286c82837fe ] + +The xfstests' test-case generic/498 leaves HFS+ volume +in corrupted state: + +sudo ./check generic/498 +FSTYP -- hfsplus +PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #18 SMP PREEMPT_DYNAMIC Thu Dec 4 12:24:45 PST 2025 +MKFS_OPTIONS -- /dev/loop51 +MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch + +generic/498 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent +(see XFSTESTS-2/xfstests-dev/results//generic/498.full for details) + +Ran: generic/498 +Failures: generic/498 +Failed 1 of 1 tests + +sudo fsck.hfsplus -d /dev/loop51 +** /dev/loop51 +Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K. +Executing fsck_hfs (version 540.1-Linux). +** Checking non-journaled HFS Plus Volume. +The volume name is untitled +** Checking extents overflow file. +** Checking catalog file. +Invalid leaf record count +(It should be 16 instead of 2) +** Checking multi-linked files. +CheckHardLinks: found 1 pre-Leopard file inodes. +** Checking catalog hierarchy. +** Checking extended attributes file. +** Checking volume bitmap. +** Checking volume information. +Verify Status: VIStat = 0x0000, ABTStat = 0x0000 EBTStat = 0x0000 +CBTStat = 0x8000 CatStat = 0x00000000 +** Repairing volume. +** Rechecking volume. +** Checking non-journaled HFS Plus Volume. +The volume name is untitled +** Checking extents overflow file. +** Checking catalog file. +** Checking multi-linked files. +CheckHardLinks: found 1 pre-Leopard file inodes. +** Checking catalog hierarchy. +** Checking extended attributes file. +** Checking volume bitmap. +** Checking volume information. +** The volume untitled was repaired successfully. + +The generic/498 test executes such steps on final phase: + +mkdir $SCRATCH_MNT/A +mkdir $SCRATCH_MNT/B +mkdir $SCRATCH_MNT/A/C +touch $SCRATCH_MNT/B/foo +$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/B/foo + +ln $SCRATCH_MNT/B/foo $SCRATCH_MNT/A/C/foo +$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/A + +"Simulate a power failure and mount the filesystem +to check that what we explicitly fsync'ed exists." + +_flakey_drop_and_remount + +The FSCK tool complains about "Invalid leaf record count". +HFS+ b-tree header contains leaf_count field is updated +by hfs_brec_insert() and hfs_brec_remove(). The hfs_brec_insert() +is involved into hard link creation process. However, +modified in-core leaf_count field is stored into HFS+ +b-tree header by hfs_btree_write() method. But, +unfortunately, hfs_btree_write() hasn't been called +by hfsplus_cat_write_inode() and hfsplus_file_fsync() +stores not fully consistent state of the Catalog File's +b-tree. + +This patch adds calling hfs_btree_write() method in +the hfsplus_cat_write_inode() with the goal of +storing consistent state of Catalog File's b-tree. +Finally, it makes FSCK tool happy. + +sudo ./check generic/498 +FSTYP -- hfsplus +PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #22 SMP PREEMPT_DYNAMIC Sat Dec 6 17:01:31 PST 2025 +MKFS_OPTIONS -- /dev/loop51 +MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch + +generic/498 33s ... 31s +Ran: generic/498 +Passed all 1 tests + +Signed-off-by: Viacheslav Dubeyko +cc: John Paul Adrian Glaubitz +cc: Yangtao Li +cc: linux-fsdevel@vger.kernel.org +Link: https://lore.kernel.org/r/20251207035821.3863657-1-slava@dubeyko.com +Signed-off-by: Viacheslav Dubeyko +Signed-off-by: Sasha Levin +--- + fs/hfsplus/inode.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c +index c762bf909d1aa..6153e5cc6eb65 100644 +--- a/fs/hfsplus/inode.c ++++ b/fs/hfsplus/inode.c +@@ -615,6 +615,7 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd) + int hfsplus_cat_write_inode(struct inode *inode) + { + struct inode *main_inode = inode; ++ struct hfs_btree *tree = HFSPLUS_SB(inode->i_sb)->cat_tree; + struct hfs_find_data fd; + hfsplus_cat_entry entry; + int res = 0; +@@ -627,7 +628,7 @@ int hfsplus_cat_write_inode(struct inode *inode) + if (!main_inode->i_nlink) + return 0; + +- if (hfs_find_init(HFSPLUS_SB(main_inode->i_sb)->cat_tree, &fd)) ++ if (hfs_find_init(tree, &fd)) + /* panic? */ + return -EIO; + +@@ -692,6 +693,15 @@ int hfsplus_cat_write_inode(struct inode *inode) + set_bit(HFSPLUS_I_CAT_DIRTY, &HFSPLUS_I(inode)->flags); + out: + hfs_find_exit(&fd); ++ ++ if (!res) { ++ res = hfs_btree_write(tree); ++ if (res) { ++ pr_err("b-tree write err: %d, ino %lu\n", ++ res, inode->i_ino); ++ } ++ } ++ + return res; + } + +-- +2.51.0 + diff --git a/queue-6.18/hfsplus-pretend-special-inodes-as-regular-files.patch b/queue-6.18/hfsplus-pretend-special-inodes-as-regular-files.patch new file mode 100644 index 00000000000..859dbd8c317 --- /dev/null +++ b/queue-6.18/hfsplus-pretend-special-inodes-as-regular-files.patch @@ -0,0 +1,45 @@ +From 03f978ac5edb2ac18727c771330eeb50621bb1b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 18:39:33 +0900 +Subject: hfsplus: pretend special inodes as regular files + +From: Tetsuo Handa + +[ Upstream commit ed8889ca21b6ab37bc1435c4009ce37a79acb9e6 ] + +Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()") +requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/ +S_IFIFO/S_IFSOCK type, use S_IFREG for special inodes. + +Reported-by: syzbot +Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d +Signed-off-by: Tetsuo Handa +Reviewed-by: Viacheslav Dubeyko +Signed-off-by: Viacheslav Dubeyko +Link: https://lore.kernel.org/r/d0a07b1b-8b73-4002-8e29-e2bd56871262@I-love.SAKURA.ne.jp +Signed-off-by: Viacheslav Dubeyko +Signed-off-by: Sasha Levin +--- + fs/hfsplus/super.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c +index 67a7a2a093476..bb819ae608fd9 100644 +--- a/fs/hfsplus/super.c ++++ b/fs/hfsplus/super.c +@@ -53,6 +53,12 @@ static int hfsplus_system_read_inode(struct inode *inode) + return -EIO; + } + ++ /* ++ * Assign a dummy file type, for may_open() requires that ++ * an inode has a valid file type. ++ */ ++ inode->i_mode = S_IFREG; ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.18/hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch b/queue-6.18/hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch new file mode 100644 index 00000000000..faf65da2d79 --- /dev/null +++ b/queue-6.18/hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch @@ -0,0 +1,37 @@ +From 664457398612faee3da7d5d689f0a7e85467cf3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Nov 2025 06:06:23 +0000 +Subject: HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple + keyboards + +From: Joey Bednar + +[ Upstream commit 7273acfd0aef106093a8ffa3b4973eb70e5a3799 ] + +The SoNiX KN85 keyboard identifies as the "Apple, Inc. Aluminium +Keyboard" and is not recognized as a non-apple keyboard. Adding "SoNiX +KN85 Keyboard" to the list of non-apple keyboards fixes the function +keys. + +Signed-off-by: Joey Bednar +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-apple.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c +index 57da4f86a9fa7..233e367cce1d1 100644 +--- a/drivers/hid/hid-apple.c ++++ b/drivers/hid/hid-apple.c +@@ -354,6 +354,7 @@ static const struct apple_key_translation swapped_fn_leftctrl_keys[] = { + }; + + static const struct apple_non_apple_keyboard non_apple_keyboards[] = { ++ { "SONiX KN85 Keyboard" }, + { "SONiX USB DEVICE" }, + { "SONiX AK870 PRO" }, + { "Keychron" }, +-- +2.51.0 + diff --git a/queue-6.18/hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch b/queue-6.18/hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch new file mode 100644 index 00000000000..3a3d10359ac --- /dev/null +++ b/queue-6.18/hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch @@ -0,0 +1,141 @@ +From 1726dc8bab514f3cae432a720b9ee0358968477f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 12:56:09 +0900 +Subject: HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK + +From: David Phillips + +[ Upstream commit b8e5fdf0bd022cd5493a5987ef66f5a24f8352d8 ] + +New model in the ELECOM HUGE trackball line that has 8 buttons but the +report descriptor specifies only 5. The HUGE Plus supports connecting via +Bluetooth, 2.4GHz wireless USB dongle, and directly via a USB-C cable. +Each connection type reports a different device id, 01AA for cable, +01AB for USB dongle, and 01AC for Bluetooth. + +This patch adds these device IDs and applies the fixups similar to the +other ELECOM devices to get all 8 buttons working for all 3 connection +types. + +For reference, the usbhid-dump output: +001:013:001:DESCRIPTOR 1769085639.598405 + 05 01 09 02 A1 01 85 01 09 01 A1 00 05 09 19 01 + 29 05 15 00 25 01 75 01 95 05 81 02 75 03 95 01 + 81 01 05 01 09 30 09 31 16 01 80 26 FF 7F 75 10 + 95 02 81 06 09 38 15 81 25 7F 75 08 95 01 81 06 + 05 0C 0A 38 02 15 81 25 7F 75 08 95 01 81 06 C0 + C0 05 0C 09 01 A1 01 85 02 15 01 26 8C 02 19 01 + 2A 8C 02 75 10 95 01 81 00 C0 05 01 09 80 A1 01 + 85 03 09 82 09 81 09 83 15 00 25 01 19 01 29 03 + 75 01 95 03 81 02 95 05 81 01 C0 06 01 FF 09 00 + A1 01 85 08 09 00 15 00 26 FF 00 75 08 95 07 81 + 02 C0 06 02 FF 09 02 A1 01 85 06 09 02 15 00 26 + FF 00 75 08 95 07 B1 02 C0 + +Signed-off-by: David Phillips +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/Kconfig | 1 + + drivers/hid/hid-elecom.c | 16 ++++++++++++++++ + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/hid-quirks.c | 3 +++ + 4 files changed, 23 insertions(+) + +diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig +index 04420a713be08..03ad8b5c29a4d 100644 +--- a/drivers/hid/Kconfig ++++ b/drivers/hid/Kconfig +@@ -369,6 +369,7 @@ config HID_ELECOM + - EX-G Trackballs (M-XT3DRBK, M-XT3URBK) + - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK) + - HUGE Trackballs (M-HT1DRBK, M-HT1URBK) ++ - HUGE Plus Trackball (M-HT1MRBK) + + config HID_ELO + tristate "ELO USB 4000/4500 touchscreen" +diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c +index 2003d2dcda7cc..37d88ce57f671 100644 +--- a/drivers/hid/hid-elecom.c ++++ b/drivers/hid/hid-elecom.c +@@ -5,6 +5,7 @@ + * - EX-G Trackballs (M-XT3DRBK, M-XT3URBK, M-XT4DRBK) + * - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK) + * - HUGE Trackballs (M-HT1DRBK, M-HT1URBK) ++ * - HUGE Plus Trackball (M-HT1MRBK) + * + * Copyright (c) 2010 Richard Nauber + * Copyright (c) 2016 Yuxuan Shui +@@ -123,12 +124,25 @@ static const __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc, + */ + mouse_button_fixup(hdev, rdesc, *rsize, 22, 30, 24, 16, 8); + break; ++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK: ++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB: ++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC: ++ /* ++ * Report descriptor format: ++ * 24: button bit count ++ * 28: padding bit count ++ * 22: button report size ++ * 16: button usage maximum ++ */ ++ mouse_button_fixup(hdev, rdesc, *rsize, 24, 28, 22, 16, 8); ++ break; + } + return rdesc; + } + + static const struct hid_device_id elecom_devices[] = { + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, ++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, +@@ -142,6 +156,8 @@ static const struct hid_device_id elecom_devices[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK_019B) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) }, + { } + }; + MODULE_DEVICE_TABLE(hid, elecom_devices); +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 240fcff0ca71e..f5715cf9468fc 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -466,6 +466,9 @@ + #define USB_DEVICE_ID_ELECOM_M_HT1URBK_019B 0x019b + #define USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D 0x010d + #define USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C 0x011c ++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK 0x01aa ++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB 0x01ab ++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC 0x01ac + + #define USB_VENDOR_ID_DREAM_CHEEKY 0x1d34 + #define USB_DEVICE_ID_DREAM_CHEEKY_WN 0x0004 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 11438039cdb7f..3217e436c052c 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -420,6 +420,7 @@ static const struct hid_device_id hid_have_special_driver[] = { + #if IS_ENABLED(CONFIG_HID_ELECOM) + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, ++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK_00FC) }, +@@ -432,6 +433,8 @@ static const struct hid_device_id hid_have_special_driver[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK_019B) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) }, + #endif + #if IS_ENABLED(CONFIG_HID_ELO) + { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) }, +-- +2.51.0 + diff --git a/queue-6.18/hid-i2c-hid-add-focaltech-ft8112.patch b/queue-6.18/hid-i2c-hid-add-focaltech-ft8112.patch new file mode 100644 index 00000000000..b9215465d14 --- /dev/null +++ b/queue-6.18/hid-i2c-hid-add-focaltech-ft8112.patch @@ -0,0 +1,55 @@ +From 7984ea50a6dd5ee90d63d55845064f278e8cf511 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 17:40:41 +0800 +Subject: HID: i2c-hid: Add FocalTech FT8112 + +From: Daniel Peng + +[ Upstream commit 3d9586f1f90c9101b1abf5b0e9d70ca45f5f16db ] + +Information for touchscreen model HKO/RB116AS01-2 as below: +- HID :FTSC1000 +- slave address:0X38 +- Interface:HID over I2C +- Touch control lC:FT8112 +- I2C ID: PNP0C50 + +Signed-off-by: Daniel Peng +Acked-by: Jiri Kosina +Reviewed-by: Douglas Anderson +Link: https://patch.msgid.link/20251117094041.300083-2-Daniel_Peng@pegatron.corp-partner.google.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/hid/i2c-hid/i2c-hid-of-elan.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/hid/i2c-hid/i2c-hid-of-elan.c b/drivers/hid/i2c-hid/i2c-hid-of-elan.c +index 0215f217f6d86..b81fcc6ff49ee 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-of-elan.c ++++ b/drivers/hid/i2c-hid/i2c-hid-of-elan.c +@@ -168,6 +168,13 @@ static const struct elan_i2c_hid_chip_data elan_ekth6a12nay_chip_data = { + .power_after_backlight = true, + }; + ++static const struct elan_i2c_hid_chip_data focaltech_ft8112_chip_data = { ++ .post_power_delay_ms = 10, ++ .post_gpio_reset_on_delay_ms = 150, ++ .hid_descriptor_address = 0x0001, ++ .main_supply_name = "vcc33", ++}; ++ + static const struct elan_i2c_hid_chip_data ilitek_ili9882t_chip_data = { + .post_power_delay_ms = 1, + .post_gpio_reset_on_delay_ms = 200, +@@ -191,6 +198,7 @@ static const struct elan_i2c_hid_chip_data ilitek_ili2901_chip_data = { + static const struct of_device_id elan_i2c_hid_of_match[] = { + { .compatible = "elan,ekth6915", .data = &elan_ekth6915_chip_data }, + { .compatible = "elan,ekth6a12nay", .data = &elan_ekth6a12nay_chip_data }, ++ { .compatible = "focaltech,ft8112", .data = &focaltech_ft8112_chip_data }, + { .compatible = "ilitek,ili9882t", .data = &ilitek_ili9882t_chip_data }, + { .compatible = "ilitek,ili2901", .data = &ilitek_ili2901_chip_data }, + { } +-- +2.51.0 + diff --git a/queue-6.18/hid-logitech-hidpp-add-support-for-logitech-k980.patch b/queue-6.18/hid-logitech-hidpp-add-support-for-logitech-k980.patch new file mode 100644 index 00000000000..abc29424c3e --- /dev/null +++ b/queue-6.18/hid-logitech-hidpp-add-support-for-logitech-k980.patch @@ -0,0 +1,36 @@ +From 68d45120ba307fa40f50fb511bc6134930c05cca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 13:12:02 +0100 +Subject: HID: logitech-hidpp: Add support for Logitech K980 + +From: Bastien Nocera + +[ Upstream commit af4fe07a9d963a72438ade96cf090e84b3399d0c ] + +Add support for the solar-charging Logitech K980 keyboard, over +Bluetooth. Bolt traffic doesn't get routed through logitech-dj, so +this code isn't triggered when Bolt is used. + +Signed-off-by: Bastien Nocera +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-logitech-hidpp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index 9b612f62d0fba..d117cf0b6de04 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -4665,6 +4665,8 @@ static const struct hid_device_id hidpp_devices[] = { + HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb037) }, + { /* MX Anywhere 3SB mouse over Bluetooth */ + HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb038) }, ++ { /* Slim Solar+ K980 Keyboard over Bluetooth */ ++ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb391) }, + {} + }; + +-- +2.51.0 + diff --git a/queue-6.18/hid-multitouch-add-egalaxtouch-exc3188-support.patch b/queue-6.18/hid-multitouch-add-egalaxtouch-exc3188-support.patch new file mode 100644 index 00000000000..ca6e72423de --- /dev/null +++ b/queue-6.18/hid-multitouch-add-egalaxtouch-exc3188-support.patch @@ -0,0 +1,49 @@ +From 9ae6d7eb872bd9f26414131b55e98666be383528 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 09:57:05 +0100 +Subject: HID: multitouch: add eGalaxTouch EXC3188 support + +From: Thorsten Schmelzer + +[ Upstream commit 8e4ac86b2ddd36fe501e20ecfcc080e536df1f48 ] + +Add support for the for the EXC3188 touchscreen from eGalaxy. + +Signed-off-by: Thorsten Schmelzer +Signed-off-by: Michael Tretter +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-multitouch.c | 3 +++ + 2 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 3965a58926f1c..240fcff0ca71e 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -437,6 +437,7 @@ + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7349 0x7349 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7 0x73f7 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001 ++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000 0xc000 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002 0xc002 + + #define USB_VENDOR_ID_EDIFIER 0x2d99 +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 1763809177c4a..4dcb1d43df27a 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -2202,6 +2202,9 @@ static const struct hid_device_id mt_devices[] = { + { .driver_data = MT_CLS_EGALAX_SERIAL, + MT_USB_DEVICE(USB_VENDOR_ID_DWAV, + USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) }, ++ { .driver_data = MT_CLS_EGALAX_SERIAL, ++ MT_USB_DEVICE(USB_VENDOR_ID_DWAV, ++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000) }, + { .driver_data = MT_CLS_EGALAX, + MT_USB_DEVICE(USB_VENDOR_ID_DWAV, + USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002) }, +-- +2.51.0 + diff --git a/queue-6.18/hid-multitouch-add-quirks-for-lenovo-yoga-book-9i.patch b/queue-6.18/hid-multitouch-add-quirks-for-lenovo-yoga-book-9i.patch new file mode 100644 index 00000000000..03945fea607 --- /dev/null +++ b/queue-6.18/hid-multitouch-add-quirks-for-lenovo-yoga-book-9i.patch @@ -0,0 +1,165 @@ +From 55d4f803e766c999659c85ed63d049391d35f4d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 21:35:47 -0500 +Subject: HID: multitouch: add quirks for Lenovo Yoga Book 9i + +From: Brian Howard + +[ Upstream commit 822bc5b3744b0b2c2c9678aa1d80b2cf04fdfabf ] + +The Lenovo Yoga Book 9i is a dual-screen laptop, with a single composite +USB device providing both touch and tablet interfaces for both screens. +All inputs report through a single device, differentiated solely by report +numbers. As there is no way for udev to differentiate the inputs based on +USB vendor/product ID or interface numbers, custom naming is required to +match against for downstream configuration. A firmware bug also results +in an erroneous InRange message report being received after the stylus +leaves proximity, blocking later touch events. Add required quirks for +Gen 8 to Gen 10 models, including a new quirk providing for custom input +device naming and dropping erroneous InRange reports. + +Signed-off-by: Brian Howard +Tested-by: Brian Howard +Tested-by: Kris Fredrick +Reported-by: Andrei Shumailov +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220386 +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-multitouch.c | 72 ++++++++++++++++++++++++++++++++++++ + 2 files changed, 73 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index b75d9d2f4dc73..3965a58926f1c 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -840,6 +840,7 @@ + #define USB_DEVICE_ID_LENOVO_X1_TAB3 0x60b5 + #define USB_DEVICE_ID_LENOVO_X12_TAB 0x60fe + #define USB_DEVICE_ID_LENOVO_X12_TAB2 0x61ae ++#define USB_DEVICE_ID_LENOVO_YOGABOOK9I 0x6161 + #define USB_DEVICE_ID_LENOVO_OPTICAL_USB_MOUSE_600E 0x600e + #define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_608D 0x608d + #define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019 0x6019 +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index a0c1ad5acb670..1763809177c4a 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -76,6 +76,7 @@ MODULE_LICENSE("GPL"); + #define MT_QUIRK_DISABLE_WAKEUP BIT(21) + #define MT_QUIRK_ORIENTATION_INVERT BIT(22) + #define MT_QUIRK_APPLE_TOUCHBAR BIT(23) ++#define MT_QUIRK_YOGABOOK9I BIT(24) + + #define MT_INPUTMODE_TOUCHSCREEN 0x02 + #define MT_INPUTMODE_TOUCHPAD 0x03 +@@ -229,6 +230,7 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app); + #define MT_CLS_RAZER_BLADE_STEALTH 0x0112 + #define MT_CLS_SMART_TECH 0x0113 + #define MT_CLS_APPLE_TOUCHBAR 0x0114 ++#define MT_CLS_YOGABOOK9I 0x0115 + #define MT_CLS_SIS 0x0457 + + #define MT_DEFAULT_MAXCONTACT 10 +@@ -425,6 +427,14 @@ static const struct mt_class mt_classes[] = { + .quirks = MT_QUIRK_NOT_SEEN_MEANS_UP | + MT_QUIRK_ALWAYS_VALID | + MT_QUIRK_CONTACT_CNT_ACCURATE, ++ }, ++ { .name = MT_CLS_YOGABOOK9I, ++ .quirks = MT_QUIRK_ALWAYS_VALID | ++ MT_QUIRK_FORCE_MULTI_INPUT | ++ MT_QUIRK_SEPARATE_APP_REPORT | ++ MT_QUIRK_HOVERING | ++ MT_QUIRK_YOGABOOK9I, ++ .export_all_inputs = true + }, + { } + }; +@@ -1566,6 +1576,38 @@ static void mt_report(struct hid_device *hid, struct hid_report *report) + if (rdata && rdata->is_mt_collection) + return mt_touch_report(hid, rdata); + ++ /* Lenovo Yoga Book 9i requires consuming and dropping certain bogus reports */ ++ if (rdata && rdata->application && ++ (rdata->application->quirks & MT_QUIRK_YOGABOOK9I)) { ++ ++ bool all_zero_report = true; ++ ++ for (int f = 0; f < report->maxfield && all_zero_report; f++) { ++ struct hid_field *fld = report->field[f]; ++ ++ for (int i = 0; i < fld->report_count; i++) { ++ unsigned int usage = fld->usage[i].hid; ++ ++ if (usage == HID_DG_INRANGE || ++ usage == HID_DG_TIPSWITCH || ++ usage == HID_DG_BARRELSWITCH || ++ usage == HID_DG_BARRELSWITCH2 || ++ usage == HID_DG_CONTACTID || ++ usage == HID_DG_TILT_X || ++ usage == HID_DG_TILT_Y) { ++ ++ if (fld->value[i] != 0) { ++ all_zero_report = false; ++ break; ++ } ++ } ++ } ++ } ++ ++ if (all_zero_report) ++ return; ++ } ++ + if (field && field->hidinput && field->hidinput->input) + input_sync(field->hidinput->input); + } +@@ -1762,6 +1804,30 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi) + break; + } + ++ /* Lenovo Yoga Book 9i requires custom naming to allow differentiation in udev */ ++ if (hi->report && td->mtclass.quirks & MT_QUIRK_YOGABOOK9I) { ++ switch (hi->report->id) { ++ case 48: ++ suffix = "Touchscreen Top"; ++ break; ++ case 56: ++ suffix = "Touchscreen Bottom"; ++ break; ++ case 20: ++ suffix = "Stylus Top"; ++ break; ++ case 40: ++ suffix = "Stylus Bottom"; ++ break; ++ case 80: ++ suffix = "Emulated Touchpad"; ++ break; ++ default: ++ suffix = ""; ++ break; ++ } ++ } ++ + if (suffix) { + hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL, + "%s %s", hdev->name, suffix); +@@ -2267,6 +2333,12 @@ static const struct hid_device_id mt_devices[] = { + USB_VENDOR_ID_LENOVO, + USB_DEVICE_ID_LENOVO_X12_TAB2) }, + ++ /* Lenovo Yoga Book 9i */ ++ { .driver_data = MT_CLS_YOGABOOK9I, ++ HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8, ++ USB_VENDOR_ID_LENOVO, ++ USB_DEVICE_ID_LENOVO_YOGABOOK9I) }, ++ + /* Logitech devices */ + { .driver_data = MT_CLS_NSMU, + HID_DEVICE(BUS_BLUETOOTH, HID_GROUP_MULTITOUCH_WIN_8, +-- +2.51.0 + diff --git a/queue-6.18/hid-pidff-do-not-set-out-of-range-trigger-button.patch b/queue-6.18/hid-pidff-do-not-set-out-of-range-trigger-button.patch new file mode 100644 index 00000000000..8280c7fb6e9 --- /dev/null +++ b/queue-6.18/hid-pidff-do-not-set-out-of-range-trigger-button.patch @@ -0,0 +1,58 @@ +From 4a03c893d8dab4aa08306f712b50a50dd81cbdc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Nov 2025 19:46:14 +0100 +Subject: HID: pidff: Do not set out of range trigger button +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tomasz Pakuła + +[ Upstream commit e01a029654f7fb67d7151365410aa22be4e63dbe ] + +Some games (mainly observed with Kylotonn's WRC Serises) set trigger +button to a random value, or always the same one, out of range. +I observed 307 and other values but, for example, my Moza R9 only +exposes 128 buttons AND it's trigger button field is 8-bit. This causes +errors to appear in dmesg. + +Only set the trigger button and trigger interval in the trigger button +is in range of the field. + +Signed-off-by: Tomasz Pakuła +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/usbhid/hid-pidff.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/drivers/hid/usbhid/hid-pidff.c b/drivers/hid/usbhid/hid-pidff.c +index 95377c5f63356..a4e700b40ba9b 100644 +--- a/drivers/hid/usbhid/hid-pidff.c ++++ b/drivers/hid/usbhid/hid-pidff.c +@@ -523,9 +523,19 @@ static void pidff_set_effect_report(struct pidff_device *pidff, + pidff_set_duration(&pidff->set_effect[PID_DURATION], + effect->replay.length); + +- pidff->set_effect[PID_TRIGGER_BUTTON].value[0] = effect->trigger.button; +- pidff_set_time(&pidff->set_effect[PID_TRIGGER_REPEAT_INT], +- effect->trigger.interval); ++ /* Some games set this to random values that can be out of range */ ++ s32 trigger_button_max = ++ pidff->set_effect[PID_TRIGGER_BUTTON].field->logical_maximum; ++ if (effect->trigger.button <= trigger_button_max) { ++ pidff->set_effect[PID_TRIGGER_BUTTON].value[0] = ++ effect->trigger.button; ++ pidff_set_time(&pidff->set_effect[PID_TRIGGER_REPEAT_INT], ++ effect->trigger.interval); ++ } else { ++ pidff->set_effect[PID_TRIGGER_BUTTON].value[0] = 0; ++ pidff->set_effect[PID_TRIGGER_REPEAT_INT].value[0] = 0; ++ } ++ + pidff->set_effect[PID_GAIN].value[0] = + pidff->set_effect[PID_GAIN].field->logical_maximum; + +-- +2.51.0 + diff --git a/queue-6.18/hisi_acc_vfio_pci-fix-the-queue-parameter-anomaly-is.patch b/queue-6.18/hisi_acc_vfio_pci-fix-the-queue-parameter-anomaly-is.patch new file mode 100644 index 00000000000..3d0df852980 --- /dev/null +++ b/queue-6.18/hisi_acc_vfio_pci-fix-the-queue-parameter-anomaly-is.patch @@ -0,0 +1,42 @@ +From 7767ed3c26ba0d671db83d4b0c194fb421a362ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 10:02:05 +0800 +Subject: hisi_acc_vfio_pci: fix the queue parameter anomaly issue + +From: Longfang Liu + +[ Upstream commit c3cbc276c2a33b04fc78a86cdb2ddce094cb3614 ] + +When the number of QPs initialized by the device, as read via vft, is zero, +it indicates either an abnormal device configuration or an abnormal read +result. +Returning 0 directly in this case would allow the live migration operation +to complete successfully, leading to incorrect parameter configuration after +migration and preventing the service from recovering normal functionality. +Therefore, in such situations, an error should be returned to roll back the +live migration operation. + +Signed-off-by: Longfang Liu +Link: https://lore.kernel.org/r/20260122020205.2884497-5-liulongfang@huawei.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c +index c7559f1d4e2f2..5950ae5222476 100644 +--- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c ++++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c +@@ -407,7 +407,7 @@ static int vf_qm_check_match(struct hisi_acc_vf_core_device *hisi_acc_vdev, + ret = qm_get_vft(vf_qm, &vf_qm->qp_base); + if (ret <= 0) { + dev_err(dev, "failed to get vft qp nums\n"); +- return ret; ++ return ret < 0 ? ret : -EINVAL; + } + + if (ret != vf_data->qp_num) { +-- +2.51.0 + diff --git a/queue-6.18/hisi_acc_vfio_pci-resolve-duplicate-migration-states.patch b/queue-6.18/hisi_acc_vfio_pci-resolve-duplicate-migration-states.patch new file mode 100644 index 00000000000..a1227a978fe --- /dev/null +++ b/queue-6.18/hisi_acc_vfio_pci-resolve-duplicate-migration-states.patch @@ -0,0 +1,41 @@ +From 56acaa527970ecb05b92df76ef9478848fc0517d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 10:02:04 +0800 +Subject: hisi_acc_vfio_pci: resolve duplicate migration states + +From: Longfang Liu + +[ Upstream commit 8c6ac1730a977234dff74cc1753b4a953f59be7b ] + +In special scenarios involving duplicate migrations, after the +first migration is completed, if the original VF device is used +again and then migrated to another destination, the state indicating +data migration completion for the VF device is not reset. +This results in the second migration to the destination being skipped +without performing data migration. +After the modification, it ensures that a complete data migration +is performed after the subsequent migration. + +Signed-off-by: Longfang Liu +Link: https://lore.kernel.org/r/20260122020205.2884497-4-liulongfang@huawei.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c +index ed2ae035deb16..c7559f1d4e2f2 100644 +--- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c ++++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c +@@ -1529,6 +1529,7 @@ static int hisi_acc_vfio_pci_open_device(struct vfio_device *core_vdev) + } + hisi_acc_vdev->mig_state = VFIO_DEVICE_STATE_RUNNING; + hisi_acc_vdev->dev_opened = true; ++ hisi_acc_vdev->match_done = 0; + mutex_unlock(&hisi_acc_vdev->open_mutex); + } + +-- +2.51.0 + diff --git a/queue-6.18/hisi_acc_vfio_pci-update-status-after-ras-error.patch b/queue-6.18/hisi_acc_vfio_pci-update-status-after-ras-error.patch new file mode 100644 index 00000000000..cfdfffaac13 --- /dev/null +++ b/queue-6.18/hisi_acc_vfio_pci-update-status-after-ras-error.patch @@ -0,0 +1,41 @@ +From 1e81d75bd7ffd4fe1142ca7d41ea5a4f2e905f9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 10:02:03 +0800 +Subject: hisi_acc_vfio_pci: update status after RAS error + +From: Longfang Liu + +[ Upstream commit 8be14dd48dfee0df91e511acceb4beeb2461a083 ] + +After a RAS error occurs on the accelerator device, the accelerator +device will be reset. The live migration state will be abnormal +after reset, and the original state needs to be restored during +the reset process. +Therefore, reset processing needs to be performed in a live +migration scenario. + +Signed-off-by: Longfang Liu +Link: https://lore.kernel.org/r/20260122020205.2884497-3-liulongfang@huawei.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c +index 5950ae5222476..f141f21566c52 100644 +--- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c ++++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c +@@ -1196,8 +1196,7 @@ static void hisi_acc_vf_pci_aer_reset_done(struct pci_dev *pdev) + if (hisi_acc_vdev->set_reset_flag) + clear_bit(QM_RESETTING, &qm->misc_ctl); + +- if (hisi_acc_vdev->core_device.vdev.migration_flags != +- VFIO_MIGRATION_STOP_COPY) ++ if (!hisi_acc_vdev->core_device.vdev.mig_ops) + return; + + mutex_lock(&hisi_acc_vdev->state_mutex); +-- +2.51.0 + diff --git a/queue-6.18/hwmon-dell-smm-add-support-for-dell-optiplex-7080.patch b/queue-6.18/hwmon-dell-smm-add-support-for-dell-optiplex-7080.patch new file mode 100644 index 00000000000..f731b9e2b06 --- /dev/null +++ b/queue-6.18/hwmon-dell-smm-add-support-for-dell-optiplex-7080.patch @@ -0,0 +1,47 @@ +From 9eefa716a75a0b95871a2c00ca286f5a28d384c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jan 2026 01:06:10 +0100 +Subject: hwmon: (dell-smm) Add support for Dell OptiPlex 7080 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit 46c3e87a79179454f741f797c274dd25f5c6125e ] + +The Dell OptiPlex 7080 supports the legacy SMM interface for reading +sensors and performing fan control. Whitelist this machine so that +this driver loads automatically. + +Closes: https://github.com/Wer-Wolf/i8kutils/issues/16 +Signed-off-by: Armin Wolf +Acked-by: Pali Rohár +Link: https://lore.kernel.org/r/20260104000654.6406-1-W_Armin@gmx.de +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/dell-smm-hwmon.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c +index f3d484a9f708b..768690a597f4d 100644 +--- a/drivers/hwmon/dell-smm-hwmon.c ++++ b/drivers/hwmon/dell-smm-hwmon.c +@@ -1325,6 +1325,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = { + DMI_MATCH(DMI_PRODUCT_NAME, "MP061"), + }, + }, ++ { ++ .ident = "Dell OptiPlex 7080", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7080"), ++ }, ++ }, + { + .ident = "Dell OptiPlex 7060", + .matches = { +-- +2.51.0 + diff --git a/queue-6.18/hwmon-emc2305-fix-a-resource-leak-in-emc2305_of_pars.patch b/queue-6.18/hwmon-emc2305-fix-a-resource-leak-in-emc2305_of_pars.patch new file mode 100644 index 00000000000..e3d186613ff --- /dev/null +++ b/queue-6.18/hwmon-emc2305-fix-a-resource-leak-in-emc2305_of_pars.patch @@ -0,0 +1,37 @@ +From 3faa1ac56d3472507ccceaace6a746e2af5457e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 21:51:48 +0800 +Subject: hwmon: (emc2305) Fix a resource leak in emc2305_of_parse_pwm_child + +From: Felix Gu + +[ Upstream commit 2954ce672b7623478c1cfeb69e6a6e4042a3656e ] + +When calling of_parse_phandle_with_args(), the caller is responsible +to call of_node_put() to release the reference of device node. +In emc2305_of_parse_pwm_child, it does not release the reference, +causing a resource leak. + +Signed-off-by: Felix Gu +Link: https://lore.kernel.org/r/tencent_738BA80BBF28F3440301EEE6F9E470165105@qq.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/emc2305.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hwmon/emc2305.c b/drivers/hwmon/emc2305.c +index ceae96c07ac45..67e82021da210 100644 +--- a/drivers/hwmon/emc2305.c ++++ b/drivers/hwmon/emc2305.c +@@ -578,6 +578,7 @@ static int emc2305_of_parse_pwm_child(struct device *dev, + data->pwm_output_mask |= EMC2305_OPEN_DRAIN << ch; + } + ++ of_node_put(args.np); + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.18/hwmon-f71882fg-add-f81968-support.patch b/queue-6.18/hwmon-f71882fg-add-f81968-support.patch new file mode 100644 index 00000000000..91f50fd6302 --- /dev/null +++ b/queue-6.18/hwmon-f71882fg-add-f81968-support.patch @@ -0,0 +1,59 @@ +From 4da5fb5dc8d2742d545287cdd57e09d1e28ff79b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Dec 2025 13:10:40 +0800 +Subject: hwmon: (f71882fg) Add F81968 support + +From: Ji-Ze Hong (Peter Hong) + +[ Upstream commit e4a3d6f79c9933fece64368168c46d6cf5fc2e52 ] + +Add hardware monitoring support for the Fintek F81968 Super I/O chip. +It is fully compatible with F81866. + +Several products share compatibility with the F81866. To better distinguish +between them, ensure that the Product ID is displayed when the device is +probed. + +Signed-off-by: Ji-Ze Hong (Peter Hong) +Link: https://lore.kernel.org/r/20251223051040.10227-1-peter_hong@fintek.com.tw +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/f71882fg.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c +index df83f9866fbcf..204059d2de6cd 100644 +--- a/drivers/hwmon/f71882fg.c ++++ b/drivers/hwmon/f71882fg.c +@@ -51,6 +51,7 @@ + #define SIO_F81866_ID 0x1010 /* Chipset ID */ + #define SIO_F71858AD_ID 0x0903 /* Chipset ID */ + #define SIO_F81966_ID 0x1502 /* Chipset ID */ ++#define SIO_F81968_ID 0x1806 /* Chipset ID */ + + #define REGION_LENGTH 8 + #define ADDR_REG_OFFSET 5 +@@ -2570,6 +2571,7 @@ static int __init f71882fg_find(int sioaddr, struct f71882fg_sio_data *sio_data) + break; + case SIO_F81866_ID: + case SIO_F81966_ID: ++ case SIO_F81968_ID: + sio_data->type = f81866a; + break; + default: +@@ -2599,9 +2601,9 @@ static int __init f71882fg_find(int sioaddr, struct f71882fg_sio_data *sio_data) + address &= ~(REGION_LENGTH - 1); /* Ignore 3 LSB */ + + err = address; +- pr_info("Found %s chip at %#x, revision %d\n", ++ pr_info("Found %s chip at %#x, revision %d, devid: %04x\n", + f71882fg_names[sio_data->type], (unsigned int)address, +- (int)superio_inb(sioaddr, SIO_REG_DEVREV)); ++ (int)superio_inb(sioaddr, SIO_REG_DEVREV), devid); + exit: + superio_exit(sioaddr); + return err; +-- +2.51.0 + diff --git a/queue-6.18/hwmon-nct6683-add-customer-id-for-asrock-z590-taichi.patch b/queue-6.18/hwmon-nct6683-add-customer-id-for-asrock-z590-taichi.patch new file mode 100644 index 00000000000..77d3e61398f --- /dev/null +++ b/queue-6.18/hwmon-nct6683-add-customer-id-for-asrock-z590-taichi.patch @@ -0,0 +1,63 @@ +From 9bb15b055ca18bbca6cb35f42977325846dc7f00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Dec 2025 09:09:42 +1100 +Subject: hwmon: (nct6683) Add customer ID for ASRock Z590 Taichi + +From: Anj Duvnjak + +[ Upstream commit c0fa7879c9850bd4597740a79d4fac5ebfcf69cc ] + +Add support for customer ID 0x1621 found on ASRock Z590 Taichi +boards using the Nuvoton NCT6686D embedded controller. + +This allows the driver to instantiate without requiring the +force=1 module parameter. + +Tested on two separate ASRock Z590 Taichi boards, both with +EC firmware version 1.0 build 01/25/21. + +Signed-off-by: Anj Duvnjak +Link: https://lore.kernel.org/r/20251222220942.10762-1-avian@extremenerds.net +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + Documentation/hwmon/nct6683.rst | 1 + + drivers/hwmon/nct6683.c | 3 +++ + 2 files changed, 4 insertions(+) + +diff --git a/Documentation/hwmon/nct6683.rst b/Documentation/hwmon/nct6683.rst +index 3e549ba95a15a..45eec9dd349aa 100644 +--- a/Documentation/hwmon/nct6683.rst ++++ b/Documentation/hwmon/nct6683.rst +@@ -65,6 +65,7 @@ AMD BC-250 NCT6686D EC firmware version 1.0 build 07/28/21 + ASRock X570 NCT6683D EC firmware version 1.0 build 06/28/19 + ASRock X670E NCT6686D EC firmware version 1.0 build 05/19/22 + ASRock B650 Steel Legend WiFi NCT6686D EC firmware version 1.0 build 11/09/23 ++ASRock Z590 Taichi NCT6686D EC firmware version 1.0 build 01/25/21 + MSI B550 NCT6687D EC firmware version 1.0 build 05/07/20 + MSI X670-P NCT6687D EC firmware version 0.0 build 09/27/22 + MSI X870E NCT6687D EC firmware version 0.0 build 11/13/24 +diff --git a/drivers/hwmon/nct6683.c b/drivers/hwmon/nct6683.c +index 6cda35388b24c..4a83804140386 100644 +--- a/drivers/hwmon/nct6683.c ++++ b/drivers/hwmon/nct6683.c +@@ -181,6 +181,7 @@ superio_exit(int ioreg) + #define NCT6683_CUSTOMER_ID_ASROCK2 0xe1b + #define NCT6683_CUSTOMER_ID_ASROCK3 0x1631 + #define NCT6683_CUSTOMER_ID_ASROCK4 0x163e ++#define NCT6683_CUSTOMER_ID_ASROCK5 0x1621 + + #define NCT6683_REG_BUILD_YEAR 0x604 + #define NCT6683_REG_BUILD_MONTH 0x605 +@@ -1242,6 +1243,8 @@ static int nct6683_probe(struct platform_device *pdev) + break; + case NCT6683_CUSTOMER_ID_ASROCK4: + break; ++ case NCT6683_CUSTOMER_ID_ASROCK5: ++ break; + default: + if (!force) + return -ENODEV; +-- +2.51.0 + diff --git a/queue-6.18/hwmon-nct6775-add-asus-pro-ws-wrx90e-sage-se.patch b/queue-6.18/hwmon-nct6775-add-asus-pro-ws-wrx90e-sage-se.patch new file mode 100644 index 00000000000..278b41998c8 --- /dev/null +++ b/queue-6.18/hwmon-nct6775-add-asus-pro-ws-wrx90e-sage-se.patch @@ -0,0 +1,39 @@ +From 180f421066fe7fd628612c6f2fd67abe019d09d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Dec 2025 17:53:14 +0200 +Subject: hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE + +From: Denis Pauk + +[ Upstream commit 246167b17c14e8a5142368ac6457e81622055e0a ] + +Boards Pro WS WRX90E-SAGE SE has got a nct6775 chip, but by default there's +no use of it because of resource conflict with WMI method. + +Add the board to the WMI monitoring list. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=204807 +Signed-off-by: Denis Pauk +Tested-by: Marcus +Link: https://lore.kernel.org/r/20251231155316.2048-1-pauk.denis@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/nct6775-platform.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hwmon/nct6775-platform.c b/drivers/hwmon/nct6775-platform.c +index 407945d2cd6a8..0b529a542b0d4 100644 +--- a/drivers/hwmon/nct6775-platform.c ++++ b/drivers/hwmon/nct6775-platform.c +@@ -1357,6 +1357,7 @@ static const char * const asus_msi_boards[] = { + "Pro WS W680-ACE IPMI", + "Pro WS W790-ACE", + "Pro WS W790E-SAGE SE", ++ "Pro WS WRX90E-SAGE SE", + "ProArt B650-CREATOR", + "ProArt B660-CREATOR D4", + "ProArt B760-CREATOR D4", +-- +2.51.0 + diff --git a/queue-6.18/hwmon-nct7363-fix-a-resource-leak-in-nct7363_present.patch b/queue-6.18/hwmon-nct7363-fix-a-resource-leak-in-nct7363_present.patch new file mode 100644 index 00000000000..cd9ff30290c --- /dev/null +++ b/queue-6.18/hwmon-nct7363-fix-a-resource-leak-in-nct7363_present.patch @@ -0,0 +1,37 @@ +From 0bec6b1783fa13ffa6ae8d4cbe503bb651d972f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 21:54:15 +0800 +Subject: hwmon: (nct7363) Fix a resource leak in nct7363_present_pwm_fanin + +From: Felix Gu + +[ Upstream commit 4923bbff0bcffe488b3aa76829c829bd15b02585 ] + +When calling of_parse_phandle_with_args(), the caller is responsible +to call of_node_put() to release the reference of device node. +In nct7363_present_pwm_fanin, it does not release the reference, +causing a resource leak. + +Signed-off-by: Felix Gu +Link: https://lore.kernel.org/r/tencent_9717645269E4C07D3D131F52201E12E5E10A@qq.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/nct7363.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hwmon/nct7363.c b/drivers/hwmon/nct7363.c +index e13ab918b1abe..56ac42e4a8653 100644 +--- a/drivers/hwmon/nct7363.c ++++ b/drivers/hwmon/nct7363.c +@@ -351,6 +351,7 @@ static int nct7363_present_pwm_fanin(struct device *dev, + if (ret) + return ret; + ++ of_node_put(args.np); + if (args.args[0] >= NCT7363_PWM_COUNT) + return -EINVAL; + data->pwm_mask |= BIT(args.args[0]); +-- +2.51.0 + diff --git a/queue-6.18/hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch b/queue-6.18/hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch new file mode 100644 index 00000000000..3af3eec0987 --- /dev/null +++ b/queue-6.18/hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch @@ -0,0 +1,61 @@ +From 882d26b27a999771c0b92ab3204cd7b29e620745 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 08:35:44 +0100 +Subject: hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 1e5271393d777f6159d896943b4c44c4f3ecff52 ] + +The unpacked union within a packed struct generates alignment warnings +on clang for 32-bit ARM: + +./usr/include/linux/hyperv.h:361:2: error: field within 'struct hv_kvp_exchg_msg_value' + is less aligned than 'union hv_kvp_exchg_msg_value::(anonymous at ./usr/include/linux/hyperv.h:361:2)' + and is usually due to 'struct hv_kvp_exchg_msg_value' being packed, + which can lead to unaligned accesses [-Werror,-Wunaligned-access] + 361 | union { + | ^ + +With the recent changes to compile-test the UAPI headers in more cases, +this warning in combination with CONFIG_WERROR breaks the build. + +Fix the warning. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/ +Reported-by: Nathan Chancellor +Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/ +Suggested-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/ +Signed-off-by: Thomas Weißschuh +Acked-by: Wei Liu (Microsoft) +Tested-by: Nicolas Schier +Reviewed-by: Nicolas Schier +Acked-by: Greg Kroah-Hartman +Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-1-076aed1623ff@linutronix.de +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + include/uapi/linux/hyperv.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/hyperv.h b/include/uapi/linux/hyperv.h +index aaa502a7bff46..1749b35ab2c21 100644 +--- a/include/uapi/linux/hyperv.h ++++ b/include/uapi/linux/hyperv.h +@@ -362,7 +362,7 @@ struct hv_kvp_exchg_msg_value { + __u8 value[HV_KVP_EXCHANGE_MAX_VALUE_SIZE]; + __u32 value_u32; + __u64 value_u64; +- }; ++ } __attribute__((packed)); + } __attribute__((packed)); + + struct hv_kvp_msg_enumerate { +-- +2.51.0 + diff --git a/queue-6.18/i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch b/queue-6.18/i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch new file mode 100644 index 00000000000..fffb24c29fa --- /dev/null +++ b/queue-6.18/i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch @@ -0,0 +1,49 @@ +From d3d1c195d3a86d05160a5d7b5d4813ae7a9331cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 15:08:51 -0500 +Subject: i3c: master: svc: Initialize 'dev' to NULL in + svc_i3c_master_ibi_isr() + +From: Frank Li + +[ Upstream commit 3c9ffb4db787428a5851d5865823ab23842d5103 ] + +Initialize the 'dev' pointer to NULL in svc_i3c_master_ibi_isr() and add +a NULL check in the error path. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/r/202512131016.YCKIsDXM-lkp@intel.com/ +Signed-off-by: Frank Li +Link: https://patch.msgid.link/20251215200852.3079073-1-Frank.Li@nxp.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/svc-i3c-master.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c +index e70a64f2a32fa..93531cb216d16 100644 +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -496,8 +496,8 @@ static int svc_i3c_master_handle_ibi_won(struct svc_i3c_master *master, u32 msta + static void svc_i3c_master_ibi_isr(struct svc_i3c_master *master) + { + struct svc_i3c_i2c_dev_data *data; ++ struct i3c_dev_desc *dev = NULL; + unsigned int ibitype, ibiaddr; +- struct i3c_dev_desc *dev; + u32 status, val; + int ret; + +@@ -590,7 +590,7 @@ static void svc_i3c_master_ibi_isr(struct svc_i3c_master *master) + * for the slave to interrupt again. + */ + if (svc_i3c_master_error(master)) { +- if (master->ibi.tbq_slot) { ++ if (master->ibi.tbq_slot && dev) { + data = i3c_dev_get_master_data(dev); + i3c_generic_ibi_recycle_slot(data->ibi_pool, + master->ibi.tbq_slot); +-- +2.51.0 + diff --git a/queue-6.18/i3c-mipi-i3c-hci-reset-ring_operation1-fields-during.patch b/queue-6.18/i3c-mipi-i3c-hci-reset-ring_operation1-fields-during.patch new file mode 100644 index 00000000000..6d92254a115 --- /dev/null +++ b/queue-6.18/i3c-mipi-i3c-hci-reset-ring_operation1-fields-during.patch @@ -0,0 +1,45 @@ +From 95c40a9340250362b5d1a1f33f46ef71a09322b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 09:26:42 +0200 +Subject: i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init + +From: Adrian Hunter + +[ Upstream commit 78f63ae4a82db173f93adca462e63d11ba06b126 ] + +The MIPI I3C HCI specification does not define reset values for +RING_OPERATION1 fields, and some controllers (e.g., Intel) do not clear +them during a software reset. Ensure the ring pointers are explicitly +set to zero during bus initialization to avoid inconsistent state. + +Signed-off-by: Adrian Hunter +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20260113072702.16268-2-adrian.hunter@intel.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/mipi-i3c-hci/dma.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c +index c401a9425cdc5..951abfea5a6fd 100644 +--- a/drivers/i3c/master/mipi-i3c-hci/dma.c ++++ b/drivers/i3c/master/mipi-i3c-hci/dma.c +@@ -342,6 +342,14 @@ static int hci_dma_init(struct i3c_hci *hci) + rh_reg_write(INTR_SIGNAL_ENABLE, regval); + + ring_ready: ++ /* ++ * The MIPI I3C HCI specification does not document reset values for ++ * RING_OPERATION1 fields and some controllers (e.g. Intel controllers) ++ * do not reset the values, so ensure the ring pointers are set to zero ++ * here. ++ */ ++ rh_reg_write(RING_OPERATION1, 0); ++ + rh_reg_write(RING_CONTROL, RING_CTRL_ENABLE | + RING_CTRL_RUN_STOP); + } +-- +2.51.0 + diff --git a/queue-6.18/i3c-mipi-i3c-hci-stop-reading-extended-capabilities-.patch b/queue-6.18/i3c-mipi-i3c-hci-stop-reading-extended-capabilities-.patch new file mode 100644 index 00000000000..7d632b4a310 --- /dev/null +++ b/queue-6.18/i3c-mipi-i3c-hci-stop-reading-extended-capabilities-.patch @@ -0,0 +1,38 @@ +From 019a12e2224ddc6fcba4da82fd55e3018a58f86b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 18:44:07 +0200 +Subject: i3c: mipi-i3c-hci: Stop reading Extended Capabilities if capability + ID is 0 + +From: Adrian Hunter + +[ Upstream commit 0818e4aa8fdeeed5973e0a8faeddc9da599fc897 ] + +Extended Capability ID value 0 is special. It signifies the end of the +list. Stop reading Extended Capabilities if capability ID is 0. + +Signed-off-by: Adrian Hunter +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20260106164416.67074-3-adrian.hunter@intel.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/mipi-i3c-hci/ext_caps.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i3c/master/mipi-i3c-hci/ext_caps.c b/drivers/i3c/master/mipi-i3c-hci/ext_caps.c +index 7714f00ea9cc0..533a495e14c86 100644 +--- a/drivers/i3c/master/mipi-i3c-hci/ext_caps.c ++++ b/drivers/i3c/master/mipi-i3c-hci/ext_caps.c +@@ -272,7 +272,7 @@ int i3c_hci_parse_ext_caps(struct i3c_hci *hci) + cap_length = FIELD_GET(CAP_HEADER_LENGTH, cap_header); + dev_dbg(&hci->master.dev, "id=0x%02x length=%d", + cap_id, cap_length); +- if (!cap_length) ++ if (!cap_id || !cap_length) + break; + if (curr_cap + cap_length * 4 >= end) { + dev_err(&hci->master.dev, +-- +2.51.0 + diff --git a/queue-6.18/iio-bmi270_i2c-add-module_device_table-for-bmi260-27.patch b/queue-6.18/iio-bmi270_i2c-add-module_device_table-for-bmi260-27.patch new file mode 100644 index 00000000000..af0f3843ba5 --- /dev/null +++ b/queue-6.18/iio-bmi270_i2c-add-module_device_table-for-bmi260-27.patch @@ -0,0 +1,54 @@ +From 3d04e5e7b2c8fde0f7058087c8c3d5b008b6b63f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 05:45:19 +0000 +Subject: iio: bmi270_i2c: Add MODULE_DEVICE_TABLE for BMI260/270 + +From: Derek J. Clark + +[ Upstream commit f69b5ac682dbc61e6aca806c22ce2ae74d598e45 ] + +Currently BMI260 & BMI270 devices do not automatically load this +driver. To fix this, add missing MODULE_DEVICE_TABLE for the i2c, +acpi, and of device tables so the driver will load when the hardware +is detected. + +Tested on my OneXPlayer F1 Pro. + +Signed-off-by: Derek J. Clark +Reviewed-by: Andy Shevchenko +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/imu/bmi270/bmi270_i2c.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/iio/imu/bmi270/bmi270_i2c.c b/drivers/iio/imu/bmi270/bmi270_i2c.c +index b909a421ad017..b92da4e0776fa 100644 +--- a/drivers/iio/imu/bmi270/bmi270_i2c.c ++++ b/drivers/iio/imu/bmi270/bmi270_i2c.c +@@ -37,6 +37,7 @@ static const struct i2c_device_id bmi270_i2c_id[] = { + { "bmi270", (kernel_ulong_t)&bmi270_chip_info }, + { } + }; ++MODULE_DEVICE_TABLE(i2c, bmi270_i2c_id); + + static const struct acpi_device_id bmi270_acpi_match[] = { + /* GPD Win Mini, Aya Neo AIR Pro, OXP Mini Pro, etc. */ +@@ -45,12 +46,14 @@ static const struct acpi_device_id bmi270_acpi_match[] = { + { "BMI0260", (kernel_ulong_t)&bmi260_chip_info }, + { } + }; ++MODULE_DEVICE_TABLE(acpi, bmi270_acpi_match); + + static const struct of_device_id bmi270_of_match[] = { + { .compatible = "bosch,bmi260", .data = &bmi260_chip_info }, + { .compatible = "bosch,bmi270", .data = &bmi270_chip_info }, + { } + }; ++MODULE_DEVICE_TABLE(of, bmi270_of_match); + + static struct i2c_driver bmi270_i2c_driver = { + .driver = { +-- +2.51.0 + diff --git a/queue-6.18/iio-magnetometer-remove-irqf_oneshot.patch b/queue-6.18/iio-magnetometer-remove-irqf_oneshot.patch new file mode 100644 index 00000000000..42510369411 --- /dev/null +++ b/queue-6.18/iio-magnetometer-remove-irqf_oneshot.patch @@ -0,0 +1,49 @@ +From e3bd5e66ce624365d6d2c6661fc7fe326b943fed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:38 +0100 +Subject: iio: magnetometer: Remove IRQF_ONESHOT +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sebastian Andrzej Siewior + +[ Upstream commit a54e9440925e6617c98669066b4753c4cdcea8a0 ] + +Passing IRQF_ONESHOT ensures that the interrupt source is masked until +the secondary (threaded) handler is done. If only a primary handler is +used then the flag makes no sense because the interrupt can not fire +(again) while its handler is running. +The flag also disallows force-threading of the primary handler and the +irq-core will warn about this. +The force-threading functionality is required on PREEMPT_RT because the +handler is using locks with can sleep on PREEMPT_RT. + +Remove IRQF_ONESHOT from irqflags. + +Tested-by: Geert Uytterhoeven +Signed-off-by: Sebastian Andrzej Siewior +Reviewed-by: Andy Shevchenko +Reviewed-by: Nuno Sá +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/magnetometer/ak8975.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c +index 3fd0171e5d69b..d30315ad85ded 100644 +--- a/drivers/iio/magnetometer/ak8975.c ++++ b/drivers/iio/magnetometer/ak8975.c +@@ -581,7 +581,7 @@ static int ak8975_setup_irq(struct ak8975_data *data) + irq = gpiod_to_irq(data->eoc_gpiod); + + rc = devm_request_irq(&client->dev, irq, ak8975_irq_handler, +- IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ IRQF_TRIGGER_RISING, + dev_name(&client->dev), data); + if (rc < 0) { + dev_err(&client->dev, "irq %d request failed: %d\n", irq, rc); +-- +2.51.0 + diff --git a/queue-6.18/iio-use-irqf_no_thread.patch b/queue-6.18/iio-use-irqf_no_thread.patch new file mode 100644 index 00000000000..1676468f803 --- /dev/null +++ b/queue-6.18/iio-use-irqf_no_thread.patch @@ -0,0 +1,90 @@ +From c986bc64925cc5e89fb5e1777024649b3769bebf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:36 +0100 +Subject: iio: Use IRQF_NO_THREAD + +From: Sebastian Andrzej Siewior + +[ Upstream commit 04d390af97f2c28166f7ddfe1a6bda622e3a4766 ] + +The interrupt handler iio_trigger_generic_data_rdy_poll() will invoke +other interrupt handler and this supposed to happen from within the +hardirq. + +Use IRQF_NO_THREAD to forbid forced-threading. + +Signed-off-by: Sebastian Andrzej Siewior +Reviewed-by: Andy Shevchenko +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/accel/bma180.c | 5 +++-- + drivers/iio/adc/ad7766.c | 2 +- + drivers/iio/gyro/itg3200_buffer.c | 8 +++----- + drivers/iio/light/si1145.c | 2 +- + 4 files changed, 8 insertions(+), 9 deletions(-) + +diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c +index 8925f5279e627..7bc6761f51354 100644 +--- a/drivers/iio/accel/bma180.c ++++ b/drivers/iio/accel/bma180.c +@@ -986,8 +986,9 @@ static int bma180_probe(struct i2c_client *client) + } + + ret = devm_request_irq(dev, client->irq, +- iio_trigger_generic_data_rdy_poll, IRQF_TRIGGER_RISING, +- "bma180_event", data->trig); ++ iio_trigger_generic_data_rdy_poll, ++ IRQF_TRIGGER_RISING | IRQF_NO_THREAD, ++ "bma180_event", data->trig); + if (ret) { + dev_err(dev, "unable to request IRQ\n"); + goto err_trigger_free; +diff --git a/drivers/iio/adc/ad7766.c b/drivers/iio/adc/ad7766.c +index 4d570383ef025..1e6bfe8765ab3 100644 +--- a/drivers/iio/adc/ad7766.c ++++ b/drivers/iio/adc/ad7766.c +@@ -261,7 +261,7 @@ static int ad7766_probe(struct spi_device *spi) + * don't enable the interrupt to avoid extra load on the system + */ + ret = devm_request_irq(&spi->dev, spi->irq, ad7766_irq, +- IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN, ++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN | IRQF_NO_THREAD, + dev_name(&spi->dev), + ad7766->trig); + if (ret < 0) +diff --git a/drivers/iio/gyro/itg3200_buffer.c b/drivers/iio/gyro/itg3200_buffer.c +index a624400a239cb..cf97adfa97274 100644 +--- a/drivers/iio/gyro/itg3200_buffer.c ++++ b/drivers/iio/gyro/itg3200_buffer.c +@@ -118,11 +118,9 @@ int itg3200_probe_trigger(struct iio_dev *indio_dev) + if (!st->trig) + return -ENOMEM; + +- ret = request_irq(st->i2c->irq, +- &iio_trigger_generic_data_rdy_poll, +- IRQF_TRIGGER_RISING, +- "itg3200_data_rdy", +- st->trig); ++ ret = request_irq(st->i2c->irq, &iio_trigger_generic_data_rdy_poll, ++ IRQF_TRIGGER_RISING | IRQF_NO_THREAD, ++ "itg3200_data_rdy", st->trig); + if (ret) + goto error_free_trig; + +diff --git a/drivers/iio/light/si1145.c b/drivers/iio/light/si1145.c +index f8eb251eca8dc..ef0abc4499b74 100644 +--- a/drivers/iio/light/si1145.c ++++ b/drivers/iio/light/si1145.c +@@ -1248,7 +1248,7 @@ static int si1145_probe_trigger(struct iio_dev *indio_dev) + + ret = devm_request_irq(&client->dev, client->irq, + iio_trigger_generic_data_rdy_poll, +- IRQF_TRIGGER_FALLING, ++ IRQF_TRIGGER_FALLING | IRQF_NO_THREAD, + "si1145_irq", + trig); + if (ret < 0) { +-- +2.51.0 + diff --git a/queue-6.18/include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch b/queue-6.18/include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch new file mode 100644 index 00000000000..193cc04c4ff --- /dev/null +++ b/queue-6.18/include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch @@ -0,0 +1,42 @@ +From b901bfeeb6a96413d3903e1e691ad17e4fca4114 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Feb 2026 15:54:06 +0100 +Subject: include: uapi: netfilter_bridge.h: Cover for musl libc + +From: Phil Sutter + +[ Upstream commit 4edd4ba71ce0df015303dba75ea9d20d1a217546 ] + +Musl defines its own struct ethhdr and thus defines __UAPI_DEF_ETHHDR to +zero. To avoid struct redefinition errors, user space is therefore +supposed to include netinet/if_ether.h before (or instead of) +linux/if_ether.h. To relieve them from this burden, include the libc +header here if not building for kernel space. + +Reported-by: Alyssa Ross +Suggested-by: Florian Westphal +Signed-off-by: Phil Sutter +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + include/uapi/linux/netfilter_bridge.h | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/include/uapi/linux/netfilter_bridge.h b/include/uapi/linux/netfilter_bridge.h +index 1610fdbab98df..ad520d3e9df8f 100644 +--- a/include/uapi/linux/netfilter_bridge.h ++++ b/include/uapi/linux/netfilter_bridge.h +@@ -5,6 +5,10 @@ + /* bridge-specific defines for netfilter. + */ + ++#ifndef __KERNEL__ ++#include /* for __UAPI_DEF_ETHHDR if defined */ ++#endif ++ + #include + #include + #include +-- +2.51.0 + diff --git a/queue-6.18/io_uring-timeout-annotate-data-race-in-io_flush_time.patch b/queue-6.18/io_uring-timeout-annotate-data-race-in-io_flush_time.patch new file mode 100644 index 00000000000..c10ed4fe438 --- /dev/null +++ b/queue-6.18/io_uring-timeout-annotate-data-race-in-io_flush_time.patch @@ -0,0 +1,39 @@ +From 5ce5a34ba154aba802ffc6e860b0c368930c6870 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 09:53:43 -0700 +Subject: io_uring/timeout: annotate data race in io_flush_timeouts() + +From: Jens Axboe + +[ Upstream commit 42b12cb5fd4554679bac06bbdd05dc8b643bcc42 ] + +syzbot correctly reports this as a KCSAN race, as ctx->cached_cq_tail +should be read under ->uring_lock. This isn't immediately feasible in +io_flush_timeouts(), but as long as we read a stable value, that should +be good enough. If two io-wq threads compete on this value, then they +will both end up calling io_flush_timeouts() and at least one of them +will see the correct value. + +Reported-by: syzbot+6c48db7d94402407301e@syzkaller.appspotmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/timeout.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/io_uring/timeout.c b/io_uring/timeout.c +index 17e3aab0af367..cd42316d0f3c0 100644 +--- a/io_uring/timeout.c ++++ b/io_uring/timeout.c +@@ -129,7 +129,7 @@ __cold void io_flush_timeouts(struct io_ring_ctx *ctx) + u32 seq; + + raw_spin_lock_irq(&ctx->timeout_lock); +- seq = ctx->cached_cq_tail - atomic_read(&ctx->cq_timeouts); ++ seq = READ_ONCE(ctx->cached_cq_tail) - atomic_read(&ctx->cq_timeouts); + + list_for_each_entry_safe(timeout, tmp, &ctx->timeout_list, list) { + struct io_kiocb *req = cmd_to_io_kiocb(timeout); +-- +2.51.0 + diff --git a/queue-6.18/iommu-amd-move-wait_on_sem-out-of-spinlock.patch b/queue-6.18/iommu-amd-move-wait_on_sem-out-of-spinlock.patch new file mode 100644 index 00000000000..ba7c279d852 --- /dev/null +++ b/queue-6.18/iommu-amd-move-wait_on_sem-out-of-spinlock.patch @@ -0,0 +1,87 @@ +From 5f14236cefc0730088dad53e4966fcb5153c9e4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 14:39:40 +0000 +Subject: iommu/amd: move wait_on_sem() out of spinlock + +From: Ankit Soni + +[ Upstream commit d2a0cac10597068567d336e85fa3cbdbe8ca62bf ] + +With iommu.strict=1, the existing completion wait path can cause soft +lockups under stressed environment, as wait_on_sem() busy-waits under the +spinlock with interrupts disabled. + +Move the completion wait in iommu_completion_wait() out of the spinlock. +wait_on_sem() only polls the hardware-updated cmd_sem and does not require +iommu->lock, so holding the lock during the busy wait unnecessarily +increases contention and extends the time with interrupts disabled. + +Signed-off-by: Ankit Soni +Reviewed-by: Vasant Hegde +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd/iommu.c | 25 +++++++++++++++++-------- + 1 file changed, 17 insertions(+), 8 deletions(-) + +diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c +index 30dd482fe0953..3f2b687947dba 100644 +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -1156,7 +1156,12 @@ static int wait_on_sem(struct amd_iommu *iommu, u64 data) + { + int i = 0; + +- while (*iommu->cmd_sem != data && i < LOOP_TIMEOUT) { ++ /* ++ * cmd_sem holds a monotonically non-decreasing completion sequence ++ * number. ++ */ ++ while ((__s64)(READ_ONCE(*iommu->cmd_sem) - data) < 0 && ++ i < LOOP_TIMEOUT) { + udelay(1); + i += 1; + } +@@ -1401,14 +1406,13 @@ static int iommu_completion_wait(struct amd_iommu *iommu) + raw_spin_lock_irqsave(&iommu->lock, flags); + + ret = __iommu_queue_command_sync(iommu, &cmd, false); ++ raw_spin_unlock_irqrestore(&iommu->lock, flags); ++ + if (ret) +- goto out_unlock; ++ return ret; + + ret = wait_on_sem(iommu, data); + +-out_unlock: +- raw_spin_unlock_irqrestore(&iommu->lock, flags); +- + return ret; + } + +@@ -3088,13 +3092,18 @@ static void iommu_flush_irt_and_complete(struct amd_iommu *iommu, u16 devid) + raw_spin_lock_irqsave(&iommu->lock, flags); + ret = __iommu_queue_command_sync(iommu, &cmd, true); + if (ret) +- goto out; ++ goto out_err; + ret = __iommu_queue_command_sync(iommu, &cmd2, false); + if (ret) +- goto out; ++ goto out_err; ++ raw_spin_unlock_irqrestore(&iommu->lock, flags); ++ + wait_on_sem(iommu, data); +-out: ++ return; ++ ++out_err: + raw_spin_unlock_irqrestore(&iommu->lock, flags); ++ return; + } + + static inline u8 iommu_get_int_tablen(struct iommu_dev_data *dev_data) +-- +2.51.0 + diff --git a/queue-6.18/iommu-amd-serialize-sequence-allocation-under-concur.patch b/queue-6.18/iommu-amd-serialize-sequence-allocation-under-concur.patch new file mode 100644 index 00000000000..d7eb512848a --- /dev/null +++ b/queue-6.18/iommu-amd-serialize-sequence-allocation-under-concur.patch @@ -0,0 +1,115 @@ +From 3dd3ccaafea5d287da053d08c89378b93fb74bce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 15:30:38 +0000 +Subject: iommu/amd: serialize sequence allocation under concurrent TLB + invalidations + +From: Ankit Soni + +[ Upstream commit 9e249c48412828e807afddc21527eb734dc9bd3d ] + +With concurrent TLB invalidations, completion wait randomly gets timed out +because cmd_sem_val was incremented outside the IOMMU spinlock, allowing +CMD_COMPL_WAIT commands to be queued out of sequence and breaking the +ordering assumption in wait_on_sem(). +Move the cmd_sem_val increment under iommu->lock so completion sequence +allocation is serialized with command queuing. +And remove the unnecessary return. + +Fixes: d2a0cac10597 ("iommu/amd: move wait_on_sem() out of spinlock") + +Tested-by: Srikanth Aithal +Reported-by: Srikanth Aithal +Signed-off-by: Ankit Soni +Reviewed-by: Vasant Hegde +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd/amd_iommu_types.h | 2 +- + drivers/iommu/amd/init.c | 2 +- + drivers/iommu/amd/iommu.c | 18 ++++++++++++------ + 3 files changed, 14 insertions(+), 8 deletions(-) + +diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h +index a698a2e7ce2a6..b0d919cd1a8fb 100644 +--- a/drivers/iommu/amd/amd_iommu_types.h ++++ b/drivers/iommu/amd/amd_iommu_types.h +@@ -791,7 +791,7 @@ struct amd_iommu { + + u32 flags; + volatile u64 *cmd_sem; +- atomic64_t cmd_sem_val; ++ u64 cmd_sem_val; + /* + * Track physical address to directly use it in build_completion_wait() + * and avoid adding any special checks and handling for kdump. +diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c +index 53afb1cb0a6fc..76efd74124b33 100644 +--- a/drivers/iommu/amd/init.c ++++ b/drivers/iommu/amd/init.c +@@ -1879,7 +1879,7 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h, + iommu->pci_seg = pci_seg; + + raw_spin_lock_init(&iommu->lock); +- atomic64_set(&iommu->cmd_sem_val, 0); ++ iommu->cmd_sem_val = 0; + + /* Add IOMMU to internal data structures */ + list_add_tail(&iommu->list, &amd_iommu_list); +diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c +index 3f2b687947dba..4beef73139611 100644 +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -1386,6 +1386,12 @@ static int iommu_queue_command(struct amd_iommu *iommu, struct iommu_cmd *cmd) + return iommu_queue_command_sync(iommu, cmd, true); + } + ++static u64 get_cmdsem_val(struct amd_iommu *iommu) ++{ ++ lockdep_assert_held(&iommu->lock); ++ return ++iommu->cmd_sem_val; ++} ++ + /* + * This function queues a completion wait command into the command + * buffer of an IOMMU +@@ -1400,11 +1406,11 @@ static int iommu_completion_wait(struct amd_iommu *iommu) + if (!iommu->need_sync) + return 0; + +- data = atomic64_inc_return(&iommu->cmd_sem_val); +- build_completion_wait(&cmd, iommu, data); +- + raw_spin_lock_irqsave(&iommu->lock, flags); + ++ data = get_cmdsem_val(iommu); ++ build_completion_wait(&cmd, iommu, data); ++ + ret = __iommu_queue_command_sync(iommu, &cmd, false); + raw_spin_unlock_irqrestore(&iommu->lock, flags); + +@@ -3086,10 +3092,11 @@ static void iommu_flush_irt_and_complete(struct amd_iommu *iommu, u16 devid) + return; + + build_inv_irt(&cmd, devid); +- data = atomic64_inc_return(&iommu->cmd_sem_val); +- build_completion_wait(&cmd2, iommu, data); + + raw_spin_lock_irqsave(&iommu->lock, flags); ++ data = get_cmdsem_val(iommu); ++ build_completion_wait(&cmd2, iommu, data); ++ + ret = __iommu_queue_command_sync(iommu, &cmd, true); + if (ret) + goto out_err; +@@ -3103,7 +3110,6 @@ static void iommu_flush_irt_and_complete(struct amd_iommu *iommu, u16 devid) + + out_err: + raw_spin_unlock_irqrestore(&iommu->lock, flags); +- return; + } + + static inline u8 iommu_get_int_tablen(struct iommu_dev_data *dev_data) +-- +2.51.0 + diff --git a/queue-6.18/iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch b/queue-6.18/iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch new file mode 100644 index 00000000000..521541f7a47 --- /dev/null +++ b/queue-6.18/iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch @@ -0,0 +1,134 @@ +From 47ae6ff32e4dde21214f27da42b73ef9e14103db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 13:28:57 -0800 +Subject: iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency + +From: Alexander Grest + +[ Upstream commit df180b1a4cc51011c5f8c52c7ec02ad2e42962de ] + +The SMMU CMDQ lock is highly contentious when there are multiple CPUs +issuing commands and the queue is nearly full. + +The lock has the following states: + - 0: Unlocked + - >0: Shared lock held with count + - INT_MIN+N: Exclusive lock held, where N is the # of shared waiters + - INT_MIN: Exclusive lock held, no shared waiters + +When multiple CPUs are polling for space in the queue, they attempt to +grab the exclusive lock to update the cons pointer from the hardware. If +they fail to get the lock, they will spin until either the cons pointer +is updated by another CPU. + +The current code allows the possibility of shared lock starvation +if there is a constant stream of CPUs trying to grab the exclusive lock. +This leads to severe latency issues and soft lockups. + +Consider the following scenario where CPU1's attempt to acquire the +shared lock is starved by CPU2 and CPU0 contending for the exclusive +lock. + +CPU0 (exclusive) | CPU1 (shared) | CPU2 (exclusive) | `cmdq->lock` +-------------------------------------------------------------------------- +trylock() //takes | | | 0 + | shared_lock() | | INT_MIN + | fetch_inc() | | INT_MIN + | no return | | INT_MIN + 1 + | spins // VAL >= 0 | | INT_MIN + 1 +unlock() | spins... | | INT_MIN + 1 +set_release(0) | spins... | | 0 see[NOTE] +(done) | (sees 0) | trylock() // takes | 0 + | *exits loop* | cmpxchg(0, INT_MIN) | 0 + | | *cuts in* | INT_MIN + | cmpxchg(0, 1) | | INT_MIN + | fails // != 0 | | INT_MIN + | spins // VAL >= 0 | | INT_MIN + | *starved* | | INT_MIN + +[NOTE] The current code resets the exclusive lock to 0 regardless of the +state of the lock. This causes two problems: +1. It opens the possibility of back-to-back exclusive locks and the + downstream effect of starving shared lock. +2. The count of shared lock waiters are lost. + +To mitigate this, we release the exclusive lock by only clearing the sign +bit while retaining the shared lock waiter count as a way to avoid +starving the shared lock waiters. + +Also deleted cmpxchg loop while trying to acquire the shared lock as it +is not needed. The waiters can see the positive lock count and proceed +immediately after the exclusive lock is released. + +Exclusive lock is not starved in that submitters will try exclusive lock +first when new spaces become available. + +Reviewed-by: Mostafa Saleh +Reviewed-by: Nicolin Chen +Signed-off-by: Alexander Grest +Signed-off-by: Jacob Pan +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 31 ++++++++++++++------- + 1 file changed, 21 insertions(+), 10 deletions(-) + +diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +index 9780f40ba3e65..b4f757e1f105f 100644 +--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c ++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +@@ -487,20 +487,26 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu) + */ + static void arm_smmu_cmdq_shared_lock(struct arm_smmu_cmdq *cmdq) + { +- int val; +- + /* +- * We can try to avoid the cmpxchg() loop by simply incrementing the +- * lock counter. When held in exclusive state, the lock counter is set +- * to INT_MIN so these increments won't hurt as the value will remain +- * negative. ++ * When held in exclusive state, the lock counter is set to INT_MIN ++ * so these increments won't hurt as the value will remain negative. ++ * The increment will also signal the exclusive locker that there are ++ * shared waiters. + */ + if (atomic_fetch_inc_relaxed(&cmdq->lock) >= 0) + return; + +- do { +- val = atomic_cond_read_relaxed(&cmdq->lock, VAL >= 0); +- } while (atomic_cmpxchg_relaxed(&cmdq->lock, val, val + 1) != val); ++ /* ++ * Someone else is holding the lock in exclusive state, so wait ++ * for them to finish. Since we already incremented the lock counter, ++ * no exclusive lock can be acquired until we finish. We don't need ++ * the return value since we only care that the exclusive lock is ++ * released (i.e. the lock counter is non-negative). ++ * Once the exclusive locker releases the lock, the sign bit will ++ * be cleared and our increment will make the lock counter positive, ++ * allowing us to proceed. ++ */ ++ atomic_cond_read_relaxed(&cmdq->lock, VAL > 0); + } + + static void arm_smmu_cmdq_shared_unlock(struct arm_smmu_cmdq *cmdq) +@@ -527,9 +533,14 @@ static bool arm_smmu_cmdq_shared_tryunlock(struct arm_smmu_cmdq *cmdq) + __ret; \ + }) + ++/* ++ * Only clear the sign bit when releasing the exclusive lock this will ++ * allow any shared_lock() waiters to proceed without the possibility ++ * of entering the exclusive lock in a tight loop. ++ */ + #define arm_smmu_cmdq_exclusive_unlock_irqrestore(cmdq, flags) \ + ({ \ +- atomic_set_release(&cmdq->lock, 0); \ ++ atomic_fetch_andnot_release(INT_MIN, &cmdq->lock); \ + local_irq_restore(flags); \ + }) + +-- +2.51.0 + diff --git a/queue-6.18/ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch b/queue-6.18/ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch new file mode 100644 index 00000000000..7f5f20fa4ac --- /dev/null +++ b/queue-6.18/ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch @@ -0,0 +1,123 @@ +From 7e51782b4025b68937111da0622e4ac31125c8db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 04:35:24 +0000 +Subject: ipv4: fib: Annotate access to struct fib_alias.fa_state. + +From: Kuniyuki Iwashima + +[ Upstream commit 6e84fc395e90465f1418f582a9f7d53c87ab010e ] + +syzbot reported that struct fib_alias.fa_state can be +modified locklessly by RCU readers. [0] + +Let's use READ_ONCE()/WRITE_ONCE() properly. + +[0]: +BUG: KCSAN: data-race in fib_table_lookup / fib_table_lookup + +write to 0xffff88811b06a7fa of 1 bytes by task 4167 on cpu 0: + fib_alias_accessed net/ipv4/fib_lookup.h:32 [inline] + fib_table_lookup+0x361/0xd60 net/ipv4/fib_trie.c:1565 + fib_lookup include/net/ip_fib.h:390 [inline] + ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814 + ip_route_output_key_hash net/ipv4/route.c:2705 [inline] + __ip_route_output_key include/net/route.h:169 [inline] + ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932 + udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450 + inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859 + sock_sendmsg_nosec net/socket.c:727 [inline] + __sock_sendmsg net/socket.c:742 [inline] + ____sys_sendmsg+0x53a/0x600 net/socket.c:2592 + ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646 + __sys_sendmmsg+0x185/0x320 net/socket.c:2735 + __do_sys_sendmmsg net/socket.c:2762 [inline] + __se_sys_sendmmsg net/socket.c:2759 [inline] + __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759 + x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +read to 0xffff88811b06a7fa of 1 bytes by task 4168 on cpu 1: + fib_alias_accessed net/ipv4/fib_lookup.h:31 [inline] + fib_table_lookup+0x338/0xd60 net/ipv4/fib_trie.c:1565 + fib_lookup include/net/ip_fib.h:390 [inline] + ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814 + ip_route_output_key_hash net/ipv4/route.c:2705 [inline] + __ip_route_output_key include/net/route.h:169 [inline] + ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932 + udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450 + inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859 + sock_sendmsg_nosec net/socket.c:727 [inline] + __sock_sendmsg net/socket.c:742 [inline] + ____sys_sendmsg+0x53a/0x600 net/socket.c:2592 + ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646 + __sys_sendmmsg+0x185/0x320 net/socket.c:2735 + __do_sys_sendmmsg net/socket.c:2762 [inline] + __se_sys_sendmmsg net/socket.c:2759 [inline] + __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759 + x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +value changed: 0x00 -> 0x01 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 1 UID: 0 PID: 4168 Comm: syz.4.206 Not tainted syzkaller #0 PREEMPT(voluntary) +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 + +Reported-by: syzbot+d24f940f770afda885cf@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/69783ead.050a0220.c9109.0013.GAE@google.com/ +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260127043528.514160-1-kuniyu@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/fib_lookup.h | 6 ++++-- + net/ipv4/fib_trie.c | 4 ++-- + 2 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h +index f9b9e26c32c19..0b72796dd1ad3 100644 +--- a/net/ipv4/fib_lookup.h ++++ b/net/ipv4/fib_lookup.h +@@ -28,8 +28,10 @@ struct fib_alias { + /* Don't write on fa_state unless needed, to keep it shared on all cpus */ + static inline void fib_alias_accessed(struct fib_alias *fa) + { +- if (!(fa->fa_state & FA_S_ACCESSED)) +- fa->fa_state |= FA_S_ACCESSED; ++ u8 fa_state = READ_ONCE(fa->fa_state); ++ ++ if (!(fa_state & FA_S_ACCESSED)) ++ WRITE_ONCE(fa->fa_state, fa_state | FA_S_ACCESSED); + } + + /* Exported by fib_semantics.c */ +diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c +index 7e2c17fec3fc4..1308213791f19 100644 +--- a/net/ipv4/fib_trie.c ++++ b/net/ipv4/fib_trie.c +@@ -1280,7 +1280,7 @@ int fib_table_insert(struct net *net, struct fib_table *tb, + new_fa->fa_dscp = fa->fa_dscp; + new_fa->fa_info = fi; + new_fa->fa_type = cfg->fc_type; +- state = fa->fa_state; ++ state = READ_ONCE(fa->fa_state); + new_fa->fa_state = state & ~FA_S_ACCESSED; + new_fa->fa_slen = fa->fa_slen; + new_fa->tb_id = tb->tb_id; +@@ -1745,7 +1745,7 @@ int fib_table_delete(struct net *net, struct fib_table *tb, + + fib_remove_alias(t, tp, l, fa_to_delete); + +- if (fa_to_delete->fa_state & FA_S_ACCESSED) ++ if (READ_ONCE(fa_to_delete->fa_state) & FA_S_ACCESSED) + rt_cache_flush(cfg->fc_nlinfo.nl_net); + + fib_release_info(fa_to_delete->fa_info); +-- +2.51.0 + diff --git a/queue-6.18/ipv4-igmp-annotate-data-races-around-idev-mr_maxdela.patch b/queue-6.18/ipv4-igmp-annotate-data-races-around-idev-mr_maxdela.patch new file mode 100644 index 00000000000..6f85c25d3cb --- /dev/null +++ b/queue-6.18/ipv4-igmp-annotate-data-races-around-idev-mr_maxdela.patch @@ -0,0 +1,66 @@ +From 3259511fa674937c85d5794677347cb457205c05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 17:22:47 +0000 +Subject: ipv4: igmp: annotate data-races around idev->mr_maxdelay + +From: Eric Dumazet + +[ Upstream commit e4faaf65a75f650ac4366ddff5dabb826029ca5a ] + +idev->mr_maxdelay is read and written locklessly, +add READ_ONCE()/WRITE_ONCE() annotations. + +While we are at it, make this field an u32. + +Signed-off-by: Eric Dumazet +Reviewed-by: David Ahern +Link: https://patch.msgid.link/20260122172247.2429403-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/linux/inetdevice.h | 2 +- + net/ipv4/igmp.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h +index 5730ba6b1cfaf..dccbeb25f7014 100644 +--- a/include/linux/inetdevice.h ++++ b/include/linux/inetdevice.h +@@ -38,11 +38,11 @@ struct in_device { + struct ip_mc_list *mc_tomb; + unsigned long mr_v1_seen; + unsigned long mr_v2_seen; +- unsigned long mr_maxdelay; + unsigned long mr_qi; /* Query Interval */ + unsigned long mr_qri; /* Query Response Interval */ + unsigned char mr_qrv; /* Query Robustness Variable */ + unsigned char mr_gq_running; ++ u32 mr_maxdelay; + u32 mr_ifc_count; + struct timer_list mr_gq_timer; /* general query timer */ + struct timer_list mr_ifc_timer; /* interface change timer */ +diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c +index 7182f1419c2a4..0adc993c211d7 100644 +--- a/net/ipv4/igmp.c ++++ b/net/ipv4/igmp.c +@@ -227,7 +227,7 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay) + + static void igmp_gq_start_timer(struct in_device *in_dev) + { +- int tv = get_random_u32_below(in_dev->mr_maxdelay); ++ int tv = get_random_u32_below(READ_ONCE(in_dev->mr_maxdelay)); + unsigned long exp = jiffies + tv + 2; + + if (in_dev->mr_gq_running && +@@ -1009,7 +1009,7 @@ static bool igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb, + max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE); + if (!max_delay) + max_delay = 1; /* can't mod w/ 0 */ +- in_dev->mr_maxdelay = max_delay; ++ WRITE_ONCE(in_dev->mr_maxdelay, max_delay); + + /* RFC3376, 4.1.6. QRV and 4.1.7. QQIC, when the most recently + * received value was zero, use the default or statically +-- +2.51.0 + diff --git a/queue-6.18/ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch b/queue-6.18/ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch new file mode 100644 index 00000000000..34083356c8c --- /dev/null +++ b/queue-6.18/ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch @@ -0,0 +1,41 @@ +From e4aaf6cb6bc66b9e115e6360046ef7ffd4df70e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 09:41:37 +0000 +Subject: ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() + +From: Eric Dumazet + +[ Upstream commit 03e9d91dd64e2f5ea632df5d59568d91757efc4d ] + +Add missing READ_ONCE() when reading sysctl values. + +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260115094141.3124990-5-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/ipv6.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/net/ipv6.h b/include/net/ipv6.h +index f0936df7567e3..7e984e75f3345 100644 +--- a/include/net/ipv6.h ++++ b/include/net/ipv6.h +@@ -1010,11 +1010,11 @@ static inline int ip6_default_np_autolabel(struct net *net) + #if IS_ENABLED(CONFIG_IPV6) + static inline int ip6_multipath_hash_policy(const struct net *net) + { +- return net->ipv6.sysctl.multipath_hash_policy; ++ return READ_ONCE(net->ipv6.sysctl.multipath_hash_policy); + } + static inline u32 ip6_multipath_hash_fields(const struct net *net) + { +- return net->ipv6.sysctl.multipath_hash_fields; ++ return READ_ONCE(net->ipv6.sysctl.multipath_hash_fields); + } + #else + static inline int ip6_multipath_hash_policy(const struct net *net) +-- +2.51.0 + diff --git a/queue-6.18/ipv6-annotate-data-races-in-net-ipv6-route.c.patch b/queue-6.18/ipv6-annotate-data-races-in-net-ipv6-route.c.patch new file mode 100644 index 00000000000..e63f2d4bd6a --- /dev/null +++ b/queue-6.18/ipv6-annotate-data-races-in-net-ipv6-route.c.patch @@ -0,0 +1,109 @@ +From bb132ce3c22498c77e294b0b3960b1e243c655ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 09:41:41 +0000 +Subject: ipv6: annotate data-races in net/ipv6/route.c + +From: Eric Dumazet + +[ Upstream commit f062e8e25102324364aada61b8283356235bc3c1 ] + +sysctls are read while their values can change, +add READ_ONCE() annotations. + +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260115094141.3124990-9-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/route.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index e3a260a5564ba..cd229974b7974 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -2895,7 +2895,7 @@ static void rt6_do_update_pmtu(struct rt6_info *rt, u32 mtu) + + dst_metric_set(&rt->dst, RTAX_MTU, mtu); + rt->rt6i_flags |= RTF_MODIFIED; +- rt6_update_expires(rt, net->ipv6.sysctl.ip6_rt_mtu_expires); ++ rt6_update_expires(rt, READ_ONCE(net->ipv6.sysctl.ip6_rt_mtu_expires)); + } + + static bool rt6_cache_allowed_for_pmtu(const struct rt6_info *rt) +@@ -3256,8 +3256,8 @@ static unsigned int ip6_default_advmss(const struct dst_entry *dst) + rcu_read_lock(); + + net = dst_dev_net_rcu(dst); +- if (mtu < net->ipv6.sysctl.ip6_rt_min_advmss) +- mtu = net->ipv6.sysctl.ip6_rt_min_advmss; ++ mtu = max_t(unsigned int, mtu, ++ READ_ONCE(net->ipv6.sysctl.ip6_rt_min_advmss)); + + rcu_read_unlock(); + +@@ -3359,10 +3359,10 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev, + static void ip6_dst_gc(struct dst_ops *ops) + { + struct net *net = container_of(ops, struct net, ipv6.ip6_dst_ops); +- int rt_min_interval = net->ipv6.sysctl.ip6_rt_gc_min_interval; +- int rt_elasticity = net->ipv6.sysctl.ip6_rt_gc_elasticity; +- int rt_gc_timeout = net->ipv6.sysctl.ip6_rt_gc_timeout; +- unsigned long rt_last_gc = net->ipv6.ip6_rt_last_gc; ++ int rt_min_interval = READ_ONCE(net->ipv6.sysctl.ip6_rt_gc_min_interval); ++ int rt_elasticity = READ_ONCE(net->ipv6.sysctl.ip6_rt_gc_elasticity); ++ int rt_gc_timeout = READ_ONCE(net->ipv6.sysctl.ip6_rt_gc_timeout); ++ unsigned long rt_last_gc = READ_ONCE(net->ipv6.ip6_rt_last_gc); + unsigned int val; + int entries; + +@@ -5008,7 +5008,7 @@ void rt6_sync_down_dev(struct net_device *dev, unsigned long event) + }; + struct net *net = dev_net(dev); + +- if (net->ipv6.sysctl.skip_notify_on_dev_down) ++ if (READ_ONCE(net->ipv6.sysctl.skip_notify_on_dev_down)) + fib6_clean_all_skip_notify(net, fib6_ifdown, &arg); + else + fib6_clean_all(net, fib6_ifdown, &arg); +@@ -6408,6 +6408,7 @@ void fib6_rt_update(struct net *net, struct fib6_info *rt, + void fib6_info_hw_flags_set(struct net *net, struct fib6_info *f6i, + bool offload, bool trap, bool offload_failed) + { ++ u8 fib_notify_on_flag_change; + struct sk_buff *skb; + int err; + +@@ -6419,8 +6420,9 @@ void fib6_info_hw_flags_set(struct net *net, struct fib6_info *f6i, + WRITE_ONCE(f6i->offload, offload); + WRITE_ONCE(f6i->trap, trap); + ++ fib_notify_on_flag_change = READ_ONCE(net->ipv6.sysctl.fib_notify_on_flag_change); + /* 2 means send notifications only if offload_failed was changed. */ +- if (net->ipv6.sysctl.fib_notify_on_flag_change == 2 && ++ if (fib_notify_on_flag_change == 2 && + READ_ONCE(f6i->offload_failed) == offload_failed) + return; + +@@ -6432,7 +6434,7 @@ void fib6_info_hw_flags_set(struct net *net, struct fib6_info *f6i, + */ + return; + +- if (!net->ipv6.sysctl.fib_notify_on_flag_change) ++ if (!fib_notify_on_flag_change) + return; + + skb = nlmsg_new(rt6_nlmsg_size(f6i), GFP_KERNEL); +@@ -6529,7 +6531,7 @@ static int ipv6_sysctl_rtcache_flush(const struct ctl_table *ctl, int write, + return ret; + + net = (struct net *)ctl->extra1; +- delay = net->ipv6.sysctl.flush_delay; ++ delay = READ_ONCE(net->ipv6.sysctl.flush_delay); + fib6_run_gc(delay <= 0 ? 0 : (unsigned long)delay, net, delay > 0); + return 0; + } +-- +2.51.0 + diff --git a/queue-6.18/ipv6-annotate-data-races-over-sysctl.flowlabel_refle.patch b/queue-6.18/ipv6-annotate-data-races-over-sysctl.flowlabel_refle.patch new file mode 100644 index 00000000000..771fee6cfb8 --- /dev/null +++ b/queue-6.18/ipv6-annotate-data-races-over-sysctl.flowlabel_refle.patch @@ -0,0 +1,69 @@ +From 4855836bda620f1442a76923e1869d0d4310c902 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 09:41:38 +0000 +Subject: ipv6: annotate data-races over sysctl.flowlabel_reflect + +From: Eric Dumazet + +[ Upstream commit 5ade47c974b46eb2a1279185962a0ffa15dc5450 ] + +Add missing READ_ONCE() when reading ipv6.sysctl.flowlabel_reflect, +as its value can be changed under us. + +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260115094141.3124990-6-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/af_inet6.c | 4 ++-- + net/ipv6/icmp.c | 3 ++- + net/ipv6/tcp_ipv6.c | 3 ++- + 3 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c +index 0e8f48835869c..3709f213d33de 100644 +--- a/net/ipv6/af_inet6.c ++++ b/net/ipv6/af_inet6.c +@@ -224,8 +224,8 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol, + inet6_set_bit(MC6_LOOP, sk); + inet6_set_bit(MC6_ALL, sk); + np->pmtudisc = IPV6_PMTUDISC_WANT; +- inet6_assign_bit(REPFLOW, sk, net->ipv6.sysctl.flowlabel_reflect & +- FLOWLABEL_REFLECT_ESTABLISHED); ++ inet6_assign_bit(REPFLOW, sk, READ_ONCE(net->ipv6.sysctl.flowlabel_reflect) & ++ FLOWLABEL_REFLECT_ESTABLISHED); + sk->sk_ipv6only = net->ipv6.sysctl.bindv6only; + sk->sk_txrehash = READ_ONCE(net->core.sysctl_txrehash); + +diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c +index 35b32dcf581ff..54ad4c7578679 100644 +--- a/net/ipv6/icmp.c ++++ b/net/ipv6/icmp.c +@@ -757,7 +757,8 @@ static enum skb_drop_reason icmpv6_echo_reply(struct sk_buff *skb) + tmp_hdr.icmp6_type = type; + + memset(&fl6, 0, sizeof(fl6)); +- if (net->ipv6.sysctl.flowlabel_reflect & FLOWLABEL_REFLECT_ICMPV6_ECHO_REPLIES) ++ if (READ_ONCE(net->ipv6.sysctl.flowlabel_reflect) & ++ FLOWLABEL_REFLECT_ICMPV6_ECHO_REPLIES) + fl6.flowlabel = ip6_flowlabel(ipv6_hdr(skb)); + + fl6.flowi6_proto = IPPROTO_ICMPV6; +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index 59c4977a811a0..2e07dba293b41 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -1131,7 +1131,8 @@ static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb, + txhash = inet_twsk(sk)->tw_txhash; + } + } else { +- if (net->ipv6.sysctl.flowlabel_reflect & FLOWLABEL_REFLECT_TCP_RESET) ++ if (READ_ONCE(net->ipv6.sysctl.flowlabel_reflect) & ++ FLOWLABEL_REFLECT_TCP_RESET) + label = ip6_flowlabel(ipv6h); + } + +-- +2.51.0 + diff --git a/queue-6.18/ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch b/queue-6.18/ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch new file mode 100644 index 00000000000..c4c255e4945 --- /dev/null +++ b/queue-6.18/ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch @@ -0,0 +1,66 @@ +From a71f67f532cdca28c74f05c595d2fee24cdbbd7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 09:41:40 +0000 +Subject: ipv6: exthdrs: annotate data-race over multiple sysctl + +From: Eric Dumazet + +[ Upstream commit 978b67d28358b0b4eacfa94453d1ad4e09b123ad ] + +Following four sysctls can change under us, add missing READ_ONCE(). + +- ipv6.sysctl.max_dst_opts_len +- ipv6.sysctl.max_dst_opts_cnt +- ipv6.sysctl.max_hbh_opts_len +- ipv6.sysctl.max_hbh_opts_cnt + +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260115094141.3124990-8-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/exthdrs.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c +index a23eb8734e151..54088fa0c09d0 100644 +--- a/net/ipv6/exthdrs.c ++++ b/net/ipv6/exthdrs.c +@@ -314,7 +314,7 @@ static int ipv6_destopt_rcv(struct sk_buff *skb) + } + + extlen = (skb_transport_header(skb)[1] + 1) << 3; +- if (extlen > net->ipv6.sysctl.max_dst_opts_len) ++ if (extlen > READ_ONCE(net->ipv6.sysctl.max_dst_opts_len)) + goto fail_and_free; + + opt->lastopt = opt->dst1 = skb_network_header_len(skb); +@@ -322,7 +322,8 @@ static int ipv6_destopt_rcv(struct sk_buff *skb) + dstbuf = opt->dst1; + #endif + +- if (ip6_parse_tlv(false, skb, net->ipv6.sysctl.max_dst_opts_cnt)) { ++ if (ip6_parse_tlv(false, skb, ++ READ_ONCE(net->ipv6.sysctl.max_dst_opts_cnt))) { + skb->transport_header += extlen; + opt = IP6CB(skb); + #if IS_ENABLED(CONFIG_IPV6_MIP6) +@@ -1049,11 +1050,12 @@ int ipv6_parse_hopopts(struct sk_buff *skb) + } + + extlen = (skb_transport_header(skb)[1] + 1) << 3; +- if (extlen > net->ipv6.sysctl.max_hbh_opts_len) ++ if (extlen > READ_ONCE(net->ipv6.sysctl.max_hbh_opts_len)) + goto fail_and_free; + + opt->flags |= IP6SKB_HOPBYHOP; +- if (ip6_parse_tlv(true, skb, net->ipv6.sysctl.max_hbh_opts_cnt)) { ++ if (ip6_parse_tlv(true, skb, ++ READ_ONCE(net->ipv6.sysctl.max_hbh_opts_cnt))) { + skb->transport_header += extlen; + opt = IP6CB(skb); + opt->nhoff = sizeof(struct ipv6hdr); +-- +2.51.0 + diff --git a/queue-6.18/irqchip-riscv-imsic-add-a-cpu-pm-notifier-to-restore.patch b/queue-6.18/irqchip-riscv-imsic-add-a-cpu-pm-notifier-to-restore.patch new file mode 100644 index 00000000000..63bac877ad7 --- /dev/null +++ b/queue-6.18/irqchip-riscv-imsic-add-a-cpu-pm-notifier-to-restore.patch @@ -0,0 +1,110 @@ +From 0f4e6f187b5f431babfd56046d28030a87e6c5c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 14:07:40 +0800 +Subject: irqchip/riscv-imsic: Add a CPU pm notifier to restore the IMSIC on + exit + +From: Nick Hu + +[ Upstream commit f48b4bd0915bf61ac12b8c65c7939ebd03bc8abf ] + +The IMSIC might be reset when the system enters a low power state, but on +exit nothing restores the registers, which prevents interrupt delivery. + +Solve this by registering a CPU power management notifier, which restores +the IMSIC on exit. + +Signed-off-by: Nick Hu +Signed-off-by: Thomas Gleixner +Reviewed-by: Yong-Xuan Wang +Reviewed-by: Cyan Yang +Reviewed-by: Anup Patel +Reviewed-by: Nutty Liu +Link: https://patch.msgid.link/20251202-preserve-aplic-imsic-v3-1-1844fbf1fe92@sifive.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-riscv-imsic-early.c | 39 ++++++++++++++++++++----- + 1 file changed, 31 insertions(+), 8 deletions(-) + +diff --git a/drivers/irqchip/irq-riscv-imsic-early.c b/drivers/irqchip/irq-riscv-imsic-early.c +index 2c4c682627b8c..d1727c343c38f 100644 +--- a/drivers/irqchip/irq-riscv-imsic-early.c ++++ b/drivers/irqchip/irq-riscv-imsic-early.c +@@ -7,6 +7,7 @@ + #define pr_fmt(fmt) "riscv-imsic: " fmt + #include + #include ++#include + #include + #include + #include +@@ -128,14 +129,8 @@ static void imsic_handle_irq(struct irq_desc *desc) + chained_irq_exit(chip, desc); + } + +-static int imsic_starting_cpu(unsigned int cpu) ++static void imsic_hw_states_init(void) + { +- /* Mark per-CPU IMSIC state as online */ +- imsic_state_online(); +- +- /* Enable per-CPU parent interrupt */ +- enable_percpu_irq(imsic_parent_irq, irq_get_trigger_type(imsic_parent_irq)); +- + /* Setup IPIs */ + imsic_ipi_starting_cpu(); + +@@ -147,6 +142,18 @@ static int imsic_starting_cpu(unsigned int cpu) + + /* Enable local interrupt delivery */ + imsic_local_delivery(true); ++} ++ ++static int imsic_starting_cpu(unsigned int cpu) ++{ ++ /* Mark per-CPU IMSIC state as online */ ++ imsic_state_online(); ++ ++ /* Enable per-CPU parent interrupt */ ++ enable_percpu_irq(imsic_parent_irq, irq_get_trigger_type(imsic_parent_irq)); ++ ++ /* Initialize the IMSIC registers to enable the interrupt delivery */ ++ imsic_hw_states_init(); + + return 0; + } +@@ -162,6 +169,22 @@ static int imsic_dying_cpu(unsigned int cpu) + return 0; + } + ++static int imsic_pm_notifier(struct notifier_block *self, unsigned long cmd, void *v) ++{ ++ switch (cmd) { ++ case CPU_PM_EXIT: ++ /* Initialize the IMSIC registers to enable the interrupt delivery */ ++ imsic_hw_states_init(); ++ break; ++ } ++ ++ return NOTIFY_OK; ++} ++ ++static struct notifier_block imsic_pm_notifier_block = { ++ .notifier_call = imsic_pm_notifier, ++}; ++ + static int __init imsic_early_probe(struct fwnode_handle *fwnode) + { + struct irq_domain *domain; +@@ -199,7 +222,7 @@ static int __init imsic_early_probe(struct fwnode_handle *fwnode) + cpuhp_setup_state(CPUHP_AP_IRQ_RISCV_IMSIC_STARTING, "irqchip/riscv/imsic:starting", + imsic_starting_cpu, imsic_dying_cpu); + +- return 0; ++ return cpu_pm_register_notifier(&imsic_pm_notifier_block); + } + + static int __init imsic_early_dt_init(struct device_node *node, struct device_node *parent) +-- +2.51.0 + diff --git a/queue-6.18/jfs-add-missing-set_freezable-for-freezable-kthread.patch b/queue-6.18/jfs-add-missing-set_freezable-for-freezable-kthread.patch new file mode 100644 index 00000000000..14e7b601f5c --- /dev/null +++ b/queue-6.18/jfs-add-missing-set_freezable-for-freezable-kthread.patch @@ -0,0 +1,37 @@ +From f404281c8e3cb4add36a0f2c28ddd1644cc93078 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 19:38:01 +0800 +Subject: jfs: Add missing set_freezable() for freezable kthread + +From: Haotian Zhang + +[ Upstream commit eb0cfcf265714b419cc3549895a00632e76732ae ] + +The jfsIOWait() thread calls try_to_freeze() but lacks set_freezable(), +causing it to remain non-freezable by default. This prevents proper +freezing during system suspend. + +Add set_freezable() to make the thread freezable as intended. + +Signed-off-by: Haotian Zhang +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_logmgr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c +index b343c5ea11592..5b1c5da041630 100644 +--- a/fs/jfs/jfs_logmgr.c ++++ b/fs/jfs/jfs_logmgr.c +@@ -2311,6 +2311,7 @@ int jfsIOWait(void *arg) + { + struct lbuf *bp; + ++ set_freezable(); + do { + spin_lock_irq(&log_redrive_lock); + while ((bp = log_redrive_list)) { +-- +2.51.0 + diff --git a/queue-6.18/jfs-nlink-overflow-in-jfs_rename.patch b/queue-6.18/jfs-nlink-overflow-in-jfs_rename.patch new file mode 100644 index 00000000000..b0e269e75fb --- /dev/null +++ b/queue-6.18/jfs-nlink-overflow-in-jfs_rename.patch @@ -0,0 +1,54 @@ +From c6a7f8a206b8fa7e6c58b634e55005a5916c81cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Oct 2025 13:22:12 +0100 +Subject: jfs: nlink overflow in jfs_rename + +From: Jori Koolstra + +[ Upstream commit 9218dc26fd922b09858ecd3666ed57dfd8098da8 ] + +If nlink is maximal for a directory (-1) and inside that directory you +perform a rename for some child directory (not moving from the parent), +then the nlink of the first directory is first incremented and later +decremented. Normally this is fine, but when nlink = -1 this causes a +wrap around to 0, and then drop_nlink issues a warning. + +After applying the patch syzbot no longer issues any warnings. I also +ran some basic fs tests to look for any regressions. + +Signed-off-by: Jori Koolstra +Reported-by: syzbot+9131ddfd7870623b719f@syzkaller.appspotmail.com +Closes: https://syzbot.org/bug?extid=9131ddfd7870623b719f +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/namei.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c +index 65a218eba8faf..7879c049632b3 100644 +--- a/fs/jfs/namei.c ++++ b/fs/jfs/namei.c +@@ -1228,7 +1228,7 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir, + jfs_err("jfs_rename: dtInsert returned -EIO"); + goto out_tx; + } +- if (S_ISDIR(old_ip->i_mode)) ++ if (S_ISDIR(old_ip->i_mode) && old_dir != new_dir) + inc_nlink(new_dir); + } + /* +@@ -1244,7 +1244,9 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir, + goto out_tx; + } + if (S_ISDIR(old_ip->i_mode)) { +- drop_nlink(old_dir); ++ if (new_ip || old_dir != new_dir) ++ drop_nlink(old_dir); ++ + if (old_dir != new_dir) { + /* + * Change inode number of parent for moved directory +-- +2.51.0 + diff --git a/queue-6.18/kselftest-kublk-include-message-in-_static_assert-fo.patch b/queue-6.18/kselftest-kublk-include-message-in-_static_assert-fo.patch new file mode 100644 index 00000000000..7de82d6a1e9 --- /dev/null +++ b/queue-6.18/kselftest-kublk-include-message-in-_static_assert-fo.patch @@ -0,0 +1,85 @@ +From 6e5f11b40f09962aec3cf7a39a4cde162c60a927 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 14:20:22 +0530 +Subject: kselftest/kublk: include message in _Static_assert for C11 + compatibility + +From: Clint George + +[ Upstream commit 3e6ad272bb8b3199bad952e7b077102af2d8df03 ] + +Add descriptive message in the _Static_assert to comply with the C11 +standard requirement to prevent compiler from throwing out error. The +compiler throws an error when _Static_assert is used without a message as +that is a C23 extension. + +[] Testing: +The diff between before and after of running the kselftest test of the +module shows no regression on system with x86 architecture + +[] Error log: +~/Desktop/kernel-dev/linux-v1/tools/testing/selftests/ublk$ make LLVM=1 W=1 + CC kublk +In file included from kublk.c:6: +./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions] + 220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7); + | ^ + | , "" +1 error generated. +In file included from null.c:3: +./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions] + 220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7); + | ^ + | , "" +1 error generated. +In file included from file_backed.c:3: +./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions] + 220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7); + | ^ + | , "" +1 error generated. +In file included from common.c:3: +./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions] + 220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7); + | ^ + | , "" +1 error generated. +In file included from stripe.c:3: +./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions] + 220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7); + | ^ + | , "" +1 error generated. +In file included from fault_inject.c:11: +./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions] + 220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7); + | ^ + | , "" +1 error generated. +make: *** [../lib.mk:225: ~/Desktop/kernel-dev/linux-v1/tools/testing/selftests/ublk/kublk] Error 1 + +Link: https://lore.kernel.org/r/20251215085022.7642-1-clintbgeorge@gmail.com +Signed-off-by: Clint George +Reviewed-by: Ming Lei +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/ublk/kublk.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/ublk/kublk.h b/tools/testing/selftests/ublk/kublk.h +index 1b8833a400643..39839c711c797 100644 +--- a/tools/testing/selftests/ublk/kublk.h ++++ b/tools/testing/selftests/ublk/kublk.h +@@ -220,7 +220,7 @@ static inline __u64 build_user_data(unsigned tag, unsigned op, + unsigned tgt_data, unsigned q_id, unsigned is_target_io) + { + /* we only have 7 bits to encode q_id */ +- _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7); ++ _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7, "UBLK_MAX_QUEUES_SHIFT must be <= 7"); + assert(!(tag >> 16) && !(op >> 8) && !(tgt_data >> 16) && !(q_id >> 7)); + + return tag | (op << 16) | (tgt_data << 24) | +-- +2.51.0 + diff --git a/queue-6.18/libceph-define-and-enforce-ceph_max_key_len.patch b/queue-6.18/libceph-define-and-enforce-ceph_max_key_len.patch new file mode 100644 index 00000000000..186ad41009a --- /dev/null +++ b/queue-6.18/libceph-define-and-enforce-ceph_max_key_len.patch @@ -0,0 +1,82 @@ +From e1a757e542bda69486513a0d7a4aedaf7b09a5ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jul 2025 16:30:50 +0200 +Subject: libceph: define and enforce CEPH_MAX_KEY_LEN + +From: Ilya Dryomov + +[ Upstream commit ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf ] + +When decoding the key, verify that the key material would fit into +a fixed-size buffer in process_auth_done() and generally has a sane +length. + +The new CEPH_MAX_KEY_LEN check replaces the existing check for a key +with no key material which is a) not universal since CEPH_CRYPTO_NONE +has to be excluded and b) doesn't provide much value since a smaller +than needed key is just as invalid as no key -- this has to be handled +elsewhere anyway. + +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + net/ceph/crypto.c | 8 +++++--- + net/ceph/crypto.h | 2 +- + net/ceph/messenger_v2.c | 2 +- + 3 files changed, 7 insertions(+), 5 deletions(-) + +diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c +index 01b2ce1e8fc06..5601732cf4faa 100644 +--- a/net/ceph/crypto.c ++++ b/net/ceph/crypto.c +@@ -37,9 +37,6 @@ static int set_secret(struct ceph_crypto_key *key, void *buf) + return -ENOTSUPP; + } + +- if (!key->len) +- return -EINVAL; +- + key->key = kmemdup(buf, key->len, GFP_NOIO); + if (!key->key) { + ret = -ENOMEM; +@@ -83,6 +80,11 @@ int ceph_crypto_key_decode(struct ceph_crypto_key *key, void **p, void *end) + ceph_decode_copy(p, &key->created, sizeof(key->created)); + key->len = ceph_decode_16(p); + ceph_decode_need(p, end, key->len, bad); ++ if (key->len > CEPH_MAX_KEY_LEN) { ++ pr_err("secret too big %d\n", key->len); ++ return -EINVAL; ++ } ++ + ret = set_secret(key, *p); + memzero_explicit(*p, key->len); + *p += key->len; +diff --git a/net/ceph/crypto.h b/net/ceph/crypto.h +index 23de29fc613cf..a20bad6d1e964 100644 +--- a/net/ceph/crypto.h ++++ b/net/ceph/crypto.h +@@ -5,7 +5,7 @@ + #include + #include + +-#define CEPH_KEY_LEN 16 ++#define CEPH_MAX_KEY_LEN 16 + #define CEPH_MAX_CON_SECRET_LEN 64 + + /* +diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c +index 061eaa047f765..b67f2b582bc76 100644 +--- a/net/ceph/messenger_v2.c ++++ b/net/ceph/messenger_v2.c +@@ -2361,7 +2361,7 @@ static int process_auth_reply_more(struct ceph_connection *con, + */ + static int process_auth_done(struct ceph_connection *con, void *p, void *end) + { +- u8 session_key_buf[CEPH_KEY_LEN + 16]; ++ u8 session_key_buf[CEPH_MAX_KEY_LEN + 16]; + u8 con_secret_buf[CEPH_MAX_CON_SECRET_LEN + 16]; + u8 *session_key = PTR_ALIGN(&session_key_buf[0], 16); + u8 *con_secret = PTR_ALIGN(&con_secret_buf[0], 16); +-- +2.51.0 + diff --git a/queue-6.18/libperf-build-always-place-libperf-includes-first.patch b/queue-6.18/libperf-build-always-place-libperf-includes-first.patch new file mode 100644 index 00000000000..f5211c39a41 --- /dev/null +++ b/queue-6.18/libperf-build-always-place-libperf-includes-first.patch @@ -0,0 +1,56 @@ +From 24e1b649a45929a13c96ecd4ec10bf59a9961b9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 22:09:18 -0800 +Subject: libperf build: Always place libperf includes first + +From: Ian Rogers + +[ Upstream commit 8c5b40678c63be6b85f1c2dc8c8b89d632faf988 ] + +When building tools/perf the CFLAGS can contain a directory for the +installed headers. + +As the headers may be being installed while building libperf.a this can +cause headers to be partially installed and found in the include path +while building an object file for libperf.a. + +The installed header may reference other installed headers that are +missing given the partial nature of the install and then the build fails +with a missing header file. + +Avoid this by ensuring the libperf source headers are always first in +the CFLAGS. + +Fixes: 3143504918105156 ("libperf: Make libperf.a part of the perf build") +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/perf/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/perf/Makefile b/tools/lib/perf/Makefile +index 7fbb50b74c00b..5c64122bf5374 100644 +--- a/tools/lib/perf/Makefile ++++ b/tools/lib/perf/Makefile +@@ -51,9 +51,9 @@ INCLUDES = \ + -I$(srctree)/tools/include/uapi + + # Append required CFLAGS ++override CFLAGS := $(INCLUDES) $(CFLAGS) + override CFLAGS += -g -Werror -Wall + override CFLAGS += -fPIC +-override CFLAGS += $(INCLUDES) + override CFLAGS += -fvisibility=hidden + override CFLAGS += $(EXTRA_WARNINGS) + override CFLAGS += $(EXTRA_CFLAGS) +-- +2.51.0 + diff --git a/queue-6.18/libsubcmd-fix-null-intersection-case-in-exclude_cmds.patch b/queue-6.18/libsubcmd-fix-null-intersection-case-in-exclude_cmds.patch new file mode 100644 index 00000000000..5293bed8cf2 --- /dev/null +++ b/queue-6.18/libsubcmd-fix-null-intersection-case-in-exclude_cmds.patch @@ -0,0 +1,67 @@ +From 8900937d94f412696b0fcdf86ae9f30fd68c518d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 16:36:32 -0500 +Subject: libsubcmd: Fix null intersection case in exclude_cmds() + +From: Sri Jayaramappa + +[ Upstream commit b6ee9b6e206b288921c14c906eebf4b32fe0c0d8 ] + +When there is no exclusion occurring from the cmds list - for example - +cmds contains ["read-vdso32"] and excludes contains ["archive"] - the +main loop completes with ci == cj == 0. In the original code the loop +processing the remaining elements in the list was conditional: + + if (ci != cj) { ...} + +So we end up in the assertion loop since ci < cmds->cnt and we +incorrectly try to assert the list elements to be NULL and fail with +the following error + + help.c:104: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed. + +Fix this by moving the if (ci != cj) check inside of a broader loop. +If ci != cj, left shift the list elements, as before, and then +unconditionally advance the ci and cj indicies which also covers the +ci == cj case. + +Fixes: 1fdf938168c4d26f ("perf tools: Fix use-after-free in help_unknown_cmd()") +Reviewed-by: Guilherme Amadio +Signed-off-by: Sri Jayaramappa +Tested-by: Guilherme Amadio +Tested-by: Ian Rogers +Cc: Joshua Hunt +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20251202213632.2873731-1-sjayaram@akamai.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/subcmd/help.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c +index ddaeb4eb3e249..db94aa685b73b 100644 +--- a/tools/lib/subcmd/help.c ++++ b/tools/lib/subcmd/help.c +@@ -97,11 +97,13 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes) + ei++; + } + } +- if (ci != cj) { +- while (ci < cmds->cnt) { +- cmds->names[cj++] = cmds->names[ci]; +- cmds->names[ci++] = NULL; ++ while (ci < cmds->cnt) { ++ if (ci != cj) { ++ cmds->names[cj] = cmds->names[ci]; ++ cmds->names[ci] = NULL; + } ++ ci++; ++ cj++; + } + for (ci = cj; ci < cmds->cnt; ci++) + assert(cmds->names[ci] == NULL); +-- +2.51.0 + diff --git a/queue-6.18/m68k-nommu-fix-memmove-with-differently-aligned-src-.patch b/queue-6.18/m68k-nommu-fix-memmove-with-differently-aligned-src-.patch new file mode 100644 index 00000000000..e9708c7f601 --- /dev/null +++ b/queue-6.18/m68k-nommu-fix-memmove-with-differently-aligned-src-.patch @@ -0,0 +1,69 @@ +From e668f65c6bc53f811672b6c75dc3bc0523e504bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Dec 2025 21:04:01 +0900 +Subject: m68k: nommu: fix memmove() with differently aligned src and dest for + 68000 + +From: Daniel Palmer + +[ Upstream commit 590fe2f46c8698bb758f9002cb247ca10ce95569 ] + +68000 has different alignment needs to 68020+. +memcpy() checks if the destination is aligned and does a smaller copy +to fix the alignment and then critically for 68000 it checks if the +source is still unaligned and if it is reverts to smaller copies. + +memmove() does not currently do the second part and malfunctions if +one of the pointers is aligned and the other isn't. + +This is apparently getting triggered by printk. If I put breakpoints +into the new checks added by this commit the first hit looks like this: + +memmove (n=205, src=0x2f3971 , dest=0x2f3980 ) at arch/m68k/lib/memmove.c:82 + +Signed-off-by: Daniel Palmer +Signed-off-by: Greg Ungerer +Signed-off-by: Sasha Levin +--- + arch/m68k/lib/memmove.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/arch/m68k/lib/memmove.c b/arch/m68k/lib/memmove.c +index 6519f7f349f66..e33f00b02e4c0 100644 +--- a/arch/m68k/lib/memmove.c ++++ b/arch/m68k/lib/memmove.c +@@ -24,6 +24,15 @@ void *memmove(void *dest, const void *src, size_t n) + src = csrc; + n--; + } ++#if defined(CONFIG_M68000) ++ if ((long)src & 1) { ++ char *cdest = dest; ++ const char *csrc = src; ++ for (; n; n--) ++ *cdest++ = *csrc++; ++ return xdest; ++ } ++#endif + if (n > 2 && (long)dest & 2) { + short *sdest = dest; + const short *ssrc = src; +@@ -66,6 +75,15 @@ void *memmove(void *dest, const void *src, size_t n) + src = csrc; + n--; + } ++#if defined(CONFIG_M68000) ++ if ((long)src & 1) { ++ char *cdest = dest; ++ const char *csrc = src; ++ for (; n; n--) ++ *--cdest = *--csrc; ++ return xdest; ++ } ++#endif + if (n > 2 && (long)dest & 2) { + short *sdest = dest; + const short *ssrc = src; +-- +2.51.0 + diff --git a/queue-6.18/mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch b/queue-6.18/mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch new file mode 100644 index 00000000000..c58f6f389a8 --- /dev/null +++ b/queue-6.18/mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch @@ -0,0 +1,66 @@ +From 84e0ccb9bc3da79b632bdb71ee92d0774f9d753a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:24 +0100 +Subject: mailbox: bcm-ferxrm-mailbox: Use default primary handler + +From: Sebastian Andrzej Siewior + +[ Upstream commit 03843d95a4a4e0ba22ad4fcda65ccf21822b104c ] + +request_threaded_irq() is invoked with a primary and a secondary handler +and no flags are passed. The primary handler is the same as +irq_default_primary_handler() so there is no need to have an identical +copy. + +The lack of the IRQF_ONESHOT flag can be dangerous because the interrupt +source is not masked while the threaded handler is active. This means, +especially on LEVEL typed interrupt lines, the interrupt can fire again +before the threaded handler had a chance to run. + +Use the default primary interrupt handler by specifying NULL and set +IRQF_ONESHOT so the interrupt source is masked until the secondary handler +is done. + +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Thomas Gleixner +Link: https://patch.msgid.link/20260128095540.863589-5-bigeasy@linutronix.de +Signed-off-by: Sasha Levin +--- + drivers/mailbox/bcm-flexrm-mailbox.c | 14 ++------------ + 1 file changed, 2 insertions(+), 12 deletions(-) + +diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c +index 41f79e51d9e5a..4255fefc3a5a0 100644 +--- a/drivers/mailbox/bcm-flexrm-mailbox.c ++++ b/drivers/mailbox/bcm-flexrm-mailbox.c +@@ -1173,14 +1173,6 @@ static int flexrm_debugfs_stats_show(struct seq_file *file, void *offset) + + /* ====== FlexRM interrupt handler ===== */ + +-static irqreturn_t flexrm_irq_event(int irq, void *dev_id) +-{ +- /* We only have MSI for completions so just wakeup IRQ thread */ +- /* Ring related errors will be informed via completion descriptors */ +- +- return IRQ_WAKE_THREAD; +-} +- + static irqreturn_t flexrm_irq_thread(int irq, void *dev_id) + { + flexrm_process_completions(dev_id); +@@ -1271,10 +1263,8 @@ static int flexrm_startup(struct mbox_chan *chan) + ret = -ENODEV; + goto fail_free_cmpl_memory; + } +- ret = request_threaded_irq(ring->irq, +- flexrm_irq_event, +- flexrm_irq_thread, +- 0, dev_name(ring->mbox->dev), ring); ++ ret = request_threaded_irq(ring->irq, NULL, flexrm_irq_thread, ++ IRQF_ONESHOT, dev_name(ring->mbox->dev), ring); + if (ret) { + dev_err(ring->mbox->dev, + "failed to request ring%d IRQ\n", ring->num); +-- +2.51.0 + diff --git a/queue-6.18/mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch b/queue-6.18/mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch new file mode 100644 index 00000000000..aa3acca5736 --- /dev/null +++ b/queue-6.18/mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch @@ -0,0 +1,77 @@ +From 7940f3bb9604c10e78ea5f3286652311e48ebc23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 16:00:54 +0800 +Subject: mailbox: imx: Skip the suspend flag for i.MX7ULP + +From: Jacky Bai + +[ Upstream commit 673b570825ace0dcb2ac0c676080559d505c6f40 ] + +In current imx-mailbox driver, the MU IRQ is configured with +'IRQF_NO_SUSPEND' flag set. So during linux suspend/resume flow, +the MU IRQ is always enabled. With commit 892cb524ae8a ("mailbox: imx: +fix wakeup failure from freeze mode"), if the MU IRQ is triggered after +the priv->suspended flag has been set, the system suspend will be +aborted. + +On i.MX7ULP platform, certain drivers that depend on rpmsg may need +to send rpmsg request and receive an acknowledgment from the remote +core during the late_suspend stage. Early suspend abort is not +expected, and the i.MX7ULP already has additional hardware and +software to make sure the system can be wakeup from freeze mode +correctly when MU IRQ is trigger. + +Skip the 'suspend' flag handling logic on i.MX7ULP to avoid the +early abort when doing suspend. + +Signed-off-by: Jacky Bai +Reviewed-by: Peng Fan +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/imx-mailbox.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/mailbox/imx-mailbox.c b/drivers/mailbox/imx-mailbox.c +index 6778afc64a048..003f9236c35e0 100644 +--- a/drivers/mailbox/imx-mailbox.c ++++ b/drivers/mailbox/imx-mailbox.c +@@ -122,6 +122,7 @@ struct imx_mu_dcfg { + u32 xRR; /* Receive Register0 */ + u32 xSR[IMX_MU_xSR_MAX]; /* Status Registers */ + u32 xCR[IMX_MU_xCR_MAX]; /* Control Registers */ ++ bool skip_suspend_flag; + }; + + #define IMX_MU_xSR_GIPn(type, x) (type & IMX_MU_V2 ? BIT(x) : BIT(28 + (3 - (x)))) +@@ -988,6 +989,7 @@ static const struct imx_mu_dcfg imx_mu_cfg_imx7ulp = { + .xRR = 0x40, + .xSR = {0x60, 0x60, 0x60, 0x60}, + .xCR = {0x64, 0x64, 0x64, 0x64, 0x64}, ++ .skip_suspend_flag = true, + }; + + static const struct imx_mu_dcfg imx_mu_cfg_imx8ulp = { +@@ -1071,7 +1073,8 @@ static int __maybe_unused imx_mu_suspend_noirq(struct device *dev) + priv->xcr[i] = imx_mu_read(priv, priv->dcfg->xCR[i]); + } + +- priv->suspend = true; ++ if (!priv->dcfg->skip_suspend_flag) ++ priv->suspend = true; + + return 0; + } +@@ -1094,7 +1097,8 @@ static int __maybe_unused imx_mu_resume_noirq(struct device *dev) + imx_mu_write(priv, priv->xcr[i], priv->dcfg->xCR[i]); + } + +- priv->suspend = false; ++ if (!priv->dcfg->skip_suspend_flag) ++ priv->suspend = false; + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.18/mailbox-mchp-ipc-sbi-fix-out-of-bounds-access-in-mch.patch b/queue-6.18/mailbox-mchp-ipc-sbi-fix-out-of-bounds-access-in-mch.patch new file mode 100644 index 00000000000..e1e425a6ade --- /dev/null +++ b/queue-6.18/mailbox-mchp-ipc-sbi-fix-out-of-bounds-access-in-mch.patch @@ -0,0 +1,87 @@ +From 997f9a86e3e129575a9c1e286365089c0577635c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Nov 2025 13:49:22 +0000 +Subject: mailbox: mchp-ipc-sbi: fix out-of-bounds access in + mchp_ipc_get_cluster_aggr_irq() + +From: Valentina Fernandez + +[ Upstream commit f7c330a8c83c9b0332fd524097eaf3e69148164d ] + +The cluster_cfg array is dynamically allocated to hold per-CPU +configuration structures, with its size based on the number of online +CPUs. Previously, this array was indexed using hartid, which may be +non-contiguous or exceed the bounds of the array, leading to +out-of-bounds access. +Switch to using cpuid as the index, as it is guaranteed to be within +the valid range provided by for_each_online_cpu(). + +Signed-off-by: Valentina Fernandez +Reviewed-by: Conor Dooley +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/mailbox-mchp-ipc-sbi.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/drivers/mailbox/mailbox-mchp-ipc-sbi.c b/drivers/mailbox/mailbox-mchp-ipc-sbi.c +index a6e52009a4245..d444491a584e8 100644 +--- a/drivers/mailbox/mailbox-mchp-ipc-sbi.c ++++ b/drivers/mailbox/mailbox-mchp-ipc-sbi.c +@@ -180,20 +180,20 @@ static irqreturn_t mchp_ipc_cluster_aggr_isr(int irq, void *data) + /* Find out the hart that originated the irq */ + for_each_online_cpu(i) { + hartid = cpuid_to_hartid_map(i); +- if (irq == ipc->cluster_cfg[hartid].irq) ++ if (irq == ipc->cluster_cfg[i].irq) + break; + } + + status_msg.cluster = hartid; +- memcpy(ipc->cluster_cfg[hartid].buf_base, &status_msg, sizeof(struct mchp_ipc_status)); ++ memcpy(ipc->cluster_cfg[i].buf_base, &status_msg, sizeof(struct mchp_ipc_status)); + +- ret = mchp_ipc_sbi_send(SBI_EXT_IPC_STATUS, ipc->cluster_cfg[hartid].buf_base_addr); ++ ret = mchp_ipc_sbi_send(SBI_EXT_IPC_STATUS, ipc->cluster_cfg[i].buf_base_addr); + if (ret < 0) { + dev_err_ratelimited(ipc->dev, "could not get IHC irq status ret=%d\n", ret); + return IRQ_HANDLED; + } + +- memcpy(&status_msg, ipc->cluster_cfg[hartid].buf_base, sizeof(struct mchp_ipc_status)); ++ memcpy(&status_msg, ipc->cluster_cfg[i].buf_base, sizeof(struct mchp_ipc_status)); + + /* + * Iterate over each bit set in the IHC interrupt status register (IRQ_STATUS) to identify +@@ -385,21 +385,21 @@ static int mchp_ipc_get_cluster_aggr_irq(struct mchp_ipc_sbi_mbox *ipc) + if (ret <= 0) + continue; + +- ipc->cluster_cfg[hartid].irq = ret; +- ret = devm_request_irq(ipc->dev, ipc->cluster_cfg[hartid].irq, ++ ipc->cluster_cfg[cpuid].irq = ret; ++ ret = devm_request_irq(ipc->dev, ipc->cluster_cfg[cpuid].irq, + mchp_ipc_cluster_aggr_isr, IRQF_SHARED, + "miv-ihc-irq", ipc); + if (ret) + return ret; + +- ipc->cluster_cfg[hartid].buf_base = devm_kmalloc(ipc->dev, +- sizeof(struct mchp_ipc_status), +- GFP_KERNEL); ++ ipc->cluster_cfg[cpuid].buf_base = devm_kmalloc(ipc->dev, ++ sizeof(struct mchp_ipc_status), ++ GFP_KERNEL); + +- if (!ipc->cluster_cfg[hartid].buf_base) ++ if (!ipc->cluster_cfg[cpuid].buf_base) + return -ENOMEM; + +- ipc->cluster_cfg[hartid].buf_base_addr = __pa(ipc->cluster_cfg[hartid].buf_base); ++ ipc->cluster_cfg[cpuid].buf_base_addr = __pa(ipc->cluster_cfg[cpuid].buf_base); + + irq_found = true; + } +-- +2.51.0 + diff --git a/queue-6.18/mailbox-mchp-ipc-sbi-fix-uninitialized-symbol-and-ot.patch b/queue-6.18/mailbox-mchp-ipc-sbi-fix-uninitialized-symbol-and-ot.patch new file mode 100644 index 00000000000..71d1820babe --- /dev/null +++ b/queue-6.18/mailbox-mchp-ipc-sbi-fix-uninitialized-symbol-and-ot.patch @@ -0,0 +1,89 @@ +From 146a5d6efbba6e201a66b8fcefef146e6896734e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Dec 2025 10:33:59 +0000 +Subject: mailbox: mchp-ipc-sbi: fix uninitialized symbol and other smatch + warnings + +From: Valentina Fernandez + +[ Upstream commit bc4d17e495cd3b02bcb2e10f575763a5ff31f80b ] + +Fix uninitialized symbol 'hartid' warning in mchp_ipc_cluster_aggr_isr() +by introducing a 'found' flag to track whether the IRQ matches any +online hart. If no match is found, return IRQ_NONE. + +Also fix other smatch warnings by removing dead code in +mchp_ipc_startup() and by returning -ENODEV in dev_err_probe() if the +Microchip SBI extension is not found. + +Fixes below smatch warnings: +drivers/mailbox/mailbox-mchp-ipc-sbi.c:187 mchp_ipc_cluster_aggr_isr() error: uninitialized symbol 'hartid'. +drivers/mailbox/mailbox-mchp-ipc-sbi.c:324 mchp_ipc_startup() warn: ignoring unreachable code. +drivers/mailbox/mailbox-mchp-ipc-sbi.c:422 mchp_ipc_probe() warn: passing zero to 'dev_err_probe' + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202512171533.CDLdScMY-lkp@intel.com/ +Signed-off-by: Valentina Fernandez +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/mailbox-mchp-ipc-sbi.c | 21 +++++++++------------ + 1 file changed, 9 insertions(+), 12 deletions(-) + +diff --git a/drivers/mailbox/mailbox-mchp-ipc-sbi.c b/drivers/mailbox/mailbox-mchp-ipc-sbi.c +index d444491a584e8..b87bf2fb4b9b9 100644 +--- a/drivers/mailbox/mailbox-mchp-ipc-sbi.c ++++ b/drivers/mailbox/mailbox-mchp-ipc-sbi.c +@@ -174,17 +174,21 @@ static irqreturn_t mchp_ipc_cluster_aggr_isr(int irq, void *data) + struct mchp_ipc_msg ipc_msg; + struct mchp_ipc_status status_msg; + int ret; +- unsigned long hartid; + u32 i, chan_index, chan_id; ++ bool found = false; + + /* Find out the hart that originated the irq */ + for_each_online_cpu(i) { +- hartid = cpuid_to_hartid_map(i); +- if (irq == ipc->cluster_cfg[i].irq) ++ if (irq == ipc->cluster_cfg[i].irq) { ++ found = true; + break; ++ } + } + +- status_msg.cluster = hartid; ++ if (unlikely(!found)) ++ return IRQ_NONE; ++ ++ status_msg.cluster = cpuid_to_hartid_map(i); + memcpy(ipc->cluster_cfg[i].buf_base, &status_msg, sizeof(struct mchp_ipc_status)); + + ret = mchp_ipc_sbi_send(SBI_EXT_IPC_STATUS, ipc->cluster_cfg[i].buf_base_addr); +@@ -321,13 +325,6 @@ static int mchp_ipc_startup(struct mbox_chan *chan) + goto fail_free_buf_msg_rx; + } + +- if (ret) { +- dev_err(ipc->dev, "failed to register interrupt(s)\n"); +- goto fail_free_buf_msg_rx; +- } +- +- return ret; +- + fail_free_buf_msg_rx: + kfree(chan_info->msg_buf_rx); + fail_free_buf_msg_tx: +@@ -419,7 +416,7 @@ static int mchp_ipc_probe(struct platform_device *pdev) + + ret = sbi_probe_extension(SBI_EXT_MICROCHIP_TECHNOLOGY); + if (ret <= 0) +- return dev_err_probe(dev, ret, "Microchip SBI extension not detected\n"); ++ return dev_err_probe(dev, -ENODEV, "Microchip SBI extension not detected\n"); + + ipc = devm_kzalloc(dev, sizeof(*ipc), GFP_KERNEL); + if (!ipc) +-- +2.51.0 + diff --git a/queue-6.18/mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch b/queue-6.18/mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch new file mode 100644 index 00000000000..5b41f4925c4 --- /dev/null +++ b/queue-6.18/mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch @@ -0,0 +1,41 @@ +From 82bc39b54627771008e4f34ccd28587885db36aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jan 2026 14:07:40 +0000 +Subject: mailbox: pcc: Remove spurious IRQF_ONESHOT usage + +From: Mark Brown + +[ Upstream commit 673327028cd61db68a1e0c708be2e302c082adf9 ] + +The PCC code currently specifies IRQF_ONESHOT if the interrupt could +potentially be shared but doesn't actually use request_threaded_irq() and +the interrupt handler does not use IRQ_WAKE_THREAD so IRQF_ONESHOT is +never relevant. Since commit aef30c8d569c ("genirq: Warn about using +IRQF_ONESHOT without a threaded handler") specifying it has resulted in a +WARN_ON(), fix this by removing IRQF_ONESHOT. + +Reported-by: Aishwarya TCV +Signed-off-by: Mark Brown +Reviewed-by: Sudeep Holla +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/pcc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c +index 0e0a66359d4c3..713022aed2e2f 100644 +--- a/drivers/mailbox/pcc.c ++++ b/drivers/mailbox/pcc.c +@@ -459,7 +459,7 @@ static int pcc_startup(struct mbox_chan *chan) + + if (pchan->plat_irq > 0) { + irqflags = pcc_chan_plat_irq_can_be_shared(pchan) ? +- IRQF_SHARED | IRQF_ONESHOT : 0; ++ IRQF_SHARED : 0; + rc = devm_request_irq(chan->mbox->dev, pchan->plat_irq, pcc_mbox_irq, + irqflags, MBOX_IRQ_NAME, chan); + if (unlikely(rc)) { +-- +2.51.0 + diff --git a/queue-6.18/mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch b/queue-6.18/mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch new file mode 100644 index 00000000000..6ab6baf1f59 --- /dev/null +++ b/queue-6.18/mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch @@ -0,0 +1,57 @@ +From a5209ed15507b3de1f56587b5fa7040eefa200be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 16:43:36 +0100 +Subject: mailbox: sprd: clear delivery flag before handling TX done +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Otto Pflüger + +[ Upstream commit c77661d60d4223bf2ff10d409beb0c3b2021183b ] + +If there are any pending messages in the mailbox queue, they are sent +as soon as a TX done event arrives from the driver. This may trigger a +new delivery interrupt while the previous one is still being handled. +If the delivery status is cleared after this, the interrupt is lost. +To prevent this from happening, clear the delivery status immediately +after checking it and before any new messages are sent. + +Signed-off-by: Otto Pflüger +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/sprd-mailbox.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c +index c1a5fe6cc8771..46d0c34177ab9 100644 +--- a/drivers/mailbox/sprd-mailbox.c ++++ b/drivers/mailbox/sprd-mailbox.c +@@ -166,6 +166,11 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data) + return IRQ_NONE; + } + ++ /* Clear FIFO delivery and overflow status first */ ++ writel(fifo_sts & ++ (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK), ++ priv->inbox_base + SPRD_MBOX_FIFO_RST); ++ + while (send_sts) { + id = __ffs(send_sts); + send_sts &= (send_sts - 1); +@@ -181,11 +186,6 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data) + mbox_chan_txdone(chan, 0); + } + +- /* Clear FIFO delivery and overflow status */ +- writel(fifo_sts & +- (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK), +- priv->inbox_base + SPRD_MBOX_FIFO_RST); +- + /* Clear irq status */ + writel(SPRD_MBOX_IRQ_CLR, priv->inbox_base + SPRD_MBOX_IRQ_STS); + +-- +2.51.0 + diff --git a/queue-6.18/mailbox-sprd-mask-interrupts-that-are-not-handled.patch b/queue-6.18/mailbox-sprd-mask-interrupts-that-are-not-handled.patch new file mode 100644 index 00000000000..bb2a952d914 --- /dev/null +++ b/queue-6.18/mailbox-sprd-mask-interrupts-that-are-not-handled.patch @@ -0,0 +1,55 @@ +From a1caa8ec4748880a25d73138c1f3eac66381ac7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 16:43:38 +0100 +Subject: mailbox: sprd: mask interrupts that are not handled +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Otto Pflüger + +[ Upstream commit 75df94d05fc03fd9d861eaf79ce10fbb7a548bd8 ] + +To reduce the amount of spurious interrupts, disable the interrupts that +are not handled in this driver. + +Signed-off-by: Otto Pflüger +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/sprd-mailbox.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c +index ee8539dfcef54..c1a5fe6cc8771 100644 +--- a/drivers/mailbox/sprd-mailbox.c ++++ b/drivers/mailbox/sprd-mailbox.c +@@ -243,21 +243,19 @@ static int sprd_mbox_startup(struct mbox_chan *chan) + /* Select outbox FIFO mode and reset the outbox FIFO status */ + writel(0x0, priv->outbox_base + SPRD_MBOX_FIFO_RST); + +- /* Enable inbox FIFO overflow and delivery interrupt */ +- val = readl(priv->inbox_base + SPRD_MBOX_IRQ_MSK); +- val &= ~(SPRD_INBOX_FIFO_OVERFLOW_IRQ | SPRD_INBOX_FIFO_DELIVER_IRQ); ++ /* Enable inbox FIFO delivery interrupt */ ++ val = SPRD_INBOX_FIFO_IRQ_MASK; ++ val &= ~SPRD_INBOX_FIFO_DELIVER_IRQ; + writel(val, priv->inbox_base + SPRD_MBOX_IRQ_MSK); + + /* Enable outbox FIFO not empty interrupt */ +- val = readl(priv->outbox_base + SPRD_MBOX_IRQ_MSK); ++ val = SPRD_OUTBOX_FIFO_IRQ_MASK; + val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ; + writel(val, priv->outbox_base + SPRD_MBOX_IRQ_MSK); + + /* Enable supplementary outbox as the fundamental one */ + if (priv->supp_base) { + writel(0x0, priv->supp_base + SPRD_MBOX_FIFO_RST); +- val = readl(priv->supp_base + SPRD_MBOX_IRQ_MSK); +- val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ; + writel(val, priv->supp_base + SPRD_MBOX_IRQ_MSK); + } + } +-- +2.51.0 + diff --git a/queue-6.18/md-cluster-fix-null-pointer-dereference-in-process_m.patch b/queue-6.18/md-cluster-fix-null-pointer-dereference-in-process_m.patch new file mode 100644 index 00000000000..4e2920dbee8 --- /dev/null +++ b/queue-6.18/md-cluster-fix-null-pointer-dereference-in-process_m.patch @@ -0,0 +1,61 @@ +From 716fa2a0045158aef5e4481b80d503a0f2d540a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jan 2026 14:59:03 +0000 +Subject: md-cluster: fix NULL pointer dereference in process_metadata_update + +From: Jiasheng Jiang + +[ Upstream commit f150e753cb8dd756085f46e86f2c35ce472e0a3c ] + +The function process_metadata_update() blindly dereferences the 'thread' +pointer (acquired via rcu_dereference_protected) within the wait_event() +macro. + +While the code comment states "daemon thread must exist", there is a valid +race condition window during the MD array startup sequence (md_run): + +1. bitmap_load() is called, which invokes md_cluster_ops->join(). +2. join() starts the "cluster_recv" thread (recv_daemon). +3. At this point, recv_daemon is active and processing messages. +4. However, mddev->thread (the main MD thread) is not initialized until + later in md_run(). + +If a METADATA_UPDATED message is received from a remote node during this +specific window, process_metadata_update() will be called while +mddev->thread is still NULL, leading to a kernel panic. + +To fix this, we must validate the 'thread' pointer. If it is NULL, we +release the held lock (no_new_dev_lockres) and return early, safely +ignoring the update request as the array is not yet fully ready to +process it. + +Link: https://lore.kernel.org/linux-raid/20260117145903.28921-1-jiashengjiangcool@gmail.com +Signed-off-by: Jiasheng Jiang +Signed-off-by: Yu Kuai +Signed-off-by: Sasha Levin +--- + drivers/md/md-cluster.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c +index 11f1e91d387d8..896279988dfd5 100644 +--- a/drivers/md/md-cluster.c ++++ b/drivers/md/md-cluster.c +@@ -549,8 +549,13 @@ static void process_metadata_update(struct mddev *mddev, struct cluster_msg *msg + + dlm_lock_sync(cinfo->no_new_dev_lockres, DLM_LOCK_CR); + +- /* daemaon thread must exist */ + thread = rcu_dereference_protected(mddev->thread, true); ++ if (!thread) { ++ pr_warn("md-cluster: Received metadata update but MD thread is not ready\n"); ++ dlm_unlock_sync(cinfo->no_new_dev_lockres); ++ return; ++ } ++ + wait_event(thread->wqueue, + (got_lock = mddev_trylock(mddev)) || + test_bit(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD, &cinfo->state)); +-- +2.51.0 + diff --git a/queue-6.18/md-raid-fix-hang-when-stopping-arrays-with-metadata-.patch b/queue-6.18/md-raid-fix-hang-when-stopping-arrays-with-metadata-.patch new file mode 100644 index 00000000000..096731640f2 --- /dev/null +++ b/queue-6.18/md-raid-fix-hang-when-stopping-arrays-with-metadata-.patch @@ -0,0 +1,78 @@ +From e1c839c82f8cbbbc7317a26aa919d62650e77b84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 18:52:21 +0100 +Subject: md raid: fix hang when stopping arrays with metadata through dm-raid + +From: Heinz Mauelshagen + +[ Upstream commit cefcb9297fbdb6d94b61787b4f8d84f55b741470 ] + +When using device-mapper's dm-raid target, stopping a RAID array can cause +the system to hang under specific conditions. + +This occurs when: + +- A dm-raid managed device tree is suspended from top to bottom + (the top-level RAID device is suspended first, followed by its + underlying metadata and data devices) + +- The top-level RAID device is then removed + +Removing the top-level device triggers a hang in the following sequence: +the dm-raid destructor calls md_stop(), which tries to flush the +write-intent bitmap by writing to the metadata sub-devices. However, these +devices are already suspended, making them unable to complete the write-intent +operations and causing an indefinite block. + +Fix: + +- Prevent bitmap flushing when md_stop() is called from dm-raid +destructor context + and avoid a quiescing/unquescing cycle which could also cause I/O + +- Still allow write-intent bitmap flushing when called from dm-raid +suspend context + +This ensures that RAID array teardown can complete successfully even when the +underlying devices are in a suspended state. + +This second patch uses md_is_rdwr() to distinguish between suspend and +destructor paths as elaborated on above. + +Link: https://lore.kernel.org/linux-raid/CAM23VxqYrwkhKEBeQrZeZwQudbiNey2_8B_SEOLqug=pXxaFrA@mail.gmail.com +Signed-off-by: Heinz Mauelshagen +Signed-off-by: Yu Kuai +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index e04ddcb03981c..92ec4be20db85 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -6716,13 +6716,15 @@ static void __md_stop_writes(struct mddev *mddev) + { + timer_delete_sync(&mddev->safemode_timer); + +- if (mddev->pers && mddev->pers->quiesce) { +- mddev->pers->quiesce(mddev, 1); +- mddev->pers->quiesce(mddev, 0); +- } ++ if (md_is_rdwr(mddev) || !mddev_is_dm(mddev)) { ++ if (mddev->pers && mddev->pers->quiesce) { ++ mddev->pers->quiesce(mddev, 1); ++ mddev->pers->quiesce(mddev, 0); ++ } + +- if (md_bitmap_enabled(mddev, true)) +- mddev->bitmap_ops->flush(mddev); ++ if (md_bitmap_enabled(mddev, true)) ++ mddev->bitmap_ops->flush(mddev); ++ } + + if (md_is_rdwr(mddev) && + ((!mddev->in_sync && !mddev_is_clustered(mddev)) || +-- +2.51.0 + diff --git a/queue-6.18/media-adv7180-fix-frame-interval-in-progressive-mode.patch b/queue-6.18/media-adv7180-fix-frame-interval-in-progressive-mode.patch new file mode 100644 index 00000000000..e3f0c21b551 --- /dev/null +++ b/queue-6.18/media-adv7180-fix-frame-interval-in-progressive-mode.patch @@ -0,0 +1,49 @@ +From 9209a6b832e6790c30730c602cfcd78e586aca53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 15:29:57 +0100 +Subject: media: adv7180: fix frame interval in progressive mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thorsten Schmelzer + +[ Upstream commit 90289b67c5c1d4c18784059b27460d292e16d208 ] + +The ADV7280-M may internally convert interlaced video input to +progressive video. If this mode is enabled, the ADV7280-M delivers +progressive video frames at the field rate of 50 fields per second (PAL) +or 60 fields per second (NTSC). + +Fix the reported frame interval if progressive video is enabled. + +Signed-off-by: Thorsten Schmelzer +Reviewed-by: Niklas Söderlund +Signed-off-by: Michael Tretter +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/adv7180.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c +index 378f4e6af12cb..5cbc973df684d 100644 +--- a/drivers/media/i2c/adv7180.c ++++ b/drivers/media/i2c/adv7180.c +@@ -507,6 +507,13 @@ static int adv7180_get_frame_interval(struct v4l2_subdev *sd, + fi->interval.denominator = 25; + } + ++ /* ++ * If the de-interlacer is active, the chip produces full video frames ++ * at the field rate. ++ */ ++ if (state->field == V4L2_FIELD_NONE) ++ fi->interval.denominator *= 2; ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.18/media-amphion-clear-last_buffer_dequeued-flag-for-de.patch b/queue-6.18/media-amphion-clear-last_buffer_dequeued-flag-for-de.patch new file mode 100644 index 00000000000..726b5269c4e --- /dev/null +++ b/queue-6.18/media-amphion-clear-last_buffer_dequeued-flag-for-de.patch @@ -0,0 +1,38 @@ +From a2fcf5ee6d4062189a75f49c069ff53c7058b326 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Dec 2025 11:02:22 +0800 +Subject: media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START + +From: Ming Qian + +[ Upstream commit d85f3207d75df6d7a08be6526b15ff398668206c ] + +The V4L2_DEC_CMD_START command may be used to handle the dynamic source +change, which will triggers an implicit decoder drain. +The last_buffer_dequeued flag is set in the implicit decoder drain, +so driver need to clear it to continue the following decoding flow. + +Signed-off-by: Ming Qian +Reviewed-by: Nicolas Dufresne +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/amphion/vdec.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/platform/amphion/vdec.c b/drivers/media/platform/amphion/vdec.c +index 32eef2fd1f2a9..6b63e8ca0cb40 100644 +--- a/drivers/media/platform/amphion/vdec.c ++++ b/drivers/media/platform/amphion/vdec.c +@@ -726,6 +726,7 @@ static int vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd + switch (cmd->cmd) { + case V4L2_DEC_CMD_START: + vdec_cmd_start(inst); ++ vb2_clear_last_buffer_dequeued(v4l2_m2m_get_dst_vq(inst->fh.m2m_ctx)); + break; + case V4L2_DEC_CMD_STOP: + vdec_cmd_stop(inst); +-- +2.51.0 + diff --git a/queue-6.18/media-chips-media-wave5-fix-conditional-in-start_str.patch b/queue-6.18/media-chips-media-wave5-fix-conditional-in-start_str.patch new file mode 100644 index 00000000000..990a78a0a32 --- /dev/null +++ b/queue-6.18/media-chips-media-wave5-fix-conditional-in-start_str.patch @@ -0,0 +1,43 @@ +From bfd6fee0038d98a19cb5974a05f4ba1bb61f5da3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Oct 2025 15:46:17 -0500 +Subject: media: chips-media: wave5: Fix conditional in start_streaming + +From: Brandon Brnich + +[ Upstream commit b4e26c6fc1b3c225caf80d4a95c6f9fcbe959e17 ] + +When STREAMON(CAP) is called after STREAMON(OUT), the driver was failing to +switch states from VPU_INST_STATE_OPEN to VPU_INST_STATE_INIT_SEQ and +VPU_INST_STATE_PIC_RUN because the capture queue streaming boolean had not +yet been set to true. This led to a hang in the encoder since the state +was stuck in VPU_INST_STATE_OPEN. During the second call to +start_streaming, the sequence initialization and frame buffer allocation +should occur. + +Signed-off-by: Brandon Brnich +Reviewed-by: Nicolas Dufresne +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c +index 94fb5d7c87021..a11f0f7c7d7b0 100644 +--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c ++++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c +@@ -1367,7 +1367,8 @@ static int wave5_vpu_enc_start_streaming(struct vb2_queue *q, unsigned int count + if (ret) + goto return_buffers; + } +- if (inst->state == VPU_INST_STATE_OPEN && m2m_ctx->cap_q_ctx.q.streaming) { ++ if (inst->state == VPU_INST_STATE_OPEN && ++ (m2m_ctx->cap_q_ctx.q.streaming || q->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE)) { + ret = initialize_sequence(inst); + if (ret) { + dev_warn(inst->dev->dev, "Sequence not found: %d\n", ret); +-- +2.51.0 + diff --git a/queue-6.18/media-chips-media-wave5-process-ready-frames-when-cm.patch b/queue-6.18/media-chips-media-wave5-process-ready-frames-when-cm.patch new file mode 100644 index 00000000000..b5590be7668 --- /dev/null +++ b/queue-6.18/media-chips-media-wave5-process-ready-frames-when-cm.patch @@ -0,0 +1,39 @@ +From a8354ee16a3265af482680e0cb2f1ad88bf6a908 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Oct 2025 15:46:18 -0500 +Subject: media: chips-media: wave5: Process ready frames when CMD_STOP sent to + Encoder + +From: Brandon Brnich + +[ Upstream commit 5da0380de41439ed64ed9a5218850db38544e315 ] + +CMD_STOP being sent to encoder before last job is executed by device_run +can lead to an occasional dropped frame. Ensure that remaining ready +buffers are drained by making a call to v4l2_m2m_try_schedule. + +Signed-off-by: Brandon Brnich +Reviewed-by: Nicolas Dufresne +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c +index a11f0f7c7d7b0..a254830e4009e 100644 +--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c ++++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c +@@ -649,6 +649,8 @@ static int wave5_vpu_enc_encoder_cmd(struct file *file, void *fh, struct v4l2_en + + m2m_ctx->last_src_buf = v4l2_m2m_last_src_buf(m2m_ctx); + m2m_ctx->is_draining = true; ++ ++ v4l2_m2m_try_schedule(m2m_ctx); + break; + case V4L2_ENC_CMD_START: + break; +-- +2.51.0 + diff --git a/queue-6.18/media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch b/queue-6.18/media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch new file mode 100644 index 00000000000..bcd2936f7b7 --- /dev/null +++ b/queue-6.18/media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch @@ -0,0 +1,34 @@ +From a13c66ce8f5bbe04184ab59f6da986589e3a035c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Jan 2026 15:46:47 +0800 +Subject: media: cx25821: Fix a resource leak in cx25821_dev_setup() + +From: Haoxiang Li + +[ Upstream commit 68cd8ac994cac38a305200f638b30e13c690753b ] + +Add release_mem_region() if ioremap() fails to release the memory +region obtained by cx25821_get_resources(). + +Signed-off-by: Haoxiang Li +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/cx25821/cx25821-core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c +index 6627fa9166d30..a7336be444748 100644 +--- a/drivers/media/pci/cx25821/cx25821-core.c ++++ b/drivers/media/pci/cx25821/cx25821-core.c +@@ -908,6 +908,7 @@ static int cx25821_dev_setup(struct cx25821_dev *dev) + + if (!dev->lmmio) { + CX25821_ERR("ioremap failed, maybe increasing __VMALLOC_RESERVE in page.h\n"); ++ release_mem_region(dev->base_io_addr, pci_resource_len(dev->pci, 0)); + cx25821_iounmap(dev); + return -ENOMEM; + } +-- +2.51.0 + diff --git a/queue-6.18/media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch b/queue-6.18/media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch new file mode 100644 index 00000000000..4c903f1bae3 --- /dev/null +++ b/queue-6.18/media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch @@ -0,0 +1,110 @@ +From 959363a64916da001e91203cf2278d8bc4c9e9a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Jun 2025 08:57:35 +0200 +Subject: media: dvb-core: dmxdevfilter must always flush bufs + +From: Hans Verkuil + +[ Upstream commit c4e620eccbef76aa5564ebb295e23d6540e27215 ] + +Currently the buffers are being filled until full, which works fine +for the transport stream, but not when reading sections, those have +to be returned to userspace immediately, otherwise dvbv5-scan will +just wait forever. + +Add a 'flush' argument to dvb_vb2_fill_buffer to indicate whether +the buffer must be flushed or wait until it is full. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-core/dmxdev.c | 8 ++++---- + drivers/media/dvb-core/dvb_vb2.c | 5 +++-- + include/media/dvb_vb2.h | 6 ++++-- + 3 files changed, 11 insertions(+), 8 deletions(-) + +diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c +index 151177e5a06d8..8a9cca6da3e0e 100644 +--- a/drivers/media/dvb-core/dmxdev.c ++++ b/drivers/media/dvb-core/dmxdev.c +@@ -397,11 +397,11 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len, + if (dvb_vb2_is_streaming(&dmxdevfilter->vb2_ctx)) { + ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx, + buffer1, buffer1_len, +- buffer_flags); ++ buffer_flags, true); + if (ret == buffer1_len) + ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx, + buffer2, buffer2_len, +- buffer_flags); ++ buffer_flags, true); + } else { + ret = dvb_dmxdev_buffer_write(&dmxdevfilter->buffer, + buffer1, buffer1_len); +@@ -452,10 +452,10 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len, + + if (dvb_vb2_is_streaming(ctx)) { + ret = dvb_vb2_fill_buffer(ctx, buffer1, buffer1_len, +- buffer_flags); ++ buffer_flags, false); + if (ret == buffer1_len) + ret = dvb_vb2_fill_buffer(ctx, buffer2, buffer2_len, +- buffer_flags); ++ buffer_flags, false); + } else { + if (buffer->error) { + spin_unlock(&dmxdevfilter->dev->lock); +diff --git a/drivers/media/dvb-core/dvb_vb2.c b/drivers/media/dvb-core/dvb_vb2.c +index 29edaaff7a5c9..7444bbc2f24d9 100644 +--- a/drivers/media/dvb-core/dvb_vb2.c ++++ b/drivers/media/dvb-core/dvb_vb2.c +@@ -249,7 +249,8 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx) + + int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx, + const unsigned char *src, int len, +- enum dmx_buffer_flags *buffer_flags) ++ enum dmx_buffer_flags *buffer_flags, ++ bool flush) + { + unsigned long flags = 0; + void *vbuf = NULL; +@@ -306,7 +307,7 @@ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx, + } + } + +- if (ctx->nonblocking && ctx->buf) { ++ if (flush && ctx->buf) { + vb2_set_plane_payload(&ctx->buf->vb, 0, ll); + vb2_buffer_done(&ctx->buf->vb, VB2_BUF_STATE_DONE); + list_del(&ctx->buf->list); +diff --git a/include/media/dvb_vb2.h b/include/media/dvb_vb2.h +index 8cb88452cd6c2..0fbbfc65157e6 100644 +--- a/include/media/dvb_vb2.h ++++ b/include/media/dvb_vb2.h +@@ -124,7 +124,7 @@ static inline int dvb_vb2_release(struct dvb_vb2_ctx *ctx) + return 0; + }; + #define dvb_vb2_is_streaming(ctx) (0) +-#define dvb_vb2_fill_buffer(ctx, file, wait, flags) (0) ++#define dvb_vb2_fill_buffer(ctx, file, wait, flags, flush) (0) + + static inline __poll_t dvb_vb2_poll(struct dvb_vb2_ctx *ctx, + struct file *file, +@@ -166,10 +166,12 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx); + * @buffer_flags: + * pointer to buffer flags as defined by &enum dmx_buffer_flags. + * can be NULL. ++ * @flush: flush the buffer, even if it isn't full. + */ + int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx, + const unsigned char *src, int len, +- enum dmx_buffer_flags *buffer_flags); ++ enum dmx_buffer_flags *buffer_flags, ++ bool flush); + + /** + * dvb_vb2_poll - Wrapper to vb2_core_streamon() for Digital TV +-- +2.51.0 + diff --git a/queue-6.18/media-ipu6-always-close-firmware-stream.patch b/queue-6.18/media-ipu6-always-close-firmware-stream.patch new file mode 100644 index 00000000000..7074846b1b9 --- /dev/null +++ b/queue-6.18/media-ipu6-always-close-firmware-stream.patch @@ -0,0 +1,45 @@ +From 31804f47c723e3f4cc1ebcc9cb1a848663de7c07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 23:55:31 +0200 +Subject: media: ipu6: Always close firmware stream + +From: Sakari Ailus + +[ Upstream commit 2b08b7007e55bd1793a58478d3ecea4fd95849a5 ] + +Close the firmware stream even when disabling a stream on an upstream +sub-device fails. This allows the firmware to release resources related to +a stream that is stopped in any case. + +Suggested-by: Bingbu Cao +Signed-off-by: Sakari Ailus +Reviewed-by: Bingbu Cao +Tested-by: Mehdi Djait # Dell XPS 9315 +Reviewed-by: Mehdi Djait +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/intel/ipu6/ipu6-isys-video.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c +index e1815faeb80d7..b96ae563b82f0 100644 +--- a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c ++++ b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c +@@ -1022,11 +1022,10 @@ int ipu6_isys_video_set_streaming(struct ipu6_isys_video *av, int state, + sd->name, r_pad->index, stream_mask); + ret = v4l2_subdev_disable_streams(sd, r_pad->index, + stream_mask); +- if (ret) { ++ if (ret) + dev_err(dev, "stream off %s failed with %d\n", sd->name, + ret); +- return ret; +- } ++ + close_streaming_firmware(av); + } else { + ret = start_stream_firmware(av, bl); +-- +2.51.0 + diff --git a/queue-6.18/media-ipu6-close-firmware-streams-on-streaming-enabl.patch b/queue-6.18/media-ipu6-close-firmware-streams-on-streaming-enabl.patch new file mode 100644 index 00000000000..88146b3a793 --- /dev/null +++ b/queue-6.18/media-ipu6-close-firmware-streams-on-streaming-enabl.patch @@ -0,0 +1,37 @@ +From 242349a023f90a15576be7f4370b6a3ff2a5cc67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Dec 2025 00:05:38 +0200 +Subject: media: ipu6: Close firmware streams on streaming enable failure + +From: Sakari Ailus + +[ Upstream commit 5925a92cc70d10c7d3124923c36da09b9c1a6eeb ] + +When enabling streaming fails, the stream is stopped in firmware but not +closed. Do this to release resources on firmware side. + +Signed-off-by: Sakari Ailus +Reviewed-by: Bingbu Cao +Tested-by: Mehdi Djait # Dell XPS 9315 +Reviewed-by: Mehdi Djait +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/intel/ipu6/ipu6-isys-video.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c +index f3f3bc0615e5d..e1815faeb80d7 100644 +--- a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c ++++ b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c +@@ -1052,6 +1052,7 @@ int ipu6_isys_video_set_streaming(struct ipu6_isys_video *av, int state, + + out_media_entity_stop_streaming_firmware: + stop_streaming_firmware(av); ++ close_streaming_firmware(av); + + return ret; + } +-- +2.51.0 + diff --git a/queue-6.18/media-ipu6-ensure-stream_mutex-is-acquired-when-deal.patch b/queue-6.18/media-ipu6-ensure-stream_mutex-is-acquired-when-deal.patch new file mode 100644 index 00000000000..5731c0e5246 --- /dev/null +++ b/queue-6.18/media-ipu6-ensure-stream_mutex-is-acquired-when-deal.patch @@ -0,0 +1,73 @@ +From 4d71803cbc28105f1e189f8407ca03b3bb2d2c46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Nov 2025 14:14:22 +0200 +Subject: media: ipu6: Ensure stream_mutex is acquired when dealing with node + list + +From: Sakari Ailus + +[ Upstream commit 779bdaad2abf718fb8116839e818e58852874b4d ] + +The ipu6 isys driver maintains the list of video buffer queues related to +a stream (in ipu6 context streams on the same CSI-2 virtual channel) and +this list is modified through VIDIOC_STREAMON and VIDIOC_STREAMOFF IOCTLs. +Ensure the common mutex is acquired when accessing the linked list, i.e. +the isys device context's stream_mutex. + +Add a lockdep assert to ipu6_isys_get_buffer_list() and switch to guard() +while at it as the error handling becomes more simple this way. + +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/intel/ipu6/ipu6-isys-queue.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c b/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c +index aa2cf7287477c..8f05987cdb4e7 100644 +--- a/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c ++++ b/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c +@@ -3,6 +3,7 @@ + * Copyright (C) 2013--2024 Intel Corporation + */ + #include ++#include + #include + #include + #include +@@ -201,6 +202,8 @@ static int buffer_list_get(struct ipu6_isys_stream *stream, + unsigned long flags; + unsigned long buf_flag = IPU6_ISYS_BUFFER_LIST_FL_INCOMING; + ++ lockdep_assert_held(&stream->mutex); ++ + bl->nbufs = 0; + INIT_LIST_HEAD(&bl->head); + +@@ -294,9 +297,8 @@ static int ipu6_isys_stream_start(struct ipu6_isys_video *av, + struct ipu6_isys_buffer_list __bl; + int ret; + +- mutex_lock(&stream->isys->stream_mutex); ++ guard(mutex)(&stream->isys->stream_mutex); + ret = ipu6_isys_video_set_streaming(av, 1, bl); +- mutex_unlock(&stream->isys->stream_mutex); + if (ret) + goto out_requeue; + +@@ -637,10 +639,10 @@ static void stop_streaming(struct vb2_queue *q) + mutex_lock(&av->isys->stream_mutex); + if (stream->nr_streaming == stream->nr_queues && stream->streaming) + ipu6_isys_video_set_streaming(av, 0, NULL); ++ list_del(&aq->node); + mutex_unlock(&av->isys->stream_mutex); + + stream->nr_streaming--; +- list_del(&aq->node); + stream->streaming = 0; + mutex_unlock(&stream->mutex); + +-- +2.51.0 + diff --git a/queue-6.18/media-mediatek-vcodec-don-t-try-to-decode-422-444-vp.patch b/queue-6.18/media-mediatek-vcodec-don-t-try-to-decode-422-444-vp.patch new file mode 100644 index 00000000000..881309921ae --- /dev/null +++ b/queue-6.18/media-mediatek-vcodec-don-t-try-to-decode-422-444-vp.patch @@ -0,0 +1,40 @@ +From d0db485901710a4133daee2c9db8b51b6c65ae40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Nov 2025 14:16:16 -0500 +Subject: media: mediatek: vcodec: Don't try to decode 422/444 VP9 + +From: Nicolas Dufresne + +[ Upstream commit 3e92d7e4935084ecdbdc88880cc4688618ae1557 ] + +This is not supported by the hardware and trying to decode +these leads to LAT timeout errors. + +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c +index d873159b9b306..9eef3ff2b1278 100644 +--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c ++++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c +@@ -502,6 +502,12 @@ static int mtk_vdec_s_ctrl(struct v4l2_ctrl *ctrl) + mtk_v4l2_vdec_err(ctx, "VP9: bit_depth:%d", frame->bit_depth); + return -EINVAL; + } ++ ++ if (!(frame->flags & V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING) || ++ !(frame->flags & V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING)) { ++ mtk_v4l2_vdec_err(ctx, "VP9: only 420 subsampling is supported"); ++ return -EINVAL; ++ } + break; + case V4L2_CID_STATELESS_AV1_SEQUENCE: + seq = (struct v4l2_ctrl_av1_sequence *)hdr_ctrl->p_new.p; +-- +2.51.0 + diff --git a/queue-6.18/media-mt9m114-avoid-a-reset-low-spike-during-probe.patch b/queue-6.18/media-mt9m114-avoid-a-reset-low-spike-during-probe.patch new file mode 100644 index 00000000000..692df604708 --- /dev/null +++ b/queue-6.18/media-mt9m114-avoid-a-reset-low-spike-during-probe.patch @@ -0,0 +1,55 @@ +From d1154a2a38aae39b8a2a3595db783d335b1917af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Dec 2025 18:03:03 +0100 +Subject: media: mt9m114: Avoid a reset low spike during probe() + +From: Hans de Goede + +[ Upstream commit 84359d0a5e3afce5e3e3b6562efadff690614d5b ] + +mt9m114_probe() requests the reset GPIO in output low state: + + sensor->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW); + +and then almost immediately afterwards calls mt9m114_power_on() which does: + + gpiod_set_value(sensor->reset, 1); + fsleep(duration); + gpiod_set_value(sensor->reset, 0); + +which means that if the reset pin was high before this code runs that +it will very briefly be driven low because of passing GPIOD_OUT_LOW when +requesting the GPIO only to be driven high again possibly directly after +that. Such a very brief driving low of the reset pin may put the chip in +a confused state. + +Request the GPIO in high (reset the chip) state instead to avoid this, +turning the initial gpiod_set_value() in mt9m114_power_on() into a no-op. +and the fsleep() ensures that it will stay high long enough to properly +reset the chip. + +Reviewed-by: Laurent Pinchart +Signed-off-by: Hans de Goede +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/mt9m114.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/mt9m114.c b/drivers/media/i2c/mt9m114.c +index 51ebbe7ae9969..554f25071cca6 100644 +--- a/drivers/media/i2c/mt9m114.c ++++ b/drivers/media/i2c/mt9m114.c +@@ -2434,7 +2434,7 @@ static int mt9m114_probe(struct i2c_client *client) + goto error_ep_free; + } + +- sensor->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW); ++ sensor->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH); + if (IS_ERR(sensor->reset)) { + ret = PTR_ERR(sensor->reset); + dev_err_probe(dev, ret, "Failed to get reset GPIO\n"); +-- +2.51.0 + diff --git a/queue-6.18/media-mt9m114-return-eprobe_defer-if-no-endpoint-is-.patch b/queue-6.18/media-mt9m114-return-eprobe_defer-if-no-endpoint-is-.patch new file mode 100644 index 00000000000..bcfbda87163 --- /dev/null +++ b/queue-6.18/media-mt9m114-return-eprobe_defer-if-no-endpoint-is-.patch @@ -0,0 +1,50 @@ +From f5e1b1a77a43f83e33820e01460a7cd136bbad7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Dec 2025 18:03:10 +0100 +Subject: media: mt9m114: Return -EPROBE_DEFER if no endpoint is found + +From: Hans de Goede + +[ Upstream commit 437e1f6a960035166495a5117aacbc596115eeb6 ] + +With IPU# bridges, endpoints may only be created when the IPU bridge is +initialized. This may happen after the sensor driver's first probe(). + +Reviewed-by: Laurent Pinchart +Signed-off-by: Hans de Goede +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/mt9m114.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/i2c/mt9m114.c b/drivers/media/i2c/mt9m114.c +index 554f25071cca6..b1325e2cd1321 100644 +--- a/drivers/media/i2c/mt9m114.c ++++ b/drivers/media/i2c/mt9m114.c +@@ -2360,11 +2360,17 @@ static int mt9m114_parse_dt(struct mt9m114 *sensor) + struct fwnode_handle *ep; + int ret; + ++ /* ++ * On ACPI systems the fwnode graph can be initialized by a bridge ++ * driver, which may not have probed yet. Wait for this. ++ * ++ * TODO: Return an error once bridge driver code will have moved ++ * to the ACPI core. ++ */ + ep = fwnode_graph_get_next_endpoint(fwnode, NULL); +- if (!ep) { +- dev_err(&sensor->client->dev, "No endpoint found\n"); +- return -EINVAL; +- } ++ if (!ep) ++ return dev_err_probe(&sensor->client->dev, -EPROBE_DEFER, ++ "waiting for fwnode graph endpoint\n"); + + sensor->bus_cfg.bus_type = V4L2_MBUS_UNKNOWN; + ret = v4l2_fwnode_endpoint_alloc_parse(ep, &sensor->bus_cfg); +-- +2.51.0 + diff --git a/queue-6.18/media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch b/queue-6.18/media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch new file mode 100644 index 00000000000..47d15975cc8 --- /dev/null +++ b/queue-6.18/media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch @@ -0,0 +1,53 @@ +From 9cc4b40fb5e17a91a0d41517d9654f1cfbd3d9e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Oct 2025 15:26:40 +0200 +Subject: media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes + +From: Hans Verkuil + +[ Upstream commit 44c03802a5191626996ee9db4bac090b164ca340 ] + +The isp_video_mbus_to_pix/pix_to_mbus functions did not take +the last empty entry { 0, } of the formats array into account. + +As a result, isp_video_mbus_to_pix would accept code 0 and +isp_video_pix_to_mbus would select code 0 if no match was found. + +Signed-off-by: Hans Verkuil +Acked-by: Sakari Ailus +Signed-off-by: Sasha Levin +--- + drivers/media/platform/ti/omap3isp/ispvideo.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/ti/omap3isp/ispvideo.c b/drivers/media/platform/ti/omap3isp/ispvideo.c +index 0e7f0bf2b3463..68e6a24be5614 100644 +--- a/drivers/media/platform/ti/omap3isp/ispvideo.c ++++ b/drivers/media/platform/ti/omap3isp/ispvideo.c +@@ -148,12 +148,12 @@ static unsigned int isp_video_mbus_to_pix(const struct isp_video *video, + pix->width = mbus->width; + pix->height = mbus->height; + +- for (i = 0; i < ARRAY_SIZE(formats); ++i) { ++ for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) { + if (formats[i].code == mbus->code) + break; + } + +- if (WARN_ON(i == ARRAY_SIZE(formats))) ++ if (WARN_ON(i == ARRAY_SIZE(formats) - 1)) + return 0; + + min_bpl = pix->width * formats[i].bpp; +@@ -191,7 +191,7 @@ static void isp_video_pix_to_mbus(const struct v4l2_pix_format *pix, + /* Skip the last format in the loop so that it will be selected if no + * match is found. + */ +- for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) { ++ for (i = 0; i < ARRAY_SIZE(formats) - 2; ++i) { + if (formats[i].pixelformat == pix->pixelformat) + break; + } +-- +2.51.0 + diff --git a/queue-6.18/media-omap3isp-isppreview-always-clamp-in-preview_tr.patch b/queue-6.18/media-omap3isp-isppreview-always-clamp-in-preview_tr.patch new file mode 100644 index 00000000000..8b7c980e483 --- /dev/null +++ b/queue-6.18/media-omap3isp-isppreview-always-clamp-in-preview_tr.patch @@ -0,0 +1,63 @@ +From ab194ab90bb68a0134757aeccb69a81d6d18b679 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 17:09:18 +0200 +Subject: media: omap3isp: isppreview: always clamp in preview_try_format() + +From: Hans Verkuil + +[ Upstream commit 17e1e1641f74a89824d4de3aa38c78daa5686cc1 ] + +If prev->input != PREVIEW_INPUT_MEMORY the width and height weren't +clamped. Just always clamp. + +This fixes a v4l2-compliance error: + + fail: v4l2-test-subdevs.cpp(171): fse.max_width == ~0U || fse.max_height == ~0U + fail: v4l2-test-subdevs.cpp(270): ret && ret != ENOTTY +test Try VIDIOC_SUBDEV_ENUM_MBUS_CODE/FRAME_SIZE/FRAME_INTERVAL: FAIL + +Signed-off-by: Hans Verkuil +Acked-by: Sakari Ailus +Signed-off-by: Sasha Levin +--- + .../media/platform/ti/omap3isp/isppreview.c | 21 +++++++------------ + 1 file changed, 8 insertions(+), 13 deletions(-) + +diff --git a/drivers/media/platform/ti/omap3isp/isppreview.c b/drivers/media/platform/ti/omap3isp/isppreview.c +index e383a57654de8..5c492b31b5160 100644 +--- a/drivers/media/platform/ti/omap3isp/isppreview.c ++++ b/drivers/media/platform/ti/omap3isp/isppreview.c +@@ -1742,22 +1742,17 @@ static void preview_try_format(struct isp_prev_device *prev, + + switch (pad) { + case PREV_PAD_SINK: +- /* When reading data from the CCDC, the input size has already +- * been mangled by the CCDC output pad so it can be accepted +- * as-is. +- * +- * When reading data from memory, clamp the requested width and +- * height. The TRM doesn't specify a minimum input height, make ++ /* ++ * Clamp the requested width and height. ++ * The TRM doesn't specify a minimum input height, make + * sure we got enough lines to enable the noise filter and color + * filter array interpolation. + */ +- if (prev->input == PREVIEW_INPUT_MEMORY) { +- fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH, +- preview_max_out_width(prev)); +- fmt->height = clamp_t(u32, fmt->height, +- PREV_MIN_IN_HEIGHT, +- PREV_MAX_IN_HEIGHT); +- } ++ fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH, ++ preview_max_out_width(prev)); ++ fmt->height = clamp_t(u32, fmt->height, ++ PREV_MIN_IN_HEIGHT, ++ PREV_MAX_IN_HEIGHT); + + fmt->colorspace = V4L2_COLORSPACE_SRGB; + +-- +2.51.0 + diff --git a/queue-6.18/media-omap3isp-set-initial-format.patch b/queue-6.18/media-omap3isp-set-initial-format.patch new file mode 100644 index 00000000000..864cc8b1a9f --- /dev/null +++ b/queue-6.18/media-omap3isp-set-initial-format.patch @@ -0,0 +1,51 @@ +From 3299db9fc64fe678aeea7b16a88723f2f48393f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Apr 2025 09:21:53 +0200 +Subject: media: omap3isp: set initial format + +From: Hans Verkuil + +[ Upstream commit 7575b8dfa91f82fcb34ffd5568ff415ac4685794 ] + +Initialize the v4l2_format to a default. Empty formats are +not allowed in V4L2, so this fixes v4l2-compliance issues: + + fail: v4l2-test-formats.cpp(514): !pix.width || !pix.height +test VIDIOC_G_FMT: FAIL + +Signed-off-by: Hans Verkuil +Acked-by: Sakari Ailus +Signed-off-by: Sasha Levin +--- + drivers/media/platform/ti/omap3isp/ispvideo.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/media/platform/ti/omap3isp/ispvideo.c b/drivers/media/platform/ti/omap3isp/ispvideo.c +index 68e6a24be5614..eb33a776f27c9 100644 +--- a/drivers/media/platform/ti/omap3isp/ispvideo.c ++++ b/drivers/media/platform/ti/omap3isp/ispvideo.c +@@ -1288,6 +1288,7 @@ static const struct v4l2_ioctl_ops isp_video_ioctl_ops = { + static int isp_video_open(struct file *file) + { + struct isp_video *video = video_drvdata(file); ++ struct v4l2_mbus_framefmt fmt; + struct isp_video_fh *handle; + struct vb2_queue *queue; + int ret = 0; +@@ -1330,6 +1331,13 @@ static int isp_video_open(struct file *file) + + memset(&handle->format, 0, sizeof(handle->format)); + handle->format.type = video->type; ++ handle->format.fmt.pix.width = 720; ++ handle->format.fmt.pix.height = 480; ++ handle->format.fmt.pix.pixelformat = V4L2_PIX_FMT_UYVY; ++ handle->format.fmt.pix.field = V4L2_FIELD_NONE; ++ handle->format.fmt.pix.colorspace = V4L2_COLORSPACE_SRGB; ++ isp_video_pix_to_mbus(&handle->format.fmt.pix, &fmt); ++ isp_video_mbus_to_pix(video, &fmt, &handle->format.fmt.pix); + handle->timeperframe.denominator = 1; + + handle->video = video; +-- +2.51.0 + diff --git a/queue-6.18/media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch b/queue-6.18/media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch new file mode 100644 index 00000000000..3f926ad3f23 --- /dev/null +++ b/queue-6.18/media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch @@ -0,0 +1,48 @@ +From f88a343fd26c0a0b2bc2991d4d8a35063bb9479c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Dec 2025 19:24:19 +0100 +Subject: media: pvrusb2: fix URB leak in pvr2_send_request_ex + +From: Szymon Wilczek + +[ Upstream commit a8333c8262aed2aedf608c18edd39cf5342680a7 ] + +When pvr2_send_request_ex() submits a write URB successfully but fails to +submit the read URB (e.g. returns -ENOMEM), it returns immediately without +waiting for the write URB to complete. Since the driver reuses the same +URB structure, a subsequent call to pvr2_send_request_ex() attempts to +submit the still-active write URB, triggering a 'URB submitted while +active' warning in usb_submit_urb(). + +Fix this by ensuring the write URB is unlinked and waited upon if the read +URB submission fails. + +Reported-by: syzbot+405dcd13121ff75a9e16@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=405dcd13121ff75a9e16 +Signed-off-by: Szymon Wilczek +Acked-by: Mike Isely +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +index b32bb906a9de2..5807734ae26c6 100644 +--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c ++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +@@ -3709,6 +3709,11 @@ status); + "Failed to submit read-control URB status=%d", + status); + hdw->ctl_read_pend_flag = 0; ++ if (hdw->ctl_write_pend_flag) { ++ usb_unlink_urb(hdw->ctl_write_urb); ++ while (hdw->ctl_write_pend_flag) ++ wait_for_completion(&hdw->ctl_done); ++ } + goto done; + } + } +-- +2.51.0 + diff --git a/queue-6.18/media-qcom-camss-do-not-enable-cpas-fast-ahb-clock-f.patch b/queue-6.18/media-qcom-camss-do-not-enable-cpas-fast-ahb-clock-f.patch new file mode 100644 index 00000000000..89d7e5e46bc --- /dev/null +++ b/queue-6.18/media-qcom-camss-do-not-enable-cpas-fast-ahb-clock-f.patch @@ -0,0 +1,58 @@ +From 0e29d027e59c709d4a8c586db1cf839dfbce0df4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Oct 2025 17:02:27 +0300 +Subject: media: qcom: camss: Do not enable cpas fast ahb clock for SM8550 VFE + lite + +From: Vladimir Zapolskiy + +[ Upstream commit a89e490ba3551823511588b7b3828d67f8b82954 ] + +The clock is needed to stream images over a full VFE IP on SM8550 CAMSS, +and it should not be enabled, when an image stream is routed over any of +two lite VFE IPs on the SoC. + +Signed-off-by: Vladimir Zapolskiy +Acked-by: Bryan O'Donoghue +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/camss/camss.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c +index 2fbcd0e343aac..fc838b3d22038 100644 +--- a/drivers/media/platform/qcom/camss/camss.c ++++ b/drivers/media/platform/qcom/camss/camss.c +@@ -2561,12 +2561,11 @@ static const struct camss_subdev_resources vfe_res_8550[] = { + /* VFE3 lite */ + { + .regulators = {}, +- .clock = { "gcc_axi_hf", "cpas_ahb", "cpas_fast_ahb_clk", "vfe_lite_ahb", ++ .clock = { "gcc_axi_hf", "cpas_ahb", "vfe_lite_ahb", + "vfe_lite", "cpas_ife_lite", "camnoc_axi" }, + .clock_rate = { { 0 }, + { 80000000 }, + { 300000000, 400000000 }, +- { 300000000, 400000000 }, + { 400000000, 480000000 }, + { 300000000, 400000000 }, + { 300000000, 400000000 } }, +@@ -2583,12 +2582,11 @@ static const struct camss_subdev_resources vfe_res_8550[] = { + /* VFE4 lite */ + { + .regulators = {}, +- .clock = { "gcc_axi_hf", "cpas_ahb", "cpas_fast_ahb_clk", "vfe_lite_ahb", ++ .clock = { "gcc_axi_hf", "cpas_ahb", "vfe_lite_ahb", + "vfe_lite", "cpas_ife_lite", "camnoc_axi" }, + .clock_rate = { { 0 }, + { 80000000 }, + { 300000000, 400000000 }, +- { 300000000, 400000000 }, + { 400000000, 480000000 }, + { 300000000, 400000000 }, + { 300000000, 400000000 } }, +-- +2.51.0 + diff --git a/queue-6.18/media-rkisp1-fix-filter-mode-register-configuration.patch b/queue-6.18/media-rkisp1-fix-filter-mode-register-configuration.patch new file mode 100644 index 00000000000..3291d3cf88b --- /dev/null +++ b/queue-6.18/media-rkisp1-fix-filter-mode-register-configuration.patch @@ -0,0 +1,53 @@ +From 738c6923be178e11cdc16cbcb12d062392b2142d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 12:11:42 -0500 +Subject: media: rkisp1: Fix filter mode register configuration + +From: Rui Wang + +[ Upstream commit 5a50f2b61104d0d351b59ec179f67abab7870453 ] + +The rkisp1_flt_config() function performs an initial direct write to +RKISP1_CIF_ISP_FILT_MODE without including the RKISP1_CIF_ISP_FLT_ENA +bit, which clears the filter enable bit in the hardware. + +The subsequent read/modify/write sequence then reads back the register +with the enable bit already cleared and cannot restore it, resulting in +the filter being inadvertently disabled. + +Remove the redundant direct write. The read/modify/write sequence alone +correctly preserves the existing enable bit state while updating the +DNR mode and filter configuration bits. + +Signed-off-by: Rui Wang +Reviewed-by: Stefan Klug +Reviewed-by: Kieran Bingham +Reviewed-by: Laurent Pinchart +Link: https://patch.msgid.link/20260105171142.147792-2-rui.wang@ideasonboard.com +Signed-off-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rockchip/rkisp1/rkisp1-params.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c +index f1585f8fa0f47..1c90b1810fcb9 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c +@@ -409,12 +409,6 @@ static void rkisp1_flt_config(struct rkisp1_params *params, + rkisp1_write(params->rkisp1, RKISP1_CIF_ISP_FILT_LUM_WEIGHT, + arg->lum_weight); + +- rkisp1_write(params->rkisp1, RKISP1_CIF_ISP_FILT_MODE, +- (arg->mode ? RKISP1_CIF_ISP_FLT_MODE_DNR : 0) | +- RKISP1_CIF_ISP_FLT_CHROMA_V_MODE(arg->chr_v_mode) | +- RKISP1_CIF_ISP_FLT_CHROMA_H_MODE(arg->chr_h_mode) | +- RKISP1_CIF_ISP_FLT_GREEN_STAGE1(arg->grn_stage1)); +- + /* avoid to override the old enable value */ + filt_mode = rkisp1_read(params->rkisp1, RKISP1_CIF_ISP_FILT_MODE); + filt_mode &= RKISP1_CIF_ISP_FLT_ENA; +-- +2.51.0 + diff --git a/queue-6.18/media-solo6x10-check-for-out-of-bounds-chip_id.patch b/queue-6.18/media-solo6x10-check-for-out-of-bounds-chip_id.patch new file mode 100644 index 00000000000..ca1a0be2a2e --- /dev/null +++ b/queue-6.18/media-solo6x10-check-for-out-of-bounds-chip_id.patch @@ -0,0 +1,68 @@ +From 463cd9cdb3b1b352fc3bdf39d3ff6dedc4839ab9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 19:00:35 -0800 +Subject: media: solo6x10: Check for out of bounds chip_id + +From: Kees Cook + +[ Upstream commit 0fdf6323c35a134f206dcad5babb4ff488552076 ] + +Clang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type +(literal "1" is an "int") could end up being shifted beyond 32 bits, +so instrumentation was added (and due to the double is_tw286x() call +seen via inlining), Clang decides the second one must now be undefined +behavior and elides the rest of the function[1]. This is a known problem +with Clang (that is still being worked on), but we can avoid the entire +problem by actually checking the existing max chip ID, and now there is +no runtime instrumentation added at all since everything is known to be +within bounds. + +Additionally use an unsigned value for the shift to remove the +instrumentation even without the explicit bounds checking. + +Link: https://github.com/ClangBuiltLinux/linux/issues/2144 [1] +Suggested-by: Nathan Chancellor +Signed-off-by: Kees Cook +Signed-off-by: Hans Verkuil +[hverkuil: fix checkpatch warning for is_tw286x] +Signed-off-by: Sasha Levin +--- + drivers/media/pci/solo6x10/solo6x10-tw28.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/pci/solo6x10/solo6x10-tw28.c b/drivers/media/pci/solo6x10/solo6x10-tw28.c +index 1b7c22a9bc94f..8f53946c67928 100644 +--- a/drivers/media/pci/solo6x10/solo6x10-tw28.c ++++ b/drivers/media/pci/solo6x10/solo6x10-tw28.c +@@ -166,7 +166,7 @@ static const u8 tbl_tw2865_pal_template[] = { + 0x64, 0x51, 0x40, 0xaf, 0xFF, 0xF0, 0x00, 0xC0, + }; + +-#define is_tw286x(__solo, __id) (!(__solo->tw2815 & (1 << __id))) ++#define is_tw286x(__solo, __id) (!((__solo)->tw2815 & (1U << (__id)))) + + static u8 tw_readbyte(struct solo_dev *solo_dev, int chip_id, u8 tw6x_off, + u8 tw_off) +@@ -686,6 +686,9 @@ int tw28_set_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch, + chip_num = ch / 4; + ch %= 4; + ++ if (chip_num >= TW_NUM_CHIP) ++ return -EINVAL; ++ + if (val > 255 || val < 0) + return -ERANGE; + +@@ -758,6 +761,9 @@ int tw28_get_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch, + chip_num = ch / 4; + ch %= 4; + ++ if (chip_num >= TW_NUM_CHIP) ++ return -EINVAL; ++ + switch (ctrl) { + case V4L2_CID_SHARPNESS: + /* Only 286x has sharpness */ +-- +2.51.0 + diff --git a/queue-6.18/media-uvcvideo-create-an-id-namespace-for-streaming-.patch b/queue-6.18/media-uvcvideo-create-an-id-namespace-for-streaming-.patch new file mode 100644 index 00000000000..14888c87faf --- /dev/null +++ b/queue-6.18/media-uvcvideo-create-an-id-namespace-for-streaming-.patch @@ -0,0 +1,183 @@ +From 295afd91a38fe7586c45c476783856dc2d5727d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Nov 2025 23:04:00 +0200 +Subject: media: uvcvideo: Create an ID namespace for streaming output + terminals + +From: Ricardo Ribalda + +[ Upstream commit 3d9f32e02c2ed85338be627de672e2b81b88a836 ] + +Some devices, such as the Grandstream GUV3100 and the LSK Meeting Eye +for Business & Home, exhibit entity ID collisions between units and +streaming output terminals. + +The UVC specification requires unit and terminal IDs to be unique, and +uses the ID to reference entities: + +- In control requests, to identify the target entity +- In the UVC units and terminals descriptors' bSourceID field, to + identify source entities +- In the UVC input header descriptor's bTerminalLink, to identify the + terminal associated with a streaming interface + +Entity ID collisions break accessing controls and make the graph +description in the UVC descriptors ambiguous. However, collisions where +one of the entities is a streaming output terminal and the other entity +is not a streaming terminal are less severe. Streaming output terminals +have no controls, and, as they are the final entity in pipelines, they +are never referenced in descriptors as source entities. They are +referenced by ID only from innput header descriptors, which by +definition only reference streaming terminals. + +For these reasons, we can work around the collision by giving streaming +output terminals their own ID namespace. Do so by setting bit +UVC_TERM_OUTPUT (15) in the uvc_entity.id field, which is normally never +set as the ID is a 8-bit value. + +This ID change doesn't affect the entity name in the media controller +graph as the name isn't constructed from the ID, so there should not be +any impact on the uAPI. + +Although this change handles some ID collisions automagically, keep +printing an error in uvc_alloc_new_entity() when a camera has invalid +descriptors. Hopefully this message will help vendors fix their invalid +descriptors. + +This new method of handling ID collisions includes a revert of commit +758dbc756aad ("media: uvcvideo: Use heuristic to find stream entity") +that attempted to fix the problem urgently due to regression reports. + +Suggested-by: Laurent Pinchart +Signed-off-by: Ricardo Ribalda +Reviewed-by: Laurent Pinchart +Tested-by: Lili Orosz +Co-developed-by: Laurent Pinchart +Signed-off-by: Laurent Pinchart +Link: https://patch.msgid.link/20251113210400.28618-1-laurent.pinchart@ideasonboard.com +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_driver.c | 54 ++++++++++++++++++------------ + drivers/media/usb/uvc/uvcvideo.h | 3 +- + 2 files changed, 35 insertions(+), 22 deletions(-) + +diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c +index ee4f54d683496..aa3e8d295e0f5 100644 +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -165,28 +165,17 @@ static struct uvc_entity *uvc_entity_by_reference(struct uvc_device *dev, + return NULL; + } + +-static struct uvc_streaming *uvc_stream_by_id(struct uvc_device *dev, int id) ++static struct uvc_streaming *uvc_stream_for_terminal(struct uvc_device *dev, ++ struct uvc_entity *term) + { +- struct uvc_streaming *stream, *last_stream; +- unsigned int count = 0; ++ u16 id = UVC_HARDWARE_ENTITY_ID(term->id); ++ struct uvc_streaming *stream; + + list_for_each_entry(stream, &dev->streams, list) { +- count += 1; +- last_stream = stream; + if (stream->header.bTerminalLink == id) + return stream; + } + +- /* +- * If the streaming entity is referenced by an invalid ID, notify the +- * user and use heuristics to guess the correct entity. +- */ +- if (count == 1 && id == UVC_INVALID_ENTITY_ID) { +- dev_warn(&dev->intf->dev, +- "UVC non compliance: Invalid USB header. The streaming entity has an invalid ID, guessing the correct one."); +- return last_stream; +- } +- + return NULL; + } + +@@ -823,10 +812,12 @@ static struct uvc_entity *uvc_alloc_new_entity(struct uvc_device *dev, u16 type, + } + + /* Per UVC 1.1+ spec 3.7.2, the ID is unique. */ +- if (uvc_entity_by_id(dev, id)) { +- dev_err(&dev->intf->dev, "Found multiple Units with ID %u\n", id); ++ if (uvc_entity_by_id(dev, UVC_HARDWARE_ENTITY_ID(id))) ++ dev_err(&dev->intf->dev, "Found multiple Units with ID %u\n", ++ UVC_HARDWARE_ENTITY_ID(id)); ++ ++ if (uvc_entity_by_id(dev, id)) + id = UVC_INVALID_ENTITY_ID; +- } + + extra_size = roundup(extra_size, sizeof(*entity->pads)); + if (num_pads) +@@ -982,6 +973,7 @@ static int uvc_parse_standard_control(struct uvc_device *dev, + struct usb_host_interface *alts = dev->intf->cur_altsetting; + unsigned int i, n, p, len; + const char *type_name; ++ unsigned int id; + u16 type; + + switch (buffer[2]) { +@@ -1120,8 +1112,28 @@ static int uvc_parse_standard_control(struct uvc_device *dev, + return 0; + } + ++ id = buffer[3]; ++ ++ /* ++ * Some devices, such as the Grandstream GUV3100, exhibit entity ++ * ID collisions between units and streaming output terminals. ++ * Move streaming output terminals to their own ID namespace by ++ * setting bit UVC_TERM_OUTPUT (15), above the ID's 8-bit value. ++ * The bit is ignored in uvc_stream_for_terminal() when looking ++ * up the streaming interface for the terminal. ++ * ++ * This hack is safe to enable unconditionally, as the ID is not ++ * used for any other purpose (streaming output terminals have ++ * no controls and are never referenced as sources in UVC ++ * descriptors). Other types output terminals can have controls, ++ * so limit usage of this separate namespace to streaming output ++ * terminals. ++ */ ++ if (type & UVC_TT_STREAMING) ++ id |= UVC_TERM_OUTPUT; ++ + term = uvc_alloc_new_entity(dev, type | UVC_TERM_OUTPUT, +- buffer[3], 1, 0); ++ id, 1, 0); + if (IS_ERR(term)) + return PTR_ERR(term); + +@@ -2118,8 +2130,8 @@ static int uvc_register_terms(struct uvc_device *dev, + if (UVC_ENTITY_TYPE(term) != UVC_TT_STREAMING) + continue; + +- stream = uvc_stream_by_id(dev, term->id); +- if (stream == NULL) { ++ stream = uvc_stream_for_terminal(dev, term); ++ if (!stream) { + dev_info(&dev->intf->dev, + "No streaming interface found for terminal %u.", + term->id); +diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h +index ed7bad31f75ca..3f2e832025e71 100644 +--- a/drivers/media/usb/uvc/uvcvideo.h ++++ b/drivers/media/usb/uvc/uvcvideo.h +@@ -41,7 +41,8 @@ + #define UVC_EXT_GPIO_UNIT 0x7ffe + #define UVC_EXT_GPIO_UNIT_ID 0x100 + +-#define UVC_INVALID_ENTITY_ID 0xffff ++#define UVC_HARDWARE_ENTITY_ID(id) ((id) & 0xff) ++#define UVC_INVALID_ENTITY_ID 0xffff + + /* ------------------------------------------------------------------------ + * Driver specific constants. +-- +2.51.0 + diff --git a/queue-6.18/media-v4l2-async-fix-error-handling-on-steps-after-f.patch b/queue-6.18/media-v4l2-async-fix-error-handling-on-steps-after-f.patch new file mode 100644 index 00000000000..052c333a610 --- /dev/null +++ b/queue-6.18/media-v4l2-async-fix-error-handling-on-steps-after-f.patch @@ -0,0 +1,131 @@ +From c8b57d476367c807a590461dc4e867f4304b44fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 13:48:40 +0200 +Subject: media: v4l2-async: Fix error handling on steps after finding a match + +From: Sakari Ailus + +[ Upstream commit 7345d6d356336c448d6b9230ed8704f39679fd12 ] + +Once an async connection is found to be matching with an fwnode, a +sub-device may be registered (in case it wasn't already), its bound +operation is called, ancillary links are created, the async connection +is added to the sub-device's list of connections and removed from the +global waiting connection list. Further on, the sub-device's possible own +notifier is searched for possible additional matches. + +Fix these specific issues: + +- If v4l2_async_match_notify() failed before the sub-notifier handling, + the async connection was unbound and its entry removed from the + sub-device's async connection list. The latter part was also done in + v4l2_async_match_notify(). + +- The async connection's sd field was only set after creating ancillary + links in v4l2_async_match_notify(). It was however dereferenced in + v4l2_async_unbind_subdev_one(), which was called on error path of + v4l2_async_match_notify() failure. + +Signed-off-by: Sakari Ailus +Tested-by: "Yew, Chang Ching" +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-async.c | 45 +++++++++++++++++++--------- + 1 file changed, 31 insertions(+), 14 deletions(-) + +diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c +index ee884a8221fbd..1c08bba9ecb91 100644 +--- a/drivers/media/v4l2-core/v4l2-async.c ++++ b/drivers/media/v4l2-core/v4l2-async.c +@@ -343,7 +343,6 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier, + struct v4l2_subdev *sd, + struct v4l2_async_connection *asc) + { +- struct v4l2_async_notifier *subdev_notifier; + bool registered = false; + int ret; + +@@ -389,6 +388,25 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier, + dev_dbg(notifier_dev(notifier), "v4l2-async: %s bound (ret %d)\n", + dev_name(sd->dev), ret); + ++ return 0; ++ ++err_call_unbind: ++ v4l2_async_nf_call_unbind(notifier, sd, asc); ++ list_del(&asc->asc_subdev_entry); ++ ++err_unregister_subdev: ++ if (registered) ++ v4l2_device_unregister_subdev(sd); ++ ++ return ret; ++} ++ ++static int ++v4l2_async_nf_try_subdev_notifier(struct v4l2_async_notifier *notifier, ++ struct v4l2_subdev *sd) ++{ ++ struct v4l2_async_notifier *subdev_notifier; ++ + /* + * See if the sub-device has a notifier. If not, return here. + */ +@@ -404,16 +422,6 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier, + subdev_notifier->parent = notifier; + + return v4l2_async_nf_try_all_subdevs(subdev_notifier); +- +-err_call_unbind: +- v4l2_async_nf_call_unbind(notifier, sd, asc); +- list_del(&asc->asc_subdev_entry); +- +-err_unregister_subdev: +- if (registered) +- v4l2_device_unregister_subdev(sd); +- +- return ret; + } + + /* Test all async sub-devices in a notifier for a match. */ +@@ -445,6 +453,10 @@ v4l2_async_nf_try_all_subdevs(struct v4l2_async_notifier *notifier) + if (ret < 0) + return ret; + ++ ret = v4l2_async_nf_try_subdev_notifier(notifier, sd); ++ if (ret < 0) ++ return ret; ++ + /* + * v4l2_async_match_notify() may lead to registering a + * new notifier and thus changing the async subdevs +@@ -829,7 +841,11 @@ int __v4l2_async_register_subdev(struct v4l2_subdev *sd, struct module *module) + ret = v4l2_async_match_notify(notifier, v4l2_dev, sd, + asc); + if (ret) +- goto err_unbind; ++ goto err_unlock; ++ ++ ret = v4l2_async_nf_try_subdev_notifier(notifier, sd); ++ if (ret) ++ goto err_unbind_one; + + ret = v4l2_async_nf_try_complete(notifier); + if (ret) +@@ -853,9 +869,10 @@ int __v4l2_async_register_subdev(struct v4l2_subdev *sd, struct module *module) + if (subdev_notifier) + v4l2_async_nf_unbind_all_subdevs(subdev_notifier); + +- if (asc) +- v4l2_async_unbind_subdev_one(notifier, asc); ++err_unbind_one: ++ v4l2_async_unbind_subdev_one(notifier, asc); + ++err_unlock: + mutex_unlock(&list_lock); + + sd->owner = NULL; +-- +2.51.0 + diff --git a/queue-6.18/mfd-intel-lpss-add-intel-nova-lake-s-pci-ids.patch b/queue-6.18/mfd-intel-lpss-add-intel-nova-lake-s-pci-ids.patch new file mode 100644 index 00000000000..f7c3e9fe66d --- /dev/null +++ b/queue-6.18/mfd-intel-lpss-add-intel-nova-lake-s-pci-ids.patch @@ -0,0 +1,50 @@ +From 35daa065bc0bc044036eb0ddca18b1007f85dfb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 19:21:50 +0200 +Subject: mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit cefd793fa17de708d043adab50e7f96f414b0f1d ] + +Add Intel Nova Lake-S LPSS PCI IDs. + +Signed-off-by: Ilpo Järvinen +Acked-by: Andy Shevchenko +Link: https://patch.msgid.link/20260113172151.48062-1-ilpo.jarvinen@linux.intel.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/intel-lpss-pci.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c +index 8d92c895d3aef..713a5bfb1a3c2 100644 +--- a/drivers/mfd/intel-lpss-pci.c ++++ b/drivers/mfd/intel-lpss-pci.c +@@ -437,6 +437,19 @@ static const struct pci_device_id intel_lpss_pci_ids[] = { + { PCI_VDEVICE(INTEL, 0x5ac4), (kernel_ulong_t)&bxt_spi_info }, + { PCI_VDEVICE(INTEL, 0x5ac6), (kernel_ulong_t)&bxt_spi_info }, + { PCI_VDEVICE(INTEL, 0x5aee), (kernel_ulong_t)&bxt_uart_info }, ++ /* NVL-S */ ++ { PCI_VDEVICE(INTEL, 0x6e28), (kernel_ulong_t)&bxt_uart_info }, ++ { PCI_VDEVICE(INTEL, 0x6e29), (kernel_ulong_t)&bxt_uart_info }, ++ { PCI_VDEVICE(INTEL, 0x6e2a), (kernel_ulong_t)&tgl_spi_info }, ++ { PCI_VDEVICE(INTEL, 0x6e2b), (kernel_ulong_t)&tgl_spi_info }, ++ { PCI_VDEVICE(INTEL, 0x6e4c), (kernel_ulong_t)&ehl_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x6e4d), (kernel_ulong_t)&ehl_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x6e4e), (kernel_ulong_t)&ehl_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x6e4f), (kernel_ulong_t)&ehl_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x6e5c), (kernel_ulong_t)&bxt_uart_info }, ++ { PCI_VDEVICE(INTEL, 0x6e5e), (kernel_ulong_t)&tgl_spi_info }, ++ { PCI_VDEVICE(INTEL, 0x6e7a), (kernel_ulong_t)&ehl_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x6e7b), (kernel_ulong_t)&ehl_i2c_info }, + /* ARL-H */ + { PCI_VDEVICE(INTEL, 0x7725), (kernel_ulong_t)&bxt_uart_info }, + { PCI_VDEVICE(INTEL, 0x7726), (kernel_ulong_t)&bxt_uart_info }, +-- +2.51.0 + diff --git a/queue-6.18/minix-add-required-sanity-checking-to-minix_check_su.patch b/queue-6.18/minix-add-required-sanity-checking-to-minix_check_su.patch new file mode 100644 index 00000000000..729e6710164 --- /dev/null +++ b/queue-6.18/minix-add-required-sanity-checking-to-minix_check_su.patch @@ -0,0 +1,103 @@ +From a9b822148209f0dad52f65bb062329af6f171ef0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 16:39:47 +0100 +Subject: minix: Add required sanity checking to minix_check_superblock() + +From: Jori Koolstra + +[ Upstream commit 8c97a6ddc95690a938ded44b4e3202f03f15078c ] + +The fs/minix implementation of the minix filesystem does not currently +support any other value for s_log_zone_size than 0. This is also the +only value supported in util-linux; see mkfs.minix.c line 511. In +addition, this patch adds some sanity checking for the other minix +superblock fields, and moves the minix_blocks_needed() checks for the +zmap and imap also to minix_check_super_block(). + +This also closes a related syzbot bug report. + +Signed-off-by: Jori Koolstra +Link: https://patch.msgid.link/20251208153947.108343-1-jkoolstra@xs4all.nl +Reviewed-by: Jan Kara +Reported-by: syzbot+5ad0824204c7bf9b67f2@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=5ad0824204c7bf9b67f2 +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/minix/inode.c | 50 ++++++++++++++++++++++++++++-------------------- + 1 file changed, 29 insertions(+), 21 deletions(-) + +diff --git a/fs/minix/inode.c b/fs/minix/inode.c +index 32db676127a9e..7bdd240ea1584 100644 +--- a/fs/minix/inode.c ++++ b/fs/minix/inode.c +@@ -154,10 +154,38 @@ static int minix_reconfigure(struct fs_context *fc) + static bool minix_check_superblock(struct super_block *sb) + { + struct minix_sb_info *sbi = minix_sb(sb); ++ unsigned long block; + +- if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0) ++ if (sbi->s_log_zone_size != 0) { ++ printk("minix-fs error: zone size must equal block size. " ++ "s_log_zone_size > 0 is not supported.\n"); ++ return false; ++ } ++ ++ if (sbi->s_ninodes < 1 || sbi->s_firstdatazone <= 4 || ++ sbi->s_firstdatazone >= sbi->s_nzones) + return false; + ++ /* Apparently minix can create filesystems that allocate more blocks for ++ * the bitmaps than needed. We simply ignore that, but verify it didn't ++ * create one with not enough blocks and bail out if so. ++ */ ++ block = minix_blocks_needed(sbi->s_ninodes, sb->s_blocksize); ++ if (sbi->s_imap_blocks < block) { ++ printk("MINIX-fs: file system does not have enough " ++ "imap blocks allocated. Refusing to mount.\n"); ++ return false; ++ } ++ ++ block = minix_blocks_needed( ++ (sbi->s_nzones - sbi->s_firstdatazone + 1), ++ sb->s_blocksize); ++ if (sbi->s_zmap_blocks < block) { ++ printk("MINIX-fs: file system does not have enough " ++ "zmap blocks allocated. Refusing to mount.\n"); ++ return false; ++ } ++ + /* + * s_max_size must not exceed the block mapping limitation. This check + * is only needed for V1 filesystems, since V2/V3 support an extra level +@@ -277,26 +305,6 @@ static int minix_fill_super(struct super_block *s, struct fs_context *fc) + minix_set_bit(0,sbi->s_imap[0]->b_data); + minix_set_bit(0,sbi->s_zmap[0]->b_data); + +- /* Apparently minix can create filesystems that allocate more blocks for +- * the bitmaps than needed. We simply ignore that, but verify it didn't +- * create one with not enough blocks and bail out if so. +- */ +- block = minix_blocks_needed(sbi->s_ninodes, s->s_blocksize); +- if (sbi->s_imap_blocks < block) { +- printk("MINIX-fs: file system does not have enough " +- "imap blocks allocated. Refusing to mount.\n"); +- goto out_no_bitmap; +- } +- +- block = minix_blocks_needed( +- (sbi->s_nzones - sbi->s_firstdatazone + 1), +- s->s_blocksize); +- if (sbi->s_zmap_blocks < block) { +- printk("MINIX-fs: file system does not have enough " +- "zmap blocks allocated. Refusing to mount.\n"); +- goto out_no_bitmap; +- } +- + /* set up enough so that it can read an inode */ + s->s_op = &minix_sops; + s->s_time_min = 0; +-- +2.51.0 + diff --git a/queue-6.18/mips-loongson-make-cpumask_of_node-robust-against-nu.patch b/queue-6.18/mips-loongson-make-cpumask_of_node-robust-against-nu.patch new file mode 100644 index 00000000000..ced56d8b296 --- /dev/null +++ b/queue-6.18/mips-loongson-make-cpumask_of_node-robust-against-nu.patch @@ -0,0 +1,36 @@ +From d4e5ac4c1a146b9507f9de9943793735b59de2f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 09:40:06 +0000 +Subject: MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE + +From: John Garry + +[ Upstream commit d55d3fe2d1470ac5b6e93efe7998b728013c9fc8 ] + +The arch definition of cpumask_of_node() cannot handle NUMA_NO_NODE - which +is a valid index - so add a check for this. + +Signed-off-by: John Garry +Reviewed-by: Huacai Chen +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/mach-loongson64/topology.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/include/asm/mach-loongson64/topology.h b/arch/mips/include/asm/mach-loongson64/topology.h +index 3414a1fd17835..89bb4deab98a6 100644 +--- a/arch/mips/include/asm/mach-loongson64/topology.h ++++ b/arch/mips/include/asm/mach-loongson64/topology.h +@@ -7,7 +7,7 @@ + #define cpu_to_node(cpu) (cpu_logical_map(cpu) >> 2) + + extern cpumask_t __node_cpumask[]; +-#define cpumask_of_node(node) (&__node_cpumask[node]) ++#define cpumask_of_node(node) ((node) == NUMA_NO_NODE ? cpu_all_mask : &__node_cpumask[node]) + + struct pci_bus; + extern int pcibus_to_node(struct pci_bus *); +-- +2.51.0 + diff --git a/queue-6.18/misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch b/queue-6.18/misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch new file mode 100644 index 00000000000..29f7fcace4d --- /dev/null +++ b/queue-6.18/misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch @@ -0,0 +1,75 @@ +From b4eae75042391b67967eb142a1ca3bfad7c17f51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 14:36:37 +0800 +Subject: misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() + +From: Tuo Li + +[ Upstream commit ba75ecb97d3f4e95d59002c13afb6519205be6cb ] + +In the function bcm_vk_read(), the pointer entry is checked, indicating +that it can be NULL. If entry is NULL and rc is set to -EMSGSIZE, the +following code may cause null-pointer dereferences: + + struct vk_msg_blk tmp_msg = entry->to_h_msg[0]; + set_msg_id(&tmp_msg, entry->usr_msg_id); + tmp_msg.size = entry->to_h_blks - 1; + +To prevent these possible null-pointer dereferences, copy to_h_msg, +usr_msg_id, and to_h_blks from iter into temporary variables, and return +these temporary variables to the application instead of accessing them +through a potentially NULL entry. + +Signed-off-by: Tuo Li +Reviewed-by: Scott Branden +Link: https://patch.msgid.link/20251211063637.3987937-1-islituo@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/bcm-vk/bcm_vk_msg.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/misc/bcm-vk/bcm_vk_msg.c b/drivers/misc/bcm-vk/bcm_vk_msg.c +index 1f42d1d5a630a..665a3888708ac 100644 +--- a/drivers/misc/bcm-vk/bcm_vk_msg.c ++++ b/drivers/misc/bcm-vk/bcm_vk_msg.c +@@ -1010,6 +1010,9 @@ ssize_t bcm_vk_read(struct file *p_file, + struct device *dev = &vk->pdev->dev; + struct bcm_vk_msg_chan *chan = &vk->to_h_msg_chan; + struct bcm_vk_wkent *entry = NULL, *iter; ++ struct vk_msg_blk tmp_msg; ++ u32 tmp_usr_msg_id; ++ u32 tmp_blks; + u32 q_num; + u32 rsp_length; + +@@ -1034,6 +1037,9 @@ ssize_t bcm_vk_read(struct file *p_file, + entry = iter; + } else { + /* buffer not big enough */ ++ tmp_msg = iter->to_h_msg[0]; ++ tmp_usr_msg_id = iter->usr_msg_id; ++ tmp_blks = iter->to_h_blks; + rc = -EMSGSIZE; + } + goto read_loop_exit; +@@ -1052,14 +1058,12 @@ ssize_t bcm_vk_read(struct file *p_file, + + bcm_vk_free_wkent(dev, entry); + } else if (rc == -EMSGSIZE) { +- struct vk_msg_blk tmp_msg = entry->to_h_msg[0]; +- + /* + * in this case, return just the first block, so + * that app knows what size it is looking for. + */ +- set_msg_id(&tmp_msg, entry->usr_msg_id); +- tmp_msg.size = entry->to_h_blks - 1; ++ set_msg_id(&tmp_msg, tmp_usr_msg_id); ++ tmp_msg.size = tmp_blks - 1; + if (copy_to_user(buf, &tmp_msg, VK_MSGQ_BLK_SIZE) != 0) { + dev_err(dev, "Error return 1st block in -EMSGSIZE\n"); + rc = -EFAULT; +-- +2.51.0 + diff --git a/queue-6.18/misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch b/queue-6.18/misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch new file mode 100644 index 00000000000..00c116b1624 --- /dev/null +++ b/queue-6.18/misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch @@ -0,0 +1,67 @@ +From b196e8f7b5e5fa0ac253dda3ede8f681abd9a4da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 11:48:24 +0100 +Subject: misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 + +From: Markus Perkins + +[ Upstream commit b54c82d6cbfc76647ba558e8e3647eb2b0ba0e2b ] + +commit 14374fbb3f06 ("misc: eeprom_93xx46: Add new 93c56 and 93c66 +compatible strings") added support for 93xx56 and 93xx66 eeproms, but +didn't take into account that the write enable/disable + erase all +commands are hardcoded for the 6-bit address of the 93xx46. + +This commit fixes the command word generation by increasing the number +of shifts as the address field grows, keeping the command intact. + +Also, the check for 8-bit or 16-bit mode is no longer required as this +is already taken into account in the edev->addrlen field. + +Signed-off-by: Markus Perkins +Link: https://patch.msgid.link/20251202104823.429869-3-markus@notsyncing.net +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/eeprom/eeprom_93xx46.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c +index 9cae6f530679b..5230e910a1d11 100644 +--- a/drivers/misc/eeprom/eeprom_93xx46.c ++++ b/drivers/misc/eeprom/eeprom_93xx46.c +@@ -45,6 +45,7 @@ struct eeprom_93xx46_platform_data { + #define OP_START 0x4 + #define OP_WRITE (OP_START | 0x1) + #define OP_READ (OP_START | 0x2) ++/* The following addresses are offset for the 1K EEPROM variant in 16-bit mode */ + #define ADDR_EWDS 0x00 + #define ADDR_ERAL 0x20 + #define ADDR_EWEN 0x30 +@@ -191,10 +192,7 @@ static int eeprom_93xx46_ew(struct eeprom_93xx46_dev *edev, int is_on) + bits = edev->addrlen + 3; + + cmd_addr = OP_START << edev->addrlen; +- if (edev->pdata->flags & EE_ADDR8) +- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << 1; +- else +- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS); ++ cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << (edev->addrlen - 6); + + if (has_quirk_instruction_length(edev)) { + cmd_addr <<= 2; +@@ -328,10 +326,7 @@ static int eeprom_93xx46_eral(struct eeprom_93xx46_dev *edev) + bits = edev->addrlen + 3; + + cmd_addr = OP_START << edev->addrlen; +- if (edev->pdata->flags & EE_ADDR8) +- cmd_addr |= ADDR_ERAL << 1; +- else +- cmd_addr |= ADDR_ERAL; ++ cmd_addr |= ADDR_ERAL << (edev->addrlen - 6); + + if (has_quirk_instruction_length(edev)) { + cmd_addr <<= 2; +-- +2.51.0 + diff --git a/queue-6.18/misc-ti_fpc202-fix-a-potential-memory-leak-in-probe-.patch b/queue-6.18/misc-ti_fpc202-fix-a-potential-memory-leak-in-probe-.patch new file mode 100644 index 00000000000..0d6d2662c5c --- /dev/null +++ b/queue-6.18/misc-ti_fpc202-fix-a-potential-memory-leak-in-probe-.patch @@ -0,0 +1,46 @@ +From 0c6221f9d1cf94e3982d05552c1fb722ff9be335 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Dec 2025 18:22:43 +0800 +Subject: misc: ti_fpc202: fix a potential memory leak in probe function + +From: Felix Gu + +[ Upstream commit dad9f13d967b4e53e8eaf5f9c690f8e778ad9802 ] + +Use for_each_child_of_node_scoped() to simplify the code and ensure the +device node reference is automatically released when the loop scope +ends. + +Signed-off-by: Felix Gu +Reviewed-by: Romain Gantois +Link: https://patch.msgid.link/tencent_FA1AC670F5CF49873F88A44424F866994A08@qq.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/ti_fpc202.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/misc/ti_fpc202.c b/drivers/misc/ti_fpc202.c +index 7964e46c74482..8eb2b5ac98506 100644 +--- a/drivers/misc/ti_fpc202.c ++++ b/drivers/misc/ti_fpc202.c +@@ -309,7 +309,6 @@ static void fpc202_remove_port(struct fpc202_priv *priv, int port_id) + static int fpc202_probe(struct i2c_client *client) + { + struct device *dev = &client->dev; +- struct device_node *i2c_handle; + struct fpc202_priv *priv; + int ret, port_id; + +@@ -357,7 +356,7 @@ static int fpc202_probe(struct i2c_client *client) + + bitmap_zero(priv->probed_ports, FPC202_NUM_PORTS); + +- for_each_child_of_node(dev->of_node, i2c_handle) { ++ for_each_child_of_node_scoped(dev->of_node, i2c_handle) { + ret = of_property_read_u32(i2c_handle, "reg", &port_id); + if (ret) { + if (ret == -EINVAL) +-- +2.51.0 + diff --git a/queue-6.18/modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch b/queue-6.18/modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch new file mode 100644 index 00000000000..944346bc8b6 --- /dev/null +++ b/queue-6.18/modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch @@ -0,0 +1,56 @@ +From 591b763310385a36ec35e531196cf2475415f6e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Nov 2025 13:13:30 +0100 +Subject: modpost: Amend ppc64 save/restfpr symnames for -Os build +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: René Rebe + +[ Upstream commit 3cd9763ce4ad999d015cf0734e6b968cead95077 ] + +Building a size optimized ppc64 kernel (-Os), gcc emits more FP +save/restore symbols, that the linker generates on demand into the +.sfpr section. Explicitly allow-list those in scripts/mod/modpost.c, +too. They are needed for the amdgpu in-kernel floating point support. + +MODPOST Module.symvers +ERROR: modpost: "_restfpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_26" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savegpr1_27" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savegpr1_25" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_28" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savegpr1_29" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savefpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savefpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_15" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +WARNING: modpost: suppressed 56 unresolved symbol warnings because there were too many) + +Signed-off-by: René Rebe +Link: https://patch.msgid.link/20251123.131330.407910684435629198.rene@exactco.de +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + scripts/mod/modpost.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index 47c8aa2a69392..133dfa16308a3 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -602,6 +602,10 @@ static int ignore_undef_symbol(struct elf_info *info, const char *symname) + /* Special register function linked on all modules during final link of .ko */ + if (strstarts(symname, "_restgpr0_") || + strstarts(symname, "_savegpr0_") || ++ strstarts(symname, "_restgpr1_") || ++ strstarts(symname, "_savegpr1_") || ++ strstarts(symname, "_restfpr_") || ++ strstarts(symname, "_savefpr_") || + strstarts(symname, "_restvr_") || + strstarts(symname, "_savevr_") || + strcmp(symname, ".TOC.") == 0) +-- +2.51.0 + diff --git a/queue-6.18/most-core-fix-resource-leak-in-most_register_interfa.patch b/queue-6.18/most-core-fix-resource-leak-in-most_register_interfa.patch new file mode 100644 index 00000000000..9935c0c7c02 --- /dev/null +++ b/queue-6.18/most-core-fix-resource-leak-in-most_register_interfa.patch @@ -0,0 +1,71 @@ +From 8259b6e6da0e4aca5c6edd25c5b86389918b29d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Nov 2025 16:53:37 +0000 +Subject: most: core: fix resource leak in most_register_interface error paths + +From: Navaneeth K + +[ Upstream commit 1f4c9d8a1021281750c6cda126d6f8a40cc24e71 ] + +The function most_register_interface() did not correctly release resources +if it failed early (before registering the device). In these cases, it +returned an error code immediately, leaking the memory allocated for the +interface. + +Fix this by initializing the device early via device_initialize() and +calling put_device() on all error paths. + +The most_register_interface() is expected to call put_device() on +error which frees the resources allocated in the caller. The +put_device() either calls release_mdev() or dim2_release(), +depending on the caller. + +Switch to using device_add() instead of device_register() to handle +the split initialization. + +Acked-by: Abdun Nihaal +Signed-off-by: Navaneeth K +Reviewed-by: Dan Carpenter +Link: https://patch.msgid.link/20251127165337.19172-1-knavaneeth786@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/most/core.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/most/core.c b/drivers/most/core.c +index da319d108ea1d..6277e6702ca8c 100644 +--- a/drivers/most/core.c ++++ b/drivers/most/core.c +@@ -1286,15 +1286,19 @@ int most_register_interface(struct most_interface *iface) + !iface->poison_channel || (iface->num_channels > MAX_CHANNELS)) + return -EINVAL; + ++ device_initialize(iface->dev); ++ + id = ida_alloc(&mdev_id, GFP_KERNEL); + if (id < 0) { + dev_err(iface->dev, "Failed to allocate device ID\n"); ++ put_device(iface->dev); + return id; + } + + iface->p = kzalloc(sizeof(*iface->p), GFP_KERNEL); + if (!iface->p) { + ida_free(&mdev_id, id); ++ put_device(iface->dev); + return -ENOMEM; + } + +@@ -1304,7 +1308,7 @@ int most_register_interface(struct most_interface *iface) + iface->dev->bus = &mostbus; + iface->dev->groups = interface_attr_groups; + dev_set_drvdata(iface->dev, iface); +- if (device_register(iface->dev)) { ++ if (device_add(iface->dev)) { + dev_err(iface->dev, "Failed to register interface device\n"); + kfree(iface->p); + put_device(iface->dev); +-- +2.51.0 + diff --git a/queue-6.18/mshv-clear-eventfd-counter-on-irqfd-shutdown.patch b/queue-6.18/mshv-clear-eventfd-counter-on-irqfd-shutdown.patch new file mode 100644 index 00000000000..6000cdcd4c4 --- /dev/null +++ b/queue-6.18/mshv-clear-eventfd-counter-on-irqfd-shutdown.patch @@ -0,0 +1,72 @@ +From 8dd3528ec275597fa6be52dbf2bcf2d2ad9aac96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 12:41:31 +0100 +Subject: mshv: clear eventfd counter on irqfd shutdown +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Carlos López + +[ Upstream commit 2b4246153e2184e3a3b4edc8cc35337d7a2455a6 ] + +While unhooking from the irqfd waitqueue, clear the internal eventfd +counter by using eventfd_ctx_remove_wait_queue() instead of +remove_wait_queue(), preventing potential spurious interrupts. This +removes the need to store a pointer into the workqueue, as the eventfd +already keeps track of it. + +This mimicks what other similar subsystems do on their equivalent paths +with their irqfds (KVM, Xen, ACRN support, etc). + +Signed-off-by: Carlos López +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/hv/mshv_eventfd.c | 5 ++--- + drivers/hv/mshv_eventfd.h | 1 - + 2 files changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/hv/mshv_eventfd.c b/drivers/hv/mshv_eventfd.c +index 05d643f54f45a..40b7179fee805 100644 +--- a/drivers/hv/mshv_eventfd.c ++++ b/drivers/hv/mshv_eventfd.c +@@ -244,12 +244,13 @@ static void mshv_irqfd_shutdown(struct work_struct *work) + { + struct mshv_irqfd *irqfd = + container_of(work, struct mshv_irqfd, irqfd_shutdown); ++ u64 cnt; + + /* + * Synchronize with the wait-queue and unhook ourselves to prevent + * further events. + */ +- remove_wait_queue(irqfd->irqfd_wqh, &irqfd->irqfd_wait); ++ eventfd_ctx_remove_wait_queue(irqfd->irqfd_eventfd_ctx, &irqfd->irqfd_wait, &cnt); + + if (irqfd->irqfd_resampler) { + mshv_irqfd_resampler_shutdown(irqfd); +@@ -368,8 +369,6 @@ static void mshv_irqfd_queue_proc(struct file *file, wait_queue_head_t *wqh, + struct mshv_irqfd *irqfd = + container_of(polltbl, struct mshv_irqfd, irqfd_polltbl); + +- irqfd->irqfd_wqh = wqh; +- + /* + * TODO: Ensure there isn't already an exclusive, priority waiter, e.g. + * that the irqfd isn't already bound to another partition. Only the +diff --git a/drivers/hv/mshv_eventfd.h b/drivers/hv/mshv_eventfd.h +index 332e7670a3442..464c6b81ab336 100644 +--- a/drivers/hv/mshv_eventfd.h ++++ b/drivers/hv/mshv_eventfd.h +@@ -32,7 +32,6 @@ struct mshv_irqfd { + struct mshv_lapic_irq irqfd_lapic_irq; + struct hlist_node irqfd_hnode; + poll_table irqfd_polltbl; +- wait_queue_head_t *irqfd_wqh; + wait_queue_entry_t irqfd_wait; + struct work_struct irqfd_shutdown; + struct mshv_irqfd_resampler *irqfd_resampler; +-- +2.51.0 + diff --git a/queue-6.18/myri10ge-avoid-uninitialized-variable-use.patch b/queue-6.18/myri10ge-avoid-uninitialized-variable-use.patch new file mode 100644 index 00000000000..f7c7f1acb8d --- /dev/null +++ b/queue-6.18/myri10ge-avoid-uninitialized-variable-use.patch @@ -0,0 +1,162 @@ +From 0a51fa38af4f69fe8d6a09f48065a2dd7b38974b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Feb 2026 17:28:09 +0100 +Subject: myri10ge: avoid uninitialized variable use + +From: Arnd Bergmann + +[ Upstream commit fd24173439c033ffb3c2a2628fcbc9cb65e62bdb ] + +While compile testing on less common architectures, I noticed that gcc-10 on +s390 finds a bug that all other configurations seem to miss: + +drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_set_multicast_list': +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:391:25: error: 'cmd.data0' is used uninitialized in this function [-Werror=uninitialized] + 391 | buf->data0 = htonl(data->data0); + | ^~ +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:25: error: '*((void *)&cmd+4)' is used uninitialized in this function [-Werror=uninitialized] + 392 | buf->data1 = htonl(data->data1); + | ^~ +drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_allocate_rings': +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:13: error: 'cmd.data1' is used uninitialized in this function [-Werror=uninitialized] + 392 | buf->data1 = htonl(data->data1); +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data1' was declared here + 1939 | struct myri10ge_cmd cmd; + | ^~~ +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:393:13: error: 'cmd.data2' is used uninitialized in this function [-Werror=uninitialized] + 393 | buf->data2 = htonl(data->data2); +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data2' was declared here + 1939 | struct myri10ge_cmd cmd; + +It would be nice to understand how to make other compilers catch this as +well, but for the moment I'll just shut up the warning by fixing the +undefined behavior in this driver. + +Signed-off-by: Arnd Bergmann +Link: https://patch.msgid.link/20260205162935.2126442-1-arnd@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/myricom/myri10ge/myri10ge.c | 28 ++++++++++++++++++- + 1 file changed, 27 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c +index 7be30a8df2685..2f0cdbd4e2ac9 100644 +--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c ++++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c +@@ -688,6 +688,9 @@ static int myri10ge_get_firmware_capabilities(struct myri10ge_priv *mgp) + + /* probe for IPv6 TSO support */ + mgp->features = NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_TSO; ++ cmd.data0 = 0, ++ cmd.data1 = 0, ++ cmd.data2 = 0, + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_MAX_TSO6_HDR_SIZE, + &cmd, 0); + if (status == 0) { +@@ -806,6 +809,7 @@ static int myri10ge_update_mac_address(struct myri10ge_priv *mgp, + | (addr[2] << 8) | addr[3]); + + cmd.data1 = ((addr[4] << 8) | (addr[5])); ++ cmd.data2 = 0; + + status = myri10ge_send_cmd(mgp, MXGEFW_SET_MAC_ADDRESS, &cmd, 0); + return status; +@@ -817,6 +821,9 @@ static int myri10ge_change_pause(struct myri10ge_priv *mgp, int pause) + int status, ctl; + + ctl = pause ? MXGEFW_ENABLE_FLOW_CONTROL : MXGEFW_DISABLE_FLOW_CONTROL; ++ cmd.data0 = 0, ++ cmd.data1 = 0, ++ cmd.data2 = 0, + status = myri10ge_send_cmd(mgp, ctl, &cmd, 0); + + if (status) { +@@ -834,6 +841,9 @@ myri10ge_change_promisc(struct myri10ge_priv *mgp, int promisc, int atomic) + int status, ctl; + + ctl = promisc ? MXGEFW_ENABLE_PROMISC : MXGEFW_DISABLE_PROMISC; ++ cmd.data0 = 0; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, ctl, &cmd, atomic); + if (status) + netdev_err(mgp->dev, "Failed to set promisc mode\n"); +@@ -1946,6 +1956,8 @@ static int myri10ge_allocate_rings(struct myri10ge_slice_state *ss) + /* get ring sizes */ + slice = ss - mgp->ss; + cmd.data0 = slice; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_RING_SIZE, &cmd, 0); + tx_ring_size = cmd.data0; + cmd.data0 = slice; +@@ -2238,12 +2250,16 @@ static int myri10ge_get_txrx(struct myri10ge_priv *mgp, int slice) + status = 0; + if (slice == 0 || (mgp->dev->real_num_tx_queues > 1)) { + cmd.data0 = slice; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_OFFSET, + &cmd, 0); + ss->tx.lanai = (struct mcp_kreq_ether_send __iomem *) + (mgp->sram + cmd.data0); + } + cmd.data0 = slice; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status |= myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SMALL_RX_OFFSET, + &cmd, 0); + ss->rx_small.lanai = (struct mcp_kreq_ether_recv __iomem *) +@@ -2312,6 +2328,7 @@ static int myri10ge_open(struct net_device *dev) + if (mgp->num_slices > 1) { + cmd.data0 = mgp->num_slices; + cmd.data1 = MXGEFW_SLICE_INTR_MODE_ONE_PER_SLICE; ++ cmd.data2 = 0; + if (mgp->dev->real_num_tx_queues > 1) + cmd.data1 |= MXGEFW_SLICE_ENABLE_MULTIPLE_TX_QUEUES; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_ENABLE_RSS_QUEUES, +@@ -2414,6 +2431,8 @@ static int myri10ge_open(struct net_device *dev) + + /* now give firmware buffers sizes, and MTU */ + cmd.data0 = dev->mtu + ETH_HLEN + VLAN_HLEN; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_SET_MTU, &cmd, 0); + cmd.data0 = mgp->small_bytes; + status |= +@@ -2472,7 +2491,6 @@ static int myri10ge_open(struct net_device *dev) + static int myri10ge_close(struct net_device *dev) + { + struct myri10ge_priv *mgp = netdev_priv(dev); +- struct myri10ge_cmd cmd; + int status, old_down_cnt; + int i; + +@@ -2491,8 +2509,13 @@ static int myri10ge_close(struct net_device *dev) + + netif_tx_stop_all_queues(dev); + if (mgp->rebooted == 0) { ++ struct myri10ge_cmd cmd; ++ + old_down_cnt = mgp->down_cnt; + mb(); ++ cmd.data0 = 0; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = + myri10ge_send_cmd(mgp, MXGEFW_CMD_ETHERNET_DOWN, &cmd, 0); + if (status) +@@ -2956,6 +2979,9 @@ static void myri10ge_set_multicast_list(struct net_device *dev) + + /* Disable multicast filtering */ + ++ cmd.data0 = 0; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + err = myri10ge_send_cmd(mgp, MXGEFW_ENABLE_ALLMULTI, &cmd, 1); + if (err != 0) { + netdev_err(dev, "Failed MXGEFW_ENABLE_ALLMULTI, error status: %d\n", +-- +2.51.0 + diff --git a/queue-6.18/net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch b/queue-6.18/net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch new file mode 100644 index 00000000000..b4d1aa2ad69 --- /dev/null +++ b/queue-6.18/net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch @@ -0,0 +1,70 @@ +From 21ebc80fee90399bb6d46a7f5af9718cf19244c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 17:47:55 +0800 +Subject: net: hns3: extend HCLGE_FD_AD_QID to 11 bits + +From: Jijie Shao + +[ Upstream commit 878406d4d6ef85c37fab52074771cc916e532c16 ] + +Currently, HCLGE_FD_AD_QID has only 10 bits and supports a +maximum of 1023 queues. However, there are actually scenarios +where the queue_id exceeds 1023. + +This patch adds an additional bit to HCLGE_FD_AD_QID to ensure +that queue_id greater than 1023 are supported. + +Signed-off-by: Jijie Shao +Link: https://patch.msgid.link/20260123094756.3718516-2-shaojijie@huawei.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 5 +++-- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 +++- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +index 416e02e7b995f..bc333d8710ac1 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +@@ -727,8 +727,8 @@ struct hclge_fd_tcam_config_3_cmd { + + #define HCLGE_FD_AD_DROP_B 0 + #define HCLGE_FD_AD_DIRECT_QID_B 1 +-#define HCLGE_FD_AD_QID_S 2 +-#define HCLGE_FD_AD_QID_M GENMASK(11, 2) ++#define HCLGE_FD_AD_QID_L_S 2 ++#define HCLGE_FD_AD_QID_L_M GENMASK(11, 2) + #define HCLGE_FD_AD_USE_COUNTER_B 12 + #define HCLGE_FD_AD_COUNTER_NUM_S 13 + #define HCLGE_FD_AD_COUNTER_NUM_M GENMASK(19, 13) +@@ -741,6 +741,7 @@ struct hclge_fd_tcam_config_3_cmd { + #define HCLGE_FD_AD_TC_OVRD_B 16 + #define HCLGE_FD_AD_TC_SIZE_S 17 + #define HCLGE_FD_AD_TC_SIZE_M GENMASK(20, 17) ++#define HCLGE_FD_AD_QID_H_B 21 + + struct hclge_fd_ad_config_cmd { + u8 stage; +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 5cc5ee9dcd982..54d0a9ba7879b 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -5679,11 +5679,13 @@ static int hclge_fd_ad_config(struct hclge_dev *hdev, u8 stage, int loc, + hnae3_set_field(ad_data, HCLGE_FD_AD_TC_SIZE_M, + HCLGE_FD_AD_TC_SIZE_S, (u32)action->tc_size); + } ++ hnae3_set_bit(ad_data, HCLGE_FD_AD_QID_H_B, ++ action->queue_id >= HCLGE_TQP_MAX_SIZE_DEV_V2 ? 1 : 0); + ad_data <<= 32; + hnae3_set_bit(ad_data, HCLGE_FD_AD_DROP_B, action->drop_packet); + hnae3_set_bit(ad_data, HCLGE_FD_AD_DIRECT_QID_B, + action->forward_to_direct_queue); +- hnae3_set_field(ad_data, HCLGE_FD_AD_QID_M, HCLGE_FD_AD_QID_S, ++ hnae3_set_field(ad_data, HCLGE_FD_AD_QID_L_M, HCLGE_FD_AD_QID_L_S, + action->queue_id); + hnae3_set_bit(ad_data, HCLGE_FD_AD_USE_COUNTER_B, action->use_counter); + hnae3_set_field(ad_data, HCLGE_FD_AD_COUNTER_NUM_M, +-- +2.51.0 + diff --git a/queue-6.18/net-rds-clear-reconnect-pending-bit.patch b/queue-6.18/net-rds-clear-reconnect-pending-bit.patch new file mode 100644 index 00000000000..a85296e17d0 --- /dev/null +++ b/queue-6.18/net-rds-clear-reconnect-pending-bit.patch @@ -0,0 +1,42 @@ +From 8a9aab7b3019c201a08d03040c9e3ceff42d7195 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 22:57:20 -0700 +Subject: net/rds: Clear reconnect pending bit +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: HÃ¥kon Bugge + +[ Upstream commit b89fc7c2523b2b0750d91840f4e52521270d70ed ] + +When canceling the reconnect worker, care must be taken to reset the +reconnect-pending bit. If the reconnect worker has not yet been +scheduled before it is canceled, the reconnect-pending bit will stay +on forever. + +Signed-off-by: HÃ¥kon Bugge +Signed-off-by: Allison Henderson +Link: https://patch.msgid.link/20260203055723.1085751-6-achender@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/rds/connection.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/rds/connection.c b/net/rds/connection.c +index ad8027e6f54ef..dbfea6fa11260 100644 +--- a/net/rds/connection.c ++++ b/net/rds/connection.c +@@ -429,6 +429,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp) + * to the conn hash, so we never trigger a reconnect on this + * conn - the reconnect is always triggered by the active peer. */ + cancel_delayed_work_sync(&cp->cp_conn_w); ++ ++ clear_bit(RDS_RECONNECT_PENDING, &cp->cp_flags); + rcu_read_lock(); + if (!hlist_unhashed(&conn->c_hash_node)) { + rcu_read_unlock(); +-- +2.51.0 + diff --git a/queue-6.18/net-rds-no-shortcut-out-of-rds_conn_error.patch b/queue-6.18/net-rds-no-shortcut-out-of-rds_conn_error.patch new file mode 100644 index 00000000000..4400ce9fdb5 --- /dev/null +++ b/queue-6.18/net-rds-no-shortcut-out-of-rds_conn_error.patch @@ -0,0 +1,92 @@ +From d3e99b140de5a0b0f8d906104cdbc6e7cda80f51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jan 2026 22:52:12 -0700 +Subject: net/rds: No shortcut out of RDS_CONN_ERROR + +From: Gerd Rausch + +[ Upstream commit ad22d24be635c6beab6a1fdd3f8b1f3c478d15da ] + +RDS connections carry a state "rds_conn_path::cp_state" +and transitions from one state to another and are conditional +upon an expected state: "rds_conn_path_transition." + +There is one exception to this conditionality, which is +"RDS_CONN_ERROR" that can be enforced by "rds_conn_path_drop" +regardless of what state the condition is currently in. + +But as soon as a connection enters state "RDS_CONN_ERROR", +the connection handling code expects it to go through the +shutdown-path. + +The RDS/TCP multipath changes added a shortcut out of +"RDS_CONN_ERROR" straight back to "RDS_CONN_CONNECTING" +via "rds_tcp_accept_one_path" (e.g. after "rds_tcp_state_change"). + +A subsequent "rds_tcp_reset_callbacks" can then transition +the state to "RDS_CONN_RESETTING" with a shutdown-worker queued. + +That'll trip up "rds_conn_init_shutdown", which was +never adjusted to handle "RDS_CONN_RESETTING" and subsequently +drops the connection with the dreaded "DR_INV_CONN_STATE", +which leaves "RDS_SHUTDOWN_WORK_QUEUED" on forever. + +So we do two things here: + +a) Don't shortcut "RDS_CONN_ERROR", but take the longer + path through the shutdown code. + +b) Add "RDS_CONN_RESETTING" to the expected states in + "rds_conn_init_shutdown" so that we won't error out + and get stuck, if we ever hit weird state transitions + like this again." + +Signed-off-by: Gerd Rausch +Signed-off-by: Allison Henderson +Link: https://patch.msgid.link/20260122055213.83608-2-achender@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/rds/connection.c | 2 ++ + net/rds/tcp_listen.c | 5 ----- + 2 files changed, 2 insertions(+), 5 deletions(-) + +diff --git a/net/rds/connection.c b/net/rds/connection.c +index 68bc88cce84ec..ad8027e6f54ef 100644 +--- a/net/rds/connection.c ++++ b/net/rds/connection.c +@@ -382,6 +382,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp) + if (!rds_conn_path_transition(cp, RDS_CONN_UP, + RDS_CONN_DISCONNECTING) && + !rds_conn_path_transition(cp, RDS_CONN_ERROR, ++ RDS_CONN_DISCONNECTING) && ++ !rds_conn_path_transition(cp, RDS_CONN_RESETTING, + RDS_CONN_DISCONNECTING)) { + rds_conn_path_error(cp, + "shutdown called in state %d\n", +diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c +index 91e34af3fe5d5..65c5425a02de4 100644 +--- a/net/rds/tcp_listen.c ++++ b/net/rds/tcp_listen.c +@@ -59,9 +59,6 @@ void rds_tcp_keepalive(struct socket *sock) + * socket and force a reconneect from smaller -> larger ip addr. The reason + * we special case cp_index 0 is to allow the rds probe ping itself to itself + * get through efficiently. +- * Since reconnects are only initiated from the node with the numerically +- * smaller ip address, we recycle conns in RDS_CONN_ERROR on the passive side +- * by moving them to CONNECTING in this function. + */ + static + struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn) +@@ -86,8 +83,6 @@ struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn) + struct rds_conn_path *cp = &conn->c_path[i]; + + if (rds_conn_path_transition(cp, RDS_CONN_DOWN, +- RDS_CONN_CONNECTING) || +- rds_conn_path_transition(cp, RDS_CONN_ERROR, + RDS_CONN_CONNECTING)) { + return cp->cp_transport_data; + } +-- +2.51.0 + diff --git a/queue-6.18/net-sfp-add-quirk-for-lantech-8330-265d.patch b/queue-6.18/net-sfp-add-quirk-for-lantech-8330-265d.patch new file mode 100644 index 00000000000..e6015016c10 --- /dev/null +++ b/queue-6.18/net-sfp-add-quirk-for-lantech-8330-265d.patch @@ -0,0 +1,49 @@ +From 361607e9d32f85d01d280f36bc2dea7a90877c32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 18:00:44 +0100 +Subject: net: sfp: add quirk for Lantech 8330-265D +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit 86a8e8e0ddbc3d14c799536eb888180b84d002f3 ] + +Similar to Lantech 8330-262D-E, the Lantech 8330-265D also reports +2500MBd instead of 3125MBd. + +Also, all 8330-265D report normal RX_LOS in EEPROM, but some signal +inverted RX_LOS. We therefore need to ignore RX_LOS on these modules. + +Signed-off-by: Marek Behún +Link: https://patch.msgid.link/20260128170044.15576-1-kabel@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/sfp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c +index 3e023723887c4..43aefdd8b70f7 100644 +--- a/drivers/net/phy/sfp.c ++++ b/drivers/net/phy/sfp.c +@@ -532,9 +532,13 @@ static const struct sfp_quirk sfp_quirks[] = { + SFP_QUIRK("HUAWEI", "MA5671A", sfp_quirk_2500basex, + sfp_fixup_ignore_tx_fault), + +- // Lantech 8330-262D-E can operate at 2500base-X, but incorrectly report +- // 2500MBd NRZ in their EEPROM ++ // Lantech 8330-262D-E and 8330-265D can operate at 2500base-X, but ++ // incorrectly report 2500MBd NRZ in their EEPROM. ++ // Some 8330-265D modules have inverted LOS, while all of them report ++ // normal LOS in EEPROM. Therefore we need to ignore LOS entirely. + SFP_QUIRK_S("Lantech", "8330-262D-E", sfp_quirk_2500basex), ++ SFP_QUIRK("Lantech", "8330-265D", sfp_quirk_2500basex, ++ sfp_fixup_ignore_los), + + SFP_QUIRK_S("UBNT", "UF-INSTANT", sfp_quirk_ubnt_uf_instant), + +-- +2.51.0 + diff --git a/queue-6.18/net-usb-r8152-fix-transmit-queue-timeout.patch b/queue-6.18/net-usb-r8152-fix-transmit-queue-timeout.patch new file mode 100644 index 00000000000..74f02a28e56 --- /dev/null +++ b/queue-6.18/net-usb-r8152-fix-transmit-queue-timeout.patch @@ -0,0 +1,42 @@ +From 510eca0c19200a9476127f3b178d496b93efdcdb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 09:59:49 +0800 +Subject: net: usb: r8152: fix transmit queue timeout + +From: Mingj Ye + +[ Upstream commit 833dcd75d54f0bf5aa0a0781ff57456b421fbb40 ] + +When the TX queue length reaches the threshold, the netdev watchdog +immediately detects a TX queue timeout. + +This patch updates the trans_start timestamp of the transmit queue +on every asynchronous USB URB submission along the transmit path, +ensuring that the network watchdog accurately reflects ongoing +transmission activity. + +Signed-off-by: Mingj Ye +Reviewed-by: Hayes Wang +Link: https://patch.msgid.link/20260120015949.84996-1-insyelu@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 6a43054d5171f..da8de7b1a4891 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -2449,6 +2449,8 @@ static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg) + ret = usb_submit_urb(agg->urb, GFP_ATOMIC); + if (ret < 0) + usb_autopm_put_interface_async(tp->intf); ++ else ++ netif_trans_update(tp->netdev); + + out_tx_fill: + return ret; +-- +2.51.0 + diff --git a/queue-6.18/net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch b/queue-6.18/net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch new file mode 100644 index 00000000000..3f26772f2c9 --- /dev/null +++ b/queue-6.18/net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch @@ -0,0 +1,117 @@ +From 6c9ca99cc8c3b30f83f82059a1bd18a9cf24cfe0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 17:39:09 -0800 +Subject: net: usb: sr9700: remove code to drive nonexistent multicast filter + +From: Ethan Nelson-Moore + +[ Upstream commit 9a9424c756feee9ee6e717405a9d6fa7bacdef08 ] + +Several registers referenced in this driver's source code do not +actually exist (they are not writable and read as zero in my testing). +They exist in this driver because it originated as a copy of the dm9601 +driver. Notably, these include the multicast filter registers - this +causes the driver to not support multicast packets correctly. Remove +the multicast filter code and register definitions. Instead, set the +chip to receive all multicast filter packets when any multicast +addresses are in the list. + +Reviewed-by: Simon Horman (from v1) +Signed-off-by: Ethan Nelson-Moore +Link: https://patch.msgid.link/20260203013924.28582-1-enelsonmoore@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/Kconfig | 1 - + drivers/net/usb/sr9700.c | 25 ++++--------------------- + drivers/net/usb/sr9700.h | 7 +------ + 3 files changed, 5 insertions(+), 28 deletions(-) + +diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig +index 856e648d804e0..da0f6a138f4fc 100644 +--- a/drivers/net/usb/Kconfig ++++ b/drivers/net/usb/Kconfig +@@ -319,7 +319,6 @@ config USB_NET_DM9601 + config USB_NET_SR9700 + tristate "CoreChip-sz SR9700 based USB 1.1 10/100 ethernet devices" + depends on USB_USBNET +- select CRC32 + help + This option adds support for CoreChip-sz SR9700 based USB 1.1 + 10/100 Ethernet adapters. +diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c +index 820c4c5069792..a5d364fbc3639 100644 +--- a/drivers/net/usb/sr9700.c ++++ b/drivers/net/usb/sr9700.c +@@ -18,7 +18,6 @@ + #include + #include + #include +-#include + #include + + #include "sr9700.h" +@@ -265,31 +264,15 @@ static const struct ethtool_ops sr9700_ethtool_ops = { + static void sr9700_set_multicast(struct net_device *netdev) + { + struct usbnet *dev = netdev_priv(netdev); +- /* We use the 20 byte dev->data for our 8 byte filter buffer +- * to avoid allocating memory that is tricky to free later +- */ +- u8 *hashes = (u8 *)&dev->data; + /* rx_ctl setting : enable, disable_long, disable_crc */ + u8 rx_ctl = RCR_RXEN | RCR_DIS_CRC | RCR_DIS_LONG; + +- memset(hashes, 0x00, SR_MCAST_SIZE); +- /* broadcast address */ +- hashes[SR_MCAST_SIZE - 1] |= SR_MCAST_ADDR_FLAG; +- if (netdev->flags & IFF_PROMISC) { ++ if (netdev->flags & IFF_PROMISC) + rx_ctl |= RCR_PRMSC; +- } else if (netdev->flags & IFF_ALLMULTI || +- netdev_mc_count(netdev) > SR_MCAST_MAX) { +- rx_ctl |= RCR_RUNT; +- } else if (!netdev_mc_empty(netdev)) { +- struct netdev_hw_addr *ha; +- +- netdev_for_each_mc_addr(ha, netdev) { +- u32 crc = ether_crc(ETH_ALEN, ha->addr) >> 26; +- hashes[crc >> 3] |= 1 << (crc & 0x7); +- } +- } ++ else if (netdev->flags & IFF_ALLMULTI || !netdev_mc_empty(netdev)) ++ /* The chip has no multicast filter */ ++ rx_ctl |= RCR_ALL; + +- sr_write_async(dev, SR_MAR, SR_MCAST_SIZE, hashes); + sr_write_reg_async(dev, SR_RCR, rx_ctl); + } + +diff --git a/drivers/net/usb/sr9700.h b/drivers/net/usb/sr9700.h +index ea2b4de621c86..c479908f7d823 100644 +--- a/drivers/net/usb/sr9700.h ++++ b/drivers/net/usb/sr9700.h +@@ -104,9 +104,7 @@ + #define WCR_LINKEN (1 << 5) + /* Physical Address Reg */ + #define SR_PAR 0x10 /* 0x10 ~ 0x15 6 bytes for PAR */ +-/* Multicast Address Reg */ +-#define SR_MAR 0x16 /* 0x16 ~ 0x1D 8 bytes for MAR */ +-/* 0x1e unused */ ++/* 0x16 --> 0x1E unused */ + /* Phy Reset Reg */ + #define SR_PRR 0x1F + #define PRR_PHY_RST (1 << 0) +@@ -161,9 +159,6 @@ + /* parameters */ + #define SR_SHARE_TIMEOUT 1000 + #define SR_EEPROM_LEN 256 +-#define SR_MCAST_SIZE 8 +-#define SR_MCAST_ADDR_FLAG 0x80 +-#define SR_MCAST_MAX 64 + #define SR_TX_OVERHEAD 2 /* 2bytes header */ + #define SR_RX_OVERHEAD 7 /* 3bytes header + 4crc tail */ + +-- +2.51.0 + diff --git a/queue-6.18/net-wwan-mhi-add-network-support-for-foxconn-t99w760.patch b/queue-6.18/net-wwan-mhi-add-network-support-for-foxconn-t99w760.patch new file mode 100644 index 00000000000..52889483d13 --- /dev/null +++ b/queue-6.18/net-wwan-mhi-add-network-support-for-foxconn-t99w760.patch @@ -0,0 +1,38 @@ +From c7e68af6df1277395f3af1eaf18f9ad81d9e99a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 10:26:46 +0800 +Subject: net: wwan: mhi: Add network support for Foxconn T99W760 + +From: Slark Xiao + +[ Upstream commit 915a5f60ad947e8dd515d2cc77a96a14dffb3f15 ] + +T99W760 is designed based on Qualcomm SDX35 chip. It use similar +architecture with SDX72/SDX75 chip. So we need to assign initial +link id for this device to make sure network available. + +Signed-off-by: Slark Xiao +Link: https://patch.msgid.link/20260105022646.10630-1-slark_xiao@163.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/wwan/mhi_wwan_mbim.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wwan/mhi_wwan_mbim.c b/drivers/net/wwan/mhi_wwan_mbim.c +index f8bc9a39bfa30..1d7e3ad900c12 100644 +--- a/drivers/net/wwan/mhi_wwan_mbim.c ++++ b/drivers/net/wwan/mhi_wwan_mbim.c +@@ -98,7 +98,8 @@ static struct mhi_mbim_link *mhi_mbim_get_link_rcu(struct mhi_mbim_context *mbim + static int mhi_mbim_get_link_mux_id(struct mhi_controller *cntrl) + { + if (strcmp(cntrl->name, "foxconn-dw5934e") == 0 || +- strcmp(cntrl->name, "foxconn-t99w640") == 0) ++ strcmp(cntrl->name, "foxconn-t99w640") == 0 || ++ strcmp(cntrl->name, "foxconn-t99w760") == 0) + return WDS_BIND_MUX_DATA_PORT_MUX_ID; + + return 0; +-- +2.51.0 + diff --git a/queue-6.18/netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch b/queue-6.18/netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch new file mode 100644 index 00000000000..87131c2b965 --- /dev/null +++ b/queue-6.18/netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch @@ -0,0 +1,41 @@ +From 77072fd573b91547438697899b975207278b08b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Dec 2025 20:53:51 +0900 +Subject: netfilter: nf_conntrack: Add allow_clash to generic protocol handler + +From: Yuto Hamaguchi + +[ Upstream commit 8a49fc8d8a3e83dc51ec05bcd4007bdea3c56eec ] + +The upstream commit, 71d8c47fc653711c41bc3282e5b0e605b3727956 + ("netfilter: conntrack: introduce clash resolution on insertion race"), +sets allow_clash=true in the UDP/UDPLITE protocol handler +but does not set it in the generic protocol handler. + +As a result, packets composed of connectionless protocols at each layer, +such as UDP over IP-in-IP, still drop packets due to conflicts during conntrack insertion. + +To resolve this, this patch sets allow_clash in the nf_conntrack_l4proto_generic. + +Signed-off-by: Yuto Hamaguchi +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_proto_generic.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c +index e831637bc8ca8..cb260eb3d012c 100644 +--- a/net/netfilter/nf_conntrack_proto_generic.c ++++ b/net/netfilter/nf_conntrack_proto_generic.c +@@ -67,6 +67,7 @@ void nf_conntrack_generic_init_net(struct net *net) + const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic = + { + .l4proto = 255, ++ .allow_clash = true, + #ifdef CONFIG_NF_CONNTRACK_TIMEOUT + .ctnl_timeout = { + .nlattr_to_obj = generic_timeout_nlattr_to_obj, +-- +2.51.0 + diff --git a/queue-6.18/netfilter-xt_tcpmss-check-remaining-length-before-re.patch b/queue-6.18/netfilter-xt_tcpmss-check-remaining-length-before-re.patch new file mode 100644 index 00000000000..094690930e1 --- /dev/null +++ b/queue-6.18/netfilter-xt_tcpmss-check-remaining-length-before-re.patch @@ -0,0 +1,42 @@ +From a4a9cfaa4ae8bc70259012650750b1b7f4a7172a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 12:30:42 +0100 +Subject: netfilter: xt_tcpmss: check remaining length before reading optlen + +From: Florian Westphal + +[ Upstream commit 735ee8582da3d239eb0c7a53adca61b79fb228b3 ] + +Quoting reporter: + In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads + op[i+1] directly without validating the remaining option length. + + If the last byte of the option field is not EOL/NOP (0/1), the code attempts + to index op[i+1]. In the case where i + 1 == optlen, this causes an + out-of-bounds read, accessing memory past the optlen boundary + (either reading beyond the stack buffer _opt or the + following payload). + +Reported-by: sungzii +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/xt_tcpmss.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c +index 37704ab017992..0d32d4841cb32 100644 +--- a/net/netfilter/xt_tcpmss.c ++++ b/net/netfilter/xt_tcpmss.c +@@ -61,7 +61,7 @@ tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par) + return (mssval >= info->mss_min && + mssval <= info->mss_max) ^ info->invert; + } +- if (op[i] < 2) ++ if (op[i] < 2 || i == optlen - 1) + i++; + else + i += op[i+1] ? : 1; +-- +2.51.0 + diff --git a/queue-6.18/netfs-when-subreq-is-marked-for-retry-do-not-check-i.patch b/queue-6.18/netfs-when-subreq-is-marked-for-retry-do-not-check-i.patch new file mode 100644 index 00000000000..6fec666a407 --- /dev/null +++ b/queue-6.18/netfs-when-subreq-is-marked-for-retry-do-not-check-i.patch @@ -0,0 +1,114 @@ +From a6848d32e66e9f00fedcc718a5688be0024a735b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Jan 2026 14:03:04 +0530 +Subject: netfs: when subreq is marked for retry, do not check if it faced an + error + +From: Shyam Prasad N + +[ Upstream commit 82e8885bd7633a36ee9050e6d7f348a4155eed5f ] + +The *_subreq_terminated functions today only process the NEED_RETRY +flag when the subreq was successful or failed with EAGAIN error. +However, there could be other retriable errors for network filesystems. + +Avoid this by processing the NEED_RETRY irrespective of the error +code faced by the subreq. If it was specifically marked for retry, +the error code must not matter. + +Acked-by: David Howells +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/netfs/read_collect.c | 10 ++++++++++ + fs/netfs/read_retry.c | 4 ++-- + fs/netfs/write_collect.c | 8 ++++---- + fs/netfs/write_issue.c | 1 + + 4 files changed, 17 insertions(+), 6 deletions(-) + +diff --git a/fs/netfs/read_collect.c b/fs/netfs/read_collect.c +index 7a0ffa675fb17..137f0e28a44c5 100644 +--- a/fs/netfs/read_collect.c ++++ b/fs/netfs/read_collect.c +@@ -546,6 +546,15 @@ void netfs_read_subreq_terminated(struct netfs_io_subrequest *subreq) + } + } + ++ /* If need retry is set, error should not matter unless we hit too many ++ * retries. Pause the generation of new subreqs ++ */ ++ if (test_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags)) { ++ trace_netfs_rreq(rreq, netfs_rreq_trace_set_pause); ++ set_bit(NETFS_RREQ_PAUSE, &rreq->flags); ++ goto skip_error_checks; ++ } ++ + if (unlikely(subreq->error < 0)) { + trace_netfs_failure(rreq, subreq, subreq->error, netfs_fail_read); + if (subreq->source == NETFS_READ_FROM_CACHE) { +@@ -559,6 +568,7 @@ void netfs_read_subreq_terminated(struct netfs_io_subrequest *subreq) + set_bit(NETFS_RREQ_PAUSE, &rreq->flags); + } + ++skip_error_checks: + trace_netfs_sreq(subreq, netfs_sreq_trace_terminated); + netfs_subreq_clear_in_progress(subreq); + netfs_put_subrequest(subreq, netfs_sreq_trace_put_terminated); +diff --git a/fs/netfs/read_retry.c b/fs/netfs/read_retry.c +index b99e84a8170af..7793ba5e3e8fc 100644 +--- a/fs/netfs/read_retry.c ++++ b/fs/netfs/read_retry.c +@@ -12,6 +12,7 @@ + static void netfs_reissue_read(struct netfs_io_request *rreq, + struct netfs_io_subrequest *subreq) + { ++ subreq->error = 0; + __clear_bit(NETFS_SREQ_MADE_PROGRESS, &subreq->flags); + __set_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags); + netfs_stat(&netfs_n_rh_retry_read_subreq); +@@ -242,8 +243,7 @@ static void netfs_retry_read_subrequests(struct netfs_io_request *rreq) + subreq = list_next_entry(subreq, rreq_link); + abandon: + list_for_each_entry_from(subreq, &stream->subrequests, rreq_link) { +- if (!subreq->error && +- !test_bit(NETFS_SREQ_FAILED, &subreq->flags) && ++ if (!test_bit(NETFS_SREQ_FAILED, &subreq->flags) && + !test_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags)) + continue; + subreq->error = -ENOMEM; +diff --git a/fs/netfs/write_collect.c b/fs/netfs/write_collect.c +index cbf3d9194c7bf..61eab34ea67ef 100644 +--- a/fs/netfs/write_collect.c ++++ b/fs/netfs/write_collect.c +@@ -492,11 +492,11 @@ void netfs_write_subrequest_terminated(void *_op, ssize_t transferred_or_error) + + if (IS_ERR_VALUE(transferred_or_error)) { + subreq->error = transferred_or_error; +- if (subreq->error == -EAGAIN) +- set_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags); +- else ++ /* if need retry is set, error should not matter */ ++ if (!test_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags)) { + set_bit(NETFS_SREQ_FAILED, &subreq->flags); +- trace_netfs_failure(wreq, subreq, transferred_or_error, netfs_fail_write); ++ trace_netfs_failure(wreq, subreq, transferred_or_error, netfs_fail_write); ++ } + + switch (subreq->source) { + case NETFS_WRITE_TO_CACHE: +diff --git a/fs/netfs/write_issue.c b/fs/netfs/write_issue.c +index dd8743bc8d7fe..34894da5a23ec 100644 +--- a/fs/netfs/write_issue.c ++++ b/fs/netfs/write_issue.c +@@ -250,6 +250,7 @@ void netfs_reissue_write(struct netfs_io_stream *stream, + iov_iter_truncate(&subreq->io_iter, size); + + subreq->retry_count++; ++ subreq->error = 0; + __clear_bit(NETFS_SREQ_MADE_PROGRESS, &subreq->flags); + __set_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags); + netfs_stat(&netfs_n_wh_retry_write_subreq); +-- +2.51.0 + diff --git a/queue-6.18/nfc-nxp-nci-remove-interrupt-trigger-type.patch b/queue-6.18/nfc-nxp-nci-remove-interrupt-trigger-type.patch new file mode 100644 index 00000000000..b3f59bb4279 --- /dev/null +++ b/queue-6.18/nfc-nxp-nci-remove-interrupt-trigger-type.patch @@ -0,0 +1,42 @@ +From 95a6108176a411b77b4828dad297d15e78723adb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Feb 2026 19:11:39 +0800 +Subject: nfc: nxp-nci: remove interrupt trigger type + +From: Carl Lee + +[ Upstream commit 57be33f85e369ce9f69f61eaa34734e0d3bd47a7 ] + +For NXP NCI devices (e.g. PN7150), the interrupt is level-triggered and +active high, not edge-triggered. + +Using IRQF_TRIGGER_RISING in the driver can cause interrupts to fail +to trigger correctly. + +Remove IRQF_TRIGGER_RISING and rely on the IRQ trigger type configured +via Device Tree. + +Signed-off-by: Carl Lee +Link: https://patch.msgid.link/20260205-fc-nxp-nci-remove-interrupt-trigger-type-v2-1-79d2ed4a7e42@amd.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/nfc/nxp-nci/i2c.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c +index 049662ffdf972..6a5ce8ff91f0b 100644 +--- a/drivers/nfc/nxp-nci/i2c.c ++++ b/drivers/nfc/nxp-nci/i2c.c +@@ -305,7 +305,7 @@ static int nxp_nci_i2c_probe(struct i2c_client *client) + + r = request_threaded_irq(client->irq, NULL, + nxp_nci_i2c_irq_thread_fn, +- IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ IRQF_ONESHOT, + NXP_NCI_I2C_DRIVER_NAME, phy); + if (r < 0) + nfc_err(&client->dev, "Unable to register IRQ handler\n"); +-- +2.51.0 + diff --git a/queue-6.18/ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch b/queue-6.18/ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch new file mode 100644 index 00000000000..52835efa293 --- /dev/null +++ b/queue-6.18/ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch @@ -0,0 +1,40 @@ +From 4855979c7a8dbc26dcaaf4d32553e4dfc31dd7b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2025 14:53:18 -0800 +Subject: ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access + +From: Maciej Grochowski + +[ Upstream commit c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface ] + +Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS, +This patch protects against invalid index out of bounds access to mw_sizes +When invalid access print message to user that configuration is not valid. + +Signed-off-by: Maciej Grochowski +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +index f851397b65d6e..f15ebab138144 100644 +--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c ++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +@@ -1314,6 +1314,12 @@ static void switchtec_ntb_init_shared(struct switchtec_ntb *sndev) + for (i = 0; i < sndev->nr_lut_mw; i++) { + int idx = sndev->nr_direct_mw + i; + ++ if (idx >= MAX_MWS) { ++ dev_err(&sndev->stdev->dev, ++ "Total number of MW cannot be bigger than %d", MAX_MWS); ++ break; ++ } ++ + sndev->self_shared->mw_sizes[idx] = LUT_SIZE; + } + } +-- +2.51.0 + diff --git a/queue-6.18/ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch b/queue-6.18/ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch new file mode 100644 index 00000000000..bd152799e8d --- /dev/null +++ b/queue-6.18/ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch @@ -0,0 +1,48 @@ +From 0b125a09384f70d45ac1790839eff2aa1c5f7031 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2025 14:53:17 -0800 +Subject: ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut + +From: Maciej Grochowski + +[ Upstream commit 186615f8855a0be4ee7d3fcd09a8ecc10e783b08 ] + +Number of MW LUTs depends on NTB configuration and can be set to zero, +in such scenario rounddown_pow_of_two will cause undefined behaviour and +should not be performed. +This patch ensures that rounddown_pow_of_two is called on valid value. + +Signed-off-by: Maciej Grochowski +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +index f15ebab138144..0536521fa6ccc 100644 +--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c ++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +@@ -1202,7 +1202,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev) + sndev->mmio_self_ctrl); + + sndev->nr_lut_mw = ioread16(&sndev->mmio_self_ctrl->lut_table_entries); +- sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw); ++ if (sndev->nr_lut_mw) ++ sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw); + + dev_dbg(&sndev->stdev->dev, "MWs: %d direct, %d lut\n", + sndev->nr_direct_mw, sndev->nr_lut_mw); +@@ -1212,7 +1213,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev) + + sndev->peer_nr_lut_mw = + ioread16(&sndev->mmio_peer_ctrl->lut_table_entries); +- sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw); ++ if (sndev->peer_nr_lut_mw) ++ sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw); + + dev_dbg(&sndev->stdev->dev, "Peer MWs: %d direct, %d lut\n", + sndev->peer_nr_direct_mw, sndev->peer_nr_lut_mw); +-- +2.51.0 + diff --git a/queue-6.18/ntfs-d_compare-must-not-block.patch b/queue-6.18/ntfs-d_compare-must-not-block.patch new file mode 100644 index 00000000000..82d408254b2 --- /dev/null +++ b/queue-6.18/ntfs-d_compare-must-not-block.patch @@ -0,0 +1,235 @@ +From 2a752bf3d59f3fbeb083a73464ad433c23a044df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 16:15:04 -0500 +Subject: ntfs: ->d_compare() must not block + +From: Al Viro + +[ Upstream commit ca2a04e84af79596e5cd9cfe697d5122ec39c8ce ] + +... so don't use __getname() there. Switch it (and ntfs_d_hash(), while +we are at it) to kmalloc(PATH_MAX, GFP_NOWAIT). Yes, ntfs_d_hash() +almost certainly can do with smaller allocations, but let ntfs folks +deal with that - keep the allocation size as-is for now. + +Stop abusing names_cachep in ntfs, period - various uses of that thing +in there have nothing to do with pathnames; just use k[mz]alloc() and +be done with that. For now let's keep sizes as-in, but AFAICS none of +the users actually want PATH_MAX. + +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + fs/ntfs3/dir.c | 5 ++--- + fs/ntfs3/fsntfs.c | 4 ++-- + fs/ntfs3/inode.c | 13 ++++++------- + fs/ntfs3/namei.c | 17 ++++++++--------- + fs/ntfs3/xattr.c | 5 ++--- + 5 files changed, 20 insertions(+), 24 deletions(-) + +diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c +index 1b5c865a0339a..460df046482c7 100644 +--- a/fs/ntfs3/dir.c ++++ b/fs/ntfs3/dir.c +@@ -424,8 +424,7 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx) + if (!dir_emit_dots(file, ctx)) + return 0; + +- /* Allocate PATH_MAX bytes. */ +- name = __getname(); ++ name = kmalloc(PATH_MAX, GFP_KERNEL); + if (!name) + return -ENOMEM; + +@@ -503,7 +502,7 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx) + + out: + +- __putname(name); ++ kfree(name); + put_indx_node(node); + + if (err == 1) { +diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c +index 5ae910e9ecbda..ef0177b5c6cb0 100644 +--- a/fs/ntfs3/fsntfs.c ++++ b/fs/ntfs3/fsntfs.c +@@ -2640,7 +2640,7 @@ int ntfs_set_label(struct ntfs_sb_info *sbi, u8 *label, int len) + u32 uni_bytes; + struct ntfs_inode *ni = sbi->volume.ni; + /* Allocate PATH_MAX bytes. */ +- struct cpu_str *uni = __getname(); ++ struct cpu_str *uni = kmalloc(PATH_MAX, GFP_KERNEL); + + if (!uni) + return -ENOMEM; +@@ -2684,6 +2684,6 @@ int ntfs_set_label(struct ntfs_sb_info *sbi, u8 *label, int len) + err = _ni_write_inode(&ni->vfs_inode, 0); + + out: +- __putname(uni); ++ kfree(uni); + return err; + } +diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c +index 164fd63dff40d..205baa791f998 100644 +--- a/fs/ntfs3/inode.c ++++ b/fs/ntfs3/inode.c +@@ -1279,7 +1279,7 @@ int ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir, + fa |= FILE_ATTRIBUTE_READONLY; + + /* Allocate PATH_MAX bytes. */ +- new_de = kmem_cache_zalloc(names_cachep, GFP_KERNEL); ++ new_de = kzalloc(PATH_MAX, GFP_KERNEL); + if (!new_de) { + err = -ENOMEM; + goto out1; +@@ -1699,7 +1699,7 @@ int ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir, + ntfs_mark_rec_free(sbi, ino, false); + + out2: +- __putname(new_de); ++ kfree(new_de); + kfree(rp); + + out1: +@@ -1720,7 +1720,7 @@ int ntfs_link_inode(struct inode *inode, struct dentry *dentry) + struct NTFS_DE *de; + + /* Allocate PATH_MAX bytes. */ +- de = kmem_cache_zalloc(names_cachep, GFP_KERNEL); ++ de = kzalloc(PATH_MAX, GFP_KERNEL); + if (!de) + return -ENOMEM; + +@@ -1734,7 +1734,7 @@ int ntfs_link_inode(struct inode *inode, struct dentry *dentry) + + err = ni_add_name(ntfs_i(d_inode(dentry->d_parent)), ni, de); + out: +- __putname(de); ++ kfree(de); + return err; + } + +@@ -1757,8 +1757,7 @@ int ntfs_unlink_inode(struct inode *dir, const struct dentry *dentry) + if (ntfs_is_meta_file(sbi, ni->mi.rno)) + return -EINVAL; + +- /* Allocate PATH_MAX bytes. */ +- de = kmem_cache_zalloc(names_cachep, GFP_KERNEL); ++ de = kzalloc(PATH_MAX, GFP_KERNEL); + if (!de) + return -ENOMEM; + +@@ -1794,7 +1793,7 @@ int ntfs_unlink_inode(struct inode *dir, const struct dentry *dentry) + + out: + ni_unlock(ni); +- __putname(de); ++ kfree(de); + return err; + } + +diff --git a/fs/ntfs3/namei.c b/fs/ntfs3/namei.c +index 82c8ae56beee6..612923d93f4dc 100644 +--- a/fs/ntfs3/namei.c ++++ b/fs/ntfs3/namei.c +@@ -68,7 +68,7 @@ static struct dentry *ntfs_lookup(struct inode *dir, struct dentry *dentry, + u32 flags) + { + struct ntfs_inode *ni = ntfs_i(dir); +- struct cpu_str *uni = __getname(); ++ struct cpu_str *uni = kmalloc(PATH_MAX, GFP_KERNEL); + struct inode *inode; + int err; + +@@ -85,7 +85,7 @@ static struct dentry *ntfs_lookup(struct inode *dir, struct dentry *dentry, + inode = dir_search_u(dir, uni, NULL); + ni_unlock(ni); + } +- __putname(uni); ++ kfree(uni); + } + + /* +@@ -303,8 +303,7 @@ static int ntfs_rename(struct mnt_idmap *idmap, struct inode *dir, + return err; + } + +- /* Allocate PATH_MAX bytes. */ +- de = __getname(); ++ de = kmalloc(PATH_MAX, GFP_KERNEL); + if (!de) + return -ENOMEM; + +@@ -349,7 +348,7 @@ static int ntfs_rename(struct mnt_idmap *idmap, struct inode *dir, + ni_unlock(ni); + ni_unlock(dir_ni); + out: +- __putname(de); ++ kfree(de); + return err; + } + +@@ -407,7 +406,7 @@ static int ntfs_d_hash(const struct dentry *dentry, struct qstr *name) + /* + * Try slow way with current upcase table + */ +- uni = kmem_cache_alloc(names_cachep, GFP_NOWAIT); ++ uni = kmalloc(PATH_MAX, GFP_NOWAIT); + if (!uni) + return -ENOMEM; + +@@ -429,7 +428,7 @@ static int ntfs_d_hash(const struct dentry *dentry, struct qstr *name) + err = 0; + + out: +- kmem_cache_free(names_cachep, uni); ++ kfree(uni); + return err; + } + +@@ -468,7 +467,7 @@ static int ntfs_d_compare(const struct dentry *dentry, unsigned int len1, + * Try slow way with current upcase table + */ + sbi = dentry->d_sb->s_fs_info; +- uni1 = __getname(); ++ uni1 = kmalloc(PATH_MAX, GFP_NOWAIT); + if (!uni1) + return -ENOMEM; + +@@ -498,7 +497,7 @@ static int ntfs_d_compare(const struct dentry *dentry, unsigned int len1, + ret = !ntfs_cmp_names_cpu(uni1, uni2, sbi->upcase, false) ? 0 : 1; + + out: +- __putname(uni1); ++ kfree(uni1); + return ret; + } + +diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c +index e519e21596a70..142ecb3847e59 100644 +--- a/fs/ntfs3/xattr.c ++++ b/fs/ntfs3/xattr.c +@@ -556,8 +556,7 @@ struct posix_acl *ntfs_get_acl(struct mnt_idmap *idmap, struct dentry *dentry, + if (unlikely(is_bad_ni(ni))) + return ERR_PTR(-EINVAL); + +- /* Allocate PATH_MAX bytes. */ +- buf = __getname(); ++ buf = kmalloc(PATH_MAX, GFP_KERNEL); + if (!buf) + return ERR_PTR(-ENOMEM); + +@@ -588,7 +587,7 @@ struct posix_acl *ntfs_get_acl(struct mnt_idmap *idmap, struct dentry *dentry, + if (!IS_ERR(acl)) + set_cached_acl(inode, type, acl); + +- __putname(buf); ++ kfree(buf); + + return acl; + } +-- +2.51.0 + diff --git a/queue-6.18/ntfs3-fix-circular-locking-dependency-in-run_unpack_.patch b/queue-6.18/ntfs3-fix-circular-locking-dependency-in-run_unpack_.patch new file mode 100644 index 00000000000..36eaefb3841 --- /dev/null +++ b/queue-6.18/ntfs3-fix-circular-locking-dependency-in-run_unpack_.patch @@ -0,0 +1,62 @@ +From b3d7865bff31f02fc8cbef47e6790f46ec64ec6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Dec 2025 15:43:07 +0100 +Subject: ntfs3: fix circular locking dependency in run_unpack_ex + +From: Szymon Wilczek + +[ Upstream commit 08ce2fee1b869ecbfbd94e0eb2630e52203a2e03 ] + +Syzbot reported a circular locking dependency between wnd->rw_lock +(sbi->used.bitmap) and ni->file.run_lock. + +The deadlock scenario: +1. ntfs_extend_mft() takes ni->file.run_lock then wnd->rw_lock. +2. run_unpack_ex() takes wnd->rw_lock then tries to acquire + ni->file.run_lock inside ntfs_refresh_zone(). + +This creates an AB-BA deadlock. + +Fix this by using down_read_trylock() instead of down_read() when +acquiring run_lock in run_unpack_ex(). If the lock is contended, +skip ntfs_refresh_zone() - the MFT zone will be refreshed on the +next MFT operation. This breaks the circular dependency since we +never block waiting for run_lock while holding wnd->rw_lock. + +Reported-by: syzbot+d27edf9f96ae85939222@syzkaller.appspotmail.com +Tested-by: syzbot+d27edf9f96ae85939222@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=d27edf9f96ae85939222 +Signed-off-by: Szymon Wilczek +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/run.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c +index 5df55e4adbb11..21decc2922823 100644 +--- a/fs/ntfs3/run.c ++++ b/fs/ntfs3/run.c +@@ -1124,11 +1124,14 @@ int run_unpack_ex(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, + struct rw_semaphore *lock = + is_mounted(sbi) ? &sbi->mft.ni->file.run_lock : + NULL; +- if (lock) +- down_read(lock); +- ntfs_refresh_zone(sbi); +- if (lock) +- up_read(lock); ++ if (lock) { ++ if (down_read_trylock(lock)) { ++ ntfs_refresh_zone(sbi); ++ up_read(lock); ++ } ++ } else { ++ ntfs_refresh_zone(sbi); ++ } + } + up_write(&wnd->rw_lock); + if (err) +-- +2.51.0 + diff --git a/queue-6.18/octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch b/queue-6.18/octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch new file mode 100644 index 00000000000..bd2af07d3d5 --- /dev/null +++ b/queue-6.18/octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch @@ -0,0 +1,69 @@ +From 7521bb2b2e36c8607e03ed068d09c4f538f804f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 18:21:47 +0530 +Subject: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geetha sowjanya + +[ Upstream commit 70e9a5760abfb6338d63994d4de6b0778ec795d6 ] + +NIX SQ manager sticky mode is known to cause stalls when multiple SQs +share an SMQ and transmit concurrently. Additionally, PSE may deadlock +on transitions between sticky and non-sticky transmissions. There is +also a credit drop issue observed when certain condition clocks are +gated. + +work around these hardware errata by: +- Disabling SQM sticky operation: + - Clear TM6 (bit 15) + - Clear TM11 (bit 14) +- Disabling sticky → non-sticky transition path that can deadlock PSE: + - Clear TM5 (bit 23) +- Preventing credit drops by keeping the control-flow clock enabled: + - Set TM9 (bit 21) + +These changes are applied via NIX_AF_SQM_DBG_CTL_STATUS. With this +configuration the SQM/PSE maintain forward progress under load without +credit loss, at the cost of disabling sticky optimizations. + +Signed-off-by: Geetha sowjanya +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260127125147.1642-1-gakula@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +index 828316211b245..c9c65ac69ead8 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +@@ -4932,12 +4932,18 @@ static int rvu_nix_block_init(struct rvu *rvu, struct nix_hw *nix_hw) + /* Set chan/link to backpressure TL3 instead of TL2 */ + rvu_write64(rvu, blkaddr, NIX_AF_PSE_CHANNEL_LEVEL, 0x01); + +- /* Disable SQ manager's sticky mode operation (set TM6 = 0) ++ /* Disable SQ manager's sticky mode operation (set TM6 = 0, TM11 = 0) + * This sticky mode is known to cause SQ stalls when multiple +- * SQs are mapped to same SMQ and transmitting pkts at a time. ++ * SQs are mapped to same SMQ and transmitting pkts simultaneously. ++ * NIX PSE may deadlock when there are any sticky to non-sticky ++ * transmission. Hence disable it (TM5 = 0). + */ + cfg = rvu_read64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS); +- cfg &= ~BIT_ULL(15); ++ cfg &= ~(BIT_ULL(15) | BIT_ULL(14) | BIT_ULL(23)); ++ /* NIX may drop credits when condition clocks are turned off. ++ * Hence enable control flow clk (set TM9 = 1). ++ */ ++ cfg |= BIT_ULL(21); + rvu_write64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS, cfg); + + ltdefs = rvu->kpu.lt_def; +-- +2.51.0 + diff --git a/queue-6.18/openrisc-define-arch-specific-version-of-nop.patch b/queue-6.18/openrisc-define-arch-specific-version-of-nop.patch new file mode 100644 index 00000000000..a7821617373 --- /dev/null +++ b/queue-6.18/openrisc-define-arch-specific-version-of-nop.patch @@ -0,0 +1,53 @@ +From a6e9d0d0446cb080590a657e6485936926af6c1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 12:07:23 -0500 +Subject: openrisc: define arch-specific version of nop() + +From: Brian Masney + +[ Upstream commit 0dfffa5479d6260d04d021f69203b1926f73d889 ] + +When compiling a driver written for MIPS on OpenRISC that uses the nop() +function, it fails due to the following error: + + drivers/watchdog/pic32-wdt.c: Assembler messages: + drivers/watchdog/pic32-wdt.c:125: Error: unrecognized instruction `nop' + +The driver currently uses the generic version of nop() from +include/asm-generic/barrier.h: + + #ifndef nop + #define nop() asm volatile ("nop") + #endif + +Let's fix this on OpenRISC by defining an architecture-specific version +of nop(). + +This was tested by performing an allmodconfig openrisc cross compile on +an aarch64 host. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202601180236.BVy480We-lkp@intel.com/ +Signed-off-by: Brian Masney +Signed-off-by: Stafford Horne +Signed-off-by: Sasha Levin +--- + arch/openrisc/include/asm/barrier.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h +index 7538294721bed..8e592c9909023 100644 +--- a/arch/openrisc/include/asm/barrier.h ++++ b/arch/openrisc/include/asm/barrier.h +@@ -4,6 +4,8 @@ + + #define mb() asm volatile ("l.msync" ::: "memory") + ++#define nop() asm volatile ("l.nop") ++ + #include + + #endif /* __ASM_BARRIER_H */ +-- +2.51.0 + diff --git a/queue-6.18/parisc-prevent-interrupts-during-reboot.patch b/queue-6.18/parisc-prevent-interrupts-during-reboot.patch new file mode 100644 index 00000000000..03e29ca3338 --- /dev/null +++ b/queue-6.18/parisc-prevent-interrupts-during-reboot.patch @@ -0,0 +1,32 @@ +From 345f2c6acd2077d9b0149c8b2116d2194660cdb8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 17:58:55 +0100 +Subject: parisc: Prevent interrupts during reboot + +From: Helge Deller + +[ Upstream commit 35ac5a728c878594f2ea6c43b57652a16be3c968 ] + +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/kernel/process.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c +index e64ab5d2a40d6..703644e5bfc4a 100644 +--- a/arch/parisc/kernel/process.c ++++ b/arch/parisc/kernel/process.c +@@ -85,6 +85,9 @@ void machine_restart(char *cmd) + #endif + /* set up a new led state on systems shipped with a LED State panel */ + pdc_chassis_send_status(PDC_CHASSIS_DIRECT_SHUTDOWN); ++ ++ /* prevent interrupts during reboot */ ++ set_eiem(0); + + /* "Normal" system reset */ + pdc_do_reset(); +-- +2.51.0 + diff --git a/queue-6.18/pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch b/queue-6.18/pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch new file mode 100644 index 00000000000..219538e34ca --- /dev/null +++ b/queue-6.18/pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch @@ -0,0 +1,41 @@ +From fe48312756fd8565222a71cf5c03f5221c6d91ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jan 2026 13:53:32 +0530 +Subject: PCI: Add ACS quirk for Qualcomm Hamoa & Glymur + +From: Krishna Chaitanya Chundru + +[ Upstream commit 44d2f70b1fd72c339c72983fcffa181beae3e113 ] + +The Qualcomm Hamoa & Glymur Root Ports don't advertise an ACS capability, +but they do provide ACS-like features to disable peer transactions and +validate bus numbers in requests. + +Add an ACS quirk for Hamoa & Glymur. + +Signed-off-by: Krishna Chaitanya Chundru +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20260109-acs_quirk-v1-1-82adf95a89ae@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index c38434d973cd2..62554152caf37 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -5117,6 +5117,10 @@ static const struct pci_dev_acs_enabled { + { PCI_VENDOR_ID_QCOM, 0x0401, pci_quirk_qcom_rp_acs }, + /* QCOM SA8775P root port */ + { PCI_VENDOR_ID_QCOM, 0x0115, pci_quirk_qcom_rp_acs }, ++ /* QCOM Hamoa root port */ ++ { PCI_VENDOR_ID_QCOM, 0x0111, pci_quirk_qcom_rp_acs }, ++ /* QCOM Glymur root port */ ++ { PCI_VENDOR_ID_QCOM, 0x0120, pci_quirk_qcom_rp_acs }, + /* HXT SD4800 root ports. The ACS design is same as QCOM QDF2xxx */ + { PCI_VENDOR_ID_HXT, 0x0401, pci_quirk_qcom_rp_acs }, + /* Intel PCH root ports */ +-- +2.51.0 + diff --git a/queue-6.18/pci-add-intel-nova-lake-audio-device-id.patch b/queue-6.18/pci-add-intel-nova-lake-audio-device-id.patch new file mode 100644 index 00000000000..0d6c231788d --- /dev/null +++ b/queue-6.18/pci-add-intel-nova-lake-audio-device-id.patch @@ -0,0 +1,42 @@ +From e160b0ccac93ca1799eb003140417d01c5bb5437 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 21:35:04 +0200 +Subject: PCI: Add Intel Nova Lake audio Device ID + +From: Peter Ujfalusi + +[ Upstream commit b190870e0e0cfb375c0d4da02761c32083f3644d ] + +Add Nova Lake (NVL) audio Device ID + +The ID will be used by HDA legacy, SOF audio stack and the driver +to determine which audio stack should be used (intel-dsp-config). + +Signed-off-by: Peter Ujfalusi +Reviewed-by: Kai Vehmanen +Reviewed-by: Liam Girdwood +Reviewed-by: Ranjani Sridharan +Acked-by: Bjorn Helgaas +Acked-by: Takashi Iwai +Link: https://patch.msgid.link/20260120193507.14019-2-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + include/linux/pci_ids.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h +index 92ffc4373f6de..03b7c0380f71c 100644 +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -3142,6 +3142,7 @@ + #define PCI_DEVICE_ID_INTEL_HDA_CML_S 0xa3f0 + #define PCI_DEVICE_ID_INTEL_HDA_LNL_P 0xa828 + #define PCI_DEVICE_ID_INTEL_S21152BB 0xb152 ++#define PCI_DEVICE_ID_INTEL_HDA_NVL 0xd328 + #define PCI_DEVICE_ID_INTEL_HDA_BMG 0xe2f7 + #define PCI_DEVICE_ID_INTEL_HDA_PTL_H 0xe328 + #define PCI_DEVICE_ID_INTEL_HDA_PTL 0xe428 +-- +2.51.0 + diff --git a/queue-6.18/pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch b/queue-6.18/pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch new file mode 100644 index 00000000000..0bb2757e732 --- /dev/null +++ b/queue-6.18/pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch @@ -0,0 +1,94 @@ +From 7cc6ca14a7735dd4d52dfc7732db5f55513e6074 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 10:25:51 +0100 +Subject: PCI/AER: Clear stale errors on reporting agents upon probe + +From: Lukas Wunner + +[ Upstream commit e242d09b58e869f86071b7889acace4cff215935 ] + +Correctable and Uncorrectable Error Status Registers on reporting agents +are cleared upon PCI device enumeration in pci_aer_init() to flush past +events. They're cleared again when an error is handled by the AER driver. + +If an agent reports a new error after pci_aer_init() and before the AER +driver has probed on the corresponding Root Port or Root Complex Event +Collector, that error is not handled by the AER driver: It clears the +Root Error Status Register on probe, but neglects to re-clear the +Correctable and Uncorrectable Error Status Registers on reporting agents. + +The error will eventually be reported when another error occurs. Which +is irritating because to an end user it appears as if the earlier error +has just happened. + +Amend the AER driver to clear stale errors on reporting agents upon probe. + +Skip reporting agents which have not invoked pci_aer_init() yet to avoid +using an uninitialized pdev->aer_cap. They're recognizable by the error +bits in the Device Control register still being clear. + +Reporting agents may execute pci_aer_init() after the AER driver has +probed, particularly when devices are hotplugged or removed/rescanned via +sysfs. For this reason, it continues to be necessary that pci_aer_init() +clears Correctable and Uncorrectable Error Status Registers. + +Reported-by: Lucas Van # off-list +Signed-off-by: Lukas Wunner +Signed-off-by: Bjorn Helgaas +Tested-by: Lucas Van +Reviewed-by: Kuppuswamy Sathyanarayanan +Link: https://patch.msgid.link/3011c2ed30c11f858e35e29939add754adea7478.1769332702.git.lukas@wunner.de +Signed-off-by: Sasha Levin +--- + drivers/pci/pcie/aer.c | 26 +++++++++++++++++++++++++- + 1 file changed, 25 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c +index 23bead9415fcd..29504173425cd 100644 +--- a/drivers/pci/pcie/aer.c ++++ b/drivers/pci/pcie/aer.c +@@ -1603,6 +1603,20 @@ static void aer_disable_irq(struct pci_dev *pdev) + pci_write_config_dword(pdev, aer + PCI_ERR_ROOT_COMMAND, reg32); + } + ++static int clear_status_iter(struct pci_dev *dev, void *data) ++{ ++ u16 devctl; ++ ++ /* Skip if pci_enable_pcie_error_reporting() hasn't been called yet */ ++ pcie_capability_read_word(dev, PCI_EXP_DEVCTL, &devctl); ++ if (!(devctl & PCI_EXP_AER_FLAGS)) ++ return 0; ++ ++ pci_aer_clear_status(dev); ++ pcie_clear_device_status(dev); ++ return 0; ++} ++ + /** + * aer_enable_rootport - enable Root Port's interrupts when receiving messages + * @rpc: pointer to a Root Port data structure +@@ -1624,9 +1638,19 @@ static void aer_enable_rootport(struct aer_rpc *rpc) + pcie_capability_clear_word(pdev, PCI_EXP_RTCTL, + SYSTEM_ERROR_INTR_ON_MESG_MASK); + +- /* Clear error status */ ++ /* Clear error status of this Root Port or RCEC */ + pci_read_config_dword(pdev, aer + PCI_ERR_ROOT_STATUS, ®32); + pci_write_config_dword(pdev, aer + PCI_ERR_ROOT_STATUS, reg32); ++ ++ /* Clear error status of agents reporting to this Root Port or RCEC */ ++ if (reg32 & AER_ERR_STATUS_MASK) { ++ if (pci_pcie_type(pdev) == PCI_EXP_TYPE_RC_EC) ++ pcie_walk_rcec(pdev, clear_status_iter, NULL); ++ else if (pdev->subordinate) ++ pci_walk_bus(pdev->subordinate, clear_status_iter, ++ NULL); ++ } ++ + pci_read_config_dword(pdev, aer + PCI_ERR_COR_STATUS, ®32); + pci_write_config_dword(pdev, aer + PCI_ERR_COR_STATUS, reg32); + pci_read_config_dword(pdev, aer + PCI_ERR_UNCOR_STATUS, ®32); +-- +2.51.0 + diff --git a/queue-6.18/pci-bwctrl-disable-bw-controller-on-intel-p45-using-.patch b/queue-6.18/pci-bwctrl-disable-bw-controller-on-intel-p45-using-.patch new file mode 100644 index 00000000000..8d8ac76008f --- /dev/null +++ b/queue-6.18/pci-bwctrl-disable-bw-controller-on-intel-p45-using-.patch @@ -0,0 +1,86 @@ +From 71f997e350fd7acc0e796a410c3084d5fe60242f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jan 2026 15:15:12 +0200 +Subject: PCI/bwctrl: Disable BW controller on Intel P45 using a quirk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 46a9f70e93ef73860d1dbbec75ef840031f8f30a ] + +The commit 665745f27487 ("PCI/bwctrl: Re-add BW notification portdrv as +PCIe BW controller") was found to lead to a boot hang on a Intel P45 +system. Testing without setting Link Bandwidth Management Interrupt Enable +(LBMIE) and Link Autonomous Bandwidth Interrupt Enable (LABIE) (PCIe r7.0, +sec 7.5.3.7) in bwctrl allowed system to come up. + +P45 is a very old chipset and supports only up to gen2 PCIe, so not having +bwctrl does not seem a huge deficiency. + +Add no_bw_notif in struct pci_dev and quirk Intel P45 Root Port with it. + +Reported-by: Adam Stylinski +Link: https://lore.kernel.org/linux-pci/aUCt1tHhm_-XIVvi@eggsbenedict/ +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Tested-by: Adam Stylinski +Link: https://patch.msgid.link/20260116131513.2359-1-ilpo.jarvinen@linux.intel.com +Signed-off-by: Sasha Levin +--- + drivers/pci/pcie/bwctrl.c | 3 +++ + drivers/pci/quirks.c | 10 ++++++++++ + include/linux/pci.h | 1 + + 3 files changed, 14 insertions(+) + +diff --git a/drivers/pci/pcie/bwctrl.c b/drivers/pci/pcie/bwctrl.c +index 36f939f23d34e..4ae92c9f912a8 100644 +--- a/drivers/pci/pcie/bwctrl.c ++++ b/drivers/pci/pcie/bwctrl.c +@@ -250,6 +250,9 @@ static int pcie_bwnotif_probe(struct pcie_device *srv) + struct pci_dev *port = srv->port; + int ret; + ++ if (port->no_bw_notif) ++ return -ENODEV; ++ + /* Can happen if we run out of bus numbers during enumeration. */ + if (!port->subordinate) + return -ENODEV; +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 3c7aebf3d238a..d32a47e81fcf3 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -1359,6 +1359,16 @@ static void quirk_transparent_bridge(struct pci_dev *dev) + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82380FB, quirk_transparent_bridge); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TOSHIBA, 0x605, quirk_transparent_bridge); + ++/* ++ * Enabling Link Bandwidth Management Interrupts (BW notifications) can cause ++ * boot hangs on P45. ++ */ ++static void quirk_p45_bw_notifications(struct pci_dev *dev) ++{ ++ dev->no_bw_notif = 1; ++} ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e21, quirk_p45_bw_notifications); ++ + /* + * Common misconfiguration of the MediaGX/Geode PCI master that will reduce + * PCI bandwidth from 70MB/s to 25MB/s. See the GXM/GXLV/GX1 datasheets +diff --git a/include/linux/pci.h b/include/linux/pci.h +index bf97d49c23cf5..05aeee8c8844a 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -406,6 +406,7 @@ struct pci_dev { + user sysfs */ + unsigned int clear_retrain_link:1; /* Need to clear Retrain Link + bit manually */ ++ unsigned int no_bw_notif:1; /* BW notifications may cause issues */ + unsigned int d3hot_delay; /* D3hot->D0 transition time in ms */ + unsigned int d3cold_delay; /* D3cold->D0 transition time in ms */ + +-- +2.51.0 + diff --git a/queue-6.18/pci-dw-rockchip-disable-bar-0-and-bar-1-for-root-por.patch b/queue-6.18/pci-dw-rockchip-disable-bar-0-and-bar-1-for-root-por.patch new file mode 100644 index 00000000000..2dde567c886 --- /dev/null +++ b/queue-6.18/pci-dw-rockchip-disable-bar-0-and-bar-1-for-root-por.patch @@ -0,0 +1,74 @@ +From 6768f0d1aa730575ee0631b8c6dfd6372b18c6cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Dec 2025 18:01:01 +0800 +Subject: PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port + +From: Shawn Lin + +[ Upstream commit b5d712e5b87fc56ff838684afb1bae359eb8069f ] + +Some Rockchip PCIe Root Ports report bogus size of 1GiB for the BAR +memories and they cause below resource allocation issue during probe. + + pci 0000:00:00.0: [1d87:3588] type 01 class 0x060400 PCIe Root Port + pci 0000:00:00.0: BAR 0 [mem 0x00000000-0x3fffffff] + pci 0000:00:00.0: BAR 1 [mem 0x00000000-0x3fffffff] + pci 0000:00:00.0: ROM [mem 0x00000000-0x0000ffff pref] + ... + pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: assigned + pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: can't assign; no space + pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: failed to assign + pci 0000:00:00.0: ROM [mem 0xf0200000-0xf020ffff pref]: assigned + pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: releasing + pci 0000:00:00.0: ROM [mem 0xf0200000-0xf020ffff pref]: releasing + pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: assigned + pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: can't assign; no space + pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: failed to assign + +Since there is no use of the Root Port BAR memories, disable both of them. + +Signed-off-by: Shawn Lin +[mani: reworded the description and comment] +Signed-off-by: Manivannan Sadhasivam +Link: https://patch.msgid.link/1766570461-138256-1-git-send-email-shawn.lin@rock-chips.com +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-dw-rockchip.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/pci/controller/dwc/pcie-dw-rockchip.c b/drivers/pci/controller/dwc/pcie-dw-rockchip.c +index 3e2752c7dd096..79e55b9833e4a 100644 +--- a/drivers/pci/controller/dwc/pcie-dw-rockchip.c ++++ b/drivers/pci/controller/dwc/pcie-dw-rockchip.c +@@ -74,6 +74,8 @@ + #define PCIE_LINKUP_MASK GENMASK(17, 16) + #define PCIE_LTSSM_STATUS_MASK GENMASK(5, 0) + ++#define PCIE_TYPE0_HDR_DBI2_OFFSET 0x100000 ++ + struct rockchip_pcie { + struct dw_pcie pci; + void __iomem *apb_base; +@@ -257,6 +259,8 @@ static int rockchip_pcie_host_init(struct dw_pcie_rp *pp) + if (irq < 0) + return irq; + ++ pci->dbi_base2 = pci->dbi_base + PCIE_TYPE0_HDR_DBI2_OFFSET; ++ + ret = rockchip_pcie_init_irq_domain(rockchip); + if (ret < 0) + dev_err(dev, "failed to init irq domain\n"); +@@ -266,6 +270,10 @@ static int rockchip_pcie_host_init(struct dw_pcie_rp *pp) + + rockchip_pcie_enable_l0s(pci); + ++ /* Disable Root Ports BAR0 and BAR1 as they report bogus size */ ++ dw_pcie_writel_dbi2(pci, PCI_BASE_ADDRESS_0, 0x0); ++ dw_pcie_writel_dbi2(pci, PCI_BASE_ADDRESS_1, 0x0); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.18/pci-dwc-skip-pme_turn_off-broadcast-and-l2-l3-transi.patch b/queue-6.18/pci-dwc-skip-pme_turn_off-broadcast-and-l2-l3-transi.patch new file mode 100644 index 00000000000..3fbd75a0fc9 --- /dev/null +++ b/queue-6.18/pci-dwc-skip-pme_turn_off-broadcast-and-l2-l3-transi.patch @@ -0,0 +1,53 @@ +From df344888ceea1b51bdbd346a379e24457e5d8ccb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Dec 2025 17:34:52 +0530 +Subject: PCI: dwc: Skip PME_Turn_Off broadcast and L2/L3 transition during + suspend if link is not up + +From: Manivannan Sadhasivam + +[ Upstream commit cfd2fdfd0a8da2e5bbfdc4009b9c4b8bf164c937 ] + +During system suspend, if the PCIe link is not up, then there is no need +to broadcast PME_Turn_Off message and wait for L2/L3 transition. So skip +them. + +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Manivannan Sadhasivam +Tested-by: Vincent Guittot +Reviewed-by: Frank Li +Reviewed-by: Shawn Lin +Link: https://patch.msgid.link/20251218-pci-dwc-suspend-rework-v2-1-5a7778c6094a@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-designware-host.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c +index e92513c5bda51..702885c53f467 100644 +--- a/drivers/pci/controller/dwc/pcie-designware-host.c ++++ b/drivers/pci/controller/dwc/pcie-designware-host.c +@@ -1146,8 +1146,11 @@ static int dw_pcie_pme_turn_off(struct dw_pcie *pci) + int dw_pcie_suspend_noirq(struct dw_pcie *pci) + { + u8 offset = dw_pcie_find_capability(pci, PCI_CAP_ID_EXP); ++ int ret = 0; + u32 val; +- int ret; ++ ++ if (!dw_pcie_link_up(pci)) ++ goto stop_link; + + /* + * If L1SS is supported, then do not put the link into L2 as some +@@ -1182,6 +1185,7 @@ int dw_pcie_suspend_noirq(struct dw_pcie *pci) + */ + udelay(1); + ++stop_link: + dw_pcie_stop_link(pci); + if (pci->pp.ops->deinit) + pci->pp.ops->deinit(&pci->pp); +-- +2.51.0 + diff --git a/queue-6.18/pci-enable-acs-after-configuring-iommu-for-of-platfo.patch b/queue-6.18/pci-enable-acs-after-configuring-iommu-for-of-platfo.patch new file mode 100644 index 00000000000..882471c4ac9 --- /dev/null +++ b/queue-6.18/pci-enable-acs-after-configuring-iommu-for-of-platfo.patch @@ -0,0 +1,136 @@ +From 168779b02226a6fe12e0ed3dd9d5389364b82414 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jan 2026 21:04:47 +0530 +Subject: PCI: Enable ACS after configuring IOMMU for OF platforms + +From: Manivannan Sadhasivam + +[ Upstream commit c41e2fb67e26b04d919257875fa954aa5f6e392e ] + +Platform, ACPI, or IOMMU drivers call pci_request_acs(), which sets +'pci_acs_enable' to request that ACS be enabled for any devices enumerated +in the future. + +OF platforms called pci_enable_acs() for the first device before +of_iommu_configure() called pci_request_acs(), so ACS was never enabled for +that device (typically a Root Port). + +Call pci_enable_acs() later, from pci_dma_configure(), after +of_dma_configure() has had a chance to call pci_request_acs(). + +Here's the call path, showing the move of pci_enable_acs() from +pci_acs_init() to pci_dma_configure(), where it always happens after +pci_request_acs(): + + pci_device_add + pci_init_capabilities + pci_acs_init + - pci_enable_acs + - if (pci_acs_enable) <-- previous test + - ... + device_add + bus_notify(BUS_NOTIFY_ADD_DEVICE) + iommu_bus_notifier + iommu_probe_device + iommu_init_device + dev->bus->dma_configure + pci_dma_configure # pci_bus_type.dma_configure + of_dma_configure + of_iommu_configure + pci_request_acs + pci_acs_enable = 1 <-- set + + pci_enable_acs + + if (pci_acs_enable) <-- new test + + ... + bus_probe_device + device_initial_probe + ... + really_probe + dev->bus->dma_configure + pci_dma_configure # pci_bus_type.dma_configure + ... + pci_enable_acs + +Note that we will now call pci_enable_acs() twice for every device, first +from the iommu_probe_device() path and again from the really_probe() path. +Presumably that's not an issue since we also call dev->bus->dma_configure() +twice. + +For the ACPI platforms, pci_request_acs() is called during ACPI +initialization time itself, independent of the IOMMU framework. + +Signed-off-by: Manivannan Sadhasivam +[bhelgaas: commit log] +Signed-off-by: Bjorn Helgaas +Tested-by: Marek Szyprowski +Tested-by: Naresh Kamboju +Link: https://patch.msgid.link/20260102-pci_acs-v3-1-72280b94d288@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/pci/pci-driver.c | 8 ++++++++ + drivers/pci/pci.c | 10 +--------- + drivers/pci/pci.h | 1 + + 3 files changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c +index 327b21c48614d..b4111c92c9572 100644 +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -1652,6 +1652,14 @@ static int pci_dma_configure(struct device *dev) + ret = acpi_dma_configure(dev, acpi_get_dma_attr(adev)); + } + ++ /* ++ * Attempt to enable ACS regardless of capability because some Root ++ * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have ++ * the standard ACS capability but still support ACS via those ++ * quirks. ++ */ ++ pci_enable_acs(to_pci_dev(dev)); ++ + pci_put_host_bridge_device(bridge); + + /* @drv may not be valid when we're called from the IOMMU layer */ +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 31d443f819a7c..d147e412668bf 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -1015,7 +1015,7 @@ static void pci_std_enable_acs(struct pci_dev *dev, struct pci_acs *caps) + * pci_enable_acs - enable ACS if hardware support it + * @dev: the PCI device + */ +-static void pci_enable_acs(struct pci_dev *dev) ++void pci_enable_acs(struct pci_dev *dev) + { + struct pci_acs caps; + bool enable_acs = false; +@@ -3677,14 +3677,6 @@ bool pci_acs_path_enabled(struct pci_dev *start, + void pci_acs_init(struct pci_dev *dev) + { + dev->acs_cap = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ACS); +- +- /* +- * Attempt to enable ACS regardless of capability because some Root +- * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have +- * the standard ACS capability but still support ACS via those +- * quirks. +- */ +- pci_enable_acs(dev); + } + + void pci_rebar_init(struct pci_dev *pdev) +diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h +index 565acfcd7cdb1..36cf1ffb2023c 100644 +--- a/drivers/pci/pci.h ++++ b/drivers/pci/pci.h +@@ -920,6 +920,7 @@ static inline resource_size_t pci_resource_alignment(struct pci_dev *dev, + } + + void pci_acs_init(struct pci_dev *dev); ++void pci_enable_acs(struct pci_dev *dev); + #ifdef CONFIG_PCI_QUIRKS + int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags); + int pci_dev_specific_enable_acs(struct pci_dev *dev); +-- +2.51.0 + diff --git a/queue-6.18/pci-fix-pci_slot_lock-device-locking.patch b/queue-6.18/pci-fix-pci_slot_lock-device-locking.patch new file mode 100644 index 00000000000..47a6be159ae --- /dev/null +++ b/queue-6.18/pci-fix-pci_slot_lock-device-locking.patch @@ -0,0 +1,97 @@ +From bad4a8736f01046f80d3ceba06f377492bc9c329 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 08:59:51 -0800 +Subject: PCI: Fix pci_slot_lock () device locking + +From: Keith Busch + +[ Upstream commit 1f5e57c622b4dc9b8e7d291d560138d92cfbe5bf ] + +Like pci_bus_lock(), pci_slot_lock() needs to lock the bridge device to +prevent warnings like: + + pcieport 0000:e2:05.0: unlocked secondary bus reset via: pciehp_reset_slot+0x55/0xa0 + +Take and release the lock for the bridge providing the slot for the +lock/trylock and unlock routines. + +Signed-off-by: Keith Busch +Signed-off-by: Bjorn Helgaas +Reviewed-by: Dan Williams +Link: https://patch.msgid.link/20260130165953.751063-3-kbusch@meta.com +Signed-off-by: Sasha Levin +--- + drivers/pci/pci.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 82e323b5aaa25..31d443f819a7c 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -5438,10 +5438,9 @@ static int pci_bus_trylock(struct pci_bus *bus) + /* Do any devices on or below this slot prevent a bus reset? */ + static bool pci_slot_resettable(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; + +- if (slot->bus->self && +- (slot->bus->self->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET)) ++ if (bridge && (bridge->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET)) + return false; + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { +@@ -5458,7 +5457,10 @@ static bool pci_slot_resettable(struct pci_slot *slot) + /* Lock devices from the top of the tree down */ + static void pci_slot_lock(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; ++ ++ if (bridge) ++ pci_dev_lock(bridge); + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { + if (!dev->slot || dev->slot != slot) +@@ -5473,7 +5475,7 @@ static void pci_slot_lock(struct pci_slot *slot) + /* Unlock devices from the bottom of the tree up */ + static void pci_slot_unlock(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { + if (!dev->slot || dev->slot != slot) +@@ -5483,12 +5485,18 @@ static void pci_slot_unlock(struct pci_slot *slot) + else + pci_dev_unlock(dev); + } ++ ++ if (bridge) ++ pci_dev_unlock(bridge); + } + + /* Return 1 on successful lock, 0 on contention */ + static int pci_slot_trylock(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; ++ ++ if (bridge && !pci_dev_trylock(bridge)) ++ return 0; + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { + if (!dev->slot || dev->slot != slot) +@@ -5513,6 +5521,9 @@ static int pci_slot_trylock(struct pci_slot *slot) + else + pci_dev_unlock(dev); + } ++ ++ if (bridge) ++ pci_dev_unlock(bridge); + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.18/pci-imx6-add-clkreq-override-to-enable-refclk-for-i..patch b/queue-6.18/pci-imx6-add-clkreq-override-to-enable-refclk-for-i..patch new file mode 100644 index 00000000000..58b5c406adb --- /dev/null +++ b/queue-6.18/pci-imx6-add-clkreq-override-to-enable-refclk-for-i..patch @@ -0,0 +1,88 @@ +From 14d09bf7157aa14f701ba02516d01698b42b4605 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 11:04:27 +0800 +Subject: PCI: imx6: Add CLKREQ# override to enable REFCLK for i.MX95 PCIe + +From: Richard Zhu + +[ Upstream commit 27a064aba2da6bc58fc36a6b8e889187ae3bf89d ] + +The CLKREQ# is an open drain, active low signal that is driven low by +the card to request reference clock. It's an optional signal added in +PCIe CEM r4.0, sec 2. Thus, this signal wouldn't be driven low if it's +not exposed on the slot. + +On the i.MX95 EVK board, REFCLK to the host and endpoint is gated by this +CLKREQ# signal. So if the CLKREQ# signal is not driven by the endpoint, it +will gate the REFCLK to host too, leading to operational failure. + +Hence, enable the REFCLK on this SoC by enabling the CLKREQ# override using +imx95_pcie_clkreq_override() helper during probe. This override should only +be cleared when the CLKREQ# signal is exposed on the slot. + +Signed-off-by: Richard Zhu +[mani: reworded description] +Signed-off-by: Manivannan Sadhasivam +Tested-by: Alexander Stein +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20251015030428.2980427-11-hongxing.zhu@nxp.com +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pci-imx6.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c +index 4668fc9648bff..34f8f69ddfae9 100644 +--- a/drivers/pci/controller/dwc/pci-imx6.c ++++ b/drivers/pci/controller/dwc/pci-imx6.c +@@ -52,6 +52,8 @@ + #define IMX95_PCIE_REF_CLKEN BIT(23) + #define IMX95_PCIE_PHY_CR_PARA_SEL BIT(9) + #define IMX95_PCIE_SS_RW_REG_1 0xf4 ++#define IMX95_PCIE_CLKREQ_OVERRIDE_EN BIT(8) ++#define IMX95_PCIE_CLKREQ_OVERRIDE_VAL BIT(9) + #define IMX95_PCIE_SYS_AUX_PWR_DET BIT(31) + + #define IMX95_PE0_GEN_CTRL_1 0x1050 +@@ -706,6 +708,22 @@ static int imx7d_pcie_enable_ref_clk(struct imx_pcie *imx_pcie, bool enable) + return 0; + } + ++static void imx95_pcie_clkreq_override(struct imx_pcie *imx_pcie, bool enable) ++{ ++ regmap_update_bits(imx_pcie->iomuxc_gpr, IMX95_PCIE_SS_RW_REG_1, ++ IMX95_PCIE_CLKREQ_OVERRIDE_EN, ++ enable ? IMX95_PCIE_CLKREQ_OVERRIDE_EN : 0); ++ regmap_update_bits(imx_pcie->iomuxc_gpr, IMX95_PCIE_SS_RW_REG_1, ++ IMX95_PCIE_CLKREQ_OVERRIDE_VAL, ++ enable ? IMX95_PCIE_CLKREQ_OVERRIDE_VAL : 0); ++} ++ ++static int imx95_pcie_enable_ref_clk(struct imx_pcie *imx_pcie, bool enable) ++{ ++ imx95_pcie_clkreq_override(imx_pcie, enable); ++ return 0; ++} ++ + static int imx_pcie_clk_enable(struct imx_pcie *imx_pcie) + { + struct dw_pcie *pci = imx_pcie->pci; +@@ -1913,6 +1931,7 @@ static const struct imx_pcie_drvdata drvdata[] = { + .core_reset = imx95_pcie_core_reset, + .init_phy = imx95_pcie_init_phy, + .wait_pll_lock = imx95_pcie_wait_for_phy_pll_lock, ++ .enable_ref_clk = imx95_pcie_enable_ref_clk, + }, + [IMX8MQ_EP] = { + .variant = IMX8MQ_EP, +@@ -1969,6 +1988,7 @@ static const struct imx_pcie_drvdata drvdata[] = { + .core_reset = imx95_pcie_core_reset, + .wait_pll_lock = imx95_pcie_wait_for_phy_pll_lock, + .epc_features = &imx95_pcie_epc_features, ++ .enable_ref_clk = imx95_pcie_enable_ref_clk, + .mode = DW_PCIE_EP_TYPE, + }, + }; +-- +2.51.0 + diff --git a/queue-6.18/pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch b/queue-6.18/pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch new file mode 100644 index 00000000000..6760d9d5ed1 --- /dev/null +++ b/queue-6.18/pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch @@ -0,0 +1,51 @@ +From 69424ceac51c035b516b4ac94c5e77dead1b1c7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 17:02:08 -0700 +Subject: PCI: Mark ASM1164 SATA controller to avoid bus reset + +From: Alex Williamson + +[ Upstream commit beb2f81792a8a619e5122b6b24a374861309c54b ] + +User forums report issues when assigning ASM1164 SATA controllers to VMs, +especially in configurations with multiple controllers. Logs show the +device fails to retrain after bus reset. Reports suggest this is an issue +across multiple platforms. The device indicates support for PM reset, +therefore the device still has a viable function level reset mechanism. +The reporting user confirms the device is well behaved in this use case +with bus reset disabled. + +Reported-by: Patrick Bianchi +Link: https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/ +Signed-off-by: Alex Williamson +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20260109000211.398300-1-alex.williamson@nvidia.com +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 9e073321b2dd2..c38434d973cd2 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3791,6 +3791,16 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_CAVIUM, 0xa100, quirk_no_bus_reset); + */ + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TI, 0xb005, quirk_no_bus_reset); + ++/* ++ * Reports from users making use of PCI device assignment with ASM1164 ++ * controllers indicate an issue with bus reset where the device fails to ++ * retrain. The issue appears more common in configurations with multiple ++ * controllers. The device does indicate PM reset support (NoSoftRst-), ++ * therefore this still leaves a viable reset method. ++ * https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/ ++ */ ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ASMEDIA, 0x1164, quirk_no_bus_reset); ++ + static void quirk_no_pm_reset(struct pci_dev *dev) + { + /* +-- +2.51.0 + diff --git a/queue-6.18/pci-mark-nvidia-gb10-to-avoid-bus-reset.patch b/queue-6.18/pci-mark-nvidia-gb10-to-avoid-bus-reset.patch new file mode 100644 index 00000000000..ecca1f79e92 --- /dev/null +++ b/queue-6.18/pci-mark-nvidia-gb10-to-avoid-bus-reset.patch @@ -0,0 +1,47 @@ +From 4cac60684f664f0df27ca4995ff8b502497b3942 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Nov 2025 16:44:06 +0800 +Subject: PCI: Mark Nvidia GB10 to avoid bus reset + +From: Johnny-CC Chang + +[ Upstream commit c81a2ce6b6a844d1a57d2a69833a9d0f00403f00 ] + +After asserting Secondary Bus Reset to downstream devices via a GB10 Root +Port, the link may not retrain correctly, e.g., the link may retrain with a +lower lane count or config accesses to downstream devices may fail. + +Prevent use of Secondary Bus Reset for devices below GB10. + +Signed-off-by: Johnny-CC Chang +[bhelgaas: drop pci_ids.h update (only used once), update commit log] +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Link: https://patch.msgid.link/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 62554152caf37..3c7aebf3d238a 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3748,6 +3748,14 @@ static void quirk_no_bus_reset(struct pci_dev *dev) + dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET; + } + ++/* ++ * After asserting Secondary Bus Reset to downstream devices via a GB10 ++ * Root Port, the link may not retrain correctly. ++ * https://lore.kernel.org/r/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com ++ */ ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22CE, quirk_no_bus_reset); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22D0, quirk_no_bus_reset); ++ + /* + * Some NVIDIA GPU devices do not work with bus reset, SBR needs to be + * prevented for those affected devices. +-- +2.51.0 + diff --git a/queue-6.18/pci-msi-unmap-msi-x-region-on-error.patch b/queue-6.18/pci-msi-unmap-msi-x-region-on-error.patch new file mode 100644 index 00000000000..37b18b35620 --- /dev/null +++ b/queue-6.18/pci-msi-unmap-msi-x-region-on-error.patch @@ -0,0 +1,49 @@ +From e6f3aa511b7a9219078a5cc5fb7b678c0d508de6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 22:44:52 +0800 +Subject: PCI/MSI: Unmap MSI-X region on error + +From: Haoxiang Li + +[ Upstream commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202 ] + +msix_capability_init() fails to unmap the MSI-X region if +msix_setup_interrupts() fails. + +Add the missing iounmap() for that error path. + +[ tglx: Massaged change log ] + +Signed-off-by: Haoxiang Li +Signed-off-by: Thomas Gleixner +Link: https://patch.msgid.link/20260125144452.2103812-1-lihaoxiang@isrc.iscas.ac.cn +Signed-off-by: Sasha Levin +--- + drivers/pci/msi/msi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c +index 34d664139f48f..e010ecd9f90dd 100644 +--- a/drivers/pci/msi/msi.c ++++ b/drivers/pci/msi/msi.c +@@ -737,7 +737,7 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries, + + ret = msix_setup_interrupts(dev, entries, nvec, affd); + if (ret) +- goto out_disable; ++ goto out_unmap; + + /* Disable INTX */ + pci_intx_for_msi(dev, 0); +@@ -758,6 +758,8 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries, + pcibios_free_irq(dev); + return 0; + ++out_unmap: ++ iounmap(dev->msix_base); + out_disable: + dev->msix_enabled = 0; + pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL | PCI_MSIX_FLAGS_ENABLE, 0); +-- +2.51.0 + diff --git a/queue-6.18/perf-annotate-fix-args-leak-of-map_symbol.patch b/queue-6.18/perf-annotate-fix-args-leak-of-map_symbol.patch new file mode 100644 index 00000000000..7ad240b69fe --- /dev/null +++ b/queue-6.18/perf-annotate-fix-args-leak-of-map_symbol.patch @@ -0,0 +1,421 @@ +From 6b71f83b8d1042519e54745cf8d61ec015d460e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 13:35:06 -0800 +Subject: perf annotate: Fix args leak of map_symbol +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ian Rogers + +[ Upstream commit 00419892bac28bf148450d762bbff990a6bd5494 ] + +map_symbol__exit() needs calling on an annotate_args.ms, however, rather +than introduce proper reference count handling to symbol__annotate() +just switch to passing the map_symbol pointer parameter around, making +the puts the caller's responsibility. + +Fix a number of cases to ensure the map in a map_symbol has a +reference count increment and add the then necessary map_symbol_exits. + +Fixes: 56e144fe98260a0f ("perf mem_info: Add and use map_symbol__exit and addr_map_symbol__exit") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Cc: Aditya Bodkhe +Cc: Adrian Hunter +Cc: Albert Ou +Cc: Alexander Shishkin +Cc: Alexandre Ghiti +Cc: Athira Rajeev +Cc: Bill Wendling +Cc: Dr. David Alan Gilbert +Cc: Guo Ren +Cc: Howard Chu +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: John Garry +Cc: Julia Lawall +Cc: Justin Stitt +Cc: Krzysztof Łopatowski +Cc: Leo Yan +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux-csky@vger.kernel.org +Cc: linux-riscv@lists.infradead.org +Cc: Namhyung Kim +Cc: Nathan Chancellor +Cc: Nick Desaulniers +Cc: Palmer Dabbelt +Cc: Paul Walmsley +Cc: Peter Zijlstra +Cc: Sergei Trofimovich +Cc: Shimin Guo +Cc: Suchit Karunakaran +Cc: Thomas Falcon +Cc: Tianyou Li +Cc: Will Deacon +Cc: Zecheng Li +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + .../arch/loongarch/annotate/instructions.c | 14 ++++---- + tools/perf/arch/s390/annotate/instructions.c | 11 +++--- + tools/perf/util/annotate.c | 2 +- + tools/perf/util/capstone.c | 14 ++++---- + tools/perf/util/disasm.c | 36 ++++++++++--------- + tools/perf/util/disasm.h | 2 +- + tools/perf/util/llvm.c | 6 ++-- + 7 files changed, 47 insertions(+), 38 deletions(-) + +diff --git a/tools/perf/arch/loongarch/annotate/instructions.c b/tools/perf/arch/loongarch/annotate/instructions.c +index 70262d5f14442..1c3abb43c8d72 100644 +--- a/tools/perf/arch/loongarch/annotate/instructions.c ++++ b/tools/perf/arch/loongarch/annotate/instructions.c +@@ -10,9 +10,7 @@ static int loongarch_call__parse(struct arch *arch, struct ins_operands *ops, st + { + char *c, *endptr, *tok, *name; + struct map *map = ms->map; +- struct addr_map_symbol target = { +- .ms = { .map = map, }, +- }; ++ struct addr_map_symbol target; + + c = strchr(ops->raw, '#'); + if (c++ == NULL) +@@ -38,12 +36,16 @@ static int loongarch_call__parse(struct arch *arch, struct ins_operands *ops, st + if (ops->target.name == NULL) + return -1; + +- target.addr = map__objdump_2mem(map, ops->target.addr); ++ target = (struct addr_map_symbol) { ++ .ms = { .map = map__get(map), }, ++ .addr = map__objdump_2mem(map, ops->target.addr), ++ }; + + if (maps__find_ams(ms->maps, &target) == 0 && + map__rip_2objdump(target.ms.map, map__map_ip(target.ms.map, target.addr)) == ops->target.addr) + ops->target.sym = target.ms.sym; + ++ addr_map_symbol__exit(&target); + return 0; + } + +@@ -58,7 +60,7 @@ static int loongarch_jump__parse(struct arch *arch, struct ins_operands *ops, st + struct map *map = ms->map; + struct symbol *sym = ms->sym; + struct addr_map_symbol target = { +- .ms = { .map = map, }, ++ .ms = { .map = map__get(map), }, + }; + const char *c = strchr(ops->raw, '#'); + u64 start, end; +@@ -90,7 +92,7 @@ static int loongarch_jump__parse(struct arch *arch, struct ins_operands *ops, st + } else { + ops->target.offset_avail = false; + } +- ++ addr_map_symbol__exit(&target); + return 0; + } + +diff --git a/tools/perf/arch/s390/annotate/instructions.c b/tools/perf/arch/s390/annotate/instructions.c +index c61193f1e0964..626e6d2cbc81a 100644 +--- a/tools/perf/arch/s390/annotate/instructions.c ++++ b/tools/perf/arch/s390/annotate/instructions.c +@@ -6,9 +6,7 @@ static int s390_call__parse(struct arch *arch, struct ins_operands *ops, + { + char *endptr, *tok, *name; + struct map *map = ms->map; +- struct addr_map_symbol target = { +- .ms = { .map = map, }, +- }; ++ struct addr_map_symbol target; + + tok = strchr(ops->raw, ','); + if (!tok) +@@ -36,12 +34,17 @@ static int s390_call__parse(struct arch *arch, struct ins_operands *ops, + + if (ops->target.name == NULL) + return -1; +- target.addr = map__objdump_2mem(map, ops->target.addr); ++ ++ target = (struct addr_map_symbol) { ++ .ms = { .map = map__get(map), }, ++ .addr = map__objdump_2mem(map, ops->target.addr), ++ }; + + if (maps__find_ams(ms->maps, &target) == 0 && + map__rip_2objdump(target.ms.map, map__map_ip(target.ms.map, target.addr)) == ops->target.addr) + ops->target.sym = target.ms.sym; + ++ addr_map_symbol__exit(&target); + return 0; + } + +diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c +index 1d6900033b3a0..dc80d922f450d 100644 +--- a/tools/perf/util/annotate.c ++++ b/tools/perf/util/annotate.c +@@ -1031,7 +1031,7 @@ int symbol__annotate(struct map_symbol *ms, struct evsel *evsel, + return 0; + + args.arch = arch; +- args.ms = *ms; ++ args.ms = ms; + + if (notes->src == NULL) { + notes->src = annotated_source__new(); +diff --git a/tools/perf/util/capstone.c b/tools/perf/util/capstone.c +index be5fd44b1f9dc..2c7feab61b7bf 100644 +--- a/tools/perf/util/capstone.c ++++ b/tools/perf/util/capstone.c +@@ -143,7 +143,7 @@ static void print_capstone_detail(cs_insn *insn, char *buf, size_t len, + struct annotate_args *args, u64 addr) + { + int i; +- struct map *map = args->ms.map; ++ struct map *map = args->ms->map; + struct symbol *sym; + + /* TODO: support more architectures */ +@@ -222,7 +222,7 @@ int symbol__disassemble_capstone(const char *filename __maybe_unused, + { + #ifdef HAVE_LIBCAPSTONE_SUPPORT + struct annotation *notes = symbol__annotation(sym); +- struct map *map = args->ms.map; ++ struct map *map = args->ms->map; + struct dso *dso = map__dso(map); + u64 start = map__rip_2objdump(map, sym->start); + u64 offset; +@@ -256,7 +256,7 @@ int symbol__disassemble_capstone(const char *filename __maybe_unused, + args->line = disasm_buf; + args->line_nr = 0; + args->fileloc = NULL; +- args->ms.sym = sym; ++ args->ms->sym = sym; + + dl = disasm_line__new(args); + if (dl == NULL) +@@ -268,7 +268,7 @@ int symbol__disassemble_capstone(const char *filename __maybe_unused, + !strcmp(args->options->disassembler_style, "att")) + disassembler_style = true; + +- if (capstone_init(maps__machine(args->ms.maps), &handle, is_64bit, disassembler_style) < 0) ++ if (capstone_init(maps__machine(args->ms->maps), &handle, is_64bit, disassembler_style) < 0) + goto err; + + needs_cs_close = true; +@@ -345,7 +345,7 @@ int symbol__disassemble_capstone_powerpc(const char *filename __maybe_unused, + { + #ifdef HAVE_LIBCAPSTONE_SUPPORT + struct annotation *notes = symbol__annotation(sym); +- struct map *map = args->ms.map; ++ struct map *map = args->ms->map; + struct dso *dso = map__dso(map); + struct nscookie nsc; + u64 start = map__rip_2objdump(map, sym->start); +@@ -382,7 +382,7 @@ int symbol__disassemble_capstone_powerpc(const char *filename __maybe_unused, + !strcmp(args->options->disassembler_style, "att")) + disassembler_style = true; + +- if (capstone_init(maps__machine(args->ms.maps), &handle, is_64bit, disassembler_style) < 0) ++ if (capstone_init(maps__machine(args->ms->maps), &handle, is_64bit, disassembler_style) < 0) + goto err; + + needs_cs_close = true; +@@ -408,7 +408,7 @@ int symbol__disassemble_capstone_powerpc(const char *filename __maybe_unused, + args->line = disasm_buf; + args->line_nr = 0; + args->fileloc = NULL; +- args->ms.sym = sym; ++ args->ms->sym = sym; + + dl = disasm_line__new(args); + if (dl == NULL) +diff --git a/tools/perf/util/disasm.c b/tools/perf/util/disasm.c +index 50b9433f3f8e6..924429142631a 100644 +--- a/tools/perf/util/disasm.c ++++ b/tools/perf/util/disasm.c +@@ -269,9 +269,7 @@ static int call__parse(struct arch *arch, struct ins_operands *ops, struct map_s + { + char *endptr, *tok, *name; + struct map *map = ms->map; +- struct addr_map_symbol target = { +- .ms = { .map = map, }, +- }; ++ struct addr_map_symbol target; + + ops->target.addr = strtoull(ops->raw, &endptr, 16); + +@@ -296,12 +294,16 @@ static int call__parse(struct arch *arch, struct ins_operands *ops, struct map_s + if (ops->target.name == NULL) + return -1; + find_target: +- target.addr = map__objdump_2mem(map, ops->target.addr); ++ target = (struct addr_map_symbol) { ++ .ms = { .map = map__get(map), }, ++ .addr = map__objdump_2mem(map, ops->target.addr), ++ }; + + if (maps__find_ams(ms->maps, &target) == 0 && + map__rip_2objdump(target.ms.map, map__map_ip(target.ms.map, target.addr)) == ops->target.addr) + ops->target.sym = target.ms.sym; + ++ addr_map_symbol__exit(&target); + return 0; + + indirect_call: +@@ -366,7 +368,7 @@ static int jump__parse(struct arch *arch, struct ins_operands *ops, struct map_s + struct map *map = ms->map; + struct symbol *sym = ms->sym; + struct addr_map_symbol target = { +- .ms = { .map = map, }, ++ .ms = { .map = map__get(map), }, + }; + const char *c = strchr(ops->raw, ','); + u64 start, end; +@@ -440,7 +442,7 @@ static int jump__parse(struct arch *arch, struct ins_operands *ops, struct map_s + } else { + ops->target.offset_avail = false; + } +- ++ addr_map_symbol__exit(&target); + return 0; + } + +@@ -1046,7 +1048,7 @@ static size_t disasm_line_size(int nr) + struct disasm_line *disasm_line__new(struct annotate_args *args) + { + struct disasm_line *dl = NULL; +- struct annotation *notes = symbol__annotation(args->ms.sym); ++ struct annotation *notes = symbol__annotation(args->ms->sym); + int nr = notes->src->nr_events; + + dl = zalloc(disasm_line_size(nr)); +@@ -1064,7 +1066,7 @@ struct disasm_line *disasm_line__new(struct annotate_args *args) + } else if (disasm_line__parse(dl->al.line, &dl->ins.name, &dl->ops.raw) < 0) + goto out_free_line; + +- disasm_line__init_ins(dl, args->arch, &args->ms); ++ disasm_line__init_ins(dl, args->arch, args->ms); + } + + return dl; +@@ -1119,7 +1121,7 @@ static int symbol__parse_objdump_line(struct symbol *sym, + struct annotate_args *args, + char *parsed_line, int *line_nr, char **fileloc) + { +- struct map *map = args->ms.map; ++ struct map *map = args->ms->map; + struct annotation *notes = symbol__annotation(sym); + struct disasm_line *dl; + char *tmp; +@@ -1151,7 +1153,7 @@ static int symbol__parse_objdump_line(struct symbol *sym, + args->line = parsed_line; + args->line_nr = *line_nr; + args->fileloc = *fileloc; +- args->ms.sym = sym; ++ args->ms->sym = sym; + + dl = disasm_line__new(args); + (*line_nr)++; +@@ -1169,12 +1171,14 @@ static int symbol__parse_objdump_line(struct symbol *sym, + if (dl->ins.ops && ins__is_call(&dl->ins) && !dl->ops.target.sym) { + struct addr_map_symbol target = { + .addr = dl->ops.target.addr, +- .ms = { .map = map, }, ++ .ms = { .map = map__get(map), }, + }; + +- if (!maps__find_ams(args->ms.maps, &target) && ++ if (!maps__find_ams(args->ms->maps, &target) && + target.ms.sym->start == target.al_addr) + dl->ops.target.sym = target.ms.sym; ++ ++ addr_map_symbol__exit(&target); + } + + annotation_line__add(&dl->al, ¬es->src->source); +@@ -1338,7 +1342,7 @@ static int symbol__disassemble_raw(char *filename, struct symbol *sym, + struct annotate_args *args) + { + struct annotation *notes = symbol__annotation(sym); +- struct map *map = args->ms.map; ++ struct map *map = args->ms->map; + struct dso *dso = map__dso(map); + u64 start = map__rip_2objdump(map, sym->start); + u64 end = map__rip_2objdump(map, sym->end); +@@ -1375,7 +1379,7 @@ static int symbol__disassemble_raw(char *filename, struct symbol *sym, + args->line = disasm_buf; + args->line_nr = 0; + args->fileloc = NULL; +- args->ms.sym = sym; ++ args->ms->sym = sym; + + dl = disasm_line__new(args); + if (dl == NULL) +@@ -1501,7 +1505,7 @@ static int symbol__disassemble_objdump(const char *filename, struct symbol *sym, + struct annotate_args *args) + { + struct annotation_options *opts = &annotate_opts; +- struct map *map = args->ms.map; ++ struct map *map = args->ms->map; + struct dso *dso = map__dso(map); + char *command; + FILE *file; +@@ -1644,7 +1648,7 @@ static int symbol__disassemble_objdump(const char *filename, struct symbol *sym, + int symbol__disassemble(struct symbol *sym, struct annotate_args *args) + { + struct annotation_options *options = args->options; +- struct map *map = args->ms.map; ++ struct map *map = args->ms->map; + struct dso *dso = map__dso(map); + char symfs_filename[PATH_MAX]; + bool delete_extract = false; +diff --git a/tools/perf/util/disasm.h b/tools/perf/util/disasm.h +index d2cb555e4a3be..a3ea9d6762816 100644 +--- a/tools/perf/util/disasm.h ++++ b/tools/perf/util/disasm.h +@@ -97,7 +97,7 @@ struct ins_ops { + + struct annotate_args { + struct arch *arch; +- struct map_symbol ms; ++ struct map_symbol *ms; + struct annotation_options *options; + s64 offset; + char *line; +diff --git a/tools/perf/util/llvm.c b/tools/perf/util/llvm.c +index 2ebf1f5f65bf7..4ada9a10bd93f 100644 +--- a/tools/perf/util/llvm.c ++++ b/tools/perf/util/llvm.c +@@ -118,7 +118,7 @@ int symbol__disassemble_llvm(const char *filename, struct symbol *sym, + { + #ifdef HAVE_LIBLLVM_SUPPORT + struct annotation *notes = symbol__annotation(sym); +- struct map *map = args->ms.map; ++ struct map *map = args->ms->map; + struct dso *dso = map__dso(map); + u64 start = map__rip_2objdump(map, sym->start); + /* Malloc-ed buffer containing instructions read from disk. */ +@@ -184,7 +184,7 @@ int symbol__disassemble_llvm(const char *filename, struct symbol *sym, + args->line = disasm_buf; + args->line_nr = 0; + args->fileloc = NULL; +- args->ms.sym = sym; ++ args->ms->sym = sym; + + dl = disasm_line__new(args); + if (dl == NULL) +@@ -242,7 +242,7 @@ int symbol__disassemble_llvm(const char *filename, struct symbol *sym, + &line_storage_len); + args->line_nr = 0; + args->fileloc = NULL; +- args->ms.sym = sym; ++ args->ms->sym = sym; + + llvm_addr2line(filename, pc, &args->fileloc, + (unsigned int *)&args->line_nr, false, NULL); +-- +2.51.0 + diff --git a/queue-6.18/perf-annotate-fix-build_nondistro-1-missing-args-ms-.patch b/queue-6.18/perf-annotate-fix-build_nondistro-1-missing-args-ms-.patch new file mode 100644 index 00000000000..3e97c983fec --- /dev/null +++ b/queue-6.18/perf-annotate-fix-build_nondistro-1-missing-args-ms-.patch @@ -0,0 +1,55 @@ +From 5df64ba21db4327d378bda9e3940d8e06648e313 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jan 2026 17:25:00 -0300 +Subject: perf annotate: Fix BUILD_NONDISTRO=1 missing args->ms conversions to + pointer + +From: Arnaldo Carvalho de Melo + +[ Upstream commit dda5f926a1006c735b00ed5c27291fce64236656 ] + +Fix a few missing conversions to pointer in the usage of 'struct +annotate_args' 'ms' member in symbol__disassemble_bpf_libbfd(). + +Fixes: 00419892bac28bf1 ("perf annotate: Fix args leak of map_symbol") +Reviewed-by: Ian Rogers +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/libbfd.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/util/libbfd.c b/tools/perf/util/libbfd.c +index 6434c2dccd4a4..2324f6846d510 100644 +--- a/tools/perf/util/libbfd.c ++++ b/tools/perf/util/libbfd.c +@@ -494,7 +494,7 @@ int symbol__disassemble_bpf_libbfd(struct symbol *sym __maybe_unused, + struct bpf_prog_info_node *info_node; + int len = sym->end - sym->start; + disassembler_ftype disassemble; +- struct map *map = args->ms.map; ++ struct map *map = args->ms->map; + struct perf_bpil *info_linear; + struct disassemble_info info; + struct dso *dso = map__dso(map); +@@ -605,7 +605,7 @@ int symbol__disassemble_bpf_libbfd(struct symbol *sym __maybe_unused, + args->line = strdup(srcline); + args->line_nr = 0; + args->fileloc = NULL; +- args->ms.sym = sym; ++ args->ms->sym = sym; + dl = disasm_line__new(args); + if (dl) { + annotation_line__add(&dl->al, +@@ -617,7 +617,7 @@ int symbol__disassemble_bpf_libbfd(struct symbol *sym __maybe_unused, + args->line = buf + prev_buf_size; + args->line_nr = 0; + args->fileloc = NULL; +- args->ms.sym = sym; ++ args->ms->sym = sym; + dl = disasm_line__new(args); + if (dl) + annotation_line__add(&dl->al, ¬es->src->source); +-- +2.51.0 + diff --git a/queue-6.18/perf-annotate-fix-memcpy-size-in-arch__grow_instruct.patch b/queue-6.18/perf-annotate-fix-memcpy-size-in-arch__grow_instruct.patch new file mode 100644 index 00000000000..26ee8b85adb --- /dev/null +++ b/queue-6.18/perf-annotate-fix-memcpy-size-in-arch__grow_instruct.patch @@ -0,0 +1,52 @@ +From c8c21d45f0b212dfad61bb02c6625c95a7a98bbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 22:47:04 +0530 +Subject: perf annotate: Fix memcpy size in arch__grow_instructions() + +From: Suchit Karunakaran + +[ Upstream commit f0d98c78f8bf73ce2a9b7793f66cda240fa9ab10 ] + +The memcpy() in arch__grow_instructions() is copying the wrong number of +bytes when growing from a non-allocated table. + +It should copy arch->nr_instructions * sizeof(struct ins) bytes, not +just arch->nr_instructions bytes. + +This bug causes data corruption as only a partial copy of the +instruction table is made, leading to garbage data in most entries and +potential crashes + +Fixes: 2a1ff812c40be982 ("perf annotate: Introduce alternative method of keeping instructions table") +Reviewed-by: Ian Rogers +Signed-off-by: Suchit Karunakaran +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/disasm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/disasm.c b/tools/perf/util/disasm.c +index 924429142631a..88706b98b9064 100644 +--- a/tools/perf/util/disasm.c ++++ b/tools/perf/util/disasm.c +@@ -81,7 +81,7 @@ static int arch__grow_instructions(struct arch *arch) + if (new_instructions == NULL) + return -1; + +- memcpy(new_instructions, arch->instructions, arch->nr_instructions); ++ memcpy(new_instructions, arch->instructions, arch->nr_instructions * sizeof(struct ins)); + goto out_update_instructions; + } + +-- +2.51.0 + diff --git a/queue-6.18/perf-arm-cmn-support-cmn-600ae.patch b/queue-6.18/perf-arm-cmn-support-cmn-600ae.patch new file mode 100644 index 00000000000..5d2977f351b --- /dev/null +++ b/queue-6.18/perf-arm-cmn-support-cmn-600ae.patch @@ -0,0 +1,50 @@ +From 2302bb493157bfe841791471c760cad47633eebf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 16:39:54 +0000 +Subject: perf/arm-cmn: Support CMN-600AE + +From: Robin Murphy + +[ Upstream commit 12a94953c37e834c3eabb839ce057094946fe67a ] + +The functional safety features of CMN-600AE have little to no impact on +the PMU relative to the base CMN-600 design, so for simplicity we can +reasonably just treat it as the same thing. The only obvious difference +is that the revision numbers aren't aligned, so we may hide some aliases +for events which do actually exist, but those can still be specified via +the underlying "type,eventid" format so it's not too big a deal. + +Signed-off-by: Robin Murphy +Reviewed-by: Ilkka Koskinen +Tested-by: Michal Simek +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm-cmn.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c +index 23245352a3fc0..651edd73bfcb1 100644 +--- a/drivers/perf/arm-cmn.c ++++ b/drivers/perf/arm-cmn.c +@@ -210,6 +210,7 @@ enum cmn_model { + enum cmn_part { + PART_CMN600 = 0x434, + PART_CMN650 = 0x436, ++ PART_CMN600AE = 0x438, + PART_CMN700 = 0x43c, + PART_CI700 = 0x43a, + PART_CMN_S3 = 0x43e, +@@ -2266,6 +2267,9 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset) + reg = readq_relaxed(cfg_region + CMN_CFGM_PERIPH_ID_01); + part = FIELD_GET(CMN_CFGM_PID0_PART_0, reg); + part |= FIELD_GET(CMN_CFGM_PID1_PART_1, reg) << 8; ++ /* 600AE is close enough that it's not really worth more complexity */ ++ if (part == PART_CMN600AE) ++ part = PART_CMN600; + if (cmn->part && cmn->part != part) + dev_warn(cmn->dev, + "Firmware binding mismatch: expected part number 0x%x, found 0x%x\n", +-- +2.51.0 + diff --git a/queue-6.18/perf-build-raise-minimum-shellcheck-version-to-0.7.2.patch b/queue-6.18/perf-build-raise-minimum-shellcheck-version-to-0.7.2.patch new file mode 100644 index 00000000000..c3cb160126d --- /dev/null +++ b/queue-6.18/perf-build-raise-minimum-shellcheck-version-to-0.7.2.patch @@ -0,0 +1,69 @@ +From 711bde4f1ec93e941728ceff9ff6b1981e8c167b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:29:10 +0100 +Subject: perf build: Raise minimum shellcheck version to 0.7.2 + +From: Nicolas Schier + +[ Upstream commit 383f8e26e2c483e25453f8c3d0839877708ac701 ] + +Raise the minimum shellcheck version for perf builds to 0.7.2, so that +systems with shellcheck versions below 0.7.2 will automatically skip the +shell script checking, even if NO_SHELLCHECK is unset. + +Since commit 241f21be7d0fdf3c ("perf test perftool_testsuite: Use +absolute paths"), shellcheck versions before 0.7.2 break the perf build +with several SC1090 [2] warnings due to its too strict dynamic source +handling [1], e.g.: + + In tests/shell/base_probe/test_line_semantics.sh line 20: + . "$DIR_PATH/../common/init.sh" + ^---------------------------^ SC1090: Can't follow non-constant source. Use a directive to specify location. + +Fixes: 241f21be7d0fdf3c ("perf test perftool_testsuite: Use absolute paths") +Signed-off-by: Nicolas Schier +Acked-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jakub Brnak +Cc: James Clark +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Michael Petlan +Cc: Nicolas Schier +Cc: Peter Zijlstra +Cc: Philipp Hahn +Cc: Veronika Molnarova +Link: https://github.com/koalaman/shellcheck/issues/1998 # [1] +Link: https://www.shellcheck.net/wiki/SC1090 +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/Makefile.perf | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf +index 47c906b807ef2..da7434b385d18 100644 +--- a/tools/perf/Makefile.perf ++++ b/tools/perf/Makefile.perf +@@ -253,11 +253,12 @@ else + endif + + # shellcheck is using in tools/perf/tests/Build with option -a/--check-sourced ( +-# introduced in v0.4.7) and -S/--severity (introduced in v0.6.0). So make the +-# minimal shellcheck version as v0.6.0. ++# introduced in v0.4.7) and -S/--severity (introduced in v0.6.0) as well as ++# dynamic source inclusions (properly handled since v0.7.2). ++# So make the minimal shellcheck version as v0.7.2. + ifneq ($(SHELLCHECK),) + ifeq ($(shell expr $(shell $(SHELLCHECK) --version | grep version: | \ +- sed -e 's/.\+ \([0-9]\+\).\([0-9]\+\).\([0-9]\+\)/\1\2\3/g') \< 060), 1) ++ sed -e 's/.\+ \([0-9]\+\).\([0-9]\+\).\([0-9]\+\)/\1\2\3/g') \< 072), 1) + SHELLCHECK := + else + SHELLCHECK := $(SHELLCHECK) -s bash -a -S warning +-- +2.51.0 + diff --git a/queue-6.18/perf-build-remove-no_libcap-that-controls-nothing.patch b/queue-6.18/perf-build-remove-no_libcap-that-controls-nothing.patch new file mode 100644 index 00000000000..5d6701dc5b7 --- /dev/null +++ b/queue-6.18/perf-build-remove-no_libcap-that-controls-nothing.patch @@ -0,0 +1,62 @@ +From cac0a7dad82057a176bbc787d4ef172018fa8326 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 15:35:39 -0800 +Subject: perf build: Remove NO_LIBCAP that controls nothing + +From: Ian Rogers + +[ Upstream commit 169343cc8ff2bd59758760d867bd26adae866a2b ] + +Using libcap was removed in commit e25ebda78e230283 ("perf cap: Tidy up +and improve capability testing") and improve capability testing"), +however, some build documentation and a use of the NO_LIBCAP=1 were +lingering. + +Remove these left over bits. + +Fixes: e25ebda78e230283 ("perf cap: Tidy up and improve capability testing") +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/Makefile.perf | 2 -- + tools/perf/tests/make | 2 +- + 2 files changed, 1 insertion(+), 3 deletions(-) + +diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf +index da7434b385d18..562b9d356d2a2 100644 +--- a/tools/perf/Makefile.perf ++++ b/tools/perf/Makefile.perf +@@ -88,8 +88,6 @@ include ../scripts/utilities.mak + # + # Define NO_LIBBPF if you do not want BPF support + # +-# Define NO_LIBCAP if you do not want process capabilities considered by perf +-# + # Define NO_SDT if you do not want to define SDT event in perf tools, + # note that it doesn't disable SDT scanning support. + # +diff --git a/tools/perf/tests/make b/tools/perf/tests/make +index b650ce8864ed5..fa4500c65949a 100644 +--- a/tools/perf/tests/make ++++ b/tools/perf/tests/make +@@ -123,7 +123,7 @@ make_minimal += NO_DEMANGLE=1 NO_LIBELF=1 NO_BACKTRACE=1 + make_minimal += NO_LIBNUMA=1 NO_LIBBIONIC=1 NO_LIBDW=1 + make_minimal += NO_LIBDW_DWARF_UNWIND=1 NO_AUXTRACE=1 NO_LIBBPF=1 + make_minimal += NO_SDT=1 NO_JVMTI=1 NO_LIBZSTD=1 +-make_minimal += NO_LIBCAP=1 NO_CAPSTONE=1 ++make_minimal += NO_CAPSTONE=1 + + # $(run) contains all available tests + run := make_pure +-- +2.51.0 + diff --git a/queue-6.18/perf-callchain-fix-srcline-printing-with-inlines.patch b/queue-6.18/perf-callchain-fix-srcline-printing-with-inlines.patch new file mode 100644 index 00000000000..bd6d2cc0ac1 --- /dev/null +++ b/queue-6.18/perf-callchain-fix-srcline-printing-with-inlines.patch @@ -0,0 +1,55 @@ +From 245dfe0e7592ea33d19d45f67f287374c3a1c35b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 20:13:36 -0800 +Subject: perf callchain: Fix srcline printing with inlines + +From: Ian Rogers + +[ Upstream commit abec464767b5d26f0612250d511c18f420826ca1 ] + +sample__fprintf_callchain() was using map__fprintf_srcline() which won't +report inline line numbers. + +Fix by using the srcline from the callchain and falling back to the map +variant. + +Fixes: 25da4fab5f66e659 ("perf evsel: Move fprintf methods to separate source file") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Stephen Brennan +Cc: Tony Jones +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/evsel_fprintf.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/evsel_fprintf.c b/tools/perf/util/evsel_fprintf.c +index 103984b29b1e1..cbf2dd2dfc6f4 100644 +--- a/tools/perf/util/evsel_fprintf.c ++++ b/tools/perf/util/evsel_fprintf.c +@@ -182,8 +182,12 @@ int sample__fprintf_callchain(struct perf_sample *sample, int left_alignment, + if (print_dso && (!sym || !sym->inlined)) + printed += map__fprintf_dsoname_dsoff(map, print_dsoff, addr, fp); + +- if (print_srcline) +- printed += map__fprintf_srcline(map, addr, "\n ", fp); ++ if (print_srcline) { ++ if (node->srcline) ++ printed += fprintf(fp, "\n %s", node->srcline); ++ else ++ printed += map__fprintf_srcline(map, addr, "\n ", fp); ++ } + + if (sym && sym->inlined) + printed += fprintf(fp, " (inlined)"); +-- +2.51.0 + diff --git a/queue-6.18/perf-core-fix-slow-perf_event_task_exit-with-lbr-cal.patch b/queue-6.18/perf-core-fix-slow-perf_event_task_exit-with-lbr-cal.patch new file mode 100644 index 00000000000..04698917d28 --- /dev/null +++ b/queue-6.18/perf-core-fix-slow-perf_event_task_exit-with-lbr-cal.patch @@ -0,0 +1,92 @@ +From 300debf4170537a501afd167e8440c304e609fdd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 08:51:57 -0800 +Subject: perf/core: Fix slow perf_event_task_exit() with LBR callstacks + +From: Namhyung Kim + +[ Upstream commit 4960626f956d63dce57f099016c2ecbe637a8229 ] + +I got a report that a task is stuck in perf_event_exit_task() waiting +for global_ctx_data_rwsem. On large systems with lots threads, it'd +have performance issues when it grabs the lock to iterate all threads +in the system to allocate the context data. + +And it'd block task exit path which is problematic especially under +memory pressure. + + perf_event_open + perf_event_alloc + attach_perf_ctx_data + attach_global_ctx_data + percpu_down_write (global_ctx_data_rwsem) + for_each_process_thread + alloc_task_ctx_data + do_exit + perf_event_exit_task + percpu_down_read (global_ctx_data_rwsem) + +It should not hold the global_ctx_data_rwsem on the exit path. Let's +skip allocation for exiting tasks and free the data carefully. + +Reported-by: Rosalie Fang +Suggested-by: Peter Zijlstra +Signed-off-by: Namhyung Kim +Signed-off-by: Peter Zijlstra (Intel) +Link: https://patch.msgid.link/20260112165157.1919624-1-namhyung@kernel.org +Signed-off-by: Sasha Levin +--- + kernel/events/core.c | 20 ++++++++++++++++++-- + 1 file changed, 18 insertions(+), 2 deletions(-) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 1d8ca8e34f5c4..c34b927e5ece3 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -5279,9 +5279,20 @@ attach_task_ctx_data(struct task_struct *task, struct kmem_cache *ctx_cache, + return -ENOMEM; + + for (;;) { +- if (try_cmpxchg((struct perf_ctx_data **)&task->perf_ctx_data, &old, cd)) { ++ if (try_cmpxchg(&task->perf_ctx_data, &old, cd)) { + if (old) + perf_free_ctx_data_rcu(old); ++ /* ++ * Above try_cmpxchg() pairs with try_cmpxchg() from ++ * detach_task_ctx_data() such that ++ * if we race with perf_event_exit_task(), we must ++ * observe PF_EXITING. ++ */ ++ if (task->flags & PF_EXITING) { ++ /* detach_task_ctx_data() may free it already */ ++ if (try_cmpxchg(&task->perf_ctx_data, &cd, NULL)) ++ perf_free_ctx_data_rcu(cd); ++ } + return 0; + } + +@@ -5327,6 +5338,8 @@ attach_global_ctx_data(struct kmem_cache *ctx_cache) + /* Allocate everything */ + scoped_guard (rcu) { + for_each_process_thread(g, p) { ++ if (p->flags & PF_EXITING) ++ continue; + cd = rcu_dereference(p->perf_ctx_data); + if (cd && !cd->global) { + cd->global = 1; +@@ -14223,8 +14236,11 @@ void perf_event_exit_task(struct task_struct *task) + + /* + * Detach the perf_ctx_data for the system-wide event. ++ * ++ * Done without holding global_ctx_data_rwsem; typically ++ * attach_global_ctx_data() will skip over this task, but otherwise ++ * attach_task_ctx_data() will observe PF_EXITING. + */ +- guard(percpu_read)(&global_ctx_data_rwsem); + detach_task_ctx_data(task); + } + +-- +2.51.0 + diff --git a/queue-6.18/perf-cs-etm-fix-decoding-for-sparse-cpu-maps.patch b/queue-6.18/perf-cs-etm-fix-decoding-for-sparse-cpu-maps.patch new file mode 100644 index 00000000000..5608c558c80 --- /dev/null +++ b/queue-6.18/perf-cs-etm-fix-decoding-for-sparse-cpu-maps.patch @@ -0,0 +1,120 @@ +From fcec1bd20013e323244e60cf504657c5afc33987 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 10:18:35 +0000 +Subject: perf cs-etm: Fix decoding for sparse CPU maps + +From: James Clark + +[ Upstream commit a70493e2bb0878885aa7a8178162550270693eb1 ] + +The ETM decoder incorrectly assumed that auxtrace queue indices were +equivalent to CPU number. This assumption is used for inserting records +into the queue, and for fetching queues when given a CPU number. This +assumption held when Perf always opened a dummy event on every CPU, even +if the user provided a subset of CPUs on the commandline, resulting in +the indices aligning. + +For example: + + # event : name = cs_etm//u, , id = { 2451, 2452 }, type = 11 (cs_etm), size = 136, config = 0x4010, { sample_period, samp> + # event : name = dummy:u, , id = { 2453, 2454, 2455, 2456 }, type = 1 (PERF_TYPE_SOFTWARE), size = 136, config = 0x9 (PER> + + 0 0 0x200 [0xd0]: PERF_RECORD_ID_INDEX nr: 6 + ... id: 2451 idx: 2 cpu: 2 tid: -1 + ... id: 2452 idx: 3 cpu: 3 tid: -1 + ... id: 2453 idx: 0 cpu: 0 tid: -1 + ... id: 2454 idx: 1 cpu: 1 tid: -1 + ... id: 2455 idx: 2 cpu: 2 tid: -1 + ... id: 2456 idx: 3 cpu: 3 tid: -1 + +Since commit 811082e4b668 ("perf parse-events: Support user CPUs mixed +with threads/processes") the dummy event no longer behaves in this way, +making the ETM event indices start from 0 on the first CPU recorded +regardless of its ID: + + # event : name = cs_etm//u, , id = { 771, 772 }, type = 11 (cs_etm), size = 144, config = 0x4010, { sample_period, sample> + # event : name = dummy:u, , id = { 773, 774 }, type = 1 (PERF_TYPE_SOFTWARE), size = 144, config = 0x9 (PERF_COUNT_SW_DUM> + + 0 0 0x200 [0x90]: PERF_RECORD_ID_INDEX nr: 4 + ... id: 771 idx: 0 cpu: 2 tid: -1 + ... id: 772 idx: 1 cpu: 3 tid: -1 + ... id: 773 idx: 0 cpu: 2 tid: -1 + ... id: 774 idx: 1 cpu: 3 tid: -1 + +This causes the following segfault when decoding: + + $ perf record -e cs_etm//u -C 2,3 -- true + $ perf report + + perf: Segmentation fault + -------- backtrace -------- + #0 0xaaaabf9fd020 in ui__signal_backtrace setup.c:110 + #1 0xffffab5c7930 in __kernel_rt_sigreturn [vdso][930] + #2 0xaaaabfb68d30 in cs_etm_decoder__reset cs-etm-decoder.c:85 + #3 0xaaaabfb65930 in cs_etm__get_data_block cs-etm.c:2032 + #4 0xaaaabfb666fc in cs_etm__run_per_cpu_timeless_decoder cs-etm.c:2551 + #5 0xaaaabfb6692c in (cs_etm__process_timeless_queues cs-etm.c:2612 + #6 0xaaaabfb63390 in cs_etm__flush_events cs-etm.c:921 + #7 0xaaaabfb324c0 in auxtrace__flush_events auxtrace.c:2915 + #8 0xaaaabfaac378 in __perf_session__process_events session.c:2285 + #9 0xaaaabfaacc9c in perf_session__process_events session.c:2442 + #10 0xaaaabf8d3d90 in __cmd_report builtin-report.c:1085 + #11 0xaaaabf8d6944 in cmd_report builtin-report.c:1866 + #12 0xaaaabf95ebfc in run_builtin perf.c:351 + #13 0xaaaabf95eeb0 in handle_internal_command perf.c:404 + #14 0xaaaabf95f068 in run_argv perf.c:451 + #15 0xaaaabf95f390 in main perf.c:558 + #16 0xffffaab97400 in __libc_start_call_main libc_start_call_main.h:74 + #17 0xffffaab974d8 in __libc_start_main@@GLIBC_2.34 libc-start.c:128 + #18 0xaaaabf8aa8f0 in _start perf[7a8f0] + +Fix it by inserting into the queues based on CPU number, rather than +using the index. + +Fixes: 811082e4b668db96 ("perf parse-events: Support user CPUs mixed with threads/processes") +Signed-off-by: James Clark +Tested-by: Leo Yan +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: coresight@lists.linaro.org +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: John Garry +Cc: Mark Rutland +Cc: Mike Leach +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Suzuki Poulouse +Cc: Thomas Falcon +Cc: Will Deacon +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/cs-etm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c +index 30f4bb3e7fa30..06eb1a56430cb 100644 +--- a/tools/perf/util/cs-etm.c ++++ b/tools/perf/util/cs-etm.c +@@ -3089,7 +3089,7 @@ static int cs_etm__queue_aux_fragment(struct perf_session *session, off_t file_o + + if (aux_offset >= auxtrace_event->offset && + aux_offset + aux_size <= auxtrace_event->offset + auxtrace_event->size) { +- struct cs_etm_queue *etmq = etm->queues.queue_array[auxtrace_event->idx].priv; ++ struct cs_etm_queue *etmq = cs_etm__get_queue(etm, auxtrace_event->cpu); + + /* + * If this AUX event was inside this buffer somewhere, create a new auxtrace event +@@ -3098,6 +3098,7 @@ static int cs_etm__queue_aux_fragment(struct perf_session *session, off_t file_o + auxtrace_fragment.auxtrace = *auxtrace_event; + auxtrace_fragment.auxtrace.size = aux_size; + auxtrace_fragment.auxtrace.offset = aux_offset; ++ auxtrace_fragment.auxtrace.idx = etmq->queue_nr; + file_offset += aux_offset - auxtrace_event->offset + auxtrace_event->header.size; + + pr_debug3("CS ETM: Queue buffer size: %#"PRI_lx64" offset: %#"PRI_lx64 +-- +2.51.0 + diff --git a/queue-6.18/perf-cxlpmu-replace-irqf_oneshot-with-irqf_no_thread.patch b/queue-6.18/perf-cxlpmu-replace-irqf_oneshot-with-irqf_no_thread.patch new file mode 100644 index 00000000000..71e0872c197 --- /dev/null +++ b/queue-6.18/perf-cxlpmu-replace-irqf_oneshot-with-irqf_no_thread.patch @@ -0,0 +1,44 @@ +From 6f97ff086fa06bf6830edffcaa7375696fb591ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:34 +0100 +Subject: perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD + +From: Sebastian Andrzej Siewior + +[ Upstream commit ab26d9c85554c4ff1d95ca8341522880ed9219d6 ] + +Passing IRQF_ONESHOT ensures that the interrupt source is masked until +the secondary (threaded) handler is done. If only a primary handler is +used then the flag makes no sense because the interrupt can not fire +(again) while its handler is running. +The flag also disallows force-threading of the primary handler and the +irq-core will warn about this. + +The intention here was probably not allowing forced-threading. + +Replace IRQF_ONESHOT with IRQF_NO_THREAD. + +Reviewed-by: Jonathan Cameron +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/cxl_pmu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/perf/cxl_pmu.c b/drivers/perf/cxl_pmu.c +index d094030220bf2..68a54d97d2a8a 100644 +--- a/drivers/perf/cxl_pmu.c ++++ b/drivers/perf/cxl_pmu.c +@@ -877,7 +877,7 @@ static int cxl_pmu_probe(struct device *dev) + if (!irq_name) + return -ENOMEM; + +- rc = devm_request_irq(dev, irq, cxl_pmu_irq, IRQF_SHARED | IRQF_ONESHOT, ++ rc = devm_request_irq(dev, irq, cxl_pmu_irq, IRQF_SHARED | IRQF_NO_THREAD, + irq_name, info); + if (rc) + return rc; +-- +2.51.0 + diff --git a/queue-6.18/perf-maps-fix-reference-count-leak-in-maps__find_ams.patch b/queue-6.18/perf-maps-fix-reference-count-leak-in-maps__find_ams.patch new file mode 100644 index 00000000000..c82bb85f332 --- /dev/null +++ b/queue-6.18/perf-maps-fix-reference-count-leak-in-maps__find_ams.patch @@ -0,0 +1,71 @@ +From d536710983e2380b60e7e9ee5f0b9886e09400e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 13:35:07 -0800 +Subject: perf maps: Fix reference count leak in maps__find_ams() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ian Rogers + +[ Upstream commit 6fdd2676db55b503c52dd3f1359b5c57f774ab75 ] + +ams and so ams->ms.map is an in argument, however, it is also +overwritten. As a map is reference counted, ensure a map__put() is done +before overwriting it. + +Fixes: 42fd623b58dbcc48 ("perf maps: Get map before returning in maps__find") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Cc: Aditya Bodkhe +Cc: Adrian Hunter +Cc: Albert Ou +Cc: Alexander Shishkin +Cc: Alexandre Ghiti +Cc: Athira Rajeev +Cc: Bill Wendling +Cc: Dr. David Alan Gilbert +Cc: Guo Ren +Cc: Howard Chu +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: John Garry +Cc: Julia Lawall +Cc: Justin Stitt +Cc: Krzysztof Łopatowski +Cc: Leo Yan +Cc: Namhyung Kim +Cc: Nathan Chancellor +Cc: Nick Desaulniers +Cc: Palmer Dabbelt +Cc: Paul Walmsley +Cc: Peter Zijlstra +Cc: Sergei Trofimovich +Cc: Shimin Guo +Cc: Suchit Karunakaran +Cc: Thomas Falcon +Cc: Tianyou Li +Cc: Will Deacon +Cc: Zecheng Li +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/maps.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/perf/util/maps.c b/tools/perf/util/maps.c +index 779f6230130af..c51ec159ac769 100644 +--- a/tools/perf/util/maps.c ++++ b/tools/perf/util/maps.c +@@ -676,6 +676,7 @@ int maps__find_ams(struct maps *maps, struct addr_map_symbol *ams) + if (ams->addr < map__start(ams->ms.map) || ams->addr >= map__end(ams->ms.map)) { + if (maps == NULL) + return -1; ++ map__put(ams->ms.map); + ams->ms.map = maps__find(maps, ams->addr); + if (ams->ms.map == NULL) + return -1; +-- +2.51.0 + diff --git a/queue-6.18/perf-symbol-elf-fix-leak-of-elf-files-with-gnu-debug.patch b/queue-6.18/perf-symbol-elf-fix-leak-of-elf-files-with-gnu-debug.patch new file mode 100644 index 00000000000..5dd2040afeb --- /dev/null +++ b/queue-6.18/perf-symbol-elf-fix-leak-of-elf-files-with-gnu-debug.patch @@ -0,0 +1,69 @@ +From ff0e86b9e2077f316288a12a21e361589a62c519 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jan 2026 21:28:27 -0800 +Subject: perf symbol-elf: Fix leak of ELF files with GNU debugdata +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ian Rogers + +[ Upstream commit 92d65d9c31621befe0a5f7c0bd43bd217613c6b6 ] + +The processing of DSO_BINARY_TYPE__GNU_DEBUGDATA in symsrc__init happens +with an open ELF file but the error path only closes the associate fd. + +Fix the goto so that the ELF file is also ended and memory released. + +Fixes: b10f74308e130527 ("perf symbol: Support .gnu_debugdata for symbols") +Signed-off-by: Ian Rogers +Cc: Aditya Bodkhe +Cc: Adrian Hunter +Cc: Albert Ou +Cc: Alexandre Ghiti +Cc: Andi Kleen +Cc: Athira Rajeev +Cc: Chun-Tse Shao +Cc: Dmitriy Vyukov +Cc: Dr. David Alan Gilbert +Cc: Guo Ren +Cc: Haibo Xu +Cc: Howard Chu +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: John Garry +Cc: Krzysztof Łopatowski +Cc: Leo Yan +Cc: Mark Wielaard +Cc: Namhyung Kim +Cc: Palmer Dabbelt +Cc: Paul Walmsley +Cc: Peter Zijlstra +Cc: Sergei Trofimovich +Cc: Shimin Guo +Cc: Stephen Brennan +Cc: Thomas Falcon +Cc: Will Deacon +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/symbol-elf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c +index 9e820599bab38..9d62386464680 100644 +--- a/tools/perf/util/symbol-elf.c ++++ b/tools/perf/util/symbol-elf.c +@@ -1170,7 +1170,7 @@ int symsrc__init(struct symsrc *ss, struct dso *dso, const char *name, + Elf *embedded = read_gnu_debugdata(dso, elf, name, &new_fd); + + if (!embedded) +- goto out_close; ++ goto out_elf_end; + + elf_end(elf); + close(fd); +-- +2.51.0 + diff --git a/queue-6.18/perf-test-fix-test-case-perftool-testsuite_report-fo.patch b/queue-6.18/perf-test-fix-test-case-perftool-testsuite_report-fo.patch new file mode 100644 index 00000000000..8778ed871d6 --- /dev/null +++ b/queue-6.18/perf-test-fix-test-case-perftool-testsuite_report-fo.patch @@ -0,0 +1,114 @@ +From 988397d2ce9b22c76af55432b755a04370063e35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 16:32:56 +0100 +Subject: perf test: Fix test case perftool-testsuite_report for s390 + +From: Thomas Richter + +[ Upstream commit 3d012b8614ee020666f3dd15af9f65dc487e3f5f ] + +Test case perftool-testsuite_report fails on s390 for some time +now. + +Root cause is a time out which is too tight for large s390 machines. +The time out value addr2line_timeout_ms is per default set to 1 second. + +This is the maximum time the function read_addr2line_record() waits for +a reply from the forked off tool addr2line, which is started as a child +in interactive mode. + +It reads stdin (an address in hexadecimal) and replies on stdout with +function name, file name and line number. This might take more than one +second. + +However one second is not always enough and the reply from addr2line +tool is not received. Function read_addr2line_record() fails and emits +a warning, which is not expected by the test case. It fails. + +Output before: + + # perf test -F 133 + -- [ PASS ] -- perf_report :: setup :: prepare the perf.data file + ================== + [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 0.087 MB \ + /tmp/perftool-testsuite_report.FHz/perf_report/perf.data.1 \ + (207 samples) ] + ================== + -- [ PASS ] -- perf_report :: setup :: prepare the perf.data.1 file + ## [ PASS ] ## perf_report :: setup SUMMARY + -- [ SKIP ] -- perf_report :: test_basic :: help message :: testcase skipped + Line did not match any pattern: "cmd__addr2line /usr/lib/debug/lib/modules/ + 6.19.0-20260205.rc8.git366.9845cf73f7db.300.fc43.s390x+next/ + vmlinux: could not read first record" + Line did not match any pattern: "cmd__addr2line /usr/lib/debug/lib/modules/ + 6.19.0-20260205.rc8.git366.9845cf73f7db.300.fc43.s390x+next/ + vmlinux: could not read first record" + -- [ FAIL ] -- perf_report :: test_basic :: basic execution + (output regexp parsing) + .... + 133: perftool-testsuite_report : FAILED! + +Output after: + + # ./perf test -F 133 + -- [ PASS ] -- perf_report :: setup :: prepare the perf.data file + ================== + [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 0.087 MB \ + /tmp/perftool-testsuite_report.Mlp/perf_report/perf.data.1 + (188 samples) ] + ================== + -- [ PASS ] -- perf_report :: setup :: prepare the perf.data.1 file + ## [ PASS ] ## perf_report :: setup SUMMARY + -- [ SKIP ] -- perf_report :: test_basic :: help message :: testcase skipped + -- [ PASS ] -- perf_report :: test_basic :: basic execution + -- [ PASS ] -- perf_report :: test_basic :: number of samples + -- [ PASS ] -- perf_report :: test_basic :: header + -- [ PASS ] -- perf_report :: test_basic :: header timestamp + -- [ PASS ] -- perf_report :: test_basic :: show CPU utilization + -- [ PASS ] -- perf_report :: test_basic :: pid + -- [ PASS ] -- perf_report :: test_basic :: non-existing symbol + -- [ PASS ] -- perf_report :: test_basic :: symbol filter + -- [ PASS ] -- perf_report :: test_basic :: latency header + -- [ PASS ] -- perf_report :: test_basic :: default report for latency profile + -- [ PASS ] -- perf_report :: test_basic :: latency report for latency profile + -- [ PASS ] -- perf_report :: test_basic :: parallelism histogram + ## [ PASS ] ## perf_report :: test_basic SUMMARY + 133: perftool-testsuite_report : Ok + # + +Fixes: 257046a36750a6db ("perf srcline: Fallback between addr2line implementations") +Reviewed-by: Jan Polensky +Signed-off-by: Thomas Richter +Cc: Alexander Gordeev +Cc: Heiko Carstens +Cc: Ian Rogers +Cc: linux-s390@vger.kernel.org +Cc: Namhyung Kim +Cc: Sumanth Korikkar +Cc: Vasily Gorbik +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/addr2line.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/addr2line.c b/tools/perf/util/addr2line.c +index f2d94a3272d71..a8b39f4f202b6 100644 +--- a/tools/perf/util/addr2line.c ++++ b/tools/perf/util/addr2line.c +@@ -18,8 +18,8 @@ + + #define MAX_INLINE_NEST 1024 + +-/* If addr2line doesn't return data for 1 second then timeout. */ +-int addr2line_timeout_ms = 1 * 1000; ++/* If addr2line doesn't return data for 5 seconds then timeout. */ ++int addr2line_timeout_ms = 5 * 1000; + + static int filename_split(char *filename, unsigned int *line_nr) + { +-- +2.51.0 + diff --git a/queue-6.18/perf-test-stat-tests-fix-for-virtualized-machines.patch b/queue-6.18/perf-test-stat-tests-fix-for-virtualized-machines.patch new file mode 100644 index 00000000000..b99c9d98122 --- /dev/null +++ b/queue-6.18/perf-test-stat-tests-fix-for-virtualized-machines.patch @@ -0,0 +1,80 @@ +From 79f854f2d2b61869b3dd632ae4aebad3286fc97d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 14:32:16 +0100 +Subject: perf test stat tests: Fix for virtualized machines + +From: Thomas Richter + +[ Upstream commit e272628902c1c96731e2d9f62a7fc77767686eb0 ] + +On s390 'perf test's 'perf stat tests', subtest test_hybrid fails for +z/VM systems. The root cause is this statement: + + $(perf stat -a -- sleep 0.1 2>&1 |\ + grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* -c) + +The 'perf stat' output on a s390 z/VM system is + + # perf stat -a -- sleep 0.1 2>&1 + Performance counter stats for 'system wide': + + 56 context-switches # 46.3 cs/sec cs_per_second + 1,210.41 msec cpu-clock # 11.9 CPUs CPUs_utilized + 12 cpu-migrations # 9.9 migrations/sec ... + 81 page-faults # 66.9 faults/sec ... + + 0.100891009 seconds time elapsed + +The grep command does not match any single line and exits with error +code 1. + +As the bash script is executed with 'set -e', it aborts with the first +error code being non-zero. + +Fix this and use 'wc -l' to count matching lines instead of 'grep ... -c'. + +Output before: + + # perf test 102 + 102: perf stat tests : FAILED! + # + +Output after: + + # perf test 102 + 102: perf stat tests : Ok + # + +Fixes: bb6e7cb11d97ce19 ("perf tools: Add fallback for exclude_guest") +Reviewed-by: Ian Rogers +Reviewed-by: James Clark +Signed-off-by: Thomas Richter +Cc: Alexander Gordeev +Cc: Heiko Carstens +Cc: Jan Polensky +Cc: linux-s390@vger.kernel.org +Cc: Namhyung Kim +Cc: Sumanth Korikkar +Cc: Vasily Gorbik +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/stat.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh +index 985adc02749e2..d72d16d0b8c46 100755 +--- a/tools/perf/tests/shell/stat.sh ++++ b/tools/perf/tests/shell/stat.sh +@@ -196,7 +196,7 @@ test_hybrid() { + fi + + # Run default Perf stat +- cycles_events=$(perf stat -a -- sleep 0.1 2>&1 | grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* " -c) ++ cycles_events=$(perf stat -a -- sleep 0.1 2>&1 | grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* " | wc -l) + + # The expectation is that default output will have a cycles events on each + # hybrid PMU. In situations with no cycles PMU events, like virtualized, this +-- +2.51.0 + diff --git a/queue-6.18/perf-test-stat-update-test-expectations-and-events.patch b/queue-6.18/perf-test-stat-update-test-expectations-and-events.patch new file mode 100644 index 00000000000..94707cd7786 --- /dev/null +++ b/queue-6.18/perf-test-stat-update-test-expectations-and-events.patch @@ -0,0 +1,58 @@ +From 063dff0cdd35a0dbc29d02ee2e0692a8c732333f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Nov 2025 13:22:04 -0800 +Subject: perf test stat: Update test expectations and events + +From: Ian Rogers + +[ Upstream commit a48cd551d7436be3b1bd65c63a6d00163f7e7706 ] + +test_stat_record_report and test_stat_record_script used default +output which triggers a bug when sending metrics. As this isn't +relevant to the test switch to using named software events. + +Update the match in test_hybrid as the cycles event is now cpu-cycles +to workaround potential ARM issues. + +Signed-off-by: Ian Rogers +Signed-off-by: Namhyung Kim +Stable-dep-of: e272628902c1 ("perf test stat tests: Fix for virtualized machines") +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/stat.sh | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh +index 8a100a7f2dc17..985adc02749e2 100755 +--- a/tools/perf/tests/shell/stat.sh ++++ b/tools/perf/tests/shell/stat.sh +@@ -18,7 +18,7 @@ test_default_stat() { + + test_stat_record_report() { + echo "stat record and report test" +- if ! perf stat record -o - true | perf stat report -i - 2>&1 | \ ++ if ! perf stat record -e task-clock -o - true | perf stat report -i - 2>&1 | \ + grep -E -q "Performance counter stats for 'pipe':" + then + echo "stat record and report test [Failed]" +@@ -30,7 +30,7 @@ test_stat_record_report() { + + test_stat_record_script() { + echo "stat record and script test" +- if ! perf stat record -o - true | perf script -i - 2>&1 | \ ++ if ! perf stat record -e task-clock -o - true | perf script -i - 2>&1 | \ + grep -E -q "CPU[[:space:]]+THREAD[[:space:]]+VAL[[:space:]]+ENA[[:space:]]+RUN[[:space:]]+TIME[[:space:]]+EVENT" + then + echo "stat record and script test [Failed]" +@@ -196,7 +196,7 @@ test_hybrid() { + fi + + # Run default Perf stat +- cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/[uH]*| cycles[:uH]* " -c) ++ cycles_events=$(perf stat -a -- sleep 0.1 2>&1 | grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* " -c) + + # The expectation is that default output will have a cycles events on each + # hybrid PMU. In situations with no cycles PMU events, like virtualized, this +-- +2.51.0 + diff --git a/queue-6.18/perf-tests-sched-avoid-error-in-cleanup-on-loaded-ma.patch b/queue-6.18/perf-tests-sched-avoid-error-in-cleanup-on-loaded-ma.patch new file mode 100644 index 00000000000..51f8e8d2fdc --- /dev/null +++ b/queue-6.18/perf-tests-sched-avoid-error-in-cleanup-on-loaded-ma.patch @@ -0,0 +1,51 @@ +From bf49db9a53cf1822f3a36e38a2233d2da41f90e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 09:53:37 -0800 +Subject: perf tests sched: Avoid error in cleanup on loaded machines + +From: Ian Rogers + +[ Upstream commit c5e47e4d00fbc15f2390bb6ed8d9c21836363291 ] + +The stop_noploops function will kill the noploop processes that are +running for 10 seconds. + +On a loaded machine they may have already terminated meaning the kill +will return an error of no such process. + +This doesn't matter and so ignore the error to avoid the test +terminating in the cleanup. + +Fixes: 0e22c5ca44e68798 ("perf test: Add sched latency and script shell tests") +Signed-off-by: Ian Rogers +Tested-by: Arnaldo Carvalho de Melo +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/sched.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/tests/shell/sched.sh b/tools/perf/tests/shell/sched.sh +index b9b81eaf856e6..b9637069adb1f 100755 +--- a/tools/perf/tests/shell/sched.sh ++++ b/tools/perf/tests/shell/sched.sh +@@ -53,7 +53,7 @@ start_noploops() { + } + + cleanup_noploops() { +- kill "$PID1" "$PID2" ++ kill "$PID1" "$PID2" || true + } + + test_sched_record() { +-- +2.51.0 + diff --git a/queue-6.18/perf-tools-get-debug-info-of-dso-properly.patch b/queue-6.18/perf-tools-get-debug-info-of-dso-properly.patch new file mode 100644 index 00000000000..0c423e77ea9 --- /dev/null +++ b/queue-6.18/perf-tools-get-debug-info-of-dso-properly.patch @@ -0,0 +1,169 @@ +From 3505675aadbccac736b32c617a9c98334e8dc26f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 15:37:57 -0800 +Subject: perf tools: Get debug info of DSO properly + +From: Namhyung Kim + +[ Upstream commit 069e603d8248dac98b1ef2909e2f1c4169b9da11 ] + +The dso__debuginfo() just used the path name to open the file but it may +be outdated. It should check build-ID and use the file in the build-ID +cache if available rather than just using the path name. + +Let's factor out dso__get_filename() to avoid code duplicate. + +Fixes: 53a61a6ca279165d ("perf annotate: Add dso__debuginfo() helper") +Reviewed-by: Ian Rogers +Signed-off-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/dso.c | 63 ++++++++++++++++++++++++++++++++----------- + tools/perf/util/dso.h | 11 ++------ + 2 files changed, 50 insertions(+), 24 deletions(-) + +diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c +index 344e689567ee1..dc202d4943721 100644 +--- a/tools/perf/util/dso.c ++++ b/tools/perf/util/dso.c +@@ -111,7 +111,7 @@ bool dso__is_object_file(const struct dso *dso) + + int dso__read_binary_type_filename(const struct dso *dso, + enum dso_binary_type type, +- char *root_dir, char *filename, size_t size) ++ const char *root_dir, char *filename, size_t size) + { + char build_id_hex[SBUILD_ID_SIZE]; + int ret = 0; +@@ -563,20 +563,15 @@ char *dso__filename_with_chroot(const struct dso *dso, const char *filename) + return filename_with_chroot(nsinfo__pid(dso__nsinfo_const(dso)), filename); + } + +-static int __open_dso(struct dso *dso, struct machine *machine) +- EXCLUSIVE_LOCKS_REQUIRED(_dso__data_open_lock) ++static char *dso__get_filename(struct dso *dso, const char *root_dir, ++ bool *decomp) + { +- int fd = -EINVAL; +- char *root_dir = (char *)""; + char *name = malloc(PATH_MAX); +- bool decomp = false; + +- if (!name) +- return -ENOMEM; ++ *decomp = false; + +- mutex_lock(dso__lock(dso)); +- if (machine) +- root_dir = machine->root_dir; ++ if (name == NULL) ++ return NULL; + + if (dso__read_binary_type_filename(dso, dso__binary_type(dso), + root_dir, name, PATH_MAX)) +@@ -601,20 +596,38 @@ static int __open_dso(struct dso *dso, struct machine *machine) + size_t len = sizeof(newpath); + + if (dso__decompress_kmodule_path(dso, name, newpath, len) < 0) { +- fd = -(*dso__load_errno(dso)); ++ errno = *dso__load_errno(dso); + goto out; + } + +- decomp = true; ++ *decomp = true; + strcpy(name, newpath); + } ++ return name; ++ ++out: ++ free(name); ++ return NULL; ++} + +- fd = do_open(name); ++static int __open_dso(struct dso *dso, struct machine *machine) ++ EXCLUSIVE_LOCKS_REQUIRED(_dso__data_open_lock) ++{ ++ int fd = -EINVAL; ++ char *name; ++ bool decomp = false; ++ ++ mutex_lock(dso__lock(dso)); ++ ++ name = dso__get_filename(dso, machine ? machine->root_dir : "", &decomp); ++ if (name) ++ fd = do_open(name); ++ else ++ fd = -errno; + + if (decomp) + unlink(name); + +-out: + mutex_unlock(dso__lock(dso)); + free(name); + return fd; +@@ -1910,3 +1923,23 @@ const u8 *dso__read_symbol(struct dso *dso, const char *symfs_filename, + return __dso__read_symbol(dso, symfs_filename, start, len, + out_buf, out_buf_len, is_64bit); + } ++ ++struct debuginfo *dso__debuginfo(struct dso *dso) ++{ ++ char *name; ++ bool decomp = false; ++ struct debuginfo *dinfo = NULL; ++ ++ mutex_lock(dso__lock(dso)); ++ ++ name = dso__get_filename(dso, "", &decomp); ++ if (name) ++ dinfo = debuginfo__new(name); ++ ++ if (decomp) ++ unlink(name); ++ ++ mutex_unlock(dso__lock(dso)); ++ free(name); ++ return dinfo; ++} +diff --git a/tools/perf/util/dso.h b/tools/perf/util/dso.h +index f8ccb9816b89c..54e470dd07305 100644 +--- a/tools/perf/util/dso.h ++++ b/tools/perf/util/dso.h +@@ -766,7 +766,7 @@ int dso__kernel_module_get_build_id(struct dso *dso, const char *root_dir); + + char dso__symtab_origin(const struct dso *dso); + int dso__read_binary_type_filename(const struct dso *dso, enum dso_binary_type type, +- char *root_dir, char *filename, size_t size); ++ const char *root_dir, char *filename, size_t size); + bool is_kernel_module(const char *pathname, int cpumode); + bool dso__needs_decompress(struct dso *dso); + int dso__decompress_kmodule_fd(struct dso *dso, const char *name); +@@ -915,14 +915,7 @@ u64 dso__findnew_global_type(struct dso *dso, u64 addr, u64 offset); + bool perf_pid_map_tid(const char *dso_name, int *tid); + bool is_perf_pid_map_name(const char *dso_name); + +-/* +- * In the future, we may get debuginfo using build-ID (w/o path). +- * Add this helper is for the smooth conversion. +- */ +-static inline struct debuginfo *dso__debuginfo(struct dso *dso) +-{ +- return debuginfo__new(dso__long_name(dso)); +-} ++struct debuginfo *dso__debuginfo(struct dso *dso); + + const u8 *dso__read_symbol(struct dso *dso, const char *symfs_filename, + const struct map *map, const struct symbol *sym, +-- +2.51.0 + diff --git a/queue-6.18/perf-unwind-libdw-fix-invalid-reference-counts.patch b/queue-6.18/perf-unwind-libdw-fix-invalid-reference-counts.patch new file mode 100644 index 00000000000..779ce0279bc --- /dev/null +++ b/queue-6.18/perf-unwind-libdw-fix-invalid-reference-counts.patch @@ -0,0 +1,59 @@ +From afdcd12bdc167725a47ddb2ed78676e46cc43a9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 20:13:32 -0800 +Subject: perf unwind-libdw: Fix invalid reference counts + +From: Ian Rogers + +[ Upstream commit f815fc0c66e777c727689666cfb46b8d461c2f99 ] + +The addition of addr_location__exit() causes use-after put on the maps +and map references in the unwind info. Add the gets and then add the +map_symbol__exit() calls. + +Fixes: 0dd5041c9a0eaf8c ("perf addr_location: Add init/exit/copy functions") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Stephen Brennan +Cc: Tony Jones +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/unwind-libdw.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c +index ae70fb56a0572..3ff427a49e4c5 100644 +--- a/tools/perf/util/unwind-libdw.c ++++ b/tools/perf/util/unwind-libdw.c +@@ -136,8 +136,8 @@ static int entry(u64 ip, struct unwind_info *ui) + } + + e->ip = ip; +- e->ms.maps = al.maps; +- e->ms.map = al.map; ++ e->ms.maps = maps__get(al.maps); ++ e->ms.map = map__get(al.map); + e->ms.sym = al.sym; + + pr_debug("unwind: %s:ip = 0x%" PRIx64 " (0x%" PRIx64 ")\n", +@@ -325,6 +325,9 @@ int unwind__get_entries(unwind_entry_cb_t cb, void *arg, + if (err) + pr_debug("unwind: failed with '%s'\n", dwfl_errmsg(-1)); + ++ for (i = 0; i < ui->idx; i++) ++ map_symbol__exit(&ui->entries[i].ms); ++ + dwfl_end(ui->dwfl); + free(ui); + return 0; +-- +2.51.0 + diff --git a/queue-6.18/perf-vendor-events-amd-fix-zen-5-mab-allocation-even.patch b/queue-6.18/perf-vendor-events-amd-fix-zen-5-mab-allocation-even.patch new file mode 100644 index 00000000000..afc94418628 --- /dev/null +++ b/queue-6.18/perf-vendor-events-amd-fix-zen-5-mab-allocation-even.patch @@ -0,0 +1,66 @@ +From 66ba288d4932e6190311231d11046814cb2fb750 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 13:39:46 +0530 +Subject: perf vendor events amd: Fix Zen 5 MAB allocation events + +From: Sandipan Das + +[ Upstream commit 76b2cf07a6d2a836108f9c2486d76599f7adf6e8 ] + +The unit masks for PMCx041 vary across different generations of Zen +processors. + +Fix the Zen 5 events based on PMCx041 as they incorrectly use the same +unit masks as that of Zen 4. + +Fixes: 45c072f2537ab07b ("perf vendor events amd: Add Zen 5 core events") +Reported-by: Suyash Mahar +Reviewed-by: Ian Rogers +Signed-off-by: Sandipan Das +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ananth Narayan +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Ravi Bangoria +Cc: Sandipan Das +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/pmu-events/arch/x86/amdzen5/load-store.json | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json b/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json +index ff6627a778057..06bbaea159259 100644 +--- a/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json ++++ b/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json +@@ -70,19 +70,19 @@ + "EventName": "ls_mab_alloc.load_store_allocations", + "EventCode": "0x41", + "BriefDescription": "Miss Address Buffer (MAB) entries allocated by a Load-Store (LS) pipe for load-store allocations.", +- "UMask": "0x3f" ++ "UMask": "0x07" + }, + { + "EventName": "ls_mab_alloc.hardware_prefetcher_allocations", + "EventCode": "0x41", + "BriefDescription": "Miss Address Buffer (MAB) entries allocated by a Load-Store (LS) pipe for hardware prefetcher allocations.", +- "UMask": "0x40" ++ "UMask": "0x08" + }, + { + "EventName": "ls_mab_alloc.all_allocations", + "EventCode": "0x41", + "BriefDescription": "Miss Address Buffer (MAB) entries allocated by a Load-Store (LS) pipe for all types of allocations.", +- "UMask": "0x7f" ++ "UMask": "0x0f" + }, + { + "EventName": "ls_dmnd_fills_from_sys.local_l2", +-- +2.51.0 + diff --git a/queue-6.18/perf-x86-cstate-add-airmont-np.patch b/queue-6.18/perf-x86-cstate-add-airmont-np.patch new file mode 100644 index 00000000000..fd792caeea7 --- /dev/null +++ b/queue-6.18/perf-x86-cstate-add-airmont-np.patch @@ -0,0 +1,36 @@ +From 7f414f03ad393cde736ea413ecada6d427b9a6d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 08:48:46 +0100 +Subject: perf/x86/cstate: Add Airmont NP + +From: Martin Schiller + +[ Upstream commit 3006911f284d769b0f66c12b39da130325ef1440 ] + +From the perspective of Intel cstate residency counters, the Airmont NP +(aka Lightning Mountain) is identical to the Airmont. + +Signed-off-by: Martin Schiller +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Dapeng Mi +Link: https://patch.msgid.link/20251124074846.9653-4-ms@dev.tdt.de +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/cstate.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c +index 6f5286a99e0c3..15db12647b2f8 100644 +--- a/arch/x86/events/intel/cstate.c ++++ b/arch/x86/events/intel/cstate.c +@@ -598,6 +598,7 @@ static const struct x86_cpu_id intel_cstates_match[] __initconst = { + X86_MATCH_VFM(INTEL_ATOM_SILVERMONT, &slm_cstates), + X86_MATCH_VFM(INTEL_ATOM_SILVERMONT_D, &slm_cstates), + X86_MATCH_VFM(INTEL_ATOM_AIRMONT, &slm_cstates), ++ X86_MATCH_VFM(INTEL_ATOM_AIRMONT_NP, &slm_cstates), + + X86_MATCH_VFM(INTEL_BROADWELL, &snb_cstates), + X86_MATCH_VFM(INTEL_BROADWELL_D, &snb_cstates), +-- +2.51.0 + diff --git a/queue-6.18/perf-x86-intel-add-airmont-np.patch b/queue-6.18/perf-x86-intel-add-airmont-np.patch new file mode 100644 index 00000000000..1bb94423d82 --- /dev/null +++ b/queue-6.18/perf-x86-intel-add-airmont-np.patch @@ -0,0 +1,36 @@ +From ed2d85c90a06e892517f3e6211f9c59d79342f37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 08:48:45 +0100 +Subject: perf/x86/intel: Add Airmont NP + +From: Martin Schiller + +[ Upstream commit a08340fd291671c54d379d285b2325490ce90ddd ] + +The Intel / MaxLinear Airmont NP (aka Lightning Mountain) supports the +same architectual and non-architecural events as Airmont. + +Signed-off-by: Martin Schiller +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Dapeng Mi +Link: https://patch.msgid.link/20251124074846.9653-3-ms@dev.tdt.de +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index 32d551f2646a7..55d8df7b0fdaa 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -7029,6 +7029,7 @@ __init int intel_pmu_init(void) + case INTEL_ATOM_SILVERMONT_D: + case INTEL_ATOM_SILVERMONT_MID: + case INTEL_ATOM_AIRMONT: ++ case INTEL_ATOM_AIRMONT_NP: + case INTEL_ATOM_SILVERMONT_MID2: + memcpy(hw_cache_event_ids, slm_hw_cache_event_ids, + sizeof(hw_cache_event_ids)); +-- +2.51.0 + diff --git a/queue-6.18/perf-x86-msr-add-airmont-np.patch b/queue-6.18/perf-x86-msr-add-airmont-np.patch new file mode 100644 index 00000000000..55a556670c2 --- /dev/null +++ b/queue-6.18/perf-x86-msr-add-airmont-np.patch @@ -0,0 +1,36 @@ +From 9fe197f78e19003b1889045ccf10846329f6640f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 08:48:44 +0100 +Subject: perf/x86/msr: Add Airmont NP + +From: Martin Schiller + +[ Upstream commit 63dbadcafc1f4d1da796a8e2c0aea1e561f79ece ] + +Like Airmont, the Airmont NP (aka Intel / MaxLinear Lightning Mountain) +supports SMI_COUNT MSR. + +Signed-off-by: Martin Schiller +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Dapeng Mi +Link: https://patch.msgid.link/20251124074846.9653-2-ms@dev.tdt.de +Signed-off-by: Sasha Levin +--- + arch/x86/events/msr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/events/msr.c b/arch/x86/events/msr.c +index 7f5007a4752a1..8052596b85036 100644 +--- a/arch/x86/events/msr.c ++++ b/arch/x86/events/msr.c +@@ -78,6 +78,7 @@ static bool test_intel(int idx, void *data) + case INTEL_ATOM_SILVERMONT: + case INTEL_ATOM_SILVERMONT_D: + case INTEL_ATOM_AIRMONT: ++ case INTEL_ATOM_AIRMONT_NP: + + case INTEL_ATOM_GOLDMONT: + case INTEL_ATOM_GOLDMONT_D: +-- +2.51.0 + diff --git a/queue-6.18/phy-cadence-torrent-restore-parent-clock-for-refclk-.patch b/queue-6.18/phy-cadence-torrent-restore-parent-clock-for-refclk-.patch new file mode 100644 index 00000000000..e25e411a2e1 --- /dev/null +++ b/queue-6.18/phy-cadence-torrent-restore-parent-clock-for-refclk-.patch @@ -0,0 +1,77 @@ +From 8ed5a77c35e1a6beea54225a868f9623f8777c92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 15:24:25 +0100 +Subject: phy: cadence-torrent: restore parent clock for refclk during resume + +From: Thomas Richard (TI.com) + +[ Upstream commit 434e1a0ee145d0389b192252be4c993f86cf1134 ] + +While suspend and resume, parent clock config for refclk was getting lost. +So save and restore it in suspend and resume operations. + +Reviewed-by: Neil Armstrong +Signed-off-by: Thomas Richard (TI.com) +Link: https://patch.msgid.link/20251216-phy-cadence-torrent-resume-restore-refclk-parent-v3-1-8a7ed84b47e3@bootlin.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/cadence/phy-cadence-torrent.c | 23 +++++++++++++++++++++++ + 1 file changed, 23 insertions(+) + +diff --git a/drivers/phy/cadence/phy-cadence-torrent.c b/drivers/phy/cadence/phy-cadence-torrent.c +index 37fa4bad6bd72..877f22177c699 100644 +--- a/drivers/phy/cadence/phy-cadence-torrent.c ++++ b/drivers/phy/cadence/phy-cadence-torrent.c +@@ -397,6 +397,7 @@ struct cdns_torrent_refclk_driver { + struct clk_hw hw; + struct regmap_field *cmn_fields[REFCLK_OUT_NUM_CMN_CONFIG]; + struct clk_init_data clk_data; ++ u8 parent_index; + }; + + #define to_cdns_torrent_refclk_driver(_hw) \ +@@ -3326,11 +3327,29 @@ static const struct cdns_torrent_vals sgmii_qsgmii_xcvr_diag_ln_vals = { + .num_regs = ARRAY_SIZE(sgmii_qsgmii_xcvr_diag_ln_regs), + }; + ++static void cdns_torrent_refclk_driver_suspend(struct cdns_torrent_phy *cdns_phy) ++{ ++ struct clk_hw *hw = cdns_phy->clk_hw_data->hws[CDNS_TORRENT_REFCLK_DRIVER]; ++ struct cdns_torrent_refclk_driver *refclk_driver = to_cdns_torrent_refclk_driver(hw); ++ ++ refclk_driver->parent_index = cdns_torrent_refclk_driver_get_parent(hw); ++} ++ ++static int cdns_torrent_refclk_driver_resume(struct cdns_torrent_phy *cdns_phy) ++{ ++ struct clk_hw *hw = cdns_phy->clk_hw_data->hws[CDNS_TORRENT_REFCLK_DRIVER]; ++ struct cdns_torrent_refclk_driver *refclk_driver = to_cdns_torrent_refclk_driver(hw); ++ ++ return cdns_torrent_refclk_driver_set_parent(hw, refclk_driver->parent_index); ++} ++ + static int cdns_torrent_phy_suspend_noirq(struct device *dev) + { + struct cdns_torrent_phy *cdns_phy = dev_get_drvdata(dev); + int i; + ++ cdns_torrent_refclk_driver_suspend(cdns_phy); ++ + reset_control_assert(cdns_phy->phy_rst); + reset_control_assert(cdns_phy->apb_rst); + for (i = 0; i < cdns_phy->nsubnodes; i++) +@@ -3352,6 +3371,10 @@ static int cdns_torrent_phy_resume_noirq(struct device *dev) + int node = cdns_phy->nsubnodes; + int ret, i; + ++ ret = cdns_torrent_refclk_driver_resume(cdns_phy); ++ if (ret) ++ return ret; ++ + ret = cdns_torrent_clk(cdns_phy); + if (ret) + return ret; +-- +2.51.0 + diff --git a/queue-6.18/phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch b/queue-6.18/phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch new file mode 100644 index 00000000000..0a6ed995bcb --- /dev/null +++ b/queue-6.18/phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch @@ -0,0 +1,38 @@ +From 22a0dce32d97fd8e1fc146c15eae57c468f24d1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 19:17:12 +0800 +Subject: phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature + +From: Xu Yang + +[ Upstream commit 27ee0869d77b2cb404770ac49bdceae3aedf658b ] + +Disabling PHYs in runtime usually causes the client with external abort +exception or similar issue due to lack of API to notify clients about PHY +removal. This patch removes the possibility to unbind i.MX PHY drivers in +runtime. + +Signed-off-by: Xu Yang +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20260120111712.3159782-1-xu.yang_2@nxp.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c +index f6cac4c049c43..bd37b6cb69cdc 100644 +--- a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c ++++ b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c +@@ -711,6 +711,7 @@ static struct platform_driver imx8mq_usb_phy_driver = { + .driver = { + .name = "imx8mq-usb-phy", + .of_match_table = imx8mq_usb_phy_of_match, ++ .suppress_bind_attrs = true, + } + }; + module_platform_driver(imx8mq_usb_phy_driver); +-- +2.51.0 + diff --git a/queue-6.18/phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch b/queue-6.18/phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch new file mode 100644 index 00000000000..beed2652970 --- /dev/null +++ b/queue-6.18/phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch @@ -0,0 +1,43 @@ +From d5d60e55a5dfaf68947f69664ab445c28b97ea96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 15:06:43 +0000 +Subject: phy: mvebu-cp110-utmi: fix dr_mode property read from dts + +From: Aleksandar Gerasimovski + +[ Upstream commit e2ce913452ab56b3330539cc443b97b7ea8c3a1a ] + +The problem with the current implementation is that it does not consider +that the USB controller can have multiple PHY handles with different +arguments count, as for example we have in our cn9131 based platform: +"phys = <&cp0_comphy1 0>, <&cp0_utmi0>;". + +In such case calling "of_usb_get_dr_mode_by_phy" with -1 (no phy-cells) +leads to not proper phy detection, taking the "marvell,cp110-utmi-phy" +dts definition we can call the "of_usb_get_dr_mode_by_phy" with 0 +(#phy-cells = <0>) and safely look for that phy. + +Signed-off-by: Aleksandar Gerasimovski +Link: https://patch.msgid.link/20260106150643.922110-1-aleksandar.gerasimovski@belden.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/marvell/phy-mvebu-cp110-utmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c +index 59903f86b13f5..dd3e515a8e865 100644 +--- a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c ++++ b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c +@@ -338,7 +338,7 @@ static int mvebu_cp110_utmi_phy_probe(struct platform_device *pdev) + return -ENOMEM; + } + +- port->dr_mode = of_usb_get_dr_mode_by_phy(child, -1); ++ port->dr_mode = of_usb_get_dr_mode_by_phy(child, 0); + if ((port->dr_mode != USB_DR_MODE_HOST) && + (port->dr_mode != USB_DR_MODE_PERIPHERAL)) { + dev_err(&pdev->dev, +-- +2.51.0 + diff --git a/queue-6.18/phy-ti-phy-j721e-wiz-restore-mux-selection-during-re.patch b/queue-6.18/phy-ti-phy-j721e-wiz-restore-mux-selection-during-re.patch new file mode 100644 index 00000000000..20a797486bf --- /dev/null +++ b/queue-6.18/phy-ti-phy-j721e-wiz-restore-mux-selection-during-re.patch @@ -0,0 +1,71 @@ +From af6b90edf83d93a1423632e9383fe54fc91925fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 15:26:20 +0100 +Subject: phy: ti: phy-j721e-wiz: restore mux selection during resume + +From: Thomas Richard (TI.com) + +[ Upstream commit 53f6240e88c9e8715e09fc19942f13450db4cb33 ] + +While suspend and resume mux selection was getting lost. So save and +restore these values in suspend and resume operations. + +Signed-off-by: Thomas Richard (TI.com) +Link: https://patch.msgid.link/20251216-phy-ti-phy-j721e-wiz-resume-restore-mux-sel-v1-1-771d564db966@bootlin.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/ti/phy-j721e-wiz.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/ti/phy-j721e-wiz.c b/drivers/phy/ti/phy-j721e-wiz.c +index a8b440c6c46bb..ba31b0a1f7f79 100644 +--- a/drivers/phy/ti/phy-j721e-wiz.c ++++ b/drivers/phy/ti/phy-j721e-wiz.c +@@ -393,6 +393,7 @@ struct wiz { + struct clk *output_clks[WIZ_MAX_OUTPUT_CLOCKS]; + struct clk_onecell_data clk_data; + const struct wiz_data *data; ++ int mux_sel_status[WIZ_MUX_NUM_CLOCKS]; + }; + + static int wiz_reset(struct wiz *wiz) +@@ -1654,11 +1655,25 @@ static void wiz_remove(struct platform_device *pdev) + pm_runtime_disable(dev); + } + ++static int wiz_suspend_noirq(struct device *dev) ++{ ++ struct wiz *wiz = dev_get_drvdata(dev); ++ int i; ++ ++ for (i = 0; i < WIZ_MUX_NUM_CLOCKS; i++) ++ regmap_field_read(wiz->mux_sel_field[i], &wiz->mux_sel_status[i]); ++ ++ return 0; ++} ++ + static int wiz_resume_noirq(struct device *dev) + { + struct device_node *node = dev->of_node; + struct wiz *wiz = dev_get_drvdata(dev); +- int ret; ++ int ret, i; ++ ++ for (i = 0; i < WIZ_MUX_NUM_CLOCKS; i++) ++ regmap_field_write(wiz->mux_sel_field[i], wiz->mux_sel_status[i]); + + /* Enable supplemental Control override if available */ + if (wiz->sup_legacy_clk_override) +@@ -1680,7 +1695,7 @@ static int wiz_resume_noirq(struct device *dev) + return ret; + } + +-static DEFINE_NOIRQ_DEV_PM_OPS(wiz_pm_ops, NULL, wiz_resume_noirq); ++static DEFINE_NOIRQ_DEV_PM_OPS(wiz_pm_ops, wiz_suspend_noirq, wiz_resume_noirq); + + static struct platform_driver wiz_driver = { + .probe = wiz_probe, +-- +2.51.0 + diff --git a/queue-6.18/pinctrl-mediatek-make-devm-allocations-safer-and-cle.patch b/queue-6.18/pinctrl-mediatek-make-devm-allocations-safer-and-cle.patch new file mode 100644 index 00000000000..a34058c598b --- /dev/null +++ b/queue-6.18/pinctrl-mediatek-make-devm-allocations-safer-and-cle.patch @@ -0,0 +1,108 @@ +From 71c6fb5b143641e087d568dc69d14ac23b3e1c44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Dec 2025 18:02:17 +0800 +Subject: pinctrl: mediatek: make devm allocations safer and clearer in + mtk_eint_do_init() + +From: Liang Jie + +[ Upstream commit 255b721c96046d4c57fa2268e4c72607868ce91f ] + +mtk_eint_do_init() allocates several pointer arrays which are then +populated in a per-instance loop and freed on error. The arrays are +currently allocated with devm_kmalloc(), so their entries are left +uninitialised until the per-instance allocations succeed. + +On a failure in the middle of the loop, the error path iterates over +the full nbase range and calls devm_kfree() on each element. For +indices which were never initialised, the corresponding array entries +contain stack garbage. If any of those happen to be non-zero, +devm_kfree() will pass them to devres_destroy(), which will WARN +because there is no matching devm_kmalloc() resource for such bogus +pointers. + +Improve the robustness and readability by: + + - Using devm_kcalloc() for the pointer arrays so that all entries + start as NULL, ensuring that only genuinely initialised elements + may be freed and preventing spurious WARN_ON()s in the error path. + - Switching the allocations to sizeof(*ptr) / sizeof(**ptr) forms, + avoiding hard-coded element types and making the code more resilient + to future type changes. + - Dropping the redundant NULL checks before devm_kfree(), as + devm_kfree() safely handles NULL pointers. + +The functional behaviour in the successful initialisation path remains +unchanged, while the error handling becomes simpler and less +error-prone. + +Reviewed-by: fanggeng +Signed-off-by: Liang Jie +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mediatek/mtk-eint.c | 29 +++++++++++++++++------------ + 1 file changed, 17 insertions(+), 12 deletions(-) + +diff --git a/drivers/pinctrl/mediatek/mtk-eint.c b/drivers/pinctrl/mediatek/mtk-eint.c +index 9f175c73613f8..2ea0902b4f660 100644 +--- a/drivers/pinctrl/mediatek/mtk-eint.c ++++ b/drivers/pinctrl/mediatek/mtk-eint.c +@@ -539,24 +539,32 @@ int mtk_eint_do_init(struct mtk_eint *eint, struct mtk_eint_pin *eint_pin) + } + } + +- eint->pin_list = devm_kmalloc(eint->dev, eint->nbase * sizeof(u16 *), GFP_KERNEL); ++ eint->pin_list = devm_kcalloc(eint->dev, eint->nbase, ++ sizeof(*eint->pin_list), GFP_KERNEL); + if (!eint->pin_list) + goto err_pin_list; + +- eint->wake_mask = devm_kmalloc(eint->dev, eint->nbase * sizeof(u32 *), GFP_KERNEL); ++ eint->wake_mask = devm_kcalloc(eint->dev, eint->nbase, ++ sizeof(*eint->wake_mask), GFP_KERNEL); + if (!eint->wake_mask) + goto err_wake_mask; + +- eint->cur_mask = devm_kmalloc(eint->dev, eint->nbase * sizeof(u32 *), GFP_KERNEL); ++ eint->cur_mask = devm_kcalloc(eint->dev, eint->nbase, ++ sizeof(*eint->cur_mask), GFP_KERNEL); + if (!eint->cur_mask) + goto err_cur_mask; + + for (i = 0; i < eint->nbase; i++) { +- eint->pin_list[i] = devm_kzalloc(eint->dev, eint->base_pin_num[i] * sizeof(u16), ++ eint->pin_list[i] = devm_kzalloc(eint->dev, ++ eint->base_pin_num[i] * sizeof(**eint->pin_list), + GFP_KERNEL); + port = DIV_ROUND_UP(eint->base_pin_num[i], 32); +- eint->wake_mask[i] = devm_kzalloc(eint->dev, port * sizeof(u32), GFP_KERNEL); +- eint->cur_mask[i] = devm_kzalloc(eint->dev, port * sizeof(u32), GFP_KERNEL); ++ eint->wake_mask[i] = devm_kzalloc(eint->dev, ++ port * sizeof(**eint->wake_mask), ++ GFP_KERNEL); ++ eint->cur_mask[i] = devm_kzalloc(eint->dev, ++ port * sizeof(**eint->cur_mask), ++ GFP_KERNEL); + if (!eint->pin_list[i] || !eint->wake_mask[i] || !eint->cur_mask[i]) + goto err_eint; + } +@@ -592,12 +600,9 @@ int mtk_eint_do_init(struct mtk_eint *eint, struct mtk_eint_pin *eint_pin) + + err_eint: + for (i = 0; i < eint->nbase; i++) { +- if (eint->cur_mask[i]) +- devm_kfree(eint->dev, eint->cur_mask[i]); +- if (eint->wake_mask[i]) +- devm_kfree(eint->dev, eint->wake_mask[i]); +- if (eint->pin_list[i]) +- devm_kfree(eint->dev, eint->pin_list[i]); ++ devm_kfree(eint->dev, eint->cur_mask[i]); ++ devm_kfree(eint->dev, eint->wake_mask[i]); ++ devm_kfree(eint->dev, eint->pin_list[i]); + } + devm_kfree(eint->dev, eint->cur_mask); + err_cur_mask: +-- +2.51.0 + diff --git a/queue-6.18/pinctrl-renesas-rzt2h-allow-.get_direction-for-irq-f.patch b/queue-6.18/pinctrl-renesas-rzt2h-allow-.get_direction-for-irq-f.patch new file mode 100644 index 00000000000..709880c53f0 --- /dev/null +++ b/queue-6.18/pinctrl-renesas-rzt2h-allow-.get_direction-for-irq-f.patch @@ -0,0 +1,101 @@ +From 083d3f24beb47be9f598d9603f6d1296ae006179 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 17:02:28 +0200 +Subject: pinctrl: renesas: rzt2h: Allow .get_direction() for IRQ function + GPIOs + +From: Cosmin Tanislav + +[ Upstream commit 49b039a61a314c18074c15a7047705399e1240e6 ] + +Setting up an IRQ would normally be done in the .activate() and +.deactivate() ops of the IRQ domain, but for hierarchical IRQ domains +the .activate() and .deactivate() ops are overridden in the +gpiochip_hierarchy_setup_domain_ops() function. + +As such, activating and deactivating need to be done in the .translate() +and .free() ops of the IRQ domain. + +For RZ/T2H and RZ/N2H, interrupts go through the pin controller, into +the ICU, which level-translates them and forwards them to the GIC. + +To use a GPIO as an interrupt it needs to be put into peripheral +function mode 0, which will connect it to the IRQ lines of the ICU. + +The IRQ chip .child_to_parent_hwirq() callback is called as part of the +IRQ fwspec parsing logic (as part of irq_create_of_mapping()) which +happens before the IRQ is requested (as part of gpiochip_lock_as_irq()). + +gpiochip_lock_as_irq() calls gpiod_get_direction() if the +.get_direction() callback is provided to ensure that the GPIO line is +set up as input. + +In our case, IRQ function is separate from GPIO, and both cannot be true +at the same time. + +Return GPIO_LINE_DIRECTION_IN even if pin is in IRQ function to allow +this setup to work. + +Hold the spinlock to ensure atomicity between reading the PMC register +(which determines whether the pin is in GPIO mode or not) and reading +the function of the pin when it is not in GPIO mode. + +Signed-off-by: Cosmin Tanislav +Reviewed-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20251205150234.2958140-3-cosmin-gabriel.tanislav.xa@renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pinctrl-rzt2h.c | 21 ++++++++++++++++++++- + 1 file changed, 20 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/renesas/pinctrl-rzt2h.c b/drivers/pinctrl/renesas/pinctrl-rzt2h.c +index 3872638f5ebb3..3161b2469c362 100644 +--- a/drivers/pinctrl/renesas/pinctrl-rzt2h.c ++++ b/drivers/pinctrl/renesas/pinctrl-rzt2h.c +@@ -51,6 +51,7 @@ + + #define PFC_MASK GENMASK_ULL(5, 0) + #define PFC_PIN_MASK(pin) (PFC_MASK << ((pin) * 8)) ++#define PFC_FUNC_INTERRUPT 0 + + /* + * Use 16 lower bits [15:0] for pin identifier +@@ -486,6 +487,7 @@ static int rzt2h_gpio_get_direction(struct gpio_chip *chip, unsigned int offset) + struct rzt2h_pinctrl *pctrl = gpiochip_get_data(chip); + u8 port = RZT2H_PIN_ID_TO_PORT(offset); + u8 bit = RZT2H_PIN_ID_TO_PIN(offset); ++ u64 reg64; + u16 reg; + int ret; + +@@ -493,8 +495,25 @@ static int rzt2h_gpio_get_direction(struct gpio_chip *chip, unsigned int offset) + if (ret) + return ret; + +- if (rzt2h_pinctrl_readb(pctrl, port, PMC(port)) & BIT(bit)) ++ guard(spinlock_irqsave)(&pctrl->lock); ++ ++ if (rzt2h_pinctrl_readb(pctrl, port, PMC(port)) & BIT(bit)) { ++ /* ++ * When a GPIO is being requested as an IRQ, the pinctrl ++ * framework expects to be able to read the GPIO's direction. ++ * IRQ function is separate from GPIO, and enabling it takes the ++ * pin out of GPIO mode. ++ * At this point, .child_to_parent_hwirq() has already been ++ * called to enable the IRQ function. ++ * Default to input direction for IRQ function. ++ */ ++ reg64 = rzt2h_pinctrl_readq(pctrl, port, PFC(port)); ++ reg64 = (reg64 >> (bit * 8)) & PFC_MASK; ++ if (reg64 == PFC_FUNC_INTERRUPT) ++ return GPIO_LINE_DIRECTION_IN; ++ + return -EINVAL; ++ } + + reg = rzt2h_pinctrl_readw(pctrl, port, PM(port)); + reg = (reg >> (bit * 2)) & PM_MASK; +-- +2.51.0 + diff --git a/queue-6.18/power-sequencing-fix-missing-state_lock-in-pwrseq_po.patch b/queue-6.18/power-sequencing-fix-missing-state_lock-in-pwrseq_po.patch new file mode 100644 index 00000000000..8be9fb8483b --- /dev/null +++ b/queue-6.18/power-sequencing-fix-missing-state_lock-in-pwrseq_po.patch @@ -0,0 +1,49 @@ +From e956c5a60cc5499f1849b6b5caacdcc91010e938 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 18:26:51 +0000 +Subject: power: sequencing: fix missing state_lock in pwrseq_power_on() error + path + +From: Ziyi Guo + +[ Upstream commit e1dccb485c2876ac1318f36ccc0155416c633a48 ] + +pwrseq_power_on() calls pwrseq_unit_disable() when the +post_enable callback fails. However, this call is outside the +scoped_guard(mutex, &pwrseq->state_lock) block that ends. + +pwrseq_unit_disable() has lockdep_assert_held(&pwrseq->state_lock), +which will fail when called from this error path. + +Add the scoped_guard block to cover the post_enable callback and its +error handling to ensure the lock is held when pwrseq_unit_disable() is +called. + +Signed-off-by: Ziyi Guo +Link: https://patch.msgid.link/20260130182651.1576579-1-n7l8m4@u.northwestern.edu +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/power/sequencing/core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/power/sequencing/core.c b/drivers/power/sequencing/core.c +index 190564e559885..1fcf0af7cc0bb 100644 +--- a/drivers/power/sequencing/core.c ++++ b/drivers/power/sequencing/core.c +@@ -914,8 +914,10 @@ int pwrseq_power_on(struct pwrseq_desc *desc) + if (target->post_enable) { + ret = target->post_enable(pwrseq); + if (ret) { +- pwrseq_unit_disable(pwrseq, unit); +- desc->powered_on = false; ++ scoped_guard(mutex, &pwrseq->state_lock) { ++ pwrseq_unit_disable(pwrseq, unit); ++ desc->powered_on = false; ++ } + } + } + +-- +2.51.0 + diff --git a/queue-6.18/powercap-intel_rapl-add-pl4-support-for-ice-lake.patch b/queue-6.18/powercap-intel_rapl-add-pl4-support-for-ice-lake.patch new file mode 100644 index 00000000000..e3a910a1efc --- /dev/null +++ b/queue-6.18/powercap-intel_rapl-add-pl4-support-for-ice-lake.patch @@ -0,0 +1,36 @@ +From 98a91002567656bd31ea7d534ff55882e7e9a38e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 21:01:52 -0500 +Subject: powercap: intel_rapl: Add PL4 support for Ice Lake + +From: Daniel Tang + +[ Upstream commit 54b3cd55a515c7c0fcfa0c1f0b10d62c11d64bcc ] + +Microsoft Surface Pro 7 firmware throttles the processor upon +boot/resume. Userspace needs to be able to restore the correct value. + +Link: https://github.com/linux-surface/linux-surface/issues/706 +Signed-off-by: Daniel Tang +Link: https://patch.msgid.link/6088605.ChMirdbgyp@daniel-desktop3 +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/powercap/intel_rapl_msr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/powercap/intel_rapl_msr.c b/drivers/powercap/intel_rapl_msr.c +index c6b9a7debc354..e827247683dbf 100644 +--- a/drivers/powercap/intel_rapl_msr.c ++++ b/drivers/powercap/intel_rapl_msr.c +@@ -140,6 +140,7 @@ static int rapl_msr_write_raw(int cpu, struct reg_action *ra) + + /* List of verified CPUs. */ + static const struct x86_cpu_id pl4_support_ids[] = { ++ X86_MATCH_VFM(INTEL_ICELAKE_L, NULL), + X86_MATCH_VFM(INTEL_TIGERLAKE_L, NULL), + X86_MATCH_VFM(INTEL_ALDERLAKE, NULL), + X86_MATCH_VFM(INTEL_ALDERLAKE_L, NULL), +-- +2.51.0 + diff --git a/queue-6.18/pstore-ram_core-fix-incorrect-success-return-when-vm.patch b/queue-6.18/pstore-ram_core-fix-incorrect-success-return-when-vm.patch new file mode 100644 index 00000000000..a3524b9432a --- /dev/null +++ b/queue-6.18/pstore-ram_core-fix-incorrect-success-return-when-vm.patch @@ -0,0 +1,49 @@ +From fd30fee50c2ba95b4495e64c61e98509b255d84d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 10:03:58 +0800 +Subject: pstore: ram_core: fix incorrect success return when vmap() fails + +From: Ruipeng Qi + +[ Upstream commit 05363abc7625cf18c96e67f50673cd07f11da5e9 ] + +In persistent_ram_vmap(), vmap() may return NULL on failure. + +If offset is non-zero, adding offset_in_page(start) causes the function +to return a non-NULL pointer even though the mapping failed. +persistent_ram_buffer_map() therefore incorrectly returns success. + +Subsequent access to prz->buffer may dereference an invalid address +and cause crashes. + +Add proper NULL checking for vmap() failures. + +Signed-off-by: Ruipeng Qi +Link: https://patch.msgid.link/20260203020358.3315299-1-ruipengqi3@gmail.com +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + fs/pstore/ram_core.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c +index c9eaacdec37e4..7b6d6378a3b87 100644 +--- a/fs/pstore/ram_core.c ++++ b/fs/pstore/ram_core.c +@@ -457,6 +457,13 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size, + vaddr = vmap(pages, page_count, VM_MAP | VM_IOREMAP, prot); + kfree(pages); + ++ /* ++ * vmap() may fail and return NULL. Do not add the offset in this ++ * case, otherwise a NULL mapping would appear successful. ++ */ ++ if (!vaddr) ++ return NULL; ++ + /* + * Since vmap() uses page granularity, we must add the offset + * into the page here, to get the byte granularity address +-- +2.51.0 + diff --git a/queue-6.18/ptp-ptp_vmclock-add-vmclock-to-acpi-device-match.patch b/queue-6.18/ptp-ptp_vmclock-add-vmclock-to-acpi-device-match.patch new file mode 100644 index 00000000000..2417388d8be --- /dev/null +++ b/queue-6.18/ptp-ptp_vmclock-add-vmclock-to-acpi-device-match.patch @@ -0,0 +1,42 @@ +From ea7e2955aff20a2ca3fe0b93bee485cc25b99e5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 17:36:04 +0000 +Subject: ptp: ptp_vmclock: add 'VMCLOCK' to ACPI device match + +From: David Woodhouse + +[ Upstream commit ed4d23ed469ca14d47670c0384f6ae6c4ff060a5 ] + +As we finalised the spec, we spotted that vmgenid actually says that the +_HID is supposed to be hypervisor-specific. Although in the 13 years +since the original vmgenid doc was published, nobody seems to have cared +about using _HID to distinguish between implementations on different +hypervisors, and we only ever use the _CID. + +For consistency, match the _CID of "VMCLOCK" too. + +Signed-off-by: David Woodhouse +Signed-off-by: Babis Chalios +Tested-by: Takahiro Itazuri +Link: https://patch.msgid.link/20260130173704.12575-6-itazur@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/ptp/ptp_vmclock.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/ptp/ptp_vmclock.c b/drivers/ptp/ptp_vmclock.c +index b3a83b03d9c14..cbbfc494680c7 100644 +--- a/drivers/ptp/ptp_vmclock.c ++++ b/drivers/ptp/ptp_vmclock.c +@@ -591,6 +591,7 @@ static int vmclock_probe(struct platform_device *pdev) + + static const struct acpi_device_id vmclock_acpi_ids[] = { + { "AMZNC10C", 0 }, ++ { "VMCLOCK", 0 }, + {} + }; + MODULE_DEVICE_TABLE(acpi, vmclock_acpi_ids); +-- +2.51.0 + diff --git a/queue-6.18/rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch b/queue-6.18/rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch new file mode 100644 index 00000000000..91504f41a23 --- /dev/null +++ b/queue-6.18/rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch @@ -0,0 +1,47 @@ +From d075c099925bcaa00328cfdcb1e7526a8e13d5a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 17:15:16 +0100 +Subject: RDMA/rtrs-clt: For conn rejection use actual err number + +From: Md Haris Iqbal + +[ Upstream commit fc290630702b530c2969061e7ef0d869a5b6dc4f ] + +When the connection establishment request is rejected from the server +side, then the actual error number sent back should be used. + +Signed-off-by: Md Haris Iqbal +Link: https://patch.msgid.link/20260107161517.56357-10-haris.iqbal@ionos.com +Reviewed-by: Grzegorz Prajsner +Reviewed-by: Jack Wang +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +index 2b397a544cb93..8fa1d72bd20a4 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +@@ -1923,7 +1923,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con, + struct rtrs_path *s = con->c.path; + const struct rtrs_msg_conn_rsp *msg; + const char *rej_msg; +- int status, errno; ++ int status, errno = -ECONNRESET; + u8 data_len; + + status = ev->status; +@@ -1945,7 +1945,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con, + status, rej_msg); + } + +- return -ECONNRESET; ++ return errno; + } + + void rtrs_clt_close_conns(struct rtrs_clt_path *clt_path, bool wait) +-- +2.51.0 + diff --git a/queue-6.18/regulator-core-remove-regulator-supply_name-length-l.patch b/queue-6.18/regulator-core-remove-regulator-supply_name-length-l.patch new file mode 100644 index 00000000000..387f4f0c0dd --- /dev/null +++ b/queue-6.18/regulator-core-remove-regulator-supply_name-length-l.patch @@ -0,0 +1,67 @@ +From 9613e99b2aa28da0e654919ef758c38b5d58bced Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Feb 2026 21:37:14 -0600 +Subject: regulator: core: Remove regulator supply_name length limit + +From: Bjorn Andersson + +[ Upstream commit e243cdd87b911ce9968b62e4ab2b680dfadc4341 ] + +When creating the regulator object, associated with a consumer device, +the supply_name is string formatted into a statically sized buffer on +the stack, then strdup()'ed onto the heap. + +Not only is the dance on the stack unnecessary, but when the device's +name is long we might not fit the constructed supply_name in the fixed +64 byte buffer on the stack. + +One such case can be seen on the Qualcomm Rb3Gen2 board, where we find a +PCIe controller, with a PCIe switch, with a USB controller, with a USB +hub, consuming a regulator. In this example the dev->kobj.name itself is +62 characters long. + +Drop the temporary buffer on the stack and kasprintf() the string +directly on the heap, both to simplify the code, and to remove the +length limitation. + +Signed-off-by: Bjorn Andersson +Link: https://patch.msgid.link/20260211-regulator-supply-name-length-v1-1-3875541c1576@oss.qualcomm.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/core.c | 12 +----------- + 1 file changed, 1 insertion(+), 11 deletions(-) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 17c60d9547dc5..765bd1b5deb3a 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1838,8 +1838,6 @@ static const struct file_operations constraint_flags_fops = { + #endif + }; + +-#define REG_STR_SIZE 64 +- + static void link_and_create_debugfs(struct regulator *regulator, struct regulator_dev *rdev, + struct device *dev) + { +@@ -1887,15 +1885,7 @@ static struct regulator *create_regulator(struct regulator_dev *rdev, + lockdep_assert_held_once(&rdev->mutex.base); + + if (dev) { +- char buf[REG_STR_SIZE]; +- int size; +- +- size = snprintf(buf, REG_STR_SIZE, "%s-%s", +- dev->kobj.name, supply_name); +- if (size >= REG_STR_SIZE) +- return NULL; +- +- supply_name = kstrdup(buf, GFP_KERNEL); ++ supply_name = kasprintf(GFP_KERNEL, "%s-%s", dev->kobj.name, supply_name); + if (supply_name == NULL) + return NULL; + } else { +-- +2.51.0 + diff --git a/queue-6.18/remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch b/queue-6.18/remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch new file mode 100644 index 00000000000..57ffb1efd10 --- /dev/null +++ b/queue-6.18/remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch @@ -0,0 +1,51 @@ +From 7d6b665227d1440cc8c7d7910bebe8dfba844e87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Dec 2025 14:28:23 +0200 +Subject: remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox + TX channel is uninitialized + +From: Iuliana Prodan + +[ Upstream commit d62e0e92e589c53c4320ed5914af5fe103f5ce7e ] + +Firmwares that do not use mailbox communication (e.g., the hello_world +sample) leave priv->tx_ch as NULL. The current suspend logic +unconditionally sends RP_MBOX_SUSPEND_SYSTEM, which is invalid without +an initialized TX channel. + +Detect the no_mailboxes case early and skip sending the suspend +message. Instead, proceed directly to the runtime PM suspend path, +which is the correct behavior for firmwares that cannot respond to +mailbox requests. + +Signed-off-by: Iuliana Prodan +Link: https://lore.kernel.org/r/20251204122825.756106-1-iuliana.prodan@oss.nxp.com +Signed-off-by: Mathieu Poirier +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/imx_dsp_rproc.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/remoteproc/imx_dsp_rproc.c b/drivers/remoteproc/imx_dsp_rproc.c +index e61a08df113e4..c0c2bda4964a7 100644 +--- a/drivers/remoteproc/imx_dsp_rproc.c ++++ b/drivers/remoteproc/imx_dsp_rproc.c +@@ -1303,6 +1303,15 @@ static int imx_dsp_suspend(struct device *dev) + if (rproc->state != RPROC_RUNNING) + goto out; + ++ /* ++ * No channel available for sending messages; ++ * indicates no mailboxes present, so trigger PM runtime suspend ++ */ ++ if (!priv->tx_ch) { ++ dev_dbg(dev, "No initialized mbox tx channel, suspend directly.\n"); ++ goto out; ++ } ++ + reinit_completion(&priv->pm_comp); + + /* Tell DSP that suspend is happening */ +-- +2.51.0 + diff --git a/queue-6.18/remoteproc-mediatek-break-lock-dependency-to-prepare.patch b/queue-6.18/remoteproc-mediatek-break-lock-dependency-to-prepare.patch new file mode 100644 index 00000000000..71d4d537e49 --- /dev/null +++ b/queue-6.18/remoteproc-mediatek-break-lock-dependency-to-prepare.patch @@ -0,0 +1,261 @@ +From 0cca95457534251805422bc1321af2d1f4019bcf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 11:07:55 +0000 +Subject: remoteproc: mediatek: Break lock dependency to `prepare_lock` + +From: Tzung-Bi Shih + +[ Upstream commit d935187cfb27fc4168f78f3959aef4eafaae76bb ] + +A potential circular locking dependency (ABBA deadlock) exists between +`ec_dev->lock` and the clock framework's `prepare_lock`. + +The first order (A -> B) occurs when scp_ipi_send() is called while +`ec_dev->lock` is held (e.g., within cros_ec_cmd_xfer()): +1. cros_ec_cmd_xfer() acquires `ec_dev->lock` and calls scp_ipi_send(). +2. scp_ipi_send() calls clk_prepare_enable(), which acquires + `prepare_lock`. +See #0 in the following example calling trace. +(Lock Order: `ec_dev->lock` -> `prepare_lock`) + +The reverse order (B -> A) is more complex and has been observed +(learned) by lockdep. It involves the clock prepare operation +triggering power domain changes, which then propagates through sysfs +and power supply uevents, eventually calling back into the ChromeOS EC +driver and attempting to acquire `ec_dev->lock`: +1. Something calls clk_prepare(), which acquires `prepare_lock`. It + then triggers genpd operations like genpd_runtime_resume(), which + takes `&genpd->mlock`. +2. Power domain changes can trigger regulator changes; regulator + changes can then trigger device link changes; device link changes + can then trigger sysfs changes. Eventually, power_supply_uevent() + is called. +3. This leads to calls like cros_usbpd_charger_get_prop(), which calls + cros_ec_cmd_xfer_status(), which then attempts to acquire + `ec_dev->lock`. +See #1 ~ #6 in the following example calling trace. +(Lock Order: `prepare_lock` -> `&genpd->mlock` -> ... -> `&ec_dev->lock`) + +Move the clk_prepare()/clk_unprepare() operations for `scp->clk` to the +remoteproc prepare()/unprepare() callbacks. This ensures `prepare_lock` +is only acquired in prepare()/unprepare() callbacks. Since +`ec_dev->lock` is not involved in the callbacks, the dependency loop is +broken. + +This means the clock is always "prepared" when the SCP is running. The +prolonged "prepared time" for the clock should be acceptable as SCP is +designed to be a very power efficient processor. The power consumption +impact can be negligible. + +A simplified calling trace reported by lockdep: +> -> #6 (&ec_dev->lock) +> cros_ec_cmd_xfer +> cros_ec_cmd_xfer_status +> cros_usbpd_charger_get_port_status +> cros_usbpd_charger_get_prop +> power_supply_get_property +> power_supply_show_property +> power_supply_uevent +> dev_uevent +> uevent_show +> dev_attr_show +> sysfs_kf_seq_show +> kernfs_seq_show +> -> #5 (kn->active#2) +> kernfs_drain +> __kernfs_remove +> kernfs_remove_by_name_ns +> sysfs_remove_file_ns +> device_del +> __device_link_del +> device_links_driver_bound +> -> #4 (device_links_lock) +> device_link_remove +> _regulator_put +> regulator_put +> -> #3 (regulator_list_mutex) +> regulator_lock_dependent +> regulator_disable +> scpsys_power_off +> _genpd_power_off +> genpd_power_off +> -> #2 (&genpd->mlock/1) +> genpd_add_subdomain +> pm_genpd_add_subdomain +> scpsys_add_subdomain +> scpsys_probe +> -> #1 (&genpd->mlock) +> genpd_runtime_resume +> __rpm_callback +> rpm_callback +> rpm_resume +> __pm_runtime_resume +> clk_core_prepare +> clk_prepare +> -> #0 (prepare_lock) +> clk_prepare +> scp_ipi_send +> scp_send_ipi +> mtk_rpmsg_send +> rpmsg_send +> cros_ec_pkt_xfer_rpmsg + +Signed-off-by: Tzung-Bi Shih +Reviewed-by: Chen-Yu Tsai +Tested-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20260112110755.2435899-1-tzungbi@kernel.org +Signed-off-by: Mathieu Poirier +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/mtk_scp.c | 39 +++++++++++++++++++++++--------- + drivers/remoteproc/mtk_scp_ipi.c | 4 ++-- + 2 files changed, 30 insertions(+), 13 deletions(-) + +diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c +index 8206a17664818..2aeb0ded165cf 100644 +--- a/drivers/remoteproc/mtk_scp.c ++++ b/drivers/remoteproc/mtk_scp.c +@@ -282,7 +282,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv) + struct mtk_scp *scp = priv; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(scp->dev, "failed to enable clocks\n"); + return IRQ_NONE; +@@ -290,7 +290,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv) + + scp->data->scp_irq_handler(scp); + +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + + return IRQ_HANDLED; + } +@@ -664,7 +664,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw) + struct device *dev = scp->dev; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(dev, "failed to enable clocks\n"); + return ret; +@@ -679,7 +679,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw) + + ret = scp_elf_load_segments(rproc, fw); + leave: +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + + return ret; + } +@@ -690,14 +690,14 @@ static int scp_parse_fw(struct rproc *rproc, const struct firmware *fw) + struct device *dev = scp->dev; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(dev, "failed to enable clocks\n"); + return ret; + } + + ret = scp_ipi_init(scp, fw); +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + return ret; + } + +@@ -708,7 +708,7 @@ static int scp_start(struct rproc *rproc) + struct scp_run *run = &scp->run; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(dev, "failed to enable clocks\n"); + return ret; +@@ -733,14 +733,14 @@ static int scp_start(struct rproc *rproc) + goto stop; + } + +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + dev_info(dev, "SCP is ready. FW version %s\n", run->fw_ver); + + return 0; + + stop: + scp->data->scp_reset_assert(scp); +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + return ret; + } + +@@ -908,7 +908,7 @@ static int scp_stop(struct rproc *rproc) + struct mtk_scp *scp = rproc->priv; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(scp->dev, "failed to enable clocks\n"); + return ret; +@@ -916,12 +916,29 @@ static int scp_stop(struct rproc *rproc) + + scp->data->scp_reset_assert(scp); + scp->data->scp_stop(scp); +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + + return 0; + } + ++static int scp_prepare(struct rproc *rproc) ++{ ++ struct mtk_scp *scp = rproc->priv; ++ ++ return clk_prepare(scp->clk); ++} ++ ++static int scp_unprepare(struct rproc *rproc) ++{ ++ struct mtk_scp *scp = rproc->priv; ++ ++ clk_unprepare(scp->clk); ++ return 0; ++} ++ + static const struct rproc_ops scp_ops = { ++ .prepare = scp_prepare, ++ .unprepare = scp_unprepare, + .start = scp_start, + .stop = scp_stop, + .load = scp_load, +diff --git a/drivers/remoteproc/mtk_scp_ipi.c b/drivers/remoteproc/mtk_scp_ipi.c +index c068227e251e7..7a37e273b3af8 100644 +--- a/drivers/remoteproc/mtk_scp_ipi.c ++++ b/drivers/remoteproc/mtk_scp_ipi.c +@@ -171,7 +171,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len, + WARN_ON(len > scp_sizes->ipi_share_buffer_size) || WARN_ON(!buf)) + return -EINVAL; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(scp->dev, "failed to enable clock\n"); + return ret; +@@ -211,7 +211,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len, + + unlock_mutex: + mutex_unlock(&scp->send_lock); +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + + return ret; + } +-- +2.51.0 + diff --git a/queue-6.18/revert-arm64-zynqmp-add-an-op-tee-node-to-the-device.patch b/queue-6.18/revert-arm64-zynqmp-add-an-op-tee-node-to-the-device.patch new file mode 100644 index 00000000000..3f50d7506d8 --- /dev/null +++ b/queue-6.18/revert-arm64-zynqmp-add-an-op-tee-node-to-the-device.patch @@ -0,0 +1,45 @@ +From 9c91289901084af66cf93a35be0653882d381e56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 09:53:54 +0200 +Subject: Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" + +From: Tomas Melin + +[ Upstream commit c197179990124f991fca220d97fac56779a02c6d ] + +This reverts commit 06d22ed6b6635b17551f386b50bb5aaff9b75fbe. + +OP-TEE logic in U-Boot automatically injects a reserved-memory +node along with optee firmware node to kernel device tree. +The injection logic is dependent on that there is no manually +defined optee node. Having the node in zynqmp.dtsi effectively +breaks OP-TEE's insertion of the reserved-memory node, causing +memory access violations during runtime. + +Signed-off-by: Tomas Melin +Signed-off-by: Michal Simek +Link: https://lore.kernel.org/r/20251125-revert-zynqmp-optee-v1-1-d2ce4c0fcaf6@vaisala.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi +index 938b014ca9231..b55c6b2e8e0e1 100644 +--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi ++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi +@@ -192,11 +192,6 @@ psci { + }; + + firmware { +- optee: optee { +- compatible = "linaro,optee-tz"; +- method = "smc"; +- }; +- + zynqmp_firmware: zynqmp-firmware { + compatible = "xlnx,zynqmp-firmware"; + #power-domain-cells = <1>; +-- +2.51.0 + diff --git a/queue-6.18/revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch b/queue-6.18/revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch new file mode 100644 index 00000000000..5999c9723eb --- /dev/null +++ b/queue-6.18/revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch @@ -0,0 +1,42 @@ +From 17a38bf2d50334a6a435ffa836bd06d240e4b329 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 17:16:51 +0100 +Subject: Revert "mfd: da9052-spi: Change read-mask to write-mask" + +From: Marcus Folkesson + +[ Upstream commit 12daa9c1954542bf98bb942fb2dadf19de79a44b ] + +This reverts commit 2e3378f6c79a1b3f7855ded1ef306ea4406352ed. + +Almost every register in this chip can be customized via OTP +memory. Somehow the value for R19, which decide if the flag is set +on read or write operation, seems to have been overwritten for the chip +the original patch were written for. + +Revert the change to follow the default behavior. + +Signed-off-by: Marcus Folkesson +Link: https://patch.msgid.link/20251124-da9052-revert-v1-1-fbeb2c894002@gmail.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/da9052-spi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mfd/da9052-spi.c b/drivers/mfd/da9052-spi.c +index 80fc5c0cac2fb..be5f2b34e18ae 100644 +--- a/drivers/mfd/da9052-spi.c ++++ b/drivers/mfd/da9052-spi.c +@@ -37,7 +37,7 @@ static int da9052_spi_probe(struct spi_device *spi) + spi_set_drvdata(spi, da9052); + + config = da9052_regmap_config; +- config.write_flag_mask = 1; ++ config.read_flag_mask = 1; + config.reg_bits = 7; + config.pad_bits = 1; + config.val_bits = 8; +-- +2.51.0 + diff --git a/queue-6.18/riscv-vector-init-vector-context-with-proper-vlenb.patch b/queue-6.18/riscv-vector-init-vector-context-with-proper-vlenb.patch new file mode 100644 index 00000000000..6a94126c8e1 --- /dev/null +++ b/queue-6.18/riscv-vector-init-vector-context-with-proper-vlenb.patch @@ -0,0 +1,83 @@ +From 8aa552c6ef8c540246499404f6b04b84637e127b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 21:09:56 -0700 +Subject: riscv: vector: init vector context with proper vlenb + +From: Sergey Matyukevich + +[ Upstream commit ef3ff40346db8476a9ef7269fc9d1837e7243c40 ] + +The vstate in thread_struct is zeroed when the vector context is +initialized. That includes read-only register vlenb, which holds +the vector register length in bytes. Zeroed state persists until +mstatus.VS becomes 'dirty' and a context switch saves the actual +hardware values. + +This can expose the zero vlenb value to the user-space in early +debug scenarios, e.g. when ptrace attaches to a traced process +early, before any vector instruction except the first one was +executed. + +Fix this by specifying proper vlenb on vector context init. + +Signed-off-by: Sergey Matyukevich +Reviewed-by: Andy Chiu +Tested-by: Andy Chiu +Link: https://patch.msgid.link/20251214163537.1054292-3-geomatsi@gmail.com +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/vector.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/arch/riscv/kernel/vector.c b/arch/riscv/kernel/vector.c +index 901e67adf5760..34048c4c26dcd 100644 +--- a/arch/riscv/kernel/vector.c ++++ b/arch/riscv/kernel/vector.c +@@ -109,8 +109,8 @@ bool insn_is_vector(u32 insn_buf) + return false; + } + +-static int riscv_v_thread_zalloc(struct kmem_cache *cache, +- struct __riscv_v_ext_state *ctx) ++static int riscv_v_thread_ctx_alloc(struct kmem_cache *cache, ++ struct __riscv_v_ext_state *ctx) + { + void *datap; + +@@ -120,13 +120,15 @@ static int riscv_v_thread_zalloc(struct kmem_cache *cache, + + ctx->datap = datap; + memset(ctx, 0, offsetof(struct __riscv_v_ext_state, datap)); ++ ctx->vlenb = riscv_v_vsize / 32; ++ + return 0; + } + + void riscv_v_thread_alloc(struct task_struct *tsk) + { + #ifdef CONFIG_RISCV_ISA_V_PREEMPTIVE +- riscv_v_thread_zalloc(riscv_v_kernel_cachep, &tsk->thread.kernel_vstate); ++ riscv_v_thread_ctx_alloc(riscv_v_kernel_cachep, &tsk->thread.kernel_vstate); + #endif + } + +@@ -212,12 +214,14 @@ bool riscv_v_first_use_handler(struct pt_regs *regs) + * context where VS has been off. So, try to allocate the user's V + * context and resume execution. + */ +- if (riscv_v_thread_zalloc(riscv_v_user_cachep, ¤t->thread.vstate)) { ++ if (riscv_v_thread_ctx_alloc(riscv_v_user_cachep, ¤t->thread.vstate)) { + force_sig(SIGBUS); + return true; + } ++ + riscv_v_vstate_on(regs); + riscv_v_vstate_set_restore(current, regs); ++ + return true; + } + +-- +2.51.0 + diff --git a/queue-6.18/rnbd-srv-zero-the-rsp-buffer-before-using-it.patch b/queue-6.18/rnbd-srv-zero-the-rsp-buffer-before-using-it.patch new file mode 100644 index 00000000000..f58f19d754d --- /dev/null +++ b/queue-6.18/rnbd-srv-zero-the-rsp-buffer-before-using-it.patch @@ -0,0 +1,47 @@ +From 6ba9eccd028532d7f1139124077192558d9fdb8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 13:47:33 +0100 +Subject: rnbd-srv: Zero the rsp buffer before using it + +From: Md Haris Iqbal + +[ Upstream commit 69d26698e4fd44935510553809007151b2fe4db5 ] + +Before using the data buffer to send back the response message, zero it +completely. This prevents any stray bytes to be picked up by the client +side when there the message is exchanged between different protocol +versions. + +Signed-off-by: Md Haris Iqbal +Signed-off-by: Jack Wang +Signed-off-by: Grzegorz Prajsner +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/rnbd/rnbd-srv.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c +index 9b3fdc202e152..7eeb321d61402 100644 +--- a/drivers/block/rnbd/rnbd-srv.c ++++ b/drivers/block/rnbd/rnbd-srv.c +@@ -551,6 +551,8 @@ static void rnbd_srv_fill_msg_open_rsp(struct rnbd_msg_open_rsp *rsp, + { + struct block_device *bdev = file_bdev(sess_dev->bdev_file); + ++ memset(rsp, 0, sizeof(*rsp)); ++ + rsp->hdr.type = cpu_to_le16(RNBD_MSG_OPEN_RSP); + rsp->device_id = cpu_to_le32(sess_dev->device_id); + rsp->nsectors = cpu_to_le64(bdev_nr_sectors(bdev)); +@@ -657,6 +659,7 @@ static void process_msg_sess_info(struct rnbd_srv_session *srv_sess, + + trace_process_msg_sess_info(srv_sess, sess_info_msg); + ++ memset(rsp, 0, sizeof(*rsp)); + rsp->hdr.type = cpu_to_le16(RNBD_MSG_SESS_INFO_RSP); + rsp->ver = srv_sess->ver; + } +-- +2.51.0 + diff --git a/queue-6.18/rtc-interface-alarm-race-handling-should-not-discard.patch b/queue-6.18/rtc-interface-alarm-race-handling-should-not-discard.patch new file mode 100644 index 00000000000..d3cdbdd74c1 --- /dev/null +++ b/queue-6.18/rtc-interface-alarm-race-handling-should-not-discard.patch @@ -0,0 +1,53 @@ +From e0a172b1561a64818635de3b5314a50b82dbf270 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 17:35:19 +0000 +Subject: rtc: interface: Alarm race handling should not discard preceding + error + +From: Anthony Pighin (Nokia) + +[ Upstream commit 81be22cd4ace020045cc6d31255c6f7c071eb7c0 ] + +Commit 795cda8338ea ("rtc: interface: Fix long-standing race when setting +alarm") should not discard any errors from the preceding validations. + +Prior to that commit, if the alarm feature was disabled, or the +set_alarm failed, a meaningful error code would be returned to the +caller for further action. + +After, more often than not, the __rtc_read_time will cause a success +return code instead, misleading the caller. + +An example of this is when timer_enqueue is called for a rtc-abx080x +device. Since that driver does not clear the alarm feature bit, but +instead relies on the set_alarm operation to return invalid, the discard +of the return code causes very different behaviour; i.e. + hwclock: select() to /dev/rtc0 to wait for clock tick timed out + +Fixes: 795cda8338ea ("rtc: interface: Fix long-standing race when setting alarm") +Signed-off-by: Anthony Pighin (Nokia) +Reviewed-by: Esben Haabendal +Tested-by: Nick Bowler +Link: https://patch.msgid.link/BN0PR08MB6951415A751F236375A2945683D1A@BN0PR08MB6951.namprd08.prod.outlook.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/interface.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c +index b8b298efd9a9c..1906f4884a834 100644 +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -457,7 +457,7 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm) + * are in, we can return -ETIME to signal that the timer has already + * expired, which is true in both cases. + */ +- if ((scheduled - now) <= 1) { ++ if (!err && (scheduled - now) <= 1) { + err = __rtc_read_time(rtc, &tm); + if (err) + return err; +-- +2.51.0 + diff --git a/queue-6.18/rtc-max31335-use-correct-config-symbol-in-is_reachab.patch b/queue-6.18/rtc-max31335-use-correct-config-symbol-in-is_reachab.patch new file mode 100644 index 00000000000..e30f8b2b1eb --- /dev/null +++ b/queue-6.18/rtc-max31335-use-correct-config-symbol-in-is_reachab.patch @@ -0,0 +1,60 @@ +From 6e6e3a2a4aff748bef17fda2271962f920070b64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 20:54:32 -0800 +Subject: rtc: max31335: use correct CONFIG symbol in IS_REACHABLE() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Randy Dunlap + +[ Upstream commit d5aca9a17f6de884febc56018f92d743b8ea1298 ] + +IS_REACHABLE() is meant to be used with full symbol names from a kernel +.config file, not the shortened symbols used in Kconfig files, so +change HWMON to CONFIG_HWMON in 3 places. + +Fixes: dedaf03b99d6 ("rtc: max31335: add driver support") +Signed-off-by: Randy Dunlap +Acked-by: Nuno Sá +Link: https://patch.msgid.link/20260108045432.2705691-1-rdunlap@infradead.org +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-max31335.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/rtc/rtc-max31335.c b/drivers/rtc/rtc-max31335.c +index 23b7bf16b4cd5..952b455071d68 100644 +--- a/drivers/rtc/rtc-max31335.c ++++ b/drivers/rtc/rtc-max31335.c +@@ -591,7 +591,7 @@ static struct nvmem_config max31335_nvmem_cfg = { + .size = MAX31335_RAM_SIZE, + }; + +-#if IS_REACHABLE(HWMON) ++#if IS_REACHABLE(CONFIG_HWMON) + static int max31335_read_temp(struct device *dev, enum hwmon_sensor_types type, + u32 attr, int channel, long *val) + { +@@ -672,7 +672,7 @@ static int max31335_clkout_register(struct device *dev) + static int max31335_probe(struct i2c_client *client) + { + struct max31335_data *max31335; +-#if IS_REACHABLE(HWMON) ++#if IS_REACHABLE(CONFIG_HWMON) + struct device *hwmon; + #endif + const struct chip_desc *match; +@@ -727,7 +727,7 @@ static int max31335_probe(struct i2c_client *client) + return dev_err_probe(&client->dev, ret, + "cannot register rtc nvmem\n"); + +-#if IS_REACHABLE(HWMON) ++#if IS_REACHABLE(CONFIG_HWMON) + if (max31335->chip->temp_reg) { + hwmon = devm_hwmon_device_register_with_info(&client->dev, client->name, max31335, + &max31335_chip_info, NULL); +-- +2.51.0 + diff --git a/queue-6.18/rtc-zynqmp-correct-frequency-value.patch b/queue-6.18/rtc-zynqmp-correct-frequency-value.patch new file mode 100644 index 00000000000..91b12257838 --- /dev/null +++ b/queue-6.18/rtc-zynqmp-correct-frequency-value.patch @@ -0,0 +1,42 @@ +From 390df839f28b1272a2e20acebc53c9c376474c15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 13:53:45 +0000 +Subject: rtc: zynqmp: correct frequency value + +From: Tomas Melin + +[ Upstream commit 2724fb4d429cbb724dcb6fa17953040918ebe3a2 ] + +Fix calibration value in case a clock reference is provided. +The actual calibration value written into register is +frequency - 1. + +Reviewed-by: Harini T +Tested-by: Harini T +Signed-off-by: Tomas Melin +Acked-by: Michal Simek +Link: https://patch.msgid.link/20260122-zynqmp-rtc-updates-v4-1-d4edb966b499@vaisala.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-zynqmp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/rtc/rtc-zynqmp.c b/drivers/rtc/rtc-zynqmp.c +index 3baa2b481d9f2..856bc1678e7d3 100644 +--- a/drivers/rtc/rtc-zynqmp.c ++++ b/drivers/rtc/rtc-zynqmp.c +@@ -345,7 +345,10 @@ static int xlnx_rtc_probe(struct platform_device *pdev) + &xrtcdev->freq); + if (ret) + xrtcdev->freq = RTC_CALIB_DEF; ++ } else { ++ xrtcdev->freq--; + } ++ + ret = readl(xrtcdev->reg_base + RTC_CALIB_RD); + if (!ret) + writel(xrtcdev->freq, (xrtcdev->reg_base + RTC_CALIB_WR)); +-- +2.51.0 + diff --git a/queue-6.18/rtla-fix-null-pointer-dereference-in-actions_parse.patch b/queue-6.18/rtla-fix-null-pointer-dereference-in-actions_parse.patch new file mode 100644 index 00000000000..c5a4e236b8a --- /dev/null +++ b/queue-6.18/rtla-fix-null-pointer-dereference-in-actions_parse.patch @@ -0,0 +1,45 @@ +From b8a7d1641bd5d012cc3ba19234a04d8e35dfb707 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 08:49:48 -0300 +Subject: rtla: Fix NULL pointer dereference in actions_parse + +From: Wander Lairson Costa + +[ Upstream commit a0890f9dbd24b302d327fe7dad9b9c5be0e278aa ] + +The actions_parse() function uses strtok() to tokenize the trigger +string, but does not check if the returned token is NULL before +passing it to strcmp(). If the trigger parameter is an empty string +or contains only delimiter characters, strtok() returns NULL, causing +strcmp() to dereference a NULL pointer and crash the program. + +This issue can be triggered by malformed user input or edge cases in +trigger string parsing. Add a NULL check immediately after the strtok() +call to validate that a token was successfully extracted before using +it. If no token is found, the function now returns -1 to indicate a +parsing error. + +Signed-off-by: Wander Lairson Costa +Link: https://lore.kernel.org/r/20260106133655.249887-13-wander@redhat.com +Signed-off-by: Tomas Glozar +Signed-off-by: Sasha Levin +--- + tools/tracing/rtla/src/actions.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/tracing/rtla/src/actions.c b/tools/tracing/rtla/src/actions.c +index 8945aee58d511..15986505b4376 100644 +--- a/tools/tracing/rtla/src/actions.c ++++ b/tools/tracing/rtla/src/actions.c +@@ -141,6 +141,8 @@ actions_parse(struct actions *self, const char *trigger, const char *tracefn) + + strcpy(trigger_c, trigger); + token = strtok(trigger_c, ","); ++ if (!token) ++ return -1; + + if (strcmp(token, "trace") == 0) + type = ACTION_TRACE_OUTPUT; +-- +2.51.0 + diff --git a/queue-6.18/rust-cpufreq-always-inline-functions-using-build_ass.patch b/queue-6.18/rust-cpufreq-always-inline-functions-using-build_ass.patch new file mode 100644 index 00000000000..f1d6cd53e2e --- /dev/null +++ b/queue-6.18/rust-cpufreq-always-inline-functions-using-build_ass.patch @@ -0,0 +1,39 @@ +From 9730cfad6578f9a4c207763afc3551109d9a5b99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Nov 2025 11:11:39 +0900 +Subject: rust: cpufreq: always inline functions using build_assert with + arguments + +From: Alexandre Courbot + +[ Upstream commit 8c8b12a55614ea05953e8d695e700e6e1322a05d ] + +`build_assert` relies on the compiler to optimize out its error path. +Functions using it with its arguments must thus always be inlined, +otherwise the error path of `build_assert` might not be optimized out, +triggering a build error. + +Signed-off-by: Alexandre Courbot +Reviewed-by: Daniel Almeida +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + rust/kernel/cpufreq.rs | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/rust/kernel/cpufreq.rs b/rust/kernel/cpufreq.rs +index 1a555fcb120a9..df5d9f6f43f3b 100644 +--- a/rust/kernel/cpufreq.rs ++++ b/rust/kernel/cpufreq.rs +@@ -1015,6 +1015,8 @@ impl Registration { + ..pin_init::zeroed() + }; + ++ // Always inline to optimize out error path of `build_assert`. ++ #[inline(always)] + const fn copy_name(name: &'static CStr) -> [c_char; CPUFREQ_NAME_LEN] { + let src = name.to_bytes_with_nul(); + let mut dst = [0; CPUFREQ_NAME_LEN]; +-- +2.51.0 + diff --git a/queue-6.18/s390-boot-add-wno-default-const-init-unsafe-to-kbuil.patch b/queue-6.18/s390-boot-add-wno-default-const-init-unsafe-to-kbuil.patch new file mode 100644 index 00000000000..09c4bced3c4 --- /dev/null +++ b/queue-6.18/s390-boot-add-wno-default-const-init-unsafe-to-kbuil.patch @@ -0,0 +1,45 @@ +From 4c679955d456099e6346a4c60c692407b02bebb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Dec 2025 16:43:58 +0100 +Subject: s390/boot: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS + +From: Heiko Carstens + +[ Upstream commit 5ba35a6c13fff0929c34aba6b7602dacbe68686c ] + +Add -Wno-default-const-init-unsafe to boot KBUILD_CFLAGS, similar to +scripts/Makefile.extrawarn, since clang generates warnings for the dummy +variable in typecheck(): + + CC arch/s390/boot/version.o + arch/s390/include/asm/ptrace.h:221:9: warning: default initialization of an object of type 'typeof (regs->psw)' (aka 'const psw_t') leaves the object uninitialized [-Wdefault-const-init-var-unsafe] + 221 | return psw_bits(regs->psw).pstate; + | ^ + arch/s390/include/asm/ptrace.h:98:2: note: expanded from macro 'psw_bits' + 98 | typecheck(psw_t, __psw); \ + | ^ + include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck' + 11 | typeof(x) __dummy2; \ + | ^ + +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/boot/Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/s390/boot/Makefile b/arch/s390/boot/Makefile +index 02f2cf0827487..1768424a1824f 100644 +--- a/arch/s390/boot/Makefile ++++ b/arch/s390/boot/Makefile +@@ -21,6 +21,7 @@ KBUILD_AFLAGS := $(filter-out $(CC_FLAGS_MARCH),$(KBUILD_AFLAGS_DECOMPRESSOR)) + KBUILD_CFLAGS := $(filter-out $(CC_FLAGS_MARCH),$(KBUILD_CFLAGS_DECOMPRESSOR)) + KBUILD_AFLAGS += $(CC_FLAGS_MARCH_MINIMUM) -D__DISABLE_EXPORTS + KBUILD_CFLAGS += $(CC_FLAGS_MARCH_MINIMUM) -D__DISABLE_EXPORTS ++KBUILD_CFLAGS += $(call cc-option, -Wno-default-const-init-unsafe) + + CFLAGS_sclp_early_core.o += -I$(srctree)/drivers/s390/char + +-- +2.51.0 + diff --git a/queue-6.18/s390-perf-disable-register-readout-on-sampling-event.patch b/queue-6.18/s390-perf-disable-register-readout-on-sampling-event.patch new file mode 100644 index 00000000000..bcaefdefcb4 --- /dev/null +++ b/queue-6.18/s390-perf-disable-register-readout-on-sampling-event.patch @@ -0,0 +1,53 @@ +From befb761c6df6ccac638b8a5ee55c0253d1a24942 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 10:14:12 +0100 +Subject: s390/perf: Disable register readout on sampling events + +From: Thomas Richter + +[ Upstream commit b2c04fc1239062b39ddfdd8731ee1a10810dfb74 ] + +Running commands + # ./perf record -IR0,R1 -a sleep 1 +extracts and displays register value of general purpose register r1 and r0. +However the value displayed of any register is random and does not +reflect the register value recorded at the time of the sample interrupt. + +The sampling device driver on s390 creates a very large buffer +for the hardware to store the samples. Only when that large buffer +gets full an interrupt is generated and many hundreds of sample +entries are processed and copied to the kernel ring buffer and +eventually get copied to the perf tool. It is during the copy +to the kernel ring buffer that each sample is processed (on s390) +and at that time the register values are extracted. +This is not the original goal, the register values should be read +when the samples are created not when the samples are copied to the +kernel ring buffer. + +Prevent this event from being installed in the first place and +return -EOPNOTSUPP. This is already the case for PERF_SAMPLE_REGS_USER. + +Signed-off-by: Thomas Richter +Reviewed-by: Jan Polensky +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/perf_cpum_sf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c +index f432869f89213..9af7228d2d792 100644 +--- a/arch/s390/kernel/perf_cpum_sf.c ++++ b/arch/s390/kernel/perf_cpum_sf.c +@@ -842,7 +842,7 @@ static bool is_callchain_event(struct perf_event *event) + u64 sample_type = event->attr.sample_type; + + return sample_type & (PERF_SAMPLE_CALLCHAIN | PERF_SAMPLE_REGS_USER | +- PERF_SAMPLE_STACK_USER); ++ PERF_SAMPLE_REGS_INTR | PERF_SAMPLE_STACK_USER); + } + + static int cpumsf_pmu_event_init(struct perf_event *event) +-- +2.51.0 + diff --git a/queue-6.18/s390-purgatory-add-wno-default-const-init-unsafe-to-.patch b/queue-6.18/s390-purgatory-add-wno-default-const-init-unsafe-to-.patch new file mode 100644 index 00000000000..442c4db0bcf --- /dev/null +++ b/queue-6.18/s390-purgatory-add-wno-default-const-init-unsafe-to-.patch @@ -0,0 +1,45 @@ +From 7cf31582f5334f49499b2e0ea06f03a7d8105246 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Dec 2025 16:47:07 +0100 +Subject: s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS + +From: Heiko Carstens + +[ Upstream commit b4780fe4ddf04b51127a33d705f4a2e224df00fa ] + +Add -Wno-default-const-init-unsafe to purgatory KBUILD_CFLAGS, similar +to scripts/Makefile.extrawarn, since clang generates warnings for the +dummy variable in typecheck(): + + CC arch/s390/purgatory/purgatory.o + arch/s390/include/asm/ptrace.h:221:9: warning: default initialization of an object of type 'typeof (regs->psw)' (aka 'const psw_t') leaves the object uninitialized [-Wdefault-const-init-var-unsafe] + 221 | return psw_bits(regs->psw).pstate; + | ^ + arch/s390/include/asm/ptrace.h:98:2: note: expanded from macro 'psw_bits' + 98 | typecheck(psw_t, __psw); \ + | ^ + include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck' + 11 | typeof(x) __dummy2; \ + | ^ + +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/purgatory/Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/s390/purgatory/Makefile b/arch/s390/purgatory/Makefile +index bd39b36e7bd68..cfb73bbcdfe85 100644 +--- a/arch/s390/purgatory/Makefile ++++ b/arch/s390/purgatory/Makefile +@@ -22,6 +22,7 @@ KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING + KBUILD_CFLAGS += -D__DISABLE_EXPORTS + KBUILD_CFLAGS += $(CLANG_FLAGS) + KBUILD_CFLAGS += $(call cc-option,-fno-PIE) ++KBUILD_CFLAGS += $(call cc-option, -Wno-default-const-init-unsafe) + KBUILD_AFLAGS := $(filter-out -DCC_USING_EXPOLINE,$(KBUILD_AFLAGS)) + KBUILD_AFLAGS += -D__DISABLE_EXPORTS + +-- +2.51.0 + diff --git a/queue-6.18/sched-debug-fix-updating-of-ppos-on-server-write-ops.patch b/queue-6.18/sched-debug-fix-updating-of-ppos-on-server-write-ops.patch new file mode 100644 index 00000000000..78d16ca109c --- /dev/null +++ b/queue-6.18/sched-debug-fix-updating-of-ppos-on-server-write-ops.patch @@ -0,0 +1,65 @@ +From a3eea662daf816cfc9398b4ae8fced8685261be9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jan 2026 10:59:00 +0100 +Subject: sched/debug: Fix updating of ppos on server write ops + +From: Joel Fernandes + +[ Upstream commit 6080fb211672aec6ce8f2f5a2e0b4eae736f2027 ] + +Updating "ppos" on error conditions does not make much sense. The pattern +is to return the error code directly without modifying the position, or +modify the position on success and return the number of bytes written. + +Since on success, the return value of apply is 0, there is no point in +modifying ppos either. Fix it by removing all this and just returning +error code or number of bytes written on success. + +Signed-off-by: Joel Fernandes +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Juri Lelli +Reviewed-by: Andrea Righi +Acked-by: Tejun Heo +Tested-by: Christian Loehle +Link: https://patch.msgid.link/20260126100050.3854740-3-arighi@nvidia.com +Signed-off-by: Sasha Levin +--- + kernel/sched/debug.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c +index 41caa22e0680a..93f009e1076d8 100644 +--- a/kernel/sched/debug.c ++++ b/kernel/sched/debug.c +@@ -345,8 +345,8 @@ static ssize_t sched_fair_server_write(struct file *filp, const char __user *ubu + long cpu = (long) ((struct seq_file *) filp->private_data)->private; + struct rq *rq = cpu_rq(cpu); + u64 runtime, period; ++ int retval = 0; + size_t err; +- int retval; + u64 value; + + err = kstrtoull_from_user(ubuf, cnt, 10, &value); +@@ -380,8 +380,6 @@ static ssize_t sched_fair_server_write(struct file *filp, const char __user *ubu + dl_server_stop(&rq->fair_server); + + retval = dl_server_apply_params(&rq->fair_server, runtime, period, 0); +- if (retval) +- cnt = retval; + + if (!runtime) + printk_deferred("Fair server disabled in CPU %d, system may crash due to starvation.\n", +@@ -389,6 +387,9 @@ static ssize_t sched_fair_server_write(struct file *filp, const char __user *ubu + + if (rq->cfs.h_nr_queued) + dl_server_start(&rq->fair_server); ++ ++ if (retval < 0) ++ return retval; + } + + *ppos += cnt; +-- +2.51.0 + diff --git a/queue-6.18/scsi-buslogic-reduce-stack-usage.patch b/queue-6.18/scsi-buslogic-reduce-stack-usage.patch new file mode 100644 index 00000000000..3d43cf748b7 --- /dev/null +++ b/queue-6.18/scsi-buslogic-reduce-stack-usage.patch @@ -0,0 +1,66 @@ +From c70d84cbc061990336093d57d3f0e83121b42b4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 17:33:15 +0100 +Subject: scsi: buslogic: Reduce stack usage + +From: Arnd Bergmann + +[ Upstream commit e17f0d4cc006265dd92129db4bf9da3a2e4a4f66 ] + +Some randconfig builds run into excessive stack usage with gcc-14 or +higher, which use __attribute__((cold)) where earlier versions did not do +that: + +drivers/scsi/BusLogic.c: In function 'blogic_init': +drivers/scsi/BusLogic.c:2398:1: error: the frame size of 1680 bytes is larger than 1536 bytes [-Werror=frame-larger-than=] + +The problem is that a lot of code gets inlined into blogic_init() here. Two +functions stick out, but they are a bit different: + + - blogic_init_probeinfo_list() actually uses a few hundred bytes of kernel + stack, which is a problem in combination with other functions that also + do. Marking this one as noinline means that the stack slots get get + reused between function calls + + - blogic_reportconfig() has a few large variables, but whenever it is not + inlined into its caller, the compiler is actually smart enough to reuse + stack slots for these automatically, so marking it as noinline saves + most of the stack space by itself. + +The combination of both of these should avoid the problem entirely. + +Signed-off-by: Arnd Bergmann +Link: https://patch.msgid.link/20260203163321.2598593-1-arnd@kernel.org +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/BusLogic.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c +index a86d780d1ba40..026c3e617cb1c 100644 +--- a/drivers/scsi/BusLogic.c ++++ b/drivers/scsi/BusLogic.c +@@ -920,7 +920,8 @@ static int __init blogic_init_fp_probeinfo(struct blogic_adapter *adapter) + a particular probe order. + */ + +-static void __init blogic_init_probeinfo_list(struct blogic_adapter *adapter) ++static noinline_for_stack void __init ++blogic_init_probeinfo_list(struct blogic_adapter *adapter) + { + /* + If a PCI BIOS is present, interrogate it for MultiMaster and +@@ -1690,7 +1691,8 @@ static bool __init blogic_rdconfig(struct blogic_adapter *adapter) + blogic_reportconfig reports the configuration of Host Adapter. + */ + +-static bool __init blogic_reportconfig(struct blogic_adapter *adapter) ++static noinline_for_stack bool __init ++blogic_reportconfig(struct blogic_adapter *adapter) + { + unsigned short alltgt_mask = (1 << adapter->maxdev) - 1; + unsigned short sync_ok, fast_ok; +-- +2.51.0 + diff --git a/queue-6.18/scsi-ufs-mediatek-fix-page-faults-in-ufs_mtk_clk_sca.patch b/queue-6.18/scsi-ufs-mediatek-fix-page-faults-in-ufs_mtk_clk_sca.patch new file mode 100644 index 00000000000..5060053ae91 --- /dev/null +++ b/queue-6.18/scsi-ufs-mediatek-fix-page-faults-in-ufs_mtk_clk_sca.patch @@ -0,0 +1,76 @@ +From 9c70b928ce560ea5fa6891e2ff76d2f9b00463ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 11:45:26 +0900 +Subject: scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace + event + +From: Keita Morisaki + +[ Upstream commit 9672ed3de7d772ceddd713c769c05e832fc69bae ] + +The ufs_mtk_clk_scale() trace event currently stores the address of the +name string directly via __field(const char *, name). This pointer may +become invalid after the module is unloaded, causing page faults when the +trace buffer is subsequently accessed. + +This can occur because the MediaTek UFS driver can be configured as a +loadable module (tristate in Kconfig), meaning the name string passed to +the trace event may reside in module memory that becomes invalid after +module unload. + +Fix this by using __string() and __assign_str() to copy the string contents +into the ring buffer instead of storing the pointer. This ensures the trace +data remains valid regardless of module state. + +This change increases the memory usage for each ftrace entry by a few bytes +(clock names are typically 7-15 characters like "ufs_sel" or +"ufs_sel_max_src") compared to storing an 8-byte pointer. + +Note that this change does not affect anything unless all of the following +conditions are met: + + - CONFIG_SCSI_UFS_MEDIATEK is enabled + + - ftrace tracing is enabled + + - The ufs_mtk_clk_scale event is enabled in ftrace + +Signed-off-by: Keita Morisaki +Reviewed-by: Peter Wang +Link: https://patch.msgid.link/20260202024526.122515-1-keita.morisaki@tier4.jp +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/host/ufs-mediatek-trace.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/ufs/host/ufs-mediatek-trace.h b/drivers/ufs/host/ufs-mediatek-trace.h +index b5f2ec3140748..0df8ac843379a 100644 +--- a/drivers/ufs/host/ufs-mediatek-trace.h ++++ b/drivers/ufs/host/ufs-mediatek-trace.h +@@ -33,19 +33,19 @@ TRACE_EVENT(ufs_mtk_clk_scale, + TP_ARGS(name, scale_up, clk_rate), + + TP_STRUCT__entry( +- __field(const char*, name) ++ __string(name, name) + __field(bool, scale_up) + __field(unsigned long, clk_rate) + ), + + TP_fast_assign( +- __entry->name = name; ++ __assign_str(name); + __entry->scale_up = scale_up; + __entry->clk_rate = clk_rate; + ), + + TP_printk("ufs: clk (%s) scaled %s @ %lu", +- __entry->name, ++ __get_str(name), + __entry->scale_up ? "up" : "down", + __entry->clk_rate) + ); +-- +2.51.0 + diff --git a/queue-6.18/serial-8250-8250_omap.c-add-support-for-handling-uar.patch b/queue-6.18/serial-8250-8250_omap.c-add-support-for-handling-uar.patch new file mode 100644 index 00000000000..8a4419f91fa --- /dev/null +++ b/queue-6.18/serial-8250-8250_omap.c-add-support-for-handling-uar.patch @@ -0,0 +1,98 @@ +From 2226f129fab128267af55a6ff8c3dcf3647e1762 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 13:48:28 +0530 +Subject: serial: 8250: 8250_omap.c: Add support for handling UART error + conditions + +From: Moteen Shah + +[ Upstream commit 623b07b370e9963122d167e04fdc1dc713ebfbaf ] + +The DMA IRQ handler does not accounts for the overrun(OE) or any other +errors being reported by the IP before triggering a DMA transaction which +leads to the interrupts not being handled resulting into an IRQ storm. + +The way to handle OE is to: +1. Reset the RX FIFO. +2. Read the UART_RESUME register, which clears the internal flag + +Earlier, the driver issued DMA transations even in case of OE which shouldn't +be done according to the OE handling mechanism mentioned above, as we are +resetting the FIFO's, refer section: "12.1.6.4.8.1.3.6 Overrun During +Receive" [0]. + +[0] https://www.ti.com/lit/pdf/spruiu1 + +Signed-off-by: Moteen Shah +Link: https://patch.msgid.link/20260112081829.63049-2-m-shah@ti.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 23 +++++++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 9e49ef48b851b..e26bae0a6488f 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -100,6 +100,9 @@ + #define OMAP_UART_REV_52 0x0502 + #define OMAP_UART_REV_63 0x0603 + ++/* Resume register */ ++#define UART_OMAP_RESUME 0x0B ++ + /* Interrupt Enable Register 2 */ + #define UART_OMAP_IER2 0x1B + #define UART_OMAP_IER2_RHR_IT_DIS BIT(2) +@@ -119,7 +122,6 @@ + /* Timeout low and High */ + #define UART_OMAP_TO_L 0x26 + #define UART_OMAP_TO_H 0x27 +- + struct omap8250_priv { + void __iomem *membase; + int line; +@@ -1256,6 +1258,20 @@ static u16 omap_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir, u16 status + return status; + } + ++static void am654_8250_handle_uart_errors(struct uart_8250_port *up, u8 iir, u16 status) ++{ ++ if (status & UART_LSR_OE) { ++ serial8250_clear_and_reinit_fifos(up); ++ serial_in(up, UART_LSR); ++ serial_in(up, UART_OMAP_RESUME); ++ } else { ++ if (status & (UART_LSR_FE | UART_LSR_PE | UART_LSR_BI)) ++ serial_in(up, UART_RX); ++ if (iir & UART_IIR_XOFF) ++ serial_in(up, UART_IIR); ++ } ++} ++ + static void am654_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir, + u16 status) + { +@@ -1266,7 +1282,8 @@ static void am654_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir, + * Queue a new transfer if FIFO has data. + */ + if ((status & (UART_LSR_DR | UART_LSR_BI)) && +- (up->ier & UART_IER_RDI)) { ++ (up->ier & UART_IER_RDI) && !(status & UART_LSR_OE)) { ++ am654_8250_handle_uart_errors(up, iir, status); + omap_8250_rx_dma(up); + serial_out(up, UART_OMAP_EFR2, UART_OMAP_EFR2_TIMEOUT_BEHAVE); + } else if ((iir & 0x3f) == UART_IIR_RX_TIMEOUT) { +@@ -1282,6 +1299,8 @@ static void am654_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir, + serial_out(up, UART_OMAP_EFR2, 0x0); + up->ier |= UART_IER_RLSI | UART_IER_RDI; + serial_out(up, UART_IER, up->ier); ++ } else { ++ am654_8250_handle_uart_errors(up, iir, status); + } + } + +-- +2.51.0 + diff --git a/queue-6.18/serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch b/queue-6.18/serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch new file mode 100644 index 00000000000..b820f4d5f61 --- /dev/null +++ b/queue-6.18/serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch @@ -0,0 +1,46 @@ +From fc4b4afba6c53bfb521355f2d75d553e5e35b68d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 13:48:29 +0530 +Subject: serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA + termination is done + +From: Moteen Shah + +[ Upstream commit a5fd8945a478ff9be14812693891d7c9b4185a50 ] + +Clear rx_running flag only after DMA teardown polling completes. In the +previous implementation the flag was being cleared while hardware teardown +was still in progress, creating a mismatch between software state +(flag = 0, "ready") and hardware state (still terminating). + +Signed-off-by: Moteen Shah +Link: https://patch.msgid.link/20260112081829.63049-3-m-shah@ti.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index e26bae0a6488f..272bc07c9a6b5 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -931,7 +931,6 @@ static void __dma_rx_do_complete(struct uart_8250_port *p) + goto out; + + cookie = dma->rx_cookie; +- dma->rx_running = 0; + + /* Re-enable RX FIFO interrupt now that transfer is complete */ + if (priv->habit & UART_HAS_RHR_IT_DIS) { +@@ -965,6 +964,7 @@ static void __dma_rx_do_complete(struct uart_8250_port *p) + goto out; + ret = tty_insert_flip_string(tty_port, dma->rx_buf, count); + ++ dma->rx_running = 0; + p->port.icount.rx += ret; + p->port.icount.buf_overrun += count - ret; + out: +-- +2.51.0 + diff --git a/queue-6.18/serial-8250_dw-handle-clock-enable-errors-in-runtime.patch b/queue-6.18/serial-8250_dw-handle-clock-enable-errors-in-runtime.patch new file mode 100644 index 00000000000..caaf2ec9b11 --- /dev/null +++ b/queue-6.18/serial-8250_dw-handle-clock-enable-errors-in-runtime.patch @@ -0,0 +1,57 @@ +From c0ce1baa50bcfd75e20a7723ce96ad49b38b4364 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 17:54:25 +0300 +Subject: serial: 8250_dw: handle clock enable errors in runtime_resume + +From: Artem Shimko + +[ Upstream commit d31228143a489ba6ba797896a07541ce06828c09 ] + +Add error checking for clk_prepare_enable() calls in +dw8250_runtime_resume(). Currently if either clock fails to enable, +the function returns success while leaving clocks in inconsistent state. + +This change implements comprehensive error handling by checking the return +values of both clk_prepare_enable() calls. If the second clock enable +operation fails after the first clock has already been successfully +enabled, the code now properly cleans up by disabling and unpreparing +the first clock before returning. The error code is then propagated to +the caller, ensuring that clock enable failures are properly reported +rather than being silently ignored. + +Signed-off-by: Artem Shimko +Link: https://patch.msgid.link/20251104145433.2316165-2-a.shimko.dev@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_dw.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c +index 710ae4d40aec4..0ff500965c103 100644 +--- a/drivers/tty/serial/8250/8250_dw.c ++++ b/drivers/tty/serial/8250/8250_dw.c +@@ -741,11 +741,18 @@ static int dw8250_runtime_suspend(struct device *dev) + + static int dw8250_runtime_resume(struct device *dev) + { ++ int ret; + struct dw8250_data *data = dev_get_drvdata(dev); + +- clk_prepare_enable(data->pclk); ++ ret = clk_prepare_enable(data->pclk); ++ if (ret) ++ return ret; + +- clk_prepare_enable(data->clk); ++ ret = clk_prepare_enable(data->clk); ++ if (ret) { ++ clk_disable_unprepare(data->pclk); ++ return ret; ++ } + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.18/series b/queue-6.18/series index e69de29bb2d..3d3477f2eab 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -0,0 +1,396 @@ +perf-test-stat-update-test-expectations-and-events.patch +perf-test-stat-tests-fix-for-virtualized-machines.patch +perf-build-raise-minimum-shellcheck-version-to-0.7.2.patch +perf-unwind-libdw-fix-invalid-reference-counts.patch +perf-callchain-fix-srcline-printing-with-inlines.patch +libsubcmd-fix-null-intersection-case-in-exclude_cmds.patch +rtc-max31335-use-correct-config-symbol-in-is_reachab.patch +perf-symbol-elf-fix-leak-of-elf-files-with-gnu-debug.patch +perf-tools-get-debug-info-of-dso-properly.patch +perf-cs-etm-fix-decoding-for-sparse-cpu-maps.patch +perf-annotate-fix-args-leak-of-map_symbol.patch +perf-maps-fix-reference-count-leak-in-maps__find_ams.patch +perf-tests-sched-avoid-error-in-cleanup-on-loaded-ma.patch +perf-annotate-fix-memcpy-size-in-arch__grow_instruct.patch +tools-headers-go-back-to-include-asm-generic-unistd..patch +perf-annotate-fix-build_nondistro-1-missing-args-ms-.patch +perf-vendor-events-amd-fix-zen-5-mab-allocation-even.patch +perf-build-remove-no_libcap-that-controls-nothing.patch +libperf-build-always-place-libperf-includes-first.patch +perf-test-fix-test-case-perftool-testsuite_report-fo.patch +rtc-interface-alarm-race-handling-should-not-discard.patch +statmount-permission-check-should-return-eperm.patch +hfsplus-fix-volume-corruption-issue-for-generic-480.patch +audit-add-fchmodat2-to-change-attributes-class.patch +hfsplus-fix-volume-corruption-issue-for-generic-498.patch +fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch +kselftest-kublk-include-message-in-_static_assert-fo.patch +audit-add-missing-syscalls-to-read-class.patch +hfsplus-pretend-special-inodes-as-regular-files.patch +i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch +i3c-mipi-i3c-hci-stop-reading-extended-capabilities-.patch +i3c-mipi-i3c-hci-reset-ring_operation1-fields-during.patch +dlm-fix-recovery-pending-middle-conversion.patch +minix-add-required-sanity-checking-to-minix_check_su.patch +dlm-validate-length-in-dlm_search_rsb_tree.patch +btrfs-fallback-to-buffered-io-if-the-data-profile-ha.patch +btrfs-handle-user-interrupt-properly-in-btrfs_trim_f.patch +netfs-when-subreq-is-marked-for-retry-do-not-check-i.patch +smb-client-add-proper-locking-around-ses-iface_last_.patch +gfs2-fiemap-page-fault-fix.patch +smb-client-prevent-races-in-query_interfaces.patch +tools-cpupower-fix-inverted-aperf-capability-check.patch +s390-boot-add-wno-default-const-init-unsafe-to-kbuil.patch +tools-power-cpupower-reset-errno-before-strtoull.patch +s390-purgatory-add-wno-default-const-init-unsafe-to-.patch +perf-arm-cmn-support-cmn-600ae.patch +arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch +rnbd-srv-zero-the-rsp-buffer-before-using-it.patch +x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch +ntfs-d_compare-must-not-block.patch +efi-cper-don-t-dump-the-entire-memory-region.patch +apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch +apei-ghes-arm-processor-error-don-t-go-past-allocate.patch +efi-cper-don-t-go-past-the-arm-processor-cper-record.patch +acpi-processor-fix-null-pointer-dereference-in-acpi_.patch +acpi-resource-add-jwipc-jvc9100-to-irq1_level_low_sk.patch +acpica-abort-aml-bytecode-execution-when-executing-a.patch +powercap-intel_rapl-add-pl4-support-for-ice-lake.patch +io_uring-timeout-annotate-data-race-in-io_flush_time.patch +alpha-fix-user-space-corruption-during-memory-compac.patch +md-cluster-fix-null-pointer-dereference-in-process_m.patch +md-raid-fix-hang-when-stopping-arrays-with-metadata-.patch +rust-cpufreq-always-inline-functions-using-build_ass.patch +cpufreq-dt-platdev-block-the-driver-from-probing-on-.patch +s390-perf-disable-register-readout-on-sampling-event.patch +perf-cxlpmu-replace-irqf_oneshot-with-irqf_no_thread.patch +acpi-x86-s2idle-invoke-microsoft-_dsm-function-9-tur.patch +acpi-battery-fix-incorrect-charging-status-when-curr.patch +xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch +blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch +blk-mq-sched-unify-elevators-checking-for-async-requ.patch +block-decouple-secure-erase-size-limit-from-discard-.patch +sparc-synchronize-user-stack-on-fork-and-clone.patch +sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch +bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch +irqchip-riscv-imsic-add-a-cpu-pm-notifier-to-restore.patch +perf-x86-msr-add-airmont-np.patch +perf-x86-cstate-add-airmont-np.patch +perf-x86-intel-add-airmont-np.patch +gendwarfksyms-fix-build-on-32-bit-hosts.patch +bpf-crypto-use-the-correct-destructor-kfunc-type.patch +bpf-net_sched-use-the-correct-destructor-kfunc-type.patch +bpf-recognize-special-arithmetic-shift-in-the-verifi.patch +genirq-cpuhotplug-notify-about-affinity-changes-brea.patch +bpf-properly-mark-live-registers-for-indirect-jumps.patch +perf-core-fix-slow-perf_event_task_exit-with-lbr-cal.patch +arm64-ftrace-bpf-fix-partial-regs-after-bpf_prog_run.patch +clocksource-drivers-sh_tmu-always-leave-device-runni.patch +clocksource-drivers-timer-integrator-ap-add-missing-.patch +pci-msi-unmap-msi-x-region-on-error.patch +bpftool-fix-dependencies-for-static-build.patch +crypto-hisilicon-qm-move-the-barrier-before-writing-.patch +mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch +char-tpm-cr50-remove-irqf_oneshot.patch +sched-debug-fix-updating-of-ppos-on-server-write-ops.patch +pstore-ram_core-fix-incorrect-success-return-when-vm.patch +firmware-arm_ffa-unmap-rx-tx-buffers-on-init-failure.patch +revert-arm64-zynqmp-add-an-op-tee-node-to-the-device.patch +edac-igen6-add-more-intel-panther-lake-h-socs-suppor.patch +edac-igen6-add-two-intel-amston-lake-socs-support.patch +arm64-tegra-smaug-add-usb-role-switch-support.patch +soc-imx8m-fix-error-handling-for-clk_prepare_enable.patch +x86-sev-use-kfree_sensitive-when-freeing-a-snp-messa.patch +parisc-prevent-interrupts-during-reboot.patch +drm-xe-ggtt-use-scope-based-runtime-pm.patch +drm-xe-covert-return-of-ebusy-to-enomem-in-vm-bind-i.patch +drm-xe-vm-skip-ufence-association-for-cpu-address-mi.patch +drm-display-dp_mst-add-protection-against-0-vcpi.patch +drm-panthor-always-wait-after-sending-a-command-to-a.patch +drm-xe-xe3_lpg-apply-wa_16028005424.patch +gpu-panel-edp-add-auo-panel-entry-for-b140han06.4.patch +accel-amdxdna-fix-tail-pointer-polling-in-mailbox_ge.patch +drm-amdgpu-fix-null-pointer-issue-buffer-funcs.patch +drm-amdgpu-fix-the-calculation-of-ras-bad-page-numbe.patch +drm-amdgpu-ras-move-ras-data-alloc-before-bad-page-c.patch +drm-amd-display-correct-fixed_vs-link-rate-toggle-co.patch +drm-amd-display-guard-fams2-configuration-updates.patch +drm-panel-edp-add-auo-b140qax01.h-panel.patch +drm-amdkfd-handle-gpu-reset-and-drain-retry-fault-ra.patch +spi-geni-qcom-initialize-mode-related-registers-to-0.patch +spi-geni-qcom-use-xfer-bits_per_word-for-can_dma.patch +spi-cadence-quadspi-parse-dt-for-flashes-with-the-re.patch +drm-amd-display-add-usb-c-dp-alt-mode-lane-limitatio.patch +drm-amd-display-don-t-disable-dpcd-mst_en-if-sink-co.patch +asoc-sof-ipc4-support-for-sending-payload-along-with.patch +media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch +gpio-pca953x-add-support-for-tcal6408-tcal6416.patch +spi-stm32-fix-overrun-issue-at-8bpw.patch +drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch +media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch +media-omap3isp-isppreview-always-clamp-in-preview_tr.patch +media-omap3isp-set-initial-format.patch +media-chips-media-wave5-fix-conditional-in-start_str.patch +media-chips-media-wave5-process-ready-frames-when-cm.patch +drm-panel-edp-add-boe-nv140wum-t08-panel.patch +media-mediatek-vcodec-don-t-try-to-decode-422-444-vp.patch +drm-amdgpu-add-support-for-hdp-ip-version-6.1.1.patch +drm-amd-display-fix-dsc-edp-issue.patch +drm-amdgpu-avoid-a-warning-in-timedout-job-handler.patch +drm-amd-display-add-signal-type-check-for-dcn401-get.patch +drm-amdgpu-refactor-amdgpu_gem_va_ioctl-for-handling.patch +hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch +hid-pidff-do-not-set-out-of-range-trigger-button.patch +hid-multitouch-add-quirks-for-lenovo-yoga-book-9i.patch +drm-amdgpu-skip-loading-sdma_rs64-in-vf.patch +drm-amd-display-only-power-down-dig-on-phy-endpoints.patch +drm-xe-only-toggle-scheduling-in-tdr-if-guc-is-runni.patch +asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch +asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch +spi-spi-mem-limit-octal-dtr-constraints-to-octal-dtr.patch +cgroup-cpuset-don-t-fail-cpuset.cpus-change-in-v2.patch +media-amphion-clear-last_buffer_dequeued-flag-for-de.patch +drm-panel-fix-a-possible-null-pointer-dereference-in.patch +media-adv7180-fix-frame-interval-in-progressive-mode.patch +media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch +media-solo6x10-check-for-out-of-bounds-chip_id.patch +media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch +media-qcom-camss-do-not-enable-cpas-fast-ahb-clock-f.patch +media-v4l2-async-fix-error-handling-on-steps-after-f.patch +media-mt9m114-avoid-a-reset-low-spike-during-probe.patch +media-mt9m114-return-eprobe_defer-if-no-endpoint-is-.patch +media-ipu6-ensure-stream_mutex-is-acquired-when-deal.patch +media-ipu6-close-firmware-streams-on-streaming-enabl.patch +media-ipu6-always-close-firmware-stream.patch +alsa-hda-realtek-add-hp-victus-16-e0xxx-mute-led-qui.patch +alsa-usb-audio-presonus-s18xx-uses-little-endian.patch +drm-amdkfd-relax-size-checking-during-queue-buffer-g.patch +drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch +drm-account-property-blob-allocations-to-memcg.patch +drm-renesas-rz-du-mipi_dsi-fix-kernel-panic-when-reb.patch +hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch +virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch +asoc-soc-acpi-intel-arl-match-change-rt722-amp-endpo.patch +pci-add-intel-nova-lake-audio-device-id.patch +drm-amd-display-disable-fec-when-powering-down-encod.patch +drm-amd-display-ensure-link-output-is-disabled-in-ba.patch +drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch +drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch +drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch +media-rkisp1-fix-filter-mode-register-configuration.patch +drm-amd-display-revert-init-dispclk-from-bootup-cloc.patch +hid-multitouch-add-egalaxtouch-exc3188-support.patch +media-uvcvideo-create-an-id-namespace-for-streaming-.patch +hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch +alsa-hda-conexant-add-headset-mic-fix-for-mechrevo-w.patch +alsa-hda-realtek-fix-lg-gram-style-14-speakers.patch +gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch +asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch +spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch +drm-amd-display-fix-gfx12-family-constant-checks.patch +drm-amd-display-avoid-dig-reg-access-timeout-on-usb4.patch +drm-amdgpu-validate-user-queue-size-constraints.patch +spi-cadence-qspi-try-hard-to-disable-the-clocks.patch +asoc-codecs-max98390-check-return-value-of-devm_gpio.patch +hwmon-dell-smm-add-support-for-dell-optiplex-7080.patch +hwmon-nct6775-add-asus-pro-ws-wrx90e-sage-se.patch +hwmon-nct6683-add-customer-id-for-asrock-z590-taichi.patch +hwmon-emc2305-fix-a-resource-leak-in-emc2305_of_pars.patch +hwmon-f71882fg-add-f81968-support.patch +hwmon-nct7363-fix-a-resource-leak-in-nct7363_present.patch +hid-logitech-hidpp-add-support-for-logitech-k980.patch +asoc-es8328-add-error-unwind-in-resume.patch +modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch +power-sequencing-fix-missing-state_lock-in-pwrseq_po.patch +asoc-sof-intel-hda-fix-null-pointer-dereference.patch +spi-geni-qcom-fix-abort-sequence-execution-for-seria.patch +asoc-fsl-imx-rpmsg-use-snd_soc_find_dai_with_mutex-i.patch +alsa-hda-realtek-enable-mute-leds-on-hp-envy-x360-15.patch +alsa-mixer-oss-add-card-disconnect-checkpoints.patch +alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch +jfs-add-missing-set_freezable-for-freezable-kthread.patch +jfs-nlink-overflow-in-jfs_rename.patch +pci-dwc-skip-pme_turn_off-broadcast-and-l2-l3-transi.patch +wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch +wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch +wifi-rtw88-rtw8821cu-add-id-for-mercusys-mu6h.patch +wifi-rtw89-8922a-set-random-mac-if-efuse-contains-ze.patch +wifi-rtw89-ser-enable-error-imr-after-recovering-fro.patch +wifi-rtw89-setting-tbtt-agg-number-when-mac-port-ini.patch +wifi-rtw89-mcc-reset-probe-counter-when-receiving-be.patch +wifi-rtw88-use-devm_kmemdup-in-rtw_set_supported_ban.patch +wifi-rtw88-fix-inadvertent-sharing-of-struct-ieee802.patch +wifi-rtw89-regd-6-ghz-power-type-marks-default-when-.patch +dm-replace-eexist-with-ebusy.patch +dm-remove-fake-timeout-to-avoid-leak-request.patch +iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch +net-wwan-mhi-add-network-support-for-foxconn-t99w760.patch +wifi-rtw89-fix-potential-zero-beacon-interval-in-bea.patch +rtla-fix-null-pointer-dereference-in-actions_parse.patch +wifi-libertas-fix-warning-in-usb_tx_block.patch +iommu-amd-move-wait_on_sem-out-of-spinlock.patch +wifi-rtw89-add-support-for-msi-ax1800-nano-guax18n.patch +wifi-rtw89-pci-validate-sequence-number-of-tx-releas.patch +wifi-rtw89-mac-correct-page-number-for-csi-response.patch +wifi-rtw89-wow-add-reason-codes-for-disassociation-i.patch +pci-dw-rockchip-disable-bar-0-and-bar-1-for-root-por.patch +wifi-rtw89-disable-eht-protocol-by-chip-capabilities.patch +wifi-ath11k-add-pm-quirk-for-thinkpad-z13-z16-gen1.patch +wifi-ath11k-fix-failure-to-connect-to-a-6-ghz-ap.patch +wifi-ath12k-fix-preferred-hardware-mode-calculation.patch +wifi-ath12k-fix-mac-phy-capability-parsing.patch +wifi-cfg80211-allow-only-one-nan-interface-also-in-m.patch +ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch +ipv6-annotate-data-races-over-sysctl.flowlabel_refle.patch +ipv6-annotate-data-races-in-net-ipv6-route.c.patch +ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch +ext4-mark-group-add-fast-commit-ineligible.patch +ext4-move-ext4_percpu_param_init-before-ext4_mb_init.patch +ext4-mark-group-extend-fast-commit-ineligible.patch +ext4-use-reserved-metadata-blocks-when-splitting-ext.patch +netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch +netfilter-xt_tcpmss-check-remaining-length-before-re.patch +openrisc-define-arch-specific-version-of-nop.patch +net-usb-r8152-fix-transmit-queue-timeout.patch +pci-imx6-add-clkreq-override-to-enable-refclk-for-i..patch +wifi-iwlwifi-mld-handle-rate-selection-for-nan-inter.patch +wifi-iwlwifi-mvm-check-the-validity-of-noa_len.patch +wifi-iwlwifi-fix-22000-series-smem-parsing.patch +wifi-iwlwifi-mld-fix-chandef-start-calculation.patch +wifi-iwlwifi-mld-fix-primary-link-selection-logic.patch +driver-core-faux-stop-using-static-struct-device.patch +wifi-rtw89-fix-unable-to-receive-probe-responses-und.patch +wifi-rtw89-8922a-add-digital-compensation-for-2ghz.patch +net-rds-no-shortcut-out-of-rds_conn_error.patch +ext4-propagate-flags-to-convert_initialized_extent.patch +gro-change-the-bug_on-in-gro_pull_from_frag0.patch +ipv4-igmp-annotate-data-races-around-idev-mr_maxdela.patch +net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch +wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch +wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch +wifi-rtw89-pci-validate-release-report-content-befor.patch +ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch +bluetooth-btusb-add-support-for-mediatek7920-0489-e1.patch +bluetooth-hci_qca-fix-ssr-subsystem-restart-fail-whe.patch +bluetooth-hci_conn-set-link_policy-on-incoming-acl-c.patch +bluetooth-btusb-add-usb-id-0489-e112-for-realtek-885.patch +bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch +bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch +bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch +octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch +net-sfp-add-quirk-for-lantech-8330-265d.patch +wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch +wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch +bnxt_en-allow-ntuple-filters-for-drops.patch +ptp-ptp_vmclock-add-vmclock-to-acpi-device-match.patch +net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch +vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch +net-rds-clear-reconnect-pending-bit.patch +pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch +pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch +pci-fix-pci_slot_lock-device-locking.patch +pci-enable-acs-after-configuring-iommu-for-of-platfo.patch +pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch +pci-mark-nvidia-gb10-to-avoid-bus-reset.patch +pci-bwctrl-disable-bw-controller-on-intel-p45-using-.patch +myri10ge-avoid-uninitialized-variable-use.patch +nfc-nxp-nci-remove-interrupt-trigger-type.patch +hisi_acc_vfio_pci-resolve-duplicate-migration-states.patch +rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch +hisi_acc_vfio_pci-fix-the-queue-parameter-anomaly-is.patch +um-preserve-errno-within-signal-handler.patch +ata-libata-avoid-long-timeouts-on-hot-unplugged-sata.patch +hisi_acc_vfio_pci-update-status-after-ras-error.patch +scsi-buslogic-reduce-stack-usage.patch +vhost-fix-caching-attributes-of-mmio-regions-by-sett.patch +scsi-ufs-mediatek-fix-page-faults-in-ufs_mtk_clk_sca.patch +riscv-vector-init-vector-context-with-proper-vlenb.patch +tracing-fix-false-sharing-in-hwlat-get_sample.patch +remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch +mailbox-mchp-ipc-sbi-fix-out-of-bounds-access-in-mch.patch +mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch +mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch +mailbox-mchp-ipc-sbi-fix-uninitialized-symbol-and-ot.patch +mailbox-sprd-mask-interrupts-that-are-not-handled.patch +remoteproc-mediatek-break-lock-dependency-to-prepare.patch +mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch +clk-amlogic-remove-potentially-unsafe-flags-from-s4-.patch +clk-renesas-rzg2l-deassert-reset-on-assert-timeout.patch +clk-microchip-core-correct-return-value-on-_get_pare.patch +hid-i2c-hid-add-focaltech-ft8112.patch +m68k-nommu-fix-memmove-with-differently-aligned-src-.patch +9p-xen-protect-xen_9pfs_front_free-against-concurren.patch +dmaengine-stm32-dma3-use-module_platform_driver.patch +soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch +soundwire-intel_auxdevice-add-cs42l45-codec-to-wake_.patch +staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch +serial-8250_dw-handle-clock-enable-errors-in-runtime.patch +usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch +fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch +most-core-fix-resource-leak-in-most_register_interfa.patch +dmaengine-sun6i-choose-appropriate-burst-length-unde.patch +dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch +phy-ti-phy-j721e-wiz-restore-mux-selection-during-re.patch +phy-cadence-torrent-restore-parent-clock-for-refclk-.patch +misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch +pinctrl-mediatek-make-devm-allocations-safer-and-cle.patch +misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch +misc-ti_fpc202-fix-a-potential-memory-leak-in-probe-.patch +pinctrl-renesas-rzt2h-allow-.get_direction-for-irq-f.patch +iio-bmi270_i2c-add-module_device_table-for-bmi260-27.patch +usb-gadget-f_fs-fix-dma-buf-out-queues.patch +usb-gadget-f_fs-fix-ioctl-error-handling.patch +usb-chipidea-udc-fix-dma-and-sg-cleanup-in-_ep_nuke.patch +staging-rtl8723bs-fix-memory-leak-on-failure-path.patch +serial-8250-8250_omap.c-add-support-for-handling-uar.patch +serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch +fix-it87_wdt-early-reboot-by-reporting-running-timer.patch +binder-don-t-use-pk-through-printk.patch +watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch +watchdog-rzv2h_wdt-discard-pm_runtime_put-return-val.patch +phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch +phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch +revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch +mfd-intel-lpss-add-intel-nova-lake-s-pci-ids.patch +iio-use-irqf_no_thread.patch +iio-magnetometer-remove-irqf_oneshot.patch +mips-loongson-make-cpumask_of_node-robust-against-nu.patch +fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch +fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch +fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch +fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch +ntfs3-fix-circular-locking-dependency-in-run_unpack_.patch +fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch +ceph-supply-snapshot-context-in-ceph_uninline_data.patch +libceph-define-and-enforce-ceph_max_key_len.patch +thermal-int340x-fix-sysfs-group-leak-on-dlvr-registr.patch +acpi-x86-force-enabling-of-pwm2-on-the-yogabook-yb1-.patch +include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch +arm-9467-1-mm-don-t-use-pk-through-printk.patch +drm-amd-display-fix-writeback-on-dcn-3.2.patch +drm-amdgpu-skip-vcn-poison-irq-release-on-vf.patch +mshv-clear-eventfd-counter-on-irqfd-shutdown.patch +asoc-rt721-sdca-fix-issue-of-fail-to-detect-omtp-jac.patch +regulator-core-remove-regulator-supply_name-length-l.patch +alsa-hda-tas2781-ignore-reset-check-for-spi-device.patch +drm-amd-display-fix-system-resume-lag-issue.patch +drm-amd-display-avoid-updating-surface-with-the-same.patch +drm-amdgpu-return-when-ras-table-checksum-is-error.patch +drm-amdgpu-adjust-usleep_range-in-fence-wait.patch +alsa-hda-realtek-fix-headset-mic-on-asus-zenbook-14-.patch +alsa-usb-audio-update-the-number-of-packets-properly.patch +drm-amdgpu-add-hainan-clock-adjustment.patch +drm-amd-display-bypass-post-csc-for-additional-color.patch +spi-spidev-fix-lock-inversion-between-spi_lock-and-b.patch +drm-radeon-add-hainan-clock-adjustment.patch +alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch +btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch +asoc-amd-amd_sdw-add-machine-driver-quirk-for-lenovo.patch +alsa-hda-hdmi-add-quirk-for-tuxedo-ibs14g6.patch +arm64-hugetlbpage-avoid-unused-but-set-parameter-war.patch +drm-amd-display-remove-conditional-for-shaper-3dlut-.patch +drm-amdgpu-avoid-sdma-ring-reset-in-sriov.patch +rtc-zynqmp-correct-frequency-value.patch +ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch +ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch +iommu-amd-serialize-sequence-allocation-under-concur.patch diff --git a/queue-6.18/smb-client-add-proper-locking-around-ses-iface_last_.patch b/queue-6.18/smb-client-add-proper-locking-around-ses-iface_last_.patch new file mode 100644 index 00000000000..c9b35cb151d --- /dev/null +++ b/queue-6.18/smb-client-add-proper-locking-around-ses-iface_last_.patch @@ -0,0 +1,36 @@ +From a2b6ac1098e18efbdbea89259322f19fb4e3aa50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 14:54:45 -0300 +Subject: smb: client: add proper locking around ses->iface_last_update + +From: Henrique Carvalho + +[ Upstream commit e97dcac3dc0bd37e4b56aaa6874b572a3a461102 ] + +There is a missing ses->iface_lock in cifs_setup_session, +around ses->iface_last_update. + +Signed-off-by: Henrique Carvalho +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/connect.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c +index 2f94d93b95e91..d96d23a8f4903 100644 +--- a/fs/smb/client/connect.c ++++ b/fs/smb/client/connect.c +@@ -4267,7 +4267,9 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses, + ses->ses_status = SES_IN_SETUP; + + /* force iface_list refresh */ ++ spin_lock(&ses->iface_lock); + ses->iface_last_update = 0; ++ spin_unlock(&ses->iface_lock); + } + spin_unlock(&ses->ses_lock); + +-- +2.51.0 + diff --git a/queue-6.18/smb-client-prevent-races-in-query_interfaces.patch b/queue-6.18/smb-client-prevent-races-in-query_interfaces.patch new file mode 100644 index 00000000000..846ad85be19 --- /dev/null +++ b/queue-6.18/smb-client-prevent-races-in-query_interfaces.patch @@ -0,0 +1,79 @@ +From e3b3e39e4e69cd5c81da5e6be790ad50805dcab9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 14:54:44 -0300 +Subject: smb: client: prevent races in ->query_interfaces() + +From: Henrique Carvalho + +[ Upstream commit c3c06e42e1527716c54f3ad2ced6a034b5f3a489 ] + +It was possible for two query interface works to be concurrently trying +to update the interfaces. + +Prevent this by checking and updating iface_last_update under +iface_lock. + +Signed-off-by: Henrique Carvalho +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2ops.c | 19 ++++++++----------- + 1 file changed, 8 insertions(+), 11 deletions(-) + +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index 1e39f2165e427..c3c5fddb2caab 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -637,13 +637,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, + p = buf; + + spin_lock(&ses->iface_lock); +- /* do not query too frequently, this time with lock held */ +- if (ses->iface_last_update && +- time_before(jiffies, ses->iface_last_update + +- (SMB_INTERFACE_POLL_INTERVAL * HZ))) { +- spin_unlock(&ses->iface_lock); +- return 0; +- } + + /* + * Go through iface_list and mark them as inactive +@@ -666,7 +659,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, + "Empty network interface list returned by server %s\n", + ses->server->hostname); + rc = -EOPNOTSUPP; +- ses->iface_last_update = jiffies; + goto out; + } + +@@ -795,8 +787,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, + + sizeof(p->Next) && p->Next)) + cifs_dbg(VFS, "%s: incomplete interface info\n", __func__); + +- ses->iface_last_update = jiffies; +- + out: + /* + * Go through the list again and put the inactive entries +@@ -825,10 +815,17 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon, bool in_ + struct TCP_Server_Info *pserver; + + /* do not query too frequently */ ++ spin_lock(&ses->iface_lock); + if (ses->iface_last_update && + time_before(jiffies, ses->iface_last_update + +- (SMB_INTERFACE_POLL_INTERVAL * HZ))) ++ (SMB_INTERFACE_POLL_INTERVAL * HZ))) { ++ spin_unlock(&ses->iface_lock); + return 0; ++ } ++ ++ ses->iface_last_update = jiffies; ++ ++ spin_unlock(&ses->iface_lock); + + rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, + FSCTL_QUERY_NETWORK_INTERFACE_INFO, +-- +2.51.0 + diff --git a/queue-6.18/soc-imx8m-fix-error-handling-for-clk_prepare_enable.patch b/queue-6.18/soc-imx8m-fix-error-handling-for-clk_prepare_enable.patch new file mode 100644 index 00000000000..76f708355e6 --- /dev/null +++ b/queue-6.18/soc-imx8m-fix-error-handling-for-clk_prepare_enable.patch @@ -0,0 +1,45 @@ +From 31bad2dfb812952024c3612d706ec4c0f05a152f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 06:12:41 +0800 +Subject: soc: imx8m: Fix error handling for clk_prepare_enable() + +From: Peng Fan + +[ Upstream commit f6ef3d9ff81240e9bcc030f2da132eb0f8a761d7 ] + +imx8m_soc_prepare() directly returns the result of clk_prepare_enable(), +which skips proper cleanup if the clock enable fails. Check the return +value of clk_prepare_enable() and release resources if failure. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202601111406.ZVV3YaiU-lkp@intel.com/ +Signed-off-by: Peng Fan +Reviewed-by: Marco Felsch +Reviewed-by: Daniel Baluta +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/soc/imx/soc-imx8m.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/soc/imx/soc-imx8m.c b/drivers/soc/imx/soc-imx8m.c +index 04a1b60f2f2b5..8e2322999f099 100644 +--- a/drivers/soc/imx/soc-imx8m.c ++++ b/drivers/soc/imx/soc-imx8m.c +@@ -148,7 +148,11 @@ static int imx8m_soc_prepare(struct platform_device *pdev, const char *ocotp_com + goto err_clk; + } + +- return clk_prepare_enable(drvdata->clk); ++ ret = clk_prepare_enable(drvdata->clk); ++ if (ret) ++ goto err_clk; ++ ++ return 0; + + err_clk: + iounmap(drvdata->ocotp_base); +-- +2.51.0 + diff --git a/queue-6.18/soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch b/queue-6.18/soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch new file mode 100644 index 00000000000..a6faa980b8a --- /dev/null +++ b/queue-6.18/soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch @@ -0,0 +1,49 @@ +From c8967ff305aab7163d519c4622873d72cc895e00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 15:09:47 +0200 +Subject: soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of + NUC15) + +From: Peter Ujfalusi + +[ Upstream commit 59946373755d71dbd7614ba235e0093159f80b69 ] + +Avell B.ON is an OEM re-branded NUC15 'Bishop County' LAPBC510 and +LAPBC710. + +Link: https://github.com/thesofproject/linux/issues/5529 +Signed-off-by: Peter Ujfalusi +Reviewed-by: Kai Vehmanen +Reviewed-by: Bard Liao +Link: https://patch.msgid.link/20251215130947.31385-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/dmi-quirks.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/soundwire/dmi-quirks.c b/drivers/soundwire/dmi-quirks.c +index 91ab97a456fa9..5854218e1a274 100644 +--- a/drivers/soundwire/dmi-quirks.c ++++ b/drivers/soundwire/dmi-quirks.c +@@ -122,6 +122,17 @@ static const struct dmi_system_id adr_remap_quirk_table[] = { + }, + .driver_data = (void *)intel_tgl_bios, + }, ++ { ++ /* ++ * quirk used for Avell B.ON (OEM rebrand of NUC15 'Bishop County' ++ * LAPBC510 and LAPBC710) ++ */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Avell High Performance"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "B.ON"), ++ }, ++ .driver_data = (void *)intel_tgl_bios, ++ }, + { + /* quirk used for NUC15 'Rooks County' LAPRC510 and LAPRC710 skews */ + .matches = { +-- +2.51.0 + diff --git a/queue-6.18/soundwire-intel_auxdevice-add-cs42l45-codec-to-wake_.patch b/queue-6.18/soundwire-intel_auxdevice-add-cs42l45-codec-to-wake_.patch new file mode 100644 index 00000000000..572874c9e3a --- /dev/null +++ b/queue-6.18/soundwire-intel_auxdevice-add-cs42l45-codec-to-wake_.patch @@ -0,0 +1,37 @@ +From a683a612c141a3841aceddd27b4f1a4cbf0ca888 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 15:17:29 +0000 +Subject: soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list + +From: Maciej Strozek + +[ Upstream commit f87e5575a6bd1925cd55f500b61b661724372e5f ] + +Add cs42l45 to the wake_capable_list because it can generate jack events +whilst the bus is stopped. + +Signed-off-by: Maciej Strozek +Reviewed-by: Bard Liao +Signed-off-by: Charles Keepax +Link: https://patch.msgid.link/20251215151729.3911077-1-ckeepax@opensource.cirrus.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/intel_auxdevice.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/soundwire/intel_auxdevice.c b/drivers/soundwire/intel_auxdevice.c +index 6df2601fff909..8752b0e3ce74c 100644 +--- a/drivers/soundwire/intel_auxdevice.c ++++ b/drivers/soundwire/intel_auxdevice.c +@@ -52,6 +52,7 @@ struct wake_capable_part { + + static struct wake_capable_part wake_capable_list[] = { + {0x01fa, 0x4243}, ++ {0x01fa, 0x4245}, + {0x025d, 0x5682}, + {0x025d, 0x700}, + {0x025d, 0x711}, +-- +2.51.0 + diff --git a/queue-6.18/sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch b/queue-6.18/sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch new file mode 100644 index 00000000000..f1d269116bf --- /dev/null +++ b/queue-6.18/sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch @@ -0,0 +1,50 @@ +From 31b8bf8b75045361c6c16cfbcc7ff575af5b66a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 13:40:29 +0000 +Subject: sparc: don't reference obsolete termio struct for TC* constants + +From: Sam James + +[ Upstream commit be0bccffcde3308150d2a90e55fc10e249098909 ] + +Similar in nature to commit ab107276607a ("powerpc: Fix struct termio related ioctl macros"). + +glibc-2.42 drops the legacy termio struct, but the ioctls.h header still +defines some TC* constants in terms of termio (via sizeof). Hardcode the +values instead. + +This fixes building Python for example, which falls over like: + ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio' + +Link: https://bugs.gentoo.org/961769 +Link: https://bugs.gentoo.org/962600 +Signed-off-by: Sam James +Reviewed-by: Andreas Larsson +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/include/uapi/asm/ioctls.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/sparc/include/uapi/asm/ioctls.h b/arch/sparc/include/uapi/asm/ioctls.h +index 7fd2f5873c9e7..a8bbdf9877a41 100644 +--- a/arch/sparc/include/uapi/asm/ioctls.h ++++ b/arch/sparc/include/uapi/asm/ioctls.h +@@ -5,10 +5,10 @@ + #include + + /* Big T */ +-#define TCGETA _IOR('T', 1, struct termio) +-#define TCSETA _IOW('T', 2, struct termio) +-#define TCSETAW _IOW('T', 3, struct termio) +-#define TCSETAF _IOW('T', 4, struct termio) ++#define TCGETA 0x40125401 /* _IOR('T', 1, struct termio) */ ++#define TCSETA 0x80125402 /* _IOW('T', 2, struct termio) */ ++#define TCSETAW 0x80125403 /* _IOW('T', 3, struct termio) */ ++#define TCSETAF 0x80125404 /* _IOW('T', 4, struct termio) */ + #define TCSBRK _IO('T', 5) + #define TCXONC _IO('T', 6) + #define TCFLSH _IO('T', 7) +-- +2.51.0 + diff --git a/queue-6.18/sparc-synchronize-user-stack-on-fork-and-clone.patch b/queue-6.18/sparc-synchronize-user-stack-on-fork-and-clone.patch new file mode 100644 index 00000000000..492fa7f0d07 --- /dev/null +++ b/queue-6.18/sparc-synchronize-user-stack-on-fork-and-clone.patch @@ -0,0 +1,114 @@ +From 5b3f97f429326b2743b126f126f83f3b85e8c214 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 15:47:52 +0100 +Subject: sparc: Synchronize user stack on fork and clone + +From: Andreas Larsson + +[ Upstream commit e38eba3b77878ada327a572a41596a3b0b44e522 ] + +Flush all uncommitted user windows before calling the generic syscall +handlers for clone, fork, and vfork. + +Prior to entering the arch common handlers sparc_{clone|fork|vfork}, the +arch-specific syscall wrappers for these syscalls will attempt to flush +all windows (including user windows). + +In the window overflow trap handlers on both SPARC{32|64}, +if the window can't be stored (i.e due to MMU related faults) the routine +backups the user window and increments a thread counter (wsaved). + +By adding a synchronization point after the flush attempt, when fault +handling is enabled, any uncommitted user windows will be flushed. + +Link: https://sourceware.org/bugzilla/show_bug.cgi?id=31394 +Closes: https://lore.kernel.org/sparclinux/fe5cc47167430007560501aabb28ba154985b661.camel@physik.fu-berlin.de/ +Signed-off-by: Andreas Larsson +Signed-off-by: Ludwig Rydberg +Tested-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/20260119144753.27945-2-ludwig.rydberg@gaisler.com +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/kernel/process.c | 38 +++++++++++++++++++++++-------------- + 1 file changed, 24 insertions(+), 14 deletions(-) + +diff --git a/arch/sparc/kernel/process.c b/arch/sparc/kernel/process.c +index 0442ab00518d3..7d69877511fac 100644 +--- a/arch/sparc/kernel/process.c ++++ b/arch/sparc/kernel/process.c +@@ -17,14 +17,18 @@ + + asmlinkage long sparc_fork(struct pt_regs *regs) + { +- unsigned long orig_i1 = regs->u_regs[UREG_I1]; ++ unsigned long orig_i1; + long ret; + struct kernel_clone_args args = { + .exit_signal = SIGCHLD, +- /* Reuse the parent's stack for the child. */ +- .stack = regs->u_regs[UREG_FP], + }; + ++ synchronize_user_stack(); ++ ++ orig_i1 = regs->u_regs[UREG_I1]; ++ /* Reuse the parent's stack for the child. */ ++ args.stack = regs->u_regs[UREG_FP]; ++ + ret = kernel_clone(&args); + + /* If we get an error and potentially restart the system +@@ -40,16 +44,19 @@ asmlinkage long sparc_fork(struct pt_regs *regs) + + asmlinkage long sparc_vfork(struct pt_regs *regs) + { +- unsigned long orig_i1 = regs->u_regs[UREG_I1]; ++ unsigned long orig_i1; + long ret; +- + struct kernel_clone_args args = { + .flags = CLONE_VFORK | CLONE_VM, + .exit_signal = SIGCHLD, +- /* Reuse the parent's stack for the child. */ +- .stack = regs->u_regs[UREG_FP], + }; + ++ synchronize_user_stack(); ++ ++ orig_i1 = regs->u_regs[UREG_I1]; ++ /* Reuse the parent's stack for the child. */ ++ args.stack = regs->u_regs[UREG_FP]; ++ + ret = kernel_clone(&args); + + /* If we get an error and potentially restart the system +@@ -65,15 +72,18 @@ asmlinkage long sparc_vfork(struct pt_regs *regs) + + asmlinkage long sparc_clone(struct pt_regs *regs) + { +- unsigned long orig_i1 = regs->u_regs[UREG_I1]; +- unsigned int flags = lower_32_bits(regs->u_regs[UREG_I0]); ++ unsigned long orig_i1; ++ unsigned int flags; + long ret; ++ struct kernel_clone_args args = {0}; + +- struct kernel_clone_args args = { +- .flags = (flags & ~CSIGNAL), +- .exit_signal = (flags & CSIGNAL), +- .tls = regs->u_regs[UREG_I3], +- }; ++ synchronize_user_stack(); ++ ++ orig_i1 = regs->u_regs[UREG_I1]; ++ flags = lower_32_bits(regs->u_regs[UREG_I0]); ++ args.flags = (flags & ~CSIGNAL); ++ args.exit_signal = (flags & CSIGNAL); ++ args.tls = regs->u_regs[UREG_I3]; + + #ifdef CONFIG_COMPAT + if (test_thread_flag(TIF_32BIT)) { +-- +2.51.0 + diff --git a/queue-6.18/spi-cadence-qspi-try-hard-to-disable-the-clocks.patch b/queue-6.18/spi-cadence-qspi-try-hard-to-disable-the-clocks.patch new file mode 100644 index 00000000000..cacdd952ba1 --- /dev/null +++ b/queue-6.18/spi-cadence-qspi-try-hard-to-disable-the-clocks.patch @@ -0,0 +1,54 @@ +From d86779d67393537c04c58c29e068c0c7aaa749fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 16:13:34 +0100 +Subject: spi: cadence-qspi: Try hard to disable the clocks + +From: Miquel Raynal (Schneider Electric) + +[ Upstream commit 612227b392eed94a3398dc03334a84a699a82276 ] + +In the remove path, we should try hard to perform all steps as we simply +cannot fail. + +The "no runtime PM" quirk must only alter the state of the RPM core, but +the clocks should still be disabled if that is possible. Move the +disable call outside of the RPM quirk. + +Tested-by: Wolfram Sang +Signed-off-by: Miquel Raynal (Schneider Electric) +Tested-by: Santhosh Kumar K +Link: https://patch.msgid.link/20260122-schneider-6-19-rc1-qspi-v4-9-f9c21419a3e6@bootlin.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-cadence-quadspi.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c +index 3689e38ebe56f..b3e4dd72d8b8a 100644 +--- a/drivers/spi/spi-cadence-quadspi.c ++++ b/drivers/spi/spi-cadence-quadspi.c +@@ -2044,6 +2044,7 @@ static void cqspi_remove(struct platform_device *pdev) + const struct cqspi_driver_platdata *ddata; + struct cqspi_st *cqspi = platform_get_drvdata(pdev); + struct device *dev = &pdev->dev; ++ int ret = 0; + + ddata = of_device_get_match_data(dev); + +@@ -2059,8 +2060,10 @@ static void cqspi_remove(struct platform_device *pdev) + dma_release_channel(cqspi->rx_chan); + + if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM))) +- if (pm_runtime_get_sync(&pdev->dev) >= 0) +- clk_disable(cqspi->clk); ++ ret = pm_runtime_get_sync(&pdev->dev); ++ ++ if (ret >= 0) ++ clk_disable(cqspi->clk); + + if (cqspi->is_jh7110) + cqspi_jh7110_disable_clk(pdev, cqspi); +-- +2.51.0 + diff --git a/queue-6.18/spi-cadence-quadspi-parse-dt-for-flashes-with-the-re.patch b/queue-6.18/spi-cadence-quadspi-parse-dt-for-flashes-with-the-re.patch new file mode 100644 index 00000000000..e0cd6c42306 --- /dev/null +++ b/queue-6.18/spi-cadence-quadspi-parse-dt-for-flashes-with-the-re.patch @@ -0,0 +1,83 @@ +From b3fbdd4af0a916894cc7b3e3d938f6a4a0a0b455 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Dec 2025 19:13:35 +0000 +Subject: spi: cadence-quadspi: Parse DT for flashes with the rest of the DT + parsing + +From: Mark Brown + +[ Upstream commit 9f0736a4e136a6eb61e0cf530ddc18ab6d816ba3 ] + +The recent refactoring of where runtime PM is enabled done in commit +f1eb4e792bb1 ("spi: spi-cadence-quadspi: Enable pm runtime earlier to +avoid imbalance") made the fact that when we do a pm_runtime_disable() +in the error paths of probe() we can trigger a runtime disable which in +turn results in duplicate clock disables. This is particularly likely +to happen when there is missing or broken DT description for the flashes +attached to the controller. + +Early on in the probe function we do a pm_runtime_get_noresume() since +the probe function leaves the device in a powered up state but in the +error path we can't assume that PM is enabled so we also manually +disable everything, including clocks. This means that when runtime PM is +active both it and the probe function release the same reference to the +main clock for the IP, triggering warnings from the clock subsystem: + +[ 8.693719] clk:75:7 already disabled +[ 8.693791] WARNING: CPU: 1 PID: 185 at /usr/src/kernel/drivers/clk/clk.c:1188 clk_core_disable+0xa0/0xb +... +[ 8.694261] clk_core_disable+0xa0/0xb4 (P) +[ 8.694272] clk_disable+0x38/0x60 +[ 8.694283] cqspi_probe+0x7c8/0xc5c [spi_cadence_quadspi] +[ 8.694309] platform_probe+0x5c/0xa4 + +Dealing with this issue properly is complicated by the fact that we +don't know if runtime PM is active so can't tell if it will disable the +clocks or not. We can, however, sidestep the issue for the flash +descriptions by moving their parsing to when we parse the controller +properties which also save us doing a bunch of setup which can never be +used so let's do that. + +Reported-by: Francesco Dolcini +Closes: https://lore.kernel.org/r/20251201072844.GA6785@francesco-nb +Signed-off-by: Mark Brown +Link: https://patch.msgid.link/20251204-spi-cadence-qspi-runtime-pm-imbalance-v2-1-10af9115d531@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-cadence-quadspi.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c +index 1cca9d87fbde4..3689e38ebe56f 100644 +--- a/drivers/spi/spi-cadence-quadspi.c ++++ b/drivers/spi/spi-cadence-quadspi.c +@@ -1853,6 +1853,12 @@ static int cqspi_probe(struct platform_device *pdev) + return -ENODEV; + } + ++ ret = cqspi_setup_flash(cqspi); ++ if (ret) { ++ dev_err(dev, "failed to setup flash parameters %d\n", ret); ++ return ret; ++ } ++ + /* Obtain QSPI clock. */ + cqspi->clk = devm_clk_get(dev, NULL); + if (IS_ERR(cqspi->clk)) { +@@ -1996,12 +2002,6 @@ static int cqspi_probe(struct platform_device *pdev) + pm_runtime_get_noresume(dev); + } + +- ret = cqspi_setup_flash(cqspi); +- if (ret) { +- dev_err(dev, "failed to setup flash parameters %d\n", ret); +- goto probe_setup_failed; +- } +- + host->num_chipselect = cqspi->num_chipselect; + + if (ddata && (ddata->quirks & CQSPI_SUPPORT_DEVICE_RESET)) +-- +2.51.0 + diff --git a/queue-6.18/spi-geni-qcom-fix-abort-sequence-execution-for-seria.patch b/queue-6.18/spi-geni-qcom-fix-abort-sequence-execution-for-seria.patch new file mode 100644 index 00000000000..58ff2f46fec --- /dev/null +++ b/queue-6.18/spi-geni-qcom-fix-abort-sequence-execution-for-seria.patch @@ -0,0 +1,71 @@ +From 068247050efc95315866f9660dd8f97d48e8eb40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 21:58:52 +0530 +Subject: spi: geni-qcom: Fix abort sequence execution for serial engine errors + +From: Praveen Talari + +[ Upstream commit 96e041647bb0f9d92f95df1d69cb7442d7408b79 ] + +The driver currently skips the abort sequence for target mode when serial +engine errors occur. This leads to improper error recovery as the serial +engine may remain in an undefined state without proper cleanup, potentially +causing subsequent operations to fail or behave unpredictably. + +Fix this by ensuring the abort sequence and DMA reset always execute during +error recovery, as both are required for proper serial engine error +handling. + +Co-developed-by: Konrad Dybcio +Signed-off-by: Konrad Dybcio +Signed-off-by: Praveen Talari +Reviewed-by: Konrad Dybcio +Link: https://patch.msgid.link/20260204162854.1206323-3-praveen.talari@oss.qualcomm.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-geni-qcom.c | 24 ++++++++++-------------- + 1 file changed, 10 insertions(+), 14 deletions(-) + +diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c +index 5ab20d7955121..acfcf870efd84 100644 +--- a/drivers/spi/spi-geni-qcom.c ++++ b/drivers/spi/spi-geni-qcom.c +@@ -160,24 +160,20 @@ static void handle_se_timeout(struct spi_controller *spi, + xfer = mas->cur_xfer; + mas->cur_xfer = NULL; + +- if (spi->target) { +- /* +- * skip CMD Cancel sequnece since spi target +- * doesn`t support CMD Cancel sequnece +- */ ++ /* The controller doesn't support the Cancel commnand in target mode */ ++ if (!spi->target) { ++ reinit_completion(&mas->cancel_done); ++ geni_se_cancel_m_cmd(se); ++ + spin_unlock_irq(&mas->lock); +- goto reset_if_dma; +- } + +- reinit_completion(&mas->cancel_done); +- geni_se_cancel_m_cmd(se); +- spin_unlock_irq(&mas->lock); ++ time_left = wait_for_completion_timeout(&mas->cancel_done, HZ); ++ if (time_left) ++ goto reset_if_dma; + +- time_left = wait_for_completion_timeout(&mas->cancel_done, HZ); +- if (time_left) +- goto reset_if_dma; ++ spin_lock_irq(&mas->lock); ++ } + +- spin_lock_irq(&mas->lock); + reinit_completion(&mas->abort_done); + geni_se_abort_m_cmd(se); + spin_unlock_irq(&mas->lock); +-- +2.51.0 + diff --git a/queue-6.18/spi-geni-qcom-initialize-mode-related-registers-to-0.patch b/queue-6.18/spi-geni-qcom-initialize-mode-related-registers-to-0.patch new file mode 100644 index 00000000000..539b6573c56 --- /dev/null +++ b/queue-6.18/spi-geni-qcom-initialize-mode-related-registers-to-0.patch @@ -0,0 +1,40 @@ +From 0fc47aedc10403cb4eded29ff528f813cc5192c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Nov 2025 16:12:01 -0500 +Subject: spi-geni-qcom: initialize mode related registers to 0 + +From: Jonathan Marek + +[ Upstream commit 739062a9f1e9a77a9687c8fd30f8e5dd12ec70be ] + +setup_fifo_params assumes these will be zero, it won't write these +registers if the initial mode is zero. + +Signed-off-by: Jonathan Marek +Link: https://patch.msgid.link/20251120211204.24078-4-jonathan@marek.ca +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-geni-qcom.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c +index a0d8d3425c6c6..9e9953469b3a0 100644 +--- a/drivers/spi/spi-geni-qcom.c ++++ b/drivers/spi/spi-geni-qcom.c +@@ -724,6 +724,12 @@ static int spi_geni_init(struct spi_geni_master *mas) + case 0: + mas->cur_xfer_mode = GENI_SE_FIFO; + geni_se_select_mode(se, GENI_SE_FIFO); ++ /* setup_fifo_params assumes that these registers start with a zero value */ ++ writel(0, se->base + SE_SPI_LOOPBACK); ++ writel(0, se->base + SE_SPI_DEMUX_SEL); ++ writel(0, se->base + SE_SPI_CPHA); ++ writel(0, se->base + SE_SPI_CPOL); ++ writel(0, se->base + SE_SPI_DEMUX_OUTPUT_INV); + ret = 0; + break; + } +-- +2.51.0 + diff --git a/queue-6.18/spi-geni-qcom-use-xfer-bits_per_word-for-can_dma.patch b/queue-6.18/spi-geni-qcom-use-xfer-bits_per_word-for-can_dma.patch new file mode 100644 index 00000000000..6dbaaaf2860 --- /dev/null +++ b/queue-6.18/spi-geni-qcom-use-xfer-bits_per_word-for-can_dma.patch @@ -0,0 +1,50 @@ +From 97a58bbf521a906dc5773534c7051379db9da79a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Nov 2025 16:12:00 -0500 +Subject: spi-geni-qcom: use xfer->bits_per_word for can_dma() + +From: Jonathan Marek + +[ Upstream commit fb2bbe3838728f572485706677590e4fc41eec5c ] + +mas->cur_bits_per_word may not reflect the value of xfer->bits_per_word +when can_dma() is called. Use the right value instead. + +Signed-off-by: Jonathan Marek +Link: https://patch.msgid.link/20251120211204.24078-3-jonathan@marek.ca +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-geni-qcom.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c +index 9e9953469b3a0..5ab20d7955121 100644 +--- a/drivers/spi/spi-geni-qcom.c ++++ b/drivers/spi/spi-geni-qcom.c +@@ -548,10 +548,10 @@ static u32 get_xfer_len_in_words(struct spi_transfer *xfer, + { + u32 len; + +- if (!(mas->cur_bits_per_word % MIN_WORD_LEN)) +- len = xfer->len * BITS_PER_BYTE / mas->cur_bits_per_word; ++ if (!(xfer->bits_per_word % MIN_WORD_LEN)) ++ len = xfer->len * BITS_PER_BYTE / xfer->bits_per_word; + else +- len = xfer->len / (mas->cur_bits_per_word / BITS_PER_BYTE + 1); ++ len = xfer->len / (xfer->bits_per_word / BITS_PER_BYTE + 1); + len &= TRANS_LEN_MSK; + + return len; +@@ -571,7 +571,7 @@ static bool geni_can_dma(struct spi_controller *ctlr, + return true; + + len = get_xfer_len_in_words(xfer, mas); +- fifo_size = mas->tx_fifo_depth * mas->fifo_width_bits / mas->cur_bits_per_word; ++ fifo_size = mas->tx_fifo_depth * mas->fifo_width_bits / xfer->bits_per_word; + + if (len > fifo_size) + return true; +-- +2.51.0 + diff --git a/queue-6.18/spi-spi-mem-limit-octal-dtr-constraints-to-octal-dtr.patch b/queue-6.18/spi-spi-mem-limit-octal-dtr-constraints-to-octal-dtr.patch new file mode 100644 index 00000000000..5b215fc5ec7 --- /dev/null +++ b/queue-6.18/spi-spi-mem-limit-octal-dtr-constraints-to-octal-dtr.patch @@ -0,0 +1,62 @@ +From 1db8c46879196949cc693cc0a07fb518552d8917 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jan 2026 18:18:01 +0100 +Subject: spi: spi-mem: Limit octal DTR constraints to octal DTR situations + +From: Miquel Raynal + +[ Upstream commit 8618271887ca10ac5108fe7e1d82ba8f1b152cf9 ] + +In this helper, any operation with a single DTR cycle (like 1S-1S-8D) is +considered requiring a duplicated command opcode. This is wrong as this +constraint only applies to octal DTR operations (8D-8D-8D). + +Narrow the application of this constraint to the concerned bus +interface. + +Note: none of the possible XD-XD-XD pattern, with X being one of {1, 2, +4} would benefit from this check either as there is only in octal DTR +mode that a single clock edge would be enough to transmit the full +opcode. + +Make sure the constraint of expecting two bytes for the command is +applied to the relevant bus interface. + +Reviewed-by: Tudor Ambarus +Signed-off-by: Miquel Raynal +Link: https://patch.msgid.link/20260109-winbond-v6-17-rc1-oddr-v2-3-1fff6a2ddb80@bootlin.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-mem.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c +index 064b99204d9ac..71e3eaf59df97 100644 +--- a/drivers/spi/spi-mem.c ++++ b/drivers/spi/spi-mem.c +@@ -175,8 +175,19 @@ bool spi_mem_default_supports_op(struct spi_mem *mem, + if (op->data.swap16 && !spi_mem_controller_is_capable(ctlr, swap16)) + return false; + +- if (op->cmd.nbytes != 2) +- return false; ++ /* Extra 8D-8D-8D limitations */ ++ if (op->cmd.dtr && op->cmd.buswidth == 8) { ++ if (op->cmd.nbytes != 2) ++ return false; ++ ++ if ((op->addr.nbytes % 2) || ++ (op->dummy.nbytes % 2) || ++ (op->data.nbytes % 2)) { ++ dev_err(&ctlr->dev, ++ "Even byte numbers not allowed in octal DTR operations\n"); ++ return false; ++ } ++ } + } else { + if (op->cmd.nbytes != 1) + return false; +-- +2.51.0 + diff --git a/queue-6.18/spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch b/queue-6.18/spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch new file mode 100644 index 00000000000..e8ba8ed10cd --- /dev/null +++ b/queue-6.18/spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch @@ -0,0 +1,60 @@ +From 63b6c71dbbd5ebe12a7466b71666a4ec57a5ad8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 20:30:04 +0800 +Subject: spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end + +From: Chin-Ting Kuo + +[ Upstream commit 53f826ff5e0e3ecb279862ca7cce1491b94bb017 ] + +spi_mem_dirmap_create() may reconfigure controller-wide settings, +which can interfere with concurrent transfers to other devices +sharing the same SPI controller but using different chip selects. + +Wrap the ->dirmap_create() callback with spi_mem_access_start() and +spi_mem_access_end() to serialize access and prevent cross-CS +interference during dirmap creation. + +This patch has been verified on a setup where a SPI TPM is connected +to CS0 of a SPI controller, while a SPI NOR flash is connected to CS1 +of the same controller. Without this patch, spi_mem_dirmap_create() +for the SPI NOR flash interferes with ongoing SPI TPM data transfers, +resulting in failure to create the TPM device. This was tested on an +ASPEED AST2700 EVB. + +Signed-off-by: Chin-Ting Kuo +Reviewed-by: Paul Menzel +Link: https://patch.msgid.link/20260120123005.1392071-2-chin-ting_kuo@aspeedtech.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-mem.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c +index 71e3eaf59df97..db9467535416d 100644 +--- a/drivers/spi/spi-mem.c ++++ b/drivers/spi/spi-mem.c +@@ -714,9 +714,18 @@ spi_mem_dirmap_create(struct spi_mem *mem, + + desc->mem = mem; + desc->info = *info; +- if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create) ++ if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create) { ++ ret = spi_mem_access_start(mem); ++ if (ret) { ++ kfree(desc); ++ return ERR_PTR(ret); ++ } ++ + ret = ctlr->mem_ops->dirmap_create(desc); + ++ spi_mem_access_end(mem); ++ } ++ + if (ret) { + desc->nodirmap = true; + if (!spi_mem_supports_op(desc->mem, &desc->info.op_tmpl)) +-- +2.51.0 + diff --git a/queue-6.18/spi-spidev-fix-lock-inversion-between-spi_lock-and-b.patch b/queue-6.18/spi-spidev-fix-lock-inversion-between-spi_lock-and-b.patch new file mode 100644 index 00000000000..edb2be1af0f --- /dev/null +++ b/queue-6.18/spi-spidev-fix-lock-inversion-between-spi_lock-and-b.patch @@ -0,0 +1,218 @@ +From f4e0491391cce1544534ed39e15cf52e4703efec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Feb 2026 08:26:16 +0100 +Subject: spi: spidev: fix lock inversion between spi_lock and buf_lock + +From: Fabian Godehardt + +[ Upstream commit 40534d19ed2afb880ecf202dab26a8e7a5808d16 ] + +The spidev driver previously used two mutexes, spi_lock and buf_lock, +but acquired them in different orders depending on the code path: + + write()/read(): buf_lock -> spi_lock + ioctl(): spi_lock -> buf_lock + +This AB-BA locking pattern triggers lockdep warnings and can +cause real deadlocks: + + WARNING: possible circular locking dependency detected + spidev_ioctl() -> mutex_lock(&spidev->buf_lock) + spidev_sync_write() -> mutex_lock(&spidev->spi_lock) + *** DEADLOCK *** + +The issue is reproducible with a simple userspace program that +performs write() and SPI_IOC_WR_MAX_SPEED_HZ ioctl() calls from +separate threads on the same spidev file descriptor. + +Fix this by simplifying the locking model and removing the lock +inversion entirely. spidev_sync() no longer performs any locking, +and all callers serialize access using spi_lock. + +buf_lock is removed since its functionality is fully covered by +spi_lock, eliminating the possibility of lock ordering issues. + +This removes the lock inversion and prevents deadlocks without +changing userspace ABI or behaviour. + +Signed-off-by: Fabian Godehardt +Link: https://patch.msgid.link/20260211072616.489522-1-fg@emlix.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spidev.c | 63 ++++++++++++++++---------------------------- + 1 file changed, 22 insertions(+), 41 deletions(-) + +diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c +index 5300c942a2a44..4d53c394101a4 100644 +--- a/drivers/spi/spidev.c ++++ b/drivers/spi/spidev.c +@@ -74,7 +74,6 @@ struct spidev_data { + struct list_head device_entry; + + /* TX/RX buffers are NULL unless this device is open (users > 0) */ +- struct mutex buf_lock; + unsigned users; + u8 *tx_buffer; + u8 *rx_buffer; +@@ -102,24 +101,6 @@ spidev_sync_unlocked(struct spi_device *spi, struct spi_message *message) + return status; + } + +-static ssize_t +-spidev_sync(struct spidev_data *spidev, struct spi_message *message) +-{ +- ssize_t status; +- struct spi_device *spi; +- +- mutex_lock(&spidev->spi_lock); +- spi = spidev->spi; +- +- if (spi == NULL) +- status = -ESHUTDOWN; +- else +- status = spidev_sync_unlocked(spi, message); +- +- mutex_unlock(&spidev->spi_lock); +- return status; +-} +- + static inline ssize_t + spidev_sync_write(struct spidev_data *spidev, size_t len) + { +@@ -132,7 +113,8 @@ spidev_sync_write(struct spidev_data *spidev, size_t len) + + spi_message_init(&m); + spi_message_add_tail(&t, &m); +- return spidev_sync(spidev, &m); ++ ++ return spidev_sync_unlocked(spidev->spi, &m); + } + + static inline ssize_t +@@ -147,7 +129,8 @@ spidev_sync_read(struct spidev_data *spidev, size_t len) + + spi_message_init(&m); + spi_message_add_tail(&t, &m); +- return spidev_sync(spidev, &m); ++ ++ return spidev_sync_unlocked(spidev->spi, &m); + } + + /*-------------------------------------------------------------------------*/ +@@ -157,7 +140,7 @@ static ssize_t + spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos) + { + struct spidev_data *spidev; +- ssize_t status; ++ ssize_t status = -ESHUTDOWN; + + /* chipselect only toggles at start or end of operation */ + if (count > bufsiz) +@@ -165,7 +148,11 @@ spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos) + + spidev = filp->private_data; + +- mutex_lock(&spidev->buf_lock); ++ mutex_lock(&spidev->spi_lock); ++ ++ if (spidev->spi == NULL) ++ goto err_spi_removed; ++ + status = spidev_sync_read(spidev, count); + if (status > 0) { + unsigned long missing; +@@ -176,7 +163,9 @@ spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos) + else + status = status - missing; + } +- mutex_unlock(&spidev->buf_lock); ++ ++err_spi_removed: ++ mutex_unlock(&spidev->spi_lock); + + return status; + } +@@ -187,7 +176,7 @@ spidev_write(struct file *filp, const char __user *buf, + size_t count, loff_t *f_pos) + { + struct spidev_data *spidev; +- ssize_t status; ++ ssize_t status = -ESHUTDOWN; + unsigned long missing; + + /* chipselect only toggles at start or end of operation */ +@@ -196,13 +185,19 @@ spidev_write(struct file *filp, const char __user *buf, + + spidev = filp->private_data; + +- mutex_lock(&spidev->buf_lock); ++ mutex_lock(&spidev->spi_lock); ++ ++ if (spidev->spi == NULL) ++ goto err_spi_removed; ++ + missing = copy_from_user(spidev->tx_buffer, buf, count); + if (missing == 0) + status = spidev_sync_write(spidev, count); + else + status = -EFAULT; +- mutex_unlock(&spidev->buf_lock); ++ ++err_spi_removed: ++ mutex_unlock(&spidev->spi_lock); + + return status; + } +@@ -379,14 +374,6 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) + + ctlr = spi->controller; + +- /* use the buffer lock here for triple duty: +- * - prevent I/O (from us) so calling spi_setup() is safe; +- * - prevent concurrent SPI_IOC_WR_* from morphing +- * data fields while SPI_IOC_RD_* reads them; +- * - SPI_IOC_MESSAGE needs the buffer locked "normally". +- */ +- mutex_lock(&spidev->buf_lock); +- + switch (cmd) { + /* read requests */ + case SPI_IOC_RD_MODE: +@@ -510,7 +497,6 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) + break; + } + +- mutex_unlock(&spidev->buf_lock); + spi_dev_put(spi); + mutex_unlock(&spidev->spi_lock); + return retval; +@@ -541,9 +527,6 @@ spidev_compat_ioc_message(struct file *filp, unsigned int cmd, + return -ESHUTDOWN; + } + +- /* SPI_IOC_MESSAGE needs the buffer locked "normally" */ +- mutex_lock(&spidev->buf_lock); +- + /* Check message and copy into scratch area */ + ioc = spidev_get_ioc_message(cmd, u_ioc, &n_ioc); + if (IS_ERR(ioc)) { +@@ -564,7 +547,6 @@ spidev_compat_ioc_message(struct file *filp, unsigned int cmd, + kfree(ioc); + + done: +- mutex_unlock(&spidev->buf_lock); + spi_dev_put(spi); + mutex_unlock(&spidev->spi_lock); + return retval; +@@ -800,7 +782,6 @@ static int spidev_probe(struct spi_device *spi) + /* Initialize the driver data */ + spidev->spi = spi; + mutex_init(&spidev->spi_lock); +- mutex_init(&spidev->buf_lock); + + INIT_LIST_HEAD(&spidev->device_entry); + +-- +2.51.0 + diff --git a/queue-6.18/spi-stm32-fix-overrun-issue-at-8bpw.patch b/queue-6.18/spi-stm32-fix-overrun-issue-at-8bpw.patch new file mode 100644 index 00000000000..53c68f71c9d --- /dev/null +++ b/queue-6.18/spi-stm32-fix-overrun-issue-at-8bpw.patch @@ -0,0 +1,53 @@ +From e6c94b7036006a00021e588b4da84b1a877674cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Dec 2025 11:48:28 +0100 +Subject: spi: stm32: fix Overrun issue at < 8bpw + +From: Deepak Kumar + +[ Upstream commit 1ac3be217c01d5df55ec5052f81e4f1708f46552 ] + +When SPI communication is suspended by hardware automatically, it could +happen that few bits of next frame are already clocked out due to +internal synchronization delay. + +To achieve a safe suspension, we need to ensure that each word must be +at least 8 SPI clock cycles long. That's why, if bpw is less than 8 +bits, we need to use midi to reach 8 SPI clock cycles at least. + +This will ensure that each word achieve safe suspension and prevent +overrun condition. + +Signed-off-by: Deepak Kumar +Signed-off-by: Alain Volmat +Link: https://patch.msgid.link/20251218-stm32-spi-enhancements-v2-2-3b69901ca9fe@foss.st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index 2c804c1aef989..80986bd251d29 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -1906,11 +1906,12 @@ static void stm32h7_spi_data_idleness(struct stm32_spi *spi, struct spi_transfer + cfg2_clrb |= STM32H7_SPI_CFG2_MIDI; + if ((len > 1) && (spi->cur_midi > 0)) { + u32 sck_period_ns = DIV_ROUND_UP(NSEC_PER_SEC, spi->cur_speed); +- u32 midi = min_t(u32, +- DIV_ROUND_UP(spi->cur_midi, sck_period_ns), +- FIELD_GET(STM32H7_SPI_CFG2_MIDI, +- STM32H7_SPI_CFG2_MIDI)); ++ u32 midi = DIV_ROUND_UP(spi->cur_midi, sck_period_ns); + ++ if ((spi->cur_bpw + midi) < 8) ++ midi = 8 - spi->cur_bpw; ++ ++ midi = min_t(u32, midi, FIELD_MAX(STM32H7_SPI_CFG2_MIDI)); + + dev_dbg(spi->dev, "period=%dns, midi=%d(=%dns)\n", + sck_period_ns, midi, midi * sck_period_ns); +-- +2.51.0 + diff --git a/queue-6.18/staging-rtl8723bs-fix-memory-leak-on-failure-path.patch b/queue-6.18/staging-rtl8723bs-fix-memory-leak-on-failure-path.patch new file mode 100644 index 00000000000..ac2f41ff4a8 --- /dev/null +++ b/queue-6.18/staging-rtl8723bs-fix-memory-leak-on-failure-path.patch @@ -0,0 +1,42 @@ +From f34aaeb860eace943d1e00e20d6ae0058acd93ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 14:47:12 +0530 +Subject: staging: rtl8723bs: fix memory leak on failure path + +From: Diksha Kumari + +[ Upstream commit abe850d82c8cb72d28700673678724e779b1826e ] + +cfg80211_inform_bss_frame() may return NULL on failure. In that case, +the allocated buffer 'buf' is not freed and the function returns early, +leading to potential memory leak. +Fix this by ensuring that 'buf' is freed on both success and failure paths. + +Signed-off-by: Diksha Kumari +Reviewed-by: Mukesh Kumar Chaurasiya +Link: https://patch.msgid.link/20260113091712.7071-1-dikshakdevgan@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +index 315bab3737294..5d28dbf8b50ef 100644 +--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c ++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +@@ -315,9 +315,10 @@ struct cfg80211_bss *rtw_cfg80211_inform_bss(struct adapter *padapter, struct wl + len, notify_signal, GFP_ATOMIC); + + if (unlikely(!bss)) +- goto exit; ++ goto free_buf; + + cfg80211_put_bss(wiphy, bss); ++free_buf: + kfree(buf); + + exit: +-- +2.51.0 + diff --git a/queue-6.18/staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch b/queue-6.18/staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch new file mode 100644 index 00000000000..9762158180f --- /dev/null +++ b/queue-6.18/staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch @@ -0,0 +1,44 @@ +From cbfef9c5aaf29fa220413b69d0afc058fa613cd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 17:27:28 +0800 +Subject: staging: rtl8723bs: fix missing status update on sdio_alloc_irq() + failure + +From: Liang Jie + +[ Upstream commit 618b4aec12faabc7579a6b0df046842d798a4c7c ] + +The return value of sdio_alloc_irq() was not stored in status. +If sdio_alloc_irq() fails after rtw_drv_register_netdev() succeeds, +status remains _SUCCESS and the error path skips resource cleanup, +while rtw_drv_init() still returns success. + +Store the return value of sdio_alloc_irq() in status and reuse the +existing error handling which relies on status. + +Reviewed-by: fanggeng +Signed-off-by: Liang Jie +Link: https://patch.msgid.link/20251208092730.262499-1-buaajxlj@163.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c +index f3caaa857c864..139ace51486d2 100644 +--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c ++++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c +@@ -377,7 +377,8 @@ static int rtw_drv_init( + if (status != _SUCCESS) + goto free_if1; + +- if (sdio_alloc_irq(dvobj) != _SUCCESS) ++ status = sdio_alloc_irq(dvobj); ++ if (status != _SUCCESS) + goto free_if1; + + status = _SUCCESS; +-- +2.51.0 + diff --git a/queue-6.18/statmount-permission-check-should-return-eperm.patch b/queue-6.18/statmount-permission-check-should-return-eperm.patch new file mode 100644 index 00000000000..2756615f476 --- /dev/null +++ b/queue-6.18/statmount-permission-check-should-return-eperm.patch @@ -0,0 +1,38 @@ +From f1223b4b657a26e6ffc4a8a7036660f77206e154 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Nov 2025 14:41:20 +0530 +Subject: statmount: permission check should return EPERM + +From: Bhavik Sachdev + +[ Upstream commit fccbe38a5d06dbe44bcd89196fe1d2c2272a1f4a ] + +Currently, statmount() returns ENOENT when caller is not CAP_SYS_ADMIN +in the user namespace owner of target mount namespace. This should be +EPERM instead. + +Suggested-by: Miklos Szeredi +Signed-off-by: Bhavik Sachdev +Link: https://patch.msgid.link/20251129091455.757724-2-b.sachdev1904@gmail.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/namespace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/namespace.c b/fs/namespace.c +index 4272349650b14..5b31682db450e 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -5796,7 +5796,7 @@ SYSCALL_DEFINE4(statmount, const struct mnt_id_req __user *, req, + + if (kreq.mnt_ns_id && (ns != current->nsproxy->mnt_ns) && + !ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN)) +- return -ENOENT; ++ return -EPERM; + + ks = kmalloc(sizeof(*ks), GFP_KERNEL_ACCOUNT); + if (!ks) +-- +2.51.0 + diff --git a/queue-6.18/thermal-int340x-fix-sysfs-group-leak-on-dlvr-registr.patch b/queue-6.18/thermal-int340x-fix-sysfs-group-leak-on-dlvr-registr.patch new file mode 100644 index 00000000000..2f7eeb9cec1 --- /dev/null +++ b/queue-6.18/thermal-int340x-fix-sysfs-group-leak-on-dlvr-registr.patch @@ -0,0 +1,45 @@ +From 331737a72b916b91fc29eb2ee960882e573c94f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Feb 2026 08:23:15 +0000 +Subject: thermal: int340x: Fix sysfs group leak on DLVR registration failure + +From: Kaushlendra Kumar + +[ Upstream commit 15176b818e048ccf6ef4b96db34eda7b7e98938a ] + +When DLVR sysfs group creation fails in proc_thermal_rfim_add(), +the function returns immediately without cleaning up the FIVR group +that may have been created earlier. + +Add proper error unwinding to remove the FIVR group before returning +failure. + +Signed-off-by: Kaushlendra Kumar +Acked-by: Srinivas Pandruvada +Link: https://patch.msgid.link/LV3PR11MB876881B77D32A2854AD2908EF563A@LV3PR11MB8768.namprd11.prod.outlook.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + .../thermal/intel/int340x_thermal/processor_thermal_rfim.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c +index 1f3d22b659dbe..635bc8fded1e9 100644 +--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c ++++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c +@@ -451,8 +451,11 @@ int proc_thermal_rfim_add(struct pci_dev *pdev, struct proc_thermal_device *proc + break; + } + ret = sysfs_create_group(&pdev->dev.kobj, &dlvr_attribute_group); +- if (ret) ++ if (ret) { ++ if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_FIVR) ++ sysfs_remove_group(&pdev->dev.kobj, &fivr_attribute_group); + return ret; ++ } + } + + if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_DVFS) { +-- +2.51.0 + diff --git a/queue-6.18/tools-cpupower-fix-inverted-aperf-capability-check.patch b/queue-6.18/tools-cpupower-fix-inverted-aperf-capability-check.patch new file mode 100644 index 00000000000..8cd6062232b --- /dev/null +++ b/queue-6.18/tools-cpupower-fix-inverted-aperf-capability-check.patch @@ -0,0 +1,39 @@ +From 2840037173c66d116ebb3cc2365697bb10c0a064 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Nov 2025 14:46:13 +0530 +Subject: tools/cpupower: Fix inverted APERF capability check + +From: Kaushlendra Kumar + +[ Upstream commit 24858a84163c8d04827166b3bcaed80612bb62fc ] + +The capability check was inverted, causing the function to return +error when APERF support is available and proceed when it is not. + +Negate the condition to return error only when APERF capability +is absent. + +Link: https://lore.kernel.org/r/20251126091613.567480-1-kaushlendra.kumar@intel.com +Signed-off-by: Kaushlendra Kumar +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/power/cpupower/utils/cpufreq-info.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/power/cpupower/utils/cpufreq-info.c b/tools/power/cpupower/utils/cpufreq-info.c +index 7d3732f5f2f6f..5fe01e516817e 100644 +--- a/tools/power/cpupower/utils/cpufreq-info.c ++++ b/tools/power/cpupower/utils/cpufreq-info.c +@@ -270,7 +270,7 @@ static int get_freq_hardware(unsigned int cpu, unsigned int human) + { + unsigned long freq; + +- if (cpupower_cpu_info.caps & CPUPOWER_CAP_APERF) ++ if (!(cpupower_cpu_info.caps & CPUPOWER_CAP_APERF)) + return -EINVAL; + + freq = cpufreq_get_freq_hardware(cpu); +-- +2.51.0 + diff --git a/queue-6.18/tools-headers-go-back-to-include-asm-generic-unistd..patch b/queue-6.18/tools-headers-go-back-to-include-asm-generic-unistd..patch new file mode 100644 index 00000000000..0aece21529a --- /dev/null +++ b/queue-6.18/tools-headers-go-back-to-include-asm-generic-unistd..patch @@ -0,0 +1,91 @@ +From 94d0768803c6b199d15b1d86d902b362f4fdf2dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 09:43:24 +0000 +Subject: tools headers: Go back to include asm-generic/unistd.h for arm64 + +From: Leo Yan + +[ Upstream commit 096b86ce08332fbcb0ec6ff6714c44899ec03970 ] + +The header unistd.h is included under Arm64's uAPI folder (see +tools/arch/arm64/include/uapi/asm/), but it does not include its +dependent header unistd_64.h. + +The intention is for unistd_64.h to be generated dynamically using +scripts/Makefile.asm-headers. + +However, this dynamic approach causes problems because the header is not +available early enough, even though it is widely included throughout +tools. + +Using the perf build as an example: + + 1) Feature detection: Perf first runs feature tests. + + The BPF feature program test-bpf.c includes unistd.h. Since + unistd_64.h has not been generated yet, the program fails to build, + and the BPF feature ends up being disabled. + + 2) libperf build: + + The libperf Makefile later generates unistd_64.h on the fly, so + libperf itself builds successfully. + + 3) Final perf build: + + Although the perf binary can build successfully using the generated + header, we never get a chance to build BPF skeleton programs, + because BPF support was already disabled earlier. + +Restore to include asm-generic/unistd.h for fixing the issue. This +aligns with most architectures (x86 is a special case that keeps +unistd_32.h/unistd_64.h for its particular syscall numbers) and ensures +the header is available from the start. + +Fixes: 22f72088ffe69a37 ("tools headers: Update the syscall table with the kernel sources") +Reviewed-by: James Clark +Signed-off-by: Leo Yan +Cc: Adrian Hunter +Cc: Arnd Bergmann +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Namhyung Kim +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/arch/arm64/include/uapi/asm/unistd.h | 24 +++++++++++++++++++++- + 1 file changed, 23 insertions(+), 1 deletion(-) + +diff --git a/tools/arch/arm64/include/uapi/asm/unistd.h b/tools/arch/arm64/include/uapi/asm/unistd.h +index df36f23876e86..9306726337fe0 100644 +--- a/tools/arch/arm64/include/uapi/asm/unistd.h ++++ b/tools/arch/arm64/include/uapi/asm/unistd.h +@@ -1,2 +1,24 @@ + /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ +-#include ++/* ++ * Copyright (C) 2012 ARM Ltd. ++ * ++ * This program is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License version 2 as ++ * published by the Free Software Foundation. ++ * ++ * This program is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with this program. If not, see . ++ */ ++ ++#define __ARCH_WANT_RENAMEAT ++#define __ARCH_WANT_NEW_STAT ++#define __ARCH_WANT_SET_GET_RLIMIT ++#define __ARCH_WANT_TIME32_SYSCALLS ++#define __ARCH_WANT_MEMFD_SECRET ++ ++#include +-- +2.51.0 + diff --git a/queue-6.18/tools-power-cpupower-reset-errno-before-strtoull.patch b/queue-6.18/tools-power-cpupower-reset-errno-before-strtoull.patch new file mode 100644 index 00000000000..fcda31104b5 --- /dev/null +++ b/queue-6.18/tools-power-cpupower-reset-errno-before-strtoull.patch @@ -0,0 +1,37 @@ +From 86acd9473ecffa58c556d3a4231960f5686c79a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 17:47:45 +0530 +Subject: tools/power cpupower: Reset errno before strtoull() + +From: Kaushlendra Kumar + +[ Upstream commit f9bd3762cf1bd0c2465f2e6121b340883471d1bf ] + +cpuidle_state_get_one_value() never cleared errno before calling +strtoull(), so a prior ERANGE caused every cpuidle counter read to +return zero. Reset errno to 0 before the conversion so each sysfs read +is evaluated independently. + +Link: https://lore.kernel.org/r/20251201121745.3776703-1-kaushlendra.kumar@intel.com +Signed-off-by: Kaushlendra Kumar +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/power/cpupower/lib/cpuidle.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c +index f2c1139adf716..bd857ee7541a7 100644 +--- a/tools/power/cpupower/lib/cpuidle.c ++++ b/tools/power/cpupower/lib/cpuidle.c +@@ -150,6 +150,7 @@ unsigned long long cpuidle_state_get_one_value(unsigned int cpu, + if (len == 0) + return 0; + ++ errno = 0; + value = strtoull(linebuf, &endp, 0); + + if (endp == linebuf || errno == ERANGE) +-- +2.51.0 + diff --git a/queue-6.18/tracing-fix-false-sharing-in-hwlat-get_sample.patch b/queue-6.18/tracing-fix-false-sharing-in-hwlat-get_sample.patch new file mode 100644 index 00000000000..cd45043bce7 --- /dev/null +++ b/queue-6.18/tracing-fix-false-sharing-in-hwlat-get_sample.patch @@ -0,0 +1,113 @@ +From 6291b2a682c39727aadd6781fd361c4bc68cd089 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 23:48:10 -0800 +Subject: tracing: Fix false sharing in hwlat get_sample() + +From: Colin Lord + +[ Upstream commit f743435f988cb0cf1f521035aee857851b25e06d ] + +The get_sample() function in the hwlat tracer assumes the caller holds +hwlat_data.lock, but this is not actually happening. The result is +unprotected data access to hwlat_data, and in per-cpu mode can result in +false sharing which may show up as false positive latency events. + +The specific case of false sharing observed was primarily between +hwlat_data.sample_width and hwlat_data.count. These are separated by +just 8B and are therefore likely to share a cache line. When one thread +modifies count, the cache line is in a modified state so when other +threads read sample_width in the main latency detection loop, they fetch +the modified cache line. On some systems, the fetch itself may be slow +enough to count as a latency event, which could set up a self +reinforcing cycle of latency events as each event increments count which +then causes more latency events, continuing the cycle. + +The other result of the unprotected data access is that hwlat_data.count +can end up with duplicate or missed values, which was observed on some +systems in testing. + +Convert hwlat_data.count to atomic64_t so it can be safely modified +without locking, and prevent false sharing by pulling sample_width into +a local variable. + +One system this was tested on was a dual socket server with 32 CPUs on +each numa node. With settings of 1us threshold, 1000us width, and +2000us window, this change reduced the number of latency events from +500 per second down to approximately 1 event per minute. Some machines +tested did not exhibit measurable latency from the false sharing. + +Cc: Masami Hiramatsu +Cc: Mathieu Desnoyers +Link: https://patch.msgid.link/20260210074810.6328-1-clord@mykolab.com +Signed-off-by: Colin Lord +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_hwlat.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c +index 2f7b94e98317c..3fe274b84f1c2 100644 +--- a/kernel/trace/trace_hwlat.c ++++ b/kernel/trace/trace_hwlat.c +@@ -102,9 +102,9 @@ struct hwlat_sample { + /* keep the global state somewhere. */ + static struct hwlat_data { + +- struct mutex lock; /* protect changes */ ++ struct mutex lock; /* protect changes */ + +- u64 count; /* total since reset */ ++ atomic64_t count; /* total since reset */ + + u64 sample_window; /* total sampling window (on+off) */ + u64 sample_width; /* active sampling portion of window */ +@@ -193,8 +193,7 @@ void trace_hwlat_callback(bool enter) + * get_sample - sample the CPU TSC and look for likely hardware latencies + * + * Used to repeatedly capture the CPU TSC (or similar), looking for potential +- * hardware-induced latency. Called with interrupts disabled and with +- * hwlat_data.lock held. ++ * hardware-induced latency. Called with interrupts disabled. + */ + static int get_sample(void) + { +@@ -204,6 +203,7 @@ static int get_sample(void) + time_type start, t1, t2, last_t2; + s64 diff, outer_diff, total, last_total = 0; + u64 sample = 0; ++ u64 sample_width = READ_ONCE(hwlat_data.sample_width); + u64 thresh = tracing_thresh; + u64 outer_sample = 0; + int ret = -1; +@@ -267,7 +267,7 @@ static int get_sample(void) + if (diff > sample) + sample = diff; /* only want highest value */ + +- } while (total <= hwlat_data.sample_width); ++ } while (total <= sample_width); + + barrier(); /* finish the above in the view for NMIs */ + trace_hwlat_callback_enabled = false; +@@ -285,8 +285,7 @@ static int get_sample(void) + if (kdata->nmi_total_ts) + do_div(kdata->nmi_total_ts, NSEC_PER_USEC); + +- hwlat_data.count++; +- s.seqnum = hwlat_data.count; ++ s.seqnum = atomic64_inc_return(&hwlat_data.count); + s.duration = sample; + s.outer_duration = outer_sample; + s.nmi_total_ts = kdata->nmi_total_ts; +@@ -832,7 +831,7 @@ static int hwlat_tracer_init(struct trace_array *tr) + + hwlat_trace = tr; + +- hwlat_data.count = 0; ++ atomic64_set(&hwlat_data.count, 0); + tr->max_latency = 0; + save_tracing_thresh = tracing_thresh; + +-- +2.51.0 + diff --git a/queue-6.18/um-preserve-errno-within-signal-handler.patch b/queue-6.18/um-preserve-errno-within-signal-handler.patch new file mode 100644 index 00000000000..fb82703cd6a --- /dev/null +++ b/queue-6.18/um-preserve-errno-within-signal-handler.patch @@ -0,0 +1,59 @@ +From 3f66255bebd110fd1dd26e8f54b982e117d45a56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 08:12:27 +0800 +Subject: um: Preserve errno within signal handler + +From: Tiwei Bie + +[ Upstream commit f68b2d5a907b53eed99cf2efcaaae116df73c298 ] + +We rely on errno to determine whether a syscall has failed, so we +need to ensure that accessing errno is async-signal-safe. Currently, +we preserve the errno in sig_handler_common(), but it doesn't cover +every possible case. Let's do it in hard_handler() instead, which +is the signal handler we actually register. + +Signed-off-by: Tiwei Bie +Link: https://patch.msgid.link/20260106001228.1531146-2-tiwei.btw@antgroup.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + arch/um/os-Linux/signal.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/um/os-Linux/signal.c b/arch/um/os-Linux/signal.c +index 11f07f4982700..bebeb6b4bee8b 100644 +--- a/arch/um/os-Linux/signal.c ++++ b/arch/um/os-Linux/signal.c +@@ -35,7 +35,6 @@ void (*sig_info[NSIG])(int, struct siginfo *, struct uml_pt_regs *, void *mc) = + static void sig_handler_common(int sig, struct siginfo *si, mcontext_t *mc) + { + struct uml_pt_regs r; +- int save_errno = errno; + + r.is_user = 0; + if (sig == SIGSEGV) { +@@ -49,8 +48,6 @@ static void sig_handler_common(int sig, struct siginfo *si, mcontext_t *mc) + unblock_signals_trace(); + + (*sig_info[sig])(sig, si, &r, mc); +- +- errno = save_errno; + } + + /* +@@ -201,8 +198,11 @@ static void hard_handler(int sig, siginfo_t *si, void *p) + { + ucontext_t *uc = p; + mcontext_t *mc = &uc->uc_mcontext; ++ int save_errno = errno; + + (*handlers[sig])(sig, (struct siginfo *)si, mc); ++ ++ errno = save_errno; + } + + void set_handler(int sig) +-- +2.51.0 + diff --git a/queue-6.18/usb-chipidea-udc-fix-dma-and-sg-cleanup-in-_ep_nuke.patch b/queue-6.18/usb-chipidea-udc-fix-dma-and-sg-cleanup-in-_ep_nuke.patch new file mode 100644 index 00000000000..e2c8c84dd5e --- /dev/null +++ b/queue-6.18/usb-chipidea-udc-fix-dma-and-sg-cleanup-in-_ep_nuke.patch @@ -0,0 +1,72 @@ +From 1136876b5f18d09c1a091a081228a99fe1c1f017 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 16:59:02 +0000 +Subject: usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() + +From: Mario Peter + +[ Upstream commit cea2a1257a3b5ea3e769a445b34af13e6aa5a123 ] + +The ChipIdea UDC driver can encounter "not page aligned sg buffer" +errors when a USB device is reconnected after being disconnected +during an active transfer. This occurs because _ep_nuke() returns +requests to the gadget layer without properly unmapping DMA buffers +or cleaning up scatter-gather bounce buffers. + +Root cause: +When a disconnect happens during a multi-segment DMA transfer, the +request's num_mapped_sgs field and sgt.sgl pointer remain set with +stale values. The request is returned to the gadget driver with status +-ESHUTDOWN but still has active DMA state. If the gadget driver reuses +this request on reconnect without reinitializing it, the stale DMA +state causes _hardware_enqueue() to skip DMA mapping (seeing non-zero +num_mapped_sgs) and attempt to use freed/invalid DMA addresses, +leading to alignment errors and potential memory corruption. + +The normal completion path via _hardware_dequeue() properly calls +usb_gadget_unmap_request_by_dev() and sglist_do_debounce() before +returning the request. The _ep_nuke() path must do the same cleanup +to ensure requests are returned in a clean, reusable state. + +Fix: +Add DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror +the cleanup sequence in _hardware_dequeue(): +- Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set +- Call sglist_do_debounce() with copy=false if bounce buffer exists + +This ensures that when requests are returned due to endpoint shutdown, +they don't retain stale DMA mappings. The 'false' parameter to +sglist_do_debounce() prevents copying data back (appropriate for +shutdown path where transfer was aborted). + +Signed-off-by: Mario Peter +Reviewed-by: Xu Yang +Acked-by: Peter Chen +Link: https://patch.msgid.link/20260108165902.795354-1-mario.peter@leica-geosystems.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/chipidea/udc.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c +index 64a421ae0f05b..c8d931d9d4330 100644 +--- a/drivers/usb/chipidea/udc.c ++++ b/drivers/usb/chipidea/udc.c +@@ -931,6 +931,13 @@ __acquires(hwep->lock) + list_del_init(&hwreq->queue); + hwreq->req.status = -ESHUTDOWN; + ++ /* Unmap DMA and clean up bounce buffers before giving back */ ++ usb_gadget_unmap_request_by_dev(hwep->ci->dev->parent, ++ &hwreq->req, hwep->dir); ++ ++ if (hwreq->sgt.sgl) ++ sglist_do_debounce(hwreq, false); ++ + if (hwreq->req.complete != NULL) { + spin_unlock(hwep->lock); + usb_gadget_giveback_request(&hwep->ep, &hwreq->req); +-- +2.51.0 + diff --git a/queue-6.18/usb-gadget-f_fs-fix-dma-buf-out-queues.patch b/queue-6.18/usb-gadget-f_fs-fix-dma-buf-out-queues.patch new file mode 100644 index 00000000000..b242aff0c1f --- /dev/null +++ b/queue-6.18/usb-gadget-f_fs-fix-dma-buf-out-queues.patch @@ -0,0 +1,66 @@ +From 173bc96e93b7584cfc5092e9d6a08d0c0c330be8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 08:30:21 +1000 +Subject: usb: gadget: f_fs: fix DMA-BUF OUT queues + +From: Sam Day + +[ Upstream commit 0145e7acd29855dfba4a2f387d455b5d9a520f0e ] + +Currently, DMA_FROM_DEVICE is used when attaching DMABUFs to IN +endpoints and DMA_TO_DEVICE for OUT endpoints. This is inverted from +how it should be. + +The result is IOMMU read-only mappings placed on OUT queues, +triggering arm-smmu write faults. + +Put differently, OUT endpoints flow data from host -> gadget, meaning +the UDC peripheral needs to have write access to the buffer to fill it +with the incoming data. + +This commit flips the directions and updates the implicit-sync helpers +so IN endpoints act as readers and OUT endpoints as writers. + +Signed-off-by: Sam Day +Tested-by: David Heidelberg # OnePlus 6T on sdm845-next-20251119 +Link: https://patch.msgid.link/20260108-ffs-dmabuf-ioctl-fix-v1-2-e51633891a81@samcday.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_fs.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 47cfbe41fdff8..2061c38d772ca 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1489,7 +1489,7 @@ static int ffs_dmabuf_attach(struct file *file, int fd) + goto err_dmabuf_detach; + } + +- dir = epfile->in ? DMA_FROM_DEVICE : DMA_TO_DEVICE; ++ dir = epfile->in ? DMA_TO_DEVICE : DMA_FROM_DEVICE; + + err = ffs_dma_resv_lock(dmabuf, nonblock); + if (err) +@@ -1619,7 +1619,7 @@ static int ffs_dmabuf_transfer(struct file *file, + /* Make sure we don't have writers */ + timeout = nonblock ? 0 : msecs_to_jiffies(DMABUF_ENQUEUE_TIMEOUT_MS); + retl = dma_resv_wait_timeout(dmabuf->resv, +- dma_resv_usage_rw(epfile->in), ++ dma_resv_usage_rw(!epfile->in), + true, timeout); + if (retl == 0) + retl = -EBUSY; +@@ -1664,7 +1664,7 @@ static int ffs_dmabuf_transfer(struct file *file, + dma_fence_init(&fence->base, &ffs_dmabuf_fence_ops, + &priv->lock, priv->context, seqno); + +- resv_dir = epfile->in ? DMA_RESV_USAGE_WRITE : DMA_RESV_USAGE_READ; ++ resv_dir = epfile->in ? DMA_RESV_USAGE_READ : DMA_RESV_USAGE_WRITE; + + dma_resv_add_fence(dmabuf->resv, &fence->base, resv_dir); + dma_resv_unlock(dmabuf->resv); +-- +2.51.0 + diff --git a/queue-6.18/usb-gadget-f_fs-fix-ioctl-error-handling.patch b/queue-6.18/usb-gadget-f_fs-fix-ioctl-error-handling.patch new file mode 100644 index 00000000000..d01fc5f710a --- /dev/null +++ b/queue-6.18/usb-gadget-f_fs-fix-ioctl-error-handling.patch @@ -0,0 +1,77 @@ +From b5098f8b6defb075558c38093dd7246d858531c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 08:30:20 +1000 +Subject: usb: gadget: f_fs: Fix ioctl error handling + +From: Sam Day + +[ Upstream commit 8e4c1d06183c25022f6b0002a5cab84979ca6337 ] + +When ffs_epfile_ioctl handles FUNCTIONFS_DMABUF_* ioctls, it's currently +falling through when copy_from_user fails. + +However, this fallthrough isn't being checked properly, so the handler +continues executing further than it should. It then tries the secondary +dispatch where it ultimately gives up and returns -ENOTTY. + +The end result is invalid ioctl invocations will yield a -ENOTTY rather +than an -EFAULT. + +It's a common pattern elsewhere in the kernel code to directly return +-EFAULT when copy_from_user fails. So we update ffs_epfile_ioctl to do +the same and fix this issue. + +Signed-off-by: Sam Day +Link: https://patch.msgid.link/20260108-ffs-dmabuf-ioctl-fix-v1-1-e51633891a81@samcday.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_fs.c | 18 ++++++------------ + 1 file changed, 6 insertions(+), 12 deletions(-) + +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 2061c38d772ca..497d20260b040 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1724,10 +1724,8 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code, + { + int fd; + +- if (copy_from_user(&fd, (void __user *)value, sizeof(fd))) { +- ret = -EFAULT; +- break; +- } ++ if (copy_from_user(&fd, (void __user *)value, sizeof(fd))) ++ return -EFAULT; + + return ffs_dmabuf_attach(file, fd); + } +@@ -1735,10 +1733,8 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code, + { + int fd; + +- if (copy_from_user(&fd, (void __user *)value, sizeof(fd))) { +- ret = -EFAULT; +- break; +- } ++ if (copy_from_user(&fd, (void __user *)value, sizeof(fd))) ++ return -EFAULT; + + return ffs_dmabuf_detach(file, fd); + } +@@ -1746,10 +1742,8 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code, + { + struct usb_ffs_dmabuf_transfer_req req; + +- if (copy_from_user(&req, (void __user *)value, sizeof(req))) { +- ret = -EFAULT; +- break; +- } ++ if (copy_from_user(&req, (void __user *)value, sizeof(req))) ++ return -EFAULT; + + return ffs_dmabuf_transfer(file, &req); + } +-- +2.51.0 + diff --git a/queue-6.18/usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch b/queue-6.18/usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch new file mode 100644 index 00000000000..3058c158568 --- /dev/null +++ b/queue-6.18/usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch @@ -0,0 +1,122 @@ +From a8648ccfd58734f8efcbadf794b3abf1aea82981 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 17:48:48 +0000 +Subject: usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs + +From: Benson Leung + +[ Upstream commit 6811e0a08bdce6b2767414caf17fda24c2e4e032 ] + +ucsi_psy_get_voltage_max and ucsi_psy_get_current_max are calculated +using whichever pdo is in the last position of the src_pdos array, presuming +it to be a fixed pdo, so the pdo_fixed_voltage or pdo_max_current +helpers are used on that last pdo. + +However, non-Fixed PDOs such as Battery PDOs, Augmented PDOs (used for AVS and +for PPS) may exist, and are always at the end of the array if they do. +In the event one of these more advanced chargers are attached the helpers for +fixed return mangled values. + +Here's an example case of a Google Pixel Flex Dual Port 67W USB-C Fast Charger +with PPS support: +POWER_SUPPLY_NAME=ucsi-source-psy-cros_ec_ucsi.4.auto2 +POWER_SUPPLY_TYPE=USB +POWER_SUPPLY_CHARGE_TYPE=Standard +POWER_SUPPLY_USB_TYPE=C [PD] PD_PPS PD_DRP +POWER_SUPPLY_ONLINE=1 +POWER_SUPPLY_VOLTAGE_MIN=5000000 +POWER_SUPPLY_VOLTAGE_MAX=13400000 +POWER_SUPPLY_VOLTAGE_NOW=20000000 +POWER_SUPPLY_CURRENT_MAX=5790000 +POWER_SUPPLY_CURRENT_NOW=3250000 + +Voltage Max is reading as 13.4V, but that's an incorrect decode of the PPS +APDO in the last position. Same goes for CURRENT_MAX. 5.79A is incorrect. + +Instead, enumerate through the src_pdos and filter just for Fixed PDOs for +now, and find the one with the highest voltage and current respectively. + +After, from the same charger: +POWER_SUPPLY_NAME=ucsi-source-psy-cros_ec_ucsi.4.auto2 +POWER_SUPPLY_TYPE=USB +POWER_SUPPLY_CHARGE_TYPE=Standard +POWER_SUPPLY_USB_TYPE=C [PD] PD_PPS PD_DRP +POWER_SUPPLY_ONLINE=1 +POWER_SUPPLY_VOLTAGE_MIN=5000000 +POWER_SUPPLY_VOLTAGE_MAX=20000000 +POWER_SUPPLY_VOLTAGE_NOW=20000000 +POWER_SUPPLY_CURRENT_MAX=4000000 +POWER_SUPPLY_CURRENT_NOW=3250000 + +Signed-off-by: Benson Leung +Reviewed-by: Heikki Krogerus +Link: https://patch.msgid.link/20251208174918.289394-3-bleung@chromium.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/ucsi/psy.c | 30 ++++++++++++++++++++---------- + 1 file changed, 20 insertions(+), 10 deletions(-) + +diff --git a/drivers/usb/typec/ucsi/psy.c b/drivers/usb/typec/ucsi/psy.c +index 8ae900c8c1321..525c6fc2217da 100644 +--- a/drivers/usb/typec/ucsi/psy.c ++++ b/drivers/usb/typec/ucsi/psy.c +@@ -88,15 +88,20 @@ static int ucsi_psy_get_voltage_max(struct ucsi_connector *con, + union power_supply_propval *val) + { + u32 pdo; ++ int max_voltage = 0; + + switch (UCSI_CONSTAT(con, PWR_OPMODE)) { + case UCSI_CONSTAT_PWR_OPMODE_PD: +- if (con->num_pdos > 0) { +- pdo = con->src_pdos[con->num_pdos - 1]; +- val->intval = pdo_fixed_voltage(pdo) * 1000; +- } else { +- val->intval = 0; ++ for (int i = 0; i < con->num_pdos; i++) { ++ int pdo_voltage = 0; ++ ++ pdo = con->src_pdos[i]; ++ if (pdo_type(pdo) == PDO_TYPE_FIXED) ++ pdo_voltage = pdo_fixed_voltage(pdo) * 1000; ++ max_voltage = (pdo_voltage > max_voltage) ? pdo_voltage ++ : max_voltage; + } ++ val->intval = max_voltage; + break; + case UCSI_CONSTAT_PWR_OPMODE_TYPEC3_0: + case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5: +@@ -144,6 +149,7 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con, + union power_supply_propval *val) + { + u32 pdo; ++ int max_current = 0; + + if (!UCSI_CONSTAT(con, CONNECTED)) { + val->intval = 0; +@@ -152,12 +158,16 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con, + + switch (UCSI_CONSTAT(con, PWR_OPMODE)) { + case UCSI_CONSTAT_PWR_OPMODE_PD: +- if (con->num_pdos > 0) { +- pdo = con->src_pdos[con->num_pdos - 1]; +- val->intval = pdo_max_current(pdo) * 1000; +- } else { +- val->intval = 0; ++ for (int i = 0; i < con->num_pdos; i++) { ++ int pdo_current = 0; ++ ++ pdo = con->src_pdos[i]; ++ if (pdo_type(pdo) == PDO_TYPE_FIXED) ++ pdo_current = pdo_max_current(pdo) * 1000; ++ max_current = (pdo_current > max_current) ? pdo_current ++ : max_current; + } ++ val->intval = max_current; + break; + case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5: + val->intval = UCSI_TYPEC_1_5_CURRENT * 1000; +-- +2.51.0 + diff --git a/queue-6.18/vhost-fix-caching-attributes-of-mmio-regions-by-sett.patch b/queue-6.18/vhost-fix-caching-attributes-of-mmio-regions-by-sett.patch new file mode 100644 index 00000000000..77c2d0a5a4b --- /dev/null +++ b/queue-6.18/vhost-fix-caching-attributes-of-mmio-regions-by-sett.patch @@ -0,0 +1,42 @@ +From 23142a88185ce3efc98fb57fd3706633368495ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jan 2026 12:27:03 +0530 +Subject: vhost: fix caching attributes of MMIO regions by setting them + explicitly + +From: Kommula Shiva Shankar + +[ Upstream commit 5145b277309f3818e2db507f525d19ac3b910922 ] + +Explicitly set non-cached caching attributes for MMIO regions. +Default write-back mode can cause CPU to cache device memory, +causing invalid reads and unpredictable behavior. + +Invalid read and write issues were observed on ARM64 when mapping the +notification area to userspace via mmap. + +Signed-off-by: Kommula Shiva Shankar +Acked-by: Jason Wang +Reviewed-by: Jason Gunthorpe +Signed-off-by: Michael S. Tsirkin +Message-Id: <20260102065703.656255-1-kshankar@marvell.com> +Signed-off-by: Sasha Levin +--- + drivers/vhost/vdpa.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c +index 05a481e4c385a..b0179e8567aba 100644 +--- a/drivers/vhost/vdpa.c ++++ b/drivers/vhost/vdpa.c +@@ -1527,6 +1527,7 @@ static int vhost_vdpa_mmap(struct file *file, struct vm_area_struct *vma) + if (vma->vm_end - vma->vm_start != notify.size) + return -ENOTSUPP; + ++ vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); + vm_flags_set(vma, VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP); + vma->vm_ops = &vhost_vdpa_vm_ops; + return 0; +-- +2.51.0 + diff --git a/queue-6.18/virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch b/queue-6.18/virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch new file mode 100644 index 00000000000..ce5ddae44d5 --- /dev/null +++ b/queue-6.18/virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch @@ -0,0 +1,75 @@ +From 49a22ed5fbede28c572f2ec493b2cca199c76c83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 08:35:45 +0100 +Subject: virt: vbox: uapi: Mark inner unions in packed structs as packed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit c25d01e1c4f2d43f47af87c00e223f5ca7c71792 ] + +The unpacked unions within a packed struct generates alignment warnings +on clang for 32-bit ARM: + +./usr/include/linux/vbox_vmmdev_types.h:239:4: error: field u within 'struct vmmdev_hgcm_function_parameter32' + is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:223:2)' + and is usually due to 'struct vmmdev_hgcm_function_parameter32' being packed, + which can lead to unaligned accesses [-Werror,-Wunaligned-access] + 239 | } u; + | ^ + +./usr/include/linux/vbox_vmmdev_types.h:254:6: error: field u within + 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)' + is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:251:4)' and is usually due to + 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)' + being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] + +With the recent changes to compile-test the UAPI headers in more cases, +these warning in combination with CONFIG_WERROR breaks the build. + +Fix the warnings. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/ +Reported-by: Nathan Chancellor +Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/ +Suggested-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/ +Signed-off-by: Thomas Weißschuh +Tested-by: Nicolas Schier +Reviewed-by: Nicolas Schier +Acked-by: Greg Kroah-Hartman +Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-2-076aed1623ff@linutronix.de +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + include/uapi/linux/vbox_vmmdev_types.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/uapi/linux/vbox_vmmdev_types.h b/include/uapi/linux/vbox_vmmdev_types.h +index 6073858d52a2e..11f3627c3729b 100644 +--- a/include/uapi/linux/vbox_vmmdev_types.h ++++ b/include/uapi/linux/vbox_vmmdev_types.h +@@ -236,7 +236,7 @@ struct vmmdev_hgcm_function_parameter32 { + /** Relative to the request header. */ + __u32 offset; + } page_list; +- } u; ++ } __packed u; + } __packed; + VMMDEV_ASSERT_SIZE(vmmdev_hgcm_function_parameter32, 4 + 8); + +@@ -251,7 +251,7 @@ struct vmmdev_hgcm_function_parameter64 { + union { + __u64 phys_addr; + __u64 linear_addr; +- } u; ++ } __packed u; + } __packed pointer; + struct { + /** Size of the buffer described by the page list. */ +-- +2.51.0 + diff --git a/queue-6.18/vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch b/queue-6.18/vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch new file mode 100644 index 00000000000..14a6806614e --- /dev/null +++ b/queue-6.18/vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch @@ -0,0 +1,62 @@ +From 7d4903d2ad35c9074ac1212a8fa19795394784c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 17:34:00 +0100 +Subject: vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 + +From: Arnd Bergmann + +[ Upstream commit e25dbf561e03c0c5e36228e3b8b784392819ce85 ] + +The gcc-16.0.1 snapshot produces a false-positive warning that turns +into a build failure with CONFIG_WERROR: + +In file included from arch/x86/include/asm/string.h:6, + from net/vmw_vsock/vmci_transport.c:10: +In function 'vmci_transport_packet_init', + inlined from '__vmci_transport_send_control_pkt.constprop' at net/vmw_vsock/vmci_transport.c:198:2: +arch/x86/include/asm/string_32.h:150:25: error: argument 2 null where non-null expected because argument 3 is nonzero [-Werror=nonnull] + 150 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n) + | ^~~~~~~~~~~~~~~~~~~~~~~~~ +net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy' + 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait)); + | ^~~~~~ +arch/x86/include/asm/string_32.h:150:25: note: in a call to built-in function '__builtin_memcpy' +net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy' + 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait)); + | ^~~~~~ + +This seems relatively harmless, and it so far the only instance of this +warning I have found. The __vmci_transport_send_control_pkt function +is called either with wait=NULL or with one of the type values that +pass 'wait' into memcpy() here, but not from the same caller. + +Replacing the memcpy with a struct assignment is otherwise the same +but avoids the warning. + +Signed-off-by: Arnd Bergmann +Reviewed-by: Bobby Eshleman +Reviewed-by: Stefano Garzarella +Reviewed-by: Bryan Tan +Link: https://patch.msgid.link/20260203163406.2636463-1-arnd@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/vmw_vsock/vmci_transport.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c +index 7eccd6708d664..aca3132689cf1 100644 +--- a/net/vmw_vsock/vmci_transport.c ++++ b/net/vmw_vsock/vmci_transport.c +@@ -161,7 +161,7 @@ vmci_transport_packet_init(struct vmci_transport_packet *pkt, + + case VMCI_TRANSPORT_PACKET_TYPE_WAITING_READ: + case VMCI_TRANSPORT_PACKET_TYPE_WAITING_WRITE: +- memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait)); ++ pkt->u.wait = *wait; + break; + + case VMCI_TRANSPORT_PACKET_TYPE_REQUEST2: +-- +2.51.0 + diff --git a/queue-6.18/watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch b/queue-6.18/watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch new file mode 100644 index 00000000000..74a8adca11a --- /dev/null +++ b/queue-6.18/watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch @@ -0,0 +1,40 @@ +From 016e34669b8cbd2133bfa578b087c587204587fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Nov 2025 22:24:33 +0200 +Subject: watchdog: imx7ulp_wdt: handle the nowayout option + +From: Oleksandr Suvorov + +[ Upstream commit d303d37ef5cf86c8c3b2daefd2a7d7fd8ca1ec14 ] + +The module parameter `nowayout` indicates whether the watchdog should ever +be allowed to stop, but the driver currently ignores this option. + +Pass the `nowayout` parameter to the watchdog core by setting the +WDOG_NO_WAY_OUT flag accordingly. + +Signed-off-by: Oleksandr Suvorov +Reviewed-by: Guenter Roeck +Reviewed-by: Frank Li +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/imx7ulp_wdt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/watchdog/imx7ulp_wdt.c b/drivers/watchdog/imx7ulp_wdt.c +index 0f13a30533574..03479110453ce 100644 +--- a/drivers/watchdog/imx7ulp_wdt.c ++++ b/drivers/watchdog/imx7ulp_wdt.c +@@ -346,6 +346,7 @@ static int imx7ulp_wdt_probe(struct platform_device *pdev) + watchdog_stop_on_reboot(wdog); + watchdog_stop_on_unregister(wdog); + watchdog_set_drvdata(wdog, imx7ulp_wdt); ++ watchdog_set_nowayout(wdog, nowayout); + + imx7ulp_wdt->hw = of_device_get_match_data(dev); + ret = imx7ulp_wdt_init(imx7ulp_wdt, wdog->timeout * imx7ulp_wdt->hw->wdog_clock_rate); +-- +2.51.0 + diff --git a/queue-6.18/watchdog-rzv2h_wdt-discard-pm_runtime_put-return-val.patch b/queue-6.18/watchdog-rzv2h_wdt-discard-pm_runtime_put-return-val.patch new file mode 100644 index 00000000000..4365c26181c --- /dev/null +++ b/queue-6.18/watchdog-rzv2h_wdt-discard-pm_runtime_put-return-val.patch @@ -0,0 +1,53 @@ +From 6eae9203c5e9f52897ecb4ed9a54297808296026 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Dec 2025 21:09:22 +0100 +Subject: watchdog: rzv2h_wdt: Discard pm_runtime_put() return value + +From: Rafael J. Wysocki + +[ Upstream commit 2dea984a74265a67e3210f818416a83b87f70200 ] + +Failing device probe due to pm_runtime_put() returning an error is not +particularly useful. + +Returning an error code from pm_runtime_put() merely means that it has +not queued up a work item to check whether or not the device can be +suspended and there are many perfectly valid situations in which that +can happen, like after writing "on" to the devices' runtime PM "control" +attribute in sysfs for one example. It also happens when the kernel is +configured with CONFIG_PM unset. + +Accordingly, update rzt2h_wdt_wdtdcr_init() to simply discard the return +value of pm_runtime_put() and return success to the caller after +invoking that function. + +This will facilitate a planned change of the pm_runtime_put() return +type to void in the future. + +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/rzv2h_wdt.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/watchdog/rzv2h_wdt.c b/drivers/watchdog/rzv2h_wdt.c +index a694786837e11..f9bb4ef3d327b 100644 +--- a/drivers/watchdog/rzv2h_wdt.c ++++ b/drivers/watchdog/rzv2h_wdt.c +@@ -270,9 +270,7 @@ static int rzt2h_wdt_wdtdcr_init(struct platform_device *pdev, + + rzt2h_wdt_wdtdcr_count_stop(priv); + +- ret = pm_runtime_put(&pdev->dev); +- if (ret < 0) +- return ret; ++ pm_runtime_put(&pdev->dev); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.18/wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch b/queue-6.18/wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch new file mode 100644 index 00000000000..9a09d59ed0d --- /dev/null +++ b/queue-6.18/wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch @@ -0,0 +1,59 @@ +From 210d78cfa5be22f410deddabfab81866df8b609a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 17:56:11 +0000 +Subject: wifi: ath10k: fix lock protection in + ath10k_wmi_event_peer_sta_ps_state_chg() + +From: Ziyi Guo + +[ Upstream commit 820ba7dd6859ef8b1eaf6014897e7aa4756fc65d ] + +ath10k_wmi_event_peer_sta_ps_state_chg() uses lockdep_assert_held() to +assert that ar->data_lock should be held by the caller, but neither +ath10k_wmi_10_2_op_rx() nor ath10k_wmi_10_4_op_rx() acquire this lock +before calling this function. + +The field arsta->peer_ps_state is documented as protected by +ar->data_lock in core.h, and other accessors (ath10k_peer_ps_state_disable, +ath10k_dbg_sta_read_peer_ps_state) properly acquire this lock. + +Add spin_lock_bh()/spin_unlock_bh() around the peer_ps_state update, +and remove the lockdep_assert_held() to be aligned with new locking, +following the pattern used by other WMI event handlers in the driver. + +Signed-off-by: Ziyi Guo +Reviewed-by: Baochen Qiang +Link: https://patch.msgid.link/20260123175611.767731-1-n7l8m4@u.northwestern.edu +[removed excess blank line] +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/wmi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c +index b4aad6604d6d9..ce22141e5efd9 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -5289,8 +5289,6 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb) + struct ath10k_sta *arsta; + u8 peer_addr[ETH_ALEN]; + +- lockdep_assert_held(&ar->data_lock); +- + ev = (struct wmi_peer_sta_ps_state_chg_event *)skb->data; + ether_addr_copy(peer_addr, ev->peer_macaddr.addr); + +@@ -5305,7 +5303,9 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb) + } + + arsta = (struct ath10k_sta *)sta->drv_priv; ++ spin_lock_bh(&ar->data_lock); + arsta->peer_ps_state = __le32_to_cpu(ev->peer_ps_state); ++ spin_unlock_bh(&ar->data_lock); + + exit: + rcu_read_unlock(); +-- +2.51.0 + diff --git a/queue-6.18/wifi-ath11k-add-pm-quirk-for-thinkpad-z13-z16-gen1.patch b/queue-6.18/wifi-ath11k-add-pm-quirk-for-thinkpad-z13-z16-gen1.patch new file mode 100644 index 00000000000..9cb910fa0e1 --- /dev/null +++ b/queue-6.18/wifi-ath11k-add-pm-quirk-for-thinkpad-z13-z16-gen1.patch @@ -0,0 +1,72 @@ +From 2dc006b05b51b9e3b4a6ad5db71179e7a2998793 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Jan 2026 17:00:34 -0800 +Subject: wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 + +From: Ross Vandegrift + +[ Upstream commit 4015b1972763d7d513172276e51439f37e622a92 ] + +Z16 Gen1 has the wakeup-from-suspend issues from [1] but was never added +to the appropriate quirk list. I've tested this patch on top of 6.18.2, +it fixes the issue for me on 21D4 + +Mark Pearson provided the other product IDs covering the second Z16 Gen1 +and both Z13 Gen1 identifiers. They share the same firmware, and folks +in the bugzilla report do indeed see the problem on Z13. + +[1] - https://bugzilla.kernel.org/show_bug.cgi?id=219196 + +Signed-off-by: Ross Vandegrift +Reviewed-by: Baochen Qiang +Tested-by: Mark Pearson +Reviewed-by: Mark Pearson +Link: https://patch.msgid.link/wj7o2kmb7g54stdjvxp2hjqrnutnq3jbf4s2uh4ctvmlxdq7tf@nbkj2ebakhrd +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/core.c | 28 ++++++++++++++++++++++++++ + 1 file changed, 28 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c +index 06b4df2370e95..78a1b0edd8b45 100644 +--- a/drivers/net/wireless/ath/ath11k/core.c ++++ b/drivers/net/wireless/ath/ath11k/core.c +@@ -994,6 +994,34 @@ static const struct dmi_system_id ath11k_pm_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "21F9"), + }, + }, ++ { ++ .driver_data = (void *)ATH11K_PM_WOW, ++ .matches = { /* Z13 G1 */ ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21D2"), ++ }, ++ }, ++ { ++ .driver_data = (void *)ATH11K_PM_WOW, ++ .matches = { /* Z13 G1 */ ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21D3"), ++ }, ++ }, ++ { ++ .driver_data = (void *)ATH11K_PM_WOW, ++ .matches = { /* Z16 G1 */ ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21D4"), ++ }, ++ }, ++ { ++ .driver_data = (void *)ATH11K_PM_WOW, ++ .matches = { /* Z16 G1 */ ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21D5"), ++ }, ++ }, + {} + }; + +-- +2.51.0 + diff --git a/queue-6.18/wifi-ath11k-fix-failure-to-connect-to-a-6-ghz-ap.patch b/queue-6.18/wifi-ath11k-fix-failure-to-connect-to-a-6-ghz-ap.patch new file mode 100644 index 00000000000..139f5ac9812 --- /dev/null +++ b/queue-6.18/wifi-ath11k-fix-failure-to-connect-to-a-6-ghz-ap.patch @@ -0,0 +1,61 @@ +From fe21f332e5e55c161d195d6caf5e1c39cb5f9759 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 11:46:07 +0800 +Subject: wifi: ath11k: Fix failure to connect to a 6 GHz AP + +From: Qian Zhang + +[ Upstream commit 0bc8c48de6f06c0cac52dde024ffda4433de6234 ] + +STA fails to connect to a 6 GHz AP with the following errors: + ath11k_pci 0000:01:00.0: failed to handle chan list with power type 1 + wlp1s0: deauthenticating from c8:a3:e8:dd:41:e3 by local choice (Reason: 3=DEAUTH_LEAVING) + +ath11k_reg_handle_chan_list() treats the update as redundant and +returns -EINVAL. That causes the connection attempt to fail. + +Avoid unnecessary validation during association. Apply the regulatory +redundant check only when the power type is IEEE80211_REG_UNSET_AP, +which only occurs during core initialization. + +Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41 + +Signed-off-by: Qian Zhang +Reviewed-by: Baochen Qiang +Link: https://patch.msgid.link/20260108034607.812885-1-qian.zhang@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/reg.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/reg.c b/drivers/net/wireless/ath/ath11k/reg.c +index d62a2014315a0..49b79648752cf 100644 +--- a/drivers/net/wireless/ath/ath11k/reg.c ++++ b/drivers/net/wireless/ath/ath11k/reg.c +@@ -1,7 +1,7 @@ + // SPDX-License-Identifier: BSD-3-Clause-Clear + /* + * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved. +- * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved. ++ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + */ + #include + +@@ -926,8 +926,11 @@ int ath11k_reg_handle_chan_list(struct ath11k_base *ab, + */ + if (ab->default_regd[pdev_idx] && !ab->new_regd[pdev_idx] && + !memcmp((char *)ab->default_regd[pdev_idx]->alpha2, +- (char *)reg_info->alpha2, 2)) +- goto retfail; ++ (char *)reg_info->alpha2, 2) && ++ power_type == IEEE80211_REG_UNSET_AP) { ++ ath11k_reg_reset_info(reg_info); ++ return 0; ++ } + + /* Intersect new rules with default regd if a new country setting was + * requested, i.e a default regd was already set during initialization +-- +2.51.0 + diff --git a/queue-6.18/wifi-ath12k-fix-mac-phy-capability-parsing.patch b/queue-6.18/wifi-ath12k-fix-mac-phy-capability-parsing.patch new file mode 100644 index 00000000000..d0d92c2eea9 --- /dev/null +++ b/queue-6.18/wifi-ath12k-fix-mac-phy-capability-parsing.patch @@ -0,0 +1,106 @@ +From 618439d9cb7ae8c8c67c75010a5bfbcd1ef30400 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 15:36:26 +0800 +Subject: wifi: ath12k: fix mac phy capability parsing + +From: Baochen Qiang + +[ Upstream commit b5151c9b6e3a347416a4b4b55fc00195526d8771 ] + +Currently ath12k_pull_mac_phy_cap_svc_ready_ext() assumes only one band +supported in each phy, hence it skips 5 GHz band if 2 GHz band support +is detected. This does not work for device which gets only one phy but +has both bands supported, such as QCC2072. + +Change to check each band individually to fix this issue. + +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 + +Signed-off-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-6-fc8ce1e43969@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/wmi.c | 22 ++++++++++++++-------- + 1 file changed, 14 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c +index 6dd95bcaf2436..f3474a13e32aa 100644 +--- a/drivers/net/wireless/ath/ath12k/wmi.c ++++ b/drivers/net/wireless/ath/ath12k/wmi.c +@@ -493,6 +493,7 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle, + struct ath12k_band_cap *cap_band; + struct ath12k_pdev_cap *pdev_cap = &pdev->cap; + struct ath12k_fw_pdev *fw_pdev; ++ u32 supported_bands; + u32 phy_map; + u32 hw_idx, phy_idx = 0; + int i; +@@ -516,14 +517,19 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle, + return -EINVAL; + + mac_caps = wmi_mac_phy_caps + phy_idx; ++ supported_bands = le32_to_cpu(mac_caps->supported_bands); ++ ++ if (!(supported_bands & WMI_HOST_WLAN_2GHZ_CAP) && ++ !(supported_bands & WMI_HOST_WLAN_5GHZ_CAP)) ++ return -EINVAL; + + pdev->pdev_id = ath12k_wmi_mac_phy_get_pdev_id(mac_caps); + pdev->hw_link_id = ath12k_wmi_mac_phy_get_hw_link_id(mac_caps); +- pdev_cap->supported_bands |= le32_to_cpu(mac_caps->supported_bands); ++ pdev_cap->supported_bands |= supported_bands; + pdev_cap->ampdu_density = le32_to_cpu(mac_caps->ampdu_density); + + fw_pdev = &ab->fw_pdev[ab->fw_pdev_count]; +- fw_pdev->supported_bands = le32_to_cpu(mac_caps->supported_bands); ++ fw_pdev->supported_bands = supported_bands; + fw_pdev->pdev_id = ath12k_wmi_mac_phy_get_pdev_id(mac_caps); + fw_pdev->phy_id = le32_to_cpu(mac_caps->phy_id); + ab->fw_pdev_count++; +@@ -532,10 +538,12 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle, + * band to band for a single radio, need to see how this should be + * handled. + */ +- if (le32_to_cpu(mac_caps->supported_bands) & WMI_HOST_WLAN_2GHZ_CAP) { ++ if (supported_bands & WMI_HOST_WLAN_2GHZ_CAP) { + pdev_cap->tx_chain_mask = le32_to_cpu(mac_caps->tx_chain_mask_2g); + pdev_cap->rx_chain_mask = le32_to_cpu(mac_caps->rx_chain_mask_2g); +- } else if (le32_to_cpu(mac_caps->supported_bands) & WMI_HOST_WLAN_5GHZ_CAP) { ++ } ++ ++ if (supported_bands & WMI_HOST_WLAN_5GHZ_CAP) { + pdev_cap->vht_cap = le32_to_cpu(mac_caps->vht_cap_info_5g); + pdev_cap->vht_mcs = le32_to_cpu(mac_caps->vht_supp_mcs_5g); + pdev_cap->he_mcs = le32_to_cpu(mac_caps->he_supp_mcs_5g); +@@ -545,8 +553,6 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle, + WMI_NSS_RATIO_EN_DIS_GET(mac_caps->nss_ratio); + pdev_cap->nss_ratio_info = + WMI_NSS_RATIO_INFO_GET(mac_caps->nss_ratio); +- } else { +- return -EINVAL; + } + + /* tx/rx chainmask reported from fw depends on the actual hw chains used, +@@ -562,7 +568,7 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle, + pdev_cap->rx_chain_mask_shift = + find_first_bit((unsigned long *)&pdev_cap->rx_chain_mask, 32); + +- if (le32_to_cpu(mac_caps->supported_bands) & WMI_HOST_WLAN_2GHZ_CAP) { ++ if (supported_bands & WMI_HOST_WLAN_2GHZ_CAP) { + cap_band = &pdev_cap->band[NL80211_BAND_2GHZ]; + cap_band->phy_id = le32_to_cpu(mac_caps->phy_id); + cap_band->max_bw_supported = le32_to_cpu(mac_caps->max_bw_supported_2g); +@@ -582,7 +588,7 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle, + le32_to_cpu(mac_caps->he_ppet2g.ppet16_ppet8_ru3_ru0[i]); + } + +- if (le32_to_cpu(mac_caps->supported_bands) & WMI_HOST_WLAN_5GHZ_CAP) { ++ if (supported_bands & WMI_HOST_WLAN_5GHZ_CAP) { + cap_band = &pdev_cap->band[NL80211_BAND_5GHZ]; + cap_band->phy_id = le32_to_cpu(mac_caps->phy_id); + cap_band->max_bw_supported = +-- +2.51.0 + diff --git a/queue-6.18/wifi-ath12k-fix-preferred-hardware-mode-calculation.patch b/queue-6.18/wifi-ath12k-fix-preferred-hardware-mode-calculation.patch new file mode 100644 index 00000000000..9bca4b319a2 --- /dev/null +++ b/queue-6.18/wifi-ath12k-fix-preferred-hardware-mode-calculation.patch @@ -0,0 +1,50 @@ +From 835019963c09542903d9a941525e182eff4720a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 15:36:24 +0800 +Subject: wifi: ath12k: fix preferred hardware mode calculation + +From: Baochen Qiang + +[ Upstream commit 7f852de0003219c431a6f2ffd951fd82a4673660 ] + +For single pdev device like WCN7850/QCC2072, preferred_hw_mode is +initialized to WMI_HOST_HW_MODE_SINGLE. Later when firmware sends +supported modes to host, each mode is compared with the initial one +and if the priority of the new mode is higher, update the parameter +and store mode capability. + +For WCN7850, this does not result in issue, as one of the supported +mode indeed has a higher priority. However the only available mode of +QCC2072 at this stage is WMI_HOST_HW_MODE_SINGLE, which fails the +comparison, hence mode capability is not stored. Subsequently driver +initialization fails. + +Fix it by accepting a mode with the same priority. + +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 + +Signed-off-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-4-fc8ce1e43969@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/wmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c +index 44e99b47e445d..6dd95bcaf2436 100644 +--- a/drivers/net/wireless/ath/ath12k/wmi.c ++++ b/drivers/net/wireless/ath/ath12k/wmi.c +@@ -4490,7 +4490,7 @@ static int ath12k_wmi_hw_mode_caps(struct ath12k_base *soc, + + pref = soc->wmi_ab.preferred_hw_mode; + +- if (ath12k_hw_mode_pri_map[mode] < ath12k_hw_mode_pri_map[pref]) { ++ if (ath12k_hw_mode_pri_map[mode] <= ath12k_hw_mode_pri_map[pref]) { + svc_rdy_ext->pref_hw_mode_caps = *hw_mode_caps; + soc->wmi_ab.preferred_hw_mode = mode; + } +-- +2.51.0 + diff --git a/queue-6.18/wifi-cfg80211-allow-only-one-nan-interface-also-in-m.patch b/queue-6.18/wifi-cfg80211-allow-only-one-nan-interface-also-in-m.patch new file mode 100644 index 00000000000..f784e7f6752 --- /dev/null +++ b/queue-6.18/wifi-cfg80211-allow-only-one-nan-interface-also-in-m.patch @@ -0,0 +1,48 @@ +From f92b669c4d60cf2fe8e2620e29bb0e610c740466 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 13:51:57 +0200 +Subject: wifi: cfg80211: allow only one NAN interface, also in multi radio + +From: Miri Korenblit + +[ Upstream commit e69fda4d07701373354e52b0321bd40311d743d0 ] + +According to Wi-Fi Aware (TM) 4.0 specification 2.8, A NAN device can +have one NAN management interface. This applies also to multi radio +devices. +The current code allows a driver to support more than one NAN interface, +if those are not in the same radio. + +Fix it. + +Reviewed-by: Johannes Berg +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20260107135129.fdaecec0fe8a.I246b5ba6e9da3ec1481ff197e47f6ce0793d7118@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/core.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/net/wireless/core.c b/net/wireless/core.c +index 87f083d9247a4..2ce6e39926d05 100644 +--- a/net/wireless/core.c ++++ b/net/wireless/core.c +@@ -658,12 +658,8 @@ int wiphy_verify_iface_combinations(struct wiphy *wiphy, + c->limits[j].max > 1)) + return -EINVAL; + +- /* Only a single NAN can be allowed, avoid this +- * check for multi-radio global combination, since it +- * hold the capabilities of all radio combinations. +- */ +- if (!combined_radio && +- WARN_ON(types & BIT(NL80211_IFTYPE_NAN) && ++ /* Only a single NAN can be allowed */ ++ if (WARN_ON(types & BIT(NL80211_IFTYPE_NAN) && + c->limits[j].max > 1)) + return -EINVAL; + +-- +2.51.0 + diff --git a/queue-6.18/wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch b/queue-6.18/wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch new file mode 100644 index 00000000000..9f14edc04e2 --- /dev/null +++ b/queue-6.18/wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch @@ -0,0 +1,48 @@ +From a827544c0734e8bf875f6435c6d808ce9a415f1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 19:30:05 +0000 +Subject: wifi: iwlegacy: add missing mutex protection in + il3945_store_measurement() + +From: Ziyi Guo + +[ Upstream commit 4dd1dda65265ecbc9f43ffc08e333684cf715152 ] + +il3945_store_measurement() calls il3945_get_measurement() which internally +calls il_send_cmd_sync() without holding il->mutex. However, +il_send_cmd_sync() has lockdep_assert_held(&il->mutex) indicating that +callers must hold this lock. + +Other sysfs store functions in the same file properly acquire the mutex: +- il3945_store_flags() acquires mutex at 3945-mac.c:3110 +- il3945_store_filter_flags() acquires mutex at 3945-mac.c:3144 + +Add mutex_lock()/mutex_unlock() around the il3945_get_measurement() call +in the sysfs store function to fix the missing lock protection. + +Signed-off-by: Ziyi Guo +Acked-by: Stanislaw Gruszka +Link: https://patch.msgid.link/20260125193005.1090429-1-n7l8m4@u.northwestern.edu +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlegacy/3945-mac.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c +index 104748fcdc33e..54991f31c52c5 100644 +--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c ++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c +@@ -3224,7 +3224,9 @@ il3945_store_measurement(struct device *d, struct device_attribute *attr, + + D_INFO("Invoking measurement of type %d on " "channel %d (for '%s')\n", + type, params.channel, buf); ++ mutex_lock(&il->mutex); + il3945_get_measurement(il, ¶ms, type); ++ mutex_unlock(&il->mutex); + + return count; + } +-- +2.51.0 + diff --git a/queue-6.18/wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch b/queue-6.18/wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch new file mode 100644 index 00000000000..d8fd4b5e402 --- /dev/null +++ b/queue-6.18/wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch @@ -0,0 +1,49 @@ +From 73f56d8f18142ec5477cccc62c80007003c3e6d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 19:40:39 +0000 +Subject: wifi: iwlegacy: add missing mutex protection in + il4965_store_tx_power() + +From: Ziyi Guo + +[ Upstream commit e31fa691d0b1c07b6094a6cf0cce894192c462b3 ] + +il4965_store_tx_power() calls il_set_tx_power() without holding il->mutex. +However, il_set_tx_power() has lockdep_assert_held(&il->mutex) indicating +that callers must hold this lock. + +All other callers of il_set_tx_power() properly acquire the mutex: +- il_bg_scan_completed() acquires mutex at common.c:1683 +- il_mac_config() acquires mutex at common.c:5006 +- il3945_commit_rxon() and il4965_commit_rxon() are called via work + queues that hold the mutex (like il4965_bg_alive_start) + +Add mutex_lock()/mutex_unlock() around the il_set_tx_power() call in +the sysfs store function to fix the missing lock protection. + +Signed-off-by: Ziyi Guo +Acked-by: Stanislaw Gruszka +Link: https://patch.msgid.link/20260125194039.1196488-1-n7l8m4@u.northwestern.edu +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c +index 3588dec75ebdd..57fa866efd9f8 100644 +--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c ++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c +@@ -4606,7 +4606,9 @@ il4965_store_tx_power(struct device *d, struct device_attribute *attr, + if (ret) + IL_INFO("%s is not in decimal form.\n", buf); + else { ++ mutex_lock(&il->mutex); + ret = il_set_tx_power(il, val, false); ++ mutex_unlock(&il->mutex); + if (ret) + IL_ERR("failed setting tx power (0x%08x).\n", ret); + else +-- +2.51.0 + diff --git a/queue-6.18/wifi-iwlwifi-fix-22000-series-smem-parsing.patch b/queue-6.18/wifi-iwlwifi-fix-22000-series-smem-parsing.patch new file mode 100644 index 00000000000..e45277c1001 --- /dev/null +++ b/queue-6.18/wifi-iwlwifi-fix-22000-series-smem-parsing.patch @@ -0,0 +1,58 @@ +From a63a4ba0c8c7924d21aeb243487d1e5b13d062ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 15:02:19 +0200 +Subject: wifi: iwlwifi: fix 22000 series SMEM parsing + +From: Johannes Berg + +[ Upstream commit 58192b9ce09b0f0f86e2036683bd542130b91a98 ] + +If the firmware were to report three LMACs (which doesn't +exist in hardware) then using "fwrt->smem_cfg.lmac[2]" is +an overrun of the array. Reject such and use IWL_FW_CHECK +instead of WARN_ON in this function. + +Signed-off-by: Johannes Berg +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20251110150012.16e8c2d70c26.Iadfcc1aedf43c5175b3f0757bea5aa232454f1ac@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/fw/smem.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/smem.c b/drivers/net/wireless/intel/iwlwifi/fw/smem.c +index 90fd69b4860c1..344ddde85b189 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/smem.c ++++ b/drivers/net/wireless/intel/iwlwifi/fw/smem.c +@@ -6,6 +6,7 @@ + */ + #include "iwl-drv.h" + #include "runtime.h" ++#include "dbg.h" + #include "fw/api/commands.h" + + static void iwl_parse_shared_mem_22000(struct iwl_fw_runtime *fwrt, +@@ -17,7 +18,9 @@ static void iwl_parse_shared_mem_22000(struct iwl_fw_runtime *fwrt, + u8 api_ver = iwl_fw_lookup_notif_ver(fwrt->fw, SYSTEM_GROUP, + SHARED_MEM_CFG_CMD, 0); + +- if (WARN_ON(lmac_num > ARRAY_SIZE(mem_cfg->lmac_smem))) ++ /* Note: notification has 3 entries, but we only expect 2 */ ++ if (IWL_FW_CHECK(fwrt, lmac_num > ARRAY_SIZE(fwrt->smem_cfg.lmac), ++ "FW advertises %d LMACs\n", lmac_num)) + return; + + fwrt->smem_cfg.num_lmacs = lmac_num; +@@ -26,7 +29,8 @@ static void iwl_parse_shared_mem_22000(struct iwl_fw_runtime *fwrt, + fwrt->smem_cfg.rxfifo2_size = le32_to_cpu(mem_cfg->rxfifo2_size); + + if (api_ver >= 4 && +- !WARN_ON_ONCE(iwl_rx_packet_payload_len(pkt) < sizeof(*mem_cfg))) { ++ !IWL_FW_CHECK(fwrt, iwl_rx_packet_payload_len(pkt) < sizeof(*mem_cfg), ++ "bad shared mem notification size\n")) { + fwrt->smem_cfg.rxfifo2_control_size = + le32_to_cpu(mem_cfg->rxfifo2_control_size); + } +-- +2.51.0 + diff --git a/queue-6.18/wifi-iwlwifi-mld-fix-chandef-start-calculation.patch b/queue-6.18/wifi-iwlwifi-mld-fix-chandef-start-calculation.patch new file mode 100644 index 00000000000..8e9868ab2c5 --- /dev/null +++ b/queue-6.18/wifi-iwlwifi-mld-fix-chandef-start-calculation.patch @@ -0,0 +1,49 @@ +From e4e6b0e216f0eea3ed915c339ec47f0bb3482c18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Jan 2026 19:39:12 +0200 +Subject: wifi: iwlwifi: mld: fix chandef start calculation + +From: Miri Korenblit + +[ Upstream commit d2fcdf36554316cc51f7928b777944738d06e332 ] + +A link pair in which both links are in 5 GHz can be used for EMLSR only +if they are separated enough. + +To check this condition we calculate the start and the end of the +chandefs of both links in the pair and do some checks. + +But the calculation of the start/end of the chandef is currently done +by subtracting/adding half the bandwidth from/to the control channel's +center frequency, when it should really be subtracted/added from/to the +center frequency of the entire chandef. + +Fix the wrong calculation. + +Reviewed-by: Johannes Berg +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20260111193638.2138fdb99bd5.I4d2e5957b22482a57b1d6ca444e90fcf73bf2cab@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mld/mlo.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mlo.c b/drivers/net/wireless/intel/iwlwifi/mld/mlo.c +index 241a6271d13d6..bf70e71aa5143 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mld/mlo.c ++++ b/drivers/net/wireless/intel/iwlwifi/mld/mlo.c +@@ -851,9 +851,9 @@ iwl_mld_emlsr_pair_state(struct ieee80211_vif *vif, + if (c_low->chan->center_freq > c_high->chan->center_freq) + swap(c_low, c_high); + +- c_low_upper_edge = c_low->chan->center_freq + ++ c_low_upper_edge = c_low->center_freq1 + + cfg80211_chandef_get_width(c_low) / 2; +- c_high_lower_edge = c_high->chan->center_freq - ++ c_high_lower_edge = c_high->center_freq1 - + cfg80211_chandef_get_width(c_high) / 2; + + if (a->chandef->chan->band == NL80211_BAND_5GHZ && +-- +2.51.0 + diff --git a/queue-6.18/wifi-iwlwifi-mld-fix-primary-link-selection-logic.patch b/queue-6.18/wifi-iwlwifi-mld-fix-primary-link-selection-logic.patch new file mode 100644 index 00000000000..d5a14d94866 --- /dev/null +++ b/queue-6.18/wifi-iwlwifi-mld-fix-primary-link-selection-logic.patch @@ -0,0 +1,93 @@ +From dc188d679586314968b5842ab156eaad85b29770 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Jan 2026 19:39:14 +0200 +Subject: wifi: iwlwifi: mld: Fix primary link selection logic + +From: Nidhish A N + +[ Upstream commit 7a749db26cab2334d5b356ac31e6f1147c7682da ] + +When assigning emlsr.primary with emlsr.selected_primary +we are checking if BIT(mld_vif->emlsr.selected_links) are +a part of vif->active_links. This is incorrect as +emlsr.selected_links is a bitmap of possibly two selected links. +Therefore, performing the BIT() operation on it does not +yield any meaningful result and almost always leads to +incorrect primary link selection. + +Additionally, we cannot rely on vif->active_links at this +stage of the link switch flow because it contains both the +removed links and also the newly added links. +For example, if we had selected links in the past (0x11) +and we now select links because of TTLM/debugfs (0x100), +vif->active_links will now be (0x111) and primary link +will be 0, while 0 is not even an active link. Thus, +we create our own bitmap of final active links. + +Signed-off-by: Nidhish A N +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20260111193638.38b2e14e3a20.Ie81a88dfff0c5d2becedabab8398702808f6b1bf@changeid +Signed-off-by: Sasha Levin +--- + .../net/wireless/intel/iwlwifi/mld/mac80211.c | 23 ++++++++++++------- + 1 file changed, 15 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c +index 2a7e7417d7d84..0f2db3ed58530 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c +@@ -980,7 +980,9 @@ int iwl_mld_assign_vif_chanctx(struct ieee80211_hw *hw, + { + struct iwl_mld *mld = IWL_MAC80211_GET_MLD(hw); + struct iwl_mld_link *mld_link = iwl_mld_link_from_mac80211(link); +- unsigned int n_active = iwl_mld_count_active_links(mld, vif); ++ struct iwl_mld_link *temp_mld_link; ++ struct iwl_mld_vif *mld_vif = iwl_mld_vif_from_mac80211(vif); ++ u16 final_active_links = 0; + int ret; + + lockdep_assert_wiphy(mld->wiphy); +@@ -988,10 +990,7 @@ int iwl_mld_assign_vif_chanctx(struct ieee80211_hw *hw, + if (WARN_ON(!mld_link)) + return -EINVAL; + +- /* if the assigned one was not counted yet, count it now */ + if (!rcu_access_pointer(mld_link->chan_ctx)) { +- n_active++; +- + /* Track addition of non-BSS link */ + if (ieee80211_vif_type_p2p(vif) != NL80211_IFTYPE_STATION) { + ret = iwl_mld_emlsr_check_non_bss_block(mld, 1); +@@ -1012,17 +1011,25 @@ int iwl_mld_assign_vif_chanctx(struct ieee80211_hw *hw, + + rcu_assign_pointer(mld_link->chan_ctx, ctx); + +- if (n_active > 1) { +- struct iwl_mld_vif *mld_vif = iwl_mld_vif_from_mac80211(vif); ++ /* We cannot rely on vif->active_links at this stage as it contains ++ * both the removed links and the newly added links. ++ * Therefore, we create our own bitmap of the final active links, ++ * which does not include the removed links. ++ */ ++ for_each_mld_vif_valid_link(mld_vif, temp_mld_link) { ++ if (rcu_access_pointer(temp_mld_link->chan_ctx)) ++ final_active_links |= BIT(link_id); ++ } + ++ if (hweight16(final_active_links) > 1) { + /* Indicate to mac80211 that EML is enabled */ + vif->driver_flags |= IEEE80211_VIF_EML_ACTIVE; + mld_vif->emlsr.last_entry_ts = jiffies; + +- if (vif->active_links & BIT(mld_vif->emlsr.selected_links)) ++ if (final_active_links == mld_vif->emlsr.selected_links) + mld_vif->emlsr.primary = mld_vif->emlsr.selected_primary; + else +- mld_vif->emlsr.primary = __ffs(vif->active_links); ++ mld_vif->emlsr.primary = __ffs(final_active_links); + + iwl_dbg_tlv_time_point(&mld->fwrt, IWL_FW_INI_TIME_ESR_LINK_UP, + NULL); +-- +2.51.0 + diff --git a/queue-6.18/wifi-iwlwifi-mld-handle-rate-selection-for-nan-inter.patch b/queue-6.18/wifi-iwlwifi-mld-handle-rate-selection-for-nan-inter.patch new file mode 100644 index 00000000000..8406dba2cdc --- /dev/null +++ b/queue-6.18/wifi-iwlwifi-mld-handle-rate-selection-for-nan-inter.patch @@ -0,0 +1,40 @@ +From 0ad128a69fff1073f7c257009c72da6af2e067cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 18:08:46 +0200 +Subject: wifi: iwlwifi: mld: Handle rate selection for NAN interface + +From: Ilan Peer + +[ Upstream commit dbbeebece03050cd510073ce89fee83844e06b00 ] + +Frames transmitted over a NAN interface might not have channel +information assigned to them. In such cases assign the lowest +OFDM to the frame. + +Signed-off-by: Ilan Peer +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20251110180612.72046f98f878.Ib784931fffd0747acd9d7bb22eabbbec5282733e@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mld/tx.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mld/tx.c b/drivers/net/wireless/intel/iwlwifi/mld/tx.c +index 3b4b575aadaa5..e3fb4fc4f452e 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mld/tx.c ++++ b/drivers/net/wireless/intel/iwlwifi/mld/tx.c +@@ -345,6 +345,11 @@ u8 iwl_mld_get_lowest_rate(struct iwl_mld *mld, + + iwl_mld_get_basic_rates_and_band(mld, vif, info, &basic_rates, &band); + ++ if (band >= NUM_NL80211_BANDS) { ++ WARN_ON(vif->type != NL80211_IFTYPE_NAN); ++ return IWL_FIRST_OFDM_RATE; ++ } ++ + sband = mld->hw->wiphy->bands[band]; + for_each_set_bit(i, &basic_rates, BITS_PER_LONG) { + u16 hw = sband->bitrates[i].hw_value; +-- +2.51.0 + diff --git a/queue-6.18/wifi-iwlwifi-mvm-check-the-validity-of-noa_len.patch b/queue-6.18/wifi-iwlwifi-mvm-check-the-validity-of-noa_len.patch new file mode 100644 index 00000000000..237be72d570 --- /dev/null +++ b/queue-6.18/wifi-iwlwifi-mvm-check-the-validity-of-noa_len.patch @@ -0,0 +1,48 @@ +From cff641481963b268273164aef6214f66c52e41ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 15:02:15 +0200 +Subject: wifi: iwlwifi: mvm: check the validity of noa_len + +From: Miri Korenblit + +[ Upstream commit 1e3fb3c4a8e6c581d0f4533dba887fabf53d607d ] + +Validate iwl_probe_resp_data_notif::noa_attr::len_low since we are using +its value to determine the noa_len, which is later used for the NoA +attribute. + +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20251110150012.99b663d9b424.I206fd54c990ca9e1160b9b94fa8be44e67bcc1b9@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c +index 867807abde664..49ffc4ecee855 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c +@@ -1761,6 +1761,20 @@ void iwl_mvm_probe_resp_data_notif(struct iwl_mvm *mvm, + + mvmvif = iwl_mvm_vif_from_mac80211(vif); + ++ /* ++ * len_low should be 2 + n*13 (where n is the number of descriptors. ++ * 13 is the size of a NoA descriptor). We can have either one or two ++ * descriptors. ++ */ ++ if (IWL_FW_CHECK(mvm, notif->noa_active && ++ notif->noa_attr.len_low != 2 + ++ sizeof(struct ieee80211_p2p_noa_desc) && ++ notif->noa_attr.len_low != 2 + ++ sizeof(struct ieee80211_p2p_noa_desc) * 2, ++ "Invalid noa_attr.len_low (%d)\n", ++ notif->noa_attr.len_low)) ++ return; ++ + new_data = kzalloc(sizeof(*new_data), GFP_KERNEL); + if (!new_data) + return; +-- +2.51.0 + diff --git a/queue-6.18/wifi-libertas-fix-warning-in-usb_tx_block.patch b/queue-6.18/wifi-libertas-fix-warning-in-usb_tx_block.patch new file mode 100644 index 00000000000..d558f9a2e59 --- /dev/null +++ b/queue-6.18/wifi-libertas-fix-warning-in-usb_tx_block.patch @@ -0,0 +1,44 @@ +From 0c635579596821ea00135e20c1c6659998652552 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Dec 2025 16:58:06 +0100 +Subject: wifi: libertas: fix WARNING in usb_tx_block + +From: Szymon Wilczek + +[ Upstream commit d66676e6ca96bf8680f869a9bd6573b26c634622 ] + +The function usb_tx_block() submits cardp->tx_urb without ensuring that +any previous transmission on this URB has completed. If a second call +occurs while the URB is still active (e.g. during rapid firmware loading), +usb_submit_urb() detects the active state and triggers a warning: +'URB submitted while active'. + +Fix this by enforcing serialization: call usb_kill_urb() before +submitting the new request. This ensures the URB is idle and safe to reuse. + +Reported-by: syzbot+67969ab6a2551c27f71b@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=67969ab6a2551c27f71b +Signed-off-by: Szymon Wilczek +Link: https://patch.msgid.link/20251221155806.23925-1-swilczek.lx@gmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/libertas/if_usb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c +index b3c4040257a67..924ab93b7b671 100644 +--- a/drivers/net/wireless/marvell/libertas/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas/if_usb.c +@@ -426,6 +426,8 @@ static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload, uint16_t nb + goto tx_ret; + } + ++ usb_kill_urb(cardp->tx_urb); ++ + usb_fill_bulk_urb(cardp->tx_urb, cardp->udev, + usb_sndbulkpipe(cardp->udev, + cardp->ep_out), +-- +2.51.0 + diff --git a/queue-6.18/wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch b/queue-6.18/wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch new file mode 100644 index 00000000000..1a44d209f97 --- /dev/null +++ b/queue-6.18/wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch @@ -0,0 +1,86 @@ +From 59b60d35bbc20fe7dfd86da2a100c1719dcd5b48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Nov 2025 16:50:31 +0200 +Subject: wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() + +From: Bitterblue Smith + +[ Upstream commit 44d1f624bbdd2d60319374ba85f7195a28d00c90 ] + +rtw8822b_set_antenna() can be called from userspace when the chip is +powered off. In that case a WARNING is triggered in +rtw8822b_config_trx_mode() because trying to read the RF registers +when the chip is powered off returns an unexpected value. + +Call rtw8822b_config_trx_mode() in rtw8822b_set_antenna() only when +the chip is powered on. + +------------[ cut here ]------------ +write RF mode table fail +WARNING: CPU: 0 PID: 7183 at rtw8822b.c:824 rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b] +CPU: 0 UID: 0 PID: 7183 Comm: iw Tainted: G W OE 6.17.5-arch1-1 #1 PREEMPT(full) 01c39fc421df2af799dd5e9180b572af860b40c1 +Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE +Hardware name: LENOVO 82KR/LNVNB161216, BIOS HBCN18WW 08/27/2021 +RIP: 0010:rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b] +Call Trace: + + rtw8822b_set_antenna+0x57/0x70 [rtw88_8822b 370206f42e5890d8d5f48eb358b759efa37c422b] + rtw_ops_set_antenna+0x50/0x80 [rtw88_core 711c8fb4f686162be4625b1d0b8e8c6a5ac850fb] + ieee80211_set_antenna+0x60/0x100 [mac80211 f1845d85d2ecacf3b71867635a050ece90486cf3] + nl80211_set_wiphy+0x384/0xe00 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] + ? netdev_run_todo+0x63/0x550 + genl_family_rcv_msg_doit+0xfc/0x160 + genl_rcv_msg+0x1aa/0x2b0 + ? __pfx_nl80211_pre_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] + ? __pfx_nl80211_set_wiphy+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] + ? __pfx_nl80211_post_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] + ? __pfx_genl_rcv_msg+0x10/0x10 + netlink_rcv_skb+0x59/0x110 + genl_rcv+0x28/0x40 + netlink_unicast+0x285/0x3c0 + ? __alloc_skb+0xdb/0x1a0 + netlink_sendmsg+0x20d/0x430 + ____sys_sendmsg+0x39f/0x3d0 + ? import_iovec+0x2f/0x40 + ___sys_sendmsg+0x99/0xe0 + ? refill_obj_stock+0x12e/0x240 + __sys_sendmsg+0x8a/0xf0 + do_syscall_64+0x81/0x970 + ? do_syscall_64+0x81/0x970 + ? ksys_read+0x73/0xf0 + ? do_syscall_64+0x81/0x970 + ? count_memcg_events+0xc2/0x190 + ? handle_mm_fault+0x1d7/0x2d0 + ? do_user_addr_fault+0x21a/0x690 + ? exc_page_fault+0x7e/0x1a0 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +---[ end trace 0000000000000000 ]--- + +Link: https://github.com/lwfinger/rtw88/issues/366 +Signed-off-by: Bitterblue Smith +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/fb9a3444-9319-4aa2-8719-35a6308bf568@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/rtw8822b.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822b.c b/drivers/net/wireless/realtek/rtw88/rtw8822b.c +index 89b6485b229a8..4d88cc2f41485 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c ++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c +@@ -1005,7 +1005,8 @@ static int rtw8822b_set_antenna(struct rtw_dev *rtwdev, + hal->antenna_tx = antenna_tx; + hal->antenna_rx = antenna_rx; + +- rtw8822b_config_trx_mode(rtwdev, antenna_tx, antenna_rx, false); ++ if (test_bit(RTW_FLAG_POWERON, rtwdev->flags)) ++ rtw8822b_config_trx_mode(rtwdev, antenna_tx, antenna_rx, false); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.18/wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch b/queue-6.18/wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch new file mode 100644 index 00000000000..e77659c3e79 --- /dev/null +++ b/queue-6.18/wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch @@ -0,0 +1,65 @@ +From c0e40c607c43d76351801264bbea47cbf705a698 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 23:09:37 +0500 +Subject: wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero + +From: Roman Peshkichev + +[ Upstream commit 9f68fdcdc9dbf21be2a48feced90ff7f77d07443 ] + +The function rtw_set_dtim_period() accepted an 'int' dtim_period parameter, +while mac80211 provides dtim_period as 'u8' in struct ieee80211_bss_conf. +In IBSS (ad-hoc) mode mac80211 may set dtim_period to 0. + +The driver unconditionally wrote (dtim_period - 1) to +REG_DTIM_COUNTER_ROOT, which resulted in 0xFF when dtim_period was 0. This +caused delays in broadcast/multicast traffic processing and issues with +ad-hoc operation. + +Convert the function parameter to u8 to match ieee80211_bss_conf and avoid +the underflow by writing 0 when dtim_period is 0. + +Link: https://github.com/lwfinger/rtw88/issues/406 +Signed-off-by: Roman Peshkichev +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20251125180937.22977-1-roman.peshkichev@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/main.c | 4 ++-- + drivers/net/wireless/realtek/rtw88/main.h | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c +index d93d21656f26c..f72d12c3b2bc6 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.c ++++ b/drivers/net/wireless/realtek/rtw88/main.c +@@ -730,10 +730,10 @@ void rtw_set_rx_freq_band(struct rtw_rx_pkt_stat *pkt_stat, u8 channel) + } + EXPORT_SYMBOL(rtw_set_rx_freq_band); + +-void rtw_set_dtim_period(struct rtw_dev *rtwdev, int dtim_period) ++void rtw_set_dtim_period(struct rtw_dev *rtwdev, u8 dtim_period) + { + rtw_write32_set(rtwdev, REG_TCR, BIT_TCR_UPDATE_TIMIE); +- rtw_write8(rtwdev, REG_DTIM_COUNTER_ROOT, dtim_period - 1); ++ rtw_write8(rtwdev, REG_DTIM_COUNTER_ROOT, dtim_period ? dtim_period - 1 : 0); + } + + void rtw_update_channel(struct rtw_dev *rtwdev, u8 center_channel, +diff --git a/drivers/net/wireless/realtek/rtw88/main.h b/drivers/net/wireless/realtek/rtw88/main.h +index 43ed6d6b42919..1ab70214ce36e 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.h ++++ b/drivers/net/wireless/realtek/rtw88/main.h +@@ -2226,7 +2226,7 @@ enum nl80211_band rtw_hw_to_nl80211_band(enum rtw_supported_band hw_band) + } + + void rtw_set_rx_freq_band(struct rtw_rx_pkt_stat *pkt_stat, u8 channel); +-void rtw_set_dtim_period(struct rtw_dev *rtwdev, int dtim_period); ++void rtw_set_dtim_period(struct rtw_dev *rtwdev, u8 dtim_period); + void rtw_get_channel_params(struct cfg80211_chan_def *chandef, + struct rtw_channel_params *ch_param); + bool check_hw_ready(struct rtw_dev *rtwdev, u32 addr, u32 mask, u32 target); +-- +2.51.0 + diff --git a/queue-6.18/wifi-rtw88-fix-inadvertent-sharing-of-struct-ieee802.patch b/queue-6.18/wifi-rtw88-fix-inadvertent-sharing-of-struct-ieee802.patch new file mode 100644 index 00000000000..863674d665c --- /dev/null +++ b/queue-6.18/wifi-rtw88-fix-inadvertent-sharing-of-struct-ieee802.patch @@ -0,0 +1,92 @@ +From d4c3d846fc16af4e4967c430876af74915f48864 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Dec 2025 01:26:45 +0200 +Subject: wifi: rtw88: Fix inadvertent sharing of struct + ieee80211_supported_band data + +From: Bitterblue Smith + +[ Upstream commit fcac0f23d4d20b11014a39f8e2527cdc12ec9c82 ] + +Internally wiphy writes to individual channels in this structure, +so we must not share one static definition of channel list between +multiple device instances, because that causes hard to debug +breakage. + +For example, with two rtw88 driven devices in the system, channel +information may get incoherent, preventing channel use. + +Copied from commit 0ae36391c804 ("wifi: rtw89: Fix inadverent sharing +of struct ieee80211_supported_band data"). + +Signed-off-by: Bitterblue Smith +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/e94ad653-2b6d-4284-a33c-8c694f88955b@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/main.c | 34 +++++++++++++++++++---- + 1 file changed, 29 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c +index 6f35357e73246..dde2ea6a00e06 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.c ++++ b/drivers/net/wireless/realtek/rtw88/main.c +@@ -1658,16 +1658,41 @@ static u16 rtw_get_max_scan_ie_len(struct rtw_dev *rtwdev) + return len; + } + ++static struct ieee80211_supported_band * ++rtw_sband_dup(struct rtw_dev *rtwdev, ++ const struct ieee80211_supported_band *sband) ++{ ++ struct ieee80211_supported_band *dup; ++ ++ dup = devm_kmemdup(rtwdev->dev, sband, sizeof(*sband), GFP_KERNEL); ++ if (!dup) ++ return NULL; ++ ++ dup->channels = devm_kmemdup_array(rtwdev->dev, sband->channels, ++ sband->n_channels, ++ sizeof(*sband->channels), ++ GFP_KERNEL); ++ if (!dup->channels) ++ return NULL; ++ ++ dup->bitrates = devm_kmemdup_array(rtwdev->dev, sband->bitrates, ++ sband->n_bitrates, ++ sizeof(*sband->bitrates), ++ GFP_KERNEL); ++ if (!dup->bitrates) ++ return NULL; ++ ++ return dup; ++} ++ + static void rtw_set_supported_band(struct ieee80211_hw *hw, + const struct rtw_chip_info *chip) + { + struct ieee80211_supported_band *sband; + struct rtw_dev *rtwdev = hw->priv; +- struct device *dev = rtwdev->dev; + + if (chip->band & RTW_BAND_2G) { +- sband = devm_kmemdup(dev, &rtw_band_2ghz, sizeof(*sband), +- GFP_KERNEL); ++ sband = rtw_sband_dup(rtwdev, &rtw_band_2ghz); + if (!sband) + goto err_out; + if (chip->ht_supported) +@@ -1676,8 +1701,7 @@ static void rtw_set_supported_band(struct ieee80211_hw *hw, + } + + if (chip->band & RTW_BAND_5G) { +- sband = devm_kmemdup(dev, &rtw_band_5ghz, sizeof(*sband), +- GFP_KERNEL); ++ sband = rtw_sband_dup(rtwdev, &rtw_band_5ghz); + if (!sband) + goto err_out; + if (chip->ht_supported) +-- +2.51.0 + diff --git a/queue-6.18/wifi-rtw88-rtw8821cu-add-id-for-mercusys-mu6h.patch b/queue-6.18/wifi-rtw88-rtw8821cu-add-id-for-mercusys-mu6h.patch new file mode 100644 index 00000000000..d4536f4b133 --- /dev/null +++ b/queue-6.18/wifi-rtw88-rtw8821cu-add-id-for-mercusys-mu6h.patch @@ -0,0 +1,37 @@ +From 4fbcc45758270449d98d3ca7c426160fd5d05d4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 08:32:04 +0800 +Subject: wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H + +From: Hsiu-Ming Chang + +[ Upstream commit 77653c327e11c71c5363b18a53fbf2b92ed21da4 ] + +Add support for Mercusys MU6H AC650 High Gain Wireless Dual Band USB +Adapter V1.30. It is based on RTL8811CU, usb device ID is 2c4e:0105. + +Signed-off-by: Hsiu-Ming Chang +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20251205003245.5762-1-cges30901@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/rtw8821cu.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8821cu.c b/drivers/net/wireless/realtek/rtw88/rtw8821cu.c +index 7a0fffc359e25..8cd09d66655db 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8821cu.c ++++ b/drivers/net/wireless/realtek/rtw88/rtw8821cu.c +@@ -37,6 +37,8 @@ static const struct usb_device_id rtw_8821cu_id_table[] = { + .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Edimax */ + { USB_DEVICE_AND_INTERFACE_INFO(0x7392, 0xd811, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Edimax */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2c4e, 0x0105, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Mercusys */ + {}, + }; + MODULE_DEVICE_TABLE(usb, rtw_8821cu_id_table); +-- +2.51.0 + diff --git a/queue-6.18/wifi-rtw88-use-devm_kmemdup-in-rtw_set_supported_ban.patch b/queue-6.18/wifi-rtw88-use-devm_kmemdup-in-rtw_set_supported_ban.patch new file mode 100644 index 00000000000..b83b4e5c53a --- /dev/null +++ b/queue-6.18/wifi-rtw88-use-devm_kmemdup-in-rtw_set_supported_ban.patch @@ -0,0 +1,84 @@ +From eea78be92295d927021bda7de831f9e2415559b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Dec 2025 01:25:32 +0200 +Subject: wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() + +From: Bitterblue Smith + +[ Upstream commit 2ba12401cc1f2d970fa2e7d5b15abde3f5abd40d ] + +Simplify the code by using device managed memory allocations. + +This also fixes a memory leak in rtw_register_hw(). The supported bands +were not freed in the error path. + +Copied from commit 145df52a8671 ("wifi: rtw89: Convert +rtw89_core_set_supported_band to use devm_*"). + +Signed-off-by: Bitterblue Smith +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/1aa7fdef-2d5b-4a31-a4e9-fac8257ed30d@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/main.c | 19 ++++++------------- + 1 file changed, 6 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c +index f72d12c3b2bc6..6f35357e73246 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.c ++++ b/drivers/net/wireless/realtek/rtw88/main.c +@@ -1661,11 +1661,13 @@ static u16 rtw_get_max_scan_ie_len(struct rtw_dev *rtwdev) + static void rtw_set_supported_band(struct ieee80211_hw *hw, + const struct rtw_chip_info *chip) + { +- struct rtw_dev *rtwdev = hw->priv; + struct ieee80211_supported_band *sband; ++ struct rtw_dev *rtwdev = hw->priv; ++ struct device *dev = rtwdev->dev; + + if (chip->band & RTW_BAND_2G) { +- sband = kmemdup(&rtw_band_2ghz, sizeof(*sband), GFP_KERNEL); ++ sband = devm_kmemdup(dev, &rtw_band_2ghz, sizeof(*sband), ++ GFP_KERNEL); + if (!sband) + goto err_out; + if (chip->ht_supported) +@@ -1674,7 +1676,8 @@ static void rtw_set_supported_band(struct ieee80211_hw *hw, + } + + if (chip->band & RTW_BAND_5G) { +- sband = kmemdup(&rtw_band_5ghz, sizeof(*sband), GFP_KERNEL); ++ sband = devm_kmemdup(dev, &rtw_band_5ghz, sizeof(*sband), ++ GFP_KERNEL); + if (!sband) + goto err_out; + if (chip->ht_supported) +@@ -1690,13 +1693,6 @@ static void rtw_set_supported_band(struct ieee80211_hw *hw, + rtw_err(rtwdev, "failed to set supported band\n"); + } + +-static void rtw_unset_supported_band(struct ieee80211_hw *hw, +- const struct rtw_chip_info *chip) +-{ +- kfree(hw->wiphy->bands[NL80211_BAND_2GHZ]); +- kfree(hw->wiphy->bands[NL80211_BAND_5GHZ]); +-} +- + static void rtw_vif_smps_iter(void *data, u8 *mac, + struct ieee80211_vif *vif) + { +@@ -2320,10 +2316,7 @@ EXPORT_SYMBOL(rtw_register_hw); + + void rtw_unregister_hw(struct rtw_dev *rtwdev, struct ieee80211_hw *hw) + { +- const struct rtw_chip_info *chip = rtwdev->chip; +- + ieee80211_unregister_hw(hw); +- rtw_unset_supported_band(hw, chip); + rtw_debugfs_deinit(rtwdev); + rtw_led_deinit(rtwdev); + } +-- +2.51.0 + diff --git a/queue-6.18/wifi-rtw89-8922a-add-digital-compensation-for-2ghz.patch b/queue-6.18/wifi-rtw89-8922a-add-digital-compensation-for-2ghz.patch new file mode 100644 index 00000000000..ee699b8990b --- /dev/null +++ b/queue-6.18/wifi-rtw89-8922a-add-digital-compensation-for-2ghz.patch @@ -0,0 +1,123 @@ +From fc99d8a3e1dece8a489361d5428d916d3c79f247 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jan 2026 12:41:57 +0800 +Subject: wifi: rtw89: 8922a: add digital compensation for 2GHz + +From: Po-Hao Huang + +[ Upstream commit 8da7e88682d58a7c2e2c2101e49d3c9c9ac481b0 ] + +This fixes transmit power too low under 2GHz connection. Previously +we missed the settings of 2GHz, add the according calibrated tables. + +Signed-off-by: Po-Hao Huang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260117044157.2392958-10-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/rtw8922a.c | 57 +++++++++++++++---- + 1 file changed, 47 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922a.c b/drivers/net/wireless/realtek/rtw89/rtw8922a.c +index 757dedd1a11d5..730e5d0d65750 100644 +--- a/drivers/net/wireless/realtek/rtw89/rtw8922a.c ++++ b/drivers/net/wireless/realtek/rtw89/rtw8922a.c +@@ -1770,6 +1770,32 @@ static int rtw8922a_ctrl_rx_path_tmac(struct rtw89_dev *rtwdev, + } + + #define DIGITAL_PWR_COMP_REG_NUM 22 ++static const u32 rtw8922a_digital_pwr_comp_2g_s0_val[][DIGITAL_PWR_COMP_REG_NUM] = { ++ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320, ++ 0x0D05091D, 0x14D50FA0, 0x00000000, 0x01010000, 0x00000101, ++ 0x01010101, 0x02020201, 0x02010000, 0x03030202, 0x00000303, ++ 0x03020101, 0x06060504, 0x01010000, 0x06050403, 0x01000606, ++ 0x05040202, 0x07070706}, ++ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320, ++ 0x0D05091D, 0x14D50FA0, 0x00000000, 0x01010100, 0x00000101, ++ 0x01000000, 0x01010101, 0x01010000, 0x02020202, 0x00000404, ++ 0x03020101, 0x04040303, 0x02010000, 0x03030303, 0x00000505, ++ 0x03030201, 0x05050303}, ++}; ++ ++static const u32 rtw8922a_digital_pwr_comp_2g_s1_val[][DIGITAL_PWR_COMP_REG_NUM] = { ++ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320, ++ 0x0D05091D, 0x14D50FA0, 0x01010000, 0x01010101, 0x00000101, ++ 0x01010100, 0x01010101, 0x01010000, 0x02020202, 0x01000202, ++ 0x02020101, 0x03030202, 0x02010000, 0x05040403, 0x01000606, ++ 0x05040302, 0x07070605}, ++ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320, ++ 0x0D05091D, 0x14D50FA0, 0x00000000, 0x01010100, 0x00000101, ++ 0x01010000, 0x02020201, 0x02010100, 0x03030202, 0x01000404, ++ 0x04030201, 0x05050404, 0x01010100, 0x04030303, 0x01000505, ++ 0x03030101, 0x05050404}, ++}; ++ + static const u32 rtw8922a_digital_pwr_comp_val[][DIGITAL_PWR_COMP_REG_NUM] = { + {0x012C0096, 0x044C02BC, 0x00322710, 0x015E0096, 0x03C8028A, + 0x0BB80708, 0x17701194, 0x02020100, 0x03030303, 0x01000303, +@@ -1784,7 +1810,7 @@ static const u32 rtw8922a_digital_pwr_comp_val[][DIGITAL_PWR_COMP_REG_NUM] = { + }; + + static void rtw8922a_set_digital_pwr_comp(struct rtw89_dev *rtwdev, +- bool enable, u8 nss, ++ u8 band, u8 nss, + enum rtw89_rf_path path) + { + static const u32 ltpc_t0[2] = {R_BE_LTPC_T0_PATH0, R_BE_LTPC_T0_PATH1}; +@@ -1792,14 +1818,25 @@ static void rtw8922a_set_digital_pwr_comp(struct rtw89_dev *rtwdev, + u32 addr, val; + u32 i; + +- if (nss == 1) +- digital_pwr_comp = rtw8922a_digital_pwr_comp_val[0]; +- else +- digital_pwr_comp = rtw8922a_digital_pwr_comp_val[1]; ++ if (nss == 1) { ++ if (band == RTW89_BAND_2G) ++ digital_pwr_comp = path == RF_PATH_A ? ++ rtw8922a_digital_pwr_comp_2g_s0_val[0] : ++ rtw8922a_digital_pwr_comp_2g_s1_val[0]; ++ else ++ digital_pwr_comp = rtw8922a_digital_pwr_comp_val[0]; ++ } else { ++ if (band == RTW89_BAND_2G) ++ digital_pwr_comp = path == RF_PATH_A ? ++ rtw8922a_digital_pwr_comp_2g_s0_val[1] : ++ rtw8922a_digital_pwr_comp_2g_s1_val[1]; ++ else ++ digital_pwr_comp = rtw8922a_digital_pwr_comp_val[1]; ++ } + + addr = ltpc_t0[path]; + for (i = 0; i < DIGITAL_PWR_COMP_REG_NUM; i++, addr += 4) { +- val = enable ? digital_pwr_comp[i] : 0; ++ val = digital_pwr_comp[i]; + rtw89_phy_write32(rtwdev, addr, val); + } + } +@@ -1808,7 +1845,7 @@ static void rtw8922a_digital_pwr_comp(struct rtw89_dev *rtwdev, + enum rtw89_phy_idx phy_idx) + { + const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, RTW89_CHANCTX_0); +- bool enable = chan->band_type != RTW89_BAND_2G; ++ u8 band = chan->band_type; + u8 path; + + if (rtwdev->mlo_dbcc_mode == MLO_1_PLUS_1_1RF) { +@@ -1816,10 +1853,10 @@ static void rtw8922a_digital_pwr_comp(struct rtw89_dev *rtwdev, + path = RF_PATH_A; + else + path = RF_PATH_B; +- rtw8922a_set_digital_pwr_comp(rtwdev, enable, 1, path); ++ rtw8922a_set_digital_pwr_comp(rtwdev, band, 1, path); + } else { +- rtw8922a_set_digital_pwr_comp(rtwdev, enable, 2, RF_PATH_A); +- rtw8922a_set_digital_pwr_comp(rtwdev, enable, 2, RF_PATH_B); ++ rtw8922a_set_digital_pwr_comp(rtwdev, band, 2, RF_PATH_A); ++ rtw8922a_set_digital_pwr_comp(rtwdev, band, 2, RF_PATH_B); + } + } + +-- +2.51.0 + diff --git a/queue-6.18/wifi-rtw89-8922a-set-random-mac-if-efuse-contains-ze.patch b/queue-6.18/wifi-rtw89-8922a-set-random-mac-if-efuse-contains-ze.patch new file mode 100644 index 00000000000..0820cc41259 --- /dev/null +++ b/queue-6.18/wifi-rtw89-8922a-set-random-mac-if-efuse-contains-ze.patch @@ -0,0 +1,71 @@ +From 4e366c650fdc273f80e5630272706b069aadbbba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Nov 2025 10:18:56 +0100 +Subject: wifi: rtw89: 8922a: set random mac if efuse contains zeroes + +From: Jose Ignacio Tornos Martinez + +[ Upstream commit 41be33d3efc120f6a2c02d12742655f2aa09e1b6 ] + +I have some rtl8922ae devices with no permanent mac stored in efuse. + +It could be properly saved and/or configured from user tools like +NetworkManager, but it would be desirable to be able to initialize it +somehow to get the device working by default. + +So, in the same way as with other devices, if the mac address read from +efuse contains zeros, a random mac address is assigned to at least allow +operation, and the user is warned about this in case any action needs to +be considered. + +Signed-off-by: Jose Ignacio Tornos Martinez +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20251126091905.217951-1-jtornosm@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/rtw8922a.c | 22 +++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922a.c b/drivers/net/wireless/realtek/rtw89/rtw8922a.c +index 6aa19ad259aca..757dedd1a11d5 100644 +--- a/drivers/net/wireless/realtek/rtw89/rtw8922a.c ++++ b/drivers/net/wireless/realtek/rtw89/rtw8922a.c +@@ -636,16 +636,30 @@ static int rtw8922a_read_efuse_rf(struct rtw89_dev *rtwdev, u8 *log_map) + static int rtw8922a_read_efuse(struct rtw89_dev *rtwdev, u8 *log_map, + enum rtw89_efuse_block block) + { ++ struct rtw89_efuse *efuse = &rtwdev->efuse; ++ int ret; ++ + switch (block) { + case RTW89_EFUSE_BLOCK_HCI_DIG_PCIE_SDIO: +- return rtw8922a_read_efuse_pci_sdio(rtwdev, log_map); ++ ret = rtw8922a_read_efuse_pci_sdio(rtwdev, log_map); ++ break; + case RTW89_EFUSE_BLOCK_HCI_DIG_USB: +- return rtw8922a_read_efuse_usb(rtwdev, log_map); ++ ret = rtw8922a_read_efuse_usb(rtwdev, log_map); ++ break; + case RTW89_EFUSE_BLOCK_RF: +- return rtw8922a_read_efuse_rf(rtwdev, log_map); ++ ret = rtw8922a_read_efuse_rf(rtwdev, log_map); ++ break; + default: +- return 0; ++ ret = 0; ++ break; ++ } ++ ++ if (!ret && is_zero_ether_addr(efuse->addr)) { ++ rtw89_info(rtwdev, "efuse mac address is zero, using random mac\n"); ++ eth_random_addr(efuse->addr); + } ++ ++ return ret; + } + + #define THM_TRIM_POSITIVE_MASK BIT(6) +-- +2.51.0 + diff --git a/queue-6.18/wifi-rtw89-add-support-for-msi-ax1800-nano-guax18n.patch b/queue-6.18/wifi-rtw89-add-support-for-msi-ax1800-nano-guax18n.patch new file mode 100644 index 00000000000..cdc197c753f --- /dev/null +++ b/queue-6.18/wifi-rtw89-add-support-for-msi-ax1800-nano-guax18n.patch @@ -0,0 +1,39 @@ +From 6b840c7f2260353137c90ce3e0e3c282e9f89512 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 08:43:58 +0800 +Subject: wifi: rtw89: Add support for MSI AX1800 Nano (GUAX18N) + +From: Zenm Chen + +[ Upstream commit 3116f287b81fe777a00b93ab07ec3c270093b185 ] + +Add the ID 0db0:f0c8 to the table to support an additional RTL8832BU +adapter: MSI AX1800 Nano (GUAX18N). + +Compile tested only. + +Link: https://github.com/morrownr/rtl8852bu-20250826/pull/2 +Signed-off-by: Zenm Chen +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260112004358.5516-1-zenmchen@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/rtw8852bu.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852bu.c b/drivers/net/wireless/realtek/rtw89/rtw8852bu.c +index 0694272f7ffae..add5987110b33 100644 +--- a/drivers/net/wireless/realtek/rtw89/rtw8852bu.c ++++ b/drivers/net/wireless/realtek/rtw89/rtw8852bu.c +@@ -30,6 +30,8 @@ static const struct usb_device_id rtw_8852bu_id_table[] = { + .driver_info = (kernel_ulong_t)&rtw89_8852bu_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x0db0, 0x6931, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&rtw89_8852bu_info }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x0db0, 0xf0c8, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&rtw89_8852bu_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3327, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&rtw89_8852bu_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3574, 0x6121, 0xff, 0xff, 0xff), +-- +2.51.0 + diff --git a/queue-6.18/wifi-rtw89-disable-eht-protocol-by-chip-capabilities.patch b/queue-6.18/wifi-rtw89-disable-eht-protocol-by-chip-capabilities.patch new file mode 100644 index 00000000000..5291e8a2735 --- /dev/null +++ b/queue-6.18/wifi-rtw89-disable-eht-protocol-by-chip-capabilities.patch @@ -0,0 +1,88 @@ +From 668b054ac597631151113c0ee911eeb61763f6bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 10:20:15 +0800 +Subject: wifi: rtw89: disable EHT protocol by chip capabilities + +From: Ping-Ke Shih + +[ Upstream commit 7fd36ffedeedc97c44a10249a3f12d471bb2dc26 ] + +For certain chip models, EHT protocol is disabled, and driver must follow +the capabilities. Otherwise, chips become unusable. + +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260110022019.2254969-5-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/core.c | 2 +- + drivers/net/wireless/realtek/rtw89/core.h | 1 + + drivers/net/wireless/realtek/rtw89/fw.h | 4 ++++ + drivers/net/wireless/realtek/rtw89/mac.c | 5 +++++ + 4 files changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c +index ed6018f54f20a..018857d3569a8 100644 +--- a/drivers/net/wireless/realtek/rtw89/core.c ++++ b/drivers/net/wireless/realtek/rtw89/core.c +@@ -5111,7 +5111,7 @@ static void rtw89_init_eht_cap(struct rtw89_dev *rtwdev, + u8 val, val_mcs13; + int sts = 8; + +- if (chip->chip_gen == RTW89_CHIP_AX) ++ if (chip->chip_gen == RTW89_CHIP_AX || hal->no_eht) + return; + + if (hal->no_mcs_12_13) +diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h +index 928c8c84c9644..c3839d49f4420 100644 +--- a/drivers/net/wireless/realtek/rtw89/core.h ++++ b/drivers/net/wireless/realtek/rtw89/core.h +@@ -4996,6 +4996,7 @@ struct rtw89_hal { + bool support_cckpd; + bool support_igi; + bool no_mcs_12_13; ++ bool no_eht; + + atomic_t roc_chanctx_idx; + u8 roc_link_index; +diff --git a/drivers/net/wireless/realtek/rtw89/fw.h b/drivers/net/wireless/realtek/rtw89/fw.h +index ddebf79720687..47e5cbec306d2 100644 +--- a/drivers/net/wireless/realtek/rtw89/fw.h ++++ b/drivers/net/wireless/realtek/rtw89/fw.h +@@ -42,6 +42,10 @@ struct rtw89_c2hreg_phycap { + #define RTW89_C2HREG_PHYCAP_W0_BW GENMASK(31, 24) + #define RTW89_C2HREG_PHYCAP_W1_TX_NSS GENMASK(7, 0) + #define RTW89_C2HREG_PHYCAP_W1_PROT GENMASK(15, 8) ++#define RTW89_C2HREG_PHYCAP_W1_PROT_11N 1 ++#define RTW89_C2HREG_PHYCAP_W1_PROT_11AC 2 ++#define RTW89_C2HREG_PHYCAP_W1_PROT_11AX 3 ++#define RTW89_C2HREG_PHYCAP_W1_PROT_11BE 4 + #define RTW89_C2HREG_PHYCAP_W1_NIC GENMASK(23, 16) + #define RTW89_C2HREG_PHYCAP_W1_WL_FUNC GENMASK(31, 24) + #define RTW89_C2HREG_PHYCAP_W2_HW_TYPE GENMASK(7, 0) +diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c +index df429bdef7956..71194ea68bcee 100644 +--- a/drivers/net/wireless/realtek/rtw89/mac.c ++++ b/drivers/net/wireless/realtek/rtw89/mac.c +@@ -2999,6 +2999,7 @@ static int rtw89_mac_setup_phycap_part0(struct rtw89_dev *rtwdev) + struct rtw89_efuse *efuse = &rtwdev->efuse; + struct rtw89_mac_c2h_info c2h_info = {}; + struct rtw89_hal *hal = &rtwdev->hal; ++ u8 protocol; + u8 tx_nss; + u8 rx_nss; + u8 tx_ant; +@@ -3046,6 +3047,10 @@ static int rtw89_mac_setup_phycap_part0(struct rtw89_dev *rtwdev) + rtw89_debug(rtwdev, RTW89_DBG_FW, "TX path diversity=%d\n", hal->tx_path_diversity); + rtw89_debug(rtwdev, RTW89_DBG_FW, "Antenna diversity=%d\n", hal->ant_diversity); + ++ protocol = u32_get_bits(phycap->w1, RTW89_C2HREG_PHYCAP_W1_PROT); ++ if (protocol < RTW89_C2HREG_PHYCAP_W1_PROT_11BE) ++ hal->no_eht = true; ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.18/wifi-rtw89-fix-potential-zero-beacon-interval-in-bea.patch b/queue-6.18/wifi-rtw89-fix-potential-zero-beacon-interval-in-bea.patch new file mode 100644 index 00000000000..0aaa85a78e2 --- /dev/null +++ b/queue-6.18/wifi-rtw89-fix-potential-zero-beacon-interval-in-bea.patch @@ -0,0 +1,78 @@ +From 6f9bd77dd6fe77b1aa8a78471ce6fb63562a97ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Dec 2025 17:06:46 +0800 +Subject: wifi: rtw89: fix potential zero beacon interval in beacon tracking + +From: Kuan-Chung Chen + +[ Upstream commit eb57be32f438c57c88d6ce756101c1dfbcc03bba ] + +During fuzz testing, it was discovered that bss_conf->beacon_int +might be zero, which could result in a division by zero error in +subsequent calculations. Set a default value of 100 TU if the +interval is zero to ensure stability. + +Signed-off-by: Kuan-Chung Chen +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20251231090647.56407-11-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/core.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c +index 917b2adede61d..ed6018f54f20a 100644 +--- a/drivers/net/wireless/realtek/rtw89/core.c ++++ b/drivers/net/wireless/realtek/rtw89/core.c +@@ -2655,7 +2655,7 @@ static void rtw89_core_bcn_track_assoc(struct rtw89_dev *rtwdev, + + rcu_read_lock(); + bss_conf = rtw89_vif_rcu_dereference_link(rtwvif_link, true); +- beacon_int = bss_conf->beacon_int; ++ beacon_int = bss_conf->beacon_int ?: 100; + dtim = bss_conf->dtim_period; + rcu_read_unlock(); + +@@ -2685,9 +2685,7 @@ static void rtw89_core_bcn_track_reset(struct rtw89_dev *rtwdev) + memset(&rtwdev->bcn_track, 0, sizeof(rtwdev->bcn_track)); + } + +-static void rtw89_vif_rx_bcn_stat(struct rtw89_dev *rtwdev, +- struct ieee80211_bss_conf *bss_conf, +- struct sk_buff *skb) ++static void rtw89_vif_rx_bcn_stat(struct rtw89_dev *rtwdev, struct sk_buff *skb) + { + #define RTW89_APPEND_TSF_2GHZ 384 + #define RTW89_APPEND_TSF_5GHZ 52 +@@ -2696,7 +2694,7 @@ static void rtw89_vif_rx_bcn_stat(struct rtw89_dev *rtwdev, + struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb); + struct rtw89_beacon_stat *bcn_stat = &rtwdev->phystat.bcn_stat; + struct rtw89_beacon_track_info *bcn_track = &rtwdev->bcn_track; +- u32 bcn_intvl_us = ieee80211_tu_to_usec(bss_conf->beacon_int); ++ u32 bcn_intvl_us = ieee80211_tu_to_usec(bcn_track->beacon_int); + u64 tsf = le64_to_cpu(mgmt->u.beacon.timestamp); + u8 wp, num = bcn_stat->num; + u16 append; +@@ -2704,6 +2702,10 @@ static void rtw89_vif_rx_bcn_stat(struct rtw89_dev *rtwdev, + if (!RTW89_CHK_FW_FEATURE(BEACON_TRACKING, &rtwdev->fw)) + return; + ++ /* Skip if not yet associated */ ++ if (!bcn_intvl_us) ++ return; ++ + switch (rx_status->band) { + default: + case NL80211_BAND_2GHZ: +@@ -2791,7 +2793,7 @@ static void rtw89_vif_rx_stats_iter(void *data, u8 *mac, + pkt_stat->beacon_rate = desc_info->data_rate; + pkt_stat->beacon_len = skb->len; + +- rtw89_vif_rx_bcn_stat(rtwdev, bss_conf, skb); ++ rtw89_vif_rx_bcn_stat(rtwdev, skb); + } + + if (!ether_addr_equal(bss_conf->addr, hdr->addr1)) +-- +2.51.0 + diff --git a/queue-6.18/wifi-rtw89-fix-unable-to-receive-probe-responses-und.patch b/queue-6.18/wifi-rtw89-fix-unable-to-receive-probe-responses-und.patch new file mode 100644 index 00000000000..411c81ab7ee --- /dev/null +++ b/queue-6.18/wifi-rtw89-fix-unable-to-receive-probe-responses-und.patch @@ -0,0 +1,47 @@ +From 09903bfa27fd3dce9fd64a520457382a325c1263 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 09:39:50 +0800 +Subject: wifi: rtw89: fix unable to receive probe responses under MLO + connection + +From: Po-Hao Huang + +[ Upstream commit 6f6d7a325fbde4f025ee1b1277f6f44727e21223 ] + +During MLO connections, A1 of the probe responses we received are +in link address, these frames will then be dropped by mac80211 due to +not matching the MLD address in ieee80211_scan_accept_presp(). +Fix this by using MLD address to scan when not using random MAC address. + +Signed-off-by: Po-Hao Huang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260114013950.19704-13-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/fw.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c +index 080c4f8a655a8..c9851aafe649e 100644 +--- a/drivers/net/wireless/realtek/rtw89/fw.c ++++ b/drivers/net/wireless/realtek/rtw89/fw.c +@@ -8042,6 +8042,7 @@ int rtw89_hw_scan_start(struct rtw89_dev *rtwdev, + struct cfg80211_scan_request *req = &scan_req->req; + const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, + rtwvif_link->chanctx_idx); ++ struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link); + struct rtw89_vif *rtwvif = rtwvif_link->rtwvif; + struct rtw89_chanctx_pause_parm pause_parm = { + .rsn = RTW89_CHANCTX_PAUSE_REASON_HW_SCAN, +@@ -8071,6 +8072,8 @@ int rtw89_hw_scan_start(struct rtw89_dev *rtwdev, + if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) + get_random_mask_addr(mac_addr, req->mac_addr, + req->mac_addr_mask); ++ else if (ieee80211_vif_is_mld(vif)) ++ ether_addr_copy(mac_addr, vif->addr); + else + ether_addr_copy(mac_addr, rtwvif_link->mac_addr); + +-- +2.51.0 + diff --git a/queue-6.18/wifi-rtw89-mac-correct-page-number-for-csi-response.patch b/queue-6.18/wifi-rtw89-mac-correct-page-number-for-csi-response.patch new file mode 100644 index 00000000000..7fbb624a18a --- /dev/null +++ b/queue-6.18/wifi-rtw89-mac-correct-page-number-for-csi-response.patch @@ -0,0 +1,35 @@ +From 60b2cd9f63d73220f2a07cc316014732261472d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 10:20:17 +0800 +Subject: wifi: rtw89: mac: correct page number for CSI response + +From: Ping-Ke Shih + +[ Upstream commit aa2a44d0d22d45d659b9f01638809b1735e46cff ] + +For beamforming procedure, hardware reserve memory page for CSI response. +The unit of register is (value - 1), so add one accordingly as expected. + +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260110022019.2254969-7-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/mac_be.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/mac_be.c b/drivers/net/wireless/realtek/rtw89/mac_be.c +index e33297220f8b5..e5a61c628b731 100644 +--- a/drivers/net/wireless/realtek/rtw89/mac_be.c ++++ b/drivers/net/wireless/realtek/rtw89/mac_be.c +@@ -1168,7 +1168,7 @@ static int resp_pktctl_init_be(struct rtw89_dev *rtwdev, u8 mac_idx) + + reg = rtw89_mac_reg_by_idx(rtwdev, R_BE_RESP_CSI_RESERVED_PAGE, mac_idx); + rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_START_PAGE_MASK, qt_cfg.pktid); +- rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_PAGE_NUM_MASK, qt_cfg.pg_num); ++ rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_PAGE_NUM_MASK, qt_cfg.pg_num + 1); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.18/wifi-rtw89-mcc-reset-probe-counter-when-receiving-be.patch b/queue-6.18/wifi-rtw89-mcc-reset-probe-counter-when-receiving-be.patch new file mode 100644 index 00000000000..e8c277ec815 --- /dev/null +++ b/queue-6.18/wifi-rtw89-mcc-reset-probe-counter-when-receiving-be.patch @@ -0,0 +1,66 @@ +From f213827d4a763e54a28724c8bfbf7f9981b91630 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Dec 2025 11:06:51 +0800 +Subject: wifi: rtw89: mcc: reset probe counter when receiving beacon + +From: Chih-Kang Chang + +[ Upstream commit 1b40c1c7571fcf926095ed92f25bd87900bdc8ed ] + +For BE chips, needs to transmit QoS null data periodically to ensure +the connection with AP in GC+STA mode. However, in environments +with interference, the Qos null data might fail to transmit +successfully. Therefore, when receive the beacon from AP will +reset the QoS null data failure counter to avoid unnecessary +disconnection. + +Signed-off-by: Chih-Kang Chang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20251223030651.480633-13-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/chan.c | 5 ++++- + drivers/net/wireless/realtek/rtw89/mac80211.c | 1 + + 2 files changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/chan.c b/drivers/net/wireless/realtek/rtw89/chan.c +index 86f1b39a967fe..8fe6a7ef738f7 100644 +--- a/drivers/net/wireless/realtek/rtw89/chan.c ++++ b/drivers/net/wireless/realtek/rtw89/chan.c +@@ -2608,17 +2608,20 @@ bool rtw89_mcc_detect_go_bcn(struct rtw89_dev *rtwdev, + static void rtw89_mcc_detect_connection(struct rtw89_dev *rtwdev, + struct rtw89_mcc_role *role) + { ++ struct rtw89_vif_link *rtwvif_link = role->rtwvif_link; + struct ieee80211_vif *vif; + bool start_detect; + int ret; + + ret = rtw89_core_send_nullfunc(rtwdev, role->rtwvif_link, true, false, + RTW89_MCC_PROBE_TIMEOUT); +- if (ret) ++ if (ret && ++ READ_ONCE(rtwvif_link->sync_bcn_tsf) == rtwvif_link->last_sync_bcn_tsf) + role->probe_count++; + else + role->probe_count = 0; + ++ rtwvif_link->last_sync_bcn_tsf = READ_ONCE(rtwvif_link->sync_bcn_tsf); + if (role->probe_count < RTW89_MCC_PROBE_MAX_TRIES) + return; + +diff --git a/drivers/net/wireless/realtek/rtw89/mac80211.c b/drivers/net/wireless/realtek/rtw89/mac80211.c +index 7b04183a3a5dd..474be7a5e49c7 100644 +--- a/drivers/net/wireless/realtek/rtw89/mac80211.c ++++ b/drivers/net/wireless/realtek/rtw89/mac80211.c +@@ -127,6 +127,7 @@ static int __rtw89_ops_add_iface_link(struct rtw89_dev *rtwdev, + rtwvif_link->reg_6ghz_power = RTW89_REG_6GHZ_POWER_DFLT; + rtwvif_link->rand_tsf_done = false; + rtwvif_link->detect_bcn_count = 0; ++ rtwvif_link->last_sync_bcn_tsf = 0; + + rcu_read_lock(); + +-- +2.51.0 + diff --git a/queue-6.18/wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch b/queue-6.18/wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch new file mode 100644 index 00000000000..f6c9153dbc0 --- /dev/null +++ b/queue-6.18/wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch @@ -0,0 +1,36 @@ +From 3da7bd4b6ffb997ae31246c0948b184019ff9b6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 16:50:35 +0800 +Subject: wifi: rtw89: pci: restore LDO setting after device resume + +From: Dian-Syuan Yang + +[ Upstream commit af1e82232b988f8fc6d635c60609765e49221a64 ] + +The LDO (Low Dropout Regulator) setting is missing after suspend/resume +in some platforms, and it will cause card loss. Therefore, reconfigure +this setting to avoid it. + +Signed-off-by: Dian-Syuan Yang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260127085036.44060-6-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c +index f7be5e7e0a37c..6be1849b0c4d2 100644 +--- a/drivers/net/wireless/realtek/rtw89/pci.c ++++ b/drivers/net/wireless/realtek/rtw89/pci.c +@@ -4591,6 +4591,7 @@ static int __maybe_unused rtw89_pci_resume(struct device *dev) + rtw89_write32_clr(rtwdev, R_AX_PCIE_PS_CTRL_V1, + B_AX_SEL_REQ_ENTR_L1); + } ++ rtw89_pci_hci_ldo(rtwdev); + rtw89_pci_l2_hci_ldo(rtwdev); + + rtw89_pci_basic_cfg(rtwdev, true); +-- +2.51.0 + diff --git a/queue-6.18/wifi-rtw89-pci-validate-release-report-content-befor.patch b/queue-6.18/wifi-rtw89-pci-validate-release-report-content-befor.patch new file mode 100644 index 00000000000..1a884209cf0 --- /dev/null +++ b/queue-6.18/wifi-rtw89-pci-validate-release-report-content-befor.patch @@ -0,0 +1,43 @@ +From b7da31ee9d10a8b8b3b91da8e91c6f9ac47e5c1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 09:39:56 +0800 +Subject: wifi: rtw89: pci: validate release report content before using for + RTL8922DE + +From: Ping-Ke Shih + +[ Upstream commit 5f93d611b33a05bd03d6843c8efe8cb6a1992620 ] + +The commit 957eda596c76 +("wifi: rtw89: pci: validate sequence number of TX release report") +does validation on existing chips, which somehow a release report of SKB +becomes malformed. As no clear cause found, add rules ahead for RTL8922DE +to avoid crash if it happens. + +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260123013957.16418-11-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/pci.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c +index 6395c53b3e170..f7be5e7e0a37c 100644 +--- a/drivers/net/wireless/realtek/rtw89/pci.c ++++ b/drivers/net/wireless/realtek/rtw89/pci.c +@@ -604,8 +604,10 @@ static void rtw89_pci_release_rpp(struct rtw89_dev *rtwdev, void *rpp) + + info->parse_rpp(rtwdev, rpp, &rpp_info); + +- if (unlikely(rpp_info.txch == RTW89_TXCH_CH12)) { +- rtw89_warn(rtwdev, "should no fwcmd release report\n"); ++ if (unlikely(rpp_info.txch >= RTW89_TXCH_NUM || ++ info->tx_dma_ch_mask & BIT(rpp_info.txch))) { ++ rtw89_warn(rtwdev, "should no release report on txch %d\n", ++ rpp_info.txch); + return; + } + +-- +2.51.0 + diff --git a/queue-6.18/wifi-rtw89-pci-validate-sequence-number-of-tx-releas.patch b/queue-6.18/wifi-rtw89-pci-validate-sequence-number-of-tx-releas.patch new file mode 100644 index 00000000000..3d98cddaaaf --- /dev/null +++ b/queue-6.18/wifi-rtw89-pci-validate-sequence-number-of-tx-releas.patch @@ -0,0 +1,75 @@ +From 8965436f644d7a5b258391db76e0ed88a65251cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 10:20:12 +0800 +Subject: wifi: rtw89: pci: validate sequence number of TX release report + +From: Ping-Ke Shih + +[ Upstream commit 957eda596c7665f2966970fd1dcc35fe299b38e8 ] + +Hardware rarely reports abnormal sequence number in TX release report, +which will access out-of-bounds of wd_ring->pages array, causing NULL +pointer dereference. + + BUG: kernel NULL pointer dereference, address: 0000000000000000 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 0 P4D 0 + Oops: 0000 [#1] PREEMPT SMP NOPTI + CPU: 1 PID: 1085 Comm: irq/129-rtw89_p Tainted: G S U + 6.1.145-17510-g2f3369c91536 #1 (HASH:69e8 1) + Call Trace: + + rtw89_pci_release_tx+0x18f/0x300 [rtw89_pci (HASH:4c83 2)] + rtw89_pci_napi_poll+0xc2/0x190 [rtw89_pci (HASH:4c83 2)] + net_rx_action+0xfc/0x460 net/core/dev.c:6578 net/core/dev.c:6645 net/core/dev.c:6759 + handle_softirqs+0xbe/0x290 kernel/softirq.c:601 + ? rtw89_pci_interrupt_threadfn+0xc5/0x350 [rtw89_pci (HASH:4c83 2)] + __local_bh_enable_ip+0xeb/0x120 kernel/softirq.c:499 kernel/softirq.c:423 + + + rtw89_pci_interrupt_threadfn+0xf8/0x350 [rtw89_pci (HASH:4c83 2)] + ? irq_thread+0xa7/0x340 kernel/irq/manage.c:0 + irq_thread+0x177/0x340 kernel/irq/manage.c:1205 kernel/irq/manage.c:1314 + ? thaw_kernel_threads+0xb0/0xb0 kernel/irq/manage.c:1202 + ? irq_forced_thread_fn+0x80/0x80 kernel/irq/manage.c:1220 + kthread+0xea/0x110 kernel/kthread.c:376 + ? synchronize_irq+0x1a0/0x1a0 kernel/irq/manage.c:1287 + ? kthread_associate_blkcg+0x80/0x80 kernel/kthread.c:331 + ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 + + +To prevent crash, validate rpp_info.seq before using. + +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260110022019.2254969-2-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/pci.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c +index 0ee5f85794476..6395c53b3e170 100644 +--- a/drivers/net/wireless/realtek/rtw89/pci.c ++++ b/drivers/net/wireless/realtek/rtw89/pci.c +@@ -604,11 +604,16 @@ static void rtw89_pci_release_rpp(struct rtw89_dev *rtwdev, void *rpp) + + info->parse_rpp(rtwdev, rpp, &rpp_info); + +- if (rpp_info.txch == RTW89_TXCH_CH12) { ++ if (unlikely(rpp_info.txch == RTW89_TXCH_CH12)) { + rtw89_warn(rtwdev, "should no fwcmd release report\n"); + return; + } + ++ if (unlikely(rpp_info.seq >= RTW89_PCI_TXWD_NUM_MAX)) { ++ rtw89_warn(rtwdev, "invalid seq %d\n", rpp_info.seq); ++ return; ++ } ++ + tx_ring = &rtwpci->tx.rings[rpp_info.txch]; + wd_ring = &tx_ring->wd_ring; + txwd = &wd_ring->pages[rpp_info.seq]; +-- +2.51.0 + diff --git a/queue-6.18/wifi-rtw89-regd-6-ghz-power-type-marks-default-when-.patch b/queue-6.18/wifi-rtw89-regd-6-ghz-power-type-marks-default-when-.patch new file mode 100644 index 00000000000..7452d3b1d15 --- /dev/null +++ b/queue-6.18/wifi-rtw89-regd-6-ghz-power-type-marks-default-when-.patch @@ -0,0 +1,39 @@ +From eadc04ee05d7148d4353715622c35a9b67ee8119 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Dec 2025 11:09:25 +0800 +Subject: wifi: rtw89: regd: 6 GHz power type marks default when inactive + +From: Zong-Zhe Yang + +[ Upstream commit 8c96752d99c0b094af68317a8c701b09bd0862d9 ] + +When inactive, 6 GHz power type has been assigned to the default one, +but missed to mark the local control variable, dflt, true. Then, this +might let some 6 GHz power info of disconnected APs keep being taken +into account under certain cases. + +So, mark default when inactive. + +Signed-off-by: Zong-Zhe Yang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20251229030926.27004-12-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/regd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/regd.c b/drivers/net/wireless/realtek/rtw89/regd.c +index 58582f8d2b74c..8211d1277699c 100644 +--- a/drivers/net/wireless/realtek/rtw89/regd.c ++++ b/drivers/net/wireless/realtek/rtw89/regd.c +@@ -1142,6 +1142,7 @@ static int rtw89_reg_6ghz_power_recalc(struct rtw89_dev *rtwdev, + } + } else { + rtwvif_link->reg_6ghz_power = RTW89_REG_6GHZ_POWER_DFLT; ++ dflt = true; + } + + rcu_read_unlock(); +-- +2.51.0 + diff --git a/queue-6.18/wifi-rtw89-ser-enable-error-imr-after-recovering-fro.patch b/queue-6.18/wifi-rtw89-ser-enable-error-imr-after-recovering-fro.patch new file mode 100644 index 00000000000..5a0aa0f2444 --- /dev/null +++ b/queue-6.18/wifi-rtw89-ser-enable-error-imr-after-recovering-fro.patch @@ -0,0 +1,90 @@ +From ddac1aedc601f6a68d4ff3fe3c7255eacdf572b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Dec 2025 11:06:44 +0800 +Subject: wifi: rtw89: ser: enable error IMR after recovering from L1 + +From: Zong-Zhe Yang + +[ Upstream commit f4de946bdb379f543e3a599f8f048d741ad4a58e ] + +After recovering from L1, explicitly enable error IMR to ensure next +L1 SER (system error recovery) can work normally. + +Signed-off-by: Zong-Zhe Yang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20251223030651.480633-6-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/mac.c | 1 + + drivers/net/wireless/realtek/rtw89/mac.h | 1 + + drivers/net/wireless/realtek/rtw89/mac_be.c | 1 + + drivers/net/wireless/realtek/rtw89/ser.c | 10 ++++++++++ + 4 files changed, 13 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c +index fd11b8fb3c899..2de75d22c97f2 100644 +--- a/drivers/net/wireless/realtek/rtw89/mac.c ++++ b/drivers/net/wireless/realtek/rtw89/mac.c +@@ -7016,6 +7016,7 @@ const struct rtw89_mac_gen_def rtw89_mac_gen_ax = { + .check_mac_en = rtw89_mac_check_mac_en_ax, + .sys_init = sys_init_ax, + .trx_init = trx_init_ax, ++ .err_imr_ctrl = err_imr_ctrl_ax, + .hci_func_en = rtw89_mac_hci_func_en_ax, + .dmac_func_pre_en = rtw89_mac_dmac_func_pre_en_ax, + .dle_func_en = dle_func_en_ax, +diff --git a/drivers/net/wireless/realtek/rtw89/mac.h b/drivers/net/wireless/realtek/rtw89/mac.h +index 25fe5e5c8a979..51e37c183a35e 100644 +--- a/drivers/net/wireless/realtek/rtw89/mac.h ++++ b/drivers/net/wireless/realtek/rtw89/mac.h +@@ -999,6 +999,7 @@ struct rtw89_mac_gen_def { + enum rtw89_mac_hwmod_sel sel); + int (*sys_init)(struct rtw89_dev *rtwdev); + int (*trx_init)(struct rtw89_dev *rtwdev); ++ void (*err_imr_ctrl)(struct rtw89_dev *rtwdev, bool en); + void (*hci_func_en)(struct rtw89_dev *rtwdev); + void (*dmac_func_pre_en)(struct rtw89_dev *rtwdev); + void (*dle_func_en)(struct rtw89_dev *rtwdev, bool enable); +diff --git a/drivers/net/wireless/realtek/rtw89/mac_be.c b/drivers/net/wireless/realtek/rtw89/mac_be.c +index ef69672b6862e..e33297220f8b5 100644 +--- a/drivers/net/wireless/realtek/rtw89/mac_be.c ++++ b/drivers/net/wireless/realtek/rtw89/mac_be.c +@@ -2594,6 +2594,7 @@ const struct rtw89_mac_gen_def rtw89_mac_gen_be = { + .check_mac_en = rtw89_mac_check_mac_en_be, + .sys_init = sys_init_be, + .trx_init = trx_init_be, ++ .err_imr_ctrl = err_imr_ctrl_be, + .hci_func_en = rtw89_mac_hci_func_en_be, + .dmac_func_pre_en = rtw89_mac_dmac_func_pre_en_be, + .dle_func_en = dle_func_en_be, +diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c +index f99e179f7ff9f..7fdc69578da31 100644 +--- a/drivers/net/wireless/realtek/rtw89/ser.c ++++ b/drivers/net/wireless/realtek/rtw89/ser.c +@@ -431,6 +431,14 @@ static void hal_send_m4_event(struct rtw89_ser *ser) + rtw89_mac_set_err_status(rtwdev, MAC_AX_ERR_L1_RCVY_EN); + } + ++static void hal_enable_err_imr(struct rtw89_ser *ser) ++{ ++ struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser); ++ const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def; ++ ++ mac->err_imr_ctrl(rtwdev, true); ++} ++ + /* state handler */ + static void ser_idle_st_hdl(struct rtw89_ser *ser, u8 evt) + { +@@ -552,6 +560,8 @@ static void ser_do_hci_st_hdl(struct rtw89_ser *ser, u8 evt) + break; + + case SER_EV_MAC_RESET_DONE: ++ hal_enable_err_imr(ser); ++ + ser_state_goto(ser, SER_IDLE_ST); + break; + +-- +2.51.0 + diff --git a/queue-6.18/wifi-rtw89-setting-tbtt-agg-number-when-mac-port-ini.patch b/queue-6.18/wifi-rtw89-setting-tbtt-agg-number-when-mac-port-ini.patch new file mode 100644 index 00000000000..f5791aaa217 --- /dev/null +++ b/queue-6.18/wifi-rtw89-setting-tbtt-agg-number-when-mac-port-ini.patch @@ -0,0 +1,63 @@ +From 8252eb0a1d7a5bf78e3d75d196a336d5677786aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Dec 2025 11:06:50 +0800 +Subject: wifi: rtw89: setting TBTT AGG number when mac port initialization + +From: Chih-Kang Chang + +[ Upstream commit 5e5f83fba48381098b26a8b2513a6d5fc5c66ccb ] + +When initializing mac port, needs to set TBTT AGG number to trigger TBTT +related interrupts. Otherwise, after sending join info H2C command with +disconnection mode, firmware will clear TBTT AGG number. Without the +setting from mac port initialization after that, this port will not be +able to transmit beacons. + +Signed-off-by: Chih-Kang Chang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20251223030651.480633-12-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/mac.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c +index 2de75d22c97f2..df429bdef7956 100644 +--- a/drivers/net/wireless/realtek/rtw89/mac.c ++++ b/drivers/net/wireless/realtek/rtw89/mac.c +@@ -4262,6 +4262,7 @@ static void rtw89_mac_bcn_drop(struct rtw89_dev *rtwdev, + #define BCN_HOLD_DEF 200 + #define BCN_MASK_DEF 0 + #define TBTT_ERLY_DEF 5 ++#define TBTT_AGG_DEF 1 + #define BCN_SET_UNIT 32 + #define BCN_ERLY_SET_DLY (10 * 2) + +@@ -4565,6 +4566,16 @@ static void rtw89_mac_port_cfg_tbtt_early(struct rtw89_dev *rtwdev, + B_AX_TBTTERLY_MASK, TBTT_ERLY_DEF); + } + ++static void rtw89_mac_port_cfg_tbtt_agg(struct rtw89_dev *rtwdev, ++ struct rtw89_vif_link *rtwvif_link) ++{ ++ const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def; ++ const struct rtw89_port_reg *p = mac->port_base; ++ ++ rtw89_write16_port_mask(rtwdev, rtwvif_link, p->tbtt_agg, ++ B_AX_TBTT_AGG_NUM_MASK, TBTT_AGG_DEF); ++} ++ + static void rtw89_mac_port_cfg_bss_color(struct rtw89_dev *rtwdev, + struct rtw89_vif_link *rtwvif_link) + { +@@ -4825,6 +4836,7 @@ int rtw89_mac_port_update(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvi + rtw89_mac_port_cfg_bcn_hold_time(rtwdev, rtwvif_link); + rtw89_mac_port_cfg_bcn_mask_area(rtwdev, rtwvif_link); + rtw89_mac_port_cfg_tbtt_early(rtwdev, rtwvif_link); ++ rtw89_mac_port_cfg_tbtt_agg(rtwdev, rtwvif_link); + rtw89_mac_port_cfg_bss_color(rtwdev, rtwvif_link); + rtw89_mac_port_cfg_mbssid(rtwdev, rtwvif_link); + rtw89_mac_port_cfg_func_en(rtwdev, rtwvif_link, true); +-- +2.51.0 + diff --git a/queue-6.18/wifi-rtw89-wow-add-reason-codes-for-disassociation-i.patch b/queue-6.18/wifi-rtw89-wow-add-reason-codes-for-disassociation-i.patch new file mode 100644 index 00000000000..cff78fec107 --- /dev/null +++ b/queue-6.18/wifi-rtw89-wow-add-reason-codes-for-disassociation-i.patch @@ -0,0 +1,53 @@ +From ab4987f7ae13fa2d1818b23c500ef547f6adb93d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 10:20:13 +0800 +Subject: wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode + +From: Chin-Yen Lee + +[ Upstream commit 2fd8f953f25173d14981d8736b6f5bfcd757e51b ] + +Some APs disconnect clients by sending a Disassociation frame +rather than a Deauthentication frame. Since these frames use +different reason codes in WoWLAN mode, this commit adds support +for handling Disassociation to prevent missed disconnection events. + +Signed-off-by: Chin-Yen Lee +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260110022019.2254969-3-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/wow.c | 4 ++++ + drivers/net/wireless/realtek/rtw89/wow.h | 1 + + 2 files changed, 5 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/wow.c b/drivers/net/wireless/realtek/rtw89/wow.c +index 5faa51ad896a2..f34cd863d1009 100644 +--- a/drivers/net/wireless/realtek/rtw89/wow.c ++++ b/drivers/net/wireless/realtek/rtw89/wow.c +@@ -809,6 +809,10 @@ static void rtw89_wow_show_wakeup_reason(struct rtw89_dev *rtwdev) + + reason = rtw89_read8(rtwdev, wow_reason_reg); + switch (reason) { ++ case RTW89_WOW_RSN_RX_DISASSOC: ++ wakeup.disconnect = true; ++ rtw89_debug(rtwdev, RTW89_DBG_WOW, "WOW: Rx disassoc\n"); ++ break; + case RTW89_WOW_RSN_RX_DEAUTH: + wakeup.disconnect = true; + rtw89_debug(rtwdev, RTW89_DBG_WOW, "WOW: Rx deauth\n"); +diff --git a/drivers/net/wireless/realtek/rtw89/wow.h b/drivers/net/wireless/realtek/rtw89/wow.h +index d2ba6cebc2a6b..71e07f482174f 100644 +--- a/drivers/net/wireless/realtek/rtw89/wow.h ++++ b/drivers/net/wireless/realtek/rtw89/wow.h +@@ -33,6 +33,7 @@ + enum rtw89_wake_reason { + RTW89_WOW_RSN_RX_PTK_REKEY = 0x1, + RTW89_WOW_RSN_RX_GTK_REKEY = 0x2, ++ RTW89_WOW_RSN_RX_DISASSOC = 0x4, + RTW89_WOW_RSN_RX_DEAUTH = 0x8, + RTW89_WOW_RSN_DISCONNECT = 0x10, + RTW89_WOW_RSN_RX_MAGIC_PKT = 0x21, +-- +2.51.0 + diff --git a/queue-6.18/x86-sev-use-kfree_sensitive-when-freeing-a-snp-messa.patch b/queue-6.18/x86-sev-use-kfree_sensitive-when-freeing-a-snp-messa.patch new file mode 100644 index 00000000000..ce16fb01c6f --- /dev/null +++ b/queue-6.18/x86-sev-use-kfree_sensitive-when-freeing-a-snp-messa.patch @@ -0,0 +1,39 @@ +From 35b7ce25cb5946cdae7a657abf5d8c5bc71fe3a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 12:37:49 +0100 +Subject: x86/sev: Use kfree_sensitive() when freeing a SNP message descriptor + +From: Borislav Petkov (AMD) + +[ Upstream commit af05e558988ed004a20fc4de7d0f80cfbba663f0 ] + +Use the proper helper instead of an open-coded variant. + +Closes: https://lore.kernel.org/r/202512202235.WHPQkLZu-lkp@intel.com +Reported-by: kernel test robot +Reported-by: Julia Lawall +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Tom Lendacky +Link: https://patch.msgid.link/20260112114147.GBaWTd-8HSy_Xp4S3X@fat_crate.local +Signed-off-by: Sasha Levin +--- + arch/x86/coco/sev/core.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/x86/coco/sev/core.c b/arch/x86/coco/sev/core.c +index 9ae3b11754e65..c8ddb9febe3d9 100644 +--- a/arch/x86/coco/sev/core.c ++++ b/arch/x86/coco/sev/core.c +@@ -2008,8 +2008,7 @@ void snp_msg_free(struct snp_msg_desc *mdesc) + free_shared_pages(mdesc->request, sizeof(struct snp_guest_msg)); + iounmap((__force void __iomem *)mdesc->secrets); + +- memset(mdesc, 0, sizeof(*mdesc)); +- kfree(mdesc); ++ kfree_sensitive(mdesc); + } + EXPORT_SYMBOL_GPL(snp_msg_free); + +-- +2.51.0 + diff --git a/queue-6.18/x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch b/queue-6.18/x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch new file mode 100644 index 00000000000..454f3bf0b82 --- /dev/null +++ b/queue-6.18/x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch @@ -0,0 +1,46 @@ +From fe178be6b913bbb8e43707f8fd7ff021cc6c2f3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 12:00:08 +0800 +Subject: x86/xen/pvh: Enable PAE mode for 32-bit guest only when + CONFIG_X86_PAE is set + +From: Hou Wenlong + +[ Upstream commit db9aded979b491a24871e1621cd4e8822dbca859 ] + +The PVH entry is available for 32-bit KVM guests, and 32-bit KVM guests +do not depend on CONFIG_X86_PAE. However, mk_early_pgtbl_32() builds +different pagetables depending on whether CONFIG_X86_PAE is set. +Therefore, enabling PAE mode for 32-bit KVM guests without +CONFIG_X86_PAE being set would result in a boot failure during CR3 +loading. + +Signed-off-by: Hou Wenlong +Reviewed-by: Juergen Gross +Signed-off-by: Juergen Gross +Message-ID: +Signed-off-by: Sasha Levin +--- + arch/x86/platform/pvh/head.S | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/x86/platform/pvh/head.S b/arch/x86/platform/pvh/head.S +index 344030c1a81d4..53ee2d53fcf8e 100644 +--- a/arch/x86/platform/pvh/head.S ++++ b/arch/x86/platform/pvh/head.S +@@ -91,10 +91,12 @@ SYM_CODE_START(pvh_start_xen) + + leal rva(early_stack_end)(%ebp), %esp + ++#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE) + /* Enable PAE mode. */ + mov %cr4, %eax + orl $X86_CR4_PAE, %eax + mov %eax, %cr4 ++#endif + + #ifdef CONFIG_X86_64 + /* Enable Long mode. */ +-- +2.51.0 + diff --git a/queue-6.18/xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch b/queue-6.18/xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch new file mode 100644 index 00000000000..16e2cd362dd --- /dev/null +++ b/queue-6.18/xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch @@ -0,0 +1,61 @@ +From 97c86784261b33879baac8e61d9f486eaf1cdf89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 17:47:29 -0500 +Subject: xenbus: Use .freeze/.thaw to handle xenbus devices + +From: Jason Andryuk + +[ Upstream commit e08dd1ee49838750a514e83c0aa60cd12ba6ecbb ] + +The goal is to fix s2idle and S3 for Xen PV devices. A domain resuming +from s3 or s2idle disconnects its PV devices during resume. The +backends are not expecting this and do not reconnect. + +b3e96c0c7562 ("xen: use freeze/restore/thaw PM events for suspend/ +resume/chkpt") changed xen_suspend()/do_suspend() from +PMSG_SUSPEND/PMSG_RESUME to PMSG_FREEZE/PMSG_THAW/PMSG_RESTORE, but the +suspend/resume callbacks remained. + +.freeze/restore are used with hiberation where Linux restarts in a new +place in the future. .suspend/resume are useful for runtime power +management for the duration of a boot. + +The current behavior of the callbacks works for an xl save/restore or +live migration where the domain is restored/migrated to a new location +and connecting to a not-already-connected backend. + +Change xenbus_pm_ops to use .freeze/thaw/restore and drop the +.suspend/resume hook. This matches the use in drivers/xen/manage.c for +save/restore and live migration. With .suspend/resume empty, PV devices +are left connected during s2idle and s3, so PV devices are not changed +and work after resume. + +Signed-off-by: Jason Andryuk +Acked-by: Juergen Gross +Signed-off-by: Juergen Gross +Message-ID: <20251119224731.61497-2-jason.andryuk@amd.com> +Signed-off-by: Sasha Levin +--- + drivers/xen/xenbus/xenbus_probe_frontend.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c +index 6d1819269cbe5..199917b6f77ca 100644 +--- a/drivers/xen/xenbus/xenbus_probe_frontend.c ++++ b/drivers/xen/xenbus/xenbus_probe_frontend.c +@@ -148,11 +148,9 @@ static void xenbus_frontend_dev_shutdown(struct device *_dev) + } + + static const struct dev_pm_ops xenbus_pm_ops = { +- .suspend = xenbus_dev_suspend, +- .resume = xenbus_frontend_dev_resume, + .freeze = xenbus_dev_suspend, + .thaw = xenbus_dev_cancel, +- .restore = xenbus_dev_resume, ++ .restore = xenbus_frontend_dev_resume, + }; + + static struct xen_bus_type xenbus_frontend = { +-- +2.51.0 + diff --git a/queue-6.19/9p-xen-protect-xen_9pfs_front_free-against-concurren.patch b/queue-6.19/9p-xen-protect-xen_9pfs_front_free-against-concurren.patch new file mode 100644 index 00000000000..6e6ad46d925 --- /dev/null +++ b/queue-6.19/9p-xen-protect-xen_9pfs_front_free-against-concurren.patch @@ -0,0 +1,194 @@ +From 2cd6f8d04f75e71b1acdd15fab8ee1f0a1dd27d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jan 2026 15:03:48 -0800 +Subject: 9p/xen: protect xen_9pfs_front_free against concurrent calls + +From: Stefano Stabellini + +[ Upstream commit ce8ded2e61f47747e31eeefb44dc24a2160a7e32 ] + +The xenwatch thread can race with other back-end change notifications +and call xen_9pfs_front_free() twice, hitting the observed general +protection fault due to a double-free. Guard the teardown path so only +one caller can release the front-end state at a time, preventing the +crash. + +This is a fix for the following double-free: + +[ 27.052347] Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI +[ 27.052357] CPU: 0 UID: 0 PID: 32 Comm: xenwatch Not tainted 6.18.0-02087-g51ab33fc0a8b-dirty #60 PREEMPT(none) +[ 27.052363] RIP: e030:xen_9pfs_front_free+0x1d/0x150 +[ 27.052368] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 41 55 41 54 55 48 89 fd 48 c7 c7 48 d0 92 85 53 e8 cb cb 05 00 48 8b 45 08 48 8b 55 00 <48> 3b 28 0f 85 f9 28 35 fe 48 3b 6a 08 0f 85 ef 28 35 fe 48 89 42 +[ 27.052377] RSP: e02b:ffffc9004016fdd0 EFLAGS: 00010246 +[ 27.052381] RAX: 6b6b6b6b6b6b6b6b RBX: ffff88800d66e400 RCX: 0000000000000000 +[ 27.052385] RDX: 6b6b6b6b6b6b6b6b RSI: 0000000000000000 RDI: 0000000000000000 +[ 27.052389] RBP: ffff88800a887040 R08: 0000000000000000 R09: 0000000000000000 +[ 27.052393] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888009e46b68 +[ 27.052397] R13: 0000000000000200 R14: 0000000000000000 R15: ffff88800a887040 +[ 27.052404] FS: 0000000000000000(0000) GS:ffff88808ca57000(0000) knlGS:0000000000000000 +[ 27.052408] CS: e030 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 27.052412] CR2: 00007f9714004360 CR3: 0000000004834000 CR4: 0000000000050660 +[ 27.052418] Call Trace: +[ 27.052420] +[ 27.052422] xen_9pfs_front_changed+0x5d5/0x720 +[ 27.052426] ? xenbus_otherend_changed+0x72/0x140 +[ 27.052430] ? __pfx_xenwatch_thread+0x10/0x10 +[ 27.052434] xenwatch_thread+0x94/0x1c0 +[ 27.052438] ? __pfx_autoremove_wake_function+0x10/0x10 +[ 27.052442] kthread+0xf8/0x240 +[ 27.052445] ? __pfx_kthread+0x10/0x10 +[ 27.052449] ? __pfx_kthread+0x10/0x10 +[ 27.052452] ret_from_fork+0x16b/0x1a0 +[ 27.052456] ? __pfx_kthread+0x10/0x10 +[ 27.052459] ret_from_fork_asm+0x1a/0x30 +[ 27.052463] +[ 27.052465] Modules linked in: +[ 27.052471] ---[ end trace 0000000000000000 ]--- + +Signed-off-by: Stefano Stabellini +Message-ID: <20260129230348.2390470-1-stefano.stabellini@amd.com> +Signed-off-by: Dominique Martinet +Signed-off-by: Sasha Levin +--- + net/9p/trans_xen.c | 85 ++++++++++++++++++++++++---------------------- + 1 file changed, 44 insertions(+), 41 deletions(-) + +diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c +index 12f752a923324..9bbfc20744f69 100644 +--- a/net/9p/trans_xen.c ++++ b/net/9p/trans_xen.c +@@ -277,45 +277,52 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv) + { + int i, j; + +- write_lock(&xen_9pfs_lock); +- list_del(&priv->list); +- write_unlock(&xen_9pfs_lock); +- +- for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) { +- struct xen_9pfs_dataring *ring = &priv->rings[i]; +- +- cancel_work_sync(&ring->work); +- +- if (!priv->rings[i].intf) +- break; +- if (priv->rings[i].irq > 0) +- unbind_from_irqhandler(priv->rings[i].irq, ring); +- if (priv->rings[i].data.in) { +- for (j = 0; +- j < (1 << priv->rings[i].intf->ring_order); +- j++) { +- grant_ref_t ref; +- +- ref = priv->rings[i].intf->ref[j]; +- gnttab_end_foreign_access(ref, NULL); +- } +- free_pages_exact(priv->rings[i].data.in, ++ if (priv->rings) { ++ for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) { ++ struct xen_9pfs_dataring *ring = &priv->rings[i]; ++ ++ cancel_work_sync(&ring->work); ++ ++ if (!priv->rings[i].intf) ++ break; ++ if (priv->rings[i].irq > 0) ++ unbind_from_irqhandler(priv->rings[i].irq, ring); ++ if (priv->rings[i].data.in) { ++ for (j = 0; ++ j < (1 << priv->rings[i].intf->ring_order); ++ j++) { ++ grant_ref_t ref; ++ ++ ref = priv->rings[i].intf->ref[j]; ++ gnttab_end_foreign_access(ref, NULL); ++ } ++ free_pages_exact(priv->rings[i].data.in, + 1UL << (priv->rings[i].intf->ring_order + + XEN_PAGE_SHIFT)); ++ } ++ gnttab_end_foreign_access(priv->rings[i].ref, NULL); ++ free_page((unsigned long)priv->rings[i].intf); + } +- gnttab_end_foreign_access(priv->rings[i].ref, NULL); +- free_page((unsigned long)priv->rings[i].intf); ++ kfree(priv->rings); + } +- kfree(priv->rings); + kfree(priv->tag); + kfree(priv); + } + + static void xen_9pfs_front_remove(struct xenbus_device *dev) + { +- struct xen_9pfs_front_priv *priv = dev_get_drvdata(&dev->dev); ++ struct xen_9pfs_front_priv *priv; + ++ write_lock(&xen_9pfs_lock); ++ priv = dev_get_drvdata(&dev->dev); ++ if (priv == NULL) { ++ write_unlock(&xen_9pfs_lock); ++ return; ++ } + dev_set_drvdata(&dev->dev, NULL); ++ list_del(&priv->list); ++ write_unlock(&xen_9pfs_lock); ++ + xen_9pfs_front_free(priv); + } + +@@ -382,7 +389,7 @@ static int xen_9pfs_front_init(struct xenbus_device *dev) + { + int ret, i; + struct xenbus_transaction xbt; +- struct xen_9pfs_front_priv *priv = dev_get_drvdata(&dev->dev); ++ struct xen_9pfs_front_priv *priv; + char *versions, *v; + unsigned int max_rings, max_ring_order, len = 0; + +@@ -410,6 +417,10 @@ static int xen_9pfs_front_init(struct xenbus_device *dev) + if (p9_xen_trans.maxsize > XEN_FLEX_RING_SIZE(max_ring_order)) + p9_xen_trans.maxsize = XEN_FLEX_RING_SIZE(max_ring_order) / 2; + ++ priv = kzalloc(sizeof(*priv), GFP_KERNEL); ++ if (!priv) ++ return -ENOMEM; ++ priv->dev = dev; + priv->rings = kcalloc(XEN_9PFS_NUM_RINGS, sizeof(*priv->rings), + GFP_KERNEL); + if (!priv->rings) { +@@ -468,6 +479,11 @@ static int xen_9pfs_front_init(struct xenbus_device *dev) + goto error; + } + ++ write_lock(&xen_9pfs_lock); ++ dev_set_drvdata(&dev->dev, priv); ++ list_add_tail(&priv->list, &xen_9pfs_devs); ++ write_unlock(&xen_9pfs_lock); ++ + xenbus_switch_state(dev, XenbusStateInitialised); + return 0; + +@@ -482,19 +498,6 @@ static int xen_9pfs_front_init(struct xenbus_device *dev) + static int xen_9pfs_front_probe(struct xenbus_device *dev, + const struct xenbus_device_id *id) + { +- struct xen_9pfs_front_priv *priv = NULL; +- +- priv = kzalloc(sizeof(*priv), GFP_KERNEL); +- if (!priv) +- return -ENOMEM; +- +- priv->dev = dev; +- dev_set_drvdata(&dev->dev, priv); +- +- write_lock(&xen_9pfs_lock); +- list_add_tail(&priv->list, &xen_9pfs_devs); +- write_unlock(&xen_9pfs_lock); +- + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.19/accel-amdxdna-fix-tail-pointer-polling-in-mailbox_ge.patch b/queue-6.19/accel-amdxdna-fix-tail-pointer-polling-in-mailbox_ge.patch new file mode 100644 index 00000000000..bf827247472 --- /dev/null +++ b/queue-6.19/accel-amdxdna-fix-tail-pointer-polling-in-mailbox_ge.patch @@ -0,0 +1,63 @@ +From 2f1669002b279500dd8fc65c9e3fb9d066e01c5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Dec 2025 10:16:03 -0800 +Subject: accel/amdxdna: Fix tail-pointer polling in mailbox_get_msg() + +From: Lizhi Hou + +[ Upstream commit cd77d5a4aaf8c5c1d819f47cf814bf7d4920b0a2 ] + +In mailbox_get_msg(), mailbox_reg_read_non_zero() is called to poll for a +non-zero tail pointer. This assumed that a zero value indicates an error. +However, certain corner cases legitimately produce a zero tail pointer. +To handle these cases, remove mailbox_reg_read_non_zero(). The zero tail +pointer will be treated as a valid rewind event. + +Reviewed-by: Maciej Falkowski +Signed-off-by: Lizhi Hou +Link: https://patch.msgid.link/20251204181603.793824-1-lizhi.hou@amd.com +Signed-off-by: Sasha Levin +--- + drivers/accel/amdxdna/amdxdna_mailbox.c | 19 +------------------ + 1 file changed, 1 insertion(+), 18 deletions(-) + +diff --git a/drivers/accel/amdxdna/amdxdna_mailbox.c b/drivers/accel/amdxdna/amdxdna_mailbox.c +index 8b72cf6bd6e4d..469242ed82246 100644 +--- a/drivers/accel/amdxdna/amdxdna_mailbox.c ++++ b/drivers/accel/amdxdna/amdxdna_mailbox.c +@@ -112,22 +112,6 @@ static u32 mailbox_reg_read(struct mailbox_channel *mb_chann, u32 mbox_reg) + return readl(ringbuf_addr); + } + +-static int mailbox_reg_read_non_zero(struct mailbox_channel *mb_chann, u32 mbox_reg, u32 *val) +-{ +- struct xdna_mailbox_res *mb_res = &mb_chann->mb->res; +- void __iomem *ringbuf_addr = mb_res->mbox_base + mbox_reg; +- int ret, value; +- +- /* Poll till value is not zero */ +- ret = readx_poll_timeout(readl, ringbuf_addr, value, +- value, 1 /* us */, 100); +- if (ret < 0) +- return ret; +- +- *val = value; +- return 0; +-} +- + static inline void + mailbox_set_headptr(struct mailbox_channel *mb_chann, u32 headptr_val) + { +@@ -291,8 +275,7 @@ static int mailbox_get_msg(struct mailbox_channel *mb_chann) + u32 start_addr; + int ret; + +- if (mailbox_reg_read_non_zero(mb_chann, mb_chann->res[CHAN_RES_I2X].mb_tail_ptr_reg, &tail)) +- return -EINVAL; ++ tail = mailbox_get_tailptr(mb_chann, CHAN_RES_I2X); + head = mb_chann->i2x_head; + ringbuf_size = mailbox_get_ringbuf_size(mb_chann, CHAN_RES_I2X); + start_addr = mb_chann->res[CHAN_RES_I2X].rb_start_addr; +-- +2.51.0 + diff --git a/queue-6.19/acpi-battery-fix-incorrect-charging-status-when-curr.patch b/queue-6.19/acpi-battery-fix-incorrect-charging-status-when-curr.patch new file mode 100644 index 00000000000..a22fa01b55c --- /dev/null +++ b/queue-6.19/acpi-battery-fix-incorrect-charging-status-when-curr.patch @@ -0,0 +1,57 @@ +From c9c7c440a376c08e7c341abca84c5c8cdd12fb56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jan 2026 17:48:56 +0300 +Subject: ACPI: battery: fix incorrect charging status when current is zero +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ata Ä°lhan Köktürk + +[ Upstream commit bb1256e0ddc7e9e406164319769b9f8d8389f056 ] + +On some laptops, such as the Huawei Matebook series, the embedded +controller continues to report "Charging" status even when the +charge threshold is reached and no current is being drawn. + +This incorrect reporting prevents the system from switching to battery +power profiles, leading to significantly higher power (e.g., 18W instead +of 7W during browsing) and missed remaining battery time estimation. + +Validate the "Charging" state by checking if rate_now is zero. If the +hardware reports charging but the current is zero, report "Not Charging" +to user space. + +Signed-off-by: Ata Ä°lhan Köktürk +[ rjw: Whitespace fix, braces added to an inner if (), new comment rewrite ] +[ rjw: Changelog edits ] +Link: https://patch.msgid.link/20260129144856.43058-1-atailhan2006@gmail.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/battery.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c +index 34181fa52e937..4b28ef79e6ac8 100644 +--- a/drivers/acpi/battery.c ++++ b/drivers/acpi/battery.c +@@ -211,7 +211,14 @@ static int acpi_battery_get_property(struct power_supply *psy, + if (battery->state & ACPI_BATTERY_STATE_DISCHARGING) + val->intval = acpi_battery_handle_discharging(battery); + else if (battery->state & ACPI_BATTERY_STATE_CHARGING) +- val->intval = POWER_SUPPLY_STATUS_CHARGING; ++ /* Validate the status by checking the current. */ ++ if (battery->rate_now != ACPI_BATTERY_VALUE_UNKNOWN && ++ battery->rate_now == 0) { ++ /* On charge but no current (0W/0mA). */ ++ val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING; ++ } else { ++ val->intval = POWER_SUPPLY_STATUS_CHARGING; ++ } + else if (battery->state & ACPI_BATTERY_STATE_CHARGE_LIMITING) + val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING; + else if (acpi_battery_is_charged(battery)) +-- +2.51.0 + diff --git a/queue-6.19/acpi-processor-fix-null-pointer-dereference-in-acpi_.patch b/queue-6.19/acpi-processor-fix-null-pointer-dereference-in-acpi_.patch new file mode 100644 index 00000000000..5ce9649b572 --- /dev/null +++ b/queue-6.19/acpi-processor-fix-null-pointer-dereference-in-acpi_.patch @@ -0,0 +1,101 @@ +From 3c6d96536800ce77f300eacbe93341766dbc76a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 00:32:14 +0800 +Subject: ACPI: processor: Fix NULL-pointer dereference in + acpi_processor_errata_piix4() + +From: Tuo Li + +[ Upstream commit f132e089fe89cadc2098991f0a3cb05c3f824ac6 ] + +In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE +device and then reassigned an ISA device: + + dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...); + dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...); + +If the first lookup succeeds but the second fails, dev becomes NULL. This +leads to a potential null-pointer dereference when dev_dbg() is called: + + if (errata.piix4.bmisx) + dev_dbg(&dev->dev, ...); + +To prevent this, use two temporary pointers and retrieve each device +independently, avoiding overwriting dev with a possible NULL value. + +Signed-off-by: Tuo Li +[ rjw: Subject adjustment, added an empty code line ] +Link: https://patch.msgid.link/20260111163214.202262-1-islituo@gmail.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpi_processor.c | 28 +++++++++++++++------------- + 1 file changed, 15 insertions(+), 13 deletions(-) + +diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c +index 7ec1dc04fd11b..85096ce7b658b 100644 +--- a/drivers/acpi/acpi_processor.c ++++ b/drivers/acpi/acpi_processor.c +@@ -50,6 +50,7 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev) + { + u8 value1 = 0; + u8 value2 = 0; ++ struct pci_dev *ide_dev = NULL, *isa_dev = NULL; + + + if (!dev) +@@ -107,12 +108,12 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev) + * each IDE controller's DMA status to make sure we catch all + * DMA activity. + */ +- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, ++ ide_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, + PCI_DEVICE_ID_INTEL_82371AB, + PCI_ANY_ID, PCI_ANY_ID, NULL); +- if (dev) { +- errata.piix4.bmisx = pci_resource_start(dev, 4); +- pci_dev_put(dev); ++ if (ide_dev) { ++ errata.piix4.bmisx = pci_resource_start(ide_dev, 4); ++ pci_dev_put(ide_dev); + } + + /* +@@ -124,24 +125,25 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev) + * disable C3 support if this is enabled, as some legacy + * devices won't operate well if fast DMA is disabled. + */ +- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, ++ isa_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, + PCI_DEVICE_ID_INTEL_82371AB_0, + PCI_ANY_ID, PCI_ANY_ID, NULL); +- if (dev) { +- pci_read_config_byte(dev, 0x76, &value1); +- pci_read_config_byte(dev, 0x77, &value2); ++ if (isa_dev) { ++ pci_read_config_byte(isa_dev, 0x76, &value1); ++ pci_read_config_byte(isa_dev, 0x77, &value2); + if ((value1 & 0x80) || (value2 & 0x80)) + errata.piix4.fdma = 1; +- pci_dev_put(dev); ++ pci_dev_put(isa_dev); + } + + break; + } + +- if (errata.piix4.bmisx) +- dev_dbg(&dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n"); +- if (errata.piix4.fdma) +- dev_dbg(&dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n"); ++ if (ide_dev) ++ dev_dbg(&ide_dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n"); ++ ++ if (isa_dev) ++ dev_dbg(&isa_dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n"); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.19/acpi-resource-add-jwipc-jvc9100-to-irq1_level_low_sk.patch b/queue-6.19/acpi-resource-add-jwipc-jvc9100-to-irq1_level_low_sk.patch new file mode 100644 index 00000000000..5989e1d6e28 --- /dev/null +++ b/queue-6.19/acpi-resource-add-jwipc-jvc9100-to-irq1_level_low_sk.patch @@ -0,0 +1,56 @@ +From 9fd925309bda23a11ba7b2d0220f7a81a03d700a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 15:27:19 +0800 +Subject: ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] + +From: Ai Chao + +[ Upstream commit ba6ded26dffe511b862a98a25955955e7154bfa8 ] + +Like the JWIPC JVC9100 has its serial IRQ (10 and 11) described +as ActiveLow in the DSDT, which the kernel overrides to EdgeHigh which +breaks the serial. + +irq 10, level, active-low, shared, skip-override +irq 11, level, active-low, shared, skip-override + +Add the JVC9100 to the irq1_level_low_skip_override[] quirk table to fix +this. + +Signed-off-by: Ai Chao +Link: https://patch.msgid.link/20260113072719.4154485-1-aichao@kylinos.cn +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/resource.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c +index d16906f46484d..bc8050d8a6f51 100644 +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -532,6 +532,12 @@ static const struct dmi_system_id irq1_level_low_skip_override[] = { + DMI_MATCH(DMI_BOARD_NAME, "16T90SP"), + }, + }, ++ { ++ /* JWIPC JVC9100 */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "JVC9100"), ++ }, ++ }, + { } + }; + +@@ -706,6 +712,8 @@ struct irq_override_cmp { + + static const struct irq_override_cmp override_table[] = { + { irq1_level_low_skip_override, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, false }, ++ { irq1_level_low_skip_override, 10, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 1, false }, ++ { irq1_level_low_skip_override, 11, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 1, false }, + { irq1_edge_low_force_override, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, + }; + +-- +2.51.0 + diff --git a/queue-6.19/acpi-scan-use-async-schedule-function-in-acpi_scan_c.patch b/queue-6.19/acpi-scan-use-async-schedule-function-in-acpi_scan_c.patch new file mode 100644 index 00000000000..06f18b5384a --- /dev/null +++ b/queue-6.19/acpi-scan-use-async-schedule-function-in-acpi_scan_c.patch @@ -0,0 +1,138 @@ +From 8f527a55c5f40e15a553074a8f0aad24a5e0bc15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 21:28:47 +0800 +Subject: ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn() + +From: Yicong Yang + +[ Upstream commit 7cf28b3797a81b616bb7eb3e90cf131afc452919 ] + +The device object rescan in acpi_scan_clear_dep_fn() is scheduled on a +system workqueue which is not guaranteed to be finished before entering +userspace. This may cause some key devices to be missing when userspace +init task tries to find them. Two issues observed on RISCV platforms: + + - Kernel panic due to userspace init cannot have an opened + console. + + The console device scanning is queued by acpi_scan_clear_dep_queue() + and not finished by the time userspace init process running, thus by + the time userspace init runs, no console is present. + + - Entering rescue shell due to the lack of root devices (PCIe nvme in + our case). + + Same reason as above, the PCIe host bridge scanning is queued on + a system workqueue and finished after init process runs. + +The reason is because both devices (console, PCIe host bridge) depend on +riscv-aplic irqchip to serve their interrupts (console's wired interrupt +and PCI's INTx interrupts). In order to keep the dependency, these +devices are scanned and created after initializing riscv-aplic. The +riscv-aplic is initialized in device_initcall() and a device scan work +is queued via acpi_scan_clear_dep_queue(), which is close to the time +userspace init process is run. Since system_dfl_wq is used in +acpi_scan_clear_dep_queue() with no synchronization, the issues will +happen if userspace init runs before these devices are ready. + +The solution is to wait for the queued work to complete before entering +userspace init. One possible way would be to use a dedicated workqueue +instead of system_dfl_wq, and explicitly flush it somewhere in the +initcall stage before entering userspace. Another way is to use +async_schedule_dev_nocall() for scanning these devices. It's designed +for asynchronous initialization and will work in the same way as before +because it's using a dedicated unbound workqueue as well, but the kernel +init code calls async_synchronize_full() right before entering userspace +init which will wait for the work to complete. + +Compared to a dedicated workqueue, the second approach is simpler +because the async schedule framework takes care of all of the details. +The ACPI code only needs to focus on its job. A dedicated workqueue for +this could also be redundant because some platforms don't need +acpi_scan_clear_dep_queue() for their device scanning. + +Signed-off-by: Yicong Yang +[ rjw: Subject adjustment, changelog edits ] +Link: https://patch.msgid.link/20260128132848.93638-1-yang.yicong@picoheart.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/scan.c | 41 +++++++++++++++-------------------------- + 1 file changed, 15 insertions(+), 26 deletions(-) + +diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c +index 416d87f9bd107..b78f6be2f9468 100644 +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -5,6 +5,7 @@ + + #define pr_fmt(fmt) "ACPI: " fmt + ++#include + #include + #include + #include +@@ -2360,46 +2361,34 @@ static int acpi_dev_get_next_consumer_dev_cb(struct acpi_dep_data *dep, void *da + return 0; + } + +-struct acpi_scan_clear_dep_work { +- struct work_struct work; +- struct acpi_device *adev; +-}; +- +-static void acpi_scan_clear_dep_fn(struct work_struct *work) ++static void acpi_scan_clear_dep_fn(void *dev, async_cookie_t cookie) + { +- struct acpi_scan_clear_dep_work *cdw; +- +- cdw = container_of(work, struct acpi_scan_clear_dep_work, work); ++ struct acpi_device *adev = to_acpi_device(dev); + + acpi_scan_lock_acquire(); +- acpi_bus_attach(cdw->adev, (void *)true); ++ acpi_bus_attach(adev, (void *)true); + acpi_scan_lock_release(); + +- acpi_dev_put(cdw->adev); +- kfree(cdw); ++ acpi_dev_put(adev); + } + + static bool acpi_scan_clear_dep_queue(struct acpi_device *adev) + { +- struct acpi_scan_clear_dep_work *cdw; +- + if (adev->dep_unmet) + return false; + +- cdw = kmalloc(sizeof(*cdw), GFP_KERNEL); +- if (!cdw) +- return false; +- +- cdw->adev = adev; +- INIT_WORK(&cdw->work, acpi_scan_clear_dep_fn); + /* +- * Since the work function may block on the lock until the entire +- * initial enumeration of devices is complete, put it into the unbound +- * workqueue. ++ * Async schedule the deferred acpi_scan_clear_dep_fn() since: ++ * - acpi_bus_attach() needs to hold acpi_scan_lock which cannot ++ * be acquired under acpi_dep_list_lock (held here) ++ * - the deferred work at boot stage is ensured to be finished ++ * before userspace init task by the async_synchronize_full() ++ * barrier ++ * ++ * Use _nocall variant since it'll return on failure instead of ++ * run the function synchronously. + */ +- queue_work(system_dfl_wq, &cdw->work); +- +- return true; ++ return async_schedule_dev_nocall(acpi_scan_clear_dep_fn, &adev->dev); + } + + static void acpi_scan_delete_dep_data(struct acpi_dep_data *dep) +-- +2.51.0 + diff --git a/queue-6.19/acpi-x86-force-enabling-of-pwm2-on-the-yogabook-yb1-.patch b/queue-6.19/acpi-x86-force-enabling-of-pwm2-on-the-yogabook-yb1-.patch new file mode 100644 index 00000000000..081b612be57 --- /dev/null +++ b/queue-6.19/acpi-x86-force-enabling-of-pwm2-on-the-yogabook-yb1-.patch @@ -0,0 +1,48 @@ +From 1c1d35754384cd45c39272e3369f301ea52437c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Feb 2026 00:22:42 +0200 +Subject: ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 + +From: Yauhen Kharuzhy + +[ Upstream commit a8c975302868c716afef0f50467bebbd069a35b8 ] + +The PWM2 on YB1-X90 tablets is used for keyboard backlight control but +it is disabled in the ACPI DSDT table. Add it to the override_status_ids +list to allow keyboard function control driver +(drivers/platform/x86/lenovo/yogabook.c) to use it. + +Signed-off-by: Yauhen Kharuzhy +Link: https://patch.msgid.link/20260211222242.4101162-1-jekhor@gmail.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/x86/utils.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c +index 4ee30c2897a2b..418951639f511 100644 +--- a/drivers/acpi/x86/utils.c ++++ b/drivers/acpi/x86/utils.c +@@ -81,6 +81,18 @@ static const struct override_status_id override_status_ids[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "Mipad2"), + }), + ++ /* ++ * Lenovo Yoga Book uses PWM2 for touch keyboard backlight control. ++ * It needs to be enabled only for the Android device version (YB1-X90* ++ * aka YETI-11); the Windows version (YB1-X91*) uses ACPI control ++ * methods. ++ */ ++ PRESENT_ENTRY_HID("80862289", "2", INTEL_ATOM_AIRMONT, { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "CHERRYVIEW D1 PLATFORM"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "YETI-11"), ++ }), ++ + /* + * The INT0002 device is necessary to clear wakeup interrupt sources + * on Cherry Trail devices, without it we get nobody cared IRQ msgs. +-- +2.51.0 + diff --git a/queue-6.19/acpi-x86-s2idle-invoke-microsoft-_dsm-function-9-tur.patch b/queue-6.19/acpi-x86-s2idle-invoke-microsoft-_dsm-function-9-tur.patch new file mode 100644 index 00000000000..548d1b23e6e --- /dev/null +++ b/queue-6.19/acpi-x86-s2idle-invoke-microsoft-_dsm-function-9-tur.patch @@ -0,0 +1,80 @@ +From 8d0e0a1802339d27675fdda6a4039bd4481a595e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 21:01:21 +0100 +Subject: ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) + +From: Jakob Riemenschneider + +[ Upstream commit 229ecbaac6b31f89c554b77eb407377a5eade7d4 ] + +Windows 11, version 22H2 introduced a new function index (Function 9) to +the Microsoft LPS0 _DSM, titled "Turn On Display Notification". + +According to Microsoft documentation, this function signals to the system +firmware that the OS intends to turn on the display when exiting Modern +Standby. This allows the firmware to release Power Limits (PLx) earlier. + +Crucially, this patch fixes a functional issue observed on the Lenovo Yoga +Slim 7i Aura (15ILL9), where system fans and keyboard backlights fail to +resume after suspend. Investigation linked shows the EC on this device +turns off these components during sleep but requires the Function 9 +notification to wake them up again. + +This patch defines the new function index (ACPI_MS_TURN_ON_DISPLAY) and +invokes it in acpi_s2idle_restore_early_lps0(). The execution order is +updated to match the logic of an "intent" signal: + + 1. LPS0 Exit (Function 6) + 2. Turn On Display Intent (Function 9) + 3. Modern Standby Exit (Function 8) + 4. Screen On (Function 4) + +Invoking Function 9 before the Modern Standby Exit ensures the firmware +has time to restore power rails and functionality (like fans) before the +software fully exits the sleep state. + +Link: https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/modern-standby-firmware-notifications#turn-on-display-notification-function-9 +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220505 +Suggested-by: Antheas Kapenekakis +Signed-off-by: Jakob Riemenschneider +Link: https://patch.msgid.link/20260127200121.1292216-1-riemenschneiderjakob@gmail.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/x86/s2idle.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/acpi/x86/s2idle.c b/drivers/acpi/x86/s2idle.c +index cc3c83e4cc23b..2189330ffc6d3 100644 +--- a/drivers/acpi/x86/s2idle.c ++++ b/drivers/acpi/x86/s2idle.c +@@ -49,6 +49,7 @@ static const struct acpi_device_id lps0_device_ids[] = { + #define ACPI_LPS0_EXIT 6 + #define ACPI_LPS0_MS_ENTRY 7 + #define ACPI_LPS0_MS_EXIT 8 ++#define ACPI_MS_TURN_ON_DISPLAY 9 + + /* AMD */ + #define ACPI_LPS0_DSM_UUID_AMD "e3f32452-febc-43ce-9039-932122d37721" +@@ -356,6 +357,8 @@ static const char *acpi_sleep_dsm_state_to_str(unsigned int state) + return "lps0 ms entry"; + case ACPI_LPS0_MS_EXIT: + return "lps0 ms exit"; ++ case ACPI_MS_TURN_ON_DISPLAY: ++ return "lps0 ms turn on display"; + } + } else { + switch (state) { +@@ -617,6 +620,9 @@ static void acpi_s2idle_restore_early_lps0(void) + if (lps0_dsm_func_mask_microsoft > 0) { + acpi_sleep_run_lps0_dsm(ACPI_LPS0_EXIT, + lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft); ++ /* Intent to turn on display */ ++ acpi_sleep_run_lps0_dsm(ACPI_MS_TURN_ON_DISPLAY, ++ lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft); + /* Modern Standby exit */ + acpi_sleep_run_lps0_dsm(ACPI_LPS0_MS_EXIT, + lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft); +-- +2.51.0 + diff --git a/queue-6.19/acpica-abort-aml-bytecode-execution-when-executing-a.patch b/queue-6.19/acpica-abort-aml-bytecode-execution-when-executing-a.patch new file mode 100644 index 00000000000..3de3c90d361 --- /dev/null +++ b/queue-6.19/acpica-abort-aml-bytecode-execution-when-executing-a.patch @@ -0,0 +1,129 @@ +From ebf77dc3e2303dec3ffb368d9a678e24f26780f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 13:25:33 +0100 +Subject: ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP + +From: Armin Wolf + +[ Upstream commit 026ad376a6a48538b576f3589331daa94daae6f0 ] + +The ACPI specification states that when executing AML_FATAL_OP, +the OS should log the fatal error event and shutdown in a timely +fashion. + +Windows complies with this requirement by immediatly entering a +Bso_d, effectively aborting the execution of the AML bytecode in +question. + +ACPICA however might continue with the AML bytecode execution +should acpi_os_signal() simply return AE_OK. This will cause issues +because ACPI BIOS implementations might assume that the Fatal() +operator does not return. + +Fix this by aborting the AML bytecode execution in such a case +by returning AE_ERROR. Also turn struct acpi_signal_fatal_info into a +local variable because of its small size (12 bytes) and to ensure +that acpi_os_signal() always receives valid information about the +fatal ACPI BIOS error. + +Link: https://github.com/acpica/acpica/commit/d516c7758ba6 +Signed-off-by: Armin Wolf +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/3325491.5fSG56mABF@rafael.j.wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/exoparg3.c | 46 +++++++++++++--------------------- + 1 file changed, 18 insertions(+), 28 deletions(-) + +diff --git a/drivers/acpi/acpica/exoparg3.c b/drivers/acpi/acpica/exoparg3.c +index bf08110ed6d25..c8c8c4e49563e 100644 +--- a/drivers/acpi/acpica/exoparg3.c ++++ b/drivers/acpi/acpica/exoparg3.c +@@ -10,6 +10,7 @@ + #include + #include "accommon.h" + #include "acinterp.h" ++#include + #include "acparser.h" + #include "amlcode.h" + +@@ -51,8 +52,7 @@ ACPI_MODULE_NAME("exoparg3") + acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state) + { + union acpi_operand_object **operand = &walk_state->operands[0]; +- struct acpi_signal_fatal_info *fatal; +- acpi_status status = AE_OK; ++ struct acpi_signal_fatal_info fatal; + + ACPI_FUNCTION_TRACE_STR(ex_opcode_3A_0T_0R, + acpi_ps_get_opcode_name(walk_state->opcode)); +@@ -60,28 +60,23 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state) + switch (walk_state->opcode) { + case AML_FATAL_OP: /* Fatal (fatal_type fatal_code fatal_arg) */ + +- ACPI_DEBUG_PRINT((ACPI_DB_INFO, +- "FatalOp: Type %X Code %X Arg %X " +- "<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n", +- (u32)operand[0]->integer.value, +- (u32)operand[1]->integer.value, +- (u32)operand[2]->integer.value)); +- +- fatal = ACPI_ALLOCATE(sizeof(struct acpi_signal_fatal_info)); +- if (fatal) { +- fatal->type = (u32) operand[0]->integer.value; +- fatal->code = (u32) operand[1]->integer.value; +- fatal->argument = (u32) operand[2]->integer.value; +- } ++ fatal.type = (u32)operand[0]->integer.value; ++ fatal.code = (u32)operand[1]->integer.value; ++ fatal.argument = (u32)operand[2]->integer.value; + +- /* Always signal the OS! */ ++ ACPI_BIOS_ERROR((AE_INFO, ++ "Fatal ACPI BIOS error (Type 0x%X Code 0x%X Arg 0x%X)\n", ++ fatal.type, fatal.code, fatal.argument)); + +- status = acpi_os_signal(ACPI_SIGNAL_FATAL, fatal); ++ /* Always signal the OS! */ + +- /* Might return while OS is shutting down, just continue */ ++ acpi_os_signal(ACPI_SIGNAL_FATAL, &fatal); + +- ACPI_FREE(fatal); +- goto cleanup; ++ /* ++ * Might return while OS is shutting down, so abort the AML execution ++ * by returning an error. ++ */ ++ return_ACPI_STATUS(AE_ERROR); + + case AML_EXTERNAL_OP: + /* +@@ -93,21 +88,16 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state) + * wrong if an external opcode ever gets here. + */ + ACPI_ERROR((AE_INFO, "Executed External Op")); +- status = AE_OK; +- goto cleanup; ++ ++ return_ACPI_STATUS(AE_OK); + + default: + + ACPI_ERROR((AE_INFO, "Unknown AML opcode 0x%X", + walk_state->opcode)); + +- status = AE_AML_BAD_OPCODE; +- goto cleanup; ++ return_ACPI_STATUS(AE_AML_BAD_OPCODE); + } +- +-cleanup: +- +- return_ACPI_STATUS(status); + } + + /******************************************************************************* +-- +2.51.0 + diff --git a/queue-6.19/alpha-fix-user-space-corruption-during-memory-compac.patch b/queue-6.19/alpha-fix-user-space-corruption-during-memory-compac.patch new file mode 100644 index 00000000000..fe98e0694b7 --- /dev/null +++ b/queue-6.19/alpha-fix-user-space-corruption-during-memory-compac.patch @@ -0,0 +1,260 @@ +From aaaa4d470040b3376aff5f3b093bc70d1c76a152 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jan 2026 18:30:43 +0100 +Subject: alpha: fix user-space corruption during memory compaction + +From: Magnus Lindholm + +[ Upstream commit dd5712f3379cfe760267cdd28ff957d9ab4e51c7 ] + +Alpha systems can suffer sporadic user-space crashes and heap +corruption when memory compaction is enabled. + +Symptoms include SIGSEGV, glibc allocator failures (e.g. "unaligned +tcache chunk"), and compiler internal errors. The failures disappear +when compaction is disabled or when using global TLB invalidation. + +The root cause is insufficient TLB shootdown during page migration. +Alpha relies on ASN-based MM context rollover for instruction cache +coherency, but this alone is not sufficient to prevent stale data or +instruction translations from surviving migration. + +Fix this by introducing a migration-specific helper that combines: + - MM context invalidation (ASN rollover), + - immediate per-CPU TLB invalidation (TBI), + - synchronous cross-CPU shootdown when required. + +The helper is used only by migration/compaction paths to avoid changing +global TLB semantics. + +Additionally, update flush_tlb_other(), pte_clear(), to use +READ_ONCE()/WRITE_ONCE() for correct SMP memory ordering. + +This fixes observed crashes on both UP and SMP Alpha systems. + +Reviewed-by: Ivan Kokshaysky +Tested-by: Matoro Mahri +Tested-by: Michael Cree +Signed-off-by: Magnus Lindholm +Link: https://lore.kernel.org/r/20260102173603.18247-2-linmag7@gmail.com +Signed-off-by: Magnus Lindholm +Signed-off-by: Sasha Levin +--- + arch/alpha/include/asm/pgtable.h | 33 ++++++++- + arch/alpha/include/asm/tlbflush.h | 4 +- + arch/alpha/mm/Makefile | 2 +- + arch/alpha/mm/tlbflush.c | 112 ++++++++++++++++++++++++++++++ + 4 files changed, 148 insertions(+), 3 deletions(-) + create mode 100644 arch/alpha/mm/tlbflush.c + +diff --git a/arch/alpha/include/asm/pgtable.h b/arch/alpha/include/asm/pgtable.h +index 90e7a95391022..c9508ec37efc4 100644 +--- a/arch/alpha/include/asm/pgtable.h ++++ b/arch/alpha/include/asm/pgtable.h +@@ -17,6 +17,7 @@ + #include /* For TASK_SIZE */ + #include + #include ++#include + + struct mm_struct; + struct vm_area_struct; +@@ -183,6 +184,9 @@ extern inline void pud_set(pud_t * pudp, pmd_t * pmdp) + { pud_val(*pudp) = _PAGE_TABLE | ((((unsigned long) pmdp) - PAGE_OFFSET) << (32-PAGE_SHIFT)); } + + ++extern void migrate_flush_tlb_page(struct vm_area_struct *vma, ++ unsigned long addr); ++ + extern inline unsigned long + pmd_page_vaddr(pmd_t pmd) + { +@@ -202,7 +206,7 @@ extern inline int pte_none(pte_t pte) { return !pte_val(pte); } + extern inline int pte_present(pte_t pte) { return pte_val(pte) & _PAGE_VALID; } + extern inline void pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep) + { +- pte_val(*ptep) = 0; ++ WRITE_ONCE(pte_val(*ptep), 0); + } + + extern inline int pmd_none(pmd_t pmd) { return !pmd_val(pmd); } +@@ -264,6 +268,33 @@ extern inline pte_t * pte_offset_kernel(pmd_t * dir, unsigned long address) + + extern pgd_t swapper_pg_dir[1024]; + ++#ifdef CONFIG_COMPACTION ++#define __HAVE_ARCH_PTEP_GET_AND_CLEAR ++ ++static inline pte_t ptep_get_and_clear(struct mm_struct *mm, ++ unsigned long address, ++ pte_t *ptep) ++{ ++ pte_t pte = READ_ONCE(*ptep); ++ ++ pte_clear(mm, address, ptep); ++ return pte; ++} ++ ++#define __HAVE_ARCH_PTEP_CLEAR_FLUSH ++ ++static inline pte_t ptep_clear_flush(struct vm_area_struct *vma, ++ unsigned long addr, pte_t *ptep) ++{ ++ struct mm_struct *mm = vma->vm_mm; ++ pte_t pte = ptep_get_and_clear(mm, addr, ptep); ++ ++ page_table_check_pte_clear(mm, pte); ++ migrate_flush_tlb_page(vma, addr); ++ return pte; ++} ++ ++#endif + /* + * The Alpha doesn't have any external MMU info: the kernel page + * tables contain all the necessary information. +diff --git a/arch/alpha/include/asm/tlbflush.h b/arch/alpha/include/asm/tlbflush.h +index ba4b359d6c395..0c8529997f54e 100644 +--- a/arch/alpha/include/asm/tlbflush.h ++++ b/arch/alpha/include/asm/tlbflush.h +@@ -58,7 +58,9 @@ flush_tlb_other(struct mm_struct *mm) + unsigned long *mmc = &mm->context[smp_processor_id()]; + /* Check it's not zero first to avoid cacheline ping pong + when possible. */ +- if (*mmc) *mmc = 0; ++ ++ if (READ_ONCE(*mmc)) ++ WRITE_ONCE(*mmc, 0); + } + + #ifndef CONFIG_SMP +diff --git a/arch/alpha/mm/Makefile b/arch/alpha/mm/Makefile +index 101dbd06b4ceb..2d05664058f64 100644 +--- a/arch/alpha/mm/Makefile ++++ b/arch/alpha/mm/Makefile +@@ -3,4 +3,4 @@ + # Makefile for the linux alpha-specific parts of the memory manager. + # + +-obj-y := init.o fault.o ++obj-y := init.o fault.o tlbflush.o +diff --git a/arch/alpha/mm/tlbflush.c b/arch/alpha/mm/tlbflush.c +new file mode 100644 +index 0000000000000..ccbc317b9a348 +--- /dev/null ++++ b/arch/alpha/mm/tlbflush.c +@@ -0,0 +1,112 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* ++ * Alpha TLB shootdown helpers ++ * ++ * Copyright (C) 2025 Magnus Lindholm ++ * ++ * Alpha-specific TLB flush helpers that cannot be expressed purely ++ * as inline functions. ++ * ++ * These helpers provide combined MM context handling (ASN rollover) ++ * and immediate TLB invalidation for page migration and memory ++ * compaction paths, where lazy shootdowns are insufficient. ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#define asn_locked() (cpu_data[smp_processor_id()].asn_lock) ++ ++/* ++ * Migration/compaction helper: combine mm context (ASN) handling with an ++ * immediate per-page TLB invalidate and (for exec) an instruction barrier. ++ * ++ * This mirrors the SMP combined IPI handler semantics, but runs locally on UP. ++ */ ++#ifndef CONFIG_SMP ++void migrate_flush_tlb_page(struct vm_area_struct *vma, ++ unsigned long addr) ++{ ++ struct mm_struct *mm = vma->vm_mm; ++ int tbi_type = (vma->vm_flags & VM_EXEC) ? 3 : 2; ++ ++ /* ++ * First do the mm-context side: ++ * If we're currently running this mm, reload a fresh context ASN. ++ * Otherwise, mark context invalid. ++ * ++ * On UP, this is mostly about matching the SMP semantics and ensuring ++ * exec/i-cache tagging assumptions hold when compaction migrates pages. ++ */ ++ if (mm == current->active_mm) ++ flush_tlb_current(mm); ++ else ++ flush_tlb_other(mm); ++ ++ /* ++ * Then do the immediate translation kill for this VA. ++ * For exec mappings, order instruction fetch after invalidation. ++ */ ++ tbi(tbi_type, addr); ++} ++ ++#else ++struct tlb_mm_and_addr { ++ struct mm_struct *mm; ++ unsigned long addr; ++ int tbi_type; /* 2 = DTB, 3 = ITB+DTB */ ++}; ++ ++static void ipi_flush_mm_and_page(void *x) ++{ ++ struct tlb_mm_and_addr *d = x; ++ ++ /* Part 1: mm context side (Alpha uses ASN/context as a key mechanism). */ ++ if (d->mm == current->active_mm && !asn_locked()) ++ __load_new_mm_context(d->mm); ++ else ++ flush_tlb_other(d->mm); ++ ++ /* Part 2: immediate per-VA invalidation on this CPU. */ ++ tbi(d->tbi_type, d->addr); ++} ++ ++void migrate_flush_tlb_page(struct vm_area_struct *vma, unsigned long addr) ++{ ++ struct mm_struct *mm = vma->vm_mm; ++ struct tlb_mm_and_addr d = { ++ .mm = mm, ++ .addr = addr, ++ .tbi_type = (vma->vm_flags & VM_EXEC) ? 3 : 2, ++ }; ++ ++ /* ++ * One synchronous rendezvous: every CPU runs ipi_flush_mm_and_page(). ++ * This is the "combined" version of flush_tlb_mm + per-page invalidate. ++ */ ++ preempt_disable(); ++ on_each_cpu(ipi_flush_mm_and_page, &d, 1); ++ ++ /* ++ * mimic flush_tlb_mm()'s mm_users<=1 optimization. ++ */ ++ if (atomic_read(&mm->mm_users) <= 1) { ++ ++ int cpu, this_cpu; ++ this_cpu = smp_processor_id(); ++ ++ for (cpu = 0; cpu < NR_CPUS; cpu++) { ++ if (!cpu_online(cpu) || cpu == this_cpu) ++ continue; ++ if (READ_ONCE(mm->context[cpu])) ++ WRITE_ONCE(mm->context[cpu], 0); ++ } ++ } ++ preempt_enable(); ++} ++ ++#endif +-- +2.51.0 + diff --git a/queue-6.19/alsa-ctxfi-add-quirk-for-se-300pcie-variant-160b-010.patch b/queue-6.19/alsa-ctxfi-add-quirk-for-se-300pcie-variant-160b-010.patch new file mode 100644 index 00000000000..87ae44a9edb --- /dev/null +++ b/queue-6.19/alsa-ctxfi-add-quirk-for-se-300pcie-variant-160b-010.patch @@ -0,0 +1,65 @@ +From c117476615358374c0e46a1041e4d622dc49ef8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Feb 2026 22:30:01 +0900 +Subject: ALSA: ctxfi: Add quirk for SE-300PCIE variant (160b:0102) + +From: Harin Lee + +[ Upstream commit 3a92733e052753d87fdd56bd6f621f969be28447 ] + +Add quirk for the Onkyo SE-300PCIE variant with PCI subsystem ID +(160b:0102). This variant (OK0011) was found in the official Windows +driver packages. + +Also, reorder entries and fix the indentation to maintain +consistency. + +Signed-off-by: Harin Lee +Link: https://patch.msgid.link/20260208133001.680550-1-me@harin.net +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/ctxfi/ctatc.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/sound/pci/ctxfi/ctatc.c b/sound/pci/ctxfi/ctatc.c +index 227d8c8490e1f..a25a599fc5bec 100644 +--- a/sound/pci/ctxfi/ctatc.c ++++ b/sound/pci/ctxfi/ctatc.c +@@ -52,18 +52,19 @@ static const struct snd_pci_quirk subsys_20k1_list[] = { + static const struct snd_pci_quirk subsys_20k2_list[] = { + SND_PCI_QUIRK(PCI_VENDOR_ID_CREATIVE, PCI_SUBDEVICE_ID_CREATIVE_SB0760, + "SB0760", CTSB0760), +- SND_PCI_QUIRK(PCI_VENDOR_ID_CREATIVE, PCI_SUBDEVICE_ID_CREATIVE_SB1270, +- "SB1270", CTSB1270), + SND_PCI_QUIRK(PCI_VENDOR_ID_CREATIVE, PCI_SUBDEVICE_ID_CREATIVE_SB08801, + "SB0880", CTSB0880), + SND_PCI_QUIRK(PCI_VENDOR_ID_CREATIVE, PCI_SUBDEVICE_ID_CREATIVE_SB08802, + "SB0880", CTSB0880), + SND_PCI_QUIRK(PCI_VENDOR_ID_CREATIVE, PCI_SUBDEVICE_ID_CREATIVE_SB08803, + "SB0880", CTSB0880), ++ SND_PCI_QUIRK(PCI_VENDOR_ID_CREATIVE, PCI_SUBDEVICE_ID_CREATIVE_SB1270, ++ "SB1270", CTSB1270), ++ SND_PCI_QUIRK(0x160b, 0x0101, "OK0010", CTOK0010), ++ SND_PCI_QUIRK(0x160b, 0x0102, "OK0010", CTOK0010), + SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_CREATIVE, 0xf000, + PCI_SUBDEVICE_ID_CREATIVE_HENDRIX, "HENDRIX", + CTHENDRIX), +- SND_PCI_QUIRK(0x160b, 0x0101, "OK0010", CTOK0010), + { } /* terminator */ + }; + +@@ -78,8 +79,8 @@ static const char *ct_subsys_name[NUM_CTCARDS] = { + [CTSB0760] = "SB076x", + [CTHENDRIX] = "Hendrix", + [CTSB0880] = "SB0880", +- [CTSB1270] = "SB1270", +- [CTOK0010] = "OK0010", ++ [CTSB1270] = "SB1270", ++ [CTOK0010] = "OK0010", + [CT20K2_UNKNOWN] = "Unknown", + }; + +-- +2.51.0 + diff --git a/queue-6.19/alsa-hda-conexant-add-headset-mic-fix-for-mechrevo-w.patch b/queue-6.19/alsa-hda-conexant-add-headset-mic-fix-for-mechrevo-w.patch new file mode 100644 index 00000000000..4df98e7419d --- /dev/null +++ b/queue-6.19/alsa-hda-conexant-add-headset-mic-fix-for-mechrevo-w.patch @@ -0,0 +1,36 @@ +From a3e5f6ef243574469a67e881a2e2ab622449545e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 23:55:01 +0800 +Subject: ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro + +From: gongqi <550230171hxy@gmail.com> + +[ Upstream commit f2581ea2d9f30844c437e348a462027ea25c12e9 ] + +The headset microphone on the MECHREVO Wujie 15X Pro requires the +CXT_FIXUP_HEADSET_MIC quirk to function properly. Add the PCI SSID +(0x1d05:0x3012) to the quirk table. + +Signed-off-by: gongqi <550230171hxy@gmail.com> +Link: https://patch.msgid.link/20260122155501.376199-5-550230171hxy@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/codecs/conexant.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/hda/codecs/conexant.c b/sound/hda/codecs/conexant.c +index 0c517378a6d28..f71123a475464 100644 +--- a/sound/hda/codecs/conexant.c ++++ b/sound/hda/codecs/conexant.c +@@ -1134,6 +1134,7 @@ static const struct hda_quirk cxt5066_fixups[] = { + SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad/Ideapad", CXT_FIXUP_LENOVO_XPAD_ACPI), + SND_PCI_QUIRK(0x1c06, 0x2011, "Lemote A1004", CXT_PINCFG_LEMOTE_A1004), + SND_PCI_QUIRK(0x1c06, 0x2012, "Lemote A1205", CXT_PINCFG_LEMOTE_A1205), ++ SND_PCI_QUIRK(0x1d05, 0x3012, "MECHREVO Wujie 15X Pro", CXT_FIXUP_HEADSET_MIC), + HDA_CODEC_QUIRK(0x2782, 0x12c3, "Sirius Gen1", CXT_PINCFG_TOP_SPEAKER), + HDA_CODEC_QUIRK(0x2782, 0x12c5, "Sirius Gen2", CXT_PINCFG_TOP_SPEAKER), + {} +-- +2.51.0 + diff --git a/queue-6.19/alsa-hda-controllers-intel-add-support-for-nova-lake.patch b/queue-6.19/alsa-hda-controllers-intel-add-support-for-nova-lake.patch new file mode 100644 index 00000000000..eb4f30fd6a2 --- /dev/null +++ b/queue-6.19/alsa-hda-controllers-intel-add-support-for-nova-lake.patch @@ -0,0 +1,38 @@ +From 357393640c454c961609fe2d4defac0cd49f1d86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 21:35:07 +0200 +Subject: ALSA: hda: controllers: intel: add support for Nova Lake + +From: Peter Ujfalusi + +[ Upstream commit 7f428282fde34f06f3ab898b8a9081bf93a41f22 ] + +Add NVL to the PCI-ID list. + +Signed-off-by: Peter Ujfalusi +Reviewed-by: Kai Vehmanen +Reviewed-by: Liam Girdwood +Reviewed-by: Ranjani Sridharan +Acked-by: Takashi Iwai +Link: https://patch.msgid.link/20260120193507.14019-5-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/hda/controllers/intel.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/hda/controllers/intel.c b/sound/hda/controllers/intel.c +index 1e8e3d61291a1..1b365e0772970 100644 +--- a/sound/hda/controllers/intel.c ++++ b/sound/hda/controllers/intel.c +@@ -2551,6 +2551,7 @@ static const struct pci_device_id azx_ids[] = { + /* Wildcat Lake */ + { PCI_DEVICE_DATA(INTEL, HDA_WCL, AZX_DRIVER_SKL | AZX_DCAPS_INTEL_LNL) }, + /* Nova Lake */ ++ { PCI_DEVICE_DATA(INTEL, HDA_NVL, AZX_DRIVER_SKL | AZX_DCAPS_INTEL_LNL) }, + { PCI_DEVICE_DATA(INTEL, HDA_NVL_S, AZX_DRIVER_SKL | AZX_DCAPS_INTEL_LNL) }, + /* Apollolake (Broxton-P) */ + { PCI_DEVICE_DATA(INTEL, HDA_APL, AZX_DRIVER_SKL | AZX_DCAPS_INTEL_BROXTON) }, +-- +2.51.0 + diff --git a/queue-6.19/alsa-hda-hdmi-add-quirk-for-tuxedo-ibs14g6.patch b/queue-6.19/alsa-hda-hdmi-add-quirk-for-tuxedo-ibs14g6.patch new file mode 100644 index 00000000000..3cb6ae52af6 --- /dev/null +++ b/queue-6.19/alsa-hda-hdmi-add-quirk-for-tuxedo-ibs14g6.patch @@ -0,0 +1,37 @@ +From b642debceb0b279dc0e976f0799b1ee0120968df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Feb 2026 22:32:10 +0100 +Subject: ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 + +From: Aaron Erhardt + +[ Upstream commit d649c58bcad8fb9b749e3837136a201632fa109d ] + +Depending on the timing during boot, the BIOS might report wrong pin +capabilities, which can lead to HDMI audio being disabled. Therefore, +force HDMI audio connection on TUXEDO InfinityBook S 14 Gen6. + +Signed-off-by: Aaron Erhardt +Signed-off-by: Werner Sembach +Link: https://patch.msgid.link/20260218213234.429686-1-wse@tuxedocomputers.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/codecs/hdmi/hdmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/hda/codecs/hdmi/hdmi.c b/sound/hda/codecs/hdmi/hdmi.c +index 111c9b5335afc..c2e3adc7b3c00 100644 +--- a/sound/hda/codecs/hdmi/hdmi.c ++++ b/sound/hda/codecs/hdmi/hdmi.c +@@ -1557,6 +1557,7 @@ static const struct snd_pci_quirk force_connect_list[] = { + SND_PCI_QUIRK(0x1043, 0x86ae, "ASUS", 1), /* Z170 PRO */ + SND_PCI_QUIRK(0x1043, 0x86c7, "ASUS", 1), /* Z170M PLUS */ + SND_PCI_QUIRK(0x1462, 0xec94, "MS-7C94", 1), ++ SND_PCI_QUIRK(0x1558, 0x14a1, "TUXEDO InfinityBook S 14 Gen6", 1), + SND_PCI_QUIRK(0x8086, 0x2060, "Intel NUC5CPYB", 1), + SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", 1), + {} +-- +2.51.0 + diff --git a/queue-6.19/alsa-hda-realtek-add-hp-victus-16-e0xxx-mute-led-qui.patch b/queue-6.19/alsa-hda-realtek-add-hp-victus-16-e0xxx-mute-led-qui.patch new file mode 100644 index 00000000000..33a255bd961 --- /dev/null +++ b/queue-6.19/alsa-hda-realtek-add-hp-victus-16-e0xxx-mute-led-qui.patch @@ -0,0 +1,80 @@ +From 74e7a062009c9fa3a0b352ddd4a989a3eb44e632 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 00:12:40 +0530 +Subject: ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk + +From: Bharat Dev Burman + +[ Upstream commit 72919c57a055f6d7b79d66731dc398e9b433f47c ] + +HP Victus 16-e0xxx with ALC245 codec does not handle the toggling of +the mute LED. +This patch adds a quirk entry for subsystem ID 0x88eb using a new +ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT fixup, enabling correct mute LED +behavior. + +Signed-off-by: Bharat Dev Burman +Link: https://patch.msgid.link/20260112184253.33376-1-bharat.singh7924@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/codecs/realtek/alc269.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c +index 1964494321006..c9f59e62ee022 100644 +--- a/sound/hda/codecs/realtek/alc269.c ++++ b/sound/hda/codecs/realtek/alc269.c +@@ -1551,6 +1551,22 @@ static void alc245_fixup_hp_mute_led_v1_coefbit(struct hda_codec *codec, + } + } + ++static void alc245_fixup_hp_mute_led_v2_coefbit(struct hda_codec *codec, ++ const struct hda_fixup *fix, ++ int action) ++{ ++ struct alc_spec *spec = codec->spec; ++ ++ if (action == HDA_FIXUP_ACT_PRE_PROBE) { ++ spec->mute_led_polarity = 0; ++ spec->mute_led_coef.idx = 0x0b; ++ spec->mute_led_coef.mask = 1 << 3; ++ spec->mute_led_coef.on = 1 << 3; ++ spec->mute_led_coef.off = 0; ++ snd_hda_gen_add_mute_led_cdev(codec, coef_mute_led_set); ++ } ++} ++ + /* turn on/off mic-mute LED per capture hook by coef bit */ + static int coef_micmute_led_set(struct led_classdev *led_cdev, + enum led_brightness brightness) +@@ -3828,6 +3844,7 @@ enum { + ALC287_FIXUP_YOGA7_14ARB7_I2C, + ALC245_FIXUP_HP_MUTE_LED_COEFBIT, + ALC245_FIXUP_HP_MUTE_LED_V1_COEFBIT, ++ ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT, + ALC245_FIXUP_HP_X360_MUTE_LEDS, + ALC287_FIXUP_THINKPAD_I2S_SPK, + ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD, +@@ -6165,6 +6182,10 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc245_fixup_hp_mute_led_v1_coefbit, + }, ++ [ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc245_fixup_hp_mute_led_v2_coefbit, ++ }, + [ALC245_FIXUP_HP_X360_MUTE_LEDS] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc245_fixup_hp_mute_led_coefbit, +@@ -6654,6 +6675,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x8898, "HP EliteBook 845 G8 Notebook PC", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x103c, 0x88d0, "HP Pavilion 15-eh1xxx (mainboard 88D0)", ALC287_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x88dd, "HP Pavilion 15z-ec200", ALC285_FIXUP_HP_MUTE_LED), ++ SND_PCI_QUIRK(0x103c, 0x88eb, "HP Victus 16-e0xxx", ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT), + SND_PCI_QUIRK(0x103c, 0x8902, "HP OMEN 16", ALC285_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x890e, "HP 255 G8 Notebook PC", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2), + SND_PCI_QUIRK(0x103c, 0x8919, "HP Pavilion Aero Laptop 13-be0xxx", ALC287_FIXUP_HP_GPIO_LED), +-- +2.51.0 + diff --git a/queue-6.19/alsa-hda-realtek-add-quirk-for-minisforum-v3-se.patch b/queue-6.19/alsa-hda-realtek-add-quirk-for-minisforum-v3-se.patch new file mode 100644 index 00000000000..1140fe260d5 --- /dev/null +++ b/queue-6.19/alsa-hda-realtek-add-quirk-for-minisforum-v3-se.patch @@ -0,0 +1,82 @@ +From c03ec08e2781d0522eb2c970fba3f73762be10c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 20:01:33 -0500 +Subject: ALSA: hda/realtek: Add quirk for Minisforum V3 SE + +From: Samuel Dionne-Riel + +[ Upstream commit e3474301824926ecce1d45f2ede7ecdda9a35840 ] + +First, adding a generic quirk for Bass speaker DAC avoidance. + +This pattern (re-routing the bass speakers off of a DAC without volume +control) seems common enough that having a "model" to match against and +quickly use to verify may be worthwhile. + +The alc285_fixup_thinkpad_x1_gen7 routing was selected, amongst the +different options, as it should allow tuning the ratio between both +speaker set. + +The routing was verified using `hda-verb`, and picking either 0x00 or +0x01. Either routing made the volume of the bass speakers controllable. + + hda-verb /dev/snd/hwC1D0 0x17 SET_CONNECT_SEL 0x01 + +This likely will apply for the Minisforum V3, though there isn't a lot +of information to confirm whether or not the identifiers are the same. + +This was verified on the Minisforum V3 SE, and the root cause (the bass +speakers routing) was found out by using pink noise, and playing with +the mixers. + +Signed-off-by: Samuel Dionne-Riel +Link: https://patch.msgid.link/20260203010132.1981419-2-samuel@dionne-riel.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/codecs/realtek/alc269.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c +index b6fae275919c6..82219f03b212c 100644 +--- a/sound/hda/codecs/realtek/alc269.c ++++ b/sound/hda/codecs/realtek/alc269.c +@@ -4046,6 +4046,7 @@ enum { + ALC288_FIXUP_SURFACE_SWAP_DACS, + ALC236_FIXUP_HP_MUTE_LED_MICMUTE_GPIO, + ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY, ++ ALC245_FIXUP_BASS_HP_DAC, + }; + + /* A special fixup for Lenovo C940 and Yoga Duet 7; +@@ -6548,6 +6549,11 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc233_fixup_lenovo_gpio2_mic_hotkey, + }, ++ [ALC245_FIXUP_BASS_HP_DAC] = { ++ .type = HDA_FIXUP_FUNC, ++ /* Borrow the DAC routing selected for those Thinkpads */ ++ .v.func = alc285_fixup_thinkpad_x1_gen7, ++ }, + }; + + static const struct hda_quirk alc269_fixup_tbl[] = { +@@ -7609,6 +7615,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1d72, 0x1947, "RedmiBook Air", ALC255_FIXUP_XIAOMI_HEADSET_MIC), + SND_PCI_QUIRK(0x1e39, 0xca14, "MEDION NM14LNL", ALC233_FIXUP_MEDION_MTL_SPK), + SND_PCI_QUIRK(0x1ee7, 0x2078, "HONOR BRB-X M1010", ALC2XX_FIXUP_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1f4c, 0xe001, "Minisforum V3 (SE)", ALC245_FIXUP_BASS_HP_DAC), + SND_PCI_QUIRK(0x1f66, 0x0105, "Ayaneo Portable Game Player", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x2014, 0x800a, "Positivo ARN50", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x2039, 0x0001, "Inspur S14-G1", ALC295_FIXUP_CHROME_BOOK), +@@ -7824,6 +7831,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { + {.id = ALC285_FIXUP_HP_GPIO_AMP_INIT, .name = "alc285-hp-amp-init"}, + {.id = ALC236_FIXUP_LENOVO_INV_DMIC, .name = "alc236-fixup-lenovo-inv-mic"}, + {.id = ALC2XX_FIXUP_HEADSET_MIC, .name = "alc2xx-fixup-headset-mic"}, ++ {.id = ALC245_FIXUP_BASS_HP_DAC, .name = "alc245-fixup-bass-hp-dac"}, + {} + }; + #define ALC225_STANDARD_PINS \ +-- +2.51.0 + diff --git a/queue-6.19/alsa-hda-realtek-enable-mute-led-for-lenovo-platform.patch b/queue-6.19/alsa-hda-realtek-enable-mute-led-for-lenovo-platform.patch new file mode 100644 index 00000000000..aa74beb7165 --- /dev/null +++ b/queue-6.19/alsa-hda-realtek-enable-mute-led-for-lenovo-platform.patch @@ -0,0 +1,119 @@ +From 9d430e9a8d0c7f427f6e99250ce16360160380ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Dec 2025 17:20:06 +0800 +Subject: ALSA: hda/realtek - Enable Mute LED for Lenovo platform + +From: Kailang Yang + +[ Upstream commit 5de5db35350d9c4def1de2ae273e224a4eee5ed1 ] + +Enable SPK Mute Led and Mic Mute Led for Lenovo platform. + +Signed-off-by: Kailang Yang +Link: https://patch.msgid.link/8a99edffee044e13b6e348d1b69c2b57@realtek.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/codecs/realtek/alc269.c | 57 +++++++++++++++++++++++++++++++ + 1 file changed, 57 insertions(+) + +diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c +index 15203c5855eb5..1964494321006 100644 +--- a/sound/hda/codecs/realtek/alc269.c ++++ b/sound/hda/codecs/realtek/alc269.c +@@ -1616,6 +1616,20 @@ static void alc295_fixup_hp_mute_led_coefbit11(struct hda_codec *codec, + } + } + ++static void alc233_fixup_lenovo_coef_micmute_led(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ struct alc_spec *spec = codec->spec; ++ ++ if (action == HDA_FIXUP_ACT_PRE_PROBE) { ++ spec->mic_led_coef.idx = 0x10; ++ spec->mic_led_coef.mask = 1 << 13; ++ spec->mic_led_coef.on = 0; ++ spec->mic_led_coef.off = 1 << 13; ++ snd_hda_gen_add_micmute_led_cdev(codec, coef_micmute_led_set); ++ } ++} ++ + static void alc285_fixup_hp_mute_led(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { +@@ -1918,6 +1932,39 @@ static void alc280_fixup_hp_gpio2_mic_hotkey(struct hda_codec *codec, + } + } + ++/* GPIO2 = mic mute hotkey ++ * GPIO3 = mic mute LED ++ */ ++static void alc233_fixup_lenovo_gpio2_mic_hotkey(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ struct alc_spec *spec = codec->spec; ++ ++ alc233_fixup_lenovo_coef_micmute_led(codec, fix, action); ++ if (action == HDA_FIXUP_ACT_PRE_PROBE) { ++ alc_update_coef_idx(codec, 0x10, 1<<2, 1<<2); ++ if (alc_register_micmute_input_device(codec) != 0) ++ return; ++ ++ spec->gpio_mask |= 0x04; ++ spec->gpio_dir |= 0x0; ++ snd_hda_codec_write_cache(codec, codec->core.afg, 0, ++ AC_VERB_SET_GPIO_UNSOLICITED_RSP_MASK, 0x04); ++ snd_hda_jack_detect_enable_callback(codec, codec->core.afg, ++ gpio2_mic_hotkey_event); ++ return; ++ } ++ ++ if (!spec->kb_dev) ++ return; ++ ++ switch (action) { ++ case HDA_FIXUP_ACT_FREE: ++ input_unregister_device(spec->kb_dev); ++ spec->kb_dev = NULL; ++ } ++} ++ + /* Line2 = mic mute hotkey + * GPIO2 = mic mute LED + */ +@@ -3816,6 +3863,7 @@ enum { + ALC245_FIXUP_HP_TAS2781_I2C_MUTE_LED, + ALC288_FIXUP_SURFACE_SWAP_DACS, + ALC236_FIXUP_HP_MUTE_LED_MICMUTE_GPIO, ++ ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY, + }; + + /* A special fixup for Lenovo C940 and Yoga Duet 7; +@@ -6306,6 +6354,10 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc288_fixup_surface_swap_dacs, + }, ++ [ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc233_fixup_lenovo_gpio2_mic_hotkey, ++ }, + }; + + static const struct hda_quirk alc269_fixup_tbl[] = { +@@ -7213,7 +7265,12 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x3176, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x17aa, 0x3178, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x17aa, 0x31af, "ThinkCentre Station", ALC623_FIXUP_LENOVO_THINKSTATION_P340), ++ SND_PCI_QUIRK(0x17aa, 0x3341, "Lenovo ThinkCentre M90 Gen4", ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY), ++ SND_PCI_QUIRK(0x17aa, 0x3342, "Lenovo ThinkCentre M90 Gen4", ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY), ++ SND_PCI_QUIRK(0x17aa, 0x3343, "Lenovo ThinkCentre M70 Gen4", ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY), ++ SND_PCI_QUIRK(0x17aa, 0x3344, "Lenovo ThinkCentre M70 Gen4", ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x334b, "Lenovo ThinkCentre M70 Gen5", ALC283_FIXUP_HEADSET_MIC), ++ SND_PCI_QUIRK(0x17aa, 0x334f, "Lenovo ThinkCentre M90a Gen5", ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x3384, "ThinkCentre M90a PRO", ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED), + SND_PCI_QUIRK(0x17aa, 0x3386, "ThinkCentre M90a Gen6", ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED), + SND_PCI_QUIRK(0x17aa, 0x3387, "ThinkCentre M70a Gen6", ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED), +-- +2.51.0 + diff --git a/queue-6.19/alsa-hda-realtek-enable-mute-leds-on-hp-envy-x360-15.patch b/queue-6.19/alsa-hda-realtek-enable-mute-leds-on-hp-envy-x360-15.patch new file mode 100644 index 00000000000..9d594896ac6 --- /dev/null +++ b/queue-6.19/alsa-hda-realtek-enable-mute-leds-on-hp-envy-x360-15.patch @@ -0,0 +1,72 @@ +From 521394d0404f33c32755263efef2d1ee7f2b6154 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Feb 2026 23:19:37 +0100 +Subject: ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx + +From: Illia Barbashyn <04baril@gmail.com> + +[ Upstream commit ac1ff574bbc09a6c90f4fe8f9e6b8d66c983064c ] + +The mute and mic-mute LEDs on HP ENVY x360 Convertible 15-es0xxx +(PCI SSID 103c:88b3) do not work with the current driver. + +This model requires a combination of COEFBIT and GPIO fixups to +correctly control the LEDs. Introduce a new fixup function +alc245_fixup_hp_envy_x360_mute_led and add a quirk to apply it. + +Signed-off-by: Illia Barbashyn <04baril@gmail.com> +Link: https://patch.msgid.link/20260207221955.24132-1-04baril@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/codecs/realtek/alc269.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c +index 82219f03b212c..c11312aa5ca76 100644 +--- a/sound/hda/codecs/realtek/alc269.c ++++ b/sound/hda/codecs/realtek/alc269.c +@@ -1660,6 +1660,13 @@ static void alc285_fixup_hp_spectre_x360_mute_led(struct hda_codec *codec, + alc285_fixup_hp_gpio_micmute_led(codec, fix, action); + } + ++static void alc245_fixup_hp_envy_x360_mute_led(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ alc245_fixup_hp_mute_led_v1_coefbit(codec, fix, action); ++ alc245_fixup_hp_gpio_led(codec, fix, action); ++} ++ + static void alc236_fixup_hp_mute_led(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { +@@ -3919,6 +3926,7 @@ enum { + ALC285_FIXUP_HP_GPIO_LED, + ALC285_FIXUP_HP_MUTE_LED, + ALC285_FIXUP_HP_SPECTRE_X360_MUTE_LED, ++ ALC245_FIXUP_HP_ENVY_X360_MUTE_LED, + ALC285_FIXUP_HP_BEEP_MICMUTE_LED, + ALC236_FIXUP_HP_MUTE_LED_COEFBIT2, + ALC236_FIXUP_HP_GPIO_LED, +@@ -5575,6 +5583,10 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_hp_spectre_x360_mute_led, + }, ++ [ALC245_FIXUP_HP_ENVY_X360_MUTE_LED] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc245_fixup_hp_envy_x360_mute_led, ++ }, + [ALC285_FIXUP_HP_BEEP_MICMUTE_LED] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_hp_beep, +@@ -6848,6 +6860,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x8895, "HP EliteBook 855 G8 Notebook PC", ALC285_FIXUP_HP_SPEAKERS_MICMUTE_LED), + SND_PCI_QUIRK(0x103c, 0x8896, "HP EliteBook 855 G8 Notebook PC", ALC285_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x8898, "HP EliteBook 845 G8 Notebook PC", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST), ++ SND_PCI_QUIRK(0x103c, 0x88b3, "HP ENVY x360 Convertible 15-es0xxx", ALC245_FIXUP_HP_ENVY_X360_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x88d0, "HP Pavilion 15-eh1xxx (mainboard 88D0)", ALC287_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x88dd, "HP Pavilion 15z-ec200", ALC285_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x88eb, "HP Victus 16-e0xxx", ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT), +-- +2.51.0 + diff --git a/queue-6.19/alsa-hda-realtek-fix-headset-mic-on-asus-zenbook-14-.patch b/queue-6.19/alsa-hda-realtek-fix-headset-mic-on-asus-zenbook-14-.patch new file mode 100644 index 00000000000..b330c971ca1 --- /dev/null +++ b/queue-6.19/alsa-hda-realtek-fix-headset-mic-on-asus-zenbook-14-.patch @@ -0,0 +1,69 @@ +From 1be81f24be6bd78deb743a4f0a7cf4c801bec999 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Feb 2026 17:21:12 +0700 +Subject: ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 UX3405MA + +From: Erik Sanjaya + +[ Upstream commit 91062e119b4eafde553c894ca072cd615a6dae2e ] + +The ASUS Zenbook 14 UX3405MA uses an ALC294 codec with CS35L41 +amplifiers over SPI. The existing quirk for this model only configured +the amplifiers, leaving the headset microphone on the combo jack +non-functional. + +Introduce a new fixup that configures pin 0x19 as headset mic input +and chains to ALC245_FIXUP_CS35L41_SPI_2 to preserve speaker +functionality. + +Similar to the fix done for the UM3406HA in commit 018f659753fd +("ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14"). + +Signed-off-by: Erik Sanjaya +Link: https://patch.msgid.link/20260217102112.20651-1-sirreidlos@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/codecs/realtek/alc269.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c +index c11312aa5ca76..36053042ca772 100644 +--- a/sound/hda/codecs/realtek/alc269.c ++++ b/sound/hda/codecs/realtek/alc269.c +@@ -3886,6 +3886,7 @@ enum { + ALC294_FIXUP_ASUS_MIC, + ALC294_FIXUP_ASUS_HEADSET_MIC, + ALC294_FIXUP_ASUS_I2C_HEADSET_MIC, ++ ALC294_FIXUP_ASUS_SPI_HEADSET_MIC, + ALC294_FIXUP_ASUS_SPK, + ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE, + ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE, +@@ -5236,6 +5237,15 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC287_FIXUP_CS35L41_I2C_2 + }, ++ [ALC294_FIXUP_ASUS_SPI_HEADSET_MIC] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x04a11020 }, /* use as headset mic */ ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC245_FIXUP_CS35L41_SPI_2 ++ }, + [ALC294_FIXUP_ASUS_SPK] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb[]) { +@@ -7189,7 +7199,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x19ce, "ASUS B9450FA", ALC294_FIXUP_ASUS_HPE), + SND_PCI_QUIRK(0x1043, 0x19e1, "ASUS UX581LV", ALC295_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW), +- SND_PCI_QUIRK(0x1043, 0x1a63, "ASUS UX3405MA", ALC245_FIXUP_CS35L41_SPI_2), ++ SND_PCI_QUIRK(0x1043, 0x1a63, "ASUS UX3405MA", ALC294_FIXUP_ASUS_SPI_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x1a83, "ASUS UM5302LA", ALC294_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x1043, 0x1a8e, "ASUS G712LWS", ALC294_FIXUP_LENOVO_MIC_LOCATION), + SND_PCI_QUIRK(0x1043, 0x1a8f, "ASUS UX582ZS", ALC245_FIXUP_CS35L41_SPI_2), +-- +2.51.0 + diff --git a/queue-6.19/alsa-hda-realtek-fix-lg-gram-style-14-speakers.patch b/queue-6.19/alsa-hda-realtek-fix-lg-gram-style-14-speakers.patch new file mode 100644 index 00000000000..0f1fb4206fd --- /dev/null +++ b/queue-6.19/alsa-hda-realtek-fix-lg-gram-style-14-speakers.patch @@ -0,0 +1,238 @@ +From 1dff336a75d2086049ea913b37f0d64452446063 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 18:14:52 +0100 +Subject: ALSA: hda/realtek: fix LG Gram Style 14 speakers + +From: Damien Dagorn + +[ Upstream commit cc051fbd7f40226cc407558bc97c5099513e8657 ] + +The LG Gram Style 14 (14Z90RS-G.AD77F, SSID 1854:0490) with Realtek ALC298 +shows normal routing and volume changes, but internal speakers stay silent +unless a userland HDA-verb workaround is applied. + +Add a dedicated quirk for the LG Gram Style 14 that programs the codec +coefficient sequence used by the known workaround and enables the speaker +amps only during playback. + +Tested-by: Damien Dagorn +Signed-off-by: Damien Dagorn +Link: https://lore.kernel.org/CAN59QMUhd4kHrkRoJA6VzEr2VKezN2yjHnANaQoZn2-Bnwe3bQ@mail.gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/codecs/realtek/alc269.c | 170 ++++++++++++++++++++++++++++++ + 1 file changed, 170 insertions(+) + +diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c +index c9f59e62ee022..b6fae275919c6 100644 +--- a/sound/hda/codecs/realtek/alc269.c ++++ b/sound/hda/codecs/realtek/alc269.c +@@ -1854,6 +1854,163 @@ static void alc298_samsung_v2_init_amps(struct hda_codec *codec, + spec->gen.pcm_playback_hook = alc298_samsung_v2_playback_hook; + } + ++/* LG Gram Style 14: program vendor coef sequence used by HDA-verb workaround */ ++struct alc298_lg_gram_style_seq { ++ unsigned short verb; ++ unsigned short idx; ++ unsigned short val; ++}; ++ ++static void alc298_lg_gram_style_coef_write(struct hda_codec *codec, ++ unsigned int verb, ++ unsigned int idx, ++ unsigned int val) ++{ ++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_COEF_INDEX, 0x23); ++ snd_hda_codec_write(codec, 0x20, 0, verb, idx); ++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_PROC_COEF, 0x00); ++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_PROC_COEF, val); ++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_PROC_COEF, 0xb011); ++} ++ ++static void alc298_lg_gram_style_run_seq(struct hda_codec *codec, ++ const struct alc298_lg_gram_style_seq *seq, ++ int seq_size) ++{ ++ int i; ++ ++ for (i = 0; i < seq_size; i++) ++ alc298_lg_gram_style_coef_write(codec, seq[i].verb, ++ seq[i].idx, seq[i].val); ++} ++ ++/* Coef sequences derived from the HDA-verb workaround for this model. */ ++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_preinit_seq[] = { ++ { 0x420, 0x00, 0x01 }, ++}; ++ ++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_disable_seq[] = { ++ { 0x423, 0xff, 0x00 }, ++ { 0x420, 0x3a, 0x80 }, ++}; ++ ++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_enable_seq[] = { ++ { 0x420, 0x3a, 0x81 }, ++ { 0x423, 0xff, 0x01 }, ++}; ++ ++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_38[] = { ++ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 }, ++ { 0x420, 0x1b, 0x01 }, { 0x420, 0x1d, 0x01 }, { 0x420, 0x1f, 0xfe }, ++ { 0x420, 0x21, 0x00 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 }, ++ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e }, ++ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0x99, 0x03 }, ++ { 0x423, 0xa4, 0xb5 }, { 0x423, 0xa5, 0x01 }, { 0x423, 0xba, 0x94 }, ++}; ++ ++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_39[] = { ++ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 }, ++ { 0x420, 0x1b, 0x02 }, { 0x420, 0x1d, 0x02 }, { 0x420, 0x1f, 0xfd }, ++ { 0x420, 0x21, 0x01 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 }, ++ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e }, ++ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0x99, 0x03 }, ++ { 0x423, 0xa4, 0xb5 }, { 0x423, 0xa5, 0x01 }, { 0x423, 0xba, 0x94 }, ++}; ++ ++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_3c[] = { ++ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 }, ++ { 0x420, 0x1b, 0x01 }, { 0x420, 0x1d, 0x01 }, { 0x420, 0x1f, 0xfe }, ++ { 0x420, 0x21, 0x00 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 }, ++ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e }, ++ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0xba, 0x8d }, ++}; ++ ++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_3d[] = { ++ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 }, ++ { 0x420, 0x1b, 0x02 }, { 0x420, 0x1d, 0x02 }, { 0x420, 0x1f, 0xfd }, ++ { 0x420, 0x21, 0x01 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 }, ++ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e }, ++ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0xba, 0x8d }, ++}; ++ ++struct alc298_lg_gram_style_amp_desc { ++ unsigned char nid; ++ const struct alc298_lg_gram_style_seq *init_seq; ++ int init_seq_size; ++}; ++ ++static const struct alc298_lg_gram_style_amp_desc alc298_lg_gram_style_amps[] = { ++ { 0x38, alc298_lg_gram_style_init_seq_38, ++ ARRAY_SIZE(alc298_lg_gram_style_init_seq_38) }, ++ { 0x39, alc298_lg_gram_style_init_seq_39, ++ ARRAY_SIZE(alc298_lg_gram_style_init_seq_39) }, ++ { 0x3c, alc298_lg_gram_style_init_seq_3c, ++ ARRAY_SIZE(alc298_lg_gram_style_init_seq_3c) }, ++ { 0x3d, alc298_lg_gram_style_init_seq_3d, ++ ARRAY_SIZE(alc298_lg_gram_style_init_seq_3d) }, ++}; ++ ++static void alc298_lg_gram_style_enable_amps(struct hda_codec *codec) ++{ ++ struct alc_spec *spec = codec->spec; ++ int i; ++ ++ for (i = 0; i < spec->num_speaker_amps; i++) { ++ alc_write_coef_idx(codec, 0x22, alc298_lg_gram_style_amps[i].nid); ++ alc298_lg_gram_style_run_seq(codec, ++ alc298_lg_gram_style_enable_seq, ++ ARRAY_SIZE(alc298_lg_gram_style_enable_seq)); ++ } ++} ++ ++static void alc298_lg_gram_style_disable_amps(struct hda_codec *codec) ++{ ++ struct alc_spec *spec = codec->spec; ++ int i; ++ ++ for (i = 0; i < spec->num_speaker_amps; i++) { ++ alc_write_coef_idx(codec, 0x22, alc298_lg_gram_style_amps[i].nid); ++ alc298_lg_gram_style_run_seq(codec, ++ alc298_lg_gram_style_disable_seq, ++ ARRAY_SIZE(alc298_lg_gram_style_disable_seq)); ++ } ++} ++ ++static void alc298_lg_gram_style_playback_hook(struct hda_pcm_stream *hinfo, ++ struct hda_codec *codec, ++ struct snd_pcm_substream *substream, ++ int action) ++{ ++ if (action == HDA_GEN_PCM_ACT_OPEN) ++ alc298_lg_gram_style_enable_amps(codec); ++ if (action == HDA_GEN_PCM_ACT_CLOSE) ++ alc298_lg_gram_style_disable_amps(codec); ++} ++ ++static void alc298_lg_gram_style_init_amps(struct hda_codec *codec) ++{ ++ struct alc_spec *spec = codec->spec; ++ int i; ++ ++ spec->num_speaker_amps = ARRAY_SIZE(alc298_lg_gram_style_amps); ++ ++ for (i = 0; i < spec->num_speaker_amps; i++) { ++ alc_write_coef_idx(codec, 0x22, alc298_lg_gram_style_amps[i].nid); ++ alc298_lg_gram_style_run_seq(codec, ++ alc298_lg_gram_style_preinit_seq, ++ ARRAY_SIZE(alc298_lg_gram_style_preinit_seq)); ++ alc298_lg_gram_style_run_seq(codec, ++ alc298_lg_gram_style_disable_seq, ++ ARRAY_SIZE(alc298_lg_gram_style_disable_seq)); ++ alc298_lg_gram_style_run_seq(codec, ++ alc298_lg_gram_style_amps[i].init_seq, ++ alc298_lg_gram_style_amps[i].init_seq_size); ++ alc_write_coef_idx(codec, 0x89, 0x0); ++ } ++ ++ spec->gen.pcm_playback_hook = alc298_lg_gram_style_playback_hook; ++} ++ + static void alc298_fixup_samsung_amp_v2_2_amps(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { +@@ -1868,6 +2025,13 @@ static void alc298_fixup_samsung_amp_v2_4_amps(struct hda_codec *codec, + alc298_samsung_v2_init_amps(codec, 4); + } + ++static void alc298_fixup_lg_gram_style_14(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ if (action == HDA_FIXUP_ACT_PROBE) ++ alc298_lg_gram_style_init_amps(codec); ++} ++ + static void gpio2_mic_hotkey_event(struct hda_codec *codec, + struct hda_jack_callback *event) + { +@@ -3764,6 +3928,7 @@ enum { + ALC298_FIXUP_SAMSUNG_AMP, + ALC298_FIXUP_SAMSUNG_AMP_V2_2_AMPS, + ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS, ++ ALC298_FIXUP_LG_GRAM_STYLE_14, + ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, + ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, + ALC295_FIXUP_ASUS_MIC_NO_PRESENCE, +@@ -5459,6 +5624,10 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc298_fixup_samsung_amp_v2_4_amps + }, ++ [ALC298_FIXUP_LG_GRAM_STYLE_14] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc298_fixup_lg_gram_style_14 ++ }, + [ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb[]) { +@@ -7406,6 +7575,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1854, 0x0488, "LG gram 16 (16Z90R)", ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS), + SND_PCI_QUIRK(0x1854, 0x0489, "LG gram 16 (16Z90R-A)", ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS), + SND_PCI_QUIRK(0x1854, 0x048a, "LG gram 17 (17ZD90R)", ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS), ++ SND_PCI_QUIRK(0x1854, 0x0490, "LG Gram Style 14 (14Z90RS)", ALC298_FIXUP_LG_GRAM_STYLE_14), + SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MACH-WX9", ALC256_FIXUP_HUAWEI_MACH_WX9_PINS), + SND_PCI_QUIRK(0x19e5, 0x320f, "Huawei WRT-WX9 ", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x19e5, 0x3212, "Huawei KLV-WX9 ", ALC256_FIXUP_ACER_HEADSET_MIC), +-- +2.51.0 + diff --git a/queue-6.19/alsa-hda-tas2781-ignore-reset-check-for-spi-device.patch b/queue-6.19/alsa-hda-tas2781-ignore-reset-check-for-spi-device.patch new file mode 100644 index 00000000000..320e507cab7 --- /dev/null +++ b/queue-6.19/alsa-hda-tas2781-ignore-reset-check-for-spi-device.patch @@ -0,0 +1,64 @@ +From 94314611f6f5e01908868021a83a5a820c1d8717 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Feb 2026 11:09:46 +0800 +Subject: ALSA: hda/tas2781: Ignore reset check for SPI device + +From: Baojun Xu + +[ Upstream commit 908ef80e31e4d3bd953a0088fe57640cd9ae7b3e ] + +In the SPI driver probe, the device should be in the default state, so the +device status check is not necessary. It should be forced to do the +firmware download as I2C device. + +Signed-off-by: Baojun Xu +Link: https://patch.msgid.link/20260211030946.2330-1-baojun.xu@ti.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + .../hda/codecs/side-codecs/tas2781_hda_spi.c | 20 +++++++------------ + 1 file changed, 7 insertions(+), 13 deletions(-) + +diff --git a/sound/hda/codecs/side-codecs/tas2781_hda_spi.c b/sound/hda/codecs/side-codecs/tas2781_hda_spi.c +index b9a55672bf15d..488e35dac9524 100644 +--- a/sound/hda/codecs/side-codecs/tas2781_hda_spi.c ++++ b/sound/hda/codecs/side-codecs/tas2781_hda_spi.c +@@ -634,7 +634,7 @@ static void tasdev_fw_ready(const struct firmware *fmw, void *context) + struct tasdevice_priv *tas_priv = context; + struct tas2781_hda *tas_hda = dev_get_drvdata(tas_priv->dev); + struct hda_codec *codec = tas_priv->codec; +- int ret, val; ++ int ret; + + pm_runtime_get_sync(tas_priv->dev); + guard(mutex)(&tas_priv->codec_lock); +@@ -673,20 +673,14 @@ static void tasdev_fw_ready(const struct firmware *fmw, void *context) + tas_priv->rcabin.profile_cfg_id = 0; + + tas_priv->fw_state = TASDEVICE_DSP_FW_ALL_OK; +- ret = tasdevice_spi_dev_read(tas_priv, tas_priv->index, +- TAS2781_REG_CLK_CONFIG, &val); +- if (ret < 0) +- goto out; + +- if (val == TAS2781_REG_CLK_CONFIG_RESET) { +- ret = tasdevice_prmg_load(tas_priv, 0); +- if (ret < 0) { +- dev_err(tas_priv->dev, "FW download failed = %d\n", +- ret); +- goto out; +- } +- tas_priv->fw_state = TASDEVICE_DSP_FW_ALL_OK; ++ ret = tasdevice_prmg_load(tas_priv, 0); ++ if (ret < 0) { ++ dev_err(tas_priv->dev, "FW download failed = %d\n", ret); ++ goto out; + } ++ tas_priv->fw_state = TASDEVICE_DSP_FW_ALL_OK; ++ + if (tas_priv->fmw->nr_programs > 0) + tas_priv->tasdevice[tas_priv->index].cur_prog = 0; + if (tas_priv->fmw->nr_configurations > 0) +-- +2.51.0 + diff --git a/queue-6.19/alsa-mixer-oss-add-card-disconnect-checkpoints.patch b/queue-6.19/alsa-mixer-oss-add-card-disconnect-checkpoints.patch new file mode 100644 index 00000000000..7b956fe8fda --- /dev/null +++ b/queue-6.19/alsa-mixer-oss-add-card-disconnect-checkpoints.patch @@ -0,0 +1,103 @@ +From 26bc0cd08cfdb7e84f36dba94093ef11714e3e36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 13:12:11 +0100 +Subject: ALSA: mixer: oss: Add card disconnect checkpoints + +From: Takashi Iwai + +[ Upstream commit 084d5d44418148662365eced3e126ad1a81ee3e2 ] + +ALSA OSS mixer layer calls the kcontrol ops rather individually, and +pending calls might be not always caught at disconnecting the device. + +For avoiding the potential UAF scenarios, add sanity checks of the +card disconnection at each entry point of OSS mixer accesses. The +rwsem is taken just before that check, hence the rest context should +be covered by that properly. + +Link: https://patch.msgid.link/20260209121212.171430-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/oss/mixer_oss.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c +index 8d2d46d03301b..f4ad0bfb4dac6 100644 +--- a/sound/core/oss/mixer_oss.c ++++ b/sound/core/oss/mixer_oss.c +@@ -523,6 +523,8 @@ static void snd_mixer_oss_get_volume1_vol(struct snd_mixer_oss_file *fmixer, + if (numid == ID_UNKNOWN) + return; + guard(rwsem_read)(&card->controls_rwsem); ++ if (card->shutdown) ++ return; + kctl = snd_ctl_find_numid(card, numid); + if (!kctl) + return; +@@ -557,6 +559,8 @@ static void snd_mixer_oss_get_volume1_sw(struct snd_mixer_oss_file *fmixer, + if (numid == ID_UNKNOWN) + return; + guard(rwsem_read)(&card->controls_rwsem); ++ if (card->shutdown) ++ return; + kctl = snd_ctl_find_numid(card, numid); + if (!kctl) + return; +@@ -618,6 +622,8 @@ static void snd_mixer_oss_put_volume1_vol(struct snd_mixer_oss_file *fmixer, + if (numid == ID_UNKNOWN) + return; + guard(rwsem_read)(&card->controls_rwsem); ++ if (card->shutdown) ++ return; + kctl = snd_ctl_find_numid(card, numid); + if (!kctl) + return; +@@ -656,6 +662,8 @@ static void snd_mixer_oss_put_volume1_sw(struct snd_mixer_oss_file *fmixer, + if (numid == ID_UNKNOWN) + return; + guard(rwsem_read)(&card->controls_rwsem); ++ if (card->shutdown) ++ return; + kctl = snd_ctl_find_numid(card, numid); + if (!kctl) + return; +@@ -796,6 +804,8 @@ static int snd_mixer_oss_get_recsrc2(struct snd_mixer_oss_file *fmixer, unsigned + if (uinfo == NULL || uctl == NULL) + return -ENOMEM; + guard(rwsem_read)(&card->controls_rwsem); ++ if (card->shutdown) ++ return -ENODEV; + kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0); + if (!kctl) + return -ENOENT; +@@ -839,6 +849,8 @@ static int snd_mixer_oss_put_recsrc2(struct snd_mixer_oss_file *fmixer, unsigned + if (uinfo == NULL || uctl == NULL) + return -ENOMEM; + guard(rwsem_read)(&card->controls_rwsem); ++ if (card->shutdown) ++ return -ENODEV; + kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0); + if (!kctl) + return -ENOENT; +@@ -885,6 +897,8 @@ static int snd_mixer_oss_build_test(struct snd_mixer_oss *mixer, struct slot *sl + if (!info) + return -ENOMEM; + scoped_guard(rwsem_read, &card->controls_rwsem) { ++ if (card->shutdown) ++ return -ENODEV; + kcontrol = snd_mixer_oss_test_id(mixer, name, index); + if (kcontrol == NULL) + return 0; +@@ -1006,6 +1020,8 @@ static int snd_mixer_oss_build_input(struct snd_mixer_oss *mixer, + if (snd_mixer_oss_build_test_all(mixer, ptr, &slot)) + return 0; + guard(rwsem_read)(&mixer->card->controls_rwsem); ++ if (mixer->card->shutdown) ++ return -ENODEV; + kctl = NULL; + if (!ptr->index) + kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0); +-- +2.51.0 + diff --git a/queue-6.19/alsa-usb-audio-add-dsd-support-for-ibasso-dc04u.patch b/queue-6.19/alsa-usb-audio-add-dsd-support-for-ibasso-dc04u.patch new file mode 100644 index 00000000000..a53262a5b92 --- /dev/null +++ b/queue-6.19/alsa-usb-audio-add-dsd-support-for-ibasso-dc04u.patch @@ -0,0 +1,41 @@ +From 17bb1dccc6549c2d9378c99f6fed12489135bb5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 18:04:18 +0800 +Subject: ALSA: usb-audio: Add DSD support for iBasso DC04U + +From: Qihang Guo + +[ Upstream commit fe7cd89f0e29f0852316857b4861309f9b891370 ] + +Vendor ID 0x0661 is assigned to Hamamatsu Photonics K.K., +but is used by iBasso for iBasso DC04U (0x0661:0x0883), +which supports native DSD playback. + +This patch adds QUIRK_FLAG_DSD_RAW for iBasso DC04U, enabling +native DSD playback (DSD_U32_BE). The change has been verified +on Arch Linux using mpd and pw-cat. + +Signed-off-by: Qihang Guo +Link: https://patch.msgid.link/TYYPR01MB14098529E0BD900921BE6F42CF465A@TYYPR01MB14098.jpnprd01.prod.outlook.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/quirks.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 4f9d19bf1ccac..7fabaeb3781a2 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -2235,6 +2235,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + DEVICE_FLG(0x0644, 0x806c, /* Esoteric XD */ + QUIRK_FLAG_ITF_USB_DSD_DAC | QUIRK_FLAG_CTL_MSG_DELAY | + QUIRK_FLAG_IFACE_DELAY | QUIRK_FLAG_FORCE_IFACE_RESET), ++ DEVICE_FLG(0x0661, 0x0883, /* iBasso DC04 Ultra */ ++ QUIRK_FLAG_DSD_RAW), + DEVICE_FLG(0x06f8, 0xb000, /* Hercules DJ Console (Windows Edition) */ + QUIRK_FLAG_IGNORE_CTL_ERROR), + DEVICE_FLG(0x06f8, 0xd002, /* Hercules DJ Console (Macintosh Edition) */ +-- +2.51.0 + diff --git a/queue-6.19/alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch b/queue-6.19/alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch new file mode 100644 index 00000000000..e5d9d77639f --- /dev/null +++ b/queue-6.19/alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch @@ -0,0 +1,42 @@ +From 6c027da59799abd57b42e18be1560eb51348b32e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 08:38:29 +0000 +Subject: ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio + +From: Lianqin Hu + +[ Upstream commit ac656d7d7c70f7c352c7652bc2bb0c1c8c2dde08 ] + +Setting up the interface when suspended/resumeing fail on this card. +Adding a reset and delay quirk will eliminate this problem. + +usb 1-1: New USB device found, idVendor=001f, idProduct=0b21 +usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 +usb 1-1: Product: AB13X USB Audio +usb 1-1: Manufacturer: Generic +usb 1-1: SerialNumber: 20210926172016 + +Signed-off-by: Lianqin Hu +Link: https://patch.msgid.link/TYUPR06MB6217522D0DB6E2C9DF46B56ED265A@TYUPR06MB6217.apcprd06.prod.outlook.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/quirks.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 7fabaeb3781a2..86c329632e396 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -2146,6 +2146,8 @@ struct usb_audio_quirk_flags_table { + + static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + /* Device matches */ ++ DEVICE_FLG(0x001f, 0x0b21, /* AB13X USB Audio */ ++ QUIRK_FLAG_FORCE_IFACE_RESET | QUIRK_FLAG_IFACE_DELAY), + DEVICE_FLG(0x03f0, 0x654a, /* HP 320 FHD Webcam */ + QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16), + DEVICE_FLG(0x041e, 0x3000, /* Creative SB Extigy */ +-- +2.51.0 + diff --git a/queue-6.19/alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch b/queue-6.19/alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch new file mode 100644 index 00000000000..d778d3eecc0 --- /dev/null +++ b/queue-6.19/alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch @@ -0,0 +1,108 @@ +From 514985d35f01ef684c62234b308bd6906303d749 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Feb 2026 15:12:07 +0100 +Subject: ALSA: usb-audio: Add sanity check for OOB writes at silencing + +From: Takashi Iwai + +[ Upstream commit fba2105a157fffcf19825e4eea498346738c9948 ] + +At silencing the playback URB packets in the implicit fb mode before +the actual playback, we blindly assume that the received packets fit +with the buffer size. But when the setup in the capture stream +differs from the playback stream (e.g. due to the USB core limitation +of max packet size), such an inconsistency may lead to OOB writes to +the buffer, resulting in a crash. + +For addressing it, add a sanity check of the transfer buffer size at +prepare_silent_urb(), and stop the data copy if the received data +overflows. Also, report back the transfer error properly from there, +too. + +Note that this doesn't fix the root cause of the playback error +itself, but this merely covers the kernel Oops. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076 +Link: https://patch.msgid.link/20260216141209.1849200-4-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/endpoint.c | 39 ++++++++++++++++++++++----------------- + 1 file changed, 22 insertions(+), 17 deletions(-) + +diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c +index 27ade2aa16f5a..1eaf52d1ae9c7 100644 +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -275,8 +275,8 @@ static inline bool has_tx_length_quirk(struct snd_usb_audio *chip) + return chip->quirk_flags & QUIRK_FLAG_TX_LENGTH; + } + +-static void prepare_silent_urb(struct snd_usb_endpoint *ep, +- struct snd_urb_ctx *ctx) ++static int prepare_silent_urb(struct snd_usb_endpoint *ep, ++ struct snd_urb_ctx *ctx) + { + struct urb *urb = ctx->urb; + unsigned int offs = 0; +@@ -289,28 +289,34 @@ static void prepare_silent_urb(struct snd_usb_endpoint *ep, + extra = sizeof(packet_length); + + for (i = 0; i < ctx->packets; ++i) { +- unsigned int offset; +- unsigned int length; +- int counts; +- +- counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0); +- length = counts * ep->stride; /* number of silent bytes */ +- offset = offs * ep->stride + extra * i; +- urb->iso_frame_desc[i].offset = offset; ++ int length; ++ ++ length = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0); ++ if (length < 0) ++ return length; ++ length *= ep->stride; /* number of silent bytes */ ++ if (offs + length + extra > ctx->buffer_size) ++ break; ++ urb->iso_frame_desc[i].offset = offs; + urb->iso_frame_desc[i].length = length + extra; + if (extra) { + packet_length = cpu_to_le32(length); +- memcpy(urb->transfer_buffer + offset, ++ memcpy(urb->transfer_buffer + offs, + &packet_length, sizeof(packet_length)); ++ offs += extra; + } +- memset(urb->transfer_buffer + offset + extra, ++ memset(urb->transfer_buffer + offs, + ep->silence_value, length); +- offs += counts; ++ offs += length; + } + +- urb->number_of_packets = ctx->packets; +- urb->transfer_buffer_length = offs * ep->stride + ctx->packets * extra; ++ if (!offs) ++ return -EPIPE; ++ ++ urb->number_of_packets = i; ++ urb->transfer_buffer_length = offs; + ctx->queued = 0; ++ return 0; + } + + /* +@@ -332,8 +338,7 @@ static int prepare_outbound_urb(struct snd_usb_endpoint *ep, + if (data_subs && ep->prepare_data_urb) + return ep->prepare_data_urb(data_subs, urb, in_stream_lock); + /* no data provider, so send silence */ +- prepare_silent_urb(ep, ctx); +- break; ++ return prepare_silent_urb(ep, ctx); + + case SND_USB_ENDPOINT_TYPE_SYNC: + if (snd_usb_get_speed(ep->chip->dev) >= USB_SPEED_HIGH) { +-- +2.51.0 + diff --git a/queue-6.19/alsa-usb-audio-presonus-s18xx-uses-little-endian.patch b/queue-6.19/alsa-usb-audio-presonus-s18xx-uses-little-endian.patch new file mode 100644 index 00000000000..32be5951ab7 --- /dev/null +++ b/queue-6.19/alsa-usb-audio-presonus-s18xx-uses-little-endian.patch @@ -0,0 +1,98 @@ +From 0a5e1ebfc19e55e9db199bbef8e607ab6fbc59b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Jan 2026 16:36:40 -0500 +Subject: ALSA: usb-audio: presonus s18xx uses little-endian + +From: fenugrec + +[ Upstream commit 3ce03297baff0ba116769044e4594fb324d4a551 ] + +Use __le32 types for USB control transfers + +Signed-off-by: fenugrec +Signed-off-by: Takashi Iwai +Link: https://patch.msgid.link/20260111-preso_clean1-v2-1-44b4e5129a75@mail.com +Signed-off-by: Sasha Levin +--- + sound/usb/mixer_s1810c.c | 36 ++++++++++++++++++------------------ + 1 file changed, 18 insertions(+), 18 deletions(-) + +diff --git a/sound/usb/mixer_s1810c.c b/sound/usb/mixer_s1810c.c +index 6e09e074c0e7f..93510aa0dc5ef 100644 +--- a/sound/usb/mixer_s1810c.c ++++ b/sound/usb/mixer_s1810c.c +@@ -82,13 +82,13 @@ + * mixer and output but a different set for device. + */ + struct s1810c_ctl_packet { +- u32 a; +- u32 b; +- u32 fixed1; +- u32 fixed2; +- u32 c; +- u32 d; +- u32 e; ++ __le32 a; ++ __le32 b; ++ __le32 fixed1; ++ __le32 fixed2; ++ __le32 c; ++ __le32 d; ++ __le32 e; + }; + + #define SC1810C_CTL_LINE_SW 0 +@@ -118,7 +118,7 @@ struct s1810c_ctl_packet { + * being zero and different f1/f2. + */ + struct s1810c_state_packet { +- u32 fields[63]; ++ __le32 fields[63]; + }; + + #define SC1810C_STATE_48V_SW 58 +@@ -140,14 +140,14 @@ snd_s1810c_send_ctl_packet(struct usb_device *dev, u32 a, + struct s1810c_ctl_packet pkt = { 0 }; + int ret = 0; + +- pkt.fixed1 = SC1810C_CMD_F1; +- pkt.fixed2 = SC1810C_CMD_F2; ++ pkt.fixed1 = __cpu_to_le32(SC1810C_CMD_F1); ++ pkt.fixed2 = __cpu_to_le32(SC1810C_CMD_F2); + +- pkt.a = a; +- pkt.b = b; +- pkt.c = c; +- pkt.d = d; +- pkt.e = e; ++ pkt.a = __cpu_to_le32(a); ++ pkt.b = __cpu_to_le32(b); ++ pkt.c = __cpu_to_le32(c); ++ pkt.d = __cpu_to_le32(d); ++ pkt.e = __cpu_to_le32(e); + + ret = snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0), + SC1810C_CMD_REQ, +@@ -176,8 +176,8 @@ snd_sc1810c_get_status_field(struct usb_device *dev, + struct s1810c_state_packet pkt_in = { { 0 } }; + int ret = 0; + +- pkt_out.fields[SC1810C_STATE_F1_IDX] = SC1810C_SET_STATE_F1; +- pkt_out.fields[SC1810C_STATE_F2_IDX] = SC1810C_SET_STATE_F2; ++ pkt_out.fields[SC1810C_STATE_F1_IDX] = __cpu_to_le32(SC1810C_SET_STATE_F1); ++ pkt_out.fields[SC1810C_STATE_F2_IDX] = __cpu_to_le32(SC1810C_SET_STATE_F2); + ret = snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0), + SC1810C_SET_STATE_REQ, + SC1810C_SET_STATE_REQTYPE, +@@ -197,7 +197,7 @@ snd_sc1810c_get_status_field(struct usb_device *dev, + return ret; + } + +- (*field) = pkt_in.fields[field_idx]; ++ (*field) = __le32_to_cpu(pkt_in.fields[field_idx]); + (*seqnum)++; + return 0; + } +-- +2.51.0 + diff --git a/queue-6.19/alsa-usb-audio-update-the-number-of-packets-properly.patch b/queue-6.19/alsa-usb-audio-update-the-number-of-packets-properly.patch new file mode 100644 index 00000000000..3b344c9dcf2 --- /dev/null +++ b/queue-6.19/alsa-usb-audio-update-the-number-of-packets-properly.patch @@ -0,0 +1,37 @@ +From 2fca7c8e7fb59f83beb683088d441b11f0916a20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Feb 2026 15:12:05 +0100 +Subject: ALSA: usb-audio: Update the number of packets properly at receiving + +From: Takashi Iwai + +[ Upstream commit cf044e44190234a41a788de1cdbb6c21f4a52e1e ] + +At receiving the packets from the implicit feedback source, we didn't +update ctx->packets field but only the ctx->packet_size[] data. +In exceptional cases, this might lead to unexpectedly superfluous data +transfer (although this won't happen usually due to the nature of USB +isochronous transfer). Fix it to update the field properly. + +Link: https://patch.msgid.link/20260216141209.1849200-2-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/endpoint.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c +index 8f9313857ee9d..27ade2aa16f5a 100644 +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -481,6 +481,7 @@ int snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep, + + /* copy over the length information */ + if (implicit_fb) { ++ ctx->packets = packet->packets; + for (i = 0; i < packet->packets; i++) + ctx->packet_size[i] = packet->packet_size[i]; + } +-- +2.51.0 + diff --git a/queue-6.19/apei-ghes-arm-processor-error-don-t-go-past-allocate.patch b/queue-6.19/apei-ghes-arm-processor-error-don-t-go-past-allocate.patch new file mode 100644 index 00000000000..5c351c39643 --- /dev/null +++ b/queue-6.19/apei-ghes-arm-processor-error-don-t-go-past-allocate.patch @@ -0,0 +1,130 @@ +From 325188c55418809ceb43be56412185be4731cfb3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:35:03 +0100 +Subject: APEI/GHES: ARM processor Error: don't go past allocated memory + +From: Mauro Carvalho Chehab + +[ Upstream commit 87880af2d24e62a84ed19943dbdd524f097172f2 ] + +If the BIOS generates a very small ARM Processor Error, or +an incomplete one, the current logic will fail to deferrence + + err->section_length +and + ctx_info->size + +Add checks to avoid that. With such changes, such GHESv2 +records won't cause OOPSes like this: + +[ 1.492129] Internal error: Oops: 0000000096000005 [#1] SMP +[ 1.495449] Modules linked in: +[ 1.495820] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.18.0-rc1-00017-gabadcc3553dd-dirty #18 PREEMPT +[ 1.496125] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022 +[ 1.496433] Workqueue: kacpi_notify acpi_os_execute_deferred +[ 1.496967] pstate: 814000c5 (Nzcv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) +[ 1.497199] pc : log_arm_hw_error+0x5c/0x200 +[ 1.497380] lr : ghes_handle_arm_hw_error+0x94/0x220 + +0xffff8000811c5324 is in log_arm_hw_error (../drivers/ras/ras.c:75). +70 err_info = (struct cper_arm_err_info *)(err + 1); +71 ctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num); +72 ctx_err = (u8 *)ctx_info; +73 +74 for (n = 0; n < err->context_info_num; n++) { +75 sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size; +76 ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz); +77 ctx_len += sz; +78 } +79 + +and similar ones while trying to access section_length on an +error dump with too small size. + +Signed-off-by: Mauro Carvalho Chehab +Reviewed-by: Jonathan Cameron +Acked-by: Ard Biesheuvel +Reviewed-by: Hanjun Guo +[ rjw: Subject tweaks ] +Link: https://patch.msgid.link/7fd9f38413be05ee2d7cfdb0dc31ea2274cf1a54.1767871950.git.mchehab+huawei@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/apei/ghes.c | 32 ++++++++++++++++++++++++++++---- + drivers/ras/ras.c | 6 +++++- + 2 files changed, 33 insertions(+), 5 deletions(-) + +diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c +index a37c8fb574832..77ea7a5b761f1 100644 +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -556,21 +556,45 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, + { + struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata); + int flags = sync ? MF_ACTION_REQUIRED : 0; ++ int length = gdata->error_data_length; + char error_type[120]; + bool queued = false; + int sec_sev, i; + char *p; + + sec_sev = ghes_severity(gdata->error_severity); +- log_arm_hw_error(err, sec_sev); ++ if (length >= sizeof(*err)) { ++ log_arm_hw_error(err, sec_sev); ++ } else { ++ pr_warn(FW_BUG "arm error length: %d\n", length); ++ pr_warn(FW_BUG "length is too small\n"); ++ pr_warn(FW_BUG "firmware-generated error record is incorrect\n"); ++ return false; ++ } ++ + if (sev != GHES_SEV_RECOVERABLE || sec_sev != GHES_SEV_RECOVERABLE) + return false; + + p = (char *)(err + 1); ++ length -= sizeof(err); ++ + for (i = 0; i < err->err_info_num; i++) { +- struct cper_arm_err_info *err_info = (struct cper_arm_err_info *)p; +- bool is_cache = err_info->type & CPER_ARM_CACHE_ERROR; +- bool has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR); ++ struct cper_arm_err_info *err_info; ++ bool is_cache, has_pa; ++ ++ /* Ensure we have enough data for the error info header */ ++ if (length < sizeof(*err_info)) ++ break; ++ ++ err_info = (struct cper_arm_err_info *)p; ++ ++ /* Validate the claimed length before using it */ ++ length -= err_info->length; ++ if (length < 0) ++ break; ++ ++ is_cache = err_info->type & CPER_ARM_CACHE_ERROR; ++ has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR); + + /* + * The field (err_info->error_info & BIT(26)) is fixed to set to +diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c +index 2a5b5a9fdcb36..03df3db623346 100644 +--- a/drivers/ras/ras.c ++++ b/drivers/ras/ras.c +@@ -72,7 +72,11 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev) + ctx_err = (u8 *)ctx_info; + + for (n = 0; n < err->context_info_num; n++) { +- sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size; ++ sz = sizeof(struct cper_arm_ctx_info); ++ ++ if (sz + (long)ctx_info - (long)err >= err->section_length) ++ sz += ctx_info->size; ++ + ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz); + ctx_len += sz; + } +-- +2.51.0 + diff --git a/queue-6.19/apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch b/queue-6.19/apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch new file mode 100644 index 00000000000..d49a3de758b --- /dev/null +++ b/queue-6.19/apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch @@ -0,0 +1,137 @@ +From 15e6687ec479226d800224e49d8566e8c7f0e72c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:35:05 +0100 +Subject: APEI/GHES: ensure that won't go past CPER allocated record + +From: Mauro Carvalho Chehab + +[ Upstream commit fa2408a24f8f0db14d9cfc613ef162dc267d7ad4 ] + +The logic at ghes_new() prevents allocating too large records, by +checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB). +Yet, the allocation is done with the actual number of pages from the +CPER bios table location, which can be smaller. + +Yet, a bad firmware could send data with a different size, which might +be bigger than the allocated memory, causing an OOPS: + + Unable to handle kernel paging request at virtual address fff00000f9b40000 + Mem abort info: + ESR = 0x0000000096000007 + EC = 0x25: DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 + FSC = 0x07: level 3 translation fault + Data abort info: + ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 + CM = 0, WnR = 0, TnD = 0, TagAccess = 0 + GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 + swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000 + [fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000 + Internal error: Oops: 0000000096000007 [#1] SMP + Modules linked in: + CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT + Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022 + Workqueue: kacpi_notify acpi_os_execute_deferred + pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) + pc : hex_dump_to_buffer+0x30c/0x4a0 + lr : hex_dump_to_buffer+0x328/0x4a0 + sp : ffff800080e13880 + x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083 + x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004 + x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083 + x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010 + x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020 + x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008 + x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000 + x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020 + x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000 + x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008 + Call trace: + hex_dump_to_buffer+0x30c/0x4a0 (P) + print_hex_dump+0xac/0x170 + cper_estatus_print_section+0x90c/0x968 + cper_estatus_print+0xf0/0x158 + __ghes_print_estatus+0xa0/0x148 + ghes_proc+0x1bc/0x220 + ghes_notify_hed+0x5c/0xb8 + notifier_call_chain+0x78/0x148 + blocking_notifier_call_chain+0x4c/0x80 + acpi_hed_notify+0x28/0x40 + acpi_ev_notify_dispatch+0x50/0x80 + acpi_os_execute_deferred+0x24/0x48 + process_one_work+0x15c/0x3b0 + worker_thread+0x2d0/0x400 + kthread+0x148/0x228 + ret_from_fork+0x10/0x20 + Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44) + ---[ end trace 0000000000000000 ]--- + +Prevent that by taking the actual allocated are into account when +checking for CPER length. + +Signed-off-by: Mauro Carvalho Chehab +Reviewed-by: Jonathan Cameron +Acked-by: Ard Biesheuvel +Reviewed-by: Hanjun Guo +[ rjw: Subject tweaks ] +Link: https://patch.msgid.link/4e70310a816577fabf37d94ed36cde4ad62b1e0a.1767871950.git.mchehab+huawei@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/apei/ghes.c | 6 +++++- + include/acpi/ghes.h | 1 + + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c +index 0dc767392a6c6..a37c8fb574832 100644 +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -294,6 +295,7 @@ static struct ghes *ghes_new(struct acpi_hest_generic *generic) + error_block_length = GHES_ESTATUS_MAX_SIZE; + } + ghes->estatus = kmalloc(error_block_length, GFP_KERNEL); ++ ghes->estatus_length = error_block_length; + if (!ghes->estatus) { + rc = -ENOMEM; + goto err_unmap_status_addr; +@@ -365,13 +367,15 @@ static int __ghes_check_estatus(struct ghes *ghes, + struct acpi_hest_generic_status *estatus) + { + u32 len = cper_estatus_len(estatus); ++ u32 max_len = min(ghes->generic->error_block_length, ++ ghes->estatus_length); + + if (len < sizeof(*estatus)) { + pr_warn_ratelimited(FW_WARN GHES_PFX "Truncated error status block!\n"); + return -EIO; + } + +- if (len > ghes->generic->error_block_length) { ++ if (!len || len > max_len) { + pr_warn_ratelimited(FW_WARN GHES_PFX "Invalid error status block length!\n"); + return -EIO; + } +diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h +index ebd21b05fe6ed..93db60da5934e 100644 +--- a/include/acpi/ghes.h ++++ b/include/acpi/ghes.h +@@ -21,6 +21,7 @@ struct ghes { + struct acpi_hest_generic_v2 *generic_v2; + }; + struct acpi_hest_generic_status *estatus; ++ unsigned int estatus_length; + unsigned long flags; + union { + struct list_head list; +-- +2.51.0 + diff --git a/queue-6.19/arm-9467-1-mm-don-t-use-pk-through-printk.patch b/queue-6.19/arm-9467-1-mm-don-t-use-pk-through-printk.patch new file mode 100644 index 00000000000..7eda0ea6502 --- /dev/null +++ b/queue-6.19/arm-9467-1-mm-don-t-use-pk-through-printk.patch @@ -0,0 +1,42 @@ +From fa9b8834dc9f71fa7b70a8bf4be856c57130a36c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 10:56:33 +0100 +Subject: ARM: 9467/1: mm: Don't use %pK through printk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weissschuh + +[ Upstream commit 012ea376a5948b025f260aa45d2a6ec5d96674ea ] + +Restricted pointers ("%pK") were never meant to be used +through printk(). They can acquire sleeping locks in atomic contexts. + +Switch to %px over the more secure %p as this usage is a debugging aid, +gated behind CONFIG_DEBUG_VIRTUAL and used by WARN(). + +Link: https://lore.kernel.org/lkml/20250113171731-dc10e3c1-da64-4af0-b767-7c7070468023@linutronix.de/ +Signed-off-by: Thomas Weißschuh +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/mm/physaddr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/mm/physaddr.c b/arch/arm/mm/physaddr.c +index 3f263c840ebc4..1a37ebfacbba9 100644 +--- a/arch/arm/mm/physaddr.c ++++ b/arch/arm/mm/physaddr.c +@@ -38,7 +38,7 @@ static inline bool __virt_addr_valid(unsigned long x) + phys_addr_t __virt_to_phys(unsigned long x) + { + WARN(!__virt_addr_valid(x), +- "virt_to_phys used for non-linear address: %pK (%pS)\n", ++ "virt_to_phys used for non-linear address: %px (%pS)\n", + (void *)x, (void *)x); + + return __virt_to_phys_nodebug(x); +-- +2.51.0 + diff --git a/queue-6.19/arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch b/queue-6.19/arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch new file mode 100644 index 00000000000..3bc5df76960 --- /dev/null +++ b/queue-6.19/arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch @@ -0,0 +1,37 @@ +From e0c73cf95ab594b3c783ad681b2566af53d48e6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Dec 2025 17:24:48 +0800 +Subject: arm64: Add support for TSV110 Spectre-BHB mitigation + +From: Jinqian Yang + +[ Upstream commit e3baa5d4b361276efeb87b20d8beced451a7dbd5 ] + +The TSV110 processor is vulnerable to the Spectre-BHB (Branch History +Buffer) attack, which can be exploited to leak information through +branch prediction side channels. This commit adds the MIDR of TSV110 +to the list for software mitigation. + +Signed-off-by: Jinqian Yang +Reviewed-by: Zenghui Yu +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/proton-pack.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c +index 80a580e019c50..b3801f532b10b 100644 +--- a/arch/arm64/kernel/proton-pack.c ++++ b/arch/arm64/kernel/proton-pack.c +@@ -887,6 +887,7 @@ static u8 spectre_bhb_loop_affected(void) + MIDR_ALL_VERSIONS(MIDR_CORTEX_X2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), ++ MIDR_ALL_VERSIONS(MIDR_HISI_TSV110), + {}, + }; + static const struct midr_range spectre_bhb_k24_list[] = { +-- +2.51.0 + diff --git a/queue-6.19/arm64-ftrace-bpf-fix-partial-regs-after-bpf_prog_run.patch b/queue-6.19/arm64-ftrace-bpf-fix-partial-regs-after-bpf_prog_run.patch new file mode 100644 index 00000000000..c1088818775 --- /dev/null +++ b/queue-6.19/arm64-ftrace-bpf-fix-partial-regs-after-bpf_prog_run.patch @@ -0,0 +1,83 @@ +From 35ed926bafd216785f922097f8e839f4630ac86b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 13:11:56 +0100 +Subject: arm64/ftrace,bpf: Fix partial regs after bpf_prog_run + +From: Jiri Olsa + +[ Upstream commit 276f3b6daf6024ae2742afd161e7418a5584a660 ] + +Mahe reported issue with bpf_override_return helper not working when +executed from kprobe.multi bpf program on arm. + +The problem is that on arm we use alternate storage for pt_regs object +that is passed to bpf_prog_run and if any register is changed (which +is the case of bpf_override_return) it's not propagated back to actual +pt_regs object. + +Fixing this by introducing and calling ftrace_partial_regs_update function +to propagate the values of changed registers (ip and stack). + +Reported-by: Mahe Tardy +Signed-off-by: Jiri Olsa +Signed-off-by: Andrii Nakryiko +Reviewed-by: Steven Rostedt (Google) +Acked-by: Will Deacon +Link: https://lore.kernel.org/bpf/20260112121157.854473-1-jolsa@kernel.org +Signed-off-by: Sasha Levin +--- + include/linux/ftrace_regs.h | 25 +++++++++++++++++++++++++ + kernel/trace/bpf_trace.c | 1 + + 2 files changed, 26 insertions(+) + +diff --git a/include/linux/ftrace_regs.h b/include/linux/ftrace_regs.h +index 15627ceea9bcc..386fa48c4a957 100644 +--- a/include/linux/ftrace_regs.h ++++ b/include/linux/ftrace_regs.h +@@ -33,6 +33,31 @@ struct ftrace_regs; + #define ftrace_regs_get_frame_pointer(fregs) \ + frame_pointer(&arch_ftrace_regs(fregs)->regs) + ++static __always_inline void ++ftrace_partial_regs_update(struct ftrace_regs *fregs, struct pt_regs *regs) { } ++ ++#else ++ ++/* ++ * ftrace_partial_regs_update - update the original ftrace_regs from regs ++ * @fregs: The ftrace_regs to update from @regs ++ * @regs: The partial regs from ftrace_partial_regs() that was updated ++ * ++ * Some architectures have the partial regs living in the ftrace_regs ++ * structure, whereas other architectures need to make a different copy ++ * of the @regs. If a partial @regs is retrieved by ftrace_partial_regs() and ++ * if the code using @regs updates a field (like the instruction pointer or ++ * stack pointer) it may need to propagate that change to the original @fregs ++ * it retrieved the partial @regs from. Use this function to guarantee that ++ * update happens. ++ */ ++static __always_inline void ++ftrace_partial_regs_update(struct ftrace_regs *fregs, struct pt_regs *regs) ++{ ++ ftrace_regs_set_instruction_pointer(fregs, instruction_pointer(regs)); ++ ftrace_regs_set_return_value(fregs, regs_return_value(regs)); ++} ++ + #endif /* HAVE_ARCH_FTRACE_REGS */ + + /* This can be overridden by the architectures */ +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index 59c2394981c72..325579c7da260 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -2564,6 +2564,7 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link, + old_run_ctx = bpf_set_run_ctx(&run_ctx.session_ctx.run_ctx); + err = bpf_prog_run(link->link.prog, regs); + bpf_reset_run_ctx(old_run_ctx); ++ ftrace_partial_regs_update(fregs, bpf_kprobe_multi_pt_regs_ptr()); + rcu_read_unlock(); + + out: +-- +2.51.0 + diff --git a/queue-6.19/arm64-hugetlbpage-avoid-unused-but-set-parameter-war.patch b/queue-6.19/arm64-hugetlbpage-avoid-unused-but-set-parameter-war.patch new file mode 100644 index 00000000000..50ab3e7f4d7 --- /dev/null +++ b/queue-6.19/arm64-hugetlbpage-avoid-unused-but-set-parameter-war.patch @@ -0,0 +1,60 @@ +From 8d0306e642a437d89b909f456f601bdfb1f6de3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Feb 2026 11:54:21 +0100 +Subject: arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) + +From: Arnd Bergmann + +[ Upstream commit 729a2e8e9ac47099a967567389cc9d73ef4194ca ] + +gcc-16 warns about an instance that older compilers did not: + +arch/arm64/mm/hugetlbpage.c: In function 'huge_pte_clear': +arch/arm64/mm/hugetlbpage.c:369:57: error: parameter 'addr' set but not used [-Werror=unused-but-set-parameter=] + +The issue here is that __pte_clear() does not actually use its second +argument, but when CONFIG_ARM64_CONTPTE is enabled it still gets +updated. + +Replace the macro with an inline function to let the compiler see +the argument getting passed down. + +Suggested-by: Catalin Marinas +Signed-off-by: Arnd Bergmann +Reviewed-by: Dev Jain +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/pgtable.h | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h +index 64d5f1d9cce96..5ab5fe3bef25e 100644 +--- a/arch/arm64/include/asm/pgtable.h ++++ b/arch/arm64/include/asm/pgtable.h +@@ -179,8 +179,6 @@ static inline pteval_t __phys_to_pte_val(phys_addr_t phys) + __pte(__phys_to_pte_val((phys_addr_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot)) + + #define pte_none(pte) (!pte_val(pte)) +-#define __pte_clear(mm, addr, ptep) \ +- __set_pte(ptep, __pte(0)) + #define pte_page(pte) (pfn_to_page(pte_pfn(pte))) + + /* +@@ -1320,6 +1318,13 @@ static inline bool pud_user_accessible_page(pud_t pud) + /* + * Atomic pte/pmd modifications. + */ ++ ++static inline void __pte_clear(struct mm_struct *mm, ++ unsigned long addr, pte_t *ptep) ++{ ++ __set_pte(ptep, __pte(0)); ++} ++ + static inline int __ptep_test_and_clear_young(struct vm_area_struct *vma, + unsigned long address, + pte_t *ptep) +-- +2.51.0 + diff --git a/queue-6.19/arm64-mte-set-tcma1-whenever-mte-is-present-in-the-k.patch b/queue-6.19/arm64-mte-set-tcma1-whenever-mte-is-present-in-the-k.patch new file mode 100644 index 00000000000..09f34496564 --- /dev/null +++ b/queue-6.19/arm64-mte-set-tcma1-whenever-mte-is-present-in-the-k.patch @@ -0,0 +1,68 @@ +From b217685acb3d540c16a25464358de6b9c5d2252d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 15:07:18 -0800 +Subject: arm64: mte: Set TCMA1 whenever MTE is present in the kernel + +From: Carl Worth + +[ Upstream commit a4e5927115f30a301f9939ed43e6a21a343e06ad ] + +Set the TCMA1 bit so that access to TTBR1 addresses with 0xf in their +tag bits will be treated as tag unchecked. + +This is important to avoid unwanted tag checking on some +systems. Specifically, SCTLR_EL1.TCF can be set to indicate that no +tag check faults are desired. But the architecture doesn't guarantee +that in this case the system won't still perform tag checks. + +Use TCMA1 to ensure that undesired tag checks are not performed. This +bit was already set in the KASAN case. Adding it to the non-KASAN case +prevents tag checking since all TTBR1 address will have a value of 0xf +in their tag bits. + +This patch has been measured on an Ampere system to improve the following: + +* Eliminate over 98% of kernel-side tag checks during "perf bench + futex hash", as measured with "perf stat". + +* Eliminate all MTE overhead (was previously a 25% performance + penalty) from the Phoronix pts/memcached benchmark (1:10 Set:Get + ration with 96 cores). + +Reported-by: Taehyun Noh +Suggested-by: Catalin Marinas +Signed-off-by: Carl Worth +Reviewed-by: Catalin Marinas +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/mm/proc.S | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S +index 5d907ce3b6d3f..22866b49be372 100644 +--- a/arch/arm64/mm/proc.S ++++ b/arch/arm64/mm/proc.S +@@ -48,14 +48,14 @@ + #define TCR_KASAN_SW_FLAGS 0 + #endif + +-#ifdef CONFIG_KASAN_HW_TAGS +-#define TCR_MTE_FLAGS TCR_EL1_TCMA1 | TCR_EL1_TBI1 | TCR_EL1_TBID1 +-#elif defined(CONFIG_ARM64_MTE) ++#ifdef CONFIG_ARM64_MTE + /* + * The mte_zero_clear_page_tags() implementation uses DC GZVA, which relies on +- * TBI being enabled at EL1. ++ * TBI being enabled at EL1. TCMA1 is needed to treat accesses with the ++ * match-all tag (0xF) as Tag Unchecked, irrespective of the SCTLR_EL1.TCF ++ * setting. + */ +-#define TCR_MTE_FLAGS TCR_EL1_TBI1 | TCR_EL1_TBID1 ++#define TCR_MTE_FLAGS TCR_EL1_TCMA1 | TCR_EL1_TBI1 | TCR_EL1_TBID1 + #else + #define TCR_MTE_FLAGS 0 + #endif +-- +2.51.0 + diff --git a/queue-6.19/arm64-tegra-smaug-add-usb-role-switch-support.patch b/queue-6.19/arm64-tegra-smaug-add-usb-role-switch-support.patch new file mode 100644 index 00000000000..f81f3485336 --- /dev/null +++ b/queue-6.19/arm64-tegra-smaug-add-usb-role-switch-support.patch @@ -0,0 +1,37 @@ +From 5128128649de5518e16bd543641b6f691af770ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Dec 2025 21:27:21 +0000 +Subject: arm64: tegra: smaug: Add usb-role-switch support + +From: Diogo Ivo + +[ Upstream commit dfa93788dd8b2f9c59adf45ecf592082b1847b7b ] + +The USB2 port on Smaug is configured for OTG operation but lacked the +required 'usb-role-switch' property, leading to a failed probe and a +non-functioning USB port. Add the property along with setting the default +role to host. + +Signed-off-by: Diogo Ivo +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/nvidia/tegra210-smaug.dts | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts +index 5aa6afd56cbc6..dfbd1c72388c1 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts ++++ b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts +@@ -1809,6 +1809,8 @@ usb2-0 { + status = "okay"; + vbus-supply = <&usbc_vbus>; + mode = "otg"; ++ usb-role-switch; ++ role-switch-default-mode = "host"; + }; + + usb3-0 { +-- +2.51.0 + diff --git a/queue-6.19/asoc-amd-amd_sdw-add-machine-driver-quirk-for-lenovo.patch b/queue-6.19/asoc-amd-amd_sdw-add-machine-driver-quirk-for-lenovo.patch new file mode 100644 index 00000000000..0082d63752b --- /dev/null +++ b/queue-6.19/asoc-amd-amd_sdw-add-machine-driver-quirk-for-lenovo.patch @@ -0,0 +1,54 @@ +From c8e347f94b68f826524294a6b675bcc5c429ea56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Feb 2026 16:15:34 +0530 +Subject: ASoC: amd: amd_sdw: add machine driver quirk for Lenovo models + +From: Vijendar Mukunda + +[ Upstream commit 3acf517e1ae05ef66561b7a2782690387ce46e21 ] + +This patch adds a quirk to include the codec amplifier function for Lenovo +models listed in the quirk table. + +Note: In these models, the RT722 codec amplifier is excluded, and an +external amplifier is used instead. + +Signed-off-by: Vijendar Mukunda +Link: https://patch.msgid.link/20260218104734.3641481-3-Vijendar.Mukunda@amd.com +Reviewed-by: Mario Limonciello (AMD) +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/acp/acp-sdw-legacy-mach.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/sound/soc/amd/acp/acp-sdw-legacy-mach.c b/sound/soc/amd/acp/acp-sdw-legacy-mach.c +index fae94b9edd5a3..4f92de33a71a0 100644 +--- a/sound/soc/amd/acp/acp-sdw-legacy-mach.c ++++ b/sound/soc/amd/acp/acp-sdw-legacy-mach.c +@@ -95,6 +95,22 @@ static const struct dmi_system_id soc_sdw_quirk_table[] = { + }, + .driver_data = (void *)(ASOC_SDW_CODEC_SPKR), + }, ++ { ++ .callback = soc_sdw_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "21YW"), ++ }, ++ .driver_data = (void *)(ASOC_SDW_CODEC_SPKR), ++ }, ++ { ++ .callback = soc_sdw_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "21YX"), ++ }, ++ .driver_data = (void *)(ASOC_SDW_CODEC_SPKR), ++ }, + {} + }; + +-- +2.51.0 + diff --git a/queue-6.19/asoc-codecs-max98390-check-return-value-of-devm_gpio.patch b/queue-6.19/asoc-codecs-max98390-check-return-value-of-devm_gpio.patch new file mode 100644 index 00000000000..9dd531589fb --- /dev/null +++ b/queue-6.19/asoc-codecs-max98390-check-return-value-of-devm_gpio.patch @@ -0,0 +1,44 @@ +From eaa08ca86c1d41cf927199187fa0e955dd76fc46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 17:19:04 +0800 +Subject: ASoC: codecs: max98390: Check return value of + devm_gpiod_get_optional() in max98390_i2c_probe() + +From: Chen Ni + +[ Upstream commit a1d14d8364eac2611fe1391c73ff0e5b26064f0e ] + +The devm_gpiod_get_optional() function may return an error pointer +(ERR_PTR) in case of a genuine failure during GPIO acquisition, +not just NULL which indicates the legitimate absence of an optional +GPIO. + +Add an IS_ERR() check after the function call to catch such errors and +propagate them to the probe function, ensuring the driver fails to load +safely rather than proceeding with an invalid pointer. + +Signed-off-by: Chen Ni +Link: https://patch.msgid.link/20260130091904.3426149-1-nichen@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98390.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/codecs/max98390.c b/sound/soc/codecs/max98390.c +index 3dd4dd94bc371..ff58805e97d17 100644 +--- a/sound/soc/codecs/max98390.c ++++ b/sound/soc/codecs/max98390.c +@@ -1067,6 +1067,9 @@ static int max98390_i2c_probe(struct i2c_client *i2c) + + reset_gpio = devm_gpiod_get_optional(&i2c->dev, + "reset", GPIOD_OUT_HIGH); ++ if (IS_ERR(reset_gpio)) ++ return dev_err_probe(&i2c->dev, PTR_ERR(reset_gpio), ++ "Failed to get reset gpio\n"); + + /* Power on device */ + if (reset_gpio) { +-- +2.51.0 + diff --git a/queue-6.19/asoc-es8328-add-error-unwind-in-resume.patch b/queue-6.19/asoc-es8328-add-error-unwind-in-resume.patch new file mode 100644 index 00000000000..c2f4bb02ad5 --- /dev/null +++ b/queue-6.19/asoc-es8328-add-error-unwind-in-resume.patch @@ -0,0 +1,57 @@ +From 4ee8d20ca3b679dd458174585f7b0d763546fb1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Jan 2026 00:00:17 +0800 +Subject: ASoC: es8328: Add error unwind in resume + +From: Hsieh Hung-En + +[ Upstream commit 8232e6079ae6f8d3a61d87973cb427385aa469b9 ] + +Handle failures in the resume path by unwinding previously enabled +resources. + +If enabling regulators or syncing the regcache fails, disable regulators +and unprepare the clock to avoid leaking resources and leaving the device +in a partially resumed state. + +Signed-off-by: Hsieh Hung-En +Link: https://patch.msgid.link/20260130160017.2630-6-hungen3108@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/es8328.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c +index 1e11175cfbbbf..47c6b0c218b2c 100644 +--- a/sound/soc/codecs/es8328.c ++++ b/sound/soc/codecs/es8328.c +@@ -758,17 +758,23 @@ static int es8328_resume(struct snd_soc_component *component) + es8328->supplies); + if (ret) { + dev_err(component->dev, "unable to enable regulators\n"); +- return ret; ++ goto err_clk; + } + + regcache_mark_dirty(regmap); + ret = regcache_sync(regmap); + if (ret) { + dev_err(component->dev, "unable to sync regcache\n"); +- return ret; ++ goto err_regulators; + } + + return 0; ++ ++err_regulators: ++ regulator_bulk_disable(ARRAY_SIZE(es8328->supplies), es8328->supplies); ++err_clk: ++ clk_disable_unprepare(es8328->clk); ++ return ret; + } + + static int es8328_component_probe(struct snd_soc_component *component) +-- +2.51.0 + diff --git a/queue-6.19/asoc-fsl-imx-rpmsg-use-snd_soc_find_dai_with_mutex-i.patch b/queue-6.19/asoc-fsl-imx-rpmsg-use-snd_soc_find_dai_with_mutex-i.patch new file mode 100644 index 00000000000..fe9388a7df2 --- /dev/null +++ b/queue-6.19/asoc-fsl-imx-rpmsg-use-snd_soc_find_dai_with_mutex-i.patch @@ -0,0 +1,45 @@ +From fefca4bf916e7e4623c6826ef69a4fdace6e9e89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Feb 2026 05:24:29 +0000 +Subject: ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe + +From: Ziyi Guo + +[ Upstream commit 84faa91585fa22a161763f2fe8f84a602a196c87 ] + +imx_rpmsg_probe() calls snd_soc_find_dai() without holding client_mutex. +However, snd_soc_find_dai() has lockdep_assert_held(&client_mutex) +indicating callers must hold this lock, as the function iterates over the +global component list. + +All other callers of snd_soc_find_dai() either hold client_mutex via the +snd_soc_bind_card() path or use the snd_soc_find_dai_with_mutex() wrapper. + +Use snd_soc_find_dai_with_mutex() instead to fix the missing lock +protection. + +Signed-off-by: Ziyi Guo +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20260205052429.4046903-1-n7l8m4@u.northwestern.edu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/imx-rpmsg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/fsl/imx-rpmsg.c b/sound/soc/fsl/imx-rpmsg.c +index 53f04d1f32806..76a8e68c1b620 100644 +--- a/sound/soc/fsl/imx-rpmsg.c ++++ b/sound/soc/fsl/imx-rpmsg.c +@@ -145,7 +145,7 @@ static int imx_rpmsg_probe(struct platform_device *pdev) + data->dai.ignore_pmdown_time = 1; + + data->dai.cpus->dai_name = pdev->dev.platform_data; +- cpu_dai = snd_soc_find_dai(data->dai.cpus); ++ cpu_dai = snd_soc_find_dai_with_mutex(data->dai.cpus); + if (!cpu_dai) { + ret = -EPROBE_DEFER; + goto fail; +-- +2.51.0 + diff --git a/queue-6.19/asoc-qcom-q6asm-drop-dsp-responses-for-closed-data-s.patch b/queue-6.19/asoc-qcom-q6asm-drop-dsp-responses-for-closed-data-s.patch new file mode 100644 index 00000000000..b37697993d9 --- /dev/null +++ b/queue-6.19/asoc-qcom-q6asm-drop-dsp-responses-for-closed-data-s.patch @@ -0,0 +1,55 @@ +From e5d5920c79f7f1f6e71f83c3bc922a203ec0019f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jan 2026 22:52:25 +0100 +Subject: ASoC: qcom: q6asm: drop DSP responses for closed data streams +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cédric Bellegarde + +[ Upstream commit 8a066a81ee0c1b6cdbd81393536c3b2d19ccef25 ] + +'Commit a354f030dbce ("ASoC: qcom: q6asm: handle the responses +after closing")' attempted to ignore DSP responses arriving +after a stream had been closed. + +However, those responses were still handled, causing lockups. + +Fix this by unconditionally dropping all DSP responses associated with +closed data streams. + +Signed-off-by: Cédric Bellegarde +Link: https://patch.msgid.link/20260102215225.609166-1-cedric.bellegarde@adishatz.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/qcom/qdsp6/q6asm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/qcom/qdsp6/q6asm.c b/sound/soc/qcom/qdsp6/q6asm.c +index e7295b7b24610..3c4a24c9dba22 100644 +--- a/sound/soc/qcom/qdsp6/q6asm.c ++++ b/sound/soc/qcom/qdsp6/q6asm.c +@@ -638,7 +638,6 @@ static int32_t q6asm_stream_callback(struct apr_device *adev, + client_event = ASM_CLIENT_EVENT_CMD_OUT_FLUSH_DONE; + break; + case ASM_STREAM_CMD_OPEN_WRITE_V3: +- case ASM_DATA_CMD_WRITE_V2: + case ASM_STREAM_CMD_OPEN_READ_V3: + case ASM_STREAM_CMD_OPEN_READWRITE_V2: + case ASM_STREAM_CMD_SET_ENCDEC_PARAM: +@@ -657,8 +656,9 @@ static int32_t q6asm_stream_callback(struct apr_device *adev, + break; + case ASM_DATA_CMD_EOS: + case ASM_DATA_CMD_READ_V2: ++ case ASM_DATA_CMD_WRITE_V2: + /* response as result of close stream */ +- break; ++ goto done; + default: + dev_err(ac->dev, "command[0x%x] not expecting rsp\n", + result->opcode); +-- +2.51.0 + diff --git a/queue-6.19/asoc-rt721-sdca-fix-issue-of-fail-to-detect-omtp-jac.patch b/queue-6.19/asoc-rt721-sdca-fix-issue-of-fail-to-detect-omtp-jac.patch new file mode 100644 index 00000000000..d2e27b1fc7c --- /dev/null +++ b/queue-6.19/asoc-rt721-sdca-fix-issue-of-fail-to-detect-omtp-jac.patch @@ -0,0 +1,42 @@ +From 32e798062ef8fb17f8a2c25ade50f6ebe3e1fe92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Feb 2026 15:43:35 +0800 +Subject: ASoC: rt721-sdca: Fix issue of fail to detect OMTP jack type + +From: Jack Yu + +[ Upstream commit 5578da7d957fbaf91f6c39ba2363c2d2e4273183 ] + +Add related HP-JD settings to fix issue of fail to detect +OMTP jack type. + +Signed-off-by: Jack Yu +Link: https://patch.msgid.link/20260210074335.2337830-1-jack.yu@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt721-sdca.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/rt721-sdca.c b/sound/soc/codecs/rt721-sdca.c +index 8233532a1752a..35960c2252249 100644 +--- a/sound/soc/codecs/rt721-sdca.c ++++ b/sound/soc/codecs/rt721-sdca.c +@@ -245,12 +245,12 @@ static void rt721_sdca_jack_preset(struct rt721_sdca_priv *rt721) + regmap_write(rt721->mbq_regmap, 0x5b10007, 0x2000); + regmap_write(rt721->mbq_regmap, 0x5B10017, 0x1b0f); + rt_sdca_index_write(rt721->mbq_regmap, RT721_CBJ_CTRL, +- RT721_CBJ_A0_GAT_CTRL1, 0x2a02); ++ RT721_CBJ_A0_GAT_CTRL1, 0x2205); + rt_sdca_index_write(rt721->mbq_regmap, RT721_CAP_PORT_CTRL, + RT721_HP_AMP_2CH_CAL4, 0xa105); + rt_sdca_index_write(rt721->mbq_regmap, RT721_VENDOR_ANA_CTL, + RT721_UAJ_TOP_TCON14, 0x3b33); +- regmap_write(rt721->mbq_regmap, 0x310400, 0x3023); ++ regmap_write(rt721->mbq_regmap, 0x310400, 0x3043); + rt_sdca_index_write(rt721->mbq_regmap, RT721_VENDOR_ANA_CTL, + RT721_UAJ_TOP_TCON14, 0x3f33); + rt_sdca_index_write(rt721->mbq_regmap, RT721_VENDOR_ANA_CTL, +-- +2.51.0 + diff --git a/queue-6.19/asoc-sdw_utils-remove-dai-registered-check.patch b/queue-6.19/asoc-sdw_utils-remove-dai-registered-check.patch new file mode 100644 index 00000000000..e9fba80273a --- /dev/null +++ b/queue-6.19/asoc-sdw_utils-remove-dai-registered-check.patch @@ -0,0 +1,64 @@ +From db5bebf611e4ceaa31a473b604406eea40bac672 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 14:56:58 +0800 +Subject: ASoC: sdw_utils: remove dai registered check +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bard Liao + +[ Upstream commit 8d38c275f7ffe257d21bea224d4288eef183817d ] + +Checking for a registered DAI for non-existing endpoints causes the +following error. The driver will always return -EPROBE_DEFER if the +codec driver doesn't register the DAI of the unexist endpoint. + +Signed-off-by: Bard Liao +Reviewed-by: Péter Ujfalusi +Reviewed-by: Liam Girdwood +Reviewed-by: Charles Keepax +Link: https://patch.msgid.link/20260120065658.1806027-1-yung-chuan.liao@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sdw_utils/soc_sdw_utils.c | 15 --------------- + 1 file changed, 15 deletions(-) + +diff --git a/sound/soc/sdw_utils/soc_sdw_utils.c b/sound/soc/sdw_utils/soc_sdw_utils.c +index ccf149f949e8f..d03072cd13cb9 100644 +--- a/sound/soc/sdw_utils/soc_sdw_utils.c ++++ b/sound/soc/sdw_utils/soc_sdw_utils.c +@@ -1421,29 +1421,14 @@ static int is_sdca_endpoint_present(struct device *dev, + const struct snd_soc_acpi_adr_device *adr_dev = &adr_link->adr_d[adr_index]; + const struct snd_soc_acpi_endpoint *adr_end; + const struct asoc_sdw_dai_info *dai_info; +- struct snd_soc_dai_link_component *dlc; +- struct snd_soc_dai *codec_dai; + struct sdw_slave *slave; + struct device *sdw_dev; + const char *sdw_codec_name; + int ret, i; + +- dlc = kzalloc(sizeof(*dlc), GFP_KERNEL); +- if (!dlc) +- return -ENOMEM; +- + adr_end = &adr_dev->endpoints[end_index]; + dai_info = &codec_info->dais[adr_end->num]; + +- dlc->dai_name = dai_info->dai_name; +- codec_dai = snd_soc_find_dai_with_mutex(dlc); +- if (!codec_dai) { +- dev_warn(dev, "codec dai %s not registered yet\n", dlc->dai_name); +- kfree(dlc); +- return -EPROBE_DEFER; +- } +- kfree(dlc); +- + sdw_codec_name = _asoc_sdw_get_codec_name(dev, adr_link, adr_index); + if (!sdw_codec_name) + return -ENOMEM; +-- +2.51.0 + diff --git a/queue-6.19/asoc-soc-acpi-intel-arl-match-change-rt722-amp-endpo.patch b/queue-6.19/asoc-soc-acpi-intel-arl-match-change-rt722-amp-endpo.patch new file mode 100644 index 00000000000..257b89ce62b --- /dev/null +++ b/queue-6.19/asoc-soc-acpi-intel-arl-match-change-rt722-amp-endpo.patch @@ -0,0 +1,87 @@ +From 3e9c76ae43031470981cbc0861745059dca45dd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 17:17:48 +0800 +Subject: ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to + aggregated + +From: Bard Liao + +[ Upstream commit 08c09899960118ffb01417242e659eb6cc067d6a ] + +rt722 is aggregated with rt1320 amp in arl_rt722_l0_rt1320_l2 and it is +the only audio configuration in the ARL platform. Set .aggregated = 1 to +represent the fact and avoid unexpected issue. + +Signed-off-by: Bard Liao +Reviewed-by: Liam Girdwood +Reviewed-by: Ranjani Sridharan +Link: https://patch.msgid.link/20260119091749.1752088-2-yung-chuan.liao@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + .../intel/common/soc-acpi-intel-arl-match.c | 23 +++++++++---------- + 1 file changed, 11 insertions(+), 12 deletions(-) + +diff --git a/sound/soc/intel/common/soc-acpi-intel-arl-match.c b/sound/soc/intel/common/soc-acpi-intel-arl-match.c +index 6bf7a6250ddc3..c952f7d2b2c0e 100644 +--- a/sound/soc/intel/common/soc-acpi-intel-arl-match.c ++++ b/sound/soc/intel/common/soc-acpi-intel-arl-match.c +@@ -45,23 +45,22 @@ static const struct snd_soc_acpi_endpoint spk_3_endpoint = { + .group_id = 1, + }; + +-/* +- * RT722 is a multi-function codec, three endpoints are created for +- * its headset, amp and dmic functions. +- */ +-static const struct snd_soc_acpi_endpoint rt722_endpoints[] = { ++static const struct snd_soc_acpi_endpoint jack_amp_g1_dmic_endpoints[] = { ++ /* Jack Endpoint */ + { + .num = 0, + .aggregated = 0, + .group_position = 0, + .group_id = 0, + }, ++ /* Amp Endpoint, work as spk_l_endpoint */ + { + .num = 1, +- .aggregated = 0, ++ .aggregated = 1, + .group_position = 0, +- .group_id = 0, ++ .group_id = 1, + }, ++ /* DMIC Endpoint */ + { + .num = 2, + .aggregated = 0, +@@ -229,11 +228,11 @@ static const struct snd_soc_acpi_adr_device rt711_sdca_0_adr[] = { + } + }; + +-static const struct snd_soc_acpi_adr_device rt722_0_single_adr[] = { ++static const struct snd_soc_acpi_adr_device rt722_0_agg_adr[] = { + { + .adr = 0x000030025D072201ull, +- .num_endpoints = ARRAY_SIZE(rt722_endpoints), +- .endpoints = rt722_endpoints, ++ .num_endpoints = ARRAY_SIZE(jack_amp_g1_dmic_endpoints), ++ .endpoints = jack_amp_g1_dmic_endpoints, + .name_prefix = "rt722" + } + }; +@@ -394,8 +393,8 @@ static const struct snd_soc_acpi_link_adr arl_rt711_l0_rt1316_l3[] = { + static const struct snd_soc_acpi_link_adr arl_rt722_l0_rt1320_l2[] = { + { + .mask = BIT(0), +- .num_adr = ARRAY_SIZE(rt722_0_single_adr), +- .adr_d = rt722_0_single_adr, ++ .num_adr = ARRAY_SIZE(rt722_0_agg_adr), ++ .adr_d = rt722_0_agg_adr, + }, + { + .mask = BIT(2), +-- +2.51.0 + diff --git a/queue-6.19/asoc-soc-acpi-intel-ptl-match-use-aggregated-endpoin.patch b/queue-6.19/asoc-soc-acpi-intel-ptl-match-use-aggregated-endpoin.patch new file mode 100644 index 00000000000..e8e03c3f158 --- /dev/null +++ b/queue-6.19/asoc-soc-acpi-intel-ptl-match-use-aggregated-endpoin.patch @@ -0,0 +1,56 @@ +From 54966a1b75d05b5f3dd9afc243f52158849fe4b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 17:17:49 +0800 +Subject: ASoC: soc-acpi-intel-ptl-match: use aggregated endpoint in + ptl_rt722_l0_rt1320_l23 + +From: Bard Liao + +[ Upstream commit 4fbd3b2ec04dc6ef93090ec24733a5c5671fb71f ] + +The rt722 amp and rt1320 amps are aggregated in this case. + +Signed-off-by: Bard Liao +Reviewed-by: Liam Girdwood +Reviewed-by: Ranjani Sridharan +Link: https://patch.msgid.link/20260119091749.1752088-3-yung-chuan.liao@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/common/soc-acpi-intel-ptl-match.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/common/soc-acpi-intel-ptl-match.c b/sound/soc/intel/common/soc-acpi-intel-ptl-match.c +index e297c8ecedb72..1055fb4838f61 100644 +--- a/sound/soc/intel/common/soc-acpi-intel-ptl-match.c ++++ b/sound/soc/intel/common/soc-acpi-intel-ptl-match.c +@@ -383,6 +383,15 @@ static const struct snd_soc_acpi_link_adr ptl_rt721_l3[] = { + {}, + }; + ++static const struct snd_soc_acpi_adr_device rt722_0_agg_adr[] = { ++ { ++ .adr = 0x000030025d072201ull, ++ .num_endpoints = ARRAY_SIZE(jack_amp_g1_dmic_endpoints), ++ .endpoints = jack_amp_g1_dmic_endpoints, ++ .name_prefix = "rt722" ++ } ++}; ++ + static const struct snd_soc_acpi_adr_device rt722_0_single_adr[] = { + { + .adr = 0x000030025d072201ull, +@@ -536,8 +545,8 @@ static const struct snd_soc_acpi_link_adr ptl_rt722_l3[] = { + static const struct snd_soc_acpi_link_adr ptl_rt722_l0_rt1320_l23[] = { + { + .mask = BIT(0), +- .num_adr = ARRAY_SIZE(rt722_0_single_adr), +- .adr_d = rt722_0_single_adr, ++ .num_adr = ARRAY_SIZE(rt722_0_agg_adr), ++ .adr_d = rt722_0_agg_adr, + }, + { + .mask = BIT(2), +-- +2.51.0 + diff --git a/queue-6.19/asoc-sof-intel-hda-fix-null-pointer-dereference.patch b/queue-6.19/asoc-sof-intel-hda-fix-null-pointer-dereference.patch new file mode 100644 index 00000000000..9f8c23ae71d --- /dev/null +++ b/queue-6.19/asoc-sof-intel-hda-fix-null-pointer-dereference.patch @@ -0,0 +1,62 @@ +From 187dc06721943b6a9c92b3b26df7d04ab60b8c74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 10:18:32 +0200 +Subject: ASoC: SOF: Intel: hda: Fix NULL pointer dereference + +From: Ranjani Sridharan + +[ Upstream commit 16c589567a956d46a7c1363af3f64de3d420af20 ] + +If there's a mismatch between the DAI links in the machine driver and +the topology, it is possible that the playback/capture widget is not +set, especially in the case of loopback capture for echo reference +where we use the dummy DAI link. Return the error when the widget is not +set to avoid a null pointer dereference like below when the topology is +broken. + +RIP: 0010:hda_dai_get_ops.isra.0+0x14/0xa0 [snd_sof_intel_hda_common] + +Signed-off-by: Ranjani Sridharan +Reviewed-by: Bard Liao +Reviewed-by: Liam Girdwood +Reviewed-by: Mateusz Redzynia +Signed-off-by: Peter Ujfalusi +Link: https://patch.msgid.link/20260204081833.16630-10-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-dai.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sof/intel/hda-dai.c b/sound/soc/sof/intel/hda-dai.c +index 883d0d3bae9ec..3c742d5351333 100644 +--- a/sound/soc/sof/intel/hda-dai.c ++++ b/sound/soc/sof/intel/hda-dai.c +@@ -70,12 +70,22 @@ static const struct hda_dai_widget_dma_ops * + hda_dai_get_ops(struct snd_pcm_substream *substream, struct snd_soc_dai *cpu_dai) + { + struct snd_soc_dapm_widget *w = snd_soc_dai_get_widget(cpu_dai, substream->stream); +- struct snd_sof_widget *swidget = w->dobj.private; ++ struct snd_sof_widget *swidget; + struct snd_sof_dev *sdev; + struct snd_sof_dai *sdai; + +- sdev = widget_to_sdev(w); ++ /* ++ * this is unlikely if the topology and the machine driver DAI links match. ++ * But if there's a missing DAI link in topology, this will prevent a NULL pointer ++ * dereference later on. ++ */ ++ if (!w) { ++ dev_err(cpu_dai->dev, "%s: widget is NULL\n", __func__); ++ return NULL; ++ } + ++ sdev = widget_to_sdev(w); ++ swidget = w->dobj.private; + if (!swidget) { + dev_err(sdev->dev, "%s: swidget is NULL\n", __func__); + return NULL; +-- +2.51.0 + diff --git a/queue-6.19/asoc-sof-ipc4-support-for-sending-payload-along-with.patch b/queue-6.19/asoc-sof-ipc4-support-for-sending-payload-along-with.patch new file mode 100644 index 00000000000..ad9aa50ae6c --- /dev/null +++ b/queue-6.19/asoc-sof-ipc4-support-for-sending-payload-along-with.patch @@ -0,0 +1,130 @@ +From 7c8674e765960f70bc696630565047c5b33c3092 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Dec 2025 16:39:43 +0200 +Subject: ASoC: SOF: ipc4: Support for sending payload along with + LARGE_CONFIG_GET + +From: Peter Ujfalusi + +[ Upstream commit d96cb0b86d6e8bbbbfa425771606f6c1aebc318e ] + +There are message types when we would need to send a payload along with +the LARGE_CONFIG_GET message to provide information to the firmware on +what data is requested. +Such cases are the ALSA Kcontrol related messages when the high level +param_id tells only the type of the control, but the ID/index of the exact +control is specified in the payload area. + +The caller must place the payload for TX before calling the set_get_data() +and this payload will be sent alongside with the message to the firmware. + +The data area will be overwritten by the received data from firmware. + +Signed-off-by: Peter Ujfalusi +Reviewed-by: Seppo Ingalsuo +Reviewed-by: Ranjani Sridharan +Reviewed-by: Bard Liao +Reviewed-by: Kai Vehmanen +Link: https://patch.msgid.link/20251217143945.2667-7-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/ipc4.c | 44 ++++++++++++++++++++++++++++++++++++++++++-- + 1 file changed, 42 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sof/ipc4.c b/sound/soc/sof/ipc4.c +index a4a090e6724a6..20d723f48fff0 100644 +--- a/sound/soc/sof/ipc4.c ++++ b/sound/soc/sof/ipc4.c +@@ -15,6 +15,7 @@ + #include "sof-audio.h" + #include "ipc4-fw-reg.h" + #include "ipc4-priv.h" ++#include "ipc4-topology.h" + #include "ipc4-telemetry.h" + #include "ops.h" + +@@ -433,6 +434,23 @@ static int sof_ipc4_tx_msg(struct snd_sof_dev *sdev, void *msg_data, size_t msg_ + return ret; + } + ++static bool sof_ipc4_tx_payload_for_get_data(struct sof_ipc4_msg *tx) ++{ ++ /* ++ * Messages that require TX payload with LARGE_CONFIG_GET. ++ * The TX payload is placed into the IPC message data section by caller, ++ * which needs to be copied to temporary buffer since the received data ++ * will overwrite it. ++ */ ++ switch (tx->extension & SOF_IPC4_MOD_EXT_MSG_PARAM_ID_MASK) { ++ case SOF_IPC4_MOD_EXT_MSG_PARAM_ID(SOF_IPC4_SWITCH_CONTROL_PARAM_ID): ++ case SOF_IPC4_MOD_EXT_MSG_PARAM_ID(SOF_IPC4_ENUM_CONTROL_PARAM_ID): ++ return true; ++ default: ++ return false; ++ } ++} ++ + static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data, + size_t payload_bytes, bool set) + { +@@ -444,6 +462,8 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data, + struct sof_ipc4_msg tx = {{ 0 }}; + struct sof_ipc4_msg rx = {{ 0 }}; + size_t remaining = payload_bytes; ++ void *tx_payload_for_get = NULL; ++ size_t tx_data_size = 0; + size_t offset = 0; + size_t chunk_size; + int ret; +@@ -469,10 +489,20 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data, + + tx.extension |= SOF_IPC4_MOD_EXT_MSG_FIRST_BLOCK(1); + ++ if (sof_ipc4_tx_payload_for_get_data(&tx)) { ++ tx_data_size = min(ipc4_msg->data_size, payload_limit); ++ tx_payload_for_get = kmemdup(ipc4_msg->data_ptr, tx_data_size, ++ GFP_KERNEL); ++ if (!tx_payload_for_get) ++ return -ENOMEM; ++ } ++ + /* ensure the DSP is in D0i0 before sending IPC */ + ret = snd_sof_dsp_set_power_state(sdev, &target_state); +- if (ret < 0) ++ if (ret < 0) { ++ kfree(tx_payload_for_get); + return ret; ++ } + + /* Serialise IPC TX */ + mutex_lock(&sdev->ipc->tx_mutex); +@@ -506,7 +536,15 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data, + rx.data_size = chunk_size; + rx.data_ptr = ipc4_msg->data_ptr + offset; + +- tx_size = 0; ++ if (tx_payload_for_get) { ++ tx_size = tx_data_size; ++ tx.data_size = tx_size; ++ tx.data_ptr = tx_payload_for_get; ++ } else { ++ tx_size = 0; ++ tx.data_size = 0; ++ tx.data_ptr = NULL; ++ } + rx_size = chunk_size; + } + +@@ -553,6 +591,8 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data, + + mutex_unlock(&sdev->ipc->tx_mutex); + ++ kfree(tx_payload_for_get); ++ + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.19/asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch b/queue-6.19/asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch new file mode 100644 index 00000000000..bc4fc113fba --- /dev/null +++ b/queue-6.19/asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch @@ -0,0 +1,37 @@ +From 4be15ea9d30b8269ff738d44bbbaf6b82b2f243d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 11:32:50 +0800 +Subject: ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio + +From: Chen Ni + +[ Upstream commit 74823db9ba2e13f3ec007b354759b3d8125e462c ] + +Add check for the return value of devm_regmap_init_mmio() and return the +error if it fails in order to catch the error. + +Signed-off-by: Chen Ni +Link: https://patch.msgid.link/20260127033250.2044608-1-nichen@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sunxi/sun50i-dmic.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/sunxi/sun50i-dmic.c b/sound/soc/sunxi/sun50i-dmic.c +index bab1e29c99887..eddfebe166169 100644 +--- a/sound/soc/sunxi/sun50i-dmic.c ++++ b/sound/soc/sunxi/sun50i-dmic.c +@@ -358,6 +358,9 @@ static int sun50i_dmic_probe(struct platform_device *pdev) + + host->regmap = devm_regmap_init_mmio(&pdev->dev, base, + &sun50i_dmic_regmap_config); ++ if (IS_ERR(host->regmap)) ++ return dev_err_probe(&pdev->dev, PTR_ERR(host->regmap), ++ "failed to initialise regmap\n"); + + /* Clocks */ + host->bus_clk = devm_clk_get(&pdev->dev, "bus"); +-- +2.51.0 + diff --git a/queue-6.19/asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch b/queue-6.19/asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch new file mode 100644 index 00000000000..b9eb4d68875 --- /dev/null +++ b/queue-6.19/asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch @@ -0,0 +1,36 @@ +From 58dee49bb6437e5379c4448fc8755fd35f2a11cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 04:02:08 +0100 +Subject: ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask + +From: Sebastian Krzyszkowiak + +[ Upstream commit 66c26346ae30c883eef70acf9cf9054dfdb4fb2f ] + +This bit is handled by a separate control. + +Signed-off-by: Sebastian Krzyszkowiak +Reviewed-by: Charles Keepax +Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-1-f4f4eeacf089@puri.sm +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index e9e317ce68982..1040740fc80f8 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -1760,7 +1760,7 @@ SND_SOC_BYTES("EQR Coefficients", WM8962_EQ24, 18), + + + SOC_SINGLE("3D Switch", WM8962_THREED1, 0, 1, 0), +-SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA), ++SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA | WM8962_ADC_MONOMIX), + + SOC_SINGLE("DF1 Switch", WM8962_DF1, 0, 1, 0), + SND_SOC_BYTES_MASK("DF1 Coefficients", WM8962_DF1, 7, WM8962_DF1_ENA), +-- +2.51.0 + diff --git a/queue-6.19/asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch b/queue-6.19/asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch new file mode 100644 index 00000000000..efbaac3c298 --- /dev/null +++ b/queue-6.19/asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch @@ -0,0 +1,58 @@ +From a7f44eac50a89202646b6ca6913eb7b828d3174c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 04:02:10 +0100 +Subject: ASoC: wm8962: Don't report a microphone if it's shorted to ground on + plug + +From: Sebastian Krzyszkowiak + +[ Upstream commit e590752119029d87ce46d725e11245a52d22e1fe ] + +This usually means that a TRS plug with no microphone pin has been plugged +into a TRRS socket. Cases where a user is plugging in a microphone while +pressing a button will be handled via incoming interrupt after the user +releases the button, so the microphone will still be detected once it +becomes usable. + +Signed-off-by: Sebastian Krzyszkowiak +Reviewed-by: Charles Keepax +Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-3-f4f4eeacf089@puri.sm +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index 1040740fc80f8..bff8644674163 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -67,6 +67,8 @@ struct wm8962_priv { + struct mutex dsp2_ena_lock; + u16 dsp2_ena; + ++ int mic_status; ++ + struct delayed_work mic_work; + struct snd_soc_jack *jack; + +@@ -3081,8 +3083,16 @@ static void wm8962_mic_work(struct work_struct *work) + if (reg & WM8962_MICSHORT_STS) { + status |= SND_JACK_BTN_0; + irq_pol |= WM8962_MICSCD_IRQ_POL; ++ ++ /* Don't report a microphone if it's shorted right after ++ * plugging in, as this may be a TRS plug in a TRRS socket. ++ */ ++ if (!(wm8962->mic_status & WM8962_MICDET_STS)) ++ status = 0; + } + ++ wm8962->mic_status = status; ++ + snd_soc_jack_report(wm8962->jack, status, + SND_JACK_MICROPHONE | SND_JACK_BTN_0); + +-- +2.51.0 + diff --git a/queue-6.19/ata-libata-avoid-long-timeouts-on-hot-unplugged-sata.patch b/queue-6.19/ata-libata-avoid-long-timeouts-on-hot-unplugged-sata.patch new file mode 100644 index 00000000000..f580cbdc416 --- /dev/null +++ b/queue-6.19/ata-libata-avoid-long-timeouts-on-hot-unplugged-sata.patch @@ -0,0 +1,160 @@ +From b3f16c6d4fa5881725fedae39b7c23468393247e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 17:46:22 +0800 +Subject: ata: libata: avoid long timeouts on hot-unplugged SATA DAS + +From: Henry Tseng + +[ Upstream commit 151cabd140322205e27dae5c4bbf261ede0056e3 ] + +When a SATA DAS enclosure is connected behind a Thunderbolt PCIe +switch, hot-unplugging the whole enclosure causes pciehp to tear down +the PCI hierarchy before the SCSI layer issues SYNCHRONIZE CACHE and +START STOP UNIT for the disks. + +libata still queues these commands and the AHCI driver tries to access +the HBA registers even though the PCI channel is already offline. This +results in a series of timeouts and error recovery attempts, e.g.: + + [ 824.778346] pcieport 0000:00:07.0: pciehp: Slot(14): Link Down + [ 891.612720] ata8.00: qc timeout after 5000 msecs (cmd 0xec) + [ 902.876501] ata8.00: qc timeout after 10000 msecs (cmd 0xec) + [ 934.107998] ata8.00: qc timeout after 30000 msecs (cmd 0xec) + [ 936.206431] sd 7:0:0:0: [sda] Synchronize Cache(10) failed: + Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK + ... + [ 1006.298356] ata1.00: qc timeout after 5000 msecs (cmd 0xec) + [ 1017.561926] ata1.00: qc timeout after 10000 msecs (cmd 0xec) + [ 1048.791790] ata1.00: qc timeout after 30000 msecs (cmd 0xec) + [ 1050.890035] sd 0:0:0:0: [sdb] Synchronize Cache(10) failed: + Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK + +With this patch applied, the same hot-unplug looks like: + + [ 59.965496] pcieport 0000:00:07.0: pciehp: Slot(14): Link Down + [ 60.002502] sd 7:0:0:0: [sda] Synchronize Cache(10) failed: + Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK + ... + [ 60.103050] sd 0:0:0:0: [sdb] Synchronize Cache(10) failed: + Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK + +In this test setup with two disks, the hot-unplug sequence shrinks from +about 226 seconds (~3.8 minutes) between the Link Down event and the +last SYNCHRONIZE CACHE failure to under a second. Without this patch the +total delay grows roughly with the number of disks, because each disk +gets its own SYNCHRONIZE CACHE and qc timeout series. + +If the underlying PCI device is already gone, these commands cannot +succeed anyway. Avoid issuing them by introducing +ata_adapter_is_online(), which checks pci_channel_offline() for +PCI-based hosts. It is used from ata_scsi_find_dev() to return NULL, +causing the SCSI layer to fail new commands with DID_BAD_TARGET +immediately, and from ata_qc_issue() to bail out before touching the +HBA registers. + +Since such failures would otherwise trigger libata error handling, +ata_adapter_is_online() is also consulted from ata_scsi_port_error_handler(). +When the adapter is offline, libata skips ap->ops->error_handler(ap) and +completes error handling using the existing path, rather than running +a full EH sequence against a dead adapter. + +With this change, SYNCHRONIZE CACHE and START STOP UNIT commands +issued during hot-unplug fail quickly once the PCI channel is offline, +without qc timeout spam or long libata EH delays. + +Suggested-by: Damien Le Moal +Signed-off-by: Henry Tseng +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/libata-core.c | 24 ++++++++++++++++++++++++ + drivers/ata/libata-eh.c | 3 ++- + drivers/ata/libata-scsi.c | 3 +++ + drivers/ata/libata.h | 1 + + 4 files changed, 30 insertions(+), 1 deletion(-) + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 50dfce8d8bba0..db74417db75d9 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -2359,6 +2359,24 @@ static bool ata_dev_check_adapter(struct ata_device *dev, + return false; + } + ++bool ata_adapter_is_online(struct ata_port *ap) ++{ ++ struct device *dev; ++ ++ if (!ap || !ap->host) ++ return false; ++ ++ dev = ap->host->dev; ++ if (!dev) ++ return false; ++ ++ if (dev_is_pci(dev) && ++ pci_channel_offline(to_pci_dev(dev))) ++ return false; ++ ++ return true; ++} ++ + static int ata_dev_config_ncq(struct ata_device *dev, + char *desc, size_t desc_sz) + { +@@ -5135,6 +5153,12 @@ void ata_qc_issue(struct ata_queued_cmd *qc) + qc->flags |= ATA_QCFLAG_ACTIVE; + ap->qc_active |= 1ULL << qc->tag; + ++ /* Make sure the device is still accessible. */ ++ if (!ata_adapter_is_online(ap)) { ++ qc->err_mask |= AC_ERR_HOST_BUS; ++ goto sys_err; ++ } ++ + /* + * We guarantee to LLDs that they will have at least one + * non-zero sg if the command is a data command. +diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c +index 258e657f3527c..b373cceb95d23 100644 +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -752,7 +752,8 @@ void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap) + spin_unlock_irqrestore(ap->lock, flags); + + /* invoke EH, skip if unloading or suspended */ +- if (!(ap->pflags & (ATA_PFLAG_UNLOADING | ATA_PFLAG_SUSPENDED))) ++ if (!(ap->pflags & (ATA_PFLAG_UNLOADING | ATA_PFLAG_SUSPENDED)) && ++ ata_adapter_is_online(ap)) + ap->ops->error_handler(ap); + else { + /* if unloading, commence suicide */ +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index 5f9abeb7b2a88..6b954efa9adb1 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -3094,6 +3094,9 @@ ata_scsi_find_dev(struct ata_port *ap, const struct scsi_device *scsidev) + { + struct ata_device *dev = __ata_scsi_find_dev(ap, scsidev); + ++ if (!ata_adapter_is_online(ap)) ++ return NULL; ++ + if (unlikely(!dev || !ata_dev_enabled(dev))) + return NULL; + +diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h +index 60a675df61dc7..9b4e578ad07ec 100644 +--- a/drivers/ata/libata.h ++++ b/drivers/ata/libata.h +@@ -94,6 +94,7 @@ extern int atapi_check_dma(struct ata_queued_cmd *qc); + extern void swap_buf_le16(u16 *buf, unsigned int buf_words); + extern bool ata_phys_link_online(struct ata_link *link); + extern bool ata_phys_link_offline(struct ata_link *link); ++bool ata_adapter_is_online(struct ata_port *ap); + extern void ata_dev_init(struct ata_device *dev); + extern void ata_link_init(struct ata_port *ap, struct ata_link *link, int pmp); + extern int sata_link_init_spd(struct ata_link *link); +-- +2.51.0 + diff --git a/queue-6.19/audit-add-fchmodat2-to-change-attributes-class.patch b/queue-6.19/audit-add-fchmodat2-to-change-attributes-class.patch new file mode 100644 index 00000000000..432df46990c --- /dev/null +++ b/queue-6.19/audit-add-fchmodat2-to-change-attributes-class.patch @@ -0,0 +1,42 @@ +From 5dc6df32fbca7e00a27f91502c9d7bb88ca88b88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 20:49:30 +0100 +Subject: audit: add fchmodat2() to change attributes class + +From: Jeffrey Bencteux + +[ Upstream commit 4f493a6079b588cf1f04ce5ed6cdad45ab0d53dc ] + +fchmodat2(), introduced in version 6.6 is currently not in the change +attribute class of audit. Calling fchmodat2() to change a file +attribute in the same fashion than chmod() or fchmodat() will bypass +audit rules such as: + +-w /tmp/test -p rwa -k test_rwa + +The current patch adds fchmodat2() to the change attributes class. + +Signed-off-by: Jeffrey Bencteux +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + include/asm-generic/audit_change_attr.h | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/include/asm-generic/audit_change_attr.h b/include/asm-generic/audit_change_attr.h +index cc840537885fb..ddd90bbe40dfc 100644 +--- a/include/asm-generic/audit_change_attr.h ++++ b/include/asm-generic/audit_change_attr.h +@@ -26,6 +26,9 @@ __NR_fremovexattr, + __NR_fchownat, + __NR_fchmodat, + #endif ++#ifdef __NR_fchmodat2 ++__NR_fchmodat2, ++#endif + #ifdef __NR_chown32 + __NR_chown32, + __NR_fchown32, +-- +2.51.0 + diff --git a/queue-6.19/audit-add-missing-syscalls-to-read-class.patch b/queue-6.19/audit-add-missing-syscalls-to-read-class.patch new file mode 100644 index 00000000000..383ab9f8d6f --- /dev/null +++ b/queue-6.19/audit-add-missing-syscalls-to-read-class.patch @@ -0,0 +1,47 @@ +From e16855bde56ab2390f30696c36cf5c94e14aa674 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Dec 2025 09:39:24 +0100 +Subject: audit: add missing syscalls to read class + +From: Jeffrey Bencteux + +[ Upstream commit bcb90a2834c7393c26df9609b889a3097b7700cd ] + +The "at" variant of getxattr() and listxattr() are missing from the +audit read class. Calling getxattrat() or listxattrat() on a file to +read its extended attributes will bypass audit rules such as: + +-w /tmp/test -p rwa -k test_rwa + +The current patch adds missing syscalls to the audit read class. + +Signed-off-by: Jeffrey Bencteux +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + include/asm-generic/audit_read.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/include/asm-generic/audit_read.h b/include/asm-generic/audit_read.h +index 7bb7b5a83ae2e..fb9991f53fb6f 100644 +--- a/include/asm-generic/audit_read.h ++++ b/include/asm-generic/audit_read.h +@@ -4,9 +4,15 @@ __NR_readlink, + #endif + __NR_quotactl, + __NR_listxattr, ++#ifdef __NR_listxattrat ++__NR_listxattrat, ++#endif + __NR_llistxattr, + __NR_flistxattr, + __NR_getxattr, ++#ifdef __NR_getxattrat ++__NR_getxattrat, ++#endif + __NR_lgetxattr, + __NR_fgetxattr, + #ifdef __NR_readlinkat +-- +2.51.0 + diff --git a/queue-6.19/binder-don-t-use-pk-through-printk.patch b/queue-6.19/binder-don-t-use-pk-through-printk.patch new file mode 100644 index 00000000000..b63a22e5495 --- /dev/null +++ b/queue-6.19/binder-don-t-use-pk-through-printk.patch @@ -0,0 +1,83 @@ +From c053da66a62c842513d4836256b349615b71ac99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 15:29:50 +0100 +Subject: binder: don't use %pK through printk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 56d21267663bad91e8b10121224ec46366a7937e ] + +In the past %pK was preferable to %p as it would not leak raw pointer +values into the kernel log. Since commit ad67b74d2469 ("printk: hash +addresses printed with %p") the regular %p has been improved to avoid +this issue. Furthermore, restricted pointers ("%pK") were never meant +to be used through printk(). They can still unintentionally leak raw +pointers or acquire sleeping locks in atomic contexts. + +Switch to the regular pointer formatting which is safer and +easier to reason about. + +There are still a few users of %pK left, but these use it through +seq_file, for which its usage is safe. + +Signed-off-by: Thomas Weißschuh +Acked-by: Carlos Llamas +Reviewed-by: Alice Ryhl +Link: https://patch.msgid.link/20260107-restricted-pointers-binder-v1-1-181018bf3812@linutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/android/binder.c | 2 +- + drivers/android/binder_alloc.c | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/android/binder.c b/drivers/android/binder.c +index b356c9b882544..33e4dad0915bb 100644 +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -4523,7 +4523,7 @@ static int binder_thread_write(struct binder_proc *proc, + } + } + binder_debug(BINDER_DEBUG_DEAD_BINDER, +- "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n", ++ "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n", + proc->pid, thread->pid, (u64)cookie, + death); + if (death == NULL) { +diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c +index 979c96b74cad3..d5ed64543bbf4 100644 +--- a/drivers/android/binder_alloc.c ++++ b/drivers/android/binder_alloc.c +@@ -81,7 +81,7 @@ static void binder_insert_free_buffer(struct binder_alloc *alloc, + new_buffer_size = binder_alloc_buffer_size(alloc, new_buffer); + + binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC, +- "%d: add free buffer, size %zd, at %pK\n", ++ "%d: add free buffer, size %zd, at %p\n", + alloc->pid, new_buffer_size, new_buffer); + + while (*p) { +@@ -572,7 +572,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked( + } + + binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC, +- "%d: binder_alloc_buf size %zd got buffer %pK size %zd\n", ++ "%d: binder_alloc_buf size %zd got buffer %p size %zd\n", + alloc->pid, size, buffer, buffer_size); + + /* +@@ -748,7 +748,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc, + ALIGN(buffer->extra_buffers_size, sizeof(void *)); + + binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC, +- "%d: binder_free_buf %pK size %zd buffer_size %zd\n", ++ "%d: binder_free_buf %p size %zd buffer_size %zd\n", + alloc->pid, buffer, size, buffer_size); + + BUG_ON(buffer->free); +-- +2.51.0 + diff --git a/queue-6.19/blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch b/queue-6.19/blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch new file mode 100644 index 00000000000..d13058d1992 --- /dev/null +++ b/queue-6.19/blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch @@ -0,0 +1,42 @@ +From 5cb1e917cf390f5a40147996bd0d2657dcc6b64f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 16:05:22 +0800 +Subject: blk-mq-debugfs: add missing debugfs_mutex in + blk_mq_debugfs_register_hctxs() + +From: Yu Kuai + +[ Upstream commit 9d20fd6ce1ba9733cd5ac96fcab32faa9fc404dd ] + +In blk_mq_update_nr_hw_queues(), debugfs_mutex is not held while +creating debugfs entries for hctxs. Hence add debugfs_mutex there, +it's safe because queue is not frozen. + +Signed-off-by: Yu Kuai +Reviewed-by: Nilay Shroff +Reviewed-by: Ming Lei +Reviewed-by: Hannes Reinecke +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-debugfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c +index 4896525b1c054..553d93b88e194 100644 +--- a/block/blk-mq-debugfs.c ++++ b/block/blk-mq-debugfs.c +@@ -686,8 +686,10 @@ void blk_mq_debugfs_register_hctxs(struct request_queue *q) + struct blk_mq_hw_ctx *hctx; + unsigned long i; + ++ mutex_lock(&q->debugfs_mutex); + queue_for_each_hw_ctx(q, hctx, i) + blk_mq_debugfs_register_hctx(q, hctx); ++ mutex_unlock(&q->debugfs_mutex); + } + + void blk_mq_debugfs_unregister_hctxs(struct request_queue *q) +-- +2.51.0 + diff --git a/queue-6.19/blk-mq-sched-unify-elevators-checking-for-async-requ.patch b/queue-6.19/blk-mq-sched-unify-elevators-checking-for-async-requ.patch new file mode 100644 index 00000000000..03b364ab403 --- /dev/null +++ b/queue-6.19/blk-mq-sched-unify-elevators-checking-for-async-requ.patch @@ -0,0 +1,87 @@ +From 0c250449a82924600d4829e211ef7580c9d67044 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 16:19:43 +0800 +Subject: blk-mq-sched: unify elevators checking for async requests + +From: Yu Kuai + +[ Upstream commit 1db61b0afdd7e8aa9289c423fdff002603b520b5 ] + +bfq and mq-deadline consider sync writes as async requests and only +reserve tags for sync reads by async_depth, however, kyber doesn't +consider sync writes as async requests for now. + +Consider the case there are lots of dirty pages, and user use fsync to +flush dirty pages. In this case sched_tags can be exhausted by sync writes +and sync reads can stuck waiting for tag. Hence let kyber follow what +mq-deadline and bfq did, and unify async requests checking for all +elevators. + +Signed-off-by: Yu Kuai +Reviewed-by: Nilay Shroff +Reviewed-by: Hannes Reinecke +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bfq-iosched.c | 2 +- + block/blk-mq-sched.h | 5 +++++ + block/kyber-iosched.c | 2 +- + block/mq-deadline.c | 2 +- + 4 files changed, 8 insertions(+), 3 deletions(-) + +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index 6e54b1d3d8bc2..9e9d081e86bb2 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -697,7 +697,7 @@ static void bfq_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data) + unsigned int limit, act_idx; + + /* Sync reads have full depth available */ +- if (op_is_sync(opf) && !op_is_write(opf)) ++ if (blk_mq_is_sync_read(opf)) + limit = data->q->nr_requests; + else + limit = bfqd->async_depths[!!bfqd->wr_busy_queues][op_is_sync(opf)]; +diff --git a/block/blk-mq-sched.h b/block/blk-mq-sched.h +index 02c40a72e9598..5678e15bd33c4 100644 +--- a/block/blk-mq-sched.h ++++ b/block/blk-mq-sched.h +@@ -137,4 +137,9 @@ static inline void blk_mq_set_min_shallow_depth(struct request_queue *q, + depth); + } + ++static inline bool blk_mq_is_sync_read(blk_opf_t opf) ++{ ++ return op_is_sync(opf) && !op_is_write(opf); ++} ++ + #endif +diff --git a/block/kyber-iosched.c b/block/kyber-iosched.c +index c1b36ffd19ceb..2b3f5b8959af0 100644 +--- a/block/kyber-iosched.c ++++ b/block/kyber-iosched.c +@@ -556,7 +556,7 @@ static void kyber_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data) + * We use the scheduler tags as per-hardware queue queueing tokens. + * Async requests can be limited at this stage. + */ +- if (!op_is_sync(opf)) { ++ if (!blk_mq_is_sync_read(opf)) { + struct kyber_queue_data *kqd = data->q->elevator->elevator_data; + + data->shallow_depth = kqd->async_depth; +diff --git a/block/mq-deadline.c b/block/mq-deadline.c +index 3e3719093aec7..29d00221fbea6 100644 +--- a/block/mq-deadline.c ++++ b/block/mq-deadline.c +@@ -495,7 +495,7 @@ static void dd_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data) + struct deadline_data *dd = data->q->elevator->elevator_data; + + /* Do not throttle synchronous reads. */ +- if (op_is_sync(opf) && !op_is_write(opf)) ++ if (blk_mq_is_sync_read(opf)) + return; + + /* +-- +2.51.0 + diff --git a/queue-6.19/block-decouple-secure-erase-size-limit-from-discard-.patch b/queue-6.19/block-decouple-secure-erase-size-limit-from-discard-.patch new file mode 100644 index 00000000000..00ab3a6d13c --- /dev/null +++ b/queue-6.19/block-decouple-secure-erase-size-limit-from-discard-.patch @@ -0,0 +1,91 @@ +From 5875d04c3bae21d5e780ec602224ff1fc718de99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 11:40:02 +0800 +Subject: block: decouple secure erase size limit from discard size limit + +From: Luke Wang + +[ Upstream commit ee81212f74a57c5d2b56cf504f40d528dac6faaf ] + +Secure erase should use max_secure_erase_sectors instead of being limited +by max_discard_sectors. Separate the handling of REQ_OP_SECURE_ERASE from +REQ_OP_DISCARD to allow each operation to use its own size limit. + +Signed-off-by: Luke Wang +Reviewed-by: Ulf Hansson +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-merge.c | 21 +++++++++++++++++---- + block/blk.h | 6 +++++- + 2 files changed, 22 insertions(+), 5 deletions(-) + +diff --git a/block/blk-merge.c b/block/blk-merge.c +index d3115d7469df0..bf8faadb0bd46 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -158,8 +158,9 @@ static struct bio *bio_submit_split(struct bio *bio, int split_sectors) + return bio; + } + +-struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim, +- unsigned *nsegs) ++static struct bio *__bio_split_discard(struct bio *bio, ++ const struct queue_limits *lim, unsigned *nsegs, ++ unsigned int max_sectors) + { + unsigned int max_discard_sectors, granularity; + sector_t tmp; +@@ -169,8 +170,7 @@ struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim, + + granularity = max(lim->discard_granularity >> 9, 1U); + +- max_discard_sectors = +- min(lim->max_discard_sectors, bio_allowed_max_sectors(lim)); ++ max_discard_sectors = min(max_sectors, bio_allowed_max_sectors(lim)); + max_discard_sectors -= max_discard_sectors % granularity; + if (unlikely(!max_discard_sectors)) + return bio; +@@ -194,6 +194,19 @@ struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim, + return bio_submit_split(bio, split_sectors); + } + ++struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim, ++ unsigned *nsegs) ++{ ++ unsigned int max_sectors; ++ ++ if (bio_op(bio) == REQ_OP_SECURE_ERASE) ++ max_sectors = lim->max_secure_erase_sectors; ++ else ++ max_sectors = lim->max_discard_sectors; ++ ++ return __bio_split_discard(bio, lim, nsegs, max_sectors); ++} ++ + static inline unsigned int blk_boundary_sectors(const struct queue_limits *lim, + bool is_atomic) + { +diff --git a/block/blk.h b/block/blk.h +index e4c433f62dfc7..4cd5a91346d8a 100644 +--- a/block/blk.h ++++ b/block/blk.h +@@ -208,10 +208,14 @@ static inline unsigned int blk_queue_get_max_sectors(struct request *rq) + struct request_queue *q = rq->q; + enum req_op op = req_op(rq); + +- if (unlikely(op == REQ_OP_DISCARD || op == REQ_OP_SECURE_ERASE)) ++ if (unlikely(op == REQ_OP_DISCARD)) + return min(q->limits.max_discard_sectors, + UINT_MAX >> SECTOR_SHIFT); + ++ if (unlikely(op == REQ_OP_SECURE_ERASE)) ++ return min(q->limits.max_secure_erase_sectors, ++ UINT_MAX >> SECTOR_SHIFT); ++ + if (unlikely(op == REQ_OP_WRITE_ZEROES)) + return q->limits.max_write_zeroes_sectors; + +-- +2.51.0 + diff --git a/queue-6.19/block-fix-partial-iova-mapping-cleanup-in-blk_rq_dma.patch b/queue-6.19/block-fix-partial-iova-mapping-cleanup-in-blk_rq_dma.patch new file mode 100644 index 00000000000..af134015438 --- /dev/null +++ b/queue-6.19/block-fix-partial-iova-mapping-cleanup-in-blk_rq_dma.patch @@ -0,0 +1,67 @@ +From 8032a4dac54154a260b095d2f71f7d8cf75130ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Feb 2026 12:49:44 -0800 +Subject: block: fix partial IOVA mapping cleanup in blk_rq_dma_map_iova + +From: Chaitanya Kulkarni + +[ Upstream commit 81e7223b1a2d63b655ee72577c8579f968d037e3 ] + +When dma_iova_link() fails partway through mapping a request's bvec +list, the function breaks out of the loop without cleaning up +already mapped segments. Similarly, if dma_iova_sync() fails after +linking all segments, no cleanup is performed. + +This leaves partial IOVA mappings in place. The completion path +attempts to unmap the full expected size via dma_iova_destroy() or +nvme_unmap_data(), but only a partial size was actually mapped, +leading to incorrect unmap operations. + +Add an out_unlink error path that calls dma_iova_destroy() to clean +up partial mappings before returning failure. The dma_iova_destroy() +function handles both partial unlink and IOVA space freeing. It +correctly handles the mapped_len == 0 case (first dma_iova_link() +failure) by only freeing the IOVA allocation without attempting to +unmap. + +Signed-off-by: Chaitanya Kulkarni +Reviewed-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-dma.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/block/blk-mq-dma.c b/block/blk-mq-dma.c +index fb018fffffdcc..feead1934301a 100644 +--- a/block/blk-mq-dma.c ++++ b/block/blk-mq-dma.c +@@ -126,17 +126,20 @@ static bool blk_rq_dma_map_iova(struct request *req, struct device *dma_dev, + error = dma_iova_link(dma_dev, state, vec->paddr, mapped, + vec->len, dir, attrs); + if (error) +- break; ++ goto out_unlink; + mapped += vec->len; + } while (blk_map_iter_next(req, &iter->iter, vec)); + + error = dma_iova_sync(dma_dev, state, 0, mapped); +- if (error) { +- iter->status = errno_to_blk_status(error); +- return false; +- } ++ if (error) ++ goto out_unlink; + + return true; ++ ++out_unlink: ++ dma_iova_destroy(dma_dev, state, mapped, dir, attrs); ++ iter->status = errno_to_blk_status(error); ++ return false; + } + + static inline void blk_rq_map_iter_init(struct request *rq, +-- +2.51.0 + diff --git a/queue-6.19/bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch b/queue-6.19/bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch new file mode 100644 index 00000000000..278b4eb312e --- /dev/null +++ b/queue-6.19/bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch @@ -0,0 +1,37 @@ +From b07ad3fd26fb1dde2fa24acab4e2b37f6246f5c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 10:13:04 +0100 +Subject: Bluetooth: btusb: Add device ID for Realtek RTL8761BU + +From: Jacopo Scannella + +[ Upstream commit cc6383d4f0cf6127c0552f94cae517a06ccc6b17 ] + +Add USB device ID 0x2c0a:0x8761 to the btusb driver fo the Realtek +RTL8761BU Bluetooth adapter. + +Reference: +https://www.startech.com/en-us/networking-io/av53c1-usb-bluetooth + +Signed-off-by: Jacopo Scannella +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index f177569978d36..a41bb1e2a279a 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -781,6 +781,7 @@ static const struct usb_device_id quirks_table[] = { + + /* Additional Realtek 8723BU Bluetooth devices */ + { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK }, ++ { USB_DEVICE(0x2c0a, 0x8761), .driver_info = BTUSB_REALTEK }, + + /* Additional Realtek 8723DE Bluetooth devices */ + { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK }, +-- +2.51.0 + diff --git a/queue-6.19/bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch b/queue-6.19/bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch new file mode 100644 index 00000000000..3499b0f42cc --- /dev/null +++ b/queue-6.19/bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch @@ -0,0 +1,74 @@ +From b0943674350f895dfc221aefd3b77dd8f623ad67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 15:03:35 +1100 +Subject: Bluetooth: btusb: Add new VID/PID for RTL8852CE + +From: Shell Chen + +[ Upstream commit d9f7c39c6b7548bd70519b241b6c2d1bcc658d4b ] + +Add VID:PID 13d3:3612 to the quirks_table. + +This ID pair is found in the Realtek RTL8852CE PCIe module +in an ASUS TUF A14 2025 (FA401KM) laptop. + +Tested on aforementioned laptop. + +The device info from /sys/kernel/debug/usb/devices is listed as below. + +T: Bus=03 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 +D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=13d3 ProdID=3612 Rev= 0.00 +S: Manufacturer=Realtek +S: Product=Bluetooth Radio +S: SerialNumber=00e04c000001 +C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms + +Signed-off-by: Shell Chen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 66e266e93cc12..f177569978d36 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -561,6 +561,8 @@ static const struct usb_device_id quirks_table[] = { + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x13d3, 0x3592), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, ++ { USB_DEVICE(0x13d3, 0x3612), .driver_info = BTUSB_REALTEK | ++ BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0489, 0xe122), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, + +-- +2.51.0 + diff --git a/queue-6.19/bluetooth-btusb-add-support-for-mediatek7920-0489-e1.patch b/queue-6.19/bluetooth-btusb-add-support-for-mediatek7920-0489-e1.patch new file mode 100644 index 00000000000..4c04ac0f6fa --- /dev/null +++ b/queue-6.19/bluetooth-btusb-add-support-for-mediatek7920-0489-e1.patch @@ -0,0 +1,76 @@ +From 9b267775b1aefa6a1beeb312106775728c67d856 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Dec 2025 23:22:25 +0300 +Subject: Bluetooth: btusb: Add support for MediaTek7920 0489:e158 + +From: Bluecross + +[ Upstream commit 2630bcc8343a9d2a38dc1793068e6754b3156811 ] + +Add support for MediaTek7920 0489:e158 + +/sys/kernel/debug/usb/devices reports for that device: + +T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=03 Dev#= 5 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=0489 ProdID=e158 Rev= 1.00 +S: Manufacturer=MediaTek Inc. +S: Product=Wireless_Device +S: SerialNumber=000000000 +C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA +A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) +E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us +E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us +I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) +E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us +E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us + +Signed-off-by: Andrew Elatsev +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 80ccfa8fd982a..ef08567a7487c 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -639,6 +639,8 @@ static const struct usb_device_id quirks_table[] = { + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x13d3, 0x3622), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH }, ++ { USB_DEVICE(0x0489, 0xe158), .driver_info = BTUSB_MEDIATEK | ++ BTUSB_WIDEBAND_SPEECH }, + + /* Additional MediaTek MT7921 Bluetooth devices */ + { USB_DEVICE(0x0489, 0xe0c8), .driver_info = BTUSB_MEDIATEK | +-- +2.51.0 + diff --git a/queue-6.19/bluetooth-btusb-add-usb-id-0489-e112-for-realtek-885.patch b/queue-6.19/bluetooth-btusb-add-usb-id-0489-e112-for-realtek-885.patch new file mode 100644 index 00000000000..e3d31d70f06 --- /dev/null +++ b/queue-6.19/bluetooth-btusb-add-usb-id-0489-e112-for-realtek-885.patch @@ -0,0 +1,41 @@ +From 392823d3b81323bbbcfde0f1c75c8acc1cbc515b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Dec 2025 11:31:29 +0800 +Subject: Bluetooth: btusb: Add USB ID 0489:e112 for Realtek 8851BE + +From: Techie Ernie + +[ Upstream commit e07094a51ad8faf98ea64320799ce550828e97cd ] + +Add USB ID 0489:e112 for the Realtek 8851BE Bluetooth adapter. +Without this entry, the device is not handled correctly by btusb and Bluetooth fails to initialise. +Adding the ID enables proper Realtek initialization for Bluetooth to work on various motherboards using this Bluetooth adapter. + +The device identifies as: + Bus 001 Device XXX: ID 0489:e112 Foxconn / Hon Hai Bluetooth Radio + +Tested on Realtek 8851BE. Bluetooth works after this change is made. + +Signed-off-by: Techie Ernie +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index ef08567a7487c..66e266e93cc12 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -521,6 +521,8 @@ static const struct usb_device_id quirks_table[] = { + { USB_DEVICE(0x0bda, 0xb850), .driver_info = BTUSB_REALTEK }, + { USB_DEVICE(0x13d3, 0x3600), .driver_info = BTUSB_REALTEK }, + { USB_DEVICE(0x13d3, 0x3601), .driver_info = BTUSB_REALTEK }, ++ { USB_DEVICE(0x0489, 0xe112), .driver_info = BTUSB_REALTEK | ++ BTUSB_WIDEBAND_SPEECH }, + + /* Realtek 8851BU Bluetooth devices */ + { USB_DEVICE(0x3625, 0x010b), .driver_info = BTUSB_REALTEK | +-- +2.51.0 + diff --git a/queue-6.19/bluetooth-hci_conn-set-link_policy-on-incoming-acl-c.patch b/queue-6.19/bluetooth-hci_conn-set-link_policy-on-incoming-acl-c.patch new file mode 100644 index 00000000000..d41155576d5 --- /dev/null +++ b/queue-6.19/bluetooth-hci_conn-set-link_policy-on-incoming-acl-c.patch @@ -0,0 +1,54 @@ +From 5355f911c9d4f254ae9e5df5943b6f7bbb9c7bd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 10:20:10 +0100 +Subject: Bluetooth: hci_conn: Set link_policy on incoming ACL connections +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stefan Sørensen + +[ Upstream commit 4bb091013ab0f2edfed3f58bebe658a798cbcc4d ] + +The connection link policy is only set when establishing an outgoing +ACL connection causing connection idle modes not to be available on +incoming connections. Move the setting of the link policy to the +creation of the connection so all ACL connection will use the link +policy set on the HCI device. + +Signed-off-by: Stefan Sørensen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_conn.c | 1 + + net/bluetooth/hci_sync.c | 2 -- + 2 files changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 5a4374ccf8e84..98f0461b3dd7d 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -1002,6 +1002,7 @@ static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type, + switch (type) { + case ACL_LINK: + conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK; ++ conn->link_policy = hdev->link_policy; + conn->mtu = hdev->acl_mtu; + break; + case LE_LINK: +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index cbc3a75d73262..334eb4376a266 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -6897,8 +6897,6 @@ static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data) + + conn->attempt++; + +- conn->link_policy = hdev->link_policy; +- + memset(&cp, 0, sizeof(cp)); + bacpy(&cp.bdaddr, &conn->dst); + cp.pscan_rep_mode = 0x02; +-- +2.51.0 + diff --git a/queue-6.19/bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch b/queue-6.19/bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch new file mode 100644 index 00000000000..6141ace6101 --- /dev/null +++ b/queue-6.19/bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch @@ -0,0 +1,46 @@ +From e61b7a724dcde049c2dcb31fc1c042714f37d858 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 10:20:09 +0100 +Subject: Bluetooth: hci_conn: use mod_delayed_work for active mode timeout +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stefan Sørensen + +[ Upstream commit 49d0901e260739de2fcc90c0c29f9e31e39a2d9b ] + +hci_conn_enter_active_mode() uses queue_delayed_work() with the +intention that the work will run after the given timeout. However, +queue_delayed_work() does nothing if the work is already queued, so +depending on the link policy we may end up putting the connection +into idle mode every hdev->idle_timeout ms. + +Use mod_delayed_work() instead so the work is queued if not already +queued, and the timeout is updated otherwise. + +Signed-off-by: Stefan Sørensen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_conn.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 98f0461b3dd7d..dc085856f5e91 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -2620,8 +2620,8 @@ void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active) + + timer: + if (hdev->idle_timeout > 0) +- queue_delayed_work(hdev->workqueue, &conn->idle_work, +- msecs_to_jiffies(hdev->idle_timeout)); ++ mod_delayed_work(hdev->workqueue, &conn->idle_work, ++ msecs_to_jiffies(hdev->idle_timeout)); + } + + /* Drop all connection on the device */ +-- +2.51.0 + diff --git a/queue-6.19/bluetooth-hci_qca-fix-ssr-subsystem-restart-fail-whe.patch b/queue-6.19/bluetooth-hci_qca-fix-ssr-subsystem-restart-fail-whe.patch new file mode 100644 index 00000000000..ca86e110d62 --- /dev/null +++ b/queue-6.19/bluetooth-hci_qca-fix-ssr-subsystem-restart-fail-whe.patch @@ -0,0 +1,91 @@ +From 9548f58b32232ace0d20dc02886d7bb44ebb8eed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Dec 2025 11:37:12 +0800 +Subject: Bluetooth: hci_qca: Fix SSR (SubSystem Restart) fail when BT_EN is + pulled up by hw + +From: Shuai Zhang + +[ Upstream commit fce1a9244a0f85683be8530e623bc729f24c5067 ] + +On QCS9075 and QCA8275 platforms, the BT_EN pin is always pulled up by hw +and cannot be controlled by the host. As a result, in case of a firmware +crash, the host cannot trigger a cold reset. Instead, the BT controller +performs a warm restart on its own, without reloading the firmware. + +This leads to the controller remaining in IBS_WAKE state, while the host +expects it to be in sleep mode. The mismatch causes HCI reset commands +to time out. Additionally, the driver does not clear internal flags +QCA_SSR_TRIGGERED and QCA_IBS_DISABLED, which blocks the reset sequence. +If the SSR duration exceeds 2 seconds, the host may enter TX sleep mode +due to tx_idle_timeout, further preventing recovery. Also, memcoredump_flag +is not cleared, so only the first SSR generates a coredump. + +Tell the driver that the BT controller has undergone a proper restart sequence: + +- Clear QCA_SSR_TRIGGERED and QCA_IBS_DISABLED flags after SSR. +- Add a 50ms delay to allow the controller to complete its warm reset. +- Reset tx_idle_timer to prevent the host from entering TX sleep mode. +- Clear memcoredump_flag to allow multiple coredump captures. + +Apply these steps only when HCI_QUIRK_NON_PERSISTENT_SETUP is not set, +which indicates that BT_EN is defined in DTS and cannot be toggled. + +Refer to the comment in include/net/bluetooth/hci.h for details on +HCI_QUIRK_NON_PERSISTENT_SETUP. + +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Shuai Zhang +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/hci_qca.c | 33 +++++++++++++++++++++++++++++++++ + 1 file changed, 33 insertions(+) + +diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c +index 888176b0faa90..a3c217571c3c4 100644 +--- a/drivers/bluetooth/hci_qca.c ++++ b/drivers/bluetooth/hci_qca.c +@@ -1653,6 +1653,39 @@ static void qca_hw_error(struct hci_dev *hdev, u8 code) + skb_queue_purge(&qca->rx_memdump_q); + } + ++ /* ++ * If the BT chip's bt_en pin is connected to a 3.3V power supply via ++ * hardware and always stays high, driver cannot control the bt_en pin. ++ * As a result, during SSR (SubSystem Restart), QCA_SSR_TRIGGERED and ++ * QCA_IBS_DISABLED flags cannot be cleared, which leads to a reset ++ * command timeout. ++ * Add an msleep delay to ensure controller completes the SSR process. ++ * ++ * Host will not download the firmware after SSR, controller to remain ++ * in the IBS_WAKE state, and the host needs to synchronize with it ++ * ++ * Since the bluetooth chip has been reset, clear the memdump state. ++ */ ++ if (!hci_test_quirk(hu->hdev, HCI_QUIRK_NON_PERSISTENT_SETUP)) { ++ /* ++ * When the SSR (SubSystem Restart) duration exceeds 2 seconds, ++ * it triggers host tx_idle_delay, which sets host TX state ++ * to sleep. Reset tx_idle_timer after SSR to prevent ++ * host enter TX IBS_Sleep mode. ++ */ ++ mod_timer(&qca->tx_idle_timer, jiffies + ++ msecs_to_jiffies(qca->tx_idle_delay)); ++ ++ /* Controller reset completion time is 50ms */ ++ msleep(50); ++ ++ clear_bit(QCA_SSR_TRIGGERED, &qca->flags); ++ clear_bit(QCA_IBS_DISABLED, &qca->flags); ++ ++ qca->tx_ibs_state = HCI_IBS_TX_AWAKE; ++ qca->memdump_state = QCA_MEMDUMP_IDLE; ++ } ++ + clear_bit(QCA_HW_ERROR_EVENT, &qca->flags); + } + +-- +2.51.0 + diff --git a/queue-6.19/bnxt_en-allow-ntuple-filters-for-drops.patch b/queue-6.19/bnxt_en-allow-ntuple-filters-for-drops.patch new file mode 100644 index 00000000000..9efe9716e92 --- /dev/null +++ b/queue-6.19/bnxt_en-allow-ntuple-filters-for-drops.patch @@ -0,0 +1,94 @@ +From 684331ca7dbe582b2c1dc1a25bada62a5e176bbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 16:30:41 -0800 +Subject: bnxt_en: Allow ntuple filters for drops + +From: Joe Damato + +[ Upstream commit 61cef6454cfbb9fcdbe41401fb53895f86603081 ] + +It appears that in commit 7efd79c0e689 ("bnxt_en: Add drop action +support for ntuple"), bnxt gained support for ntuple filters for packet +drops. + +However, support for this does not seem to work in recent kernels or +against net-next: + + % sudo ethtool -U eth0 flow-type udp4 src-ip 1.1.1.1 action -1 + rmgr: Cannot insert RX class rule: Operation not supported + Cannot insert classification rule + +The issue is that the existing code uses ethtool_get_flow_spec_ring_vf, +which will return a non-zero value if the ring_cookie is set to +RX_CLS_FLOW_DISC, which then causes bnxt_add_ntuple_cls_rule to return +-EOPNOTSUPP because it thinks the user is trying to set an ntuple filter +for a vf. + +Fix this by first checking that the ring_cookie is not RX_CLS_FLOW_DISC. + +After this patch, ntuple filters for drops can be added: + + % sudo ethtool -U eth0 flow-type udp4 src-ip 1.1.1.1 action -1 + Added rule with ID 0 + + % ethtool -n eth0 + 44 RX rings available + Total 1 rules + + Filter: 0 + Rule Type: UDP over IPv4 + Src IP addr: 1.1.1.1 mask: 0.0.0.0 + Dest IP addr: 0.0.0.0 mask: 255.255.255.255 + TOS: 0x0 mask: 0xff + Src port: 0 mask: 0xffff + Dest port: 0 mask: 0xffff + Action: Drop + +Reviewed-by: Michael Chan +Signed-off-by: Joe Damato +Link: https://patch.msgid.link/20260131003042.2570434-1-joe@dama.to +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 068e191ede19e..c76a7623870be 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -1346,16 +1346,17 @@ static int bnxt_add_ntuple_cls_rule(struct bnxt *bp, + struct bnxt_l2_filter *l2_fltr; + struct bnxt_flow_masks *fmasks; + struct flow_keys *fkeys; +- u32 idx, ring; ++ u32 idx; + int rc; +- u8 vf; + + if (!bp->vnic_info) + return -EAGAIN; + +- vf = ethtool_get_flow_spec_ring_vf(fs->ring_cookie); +- ring = ethtool_get_flow_spec_ring(fs->ring_cookie); +- if ((fs->flow_type & (FLOW_MAC_EXT | FLOW_EXT)) || vf) ++ if (fs->flow_type & (FLOW_MAC_EXT | FLOW_EXT)) ++ return -EOPNOTSUPP; ++ ++ if (fs->ring_cookie != RX_CLS_FLOW_DISC && ++ ethtool_get_flow_spec_ring_vf(fs->ring_cookie)) + return -EOPNOTSUPP; + + if (flow_type == IP_USER_FLOW) { +@@ -1481,7 +1482,7 @@ static int bnxt_add_ntuple_cls_rule(struct bnxt *bp, + if (fs->ring_cookie == RX_CLS_FLOW_DISC) + new_fltr->base.flags |= BNXT_ACT_DROP; + else +- new_fltr->base.rxq = ring; ++ new_fltr->base.rxq = ethtool_get_flow_spec_ring(fs->ring_cookie); + __set_bit(BNXT_FLTR_VALID, &new_fltr->base.state); + rc = bnxt_insert_ntp_filter(bp, new_fltr, idx); + if (!rc) { +-- +2.51.0 + diff --git a/queue-6.19/bpf-crypto-use-the-correct-destructor-kfunc-type.patch b/queue-6.19/bpf-crypto-use-the-correct-destructor-kfunc-type.patch new file mode 100644 index 00000000000..6e300f131c2 --- /dev/null +++ b/queue-6.19/bpf-crypto-use-the-correct-destructor-kfunc-type.patch @@ -0,0 +1,63 @@ +From fa9ee9159b6458f3cbba4677944774828efaf7aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 08:25:50 +0000 +Subject: bpf: crypto: Use the correct destructor kfunc type + +From: Sami Tolvanen + +[ Upstream commit b40a5d724f29fc2eed23ff353808a9aae616b48a ] + +With CONFIG_CFI enabled, the kernel strictly enforces that indirect +function calls use a function pointer type that matches the target +function. I ran into the following type mismatch when running BPF +self-tests: + + CFI failure at bpf_obj_free_fields+0x190/0x238 (target: + bpf_crypto_ctx_release+0x0/0x94; expected type: 0xa488ebfc) + Internal error: Oops - CFI: 00000000f2008228 [#1] SMP + ... + +As bpf_crypto_ctx_release() is also used in BPF programs and using +a void pointer as the argument would make the verifier unhappy, add +a simple stub function with the correct type and register it as the +destructor kfunc instead. + +Signed-off-by: Sami Tolvanen +Acked-by: Yonghong Song +Tested-by: Viktor Malik +Link: https://lore.kernel.org/r/20260110082548.113748-7-samitolvanen@google.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/crypto.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/kernel/bpf/crypto.c b/kernel/bpf/crypto.c +index 83c4d9943084b..1d024fe7248ac 100644 +--- a/kernel/bpf/crypto.c ++++ b/kernel/bpf/crypto.c +@@ -261,6 +261,12 @@ __bpf_kfunc void bpf_crypto_ctx_release(struct bpf_crypto_ctx *ctx) + call_rcu(&ctx->rcu, crypto_free_cb); + } + ++__bpf_kfunc void bpf_crypto_ctx_release_dtor(void *ctx) ++{ ++ bpf_crypto_ctx_release(ctx); ++} ++CFI_NOSEAL(bpf_crypto_ctx_release_dtor); ++ + static int bpf_crypto_crypt(const struct bpf_crypto_ctx *ctx, + const struct bpf_dynptr_kern *src, + const struct bpf_dynptr_kern *dst, +@@ -368,7 +374,7 @@ static const struct btf_kfunc_id_set crypt_kfunc_set = { + + BTF_ID_LIST(bpf_crypto_dtor_ids) + BTF_ID(struct, bpf_crypto_ctx) +-BTF_ID(func, bpf_crypto_ctx_release) ++BTF_ID(func, bpf_crypto_ctx_release_dtor) + + static int __init crypto_kfunc_init(void) + { +-- +2.51.0 + diff --git a/queue-6.19/bpf-net_sched-use-the-correct-destructor-kfunc-type.patch b/queue-6.19/bpf-net_sched-use-the-correct-destructor-kfunc-type.patch new file mode 100644 index 00000000000..0acf0cc015f --- /dev/null +++ b/queue-6.19/bpf-net_sched-use-the-correct-destructor-kfunc-type.patch @@ -0,0 +1,54 @@ +From 96257de503e94ddc6787f01d063cb2e9a5add68a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 08:25:51 +0000 +Subject: bpf: net_sched: Use the correct destructor kfunc type + +From: Sami Tolvanen + +[ Upstream commit c99d97b46631c4bea0c14b7581b7a59214601e63 ] + +With CONFIG_CFI enabled, the kernel strictly enforces that indirect +function calls use a function pointer type that matches the +target function. As bpf_kfree_skb() signature differs from the +btf_dtor_kfunc_t pointer type used for the destructor calls in +bpf_obj_free_fields(), add a stub function with the correct type to +fix the type mismatch. + +Signed-off-by: Sami Tolvanen +Acked-by: Yonghong Song +Link: https://lore.kernel.org/r/20260110082548.113748-8-samitolvanen@google.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + net/sched/bpf_qdisc.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/net/sched/bpf_qdisc.c b/net/sched/bpf_qdisc.c +index adcb618a2bfca..e9bea9890777d 100644 +--- a/net/sched/bpf_qdisc.c ++++ b/net/sched/bpf_qdisc.c +@@ -202,6 +202,12 @@ __bpf_kfunc void bpf_kfree_skb(struct sk_buff *skb) + kfree_skb(skb); + } + ++__bpf_kfunc void bpf_kfree_skb_dtor(void *skb) ++{ ++ bpf_kfree_skb(skb); ++} ++CFI_NOSEAL(bpf_kfree_skb_dtor); ++ + /* bpf_qdisc_skb_drop - Drop an skb by adding it to a deferred free list. + * @skb: The skb whose reference to be released and dropped. + * @to_free_list: The list of skbs to be dropped. +@@ -449,7 +455,7 @@ static struct bpf_struct_ops bpf_Qdisc_ops = { + .owner = THIS_MODULE, + }; + +-BTF_ID_LIST_SINGLE(bpf_sk_buff_dtor_ids, func, bpf_kfree_skb) ++BTF_ID_LIST_SINGLE(bpf_sk_buff_dtor_ids, func, bpf_kfree_skb_dtor) + + static int __init bpf_qdisc_kfunc_init(void) + { +-- +2.51.0 + diff --git a/queue-6.19/bpf-properly-mark-live-registers-for-indirect-jumps.patch b/queue-6.19/bpf-properly-mark-live-registers-for-indirect-jumps.patch new file mode 100644 index 00000000000..ef806f96474 --- /dev/null +++ b/queue-6.19/bpf-properly-mark-live-registers-for-indirect-jumps.patch @@ -0,0 +1,40 @@ +From 9b0e63d203f3af7eb91c50952d8a1172d9b30031 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 16:25:43 +0000 +Subject: bpf: Properly mark live registers for indirect jumps + +From: Anton Protopopov + +[ Upstream commit d1aab1ca576c90192ba961094d51b0be6355a4d6 ] + +For a `gotox rX` instruction the rX register should be marked as used +in the compute_insn_live_regs() function. Fix this. + +Signed-off-by: Anton Protopopov +Link: https://lore.kernel.org/r/20260114162544.83253-2-a.s.protopopov@gmail.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 1999b8d244f64..783d984d7884d 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -24852,6 +24852,12 @@ static void compute_insn_live_regs(struct bpf_verifier_env *env, + case BPF_JMP32: + switch (code) { + case BPF_JA: ++ def = 0; ++ if (BPF_SRC(insn->code) == BPF_X) ++ use = dst; ++ else ++ use = 0; ++ break; + case BPF_JCOND: + def = 0; + use = 0; +-- +2.51.0 + diff --git a/queue-6.19/bpf-recognize-special-arithmetic-shift-in-the-verifi.patch b/queue-6.19/bpf-recognize-special-arithmetic-shift-in-the-verifi.patch new file mode 100644 index 00000000000..7a3be9d2828 --- /dev/null +++ b/queue-6.19/bpf-recognize-special-arithmetic-shift-in-the-verifi.patch @@ -0,0 +1,181 @@ +From 897af3ea32c676b1bbab7841e7be455174cd091b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 12:13:57 -0800 +Subject: bpf: Recognize special arithmetic shift in the verifier + +From: Alexei Starovoitov + +[ Upstream commit bffacdb80b93b7b5e96b26fad64cc490a6c7d6c7 ] + +cilium bpf_wiregard.bpf.c when compiled with -O1 fails to load +with the following verifier log: + +192: (79) r2 = *(u64 *)(r10 -304) ; R2=pkt(r=40) R10=fp0 fp-304=pkt(r=40) +... +227: (85) call bpf_skb_store_bytes#9 ; R0=scalar() +228: (bc) w2 = w0 ; R0=scalar() R2=scalar(smin=0,smax=umax=0xffffffff,var_off=(0x0; 0xffffffff)) +229: (c4) w2 s>>= 31 ; R2=scalar(smin=0,smax=umax=0xffffffff,smin32=-1,smax32=0,var_off=(0x0; 0xffffffff)) +230: (54) w2 &= -134 ; R2=scalar(smin=0,smax=umax=umax32=0xffffff7a,smax32=0x7fffff7a,var_off=(0x0; 0xffffff7a)) +... +232: (66) if w2 s> 0xffffffff goto pc+125 ; R2=scalar(smin=umin=umin32=0x80000000,smax=umax=umax32=0xffffff7a,smax32=-134,var_off=(0x80000000; 0x7fffff7a)) +... +238: (79) r4 = *(u64 *)(r10 -304) ; R4=scalar() R10=fp0 fp-304=scalar() +239: (56) if w2 != 0xffffff78 goto pc+210 ; R2=0xffffff78 // -136 +... +258: (71) r1 = *(u8 *)(r4 +0) +R4 invalid mem access 'scalar' + +The error might confuse most bpf authors, since fp-304 slot had 'pkt' +pointer at insn 192 and became 'scalar' at 238. That happened because +bpf_skb_store_bytes() clears all packet pointers including those in +the stack. On the first glance it might look like a bug in the source +code, since ctx->data pointer should have been reloaded after the call +to bpf_skb_store_bytes(). + +The relevant part of cilium source code looks like this: + +// bpf/lib/nodeport.h +int dsr_set_ipip6() +{ + if (ctx_adjust_hroom(...)) + return DROP_INVALID; // -134 + if (ctx_store_bytes(...)) + return DROP_WRITE_ERROR; // -141 + return 0; +} + +bool dsr_fail_needs_reply(int code) +{ + if (code == DROP_FRAG_NEEDED) // -136 + return true; + return false; +} + +tail_nodeport_ipv6_dsr() +{ + ret = dsr_set_ipip6(...); + if (!IS_ERR(ret)) { + ... + } else { + if (dsr_fail_needs_reply(ret)) + return dsr_reply_icmp6(...); + } +} + +The code doesn't have arithmetic shift by 31 and it reloads ctx->data +every time it needs to access it. So it's not a bug in the source code. + +The reason is DAGCombiner::foldSelectCCToShiftAnd() LLVM transformation: + + // If this is a select where the false operand is zero and the compare is a + // check of the sign bit, see if we can perform the "gzip trick": + // select_cc setlt X, 0, A, 0 -> and (sra X, size(X)-1), A + // select_cc setgt X, 0, A, 0 -> and (not (sra X, size(X)-1)), A + +The conditional branch in dsr_set_ipip6() and its return values +are optimized into BPF_ARSH plus BPF_AND: + +227: (85) call bpf_skb_store_bytes#9 +228: (bc) w2 = w0 +229: (c4) w2 s>>= 31 ; R2=scalar(smin=0,smax=umax=0xffffffff,smin32=-1,smax32=0,var_off=(0x0; 0xffffffff)) +230: (54) w2 &= -134 ; R2=scalar(smin=0,smax=umax=umax32=0xffffff7a,smax32=0x7fffff7a,var_off=(0x0; 0xffffff7a)) + +after insn 230 the register w2 can only be 0 or -134, +but the verifier approximates it, since there is no way to +represent two scalars in bpf_reg_state. +After fallthough at insn 232 the w2 can only be -134, +hence the branch at insn +239: (56) if w2 != -136 goto pc+210 +should be always taken, and trapping insn 258 should never execute. +LLVM generated correct code, but the verifier follows impossible +path and rejects valid program. To fix this issue recognize this +special LLVM optimization and fork the verifier state. +So after insn 229: (c4) w2 s>>= 31 +the verifier has two states to explore: +one with w2 = 0 and another with w2 = 0xffffffff +which makes the verifier accept bpf_wiregard.c + +A similar pattern exists were OR operation is used in place of the AND +operation, the verifier detects that pattern as well by forking the +state before the OR operation with a scalar in range [-1,0]. + +Note there are 20+ such patterns in bpf_wiregard.o compiled +with -O1 and -O2, but they're rarely seen in other production +bpf programs, so push_stack() approach is not a concern. + +Reported-by: Hao Sun +Signed-off-by: Alexei Starovoitov +Co-developed-by: Puranjay Mohan +Signed-off-by: Puranjay Mohan +Link: https://lore.kernel.org/r/20260112201424.816836-2-puranjay@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 39 +++++++++++++++++++++++++++++++++++++++ + 1 file changed, 39 insertions(+) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 7069e9f527eaa..1999b8d244f64 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -15499,6 +15499,35 @@ static bool is_safe_to_compute_dst_reg_range(struct bpf_insn *insn, + } + } + ++static int maybe_fork_scalars(struct bpf_verifier_env *env, struct bpf_insn *insn, ++ struct bpf_reg_state *dst_reg) ++{ ++ struct bpf_verifier_state *branch; ++ struct bpf_reg_state *regs; ++ bool alu32; ++ ++ if (dst_reg->smin_value == -1 && dst_reg->smax_value == 0) ++ alu32 = false; ++ else if (dst_reg->s32_min_value == -1 && dst_reg->s32_max_value == 0) ++ alu32 = true; ++ else ++ return 0; ++ ++ branch = push_stack(env, env->insn_idx + 1, env->insn_idx, false); ++ if (IS_ERR(branch)) ++ return PTR_ERR(branch); ++ ++ regs = branch->frame[branch->curframe]->regs; ++ if (alu32) { ++ __mark_reg32_known(®s[insn->dst_reg], 0); ++ __mark_reg32_known(dst_reg, -1ull); ++ } else { ++ __mark_reg_known(®s[insn->dst_reg], 0); ++ __mark_reg_known(dst_reg, -1ull); ++ } ++ return 0; ++} ++ + /* WARNING: This function does calculations on 64-bit values, but the actual + * execution may occur on 32-bit values. Therefore, things like bitshifts + * need extra checks in the 32-bit case. +@@ -15561,11 +15590,21 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env, + scalar_min_max_mul(dst_reg, &src_reg); + break; + case BPF_AND: ++ if (tnum_is_const(src_reg.var_off)) { ++ ret = maybe_fork_scalars(env, insn, dst_reg); ++ if (ret) ++ return ret; ++ } + dst_reg->var_off = tnum_and(dst_reg->var_off, src_reg.var_off); + scalar32_min_max_and(dst_reg, &src_reg); + scalar_min_max_and(dst_reg, &src_reg); + break; + case BPF_OR: ++ if (tnum_is_const(src_reg.var_off)) { ++ ret = maybe_fork_scalars(env, insn, dst_reg); ++ if (ret) ++ return ret; ++ } + dst_reg->var_off = tnum_or(dst_reg->var_off, src_reg.var_off); + scalar32_min_max_or(dst_reg, &src_reg); + scalar_min_max_or(dst_reg, &src_reg); +-- +2.51.0 + diff --git a/queue-6.19/bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch b/queue-6.19/bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch new file mode 100644 index 00000000000..b9a9d7f1ac5 --- /dev/null +++ b/queue-6.19/bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch @@ -0,0 +1,72 @@ +From e3386a72442ca933ade149e43245bd6c3aa377b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 18:02:19 +0000 +Subject: bpf: verifier improvement in 32bit shift sign extension pattern + +From: Cupertino Miranda + +[ Upstream commit d18dec4b8990048ce75f0ece32bb96b3fbd3f422 ] + +This patch improves the verifier to correctly compute bounds for +sign extension compiler pattern composed of left shift by 32bits +followed by a sign right shift by 32bits. Pattern in the verifier was +limitted to positive value bounds and would reset bound computation for +negative values. New code allows both positive and negative values for +sign extension without compromising bound computation and verifier to +pass. + +This change is required by GCC which generate such pattern, and was +detected in the context of systemd, as described in the following GCC +bugzilla: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119731 + +Three new tests were added in verifier_subreg.c. + +Signed-off-by: Cupertino Miranda +Signed-off-by: Andrew Pinski +Acked-by: Eduard Zingerman +Cc: David Faust +Cc: Jose Marchesi +Cc: Elena Zannoni +Link: https://lore.kernel.org/r/20251202180220.11128-2-cupertino.miranda@oracle.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 18 +++++++----------- + 1 file changed, 7 insertions(+), 11 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index fe01edfcc34c6..7069e9f527eaa 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -15305,21 +15305,17 @@ static void __scalar64_min_max_lsh(struct bpf_reg_state *dst_reg, + u64 umin_val, u64 umax_val) + { + /* Special case <<32 because it is a common compiler pattern to sign +- * extend subreg by doing <<32 s>>32. In this case if 32bit bounds are +- * positive we know this shift will also be positive so we can track +- * bounds correctly. Otherwise we lose all sign bit information except +- * what we can pick up from var_off. Perhaps we can generalize this +- * later to shifts of any length. ++ * extend subreg by doing <<32 s>>32. smin/smax assignments are correct ++ * because s32 bounds don't flip sign when shifting to the left by ++ * 32bits. + */ +- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_max_value >= 0) ++ if (umin_val == 32 && umax_val == 32) { + dst_reg->smax_value = (s64)dst_reg->s32_max_value << 32; +- else +- dst_reg->smax_value = S64_MAX; +- +- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_min_value >= 0) + dst_reg->smin_value = (s64)dst_reg->s32_min_value << 32; +- else ++ } else { ++ dst_reg->smax_value = S64_MAX; + dst_reg->smin_value = S64_MIN; ++ } + + /* If we might shift our top bit out, then we know nothing */ + if (dst_reg->umax_value > 1ULL << (63 - umax_val)) { +-- +2.51.0 + diff --git a/queue-6.19/bpftool-fix-dependencies-for-static-build.patch b/queue-6.19/bpftool-fix-dependencies-for-static-build.patch new file mode 100644 index 00000000000..fe58ddb28c2 --- /dev/null +++ b/queue-6.19/bpftool-fix-dependencies-for-static-build.patch @@ -0,0 +1,52 @@ +From 6aebc535bda6f9d3297602ea8222782a4802ff2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 13:12:55 -0800 +Subject: bpftool: Fix dependencies for static build + +From: Ihor Solodrai + +[ Upstream commit 08a7491843224f8b96518fbe70d9e48163046054 ] + +When building selftests/bpf with EXTRA_LDFLAGS=-static the follwoing +error happens: + + LINK /ws/linux/tools/testing/selftests/bpf/tools/build/bpftool/bootstrap/bpftool +/usr/bin/x86_64-linux-gnu-ld.bfd: /usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu/libcrypto.a(libcrypto-lib-dso_dlfcn.o): in function `dlfcn_globallookup': + [...] +/usr/bin/x86_64-linux-gnu-ld.bfd: /usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu/libcrypto.a(libcrypto-lib-c_zlib.o): in function `zlib_oneshot_expand_block': +(.text+0xc64): undefined reference to `uncompress' +/usr/bin/x86_64-linux-gnu-ld.bfd: /usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu/libcrypto.a(libcrypto-lib-c_zlib.o): in function `zlib_oneshot_compress_block': +(.text+0xce4): undefined reference to `compress' +collect2: error: ld returned 1 exit status +make[1]: *** [Makefile:252: /ws/linux/tools/testing/selftests/bpf/tools/build/bpftool/bootstrap/bpftool] Error 1 +make: *** [Makefile:327: /ws/linux/tools/testing/selftests/bpf/tools/sbin/bpftool] Error 2 +make: *** Waiting for unfinished jobs.... + +This is caused by wrong order of dependencies in the Makefile. Fix it. + +Signed-off-by: Ihor Solodrai +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20260128211255.376933-1-ihor.solodrai@linux.dev +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/bpf/bpftool/Makefile b/tools/bpf/bpftool/Makefile +index 5442073a2e428..519ea5cb8ab1c 100644 +--- a/tools/bpf/bpftool/Makefile ++++ b/tools/bpf/bpftool/Makefile +@@ -130,8 +130,8 @@ include $(FEATURES_DUMP) + endif + endif + +-LIBS = $(LIBBPF) -lelf -lz -lcrypto +-LIBS_BOOTSTRAP = $(LIBBPF_BOOTSTRAP) -lelf -lz -lcrypto ++LIBS = $(LIBBPF) -lelf -lcrypto -lz ++LIBS_BOOTSTRAP = $(LIBBPF_BOOTSTRAP) -lelf -lcrypto -lz + + ifeq ($(feature-libelf-zstd),1) + LIBS += -lzstd +-- +2.51.0 + diff --git a/queue-6.19/btrfs-do-not-assert-when-the-fs-flips-ro-inside-btrf.patch b/queue-6.19/btrfs-do-not-assert-when-the-fs-flips-ro-inside-btrf.patch new file mode 100644 index 00000000000..6cb77240d6a --- /dev/null +++ b/queue-6.19/btrfs-do-not-assert-when-the-fs-flips-ro-inside-btrf.patch @@ -0,0 +1,109 @@ +From 7a4fef710a8846b8321e6d07681d2ea1ea8ac633 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 15:46:55 +1030 +Subject: btrfs: do not ASSERT() when the fs flips RO inside + btrfs_repair_io_failure() + +From: Qu Wenruo + +[ Upstream commit 8ceaad6cd6e7fa5f73b0b2796a2e85d75d37e9f3 ] + +[BUG] +There is a bug report that when btrfs hits ENOSPC error in a critical +path, btrfs flips RO (this part is expected, although the ENOSPC bug +still needs to be addressed). + +The problem is after the RO flip, if there is a read repair pending, we +can hit the ASSERT() inside btrfs_repair_io_failure() like the following: + + BTRFS info (device vdc): relocating block group 30408704 flags metadata|raid1 + ------------[ cut here ]------------ + BTRFS: Transaction aborted (error -28) + WARNING: fs/btrfs/extent-tree.c:3235 at __btrfs_free_extent.isra.0+0x453/0xfd0, CPU#1: btrfs/383844 + Modules linked in: kvm_intel kvm irqbypass + [...] + ---[ end trace 0000000000000000 ]--- + BTRFS info (device vdc state EA): 2 enospc errors during balance + BTRFS info (device vdc state EA): balance: ended with status: -30 + BTRFS error (device vdc state EA): parent transid verify failed on logical 30556160 mirror 2 wanted 8 found 6 + BTRFS error (device vdc state EA): bdev /dev/nvme0n1 errs: wr 0, rd 0, flush 0, corrupt 10, gen 0 + [...] + assertion failed: !(fs_info->sb->s_flags & SB_RDONLY) :: 0, in fs/btrfs/bio.c:938 + ------------[ cut here ]------------ + assertion failed: !(fs_info->sb->s_flags & SB_RDONLY) :: 0, in fs/btrfs/bio.c:938 + kernel BUG at fs/btrfs/bio.c:938! + Oops: invalid opcode: 0000 [#1] SMP NOPTI + CPU: 0 UID: 0 PID: 868 Comm: kworker/u8:13 Tainted: G W N 6.19.0-rc6+ #4788 PREEMPT(full) + Tainted: [W]=WARN, [N]=TEST + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 + Workqueue: btrfs-endio simple_end_io_work + RIP: 0010:btrfs_repair_io_failure.cold+0xb2/0x120 + RSP: 0000:ffffc90001d2bcf0 EFLAGS: 00010246 + RAX: 0000000000000051 RBX: 0000000000001000 RCX: 0000000000000000 + RDX: 0000000000000000 RSI: ffffffff8305cf42 RDI: 00000000ffffffff + RBP: 0000000000000002 R08: 00000000fffeffff R09: ffffffff837fa988 + R10: ffffffff8327a9e0 R11: 6f69747265737361 R12: ffff88813018d310 + R13: ffff888168b8a000 R14: ffffc90001d2bd90 R15: ffff88810a169000 + FS: 0000000000000000(0000) GS:ffff8885e752c000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + ------------[ cut here ]------------ + +[CAUSE] +The cause of -ENOSPC error during the test case btrfs/124 is still +unknown, although it's known that we still have cases where metadata can +be over-committed but can not be fulfilled correctly, thus if we hit +such ENOSPC error inside a critical path, we have no choice but abort +the current transaction. + +This will mark the fs read-only. + +The problem is inside the btrfs_repair_io_failure() path that we require +the fs not to be mount read-only. This is normally fine, but if we are +doing a read-repair meanwhile the fs flips RO due to a critical error, +we can enter btrfs_repair_io_failure() with super block set to +read-only, thus triggering the above crash. + +[FIX] +Just replace the ASSERT() with a proper return if the fs is already +read-only. + +Reported-by: Christoph Hellwig +Link: https://lore.kernel.org/linux-btrfs/20260126045555.GB31641@lst.de/ +Tested-by: Christoph Hellwig +Signed-off-by: Qu Wenruo +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/bio.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/bio.c b/fs/btrfs/bio.c +index e4d382d3a7aea..1de1b408c6a6d 100644 +--- a/fs/btrfs/bio.c ++++ b/fs/btrfs/bio.c +@@ -934,7 +934,6 @@ int btrfs_repair_io_failure(struct btrfs_fs_info *fs_info, u64 ino, u64 fileoff, + struct bio *bio = NULL; + int ret = 0; + +- ASSERT(!(fs_info->sb->s_flags & SB_RDONLY)); + BUG_ON(!mirror_num); + + /* Basic alignment checks. */ +@@ -946,6 +945,13 @@ int btrfs_repair_io_failure(struct btrfs_fs_info *fs_info, u64 ino, u64 fileoff, + ASSERT(step <= length); + ASSERT(is_power_of_2(step)); + ++ /* ++ * The fs either mounted RO or hit critical errors, no need ++ * to continue repairing. ++ */ ++ if (unlikely(sb_rdonly(fs_info->sb))) ++ return 0; ++ + if (btrfs_repair_one_zone(fs_info, logical)) + return 0; + +-- +2.51.0 + diff --git a/queue-6.19/btrfs-don-t-bug-on-unexpected-delayed-ref-type-in-ru.patch b/queue-6.19/btrfs-don-t-bug-on-unexpected-delayed-ref-type-in-ru.patch new file mode 100644 index 00000000000..f96318c2725 --- /dev/null +++ b/queue-6.19/btrfs-don-t-bug-on-unexpected-delayed-ref-type-in-ru.patch @@ -0,0 +1,75 @@ +From c42213c8f325987b57c8b3f2b196b4baca074c9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 16:37:26 +0000 +Subject: btrfs: don't BUG() on unexpected delayed ref type in + run_one_delayed_ref() + +From: Filipe Manana + +[ Upstream commit c7d1d4ff56744074e005771aff193b927392d51f ] + +There is no need to BUG(), we can just return an error and log an error +message. + +Reviewed-by: Boris Burkov +Reviewed-by: Qu Wenruo +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/extent-tree.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index e4cae34620d19..1bf081243efb2 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -1761,32 +1761,36 @@ static int run_one_delayed_ref(struct btrfs_trans_handle *trans, + struct btrfs_delayed_extent_op *extent_op, + bool insert_reserved) + { ++ struct btrfs_fs_info *fs_info = trans->fs_info; + int ret = 0; + + if (TRANS_ABORTED(trans)) { + if (insert_reserved) { + btrfs_pin_extent(trans, node->bytenr, node->num_bytes); +- free_head_ref_squota_rsv(trans->fs_info, href); ++ free_head_ref_squota_rsv(fs_info, href); + } + return 0; + } + + if (node->type == BTRFS_TREE_BLOCK_REF_KEY || +- node->type == BTRFS_SHARED_BLOCK_REF_KEY) ++ node->type == BTRFS_SHARED_BLOCK_REF_KEY) { + ret = run_delayed_tree_ref(trans, href, node, extent_op, + insert_reserved); +- else if (node->type == BTRFS_EXTENT_DATA_REF_KEY || +- node->type == BTRFS_SHARED_DATA_REF_KEY) ++ } else if (node->type == BTRFS_EXTENT_DATA_REF_KEY || ++ node->type == BTRFS_SHARED_DATA_REF_KEY) { + ret = run_delayed_data_ref(trans, href, node, extent_op, + insert_reserved); +- else if (node->type == BTRFS_EXTENT_OWNER_REF_KEY) ++ } else if (node->type == BTRFS_EXTENT_OWNER_REF_KEY) { + ret = 0; +- else +- BUG(); ++ } else { ++ ret = -EUCLEAN; ++ btrfs_err(fs_info, "unexpected delayed ref node type: %u", node->type); ++ } ++ + if (ret && insert_reserved) + btrfs_pin_extent(trans, node->bytenr, node->num_bytes); + if (ret < 0) +- btrfs_err(trans->fs_info, ++ btrfs_err(fs_info, + "failed to run delayed ref for logical %llu num_bytes %llu type %u action %u ref_mod %d: %d", + node->bytenr, node->num_bytes, node->type, + node->action, node->ref_mod, ret); +-- +2.51.0 + diff --git a/queue-6.19/btrfs-fallback-to-buffered-io-if-the-data-profile-ha.patch b/queue-6.19/btrfs-fallback-to-buffered-io-if-the-data-profile-ha.patch new file mode 100644 index 00000000000..be6ffb4033e --- /dev/null +++ b/queue-6.19/btrfs-fallback-to-buffered-io-if-the-data-profile-ha.patch @@ -0,0 +1,108 @@ +From 29d39391f56c2fb30d091acc97f5c69d66d4b6a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Nov 2025 10:22:16 +1030 +Subject: btrfs: fallback to buffered IO if the data profile has duplication + +From: Qu Wenruo + +[ Upstream commit 7c2830f00c3e086292c1ee9f27b61efaf8e76c9a ] + +[BACKGROUND] +Inspired by a recent kernel bug report, which is related to direct IO +buffer modification during writeback, that leads to contents mismatch of +different RAID1 mirrors. + +[CAUSE AND PROBLEMS] +The root cause is exactly the same explained in commit 968f19c5b1b7 +("btrfs: always fallback to buffered write if the inode requires +checksum"), that we can not trust direct IO buffer which can be modified +halfway during writeback. + +Unlike data checksum verification, if this happened on inodes without +data checksum but has the data has extra mirrors, it will lead to +stealth data mismatch on different mirrors. + +This will be way harder to detect without data checksum. + +Furthermore for RAID56, we can even have data without checksum and data +with checksum mixed inside the same full stripe. + +In that case if the direct IO buffer got changed halfway for the +nodatasum part, the data with checksum immediately lost its ability to +recover, e.g.: + +" " = Good old data or parity calculated using good old data +"X" = Data modified during writeback + + 0 32K 64K + Data 1 | | Has csum + Data 2 |XXXXXXXXXXXXXXXX | No csum + Parity | | + +In above case, the parity is calculated using data 1 (has csum, from +page cache, won't change during writeback), and old data 2 (has no csum, +direct IO write). + +After parity is calculated, but before submission to the storage, direct +IO buffer of data 2 is modified, causing the range [0, 32K) of data 2 +has a different content. + +Now all data is submitted to the storage, and the fs got fully synced. + +Then the device of data 1 is lost, has to be rebuilt from data 2 and +parity. But since the data 2 has some modified data, and the parity is +calculated using old data, the recovered data is no the same for data 1, +causing data checksum mismatch. + +[FIX] +Fix the problem by checking the data allocation profile. +If our data allocation profile is either RAID0 or SINGLE, we can allow +true zero-copy direct IO and the end user is fully responsible for any +race. + +However this is not going to fix all situations, as it's still possible +to race with balance where the fs got a new data profile after the data +allocation profile check. +But this fix should still greatly reduce the window of the original bug. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=99171 +Signed-off-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/direct-io.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/fs/btrfs/direct-io.c b/fs/btrfs/direct-io.c +index 07e19e88ba4b3..5443d69efe956 100644 +--- a/fs/btrfs/direct-io.c ++++ b/fs/btrfs/direct-io.c +@@ -814,6 +814,8 @@ ssize_t btrfs_direct_write(struct kiocb *iocb, struct iov_iter *from) + ssize_t ret; + unsigned int ilock_flags = 0; + struct iomap_dio *dio; ++ const u64 data_profile = btrfs_data_alloc_profile(fs_info) & ++ BTRFS_BLOCK_GROUP_PROFILE_MASK; + + if (iocb->ki_flags & IOCB_NOWAIT) + ilock_flags |= BTRFS_ILOCK_TRY; +@@ -827,6 +829,16 @@ ssize_t btrfs_direct_write(struct kiocb *iocb, struct iov_iter *from) + if (iocb->ki_pos + iov_iter_count(from) <= i_size_read(inode) && IS_NOSEC(inode)) + ilock_flags |= BTRFS_ILOCK_SHARED; + ++ /* ++ * If our data profile has duplication (either extra mirrors or RAID56), ++ * we can not trust the direct IO buffer, the content may change during ++ * writeback and cause different contents written to different mirrors. ++ * ++ * Thus only RAID0 and SINGLE can go true zero-copy direct IO. ++ */ ++ if (data_profile != BTRFS_BLOCK_GROUP_RAID0 && data_profile != 0) ++ goto buffered; ++ + relock: + ret = btrfs_inode_lock(BTRFS_I(inode), ilock_flags); + if (ret < 0) +-- +2.51.0 + diff --git a/queue-6.19/btrfs-handle-user-interrupt-properly-in-btrfs_trim_f.patch b/queue-6.19/btrfs-handle-user-interrupt-properly-in-btrfs_trim_f.patch new file mode 100644 index 00000000000..5c965942f7c --- /dev/null +++ b/queue-6.19/btrfs-handle-user-interrupt-properly-in-btrfs_trim_f.patch @@ -0,0 +1,76 @@ +From 92ca26ea5f9525bb1724eb912cb4d83e74869b5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 07:06:40 +0000 +Subject: btrfs: handle user interrupt properly in btrfs_trim_fs() + +From: jinbaohong + +[ Upstream commit bfb670b9183b0e4ba660aff2e396ec1cc01d0761 ] + +When a fatal signal is pending or the process is freezing, +btrfs_trim_block_group() and btrfs_trim_free_extents() return -ERESTARTSYS. +Currently this is treated as a regular error: the loops continue to the +next iteration and count it as a block group or device failure. + +Instead, break out of the loops immediately and return -ERESTARTSYS to +userspace without counting it as a failure. Also skip the device loop +entirely if the block group loop was interrupted. + +Reviewed-by: Qu Wenruo +Signed-off-by: Robbie Ko +Signed-off-by: jinbaohong +Reviewed-by: Filipe Manana +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/extent-tree.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 1bf081243efb2..8bdb609f58a7e 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -6555,6 +6555,10 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range) + range->minlen); + + trimmed += group_trimmed; ++ if (ret == -ERESTARTSYS || ret == -EINTR) { ++ btrfs_put_block_group(cache); ++ break; ++ } + if (ret) { + bg_failed++; + bg_ret = ret; +@@ -6568,6 +6572,9 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range) + "failed to trim %llu block group(s), last error %d", + bg_failed, bg_ret); + ++ if (ret == -ERESTARTSYS || ret == -EINTR) ++ return ret; ++ + mutex_lock(&fs_devices->device_list_mutex); + list_for_each_entry(device, &fs_devices->devices, dev_list) { + if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state)) +@@ -6576,6 +6583,8 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range) + ret = btrfs_trim_free_extents(device, &group_trimmed); + + trimmed += group_trimmed; ++ if (ret == -ERESTARTSYS || ret == -EINTR) ++ break; + if (ret) { + dev_failed++; + dev_ret = ret; +@@ -6589,6 +6598,8 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range) + "failed to trim %llu device(s), last error %d", + dev_failed, dev_ret); + range->len = trimmed; ++ if (ret == -ERESTARTSYS || ret == -EINTR) ++ return ret; + if (bg_ret) + return bg_ret; + return dev_ret; +-- +2.51.0 + diff --git a/queue-6.19/btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch b/queue-6.19/btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch new file mode 100644 index 00000000000..02afeee323b --- /dev/null +++ b/queue-6.19/btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch @@ -0,0 +1,46 @@ +From e0b18c890ee6e3d335e358aa74dc6724e60340b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 22:53:57 +0530 +Subject: btrfs: replace BUG() with error handling in __btrfs_balance() + +From: Adarsh Das + +[ Upstream commit be6324a809dbda76d5fdb23720ad9b20e5c1905c ] + +We search with offset (u64)-1 which should never match exactly. +Previously this was handled with BUG(). Now logs an error +and return -EUCLEAN. + +Reviewed-by: Qu Wenruo +Signed-off-by: Adarsh Das +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/volumes.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 99e167a697ba8..1cbe7c6a2889c 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -4234,8 +4234,14 @@ static int __btrfs_balance(struct btrfs_fs_info *fs_info) + * this shouldn't happen, it means the last relocate + * failed + */ +- if (ret == 0) +- BUG(); /* FIXME break ? */ ++ if (unlikely(ret == 0)) { ++ btrfs_err(fs_info, ++ "unexpected exact match of CHUNK_ITEM in chunk tree, offset 0x%llx", ++ key.offset); ++ mutex_unlock(&fs_info->reclaim_bgs_lock); ++ ret = -EUCLEAN; ++ goto error; ++ } + + ret = btrfs_previous_item(chunk_root, path, 0, + BTRFS_CHUNK_ITEM_KEY); +-- +2.51.0 + diff --git a/queue-6.19/ceph-supply-snapshot-context-in-ceph_uninline_data.patch b/queue-6.19/ceph-supply-snapshot-context-in-ceph_uninline_data.patch new file mode 100644 index 00000000000..ba1ce621285 --- /dev/null +++ b/queue-6.19/ceph-supply-snapshot-context-in-ceph_uninline_data.patch @@ -0,0 +1,127 @@ +From 4164e74164367b88cf482a93e1bb16a331a6369b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 18:42:06 +0800 +Subject: ceph: supply snapshot context in ceph_uninline_data() + +From: ethanwu + +[ Upstream commit 305ff6b3a03c230d3c07b61457e961406d979693 ] + +The ceph_uninline_data function was missing proper snapshot context +handling for its OSD write operations. Both CEPH_OSD_OP_CREATE and +CEPH_OSD_OP_WRITE requests were passing NULL instead of the appropriate +snapshot context, which could lead to unnecessary object clone. + +Reproducer: +../src/vstart.sh --new -x --localhost --bluestore +// turn on cephfs inline data +./bin/ceph fs set a inline_data true --yes-i-really-really-mean-it +// allow fs_a client to take snapshot +./bin/ceph auth caps client.fs_a mds 'allow rwps fsname=a' mon 'allow r fsname=a' osd 'allow rw tag cephfs data=a' +// mount cephfs with fuse, since kernel cephfs doesn't support inline write +ceph-fuse --id fs_a -m 127.0.0.1:40318 --conf ceph.conf -d /mnt/mycephfs/ +// bump snapshot seq +mkdir /mnt/mycephfs/.snap/snap1 +echo "foo" > /mnt/mycephfs/test +// umount and mount it again using kernel cephfs client +umount /mnt/mycephfs +mount -t ceph fs_a@.a=/ /mnt/mycephfs/ -o conf=./ceph.conf +echo "bar" >> /mnt/mycephfs/test +./bin/rados listsnaps -p cephfs.a.data $(printf "%x\n" $(stat -c %i /mnt/mycephfs/test)).00000000 + +will see this object does unnecessary clone +1000000000a.00000000 (seq:2): +cloneid snaps size overlap +2 2 4 [] +head - 8 + +but it's expected to see +10000000000.00000000 (seq:2): +cloneid snaps size overlap +head - 8 + +since there's no snapshot between these 2 writes + +clone happened because the first osd request CEPH_OSD_OP_CREATE doesn't +pass snap context so object is created with snap seq 0, but later data +writeback is equipped with snapshot context. +snap.seq(1) > object snap seq(0), so osd does object clone. + +This fix properly acquiring the snapshot context before performing +write operations. + +Signed-off-by: ethanwu +Reviewed-by: Viacheslav Dubeyko +Tested-by: Viacheslav Dubeyko +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/addr.c | 24 ++++++++++++++++++++++-- + 1 file changed, 22 insertions(+), 2 deletions(-) + +diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c +index 63b75d2142102..faecd9025ee9c 100644 +--- a/fs/ceph/addr.c ++++ b/fs/ceph/addr.c +@@ -2199,6 +2199,7 @@ int ceph_uninline_data(struct file *file) + struct ceph_osd_request *req = NULL; + struct ceph_cap_flush *prealloc_cf = NULL; + struct folio *folio = NULL; ++ struct ceph_snap_context *snapc = NULL; + u64 inline_version = CEPH_INLINE_NONE; + struct page *pages[1]; + int err = 0; +@@ -2226,6 +2227,24 @@ int ceph_uninline_data(struct file *file) + if (inline_version == 1) /* initial version, no data */ + goto out_uninline; + ++ down_read(&fsc->mdsc->snap_rwsem); ++ spin_lock(&ci->i_ceph_lock); ++ if (__ceph_have_pending_cap_snap(ci)) { ++ struct ceph_cap_snap *capsnap = ++ list_last_entry(&ci->i_cap_snaps, ++ struct ceph_cap_snap, ++ ci_item); ++ snapc = ceph_get_snap_context(capsnap->context); ++ } else { ++ if (!ci->i_head_snapc) { ++ ci->i_head_snapc = ceph_get_snap_context( ++ ci->i_snap_realm->cached_context); ++ } ++ snapc = ceph_get_snap_context(ci->i_head_snapc); ++ } ++ spin_unlock(&ci->i_ceph_lock); ++ up_read(&fsc->mdsc->snap_rwsem); ++ + folio = read_mapping_folio(inode->i_mapping, 0, file); + if (IS_ERR(folio)) { + err = PTR_ERR(folio); +@@ -2241,7 +2260,7 @@ int ceph_uninline_data(struct file *file) + req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout, + ceph_vino(inode), 0, &len, 0, 1, + CEPH_OSD_OP_CREATE, CEPH_OSD_FLAG_WRITE, +- NULL, 0, 0, false); ++ snapc, 0, 0, false); + if (IS_ERR(req)) { + err = PTR_ERR(req); + goto out_unlock; +@@ -2257,7 +2276,7 @@ int ceph_uninline_data(struct file *file) + req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout, + ceph_vino(inode), 0, &len, 1, 3, + CEPH_OSD_OP_WRITE, CEPH_OSD_FLAG_WRITE, +- NULL, ci->i_truncate_seq, ++ snapc, ci->i_truncate_seq, + ci->i_truncate_size, false); + if (IS_ERR(req)) { + err = PTR_ERR(req); +@@ -2320,6 +2339,7 @@ int ceph_uninline_data(struct file *file) + folio_put(folio); + } + out: ++ ceph_put_snap_context(snapc); + ceph_free_cap_flush(prealloc_cf); + doutc(cl, "%llx.%llx inline_version %llu = %d\n", + ceph_vinop(inode), inline_version, err); +-- +2.51.0 + diff --git a/queue-6.19/cgroup-cpuset-don-t-fail-cpuset.cpus-change-in-v2.patch b/queue-6.19/cgroup-cpuset-don-t-fail-cpuset.cpus-change-in-v2.patch new file mode 100644 index 00000000000..263ce7f144f --- /dev/null +++ b/queue-6.19/cgroup-cpuset-don-t-fail-cpuset.cpus-change-in-v2.patch @@ -0,0 +1,126 @@ +From ebd8d8ebf66148e81f27a52dfa155a1bf18dda90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 11:00:19 -0500 +Subject: cgroup/cpuset: Don't fail cpuset.cpus change in v2 + +From: Waiman Long + +[ Upstream commit 6e6f13f6d5095f3a432da421e78f4d7d51ef39c8 ] + +Commit fe8cd2736e75 ("cgroup/cpuset: Delay setting of CS_CPU_EXCLUSIVE +until valid partition") introduced a new check to disallow the setting +of a new cpuset.cpus.exclusive value that is a superset of a sibling's +cpuset.cpus value so that there will at least be one CPU left in the +sibling in case the cpuset becomes a valid partition root. This new +check does have the side effect of failing a cpuset.cpus change that +make it a subset of a sibling's cpuset.cpus.exclusive value. + +With v2, users are supposed to be allowed to set whatever value they +want in cpuset.cpus without failure. To maintain this rule, the check +is now restricted to only when cpuset.cpus.exclusive is being changed +not when cpuset.cpus is changed. + +The cgroup-v2.rst doc file is also updated to reflect this change. + +Signed-off-by: Waiman Long +Reviewed-by: Chen Ridong +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + Documentation/admin-guide/cgroup-v2.rst | 8 +++---- + kernel/cgroup/cpuset.c | 30 ++++++++++++------------- + 2 files changed, 19 insertions(+), 19 deletions(-) + +diff --git a/Documentation/admin-guide/cgroup-v2.rst b/Documentation/admin-guide/cgroup-v2.rst +index 7f5b59d95fce5..510df2461aff2 100644 +--- a/Documentation/admin-guide/cgroup-v2.rst ++++ b/Documentation/admin-guide/cgroup-v2.rst +@@ -2561,10 +2561,10 @@ Cpuset Interface Files + Users can manually set it to a value that is different from + "cpuset.cpus". One constraint in setting it is that the list of + CPUs must be exclusive with respect to "cpuset.cpus.exclusive" +- of its sibling. If "cpuset.cpus.exclusive" of a sibling cgroup +- isn't set, its "cpuset.cpus" value, if set, cannot be a subset +- of it to leave at least one CPU available when the exclusive +- CPUs are taken away. ++ and "cpuset.cpus.exclusive.effective" of its siblings. Another ++ constraint is that it cannot be a superset of "cpuset.cpus" ++ of its sibling in order to leave at least one CPU available to ++ that sibling when the exclusive CPUs are taken away. + + For a parent cgroup, any one of its exclusive CPUs can only + be distributed to at most one of its child cgroups. Having an +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index c06e2e96f79dc..dc3ac38c5d160 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -603,33 +603,31 @@ static inline bool cpusets_are_exclusive(struct cpuset *cs1, struct cpuset *cs2) + + /** + * cpus_excl_conflict - Check if two cpusets have exclusive CPU conflicts +- * @cs1: first cpuset to check +- * @cs2: second cpuset to check ++ * @trial: the trial cpuset to be checked ++ * @sibling: a sibling cpuset to be checked against ++ * @xcpus_changed: set if exclusive_cpus has been set + * + * Returns: true if CPU exclusivity conflict exists, false otherwise + * + * Conflict detection rules: + * 1. If either cpuset is CPU exclusive, they must be mutually exclusive + * 2. exclusive_cpus masks cannot intersect between cpusets +- * 3. The allowed CPUs of one cpuset cannot be a subset of another's exclusive CPUs ++ * 3. The allowed CPUs of a sibling cpuset cannot be a subset of the new exclusive CPUs + */ +-static inline bool cpus_excl_conflict(struct cpuset *cs1, struct cpuset *cs2) ++static inline bool cpus_excl_conflict(struct cpuset *trial, struct cpuset *sibling, ++ bool xcpus_changed) + { + /* If either cpuset is exclusive, check if they are mutually exclusive */ +- if (is_cpu_exclusive(cs1) || is_cpu_exclusive(cs2)) +- return !cpusets_are_exclusive(cs1, cs2); ++ if (is_cpu_exclusive(trial) || is_cpu_exclusive(sibling)) ++ return !cpusets_are_exclusive(trial, sibling); + + /* Exclusive_cpus cannot intersect */ +- if (cpumask_intersects(cs1->exclusive_cpus, cs2->exclusive_cpus)) ++ if (cpumask_intersects(trial->exclusive_cpus, sibling->exclusive_cpus)) + return true; + +- /* The cpus_allowed of one cpuset cannot be a subset of another cpuset's exclusive_cpus */ +- if (!cpumask_empty(cs1->cpus_allowed) && +- cpumask_subset(cs1->cpus_allowed, cs2->exclusive_cpus)) +- return true; +- +- if (!cpumask_empty(cs2->cpus_allowed) && +- cpumask_subset(cs2->cpus_allowed, cs1->exclusive_cpus)) ++ /* The cpus_allowed of a sibling cpuset cannot be a subset of the new exclusive_cpus */ ++ if (xcpus_changed && !cpumask_empty(sibling->cpus_allowed) && ++ cpumask_subset(sibling->cpus_allowed, trial->exclusive_cpus)) + return true; + + return false; +@@ -666,6 +664,7 @@ static int validate_change(struct cpuset *cur, struct cpuset *trial) + { + struct cgroup_subsys_state *css; + struct cpuset *c, *par; ++ bool xcpus_changed; + int ret = 0; + + rcu_read_lock(); +@@ -722,10 +721,11 @@ static int validate_change(struct cpuset *cur, struct cpuset *trial) + * overlap. exclusive_cpus cannot overlap with each other if set. + */ + ret = -EINVAL; ++ xcpus_changed = !cpumask_equal(cur->exclusive_cpus, trial->exclusive_cpus); + cpuset_for_each_child(c, css, par) { + if (c == cur) + continue; +- if (cpus_excl_conflict(trial, c)) ++ if (cpus_excl_conflict(trial, c, xcpus_changed)) + goto out; + if (mems_excl_conflict(trial, c)) + goto out; +-- +2.51.0 + diff --git a/queue-6.19/char-tpm-cr50-remove-irqf_oneshot.patch b/queue-6.19/char-tpm-cr50-remove-irqf_oneshot.patch new file mode 100644 index 00000000000..bbff22bd5d1 --- /dev/null +++ b/queue-6.19/char-tpm-cr50-remove-irqf_oneshot.patch @@ -0,0 +1,59 @@ +From 1d3dcf40a93da62f90214c8c88a5f64f36feb468 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:29 +0100 +Subject: char: tpm: cr50: Remove IRQF_ONESHOT + +From: Sebastian Andrzej Siewior + +[ Upstream commit 1affd29ffbd50125a5492c6be1dbb1f04be18d4f ] + +Passing IRQF_ONESHOT ensures that the interrupt source is masked until +the secondary (threaded) handler is done. If only a primary handler is +used then the flag makes no sense because the interrupt can not fire +(again) while its handler is running. + +The flag also prevents force-threading of the primary handler and the +irq-core will warn about this. + +Remove IRQF_ONESHOT from irqflags. + +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Thomas Gleixner +Reviewed-by: Jarkko Sakkinen +Link: https://patch.msgid.link/20260128095540.863589-10-bigeasy@linutronix.de +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_i2c_cr50.c | 3 +-- + drivers/char/tpm/tpm_tis_spi_cr50.c | 2 +- + 2 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_i2c_cr50.c b/drivers/char/tpm/tpm_tis_i2c_cr50.c +index fc6891a0b6936..b48cacacc0664 100644 +--- a/drivers/char/tpm/tpm_tis_i2c_cr50.c ++++ b/drivers/char/tpm/tpm_tis_i2c_cr50.c +@@ -749,8 +749,7 @@ static int tpm_cr50_i2c_probe(struct i2c_client *client) + + if (client->irq > 0) { + rc = devm_request_irq(dev, client->irq, tpm_cr50_i2c_int_handler, +- IRQF_TRIGGER_FALLING | IRQF_ONESHOT | +- IRQF_NO_AUTOEN, ++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN, + dev->driver->name, chip); + if (rc < 0) { + dev_err(dev, "Failed to probe IRQ %d\n", client->irq); +diff --git a/drivers/char/tpm/tpm_tis_spi_cr50.c b/drivers/char/tpm/tpm_tis_spi_cr50.c +index f4937280e9406..32920b4cecfb4 100644 +--- a/drivers/char/tpm/tpm_tis_spi_cr50.c ++++ b/drivers/char/tpm/tpm_tis_spi_cr50.c +@@ -287,7 +287,7 @@ int cr50_spi_probe(struct spi_device *spi) + if (spi->irq > 0) { + ret = devm_request_irq(&spi->dev, spi->irq, + cr50_spi_irq_handler, +- IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ IRQF_TRIGGER_RISING, + "cr50_spi", cr50_phy); + if (ret < 0) { + if (ret == -EPROBE_DEFER) +-- +2.51.0 + diff --git a/queue-6.19/clk-amlogic-remove-potentially-unsafe-flags-from-s4-.patch b/queue-6.19/clk-amlogic-remove-potentially-unsafe-flags-from-s4-.patch new file mode 100644 index 00000000000..52717301c98 --- /dev/null +++ b/queue-6.19/clk-amlogic-remove-potentially-unsafe-flags-from-s4-.patch @@ -0,0 +1,60 @@ +From 3f2e566843bd4b6f2ab2af7e3bb0d2353c2b30f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 13:59:01 +0800 +Subject: clk: amlogic: remove potentially unsafe flags from S4 video clocks + +From: Chuan Liu + +[ Upstream commit 4aca7e92023cac5018b4053bae324450f884c937 ] + +The video clocks enci, encp, vdac and hdmitx share the same clock +source. Adding CLK_SET_RATE_PARENT to the mux may unintentionally change +the shared parent clock, which could affect other video clocks. + +Signed-off-by: Chuan Liu +Link: https://lore.kernel.org/r/20250919-add_video_clk-v6-3-fe223161fb3f@amlogic.com +Signed-off-by: Jerome Brunet +Signed-off-by: Sasha Levin +--- + drivers/clk/meson/s4-peripherals.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/clk/meson/s4-peripherals.c b/drivers/clk/meson/s4-peripherals.c +index 6d69b132d1e1f..bab4f5700de47 100644 +--- a/drivers/clk/meson/s4-peripherals.c ++++ b/drivers/clk/meson/s4-peripherals.c +@@ -1106,7 +1106,6 @@ static struct clk_regmap s4_cts_enci_sel = { + .ops = &clk_regmap_mux_ops, + .parent_hws = s4_cts_parents, + .num_parents = ARRAY_SIZE(s4_cts_parents), +- .flags = CLK_SET_RATE_PARENT, + }, + }; + +@@ -1122,7 +1121,6 @@ static struct clk_regmap s4_cts_encp_sel = { + .ops = &clk_regmap_mux_ops, + .parent_hws = s4_cts_parents, + .num_parents = ARRAY_SIZE(s4_cts_parents), +- .flags = CLK_SET_RATE_PARENT, + }, + }; + +@@ -1138,7 +1136,6 @@ static struct clk_regmap s4_cts_vdac_sel = { + .ops = &clk_regmap_mux_ops, + .parent_hws = s4_cts_parents, + .num_parents = ARRAY_SIZE(s4_cts_parents), +- .flags = CLK_SET_RATE_PARENT, + }, + }; + +@@ -1169,7 +1166,6 @@ static struct clk_regmap s4_hdmi_tx_sel = { + .ops = &clk_regmap_mux_ops, + .parent_hws = s4_hdmi_tx_parents, + .num_parents = ARRAY_SIZE(s4_hdmi_tx_parents), +- .flags = CLK_SET_RATE_PARENT, + }, + }; + +-- +2.51.0 + diff --git a/queue-6.19/clk-microchip-core-correct-return-value-on-_get_pare.patch b/queue-6.19/clk-microchip-core-correct-return-value-on-_get_pare.patch new file mode 100644 index 00000000000..168fc10a718 --- /dev/null +++ b/queue-6.19/clk-microchip-core-correct-return-value-on-_get_pare.patch @@ -0,0 +1,80 @@ +From e6200eee5d61a0099002dbba554576e2bf254fcf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 14:46:28 -0500 +Subject: clk: microchip: core: correct return value on *_get_parent() + +From: Brian Masney + +[ Upstream commit 5df96d141cccb37f0c3112a22fc1112ea48e9246 ] + +roclk_get_parent() and sclk_get_parent() has the possibility of +returning -EINVAL, however the framework expects this call to always +succeed since the return value is unsigned. + +If there is no parent map defined, then the current value programmed in +the hardware is used. Let's use that same value in the case where +-EINVAL is currently returned. + +This index is only used by clk_core_get_parent_by_index(), and it +validates that it doesn't overflow the number of available parents. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202512050233.R9hAWsJN-lkp@intel.com/ +Signed-off-by: Brian Masney +Reviewed-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20251205-clk-microchip-fixes-v3-2-a02190705e47@redhat.com +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + drivers/clk/microchip/clk-core.c | 25 ++++++++++++------------- + 1 file changed, 12 insertions(+), 13 deletions(-) + +diff --git a/drivers/clk/microchip/clk-core.c b/drivers/clk/microchip/clk-core.c +index a0163441dfe5c..82f62731fc0ed 100644 +--- a/drivers/clk/microchip/clk-core.c ++++ b/drivers/clk/microchip/clk-core.c +@@ -283,14 +283,13 @@ static u8 roclk_get_parent(struct clk_hw *hw) + + v = (readl(refo->ctrl_reg) >> REFO_SEL_SHIFT) & REFO_SEL_MASK; + +- if (!refo->parent_map) +- return v; +- +- for (i = 0; i < clk_hw_get_num_parents(hw); i++) +- if (refo->parent_map[i] == v) +- return i; ++ if (refo->parent_map) { ++ for (i = 0; i < clk_hw_get_num_parents(hw); i++) ++ if (refo->parent_map[i] == v) ++ return i; ++ } + +- return -EINVAL; ++ return v; + } + + static unsigned long roclk_calc_rate(unsigned long parent_rate, +@@ -817,13 +816,13 @@ static u8 sclk_get_parent(struct clk_hw *hw) + + v = (readl(sclk->mux_reg) >> OSC_CUR_SHIFT) & OSC_CUR_MASK; + +- if (!sclk->parent_map) +- return v; ++ if (sclk->parent_map) { ++ for (i = 0; i < clk_hw_get_num_parents(hw); i++) ++ if (sclk->parent_map[i] == v) ++ return i; ++ } + +- for (i = 0; i < clk_hw_get_num_parents(hw); i++) +- if (sclk->parent_map[i] == v) +- return i; +- return -EINVAL; ++ return v; + } + + static int sclk_set_parent(struct clk_hw *hw, u8 index) +-- +2.51.0 + diff --git a/queue-6.19/clk-renesas-rzg2l-deassert-reset-on-assert-timeout.patch b/queue-6.19/clk-renesas-rzg2l-deassert-reset-on-assert-timeout.patch new file mode 100644 index 00000000000..b3073e82b48 --- /dev/null +++ b/queue-6.19/clk-renesas-rzg2l-deassert-reset-on-assert-timeout.patch @@ -0,0 +1,53 @@ +From 60902cfd2e88699f36a5336b4294b6dba4f84fa2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:34:27 +0000 +Subject: clk: renesas: rzg2l: Deassert reset on assert timeout + +From: Biju Das + +[ Upstream commit 0b0201f259e1158a875c5fd01adf318ae5d32352 ] + +If the assert() fails due to timeout error, set the reset register bit +back to deasserted state. This change is needed especially for handling +assert error in suspend() callback that expect the device to be in +operational state in case of failure. + +Signed-off-by: Biju Das +Reviewed-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20260108123433.104464-2-biju.das.jz@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/clk/renesas/rzg2l-cpg.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c +index 64d1ef6e4c943..c20ea1212b360 100644 +--- a/drivers/clk/renesas/rzg2l-cpg.c ++++ b/drivers/clk/renesas/rzg2l-cpg.c +@@ -1647,6 +1647,7 @@ static int __rzg2l_cpg_assert(struct reset_controller_dev *rcdev, + u32 mask = BIT(info->resets[id].bit); + s8 monbit = info->resets[id].monbit; + u32 value = mask << 16; ++ u32 mon; + int ret; + + dev_dbg(rcdev->dev, "%s id:%ld offset:0x%x\n", +@@ -1667,10 +1668,10 @@ static int __rzg2l_cpg_assert(struct reset_controller_dev *rcdev, + return 0; + } + +- ret = readl_poll_timeout_atomic(priv->base + reg, value, +- assert == !!(value & mask), 10, 200); +- if (ret && !assert) { +- value = mask << 16; ++ ret = readl_poll_timeout_atomic(priv->base + reg, mon, ++ assert == !!(mon & mask), 10, 200); ++ if (ret) { ++ value ^= mask; + writel(value, priv->base + CLK_RST_R(info->resets[id].off)); + } + +-- +2.51.0 + diff --git a/queue-6.19/clocksource-drivers-sh_tmu-always-leave-device-runni.patch b/queue-6.19/clocksource-drivers-sh_tmu-always-leave-device-runni.patch new file mode 100644 index 00000000000..cd3897bd7f8 --- /dev/null +++ b/queue-6.19/clocksource-drivers-sh_tmu-always-leave-device-runni.patch @@ -0,0 +1,149 @@ +From 174508a08816695f021d8b7cd92af6c4e3db6cb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 23:13:41 +0100 +Subject: clocksource/drivers/sh_tmu: Always leave device running after probe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Niklas Söderlund + +[ Upstream commit b1278972b08e480990e2789bdc6a7c918bc349be ] + +The TMU device can be used as both a clocksource and a clockevent +provider. The driver tries to be smart and power itself on and off, as +well as enabling and disabling its clock when it's not in operation. +This behavior is slightly altered if the TMU is used as an early +platform device in which case the device is left powered on after probe, +but the clock is still enabled and disabled at runtime. + +This has worked for a long time, but recent improvements in PREEMPT_RT +and PROVE_LOCKING have highlighted an issue. As the TMU registers itself +as a clockevent provider, clockevents_register_device(), it needs to use +raw spinlocks internally as this is the context of which the clockevent +framework interacts with the TMU driver. However in the context of +holding a raw spinlock the TMU driver can't really manage its power +state or clock with calls to pm_runtime_*() and clk_*() as these calls +end up in other platform drivers using regular spinlocks to control +power and clocks. + +This mix of spinlock contexts trips a lockdep warning. + + ============================= + [ BUG: Invalid wait context ] + 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 Not tainted + ----------------------------- + swapper/0/0 is trying to lock: + ffff000008c9e180 (&dev->power.lock){-...}-{3:3}, at: __pm_runtime_resume+0x38/0x88 + other info that might help us debug this: + context-{5:5} + 1 lock held by swapper/0/0: + ccree e6601000.crypto: ARM CryptoCell 630P Driver: HW version 0xAF400001/0xDCC63000, Driver version 5.0 + #0: ffff8000817ec298 + ccree e6601000.crypto: ARM ccree device initialized + (tick_broadcast_lock){-...}-{2:2}, at: __tick_broadcast_oneshot_control+0xa4/0x3a8 + stack backtrace: + CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 PREEMPT + Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT) + Call trace: + show_stack+0x14/0x1c (C) + dump_stack_lvl+0x6c/0x90 + dump_stack+0x14/0x1c + __lock_acquire+0x904/0x1584 + lock_acquire+0x220/0x34c + _raw_spin_lock_irqsave+0x58/0x80 + __pm_runtime_resume+0x38/0x88 + sh_tmu_clock_event_set_oneshot+0x84/0xd4 + clockevents_switch_state+0xfc/0x13c + tick_broadcast_set_event+0x30/0xa4 + __tick_broadcast_oneshot_control+0x1e0/0x3a8 + tick_broadcast_oneshot_control+0x30/0x40 + cpuidle_enter_state+0x40c/0x680 + cpuidle_enter+0x30/0x40 + do_idle+0x1f4/0x280 + cpu_startup_entry+0x34/0x40 + kernel_init+0x0/0x130 + do_one_initcall+0x0/0x230 + __primary_switched+0x88/0x90 + +For non-PREEMPT_RT builds this is not really an issue, but for +PREEMPT_RT builds where normal spinlocks can sleep this might be an +issue. Be cautious and always leave the power and clock running after +probe. + +Signed-off-by: Niklas Söderlund +Signed-off-by: Daniel Lezcano +Tested-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20251202221341.1856773-1-niklas.soderlund+renesas@ragnatech.se +Signed-off-by: Sasha Levin +--- + drivers/clocksource/sh_tmu.c | 18 ------------------ + 1 file changed, 18 deletions(-) + +diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c +index beffff81c00f3..3fc6ed9b56300 100644 +--- a/drivers/clocksource/sh_tmu.c ++++ b/drivers/clocksource/sh_tmu.c +@@ -143,16 +143,6 @@ static void sh_tmu_start_stop_ch(struct sh_tmu_channel *ch, int start) + + static int __sh_tmu_enable(struct sh_tmu_channel *ch) + { +- int ret; +- +- /* enable clock */ +- ret = clk_enable(ch->tmu->clk); +- if (ret) { +- dev_err(&ch->tmu->pdev->dev, "ch%u: cannot enable clock\n", +- ch->index); +- return ret; +- } +- + /* make sure channel is disabled */ + sh_tmu_start_stop_ch(ch, 0); + +@@ -174,7 +164,6 @@ static int sh_tmu_enable(struct sh_tmu_channel *ch) + if (ch->enable_count++ > 0) + return 0; + +- pm_runtime_get_sync(&ch->tmu->pdev->dev); + dev_pm_syscore_device(&ch->tmu->pdev->dev, true); + + return __sh_tmu_enable(ch); +@@ -187,9 +176,6 @@ static void __sh_tmu_disable(struct sh_tmu_channel *ch) + + /* disable interrupts in TMU block */ + sh_tmu_write(ch, TCR, TCR_TPSC_CLK4); +- +- /* stop clock */ +- clk_disable(ch->tmu->clk); + } + + static void sh_tmu_disable(struct sh_tmu_channel *ch) +@@ -203,7 +189,6 @@ static void sh_tmu_disable(struct sh_tmu_channel *ch) + __sh_tmu_disable(ch); + + dev_pm_syscore_device(&ch->tmu->pdev->dev, false); +- pm_runtime_put(&ch->tmu->pdev->dev); + } + + static void sh_tmu_set_next(struct sh_tmu_channel *ch, unsigned long delta, +@@ -552,7 +537,6 @@ static int sh_tmu_setup(struct sh_tmu_device *tmu, struct platform_device *pdev) + goto err_clk_unprepare; + + tmu->rate = clk_get_rate(tmu->clk) / 4; +- clk_disable(tmu->clk); + + /* Map the memory resource. */ + ret = sh_tmu_map_memory(tmu); +@@ -626,8 +610,6 @@ static int sh_tmu_probe(struct platform_device *pdev) + out: + if (tmu->has_clockevent || tmu->has_clocksource) + pm_runtime_irq_safe(&pdev->dev); +- else +- pm_runtime_idle(&pdev->dev); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.19/clocksource-drivers-timer-integrator-ap-add-missing-.patch b/queue-6.19/clocksource-drivers-timer-integrator-ap-add-missing-.patch new file mode 100644 index 00000000000..0acf99df5de --- /dev/null +++ b/queue-6.19/clocksource-drivers-timer-integrator-ap-add-missing-.patch @@ -0,0 +1,38 @@ +From 963402dd0ea6aa5609f463a20625e8819fd201ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jan 2026 12:17:23 +0100 +Subject: clocksource/drivers/timer-integrator-ap: Add missing Kconfig + dependency on OF + +From: Bartosz Golaszewski + +[ Upstream commit 2246464821e2820572e6feefca2029f17629cc50 ] + +This driver accesses the of_aliases global variable declared in +linux/of.h and defined in drivers/base/of.c. It requires OF support or +will cause a link failure. Add the missing Kconfig dependency. + +Closes: https://lore.kernel.org/oe-kbuild-all/202601152233.og6LdeUo-lkp@intel.com/ +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Daniel Lezcano +Link: https://patch.msgid.link/20260116111723.10585-1-bartosz.golaszewski@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/clocksource/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig +index aa59e5b133510..fd91127065454 100644 +--- a/drivers/clocksource/Kconfig ++++ b/drivers/clocksource/Kconfig +@@ -254,6 +254,7 @@ config KEYSTONE_TIMER + + config INTEGRATOR_AP_TIMER + bool "Integrator-AP timer driver" if COMPILE_TEST ++ depends on OF + select CLKSRC_MMIO + help + Enables support for the Integrator-AP timer. +-- +2.51.0 + diff --git a/queue-6.19/cpufreq-dt-platdev-block-the-driver-from-probing-on-.patch b/queue-6.19/cpufreq-dt-platdev-block-the-driver-from-probing-on-.patch new file mode 100644 index 00000000000..03433d1b5a4 --- /dev/null +++ b/queue-6.19/cpufreq-dt-platdev-block-the-driver-from-probing-on-.patch @@ -0,0 +1,39 @@ +From 250e7d61694011bff7def520b65fa995d5dd402f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 16:25:35 +0100 +Subject: cpufreq: dt-platdev: Block the driver from probing on more QC + platforms + +From: Konrad Dybcio + +[ Upstream commit 7b781899072c5701ef9538c365757ee9ab9c00bd ] + +Add a number of QC platforms to the blocklist, they all use either the +qcom-cpufreq-hw driver. + +Signed-off-by: Konrad Dybcio +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq-dt-platdev.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c +index b06a43143d23c..2fecab989dacc 100644 +--- a/drivers/cpufreq/cpufreq-dt-platdev.c ++++ b/drivers/cpufreq/cpufreq-dt-platdev.c +@@ -169,8 +169,11 @@ static const struct of_device_id blocklist[] __initconst = { + { .compatible = "qcom,sdm845", }, + { .compatible = "qcom,sdx75", }, + { .compatible = "qcom,sm6115", }, ++ { .compatible = "qcom,sm6125", }, ++ { .compatible = "qcom,sm6150", }, + { .compatible = "qcom,sm6350", }, + { .compatible = "qcom,sm6375", }, ++ { .compatible = "qcom,sm7125", }, + { .compatible = "qcom,sm7225", }, + { .compatible = "qcom,sm7325", }, + { .compatible = "qcom,sm8150", }, +-- +2.51.0 + diff --git a/queue-6.19/crypto-hisilicon-qm-move-the-barrier-before-writing-.patch b/queue-6.19/crypto-hisilicon-qm-move-the-barrier-before-writing-.patch new file mode 100644 index 00000000000..9a316b97108 --- /dev/null +++ b/queue-6.19/crypto-hisilicon-qm-move-the-barrier-before-writing-.patch @@ -0,0 +1,45 @@ +From 1accc0db8791d1ce84bbfacf821635320d0b70fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jan 2026 18:18:03 +0800 +Subject: crypto: hisilicon/qm - move the barrier before writing to the mailbox + register + +From: Chenghai Huang + +[ Upstream commit ebf35d8f9368816c930f5d70783a72716fab5e19 ] + +Before sending the data via the mailbox to the hardware, to ensure +that the data accessed by the hardware is the most up-to-date, +a write barrier should be added before writing to the mailbox register. +The current memory barrier is placed after writing to the register, +the barrier order should be modified to be before writing to the register. + +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/qm.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c +index b8e59f99f7007..cf58d0d01b199 100644 +--- a/drivers/crypto/hisilicon/qm.c ++++ b/drivers/crypto/hisilicon/qm.c +@@ -609,9 +609,13 @@ static void qm_mb_write(struct hisi_qm *qm, const void *src) + } + + #if IS_ENABLED(CONFIG_ARM64) ++ /* ++ * The dmb oshst instruction ensures that the data in the ++ * mailbox is written before it is sent to the hardware. ++ */ + asm volatile("ldp %0, %1, %3\n" +- "stp %0, %1, %2\n" + "dmb oshst\n" ++ "stp %0, %1, %2\n" + : "=&r" (tmp0), + "=&r" (tmp1), + "+Q" (*((char __iomem *)fun_base)) +-- +2.51.0 + diff --git a/queue-6.19/dlm-fix-recovery-pending-middle-conversion.patch b/queue-6.19/dlm-fix-recovery-pending-middle-conversion.patch new file mode 100644 index 00000000000..d1a93273e83 --- /dev/null +++ b/queue-6.19/dlm-fix-recovery-pending-middle-conversion.patch @@ -0,0 +1,75 @@ +From cdfe0b2bda136e9397b59a228fdc1283f67b52b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 10:35:05 -0500 +Subject: dlm: fix recovery pending middle conversion + +From: Alexander Aring + +[ Upstream commit 1416bd508c78bdfdb9ae0b4511369e5581f348ea ] + +During a workload involving conversions between lock modes PR and CW, +lock recovery can create a "conversion deadlock" state between locks +that have been recovered. When this occurs, kernel warning messages +are logged, e.g. + + "dlm: WARN: pending deadlock 1e node 0 2 1bf21" + + "dlm: receive_rcom_lock_args 2e middle convert gr 3 rq 2 remote 2 1e" + +After this occurs, the deadlocked conversions both appear on the convert +queue of the resource being locked, and the conversion requests do not +complete. + +Outside of recovery, conversions that would produce a deadlock are +resolved immediately, and return -EDEADLK. The locks are not placed +on the convert queue in the deadlocked state. + +To fix this problem, an lkb under conversion between PR/CW is rebuilt +during recovery on a new master's granted queue, with the currently +granted mode, rather than being rebuilt on the new master's convert +queue, with the currently granted mode and the newly requested mode. +The in-progress convert is then resent to the new master after +recovery, so the conversion deadlock will be processed outside of +the recovery context and handled as described above. + +Signed-off-by: Alexander Aring +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/lock.c | 19 +------------------ + 1 file changed, 1 insertion(+), 18 deletions(-) + +diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c +index be938fdf17d96..c01a291db401b 100644 +--- a/fs/dlm/lock.c ++++ b/fs/dlm/lock.c +@@ -5014,25 +5014,8 @@ void dlm_receive_buffer(const union dlm_packet *p, int nodeid) + static void recover_convert_waiter(struct dlm_ls *ls, struct dlm_lkb *lkb, + struct dlm_message *ms_local) + { +- if (middle_conversion(lkb)) { +- log_rinfo(ls, "%s %x middle convert in progress", __func__, +- lkb->lkb_id); +- +- /* We sent this lock to the new master. The new master will +- * tell us when it's granted. We no longer need a reply, so +- * use a fake reply to put the lkb into the right state. +- */ +- hold_lkb(lkb); +- memset(ms_local, 0, sizeof(struct dlm_message)); +- ms_local->m_type = cpu_to_le32(DLM_MSG_CONVERT_REPLY); +- ms_local->m_result = cpu_to_le32(to_dlm_errno(-EINPROGRESS)); +- ms_local->m_header.h_nodeid = cpu_to_le32(lkb->lkb_nodeid); +- _receive_convert_reply(lkb, ms_local, true); +- unhold_lkb(lkb); +- +- } else if (lkb->lkb_rqmode >= lkb->lkb_grmode) { ++ if (middle_conversion(lkb) || lkb->lkb_rqmode >= lkb->lkb_grmode) + set_bit(DLM_IFL_RESEND_BIT, &lkb->lkb_iflags); +- } + + /* lkb->lkb_rqmode < lkb->lkb_grmode shouldn't happen since down + conversions are async; there's no reply from the remote master */ +-- +2.51.0 + diff --git a/queue-6.19/dlm-validate-length-in-dlm_search_rsb_tree.patch b/queue-6.19/dlm-validate-length-in-dlm_search_rsb_tree.patch new file mode 100644 index 00000000000..831c71777f7 --- /dev/null +++ b/queue-6.19/dlm-validate-length-in-dlm_search_rsb_tree.patch @@ -0,0 +1,40 @@ +From 0b49ff5358c0a2138828ba0b4d94636ef76370da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 10:35:06 -0500 +Subject: dlm: validate length in dlm_search_rsb_tree + +From: Ezrak1e + +[ Upstream commit 080e5563f878c64e697b89e7439d730d0daad882 ] + +The len parameter in dlm_dump_rsb_name() is not validated and comes +from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can +cause out-of-bounds write in dlm_search_rsb_tree(). + +Add length validation to prevent potential buffer overflow. + +Signed-off-by: Ezrak1e +Signed-off-by: Alexander Aring +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/lock.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c +index c01a291db401b..a393ecaf3442a 100644 +--- a/fs/dlm/lock.c ++++ b/fs/dlm/lock.c +@@ -626,7 +626,8 @@ int dlm_search_rsb_tree(struct rhashtable *rhash, const void *name, int len, + struct dlm_rsb **r_ret) + { + char key[DLM_RESNAME_MAXLEN] = {}; +- ++ if (len > DLM_RESNAME_MAXLEN) ++ return -EINVAL; + memcpy(key, name, len); + *r_ret = rhashtable_lookup_fast(rhash, &key, dlm_rhash_rsb_params); + if (*r_ret) +-- +2.51.0 + diff --git a/queue-6.19/dm-remove-fake-timeout-to-avoid-leak-request.patch b/queue-6.19/dm-remove-fake-timeout-to-avoid-leak-request.patch new file mode 100644 index 00000000000..f47c993014e --- /dev/null +++ b/queue-6.19/dm-remove-fake-timeout-to-avoid-leak-request.patch @@ -0,0 +1,86 @@ +From 48d52a1a56421d75f5dd5c9a1e154f8a04bca122 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Dec 2025 20:03:50 +0800 +Subject: dm: remove fake timeout to avoid leak request + +From: Ding Hui + +[ Upstream commit f3a9c95a15d2f4466acad5c68faeff79ca5e9f47 ] + +Since commit 15f73f5b3e59 ("blk-mq: move failure injection out of +blk_mq_complete_request"), drivers are responsible for calling +blk_should_fake_timeout() at appropriate code paths and opportunities. + +However, the dm driver does not implement its own timeout handler and +relies on the timeout handling of its slave devices. + +If an io-timeout-fail error is injected to a dm device, the request +will be leaked and never completed, causing tasks to hang indefinitely. + +Reproduce: +1. prepare dm which has iscsi slave device +2. inject io-timeout-fail to dm + echo 1 >/sys/class/block/dm-0/io-timeout-fail + echo 100 >/sys/kernel/debug/fail_io_timeout/probability + echo 10 >/sys/kernel/debug/fail_io_timeout/times +3. read/write dm +4. iscsiadm -m node -u + +Result: hang task like below +[ 862.243768] INFO: task kworker/u514:2:151 blocked for more than 122 seconds. +[ 862.244133] Tainted: G E 6.19.0-rc1+ #51 +[ 862.244337] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 862.244718] task:kworker/u514:2 state:D stack:0 pid:151 tgid:151 ppid:2 task_flags:0x4288060 flags:0x00080000 +[ 862.245024] Workqueue: iscsi_ctrl_3:1 __iscsi_unbind_session [scsi_transport_iscsi] +[ 862.245264] Call Trace: +[ 862.245587] +[ 862.245814] __schedule+0x810/0x15c0 +[ 862.246557] schedule+0x69/0x180 +[ 862.246760] blk_mq_freeze_queue_wait+0xde/0x120 +[ 862.247688] elevator_change+0x16d/0x460 +[ 862.247893] elevator_set_none+0x87/0xf0 +[ 862.248798] blk_unregister_queue+0x12e/0x2a0 +[ 862.248995] __del_gendisk+0x231/0x7e0 +[ 862.250143] del_gendisk+0x12f/0x1d0 +[ 862.250339] sd_remove+0x85/0x130 [sd_mod] +[ 862.250650] device_release_driver_internal+0x36d/0x530 +[ 862.250849] bus_remove_device+0x1dd/0x3f0 +[ 862.251042] device_del+0x38a/0x930 +[ 862.252095] __scsi_remove_device+0x293/0x360 +[ 862.252291] scsi_remove_target+0x486/0x760 +[ 862.252654] __iscsi_unbind_session+0x18a/0x3e0 [scsi_transport_iscsi] +[ 862.252886] process_one_work+0x633/0xe50 +[ 862.253101] worker_thread+0x6df/0xf10 +[ 862.253647] kthread+0x36d/0x720 +[ 862.254533] ret_from_fork+0x2a6/0x470 +[ 862.255852] ret_from_fork_asm+0x1a/0x30 +[ 862.256037] + +Remove the blk_should_fake_timeout() check from dm, as dm has no +native timeout handling and should not attempt to fake timeouts. + +Signed-off-by: Ding Hui +Reviewed-by: Christoph Hellwig +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + drivers/md/dm-rq.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c +index a6ca92049c10e..5e08546696145 100644 +--- a/drivers/md/dm-rq.c ++++ b/drivers/md/dm-rq.c +@@ -278,8 +278,7 @@ static void dm_complete_request(struct request *rq, blk_status_t error) + struct dm_rq_target_io *tio = tio_from_request(rq); + + tio->error = error; +- if (likely(!blk_should_fake_timeout(rq->q))) +- blk_mq_complete_request(rq); ++ blk_mq_complete_request(rq); + } + + /* +-- +2.51.0 + diff --git a/queue-6.19/dm-replace-eexist-with-ebusy.patch b/queue-6.19/dm-replace-eexist-with-ebusy.patch new file mode 100644 index 00000000000..fbaf84fd9b9 --- /dev/null +++ b/queue-6.19/dm-replace-eexist-with-ebusy.patch @@ -0,0 +1,89 @@ +From be7990cd369f355ccae1df7d886eca7fc1dc2619 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Dec 2025 04:49:37 +0100 +Subject: dm: replace -EEXIST with -EBUSY + +From: Daniel Gomez + +[ Upstream commit b13ef361d47f09b7aecd18e0383ecc83ff61057e ] + +The -EEXIST error code is reserved by the module loading infrastructure +to indicate that a module is already loaded. When a module's init +function returns -EEXIST, userspace tools like kmod interpret this as +"module already loaded" and treat the operation as successful, returning +0 to the user even though the module initialization actually failed. + +This follows the precedent set by commit 54416fd76770 ("netfilter: +conntrack: helper: Replace -EEXIST by -EBUSY") which fixed the same +issue in nf_conntrack_helper_register(). + +Affected modules: + * dm_cache dm_clone dm_integrity dm_mirror dm_multipath dm_pcache + * dm_vdo dm-ps-round-robin dm_historical_service_time dm_io_affinity + * dm_queue_length dm_service_time dm_snapshot + +Signed-off-by: Daniel Gomez +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + drivers/md/dm-exception-store.c | 2 +- + drivers/md/dm-log.c | 2 +- + drivers/md/dm-path-selector.c | 2 +- + drivers/md/dm-target.c | 2 +- + 4 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c +index c3799757bf4a0..88f119a0a2ae0 100644 +--- a/drivers/md/dm-exception-store.c ++++ b/drivers/md/dm-exception-store.c +@@ -116,7 +116,7 @@ int dm_exception_store_type_register(struct dm_exception_store_type *type) + if (!__find_exception_store_type(type->name)) + list_add(&type->list, &_exception_store_types); + else +- r = -EEXIST; ++ r = -EBUSY; + spin_unlock(&_lock); + + return r; +diff --git a/drivers/md/dm-log.c b/drivers/md/dm-log.c +index 9d85d045f9d9d..bced5a783ee33 100644 +--- a/drivers/md/dm-log.c ++++ b/drivers/md/dm-log.c +@@ -121,7 +121,7 @@ int dm_dirty_log_type_register(struct dm_dirty_log_type *type) + if (!__find_dirty_log_type(type->name)) + list_add(&type->list, &_log_types); + else +- r = -EEXIST; ++ r = -EBUSY; + spin_unlock(&_lock); + + return r; +diff --git a/drivers/md/dm-path-selector.c b/drivers/md/dm-path-selector.c +index d0b883fabfeb6..2b0ac200f1c02 100644 +--- a/drivers/md/dm-path-selector.c ++++ b/drivers/md/dm-path-selector.c +@@ -107,7 +107,7 @@ int dm_register_path_selector(struct path_selector_type *pst) + + if (__find_path_selector_type(pst->name)) { + kfree(psi); +- r = -EEXIST; ++ r = -EBUSY; + } else + list_add(&psi->list, &_path_selectors); + +diff --git a/drivers/md/dm-target.c b/drivers/md/dm-target.c +index 8fede41adec00..1fd41289de367 100644 +--- a/drivers/md/dm-target.c ++++ b/drivers/md/dm-target.c +@@ -88,7 +88,7 @@ int dm_register_target(struct target_type *tt) + if (__find_target_type(tt->name)) { + DMERR("%s: '%s' target already registered", + __func__, tt->name); +- rv = -EEXIST; ++ rv = -EBUSY; + } else { + list_add(&tt->list, &_targets); + } +-- +2.51.0 + diff --git a/queue-6.19/dmaengine-stm32-dma3-use-module_platform_driver.patch b/queue-6.19/dmaengine-stm32-dma3-use-module_platform_driver.patch new file mode 100644 index 00000000000..40c0877fd10 --- /dev/null +++ b/queue-6.19/dmaengine-stm32-dma3-use-module_platform_driver.patch @@ -0,0 +1,45 @@ +From 2f4ab75e1eb207161e3dd5356ebe4d3470fa64a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 14:36:56 +0100 +Subject: dmaengine: stm32-dma3: use module_platform_driver + +From: Amelie Delaunay + +[ Upstream commit 0d41ed4ea496fabbb4dc21171e32d9a924c2a661 ] + +Without module_platform_driver(), stm32-dma3 doesn't have a +module_exit procedure. Once stm32-dma3 module is inserted, it +can't be removed, marked busy. +Use module_platform_driver() instead of subsys_initcall() to register +(insmod) and unregister (rmmod) stm32-dma3 driver. + +Reviewed-by: Eugen Hristev +Signed-off-by: Amelie Delaunay +Link: https://patch.msgid.link/20251121-dma3_improv-v2-1-76a207b13ea6@foss.st.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/stm32/stm32-dma3.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +diff --git a/drivers/dma/stm32/stm32-dma3.c b/drivers/dma/stm32/stm32-dma3.c +index 50e7106c5cb73..9500164c8f688 100644 +--- a/drivers/dma/stm32/stm32-dma3.c ++++ b/drivers/dma/stm32/stm32-dma3.c +@@ -1914,12 +1914,7 @@ static struct platform_driver stm32_dma3_driver = { + }, + }; + +-static int __init stm32_dma3_init(void) +-{ +- return platform_driver_register(&stm32_dma3_driver); +-} +- +-subsys_initcall(stm32_dma3_init); ++module_platform_driver(stm32_dma3_driver); + + MODULE_DESCRIPTION("STM32 DMA3 controller driver"); + MODULE_AUTHOR("Amelie Delaunay "); +-- +2.51.0 + diff --git a/queue-6.19/dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch b/queue-6.19/dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch new file mode 100644 index 00000000000..bc83e547f3f --- /dev/null +++ b/queue-6.19/dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch @@ -0,0 +1,51 @@ +From fd901a460c8f4f12519e05744a561f307e740b2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Dec 2025 09:15:03 +0100 +Subject: dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix + warnings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Le Goffic + +[ Upstream commit aaf3bc0265744adbc2d364964ef409cf118d193d ] + +m2m_hw_period is initialized only when chan_config->m2m_hw is true. This +triggers a warning: +‘m2m_hw_period’ may be used uninitialized [-Wmaybe-uninitialized] +Although m2m_hw_period is only used when chan_config->m2m_hw is true and +ignored otherwise, initialize it unconditionally to 0. + +ccr is initialized by stm32_mdma_set_xfer_param() when the sg list is not +empty. This triggers a warning: +‘ccr’ may be used uninitialized [-Wmaybe-uninitialized] +Indeed, it could be used uninitialized if the sg list is empty. Initialize +it to 0. + +Signed-off-by: Clément Le Goffic +Reviewed-by: Clément Le Goffic +Signed-off-by: Amelie Delaunay +Link: https://patch.msgid.link/20251217-mdma_warnings_fix-v2-1-340200e0bb55@foss.st.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/stm32/stm32-mdma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/stm32/stm32-mdma.c b/drivers/dma/stm32/stm32-mdma.c +index 080c1c725216c..b87d41b234df1 100644 +--- a/drivers/dma/stm32/stm32-mdma.c ++++ b/drivers/dma/stm32/stm32-mdma.c +@@ -731,7 +731,7 @@ static int stm32_mdma_setup_xfer(struct stm32_mdma_chan *chan, + struct stm32_mdma_chan_config *chan_config = &chan->chan_config; + struct scatterlist *sg; + dma_addr_t src_addr, dst_addr; +- u32 m2m_hw_period, ccr, ctcr, ctbr; ++ u32 m2m_hw_period = 0, ccr = 0, ctcr, ctbr; + int i, ret = 0; + + if (chan_config->m2m_hw) +-- +2.51.0 + diff --git a/queue-6.19/dmaengine-sun6i-choose-appropriate-burst-length-unde.patch b/queue-6.19/dmaengine-sun6i-choose-appropriate-burst-length-unde.patch new file mode 100644 index 00000000000..3e83e67a98e --- /dev/null +++ b/queue-6.19/dmaengine-sun6i-choose-appropriate-burst-length-unde.patch @@ -0,0 +1,80 @@ +From 98cd606ff2e32ef83d6585c3d6bcd1f4d6a8e05d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Dec 2025 16:04:48 +0800 +Subject: dmaengine: sun6i: Choose appropriate burst length under maxburst + +From: Chen-Yu Tsai + +[ Upstream commit 7178c3586ab42693b28bb81014320a7783e5c435 ] + +maxburst, as provided by the client, specifies the largest amount of +data that is allowed to be transferred in one burst. This limit is +normally provided to avoid a data burst overflowing the target FIFO. +It does not mean that the DMA engine can only do bursts in that size. + +Let the driver pick the largest supported burst length within the +given limit. This lets the driver work correctly with some clients that +give a large maxburst value. In particular, the 8250_dw driver will give +a quarter of the UART's FIFO size as maxburst. On some systems the FIFO +size is 256 bytes, giving a maxburst of 64 bytes, while the hardware +only supports bursts of up to 16 bytes. + +Signed-off-by: Chen-Yu Tsai +Reviewed-by: Jernej Skrabec +Link: https://patch.msgid.link/20251221080450.1813479-1-wens@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/sun6i-dma.c | 26 ++++++++++++++++++++------ + 1 file changed, 20 insertions(+), 6 deletions(-) + +diff --git a/drivers/dma/sun6i-dma.c b/drivers/dma/sun6i-dma.c +index 2215ff877bf7d..f9d876deb1f05 100644 +--- a/drivers/dma/sun6i-dma.c ++++ b/drivers/dma/sun6i-dma.c +@@ -583,6 +583,22 @@ static irqreturn_t sun6i_dma_interrupt(int irq, void *dev_id) + return ret; + } + ++static u32 find_burst_size(const u32 burst_lengths, u32 maxburst) ++{ ++ if (!maxburst) ++ return 1; ++ ++ if (BIT(maxburst) & burst_lengths) ++ return maxburst; ++ ++ /* Hardware only does power-of-two bursts. */ ++ for (u32 burst = rounddown_pow_of_two(maxburst); burst > 0; burst /= 2) ++ if (BIT(burst) & burst_lengths) ++ return burst; ++ ++ return 1; ++} ++ + static int set_config(struct sun6i_dma_dev *sdev, + struct dma_slave_config *sconfig, + enum dma_transfer_direction direction, +@@ -616,15 +632,13 @@ static int set_config(struct sun6i_dma_dev *sdev, + return -EINVAL; + if (!(BIT(dst_addr_width) & sdev->slave.dst_addr_widths)) + return -EINVAL; +- if (!(BIT(src_maxburst) & sdev->cfg->src_burst_lengths)) +- return -EINVAL; +- if (!(BIT(dst_maxburst) & sdev->cfg->dst_burst_lengths)) +- return -EINVAL; + + src_width = convert_buswidth(src_addr_width); + dst_width = convert_buswidth(dst_addr_width); +- dst_burst = convert_burst(dst_maxburst); +- src_burst = convert_burst(src_maxburst); ++ src_burst = find_burst_size(sdev->cfg->src_burst_lengths, src_maxburst); ++ dst_burst = find_burst_size(sdev->cfg->dst_burst_lengths, dst_maxburst); ++ dst_burst = convert_burst(dst_burst); ++ src_burst = convert_burst(src_burst); + + *p_cfg = DMA_CHAN_CFG_SRC_WIDTH(src_width) | + DMA_CHAN_CFG_DST_WIDTH(dst_width); +-- +2.51.0 + diff --git a/queue-6.19/driver-core-faux-stop-using-static-struct-device.patch b/queue-6.19/driver-core-faux-stop-using-static-struct-device.patch new file mode 100644 index 00000000000..bb6918538c2 --- /dev/null +++ b/queue-6.19/driver-core-faux-stop-using-static-struct-device.patch @@ -0,0 +1,77 @@ +From c9b72fb6d5fcb5934d35325ba08078409c9b08ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jan 2026 11:29:45 +0100 +Subject: driver core: faux: stop using static struct device + +From: Greg Kroah-Hartman + +[ Upstream commit 61b76d07d2b46a86ea91267d36449fc78f8a1f6e ] + +faux_bus_root should not have been a static struct device, but rather a +dynamically created structure so that lockdep and other testing tools do +not trip over it (as well as being the right thing overall to do.) Fix +this up by making it properly dynamic. + +Reported-by: Gui-Dong Han +Closes: https://lore.kernel.org/lkml/CALbr=LYKJsj6cbrDLA07qioKhWJcRj+gW8=bq5=4ZvpEe2c4Yg@mail.gmail.com/ +Reviewed-by: Danilo Krummrich +Link: https://patch.msgid.link/2026012145-lapping-countless-ef81@gregkh +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/faux.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/drivers/base/faux.c b/drivers/base/faux.c +index 21dd02124231a..23d7258172325 100644 +--- a/drivers/base/faux.c ++++ b/drivers/base/faux.c +@@ -29,9 +29,7 @@ struct faux_object { + }; + #define to_faux_object(dev) container_of_const(dev, struct faux_object, faux_dev.dev) + +-static struct device faux_bus_root = { +- .init_name = "faux", +-}; ++static struct device *faux_bus_root; + + static int faux_match(struct device *dev, const struct device_driver *drv) + { +@@ -152,7 +150,7 @@ struct faux_device *faux_device_create_with_groups(const char *name, + if (parent) + dev->parent = parent; + else +- dev->parent = &faux_bus_root; ++ dev->parent = faux_bus_root; + dev->bus = &faux_bus_type; + dev_set_name(dev, "%s", name); + device_set_pm_not_required(dev); +@@ -236,9 +234,15 @@ int __init faux_bus_init(void) + { + int ret; + +- ret = device_register(&faux_bus_root); ++ faux_bus_root = kzalloc(sizeof(*faux_bus_root), GFP_KERNEL); ++ if (!faux_bus_root) ++ return -ENOMEM; ++ ++ dev_set_name(faux_bus_root, "faux"); ++ ++ ret = device_register(faux_bus_root); + if (ret) { +- put_device(&faux_bus_root); ++ put_device(faux_bus_root); + return ret; + } + +@@ -256,6 +260,6 @@ int __init faux_bus_init(void) + bus_unregister(&faux_bus_type); + + error_bus: +- device_unregister(&faux_bus_root); ++ device_unregister(faux_bus_root); + return ret; + } +-- +2.51.0 + diff --git a/queue-6.19/drm-account-property-blob-allocations-to-memcg.patch b/queue-6.19/drm-account-property-blob-allocations-to-memcg.patch new file mode 100644 index 00000000000..bd53105d068 --- /dev/null +++ b/queue-6.19/drm-account-property-blob-allocations-to-memcg.patch @@ -0,0 +1,46 @@ +From 072f7931e8671a178caf584dd14feae9263dea31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 08:22:26 -0500 +Subject: drm: Account property blob allocations to memcg + +From: Xiao Kan <814091656@qq.com> + +[ Upstream commit 26b4309a3ab82a0697751cde52eb336c29c19035 ] + +DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized +property blobs backed by kernel memory. + +Currently, the blob data allocation is not accounted to the allocating +process's memory cgroup, allowing unprivileged users to trigger unbounded +kernel memory consumption and potentially cause system-wide OOM. + +Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory +is properly charged to the caller's memcg. This ensures existing cgroup +memory limits apply and prevents uncontrolled kernel memory growth without +introducing additional policy or per-file limits. + +Signed-off-by: Xiao Kan <814091656@qq.com> +Signed-off-by: Xiao Kan +Link: https://patch.msgid.link/tencent_D12AA2DEDE6F359E1AF59405242FB7A5FD05@qq.com +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_property.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c +index 596272149a359..3c88b5fbdf28c 100644 +--- a/drivers/gpu/drm/drm_property.c ++++ b/drivers/gpu/drm/drm_property.c +@@ -562,7 +562,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length, + if (!length || length > INT_MAX - sizeof(struct drm_property_blob)) + return ERR_PTR(-EINVAL); + +- blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL); ++ blob = kvzalloc(sizeof(struct drm_property_blob) + length, GFP_KERNEL_ACCOUNT); + if (!blob) + return ERR_PTR(-ENOMEM); + +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-display-add-signal-type-check-for-dcn401-get.patch b/queue-6.19/drm-amd-display-add-signal-type-check-for-dcn401-get.patch new file mode 100644 index 00000000000..d7ce542824d --- /dev/null +++ b/queue-6.19/drm-amd-display-add-signal-type-check-for-dcn401-get.patch @@ -0,0 +1,42 @@ +From c7b75f1036e12731cf42caf9be84d7dc8326d7ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Dec 2025 15:52:39 -0500 +Subject: drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src + +From: Dmytro Laktyushkin + +[ Upstream commit c979d8db7b0f293111f2e83795ea353c8ed75de9 ] + +Trying to access link enc on a dpia link will cause a crash otherwise + +Reviewed-by: Charlene Liu +Signed-off-by: Dmytro Laktyushkin +Signed-off-by: Chenyu Chen +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +index e1f5b1a34cde8..f04cbdb3d3814 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +@@ -916,10 +916,10 @@ static void dcn401_enable_stream_calc( + pipe_ctx->stream->link->cur_link_settings.lane_count; + uint32_t active_total_with_borders; + +- if (dc->link_srv->dp_is_128b_132b_signal(pipe_ctx)) ++ if (dc->link_srv->dp_is_128b_132b_signal(pipe_ctx)) { + *dp_hpo_inst = pipe_ctx->stream_res.hpo_dp_stream_enc->inst; +- +- *phyd32clk = get_phyd32clk_src(pipe_ctx->stream->link); ++ *phyd32clk = get_phyd32clk_src(pipe_ctx->stream->link); ++ } + + if (dc_is_tmds_signal(pipe_ctx->stream->signal)) + dcn401_calculate_dccg_tmds_div_value(pipe_ctx, tmds_div); +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-display-add-usb-c-dp-alt-mode-lane-limitatio.patch b/queue-6.19/drm-amd-display-add-usb-c-dp-alt-mode-lane-limitatio.patch new file mode 100644 index 00000000000..d82ec1c63c5 --- /dev/null +++ b/queue-6.19/drm-amd-display-add-usb-c-dp-alt-mode-lane-limitatio.patch @@ -0,0 +1,59 @@ +From 96152782434d1ae883e1e811da540702b15a2df3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Dec 2025 10:18:16 +0800 +Subject: drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 + +From: LinCheng Ku + +[ Upstream commit cea573a8e1ed83840a2173d153dd68e172849d44 ] + +[Why] +USB-C DisplayPort Alt Mode with concurrent USB data needs lane count +limitation to prevent incorrect 4-lane DP configuration when only 2 lanes +are available due to hardware lane sharing between DP and USB3. + +[How] +Query DMUB for Alt Mode status (is_dp_alt_disable, is_usb, is_dp4) in +dcn32_link_encoder_get_max_link_cap() and cap DP to 2 lanes when USB is +active on USB-C port. Added inline documentation explaining the USB-C +lane sharing constraint. + +Reviewed-by: PeiChen Huang +Signed-off-by: LinCheng Ku +Signed-off-by: Chenyu Chen +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../display/dc/dio/dcn32/dcn32_dio_link_encoder.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c +index 06907e8a4eda1..ddc736af776c9 100644 +--- a/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c ++++ b/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c +@@ -188,9 +188,18 @@ void dcn32_link_encoder_get_max_link_cap(struct link_encoder *enc, + if (!query_dp_alt_from_dmub(enc, &cmd)) + return; + +- if (cmd.query_dp_alt.data.is_usb && +- cmd.query_dp_alt.data.is_dp4 == 0) +- link_settings->lane_count = MIN(LANE_COUNT_TWO, link_settings->lane_count); ++ /* ++ * USB-C DisplayPort Alt Mode lane count limitation logic: ++ * When USB and DP share the same USB-C connector, hardware must allocate ++ * some lanes for USB data, limiting DP to maximum 2 lanes instead of 4. ++ * This ensures USB functionality remains available while DP is active. ++ */ ++ if (cmd.query_dp_alt.data.is_dp_alt_disable == 0 && ++ cmd.query_dp_alt.data.is_usb && ++ cmd.query_dp_alt.data.is_dp4 == 0) { ++ link_settings->lane_count = ++ MIN(LANE_COUNT_TWO, link_settings->lane_count); ++ } + } + + +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-display-adjust-phy-fsm-transition-to-tx_en-t.patch b/queue-6.19/drm-amd-display-adjust-phy-fsm-transition-to-tx_en-t.patch new file mode 100644 index 00000000000..15ded560787 --- /dev/null +++ b/queue-6.19/drm-amd-display-adjust-phy-fsm-transition-to-tx_en-t.patch @@ -0,0 +1,130 @@ +From 8eff84bf25833956c59d3ab09161e8cf7023c2a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Dec 2025 13:21:59 -0500 +Subject: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for + TMDS on DCN35 + +From: Nicholas Kazlauskas + +[ Upstream commit 75372d75a4e23783583998ed99d5009d555850da ] + +[Why] +A backport of the change made for DCN401 that addresses an issue where +we turn off the PHY PLL when disabling TMDS output, which causes the +OTG to remain stuck. + +The OTG being stuck can lead to a hang in the DCHVM's ability to ACK +invalidations when it thinks the HUBP is still on but it's not receiving +global sync. + +The transition to PLL_ON needs to be atomic as there's no guarantee +that the thread isn't pre-empted or is able to complete before the +IOMMU watchdog times out. + +[How] +Backport the implementation from dcn401 back to dcn35. + +There's a functional difference in when the eDP output is disabled in +dcn401 code so we don't want to utilize it directly. + +Reviewed-by: Yihan Zhu +Signed-off-by: Nicholas Kazlauskas +Signed-off-by: Matthew Stewart +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 52 +++++++++++++++++++ + .../amd/display/dc/hwss/dcn35/dcn35_hwseq.h | 3 ++ + .../amd/display/dc/hwss/dcn35/dcn35_init.c | 2 +- + 3 files changed, 56 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c +index cb2dfd34b5e2e..88542ca715573 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c +@@ -1726,3 +1726,55 @@ void dcn35_program_cursor_offload_now(struct dc *dc, const struct pipe_ctx *pipe + { + dc_dmub_srv_program_cursor_now(dc, pipe); + } ++ ++static void disable_link_output_symclk_on_tx_off(struct dc_link *link, enum dp_link_encoding link_encoding) ++{ ++ struct dc *dc = link->ctx->dc; ++ struct pipe_ctx *pipe_ctx = NULL; ++ uint8_t i; ++ ++ for (i = 0; i < MAX_PIPES; i++) { ++ pipe_ctx = &dc->current_state->res_ctx.pipe_ctx[i]; ++ if (pipe_ctx->stream && pipe_ctx->stream->link == link && pipe_ctx->top_pipe == NULL) { ++ pipe_ctx->clock_source->funcs->program_pix_clk( ++ pipe_ctx->clock_source, ++ &pipe_ctx->stream_res.pix_clk_params, ++ link_encoding, ++ &pipe_ctx->pll_settings); ++ break; ++ } ++ } ++} ++ ++void dcn35_disable_link_output(struct dc_link *link, ++ const struct link_resource *link_res, ++ enum signal_type signal) ++{ ++ struct dc *dc = link->ctx->dc; ++ const struct link_hwss *link_hwss = get_link_hwss(link, link_res); ++ struct dmcu *dmcu = dc->res_pool->dmcu; ++ ++ if (signal == SIGNAL_TYPE_EDP && ++ link->dc->hwss.edp_backlight_control && ++ !link->skip_implict_edp_power_control) ++ link->dc->hwss.edp_backlight_control(link, false); ++ else if (dmcu != NULL && dmcu->funcs->lock_phy) ++ dmcu->funcs->lock_phy(dmcu); ++ ++ if (dc_is_tmds_signal(signal) && link->phy_state.symclk_ref_cnts.otg > 0) { ++ disable_link_output_symclk_on_tx_off(link, DP_UNKNOWN_ENCODING); ++ link->phy_state.symclk_state = SYMCLK_ON_TX_OFF; ++ } else { ++ link_hwss->disable_link_output(link, link_res, signal); ++ link->phy_state.symclk_state = SYMCLK_OFF_TX_OFF; ++ } ++ /* ++ * Add the logic to extract BOTH power up and power down sequences ++ * from enable/disable link output and only call edp panel control ++ * in enable_link_dp and disable_link_dp once. ++ */ ++ if (dmcu != NULL && dmcu->funcs->unlock_phy) ++ dmcu->funcs->unlock_phy(dmcu); ++ ++ dc->link_srv->dp_trace_source_sequence(link, DPCD_SOURCE_SEQ_AFTER_DISABLE_LINK_PHY); ++} +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h +index 1ff41dba556c0..e3459546a908a 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h +@@ -108,5 +108,8 @@ void dcn35_update_cursor_offload_pipe(struct dc *dc, const struct pipe_ctx *pipe + void dcn35_notify_cursor_offload_drr_update(struct dc *dc, struct dc_state *context, + const struct dc_stream_state *stream); + void dcn35_program_cursor_offload_now(struct dc *dc, const struct pipe_ctx *pipe); ++void dcn35_disable_link_output(struct dc_link *link, ++ const struct link_resource *link_res, ++ enum signal_type signal); + + #endif /* __DC_HWSS_DCN35_H__ */ +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c +index 5a66c9db26709..81bd36f3381db 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c +@@ -113,7 +113,7 @@ static const struct hw_sequencer_funcs dcn35_funcs = { + .enable_lvds_link_output = dce110_enable_lvds_link_output, + .enable_tmds_link_output = dce110_enable_tmds_link_output, + .enable_dp_link_output = dce110_enable_dp_link_output, +- .disable_link_output = dcn32_disable_link_output, ++ .disable_link_output = dcn35_disable_link_output, + .z10_restore = dcn35_z10_restore, + .z10_save_init = dcn31_z10_save_init, + .set_disp_pattern_generator = dcn30_set_disp_pattern_generator, +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-display-avoid-dig-reg-access-timeout-on-usb4.patch b/queue-6.19/drm-amd-display-avoid-dig-reg-access-timeout-on-usb4.patch new file mode 100644 index 00000000000..0db57b17c60 --- /dev/null +++ b/queue-6.19/drm-amd-display-avoid-dig-reg-access-timeout-on-usb4.patch @@ -0,0 +1,58 @@ +From 54bdb50994a1d83c56bf8d2694cc3527d8811d3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 15:51:42 +0800 +Subject: drm/amd/display: avoid dig reg access timeout on usb4 link training + fail + +From: Zhongwei + +[ Upstream commit 15b1d7b77e9836ff4184093163174a1ef28bbdd7 ] + +[Why] +When usb4 link training fails, the dpia sym clock will be disabled and SYMCLK +source should be changed back to phy clock. In enable_streams, it is +assumed that link training succeeded and will switch from refclk to +phy clock. But phy clk here might not be on. Dig reg access timeout +will occur. + +[How] +When enable_stream is hit, check if link training failed for usb4. +If it did, fall back to the ref clock to avoid reg access timeout. + +Reviewed-by: Wenjing Liu +Signed-off-by: Zhongwei +Signed-off-by: Aurabindo Pillai +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c +index c8ff8ae85a030..517d4c08d34c4 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c +@@ -3058,9 +3058,17 @@ void dcn20_enable_stream(struct pipe_ctx *pipe_ctx) + dccg->funcs->enable_symclk32_se(dccg, dp_hpo_inst, phyd32clk); + } + } else { +- if (dccg->funcs->enable_symclk_se) +- dccg->funcs->enable_symclk_se(dccg, stream_enc->stream_enc_inst, ++ if (dccg->funcs->enable_symclk_se && link_enc) { ++ if (link->ep_type == DISPLAY_ENDPOINT_USB4_DPIA ++ && link->cur_link_settings.link_rate == LINK_RATE_UNKNOWN ++ && !link->link_status.link_active) { ++ if (dccg->funcs->disable_symclk_se) ++ dccg->funcs->disable_symclk_se(dccg, stream_enc->stream_enc_inst, + link_enc->transmitter - TRANSMITTER_UNIPHY_A); ++ } else ++ dccg->funcs->enable_symclk_se(dccg, stream_enc->stream_enc_inst, ++ link_enc->transmitter - TRANSMITTER_UNIPHY_A); ++ } + } + + if (dc->res_pool->dccg->funcs->set_pixel_rate_div) +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-display-avoid-updating-surface-with-the-same.patch b/queue-6.19/drm-amd-display-avoid-updating-surface-with-the-same.patch new file mode 100644 index 00000000000..9cf51035fb0 --- /dev/null +++ b/queue-6.19/drm-amd-display-avoid-updating-surface-with-the-same.patch @@ -0,0 +1,43 @@ +From 2168145075750e916be2f350d9c26f3a15570ac4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 14:47:01 +0800 +Subject: drm/amd/display: Avoid updating surface with the same surface under + MPO + +From: Wayne Lin + +[ Upstream commit 1a38ded4bc8ac09fd029ec656b1e2c98cc0d238c ] + +[Why & How] +Although it's dummy updates of surface update for committing stream +updates, we should not have dummy_updates[j].surface all indicating +to the same surface under multiple surfaces case. Otherwise, +copy_surface_update_to_plane() in update_planes_and_stream_state() +will update to the same surface only. + +Reviewed-by: Harry Wentland +Signed-off-by: Wayne Lin +Signed-off-by: Tom Chung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index b6eee94861477..e84ec4365ca6b 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -10961,7 +10961,7 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state) + continue; + } + for (j = 0; j < status->plane_count; j++) +- dummy_updates[j].surface = status->plane_states[0]; ++ dummy_updates[j].surface = status->plane_states[j]; + + sort(dummy_updates, status->plane_count, + sizeof(*dummy_updates), dm_plane_layer_index_cmp, NULL); +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-display-bypass-post-csc-for-additional-color.patch b/queue-6.19/drm-amd-display-bypass-post-csc-for-additional-color.patch new file mode 100644 index 00000000000..167c892835b --- /dev/null +++ b/queue-6.19/drm-amd-display-bypass-post-csc-for-additional-color.patch @@ -0,0 +1,100 @@ +From 14b6670122c9609cb70502d46a785928f47dfbfa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 11:40:06 -0500 +Subject: drm/amd/display: bypass post csc for additional color spaces in dal + +From: Clay King + +[ Upstream commit 7d9ec9dc20ecdb1661f4538cd9112cd3d6a5f15a ] + +[Why] +For RGB BT2020 full and limited color spaces, overlay adjustments were +applied twice (once by MM and once by DAL). This results in incorrect +colours and a noticeable difference between mpo and non-mpo cases. + +[How] +Add RGB BT2020 full and limited color spaces to list that bypasses post +csc adjustment. + +Reviewed-by: Aric Cyr +Signed-off-by: Clay King +Signed-off-by: Tom Chung +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c | 21 ++++++++++++++++--- + .../drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h | 4 ++++ + .../amd/display/dc/dpp/dcn401/dcn401_dpp.c | 6 +++--- + 3 files changed, 25 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c +index ef4a161171814..c7923531da83d 100644 +--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c ++++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c +@@ -376,10 +376,10 @@ void dpp3_cnv_setup ( + + tbl_entry.color_space = input_color_space; + +- if (color_space >= COLOR_SPACE_YCBCR601) +- select = INPUT_CSC_SELECT_ICSC; +- else ++ if (dpp3_should_bypass_post_csc_for_colorspace(color_space)) + select = INPUT_CSC_SELECT_BYPASS; ++ else ++ select = INPUT_CSC_SELECT_ICSC; + + dpp3_program_post_csc(dpp_base, color_space, select, + &tbl_entry); +@@ -1541,3 +1541,18 @@ bool dpp3_construct( + return true; + } + ++bool dpp3_should_bypass_post_csc_for_colorspace(enum dc_color_space dc_color_space) ++{ ++ switch (dc_color_space) { ++ case COLOR_SPACE_UNKNOWN: ++ case COLOR_SPACE_SRGB: ++ case COLOR_SPACE_XR_RGB: ++ case COLOR_SPACE_SRGB_LIMITED: ++ case COLOR_SPACE_MSREF_SCRGB: ++ case COLOR_SPACE_2020_RGB_FULLRANGE: ++ case COLOR_SPACE_2020_RGB_LIMITEDRANGE: ++ return true; ++ default: ++ return false; ++ } ++} +diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h +index d4a70b4379eaf..6a61b99d6a798 100644 +--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h ++++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h +@@ -644,4 +644,8 @@ void dpp3_program_cm_dealpha( + + void dpp3_cm_get_gamut_remap(struct dpp *dpp_base, + struct dpp_grph_csc_adjustment *adjust); ++ ++bool dpp3_should_bypass_post_csc_for_colorspace( ++ enum dc_color_space dc_color_space); ++ + #endif /* __DC_HWSS_DCN30_H__ */ +diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c +index 96c2c853de42c..2d6a646462e21 100644 +--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c ++++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c +@@ -206,10 +206,10 @@ void dpp401_dpp_setup( + + tbl_entry.color_space = input_color_space; + +- if (color_space >= COLOR_SPACE_YCBCR601) +- select = INPUT_CSC_SELECT_ICSC; +- else ++ if (dpp3_should_bypass_post_csc_for_colorspace(color_space)) + select = INPUT_CSC_SELECT_BYPASS; ++ else ++ select = INPUT_CSC_SELECT_ICSC; + + dpp3_program_post_csc(dpp_base, color_space, select, + &tbl_entry); +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-display-correct-dsc-padding-accounting.patch b/queue-6.19/drm-amd-display-correct-dsc-padding-accounting.patch new file mode 100644 index 00000000000..35a6af8fada --- /dev/null +++ b/queue-6.19/drm-amd-display-correct-dsc-padding-accounting.patch @@ -0,0 +1,122 @@ +From edc85de31f9fa86a9cb012f5845a2cac4f3d825f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Nov 2025 15:21:46 -0500 +Subject: drm/amd/display: Correct DSC padding accounting + +From: Relja Vojvodic + +[ Upstream commit c7062be3380cb20c8b1c4a935a13f1848ead0719 ] + +[WHY] +- After the addition of all OVT patches, DSC padding was being accounted + for multiple times, effectively doubling the padding +- This caused compliance failures or corruption + +[HOW] +- Add padding to DSC pic width when required by HW, and do not re-add + when calculating reg values +- Do not add padding when computing PPS values, and instead track padding + separately to add when calculating slice width values + +Reviewed-by: Chris Park +Reviewed-by: Wenjing Liu +Signed-off-by: Relja Vojvodic +Signed-off-by: Alex Hung +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c | 2 +- + drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 2 +- + drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 2 +- + drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 3 ++- + .../gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c | 6 +++--- + 5 files changed, 8 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c +index 4ee6ed610de0b..3e239124c17d8 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c +@@ -108,7 +108,7 @@ static void update_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable) + dsc_cfg.dc_dsc_cfg = stream->timing.dsc_cfg; + ASSERT(dsc_cfg.dc_dsc_cfg.num_slices_h % opp_cnt == 0); + dsc_cfg.dc_dsc_cfg.num_slices_h /= opp_cnt; +- dsc_cfg.dsc_padding = pipe_ctx->dsc_padding_params.dsc_hactive_padding; ++ dsc_cfg.dsc_padding = 0; + + dsc->funcs->dsc_set_config(dsc, &dsc_cfg, &dsc_optc_cfg); + dsc->funcs->dsc_enable(dsc, pipe_ctx->stream_res.opp->inst); +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c +index be1f3caf4096f..24af5e94c7fce 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c +@@ -1063,7 +1063,7 @@ void dcn32_update_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable) + dsc_cfg.dc_dsc_cfg = stream->timing.dsc_cfg; + ASSERT(dsc_cfg.dc_dsc_cfg.num_slices_h % opp_cnt == 0); + dsc_cfg.dc_dsc_cfg.num_slices_h /= opp_cnt; +- dsc_cfg.dsc_padding = pipe_ctx->dsc_padding_params.dsc_hactive_padding; ++ dsc_cfg.dsc_padding = 0; + + if (should_use_dto_dscclk) + dccg->funcs->set_dto_dscclk(dccg, dsc->inst, dsc_cfg.dc_dsc_cfg.num_slices_h); +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c +index 7aa0f452e8f7a..cb2dfd34b5e2e 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c +@@ -364,7 +364,7 @@ static void update_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable) + dsc_cfg.dc_dsc_cfg = stream->timing.dsc_cfg; + ASSERT(dsc_cfg.dc_dsc_cfg.num_slices_h % opp_cnt == 0); + dsc_cfg.dc_dsc_cfg.num_slices_h /= opp_cnt; +- dsc_cfg.dsc_padding = pipe_ctx->dsc_padding_params.dsc_hactive_padding; ++ dsc_cfg.dsc_padding = 0; + + dsc->funcs->dsc_set_config(dsc, &dsc_cfg, &dsc_optc_cfg); + dsc->funcs->dsc_enable(dsc, pipe_ctx->stream_res.opp->inst); +diff --git a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c +index 635f614c06734..770c9cd128ae8 100644 +--- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c ++++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c +@@ -841,7 +841,7 @@ void link_set_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable) + dsc_cfg.dc_dsc_cfg = stream->timing.dsc_cfg; + ASSERT(dsc_cfg.dc_dsc_cfg.num_slices_h % opp_cnt == 0); + dsc_cfg.dc_dsc_cfg.num_slices_h /= opp_cnt; +- dsc_cfg.dsc_padding = pipe_ctx->dsc_padding_params.dsc_hactive_padding; ++ dsc_cfg.dsc_padding = 0; + + if (should_use_dto_dscclk) + dccg->funcs->set_dto_dscclk(dccg, dsc->inst, dsc_cfg.dc_dsc_cfg.num_slices_h); +@@ -857,6 +857,7 @@ void link_set_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable) + } + dsc_cfg.dc_dsc_cfg.num_slices_h *= opp_cnt; + dsc_cfg.pic_width *= opp_cnt; ++ dsc_cfg.dsc_padding = pipe_ctx->dsc_padding_params.dsc_hactive_padding; + + optc_dsc_mode = dsc_optc_cfg.is_pixel_format_444 ? OPTC_DSC_ENABLED_444 : OPTC_DSC_ENABLED_NATIVE_SUBSAMPLED; + +diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c +index 6679c1a14f2fe..8d10aac9c510c 100644 +--- a/drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c +@@ -1660,8 +1660,8 @@ bool dcn20_validate_dsc(struct dc *dc, struct dc_state *new_ctx) + if (pipe_ctx->top_pipe || pipe_ctx->prev_odm_pipe || !stream || !stream->timing.flags.DSC) + continue; + +- dsc_cfg.pic_width = (stream->timing.h_addressable + stream->timing.h_border_left +- + stream->timing.h_border_right) / opp_cnt; ++ dsc_cfg.pic_width = (stream->timing.h_addressable + pipe_ctx->dsc_padding_params.dsc_hactive_padding ++ + stream->timing.h_border_left + stream->timing.h_border_right) / opp_cnt; + dsc_cfg.pic_height = stream->timing.v_addressable + stream->timing.v_border_top + + stream->timing.v_border_bottom; + dsc_cfg.pixel_encoding = stream->timing.pixel_encoding; +@@ -1669,7 +1669,7 @@ bool dcn20_validate_dsc(struct dc *dc, struct dc_state *new_ctx) + dsc_cfg.is_odm = pipe_ctx->next_odm_pipe ? true : false; + dsc_cfg.dc_dsc_cfg = stream->timing.dsc_cfg; + dsc_cfg.dc_dsc_cfg.num_slices_h /= opp_cnt; +- dsc_cfg.dsc_padding = pipe_ctx->dsc_padding_params.dsc_hactive_padding; ++ dsc_cfg.dsc_padding = 0; + + if (!pipe_ctx->stream_res.dsc->funcs->dsc_validate_stream(pipe_ctx->stream_res.dsc, &dsc_cfg)) + return false; +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-display-correct-fixed_vs-link-rate-toggle-co.patch b/queue-6.19/drm-amd-display-correct-fixed_vs-link-rate-toggle-co.patch new file mode 100644 index 00000000000..50ceda3d846 --- /dev/null +++ b/queue-6.19/drm-amd-display-correct-fixed_vs-link-rate-toggle-co.patch @@ -0,0 +1,43 @@ +From 170405f41a0fa712df0df04b206b139c4cef6333 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 15:18:50 +0800 +Subject: drm/amd/display: Correct FIXED_VS Link Rate Toggle Condition + +From: Jing Zhou + +[ Upstream commit 531fe6e0fee85a1bdb5b8223a706fff654ed0a61 ] + +[WHY&HOW] +The condition is only perform toggle if FIXED_VS LTTPR reports +no IEEE OUI. +The literal "\x0,\x0,\x0" contains commas changes the +bytes being compared to {0x00,0x2C,0X00}. +The correct literal should be "\x00\x00\x00" without commas. + +Reviewed-by: Charlene Liu +Reviewed-by: Wenjing Liu +Signed-off-by: Jing Zhou +Signed-off-by: Roman Li +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c +index ce174ce5579c0..6a7c4a59ff4c7 100644 +--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c ++++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c +@@ -271,7 +271,7 @@ enum link_training_result dp_perform_fixed_vs_pe_training_sequence( + rate = get_dpcd_link_rate(<_settings->link_settings); + + // Only perform toggle if FIXED_VS LTTPR reports no IEEE OUI +- if (memcmp("\x0,\x0,\x0", &link->dpcd_caps.lttpr_caps.lttpr_ieee_oui[0], 3) == 0) { ++ if (memcmp("\x00\x00\x00", &link->dpcd_caps.lttpr_caps.lttpr_ieee_oui[0], 3) == 0) { + /* Vendor specific: Toggle link rate */ + toggle_rate = (rate == 0x6) ? 0xA : 0x6; + +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-display-disable-fec-when-powering-down-encod.patch b/queue-6.19/drm-amd-display-disable-fec-when-powering-down-encod.patch new file mode 100644 index 00000000000..7eaab9f5c9b --- /dev/null +++ b/queue-6.19/drm-amd-display-disable-fec-when-powering-down-encod.patch @@ -0,0 +1,79 @@ +From d66ef7a48dc8ea15e7d45f38744cd2e519878f65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jan 2026 17:48:59 -0500 +Subject: drm/amd/display: Disable FEC when powering down encoders + +From: Ovidiu Bunea + +[ Upstream commit 8cee62904caf95e5698fa0f2d420f5f22b4dea15 ] + +[why & how] +VBIOS DMCUB FW can enable FEC for capable eDPs, but S/W DC state is +only updated for link0 when transitioning into OS with driver loaded. +This causes issues when the eDP is immediately hidden and DIG0 is +assigned to another link that does not support FEC. Driver will +attempt to disable FEC but FEC enablement occurs based on the link +state, which does not have fec_state updated since it is a different +link. Thus, FEC disablement on DIG0 will get skipped and cause no +light up. + +Reviewed-by: Karen Chen +Signed-off-by: Ovidiu Bunea +Signed-off-by: Matthew Stewart +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../amd/display/dc/hwss/dce110/dce110_hwseq.c | 24 ++++++++++++------- + 1 file changed, 15 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +index 9f7087ac41f21..3d2673a22759a 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +@@ -59,6 +59,7 @@ + #include "dc_state_priv.h" + #include "dpcd_defs.h" + #include "dsc.h" ++#include "dc_dp_types.h" + /* include DCE11 register header files */ + #include "dce/dce_11_0_d.h" + #include "dce/dce_11_0_sh_mask.h" +@@ -1736,20 +1737,25 @@ static void power_down_encoders(struct dc *dc) + int i; + + for (i = 0; i < dc->link_count; i++) { +- enum signal_type signal = dc->links[i]->connector_signal; +- +- dc->link_srv->blank_dp_stream(dc->links[i], false); ++ struct dc_link *link = dc->links[i]; ++ struct link_encoder *link_enc = link->link_enc; ++ enum signal_type signal = link->connector_signal; + ++ dc->link_srv->blank_dp_stream(link, false); + if (signal != SIGNAL_TYPE_EDP) + signal = SIGNAL_TYPE_NONE; + +- if (dc->links[i]->ep_type == DISPLAY_ENDPOINT_PHY) +- dc->links[i]->link_enc->funcs->disable_output( +- dc->links[i]->link_enc, signal); ++ if (link->ep_type == DISPLAY_ENDPOINT_PHY) ++ link_enc->funcs->disable_output(link_enc, signal); ++ ++ if (link->fec_state == dc_link_fec_enabled) { ++ link_enc->funcs->fec_set_enable(link_enc, false); ++ link_enc->funcs->fec_set_ready(link_enc, false); ++ link->fec_state = dc_link_fec_not_ready; ++ } + +- dc->links[i]->link_status.link_active = false; +- memset(&dc->links[i]->cur_link_settings, 0, +- sizeof(dc->links[i]->cur_link_settings)); ++ link->link_status.link_active = false; ++ memset(&link->cur_link_settings, 0, sizeof(link->cur_link_settings)); + } + } + +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-display-don-t-disable-dpcd-mst_en-if-sink-co.patch b/queue-6.19/drm-amd-display-don-t-disable-dpcd-mst_en-if-sink-co.patch new file mode 100644 index 00000000000..dbd5c971f68 --- /dev/null +++ b/queue-6.19/drm-amd-display-don-t-disable-dpcd-mst_en-if-sink-co.patch @@ -0,0 +1,87 @@ +From 268c34d848bc64ae76749a3321284a68f5f82e56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Nov 2025 11:19:36 +0800 +Subject: drm/amd/display: Don't disable DPCD mst_en if sink connected + +From: Peichen Huang + +[ Upstream commit 9aeb31b2456452257ad1ff7ec566f21bab1f3e8a ] + +[WHY] +User may connect mst dock with multi monitors and do quick unplug +and plug in one of the monitor. This operatioin may create CSN from +dock to display driver. Then display driver would disable and then enable +mst link and also disable/enable DPCD mst_en bit in dock RX. However, +when mst_en bit being disabled, if dock has another CSN message to +transmit then the message would be removed because of the disabling of +mst_en. In this case, the message is missing and it ends up no display in +the replugged monitor. + +[HOW] +Don't disable mst_en bit when link still has sink connected. + +Reviewed-by: Wenjing Liu +Signed-off-by: Peichen Huang +Signed-off-by: Chenyu Chen +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c +index 770c9cd128ae8..a36762915943b 100644 +--- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c ++++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c +@@ -1931,7 +1931,7 @@ static void disable_link_dp(struct dc_link *link, + link->dc->hwss.edp_power_control(link, false); + } + +- if (signal == SIGNAL_TYPE_DISPLAY_PORT_MST) ++ if (signal == SIGNAL_TYPE_DISPLAY_PORT_MST && link->sink_count == 0) + /* set the sink to SST mode after disabling the link */ + enable_mst_on_sink(link, false); + +@@ -2082,7 +2082,12 @@ static enum dc_status enable_link_dp(struct dc_state *state, + pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT && + link->dc->debug.set_mst_en_for_sst) { + enable_mst_on_sink(link, true); ++ } else if (link->dpcd_caps.is_mst_capable && ++ pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT) { ++ /* disable mst on sink */ ++ enable_mst_on_sink(link, false); + } ++ + if (pipe_ctx->stream->signal == SIGNAL_TYPE_EDP) { + /*in case it is not on*/ + if (!link->dc->config.edp_no_power_sequencing) +@@ -2380,9 +2385,9 @@ void link_set_dpms_off(struct pipe_ctx *pipe_ctx) + if (pipe_ctx->stream->sink) { + if (pipe_ctx->stream->sink->sink_signal != SIGNAL_TYPE_VIRTUAL && + pipe_ctx->stream->sink->sink_signal != SIGNAL_TYPE_NONE) { +- DC_LOG_DC("%s pipe_ctx dispname=%s signal=%x link=%d\n", __func__, ++ DC_LOG_DC("%s pipe_ctx dispname=%s signal=%x link=%d sink_count=%d\n", __func__, + pipe_ctx->stream->sink->edid_caps.display_name, +- pipe_ctx->stream->signal, link->link_index); ++ pipe_ctx->stream->signal, link->link_index, link->sink_count); + } + } + +@@ -2496,10 +2501,11 @@ void link_set_dpms_on( + if (pipe_ctx->stream->sink) { + if (pipe_ctx->stream->sink->sink_signal != SIGNAL_TYPE_VIRTUAL && + pipe_ctx->stream->sink->sink_signal != SIGNAL_TYPE_NONE) { +- DC_LOG_DC("%s pipe_ctx dispname=%s signal=%x link=%d\n", __func__, ++ DC_LOG_DC("%s pipe_ctx dispname=%s signal=%x link=%d sink_count=%d\n", __func__, + pipe_ctx->stream->sink->edid_caps.display_name, + pipe_ctx->stream->signal, +- link->link_index); ++ link->link_index, ++ link->sink_count); + } + } + +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-display-ensure-link-output-is-disabled-in-ba.patch b/queue-6.19/drm-amd-display-ensure-link-output-is-disabled-in-ba.patch new file mode 100644 index 00000000000..1788e0b933c --- /dev/null +++ b/queue-6.19/drm-amd-display-ensure-link-output-is-disabled-in-ba.patch @@ -0,0 +1,59 @@ +From c89390c58da3b1fdb5364ba9b0237c7ae2a28c5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 11:11:19 -0500 +Subject: drm/amd/display: Ensure link output is disabled in backend reset for + PLL_ON + +From: Nicholas Kazlauskas + +[ Upstream commit 4589712e0111352973131bad975023b25569287c ] + +[Why] +We're missing the code to actually disable the link output when we have +to leave the SYMCLK_ON but the TX remains OFF. + +[How] +Port the code from DCN401 that detects SYMCLK_ON_TX_OFF and disable +the link output when the backend is reset. + +Reviewed-by: Ovidiu (Ovi) Bunea +Signed-off-by: Nicholas Kazlauskas +Signed-off-by: Matthew Stewart +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c +index d1ecdb92b072b..20f700b59847c 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c +@@ -546,8 +546,22 @@ static void dcn31_reset_back_end_for_pipe( + if (pipe_ctx->stream_res.tg->funcs->set_odm_bypass) + pipe_ctx->stream_res.tg->funcs->set_odm_bypass( + pipe_ctx->stream_res.tg, &pipe_ctx->stream->timing); ++ /* ++ * TODO - convert symclk_ref_cnts for otg to a bit map to solve ++ * the case where the same symclk is shared across multiple otg ++ * instances ++ */ + if (dc_is_hdmi_tmds_signal(pipe_ctx->stream->signal)) +- pipe_ctx->stream->link->phy_state.symclk_ref_cnts.otg = 0; ++ link->phy_state.symclk_ref_cnts.otg = 0; ++ ++ if (pipe_ctx->top_pipe == NULL) { ++ if (link->phy_state.symclk_state == SYMCLK_ON_TX_OFF) { ++ const struct link_hwss *link_hwss = get_link_hwss(link, &pipe_ctx->link_res); ++ ++ link_hwss->disable_link_output(link, &pipe_ctx->link_res, pipe_ctx->stream->signal); ++ link->phy_state.symclk_state = SYMCLK_OFF_TX_OFF; ++ } ++ } + + set_drr_and_clear_adjust_pending(pipe_ctx, pipe_ctx->stream, NULL); + +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-display-fix-dp-no-audio-issue.patch b/queue-6.19/drm-amd-display-fix-dp-no-audio-issue.patch new file mode 100644 index 00000000000..fd4a902349c --- /dev/null +++ b/queue-6.19/drm-amd-display-fix-dp-no-audio-issue.patch @@ -0,0 +1,38 @@ +From 67a5ad564365da359679aae2474704eaf1c79565 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Nov 2025 19:38:31 -0500 +Subject: drm/amd/display: Fix DP no audio issue + +From: Charlene Liu + +[ Upstream commit bf5e396957acafd46003318965500914d5f4edfa ] + +[why] +need to enable APG_CLOCK_ENABLE enable first +also need to wake up az from D3 before access az block + +Reviewed-by: Swapnil Patel +Signed-off-by: Charlene Liu +Signed-off-by: Chenyu Chen +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +index 12ce3789f5130..e1f5b1a34cde8 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +@@ -297,7 +297,6 @@ void dcn401_init_hw(struct dc *dc) + } + } + } +- + for (i = 0; i < res_pool->audio_count; i++) { + struct audio *audio = res_pool->audios[i]; + +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-display-fix-dsc-edp-issue.patch b/queue-6.19/drm-amd-display-fix-dsc-edp-issue.patch new file mode 100644 index 00000000000..4cf83412c99 --- /dev/null +++ b/queue-6.19/drm-amd-display-fix-dsc-edp-issue.patch @@ -0,0 +1,59 @@ +From d15d3288518fae5149e192f2c6faf71572065140 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Dec 2025 17:01:17 -0500 +Subject: drm/amd/display: Fix dsc eDP issue + +From: Charlene Liu + +[ Upstream commit 878a4b73c11111ff5f820730f59a7f8c6fd59374 ] + +[why] +Need to add function hook check before use + +Reviewed-by: Mohit Bawa +Signed-off-by: Charlene Liu +Signed-off-by: Chenyu Chen +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +index 5896ce5511ab1..9f7087ac41f21 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +@@ -1797,6 +1797,9 @@ static void disable_vga_and_power_gate_all_controllers( + struct timing_generator *tg; + struct dc_context *ctx = dc->ctx; + ++ if (dc->caps.ips_support) ++ return; ++ + for (i = 0; i < dc->res_pool->timing_generator_count; i++) { + tg = dc->res_pool->timing_generators[i]; + +@@ -1873,13 +1876,16 @@ static void clean_up_dsc_blocks(struct dc *dc) + /* disable DSC in OPTC */ + if (i < dc->res_pool->timing_generator_count) { + tg = dc->res_pool->timing_generators[i]; +- tg->funcs->set_dsc_config(tg, OPTC_DSC_DISABLED, 0, 0); ++ if (tg->funcs->set_dsc_config) ++ tg->funcs->set_dsc_config(tg, OPTC_DSC_DISABLED, 0, 0); + } + /* disable DSC in stream encoder */ + if (i < dc->res_pool->stream_enc_count) { + se = dc->res_pool->stream_enc[i]; +- se->funcs->dp_set_dsc_config(se, OPTC_DSC_DISABLED, 0, 0); +- se->funcs->dp_set_dsc_pps_info_packet(se, false, NULL, true); ++ if (se->funcs->dp_set_dsc_config) ++ se->funcs->dp_set_dsc_config(se, OPTC_DSC_DISABLED, 0, 0); ++ if (se->funcs->dp_set_dsc_pps_info_packet) ++ se->funcs->dp_set_dsc_pps_info_packet(se, false, NULL, true); + } + /* disable DSC block */ + if (dccg->funcs->set_ref_dscclk) +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-display-fix-gfx12-family-constant-checks.patch b/queue-6.19/drm-amd-display-fix-gfx12-family-constant-checks.patch new file mode 100644 index 00000000000..2df52562e4a --- /dev/null +++ b/queue-6.19/drm-amd-display-fix-gfx12-family-constant-checks.patch @@ -0,0 +1,59 @@ +From f5c80d4bd937229120919b1ac3cbe581fe04066f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jan 2026 13:32:42 -0500 +Subject: drm/amd/display: Fix GFX12 family constant checks + +From: Matthew Stewart + +[ Upstream commit bdad08670278829771626ea7b57c4db531e2544f ] + +Using >=, <= for checking the family is not always correct. + +Reviewed-by: Aurabindo Pillai +Signed-off-by: Matthew Stewart +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 62622aa622066..209a6e5c713ca 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -11853,7 +11853,7 @@ static int dm_check_cursor_fb(struct amdgpu_crtc *new_acrtc, + * check tiling flags when the FB doesn't have a modifier. + */ + if (!(fb->flags & DRM_MODE_FB_MODIFIERS)) { +- if (adev->family >= AMDGPU_FAMILY_GC_12_0_0) { ++ if (adev->family == AMDGPU_FAMILY_GC_12_0_0) { + linear = AMDGPU_TILING_GET(afb->tiling_flags, GFX12_SWIZZLE_MODE) == 0; + } else if (adev->family >= AMDGPU_FAMILY_AI) { + linear = AMDGPU_TILING_GET(afb->tiling_flags, SWIZZLE_MODE) == 0; +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c +index f0946e67aef97..7474f1bc1d0b8 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c +@@ -278,7 +278,7 @@ static int amdgpu_dm_plane_validate_dcc(struct amdgpu_device *adev, + if (!dcc->enable) + return 0; + +- if (adev->family < AMDGPU_FAMILY_GC_12_0_0 && ++ if (adev->family != AMDGPU_FAMILY_GC_12_0_0 && + format >= SURFACE_PIXEL_FORMAT_VIDEO_BEGIN) + return -EINVAL; + +@@ -901,7 +901,7 @@ int amdgpu_dm_plane_fill_plane_buffer_attributes(struct amdgpu_device *adev, + upper_32_bits(chroma_addr); + } + +- if (adev->family >= AMDGPU_FAMILY_GC_12_0_0) { ++ if (adev->family == AMDGPU_FAMILY_GC_12_0_0) { + ret = amdgpu_dm_plane_fill_gfx12_plane_attributes_from_modifiers(adev, afb, format, + rotation, plane_size, + tiling_info, dcc, +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-display-fix-mismatched-unlock-for-dmub-hw-lo.patch b/queue-6.19/drm-amd-display-fix-mismatched-unlock-for-dmub-hw-lo.patch new file mode 100644 index 00000000000..969f0d647a8 --- /dev/null +++ b/queue-6.19/drm-amd-display-fix-mismatched-unlock-for-dmub-hw-lo.patch @@ -0,0 +1,69 @@ +From bc1352ed942d4a217fcce66bc742105d48985ff4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 14:08:56 -0500 +Subject: drm/amd/display: Fix mismatched unlock for DMUB HW lock in HWSS fast + path + +From: Nicholas Kazlauskas + +[ Upstream commit af3303970da5ce5bfe6dffdd07f38f42aad603e0 ] + +[Why] +The evaluation for whether we need to use the DMUB HW lock isn't the +same as whether we need to unlock which results in a hang when the +fast path is used for ASIC without FAMS support. + +[How] +Store a flag that indicates whether we should use the lock and use +that same flag to specify whether unlocking is needed. + +Reviewed-by: Swapnil Patel +Signed-off-by: Nicholas Kazlauskas +Signed-off-by: Chenyu Chen +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c +index e2763b60482a0..052d573408c3e 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c +@@ -741,6 +741,7 @@ void hwss_build_fast_sequence(struct dc *dc, + struct dce_hwseq *hws = dc->hwseq; + struct pipe_ctx *current_pipe = NULL; + struct pipe_ctx *current_mpc_pipe = NULL; ++ bool is_dmub_lock_required = false; + unsigned int i = 0; + + *num_steps = 0; // Initialize to 0 +@@ -763,11 +764,12 @@ void hwss_build_fast_sequence(struct dc *dc, + (*num_steps)++; + } + if (dc->hwss.dmub_hw_control_lock_fast) { ++ is_dmub_lock_required = dc_state_is_fams2_in_use(dc, context) || ++ dmub_hw_lock_mgr_does_link_require_lock(dc, stream->link); ++ + block_sequence[*num_steps].params.dmub_hw_control_lock_fast_params.dc = dc; + block_sequence[*num_steps].params.dmub_hw_control_lock_fast_params.lock = true; +- block_sequence[*num_steps].params.dmub_hw_control_lock_fast_params.is_required = +- dc_state_is_fams2_in_use(dc, context) || +- dmub_hw_lock_mgr_does_link_require_lock(dc, stream->link); ++ block_sequence[*num_steps].params.dmub_hw_control_lock_fast_params.is_required = is_dmub_lock_required; + block_sequence[*num_steps].func = DMUB_HW_CONTROL_LOCK_FAST; + (*num_steps)++; + } +@@ -906,7 +908,7 @@ void hwss_build_fast_sequence(struct dc *dc, + if (dc->hwss.dmub_hw_control_lock_fast) { + block_sequence[*num_steps].params.dmub_hw_control_lock_fast_params.dc = dc; + block_sequence[*num_steps].params.dmub_hw_control_lock_fast_params.lock = false; +- block_sequence[*num_steps].params.dmub_hw_control_lock_fast_params.is_required = dc_state_is_fams2_in_use(dc, context); ++ block_sequence[*num_steps].params.dmub_hw_control_lock_fast_params.is_required = is_dmub_lock_required; + block_sequence[*num_steps].func = DMUB_HW_CONTROL_LOCK_FAST; + (*num_steps)++; + } +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-display-fix-system-resume-lag-issue.patch b/queue-6.19/drm-amd-display-fix-system-resume-lag-issue.patch new file mode 100644 index 00000000000..324c39c3e2c --- /dev/null +++ b/queue-6.19/drm-amd-display-fix-system-resume-lag-issue.patch @@ -0,0 +1,54 @@ +From 3b2a473e195cb5747fbf87bd6fd058806caa8964 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 18:10:31 +0800 +Subject: drm/amd/display: Fix system resume lag issue + +From: Tom Chung + +[ Upstream commit 64c94cd9be2e188ed07efeafa6a109bce638c967 ] + +[Why] +System will try to apply idle power optimizations setting during +system resume. But system power state is still in D3 state, and +it will cause the idle power optimizations command not actually +to be sent to DMUB and cause some platforms to go into IPS. + +[How] +Set power state to D0 first before calling the +dc_dmub_srv_apply_idle_power_optimizations(dm->dc, false) + +Reviewed-by: Nicholas Kazlauskas +Signed-off-by: Tom Chung +Signed-off-by: Wayne Lin +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 150cc3fc7b2a9..b6eee94861477 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -3468,7 +3468,17 @@ static int dm_resume(struct amdgpu_ip_block *ip_block) + struct dc_commit_streams_params commit_params = {}; + + if (dm->dc->caps.ips_support) { ++ if (!amdgpu_in_reset(adev)) ++ mutex_lock(&dm->dc_lock); ++ ++ /* Need to set POWER_STATE_D0 first or it will not execute ++ * idle_power_optimizations command to DMUB. ++ */ ++ dc_dmub_srv_set_power_state(dm->dc->ctx->dmub_srv, DC_ACPI_CM_POWER_STATE_D0); + dc_dmub_srv_apply_idle_power_optimizations(dm->dc, false); ++ ++ if (!amdgpu_in_reset(adev)) ++ mutex_unlock(&dm->dc_lock); + } + + if (amdgpu_in_reset(adev)) { +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-display-fix-writeback-on-dcn-3.2.patch b/queue-6.19/drm-amd-display-fix-writeback-on-dcn-3.2.patch new file mode 100644 index 00000000000..2c9bd1a87e9 --- /dev/null +++ b/queue-6.19/drm-amd-display-fix-writeback-on-dcn-3.2.patch @@ -0,0 +1,70 @@ +From 1b20876c86f7c3dbd881e9ba6dc9cc2a8034453f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 17:20:31 -0700 +Subject: drm/amd/display: Fix writeback on DCN 3.2+ + +From: Alex Hung + +[ Upstream commit 9ef84a307582a92ef055ef0bd3db10fd8ac75960 ] + +[WHAT] +1. Set no scaling for writeback as they are hardcoded in DCN3.2+. +2. Set no fast plane update for writeback commits. + +Reviewed-by: Harry Wentland +Signed-off-by: Alex Hung +Signed-off-by: Wayne Lin +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 209a6e5c713ca..150cc3fc7b2a9 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -10648,10 +10648,10 @@ static void dm_set_writeback(struct amdgpu_display_manager *dm, + + wb_info->dwb_params.capture_rate = dwb_capture_rate_0; + +- wb_info->dwb_params.scaler_taps.h_taps = 4; +- wb_info->dwb_params.scaler_taps.v_taps = 4; +- wb_info->dwb_params.scaler_taps.h_taps_c = 2; +- wb_info->dwb_params.scaler_taps.v_taps_c = 2; ++ wb_info->dwb_params.scaler_taps.h_taps = 1; ++ wb_info->dwb_params.scaler_taps.v_taps = 1; ++ wb_info->dwb_params.scaler_taps.h_taps_c = 1; ++ wb_info->dwb_params.scaler_taps.v_taps_c = 1; + wb_info->dwb_params.subsample_position = DWB_INTERSTITIAL_SUBSAMPLING; + + wb_info->mcif_buf_params.luma_pitch = afb->base.pitches[0]; +@@ -11667,6 +11667,8 @@ static bool should_reset_plane(struct drm_atomic_state *state, + struct drm_crtc_state *old_crtc_state, *new_crtc_state; + struct dm_crtc_state *old_dm_crtc_state, *new_dm_crtc_state; + struct amdgpu_device *adev = drm_to_adev(plane->dev); ++ struct drm_connector_state *new_con_state; ++ struct drm_connector *connector; + int i; + + /* +@@ -11677,6 +11679,15 @@ static bool should_reset_plane(struct drm_atomic_state *state, + state->allow_modeset) + return true; + ++ /* Check for writeback commit */ ++ for_each_new_connector_in_state(state, connector, new_con_state, i) { ++ if (connector->connector_type != DRM_MODE_CONNECTOR_WRITEBACK) ++ continue; ++ ++ if (new_con_state->writeback_job) ++ return true; ++ } ++ + if (amdgpu_in_reset(adev) && state->allow_modeset) + return true; + +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-display-fix-wrong-x_pos-and-y_pos-for-cursor.patch b/queue-6.19/drm-amd-display-fix-wrong-x_pos-and-y_pos-for-cursor.patch new file mode 100644 index 00000000000..c623f62de28 --- /dev/null +++ b/queue-6.19/drm-amd-display-fix-wrong-x_pos-and-y_pos-for-cursor.patch @@ -0,0 +1,92 @@ +From 38fe64b18a96b7653397c59af48a738d47b605d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Nov 2025 10:58:19 -0500 +Subject: drm/amd/display: Fix wrong x_pos and y_pos for cursor offload + +From: Nicholas Kazlauskas + +[ Upstream commit c02288724b98cbc018231200891d66578f83f848 ] + +[Why] +The hubp401_cursor_set_position function programs a different value +than it stores for use with cursor offload. + +This can cause a desync when switching between cursor programming paths. + +[How] +We do the translation to destination space currently twice: once in the +HWSS layer, and then again in the HUBP layer since we never store the +translated result. + +HUBP expects to program the pos->x and pos->y directly for other ASIC, +so follow that pattern here as well. + +Reviewed-by: Alvin Lee +Signed-off-by: Nicholas Kazlauskas +Signed-off-by: Roman Li +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c | 14 ++++++-------- + .../drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 3 +++ + 2 files changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c b/drivers/gpu/drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c +index f01eae50d02f7..c205500290ecd 100644 +--- a/drivers/gpu/drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c ++++ b/drivers/gpu/drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c +@@ -733,10 +733,8 @@ void hubp401_cursor_set_position( + const struct dc_cursor_mi_param *param) + { + struct dcn20_hubp *hubp2 = TO_DCN20_HUBP(hubp); +- int x_pos = pos->x - param->recout.x; +- int y_pos = pos->y - param->recout.y; +- int rec_x_offset = x_pos - pos->x_hotspot; +- int rec_y_offset = y_pos - pos->y_hotspot; ++ int rec_x_offset = pos->x - pos->x_hotspot; ++ int rec_y_offset = pos->y - pos->y_hotspot; + int dst_x_offset; + int x_pos_viewport = 0; + int x_hot_viewport = 0; +@@ -748,10 +746,10 @@ void hubp401_cursor_set_position( + * within preceeding ODM slices. + */ + if (param->recout.width) { +- x_pos_viewport = x_pos * param->viewport.width / param->recout.width; ++ x_pos_viewport = pos->x * param->viewport.width / param->recout.width; + x_hot_viewport = pos->x_hotspot * param->viewport.width / param->recout.width; + } else { +- ASSERT(!cur_en || x_pos == 0); ++ ASSERT(!cur_en || pos->x == 0); + ASSERT(!cur_en || pos->x_hotspot == 0); + } + +@@ -790,8 +788,8 @@ void hubp401_cursor_set_position( + + if (!hubp->cursor_offload) { + REG_SET_2(CURSOR_POSITION, 0, +- CURSOR_X_POSITION, x_pos, +- CURSOR_Y_POSITION, y_pos); ++ CURSOR_X_POSITION, pos->x, ++ CURSOR_Y_POSITION, pos->y); + + REG_SET_2(CURSOR_HOT_SPOT, 0, + CURSOR_HOT_SPOT_X, pos->x_hotspot, +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +index 5eda7648d0d2b..5ffe41a96864a 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +@@ -1215,6 +1215,9 @@ void dcn401_set_cursor_position(struct pipe_ctx *pipe_ctx) + if (recout_y_pos + (int)hubp->curs_attr.height <= 0) + pos_cpy.enable = false; /* not visible beyond top edge*/ + ++ pos_cpy.x = x_pos; ++ pos_cpy.y = y_pos; ++ + hubp->funcs->set_cursor_position(hubp, &pos_cpy, ¶m); + dpp->funcs->set_cursor_position(dpp, &pos_cpy, ¶m, hubp->curs_attr.width, hubp->curs_attr.height); + } +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-display-guard-fams2-configuration-updates.patch b/queue-6.19/drm-amd-display-guard-fams2-configuration-updates.patch new file mode 100644 index 00000000000..73cdb983c6e --- /dev/null +++ b/queue-6.19/drm-amd-display-guard-fams2-configuration-updates.patch @@ -0,0 +1,51 @@ +From 378952889ce6bf06836fe11e024f55a8da56847c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Nov 2025 20:58:23 +0000 +Subject: drm/amd/display: Guard FAMS2 configuration updates + +From: Dillon Varone + +[ Upstream commit 7dedb906cdfec100061daf41f8e54266e975987d ] + +[WHY&HOW] +If DMCUB is not initialized or FAMS2 is not supported, the +interface should not be called. + +Reviewed-by: Sridevi Arvindekar +Signed-off-by: Dillon Varone +Signed-off-by: Roman Li +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +index 5ffe41a96864a..12ce3789f5130 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +@@ -1774,7 +1774,8 @@ void dcn401_unblank_stream(struct pipe_ctx *pipe_ctx, + void dcn401_hardware_release(struct dc *dc) + { + if (!dc->debug.disable_force_pstate_allow_on_hw_release) { +- dc_dmub_srv_fams2_update_config(dc, dc->current_state, false); ++ if (dc->ctx->dmub_srv && dc->debug.fams2_config.bits.enable) ++ dc_dmub_srv_fams2_update_config(dc, dc->current_state, false); + + /* If pstate unsupported, or still supported + * by firmware, force it supported by dcn +@@ -1794,7 +1795,9 @@ void dcn401_hardware_release(struct dc *dc) + dc->clk_mgr->clks.p_state_change_support = false; + dc->clk_mgr->funcs->update_clocks(dc->clk_mgr, dc->current_state, true); + } +- dc_dmub_srv_fams2_update_config(dc, dc->current_state, false); ++ ++ if (dc->ctx->dmub_srv && dc->debug.fams2_config.bits.enable) ++ dc_dmub_srv_fams2_update_config(dc, dc->current_state, false); + } + } + +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-display-only-power-down-dig-on-phy-endpoints.patch b/queue-6.19/drm-amd-display-only-power-down-dig-on-phy-endpoints.patch new file mode 100644 index 00000000000..b4fc6c5ce21 --- /dev/null +++ b/queue-6.19/drm-amd-display-only-power-down-dig-on-phy-endpoints.patch @@ -0,0 +1,37 @@ +From f58a9cfb18704dfd0e5ed1dcb7b5d5ab4e0bade2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 16:38:50 -0500 +Subject: drm/amd/display: only power down dig on phy endpoints + +From: Dmytro Laktyushkin + +[ Upstream commit 0839d8d24e6f1fc2587c4a976f44da9fa69ae3d0 ] + +This avoids any issues with dpia endpoints + +Reviewed-by: Charlene Liu +Signed-off-by: Dmytro Laktyushkin +Signed-off-by: Matthew Stewart +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +index f04cbdb3d3814..1ce61f0570201 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +@@ -287,6 +287,8 @@ void dcn401_init_hw(struct dc *dc) + for (i = 0; i < dc->link_count; i++) { + struct dc_link *link = dc->links[i]; + ++ if (link->ep_type != DISPLAY_ENDPOINT_PHY) ++ continue; + if (link->link_enc->funcs->is_dig_enabled && + link->link_enc->funcs->is_dig_enabled(link->link_enc) && + hws->funcs.power_down) { +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-display-remove-conditional-for-shaper-3dlut-.patch b/queue-6.19/drm-amd-display-remove-conditional-for-shaper-3dlut-.patch new file mode 100644 index 00000000000..3ce3b9978b7 --- /dev/null +++ b/queue-6.19/drm-amd-display-remove-conditional-for-shaper-3dlut-.patch @@ -0,0 +1,44 @@ +From ff01c09defad777dff09ad0e28acafdb6fbc9b27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 22:05:16 -0700 +Subject: drm/amd/display: Remove conditional for shaper 3DLUT power-on + +From: Alex Hung + +[ Upstream commit 1b38a87b8f8020e8ef4563e7752a64182b5a39b9 ] + +[Why] +Shaper programming has high chance to fail on first time after +power-on or reboot. This can be verified by running IGT's kms_colorop. + +[How] +Always power on the shaper and 3DLUT before programming by +removing the debug flag of low power mode. + +Reviewed-by: Aurabindo Pillai +Signed-off-by: Alex Hung +Signed-off-by: Ray Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c b/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c +index 83bbbf34bcac7..badcef027b846 100644 +--- a/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c ++++ b/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c +@@ -724,8 +724,7 @@ bool mpc32_program_shaper( + return false; + } + +- if (mpc->ctx->dc->debug.enable_mem_low_power.bits.mpc) +- mpc32_power_on_shaper_3dlut(mpc, mpcc_id, true); ++ mpc32_power_on_shaper_3dlut(mpc, mpcc_id, true); + + current_mode = mpc32_get_shaper_current(mpc, mpcc_id); + +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-display-revert-init-dispclk-from-bootup-cloc.patch b/queue-6.19/drm-amd-display-revert-init-dispclk-from-bootup-cloc.patch new file mode 100644 index 00000000000..12595f8e752 --- /dev/null +++ b/queue-6.19/drm-amd-display-revert-init-dispclk-from-bootup-cloc.patch @@ -0,0 +1,248 @@ +From bd7b2d0af411faa1bda336bd1cfd6b6f251e0868 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Dec 2025 13:04:48 +0800 +Subject: drm/amd/display: Revert "init dispclk from bootup clock for DCN314" + +From: Wang, Sung-huai + +[ Upstream commit bdc26342c49e1dc1afb48feeb20c9d74d15b784c ] + +[Why&How] +This reverts commit f082daf08f2f. +Due to the change, the display shows garbage on startup. + +We have an alternative solution for the original issue: +d24203bb629f ("drm/amd/display: Re-check seamless boot can be enabled or not") + +Reviewed-by: Nicholas Kazlauskas +Signed-off-by: Wang, Sung-huai +Signed-off-by: Matthew Stewart +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../dc/clk_mgr/dcn314/dcn314_clk_mgr.c | 133 +----------------- + .../dc/clk_mgr/dcn314/dcn314_clk_mgr.h | 5 - + 2 files changed, 4 insertions(+), 134 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c +index db687a13174d5..0cb37827a62b6 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c +@@ -77,7 +77,6 @@ static const struct IP_BASE CLK_BASE = { { { { 0x00016C00, 0x02401800, 0, 0, 0, + #undef DC_LOGGER + #define DC_LOGGER \ + clk_mgr->base.base.ctx->logger +- + #define regCLK1_CLK_PLL_REQ 0x0237 + #define regCLK1_CLK_PLL_REQ_BASE_IDX 0 + +@@ -88,70 +87,8 @@ static const struct IP_BASE CLK_BASE = { { { { 0x00016C00, 0x02401800, 0, 0, 0, + #define CLK1_CLK_PLL_REQ__PllSpineDiv_MASK 0x0000F000L + #define CLK1_CLK_PLL_REQ__FbMult_frac_MASK 0xFFFF0000L + +-#define regCLK1_CLK0_DFS_CNTL 0x0269 +-#define regCLK1_CLK0_DFS_CNTL_BASE_IDX 0 +-#define regCLK1_CLK1_DFS_CNTL 0x026c +-#define regCLK1_CLK1_DFS_CNTL_BASE_IDX 0 +-#define regCLK1_CLK2_DFS_CNTL 0x026f +-#define regCLK1_CLK2_DFS_CNTL_BASE_IDX 0 +-#define regCLK1_CLK3_DFS_CNTL 0x0272 +-#define regCLK1_CLK3_DFS_CNTL_BASE_IDX 0 +-#define regCLK1_CLK4_DFS_CNTL 0x0275 +-#define regCLK1_CLK4_DFS_CNTL_BASE_IDX 0 +-#define regCLK1_CLK5_DFS_CNTL 0x0278 +-#define regCLK1_CLK5_DFS_CNTL_BASE_IDX 0 +- +-#define regCLK1_CLK0_CURRENT_CNT 0x02fb +-#define regCLK1_CLK0_CURRENT_CNT_BASE_IDX 0 +-#define regCLK1_CLK1_CURRENT_CNT 0x02fc +-#define regCLK1_CLK1_CURRENT_CNT_BASE_IDX 0 +-#define regCLK1_CLK2_CURRENT_CNT 0x02fd +-#define regCLK1_CLK2_CURRENT_CNT_BASE_IDX 0 +-#define regCLK1_CLK3_CURRENT_CNT 0x02fe +-#define regCLK1_CLK3_CURRENT_CNT_BASE_IDX 0 +-#define regCLK1_CLK4_CURRENT_CNT 0x02ff +-#define regCLK1_CLK4_CURRENT_CNT_BASE_IDX 0 +-#define regCLK1_CLK5_CURRENT_CNT 0x0300 +-#define regCLK1_CLK5_CURRENT_CNT_BASE_IDX 0 +- +-#define regCLK1_CLK0_BYPASS_CNTL 0x028a +-#define regCLK1_CLK0_BYPASS_CNTL_BASE_IDX 0 +-#define regCLK1_CLK1_BYPASS_CNTL 0x0293 +-#define regCLK1_CLK1_BYPASS_CNTL_BASE_IDX 0 + #define regCLK1_CLK2_BYPASS_CNTL 0x029c + #define regCLK1_CLK2_BYPASS_CNTL_BASE_IDX 0 +-#define regCLK1_CLK3_BYPASS_CNTL 0x02a5 +-#define regCLK1_CLK3_BYPASS_CNTL_BASE_IDX 0 +-#define regCLK1_CLK4_BYPASS_CNTL 0x02ae +-#define regCLK1_CLK4_BYPASS_CNTL_BASE_IDX 0 +-#define regCLK1_CLK5_BYPASS_CNTL 0x02b7 +-#define regCLK1_CLK5_BYPASS_CNTL_BASE_IDX 0 +- +-#define regCLK1_CLK0_DS_CNTL 0x0283 +-#define regCLK1_CLK0_DS_CNTL_BASE_IDX 0 +-#define regCLK1_CLK1_DS_CNTL 0x028c +-#define regCLK1_CLK1_DS_CNTL_BASE_IDX 0 +-#define regCLK1_CLK2_DS_CNTL 0x0295 +-#define regCLK1_CLK2_DS_CNTL_BASE_IDX 0 +-#define regCLK1_CLK3_DS_CNTL 0x029e +-#define regCLK1_CLK3_DS_CNTL_BASE_IDX 0 +-#define regCLK1_CLK4_DS_CNTL 0x02a7 +-#define regCLK1_CLK4_DS_CNTL_BASE_IDX 0 +-#define regCLK1_CLK5_DS_CNTL 0x02b0 +-#define regCLK1_CLK5_DS_CNTL_BASE_IDX 0 +- +-#define regCLK1_CLK0_ALLOW_DS 0x0284 +-#define regCLK1_CLK0_ALLOW_DS_BASE_IDX 0 +-#define regCLK1_CLK1_ALLOW_DS 0x028d +-#define regCLK1_CLK1_ALLOW_DS_BASE_IDX 0 +-#define regCLK1_CLK2_ALLOW_DS 0x0296 +-#define regCLK1_CLK2_ALLOW_DS_BASE_IDX 0 +-#define regCLK1_CLK3_ALLOW_DS 0x029f +-#define regCLK1_CLK3_ALLOW_DS_BASE_IDX 0 +-#define regCLK1_CLK4_ALLOW_DS 0x02a8 +-#define regCLK1_CLK4_ALLOW_DS_BASE_IDX 0 +-#define regCLK1_CLK5_ALLOW_DS 0x02b1 +-#define regCLK1_CLK5_ALLOW_DS_BASE_IDX 0 + + #define CLK1_CLK2_BYPASS_CNTL__CLK2_BYPASS_SEL__SHIFT 0x0 + #define CLK1_CLK2_BYPASS_CNTL__CLK2_BYPASS_DIV__SHIFT 0x10 +@@ -248,8 +185,6 @@ void dcn314_init_clocks(struct clk_mgr *clk_mgr) + { + struct clk_mgr_internal *clk_mgr_int = TO_CLK_MGR_INTERNAL(clk_mgr); + uint32_t ref_dtbclk = clk_mgr->clks.ref_dtbclk_khz; +- struct clk_mgr_dcn314 *clk_mgr_dcn314 = TO_CLK_MGR_DCN314(clk_mgr_int); +- struct clk_log_info log_info = {0}; + + memset(&(clk_mgr->clks), 0, sizeof(struct dc_clocks)); + // Assumption is that boot state always supports pstate +@@ -265,9 +200,6 @@ void dcn314_init_clocks(struct clk_mgr *clk_mgr) + dce_adjust_dp_ref_freq_for_ss(clk_mgr_int, clk_mgr->dprefclk_khz); + else + clk_mgr->dp_dto_source_clock_in_khz = clk_mgr->dprefclk_khz; +- +- dcn314_dump_clk_registers(&clk_mgr->boot_snapshot, &clk_mgr_dcn314->base.base, &log_info); +- clk_mgr->clks.dispclk_khz = clk_mgr->boot_snapshot.dispclk * 1000; + } + + void dcn314_update_clocks(struct clk_mgr *clk_mgr_base, +@@ -278,7 +210,7 @@ void dcn314_update_clocks(struct clk_mgr *clk_mgr_base, + struct clk_mgr_internal *clk_mgr = TO_CLK_MGR_INTERNAL(clk_mgr_base); + struct dc_clocks *new_clocks = &context->bw_ctx.bw.dcn.clk; + struct dc *dc = clk_mgr_base->ctx->dc; +- int display_count; ++ int display_count = 0; + bool update_dppclk = false; + bool update_dispclk = false; + bool dpp_clock_lowered = false; +@@ -287,7 +219,6 @@ void dcn314_update_clocks(struct clk_mgr *clk_mgr_base, + return; + + display_count = dcn314_get_active_display_cnt_wa(dc, context); +- + /* + * if it is safe to lower, but we are already in the lower state, we don't have to do anything + * also if safe to lower is false, we just go in the higher state +@@ -363,7 +294,7 @@ void dcn314_update_clocks(struct clk_mgr *clk_mgr_base, + } + + if (should_set_clock(safe_to_lower, new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz) && +- (new_clocks->dispclk_khz > 0 || (safe_to_lower && display_count == 0))) { ++ (new_clocks->dispclk_khz > 0 || (safe_to_lower && display_count == 0))) { + int requested_dispclk_khz = new_clocks->dispclk_khz; + + dcn314_disable_otg_wa(clk_mgr_base, context, safe_to_lower, true); +@@ -374,7 +305,6 @@ void dcn314_update_clocks(struct clk_mgr *clk_mgr_base, + + dcn314_smu_set_dispclk(clk_mgr, requested_dispclk_khz); + clk_mgr_base->clks.dispclk_khz = new_clocks->dispclk_khz; +- + dcn314_disable_otg_wa(clk_mgr_base, context, safe_to_lower, false); + + update_dispclk = true; +@@ -462,65 +392,10 @@ bool dcn314_are_clock_states_equal(struct dc_clocks *a, + return true; + } + +- +-static void dcn314_dump_clk_registers_internal(struct dcn35_clk_internal *internal, struct clk_mgr *clk_mgr_base) +-{ +- struct clk_mgr_internal *clk_mgr = TO_CLK_MGR_INTERNAL(clk_mgr_base); +- +- // read dtbclk +- internal->CLK1_CLK4_CURRENT_CNT = REG_READ(CLK1_CLK4_CURRENT_CNT); +- internal->CLK1_CLK4_BYPASS_CNTL = REG_READ(CLK1_CLK4_BYPASS_CNTL); +- +- // read dcfclk +- internal->CLK1_CLK3_CURRENT_CNT = REG_READ(CLK1_CLK3_CURRENT_CNT); +- internal->CLK1_CLK3_BYPASS_CNTL = REG_READ(CLK1_CLK3_BYPASS_CNTL); +- +- // read dcf deep sleep divider +- internal->CLK1_CLK3_DS_CNTL = REG_READ(CLK1_CLK3_DS_CNTL); +- internal->CLK1_CLK3_ALLOW_DS = REG_READ(CLK1_CLK3_ALLOW_DS); +- +- // read dppclk +- internal->CLK1_CLK1_CURRENT_CNT = REG_READ(CLK1_CLK1_CURRENT_CNT); +- internal->CLK1_CLK1_BYPASS_CNTL = REG_READ(CLK1_CLK1_BYPASS_CNTL); +- +- // read dprefclk +- internal->CLK1_CLK2_CURRENT_CNT = REG_READ(CLK1_CLK2_CURRENT_CNT); +- internal->CLK1_CLK2_BYPASS_CNTL = REG_READ(CLK1_CLK2_BYPASS_CNTL); +- +- // read dispclk +- internal->CLK1_CLK0_CURRENT_CNT = REG_READ(CLK1_CLK0_CURRENT_CNT); +- internal->CLK1_CLK0_BYPASS_CNTL = REG_READ(CLK1_CLK0_BYPASS_CNTL); +-} +- +-void dcn314_dump_clk_registers(struct clk_state_registers_and_bypass *regs_and_bypass, ++static void dcn314_dump_clk_registers(struct clk_state_registers_and_bypass *regs_and_bypass, + struct clk_mgr *clk_mgr_base, struct clk_log_info *log_info) + { +- +- struct dcn35_clk_internal internal = {0}; +- +- dcn314_dump_clk_registers_internal(&internal, clk_mgr_base); +- +- regs_and_bypass->dcfclk = internal.CLK1_CLK3_CURRENT_CNT / 10; +- regs_and_bypass->dcf_deep_sleep_divider = internal.CLK1_CLK3_DS_CNTL / 10; +- regs_and_bypass->dcf_deep_sleep_allow = internal.CLK1_CLK3_ALLOW_DS; +- regs_and_bypass->dprefclk = internal.CLK1_CLK2_CURRENT_CNT / 10; +- regs_and_bypass->dispclk = internal.CLK1_CLK0_CURRENT_CNT / 10; +- regs_and_bypass->dppclk = internal.CLK1_CLK1_CURRENT_CNT / 10; +- regs_and_bypass->dtbclk = internal.CLK1_CLK4_CURRENT_CNT / 10; +- +- regs_and_bypass->dppclk_bypass = internal.CLK1_CLK1_BYPASS_CNTL & 0x0007; +- if (regs_and_bypass->dppclk_bypass > 4) +- regs_and_bypass->dppclk_bypass = 0; +- regs_and_bypass->dcfclk_bypass = internal.CLK1_CLK3_BYPASS_CNTL & 0x0007; +- if (regs_and_bypass->dcfclk_bypass > 4) +- regs_and_bypass->dcfclk_bypass = 0; +- regs_and_bypass->dispclk_bypass = internal.CLK1_CLK0_BYPASS_CNTL & 0x0007; +- if (regs_and_bypass->dispclk_bypass > 4) +- regs_and_bypass->dispclk_bypass = 0; +- regs_and_bypass->dprefclk_bypass = internal.CLK1_CLK2_BYPASS_CNTL & 0x0007; +- if (regs_and_bypass->dprefclk_bypass > 4) +- regs_and_bypass->dprefclk_bypass = 0; +- ++ return; + } + + static struct clk_bw_params dcn314_bw_params = { +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h +index 0577eb527bc36..002c28e807208 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h +@@ -65,9 +65,4 @@ void dcn314_clk_mgr_construct(struct dc_context *ctx, + + void dcn314_clk_mgr_destroy(struct clk_mgr_internal *clk_mgr_int); + +- +-void dcn314_dump_clk_registers(struct clk_state_registers_and_bypass *regs_and_bypass, +- struct clk_mgr *clk_mgr_base, struct clk_log_info *log_info); +- +- + #endif //__DCN314_CLK_MGR_H__ +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-display-revert-init-dispclk-from-bootup-cloc.patch-24199 b/queue-6.19/drm-amd-display-revert-init-dispclk-from-bootup-cloc.patch-24199 new file mode 100644 index 00000000000..28e17edcd66 --- /dev/null +++ b/queue-6.19/drm-amd-display-revert-init-dispclk-from-bootup-cloc.patch-24199 @@ -0,0 +1,197 @@ +From dd0cdacc2d3d9d0fb6f39371ee10222b400a6b48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Dec 2025 11:01:38 +0800 +Subject: drm/amd/display: Revert "init dispclk from bootup clock for DCN315" + +From: Wang, Sung-huai + +[ Upstream commit a625dc4989a2affb8f06e7b418bf30e1474b99c1 ] + +[Why&How] +This reverts commit 14bb17cc37e0. +Due to the change, the display shows garbage on startup. + +We have an alternative solution for the original issue: +d24203bb629f ("drm/amd/display: Re-check seamless boot can be enabled or not") + +Reviewed-by: Nicholas Kazlauskas +Signed-off-by: Wang, Sung-huai +Signed-off-by: Matthew Stewart +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 90 +------------------ + .../dc/clk_mgr/dcn315/dcn315_clk_mgr.h | 1 - + 2 files changed, 3 insertions(+), 88 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c +index 3a881451e9da4..c49268db85f68 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c +@@ -40,7 +40,7 @@ + #include "dm_helpers.h" + + #include "dc_dmub_srv.h" +-#include "reg_helper.h" ++ + #include "logger_types.h" + #undef DC_LOGGER + #define DC_LOGGER \ +@@ -48,43 +48,9 @@ + + #include "link_service.h" + +-#define MAX_INSTANCE 7 +-#define MAX_SEGMENT 8 +- +-struct IP_BASE_INSTANCE { +- unsigned int segment[MAX_SEGMENT]; +-}; +- +-struct IP_BASE { +- struct IP_BASE_INSTANCE instance[MAX_INSTANCE]; +-}; +- +-static const struct IP_BASE CLK_BASE = { { { { 0x00016C00, 0x02401800, 0, 0, 0, 0, 0, 0 } }, +- { { 0x00016E00, 0x02401C00, 0, 0, 0, 0, 0, 0 } }, +- { { 0x00017000, 0x02402000, 0, 0, 0, 0, 0, 0 } }, +- { { 0x00017200, 0x02402400, 0, 0, 0, 0, 0, 0 } }, +- { { 0x0001B000, 0x0242D800, 0, 0, 0, 0, 0, 0 } }, +- { { 0x0001B200, 0x0242DC00, 0, 0, 0, 0, 0, 0 } } } }; +- +-#define regCLK1_CLK0_CURRENT_CNT 0x0314 +-#define regCLK1_CLK0_CURRENT_CNT_BASE_IDX 0 +-#define regCLK1_CLK1_CURRENT_CNT 0x0315 +-#define regCLK1_CLK1_CURRENT_CNT_BASE_IDX 0 +-#define regCLK1_CLK2_CURRENT_CNT 0x0316 +-#define regCLK1_CLK2_CURRENT_CNT_BASE_IDX 0 +-#define regCLK1_CLK3_CURRENT_CNT 0x0317 +-#define regCLK1_CLK3_CURRENT_CNT_BASE_IDX 0 +-#define regCLK1_CLK4_CURRENT_CNT 0x0318 +-#define regCLK1_CLK4_CURRENT_CNT_BASE_IDX 0 +-#define regCLK1_CLK5_CURRENT_CNT 0x0319 +-#define regCLK1_CLK5_CURRENT_CNT_BASE_IDX 0 +- + #define TO_CLK_MGR_DCN315(clk_mgr)\ + container_of(clk_mgr, struct clk_mgr_dcn315, base) + +-#define REG(reg_name) \ +- (CLK_BASE.instance[0].segment[reg ## reg_name ## _BASE_IDX] + reg ## reg_name) +- + #define UNSUPPORTED_DCFCLK 10000000 + #define MIN_DPP_DISP_CLK 100000 + +@@ -172,7 +138,7 @@ static void dcn315_update_clocks(struct clk_mgr *clk_mgr_base, + if (dc->work_arounds.skip_clock_update) + return; + +- clk_mgr_base->clks.zstate_support = new_clocks->zstate_support; ++ display_count = dcn315_get_active_display_cnt_wa(dc, context); + /* + * if it is safe to lower, but we are already in the lower state, we don't have to do anything + * also if safe to lower is false, we just go in the higher state +@@ -185,7 +151,6 @@ static void dcn315_update_clocks(struct clk_mgr *clk_mgr_base, + } + /* check that we're not already in lower */ + if (clk_mgr_base->clks.pwr_state != DCN_PWR_STATE_LOW_POWER) { +- display_count = dcn315_get_active_display_cnt_wa(dc, context); + /* if we can go lower, go lower */ + if (display_count == 0) { + union display_idle_optimization_u idle_info = { 0 }; +@@ -279,38 +244,9 @@ static void dcn315_update_clocks(struct clk_mgr *clk_mgr_base, + dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); + } + +-static void dcn315_dump_clk_registers_internal(struct dcn35_clk_internal *internal, struct clk_mgr *clk_mgr_base) +-{ +- struct clk_mgr_internal *clk_mgr = TO_CLK_MGR_INTERNAL(clk_mgr_base); +- +- // read dtbclk +- internal->CLK1_CLK4_CURRENT_CNT = REG_READ(CLK1_CLK4_CURRENT_CNT); +- +- // read dcfclk +- internal->CLK1_CLK3_CURRENT_CNT = REG_READ(CLK1_CLK3_CURRENT_CNT); +- +- // read dppclk +- internal->CLK1_CLK1_CURRENT_CNT = REG_READ(CLK1_CLK1_CURRENT_CNT); +- +- // read dprefclk +- internal->CLK1_CLK2_CURRENT_CNT = REG_READ(CLK1_CLK2_CURRENT_CNT); +- +- // read dispclk +- internal->CLK1_CLK0_CURRENT_CNT = REG_READ(CLK1_CLK0_CURRENT_CNT); +-} +- + static void dcn315_dump_clk_registers(struct clk_state_registers_and_bypass *regs_and_bypass, + struct clk_mgr *clk_mgr_base, struct clk_log_info *log_info) + { +- struct dcn35_clk_internal internal = {0}; +- +- dcn315_dump_clk_registers_internal(&internal, clk_mgr_base); +- +- regs_and_bypass->dcfclk = internal.CLK1_CLK3_CURRENT_CNT / 10; +- regs_and_bypass->dprefclk = internal.CLK1_CLK2_CURRENT_CNT / 10; +- regs_and_bypass->dispclk = internal.CLK1_CLK0_CURRENT_CNT / 10; +- regs_and_bypass->dppclk = internal.CLK1_CLK1_CURRENT_CNT / 10; +- regs_and_bypass->dtbclk = internal.CLK1_CLK4_CURRENT_CNT / 10; + return; + } + +@@ -657,32 +593,13 @@ static struct clk_mgr_funcs dcn315_funcs = { + .get_dp_ref_clk_frequency = dce12_get_dp_ref_freq_khz, + .get_dtb_ref_clk_frequency = dcn31_get_dtb_ref_freq_khz, + .update_clocks = dcn315_update_clocks, +- .init_clocks = dcn315_init_clocks, ++ .init_clocks = dcn31_init_clocks, + .enable_pme_wa = dcn315_enable_pme_wa, + .are_clock_states_equal = dcn31_are_clock_states_equal, + .notify_wm_ranges = dcn315_notify_wm_ranges + }; + extern struct clk_mgr_funcs dcn3_fpga_funcs; + +-void dcn315_init_clocks(struct clk_mgr *clk_mgr) +-{ +- struct clk_mgr_internal *clk_mgr_int = TO_CLK_MGR_INTERNAL(clk_mgr); +- uint32_t ref_dtbclk = clk_mgr->clks.ref_dtbclk_khz; +- struct clk_mgr_dcn315 *clk_mgr_dcn315 = TO_CLK_MGR_DCN315(clk_mgr_int); +- struct clk_log_info log_info = {0}; +- +- memset(&(clk_mgr->clks), 0, sizeof(struct dc_clocks)); +- // Assumption is that boot state always supports pstate +- clk_mgr->clks.ref_dtbclk_khz = ref_dtbclk; // restore ref_dtbclk +- clk_mgr->clks.p_state_change_support = true; +- clk_mgr->clks.prev_p_state_change_support = true; +- clk_mgr->clks.pwr_state = DCN_PWR_STATE_UNKNOWN; +- clk_mgr->clks.zstate_support = DCN_ZSTATE_SUPPORT_UNKNOWN; +- +- dcn315_dump_clk_registers(&clk_mgr->boot_snapshot, &clk_mgr_dcn315->base.base, &log_info); +- clk_mgr->clks.dispclk_khz = clk_mgr->boot_snapshot.dispclk * 1000; +-} +- + void dcn315_clk_mgr_construct( + struct dc_context *ctx, + struct clk_mgr_dcn315 *clk_mgr, +@@ -743,7 +660,6 @@ void dcn315_clk_mgr_construct( + /* Saved clocks configured at boot for debug purposes */ + dcn315_dump_clk_registers(&clk_mgr->base.base.boot_snapshot, + &clk_mgr->base.base, &log_info); +- clk_mgr->base.base.clks.dispclk_khz = clk_mgr->base.base.boot_snapshot.dispclk * 1000; + + clk_mgr->base.base.dprefclk_khz = 600000; + clk_mgr->base.base.dprefclk_khz = dcn315_smu_get_dpref_clk(&clk_mgr->base); +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.h b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.h +index 642ae3d4a7909..ac36ddf5dd1af 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.h ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.h +@@ -44,7 +44,6 @@ void dcn315_clk_mgr_construct(struct dc_context *ctx, + struct pp_smu_funcs *pp_smu, + struct dccg *dccg); + +-void dcn315_init_clocks(struct clk_mgr *clk_mgr); + void dcn315_clk_mgr_destroy(struct clk_mgr_internal *clk_mgr_int); + + #endif //__DCN315_CLK_MGR_H__ +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-display-set-enable_legacy_fast_update-to-fal.patch b/queue-6.19/drm-amd-display-set-enable_legacy_fast_update-to-fal.patch new file mode 100644 index 00000000000..e4130b91d36 --- /dev/null +++ b/queue-6.19/drm-amd-display-set-enable_legacy_fast_update-to-fal.patch @@ -0,0 +1,38 @@ +From 47496c002897f3c2ba1d35b7be0acf9eac34e12a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 13:32:40 +0800 +Subject: drm/amd/display: set enable_legacy_fast_update to false for DCN36 + +From: YiLing Chen + +[ Upstream commit d0728aee5090853d0b9982757f5fb1b13e2e2b27 ] + +[Why/How] +Align the default value of the flag with DCN35/351. + +Reviewed-by: Nicholas Kazlauskas +Signed-off-by: YiLing Chen +Signed-off-by: Tom Chung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c +index 6469d5fe2e6d4..a1132102afde4 100644 +--- a/drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c +@@ -769,7 +769,7 @@ static const struct dc_debug_options debug_defaults_drv = { + }; + + static const struct dc_check_config config_defaults = { +- .enable_legacy_fast_update = true, ++ .enable_legacy_fast_update = false, + }; + + static const struct dc_panel_config panel_config_defaults = { +-- +2.51.0 + diff --git a/queue-6.19/drm-amd-pm-fix-null-pointer-dereference-issue.patch b/queue-6.19/drm-amd-pm-fix-null-pointer-dereference-issue.patch new file mode 100644 index 00000000000..8ed671a5d6b --- /dev/null +++ b/queue-6.19/drm-amd-pm-fix-null-pointer-dereference-issue.patch @@ -0,0 +1,37 @@ +From 89ef51a181196d59e22c9830b910996c4487be23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jan 2026 16:42:11 +0800 +Subject: drm/amd/pm: Fix null pointer dereference issue + +From: Jinzhou Su + +[ Upstream commit 1197366cca89a4c44c541ddedb8ce8bf0757993d ] + +If SMU is disabled, during RAS initialization, +there will be null pointer dereference issue here. + +Signed-off-by: Jinzhou Su +Reviewed-by: Yang Wang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +index f51fa265230b3..2a0e826d0317d 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +@@ -618,6 +618,9 @@ int amdgpu_smu_ras_send_msg(struct amdgpu_device *adev, enum smu_message_type ms + struct smu_context *smu = adev->powerplay.pp_handle; + int ret = -EOPNOTSUPP; + ++ if (!smu) ++ return ret; ++ + if (smu->ppt_funcs && smu->ppt_funcs->ras_send_msg) + ret = smu->ppt_funcs->ras_send_msg(smu, msg, param, read_arg); + +-- +2.51.0 + diff --git a/queue-6.19/drm-amdgpu-add-hainan-clock-adjustment.patch b/queue-6.19/drm-amdgpu-add-hainan-clock-adjustment.patch new file mode 100644 index 00000000000..0839cc53dae --- /dev/null +++ b/queue-6.19/drm-amdgpu-add-hainan-clock-adjustment.patch @@ -0,0 +1,39 @@ +From dbae7b06f456ae1751643dd39555d7d9c2dc3650 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Feb 2026 07:24:01 +0000 +Subject: drm/amdgpu: Add HAINAN clock adjustment + +From: decce6 + +[ Upstream commit 49fe2c57bdc0acff9d2551ae337270b6fd8119d9 ] + +This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from +850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This +patch is for amdgpu. + +Signed-off-by: decce6 +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index 695432d3045ff..2d8d86efe2e73 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -3464,6 +3464,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + max_sclk = 60000; + max_mclk = 80000; + } ++ if ((adev->pdev->device == 0x666f) && ++ (adev->pdev->revision == 0x00)) { ++ max_sclk = 80000; ++ max_mclk = 95000; ++ } + } else if (adev->asic_type == CHIP_OLAND) { + if ((adev->pdev->revision == 0xC7) || + (adev->pdev->revision == 0x80) || +-- +2.51.0 + diff --git a/queue-6.19/drm-amdgpu-add-support-for-hdp-ip-version-6.1.1.patch b/queue-6.19/drm-amdgpu-add-support-for-hdp-ip-version-6.1.1.patch new file mode 100644 index 00000000000..4cc6985251c --- /dev/null +++ b/queue-6.19/drm-amdgpu-add-support-for-hdp-ip-version-6.1.1.patch @@ -0,0 +1,34 @@ +From 0740fbcad27cc5c313973f5e1341f4bc1f83c990 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Dec 2024 10:46:47 +0800 +Subject: drm/amdgpu: add support for HDP IP version 6.1.1 + +From: Tim Huang + +[ Upstream commit e2fd14f579b841f54a9b7162fef15234d8c0627a ] + +This initializes HDP IP version 6.1.1. + +Reviewed-by: Mario Limonciello +Signed-off-by: Tim Huang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +index fa2a22dfa0487..f9e0e80c4c186 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +@@ -3059,6 +3059,7 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev) + case IP_VERSION(6, 0, 0): + case IP_VERSION(6, 0, 1): + case IP_VERSION(6, 1, 0): ++ case IP_VERSION(6, 1, 1): + adev->hdp.funcs = &hdp_v6_0_funcs; + break; + case IP_VERSION(7, 0, 0): +-- +2.51.0 + diff --git a/queue-6.19/drm-amdgpu-adjust-usleep_range-in-fence-wait.patch b/queue-6.19/drm-amdgpu-adjust-usleep_range-in-fence-wait.patch new file mode 100644 index 00000000000..3281f9b41d6 --- /dev/null +++ b/queue-6.19/drm-amdgpu-adjust-usleep_range-in-fence-wait.patch @@ -0,0 +1,38 @@ +From bf21231e1d83a28751bda3e092fbf8d938bc7ed4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Feb 2026 15:32:01 +0800 +Subject: drm/amdgpu: Adjust usleep_range in fence wait + +From: Ce Sun + +[ Upstream commit 3ee1c72606bd2842f0f377fd4b118362af0323ae ] + +Tune the sleep interval in the PSP fence wait loop from 10-100us to +60-100us.This adjustment results in an overall wait window of 1.2s +(60us * 20000 iterations) to 2 seconds (100us * 20000 iterations), +which guarantees that we can retrieve the correct fence value + +Signed-off-by: Ce Sun +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index 0b10497d487c3..81bdd6aaad2a1 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -726,7 +726,7 @@ psp_cmd_submit_buf(struct psp_context *psp, + ras_intr = amdgpu_ras_intr_triggered(); + if (ras_intr) + break; +- usleep_range(10, 100); ++ usleep_range(60, 100); + amdgpu_device_invalidate_hdp(psp->adev, NULL); + } + +-- +2.51.0 + diff --git a/queue-6.19/drm-amdgpu-avoid-a-warning-in-timedout-job-handler.patch b/queue-6.19/drm-amdgpu-avoid-a-warning-in-timedout-job-handler.patch new file mode 100644 index 00000000000..5fa09c1939d --- /dev/null +++ b/queue-6.19/drm-amdgpu-avoid-a-warning-in-timedout-job-handler.patch @@ -0,0 +1,41 @@ +From 87148f81fd75c43422641019303ff98a3c6766c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Dec 2025 11:46:48 -0500 +Subject: drm/amdgpu: avoid a warning in timedout job handler +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +[ Upstream commit c8cf9ddc549fb93cb5a35f3fe23487b1e6707e74 ] + +Only set an error on the fence if the fence is not +signalled. We can end up with a warning if the +per queue reset path signals the fence and sets an error +as part of the reset, but fails to recover. + +Reviewed-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c +index 7ccb724b2488d..aaf5477fcd7ac 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c +@@ -147,7 +147,8 @@ static enum drm_gpu_sched_stat amdgpu_job_timedout(struct drm_sched_job *s_job) + dev_err(adev->dev, "Ring %s reset failed\n", ring->sched.name); + } + +- dma_fence_set_error(&s_job->s_fence->finished, -ETIME); ++ if (dma_fence_get_status(&s_job->s_fence->finished) == 0) ++ dma_fence_set_error(&s_job->s_fence->finished, -ETIME); + + if (amdgpu_device_should_recover_gpu(ring->adev)) { + struct amdgpu_reset_context reset_context; +-- +2.51.0 + diff --git a/queue-6.19/drm-amdgpu-avoid-sdma-ring-reset-in-sriov.patch b/queue-6.19/drm-amdgpu-avoid-sdma-ring-reset-in-sriov.patch new file mode 100644 index 00000000000..17490a9ef85 --- /dev/null +++ b/queue-6.19/drm-amdgpu-avoid-sdma-ring-reset-in-sriov.patch @@ -0,0 +1,39 @@ +From 918f4c9d069add5cb2e2e3204afe373e9093dabb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 23:15:04 +0800 +Subject: drm/amdgpu: avoid sdma ring reset in sriov + +From: Victor Zhao + +[ Upstream commit 5cc7bbd9f1b74d9fe2f7ac08d6ba0477e8d2d65f ] + +sdma ring reset is not supported in SRIOV. kfd driver does not check +reset mask, and could queue sdma ring reset during unmap_queues_cpsch. + +Avoid the ring reset for sriov. + +Signed-off-by: Victor Zhao +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c +index 8b8a04138711c..321310ba2c08e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c +@@ -558,6 +558,9 @@ int amdgpu_sdma_reset_engine(struct amdgpu_device *adev, uint32_t instance_id, + struct amdgpu_ring *gfx_ring = &sdma_instance->ring; + struct amdgpu_ring *page_ring = &sdma_instance->page; + ++ if (amdgpu_sriov_vf(adev)) ++ return -EOPNOTSUPP; ++ + mutex_lock(&sdma_instance->engine_reset_mutex); + + if (!caller_handles_kernel_queues) { +-- +2.51.0 + diff --git a/queue-6.19/drm-amdgpu-fix-null-pointer-issue-buffer-funcs.patch b/queue-6.19/drm-amdgpu-fix-null-pointer-issue-buffer-funcs.patch new file mode 100644 index 00000000000..3618d4328d0 --- /dev/null +++ b/queue-6.19/drm-amdgpu-fix-null-pointer-issue-buffer-funcs.patch @@ -0,0 +1,37 @@ +From 1a12f40247477abce80075d1012155ab8379228f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Jul 2024 11:07:40 +0800 +Subject: drm/amdgpu: fix NULL pointer issue buffer funcs + +From: Likun Gao + +[ Upstream commit 9877a865d62c9c3e0f4cc369dc9ca9f7f24f5ee9 ] + +If SDMA block not enabled, buffer_funcs will not initialize, +fix the null pointer issue if buffer_funcs not initialized. + +Signed-off-by: Likun Gao +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index d2c3885de711f..ba6fb23b840a0 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -3309,7 +3309,8 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev) + if (r) + goto init_failed; + +- if (adev->mman.buffer_funcs_ring->sched.ready) ++ if (adev->mman.buffer_funcs_ring && ++ adev->mman.buffer_funcs_ring->sched.ready) + amdgpu_ttm_set_buffer_funcs_status(adev, true); + + /* Don't init kfd if whole hive need to be reset during init */ +-- +2.51.0 + diff --git a/queue-6.19/drm-amdgpu-fix-the-calculation-of-ras-bad-page-numbe.patch b/queue-6.19/drm-amdgpu-fix-the-calculation-of-ras-bad-page-numbe.patch new file mode 100644 index 00000000000..b85cbc49f4e --- /dev/null +++ b/queue-6.19/drm-amdgpu-fix-the-calculation-of-ras-bad-page-numbe.patch @@ -0,0 +1,46 @@ +From e4904bd8d5b07141509e4bd74b0110d9bd0dea24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 15:21:43 +0800 +Subject: drm/amdgpu: fix the calculation of RAS bad page number + +From: Tao Zhou + +[ Upstream commit f752e79d38857011f1293fcb6c810409c3b669ee ] + +__amdgpu_ras_restore_bad_pages is responsible for the maintenance of bad +page number, drop the unnecessary bad page number update in the error +handling path of add_bad_pages. + +Signed-off-by: Tao Zhou +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +index 8de9f68f7bea6..9c21401c9b830 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +@@ -3249,8 +3249,6 @@ int amdgpu_ras_add_bad_pages(struct amdgpu_device *adev, + /* deal with retire_unit records a time */ + ret = __amdgpu_ras_convert_rec_array_from_rom(adev, + &bps[i], &err_data, nps); +- if (ret) +- con->bad_page_num -= adev->umc.retire_unit; + i += (adev->umc.retire_unit - 1); + } else { + break; +@@ -3263,8 +3261,6 @@ int amdgpu_ras_add_bad_pages(struct amdgpu_device *adev, + for (; i < pages; i++) { + ret = __amdgpu_ras_convert_rec_from_rom(adev, + &bps[i], &err_data, nps); +- if (ret) +- con->bad_page_num -= adev->umc.retire_unit; + } + + con->eh_data->count_saved = con->eh_data->count; +-- +2.51.0 + diff --git a/queue-6.19/drm-amdgpu-mark-invalid-records-with-u64_max.patch b/queue-6.19/drm-amdgpu-mark-invalid-records-with-u64_max.patch new file mode 100644 index 00000000000..4c68a805361 --- /dev/null +++ b/queue-6.19/drm-amdgpu-mark-invalid-records-with-u64_max.patch @@ -0,0 +1,47 @@ +From b441092103f2dbaa4da882e8330e6f9dfec97d16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jan 2026 11:32:08 +0800 +Subject: drm/amdgpu: mark invalid records with U64_MAX + +From: Gangliang Xie + +[ Upstream commit 0028b86b52f7609e36af635ef6cb908925306233 ] + +set retired_page of invalid ras records to U64_MAX, and skip +them when reading ras records + +Signed-off-by: Gangliang Xie +Reviewed-by: Tao Zhou +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +index 6b069dc4bab06..ee4d08b0988d3 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +@@ -2777,6 +2777,10 @@ static int amdgpu_ras_badpages_read(struct amdgpu_device *adev, + if (!data->bps[i].ts) + continue; + ++ /* U64_MAX is used to mark the record as invalid */ ++ if (data->bps[i].retired_page == U64_MAX) ++ continue; ++ + bps[r].bp = data->bps[i].retired_page; + r++; + if (r >= count) +@@ -3083,6 +3087,8 @@ static int __amdgpu_ras_restore_bad_pages(struct amdgpu_device *adev, + + if (amdgpu_ras_check_bad_page_unlock(con, + bps[j].retired_page << AMDGPU_GPU_PAGE_SHIFT)) { ++ /* set to U64_MAX to mark it as invalid */ ++ data->bps[data->count].retired_page = U64_MAX; + data->count++; + data->space_left--; + continue; +-- +2.51.0 + diff --git a/queue-6.19/drm-amdgpu-ras-move-ras-data-alloc-before-bad-page-c.patch b/queue-6.19/drm-amdgpu-ras-move-ras-data-alloc-before-bad-page-c.patch new file mode 100644 index 00000000000..576657db104 --- /dev/null +++ b/queue-6.19/drm-amdgpu-ras-move-ras-data-alloc-before-bad-page-c.patch @@ -0,0 +1,89 @@ +From 38f038d1574037108a74efe89e1945ab594b4574 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 00:46:23 +0800 +Subject: drm/amdgpu/ras: Move ras data alloc before bad page check + +From: Asad Kamal + +[ Upstream commit bd68a1404b6fa2e7e9957b38ba22616faba43e75 ] + +In the rare event if eeprom has only invalid address entries, +allocation is skipped, this causes following NULL pointer issue +[ 547.103445] BUG: kernel NULL pointer dereference, address: 0000000000000010 +[ 547.118897] #PF: supervisor read access in kernel mode +[ 547.130292] #PF: error_code(0x0000) - not-present page +[ 547.141689] PGD 124757067 P4D 0 +[ 547.148842] Oops: 0000 [#1] PREEMPT SMP NOPTI +[ 547.158504] CPU: 49 PID: 8167 Comm: cat Tainted: G OE 6.8.0-38-generic #38-Ubuntu +[ 547.177998] Hardware name: Supermicro AS -8126GS-TNMR/H14DSG-OD, BIOS 1.7 09/12/2025 +[ 547.195178] RIP: 0010:amdgpu_ras_sysfs_badpages_read+0x2f2/0x5d0 [amdgpu] +[ 547.210375] Code: e8 63 78 82 c0 45 31 d2 45 3b 75 08 48 8b 45 a0 73 44 44 89 f1 48 8b 7d 88 48 89 ca 48 c1 e2 05 48 29 ca 49 8b 4d 00 48 01 d1 <48> 83 79 10 00 74 17 49 63 f2 48 8b 49 08 41 83 c2 01 48 8d 34 76 +[ 547.252045] RSP: 0018:ffa0000067287ac0 EFLAGS: 00010246 +[ 547.263636] RAX: ff11000167c28130 RBX: ff11000127600000 RCX: 0000000000000000 +[ 547.279467] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ff11000125b1c800 +[ 547.295298] RBP: ffa0000067287b50 R08: 0000000000000000 R09: 0000000000000000 +[ 547.311129] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 +[ 547.326959] R13: ff11000217b1de00 R14: 0000000000000000 R15: 0000000000000092 +[ 547.342790] FS: 0000746e59d14740(0000) GS:ff11017dfda80000(0000) knlGS:0000000000000000 +[ 547.360744] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 547.373489] CR2: 0000000000000010 CR3: 000000019585e001 CR4: 0000000000f71ef0 +[ 547.389321] PKRU: 55555554 +[ 547.395316] Call Trace: +[ 547.400737] +[ 547.405386] ? show_regs+0x6d/0x80 +[ 547.412929] ? __die+0x24/0x80 +[ 547.419697] ? page_fault_oops+0x99/0x1b0 +[ 547.428588] ? do_user_addr_fault+0x2ee/0x6b0 +[ 547.438249] ? exc_page_fault+0x83/0x1b0 +[ 547.446949] ? asm_exc_page_fault+0x27/0x30 +[ 547.456225] ? amdgpu_ras_sysfs_badpages_read+0x2f2/0x5d0 [amdgpu] +[ 547.470040] ? mas_wr_modify+0xcd/0x140 +[ 547.478548] sysfs_kf_bin_read+0x63/0xb0 +[ 547.487248] kernfs_file_read_iter+0xa1/0x190 +[ 547.496909] kernfs_fop_read_iter+0x25/0x40 +[ 547.506182] vfs_read+0x255/0x390 + +This also result in space left assigned to negative values. +Moving data alloc call before bad page check resolves both the issue. + +Signed-off-by: Asad Kamal +Suggested-by: Lijo Lazar +Reviewed-by: Hawking Zhang +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +index 9c21401c9b830..6b069dc4bab06 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +@@ -3076,6 +3076,11 @@ static int __amdgpu_ras_restore_bad_pages(struct amdgpu_device *adev, + struct ras_err_handler_data *data = con->eh_data; + + for (j = 0; j < count; j++) { ++ if (!data->space_left && ++ amdgpu_ras_realloc_eh_data_space(adev, data, 256)) { ++ return -ENOMEM; ++ } ++ + if (amdgpu_ras_check_bad_page_unlock(con, + bps[j].retired_page << AMDGPU_GPU_PAGE_SHIFT)) { + data->count++; +@@ -3083,11 +3088,6 @@ static int __amdgpu_ras_restore_bad_pages(struct amdgpu_device *adev, + continue; + } + +- if (!data->space_left && +- amdgpu_ras_realloc_eh_data_space(adev, data, 256)) { +- return -ENOMEM; +- } +- + amdgpu_ras_reserve_page(adev, bps[j].retired_page); + + memcpy(&data->bps[data->count], &(bps[j]), +-- +2.51.0 + diff --git a/queue-6.19/drm-amdgpu-refactor-amdgpu_gem_va_ioctl-for-handling.patch b/queue-6.19/drm-amdgpu-refactor-amdgpu_gem_va_ioctl-for-handling.patch new file mode 100644 index 00000000000..8f18a9dbc44 --- /dev/null +++ b/queue-6.19/drm-amdgpu-refactor-amdgpu_gem_va_ioctl-for-handling.patch @@ -0,0 +1,309 @@ +From 73f68920eff188d272a895fa46a81237a3bf8833 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 21:25:20 +0530 +Subject: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence + Update and Timeline Management v4 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Srinivasan Shanmugam + +[ Upstream commit bd8150a1b3370a9f7761c5814202a3fe5a79f44f ] + +This commit simplifies the amdgpu_gem_va_ioctl function, key updates +include: + - Moved the logic for managing the last update fence directly into + amdgpu_gem_va_update_vm. + - Introduced checks for the timeline point to enable conditional + replacement or addition of fences. + +v2: Addressed review comments from Christian. +v3: Updated comments (Christian). +v4: The previous version selected the fence too early and did not manage its + reference correctly, which could lead to stale or freed fences being used. + This resulted in refcount underflows and could crash when updating GPU + timelines. + The fence is now chosen only after the VA mapping work is completed, and its + reference is taken safely. After exporting it to the VM timeline syncobj, the + driver always drops its local fence reference, ensuring balanced refcounting + and avoiding use-after-free on dma_fence. + + Crash signature: + [ 205.828135] refcount_t: underflow; use-after-free. + [ 205.832963] WARNING: CPU: 30 PID: 7274 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110 + ... + [ 206.074014] Call Trace: + [ 206.076488] + [ 206.078608] amdgpu_gem_va_ioctl+0x6ea/0x740 [amdgpu] + [ 206.084040] ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu] + [ 206.089994] drm_ioctl_kernel+0x86/0xe0 [drm] + [ 206.094415] drm_ioctl+0x26e/0x520 [drm] + [ 206.098424] ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu] + [ 206.104402] amdgpu_drm_ioctl+0x4b/0x80 [amdgpu] + [ 206.109387] __x64_sys_ioctl+0x96/0xe0 + [ 206.113156] do_syscall_64+0x66/0x2d0 + ... + [ 206.553351] BUG: unable to handle page fault for address: ffffffffc0dfde90 + ... + [ 206.553378] RIP: 0010:dma_fence_signal_timestamp_locked+0x39/0xe0 + ... + [ 206.553405] Call Trace: + [ 206.553409] + [ 206.553415] ? __pfx_drm_sched_fence_free_rcu+0x10/0x10 [gpu_sched] + [ 206.553424] dma_fence_signal+0x30/0x60 + [ 206.553427] drm_sched_job_done.isra.0+0x123/0x150 [gpu_sched] + [ 206.553434] dma_fence_signal_timestamp_locked+0x6e/0xe0 + [ 206.553437] dma_fence_signal+0x30/0x60 + [ 206.553441] amdgpu_fence_process+0xd8/0x150 [amdgpu] + [ 206.553854] sdma_v4_0_process_trap_irq+0x97/0xb0 [amdgpu] + [ 206.554353] edac_mce_amd(E) ee1004(E) + [ 206.554270] amdgpu_irq_dispatch+0x150/0x230 [amdgpu] + [ 206.554702] amdgpu_ih_process+0x6a/0x180 [amdgpu] + [ 206.555101] amdgpu_irq_handler+0x23/0x60 [amdgpu] + [ 206.555500] __handle_irq_event_percpu+0x4a/0x1c0 + [ 206.555506] handle_irq_event+0x38/0x80 + [ 206.555509] handle_edge_irq+0x92/0x1e0 + [ 206.555513] __common_interrupt+0x3e/0xb0 + [ 206.555519] common_interrupt+0x80/0xa0 + [ 206.555525] + [ 206.555527] + ... + [ 206.555650] RIP: 0010:dma_fence_signal_timestamp_locked+0x39/0xe0 + ... + [ 206.555667] Kernel panic - not syncing: Fatal exception in interrupt + +Link: https://patchwork.freedesktop.org/patch/654669/ +Cc: Alex Deucher +Cc: Christian König +Suggested-by: Christian König +Signed-off-by: Srinivasan Shanmugam +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 135 ++++++++++++++---------- + 1 file changed, 82 insertions(+), 53 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c +index 5a93cbadc4f44..f30e32fbff99a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c +@@ -112,47 +112,6 @@ amdgpu_gem_update_timeline_node(struct drm_file *filp, + return 0; + } + +-static void +-amdgpu_gem_update_bo_mapping(struct drm_file *filp, +- struct amdgpu_bo_va *bo_va, +- uint32_t operation, +- uint64_t point, +- struct dma_fence *fence, +- struct drm_syncobj *syncobj, +- struct dma_fence_chain *chain) +-{ +- struct amdgpu_bo *bo = bo_va ? bo_va->base.bo : NULL; +- struct amdgpu_fpriv *fpriv = filp->driver_priv; +- struct amdgpu_vm *vm = &fpriv->vm; +- struct dma_fence *last_update; +- +- if (!syncobj) +- return; +- +- /* Find the last update fence */ +- switch (operation) { +- case AMDGPU_VA_OP_MAP: +- case AMDGPU_VA_OP_REPLACE: +- if (bo && (bo->tbo.base.resv == vm->root.bo->tbo.base.resv)) +- last_update = vm->last_update; +- else +- last_update = bo_va->last_pt_update; +- break; +- case AMDGPU_VA_OP_UNMAP: +- case AMDGPU_VA_OP_CLEAR: +- last_update = fence; +- break; +- default: +- return; +- } +- +- /* Add fence to timeline */ +- if (!point) +- drm_syncobj_replace_fence(syncobj, last_update); +- else +- drm_syncobj_add_point(syncobj, chain, last_update, point); +-} +- + static vm_fault_t amdgpu_gem_fault(struct vm_fault *vmf) + { + struct ttm_buffer_object *bo = vmf->vma->vm_private_data; +@@ -761,16 +720,19 @@ amdgpu_gem_va_update_vm(struct amdgpu_device *adev, + struct amdgpu_bo_va *bo_va, + uint32_t operation) + { +- struct dma_fence *fence = dma_fence_get_stub(); ++ struct dma_fence *clear_fence = dma_fence_get_stub(); ++ struct dma_fence *last_update = NULL; + int r; + + if (!amdgpu_vm_ready(vm)) +- return fence; ++ return clear_fence; + +- r = amdgpu_vm_clear_freed(adev, vm, &fence); ++ /* First clear freed BOs and get a fence for that work, if any. */ ++ r = amdgpu_vm_clear_freed(adev, vm, &clear_fence); + if (r) + goto error; + ++ /* For MAP/REPLACE we also need to update the BO mappings. */ + if (operation == AMDGPU_VA_OP_MAP || + operation == AMDGPU_VA_OP_REPLACE) { + r = amdgpu_vm_bo_update(adev, bo_va, false); +@@ -778,13 +740,59 @@ amdgpu_gem_va_update_vm(struct amdgpu_device *adev, + goto error; + } + ++ /* Always update PDEs after we touched the mappings. */ + r = amdgpu_vm_update_pdes(adev, vm, false); ++ if (r) ++ goto error; ++ ++ /* ++ * Decide which fence represents the "last update" for this VM/BO: ++ * ++ * - For MAP/REPLACE we want the PT update fence, which is tracked as ++ * either vm->last_update (for always-valid BOs) or bo_va->last_pt_update ++ * (for per-BO updates). ++ * ++ * - For UNMAP/CLEAR we rely on the fence returned by ++ * amdgpu_vm_clear_freed(), which already covers the page table work ++ * for the removed mappings. ++ */ ++ switch (operation) { ++ case AMDGPU_VA_OP_MAP: ++ case AMDGPU_VA_OP_REPLACE: ++ if (bo_va && bo_va->base.bo) { ++ if (amdgpu_vm_is_bo_always_valid(vm, bo_va->base.bo)) { ++ if (vm->last_update) ++ last_update = dma_fence_get(vm->last_update); ++ } else { ++ if (bo_va->last_pt_update) ++ last_update = dma_fence_get(bo_va->last_pt_update); ++ } ++ } ++ break; ++ case AMDGPU_VA_OP_UNMAP: ++ case AMDGPU_VA_OP_CLEAR: ++ if (clear_fence) ++ last_update = dma_fence_get(clear_fence); ++ break; ++ default: ++ break; ++ } + + error: + if (r && r != -ERESTARTSYS) + DRM_ERROR("Couldn't update BO_VA (%d)\n", r); + +- return fence; ++ /* ++ * If we managed to pick a more specific last-update fence, prefer it ++ * over the generic clear_fence and drop the extra reference to the ++ * latter. ++ */ ++ if (last_update) { ++ dma_fence_put(clear_fence); ++ return last_update; ++ } ++ ++ return clear_fence; + } + + int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data, +@@ -810,6 +818,7 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data, + uint64_t vm_size; + int r = 0; + ++ /* Validate virtual address range against reserved regions. */ + if (args->va_address < AMDGPU_VA_RESERVED_BOTTOM) { + dev_dbg(dev->dev, + "va_address 0x%llx is in reserved area 0x%llx\n", +@@ -843,6 +852,7 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data, + return -EINVAL; + } + ++ /* Validate operation type. */ + switch (args->operation) { + case AMDGPU_VA_OP_MAP: + case AMDGPU_VA_OP_UNMAP: +@@ -866,6 +876,7 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data, + abo = NULL; + } + ++ /* Add input syncobj fences (if any) for synchronization. */ + r = amdgpu_gem_add_input_fence(filp, + args->input_fence_syncobj_handles, + args->num_syncobj_handles); +@@ -888,6 +899,7 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data, + goto error; + } + ++ /* Resolve the BO-VA mapping for this VM/BO combination. */ + if (abo) { + bo_va = amdgpu_vm_bo_find(&fpriv->vm, abo); + if (!bo_va) { +@@ -900,6 +912,11 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data, + bo_va = NULL; + } + ++ /* ++ * Prepare the timeline syncobj node if the user requested a VM ++ * timeline update. This only allocates/looks up the syncobj and ++ * chain node; the actual fence is attached later. ++ */ + r = amdgpu_gem_update_timeline_node(filp, + args->vm_timeline_syncobj_out, + args->vm_timeline_point, +@@ -931,18 +948,30 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data, + default: + break; + } ++ ++ /* ++ * Once the VA operation is done, update the VM and obtain the fence ++ * that represents the last relevant update for this mapping. This ++ * fence can then be exported to the user-visible VM timeline. ++ */ + if (!r && !(args->flags & AMDGPU_VM_DELAY_UPDATE) && !adev->debug_vm) { + fence = amdgpu_gem_va_update_vm(adev, &fpriv->vm, bo_va, + args->operation); + +- if (timeline_syncobj) +- amdgpu_gem_update_bo_mapping(filp, bo_va, +- args->operation, +- args->vm_timeline_point, +- fence, timeline_syncobj, +- timeline_chain); +- else +- dma_fence_put(fence); ++ if (timeline_syncobj && fence) { ++ if (!args->vm_timeline_point) { ++ /* Replace the existing fence when no point is given. */ ++ drm_syncobj_replace_fence(timeline_syncobj, ++ fence); ++ } else { ++ /* Attach the last-update fence at a specific point. */ ++ drm_syncobj_add_point(timeline_syncobj, ++ timeline_chain, ++ fence, ++ args->vm_timeline_point); ++ } ++ } ++ dma_fence_put(fence); + + } + +-- +2.51.0 + diff --git a/queue-6.19/drm-amdgpu-return-when-ras-table-checksum-is-error.patch b/queue-6.19/drm-amdgpu-return-when-ras-table-checksum-is-error.patch new file mode 100644 index 00000000000..edd8edcab4d --- /dev/null +++ b/queue-6.19/drm-amdgpu-return-when-ras-table-checksum-is-error.patch @@ -0,0 +1,41 @@ +From a2f6e8219b703b029661397b81be9c154f0f23da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 17:32:00 +0800 +Subject: drm/amdgpu: return when ras table checksum is error + +From: Gangliang Xie + +[ Upstream commit 044f8d3b1fac6ac89c560f61415000e6bdab3a03 ] + +end the function flow when ras table checksum is error + +Signed-off-by: Gangliang Xie +Reviewed-by: Tao Zhou +Reviewed-by: Kent Russell +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c +index 64dd7a81bff5f..710a8fe79fccd 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c +@@ -1701,10 +1701,12 @@ int amdgpu_ras_eeprom_check(struct amdgpu_ras_eeprom_control *control) + } + + res = __verify_ras_table_checksum(control); +- if (res) ++ if (res) { + dev_err(adev->dev, + "RAS table incorrect checksum or error:%d\n", + res); ++ return -EINVAL; ++ } + + /* Warn if we are at 90% of the threshold or above + */ +-- +2.51.0 + diff --git a/queue-6.19/drm-amdgpu-skip-loading-sdma_rs64-in-vf.patch b/queue-6.19/drm-amdgpu-skip-loading-sdma_rs64-in-vf.patch new file mode 100644 index 00000000000..4d1f4e13dfa --- /dev/null +++ b/queue-6.19/drm-amdgpu-skip-loading-sdma_rs64-in-vf.patch @@ -0,0 +1,35 @@ +From 12df04c69ad4503bf235cfb06c18871cd11e69d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Nov 2025 15:16:27 +0800 +Subject: drm/amdgpu: Skip loading SDMA_RS64 in VF + +From: YuBiao Wang + +[ Upstream commit 39c21b81112321cbe1267b02c77ecd2161ce19aa ] + +VFs use the PF SDMA ucode and are unable to load SDMA_RS64. + +Signed-off-by: YuBiao Wang +Signed-off-by: Victor Skvortsov +Reviewed-by: Gavin Wan +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +index 47a6ce4fdc744..292e2706286a1 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +@@ -1261,6 +1261,7 @@ bool amdgpu_virt_fw_load_skip_check(struct amdgpu_device *adev, uint32_t ucode_i + || ucode_id == AMDGPU_UCODE_ID_SDMA5 + || ucode_id == AMDGPU_UCODE_ID_SDMA6 + || ucode_id == AMDGPU_UCODE_ID_SDMA7 ++ || ucode_id == AMDGPU_UCODE_ID_SDMA_RS64 + || ucode_id == AMDGPU_UCODE_ID_RLC_G + || ucode_id == AMDGPU_UCODE_ID_RLC_RESTORE_LIST_CNTL + || ucode_id == AMDGPU_UCODE_ID_RLC_RESTORE_LIST_GPM_MEM +-- +2.51.0 + diff --git a/queue-6.19/drm-amdgpu-skip-vcn-poison-irq-release-on-vf.patch b/queue-6.19/drm-amdgpu-skip-vcn-poison-irq-release-on-vf.patch new file mode 100644 index 00000000000..7914e45a6ad --- /dev/null +++ b/queue-6.19/drm-amdgpu-skip-vcn-poison-irq-release-on-vf.patch @@ -0,0 +1,60 @@ +From 77c574f7ad641dab57827a3889dfe5eeb7360558 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 12:11:49 +0530 +Subject: drm/amdgpu: Skip vcn poison irq release on VF + +From: Lijo Lazar + +[ Upstream commit 8980be03b3f9a4b58197ef95d3b37efa41a25331 ] + +VF doesn't enable VCN poison irq in VCNv2.5. Skip releasing it and avoid +call trace during deinitialization. + +[ 71.913601] [drm] clean up the vf2pf work item +[ 71.915088] ------------[ cut here ]------------ +[ 71.915092] WARNING: CPU: 3 PID: 1079 at /tmp/amd.aFkFvSQl/amd/amdgpu/amdgpu_irq.c:641 amdgpu_irq_put+0xc6/0xe0 [amdgpu] +[ 71.915355] Modules linked in: amdgpu(OE-) amddrm_ttm_helper(OE) amdttm(OE) amddrm_buddy(OE) amdxcp(OE) amddrm_exec(OE) amd_sched(OE) amdkcl(OE) drm_suballoc_helper drm_display_helper cec rc_core i2c_algo_bit video wmi binfmt_misc nls_iso8859_1 intel_rapl_msr intel_rapl_common input_leds joydev serio_raw mac_hid qemu_fw_cfg sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 hid_generic crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic ghash_clmulni_intel usbhid 8139too sha256_ssse3 sha1_ssse3 hid psmouse bochs i2c_i801 ahci drm_vram_helper libahci i2c_smbus lpc_ich drm_ttm_helper 8139cp mii ttm aesni_intel crypto_simd cryptd +[ 71.915484] CPU: 3 PID: 1079 Comm: rmmod Tainted: G OE 6.8.0-87-generic #88~22.04.1-Ubuntu +[ 71.915489] Hardware name: Red Hat KVM/RHEL, BIOS 1.16.3-2.el9_5.1 04/01/2014 +[ 71.915492] RIP: 0010:amdgpu_irq_put+0xc6/0xe0 [amdgpu] +[ 71.915768] Code: 75 84 b8 ea ff ff ff eb d4 44 89 ea 48 89 de 4c 89 e7 e8 fd fc ff ff 5b 41 5c 41 5d 41 5e 5d 31 d2 31 f6 31 ff e9 55 30 3b c7 <0f> 0b eb d4 b8 fe ff ff ff eb a8 e9 b7 3b 8a 00 66 2e 0f 1f 84 00 +[ 71.915771] RSP: 0018:ffffcf0800eafa30 EFLAGS: 00010246 +[ 71.915775] RAX: 0000000000000000 RBX: ffff891bda4b0668 RCX: 0000000000000000 +[ 71.915777] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 +[ 71.915779] RBP: ffffcf0800eafa50 R08: 0000000000000000 R09: 0000000000000000 +[ 71.915781] R10: 0000000000000000 R11: 0000000000000000 R12: ffff891bda480000 +[ 71.915782] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 +[ 71.915792] FS: 000070cff87c4c40(0000) GS:ffff893abfb80000(0000) knlGS:0000000000000000 +[ 71.915795] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 71.915797] CR2: 00005fa13073e478 CR3: 000000010d634006 CR4: 0000000000770ef0 +[ 71.915800] PKRU: 55555554 +[ 71.915802] Call Trace: +[ 71.915805] +[ 71.915809] vcn_v2_5_hw_fini+0x19e/0x1e0 [amdgpu] + +Signed-off-by: Lijo Lazar +Reviewed-by: Mangesh Gadre +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c +index cebee453871c1..006a154511971 100644 +--- a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c ++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c +@@ -521,7 +521,9 @@ static int vcn_v2_5_hw_fini(struct amdgpu_ip_block *ip_block) + RREG32_SOC15(VCN, i, mmUVD_STATUS))) + vinst->set_pg_state(vinst, AMD_PG_STATE_GATE); + +- if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN)) ++ /* VF doesn't enable interrupt operations for RAS */ ++ if (!amdgpu_sriov_vf(adev) && ++ amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN)) + amdgpu_irq_put(adev, &vinst->ras_poison_irq, 0); + } + +-- +2.51.0 + diff --git a/queue-6.19/drm-amdgpu-validate-user-queue-size-constraints.patch b/queue-6.19/drm-amdgpu-validate-user-queue-size-constraints.patch new file mode 100644 index 00000000000..868dd803f15 --- /dev/null +++ b/queue-6.19/drm-amdgpu-validate-user-queue-size-constraints.patch @@ -0,0 +1,52 @@ +From a21721bd2214370239899c67524ebae4a4b1f2d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 11:35:57 +0800 +Subject: drm/amdgpu: validate user queue size constraints +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jesse.Zhang + +[ Upstream commit 8079b87c02e531cc91601f72ea8336dd2262fdf1 ] + +Add validation to ensure user queue sizes meet hardware requirements: +- Size must be a power of two for efficient ring buffer wrapping +- Size must be at least AMDGPU_GPU_PAGE_SIZE to prevent undersized allocations + +This prevents invalid configurations that could lead to GPU faults or +unexpected behavior. + +Reviewed-by: Christian König +Signed-off-by: Jesse Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c +index 58b26c78b6425..ab934723579c9 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c +@@ -860,6 +860,17 @@ static int amdgpu_userq_input_args_validate(struct drm_device *dev, + drm_file_err(filp, "invalidate userq queue va or size\n"); + return -EINVAL; + } ++ ++ if (!is_power_of_2(args->in.queue_size)) { ++ drm_file_err(filp, "Queue size must be a power of 2\n"); ++ return -EINVAL; ++ } ++ ++ if (args->in.queue_size < AMDGPU_GPU_PAGE_SIZE) { ++ drm_file_err(filp, "Queue size smaller than AMDGPU_GPU_PAGE_SIZE\n"); ++ return -EINVAL; ++ } ++ + if (!args->in.wptr_va || !args->in.rptr_va) { + drm_file_err(filp, "invalidate userq queue rptr or wptr\n"); + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.19/drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch b/queue-6.19/drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch new file mode 100644 index 00000000000..40c939fedd0 --- /dev/null +++ b/queue-6.19/drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch @@ -0,0 +1,51 @@ +From e9e9cf2760db5f7ca830ad6baf7bf5a8885a4a25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 19:36:56 +0530 +Subject: drm/amdkfd: Fix GART PTE for non-4K pagesize in + svm_migrate_gart_map() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Donet Tom + +[ Upstream commit 6c160001661b6c4e20f5c31909c722741e14c2d8 ] + +In svm_migrate_gart_map(), while migrating GART mapping, the number of +bytes copied for the GART table only accounts for CPU pages. On non-4K +systems, each CPU page can contain multiple GPU pages, and the GART +requires one 8-byte PTE per GPU page. As a result, an incorrect size was +passed to the DMA, causing only a partial update of the GART table. + +Fix this function to work correctly on non-4K page-size systems by +accounting for the number of GPU pages per CPU page when calculating the +number of bytes to be copied. + +Acked-by: Christian König +Reviewed-by: Philip Yang +Signed-off-by: Ritesh Harjani (IBM) +Signed-off-by: Donet Tom +Signed-off-by: Felix Kuehling +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +index 6ada7b4af7c68..5086caac3fd06 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +@@ -61,7 +61,7 @@ svm_migrate_gart_map(struct amdgpu_ring *ring, u64 npages, + *gart_addr = adev->gmc.gart_start; + + num_dw = ALIGN(adev->mman.buffer_funcs->copy_num_dw, 8); +- num_bytes = npages * 8; ++ num_bytes = npages * 8 * AMDGPU_GPU_PAGES_IN_CPU_PAGE; + + r = amdgpu_job_alloc_with_ib(adev, &adev->mman.high_pr, + AMDGPU_FENCE_OWNER_UNDEFINED, +-- +2.51.0 + diff --git a/queue-6.19/drm-amdkfd-handle-gpu-reset-and-drain-retry-fault-ra.patch b/queue-6.19/drm-amdkfd-handle-gpu-reset-and-drain-retry-fault-ra.patch new file mode 100644 index 00000000000..4d73a2d6c9e --- /dev/null +++ b/queue-6.19/drm-amdkfd-handle-gpu-reset-and-drain-retry-fault-ra.patch @@ -0,0 +1,63 @@ +From 5e42b91d91eab91dc61b1cdc67527cc6d65f005a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 16:32:45 -0500 +Subject: drm/amdkfd: Handle GPU reset and drain retry fault race + +From: Philip Yang + +[ Upstream commit 5b57c3c3f22336e8fd5edb7f0fef3c7823f8eac1 ] + +Only check and drain IH1 ring if CAM is not enabled. + +If GPU is under reset, don't access IH to drain retry fault. + +Signed-off-by: Philip Yang +Reviewed-by: Harish Kasiviswanathan +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +index 79ea138897fcf..a10cf8650c92b 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +@@ -33,6 +33,7 @@ + #include "amdgpu_hmm.h" + #include "amdgpu.h" + #include "amdgpu_xgmi.h" ++#include "amdgpu_reset.h" + #include "kfd_priv.h" + #include "kfd_svm.h" + #include "kfd_migrate.h" +@@ -2349,6 +2350,9 @@ static void svm_range_drain_retry_fault(struct svm_range_list *svms) + + pr_debug("drain retry fault gpu %d svms %p\n", i, svms); + ++ if (!down_read_trylock(&pdd->dev->adev->reset_domain->sem)) ++ continue; ++ + amdgpu_ih_wait_on_checkpoint_process_ts(pdd->dev->adev, + pdd->dev->adev->irq.retry_cam_enabled ? + &pdd->dev->adev->irq.ih : +@@ -2358,6 +2362,7 @@ static void svm_range_drain_retry_fault(struct svm_range_list *svms) + amdgpu_ih_wait_on_checkpoint_process_ts(pdd->dev->adev, + &pdd->dev->adev->irq.ih_soft); + ++ up_read(&pdd->dev->adev->reset_domain->sem); + + pr_debug("drain retry fault gpu %d svms 0x%p done\n", i, svms); + } +@@ -2541,7 +2546,7 @@ svm_range_unmap_from_cpu(struct mm_struct *mm, struct svm_range *prange, + adev = pdd->dev->adev; + + /* Check and drain ih1 ring if cam not available */ +- if (adev->irq.ih1.ring_size) { ++ if (!adev->irq.retry_cam_enabled && adev->irq.ih1.ring_size) { + ih = &adev->irq.ih1; + checkpoint_wptr = amdgpu_ih_get_wptr(adev, ih); + if (ih->rptr != checkpoint_wptr) { +-- +2.51.0 + diff --git a/queue-6.19/drm-amdkfd-relax-size-checking-during-queue-buffer-g.patch b/queue-6.19/drm-amdkfd-relax-size-checking-during-queue-buffer-g.patch new file mode 100644 index 00000000000..e2aeb4d9461 --- /dev/null +++ b/queue-6.19/drm-amdkfd-relax-size-checking-during-queue-buffer-g.patch @@ -0,0 +1,61 @@ +From e982a7e5e041ee0301579fef00a21a7e5e1f44ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 19:36:54 +0530 +Subject: drm/amdkfd: Relax size checking during queue buffer get +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Donet Tom + +[ Upstream commit 42ea9cf2f16b7131cb7302acb3dac510968f8bdc ] + +HW-supported EOP buffer sizes are 4K and 32K. On systems that do not +use 4K pages, the minimum buffer object (BO) allocation size is +PAGE_SIZE (for example, 64K). During queue buffer acquisition, the driver +currently checks the allocated BO size against the supported EOP buffer +size. Since the allocated BO is larger than the expected size, this check +fails, preventing queue creation. + +Relax the strict size validation and allow PAGE_SIZE-sized BOs to be used. +Only the required 4K region of the buffer will be used as the EOP buffer +and avoids queue creation failures on non-4K page systems. + +Acked-by: Christian König +Suggested-by: Philip Yang +Signed-off-by: Donet Tom +Signed-off-by: Felix Kuehling +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c +index 80c4fa2b0975d..2822c90bd7be4 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c +@@ -275,8 +275,8 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope + + /* EOP buffer is not required for all ASICs */ + if (properties->eop_ring_buffer_address) { +- if (properties->eop_ring_buffer_size != topo_dev->node_props.eop_buffer_size) { +- pr_debug("queue eop bo size 0x%x not equal to node eop buf size 0x%x\n", ++ if (properties->eop_ring_buffer_size < topo_dev->node_props.eop_buffer_size) { ++ pr_debug("queue eop bo size 0x%x is less than node eop buf size 0x%x\n", + properties->eop_ring_buffer_size, + topo_dev->node_props.eop_buffer_size); + err = -EINVAL; +@@ -284,7 +284,7 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope + } + err = kfd_queue_buffer_get(vm, (void *)properties->eop_ring_buffer_address, + &properties->eop_buf_bo, +- properties->eop_ring_buffer_size); ++ ALIGN(properties->eop_ring_buffer_size, PAGE_SIZE)); + if (err) + goto out_err_unreserve; + } +-- +2.51.0 + diff --git a/queue-6.19/drm-ast-swap-framebuffer-writes-on-big-endian-machin.patch b/queue-6.19/drm-ast-swap-framebuffer-writes-on-big-endian-machin.patch new file mode 100644 index 00000000000..6b1573d6db3 --- /dev/null +++ b/queue-6.19/drm-ast-swap-framebuffer-writes-on-big-endian-machin.patch @@ -0,0 +1,95 @@ +From 6a161b5aea0f137a604e04f7c043803fd68d0906 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Dec 2025 21:05:04 +0100 +Subject: drm/ast: Swap framebuffer writes on big-endian machines +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: René Rebe + +[ Upstream commit 50c26c301c5176cc8b431044390e10ec862b9b77 ] + +Swap the pixel data when writing to framebuffer memory on big-endian +machines. Fixes incorrect output. Aspeed graphics does not appear to +support big-endian framebuffers after AST2400, although the feature +has been documented. + +There's a lengthy discussion at [1]. + +v5: +- avoid restricted cast from __be16 (kernel test robot) + +Signed-off-by: René Rebe +Link: https://lore.kernel.org/dri-devel/20251202.170626.2134482663677806825.rene@exactco.de/ # [1] +Reviewed-by: Thomas Zimmermann +Signed-off-by: Thomas Zimmermann +Link: https://patch.msgid.link/20251212.210504.1355099120650239629.rene@exactco.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ast/ast_cursor.c | 11 ++++++++--- + drivers/gpu/drm/ast/ast_mode.c | 11 +++++++++-- + 2 files changed, 17 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/ast/ast_cursor.c b/drivers/gpu/drm/ast/ast_cursor.c +index 2d3ad7610c2e9..7da0a2d463e6c 100644 +--- a/drivers/gpu/drm/ast/ast_cursor.c ++++ b/drivers/gpu/drm/ast/ast_cursor.c +@@ -92,12 +92,17 @@ static void ast_set_cursor_image(struct ast_device *ast, const u8 *src, + unsigned int width, unsigned int height) + { + u8 __iomem *dst = ast_plane_vaddr(&ast->cursor_plane.base); +- u32 csum; +- +- csum = ast_cursor_calculate_checksum(src, width, height); ++ u32 csum = ast_cursor_calculate_checksum(src, width, height); + + /* write pixel data */ ++#if defined(__BIG_ENDIAN) ++ unsigned int i; ++ ++ for (i = 0; i < AST_HWC_SIZE; i += 2) ++ writew(swab16(*(const __u16 *)&src[i]), &dst[i]); ++#else + memcpy_toio(dst, src, AST_HWC_SIZE); ++#endif + + /* write checksum + signature */ + dst += AST_HWC_SIZE; +diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c +index cd08990a10f93..57c6fbc3232b0 100644 +--- a/drivers/gpu/drm/ast/ast_mode.c ++++ b/drivers/gpu/drm/ast/ast_mode.c +@@ -526,12 +526,18 @@ static int ast_primary_plane_helper_atomic_check(struct drm_plane *plane, + + static void ast_handle_damage(struct ast_plane *ast_plane, struct iosys_map *src, + struct drm_framebuffer *fb, +- const struct drm_rect *clip) ++ const struct drm_rect *clip, ++ struct drm_format_conv_state *fmtcnv_state) + { + struct iosys_map dst = IOSYS_MAP_INIT_VADDR_IOMEM(ast_plane_vaddr(ast_plane)); + + iosys_map_incr(&dst, drm_fb_clip_offset(fb->pitches[0], fb->format, clip)); ++ ++#if defined(__BIG_ENDIAN) ++ drm_fb_swab(&dst, fb->pitches, src, fb, clip, !src[0].is_iomem, fmtcnv_state); ++#else + drm_fb_memcpy(&dst, fb->pitches, src, fb, clip); ++#endif + } + + static void ast_primary_plane_helper_atomic_update(struct drm_plane *plane, +@@ -561,7 +567,8 @@ static void ast_primary_plane_helper_atomic_update(struct drm_plane *plane, + if (drm_gem_fb_begin_cpu_access(fb, DMA_FROM_DEVICE) == 0) { + drm_atomic_helper_damage_iter_init(&iter, old_plane_state, plane_state); + drm_atomic_for_each_plane_damage(&iter, &damage) { +- ast_handle_damage(ast_plane, shadow_plane_state->data, fb, &damage); ++ ast_handle_damage(ast_plane, shadow_plane_state->data, fb, &damage, ++ &shadow_plane_state->fmtcnv_state); + } + + drm_gem_fb_end_cpu_access(fb, DMA_FROM_DEVICE); +-- +2.51.0 + diff --git a/queue-6.19/drm-atmel-hlcdc-destroy-properly-the-plane-state-in-.patch b/queue-6.19/drm-atmel-hlcdc-destroy-properly-the-plane-state-in-.patch new file mode 100644 index 00000000000..a41d09d5609 --- /dev/null +++ b/queue-6.19/drm-atmel-hlcdc-destroy-properly-the-plane-state-in-.patch @@ -0,0 +1,96 @@ +From 8a8aec063324a4fb4ade739692077dcf3d3cec68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Dec 2025 14:26:06 +0100 +Subject: drm/atmel-hlcdc: destroy properly the plane state in the reset + callback + +From: Ludovic Desroches + +[ Upstream commit 81af99cbd9e4f238011af811d544fff75641fc25 ] + +If there is a plane state to destroy when doing a plane reset, destroy +it using the atmel_hlcdc_plane_destroy_state() function. So we call +__drm_atomic_helper_plane_destroy_state() and avoid code duplication. + +Signed-off-by: Ludovic Desroches +Reviewed-by: Manikandan Muralidharan +Link: https://patch.msgid.link/20251218-lcd_cleanup_mainline-v2-8-df837aba878f@microchip.com +Signed-off-by: Manikandan Muralidharan +Signed-off-by: Sasha Levin +--- + .../gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 52 +++++++++---------- + 1 file changed, 26 insertions(+), 26 deletions(-) + +diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +index 92132be9823f1..0ffec44c6d317 100644 +--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c ++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +@@ -1155,32 +1155,6 @@ static int atmel_hlcdc_plane_alloc_dscrs(struct drm_plane *p, + return -ENOMEM; + } + +-static void atmel_hlcdc_plane_reset(struct drm_plane *p) +-{ +- struct atmel_hlcdc_plane_state *state; +- +- if (p->state) { +- state = drm_plane_state_to_atmel_hlcdc_plane_state(p->state); +- +- if (state->base.fb) +- drm_framebuffer_put(state->base.fb); +- +- kfree(state); +- p->state = NULL; +- } +- +- state = kzalloc(sizeof(*state), GFP_KERNEL); +- if (state) { +- if (atmel_hlcdc_plane_alloc_dscrs(p, state)) { +- kfree(state); +- drm_err(p->dev, +- "Failed to allocate initial plane state\n"); +- return; +- } +- __drm_atomic_helper_plane_reset(p, &state->base); +- } +-} +- + static struct drm_plane_state * + atmel_hlcdc_plane_atomic_duplicate_state(struct drm_plane *p) + { +@@ -1222,6 +1196,32 @@ static void atmel_hlcdc_plane_atomic_destroy_state(struct drm_plane *p, + kfree(state); + } + ++static void atmel_hlcdc_plane_reset(struct drm_plane *p) ++{ ++ struct atmel_hlcdc_plane_state *state; ++ struct atmel_hlcdc_dc *dc = p->dev->dev_private; ++ struct atmel_hlcdc_plane *plane = drm_plane_to_atmel_hlcdc_plane(p); ++ ++ if (p->state) { ++ atmel_hlcdc_plane_atomic_destroy_state(p, p->state); ++ p->state = NULL; ++ } ++ ++ state = kzalloc(sizeof(*state), GFP_KERNEL); ++ if (state) { ++ if (atmel_hlcdc_plane_alloc_dscrs(p, state)) { ++ kfree(state); ++ drm_err(p->dev, ++ "Failed to allocate initial plane state\n"); ++ return; ++ } ++ __drm_atomic_helper_plane_reset(p, &state->base); ++ } ++ ++ if (plane->layer.desc->layout.csc) ++ dc->desc->ops->lcdc_csc_init(plane, plane->layer.desc); ++} ++ + static const struct drm_plane_funcs layer_plane_funcs = { + .update_plane = drm_atomic_helper_update_plane, + .disable_plane = drm_atomic_helper_disable_plane, +-- +2.51.0 + diff --git a/queue-6.19/drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch b/queue-6.19/drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch new file mode 100644 index 00000000000..fd73ff4b078 --- /dev/null +++ b/queue-6.19/drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch @@ -0,0 +1,73 @@ +From 81bb504e8dd4a40f5c5b8c9a5e41493c6deaaf94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Nov 2025 11:38:25 +0100 +Subject: drm/atmel-hlcdc: don't reject the commit if the src rect has + fractional parts +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ludovic Desroches + +[ Upstream commit 06682206e2a1883354ed758c09efeb51f435adbd ] + +Don’t reject the commit when the source rectangle has fractional parts. +This can occur due to scaling: drm_atomic_helper_check_plane_state() calls +drm_rect_clip_scaled(), which may introduce fractional parts while +computing the clipped source rectangle. This does not imply the commit is +invalid, so we should accept it instead of discarding it. + +Signed-off-by: Ludovic Desroches +Reviewed-by: Manikandan Muralidharan +Link: https://patch.msgid.link/20251120-lcd_scaling_fix-v1-1-5ffc98557923@microchip.com +Signed-off-by: Manikandan Muralidharan +Signed-off-by: Sasha Levin +--- + .../gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 19 ++++--------------- + 1 file changed, 4 insertions(+), 15 deletions(-) + +diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +index c0075894dc422..ec1fb5f9549a2 100644 +--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c ++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +@@ -79,8 +79,6 @@ drm_plane_state_to_atmel_hlcdc_plane_state(struct drm_plane_state *s) + return container_of(s, struct atmel_hlcdc_plane_state, base); + } + +-#define SUBPIXEL_MASK 0xffff +- + static uint32_t rgb_formats[] = { + DRM_FORMAT_C8, + DRM_FORMAT_XRGB4444, +@@ -745,24 +743,15 @@ static int atmel_hlcdc_plane_atomic_check(struct drm_plane *p, + if (ret || !s->visible) + return ret; + +- hstate->src_x = s->src.x1; +- hstate->src_y = s->src.y1; +- hstate->src_w = drm_rect_width(&s->src); +- hstate->src_h = drm_rect_height(&s->src); ++ hstate->src_x = s->src.x1 >> 16; ++ hstate->src_y = s->src.y1 >> 16; ++ hstate->src_w = drm_rect_width(&s->src) >> 16; ++ hstate->src_h = drm_rect_height(&s->src) >> 16; + hstate->crtc_x = s->dst.x1; + hstate->crtc_y = s->dst.y1; + hstate->crtc_w = drm_rect_width(&s->dst); + hstate->crtc_h = drm_rect_height(&s->dst); + +- if ((hstate->src_x | hstate->src_y | hstate->src_w | hstate->src_h) & +- SUBPIXEL_MASK) +- return -EINVAL; +- +- hstate->src_x >>= 16; +- hstate->src_y >>= 16; +- hstate->src_w >>= 16; +- hstate->src_h >>= 16; +- + hstate->nplanes = fb->format->num_planes; + if (hstate->nplanes > ATMEL_HLCDC_LAYER_MAX_PLANES) + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.19/drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch b/queue-6.19/drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch new file mode 100644 index 00000000000..dcc681c030c --- /dev/null +++ b/queue-6.19/drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch @@ -0,0 +1,61 @@ +From 129967d9e50eb5d5cc723589bcf3dff034569f42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Oct 2025 18:14:52 +0200 +Subject: drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state + callback + +From: Ludovic Desroches + +[ Upstream commit f12352471061df83a36edf54bbb16284793284e4 ] + +After several commits, the slab memory increases. Some drm_crtc_commit +objects are not freed. The atomic_destroy_state callback only put the +framebuffer. Use the __drm_atomic_helper_plane_destroy_state() function +to put all the objects that are no longer needed. + +It has been seen after hours of usage of a graphics application or using +kmemleak: + +unreferenced object 0xc63a6580 (size 64): + comm "egt_basic", pid 171, jiffies 4294940784 + hex dump (first 32 bytes): + 40 50 34 c5 01 00 00 00 ff ff ff ff 8c 65 3a c6 @P4..........e:. + 8c 65 3a c6 ff ff ff ff 98 65 3a c6 98 65 3a c6 .e:......e:..e:. + backtrace (crc c25aa925): + kmemleak_alloc+0x34/0x3c + __kmalloc_cache_noprof+0x150/0x1a4 + drm_atomic_helper_setup_commit+0x1e8/0x7bc + drm_atomic_helper_commit+0x3c/0x15c + drm_atomic_commit+0xc0/0xf4 + drm_atomic_helper_set_config+0x84/0xb8 + drm_mode_setcrtc+0x32c/0x810 + drm_ioctl+0x20c/0x488 + sys_ioctl+0x14c/0xc20 + ret_fast_syscall+0x0/0x54 + +Signed-off-by: Ludovic Desroches +Reviewed-by: Manikandan Muralidharan +Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-1-79b615130dc3@microchip.com +Signed-off-by: Manikandan Muralidharan +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +index 0ffec44c6d317..c0075894dc422 100644 +--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c ++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +@@ -1190,8 +1190,7 @@ static void atmel_hlcdc_plane_atomic_destroy_state(struct drm_plane *p, + state->dscrs[i]->self); + } + +- if (s->fb) +- drm_framebuffer_put(s->fb); ++ __drm_atomic_helper_plane_destroy_state(s); + + kfree(state); + } +-- +2.51.0 + diff --git a/queue-6.19/drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch b/queue-6.19/drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch new file mode 100644 index 00000000000..c75d8c62cf1 --- /dev/null +++ b/queue-6.19/drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch @@ -0,0 +1,81 @@ +From f50291ff8477842a40ae53a8ebe14e8d9aff2747 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Oct 2025 18:14:53 +0200 +Subject: drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release + +From: Ludovic Desroches + +[ Upstream commit bc847787233277a337788568e90a6ee1557595eb ] + +The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying +the atmel_hlcdc_plane state structure without properly duplicating the +drm_plane_state. In particular, state->commit remained set to the old +state commit, which can lead to a use-after-free in the next +drm_atomic_commit() call. + +Fix this by calling +__drm_atomic_helper_duplicate_plane_state(), which correctly clones +the base drm_plane_state (including the ->commit pointer). + +It has been seen when closing and re-opening the device node while +another DRM client (e.g. fbdev) is still attached: + +============================================================================= +BUG kmalloc-64 (Not tainted): Poison overwritten +----------------------------------------------------------------------------- + +0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b +FIX kmalloc-64: Restoring Poison 0xc611b344-0xc611b344=0x6b +Allocated in drm_atomic_helper_setup_commit+0x1e8/0x7bc age=178 cpu=0 +pid=29 + drm_atomic_helper_setup_commit+0x1e8/0x7bc + drm_atomic_helper_commit+0x3c/0x15c + drm_atomic_commit+0xc0/0xf4 + drm_framebuffer_remove+0x4cc/0x5a8 + drm_mode_rmfb_work_fn+0x6c/0x80 + process_one_work+0x12c/0x2cc + worker_thread+0x2a8/0x400 + kthread+0xc0/0xdc + ret_from_fork+0x14/0x28 +Freed in drm_atomic_helper_commit_hw_done+0x100/0x150 age=8 cpu=0 +pid=169 + drm_atomic_helper_commit_hw_done+0x100/0x150 + drm_atomic_helper_commit_tail+0x64/0x8c + commit_tail+0x168/0x18c + drm_atomic_helper_commit+0x138/0x15c + drm_atomic_commit+0xc0/0xf4 + drm_atomic_helper_set_config+0x84/0xb8 + drm_mode_setcrtc+0x32c/0x810 + drm_ioctl+0x20c/0x488 + sys_ioctl+0x14c/0xc20 + ret_fast_syscall+0x0/0x54 +Slab 0xef8bc360 objects=21 used=16 fp=0xc611b7c0 +flags=0x200(workingset|zone=0) +Object 0xc611b340 @offset=832 fp=0xc611b7c0 + +Signed-off-by: Ludovic Desroches +Reviewed-by: Manikandan Muralidharan +Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-2-79b615130dc3@microchip.com +Signed-off-by: Manikandan Muralidharan +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +index ec1fb5f9549a2..e55e88d44e829 100644 +--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c ++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +@@ -1160,8 +1160,7 @@ atmel_hlcdc_plane_atomic_duplicate_state(struct drm_plane *p) + return NULL; + } + +- if (copy->base.fb) +- drm_framebuffer_get(copy->base.fb); ++ __drm_atomic_helper_plane_duplicate_state(p, ©->base); + + return ©->base; + } +-- +2.51.0 + diff --git a/queue-6.19/drm-panel-edp-add-auo-b140qax01.h-panel.patch b/queue-6.19/drm-panel-edp-add-auo-b140qax01.h-panel.patch new file mode 100644 index 00000000000..80ca3843a2a --- /dev/null +++ b/queue-6.19/drm-panel-edp-add-auo-b140qax01.h-panel.patch @@ -0,0 +1,52 @@ +From dbb8a61a5d2d415631c92aee94b9b5abeba6838a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Dec 2025 14:37:28 -0300 +Subject: drm/panel-edp: Add AUO B140QAX01.H panel + +From: Val Packett + +[ Upstream commit bcd752c706c357229185a330ab450b86236d9031 ] + +A 14-inch 2560x1600 60Hz matte touch panel, found on a Dell Latitude 7455 +laptop (second-source with BOE NE14QDM), according to online sources it's +also found on the Latitude 7440 and some ASUS models. + +Raw EDID dump: + +00 ff ff ff ff ff ff 00 06 af a4 0b 00 00 00 00 +00 20 01 04 a5 1e 13 78 03 ad f5 a8 54 47 9c 24 +0e 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 +01 01 01 01 01 01 f0 68 00 a0 a0 40 2e 60 30 20 +35 00 2d bc 10 00 00 1a f3 53 00 a0 a0 40 2e 60 +30 20 35 00 2d bc 10 00 00 1a 00 00 00 fe 00 36 +39 52 31 57 80 42 31 34 30 51 41 58 00 00 00 00 +00 02 41 21 a8 00 01 00 00 1a 41 0a 20 20 00 a1 + +Don't have datasheet access, but the same timing as for other panels from +the same manufacturer works fine. + +Signed-off-by: Val Packett +[dianders: Moved to the right location in the table] +Reviewed-by: Douglas Anderson +Signed-off-by: Douglas Anderson +Link: https://patch.msgid.link/20251206173739.2222940-1-val@packett.cool +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-edp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c +index 2c35970377431..85dd3f4cb8e1c 100644 +--- a/drivers/gpu/drm/panel/panel-edp.c ++++ b/drivers/gpu/drm/panel/panel-edp.c +@@ -1880,6 +1880,7 @@ static const struct panel_delay delay_80_500_e50_d50 = { + */ + static const struct edp_panel_entry edp_panels[] = { + EDP_PANEL_ENTRY('A', 'U', 'O', 0x04a4, &delay_200_500_e50, "B122UAN01.0"), ++ EDP_PANEL_ENTRY('A', 'U', 'O', 0x0ba4, &delay_200_500_e50, "B140QAX01.H"), + EDP_PANEL_ENTRY('A', 'U', 'O', 0x105c, &delay_200_500_e50, "B116XTN01.0"), + EDP_PANEL_ENTRY('A', 'U', 'O', 0x1062, &delay_200_500_e50, "B120XAN01.0"), + EDP_PANEL_ENTRY('A', 'U', 'O', 0x125c, &delay_200_500_e50, "Unknown"), +-- +2.51.0 + diff --git a/queue-6.19/drm-panel-edp-add-boe-nv140wum-t08-panel.patch b/queue-6.19/drm-panel-edp-add-boe-nv140wum-t08-panel.patch new file mode 100644 index 00000000000..458dd95982d --- /dev/null +++ b/queue-6.19/drm-panel-edp-add-boe-nv140wum-t08-panel.patch @@ -0,0 +1,60 @@ +From 2988d06c656392d7901b5648f8d43dd6c3f5ee09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 16:51:34 +0100 +Subject: drm/panel: edp: add BOE NV140WUM-T08 panel + +From: Hans de Goede + +[ Upstream commit 349d4efadc1f831ebc0b872ba1e3a2b7dd58b72b ] + +Add powerseq timing info for the BOE NV140WUM-T08 panel used on Lenovo +Thinkpad T14s gen 6 (Snapdragon X1 Elite) laptops. + +edid-decode (hex): + +00 ff ff ff ff ff ff 00 09 e5 26 0c 00 00 00 00 +0a 21 01 04 a5 1e 13 78 03 d6 62 99 5e 5a 8e 27 +25 53 58 00 00 00 01 01 01 01 01 01 01 01 01 01 +01 01 01 01 01 01 33 3f 80 dc 70 b0 3c 40 30 20 +36 00 2e bc 10 00 00 1a 00 00 00 fd 00 28 3c 4c +4c 10 01 0a 20 20 20 20 20 20 00 00 00 fe 00 42 +4f 45 20 43 51 0a 20 20 20 20 20 20 00 00 00 fe +00 4e 56 31 34 30 57 55 4d 2d 54 30 38 0a 00 fa + +Signed-off-by: Hans de Goede +Reviewed-by: Douglas Anderson +Signed-off-by: Douglas Anderson +Link: https://patch.msgid.link/20260105155134.83266-1-johannes.goede@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-edp.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c +index 85dd3f4cb8e1c..679f4af5246d8 100644 +--- a/drivers/gpu/drm/panel/panel-edp.c ++++ b/drivers/gpu/drm/panel/panel-edp.c +@@ -1730,6 +1730,12 @@ static const struct panel_delay delay_200_500_p2e100 = { + .prepare_to_enable = 100, + }; + ++static const struct panel_delay delay_200_500_p2e200 = { ++ .hpd_absent = 200, ++ .unprepare = 500, ++ .prepare_to_enable = 200, ++}; ++ + static const struct panel_delay delay_200_500_e50 = { + .hpd_absent = 200, + .unprepare = 500, +@@ -1977,6 +1983,7 @@ static const struct edp_panel_entry edp_panels[] = { + EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b56, &delay_200_500_e80, "NT140FHM-N47"), + EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b66, &delay_200_500_e80, "NE140WUM-N6G"), + EDP_PANEL_ENTRY('B', 'O', 'E', 0x0c20, &delay_200_500_e80, "NT140FHM-N47"), ++ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0c26, &delay_200_500_p2e200, "NV140WUM-T08"), + EDP_PANEL_ENTRY('B', 'O', 'E', 0x0c93, &delay_200_500_e200, "Unknown"), + EDP_PANEL_ENTRY('B', 'O', 'E', 0x0cb6, &delay_200_500_e200, "NT116WHM-N44"), + EDP_PANEL_ENTRY('B', 'O', 'E', 0x0cf2, &delay_200_500_e200, "NV156FHM-N4S"), +-- +2.51.0 + diff --git a/queue-6.19/drm-panel-edp-add-csw-mne007qb3-1.patch b/queue-6.19/drm-panel-edp-add-csw-mne007qb3-1.patch new file mode 100644 index 00000000000..d9605c2d0ac --- /dev/null +++ b/queue-6.19/drm-panel-edp-add-csw-mne007qb3-1.patch @@ -0,0 +1,53 @@ +From 602b6923533913bca7dde192a39876901ef36f71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Nov 2025 20:16:01 +0800 +Subject: drm/panel-edp: Add CSW MNE007QB3-1 + +From: Langyan Ye + +[ Upstream commit b1ea3babb67dcb8b0881c2ab49dfba88b1445856 ] + +Add support for the CSW MNE007QB3-1, pleace the EDID here for +subsequent reference. + +00 ff ff ff ff ff ff 00 0e 77 7c 14 00 00 00 00 +00 23 01 04 a5 1e 13 78 07 ee 95 a3 54 4c 99 26 +0f 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 +01 01 01 01 01 01 35 3c 80 a0 70 b0 23 40 30 20 +36 00 2d bc 10 00 00 18 2b 30 80 a0 70 b0 23 40 +30 20 36 00 2d bc 10 00 00 18 00 00 00 fd 00 28 +3c 4a 4a 0f 01 0a 20 20 20 20 20 20 00 00 00 fc +00 4d 4e 45 30 30 37 51 42 33 2d 31 0a 20 01 5b + +70 20 79 02 00 21 00 1d c8 0b 5d 07 80 07 b0 04 +00 3d 8a 54 cd a4 99 66 62 0f 02 45 54 40 5e 40 +5e 00 44 12 78 2e 00 06 00 44 40 5e 40 5e 81 00 +20 74 1a 00 00 03 01 28 3c 00 00 00 00 00 00 3c +00 00 00 00 8d 00 e3 05 04 00 e6 06 01 00 60 60 +ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 90 + +Signed-off-by: Langyan Ye +Signed-off-by: Douglas Anderson +Link: https://patch.msgid.link/20251127121601.1608379-1-yelangyan@huaqin.corp-partner.google.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-edp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c +index 415b894890ad7..023fbbb10eb4f 100644 +--- a/drivers/gpu/drm/panel/panel-edp.c ++++ b/drivers/gpu/drm/panel/panel-edp.c +@@ -2033,6 +2033,7 @@ static const struct edp_panel_entry edp_panels[] = { + EDP_PANEL_ENTRY('C', 'S', 'W', 0x1462, &delay_200_500_e50, "MNE007QS5-2"), + EDP_PANEL_ENTRY('C', 'S', 'W', 0x1468, &delay_200_500_e50, "MNE007QB2-2"), + EDP_PANEL_ENTRY('C', 'S', 'W', 0x146e, &delay_80_500_e50_d50, "MNE007QB3-1"), ++ EDP_PANEL_ENTRY('C', 'S', 'W', 0x147c, &delay_200_500_e50_d100, "MNE007QB3-1"), + EDP_PANEL_ENTRY('C', 'S', 'W', 0x1519, &delay_200_500_e80_d50, "MNF601BS1-3"), + + EDP_PANEL_ENTRY('E', 'T', 'C', 0x0000, &delay_50_500_e200_d200_po2e335, "LP079QX1-SP0V"), +-- +2.51.0 + diff --git a/queue-6.19/drm-panel-fix-a-possible-null-pointer-dereference-in.patch b/queue-6.19/drm-panel-fix-a-possible-null-pointer-dereference-in.patch new file mode 100644 index 00000000000..dcfa1ffc41e --- /dev/null +++ b/queue-6.19/drm-panel-fix-a-possible-null-pointer-dereference-in.patch @@ -0,0 +1,58 @@ +From e62deb8ede4023a2f4b959b2475e6e4e61aae800 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Dec 2025 20:09:55 +0800 +Subject: drm/panel: Fix a possible null-pointer dereference in + jdi_panel_dsi_remove() + +From: Tuo Li + +[ Upstream commit 95eed73b871111123a8b1d31cb1fce7e902e49ea ] + +In jdi_panel_dsi_remove(), jdi is explicitly checked, indicating that it +may be NULL: + + if (!jdi) + mipi_dsi_detach(dsi); + +However, when jdi is NULL, the function does not return and continues by +calling jdi_panel_disable(): + + err = jdi_panel_disable(&jdi->base); + +Inside jdi_panel_disable(), jdi is dereferenced unconditionally, which can +lead to a NULL-pointer dereference: + + struct jdi_panel *jdi = to_panel_jdi(panel); + backlight_disable(jdi->backlight); + +To prevent such a potential NULL-pointer dereference, return early from +jdi_panel_dsi_remove() when jdi is NULL. + +Signed-off-by: Tuo Li +Reviewed-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://patch.msgid.link/20251218120955.11185-1-islituo@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c b/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c +index 23462065d726b..ea975170fafff 100644 +--- a/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c ++++ b/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c +@@ -434,8 +434,10 @@ static void jdi_panel_dsi_remove(struct mipi_dsi_device *dsi) + int err; + + /* only detach from host for the DSI-LINK2 interface */ +- if (!jdi) ++ if (!jdi) { + mipi_dsi_detach(dsi); ++ return; ++ } + + err = jdi_panel_disable(&jdi->base); + if (err < 0) +-- +2.51.0 + diff --git a/queue-6.19/drm-panthor-always-wait-after-sending-a-command-to-a.patch b/queue-6.19/drm-panthor-always-wait-after-sending-a-command-to-a.patch new file mode 100644 index 00000000000..c965bf6afdc --- /dev/null +++ b/queue-6.19/drm-panthor-always-wait-after-sending-a-command-to-a.patch @@ -0,0 +1,124 @@ +From 2b443a112df0cdaf9420e7c3186cab878d07f912 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Nov 2025 09:48:35 +0100 +Subject: drm/panthor: Always wait after sending a command to an AS + +From: Boris Brezillon + +[ Upstream commit d2c6fde56d451ca48a5e03428535ce3dbc8fc910 ] + +There's currently no situation where we want to issue a command to an +AS and not wait for this command to complete. The wait is either +explicitly done (LOCK, UNLOCK) or it's missing (UPDATE). So let's +turn write_cmd() into as_send_cmd_and_wait() that has the wait after +a command is sent. + +v2: +- New patch + +v3: +- Collect R-b + +v4: +- No changes + +Reviewed-by: Steven Price +Link: https://patch.msgid.link/20251128084841.3804658-2-boris.brezillon@collabora.com +Signed-off-by: Boris Brezillon +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panthor/panthor_mmu.c | 27 ++++++++++++--------------- + 1 file changed, 12 insertions(+), 15 deletions(-) + +diff --git a/drivers/gpu/drm/panthor/panthor_mmu.c b/drivers/gpu/drm/panthor/panthor_mmu.c +index 9194bad4b6196..c15d2a3906db9 100644 +--- a/drivers/gpu/drm/panthor/panthor_mmu.c ++++ b/drivers/gpu/drm/panthor/panthor_mmu.c +@@ -510,27 +510,29 @@ static int wait_ready(struct panthor_device *ptdev, u32 as_nr) + return ret; + } + +-static int write_cmd(struct panthor_device *ptdev, u32 as_nr, u32 cmd) ++static int as_send_cmd_and_wait(struct panthor_device *ptdev, u32 as_nr, u32 cmd) + { + int status; + + /* write AS_COMMAND when MMU is ready to accept another command */ + status = wait_ready(ptdev, as_nr); +- if (!status) ++ if (!status) { + gpu_write(ptdev, AS_COMMAND(as_nr), cmd); ++ status = wait_ready(ptdev, as_nr); ++ } + + return status; + } + +-static void lock_region(struct panthor_device *ptdev, u32 as_nr, +- u64 region_start, u64 size) ++static int lock_region(struct panthor_device *ptdev, u32 as_nr, ++ u64 region_start, u64 size) + { + u8 region_width; + u64 region; + u64 region_end = region_start + size; + + if (!size) +- return; ++ return 0; + + /* + * The locked region is a naturally aligned power of 2 block encoded as +@@ -553,7 +555,7 @@ static void lock_region(struct panthor_device *ptdev, u32 as_nr, + + /* Lock the region that needs to be updated */ + gpu_write64(ptdev, AS_LOCKADDR(as_nr), region); +- write_cmd(ptdev, as_nr, AS_COMMAND_LOCK); ++ return as_send_cmd_and_wait(ptdev, as_nr, AS_COMMAND_LOCK); + } + + static int mmu_hw_do_operation_locked(struct panthor_device *ptdev, int as_nr, +@@ -586,9 +588,7 @@ static int mmu_hw_do_operation_locked(struct panthor_device *ptdev, int as_nr, + * power it up + */ + +- lock_region(ptdev, as_nr, iova, size); +- +- ret = wait_ready(ptdev, as_nr); ++ ret = lock_region(ptdev, as_nr, iova, size); + if (ret) + return ret; + +@@ -601,10 +601,7 @@ static int mmu_hw_do_operation_locked(struct panthor_device *ptdev, int as_nr, + * at the end of the GPU_CONTROL cache flush command, unlike + * AS_COMMAND_FLUSH_MEM or AS_COMMAND_FLUSH_PT. + */ +- write_cmd(ptdev, as_nr, AS_COMMAND_UNLOCK); +- +- /* Wait for the unlock command to complete */ +- return wait_ready(ptdev, as_nr); ++ return as_send_cmd_and_wait(ptdev, as_nr, AS_COMMAND_UNLOCK); + } + + static int mmu_hw_do_operation(struct panthor_vm *vm, +@@ -633,7 +630,7 @@ static int panthor_mmu_as_enable(struct panthor_device *ptdev, u32 as_nr, + gpu_write64(ptdev, AS_MEMATTR(as_nr), memattr); + gpu_write64(ptdev, AS_TRANSCFG(as_nr), transcfg); + +- return write_cmd(ptdev, as_nr, AS_COMMAND_UPDATE); ++ return as_send_cmd_and_wait(ptdev, as_nr, AS_COMMAND_UPDATE); + } + + static int panthor_mmu_as_disable(struct panthor_device *ptdev, u32 as_nr) +@@ -648,7 +645,7 @@ static int panthor_mmu_as_disable(struct panthor_device *ptdev, u32 as_nr) + gpu_write64(ptdev, AS_MEMATTR(as_nr), 0); + gpu_write64(ptdev, AS_TRANSCFG(as_nr), AS_TRANSCFG_ADRMODE_UNMAPPED); + +- return write_cmd(ptdev, as_nr, AS_COMMAND_UPDATE); ++ return as_send_cmd_and_wait(ptdev, as_nr, AS_COMMAND_UPDATE); + } + + static u32 panthor_mmu_fault_mask(struct panthor_device *ptdev, u32 value) +-- +2.51.0 + diff --git a/queue-6.19/drm-radeon-add-hainan-clock-adjustment.patch b/queue-6.19/drm-radeon-add-hainan-clock-adjustment.patch new file mode 100644 index 00000000000..9b7c50163f3 --- /dev/null +++ b/queue-6.19/drm-radeon-add-hainan-clock-adjustment.patch @@ -0,0 +1,39 @@ +From 2b6328693e408ad1d16182cceec48ca871f78d70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Feb 2026 07:26:00 +0000 +Subject: drm/radeon: Add HAINAN clock adjustment + +From: decce6 + +[ Upstream commit 908d318f23d6b5d625bea093c5fc056238cdb7ff ] + +This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from +850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This +patch is for radeon. + +Signed-off-by: decce6 +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/si_dpm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c +index 9deb91970d4df..f12227145ef08 100644 +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -2925,6 +2925,11 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev, + max_sclk = 60000; + max_mclk = 80000; + } ++ if ((rdev->pdev->device == 0x666f) && ++ (rdev->pdev->revision == 0x00)) { ++ max_sclk = 80000; ++ max_mclk = 95000; ++ } + } else if (rdev->family == CHIP_OLAND) { + if ((rdev->pdev->revision == 0xC7) || + (rdev->pdev->revision == 0x80) || +-- +2.51.0 + diff --git a/queue-6.19/drm-renesas-rz-du-mipi_dsi-fix-kernel-panic-when-reb.patch b/queue-6.19/drm-renesas-rz-du-mipi_dsi-fix-kernel-panic-when-reb.patch new file mode 100644 index 00000000000..4ab41d17994 --- /dev/null +++ b/queue-6.19/drm-renesas-rz-du-mipi_dsi-fix-kernel-panic-when-reb.patch @@ -0,0 +1,79 @@ +From c0a76ce48ffe333a7db358a11a3706b7f1865a81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 10:43:18 -0500 +Subject: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for + some panels + +From: Hugo Villeneuve + +[ Upstream commit 64aa8b3a60a825134f7d866adf05c024bbe0c24c ] + +Since commit 56de5e305d4b ("clk: renesas: r9a07g044: Add MSTOP for RZ/G2L") +we may get the following kernel panic, for some panels, when rebooting: + + systemd-shutdown[1]: Rebooting. + Call trace: + ... + do_serror+0x28/0x68 + el1h_64_error_handler+0x34/0x50 + el1h_64_error+0x6c/0x70 + rzg2l_mipi_dsi_host_transfer+0x114/0x458 (P) + mipi_dsi_device_transfer+0x44/0x58 + mipi_dsi_dcs_set_display_off_multi+0x9c/0xc4 + ili9881c_unprepare+0x38/0x88 + drm_panel_unprepare+0xbc/0x108 + +This happens for panels that need to send MIPI-DSI commands in their +unprepare() callback. Since the MIPI-DSI interface is stopped at that +point, rzg2l_mipi_dsi_host_transfer() triggers the kernel panic. + +Fix by moving rzg2l_mipi_dsi_stop() to new callback function +rzg2l_mipi_dsi_atomic_post_disable(). + +With this change we now have the correct power-down/stop sequence: + + systemd-shutdown[1]: Rebooting. + rzg2l-mipi-dsi 10850000.dsi: rzg2l_mipi_dsi_atomic_disable(): entry + ili9881c-dsi 10850000.dsi.0: ili9881c_unprepare(): entry + rzg2l-mipi-dsi 10850000.dsi: rzg2l_mipi_dsi_atomic_post_disable(): entry + reboot: Restarting system + +Suggested-by: Biju Das +Signed-off-by: Hugo Villeneuve +Tested-by: Biju Das +Link: https://patch.msgid.link/20260112154333.655352-1-hugo@hugovil.com +Signed-off-by: Biju Das +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c b/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c +index 3b52dfc0ea1e0..b164e3a62cc2f 100644 +--- a/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c ++++ b/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c +@@ -646,6 +646,13 @@ static void rzg2l_mipi_dsi_atomic_disable(struct drm_bridge *bridge, + + rzg2l_mipi_dsi_stop_video(dsi); + rzg2l_mipi_dsi_stop_hs_clock(dsi); ++} ++ ++static void rzg2l_mipi_dsi_atomic_post_disable(struct drm_bridge *bridge, ++ struct drm_atomic_state *state) ++{ ++ struct rzg2l_mipi_dsi *dsi = bridge_to_rzg2l_mipi_dsi(bridge); ++ + rzg2l_mipi_dsi_stop(dsi); + } + +@@ -681,6 +688,7 @@ static const struct drm_bridge_funcs rzg2l_mipi_dsi_bridge_ops = { + .atomic_pre_enable = rzg2l_mipi_dsi_atomic_pre_enable, + .atomic_enable = rzg2l_mipi_dsi_atomic_enable, + .atomic_disable = rzg2l_mipi_dsi_atomic_disable, ++ .atomic_post_disable = rzg2l_mipi_dsi_atomic_post_disable, + .mode_valid = rzg2l_mipi_dsi_bridge_mode_valid, + }; + +-- +2.51.0 + diff --git a/queue-6.19/drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch b/queue-6.19/drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch new file mode 100644 index 00000000000..ae20d35872c --- /dev/null +++ b/queue-6.19/drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch @@ -0,0 +1,71 @@ +From 142b8a9ba4ef15c7c9050962325d550ea78bff95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Dec 2025 21:03:23 +0800 +Subject: drm/v3d: Set DMA segment size to avoid debug warnings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Xiaolei Wang + +[ Upstream commit 9eb018828b1b30dfba689c060735c50fc5b9f704 ] + +When using V3D rendering with CONFIG_DMA_API_DEBUG enabled, the +kernel occasionally reports a segment size mismatch. This is because +'max_seg_size' is not set. The kernel defaults to 64K. setting +'max_seg_size' to the maximum will prevent 'debug_dma_map_sg()' +from complaining about the over-mapping of the V3D segment length. + +DMA-API: v3d 1002000000.v3d: mapping sg segment longer than device + claims to support [len=8290304] [max=65536] +WARNING: CPU: 0 PID: 493 at kernel/dma/debug.c:1179 debug_dma_map_sg+0x330/0x388 +CPU: 0 UID: 0 PID: 493 Comm: Xorg Not tainted 6.12.53-yocto-standard #1 +Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT) +pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : debug_dma_map_sg+0x330/0x388 +lr : debug_dma_map_sg+0x330/0x388 +sp : ffff8000829a3ac0 +x29: ffff8000829a3ac0 x28: 0000000000000001 x27: ffff8000813fe000 +x26: ffffc1ffc0000000 x25: ffff00010fdeb760 x24: 0000000000000000 +x23: ffff8000816a9bf0 x22: 0000000000000001 x21: 0000000000000002 +x20: 0000000000000002 x19: ffff00010185e810 x18: ffffffffffffffff +x17: 69766564206e6168 x16: 74207265676e6f6c x15: 20746e656d676573 +x14: 20677320676e6970 x13: 5d34303334393134 x12: 0000000000000000 +x11: 00000000000000c0 x10: 00000000000009c0 x9 : ffff8000800e0b7c +x8 : ffff00010a315ca0 x7 : ffff8000816a5110 x6 : 0000000000000001 +x5 : 000000000000002b x4 : 0000000000000002 x3 : 0000000000000008 +x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00010a315280 +Call trace: + debug_dma_map_sg+0x330/0x388 + __dma_map_sg_attrs+0xc0/0x278 + dma_map_sgtable+0x30/0x58 + drm_gem_shmem_get_pages_sgt+0xb4/0x140 + v3d_bo_create_finish+0x28/0x130 [v3d] + v3d_create_bo_ioctl+0x54/0x180 [v3d] + drm_ioctl_kernel+0xc8/0x140 + drm_ioctl+0x2d4/0x4d8 + +Signed-off-by: Xiaolei Wang +Link: https://patch.msgid.link/20251203130323.2247072-1-xiaolei.wang@windriver.com +Signed-off-by: Maíra Canal +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/v3d/v3d_drv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c +index e8a46c8bad8a2..f469de456f9bb 100644 +--- a/drivers/gpu/drm/v3d/v3d_drv.c ++++ b/drivers/gpu/drm/v3d/v3d_drv.c +@@ -378,6 +378,8 @@ static int v3d_platform_drm_probe(struct platform_device *pdev) + if (ret) + goto clk_disable; + ++ dma_set_max_seg_size(&pdev->dev, UINT_MAX); ++ + v3d->va_width = 30 + V3D_GET_FIELD(mmu_debug, V3D_MMU_VA_WIDTH); + + ident1 = V3D_READ(V3D_HUB_IDENT1); +-- +2.51.0 + diff --git a/queue-6.19/drm-xe-covert-return-of-ebusy-to-enomem-in-vm-bind-i.patch b/queue-6.19/drm-xe-covert-return-of-ebusy-to-enomem-in-vm-bind-i.patch new file mode 100644 index 00000000000..cae65b2682e --- /dev/null +++ b/queue-6.19/drm-xe-covert-return-of-ebusy-to-enomem-in-vm-bind-i.patch @@ -0,0 +1,48 @@ +From 95314ab60c79deb1cfab0cff2fd9e3c2893ccf56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 17:25:02 -0800 +Subject: drm/xe: Covert return of -EBUSY to -ENOMEM in VM bind IOCTL + +From: Matthew Brost + +[ Upstream commit 6028f59620927aee2e15a424004012ae05c50684 ] + +xe_vma_userptr_pin_pages can return -EBUSY but -EBUSY has special +meaning in VM bind IOCTLs that user fence is pending that is attached to +the VMA. Convert -EBUSY to -ENOMEM in this case as -EBUSY in practice +means we are low or out of memory. + +Signed-off-by: Matthew Brost +Reviewed-by: Tejas Upadhyay +Link: https://patch.msgid.link/20251122012502.382587-2-matthew.brost@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_vm.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c +index 095bb197e8b05..9781209dd26ed 100644 +--- a/drivers/gpu/drm/xe/xe_vm.c ++++ b/drivers/gpu/drm/xe/xe_vm.c +@@ -2451,8 +2451,17 @@ static struct xe_vma *new_vma(struct xe_vm *vm, struct drm_gpuva_op_map *op, + if (IS_ERR(vma)) + return vma; + +- if (xe_vma_is_userptr(vma)) ++ if (xe_vma_is_userptr(vma)) { + err = xe_vma_userptr_pin_pages(to_userptr_vma(vma)); ++ /* ++ * -EBUSY has dedicated meaning that a user fence ++ * attached to the VMA is busy, in practice ++ * xe_vma_userptr_pin_pages can only fail with -EBUSY if ++ * we are low on memory so convert this to -ENOMEM. ++ */ ++ if (err == -EBUSY) ++ err = -ENOMEM; ++ } + } + if (err) { + prep_vma_destroy(vm, vma, false); +-- +2.51.0 + diff --git a/queue-6.19/drm-xe-ggtt-use-scope-based-runtime-pm.patch b/queue-6.19/drm-xe-ggtt-use-scope-based-runtime-pm.patch new file mode 100644 index 00000000000..30e0ef2ccde --- /dev/null +++ b/queue-6.19/drm-xe-ggtt-use-scope-based-runtime-pm.patch @@ -0,0 +1,38 @@ +From e9142af165af6c86b011792c1dd8be2c351313d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Nov 2025 08:44:01 -0800 +Subject: drm/xe/ggtt: Use scope-based runtime pm + +From: Matt Roper + +[ Upstream commit 8a579f4b2476fd1df07e2bca9fedc82a39a56a65 ] + +Switch the GGTT code to scope-based runtime PM for consistency with +other parts of the driver. + +Reviewed-by: Gustavo Sousa +Link: https://patch.msgid.link/20251118164338.3572146-51-matthew.d.roper@intel.com +Signed-off-by: Matt Roper +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_ggtt.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_ggtt.c b/drivers/gpu/drm/xe/xe_ggtt.c +index 793d7324a395d..9e6b4e9835424 100644 +--- a/drivers/gpu/drm/xe/xe_ggtt.c ++++ b/drivers/gpu/drm/xe/xe_ggtt.c +@@ -396,9 +396,8 @@ static void ggtt_node_remove_work_func(struct work_struct *work) + delayed_removal_work); + struct xe_device *xe = tile_to_xe(node->ggtt->tile); + +- xe_pm_runtime_get(xe); ++ guard(xe_pm_runtime)(xe); + ggtt_node_remove(node); +- xe_pm_runtime_put(xe); + } + + /** +-- +2.51.0 + diff --git a/queue-6.19/drm-xe-only-toggle-scheduling-in-tdr-if-guc-is-runni.patch b/queue-6.19/drm-xe-only-toggle-scheduling-in-tdr-if-guc-is-runni.patch new file mode 100644 index 00000000000..6593d75409a --- /dev/null +++ b/queue-6.19/drm-xe-only-toggle-scheduling-in-tdr-if-guc-is-runni.patch @@ -0,0 +1,48 @@ +From f1ff2b1b4211aec4cabb01cefe23b1cbc951e150 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jan 2026 17:27:35 -0800 +Subject: drm/xe: Only toggle scheduling in TDR if GuC is running + +From: Matthew Brost + +[ Upstream commit dd1ef5e2456558876244795bb22a4d90cb24f160 ] + +If the firmware is not running during TDR (e.g., when the driver is +unloading), there's no need to toggle scheduling in the GuC. In such +cases, skip this step. + +v4: + - Bail on wait UC not running (Niranjana) + +Signed-off-by: Matthew Brost +Reviewed-by: Niranjana Vishwanathapura +Link: https://patch.msgid.link/20260110012739.2888434-4-matthew.brost@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_guc_submit.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c +index f6ba2b0f074d2..ced13f17fb720 100644 +--- a/drivers/gpu/drm/xe/xe_guc_submit.c ++++ b/drivers/gpu/drm/xe/xe_guc_submit.c +@@ -1304,7 +1304,7 @@ guc_exec_queue_timedout_job(struct drm_sched_job *drm_job) + if (exec_queue_reset(q)) + err = -EIO; + +- if (!exec_queue_destroyed(q)) { ++ if (!exec_queue_destroyed(q) && xe_uc_fw_is_running(&guc->fw)) { + /* + * Wait for any pending G2H to flush out before + * modifying state +@@ -1339,6 +1339,7 @@ guc_exec_queue_timedout_job(struct drm_sched_job *drm_job) + */ + smp_rmb(); + ret = wait_event_timeout(guc->ct.wq, ++ !xe_uc_fw_is_running(&guc->fw) || + !exec_queue_pending_disable(q) || + xe_guc_read_stopped(guc) || + vf_recovery(guc), HZ * 5); +-- +2.51.0 + diff --git a/queue-6.19/drm-xe-vm-skip-ufence-association-for-cpu-address-mi.patch b/queue-6.19/drm-xe-vm-skip-ufence-association-for-cpu-address-mi.patch new file mode 100644 index 00000000000..9f58ecd71ba --- /dev/null +++ b/queue-6.19/drm-xe-vm-skip-ufence-association-for-cpu-address-mi.patch @@ -0,0 +1,47 @@ +From a7549fff630f0fac877f933ef638339dd1efe31c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 13:26:28 +0530 +Subject: drm/xe/vm: Skip ufence association for CPU address mirror VMA during + MAP +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Himal Prasad Ghimiray + +[ Upstream commit 7f08cc5b3cc3bf6416f8b55bff906f67ed75637d ] + +The MAP operation for a CPU address mirror VMA does not require ufence +association because such mappings are not GPU-synchronized and do not +participate in GPU job completion signaling. + +Remove the unnecessary ufence addition for this case to avoid -EBUSY +failure in check_ufence of unbind ops. + +Cc: Matthew Brost +Cc: Thomas Hellström +Reviewed-by: Matthew Brost +Link: https://patch.msgid.link/20251125075628.1182481-6-himal.prasad.ghimiray@intel.com +Signed-off-by: Himal Prasad Ghimiray +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_vm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c +index 9781209dd26ed..612fc5b2539cd 100644 +--- a/drivers/gpu/drm/xe/xe_vm.c ++++ b/drivers/gpu/drm/xe/xe_vm.c +@@ -3223,7 +3223,8 @@ static void op_add_ufence(struct xe_vm *vm, struct xe_vma_op *op, + { + switch (op->base.op) { + case DRM_GPUVA_OP_MAP: +- vma_add_ufence(op->map.vma, ufence); ++ if (!xe_vma_is_cpu_addr_mirror(op->map.vma)) ++ vma_add_ufence(op->map.vma, ufence); + break; + case DRM_GPUVA_OP_REMAP: + if (op->remap.prev) +-- +2.51.0 + diff --git a/queue-6.19/drm-xe-xe3_lpg-apply-wa_16028005424.patch b/queue-6.19/drm-xe-xe3_lpg-apply-wa_16028005424.patch new file mode 100644 index 00000000000..da5d1b15261 --- /dev/null +++ b/queue-6.19/drm-xe-xe3_lpg-apply-wa_16028005424.patch @@ -0,0 +1,61 @@ +From 4d4919d06d3d7c767e91b607a3d66b7f9d425d43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 15:38:23 +0530 +Subject: drm/xe/xe3_lpg: Apply Wa_16028005424 + +From: Balasubramani Vivekanandan + +[ Upstream commit 9d94c1cf6ef938abd4b849b66f8eab11e3c537ef ] + +Applied Wa_16028005424 to Graphics version from 30.00 to 30.05 + +Reviewed-by: Matt Roper +Signed-off-by: Balasubramani Vivekanandan +Link: https://patch.msgid.link/20251121100822.20076-2-balasubramani.vivekanandan@intel.com +Signed-off-by: Matt Roper +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/regs/xe_guc_regs.h | 3 +++ + drivers/gpu/drm/xe/xe_wa.c | 5 +++++ + 2 files changed, 8 insertions(+) + +diff --git a/drivers/gpu/drm/xe/regs/xe_guc_regs.h b/drivers/gpu/drm/xe/regs/xe_guc_regs.h +index 2118f7dec287f..87984713dd126 100644 +--- a/drivers/gpu/drm/xe/regs/xe_guc_regs.h ++++ b/drivers/gpu/drm/xe/regs/xe_guc_regs.h +@@ -90,6 +90,9 @@ + #define GUC_SEND_INTERRUPT XE_REG(0xc4c8) + #define GUC_SEND_TRIGGER REG_BIT(0) + ++#define GUC_INTR_CHICKEN XE_REG(0xc50c) ++#define DISABLE_SIGNALING_ENGINES REG_BIT(1) ++ + #define GUC_BCS_RCS_IER XE_REG(0xc550) + #define GUC_VCS2_VCS1_IER XE_REG(0xc554) + #define GUC_WD_VECS_IER XE_REG(0xc558) +diff --git a/drivers/gpu/drm/xe/xe_wa.c b/drivers/gpu/drm/xe/xe_wa.c +index c7eab0c4af7a8..68238e73015b7 100644 +--- a/drivers/gpu/drm/xe/xe_wa.c ++++ b/drivers/gpu/drm/xe/xe_wa.c +@@ -15,6 +15,7 @@ + + #include "regs/xe_engine_regs.h" + #include "regs/xe_gt_regs.h" ++#include "regs/xe_guc_regs.h" + #include "regs/xe_regs.h" + #include "xe_device_types.h" + #include "xe_force_wake.h" +@@ -315,6 +316,10 @@ static const struct xe_rtp_entry_sr gt_was[] = { + XE_RTP_ACTIONS(SET(VDBOX_CGCTL3F10(0), RAMDFTUNIT_CLKGATE_DIS)), + XE_RTP_ENTRY_FLAG(FOREACH_ENGINE), + }, ++ { XE_RTP_NAME("16028005424"), ++ XE_RTP_RULES(GRAPHICS_VERSION_RANGE(3000, 3005)), ++ XE_RTP_ACTIONS(SET(GUC_INTR_CHICKEN, DISABLE_SIGNALING_ENGINES)) ++ }, + }; + + static const struct xe_rtp_entry_sr engine_was[] = { +-- +2.51.0 + diff --git a/queue-6.19/edac-igen6-add-more-intel-panther-lake-h-socs-suppor.patch b/queue-6.19/edac-igen6-add-more-intel-panther-lake-h-socs-suppor.patch new file mode 100644 index 00000000000..231d3fcc5c9 --- /dev/null +++ b/queue-6.19/edac-igen6-add-more-intel-panther-lake-h-socs-suppor.patch @@ -0,0 +1,61 @@ +From 6c746b87eb8a296a0eabeeeee7f7a1c299a8f275 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 21:15:37 +0800 +Subject: EDAC/igen6: Add more Intel Panther Lake-H SoCs support + +From: Lili Li + +[ Upstream commit 4c36e6106997b6ad8f4a279b4bdbca3ed6f53c6c ] + +Add more Intel Panther Lake-H SoC compute die IDs for EDAC support. + +Signed-off-by: Lili Li +Signed-off-by: Tony Luck +Reviewed-by: Qiuxu Zhuo +Link: https://patch.msgid.link/20251124131537.3633983-1-qiuxu.zhuo@intel.com +Signed-off-by: Sasha Levin +--- + drivers/edac/igen6_edac.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/edac/igen6_edac.c b/drivers/edac/igen6_edac.c +index 553c31a2d9226..839b6dd3629e9 100644 +--- a/drivers/edac/igen6_edac.c ++++ b/drivers/edac/igen6_edac.c +@@ -274,6 +274,16 @@ static struct work_struct ecclog_work; + #define DID_PTL_H_SKU1 0xb000 + #define DID_PTL_H_SKU2 0xb001 + #define DID_PTL_H_SKU3 0xb002 ++#define DID_PTL_H_SKU4 0xb003 ++#define DID_PTL_H_SKU5 0xb004 ++#define DID_PTL_H_SKU6 0xb005 ++#define DID_PTL_H_SKU7 0xb008 ++#define DID_PTL_H_SKU8 0xb011 ++#define DID_PTL_H_SKU9 0xb014 ++#define DID_PTL_H_SKU10 0xb015 ++#define DID_PTL_H_SKU11 0xb028 ++#define DID_PTL_H_SKU12 0xb029 ++#define DID_PTL_H_SKU13 0xb02a + + /* Compute die IDs for Wildcat Lake with IBECC */ + #define DID_WCL_SKU1 0xfd00 +@@ -636,6 +646,16 @@ static struct pci_device_id igen6_pci_tbl[] = { + { PCI_VDEVICE(INTEL, DID_PTL_H_SKU1), (kernel_ulong_t)&mtl_p_cfg }, + { PCI_VDEVICE(INTEL, DID_PTL_H_SKU2), (kernel_ulong_t)&mtl_p_cfg }, + { PCI_VDEVICE(INTEL, DID_PTL_H_SKU3), (kernel_ulong_t)&mtl_p_cfg }, ++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU4), (kernel_ulong_t)&mtl_p_cfg }, ++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU5), (kernel_ulong_t)&mtl_p_cfg }, ++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU6), (kernel_ulong_t)&mtl_p_cfg }, ++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU7), (kernel_ulong_t)&mtl_p_cfg }, ++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU8), (kernel_ulong_t)&mtl_p_cfg }, ++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU9), (kernel_ulong_t)&mtl_p_cfg }, ++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU10), (kernel_ulong_t)&mtl_p_cfg }, ++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU11), (kernel_ulong_t)&mtl_p_cfg }, ++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU12), (kernel_ulong_t)&mtl_p_cfg }, ++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU13), (kernel_ulong_t)&mtl_p_cfg }, + { PCI_VDEVICE(INTEL, DID_WCL_SKU1), (kernel_ulong_t)&wcl_cfg }, + { }, + }; +-- +2.51.0 + diff --git a/queue-6.19/edac-igen6-add-two-intel-amston-lake-socs-support.patch b/queue-6.19/edac-igen6-add-two-intel-amston-lake-socs-support.patch new file mode 100644 index 00000000000..d5de03d9df9 --- /dev/null +++ b/queue-6.19/edac-igen6-add-two-intel-amston-lake-socs-support.patch @@ -0,0 +1,47 @@ +From c0b0f3016f8d26c48a9b22cec47cddb8a9633103 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 14:54:56 +0800 +Subject: EDAC/igen6: Add two Intel Amston Lake SoCs support + +From: Qiuxu Zhuo + +[ Upstream commit 41ca2155d62b0b0d217f59e1bce18362d0c2446f ] + +Intel Amston Lake SoCs with IBECC (In-Band ECC) capability share the same +IBECC registers as Alder Lake-N SoCs. Add two new compute die IDs for +Amston Lake SoC products to enable EDAC support. + +Signed-off-by: Qiuxu Zhuo +Signed-off-by: Tony Luck +Tested-by: Jianfeng Gao +Link: https://patch.msgid.link/20251124065457.3630949-2-qiuxu.zhuo@intel.com +Signed-off-by: Sasha Levin +--- + drivers/edac/igen6_edac.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/edac/igen6_edac.c b/drivers/edac/igen6_edac.c +index 839b6dd3629e9..f2c9270c1893c 100644 +--- a/drivers/edac/igen6_edac.c ++++ b/drivers/edac/igen6_edac.c +@@ -246,6 +246,8 @@ static struct work_struct ecclog_work; + + /* Compute did IDs for Amston Lake with IBECC */ + #define DID_ASL_SKU1 0x464a ++#define DID_ASL_SKU2 0x4646 ++#define DID_ASL_SKU3 0x4652 + + /* Compute die IDs for Raptor Lake-P with IBECC */ + #define DID_RPL_P_SKU1 0xa706 +@@ -628,6 +630,8 @@ static struct pci_device_id igen6_pci_tbl[] = { + { PCI_VDEVICE(INTEL, DID_ADL_N_SKU12), (kernel_ulong_t)&adl_n_cfg }, + { PCI_VDEVICE(INTEL, DID_AZB_SKU1), (kernel_ulong_t)&adl_n_cfg }, + { PCI_VDEVICE(INTEL, DID_ASL_SKU1), (kernel_ulong_t)&adl_n_cfg }, ++ { PCI_VDEVICE(INTEL, DID_ASL_SKU2), (kernel_ulong_t)&adl_n_cfg }, ++ { PCI_VDEVICE(INTEL, DID_ASL_SKU3), (kernel_ulong_t)&adl_n_cfg }, + { PCI_VDEVICE(INTEL, DID_RPL_P_SKU1), (kernel_ulong_t)&rpl_p_cfg }, + { PCI_VDEVICE(INTEL, DID_RPL_P_SKU2), (kernel_ulong_t)&rpl_p_cfg }, + { PCI_VDEVICE(INTEL, DID_RPL_P_SKU3), (kernel_ulong_t)&rpl_p_cfg }, +-- +2.51.0 + diff --git a/queue-6.19/efi-cper-don-t-dump-the-entire-memory-region.patch b/queue-6.19/efi-cper-don-t-dump-the-entire-memory-region.patch new file mode 100644 index 00000000000..aa22a8f6ab1 --- /dev/null +++ b/queue-6.19/efi-cper-don-t-dump-the-entire-memory-region.patch @@ -0,0 +1,54 @@ +From 358c253a97e05a0d1c96510580e9003e92c3f7d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:35:06 +0100 +Subject: EFI/CPER: don't dump the entire memory region + +From: Mauro Carvalho Chehab + +[ Upstream commit 55cc6fe5716f678f06bcb95140882dfa684464ec ] + +The current logic at cper_print_fw_err() doesn't check if the +error record length is big enough to handle offset. On a bad firmware, +if the ofset is above the actual record, length -= offset will +underflow, making it dump the entire memory. + +The end result can be: + + - the logic taking a lot of time dumping large regions of memory; + - data disclosure due to the memory dumps; + - an OOPS, if it tries to dump an unmapped memory region. + +Fix it by checking if the section length is too small before doing +a hex dump. + +Signed-off-by: Mauro Carvalho Chehab +Reviewed-by: Jonathan Cameron +Acked-by: Ard Biesheuvel +Reviewed-by: Hanjun Guo +[ rjw: Subject tweaks ] +Link: https://patch.msgid.link/1752b5ba63a3e2f148ddee813b36c996cc617e86.1767871950.git.mchehab+huawei@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/cper.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c +index bd99802cb0cad..09a4f0168df80 100644 +--- a/drivers/firmware/efi/cper.c ++++ b/drivers/firmware/efi/cper.c +@@ -560,6 +560,11 @@ static void cper_print_fw_err(const char *pfx, + } else { + offset = sizeof(*fw_err); + } ++ if (offset > length) { ++ printk("%s""error section length is too small: offset=%d, length=%d\n", ++ pfx, offset, length); ++ return; ++ } + + buf += offset; + length -= offset; +-- +2.51.0 + diff --git a/queue-6.19/efi-cper-don-t-go-past-the-arm-processor-cper-record.patch b/queue-6.19/efi-cper-don-t-go-past-the-arm-processor-cper-record.patch new file mode 100644 index 00000000000..419d3db41c0 --- /dev/null +++ b/queue-6.19/efi-cper-don-t-go-past-the-arm-processor-cper-record.patch @@ -0,0 +1,107 @@ +From 905f3b6d77c3277553c2c8611f0628bccaff6522 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:35:04 +0100 +Subject: EFI/CPER: don't go past the ARM processor CPER record buffer + +From: Mauro Carvalho Chehab + +[ Upstream commit eae21beecb95a3b69ee5c38a659f774e171d730e ] + +There's a logic inside GHES/CPER to detect if the section_length +is too small, but it doesn't detect if it is too big. + +Currently, if the firmware receives an ARM processor CPER record +stating that a section length is big, kernel will blindly trust +section_length, producing a very long dump. For instance, a 67 +bytes record with ERR_INFO_NUM set 46198 and section length +set to 854918320 would dump a lot of data going a way past the +firmware memory-mapped area. + +Fix it by adding a logic to prevent it to go past the buffer +if ERR_INFO_NUM is too big, making it report instead: + + [Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1 + [Hardware Error]: event severity: recoverable + [Hardware Error]: Error 0, type: recoverable + [Hardware Error]: section_type: ARM processor error + [Hardware Error]: MIDR: 0xff304b2f8476870a + [Hardware Error]: section length: 854918320, CPER size: 67 + [Hardware Error]: section length is too big + [Hardware Error]: firmware-generated error record is incorrect + [Hardware Error]: ERR_INFO_NUM is 46198 + +Signed-off-by: Mauro Carvalho Chehab +Reviewed-by: Jonathan Cameron +Acked-by: Ard Biesheuvel +Reviewed-by: Hanjun Guo +[ rjw: Subject and changelog tweaks ] +Link: https://patch.msgid.link/41cd9f6b3ace3cdff7a5e864890849e4b1c58b63.1767871950.git.mchehab+huawei@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/cper-arm.c | 12 ++++++++---- + drivers/firmware/efi/cper.c | 3 ++- + include/linux/cper.h | 3 ++- + 3 files changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/firmware/efi/cper-arm.c b/drivers/firmware/efi/cper-arm.c +index 76542a53e2027..b21cb1232d820 100644 +--- a/drivers/firmware/efi/cper-arm.c ++++ b/drivers/firmware/efi/cper-arm.c +@@ -226,7 +226,8 @@ static void cper_print_arm_err_info(const char *pfx, u32 type, + } + + void cper_print_proc_arm(const char *pfx, +- const struct cper_sec_proc_arm *proc) ++ const struct cper_sec_proc_arm *proc, ++ u32 length) + { + int i, len, max_ctx_type; + struct cper_arm_err_info *err_info; +@@ -238,9 +239,12 @@ void cper_print_proc_arm(const char *pfx, + + len = proc->section_length - (sizeof(*proc) + + proc->err_info_num * (sizeof(*err_info))); +- if (len < 0) { +- printk("%ssection length: %d\n", pfx, proc->section_length); +- printk("%ssection length is too small\n", pfx); ++ ++ if (len < 0 || proc->section_length > length) { ++ printk("%ssection length: %d, CPER size: %d\n", ++ pfx, proc->section_length, length); ++ printk("%ssection length is too %s\n", pfx, ++ (len < 0) ? "small" : "big"); + printk("%sfirmware-generated error record is incorrect\n", pfx); + printk("%sERR_INFO_NUM is %d\n", pfx, proc->err_info_num); + return; +diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c +index 09a4f0168df80..06b4fdb59917a 100644 +--- a/drivers/firmware/efi/cper.c ++++ b/drivers/firmware/efi/cper.c +@@ -664,7 +664,8 @@ cper_estatus_print_section(const char *pfx, struct acpi_hest_generic_data *gdata + + printk("%ssection_type: ARM processor error\n", newpfx); + if (gdata->error_data_length >= sizeof(*arm_err)) +- cper_print_proc_arm(newpfx, arm_err); ++ cper_print_proc_arm(newpfx, arm_err, ++ gdata->error_data_length); + else + goto err_section_too_small; + #endif +diff --git a/include/linux/cper.h b/include/linux/cper.h +index 5b1236d8c65bb..440b35e459e53 100644 +--- a/include/linux/cper.h ++++ b/include/linux/cper.h +@@ -595,7 +595,8 @@ void cper_mem_err_pack(const struct cper_sec_mem_err *, + const char *cper_mem_err_unpack(struct trace_seq *, + struct cper_mem_err_compact *); + void cper_print_proc_arm(const char *pfx, +- const struct cper_sec_proc_arm *proc); ++ const struct cper_sec_proc_arm *proc, ++ u32 length); + void cper_print_proc_ia(const char *pfx, + const struct cper_sec_proc_ia *proc); + int cper_mem_err_location(struct cper_mem_err_compact *mem, char *msg); +-- +2.51.0 + diff --git a/queue-6.19/ext4-mark-group-add-fast-commit-ineligible.patch b/queue-6.19/ext4-mark-group-add-fast-commit-ineligible.patch new file mode 100644 index 00000000000..8b25d571237 --- /dev/null +++ b/queue-6.19/ext4-mark-group-add-fast-commit-ineligible.patch @@ -0,0 +1,68 @@ +From 60c92601fddbcc97c070556020c177cafbe321ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 19:51:41 +0800 +Subject: ext4: mark group add fast-commit ineligible + +From: Li Chen + +[ Upstream commit 89b4336fd5ec78f51f9d3a1d100f3ffa3228e604 ] + +Fast commits only log operations that have dedicated replay support. +Online resize via EXT4_IOC_GROUP_ADD updates the superblock and group +descriptor metadata without going through the fast commit tracking +paths. +In practice these operations are rare and usually followed by further +updates, but mixing them into a fast commit makes the overall +semantics harder to reason about and risks replay gaps if new call +sites appear. + +Teach ext4 to mark the filesystem fast-commit ineligible when +ext4_ioctl_group_add() adds new block groups. +This forces those transactions to fall back to a full commit, +ensuring that the filesystem geometry updates are captured by the +normal journal rather than partially encoded in fast commit TLVs. +This change should not affect common workloads but makes online +resize via GROUP_ADD safer and easier to reason about under fast +commit. + +Testing: +1. prepare: + dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256 + mkfs.ext4 -O fast_commit -F /root/fc_resize.img + mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize +2. Ran a helper that issues EXT4_IOC_GROUP_ADD on the mounted + filesystem and checked the resize ineligible reason: + ./group_add_helper /mnt/fc_resize + cat /proc/fs/ext4/loop0/fc_info + shows "Resize": > 0. +3. Fsynced a file on the resized filesystem and verified that the fast + commit stats report at least one ineligible commit: + touch /mnt/fc_resize/file + /root/fsync_file /mnt/fc_resize/file + sync + cat /proc/fs/ext4/loop0/fc_info + shows fc stats ineligible > 0. + +Signed-off-by: Li Chen +Link: https://patch.msgid.link/20251211115146.897420-5-me@linux.beauty +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/ioctl.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c +index 7ce0fc40aec2f..5109b005e0286 100644 +--- a/fs/ext4/ioctl.c ++++ b/fs/ext4/ioctl.c +@@ -966,6 +966,7 @@ static long ext4_ioctl_group_add(struct file *file, + + err = ext4_group_add(sb, input); + if (EXT4_SB(sb)->s_journal) { ++ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE, NULL); + jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal); + err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0); + jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal); +-- +2.51.0 + diff --git a/queue-6.19/ext4-mark-group-extend-fast-commit-ineligible.patch b/queue-6.19/ext4-mark-group-extend-fast-commit-ineligible.patch new file mode 100644 index 00000000000..36ea7c6c491 --- /dev/null +++ b/queue-6.19/ext4-mark-group-extend-fast-commit-ineligible.patch @@ -0,0 +1,69 @@ +From 8256b200b302f1922b63fd1b65db529f69ff986f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 19:51:42 +0800 +Subject: ext4: mark group extend fast-commit ineligible + +From: Li Chen + +[ Upstream commit 1f8dd813a1c771b13c303f73d876164bc9b327cc ] + +Fast commits only log operations that have dedicated replay support. +EXT4_IOC_GROUP_EXTEND grows the filesystem to the end of the last +block group and updates the same on-disk metadata without going +through the fast commit tracking paths. +In practice these operations are rare and usually followed by further +updates, but mixing them into a fast commit makes the overall +semantics harder to reason about and risks replay gaps if new call +sites appear. + +Teach ext4 to mark the filesystem fast-commit ineligible when +EXT4_IOC_GROUP_EXTEND grows the filesystem. +This forces those transactions to fall back to a full commit, +ensuring that the group extension changes are captured by the normal +journal rather than partially encoded in fast commit TLVs. +This change should not affect common workloads but makes online +resize via GROUP_EXTEND safer and easier to reason about under fast +commit. + +Testing: +1. prepare: + dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256 + mkfs.ext4 -O fast_commit -F /root/fc_resize.img + mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize +2. Extended the filesystem to the end of the last block group using a + helper that calls EXT4_IOC_GROUP_EXTEND on the mounted filesystem + and checked fc_info: + ./group_extend_helper /mnt/fc_resize + cat /proc/fs/ext4/loop0/fc_info + shows the "Resize" ineligible reason increased. +3. Fsynced a file on the resized filesystem and confirmed that the fast + commit ineligible counter incremented for the resize transaction: + touch /mnt/fc_resize/file + /root/fsync_file /mnt/fc_resize/file + sync + cat /proc/fs/ext4/loop0/fc_info + +Signed-off-by: Li Chen +Link: https://patch.msgid.link/20251211115146.897420-6-me@linux.beauty +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/ioctl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c +index 5109b005e0286..e5e197ac7d88b 100644 +--- a/fs/ext4/ioctl.c ++++ b/fs/ext4/ioctl.c +@@ -1612,6 +1612,8 @@ static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) + + err = ext4_group_extend(sb, EXT4_SB(sb)->s_es, n_blocks_count); + if (EXT4_SB(sb)->s_journal) { ++ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE, ++ NULL); + jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal); + err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0); + jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal); +-- +2.51.0 + diff --git a/queue-6.19/ext4-move-ext4_percpu_param_init-before-ext4_mb_init.patch b/queue-6.19/ext4-move-ext4_percpu_param_init-before-ext4_mb_init.patch new file mode 100644 index 00000000000..a7424a555a5 --- /dev/null +++ b/queue-6.19/ext4-move-ext4_percpu_param_init-before-ext4_mb_init.patch @@ -0,0 +1,104 @@ +From 1f2480c1a4893345624cbbf73869099f73e94b4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Dec 2025 21:31:16 +0800 +Subject: ext4: move ext4_percpu_param_init() before ext4_mb_init() + +From: Baokun Li + +[ Upstream commit 270564513489d98b721a1e4a10017978d5213bff ] + +When running `kvm-xfstests -c ext4/1k -C 1 generic/383` with the +`DOUBLE_CHECK` macro defined, the following panic is triggered: + +================================================================== +EXT4-fs error (device vdc): ext4_validate_block_bitmap:423: + comm mount: bg 0: bad block bitmap checksum +BUG: unable to handle page fault for address: ff110000fa2cc000 +PGD 3e01067 P4D 3e02067 PUD 0 +Oops: Oops: 0000 [#1] SMP NOPTI +CPU: 0 UID: 0 PID: 2386 Comm: mount Tainted: G W + 6.18.0-gba65a4e7120a-dirty #1152 PREEMPT(none) +RIP: 0010:percpu_counter_add_batch+0x13/0xa0 +Call Trace: + + ext4_mark_group_bitmap_corrupted+0xcb/0xe0 + ext4_validate_block_bitmap+0x2a1/0x2f0 + ext4_read_block_bitmap+0x33/0x50 + mb_group_bb_bitmap_alloc+0x33/0x80 + ext4_mb_add_groupinfo+0x190/0x250 + ext4_mb_init_backend+0x87/0x290 + ext4_mb_init+0x456/0x640 + __ext4_fill_super+0x1072/0x1680 + ext4_fill_super+0xd3/0x280 + get_tree_bdev_flags+0x132/0x1d0 + vfs_get_tree+0x29/0xd0 + vfs_cmd_create+0x59/0xe0 + __do_sys_fsconfig+0x4f6/0x6b0 + do_syscall_64+0x50/0x1f0 + entry_SYSCALL_64_after_hwframe+0x76/0x7e +================================================================== + +This issue can be reproduced using the following commands: + mkfs.ext4 -F -q -b 1024 /dev/sda 5G + tune2fs -O quota,project /dev/sda + mount /dev/sda /tmp/test + +With DOUBLE_CHECK defined, mb_group_bb_bitmap_alloc() reads +and validates the block bitmap. When the validation fails, +ext4_mark_group_bitmap_corrupted() attempts to update +sbi->s_freeclusters_counter. However, this percpu_counter has not been +initialized yet at this point, which leads to the panic described above. + +Fix this by moving the execution of ext4_percpu_param_init() to occur +before ext4_mb_init(), ensuring the per-CPU counters are initialized +before they are used. + +Signed-off-by: Baokun Li +Reviewed-by: Zhang Yi +Reviewed-by: Jan Kara +Link: https://patch.msgid.link/20251209133116.731350-1-libaokun@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/super.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 87205660c5d02..5c2e931d8a533 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -5604,6 +5604,10 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb) + clear_opt2(sb, MB_OPTIMIZE_SCAN); + } + ++ err = ext4_percpu_param_init(sbi); ++ if (err) ++ goto failed_mount5; ++ + err = ext4_mb_init(sb); + if (err) { + ext4_msg(sb, KERN_ERR, "failed to initialize mballoc (%d)", +@@ -5619,10 +5623,6 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb) + sbi->s_journal->j_commit_callback = + ext4_journal_commit_callback; + +- err = ext4_percpu_param_init(sbi); +- if (err) +- goto failed_mount6; +- + if (ext4_has_feature_flex_bg(sb)) + if (!ext4_fill_flex_info(sb)) { + ext4_msg(sb, KERN_ERR, +@@ -5704,8 +5704,8 @@ failed_mount8: __maybe_unused + failed_mount6: + ext4_mb_release(sb); + ext4_flex_groups_free(sbi); +- ext4_percpu_param_destroy(sbi); + failed_mount5: ++ ext4_percpu_param_destroy(sbi); + ext4_ext_release(sb); + ext4_release_system_zone(sb); + failed_mount4a: +-- +2.51.0 + diff --git a/queue-6.19/ext4-propagate-flags-to-convert_initialized_extent.patch b/queue-6.19/ext4-propagate-flags-to-convert_initialized_extent.patch new file mode 100644 index 00000000000..70f5d93c921 --- /dev/null +++ b/queue-6.19/ext4-propagate-flags-to-convert_initialized_extent.patch @@ -0,0 +1,66 @@ +From 03a448026d82bd6a7ee0944e5b1b32f2a4f2f7f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 11:55:35 +0530 +Subject: ext4: propagate flags to convert_initialized_extent() + +From: Ojaswin Mujoo + +[ Upstream commit 3fffa44b6ebf65be92a562a5063303979385a1c9 ] + +Currently, ext4_zero_range passes EXT4_EX_NOCACHE flag to avoid caching +extents however this is not respected by convert_initialized_extent(). +Hence, modify it to accept flags from the caller and to pass the flags +on to other extent manipulation functions it calls. This makes +sure the NOCACHE flag is respected throughout the code path. + +Also, we no longer explicitly pass CONVERT_UNWRITTEN as the caller takes +care of this. + +Reviewed-by: Zhang Yi +Reviewed-by: Jan Kara +Signed-off-by: Ojaswin Mujoo +Link: https://patch.msgid.link/07008fbb14db727fddcaf4c30e2346c49f6c8fe0.1769149131.git.ojaswin@linux.ibm.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/extents.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 418c4351ef40c..986e85902d06a 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -3857,6 +3857,7 @@ static struct ext4_ext_path * + convert_initialized_extent(handle_t *handle, struct inode *inode, + struct ext4_map_blocks *map, + struct ext4_ext_path *path, ++ int flags, + unsigned int *allocated) + { + struct ext4_extent *ex; +@@ -3882,11 +3883,11 @@ convert_initialized_extent(handle_t *handle, struct inode *inode, + + if (ee_block != map->m_lblk || ee_len > map->m_len) { + path = ext4_split_convert_extents(handle, inode, map, path, +- EXT4_GET_BLOCKS_CONVERT_UNWRITTEN, NULL); ++ flags, NULL); + if (IS_ERR(path)) + return path; + +- path = ext4_find_extent(inode, map->m_lblk, path, 0); ++ path = ext4_find_extent(inode, map->m_lblk, path, flags); + if (IS_ERR(path)) + return path; + depth = ext_depth(inode); +@@ -4298,7 +4299,7 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode, + if ((!ext4_ext_is_unwritten(ex)) && + (flags & EXT4_GET_BLOCKS_CONVERT_UNWRITTEN)) { + path = convert_initialized_extent(handle, +- inode, map, path, &allocated); ++ inode, map, path, flags, &allocated); + if (IS_ERR(path)) + err = PTR_ERR(path); + goto out; +-- +2.51.0 + diff --git a/queue-6.19/ext4-use-reserved-metadata-blocks-when-splitting-ext.patch b/queue-6.19/ext4-use-reserved-metadata-blocks-when-splitting-ext.patch new file mode 100644 index 00000000000..ae2d6c94fe6 --- /dev/null +++ b/queue-6.19/ext4-use-reserved-metadata-blocks-when-splitting-ext.patch @@ -0,0 +1,64 @@ +From 4988768c6be33f1a95d662e6c7279543ea1c3250 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 09:45:16 +0800 +Subject: ext4: use reserved metadata blocks when splitting extent on endio + +From: Zhang Yi + +[ Upstream commit 01942af95ab6c9d98e64ae01fdc243a03e4b973f ] + +When performing buffered writes, we may need to split and convert an +unwritten extent into a written one during the end I/O process. However, +we do not reserve space specifically for these metadata changes, we only +reserve 2% of space or 4096 blocks. To address this, we use +EXT4_GET_BLOCKS_PRE_IO to potentially split extents in advance and +EXT4_GET_BLOCKS_METADATA_NOFAIL to utilize reserved space if necessary. + +These two approaches can reduce the likelihood of running out of space +and losing data. However, these methods are merely best efforts, we +could still run out of space, and there is not much difference between +converting an extent during the writeback process and the end I/O +process, it won't increase the risk of losing data if we postpone the +conversion. + +Therefore, also use EXT4_GET_BLOCKS_METADATA_NOFAIL in +ext4_convert_unwritten_extents_endio() to prepare for the buffered I/O +iomap conversion, which may perform extent conversion during the end I/O +process. + +Signed-off-by: Zhang Yi +Reviewed-by: Jan Kara +Reviewed-by: Baokun Li +Reviewed-by: Ojaswin Mujoo +Link: https://patch.msgid.link/20260105014522.1937690-2-yi.zhang@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/extents.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 18b39eed75267..418c4351ef40c 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -3809,6 +3809,8 @@ ext4_convert_unwritten_extents_endio(handle_t *handle, struct inode *inode, + * illegal. + */ + if (ee_block != map->m_lblk || ee_len > map->m_len) { ++ int flags = EXT4_GET_BLOCKS_CONVERT | ++ EXT4_GET_BLOCKS_METADATA_NOFAIL; + #ifdef CONFIG_EXT4_DEBUG + ext4_warning(inode->i_sb, "Inode (%ld) finished: extent logical block %llu," + " len %u; IO logical block %llu, len %u", +@@ -3816,7 +3818,7 @@ ext4_convert_unwritten_extents_endio(handle_t *handle, struct inode *inode, + (unsigned long long)map->m_lblk, map->m_len); + #endif + path = ext4_split_convert_extents(handle, inode, map, path, +- EXT4_GET_BLOCKS_CONVERT, NULL); ++ flags, NULL); + if (IS_ERR(path)) + return path; + +-- +2.51.0 + diff --git a/queue-6.19/firmware-arm_ffa-unmap-rx-tx-buffers-on-init-failure.patch b/queue-6.19/firmware-arm_ffa-unmap-rx-tx-buffers-on-init-failure.patch new file mode 100644 index 00000000000..d47da74de7a --- /dev/null +++ b/queue-6.19/firmware-arm_ffa-unmap-rx-tx-buffers-on-init-failure.patch @@ -0,0 +1,39 @@ +From 7880c17f905fe40291108e459ed8f027164e1846 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Dec 2025 11:16:56 +0800 +Subject: firmware: arm_ffa: Unmap Rx/Tx buffers on init failure + +From: Haoxiang Li + +[ Upstream commit 9fda364cb78c8b9e1abe4029f877300c94655742 ] + +ffa_init() maps the Rx/Tx buffers via ffa_rxtx_map() but on the +partition setup failure path it never unmaps them. + +Add the missing ffa_rxtx_unmap() call in the error path so that +the Rx/Tx buffers are properly released before freeing the backing +pages. + +Signed-off-by: Haoxiang Li +Message-Id: <20251210031656.56194-1-lihaoxiang@isrc.iscas.ac.cn> +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_ffa/driver.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c +index c501c3104b3a4..11a702e7f641c 100644 +--- a/drivers/firmware/arm_ffa/driver.c ++++ b/drivers/firmware/arm_ffa/driver.c +@@ -2093,6 +2093,7 @@ static int __init ffa_init(void) + + pr_err("failed to setup partitions\n"); + ffa_notifications_cleanup(); ++ ffa_rxtx_unmap(drv_info->vm_id); + free_pages: + if (drv_info->tx_buffer) + free_pages_exact(drv_info->tx_buffer, rxtx_bufsz); +-- +2.51.0 + diff --git a/queue-6.19/fix-it87_wdt-early-reboot-by-reporting-running-timer.patch b/queue-6.19/fix-it87_wdt-early-reboot-by-reporting-running-timer.patch new file mode 100644 index 00000000000..79957b92fda --- /dev/null +++ b/queue-6.19/fix-it87_wdt-early-reboot-by-reporting-running-timer.patch @@ -0,0 +1,60 @@ +From c48c232fdf45ce4985cc217f1119f580e619ae35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 13:11:24 +0100 +Subject: fix it87_wdt early reboot by reporting running timer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: René Rebe + +[ Upstream commit 88b2ab346436f799b99894a3e9518a3ffa344524 ] + +Some products, such as the Ugreen DXP4800 Plus NAS, ship with the it87 +wdt enabled by the firmware and a broken BIOS option that does not +allow to change the time or turn it off. As this makes installing +Linux rather difficult, change the it87_wdt to report it running to +the watchdog core. + +Signed-off-by: René Rebe +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/it87_wdt.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/watchdog/it87_wdt.c b/drivers/watchdog/it87_wdt.c +index 3b8488c86a2f3..1d9f8591f38d8 100644 +--- a/drivers/watchdog/it87_wdt.c ++++ b/drivers/watchdog/it87_wdt.c +@@ -188,6 +188,12 @@ static void _wdt_update_timeout(unsigned int t) + superio_outb(t >> 8, WDTVALMSB); + } + ++/* Internal function, should be called after superio_select(GPIO) */ ++static bool _wdt_running(void) ++{ ++ return superio_inb(WDTVALLSB) || (max_units > 255 && superio_inb(WDTVALMSB)); ++} ++ + static int wdt_update_timeout(unsigned int t) + { + int ret; +@@ -374,6 +380,12 @@ static int __init it87_wdt_init(void) + } + } + ++ /* wdt already left running by firmware? */ ++ if (_wdt_running()) { ++ pr_info("Left running by firmware.\n"); ++ set_bit(WDOG_HW_RUNNING, &wdt_dev.status); ++ } ++ + superio_exit(); + + if (timeout < 1 || timeout > max_units * 60) { +-- +2.51.0 + diff --git a/queue-6.19/fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch b/queue-6.19/fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch new file mode 100644 index 00000000000..bad3e94441c --- /dev/null +++ b/queue-6.19/fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch @@ -0,0 +1,58 @@ +From 7431dc711a6ddc1aa70508cb2c79987adc677a0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Nov 2025 16:58:48 +0100 +Subject: fpga: of-fpga-region: Fail if any bridge is missing + +From: Romain Gantois + +[ Upstream commit c141c8221bc5089de915d9f26044df892c343c7e ] + +When parsing the region bridge list from the "fpga-bridges" device tree +property, the of-fpga-region driver will silently ignore bridges which fail +to be obtained, for example due to a missing bridge driver or invalid +phandle. + +This can lead to hardware issues if a region bridge stays coupled when +partial programming is performed. + +Fail if any of the bridges specified in "fpga-bridges" cannot be obtained. + +Signed-off-by: Romain Gantois +Link: https://lore.kernel.org/r/20251127-of-fpga-region-fail-if-bridges-not-found-v1-1-ca674f8d07eb@bootlin.com +Reviewed-by: Xu Yilun +Signed-off-by: Xu Yilun +Signed-off-by: Sasha Levin +--- + drivers/fpga/of-fpga-region.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/fpga/of-fpga-region.c b/drivers/fpga/of-fpga-region.c +index 43db4bb77138a..caa091224dc54 100644 +--- a/drivers/fpga/of-fpga-region.c ++++ b/drivers/fpga/of-fpga-region.c +@@ -83,7 +83,7 @@ static struct fpga_manager *of_fpga_region_get_mgr(struct device_node *np) + * done with the bridges. + * + * Return: 0 for success (even if there are no bridges specified) +- * or -EBUSY if any of the bridges are in use. ++ * or an error code if any of the bridges are not available. + */ + static int of_fpga_region_get_bridges(struct fpga_region *region) + { +@@ -130,10 +130,10 @@ static int of_fpga_region_get_bridges(struct fpga_region *region) + ®ion->bridge_list); + of_node_put(br); + +- /* If any of the bridges are in use, give up */ +- if (ret == -EBUSY) { ++ /* If any of the bridges are not available, give up */ ++ if (ret) { + fpga_bridges_put(®ion->bridge_list); +- return -EBUSY; ++ return ret; + } + } + +-- +2.51.0 + diff --git a/queue-6.19/fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch b/queue-6.19/fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch new file mode 100644 index 00000000000..3ca5b88f18c --- /dev/null +++ b/queue-6.19/fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch @@ -0,0 +1,50 @@ +From 3125db45a22d2c831ff80c2b7ca07334a75d90fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 18:42:11 +0530 +Subject: fs/buffer: add alert in try_to_free_buffers() for folios without + buffers + +From: Deepakkumar Karn + +[ Upstream commit b68f91ef3b3fe82ad78c417de71b675699a8467c ] + +try_to_free_buffers() can be called on folios with no buffers attached +when filemap_release_folio() is invoked on a folio belonging to a mapping +with AS_RELEASE_ALWAYS set but no release_folio operation defined. + +In such cases, folio_needs_release() returns true because of the +AS_RELEASE_ALWAYS flag, but the folio has no private buffer data. This +causes try_to_free_buffers() to call drop_buffers() on a folio with no +buffers, leading to a null pointer dereference. + +Adding a check in try_to_free_buffers() to return early if the folio has no +buffers attached, with WARN_ON_ONCE() to alert about the misconfiguration. +This provides defensive hardening. + +Signed-off-by: Deepakkumar Karn +Link: https://patch.msgid.link/20251211131211.308021-1-dkarn@redhat.com +Reviewed-by: Jan Kara +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/buffer.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/buffer.c b/fs/buffer.c +index 838c0c5710229..28e4d53f17173 100644 +--- a/fs/buffer.c ++++ b/fs/buffer.c +@@ -2948,6 +2948,10 @@ bool try_to_free_buffers(struct folio *folio) + if (folio_test_writeback(folio)) + return false; + ++ /* Misconfigured folio check */ ++ if (WARN_ON_ONCE(!folio_buffers(folio))) ++ return true; ++ + if (mapping == NULL) { /* can this still happen? */ + ret = drop_buffers(folio, &buffers_to_free); + goto out; +-- +2.51.0 + diff --git a/queue-6.19/fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch b/queue-6.19/fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch new file mode 100644 index 00000000000..397e9c0b7d2 --- /dev/null +++ b/queue-6.19/fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch @@ -0,0 +1,45 @@ +From 802b713c4a9c880ddad30294ecf4f1a628f2ecbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 16:07:32 +0100 +Subject: fs/ntfs3: avoid calling run_get_entry() when run == NULL in + ntfs_read_run_nb_ra() + +From: Konstantin Komarov + +[ Upstream commit c5226b96c08a010ebef5fdf4c90572bcd89e4299 ] + +When ntfs_read_run_nb_ra() is invoked with run == NULL the code later +assumes run is valid and may call run_get_entry(NULL, ...), and also +uses clen/idx without initializing them. Smatch reported uninitialized +variable warnings and this can lead to undefined behaviour. This patch +fixes it. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202512230646.v5hrYXL0-lkp@intel.com/ +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/fsntfs.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c +index bd67ba7b50153..ea5b673462c35 100644 +--- a/fs/ntfs3/fsntfs.c ++++ b/fs/ntfs3/fsntfs.c +@@ -1252,6 +1252,12 @@ int ntfs_read_run_nb(struct ntfs_sb_info *sbi, const struct runs_tree *run, + + } while (len32); + ++ if (!run) { ++ err = -EINVAL; ++ goto out; ++ } ++ ++ /* Get next fragment to read. */ + vcn_next = vcn + clen; + if (!run_get_entry(run, ++idx, &vcn, &lcn, &clen) || + vcn != vcn_next) { +-- +2.51.0 + diff --git a/queue-6.19/fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch b/queue-6.19/fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch new file mode 100644 index 00000000000..cadbd9cefe1 --- /dev/null +++ b/queue-6.19/fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch @@ -0,0 +1,58 @@ +From 34564054bd7812b16ff17b03cd3fdb38594e3d2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 19:59:59 +0900 +Subject: fs: ntfs3: check return value of indx_find to avoid infinite loop + +From: Jaehun Gou + +[ Upstream commit 1732053c8a6b360e2d5afb1b34fe9779398b072c ] + +We found an infinite loop bug in the ntfs3 file system that can lead to a +Denial-of-Service (DoS) condition. + +A malformed dentry in the ntfs3 filesystem can cause the kernel to hang +during the lookup operations. By setting the HAS_SUB_NODE flag in an +INDEX_ENTRY within a directory's INDEX_ALLOCATION block and manipulating the +VCN pointer, an attacker can cause the indx_find() function to repeatedly +read the same block, allocating 4 KB of memory each time. The kernel lacks +VCN loop detection and depth limits, causing memory exhaustion and an OOM +crash. + +This patch adds a return value check for fnd_push() to prevent a memory +exhaustion vulnerability caused by infinite loops. When the index exceeds the +size of the fnd->nodes array, fnd_push() returns -EINVAL. The indx_find() +function checks this return value and stops processing, preventing further +memory allocation. + +Co-developed-by: Seunghun Han +Signed-off-by: Seunghun Han +Co-developed-by: Jihoon Kwon +Signed-off-by: Jihoon Kwon +Signed-off-by: Jaehun Gou +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/index.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c +index 7157cfd70fdcb..75b94beac1613 100644 +--- a/fs/ntfs3/index.c ++++ b/fs/ntfs3/index.c +@@ -1190,7 +1190,12 @@ int indx_find(struct ntfs_index *indx, struct ntfs_inode *ni, + return -EINVAL; + } + +- fnd_push(fnd, node, e); ++ err = fnd_push(fnd, node, e); ++ ++ if (err) { ++ put_indx_node(node); ++ return err; ++ } + } + + *entry = e; +-- +2.51.0 + diff --git a/queue-6.19/fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch b/queue-6.19/fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch new file mode 100644 index 00000000000..06bcd64a7e2 --- /dev/null +++ b/queue-6.19/fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch @@ -0,0 +1,38 @@ +From 1f7a6617f3dcd1ee0ed5473580e9e664b24070d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Dec 2025 14:27:48 +0300 +Subject: fs/ntfs3: drop preallocated clusters for sparse and compressed files + +From: Konstantin Komarov + +[ Upstream commit 3a6aba7f3cf2b46816e08548c254d98de9c74eba ] + +Do not keep preallocated clusters for sparsed and compressed files. +Preserving preallocation in these cases causes fsx failures when running +with sparse files and preallocation enabled. + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index c45880ab23912..0cd15a0983fee 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -448,8 +448,10 @@ int attr_set_size(struct ntfs_inode *ni, enum ATTR_TYPE type, + + is_ext = is_attr_ext(attr_b); + align = sbi->cluster_size; +- if (is_ext) ++ if (is_ext) { + align <<= attr_b->nres.c_unit; ++ keep_prealloc = false; ++ } + + old_valid = le64_to_cpu(attr_b->nres.valid_size); + old_size = le64_to_cpu(attr_b->nres.data_size); +-- +2.51.0 + diff --git a/queue-6.19/fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch b/queue-6.19/fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch new file mode 100644 index 00000000000..fe262e269c4 --- /dev/null +++ b/queue-6.19/fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch @@ -0,0 +1,83 @@ +From 9db13a9143f86d3678ae8096b09a41dcb1e497ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 20:01:09 +0900 +Subject: fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent + metadata + +From: Jaehun Gou + +[ Upstream commit 4b90f16e4bb5607fb35e7802eb67874038da4640 ] + +We found an infinite loop bug in the ntfs3 file system that can lead to a +Denial-of-Service (DoS) condition. + +A malformed NTFS image can cause an infinite loop when an attribute header +indicates an empty run list, while directory entries reference it as +containing actual data. In NTFS, setting evcn=-1 with svcn=0 is a valid way +to represent an empty run list, and run_unpack() correctly handles this by +checking if evcn + 1 equals svcn and returning early without parsing any run +data. However, this creates a problem when there is metadata inconsistency, +where the attribute header claims to be empty (evcn=-1) but the caller +expects to read actual data. When run_unpack() immediately returns success +upon seeing this condition, it leaves the runs_tree uninitialized with +run->runs as a NULL. The calling function attr_load_runs_range() assumes +that a successful return means that the runs were loaded and sets clen to 0, +expecting the next run_lookup_entry() call to succeed. Because runs_tree +remains uninitialized, run_lookup_entry() continues to fail, and the loop +increments vcn by zero (vcn += 0), leading to an infinite loop. + +This patch adds a retry counter to detect when run_lookup_entry() fails +consecutively after attr_load_runs_vcn(). If the run is still not found on +the second attempt, it indicates corrupted metadata and returns -EINVAL, +preventing the Denial-of-Service (DoS) vulnerability. + +Co-developed-by: Seunghun Han +Signed-off-by: Seunghun Han +Co-developed-by: Jihoon Kwon +Signed-off-by: Jihoon Kwon +Signed-off-by: Jaehun Gou +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index 980ae9157248d..c45880ab23912 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -1354,19 +1354,28 @@ int attr_load_runs_range(struct ntfs_inode *ni, enum ATTR_TYPE type, + CLST vcn; + CLST vcn_last = (to - 1) >> cluster_bits; + CLST lcn, clen; +- int err; ++ int err = 0; ++ int retry = 0; + + for (vcn = from >> cluster_bits; vcn <= vcn_last; vcn += clen) { + if (!run_lookup_entry(run, vcn, &lcn, &clen, NULL)) { ++ if (retry != 0) { /* Next run_lookup_entry(vcn) also failed. */ ++ err = -EINVAL; ++ break; ++ } + err = attr_load_runs_vcn(ni, type, name, name_len, run, + vcn); + if (err) +- return err; ++ break; ++ + clen = 0; /* Next run_lookup_entry(vcn) must be success. */ ++ retry++; + } ++ else ++ retry = 0; + } + +- return 0; ++ return err; + } + + #ifdef CONFIG_NTFS3_LZX_XPRESS +-- +2.51.0 + diff --git a/queue-6.19/fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch b/queue-6.19/fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch new file mode 100644 index 00000000000..36b59e45daf --- /dev/null +++ b/queue-6.19/fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch @@ -0,0 +1,68 @@ +From c7feeb777b38426b734bfecc5688516d00b5d57a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 20:01:46 +0900 +Subject: fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST + +From: Jaehun Gou + +[ Upstream commit 06909b2549d631a47fcda249d34be26f7ca1711d ] + +We found an infinite loop bug in the ntfs3 file system that can lead to a +Denial-of-Service (DoS) condition. + +A malformed NTFS image can cause an infinite loop when an ATTR_LIST attribute +indicates a zero data size while the driver allocates memory for it. + +When ntfs_load_attr_list() processes a resident ATTR_LIST with data_size set +to zero, it still allocates memory because of al_aligned(0). This creates an +inconsistent state where ni->attr_list.size is zero, but ni->attr_list.le is +non-null. This causes ni_enum_attr_ex to incorrectly assume that no attribute +list exists and enumerates only the primary MFT record. When it finds +ATTR_LIST, the code reloads it and restarts the enumeration, repeating +indefinitely. The mount operation never completes, hanging the kernel thread. + +This patch adds validation to ensure that data_size is non-zero before memory +allocation. When a zero-sized ATTR_LIST is detected, the function returns +-EINVAL, preventing a DoS vulnerability. + +Co-developed-by: Seunghun Han +Signed-off-by: Seunghun Han +Co-developed-by: Jihoon Kwon +Signed-off-by: Jihoon Kwon +Signed-off-by: Jaehun Gou +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrlist.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/fs/ntfs3/attrlist.c b/fs/ntfs3/attrlist.c +index a4d74bed74fab..098bd7e8c3d64 100644 +--- a/fs/ntfs3/attrlist.c ++++ b/fs/ntfs3/attrlist.c +@@ -52,6 +52,11 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr) + + if (!attr->non_res) { + lsize = le32_to_cpu(attr->res.data_size); ++ if (!lsize) { ++ err = -EINVAL; ++ goto out; ++ } ++ + /* attr is resident: lsize < record_size (1K or 4K) */ + le = kvmalloc(al_aligned(lsize), GFP_KERNEL); + if (!le) { +@@ -66,6 +71,10 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr) + u16 run_off = le16_to_cpu(attr->nres.run_off); + + lsize = le64_to_cpu(attr->nres.data_size); ++ if (!lsize) { ++ err = -EINVAL; ++ goto out; ++ } + + run_init(&ni->attr_list.run); + +-- +2.51.0 + diff --git a/queue-6.19/fs-ntfs3-handle-attr_set_size-errors-when-truncating.patch b/queue-6.19/fs-ntfs3-handle-attr_set_size-errors-when-truncating.patch new file mode 100644 index 00000000000..7f1d726e26c --- /dev/null +++ b/queue-6.19/fs-ntfs3-handle-attr_set_size-errors-when-truncating.patch @@ -0,0 +1,67 @@ +From 217068a672b0ec92634dda869b775b87e35644b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Dec 2025 14:33:19 +0300 +Subject: fs/ntfs3: handle attr_set_size() errors when truncating files + +From: Konstantin Komarov + +[ Upstream commit 576248a34b927e93b2fd3fff7df735ba73ad7d01 ] + +If attr_set_size() fails while truncating down, the error is silently +ignored and the inode may be left in an inconsistent state. + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/file.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c +index 5120bd7851694..13d014b878f6c 100644 +--- a/fs/ntfs3/file.c ++++ b/fs/ntfs3/file.c +@@ -505,8 +505,8 @@ static int ntfs_truncate(struct inode *inode, loff_t new_size) + { + struct super_block *sb = inode->i_sb; + struct ntfs_inode *ni = ntfs_i(inode); +- int err, dirty = 0; + u64 new_valid; ++ int err; + + if (!S_ISREG(inode->i_mode)) + return 0; +@@ -522,7 +522,6 @@ static int ntfs_truncate(struct inode *inode, loff_t new_size) + } + + new_valid = ntfs_up_block(sb, min_t(u64, ni->i_valid, new_size)); +- + truncate_setsize(inode, new_size); + + ni_lock(ni); +@@ -536,20 +535,19 @@ static int ntfs_truncate(struct inode *inode, loff_t new_size) + ni->i_valid = new_valid; + + ni_unlock(ni); ++ if (unlikely(err)) ++ return err; + + ni->std_fa |= FILE_ATTRIBUTE_ARCHIVE; + inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode)); + if (!IS_DIRSYNC(inode)) { +- dirty = 1; ++ mark_inode_dirty(inode); + } else { + err = ntfs_sync_inode(inode); + if (err) + return err; + } + +- if (dirty) +- mark_inode_dirty(inode); +- + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.19/gendwarfksyms-fix-build-on-32-bit-hosts.patch b/queue-6.19/gendwarfksyms-fix-build-on-32-bit-hosts.patch new file mode 100644 index 00000000000..87b191baa0b --- /dev/null +++ b/queue-6.19/gendwarfksyms-fix-build-on-32-bit-hosts.patch @@ -0,0 +1,81 @@ +From d6fa28d40b4be72789997e52bcb197734167e97e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 20:38:07 +0000 +Subject: gendwarfksyms: Fix build on 32-bit hosts +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sami Tolvanen + +[ Upstream commit ddc54f912a551f6eb0bbcfc3880f45fe27a252cb ] + +We have interchangeably used unsigned long for some of the types +defined in elfutils, assuming they're always 64-bit. This obviously +fails when building gendwarfksyms on 32-bit hosts. Fix the types. + +Reported-by: Michal Suchánek +Closes: https://lore.kernel.org/linux-modules/aRcxzPxtJblVSh1y@kitsune.suse.cz/ +Tested-by: Michal Suchánek +Signed-off-by: Sami Tolvanen +Signed-off-by: Sasha Levin +--- + scripts/gendwarfksyms/dwarf.c | 4 +++- + scripts/gendwarfksyms/symbols.c | 5 +++-- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/scripts/gendwarfksyms/dwarf.c b/scripts/gendwarfksyms/dwarf.c +index 3538a7d9cb070..e76d732f5f602 100644 +--- a/scripts/gendwarfksyms/dwarf.c ++++ b/scripts/gendwarfksyms/dwarf.c +@@ -750,6 +750,7 @@ static void process_enumerator_type(struct state *state, struct die *cache, + Dwarf_Die *die) + { + bool overridden = false; ++ unsigned long override; + Dwarf_Word value; + + if (stable) { +@@ -761,7 +762,8 @@ static void process_enumerator_type(struct state *state, struct die *cache, + return; + + overridden = kabi_get_enumerator_value( +- state->expand.current_fqn, cache->fqn, &value); ++ state->expand.current_fqn, cache->fqn, &override); ++ value = override; + } + + process_list_comma(state, cache); +diff --git a/scripts/gendwarfksyms/symbols.c b/scripts/gendwarfksyms/symbols.c +index ecddcb5ffcdfb..42cd27c9cec4f 100644 +--- a/scripts/gendwarfksyms/symbols.c ++++ b/scripts/gendwarfksyms/symbols.c +@@ -3,6 +3,7 @@ + * Copyright (C) 2024 Google LLC + */ + ++#include + #include "gendwarfksyms.h" + + #define SYMBOL_HASH_BITS 12 +@@ -242,7 +243,7 @@ static void elf_for_each_global(int fd, elf_symbol_callback_t func, void *arg) + error("elf_getdata failed: %s", elf_errmsg(-1)); + + if (shdr->sh_entsize != sym_size) +- error("expected sh_entsize (%lu) to be %zu", ++ error("expected sh_entsize (%" PRIu64 ") to be %zu", + shdr->sh_entsize, sym_size); + + nsyms = shdr->sh_size / shdr->sh_entsize; +@@ -292,7 +293,7 @@ static void set_symbol_addr(struct symbol *sym, void *arg) + hash_add(symbol_addrs, &sym->addr_hash, + symbol_addr_hash(&sym->addr)); + +- debug("%s -> { %u, %lx }", sym->name, sym->addr.section, ++ debug("%s -> { %u, %" PRIx64 " }", sym->name, sym->addr.section, + sym->addr.address); + } else if (sym->addr.section != addr->section || + sym->addr.address != addr->address) { +-- +2.51.0 + diff --git a/queue-6.19/genirq-cpuhotplug-notify-about-affinity-changes-brea.patch b/queue-6.19/genirq-cpuhotplug-notify-about-affinity-changes-brea.patch new file mode 100644 index 00000000000..dc697e0637b --- /dev/null +++ b/queue-6.19/genirq-cpuhotplug-notify-about-affinity-changes-brea.patch @@ -0,0 +1,123 @@ +From 12ee336910eab0b604d874b45fbb3a69980fe5c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 22:37:27 +0800 +Subject: genirq/cpuhotplug: Notify about affinity changes breaking the + affinity mask + +From: Imran Khan + +[ Upstream commit dd9f6d30c64001ca4dde973ac04d8d155e856743 ] + +During CPU offlining the interrupts affined to that CPU are moved to other +online CPUs, which might break the original affinity mask if the outgoing +CPU was the last online CPU in that mask. This change is not propagated to +irq_desc::affinity_notify(), which leaves users of the affinity notifier +mechanism with stale information. + +Avoid this by scheduling affinity change notification work for interrupts +that were affined to the CPU being offlined, if the new target CPU is not +part of the original affinity mask. + +Since irq_set_affinity_locked() uses the same logic to schedule affinity +change notification work, split out this logic into a dedicated function +and use that at both places. + +[ tglx: Removed the EXPORT(), removed the !SMP stub, moved the prototype, + added a lockdep assert instead of a comment, fixed up coding style + and name space. Polished and clarified the change log ] + +Signed-off-by: Imran Khan +Signed-off-by: Thomas Gleixner +Link: https://patch.msgid.link/20260113143727.1041265-1-imran.f.khan@oracle.com +Signed-off-by: Sasha Levin +--- + kernel/irq/cpuhotplug.c | 6 ++++-- + kernel/irq/internals.h | 2 +- + kernel/irq/manage.c | 26 ++++++++++++++++++-------- + 3 files changed, 23 insertions(+), 11 deletions(-) + +diff --git a/kernel/irq/cpuhotplug.c b/kernel/irq/cpuhotplug.c +index 755346ea98196..cd5689e383b00 100644 +--- a/kernel/irq/cpuhotplug.c ++++ b/kernel/irq/cpuhotplug.c +@@ -177,9 +177,11 @@ void irq_migrate_all_off_this_cpu(void) + bool affinity_broken; + + desc = irq_to_desc(irq); +- scoped_guard(raw_spinlock, &desc->lock) ++ scoped_guard(raw_spinlock, &desc->lock) { + affinity_broken = migrate_one_irq(desc); +- ++ if (affinity_broken && desc->affinity_notify) ++ irq_affinity_schedule_notify_work(desc); ++ } + if (affinity_broken) { + pr_debug_ratelimited("IRQ %u: no longer affine to CPU%u\n", + irq, smp_processor_id()); +diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h +index 0164ca48da59e..5568ed3a8b852 100644 +--- a/kernel/irq/internals.h ++++ b/kernel/irq/internals.h +@@ -135,6 +135,7 @@ extern bool irq_can_set_affinity_usr(unsigned int irq); + + extern int irq_do_set_affinity(struct irq_data *data, + const struct cpumask *dest, bool force); ++extern void irq_affinity_schedule_notify_work(struct irq_desc *desc); + + #ifdef CONFIG_SMP + extern int irq_setup_affinity(struct irq_desc *desc); +@@ -142,7 +143,6 @@ extern int irq_setup_affinity(struct irq_desc *desc); + static inline int irq_setup_affinity(struct irq_desc *desc) { return 0; } + #endif + +- + #define for_each_action_of_desc(desc, act) \ + for (act = desc->action; act; act = act->next) + +diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c +index 349ae7979da0e..4873b0f73df96 100644 +--- a/kernel/irq/manage.c ++++ b/kernel/irq/manage.c +@@ -347,6 +347,21 @@ static bool irq_set_affinity_deactivated(struct irq_data *data, + return true; + } + ++/** ++ * irq_affinity_schedule_notify_work - Schedule work to notify about affinity change ++ * @desc: Interrupt descriptor whose affinity changed ++ */ ++void irq_affinity_schedule_notify_work(struct irq_desc *desc) ++{ ++ lockdep_assert_held(&desc->lock); ++ ++ kref_get(&desc->affinity_notify->kref); ++ if (!schedule_work(&desc->affinity_notify->work)) { ++ /* Work was already scheduled, drop our extra ref */ ++ kref_put(&desc->affinity_notify->kref, desc->affinity_notify->release); ++ } ++} ++ + int irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask, + bool force) + { +@@ -367,14 +382,9 @@ int irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask, + irq_copy_pending(desc, mask); + } + +- if (desc->affinity_notify) { +- kref_get(&desc->affinity_notify->kref); +- if (!schedule_work(&desc->affinity_notify->work)) { +- /* Work was already scheduled, drop our extra ref */ +- kref_put(&desc->affinity_notify->kref, +- desc->affinity_notify->release); +- } +- } ++ if (desc->affinity_notify) ++ irq_affinity_schedule_notify_work(desc); ++ + irqd_set(data, IRQD_AFFINITY_SET); + + return ret; +-- +2.51.0 + diff --git a/queue-6.19/gfs2-fiemap-page-fault-fix.patch b/queue-6.19/gfs2-fiemap-page-fault-fix.patch new file mode 100644 index 00000000000..0415220c22c --- /dev/null +++ b/queue-6.19/gfs2-fiemap-page-fault-fix.patch @@ -0,0 +1,69 @@ +From 9eaa75258aca60dc91ba53b0c64a1e5809797f34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Feb 2026 15:52:57 +0100 +Subject: gfs2: fiemap page fault fix + +From: Andreas Gruenbacher + +[ Upstream commit e411d74cc5ba290f85d0dd5e4d1df8f1d6d975d2 ] + +In gfs2_fiemap(), we are calling iomap_fiemap() while holding the inode +glock. This can lead to recursive glock taking if the fiemap buffer is +memory mapped to the same inode and accessing it triggers a page fault. + +Fix by disabling page faults for iomap_fiemap() and faulting in the +buffer by hand if necessary. + +Fixes xfstest generic/742. + +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/inode.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c +index b6ed069b34872..4d65e4a752626 100644 +--- a/fs/gfs2/inode.c ++++ b/fs/gfs2/inode.c +@@ -2192,6 +2192,14 @@ static int gfs2_getattr(struct mnt_idmap *idmap, + return 0; + } + ++static bool fault_in_fiemap(struct fiemap_extent_info *fi) ++{ ++ struct fiemap_extent __user *dest = fi->fi_extents_start; ++ size_t size = sizeof(*dest) * fi->fi_extents_max; ++ ++ return fault_in_safe_writeable((char __user *)dest, size) == 0; ++} ++ + static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, + u64 start, u64 len) + { +@@ -2201,14 +2209,22 @@ static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, + + inode_lock_shared(inode); + ++retry: + ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_SHARED, 0, &gh); + if (ret) + goto out; + ++ pagefault_disable(); + ret = iomap_fiemap(inode, fieinfo, start, len, &gfs2_iomap_ops); ++ pagefault_enable(); + + gfs2_glock_dq_uninit(&gh); + ++ if (ret == -EFAULT && fault_in_fiemap(fieinfo)) { ++ fieinfo->fi_extents_mapped = 0; ++ goto retry; ++ } ++ + out: + inode_unlock_shared(inode); + return ret; +-- +2.51.0 + diff --git a/queue-6.19/gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch b/queue-6.19/gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch new file mode 100644 index 00000000000..9588030ba2d --- /dev/null +++ b/queue-6.19/gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch @@ -0,0 +1,56 @@ +From 27dc99fe47651f34265e7341a5d26cbc5935e157 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 17:26:26 +0800 +Subject: gpio: aspeed-sgpio: Change the macro to support deferred probe + +From: Billy Tsai + +[ Upstream commit e18533b023ec7a33488bcf33140ce69bbba2894f ] + +Use module_platform_driver() to replace module_platform_driver_probe(). +The former utilizes platform_driver_register(), which allows the driver to +defer probing when it doesn't acquire the necessary resources due to probe +order. In contrast, the latter uses __platform_driver_probe(), which +includes the comment "Note that this is incompatible with deferred +probing." Since our SGPIO driver requires access to the clock resource, the +former is more suitable. + +Reviewed-by: Linus Walleij +Signed-off-by: Billy Tsai +Link: https://lore.kernel.org/r/20260123-upstream_sgpio-v2-1-69cfd1631400@aspeedtech.com +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-aspeed-sgpio.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpio/gpio-aspeed-sgpio.c b/drivers/gpio/gpio-aspeed-sgpio.c +index 7622f9e9f54af..318cd0e397416 100644 +--- a/drivers/gpio/gpio-aspeed-sgpio.c ++++ b/drivers/gpio/gpio-aspeed-sgpio.c +@@ -516,7 +516,7 @@ static const struct of_device_id aspeed_sgpio_of_table[] = { + + MODULE_DEVICE_TABLE(of, aspeed_sgpio_of_table); + +-static int __init aspeed_sgpio_probe(struct platform_device *pdev) ++static int aspeed_sgpio_probe(struct platform_device *pdev) + { + u32 nr_gpios, sgpio_freq, sgpio_clk_div, gpio_cnt_regval, pin_mask; + const struct aspeed_sgpio_pdata *pdata; +@@ -611,11 +611,12 @@ static int __init aspeed_sgpio_probe(struct platform_device *pdev) + } + + static struct platform_driver aspeed_sgpio_driver = { ++ .probe = aspeed_sgpio_probe, + .driver = { + .name = KBUILD_MODNAME, + .of_match_table = aspeed_sgpio_of_table, + }, + }; + +-module_platform_driver_probe(aspeed_sgpio_driver, aspeed_sgpio_probe); ++module_platform_driver(aspeed_sgpio_driver); + MODULE_DESCRIPTION("Aspeed Serial GPIO Driver"); +-- +2.51.0 + diff --git a/queue-6.19/gpio-pca953x-add-support-for-tcal6408-tcal6416.patch b/queue-6.19/gpio-pca953x-add-support-for-tcal6408-tcal6416.patch new file mode 100644 index 00000000000..b37fa01035d --- /dev/null +++ b/queue-6.19/gpio-pca953x-add-support-for-tcal6408-tcal6416.patch @@ -0,0 +1,73 @@ +From 853dee20eb9f4edc5ba62a054a34c8eb85af2dcf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 08:39:35 +0100 +Subject: gpio: pca953x: Add support for TCAL6408 TCAL6416 + +From: Jan Remmet + +[ Upstream commit a30a9cb9bca4296d25f253619883e7013b6be158 ] + +TCAL6408 and TCAL6416 supports latchable inputs and maskable interrupt. +Tested on a TCAL6416, checked datasheets for the TCAL6408. + +They use the same programming model ad the NXP PCAL64xx, but +support a lower supply power (1.08V to 3.6V) compared to PCAL +(1.65V to 5.5V) + +Datasheet: https://www.ti.com/lit/ds/symlink/tcal6408.pdf +Datasheet: https://www.ti.com/lit/ds/symlink/tcal6416.pdf + +Signed-off-by: Jan Remmet +Link: https://lore.kernel.org/r/20251216-wip-jremmet-tcal6416rtw-v2-3-6516d98a9836@phytec.de +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/Kconfig | 4 ++-- + drivers/gpio/gpio-pca953x.c | 6 ++++++ + 2 files changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig +index bd185482a7fdf..3439e025ba1c6 100644 +--- a/drivers/gpio/Kconfig ++++ b/drivers/gpio/Kconfig +@@ -1193,11 +1193,11 @@ config GPIO_PCA953X + + 8 bits: max7310, max7315, pca6107, pca9534, pca9538, pca9554, + pca9556, pca9557, pca9574, tca6408, tca9554, xra1202, +- pcal6408, pcal9554b, tca9538 ++ pcal6408, pcal9554b, tca9538, tcal6408 + + 16 bits: max7312, max7313, pca9535, pca9539, pca9555, pca9575, + tca6416, pca6416, pcal6416, pcal9535, pcal9555a, max7318, +- tca9539 ++ tca9539, tcal6416 + + 18 bits: tca6418 + +diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c +index f93a3dbb2daaf..52e96cc5f67bb 100644 +--- a/drivers/gpio/gpio-pca953x.c ++++ b/drivers/gpio/gpio-pca953x.c +@@ -126,6 +126,9 @@ static const struct i2c_device_id pca953x_id[] = { + { "tca9539", 16 | PCA953X_TYPE | PCA_INT, }, + { "tca9554", 8 | PCA953X_TYPE | PCA_INT, }, + { "xra1202", 8 | PCA953X_TYPE }, ++ ++ { "tcal6408", 8 | PCA953X_TYPE | PCA_LATCH_INT, }, ++ { "tcal6416", 16 | PCA953X_TYPE | PCA_LATCH_INT, }, + { } + }; + MODULE_DEVICE_TABLE(i2c, pca953x_id); +@@ -1469,6 +1472,9 @@ static const struct of_device_id pca953x_dt_ids[] = { + { .compatible = "ti,tca9538", .data = OF_953X( 8, PCA_INT), }, + { .compatible = "ti,tca9539", .data = OF_953X(16, PCA_INT), }, + ++ { .compatible = "ti,tcal6408", .data = OF_953X( 8, PCA_LATCH_INT), }, ++ { .compatible = "ti,tcal6416", .data = OF_953X(16, PCA_LATCH_INT), }, ++ + { .compatible = "onnn,cat9554", .data = OF_953X( 8, PCA_INT), }, + { .compatible = "onnn,pca9654", .data = OF_953X( 8, PCA_INT), }, + { .compatible = "onnn,pca9655", .data = OF_953X(16, PCA_INT), }, +-- +2.51.0 + diff --git a/queue-6.19/gpu-panel-edp-add-auo-panel-entry-for-b140han06.4.patch b/queue-6.19/gpu-panel-edp-add-auo-panel-entry-for-b140han06.4.patch new file mode 100644 index 00000000000..92e22b1052a --- /dev/null +++ b/queue-6.19/gpu-panel-edp-add-auo-panel-entry-for-b140han06.4.patch @@ -0,0 +1,53 @@ +From 8b14ad16d2dd92b369eec2c12edfd14e1e89608f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Dec 2025 07:45:55 +0000 +Subject: gpu/panel-edp: add AUO panel entry for B140HAN06.4 + +From: Alexey Klimov + +[ Upstream commit 2976aeb0de77da599ad37691963efbdcb07435ce ] + +Add an eDP panel entry for AUO B140HAN06.4 that is also used in +some variants of Lenovo Flex 5G with Qcom SC8180 SoC. + +The raw edid of the panel is: + +00 ff ff ff ff ff ff 00 06 af 3d 64 00 00 00 00 +2b 1d 01 04 a5 1f 11 78 03 b8 1a a6 54 4a 9b 26 +0e 52 55 00 00 00 01 01 01 01 01 01 01 01 01 01 +01 01 01 01 01 01 14 37 80 b8 70 38 24 40 10 10 +3e 00 35 ae 10 00 00 18 10 2c 80 b8 70 38 24 40 +10 10 3e 00 35 ae 10 00 00 18 00 00 00 fe 00 41 +55 4f 0a 20 20 20 20 20 20 20 20 20 00 00 00 fe +00 42 31 34 30 48 41 4e 30 36 2e 34 20 0a 00 eb + +I do not have access to the datasheet and but it is tested on above +mentioned laptop for a few weeks and seems to work just fine with +timing info of similar panels. + +Cc: Bjorn Andersson +Cc: Vinod Koul +Signed-off-by: Alexey Klimov +Reviewed-by: Douglas Anderson +Signed-off-by: Douglas Anderson +Link: https://patch.msgid.link/20251203074555.690613-1-alexey.klimov@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-edp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c +index 023fbbb10eb4f..2c35970377431 100644 +--- a/drivers/gpu/drm/panel/panel-edp.c ++++ b/drivers/gpu/drm/panel/panel-edp.c +@@ -1904,6 +1904,7 @@ static const struct edp_panel_entry edp_panels[] = { + EDP_PANEL_ENTRY('A', 'U', 'O', 0x615c, &delay_200_500_e50, "B116XAN06.1"), + EDP_PANEL_ENTRY('A', 'U', 'O', 0x635c, &delay_200_500_e50, "B116XAN06.3"), + EDP_PANEL_ENTRY('A', 'U', 'O', 0x639c, &delay_200_500_e50, "B140HAK02.7"), ++ EDP_PANEL_ENTRY('A', 'U', 'O', 0x643d, &delay_200_500_e50, "B140HAN06.4"), + EDP_PANEL_ENTRY('A', 'U', 'O', 0x723c, &delay_200_500_e50, "B140XTN07.2"), + EDP_PANEL_ENTRY('A', 'U', 'O', 0x73aa, &delay_200_500_e50, "B116XTN02.3"), + EDP_PANEL_ENTRY('A', 'U', 'O', 0x8594, &delay_200_500_e50, "B133UAN01.0"), +-- +2.51.0 + diff --git a/queue-6.19/gro-change-the-bug_on-in-gro_pull_from_frag0.patch b/queue-6.19/gro-change-the-bug_on-in-gro_pull_from_frag0.patch new file mode 100644 index 00000000000..2c6b077f05a --- /dev/null +++ b/queue-6.19/gro-change-the-bug_on-in-gro_pull_from_frag0.patch @@ -0,0 +1,46 @@ +From 4565f3559a6fea2e483710e1eb701d917da79d8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 04:57:17 +0000 +Subject: gro: change the BUG_ON() in gro_pull_from_frag0() + +From: Eric Dumazet + +[ Upstream commit cbe41362be2c27e0237a94a404ae413cec9c2ad9 ] + +Replace the BUG_ON() which never fired with a DEBUG_NET_WARN_ON_ONCE() + +$ scripts/bloat-o-meter -t vmlinux.1 vmlinux.2 +add/remove: 2/2 grow/shrink: 1/1 up/down: 370/-254 (116) +Function old new delta +gro_try_pull_from_frag0 - 196 +196 +napi_gro_frags 771 929 +158 +__pfx_gro_try_pull_from_frag0 - 16 +16 +__pfx_gro_pull_from_frag0 16 - -16 +dev_gro_receive 1514 1464 -50 +gro_pull_from_frag0 188 - -188 +Total: Before=22565899, After=22566015, chg +0.00% + +Signed-off-by: Eric Dumazet +Link: https://patch.msgid.link/20260122045720.1221017-3-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/gro.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/gro.c b/net/core/gro.c +index 482fa7d7f5981..ef61695fbdbb6 100644 +--- a/net/core/gro.c ++++ b/net/core/gro.c +@@ -417,7 +417,7 @@ static void gro_pull_from_frag0(struct sk_buff *skb, int grow) + { + struct skb_shared_info *pinfo = skb_shinfo(skb); + +- BUG_ON(skb->end - skb->tail < grow); ++ DEBUG_NET_WARN_ON_ONCE(skb->end - skb->tail < grow); + + memcpy(skb_tail_pointer(skb), NAPI_GRO_CB(skb)->frag0, grow); + +-- +2.51.0 + diff --git a/queue-6.19/hfs-replace-bug_on-with-error-handling-for-cnid-coun.patch b/queue-6.19/hfs-replace-bug_on-with-error-handling-for-cnid-coun.patch new file mode 100644 index 00000000000..07218437db2 --- /dev/null +++ b/queue-6.19/hfs-replace-bug_on-with-error-handling-for-cnid-coun.patch @@ -0,0 +1,266 @@ +From 2037b1ef27b4a2dc3b92ff43fd004dcd1add2f25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Dec 2025 20:10:06 +0100 +Subject: hfs: Replace BUG_ON with error handling for CNID count checks + +From: Jori Koolstra + +[ Upstream commit b226804532a875c10276168dc55ce752944096bd ] + +In a06ec283e125 next_id, folder_count, and file_count in the super block +info were expanded to 64 bits, and BUG_ONs were added to detect +overflow. This triggered an error reported by syzbot: if the MDB is +corrupted, the BUG_ON is triggered. This patch replaces this mechanism +with proper error handling and resolves the syzbot reported bug. + +Singed-off-by: Jori Koolstra +Reported-by: syzbot+17cc9bb6d8d69b4139f0@syzkaller.appspotmail.com +Closes: https://syzbot.org/bug?extid=17cc9bb6d8d69b4139f0 +Signed-off-by: Jori Koolstra +Reviewed-by: Viacheslav Dubeyko +Signed-off-by: Viacheslav Dubeyko +Link: https://lore.kernel.org/r/20251220191006.2465256-1-jkoolstra@xs4all.nl +Signed-off-by: Viacheslav Dubeyko +Signed-off-by: Sasha Levin +--- + fs/hfs/dir.c | 15 +++++++++++---- + fs/hfs/hfs_fs.h | 1 + + fs/hfs/inode.c | 30 ++++++++++++++++++++++++------ + fs/hfs/mdb.c | 31 +++++++++++++++++++++++++++---- + fs/hfs/super.c | 3 +++ + 5 files changed, 66 insertions(+), 14 deletions(-) + +diff --git a/fs/hfs/dir.c b/fs/hfs/dir.c +index 86a6b317b474a..0c615c078650c 100644 +--- a/fs/hfs/dir.c ++++ b/fs/hfs/dir.c +@@ -196,8 +196,8 @@ static int hfs_create(struct mnt_idmap *idmap, struct inode *dir, + int res; + + inode = hfs_new_inode(dir, &dentry->d_name, mode); +- if (!inode) +- return -ENOMEM; ++ if (IS_ERR(inode)) ++ return PTR_ERR(inode); + + res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode); + if (res) { +@@ -226,8 +226,8 @@ static struct dentry *hfs_mkdir(struct mnt_idmap *idmap, struct inode *dir, + int res; + + inode = hfs_new_inode(dir, &dentry->d_name, S_IFDIR | mode); +- if (!inode) +- return ERR_PTR(-ENOMEM); ++ if (IS_ERR(inode)) ++ return ERR_CAST(inode); + + res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode); + if (res) { +@@ -254,11 +254,18 @@ static struct dentry *hfs_mkdir(struct mnt_idmap *idmap, struct inode *dir, + */ + static int hfs_remove(struct inode *dir, struct dentry *dentry) + { ++ struct super_block *sb = dir->i_sb; + struct inode *inode = d_inode(dentry); + int res; + + if (S_ISDIR(inode->i_mode) && inode->i_size != 2) + return -ENOTEMPTY; ++ ++ if (unlikely(!is_hfs_cnid_counts_valid(sb))) { ++ pr_err("cannot remove file/folder\n"); ++ return -ERANGE; ++ } ++ + res = hfs_cat_delete(inode->i_ino, dir, &dentry->d_name); + if (res) + return res; +diff --git a/fs/hfs/hfs_fs.h b/fs/hfs/hfs_fs.h +index e94dbc04a1e43..ac0e83f77a0f1 100644 +--- a/fs/hfs/hfs_fs.h ++++ b/fs/hfs/hfs_fs.h +@@ -199,6 +199,7 @@ extern void hfs_delete_inode(struct inode *inode); + extern const struct xattr_handler * const hfs_xattr_handlers[]; + + /* mdb.c */ ++extern bool is_hfs_cnid_counts_valid(struct super_block *sb); + extern int hfs_mdb_get(struct super_block *sb); + extern void hfs_mdb_commit(struct super_block *sb); + extern void hfs_mdb_close(struct super_block *sb); +diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c +index 524db1389737d..878535db64d67 100644 +--- a/fs/hfs/inode.c ++++ b/fs/hfs/inode.c +@@ -187,16 +187,23 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t + s64 next_id; + s64 file_count; + s64 folder_count; ++ int err = -ENOMEM; + + if (!inode) +- return NULL; ++ goto out_err; ++ ++ err = -ERANGE; + + mutex_init(&HFS_I(inode)->extents_lock); + INIT_LIST_HEAD(&HFS_I(inode)->open_dir_list); + spin_lock_init(&HFS_I(inode)->open_dir_lock); + hfs_cat_build_key(sb, (btree_key *)&HFS_I(inode)->cat_key, dir->i_ino, name); + next_id = atomic64_inc_return(&HFS_SB(sb)->next_id); +- BUG_ON(next_id > U32_MAX); ++ if (next_id > U32_MAX) { ++ atomic64_dec(&HFS_SB(sb)->next_id); ++ pr_err("cannot create new inode: next CNID exceeds limit\n"); ++ goto out_discard; ++ } + inode->i_ino = (u32)next_id; + inode->i_mode = mode; + inode->i_uid = current_fsuid(); +@@ -210,7 +217,11 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t + if (S_ISDIR(mode)) { + inode->i_size = 2; + folder_count = atomic64_inc_return(&HFS_SB(sb)->folder_count); +- BUG_ON(folder_count > U32_MAX); ++ if (folder_count> U32_MAX) { ++ atomic64_dec(&HFS_SB(sb)->folder_count); ++ pr_err("cannot create new inode: folder count exceeds limit\n"); ++ goto out_discard; ++ } + if (dir->i_ino == HFS_ROOT_CNID) + HFS_SB(sb)->root_dirs++; + inode->i_op = &hfs_dir_inode_operations; +@@ -220,7 +231,11 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t + } else if (S_ISREG(mode)) { + HFS_I(inode)->clump_blocks = HFS_SB(sb)->clumpablks; + file_count = atomic64_inc_return(&HFS_SB(sb)->file_count); +- BUG_ON(file_count > U32_MAX); ++ if (file_count > U32_MAX) { ++ atomic64_dec(&HFS_SB(sb)->file_count); ++ pr_err("cannot create new inode: file count exceeds limit\n"); ++ goto out_discard; ++ } + if (dir->i_ino == HFS_ROOT_CNID) + HFS_SB(sb)->root_files++; + inode->i_op = &hfs_file_inode_operations; +@@ -244,6 +259,11 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t + hfs_mark_mdb_dirty(sb); + + return inode; ++ ++ out_discard: ++ iput(inode); ++ out_err: ++ return ERR_PTR(err); + } + + void hfs_delete_inode(struct inode *inode) +@@ -252,7 +272,6 @@ void hfs_delete_inode(struct inode *inode) + + hfs_dbg("ino %lu\n", inode->i_ino); + if (S_ISDIR(inode->i_mode)) { +- BUG_ON(atomic64_read(&HFS_SB(sb)->folder_count) > U32_MAX); + atomic64_dec(&HFS_SB(sb)->folder_count); + if (HFS_I(inode)->cat_key.ParID == cpu_to_be32(HFS_ROOT_CNID)) + HFS_SB(sb)->root_dirs--; +@@ -261,7 +280,6 @@ void hfs_delete_inode(struct inode *inode) + return; + } + +- BUG_ON(atomic64_read(&HFS_SB(sb)->file_count) > U32_MAX); + atomic64_dec(&HFS_SB(sb)->file_count); + if (HFS_I(inode)->cat_key.ParID == cpu_to_be32(HFS_ROOT_CNID)) + HFS_SB(sb)->root_files--; +diff --git a/fs/hfs/mdb.c b/fs/hfs/mdb.c +index f28cd24dee842..a97cea35ca2e1 100644 +--- a/fs/hfs/mdb.c ++++ b/fs/hfs/mdb.c +@@ -64,6 +64,27 @@ static int hfs_get_last_session(struct super_block *sb, + return 0; + } + ++bool is_hfs_cnid_counts_valid(struct super_block *sb) ++{ ++ struct hfs_sb_info *sbi = HFS_SB(sb); ++ bool corrupted = false; ++ ++ if (unlikely(atomic64_read(&sbi->next_id) > U32_MAX)) { ++ pr_warn("next CNID exceeds limit\n"); ++ corrupted = true; ++ } ++ if (unlikely(atomic64_read(&sbi->file_count) > U32_MAX)) { ++ pr_warn("file count exceeds limit\n"); ++ corrupted = true; ++ } ++ if (unlikely(atomic64_read(&sbi->folder_count) > U32_MAX)) { ++ pr_warn("folder count exceeds limit\n"); ++ corrupted = true; ++ } ++ ++ return !corrupted; ++} ++ + /* + * hfs_mdb_get() + * +@@ -159,6 +180,11 @@ int hfs_mdb_get(struct super_block *sb) + atomic64_set(&HFS_SB(sb)->file_count, be32_to_cpu(mdb->drFilCnt)); + atomic64_set(&HFS_SB(sb)->folder_count, be32_to_cpu(mdb->drDirCnt)); + ++ if (!is_hfs_cnid_counts_valid(sb)) { ++ pr_warn("filesystem possibly corrupted, running fsck.hfs is recommended. Mounting read-only.\n"); ++ sb->s_flags |= SB_RDONLY; ++ } ++ + /* TRY to get the alternate (backup) MDB. */ + sect = part_start + part_size - 2; + bh = sb_bread512(sb, sect, mdb2); +@@ -212,7 +238,7 @@ int hfs_mdb_get(struct super_block *sb) + + attrib = mdb->drAtrb; + if (!(attrib & cpu_to_be16(HFS_SB_ATTRIB_UNMNT))) { +- pr_warn("filesystem was not cleanly unmounted, running fsck.hfs is recommended. mounting read-only.\n"); ++ pr_warn("filesystem was not cleanly unmounted, running fsck.hfs is recommended. Mounting read-only.\n"); + sb->s_flags |= SB_RDONLY; + } + if ((attrib & cpu_to_be16(HFS_SB_ATTRIB_SLOCK))) { +@@ -270,15 +296,12 @@ void hfs_mdb_commit(struct super_block *sb) + /* These parameters may have been modified, so write them back */ + mdb->drLsMod = hfs_mtime(); + mdb->drFreeBks = cpu_to_be16(HFS_SB(sb)->free_ablocks); +- BUG_ON(atomic64_read(&HFS_SB(sb)->next_id) > U32_MAX); + mdb->drNxtCNID = + cpu_to_be32((u32)atomic64_read(&HFS_SB(sb)->next_id)); + mdb->drNmFls = cpu_to_be16(HFS_SB(sb)->root_files); + mdb->drNmRtDirs = cpu_to_be16(HFS_SB(sb)->root_dirs); +- BUG_ON(atomic64_read(&HFS_SB(sb)->file_count) > U32_MAX); + mdb->drFilCnt = + cpu_to_be32((u32)atomic64_read(&HFS_SB(sb)->file_count)); +- BUG_ON(atomic64_read(&HFS_SB(sb)->folder_count) > U32_MAX); + mdb->drDirCnt = + cpu_to_be32((u32)atomic64_read(&HFS_SB(sb)->folder_count)); + +diff --git a/fs/hfs/super.c b/fs/hfs/super.c +index df289cbdd4e85..97546d6b41f47 100644 +--- a/fs/hfs/super.c ++++ b/fs/hfs/super.c +@@ -34,6 +34,7 @@ MODULE_LICENSE("GPL"); + + static int hfs_sync_fs(struct super_block *sb, int wait) + { ++ is_hfs_cnid_counts_valid(sb); + hfs_mdb_commit(sb); + return 0; + } +@@ -65,6 +66,8 @@ static void flush_mdb(struct work_struct *work) + sbi->work_queued = 0; + spin_unlock(&sbi->work_lock); + ++ is_hfs_cnid_counts_valid(sb); ++ + hfs_mdb_commit(sb); + } + +-- +2.51.0 + diff --git a/queue-6.19/hfsplus-fix-volume-corruption-issue-for-generic-480.patch b/queue-6.19/hfsplus-fix-volume-corruption-issue-for-generic-480.patch new file mode 100644 index 00000000000..d519c49451a --- /dev/null +++ b/queue-6.19/hfsplus-fix-volume-corruption-issue-for-generic-480.patch @@ -0,0 +1,256 @@ +From 3b402182bea5ee91bc2b9f6aeccdd972d1c17048 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Dec 2025 16:00:55 -0800 +Subject: hfsplus: fix volume corruption issue for generic/480 + +From: Viacheslav Dubeyko + +[ Upstream commit bea4429eb30190c59b5ac7c8ff6c90176c7c110f ] + +The xfstests' test-case generic/480 leaves HFS+ volume +in corrupted state: + +sudo ./check generic/480 +FSTYP -- hfsplus +PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.17.0-rc1+ #4 SMP PREEMPT_DYNAMIC Wed Oct 1 15:02:44 PDT 2025 +MKFS_OPTIONS -- /dev/loop51 +MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch + +generic/480 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent +(see XFSTESTS-2/xfstests-dev/results//generic/480.full for details) + +Ran: generic/480 +Failures: generic/480 +Failed 1 of 1 tests + +sudo fsck.hfsplus -d /dev/loop51 +** /dev/loop51 +Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K. +Executing fsck_hfs (version 540.1-Linux). +** Checking non-journaled HFS Plus Volume. +The volume name is untitled +** Checking extents overflow file. +** Checking catalog file. +** Checking multi-linked files. +CheckHardLinks: found 1 pre-Leopard file inodes. +Incorrect number of file hard links +** Checking catalog hierarchy. +** Checking extended attributes file. +** Checking volume bitmap. +** Checking volume information. +invalid VHB nextCatalogID +Volume header needs minor repair +(2, 0) +Verify Status: VIStat = 0x8000, ABTStat = 0x0000 EBTStat = 0x0000 +CBTStat = 0x0000 CatStat = 0x00000002 +** Repairing volume. +Incorrect flags for file hard link (id = 19) +(It should be 0x22 instead of 0x2) +Incorrect flags for file inode (id = 18) +(It should be 0x22 instead of 0x2) +first link ID=0 is < 16 for fileinode=18 +Error getting first link ID for inode = 18 (result=2) +Invalid first link in hard link chain (id = 18) +(It should be 19 instead of 0) +Indirect node 18 needs link count adjustment +(It should be 1 instead of 2) +** Rechecking volume. +** Checking non-journaled HFS Plus Volume. +The volume name is untitled +** Checking extents overflow file. +** Checking catalog file. +** Checking multi-linked files. +** Checking catalog hierarchy. +** Checking extended attributes file. +** Checking volume bitmap. +** Checking volume information. +** The volume untitled was repaired successfully. + +The generic/480 test executes such steps on final phase: + +"Now remove of the links of our file and create +a new file with the same name and in the same +parent directory, and finally fsync this new file." + +unlink $SCRATCH_MNT/testdir/bar +touch $SCRATCH_MNT/testdir/bar +$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/testdir/bar + +"Simulate a power failure and mount the filesystem +to check that replaying the fsync log/journal +succeeds, that is the mount operation does not fail." + +_flakey_drop_and_remount + +The key issue in HFS+ logic is that hfsplus_link(), +hfsplus_unlink(), hfsplus_rmdir(), hfsplus_symlink(), +and hfsplus_mknod() methods don't call +hfsplus_cat_write_inode() for the case of modified +inode objects. As a result, even if hfsplus_file_fsync() +is trying to flush the dirty Catalog File, but because of +not calling hfsplus_cat_write_inode() not all modified +inodes save the new state into Catalog File's records. +Finally, simulation of power failure results in inconsistent +state of Catalog File and FSCK tool reports about +volume corruption. + +This patch adds calling of hfsplus_cat_write_inode() +method for modified inodes in hfsplus_link(), +hfsplus_unlink(), hfsplus_rmdir(), hfsplus_symlink(), +and hfsplus_mknod() methods. Also, it adds debug output +in several methods. + +sudo ./check generic/480 +FSTYP -- hfsplus +PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #18 SMP PREEMPT_DYNAMIC Thu Dec 4 12:24:45 PST 2025 +MKFS_OPTIONS -- /dev/loop51 +MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch + +generic/480 16s ... 16s +Ran: generic/480 +Passed all 1 tests + +Signed-off-by: Viacheslav Dubeyko +cc: John Paul Adrian Glaubitz +cc: Yangtao Li +cc: linux-fsdevel@vger.kernel.org +Link: https://lore.kernel.org/r/20251205000054.3670326-1-slava@dubeyko.com +Signed-off-by: Viacheslav Dubeyko +Signed-off-by: Sasha Levin +--- + fs/hfsplus/dir.c | 46 +++++++++++++++++++++++++++++++++++++++++++++- + fs/hfsplus/inode.c | 5 +++++ + 2 files changed, 50 insertions(+), 1 deletion(-) + +diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c +index cadf0b5f93422..ca5f74a140ec1 100644 +--- a/fs/hfsplus/dir.c ++++ b/fs/hfsplus/dir.c +@@ -313,6 +313,9 @@ static int hfsplus_link(struct dentry *src_dentry, struct inode *dst_dir, + if (!S_ISREG(inode->i_mode)) + return -EPERM; + ++ hfs_dbg("src_dir->i_ino %lu, dst_dir->i_ino %lu, inode->i_ino %lu\n", ++ src_dir->i_ino, dst_dir->i_ino, inode->i_ino); ++ + mutex_lock(&sbi->vh_mutex); + if (inode->i_ino == (u32)(unsigned long)src_dentry->d_fsdata) { + for (;;) { +@@ -332,7 +335,7 @@ static int hfsplus_link(struct dentry *src_dentry, struct inode *dst_dir, + cnid = sbi->next_cnid++; + src_dentry->d_fsdata = (void *)(unsigned long)cnid; + res = hfsplus_create_cat(cnid, src_dir, +- &src_dentry->d_name, inode); ++ &src_dentry->d_name, inode); + if (res) + /* panic? */ + goto out; +@@ -350,6 +353,21 @@ static int hfsplus_link(struct dentry *src_dentry, struct inode *dst_dir, + mark_inode_dirty(inode); + sbi->file_count++; + hfsplus_mark_mdb_dirty(dst_dir->i_sb); ++ ++ res = hfsplus_cat_write_inode(src_dir); ++ if (res) ++ goto out; ++ ++ res = hfsplus_cat_write_inode(dst_dir); ++ if (res) ++ goto out; ++ ++ res = hfsplus_cat_write_inode(sbi->hidden_dir); ++ if (res) ++ goto out; ++ ++ res = hfsplus_cat_write_inode(inode); ++ + out: + mutex_unlock(&sbi->vh_mutex); + return res; +@@ -367,6 +385,9 @@ static int hfsplus_unlink(struct inode *dir, struct dentry *dentry) + if (HFSPLUS_IS_RSRC(inode)) + return -EPERM; + ++ hfs_dbg("dir->i_ino %lu, inode->i_ino %lu\n", ++ dir->i_ino, inode->i_ino); ++ + mutex_lock(&sbi->vh_mutex); + cnid = (u32)(unsigned long)dentry->d_fsdata; + if (inode->i_ino == cnid && +@@ -408,6 +429,15 @@ static int hfsplus_unlink(struct inode *dir, struct dentry *dentry) + inode_set_ctime_current(inode); + mark_inode_dirty(inode); + out: ++ if (!res) { ++ res = hfsplus_cat_write_inode(dir); ++ if (!res) { ++ res = hfsplus_cat_write_inode(sbi->hidden_dir); ++ if (!res) ++ res = hfsplus_cat_write_inode(inode); ++ } ++ } ++ + mutex_unlock(&sbi->vh_mutex); + return res; + } +@@ -429,6 +459,8 @@ static int hfsplus_rmdir(struct inode *dir, struct dentry *dentry) + inode_set_ctime_current(inode); + hfsplus_delete_inode(inode); + mark_inode_dirty(inode); ++ ++ res = hfsplus_cat_write_inode(dir); + out: + mutex_unlock(&sbi->vh_mutex); + return res; +@@ -465,6 +497,12 @@ static int hfsplus_symlink(struct mnt_idmap *idmap, struct inode *dir, + + hfsplus_instantiate(dentry, inode, inode->i_ino); + mark_inode_dirty(inode); ++ ++ res = hfsplus_cat_write_inode(dir); ++ if (res) ++ goto out; ++ ++ res = hfsplus_cat_write_inode(inode); + goto out; + + out_err: +@@ -506,6 +544,12 @@ static int hfsplus_mknod(struct mnt_idmap *idmap, struct inode *dir, + + hfsplus_instantiate(dentry, inode, inode->i_ino); + mark_inode_dirty(inode); ++ ++ res = hfsplus_cat_write_inode(dir); ++ if (res) ++ goto out; ++ ++ res = hfsplus_cat_write_inode(inode); + goto out; + + failed_mknod: +diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c +index 7ae6745ca7ae1..c762bf909d1aa 100644 +--- a/fs/hfsplus/inode.c ++++ b/fs/hfsplus/inode.c +@@ -328,6 +328,9 @@ int hfsplus_file_fsync(struct file *file, loff_t start, loff_t end, + struct hfsplus_vh *vhdr = sbi->s_vhdr; + int error = 0, error2; + ++ hfs_dbg("inode->i_ino %lu, start %llu, end %llu\n", ++ inode->i_ino, start, end); ++ + error = file_write_and_wait_range(file, start, end); + if (error) + return error; +@@ -616,6 +619,8 @@ int hfsplus_cat_write_inode(struct inode *inode) + hfsplus_cat_entry entry; + int res = 0; + ++ hfs_dbg("inode->i_ino %lu\n", inode->i_ino); ++ + if (HFSPLUS_IS_RSRC(inode)) + main_inode = HFSPLUS_I(inode)->rsrc_inode; + +-- +2.51.0 + diff --git a/queue-6.19/hfsplus-fix-volume-corruption-issue-for-generic-498.patch b/queue-6.19/hfsplus-fix-volume-corruption-issue-for-generic-498.patch new file mode 100644 index 00000000000..2e9677b5b1a --- /dev/null +++ b/queue-6.19/hfsplus-fix-volume-corruption-issue-for-generic-498.patch @@ -0,0 +1,150 @@ +From dd56cf4c1086ff51f1b992ed8806d5721a858d9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Dec 2025 19:58:22 -0800 +Subject: hfsplus: fix volume corruption issue for generic/498 + +From: Viacheslav Dubeyko + +[ Upstream commit 9a8c4ad44721da4c48e1ff240ac76286c82837fe ] + +The xfstests' test-case generic/498 leaves HFS+ volume +in corrupted state: + +sudo ./check generic/498 +FSTYP -- hfsplus +PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #18 SMP PREEMPT_DYNAMIC Thu Dec 4 12:24:45 PST 2025 +MKFS_OPTIONS -- /dev/loop51 +MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch + +generic/498 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent +(see XFSTESTS-2/xfstests-dev/results//generic/498.full for details) + +Ran: generic/498 +Failures: generic/498 +Failed 1 of 1 tests + +sudo fsck.hfsplus -d /dev/loop51 +** /dev/loop51 +Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K. +Executing fsck_hfs (version 540.1-Linux). +** Checking non-journaled HFS Plus Volume. +The volume name is untitled +** Checking extents overflow file. +** Checking catalog file. +Invalid leaf record count +(It should be 16 instead of 2) +** Checking multi-linked files. +CheckHardLinks: found 1 pre-Leopard file inodes. +** Checking catalog hierarchy. +** Checking extended attributes file. +** Checking volume bitmap. +** Checking volume information. +Verify Status: VIStat = 0x0000, ABTStat = 0x0000 EBTStat = 0x0000 +CBTStat = 0x8000 CatStat = 0x00000000 +** Repairing volume. +** Rechecking volume. +** Checking non-journaled HFS Plus Volume. +The volume name is untitled +** Checking extents overflow file. +** Checking catalog file. +** Checking multi-linked files. +CheckHardLinks: found 1 pre-Leopard file inodes. +** Checking catalog hierarchy. +** Checking extended attributes file. +** Checking volume bitmap. +** Checking volume information. +** The volume untitled was repaired successfully. + +The generic/498 test executes such steps on final phase: + +mkdir $SCRATCH_MNT/A +mkdir $SCRATCH_MNT/B +mkdir $SCRATCH_MNT/A/C +touch $SCRATCH_MNT/B/foo +$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/B/foo + +ln $SCRATCH_MNT/B/foo $SCRATCH_MNT/A/C/foo +$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/A + +"Simulate a power failure and mount the filesystem +to check that what we explicitly fsync'ed exists." + +_flakey_drop_and_remount + +The FSCK tool complains about "Invalid leaf record count". +HFS+ b-tree header contains leaf_count field is updated +by hfs_brec_insert() and hfs_brec_remove(). The hfs_brec_insert() +is involved into hard link creation process. However, +modified in-core leaf_count field is stored into HFS+ +b-tree header by hfs_btree_write() method. But, +unfortunately, hfs_btree_write() hasn't been called +by hfsplus_cat_write_inode() and hfsplus_file_fsync() +stores not fully consistent state of the Catalog File's +b-tree. + +This patch adds calling hfs_btree_write() method in +the hfsplus_cat_write_inode() with the goal of +storing consistent state of Catalog File's b-tree. +Finally, it makes FSCK tool happy. + +sudo ./check generic/498 +FSTYP -- hfsplus +PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #22 SMP PREEMPT_DYNAMIC Sat Dec 6 17:01:31 PST 2025 +MKFS_OPTIONS -- /dev/loop51 +MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch + +generic/498 33s ... 31s +Ran: generic/498 +Passed all 1 tests + +Signed-off-by: Viacheslav Dubeyko +cc: John Paul Adrian Glaubitz +cc: Yangtao Li +cc: linux-fsdevel@vger.kernel.org +Link: https://lore.kernel.org/r/20251207035821.3863657-1-slava@dubeyko.com +Signed-off-by: Viacheslav Dubeyko +Signed-off-by: Sasha Levin +--- + fs/hfsplus/inode.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c +index c762bf909d1aa..6153e5cc6eb65 100644 +--- a/fs/hfsplus/inode.c ++++ b/fs/hfsplus/inode.c +@@ -615,6 +615,7 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd) + int hfsplus_cat_write_inode(struct inode *inode) + { + struct inode *main_inode = inode; ++ struct hfs_btree *tree = HFSPLUS_SB(inode->i_sb)->cat_tree; + struct hfs_find_data fd; + hfsplus_cat_entry entry; + int res = 0; +@@ -627,7 +628,7 @@ int hfsplus_cat_write_inode(struct inode *inode) + if (!main_inode->i_nlink) + return 0; + +- if (hfs_find_init(HFSPLUS_SB(main_inode->i_sb)->cat_tree, &fd)) ++ if (hfs_find_init(tree, &fd)) + /* panic? */ + return -EIO; + +@@ -692,6 +693,15 @@ int hfsplus_cat_write_inode(struct inode *inode) + set_bit(HFSPLUS_I_CAT_DIRTY, &HFSPLUS_I(inode)->flags); + out: + hfs_find_exit(&fd); ++ ++ if (!res) { ++ res = hfs_btree_write(tree); ++ if (res) { ++ pr_err("b-tree write err: %d, ino %lu\n", ++ res, inode->i_ino); ++ } ++ } ++ + return res; + } + +-- +2.51.0 + diff --git a/queue-6.19/hfsplus-pretend-special-inodes-as-regular-files.patch b/queue-6.19/hfsplus-pretend-special-inodes-as-regular-files.patch new file mode 100644 index 00000000000..78058410623 --- /dev/null +++ b/queue-6.19/hfsplus-pretend-special-inodes-as-regular-files.patch @@ -0,0 +1,45 @@ +From 2d664d032e03f359574c8814b595d0507730598d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 18:39:33 +0900 +Subject: hfsplus: pretend special inodes as regular files + +From: Tetsuo Handa + +[ Upstream commit ed8889ca21b6ab37bc1435c4009ce37a79acb9e6 ] + +Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()") +requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/ +S_IFIFO/S_IFSOCK type, use S_IFREG for special inodes. + +Reported-by: syzbot +Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d +Signed-off-by: Tetsuo Handa +Reviewed-by: Viacheslav Dubeyko +Signed-off-by: Viacheslav Dubeyko +Link: https://lore.kernel.org/r/d0a07b1b-8b73-4002-8e29-e2bd56871262@I-love.SAKURA.ne.jp +Signed-off-by: Viacheslav Dubeyko +Signed-off-by: Sasha Levin +--- + fs/hfsplus/super.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c +index aaffa9e060a0a..7f327b777ece8 100644 +--- a/fs/hfsplus/super.c ++++ b/fs/hfsplus/super.c +@@ -53,6 +53,12 @@ static int hfsplus_system_read_inode(struct inode *inode) + return -EIO; + } + ++ /* ++ * Assign a dummy file type, for may_open() requires that ++ * an inode has a valid file type. ++ */ ++ inode->i_mode = S_IFREG; ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.19/hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch b/queue-6.19/hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch new file mode 100644 index 00000000000..e6605ac63ae --- /dev/null +++ b/queue-6.19/hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch @@ -0,0 +1,37 @@ +From 20bc82c3571874da0bd5e41723448d0c0656f251 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Nov 2025 06:06:23 +0000 +Subject: HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple + keyboards + +From: Joey Bednar + +[ Upstream commit 7273acfd0aef106093a8ffa3b4973eb70e5a3799 ] + +The SoNiX KN85 keyboard identifies as the "Apple, Inc. Aluminium +Keyboard" and is not recognized as a non-apple keyboard. Adding "SoNiX +KN85 Keyboard" to the list of non-apple keyboards fixes the function +keys. + +Signed-off-by: Joey Bednar +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-apple.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c +index 57da4f86a9fa7..233e367cce1d1 100644 +--- a/drivers/hid/hid-apple.c ++++ b/drivers/hid/hid-apple.c +@@ -354,6 +354,7 @@ static const struct apple_key_translation swapped_fn_leftctrl_keys[] = { + }; + + static const struct apple_non_apple_keyboard non_apple_keyboards[] = { ++ { "SONiX KN85 Keyboard" }, + { "SONiX USB DEVICE" }, + { "SONiX AK870 PRO" }, + { "Keychron" }, +-- +2.51.0 + diff --git a/queue-6.19/hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch b/queue-6.19/hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch new file mode 100644 index 00000000000..cff56b14e44 --- /dev/null +++ b/queue-6.19/hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch @@ -0,0 +1,141 @@ +From 9501a2defebf46d2b3d30b7daf2ffb95294c8c54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 12:56:09 +0900 +Subject: HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK + +From: David Phillips + +[ Upstream commit b8e5fdf0bd022cd5493a5987ef66f5a24f8352d8 ] + +New model in the ELECOM HUGE trackball line that has 8 buttons but the +report descriptor specifies only 5. The HUGE Plus supports connecting via +Bluetooth, 2.4GHz wireless USB dongle, and directly via a USB-C cable. +Each connection type reports a different device id, 01AA for cable, +01AB for USB dongle, and 01AC for Bluetooth. + +This patch adds these device IDs and applies the fixups similar to the +other ELECOM devices to get all 8 buttons working for all 3 connection +types. + +For reference, the usbhid-dump output: +001:013:001:DESCRIPTOR 1769085639.598405 + 05 01 09 02 A1 01 85 01 09 01 A1 00 05 09 19 01 + 29 05 15 00 25 01 75 01 95 05 81 02 75 03 95 01 + 81 01 05 01 09 30 09 31 16 01 80 26 FF 7F 75 10 + 95 02 81 06 09 38 15 81 25 7F 75 08 95 01 81 06 + 05 0C 0A 38 02 15 81 25 7F 75 08 95 01 81 06 C0 + C0 05 0C 09 01 A1 01 85 02 15 01 26 8C 02 19 01 + 2A 8C 02 75 10 95 01 81 00 C0 05 01 09 80 A1 01 + 85 03 09 82 09 81 09 83 15 00 25 01 19 01 29 03 + 75 01 95 03 81 02 95 05 81 01 C0 06 01 FF 09 00 + A1 01 85 08 09 00 15 00 26 FF 00 75 08 95 07 81 + 02 C0 06 02 FF 09 02 A1 01 85 06 09 02 15 00 26 + FF 00 75 08 95 07 B1 02 C0 + +Signed-off-by: David Phillips +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/Kconfig | 1 + + drivers/hid/hid-elecom.c | 16 ++++++++++++++++ + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/hid-quirks.c | 3 +++ + 4 files changed, 23 insertions(+) + +diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig +index 920a64b66b25b..6ff4a3ad34cbf 100644 +--- a/drivers/hid/Kconfig ++++ b/drivers/hid/Kconfig +@@ -369,6 +369,7 @@ config HID_ELECOM + - EX-G Trackballs (M-XT3DRBK, M-XT3URBK) + - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK) + - HUGE Trackballs (M-HT1DRBK, M-HT1URBK) ++ - HUGE Plus Trackball (M-HT1MRBK) + + config HID_ELO + tristate "ELO USB 4000/4500 touchscreen" +diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c +index 2003d2dcda7cc..37d88ce57f671 100644 +--- a/drivers/hid/hid-elecom.c ++++ b/drivers/hid/hid-elecom.c +@@ -5,6 +5,7 @@ + * - EX-G Trackballs (M-XT3DRBK, M-XT3URBK, M-XT4DRBK) + * - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK) + * - HUGE Trackballs (M-HT1DRBK, M-HT1URBK) ++ * - HUGE Plus Trackball (M-HT1MRBK) + * + * Copyright (c) 2010 Richard Nauber + * Copyright (c) 2016 Yuxuan Shui +@@ -123,12 +124,25 @@ static const __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc, + */ + mouse_button_fixup(hdev, rdesc, *rsize, 22, 30, 24, 16, 8); + break; ++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK: ++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB: ++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC: ++ /* ++ * Report descriptor format: ++ * 24: button bit count ++ * 28: padding bit count ++ * 22: button report size ++ * 16: button usage maximum ++ */ ++ mouse_button_fixup(hdev, rdesc, *rsize, 24, 28, 22, 16, 8); ++ break; + } + return rdesc; + } + + static const struct hid_device_id elecom_devices[] = { + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, ++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, +@@ -142,6 +156,8 @@ static const struct hid_device_id elecom_devices[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK_019B) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) }, + { } + }; + MODULE_DEVICE_TABLE(hid, elecom_devices); +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 6d8b64872cefe..85ab1ac511096 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -466,6 +466,9 @@ + #define USB_DEVICE_ID_ELECOM_M_HT1URBK_019B 0x019b + #define USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D 0x010d + #define USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C 0x011c ++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK 0x01aa ++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB 0x01ab ++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC 0x01ac + + #define USB_VENDOR_ID_DREAM_CHEEKY 0x1d34 + #define USB_DEVICE_ID_DREAM_CHEEKY_WN 0x0004 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 11438039cdb7f..3217e436c052c 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -420,6 +420,7 @@ static const struct hid_device_id hid_have_special_driver[] = { + #if IS_ENABLED(CONFIG_HID_ELECOM) + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, ++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK_00FC) }, +@@ -432,6 +433,8 @@ static const struct hid_device_id hid_have_special_driver[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK_019B) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) }, + #endif + #if IS_ENABLED(CONFIG_HID_ELO) + { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) }, +-- +2.51.0 + diff --git a/queue-6.19/hid-i2c-hid-add-focaltech-ft8112.patch b/queue-6.19/hid-i2c-hid-add-focaltech-ft8112.patch new file mode 100644 index 00000000000..48df7b54c9b --- /dev/null +++ b/queue-6.19/hid-i2c-hid-add-focaltech-ft8112.patch @@ -0,0 +1,55 @@ +From c6b565abbaca06e1eb3c40e86c32b49ed06330aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 17:40:41 +0800 +Subject: HID: i2c-hid: Add FocalTech FT8112 + +From: Daniel Peng + +[ Upstream commit 3d9586f1f90c9101b1abf5b0e9d70ca45f5f16db ] + +Information for touchscreen model HKO/RB116AS01-2 as below: +- HID :FTSC1000 +- slave address:0X38 +- Interface:HID over I2C +- Touch control lC:FT8112 +- I2C ID: PNP0C50 + +Signed-off-by: Daniel Peng +Acked-by: Jiri Kosina +Reviewed-by: Douglas Anderson +Link: https://patch.msgid.link/20251117094041.300083-2-Daniel_Peng@pegatron.corp-partner.google.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/hid/i2c-hid/i2c-hid-of-elan.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/hid/i2c-hid/i2c-hid-of-elan.c b/drivers/hid/i2c-hid/i2c-hid-of-elan.c +index 0215f217f6d86..b81fcc6ff49ee 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-of-elan.c ++++ b/drivers/hid/i2c-hid/i2c-hid-of-elan.c +@@ -168,6 +168,13 @@ static const struct elan_i2c_hid_chip_data elan_ekth6a12nay_chip_data = { + .power_after_backlight = true, + }; + ++static const struct elan_i2c_hid_chip_data focaltech_ft8112_chip_data = { ++ .post_power_delay_ms = 10, ++ .post_gpio_reset_on_delay_ms = 150, ++ .hid_descriptor_address = 0x0001, ++ .main_supply_name = "vcc33", ++}; ++ + static const struct elan_i2c_hid_chip_data ilitek_ili9882t_chip_data = { + .post_power_delay_ms = 1, + .post_gpio_reset_on_delay_ms = 200, +@@ -191,6 +198,7 @@ static const struct elan_i2c_hid_chip_data ilitek_ili2901_chip_data = { + static const struct of_device_id elan_i2c_hid_of_match[] = { + { .compatible = "elan,ekth6915", .data = &elan_ekth6915_chip_data }, + { .compatible = "elan,ekth6a12nay", .data = &elan_ekth6a12nay_chip_data }, ++ { .compatible = "focaltech,ft8112", .data = &focaltech_ft8112_chip_data }, + { .compatible = "ilitek,ili9882t", .data = &ilitek_ili9882t_chip_data }, + { .compatible = "ilitek,ili2901", .data = &ilitek_ili2901_chip_data }, + { } +-- +2.51.0 + diff --git a/queue-6.19/hid-logitech-hidpp-add-support-for-logitech-k980.patch b/queue-6.19/hid-logitech-hidpp-add-support-for-logitech-k980.patch new file mode 100644 index 00000000000..3dd44294779 --- /dev/null +++ b/queue-6.19/hid-logitech-hidpp-add-support-for-logitech-k980.patch @@ -0,0 +1,36 @@ +From 829d3b7b961c0a877b3e403d99bb082a5d15562f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 13:12:02 +0100 +Subject: HID: logitech-hidpp: Add support for Logitech K980 + +From: Bastien Nocera + +[ Upstream commit af4fe07a9d963a72438ade96cf090e84b3399d0c ] + +Add support for the solar-charging Logitech K980 keyboard, over +Bluetooth. Bolt traffic doesn't get routed through logitech-dj, so +this code isn't triggered when Bolt is used. + +Signed-off-by: Bastien Nocera +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-logitech-hidpp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index e871f1729d4b3..ca96102121b85 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -4666,6 +4666,8 @@ static const struct hid_device_id hidpp_devices[] = { + HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb037) }, + { /* MX Anywhere 3SB mouse over Bluetooth */ + HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb038) }, ++ { /* Slim Solar+ K980 Keyboard over Bluetooth */ ++ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb391) }, + {} + }; + +-- +2.51.0 + diff --git a/queue-6.19/hid-multitouch-add-egalaxtouch-exc3188-support.patch b/queue-6.19/hid-multitouch-add-egalaxtouch-exc3188-support.patch new file mode 100644 index 00000000000..ab444ac3217 --- /dev/null +++ b/queue-6.19/hid-multitouch-add-egalaxtouch-exc3188-support.patch @@ -0,0 +1,49 @@ +From 20212c5b55112c40fb681ee667f312570e3f788c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 09:57:05 +0100 +Subject: HID: multitouch: add eGalaxTouch EXC3188 support + +From: Thorsten Schmelzer + +[ Upstream commit 8e4ac86b2ddd36fe501e20ecfcc080e536df1f48 ] + +Add support for the for the EXC3188 touchscreen from eGalaxy. + +Signed-off-by: Thorsten Schmelzer +Signed-off-by: Michael Tretter +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-multitouch.c | 3 +++ + 2 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 5a18cb41e6d79..6d8b64872cefe 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -437,6 +437,7 @@ + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7349 0x7349 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7 0x73f7 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001 ++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000 0xc000 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002 0xc002 + + #define USB_VENDOR_ID_EDIFIER 0x2d99 +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index f21850f7d89e4..7daa8f6d81870 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -2212,6 +2212,9 @@ static const struct hid_device_id mt_devices[] = { + { .driver_data = MT_CLS_EGALAX_SERIAL, + MT_USB_DEVICE(USB_VENDOR_ID_DWAV, + USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) }, ++ { .driver_data = MT_CLS_EGALAX_SERIAL, ++ MT_USB_DEVICE(USB_VENDOR_ID_DWAV, ++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000) }, + { .driver_data = MT_CLS_EGALAX, + MT_USB_DEVICE(USB_VENDOR_ID_DWAV, + USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002) }, +-- +2.51.0 + diff --git a/queue-6.19/hid-multitouch-add-quirks-for-lenovo-yoga-book-9i.patch b/queue-6.19/hid-multitouch-add-quirks-for-lenovo-yoga-book-9i.patch new file mode 100644 index 00000000000..9e802795a76 --- /dev/null +++ b/queue-6.19/hid-multitouch-add-quirks-for-lenovo-yoga-book-9i.patch @@ -0,0 +1,165 @@ +From 4e5be94779a2b1d5152744133cf7aea3c0c24e53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 21:35:47 -0500 +Subject: HID: multitouch: add quirks for Lenovo Yoga Book 9i + +From: Brian Howard + +[ Upstream commit 822bc5b3744b0b2c2c9678aa1d80b2cf04fdfabf ] + +The Lenovo Yoga Book 9i is a dual-screen laptop, with a single composite +USB device providing both touch and tablet interfaces for both screens. +All inputs report through a single device, differentiated solely by report +numbers. As there is no way for udev to differentiate the inputs based on +USB vendor/product ID or interface numbers, custom naming is required to +match against for downstream configuration. A firmware bug also results +in an erroneous InRange message report being received after the stylus +leaves proximity, blocking later touch events. Add required quirks for +Gen 8 to Gen 10 models, including a new quirk providing for custom input +device naming and dropping erroneous InRange reports. + +Signed-off-by: Brian Howard +Tested-by: Brian Howard +Tested-by: Kris Fredrick +Reported-by: Andrei Shumailov +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220386 +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-multitouch.c | 72 ++++++++++++++++++++++++++++++++++++ + 2 files changed, 73 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 9c2bf584d9f6f..5a18cb41e6d79 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -841,6 +841,7 @@ + #define USB_DEVICE_ID_LENOVO_X1_TAB3 0x60b5 + #define USB_DEVICE_ID_LENOVO_X12_TAB 0x60fe + #define USB_DEVICE_ID_LENOVO_X12_TAB2 0x61ae ++#define USB_DEVICE_ID_LENOVO_YOGABOOK9I 0x6161 + #define USB_DEVICE_ID_LENOVO_OPTICAL_USB_MOUSE_600E 0x600e + #define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_608D 0x608d + #define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019 0x6019 +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index b1c3ef1290587..f21850f7d89e4 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -76,6 +76,7 @@ MODULE_LICENSE("GPL"); + #define MT_QUIRK_DISABLE_WAKEUP BIT(21) + #define MT_QUIRK_ORIENTATION_INVERT BIT(22) + #define MT_QUIRK_APPLE_TOUCHBAR BIT(23) ++#define MT_QUIRK_YOGABOOK9I BIT(24) + + #define MT_INPUTMODE_TOUCHSCREEN 0x02 + #define MT_INPUTMODE_TOUCHPAD 0x03 +@@ -231,6 +232,7 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app); + #define MT_CLS_RAZER_BLADE_STEALTH 0x0112 + #define MT_CLS_SMART_TECH 0x0113 + #define MT_CLS_APPLE_TOUCHBAR 0x0114 ++#define MT_CLS_YOGABOOK9I 0x0115 + #define MT_CLS_SIS 0x0457 + + #define MT_DEFAULT_MAXCONTACT 10 +@@ -427,6 +429,14 @@ static const struct mt_class mt_classes[] = { + .quirks = MT_QUIRK_NOT_SEEN_MEANS_UP | + MT_QUIRK_ALWAYS_VALID | + MT_QUIRK_CONTACT_CNT_ACCURATE, ++ }, ++ { .name = MT_CLS_YOGABOOK9I, ++ .quirks = MT_QUIRK_ALWAYS_VALID | ++ MT_QUIRK_FORCE_MULTI_INPUT | ++ MT_QUIRK_SEPARATE_APP_REPORT | ++ MT_QUIRK_HOVERING | ++ MT_QUIRK_YOGABOOK9I, ++ .export_all_inputs = true + }, + { } + }; +@@ -1576,6 +1586,38 @@ static void mt_report(struct hid_device *hid, struct hid_report *report) + if (rdata && rdata->is_mt_collection) + return mt_touch_report(hid, rdata); + ++ /* Lenovo Yoga Book 9i requires consuming and dropping certain bogus reports */ ++ if (rdata && rdata->application && ++ (rdata->application->quirks & MT_QUIRK_YOGABOOK9I)) { ++ ++ bool all_zero_report = true; ++ ++ for (int f = 0; f < report->maxfield && all_zero_report; f++) { ++ struct hid_field *fld = report->field[f]; ++ ++ for (int i = 0; i < fld->report_count; i++) { ++ unsigned int usage = fld->usage[i].hid; ++ ++ if (usage == HID_DG_INRANGE || ++ usage == HID_DG_TIPSWITCH || ++ usage == HID_DG_BARRELSWITCH || ++ usage == HID_DG_BARRELSWITCH2 || ++ usage == HID_DG_CONTACTID || ++ usage == HID_DG_TILT_X || ++ usage == HID_DG_TILT_Y) { ++ ++ if (fld->value[i] != 0) { ++ all_zero_report = false; ++ break; ++ } ++ } ++ } ++ } ++ ++ if (all_zero_report) ++ return; ++ } ++ + if (field && field->hidinput && field->hidinput->input) + input_sync(field->hidinput->input); + } +@@ -1772,6 +1814,30 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi) + break; + } + ++ /* Lenovo Yoga Book 9i requires custom naming to allow differentiation in udev */ ++ if (hi->report && td->mtclass.quirks & MT_QUIRK_YOGABOOK9I) { ++ switch (hi->report->id) { ++ case 48: ++ suffix = "Touchscreen Top"; ++ break; ++ case 56: ++ suffix = "Touchscreen Bottom"; ++ break; ++ case 20: ++ suffix = "Stylus Top"; ++ break; ++ case 40: ++ suffix = "Stylus Bottom"; ++ break; ++ case 80: ++ suffix = "Emulated Touchpad"; ++ break; ++ default: ++ suffix = ""; ++ break; ++ } ++ } ++ + if (suffix) { + hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL, + "%s %s", hdev->name, suffix); +@@ -2277,6 +2343,12 @@ static const struct hid_device_id mt_devices[] = { + USB_VENDOR_ID_LENOVO, + USB_DEVICE_ID_LENOVO_X12_TAB2) }, + ++ /* Lenovo Yoga Book 9i */ ++ { .driver_data = MT_CLS_YOGABOOK9I, ++ HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8, ++ USB_VENDOR_ID_LENOVO, ++ USB_DEVICE_ID_LENOVO_YOGABOOK9I) }, ++ + /* Logitech devices */ + { .driver_data = MT_CLS_NSMU, + HID_DEVICE(BUS_BLUETOOTH, HID_GROUP_MULTITOUCH_WIN_8, +-- +2.51.0 + diff --git a/queue-6.19/hid-pidff-do-not-set-out-of-range-trigger-button.patch b/queue-6.19/hid-pidff-do-not-set-out-of-range-trigger-button.patch new file mode 100644 index 00000000000..3b315451db9 --- /dev/null +++ b/queue-6.19/hid-pidff-do-not-set-out-of-range-trigger-button.patch @@ -0,0 +1,58 @@ +From de6e7bb6fe811dbac9dbcfd1f4a2c564fcbb012e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Nov 2025 19:46:14 +0100 +Subject: HID: pidff: Do not set out of range trigger button +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tomasz Pakuła + +[ Upstream commit e01a029654f7fb67d7151365410aa22be4e63dbe ] + +Some games (mainly observed with Kylotonn's WRC Serises) set trigger +button to a random value, or always the same one, out of range. +I observed 307 and other values but, for example, my Moza R9 only +exposes 128 buttons AND it's trigger button field is 8-bit. This causes +errors to appear in dmesg. + +Only set the trigger button and trigger interval in the trigger button +is in range of the field. + +Signed-off-by: Tomasz Pakuła +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/usbhid/hid-pidff.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/drivers/hid/usbhid/hid-pidff.c b/drivers/hid/usbhid/hid-pidff.c +index 95377c5f63356..a4e700b40ba9b 100644 +--- a/drivers/hid/usbhid/hid-pidff.c ++++ b/drivers/hid/usbhid/hid-pidff.c +@@ -523,9 +523,19 @@ static void pidff_set_effect_report(struct pidff_device *pidff, + pidff_set_duration(&pidff->set_effect[PID_DURATION], + effect->replay.length); + +- pidff->set_effect[PID_TRIGGER_BUTTON].value[0] = effect->trigger.button; +- pidff_set_time(&pidff->set_effect[PID_TRIGGER_REPEAT_INT], +- effect->trigger.interval); ++ /* Some games set this to random values that can be out of range */ ++ s32 trigger_button_max = ++ pidff->set_effect[PID_TRIGGER_BUTTON].field->logical_maximum; ++ if (effect->trigger.button <= trigger_button_max) { ++ pidff->set_effect[PID_TRIGGER_BUTTON].value[0] = ++ effect->trigger.button; ++ pidff_set_time(&pidff->set_effect[PID_TRIGGER_REPEAT_INT], ++ effect->trigger.interval); ++ } else { ++ pidff->set_effect[PID_TRIGGER_BUTTON].value[0] = 0; ++ pidff->set_effect[PID_TRIGGER_REPEAT_INT].value[0] = 0; ++ } ++ + pidff->set_effect[PID_GAIN].value[0] = + pidff->set_effect[PID_GAIN].field->logical_maximum; + +-- +2.51.0 + diff --git a/queue-6.19/hisi_acc_vfio_pci-fix-the-queue-parameter-anomaly-is.patch b/queue-6.19/hisi_acc_vfio_pci-fix-the-queue-parameter-anomaly-is.patch new file mode 100644 index 00000000000..64e440d6c1b --- /dev/null +++ b/queue-6.19/hisi_acc_vfio_pci-fix-the-queue-parameter-anomaly-is.patch @@ -0,0 +1,42 @@ +From 00effe05d74df54eec15eed76bfb0e4f6abe1b29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 10:02:05 +0800 +Subject: hisi_acc_vfio_pci: fix the queue parameter anomaly issue + +From: Longfang Liu + +[ Upstream commit c3cbc276c2a33b04fc78a86cdb2ddce094cb3614 ] + +When the number of QPs initialized by the device, as read via vft, is zero, +it indicates either an abnormal device configuration or an abnormal read +result. +Returning 0 directly in this case would allow the live migration operation +to complete successfully, leading to incorrect parameter configuration after +migration and preventing the service from recovering normal functionality. +Therefore, in such situations, an error should be returned to roll back the +live migration operation. + +Signed-off-by: Longfang Liu +Link: https://lore.kernel.org/r/20260122020205.2884497-5-liulongfang@huawei.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c +index 8a05fb91929fb..2b8ac97cef2d2 100644 +--- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c ++++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c +@@ -426,7 +426,7 @@ static int vf_qm_check_match(struct hisi_acc_vf_core_device *hisi_acc_vdev, + ret = qm_get_vft(vf_qm, &vf_qm->qp_base); + if (ret <= 0) { + dev_err(dev, "failed to get vft qp nums\n"); +- return ret; ++ return ret < 0 ? ret : -EINVAL; + } + + if (ret != vf_data->qp_num) { +-- +2.51.0 + diff --git a/queue-6.19/hisi_acc_vfio_pci-resolve-duplicate-migration-states.patch b/queue-6.19/hisi_acc_vfio_pci-resolve-duplicate-migration-states.patch new file mode 100644 index 00000000000..f0ed9944adc --- /dev/null +++ b/queue-6.19/hisi_acc_vfio_pci-resolve-duplicate-migration-states.patch @@ -0,0 +1,41 @@ +From 6b2c231f885a99453419811786272625895a616a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 10:02:04 +0800 +Subject: hisi_acc_vfio_pci: resolve duplicate migration states + +From: Longfang Liu + +[ Upstream commit 8c6ac1730a977234dff74cc1753b4a953f59be7b ] + +In special scenarios involving duplicate migrations, after the +first migration is completed, if the original VF device is used +again and then migrated to another destination, the state indicating +data migration completion for the VF device is not reset. +This results in the second migration to the destination being skipped +without performing data migration. +After the modification, it ensures that a complete data migration +is performed after the subsequent migration. + +Signed-off-by: Longfang Liu +Link: https://lore.kernel.org/r/20260122020205.2884497-4-liulongfang@huawei.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c +index d1e8053640a98..8a05fb91929fb 100644 +--- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c ++++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c +@@ -1570,6 +1570,7 @@ static int hisi_acc_vfio_pci_open_device(struct vfio_device *core_vdev) + } + hisi_acc_vdev->mig_state = VFIO_DEVICE_STATE_RUNNING; + hisi_acc_vdev->dev_opened = true; ++ hisi_acc_vdev->match_done = 0; + mutex_unlock(&hisi_acc_vdev->open_mutex); + } + +-- +2.51.0 + diff --git a/queue-6.19/hisi_acc_vfio_pci-update-status-after-ras-error.patch b/queue-6.19/hisi_acc_vfio_pci-update-status-after-ras-error.patch new file mode 100644 index 00000000000..a1f246bd5f8 --- /dev/null +++ b/queue-6.19/hisi_acc_vfio_pci-update-status-after-ras-error.patch @@ -0,0 +1,41 @@ +From 4ce83b809da1b965d2d96133b96440de272b1065 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 10:02:03 +0800 +Subject: hisi_acc_vfio_pci: update status after RAS error + +From: Longfang Liu + +[ Upstream commit 8be14dd48dfee0df91e511acceb4beeb2461a083 ] + +After a RAS error occurs on the accelerator device, the accelerator +device will be reset. The live migration state will be abnormal +after reset, and the original state needs to be restored during +the reset process. +Therefore, reset processing needs to be performed in a live +migration scenario. + +Signed-off-by: Longfang Liu +Link: https://lore.kernel.org/r/20260122020205.2884497-3-liulongfang@huawei.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c +index 2b8ac97cef2d2..e61df3fe0db99 100644 +--- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c ++++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c +@@ -1215,8 +1215,7 @@ static void hisi_acc_vf_pci_aer_reset_done(struct pci_dev *pdev) + if (hisi_acc_vdev->set_reset_flag) + clear_bit(QM_RESETTING, &qm->misc_ctl); + +- if (hisi_acc_vdev->core_device.vdev.migration_flags != +- VFIO_MIGRATION_STOP_COPY) ++ if (!hisi_acc_vdev->core_device.vdev.mig_ops) + return; + + mutex_lock(&hisi_acc_vdev->state_mutex); +-- +2.51.0 + diff --git a/queue-6.19/hwmon-asus-ec-sensors-add-pro-ws-trx50-sage-wifi-a.patch b/queue-6.19/hwmon-asus-ec-sensors-add-pro-ws-trx50-sage-wifi-a.patch new file mode 100644 index 00000000000..1a3a575aca2 --- /dev/null +++ b/queue-6.19/hwmon-asus-ec-sensors-add-pro-ws-trx50-sage-wifi-a.patch @@ -0,0 +1,50 @@ +From e24c1de7e9efb115cd6303084832c46f200fdaf0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Dec 2025 21:03:43 +0100 +Subject: hwmon: (asus-ec-sensors) add Pro WS TRX50-SAGE WIFI A + +From: Robert McIntyre + +[ Upstream commit af7e57d444141ac9e77b57296d59c3e965c4c4fa ] + +Adding support for Pro WS TRX50-SAGE WIFI A, which is identical +sensors-wise to Pro WS TRX50-SAGE WIFI + +Signed-off-by: Robert McIntyre +Signed-off-by: Eugene Shalygin +Link: https://lore.kernel.org/r/20251213200531.259435-4-eugene.shalygin@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + Documentation/hwmon/asus_ec_sensors.rst | 1 + + drivers/hwmon/asus-ec-sensors.c | 2 ++ + 2 files changed, 3 insertions(+) + +diff --git a/Documentation/hwmon/asus_ec_sensors.rst b/Documentation/hwmon/asus_ec_sensors.rst +index 232885f24430d..b5e1bc7ac0643 100644 +--- a/Documentation/hwmon/asus_ec_sensors.rst ++++ b/Documentation/hwmon/asus_ec_sensors.rst +@@ -10,6 +10,7 @@ Supported boards: + * PRIME X670E-PRO WIFI + * PRIME Z270-A + * Pro WS TRX50-SAGE WIFI ++ * Pro WS TRX50-SAGE WIFI A + * Pro WS X570-ACE + * Pro WS WRX90E-SAGE SE + * ProArt X570-CREATOR WIFI +diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c +index 61b18b88ee8ff..a1445799e23d8 100644 +--- a/drivers/hwmon/asus-ec-sensors.c ++++ b/drivers/hwmon/asus-ec-sensors.c +@@ -793,6 +793,8 @@ static const struct dmi_system_id dmi_table[] = { + &board_info_pro_art_x870E_creator_wifi), + DMI_EXACT_MATCH_ASUS_BOARD_NAME("Pro WS TRX50-SAGE WIFI", + &board_info_pro_ws_trx50_sage_wifi), ++ DMI_EXACT_MATCH_ASUS_BOARD_NAME("Pro WS TRX50-SAGE WIFI A", ++ &board_info_pro_ws_trx50_sage_wifi), + DMI_EXACT_MATCH_ASUS_BOARD_NAME("Pro WS WRX90E-SAGE SE", + &board_info_pro_ws_wrx90e_sage_se), + DMI_EXACT_MATCH_ASUS_BOARD_NAME("Pro WS X570-ACE", +-- +2.51.0 + diff --git a/queue-6.19/hwmon-dell-smm-add-support-for-dell-optiplex-7080.patch b/queue-6.19/hwmon-dell-smm-add-support-for-dell-optiplex-7080.patch new file mode 100644 index 00000000000..847346d60d9 --- /dev/null +++ b/queue-6.19/hwmon-dell-smm-add-support-for-dell-optiplex-7080.patch @@ -0,0 +1,47 @@ +From 7e63abbd4eeac6ebbf892223f21b202aa5f3fa6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jan 2026 01:06:10 +0100 +Subject: hwmon: (dell-smm) Add support for Dell OptiPlex 7080 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit 46c3e87a79179454f741f797c274dd25f5c6125e ] + +The Dell OptiPlex 7080 supports the legacy SMM interface for reading +sensors and performing fan control. Whitelist this machine so that +this driver loads automatically. + +Closes: https://github.com/Wer-Wolf/i8kutils/issues/16 +Signed-off-by: Armin Wolf +Acked-by: Pali Rohár +Link: https://lore.kernel.org/r/20260104000654.6406-1-W_Armin@gmx.de +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/dell-smm-hwmon.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c +index 93143cfc157cf..038edffc1ac74 100644 +--- a/drivers/hwmon/dell-smm-hwmon.c ++++ b/drivers/hwmon/dell-smm-hwmon.c +@@ -1325,6 +1325,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = { + DMI_MATCH(DMI_PRODUCT_NAME, "MP061"), + }, + }, ++ { ++ .ident = "Dell OptiPlex 7080", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7080"), ++ }, ++ }, + { + .ident = "Dell OptiPlex 7060", + .matches = { +-- +2.51.0 + diff --git a/queue-6.19/hwmon-emc2305-fix-a-resource-leak-in-emc2305_of_pars.patch b/queue-6.19/hwmon-emc2305-fix-a-resource-leak-in-emc2305_of_pars.patch new file mode 100644 index 00000000000..357028bd49f --- /dev/null +++ b/queue-6.19/hwmon-emc2305-fix-a-resource-leak-in-emc2305_of_pars.patch @@ -0,0 +1,37 @@ +From 8cc3cc98a691a99f13ea847786bb876674366834 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 21:51:48 +0800 +Subject: hwmon: (emc2305) Fix a resource leak in emc2305_of_parse_pwm_child + +From: Felix Gu + +[ Upstream commit 2954ce672b7623478c1cfeb69e6a6e4042a3656e ] + +When calling of_parse_phandle_with_args(), the caller is responsible +to call of_node_put() to release the reference of device node. +In emc2305_of_parse_pwm_child, it does not release the reference, +causing a resource leak. + +Signed-off-by: Felix Gu +Link: https://lore.kernel.org/r/tencent_738BA80BBF28F3440301EEE6F9E470165105@qq.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/emc2305.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hwmon/emc2305.c b/drivers/hwmon/emc2305.c +index ceae96c07ac45..67e82021da210 100644 +--- a/drivers/hwmon/emc2305.c ++++ b/drivers/hwmon/emc2305.c +@@ -578,6 +578,7 @@ static int emc2305_of_parse_pwm_child(struct device *dev, + data->pwm_output_mask |= EMC2305_OPEN_DRAIN << ch; + } + ++ of_node_put(args.np); + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.19/hwmon-f71882fg-add-f81968-support.patch b/queue-6.19/hwmon-f71882fg-add-f81968-support.patch new file mode 100644 index 00000000000..d6f21bcff74 --- /dev/null +++ b/queue-6.19/hwmon-f71882fg-add-f81968-support.patch @@ -0,0 +1,59 @@ +From 2bba701462cc1da5f3eeba182f15546e6ee56624 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Dec 2025 13:10:40 +0800 +Subject: hwmon: (f71882fg) Add F81968 support + +From: Ji-Ze Hong (Peter Hong) + +[ Upstream commit e4a3d6f79c9933fece64368168c46d6cf5fc2e52 ] + +Add hardware monitoring support for the Fintek F81968 Super I/O chip. +It is fully compatible with F81866. + +Several products share compatibility with the F81866. To better distinguish +between them, ensure that the Product ID is displayed when the device is +probed. + +Signed-off-by: Ji-Ze Hong (Peter Hong) +Link: https://lore.kernel.org/r/20251223051040.10227-1-peter_hong@fintek.com.tw +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/f71882fg.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c +index df83f9866fbcf..204059d2de6cd 100644 +--- a/drivers/hwmon/f71882fg.c ++++ b/drivers/hwmon/f71882fg.c +@@ -51,6 +51,7 @@ + #define SIO_F81866_ID 0x1010 /* Chipset ID */ + #define SIO_F71858AD_ID 0x0903 /* Chipset ID */ + #define SIO_F81966_ID 0x1502 /* Chipset ID */ ++#define SIO_F81968_ID 0x1806 /* Chipset ID */ + + #define REGION_LENGTH 8 + #define ADDR_REG_OFFSET 5 +@@ -2570,6 +2571,7 @@ static int __init f71882fg_find(int sioaddr, struct f71882fg_sio_data *sio_data) + break; + case SIO_F81866_ID: + case SIO_F81966_ID: ++ case SIO_F81968_ID: + sio_data->type = f81866a; + break; + default: +@@ -2599,9 +2601,9 @@ static int __init f71882fg_find(int sioaddr, struct f71882fg_sio_data *sio_data) + address &= ~(REGION_LENGTH - 1); /* Ignore 3 LSB */ + + err = address; +- pr_info("Found %s chip at %#x, revision %d\n", ++ pr_info("Found %s chip at %#x, revision %d, devid: %04x\n", + f71882fg_names[sio_data->type], (unsigned int)address, +- (int)superio_inb(sioaddr, SIO_REG_DEVREV)); ++ (int)superio_inb(sioaddr, SIO_REG_DEVREV), devid); + exit: + superio_exit(sioaddr); + return err; +-- +2.51.0 + diff --git a/queue-6.19/hwmon-nct6683-add-customer-id-for-asrock-z590-taichi.patch b/queue-6.19/hwmon-nct6683-add-customer-id-for-asrock-z590-taichi.patch new file mode 100644 index 00000000000..d58e2c62646 --- /dev/null +++ b/queue-6.19/hwmon-nct6683-add-customer-id-for-asrock-z590-taichi.patch @@ -0,0 +1,63 @@ +From fecebdd33f75a79bf7d2f8c0f1f886f4796fa5c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Dec 2025 09:09:42 +1100 +Subject: hwmon: (nct6683) Add customer ID for ASRock Z590 Taichi + +From: Anj Duvnjak + +[ Upstream commit c0fa7879c9850bd4597740a79d4fac5ebfcf69cc ] + +Add support for customer ID 0x1621 found on ASRock Z590 Taichi +boards using the Nuvoton NCT6686D embedded controller. + +This allows the driver to instantiate without requiring the +force=1 module parameter. + +Tested on two separate ASRock Z590 Taichi boards, both with +EC firmware version 1.0 build 01/25/21. + +Signed-off-by: Anj Duvnjak +Link: https://lore.kernel.org/r/20251222220942.10762-1-avian@extremenerds.net +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + Documentation/hwmon/nct6683.rst | 1 + + drivers/hwmon/nct6683.c | 3 +++ + 2 files changed, 4 insertions(+) + +diff --git a/Documentation/hwmon/nct6683.rst b/Documentation/hwmon/nct6683.rst +index 3e549ba95a15a..45eec9dd349aa 100644 +--- a/Documentation/hwmon/nct6683.rst ++++ b/Documentation/hwmon/nct6683.rst +@@ -65,6 +65,7 @@ AMD BC-250 NCT6686D EC firmware version 1.0 build 07/28/21 + ASRock X570 NCT6683D EC firmware version 1.0 build 06/28/19 + ASRock X670E NCT6686D EC firmware version 1.0 build 05/19/22 + ASRock B650 Steel Legend WiFi NCT6686D EC firmware version 1.0 build 11/09/23 ++ASRock Z590 Taichi NCT6686D EC firmware version 1.0 build 01/25/21 + MSI B550 NCT6687D EC firmware version 1.0 build 05/07/20 + MSI X670-P NCT6687D EC firmware version 0.0 build 09/27/22 + MSI X870E NCT6687D EC firmware version 0.0 build 11/13/24 +diff --git a/drivers/hwmon/nct6683.c b/drivers/hwmon/nct6683.c +index 6cda35388b24c..4a83804140386 100644 +--- a/drivers/hwmon/nct6683.c ++++ b/drivers/hwmon/nct6683.c +@@ -181,6 +181,7 @@ superio_exit(int ioreg) + #define NCT6683_CUSTOMER_ID_ASROCK2 0xe1b + #define NCT6683_CUSTOMER_ID_ASROCK3 0x1631 + #define NCT6683_CUSTOMER_ID_ASROCK4 0x163e ++#define NCT6683_CUSTOMER_ID_ASROCK5 0x1621 + + #define NCT6683_REG_BUILD_YEAR 0x604 + #define NCT6683_REG_BUILD_MONTH 0x605 +@@ -1242,6 +1243,8 @@ static int nct6683_probe(struct platform_device *pdev) + break; + case NCT6683_CUSTOMER_ID_ASROCK4: + break; ++ case NCT6683_CUSTOMER_ID_ASROCK5: ++ break; + default: + if (!force) + return -ENODEV; +-- +2.51.0 + diff --git a/queue-6.19/hwmon-nct6775-add-asus-pro-ws-wrx90e-sage-se.patch b/queue-6.19/hwmon-nct6775-add-asus-pro-ws-wrx90e-sage-se.patch new file mode 100644 index 00000000000..e982395f77a --- /dev/null +++ b/queue-6.19/hwmon-nct6775-add-asus-pro-ws-wrx90e-sage-se.patch @@ -0,0 +1,39 @@ +From 059aeea30152a39947eda299cd12be327427baac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Dec 2025 17:53:14 +0200 +Subject: hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE + +From: Denis Pauk + +[ Upstream commit 246167b17c14e8a5142368ac6457e81622055e0a ] + +Boards Pro WS WRX90E-SAGE SE has got a nct6775 chip, but by default there's +no use of it because of resource conflict with WMI method. + +Add the board to the WMI monitoring list. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=204807 +Signed-off-by: Denis Pauk +Tested-by: Marcus +Link: https://lore.kernel.org/r/20251231155316.2048-1-pauk.denis@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/nct6775-platform.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hwmon/nct6775-platform.c b/drivers/hwmon/nct6775-platform.c +index c3a719aef1ace..555029dfe713f 100644 +--- a/drivers/hwmon/nct6775-platform.c ++++ b/drivers/hwmon/nct6775-platform.c +@@ -1357,6 +1357,7 @@ static const char * const asus_msi_boards[] = { + "Pro WS W680-ACE IPMI", + "Pro WS W790-ACE", + "Pro WS W790E-SAGE SE", ++ "Pro WS WRX90E-SAGE SE", + "ProArt B650-CREATOR", + "ProArt B660-CREATOR D4", + "ProArt B760-CREATOR D4", +-- +2.51.0 + diff --git a/queue-6.19/hwmon-nct7363-fix-a-resource-leak-in-nct7363_present.patch b/queue-6.19/hwmon-nct7363-fix-a-resource-leak-in-nct7363_present.patch new file mode 100644 index 00000000000..118fddc25fc --- /dev/null +++ b/queue-6.19/hwmon-nct7363-fix-a-resource-leak-in-nct7363_present.patch @@ -0,0 +1,37 @@ +From f44486736a4f8f4cbcb52ef8f08c97fed343502c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 21:54:15 +0800 +Subject: hwmon: (nct7363) Fix a resource leak in nct7363_present_pwm_fanin + +From: Felix Gu + +[ Upstream commit 4923bbff0bcffe488b3aa76829c829bd15b02585 ] + +When calling of_parse_phandle_with_args(), the caller is responsible +to call of_node_put() to release the reference of device node. +In nct7363_present_pwm_fanin, it does not release the reference, +causing a resource leak. + +Signed-off-by: Felix Gu +Link: https://lore.kernel.org/r/tencent_9717645269E4C07D3D131F52201E12E5E10A@qq.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/nct7363.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hwmon/nct7363.c b/drivers/hwmon/nct7363.c +index 71cef794835df..47fc1b4a0f3f9 100644 +--- a/drivers/hwmon/nct7363.c ++++ b/drivers/hwmon/nct7363.c +@@ -349,6 +349,7 @@ static int nct7363_present_pwm_fanin(struct device *dev, + if (ret) + return ret; + ++ of_node_put(args.np); + if (args.args[0] >= NCT7363_PWM_COUNT) + return -EINVAL; + data->pwm_mask |= BIT(args.args[0]); +-- +2.51.0 + diff --git a/queue-6.19/hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch b/queue-6.19/hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch new file mode 100644 index 00000000000..9578b0b5eb8 --- /dev/null +++ b/queue-6.19/hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch @@ -0,0 +1,61 @@ +From 152bac995f1bc286b39c9db9a5220cd9632f6599 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 08:35:44 +0100 +Subject: hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 1e5271393d777f6159d896943b4c44c4f3ecff52 ] + +The unpacked union within a packed struct generates alignment warnings +on clang for 32-bit ARM: + +./usr/include/linux/hyperv.h:361:2: error: field within 'struct hv_kvp_exchg_msg_value' + is less aligned than 'union hv_kvp_exchg_msg_value::(anonymous at ./usr/include/linux/hyperv.h:361:2)' + and is usually due to 'struct hv_kvp_exchg_msg_value' being packed, + which can lead to unaligned accesses [-Werror,-Wunaligned-access] + 361 | union { + | ^ + +With the recent changes to compile-test the UAPI headers in more cases, +this warning in combination with CONFIG_WERROR breaks the build. + +Fix the warning. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/ +Reported-by: Nathan Chancellor +Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/ +Suggested-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/ +Signed-off-by: Thomas Weißschuh +Acked-by: Wei Liu (Microsoft) +Tested-by: Nicolas Schier +Reviewed-by: Nicolas Schier +Acked-by: Greg Kroah-Hartman +Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-1-076aed1623ff@linutronix.de +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + include/uapi/linux/hyperv.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/hyperv.h b/include/uapi/linux/hyperv.h +index aaa502a7bff46..1749b35ab2c21 100644 +--- a/include/uapi/linux/hyperv.h ++++ b/include/uapi/linux/hyperv.h +@@ -362,7 +362,7 @@ struct hv_kvp_exchg_msg_value { + __u8 value[HV_KVP_EXCHANGE_MAX_VALUE_SIZE]; + __u32 value_u32; + __u64 value_u64; +- }; ++ } __attribute__((packed)); + } __attribute__((packed)); + + struct hv_kvp_msg_enumerate { +-- +2.51.0 + diff --git a/queue-6.19/i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch b/queue-6.19/i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch new file mode 100644 index 00000000000..13c2c7299f7 --- /dev/null +++ b/queue-6.19/i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch @@ -0,0 +1,49 @@ +From 65fa03ce6f37b45c9bc936f1a6e5131e610b14ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 15:08:51 -0500 +Subject: i3c: master: svc: Initialize 'dev' to NULL in + svc_i3c_master_ibi_isr() + +From: Frank Li + +[ Upstream commit 3c9ffb4db787428a5851d5865823ab23842d5103 ] + +Initialize the 'dev' pointer to NULL in svc_i3c_master_ibi_isr() and add +a NULL check in the error path. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/r/202512131016.YCKIsDXM-lkp@intel.com/ +Signed-off-by: Frank Li +Link: https://patch.msgid.link/20251215200852.3079073-1-Frank.Li@nxp.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/svc-i3c-master.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c +index a62f22ff8b576..857504d36e186 100644 +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -533,8 +533,8 @@ static int svc_i3c_master_handle_ibi_won(struct svc_i3c_master *master, u32 msta + static void svc_i3c_master_ibi_isr(struct svc_i3c_master *master) + { + struct svc_i3c_i2c_dev_data *data; ++ struct i3c_dev_desc *dev = NULL; + unsigned int ibitype, ibiaddr; +- struct i3c_dev_desc *dev; + u32 status, val; + int ret; + +@@ -627,7 +627,7 @@ static void svc_i3c_master_ibi_isr(struct svc_i3c_master *master) + * for the slave to interrupt again. + */ + if (svc_i3c_master_error(master)) { +- if (master->ibi.tbq_slot) { ++ if (master->ibi.tbq_slot && dev) { + data = i3c_dev_get_master_data(dev); + i3c_generic_ibi_recycle_slot(data->ibi_pool, + master->ibi.tbq_slot); +-- +2.51.0 + diff --git a/queue-6.19/i3c-mipi-i3c-hci-reset-ring_operation1-fields-during.patch b/queue-6.19/i3c-mipi-i3c-hci-reset-ring_operation1-fields-during.patch new file mode 100644 index 00000000000..6bbe91414dd --- /dev/null +++ b/queue-6.19/i3c-mipi-i3c-hci-reset-ring_operation1-fields-during.patch @@ -0,0 +1,45 @@ +From 2b0d2b441dcc08640ef2b7f0245affafcf76e300 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 09:26:42 +0200 +Subject: i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init + +From: Adrian Hunter + +[ Upstream commit 78f63ae4a82db173f93adca462e63d11ba06b126 ] + +The MIPI I3C HCI specification does not define reset values for +RING_OPERATION1 fields, and some controllers (e.g., Intel) do not clear +them during a software reset. Ensure the ring pointers are explicitly +set to zero during bus initialization to avoid inconsistent state. + +Signed-off-by: Adrian Hunter +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20260113072702.16268-2-adrian.hunter@intel.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/mipi-i3c-hci/dma.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c +index c401a9425cdc5..951abfea5a6fd 100644 +--- a/drivers/i3c/master/mipi-i3c-hci/dma.c ++++ b/drivers/i3c/master/mipi-i3c-hci/dma.c +@@ -342,6 +342,14 @@ static int hci_dma_init(struct i3c_hci *hci) + rh_reg_write(INTR_SIGNAL_ENABLE, regval); + + ring_ready: ++ /* ++ * The MIPI I3C HCI specification does not document reset values for ++ * RING_OPERATION1 fields and some controllers (e.g. Intel controllers) ++ * do not reset the values, so ensure the ring pointers are set to zero ++ * here. ++ */ ++ rh_reg_write(RING_OPERATION1, 0); ++ + rh_reg_write(RING_CONTROL, RING_CTRL_ENABLE | + RING_CTRL_RUN_STOP); + } +-- +2.51.0 + diff --git a/queue-6.19/i3c-mipi-i3c-hci-stop-reading-extended-capabilities-.patch b/queue-6.19/i3c-mipi-i3c-hci-stop-reading-extended-capabilities-.patch new file mode 100644 index 00000000000..0ed1622707e --- /dev/null +++ b/queue-6.19/i3c-mipi-i3c-hci-stop-reading-extended-capabilities-.patch @@ -0,0 +1,38 @@ +From cf96a5e97f16c6fa54cda456ce0190d3e560e36d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 18:44:07 +0200 +Subject: i3c: mipi-i3c-hci: Stop reading Extended Capabilities if capability + ID is 0 + +From: Adrian Hunter + +[ Upstream commit 0818e4aa8fdeeed5973e0a8faeddc9da599fc897 ] + +Extended Capability ID value 0 is special. It signifies the end of the +list. Stop reading Extended Capabilities if capability ID is 0. + +Signed-off-by: Adrian Hunter +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20260106164416.67074-3-adrian.hunter@intel.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/mipi-i3c-hci/ext_caps.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i3c/master/mipi-i3c-hci/ext_caps.c b/drivers/i3c/master/mipi-i3c-hci/ext_caps.c +index 7714f00ea9cc0..533a495e14c86 100644 +--- a/drivers/i3c/master/mipi-i3c-hci/ext_caps.c ++++ b/drivers/i3c/master/mipi-i3c-hci/ext_caps.c +@@ -272,7 +272,7 @@ int i3c_hci_parse_ext_caps(struct i3c_hci *hci) + cap_length = FIELD_GET(CAP_HEADER_LENGTH, cap_header); + dev_dbg(&hci->master.dev, "id=0x%02x length=%d", + cap_id, cap_length); +- if (!cap_length) ++ if (!cap_id || !cap_length) + break; + if (curr_cap + cap_length * 4 >= end) { + dev_err(&hci->master.dev, +-- +2.51.0 + diff --git a/queue-6.19/iio-bmi270_i2c-add-module_device_table-for-bmi260-27.patch b/queue-6.19/iio-bmi270_i2c-add-module_device_table-for-bmi260-27.patch new file mode 100644 index 00000000000..c9cd7fb8005 --- /dev/null +++ b/queue-6.19/iio-bmi270_i2c-add-module_device_table-for-bmi260-27.patch @@ -0,0 +1,54 @@ +From 13154b53af98b99fa15461b1b681146038bb0afb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 05:45:19 +0000 +Subject: iio: bmi270_i2c: Add MODULE_DEVICE_TABLE for BMI260/270 + +From: Derek J. Clark + +[ Upstream commit f69b5ac682dbc61e6aca806c22ce2ae74d598e45 ] + +Currently BMI260 & BMI270 devices do not automatically load this +driver. To fix this, add missing MODULE_DEVICE_TABLE for the i2c, +acpi, and of device tables so the driver will load when the hardware +is detected. + +Tested on my OneXPlayer F1 Pro. + +Signed-off-by: Derek J. Clark +Reviewed-by: Andy Shevchenko +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/imu/bmi270/bmi270_i2c.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/iio/imu/bmi270/bmi270_i2c.c b/drivers/iio/imu/bmi270/bmi270_i2c.c +index b909a421ad017..b92da4e0776fa 100644 +--- a/drivers/iio/imu/bmi270/bmi270_i2c.c ++++ b/drivers/iio/imu/bmi270/bmi270_i2c.c +@@ -37,6 +37,7 @@ static const struct i2c_device_id bmi270_i2c_id[] = { + { "bmi270", (kernel_ulong_t)&bmi270_chip_info }, + { } + }; ++MODULE_DEVICE_TABLE(i2c, bmi270_i2c_id); + + static const struct acpi_device_id bmi270_acpi_match[] = { + /* GPD Win Mini, Aya Neo AIR Pro, OXP Mini Pro, etc. */ +@@ -45,12 +46,14 @@ static const struct acpi_device_id bmi270_acpi_match[] = { + { "BMI0260", (kernel_ulong_t)&bmi260_chip_info }, + { } + }; ++MODULE_DEVICE_TABLE(acpi, bmi270_acpi_match); + + static const struct of_device_id bmi270_of_match[] = { + { .compatible = "bosch,bmi260", .data = &bmi260_chip_info }, + { .compatible = "bosch,bmi270", .data = &bmi270_chip_info }, + { } + }; ++MODULE_DEVICE_TABLE(of, bmi270_of_match); + + static struct i2c_driver bmi270_i2c_driver = { + .driver = { +-- +2.51.0 + diff --git a/queue-6.19/iio-magnetometer-remove-irqf_oneshot.patch b/queue-6.19/iio-magnetometer-remove-irqf_oneshot.patch new file mode 100644 index 00000000000..bdcb6cc698f --- /dev/null +++ b/queue-6.19/iio-magnetometer-remove-irqf_oneshot.patch @@ -0,0 +1,49 @@ +From 872d916f432aaf291c5ebc1aa509c7302c55c20e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:38 +0100 +Subject: iio: magnetometer: Remove IRQF_ONESHOT +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sebastian Andrzej Siewior + +[ Upstream commit a54e9440925e6617c98669066b4753c4cdcea8a0 ] + +Passing IRQF_ONESHOT ensures that the interrupt source is masked until +the secondary (threaded) handler is done. If only a primary handler is +used then the flag makes no sense because the interrupt can not fire +(again) while its handler is running. +The flag also disallows force-threading of the primary handler and the +irq-core will warn about this. +The force-threading functionality is required on PREEMPT_RT because the +handler is using locks with can sleep on PREEMPT_RT. + +Remove IRQF_ONESHOT from irqflags. + +Tested-by: Geert Uytterhoeven +Signed-off-by: Sebastian Andrzej Siewior +Reviewed-by: Andy Shevchenko +Reviewed-by: Nuno Sá +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/magnetometer/ak8975.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c +index 3fd0171e5d69b..d30315ad85ded 100644 +--- a/drivers/iio/magnetometer/ak8975.c ++++ b/drivers/iio/magnetometer/ak8975.c +@@ -581,7 +581,7 @@ static int ak8975_setup_irq(struct ak8975_data *data) + irq = gpiod_to_irq(data->eoc_gpiod); + + rc = devm_request_irq(&client->dev, irq, ak8975_irq_handler, +- IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ IRQF_TRIGGER_RISING, + dev_name(&client->dev), data); + if (rc < 0) { + dev_err(&client->dev, "irq %d request failed: %d\n", irq, rc); +-- +2.51.0 + diff --git a/queue-6.19/iio-use-irqf_no_thread.patch b/queue-6.19/iio-use-irqf_no_thread.patch new file mode 100644 index 00000000000..adbccbb476e --- /dev/null +++ b/queue-6.19/iio-use-irqf_no_thread.patch @@ -0,0 +1,90 @@ +From 72ca19ce906bc97aa6e8dfbf8a24e01fc16c275d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:36 +0100 +Subject: iio: Use IRQF_NO_THREAD + +From: Sebastian Andrzej Siewior + +[ Upstream commit 04d390af97f2c28166f7ddfe1a6bda622e3a4766 ] + +The interrupt handler iio_trigger_generic_data_rdy_poll() will invoke +other interrupt handler and this supposed to happen from within the +hardirq. + +Use IRQF_NO_THREAD to forbid forced-threading. + +Signed-off-by: Sebastian Andrzej Siewior +Reviewed-by: Andy Shevchenko +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/accel/bma180.c | 5 +++-- + drivers/iio/adc/ad7766.c | 2 +- + drivers/iio/gyro/itg3200_buffer.c | 8 +++----- + drivers/iio/light/si1145.c | 2 +- + 4 files changed, 8 insertions(+), 9 deletions(-) + +diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c +index 8925f5279e627..7bc6761f51354 100644 +--- a/drivers/iio/accel/bma180.c ++++ b/drivers/iio/accel/bma180.c +@@ -986,8 +986,9 @@ static int bma180_probe(struct i2c_client *client) + } + + ret = devm_request_irq(dev, client->irq, +- iio_trigger_generic_data_rdy_poll, IRQF_TRIGGER_RISING, +- "bma180_event", data->trig); ++ iio_trigger_generic_data_rdy_poll, ++ IRQF_TRIGGER_RISING | IRQF_NO_THREAD, ++ "bma180_event", data->trig); + if (ret) { + dev_err(dev, "unable to request IRQ\n"); + goto err_trigger_free; +diff --git a/drivers/iio/adc/ad7766.c b/drivers/iio/adc/ad7766.c +index 4d570383ef025..1e6bfe8765ab3 100644 +--- a/drivers/iio/adc/ad7766.c ++++ b/drivers/iio/adc/ad7766.c +@@ -261,7 +261,7 @@ static int ad7766_probe(struct spi_device *spi) + * don't enable the interrupt to avoid extra load on the system + */ + ret = devm_request_irq(&spi->dev, spi->irq, ad7766_irq, +- IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN, ++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN | IRQF_NO_THREAD, + dev_name(&spi->dev), + ad7766->trig); + if (ret < 0) +diff --git a/drivers/iio/gyro/itg3200_buffer.c b/drivers/iio/gyro/itg3200_buffer.c +index a624400a239cb..cf97adfa97274 100644 +--- a/drivers/iio/gyro/itg3200_buffer.c ++++ b/drivers/iio/gyro/itg3200_buffer.c +@@ -118,11 +118,9 @@ int itg3200_probe_trigger(struct iio_dev *indio_dev) + if (!st->trig) + return -ENOMEM; + +- ret = request_irq(st->i2c->irq, +- &iio_trigger_generic_data_rdy_poll, +- IRQF_TRIGGER_RISING, +- "itg3200_data_rdy", +- st->trig); ++ ret = request_irq(st->i2c->irq, &iio_trigger_generic_data_rdy_poll, ++ IRQF_TRIGGER_RISING | IRQF_NO_THREAD, ++ "itg3200_data_rdy", st->trig); + if (ret) + goto error_free_trig; + +diff --git a/drivers/iio/light/si1145.c b/drivers/iio/light/si1145.c +index f8eb251eca8dc..ef0abc4499b74 100644 +--- a/drivers/iio/light/si1145.c ++++ b/drivers/iio/light/si1145.c +@@ -1248,7 +1248,7 @@ static int si1145_probe_trigger(struct iio_dev *indio_dev) + + ret = devm_request_irq(&client->dev, client->irq, + iio_trigger_generic_data_rdy_poll, +- IRQF_TRIGGER_FALLING, ++ IRQF_TRIGGER_FALLING | IRQF_NO_THREAD, + "si1145_irq", + trig); + if (ret < 0) { +-- +2.51.0 + diff --git a/queue-6.19/include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch b/queue-6.19/include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch new file mode 100644 index 00000000000..c495a7da164 --- /dev/null +++ b/queue-6.19/include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch @@ -0,0 +1,42 @@ +From 77d5d5b7287cffe74455743ea6c3989d258395ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Feb 2026 15:54:06 +0100 +Subject: include: uapi: netfilter_bridge.h: Cover for musl libc + +From: Phil Sutter + +[ Upstream commit 4edd4ba71ce0df015303dba75ea9d20d1a217546 ] + +Musl defines its own struct ethhdr and thus defines __UAPI_DEF_ETHHDR to +zero. To avoid struct redefinition errors, user space is therefore +supposed to include netinet/if_ether.h before (or instead of) +linux/if_ether.h. To relieve them from this burden, include the libc +header here if not building for kernel space. + +Reported-by: Alyssa Ross +Suggested-by: Florian Westphal +Signed-off-by: Phil Sutter +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + include/uapi/linux/netfilter_bridge.h | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/include/uapi/linux/netfilter_bridge.h b/include/uapi/linux/netfilter_bridge.h +index 1610fdbab98df..ad520d3e9df8f 100644 +--- a/include/uapi/linux/netfilter_bridge.h ++++ b/include/uapi/linux/netfilter_bridge.h +@@ -5,6 +5,10 @@ + /* bridge-specific defines for netfilter. + */ + ++#ifndef __KERNEL__ ++#include /* for __UAPI_DEF_ETHHDR if defined */ ++#endif ++ + #include + #include + #include +-- +2.51.0 + diff --git a/queue-6.19/io_uring-add-ioring_op_uring_cmd128-to-opcode-checks.patch b/queue-6.19/io_uring-add-ioring_op_uring_cmd128-to-opcode-checks.patch new file mode 100644 index 00000000000..d0c960d046d --- /dev/null +++ b/queue-6.19/io_uring-add-ioring_op_uring_cmd128-to-opcode-checks.patch @@ -0,0 +1,82 @@ +From ced0759f528817f941d9fbf4578c1dfd7332c201 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Feb 2026 18:35:34 -0700 +Subject: io_uring: add IORING_OP_URING_CMD128 to opcode checks + +From: Caleb Sander Mateos + +[ Upstream commit 42a6bd57ee9f930a72c26f863c72f666d6ed9ea5 ] + +io_should_commit(), io_uring_classic_poll(), and io_do_iopoll() compare +struct io_kiocb's opcode against IORING_OP_URING_CMD to implement +special treatment for uring_cmds. The recently added opcode +IORING_OP_URING_CMD128 is meant to be equivalent to IORING_OP_URING_CMD, +so treat it the same way in these functions. + +Fixes: 1cba30bf9fdd ("io_uring: add support for IORING_SETUP_SQE_MIXED") +Signed-off-by: Caleb Sander Mateos +Reviewed-by: Anuj Gupta +Reviewed-by: Kanchan Joshi +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/io_uring.h | 6 ++++++ + io_uring/kbuf.c | 2 +- + io_uring/rw.c | 4 ++-- + 3 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/io_uring/io_uring.h b/io_uring/io_uring.h +index a790c16854d32..0f096f44d34bf 100644 +--- a/io_uring/io_uring.h ++++ b/io_uring/io_uring.h +@@ -595,6 +595,12 @@ static inline bool io_file_can_poll(struct io_kiocb *req) + return false; + } + ++static inline bool io_is_uring_cmd(const struct io_kiocb *req) ++{ ++ return req->opcode == IORING_OP_URING_CMD || ++ req->opcode == IORING_OP_URING_CMD128; ++} ++ + static inline ktime_t io_get_time(struct io_ring_ctx *ctx) + { + if (ctx->clockid == CLOCK_MONOTONIC) +diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c +index 67d4fe576473a..dae5b4ab3819c 100644 +--- a/io_uring/kbuf.c ++++ b/io_uring/kbuf.c +@@ -171,7 +171,7 @@ static bool io_should_commit(struct io_kiocb *req, unsigned int issue_flags) + return true; + + /* uring_cmd commits kbuf upfront, no need to auto-commit */ +- if (!io_file_can_poll(req) && req->opcode != IORING_OP_URING_CMD) ++ if (!io_file_can_poll(req) && !io_is_uring_cmd(req)) + return true; + return false; + } +diff --git a/io_uring/rw.c b/io_uring/rw.c +index 28555bc85ba0f..01367ac09531a 100644 +--- a/io_uring/rw.c ++++ b/io_uring/rw.c +@@ -1253,7 +1253,7 @@ static int io_uring_classic_poll(struct io_kiocb *req, struct io_comp_batch *iob + { + struct file *file = req->file; + +- if (req->opcode == IORING_OP_URING_CMD) { ++ if (io_is_uring_cmd(req)) { + struct io_uring_cmd *ioucmd; + + ioucmd = io_kiocb_to_cmd(req, struct io_uring_cmd); +@@ -1376,7 +1376,7 @@ int io_do_iopoll(struct io_ring_ctx *ctx, bool force_nonspin) + break; + nr_events++; + req->cqe.flags = io_put_kbuf(req, req->cqe.res, NULL); +- if (req->opcode != IORING_OP_URING_CMD) ++ if (!io_is_uring_cmd(req)) + io_req_rw_cleanup(req, 0); + } + if (unlikely(!nr_events)) +-- +2.51.0 + diff --git a/queue-6.19/io_uring-timeout-annotate-data-race-in-io_flush_time.patch b/queue-6.19/io_uring-timeout-annotate-data-race-in-io_flush_time.patch new file mode 100644 index 00000000000..02b9baa418f --- /dev/null +++ b/queue-6.19/io_uring-timeout-annotate-data-race-in-io_flush_time.patch @@ -0,0 +1,39 @@ +From b766b4a1150fa92e19c3f00cfc7164801da0b3b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 09:53:43 -0700 +Subject: io_uring/timeout: annotate data race in io_flush_timeouts() + +From: Jens Axboe + +[ Upstream commit 42b12cb5fd4554679bac06bbdd05dc8b643bcc42 ] + +syzbot correctly reports this as a KCSAN race, as ctx->cached_cq_tail +should be read under ->uring_lock. This isn't immediately feasible in +io_flush_timeouts(), but as long as we read a stable value, that should +be good enough. If two io-wq threads compete on this value, then they +will both end up calling io_flush_timeouts() and at least one of them +will see the correct value. + +Reported-by: syzbot+6c48db7d94402407301e@syzkaller.appspotmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/timeout.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/io_uring/timeout.c b/io_uring/timeout.c +index d8fbbaf31cf35..84dda24f3eb24 100644 +--- a/io_uring/timeout.c ++++ b/io_uring/timeout.c +@@ -130,7 +130,7 @@ __cold void io_flush_timeouts(struct io_ring_ctx *ctx) + u32 seq; + + raw_spin_lock_irq(&ctx->timeout_lock); +- seq = ctx->cached_cq_tail - atomic_read(&ctx->cq_timeouts); ++ seq = READ_ONCE(ctx->cached_cq_tail) - atomic_read(&ctx->cq_timeouts); + + list_for_each_entry_safe(timeout, tmp, &ctx->timeout_list, list) { + struct io_kiocb *req = cmd_to_io_kiocb(timeout); +-- +2.51.0 + diff --git a/queue-6.19/iommu-amd-move-wait_on_sem-out-of-spinlock.patch b/queue-6.19/iommu-amd-move-wait_on_sem-out-of-spinlock.patch new file mode 100644 index 00000000000..282284d1235 --- /dev/null +++ b/queue-6.19/iommu-amd-move-wait_on_sem-out-of-spinlock.patch @@ -0,0 +1,87 @@ +From 417226f5eefb92eda4fe1c62bf20e54e25966300 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 14:39:40 +0000 +Subject: iommu/amd: move wait_on_sem() out of spinlock + +From: Ankit Soni + +[ Upstream commit d2a0cac10597068567d336e85fa3cbdbe8ca62bf ] + +With iommu.strict=1, the existing completion wait path can cause soft +lockups under stressed environment, as wait_on_sem() busy-waits under the +spinlock with interrupts disabled. + +Move the completion wait in iommu_completion_wait() out of the spinlock. +wait_on_sem() only polls the hardware-updated cmd_sem and does not require +iommu->lock, so holding the lock during the busy wait unnecessarily +increases contention and extends the time with interrupts disabled. + +Signed-off-by: Ankit Soni +Reviewed-by: Vasant Hegde +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd/iommu.c | 25 +++++++++++++++++-------- + 1 file changed, 17 insertions(+), 8 deletions(-) + +diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c +index 0f9045ce93af1..c5f7e003d01c9 100644 +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -1180,7 +1180,12 @@ static int wait_on_sem(struct amd_iommu *iommu, u64 data) + { + int i = 0; + +- while (*iommu->cmd_sem != data && i < LOOP_TIMEOUT) { ++ /* ++ * cmd_sem holds a monotonically non-decreasing completion sequence ++ * number. ++ */ ++ while ((__s64)(READ_ONCE(*iommu->cmd_sem) - data) < 0 && ++ i < LOOP_TIMEOUT) { + udelay(1); + i += 1; + } +@@ -1432,14 +1437,13 @@ static int iommu_completion_wait(struct amd_iommu *iommu) + raw_spin_lock_irqsave(&iommu->lock, flags); + + ret = __iommu_queue_command_sync(iommu, &cmd, false); ++ raw_spin_unlock_irqrestore(&iommu->lock, flags); ++ + if (ret) +- goto out_unlock; ++ return ret; + + ret = wait_on_sem(iommu, data); + +-out_unlock: +- raw_spin_unlock_irqrestore(&iommu->lock, flags); +- + return ret; + } + +@@ -3115,13 +3119,18 @@ static void iommu_flush_irt_and_complete(struct amd_iommu *iommu, u16 devid) + raw_spin_lock_irqsave(&iommu->lock, flags); + ret = __iommu_queue_command_sync(iommu, &cmd, true); + if (ret) +- goto out; ++ goto out_err; + ret = __iommu_queue_command_sync(iommu, &cmd2, false); + if (ret) +- goto out; ++ goto out_err; ++ raw_spin_unlock_irqrestore(&iommu->lock, flags); ++ + wait_on_sem(iommu, data); +-out: ++ return; ++ ++out_err: + raw_spin_unlock_irqrestore(&iommu->lock, flags); ++ return; + } + + static inline u8 iommu_get_int_tablen(struct iommu_dev_data *dev_data) +-- +2.51.0 + diff --git a/queue-6.19/iommu-amd-serialize-sequence-allocation-under-concur.patch b/queue-6.19/iommu-amd-serialize-sequence-allocation-under-concur.patch new file mode 100644 index 00000000000..3cdbd63c83c --- /dev/null +++ b/queue-6.19/iommu-amd-serialize-sequence-allocation-under-concur.patch @@ -0,0 +1,115 @@ +From 43bf5fba7bb71fd497de8590c4eea2bb66c44d9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 15:30:38 +0000 +Subject: iommu/amd: serialize sequence allocation under concurrent TLB + invalidations + +From: Ankit Soni + +[ Upstream commit 9e249c48412828e807afddc21527eb734dc9bd3d ] + +With concurrent TLB invalidations, completion wait randomly gets timed out +because cmd_sem_val was incremented outside the IOMMU spinlock, allowing +CMD_COMPL_WAIT commands to be queued out of sequence and breaking the +ordering assumption in wait_on_sem(). +Move the cmd_sem_val increment under iommu->lock so completion sequence +allocation is serialized with command queuing. +And remove the unnecessary return. + +Fixes: d2a0cac10597 ("iommu/amd: move wait_on_sem() out of spinlock") + +Tested-by: Srikanth Aithal +Reported-by: Srikanth Aithal +Signed-off-by: Ankit Soni +Reviewed-by: Vasant Hegde +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd/amd_iommu_types.h | 2 +- + drivers/iommu/amd/init.c | 2 +- + drivers/iommu/amd/iommu.c | 18 ++++++++++++------ + 3 files changed, 14 insertions(+), 8 deletions(-) + +diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h +index 320733e7d8b42..3b09da3ffb74f 100644 +--- a/drivers/iommu/amd/amd_iommu_types.h ++++ b/drivers/iommu/amd/amd_iommu_types.h +@@ -706,7 +706,7 @@ struct amd_iommu { + + u32 flags; + volatile u64 *cmd_sem; +- atomic64_t cmd_sem_val; ++ u64 cmd_sem_val; + /* + * Track physical address to directly use it in build_completion_wait() + * and avoid adding any special checks and handling for kdump. +diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c +index 62a7a718acf8f..58d6f5ae155f2 100644 +--- a/drivers/iommu/amd/init.c ++++ b/drivers/iommu/amd/init.c +@@ -1877,7 +1877,7 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h, + iommu->pci_seg = pci_seg; + + raw_spin_lock_init(&iommu->lock); +- atomic64_set(&iommu->cmd_sem_val, 0); ++ iommu->cmd_sem_val = 0; + + /* Add IOMMU to internal data structures */ + list_add_tail(&iommu->list, &amd_iommu_list); +diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c +index c5f7e003d01c9..e216b5a13d49d 100644 +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -1417,6 +1417,12 @@ static int iommu_queue_command(struct amd_iommu *iommu, struct iommu_cmd *cmd) + return iommu_queue_command_sync(iommu, cmd, true); + } + ++static u64 get_cmdsem_val(struct amd_iommu *iommu) ++{ ++ lockdep_assert_held(&iommu->lock); ++ return ++iommu->cmd_sem_val; ++} ++ + /* + * This function queues a completion wait command into the command + * buffer of an IOMMU +@@ -1431,11 +1437,11 @@ static int iommu_completion_wait(struct amd_iommu *iommu) + if (!iommu->need_sync) + return 0; + +- data = atomic64_inc_return(&iommu->cmd_sem_val); +- build_completion_wait(&cmd, iommu, data); +- + raw_spin_lock_irqsave(&iommu->lock, flags); + ++ data = get_cmdsem_val(iommu); ++ build_completion_wait(&cmd, iommu, data); ++ + ret = __iommu_queue_command_sync(iommu, &cmd, false); + raw_spin_unlock_irqrestore(&iommu->lock, flags); + +@@ -3113,10 +3119,11 @@ static void iommu_flush_irt_and_complete(struct amd_iommu *iommu, u16 devid) + return; + + build_inv_irt(&cmd, devid); +- data = atomic64_inc_return(&iommu->cmd_sem_val); +- build_completion_wait(&cmd2, iommu, data); + + raw_spin_lock_irqsave(&iommu->lock, flags); ++ data = get_cmdsem_val(iommu); ++ build_completion_wait(&cmd2, iommu, data); ++ + ret = __iommu_queue_command_sync(iommu, &cmd, true); + if (ret) + goto out_err; +@@ -3130,7 +3137,6 @@ static void iommu_flush_irt_and_complete(struct amd_iommu *iommu, u16 devid) + + out_err: + raw_spin_unlock_irqrestore(&iommu->lock, flags); +- return; + } + + static inline u8 iommu_get_int_tablen(struct iommu_dev_data *dev_data) +-- +2.51.0 + diff --git a/queue-6.19/iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch b/queue-6.19/iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch new file mode 100644 index 00000000000..430ef778036 --- /dev/null +++ b/queue-6.19/iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch @@ -0,0 +1,134 @@ +From 186b094d204682ba2f6ec569ee19bb55a866daca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 13:28:57 -0800 +Subject: iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency + +From: Alexander Grest + +[ Upstream commit df180b1a4cc51011c5f8c52c7ec02ad2e42962de ] + +The SMMU CMDQ lock is highly contentious when there are multiple CPUs +issuing commands and the queue is nearly full. + +The lock has the following states: + - 0: Unlocked + - >0: Shared lock held with count + - INT_MIN+N: Exclusive lock held, where N is the # of shared waiters + - INT_MIN: Exclusive lock held, no shared waiters + +When multiple CPUs are polling for space in the queue, they attempt to +grab the exclusive lock to update the cons pointer from the hardware. If +they fail to get the lock, they will spin until either the cons pointer +is updated by another CPU. + +The current code allows the possibility of shared lock starvation +if there is a constant stream of CPUs trying to grab the exclusive lock. +This leads to severe latency issues and soft lockups. + +Consider the following scenario where CPU1's attempt to acquire the +shared lock is starved by CPU2 and CPU0 contending for the exclusive +lock. + +CPU0 (exclusive) | CPU1 (shared) | CPU2 (exclusive) | `cmdq->lock` +-------------------------------------------------------------------------- +trylock() //takes | | | 0 + | shared_lock() | | INT_MIN + | fetch_inc() | | INT_MIN + | no return | | INT_MIN + 1 + | spins // VAL >= 0 | | INT_MIN + 1 +unlock() | spins... | | INT_MIN + 1 +set_release(0) | spins... | | 0 see[NOTE] +(done) | (sees 0) | trylock() // takes | 0 + | *exits loop* | cmpxchg(0, INT_MIN) | 0 + | | *cuts in* | INT_MIN + | cmpxchg(0, 1) | | INT_MIN + | fails // != 0 | | INT_MIN + | spins // VAL >= 0 | | INT_MIN + | *starved* | | INT_MIN + +[NOTE] The current code resets the exclusive lock to 0 regardless of the +state of the lock. This causes two problems: +1. It opens the possibility of back-to-back exclusive locks and the + downstream effect of starving shared lock. +2. The count of shared lock waiters are lost. + +To mitigate this, we release the exclusive lock by only clearing the sign +bit while retaining the shared lock waiter count as a way to avoid +starving the shared lock waiters. + +Also deleted cmpxchg loop while trying to acquire the shared lock as it +is not needed. The waiters can see the positive lock count and proceed +immediately after the exclusive lock is released. + +Exclusive lock is not starved in that submitters will try exclusive lock +first when new spaces become available. + +Reviewed-by: Mostafa Saleh +Reviewed-by: Nicolin Chen +Signed-off-by: Alexander Grest +Signed-off-by: Jacob Pan +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 31 ++++++++++++++------- + 1 file changed, 21 insertions(+), 10 deletions(-) + +diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +index d16d35c78c068..7a6aea3b61c11 100644 +--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c ++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +@@ -487,20 +487,26 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu) + */ + static void arm_smmu_cmdq_shared_lock(struct arm_smmu_cmdq *cmdq) + { +- int val; +- + /* +- * We can try to avoid the cmpxchg() loop by simply incrementing the +- * lock counter. When held in exclusive state, the lock counter is set +- * to INT_MIN so these increments won't hurt as the value will remain +- * negative. ++ * When held in exclusive state, the lock counter is set to INT_MIN ++ * so these increments won't hurt as the value will remain negative. ++ * The increment will also signal the exclusive locker that there are ++ * shared waiters. + */ + if (atomic_fetch_inc_relaxed(&cmdq->lock) >= 0) + return; + +- do { +- val = atomic_cond_read_relaxed(&cmdq->lock, VAL >= 0); +- } while (atomic_cmpxchg_relaxed(&cmdq->lock, val, val + 1) != val); ++ /* ++ * Someone else is holding the lock in exclusive state, so wait ++ * for them to finish. Since we already incremented the lock counter, ++ * no exclusive lock can be acquired until we finish. We don't need ++ * the return value since we only care that the exclusive lock is ++ * released (i.e. the lock counter is non-negative). ++ * Once the exclusive locker releases the lock, the sign bit will ++ * be cleared and our increment will make the lock counter positive, ++ * allowing us to proceed. ++ */ ++ atomic_cond_read_relaxed(&cmdq->lock, VAL > 0); + } + + static void arm_smmu_cmdq_shared_unlock(struct arm_smmu_cmdq *cmdq) +@@ -527,9 +533,14 @@ static bool arm_smmu_cmdq_shared_tryunlock(struct arm_smmu_cmdq *cmdq) + __ret; \ + }) + ++/* ++ * Only clear the sign bit when releasing the exclusive lock this will ++ * allow any shared_lock() waiters to proceed without the possibility ++ * of entering the exclusive lock in a tight loop. ++ */ + #define arm_smmu_cmdq_exclusive_unlock_irqrestore(cmdq, flags) \ + ({ \ +- atomic_set_release(&cmdq->lock, 0); \ ++ atomic_fetch_andnot_release(INT_MIN, &cmdq->lock); \ + local_irq_restore(flags); \ + }) + +-- +2.51.0 + diff --git a/queue-6.19/ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch b/queue-6.19/ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch new file mode 100644 index 00000000000..4521fce023b --- /dev/null +++ b/queue-6.19/ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch @@ -0,0 +1,123 @@ +From 8eb9631facdf2e122aef8f0c6da5c420233ab48e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 04:35:24 +0000 +Subject: ipv4: fib: Annotate access to struct fib_alias.fa_state. + +From: Kuniyuki Iwashima + +[ Upstream commit 6e84fc395e90465f1418f582a9f7d53c87ab010e ] + +syzbot reported that struct fib_alias.fa_state can be +modified locklessly by RCU readers. [0] + +Let's use READ_ONCE()/WRITE_ONCE() properly. + +[0]: +BUG: KCSAN: data-race in fib_table_lookup / fib_table_lookup + +write to 0xffff88811b06a7fa of 1 bytes by task 4167 on cpu 0: + fib_alias_accessed net/ipv4/fib_lookup.h:32 [inline] + fib_table_lookup+0x361/0xd60 net/ipv4/fib_trie.c:1565 + fib_lookup include/net/ip_fib.h:390 [inline] + ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814 + ip_route_output_key_hash net/ipv4/route.c:2705 [inline] + __ip_route_output_key include/net/route.h:169 [inline] + ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932 + udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450 + inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859 + sock_sendmsg_nosec net/socket.c:727 [inline] + __sock_sendmsg net/socket.c:742 [inline] + ____sys_sendmsg+0x53a/0x600 net/socket.c:2592 + ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646 + __sys_sendmmsg+0x185/0x320 net/socket.c:2735 + __do_sys_sendmmsg net/socket.c:2762 [inline] + __se_sys_sendmmsg net/socket.c:2759 [inline] + __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759 + x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +read to 0xffff88811b06a7fa of 1 bytes by task 4168 on cpu 1: + fib_alias_accessed net/ipv4/fib_lookup.h:31 [inline] + fib_table_lookup+0x338/0xd60 net/ipv4/fib_trie.c:1565 + fib_lookup include/net/ip_fib.h:390 [inline] + ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814 + ip_route_output_key_hash net/ipv4/route.c:2705 [inline] + __ip_route_output_key include/net/route.h:169 [inline] + ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932 + udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450 + inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859 + sock_sendmsg_nosec net/socket.c:727 [inline] + __sock_sendmsg net/socket.c:742 [inline] + ____sys_sendmsg+0x53a/0x600 net/socket.c:2592 + ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646 + __sys_sendmmsg+0x185/0x320 net/socket.c:2735 + __do_sys_sendmmsg net/socket.c:2762 [inline] + __se_sys_sendmmsg net/socket.c:2759 [inline] + __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759 + x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +value changed: 0x00 -> 0x01 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 1 UID: 0 PID: 4168 Comm: syz.4.206 Not tainted syzkaller #0 PREEMPT(voluntary) +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 + +Reported-by: syzbot+d24f940f770afda885cf@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/69783ead.050a0220.c9109.0013.GAE@google.com/ +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260127043528.514160-1-kuniyu@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/fib_lookup.h | 6 ++++-- + net/ipv4/fib_trie.c | 4 ++-- + 2 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h +index f9b9e26c32c19..0b72796dd1ad3 100644 +--- a/net/ipv4/fib_lookup.h ++++ b/net/ipv4/fib_lookup.h +@@ -28,8 +28,10 @@ struct fib_alias { + /* Don't write on fa_state unless needed, to keep it shared on all cpus */ + static inline void fib_alias_accessed(struct fib_alias *fa) + { +- if (!(fa->fa_state & FA_S_ACCESSED)) +- fa->fa_state |= FA_S_ACCESSED; ++ u8 fa_state = READ_ONCE(fa->fa_state); ++ ++ if (!(fa_state & FA_S_ACCESSED)) ++ WRITE_ONCE(fa->fa_state, fa_state | FA_S_ACCESSED); + } + + /* Exported by fib_semantics.c */ +diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c +index 7e2c17fec3fc4..1308213791f19 100644 +--- a/net/ipv4/fib_trie.c ++++ b/net/ipv4/fib_trie.c +@@ -1280,7 +1280,7 @@ int fib_table_insert(struct net *net, struct fib_table *tb, + new_fa->fa_dscp = fa->fa_dscp; + new_fa->fa_info = fi; + new_fa->fa_type = cfg->fc_type; +- state = fa->fa_state; ++ state = READ_ONCE(fa->fa_state); + new_fa->fa_state = state & ~FA_S_ACCESSED; + new_fa->fa_slen = fa->fa_slen; + new_fa->tb_id = tb->tb_id; +@@ -1745,7 +1745,7 @@ int fib_table_delete(struct net *net, struct fib_table *tb, + + fib_remove_alias(t, tp, l, fa_to_delete); + +- if (fa_to_delete->fa_state & FA_S_ACCESSED) ++ if (READ_ONCE(fa_to_delete->fa_state) & FA_S_ACCESSED) + rt_cache_flush(cfg->fc_nlinfo.nl_net); + + fib_release_info(fa_to_delete->fa_info); +-- +2.51.0 + diff --git a/queue-6.19/ipv4-igmp-annotate-data-races-around-idev-mr_maxdela.patch b/queue-6.19/ipv4-igmp-annotate-data-races-around-idev-mr_maxdela.patch new file mode 100644 index 00000000000..6ee42b9063c --- /dev/null +++ b/queue-6.19/ipv4-igmp-annotate-data-races-around-idev-mr_maxdela.patch @@ -0,0 +1,66 @@ +From 74aedc818e5d21089b86d27fbc6b8463cad0f5b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 17:22:47 +0000 +Subject: ipv4: igmp: annotate data-races around idev->mr_maxdelay + +From: Eric Dumazet + +[ Upstream commit e4faaf65a75f650ac4366ddff5dabb826029ca5a ] + +idev->mr_maxdelay is read and written locklessly, +add READ_ONCE()/WRITE_ONCE() annotations. + +While we are at it, make this field an u32. + +Signed-off-by: Eric Dumazet +Reviewed-by: David Ahern +Link: https://patch.msgid.link/20260122172247.2429403-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/linux/inetdevice.h | 2 +- + net/ipv4/igmp.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h +index 5730ba6b1cfaf..dccbeb25f7014 100644 +--- a/include/linux/inetdevice.h ++++ b/include/linux/inetdevice.h +@@ -38,11 +38,11 @@ struct in_device { + struct ip_mc_list *mc_tomb; + unsigned long mr_v1_seen; + unsigned long mr_v2_seen; +- unsigned long mr_maxdelay; + unsigned long mr_qi; /* Query Interval */ + unsigned long mr_qri; /* Query Response Interval */ + unsigned char mr_qrv; /* Query Robustness Variable */ + unsigned char mr_gq_running; ++ u32 mr_maxdelay; + u32 mr_ifc_count; + struct timer_list mr_gq_timer; /* general query timer */ + struct timer_list mr_ifc_timer; /* interface change timer */ +diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c +index 7182f1419c2a4..0adc993c211d7 100644 +--- a/net/ipv4/igmp.c ++++ b/net/ipv4/igmp.c +@@ -227,7 +227,7 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay) + + static void igmp_gq_start_timer(struct in_device *in_dev) + { +- int tv = get_random_u32_below(in_dev->mr_maxdelay); ++ int tv = get_random_u32_below(READ_ONCE(in_dev->mr_maxdelay)); + unsigned long exp = jiffies + tv + 2; + + if (in_dev->mr_gq_running && +@@ -1009,7 +1009,7 @@ static bool igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb, + max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE); + if (!max_delay) + max_delay = 1; /* can't mod w/ 0 */ +- in_dev->mr_maxdelay = max_delay; ++ WRITE_ONCE(in_dev->mr_maxdelay, max_delay); + + /* RFC3376, 4.1.6. QRV and 4.1.7. QQIC, when the most recently + * received value was zero, use the default or statically +-- +2.51.0 + diff --git a/queue-6.19/ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch b/queue-6.19/ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch new file mode 100644 index 00000000000..41a10fd547e --- /dev/null +++ b/queue-6.19/ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch @@ -0,0 +1,41 @@ +From b92d2c96e0eed9ccd9d157fb9524a8260b4a934f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 09:41:37 +0000 +Subject: ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() + +From: Eric Dumazet + +[ Upstream commit 03e9d91dd64e2f5ea632df5d59568d91757efc4d ] + +Add missing READ_ONCE() when reading sysctl values. + +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260115094141.3124990-5-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/ipv6.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/net/ipv6.h b/include/net/ipv6.h +index 6a933690e0ff5..e759a00dbde19 100644 +--- a/include/net/ipv6.h ++++ b/include/net/ipv6.h +@@ -1010,11 +1010,11 @@ static inline int ip6_default_np_autolabel(struct net *net) + #if IS_ENABLED(CONFIG_IPV6) + static inline int ip6_multipath_hash_policy(const struct net *net) + { +- return net->ipv6.sysctl.multipath_hash_policy; ++ return READ_ONCE(net->ipv6.sysctl.multipath_hash_policy); + } + static inline u32 ip6_multipath_hash_fields(const struct net *net) + { +- return net->ipv6.sysctl.multipath_hash_fields; ++ return READ_ONCE(net->ipv6.sysctl.multipath_hash_fields); + } + #else + static inline int ip6_multipath_hash_policy(const struct net *net) +-- +2.51.0 + diff --git a/queue-6.19/ipv6-annotate-data-races-in-net-ipv6-route.c.patch b/queue-6.19/ipv6-annotate-data-races-in-net-ipv6-route.c.patch new file mode 100644 index 00000000000..78547984c20 --- /dev/null +++ b/queue-6.19/ipv6-annotate-data-races-in-net-ipv6-route.c.patch @@ -0,0 +1,109 @@ +From dc79e005d1c5edd292ca6a814c00e806cd008b5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 09:41:41 +0000 +Subject: ipv6: annotate data-races in net/ipv6/route.c + +From: Eric Dumazet + +[ Upstream commit f062e8e25102324364aada61b8283356235bc3c1 ] + +sysctls are read while their values can change, +add READ_ONCE() annotations. + +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260115094141.3124990-9-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/route.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index e3a260a5564ba..cd229974b7974 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -2895,7 +2895,7 @@ static void rt6_do_update_pmtu(struct rt6_info *rt, u32 mtu) + + dst_metric_set(&rt->dst, RTAX_MTU, mtu); + rt->rt6i_flags |= RTF_MODIFIED; +- rt6_update_expires(rt, net->ipv6.sysctl.ip6_rt_mtu_expires); ++ rt6_update_expires(rt, READ_ONCE(net->ipv6.sysctl.ip6_rt_mtu_expires)); + } + + static bool rt6_cache_allowed_for_pmtu(const struct rt6_info *rt) +@@ -3256,8 +3256,8 @@ static unsigned int ip6_default_advmss(const struct dst_entry *dst) + rcu_read_lock(); + + net = dst_dev_net_rcu(dst); +- if (mtu < net->ipv6.sysctl.ip6_rt_min_advmss) +- mtu = net->ipv6.sysctl.ip6_rt_min_advmss; ++ mtu = max_t(unsigned int, mtu, ++ READ_ONCE(net->ipv6.sysctl.ip6_rt_min_advmss)); + + rcu_read_unlock(); + +@@ -3359,10 +3359,10 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev, + static void ip6_dst_gc(struct dst_ops *ops) + { + struct net *net = container_of(ops, struct net, ipv6.ip6_dst_ops); +- int rt_min_interval = net->ipv6.sysctl.ip6_rt_gc_min_interval; +- int rt_elasticity = net->ipv6.sysctl.ip6_rt_gc_elasticity; +- int rt_gc_timeout = net->ipv6.sysctl.ip6_rt_gc_timeout; +- unsigned long rt_last_gc = net->ipv6.ip6_rt_last_gc; ++ int rt_min_interval = READ_ONCE(net->ipv6.sysctl.ip6_rt_gc_min_interval); ++ int rt_elasticity = READ_ONCE(net->ipv6.sysctl.ip6_rt_gc_elasticity); ++ int rt_gc_timeout = READ_ONCE(net->ipv6.sysctl.ip6_rt_gc_timeout); ++ unsigned long rt_last_gc = READ_ONCE(net->ipv6.ip6_rt_last_gc); + unsigned int val; + int entries; + +@@ -5008,7 +5008,7 @@ void rt6_sync_down_dev(struct net_device *dev, unsigned long event) + }; + struct net *net = dev_net(dev); + +- if (net->ipv6.sysctl.skip_notify_on_dev_down) ++ if (READ_ONCE(net->ipv6.sysctl.skip_notify_on_dev_down)) + fib6_clean_all_skip_notify(net, fib6_ifdown, &arg); + else + fib6_clean_all(net, fib6_ifdown, &arg); +@@ -6408,6 +6408,7 @@ void fib6_rt_update(struct net *net, struct fib6_info *rt, + void fib6_info_hw_flags_set(struct net *net, struct fib6_info *f6i, + bool offload, bool trap, bool offload_failed) + { ++ u8 fib_notify_on_flag_change; + struct sk_buff *skb; + int err; + +@@ -6419,8 +6420,9 @@ void fib6_info_hw_flags_set(struct net *net, struct fib6_info *f6i, + WRITE_ONCE(f6i->offload, offload); + WRITE_ONCE(f6i->trap, trap); + ++ fib_notify_on_flag_change = READ_ONCE(net->ipv6.sysctl.fib_notify_on_flag_change); + /* 2 means send notifications only if offload_failed was changed. */ +- if (net->ipv6.sysctl.fib_notify_on_flag_change == 2 && ++ if (fib_notify_on_flag_change == 2 && + READ_ONCE(f6i->offload_failed) == offload_failed) + return; + +@@ -6432,7 +6434,7 @@ void fib6_info_hw_flags_set(struct net *net, struct fib6_info *f6i, + */ + return; + +- if (!net->ipv6.sysctl.fib_notify_on_flag_change) ++ if (!fib_notify_on_flag_change) + return; + + skb = nlmsg_new(rt6_nlmsg_size(f6i), GFP_KERNEL); +@@ -6529,7 +6531,7 @@ static int ipv6_sysctl_rtcache_flush(const struct ctl_table *ctl, int write, + return ret; + + net = (struct net *)ctl->extra1; +- delay = net->ipv6.sysctl.flush_delay; ++ delay = READ_ONCE(net->ipv6.sysctl.flush_delay); + fib6_run_gc(delay <= 0 ? 0 : (unsigned long)delay, net, delay > 0); + return 0; + } +-- +2.51.0 + diff --git a/queue-6.19/ipv6-annotate-data-races-over-sysctl.flowlabel_refle.patch b/queue-6.19/ipv6-annotate-data-races-over-sysctl.flowlabel_refle.patch new file mode 100644 index 00000000000..1fcedbf6fc7 --- /dev/null +++ b/queue-6.19/ipv6-annotate-data-races-over-sysctl.flowlabel_refle.patch @@ -0,0 +1,69 @@ +From 3f3ced5132677e010c3532658571c137342aa5fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 09:41:38 +0000 +Subject: ipv6: annotate data-races over sysctl.flowlabel_reflect + +From: Eric Dumazet + +[ Upstream commit 5ade47c974b46eb2a1279185962a0ffa15dc5450 ] + +Add missing READ_ONCE() when reading ipv6.sysctl.flowlabel_reflect, +as its value can be changed under us. + +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260115094141.3124990-6-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/af_inet6.c | 4 ++-- + net/ipv6/icmp.c | 3 ++- + net/ipv6/tcp_ipv6.c | 3 ++- + 3 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c +index d3534bdb805da..56d453a598ec6 100644 +--- a/net/ipv6/af_inet6.c ++++ b/net/ipv6/af_inet6.c +@@ -224,8 +224,8 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol, + inet6_set_bit(MC6_LOOP, sk); + inet6_set_bit(MC6_ALL, sk); + np->pmtudisc = IPV6_PMTUDISC_WANT; +- inet6_assign_bit(REPFLOW, sk, net->ipv6.sysctl.flowlabel_reflect & +- FLOWLABEL_REFLECT_ESTABLISHED); ++ inet6_assign_bit(REPFLOW, sk, READ_ONCE(net->ipv6.sysctl.flowlabel_reflect) & ++ FLOWLABEL_REFLECT_ESTABLISHED); + sk->sk_ipv6only = net->ipv6.sysctl.bindv6only; + sk->sk_txrehash = READ_ONCE(net->core.sysctl_txrehash); + +diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c +index 55b1aa75ab802..0f41ca6f3d83e 100644 +--- a/net/ipv6/icmp.c ++++ b/net/ipv6/icmp.c +@@ -953,7 +953,8 @@ static enum skb_drop_reason icmpv6_echo_reply(struct sk_buff *skb) + tmp_hdr.icmp6_type = type; + + memset(&fl6, 0, sizeof(fl6)); +- if (net->ipv6.sysctl.flowlabel_reflect & FLOWLABEL_REFLECT_ICMPV6_ECHO_REPLIES) ++ if (READ_ONCE(net->ipv6.sysctl.flowlabel_reflect) & ++ FLOWLABEL_REFLECT_ICMPV6_ECHO_REPLIES) + fl6.flowlabel = ip6_flowlabel(ipv6_hdr(skb)); + + fl6.flowi6_proto = IPPROTO_ICMPV6; +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index 280fe59785598..4ae664b05fa91 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -1085,7 +1085,8 @@ static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb, + txhash = inet_twsk(sk)->tw_txhash; + } + } else { +- if (net->ipv6.sysctl.flowlabel_reflect & FLOWLABEL_REFLECT_TCP_RESET) ++ if (READ_ONCE(net->ipv6.sysctl.flowlabel_reflect) & ++ FLOWLABEL_REFLECT_TCP_RESET) + label = ip6_flowlabel(ipv6h); + } + +-- +2.51.0 + diff --git a/queue-6.19/ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch b/queue-6.19/ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch new file mode 100644 index 00000000000..46cd53d04c2 --- /dev/null +++ b/queue-6.19/ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch @@ -0,0 +1,66 @@ +From 1e05fc117b409547bce99a94e2e489ba93599fda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 09:41:40 +0000 +Subject: ipv6: exthdrs: annotate data-race over multiple sysctl + +From: Eric Dumazet + +[ Upstream commit 978b67d28358b0b4eacfa94453d1ad4e09b123ad ] + +Following four sysctls can change under us, add missing READ_ONCE(). + +- ipv6.sysctl.max_dst_opts_len +- ipv6.sysctl.max_dst_opts_cnt +- ipv6.sysctl.max_hbh_opts_len +- ipv6.sysctl.max_hbh_opts_cnt + +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260115094141.3124990-8-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/exthdrs.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c +index a23eb8734e151..54088fa0c09d0 100644 +--- a/net/ipv6/exthdrs.c ++++ b/net/ipv6/exthdrs.c +@@ -314,7 +314,7 @@ static int ipv6_destopt_rcv(struct sk_buff *skb) + } + + extlen = (skb_transport_header(skb)[1] + 1) << 3; +- if (extlen > net->ipv6.sysctl.max_dst_opts_len) ++ if (extlen > READ_ONCE(net->ipv6.sysctl.max_dst_opts_len)) + goto fail_and_free; + + opt->lastopt = opt->dst1 = skb_network_header_len(skb); +@@ -322,7 +322,8 @@ static int ipv6_destopt_rcv(struct sk_buff *skb) + dstbuf = opt->dst1; + #endif + +- if (ip6_parse_tlv(false, skb, net->ipv6.sysctl.max_dst_opts_cnt)) { ++ if (ip6_parse_tlv(false, skb, ++ READ_ONCE(net->ipv6.sysctl.max_dst_opts_cnt))) { + skb->transport_header += extlen; + opt = IP6CB(skb); + #if IS_ENABLED(CONFIG_IPV6_MIP6) +@@ -1049,11 +1050,12 @@ int ipv6_parse_hopopts(struct sk_buff *skb) + } + + extlen = (skb_transport_header(skb)[1] + 1) << 3; +- if (extlen > net->ipv6.sysctl.max_hbh_opts_len) ++ if (extlen > READ_ONCE(net->ipv6.sysctl.max_hbh_opts_len)) + goto fail_and_free; + + opt->flags |= IP6SKB_HOPBYHOP; +- if (ip6_parse_tlv(true, skb, net->ipv6.sysctl.max_hbh_opts_cnt)) { ++ if (ip6_parse_tlv(true, skb, ++ READ_ONCE(net->ipv6.sysctl.max_hbh_opts_cnt))) { + skb->transport_header += extlen; + opt = IP6CB(skb); + opt->nhoff = sizeof(struct ipv6hdr); +-- +2.51.0 + diff --git a/queue-6.19/irqchip-riscv-imsic-add-a-cpu-pm-notifier-to-restore.patch b/queue-6.19/irqchip-riscv-imsic-add-a-cpu-pm-notifier-to-restore.patch new file mode 100644 index 00000000000..1d5feefb214 --- /dev/null +++ b/queue-6.19/irqchip-riscv-imsic-add-a-cpu-pm-notifier-to-restore.patch @@ -0,0 +1,110 @@ +From 3f1bd0876ee1c6c0f6d9305a51ce1ef6c5977a06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 14:07:40 +0800 +Subject: irqchip/riscv-imsic: Add a CPU pm notifier to restore the IMSIC on + exit + +From: Nick Hu + +[ Upstream commit f48b4bd0915bf61ac12b8c65c7939ebd03bc8abf ] + +The IMSIC might be reset when the system enters a low power state, but on +exit nothing restores the registers, which prevents interrupt delivery. + +Solve this by registering a CPU power management notifier, which restores +the IMSIC on exit. + +Signed-off-by: Nick Hu +Signed-off-by: Thomas Gleixner +Reviewed-by: Yong-Xuan Wang +Reviewed-by: Cyan Yang +Reviewed-by: Anup Patel +Reviewed-by: Nutty Liu +Link: https://patch.msgid.link/20251202-preserve-aplic-imsic-v3-1-1844fbf1fe92@sifive.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-riscv-imsic-early.c | 39 ++++++++++++++++++++----- + 1 file changed, 31 insertions(+), 8 deletions(-) + +diff --git a/drivers/irqchip/irq-riscv-imsic-early.c b/drivers/irqchip/irq-riscv-imsic-early.c +index 6bac67cc0b6d9..ba903fa689bd5 100644 +--- a/drivers/irqchip/irq-riscv-imsic-early.c ++++ b/drivers/irqchip/irq-riscv-imsic-early.c +@@ -7,6 +7,7 @@ + #define pr_fmt(fmt) "riscv-imsic: " fmt + #include + #include ++#include + #include + #include + #include +@@ -123,14 +124,8 @@ static void imsic_handle_irq(struct irq_desc *desc) + chained_irq_exit(chip, desc); + } + +-static int imsic_starting_cpu(unsigned int cpu) ++static void imsic_hw_states_init(void) + { +- /* Mark per-CPU IMSIC state as online */ +- imsic_state_online(); +- +- /* Enable per-CPU parent interrupt */ +- enable_percpu_irq(imsic_parent_irq, irq_get_trigger_type(imsic_parent_irq)); +- + /* Setup IPIs */ + imsic_ipi_starting_cpu(); + +@@ -142,6 +137,18 @@ static int imsic_starting_cpu(unsigned int cpu) + + /* Enable local interrupt delivery */ + imsic_local_delivery(true); ++} ++ ++static int imsic_starting_cpu(unsigned int cpu) ++{ ++ /* Mark per-CPU IMSIC state as online */ ++ imsic_state_online(); ++ ++ /* Enable per-CPU parent interrupt */ ++ enable_percpu_irq(imsic_parent_irq, irq_get_trigger_type(imsic_parent_irq)); ++ ++ /* Initialize the IMSIC registers to enable the interrupt delivery */ ++ imsic_hw_states_init(); + + return 0; + } +@@ -157,6 +164,22 @@ static int imsic_dying_cpu(unsigned int cpu) + return 0; + } + ++static int imsic_pm_notifier(struct notifier_block *self, unsigned long cmd, void *v) ++{ ++ switch (cmd) { ++ case CPU_PM_EXIT: ++ /* Initialize the IMSIC registers to enable the interrupt delivery */ ++ imsic_hw_states_init(); ++ break; ++ } ++ ++ return NOTIFY_OK; ++} ++ ++static struct notifier_block imsic_pm_notifier_block = { ++ .notifier_call = imsic_pm_notifier, ++}; ++ + static int __init imsic_early_probe(struct fwnode_handle *fwnode) + { + struct irq_domain *domain; +@@ -194,7 +217,7 @@ static int __init imsic_early_probe(struct fwnode_handle *fwnode) + cpuhp_setup_state(CPUHP_AP_IRQ_RISCV_IMSIC_STARTING, "irqchip/riscv/imsic:starting", + imsic_starting_cpu, imsic_dying_cpu); + +- return 0; ++ return cpu_pm_register_notifier(&imsic_pm_notifier_block); + } + + static int __init imsic_early_dt_init(struct device_node *node, struct device_node *parent) +-- +2.51.0 + diff --git a/queue-6.19/jfs-add-missing-set_freezable-for-freezable-kthread.patch b/queue-6.19/jfs-add-missing-set_freezable-for-freezable-kthread.patch new file mode 100644 index 00000000000..8b2f4fac487 --- /dev/null +++ b/queue-6.19/jfs-add-missing-set_freezable-for-freezable-kthread.patch @@ -0,0 +1,37 @@ +From 538cdf2c25bc9ff90c19aa39aa0f5be8f9888e5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 19:38:01 +0800 +Subject: jfs: Add missing set_freezable() for freezable kthread + +From: Haotian Zhang + +[ Upstream commit eb0cfcf265714b419cc3549895a00632e76732ae ] + +The jfsIOWait() thread calls try_to_freeze() but lacks set_freezable(), +causing it to remain non-freezable by default. This prevents proper +freezing during system suspend. + +Add set_freezable() to make the thread freezable as intended. + +Signed-off-by: Haotian Zhang +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_logmgr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c +index b343c5ea11592..5b1c5da041630 100644 +--- a/fs/jfs/jfs_logmgr.c ++++ b/fs/jfs/jfs_logmgr.c +@@ -2311,6 +2311,7 @@ int jfsIOWait(void *arg) + { + struct lbuf *bp; + ++ set_freezable(); + do { + spin_lock_irq(&log_redrive_lock); + while ((bp = log_redrive_list)) { +-- +2.51.0 + diff --git a/queue-6.19/jfs-nlink-overflow-in-jfs_rename.patch b/queue-6.19/jfs-nlink-overflow-in-jfs_rename.patch new file mode 100644 index 00000000000..3a3eabb1377 --- /dev/null +++ b/queue-6.19/jfs-nlink-overflow-in-jfs_rename.patch @@ -0,0 +1,54 @@ +From 684f96a0085aa6d77a19e4f0e6616c17e57215f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Oct 2025 13:22:12 +0100 +Subject: jfs: nlink overflow in jfs_rename + +From: Jori Koolstra + +[ Upstream commit 9218dc26fd922b09858ecd3666ed57dfd8098da8 ] + +If nlink is maximal for a directory (-1) and inside that directory you +perform a rename for some child directory (not moving from the parent), +then the nlink of the first directory is first incremented and later +decremented. Normally this is fine, but when nlink = -1 this causes a +wrap around to 0, and then drop_nlink issues a warning. + +After applying the patch syzbot no longer issues any warnings. I also +ran some basic fs tests to look for any regressions. + +Signed-off-by: Jori Koolstra +Reported-by: syzbot+9131ddfd7870623b719f@syzkaller.appspotmail.com +Closes: https://syzbot.org/bug?extid=9131ddfd7870623b719f +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/namei.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c +index 65a218eba8faf..7879c049632b3 100644 +--- a/fs/jfs/namei.c ++++ b/fs/jfs/namei.c +@@ -1228,7 +1228,7 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir, + jfs_err("jfs_rename: dtInsert returned -EIO"); + goto out_tx; + } +- if (S_ISDIR(old_ip->i_mode)) ++ if (S_ISDIR(old_ip->i_mode) && old_dir != new_dir) + inc_nlink(new_dir); + } + /* +@@ -1244,7 +1244,9 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir, + goto out_tx; + } + if (S_ISDIR(old_ip->i_mode)) { +- drop_nlink(old_dir); ++ if (new_ip || old_dir != new_dir) ++ drop_nlink(old_dir); ++ + if (old_dir != new_dir) { + /* + * Change inode number of parent for moved directory +-- +2.51.0 + diff --git a/queue-6.19/kselftest-kublk-include-message-in-_static_assert-fo.patch b/queue-6.19/kselftest-kublk-include-message-in-_static_assert-fo.patch new file mode 100644 index 00000000000..ae1f6618467 --- /dev/null +++ b/queue-6.19/kselftest-kublk-include-message-in-_static_assert-fo.patch @@ -0,0 +1,85 @@ +From ef8165d95fedbd2d98ce19f60caaa7cace3b3155 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 14:20:22 +0530 +Subject: kselftest/kublk: include message in _Static_assert for C11 + compatibility + +From: Clint George + +[ Upstream commit 3e6ad272bb8b3199bad952e7b077102af2d8df03 ] + +Add descriptive message in the _Static_assert to comply with the C11 +standard requirement to prevent compiler from throwing out error. The +compiler throws an error when _Static_assert is used without a message as +that is a C23 extension. + +[] Testing: +The diff between before and after of running the kselftest test of the +module shows no regression on system with x86 architecture + +[] Error log: +~/Desktop/kernel-dev/linux-v1/tools/testing/selftests/ublk$ make LLVM=1 W=1 + CC kublk +In file included from kublk.c:6: +./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions] + 220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7); + | ^ + | , "" +1 error generated. +In file included from null.c:3: +./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions] + 220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7); + | ^ + | , "" +1 error generated. +In file included from file_backed.c:3: +./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions] + 220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7); + | ^ + | , "" +1 error generated. +In file included from common.c:3: +./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions] + 220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7); + | ^ + | , "" +1 error generated. +In file included from stripe.c:3: +./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions] + 220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7); + | ^ + | , "" +1 error generated. +In file included from fault_inject.c:11: +./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions] + 220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7); + | ^ + | , "" +1 error generated. +make: *** [../lib.mk:225: ~/Desktop/kernel-dev/linux-v1/tools/testing/selftests/ublk/kublk] Error 1 + +Link: https://lore.kernel.org/r/20251215085022.7642-1-clintbgeorge@gmail.com +Signed-off-by: Clint George +Reviewed-by: Ming Lei +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/ublk/kublk.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/ublk/kublk.h b/tools/testing/selftests/ublk/kublk.h +index 8a83b90ec603a..cae2e30f0cdd5 100644 +--- a/tools/testing/selftests/ublk/kublk.h ++++ b/tools/testing/selftests/ublk/kublk.h +@@ -223,7 +223,7 @@ static inline __u64 build_user_data(unsigned tag, unsigned op, + unsigned tgt_data, unsigned q_id, unsigned is_target_io) + { + /* we only have 7 bits to encode q_id */ +- _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7); ++ _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7, "UBLK_MAX_QUEUES_SHIFT must be <= 7"); + assert(!(tag >> 16) && !(op >> 8) && !(tgt_data >> 16) && !(q_id >> 7)); + + return tag | (op << 16) | (tgt_data << 24) | +-- +2.51.0 + diff --git a/queue-6.19/libceph-define-and-enforce-ceph_max_key_len.patch b/queue-6.19/libceph-define-and-enforce-ceph_max_key_len.patch new file mode 100644 index 00000000000..1c63922c8b3 --- /dev/null +++ b/queue-6.19/libceph-define-and-enforce-ceph_max_key_len.patch @@ -0,0 +1,82 @@ +From 4dcbc95f995888d39bd5fbfb00c42fae16518ad3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jul 2025 16:30:50 +0200 +Subject: libceph: define and enforce CEPH_MAX_KEY_LEN + +From: Ilya Dryomov + +[ Upstream commit ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf ] + +When decoding the key, verify that the key material would fit into +a fixed-size buffer in process_auth_done() and generally has a sane +length. + +The new CEPH_MAX_KEY_LEN check replaces the existing check for a key +with no key material which is a) not universal since CEPH_CRYPTO_NONE +has to be excluded and b) doesn't provide much value since a smaller +than needed key is just as invalid as no key -- this has to be handled +elsewhere anyway. + +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + net/ceph/crypto.c | 8 +++++--- + net/ceph/crypto.h | 2 +- + net/ceph/messenger_v2.c | 2 +- + 3 files changed, 7 insertions(+), 5 deletions(-) + +diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c +index 01b2ce1e8fc06..5601732cf4faa 100644 +--- a/net/ceph/crypto.c ++++ b/net/ceph/crypto.c +@@ -37,9 +37,6 @@ static int set_secret(struct ceph_crypto_key *key, void *buf) + return -ENOTSUPP; + } + +- if (!key->len) +- return -EINVAL; +- + key->key = kmemdup(buf, key->len, GFP_NOIO); + if (!key->key) { + ret = -ENOMEM; +@@ -83,6 +80,11 @@ int ceph_crypto_key_decode(struct ceph_crypto_key *key, void **p, void *end) + ceph_decode_copy(p, &key->created, sizeof(key->created)); + key->len = ceph_decode_16(p); + ceph_decode_need(p, end, key->len, bad); ++ if (key->len > CEPH_MAX_KEY_LEN) { ++ pr_err("secret too big %d\n", key->len); ++ return -EINVAL; ++ } ++ + ret = set_secret(key, *p); + memzero_explicit(*p, key->len); + *p += key->len; +diff --git a/net/ceph/crypto.h b/net/ceph/crypto.h +index 23de29fc613cf..a20bad6d1e964 100644 +--- a/net/ceph/crypto.h ++++ b/net/ceph/crypto.h +@@ -5,7 +5,7 @@ + #include + #include + +-#define CEPH_KEY_LEN 16 ++#define CEPH_MAX_KEY_LEN 16 + #define CEPH_MAX_CON_SECRET_LEN 64 + + /* +diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c +index c9d50c0dcd33a..31e042dc1b3f2 100644 +--- a/net/ceph/messenger_v2.c ++++ b/net/ceph/messenger_v2.c +@@ -2360,7 +2360,7 @@ static int process_auth_reply_more(struct ceph_connection *con, + */ + static int process_auth_done(struct ceph_connection *con, void *p, void *end) + { +- u8 session_key_buf[CEPH_KEY_LEN + 16]; ++ u8 session_key_buf[CEPH_MAX_KEY_LEN + 16]; + u8 con_secret_buf[CEPH_MAX_CON_SECRET_LEN + 16]; + u8 *session_key = PTR_ALIGN(&session_key_buf[0], 16); + u8 *con_secret = PTR_ALIGN(&con_secret_buf[0], 16); +-- +2.51.0 + diff --git a/queue-6.19/libperf-build-always-place-libperf-includes-first.patch b/queue-6.19/libperf-build-always-place-libperf-includes-first.patch new file mode 100644 index 00000000000..f16133288f7 --- /dev/null +++ b/queue-6.19/libperf-build-always-place-libperf-includes-first.patch @@ -0,0 +1,56 @@ +From 8fd189335ce117ee54e418802790af4d838e72b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 22:09:18 -0800 +Subject: libperf build: Always place libperf includes first + +From: Ian Rogers + +[ Upstream commit 8c5b40678c63be6b85f1c2dc8c8b89d632faf988 ] + +When building tools/perf the CFLAGS can contain a directory for the +installed headers. + +As the headers may be being installed while building libperf.a this can +cause headers to be partially installed and found in the include path +while building an object file for libperf.a. + +The installed header may reference other installed headers that are +missing given the partial nature of the install and then the build fails +with a missing header file. + +Avoid this by ensuring the libperf source headers are always first in +the CFLAGS. + +Fixes: 3143504918105156 ("libperf: Make libperf.a part of the perf build") +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/perf/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/perf/Makefile b/tools/lib/perf/Makefile +index 7fbb50b74c00b..5c64122bf5374 100644 +--- a/tools/lib/perf/Makefile ++++ b/tools/lib/perf/Makefile +@@ -51,9 +51,9 @@ INCLUDES = \ + -I$(srctree)/tools/include/uapi + + # Append required CFLAGS ++override CFLAGS := $(INCLUDES) $(CFLAGS) + override CFLAGS += -g -Werror -Wall + override CFLAGS += -fPIC +-override CFLAGS += $(INCLUDES) + override CFLAGS += -fvisibility=hidden + override CFLAGS += $(EXTRA_WARNINGS) + override CFLAGS += $(EXTRA_CFLAGS) +-- +2.51.0 + diff --git a/queue-6.19/libsubcmd-fix-null-intersection-case-in-exclude_cmds.patch b/queue-6.19/libsubcmd-fix-null-intersection-case-in-exclude_cmds.patch new file mode 100644 index 00000000000..9cfcef9f37a --- /dev/null +++ b/queue-6.19/libsubcmd-fix-null-intersection-case-in-exclude_cmds.patch @@ -0,0 +1,67 @@ +From 002db3b1bfb26ae45abddf88a04c0b1451cb77c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 16:36:32 -0500 +Subject: libsubcmd: Fix null intersection case in exclude_cmds() + +From: Sri Jayaramappa + +[ Upstream commit b6ee9b6e206b288921c14c906eebf4b32fe0c0d8 ] + +When there is no exclusion occurring from the cmds list - for example - +cmds contains ["read-vdso32"] and excludes contains ["archive"] - the +main loop completes with ci == cj == 0. In the original code the loop +processing the remaining elements in the list was conditional: + + if (ci != cj) { ...} + +So we end up in the assertion loop since ci < cmds->cnt and we +incorrectly try to assert the list elements to be NULL and fail with +the following error + + help.c:104: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed. + +Fix this by moving the if (ci != cj) check inside of a broader loop. +If ci != cj, left shift the list elements, as before, and then +unconditionally advance the ci and cj indicies which also covers the +ci == cj case. + +Fixes: 1fdf938168c4d26f ("perf tools: Fix use-after-free in help_unknown_cmd()") +Reviewed-by: Guilherme Amadio +Signed-off-by: Sri Jayaramappa +Tested-by: Guilherme Amadio +Tested-by: Ian Rogers +Cc: Joshua Hunt +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20251202213632.2873731-1-sjayaram@akamai.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/subcmd/help.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c +index ddaeb4eb3e249..db94aa685b73b 100644 +--- a/tools/lib/subcmd/help.c ++++ b/tools/lib/subcmd/help.c +@@ -97,11 +97,13 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes) + ei++; + } + } +- if (ci != cj) { +- while (ci < cmds->cnt) { +- cmds->names[cj++] = cmds->names[ci]; +- cmds->names[ci++] = NULL; ++ while (ci < cmds->cnt) { ++ if (ci != cj) { ++ cmds->names[cj] = cmds->names[ci]; ++ cmds->names[ci] = NULL; + } ++ ci++; ++ cj++; + } + for (ci = cj; ci < cmds->cnt; ci++) + assert(cmds->names[ci] == NULL); +-- +2.51.0 + diff --git a/queue-6.19/m68k-nommu-fix-memmove-with-differently-aligned-src-.patch b/queue-6.19/m68k-nommu-fix-memmove-with-differently-aligned-src-.patch new file mode 100644 index 00000000000..abb0c577d5a --- /dev/null +++ b/queue-6.19/m68k-nommu-fix-memmove-with-differently-aligned-src-.patch @@ -0,0 +1,69 @@ +From b357d8f3771a9c3f92b2cbfdab4cf1e4dfd59fc5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Dec 2025 21:04:01 +0900 +Subject: m68k: nommu: fix memmove() with differently aligned src and dest for + 68000 + +From: Daniel Palmer + +[ Upstream commit 590fe2f46c8698bb758f9002cb247ca10ce95569 ] + +68000 has different alignment needs to 68020+. +memcpy() checks if the destination is aligned and does a smaller copy +to fix the alignment and then critically for 68000 it checks if the +source is still unaligned and if it is reverts to smaller copies. + +memmove() does not currently do the second part and malfunctions if +one of the pointers is aligned and the other isn't. + +This is apparently getting triggered by printk. If I put breakpoints +into the new checks added by this commit the first hit looks like this: + +memmove (n=205, src=0x2f3971 , dest=0x2f3980 ) at arch/m68k/lib/memmove.c:82 + +Signed-off-by: Daniel Palmer +Signed-off-by: Greg Ungerer +Signed-off-by: Sasha Levin +--- + arch/m68k/lib/memmove.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/arch/m68k/lib/memmove.c b/arch/m68k/lib/memmove.c +index 6519f7f349f66..e33f00b02e4c0 100644 +--- a/arch/m68k/lib/memmove.c ++++ b/arch/m68k/lib/memmove.c +@@ -24,6 +24,15 @@ void *memmove(void *dest, const void *src, size_t n) + src = csrc; + n--; + } ++#if defined(CONFIG_M68000) ++ if ((long)src & 1) { ++ char *cdest = dest; ++ const char *csrc = src; ++ for (; n; n--) ++ *cdest++ = *csrc++; ++ return xdest; ++ } ++#endif + if (n > 2 && (long)dest & 2) { + short *sdest = dest; + const short *ssrc = src; +@@ -66,6 +75,15 @@ void *memmove(void *dest, const void *src, size_t n) + src = csrc; + n--; + } ++#if defined(CONFIG_M68000) ++ if ((long)src & 1) { ++ char *cdest = dest; ++ const char *csrc = src; ++ for (; n; n--) ++ *--cdest = *--csrc; ++ return xdest; ++ } ++#endif + if (n > 2 && (long)dest & 2) { + short *sdest = dest; + const short *ssrc = src; +-- +2.51.0 + diff --git a/queue-6.19/mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch b/queue-6.19/mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch new file mode 100644 index 00000000000..45bf3ff6f3c --- /dev/null +++ b/queue-6.19/mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch @@ -0,0 +1,66 @@ +From b1e4381c6c0de944def6f68e072b77856c63aff5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:24 +0100 +Subject: mailbox: bcm-ferxrm-mailbox: Use default primary handler + +From: Sebastian Andrzej Siewior + +[ Upstream commit 03843d95a4a4e0ba22ad4fcda65ccf21822b104c ] + +request_threaded_irq() is invoked with a primary and a secondary handler +and no flags are passed. The primary handler is the same as +irq_default_primary_handler() so there is no need to have an identical +copy. + +The lack of the IRQF_ONESHOT flag can be dangerous because the interrupt +source is not masked while the threaded handler is active. This means, +especially on LEVEL typed interrupt lines, the interrupt can fire again +before the threaded handler had a chance to run. + +Use the default primary interrupt handler by specifying NULL and set +IRQF_ONESHOT so the interrupt source is masked until the secondary handler +is done. + +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Thomas Gleixner +Link: https://patch.msgid.link/20260128095540.863589-5-bigeasy@linutronix.de +Signed-off-by: Sasha Levin +--- + drivers/mailbox/bcm-flexrm-mailbox.c | 14 ++------------ + 1 file changed, 2 insertions(+), 12 deletions(-) + +diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c +index 41f79e51d9e5a..4255fefc3a5a0 100644 +--- a/drivers/mailbox/bcm-flexrm-mailbox.c ++++ b/drivers/mailbox/bcm-flexrm-mailbox.c +@@ -1173,14 +1173,6 @@ static int flexrm_debugfs_stats_show(struct seq_file *file, void *offset) + + /* ====== FlexRM interrupt handler ===== */ + +-static irqreturn_t flexrm_irq_event(int irq, void *dev_id) +-{ +- /* We only have MSI for completions so just wakeup IRQ thread */ +- /* Ring related errors will be informed via completion descriptors */ +- +- return IRQ_WAKE_THREAD; +-} +- + static irqreturn_t flexrm_irq_thread(int irq, void *dev_id) + { + flexrm_process_completions(dev_id); +@@ -1271,10 +1263,8 @@ static int flexrm_startup(struct mbox_chan *chan) + ret = -ENODEV; + goto fail_free_cmpl_memory; + } +- ret = request_threaded_irq(ring->irq, +- flexrm_irq_event, +- flexrm_irq_thread, +- 0, dev_name(ring->mbox->dev), ring); ++ ret = request_threaded_irq(ring->irq, NULL, flexrm_irq_thread, ++ IRQF_ONESHOT, dev_name(ring->mbox->dev), ring); + if (ret) { + dev_err(ring->mbox->dev, + "failed to request ring%d IRQ\n", ring->num); +-- +2.51.0 + diff --git a/queue-6.19/mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch b/queue-6.19/mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch new file mode 100644 index 00000000000..5a13e7d9c94 --- /dev/null +++ b/queue-6.19/mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch @@ -0,0 +1,77 @@ +From 9f24311e211defd7d842782c4d8c79b3f3e16bf9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 16:00:54 +0800 +Subject: mailbox: imx: Skip the suspend flag for i.MX7ULP + +From: Jacky Bai + +[ Upstream commit 673b570825ace0dcb2ac0c676080559d505c6f40 ] + +In current imx-mailbox driver, the MU IRQ is configured with +'IRQF_NO_SUSPEND' flag set. So during linux suspend/resume flow, +the MU IRQ is always enabled. With commit 892cb524ae8a ("mailbox: imx: +fix wakeup failure from freeze mode"), if the MU IRQ is triggered after +the priv->suspended flag has been set, the system suspend will be +aborted. + +On i.MX7ULP platform, certain drivers that depend on rpmsg may need +to send rpmsg request and receive an acknowledgment from the remote +core during the late_suspend stage. Early suspend abort is not +expected, and the i.MX7ULP already has additional hardware and +software to make sure the system can be wakeup from freeze mode +correctly when MU IRQ is trigger. + +Skip the 'suspend' flag handling logic on i.MX7ULP to avoid the +early abort when doing suspend. + +Signed-off-by: Jacky Bai +Reviewed-by: Peng Fan +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/imx-mailbox.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/mailbox/imx-mailbox.c b/drivers/mailbox/imx-mailbox.c +index 6778afc64a048..003f9236c35e0 100644 +--- a/drivers/mailbox/imx-mailbox.c ++++ b/drivers/mailbox/imx-mailbox.c +@@ -122,6 +122,7 @@ struct imx_mu_dcfg { + u32 xRR; /* Receive Register0 */ + u32 xSR[IMX_MU_xSR_MAX]; /* Status Registers */ + u32 xCR[IMX_MU_xCR_MAX]; /* Control Registers */ ++ bool skip_suspend_flag; + }; + + #define IMX_MU_xSR_GIPn(type, x) (type & IMX_MU_V2 ? BIT(x) : BIT(28 + (3 - (x)))) +@@ -988,6 +989,7 @@ static const struct imx_mu_dcfg imx_mu_cfg_imx7ulp = { + .xRR = 0x40, + .xSR = {0x60, 0x60, 0x60, 0x60}, + .xCR = {0x64, 0x64, 0x64, 0x64, 0x64}, ++ .skip_suspend_flag = true, + }; + + static const struct imx_mu_dcfg imx_mu_cfg_imx8ulp = { +@@ -1071,7 +1073,8 @@ static int __maybe_unused imx_mu_suspend_noirq(struct device *dev) + priv->xcr[i] = imx_mu_read(priv, priv->dcfg->xCR[i]); + } + +- priv->suspend = true; ++ if (!priv->dcfg->skip_suspend_flag) ++ priv->suspend = true; + + return 0; + } +@@ -1094,7 +1097,8 @@ static int __maybe_unused imx_mu_resume_noirq(struct device *dev) + imx_mu_write(priv, priv->xcr[i], priv->dcfg->xCR[i]); + } + +- priv->suspend = false; ++ if (!priv->dcfg->skip_suspend_flag) ++ priv->suspend = false; + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.19/mailbox-mchp-ipc-sbi-fix-out-of-bounds-access-in-mch.patch b/queue-6.19/mailbox-mchp-ipc-sbi-fix-out-of-bounds-access-in-mch.patch new file mode 100644 index 00000000000..b39abd33f91 --- /dev/null +++ b/queue-6.19/mailbox-mchp-ipc-sbi-fix-out-of-bounds-access-in-mch.patch @@ -0,0 +1,87 @@ +From 2aaa874b22ccaa39ceee55e5996bbb1c09b525f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Nov 2025 13:49:22 +0000 +Subject: mailbox: mchp-ipc-sbi: fix out-of-bounds access in + mchp_ipc_get_cluster_aggr_irq() + +From: Valentina Fernandez + +[ Upstream commit f7c330a8c83c9b0332fd524097eaf3e69148164d ] + +The cluster_cfg array is dynamically allocated to hold per-CPU +configuration structures, with its size based on the number of online +CPUs. Previously, this array was indexed using hartid, which may be +non-contiguous or exceed the bounds of the array, leading to +out-of-bounds access. +Switch to using cpuid as the index, as it is guaranteed to be within +the valid range provided by for_each_online_cpu(). + +Signed-off-by: Valentina Fernandez +Reviewed-by: Conor Dooley +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/mailbox-mchp-ipc-sbi.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/drivers/mailbox/mailbox-mchp-ipc-sbi.c b/drivers/mailbox/mailbox-mchp-ipc-sbi.c +index a6e52009a4245..d444491a584e8 100644 +--- a/drivers/mailbox/mailbox-mchp-ipc-sbi.c ++++ b/drivers/mailbox/mailbox-mchp-ipc-sbi.c +@@ -180,20 +180,20 @@ static irqreturn_t mchp_ipc_cluster_aggr_isr(int irq, void *data) + /* Find out the hart that originated the irq */ + for_each_online_cpu(i) { + hartid = cpuid_to_hartid_map(i); +- if (irq == ipc->cluster_cfg[hartid].irq) ++ if (irq == ipc->cluster_cfg[i].irq) + break; + } + + status_msg.cluster = hartid; +- memcpy(ipc->cluster_cfg[hartid].buf_base, &status_msg, sizeof(struct mchp_ipc_status)); ++ memcpy(ipc->cluster_cfg[i].buf_base, &status_msg, sizeof(struct mchp_ipc_status)); + +- ret = mchp_ipc_sbi_send(SBI_EXT_IPC_STATUS, ipc->cluster_cfg[hartid].buf_base_addr); ++ ret = mchp_ipc_sbi_send(SBI_EXT_IPC_STATUS, ipc->cluster_cfg[i].buf_base_addr); + if (ret < 0) { + dev_err_ratelimited(ipc->dev, "could not get IHC irq status ret=%d\n", ret); + return IRQ_HANDLED; + } + +- memcpy(&status_msg, ipc->cluster_cfg[hartid].buf_base, sizeof(struct mchp_ipc_status)); ++ memcpy(&status_msg, ipc->cluster_cfg[i].buf_base, sizeof(struct mchp_ipc_status)); + + /* + * Iterate over each bit set in the IHC interrupt status register (IRQ_STATUS) to identify +@@ -385,21 +385,21 @@ static int mchp_ipc_get_cluster_aggr_irq(struct mchp_ipc_sbi_mbox *ipc) + if (ret <= 0) + continue; + +- ipc->cluster_cfg[hartid].irq = ret; +- ret = devm_request_irq(ipc->dev, ipc->cluster_cfg[hartid].irq, ++ ipc->cluster_cfg[cpuid].irq = ret; ++ ret = devm_request_irq(ipc->dev, ipc->cluster_cfg[cpuid].irq, + mchp_ipc_cluster_aggr_isr, IRQF_SHARED, + "miv-ihc-irq", ipc); + if (ret) + return ret; + +- ipc->cluster_cfg[hartid].buf_base = devm_kmalloc(ipc->dev, +- sizeof(struct mchp_ipc_status), +- GFP_KERNEL); ++ ipc->cluster_cfg[cpuid].buf_base = devm_kmalloc(ipc->dev, ++ sizeof(struct mchp_ipc_status), ++ GFP_KERNEL); + +- if (!ipc->cluster_cfg[hartid].buf_base) ++ if (!ipc->cluster_cfg[cpuid].buf_base) + return -ENOMEM; + +- ipc->cluster_cfg[hartid].buf_base_addr = __pa(ipc->cluster_cfg[hartid].buf_base); ++ ipc->cluster_cfg[cpuid].buf_base_addr = __pa(ipc->cluster_cfg[cpuid].buf_base); + + irq_found = true; + } +-- +2.51.0 + diff --git a/queue-6.19/mailbox-mchp-ipc-sbi-fix-uninitialized-symbol-and-ot.patch b/queue-6.19/mailbox-mchp-ipc-sbi-fix-uninitialized-symbol-and-ot.patch new file mode 100644 index 00000000000..24c19c9fcef --- /dev/null +++ b/queue-6.19/mailbox-mchp-ipc-sbi-fix-uninitialized-symbol-and-ot.patch @@ -0,0 +1,89 @@ +From aad7142e4fa733221a7a6a777f3142eb71755beb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Dec 2025 10:33:59 +0000 +Subject: mailbox: mchp-ipc-sbi: fix uninitialized symbol and other smatch + warnings + +From: Valentina Fernandez + +[ Upstream commit bc4d17e495cd3b02bcb2e10f575763a5ff31f80b ] + +Fix uninitialized symbol 'hartid' warning in mchp_ipc_cluster_aggr_isr() +by introducing a 'found' flag to track whether the IRQ matches any +online hart. If no match is found, return IRQ_NONE. + +Also fix other smatch warnings by removing dead code in +mchp_ipc_startup() and by returning -ENODEV in dev_err_probe() if the +Microchip SBI extension is not found. + +Fixes below smatch warnings: +drivers/mailbox/mailbox-mchp-ipc-sbi.c:187 mchp_ipc_cluster_aggr_isr() error: uninitialized symbol 'hartid'. +drivers/mailbox/mailbox-mchp-ipc-sbi.c:324 mchp_ipc_startup() warn: ignoring unreachable code. +drivers/mailbox/mailbox-mchp-ipc-sbi.c:422 mchp_ipc_probe() warn: passing zero to 'dev_err_probe' + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202512171533.CDLdScMY-lkp@intel.com/ +Signed-off-by: Valentina Fernandez +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/mailbox-mchp-ipc-sbi.c | 21 +++++++++------------ + 1 file changed, 9 insertions(+), 12 deletions(-) + +diff --git a/drivers/mailbox/mailbox-mchp-ipc-sbi.c b/drivers/mailbox/mailbox-mchp-ipc-sbi.c +index d444491a584e8..b87bf2fb4b9b9 100644 +--- a/drivers/mailbox/mailbox-mchp-ipc-sbi.c ++++ b/drivers/mailbox/mailbox-mchp-ipc-sbi.c +@@ -174,17 +174,21 @@ static irqreturn_t mchp_ipc_cluster_aggr_isr(int irq, void *data) + struct mchp_ipc_msg ipc_msg; + struct mchp_ipc_status status_msg; + int ret; +- unsigned long hartid; + u32 i, chan_index, chan_id; ++ bool found = false; + + /* Find out the hart that originated the irq */ + for_each_online_cpu(i) { +- hartid = cpuid_to_hartid_map(i); +- if (irq == ipc->cluster_cfg[i].irq) ++ if (irq == ipc->cluster_cfg[i].irq) { ++ found = true; + break; ++ } + } + +- status_msg.cluster = hartid; ++ if (unlikely(!found)) ++ return IRQ_NONE; ++ ++ status_msg.cluster = cpuid_to_hartid_map(i); + memcpy(ipc->cluster_cfg[i].buf_base, &status_msg, sizeof(struct mchp_ipc_status)); + + ret = mchp_ipc_sbi_send(SBI_EXT_IPC_STATUS, ipc->cluster_cfg[i].buf_base_addr); +@@ -321,13 +325,6 @@ static int mchp_ipc_startup(struct mbox_chan *chan) + goto fail_free_buf_msg_rx; + } + +- if (ret) { +- dev_err(ipc->dev, "failed to register interrupt(s)\n"); +- goto fail_free_buf_msg_rx; +- } +- +- return ret; +- + fail_free_buf_msg_rx: + kfree(chan_info->msg_buf_rx); + fail_free_buf_msg_tx: +@@ -419,7 +416,7 @@ static int mchp_ipc_probe(struct platform_device *pdev) + + ret = sbi_probe_extension(SBI_EXT_MICROCHIP_TECHNOLOGY); + if (ret <= 0) +- return dev_err_probe(dev, ret, "Microchip SBI extension not detected\n"); ++ return dev_err_probe(dev, -ENODEV, "Microchip SBI extension not detected\n"); + + ipc = devm_kzalloc(dev, sizeof(*ipc), GFP_KERNEL); + if (!ipc) +-- +2.51.0 + diff --git a/queue-6.19/mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch b/queue-6.19/mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch new file mode 100644 index 00000000000..4ec7877e9a3 --- /dev/null +++ b/queue-6.19/mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch @@ -0,0 +1,41 @@ +From 30747ba20a629590f0a9d0e0d571fb261e6c03ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jan 2026 14:07:40 +0000 +Subject: mailbox: pcc: Remove spurious IRQF_ONESHOT usage + +From: Mark Brown + +[ Upstream commit 673327028cd61db68a1e0c708be2e302c082adf9 ] + +The PCC code currently specifies IRQF_ONESHOT if the interrupt could +potentially be shared but doesn't actually use request_threaded_irq() and +the interrupt handler does not use IRQ_WAKE_THREAD so IRQF_ONESHOT is +never relevant. Since commit aef30c8d569c ("genirq: Warn about using +IRQF_ONESHOT without a threaded handler") specifying it has resulted in a +WARN_ON(), fix this by removing IRQF_ONESHOT. + +Reported-by: Aishwarya TCV +Signed-off-by: Mark Brown +Reviewed-by: Sudeep Holla +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/pcc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c +index 0e0a66359d4c3..713022aed2e2f 100644 +--- a/drivers/mailbox/pcc.c ++++ b/drivers/mailbox/pcc.c +@@ -459,7 +459,7 @@ static int pcc_startup(struct mbox_chan *chan) + + if (pchan->plat_irq > 0) { + irqflags = pcc_chan_plat_irq_can_be_shared(pchan) ? +- IRQF_SHARED | IRQF_ONESHOT : 0; ++ IRQF_SHARED : 0; + rc = devm_request_irq(chan->mbox->dev, pchan->plat_irq, pcc_mbox_irq, + irqflags, MBOX_IRQ_NAME, chan); + if (unlikely(rc)) { +-- +2.51.0 + diff --git a/queue-6.19/mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch b/queue-6.19/mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch new file mode 100644 index 00000000000..9eba17a6abe --- /dev/null +++ b/queue-6.19/mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch @@ -0,0 +1,57 @@ +From 7b8798168e478c4eec7597b207d233b7f7696a88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 16:43:36 +0100 +Subject: mailbox: sprd: clear delivery flag before handling TX done +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Otto Pflüger + +[ Upstream commit c77661d60d4223bf2ff10d409beb0c3b2021183b ] + +If there are any pending messages in the mailbox queue, they are sent +as soon as a TX done event arrives from the driver. This may trigger a +new delivery interrupt while the previous one is still being handled. +If the delivery status is cleared after this, the interrupt is lost. +To prevent this from happening, clear the delivery status immediately +after checking it and before any new messages are sent. + +Signed-off-by: Otto Pflüger +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/sprd-mailbox.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c +index c1a5fe6cc8771..46d0c34177ab9 100644 +--- a/drivers/mailbox/sprd-mailbox.c ++++ b/drivers/mailbox/sprd-mailbox.c +@@ -166,6 +166,11 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data) + return IRQ_NONE; + } + ++ /* Clear FIFO delivery and overflow status first */ ++ writel(fifo_sts & ++ (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK), ++ priv->inbox_base + SPRD_MBOX_FIFO_RST); ++ + while (send_sts) { + id = __ffs(send_sts); + send_sts &= (send_sts - 1); +@@ -181,11 +186,6 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data) + mbox_chan_txdone(chan, 0); + } + +- /* Clear FIFO delivery and overflow status */ +- writel(fifo_sts & +- (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK), +- priv->inbox_base + SPRD_MBOX_FIFO_RST); +- + /* Clear irq status */ + writel(SPRD_MBOX_IRQ_CLR, priv->inbox_base + SPRD_MBOX_IRQ_STS); + +-- +2.51.0 + diff --git a/queue-6.19/mailbox-sprd-mask-interrupts-that-are-not-handled.patch b/queue-6.19/mailbox-sprd-mask-interrupts-that-are-not-handled.patch new file mode 100644 index 00000000000..7375137250c --- /dev/null +++ b/queue-6.19/mailbox-sprd-mask-interrupts-that-are-not-handled.patch @@ -0,0 +1,55 @@ +From 0b69c6597148a0dcc1d1491a370734f92c92fc18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 16:43:38 +0100 +Subject: mailbox: sprd: mask interrupts that are not handled +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Otto Pflüger + +[ Upstream commit 75df94d05fc03fd9d861eaf79ce10fbb7a548bd8 ] + +To reduce the amount of spurious interrupts, disable the interrupts that +are not handled in this driver. + +Signed-off-by: Otto Pflüger +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/sprd-mailbox.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c +index ee8539dfcef54..c1a5fe6cc8771 100644 +--- a/drivers/mailbox/sprd-mailbox.c ++++ b/drivers/mailbox/sprd-mailbox.c +@@ -243,21 +243,19 @@ static int sprd_mbox_startup(struct mbox_chan *chan) + /* Select outbox FIFO mode and reset the outbox FIFO status */ + writel(0x0, priv->outbox_base + SPRD_MBOX_FIFO_RST); + +- /* Enable inbox FIFO overflow and delivery interrupt */ +- val = readl(priv->inbox_base + SPRD_MBOX_IRQ_MSK); +- val &= ~(SPRD_INBOX_FIFO_OVERFLOW_IRQ | SPRD_INBOX_FIFO_DELIVER_IRQ); ++ /* Enable inbox FIFO delivery interrupt */ ++ val = SPRD_INBOX_FIFO_IRQ_MASK; ++ val &= ~SPRD_INBOX_FIFO_DELIVER_IRQ; + writel(val, priv->inbox_base + SPRD_MBOX_IRQ_MSK); + + /* Enable outbox FIFO not empty interrupt */ +- val = readl(priv->outbox_base + SPRD_MBOX_IRQ_MSK); ++ val = SPRD_OUTBOX_FIFO_IRQ_MASK; + val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ; + writel(val, priv->outbox_base + SPRD_MBOX_IRQ_MSK); + + /* Enable supplementary outbox as the fundamental one */ + if (priv->supp_base) { + writel(0x0, priv->supp_base + SPRD_MBOX_FIFO_RST); +- val = readl(priv->supp_base + SPRD_MBOX_IRQ_MSK); +- val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ; + writel(val, priv->supp_base + SPRD_MBOX_IRQ_MSK); + } + } +-- +2.51.0 + diff --git a/queue-6.19/md-cluster-fix-null-pointer-dereference-in-process_m.patch b/queue-6.19/md-cluster-fix-null-pointer-dereference-in-process_m.patch new file mode 100644 index 00000000000..739c5c8e468 --- /dev/null +++ b/queue-6.19/md-cluster-fix-null-pointer-dereference-in-process_m.patch @@ -0,0 +1,61 @@ +From d5248ddecd2dbde003a6e23ba510ecc5e3b29f9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jan 2026 14:59:03 +0000 +Subject: md-cluster: fix NULL pointer dereference in process_metadata_update + +From: Jiasheng Jiang + +[ Upstream commit f150e753cb8dd756085f46e86f2c35ce472e0a3c ] + +The function process_metadata_update() blindly dereferences the 'thread' +pointer (acquired via rcu_dereference_protected) within the wait_event() +macro. + +While the code comment states "daemon thread must exist", there is a valid +race condition window during the MD array startup sequence (md_run): + +1. bitmap_load() is called, which invokes md_cluster_ops->join(). +2. join() starts the "cluster_recv" thread (recv_daemon). +3. At this point, recv_daemon is active and processing messages. +4. However, mddev->thread (the main MD thread) is not initialized until + later in md_run(). + +If a METADATA_UPDATED message is received from a remote node during this +specific window, process_metadata_update() will be called while +mddev->thread is still NULL, leading to a kernel panic. + +To fix this, we must validate the 'thread' pointer. If it is NULL, we +release the held lock (no_new_dev_lockres) and return early, safely +ignoring the update request as the array is not yet fully ready to +process it. + +Link: https://lore.kernel.org/linux-raid/20260117145903.28921-1-jiashengjiangcool@gmail.com +Signed-off-by: Jiasheng Jiang +Signed-off-by: Yu Kuai +Signed-off-by: Sasha Levin +--- + drivers/md/md-cluster.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c +index 11f1e91d387d8..896279988dfd5 100644 +--- a/drivers/md/md-cluster.c ++++ b/drivers/md/md-cluster.c +@@ -549,8 +549,13 @@ static void process_metadata_update(struct mddev *mddev, struct cluster_msg *msg + + dlm_lock_sync(cinfo->no_new_dev_lockres, DLM_LOCK_CR); + +- /* daemaon thread must exist */ + thread = rcu_dereference_protected(mddev->thread, true); ++ if (!thread) { ++ pr_warn("md-cluster: Received metadata update but MD thread is not ready\n"); ++ dlm_unlock_sync(cinfo->no_new_dev_lockres); ++ return; ++ } ++ + wait_event(thread->wqueue, + (got_lock = mddev_trylock(mddev)) || + test_bit(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD, &cinfo->state)); +-- +2.51.0 + diff --git a/queue-6.19/md-raid-fix-hang-when-stopping-arrays-with-metadata-.patch b/queue-6.19/md-raid-fix-hang-when-stopping-arrays-with-metadata-.patch new file mode 100644 index 00000000000..d7696a92d65 --- /dev/null +++ b/queue-6.19/md-raid-fix-hang-when-stopping-arrays-with-metadata-.patch @@ -0,0 +1,78 @@ +From de310b6b850319ee12df6cd597ce7494d0312e51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 18:52:21 +0100 +Subject: md raid: fix hang when stopping arrays with metadata through dm-raid + +From: Heinz Mauelshagen + +[ Upstream commit cefcb9297fbdb6d94b61787b4f8d84f55b741470 ] + +When using device-mapper's dm-raid target, stopping a RAID array can cause +the system to hang under specific conditions. + +This occurs when: + +- A dm-raid managed device tree is suspended from top to bottom + (the top-level RAID device is suspended first, followed by its + underlying metadata and data devices) + +- The top-level RAID device is then removed + +Removing the top-level device triggers a hang in the following sequence: +the dm-raid destructor calls md_stop(), which tries to flush the +write-intent bitmap by writing to the metadata sub-devices. However, these +devices are already suspended, making them unable to complete the write-intent +operations and causing an indefinite block. + +Fix: + +- Prevent bitmap flushing when md_stop() is called from dm-raid +destructor context + and avoid a quiescing/unquescing cycle which could also cause I/O + +- Still allow write-intent bitmap flushing when called from dm-raid +suspend context + +This ensures that RAID array teardown can complete successfully even when the +underlying devices are in a suspended state. + +This second patch uses md_is_rdwr() to distinguish between suspend and +destructor paths as elaborated on above. + +Link: https://lore.kernel.org/linux-raid/CAM23VxqYrwkhKEBeQrZeZwQudbiNey2_8B_SEOLqug=pXxaFrA@mail.gmail.com +Signed-off-by: Heinz Mauelshagen +Signed-off-by: Yu Kuai +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 6d73f6e196a9f..ac71640ff3a81 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -6848,13 +6848,15 @@ static void __md_stop_writes(struct mddev *mddev) + { + timer_delete_sync(&mddev->safemode_timer); + +- if (mddev->pers && mddev->pers->quiesce) { +- mddev->pers->quiesce(mddev, 1); +- mddev->pers->quiesce(mddev, 0); +- } ++ if (md_is_rdwr(mddev) || !mddev_is_dm(mddev)) { ++ if (mddev->pers && mddev->pers->quiesce) { ++ mddev->pers->quiesce(mddev, 1); ++ mddev->pers->quiesce(mddev, 0); ++ } + +- if (md_bitmap_enabled(mddev, true)) +- mddev->bitmap_ops->flush(mddev); ++ if (md_bitmap_enabled(mddev, true)) ++ mddev->bitmap_ops->flush(mddev); ++ } + + if (md_is_rdwr(mddev) && + ((!mddev->in_sync && !mddev_is_clustered(mddev)) || +-- +2.51.0 + diff --git a/queue-6.19/media-adv7180-fix-frame-interval-in-progressive-mode.patch b/queue-6.19/media-adv7180-fix-frame-interval-in-progressive-mode.patch new file mode 100644 index 00000000000..f5b8a9ee730 --- /dev/null +++ b/queue-6.19/media-adv7180-fix-frame-interval-in-progressive-mode.patch @@ -0,0 +1,49 @@ +From a123bb3f24f08f117891d328cfce6eab33edf179 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 15:29:57 +0100 +Subject: media: adv7180: fix frame interval in progressive mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thorsten Schmelzer + +[ Upstream commit 90289b67c5c1d4c18784059b27460d292e16d208 ] + +The ADV7280-M may internally convert interlaced video input to +progressive video. If this mode is enabled, the ADV7280-M delivers +progressive video frames at the field rate of 50 fields per second (PAL) +or 60 fields per second (NTSC). + +Fix the reported frame interval if progressive video is enabled. + +Signed-off-by: Thorsten Schmelzer +Reviewed-by: Niklas Söderlund +Signed-off-by: Michael Tretter +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/adv7180.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c +index 378f4e6af12cb..5cbc973df684d 100644 +--- a/drivers/media/i2c/adv7180.c ++++ b/drivers/media/i2c/adv7180.c +@@ -507,6 +507,13 @@ static int adv7180_get_frame_interval(struct v4l2_subdev *sd, + fi->interval.denominator = 25; + } + ++ /* ++ * If the de-interlacer is active, the chip produces full video frames ++ * at the field rate. ++ */ ++ if (state->field == V4L2_FIELD_NONE) ++ fi->interval.denominator *= 2; ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.19/media-amphion-clear-last_buffer_dequeued-flag-for-de.patch b/queue-6.19/media-amphion-clear-last_buffer_dequeued-flag-for-de.patch new file mode 100644 index 00000000000..6cecf727078 --- /dev/null +++ b/queue-6.19/media-amphion-clear-last_buffer_dequeued-flag-for-de.patch @@ -0,0 +1,38 @@ +From 6bd6e24e70f7011a6531965f60245b06928f31a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Dec 2025 11:02:22 +0800 +Subject: media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START + +From: Ming Qian + +[ Upstream commit d85f3207d75df6d7a08be6526b15ff398668206c ] + +The V4L2_DEC_CMD_START command may be used to handle the dynamic source +change, which will triggers an implicit decoder drain. +The last_buffer_dequeued flag is set in the implicit decoder drain, +so driver need to clear it to continue the following decoding flow. + +Signed-off-by: Ming Qian +Reviewed-by: Nicolas Dufresne +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/amphion/vdec.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/platform/amphion/vdec.c b/drivers/media/platform/amphion/vdec.c +index c0d2aabb9e0e3..f25dbcebdccf6 100644 +--- a/drivers/media/platform/amphion/vdec.c ++++ b/drivers/media/platform/amphion/vdec.c +@@ -724,6 +724,7 @@ static int vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd + switch (cmd->cmd) { + case V4L2_DEC_CMD_START: + vdec_cmd_start(inst); ++ vb2_clear_last_buffer_dequeued(v4l2_m2m_get_dst_vq(inst->fh.m2m_ctx)); + break; + case V4L2_DEC_CMD_STOP: + vdec_cmd_stop(inst); +-- +2.51.0 + diff --git a/queue-6.19/media-chips-media-wave5-fix-conditional-in-start_str.patch b/queue-6.19/media-chips-media-wave5-fix-conditional-in-start_str.patch new file mode 100644 index 00000000000..9e1b9436a48 --- /dev/null +++ b/queue-6.19/media-chips-media-wave5-fix-conditional-in-start_str.patch @@ -0,0 +1,43 @@ +From 8a42ed8f11f4cda93219a1d73c8aadab6c7f8c25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Oct 2025 15:46:17 -0500 +Subject: media: chips-media: wave5: Fix conditional in start_streaming + +From: Brandon Brnich + +[ Upstream commit b4e26c6fc1b3c225caf80d4a95c6f9fcbe959e17 ] + +When STREAMON(CAP) is called after STREAMON(OUT), the driver was failing to +switch states from VPU_INST_STATE_OPEN to VPU_INST_STATE_INIT_SEQ and +VPU_INST_STATE_PIC_RUN because the capture queue streaming boolean had not +yet been set to true. This led to a hang in the encoder since the state +was stuck in VPU_INST_STATE_OPEN. During the second call to +start_streaming, the sequence initialization and frame buffer allocation +should occur. + +Signed-off-by: Brandon Brnich +Reviewed-by: Nicolas Dufresne +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c +index 94fb5d7c87021..a11f0f7c7d7b0 100644 +--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c ++++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c +@@ -1367,7 +1367,8 @@ static int wave5_vpu_enc_start_streaming(struct vb2_queue *q, unsigned int count + if (ret) + goto return_buffers; + } +- if (inst->state == VPU_INST_STATE_OPEN && m2m_ctx->cap_q_ctx.q.streaming) { ++ if (inst->state == VPU_INST_STATE_OPEN && ++ (m2m_ctx->cap_q_ctx.q.streaming || q->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE)) { + ret = initialize_sequence(inst); + if (ret) { + dev_warn(inst->dev->dev, "Sequence not found: %d\n", ret); +-- +2.51.0 + diff --git a/queue-6.19/media-chips-media-wave5-process-ready-frames-when-cm.patch b/queue-6.19/media-chips-media-wave5-process-ready-frames-when-cm.patch new file mode 100644 index 00000000000..b2ed70aef9b --- /dev/null +++ b/queue-6.19/media-chips-media-wave5-process-ready-frames-when-cm.patch @@ -0,0 +1,39 @@ +From 63c76765ea3ce758d789e80fff73de7550bf276f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Oct 2025 15:46:18 -0500 +Subject: media: chips-media: wave5: Process ready frames when CMD_STOP sent to + Encoder + +From: Brandon Brnich + +[ Upstream commit 5da0380de41439ed64ed9a5218850db38544e315 ] + +CMD_STOP being sent to encoder before last job is executed by device_run +can lead to an occasional dropped frame. Ensure that remaining ready +buffers are drained by making a call to v4l2_m2m_try_schedule. + +Signed-off-by: Brandon Brnich +Reviewed-by: Nicolas Dufresne +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c +index a11f0f7c7d7b0..a254830e4009e 100644 +--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c ++++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c +@@ -649,6 +649,8 @@ static int wave5_vpu_enc_encoder_cmd(struct file *file, void *fh, struct v4l2_en + + m2m_ctx->last_src_buf = v4l2_m2m_last_src_buf(m2m_ctx); + m2m_ctx->is_draining = true; ++ ++ v4l2_m2m_try_schedule(m2m_ctx); + break; + case V4L2_ENC_CMD_START: + break; +-- +2.51.0 + diff --git a/queue-6.19/media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch b/queue-6.19/media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch new file mode 100644 index 00000000000..96b66f58ce2 --- /dev/null +++ b/queue-6.19/media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch @@ -0,0 +1,34 @@ +From 35d0d89f50eaff295857a6beb9889a581c5c3fbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Jan 2026 15:46:47 +0800 +Subject: media: cx25821: Fix a resource leak in cx25821_dev_setup() + +From: Haoxiang Li + +[ Upstream commit 68cd8ac994cac38a305200f638b30e13c690753b ] + +Add release_mem_region() if ioremap() fails to release the memory +region obtained by cx25821_get_resources(). + +Signed-off-by: Haoxiang Li +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/cx25821/cx25821-core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c +index 6627fa9166d30..a7336be444748 100644 +--- a/drivers/media/pci/cx25821/cx25821-core.c ++++ b/drivers/media/pci/cx25821/cx25821-core.c +@@ -908,6 +908,7 @@ static int cx25821_dev_setup(struct cx25821_dev *dev) + + if (!dev->lmmio) { + CX25821_ERR("ioremap failed, maybe increasing __VMALLOC_RESERVE in page.h\n"); ++ release_mem_region(dev->base_io_addr, pci_resource_len(dev->pci, 0)); + cx25821_iounmap(dev); + return -ENOMEM; + } +-- +2.51.0 + diff --git a/queue-6.19/media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch b/queue-6.19/media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch new file mode 100644 index 00000000000..09f248ddda6 --- /dev/null +++ b/queue-6.19/media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch @@ -0,0 +1,110 @@ +From c782ab3761dc3c5efe554d4b7e191b6a82e1565a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Jun 2025 08:57:35 +0200 +Subject: media: dvb-core: dmxdevfilter must always flush bufs + +From: Hans Verkuil + +[ Upstream commit c4e620eccbef76aa5564ebb295e23d6540e27215 ] + +Currently the buffers are being filled until full, which works fine +for the transport stream, but not when reading sections, those have +to be returned to userspace immediately, otherwise dvbv5-scan will +just wait forever. + +Add a 'flush' argument to dvb_vb2_fill_buffer to indicate whether +the buffer must be flushed or wait until it is full. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-core/dmxdev.c | 8 ++++---- + drivers/media/dvb-core/dvb_vb2.c | 5 +++-- + include/media/dvb_vb2.h | 6 ++++-- + 3 files changed, 11 insertions(+), 8 deletions(-) + +diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c +index 8c6f5aafda1d6..17184b3674904 100644 +--- a/drivers/media/dvb-core/dmxdev.c ++++ b/drivers/media/dvb-core/dmxdev.c +@@ -397,11 +397,11 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len, + if (dvb_vb2_is_streaming(&dmxdevfilter->vb2_ctx)) { + ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx, + buffer1, buffer1_len, +- buffer_flags); ++ buffer_flags, true); + if (ret == buffer1_len) + ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx, + buffer2, buffer2_len, +- buffer_flags); ++ buffer_flags, true); + } else { + ret = dvb_dmxdev_buffer_write(&dmxdevfilter->buffer, + buffer1, buffer1_len); +@@ -452,10 +452,10 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len, + + if (dvb_vb2_is_streaming(ctx)) { + ret = dvb_vb2_fill_buffer(ctx, buffer1, buffer1_len, +- buffer_flags); ++ buffer_flags, false); + if (ret == buffer1_len) + ret = dvb_vb2_fill_buffer(ctx, buffer2, buffer2_len, +- buffer_flags); ++ buffer_flags, false); + } else { + if (buffer->error) { + spin_unlock(&dmxdevfilter->dev->lock); +diff --git a/drivers/media/dvb-core/dvb_vb2.c b/drivers/media/dvb-core/dvb_vb2.c +index 29edaaff7a5c9..7444bbc2f24d9 100644 +--- a/drivers/media/dvb-core/dvb_vb2.c ++++ b/drivers/media/dvb-core/dvb_vb2.c +@@ -249,7 +249,8 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx) + + int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx, + const unsigned char *src, int len, +- enum dmx_buffer_flags *buffer_flags) ++ enum dmx_buffer_flags *buffer_flags, ++ bool flush) + { + unsigned long flags = 0; + void *vbuf = NULL; +@@ -306,7 +307,7 @@ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx, + } + } + +- if (ctx->nonblocking && ctx->buf) { ++ if (flush && ctx->buf) { + vb2_set_plane_payload(&ctx->buf->vb, 0, ll); + vb2_buffer_done(&ctx->buf->vb, VB2_BUF_STATE_DONE); + list_del(&ctx->buf->list); +diff --git a/include/media/dvb_vb2.h b/include/media/dvb_vb2.h +index 8cb88452cd6c2..0fbbfc65157e6 100644 +--- a/include/media/dvb_vb2.h ++++ b/include/media/dvb_vb2.h +@@ -124,7 +124,7 @@ static inline int dvb_vb2_release(struct dvb_vb2_ctx *ctx) + return 0; + }; + #define dvb_vb2_is_streaming(ctx) (0) +-#define dvb_vb2_fill_buffer(ctx, file, wait, flags) (0) ++#define dvb_vb2_fill_buffer(ctx, file, wait, flags, flush) (0) + + static inline __poll_t dvb_vb2_poll(struct dvb_vb2_ctx *ctx, + struct file *file, +@@ -166,10 +166,12 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx); + * @buffer_flags: + * pointer to buffer flags as defined by &enum dmx_buffer_flags. + * can be NULL. ++ * @flush: flush the buffer, even if it isn't full. + */ + int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx, + const unsigned char *src, int len, +- enum dmx_buffer_flags *buffer_flags); ++ enum dmx_buffer_flags *buffer_flags, ++ bool flush); + + /** + * dvb_vb2_poll - Wrapper to vb2_core_streamon() for Digital TV +-- +2.51.0 + diff --git a/queue-6.19/media-ipu6-always-close-firmware-stream.patch b/queue-6.19/media-ipu6-always-close-firmware-stream.patch new file mode 100644 index 00000000000..27c3b3df57c --- /dev/null +++ b/queue-6.19/media-ipu6-always-close-firmware-stream.patch @@ -0,0 +1,45 @@ +From 23d3e743de88d2423169371ae62258773f2183ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 23:55:31 +0200 +Subject: media: ipu6: Always close firmware stream + +From: Sakari Ailus + +[ Upstream commit 2b08b7007e55bd1793a58478d3ecea4fd95849a5 ] + +Close the firmware stream even when disabling a stream on an upstream +sub-device fails. This allows the firmware to release resources related to +a stream that is stopped in any case. + +Suggested-by: Bingbu Cao +Signed-off-by: Sakari Ailus +Reviewed-by: Bingbu Cao +Tested-by: Mehdi Djait # Dell XPS 9315 +Reviewed-by: Mehdi Djait +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/intel/ipu6/ipu6-isys-video.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c +index 919b77107cef7..54d861aca0088 100644 +--- a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c ++++ b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c +@@ -1036,11 +1036,10 @@ int ipu6_isys_video_set_streaming(struct ipu6_isys_video *av, int state, + sd->name, r_pad->index, stream_mask); + ret = v4l2_subdev_disable_streams(sd, r_pad->index, + stream_mask); +- if (ret) { ++ if (ret) + dev_err(dev, "stream off %s failed with %d\n", sd->name, + ret); +- return ret; +- } ++ + close_streaming_firmware(av); + } else { + ret = start_stream_firmware(av, bl); +-- +2.51.0 + diff --git a/queue-6.19/media-ipu6-close-firmware-streams-on-streaming-enabl.patch b/queue-6.19/media-ipu6-close-firmware-streams-on-streaming-enabl.patch new file mode 100644 index 00000000000..d8cc740837a --- /dev/null +++ b/queue-6.19/media-ipu6-close-firmware-streams-on-streaming-enabl.patch @@ -0,0 +1,37 @@ +From 5c47c7edc336051849b852cd1dd0f01241d6dce4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Dec 2025 00:05:38 +0200 +Subject: media: ipu6: Close firmware streams on streaming enable failure + +From: Sakari Ailus + +[ Upstream commit 5925a92cc70d10c7d3124923c36da09b9c1a6eeb ] + +When enabling streaming fails, the stream is stopped in firmware but not +closed. Do this to release resources on firmware side. + +Signed-off-by: Sakari Ailus +Reviewed-by: Bingbu Cao +Tested-by: Mehdi Djait # Dell XPS 9315 +Reviewed-by: Mehdi Djait +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/intel/ipu6/ipu6-isys-video.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c +index dec8f5ffcfa5f..919b77107cef7 100644 +--- a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c ++++ b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c +@@ -1066,6 +1066,7 @@ int ipu6_isys_video_set_streaming(struct ipu6_isys_video *av, int state, + + out_media_entity_stop_streaming_firmware: + stop_streaming_firmware(av); ++ close_streaming_firmware(av); + + return ret; + } +-- +2.51.0 + diff --git a/queue-6.19/media-ipu6-ensure-stream_mutex-is-acquired-when-deal.patch b/queue-6.19/media-ipu6-ensure-stream_mutex-is-acquired-when-deal.patch new file mode 100644 index 00000000000..691ed310bbb --- /dev/null +++ b/queue-6.19/media-ipu6-ensure-stream_mutex-is-acquired-when-deal.patch @@ -0,0 +1,73 @@ +From 5296f26282c936a88531b20bf3d4613ac2e9f950 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Nov 2025 14:14:22 +0200 +Subject: media: ipu6: Ensure stream_mutex is acquired when dealing with node + list + +From: Sakari Ailus + +[ Upstream commit 779bdaad2abf718fb8116839e818e58852874b4d ] + +The ipu6 isys driver maintains the list of video buffer queues related to +a stream (in ipu6 context streams on the same CSI-2 virtual channel) and +this list is modified through VIDIOC_STREAMON and VIDIOC_STREAMOFF IOCTLs. +Ensure the common mutex is acquired when accessing the linked list, i.e. +the isys device context's stream_mutex. + +Add a lockdep assert to ipu6_isys_get_buffer_list() and switch to guard() +while at it as the error handling becomes more simple this way. + +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/intel/ipu6/ipu6-isys-queue.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c b/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c +index aa2cf7287477c..8f05987cdb4e7 100644 +--- a/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c ++++ b/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c +@@ -3,6 +3,7 @@ + * Copyright (C) 2013--2024 Intel Corporation + */ + #include ++#include + #include + #include + #include +@@ -201,6 +202,8 @@ static int buffer_list_get(struct ipu6_isys_stream *stream, + unsigned long flags; + unsigned long buf_flag = IPU6_ISYS_BUFFER_LIST_FL_INCOMING; + ++ lockdep_assert_held(&stream->mutex); ++ + bl->nbufs = 0; + INIT_LIST_HEAD(&bl->head); + +@@ -294,9 +297,8 @@ static int ipu6_isys_stream_start(struct ipu6_isys_video *av, + struct ipu6_isys_buffer_list __bl; + int ret; + +- mutex_lock(&stream->isys->stream_mutex); ++ guard(mutex)(&stream->isys->stream_mutex); + ret = ipu6_isys_video_set_streaming(av, 1, bl); +- mutex_unlock(&stream->isys->stream_mutex); + if (ret) + goto out_requeue; + +@@ -637,10 +639,10 @@ static void stop_streaming(struct vb2_queue *q) + mutex_lock(&av->isys->stream_mutex); + if (stream->nr_streaming == stream->nr_queues && stream->streaming) + ipu6_isys_video_set_streaming(av, 0, NULL); ++ list_del(&aq->node); + mutex_unlock(&av->isys->stream_mutex); + + stream->nr_streaming--; +- list_del(&aq->node); + stream->streaming = 0; + mutex_unlock(&stream->mutex); + +-- +2.51.0 + diff --git a/queue-6.19/media-mediatek-vcodec-don-t-try-to-decode-422-444-vp.patch b/queue-6.19/media-mediatek-vcodec-don-t-try-to-decode-422-444-vp.patch new file mode 100644 index 00000000000..4c19241819c --- /dev/null +++ b/queue-6.19/media-mediatek-vcodec-don-t-try-to-decode-422-444-vp.patch @@ -0,0 +1,40 @@ +From 656948881a966637875510f1514d89817c58b114 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Nov 2025 14:16:16 -0500 +Subject: media: mediatek: vcodec: Don't try to decode 422/444 VP9 + +From: Nicolas Dufresne + +[ Upstream commit 3e92d7e4935084ecdbdc88880cc4688618ae1557 ] + +This is not supported by the hardware and trying to decode +these leads to LAT timeout errors. + +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c +index d873159b9b306..9eef3ff2b1278 100644 +--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c ++++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c +@@ -502,6 +502,12 @@ static int mtk_vdec_s_ctrl(struct v4l2_ctrl *ctrl) + mtk_v4l2_vdec_err(ctx, "VP9: bit_depth:%d", frame->bit_depth); + return -EINVAL; + } ++ ++ if (!(frame->flags & V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING) || ++ !(frame->flags & V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING)) { ++ mtk_v4l2_vdec_err(ctx, "VP9: only 420 subsampling is supported"); ++ return -EINVAL; ++ } + break; + case V4L2_CID_STATELESS_AV1_SEQUENCE: + seq = (struct v4l2_ctrl_av1_sequence *)hdr_ctrl->p_new.p; +-- +2.51.0 + diff --git a/queue-6.19/media-mt9m114-avoid-a-reset-low-spike-during-probe.patch b/queue-6.19/media-mt9m114-avoid-a-reset-low-spike-during-probe.patch new file mode 100644 index 00000000000..b39b57847e5 --- /dev/null +++ b/queue-6.19/media-mt9m114-avoid-a-reset-low-spike-during-probe.patch @@ -0,0 +1,55 @@ +From 09f2132a5c4d29057e5147505062eaa1429200f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Dec 2025 18:03:03 +0100 +Subject: media: mt9m114: Avoid a reset low spike during probe() + +From: Hans de Goede + +[ Upstream commit 84359d0a5e3afce5e3e3b6562efadff690614d5b ] + +mt9m114_probe() requests the reset GPIO in output low state: + + sensor->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW); + +and then almost immediately afterwards calls mt9m114_power_on() which does: + + gpiod_set_value(sensor->reset, 1); + fsleep(duration); + gpiod_set_value(sensor->reset, 0); + +which means that if the reset pin was high before this code runs that +it will very briefly be driven low because of passing GPIOD_OUT_LOW when +requesting the GPIO only to be driven high again possibly directly after +that. Such a very brief driving low of the reset pin may put the chip in +a confused state. + +Request the GPIO in high (reset the chip) state instead to avoid this, +turning the initial gpiod_set_value() in mt9m114_power_on() into a no-op. +and the fsleep() ensures that it will stay high long enough to properly +reset the chip. + +Reviewed-by: Laurent Pinchart +Signed-off-by: Hans de Goede +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/mt9m114.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/mt9m114.c b/drivers/media/i2c/mt9m114.c +index 51ebbe7ae9969..554f25071cca6 100644 +--- a/drivers/media/i2c/mt9m114.c ++++ b/drivers/media/i2c/mt9m114.c +@@ -2434,7 +2434,7 @@ static int mt9m114_probe(struct i2c_client *client) + goto error_ep_free; + } + +- sensor->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW); ++ sensor->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH); + if (IS_ERR(sensor->reset)) { + ret = PTR_ERR(sensor->reset); + dev_err_probe(dev, ret, "Failed to get reset GPIO\n"); +-- +2.51.0 + diff --git a/queue-6.19/media-mt9m114-return-eprobe_defer-if-no-endpoint-is-.patch b/queue-6.19/media-mt9m114-return-eprobe_defer-if-no-endpoint-is-.patch new file mode 100644 index 00000000000..cee75faeb60 --- /dev/null +++ b/queue-6.19/media-mt9m114-return-eprobe_defer-if-no-endpoint-is-.patch @@ -0,0 +1,50 @@ +From d20fa90e6c0cd37763da0b0df60c2b7e80c2744f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Dec 2025 18:03:10 +0100 +Subject: media: mt9m114: Return -EPROBE_DEFER if no endpoint is found + +From: Hans de Goede + +[ Upstream commit 437e1f6a960035166495a5117aacbc596115eeb6 ] + +With IPU# bridges, endpoints may only be created when the IPU bridge is +initialized. This may happen after the sensor driver's first probe(). + +Reviewed-by: Laurent Pinchart +Signed-off-by: Hans de Goede +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/mt9m114.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/i2c/mt9m114.c b/drivers/media/i2c/mt9m114.c +index 554f25071cca6..b1325e2cd1321 100644 +--- a/drivers/media/i2c/mt9m114.c ++++ b/drivers/media/i2c/mt9m114.c +@@ -2360,11 +2360,17 @@ static int mt9m114_parse_dt(struct mt9m114 *sensor) + struct fwnode_handle *ep; + int ret; + ++ /* ++ * On ACPI systems the fwnode graph can be initialized by a bridge ++ * driver, which may not have probed yet. Wait for this. ++ * ++ * TODO: Return an error once bridge driver code will have moved ++ * to the ACPI core. ++ */ + ep = fwnode_graph_get_next_endpoint(fwnode, NULL); +- if (!ep) { +- dev_err(&sensor->client->dev, "No endpoint found\n"); +- return -EINVAL; +- } ++ if (!ep) ++ return dev_err_probe(&sensor->client->dev, -EPROBE_DEFER, ++ "waiting for fwnode graph endpoint\n"); + + sensor->bus_cfg.bus_type = V4L2_MBUS_UNKNOWN; + ret = v4l2_fwnode_endpoint_alloc_parse(ep, &sensor->bus_cfg); +-- +2.51.0 + diff --git a/queue-6.19/media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch b/queue-6.19/media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch new file mode 100644 index 00000000000..faa13cbe0ee --- /dev/null +++ b/queue-6.19/media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch @@ -0,0 +1,53 @@ +From 2e8eb9d7121a1d6387c296273f24f7cc8d212d3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Oct 2025 15:26:40 +0200 +Subject: media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes + +From: Hans Verkuil + +[ Upstream commit 44c03802a5191626996ee9db4bac090b164ca340 ] + +The isp_video_mbus_to_pix/pix_to_mbus functions did not take +the last empty entry { 0, } of the formats array into account. + +As a result, isp_video_mbus_to_pix would accept code 0 and +isp_video_pix_to_mbus would select code 0 if no match was found. + +Signed-off-by: Hans Verkuil +Acked-by: Sakari Ailus +Signed-off-by: Sasha Levin +--- + drivers/media/platform/ti/omap3isp/ispvideo.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/ti/omap3isp/ispvideo.c b/drivers/media/platform/ti/omap3isp/ispvideo.c +index 0e7f0bf2b3463..68e6a24be5614 100644 +--- a/drivers/media/platform/ti/omap3isp/ispvideo.c ++++ b/drivers/media/platform/ti/omap3isp/ispvideo.c +@@ -148,12 +148,12 @@ static unsigned int isp_video_mbus_to_pix(const struct isp_video *video, + pix->width = mbus->width; + pix->height = mbus->height; + +- for (i = 0; i < ARRAY_SIZE(formats); ++i) { ++ for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) { + if (formats[i].code == mbus->code) + break; + } + +- if (WARN_ON(i == ARRAY_SIZE(formats))) ++ if (WARN_ON(i == ARRAY_SIZE(formats) - 1)) + return 0; + + min_bpl = pix->width * formats[i].bpp; +@@ -191,7 +191,7 @@ static void isp_video_pix_to_mbus(const struct v4l2_pix_format *pix, + /* Skip the last format in the loop so that it will be selected if no + * match is found. + */ +- for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) { ++ for (i = 0; i < ARRAY_SIZE(formats) - 2; ++i) { + if (formats[i].pixelformat == pix->pixelformat) + break; + } +-- +2.51.0 + diff --git a/queue-6.19/media-omap3isp-isppreview-always-clamp-in-preview_tr.patch b/queue-6.19/media-omap3isp-isppreview-always-clamp-in-preview_tr.patch new file mode 100644 index 00000000000..84aed865cb6 --- /dev/null +++ b/queue-6.19/media-omap3isp-isppreview-always-clamp-in-preview_tr.patch @@ -0,0 +1,63 @@ +From 514f220bdca767639295d5b410b617a59e202783 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 17:09:18 +0200 +Subject: media: omap3isp: isppreview: always clamp in preview_try_format() + +From: Hans Verkuil + +[ Upstream commit 17e1e1641f74a89824d4de3aa38c78daa5686cc1 ] + +If prev->input != PREVIEW_INPUT_MEMORY the width and height weren't +clamped. Just always clamp. + +This fixes a v4l2-compliance error: + + fail: v4l2-test-subdevs.cpp(171): fse.max_width == ~0U || fse.max_height == ~0U + fail: v4l2-test-subdevs.cpp(270): ret && ret != ENOTTY +test Try VIDIOC_SUBDEV_ENUM_MBUS_CODE/FRAME_SIZE/FRAME_INTERVAL: FAIL + +Signed-off-by: Hans Verkuil +Acked-by: Sakari Ailus +Signed-off-by: Sasha Levin +--- + .../media/platform/ti/omap3isp/isppreview.c | 21 +++++++------------ + 1 file changed, 8 insertions(+), 13 deletions(-) + +diff --git a/drivers/media/platform/ti/omap3isp/isppreview.c b/drivers/media/platform/ti/omap3isp/isppreview.c +index e383a57654de8..5c492b31b5160 100644 +--- a/drivers/media/platform/ti/omap3isp/isppreview.c ++++ b/drivers/media/platform/ti/omap3isp/isppreview.c +@@ -1742,22 +1742,17 @@ static void preview_try_format(struct isp_prev_device *prev, + + switch (pad) { + case PREV_PAD_SINK: +- /* When reading data from the CCDC, the input size has already +- * been mangled by the CCDC output pad so it can be accepted +- * as-is. +- * +- * When reading data from memory, clamp the requested width and +- * height. The TRM doesn't specify a minimum input height, make ++ /* ++ * Clamp the requested width and height. ++ * The TRM doesn't specify a minimum input height, make + * sure we got enough lines to enable the noise filter and color + * filter array interpolation. + */ +- if (prev->input == PREVIEW_INPUT_MEMORY) { +- fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH, +- preview_max_out_width(prev)); +- fmt->height = clamp_t(u32, fmt->height, +- PREV_MIN_IN_HEIGHT, +- PREV_MAX_IN_HEIGHT); +- } ++ fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH, ++ preview_max_out_width(prev)); ++ fmt->height = clamp_t(u32, fmt->height, ++ PREV_MIN_IN_HEIGHT, ++ PREV_MAX_IN_HEIGHT); + + fmt->colorspace = V4L2_COLORSPACE_SRGB; + +-- +2.51.0 + diff --git a/queue-6.19/media-omap3isp-set-initial-format.patch b/queue-6.19/media-omap3isp-set-initial-format.patch new file mode 100644 index 00000000000..9f2ca578796 --- /dev/null +++ b/queue-6.19/media-omap3isp-set-initial-format.patch @@ -0,0 +1,51 @@ +From 4a815239fa9f96f8875538d3833b9f0fe047d6de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Apr 2025 09:21:53 +0200 +Subject: media: omap3isp: set initial format + +From: Hans Verkuil + +[ Upstream commit 7575b8dfa91f82fcb34ffd5568ff415ac4685794 ] + +Initialize the v4l2_format to a default. Empty formats are +not allowed in V4L2, so this fixes v4l2-compliance issues: + + fail: v4l2-test-formats.cpp(514): !pix.width || !pix.height +test VIDIOC_G_FMT: FAIL + +Signed-off-by: Hans Verkuil +Acked-by: Sakari Ailus +Signed-off-by: Sasha Levin +--- + drivers/media/platform/ti/omap3isp/ispvideo.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/media/platform/ti/omap3isp/ispvideo.c b/drivers/media/platform/ti/omap3isp/ispvideo.c +index 68e6a24be5614..eb33a776f27c9 100644 +--- a/drivers/media/platform/ti/omap3isp/ispvideo.c ++++ b/drivers/media/platform/ti/omap3isp/ispvideo.c +@@ -1288,6 +1288,7 @@ static const struct v4l2_ioctl_ops isp_video_ioctl_ops = { + static int isp_video_open(struct file *file) + { + struct isp_video *video = video_drvdata(file); ++ struct v4l2_mbus_framefmt fmt; + struct isp_video_fh *handle; + struct vb2_queue *queue; + int ret = 0; +@@ -1330,6 +1331,13 @@ static int isp_video_open(struct file *file) + + memset(&handle->format, 0, sizeof(handle->format)); + handle->format.type = video->type; ++ handle->format.fmt.pix.width = 720; ++ handle->format.fmt.pix.height = 480; ++ handle->format.fmt.pix.pixelformat = V4L2_PIX_FMT_UYVY; ++ handle->format.fmt.pix.field = V4L2_FIELD_NONE; ++ handle->format.fmt.pix.colorspace = V4L2_COLORSPACE_SRGB; ++ isp_video_pix_to_mbus(&handle->format.fmt.pix, &fmt); ++ isp_video_mbus_to_pix(video, &fmt, &handle->format.fmt.pix); + handle->timeperframe.denominator = 1; + + handle->video = video; +-- +2.51.0 + diff --git a/queue-6.19/media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch b/queue-6.19/media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch new file mode 100644 index 00000000000..a2a849e30f9 --- /dev/null +++ b/queue-6.19/media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch @@ -0,0 +1,48 @@ +From 6404a67da6eac9828d341fb19457560143b3082e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Dec 2025 19:24:19 +0100 +Subject: media: pvrusb2: fix URB leak in pvr2_send_request_ex + +From: Szymon Wilczek + +[ Upstream commit a8333c8262aed2aedf608c18edd39cf5342680a7 ] + +When pvr2_send_request_ex() submits a write URB successfully but fails to +submit the read URB (e.g. returns -ENOMEM), it returns immediately without +waiting for the write URB to complete. Since the driver reuses the same +URB structure, a subsequent call to pvr2_send_request_ex() attempts to +submit the still-active write URB, triggering a 'URB submitted while +active' warning in usb_submit_urb(). + +Fix this by ensuring the write URB is unlinked and waited upon if the read +URB submission fails. + +Reported-by: syzbot+405dcd13121ff75a9e16@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=405dcd13121ff75a9e16 +Signed-off-by: Szymon Wilczek +Acked-by: Mike Isely +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +index b32bb906a9de2..5807734ae26c6 100644 +--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c ++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +@@ -3709,6 +3709,11 @@ status); + "Failed to submit read-control URB status=%d", + status); + hdw->ctl_read_pend_flag = 0; ++ if (hdw->ctl_write_pend_flag) { ++ usb_unlink_urb(hdw->ctl_write_urb); ++ while (hdw->ctl_write_pend_flag) ++ wait_for_completion(&hdw->ctl_done); ++ } + goto done; + } + } +-- +2.51.0 + diff --git a/queue-6.19/media-qcom-camss-do-not-enable-cpas-fast-ahb-clock-f.patch b/queue-6.19/media-qcom-camss-do-not-enable-cpas-fast-ahb-clock-f.patch new file mode 100644 index 00000000000..a0b81a915f6 --- /dev/null +++ b/queue-6.19/media-qcom-camss-do-not-enable-cpas-fast-ahb-clock-f.patch @@ -0,0 +1,58 @@ +From 5da48281e7172d7e53f0eac8e4941a33efe3ce99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Oct 2025 17:02:27 +0300 +Subject: media: qcom: camss: Do not enable cpas fast ahb clock for SM8550 VFE + lite + +From: Vladimir Zapolskiy + +[ Upstream commit a89e490ba3551823511588b7b3828d67f8b82954 ] + +The clock is needed to stream images over a full VFE IP on SM8550 CAMSS, +and it should not be enabled, when an image stream is routed over any of +two lite VFE IPs on the SoC. + +Signed-off-by: Vladimir Zapolskiy +Acked-by: Bryan O'Donoghue +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/camss/camss.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c +index fcc2b2c3cba07..757c548af485a 100644 +--- a/drivers/media/platform/qcom/camss/camss.c ++++ b/drivers/media/platform/qcom/camss/camss.c +@@ -2704,12 +2704,11 @@ static const struct camss_subdev_resources vfe_res_8550[] = { + /* VFE3 lite */ + { + .regulators = {}, +- .clock = { "gcc_axi_hf", "cpas_ahb", "cpas_fast_ahb_clk", "vfe_lite_ahb", ++ .clock = { "gcc_axi_hf", "cpas_ahb", "vfe_lite_ahb", + "vfe_lite", "cpas_ife_lite", "camnoc_axi" }, + .clock_rate = { { 0 }, + { 80000000 }, + { 300000000, 400000000 }, +- { 300000000, 400000000 }, + { 400000000, 480000000 }, + { 300000000, 400000000 }, + { 300000000, 400000000 } }, +@@ -2726,12 +2725,11 @@ static const struct camss_subdev_resources vfe_res_8550[] = { + /* VFE4 lite */ + { + .regulators = {}, +- .clock = { "gcc_axi_hf", "cpas_ahb", "cpas_fast_ahb_clk", "vfe_lite_ahb", ++ .clock = { "gcc_axi_hf", "cpas_ahb", "vfe_lite_ahb", + "vfe_lite", "cpas_ife_lite", "camnoc_axi" }, + .clock_rate = { { 0 }, + { 80000000 }, + { 300000000, 400000000 }, +- { 300000000, 400000000 }, + { 400000000, 480000000 }, + { 300000000, 400000000 }, + { 300000000, 400000000 } }, +-- +2.51.0 + diff --git a/queue-6.19/media-rkisp1-fix-filter-mode-register-configuration.patch b/queue-6.19/media-rkisp1-fix-filter-mode-register-configuration.patch new file mode 100644 index 00000000000..5a751e7235c --- /dev/null +++ b/queue-6.19/media-rkisp1-fix-filter-mode-register-configuration.patch @@ -0,0 +1,53 @@ +From e9c20eeaebc6f76870a32317df0c4c92de4a0eae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 12:11:42 -0500 +Subject: media: rkisp1: Fix filter mode register configuration + +From: Rui Wang + +[ Upstream commit 5a50f2b61104d0d351b59ec179f67abab7870453 ] + +The rkisp1_flt_config() function performs an initial direct write to +RKISP1_CIF_ISP_FILT_MODE without including the RKISP1_CIF_ISP_FLT_ENA +bit, which clears the filter enable bit in the hardware. + +The subsequent read/modify/write sequence then reads back the register +with the enable bit already cleared and cannot restore it, resulting in +the filter being inadvertently disabled. + +Remove the redundant direct write. The read/modify/write sequence alone +correctly preserves the existing enable bit state while updating the +DNR mode and filter configuration bits. + +Signed-off-by: Rui Wang +Reviewed-by: Stefan Klug +Reviewed-by: Kieran Bingham +Reviewed-by: Laurent Pinchart +Link: https://patch.msgid.link/20260105171142.147792-2-rui.wang@ideasonboard.com +Signed-off-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rockchip/rkisp1/rkisp1-params.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c +index c9f88635224cc..6442436a5e428 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c +@@ -411,12 +411,6 @@ static void rkisp1_flt_config(struct rkisp1_params *params, + rkisp1_write(params->rkisp1, RKISP1_CIF_ISP_FILT_LUM_WEIGHT, + arg->lum_weight); + +- rkisp1_write(params->rkisp1, RKISP1_CIF_ISP_FILT_MODE, +- (arg->mode ? RKISP1_CIF_ISP_FLT_MODE_DNR : 0) | +- RKISP1_CIF_ISP_FLT_CHROMA_V_MODE(arg->chr_v_mode) | +- RKISP1_CIF_ISP_FLT_CHROMA_H_MODE(arg->chr_h_mode) | +- RKISP1_CIF_ISP_FLT_GREEN_STAGE1(arg->grn_stage1)); +- + /* avoid to override the old enable value */ + filt_mode = rkisp1_read(params->rkisp1, RKISP1_CIF_ISP_FILT_MODE); + filt_mode &= RKISP1_CIF_ISP_FLT_ENA; +-- +2.51.0 + diff --git a/queue-6.19/media-solo6x10-check-for-out-of-bounds-chip_id.patch b/queue-6.19/media-solo6x10-check-for-out-of-bounds-chip_id.patch new file mode 100644 index 00000000000..026330bc185 --- /dev/null +++ b/queue-6.19/media-solo6x10-check-for-out-of-bounds-chip_id.patch @@ -0,0 +1,68 @@ +From d7a7686c062c78ce429e8888b174a4358f9b28d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 19:00:35 -0800 +Subject: media: solo6x10: Check for out of bounds chip_id + +From: Kees Cook + +[ Upstream commit 0fdf6323c35a134f206dcad5babb4ff488552076 ] + +Clang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type +(literal "1" is an "int") could end up being shifted beyond 32 bits, +so instrumentation was added (and due to the double is_tw286x() call +seen via inlining), Clang decides the second one must now be undefined +behavior and elides the rest of the function[1]. This is a known problem +with Clang (that is still being worked on), but we can avoid the entire +problem by actually checking the existing max chip ID, and now there is +no runtime instrumentation added at all since everything is known to be +within bounds. + +Additionally use an unsigned value for the shift to remove the +instrumentation even without the explicit bounds checking. + +Link: https://github.com/ClangBuiltLinux/linux/issues/2144 [1] +Suggested-by: Nathan Chancellor +Signed-off-by: Kees Cook +Signed-off-by: Hans Verkuil +[hverkuil: fix checkpatch warning for is_tw286x] +Signed-off-by: Sasha Levin +--- + drivers/media/pci/solo6x10/solo6x10-tw28.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/pci/solo6x10/solo6x10-tw28.c b/drivers/media/pci/solo6x10/solo6x10-tw28.c +index 1b7c22a9bc94f..8f53946c67928 100644 +--- a/drivers/media/pci/solo6x10/solo6x10-tw28.c ++++ b/drivers/media/pci/solo6x10/solo6x10-tw28.c +@@ -166,7 +166,7 @@ static const u8 tbl_tw2865_pal_template[] = { + 0x64, 0x51, 0x40, 0xaf, 0xFF, 0xF0, 0x00, 0xC0, + }; + +-#define is_tw286x(__solo, __id) (!(__solo->tw2815 & (1 << __id))) ++#define is_tw286x(__solo, __id) (!((__solo)->tw2815 & (1U << (__id)))) + + static u8 tw_readbyte(struct solo_dev *solo_dev, int chip_id, u8 tw6x_off, + u8 tw_off) +@@ -686,6 +686,9 @@ int tw28_set_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch, + chip_num = ch / 4; + ch %= 4; + ++ if (chip_num >= TW_NUM_CHIP) ++ return -EINVAL; ++ + if (val > 255 || val < 0) + return -ERANGE; + +@@ -758,6 +761,9 @@ int tw28_get_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch, + chip_num = ch / 4; + ch %= 4; + ++ if (chip_num >= TW_NUM_CHIP) ++ return -EINVAL; ++ + switch (ctrl) { + case V4L2_CID_SHARPNESS: + /* Only 286x has sharpness */ +-- +2.51.0 + diff --git a/queue-6.19/media-uvcvideo-create-an-id-namespace-for-streaming-.patch b/queue-6.19/media-uvcvideo-create-an-id-namespace-for-streaming-.patch new file mode 100644 index 00000000000..21c0866b504 --- /dev/null +++ b/queue-6.19/media-uvcvideo-create-an-id-namespace-for-streaming-.patch @@ -0,0 +1,183 @@ +From db934604b090a8d4e28c8288b4b3991a7c987e2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Nov 2025 23:04:00 +0200 +Subject: media: uvcvideo: Create an ID namespace for streaming output + terminals + +From: Ricardo Ribalda + +[ Upstream commit 3d9f32e02c2ed85338be627de672e2b81b88a836 ] + +Some devices, such as the Grandstream GUV3100 and the LSK Meeting Eye +for Business & Home, exhibit entity ID collisions between units and +streaming output terminals. + +The UVC specification requires unit and terminal IDs to be unique, and +uses the ID to reference entities: + +- In control requests, to identify the target entity +- In the UVC units and terminals descriptors' bSourceID field, to + identify source entities +- In the UVC input header descriptor's bTerminalLink, to identify the + terminal associated with a streaming interface + +Entity ID collisions break accessing controls and make the graph +description in the UVC descriptors ambiguous. However, collisions where +one of the entities is a streaming output terminal and the other entity +is not a streaming terminal are less severe. Streaming output terminals +have no controls, and, as they are the final entity in pipelines, they +are never referenced in descriptors as source entities. They are +referenced by ID only from innput header descriptors, which by +definition only reference streaming terminals. + +For these reasons, we can work around the collision by giving streaming +output terminals their own ID namespace. Do so by setting bit +UVC_TERM_OUTPUT (15) in the uvc_entity.id field, which is normally never +set as the ID is a 8-bit value. + +This ID change doesn't affect the entity name in the media controller +graph as the name isn't constructed from the ID, so there should not be +any impact on the uAPI. + +Although this change handles some ID collisions automagically, keep +printing an error in uvc_alloc_new_entity() when a camera has invalid +descriptors. Hopefully this message will help vendors fix their invalid +descriptors. + +This new method of handling ID collisions includes a revert of commit +758dbc756aad ("media: uvcvideo: Use heuristic to find stream entity") +that attempted to fix the problem urgently due to regression reports. + +Suggested-by: Laurent Pinchart +Signed-off-by: Ricardo Ribalda +Reviewed-by: Laurent Pinchart +Tested-by: Lili Orosz +Co-developed-by: Laurent Pinchart +Signed-off-by: Laurent Pinchart +Link: https://patch.msgid.link/20251113210400.28618-1-laurent.pinchart@ideasonboard.com +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_driver.c | 54 ++++++++++++++++++------------ + drivers/media/usb/uvc/uvcvideo.h | 3 +- + 2 files changed, 35 insertions(+), 22 deletions(-) + +diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c +index ee4f54d683496..aa3e8d295e0f5 100644 +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -165,28 +165,17 @@ static struct uvc_entity *uvc_entity_by_reference(struct uvc_device *dev, + return NULL; + } + +-static struct uvc_streaming *uvc_stream_by_id(struct uvc_device *dev, int id) ++static struct uvc_streaming *uvc_stream_for_terminal(struct uvc_device *dev, ++ struct uvc_entity *term) + { +- struct uvc_streaming *stream, *last_stream; +- unsigned int count = 0; ++ u16 id = UVC_HARDWARE_ENTITY_ID(term->id); ++ struct uvc_streaming *stream; + + list_for_each_entry(stream, &dev->streams, list) { +- count += 1; +- last_stream = stream; + if (stream->header.bTerminalLink == id) + return stream; + } + +- /* +- * If the streaming entity is referenced by an invalid ID, notify the +- * user and use heuristics to guess the correct entity. +- */ +- if (count == 1 && id == UVC_INVALID_ENTITY_ID) { +- dev_warn(&dev->intf->dev, +- "UVC non compliance: Invalid USB header. The streaming entity has an invalid ID, guessing the correct one."); +- return last_stream; +- } +- + return NULL; + } + +@@ -823,10 +812,12 @@ static struct uvc_entity *uvc_alloc_new_entity(struct uvc_device *dev, u16 type, + } + + /* Per UVC 1.1+ spec 3.7.2, the ID is unique. */ +- if (uvc_entity_by_id(dev, id)) { +- dev_err(&dev->intf->dev, "Found multiple Units with ID %u\n", id); ++ if (uvc_entity_by_id(dev, UVC_HARDWARE_ENTITY_ID(id))) ++ dev_err(&dev->intf->dev, "Found multiple Units with ID %u\n", ++ UVC_HARDWARE_ENTITY_ID(id)); ++ ++ if (uvc_entity_by_id(dev, id)) + id = UVC_INVALID_ENTITY_ID; +- } + + extra_size = roundup(extra_size, sizeof(*entity->pads)); + if (num_pads) +@@ -982,6 +973,7 @@ static int uvc_parse_standard_control(struct uvc_device *dev, + struct usb_host_interface *alts = dev->intf->cur_altsetting; + unsigned int i, n, p, len; + const char *type_name; ++ unsigned int id; + u16 type; + + switch (buffer[2]) { +@@ -1120,8 +1112,28 @@ static int uvc_parse_standard_control(struct uvc_device *dev, + return 0; + } + ++ id = buffer[3]; ++ ++ /* ++ * Some devices, such as the Grandstream GUV3100, exhibit entity ++ * ID collisions between units and streaming output terminals. ++ * Move streaming output terminals to their own ID namespace by ++ * setting bit UVC_TERM_OUTPUT (15), above the ID's 8-bit value. ++ * The bit is ignored in uvc_stream_for_terminal() when looking ++ * up the streaming interface for the terminal. ++ * ++ * This hack is safe to enable unconditionally, as the ID is not ++ * used for any other purpose (streaming output terminals have ++ * no controls and are never referenced as sources in UVC ++ * descriptors). Other types output terminals can have controls, ++ * so limit usage of this separate namespace to streaming output ++ * terminals. ++ */ ++ if (type & UVC_TT_STREAMING) ++ id |= UVC_TERM_OUTPUT; ++ + term = uvc_alloc_new_entity(dev, type | UVC_TERM_OUTPUT, +- buffer[3], 1, 0); ++ id, 1, 0); + if (IS_ERR(term)) + return PTR_ERR(term); + +@@ -2118,8 +2130,8 @@ static int uvc_register_terms(struct uvc_device *dev, + if (UVC_ENTITY_TYPE(term) != UVC_TT_STREAMING) + continue; + +- stream = uvc_stream_by_id(dev, term->id); +- if (stream == NULL) { ++ stream = uvc_stream_for_terminal(dev, term); ++ if (!stream) { + dev_info(&dev->intf->dev, + "No streaming interface found for terminal %u.", + term->id); +diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h +index ed7bad31f75ca..3f2e832025e71 100644 +--- a/drivers/media/usb/uvc/uvcvideo.h ++++ b/drivers/media/usb/uvc/uvcvideo.h +@@ -41,7 +41,8 @@ + #define UVC_EXT_GPIO_UNIT 0x7ffe + #define UVC_EXT_GPIO_UNIT_ID 0x100 + +-#define UVC_INVALID_ENTITY_ID 0xffff ++#define UVC_HARDWARE_ENTITY_ID(id) ((id) & 0xff) ++#define UVC_INVALID_ENTITY_ID 0xffff + + /* ------------------------------------------------------------------------ + * Driver specific constants. +-- +2.51.0 + diff --git a/queue-6.19/media-v4l2-async-fix-error-handling-on-steps-after-f.patch b/queue-6.19/media-v4l2-async-fix-error-handling-on-steps-after-f.patch new file mode 100644 index 00000000000..1ab78d38346 --- /dev/null +++ b/queue-6.19/media-v4l2-async-fix-error-handling-on-steps-after-f.patch @@ -0,0 +1,131 @@ +From f0824ef46aed712a9565cce64f1f8a7d0d705bf5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 13:48:40 +0200 +Subject: media: v4l2-async: Fix error handling on steps after finding a match + +From: Sakari Ailus + +[ Upstream commit 7345d6d356336c448d6b9230ed8704f39679fd12 ] + +Once an async connection is found to be matching with an fwnode, a +sub-device may be registered (in case it wasn't already), its bound +operation is called, ancillary links are created, the async connection +is added to the sub-device's list of connections and removed from the +global waiting connection list. Further on, the sub-device's possible own +notifier is searched for possible additional matches. + +Fix these specific issues: + +- If v4l2_async_match_notify() failed before the sub-notifier handling, + the async connection was unbound and its entry removed from the + sub-device's async connection list. The latter part was also done in + v4l2_async_match_notify(). + +- The async connection's sd field was only set after creating ancillary + links in v4l2_async_match_notify(). It was however dereferenced in + v4l2_async_unbind_subdev_one(), which was called on error path of + v4l2_async_match_notify() failure. + +Signed-off-by: Sakari Ailus +Tested-by: "Yew, Chang Ching" +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-async.c | 45 +++++++++++++++++++--------- + 1 file changed, 31 insertions(+), 14 deletions(-) + +diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c +index ee884a8221fbd..1c08bba9ecb91 100644 +--- a/drivers/media/v4l2-core/v4l2-async.c ++++ b/drivers/media/v4l2-core/v4l2-async.c +@@ -343,7 +343,6 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier, + struct v4l2_subdev *sd, + struct v4l2_async_connection *asc) + { +- struct v4l2_async_notifier *subdev_notifier; + bool registered = false; + int ret; + +@@ -389,6 +388,25 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier, + dev_dbg(notifier_dev(notifier), "v4l2-async: %s bound (ret %d)\n", + dev_name(sd->dev), ret); + ++ return 0; ++ ++err_call_unbind: ++ v4l2_async_nf_call_unbind(notifier, sd, asc); ++ list_del(&asc->asc_subdev_entry); ++ ++err_unregister_subdev: ++ if (registered) ++ v4l2_device_unregister_subdev(sd); ++ ++ return ret; ++} ++ ++static int ++v4l2_async_nf_try_subdev_notifier(struct v4l2_async_notifier *notifier, ++ struct v4l2_subdev *sd) ++{ ++ struct v4l2_async_notifier *subdev_notifier; ++ + /* + * See if the sub-device has a notifier. If not, return here. + */ +@@ -404,16 +422,6 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier, + subdev_notifier->parent = notifier; + + return v4l2_async_nf_try_all_subdevs(subdev_notifier); +- +-err_call_unbind: +- v4l2_async_nf_call_unbind(notifier, sd, asc); +- list_del(&asc->asc_subdev_entry); +- +-err_unregister_subdev: +- if (registered) +- v4l2_device_unregister_subdev(sd); +- +- return ret; + } + + /* Test all async sub-devices in a notifier for a match. */ +@@ -445,6 +453,10 @@ v4l2_async_nf_try_all_subdevs(struct v4l2_async_notifier *notifier) + if (ret < 0) + return ret; + ++ ret = v4l2_async_nf_try_subdev_notifier(notifier, sd); ++ if (ret < 0) ++ return ret; ++ + /* + * v4l2_async_match_notify() may lead to registering a + * new notifier and thus changing the async subdevs +@@ -829,7 +841,11 @@ int __v4l2_async_register_subdev(struct v4l2_subdev *sd, struct module *module) + ret = v4l2_async_match_notify(notifier, v4l2_dev, sd, + asc); + if (ret) +- goto err_unbind; ++ goto err_unlock; ++ ++ ret = v4l2_async_nf_try_subdev_notifier(notifier, sd); ++ if (ret) ++ goto err_unbind_one; + + ret = v4l2_async_nf_try_complete(notifier); + if (ret) +@@ -853,9 +869,10 @@ int __v4l2_async_register_subdev(struct v4l2_subdev *sd, struct module *module) + if (subdev_notifier) + v4l2_async_nf_unbind_all_subdevs(subdev_notifier); + +- if (asc) +- v4l2_async_unbind_subdev_one(notifier, asc); ++err_unbind_one: ++ v4l2_async_unbind_subdev_one(notifier, asc); + ++err_unlock: + mutex_unlock(&list_lock); + + sd->owner = NULL; +-- +2.51.0 + diff --git a/queue-6.19/mfd-intel-lpss-add-intel-nova-lake-s-pci-ids.patch b/queue-6.19/mfd-intel-lpss-add-intel-nova-lake-s-pci-ids.patch new file mode 100644 index 00000000000..3ff49558720 --- /dev/null +++ b/queue-6.19/mfd-intel-lpss-add-intel-nova-lake-s-pci-ids.patch @@ -0,0 +1,50 @@ +From 8c465adef131d359419791ee0a11f392b8a3608c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 19:21:50 +0200 +Subject: mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit cefd793fa17de708d043adab50e7f96f414b0f1d ] + +Add Intel Nova Lake-S LPSS PCI IDs. + +Signed-off-by: Ilpo Järvinen +Acked-by: Andy Shevchenko +Link: https://patch.msgid.link/20260113172151.48062-1-ilpo.jarvinen@linux.intel.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/intel-lpss-pci.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c +index 8d92c895d3aef..713a5bfb1a3c2 100644 +--- a/drivers/mfd/intel-lpss-pci.c ++++ b/drivers/mfd/intel-lpss-pci.c +@@ -437,6 +437,19 @@ static const struct pci_device_id intel_lpss_pci_ids[] = { + { PCI_VDEVICE(INTEL, 0x5ac4), (kernel_ulong_t)&bxt_spi_info }, + { PCI_VDEVICE(INTEL, 0x5ac6), (kernel_ulong_t)&bxt_spi_info }, + { PCI_VDEVICE(INTEL, 0x5aee), (kernel_ulong_t)&bxt_uart_info }, ++ /* NVL-S */ ++ { PCI_VDEVICE(INTEL, 0x6e28), (kernel_ulong_t)&bxt_uart_info }, ++ { PCI_VDEVICE(INTEL, 0x6e29), (kernel_ulong_t)&bxt_uart_info }, ++ { PCI_VDEVICE(INTEL, 0x6e2a), (kernel_ulong_t)&tgl_spi_info }, ++ { PCI_VDEVICE(INTEL, 0x6e2b), (kernel_ulong_t)&tgl_spi_info }, ++ { PCI_VDEVICE(INTEL, 0x6e4c), (kernel_ulong_t)&ehl_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x6e4d), (kernel_ulong_t)&ehl_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x6e4e), (kernel_ulong_t)&ehl_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x6e4f), (kernel_ulong_t)&ehl_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x6e5c), (kernel_ulong_t)&bxt_uart_info }, ++ { PCI_VDEVICE(INTEL, 0x6e5e), (kernel_ulong_t)&tgl_spi_info }, ++ { PCI_VDEVICE(INTEL, 0x6e7a), (kernel_ulong_t)&ehl_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x6e7b), (kernel_ulong_t)&ehl_i2c_info }, + /* ARL-H */ + { PCI_VDEVICE(INTEL, 0x7725), (kernel_ulong_t)&bxt_uart_info }, + { PCI_VDEVICE(INTEL, 0x7726), (kernel_ulong_t)&bxt_uart_info }, +-- +2.51.0 + diff --git a/queue-6.19/minix-add-required-sanity-checking-to-minix_check_su.patch b/queue-6.19/minix-add-required-sanity-checking-to-minix_check_su.patch new file mode 100644 index 00000000000..4c4e7c6bc9d --- /dev/null +++ b/queue-6.19/minix-add-required-sanity-checking-to-minix_check_su.patch @@ -0,0 +1,103 @@ +From 775942b9ae815cec8e9b49ee2a9a9af253c95d7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 16:39:47 +0100 +Subject: minix: Add required sanity checking to minix_check_superblock() + +From: Jori Koolstra + +[ Upstream commit 8c97a6ddc95690a938ded44b4e3202f03f15078c ] + +The fs/minix implementation of the minix filesystem does not currently +support any other value for s_log_zone_size than 0. This is also the +only value supported in util-linux; see mkfs.minix.c line 511. In +addition, this patch adds some sanity checking for the other minix +superblock fields, and moves the minix_blocks_needed() checks for the +zmap and imap also to minix_check_super_block(). + +This also closes a related syzbot bug report. + +Signed-off-by: Jori Koolstra +Link: https://patch.msgid.link/20251208153947.108343-1-jkoolstra@xs4all.nl +Reviewed-by: Jan Kara +Reported-by: syzbot+5ad0824204c7bf9b67f2@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=5ad0824204c7bf9b67f2 +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/minix/inode.c | 50 ++++++++++++++++++++++++++++-------------------- + 1 file changed, 29 insertions(+), 21 deletions(-) + +diff --git a/fs/minix/inode.c b/fs/minix/inode.c +index 51ea9bdc813f7..c8c6b2135abe7 100644 +--- a/fs/minix/inode.c ++++ b/fs/minix/inode.c +@@ -170,10 +170,38 @@ static int minix_reconfigure(struct fs_context *fc) + static bool minix_check_superblock(struct super_block *sb) + { + struct minix_sb_info *sbi = minix_sb(sb); ++ unsigned long block; + +- if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0) ++ if (sbi->s_log_zone_size != 0) { ++ printk("minix-fs error: zone size must equal block size. " ++ "s_log_zone_size > 0 is not supported.\n"); ++ return false; ++ } ++ ++ if (sbi->s_ninodes < 1 || sbi->s_firstdatazone <= 4 || ++ sbi->s_firstdatazone >= sbi->s_nzones) + return false; + ++ /* Apparently minix can create filesystems that allocate more blocks for ++ * the bitmaps than needed. We simply ignore that, but verify it didn't ++ * create one with not enough blocks and bail out if so. ++ */ ++ block = minix_blocks_needed(sbi->s_ninodes, sb->s_blocksize); ++ if (sbi->s_imap_blocks < block) { ++ printk("MINIX-fs: file system does not have enough " ++ "imap blocks allocated. Refusing to mount.\n"); ++ return false; ++ } ++ ++ block = minix_blocks_needed( ++ (sbi->s_nzones - sbi->s_firstdatazone + 1), ++ sb->s_blocksize); ++ if (sbi->s_zmap_blocks < block) { ++ printk("MINIX-fs: file system does not have enough " ++ "zmap blocks allocated. Refusing to mount.\n"); ++ return false; ++ } ++ + /* + * s_max_size must not exceed the block mapping limitation. This check + * is only needed for V1 filesystems, since V2/V3 support an extra level +@@ -293,26 +321,6 @@ static int minix_fill_super(struct super_block *s, struct fs_context *fc) + minix_set_bit(0,sbi->s_imap[0]->b_data); + minix_set_bit(0,sbi->s_zmap[0]->b_data); + +- /* Apparently minix can create filesystems that allocate more blocks for +- * the bitmaps than needed. We simply ignore that, but verify it didn't +- * create one with not enough blocks and bail out if so. +- */ +- block = minix_blocks_needed(sbi->s_ninodes, s->s_blocksize); +- if (sbi->s_imap_blocks < block) { +- printk("MINIX-fs: file system does not have enough " +- "imap blocks allocated. Refusing to mount.\n"); +- goto out_no_bitmap; +- } +- +- block = minix_blocks_needed( +- (sbi->s_nzones - sbi->s_firstdatazone + 1), +- s->s_blocksize); +- if (sbi->s_zmap_blocks < block) { +- printk("MINIX-fs: file system does not have enough " +- "zmap blocks allocated. Refusing to mount.\n"); +- goto out_no_bitmap; +- } +- + /* set up enough so that it can read an inode */ + s->s_op = &minix_sops; + s->s_time_min = 0; +-- +2.51.0 + diff --git a/queue-6.19/mips-loongson-make-cpumask_of_node-robust-against-nu.patch b/queue-6.19/mips-loongson-make-cpumask_of_node-robust-against-nu.patch new file mode 100644 index 00000000000..293b9fa8b1b --- /dev/null +++ b/queue-6.19/mips-loongson-make-cpumask_of_node-robust-against-nu.patch @@ -0,0 +1,36 @@ +From f1b3c859a7a52f47fb9c5ddbd1d3d67f48cef070 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 09:40:06 +0000 +Subject: MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE + +From: John Garry + +[ Upstream commit d55d3fe2d1470ac5b6e93efe7998b728013c9fc8 ] + +The arch definition of cpumask_of_node() cannot handle NUMA_NO_NODE - which +is a valid index - so add a check for this. + +Signed-off-by: John Garry +Reviewed-by: Huacai Chen +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/mach-loongson64/topology.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/include/asm/mach-loongson64/topology.h b/arch/mips/include/asm/mach-loongson64/topology.h +index 3414a1fd17835..89bb4deab98a6 100644 +--- a/arch/mips/include/asm/mach-loongson64/topology.h ++++ b/arch/mips/include/asm/mach-loongson64/topology.h +@@ -7,7 +7,7 @@ + #define cpu_to_node(cpu) (cpu_logical_map(cpu) >> 2) + + extern cpumask_t __node_cpumask[]; +-#define cpumask_of_node(node) (&__node_cpumask[node]) ++#define cpumask_of_node(node) ((node) == NUMA_NO_NODE ? cpu_all_mask : &__node_cpumask[node]) + + struct pci_bus; + extern int pcibus_to_node(struct pci_bus *); +-- +2.51.0 + diff --git a/queue-6.19/misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch b/queue-6.19/misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch new file mode 100644 index 00000000000..935f8965cc8 --- /dev/null +++ b/queue-6.19/misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch @@ -0,0 +1,75 @@ +From 4f1c3cdf18ecf5fff223079889f5bc43eb7f13a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 14:36:37 +0800 +Subject: misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() + +From: Tuo Li + +[ Upstream commit ba75ecb97d3f4e95d59002c13afb6519205be6cb ] + +In the function bcm_vk_read(), the pointer entry is checked, indicating +that it can be NULL. If entry is NULL and rc is set to -EMSGSIZE, the +following code may cause null-pointer dereferences: + + struct vk_msg_blk tmp_msg = entry->to_h_msg[0]; + set_msg_id(&tmp_msg, entry->usr_msg_id); + tmp_msg.size = entry->to_h_blks - 1; + +To prevent these possible null-pointer dereferences, copy to_h_msg, +usr_msg_id, and to_h_blks from iter into temporary variables, and return +these temporary variables to the application instead of accessing them +through a potentially NULL entry. + +Signed-off-by: Tuo Li +Reviewed-by: Scott Branden +Link: https://patch.msgid.link/20251211063637.3987937-1-islituo@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/bcm-vk/bcm_vk_msg.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/misc/bcm-vk/bcm_vk_msg.c b/drivers/misc/bcm-vk/bcm_vk_msg.c +index 1f42d1d5a630a..665a3888708ac 100644 +--- a/drivers/misc/bcm-vk/bcm_vk_msg.c ++++ b/drivers/misc/bcm-vk/bcm_vk_msg.c +@@ -1010,6 +1010,9 @@ ssize_t bcm_vk_read(struct file *p_file, + struct device *dev = &vk->pdev->dev; + struct bcm_vk_msg_chan *chan = &vk->to_h_msg_chan; + struct bcm_vk_wkent *entry = NULL, *iter; ++ struct vk_msg_blk tmp_msg; ++ u32 tmp_usr_msg_id; ++ u32 tmp_blks; + u32 q_num; + u32 rsp_length; + +@@ -1034,6 +1037,9 @@ ssize_t bcm_vk_read(struct file *p_file, + entry = iter; + } else { + /* buffer not big enough */ ++ tmp_msg = iter->to_h_msg[0]; ++ tmp_usr_msg_id = iter->usr_msg_id; ++ tmp_blks = iter->to_h_blks; + rc = -EMSGSIZE; + } + goto read_loop_exit; +@@ -1052,14 +1058,12 @@ ssize_t bcm_vk_read(struct file *p_file, + + bcm_vk_free_wkent(dev, entry); + } else if (rc == -EMSGSIZE) { +- struct vk_msg_blk tmp_msg = entry->to_h_msg[0]; +- + /* + * in this case, return just the first block, so + * that app knows what size it is looking for. + */ +- set_msg_id(&tmp_msg, entry->usr_msg_id); +- tmp_msg.size = entry->to_h_blks - 1; ++ set_msg_id(&tmp_msg, tmp_usr_msg_id); ++ tmp_msg.size = tmp_blks - 1; + if (copy_to_user(buf, &tmp_msg, VK_MSGQ_BLK_SIZE) != 0) { + dev_err(dev, "Error return 1st block in -EMSGSIZE\n"); + rc = -EFAULT; +-- +2.51.0 + diff --git a/queue-6.19/misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch b/queue-6.19/misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch new file mode 100644 index 00000000000..c84ea6cd0b9 --- /dev/null +++ b/queue-6.19/misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch @@ -0,0 +1,67 @@ +From be5a85e42826eaac9688967f00c7616c10d547dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 11:48:24 +0100 +Subject: misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 + +From: Markus Perkins + +[ Upstream commit b54c82d6cbfc76647ba558e8e3647eb2b0ba0e2b ] + +commit 14374fbb3f06 ("misc: eeprom_93xx46: Add new 93c56 and 93c66 +compatible strings") added support for 93xx56 and 93xx66 eeproms, but +didn't take into account that the write enable/disable + erase all +commands are hardcoded for the 6-bit address of the 93xx46. + +This commit fixes the command word generation by increasing the number +of shifts as the address field grows, keeping the command intact. + +Also, the check for 8-bit or 16-bit mode is no longer required as this +is already taken into account in the edev->addrlen field. + +Signed-off-by: Markus Perkins +Link: https://patch.msgid.link/20251202104823.429869-3-markus@notsyncing.net +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/eeprom/eeprom_93xx46.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c +index 9cae6f530679b..5230e910a1d11 100644 +--- a/drivers/misc/eeprom/eeprom_93xx46.c ++++ b/drivers/misc/eeprom/eeprom_93xx46.c +@@ -45,6 +45,7 @@ struct eeprom_93xx46_platform_data { + #define OP_START 0x4 + #define OP_WRITE (OP_START | 0x1) + #define OP_READ (OP_START | 0x2) ++/* The following addresses are offset for the 1K EEPROM variant in 16-bit mode */ + #define ADDR_EWDS 0x00 + #define ADDR_ERAL 0x20 + #define ADDR_EWEN 0x30 +@@ -191,10 +192,7 @@ static int eeprom_93xx46_ew(struct eeprom_93xx46_dev *edev, int is_on) + bits = edev->addrlen + 3; + + cmd_addr = OP_START << edev->addrlen; +- if (edev->pdata->flags & EE_ADDR8) +- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << 1; +- else +- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS); ++ cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << (edev->addrlen - 6); + + if (has_quirk_instruction_length(edev)) { + cmd_addr <<= 2; +@@ -328,10 +326,7 @@ static int eeprom_93xx46_eral(struct eeprom_93xx46_dev *edev) + bits = edev->addrlen + 3; + + cmd_addr = OP_START << edev->addrlen; +- if (edev->pdata->flags & EE_ADDR8) +- cmd_addr |= ADDR_ERAL << 1; +- else +- cmd_addr |= ADDR_ERAL; ++ cmd_addr |= ADDR_ERAL << (edev->addrlen - 6); + + if (has_quirk_instruction_length(edev)) { + cmd_addr <<= 2; +-- +2.51.0 + diff --git a/queue-6.19/misc-ti_fpc202-fix-a-potential-memory-leak-in-probe-.patch b/queue-6.19/misc-ti_fpc202-fix-a-potential-memory-leak-in-probe-.patch new file mode 100644 index 00000000000..ada973f7be0 --- /dev/null +++ b/queue-6.19/misc-ti_fpc202-fix-a-potential-memory-leak-in-probe-.patch @@ -0,0 +1,46 @@ +From 63f9a18e579ccc2307ea3a44785f5a1468627378 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Dec 2025 18:22:43 +0800 +Subject: misc: ti_fpc202: fix a potential memory leak in probe function + +From: Felix Gu + +[ Upstream commit dad9f13d967b4e53e8eaf5f9c690f8e778ad9802 ] + +Use for_each_child_of_node_scoped() to simplify the code and ensure the +device node reference is automatically released when the loop scope +ends. + +Signed-off-by: Felix Gu +Reviewed-by: Romain Gantois +Link: https://patch.msgid.link/tencent_FA1AC670F5CF49873F88A44424F866994A08@qq.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/ti_fpc202.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/misc/ti_fpc202.c b/drivers/misc/ti_fpc202.c +index 7964e46c74482..8eb2b5ac98506 100644 +--- a/drivers/misc/ti_fpc202.c ++++ b/drivers/misc/ti_fpc202.c +@@ -309,7 +309,6 @@ static void fpc202_remove_port(struct fpc202_priv *priv, int port_id) + static int fpc202_probe(struct i2c_client *client) + { + struct device *dev = &client->dev; +- struct device_node *i2c_handle; + struct fpc202_priv *priv; + int ret, port_id; + +@@ -357,7 +356,7 @@ static int fpc202_probe(struct i2c_client *client) + + bitmap_zero(priv->probed_ports, FPC202_NUM_PORTS); + +- for_each_child_of_node(dev->of_node, i2c_handle) { ++ for_each_child_of_node_scoped(dev->of_node, i2c_handle) { + ret = of_property_read_u32(i2c_handle, "reg", &port_id); + if (ret) { + if (ret == -EINVAL) +-- +2.51.0 + diff --git a/queue-6.19/mmc-rtsx_pci_sdmmc-increase-power-on-settling-delay-.patch b/queue-6.19/mmc-rtsx_pci_sdmmc-increase-power-on-settling-delay-.patch new file mode 100644 index 00000000000..4e918ba9913 --- /dev/null +++ b/queue-6.19/mmc-rtsx_pci_sdmmc-increase-power-on-settling-delay-.patch @@ -0,0 +1,40 @@ +From efa587c899113f32f1e3521d1a3e83f3ee6db22d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jan 2026 22:02:36 -0800 +Subject: mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms + +From: Matthew Schwartz + +[ Upstream commit aced969e9bf3701dc75cfca57c78c031b7875b9d ] + +The existing 1ms delay in sd_power_on is insufficient and causes resume +errors around 4% of the time. + +Increasing the delay to 5ms resolves this issue after testing 300 +s2idle cycles. + +Fixes: 1f311c94aabd ("mmc: rtsx: add 74 Clocks in power on flow") +Signed-off-by: Matthew Schwartz +Link: https://patch.msgid.link/20260105060236.400366-3-matthew.schwartz@linux.dev +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/rtsx_pci_sdmmc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c +index 4db3328f46dfb..b6cf1803c7d27 100644 +--- a/drivers/mmc/host/rtsx_pci_sdmmc.c ++++ b/drivers/mmc/host/rtsx_pci_sdmmc.c +@@ -937,7 +937,7 @@ static int sd_power_on(struct realtek_pci_sdmmc *host, unsigned char power_mode) + if (err < 0) + return err; + +- mdelay(1); ++ mdelay(5); + + err = rtsx_pci_write_register(pcr, CARD_OE, SD_OUTPUT_EN, SD_OUTPUT_EN); + if (err < 0) +-- +2.51.0 + diff --git a/queue-6.19/modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch b/queue-6.19/modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch new file mode 100644 index 00000000000..d872db4eae0 --- /dev/null +++ b/queue-6.19/modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch @@ -0,0 +1,56 @@ +From dfa6e81cfa004e34ffed62ae4b38b3a0661afd2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Nov 2025 13:13:30 +0100 +Subject: modpost: Amend ppc64 save/restfpr symnames for -Os build +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: René Rebe + +[ Upstream commit 3cd9763ce4ad999d015cf0734e6b968cead95077 ] + +Building a size optimized ppc64 kernel (-Os), gcc emits more FP +save/restore symbols, that the linker generates on demand into the +.sfpr section. Explicitly allow-list those in scripts/mod/modpost.c, +too. They are needed for the amdgpu in-kernel floating point support. + +MODPOST Module.symvers +ERROR: modpost: "_restfpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_26" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savegpr1_27" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savegpr1_25" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_28" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savegpr1_29" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savefpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savefpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_15" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +WARNING: modpost: suppressed 56 unresolved symbol warnings because there were too many) + +Signed-off-by: René Rebe +Link: https://patch.msgid.link/20251123.131330.407910684435629198.rene@exactco.de +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + scripts/mod/modpost.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index 755b842f1f9b7..88ad227f87cd1 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -602,6 +602,10 @@ static int ignore_undef_symbol(struct elf_info *info, const char *symname) + /* Special register function linked on all modules during final link of .ko */ + if (strstarts(symname, "_restgpr0_") || + strstarts(symname, "_savegpr0_") || ++ strstarts(symname, "_restgpr1_") || ++ strstarts(symname, "_savegpr1_") || ++ strstarts(symname, "_restfpr_") || ++ strstarts(symname, "_savefpr_") || + strstarts(symname, "_restvr_") || + strstarts(symname, "_savevr_") || + strcmp(symname, ".TOC.") == 0) +-- +2.51.0 + diff --git a/queue-6.19/most-core-fix-resource-leak-in-most_register_interfa.patch b/queue-6.19/most-core-fix-resource-leak-in-most_register_interfa.patch new file mode 100644 index 00000000000..8259105ee40 --- /dev/null +++ b/queue-6.19/most-core-fix-resource-leak-in-most_register_interfa.patch @@ -0,0 +1,71 @@ +From fe6229f704026dbd2f2528bfa17aadee42b7963c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Nov 2025 16:53:37 +0000 +Subject: most: core: fix resource leak in most_register_interface error paths + +From: Navaneeth K + +[ Upstream commit 1f4c9d8a1021281750c6cda126d6f8a40cc24e71 ] + +The function most_register_interface() did not correctly release resources +if it failed early (before registering the device). In these cases, it +returned an error code immediately, leaking the memory allocated for the +interface. + +Fix this by initializing the device early via device_initialize() and +calling put_device() on all error paths. + +The most_register_interface() is expected to call put_device() on +error which frees the resources allocated in the caller. The +put_device() either calls release_mdev() or dim2_release(), +depending on the caller. + +Switch to using device_add() instead of device_register() to handle +the split initialization. + +Acked-by: Abdun Nihaal +Signed-off-by: Navaneeth K +Reviewed-by: Dan Carpenter +Link: https://patch.msgid.link/20251127165337.19172-1-knavaneeth786@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/most/core.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/most/core.c b/drivers/most/core.c +index da319d108ea1d..6277e6702ca8c 100644 +--- a/drivers/most/core.c ++++ b/drivers/most/core.c +@@ -1286,15 +1286,19 @@ int most_register_interface(struct most_interface *iface) + !iface->poison_channel || (iface->num_channels > MAX_CHANNELS)) + return -EINVAL; + ++ device_initialize(iface->dev); ++ + id = ida_alloc(&mdev_id, GFP_KERNEL); + if (id < 0) { + dev_err(iface->dev, "Failed to allocate device ID\n"); ++ put_device(iface->dev); + return id; + } + + iface->p = kzalloc(sizeof(*iface->p), GFP_KERNEL); + if (!iface->p) { + ida_free(&mdev_id, id); ++ put_device(iface->dev); + return -ENOMEM; + } + +@@ -1304,7 +1308,7 @@ int most_register_interface(struct most_interface *iface) + iface->dev->bus = &mostbus; + iface->dev->groups = interface_attr_groups; + dev_set_drvdata(iface->dev, iface); +- if (device_register(iface->dev)) { ++ if (device_add(iface->dev)) { + dev_err(iface->dev, "Failed to register interface device\n"); + kfree(iface->p); + put_device(iface->dev); +-- +2.51.0 + diff --git a/queue-6.19/mshv-clear-eventfd-counter-on-irqfd-shutdown.patch b/queue-6.19/mshv-clear-eventfd-counter-on-irqfd-shutdown.patch new file mode 100644 index 00000000000..b5a4daeff3e --- /dev/null +++ b/queue-6.19/mshv-clear-eventfd-counter-on-irqfd-shutdown.patch @@ -0,0 +1,72 @@ +From 1ce78810666a03959aa072e31be5b86829a12bfa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 12:41:31 +0100 +Subject: mshv: clear eventfd counter on irqfd shutdown +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Carlos López + +[ Upstream commit 2b4246153e2184e3a3b4edc8cc35337d7a2455a6 ] + +While unhooking from the irqfd waitqueue, clear the internal eventfd +counter by using eventfd_ctx_remove_wait_queue() instead of +remove_wait_queue(), preventing potential spurious interrupts. This +removes the need to store a pointer into the workqueue, as the eventfd +already keeps track of it. + +This mimicks what other similar subsystems do on their equivalent paths +with their irqfds (KVM, Xen, ACRN support, etc). + +Signed-off-by: Carlos López +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/hv/mshv_eventfd.c | 5 ++--- + drivers/hv/mshv_eventfd.h | 1 - + 2 files changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/hv/mshv_eventfd.c b/drivers/hv/mshv_eventfd.c +index 6d176ed8ae516..188923fce40b4 100644 +--- a/drivers/hv/mshv_eventfd.c ++++ b/drivers/hv/mshv_eventfd.c +@@ -248,12 +248,13 @@ static void mshv_irqfd_shutdown(struct work_struct *work) + { + struct mshv_irqfd *irqfd = + container_of(work, struct mshv_irqfd, irqfd_shutdown); ++ u64 cnt; + + /* + * Synchronize with the wait-queue and unhook ourselves to prevent + * further events. + */ +- remove_wait_queue(irqfd->irqfd_wqh, &irqfd->irqfd_wait); ++ eventfd_ctx_remove_wait_queue(irqfd->irqfd_eventfd_ctx, &irqfd->irqfd_wait, &cnt); + + if (irqfd->irqfd_resampler) { + mshv_irqfd_resampler_shutdown(irqfd); +@@ -372,8 +373,6 @@ static void mshv_irqfd_queue_proc(struct file *file, wait_queue_head_t *wqh, + struct mshv_irqfd *irqfd = + container_of(polltbl, struct mshv_irqfd, irqfd_polltbl); + +- irqfd->irqfd_wqh = wqh; +- + /* + * TODO: Ensure there isn't already an exclusive, priority waiter, e.g. + * that the irqfd isn't already bound to another partition. Only the +diff --git a/drivers/hv/mshv_eventfd.h b/drivers/hv/mshv_eventfd.h +index 332e7670a3442..464c6b81ab336 100644 +--- a/drivers/hv/mshv_eventfd.h ++++ b/drivers/hv/mshv_eventfd.h +@@ -32,7 +32,6 @@ struct mshv_irqfd { + struct mshv_lapic_irq irqfd_lapic_irq; + struct hlist_node irqfd_hnode; + poll_table irqfd_polltbl; +- wait_queue_head_t *irqfd_wqh; + wait_queue_entry_t irqfd_wait; + struct work_struct irqfd_shutdown; + struct mshv_irqfd_resampler *irqfd_resampler; +-- +2.51.0 + diff --git a/queue-6.19/mshv-ignore-second-stats-page-map-result-failure.patch b/queue-6.19/mshv-ignore-second-stats-page-map-result-failure.patch new file mode 100644 index 00000000000..08b460d9d9b --- /dev/null +++ b/queue-6.19/mshv-ignore-second-stats-page-map-result-failure.patch @@ -0,0 +1,138 @@ +From 4af39bad445fdda040c23b8c7780a4bb70045acb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:11:40 -0800 +Subject: mshv: Ignore second stats page map result failure + +From: Purna Pavan Chandra Aekkaladevi + +[ Upstream commit 7538b80e5a4b473b73428d13b3a47ceaad9a8a7c ] + +Older versions of the hypervisor do not have a concept of separate SELF +and PARENT stats areas. In this case, mapping the HV_STATS_AREA_SELF page +is sufficient - it's the only page and it contains all available stats. + +Mapping HV_STATS_AREA_PARENT returns HV_STATUS_INVALID_PARAMETER which +currently causes module init to fail on older hypevisor versions. + +Detect this case and gracefully fall back to populating +stats_pages[HV_STATS_AREA_PARENT] with the already-mapped SELF page. + +Add comments to clarify the behavior, including a clarification of why +this isn't needed for hv_call_map_stats_page2() which always supports +PARENT and SELF areas. + +Signed-off-by: Purna Pavan Chandra Aekkaladevi +Signed-off-by: Nuno Das Neves +Reviewed-by: Stanislav Kinsburskii +Acked-by: Stanislav Kinsburskii +Reviewed-by: Michael Kelley +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/hv/mshv_root_hv_call.c | 52 +++++++++++++++++++++++++++++++--- + drivers/hv/mshv_root_main.c | 3 ++ + 2 files changed, 51 insertions(+), 4 deletions(-) + +diff --git a/drivers/hv/mshv_root_hv_call.c b/drivers/hv/mshv_root_hv_call.c +index 598eaff4ff299..1f93b94d7580c 100644 +--- a/drivers/hv/mshv_root_hv_call.c ++++ b/drivers/hv/mshv_root_hv_call.c +@@ -813,6 +813,13 @@ hv_call_notify_port_ring_empty(u32 sint_index) + return hv_result_to_errno(status); + } + ++/* ++ * Equivalent of hv_call_map_stats_page() for cases when the caller provides ++ * the map location. ++ * ++ * NOTE: This is a newer hypercall that always supports SELF and PARENT stats ++ * areas, unlike hv_call_map_stats_page(). ++ */ + static int hv_call_map_stats_page2(enum hv_stats_object_type type, + const union hv_stats_object_identity *identity, + u64 map_location) +@@ -855,6 +862,34 @@ static int hv_call_map_stats_page2(enum hv_stats_object_type type, + return ret; + } + ++static int ++hv_stats_get_area_type(enum hv_stats_object_type type, ++ const union hv_stats_object_identity *identity) ++{ ++ switch (type) { ++ case HV_STATS_OBJECT_HYPERVISOR: ++ return identity->hv.stats_area_type; ++ case HV_STATS_OBJECT_LOGICAL_PROCESSOR: ++ return identity->lp.stats_area_type; ++ case HV_STATS_OBJECT_PARTITION: ++ return identity->partition.stats_area_type; ++ case HV_STATS_OBJECT_VP: ++ return identity->vp.stats_area_type; ++ } ++ ++ return -EINVAL; ++} ++ ++/* ++ * Map a stats page, where the page location is provided by the hypervisor. ++ * ++ * NOTE: The concept of separate SELF and PARENT stats areas does not exist on ++ * older hypervisor versions. All the available stats information can be found ++ * on the SELF page. When attempting to map the PARENT area on a hypervisor ++ * that doesn't support it, return "success" but with a NULL address. The ++ * caller should check for this case and instead fallback to the SELF area ++ * alone. ++ */ + static int hv_call_map_stats_page(enum hv_stats_object_type type, + const union hv_stats_object_identity *identity, + void **addr) +@@ -863,7 +898,7 @@ static int hv_call_map_stats_page(enum hv_stats_object_type type, + struct hv_input_map_stats_page *input; + struct hv_output_map_stats_page *output; + u64 status, pfn; +- int ret = 0; ++ int hv_status, ret = 0; + + do { + local_irq_save(flags); +@@ -878,11 +913,20 @@ static int hv_call_map_stats_page(enum hv_stats_object_type type, + pfn = output->map_location; + + local_irq_restore(flags); +- if (hv_result(status) != HV_STATUS_INSUFFICIENT_MEMORY) { +- ret = hv_result_to_errno(status); ++ ++ hv_status = hv_result(status); ++ if (hv_status != HV_STATUS_INSUFFICIENT_MEMORY) { + if (hv_result_success(status)) + break; +- return ret; ++ ++ if (hv_stats_get_area_type(type, identity) == HV_STATS_AREA_PARENT && ++ hv_status == HV_STATUS_INVALID_PARAMETER) { ++ *addr = NULL; ++ return 0; ++ } ++ ++ hv_status_debug(status, "\n"); ++ return hv_result_to_errno(status); + } + + ret = hv_call_deposit_pages(NUMA_NO_NODE, +diff --git a/drivers/hv/mshv_root_main.c b/drivers/hv/mshv_root_main.c +index 681b58154d5ea..d3e8a66443ad6 100644 +--- a/drivers/hv/mshv_root_main.c ++++ b/drivers/hv/mshv_root_main.c +@@ -993,6 +993,9 @@ static int mshv_vp_stats_map(u64 partition_id, u32 vp_index, + if (err) + goto unmap_self; + ++ if (!stats_pages[HV_STATS_AREA_PARENT]) ++ stats_pages[HV_STATS_AREA_PARENT] = stats_pages[HV_STATS_AREA_SELF]; ++ + return 0; + + unmap_self: +-- +2.51.0 + diff --git a/queue-6.19/myri10ge-avoid-uninitialized-variable-use.patch b/queue-6.19/myri10ge-avoid-uninitialized-variable-use.patch new file mode 100644 index 00000000000..9d1588e120c --- /dev/null +++ b/queue-6.19/myri10ge-avoid-uninitialized-variable-use.patch @@ -0,0 +1,162 @@ +From 46ccb91803cd693dc1475b14a391f9b286fdb650 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Feb 2026 17:28:09 +0100 +Subject: myri10ge: avoid uninitialized variable use + +From: Arnd Bergmann + +[ Upstream commit fd24173439c033ffb3c2a2628fcbc9cb65e62bdb ] + +While compile testing on less common architectures, I noticed that gcc-10 on +s390 finds a bug that all other configurations seem to miss: + +drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_set_multicast_list': +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:391:25: error: 'cmd.data0' is used uninitialized in this function [-Werror=uninitialized] + 391 | buf->data0 = htonl(data->data0); + | ^~ +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:25: error: '*((void *)&cmd+4)' is used uninitialized in this function [-Werror=uninitialized] + 392 | buf->data1 = htonl(data->data1); + | ^~ +drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_allocate_rings': +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:13: error: 'cmd.data1' is used uninitialized in this function [-Werror=uninitialized] + 392 | buf->data1 = htonl(data->data1); +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data1' was declared here + 1939 | struct myri10ge_cmd cmd; + | ^~~ +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:393:13: error: 'cmd.data2' is used uninitialized in this function [-Werror=uninitialized] + 393 | buf->data2 = htonl(data->data2); +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data2' was declared here + 1939 | struct myri10ge_cmd cmd; + +It would be nice to understand how to make other compilers catch this as +well, but for the moment I'll just shut up the warning by fixing the +undefined behavior in this driver. + +Signed-off-by: Arnd Bergmann +Link: https://patch.msgid.link/20260205162935.2126442-1-arnd@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/myricom/myri10ge/myri10ge.c | 28 ++++++++++++++++++- + 1 file changed, 27 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c +index 7be30a8df2685..2f0cdbd4e2ac9 100644 +--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c ++++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c +@@ -688,6 +688,9 @@ static int myri10ge_get_firmware_capabilities(struct myri10ge_priv *mgp) + + /* probe for IPv6 TSO support */ + mgp->features = NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_TSO; ++ cmd.data0 = 0, ++ cmd.data1 = 0, ++ cmd.data2 = 0, + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_MAX_TSO6_HDR_SIZE, + &cmd, 0); + if (status == 0) { +@@ -806,6 +809,7 @@ static int myri10ge_update_mac_address(struct myri10ge_priv *mgp, + | (addr[2] << 8) | addr[3]); + + cmd.data1 = ((addr[4] << 8) | (addr[5])); ++ cmd.data2 = 0; + + status = myri10ge_send_cmd(mgp, MXGEFW_SET_MAC_ADDRESS, &cmd, 0); + return status; +@@ -817,6 +821,9 @@ static int myri10ge_change_pause(struct myri10ge_priv *mgp, int pause) + int status, ctl; + + ctl = pause ? MXGEFW_ENABLE_FLOW_CONTROL : MXGEFW_DISABLE_FLOW_CONTROL; ++ cmd.data0 = 0, ++ cmd.data1 = 0, ++ cmd.data2 = 0, + status = myri10ge_send_cmd(mgp, ctl, &cmd, 0); + + if (status) { +@@ -834,6 +841,9 @@ myri10ge_change_promisc(struct myri10ge_priv *mgp, int promisc, int atomic) + int status, ctl; + + ctl = promisc ? MXGEFW_ENABLE_PROMISC : MXGEFW_DISABLE_PROMISC; ++ cmd.data0 = 0; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, ctl, &cmd, atomic); + if (status) + netdev_err(mgp->dev, "Failed to set promisc mode\n"); +@@ -1946,6 +1956,8 @@ static int myri10ge_allocate_rings(struct myri10ge_slice_state *ss) + /* get ring sizes */ + slice = ss - mgp->ss; + cmd.data0 = slice; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_RING_SIZE, &cmd, 0); + tx_ring_size = cmd.data0; + cmd.data0 = slice; +@@ -2238,12 +2250,16 @@ static int myri10ge_get_txrx(struct myri10ge_priv *mgp, int slice) + status = 0; + if (slice == 0 || (mgp->dev->real_num_tx_queues > 1)) { + cmd.data0 = slice; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_OFFSET, + &cmd, 0); + ss->tx.lanai = (struct mcp_kreq_ether_send __iomem *) + (mgp->sram + cmd.data0); + } + cmd.data0 = slice; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status |= myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SMALL_RX_OFFSET, + &cmd, 0); + ss->rx_small.lanai = (struct mcp_kreq_ether_recv __iomem *) +@@ -2312,6 +2328,7 @@ static int myri10ge_open(struct net_device *dev) + if (mgp->num_slices > 1) { + cmd.data0 = mgp->num_slices; + cmd.data1 = MXGEFW_SLICE_INTR_MODE_ONE_PER_SLICE; ++ cmd.data2 = 0; + if (mgp->dev->real_num_tx_queues > 1) + cmd.data1 |= MXGEFW_SLICE_ENABLE_MULTIPLE_TX_QUEUES; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_ENABLE_RSS_QUEUES, +@@ -2414,6 +2431,8 @@ static int myri10ge_open(struct net_device *dev) + + /* now give firmware buffers sizes, and MTU */ + cmd.data0 = dev->mtu + ETH_HLEN + VLAN_HLEN; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_SET_MTU, &cmd, 0); + cmd.data0 = mgp->small_bytes; + status |= +@@ -2472,7 +2491,6 @@ static int myri10ge_open(struct net_device *dev) + static int myri10ge_close(struct net_device *dev) + { + struct myri10ge_priv *mgp = netdev_priv(dev); +- struct myri10ge_cmd cmd; + int status, old_down_cnt; + int i; + +@@ -2491,8 +2509,13 @@ static int myri10ge_close(struct net_device *dev) + + netif_tx_stop_all_queues(dev); + if (mgp->rebooted == 0) { ++ struct myri10ge_cmd cmd; ++ + old_down_cnt = mgp->down_cnt; + mb(); ++ cmd.data0 = 0; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = + myri10ge_send_cmd(mgp, MXGEFW_CMD_ETHERNET_DOWN, &cmd, 0); + if (status) +@@ -2956,6 +2979,9 @@ static void myri10ge_set_multicast_list(struct net_device *dev) + + /* Disable multicast filtering */ + ++ cmd.data0 = 0; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + err = myri10ge_send_cmd(mgp, MXGEFW_ENABLE_ALLMULTI, &cmd, 1); + if (err != 0) { + netdev_err(dev, "Failed MXGEFW_ENABLE_ALLMULTI, error status: %d\n", +-- +2.51.0 + diff --git a/queue-6.19/net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch b/queue-6.19/net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch new file mode 100644 index 00000000000..7fd9c2f4da0 --- /dev/null +++ b/queue-6.19/net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch @@ -0,0 +1,70 @@ +From 6126cf78f7a23d3228a2332b9979e1ad750f117b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 17:47:55 +0800 +Subject: net: hns3: extend HCLGE_FD_AD_QID to 11 bits + +From: Jijie Shao + +[ Upstream commit 878406d4d6ef85c37fab52074771cc916e532c16 ] + +Currently, HCLGE_FD_AD_QID has only 10 bits and supports a +maximum of 1023 queues. However, there are actually scenarios +where the queue_id exceeds 1023. + +This patch adds an additional bit to HCLGE_FD_AD_QID to ensure +that queue_id greater than 1023 are supported. + +Signed-off-by: Jijie Shao +Link: https://patch.msgid.link/20260123094756.3718516-2-shaojijie@huawei.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 5 +++-- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 +++- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +index 416e02e7b995f..bc333d8710ac1 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +@@ -727,8 +727,8 @@ struct hclge_fd_tcam_config_3_cmd { + + #define HCLGE_FD_AD_DROP_B 0 + #define HCLGE_FD_AD_DIRECT_QID_B 1 +-#define HCLGE_FD_AD_QID_S 2 +-#define HCLGE_FD_AD_QID_M GENMASK(11, 2) ++#define HCLGE_FD_AD_QID_L_S 2 ++#define HCLGE_FD_AD_QID_L_M GENMASK(11, 2) + #define HCLGE_FD_AD_USE_COUNTER_B 12 + #define HCLGE_FD_AD_COUNTER_NUM_S 13 + #define HCLGE_FD_AD_COUNTER_NUM_M GENMASK(19, 13) +@@ -741,6 +741,7 @@ struct hclge_fd_tcam_config_3_cmd { + #define HCLGE_FD_AD_TC_OVRD_B 16 + #define HCLGE_FD_AD_TC_SIZE_S 17 + #define HCLGE_FD_AD_TC_SIZE_M GENMASK(20, 17) ++#define HCLGE_FD_AD_QID_H_B 21 + + struct hclge_fd_ad_config_cmd { + u8 stage; +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index b8e2aa19f9e61..a90f1a91f9973 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -5679,11 +5679,13 @@ static int hclge_fd_ad_config(struct hclge_dev *hdev, u8 stage, int loc, + hnae3_set_field(ad_data, HCLGE_FD_AD_TC_SIZE_M, + HCLGE_FD_AD_TC_SIZE_S, (u32)action->tc_size); + } ++ hnae3_set_bit(ad_data, HCLGE_FD_AD_QID_H_B, ++ action->queue_id >= HCLGE_TQP_MAX_SIZE_DEV_V2 ? 1 : 0); + ad_data <<= 32; + hnae3_set_bit(ad_data, HCLGE_FD_AD_DROP_B, action->drop_packet); + hnae3_set_bit(ad_data, HCLGE_FD_AD_DIRECT_QID_B, + action->forward_to_direct_queue); +- hnae3_set_field(ad_data, HCLGE_FD_AD_QID_M, HCLGE_FD_AD_QID_S, ++ hnae3_set_field(ad_data, HCLGE_FD_AD_QID_L_M, HCLGE_FD_AD_QID_L_S, + action->queue_id); + hnae3_set_bit(ad_data, HCLGE_FD_AD_USE_COUNTER_B, action->use_counter); + hnae3_set_field(ad_data, HCLGE_FD_AD_COUNTER_NUM_M, +-- +2.51.0 + diff --git a/queue-6.19/net-rds-clear-reconnect-pending-bit.patch b/queue-6.19/net-rds-clear-reconnect-pending-bit.patch new file mode 100644 index 00000000000..8dbbe50f17f --- /dev/null +++ b/queue-6.19/net-rds-clear-reconnect-pending-bit.patch @@ -0,0 +1,42 @@ +From 1354595f3470cdc86ee9dae1ae43a7e65823f760 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 22:57:20 -0700 +Subject: net/rds: Clear reconnect pending bit +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: HÃ¥kon Bugge + +[ Upstream commit b89fc7c2523b2b0750d91840f4e52521270d70ed ] + +When canceling the reconnect worker, care must be taken to reset the +reconnect-pending bit. If the reconnect worker has not yet been +scheduled before it is canceled, the reconnect-pending bit will stay +on forever. + +Signed-off-by: HÃ¥kon Bugge +Signed-off-by: Allison Henderson +Link: https://patch.msgid.link/20260203055723.1085751-6-achender@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/rds/connection.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/rds/connection.c b/net/rds/connection.c +index ad8027e6f54ef..dbfea6fa11260 100644 +--- a/net/rds/connection.c ++++ b/net/rds/connection.c +@@ -429,6 +429,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp) + * to the conn hash, so we never trigger a reconnect on this + * conn - the reconnect is always triggered by the active peer. */ + cancel_delayed_work_sync(&cp->cp_conn_w); ++ ++ clear_bit(RDS_RECONNECT_PENDING, &cp->cp_flags); + rcu_read_lock(); + if (!hlist_unhashed(&conn->c_hash_node)) { + rcu_read_unlock(); +-- +2.51.0 + diff --git a/queue-6.19/net-rds-no-shortcut-out-of-rds_conn_error.patch b/queue-6.19/net-rds-no-shortcut-out-of-rds_conn_error.patch new file mode 100644 index 00000000000..c1b8dbc8e03 --- /dev/null +++ b/queue-6.19/net-rds-no-shortcut-out-of-rds_conn_error.patch @@ -0,0 +1,92 @@ +From f05f6f34f746136faf2d3c8a688db936fa18796f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jan 2026 22:52:12 -0700 +Subject: net/rds: No shortcut out of RDS_CONN_ERROR + +From: Gerd Rausch + +[ Upstream commit ad22d24be635c6beab6a1fdd3f8b1f3c478d15da ] + +RDS connections carry a state "rds_conn_path::cp_state" +and transitions from one state to another and are conditional +upon an expected state: "rds_conn_path_transition." + +There is one exception to this conditionality, which is +"RDS_CONN_ERROR" that can be enforced by "rds_conn_path_drop" +regardless of what state the condition is currently in. + +But as soon as a connection enters state "RDS_CONN_ERROR", +the connection handling code expects it to go through the +shutdown-path. + +The RDS/TCP multipath changes added a shortcut out of +"RDS_CONN_ERROR" straight back to "RDS_CONN_CONNECTING" +via "rds_tcp_accept_one_path" (e.g. after "rds_tcp_state_change"). + +A subsequent "rds_tcp_reset_callbacks" can then transition +the state to "RDS_CONN_RESETTING" with a shutdown-worker queued. + +That'll trip up "rds_conn_init_shutdown", which was +never adjusted to handle "RDS_CONN_RESETTING" and subsequently +drops the connection with the dreaded "DR_INV_CONN_STATE", +which leaves "RDS_SHUTDOWN_WORK_QUEUED" on forever. + +So we do two things here: + +a) Don't shortcut "RDS_CONN_ERROR", but take the longer + path through the shutdown code. + +b) Add "RDS_CONN_RESETTING" to the expected states in + "rds_conn_init_shutdown" so that we won't error out + and get stuck, if we ever hit weird state transitions + like this again." + +Signed-off-by: Gerd Rausch +Signed-off-by: Allison Henderson +Link: https://patch.msgid.link/20260122055213.83608-2-achender@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/rds/connection.c | 2 ++ + net/rds/tcp_listen.c | 5 ----- + 2 files changed, 2 insertions(+), 5 deletions(-) + +diff --git a/net/rds/connection.c b/net/rds/connection.c +index 68bc88cce84ec..ad8027e6f54ef 100644 +--- a/net/rds/connection.c ++++ b/net/rds/connection.c +@@ -382,6 +382,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp) + if (!rds_conn_path_transition(cp, RDS_CONN_UP, + RDS_CONN_DISCONNECTING) && + !rds_conn_path_transition(cp, RDS_CONN_ERROR, ++ RDS_CONN_DISCONNECTING) && ++ !rds_conn_path_transition(cp, RDS_CONN_RESETTING, + RDS_CONN_DISCONNECTING)) { + rds_conn_path_error(cp, + "shutdown called in state %d\n", +diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c +index 820d3e20de195..27b6107ddc28d 100644 +--- a/net/rds/tcp_listen.c ++++ b/net/rds/tcp_listen.c +@@ -59,9 +59,6 @@ void rds_tcp_keepalive(struct socket *sock) + * socket and force a reconneect from smaller -> larger ip addr. The reason + * we special case cp_index 0 is to allow the rds probe ping itself to itself + * get through efficiently. +- * Since reconnects are only initiated from the node with the numerically +- * smaller ip address, we recycle conns in RDS_CONN_ERROR on the passive side +- * by moving them to CONNECTING in this function. + */ + static + struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn) +@@ -86,8 +83,6 @@ struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn) + struct rds_conn_path *cp = &conn->c_path[i]; + + if (rds_conn_path_transition(cp, RDS_CONN_DOWN, +- RDS_CONN_CONNECTING) || +- rds_conn_path_transition(cp, RDS_CONN_ERROR, + RDS_CONN_CONNECTING)) { + return cp->cp_transport_data; + } +-- +2.51.0 + diff --git a/queue-6.19/net-sfp-add-quirk-for-lantech-8330-265d.patch b/queue-6.19/net-sfp-add-quirk-for-lantech-8330-265d.patch new file mode 100644 index 00000000000..0f6103e9c98 --- /dev/null +++ b/queue-6.19/net-sfp-add-quirk-for-lantech-8330-265d.patch @@ -0,0 +1,49 @@ +From 23bd4c7b9466ed40b0578d497f3e4670f956a727 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 18:00:44 +0100 +Subject: net: sfp: add quirk for Lantech 8330-265D +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit 86a8e8e0ddbc3d14c799536eb888180b84d002f3 ] + +Similar to Lantech 8330-262D-E, the Lantech 8330-265D also reports +2500MBd instead of 3125MBd. + +Also, all 8330-265D report normal RX_LOS in EEPROM, but some signal +inverted RX_LOS. We therefore need to ignore RX_LOS on these modules. + +Signed-off-by: Marek Behún +Link: https://patch.msgid.link/20260128170044.15576-1-kabel@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/sfp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c +index 3e023723887c4..43aefdd8b70f7 100644 +--- a/drivers/net/phy/sfp.c ++++ b/drivers/net/phy/sfp.c +@@ -532,9 +532,13 @@ static const struct sfp_quirk sfp_quirks[] = { + SFP_QUIRK("HUAWEI", "MA5671A", sfp_quirk_2500basex, + sfp_fixup_ignore_tx_fault), + +- // Lantech 8330-262D-E can operate at 2500base-X, but incorrectly report +- // 2500MBd NRZ in their EEPROM ++ // Lantech 8330-262D-E and 8330-265D can operate at 2500base-X, but ++ // incorrectly report 2500MBd NRZ in their EEPROM. ++ // Some 8330-265D modules have inverted LOS, while all of them report ++ // normal LOS in EEPROM. Therefore we need to ignore LOS entirely. + SFP_QUIRK_S("Lantech", "8330-262D-E", sfp_quirk_2500basex), ++ SFP_QUIRK("Lantech", "8330-265D", sfp_quirk_2500basex, ++ sfp_fixup_ignore_los), + + SFP_QUIRK_S("UBNT", "UF-INSTANT", sfp_quirk_ubnt_uf_instant), + +-- +2.51.0 + diff --git a/queue-6.19/net-usb-r8152-fix-transmit-queue-timeout.patch b/queue-6.19/net-usb-r8152-fix-transmit-queue-timeout.patch new file mode 100644 index 00000000000..93183258980 --- /dev/null +++ b/queue-6.19/net-usb-r8152-fix-transmit-queue-timeout.patch @@ -0,0 +1,42 @@ +From 4cae521df6e04f0eca5ac73bff880022d27fde76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 09:59:49 +0800 +Subject: net: usb: r8152: fix transmit queue timeout + +From: Mingj Ye + +[ Upstream commit 833dcd75d54f0bf5aa0a0781ff57456b421fbb40 ] + +When the TX queue length reaches the threshold, the netdev watchdog +immediately detects a TX queue timeout. + +This patch updates the trans_start timestamp of the transmit queue +on every asynchronous USB URB submission along the transmit path, +ensuring that the network watchdog accurately reflects ongoing +transmission activity. + +Signed-off-by: Mingj Ye +Reviewed-by: Hayes Wang +Link: https://patch.msgid.link/20260120015949.84996-1-insyelu@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 2f3baa5f6e9c9..6b107cf5f37bd 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -2449,6 +2449,8 @@ static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg) + ret = usb_submit_urb(agg->urb, GFP_ATOMIC); + if (ret < 0) + usb_autopm_put_interface_async(tp->intf); ++ else ++ netif_trans_update(tp->netdev); + + out_tx_fill: + return ret; +-- +2.51.0 + diff --git a/queue-6.19/net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch b/queue-6.19/net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch new file mode 100644 index 00000000000..69dbb09a4ac --- /dev/null +++ b/queue-6.19/net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch @@ -0,0 +1,117 @@ +From 52c6717ca6c13e991c1dc633958db5a33ed4ab0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 17:39:09 -0800 +Subject: net: usb: sr9700: remove code to drive nonexistent multicast filter + +From: Ethan Nelson-Moore + +[ Upstream commit 9a9424c756feee9ee6e717405a9d6fa7bacdef08 ] + +Several registers referenced in this driver's source code do not +actually exist (they are not writable and read as zero in my testing). +They exist in this driver because it originated as a copy of the dm9601 +driver. Notably, these include the multicast filter registers - this +causes the driver to not support multicast packets correctly. Remove +the multicast filter code and register definitions. Instead, set the +chip to receive all multicast filter packets when any multicast +addresses are in the list. + +Reviewed-by: Simon Horman (from v1) +Signed-off-by: Ethan Nelson-Moore +Link: https://patch.msgid.link/20260203013924.28582-1-enelsonmoore@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/Kconfig | 1 - + drivers/net/usb/sr9700.c | 25 ++++--------------------- + drivers/net/usb/sr9700.h | 7 +------ + 3 files changed, 5 insertions(+), 28 deletions(-) + +diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig +index 856e648d804e0..da0f6a138f4fc 100644 +--- a/drivers/net/usb/Kconfig ++++ b/drivers/net/usb/Kconfig +@@ -319,7 +319,6 @@ config USB_NET_DM9601 + config USB_NET_SR9700 + tristate "CoreChip-sz SR9700 based USB 1.1 10/100 ethernet devices" + depends on USB_USBNET +- select CRC32 + help + This option adds support for CoreChip-sz SR9700 based USB 1.1 + 10/100 Ethernet adapters. +diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c +index 820c4c5069792..a5d364fbc3639 100644 +--- a/drivers/net/usb/sr9700.c ++++ b/drivers/net/usb/sr9700.c +@@ -18,7 +18,6 @@ + #include + #include + #include +-#include + #include + + #include "sr9700.h" +@@ -265,31 +264,15 @@ static const struct ethtool_ops sr9700_ethtool_ops = { + static void sr9700_set_multicast(struct net_device *netdev) + { + struct usbnet *dev = netdev_priv(netdev); +- /* We use the 20 byte dev->data for our 8 byte filter buffer +- * to avoid allocating memory that is tricky to free later +- */ +- u8 *hashes = (u8 *)&dev->data; + /* rx_ctl setting : enable, disable_long, disable_crc */ + u8 rx_ctl = RCR_RXEN | RCR_DIS_CRC | RCR_DIS_LONG; + +- memset(hashes, 0x00, SR_MCAST_SIZE); +- /* broadcast address */ +- hashes[SR_MCAST_SIZE - 1] |= SR_MCAST_ADDR_FLAG; +- if (netdev->flags & IFF_PROMISC) { ++ if (netdev->flags & IFF_PROMISC) + rx_ctl |= RCR_PRMSC; +- } else if (netdev->flags & IFF_ALLMULTI || +- netdev_mc_count(netdev) > SR_MCAST_MAX) { +- rx_ctl |= RCR_RUNT; +- } else if (!netdev_mc_empty(netdev)) { +- struct netdev_hw_addr *ha; +- +- netdev_for_each_mc_addr(ha, netdev) { +- u32 crc = ether_crc(ETH_ALEN, ha->addr) >> 26; +- hashes[crc >> 3] |= 1 << (crc & 0x7); +- } +- } ++ else if (netdev->flags & IFF_ALLMULTI || !netdev_mc_empty(netdev)) ++ /* The chip has no multicast filter */ ++ rx_ctl |= RCR_ALL; + +- sr_write_async(dev, SR_MAR, SR_MCAST_SIZE, hashes); + sr_write_reg_async(dev, SR_RCR, rx_ctl); + } + +diff --git a/drivers/net/usb/sr9700.h b/drivers/net/usb/sr9700.h +index ea2b4de621c86..c479908f7d823 100644 +--- a/drivers/net/usb/sr9700.h ++++ b/drivers/net/usb/sr9700.h +@@ -104,9 +104,7 @@ + #define WCR_LINKEN (1 << 5) + /* Physical Address Reg */ + #define SR_PAR 0x10 /* 0x10 ~ 0x15 6 bytes for PAR */ +-/* Multicast Address Reg */ +-#define SR_MAR 0x16 /* 0x16 ~ 0x1D 8 bytes for MAR */ +-/* 0x1e unused */ ++/* 0x16 --> 0x1E unused */ + /* Phy Reset Reg */ + #define SR_PRR 0x1F + #define PRR_PHY_RST (1 << 0) +@@ -161,9 +159,6 @@ + /* parameters */ + #define SR_SHARE_TIMEOUT 1000 + #define SR_EEPROM_LEN 256 +-#define SR_MCAST_SIZE 8 +-#define SR_MCAST_ADDR_FLAG 0x80 +-#define SR_MCAST_MAX 64 + #define SR_TX_OVERHEAD 2 /* 2bytes header */ + #define SR_RX_OVERHEAD 7 /* 3bytes header + 4crc tail */ + +-- +2.51.0 + diff --git a/queue-6.19/net-wwan-mhi-add-network-support-for-foxconn-t99w760.patch b/queue-6.19/net-wwan-mhi-add-network-support-for-foxconn-t99w760.patch new file mode 100644 index 00000000000..1b1144d36d4 --- /dev/null +++ b/queue-6.19/net-wwan-mhi-add-network-support-for-foxconn-t99w760.patch @@ -0,0 +1,38 @@ +From ef6e58b59374835e87f92b3d8f5595281ca54b0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 10:26:46 +0800 +Subject: net: wwan: mhi: Add network support for Foxconn T99W760 + +From: Slark Xiao + +[ Upstream commit 915a5f60ad947e8dd515d2cc77a96a14dffb3f15 ] + +T99W760 is designed based on Qualcomm SDX35 chip. It use similar +architecture with SDX72/SDX75 chip. So we need to assign initial +link id for this device to make sure network available. + +Signed-off-by: Slark Xiao +Link: https://patch.msgid.link/20260105022646.10630-1-slark_xiao@163.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/wwan/mhi_wwan_mbim.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wwan/mhi_wwan_mbim.c b/drivers/net/wwan/mhi_wwan_mbim.c +index f8bc9a39bfa30..1d7e3ad900c12 100644 +--- a/drivers/net/wwan/mhi_wwan_mbim.c ++++ b/drivers/net/wwan/mhi_wwan_mbim.c +@@ -98,7 +98,8 @@ static struct mhi_mbim_link *mhi_mbim_get_link_rcu(struct mhi_mbim_context *mbim + static int mhi_mbim_get_link_mux_id(struct mhi_controller *cntrl) + { + if (strcmp(cntrl->name, "foxconn-dw5934e") == 0 || +- strcmp(cntrl->name, "foxconn-t99w640") == 0) ++ strcmp(cntrl->name, "foxconn-t99w640") == 0 || ++ strcmp(cntrl->name, "foxconn-t99w760") == 0) + return WDS_BIND_MUX_DATA_PORT_MUX_ID; + + return 0; +-- +2.51.0 + diff --git a/queue-6.19/netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch b/queue-6.19/netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch new file mode 100644 index 00000000000..c0712763bb6 --- /dev/null +++ b/queue-6.19/netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch @@ -0,0 +1,41 @@ +From dd94ce2a5f1929c15740a6e39d6c57204a6f7c4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Dec 2025 20:53:51 +0900 +Subject: netfilter: nf_conntrack: Add allow_clash to generic protocol handler + +From: Yuto Hamaguchi + +[ Upstream commit 8a49fc8d8a3e83dc51ec05bcd4007bdea3c56eec ] + +The upstream commit, 71d8c47fc653711c41bc3282e5b0e605b3727956 + ("netfilter: conntrack: introduce clash resolution on insertion race"), +sets allow_clash=true in the UDP/UDPLITE protocol handler +but does not set it in the generic protocol handler. + +As a result, packets composed of connectionless protocols at each layer, +such as UDP over IP-in-IP, still drop packets due to conflicts during conntrack insertion. + +To resolve this, this patch sets allow_clash in the nf_conntrack_l4proto_generic. + +Signed-off-by: Yuto Hamaguchi +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_proto_generic.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c +index e831637bc8ca8..cb260eb3d012c 100644 +--- a/net/netfilter/nf_conntrack_proto_generic.c ++++ b/net/netfilter/nf_conntrack_proto_generic.c +@@ -67,6 +67,7 @@ void nf_conntrack_generic_init_net(struct net *net) + const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic = + { + .l4proto = 255, ++ .allow_clash = true, + #ifdef CONFIG_NF_CONNTRACK_TIMEOUT + .ctnl_timeout = { + .nlattr_to_obj = generic_timeout_nlattr_to_obj, +-- +2.51.0 + diff --git a/queue-6.19/netfilter-xt_tcpmss-check-remaining-length-before-re.patch b/queue-6.19/netfilter-xt_tcpmss-check-remaining-length-before-re.patch new file mode 100644 index 00000000000..a2687a06581 --- /dev/null +++ b/queue-6.19/netfilter-xt_tcpmss-check-remaining-length-before-re.patch @@ -0,0 +1,42 @@ +From 619f2f0817c4bae11727fdcc08fe766c1a2aa50d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 12:30:42 +0100 +Subject: netfilter: xt_tcpmss: check remaining length before reading optlen + +From: Florian Westphal + +[ Upstream commit 735ee8582da3d239eb0c7a53adca61b79fb228b3 ] + +Quoting reporter: + In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads + op[i+1] directly without validating the remaining option length. + + If the last byte of the option field is not EOL/NOP (0/1), the code attempts + to index op[i+1]. In the case where i + 1 == optlen, this causes an + out-of-bounds read, accessing memory past the optlen boundary + (either reading beyond the stack buffer _opt or the + following payload). + +Reported-by: sungzii +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/xt_tcpmss.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c +index 37704ab017992..0d32d4841cb32 100644 +--- a/net/netfilter/xt_tcpmss.c ++++ b/net/netfilter/xt_tcpmss.c +@@ -61,7 +61,7 @@ tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par) + return (mssval >= info->mss_min && + mssval <= info->mss_max) ^ info->invert; + } +- if (op[i] < 2) ++ if (op[i] < 2 || i == optlen - 1) + i++; + else + i += op[i+1] ? : 1; +-- +2.51.0 + diff --git a/queue-6.19/netfs-when-subreq-is-marked-for-retry-do-not-check-i.patch b/queue-6.19/netfs-when-subreq-is-marked-for-retry-do-not-check-i.patch new file mode 100644 index 00000000000..57e518045bb --- /dev/null +++ b/queue-6.19/netfs-when-subreq-is-marked-for-retry-do-not-check-i.patch @@ -0,0 +1,114 @@ +From 87065ca63c7c9f198e50bd0c888a8ed73c8ef4a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Jan 2026 14:03:04 +0530 +Subject: netfs: when subreq is marked for retry, do not check if it faced an + error + +From: Shyam Prasad N + +[ Upstream commit 82e8885bd7633a36ee9050e6d7f348a4155eed5f ] + +The *_subreq_terminated functions today only process the NEED_RETRY +flag when the subreq was successful or failed with EAGAIN error. +However, there could be other retriable errors for network filesystems. + +Avoid this by processing the NEED_RETRY irrespective of the error +code faced by the subreq. If it was specifically marked for retry, +the error code must not matter. + +Acked-by: David Howells +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/netfs/read_collect.c | 10 ++++++++++ + fs/netfs/read_retry.c | 4 ++-- + fs/netfs/write_collect.c | 8 ++++---- + fs/netfs/write_issue.c | 1 + + 4 files changed, 17 insertions(+), 6 deletions(-) + +diff --git a/fs/netfs/read_collect.c b/fs/netfs/read_collect.c +index 7a0ffa675fb17..137f0e28a44c5 100644 +--- a/fs/netfs/read_collect.c ++++ b/fs/netfs/read_collect.c +@@ -546,6 +546,15 @@ void netfs_read_subreq_terminated(struct netfs_io_subrequest *subreq) + } + } + ++ /* If need retry is set, error should not matter unless we hit too many ++ * retries. Pause the generation of new subreqs ++ */ ++ if (test_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags)) { ++ trace_netfs_rreq(rreq, netfs_rreq_trace_set_pause); ++ set_bit(NETFS_RREQ_PAUSE, &rreq->flags); ++ goto skip_error_checks; ++ } ++ + if (unlikely(subreq->error < 0)) { + trace_netfs_failure(rreq, subreq, subreq->error, netfs_fail_read); + if (subreq->source == NETFS_READ_FROM_CACHE) { +@@ -559,6 +568,7 @@ void netfs_read_subreq_terminated(struct netfs_io_subrequest *subreq) + set_bit(NETFS_RREQ_PAUSE, &rreq->flags); + } + ++skip_error_checks: + trace_netfs_sreq(subreq, netfs_sreq_trace_terminated); + netfs_subreq_clear_in_progress(subreq); + netfs_put_subrequest(subreq, netfs_sreq_trace_put_terminated); +diff --git a/fs/netfs/read_retry.c b/fs/netfs/read_retry.c +index b99e84a8170af..7793ba5e3e8fc 100644 +--- a/fs/netfs/read_retry.c ++++ b/fs/netfs/read_retry.c +@@ -12,6 +12,7 @@ + static void netfs_reissue_read(struct netfs_io_request *rreq, + struct netfs_io_subrequest *subreq) + { ++ subreq->error = 0; + __clear_bit(NETFS_SREQ_MADE_PROGRESS, &subreq->flags); + __set_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags); + netfs_stat(&netfs_n_rh_retry_read_subreq); +@@ -242,8 +243,7 @@ static void netfs_retry_read_subrequests(struct netfs_io_request *rreq) + subreq = list_next_entry(subreq, rreq_link); + abandon: + list_for_each_entry_from(subreq, &stream->subrequests, rreq_link) { +- if (!subreq->error && +- !test_bit(NETFS_SREQ_FAILED, &subreq->flags) && ++ if (!test_bit(NETFS_SREQ_FAILED, &subreq->flags) && + !test_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags)) + continue; + subreq->error = -ENOMEM; +diff --git a/fs/netfs/write_collect.c b/fs/netfs/write_collect.c +index cbf3d9194c7bf..61eab34ea67ef 100644 +--- a/fs/netfs/write_collect.c ++++ b/fs/netfs/write_collect.c +@@ -492,11 +492,11 @@ void netfs_write_subrequest_terminated(void *_op, ssize_t transferred_or_error) + + if (IS_ERR_VALUE(transferred_or_error)) { + subreq->error = transferred_or_error; +- if (subreq->error == -EAGAIN) +- set_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags); +- else ++ /* if need retry is set, error should not matter */ ++ if (!test_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags)) { + set_bit(NETFS_SREQ_FAILED, &subreq->flags); +- trace_netfs_failure(wreq, subreq, transferred_or_error, netfs_fail_write); ++ trace_netfs_failure(wreq, subreq, transferred_or_error, netfs_fail_write); ++ } + + switch (subreq->source) { + case NETFS_WRITE_TO_CACHE: +diff --git a/fs/netfs/write_issue.c b/fs/netfs/write_issue.c +index dd8743bc8d7fe..34894da5a23ec 100644 +--- a/fs/netfs/write_issue.c ++++ b/fs/netfs/write_issue.c +@@ -250,6 +250,7 @@ void netfs_reissue_write(struct netfs_io_stream *stream, + iov_iter_truncate(&subreq->io_iter, size); + + subreq->retry_count++; ++ subreq->error = 0; + __clear_bit(NETFS_SREQ_MADE_PROGRESS, &subreq->flags); + __set_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags); + netfs_stat(&netfs_n_wh_retry_write_subreq); +-- +2.51.0 + diff --git a/queue-6.19/nfc-nxp-nci-remove-interrupt-trigger-type.patch b/queue-6.19/nfc-nxp-nci-remove-interrupt-trigger-type.patch new file mode 100644 index 00000000000..cbdb9a34a85 --- /dev/null +++ b/queue-6.19/nfc-nxp-nci-remove-interrupt-trigger-type.patch @@ -0,0 +1,42 @@ +From 1fef83601b91bf03d249befc323a42a340cb55c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Feb 2026 19:11:39 +0800 +Subject: nfc: nxp-nci: remove interrupt trigger type + +From: Carl Lee + +[ Upstream commit 57be33f85e369ce9f69f61eaa34734e0d3bd47a7 ] + +For NXP NCI devices (e.g. PN7150), the interrupt is level-triggered and +active high, not edge-triggered. + +Using IRQF_TRIGGER_RISING in the driver can cause interrupts to fail +to trigger correctly. + +Remove IRQF_TRIGGER_RISING and rely on the IRQ trigger type configured +via Device Tree. + +Signed-off-by: Carl Lee +Link: https://patch.msgid.link/20260205-fc-nxp-nci-remove-interrupt-trigger-type-v2-1-79d2ed4a7e42@amd.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/nfc/nxp-nci/i2c.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c +index 049662ffdf972..6a5ce8ff91f0b 100644 +--- a/drivers/nfc/nxp-nci/i2c.c ++++ b/drivers/nfc/nxp-nci/i2c.c +@@ -305,7 +305,7 @@ static int nxp_nci_i2c_probe(struct i2c_client *client) + + r = request_threaded_irq(client->irq, NULL, + nxp_nci_i2c_irq_thread_fn, +- IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ IRQF_ONESHOT, + NXP_NCI_I2C_DRIVER_NAME, phy); + if (r < 0) + nfc_err(&client->dev, "Unable to register IRQ handler\n"); +-- +2.51.0 + diff --git a/queue-6.19/ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch b/queue-6.19/ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch new file mode 100644 index 00000000000..67c28bb13ca --- /dev/null +++ b/queue-6.19/ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch @@ -0,0 +1,40 @@ +From 6c12a3d41754fc22d85c667c6cf8d92abdd65e4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2025 14:53:18 -0800 +Subject: ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access + +From: Maciej Grochowski + +[ Upstream commit c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface ] + +Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS, +This patch protects against invalid index out of bounds access to mw_sizes +When invalid access print message to user that configuration is not valid. + +Signed-off-by: Maciej Grochowski +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +index f851397b65d6e..f15ebab138144 100644 +--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c ++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +@@ -1314,6 +1314,12 @@ static void switchtec_ntb_init_shared(struct switchtec_ntb *sndev) + for (i = 0; i < sndev->nr_lut_mw; i++) { + int idx = sndev->nr_direct_mw + i; + ++ if (idx >= MAX_MWS) { ++ dev_err(&sndev->stdev->dev, ++ "Total number of MW cannot be bigger than %d", MAX_MWS); ++ break; ++ } ++ + sndev->self_shared->mw_sizes[idx] = LUT_SIZE; + } + } +-- +2.51.0 + diff --git a/queue-6.19/ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch b/queue-6.19/ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch new file mode 100644 index 00000000000..8c9f469d1d7 --- /dev/null +++ b/queue-6.19/ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch @@ -0,0 +1,48 @@ +From 5b9c172ba51c67eae8d2753a264b9b6bdadf9d81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2025 14:53:17 -0800 +Subject: ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut + +From: Maciej Grochowski + +[ Upstream commit 186615f8855a0be4ee7d3fcd09a8ecc10e783b08 ] + +Number of MW LUTs depends on NTB configuration and can be set to zero, +in such scenario rounddown_pow_of_two will cause undefined behaviour and +should not be performed. +This patch ensures that rounddown_pow_of_two is called on valid value. + +Signed-off-by: Maciej Grochowski +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +index f15ebab138144..0536521fa6ccc 100644 +--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c ++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +@@ -1202,7 +1202,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev) + sndev->mmio_self_ctrl); + + sndev->nr_lut_mw = ioread16(&sndev->mmio_self_ctrl->lut_table_entries); +- sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw); ++ if (sndev->nr_lut_mw) ++ sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw); + + dev_dbg(&sndev->stdev->dev, "MWs: %d direct, %d lut\n", + sndev->nr_direct_mw, sndev->nr_lut_mw); +@@ -1212,7 +1213,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev) + + sndev->peer_nr_lut_mw = + ioread16(&sndev->mmio_peer_ctrl->lut_table_entries); +- sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw); ++ if (sndev->peer_nr_lut_mw) ++ sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw); + + dev_dbg(&sndev->stdev->dev, "Peer MWs: %d direct, %d lut\n", + sndev->peer_nr_direct_mw, sndev->peer_nr_lut_mw); +-- +2.51.0 + diff --git a/queue-6.19/ntfs-d_compare-must-not-block.patch b/queue-6.19/ntfs-d_compare-must-not-block.patch new file mode 100644 index 00000000000..78fbf5b8d3f --- /dev/null +++ b/queue-6.19/ntfs-d_compare-must-not-block.patch @@ -0,0 +1,235 @@ +From d9b896abe07e51cbb2767e746b2825152c689336 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 16:15:04 -0500 +Subject: ntfs: ->d_compare() must not block + +From: Al Viro + +[ Upstream commit ca2a04e84af79596e5cd9cfe697d5122ec39c8ce ] + +... so don't use __getname() there. Switch it (and ntfs_d_hash(), while +we are at it) to kmalloc(PATH_MAX, GFP_NOWAIT). Yes, ntfs_d_hash() +almost certainly can do with smaller allocations, but let ntfs folks +deal with that - keep the allocation size as-is for now. + +Stop abusing names_cachep in ntfs, period - various uses of that thing +in there have nothing to do with pathnames; just use k[mz]alloc() and +be done with that. For now let's keep sizes as-in, but AFAICS none of +the users actually want PATH_MAX. + +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + fs/ntfs3/dir.c | 5 ++--- + fs/ntfs3/fsntfs.c | 4 ++-- + fs/ntfs3/inode.c | 13 ++++++------- + fs/ntfs3/namei.c | 17 ++++++++--------- + fs/ntfs3/xattr.c | 5 ++--- + 5 files changed, 20 insertions(+), 24 deletions(-) + +diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c +index b98e95d6b4d99..cf038d713f507 100644 +--- a/fs/ntfs3/dir.c ++++ b/fs/ntfs3/dir.c +@@ -423,8 +423,7 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx) + if (!dir_emit_dots(file, ctx)) + return 0; + +- /* Allocate PATH_MAX bytes. */ +- name = __getname(); ++ name = kmalloc(PATH_MAX, GFP_KERNEL); + if (!name) + return -ENOMEM; + +@@ -502,7 +501,7 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx) + + out: + +- __putname(name); ++ kfree(name); + put_indx_node(node); + + if (err == 1) { +diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c +index 5f138f7158357..bd67ba7b50153 100644 +--- a/fs/ntfs3/fsntfs.c ++++ b/fs/ntfs3/fsntfs.c +@@ -2627,7 +2627,7 @@ int ntfs_set_label(struct ntfs_sb_info *sbi, u8 *label, int len) + u32 uni_bytes; + struct ntfs_inode *ni = sbi->volume.ni; + /* Allocate PATH_MAX bytes. */ +- struct cpu_str *uni = __getname(); ++ struct cpu_str *uni = kmalloc(PATH_MAX, GFP_KERNEL); + + if (!uni) + return -ENOMEM; +@@ -2671,6 +2671,6 @@ int ntfs_set_label(struct ntfs_sb_info *sbi, u8 *label, int len) + err = _ni_write_inode(&ni->vfs_inode, 0); + + out: +- __putname(uni); ++ kfree(uni); + return err; + } +diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c +index ec8e954f4426c..bf6ef525d9562 100644 +--- a/fs/ntfs3/inode.c ++++ b/fs/ntfs3/inode.c +@@ -1280,7 +1280,7 @@ int ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir, + fa |= FILE_ATTRIBUTE_READONLY; + + /* Allocate PATH_MAX bytes. */ +- new_de = kmem_cache_zalloc(names_cachep, GFP_KERNEL); ++ new_de = kzalloc(PATH_MAX, GFP_KERNEL); + if (!new_de) { + err = -ENOMEM; + goto out1; +@@ -1701,7 +1701,7 @@ int ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir, + ntfs_mark_rec_free(sbi, ino, false); + + out2: +- __putname(new_de); ++ kfree(new_de); + kfree(rp); + + out1: +@@ -1722,7 +1722,7 @@ int ntfs_link_inode(struct inode *inode, struct dentry *dentry) + struct NTFS_DE *de; + + /* Allocate PATH_MAX bytes. */ +- de = kmem_cache_zalloc(names_cachep, GFP_KERNEL); ++ de = kzalloc(PATH_MAX, GFP_KERNEL); + if (!de) + return -ENOMEM; + +@@ -1736,7 +1736,7 @@ int ntfs_link_inode(struct inode *inode, struct dentry *dentry) + + err = ni_add_name(ntfs_i(d_inode(dentry->d_parent)), ni, de); + out: +- __putname(de); ++ kfree(de); + return err; + } + +@@ -1759,8 +1759,7 @@ int ntfs_unlink_inode(struct inode *dir, const struct dentry *dentry) + if (ntfs_is_meta_file(sbi, ni->mi.rno)) + return -EINVAL; + +- /* Allocate PATH_MAX bytes. */ +- de = kmem_cache_zalloc(names_cachep, GFP_KERNEL); ++ de = kzalloc(PATH_MAX, GFP_KERNEL); + if (!de) + return -ENOMEM; + +@@ -1796,7 +1795,7 @@ int ntfs_unlink_inode(struct inode *dir, const struct dentry *dentry) + + out: + ni_unlock(ni); +- __putname(de); ++ kfree(de); + return err; + } + +diff --git a/fs/ntfs3/namei.c b/fs/ntfs3/namei.c +index 3b24ca02de614..b2af8f695e60f 100644 +--- a/fs/ntfs3/namei.c ++++ b/fs/ntfs3/namei.c +@@ -68,7 +68,7 @@ static struct dentry *ntfs_lookup(struct inode *dir, struct dentry *dentry, + u32 flags) + { + struct ntfs_inode *ni = ntfs_i(dir); +- struct cpu_str *uni = __getname(); ++ struct cpu_str *uni = kmalloc(PATH_MAX, GFP_KERNEL); + struct inode *inode; + int err; + +@@ -85,7 +85,7 @@ static struct dentry *ntfs_lookup(struct inode *dir, struct dentry *dentry, + inode = dir_search_u(dir, uni, NULL); + ni_unlock(ni); + } +- __putname(uni); ++ kfree(uni); + } + + /* +@@ -303,8 +303,7 @@ static int ntfs_rename(struct mnt_idmap *idmap, struct inode *dir, + return err; + } + +- /* Allocate PATH_MAX bytes. */ +- de = __getname(); ++ de = kmalloc(PATH_MAX, GFP_KERNEL); + if (!de) + return -ENOMEM; + +@@ -349,7 +348,7 @@ static int ntfs_rename(struct mnt_idmap *idmap, struct inode *dir, + ni_unlock(ni); + ni_unlock(dir_ni); + out: +- __putname(de); ++ kfree(de); + return err; + } + +@@ -407,7 +406,7 @@ static int ntfs_d_hash(const struct dentry *dentry, struct qstr *name) + /* + * Try slow way with current upcase table + */ +- uni = kmem_cache_alloc(names_cachep, GFP_NOWAIT); ++ uni = kmalloc(PATH_MAX, GFP_NOWAIT); + if (!uni) + return -ENOMEM; + +@@ -429,7 +428,7 @@ static int ntfs_d_hash(const struct dentry *dentry, struct qstr *name) + err = 0; + + out: +- kmem_cache_free(names_cachep, uni); ++ kfree(uni); + return err; + } + +@@ -468,7 +467,7 @@ static int ntfs_d_compare(const struct dentry *dentry, unsigned int len1, + * Try slow way with current upcase table + */ + sbi = dentry->d_sb->s_fs_info; +- uni1 = __getname(); ++ uni1 = kmalloc(PATH_MAX, GFP_NOWAIT); + if (!uni1) + return -ENOMEM; + +@@ -498,7 +497,7 @@ static int ntfs_d_compare(const struct dentry *dentry, unsigned int len1, + ret = !ntfs_cmp_names_cpu(uni1, uni2, sbi->upcase, false) ? 0 : 1; + + out: +- __putname(uni1); ++ kfree(uni1); + return ret; + } + +diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c +index c93df55e98d07..f3bb2c41c000f 100644 +--- a/fs/ntfs3/xattr.c ++++ b/fs/ntfs3/xattr.c +@@ -556,8 +556,7 @@ struct posix_acl *ntfs_get_acl(struct mnt_idmap *idmap, struct dentry *dentry, + if (unlikely(is_bad_ni(ni))) + return ERR_PTR(-EINVAL); + +- /* Allocate PATH_MAX bytes. */ +- buf = __getname(); ++ buf = kmalloc(PATH_MAX, GFP_KERNEL); + if (!buf) + return ERR_PTR(-ENOMEM); + +@@ -588,7 +587,7 @@ struct posix_acl *ntfs_get_acl(struct mnt_idmap *idmap, struct dentry *dentry, + if (!IS_ERR(acl)) + set_cached_acl(inode, type, acl); + +- __putname(buf); ++ kfree(buf); + + return acl; + } +-- +2.51.0 + diff --git a/queue-6.19/ntfs3-fix-circular-locking-dependency-in-run_unpack_.patch b/queue-6.19/ntfs3-fix-circular-locking-dependency-in-run_unpack_.patch new file mode 100644 index 00000000000..7727520be59 --- /dev/null +++ b/queue-6.19/ntfs3-fix-circular-locking-dependency-in-run_unpack_.patch @@ -0,0 +1,62 @@ +From ef5dae37b29b663e8c3b61577a85da17f9cd25ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Dec 2025 15:43:07 +0100 +Subject: ntfs3: fix circular locking dependency in run_unpack_ex + +From: Szymon Wilczek + +[ Upstream commit 08ce2fee1b869ecbfbd94e0eb2630e52203a2e03 ] + +Syzbot reported a circular locking dependency between wnd->rw_lock +(sbi->used.bitmap) and ni->file.run_lock. + +The deadlock scenario: +1. ntfs_extend_mft() takes ni->file.run_lock then wnd->rw_lock. +2. run_unpack_ex() takes wnd->rw_lock then tries to acquire + ni->file.run_lock inside ntfs_refresh_zone(). + +This creates an AB-BA deadlock. + +Fix this by using down_read_trylock() instead of down_read() when +acquiring run_lock in run_unpack_ex(). If the lock is contended, +skip ntfs_refresh_zone() - the MFT zone will be refreshed on the +next MFT operation. This breaks the circular dependency since we +never block waiting for run_lock while holding wnd->rw_lock. + +Reported-by: syzbot+d27edf9f96ae85939222@syzkaller.appspotmail.com +Tested-by: syzbot+d27edf9f96ae85939222@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=d27edf9f96ae85939222 +Signed-off-by: Szymon Wilczek +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/run.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c +index 395b204925258..dc59cad4fa376 100644 +--- a/fs/ntfs3/run.c ++++ b/fs/ntfs3/run.c +@@ -1131,11 +1131,14 @@ int run_unpack_ex(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, + struct rw_semaphore *lock = + is_mounted(sbi) ? &sbi->mft.ni->file.run_lock : + NULL; +- if (lock) +- down_read(lock); +- ntfs_refresh_zone(sbi); +- if (lock) +- up_read(lock); ++ if (lock) { ++ if (down_read_trylock(lock)) { ++ ntfs_refresh_zone(sbi); ++ up_read(lock); ++ } ++ } else { ++ ntfs_refresh_zone(sbi); ++ } + } + up_write(&wnd->rw_lock); + if (err) +-- +2.51.0 + diff --git a/queue-6.19/objtool-rust-add-one-more-noreturn-rust-function.patch b/queue-6.19/objtool-rust-add-one-more-noreturn-rust-function.patch new file mode 100644 index 00000000000..1261bb65652 --- /dev/null +++ b/queue-6.19/objtool-rust-add-one-more-noreturn-rust-function.patch @@ -0,0 +1,49 @@ +From 7e63cc26eff2595fa3dbeaef80755b2e07093cd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Feb 2026 21:43:36 +0100 +Subject: objtool/rust: add one more `noreturn` Rust function + +From: Miguel Ojeda + +[ Upstream commit c431b00ca6afc5da3133636ecc34ee7edd38d6cc ] + +`objtool` with Rust 1.84.0 reports: + + rust/kernel.o: error: objtool: _RNvXNtNtCsaRPFapPOzLs_6kernel3str9parse_intaNtNtB2_7private12FromStrRadix14from_str_radix() + falls through to next function _RNvXNtNtCsaRPFapPOzLs_6kernel3str9parse_intaNtNtB2_7private12FromStrRadix16from_u64_negated() + +This is very similar to commit c18f35e49049 ("objtool/rust: add one more +`noreturn` Rust function"), which added `from_ascii_radix_panic` for Rust +1.86.0, except that Rust 1.84.0 ends up needing `from_str_radix_panic`. + +Thus add it to the list to fix the warning. + +Cc: FUJITA Tomonori +Fixes: 51d9ee90ea90 ("rust: str: add radix prefixed integer parsing functions") +Reported-by: Alice Ryhl +Link: https://rust-for-linux.zulipchat.com/#narrow/channel/291565/topic/x/with/572427627 +Tested-by: Alice Ryhl +Link: https://patch.msgid.link/20260206204336.38462-1-ojeda@kernel.org +Signed-off-by: Miguel Ojeda +Signed-off-by: Sasha Levin +--- + tools/objtool/check.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/objtool/check.c b/tools/objtool/check.c +index 3fd98c5b6e1a8..37ec0d757e9b1 100644 +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -197,7 +197,8 @@ static bool is_rust_noreturn(const struct symbol *func) + * as well as changes to the source code itself between versions (since + * these come from the Rust standard library). + */ +- return str_ends_with(func->name, "_4core3num22from_ascii_radix_panic") || ++ return str_ends_with(func->name, "_4core3num20from_str_radix_panic") || ++ str_ends_with(func->name, "_4core3num22from_ascii_radix_panic") || + str_ends_with(func->name, "_4core5sliceSp15copy_from_slice17len_mismatch_fail") || + str_ends_with(func->name, "_4core6option13expect_failed") || + str_ends_with(func->name, "_4core6option13unwrap_failed") || +-- +2.51.0 + diff --git a/queue-6.19/octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch b/queue-6.19/octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch new file mode 100644 index 00000000000..3a66d36866c --- /dev/null +++ b/queue-6.19/octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch @@ -0,0 +1,69 @@ +From 23389bbae8eaa07413f14bde6004ec3d2a7b001c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 18:21:47 +0530 +Subject: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geetha sowjanya + +[ Upstream commit 70e9a5760abfb6338d63994d4de6b0778ec795d6 ] + +NIX SQ manager sticky mode is known to cause stalls when multiple SQs +share an SMQ and transmit concurrently. Additionally, PSE may deadlock +on transitions between sticky and non-sticky transmissions. There is +also a credit drop issue observed when certain condition clocks are +gated. + +work around these hardware errata by: +- Disabling SQM sticky operation: + - Clear TM6 (bit 15) + - Clear TM11 (bit 14) +- Disabling sticky → non-sticky transition path that can deadlock PSE: + - Clear TM5 (bit 23) +- Preventing credit drops by keeping the control-flow clock enabled: + - Set TM9 (bit 21) + +These changes are applied via NIX_AF_SQM_DBG_CTL_STATUS. With this +configuration the SQM/PSE maintain forward progress under load without +credit loss, at the cost of disabling sticky optimizations. + +Signed-off-by: Geetha sowjanya +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260127125147.1642-1-gakula@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +index 2f485a930edd1..49f7ff5eddfc8 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +@@ -4938,12 +4938,18 @@ static int rvu_nix_block_init(struct rvu *rvu, struct nix_hw *nix_hw) + /* Set chan/link to backpressure TL3 instead of TL2 */ + rvu_write64(rvu, blkaddr, NIX_AF_PSE_CHANNEL_LEVEL, 0x01); + +- /* Disable SQ manager's sticky mode operation (set TM6 = 0) ++ /* Disable SQ manager's sticky mode operation (set TM6 = 0, TM11 = 0) + * This sticky mode is known to cause SQ stalls when multiple +- * SQs are mapped to same SMQ and transmitting pkts at a time. ++ * SQs are mapped to same SMQ and transmitting pkts simultaneously. ++ * NIX PSE may deadlock when there are any sticky to non-sticky ++ * transmission. Hence disable it (TM5 = 0). + */ + cfg = rvu_read64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS); +- cfg &= ~BIT_ULL(15); ++ cfg &= ~(BIT_ULL(15) | BIT_ULL(14) | BIT_ULL(23)); ++ /* NIX may drop credits when condition clocks are turned off. ++ * Hence enable control flow clk (set TM9 = 1). ++ */ ++ cfg |= BIT_ULL(21); + rvu_write64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS, cfg); + + ltdefs = rvu->kpu.lt_def; +-- +2.51.0 + diff --git a/queue-6.19/openrisc-define-arch-specific-version-of-nop.patch b/queue-6.19/openrisc-define-arch-specific-version-of-nop.patch new file mode 100644 index 00000000000..01de10364be --- /dev/null +++ b/queue-6.19/openrisc-define-arch-specific-version-of-nop.patch @@ -0,0 +1,53 @@ +From b43afaf07c4924bb4dc235af14b6345c55e9f794 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 12:07:23 -0500 +Subject: openrisc: define arch-specific version of nop() + +From: Brian Masney + +[ Upstream commit 0dfffa5479d6260d04d021f69203b1926f73d889 ] + +When compiling a driver written for MIPS on OpenRISC that uses the nop() +function, it fails due to the following error: + + drivers/watchdog/pic32-wdt.c: Assembler messages: + drivers/watchdog/pic32-wdt.c:125: Error: unrecognized instruction `nop' + +The driver currently uses the generic version of nop() from +include/asm-generic/barrier.h: + + #ifndef nop + #define nop() asm volatile ("nop") + #endif + +Let's fix this on OpenRISC by defining an architecture-specific version +of nop(). + +This was tested by performing an allmodconfig openrisc cross compile on +an aarch64 host. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202601180236.BVy480We-lkp@intel.com/ +Signed-off-by: Brian Masney +Signed-off-by: Stafford Horne +Signed-off-by: Sasha Levin +--- + arch/openrisc/include/asm/barrier.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h +index 7538294721bed..8e592c9909023 100644 +--- a/arch/openrisc/include/asm/barrier.h ++++ b/arch/openrisc/include/asm/barrier.h +@@ -4,6 +4,8 @@ + + #define mb() asm volatile ("l.msync" ::: "memory") + ++#define nop() asm volatile ("l.nop") ++ + #include + + #endif /* __ASM_BARRIER_H */ +-- +2.51.0 + diff --git a/queue-6.19/parisc-prevent-interrupts-during-reboot.patch b/queue-6.19/parisc-prevent-interrupts-during-reboot.patch new file mode 100644 index 00000000000..49479ebb747 --- /dev/null +++ b/queue-6.19/parisc-prevent-interrupts-during-reboot.patch @@ -0,0 +1,32 @@ +From e04002c04ac9b2b20a2823cf77cb2232c6733adb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 17:58:55 +0100 +Subject: parisc: Prevent interrupts during reboot + +From: Helge Deller + +[ Upstream commit 35ac5a728c878594f2ea6c43b57652a16be3c968 ] + +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/kernel/process.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c +index e64ab5d2a40d6..703644e5bfc4a 100644 +--- a/arch/parisc/kernel/process.c ++++ b/arch/parisc/kernel/process.c +@@ -85,6 +85,9 @@ void machine_restart(char *cmd) + #endif + /* set up a new led state on systems shipped with a LED State panel */ + pdc_chassis_send_status(PDC_CHASSIS_DIRECT_SHUTDOWN); ++ ++ /* prevent interrupts during reboot */ ++ set_eiem(0); + + /* "Normal" system reset */ + pdc_do_reset(); +-- +2.51.0 + diff --git a/queue-6.19/pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch b/queue-6.19/pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch new file mode 100644 index 00000000000..ead06f00c7e --- /dev/null +++ b/queue-6.19/pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch @@ -0,0 +1,41 @@ +From 56583181fd8c959eaeb1c55b8aea3fe6a57c5184 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jan 2026 13:53:32 +0530 +Subject: PCI: Add ACS quirk for Qualcomm Hamoa & Glymur + +From: Krishna Chaitanya Chundru + +[ Upstream commit 44d2f70b1fd72c339c72983fcffa181beae3e113 ] + +The Qualcomm Hamoa & Glymur Root Ports don't advertise an ACS capability, +but they do provide ACS-like features to disable peer transactions and +validate bus numbers in requests. + +Add an ACS quirk for Hamoa & Glymur. + +Signed-off-by: Krishna Chaitanya Chundru +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20260109-acs_quirk-v1-1-82adf95a89ae@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 538ad85cf7c30..4463a2da0441f 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -5117,6 +5117,10 @@ static const struct pci_dev_acs_enabled { + { PCI_VENDOR_ID_QCOM, 0x0401, pci_quirk_qcom_rp_acs }, + /* QCOM SA8775P root port */ + { PCI_VENDOR_ID_QCOM, 0x0115, pci_quirk_qcom_rp_acs }, ++ /* QCOM Hamoa root port */ ++ { PCI_VENDOR_ID_QCOM, 0x0111, pci_quirk_qcom_rp_acs }, ++ /* QCOM Glymur root port */ ++ { PCI_VENDOR_ID_QCOM, 0x0120, pci_quirk_qcom_rp_acs }, + /* HXT SD4800 root ports. The ACS design is same as QCOM QDF2xxx */ + { PCI_VENDOR_ID_HXT, 0x0401, pci_quirk_qcom_rp_acs }, + /* Intel PCH root ports */ +-- +2.51.0 + diff --git a/queue-6.19/pci-add-intel-nova-lake-audio-device-id.patch b/queue-6.19/pci-add-intel-nova-lake-audio-device-id.patch new file mode 100644 index 00000000000..07c66660546 --- /dev/null +++ b/queue-6.19/pci-add-intel-nova-lake-audio-device-id.patch @@ -0,0 +1,42 @@ +From 3516980a9e7c7fe0c60d06378b8b2cdf9f643d32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 21:35:04 +0200 +Subject: PCI: Add Intel Nova Lake audio Device ID + +From: Peter Ujfalusi + +[ Upstream commit b190870e0e0cfb375c0d4da02761c32083f3644d ] + +Add Nova Lake (NVL) audio Device ID + +The ID will be used by HDA legacy, SOF audio stack and the driver +to determine which audio stack should be used (intel-dsp-config). + +Signed-off-by: Peter Ujfalusi +Reviewed-by: Kai Vehmanen +Reviewed-by: Liam Girdwood +Reviewed-by: Ranjani Sridharan +Acked-by: Bjorn Helgaas +Acked-by: Takashi Iwai +Link: https://patch.msgid.link/20260120193507.14019-2-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + include/linux/pci_ids.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h +index a9a089566b7cb..f2849ff1830b1 100644 +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -3143,6 +3143,7 @@ + #define PCI_DEVICE_ID_INTEL_HDA_CML_S 0xa3f0 + #define PCI_DEVICE_ID_INTEL_HDA_LNL_P 0xa828 + #define PCI_DEVICE_ID_INTEL_S21152BB 0xb152 ++#define PCI_DEVICE_ID_INTEL_HDA_NVL 0xd328 + #define PCI_DEVICE_ID_INTEL_HDA_BMG 0xe2f7 + #define PCI_DEVICE_ID_INTEL_HDA_PTL_H 0xe328 + #define PCI_DEVICE_ID_INTEL_HDA_PTL 0xe428 +-- +2.51.0 + diff --git a/queue-6.19/pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch b/queue-6.19/pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch new file mode 100644 index 00000000000..776baead489 --- /dev/null +++ b/queue-6.19/pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch @@ -0,0 +1,94 @@ +From a4c680648284cde5141458fd5eced3882244f6e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 10:25:51 +0100 +Subject: PCI/AER: Clear stale errors on reporting agents upon probe + +From: Lukas Wunner + +[ Upstream commit e242d09b58e869f86071b7889acace4cff215935 ] + +Correctable and Uncorrectable Error Status Registers on reporting agents +are cleared upon PCI device enumeration in pci_aer_init() to flush past +events. They're cleared again when an error is handled by the AER driver. + +If an agent reports a new error after pci_aer_init() and before the AER +driver has probed on the corresponding Root Port or Root Complex Event +Collector, that error is not handled by the AER driver: It clears the +Root Error Status Register on probe, but neglects to re-clear the +Correctable and Uncorrectable Error Status Registers on reporting agents. + +The error will eventually be reported when another error occurs. Which +is irritating because to an end user it appears as if the earlier error +has just happened. + +Amend the AER driver to clear stale errors on reporting agents upon probe. + +Skip reporting agents which have not invoked pci_aer_init() yet to avoid +using an uninitialized pdev->aer_cap. They're recognizable by the error +bits in the Device Control register still being clear. + +Reporting agents may execute pci_aer_init() after the AER driver has +probed, particularly when devices are hotplugged or removed/rescanned via +sysfs. For this reason, it continues to be necessary that pci_aer_init() +clears Correctable and Uncorrectable Error Status Registers. + +Reported-by: Lucas Van # off-list +Signed-off-by: Lukas Wunner +Signed-off-by: Bjorn Helgaas +Tested-by: Lucas Van +Reviewed-by: Kuppuswamy Sathyanarayanan +Link: https://patch.msgid.link/3011c2ed30c11f858e35e29939add754adea7478.1769332702.git.lukas@wunner.de +Signed-off-by: Sasha Levin +--- + drivers/pci/pcie/aer.c | 26 +++++++++++++++++++++++++- + 1 file changed, 25 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c +index 9472d86cef552..73cb6d587202c 100644 +--- a/drivers/pci/pcie/aer.c ++++ b/drivers/pci/pcie/aer.c +@@ -1605,6 +1605,20 @@ static void aer_disable_irq(struct pci_dev *pdev) + pci_write_config_dword(pdev, aer + PCI_ERR_ROOT_COMMAND, reg32); + } + ++static int clear_status_iter(struct pci_dev *dev, void *data) ++{ ++ u16 devctl; ++ ++ /* Skip if pci_enable_pcie_error_reporting() hasn't been called yet */ ++ pcie_capability_read_word(dev, PCI_EXP_DEVCTL, &devctl); ++ if (!(devctl & PCI_EXP_AER_FLAGS)) ++ return 0; ++ ++ pci_aer_clear_status(dev); ++ pcie_clear_device_status(dev); ++ return 0; ++} ++ + /** + * aer_enable_rootport - enable Root Port's interrupts when receiving messages + * @rpc: pointer to a Root Port data structure +@@ -1626,9 +1640,19 @@ static void aer_enable_rootport(struct aer_rpc *rpc) + pcie_capability_clear_word(pdev, PCI_EXP_RTCTL, + SYSTEM_ERROR_INTR_ON_MESG_MASK); + +- /* Clear error status */ ++ /* Clear error status of this Root Port or RCEC */ + pci_read_config_dword(pdev, aer + PCI_ERR_ROOT_STATUS, ®32); + pci_write_config_dword(pdev, aer + PCI_ERR_ROOT_STATUS, reg32); ++ ++ /* Clear error status of agents reporting to this Root Port or RCEC */ ++ if (reg32 & AER_ERR_STATUS_MASK) { ++ if (pci_pcie_type(pdev) == PCI_EXP_TYPE_RC_EC) ++ pcie_walk_rcec(pdev, clear_status_iter, NULL); ++ else if (pdev->subordinate) ++ pci_walk_bus(pdev->subordinate, clear_status_iter, ++ NULL); ++ } ++ + pci_read_config_dword(pdev, aer + PCI_ERR_COR_STATUS, ®32); + pci_write_config_dword(pdev, aer + PCI_ERR_COR_STATUS, reg32); + pci_read_config_dword(pdev, aer + PCI_ERR_UNCOR_STATUS, ®32); +-- +2.51.0 + diff --git a/queue-6.19/pci-bwctrl-disable-bw-controller-on-intel-p45-using-.patch b/queue-6.19/pci-bwctrl-disable-bw-controller-on-intel-p45-using-.patch new file mode 100644 index 00000000000..68b2f2ea6e7 --- /dev/null +++ b/queue-6.19/pci-bwctrl-disable-bw-controller-on-intel-p45-using-.patch @@ -0,0 +1,86 @@ +From 9a1e23ff807fb273d01ffe1ca45d04b63b419242 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jan 2026 15:15:12 +0200 +Subject: PCI/bwctrl: Disable BW controller on Intel P45 using a quirk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 46a9f70e93ef73860d1dbbec75ef840031f8f30a ] + +The commit 665745f27487 ("PCI/bwctrl: Re-add BW notification portdrv as +PCIe BW controller") was found to lead to a boot hang on a Intel P45 +system. Testing without setting Link Bandwidth Management Interrupt Enable +(LBMIE) and Link Autonomous Bandwidth Interrupt Enable (LABIE) (PCIe r7.0, +sec 7.5.3.7) in bwctrl allowed system to come up. + +P45 is a very old chipset and supports only up to gen2 PCIe, so not having +bwctrl does not seem a huge deficiency. + +Add no_bw_notif in struct pci_dev and quirk Intel P45 Root Port with it. + +Reported-by: Adam Stylinski +Link: https://lore.kernel.org/linux-pci/aUCt1tHhm_-XIVvi@eggsbenedict/ +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Tested-by: Adam Stylinski +Link: https://patch.msgid.link/20260116131513.2359-1-ilpo.jarvinen@linux.intel.com +Signed-off-by: Sasha Levin +--- + drivers/pci/pcie/bwctrl.c | 3 +++ + drivers/pci/quirks.c | 10 ++++++++++ + include/linux/pci.h | 1 + + 3 files changed, 14 insertions(+) + +diff --git a/drivers/pci/pcie/bwctrl.c b/drivers/pci/pcie/bwctrl.c +index 36f939f23d34e..4ae92c9f912a8 100644 +--- a/drivers/pci/pcie/bwctrl.c ++++ b/drivers/pci/pcie/bwctrl.c +@@ -250,6 +250,9 @@ static int pcie_bwnotif_probe(struct pcie_device *srv) + struct pci_dev *port = srv->port; + int ret; + ++ if (port->no_bw_notif) ++ return -ENODEV; ++ + /* Can happen if we run out of bus numbers during enumeration. */ + if (!port->subordinate) + return -ENODEV; +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 90676cb2fd10b..fd86f72f54aef 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -1359,6 +1359,16 @@ static void quirk_transparent_bridge(struct pci_dev *dev) + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82380FB, quirk_transparent_bridge); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TOSHIBA, 0x605, quirk_transparent_bridge); + ++/* ++ * Enabling Link Bandwidth Management Interrupts (BW notifications) can cause ++ * boot hangs on P45. ++ */ ++static void quirk_p45_bw_notifications(struct pci_dev *dev) ++{ ++ dev->no_bw_notif = 1; ++} ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e21, quirk_p45_bw_notifications); ++ + /* + * Common misconfiguration of the MediaGX/Geode PCI master that will reduce + * PCI bandwidth from 70MB/s to 25MB/s. See the GXM/GXLV/GX1 datasheets +diff --git a/include/linux/pci.h b/include/linux/pci.h +index b5cc0c2b99065..e958ff7443356 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -406,6 +406,7 @@ struct pci_dev { + user sysfs */ + unsigned int clear_retrain_link:1; /* Need to clear Retrain Link + bit manually */ ++ unsigned int no_bw_notif:1; /* BW notifications may cause issues */ + unsigned int d3hot_delay; /* D3hot->D0 transition time in ms */ + unsigned int d3cold_delay; /* D3cold->D0 transition time in ms */ + +-- +2.51.0 + diff --git a/queue-6.19/pci-cadence-avoid-signed-64-bit-truncation-and-inval.patch b/queue-6.19/pci-cadence-avoid-signed-64-bit-truncation-and-inval.patch new file mode 100644 index 00000000000..e4675a3f9af --- /dev/null +++ b/queue-6.19/pci-cadence-avoid-signed-64-bit-truncation-and-inval.patch @@ -0,0 +1,58 @@ +From 61f0f893efb9f787b1662424a5ee3497c2bc6354 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Dec 2025 14:37:56 -0800 +Subject: PCI: cadence: Avoid signed 64-bit truncation and invalid sort + +From: Ian Rogers + +[ Upstream commit 0297dce758a021ccf2c0f4e164d5403ef722961c ] + +The cdns_pcie_host_dma_ranges_cmp() element comparison function used by +list_sort() is of type list_cmp_func_t, so it returns a 32-bit int. + +cdns_pcie_host_dma_ranges_cmp() computes a resource_size_t difference that +may be a 64-bit value, and truncating that difference to a 32-bit return +value may change the sign and result in an invalid sort order. + +Avoid the truncation and invalid sort order by returning -1, 0, or 1. + +Signed-off-by: Ian Rogers +Signed-off-by: Manivannan Sadhasivam +[bhelgaas: commit log] +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20251209223756.2321578-1-irogers@google.com +Signed-off-by: Sasha Levin +--- + .../controller/cadence/pcie-cadence-host-common.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/cadence/pcie-cadence-host-common.c b/drivers/pci/controller/cadence/pcie-cadence-host-common.c +index 15415d7f35ee9..2b0211870f02a 100644 +--- a/drivers/pci/controller/cadence/pcie-cadence-host-common.c ++++ b/drivers/pci/controller/cadence/pcie-cadence-host-common.c +@@ -173,11 +173,21 @@ int cdns_pcie_host_dma_ranges_cmp(void *priv, const struct list_head *a, + const struct list_head *b) + { + struct resource_entry *entry1, *entry2; ++ u64 size1, size2; + + entry1 = container_of(a, struct resource_entry, node); + entry2 = container_of(b, struct resource_entry, node); + +- return resource_size(entry2->res) - resource_size(entry1->res); ++ size1 = resource_size(entry1->res); ++ size2 = resource_size(entry2->res); ++ ++ if (size1 > size2) ++ return -1; ++ ++ if (size1 < size2) ++ return 1; ++ ++ return 0; + } + EXPORT_SYMBOL_GPL(cdns_pcie_host_dma_ranges_cmp); + +-- +2.51.0 + diff --git a/queue-6.19/pci-dw-rockchip-disable-bar-0-and-bar-1-for-root-por.patch b/queue-6.19/pci-dw-rockchip-disable-bar-0-and-bar-1-for-root-por.patch new file mode 100644 index 00000000000..a174bbc5c8b --- /dev/null +++ b/queue-6.19/pci-dw-rockchip-disable-bar-0-and-bar-1-for-root-por.patch @@ -0,0 +1,74 @@ +From c5207ac23dc3ca17e96a130866f8016efad0608f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Dec 2025 18:01:01 +0800 +Subject: PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port + +From: Shawn Lin + +[ Upstream commit b5d712e5b87fc56ff838684afb1bae359eb8069f ] + +Some Rockchip PCIe Root Ports report bogus size of 1GiB for the BAR +memories and they cause below resource allocation issue during probe. + + pci 0000:00:00.0: [1d87:3588] type 01 class 0x060400 PCIe Root Port + pci 0000:00:00.0: BAR 0 [mem 0x00000000-0x3fffffff] + pci 0000:00:00.0: BAR 1 [mem 0x00000000-0x3fffffff] + pci 0000:00:00.0: ROM [mem 0x00000000-0x0000ffff pref] + ... + pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: assigned + pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: can't assign; no space + pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: failed to assign + pci 0000:00:00.0: ROM [mem 0xf0200000-0xf020ffff pref]: assigned + pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: releasing + pci 0000:00:00.0: ROM [mem 0xf0200000-0xf020ffff pref]: releasing + pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: assigned + pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: can't assign; no space + pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: failed to assign + +Since there is no use of the Root Port BAR memories, disable both of them. + +Signed-off-by: Shawn Lin +[mani: reworded the description and comment] +Signed-off-by: Manivannan Sadhasivam +Link: https://patch.msgid.link/1766570461-138256-1-git-send-email-shawn.lin@rock-chips.com +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-dw-rockchip.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/pci/controller/dwc/pcie-dw-rockchip.c b/drivers/pci/controller/dwc/pcie-dw-rockchip.c +index bf8ec3ca6f689..a3daac74d3f18 100644 +--- a/drivers/pci/controller/dwc/pcie-dw-rockchip.c ++++ b/drivers/pci/controller/dwc/pcie-dw-rockchip.c +@@ -80,6 +80,8 @@ + #define PCIE_LINKUP_MASK GENMASK(17, 16) + #define PCIE_LTSSM_STATUS_MASK GENMASK(5, 0) + ++#define PCIE_TYPE0_HDR_DBI2_OFFSET 0x100000 ++ + struct rockchip_pcie { + struct dw_pcie pci; + void __iomem *apb_base; +@@ -292,6 +294,8 @@ static int rockchip_pcie_host_init(struct dw_pcie_rp *pp) + if (irq < 0) + return irq; + ++ pci->dbi_base2 = pci->dbi_base + PCIE_TYPE0_HDR_DBI2_OFFSET; ++ + ret = rockchip_pcie_init_irq_domain(rockchip); + if (ret < 0) + dev_err(dev, "failed to init irq domain\n"); +@@ -302,6 +306,10 @@ static int rockchip_pcie_host_init(struct dw_pcie_rp *pp) + rockchip_pcie_configure_l1ss(pci); + rockchip_pcie_enable_l0s(pci); + ++ /* Disable Root Ports BAR0 and BAR1 as they report bogus size */ ++ dw_pcie_writel_dbi2(pci, PCI_BASE_ADDRESS_0, 0x0); ++ dw_pcie_writel_dbi2(pci, PCI_BASE_ADDRESS_1, 0x0); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.19/pci-dwc-skip-pme_turn_off-broadcast-and-l2-l3-transi.patch b/queue-6.19/pci-dwc-skip-pme_turn_off-broadcast-and-l2-l3-transi.patch new file mode 100644 index 00000000000..1e3372ccb76 --- /dev/null +++ b/queue-6.19/pci-dwc-skip-pme_turn_off-broadcast-and-l2-l3-transi.patch @@ -0,0 +1,53 @@ +From 609fe173198919bf11fbf1652e49d31e63b60052 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Dec 2025 17:34:52 +0530 +Subject: PCI: dwc: Skip PME_Turn_Off broadcast and L2/L3 transition during + suspend if link is not up + +From: Manivannan Sadhasivam + +[ Upstream commit cfd2fdfd0a8da2e5bbfdc4009b9c4b8bf164c937 ] + +During system suspend, if the PCIe link is not up, then there is no need +to broadcast PME_Turn_Off message and wait for L2/L3 transition. So skip +them. + +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Manivannan Sadhasivam +Tested-by: Vincent Guittot +Reviewed-by: Frank Li +Reviewed-by: Shawn Lin +Link: https://patch.msgid.link/20251218-pci-dwc-suspend-rework-v2-1-5a7778c6094a@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-designware-host.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c +index 372207c33a857..250725ced9026 100644 +--- a/drivers/pci/controller/dwc/pcie-designware-host.c ++++ b/drivers/pci/controller/dwc/pcie-designware-host.c +@@ -1158,8 +1158,11 @@ static int dw_pcie_pme_turn_off(struct dw_pcie *pci) + int dw_pcie_suspend_noirq(struct dw_pcie *pci) + { + u8 offset = dw_pcie_find_capability(pci, PCI_CAP_ID_EXP); ++ int ret = 0; + u32 val; +- int ret; ++ ++ if (!dw_pcie_link_up(pci)) ++ goto stop_link; + + /* + * If L1SS is supported, then do not put the link into L2 as some +@@ -1194,6 +1197,7 @@ int dw_pcie_suspend_noirq(struct dw_pcie *pci) + */ + udelay(1); + ++stop_link: + dw_pcie_stop_link(pci); + if (pci->pp.ops->deinit) + pci->pp.ops->deinit(&pci->pp); +-- +2.51.0 + diff --git a/queue-6.19/pci-enable-acs-after-configuring-iommu-for-of-platfo.patch b/queue-6.19/pci-enable-acs-after-configuring-iommu-for-of-platfo.patch new file mode 100644 index 00000000000..76463f41f0c --- /dev/null +++ b/queue-6.19/pci-enable-acs-after-configuring-iommu-for-of-platfo.patch @@ -0,0 +1,136 @@ +From 2d4e7a16269704f1c309fa7f00dbfb54463430dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jan 2026 21:04:47 +0530 +Subject: PCI: Enable ACS after configuring IOMMU for OF platforms + +From: Manivannan Sadhasivam + +[ Upstream commit c41e2fb67e26b04d919257875fa954aa5f6e392e ] + +Platform, ACPI, or IOMMU drivers call pci_request_acs(), which sets +'pci_acs_enable' to request that ACS be enabled for any devices enumerated +in the future. + +OF platforms called pci_enable_acs() for the first device before +of_iommu_configure() called pci_request_acs(), so ACS was never enabled for +that device (typically a Root Port). + +Call pci_enable_acs() later, from pci_dma_configure(), after +of_dma_configure() has had a chance to call pci_request_acs(). + +Here's the call path, showing the move of pci_enable_acs() from +pci_acs_init() to pci_dma_configure(), where it always happens after +pci_request_acs(): + + pci_device_add + pci_init_capabilities + pci_acs_init + - pci_enable_acs + - if (pci_acs_enable) <-- previous test + - ... + device_add + bus_notify(BUS_NOTIFY_ADD_DEVICE) + iommu_bus_notifier + iommu_probe_device + iommu_init_device + dev->bus->dma_configure + pci_dma_configure # pci_bus_type.dma_configure + of_dma_configure + of_iommu_configure + pci_request_acs + pci_acs_enable = 1 <-- set + + pci_enable_acs + + if (pci_acs_enable) <-- new test + + ... + bus_probe_device + device_initial_probe + ... + really_probe + dev->bus->dma_configure + pci_dma_configure # pci_bus_type.dma_configure + ... + pci_enable_acs + +Note that we will now call pci_enable_acs() twice for every device, first +from the iommu_probe_device() path and again from the really_probe() path. +Presumably that's not an issue since we also call dev->bus->dma_configure() +twice. + +For the ACPI platforms, pci_request_acs() is called during ACPI +initialization time itself, independent of the IOMMU framework. + +Signed-off-by: Manivannan Sadhasivam +[bhelgaas: commit log] +Signed-off-by: Bjorn Helgaas +Tested-by: Marek Szyprowski +Tested-by: Naresh Kamboju +Link: https://patch.msgid.link/20260102-pci_acs-v3-1-72280b94d288@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/pci/pci-driver.c | 8 ++++++++ + drivers/pci/pci.c | 10 +--------- + drivers/pci/pci.h | 1 + + 3 files changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c +index 7c2d9d5962586..301a9418e38e0 100644 +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -1650,6 +1650,14 @@ static int pci_dma_configure(struct device *dev) + ret = acpi_dma_configure(dev, acpi_get_dma_attr(adev)); + } + ++ /* ++ * Attempt to enable ACS regardless of capability because some Root ++ * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have ++ * the standard ACS capability but still support ACS via those ++ * quirks. ++ */ ++ pci_enable_acs(to_pci_dev(dev)); ++ + pci_put_host_bridge_device(bridge); + + /* @drv may not be valid when we're called from the IOMMU layer */ +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 41596bc72f1dc..f21f6933c9b63 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -1015,7 +1015,7 @@ static void pci_std_enable_acs(struct pci_dev *dev, struct pci_acs *caps) + * pci_enable_acs - enable ACS if hardware support it + * @dev: the PCI device + */ +-static void pci_enable_acs(struct pci_dev *dev) ++void pci_enable_acs(struct pci_dev *dev) + { + struct pci_acs caps; + bool enable_acs = false; +@@ -3651,14 +3651,6 @@ bool pci_acs_path_enabled(struct pci_dev *start, + void pci_acs_init(struct pci_dev *dev) + { + dev->acs_cap = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ACS); +- +- /* +- * Attempt to enable ACS regardless of capability because some Root +- * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have +- * the standard ACS capability but still support ACS via those +- * quirks. +- */ +- pci_enable_acs(dev); + } + + /** +diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h +index 36f32b8af6ab3..ecc67fbb159c4 100644 +--- a/drivers/pci/pci.h ++++ b/drivers/pci/pci.h +@@ -957,6 +957,7 @@ static inline resource_size_t pci_resource_alignment(struct pci_dev *dev, + } + + void pci_acs_init(struct pci_dev *dev); ++void pci_enable_acs(struct pci_dev *dev); + #ifdef CONFIG_PCI_QUIRKS + int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags); + int pci_dev_specific_enable_acs(struct pci_dev *dev); +-- +2.51.0 + diff --git a/queue-6.19/pci-fix-pci_slot_lock-device-locking.patch b/queue-6.19/pci-fix-pci_slot_lock-device-locking.patch new file mode 100644 index 00000000000..dca0124b1cd --- /dev/null +++ b/queue-6.19/pci-fix-pci_slot_lock-device-locking.patch @@ -0,0 +1,97 @@ +From afbb00505470ad24d1ca7cda5638532ccb6a4f85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 08:59:51 -0800 +Subject: PCI: Fix pci_slot_lock () device locking + +From: Keith Busch + +[ Upstream commit 1f5e57c622b4dc9b8e7d291d560138d92cfbe5bf ] + +Like pci_bus_lock(), pci_slot_lock() needs to lock the bridge device to +prevent warnings like: + + pcieport 0000:e2:05.0: unlocked secondary bus reset via: pciehp_reset_slot+0x55/0xa0 + +Take and release the lock for the bridge providing the slot for the +lock/trylock and unlock routines. + +Signed-off-by: Keith Busch +Signed-off-by: Bjorn Helgaas +Reviewed-by: Dan Williams +Link: https://patch.msgid.link/20260130165953.751063-3-kbusch@meta.com +Signed-off-by: Sasha Levin +--- + drivers/pci/pci.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index a05978f5cf2c7..41596bc72f1dc 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -5293,10 +5293,9 @@ static int pci_bus_trylock(struct pci_bus *bus) + /* Do any devices on or below this slot prevent a bus reset? */ + static bool pci_slot_resettable(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; + +- if (slot->bus->self && +- (slot->bus->self->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET)) ++ if (bridge && (bridge->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET)) + return false; + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { +@@ -5313,7 +5312,10 @@ static bool pci_slot_resettable(struct pci_slot *slot) + /* Lock devices from the top of the tree down */ + static void pci_slot_lock(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; ++ ++ if (bridge) ++ pci_dev_lock(bridge); + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { + if (!dev->slot || dev->slot != slot) +@@ -5328,7 +5330,7 @@ static void pci_slot_lock(struct pci_slot *slot) + /* Unlock devices from the bottom of the tree up */ + static void pci_slot_unlock(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { + if (!dev->slot || dev->slot != slot) +@@ -5338,12 +5340,18 @@ static void pci_slot_unlock(struct pci_slot *slot) + else + pci_dev_unlock(dev); + } ++ ++ if (bridge) ++ pci_dev_unlock(bridge); + } + + /* Return 1 on successful lock, 0 on contention */ + static int pci_slot_trylock(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; ++ ++ if (bridge && !pci_dev_trylock(bridge)) ++ return 0; + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { + if (!dev->slot || dev->slot != slot) +@@ -5368,6 +5376,9 @@ static int pci_slot_trylock(struct pci_slot *slot) + else + pci_dev_unlock(dev); + } ++ ++ if (bridge) ++ pci_dev_unlock(bridge); + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.19/pci-imx6-add-clkreq-override-to-enable-refclk-for-i..patch b/queue-6.19/pci-imx6-add-clkreq-override-to-enable-refclk-for-i..patch new file mode 100644 index 00000000000..d0bb96daa8b --- /dev/null +++ b/queue-6.19/pci-imx6-add-clkreq-override-to-enable-refclk-for-i..patch @@ -0,0 +1,88 @@ +From 130156807cf0e39cc0d3627b211dff4c4943f3e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 11:04:27 +0800 +Subject: PCI: imx6: Add CLKREQ# override to enable REFCLK for i.MX95 PCIe + +From: Richard Zhu + +[ Upstream commit 27a064aba2da6bc58fc36a6b8e889187ae3bf89d ] + +The CLKREQ# is an open drain, active low signal that is driven low by +the card to request reference clock. It's an optional signal added in +PCIe CEM r4.0, sec 2. Thus, this signal wouldn't be driven low if it's +not exposed on the slot. + +On the i.MX95 EVK board, REFCLK to the host and endpoint is gated by this +CLKREQ# signal. So if the CLKREQ# signal is not driven by the endpoint, it +will gate the REFCLK to host too, leading to operational failure. + +Hence, enable the REFCLK on this SoC by enabling the CLKREQ# override using +imx95_pcie_clkreq_override() helper during probe. This override should only +be cleared when the CLKREQ# signal is exposed on the slot. + +Signed-off-by: Richard Zhu +[mani: reworded description] +Signed-off-by: Manivannan Sadhasivam +Tested-by: Alexander Stein +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20251015030428.2980427-11-hongxing.zhu@nxp.com +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pci-imx6.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c +index f28e335bbbfaf..dd69af0f195ff 100644 +--- a/drivers/pci/controller/dwc/pci-imx6.c ++++ b/drivers/pci/controller/dwc/pci-imx6.c +@@ -52,6 +52,8 @@ + #define IMX95_PCIE_REF_CLKEN BIT(23) + #define IMX95_PCIE_PHY_CR_PARA_SEL BIT(9) + #define IMX95_PCIE_SS_RW_REG_1 0xf4 ++#define IMX95_PCIE_CLKREQ_OVERRIDE_EN BIT(8) ++#define IMX95_PCIE_CLKREQ_OVERRIDE_VAL BIT(9) + #define IMX95_PCIE_SYS_AUX_PWR_DET BIT(31) + + #define IMX95_PE0_GEN_CTRL_1 0x1050 +@@ -706,6 +708,22 @@ static int imx7d_pcie_enable_ref_clk(struct imx_pcie *imx_pcie, bool enable) + return 0; + } + ++static void imx95_pcie_clkreq_override(struct imx_pcie *imx_pcie, bool enable) ++{ ++ regmap_update_bits(imx_pcie->iomuxc_gpr, IMX95_PCIE_SS_RW_REG_1, ++ IMX95_PCIE_CLKREQ_OVERRIDE_EN, ++ enable ? IMX95_PCIE_CLKREQ_OVERRIDE_EN : 0); ++ regmap_update_bits(imx_pcie->iomuxc_gpr, IMX95_PCIE_SS_RW_REG_1, ++ IMX95_PCIE_CLKREQ_OVERRIDE_VAL, ++ enable ? IMX95_PCIE_CLKREQ_OVERRIDE_VAL : 0); ++} ++ ++static int imx95_pcie_enable_ref_clk(struct imx_pcie *imx_pcie, bool enable) ++{ ++ imx95_pcie_clkreq_override(imx_pcie, enable); ++ return 0; ++} ++ + static int imx_pcie_clk_enable(struct imx_pcie *imx_pcie) + { + struct dw_pcie *pci = imx_pcie->pci; +@@ -1916,6 +1934,7 @@ static const struct imx_pcie_drvdata drvdata[] = { + .core_reset = imx95_pcie_core_reset, + .init_phy = imx95_pcie_init_phy, + .wait_pll_lock = imx95_pcie_wait_for_phy_pll_lock, ++ .enable_ref_clk = imx95_pcie_enable_ref_clk, + }, + [IMX8MQ_EP] = { + .variant = IMX8MQ_EP, +@@ -1972,6 +1991,7 @@ static const struct imx_pcie_drvdata drvdata[] = { + .core_reset = imx95_pcie_core_reset, + .wait_pll_lock = imx95_pcie_wait_for_phy_pll_lock, + .epc_features = &imx95_pcie_epc_features, ++ .enable_ref_clk = imx95_pcie_enable_ref_clk, + .mode = DW_PCIE_EP_TYPE, + }, + }; +-- +2.51.0 + diff --git a/queue-6.19/pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch b/queue-6.19/pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch new file mode 100644 index 00000000000..ad18df50ae0 --- /dev/null +++ b/queue-6.19/pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch @@ -0,0 +1,51 @@ +From 13d167fa59dcdf9e99c52b7b2d790ff21725eedd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 17:02:08 -0700 +Subject: PCI: Mark ASM1164 SATA controller to avoid bus reset + +From: Alex Williamson + +[ Upstream commit beb2f81792a8a619e5122b6b24a374861309c54b ] + +User forums report issues when assigning ASM1164 SATA controllers to VMs, +especially in configurations with multiple controllers. Logs show the +device fails to retrain after bus reset. Reports suggest this is an issue +across multiple platforms. The device indicates support for PM reset, +therefore the device still has a viable function level reset mechanism. +The reporting user confirms the device is well behaved in this use case +with bus reset disabled. + +Reported-by: Patrick Bianchi +Link: https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/ +Signed-off-by: Alex Williamson +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20260109000211.398300-1-alex.williamson@nvidia.com +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 6df78efd7f6dc..538ad85cf7c30 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3791,6 +3791,16 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_CAVIUM, 0xa100, quirk_no_bus_reset); + */ + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TI, 0xb005, quirk_no_bus_reset); + ++/* ++ * Reports from users making use of PCI device assignment with ASM1164 ++ * controllers indicate an issue with bus reset where the device fails to ++ * retrain. The issue appears more common in configurations with multiple ++ * controllers. The device does indicate PM reset support (NoSoftRst-), ++ * therefore this still leaves a viable reset method. ++ * https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/ ++ */ ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ASMEDIA, 0x1164, quirk_no_bus_reset); ++ + static void quirk_no_pm_reset(struct pci_dev *dev) + { + /* +-- +2.51.0 + diff --git a/queue-6.19/pci-mark-nvidia-gb10-to-avoid-bus-reset.patch b/queue-6.19/pci-mark-nvidia-gb10-to-avoid-bus-reset.patch new file mode 100644 index 00000000000..3cc9d60e645 --- /dev/null +++ b/queue-6.19/pci-mark-nvidia-gb10-to-avoid-bus-reset.patch @@ -0,0 +1,47 @@ +From a330d687a15239cd7d77dd873f22364898385d83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Nov 2025 16:44:06 +0800 +Subject: PCI: Mark Nvidia GB10 to avoid bus reset + +From: Johnny-CC Chang + +[ Upstream commit c81a2ce6b6a844d1a57d2a69833a9d0f00403f00 ] + +After asserting Secondary Bus Reset to downstream devices via a GB10 Root +Port, the link may not retrain correctly, e.g., the link may retrain with a +lower lane count or config accesses to downstream devices may fail. + +Prevent use of Secondary Bus Reset for devices below GB10. + +Signed-off-by: Johnny-CC Chang +[bhelgaas: drop pci_ids.h update (only used once), update commit log] +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Link: https://patch.msgid.link/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 4463a2da0441f..90676cb2fd10b 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3748,6 +3748,14 @@ static void quirk_no_bus_reset(struct pci_dev *dev) + dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET; + } + ++/* ++ * After asserting Secondary Bus Reset to downstream devices via a GB10 ++ * Root Port, the link may not retrain correctly. ++ * https://lore.kernel.org/r/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com ++ */ ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22CE, quirk_no_bus_reset); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22D0, quirk_no_bus_reset); ++ + /* + * Some NVIDIA GPU devices do not work with bus reset, SBR needs to be + * prevented for those affected devices. +-- +2.51.0 + diff --git a/queue-6.19/pci-msi-unmap-msi-x-region-on-error.patch b/queue-6.19/pci-msi-unmap-msi-x-region-on-error.patch new file mode 100644 index 00000000000..06098077612 --- /dev/null +++ b/queue-6.19/pci-msi-unmap-msi-x-region-on-error.patch @@ -0,0 +1,49 @@ +From eaa13026354cc29fed668d53cb3a05431145994e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 22:44:52 +0800 +Subject: PCI/MSI: Unmap MSI-X region on error + +From: Haoxiang Li + +[ Upstream commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202 ] + +msix_capability_init() fails to unmap the MSI-X region if +msix_setup_interrupts() fails. + +Add the missing iounmap() for that error path. + +[ tglx: Massaged change log ] + +Signed-off-by: Haoxiang Li +Signed-off-by: Thomas Gleixner +Link: https://patch.msgid.link/20260125144452.2103812-1-lihaoxiang@isrc.iscas.ac.cn +Signed-off-by: Sasha Levin +--- + drivers/pci/msi/msi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c +index 34d664139f48f..e010ecd9f90dd 100644 +--- a/drivers/pci/msi/msi.c ++++ b/drivers/pci/msi/msi.c +@@ -737,7 +737,7 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries, + + ret = msix_setup_interrupts(dev, entries, nvec, affd); + if (ret) +- goto out_disable; ++ goto out_unmap; + + /* Disable INTX */ + pci_intx_for_msi(dev, 0); +@@ -758,6 +758,8 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries, + pcibios_free_irq(dev); + return 0; + ++out_unmap: ++ iounmap(dev->msix_base); + out_disable: + dev->msix_enabled = 0; + pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL | PCI_MSIX_FLAGS_ENABLE, 0); +-- +2.51.0 + diff --git a/queue-6.19/perf-annotate-fix-args-leak-of-map_symbol.patch b/queue-6.19/perf-annotate-fix-args-leak-of-map_symbol.patch new file mode 100644 index 00000000000..8fa5cf3e637 --- /dev/null +++ b/queue-6.19/perf-annotate-fix-args-leak-of-map_symbol.patch @@ -0,0 +1,421 @@ +From 132846ea1a417dffff8307e6ccc7c575ea234364 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 13:35:06 -0800 +Subject: perf annotate: Fix args leak of map_symbol +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ian Rogers + +[ Upstream commit 00419892bac28bf148450d762bbff990a6bd5494 ] + +map_symbol__exit() needs calling on an annotate_args.ms, however, rather +than introduce proper reference count handling to symbol__annotate() +just switch to passing the map_symbol pointer parameter around, making +the puts the caller's responsibility. + +Fix a number of cases to ensure the map in a map_symbol has a +reference count increment and add the then necessary map_symbol_exits. + +Fixes: 56e144fe98260a0f ("perf mem_info: Add and use map_symbol__exit and addr_map_symbol__exit") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Cc: Aditya Bodkhe +Cc: Adrian Hunter +Cc: Albert Ou +Cc: Alexander Shishkin +Cc: Alexandre Ghiti +Cc: Athira Rajeev +Cc: Bill Wendling +Cc: Dr. David Alan Gilbert +Cc: Guo Ren +Cc: Howard Chu +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: John Garry +Cc: Julia Lawall +Cc: Justin Stitt +Cc: Krzysztof Łopatowski +Cc: Leo Yan +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux-csky@vger.kernel.org +Cc: linux-riscv@lists.infradead.org +Cc: Namhyung Kim +Cc: Nathan Chancellor +Cc: Nick Desaulniers +Cc: Palmer Dabbelt +Cc: Paul Walmsley +Cc: Peter Zijlstra +Cc: Sergei Trofimovich +Cc: Shimin Guo +Cc: Suchit Karunakaran +Cc: Thomas Falcon +Cc: Tianyou Li +Cc: Will Deacon +Cc: Zecheng Li +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + .../arch/loongarch/annotate/instructions.c | 14 ++++---- + tools/perf/arch/s390/annotate/instructions.c | 11 +++--- + tools/perf/util/annotate.c | 2 +- + tools/perf/util/capstone.c | 14 ++++---- + tools/perf/util/disasm.c | 36 ++++++++++--------- + tools/perf/util/disasm.h | 2 +- + tools/perf/util/llvm.c | 6 ++-- + 7 files changed, 47 insertions(+), 38 deletions(-) + +diff --git a/tools/perf/arch/loongarch/annotate/instructions.c b/tools/perf/arch/loongarch/annotate/instructions.c +index 70262d5f14442..1c3abb43c8d72 100644 +--- a/tools/perf/arch/loongarch/annotate/instructions.c ++++ b/tools/perf/arch/loongarch/annotate/instructions.c +@@ -10,9 +10,7 @@ static int loongarch_call__parse(struct arch *arch, struct ins_operands *ops, st + { + char *c, *endptr, *tok, *name; + struct map *map = ms->map; +- struct addr_map_symbol target = { +- .ms = { .map = map, }, +- }; ++ struct addr_map_symbol target; + + c = strchr(ops->raw, '#'); + if (c++ == NULL) +@@ -38,12 +36,16 @@ static int loongarch_call__parse(struct arch *arch, struct ins_operands *ops, st + if (ops->target.name == NULL) + return -1; + +- target.addr = map__objdump_2mem(map, ops->target.addr); ++ target = (struct addr_map_symbol) { ++ .ms = { .map = map__get(map), }, ++ .addr = map__objdump_2mem(map, ops->target.addr), ++ }; + + if (maps__find_ams(ms->maps, &target) == 0 && + map__rip_2objdump(target.ms.map, map__map_ip(target.ms.map, target.addr)) == ops->target.addr) + ops->target.sym = target.ms.sym; + ++ addr_map_symbol__exit(&target); + return 0; + } + +@@ -58,7 +60,7 @@ static int loongarch_jump__parse(struct arch *arch, struct ins_operands *ops, st + struct map *map = ms->map; + struct symbol *sym = ms->sym; + struct addr_map_symbol target = { +- .ms = { .map = map, }, ++ .ms = { .map = map__get(map), }, + }; + const char *c = strchr(ops->raw, '#'); + u64 start, end; +@@ -90,7 +92,7 @@ static int loongarch_jump__parse(struct arch *arch, struct ins_operands *ops, st + } else { + ops->target.offset_avail = false; + } +- ++ addr_map_symbol__exit(&target); + return 0; + } + +diff --git a/tools/perf/arch/s390/annotate/instructions.c b/tools/perf/arch/s390/annotate/instructions.c +index c61193f1e0964..626e6d2cbc81a 100644 +--- a/tools/perf/arch/s390/annotate/instructions.c ++++ b/tools/perf/arch/s390/annotate/instructions.c +@@ -6,9 +6,7 @@ static int s390_call__parse(struct arch *arch, struct ins_operands *ops, + { + char *endptr, *tok, *name; + struct map *map = ms->map; +- struct addr_map_symbol target = { +- .ms = { .map = map, }, +- }; ++ struct addr_map_symbol target; + + tok = strchr(ops->raw, ','); + if (!tok) +@@ -36,12 +34,17 @@ static int s390_call__parse(struct arch *arch, struct ins_operands *ops, + + if (ops->target.name == NULL) + return -1; +- target.addr = map__objdump_2mem(map, ops->target.addr); ++ ++ target = (struct addr_map_symbol) { ++ .ms = { .map = map__get(map), }, ++ .addr = map__objdump_2mem(map, ops->target.addr), ++ }; + + if (maps__find_ams(ms->maps, &target) == 0 && + map__rip_2objdump(target.ms.map, map__map_ip(target.ms.map, target.addr)) == ops->target.addr) + ops->target.sym = target.ms.sym; + ++ addr_map_symbol__exit(&target); + return 0; + } + +diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c +index cc7764455faf6..791d60f97c23e 100644 +--- a/tools/perf/util/annotate.c ++++ b/tools/perf/util/annotate.c +@@ -1031,7 +1031,7 @@ int symbol__annotate(struct map_symbol *ms, struct evsel *evsel, + return 0; + + args.arch = arch; +- args.ms = *ms; ++ args.ms = ms; + + if (notes->src == NULL) { + notes->src = annotated_source__new(); +diff --git a/tools/perf/util/capstone.c b/tools/perf/util/capstone.c +index be5fd44b1f9dc..2c7feab61b7bf 100644 +--- a/tools/perf/util/capstone.c ++++ b/tools/perf/util/capstone.c +@@ -143,7 +143,7 @@ static void print_capstone_detail(cs_insn *insn, char *buf, size_t len, + struct annotate_args *args, u64 addr) + { + int i; +- struct map *map = args->ms.map; ++ struct map *map = args->ms->map; + struct symbol *sym; + + /* TODO: support more architectures */ +@@ -222,7 +222,7 @@ int symbol__disassemble_capstone(const char *filename __maybe_unused, + { + #ifdef HAVE_LIBCAPSTONE_SUPPORT + struct annotation *notes = symbol__annotation(sym); +- struct map *map = args->ms.map; ++ struct map *map = args->ms->map; + struct dso *dso = map__dso(map); + u64 start = map__rip_2objdump(map, sym->start); + u64 offset; +@@ -256,7 +256,7 @@ int symbol__disassemble_capstone(const char *filename __maybe_unused, + args->line = disasm_buf; + args->line_nr = 0; + args->fileloc = NULL; +- args->ms.sym = sym; ++ args->ms->sym = sym; + + dl = disasm_line__new(args); + if (dl == NULL) +@@ -268,7 +268,7 @@ int symbol__disassemble_capstone(const char *filename __maybe_unused, + !strcmp(args->options->disassembler_style, "att")) + disassembler_style = true; + +- if (capstone_init(maps__machine(args->ms.maps), &handle, is_64bit, disassembler_style) < 0) ++ if (capstone_init(maps__machine(args->ms->maps), &handle, is_64bit, disassembler_style) < 0) + goto err; + + needs_cs_close = true; +@@ -345,7 +345,7 @@ int symbol__disassemble_capstone_powerpc(const char *filename __maybe_unused, + { + #ifdef HAVE_LIBCAPSTONE_SUPPORT + struct annotation *notes = symbol__annotation(sym); +- struct map *map = args->ms.map; ++ struct map *map = args->ms->map; + struct dso *dso = map__dso(map); + struct nscookie nsc; + u64 start = map__rip_2objdump(map, sym->start); +@@ -382,7 +382,7 @@ int symbol__disassemble_capstone_powerpc(const char *filename __maybe_unused, + !strcmp(args->options->disassembler_style, "att")) + disassembler_style = true; + +- if (capstone_init(maps__machine(args->ms.maps), &handle, is_64bit, disassembler_style) < 0) ++ if (capstone_init(maps__machine(args->ms->maps), &handle, is_64bit, disassembler_style) < 0) + goto err; + + needs_cs_close = true; +@@ -408,7 +408,7 @@ int symbol__disassemble_capstone_powerpc(const char *filename __maybe_unused, + args->line = disasm_buf; + args->line_nr = 0; + args->fileloc = NULL; +- args->ms.sym = sym; ++ args->ms->sym = sym; + + dl = disasm_line__new(args); + if (dl == NULL) +diff --git a/tools/perf/util/disasm.c b/tools/perf/util/disasm.c +index 50b9433f3f8e6..924429142631a 100644 +--- a/tools/perf/util/disasm.c ++++ b/tools/perf/util/disasm.c +@@ -269,9 +269,7 @@ static int call__parse(struct arch *arch, struct ins_operands *ops, struct map_s + { + char *endptr, *tok, *name; + struct map *map = ms->map; +- struct addr_map_symbol target = { +- .ms = { .map = map, }, +- }; ++ struct addr_map_symbol target; + + ops->target.addr = strtoull(ops->raw, &endptr, 16); + +@@ -296,12 +294,16 @@ static int call__parse(struct arch *arch, struct ins_operands *ops, struct map_s + if (ops->target.name == NULL) + return -1; + find_target: +- target.addr = map__objdump_2mem(map, ops->target.addr); ++ target = (struct addr_map_symbol) { ++ .ms = { .map = map__get(map), }, ++ .addr = map__objdump_2mem(map, ops->target.addr), ++ }; + + if (maps__find_ams(ms->maps, &target) == 0 && + map__rip_2objdump(target.ms.map, map__map_ip(target.ms.map, target.addr)) == ops->target.addr) + ops->target.sym = target.ms.sym; + ++ addr_map_symbol__exit(&target); + return 0; + + indirect_call: +@@ -366,7 +368,7 @@ static int jump__parse(struct arch *arch, struct ins_operands *ops, struct map_s + struct map *map = ms->map; + struct symbol *sym = ms->sym; + struct addr_map_symbol target = { +- .ms = { .map = map, }, ++ .ms = { .map = map__get(map), }, + }; + const char *c = strchr(ops->raw, ','); + u64 start, end; +@@ -440,7 +442,7 @@ static int jump__parse(struct arch *arch, struct ins_operands *ops, struct map_s + } else { + ops->target.offset_avail = false; + } +- ++ addr_map_symbol__exit(&target); + return 0; + } + +@@ -1046,7 +1048,7 @@ static size_t disasm_line_size(int nr) + struct disasm_line *disasm_line__new(struct annotate_args *args) + { + struct disasm_line *dl = NULL; +- struct annotation *notes = symbol__annotation(args->ms.sym); ++ struct annotation *notes = symbol__annotation(args->ms->sym); + int nr = notes->src->nr_events; + + dl = zalloc(disasm_line_size(nr)); +@@ -1064,7 +1066,7 @@ struct disasm_line *disasm_line__new(struct annotate_args *args) + } else if (disasm_line__parse(dl->al.line, &dl->ins.name, &dl->ops.raw) < 0) + goto out_free_line; + +- disasm_line__init_ins(dl, args->arch, &args->ms); ++ disasm_line__init_ins(dl, args->arch, args->ms); + } + + return dl; +@@ -1119,7 +1121,7 @@ static int symbol__parse_objdump_line(struct symbol *sym, + struct annotate_args *args, + char *parsed_line, int *line_nr, char **fileloc) + { +- struct map *map = args->ms.map; ++ struct map *map = args->ms->map; + struct annotation *notes = symbol__annotation(sym); + struct disasm_line *dl; + char *tmp; +@@ -1151,7 +1153,7 @@ static int symbol__parse_objdump_line(struct symbol *sym, + args->line = parsed_line; + args->line_nr = *line_nr; + args->fileloc = *fileloc; +- args->ms.sym = sym; ++ args->ms->sym = sym; + + dl = disasm_line__new(args); + (*line_nr)++; +@@ -1169,12 +1171,14 @@ static int symbol__parse_objdump_line(struct symbol *sym, + if (dl->ins.ops && ins__is_call(&dl->ins) && !dl->ops.target.sym) { + struct addr_map_symbol target = { + .addr = dl->ops.target.addr, +- .ms = { .map = map, }, ++ .ms = { .map = map__get(map), }, + }; + +- if (!maps__find_ams(args->ms.maps, &target) && ++ if (!maps__find_ams(args->ms->maps, &target) && + target.ms.sym->start == target.al_addr) + dl->ops.target.sym = target.ms.sym; ++ ++ addr_map_symbol__exit(&target); + } + + annotation_line__add(&dl->al, ¬es->src->source); +@@ -1338,7 +1342,7 @@ static int symbol__disassemble_raw(char *filename, struct symbol *sym, + struct annotate_args *args) + { + struct annotation *notes = symbol__annotation(sym); +- struct map *map = args->ms.map; ++ struct map *map = args->ms->map; + struct dso *dso = map__dso(map); + u64 start = map__rip_2objdump(map, sym->start); + u64 end = map__rip_2objdump(map, sym->end); +@@ -1375,7 +1379,7 @@ static int symbol__disassemble_raw(char *filename, struct symbol *sym, + args->line = disasm_buf; + args->line_nr = 0; + args->fileloc = NULL; +- args->ms.sym = sym; ++ args->ms->sym = sym; + + dl = disasm_line__new(args); + if (dl == NULL) +@@ -1501,7 +1505,7 @@ static int symbol__disassemble_objdump(const char *filename, struct symbol *sym, + struct annotate_args *args) + { + struct annotation_options *opts = &annotate_opts; +- struct map *map = args->ms.map; ++ struct map *map = args->ms->map; + struct dso *dso = map__dso(map); + char *command; + FILE *file; +@@ -1644,7 +1648,7 @@ static int symbol__disassemble_objdump(const char *filename, struct symbol *sym, + int symbol__disassemble(struct symbol *sym, struct annotate_args *args) + { + struct annotation_options *options = args->options; +- struct map *map = args->ms.map; ++ struct map *map = args->ms->map; + struct dso *dso = map__dso(map); + char symfs_filename[PATH_MAX]; + bool delete_extract = false; +diff --git a/tools/perf/util/disasm.h b/tools/perf/util/disasm.h +index d2cb555e4a3be..a3ea9d6762816 100644 +--- a/tools/perf/util/disasm.h ++++ b/tools/perf/util/disasm.h +@@ -97,7 +97,7 @@ struct ins_ops { + + struct annotate_args { + struct arch *arch; +- struct map_symbol ms; ++ struct map_symbol *ms; + struct annotation_options *options; + s64 offset; + char *line; +diff --git a/tools/perf/util/llvm.c b/tools/perf/util/llvm.c +index 2ebf1f5f65bf7..4ada9a10bd93f 100644 +--- a/tools/perf/util/llvm.c ++++ b/tools/perf/util/llvm.c +@@ -118,7 +118,7 @@ int symbol__disassemble_llvm(const char *filename, struct symbol *sym, + { + #ifdef HAVE_LIBLLVM_SUPPORT + struct annotation *notes = symbol__annotation(sym); +- struct map *map = args->ms.map; ++ struct map *map = args->ms->map; + struct dso *dso = map__dso(map); + u64 start = map__rip_2objdump(map, sym->start); + /* Malloc-ed buffer containing instructions read from disk. */ +@@ -184,7 +184,7 @@ int symbol__disassemble_llvm(const char *filename, struct symbol *sym, + args->line = disasm_buf; + args->line_nr = 0; + args->fileloc = NULL; +- args->ms.sym = sym; ++ args->ms->sym = sym; + + dl = disasm_line__new(args); + if (dl == NULL) +@@ -242,7 +242,7 @@ int symbol__disassemble_llvm(const char *filename, struct symbol *sym, + &line_storage_len); + args->line_nr = 0; + args->fileloc = NULL; +- args->ms.sym = sym; ++ args->ms->sym = sym; + + llvm_addr2line(filename, pc, &args->fileloc, + (unsigned int *)&args->line_nr, false, NULL); +-- +2.51.0 + diff --git a/queue-6.19/perf-annotate-fix-build_nondistro-1-missing-args-ms-.patch b/queue-6.19/perf-annotate-fix-build_nondistro-1-missing-args-ms-.patch new file mode 100644 index 00000000000..29d9dc6bdf0 --- /dev/null +++ b/queue-6.19/perf-annotate-fix-build_nondistro-1-missing-args-ms-.patch @@ -0,0 +1,55 @@ +From 12b505efd1e0f76149a1be9198ae4036b53e7658 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jan 2026 17:25:00 -0300 +Subject: perf annotate: Fix BUILD_NONDISTRO=1 missing args->ms conversions to + pointer + +From: Arnaldo Carvalho de Melo + +[ Upstream commit dda5f926a1006c735b00ed5c27291fce64236656 ] + +Fix a few missing conversions to pointer in the usage of 'struct +annotate_args' 'ms' member in symbol__disassemble_bpf_libbfd(). + +Fixes: 00419892bac28bf1 ("perf annotate: Fix args leak of map_symbol") +Reviewed-by: Ian Rogers +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/libbfd.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/util/libbfd.c b/tools/perf/util/libbfd.c +index 79f4528234a9d..63ea3fb53e77d 100644 +--- a/tools/perf/util/libbfd.c ++++ b/tools/perf/util/libbfd.c +@@ -501,7 +501,7 @@ int symbol__disassemble_bpf_libbfd(struct symbol *sym __maybe_unused, + struct bpf_prog_info_node *info_node; + int len = sym->end - sym->start; + disassembler_ftype disassemble; +- struct map *map = args->ms.map; ++ struct map *map = args->ms->map; + struct perf_bpil *info_linear; + struct disassemble_info info; + struct dso *dso = map__dso(map); +@@ -612,7 +612,7 @@ int symbol__disassemble_bpf_libbfd(struct symbol *sym __maybe_unused, + args->line = strdup(srcline); + args->line_nr = 0; + args->fileloc = NULL; +- args->ms.sym = sym; ++ args->ms->sym = sym; + dl = disasm_line__new(args); + if (dl) { + annotation_line__add(&dl->al, +@@ -624,7 +624,7 @@ int symbol__disassemble_bpf_libbfd(struct symbol *sym __maybe_unused, + args->line = buf + prev_buf_size; + args->line_nr = 0; + args->fileloc = NULL; +- args->ms.sym = sym; ++ args->ms->sym = sym; + dl = disasm_line__new(args); + if (dl) + annotation_line__add(&dl->al, ¬es->src->source); +-- +2.51.0 + diff --git a/queue-6.19/perf-annotate-fix-memcpy-size-in-arch__grow_instruct.patch b/queue-6.19/perf-annotate-fix-memcpy-size-in-arch__grow_instruct.patch new file mode 100644 index 00000000000..78dfe435833 --- /dev/null +++ b/queue-6.19/perf-annotate-fix-memcpy-size-in-arch__grow_instruct.patch @@ -0,0 +1,52 @@ +From df698c1c2e545c21e554cb13c23d4eab63ac4bb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 22:47:04 +0530 +Subject: perf annotate: Fix memcpy size in arch__grow_instructions() + +From: Suchit Karunakaran + +[ Upstream commit f0d98c78f8bf73ce2a9b7793f66cda240fa9ab10 ] + +The memcpy() in arch__grow_instructions() is copying the wrong number of +bytes when growing from a non-allocated table. + +It should copy arch->nr_instructions * sizeof(struct ins) bytes, not +just arch->nr_instructions bytes. + +This bug causes data corruption as only a partial copy of the +instruction table is made, leading to garbage data in most entries and +potential crashes + +Fixes: 2a1ff812c40be982 ("perf annotate: Introduce alternative method of keeping instructions table") +Reviewed-by: Ian Rogers +Signed-off-by: Suchit Karunakaran +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/disasm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/disasm.c b/tools/perf/util/disasm.c +index 924429142631a..88706b98b9064 100644 +--- a/tools/perf/util/disasm.c ++++ b/tools/perf/util/disasm.c +@@ -81,7 +81,7 @@ static int arch__grow_instructions(struct arch *arch) + if (new_instructions == NULL) + return -1; + +- memcpy(new_instructions, arch->instructions, arch->nr_instructions); ++ memcpy(new_instructions, arch->instructions, arch->nr_instructions * sizeof(struct ins)); + goto out_update_instructions; + } + +-- +2.51.0 + diff --git a/queue-6.19/perf-arm-cmn-support-cmn-600ae.patch b/queue-6.19/perf-arm-cmn-support-cmn-600ae.patch new file mode 100644 index 00000000000..9f926bc739f --- /dev/null +++ b/queue-6.19/perf-arm-cmn-support-cmn-600ae.patch @@ -0,0 +1,50 @@ +From 4f658e21137806cc2d9189e58f9ddf598cc4dc7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 16:39:54 +0000 +Subject: perf/arm-cmn: Support CMN-600AE + +From: Robin Murphy + +[ Upstream commit 12a94953c37e834c3eabb839ce057094946fe67a ] + +The functional safety features of CMN-600AE have little to no impact on +the PMU relative to the base CMN-600 design, so for simplicity we can +reasonably just treat it as the same thing. The only obvious difference +is that the revision numbers aren't aligned, so we may hide some aliases +for events which do actually exist, but those can still be specified via +the underlying "type,eventid" format so it's not too big a deal. + +Signed-off-by: Robin Murphy +Reviewed-by: Ilkka Koskinen +Tested-by: Michal Simek +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm-cmn.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c +index 23245352a3fc0..651edd73bfcb1 100644 +--- a/drivers/perf/arm-cmn.c ++++ b/drivers/perf/arm-cmn.c +@@ -210,6 +210,7 @@ enum cmn_model { + enum cmn_part { + PART_CMN600 = 0x434, + PART_CMN650 = 0x436, ++ PART_CMN600AE = 0x438, + PART_CMN700 = 0x43c, + PART_CI700 = 0x43a, + PART_CMN_S3 = 0x43e, +@@ -2266,6 +2267,9 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset) + reg = readq_relaxed(cfg_region + CMN_CFGM_PERIPH_ID_01); + part = FIELD_GET(CMN_CFGM_PID0_PART_0, reg); + part |= FIELD_GET(CMN_CFGM_PID1_PART_1, reg) << 8; ++ /* 600AE is close enough that it's not really worth more complexity */ ++ if (part == PART_CMN600AE) ++ part = PART_CMN600; + if (cmn->part && cmn->part != part) + dev_warn(cmn->dev, + "Firmware binding mismatch: expected part number 0x%x, found 0x%x\n", +-- +2.51.0 + diff --git a/queue-6.19/perf-build-raise-minimum-shellcheck-version-to-0.7.2.patch b/queue-6.19/perf-build-raise-minimum-shellcheck-version-to-0.7.2.patch new file mode 100644 index 00000000000..6e29e4dfb6f --- /dev/null +++ b/queue-6.19/perf-build-raise-minimum-shellcheck-version-to-0.7.2.patch @@ -0,0 +1,69 @@ +From 143a491a318355fce8f2c3979e585cfca8fa3e37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:29:10 +0100 +Subject: perf build: Raise minimum shellcheck version to 0.7.2 + +From: Nicolas Schier + +[ Upstream commit 383f8e26e2c483e25453f8c3d0839877708ac701 ] + +Raise the minimum shellcheck version for perf builds to 0.7.2, so that +systems with shellcheck versions below 0.7.2 will automatically skip the +shell script checking, even if NO_SHELLCHECK is unset. + +Since commit 241f21be7d0fdf3c ("perf test perftool_testsuite: Use +absolute paths"), shellcheck versions before 0.7.2 break the perf build +with several SC1090 [2] warnings due to its too strict dynamic source +handling [1], e.g.: + + In tests/shell/base_probe/test_line_semantics.sh line 20: + . "$DIR_PATH/../common/init.sh" + ^---------------------------^ SC1090: Can't follow non-constant source. Use a directive to specify location. + +Fixes: 241f21be7d0fdf3c ("perf test perftool_testsuite: Use absolute paths") +Signed-off-by: Nicolas Schier +Acked-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jakub Brnak +Cc: James Clark +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Michael Petlan +Cc: Nicolas Schier +Cc: Peter Zijlstra +Cc: Philipp Hahn +Cc: Veronika Molnarova +Link: https://github.com/koalaman/shellcheck/issues/1998 # [1] +Link: https://www.shellcheck.net/wiki/SC1090 +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/Makefile.perf | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf +index b3f481a626afa..e6895626c1872 100644 +--- a/tools/perf/Makefile.perf ++++ b/tools/perf/Makefile.perf +@@ -251,11 +251,12 @@ else + endif + + # shellcheck is using in tools/perf/tests/Build with option -a/--check-sourced ( +-# introduced in v0.4.7) and -S/--severity (introduced in v0.6.0). So make the +-# minimal shellcheck version as v0.6.0. ++# introduced in v0.4.7) and -S/--severity (introduced in v0.6.0) as well as ++# dynamic source inclusions (properly handled since v0.7.2). ++# So make the minimal shellcheck version as v0.7.2. + ifneq ($(SHELLCHECK),) + ifeq ($(shell expr $(shell $(SHELLCHECK) --version | grep version: | \ +- sed -e 's/.\+ \([0-9]\+\).\([0-9]\+\).\([0-9]\+\)/\1\2\3/g') \< 060), 1) ++ sed -e 's/.\+ \([0-9]\+\).\([0-9]\+\).\([0-9]\+\)/\1\2\3/g') \< 072), 1) + SHELLCHECK := + else + SHELLCHECK := $(SHELLCHECK) -s bash -a -S warning +-- +2.51.0 + diff --git a/queue-6.19/perf-build-remove-no_libcap-that-controls-nothing.patch b/queue-6.19/perf-build-remove-no_libcap-that-controls-nothing.patch new file mode 100644 index 00000000000..104ae1a794f --- /dev/null +++ b/queue-6.19/perf-build-remove-no_libcap-that-controls-nothing.patch @@ -0,0 +1,62 @@ +From e706d634cd51d5e8ce2d44368f5b352de826c9db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 15:35:39 -0800 +Subject: perf build: Remove NO_LIBCAP that controls nothing + +From: Ian Rogers + +[ Upstream commit 169343cc8ff2bd59758760d867bd26adae866a2b ] + +Using libcap was removed in commit e25ebda78e230283 ("perf cap: Tidy up +and improve capability testing") and improve capability testing"), +however, some build documentation and a use of the NO_LIBCAP=1 were +lingering. + +Remove these left over bits. + +Fixes: e25ebda78e230283 ("perf cap: Tidy up and improve capability testing") +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/Makefile.perf | 2 -- + tools/perf/tests/make | 2 +- + 2 files changed, 1 insertion(+), 3 deletions(-) + +diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf +index e6895626c1872..fbeb5c81c8072 100644 +--- a/tools/perf/Makefile.perf ++++ b/tools/perf/Makefile.perf +@@ -86,8 +86,6 @@ include ../scripts/utilities.mak + # + # Define NO_LIBBPF if you do not want BPF support + # +-# Define NO_LIBCAP if you do not want process capabilities considered by perf +-# + # Define NO_SDT if you do not want to define SDT event in perf tools, + # note that it doesn't disable SDT scanning support. + # +diff --git a/tools/perf/tests/make b/tools/perf/tests/make +index 6641701e48285..c721cd1bcaa9a 100644 +--- a/tools/perf/tests/make ++++ b/tools/perf/tests/make +@@ -122,7 +122,7 @@ make_minimal += NO_DEMANGLE=1 NO_LIBELF=1 NO_BACKTRACE=1 + make_minimal += NO_LIBNUMA=1 NO_LIBBIONIC=1 NO_LIBDW=1 + make_minimal += NO_LIBDW_DWARF_UNWIND=1 NO_LIBBPF=1 + make_minimal += NO_SDT=1 NO_JVMTI=1 NO_LIBZSTD=1 +-make_minimal += NO_LIBCAP=1 NO_CAPSTONE=1 ++make_minimal += NO_CAPSTONE=1 + + # $(run) contains all available tests + run := make_pure +-- +2.51.0 + diff --git a/queue-6.19/perf-callchain-fix-srcline-printing-with-inlines.patch b/queue-6.19/perf-callchain-fix-srcline-printing-with-inlines.patch new file mode 100644 index 00000000000..bf15275d773 --- /dev/null +++ b/queue-6.19/perf-callchain-fix-srcline-printing-with-inlines.patch @@ -0,0 +1,55 @@ +From 2dcfde82523c770ce07c52d3a163334f9b8bb4e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 20:13:36 -0800 +Subject: perf callchain: Fix srcline printing with inlines + +From: Ian Rogers + +[ Upstream commit abec464767b5d26f0612250d511c18f420826ca1 ] + +sample__fprintf_callchain() was using map__fprintf_srcline() which won't +report inline line numbers. + +Fix by using the srcline from the callchain and falling back to the map +variant. + +Fixes: 25da4fab5f66e659 ("perf evsel: Move fprintf methods to separate source file") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Stephen Brennan +Cc: Tony Jones +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/evsel_fprintf.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/evsel_fprintf.c b/tools/perf/util/evsel_fprintf.c +index 10f1a03c28601..5521d00bff2c0 100644 +--- a/tools/perf/util/evsel_fprintf.c ++++ b/tools/perf/util/evsel_fprintf.c +@@ -185,8 +185,12 @@ int sample__fprintf_callchain(struct perf_sample *sample, int left_alignment, + if (print_dso && (!sym || !sym->inlined)) + printed += map__fprintf_dsoname_dsoff(map, print_dsoff, addr, fp); + +- if (print_srcline) +- printed += map__fprintf_srcline(map, addr, "\n ", fp); ++ if (print_srcline) { ++ if (node->srcline) ++ printed += fprintf(fp, "\n %s", node->srcline); ++ else ++ printed += map__fprintf_srcline(map, addr, "\n ", fp); ++ } + + if (sym && sym->inlined) + printed += fprintf(fp, " (inlined)"); +-- +2.51.0 + diff --git a/queue-6.19/perf-core-fix-slow-perf_event_task_exit-with-lbr-cal.patch b/queue-6.19/perf-core-fix-slow-perf_event_task_exit-with-lbr-cal.patch new file mode 100644 index 00000000000..e870d17a8a6 --- /dev/null +++ b/queue-6.19/perf-core-fix-slow-perf_event_task_exit-with-lbr-cal.patch @@ -0,0 +1,92 @@ +From 3276e1c102bd7c99b43e65048963d5f7279aaee3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 08:51:57 -0800 +Subject: perf/core: Fix slow perf_event_task_exit() with LBR callstacks + +From: Namhyung Kim + +[ Upstream commit 4960626f956d63dce57f099016c2ecbe637a8229 ] + +I got a report that a task is stuck in perf_event_exit_task() waiting +for global_ctx_data_rwsem. On large systems with lots threads, it'd +have performance issues when it grabs the lock to iterate all threads +in the system to allocate the context data. + +And it'd block task exit path which is problematic especially under +memory pressure. + + perf_event_open + perf_event_alloc + attach_perf_ctx_data + attach_global_ctx_data + percpu_down_write (global_ctx_data_rwsem) + for_each_process_thread + alloc_task_ctx_data + do_exit + perf_event_exit_task + percpu_down_read (global_ctx_data_rwsem) + +It should not hold the global_ctx_data_rwsem on the exit path. Let's +skip allocation for exiting tasks and free the data carefully. + +Reported-by: Rosalie Fang +Suggested-by: Peter Zijlstra +Signed-off-by: Namhyung Kim +Signed-off-by: Peter Zijlstra (Intel) +Link: https://patch.msgid.link/20260112165157.1919624-1-namhyung@kernel.org +Signed-off-by: Sasha Levin +--- + kernel/events/core.c | 20 ++++++++++++++++++-- + 1 file changed, 18 insertions(+), 2 deletions(-) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 8cca800946248..69c56cad88a89 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -5280,9 +5280,20 @@ attach_task_ctx_data(struct task_struct *task, struct kmem_cache *ctx_cache, + return -ENOMEM; + + for (;;) { +- if (try_cmpxchg((struct perf_ctx_data **)&task->perf_ctx_data, &old, cd)) { ++ if (try_cmpxchg(&task->perf_ctx_data, &old, cd)) { + if (old) + perf_free_ctx_data_rcu(old); ++ /* ++ * Above try_cmpxchg() pairs with try_cmpxchg() from ++ * detach_task_ctx_data() such that ++ * if we race with perf_event_exit_task(), we must ++ * observe PF_EXITING. ++ */ ++ if (task->flags & PF_EXITING) { ++ /* detach_task_ctx_data() may free it already */ ++ if (try_cmpxchg(&task->perf_ctx_data, &cd, NULL)) ++ perf_free_ctx_data_rcu(cd); ++ } + return 0; + } + +@@ -5328,6 +5339,8 @@ attach_global_ctx_data(struct kmem_cache *ctx_cache) + /* Allocate everything */ + scoped_guard (rcu) { + for_each_process_thread(g, p) { ++ if (p->flags & PF_EXITING) ++ continue; + cd = rcu_dereference(p->perf_ctx_data); + if (cd && !cd->global) { + cd->global = 1; +@@ -14294,8 +14307,11 @@ void perf_event_exit_task(struct task_struct *task) + + /* + * Detach the perf_ctx_data for the system-wide event. ++ * ++ * Done without holding global_ctx_data_rwsem; typically ++ * attach_global_ctx_data() will skip over this task, but otherwise ++ * attach_task_ctx_data() will observe PF_EXITING. + */ +- guard(percpu_read)(&global_ctx_data_rwsem); + detach_task_ctx_data(task); + } + +-- +2.51.0 + diff --git a/queue-6.19/perf-cs-etm-fix-decoding-for-sparse-cpu-maps.patch b/queue-6.19/perf-cs-etm-fix-decoding-for-sparse-cpu-maps.patch new file mode 100644 index 00000000000..c385bcb5ac3 --- /dev/null +++ b/queue-6.19/perf-cs-etm-fix-decoding-for-sparse-cpu-maps.patch @@ -0,0 +1,120 @@ +From 6af646327c4cc1259ca7fade9c8569db19b779d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 10:18:35 +0000 +Subject: perf cs-etm: Fix decoding for sparse CPU maps + +From: James Clark + +[ Upstream commit a70493e2bb0878885aa7a8178162550270693eb1 ] + +The ETM decoder incorrectly assumed that auxtrace queue indices were +equivalent to CPU number. This assumption is used for inserting records +into the queue, and for fetching queues when given a CPU number. This +assumption held when Perf always opened a dummy event on every CPU, even +if the user provided a subset of CPUs on the commandline, resulting in +the indices aligning. + +For example: + + # event : name = cs_etm//u, , id = { 2451, 2452 }, type = 11 (cs_etm), size = 136, config = 0x4010, { sample_period, samp> + # event : name = dummy:u, , id = { 2453, 2454, 2455, 2456 }, type = 1 (PERF_TYPE_SOFTWARE), size = 136, config = 0x9 (PER> + + 0 0 0x200 [0xd0]: PERF_RECORD_ID_INDEX nr: 6 + ... id: 2451 idx: 2 cpu: 2 tid: -1 + ... id: 2452 idx: 3 cpu: 3 tid: -1 + ... id: 2453 idx: 0 cpu: 0 tid: -1 + ... id: 2454 idx: 1 cpu: 1 tid: -1 + ... id: 2455 idx: 2 cpu: 2 tid: -1 + ... id: 2456 idx: 3 cpu: 3 tid: -1 + +Since commit 811082e4b668 ("perf parse-events: Support user CPUs mixed +with threads/processes") the dummy event no longer behaves in this way, +making the ETM event indices start from 0 on the first CPU recorded +regardless of its ID: + + # event : name = cs_etm//u, , id = { 771, 772 }, type = 11 (cs_etm), size = 144, config = 0x4010, { sample_period, sample> + # event : name = dummy:u, , id = { 773, 774 }, type = 1 (PERF_TYPE_SOFTWARE), size = 144, config = 0x9 (PERF_COUNT_SW_DUM> + + 0 0 0x200 [0x90]: PERF_RECORD_ID_INDEX nr: 4 + ... id: 771 idx: 0 cpu: 2 tid: -1 + ... id: 772 idx: 1 cpu: 3 tid: -1 + ... id: 773 idx: 0 cpu: 2 tid: -1 + ... id: 774 idx: 1 cpu: 3 tid: -1 + +This causes the following segfault when decoding: + + $ perf record -e cs_etm//u -C 2,3 -- true + $ perf report + + perf: Segmentation fault + -------- backtrace -------- + #0 0xaaaabf9fd020 in ui__signal_backtrace setup.c:110 + #1 0xffffab5c7930 in __kernel_rt_sigreturn [vdso][930] + #2 0xaaaabfb68d30 in cs_etm_decoder__reset cs-etm-decoder.c:85 + #3 0xaaaabfb65930 in cs_etm__get_data_block cs-etm.c:2032 + #4 0xaaaabfb666fc in cs_etm__run_per_cpu_timeless_decoder cs-etm.c:2551 + #5 0xaaaabfb6692c in (cs_etm__process_timeless_queues cs-etm.c:2612 + #6 0xaaaabfb63390 in cs_etm__flush_events cs-etm.c:921 + #7 0xaaaabfb324c0 in auxtrace__flush_events auxtrace.c:2915 + #8 0xaaaabfaac378 in __perf_session__process_events session.c:2285 + #9 0xaaaabfaacc9c in perf_session__process_events session.c:2442 + #10 0xaaaabf8d3d90 in __cmd_report builtin-report.c:1085 + #11 0xaaaabf8d6944 in cmd_report builtin-report.c:1866 + #12 0xaaaabf95ebfc in run_builtin perf.c:351 + #13 0xaaaabf95eeb0 in handle_internal_command perf.c:404 + #14 0xaaaabf95f068 in run_argv perf.c:451 + #15 0xaaaabf95f390 in main perf.c:558 + #16 0xffffaab97400 in __libc_start_call_main libc_start_call_main.h:74 + #17 0xffffaab974d8 in __libc_start_main@@GLIBC_2.34 libc-start.c:128 + #18 0xaaaabf8aa8f0 in _start perf[7a8f0] + +Fix it by inserting into the queues based on CPU number, rather than +using the index. + +Fixes: 811082e4b668db96 ("perf parse-events: Support user CPUs mixed with threads/processes") +Signed-off-by: James Clark +Tested-by: Leo Yan +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: coresight@lists.linaro.org +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: John Garry +Cc: Mark Rutland +Cc: Mike Leach +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Suzuki Poulouse +Cc: Thomas Falcon +Cc: Will Deacon +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/cs-etm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c +index 25d56e0f1c078..12b55c2bc2ca4 100644 +--- a/tools/perf/util/cs-etm.c ++++ b/tools/perf/util/cs-etm.c +@@ -3086,7 +3086,7 @@ static int cs_etm__queue_aux_fragment(struct perf_session *session, off_t file_o + + if (aux_offset >= auxtrace_event->offset && + aux_offset + aux_size <= auxtrace_event->offset + auxtrace_event->size) { +- struct cs_etm_queue *etmq = etm->queues.queue_array[auxtrace_event->idx].priv; ++ struct cs_etm_queue *etmq = cs_etm__get_queue(etm, auxtrace_event->cpu); + + /* + * If this AUX event was inside this buffer somewhere, create a new auxtrace event +@@ -3095,6 +3095,7 @@ static int cs_etm__queue_aux_fragment(struct perf_session *session, off_t file_o + auxtrace_fragment.auxtrace = *auxtrace_event; + auxtrace_fragment.auxtrace.size = aux_size; + auxtrace_fragment.auxtrace.offset = aux_offset; ++ auxtrace_fragment.auxtrace.idx = etmq->queue_nr; + file_offset += aux_offset - auxtrace_event->offset + auxtrace_event->header.size; + + pr_debug3("CS ETM: Queue buffer size: %#"PRI_lx64" offset: %#"PRI_lx64 +-- +2.51.0 + diff --git a/queue-6.19/perf-cxlpmu-replace-irqf_oneshot-with-irqf_no_thread.patch b/queue-6.19/perf-cxlpmu-replace-irqf_oneshot-with-irqf_no_thread.patch new file mode 100644 index 00000000000..d2c52f6725e --- /dev/null +++ b/queue-6.19/perf-cxlpmu-replace-irqf_oneshot-with-irqf_no_thread.patch @@ -0,0 +1,44 @@ +From 75bf71f3e402613d12bd7332c83a1e538e3f3c75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:34 +0100 +Subject: perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD + +From: Sebastian Andrzej Siewior + +[ Upstream commit ab26d9c85554c4ff1d95ca8341522880ed9219d6 ] + +Passing IRQF_ONESHOT ensures that the interrupt source is masked until +the secondary (threaded) handler is done. If only a primary handler is +used then the flag makes no sense because the interrupt can not fire +(again) while its handler is running. +The flag also disallows force-threading of the primary handler and the +irq-core will warn about this. + +The intention here was probably not allowing forced-threading. + +Replace IRQF_ONESHOT with IRQF_NO_THREAD. + +Reviewed-by: Jonathan Cameron +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/cxl_pmu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/perf/cxl_pmu.c b/drivers/perf/cxl_pmu.c +index d094030220bf2..68a54d97d2a8a 100644 +--- a/drivers/perf/cxl_pmu.c ++++ b/drivers/perf/cxl_pmu.c +@@ -877,7 +877,7 @@ static int cxl_pmu_probe(struct device *dev) + if (!irq_name) + return -ENOMEM; + +- rc = devm_request_irq(dev, irq, cxl_pmu_irq, IRQF_SHARED | IRQF_ONESHOT, ++ rc = devm_request_irq(dev, irq, cxl_pmu_irq, IRQF_SHARED | IRQF_NO_THREAD, + irq_name, info); + if (rc) + return rc; +-- +2.51.0 + diff --git a/queue-6.19/perf-jevents-handle-deleted-jsons-in-out-of-source-b.patch b/queue-6.19/perf-jevents-handle-deleted-jsons-in-out-of-source-b.patch new file mode 100644 index 00000000000..ea821f1f9bf --- /dev/null +++ b/queue-6.19/perf-jevents-handle-deleted-jsons-in-out-of-source-b.patch @@ -0,0 +1,81 @@ +From cfb8a2938a2a1130ad82a2f1b36cd8e598d834b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jan 2026 16:19:40 +0000 +Subject: perf jevents: Handle deleted JSONS in out of source builds + +From: James Clark + +[ Upstream commit 297c9d96e3085116c5cde18170dba716a1f2591e ] + +Make the source folders a dependency for the generated folder root so +that whenever a file is deleted from the source it will force a new +fresh copy of all the JSON files and avoid stale deleted files. + +JSON_DIRS_OUTPUT_ROOT needs to be a dependency of LEGACY_CACHE_JSON so +that the root folder doesn't get cleaned after the legacy JSON is +generated. But this is a no-op with in-source builds as +JSON_DIRS_OUTPUT_ROOT is unset. + +JSON_DIRS is added as a dependency of PMU_EVENTS_C which also forces a +re-build for in source builds when JSON files are deleted. This could +have also resulted in stale builds, but never a broken one. + +Closes: https://lore.kernel.org/linux-next/aW5XSAo88_LBPSYI@sirena.org.uk/ +Fixes: 4bb55de4ff03db3e ("perf jevents: Support copying the source json files to OUTPUT") +Reported-by: Mark Brown +Signed-off-by: James Clark +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/pmu-events/Build | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/pmu-events/Build b/tools/perf/pmu-events/Build +index a46ab7b612dfc..4f9ef624ba70d 100644 +--- a/tools/perf/pmu-events/Build ++++ b/tools/perf/pmu-events/Build +@@ -1,5 +1,6 @@ + pmu-events-y += pmu-events.o + JSON = $(shell find pmu-events/arch -name '*.json' -o -name '*.csv') ++JSON_DIRS = $(shell find pmu-events/arch -type d) + JDIR_TEST = pmu-events/arch/test + JSON_TEST = $(shell [ -d $(JDIR_TEST) ] && \ + find $(JDIR_TEST) -name '*.json') +@@ -31,16 +32,23 @@ $(PMU_EVENTS_C): $(EMPTY_PMU_EVENTS_C) + else + # Copy checked-in json to OUTPUT for generation if it's an out of source build + ifneq ($(OUTPUT),) +-$(OUTPUT)pmu-events/arch/%: pmu-events/arch/% ++# Remove all output directories when any source directory timestamp changes ++# so there are no stale deleted files ++JSON_DIRS_ROOT = $(OUTPUT)pmu-events/arch/ ++$(JSON_DIRS_ROOT): $(JSON_DIRS) ++ $(Q)$(call echo-cmd,gen)rm -rf $@ ++ $(Q)mkdir -p $@ ++ ++$(OUTPUT)pmu-events/arch/%: pmu-events/arch/% $(JSON_DIRS_ROOT) + $(call rule_mkdir) + $(Q)$(call echo-cmd,gen)cp $< $@ + endif + +-$(LEGACY_CACHE_JSON): $(LEGACY_CACHE_PY) ++$(LEGACY_CACHE_JSON): $(LEGACY_CACHE_PY) $(JSON_DIRS_ROOT) + $(call rule_mkdir) + $(Q)$(call echo-cmd,gen)$(PYTHON) $(LEGACY_CACHE_PY) > $@ + +-GEN_JSON = $(patsubst %,$(OUTPUT)%,$(JSON)) $(LEGACY_CACHE_JSON) ++GEN_JSON = $(patsubst %,$(OUTPUT)%,$(JSON)) $(LEGACY_CACHE_JSON) $(JSON_DIRS) + + $(METRIC_TEST_LOG): $(METRIC_TEST_PY) $(METRIC_PY) + $(call rule_mkdir) +-- +2.51.0 + diff --git a/queue-6.19/perf-maps-fix-reference-count-leak-in-maps__find_ams.patch b/queue-6.19/perf-maps-fix-reference-count-leak-in-maps__find_ams.patch new file mode 100644 index 00000000000..3f603030c21 --- /dev/null +++ b/queue-6.19/perf-maps-fix-reference-count-leak-in-maps__find_ams.patch @@ -0,0 +1,71 @@ +From dc96337f8b798e00352fe2e475f834e1ba0d8d40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 13:35:07 -0800 +Subject: perf maps: Fix reference count leak in maps__find_ams() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ian Rogers + +[ Upstream commit 6fdd2676db55b503c52dd3f1359b5c57f774ab75 ] + +ams and so ams->ms.map is an in argument, however, it is also +overwritten. As a map is reference counted, ensure a map__put() is done +before overwriting it. + +Fixes: 42fd623b58dbcc48 ("perf maps: Get map before returning in maps__find") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Cc: Aditya Bodkhe +Cc: Adrian Hunter +Cc: Albert Ou +Cc: Alexander Shishkin +Cc: Alexandre Ghiti +Cc: Athira Rajeev +Cc: Bill Wendling +Cc: Dr. David Alan Gilbert +Cc: Guo Ren +Cc: Howard Chu +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: John Garry +Cc: Julia Lawall +Cc: Justin Stitt +Cc: Krzysztof Łopatowski +Cc: Leo Yan +Cc: Namhyung Kim +Cc: Nathan Chancellor +Cc: Nick Desaulniers +Cc: Palmer Dabbelt +Cc: Paul Walmsley +Cc: Peter Zijlstra +Cc: Sergei Trofimovich +Cc: Shimin Guo +Cc: Suchit Karunakaran +Cc: Thomas Falcon +Cc: Tianyou Li +Cc: Will Deacon +Cc: Zecheng Li +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/maps.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/perf/util/maps.c b/tools/perf/util/maps.c +index c321d4f4d8466..8885c95f02b3e 100644 +--- a/tools/perf/util/maps.c ++++ b/tools/perf/util/maps.c +@@ -676,6 +676,7 @@ int maps__find_ams(struct maps *maps, struct addr_map_symbol *ams) + if (ams->addr < map__start(ams->ms.map) || ams->addr >= map__end(ams->ms.map)) { + if (maps == NULL) + return -1; ++ map__put(ams->ms.map); + ams->ms.map = maps__find(maps, ams->addr); + if (ams->ms.map == NULL) + return -1; +-- +2.51.0 + diff --git a/queue-6.19/perf-metricgroup-don-t-early-exit-if-no-cpuid-table-.patch b/queue-6.19/perf-metricgroup-don-t-early-exit-if-no-cpuid-table-.patch new file mode 100644 index 00000000000..7caf159b5ac --- /dev/null +++ b/queue-6.19/perf-metricgroup-don-t-early-exit-if-no-cpuid-table-.patch @@ -0,0 +1,78 @@ +From e2f41bc6103d7251f2e540e17bf279873232cb7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Feb 2026 10:36:03 -0800 +Subject: perf metricgroup: Don't early exit if no CPUID table exists + +From: Ian Rogers + +[ Upstream commit cee275edcdb1acfdc8270f80e96f30750b633220 ] + +The failure to find a table of metrics with a CPUID shouldn't early +exit as the metric code will now also consider the default table. + +When searching for a metric or metric group, +pmu_metrics_table__for_each_metric() considers all tables and so the +caller doesn't need to switch the table to do this. + +Fixes: c7adeb0974f18da4 ("perf jevents: Add set of common metrics based on default ones") +Reviewed-by: Leo Yan +Signed-off-by: Ian Rogers +Tested-by: Leo Yan +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/metricgroup.c | 18 +++++------------- + 1 file changed, 5 insertions(+), 13 deletions(-) + +diff --git a/tools/perf/util/metricgroup.c b/tools/perf/util/metricgroup.c +index 25c75fdbfc525..a21f2d4969c5c 100644 +--- a/tools/perf/util/metricgroup.c ++++ b/tools/perf/util/metricgroup.c +@@ -1563,8 +1563,6 @@ int metricgroup__parse_groups(struct evlist *perf_evlist, + { + const struct pmu_metrics_table *table = pmu_metrics_table__find(); + +- if (!table) +- return -EINVAL; + if (hardware_aware_grouping) + pr_debug("Use hardware aware grouping instead of traditional metric grouping method\n"); + +@@ -1602,22 +1600,16 @@ static int metricgroup__has_metric_or_groups_callback(const struct pmu_metric *p + + bool metricgroup__has_metric_or_groups(const char *pmu, const char *metric_or_groups) + { +- const struct pmu_metrics_table *tables[2] = { +- pmu_metrics_table__find(), +- pmu_metrics_table__default(), +- }; ++ const struct pmu_metrics_table *table = pmu_metrics_table__find(); + struct metricgroup__has_metric_data data = { + .pmu = pmu, + .metric_or_groups = metric_or_groups, + }; + +- for (size_t i = 0; i < ARRAY_SIZE(tables); i++) { +- if (pmu_metrics_table__for_each_metric(tables[i], +- metricgroup__has_metric_or_groups_callback, +- &data)) +- return true; +- } +- return false; ++ return pmu_metrics_table__for_each_metric(table, ++ metricgroup__has_metric_or_groups_callback, ++ &data) ++ ? true : false; + } + + static int metricgroup__topdown_max_level_callback(const struct pmu_metric *pm, +-- +2.51.0 + diff --git a/queue-6.19/perf-stat-ensure-metrics-are-displayed-even-with-fai.patch b/queue-6.19/perf-stat-ensure-metrics-are-displayed-even-with-fai.patch new file mode 100644 index 00000000000..83e6b8706cc --- /dev/null +++ b/queue-6.19/perf-stat-ensure-metrics-are-displayed-even-with-fai.patch @@ -0,0 +1,213 @@ +From 028488b5c72f6dbdd17811d0c13e020a478dcba8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 15:06:22 -0800 +Subject: perf stat: Ensure metrics are displayed even with failed events + +From: Chun-Tse Shao + +[ Upstream commit bb5a920b9099127915706fdd23eb540c9a69c338 ] + +Currently, `perf stat` skips or hides metrics when the underlying +hardware events cannot be counted (e.g., due to insufficient permissions +or unsupported events). + +In `--metric-only` mode, this often results in missing columns or blank +spaces, making the output difficult to parse. + +Modify the logic to ensure metrics are consistently displayed by +propagating NAN (Not a Number) through the expression evaluator. +Specifically: + +1. Update `prepare_metric()` in stat-shadow.c to treat uncounted events + (where `run == 0`) as NAN. This leverages the existing math in expr.y + to propagate NAN through metric expressions. + +2. Remove the early return in the display logic's `printout()` function + that was previously skipping metrics in `--metric-only` mode for + failed events. +l +3. Simplify `perf_stat__skip_metric_event()` to no longer depend on + event runtime. + +Tested: + +1. `perf all metrics test` did not crash while paranoid is 2. + +2. Multiple combinations with `CPUs_utilized` while paranoid is 2. + + $ ./perf stat -M CPUs_utilized -a -- sleep 1 + + Performance counter stats for 'system wide': + + msec cpu-clock:u # nan CPUs CPUs_utilized + 1,006,356,120 duration_time + + 1.004375550 seconds time elapsed + + $ ./perf stat -M CPUs_utilized -a -j -- sleep 1 + {"counter-value" : "", "unit" : "msec", "event" : "cpu-clock:u", "event-runtime" : 0, "pcnt-running" : 100.00, "metric-value" : "nan", "metric-unit" : "CPUs CPUs_utilized"} + {"counter-value" : "1006642462.000000", "unit" : "", "event" : "duration_time", "event-runtime" : 1, "pcnt-running" : 100.00} + + $ ./perf stat -M CPUs_utilized -a --metric-only -- sleep 1 + + Performance counter stats for 'system wide': + + CPUs CPUs_utilized + nan + + 1.004424652 seconds time elapsed + + $ ./perf stat -M CPUs_utilized -a --metric-only -j -- sleep 1 + {"CPUs CPUs_utilized" : "none"} + +Reviewed-by: Ian Rogers +Signed-off-by: Chun-Tse Shao +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Yang Li +Signed-off-by: Arnaldo Carvalho de Melo +Stable-dep-of: 63b320aaac08 ("perf stat-shadow: In prepare_metric fix guard on reading NULL perf_stat_evsel") +Signed-off-by: Sasha Levin +--- + tools/perf/util/stat-display.c | 59 +++++++++++++++------------------- + tools/perf/util/stat-shadow.c | 8 ++--- + tools/perf/util/stat.h | 2 +- + 3 files changed, 29 insertions(+), 40 deletions(-) + +diff --git a/tools/perf/util/stat-display.c b/tools/perf/util/stat-display.c +index 6d02f84c5691a..f4bd579908b43 100644 +--- a/tools/perf/util/stat-display.c ++++ b/tools/perf/util/stat-display.c +@@ -820,12 +820,6 @@ static void printout(struct perf_stat_config *config, struct outstate *os, + } + + if (run == 0 || ena == 0 || counter->counts->scaled == -1) { +- if (config->metric_only) { +- pm(config, os, METRIC_THRESHOLD_UNKNOWN, /*format=*/NULL, +- /*unit=*/NULL, /*val=*/0); +- return; +- } +- + ok = false; + + if (counter->supported) { +@@ -848,33 +842,32 @@ static void printout(struct perf_stat_config *config, struct outstate *os, + print_running(config, os, run, ena, /*before_metric=*/true); + } + +- if (ok) { +- if (!config->metric_only && counter->default_metricgroup && !counter->default_show_events) { +- void *from = NULL; +- +- aggr_printout(config, os, os->evsel, os->id, os->aggr_nr); +- /* Print out all the metricgroup with the same metric event. */ +- do { +- int num = 0; +- +- /* Print out the new line for the next new metricgroup. */ +- if (from) { +- if (config->json_output) +- new_line_json(config, (void *)os); +- else +- __new_line_std_csv(config, os); +- } +- +- print_noise(config, os, counter, noise, /*before_metric=*/true); +- print_running(config, os, run, ena, /*before_metric=*/true); +- from = perf_stat__print_shadow_stats_metricgroup(config, counter, aggr_idx, +- &num, from, &out); +- } while (from != NULL); +- } else { +- perf_stat__print_shadow_stats(config, counter, aggr_idx, &out); +- } ++ if (!config->metric_only && counter->default_metricgroup && ++ !counter->default_show_events) { ++ void *from = NULL; ++ ++ aggr_printout(config, os, os->evsel, os->id, os->aggr_nr); ++ /* Print out all the metricgroup with the same metric event. */ ++ do { ++ int num = 0; ++ ++ /* Print out the new line for the next new metricgroup. */ ++ if (from) { ++ if (config->json_output) ++ new_line_json(config, (void *)os); ++ else ++ __new_line_std_csv(config, os); ++ } ++ ++ print_noise(config, os, counter, noise, ++ /*before_metric=*/true); ++ print_running(config, os, run, ena, ++ /*before_metric=*/true); ++ from = perf_stat__print_shadow_stats_metricgroup( ++ config, counter, aggr_idx, &num, from, &out); ++ } while (from != NULL); + } else { +- pm(config, os, METRIC_THRESHOLD_UNKNOWN, /*format=*/NULL, /*unit=*/NULL, /*val=*/0); ++ perf_stat__print_shadow_stats(config, counter, aggr_idx, &out); + } + + if (!config->metric_only) { +@@ -987,7 +980,7 @@ static void print_counter_aggrdata(struct perf_stat_config *config, + ena = aggr->counts.ena; + run = aggr->counts.run; + +- if (perf_stat__skip_metric_event(counter, ena, run)) ++ if (perf_stat__skip_metric_event(counter)) + return; + + if (val == 0 && should_skip_zero_counter(config, counter, &id)) +diff --git a/tools/perf/util/stat-shadow.c b/tools/perf/util/stat-shadow.c +index 9c83f7d96caa4..5d8d09e0e6ae5 100644 +--- a/tools/perf/util/stat-shadow.c ++++ b/tools/perf/util/stat-shadow.c +@@ -83,7 +83,7 @@ static int prepare_metric(struct perf_stat_config *config, + } + /* Time events are always on CPU0, the first aggregation index. */ + aggr = &ps->aggr[is_tool_time ? tool_aggr_idx : aggr_idx]; +- if (!aggr || !metric_events[i]->supported) { ++ if (!aggr || !metric_events[i]->supported || aggr->counts.run == 0) { + /* + * Not supported events will have a count of 0, which + * can be confusing in a metric. Explicitly set the +@@ -335,14 +335,10 @@ void perf_stat__print_shadow_stats(struct perf_stat_config *config, + * perf_stat__skip_metric_event - Skip the evsel in the Default metricgroup, + * if it's not running or not the metric event. + */ +-bool perf_stat__skip_metric_event(struct evsel *evsel, +- u64 ena, u64 run) ++bool perf_stat__skip_metric_event(struct evsel *evsel) + { + if (!evsel->default_metricgroup) + return false; + +- if (!ena || !run) +- return true; +- + return !metricgroup__lookup(&evsel->evlist->metric_events, evsel, false); + } +diff --git a/tools/perf/util/stat.h b/tools/perf/util/stat.h +index f986911c9296e..4bced233d2fc0 100644 +--- a/tools/perf/util/stat.h ++++ b/tools/perf/util/stat.h +@@ -163,7 +163,7 @@ void perf_stat__print_shadow_stats(struct perf_stat_config *config, + struct evsel *evsel, + int aggr_idx, + struct perf_stat_output_ctx *out); +-bool perf_stat__skip_metric_event(struct evsel *evsel, u64 ena, u64 run); ++bool perf_stat__skip_metric_event(struct evsel *evsel); + void *perf_stat__print_shadow_stats_metricgroup(struct perf_stat_config *config, + struct evsel *evsel, + int aggr_idx, +-- +2.51.0 + diff --git a/queue-6.19/perf-stat-shadow-in-prepare_metric-fix-guard-on-read.patch b/queue-6.19/perf-stat-shadow-in-prepare_metric-fix-guard-on-read.patch new file mode 100644 index 00000000000..fabaea92c9b --- /dev/null +++ b/queue-6.19/perf-stat-shadow-in-prepare_metric-fix-guard-on-read.patch @@ -0,0 +1,89 @@ +From df6e72a0d57ce044eaf015d0415d02d622a22934 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 22:03:55 -0800 +Subject: perf stat-shadow: In prepare_metric fix guard on reading NULL + perf_stat_evsel + +From: Ian Rogers + +[ Upstream commit 63b320aaac08ba267268ec21a195ce3c82dcb8ab ] + +The aggr value is setup to always be non-null creating a redundant +guard for reading from it. Switch to using the perf_stat_evsel (ps) +and narrow the scope of aggr so that it is known valid when used. + +Fixes: 3d65f6445fd93e3e ("perf stat-shadow: Read tool events directly") +Reported-by: Andres Freund +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Dapeng Mi +Cc: Dr. David Alan Gilbert +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Thomas Falcon +Cc: Thomas Richter +Cc: Yang Li +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/stat-shadow.c | 24 ++++++++++++++++-------- + 1 file changed, 16 insertions(+), 8 deletions(-) + +diff --git a/tools/perf/util/stat-shadow.c b/tools/perf/util/stat-shadow.c +index 5d8d09e0e6ae5..59d2cd4f2188d 100644 +--- a/tools/perf/util/stat-shadow.c ++++ b/tools/perf/util/stat-shadow.c +@@ -57,7 +57,6 @@ static int prepare_metric(struct perf_stat_config *config, + bool is_tool_time = + tool_pmu__is_time_event(config, metric_events[i], &tool_aggr_idx); + struct perf_stat_evsel *ps = metric_events[i]->stats; +- struct perf_stat_aggr *aggr; + char *n; + double val; + +@@ -82,8 +81,7 @@ static int prepare_metric(struct perf_stat_config *config, + } + } + /* Time events are always on CPU0, the first aggregation index. */ +- aggr = &ps->aggr[is_tool_time ? tool_aggr_idx : aggr_idx]; +- if (!aggr || !metric_events[i]->supported || aggr->counts.run == 0) { ++ if (!ps || !metric_events[i]->supported) { + /* + * Not supported events will have a count of 0, which + * can be confusing in a metric. Explicitly set the +@@ -93,11 +91,21 @@ static int prepare_metric(struct perf_stat_config *config, + val = NAN; + source_count = 0; + } else { +- val = aggr->counts.val; +- if (is_tool_time) +- val *= 1e-9; /* Convert time event nanoseconds to seconds. */ +- if (!source_count) +- source_count = evsel__source_count(metric_events[i]); ++ struct perf_stat_aggr *aggr = ++ &ps->aggr[is_tool_time ? tool_aggr_idx : aggr_idx]; ++ ++ if (aggr->counts.run == 0) { ++ val = NAN; ++ source_count = 0; ++ } else { ++ val = aggr->counts.val; ++ if (is_tool_time) { ++ /* Convert time event nanoseconds to seconds. */ ++ val *= 1e-9; ++ } ++ if (!source_count) ++ source_count = evsel__source_count(metric_events[i]); ++ } + } + n = strdup(evsel__metric_id(metric_events[i])); + if (!n) +-- +2.51.0 + diff --git a/queue-6.19/perf-symbol-elf-fix-leak-of-elf-files-with-gnu-debug.patch b/queue-6.19/perf-symbol-elf-fix-leak-of-elf-files-with-gnu-debug.patch new file mode 100644 index 00000000000..de27a4b32e5 --- /dev/null +++ b/queue-6.19/perf-symbol-elf-fix-leak-of-elf-files-with-gnu-debug.patch @@ -0,0 +1,69 @@ +From 218ccaafbaca60e6fbce9403bdd40cbe3c5f92ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jan 2026 21:28:27 -0800 +Subject: perf symbol-elf: Fix leak of ELF files with GNU debugdata +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ian Rogers + +[ Upstream commit 92d65d9c31621befe0a5f7c0bd43bd217613c6b6 ] + +The processing of DSO_BINARY_TYPE__GNU_DEBUGDATA in symsrc__init happens +with an open ELF file but the error path only closes the associate fd. + +Fix the goto so that the ELF file is also ended and memory released. + +Fixes: b10f74308e130527 ("perf symbol: Support .gnu_debugdata for symbols") +Signed-off-by: Ian Rogers +Cc: Aditya Bodkhe +Cc: Adrian Hunter +Cc: Albert Ou +Cc: Alexandre Ghiti +Cc: Andi Kleen +Cc: Athira Rajeev +Cc: Chun-Tse Shao +Cc: Dmitriy Vyukov +Cc: Dr. David Alan Gilbert +Cc: Guo Ren +Cc: Haibo Xu +Cc: Howard Chu +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: John Garry +Cc: Krzysztof Łopatowski +Cc: Leo Yan +Cc: Mark Wielaard +Cc: Namhyung Kim +Cc: Palmer Dabbelt +Cc: Paul Walmsley +Cc: Peter Zijlstra +Cc: Sergei Trofimovich +Cc: Shimin Guo +Cc: Stephen Brennan +Cc: Thomas Falcon +Cc: Will Deacon +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/symbol-elf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c +index d1dcafa4b3b80..439f252937b89 100644 +--- a/tools/perf/util/symbol-elf.c ++++ b/tools/perf/util/symbol-elf.c +@@ -1173,7 +1173,7 @@ int symsrc__init(struct symsrc *ss, struct dso *dso, const char *name, + Elf *embedded = read_gnu_debugdata(dso, elf, name, &new_fd); + + if (!embedded) +- goto out_close; ++ goto out_elf_end; + + elf_end(elf); + close(fd); +-- +2.51.0 + diff --git a/queue-6.19/perf-test-fix-test-case-perf-evlist-tests-for-s390x.patch b/queue-6.19/perf-test-fix-test-case-perf-evlist-tests-for-s390x.patch new file mode 100644 index 00000000000..b7b0bf918ba --- /dev/null +++ b/queue-6.19/perf-test-fix-test-case-perf-evlist-tests-for-s390x.patch @@ -0,0 +1,64 @@ +From a465f48a0d67673269acf86c5de4c6f9be825425 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Dec 2025 08:17:52 +0100 +Subject: perf test: Fix test case perf evlist tests for s390x + +From: Thomas Richter + +[ Upstream commit b04d2b9199129f4f0c992a518c0fb78c2efc1064 ] + +Perf test case 78: perf evlist tests fails on s390. + +The failure is causes by grouping events cycles and instructions because +sampling does only support event cycles. Change the group to software +events to fix this. + +Output before: + # ./perf test 78 + 78: perf evlist tests : FAILED! + # + +Output after: + # ./perf test 78 + 78: perf evlist tests : Ok + # + +Fixes: db452961de939225 ("perf tests evlist: Add basic evlist test") +Signed-off-by: Thomas Richter +Tested-by: Ian Rogers +Cc: Alexander Gordeev +Cc: Heiko Carstens +Cc: Jan Polensky +Cc: Namhyung Kim +Cc: Sumanth Korikkar +Cc: Vasily Gorbik +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/evlist.sh | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/tests/shell/evlist.sh b/tools/perf/tests/shell/evlist.sh +index 140f099e75c1e..5632be3917109 100755 +--- a/tools/perf/tests/shell/evlist.sh ++++ b/tools/perf/tests/shell/evlist.sh +@@ -38,13 +38,14 @@ test_evlist_simple() { + + test_evlist_group() { + echo "Group evlist test" +- if ! perf record -e "{cycles,instructions}" -o "${perfdata}" true 2> /dev/null ++ if ! perf record -e "{cpu-clock,task-clock}" -o "${perfdata}" \ ++ -- perf test -w noploop 2> /dev/null + then + echo "Group evlist [Skipped event group recording failed]" + return + fi + +- if ! perf evlist -i "${perfdata}" -g | grep -q "{.*cycles.*,.*instructions.*}" ++ if ! perf evlist -i "${perfdata}" -g | grep -q "{.*cpu-clock.*,.*task-clock.*}" + then + echo "Group evlist [Failed to list event group]" + err=1 +-- +2.51.0 + diff --git a/queue-6.19/perf-test-fix-test-case-perftool-testsuite_report-fo.patch b/queue-6.19/perf-test-fix-test-case-perftool-testsuite_report-fo.patch new file mode 100644 index 00000000000..782f1c29e3f --- /dev/null +++ b/queue-6.19/perf-test-fix-test-case-perftool-testsuite_report-fo.patch @@ -0,0 +1,114 @@ +From 7c60b8f049a38b7dcd0b0eb479dba8ee96091bb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 16:32:56 +0100 +Subject: perf test: Fix test case perftool-testsuite_report for s390 + +From: Thomas Richter + +[ Upstream commit 3d012b8614ee020666f3dd15af9f65dc487e3f5f ] + +Test case perftool-testsuite_report fails on s390 for some time +now. + +Root cause is a time out which is too tight for large s390 machines. +The time out value addr2line_timeout_ms is per default set to 1 second. + +This is the maximum time the function read_addr2line_record() waits for +a reply from the forked off tool addr2line, which is started as a child +in interactive mode. + +It reads stdin (an address in hexadecimal) and replies on stdout with +function name, file name and line number. This might take more than one +second. + +However one second is not always enough and the reply from addr2line +tool is not received. Function read_addr2line_record() fails and emits +a warning, which is not expected by the test case. It fails. + +Output before: + + # perf test -F 133 + -- [ PASS ] -- perf_report :: setup :: prepare the perf.data file + ================== + [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 0.087 MB \ + /tmp/perftool-testsuite_report.FHz/perf_report/perf.data.1 \ + (207 samples) ] + ================== + -- [ PASS ] -- perf_report :: setup :: prepare the perf.data.1 file + ## [ PASS ] ## perf_report :: setup SUMMARY + -- [ SKIP ] -- perf_report :: test_basic :: help message :: testcase skipped + Line did not match any pattern: "cmd__addr2line /usr/lib/debug/lib/modules/ + 6.19.0-20260205.rc8.git366.9845cf73f7db.300.fc43.s390x+next/ + vmlinux: could not read first record" + Line did not match any pattern: "cmd__addr2line /usr/lib/debug/lib/modules/ + 6.19.0-20260205.rc8.git366.9845cf73f7db.300.fc43.s390x+next/ + vmlinux: could not read first record" + -- [ FAIL ] -- perf_report :: test_basic :: basic execution + (output regexp parsing) + .... + 133: perftool-testsuite_report : FAILED! + +Output after: + + # ./perf test -F 133 + -- [ PASS ] -- perf_report :: setup :: prepare the perf.data file + ================== + [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 0.087 MB \ + /tmp/perftool-testsuite_report.Mlp/perf_report/perf.data.1 + (188 samples) ] + ================== + -- [ PASS ] -- perf_report :: setup :: prepare the perf.data.1 file + ## [ PASS ] ## perf_report :: setup SUMMARY + -- [ SKIP ] -- perf_report :: test_basic :: help message :: testcase skipped + -- [ PASS ] -- perf_report :: test_basic :: basic execution + -- [ PASS ] -- perf_report :: test_basic :: number of samples + -- [ PASS ] -- perf_report :: test_basic :: header + -- [ PASS ] -- perf_report :: test_basic :: header timestamp + -- [ PASS ] -- perf_report :: test_basic :: show CPU utilization + -- [ PASS ] -- perf_report :: test_basic :: pid + -- [ PASS ] -- perf_report :: test_basic :: non-existing symbol + -- [ PASS ] -- perf_report :: test_basic :: symbol filter + -- [ PASS ] -- perf_report :: test_basic :: latency header + -- [ PASS ] -- perf_report :: test_basic :: default report for latency profile + -- [ PASS ] -- perf_report :: test_basic :: latency report for latency profile + -- [ PASS ] -- perf_report :: test_basic :: parallelism histogram + ## [ PASS ] ## perf_report :: test_basic SUMMARY + 133: perftool-testsuite_report : Ok + # + +Fixes: 257046a36750a6db ("perf srcline: Fallback between addr2line implementations") +Reviewed-by: Jan Polensky +Signed-off-by: Thomas Richter +Cc: Alexander Gordeev +Cc: Heiko Carstens +Cc: Ian Rogers +Cc: linux-s390@vger.kernel.org +Cc: Namhyung Kim +Cc: Sumanth Korikkar +Cc: Vasily Gorbik +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/addr2line.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/addr2line.c b/tools/perf/util/addr2line.c +index f2d94a3272d71..a8b39f4f202b6 100644 +--- a/tools/perf/util/addr2line.c ++++ b/tools/perf/util/addr2line.c +@@ -18,8 +18,8 @@ + + #define MAX_INLINE_NEST 1024 + +-/* If addr2line doesn't return data for 1 second then timeout. */ +-int addr2line_timeout_ms = 1 * 1000; ++/* If addr2line doesn't return data for 5 seconds then timeout. */ ++int addr2line_timeout_ms = 5 * 1000; + + static int filename_split(char *filename, unsigned int *line_nr) + { +-- +2.51.0 + diff --git a/queue-6.19/perf-test-fix-test-perf-evlist-for-z-vm-s390x.patch b/queue-6.19/perf-test-fix-test-perf-evlist-for-z-vm-s390x.patch new file mode 100644 index 00000000000..0c6d1221b7c --- /dev/null +++ b/queue-6.19/perf-test-fix-test-perf-evlist-for-z-vm-s390x.patch @@ -0,0 +1,66 @@ +From 32b4b04f1396b0b1dc019032f79b651e3356726b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jan 2026 11:18:23 +0100 +Subject: perf test: Fix test perf evlist for z/VM s390x + +From: Thomas Richter + +[ Upstream commit 008603bda19b29687edce533e4c09acff68c1077 ] + +Perf test case 'perf evlist tests' fails on z/VM machines on s390. + +The failure is causes by event cycles. This event is not available +on virtualized machines like z/VM on s390. + +Change to software event cpu-clock to fix this. + + Output before: + # ./perf test 78 + 79: perf evlist tests : FAILED! + # + + Output after: + # ./perf test 78 + 79: perf evlist tests : Ok + # + +Fixes: b04d2b9199129f4f ("perf test: Fix test case perf evlist tests for s390x") +Reviewed-by: Ian Rogers +Reviewed-by: Jan Polensky +Signed-off-by: Thomas Richter +Tested-by: Jan Polensky +Cc: Alexander Gordeev +Cc: Heiko Carstens +Cc: Namhyung Kim +Cc: Sumanth Korikkar +Cc: Thomas Richter +Cc: Vasily Gorbik +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/evlist.sh | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/tests/shell/evlist.sh b/tools/perf/tests/shell/evlist.sh +index 5632be3917109..8a22f4171c07c 100755 +--- a/tools/perf/tests/shell/evlist.sh ++++ b/tools/perf/tests/shell/evlist.sh +@@ -21,13 +21,13 @@ trap trap_cleanup EXIT TERM INT + + test_evlist_simple() { + echo "Simple evlist test" +- if ! perf record -e cycles -o "${perfdata}" true 2> /dev/null ++ if ! perf record -e cpu-clock -o "${perfdata}" true 2> /dev/null + then + echo "Simple evlist [Failed record]" + err=1 + return + fi +- if ! perf evlist -i "${perfdata}" | grep -q "cycles" ++ if ! perf evlist -i "${perfdata}" | grep -q "cpu-clock" + then + echo "Simple evlist [Failed to list event]" + err=1 +-- +2.51.0 + diff --git a/queue-6.19/perf-test-stat-tests-fix-for-virtualized-machines.patch b/queue-6.19/perf-test-stat-tests-fix-for-virtualized-machines.patch new file mode 100644 index 00000000000..f9da6caac40 --- /dev/null +++ b/queue-6.19/perf-test-stat-tests-fix-for-virtualized-machines.patch @@ -0,0 +1,80 @@ +From 1a7dec8ea4cd5ef10b8f06df19c90e03b8207f84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 14:32:16 +0100 +Subject: perf test stat tests: Fix for virtualized machines + +From: Thomas Richter + +[ Upstream commit e272628902c1c96731e2d9f62a7fc77767686eb0 ] + +On s390 'perf test's 'perf stat tests', subtest test_hybrid fails for +z/VM systems. The root cause is this statement: + + $(perf stat -a -- sleep 0.1 2>&1 |\ + grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* -c) + +The 'perf stat' output on a s390 z/VM system is + + # perf stat -a -- sleep 0.1 2>&1 + Performance counter stats for 'system wide': + + 56 context-switches # 46.3 cs/sec cs_per_second + 1,210.41 msec cpu-clock # 11.9 CPUs CPUs_utilized + 12 cpu-migrations # 9.9 migrations/sec ... + 81 page-faults # 66.9 faults/sec ... + + 0.100891009 seconds time elapsed + +The grep command does not match any single line and exits with error +code 1. + +As the bash script is executed with 'set -e', it aborts with the first +error code being non-zero. + +Fix this and use 'wc -l' to count matching lines instead of 'grep ... -c'. + +Output before: + + # perf test 102 + 102: perf stat tests : FAILED! + # + +Output after: + + # perf test 102 + 102: perf stat tests : Ok + # + +Fixes: bb6e7cb11d97ce19 ("perf tools: Add fallback for exclude_guest") +Reviewed-by: Ian Rogers +Reviewed-by: James Clark +Signed-off-by: Thomas Richter +Cc: Alexander Gordeev +Cc: Heiko Carstens +Cc: Jan Polensky +Cc: linux-s390@vger.kernel.org +Cc: Namhyung Kim +Cc: Sumanth Korikkar +Cc: Vasily Gorbik +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/stat.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh +index 0b2f0f88ca166..792a0b79f6b86 100755 +--- a/tools/perf/tests/shell/stat.sh ++++ b/tools/perf/tests/shell/stat.sh +@@ -233,7 +233,7 @@ test_hybrid() { + fi + + # Run default Perf stat +- cycles_events=$(perf stat -a -- sleep 0.1 2>&1 | grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* " -c) ++ cycles_events=$(perf stat -a -- sleep 0.1 2>&1 | grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* " | wc -l) + + # The expectation is that default output will have a cycles events on each + # hybrid PMU. In situations with no cycles PMU events, like virtualized, this +-- +2.51.0 + diff --git a/queue-6.19/perf-tests-kallsyms-fix-missed-map__put.patch b/queue-6.19/perf-tests-kallsyms-fix-missed-map__put.patch new file mode 100644 index 00000000000..68a56331e3d --- /dev/null +++ b/queue-6.19/perf-tests-kallsyms-fix-missed-map__put.patch @@ -0,0 +1,41 @@ +From 129f90c53abba37523fdc6a88f615859000594fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Dec 2025 11:01:41 -0800 +Subject: perf tests kallsyms: Fix missed map__put() + +From: Ian Rogers + +[ Upstream commit a58807adbed5f532efb231e5490767f284f237c0 ] + +Issue was caught by leak sanitizer and the test robot. + +Fixes: 34e271ae55382fbd ("perf test: Add kallsyms split test") +Reported-by: kernel test robot +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Closes: https://lore.kernel.org/oe-lkp/202512101502.f3819cd3-lkp@intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/kallsyms-split.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/perf/tests/kallsyms-split.c b/tools/perf/tests/kallsyms-split.c +index bbbc66957e5d0..117ed3b70f630 100644 +--- a/tools/perf/tests/kallsyms-split.c ++++ b/tools/perf/tests/kallsyms-split.c +@@ -148,6 +148,7 @@ static int test__kallsyms_split(struct test_suite *test __maybe_unused, + ret = TEST_OK; + + out: ++ map__put(map); + remove_proc_dir(0); + machine__exit(&m); + return ret; +-- +2.51.0 + diff --git a/queue-6.19/perf-tests-sched-avoid-error-in-cleanup-on-loaded-ma.patch b/queue-6.19/perf-tests-sched-avoid-error-in-cleanup-on-loaded-ma.patch new file mode 100644 index 00000000000..2e7d3c3534e --- /dev/null +++ b/queue-6.19/perf-tests-sched-avoid-error-in-cleanup-on-loaded-ma.patch @@ -0,0 +1,51 @@ +From e27c8fe84849ed4e0c9959551c0947324098d2f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 09:53:37 -0800 +Subject: perf tests sched: Avoid error in cleanup on loaded machines + +From: Ian Rogers + +[ Upstream commit c5e47e4d00fbc15f2390bb6ed8d9c21836363291 ] + +The stop_noploops function will kill the noploop processes that are +running for 10 seconds. + +On a loaded machine they may have already terminated meaning the kill +will return an error of no such process. + +This doesn't matter and so ignore the error to avoid the test +terminating in the cleanup. + +Fixes: 0e22c5ca44e68798 ("perf test: Add sched latency and script shell tests") +Signed-off-by: Ian Rogers +Tested-by: Arnaldo Carvalho de Melo +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/sched.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/tests/shell/sched.sh b/tools/perf/tests/shell/sched.sh +index b9b81eaf856e6..b9637069adb1f 100755 +--- a/tools/perf/tests/shell/sched.sh ++++ b/tools/perf/tests/shell/sched.sh +@@ -53,7 +53,7 @@ start_noploops() { + } + + cleanup_noploops() { +- kill "$PID1" "$PID2" ++ kill "$PID1" "$PID2" || true + } + + test_sched_record() { +-- +2.51.0 + diff --git a/queue-6.19/perf-tools-get-debug-info-of-dso-properly.patch b/queue-6.19/perf-tools-get-debug-info-of-dso-properly.patch new file mode 100644 index 00000000000..d90743c210f --- /dev/null +++ b/queue-6.19/perf-tools-get-debug-info-of-dso-properly.patch @@ -0,0 +1,169 @@ +From 0dac4e3a03c3fea5c7813adf45d156ff89907ab0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 15:37:57 -0800 +Subject: perf tools: Get debug info of DSO properly + +From: Namhyung Kim + +[ Upstream commit 069e603d8248dac98b1ef2909e2f1c4169b9da11 ] + +The dso__debuginfo() just used the path name to open the file but it may +be outdated. It should check build-ID and use the file in the build-ID +cache if available rather than just using the path name. + +Let's factor out dso__get_filename() to avoid code duplicate. + +Fixes: 53a61a6ca279165d ("perf annotate: Add dso__debuginfo() helper") +Reviewed-by: Ian Rogers +Signed-off-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/dso.c | 63 ++++++++++++++++++++++++++++++++----------- + tools/perf/util/dso.h | 11 ++------ + 2 files changed, 50 insertions(+), 24 deletions(-) + +diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c +index 344e689567ee1..dc202d4943721 100644 +--- a/tools/perf/util/dso.c ++++ b/tools/perf/util/dso.c +@@ -111,7 +111,7 @@ bool dso__is_object_file(const struct dso *dso) + + int dso__read_binary_type_filename(const struct dso *dso, + enum dso_binary_type type, +- char *root_dir, char *filename, size_t size) ++ const char *root_dir, char *filename, size_t size) + { + char build_id_hex[SBUILD_ID_SIZE]; + int ret = 0; +@@ -563,20 +563,15 @@ char *dso__filename_with_chroot(const struct dso *dso, const char *filename) + return filename_with_chroot(nsinfo__pid(dso__nsinfo_const(dso)), filename); + } + +-static int __open_dso(struct dso *dso, struct machine *machine) +- EXCLUSIVE_LOCKS_REQUIRED(_dso__data_open_lock) ++static char *dso__get_filename(struct dso *dso, const char *root_dir, ++ bool *decomp) + { +- int fd = -EINVAL; +- char *root_dir = (char *)""; + char *name = malloc(PATH_MAX); +- bool decomp = false; + +- if (!name) +- return -ENOMEM; ++ *decomp = false; + +- mutex_lock(dso__lock(dso)); +- if (machine) +- root_dir = machine->root_dir; ++ if (name == NULL) ++ return NULL; + + if (dso__read_binary_type_filename(dso, dso__binary_type(dso), + root_dir, name, PATH_MAX)) +@@ -601,20 +596,38 @@ static int __open_dso(struct dso *dso, struct machine *machine) + size_t len = sizeof(newpath); + + if (dso__decompress_kmodule_path(dso, name, newpath, len) < 0) { +- fd = -(*dso__load_errno(dso)); ++ errno = *dso__load_errno(dso); + goto out; + } + +- decomp = true; ++ *decomp = true; + strcpy(name, newpath); + } ++ return name; ++ ++out: ++ free(name); ++ return NULL; ++} + +- fd = do_open(name); ++static int __open_dso(struct dso *dso, struct machine *machine) ++ EXCLUSIVE_LOCKS_REQUIRED(_dso__data_open_lock) ++{ ++ int fd = -EINVAL; ++ char *name; ++ bool decomp = false; ++ ++ mutex_lock(dso__lock(dso)); ++ ++ name = dso__get_filename(dso, machine ? machine->root_dir : "", &decomp); ++ if (name) ++ fd = do_open(name); ++ else ++ fd = -errno; + + if (decomp) + unlink(name); + +-out: + mutex_unlock(dso__lock(dso)); + free(name); + return fd; +@@ -1910,3 +1923,23 @@ const u8 *dso__read_symbol(struct dso *dso, const char *symfs_filename, + return __dso__read_symbol(dso, symfs_filename, start, len, + out_buf, out_buf_len, is_64bit); + } ++ ++struct debuginfo *dso__debuginfo(struct dso *dso) ++{ ++ char *name; ++ bool decomp = false; ++ struct debuginfo *dinfo = NULL; ++ ++ mutex_lock(dso__lock(dso)); ++ ++ name = dso__get_filename(dso, "", &decomp); ++ if (name) ++ dinfo = debuginfo__new(name); ++ ++ if (decomp) ++ unlink(name); ++ ++ mutex_unlock(dso__lock(dso)); ++ free(name); ++ return dinfo; ++} +diff --git a/tools/perf/util/dso.h b/tools/perf/util/dso.h +index f8ccb9816b89c..54e470dd07305 100644 +--- a/tools/perf/util/dso.h ++++ b/tools/perf/util/dso.h +@@ -766,7 +766,7 @@ int dso__kernel_module_get_build_id(struct dso *dso, const char *root_dir); + + char dso__symtab_origin(const struct dso *dso); + int dso__read_binary_type_filename(const struct dso *dso, enum dso_binary_type type, +- char *root_dir, char *filename, size_t size); ++ const char *root_dir, char *filename, size_t size); + bool is_kernel_module(const char *pathname, int cpumode); + bool dso__needs_decompress(struct dso *dso); + int dso__decompress_kmodule_fd(struct dso *dso, const char *name); +@@ -915,14 +915,7 @@ u64 dso__findnew_global_type(struct dso *dso, u64 addr, u64 offset); + bool perf_pid_map_tid(const char *dso_name, int *tid); + bool is_perf_pid_map_name(const char *dso_name); + +-/* +- * In the future, we may get debuginfo using build-ID (w/o path). +- * Add this helper is for the smooth conversion. +- */ +-static inline struct debuginfo *dso__debuginfo(struct dso *dso) +-{ +- return debuginfo__new(dso__long_name(dso)); +-} ++struct debuginfo *dso__debuginfo(struct dso *dso); + + const u8 *dso__read_symbol(struct dso *dso, const char *symfs_filename, + const struct map *map, const struct symbol *sym, +-- +2.51.0 + diff --git a/queue-6.19/perf-unwind-libdw-fix-invalid-reference-counts.patch b/queue-6.19/perf-unwind-libdw-fix-invalid-reference-counts.patch new file mode 100644 index 00000000000..ffccdb6acd6 --- /dev/null +++ b/queue-6.19/perf-unwind-libdw-fix-invalid-reference-counts.patch @@ -0,0 +1,59 @@ +From ad15c71ae1ae56d3db2faa7eef73356c36d8ac61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 20:13:32 -0800 +Subject: perf unwind-libdw: Fix invalid reference counts + +From: Ian Rogers + +[ Upstream commit f815fc0c66e777c727689666cfb46b8d461c2f99 ] + +The addition of addr_location__exit() causes use-after put on the maps +and map references in the unwind info. Add the gets and then add the +map_symbol__exit() calls. + +Fixes: 0dd5041c9a0eaf8c ("perf addr_location: Add init/exit/copy functions") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Stephen Brennan +Cc: Tony Jones +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/unwind-libdw.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c +index ae70fb56a0572..3ff427a49e4c5 100644 +--- a/tools/perf/util/unwind-libdw.c ++++ b/tools/perf/util/unwind-libdw.c +@@ -136,8 +136,8 @@ static int entry(u64 ip, struct unwind_info *ui) + } + + e->ip = ip; +- e->ms.maps = al.maps; +- e->ms.map = al.map; ++ e->ms.maps = maps__get(al.maps); ++ e->ms.map = map__get(al.map); + e->ms.sym = al.sym; + + pr_debug("unwind: %s:ip = 0x%" PRIx64 " (0x%" PRIx64 ")\n", +@@ -325,6 +325,9 @@ int unwind__get_entries(unwind_entry_cb_t cb, void *arg, + if (err) + pr_debug("unwind: failed with '%s'\n", dwfl_errmsg(-1)); + ++ for (i = 0; i < ui->idx; i++) ++ map_symbol__exit(&ui->entries[i].ms); ++ + dwfl_end(ui->dwfl); + free(ui); + return 0; +-- +2.51.0 + diff --git a/queue-6.19/perf-vendor-events-amd-fix-zen-5-mab-allocation-even.patch b/queue-6.19/perf-vendor-events-amd-fix-zen-5-mab-allocation-even.patch new file mode 100644 index 00000000000..942451849a4 --- /dev/null +++ b/queue-6.19/perf-vendor-events-amd-fix-zen-5-mab-allocation-even.patch @@ -0,0 +1,66 @@ +From ff22ab916f45ef50ca7d9c47a5c4f334a866db76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 13:39:46 +0530 +Subject: perf vendor events amd: Fix Zen 5 MAB allocation events + +From: Sandipan Das + +[ Upstream commit 76b2cf07a6d2a836108f9c2486d76599f7adf6e8 ] + +The unit masks for PMCx041 vary across different generations of Zen +processors. + +Fix the Zen 5 events based on PMCx041 as they incorrectly use the same +unit masks as that of Zen 4. + +Fixes: 45c072f2537ab07b ("perf vendor events amd: Add Zen 5 core events") +Reported-by: Suyash Mahar +Reviewed-by: Ian Rogers +Signed-off-by: Sandipan Das +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ananth Narayan +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Ravi Bangoria +Cc: Sandipan Das +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/pmu-events/arch/x86/amdzen5/load-store.json | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json b/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json +index ff6627a778057..06bbaea159259 100644 +--- a/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json ++++ b/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json +@@ -70,19 +70,19 @@ + "EventName": "ls_mab_alloc.load_store_allocations", + "EventCode": "0x41", + "BriefDescription": "Miss Address Buffer (MAB) entries allocated by a Load-Store (LS) pipe for load-store allocations.", +- "UMask": "0x3f" ++ "UMask": "0x07" + }, + { + "EventName": "ls_mab_alloc.hardware_prefetcher_allocations", + "EventCode": "0x41", + "BriefDescription": "Miss Address Buffer (MAB) entries allocated by a Load-Store (LS) pipe for hardware prefetcher allocations.", +- "UMask": "0x40" ++ "UMask": "0x08" + }, + { + "EventName": "ls_mab_alloc.all_allocations", + "EventCode": "0x41", + "BriefDescription": "Miss Address Buffer (MAB) entries allocated by a Load-Store (LS) pipe for all types of allocations.", +- "UMask": "0x7f" ++ "UMask": "0x0f" + }, + { + "EventName": "ls_dmnd_fills_from_sys.local_l2", +-- +2.51.0 + diff --git a/queue-6.19/perf-x86-cstate-add-airmont-np.patch b/queue-6.19/perf-x86-cstate-add-airmont-np.patch new file mode 100644 index 00000000000..a5871342e2e --- /dev/null +++ b/queue-6.19/perf-x86-cstate-add-airmont-np.patch @@ -0,0 +1,36 @@ +From 7a01b6bbb6c40743c698f9cd7ee019d08f89223d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 08:48:46 +0100 +Subject: perf/x86/cstate: Add Airmont NP + +From: Martin Schiller + +[ Upstream commit 3006911f284d769b0f66c12b39da130325ef1440 ] + +From the perspective of Intel cstate residency counters, the Airmont NP +(aka Lightning Mountain) is identical to the Airmont. + +Signed-off-by: Martin Schiller +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Dapeng Mi +Link: https://patch.msgid.link/20251124074846.9653-4-ms@dev.tdt.de +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/cstate.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c +index fa67fda6e45b4..c1e318bdaa397 100644 +--- a/arch/x86/events/intel/cstate.c ++++ b/arch/x86/events/intel/cstate.c +@@ -599,6 +599,7 @@ static const struct x86_cpu_id intel_cstates_match[] __initconst = { + X86_MATCH_VFM(INTEL_ATOM_SILVERMONT, &slm_cstates), + X86_MATCH_VFM(INTEL_ATOM_SILVERMONT_D, &slm_cstates), + X86_MATCH_VFM(INTEL_ATOM_AIRMONT, &slm_cstates), ++ X86_MATCH_VFM(INTEL_ATOM_AIRMONT_NP, &slm_cstates), + + X86_MATCH_VFM(INTEL_BROADWELL, &snb_cstates), + X86_MATCH_VFM(INTEL_BROADWELL_D, &snb_cstates), +-- +2.51.0 + diff --git a/queue-6.19/perf-x86-intel-add-airmont-np.patch b/queue-6.19/perf-x86-intel-add-airmont-np.patch new file mode 100644 index 00000000000..f4e3edba160 --- /dev/null +++ b/queue-6.19/perf-x86-intel-add-airmont-np.patch @@ -0,0 +1,36 @@ +From 8fbac886cb98e39c698fc9775c36c45acb888ffa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 08:48:45 +0100 +Subject: perf/x86/intel: Add Airmont NP + +From: Martin Schiller + +[ Upstream commit a08340fd291671c54d379d285b2325490ce90ddd ] + +The Intel / MaxLinear Airmont NP (aka Lightning Mountain) supports the +same architectual and non-architecural events as Airmont. + +Signed-off-by: Martin Schiller +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Dapeng Mi +Link: https://patch.msgid.link/20251124074846.9653-3-ms@dev.tdt.de +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index bdf3f0d0fe216..d85df652334fb 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -7405,6 +7405,7 @@ __init int intel_pmu_init(void) + case INTEL_ATOM_SILVERMONT_D: + case INTEL_ATOM_SILVERMONT_MID: + case INTEL_ATOM_AIRMONT: ++ case INTEL_ATOM_AIRMONT_NP: + case INTEL_ATOM_SILVERMONT_MID2: + memcpy(hw_cache_event_ids, slm_hw_cache_event_ids, + sizeof(hw_cache_event_ids)); +-- +2.51.0 + diff --git a/queue-6.19/perf-x86-msr-add-airmont-np.patch b/queue-6.19/perf-x86-msr-add-airmont-np.patch new file mode 100644 index 00000000000..aff623e995a --- /dev/null +++ b/queue-6.19/perf-x86-msr-add-airmont-np.patch @@ -0,0 +1,36 @@ +From 7e4c8729f22ac0fc9bd6da0610085e26541ecb18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 08:48:44 +0100 +Subject: perf/x86/msr: Add Airmont NP + +From: Martin Schiller + +[ Upstream commit 63dbadcafc1f4d1da796a8e2c0aea1e561f79ece ] + +Like Airmont, the Airmont NP (aka Intel / MaxLinear Lightning Mountain) +supports SMI_COUNT MSR. + +Signed-off-by: Martin Schiller +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Dapeng Mi +Link: https://patch.msgid.link/20251124074846.9653-2-ms@dev.tdt.de +Signed-off-by: Sasha Levin +--- + arch/x86/events/msr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/events/msr.c b/arch/x86/events/msr.c +index 7f5007a4752a1..8052596b85036 100644 +--- a/arch/x86/events/msr.c ++++ b/arch/x86/events/msr.c +@@ -78,6 +78,7 @@ static bool test_intel(int idx, void *data) + case INTEL_ATOM_SILVERMONT: + case INTEL_ATOM_SILVERMONT_D: + case INTEL_ATOM_AIRMONT: ++ case INTEL_ATOM_AIRMONT_NP: + + case INTEL_ATOM_GOLDMONT: + case INTEL_ATOM_GOLDMONT_D: +-- +2.51.0 + diff --git a/queue-6.19/phy-cadence-torrent-restore-parent-clock-for-refclk-.patch b/queue-6.19/phy-cadence-torrent-restore-parent-clock-for-refclk-.patch new file mode 100644 index 00000000000..02fa3f10ec3 --- /dev/null +++ b/queue-6.19/phy-cadence-torrent-restore-parent-clock-for-refclk-.patch @@ -0,0 +1,77 @@ +From e4dddbba6657655341933c44ed2e0b85ebbc94e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 15:24:25 +0100 +Subject: phy: cadence-torrent: restore parent clock for refclk during resume + +From: Thomas Richard (TI.com) + +[ Upstream commit 434e1a0ee145d0389b192252be4c993f86cf1134 ] + +While suspend and resume, parent clock config for refclk was getting lost. +So save and restore it in suspend and resume operations. + +Reviewed-by: Neil Armstrong +Signed-off-by: Thomas Richard (TI.com) +Link: https://patch.msgid.link/20251216-phy-cadence-torrent-resume-restore-refclk-parent-v3-1-8a7ed84b47e3@bootlin.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/cadence/phy-cadence-torrent.c | 23 +++++++++++++++++++++++ + 1 file changed, 23 insertions(+) + +diff --git a/drivers/phy/cadence/phy-cadence-torrent.c b/drivers/phy/cadence/phy-cadence-torrent.c +index 37fa4bad6bd72..877f22177c699 100644 +--- a/drivers/phy/cadence/phy-cadence-torrent.c ++++ b/drivers/phy/cadence/phy-cadence-torrent.c +@@ -397,6 +397,7 @@ struct cdns_torrent_refclk_driver { + struct clk_hw hw; + struct regmap_field *cmn_fields[REFCLK_OUT_NUM_CMN_CONFIG]; + struct clk_init_data clk_data; ++ u8 parent_index; + }; + + #define to_cdns_torrent_refclk_driver(_hw) \ +@@ -3326,11 +3327,29 @@ static const struct cdns_torrent_vals sgmii_qsgmii_xcvr_diag_ln_vals = { + .num_regs = ARRAY_SIZE(sgmii_qsgmii_xcvr_diag_ln_regs), + }; + ++static void cdns_torrent_refclk_driver_suspend(struct cdns_torrent_phy *cdns_phy) ++{ ++ struct clk_hw *hw = cdns_phy->clk_hw_data->hws[CDNS_TORRENT_REFCLK_DRIVER]; ++ struct cdns_torrent_refclk_driver *refclk_driver = to_cdns_torrent_refclk_driver(hw); ++ ++ refclk_driver->parent_index = cdns_torrent_refclk_driver_get_parent(hw); ++} ++ ++static int cdns_torrent_refclk_driver_resume(struct cdns_torrent_phy *cdns_phy) ++{ ++ struct clk_hw *hw = cdns_phy->clk_hw_data->hws[CDNS_TORRENT_REFCLK_DRIVER]; ++ struct cdns_torrent_refclk_driver *refclk_driver = to_cdns_torrent_refclk_driver(hw); ++ ++ return cdns_torrent_refclk_driver_set_parent(hw, refclk_driver->parent_index); ++} ++ + static int cdns_torrent_phy_suspend_noirq(struct device *dev) + { + struct cdns_torrent_phy *cdns_phy = dev_get_drvdata(dev); + int i; + ++ cdns_torrent_refclk_driver_suspend(cdns_phy); ++ + reset_control_assert(cdns_phy->phy_rst); + reset_control_assert(cdns_phy->apb_rst); + for (i = 0; i < cdns_phy->nsubnodes; i++) +@@ -3352,6 +3371,10 @@ static int cdns_torrent_phy_resume_noirq(struct device *dev) + int node = cdns_phy->nsubnodes; + int ret, i; + ++ ret = cdns_torrent_refclk_driver_resume(cdns_phy); ++ if (ret) ++ return ret; ++ + ret = cdns_torrent_clk(cdns_phy); + if (ret) + return ret; +-- +2.51.0 + diff --git a/queue-6.19/phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch b/queue-6.19/phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch new file mode 100644 index 00000000000..e9f6499278f --- /dev/null +++ b/queue-6.19/phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch @@ -0,0 +1,38 @@ +From ab1ed626d1cfbfc50d590a01833e85121f3a1e2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 19:17:12 +0800 +Subject: phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature + +From: Xu Yang + +[ Upstream commit 27ee0869d77b2cb404770ac49bdceae3aedf658b ] + +Disabling PHYs in runtime usually causes the client with external abort +exception or similar issue due to lack of API to notify clients about PHY +removal. This patch removes the possibility to unbind i.MX PHY drivers in +runtime. + +Signed-off-by: Xu Yang +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20260120111712.3159782-1-xu.yang_2@nxp.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c +index 91b3e62743d3a..b30d01f345d20 100644 +--- a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c ++++ b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c +@@ -730,6 +730,7 @@ static struct platform_driver imx8mq_usb_phy_driver = { + .driver = { + .name = "imx8mq-usb-phy", + .of_match_table = imx8mq_usb_phy_of_match, ++ .suppress_bind_attrs = true, + } + }; + module_platform_driver(imx8mq_usb_phy_driver); +-- +2.51.0 + diff --git a/queue-6.19/phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch b/queue-6.19/phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch new file mode 100644 index 00000000000..8746fde4620 --- /dev/null +++ b/queue-6.19/phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch @@ -0,0 +1,43 @@ +From a5f60a728a27f2e16334167b0f21bdf56c29efb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 15:06:43 +0000 +Subject: phy: mvebu-cp110-utmi: fix dr_mode property read from dts + +From: Aleksandar Gerasimovski + +[ Upstream commit e2ce913452ab56b3330539cc443b97b7ea8c3a1a ] + +The problem with the current implementation is that it does not consider +that the USB controller can have multiple PHY handles with different +arguments count, as for example we have in our cn9131 based platform: +"phys = <&cp0_comphy1 0>, <&cp0_utmi0>;". + +In such case calling "of_usb_get_dr_mode_by_phy" with -1 (no phy-cells) +leads to not proper phy detection, taking the "marvell,cp110-utmi-phy" +dts definition we can call the "of_usb_get_dr_mode_by_phy" with 0 +(#phy-cells = <0>) and safely look for that phy. + +Signed-off-by: Aleksandar Gerasimovski +Link: https://patch.msgid.link/20260106150643.922110-1-aleksandar.gerasimovski@belden.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/marvell/phy-mvebu-cp110-utmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c +index 59903f86b13f5..dd3e515a8e865 100644 +--- a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c ++++ b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c +@@ -338,7 +338,7 @@ static int mvebu_cp110_utmi_phy_probe(struct platform_device *pdev) + return -ENOMEM; + } + +- port->dr_mode = of_usb_get_dr_mode_by_phy(child, -1); ++ port->dr_mode = of_usb_get_dr_mode_by_phy(child, 0); + if ((port->dr_mode != USB_DR_MODE_HOST) && + (port->dr_mode != USB_DR_MODE_PERIPHERAL)) { + dev_err(&pdev->dev, +-- +2.51.0 + diff --git a/queue-6.19/phy-ti-phy-j721e-wiz-restore-mux-selection-during-re.patch b/queue-6.19/phy-ti-phy-j721e-wiz-restore-mux-selection-during-re.patch new file mode 100644 index 00000000000..dabe1bc4a9f --- /dev/null +++ b/queue-6.19/phy-ti-phy-j721e-wiz-restore-mux-selection-during-re.patch @@ -0,0 +1,71 @@ +From 85d421d568c82246110870adbe98f3149e5ef928 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 15:26:20 +0100 +Subject: phy: ti: phy-j721e-wiz: restore mux selection during resume + +From: Thomas Richard (TI.com) + +[ Upstream commit 53f6240e88c9e8715e09fc19942f13450db4cb33 ] + +While suspend and resume mux selection was getting lost. So save and +restore these values in suspend and resume operations. + +Signed-off-by: Thomas Richard (TI.com) +Link: https://patch.msgid.link/20251216-phy-ti-phy-j721e-wiz-resume-restore-mux-sel-v1-1-771d564db966@bootlin.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/ti/phy-j721e-wiz.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/ti/phy-j721e-wiz.c b/drivers/phy/ti/phy-j721e-wiz.c +index a8b440c6c46bb..ba31b0a1f7f79 100644 +--- a/drivers/phy/ti/phy-j721e-wiz.c ++++ b/drivers/phy/ti/phy-j721e-wiz.c +@@ -393,6 +393,7 @@ struct wiz { + struct clk *output_clks[WIZ_MAX_OUTPUT_CLOCKS]; + struct clk_onecell_data clk_data; + const struct wiz_data *data; ++ int mux_sel_status[WIZ_MUX_NUM_CLOCKS]; + }; + + static int wiz_reset(struct wiz *wiz) +@@ -1654,11 +1655,25 @@ static void wiz_remove(struct platform_device *pdev) + pm_runtime_disable(dev); + } + ++static int wiz_suspend_noirq(struct device *dev) ++{ ++ struct wiz *wiz = dev_get_drvdata(dev); ++ int i; ++ ++ for (i = 0; i < WIZ_MUX_NUM_CLOCKS; i++) ++ regmap_field_read(wiz->mux_sel_field[i], &wiz->mux_sel_status[i]); ++ ++ return 0; ++} ++ + static int wiz_resume_noirq(struct device *dev) + { + struct device_node *node = dev->of_node; + struct wiz *wiz = dev_get_drvdata(dev); +- int ret; ++ int ret, i; ++ ++ for (i = 0; i < WIZ_MUX_NUM_CLOCKS; i++) ++ regmap_field_write(wiz->mux_sel_field[i], wiz->mux_sel_status[i]); + + /* Enable supplemental Control override if available */ + if (wiz->sup_legacy_clk_override) +@@ -1680,7 +1695,7 @@ static int wiz_resume_noirq(struct device *dev) + return ret; + } + +-static DEFINE_NOIRQ_DEV_PM_OPS(wiz_pm_ops, NULL, wiz_resume_noirq); ++static DEFINE_NOIRQ_DEV_PM_OPS(wiz_pm_ops, wiz_suspend_noirq, wiz_resume_noirq); + + static struct platform_driver wiz_driver = { + .probe = wiz_probe, +-- +2.51.0 + diff --git a/queue-6.19/pinctrl-mediatek-make-devm-allocations-safer-and-cle.patch b/queue-6.19/pinctrl-mediatek-make-devm-allocations-safer-and-cle.patch new file mode 100644 index 00000000000..39f33f58720 --- /dev/null +++ b/queue-6.19/pinctrl-mediatek-make-devm-allocations-safer-and-cle.patch @@ -0,0 +1,108 @@ +From d6b05baf8603e27f5a6bb3f524304bf46d75c1a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Dec 2025 18:02:17 +0800 +Subject: pinctrl: mediatek: make devm allocations safer and clearer in + mtk_eint_do_init() + +From: Liang Jie + +[ Upstream commit 255b721c96046d4c57fa2268e4c72607868ce91f ] + +mtk_eint_do_init() allocates several pointer arrays which are then +populated in a per-instance loop and freed on error. The arrays are +currently allocated with devm_kmalloc(), so their entries are left +uninitialised until the per-instance allocations succeed. + +On a failure in the middle of the loop, the error path iterates over +the full nbase range and calls devm_kfree() on each element. For +indices which were never initialised, the corresponding array entries +contain stack garbage. If any of those happen to be non-zero, +devm_kfree() will pass them to devres_destroy(), which will WARN +because there is no matching devm_kmalloc() resource for such bogus +pointers. + +Improve the robustness and readability by: + + - Using devm_kcalloc() for the pointer arrays so that all entries + start as NULL, ensuring that only genuinely initialised elements + may be freed and preventing spurious WARN_ON()s in the error path. + - Switching the allocations to sizeof(*ptr) / sizeof(**ptr) forms, + avoiding hard-coded element types and making the code more resilient + to future type changes. + - Dropping the redundant NULL checks before devm_kfree(), as + devm_kfree() safely handles NULL pointers. + +The functional behaviour in the successful initialisation path remains +unchanged, while the error handling becomes simpler and less +error-prone. + +Reviewed-by: fanggeng +Signed-off-by: Liang Jie +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mediatek/mtk-eint.c | 29 +++++++++++++++++------------ + 1 file changed, 17 insertions(+), 12 deletions(-) + +diff --git a/drivers/pinctrl/mediatek/mtk-eint.c b/drivers/pinctrl/mediatek/mtk-eint.c +index c8c5097c11c4d..2a3c04eedc5f3 100644 +--- a/drivers/pinctrl/mediatek/mtk-eint.c ++++ b/drivers/pinctrl/mediatek/mtk-eint.c +@@ -544,24 +544,32 @@ int mtk_eint_do_init(struct mtk_eint *eint, struct mtk_eint_pin *eint_pin) + } + } + +- eint->pin_list = devm_kmalloc(eint->dev, eint->nbase * sizeof(u16 *), GFP_KERNEL); ++ eint->pin_list = devm_kcalloc(eint->dev, eint->nbase, ++ sizeof(*eint->pin_list), GFP_KERNEL); + if (!eint->pin_list) + goto err_pin_list; + +- eint->wake_mask = devm_kmalloc(eint->dev, eint->nbase * sizeof(u32 *), GFP_KERNEL); ++ eint->wake_mask = devm_kcalloc(eint->dev, eint->nbase, ++ sizeof(*eint->wake_mask), GFP_KERNEL); + if (!eint->wake_mask) + goto err_wake_mask; + +- eint->cur_mask = devm_kmalloc(eint->dev, eint->nbase * sizeof(u32 *), GFP_KERNEL); ++ eint->cur_mask = devm_kcalloc(eint->dev, eint->nbase, ++ sizeof(*eint->cur_mask), GFP_KERNEL); + if (!eint->cur_mask) + goto err_cur_mask; + + for (i = 0; i < eint->nbase; i++) { +- eint->pin_list[i] = devm_kzalloc(eint->dev, eint->base_pin_num[i] * sizeof(u16), ++ eint->pin_list[i] = devm_kzalloc(eint->dev, ++ eint->base_pin_num[i] * sizeof(**eint->pin_list), + GFP_KERNEL); + port = DIV_ROUND_UP(eint->base_pin_num[i], 32); +- eint->wake_mask[i] = devm_kzalloc(eint->dev, port * sizeof(u32), GFP_KERNEL); +- eint->cur_mask[i] = devm_kzalloc(eint->dev, port * sizeof(u32), GFP_KERNEL); ++ eint->wake_mask[i] = devm_kzalloc(eint->dev, ++ port * sizeof(**eint->wake_mask), ++ GFP_KERNEL); ++ eint->cur_mask[i] = devm_kzalloc(eint->dev, ++ port * sizeof(**eint->cur_mask), ++ GFP_KERNEL); + if (!eint->pin_list[i] || !eint->wake_mask[i] || !eint->cur_mask[i]) + goto err_eint; + } +@@ -597,12 +605,9 @@ int mtk_eint_do_init(struct mtk_eint *eint, struct mtk_eint_pin *eint_pin) + + err_eint: + for (i = 0; i < eint->nbase; i++) { +- if (eint->cur_mask[i]) +- devm_kfree(eint->dev, eint->cur_mask[i]); +- if (eint->wake_mask[i]) +- devm_kfree(eint->dev, eint->wake_mask[i]); +- if (eint->pin_list[i]) +- devm_kfree(eint->dev, eint->pin_list[i]); ++ devm_kfree(eint->dev, eint->cur_mask[i]); ++ devm_kfree(eint->dev, eint->wake_mask[i]); ++ devm_kfree(eint->dev, eint->pin_list[i]); + } + devm_kfree(eint->dev, eint->cur_mask); + err_cur_mask: +-- +2.51.0 + diff --git a/queue-6.19/pinctrl-renesas-rzt2h-allow-.get_direction-for-irq-f.patch b/queue-6.19/pinctrl-renesas-rzt2h-allow-.get_direction-for-irq-f.patch new file mode 100644 index 00000000000..a7eb471d30d --- /dev/null +++ b/queue-6.19/pinctrl-renesas-rzt2h-allow-.get_direction-for-irq-f.patch @@ -0,0 +1,101 @@ +From fed781a232d26d21793bc31ed3026dc32eebfbb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 17:02:28 +0200 +Subject: pinctrl: renesas: rzt2h: Allow .get_direction() for IRQ function + GPIOs + +From: Cosmin Tanislav + +[ Upstream commit 49b039a61a314c18074c15a7047705399e1240e6 ] + +Setting up an IRQ would normally be done in the .activate() and +.deactivate() ops of the IRQ domain, but for hierarchical IRQ domains +the .activate() and .deactivate() ops are overridden in the +gpiochip_hierarchy_setup_domain_ops() function. + +As such, activating and deactivating need to be done in the .translate() +and .free() ops of the IRQ domain. + +For RZ/T2H and RZ/N2H, interrupts go through the pin controller, into +the ICU, which level-translates them and forwards them to the GIC. + +To use a GPIO as an interrupt it needs to be put into peripheral +function mode 0, which will connect it to the IRQ lines of the ICU. + +The IRQ chip .child_to_parent_hwirq() callback is called as part of the +IRQ fwspec parsing logic (as part of irq_create_of_mapping()) which +happens before the IRQ is requested (as part of gpiochip_lock_as_irq()). + +gpiochip_lock_as_irq() calls gpiod_get_direction() if the +.get_direction() callback is provided to ensure that the GPIO line is +set up as input. + +In our case, IRQ function is separate from GPIO, and both cannot be true +at the same time. + +Return GPIO_LINE_DIRECTION_IN even if pin is in IRQ function to allow +this setup to work. + +Hold the spinlock to ensure atomicity between reading the PMC register +(which determines whether the pin is in GPIO mode or not) and reading +the function of the pin when it is not in GPIO mode. + +Signed-off-by: Cosmin Tanislav +Reviewed-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20251205150234.2958140-3-cosmin-gabriel.tanislav.xa@renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pinctrl-rzt2h.c | 21 ++++++++++++++++++++- + 1 file changed, 20 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/renesas/pinctrl-rzt2h.c b/drivers/pinctrl/renesas/pinctrl-rzt2h.c +index 4826ff91cd906..40df706210119 100644 +--- a/drivers/pinctrl/renesas/pinctrl-rzt2h.c ++++ b/drivers/pinctrl/renesas/pinctrl-rzt2h.c +@@ -51,6 +51,7 @@ + + #define PFC_MASK GENMASK_ULL(5, 0) + #define PFC_PIN_MASK(pin) (PFC_MASK << ((pin) * 8)) ++#define PFC_FUNC_INTERRUPT 0 + + /* + * Use 16 lower bits [15:0] for pin identifier +@@ -486,6 +487,7 @@ static int rzt2h_gpio_get_direction(struct gpio_chip *chip, unsigned int offset) + struct rzt2h_pinctrl *pctrl = gpiochip_get_data(chip); + u8 port = RZT2H_PIN_ID_TO_PORT(offset); + u8 bit = RZT2H_PIN_ID_TO_PIN(offset); ++ u64 reg64; + u16 reg; + int ret; + +@@ -493,8 +495,25 @@ static int rzt2h_gpio_get_direction(struct gpio_chip *chip, unsigned int offset) + if (ret) + return ret; + +- if (rzt2h_pinctrl_readb(pctrl, port, PMC(port)) & BIT(bit)) ++ guard(spinlock_irqsave)(&pctrl->lock); ++ ++ if (rzt2h_pinctrl_readb(pctrl, port, PMC(port)) & BIT(bit)) { ++ /* ++ * When a GPIO is being requested as an IRQ, the pinctrl ++ * framework expects to be able to read the GPIO's direction. ++ * IRQ function is separate from GPIO, and enabling it takes the ++ * pin out of GPIO mode. ++ * At this point, .child_to_parent_hwirq() has already been ++ * called to enable the IRQ function. ++ * Default to input direction for IRQ function. ++ */ ++ reg64 = rzt2h_pinctrl_readq(pctrl, port, PFC(port)); ++ reg64 = (reg64 >> (bit * 8)) & PFC_MASK; ++ if (reg64 == PFC_FUNC_INTERRUPT) ++ return GPIO_LINE_DIRECTION_IN; ++ + return -EINVAL; ++ } + + reg = rzt2h_pinctrl_readw(pctrl, port, PM(port)); + reg = (reg >> (bit * 2)) & PM_MASK; +-- +2.51.0 + diff --git a/queue-6.19/power-sequencing-fix-missing-state_lock-in-pwrseq_po.patch b/queue-6.19/power-sequencing-fix-missing-state_lock-in-pwrseq_po.patch new file mode 100644 index 00000000000..d0427a5ad11 --- /dev/null +++ b/queue-6.19/power-sequencing-fix-missing-state_lock-in-pwrseq_po.patch @@ -0,0 +1,49 @@ +From 402c9547ab5e01374c6be1ed4251f8d6e8adaa3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 18:26:51 +0000 +Subject: power: sequencing: fix missing state_lock in pwrseq_power_on() error + path + +From: Ziyi Guo + +[ Upstream commit e1dccb485c2876ac1318f36ccc0155416c633a48 ] + +pwrseq_power_on() calls pwrseq_unit_disable() when the +post_enable callback fails. However, this call is outside the +scoped_guard(mutex, &pwrseq->state_lock) block that ends. + +pwrseq_unit_disable() has lockdep_assert_held(&pwrseq->state_lock), +which will fail when called from this error path. + +Add the scoped_guard block to cover the post_enable callback and its +error handling to ensure the lock is held when pwrseq_unit_disable() is +called. + +Signed-off-by: Ziyi Guo +Link: https://patch.msgid.link/20260130182651.1576579-1-n7l8m4@u.northwestern.edu +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/power/sequencing/core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/power/sequencing/core.c b/drivers/power/sequencing/core.c +index 190564e559885..1fcf0af7cc0bb 100644 +--- a/drivers/power/sequencing/core.c ++++ b/drivers/power/sequencing/core.c +@@ -914,8 +914,10 @@ int pwrseq_power_on(struct pwrseq_desc *desc) + if (target->post_enable) { + ret = target->post_enable(pwrseq); + if (ret) { +- pwrseq_unit_disable(pwrseq, unit); +- desc->powered_on = false; ++ scoped_guard(mutex, &pwrseq->state_lock) { ++ pwrseq_unit_disable(pwrseq, unit); ++ desc->powered_on = false; ++ } + } + } + +-- +2.51.0 + diff --git a/queue-6.19/powercap-intel_rapl-add-pl4-support-for-ice-lake.patch b/queue-6.19/powercap-intel_rapl-add-pl4-support-for-ice-lake.patch new file mode 100644 index 00000000000..12d6a97b3ff --- /dev/null +++ b/queue-6.19/powercap-intel_rapl-add-pl4-support-for-ice-lake.patch @@ -0,0 +1,36 @@ +From 402cfb6a46ff1184b28a8b167748f3780a77ff7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 21:01:52 -0500 +Subject: powercap: intel_rapl: Add PL4 support for Ice Lake + +From: Daniel Tang + +[ Upstream commit 54b3cd55a515c7c0fcfa0c1f0b10d62c11d64bcc ] + +Microsoft Surface Pro 7 firmware throttles the processor upon +boot/resume. Userspace needs to be able to restore the correct value. + +Link: https://github.com/linux-surface/linux-surface/issues/706 +Signed-off-by: Daniel Tang +Link: https://patch.msgid.link/6088605.ChMirdbgyp@daniel-desktop3 +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/powercap/intel_rapl_msr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/powercap/intel_rapl_msr.c b/drivers/powercap/intel_rapl_msr.c +index 152893dca5653..3d5e7f56d68a1 100644 +--- a/drivers/powercap/intel_rapl_msr.c ++++ b/drivers/powercap/intel_rapl_msr.c +@@ -160,6 +160,7 @@ static int rapl_msr_write_raw(int cpu, struct reg_action *ra) + + /* List of verified CPUs. */ + static const struct x86_cpu_id pl4_support_ids[] = { ++ X86_MATCH_VFM(INTEL_ICELAKE_L, NULL), + X86_MATCH_VFM(INTEL_TIGERLAKE_L, NULL), + X86_MATCH_VFM(INTEL_ALDERLAKE, NULL), + X86_MATCH_VFM(INTEL_ALDERLAKE_L, NULL), +-- +2.51.0 + diff --git a/queue-6.19/pstore-ram_core-fix-incorrect-success-return-when-vm.patch b/queue-6.19/pstore-ram_core-fix-incorrect-success-return-when-vm.patch new file mode 100644 index 00000000000..4428e7873a0 --- /dev/null +++ b/queue-6.19/pstore-ram_core-fix-incorrect-success-return-when-vm.patch @@ -0,0 +1,49 @@ +From 0dba926e2baacebe053994ad7ab0797debc259e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 10:03:58 +0800 +Subject: pstore: ram_core: fix incorrect success return when vmap() fails + +From: Ruipeng Qi + +[ Upstream commit 05363abc7625cf18c96e67f50673cd07f11da5e9 ] + +In persistent_ram_vmap(), vmap() may return NULL on failure. + +If offset is non-zero, adding offset_in_page(start) causes the function +to return a non-NULL pointer even though the mapping failed. +persistent_ram_buffer_map() therefore incorrectly returns success. + +Subsequent access to prz->buffer may dereference an invalid address +and cause crashes. + +Add proper NULL checking for vmap() failures. + +Signed-off-by: Ruipeng Qi +Link: https://patch.msgid.link/20260203020358.3315299-1-ruipengqi3@gmail.com +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + fs/pstore/ram_core.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c +index c9eaacdec37e4..7b6d6378a3b87 100644 +--- a/fs/pstore/ram_core.c ++++ b/fs/pstore/ram_core.c +@@ -457,6 +457,13 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size, + vaddr = vmap(pages, page_count, VM_MAP | VM_IOREMAP, prot); + kfree(pages); + ++ /* ++ * vmap() may fail and return NULL. Do not add the offset in this ++ * case, otherwise a NULL mapping would appear successful. ++ */ ++ if (!vaddr) ++ return NULL; ++ + /* + * Since vmap() uses page granularity, we must add the offset + * into the page here, to get the byte granularity address +-- +2.51.0 + diff --git a/queue-6.19/ptp-ptp_vmclock-add-vmclock-to-acpi-device-match.patch b/queue-6.19/ptp-ptp_vmclock-add-vmclock-to-acpi-device-match.patch new file mode 100644 index 00000000000..a12e3b84d18 --- /dev/null +++ b/queue-6.19/ptp-ptp_vmclock-add-vmclock-to-acpi-device-match.patch @@ -0,0 +1,42 @@ +From 02ceeede1c7a35ec3d908bf9c13ceb27979c16e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 17:36:04 +0000 +Subject: ptp: ptp_vmclock: add 'VMCLOCK' to ACPI device match + +From: David Woodhouse + +[ Upstream commit ed4d23ed469ca14d47670c0384f6ae6c4ff060a5 ] + +As we finalised the spec, we spotted that vmgenid actually says that the +_HID is supposed to be hypervisor-specific. Although in the 13 years +since the original vmgenid doc was published, nobody seems to have cared +about using _HID to distinguish between implementations on different +hypervisors, and we only ever use the _CID. + +For consistency, match the _CID of "VMCLOCK" too. + +Signed-off-by: David Woodhouse +Signed-off-by: Babis Chalios +Tested-by: Takahiro Itazuri +Link: https://patch.msgid.link/20260130173704.12575-6-itazur@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/ptp/ptp_vmclock.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/ptp/ptp_vmclock.c b/drivers/ptp/ptp_vmclock.c +index b3a83b03d9c14..cbbfc494680c7 100644 +--- a/drivers/ptp/ptp_vmclock.c ++++ b/drivers/ptp/ptp_vmclock.c +@@ -591,6 +591,7 @@ static int vmclock_probe(struct platform_device *pdev) + + static const struct acpi_device_id vmclock_acpi_ids[] = { + { "AMZNC10C", 0 }, ++ { "VMCLOCK", 0 }, + {} + }; + MODULE_DEVICE_TABLE(acpi, vmclock_acpi_ids); +-- +2.51.0 + diff --git a/queue-6.19/rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch b/queue-6.19/rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch new file mode 100644 index 00000000000..ca3744e6695 --- /dev/null +++ b/queue-6.19/rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch @@ -0,0 +1,47 @@ +From fc63a78f88b4fe80625a9f65360dc8a7b65d6e56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 17:15:16 +0100 +Subject: RDMA/rtrs-clt: For conn rejection use actual err number + +From: Md Haris Iqbal + +[ Upstream commit fc290630702b530c2969061e7ef0d869a5b6dc4f ] + +When the connection establishment request is rejected from the server +side, then the actual error number sent back should be used. + +Signed-off-by: Md Haris Iqbal +Link: https://patch.msgid.link/20260107161517.56357-10-haris.iqbal@ionos.com +Reviewed-by: Grzegorz Prajsner +Reviewed-by: Jack Wang +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +index 2b397a544cb93..8fa1d72bd20a4 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +@@ -1923,7 +1923,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con, + struct rtrs_path *s = con->c.path; + const struct rtrs_msg_conn_rsp *msg; + const char *rej_msg; +- int status, errno; ++ int status, errno = -ECONNRESET; + u8 data_len; + + status = ev->status; +@@ -1945,7 +1945,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con, + status, rej_msg); + } + +- return -ECONNRESET; ++ return errno; + } + + void rtrs_clt_close_conns(struct rtrs_clt_path *clt_path, bool wait) +-- +2.51.0 + diff --git a/queue-6.19/regulator-core-remove-regulator-supply_name-length-l.patch b/queue-6.19/regulator-core-remove-regulator-supply_name-length-l.patch new file mode 100644 index 00000000000..3317c0739c4 --- /dev/null +++ b/queue-6.19/regulator-core-remove-regulator-supply_name-length-l.patch @@ -0,0 +1,67 @@ +From 842c1b0b35466deb9325fbd95305d1db1b5bb4aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Feb 2026 21:37:14 -0600 +Subject: regulator: core: Remove regulator supply_name length limit + +From: Bjorn Andersson + +[ Upstream commit e243cdd87b911ce9968b62e4ab2b680dfadc4341 ] + +When creating the regulator object, associated with a consumer device, +the supply_name is string formatted into a statically sized buffer on +the stack, then strdup()'ed onto the heap. + +Not only is the dance on the stack unnecessary, but when the device's +name is long we might not fit the constructed supply_name in the fixed +64 byte buffer on the stack. + +One such case can be seen on the Qualcomm Rb3Gen2 board, where we find a +PCIe controller, with a PCIe switch, with a USB controller, with a USB +hub, consuming a regulator. In this example the dev->kobj.name itself is +62 characters long. + +Drop the temporary buffer on the stack and kasprintf() the string +directly on the heap, both to simplify the code, and to remove the +length limitation. + +Signed-off-by: Bjorn Andersson +Link: https://patch.msgid.link/20260211-regulator-supply-name-length-v1-1-3875541c1576@oss.qualcomm.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/core.c | 12 +----------- + 1 file changed, 1 insertion(+), 11 deletions(-) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 8ee33b777f6ce..838bbdcdede9a 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1949,8 +1949,6 @@ static const struct file_operations constraint_flags_fops = { + #endif + }; + +-#define REG_STR_SIZE 64 +- + static void link_and_create_debugfs(struct regulator *regulator, struct regulator_dev *rdev, + struct device *dev) + { +@@ -1998,15 +1996,7 @@ static struct regulator *create_regulator(struct regulator_dev *rdev, + lockdep_assert_held_once(&rdev->mutex.base); + + if (dev) { +- char buf[REG_STR_SIZE]; +- int size; +- +- size = snprintf(buf, REG_STR_SIZE, "%s-%s", +- dev->kobj.name, supply_name); +- if (size >= REG_STR_SIZE) +- return NULL; +- +- supply_name = kstrdup(buf, GFP_KERNEL); ++ supply_name = kasprintf(GFP_KERNEL, "%s-%s", dev->kobj.name, supply_name); + if (supply_name == NULL) + return NULL; + } else { +-- +2.51.0 + diff --git a/queue-6.19/remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch b/queue-6.19/remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch new file mode 100644 index 00000000000..c25e7b572c4 --- /dev/null +++ b/queue-6.19/remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch @@ -0,0 +1,51 @@ +From b9329f55820e1848be9f45e18dcba7fe7c0d0ef8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Dec 2025 14:28:23 +0200 +Subject: remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox + TX channel is uninitialized + +From: Iuliana Prodan + +[ Upstream commit d62e0e92e589c53c4320ed5914af5fe103f5ce7e ] + +Firmwares that do not use mailbox communication (e.g., the hello_world +sample) leave priv->tx_ch as NULL. The current suspend logic +unconditionally sends RP_MBOX_SUSPEND_SYSTEM, which is invalid without +an initialized TX channel. + +Detect the no_mailboxes case early and skip sending the suspend +message. Instead, proceed directly to the runtime PM suspend path, +which is the correct behavior for firmwares that cannot respond to +mailbox requests. + +Signed-off-by: Iuliana Prodan +Link: https://lore.kernel.org/r/20251204122825.756106-1-iuliana.prodan@oss.nxp.com +Signed-off-by: Mathieu Poirier +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/imx_dsp_rproc.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/remoteproc/imx_dsp_rproc.c b/drivers/remoteproc/imx_dsp_rproc.c +index 5a9a8fa031f6d..9e4f50e0e822d 100644 +--- a/drivers/remoteproc/imx_dsp_rproc.c ++++ b/drivers/remoteproc/imx_dsp_rproc.c +@@ -1260,6 +1260,15 @@ static int imx_dsp_suspend(struct device *dev) + if (rproc->state != RPROC_RUNNING) + goto out; + ++ /* ++ * No channel available for sending messages; ++ * indicates no mailboxes present, so trigger PM runtime suspend ++ */ ++ if (!priv->tx_ch) { ++ dev_dbg(dev, "No initialized mbox tx channel, suspend directly.\n"); ++ goto out; ++ } ++ + reinit_completion(&priv->pm_comp); + + /* Tell DSP that suspend is happening */ +-- +2.51.0 + diff --git a/queue-6.19/remoteproc-mediatek-break-lock-dependency-to-prepare.patch b/queue-6.19/remoteproc-mediatek-break-lock-dependency-to-prepare.patch new file mode 100644 index 00000000000..3151085e1e6 --- /dev/null +++ b/queue-6.19/remoteproc-mediatek-break-lock-dependency-to-prepare.patch @@ -0,0 +1,261 @@ +From e318d7fcf37cb1abbb7121c798d560722e25692b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 11:07:55 +0000 +Subject: remoteproc: mediatek: Break lock dependency to `prepare_lock` + +From: Tzung-Bi Shih + +[ Upstream commit d935187cfb27fc4168f78f3959aef4eafaae76bb ] + +A potential circular locking dependency (ABBA deadlock) exists between +`ec_dev->lock` and the clock framework's `prepare_lock`. + +The first order (A -> B) occurs when scp_ipi_send() is called while +`ec_dev->lock` is held (e.g., within cros_ec_cmd_xfer()): +1. cros_ec_cmd_xfer() acquires `ec_dev->lock` and calls scp_ipi_send(). +2. scp_ipi_send() calls clk_prepare_enable(), which acquires + `prepare_lock`. +See #0 in the following example calling trace. +(Lock Order: `ec_dev->lock` -> `prepare_lock`) + +The reverse order (B -> A) is more complex and has been observed +(learned) by lockdep. It involves the clock prepare operation +triggering power domain changes, which then propagates through sysfs +and power supply uevents, eventually calling back into the ChromeOS EC +driver and attempting to acquire `ec_dev->lock`: +1. Something calls clk_prepare(), which acquires `prepare_lock`. It + then triggers genpd operations like genpd_runtime_resume(), which + takes `&genpd->mlock`. +2. Power domain changes can trigger regulator changes; regulator + changes can then trigger device link changes; device link changes + can then trigger sysfs changes. Eventually, power_supply_uevent() + is called. +3. This leads to calls like cros_usbpd_charger_get_prop(), which calls + cros_ec_cmd_xfer_status(), which then attempts to acquire + `ec_dev->lock`. +See #1 ~ #6 in the following example calling trace. +(Lock Order: `prepare_lock` -> `&genpd->mlock` -> ... -> `&ec_dev->lock`) + +Move the clk_prepare()/clk_unprepare() operations for `scp->clk` to the +remoteproc prepare()/unprepare() callbacks. This ensures `prepare_lock` +is only acquired in prepare()/unprepare() callbacks. Since +`ec_dev->lock` is not involved in the callbacks, the dependency loop is +broken. + +This means the clock is always "prepared" when the SCP is running. The +prolonged "prepared time" for the clock should be acceptable as SCP is +designed to be a very power efficient processor. The power consumption +impact can be negligible. + +A simplified calling trace reported by lockdep: +> -> #6 (&ec_dev->lock) +> cros_ec_cmd_xfer +> cros_ec_cmd_xfer_status +> cros_usbpd_charger_get_port_status +> cros_usbpd_charger_get_prop +> power_supply_get_property +> power_supply_show_property +> power_supply_uevent +> dev_uevent +> uevent_show +> dev_attr_show +> sysfs_kf_seq_show +> kernfs_seq_show +> -> #5 (kn->active#2) +> kernfs_drain +> __kernfs_remove +> kernfs_remove_by_name_ns +> sysfs_remove_file_ns +> device_del +> __device_link_del +> device_links_driver_bound +> -> #4 (device_links_lock) +> device_link_remove +> _regulator_put +> regulator_put +> -> #3 (regulator_list_mutex) +> regulator_lock_dependent +> regulator_disable +> scpsys_power_off +> _genpd_power_off +> genpd_power_off +> -> #2 (&genpd->mlock/1) +> genpd_add_subdomain +> pm_genpd_add_subdomain +> scpsys_add_subdomain +> scpsys_probe +> -> #1 (&genpd->mlock) +> genpd_runtime_resume +> __rpm_callback +> rpm_callback +> rpm_resume +> __pm_runtime_resume +> clk_core_prepare +> clk_prepare +> -> #0 (prepare_lock) +> clk_prepare +> scp_ipi_send +> scp_send_ipi +> mtk_rpmsg_send +> rpmsg_send +> cros_ec_pkt_xfer_rpmsg + +Signed-off-by: Tzung-Bi Shih +Reviewed-by: Chen-Yu Tsai +Tested-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20260112110755.2435899-1-tzungbi@kernel.org +Signed-off-by: Mathieu Poirier +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/mtk_scp.c | 39 +++++++++++++++++++++++--------- + drivers/remoteproc/mtk_scp_ipi.c | 4 ++-- + 2 files changed, 30 insertions(+), 13 deletions(-) + +diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c +index db8fd045468d9..98d00bd5200cc 100644 +--- a/drivers/remoteproc/mtk_scp.c ++++ b/drivers/remoteproc/mtk_scp.c +@@ -283,7 +283,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv) + struct mtk_scp *scp = priv; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(scp->dev, "failed to enable clocks\n"); + return IRQ_NONE; +@@ -291,7 +291,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv) + + scp->data->scp_irq_handler(scp); + +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + + return IRQ_HANDLED; + } +@@ -665,7 +665,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw) + struct device *dev = scp->dev; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(dev, "failed to enable clocks\n"); + return ret; +@@ -680,7 +680,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw) + + ret = scp_elf_load_segments(rproc, fw); + leave: +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + + return ret; + } +@@ -691,14 +691,14 @@ static int scp_parse_fw(struct rproc *rproc, const struct firmware *fw) + struct device *dev = scp->dev; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(dev, "failed to enable clocks\n"); + return ret; + } + + ret = scp_ipi_init(scp, fw); +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + return ret; + } + +@@ -709,7 +709,7 @@ static int scp_start(struct rproc *rproc) + struct scp_run *run = &scp->run; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(dev, "failed to enable clocks\n"); + return ret; +@@ -734,14 +734,14 @@ static int scp_start(struct rproc *rproc) + goto stop; + } + +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + dev_info(dev, "SCP is ready. FW version %s\n", run->fw_ver); + + return 0; + + stop: + scp->data->scp_reset_assert(scp); +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + return ret; + } + +@@ -909,7 +909,7 @@ static int scp_stop(struct rproc *rproc) + struct mtk_scp *scp = rproc->priv; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(scp->dev, "failed to enable clocks\n"); + return ret; +@@ -917,12 +917,29 @@ static int scp_stop(struct rproc *rproc) + + scp->data->scp_reset_assert(scp); + scp->data->scp_stop(scp); +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + + return 0; + } + ++static int scp_prepare(struct rproc *rproc) ++{ ++ struct mtk_scp *scp = rproc->priv; ++ ++ return clk_prepare(scp->clk); ++} ++ ++static int scp_unprepare(struct rproc *rproc) ++{ ++ struct mtk_scp *scp = rproc->priv; ++ ++ clk_unprepare(scp->clk); ++ return 0; ++} ++ + static const struct rproc_ops scp_ops = { ++ .prepare = scp_prepare, ++ .unprepare = scp_unprepare, + .start = scp_start, + .stop = scp_stop, + .load = scp_load, +diff --git a/drivers/remoteproc/mtk_scp_ipi.c b/drivers/remoteproc/mtk_scp_ipi.c +index c068227e251e7..7a37e273b3af8 100644 +--- a/drivers/remoteproc/mtk_scp_ipi.c ++++ b/drivers/remoteproc/mtk_scp_ipi.c +@@ -171,7 +171,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len, + WARN_ON(len > scp_sizes->ipi_share_buffer_size) || WARN_ON(!buf)) + return -EINVAL; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(scp->dev, "failed to enable clock\n"); + return ret; +@@ -211,7 +211,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len, + + unlock_mutex: + mutex_unlock(&scp->send_lock); +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + + return ret; + } +-- +2.51.0 + diff --git a/queue-6.19/revert-arm64-zynqmp-add-an-op-tee-node-to-the-device.patch b/queue-6.19/revert-arm64-zynqmp-add-an-op-tee-node-to-the-device.patch new file mode 100644 index 00000000000..66afd38c3de --- /dev/null +++ b/queue-6.19/revert-arm64-zynqmp-add-an-op-tee-node-to-the-device.patch @@ -0,0 +1,45 @@ +From c72b1adb6d430fc4668c1a9ec226fc073c02f9d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 09:53:54 +0200 +Subject: Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" + +From: Tomas Melin + +[ Upstream commit c197179990124f991fca220d97fac56779a02c6d ] + +This reverts commit 06d22ed6b6635b17551f386b50bb5aaff9b75fbe. + +OP-TEE logic in U-Boot automatically injects a reserved-memory +node along with optee firmware node to kernel device tree. +The injection logic is dependent on that there is no manually +defined optee node. Having the node in zynqmp.dtsi effectively +breaks OP-TEE's insertion of the reserved-memory node, causing +memory access violations during runtime. + +Signed-off-by: Tomas Melin +Signed-off-by: Michal Simek +Link: https://lore.kernel.org/r/20251125-revert-zynqmp-optee-v1-1-d2ce4c0fcaf6@vaisala.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi +index 938b014ca9231..b55c6b2e8e0e1 100644 +--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi ++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi +@@ -192,11 +192,6 @@ psci { + }; + + firmware { +- optee: optee { +- compatible = "linaro,optee-tz"; +- method = "smc"; +- }; +- + zynqmp_firmware: zynqmp-firmware { + compatible = "xlnx,zynqmp-firmware"; + #power-domain-cells = <1>; +-- +2.51.0 + diff --git a/queue-6.19/revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch b/queue-6.19/revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch new file mode 100644 index 00000000000..ec335a5b6f8 --- /dev/null +++ b/queue-6.19/revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch @@ -0,0 +1,42 @@ +From 81b41e23476256375cee6c20177bc3552c8c6401 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 17:16:51 +0100 +Subject: Revert "mfd: da9052-spi: Change read-mask to write-mask" + +From: Marcus Folkesson + +[ Upstream commit 12daa9c1954542bf98bb942fb2dadf19de79a44b ] + +This reverts commit 2e3378f6c79a1b3f7855ded1ef306ea4406352ed. + +Almost every register in this chip can be customized via OTP +memory. Somehow the value for R19, which decide if the flag is set +on read or write operation, seems to have been overwritten for the chip +the original patch were written for. + +Revert the change to follow the default behavior. + +Signed-off-by: Marcus Folkesson +Link: https://patch.msgid.link/20251124-da9052-revert-v1-1-fbeb2c894002@gmail.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/da9052-spi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mfd/da9052-spi.c b/drivers/mfd/da9052-spi.c +index 80fc5c0cac2fb..be5f2b34e18ae 100644 +--- a/drivers/mfd/da9052-spi.c ++++ b/drivers/mfd/da9052-spi.c +@@ -37,7 +37,7 @@ static int da9052_spi_probe(struct spi_device *spi) + spi_set_drvdata(spi, da9052); + + config = da9052_regmap_config; +- config.write_flag_mask = 1; ++ config.read_flag_mask = 1; + config.reg_bits = 7; + config.pad_bits = 1; + config.val_bits = 8; +-- +2.51.0 + diff --git a/queue-6.19/revert-mmc-rtsx_pci_sdmmc-increase-power-on-settling.patch b/queue-6.19/revert-mmc-rtsx_pci_sdmmc-increase-power-on-settling.patch new file mode 100644 index 00000000000..3d4ead4ee32 --- /dev/null +++ b/queue-6.19/revert-mmc-rtsx_pci_sdmmc-increase-power-on-settling.patch @@ -0,0 +1,39 @@ +From 8b6d627e79dd1986f65f08d9e727f4e2056bb01d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jan 2026 15:49:31 +0100 +Subject: Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" + +From: Greg Kroah-Hartman + +[ Upstream commit ff112f1ecd10b72004eac05bae395e1c65f0c63c ] + +This reverts commit aced969e9bf3701dc75cfca57c78c031b7875b9d. + +It was determined that this was not the correct "fix", so should be +reverted. + +Fixes: aced969e9bf3 ("mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms") +Cc: Matthew Schwartz +Cc: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/rtsx_pci_sdmmc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c +index b6cf1803c7d27..4db3328f46dfb 100644 +--- a/drivers/mmc/host/rtsx_pci_sdmmc.c ++++ b/drivers/mmc/host/rtsx_pci_sdmmc.c +@@ -937,7 +937,7 @@ static int sd_power_on(struct realtek_pci_sdmmc *host, unsigned char power_mode) + if (err < 0) + return err; + +- mdelay(5); ++ mdelay(1); + + err = rtsx_pci_write_register(pcr, CARD_OE, SD_OUTPUT_EN, SD_OUTPUT_EN); + if (err < 0) +-- +2.51.0 + diff --git a/queue-6.19/riscv-vector-init-vector-context-with-proper-vlenb.patch b/queue-6.19/riscv-vector-init-vector-context-with-proper-vlenb.patch new file mode 100644 index 00000000000..a335fd3a023 --- /dev/null +++ b/queue-6.19/riscv-vector-init-vector-context-with-proper-vlenb.patch @@ -0,0 +1,83 @@ +From 8d93f012ec4095384fe6364cda0e35da5edd1d11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 21:09:56 -0700 +Subject: riscv: vector: init vector context with proper vlenb + +From: Sergey Matyukevich + +[ Upstream commit ef3ff40346db8476a9ef7269fc9d1837e7243c40 ] + +The vstate in thread_struct is zeroed when the vector context is +initialized. That includes read-only register vlenb, which holds +the vector register length in bytes. Zeroed state persists until +mstatus.VS becomes 'dirty' and a context switch saves the actual +hardware values. + +This can expose the zero vlenb value to the user-space in early +debug scenarios, e.g. when ptrace attaches to a traced process +early, before any vector instruction except the first one was +executed. + +Fix this by specifying proper vlenb on vector context init. + +Signed-off-by: Sergey Matyukevich +Reviewed-by: Andy Chiu +Tested-by: Andy Chiu +Link: https://patch.msgid.link/20251214163537.1054292-3-geomatsi@gmail.com +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/vector.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/arch/riscv/kernel/vector.c b/arch/riscv/kernel/vector.c +index 3ed071dab9d83..b112166d51e9f 100644 +--- a/arch/riscv/kernel/vector.c ++++ b/arch/riscv/kernel/vector.c +@@ -111,8 +111,8 @@ bool insn_is_vector(u32 insn_buf) + return false; + } + +-static int riscv_v_thread_zalloc(struct kmem_cache *cache, +- struct __riscv_v_ext_state *ctx) ++static int riscv_v_thread_ctx_alloc(struct kmem_cache *cache, ++ struct __riscv_v_ext_state *ctx) + { + void *datap; + +@@ -122,13 +122,15 @@ static int riscv_v_thread_zalloc(struct kmem_cache *cache, + + ctx->datap = datap; + memset(ctx, 0, offsetof(struct __riscv_v_ext_state, datap)); ++ ctx->vlenb = riscv_v_vsize / 32; ++ + return 0; + } + + void riscv_v_thread_alloc(struct task_struct *tsk) + { + #ifdef CONFIG_RISCV_ISA_V_PREEMPTIVE +- riscv_v_thread_zalloc(riscv_v_kernel_cachep, &tsk->thread.kernel_vstate); ++ riscv_v_thread_ctx_alloc(riscv_v_kernel_cachep, &tsk->thread.kernel_vstate); + #endif + } + +@@ -214,12 +216,14 @@ bool riscv_v_first_use_handler(struct pt_regs *regs) + * context where VS has been off. So, try to allocate the user's V + * context and resume execution. + */ +- if (riscv_v_thread_zalloc(riscv_v_user_cachep, ¤t->thread.vstate)) { ++ if (riscv_v_thread_ctx_alloc(riscv_v_user_cachep, ¤t->thread.vstate)) { + force_sig(SIGBUS); + return true; + } ++ + riscv_v_vstate_on(regs); + riscv_v_vstate_set_restore(current, regs); ++ + return true; + } + +-- +2.51.0 + diff --git a/queue-6.19/rnbd-srv-zero-the-rsp-buffer-before-using-it.patch b/queue-6.19/rnbd-srv-zero-the-rsp-buffer-before-using-it.patch new file mode 100644 index 00000000000..37669fbf6d9 --- /dev/null +++ b/queue-6.19/rnbd-srv-zero-the-rsp-buffer-before-using-it.patch @@ -0,0 +1,47 @@ +From c75b30c0f180ba848f837d15c448ee92537381c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 13:47:33 +0100 +Subject: rnbd-srv: Zero the rsp buffer before using it + +From: Md Haris Iqbal + +[ Upstream commit 69d26698e4fd44935510553809007151b2fe4db5 ] + +Before using the data buffer to send back the response message, zero it +completely. This prevents any stray bytes to be picked up by the client +side when there the message is exchanged between different protocol +versions. + +Signed-off-by: Md Haris Iqbal +Signed-off-by: Jack Wang +Signed-off-by: Grzegorz Prajsner +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/rnbd/rnbd-srv.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c +index 9b3fdc202e152..7eeb321d61402 100644 +--- a/drivers/block/rnbd/rnbd-srv.c ++++ b/drivers/block/rnbd/rnbd-srv.c +@@ -551,6 +551,8 @@ static void rnbd_srv_fill_msg_open_rsp(struct rnbd_msg_open_rsp *rsp, + { + struct block_device *bdev = file_bdev(sess_dev->bdev_file); + ++ memset(rsp, 0, sizeof(*rsp)); ++ + rsp->hdr.type = cpu_to_le16(RNBD_MSG_OPEN_RSP); + rsp->device_id = cpu_to_le32(sess_dev->device_id); + rsp->nsectors = cpu_to_le64(bdev_nr_sectors(bdev)); +@@ -657,6 +659,7 @@ static void process_msg_sess_info(struct rnbd_srv_session *srv_sess, + + trace_process_msg_sess_info(srv_sess, sess_info_msg); + ++ memset(rsp, 0, sizeof(*rsp)); + rsp->hdr.type = cpu_to_le16(RNBD_MSG_SESS_INFO_RSP); + rsp->ver = srv_sess->ver; + } +-- +2.51.0 + diff --git a/queue-6.19/rtc-interface-alarm-race-handling-should-not-discard.patch b/queue-6.19/rtc-interface-alarm-race-handling-should-not-discard.patch new file mode 100644 index 00000000000..cf07a104a8d --- /dev/null +++ b/queue-6.19/rtc-interface-alarm-race-handling-should-not-discard.patch @@ -0,0 +1,53 @@ +From f224affb2ff087479f741d14267a361819dd4309 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 17:35:19 +0000 +Subject: rtc: interface: Alarm race handling should not discard preceding + error + +From: Anthony Pighin (Nokia) + +[ Upstream commit 81be22cd4ace020045cc6d31255c6f7c071eb7c0 ] + +Commit 795cda8338ea ("rtc: interface: Fix long-standing race when setting +alarm") should not discard any errors from the preceding validations. + +Prior to that commit, if the alarm feature was disabled, or the +set_alarm failed, a meaningful error code would be returned to the +caller for further action. + +After, more often than not, the __rtc_read_time will cause a success +return code instead, misleading the caller. + +An example of this is when timer_enqueue is called for a rtc-abx080x +device. Since that driver does not clear the alarm feature bit, but +instead relies on the set_alarm operation to return invalid, the discard +of the return code causes very different behaviour; i.e. + hwclock: select() to /dev/rtc0 to wait for clock tick timed out + +Fixes: 795cda8338ea ("rtc: interface: Fix long-standing race when setting alarm") +Signed-off-by: Anthony Pighin (Nokia) +Reviewed-by: Esben Haabendal +Tested-by: Nick Bowler +Link: https://patch.msgid.link/BN0PR08MB6951415A751F236375A2945683D1A@BN0PR08MB6951.namprd08.prod.outlook.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/interface.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c +index b8b298efd9a9c..1906f4884a834 100644 +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -457,7 +457,7 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm) + * are in, we can return -ETIME to signal that the timer has already + * expired, which is true in both cases. + */ +- if ((scheduled - now) <= 1) { ++ if (!err && (scheduled - now) <= 1) { + err = __rtc_read_time(rtc, &tm); + if (err) + return err; +-- +2.51.0 + diff --git a/queue-6.19/rtc-max31335-use-correct-config-symbol-in-is_reachab.patch b/queue-6.19/rtc-max31335-use-correct-config-symbol-in-is_reachab.patch new file mode 100644 index 00000000000..4dbd6078830 --- /dev/null +++ b/queue-6.19/rtc-max31335-use-correct-config-symbol-in-is_reachab.patch @@ -0,0 +1,60 @@ +From 070e7df22eeb8706a92b90d287dc0202f223fa23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 20:54:32 -0800 +Subject: rtc: max31335: use correct CONFIG symbol in IS_REACHABLE() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Randy Dunlap + +[ Upstream commit d5aca9a17f6de884febc56018f92d743b8ea1298 ] + +IS_REACHABLE() is meant to be used with full symbol names from a kernel +.config file, not the shortened symbols used in Kconfig files, so +change HWMON to CONFIG_HWMON in 3 places. + +Fixes: dedaf03b99d6 ("rtc: max31335: add driver support") +Signed-off-by: Randy Dunlap +Acked-by: Nuno Sá +Link: https://patch.msgid.link/20260108045432.2705691-1-rdunlap@infradead.org +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-max31335.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/rtc/rtc-max31335.c b/drivers/rtc/rtc-max31335.c +index 23b7bf16b4cd5..952b455071d68 100644 +--- a/drivers/rtc/rtc-max31335.c ++++ b/drivers/rtc/rtc-max31335.c +@@ -591,7 +591,7 @@ static struct nvmem_config max31335_nvmem_cfg = { + .size = MAX31335_RAM_SIZE, + }; + +-#if IS_REACHABLE(HWMON) ++#if IS_REACHABLE(CONFIG_HWMON) + static int max31335_read_temp(struct device *dev, enum hwmon_sensor_types type, + u32 attr, int channel, long *val) + { +@@ -672,7 +672,7 @@ static int max31335_clkout_register(struct device *dev) + static int max31335_probe(struct i2c_client *client) + { + struct max31335_data *max31335; +-#if IS_REACHABLE(HWMON) ++#if IS_REACHABLE(CONFIG_HWMON) + struct device *hwmon; + #endif + const struct chip_desc *match; +@@ -727,7 +727,7 @@ static int max31335_probe(struct i2c_client *client) + return dev_err_probe(&client->dev, ret, + "cannot register rtc nvmem\n"); + +-#if IS_REACHABLE(HWMON) ++#if IS_REACHABLE(CONFIG_HWMON) + if (max31335->chip->temp_reg) { + hwmon = devm_hwmon_device_register_with_info(&client->dev, client->name, max31335, + &max31335_chip_info, NULL); +-- +2.51.0 + diff --git a/queue-6.19/rtc-nvvrs-add-arch_tegra-to-the-nv-vrs-rtc-driver.patch b/queue-6.19/rtc-nvvrs-add-arch_tegra-to-the-nv-vrs-rtc-driver.patch new file mode 100644 index 00000000000..146f35b27a6 --- /dev/null +++ b/queue-6.19/rtc-nvvrs-add-arch_tegra-to-the-nv-vrs-rtc-driver.patch @@ -0,0 +1,40 @@ +From ac4d032431444a424fa3c4854bfaf0aa4054b1d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Dec 2025 03:56:48 +0000 +Subject: rtc: nvvrs: Add ARCH_TEGRA to the NV VRS RTC driver + +From: Peter Robinson + +[ Upstream commit f9ecfd9bfedba9fd9d4b015b33b847571f7fdd42 ] + +The NV VRS RTC driver currently is only supported on the +Tegra platform so add a dep for ARCH_TEGRA and compile test +so it doesn't show up universally across all arches/platforms. + +Fixes: 9d6d6b06933c8 ("rtc: nvvrs: add NVIDIA VRS RTC device driver") +Cc: Shubhi Garg +Cc: Jon Hunter +Signed-off-by: Peter Robinson +Acked-by: Jon Hunter +Link: https://patch.msgid.link/20251222035651.433603-1-pbrobinson@gmail.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig +index 50dc779f7f983..50ba48609d74e 100644 +--- a/drivers/rtc/Kconfig ++++ b/drivers/rtc/Kconfig +@@ -418,6 +418,7 @@ config RTC_DRV_SPACEMIT_P1 + + config RTC_DRV_NVIDIA_VRS10 + tristate "NVIDIA VRS10 RTC device" ++ depends on ARCH_TEGRA || COMPILE_TEST + help + If you say yes here you will get support for the battery backed RTC device + of NVIDIA VRS (Voltage Regulator Specification). The RTC is connected via +-- +2.51.0 + diff --git a/queue-6.19/rtc-zynqmp-correct-frequency-value.patch b/queue-6.19/rtc-zynqmp-correct-frequency-value.patch new file mode 100644 index 00000000000..279505bcc55 --- /dev/null +++ b/queue-6.19/rtc-zynqmp-correct-frequency-value.patch @@ -0,0 +1,42 @@ +From 7853e63d3d17fb45a41f57abdeb7619aab03908d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 13:53:45 +0000 +Subject: rtc: zynqmp: correct frequency value + +From: Tomas Melin + +[ Upstream commit 2724fb4d429cbb724dcb6fa17953040918ebe3a2 ] + +Fix calibration value in case a clock reference is provided. +The actual calibration value written into register is +frequency - 1. + +Reviewed-by: Harini T +Tested-by: Harini T +Signed-off-by: Tomas Melin +Acked-by: Michal Simek +Link: https://patch.msgid.link/20260122-zynqmp-rtc-updates-v4-1-d4edb966b499@vaisala.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-zynqmp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/rtc/rtc-zynqmp.c b/drivers/rtc/rtc-zynqmp.c +index 3baa2b481d9f2..856bc1678e7d3 100644 +--- a/drivers/rtc/rtc-zynqmp.c ++++ b/drivers/rtc/rtc-zynqmp.c +@@ -345,7 +345,10 @@ static int xlnx_rtc_probe(struct platform_device *pdev) + &xrtcdev->freq); + if (ret) + xrtcdev->freq = RTC_CALIB_DEF; ++ } else { ++ xrtcdev->freq--; + } ++ + ret = readl(xrtcdev->reg_base + RTC_CALIB_RD); + if (!ret) + writel(xrtcdev->freq, (xrtcdev->reg_base + RTC_CALIB_WR)); +-- +2.51.0 + diff --git a/queue-6.19/rtla-fix-null-pointer-dereference-in-actions_parse.patch b/queue-6.19/rtla-fix-null-pointer-dereference-in-actions_parse.patch new file mode 100644 index 00000000000..4704d413d0b --- /dev/null +++ b/queue-6.19/rtla-fix-null-pointer-dereference-in-actions_parse.patch @@ -0,0 +1,45 @@ +From fe7b1d2c559bed8405eb28f6bed565abae11ec45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 08:49:48 -0300 +Subject: rtla: Fix NULL pointer dereference in actions_parse + +From: Wander Lairson Costa + +[ Upstream commit a0890f9dbd24b302d327fe7dad9b9c5be0e278aa ] + +The actions_parse() function uses strtok() to tokenize the trigger +string, but does not check if the returned token is NULL before +passing it to strcmp(). If the trigger parameter is an empty string +or contains only delimiter characters, strtok() returns NULL, causing +strcmp() to dereference a NULL pointer and crash the program. + +This issue can be triggered by malformed user input or edge cases in +trigger string parsing. Add a NULL check immediately after the strtok() +call to validate that a token was successfully extracted before using +it. If no token is found, the function now returns -1 to indicate a +parsing error. + +Signed-off-by: Wander Lairson Costa +Link: https://lore.kernel.org/r/20260106133655.249887-13-wander@redhat.com +Signed-off-by: Tomas Glozar +Signed-off-by: Sasha Levin +--- + tools/tracing/rtla/src/actions.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/tracing/rtla/src/actions.c b/tools/tracing/rtla/src/actions.c +index 8945aee58d511..15986505b4376 100644 +--- a/tools/tracing/rtla/src/actions.c ++++ b/tools/tracing/rtla/src/actions.c +@@ -141,6 +141,8 @@ actions_parse(struct actions *self, const char *trigger, const char *tracefn) + + strcpy(trigger_c, trigger); + token = strtok(trigger_c, ","); ++ if (!token) ++ return -1; + + if (strcmp(token, "trace") == 0) + type = ACTION_TRACE_OUTPUT; +-- +2.51.0 + diff --git a/queue-6.19/rust-cpufreq-always-inline-functions-using-build_ass.patch b/queue-6.19/rust-cpufreq-always-inline-functions-using-build_ass.patch new file mode 100644 index 00000000000..462cbd85b9e --- /dev/null +++ b/queue-6.19/rust-cpufreq-always-inline-functions-using-build_ass.patch @@ -0,0 +1,39 @@ +From 59e860d296ae98af1d318627acea5ef602139886 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Nov 2025 11:11:39 +0900 +Subject: rust: cpufreq: always inline functions using build_assert with + arguments + +From: Alexandre Courbot + +[ Upstream commit 8c8b12a55614ea05953e8d695e700e6e1322a05d ] + +`build_assert` relies on the compiler to optimize out its error path. +Functions using it with its arguments must thus always be inlined, +otherwise the error path of `build_assert` might not be optimized out, +triggering a build error. + +Signed-off-by: Alexandre Courbot +Reviewed-by: Daniel Almeida +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + rust/kernel/cpufreq.rs | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/rust/kernel/cpufreq.rs b/rust/kernel/cpufreq.rs +index f968fbd228905..0879a79485f8e 100644 +--- a/rust/kernel/cpufreq.rs ++++ b/rust/kernel/cpufreq.rs +@@ -1015,6 +1015,8 @@ impl Registration { + ..pin_init::zeroed() + }; + ++ // Always inline to optimize out error path of `build_assert`. ++ #[inline(always)] + const fn copy_name(name: &'static CStr) -> [c_char; CPUFREQ_NAME_LEN] { + let src = name.to_bytes_with_nul(); + let mut dst = [0; CPUFREQ_NAME_LEN]; +-- +2.51.0 + diff --git a/queue-6.19/s390-boot-add-wno-default-const-init-unsafe-to-kbuil.patch b/queue-6.19/s390-boot-add-wno-default-const-init-unsafe-to-kbuil.patch new file mode 100644 index 00000000000..e4bd023fdde --- /dev/null +++ b/queue-6.19/s390-boot-add-wno-default-const-init-unsafe-to-kbuil.patch @@ -0,0 +1,45 @@ +From def1fca04336ff8863b0ecd6dba1ddcc875f8f19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Dec 2025 16:43:58 +0100 +Subject: s390/boot: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS + +From: Heiko Carstens + +[ Upstream commit 5ba35a6c13fff0929c34aba6b7602dacbe68686c ] + +Add -Wno-default-const-init-unsafe to boot KBUILD_CFLAGS, similar to +scripts/Makefile.extrawarn, since clang generates warnings for the dummy +variable in typecheck(): + + CC arch/s390/boot/version.o + arch/s390/include/asm/ptrace.h:221:9: warning: default initialization of an object of type 'typeof (regs->psw)' (aka 'const psw_t') leaves the object uninitialized [-Wdefault-const-init-var-unsafe] + 221 | return psw_bits(regs->psw).pstate; + | ^ + arch/s390/include/asm/ptrace.h:98:2: note: expanded from macro 'psw_bits' + 98 | typecheck(psw_t, __psw); \ + | ^ + include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck' + 11 | typeof(x) __dummy2; \ + | ^ + +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/boot/Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/s390/boot/Makefile b/arch/s390/boot/Makefile +index 490167faba7a4..a1e719a79d38c 100644 +--- a/arch/s390/boot/Makefile ++++ b/arch/s390/boot/Makefile +@@ -21,6 +21,7 @@ KBUILD_AFLAGS := $(filter-out $(CC_FLAGS_MARCH),$(KBUILD_AFLAGS_DECOMPRESSOR)) + KBUILD_CFLAGS := $(filter-out $(CC_FLAGS_MARCH),$(KBUILD_CFLAGS_DECOMPRESSOR)) + KBUILD_AFLAGS += $(CC_FLAGS_MARCH_MINIMUM) -D__DISABLE_EXPORTS + KBUILD_CFLAGS += $(CC_FLAGS_MARCH_MINIMUM) -D__DISABLE_EXPORTS ++KBUILD_CFLAGS += $(call cc-option, -Wno-default-const-init-unsafe) + + CFLAGS_sclp_early_core.o += -I$(srctree)/drivers/s390/char + +-- +2.51.0 + diff --git a/queue-6.19/s390-perf-disable-register-readout-on-sampling-event.patch b/queue-6.19/s390-perf-disable-register-readout-on-sampling-event.patch new file mode 100644 index 00000000000..d78ae29a039 --- /dev/null +++ b/queue-6.19/s390-perf-disable-register-readout-on-sampling-event.patch @@ -0,0 +1,53 @@ +From 071cc638bc9b0bf029b58c30cb41865e86faf7a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 10:14:12 +0100 +Subject: s390/perf: Disable register readout on sampling events + +From: Thomas Richter + +[ Upstream commit b2c04fc1239062b39ddfdd8731ee1a10810dfb74 ] + +Running commands + # ./perf record -IR0,R1 -a sleep 1 +extracts and displays register value of general purpose register r1 and r0. +However the value displayed of any register is random and does not +reflect the register value recorded at the time of the sample interrupt. + +The sampling device driver on s390 creates a very large buffer +for the hardware to store the samples. Only when that large buffer +gets full an interrupt is generated and many hundreds of sample +entries are processed and copied to the kernel ring buffer and +eventually get copied to the perf tool. It is during the copy +to the kernel ring buffer that each sample is processed (on s390) +and at that time the register values are extracted. +This is not the original goal, the register values should be read +when the samples are created not when the samples are copied to the +kernel ring buffer. + +Prevent this event from being installed in the first place and +return -EOPNOTSUPP. This is already the case for PERF_SAMPLE_REGS_USER. + +Signed-off-by: Thomas Richter +Reviewed-by: Jan Polensky +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/perf_cpum_sf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c +index 459af23a47a5e..e8bd19ac82c7d 100644 +--- a/arch/s390/kernel/perf_cpum_sf.c ++++ b/arch/s390/kernel/perf_cpum_sf.c +@@ -841,7 +841,7 @@ static bool is_callchain_event(struct perf_event *event) + u64 sample_type = event->attr.sample_type; + + return sample_type & (PERF_SAMPLE_CALLCHAIN | PERF_SAMPLE_REGS_USER | +- PERF_SAMPLE_STACK_USER); ++ PERF_SAMPLE_REGS_INTR | PERF_SAMPLE_STACK_USER); + } + + static int cpumsf_pmu_event_init(struct perf_event *event) +-- +2.51.0 + diff --git a/queue-6.19/s390-purgatory-add-wno-default-const-init-unsafe-to-.patch b/queue-6.19/s390-purgatory-add-wno-default-const-init-unsafe-to-.patch new file mode 100644 index 00000000000..e2aa25557e2 --- /dev/null +++ b/queue-6.19/s390-purgatory-add-wno-default-const-init-unsafe-to-.patch @@ -0,0 +1,45 @@ +From 47a172fbd0119e2ad0b168826916db44614c2921 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Dec 2025 16:47:07 +0100 +Subject: s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS + +From: Heiko Carstens + +[ Upstream commit b4780fe4ddf04b51127a33d705f4a2e224df00fa ] + +Add -Wno-default-const-init-unsafe to purgatory KBUILD_CFLAGS, similar +to scripts/Makefile.extrawarn, since clang generates warnings for the +dummy variable in typecheck(): + + CC arch/s390/purgatory/purgatory.o + arch/s390/include/asm/ptrace.h:221:9: warning: default initialization of an object of type 'typeof (regs->psw)' (aka 'const psw_t') leaves the object uninitialized [-Wdefault-const-init-var-unsafe] + 221 | return psw_bits(regs->psw).pstate; + | ^ + arch/s390/include/asm/ptrace.h:98:2: note: expanded from macro 'psw_bits' + 98 | typecheck(psw_t, __psw); \ + | ^ + include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck' + 11 | typeof(x) __dummy2; \ + | ^ + +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/purgatory/Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/s390/purgatory/Makefile b/arch/s390/purgatory/Makefile +index 0c196a5b194af..61d240a37633d 100644 +--- a/arch/s390/purgatory/Makefile ++++ b/arch/s390/purgatory/Makefile +@@ -23,6 +23,7 @@ KBUILD_CFLAGS += -D__DISABLE_EXPORTS + KBUILD_CFLAGS += $(CLANG_FLAGS) + KBUILD_CFLAGS += $(if $(CONFIG_CC_IS_CLANG),-Wno-microsoft-anon-tag) + KBUILD_CFLAGS += $(call cc-option,-fno-PIE) ++KBUILD_CFLAGS += $(call cc-option, -Wno-default-const-init-unsafe) + KBUILD_AFLAGS := $(filter-out -DCC_USING_EXPOLINE,$(KBUILD_AFLAGS)) + KBUILD_AFLAGS += -D__DISABLE_EXPORTS + +-- +2.51.0 + diff --git a/queue-6.19/sched-debug-fix-updating-of-ppos-on-server-write-ops.patch b/queue-6.19/sched-debug-fix-updating-of-ppos-on-server-write-ops.patch new file mode 100644 index 00000000000..ae618b771ff --- /dev/null +++ b/queue-6.19/sched-debug-fix-updating-of-ppos-on-server-write-ops.patch @@ -0,0 +1,65 @@ +From 0b5ee2711b66e0261b8dc4574d4f0bc2eecf045a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jan 2026 10:59:00 +0100 +Subject: sched/debug: Fix updating of ppos on server write ops + +From: Joel Fernandes + +[ Upstream commit 6080fb211672aec6ce8f2f5a2e0b4eae736f2027 ] + +Updating "ppos" on error conditions does not make much sense. The pattern +is to return the error code directly without modifying the position, or +modify the position on success and return the number of bytes written. + +Since on success, the return value of apply is 0, there is no point in +modifying ppos either. Fix it by removing all this and just returning +error code or number of bytes written on success. + +Signed-off-by: Joel Fernandes +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Juri Lelli +Reviewed-by: Andrea Righi +Acked-by: Tejun Heo +Tested-by: Christian Loehle +Link: https://patch.msgid.link/20260126100050.3854740-3-arighi@nvidia.com +Signed-off-by: Sasha Levin +--- + kernel/sched/debug.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c +index 41caa22e0680a..93f009e1076d8 100644 +--- a/kernel/sched/debug.c ++++ b/kernel/sched/debug.c +@@ -345,8 +345,8 @@ static ssize_t sched_fair_server_write(struct file *filp, const char __user *ubu + long cpu = (long) ((struct seq_file *) filp->private_data)->private; + struct rq *rq = cpu_rq(cpu); + u64 runtime, period; ++ int retval = 0; + size_t err; +- int retval; + u64 value; + + err = kstrtoull_from_user(ubuf, cnt, 10, &value); +@@ -380,8 +380,6 @@ static ssize_t sched_fair_server_write(struct file *filp, const char __user *ubu + dl_server_stop(&rq->fair_server); + + retval = dl_server_apply_params(&rq->fair_server, runtime, period, 0); +- if (retval) +- cnt = retval; + + if (!runtime) + printk_deferred("Fair server disabled in CPU %d, system may crash due to starvation.\n", +@@ -389,6 +387,9 @@ static ssize_t sched_fair_server_write(struct file *filp, const char __user *ubu + + if (rq->cfs.h_nr_queued) + dl_server_start(&rq->fair_server); ++ ++ if (retval < 0) ++ return retval; + } + + *ppos += cnt; +-- +2.51.0 + diff --git a/queue-6.19/scsi-buslogic-reduce-stack-usage.patch b/queue-6.19/scsi-buslogic-reduce-stack-usage.patch new file mode 100644 index 00000000000..236a9d42bc6 --- /dev/null +++ b/queue-6.19/scsi-buslogic-reduce-stack-usage.patch @@ -0,0 +1,66 @@ +From e283128c6704ff57cce8ea0170afab059661ed5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 17:33:15 +0100 +Subject: scsi: buslogic: Reduce stack usage + +From: Arnd Bergmann + +[ Upstream commit e17f0d4cc006265dd92129db4bf9da3a2e4a4f66 ] + +Some randconfig builds run into excessive stack usage with gcc-14 or +higher, which use __attribute__((cold)) where earlier versions did not do +that: + +drivers/scsi/BusLogic.c: In function 'blogic_init': +drivers/scsi/BusLogic.c:2398:1: error: the frame size of 1680 bytes is larger than 1536 bytes [-Werror=frame-larger-than=] + +The problem is that a lot of code gets inlined into blogic_init() here. Two +functions stick out, but they are a bit different: + + - blogic_init_probeinfo_list() actually uses a few hundred bytes of kernel + stack, which is a problem in combination with other functions that also + do. Marking this one as noinline means that the stack slots get get + reused between function calls + + - blogic_reportconfig() has a few large variables, but whenever it is not + inlined into its caller, the compiler is actually smart enough to reuse + stack slots for these automatically, so marking it as noinline saves + most of the stack space by itself. + +The combination of both of these should avoid the problem entirely. + +Signed-off-by: Arnd Bergmann +Link: https://patch.msgid.link/20260203163321.2598593-1-arnd@kernel.org +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/BusLogic.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c +index a86d780d1ba40..026c3e617cb1c 100644 +--- a/drivers/scsi/BusLogic.c ++++ b/drivers/scsi/BusLogic.c +@@ -920,7 +920,8 @@ static int __init blogic_init_fp_probeinfo(struct blogic_adapter *adapter) + a particular probe order. + */ + +-static void __init blogic_init_probeinfo_list(struct blogic_adapter *adapter) ++static noinline_for_stack void __init ++blogic_init_probeinfo_list(struct blogic_adapter *adapter) + { + /* + If a PCI BIOS is present, interrogate it for MultiMaster and +@@ -1690,7 +1691,8 @@ static bool __init blogic_rdconfig(struct blogic_adapter *adapter) + blogic_reportconfig reports the configuration of Host Adapter. + */ + +-static bool __init blogic_reportconfig(struct blogic_adapter *adapter) ++static noinline_for_stack bool __init ++blogic_reportconfig(struct blogic_adapter *adapter) + { + unsigned short alltgt_mask = (1 << adapter->maxdev) - 1; + unsigned short sync_ok, fast_ok; +-- +2.51.0 + diff --git a/queue-6.19/scsi-ufs-mediatek-fix-page-faults-in-ufs_mtk_clk_sca.patch b/queue-6.19/scsi-ufs-mediatek-fix-page-faults-in-ufs_mtk_clk_sca.patch new file mode 100644 index 00000000000..80222356b3a --- /dev/null +++ b/queue-6.19/scsi-ufs-mediatek-fix-page-faults-in-ufs_mtk_clk_sca.patch @@ -0,0 +1,76 @@ +From 7230109f06e4617ee741acdc88c73821c8bffc96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 11:45:26 +0900 +Subject: scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace + event + +From: Keita Morisaki + +[ Upstream commit 9672ed3de7d772ceddd713c769c05e832fc69bae ] + +The ufs_mtk_clk_scale() trace event currently stores the address of the +name string directly via __field(const char *, name). This pointer may +become invalid after the module is unloaded, causing page faults when the +trace buffer is subsequently accessed. + +This can occur because the MediaTek UFS driver can be configured as a +loadable module (tristate in Kconfig), meaning the name string passed to +the trace event may reside in module memory that becomes invalid after +module unload. + +Fix this by using __string() and __assign_str() to copy the string contents +into the ring buffer instead of storing the pointer. This ensures the trace +data remains valid regardless of module state. + +This change increases the memory usage for each ftrace entry by a few bytes +(clock names are typically 7-15 characters like "ufs_sel" or +"ufs_sel_max_src") compared to storing an 8-byte pointer. + +Note that this change does not affect anything unless all of the following +conditions are met: + + - CONFIG_SCSI_UFS_MEDIATEK is enabled + + - ftrace tracing is enabled + + - The ufs_mtk_clk_scale event is enabled in ftrace + +Signed-off-by: Keita Morisaki +Reviewed-by: Peter Wang +Link: https://patch.msgid.link/20260202024526.122515-1-keita.morisaki@tier4.jp +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/host/ufs-mediatek-trace.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/ufs/host/ufs-mediatek-trace.h b/drivers/ufs/host/ufs-mediatek-trace.h +index b5f2ec3140748..0df8ac843379a 100644 +--- a/drivers/ufs/host/ufs-mediatek-trace.h ++++ b/drivers/ufs/host/ufs-mediatek-trace.h +@@ -33,19 +33,19 @@ TRACE_EVENT(ufs_mtk_clk_scale, + TP_ARGS(name, scale_up, clk_rate), + + TP_STRUCT__entry( +- __field(const char*, name) ++ __string(name, name) + __field(bool, scale_up) + __field(unsigned long, clk_rate) + ), + + TP_fast_assign( +- __entry->name = name; ++ __assign_str(name); + __entry->scale_up = scale_up; + __entry->clk_rate = clk_rate; + ), + + TP_printk("ufs: clk (%s) scaled %s @ %lu", +- __entry->name, ++ __get_str(name), + __entry->scale_up ? "up" : "down", + __entry->clk_rate) + ); +-- +2.51.0 + diff --git a/queue-6.19/serial-8250-8250_omap.c-add-support-for-handling-uar.patch b/queue-6.19/serial-8250-8250_omap.c-add-support-for-handling-uar.patch new file mode 100644 index 00000000000..4e0ed02d645 --- /dev/null +++ b/queue-6.19/serial-8250-8250_omap.c-add-support-for-handling-uar.patch @@ -0,0 +1,98 @@ +From d3c2c6c6ef0b105461435c91949ac2af5257b897 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 13:48:28 +0530 +Subject: serial: 8250: 8250_omap.c: Add support for handling UART error + conditions + +From: Moteen Shah + +[ Upstream commit 623b07b370e9963122d167e04fdc1dc713ebfbaf ] + +The DMA IRQ handler does not accounts for the overrun(OE) or any other +errors being reported by the IP before triggering a DMA transaction which +leads to the interrupts not being handled resulting into an IRQ storm. + +The way to handle OE is to: +1. Reset the RX FIFO. +2. Read the UART_RESUME register, which clears the internal flag + +Earlier, the driver issued DMA transations even in case of OE which shouldn't +be done according to the OE handling mechanism mentioned above, as we are +resetting the FIFO's, refer section: "12.1.6.4.8.1.3.6 Overrun During +Receive" [0]. + +[0] https://www.ti.com/lit/pdf/spruiu1 + +Signed-off-by: Moteen Shah +Link: https://patch.msgid.link/20260112081829.63049-2-m-shah@ti.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 23 +++++++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 9e49ef48b851b..e26bae0a6488f 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -100,6 +100,9 @@ + #define OMAP_UART_REV_52 0x0502 + #define OMAP_UART_REV_63 0x0603 + ++/* Resume register */ ++#define UART_OMAP_RESUME 0x0B ++ + /* Interrupt Enable Register 2 */ + #define UART_OMAP_IER2 0x1B + #define UART_OMAP_IER2_RHR_IT_DIS BIT(2) +@@ -119,7 +122,6 @@ + /* Timeout low and High */ + #define UART_OMAP_TO_L 0x26 + #define UART_OMAP_TO_H 0x27 +- + struct omap8250_priv { + void __iomem *membase; + int line; +@@ -1256,6 +1258,20 @@ static u16 omap_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir, u16 status + return status; + } + ++static void am654_8250_handle_uart_errors(struct uart_8250_port *up, u8 iir, u16 status) ++{ ++ if (status & UART_LSR_OE) { ++ serial8250_clear_and_reinit_fifos(up); ++ serial_in(up, UART_LSR); ++ serial_in(up, UART_OMAP_RESUME); ++ } else { ++ if (status & (UART_LSR_FE | UART_LSR_PE | UART_LSR_BI)) ++ serial_in(up, UART_RX); ++ if (iir & UART_IIR_XOFF) ++ serial_in(up, UART_IIR); ++ } ++} ++ + static void am654_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir, + u16 status) + { +@@ -1266,7 +1282,8 @@ static void am654_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir, + * Queue a new transfer if FIFO has data. + */ + if ((status & (UART_LSR_DR | UART_LSR_BI)) && +- (up->ier & UART_IER_RDI)) { ++ (up->ier & UART_IER_RDI) && !(status & UART_LSR_OE)) { ++ am654_8250_handle_uart_errors(up, iir, status); + omap_8250_rx_dma(up); + serial_out(up, UART_OMAP_EFR2, UART_OMAP_EFR2_TIMEOUT_BEHAVE); + } else if ((iir & 0x3f) == UART_IIR_RX_TIMEOUT) { +@@ -1282,6 +1299,8 @@ static void am654_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir, + serial_out(up, UART_OMAP_EFR2, 0x0); + up->ier |= UART_IER_RLSI | UART_IER_RDI; + serial_out(up, UART_IER, up->ier); ++ } else { ++ am654_8250_handle_uart_errors(up, iir, status); + } + } + +-- +2.51.0 + diff --git a/queue-6.19/serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch b/queue-6.19/serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch new file mode 100644 index 00000000000..e3698e6b622 --- /dev/null +++ b/queue-6.19/serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch @@ -0,0 +1,46 @@ +From b1244a418c3a9833fd1935ec2971986839ab096c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 13:48:29 +0530 +Subject: serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA + termination is done + +From: Moteen Shah + +[ Upstream commit a5fd8945a478ff9be14812693891d7c9b4185a50 ] + +Clear rx_running flag only after DMA teardown polling completes. In the +previous implementation the flag was being cleared while hardware teardown +was still in progress, creating a mismatch between software state +(flag = 0, "ready") and hardware state (still terminating). + +Signed-off-by: Moteen Shah +Link: https://patch.msgid.link/20260112081829.63049-3-m-shah@ti.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index e26bae0a6488f..272bc07c9a6b5 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -931,7 +931,6 @@ static void __dma_rx_do_complete(struct uart_8250_port *p) + goto out; + + cookie = dma->rx_cookie; +- dma->rx_running = 0; + + /* Re-enable RX FIFO interrupt now that transfer is complete */ + if (priv->habit & UART_HAS_RHR_IT_DIS) { +@@ -965,6 +964,7 @@ static void __dma_rx_do_complete(struct uart_8250_port *p) + goto out; + ret = tty_insert_flip_string(tty_port, dma->rx_buf, count); + ++ dma->rx_running = 0; + p->port.icount.rx += ret; + p->port.icount.buf_overrun += count - ret; + out: +-- +2.51.0 + diff --git a/queue-6.19/serial-8250_dw-handle-clock-enable-errors-in-runtime.patch b/queue-6.19/serial-8250_dw-handle-clock-enable-errors-in-runtime.patch new file mode 100644 index 00000000000..165de6c9a80 --- /dev/null +++ b/queue-6.19/serial-8250_dw-handle-clock-enable-errors-in-runtime.patch @@ -0,0 +1,57 @@ +From e46cdfd33d6039350d5a671bd6838f66cd352d72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 17:54:25 +0300 +Subject: serial: 8250_dw: handle clock enable errors in runtime_resume + +From: Artem Shimko + +[ Upstream commit d31228143a489ba6ba797896a07541ce06828c09 ] + +Add error checking for clk_prepare_enable() calls in +dw8250_runtime_resume(). Currently if either clock fails to enable, +the function returns success while leaving clocks in inconsistent state. + +This change implements comprehensive error handling by checking the return +values of both clk_prepare_enable() calls. If the second clock enable +operation fails after the first clock has already been successfully +enabled, the code now properly cleans up by disabling and unpreparing +the first clock before returning. The error code is then propagated to +the caller, ensuring that clock enable failures are properly reported +rather than being silently ignored. + +Signed-off-by: Artem Shimko +Link: https://patch.msgid.link/20251104145433.2316165-2-a.shimko.dev@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_dw.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c +index 27af83f0ff463..0f8207652efe6 100644 +--- a/drivers/tty/serial/8250/8250_dw.c ++++ b/drivers/tty/serial/8250/8250_dw.c +@@ -741,11 +741,18 @@ static int dw8250_runtime_suspend(struct device *dev) + + static int dw8250_runtime_resume(struct device *dev) + { ++ int ret; + struct dw8250_data *data = dev_get_drvdata(dev); + +- clk_prepare_enable(data->pclk); ++ ret = clk_prepare_enable(data->pclk); ++ if (ret) ++ return ret; + +- clk_prepare_enable(data->clk); ++ ret = clk_prepare_enable(data->clk); ++ if (ret) { ++ clk_disable_unprepare(data->pclk); ++ return ret; ++ } + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.19/serial-rsci-add-set_rtrg-callback.patch b/queue-6.19/serial-rsci-add-set_rtrg-callback.patch new file mode 100644 index 00000000000..a44bafbeebd --- /dev/null +++ b/queue-6.19/serial-rsci-add-set_rtrg-callback.patch @@ -0,0 +1,59 @@ +From 38643096cc25acdd85c0ac01d9ff4b812d8ab0f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Nov 2025 16:42:59 +0000 +Subject: serial: rsci: Add set_rtrg() callback + +From: Biju Das + +[ Upstream commit b346e5d7dbf6696176417923c49838a1beb1d785 ] + +The rtrg variable is populated in sci_init_single() for RZ/T2H. Add +set_rtrg() callback for setting the rtrg value. + +Signed-off-by: Biju Das +Tested-by: Lad Prabhakar +Link: https://patch.msgid.link/20251129164325.209213-4-biju.das.jz@bp.renesas.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/rsci.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/tty/serial/rsci.c b/drivers/tty/serial/rsci.c +index b3c48dc1e07db..0533a4bb1d03c 100644 +--- a/drivers/tty/serial/rsci.c ++++ b/drivers/tty/serial/rsci.c +@@ -151,6 +151,22 @@ static void rsci_start_rx(struct uart_port *port) + rsci_serial_out(port, CCR0, ctrl); + } + ++static int rsci_scif_set_rtrg(struct uart_port *port, int rx_trig) ++{ ++ u32 fcr = rsci_serial_in(port, FCR); ++ ++ if (rx_trig >= port->fifosize) ++ rx_trig = port->fifosize - 1; ++ else if (rx_trig < 1) ++ rx_trig = 0; ++ ++ fcr &= ~FCR_RTRG4_0; ++ fcr |= field_prep(FCR_RTRG4_0, rx_trig); ++ rsci_serial_out(port, FCR, fcr); ++ ++ return rx_trig; ++} ++ + static void rsci_set_termios(struct uart_port *port, struct ktermios *termios, + const struct ktermios *old) + { +@@ -454,6 +470,7 @@ static const struct sci_port_ops rsci_port_ops = { + .poll_put_char = rsci_poll_put_char, + .prepare_console_write = rsci_prepare_console_write, + .suspend_regs_size = rsci_suspend_regs_size, ++ .set_rtrg = rsci_scif_set_rtrg, + .shutdown_complete = rsci_shutdown_complete, + }; + +-- +2.51.0 + diff --git a/queue-6.19/series b/queue-6.19/series index 7a461b56ca0..c2f039fd258 100644 --- a/queue-6.19/series +++ b/queue-6.19/series @@ -1 +1,446 @@ rust_binder-fix-build-failure-if-config_compat.patch +mmc-rtsx_pci_sdmmc-increase-power-on-settling-delay-.patch +revert-mmc-rtsx_pci_sdmmc-increase-power-on-settling.patch +perf-test-fix-test-case-perf-evlist-tests-for-s390x.patch +perf-test-stat-tests-fix-for-virtualized-machines.patch +perf-build-raise-minimum-shellcheck-version-to-0.7.2.patch +perf-unwind-libdw-fix-invalid-reference-counts.patch +perf-callchain-fix-srcline-printing-with-inlines.patch +libsubcmd-fix-null-intersection-case-in-exclude_cmds.patch +rtc-nvvrs-add-arch_tegra-to-the-nv-vrs-rtc-driver.patch +rtc-max31335-use-correct-config-symbol-in-is_reachab.patch +perf-symbol-elf-fix-leak-of-elf-files-with-gnu-debug.patch +perf-tools-get-debug-info-of-dso-properly.patch +perf-tests-kallsyms-fix-missed-map__put.patch +perf-cs-etm-fix-decoding-for-sparse-cpu-maps.patch +perf-annotate-fix-args-leak-of-map_symbol.patch +perf-maps-fix-reference-count-leak-in-maps__find_ams.patch +perf-tests-sched-avoid-error-in-cleanup-on-loaded-ma.patch +perf-annotate-fix-memcpy-size-in-arch__grow_instruct.patch +tools-headers-go-back-to-include-asm-generic-unistd..patch +perf-annotate-fix-build_nondistro-1-missing-args-ms-.patch +perf-test-fix-test-perf-evlist-for-z-vm-s390x.patch +perf-vendor-events-amd-fix-zen-5-mab-allocation-even.patch +perf-jevents-handle-deleted-jsons-in-out-of-source-b.patch +perf-build-remove-no_libcap-that-controls-nothing.patch +libperf-build-always-place-libperf-includes-first.patch +perf-metricgroup-don-t-early-exit-if-no-cpuid-table-.patch +perf-test-fix-test-case-perftool-testsuite_report-fo.patch +objtool-rust-add-one-more-noreturn-rust-function.patch +perf-stat-ensure-metrics-are-displayed-even-with-fai.patch +perf-stat-shadow-in-prepare_metric-fix-guard-on-read.patch +io_uring-add-ioring_op_uring_cmd128-to-opcode-checks.patch +rtc-interface-alarm-race-handling-should-not-discard.patch +statmount-permission-check-should-return-eperm.patch +hfsplus-fix-volume-corruption-issue-for-generic-480.patch +audit-add-fchmodat2-to-change-attributes-class.patch +hfsplus-fix-volume-corruption-issue-for-generic-498.patch +fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch +kselftest-kublk-include-message-in-_static_assert-fo.patch +hfs-replace-bug_on-with-error-handling-for-cnid-coun.patch +audit-add-missing-syscalls-to-read-class.patch +hfsplus-pretend-special-inodes-as-regular-files.patch +i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch +i3c-mipi-i3c-hci-stop-reading-extended-capabilities-.patch +i3c-mipi-i3c-hci-reset-ring_operation1-fields-during.patch +dlm-fix-recovery-pending-middle-conversion.patch +minix-add-required-sanity-checking-to-minix_check_su.patch +dlm-validate-length-in-dlm_search_rsb_tree.patch +btrfs-don-t-bug-on-unexpected-delayed-ref-type-in-ru.patch +btrfs-fallback-to-buffered-io-if-the-data-profile-ha.patch +btrfs-handle-user-interrupt-properly-in-btrfs_trim_f.patch +netfs-when-subreq-is-marked-for-retry-do-not-check-i.patch +smb-client-add-proper-locking-around-ses-iface_last_.patch +gfs2-fiemap-page-fault-fix.patch +smb-client-prevent-races-in-query_interfaces.patch +tools-cpupower-fix-inverted-aperf-capability-check.patch +s390-boot-add-wno-default-const-init-unsafe-to-kbuil.patch +tools-power-cpupower-reset-errno-before-strtoull.patch +s390-purgatory-add-wno-default-const-init-unsafe-to-.patch +perf-arm-cmn-support-cmn-600ae.patch +arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch +rnbd-srv-zero-the-rsp-buffer-before-using-it.patch +x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch +ntfs-d_compare-must-not-block.patch +efi-cper-don-t-dump-the-entire-memory-region.patch +apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch +apei-ghes-arm-processor-error-don-t-go-past-allocate.patch +efi-cper-don-t-go-past-the-arm-processor-cper-record.patch +acpi-processor-fix-null-pointer-dereference-in-acpi_.patch +acpi-resource-add-jwipc-jvc9100-to-irq1_level_low_sk.patch +acpica-abort-aml-bytecode-execution-when-executing-a.patch +powercap-intel_rapl-add-pl4-support-for-ice-lake.patch +io_uring-timeout-annotate-data-race-in-io_flush_time.patch +alpha-fix-user-space-corruption-during-memory-compac.patch +md-cluster-fix-null-pointer-dereference-in-process_m.patch +md-raid-fix-hang-when-stopping-arrays-with-metadata-.patch +rust-cpufreq-always-inline-functions-using-build_ass.patch +cpufreq-dt-platdev-block-the-driver-from-probing-on-.patch +s390-perf-disable-register-readout-on-sampling-event.patch +arm64-mte-set-tcma1-whenever-mte-is-present-in-the-k.patch +perf-cxlpmu-replace-irqf_oneshot-with-irqf_no_thread.patch +acpi-x86-s2idle-invoke-microsoft-_dsm-function-9-tur.patch +acpi-scan-use-async-schedule-function-in-acpi_scan_c.patch +acpi-battery-fix-incorrect-charging-status-when-curr.patch +xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch +blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch +blk-mq-sched-unify-elevators-checking-for-async-requ.patch +block-decouple-secure-erase-size-limit-from-discard-.patch +sparc-synchronize-user-stack-on-fork-and-clone.patch +sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch +bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch +irqchip-riscv-imsic-add-a-cpu-pm-notifier-to-restore.patch +perf-x86-msr-add-airmont-np.patch +perf-x86-cstate-add-airmont-np.patch +perf-x86-intel-add-airmont-np.patch +gendwarfksyms-fix-build-on-32-bit-hosts.patch +bpf-crypto-use-the-correct-destructor-kfunc-type.patch +bpf-net_sched-use-the-correct-destructor-kfunc-type.patch +bpf-recognize-special-arithmetic-shift-in-the-verifi.patch +genirq-cpuhotplug-notify-about-affinity-changes-brea.patch +bpf-properly-mark-live-registers-for-indirect-jumps.patch +perf-core-fix-slow-perf_event_task_exit-with-lbr-cal.patch +arm64-ftrace-bpf-fix-partial-regs-after-bpf_prog_run.patch +clocksource-drivers-sh_tmu-always-leave-device-runni.patch +clocksource-drivers-timer-integrator-ap-add-missing-.patch +pci-msi-unmap-msi-x-region-on-error.patch +bpftool-fix-dependencies-for-static-build.patch +crypto-hisilicon-qm-move-the-barrier-before-writing-.patch +mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch +char-tpm-cr50-remove-irqf_oneshot.patch +sched-debug-fix-updating-of-ppos-on-server-write-ops.patch +pstore-ram_core-fix-incorrect-success-return-when-vm.patch +firmware-arm_ffa-unmap-rx-tx-buffers-on-init-failure.patch +revert-arm64-zynqmp-add-an-op-tee-node-to-the-device.patch +edac-igen6-add-more-intel-panther-lake-h-socs-suppor.patch +edac-igen6-add-two-intel-amston-lake-socs-support.patch +arm64-tegra-smaug-add-usb-role-switch-support.patch +soc-imx8m-fix-error-handling-for-clk_prepare_enable.patch +soc-tegra-pmc-fix-unsafe-generic_handle_irq-call.patch +x86-sev-use-kfree_sensitive-when-freeing-a-snp-messa.patch +parisc-prevent-interrupts-during-reboot.patch +drm-xe-ggtt-use-scope-based-runtime-pm.patch +drm-xe-covert-return-of-ebusy-to-enomem-in-vm-bind-i.patch +drm-xe-vm-skip-ufence-association-for-cpu-address-mi.patch +drm-panthor-always-wait-after-sending-a-command-to-a.patch +drm-xe-xe3_lpg-apply-wa_16028005424.patch +drm-panel-edp-add-csw-mne007qb3-1.patch +gpu-panel-edp-add-auo-panel-entry-for-b140han06.4.patch +accel-amdxdna-fix-tail-pointer-polling-in-mailbox_ge.patch +drm-amdgpu-fix-null-pointer-issue-buffer-funcs.patch +drm-amdgpu-fix-the-calculation-of-ras-bad-page-numbe.patch +drm-amdgpu-ras-move-ras-data-alloc-before-bad-page-c.patch +drm-amd-display-correct-dsc-padding-accounting.patch +drm-amd-display-fix-wrong-x_pos-and-y_pos-for-cursor.patch +drm-amd-display-correct-fixed_vs-link-rate-toggle-co.patch +drm-amd-display-guard-fams2-configuration-updates.patch +drm-panel-edp-add-auo-b140qax01.h-panel.patch +drm-amdkfd-handle-gpu-reset-and-drain-retry-fault-ra.patch +spi-geni-qcom-initialize-mode-related-registers-to-0.patch +spi-geni-qcom-use-xfer-bits_per_word-for-can_dma.patch +spi-cadence-quadspi-parse-dt-for-flashes-with-the-re.patch +drm-amd-display-fix-dp-no-audio-issue.patch +drm-amd-display-add-usb-c-dp-alt-mode-lane-limitatio.patch +drm-amd-display-don-t-disable-dpcd-mst_en-if-sink-co.patch +asoc-sof-ipc4-support-for-sending-payload-along-with.patch +media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch +gpio-pca953x-add-support-for-tcal6408-tcal6416.patch +spi-stm32-fix-overrun-issue-at-8bpw.patch +drm-ast-swap-framebuffer-writes-on-big-endian-machin.patch +alsa-hda-realtek-enable-mute-led-for-lenovo-platform.patch +drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch +media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch +media-omap3isp-isppreview-always-clamp-in-preview_tr.patch +media-omap3isp-set-initial-format.patch +media-chips-media-wave5-fix-conditional-in-start_str.patch +media-chips-media-wave5-process-ready-frames-when-cm.patch +drm-panel-edp-add-boe-nv140wum-t08-panel.patch +media-mediatek-vcodec-don-t-try-to-decode-422-444-vp.patch +drm-amdgpu-add-support-for-hdp-ip-version-6.1.1.patch +drm-amd-display-fix-mismatched-unlock-for-dmub-hw-lo.patch +drm-amd-display-fix-dsc-edp-issue.patch +drm-amdgpu-avoid-a-warning-in-timedout-job-handler.patch +drm-amd-display-add-signal-type-check-for-dcn401-get.patch +drm-amdgpu-refactor-amdgpu_gem_va_ioctl-for-handling.patch +hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch +hid-pidff-do-not-set-out-of-range-trigger-button.patch +hid-multitouch-add-quirks-for-lenovo-yoga-book-9i.patch +drm-amdgpu-skip-loading-sdma_rs64-in-vf.patch +drm-amd-display-only-power-down-dig-on-phy-endpoints.patch +drm-amd-display-adjust-phy-fsm-transition-to-tx_en-t.patch +drm-xe-only-toggle-scheduling-in-tdr-if-guc-is-runni.patch +asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch +asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch +spi-spi-mem-limit-octal-dtr-constraints-to-octal-dtr.patch +cgroup-cpuset-don-t-fail-cpuset.cpus-change-in-v2.patch +media-amphion-clear-last_buffer_dequeued-flag-for-de.patch +drm-panel-fix-a-possible-null-pointer-dereference-in.patch +media-adv7180-fix-frame-interval-in-progressive-mode.patch +media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch +media-solo6x10-check-for-out-of-bounds-chip_id.patch +media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch +media-qcom-camss-do-not-enable-cpas-fast-ahb-clock-f.patch +media-v4l2-async-fix-error-handling-on-steps-after-f.patch +media-mt9m114-avoid-a-reset-low-spike-during-probe.patch +media-mt9m114-return-eprobe_defer-if-no-endpoint-is-.patch +media-ipu6-ensure-stream_mutex-is-acquired-when-deal.patch +media-ipu6-close-firmware-streams-on-streaming-enabl.patch +media-ipu6-always-close-firmware-stream.patch +alsa-hda-realtek-add-hp-victus-16-e0xxx-mute-led-qui.patch +alsa-usb-audio-presonus-s18xx-uses-little-endian.patch +drm-amdkfd-relax-size-checking-during-queue-buffer-g.patch +drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch +drm-account-property-blob-allocations-to-memcg.patch +drm-renesas-rz-du-mipi_dsi-fix-kernel-panic-when-reb.patch +hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch +virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch +asoc-soc-acpi-intel-arl-match-change-rt722-amp-endpo.patch +asoc-soc-acpi-intel-ptl-match-use-aggregated-endpoin.patch +asoc-sdw_utils-remove-dai-registered-check.patch +drm-atmel-hlcdc-destroy-properly-the-plane-state-in-.patch +pci-add-intel-nova-lake-audio-device-id.patch +alsa-hda-controllers-intel-add-support-for-nova-lake.patch +drm-amd-display-disable-fec-when-powering-down-encod.patch +drm-amd-display-ensure-link-output-is-disabled-in-ba.patch +drm-amd-display-revert-init-dispclk-from-bootup-cloc.patch +drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch +drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch +drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch +media-rkisp1-fix-filter-mode-register-configuration.patch +drm-amd-display-revert-init-dispclk-from-bootup-cloc.patch-24199 +drm-amdgpu-mark-invalid-records-with-u64_max.patch +hid-multitouch-add-egalaxtouch-exc3188-support.patch +media-uvcvideo-create-an-id-namespace-for-streaming-.patch +hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch +alsa-hda-conexant-add-headset-mic-fix-for-mechrevo-w.patch +alsa-hda-realtek-fix-lg-gram-style-14-speakers.patch +gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch +asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch +spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch +drm-amd-display-fix-gfx12-family-constant-checks.patch +drm-amd-display-avoid-dig-reg-access-timeout-on-usb4.patch +spi-cadence-qspi-fix-probe-error-path-and-remove.patch +drm-amdgpu-validate-user-queue-size-constraints.patch +spi-cadence-qspi-try-hard-to-disable-the-clocks.patch +drm-amd-pm-fix-null-pointer-dereference-issue.patch +asoc-codecs-max98390-check-return-value-of-devm_gpio.patch +hwmon-asus-ec-sensors-add-pro-ws-trx50-sage-wifi-a.patch +hwmon-dell-smm-add-support-for-dell-optiplex-7080.patch +hwmon-nct6775-add-asus-pro-ws-wrx90e-sage-se.patch +hwmon-nct6683-add-customer-id-for-asrock-z590-taichi.patch +hwmon-emc2305-fix-a-resource-leak-in-emc2305_of_pars.patch +hwmon-f71882fg-add-f81968-support.patch +hwmon-nct7363-fix-a-resource-leak-in-nct7363_present.patch +hid-logitech-hidpp-add-support-for-logitech-k980.patch +asoc-es8328-add-error-unwind-in-resume.patch +alsa-hda-realtek-add-quirk-for-minisforum-v3-se.patch +modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch +asoc-qcom-q6asm-drop-dsp-responses-for-closed-data-s.patch +power-sequencing-fix-missing-state_lock-in-pwrseq_po.patch +asoc-sof-intel-hda-fix-null-pointer-dereference.patch +spi-geni-qcom-fix-abort-sequence-execution-for-seria.patch +asoc-fsl-imx-rpmsg-use-snd_soc_find_dai_with_mutex-i.patch +alsa-hda-realtek-enable-mute-leds-on-hp-envy-x360-15.patch +alsa-mixer-oss-add-card-disconnect-checkpoints.patch +alsa-ctxfi-add-quirk-for-se-300pcie-variant-160b-010.patch +alsa-usb-audio-add-dsd-support-for-ibasso-dc04u.patch +alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch +jfs-add-missing-set_freezable-for-freezable-kthread.patch +jfs-nlink-overflow-in-jfs_rename.patch +pci-dwc-skip-pme_turn_off-broadcast-and-l2-l3-transi.patch +wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch +wifi-rtw89-8852au-add-support-for-tp-tx30u-plus.patch +wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch +wifi-rtw88-rtw8821cu-add-id-for-mercusys-mu6h.patch +wifi-rtw89-8922a-set-random-mac-if-efuse-contains-ze.patch +wifi-rtw89-ser-enable-error-imr-after-recovering-fro.patch +wifi-rtw89-setting-tbtt-agg-number-when-mac-port-ini.patch +wifi-rtw89-mcc-reset-probe-counter-when-receiving-be.patch +wifi-rtw88-use-devm_kmemdup-in-rtw_set_supported_ban.patch +wifi-rtw88-fix-inadvertent-sharing-of-struct-ieee802.patch +pci-cadence-avoid-signed-64-bit-truncation-and-inval.patch +wifi-rtw89-regd-6-ghz-power-type-marks-default-when-.patch +dm-replace-eexist-with-ebusy.patch +dm-remove-fake-timeout-to-avoid-leak-request.patch +iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch +net-wwan-mhi-add-network-support-for-foxconn-t99w760.patch +wifi-rtw89-fix-potential-zero-beacon-interval-in-bea.patch +rtla-fix-null-pointer-dereference-in-actions_parse.patch +wifi-libertas-fix-warning-in-usb_tx_block.patch +iommu-amd-move-wait_on_sem-out-of-spinlock.patch +wifi-rtw89-add-support-for-msi-ax1800-nano-guax18n.patch +wifi-rtw89-add-support-for-d-link-vr-air-bridge-dwa-.patch +wifi-rtw89-pci-validate-sequence-number-of-tx-releas.patch +wifi-rtw89-mac-correct-page-number-for-csi-response.patch +wifi-rtw89-wow-add-reason-codes-for-disassociation-i.patch +pci-dw-rockchip-disable-bar-0-and-bar-1-for-root-por.patch +wifi-rtw89-disable-eht-protocol-by-chip-capabilities.patch +wifi-ath11k-add-pm-quirk-for-thinkpad-z13-z16-gen1.patch +wifi-ath11k-fix-failure-to-connect-to-a-6-ghz-ap.patch +wifi-ath12k-fix-preferred-hardware-mode-calculation.patch +wifi-ath12k-fix-mac-phy-capability-parsing.patch +wifi-cfg80211-allow-only-one-nan-interface-also-in-m.patch +ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch +ipv6-annotate-data-races-over-sysctl.flowlabel_refle.patch +ipv6-annotate-data-races-in-net-ipv6-route.c.patch +ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch +ext4-mark-group-add-fast-commit-ineligible.patch +ext4-move-ext4_percpu_param_init-before-ext4_mb_init.patch +ext4-mark-group-extend-fast-commit-ineligible.patch +ext4-use-reserved-metadata-blocks-when-splitting-ext.patch +netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch +netfilter-xt_tcpmss-check-remaining-length-before-re.patch +openrisc-define-arch-specific-version-of-nop.patch +net-usb-r8152-fix-transmit-queue-timeout.patch +pci-imx6-add-clkreq-override-to-enable-refclk-for-i..patch +wifi-iwlwifi-mld-handle-rate-selection-for-nan-inter.patch +wifi-iwlwifi-mvm-check-the-validity-of-noa_len.patch +wifi-iwlwifi-fix-22000-series-smem-parsing.patch +wifi-iwlwifi-mld-fix-chandef-start-calculation.patch +wifi-iwlwifi-mld-fix-primary-link-selection-logic.patch +driver-core-faux-stop-using-static-struct-device.patch +wifi-rtw89-add-default-id-28de-2432-for-rtl8832cu.patch +wifi-rtw89-fix-unable-to-receive-probe-responses-und.patch +wifi-rtw89-8922a-add-digital-compensation-for-2ghz.patch +net-rds-no-shortcut-out-of-rds_conn_error.patch +ext4-propagate-flags-to-convert_initialized_extent.patch +gro-change-the-bug_on-in-gro_pull_from_frag0.patch +ipv4-igmp-annotate-data-races-around-idev-mr_maxdela.patch +net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch +wifi-cfg80211-treat-deprecated-indoor_sp_ap_old-cont.patch +wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch +wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch +wifi-rtw89-pci-validate-release-report-content-befor.patch +ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch +bluetooth-btusb-add-support-for-mediatek7920-0489-e1.patch +bluetooth-hci_qca-fix-ssr-subsystem-restart-fail-whe.patch +bluetooth-hci_conn-set-link_policy-on-incoming-acl-c.patch +bluetooth-btusb-add-usb-id-0489-e112-for-realtek-885.patch +bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch +bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch +bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch +octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch +net-sfp-add-quirk-for-lantech-8330-265d.patch +wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch +wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch +bnxt_en-allow-ntuple-filters-for-drops.patch +ptp-ptp_vmclock-add-vmclock-to-acpi-device-match.patch +net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch +vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch +net-rds-clear-reconnect-pending-bit.patch +pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch +pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch +pci-fix-pci_slot_lock-device-locking.patch +pci-enable-acs-after-configuring-iommu-for-of-platfo.patch +pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch +pci-mark-nvidia-gb10-to-avoid-bus-reset.patch +pci-bwctrl-disable-bw-controller-on-intel-p45-using-.patch +myri10ge-avoid-uninitialized-variable-use.patch +nfc-nxp-nci-remove-interrupt-trigger-type.patch +hisi_acc_vfio_pci-resolve-duplicate-migration-states.patch +rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch +hisi_acc_vfio_pci-fix-the-queue-parameter-anomaly-is.patch +um-preserve-errno-within-signal-handler.patch +ata-libata-avoid-long-timeouts-on-hot-unplugged-sata.patch +hisi_acc_vfio_pci-update-status-after-ras-error.patch +scsi-buslogic-reduce-stack-usage.patch +vhost-fix-caching-attributes-of-mmio-regions-by-sett.patch +scsi-ufs-mediatek-fix-page-faults-in-ufs_mtk_clk_sca.patch +riscv-vector-init-vector-context-with-proper-vlenb.patch +tracing-fix-false-sharing-in-hwlat-get_sample.patch +remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch +mailbox-mchp-ipc-sbi-fix-out-of-bounds-access-in-mch.patch +mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch +mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch +mailbox-mchp-ipc-sbi-fix-uninitialized-symbol-and-ot.patch +mailbox-sprd-mask-interrupts-that-are-not-handled.patch +remoteproc-mediatek-break-lock-dependency-to-prepare.patch +mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch +clk-amlogic-remove-potentially-unsafe-flags-from-s4-.patch +clk-renesas-rzg2l-deassert-reset-on-assert-timeout.patch +clk-microchip-core-correct-return-value-on-_get_pare.patch +hid-i2c-hid-add-focaltech-ft8112.patch +m68k-nommu-fix-memmove-with-differently-aligned-src-.patch +9p-xen-protect-xen_9pfs_front_free-against-concurren.patch +dmaengine-stm32-dma3-use-module_platform_driver.patch +soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch +soundwire-intel_auxdevice-add-cs42l45-codec-to-wake_.patch +staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch +serial-8250_dw-handle-clock-enable-errors-in-runtime.patch +usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch +tty-vt-keyboard-split-apart-vt_do_diacrit.patch +serial-rsci-add-set_rtrg-callback.patch +fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch +most-core-fix-resource-leak-in-most_register_interfa.patch +dmaengine-sun6i-choose-appropriate-burst-length-unde.patch +dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch +phy-ti-phy-j721e-wiz-restore-mux-selection-during-re.patch +phy-cadence-torrent-restore-parent-clock-for-refclk-.patch +misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch +pinctrl-mediatek-make-devm-allocations-safer-and-cle.patch +misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch +misc-ti_fpc202-fix-a-potential-memory-leak-in-probe-.patch +pinctrl-renesas-rzt2h-allow-.get_direction-for-irq-f.patch +iio-bmi270_i2c-add-module_device_table-for-bmi260-27.patch +usb-gadget-f_fs-fix-dma-buf-out-queues.patch +usb-gadget-f_fs-fix-ioctl-error-handling.patch +usb-chipidea-udc-fix-dma-and-sg-cleanup-in-_ep_nuke.patch +staging-rtl8723bs-fix-memory-leak-on-failure-path.patch +serial-8250-8250_omap.c-add-support-for-handling-uar.patch +serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch +fix-it87_wdt-early-reboot-by-reporting-running-timer.patch +binder-don-t-use-pk-through-printk.patch +watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch +watchdog-rzv2h_wdt-discard-pm_runtime_put-return-val.patch +phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch +phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch +revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch +mfd-intel-lpss-add-intel-nova-lake-s-pci-ids.patch +iio-use-irqf_no_thread.patch +iio-magnetometer-remove-irqf_oneshot.patch +mips-loongson-make-cpumask_of_node-robust-against-nu.patch +block-fix-partial-iova-mapping-cleanup-in-blk_rq_dma.patch +fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch +fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch +fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch +fs-ntfs3-handle-attr_set_size-errors-when-truncating.patch +fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch +ntfs3-fix-circular-locking-dependency-in-run_unpack_.patch +fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch +ceph-supply-snapshot-context-in-ceph_uninline_data.patch +libceph-define-and-enforce-ceph_max_key_len.patch +thermal-int340x-fix-sysfs-group-leak-on-dlvr-registr.patch +acpi-x86-force-enabling-of-pwm2-on-the-yogabook-yb1-.patch +include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch +arm-9467-1-mm-don-t-use-pk-through-printk.patch +drm-amd-display-fix-writeback-on-dcn-3.2.patch +drm-amdgpu-skip-vcn-poison-irq-release-on-vf.patch +mshv-ignore-second-stats-page-map-result-failure.patch +x86-hyperv-move-hv-crash-init-after-hypercall-pg-set.patch +mshv-clear-eventfd-counter-on-irqfd-shutdown.patch +asoc-rt721-sdca-fix-issue-of-fail-to-detect-omtp-jac.patch +regulator-core-remove-regulator-supply_name-length-l.patch +alsa-hda-tas2781-ignore-reset-check-for-spi-device.patch +drm-amd-display-fix-system-resume-lag-issue.patch +drm-amd-display-avoid-updating-surface-with-the-same.patch +drm-amdgpu-return-when-ras-table-checksum-is-error.patch +drm-amdgpu-adjust-usleep_range-in-fence-wait.patch +alsa-hda-realtek-fix-headset-mic-on-asus-zenbook-14-.patch +alsa-usb-audio-update-the-number-of-packets-properly.patch +drm-amd-display-set-enable_legacy_fast_update-to-fal.patch +drm-amdgpu-add-hainan-clock-adjustment.patch +drm-amd-display-bypass-post-csc-for-additional-color.patch +spi-spidev-fix-lock-inversion-between-spi_lock-and-b.patch +drm-radeon-add-hainan-clock-adjustment.patch +alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch +btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch +btrfs-do-not-assert-when-the-fs-flips-ro-inside-btrf.patch +asoc-amd-amd_sdw-add-machine-driver-quirk-for-lenovo.patch +alsa-hda-hdmi-add-quirk-for-tuxedo-ibs14g6.patch +arm64-hugetlbpage-avoid-unused-but-set-parameter-war.patch +drm-amd-display-remove-conditional-for-shaper-3dlut-.patch +drm-amdgpu-avoid-sdma-ring-reset-in-sriov.patch +rtc-zynqmp-correct-frequency-value.patch +ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch +ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch +iommu-amd-serialize-sequence-allocation-under-concur.patch diff --git a/queue-6.19/smb-client-add-proper-locking-around-ses-iface_last_.patch b/queue-6.19/smb-client-add-proper-locking-around-ses-iface_last_.patch new file mode 100644 index 00000000000..a93c4b52af2 --- /dev/null +++ b/queue-6.19/smb-client-add-proper-locking-around-ses-iface_last_.patch @@ -0,0 +1,36 @@ +From 0beb88bacdde1ac864085ab1e1f1cab9ba5755fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 14:54:45 -0300 +Subject: smb: client: add proper locking around ses->iface_last_update + +From: Henrique Carvalho + +[ Upstream commit e97dcac3dc0bd37e4b56aaa6874b572a3a461102 ] + +There is a missing ses->iface_lock in cifs_setup_session, +around ses->iface_last_update. + +Signed-off-by: Henrique Carvalho +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/connect.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c +index ce620503e9f70..60c76375f0f50 100644 +--- a/fs/smb/client/connect.c ++++ b/fs/smb/client/connect.c +@@ -4270,7 +4270,9 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses, + ses->ses_status = SES_IN_SETUP; + + /* force iface_list refresh */ ++ spin_lock(&ses->iface_lock); + ses->iface_last_update = 0; ++ spin_unlock(&ses->iface_lock); + } + spin_unlock(&ses->ses_lock); + +-- +2.51.0 + diff --git a/queue-6.19/smb-client-prevent-races-in-query_interfaces.patch b/queue-6.19/smb-client-prevent-races-in-query_interfaces.patch new file mode 100644 index 00000000000..232723f76e1 --- /dev/null +++ b/queue-6.19/smb-client-prevent-races-in-query_interfaces.patch @@ -0,0 +1,79 @@ +From 9da455bf644070ac52ad8d9caec648f6ec106b8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 14:54:44 -0300 +Subject: smb: client: prevent races in ->query_interfaces() + +From: Henrique Carvalho + +[ Upstream commit c3c06e42e1527716c54f3ad2ced6a034b5f3a489 ] + +It was possible for two query interface works to be concurrently trying +to update the interfaces. + +Prevent this by checking and updating iface_last_update under +iface_lock. + +Signed-off-by: Henrique Carvalho +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2ops.c | 19 ++++++++----------- + 1 file changed, 8 insertions(+), 11 deletions(-) + +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index c1aaf77e187b6..edfd6a4e87e8b 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -637,13 +637,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, + p = buf; + + spin_lock(&ses->iface_lock); +- /* do not query too frequently, this time with lock held */ +- if (ses->iface_last_update && +- time_before(jiffies, ses->iface_last_update + +- (SMB_INTERFACE_POLL_INTERVAL * HZ))) { +- spin_unlock(&ses->iface_lock); +- return 0; +- } + + /* + * Go through iface_list and mark them as inactive +@@ -666,7 +659,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, + "Empty network interface list returned by server %s\n", + ses->server->hostname); + rc = -EOPNOTSUPP; +- ses->iface_last_update = jiffies; + goto out; + } + +@@ -795,8 +787,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, + + sizeof(p->Next) && p->Next)) + cifs_dbg(VFS, "%s: incomplete interface info\n", __func__); + +- ses->iface_last_update = jiffies; +- + out: + /* + * Go through the list again and put the inactive entries +@@ -825,10 +815,17 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon, bool in_ + struct TCP_Server_Info *pserver; + + /* do not query too frequently */ ++ spin_lock(&ses->iface_lock); + if (ses->iface_last_update && + time_before(jiffies, ses->iface_last_update + +- (SMB_INTERFACE_POLL_INTERVAL * HZ))) ++ (SMB_INTERFACE_POLL_INTERVAL * HZ))) { ++ spin_unlock(&ses->iface_lock); + return 0; ++ } ++ ++ ses->iface_last_update = jiffies; ++ ++ spin_unlock(&ses->iface_lock); + + rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, + FSCTL_QUERY_NETWORK_INTERFACE_INFO, +-- +2.51.0 + diff --git a/queue-6.19/soc-imx8m-fix-error-handling-for-clk_prepare_enable.patch b/queue-6.19/soc-imx8m-fix-error-handling-for-clk_prepare_enable.patch new file mode 100644 index 00000000000..f70f500cac7 --- /dev/null +++ b/queue-6.19/soc-imx8m-fix-error-handling-for-clk_prepare_enable.patch @@ -0,0 +1,45 @@ +From 4a8c5cb3c9416ab49f0d478d767d75e60f8367cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 06:12:41 +0800 +Subject: soc: imx8m: Fix error handling for clk_prepare_enable() + +From: Peng Fan + +[ Upstream commit f6ef3d9ff81240e9bcc030f2da132eb0f8a761d7 ] + +imx8m_soc_prepare() directly returns the result of clk_prepare_enable(), +which skips proper cleanup if the clock enable fails. Check the return +value of clk_prepare_enable() and release resources if failure. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202601111406.ZVV3YaiU-lkp@intel.com/ +Signed-off-by: Peng Fan +Reviewed-by: Marco Felsch +Reviewed-by: Daniel Baluta +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/soc/imx/soc-imx8m.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/soc/imx/soc-imx8m.c b/drivers/soc/imx/soc-imx8m.c +index 04a1b60f2f2b5..8e2322999f099 100644 +--- a/drivers/soc/imx/soc-imx8m.c ++++ b/drivers/soc/imx/soc-imx8m.c +@@ -148,7 +148,11 @@ static int imx8m_soc_prepare(struct platform_device *pdev, const char *ocotp_com + goto err_clk; + } + +- return clk_prepare_enable(drvdata->clk); ++ ret = clk_prepare_enable(drvdata->clk); ++ if (ret) ++ goto err_clk; ++ ++ return 0; + + err_clk: + iounmap(drvdata->ocotp_base); +-- +2.51.0 + diff --git a/queue-6.19/soc-tegra-pmc-fix-unsafe-generic_handle_irq-call.patch b/queue-6.19/soc-tegra-pmc-fix-unsafe-generic_handle_irq-call.patch new file mode 100644 index 00000000000..ab64f7c4f8c --- /dev/null +++ b/queue-6.19/soc-tegra-pmc-fix-unsafe-generic_handle_irq-call.patch @@ -0,0 +1,206 @@ +From 5ff5259b5af89149afbf24735d5444546c731cd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 05:01:03 +0000 +Subject: soc/tegra: pmc: Fix unsafe generic_handle_irq() call + +From: Prathamesh Shete + +[ Upstream commit e6d96073af681780820c94079b978474a8a44413 ] + +Currently, when resuming from system suspend on Tegra platforms, +the following warning is observed: + +WARNING: CPU: 0 PID: 14459 at kernel/irq/irqdesc.c:666 +Call trace: + handle_irq_desc+0x20/0x58 (P) + tegra186_pmc_wake_syscore_resume+0xe4/0x15c + syscore_resume+0x3c/0xb8 + suspend_devices_and_enter+0x510/0x540 + pm_suspend+0x16c/0x1d8 + +The warning occurs because generic_handle_irq() is being called from +a non-interrupt context which is considered as unsafe. + +Fix this warning by deferring generic_handle_irq() call to an IRQ work +which gets executed in hard IRQ context where generic_handle_irq() +can be called safely. + +When PREEMPT_RT kernels are used, regular IRQ work (initialized with +init_irq_work) is deferred to run in per-CPU kthreads in preemptible +context rather than hard IRQ context. Hence, use the IRQ_WORK_INIT_HARD +variant so that with PREEMPT_RT kernels, the IRQ work is processed in +hardirq context instead of being deferred to a thread which is required +for calling generic_handle_irq(). + +On non-PREEMPT_RT kernels, both init_irq_work() and IRQ_WORK_INIT_HARD() +execute in IRQ context, so this change has no functional impact for +standard kernel configurations. + +Signed-off-by: Petlozu Pravareshwar +Signed-off-by: Prathamesh Shete +Reviewed-by: Jon Hunter +Tested-by: Jon Hunter +[treding@nvidia.com: miscellaneous cleanups] +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/soc/tegra/pmc.c | 104 ++++++++++++++++++++++++++++------------ + 1 file changed, 74 insertions(+), 30 deletions(-) + +diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c +index f3760a3b3026d..407fa840814c3 100644 +--- a/drivers/soc/tegra/pmc.c ++++ b/drivers/soc/tegra/pmc.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -468,6 +469,10 @@ struct tegra_pmc { + unsigned long *wake_sw_status_map; + unsigned long *wake_cntrl_level_map; + struct syscore syscore; ++ ++ /* Pending wake IRQ processing */ ++ struct irq_work wake_work; ++ u32 *wake_status; + }; + + static struct tegra_pmc *pmc = &(struct tegra_pmc) { +@@ -1905,6 +1910,50 @@ static int tegra_pmc_parse_dt(struct tegra_pmc *pmc, struct device_node *np) + return 0; + } + ++/* translate sc7 wake sources back into IRQs to catch edge triggered wakeups */ ++static void tegra186_pmc_wake_handler(struct irq_work *work) ++{ ++ struct tegra_pmc *pmc = container_of(work, struct tegra_pmc, wake_work); ++ unsigned int i, wake; ++ ++ for (i = 0; i < pmc->soc->max_wake_vectors; i++) { ++ unsigned long status = pmc->wake_status[i]; ++ ++ for_each_set_bit(wake, &status, 32) { ++ irq_hw_number_t hwirq = wake + (i * 32); ++ struct irq_desc *desc; ++ unsigned int irq; ++ ++ irq = irq_find_mapping(pmc->domain, hwirq); ++ if (!irq) { ++ dev_warn(pmc->dev, ++ "No IRQ found for WAKE#%lu!\n", ++ hwirq); ++ continue; ++ } ++ ++ dev_dbg(pmc->dev, ++ "Resume caused by WAKE#%lu mapped to IRQ#%u\n", ++ hwirq, irq); ++ ++ desc = irq_to_desc(irq); ++ if (!desc) { ++ dev_warn(pmc->dev, ++ "No descriptor found for IRQ#%u\n", ++ irq); ++ continue; ++ } ++ ++ if (!desc->action || !desc->action->name) ++ continue; ++ ++ generic_handle_irq(irq); ++ } ++ ++ pmc->wake_status[i] = 0; ++ } ++} ++ + static int tegra_pmc_init(struct tegra_pmc *pmc) + { + if (pmc->soc->max_wake_events > 0) { +@@ -1923,6 +1972,18 @@ static int tegra_pmc_init(struct tegra_pmc *pmc) + pmc->wake_cntrl_level_map = bitmap_zalloc(pmc->soc->max_wake_events, GFP_KERNEL); + if (!pmc->wake_cntrl_level_map) + return -ENOMEM; ++ ++ pmc->wake_status = kcalloc(pmc->soc->max_wake_vectors, sizeof(u32), GFP_KERNEL); ++ if (!pmc->wake_status) ++ return -ENOMEM; ++ ++ /* ++ * Initialize IRQ work for processing wake IRQs. Must use ++ * HARD_IRQ variant to run in hard IRQ context on PREEMPT_RT ++ * because we call generic_handle_irq() which requires hard ++ * IRQ context. ++ */ ++ pmc->wake_work = IRQ_WORK_INIT_HARD(tegra186_pmc_wake_handler); + } + + if (pmc->soc->init) +@@ -3129,47 +3190,30 @@ static void wke_clear_wake_status(struct tegra_pmc *pmc) + } + } + +-/* translate sc7 wake sources back into IRQs to catch edge triggered wakeups */ +-static void tegra186_pmc_process_wake_events(struct tegra_pmc *pmc, unsigned int index, +- unsigned long status) +-{ +- unsigned int wake; +- +- dev_dbg(pmc->dev, "Wake[%d:%d] status=%#lx\n", (index * 32) + 31, index * 32, status); +- +- for_each_set_bit(wake, &status, 32) { +- irq_hw_number_t hwirq = wake + 32 * index; +- struct irq_desc *desc; +- unsigned int irq; +- +- irq = irq_find_mapping(pmc->domain, hwirq); +- +- desc = irq_to_desc(irq); +- if (!desc || !desc->action || !desc->action->name) { +- dev_dbg(pmc->dev, "Resume caused by WAKE%ld, IRQ %d\n", hwirq, irq); +- continue; +- } +- +- dev_dbg(pmc->dev, "Resume caused by WAKE%ld, %s\n", hwirq, desc->action->name); +- generic_handle_irq(irq); +- } +-} +- + static void tegra186_pmc_wake_syscore_resume(void *data) + { +- u32 status, mask; + unsigned int i; ++ u32 mask; + + for (i = 0; i < pmc->soc->max_wake_vectors; i++) { + mask = readl(pmc->wake + WAKE_AOWAKE_TIER2_ROUTING(i)); +- status = readl(pmc->wake + WAKE_AOWAKE_STATUS_R(i)) & mask; +- +- tegra186_pmc_process_wake_events(pmc, i, status); ++ pmc->wake_status[i] = readl(pmc->wake + WAKE_AOWAKE_STATUS_R(i)) & mask; + } ++ ++ /* Schedule IRQ work to process wake IRQs (if any) */ ++ irq_work_queue(&pmc->wake_work); + } + + static int tegra186_pmc_wake_syscore_suspend(void *data) + { ++ unsigned int i; ++ ++ /* Check if there are unhandled wake IRQs */ ++ for (i = 0; i < pmc->soc->max_wake_vectors; i++) ++ if (pmc->wake_status[i]) ++ dev_warn(pmc->dev, ++ "Unhandled wake IRQs pending vector[%u]: 0x%x\n", ++ i, pmc->wake_status[i]); + wke_read_sw_wake_status(pmc); + + /* flip the wakeup trigger for dual-edge triggered pads +-- +2.51.0 + diff --git a/queue-6.19/soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch b/queue-6.19/soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch new file mode 100644 index 00000000000..fb39cd68c29 --- /dev/null +++ b/queue-6.19/soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch @@ -0,0 +1,49 @@ +From da53429d1ae6b27eb2c2e12ebb2864c3e6683fb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 15:09:47 +0200 +Subject: soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of + NUC15) + +From: Peter Ujfalusi + +[ Upstream commit 59946373755d71dbd7614ba235e0093159f80b69 ] + +Avell B.ON is an OEM re-branded NUC15 'Bishop County' LAPBC510 and +LAPBC710. + +Link: https://github.com/thesofproject/linux/issues/5529 +Signed-off-by: Peter Ujfalusi +Reviewed-by: Kai Vehmanen +Reviewed-by: Bard Liao +Link: https://patch.msgid.link/20251215130947.31385-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/dmi-quirks.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/soundwire/dmi-quirks.c b/drivers/soundwire/dmi-quirks.c +index 91ab97a456fa9..5854218e1a274 100644 +--- a/drivers/soundwire/dmi-quirks.c ++++ b/drivers/soundwire/dmi-quirks.c +@@ -122,6 +122,17 @@ static const struct dmi_system_id adr_remap_quirk_table[] = { + }, + .driver_data = (void *)intel_tgl_bios, + }, ++ { ++ /* ++ * quirk used for Avell B.ON (OEM rebrand of NUC15 'Bishop County' ++ * LAPBC510 and LAPBC710) ++ */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Avell High Performance"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "B.ON"), ++ }, ++ .driver_data = (void *)intel_tgl_bios, ++ }, + { + /* quirk used for NUC15 'Rooks County' LAPRC510 and LAPRC710 skews */ + .matches = { +-- +2.51.0 + diff --git a/queue-6.19/soundwire-intel_auxdevice-add-cs42l45-codec-to-wake_.patch b/queue-6.19/soundwire-intel_auxdevice-add-cs42l45-codec-to-wake_.patch new file mode 100644 index 00000000000..28f8e52ef30 --- /dev/null +++ b/queue-6.19/soundwire-intel_auxdevice-add-cs42l45-codec-to-wake_.patch @@ -0,0 +1,37 @@ +From acb0044662d8ec21331d9b60121f4a2b2e50d3c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 15:17:29 +0000 +Subject: soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list + +From: Maciej Strozek + +[ Upstream commit f87e5575a6bd1925cd55f500b61b661724372e5f ] + +Add cs42l45 to the wake_capable_list because it can generate jack events +whilst the bus is stopped. + +Signed-off-by: Maciej Strozek +Reviewed-by: Bard Liao +Signed-off-by: Charles Keepax +Link: https://patch.msgid.link/20251215151729.3911077-1-ckeepax@opensource.cirrus.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/intel_auxdevice.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/soundwire/intel_auxdevice.c b/drivers/soundwire/intel_auxdevice.c +index 6df2601fff909..8752b0e3ce74c 100644 +--- a/drivers/soundwire/intel_auxdevice.c ++++ b/drivers/soundwire/intel_auxdevice.c +@@ -52,6 +52,7 @@ struct wake_capable_part { + + static struct wake_capable_part wake_capable_list[] = { + {0x01fa, 0x4243}, ++ {0x01fa, 0x4245}, + {0x025d, 0x5682}, + {0x025d, 0x700}, + {0x025d, 0x711}, +-- +2.51.0 + diff --git a/queue-6.19/sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch b/queue-6.19/sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch new file mode 100644 index 00000000000..1bc13732f84 --- /dev/null +++ b/queue-6.19/sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch @@ -0,0 +1,50 @@ +From 371e4efc27bd82024b639cdafbaf8dcbe995ccc7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 13:40:29 +0000 +Subject: sparc: don't reference obsolete termio struct for TC* constants + +From: Sam James + +[ Upstream commit be0bccffcde3308150d2a90e55fc10e249098909 ] + +Similar in nature to commit ab107276607a ("powerpc: Fix struct termio related ioctl macros"). + +glibc-2.42 drops the legacy termio struct, but the ioctls.h header still +defines some TC* constants in terms of termio (via sizeof). Hardcode the +values instead. + +This fixes building Python for example, which falls over like: + ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio' + +Link: https://bugs.gentoo.org/961769 +Link: https://bugs.gentoo.org/962600 +Signed-off-by: Sam James +Reviewed-by: Andreas Larsson +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/include/uapi/asm/ioctls.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/sparc/include/uapi/asm/ioctls.h b/arch/sparc/include/uapi/asm/ioctls.h +index 7fd2f5873c9e7..a8bbdf9877a41 100644 +--- a/arch/sparc/include/uapi/asm/ioctls.h ++++ b/arch/sparc/include/uapi/asm/ioctls.h +@@ -5,10 +5,10 @@ + #include + + /* Big T */ +-#define TCGETA _IOR('T', 1, struct termio) +-#define TCSETA _IOW('T', 2, struct termio) +-#define TCSETAW _IOW('T', 3, struct termio) +-#define TCSETAF _IOW('T', 4, struct termio) ++#define TCGETA 0x40125401 /* _IOR('T', 1, struct termio) */ ++#define TCSETA 0x80125402 /* _IOW('T', 2, struct termio) */ ++#define TCSETAW 0x80125403 /* _IOW('T', 3, struct termio) */ ++#define TCSETAF 0x80125404 /* _IOW('T', 4, struct termio) */ + #define TCSBRK _IO('T', 5) + #define TCXONC _IO('T', 6) + #define TCFLSH _IO('T', 7) +-- +2.51.0 + diff --git a/queue-6.19/sparc-synchronize-user-stack-on-fork-and-clone.patch b/queue-6.19/sparc-synchronize-user-stack-on-fork-and-clone.patch new file mode 100644 index 00000000000..4a69a3e1026 --- /dev/null +++ b/queue-6.19/sparc-synchronize-user-stack-on-fork-and-clone.patch @@ -0,0 +1,114 @@ +From 016a5109f8ebbc4068b24f9f8abe863ec1b50a39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 15:47:52 +0100 +Subject: sparc: Synchronize user stack on fork and clone + +From: Andreas Larsson + +[ Upstream commit e38eba3b77878ada327a572a41596a3b0b44e522 ] + +Flush all uncommitted user windows before calling the generic syscall +handlers for clone, fork, and vfork. + +Prior to entering the arch common handlers sparc_{clone|fork|vfork}, the +arch-specific syscall wrappers for these syscalls will attempt to flush +all windows (including user windows). + +In the window overflow trap handlers on both SPARC{32|64}, +if the window can't be stored (i.e due to MMU related faults) the routine +backups the user window and increments a thread counter (wsaved). + +By adding a synchronization point after the flush attempt, when fault +handling is enabled, any uncommitted user windows will be flushed. + +Link: https://sourceware.org/bugzilla/show_bug.cgi?id=31394 +Closes: https://lore.kernel.org/sparclinux/fe5cc47167430007560501aabb28ba154985b661.camel@physik.fu-berlin.de/ +Signed-off-by: Andreas Larsson +Signed-off-by: Ludwig Rydberg +Tested-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/20260119144753.27945-2-ludwig.rydberg@gaisler.com +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/kernel/process.c | 38 +++++++++++++++++++++++-------------- + 1 file changed, 24 insertions(+), 14 deletions(-) + +diff --git a/arch/sparc/kernel/process.c b/arch/sparc/kernel/process.c +index 0442ab00518d3..7d69877511fac 100644 +--- a/arch/sparc/kernel/process.c ++++ b/arch/sparc/kernel/process.c +@@ -17,14 +17,18 @@ + + asmlinkage long sparc_fork(struct pt_regs *regs) + { +- unsigned long orig_i1 = regs->u_regs[UREG_I1]; ++ unsigned long orig_i1; + long ret; + struct kernel_clone_args args = { + .exit_signal = SIGCHLD, +- /* Reuse the parent's stack for the child. */ +- .stack = regs->u_regs[UREG_FP], + }; + ++ synchronize_user_stack(); ++ ++ orig_i1 = regs->u_regs[UREG_I1]; ++ /* Reuse the parent's stack for the child. */ ++ args.stack = regs->u_regs[UREG_FP]; ++ + ret = kernel_clone(&args); + + /* If we get an error and potentially restart the system +@@ -40,16 +44,19 @@ asmlinkage long sparc_fork(struct pt_regs *regs) + + asmlinkage long sparc_vfork(struct pt_regs *regs) + { +- unsigned long orig_i1 = regs->u_regs[UREG_I1]; ++ unsigned long orig_i1; + long ret; +- + struct kernel_clone_args args = { + .flags = CLONE_VFORK | CLONE_VM, + .exit_signal = SIGCHLD, +- /* Reuse the parent's stack for the child. */ +- .stack = regs->u_regs[UREG_FP], + }; + ++ synchronize_user_stack(); ++ ++ orig_i1 = regs->u_regs[UREG_I1]; ++ /* Reuse the parent's stack for the child. */ ++ args.stack = regs->u_regs[UREG_FP]; ++ + ret = kernel_clone(&args); + + /* If we get an error and potentially restart the system +@@ -65,15 +72,18 @@ asmlinkage long sparc_vfork(struct pt_regs *regs) + + asmlinkage long sparc_clone(struct pt_regs *regs) + { +- unsigned long orig_i1 = regs->u_regs[UREG_I1]; +- unsigned int flags = lower_32_bits(regs->u_regs[UREG_I0]); ++ unsigned long orig_i1; ++ unsigned int flags; + long ret; ++ struct kernel_clone_args args = {0}; + +- struct kernel_clone_args args = { +- .flags = (flags & ~CSIGNAL), +- .exit_signal = (flags & CSIGNAL), +- .tls = regs->u_regs[UREG_I3], +- }; ++ synchronize_user_stack(); ++ ++ orig_i1 = regs->u_regs[UREG_I1]; ++ flags = lower_32_bits(regs->u_regs[UREG_I0]); ++ args.flags = (flags & ~CSIGNAL); ++ args.exit_signal = (flags & CSIGNAL); ++ args.tls = regs->u_regs[UREG_I3]; + + #ifdef CONFIG_COMPAT + if (test_thread_flag(TIF_32BIT)) { +-- +2.51.0 + diff --git a/queue-6.19/spi-cadence-qspi-fix-probe-error-path-and-remove.patch b/queue-6.19/spi-cadence-qspi-fix-probe-error-path-and-remove.patch new file mode 100644 index 00000000000..583f03abc0a --- /dev/null +++ b/queue-6.19/spi-cadence-qspi-fix-probe-error-path-and-remove.patch @@ -0,0 +1,166 @@ +From 9c9f87fcc213582fa95c9736ff289196c46dc848 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 16:13:33 +0100 +Subject: spi: cadence-qspi: Fix probe error path and remove + +From: Miquel Raynal (Schneider Electric) + +[ Upstream commit f18c8cfa4f1af2cf7d68d86989a7d6109acfa1bb ] + +The probe has been modified by many different users, it is hard to track +history, but for sure its current state is partially broken. One easy +rule to follow is to drop/free/release the resources in the opposite +order they have been queried. + +Fix the labels, the order for freeing the resources, and add the +missing DMA channel step. Replicate these changes in the remove path as +well. + +Tested-by: Wolfram Sang +Signed-off-by: Miquel Raynal (Schneider Electric) +Tested-by: Santhosh Kumar K +Link: https://patch.msgid.link/20260122-schneider-6-19-rc1-qspi-v4-8-f9c21419a3e6@bootlin.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-cadence-quadspi.c | 44 ++++++++++++++++++------------- + 1 file changed, 25 insertions(+), 19 deletions(-) + +diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c +index b1cf182d65665..ab74808debe98 100644 +--- a/drivers/spi/spi-cadence-quadspi.c ++++ b/drivers/spi/spi-cadence-quadspi.c +@@ -1891,7 +1891,7 @@ static int cqspi_probe(struct platform_device *pdev) + ret = clk_prepare_enable(cqspi->clk); + if (ret) { + dev_err(dev, "Cannot enable QSPI clock.\n"); +- goto probe_clk_failed; ++ goto disable_rpm; + } + + /* Obtain QSPI reset control */ +@@ -1899,14 +1899,14 @@ static int cqspi_probe(struct platform_device *pdev) + if (IS_ERR(rstc)) { + ret = PTR_ERR(rstc); + dev_err(dev, "Cannot get QSPI reset.\n"); +- goto probe_reset_failed; ++ goto disable_clk; + } + + rstc_ocp = devm_reset_control_get_optional_exclusive(dev, "qspi-ocp"); + if (IS_ERR(rstc_ocp)) { + ret = PTR_ERR(rstc_ocp); + dev_err(dev, "Cannot get QSPI OCP reset.\n"); +- goto probe_reset_failed; ++ goto disable_clk; + } + + if (of_device_is_compatible(pdev->dev.of_node, "starfive,jh7110-qspi")) { +@@ -1914,7 +1914,7 @@ static int cqspi_probe(struct platform_device *pdev) + if (IS_ERR(rstc_ref)) { + ret = PTR_ERR(rstc_ref); + dev_err(dev, "Cannot get QSPI REF reset.\n"); +- goto probe_reset_failed; ++ goto disable_clk; + } + reset_control_assert(rstc_ref); + reset_control_deassert(rstc_ref); +@@ -1956,7 +1956,7 @@ static int cqspi_probe(struct platform_device *pdev) + if (ddata->jh7110_clk_init) { + ret = cqspi_jh7110_clk_init(pdev, cqspi); + if (ret) +- goto probe_reset_failed; ++ goto disable_clk; + } + if (ddata->quirks & CQSPI_DISABLE_STIG_MODE) + cqspi->disable_stig_mode = true; +@@ -1964,7 +1964,7 @@ static int cqspi_probe(struct platform_device *pdev) + if (ddata->quirks & CQSPI_DMA_SET_MASK) { + ret = dma_set_mask(&pdev->dev, DMA_BIT_MASK(64)); + if (ret) +- goto probe_reset_failed; ++ goto disable_clks; + } + } + +@@ -1975,7 +1975,7 @@ static int cqspi_probe(struct platform_device *pdev) + pdev->name, cqspi); + if (ret) { + dev_err(dev, "Cannot request IRQ.\n"); +- goto probe_reset_failed; ++ goto disable_clks; + } + + cqspi_wait_idle(cqspi); +@@ -2002,31 +2002,36 @@ static int cqspi_probe(struct platform_device *pdev) + ret = cqspi_request_mmap_dma(cqspi); + if (ret == -EPROBE_DEFER) { + dev_err_probe(&pdev->dev, ret, "Failed to request mmap DMA\n"); +- goto probe_setup_failed; ++ goto disable_controller; + } + } + + ret = spi_register_controller(host); + if (ret) { + dev_err(&pdev->dev, "failed to register SPI ctlr %d\n", ret); +- goto probe_setup_failed; ++ goto release_dma_chan; + } + + if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM))) + pm_runtime_put_autosuspend(dev); + + return 0; +-probe_setup_failed: +- if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM))) +- pm_runtime_disable(dev); ++ ++release_dma_chan: ++ if (cqspi->rx_chan) ++ dma_release_channel(cqspi->rx_chan); ++disable_controller: + cqspi_controller_enable(cqspi, 0); +-probe_reset_failed: ++disable_clks: + if (cqspi->is_jh7110) + cqspi_jh7110_disable_clk(pdev, cqspi); +- ++disable_clk: + if (pm_runtime_get_sync(&pdev->dev) >= 0) + clk_disable_unprepare(cqspi->clk); +-probe_clk_failed: ++disable_rpm: ++ if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM))) ++ pm_runtime_disable(dev); ++ + return ret; + } + +@@ -2044,18 +2049,19 @@ static void cqspi_remove(struct platform_device *pdev) + cqspi_wait_idle(cqspi); + + spi_unregister_controller(cqspi->host); +- cqspi_controller_enable(cqspi, 0); + + if (cqspi->rx_chan) + dma_release_channel(cqspi->rx_chan); + +- if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM))) +- if (pm_runtime_get_sync(&pdev->dev) >= 0) +- clk_disable(cqspi->clk); ++ cqspi_controller_enable(cqspi, 0); + + if (cqspi->is_jh7110) + cqspi_jh7110_disable_clk(pdev, cqspi); + ++ if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM))) ++ if (pm_runtime_get_sync(&pdev->dev) >= 0) ++ clk_disable(cqspi->clk); ++ + if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM))) { + pm_runtime_put_sync(&pdev->dev); + pm_runtime_disable(&pdev->dev); +-- +2.51.0 + diff --git a/queue-6.19/spi-cadence-qspi-try-hard-to-disable-the-clocks.patch b/queue-6.19/spi-cadence-qspi-try-hard-to-disable-the-clocks.patch new file mode 100644 index 00000000000..161d26279b2 --- /dev/null +++ b/queue-6.19/spi-cadence-qspi-try-hard-to-disable-the-clocks.patch @@ -0,0 +1,54 @@ +From edd58cb8fb0caa6476c8d899e4b3a8124a1e7f8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 16:13:34 +0100 +Subject: spi: cadence-qspi: Try hard to disable the clocks + +From: Miquel Raynal (Schneider Electric) + +[ Upstream commit 612227b392eed94a3398dc03334a84a699a82276 ] + +In the remove path, we should try hard to perform all steps as we simply +cannot fail. + +The "no runtime PM" quirk must only alter the state of the RPM core, but +the clocks should still be disabled if that is possible. Move the +disable call outside of the RPM quirk. + +Tested-by: Wolfram Sang +Signed-off-by: Miquel Raynal (Schneider Electric) +Tested-by: Santhosh Kumar K +Link: https://patch.msgid.link/20260122-schneider-6-19-rc1-qspi-v4-9-f9c21419a3e6@bootlin.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-cadence-quadspi.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c +index ab74808debe98..51ed666a0fdd1 100644 +--- a/drivers/spi/spi-cadence-quadspi.c ++++ b/drivers/spi/spi-cadence-quadspi.c +@@ -2040,6 +2040,7 @@ static void cqspi_remove(struct platform_device *pdev) + const struct cqspi_driver_platdata *ddata; + struct cqspi_st *cqspi = platform_get_drvdata(pdev); + struct device *dev = &pdev->dev; ++ int ret = 0; + + ddata = of_device_get_match_data(dev); + +@@ -2059,8 +2060,10 @@ static void cqspi_remove(struct platform_device *pdev) + cqspi_jh7110_disable_clk(pdev, cqspi); + + if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM))) +- if (pm_runtime_get_sync(&pdev->dev) >= 0) +- clk_disable(cqspi->clk); ++ ret = pm_runtime_get_sync(&pdev->dev); ++ ++ if (ret >= 0) ++ clk_disable(cqspi->clk); + + if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM))) { + pm_runtime_put_sync(&pdev->dev); +-- +2.51.0 + diff --git a/queue-6.19/spi-cadence-quadspi-parse-dt-for-flashes-with-the-re.patch b/queue-6.19/spi-cadence-quadspi-parse-dt-for-flashes-with-the-re.patch new file mode 100644 index 00000000000..aae8536cafa --- /dev/null +++ b/queue-6.19/spi-cadence-quadspi-parse-dt-for-flashes-with-the-re.patch @@ -0,0 +1,83 @@ +From 528544710c6a40b40e5063195ec3f119bf63e714 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Dec 2025 19:13:35 +0000 +Subject: spi: cadence-quadspi: Parse DT for flashes with the rest of the DT + parsing + +From: Mark Brown + +[ Upstream commit 9f0736a4e136a6eb61e0cf530ddc18ab6d816ba3 ] + +The recent refactoring of where runtime PM is enabled done in commit +f1eb4e792bb1 ("spi: spi-cadence-quadspi: Enable pm runtime earlier to +avoid imbalance") made the fact that when we do a pm_runtime_disable() +in the error paths of probe() we can trigger a runtime disable which in +turn results in duplicate clock disables. This is particularly likely +to happen when there is missing or broken DT description for the flashes +attached to the controller. + +Early on in the probe function we do a pm_runtime_get_noresume() since +the probe function leaves the device in a powered up state but in the +error path we can't assume that PM is enabled so we also manually +disable everything, including clocks. This means that when runtime PM is +active both it and the probe function release the same reference to the +main clock for the IP, triggering warnings from the clock subsystem: + +[ 8.693719] clk:75:7 already disabled +[ 8.693791] WARNING: CPU: 1 PID: 185 at /usr/src/kernel/drivers/clk/clk.c:1188 clk_core_disable+0xa0/0xb +... +[ 8.694261] clk_core_disable+0xa0/0xb4 (P) +[ 8.694272] clk_disable+0x38/0x60 +[ 8.694283] cqspi_probe+0x7c8/0xc5c [spi_cadence_quadspi] +[ 8.694309] platform_probe+0x5c/0xa4 + +Dealing with this issue properly is complicated by the fact that we +don't know if runtime PM is active so can't tell if it will disable the +clocks or not. We can, however, sidestep the issue for the flash +descriptions by moving their parsing to when we parse the controller +properties which also save us doing a bunch of setup which can never be +used so let's do that. + +Reported-by: Francesco Dolcini +Closes: https://lore.kernel.org/r/20251201072844.GA6785@francesco-nb +Signed-off-by: Mark Brown +Link: https://patch.msgid.link/20251204-spi-cadence-qspi-runtime-pm-imbalance-v2-1-10af9115d531@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-cadence-quadspi.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c +index b9a560c75c5cd..b1cf182d65665 100644 +--- a/drivers/spi/spi-cadence-quadspi.c ++++ b/drivers/spi/spi-cadence-quadspi.c +@@ -1844,6 +1844,12 @@ static int cqspi_probe(struct platform_device *pdev) + return -ENODEV; + } + ++ ret = cqspi_setup_flash(cqspi); ++ if (ret) { ++ dev_err(dev, "failed to setup flash parameters %d\n", ret); ++ return ret; ++ } ++ + /* Obtain QSPI clock. */ + cqspi->clk = devm_clk_get(dev, NULL); + if (IS_ERR(cqspi->clk)) { +@@ -1987,12 +1993,6 @@ static int cqspi_probe(struct platform_device *pdev) + pm_runtime_get_noresume(dev); + } + +- ret = cqspi_setup_flash(cqspi); +- if (ret) { +- dev_err(dev, "failed to setup flash parameters %d\n", ret); +- goto probe_setup_failed; +- } +- + host->num_chipselect = cqspi->num_chipselect; + + if (ddata && (ddata->quirks & CQSPI_SUPPORT_DEVICE_RESET)) +-- +2.51.0 + diff --git a/queue-6.19/spi-geni-qcom-fix-abort-sequence-execution-for-seria.patch b/queue-6.19/spi-geni-qcom-fix-abort-sequence-execution-for-seria.patch new file mode 100644 index 00000000000..31057954165 --- /dev/null +++ b/queue-6.19/spi-geni-qcom-fix-abort-sequence-execution-for-seria.patch @@ -0,0 +1,71 @@ +From e8df146df00f852048cd68aa73cc37609ce82205 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 21:58:52 +0530 +Subject: spi: geni-qcom: Fix abort sequence execution for serial engine errors + +From: Praveen Talari + +[ Upstream commit 96e041647bb0f9d92f95df1d69cb7442d7408b79 ] + +The driver currently skips the abort sequence for target mode when serial +engine errors occur. This leads to improper error recovery as the serial +engine may remain in an undefined state without proper cleanup, potentially +causing subsequent operations to fail or behave unpredictably. + +Fix this by ensuring the abort sequence and DMA reset always execute during +error recovery, as both are required for proper serial engine error +handling. + +Co-developed-by: Konrad Dybcio +Signed-off-by: Konrad Dybcio +Signed-off-by: Praveen Talari +Reviewed-by: Konrad Dybcio +Link: https://patch.msgid.link/20260204162854.1206323-3-praveen.talari@oss.qualcomm.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-geni-qcom.c | 24 ++++++++++-------------- + 1 file changed, 10 insertions(+), 14 deletions(-) + +diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c +index 5ab20d7955121..acfcf870efd84 100644 +--- a/drivers/spi/spi-geni-qcom.c ++++ b/drivers/spi/spi-geni-qcom.c +@@ -160,24 +160,20 @@ static void handle_se_timeout(struct spi_controller *spi, + xfer = mas->cur_xfer; + mas->cur_xfer = NULL; + +- if (spi->target) { +- /* +- * skip CMD Cancel sequnece since spi target +- * doesn`t support CMD Cancel sequnece +- */ ++ /* The controller doesn't support the Cancel commnand in target mode */ ++ if (!spi->target) { ++ reinit_completion(&mas->cancel_done); ++ geni_se_cancel_m_cmd(se); ++ + spin_unlock_irq(&mas->lock); +- goto reset_if_dma; +- } + +- reinit_completion(&mas->cancel_done); +- geni_se_cancel_m_cmd(se); +- spin_unlock_irq(&mas->lock); ++ time_left = wait_for_completion_timeout(&mas->cancel_done, HZ); ++ if (time_left) ++ goto reset_if_dma; + +- time_left = wait_for_completion_timeout(&mas->cancel_done, HZ); +- if (time_left) +- goto reset_if_dma; ++ spin_lock_irq(&mas->lock); ++ } + +- spin_lock_irq(&mas->lock); + reinit_completion(&mas->abort_done); + geni_se_abort_m_cmd(se); + spin_unlock_irq(&mas->lock); +-- +2.51.0 + diff --git a/queue-6.19/spi-geni-qcom-initialize-mode-related-registers-to-0.patch b/queue-6.19/spi-geni-qcom-initialize-mode-related-registers-to-0.patch new file mode 100644 index 00000000000..7d1f887bc36 --- /dev/null +++ b/queue-6.19/spi-geni-qcom-initialize-mode-related-registers-to-0.patch @@ -0,0 +1,40 @@ +From 996200a0ec3631766878c5a2b938deaef29cb7b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Nov 2025 16:12:01 -0500 +Subject: spi-geni-qcom: initialize mode related registers to 0 + +From: Jonathan Marek + +[ Upstream commit 739062a9f1e9a77a9687c8fd30f8e5dd12ec70be ] + +setup_fifo_params assumes these will be zero, it won't write these +registers if the initial mode is zero. + +Signed-off-by: Jonathan Marek +Link: https://patch.msgid.link/20251120211204.24078-4-jonathan@marek.ca +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-geni-qcom.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c +index a0d8d3425c6c6..9e9953469b3a0 100644 +--- a/drivers/spi/spi-geni-qcom.c ++++ b/drivers/spi/spi-geni-qcom.c +@@ -724,6 +724,12 @@ static int spi_geni_init(struct spi_geni_master *mas) + case 0: + mas->cur_xfer_mode = GENI_SE_FIFO; + geni_se_select_mode(se, GENI_SE_FIFO); ++ /* setup_fifo_params assumes that these registers start with a zero value */ ++ writel(0, se->base + SE_SPI_LOOPBACK); ++ writel(0, se->base + SE_SPI_DEMUX_SEL); ++ writel(0, se->base + SE_SPI_CPHA); ++ writel(0, se->base + SE_SPI_CPOL); ++ writel(0, se->base + SE_SPI_DEMUX_OUTPUT_INV); + ret = 0; + break; + } +-- +2.51.0 + diff --git a/queue-6.19/spi-geni-qcom-use-xfer-bits_per_word-for-can_dma.patch b/queue-6.19/spi-geni-qcom-use-xfer-bits_per_word-for-can_dma.patch new file mode 100644 index 00000000000..72bc98dabb5 --- /dev/null +++ b/queue-6.19/spi-geni-qcom-use-xfer-bits_per_word-for-can_dma.patch @@ -0,0 +1,50 @@ +From 45416c9b11ccd343ba8bb351ad22d4781c972330 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Nov 2025 16:12:00 -0500 +Subject: spi-geni-qcom: use xfer->bits_per_word for can_dma() + +From: Jonathan Marek + +[ Upstream commit fb2bbe3838728f572485706677590e4fc41eec5c ] + +mas->cur_bits_per_word may not reflect the value of xfer->bits_per_word +when can_dma() is called. Use the right value instead. + +Signed-off-by: Jonathan Marek +Link: https://patch.msgid.link/20251120211204.24078-3-jonathan@marek.ca +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-geni-qcom.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c +index 9e9953469b3a0..5ab20d7955121 100644 +--- a/drivers/spi/spi-geni-qcom.c ++++ b/drivers/spi/spi-geni-qcom.c +@@ -548,10 +548,10 @@ static u32 get_xfer_len_in_words(struct spi_transfer *xfer, + { + u32 len; + +- if (!(mas->cur_bits_per_word % MIN_WORD_LEN)) +- len = xfer->len * BITS_PER_BYTE / mas->cur_bits_per_word; ++ if (!(xfer->bits_per_word % MIN_WORD_LEN)) ++ len = xfer->len * BITS_PER_BYTE / xfer->bits_per_word; + else +- len = xfer->len / (mas->cur_bits_per_word / BITS_PER_BYTE + 1); ++ len = xfer->len / (xfer->bits_per_word / BITS_PER_BYTE + 1); + len &= TRANS_LEN_MSK; + + return len; +@@ -571,7 +571,7 @@ static bool geni_can_dma(struct spi_controller *ctlr, + return true; + + len = get_xfer_len_in_words(xfer, mas); +- fifo_size = mas->tx_fifo_depth * mas->fifo_width_bits / mas->cur_bits_per_word; ++ fifo_size = mas->tx_fifo_depth * mas->fifo_width_bits / xfer->bits_per_word; + + if (len > fifo_size) + return true; +-- +2.51.0 + diff --git a/queue-6.19/spi-spi-mem-limit-octal-dtr-constraints-to-octal-dtr.patch b/queue-6.19/spi-spi-mem-limit-octal-dtr-constraints-to-octal-dtr.patch new file mode 100644 index 00000000000..6975890f3ce --- /dev/null +++ b/queue-6.19/spi-spi-mem-limit-octal-dtr-constraints-to-octal-dtr.patch @@ -0,0 +1,62 @@ +From 076afaf190926056d6ba03d6a607cfdc2656d8b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jan 2026 18:18:01 +0100 +Subject: spi: spi-mem: Limit octal DTR constraints to octal DTR situations + +From: Miquel Raynal + +[ Upstream commit 8618271887ca10ac5108fe7e1d82ba8f1b152cf9 ] + +In this helper, any operation with a single DTR cycle (like 1S-1S-8D) is +considered requiring a duplicated command opcode. This is wrong as this +constraint only applies to octal DTR operations (8D-8D-8D). + +Narrow the application of this constraint to the concerned bus +interface. + +Note: none of the possible XD-XD-XD pattern, with X being one of {1, 2, +4} would benefit from this check either as there is only in octal DTR +mode that a single clock edge would be enough to transmit the full +opcode. + +Make sure the constraint of expecting two bytes for the command is +applied to the relevant bus interface. + +Reviewed-by: Tudor Ambarus +Signed-off-by: Miquel Raynal +Link: https://patch.msgid.link/20260109-winbond-v6-17-rc1-oddr-v2-3-1fff6a2ddb80@bootlin.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-mem.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c +index c8b2add2640e5..6c7921469b90b 100644 +--- a/drivers/spi/spi-mem.c ++++ b/drivers/spi/spi-mem.c +@@ -178,8 +178,19 @@ bool spi_mem_default_supports_op(struct spi_mem *mem, + if (op->data.swap16 && !spi_mem_controller_is_capable(ctlr, swap16)) + return false; + +- if (op->cmd.nbytes != 2) +- return false; ++ /* Extra 8D-8D-8D limitations */ ++ if (op->cmd.dtr && op->cmd.buswidth == 8) { ++ if (op->cmd.nbytes != 2) ++ return false; ++ ++ if ((op->addr.nbytes % 2) || ++ (op->dummy.nbytes % 2) || ++ (op->data.nbytes % 2)) { ++ dev_err(&ctlr->dev, ++ "Even byte numbers not allowed in octal DTR operations\n"); ++ return false; ++ } ++ } + } else { + if (op->cmd.nbytes != 1) + return false; +-- +2.51.0 + diff --git a/queue-6.19/spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch b/queue-6.19/spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch new file mode 100644 index 00000000000..2069653d682 --- /dev/null +++ b/queue-6.19/spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch @@ -0,0 +1,60 @@ +From 895188452336c38759dfc7e2649801d79bb4a048 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 20:30:04 +0800 +Subject: spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end + +From: Chin-Ting Kuo + +[ Upstream commit 53f826ff5e0e3ecb279862ca7cce1491b94bb017 ] + +spi_mem_dirmap_create() may reconfigure controller-wide settings, +which can interfere with concurrent transfers to other devices +sharing the same SPI controller but using different chip selects. + +Wrap the ->dirmap_create() callback with spi_mem_access_start() and +spi_mem_access_end() to serialize access and prevent cross-CS +interference during dirmap creation. + +This patch has been verified on a setup where a SPI TPM is connected +to CS0 of a SPI controller, while a SPI NOR flash is connected to CS1 +of the same controller. Without this patch, spi_mem_dirmap_create() +for the SPI NOR flash interferes with ongoing SPI TPM data transfers, +resulting in failure to create the TPM device. This was tested on an +ASPEED AST2700 EVB. + +Signed-off-by: Chin-Ting Kuo +Reviewed-by: Paul Menzel +Link: https://patch.msgid.link/20260120123005.1392071-2-chin-ting_kuo@aspeedtech.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-mem.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c +index 6c7921469b90b..965673bac98b9 100644 +--- a/drivers/spi/spi-mem.c ++++ b/drivers/spi/spi-mem.c +@@ -719,9 +719,18 @@ spi_mem_dirmap_create(struct spi_mem *mem, + + desc->mem = mem; + desc->info = *info; +- if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create) ++ if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create) { ++ ret = spi_mem_access_start(mem); ++ if (ret) { ++ kfree(desc); ++ return ERR_PTR(ret); ++ } ++ + ret = ctlr->mem_ops->dirmap_create(desc); + ++ spi_mem_access_end(mem); ++ } ++ + if (ret) { + desc->nodirmap = true; + if (!spi_mem_supports_op(desc->mem, &desc->info.op_tmpl)) +-- +2.51.0 + diff --git a/queue-6.19/spi-spidev-fix-lock-inversion-between-spi_lock-and-b.patch b/queue-6.19/spi-spidev-fix-lock-inversion-between-spi_lock-and-b.patch new file mode 100644 index 00000000000..c76e918b07f --- /dev/null +++ b/queue-6.19/spi-spidev-fix-lock-inversion-between-spi_lock-and-b.patch @@ -0,0 +1,218 @@ +From f956100ff9602ce204484ebed59acff55b002426 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Feb 2026 08:26:16 +0100 +Subject: spi: spidev: fix lock inversion between spi_lock and buf_lock + +From: Fabian Godehardt + +[ Upstream commit 40534d19ed2afb880ecf202dab26a8e7a5808d16 ] + +The spidev driver previously used two mutexes, spi_lock and buf_lock, +but acquired them in different orders depending on the code path: + + write()/read(): buf_lock -> spi_lock + ioctl(): spi_lock -> buf_lock + +This AB-BA locking pattern triggers lockdep warnings and can +cause real deadlocks: + + WARNING: possible circular locking dependency detected + spidev_ioctl() -> mutex_lock(&spidev->buf_lock) + spidev_sync_write() -> mutex_lock(&spidev->spi_lock) + *** DEADLOCK *** + +The issue is reproducible with a simple userspace program that +performs write() and SPI_IOC_WR_MAX_SPEED_HZ ioctl() calls from +separate threads on the same spidev file descriptor. + +Fix this by simplifying the locking model and removing the lock +inversion entirely. spidev_sync() no longer performs any locking, +and all callers serialize access using spi_lock. + +buf_lock is removed since its functionality is fully covered by +spi_lock, eliminating the possibility of lock ordering issues. + +This removes the lock inversion and prevents deadlocks without +changing userspace ABI or behaviour. + +Signed-off-by: Fabian Godehardt +Link: https://patch.msgid.link/20260211072616.489522-1-fg@emlix.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spidev.c | 63 ++++++++++++++++---------------------------- + 1 file changed, 22 insertions(+), 41 deletions(-) + +diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c +index 9a0160f6dc3dc..f28528ed1c24e 100644 +--- a/drivers/spi/spidev.c ++++ b/drivers/spi/spidev.c +@@ -74,7 +74,6 @@ struct spidev_data { + struct list_head device_entry; + + /* TX/RX buffers are NULL unless this device is open (users > 0) */ +- struct mutex buf_lock; + unsigned users; + u8 *tx_buffer; + u8 *rx_buffer; +@@ -102,24 +101,6 @@ spidev_sync_unlocked(struct spi_device *spi, struct spi_message *message) + return status; + } + +-static ssize_t +-spidev_sync(struct spidev_data *spidev, struct spi_message *message) +-{ +- ssize_t status; +- struct spi_device *spi; +- +- mutex_lock(&spidev->spi_lock); +- spi = spidev->spi; +- +- if (spi == NULL) +- status = -ESHUTDOWN; +- else +- status = spidev_sync_unlocked(spi, message); +- +- mutex_unlock(&spidev->spi_lock); +- return status; +-} +- + static inline ssize_t + spidev_sync_write(struct spidev_data *spidev, size_t len) + { +@@ -132,7 +113,8 @@ spidev_sync_write(struct spidev_data *spidev, size_t len) + + spi_message_init(&m); + spi_message_add_tail(&t, &m); +- return spidev_sync(spidev, &m); ++ ++ return spidev_sync_unlocked(spidev->spi, &m); + } + + static inline ssize_t +@@ -147,7 +129,8 @@ spidev_sync_read(struct spidev_data *spidev, size_t len) + + spi_message_init(&m); + spi_message_add_tail(&t, &m); +- return spidev_sync(spidev, &m); ++ ++ return spidev_sync_unlocked(spidev->spi, &m); + } + + /*-------------------------------------------------------------------------*/ +@@ -157,7 +140,7 @@ static ssize_t + spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos) + { + struct spidev_data *spidev; +- ssize_t status; ++ ssize_t status = -ESHUTDOWN; + + /* chipselect only toggles at start or end of operation */ + if (count > bufsiz) +@@ -165,7 +148,11 @@ spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos) + + spidev = filp->private_data; + +- mutex_lock(&spidev->buf_lock); ++ mutex_lock(&spidev->spi_lock); ++ ++ if (spidev->spi == NULL) ++ goto err_spi_removed; ++ + status = spidev_sync_read(spidev, count); + if (status > 0) { + unsigned long missing; +@@ -176,7 +163,9 @@ spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos) + else + status = status - missing; + } +- mutex_unlock(&spidev->buf_lock); ++ ++err_spi_removed: ++ mutex_unlock(&spidev->spi_lock); + + return status; + } +@@ -187,7 +176,7 @@ spidev_write(struct file *filp, const char __user *buf, + size_t count, loff_t *f_pos) + { + struct spidev_data *spidev; +- ssize_t status; ++ ssize_t status = -ESHUTDOWN; + unsigned long missing; + + /* chipselect only toggles at start or end of operation */ +@@ -196,13 +185,19 @@ spidev_write(struct file *filp, const char __user *buf, + + spidev = filp->private_data; + +- mutex_lock(&spidev->buf_lock); ++ mutex_lock(&spidev->spi_lock); ++ ++ if (spidev->spi == NULL) ++ goto err_spi_removed; ++ + missing = copy_from_user(spidev->tx_buffer, buf, count); + if (missing == 0) + status = spidev_sync_write(spidev, count); + else + status = -EFAULT; +- mutex_unlock(&spidev->buf_lock); ++ ++err_spi_removed: ++ mutex_unlock(&spidev->spi_lock); + + return status; + } +@@ -379,14 +374,6 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) + + ctlr = spi->controller; + +- /* use the buffer lock here for triple duty: +- * - prevent I/O (from us) so calling spi_setup() is safe; +- * - prevent concurrent SPI_IOC_WR_* from morphing +- * data fields while SPI_IOC_RD_* reads them; +- * - SPI_IOC_MESSAGE needs the buffer locked "normally". +- */ +- mutex_lock(&spidev->buf_lock); +- + switch (cmd) { + /* read requests */ + case SPI_IOC_RD_MODE: +@@ -510,7 +497,6 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) + break; + } + +- mutex_unlock(&spidev->buf_lock); + spi_dev_put(spi); + mutex_unlock(&spidev->spi_lock); + return retval; +@@ -541,9 +527,6 @@ spidev_compat_ioc_message(struct file *filp, unsigned int cmd, + return -ESHUTDOWN; + } + +- /* SPI_IOC_MESSAGE needs the buffer locked "normally" */ +- mutex_lock(&spidev->buf_lock); +- + /* Check message and copy into scratch area */ + ioc = spidev_get_ioc_message(cmd, u_ioc, &n_ioc); + if (IS_ERR(ioc)) { +@@ -564,7 +547,6 @@ spidev_compat_ioc_message(struct file *filp, unsigned int cmd, + kfree(ioc); + + done: +- mutex_unlock(&spidev->buf_lock); + spi_dev_put(spi); + mutex_unlock(&spidev->spi_lock); + return retval; +@@ -802,7 +784,6 @@ static int spidev_probe(struct spi_device *spi) + /* Initialize the driver data */ + spidev->spi = spi; + mutex_init(&spidev->spi_lock); +- mutex_init(&spidev->buf_lock); + + INIT_LIST_HEAD(&spidev->device_entry); + +-- +2.51.0 + diff --git a/queue-6.19/spi-stm32-fix-overrun-issue-at-8bpw.patch b/queue-6.19/spi-stm32-fix-overrun-issue-at-8bpw.patch new file mode 100644 index 00000000000..d8538f3c12f --- /dev/null +++ b/queue-6.19/spi-stm32-fix-overrun-issue-at-8bpw.patch @@ -0,0 +1,53 @@ +From 742618093b1c99bcb62ca781a841a8c5d6bf4f62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Dec 2025 11:48:28 +0100 +Subject: spi: stm32: fix Overrun issue at < 8bpw + +From: Deepak Kumar + +[ Upstream commit 1ac3be217c01d5df55ec5052f81e4f1708f46552 ] + +When SPI communication is suspended by hardware automatically, it could +happen that few bits of next frame are already clocked out due to +internal synchronization delay. + +To achieve a safe suspension, we need to ensure that each word must be +at least 8 SPI clock cycles long. That's why, if bpw is less than 8 +bits, we need to use midi to reach 8 SPI clock cycles at least. + +This will ensure that each word achieve safe suspension and prevent +overrun condition. + +Signed-off-by: Deepak Kumar +Signed-off-by: Alain Volmat +Link: https://patch.msgid.link/20251218-stm32-spi-enhancements-v2-2-3b69901ca9fe@foss.st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index 2c804c1aef989..80986bd251d29 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -1906,11 +1906,12 @@ static void stm32h7_spi_data_idleness(struct stm32_spi *spi, struct spi_transfer + cfg2_clrb |= STM32H7_SPI_CFG2_MIDI; + if ((len > 1) && (spi->cur_midi > 0)) { + u32 sck_period_ns = DIV_ROUND_UP(NSEC_PER_SEC, spi->cur_speed); +- u32 midi = min_t(u32, +- DIV_ROUND_UP(spi->cur_midi, sck_period_ns), +- FIELD_GET(STM32H7_SPI_CFG2_MIDI, +- STM32H7_SPI_CFG2_MIDI)); ++ u32 midi = DIV_ROUND_UP(spi->cur_midi, sck_period_ns); + ++ if ((spi->cur_bpw + midi) < 8) ++ midi = 8 - spi->cur_bpw; ++ ++ midi = min_t(u32, midi, FIELD_MAX(STM32H7_SPI_CFG2_MIDI)); + + dev_dbg(spi->dev, "period=%dns, midi=%d(=%dns)\n", + sck_period_ns, midi, midi * sck_period_ns); +-- +2.51.0 + diff --git a/queue-6.19/staging-rtl8723bs-fix-memory-leak-on-failure-path.patch b/queue-6.19/staging-rtl8723bs-fix-memory-leak-on-failure-path.patch new file mode 100644 index 00000000000..e0986bb495c --- /dev/null +++ b/queue-6.19/staging-rtl8723bs-fix-memory-leak-on-failure-path.patch @@ -0,0 +1,42 @@ +From 4b4577ee1e6b6ccf0ae5706453a411d2aed04771 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 14:47:12 +0530 +Subject: staging: rtl8723bs: fix memory leak on failure path + +From: Diksha Kumari + +[ Upstream commit abe850d82c8cb72d28700673678724e779b1826e ] + +cfg80211_inform_bss_frame() may return NULL on failure. In that case, +the allocated buffer 'buf' is not freed and the function returns early, +leading to potential memory leak. +Fix this by ensuring that 'buf' is freed on both success and failure paths. + +Signed-off-by: Diksha Kumari +Reviewed-by: Mukesh Kumar Chaurasiya +Link: https://patch.msgid.link/20260113091712.7071-1-dikshakdevgan@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +index 60edeae1cffe7..476ab055e53e5 100644 +--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c ++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +@@ -315,9 +315,10 @@ struct cfg80211_bss *rtw_cfg80211_inform_bss(struct adapter *padapter, struct wl + len, notify_signal, GFP_ATOMIC); + + if (unlikely(!bss)) +- goto exit; ++ goto free_buf; + + cfg80211_put_bss(wiphy, bss); ++free_buf: + kfree(buf); + + exit: +-- +2.51.0 + diff --git a/queue-6.19/staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch b/queue-6.19/staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch new file mode 100644 index 00000000000..1a52908eddc --- /dev/null +++ b/queue-6.19/staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch @@ -0,0 +1,44 @@ +From 2cf2f6df9a01a50df6f5de21635b109b31a3d7d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 17:27:28 +0800 +Subject: staging: rtl8723bs: fix missing status update on sdio_alloc_irq() + failure + +From: Liang Jie + +[ Upstream commit 618b4aec12faabc7579a6b0df046842d798a4c7c ] + +The return value of sdio_alloc_irq() was not stored in status. +If sdio_alloc_irq() fails after rtw_drv_register_netdev() succeeds, +status remains _SUCCESS and the error path skips resource cleanup, +while rtw_drv_init() still returns success. + +Store the return value of sdio_alloc_irq() in status and reuse the +existing error handling which relies on status. + +Reviewed-by: fanggeng +Signed-off-by: Liang Jie +Link: https://patch.msgid.link/20251208092730.262499-1-buaajxlj@163.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c +index 1d0239eef114b..dc787954126fd 100644 +--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c ++++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c +@@ -377,7 +377,8 @@ static int rtw_drv_init( + if (status != _SUCCESS) + goto free_if1; + +- if (sdio_alloc_irq(dvobj) != _SUCCESS) ++ status = sdio_alloc_irq(dvobj); ++ if (status != _SUCCESS) + goto free_if1; + + status = _SUCCESS; +-- +2.51.0 + diff --git a/queue-6.19/statmount-permission-check-should-return-eperm.patch b/queue-6.19/statmount-permission-check-should-return-eperm.patch new file mode 100644 index 00000000000..85ff23e7ae6 --- /dev/null +++ b/queue-6.19/statmount-permission-check-should-return-eperm.patch @@ -0,0 +1,38 @@ +From f30b4cbfb94e82c2ad9335bd366e1a6656fd0b1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Nov 2025 14:41:20 +0530 +Subject: statmount: permission check should return EPERM + +From: Bhavik Sachdev + +[ Upstream commit fccbe38a5d06dbe44bcd89196fe1d2c2272a1f4a ] + +Currently, statmount() returns ENOENT when caller is not CAP_SYS_ADMIN +in the user namespace owner of target mount namespace. This should be +EPERM instead. + +Suggested-by: Miklos Szeredi +Signed-off-by: Bhavik Sachdev +Link: https://patch.msgid.link/20251129091455.757724-2-b.sachdev1904@gmail.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/namespace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/namespace.c b/fs/namespace.c +index c58674a20cad5..f6879f282daec 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -5780,7 +5780,7 @@ SYSCALL_DEFINE4(statmount, const struct mnt_id_req __user *, req, + + if (kreq.mnt_ns_id && (ns != current->nsproxy->mnt_ns) && + !ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN)) +- return -ENOENT; ++ return -EPERM; + + ks = kmalloc(sizeof(*ks), GFP_KERNEL_ACCOUNT); + if (!ks) +-- +2.51.0 + diff --git a/queue-6.19/thermal-int340x-fix-sysfs-group-leak-on-dlvr-registr.patch b/queue-6.19/thermal-int340x-fix-sysfs-group-leak-on-dlvr-registr.patch new file mode 100644 index 00000000000..86268b75b43 --- /dev/null +++ b/queue-6.19/thermal-int340x-fix-sysfs-group-leak-on-dlvr-registr.patch @@ -0,0 +1,45 @@ +From 5fe5dfc744c4981dac07c37c0388bc38d11f24d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Feb 2026 08:23:15 +0000 +Subject: thermal: int340x: Fix sysfs group leak on DLVR registration failure + +From: Kaushlendra Kumar + +[ Upstream commit 15176b818e048ccf6ef4b96db34eda7b7e98938a ] + +When DLVR sysfs group creation fails in proc_thermal_rfim_add(), +the function returns immediately without cleaning up the FIVR group +that may have been created earlier. + +Add proper error unwinding to remove the FIVR group before returning +failure. + +Signed-off-by: Kaushlendra Kumar +Acked-by: Srinivas Pandruvada +Link: https://patch.msgid.link/LV3PR11MB876881B77D32A2854AD2908EF563A@LV3PR11MB8768.namprd11.prod.outlook.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + .../thermal/intel/int340x_thermal/processor_thermal_rfim.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c +index 589a3a71f0c4c..ba88d878c998d 100644 +--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c ++++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c +@@ -466,8 +466,11 @@ int proc_thermal_rfim_add(struct pci_dev *pdev, struct proc_thermal_device *proc + break; + } + ret = sysfs_create_group(&pdev->dev.kobj, &dlvr_attribute_group); +- if (ret) ++ if (ret) { ++ if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_FIVR) ++ sysfs_remove_group(&pdev->dev.kobj, &fivr_attribute_group); + return ret; ++ } + } + + if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_DVFS) { +-- +2.51.0 + diff --git a/queue-6.19/tools-cpupower-fix-inverted-aperf-capability-check.patch b/queue-6.19/tools-cpupower-fix-inverted-aperf-capability-check.patch new file mode 100644 index 00000000000..c46f82ca41e --- /dev/null +++ b/queue-6.19/tools-cpupower-fix-inverted-aperf-capability-check.patch @@ -0,0 +1,39 @@ +From d173aee241b3eabe19104ca44b6788177aebfadf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Nov 2025 14:46:13 +0530 +Subject: tools/cpupower: Fix inverted APERF capability check + +From: Kaushlendra Kumar + +[ Upstream commit 24858a84163c8d04827166b3bcaed80612bb62fc ] + +The capability check was inverted, causing the function to return +error when APERF support is available and proceed when it is not. + +Negate the condition to return error only when APERF capability +is absent. + +Link: https://lore.kernel.org/r/20251126091613.567480-1-kaushlendra.kumar@intel.com +Signed-off-by: Kaushlendra Kumar +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/power/cpupower/utils/cpufreq-info.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/power/cpupower/utils/cpufreq-info.c b/tools/power/cpupower/utils/cpufreq-info.c +index 7d3732f5f2f6f..5fe01e516817e 100644 +--- a/tools/power/cpupower/utils/cpufreq-info.c ++++ b/tools/power/cpupower/utils/cpufreq-info.c +@@ -270,7 +270,7 @@ static int get_freq_hardware(unsigned int cpu, unsigned int human) + { + unsigned long freq; + +- if (cpupower_cpu_info.caps & CPUPOWER_CAP_APERF) ++ if (!(cpupower_cpu_info.caps & CPUPOWER_CAP_APERF)) + return -EINVAL; + + freq = cpufreq_get_freq_hardware(cpu); +-- +2.51.0 + diff --git a/queue-6.19/tools-headers-go-back-to-include-asm-generic-unistd..patch b/queue-6.19/tools-headers-go-back-to-include-asm-generic-unistd..patch new file mode 100644 index 00000000000..b1d1c53ef3f --- /dev/null +++ b/queue-6.19/tools-headers-go-back-to-include-asm-generic-unistd..patch @@ -0,0 +1,91 @@ +From e9d143f7b30681841774ce0ace453d2d2bc688bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 09:43:24 +0000 +Subject: tools headers: Go back to include asm-generic/unistd.h for arm64 + +From: Leo Yan + +[ Upstream commit 096b86ce08332fbcb0ec6ff6714c44899ec03970 ] + +The header unistd.h is included under Arm64's uAPI folder (see +tools/arch/arm64/include/uapi/asm/), but it does not include its +dependent header unistd_64.h. + +The intention is for unistd_64.h to be generated dynamically using +scripts/Makefile.asm-headers. + +However, this dynamic approach causes problems because the header is not +available early enough, even though it is widely included throughout +tools. + +Using the perf build as an example: + + 1) Feature detection: Perf first runs feature tests. + + The BPF feature program test-bpf.c includes unistd.h. Since + unistd_64.h has not been generated yet, the program fails to build, + and the BPF feature ends up being disabled. + + 2) libperf build: + + The libperf Makefile later generates unistd_64.h on the fly, so + libperf itself builds successfully. + + 3) Final perf build: + + Although the perf binary can build successfully using the generated + header, we never get a chance to build BPF skeleton programs, + because BPF support was already disabled earlier. + +Restore to include asm-generic/unistd.h for fixing the issue. This +aligns with most architectures (x86 is a special case that keeps +unistd_32.h/unistd_64.h for its particular syscall numbers) and ensures +the header is available from the start. + +Fixes: 22f72088ffe69a37 ("tools headers: Update the syscall table with the kernel sources") +Reviewed-by: James Clark +Signed-off-by: Leo Yan +Cc: Adrian Hunter +Cc: Arnd Bergmann +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Namhyung Kim +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/arch/arm64/include/uapi/asm/unistd.h | 24 +++++++++++++++++++++- + 1 file changed, 23 insertions(+), 1 deletion(-) + +diff --git a/tools/arch/arm64/include/uapi/asm/unistd.h b/tools/arch/arm64/include/uapi/asm/unistd.h +index df36f23876e86..9306726337fe0 100644 +--- a/tools/arch/arm64/include/uapi/asm/unistd.h ++++ b/tools/arch/arm64/include/uapi/asm/unistd.h +@@ -1,2 +1,24 @@ + /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ +-#include ++/* ++ * Copyright (C) 2012 ARM Ltd. ++ * ++ * This program is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License version 2 as ++ * published by the Free Software Foundation. ++ * ++ * This program is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with this program. If not, see . ++ */ ++ ++#define __ARCH_WANT_RENAMEAT ++#define __ARCH_WANT_NEW_STAT ++#define __ARCH_WANT_SET_GET_RLIMIT ++#define __ARCH_WANT_TIME32_SYSCALLS ++#define __ARCH_WANT_MEMFD_SECRET ++ ++#include +-- +2.51.0 + diff --git a/queue-6.19/tools-power-cpupower-reset-errno-before-strtoull.patch b/queue-6.19/tools-power-cpupower-reset-errno-before-strtoull.patch new file mode 100644 index 00000000000..beb584fc664 --- /dev/null +++ b/queue-6.19/tools-power-cpupower-reset-errno-before-strtoull.patch @@ -0,0 +1,37 @@ +From 6cda2be8c213c1773030a8c8e37a06ab0b86613f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 17:47:45 +0530 +Subject: tools/power cpupower: Reset errno before strtoull() + +From: Kaushlendra Kumar + +[ Upstream commit f9bd3762cf1bd0c2465f2e6121b340883471d1bf ] + +cpuidle_state_get_one_value() never cleared errno before calling +strtoull(), so a prior ERANGE caused every cpuidle counter read to +return zero. Reset errno to 0 before the conversion so each sysfs read +is evaluated independently. + +Link: https://lore.kernel.org/r/20251201121745.3776703-1-kaushlendra.kumar@intel.com +Signed-off-by: Kaushlendra Kumar +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/power/cpupower/lib/cpuidle.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c +index f2c1139adf716..bd857ee7541a7 100644 +--- a/tools/power/cpupower/lib/cpuidle.c ++++ b/tools/power/cpupower/lib/cpuidle.c +@@ -150,6 +150,7 @@ unsigned long long cpuidle_state_get_one_value(unsigned int cpu, + if (len == 0) + return 0; + ++ errno = 0; + value = strtoull(linebuf, &endp, 0); + + if (endp == linebuf || errno == ERANGE) +-- +2.51.0 + diff --git a/queue-6.19/tracing-fix-false-sharing-in-hwlat-get_sample.patch b/queue-6.19/tracing-fix-false-sharing-in-hwlat-get_sample.patch new file mode 100644 index 00000000000..4ea6a6cb5cd --- /dev/null +++ b/queue-6.19/tracing-fix-false-sharing-in-hwlat-get_sample.patch @@ -0,0 +1,113 @@ +From 363b25f746026f8ae7aae915f535bb113870fad6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 23:48:10 -0800 +Subject: tracing: Fix false sharing in hwlat get_sample() + +From: Colin Lord + +[ Upstream commit f743435f988cb0cf1f521035aee857851b25e06d ] + +The get_sample() function in the hwlat tracer assumes the caller holds +hwlat_data.lock, but this is not actually happening. The result is +unprotected data access to hwlat_data, and in per-cpu mode can result in +false sharing which may show up as false positive latency events. + +The specific case of false sharing observed was primarily between +hwlat_data.sample_width and hwlat_data.count. These are separated by +just 8B and are therefore likely to share a cache line. When one thread +modifies count, the cache line is in a modified state so when other +threads read sample_width in the main latency detection loop, they fetch +the modified cache line. On some systems, the fetch itself may be slow +enough to count as a latency event, which could set up a self +reinforcing cycle of latency events as each event increments count which +then causes more latency events, continuing the cycle. + +The other result of the unprotected data access is that hwlat_data.count +can end up with duplicate or missed values, which was observed on some +systems in testing. + +Convert hwlat_data.count to atomic64_t so it can be safely modified +without locking, and prevent false sharing by pulling sample_width into +a local variable. + +One system this was tested on was a dual socket server with 32 CPUs on +each numa node. With settings of 1us threshold, 1000us width, and +2000us window, this change reduced the number of latency events from +500 per second down to approximately 1 event per minute. Some machines +tested did not exhibit measurable latency from the false sharing. + +Cc: Masami Hiramatsu +Cc: Mathieu Desnoyers +Link: https://patch.msgid.link/20260210074810.6328-1-clord@mykolab.com +Signed-off-by: Colin Lord +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_hwlat.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c +index 2f7b94e98317c..3fe274b84f1c2 100644 +--- a/kernel/trace/trace_hwlat.c ++++ b/kernel/trace/trace_hwlat.c +@@ -102,9 +102,9 @@ struct hwlat_sample { + /* keep the global state somewhere. */ + static struct hwlat_data { + +- struct mutex lock; /* protect changes */ ++ struct mutex lock; /* protect changes */ + +- u64 count; /* total since reset */ ++ atomic64_t count; /* total since reset */ + + u64 sample_window; /* total sampling window (on+off) */ + u64 sample_width; /* active sampling portion of window */ +@@ -193,8 +193,7 @@ void trace_hwlat_callback(bool enter) + * get_sample - sample the CPU TSC and look for likely hardware latencies + * + * Used to repeatedly capture the CPU TSC (or similar), looking for potential +- * hardware-induced latency. Called with interrupts disabled and with +- * hwlat_data.lock held. ++ * hardware-induced latency. Called with interrupts disabled. + */ + static int get_sample(void) + { +@@ -204,6 +203,7 @@ static int get_sample(void) + time_type start, t1, t2, last_t2; + s64 diff, outer_diff, total, last_total = 0; + u64 sample = 0; ++ u64 sample_width = READ_ONCE(hwlat_data.sample_width); + u64 thresh = tracing_thresh; + u64 outer_sample = 0; + int ret = -1; +@@ -267,7 +267,7 @@ static int get_sample(void) + if (diff > sample) + sample = diff; /* only want highest value */ + +- } while (total <= hwlat_data.sample_width); ++ } while (total <= sample_width); + + barrier(); /* finish the above in the view for NMIs */ + trace_hwlat_callback_enabled = false; +@@ -285,8 +285,7 @@ static int get_sample(void) + if (kdata->nmi_total_ts) + do_div(kdata->nmi_total_ts, NSEC_PER_USEC); + +- hwlat_data.count++; +- s.seqnum = hwlat_data.count; ++ s.seqnum = atomic64_inc_return(&hwlat_data.count); + s.duration = sample; + s.outer_duration = outer_sample; + s.nmi_total_ts = kdata->nmi_total_ts; +@@ -832,7 +831,7 @@ static int hwlat_tracer_init(struct trace_array *tr) + + hwlat_trace = tr; + +- hwlat_data.count = 0; ++ atomic64_set(&hwlat_data.count, 0); + tr->max_latency = 0; + save_tracing_thresh = tracing_thresh; + +-- +2.51.0 + diff --git a/queue-6.19/tty-vt-keyboard-split-apart-vt_do_diacrit.patch b/queue-6.19/tty-vt-keyboard-split-apart-vt_do_diacrit.patch new file mode 100644 index 00000000000..8bea35fc4e2 --- /dev/null +++ b/queue-6.19/tty-vt-keyboard-split-apart-vt_do_diacrit.patch @@ -0,0 +1,313 @@ +From aac177594ad7c67f178c93aa67c54fe97d6afddd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 15:54:37 -0700 +Subject: tty: vt/keyboard: Split apart vt_do_diacrit() + +From: Nathan Chancellor + +[ Upstream commit 0a76a17238f805b231d97b118232a5185bbb7a18 ] + +After commit bfb24564b5fd ("tty: vt/keyboard: use __free()"), builds +using asm goto for put_user() and get_user() with a version of clang +older than 17 error with: + + drivers/tty/vt/keyboard.c:1709:7: error: cannot jump from this asm goto statement to one of its possible targets + if (put_user(asize, &a->kb_cnt)) + ^ + ... + arch/arm64/include/asm/uaccess.h:298:2: note: expanded from macro '__put_mem_asm' + asm goto( \ + ^ + drivers/tty/vt/keyboard.c:1687:7: note: possible target of asm goto statement + if (put_user(asize, &a->kb_cnt)) + ^ + ... + arch/arm64/include/asm/uaccess.h:342:2: note: expanded from macro '__raw_put_user' + __rpu_failed: \ + ^ + drivers/tty/vt/keyboard.c:1697:23: note: jump exits scope of variable with __attribute__((cleanup)) + void __free(kfree) *buf = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacruc), + ^ + drivers/tty/vt/keyboard.c:1671:33: note: jump bypasses initialization of variable with __attribute__((cleanup)) + struct kbdiacr __free(kfree) *dia = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacr), + ^ + +Prior to a fix to clang's scope checker in clang 17 [1], all labels in a +function were validated as potential targets of all asm gotos in a +function, regardless of whether they actually were a target of an asm +goto call, resulting in false positive errors about skipping over +variables marked with the cleanup attribute. + +To workaround this error, split up the bodies of the case statements in +vt_do_diacrit() into their own functions so that the scope checker does +not trip up on the multiple instances of __free(). + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202509091702.Oc7eCRDw-lkp@intel.com/ +Closes: https://lore.kernel.org/oe-kbuild-all/202511241835.EA8lShgH-lkp@intel.com/ +Link: https://github.com/llvm/llvm-project/commit/f023f5cdb2e6c19026f04a15b5a935c041835d14 [1] +Signed-off-by: Nathan Chancellor +Link: https://patch.msgid.link/20251125-tty-vt-keyboard-wa-clang-scope-check-error-v1-1-f5a5ea55c578@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/vt/keyboard.c | 221 ++++++++++++++++++++------------------ + 1 file changed, 115 insertions(+), 106 deletions(-) + +diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c +index d65fc60dd7bed..3538d54d6a6ac 100644 +--- a/drivers/tty/vt/keyboard.c ++++ b/drivers/tty/vt/keyboard.c +@@ -1649,134 +1649,143 @@ int __init kbd_init(void) + + /* Ioctl support code */ + +-/** +- * vt_do_diacrit - diacritical table updates +- * @cmd: ioctl request +- * @udp: pointer to user data for ioctl +- * @perm: permissions check computed by caller +- * +- * Update the diacritical tables atomically and safely. Lock them +- * against simultaneous keypresses +- */ +-int vt_do_diacrit(unsigned int cmd, void __user *udp, int perm) ++static int vt_do_kdgkbdiacr(void __user *udp) + { +- int asize; +- +- switch (cmd) { +- case KDGKBDIACR: +- { +- struct kbdiacrs __user *a = udp; +- int i; ++ struct kbdiacrs __user *a = udp; ++ int i, asize; + +- struct kbdiacr __free(kfree) *dia = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacr), +- GFP_KERNEL); +- if (!dia) +- return -ENOMEM; ++ struct kbdiacr __free(kfree) *dia = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacr), ++ GFP_KERNEL); ++ if (!dia) ++ return -ENOMEM; + +- /* Lock the diacriticals table, make a copy and then +- copy it after we unlock */ +- scoped_guard(spinlock_irqsave, &kbd_event_lock) { +- asize = accent_table_size; +- for (i = 0; i < asize; i++) { +- dia[i].diacr = conv_uni_to_8bit(accent_table[i].diacr); +- dia[i].base = conv_uni_to_8bit(accent_table[i].base); +- dia[i].result = conv_uni_to_8bit(accent_table[i].result); +- } ++ /* Lock the diacriticals table, make a copy and then ++ copy it after we unlock */ ++ scoped_guard(spinlock_irqsave, &kbd_event_lock) { ++ asize = accent_table_size; ++ for (i = 0; i < asize; i++) { ++ dia[i].diacr = conv_uni_to_8bit(accent_table[i].diacr); ++ dia[i].base = conv_uni_to_8bit(accent_table[i].base); ++ dia[i].result = conv_uni_to_8bit(accent_table[i].result); + } +- +- if (put_user(asize, &a->kb_cnt)) +- return -EFAULT; +- if (copy_to_user(a->kbdiacr, dia, asize * sizeof(struct kbdiacr))) +- return -EFAULT; +- return 0; + } +- case KDGKBDIACRUC: +- { +- struct kbdiacrsuc __user *a = udp; + +- void __free(kfree) *buf = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacruc), +- GFP_KERNEL); +- if (buf == NULL) +- return -ENOMEM; ++ if (put_user(asize, &a->kb_cnt)) ++ return -EFAULT; ++ if (copy_to_user(a->kbdiacr, dia, asize * sizeof(struct kbdiacr))) ++ return -EFAULT; ++ return 0; ++} + +- /* Lock the diacriticals table, make a copy and then +- copy it after we unlock */ +- scoped_guard(spinlock_irqsave, &kbd_event_lock) { +- asize = accent_table_size; +- memcpy(buf, accent_table, asize * sizeof(struct kbdiacruc)); +- } ++static int vt_do_kdgkbdiacruc(void __user *udp) ++{ ++ struct kbdiacrsuc __user *a = udp; ++ int asize; + +- if (put_user(asize, &a->kb_cnt)) +- return -EFAULT; +- if (copy_to_user(a->kbdiacruc, buf, asize * sizeof(struct kbdiacruc))) +- return -EFAULT; ++ void __free(kfree) *buf = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacruc), ++ GFP_KERNEL); ++ if (buf == NULL) ++ return -ENOMEM; + +- return 0; ++ /* Lock the diacriticals table, make a copy and then ++ copy it after we unlock */ ++ scoped_guard(spinlock_irqsave, &kbd_event_lock) { ++ asize = accent_table_size; ++ memcpy(buf, accent_table, asize * sizeof(struct kbdiacruc)); + } + +- case KDSKBDIACR: +- { +- struct kbdiacrs __user *a = udp; +- struct kbdiacr __free(kfree) *dia = NULL; +- unsigned int ct; +- int i; ++ if (put_user(asize, &a->kb_cnt)) ++ return -EFAULT; ++ if (copy_to_user(a->kbdiacruc, buf, asize * sizeof(struct kbdiacruc))) ++ return -EFAULT; + +- if (!perm) +- return -EPERM; +- if (get_user(ct, &a->kb_cnt)) +- return -EFAULT; +- if (ct >= MAX_DIACR) +- return -EINVAL; ++ return 0; ++} + +- if (ct) { +- dia = memdup_array_user(a->kbdiacr, +- ct, sizeof(struct kbdiacr)); +- if (IS_ERR(dia)) +- return PTR_ERR(dia); +- } ++static int vt_do_kdskbdiacr(void __user *udp, int perm) ++{ ++ struct kbdiacrs __user *a = udp; ++ struct kbdiacr __free(kfree) *dia = NULL; ++ unsigned int ct; ++ int i; + +- guard(spinlock_irqsave)(&kbd_event_lock); +- accent_table_size = ct; +- for (i = 0; i < ct; i++) { +- accent_table[i].diacr = +- conv_8bit_to_uni(dia[i].diacr); +- accent_table[i].base = +- conv_8bit_to_uni(dia[i].base); +- accent_table[i].result = +- conv_8bit_to_uni(dia[i].result); +- } ++ if (!perm) ++ return -EPERM; ++ if (get_user(ct, &a->kb_cnt)) ++ return -EFAULT; ++ if (ct >= MAX_DIACR) ++ return -EINVAL; + +- return 0; ++ if (ct) { ++ dia = memdup_array_user(a->kbdiacr, ++ ct, sizeof(struct kbdiacr)); ++ if (IS_ERR(dia)) ++ return PTR_ERR(dia); + } + +- case KDSKBDIACRUC: +- { +- struct kbdiacrsuc __user *a = udp; +- unsigned int ct; +- void __free(kfree) *buf = NULL; ++ guard(spinlock_irqsave)(&kbd_event_lock); ++ accent_table_size = ct; ++ for (i = 0; i < ct; i++) { ++ accent_table[i].diacr = ++ conv_8bit_to_uni(dia[i].diacr); ++ accent_table[i].base = ++ conv_8bit_to_uni(dia[i].base); ++ accent_table[i].result = ++ conv_8bit_to_uni(dia[i].result); ++ } + +- if (!perm) +- return -EPERM; ++ return 0; ++} + +- if (get_user(ct, &a->kb_cnt)) +- return -EFAULT; ++static int vt_do_kdskbdiacruc(void __user *udp, int perm) ++{ ++ struct kbdiacrsuc __user *a = udp; ++ unsigned int ct; ++ void __free(kfree) *buf = NULL; + +- if (ct >= MAX_DIACR) +- return -EINVAL; ++ if (!perm) ++ return -EPERM; + +- if (ct) { +- buf = memdup_array_user(a->kbdiacruc, +- ct, sizeof(struct kbdiacruc)); +- if (IS_ERR(buf)) +- return PTR_ERR(buf); +- } +- guard(spinlock_irqsave)(&kbd_event_lock); +- if (ct) +- memcpy(accent_table, buf, +- ct * sizeof(struct kbdiacruc)); +- accent_table_size = ct; +- return 0; ++ if (get_user(ct, &a->kb_cnt)) ++ return -EFAULT; ++ ++ if (ct >= MAX_DIACR) ++ return -EINVAL; ++ ++ if (ct) { ++ buf = memdup_array_user(a->kbdiacruc, ++ ct, sizeof(struct kbdiacruc)); ++ if (IS_ERR(buf)) ++ return PTR_ERR(buf); + } ++ guard(spinlock_irqsave)(&kbd_event_lock); ++ if (ct) ++ memcpy(accent_table, buf, ++ ct * sizeof(struct kbdiacruc)); ++ accent_table_size = ct; ++ return 0; ++} ++ ++/** ++ * vt_do_diacrit - diacritical table updates ++ * @cmd: ioctl request ++ * @udp: pointer to user data for ioctl ++ * @perm: permissions check computed by caller ++ * ++ * Update the diacritical tables atomically and safely. Lock them ++ * against simultaneous keypresses ++ */ ++int vt_do_diacrit(unsigned int cmd, void __user *udp, int perm) ++{ ++ switch (cmd) { ++ case KDGKBDIACR: ++ return vt_do_kdgkbdiacr(udp); ++ case KDGKBDIACRUC: ++ return vt_do_kdgkbdiacruc(udp); ++ case KDSKBDIACR: ++ return vt_do_kdskbdiacr(udp, perm); ++ case KDSKBDIACRUC: ++ return vt_do_kdskbdiacruc(udp, perm); + } + return 0; + } +-- +2.51.0 + diff --git a/queue-6.19/um-preserve-errno-within-signal-handler.patch b/queue-6.19/um-preserve-errno-within-signal-handler.patch new file mode 100644 index 00000000000..16a182e751f --- /dev/null +++ b/queue-6.19/um-preserve-errno-within-signal-handler.patch @@ -0,0 +1,59 @@ +From 61e9f63afb901460ef15e4f0d95400c07dc45152 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 08:12:27 +0800 +Subject: um: Preserve errno within signal handler + +From: Tiwei Bie + +[ Upstream commit f68b2d5a907b53eed99cf2efcaaae116df73c298 ] + +We rely on errno to determine whether a syscall has failed, so we +need to ensure that accessing errno is async-signal-safe. Currently, +we preserve the errno in sig_handler_common(), but it doesn't cover +every possible case. Let's do it in hard_handler() instead, which +is the signal handler we actually register. + +Signed-off-by: Tiwei Bie +Link: https://patch.msgid.link/20260106001228.1531146-2-tiwei.btw@antgroup.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + arch/um/os-Linux/signal.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/um/os-Linux/signal.c b/arch/um/os-Linux/signal.c +index 327fb3c52fc79..de372b936a804 100644 +--- a/arch/um/os-Linux/signal.c ++++ b/arch/um/os-Linux/signal.c +@@ -36,7 +36,6 @@ void (*sig_info[NSIG])(int, struct siginfo *, struct uml_pt_regs *, void *mc) = + static void sig_handler_common(int sig, struct siginfo *si, mcontext_t *mc) + { + struct uml_pt_regs r; +- int save_errno = errno; + + r.is_user = 0; + if (sig == SIGSEGV) { +@@ -50,8 +49,6 @@ static void sig_handler_common(int sig, struct siginfo *si, mcontext_t *mc) + unblock_signals_trace(); + + (*sig_info[sig])(sig, si, &r, mc); +- +- errno = save_errno; + } + + /* +@@ -207,8 +204,11 @@ static void hard_handler(int sig, siginfo_t *si, void *p) + { + ucontext_t *uc = p; + mcontext_t *mc = &uc->uc_mcontext; ++ int save_errno = errno; + + (*handlers[sig])(sig, (struct siginfo *)si, mc); ++ ++ errno = save_errno; + } + + void set_handler(int sig) +-- +2.51.0 + diff --git a/queue-6.19/usb-chipidea-udc-fix-dma-and-sg-cleanup-in-_ep_nuke.patch b/queue-6.19/usb-chipidea-udc-fix-dma-and-sg-cleanup-in-_ep_nuke.patch new file mode 100644 index 00000000000..e8be3aaa535 --- /dev/null +++ b/queue-6.19/usb-chipidea-udc-fix-dma-and-sg-cleanup-in-_ep_nuke.patch @@ -0,0 +1,72 @@ +From 9e7e005e0b234a1fe0bfedf7c8a4fe0045466e7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 16:59:02 +0000 +Subject: usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() + +From: Mario Peter + +[ Upstream commit cea2a1257a3b5ea3e769a445b34af13e6aa5a123 ] + +The ChipIdea UDC driver can encounter "not page aligned sg buffer" +errors when a USB device is reconnected after being disconnected +during an active transfer. This occurs because _ep_nuke() returns +requests to the gadget layer without properly unmapping DMA buffers +or cleaning up scatter-gather bounce buffers. + +Root cause: +When a disconnect happens during a multi-segment DMA transfer, the +request's num_mapped_sgs field and sgt.sgl pointer remain set with +stale values. The request is returned to the gadget driver with status +-ESHUTDOWN but still has active DMA state. If the gadget driver reuses +this request on reconnect without reinitializing it, the stale DMA +state causes _hardware_enqueue() to skip DMA mapping (seeing non-zero +num_mapped_sgs) and attempt to use freed/invalid DMA addresses, +leading to alignment errors and potential memory corruption. + +The normal completion path via _hardware_dequeue() properly calls +usb_gadget_unmap_request_by_dev() and sglist_do_debounce() before +returning the request. The _ep_nuke() path must do the same cleanup +to ensure requests are returned in a clean, reusable state. + +Fix: +Add DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror +the cleanup sequence in _hardware_dequeue(): +- Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set +- Call sglist_do_debounce() with copy=false if bounce buffer exists + +This ensures that when requests are returned due to endpoint shutdown, +they don't retain stale DMA mappings. The 'false' parameter to +sglist_do_debounce() prevents copying data back (appropriate for +shutdown path where transfer was aborted). + +Signed-off-by: Mario Peter +Reviewed-by: Xu Yang +Acked-by: Peter Chen +Link: https://patch.msgid.link/20260108165902.795354-1-mario.peter@leica-geosystems.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/chipidea/udc.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c +index 64a421ae0f05b..c8d931d9d4330 100644 +--- a/drivers/usb/chipidea/udc.c ++++ b/drivers/usb/chipidea/udc.c +@@ -931,6 +931,13 @@ __acquires(hwep->lock) + list_del_init(&hwreq->queue); + hwreq->req.status = -ESHUTDOWN; + ++ /* Unmap DMA and clean up bounce buffers before giving back */ ++ usb_gadget_unmap_request_by_dev(hwep->ci->dev->parent, ++ &hwreq->req, hwep->dir); ++ ++ if (hwreq->sgt.sgl) ++ sglist_do_debounce(hwreq, false); ++ + if (hwreq->req.complete != NULL) { + spin_unlock(hwep->lock); + usb_gadget_giveback_request(&hwep->ep, &hwreq->req); +-- +2.51.0 + diff --git a/queue-6.19/usb-gadget-f_fs-fix-dma-buf-out-queues.patch b/queue-6.19/usb-gadget-f_fs-fix-dma-buf-out-queues.patch new file mode 100644 index 00000000000..88de0035710 --- /dev/null +++ b/queue-6.19/usb-gadget-f_fs-fix-dma-buf-out-queues.patch @@ -0,0 +1,66 @@ +From e83c746b9747f024fc9e8efdd955e7d72c88d34b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 08:30:21 +1000 +Subject: usb: gadget: f_fs: fix DMA-BUF OUT queues + +From: Sam Day + +[ Upstream commit 0145e7acd29855dfba4a2f387d455b5d9a520f0e ] + +Currently, DMA_FROM_DEVICE is used when attaching DMABUFs to IN +endpoints and DMA_TO_DEVICE for OUT endpoints. This is inverted from +how it should be. + +The result is IOMMU read-only mappings placed on OUT queues, +triggering arm-smmu write faults. + +Put differently, OUT endpoints flow data from host -> gadget, meaning +the UDC peripheral needs to have write access to the buffer to fill it +with the incoming data. + +This commit flips the directions and updates the implicit-sync helpers +so IN endpoints act as readers and OUT endpoints as writers. + +Signed-off-by: Sam Day +Tested-by: David Heidelberg # OnePlus 6T on sdm845-next-20251119 +Link: https://patch.msgid.link/20260108-ffs-dmabuf-ioctl-fix-v1-2-e51633891a81@samcday.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_fs.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index fa467a40949d2..928f51fddc64e 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1509,7 +1509,7 @@ static int ffs_dmabuf_attach(struct file *file, int fd) + goto err_dmabuf_detach; + } + +- dir = epfile->in ? DMA_FROM_DEVICE : DMA_TO_DEVICE; ++ dir = epfile->in ? DMA_TO_DEVICE : DMA_FROM_DEVICE; + + err = ffs_dma_resv_lock(dmabuf, nonblock); + if (err) +@@ -1639,7 +1639,7 @@ static int ffs_dmabuf_transfer(struct file *file, + /* Make sure we don't have writers */ + timeout = nonblock ? 0 : msecs_to_jiffies(DMABUF_ENQUEUE_TIMEOUT_MS); + retl = dma_resv_wait_timeout(dmabuf->resv, +- dma_resv_usage_rw(epfile->in), ++ dma_resv_usage_rw(!epfile->in), + true, timeout); + if (retl == 0) + retl = -EBUSY; +@@ -1684,7 +1684,7 @@ static int ffs_dmabuf_transfer(struct file *file, + dma_fence_init(&fence->base, &ffs_dmabuf_fence_ops, + &priv->lock, priv->context, seqno); + +- resv_dir = epfile->in ? DMA_RESV_USAGE_WRITE : DMA_RESV_USAGE_READ; ++ resv_dir = epfile->in ? DMA_RESV_USAGE_READ : DMA_RESV_USAGE_WRITE; + + dma_resv_add_fence(dmabuf->resv, &fence->base, resv_dir); + dma_resv_unlock(dmabuf->resv); +-- +2.51.0 + diff --git a/queue-6.19/usb-gadget-f_fs-fix-ioctl-error-handling.patch b/queue-6.19/usb-gadget-f_fs-fix-ioctl-error-handling.patch new file mode 100644 index 00000000000..71951bf9d40 --- /dev/null +++ b/queue-6.19/usb-gadget-f_fs-fix-ioctl-error-handling.patch @@ -0,0 +1,77 @@ +From efec1fdaa3688c2d80750550c51c047f84f9e6d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 08:30:20 +1000 +Subject: usb: gadget: f_fs: Fix ioctl error handling + +From: Sam Day + +[ Upstream commit 8e4c1d06183c25022f6b0002a5cab84979ca6337 ] + +When ffs_epfile_ioctl handles FUNCTIONFS_DMABUF_* ioctls, it's currently +falling through when copy_from_user fails. + +However, this fallthrough isn't being checked properly, so the handler +continues executing further than it should. It then tries the secondary +dispatch where it ultimately gives up and returns -ENOTTY. + +The end result is invalid ioctl invocations will yield a -ENOTTY rather +than an -EFAULT. + +It's a common pattern elsewhere in the kernel code to directly return +-EFAULT when copy_from_user fails. So we update ffs_epfile_ioctl to do +the same and fix this issue. + +Signed-off-by: Sam Day +Link: https://patch.msgid.link/20260108-ffs-dmabuf-ioctl-fix-v1-1-e51633891a81@samcday.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_fs.c | 18 ++++++------------ + 1 file changed, 6 insertions(+), 12 deletions(-) + +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 928f51fddc64e..e75d5d8b5ac91 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1744,10 +1744,8 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code, + { + int fd; + +- if (copy_from_user(&fd, (void __user *)value, sizeof(fd))) { +- ret = -EFAULT; +- break; +- } ++ if (copy_from_user(&fd, (void __user *)value, sizeof(fd))) ++ return -EFAULT; + + return ffs_dmabuf_attach(file, fd); + } +@@ -1755,10 +1753,8 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code, + { + int fd; + +- if (copy_from_user(&fd, (void __user *)value, sizeof(fd))) { +- ret = -EFAULT; +- break; +- } ++ if (copy_from_user(&fd, (void __user *)value, sizeof(fd))) ++ return -EFAULT; + + return ffs_dmabuf_detach(file, fd); + } +@@ -1766,10 +1762,8 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code, + { + struct usb_ffs_dmabuf_transfer_req req; + +- if (copy_from_user(&req, (void __user *)value, sizeof(req))) { +- ret = -EFAULT; +- break; +- } ++ if (copy_from_user(&req, (void __user *)value, sizeof(req))) ++ return -EFAULT; + + return ffs_dmabuf_transfer(file, &req); + } +-- +2.51.0 + diff --git a/queue-6.19/usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch b/queue-6.19/usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch new file mode 100644 index 00000000000..ec51b91ee9a --- /dev/null +++ b/queue-6.19/usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch @@ -0,0 +1,122 @@ +From 1ffd92e5254399796059f421d04692b36f097b2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 17:48:48 +0000 +Subject: usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs + +From: Benson Leung + +[ Upstream commit 6811e0a08bdce6b2767414caf17fda24c2e4e032 ] + +ucsi_psy_get_voltage_max and ucsi_psy_get_current_max are calculated +using whichever pdo is in the last position of the src_pdos array, presuming +it to be a fixed pdo, so the pdo_fixed_voltage or pdo_max_current +helpers are used on that last pdo. + +However, non-Fixed PDOs such as Battery PDOs, Augmented PDOs (used for AVS and +for PPS) may exist, and are always at the end of the array if they do. +In the event one of these more advanced chargers are attached the helpers for +fixed return mangled values. + +Here's an example case of a Google Pixel Flex Dual Port 67W USB-C Fast Charger +with PPS support: +POWER_SUPPLY_NAME=ucsi-source-psy-cros_ec_ucsi.4.auto2 +POWER_SUPPLY_TYPE=USB +POWER_SUPPLY_CHARGE_TYPE=Standard +POWER_SUPPLY_USB_TYPE=C [PD] PD_PPS PD_DRP +POWER_SUPPLY_ONLINE=1 +POWER_SUPPLY_VOLTAGE_MIN=5000000 +POWER_SUPPLY_VOLTAGE_MAX=13400000 +POWER_SUPPLY_VOLTAGE_NOW=20000000 +POWER_SUPPLY_CURRENT_MAX=5790000 +POWER_SUPPLY_CURRENT_NOW=3250000 + +Voltage Max is reading as 13.4V, but that's an incorrect decode of the PPS +APDO in the last position. Same goes for CURRENT_MAX. 5.79A is incorrect. + +Instead, enumerate through the src_pdos and filter just for Fixed PDOs for +now, and find the one with the highest voltage and current respectively. + +After, from the same charger: +POWER_SUPPLY_NAME=ucsi-source-psy-cros_ec_ucsi.4.auto2 +POWER_SUPPLY_TYPE=USB +POWER_SUPPLY_CHARGE_TYPE=Standard +POWER_SUPPLY_USB_TYPE=C [PD] PD_PPS PD_DRP +POWER_SUPPLY_ONLINE=1 +POWER_SUPPLY_VOLTAGE_MIN=5000000 +POWER_SUPPLY_VOLTAGE_MAX=20000000 +POWER_SUPPLY_VOLTAGE_NOW=20000000 +POWER_SUPPLY_CURRENT_MAX=4000000 +POWER_SUPPLY_CURRENT_NOW=3250000 + +Signed-off-by: Benson Leung +Reviewed-by: Heikki Krogerus +Link: https://patch.msgid.link/20251208174918.289394-3-bleung@chromium.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/ucsi/psy.c | 30 ++++++++++++++++++++---------- + 1 file changed, 20 insertions(+), 10 deletions(-) + +diff --git a/drivers/usb/typec/ucsi/psy.c b/drivers/usb/typec/ucsi/psy.c +index 3abe9370ffaaf..62160c4191718 100644 +--- a/drivers/usb/typec/ucsi/psy.c ++++ b/drivers/usb/typec/ucsi/psy.c +@@ -112,15 +112,20 @@ static int ucsi_psy_get_voltage_max(struct ucsi_connector *con, + union power_supply_propval *val) + { + u32 pdo; ++ int max_voltage = 0; + + switch (UCSI_CONSTAT(con, PWR_OPMODE)) { + case UCSI_CONSTAT_PWR_OPMODE_PD: +- if (con->num_pdos > 0) { +- pdo = con->src_pdos[con->num_pdos - 1]; +- val->intval = pdo_fixed_voltage(pdo) * 1000; +- } else { +- val->intval = 0; ++ for (int i = 0; i < con->num_pdos; i++) { ++ int pdo_voltage = 0; ++ ++ pdo = con->src_pdos[i]; ++ if (pdo_type(pdo) == PDO_TYPE_FIXED) ++ pdo_voltage = pdo_fixed_voltage(pdo) * 1000; ++ max_voltage = (pdo_voltage > max_voltage) ? pdo_voltage ++ : max_voltage; + } ++ val->intval = max_voltage; + break; + case UCSI_CONSTAT_PWR_OPMODE_TYPEC3_0: + case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5: +@@ -168,6 +173,7 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con, + union power_supply_propval *val) + { + u32 pdo; ++ int max_current = 0; + + if (!UCSI_CONSTAT(con, CONNECTED)) { + val->intval = 0; +@@ -176,12 +182,16 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con, + + switch (UCSI_CONSTAT(con, PWR_OPMODE)) { + case UCSI_CONSTAT_PWR_OPMODE_PD: +- if (con->num_pdos > 0) { +- pdo = con->src_pdos[con->num_pdos - 1]; +- val->intval = pdo_max_current(pdo) * 1000; +- } else { +- val->intval = 0; ++ for (int i = 0; i < con->num_pdos; i++) { ++ int pdo_current = 0; ++ ++ pdo = con->src_pdos[i]; ++ if (pdo_type(pdo) == PDO_TYPE_FIXED) ++ pdo_current = pdo_max_current(pdo) * 1000; ++ max_current = (pdo_current > max_current) ? pdo_current ++ : max_current; + } ++ val->intval = max_current; + break; + case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5: + val->intval = UCSI_TYPEC_1_5_CURRENT * 1000; +-- +2.51.0 + diff --git a/queue-6.19/vhost-fix-caching-attributes-of-mmio-regions-by-sett.patch b/queue-6.19/vhost-fix-caching-attributes-of-mmio-regions-by-sett.patch new file mode 100644 index 00000000000..0587d2869b3 --- /dev/null +++ b/queue-6.19/vhost-fix-caching-attributes-of-mmio-regions-by-sett.patch @@ -0,0 +1,42 @@ +From 93503b7e26c4f27ed1ffa475d441977dbb2a33a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jan 2026 12:27:03 +0530 +Subject: vhost: fix caching attributes of MMIO regions by setting them + explicitly + +From: Kommula Shiva Shankar + +[ Upstream commit 5145b277309f3818e2db507f525d19ac3b910922 ] + +Explicitly set non-cached caching attributes for MMIO regions. +Default write-back mode can cause CPU to cache device memory, +causing invalid reads and unpredictable behavior. + +Invalid read and write issues were observed on ARM64 when mapping the +notification area to userspace via mmap. + +Signed-off-by: Kommula Shiva Shankar +Acked-by: Jason Wang +Reviewed-by: Jason Gunthorpe +Signed-off-by: Michael S. Tsirkin +Message-Id: <20260102065703.656255-1-kshankar@marvell.com> +Signed-off-by: Sasha Levin +--- + drivers/vhost/vdpa.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c +index 05a481e4c385a..b0179e8567aba 100644 +--- a/drivers/vhost/vdpa.c ++++ b/drivers/vhost/vdpa.c +@@ -1527,6 +1527,7 @@ static int vhost_vdpa_mmap(struct file *file, struct vm_area_struct *vma) + if (vma->vm_end - vma->vm_start != notify.size) + return -ENOTSUPP; + ++ vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); + vm_flags_set(vma, VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP); + vma->vm_ops = &vhost_vdpa_vm_ops; + return 0; +-- +2.51.0 + diff --git a/queue-6.19/virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch b/queue-6.19/virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch new file mode 100644 index 00000000000..0207ff2a982 --- /dev/null +++ b/queue-6.19/virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch @@ -0,0 +1,75 @@ +From 18d1bee24af36c559713d264f39864e4ce18ad12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 08:35:45 +0100 +Subject: virt: vbox: uapi: Mark inner unions in packed structs as packed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit c25d01e1c4f2d43f47af87c00e223f5ca7c71792 ] + +The unpacked unions within a packed struct generates alignment warnings +on clang for 32-bit ARM: + +./usr/include/linux/vbox_vmmdev_types.h:239:4: error: field u within 'struct vmmdev_hgcm_function_parameter32' + is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:223:2)' + and is usually due to 'struct vmmdev_hgcm_function_parameter32' being packed, + which can lead to unaligned accesses [-Werror,-Wunaligned-access] + 239 | } u; + | ^ + +./usr/include/linux/vbox_vmmdev_types.h:254:6: error: field u within + 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)' + is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:251:4)' and is usually due to + 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)' + being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] + +With the recent changes to compile-test the UAPI headers in more cases, +these warning in combination with CONFIG_WERROR breaks the build. + +Fix the warnings. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/ +Reported-by: Nathan Chancellor +Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/ +Suggested-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/ +Signed-off-by: Thomas Weißschuh +Tested-by: Nicolas Schier +Reviewed-by: Nicolas Schier +Acked-by: Greg Kroah-Hartman +Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-2-076aed1623ff@linutronix.de +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + include/uapi/linux/vbox_vmmdev_types.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/uapi/linux/vbox_vmmdev_types.h b/include/uapi/linux/vbox_vmmdev_types.h +index 6073858d52a2e..11f3627c3729b 100644 +--- a/include/uapi/linux/vbox_vmmdev_types.h ++++ b/include/uapi/linux/vbox_vmmdev_types.h +@@ -236,7 +236,7 @@ struct vmmdev_hgcm_function_parameter32 { + /** Relative to the request header. */ + __u32 offset; + } page_list; +- } u; ++ } __packed u; + } __packed; + VMMDEV_ASSERT_SIZE(vmmdev_hgcm_function_parameter32, 4 + 8); + +@@ -251,7 +251,7 @@ struct vmmdev_hgcm_function_parameter64 { + union { + __u64 phys_addr; + __u64 linear_addr; +- } u; ++ } __packed u; + } __packed pointer; + struct { + /** Size of the buffer described by the page list. */ +-- +2.51.0 + diff --git a/queue-6.19/vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch b/queue-6.19/vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch new file mode 100644 index 00000000000..9aed90a9afe --- /dev/null +++ b/queue-6.19/vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch @@ -0,0 +1,62 @@ +From 38f9c07c8f429a9cc179973eee146ae619df0ba2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 17:34:00 +0100 +Subject: vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 + +From: Arnd Bergmann + +[ Upstream commit e25dbf561e03c0c5e36228e3b8b784392819ce85 ] + +The gcc-16.0.1 snapshot produces a false-positive warning that turns +into a build failure with CONFIG_WERROR: + +In file included from arch/x86/include/asm/string.h:6, + from net/vmw_vsock/vmci_transport.c:10: +In function 'vmci_transport_packet_init', + inlined from '__vmci_transport_send_control_pkt.constprop' at net/vmw_vsock/vmci_transport.c:198:2: +arch/x86/include/asm/string_32.h:150:25: error: argument 2 null where non-null expected because argument 3 is nonzero [-Werror=nonnull] + 150 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n) + | ^~~~~~~~~~~~~~~~~~~~~~~~~ +net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy' + 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait)); + | ^~~~~~ +arch/x86/include/asm/string_32.h:150:25: note: in a call to built-in function '__builtin_memcpy' +net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy' + 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait)); + | ^~~~~~ + +This seems relatively harmless, and it so far the only instance of this +warning I have found. The __vmci_transport_send_control_pkt function +is called either with wait=NULL or with one of the type values that +pass 'wait' into memcpy() here, but not from the same caller. + +Replacing the memcpy with a struct assignment is otherwise the same +but avoids the warning. + +Signed-off-by: Arnd Bergmann +Reviewed-by: Bobby Eshleman +Reviewed-by: Stefano Garzarella +Reviewed-by: Bryan Tan +Link: https://patch.msgid.link/20260203163406.2636463-1-arnd@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/vmw_vsock/vmci_transport.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c +index 7eccd6708d664..aca3132689cf1 100644 +--- a/net/vmw_vsock/vmci_transport.c ++++ b/net/vmw_vsock/vmci_transport.c +@@ -161,7 +161,7 @@ vmci_transport_packet_init(struct vmci_transport_packet *pkt, + + case VMCI_TRANSPORT_PACKET_TYPE_WAITING_READ: + case VMCI_TRANSPORT_PACKET_TYPE_WAITING_WRITE: +- memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait)); ++ pkt->u.wait = *wait; + break; + + case VMCI_TRANSPORT_PACKET_TYPE_REQUEST2: +-- +2.51.0 + diff --git a/queue-6.19/watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch b/queue-6.19/watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch new file mode 100644 index 00000000000..bc3a6f10a5b --- /dev/null +++ b/queue-6.19/watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch @@ -0,0 +1,40 @@ +From c9c7ff4480472b28d180f2f3725a7fe09740a16f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Nov 2025 22:24:33 +0200 +Subject: watchdog: imx7ulp_wdt: handle the nowayout option + +From: Oleksandr Suvorov + +[ Upstream commit d303d37ef5cf86c8c3b2daefd2a7d7fd8ca1ec14 ] + +The module parameter `nowayout` indicates whether the watchdog should ever +be allowed to stop, but the driver currently ignores this option. + +Pass the `nowayout` parameter to the watchdog core by setting the +WDOG_NO_WAY_OUT flag accordingly. + +Signed-off-by: Oleksandr Suvorov +Reviewed-by: Guenter Roeck +Reviewed-by: Frank Li +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/imx7ulp_wdt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/watchdog/imx7ulp_wdt.c b/drivers/watchdog/imx7ulp_wdt.c +index 0f13a30533574..03479110453ce 100644 +--- a/drivers/watchdog/imx7ulp_wdt.c ++++ b/drivers/watchdog/imx7ulp_wdt.c +@@ -346,6 +346,7 @@ static int imx7ulp_wdt_probe(struct platform_device *pdev) + watchdog_stop_on_reboot(wdog); + watchdog_stop_on_unregister(wdog); + watchdog_set_drvdata(wdog, imx7ulp_wdt); ++ watchdog_set_nowayout(wdog, nowayout); + + imx7ulp_wdt->hw = of_device_get_match_data(dev); + ret = imx7ulp_wdt_init(imx7ulp_wdt, wdog->timeout * imx7ulp_wdt->hw->wdog_clock_rate); +-- +2.51.0 + diff --git a/queue-6.19/watchdog-rzv2h_wdt-discard-pm_runtime_put-return-val.patch b/queue-6.19/watchdog-rzv2h_wdt-discard-pm_runtime_put-return-val.patch new file mode 100644 index 00000000000..5d8d83e1466 --- /dev/null +++ b/queue-6.19/watchdog-rzv2h_wdt-discard-pm_runtime_put-return-val.patch @@ -0,0 +1,53 @@ +From 826f9935f74dab05ffa98c7d25a5d8987e2367cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Dec 2025 21:09:22 +0100 +Subject: watchdog: rzv2h_wdt: Discard pm_runtime_put() return value + +From: Rafael J. Wysocki + +[ Upstream commit 2dea984a74265a67e3210f818416a83b87f70200 ] + +Failing device probe due to pm_runtime_put() returning an error is not +particularly useful. + +Returning an error code from pm_runtime_put() merely means that it has +not queued up a work item to check whether or not the device can be +suspended and there are many perfectly valid situations in which that +can happen, like after writing "on" to the devices' runtime PM "control" +attribute in sysfs for one example. It also happens when the kernel is +configured with CONFIG_PM unset. + +Accordingly, update rzt2h_wdt_wdtdcr_init() to simply discard the return +value of pm_runtime_put() and return success to the caller after +invoking that function. + +This will facilitate a planned change of the pm_runtime_put() return +type to void in the future. + +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/rzv2h_wdt.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/watchdog/rzv2h_wdt.c b/drivers/watchdog/rzv2h_wdt.c +index a694786837e11..f9bb4ef3d327b 100644 +--- a/drivers/watchdog/rzv2h_wdt.c ++++ b/drivers/watchdog/rzv2h_wdt.c +@@ -270,9 +270,7 @@ static int rzt2h_wdt_wdtdcr_init(struct platform_device *pdev, + + rzt2h_wdt_wdtdcr_count_stop(priv); + +- ret = pm_runtime_put(&pdev->dev); +- if (ret < 0) +- return ret; ++ pm_runtime_put(&pdev->dev); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.19/wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch b/queue-6.19/wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch new file mode 100644 index 00000000000..f3aec4944c1 --- /dev/null +++ b/queue-6.19/wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch @@ -0,0 +1,59 @@ +From c56de72199e85e37bf6dd8b6f5333ef39ac095ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 17:56:11 +0000 +Subject: wifi: ath10k: fix lock protection in + ath10k_wmi_event_peer_sta_ps_state_chg() + +From: Ziyi Guo + +[ Upstream commit 820ba7dd6859ef8b1eaf6014897e7aa4756fc65d ] + +ath10k_wmi_event_peer_sta_ps_state_chg() uses lockdep_assert_held() to +assert that ar->data_lock should be held by the caller, but neither +ath10k_wmi_10_2_op_rx() nor ath10k_wmi_10_4_op_rx() acquire this lock +before calling this function. + +The field arsta->peer_ps_state is documented as protected by +ar->data_lock in core.h, and other accessors (ath10k_peer_ps_state_disable, +ath10k_dbg_sta_read_peer_ps_state) properly acquire this lock. + +Add spin_lock_bh()/spin_unlock_bh() around the peer_ps_state update, +and remove the lockdep_assert_held() to be aligned with new locking, +following the pattern used by other WMI event handlers in the driver. + +Signed-off-by: Ziyi Guo +Reviewed-by: Baochen Qiang +Link: https://patch.msgid.link/20260123175611.767731-1-n7l8m4@u.northwestern.edu +[removed excess blank line] +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/wmi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c +index b4aad6604d6d9..ce22141e5efd9 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -5289,8 +5289,6 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb) + struct ath10k_sta *arsta; + u8 peer_addr[ETH_ALEN]; + +- lockdep_assert_held(&ar->data_lock); +- + ev = (struct wmi_peer_sta_ps_state_chg_event *)skb->data; + ether_addr_copy(peer_addr, ev->peer_macaddr.addr); + +@@ -5305,7 +5303,9 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb) + } + + arsta = (struct ath10k_sta *)sta->drv_priv; ++ spin_lock_bh(&ar->data_lock); + arsta->peer_ps_state = __le32_to_cpu(ev->peer_ps_state); ++ spin_unlock_bh(&ar->data_lock); + + exit: + rcu_read_unlock(); +-- +2.51.0 + diff --git a/queue-6.19/wifi-ath11k-add-pm-quirk-for-thinkpad-z13-z16-gen1.patch b/queue-6.19/wifi-ath11k-add-pm-quirk-for-thinkpad-z13-z16-gen1.patch new file mode 100644 index 00000000000..f022c4a8b6a --- /dev/null +++ b/queue-6.19/wifi-ath11k-add-pm-quirk-for-thinkpad-z13-z16-gen1.patch @@ -0,0 +1,72 @@ +From 8283b93151407d11a9633967513d1f241242e29e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Jan 2026 17:00:34 -0800 +Subject: wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 + +From: Ross Vandegrift + +[ Upstream commit 4015b1972763d7d513172276e51439f37e622a92 ] + +Z16 Gen1 has the wakeup-from-suspend issues from [1] but was never added +to the appropriate quirk list. I've tested this patch on top of 6.18.2, +it fixes the issue for me on 21D4 + +Mark Pearson provided the other product IDs covering the second Z16 Gen1 +and both Z13 Gen1 identifiers. They share the same firmware, and folks +in the bugzilla report do indeed see the problem on Z13. + +[1] - https://bugzilla.kernel.org/show_bug.cgi?id=219196 + +Signed-off-by: Ross Vandegrift +Reviewed-by: Baochen Qiang +Tested-by: Mark Pearson +Reviewed-by: Mark Pearson +Link: https://patch.msgid.link/wj7o2kmb7g54stdjvxp2hjqrnutnq3jbf4s2uh4ctvmlxdq7tf@nbkj2ebakhrd +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/core.c | 28 ++++++++++++++++++++++++++ + 1 file changed, 28 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c +index 06b4df2370e95..78a1b0edd8b45 100644 +--- a/drivers/net/wireless/ath/ath11k/core.c ++++ b/drivers/net/wireless/ath/ath11k/core.c +@@ -994,6 +994,34 @@ static const struct dmi_system_id ath11k_pm_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "21F9"), + }, + }, ++ { ++ .driver_data = (void *)ATH11K_PM_WOW, ++ .matches = { /* Z13 G1 */ ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21D2"), ++ }, ++ }, ++ { ++ .driver_data = (void *)ATH11K_PM_WOW, ++ .matches = { /* Z13 G1 */ ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21D3"), ++ }, ++ }, ++ { ++ .driver_data = (void *)ATH11K_PM_WOW, ++ .matches = { /* Z16 G1 */ ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21D4"), ++ }, ++ }, ++ { ++ .driver_data = (void *)ATH11K_PM_WOW, ++ .matches = { /* Z16 G1 */ ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21D5"), ++ }, ++ }, + {} + }; + +-- +2.51.0 + diff --git a/queue-6.19/wifi-ath11k-fix-failure-to-connect-to-a-6-ghz-ap.patch b/queue-6.19/wifi-ath11k-fix-failure-to-connect-to-a-6-ghz-ap.patch new file mode 100644 index 00000000000..06a2dbdde23 --- /dev/null +++ b/queue-6.19/wifi-ath11k-fix-failure-to-connect-to-a-6-ghz-ap.patch @@ -0,0 +1,61 @@ +From 84458810a192ba84d00de77eb51d8773ea93c718 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 11:46:07 +0800 +Subject: wifi: ath11k: Fix failure to connect to a 6 GHz AP + +From: Qian Zhang + +[ Upstream commit 0bc8c48de6f06c0cac52dde024ffda4433de6234 ] + +STA fails to connect to a 6 GHz AP with the following errors: + ath11k_pci 0000:01:00.0: failed to handle chan list with power type 1 + wlp1s0: deauthenticating from c8:a3:e8:dd:41:e3 by local choice (Reason: 3=DEAUTH_LEAVING) + +ath11k_reg_handle_chan_list() treats the update as redundant and +returns -EINVAL. That causes the connection attempt to fail. + +Avoid unnecessary validation during association. Apply the regulatory +redundant check only when the power type is IEEE80211_REG_UNSET_AP, +which only occurs during core initialization. + +Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41 + +Signed-off-by: Qian Zhang +Reviewed-by: Baochen Qiang +Link: https://patch.msgid.link/20260108034607.812885-1-qian.zhang@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/reg.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/reg.c b/drivers/net/wireless/ath/ath11k/reg.c +index d62a2014315a0..49b79648752cf 100644 +--- a/drivers/net/wireless/ath/ath11k/reg.c ++++ b/drivers/net/wireless/ath/ath11k/reg.c +@@ -1,7 +1,7 @@ + // SPDX-License-Identifier: BSD-3-Clause-Clear + /* + * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved. +- * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved. ++ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + */ + #include + +@@ -926,8 +926,11 @@ int ath11k_reg_handle_chan_list(struct ath11k_base *ab, + */ + if (ab->default_regd[pdev_idx] && !ab->new_regd[pdev_idx] && + !memcmp((char *)ab->default_regd[pdev_idx]->alpha2, +- (char *)reg_info->alpha2, 2)) +- goto retfail; ++ (char *)reg_info->alpha2, 2) && ++ power_type == IEEE80211_REG_UNSET_AP) { ++ ath11k_reg_reset_info(reg_info); ++ return 0; ++ } + + /* Intersect new rules with default regd if a new country setting was + * requested, i.e a default regd was already set during initialization +-- +2.51.0 + diff --git a/queue-6.19/wifi-ath12k-fix-mac-phy-capability-parsing.patch b/queue-6.19/wifi-ath12k-fix-mac-phy-capability-parsing.patch new file mode 100644 index 00000000000..00bdd56f1f4 --- /dev/null +++ b/queue-6.19/wifi-ath12k-fix-mac-phy-capability-parsing.patch @@ -0,0 +1,106 @@ +From 52122f844b58aa2386e8b1389be9cd85efa29bb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 15:36:26 +0800 +Subject: wifi: ath12k: fix mac phy capability parsing + +From: Baochen Qiang + +[ Upstream commit b5151c9b6e3a347416a4b4b55fc00195526d8771 ] + +Currently ath12k_pull_mac_phy_cap_svc_ready_ext() assumes only one band +supported in each phy, hence it skips 5 GHz band if 2 GHz band support +is detected. This does not work for device which gets only one phy but +has both bands supported, such as QCC2072. + +Change to check each band individually to fix this issue. + +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 + +Signed-off-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-6-fc8ce1e43969@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/wmi.c | 22 ++++++++++++++-------- + 1 file changed, 14 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c +index 12f4d378f50d4..1613492b38350 100644 +--- a/drivers/net/wireless/ath/ath12k/wmi.c ++++ b/drivers/net/wireless/ath/ath12k/wmi.c +@@ -496,6 +496,7 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle, + struct ath12k_band_cap *cap_band; + struct ath12k_pdev_cap *pdev_cap = &pdev->cap; + struct ath12k_fw_pdev *fw_pdev; ++ u32 supported_bands; + u32 phy_map; + u32 hw_idx, phy_idx = 0; + int i; +@@ -519,14 +520,19 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle, + return -EINVAL; + + mac_caps = wmi_mac_phy_caps + phy_idx; ++ supported_bands = le32_to_cpu(mac_caps->supported_bands); ++ ++ if (!(supported_bands & WMI_HOST_WLAN_2GHZ_CAP) && ++ !(supported_bands & WMI_HOST_WLAN_5GHZ_CAP)) ++ return -EINVAL; + + pdev->pdev_id = ath12k_wmi_mac_phy_get_pdev_id(mac_caps); + pdev->hw_link_id = ath12k_wmi_mac_phy_get_hw_link_id(mac_caps); +- pdev_cap->supported_bands |= le32_to_cpu(mac_caps->supported_bands); ++ pdev_cap->supported_bands |= supported_bands; + pdev_cap->ampdu_density = le32_to_cpu(mac_caps->ampdu_density); + + fw_pdev = &ab->fw_pdev[ab->fw_pdev_count]; +- fw_pdev->supported_bands = le32_to_cpu(mac_caps->supported_bands); ++ fw_pdev->supported_bands = supported_bands; + fw_pdev->pdev_id = ath12k_wmi_mac_phy_get_pdev_id(mac_caps); + fw_pdev->phy_id = le32_to_cpu(mac_caps->phy_id); + ab->fw_pdev_count++; +@@ -535,10 +541,12 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle, + * band to band for a single radio, need to see how this should be + * handled. + */ +- if (le32_to_cpu(mac_caps->supported_bands) & WMI_HOST_WLAN_2GHZ_CAP) { ++ if (supported_bands & WMI_HOST_WLAN_2GHZ_CAP) { + pdev_cap->tx_chain_mask = le32_to_cpu(mac_caps->tx_chain_mask_2g); + pdev_cap->rx_chain_mask = le32_to_cpu(mac_caps->rx_chain_mask_2g); +- } else if (le32_to_cpu(mac_caps->supported_bands) & WMI_HOST_WLAN_5GHZ_CAP) { ++ } ++ ++ if (supported_bands & WMI_HOST_WLAN_5GHZ_CAP) { + pdev_cap->vht_cap = le32_to_cpu(mac_caps->vht_cap_info_5g); + pdev_cap->vht_mcs = le32_to_cpu(mac_caps->vht_supp_mcs_5g); + pdev_cap->he_mcs = le32_to_cpu(mac_caps->he_supp_mcs_5g); +@@ -548,8 +556,6 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle, + WMI_NSS_RATIO_EN_DIS_GET(mac_caps->nss_ratio); + pdev_cap->nss_ratio_info = + WMI_NSS_RATIO_INFO_GET(mac_caps->nss_ratio); +- } else { +- return -EINVAL; + } + + /* tx/rx chainmask reported from fw depends on the actual hw chains used, +@@ -565,7 +571,7 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle, + pdev_cap->rx_chain_mask_shift = + find_first_bit((unsigned long *)&pdev_cap->rx_chain_mask, 32); + +- if (le32_to_cpu(mac_caps->supported_bands) & WMI_HOST_WLAN_2GHZ_CAP) { ++ if (supported_bands & WMI_HOST_WLAN_2GHZ_CAP) { + cap_band = &pdev_cap->band[NL80211_BAND_2GHZ]; + cap_band->phy_id = le32_to_cpu(mac_caps->phy_id); + cap_band->max_bw_supported = le32_to_cpu(mac_caps->max_bw_supported_2g); +@@ -585,7 +591,7 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle, + le32_to_cpu(mac_caps->he_ppet2g.ppet16_ppet8_ru3_ru0[i]); + } + +- if (le32_to_cpu(mac_caps->supported_bands) & WMI_HOST_WLAN_5GHZ_CAP) { ++ if (supported_bands & WMI_HOST_WLAN_5GHZ_CAP) { + cap_band = &pdev_cap->band[NL80211_BAND_5GHZ]; + cap_band->phy_id = le32_to_cpu(mac_caps->phy_id); + cap_band->max_bw_supported = +-- +2.51.0 + diff --git a/queue-6.19/wifi-ath12k-fix-preferred-hardware-mode-calculation.patch b/queue-6.19/wifi-ath12k-fix-preferred-hardware-mode-calculation.patch new file mode 100644 index 00000000000..a46a3e48550 --- /dev/null +++ b/queue-6.19/wifi-ath12k-fix-preferred-hardware-mode-calculation.patch @@ -0,0 +1,50 @@ +From 1e40cb7cab0515323a52503f594dadf150ce1441 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 15:36:24 +0800 +Subject: wifi: ath12k: fix preferred hardware mode calculation + +From: Baochen Qiang + +[ Upstream commit 7f852de0003219c431a6f2ffd951fd82a4673660 ] + +For single pdev device like WCN7850/QCC2072, preferred_hw_mode is +initialized to WMI_HOST_HW_MODE_SINGLE. Later when firmware sends +supported modes to host, each mode is compared with the initial one +and if the priority of the new mode is higher, update the parameter +and store mode capability. + +For WCN7850, this does not result in issue, as one of the supported +mode indeed has a higher priority. However the only available mode of +QCC2072 at this stage is WMI_HOST_HW_MODE_SINGLE, which fails the +comparison, hence mode capability is not stored. Subsequently driver +initialization fails. + +Fix it by accepting a mode with the same priority. + +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 + +Signed-off-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-4-fc8ce1e43969@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/wmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c +index 3ce5fcb0e4600..12f4d378f50d4 100644 +--- a/drivers/net/wireless/ath/ath12k/wmi.c ++++ b/drivers/net/wireless/ath/ath12k/wmi.c +@@ -4545,7 +4545,7 @@ static int ath12k_wmi_hw_mode_caps(struct ath12k_base *soc, + + pref = soc->wmi_ab.preferred_hw_mode; + +- if (ath12k_hw_mode_pri_map[mode] < ath12k_hw_mode_pri_map[pref]) { ++ if (ath12k_hw_mode_pri_map[mode] <= ath12k_hw_mode_pri_map[pref]) { + svc_rdy_ext->pref_hw_mode_caps = *hw_mode_caps; + soc->wmi_ab.preferred_hw_mode = mode; + } +-- +2.51.0 + diff --git a/queue-6.19/wifi-cfg80211-allow-only-one-nan-interface-also-in-m.patch b/queue-6.19/wifi-cfg80211-allow-only-one-nan-interface-also-in-m.patch new file mode 100644 index 00000000000..eb74e616726 --- /dev/null +++ b/queue-6.19/wifi-cfg80211-allow-only-one-nan-interface-also-in-m.patch @@ -0,0 +1,48 @@ +From 6ad8a64ec3048f507c4c9161dcf999a00ed809cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 13:51:57 +0200 +Subject: wifi: cfg80211: allow only one NAN interface, also in multi radio + +From: Miri Korenblit + +[ Upstream commit e69fda4d07701373354e52b0321bd40311d743d0 ] + +According to Wi-Fi Aware (TM) 4.0 specification 2.8, A NAN device can +have one NAN management interface. This applies also to multi radio +devices. +The current code allows a driver to support more than one NAN interface, +if those are not in the same radio. + +Fix it. + +Reviewed-by: Johannes Berg +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20260107135129.fdaecec0fe8a.I246b5ba6e9da3ec1481ff197e47f6ce0793d7118@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/core.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/net/wireless/core.c b/net/wireless/core.c +index a04f96dc9a1d7..16ccf6fb28b21 100644 +--- a/net/wireless/core.c ++++ b/net/wireless/core.c +@@ -661,12 +661,8 @@ int wiphy_verify_iface_combinations(struct wiphy *wiphy, + c->limits[j].max > 1)) + return -EINVAL; + +- /* Only a single NAN can be allowed, avoid this +- * check for multi-radio global combination, since it +- * hold the capabilities of all radio combinations. +- */ +- if (!combined_radio && +- WARN_ON(types & BIT(NL80211_IFTYPE_NAN) && ++ /* Only a single NAN can be allowed */ ++ if (WARN_ON(types & BIT(NL80211_IFTYPE_NAN) && + c->limits[j].max > 1)) + return -EINVAL; + +-- +2.51.0 + diff --git a/queue-6.19/wifi-cfg80211-treat-deprecated-indoor_sp_ap_old-cont.patch b/queue-6.19/wifi-cfg80211-treat-deprecated-indoor_sp_ap_old-cont.patch new file mode 100644 index 00000000000..c4b47e6e3c8 --- /dev/null +++ b/queue-6.19/wifi-cfg80211-treat-deprecated-indoor_sp_ap_old-cont.patch @@ -0,0 +1,46 @@ +From 54c68e1b940b7da52b6127e4cdbf21ddc201f6c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Jan 2026 16:36:08 +0200 +Subject: wifi: cfg80211: treat deprecated INDOOR_SP_AP_OLD control value as + LPI mode + +From: Pagadala Yesu Anjaneyulu + +[ Upstream commit fd5bfcf430ea2fdbb3e78fd0b82ceb0ab02b72ee ] + +Although value 4 (INDOOR_SP_AP_OLD) is deprecated in IEEE standards, +existing APs may still use this control value. Since this value is +based on the old specification, we cannot trust such APs implement +proper power controls. +Therefore, move IEEE80211_6GHZ_CTRL_REG_INDOOR_SP_AP_OLD case +from SP_AP to LPI_AP power type handling to prevent potential +power limit violations. + +Signed-off-by: Pagadala Yesu Anjaneyulu +Reviewed-by: Johannes Berg +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20260111163601.6b5a36d3601e.I1704ee575fd25edb0d56f48a0a3169b44ef72ad0@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + include/net/cfg80211.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h +index 2900202588a54..39a04776705eb 100644 +--- a/include/net/cfg80211.h ++++ b/include/net/cfg80211.h +@@ -10147,9 +10147,9 @@ cfg80211_6ghz_power_type(u8 control, u32 client_flags) + case IEEE80211_6GHZ_CTRL_REG_LPI_AP: + case IEEE80211_6GHZ_CTRL_REG_INDOOR_LPI_AP: + case IEEE80211_6GHZ_CTRL_REG_AP_ROLE_NOT_RELEVANT: ++ case IEEE80211_6GHZ_CTRL_REG_INDOOR_SP_AP_OLD: + return IEEE80211_REG_LPI_AP; + case IEEE80211_6GHZ_CTRL_REG_SP_AP: +- case IEEE80211_6GHZ_CTRL_REG_INDOOR_SP_AP_OLD: + return IEEE80211_REG_SP_AP; + case IEEE80211_6GHZ_CTRL_REG_VLP_AP: + return IEEE80211_REG_VLP_AP; +-- +2.51.0 + diff --git a/queue-6.19/wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch b/queue-6.19/wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch new file mode 100644 index 00000000000..f257958160b --- /dev/null +++ b/queue-6.19/wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch @@ -0,0 +1,48 @@ +From b6bba25afab274292cf03303614924919b8376d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 19:30:05 +0000 +Subject: wifi: iwlegacy: add missing mutex protection in + il3945_store_measurement() + +From: Ziyi Guo + +[ Upstream commit 4dd1dda65265ecbc9f43ffc08e333684cf715152 ] + +il3945_store_measurement() calls il3945_get_measurement() which internally +calls il_send_cmd_sync() without holding il->mutex. However, +il_send_cmd_sync() has lockdep_assert_held(&il->mutex) indicating that +callers must hold this lock. + +Other sysfs store functions in the same file properly acquire the mutex: +- il3945_store_flags() acquires mutex at 3945-mac.c:3110 +- il3945_store_filter_flags() acquires mutex at 3945-mac.c:3144 + +Add mutex_lock()/mutex_unlock() around the il3945_get_measurement() call +in the sysfs store function to fix the missing lock protection. + +Signed-off-by: Ziyi Guo +Acked-by: Stanislaw Gruszka +Link: https://patch.msgid.link/20260125193005.1090429-1-n7l8m4@u.northwestern.edu +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlegacy/3945-mac.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c +index 104748fcdc33e..54991f31c52c5 100644 +--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c ++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c +@@ -3224,7 +3224,9 @@ il3945_store_measurement(struct device *d, struct device_attribute *attr, + + D_INFO("Invoking measurement of type %d on " "channel %d (for '%s')\n", + type, params.channel, buf); ++ mutex_lock(&il->mutex); + il3945_get_measurement(il, ¶ms, type); ++ mutex_unlock(&il->mutex); + + return count; + } +-- +2.51.0 + diff --git a/queue-6.19/wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch b/queue-6.19/wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch new file mode 100644 index 00000000000..9fc407dea59 --- /dev/null +++ b/queue-6.19/wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch @@ -0,0 +1,49 @@ +From 65c87c000d6c438f88310c5f2b9c12687324bb4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 19:40:39 +0000 +Subject: wifi: iwlegacy: add missing mutex protection in + il4965_store_tx_power() + +From: Ziyi Guo + +[ Upstream commit e31fa691d0b1c07b6094a6cf0cce894192c462b3 ] + +il4965_store_tx_power() calls il_set_tx_power() without holding il->mutex. +However, il_set_tx_power() has lockdep_assert_held(&il->mutex) indicating +that callers must hold this lock. + +All other callers of il_set_tx_power() properly acquire the mutex: +- il_bg_scan_completed() acquires mutex at common.c:1683 +- il_mac_config() acquires mutex at common.c:5006 +- il3945_commit_rxon() and il4965_commit_rxon() are called via work + queues that hold the mutex (like il4965_bg_alive_start) + +Add mutex_lock()/mutex_unlock() around the il_set_tx_power() call in +the sysfs store function to fix the missing lock protection. + +Signed-off-by: Ziyi Guo +Acked-by: Stanislaw Gruszka +Link: https://patch.msgid.link/20260125194039.1196488-1-n7l8m4@u.northwestern.edu +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c +index 3588dec75ebdd..57fa866efd9f8 100644 +--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c ++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c +@@ -4606,7 +4606,9 @@ il4965_store_tx_power(struct device *d, struct device_attribute *attr, + if (ret) + IL_INFO("%s is not in decimal form.\n", buf); + else { ++ mutex_lock(&il->mutex); + ret = il_set_tx_power(il, val, false); ++ mutex_unlock(&il->mutex); + if (ret) + IL_ERR("failed setting tx power (0x%08x).\n", ret); + else +-- +2.51.0 + diff --git a/queue-6.19/wifi-iwlwifi-fix-22000-series-smem-parsing.patch b/queue-6.19/wifi-iwlwifi-fix-22000-series-smem-parsing.patch new file mode 100644 index 00000000000..d8d2308b650 --- /dev/null +++ b/queue-6.19/wifi-iwlwifi-fix-22000-series-smem-parsing.patch @@ -0,0 +1,58 @@ +From 0af4dbb34fc4ea3898e3c6997d6ff198c92cd7ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 15:02:19 +0200 +Subject: wifi: iwlwifi: fix 22000 series SMEM parsing + +From: Johannes Berg + +[ Upstream commit 58192b9ce09b0f0f86e2036683bd542130b91a98 ] + +If the firmware were to report three LMACs (which doesn't +exist in hardware) then using "fwrt->smem_cfg.lmac[2]" is +an overrun of the array. Reject such and use IWL_FW_CHECK +instead of WARN_ON in this function. + +Signed-off-by: Johannes Berg +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20251110150012.16e8c2d70c26.Iadfcc1aedf43c5175b3f0757bea5aa232454f1ac@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/fw/smem.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/smem.c b/drivers/net/wireless/intel/iwlwifi/fw/smem.c +index 90fd69b4860c1..344ddde85b189 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/smem.c ++++ b/drivers/net/wireless/intel/iwlwifi/fw/smem.c +@@ -6,6 +6,7 @@ + */ + #include "iwl-drv.h" + #include "runtime.h" ++#include "dbg.h" + #include "fw/api/commands.h" + + static void iwl_parse_shared_mem_22000(struct iwl_fw_runtime *fwrt, +@@ -17,7 +18,9 @@ static void iwl_parse_shared_mem_22000(struct iwl_fw_runtime *fwrt, + u8 api_ver = iwl_fw_lookup_notif_ver(fwrt->fw, SYSTEM_GROUP, + SHARED_MEM_CFG_CMD, 0); + +- if (WARN_ON(lmac_num > ARRAY_SIZE(mem_cfg->lmac_smem))) ++ /* Note: notification has 3 entries, but we only expect 2 */ ++ if (IWL_FW_CHECK(fwrt, lmac_num > ARRAY_SIZE(fwrt->smem_cfg.lmac), ++ "FW advertises %d LMACs\n", lmac_num)) + return; + + fwrt->smem_cfg.num_lmacs = lmac_num; +@@ -26,7 +29,8 @@ static void iwl_parse_shared_mem_22000(struct iwl_fw_runtime *fwrt, + fwrt->smem_cfg.rxfifo2_size = le32_to_cpu(mem_cfg->rxfifo2_size); + + if (api_ver >= 4 && +- !WARN_ON_ONCE(iwl_rx_packet_payload_len(pkt) < sizeof(*mem_cfg))) { ++ !IWL_FW_CHECK(fwrt, iwl_rx_packet_payload_len(pkt) < sizeof(*mem_cfg), ++ "bad shared mem notification size\n")) { + fwrt->smem_cfg.rxfifo2_control_size = + le32_to_cpu(mem_cfg->rxfifo2_control_size); + } +-- +2.51.0 + diff --git a/queue-6.19/wifi-iwlwifi-mld-fix-chandef-start-calculation.patch b/queue-6.19/wifi-iwlwifi-mld-fix-chandef-start-calculation.patch new file mode 100644 index 00000000000..3cd973f2ae7 --- /dev/null +++ b/queue-6.19/wifi-iwlwifi-mld-fix-chandef-start-calculation.patch @@ -0,0 +1,49 @@ +From 4ee069cd4011b97b58abc804247ff25c8ff17dbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Jan 2026 19:39:12 +0200 +Subject: wifi: iwlwifi: mld: fix chandef start calculation + +From: Miri Korenblit + +[ Upstream commit d2fcdf36554316cc51f7928b777944738d06e332 ] + +A link pair in which both links are in 5 GHz can be used for EMLSR only +if they are separated enough. + +To check this condition we calculate the start and the end of the +chandefs of both links in the pair and do some checks. + +But the calculation of the start/end of the chandef is currently done +by subtracting/adding half the bandwidth from/to the control channel's +center frequency, when it should really be subtracted/added from/to the +center frequency of the entire chandef. + +Fix the wrong calculation. + +Reviewed-by: Johannes Berg +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20260111193638.2138fdb99bd5.I4d2e5957b22482a57b1d6ca444e90fcf73bf2cab@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mld/mlo.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mlo.c b/drivers/net/wireless/intel/iwlwifi/mld/mlo.c +index c6b151f269216..1efefc737248f 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mld/mlo.c ++++ b/drivers/net/wireless/intel/iwlwifi/mld/mlo.c +@@ -844,9 +844,9 @@ iwl_mld_emlsr_pair_state(struct ieee80211_vif *vif, + if (c_low->chan->center_freq > c_high->chan->center_freq) + swap(c_low, c_high); + +- c_low_upper_edge = c_low->chan->center_freq + ++ c_low_upper_edge = c_low->center_freq1 + + cfg80211_chandef_get_width(c_low) / 2; +- c_high_lower_edge = c_high->chan->center_freq - ++ c_high_lower_edge = c_high->center_freq1 - + cfg80211_chandef_get_width(c_high) / 2; + + if (a->chandef->chan->band == NL80211_BAND_5GHZ && +-- +2.51.0 + diff --git a/queue-6.19/wifi-iwlwifi-mld-fix-primary-link-selection-logic.patch b/queue-6.19/wifi-iwlwifi-mld-fix-primary-link-selection-logic.patch new file mode 100644 index 00000000000..ae4d0bafd4e --- /dev/null +++ b/queue-6.19/wifi-iwlwifi-mld-fix-primary-link-selection-logic.patch @@ -0,0 +1,93 @@ +From 6dc4ff671ced6e93af3ead6d83ad07b120b15468 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Jan 2026 19:39:14 +0200 +Subject: wifi: iwlwifi: mld: Fix primary link selection logic + +From: Nidhish A N + +[ Upstream commit 7a749db26cab2334d5b356ac31e6f1147c7682da ] + +When assigning emlsr.primary with emlsr.selected_primary +we are checking if BIT(mld_vif->emlsr.selected_links) are +a part of vif->active_links. This is incorrect as +emlsr.selected_links is a bitmap of possibly two selected links. +Therefore, performing the BIT() operation on it does not +yield any meaningful result and almost always leads to +incorrect primary link selection. + +Additionally, we cannot rely on vif->active_links at this +stage of the link switch flow because it contains both the +removed links and also the newly added links. +For example, if we had selected links in the past (0x11) +and we now select links because of TTLM/debugfs (0x100), +vif->active_links will now be (0x111) and primary link +will be 0, while 0 is not even an active link. Thus, +we create our own bitmap of final active links. + +Signed-off-by: Nidhish A N +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20260111193638.38b2e14e3a20.Ie81a88dfff0c5d2becedabab8398702808f6b1bf@changeid +Signed-off-by: Sasha Levin +--- + .../net/wireless/intel/iwlwifi/mld/mac80211.c | 23 ++++++++++++------- + 1 file changed, 15 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c +index cd0dce8de8569..3a1b5bfb9ed66 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c +@@ -984,7 +984,9 @@ int iwl_mld_assign_vif_chanctx(struct ieee80211_hw *hw, + { + struct iwl_mld *mld = IWL_MAC80211_GET_MLD(hw); + struct iwl_mld_link *mld_link = iwl_mld_link_from_mac80211(link); +- unsigned int n_active = iwl_mld_count_active_links(mld, vif); ++ struct iwl_mld_link *temp_mld_link; ++ struct iwl_mld_vif *mld_vif = iwl_mld_vif_from_mac80211(vif); ++ u16 final_active_links = 0; + int ret; + + lockdep_assert_wiphy(mld->wiphy); +@@ -992,10 +994,7 @@ int iwl_mld_assign_vif_chanctx(struct ieee80211_hw *hw, + if (WARN_ON(!mld_link)) + return -EINVAL; + +- /* if the assigned one was not counted yet, count it now */ + if (!rcu_access_pointer(mld_link->chan_ctx)) { +- n_active++; +- + /* Track addition of non-BSS link */ + if (ieee80211_vif_type_p2p(vif) != NL80211_IFTYPE_STATION) { + ret = iwl_mld_emlsr_check_non_bss_block(mld, 1); +@@ -1016,17 +1015,25 @@ int iwl_mld_assign_vif_chanctx(struct ieee80211_hw *hw, + + rcu_assign_pointer(mld_link->chan_ctx, ctx); + +- if (n_active > 1) { +- struct iwl_mld_vif *mld_vif = iwl_mld_vif_from_mac80211(vif); ++ /* We cannot rely on vif->active_links at this stage as it contains ++ * both the removed links and the newly added links. ++ * Therefore, we create our own bitmap of the final active links, ++ * which does not include the removed links. ++ */ ++ for_each_mld_vif_valid_link(mld_vif, temp_mld_link) { ++ if (rcu_access_pointer(temp_mld_link->chan_ctx)) ++ final_active_links |= BIT(link_id); ++ } + ++ if (hweight16(final_active_links) > 1) { + /* Indicate to mac80211 that EML is enabled */ + vif->driver_flags |= IEEE80211_VIF_EML_ACTIVE; + mld_vif->emlsr.last_entry_ts = jiffies; + +- if (vif->active_links & BIT(mld_vif->emlsr.selected_links)) ++ if (final_active_links == mld_vif->emlsr.selected_links) + mld_vif->emlsr.primary = mld_vif->emlsr.selected_primary; + else +- mld_vif->emlsr.primary = __ffs(vif->active_links); ++ mld_vif->emlsr.primary = __ffs(final_active_links); + + iwl_dbg_tlv_time_point(&mld->fwrt, IWL_FW_INI_TIME_ESR_LINK_UP, + NULL); +-- +2.51.0 + diff --git a/queue-6.19/wifi-iwlwifi-mld-handle-rate-selection-for-nan-inter.patch b/queue-6.19/wifi-iwlwifi-mld-handle-rate-selection-for-nan-inter.patch new file mode 100644 index 00000000000..614e5f575a9 --- /dev/null +++ b/queue-6.19/wifi-iwlwifi-mld-handle-rate-selection-for-nan-inter.patch @@ -0,0 +1,40 @@ +From bc615a15ce4812471f398ce44424cee4a9e5f579 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 18:08:46 +0200 +Subject: wifi: iwlwifi: mld: Handle rate selection for NAN interface + +From: Ilan Peer + +[ Upstream commit dbbeebece03050cd510073ce89fee83844e06b00 ] + +Frames transmitted over a NAN interface might not have channel +information assigned to them. In such cases assign the lowest +OFDM to the frame. + +Signed-off-by: Ilan Peer +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20251110180612.72046f98f878.Ib784931fffd0747acd9d7bb22eabbbec5282733e@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mld/tx.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mld/tx.c b/drivers/net/wireless/intel/iwlwifi/mld/tx.c +index 3b4b575aadaa5..e3fb4fc4f452e 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mld/tx.c ++++ b/drivers/net/wireless/intel/iwlwifi/mld/tx.c +@@ -345,6 +345,11 @@ u8 iwl_mld_get_lowest_rate(struct iwl_mld *mld, + + iwl_mld_get_basic_rates_and_band(mld, vif, info, &basic_rates, &band); + ++ if (band >= NUM_NL80211_BANDS) { ++ WARN_ON(vif->type != NL80211_IFTYPE_NAN); ++ return IWL_FIRST_OFDM_RATE; ++ } ++ + sband = mld->hw->wiphy->bands[band]; + for_each_set_bit(i, &basic_rates, BITS_PER_LONG) { + u16 hw = sband->bitrates[i].hw_value; +-- +2.51.0 + diff --git a/queue-6.19/wifi-iwlwifi-mvm-check-the-validity-of-noa_len.patch b/queue-6.19/wifi-iwlwifi-mvm-check-the-validity-of-noa_len.patch new file mode 100644 index 00000000000..59e41d3ce81 --- /dev/null +++ b/queue-6.19/wifi-iwlwifi-mvm-check-the-validity-of-noa_len.patch @@ -0,0 +1,48 @@ +From 21aecc172c81faf6597b90a491519ffc0a31d5db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 15:02:15 +0200 +Subject: wifi: iwlwifi: mvm: check the validity of noa_len + +From: Miri Korenblit + +[ Upstream commit 1e3fb3c4a8e6c581d0f4533dba887fabf53d607d ] + +Validate iwl_probe_resp_data_notif::noa_attr::len_low since we are using +its value to determine the noa_len, which is later used for the NoA +attribute. + +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20251110150012.99b663d9b424.I206fd54c990ca9e1160b9b94fa8be44e67bcc1b9@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c +index 867807abde664..49ffc4ecee855 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c +@@ -1761,6 +1761,20 @@ void iwl_mvm_probe_resp_data_notif(struct iwl_mvm *mvm, + + mvmvif = iwl_mvm_vif_from_mac80211(vif); + ++ /* ++ * len_low should be 2 + n*13 (where n is the number of descriptors. ++ * 13 is the size of a NoA descriptor). We can have either one or two ++ * descriptors. ++ */ ++ if (IWL_FW_CHECK(mvm, notif->noa_active && ++ notif->noa_attr.len_low != 2 + ++ sizeof(struct ieee80211_p2p_noa_desc) && ++ notif->noa_attr.len_low != 2 + ++ sizeof(struct ieee80211_p2p_noa_desc) * 2, ++ "Invalid noa_attr.len_low (%d)\n", ++ notif->noa_attr.len_low)) ++ return; ++ + new_data = kzalloc(sizeof(*new_data), GFP_KERNEL); + if (!new_data) + return; +-- +2.51.0 + diff --git a/queue-6.19/wifi-libertas-fix-warning-in-usb_tx_block.patch b/queue-6.19/wifi-libertas-fix-warning-in-usb_tx_block.patch new file mode 100644 index 00000000000..36b6f02e1c1 --- /dev/null +++ b/queue-6.19/wifi-libertas-fix-warning-in-usb_tx_block.patch @@ -0,0 +1,44 @@ +From 8b774c393e0445dc057b25dbaaad6baf8959de6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Dec 2025 16:58:06 +0100 +Subject: wifi: libertas: fix WARNING in usb_tx_block + +From: Szymon Wilczek + +[ Upstream commit d66676e6ca96bf8680f869a9bd6573b26c634622 ] + +The function usb_tx_block() submits cardp->tx_urb without ensuring that +any previous transmission on this URB has completed. If a second call +occurs while the URB is still active (e.g. during rapid firmware loading), +usb_submit_urb() detects the active state and triggers a warning: +'URB submitted while active'. + +Fix this by enforcing serialization: call usb_kill_urb() before +submitting the new request. This ensures the URB is idle and safe to reuse. + +Reported-by: syzbot+67969ab6a2551c27f71b@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=67969ab6a2551c27f71b +Signed-off-by: Szymon Wilczek +Link: https://patch.msgid.link/20251221155806.23925-1-swilczek.lx@gmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/libertas/if_usb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c +index b3c4040257a67..924ab93b7b671 100644 +--- a/drivers/net/wireless/marvell/libertas/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas/if_usb.c +@@ -426,6 +426,8 @@ static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload, uint16_t nb + goto tx_ret; + } + ++ usb_kill_urb(cardp->tx_urb); ++ + usb_fill_bulk_urb(cardp->tx_urb, cardp->udev, + usb_sndbulkpipe(cardp->udev, + cardp->ep_out), +-- +2.51.0 + diff --git a/queue-6.19/wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch b/queue-6.19/wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch new file mode 100644 index 00000000000..511dc8cbef8 --- /dev/null +++ b/queue-6.19/wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch @@ -0,0 +1,86 @@ +From 57f89ac7ac8e1f53a8eac951620af75f34871ee3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Nov 2025 16:50:31 +0200 +Subject: wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() + +From: Bitterblue Smith + +[ Upstream commit 44d1f624bbdd2d60319374ba85f7195a28d00c90 ] + +rtw8822b_set_antenna() can be called from userspace when the chip is +powered off. In that case a WARNING is triggered in +rtw8822b_config_trx_mode() because trying to read the RF registers +when the chip is powered off returns an unexpected value. + +Call rtw8822b_config_trx_mode() in rtw8822b_set_antenna() only when +the chip is powered on. + +------------[ cut here ]------------ +write RF mode table fail +WARNING: CPU: 0 PID: 7183 at rtw8822b.c:824 rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b] +CPU: 0 UID: 0 PID: 7183 Comm: iw Tainted: G W OE 6.17.5-arch1-1 #1 PREEMPT(full) 01c39fc421df2af799dd5e9180b572af860b40c1 +Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE +Hardware name: LENOVO 82KR/LNVNB161216, BIOS HBCN18WW 08/27/2021 +RIP: 0010:rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b] +Call Trace: + + rtw8822b_set_antenna+0x57/0x70 [rtw88_8822b 370206f42e5890d8d5f48eb358b759efa37c422b] + rtw_ops_set_antenna+0x50/0x80 [rtw88_core 711c8fb4f686162be4625b1d0b8e8c6a5ac850fb] + ieee80211_set_antenna+0x60/0x100 [mac80211 f1845d85d2ecacf3b71867635a050ece90486cf3] + nl80211_set_wiphy+0x384/0xe00 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] + ? netdev_run_todo+0x63/0x550 + genl_family_rcv_msg_doit+0xfc/0x160 + genl_rcv_msg+0x1aa/0x2b0 + ? __pfx_nl80211_pre_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] + ? __pfx_nl80211_set_wiphy+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] + ? __pfx_nl80211_post_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] + ? __pfx_genl_rcv_msg+0x10/0x10 + netlink_rcv_skb+0x59/0x110 + genl_rcv+0x28/0x40 + netlink_unicast+0x285/0x3c0 + ? __alloc_skb+0xdb/0x1a0 + netlink_sendmsg+0x20d/0x430 + ____sys_sendmsg+0x39f/0x3d0 + ? import_iovec+0x2f/0x40 + ___sys_sendmsg+0x99/0xe0 + ? refill_obj_stock+0x12e/0x240 + __sys_sendmsg+0x8a/0xf0 + do_syscall_64+0x81/0x970 + ? do_syscall_64+0x81/0x970 + ? ksys_read+0x73/0xf0 + ? do_syscall_64+0x81/0x970 + ? count_memcg_events+0xc2/0x190 + ? handle_mm_fault+0x1d7/0x2d0 + ? do_user_addr_fault+0x21a/0x690 + ? exc_page_fault+0x7e/0x1a0 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +---[ end trace 0000000000000000 ]--- + +Link: https://github.com/lwfinger/rtw88/issues/366 +Signed-off-by: Bitterblue Smith +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/fb9a3444-9319-4aa2-8719-35a6308bf568@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/rtw8822b.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822b.c b/drivers/net/wireless/realtek/rtw88/rtw8822b.c +index 89b6485b229a8..4d88cc2f41485 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c ++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c +@@ -1005,7 +1005,8 @@ static int rtw8822b_set_antenna(struct rtw_dev *rtwdev, + hal->antenna_tx = antenna_tx; + hal->antenna_rx = antenna_rx; + +- rtw8822b_config_trx_mode(rtwdev, antenna_tx, antenna_rx, false); ++ if (test_bit(RTW_FLAG_POWERON, rtwdev->flags)) ++ rtw8822b_config_trx_mode(rtwdev, antenna_tx, antenna_rx, false); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.19/wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch b/queue-6.19/wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch new file mode 100644 index 00000000000..80208e0e840 --- /dev/null +++ b/queue-6.19/wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch @@ -0,0 +1,65 @@ +From 7660e964b07b7801b83beb2423e947d6bbe40267 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 23:09:37 +0500 +Subject: wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero + +From: Roman Peshkichev + +[ Upstream commit 9f68fdcdc9dbf21be2a48feced90ff7f77d07443 ] + +The function rtw_set_dtim_period() accepted an 'int' dtim_period parameter, +while mac80211 provides dtim_period as 'u8' in struct ieee80211_bss_conf. +In IBSS (ad-hoc) mode mac80211 may set dtim_period to 0. + +The driver unconditionally wrote (dtim_period - 1) to +REG_DTIM_COUNTER_ROOT, which resulted in 0xFF when dtim_period was 0. This +caused delays in broadcast/multicast traffic processing and issues with +ad-hoc operation. + +Convert the function parameter to u8 to match ieee80211_bss_conf and avoid +the underflow by writing 0 when dtim_period is 0. + +Link: https://github.com/lwfinger/rtw88/issues/406 +Signed-off-by: Roman Peshkichev +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20251125180937.22977-1-roman.peshkichev@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/main.c | 4 ++-- + drivers/net/wireless/realtek/rtw88/main.h | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c +index d93d21656f26c..f72d12c3b2bc6 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.c ++++ b/drivers/net/wireless/realtek/rtw88/main.c +@@ -730,10 +730,10 @@ void rtw_set_rx_freq_band(struct rtw_rx_pkt_stat *pkt_stat, u8 channel) + } + EXPORT_SYMBOL(rtw_set_rx_freq_band); + +-void rtw_set_dtim_period(struct rtw_dev *rtwdev, int dtim_period) ++void rtw_set_dtim_period(struct rtw_dev *rtwdev, u8 dtim_period) + { + rtw_write32_set(rtwdev, REG_TCR, BIT_TCR_UPDATE_TIMIE); +- rtw_write8(rtwdev, REG_DTIM_COUNTER_ROOT, dtim_period - 1); ++ rtw_write8(rtwdev, REG_DTIM_COUNTER_ROOT, dtim_period ? dtim_period - 1 : 0); + } + + void rtw_update_channel(struct rtw_dev *rtwdev, u8 center_channel, +diff --git a/drivers/net/wireless/realtek/rtw88/main.h b/drivers/net/wireless/realtek/rtw88/main.h +index 43ed6d6b42919..1ab70214ce36e 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.h ++++ b/drivers/net/wireless/realtek/rtw88/main.h +@@ -2226,7 +2226,7 @@ enum nl80211_band rtw_hw_to_nl80211_band(enum rtw_supported_band hw_band) + } + + void rtw_set_rx_freq_band(struct rtw_rx_pkt_stat *pkt_stat, u8 channel); +-void rtw_set_dtim_period(struct rtw_dev *rtwdev, int dtim_period); ++void rtw_set_dtim_period(struct rtw_dev *rtwdev, u8 dtim_period); + void rtw_get_channel_params(struct cfg80211_chan_def *chandef, + struct rtw_channel_params *ch_param); + bool check_hw_ready(struct rtw_dev *rtwdev, u32 addr, u32 mask, u32 target); +-- +2.51.0 + diff --git a/queue-6.19/wifi-rtw88-fix-inadvertent-sharing-of-struct-ieee802.patch b/queue-6.19/wifi-rtw88-fix-inadvertent-sharing-of-struct-ieee802.patch new file mode 100644 index 00000000000..7fffa296669 --- /dev/null +++ b/queue-6.19/wifi-rtw88-fix-inadvertent-sharing-of-struct-ieee802.patch @@ -0,0 +1,92 @@ +From cbe44e0b36477f64deb62151ba80090338e93859 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Dec 2025 01:26:45 +0200 +Subject: wifi: rtw88: Fix inadvertent sharing of struct + ieee80211_supported_band data + +From: Bitterblue Smith + +[ Upstream commit fcac0f23d4d20b11014a39f8e2527cdc12ec9c82 ] + +Internally wiphy writes to individual channels in this structure, +so we must not share one static definition of channel list between +multiple device instances, because that causes hard to debug +breakage. + +For example, with two rtw88 driven devices in the system, channel +information may get incoherent, preventing channel use. + +Copied from commit 0ae36391c804 ("wifi: rtw89: Fix inadverent sharing +of struct ieee80211_supported_band data"). + +Signed-off-by: Bitterblue Smith +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/e94ad653-2b6d-4284-a33c-8c694f88955b@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/main.c | 34 +++++++++++++++++++---- + 1 file changed, 29 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c +index 6f35357e73246..dde2ea6a00e06 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.c ++++ b/drivers/net/wireless/realtek/rtw88/main.c +@@ -1658,16 +1658,41 @@ static u16 rtw_get_max_scan_ie_len(struct rtw_dev *rtwdev) + return len; + } + ++static struct ieee80211_supported_band * ++rtw_sband_dup(struct rtw_dev *rtwdev, ++ const struct ieee80211_supported_band *sband) ++{ ++ struct ieee80211_supported_band *dup; ++ ++ dup = devm_kmemdup(rtwdev->dev, sband, sizeof(*sband), GFP_KERNEL); ++ if (!dup) ++ return NULL; ++ ++ dup->channels = devm_kmemdup_array(rtwdev->dev, sband->channels, ++ sband->n_channels, ++ sizeof(*sband->channels), ++ GFP_KERNEL); ++ if (!dup->channels) ++ return NULL; ++ ++ dup->bitrates = devm_kmemdup_array(rtwdev->dev, sband->bitrates, ++ sband->n_bitrates, ++ sizeof(*sband->bitrates), ++ GFP_KERNEL); ++ if (!dup->bitrates) ++ return NULL; ++ ++ return dup; ++} ++ + static void rtw_set_supported_band(struct ieee80211_hw *hw, + const struct rtw_chip_info *chip) + { + struct ieee80211_supported_band *sband; + struct rtw_dev *rtwdev = hw->priv; +- struct device *dev = rtwdev->dev; + + if (chip->band & RTW_BAND_2G) { +- sband = devm_kmemdup(dev, &rtw_band_2ghz, sizeof(*sband), +- GFP_KERNEL); ++ sband = rtw_sband_dup(rtwdev, &rtw_band_2ghz); + if (!sband) + goto err_out; + if (chip->ht_supported) +@@ -1676,8 +1701,7 @@ static void rtw_set_supported_band(struct ieee80211_hw *hw, + } + + if (chip->band & RTW_BAND_5G) { +- sband = devm_kmemdup(dev, &rtw_band_5ghz, sizeof(*sband), +- GFP_KERNEL); ++ sband = rtw_sband_dup(rtwdev, &rtw_band_5ghz); + if (!sband) + goto err_out; + if (chip->ht_supported) +-- +2.51.0 + diff --git a/queue-6.19/wifi-rtw88-rtw8821cu-add-id-for-mercusys-mu6h.patch b/queue-6.19/wifi-rtw88-rtw8821cu-add-id-for-mercusys-mu6h.patch new file mode 100644 index 00000000000..e6b019dc9af --- /dev/null +++ b/queue-6.19/wifi-rtw88-rtw8821cu-add-id-for-mercusys-mu6h.patch @@ -0,0 +1,37 @@ +From efe135cf16d1f55071e1ef590e7f7b695e7ab0da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 08:32:04 +0800 +Subject: wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H + +From: Hsiu-Ming Chang + +[ Upstream commit 77653c327e11c71c5363b18a53fbf2b92ed21da4 ] + +Add support for Mercusys MU6H AC650 High Gain Wireless Dual Band USB +Adapter V1.30. It is based on RTL8811CU, usb device ID is 2c4e:0105. + +Signed-off-by: Hsiu-Ming Chang +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20251205003245.5762-1-cges30901@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/rtw8821cu.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8821cu.c b/drivers/net/wireless/realtek/rtw88/rtw8821cu.c +index 7a0fffc359e25..8cd09d66655db 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8821cu.c ++++ b/drivers/net/wireless/realtek/rtw88/rtw8821cu.c +@@ -37,6 +37,8 @@ static const struct usb_device_id rtw_8821cu_id_table[] = { + .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Edimax */ + { USB_DEVICE_AND_INTERFACE_INFO(0x7392, 0xd811, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Edimax */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2c4e, 0x0105, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Mercusys */ + {}, + }; + MODULE_DEVICE_TABLE(usb, rtw_8821cu_id_table); +-- +2.51.0 + diff --git a/queue-6.19/wifi-rtw88-use-devm_kmemdup-in-rtw_set_supported_ban.patch b/queue-6.19/wifi-rtw88-use-devm_kmemdup-in-rtw_set_supported_ban.patch new file mode 100644 index 00000000000..dc5065f662c --- /dev/null +++ b/queue-6.19/wifi-rtw88-use-devm_kmemdup-in-rtw_set_supported_ban.patch @@ -0,0 +1,84 @@ +From c91cb9409e7ab3e537eed73d608cd9db7dfbc7b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Dec 2025 01:25:32 +0200 +Subject: wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() + +From: Bitterblue Smith + +[ Upstream commit 2ba12401cc1f2d970fa2e7d5b15abde3f5abd40d ] + +Simplify the code by using device managed memory allocations. + +This also fixes a memory leak in rtw_register_hw(). The supported bands +were not freed in the error path. + +Copied from commit 145df52a8671 ("wifi: rtw89: Convert +rtw89_core_set_supported_band to use devm_*"). + +Signed-off-by: Bitterblue Smith +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/1aa7fdef-2d5b-4a31-a4e9-fac8257ed30d@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/main.c | 19 ++++++------------- + 1 file changed, 6 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c +index f72d12c3b2bc6..6f35357e73246 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.c ++++ b/drivers/net/wireless/realtek/rtw88/main.c +@@ -1661,11 +1661,13 @@ static u16 rtw_get_max_scan_ie_len(struct rtw_dev *rtwdev) + static void rtw_set_supported_band(struct ieee80211_hw *hw, + const struct rtw_chip_info *chip) + { +- struct rtw_dev *rtwdev = hw->priv; + struct ieee80211_supported_band *sband; ++ struct rtw_dev *rtwdev = hw->priv; ++ struct device *dev = rtwdev->dev; + + if (chip->band & RTW_BAND_2G) { +- sband = kmemdup(&rtw_band_2ghz, sizeof(*sband), GFP_KERNEL); ++ sband = devm_kmemdup(dev, &rtw_band_2ghz, sizeof(*sband), ++ GFP_KERNEL); + if (!sband) + goto err_out; + if (chip->ht_supported) +@@ -1674,7 +1676,8 @@ static void rtw_set_supported_band(struct ieee80211_hw *hw, + } + + if (chip->band & RTW_BAND_5G) { +- sband = kmemdup(&rtw_band_5ghz, sizeof(*sband), GFP_KERNEL); ++ sband = devm_kmemdup(dev, &rtw_band_5ghz, sizeof(*sband), ++ GFP_KERNEL); + if (!sband) + goto err_out; + if (chip->ht_supported) +@@ -1690,13 +1693,6 @@ static void rtw_set_supported_band(struct ieee80211_hw *hw, + rtw_err(rtwdev, "failed to set supported band\n"); + } + +-static void rtw_unset_supported_band(struct ieee80211_hw *hw, +- const struct rtw_chip_info *chip) +-{ +- kfree(hw->wiphy->bands[NL80211_BAND_2GHZ]); +- kfree(hw->wiphy->bands[NL80211_BAND_5GHZ]); +-} +- + static void rtw_vif_smps_iter(void *data, u8 *mac, + struct ieee80211_vif *vif) + { +@@ -2320,10 +2316,7 @@ EXPORT_SYMBOL(rtw_register_hw); + + void rtw_unregister_hw(struct rtw_dev *rtwdev, struct ieee80211_hw *hw) + { +- const struct rtw_chip_info *chip = rtwdev->chip; +- + ieee80211_unregister_hw(hw); +- rtw_unset_supported_band(hw, chip); + rtw_debugfs_deinit(rtwdev); + rtw_led_deinit(rtwdev); + } +-- +2.51.0 + diff --git a/queue-6.19/wifi-rtw89-8852au-add-support-for-tp-tx30u-plus.patch b/queue-6.19/wifi-rtw89-8852au-add-support-for-tp-tx30u-plus.patch new file mode 100644 index 00000000000..8e01bfceac2 --- /dev/null +++ b/queue-6.19/wifi-rtw89-8852au-add-support-for-tp-tx30u-plus.patch @@ -0,0 +1,38 @@ +From ef604aebe2760987c95f8e9003a6984927fbe01a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Dec 2025 01:54:21 +0100 +Subject: wifi: rtw89: 8852au: add support for TP TX30U Plus + +From: Jan Gerber + +[ Upstream commit a2f1fc9ab6fb0d5c9d701a516c342944258fb20e ] + +the device shows up like this and everything seams to work: + +Bus 004 Device 003: ID 3625:010d Realtek 802.11ax WLAN Adapter + +Signed-off-by: Jan Gerber +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20251212005515.2059533-1-j@mailb.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/rtw8852au.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852au.c b/drivers/net/wireless/realtek/rtw89/rtw8852au.c +index ca782469c455d..74a976c984ad8 100644 +--- a/drivers/net/wireless/realtek/rtw89/rtw8852au.c ++++ b/drivers/net/wireless/realtek/rtw89/rtw8852au.c +@@ -60,6 +60,8 @@ static const struct usb_device_id rtw_8852au_id_table[] = { + .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x0141, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3625, 0x010d, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3625, 0x010f, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, + {}, +-- +2.51.0 + diff --git a/queue-6.19/wifi-rtw89-8922a-add-digital-compensation-for-2ghz.patch b/queue-6.19/wifi-rtw89-8922a-add-digital-compensation-for-2ghz.patch new file mode 100644 index 00000000000..37f9d50a799 --- /dev/null +++ b/queue-6.19/wifi-rtw89-8922a-add-digital-compensation-for-2ghz.patch @@ -0,0 +1,123 @@ +From f16a7d0f5707370052c5a2fe81c527cdfb80f666 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jan 2026 12:41:57 +0800 +Subject: wifi: rtw89: 8922a: add digital compensation for 2GHz + +From: Po-Hao Huang + +[ Upstream commit 8da7e88682d58a7c2e2c2101e49d3c9c9ac481b0 ] + +This fixes transmit power too low under 2GHz connection. Previously +we missed the settings of 2GHz, add the according calibrated tables. + +Signed-off-by: Po-Hao Huang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260117044157.2392958-10-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/rtw8922a.c | 57 +++++++++++++++---- + 1 file changed, 47 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922a.c b/drivers/net/wireless/realtek/rtw89/rtw8922a.c +index 4bcf20612a455..52da0fa02da01 100644 +--- a/drivers/net/wireless/realtek/rtw89/rtw8922a.c ++++ b/drivers/net/wireless/realtek/rtw89/rtw8922a.c +@@ -1770,6 +1770,32 @@ static int rtw8922a_ctrl_rx_path_tmac(struct rtw89_dev *rtwdev, + } + + #define DIGITAL_PWR_COMP_REG_NUM 22 ++static const u32 rtw8922a_digital_pwr_comp_2g_s0_val[][DIGITAL_PWR_COMP_REG_NUM] = { ++ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320, ++ 0x0D05091D, 0x14D50FA0, 0x00000000, 0x01010000, 0x00000101, ++ 0x01010101, 0x02020201, 0x02010000, 0x03030202, 0x00000303, ++ 0x03020101, 0x06060504, 0x01010000, 0x06050403, 0x01000606, ++ 0x05040202, 0x07070706}, ++ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320, ++ 0x0D05091D, 0x14D50FA0, 0x00000000, 0x01010100, 0x00000101, ++ 0x01000000, 0x01010101, 0x01010000, 0x02020202, 0x00000404, ++ 0x03020101, 0x04040303, 0x02010000, 0x03030303, 0x00000505, ++ 0x03030201, 0x05050303}, ++}; ++ ++static const u32 rtw8922a_digital_pwr_comp_2g_s1_val[][DIGITAL_PWR_COMP_REG_NUM] = { ++ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320, ++ 0x0D05091D, 0x14D50FA0, 0x01010000, 0x01010101, 0x00000101, ++ 0x01010100, 0x01010101, 0x01010000, 0x02020202, 0x01000202, ++ 0x02020101, 0x03030202, 0x02010000, 0x05040403, 0x01000606, ++ 0x05040302, 0x07070605}, ++ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320, ++ 0x0D05091D, 0x14D50FA0, 0x00000000, 0x01010100, 0x00000101, ++ 0x01010000, 0x02020201, 0x02010100, 0x03030202, 0x01000404, ++ 0x04030201, 0x05050404, 0x01010100, 0x04030303, 0x01000505, ++ 0x03030101, 0x05050404}, ++}; ++ + static const u32 rtw8922a_digital_pwr_comp_val[][DIGITAL_PWR_COMP_REG_NUM] = { + {0x012C0096, 0x044C02BC, 0x00322710, 0x015E0096, 0x03C8028A, + 0x0BB80708, 0x17701194, 0x02020100, 0x03030303, 0x01000303, +@@ -1784,7 +1810,7 @@ static const u32 rtw8922a_digital_pwr_comp_val[][DIGITAL_PWR_COMP_REG_NUM] = { + }; + + static void rtw8922a_set_digital_pwr_comp(struct rtw89_dev *rtwdev, +- bool enable, u8 nss, ++ u8 band, u8 nss, + enum rtw89_rf_path path) + { + static const u32 ltpc_t0[2] = {R_BE_LTPC_T0_PATH0, R_BE_LTPC_T0_PATH1}; +@@ -1792,14 +1818,25 @@ static void rtw8922a_set_digital_pwr_comp(struct rtw89_dev *rtwdev, + u32 addr, val; + u32 i; + +- if (nss == 1) +- digital_pwr_comp = rtw8922a_digital_pwr_comp_val[0]; +- else +- digital_pwr_comp = rtw8922a_digital_pwr_comp_val[1]; ++ if (nss == 1) { ++ if (band == RTW89_BAND_2G) ++ digital_pwr_comp = path == RF_PATH_A ? ++ rtw8922a_digital_pwr_comp_2g_s0_val[0] : ++ rtw8922a_digital_pwr_comp_2g_s1_val[0]; ++ else ++ digital_pwr_comp = rtw8922a_digital_pwr_comp_val[0]; ++ } else { ++ if (band == RTW89_BAND_2G) ++ digital_pwr_comp = path == RF_PATH_A ? ++ rtw8922a_digital_pwr_comp_2g_s0_val[1] : ++ rtw8922a_digital_pwr_comp_2g_s1_val[1]; ++ else ++ digital_pwr_comp = rtw8922a_digital_pwr_comp_val[1]; ++ } + + addr = ltpc_t0[path]; + for (i = 0; i < DIGITAL_PWR_COMP_REG_NUM; i++, addr += 4) { +- val = enable ? digital_pwr_comp[i] : 0; ++ val = digital_pwr_comp[i]; + rtw89_phy_write32(rtwdev, addr, val); + } + } +@@ -1808,7 +1845,7 @@ static void rtw8922a_digital_pwr_comp(struct rtw89_dev *rtwdev, + enum rtw89_phy_idx phy_idx) + { + const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, RTW89_CHANCTX_0); +- bool enable = chan->band_type != RTW89_BAND_2G; ++ u8 band = chan->band_type; + u8 path; + + if (rtwdev->mlo_dbcc_mode == MLO_1_PLUS_1_1RF) { +@@ -1816,10 +1853,10 @@ static void rtw8922a_digital_pwr_comp(struct rtw89_dev *rtwdev, + path = RF_PATH_A; + else + path = RF_PATH_B; +- rtw8922a_set_digital_pwr_comp(rtwdev, enable, 1, path); ++ rtw8922a_set_digital_pwr_comp(rtwdev, band, 1, path); + } else { +- rtw8922a_set_digital_pwr_comp(rtwdev, enable, 2, RF_PATH_A); +- rtw8922a_set_digital_pwr_comp(rtwdev, enable, 2, RF_PATH_B); ++ rtw8922a_set_digital_pwr_comp(rtwdev, band, 2, RF_PATH_A); ++ rtw8922a_set_digital_pwr_comp(rtwdev, band, 2, RF_PATH_B); + } + } + +-- +2.51.0 + diff --git a/queue-6.19/wifi-rtw89-8922a-set-random-mac-if-efuse-contains-ze.patch b/queue-6.19/wifi-rtw89-8922a-set-random-mac-if-efuse-contains-ze.patch new file mode 100644 index 00000000000..63b806d1398 --- /dev/null +++ b/queue-6.19/wifi-rtw89-8922a-set-random-mac-if-efuse-contains-ze.patch @@ -0,0 +1,71 @@ +From e2c099a7d6040f487106f4aebca2644199cdc907 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Nov 2025 10:18:56 +0100 +Subject: wifi: rtw89: 8922a: set random mac if efuse contains zeroes + +From: Jose Ignacio Tornos Martinez + +[ Upstream commit 41be33d3efc120f6a2c02d12742655f2aa09e1b6 ] + +I have some rtl8922ae devices with no permanent mac stored in efuse. + +It could be properly saved and/or configured from user tools like +NetworkManager, but it would be desirable to be able to initialize it +somehow to get the device working by default. + +So, in the same way as with other devices, if the mac address read from +efuse contains zeros, a random mac address is assigned to at least allow +operation, and the user is warned about this in case any action needs to +be considered. + +Signed-off-by: Jose Ignacio Tornos Martinez +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20251126091905.217951-1-jtornosm@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/rtw8922a.c | 22 +++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922a.c b/drivers/net/wireless/realtek/rtw89/rtw8922a.c +index 4437279c554b0..4bcf20612a455 100644 +--- a/drivers/net/wireless/realtek/rtw89/rtw8922a.c ++++ b/drivers/net/wireless/realtek/rtw89/rtw8922a.c +@@ -636,16 +636,30 @@ static int rtw8922a_read_efuse_rf(struct rtw89_dev *rtwdev, u8 *log_map) + static int rtw8922a_read_efuse(struct rtw89_dev *rtwdev, u8 *log_map, + enum rtw89_efuse_block block) + { ++ struct rtw89_efuse *efuse = &rtwdev->efuse; ++ int ret; ++ + switch (block) { + case RTW89_EFUSE_BLOCK_HCI_DIG_PCIE_SDIO: +- return rtw8922a_read_efuse_pci_sdio(rtwdev, log_map); ++ ret = rtw8922a_read_efuse_pci_sdio(rtwdev, log_map); ++ break; + case RTW89_EFUSE_BLOCK_HCI_DIG_USB: +- return rtw8922a_read_efuse_usb(rtwdev, log_map); ++ ret = rtw8922a_read_efuse_usb(rtwdev, log_map); ++ break; + case RTW89_EFUSE_BLOCK_RF: +- return rtw8922a_read_efuse_rf(rtwdev, log_map); ++ ret = rtw8922a_read_efuse_rf(rtwdev, log_map); ++ break; + default: +- return 0; ++ ret = 0; ++ break; ++ } ++ ++ if (!ret && is_zero_ether_addr(efuse->addr)) { ++ rtw89_info(rtwdev, "efuse mac address is zero, using random mac\n"); ++ eth_random_addr(efuse->addr); + } ++ ++ return ret; + } + + #define THM_TRIM_POSITIVE_MASK BIT(6) +-- +2.51.0 + diff --git a/queue-6.19/wifi-rtw89-add-default-id-28de-2432-for-rtl8832cu.patch b/queue-6.19/wifi-rtw89-add-default-id-28de-2432-for-rtl8832cu.patch new file mode 100644 index 00000000000..837753e736b --- /dev/null +++ b/queue-6.19/wifi-rtw89-add-default-id-28de-2432-for-rtl8832cu.patch @@ -0,0 +1,35 @@ +From 4ebc361cd81f1167bff9014be2b8afe2c473b345 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 09:49:06 +0800 +Subject: wifi: rtw89: Add default ID 28de:2432 for RTL8832CU + +From: Shin-Yi Lin + +[ Upstream commit 5f65ebf9aaf00c7443252136066138435ec03958 ] + +Add 28de:2432 for RTL8832CU-based adapters that use this default ID. + +Signed-off-by: Shin-Yi Lin +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260114014906.21829-1-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/rtw8852cu.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852cu.c b/drivers/net/wireless/realtek/rtw89/rtw8852cu.c +index 2708b523ca141..3b9825c92a0d9 100644 +--- a/drivers/net/wireless/realtek/rtw89/rtw8852cu.c ++++ b/drivers/net/wireless/realtek/rtw89/rtw8852cu.c +@@ -46,6 +46,8 @@ static const struct usb_device_id rtw_8852cu_id_table[] = { + .driver_info = (kernel_ulong_t)&rtw89_8852cu_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x0db0, 0x991d, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&rtw89_8852cu_info }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x28de, 0x2432, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&rtw89_8852cu_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x35b2, 0x0502, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&rtw89_8852cu_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x35bc, 0x0101, 0xff, 0xff, 0xff), +-- +2.51.0 + diff --git a/queue-6.19/wifi-rtw89-add-support-for-d-link-vr-air-bridge-dwa-.patch b/queue-6.19/wifi-rtw89-add-support-for-d-link-vr-air-bridge-dwa-.patch new file mode 100644 index 00000000000..35637bb08f5 --- /dev/null +++ b/queue-6.19/wifi-rtw89-add-support-for-d-link-vr-air-bridge-dwa-.patch @@ -0,0 +1,39 @@ +From be725883c08b2412ae99f36eaf8499d9db45f78d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 08:47:59 +0800 +Subject: wifi: rtw89: Add support for D-Link VR Air Bridge (DWA-F18) + +From: Zenm Chen + +[ Upstream commit 292c0bc8acb687de7e83fc454bb98af19187b6bf ] + +Add the ID 2001:3323 to the table to support an additional RTL8832AU +adapter: D-Link VR Air Bridge (DWA-F18). + +Compile tested only. + +Link: https://github.com/morrownr/rtw89/pull/44 +Signed-off-by: Zenm Chen +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260112004759.6028-1-zenmchen@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/rtw8852au.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852au.c b/drivers/net/wireless/realtek/rtw89/rtw8852au.c +index 74a976c984ad8..ccdbcc178c2a4 100644 +--- a/drivers/net/wireless/realtek/rtw89/rtw8852au.c ++++ b/drivers/net/wireless/realtek/rtw89/rtw8852au.c +@@ -52,6 +52,8 @@ static const struct usb_device_id rtw_8852au_id_table[] = { + .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3321, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3323, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x332c, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x013f, 0xff, 0xff, 0xff), +-- +2.51.0 + diff --git a/queue-6.19/wifi-rtw89-add-support-for-msi-ax1800-nano-guax18n.patch b/queue-6.19/wifi-rtw89-add-support-for-msi-ax1800-nano-guax18n.patch new file mode 100644 index 00000000000..3aab39171cc --- /dev/null +++ b/queue-6.19/wifi-rtw89-add-support-for-msi-ax1800-nano-guax18n.patch @@ -0,0 +1,39 @@ +From d9e4d5c46fdf5e8ac03f0ce27a0f301ca9c11871 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 08:43:58 +0800 +Subject: wifi: rtw89: Add support for MSI AX1800 Nano (GUAX18N) + +From: Zenm Chen + +[ Upstream commit 3116f287b81fe777a00b93ab07ec3c270093b185 ] + +Add the ID 0db0:f0c8 to the table to support an additional RTL8832BU +adapter: MSI AX1800 Nano (GUAX18N). + +Compile tested only. + +Link: https://github.com/morrownr/rtl8852bu-20250826/pull/2 +Signed-off-by: Zenm Chen +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260112004358.5516-1-zenmchen@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/rtw8852bu.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852bu.c b/drivers/net/wireless/realtek/rtw89/rtw8852bu.c +index 980d17ef68d0a..84cd3ec971f98 100644 +--- a/drivers/net/wireless/realtek/rtw89/rtw8852bu.c ++++ b/drivers/net/wireless/realtek/rtw89/rtw8852bu.c +@@ -54,6 +54,8 @@ static const struct usb_device_id rtw_8852bu_id_table[] = { + .driver_info = (kernel_ulong_t)&rtw89_8852bu_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x0db0, 0x6931, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&rtw89_8852bu_info }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x0db0, 0xf0c8, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&rtw89_8852bu_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3327, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&rtw89_8852bu_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3574, 0x6121, 0xff, 0xff, 0xff), +-- +2.51.0 + diff --git a/queue-6.19/wifi-rtw89-disable-eht-protocol-by-chip-capabilities.patch b/queue-6.19/wifi-rtw89-disable-eht-protocol-by-chip-capabilities.patch new file mode 100644 index 00000000000..b4d68ac77cb --- /dev/null +++ b/queue-6.19/wifi-rtw89-disable-eht-protocol-by-chip-capabilities.patch @@ -0,0 +1,88 @@ +From d4cbce0fe1761841b4ec600cc105610560a74f46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 10:20:15 +0800 +Subject: wifi: rtw89: disable EHT protocol by chip capabilities + +From: Ping-Ke Shih + +[ Upstream commit 7fd36ffedeedc97c44a10249a3f12d471bb2dc26 ] + +For certain chip models, EHT protocol is disabled, and driver must follow +the capabilities. Otherwise, chips become unusable. + +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260110022019.2254969-5-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/core.c | 2 +- + drivers/net/wireless/realtek/rtw89/core.h | 1 + + drivers/net/wireless/realtek/rtw89/fw.h | 4 ++++ + drivers/net/wireless/realtek/rtw89/mac.c | 5 +++++ + 4 files changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c +index c5934e4eff711..4b86a7c4fe329 100644 +--- a/drivers/net/wireless/realtek/rtw89/core.c ++++ b/drivers/net/wireless/realtek/rtw89/core.c +@@ -5238,7 +5238,7 @@ static void rtw89_init_eht_cap(struct rtw89_dev *rtwdev, + u8 val, val_mcs13; + int sts = 8; + +- if (chip->chip_gen == RTW89_CHIP_AX) ++ if (chip->chip_gen == RTW89_CHIP_AX || hal->no_eht) + return; + + if (hal->no_mcs_12_13) +diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h +index 92636cfc5ca58..a032a20d4c23b 100644 +--- a/drivers/net/wireless/realtek/rtw89/core.h ++++ b/drivers/net/wireless/realtek/rtw89/core.h +@@ -5039,6 +5039,7 @@ struct rtw89_hal { + bool support_cckpd; + bool support_igi; + bool no_mcs_12_13; ++ bool no_eht; + + atomic_t roc_chanctx_idx; + u8 roc_link_index; +diff --git a/drivers/net/wireless/realtek/rtw89/fw.h b/drivers/net/wireless/realtek/rtw89/fw.h +index cedb4a47a769c..ba7c332911310 100644 +--- a/drivers/net/wireless/realtek/rtw89/fw.h ++++ b/drivers/net/wireless/realtek/rtw89/fw.h +@@ -42,6 +42,10 @@ struct rtw89_c2hreg_phycap { + #define RTW89_C2HREG_PHYCAP_W0_BW GENMASK(31, 24) + #define RTW89_C2HREG_PHYCAP_W1_TX_NSS GENMASK(7, 0) + #define RTW89_C2HREG_PHYCAP_W1_PROT GENMASK(15, 8) ++#define RTW89_C2HREG_PHYCAP_W1_PROT_11N 1 ++#define RTW89_C2HREG_PHYCAP_W1_PROT_11AC 2 ++#define RTW89_C2HREG_PHYCAP_W1_PROT_11AX 3 ++#define RTW89_C2HREG_PHYCAP_W1_PROT_11BE 4 + #define RTW89_C2HREG_PHYCAP_W1_NIC GENMASK(23, 16) + #define RTW89_C2HREG_PHYCAP_W1_WL_FUNC GENMASK(31, 24) + #define RTW89_C2HREG_PHYCAP_W2_HW_TYPE GENMASK(7, 0) +diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c +index 6734e5d5a5e22..fbce71cd5a05c 100644 +--- a/drivers/net/wireless/realtek/rtw89/mac.c ++++ b/drivers/net/wireless/realtek/rtw89/mac.c +@@ -3061,6 +3061,7 @@ static int rtw89_mac_setup_phycap_part0(struct rtw89_dev *rtwdev) + struct rtw89_efuse *efuse = &rtwdev->efuse; + struct rtw89_mac_c2h_info c2h_info = {}; + struct rtw89_hal *hal = &rtwdev->hal; ++ u8 protocol; + u8 tx_nss; + u8 rx_nss; + u8 tx_ant; +@@ -3108,6 +3109,10 @@ static int rtw89_mac_setup_phycap_part0(struct rtw89_dev *rtwdev) + rtw89_debug(rtwdev, RTW89_DBG_FW, "TX path diversity=%d\n", hal->tx_path_diversity); + rtw89_debug(rtwdev, RTW89_DBG_FW, "Antenna diversity=%d\n", hal->ant_diversity); + ++ protocol = u32_get_bits(phycap->w1, RTW89_C2HREG_PHYCAP_W1_PROT); ++ if (protocol < RTW89_C2HREG_PHYCAP_W1_PROT_11BE) ++ hal->no_eht = true; ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.19/wifi-rtw89-fix-potential-zero-beacon-interval-in-bea.patch b/queue-6.19/wifi-rtw89-fix-potential-zero-beacon-interval-in-bea.patch new file mode 100644 index 00000000000..4fa83b9c507 --- /dev/null +++ b/queue-6.19/wifi-rtw89-fix-potential-zero-beacon-interval-in-bea.patch @@ -0,0 +1,78 @@ +From 4807369f0b7a4fcf133960b13895ee7132a090bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Dec 2025 17:06:46 +0800 +Subject: wifi: rtw89: fix potential zero beacon interval in beacon tracking + +From: Kuan-Chung Chen + +[ Upstream commit eb57be32f438c57c88d6ce756101c1dfbcc03bba ] + +During fuzz testing, it was discovered that bss_conf->beacon_int +might be zero, which could result in a division by zero error in +subsequent calculations. Set a default value of 100 TU if the +interval is zero to ensure stability. + +Signed-off-by: Kuan-Chung Chen +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20251231090647.56407-11-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/core.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c +index 53d32f3137ebe..c5934e4eff711 100644 +--- a/drivers/net/wireless/realtek/rtw89/core.c ++++ b/drivers/net/wireless/realtek/rtw89/core.c +@@ -2787,7 +2787,7 @@ static void rtw89_core_bcn_track_assoc(struct rtw89_dev *rtwdev, + + rcu_read_lock(); + bss_conf = rtw89_vif_rcu_dereference_link(rtwvif_link, true); +- beacon_int = bss_conf->beacon_int; ++ beacon_int = bss_conf->beacon_int ?: 100; + dtim = bss_conf->dtim_period; + rcu_read_unlock(); + +@@ -2817,9 +2817,7 @@ static void rtw89_core_bcn_track_reset(struct rtw89_dev *rtwdev) + memset(&rtwdev->bcn_track, 0, sizeof(rtwdev->bcn_track)); + } + +-static void rtw89_vif_rx_bcn_stat(struct rtw89_dev *rtwdev, +- struct ieee80211_bss_conf *bss_conf, +- struct sk_buff *skb) ++static void rtw89_vif_rx_bcn_stat(struct rtw89_dev *rtwdev, struct sk_buff *skb) + { + #define RTW89_APPEND_TSF_2GHZ 384 + #define RTW89_APPEND_TSF_5GHZ 52 +@@ -2828,7 +2826,7 @@ static void rtw89_vif_rx_bcn_stat(struct rtw89_dev *rtwdev, + struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb); + struct rtw89_beacon_stat *bcn_stat = &rtwdev->phystat.bcn_stat; + struct rtw89_beacon_track_info *bcn_track = &rtwdev->bcn_track; +- u32 bcn_intvl_us = ieee80211_tu_to_usec(bss_conf->beacon_int); ++ u32 bcn_intvl_us = ieee80211_tu_to_usec(bcn_track->beacon_int); + u64 tsf = le64_to_cpu(mgmt->u.beacon.timestamp); + u8 wp, num = bcn_stat->num; + u16 append; +@@ -2836,6 +2834,10 @@ static void rtw89_vif_rx_bcn_stat(struct rtw89_dev *rtwdev, + if (!RTW89_CHK_FW_FEATURE(BEACON_TRACKING, &rtwdev->fw)) + return; + ++ /* Skip if not yet associated */ ++ if (!bcn_intvl_us) ++ return; ++ + switch (rx_status->band) { + default: + case NL80211_BAND_2GHZ: +@@ -2923,7 +2925,7 @@ static void rtw89_vif_rx_stats_iter(void *data, u8 *mac, + pkt_stat->beacon_rate = desc_info->data_rate; + pkt_stat->beacon_len = skb->len; + +- rtw89_vif_rx_bcn_stat(rtwdev, bss_conf, skb); ++ rtw89_vif_rx_bcn_stat(rtwdev, skb); + } + + if (!ether_addr_equal(bss_conf->addr, hdr->addr1)) +-- +2.51.0 + diff --git a/queue-6.19/wifi-rtw89-fix-unable-to-receive-probe-responses-und.patch b/queue-6.19/wifi-rtw89-fix-unable-to-receive-probe-responses-und.patch new file mode 100644 index 00000000000..1554685273d --- /dev/null +++ b/queue-6.19/wifi-rtw89-fix-unable-to-receive-probe-responses-und.patch @@ -0,0 +1,47 @@ +From 50d51d65dea68e022de482a659b6a26907b55ce8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 09:39:50 +0800 +Subject: wifi: rtw89: fix unable to receive probe responses under MLO + connection + +From: Po-Hao Huang + +[ Upstream commit 6f6d7a325fbde4f025ee1b1277f6f44727e21223 ] + +During MLO connections, A1 of the probe responses we received are +in link address, these frames will then be dropped by mac80211 due to +not matching the MLD address in ieee80211_scan_accept_presp(). +Fix this by using MLD address to scan when not using random MAC address. + +Signed-off-by: Po-Hao Huang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260114013950.19704-13-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/fw.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c +index 7b9d9989e5170..2f68a04cc028f 100644 +--- a/drivers/net/wireless/realtek/rtw89/fw.c ++++ b/drivers/net/wireless/realtek/rtw89/fw.c +@@ -8114,6 +8114,7 @@ int rtw89_hw_scan_start(struct rtw89_dev *rtwdev, + struct cfg80211_scan_request *req = &scan_req->req; + const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, + rtwvif_link->chanctx_idx); ++ struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link); + struct rtw89_vif *rtwvif = rtwvif_link->rtwvif; + struct rtw89_chanctx_pause_parm pause_parm = { + .rsn = RTW89_CHANCTX_PAUSE_REASON_HW_SCAN, +@@ -8142,6 +8143,8 @@ int rtw89_hw_scan_start(struct rtw89_dev *rtwdev, + if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) + get_random_mask_addr(mac_addr, req->mac_addr, + req->mac_addr_mask); ++ else if (ieee80211_vif_is_mld(vif)) ++ ether_addr_copy(mac_addr, vif->addr); + else + ether_addr_copy(mac_addr, rtwvif_link->mac_addr); + +-- +2.51.0 + diff --git a/queue-6.19/wifi-rtw89-mac-correct-page-number-for-csi-response.patch b/queue-6.19/wifi-rtw89-mac-correct-page-number-for-csi-response.patch new file mode 100644 index 00000000000..766d9a6e1b8 --- /dev/null +++ b/queue-6.19/wifi-rtw89-mac-correct-page-number-for-csi-response.patch @@ -0,0 +1,35 @@ +From 5ccc750deda5d7875f7559ddef415a746ff71c80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 10:20:17 +0800 +Subject: wifi: rtw89: mac: correct page number for CSI response + +From: Ping-Ke Shih + +[ Upstream commit aa2a44d0d22d45d659b9f01638809b1735e46cff ] + +For beamforming procedure, hardware reserve memory page for CSI response. +The unit of register is (value - 1), so add one accordingly as expected. + +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260110022019.2254969-7-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/mac_be.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/mac_be.c b/drivers/net/wireless/realtek/rtw89/mac_be.c +index 9b9e646487346..dee5ff71b75fe 100644 +--- a/drivers/net/wireless/realtek/rtw89/mac_be.c ++++ b/drivers/net/wireless/realtek/rtw89/mac_be.c +@@ -1175,7 +1175,7 @@ static int resp_pktctl_init_be(struct rtw89_dev *rtwdev, u8 mac_idx) + + reg = rtw89_mac_reg_by_idx(rtwdev, R_BE_RESP_CSI_RESERVED_PAGE, mac_idx); + rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_START_PAGE_MASK, qt_cfg.pktid); +- rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_PAGE_NUM_MASK, qt_cfg.pg_num); ++ rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_PAGE_NUM_MASK, qt_cfg.pg_num + 1); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.19/wifi-rtw89-mcc-reset-probe-counter-when-receiving-be.patch b/queue-6.19/wifi-rtw89-mcc-reset-probe-counter-when-receiving-be.patch new file mode 100644 index 00000000000..19f90767492 --- /dev/null +++ b/queue-6.19/wifi-rtw89-mcc-reset-probe-counter-when-receiving-be.patch @@ -0,0 +1,66 @@ +From 6b8feef86039bc991a5f002ba10d07596bb9d9a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Dec 2025 11:06:51 +0800 +Subject: wifi: rtw89: mcc: reset probe counter when receiving beacon + +From: Chih-Kang Chang + +[ Upstream commit 1b40c1c7571fcf926095ed92f25bd87900bdc8ed ] + +For BE chips, needs to transmit QoS null data periodically to ensure +the connection with AP in GC+STA mode. However, in environments +with interference, the Qos null data might fail to transmit +successfully. Therefore, when receive the beacon from AP will +reset the QoS null data failure counter to avoid unnecessary +disconnection. + +Signed-off-by: Chih-Kang Chang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20251223030651.480633-13-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/chan.c | 5 ++++- + drivers/net/wireless/realtek/rtw89/mac80211.c | 1 + + 2 files changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/chan.c b/drivers/net/wireless/realtek/rtw89/chan.c +index 86f1b39a967fe..8fe6a7ef738f7 100644 +--- a/drivers/net/wireless/realtek/rtw89/chan.c ++++ b/drivers/net/wireless/realtek/rtw89/chan.c +@@ -2608,17 +2608,20 @@ bool rtw89_mcc_detect_go_bcn(struct rtw89_dev *rtwdev, + static void rtw89_mcc_detect_connection(struct rtw89_dev *rtwdev, + struct rtw89_mcc_role *role) + { ++ struct rtw89_vif_link *rtwvif_link = role->rtwvif_link; + struct ieee80211_vif *vif; + bool start_detect; + int ret; + + ret = rtw89_core_send_nullfunc(rtwdev, role->rtwvif_link, true, false, + RTW89_MCC_PROBE_TIMEOUT); +- if (ret) ++ if (ret && ++ READ_ONCE(rtwvif_link->sync_bcn_tsf) == rtwvif_link->last_sync_bcn_tsf) + role->probe_count++; + else + role->probe_count = 0; + ++ rtwvif_link->last_sync_bcn_tsf = READ_ONCE(rtwvif_link->sync_bcn_tsf); + if (role->probe_count < RTW89_MCC_PROBE_MAX_TRIES) + return; + +diff --git a/drivers/net/wireless/realtek/rtw89/mac80211.c b/drivers/net/wireless/realtek/rtw89/mac80211.c +index f39ca1c2ed100..d08eac3d99266 100644 +--- a/drivers/net/wireless/realtek/rtw89/mac80211.c ++++ b/drivers/net/wireless/realtek/rtw89/mac80211.c +@@ -127,6 +127,7 @@ static int __rtw89_ops_add_iface_link(struct rtw89_dev *rtwdev, + rtwvif_link->reg_6ghz_power = RTW89_REG_6GHZ_POWER_DFLT; + rtwvif_link->rand_tsf_done = false; + rtwvif_link->detect_bcn_count = 0; ++ rtwvif_link->last_sync_bcn_tsf = 0; + + rcu_read_lock(); + +-- +2.51.0 + diff --git a/queue-6.19/wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch b/queue-6.19/wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch new file mode 100644 index 00000000000..c4b489ff89e --- /dev/null +++ b/queue-6.19/wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch @@ -0,0 +1,36 @@ +From c98052379a3b4cca2244f5454711035a6217e307 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 16:50:35 +0800 +Subject: wifi: rtw89: pci: restore LDO setting after device resume + +From: Dian-Syuan Yang + +[ Upstream commit af1e82232b988f8fc6d635c60609765e49221a64 ] + +The LDO (Low Dropout Regulator) setting is missing after suspend/resume +in some platforms, and it will cause card loss. Therefore, reconfigure +this setting to avoid it. + +Signed-off-by: Dian-Syuan Yang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260127085036.44060-6-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c +index b8135cf15d13c..fb4469a76bc03 100644 +--- a/drivers/net/wireless/realtek/rtw89/pci.c ++++ b/drivers/net/wireless/realtek/rtw89/pci.c +@@ -4605,6 +4605,7 @@ static int __maybe_unused rtw89_pci_resume(struct device *dev) + rtw89_write32_clr(rtwdev, R_AX_PCIE_PS_CTRL_V1, + B_AX_SEL_REQ_ENTR_L1); + } ++ rtw89_pci_hci_ldo(rtwdev); + rtw89_pci_l2_hci_ldo(rtwdev); + + rtw89_pci_basic_cfg(rtwdev, true); +-- +2.51.0 + diff --git a/queue-6.19/wifi-rtw89-pci-validate-release-report-content-befor.patch b/queue-6.19/wifi-rtw89-pci-validate-release-report-content-befor.patch new file mode 100644 index 00000000000..9b86f9d7099 --- /dev/null +++ b/queue-6.19/wifi-rtw89-pci-validate-release-report-content-befor.patch @@ -0,0 +1,43 @@ +From 50ae29386aed5f2f8993d4c056b36e54162a370d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 09:39:56 +0800 +Subject: wifi: rtw89: pci: validate release report content before using for + RTL8922DE + +From: Ping-Ke Shih + +[ Upstream commit 5f93d611b33a05bd03d6843c8efe8cb6a1992620 ] + +The commit 957eda596c76 +("wifi: rtw89: pci: validate sequence number of TX release report") +does validation on existing chips, which somehow a release report of SKB +becomes malformed. As no clear cause found, add rules ahead for RTL8922DE +to avoid crash if it happens. + +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260123013957.16418-11-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/pci.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c +index 093960d7279f8..b8135cf15d13c 100644 +--- a/drivers/net/wireless/realtek/rtw89/pci.c ++++ b/drivers/net/wireless/realtek/rtw89/pci.c +@@ -604,8 +604,10 @@ static void rtw89_pci_release_rpp(struct rtw89_dev *rtwdev, void *rpp) + + info->parse_rpp(rtwdev, rpp, &rpp_info); + +- if (unlikely(rpp_info.txch == RTW89_TXCH_CH12)) { +- rtw89_warn(rtwdev, "should no fwcmd release report\n"); ++ if (unlikely(rpp_info.txch >= RTW89_TXCH_NUM || ++ info->tx_dma_ch_mask & BIT(rpp_info.txch))) { ++ rtw89_warn(rtwdev, "should no release report on txch %d\n", ++ rpp_info.txch); + return; + } + +-- +2.51.0 + diff --git a/queue-6.19/wifi-rtw89-pci-validate-sequence-number-of-tx-releas.patch b/queue-6.19/wifi-rtw89-pci-validate-sequence-number-of-tx-releas.patch new file mode 100644 index 00000000000..4eac6b44055 --- /dev/null +++ b/queue-6.19/wifi-rtw89-pci-validate-sequence-number-of-tx-releas.patch @@ -0,0 +1,75 @@ +From 5119fbf9fd713801afd4b922ba0bfa636a127120 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 10:20:12 +0800 +Subject: wifi: rtw89: pci: validate sequence number of TX release report + +From: Ping-Ke Shih + +[ Upstream commit 957eda596c7665f2966970fd1dcc35fe299b38e8 ] + +Hardware rarely reports abnormal sequence number in TX release report, +which will access out-of-bounds of wd_ring->pages array, causing NULL +pointer dereference. + + BUG: kernel NULL pointer dereference, address: 0000000000000000 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 0 P4D 0 + Oops: 0000 [#1] PREEMPT SMP NOPTI + CPU: 1 PID: 1085 Comm: irq/129-rtw89_p Tainted: G S U + 6.1.145-17510-g2f3369c91536 #1 (HASH:69e8 1) + Call Trace: + + rtw89_pci_release_tx+0x18f/0x300 [rtw89_pci (HASH:4c83 2)] + rtw89_pci_napi_poll+0xc2/0x190 [rtw89_pci (HASH:4c83 2)] + net_rx_action+0xfc/0x460 net/core/dev.c:6578 net/core/dev.c:6645 net/core/dev.c:6759 + handle_softirqs+0xbe/0x290 kernel/softirq.c:601 + ? rtw89_pci_interrupt_threadfn+0xc5/0x350 [rtw89_pci (HASH:4c83 2)] + __local_bh_enable_ip+0xeb/0x120 kernel/softirq.c:499 kernel/softirq.c:423 + + + rtw89_pci_interrupt_threadfn+0xf8/0x350 [rtw89_pci (HASH:4c83 2)] + ? irq_thread+0xa7/0x340 kernel/irq/manage.c:0 + irq_thread+0x177/0x340 kernel/irq/manage.c:1205 kernel/irq/manage.c:1314 + ? thaw_kernel_threads+0xb0/0xb0 kernel/irq/manage.c:1202 + ? irq_forced_thread_fn+0x80/0x80 kernel/irq/manage.c:1220 + kthread+0xea/0x110 kernel/kthread.c:376 + ? synchronize_irq+0x1a0/0x1a0 kernel/irq/manage.c:1287 + ? kthread_associate_blkcg+0x80/0x80 kernel/kthread.c:331 + ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 + + +To prevent crash, validate rpp_info.seq before using. + +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260110022019.2254969-2-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/pci.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c +index a66fcdb0293b6..093960d7279f8 100644 +--- a/drivers/net/wireless/realtek/rtw89/pci.c ++++ b/drivers/net/wireless/realtek/rtw89/pci.c +@@ -604,11 +604,16 @@ static void rtw89_pci_release_rpp(struct rtw89_dev *rtwdev, void *rpp) + + info->parse_rpp(rtwdev, rpp, &rpp_info); + +- if (rpp_info.txch == RTW89_TXCH_CH12) { ++ if (unlikely(rpp_info.txch == RTW89_TXCH_CH12)) { + rtw89_warn(rtwdev, "should no fwcmd release report\n"); + return; + } + ++ if (unlikely(rpp_info.seq >= RTW89_PCI_TXWD_NUM_MAX)) { ++ rtw89_warn(rtwdev, "invalid seq %d\n", rpp_info.seq); ++ return; ++ } ++ + tx_ring = &rtwpci->tx.rings[rpp_info.txch]; + wd_ring = &tx_ring->wd_ring; + txwd = &wd_ring->pages[rpp_info.seq]; +-- +2.51.0 + diff --git a/queue-6.19/wifi-rtw89-regd-6-ghz-power-type-marks-default-when-.patch b/queue-6.19/wifi-rtw89-regd-6-ghz-power-type-marks-default-when-.patch new file mode 100644 index 00000000000..0d512ae3471 --- /dev/null +++ b/queue-6.19/wifi-rtw89-regd-6-ghz-power-type-marks-default-when-.patch @@ -0,0 +1,39 @@ +From 6207db92e78462bca3d7cb9bc8afa13556a51428 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Dec 2025 11:09:25 +0800 +Subject: wifi: rtw89: regd: 6 GHz power type marks default when inactive + +From: Zong-Zhe Yang + +[ Upstream commit 8c96752d99c0b094af68317a8c701b09bd0862d9 ] + +When inactive, 6 GHz power type has been assigned to the default one, +but missed to mark the local control variable, dflt, true. Then, this +might let some 6 GHz power info of disconnected APs keep being taken +into account under certain cases. + +So, mark default when inactive. + +Signed-off-by: Zong-Zhe Yang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20251229030926.27004-12-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/regd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/regd.c b/drivers/net/wireless/realtek/rtw89/regd.c +index 209d84909f885..c3425ed44732e 100644 +--- a/drivers/net/wireless/realtek/rtw89/regd.c ++++ b/drivers/net/wireless/realtek/rtw89/regd.c +@@ -1142,6 +1142,7 @@ static int rtw89_reg_6ghz_power_recalc(struct rtw89_dev *rtwdev, + } + } else { + rtwvif_link->reg_6ghz_power = RTW89_REG_6GHZ_POWER_DFLT; ++ dflt = true; + } + + rcu_read_unlock(); +-- +2.51.0 + diff --git a/queue-6.19/wifi-rtw89-ser-enable-error-imr-after-recovering-fro.patch b/queue-6.19/wifi-rtw89-ser-enable-error-imr-after-recovering-fro.patch new file mode 100644 index 00000000000..ac4e78bbc01 --- /dev/null +++ b/queue-6.19/wifi-rtw89-ser-enable-error-imr-after-recovering-fro.patch @@ -0,0 +1,90 @@ +From 85a3797d667e2137c0b8c09926d9150638b377c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Dec 2025 11:06:44 +0800 +Subject: wifi: rtw89: ser: enable error IMR after recovering from L1 + +From: Zong-Zhe Yang + +[ Upstream commit f4de946bdb379f543e3a599f8f048d741ad4a58e ] + +After recovering from L1, explicitly enable error IMR to ensure next +L1 SER (system error recovery) can work normally. + +Signed-off-by: Zong-Zhe Yang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20251223030651.480633-6-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/mac.c | 1 + + drivers/net/wireless/realtek/rtw89/mac.h | 1 + + drivers/net/wireless/realtek/rtw89/mac_be.c | 1 + + drivers/net/wireless/realtek/rtw89/ser.c | 10 ++++++++++ + 4 files changed, 13 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c +index d78fbe73e3657..b4c292c7e829d 100644 +--- a/drivers/net/wireless/realtek/rtw89/mac.c ++++ b/drivers/net/wireless/realtek/rtw89/mac.c +@@ -7184,6 +7184,7 @@ const struct rtw89_mac_gen_def rtw89_mac_gen_ax = { + .check_mac_en = rtw89_mac_check_mac_en_ax, + .sys_init = sys_init_ax, + .trx_init = trx_init_ax, ++ .err_imr_ctrl = err_imr_ctrl_ax, + .hci_func_en = rtw89_mac_hci_func_en_ax, + .dmac_func_pre_en = rtw89_mac_dmac_func_pre_en_ax, + .dle_func_en = dle_func_en_ax, +diff --git a/drivers/net/wireless/realtek/rtw89/mac.h b/drivers/net/wireless/realtek/rtw89/mac.h +index 0007229d67537..a4ed1c545609e 100644 +--- a/drivers/net/wireless/realtek/rtw89/mac.h ++++ b/drivers/net/wireless/realtek/rtw89/mac.h +@@ -1019,6 +1019,7 @@ struct rtw89_mac_gen_def { + enum rtw89_mac_hwmod_sel sel); + int (*sys_init)(struct rtw89_dev *rtwdev); + int (*trx_init)(struct rtw89_dev *rtwdev); ++ void (*err_imr_ctrl)(struct rtw89_dev *rtwdev, bool en); + void (*hci_func_en)(struct rtw89_dev *rtwdev); + void (*dmac_func_pre_en)(struct rtw89_dev *rtwdev); + void (*dle_func_en)(struct rtw89_dev *rtwdev, bool enable); +diff --git a/drivers/net/wireless/realtek/rtw89/mac_be.c b/drivers/net/wireless/realtek/rtw89/mac_be.c +index 556e5f98e8d41..9b9e646487346 100644 +--- a/drivers/net/wireless/realtek/rtw89/mac_be.c ++++ b/drivers/net/wireless/realtek/rtw89/mac_be.c +@@ -2601,6 +2601,7 @@ const struct rtw89_mac_gen_def rtw89_mac_gen_be = { + .check_mac_en = rtw89_mac_check_mac_en_be, + .sys_init = sys_init_be, + .trx_init = trx_init_be, ++ .err_imr_ctrl = err_imr_ctrl_be, + .hci_func_en = rtw89_mac_hci_func_en_be, + .dmac_func_pre_en = rtw89_mac_dmac_func_pre_en_be, + .dle_func_en = dle_func_en_be, +diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c +index f99e179f7ff9f..7fdc69578da31 100644 +--- a/drivers/net/wireless/realtek/rtw89/ser.c ++++ b/drivers/net/wireless/realtek/rtw89/ser.c +@@ -431,6 +431,14 @@ static void hal_send_m4_event(struct rtw89_ser *ser) + rtw89_mac_set_err_status(rtwdev, MAC_AX_ERR_L1_RCVY_EN); + } + ++static void hal_enable_err_imr(struct rtw89_ser *ser) ++{ ++ struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser); ++ const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def; ++ ++ mac->err_imr_ctrl(rtwdev, true); ++} ++ + /* state handler */ + static void ser_idle_st_hdl(struct rtw89_ser *ser, u8 evt) + { +@@ -552,6 +560,8 @@ static void ser_do_hci_st_hdl(struct rtw89_ser *ser, u8 evt) + break; + + case SER_EV_MAC_RESET_DONE: ++ hal_enable_err_imr(ser); ++ + ser_state_goto(ser, SER_IDLE_ST); + break; + +-- +2.51.0 + diff --git a/queue-6.19/wifi-rtw89-setting-tbtt-agg-number-when-mac-port-ini.patch b/queue-6.19/wifi-rtw89-setting-tbtt-agg-number-when-mac-port-ini.patch new file mode 100644 index 00000000000..9dc6e3dc7d0 --- /dev/null +++ b/queue-6.19/wifi-rtw89-setting-tbtt-agg-number-when-mac-port-ini.patch @@ -0,0 +1,63 @@ +From c01358eb7c18249d795f2d68ec3e2b8aaa8c2d6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Dec 2025 11:06:50 +0800 +Subject: wifi: rtw89: setting TBTT AGG number when mac port initialization + +From: Chih-Kang Chang + +[ Upstream commit 5e5f83fba48381098b26a8b2513a6d5fc5c66ccb ] + +When initializing mac port, needs to set TBTT AGG number to trigger TBTT +related interrupts. Otherwise, after sending join info H2C command with +disconnection mode, firmware will clear TBTT AGG number. Without the +setting from mac port initialization after that, this port will not be +able to transmit beacons. + +Signed-off-by: Chih-Kang Chang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20251223030651.480633-12-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/mac.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c +index b4c292c7e829d..6734e5d5a5e22 100644 +--- a/drivers/net/wireless/realtek/rtw89/mac.c ++++ b/drivers/net/wireless/realtek/rtw89/mac.c +@@ -4341,6 +4341,7 @@ static void rtw89_mac_bcn_drop(struct rtw89_dev *rtwdev, + #define BCN_HOLD_DEF 200 + #define BCN_MASK_DEF 0 + #define TBTT_ERLY_DEF 5 ++#define TBTT_AGG_DEF 1 + #define BCN_SET_UNIT 32 + #define BCN_ERLY_SET_DLY (10 * 2) + +@@ -4644,6 +4645,16 @@ static void rtw89_mac_port_cfg_tbtt_early(struct rtw89_dev *rtwdev, + B_AX_TBTTERLY_MASK, TBTT_ERLY_DEF); + } + ++static void rtw89_mac_port_cfg_tbtt_agg(struct rtw89_dev *rtwdev, ++ struct rtw89_vif_link *rtwvif_link) ++{ ++ const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def; ++ const struct rtw89_port_reg *p = mac->port_base; ++ ++ rtw89_write16_port_mask(rtwdev, rtwvif_link, p->tbtt_agg, ++ B_AX_TBTT_AGG_NUM_MASK, TBTT_AGG_DEF); ++} ++ + static void rtw89_mac_port_cfg_bss_color(struct rtw89_dev *rtwdev, + struct rtw89_vif_link *rtwvif_link) + { +@@ -4904,6 +4915,7 @@ int rtw89_mac_port_update(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvi + rtw89_mac_port_cfg_bcn_hold_time(rtwdev, rtwvif_link); + rtw89_mac_port_cfg_bcn_mask_area(rtwdev, rtwvif_link); + rtw89_mac_port_cfg_tbtt_early(rtwdev, rtwvif_link); ++ rtw89_mac_port_cfg_tbtt_agg(rtwdev, rtwvif_link); + rtw89_mac_port_cfg_bss_color(rtwdev, rtwvif_link); + rtw89_mac_port_cfg_mbssid(rtwdev, rtwvif_link); + rtw89_mac_port_cfg_func_en(rtwdev, rtwvif_link, true); +-- +2.51.0 + diff --git a/queue-6.19/wifi-rtw89-wow-add-reason-codes-for-disassociation-i.patch b/queue-6.19/wifi-rtw89-wow-add-reason-codes-for-disassociation-i.patch new file mode 100644 index 00000000000..7dce92334d9 --- /dev/null +++ b/queue-6.19/wifi-rtw89-wow-add-reason-codes-for-disassociation-i.patch @@ -0,0 +1,53 @@ +From f7805324ea7e34d512cbac3ed461f0ad7652e441 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 10:20:13 +0800 +Subject: wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode + +From: Chin-Yen Lee + +[ Upstream commit 2fd8f953f25173d14981d8736b6f5bfcd757e51b ] + +Some APs disconnect clients by sending a Disassociation frame +rather than a Deauthentication frame. Since these frames use +different reason codes in WoWLAN mode, this commit adds support +for handling Disassociation to prevent missed disconnection events. + +Signed-off-by: Chin-Yen Lee +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260110022019.2254969-3-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/wow.c | 4 ++++ + drivers/net/wireless/realtek/rtw89/wow.h | 1 + + 2 files changed, 5 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/wow.c b/drivers/net/wireless/realtek/rtw89/wow.c +index 46aba4cb2ee9e..534966b4d9c43 100644 +--- a/drivers/net/wireless/realtek/rtw89/wow.c ++++ b/drivers/net/wireless/realtek/rtw89/wow.c +@@ -809,6 +809,10 @@ static void rtw89_wow_show_wakeup_reason(struct rtw89_dev *rtwdev) + + reason = rtw89_read8(rtwdev, wow_reason_reg); + switch (reason) { ++ case RTW89_WOW_RSN_RX_DISASSOC: ++ wakeup.disconnect = true; ++ rtw89_debug(rtwdev, RTW89_DBG_WOW, "WOW: Rx disassoc\n"); ++ break; + case RTW89_WOW_RSN_RX_DEAUTH: + wakeup.disconnect = true; + rtw89_debug(rtwdev, RTW89_DBG_WOW, "WOW: Rx deauth\n"); +diff --git a/drivers/net/wireless/realtek/rtw89/wow.h b/drivers/net/wireless/realtek/rtw89/wow.h +index d2ba6cebc2a6b..71e07f482174f 100644 +--- a/drivers/net/wireless/realtek/rtw89/wow.h ++++ b/drivers/net/wireless/realtek/rtw89/wow.h +@@ -33,6 +33,7 @@ + enum rtw89_wake_reason { + RTW89_WOW_RSN_RX_PTK_REKEY = 0x1, + RTW89_WOW_RSN_RX_GTK_REKEY = 0x2, ++ RTW89_WOW_RSN_RX_DISASSOC = 0x4, + RTW89_WOW_RSN_RX_DEAUTH = 0x8, + RTW89_WOW_RSN_DISCONNECT = 0x10, + RTW89_WOW_RSN_RX_MAGIC_PKT = 0x21, +-- +2.51.0 + diff --git a/queue-6.19/x86-hyperv-move-hv-crash-init-after-hypercall-pg-set.patch b/queue-6.19/x86-hyperv-move-hv-crash-init-after-hypercall-pg-set.patch new file mode 100644 index 00000000000..0174b97f1c8 --- /dev/null +++ b/queue-6.19/x86-hyperv-move-hv-crash-init-after-hypercall-pg-set.patch @@ -0,0 +1,48 @@ +From 00ac21f42fa80a07f44692f5df7e64e6e6fe0da7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 17:58:00 -0800 +Subject: x86/hyperv: Move hv crash init after hypercall pg setup + +From: Mukesh R + +[ Upstream commit c3a6ae7ea2d3f507cbddb5818ccc65b9d84d6dc7 ] + +hv_root_crash_init() is not setting up the hypervisor crash collection +for baremetal cases because when it's called, hypervisor page is not +setup. + +Fix is simple, just move the crash init call after the hypercall +page setup. + +Signed-off-by: Mukesh Rathor +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + arch/x86/hyperv/hv_init.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c +index 14de43f4bc6c1..7f3301bd081ec 100644 +--- a/arch/x86/hyperv/hv_init.c ++++ b/arch/x86/hyperv/hv_init.c +@@ -558,7 +558,6 @@ void __init hyperv_init(void) + memunmap(src); + + hv_remap_tsc_clocksource(); +- hv_root_crash_init(); + hv_sleep_notifiers_register(); + } else { + hypercall_msr.guest_physical_address = vmalloc_to_pfn(hv_hypercall_pg); +@@ -567,6 +566,9 @@ void __init hyperv_init(void) + + hv_set_hypercall_pg(hv_hypercall_pg); + ++ if (hv_root_partition()) /* after set hypercall pg */ ++ hv_root_crash_init(); ++ + skip_hypercall_pg_init: + /* + * hyperv_init() is called before LAPIC is initialized: see +-- +2.51.0 + diff --git a/queue-6.19/x86-sev-use-kfree_sensitive-when-freeing-a-snp-messa.patch b/queue-6.19/x86-sev-use-kfree_sensitive-when-freeing-a-snp-messa.patch new file mode 100644 index 00000000000..857dcc13e3e --- /dev/null +++ b/queue-6.19/x86-sev-use-kfree_sensitive-when-freeing-a-snp-messa.patch @@ -0,0 +1,39 @@ +From da2d9117ddfd7bf18e366b364742a826f421ec6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 12:37:49 +0100 +Subject: x86/sev: Use kfree_sensitive() when freeing a SNP message descriptor + +From: Borislav Petkov (AMD) + +[ Upstream commit af05e558988ed004a20fc4de7d0f80cfbba663f0 ] + +Use the proper helper instead of an open-coded variant. + +Closes: https://lore.kernel.org/r/202512202235.WHPQkLZu-lkp@intel.com +Reported-by: kernel test robot +Reported-by: Julia Lawall +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Tom Lendacky +Link: https://patch.msgid.link/20260112114147.GBaWTd-8HSy_Xp4S3X@fat_crate.local +Signed-off-by: Sasha Levin +--- + arch/x86/coco/sev/core.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/x86/coco/sev/core.c b/arch/x86/coco/sev/core.c +index 9ae3b11754e65..c8ddb9febe3d9 100644 +--- a/arch/x86/coco/sev/core.c ++++ b/arch/x86/coco/sev/core.c +@@ -2008,8 +2008,7 @@ void snp_msg_free(struct snp_msg_desc *mdesc) + free_shared_pages(mdesc->request, sizeof(struct snp_guest_msg)); + iounmap((__force void __iomem *)mdesc->secrets); + +- memset(mdesc, 0, sizeof(*mdesc)); +- kfree(mdesc); ++ kfree_sensitive(mdesc); + } + EXPORT_SYMBOL_GPL(snp_msg_free); + +-- +2.51.0 + diff --git a/queue-6.19/x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch b/queue-6.19/x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch new file mode 100644 index 00000000000..f53469b8b4f --- /dev/null +++ b/queue-6.19/x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch @@ -0,0 +1,46 @@ +From cf5fea3614e156a7ca95596b7915090c61908ec5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 12:00:08 +0800 +Subject: x86/xen/pvh: Enable PAE mode for 32-bit guest only when + CONFIG_X86_PAE is set + +From: Hou Wenlong + +[ Upstream commit db9aded979b491a24871e1621cd4e8822dbca859 ] + +The PVH entry is available for 32-bit KVM guests, and 32-bit KVM guests +do not depend on CONFIG_X86_PAE. However, mk_early_pgtbl_32() builds +different pagetables depending on whether CONFIG_X86_PAE is set. +Therefore, enabling PAE mode for 32-bit KVM guests without +CONFIG_X86_PAE being set would result in a boot failure during CR3 +loading. + +Signed-off-by: Hou Wenlong +Reviewed-by: Juergen Gross +Signed-off-by: Juergen Gross +Message-ID: +Signed-off-by: Sasha Levin +--- + arch/x86/platform/pvh/head.S | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/x86/platform/pvh/head.S b/arch/x86/platform/pvh/head.S +index 344030c1a81d4..53ee2d53fcf8e 100644 +--- a/arch/x86/platform/pvh/head.S ++++ b/arch/x86/platform/pvh/head.S +@@ -91,10 +91,12 @@ SYM_CODE_START(pvh_start_xen) + + leal rva(early_stack_end)(%ebp), %esp + ++#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE) + /* Enable PAE mode. */ + mov %cr4, %eax + orl $X86_CR4_PAE, %eax + mov %eax, %cr4 ++#endif + + #ifdef CONFIG_X86_64 + /* Enable Long mode. */ +-- +2.51.0 + diff --git a/queue-6.19/xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch b/queue-6.19/xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch new file mode 100644 index 00000000000..b14f8149cfa --- /dev/null +++ b/queue-6.19/xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch @@ -0,0 +1,61 @@ +From e9f0c2699c355805f95e0ec8e17a18c3a996ec1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 17:47:29 -0500 +Subject: xenbus: Use .freeze/.thaw to handle xenbus devices + +From: Jason Andryuk + +[ Upstream commit e08dd1ee49838750a514e83c0aa60cd12ba6ecbb ] + +The goal is to fix s2idle and S3 for Xen PV devices. A domain resuming +from s3 or s2idle disconnects its PV devices during resume. The +backends are not expecting this and do not reconnect. + +b3e96c0c7562 ("xen: use freeze/restore/thaw PM events for suspend/ +resume/chkpt") changed xen_suspend()/do_suspend() from +PMSG_SUSPEND/PMSG_RESUME to PMSG_FREEZE/PMSG_THAW/PMSG_RESTORE, but the +suspend/resume callbacks remained. + +.freeze/restore are used with hiberation where Linux restarts in a new +place in the future. .suspend/resume are useful for runtime power +management for the duration of a boot. + +The current behavior of the callbacks works for an xl save/restore or +live migration where the domain is restored/migrated to a new location +and connecting to a not-already-connected backend. + +Change xenbus_pm_ops to use .freeze/thaw/restore and drop the +.suspend/resume hook. This matches the use in drivers/xen/manage.c for +save/restore and live migration. With .suspend/resume empty, PV devices +are left connected during s2idle and s3, so PV devices are not changed +and work after resume. + +Signed-off-by: Jason Andryuk +Acked-by: Juergen Gross +Signed-off-by: Juergen Gross +Message-ID: <20251119224731.61497-2-jason.andryuk@amd.com> +Signed-off-by: Sasha Levin +--- + drivers/xen/xenbus/xenbus_probe_frontend.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c +index 6d1819269cbe5..199917b6f77ca 100644 +--- a/drivers/xen/xenbus/xenbus_probe_frontend.c ++++ b/drivers/xen/xenbus/xenbus_probe_frontend.c +@@ -148,11 +148,9 @@ static void xenbus_frontend_dev_shutdown(struct device *_dev) + } + + static const struct dev_pm_ops xenbus_pm_ops = { +- .suspend = xenbus_dev_suspend, +- .resume = xenbus_frontend_dev_resume, + .freeze = xenbus_dev_suspend, + .thaw = xenbus_dev_cancel, +- .restore = xenbus_dev_resume, ++ .restore = xenbus_frontend_dev_resume, + }; + + static struct xen_bus_type xenbus_frontend = { +-- +2.51.0 + diff --git a/queue-6.6/acpi-processor-fix-null-pointer-dereference-in-acpi_.patch b/queue-6.6/acpi-processor-fix-null-pointer-dereference-in-acpi_.patch new file mode 100644 index 00000000000..acd3341a8f1 --- /dev/null +++ b/queue-6.6/acpi-processor-fix-null-pointer-dereference-in-acpi_.patch @@ -0,0 +1,101 @@ +From 8edef5ced29996136a3d5804b5c304364c9d1f07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 00:32:14 +0800 +Subject: ACPI: processor: Fix NULL-pointer dereference in + acpi_processor_errata_piix4() + +From: Tuo Li + +[ Upstream commit f132e089fe89cadc2098991f0a3cb05c3f824ac6 ] + +In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE +device and then reassigned an ISA device: + + dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...); + dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...); + +If the first lookup succeeds but the second fails, dev becomes NULL. This +leads to a potential null-pointer dereference when dev_dbg() is called: + + if (errata.piix4.bmisx) + dev_dbg(&dev->dev, ...); + +To prevent this, use two temporary pointers and retrieve each device +independently, avoiding overwriting dev with a possible NULL value. + +Signed-off-by: Tuo Li +[ rjw: Subject adjustment, added an empty code line ] +Link: https://patch.msgid.link/20260111163214.202262-1-islituo@gmail.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpi_processor.c | 28 +++++++++++++++------------- + 1 file changed, 15 insertions(+), 13 deletions(-) + +diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c +index c0f9cf9768ea9..5e409f86f0709 100644 +--- a/drivers/acpi/acpi_processor.c ++++ b/drivers/acpi/acpi_processor.c +@@ -39,6 +39,7 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev) + { + u8 value1 = 0; + u8 value2 = 0; ++ struct pci_dev *ide_dev = NULL, *isa_dev = NULL; + + + if (!dev) +@@ -96,12 +97,12 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev) + * each IDE controller's DMA status to make sure we catch all + * DMA activity. + */ +- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, ++ ide_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, + PCI_DEVICE_ID_INTEL_82371AB, + PCI_ANY_ID, PCI_ANY_ID, NULL); +- if (dev) { +- errata.piix4.bmisx = pci_resource_start(dev, 4); +- pci_dev_put(dev); ++ if (ide_dev) { ++ errata.piix4.bmisx = pci_resource_start(ide_dev, 4); ++ pci_dev_put(ide_dev); + } + + /* +@@ -113,24 +114,25 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev) + * disable C3 support if this is enabled, as some legacy + * devices won't operate well if fast DMA is disabled. + */ +- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, ++ isa_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, + PCI_DEVICE_ID_INTEL_82371AB_0, + PCI_ANY_ID, PCI_ANY_ID, NULL); +- if (dev) { +- pci_read_config_byte(dev, 0x76, &value1); +- pci_read_config_byte(dev, 0x77, &value2); ++ if (isa_dev) { ++ pci_read_config_byte(isa_dev, 0x76, &value1); ++ pci_read_config_byte(isa_dev, 0x77, &value2); + if ((value1 & 0x80) || (value2 & 0x80)) + errata.piix4.fdma = 1; +- pci_dev_put(dev); ++ pci_dev_put(isa_dev); + } + + break; + } + +- if (errata.piix4.bmisx) +- dev_dbg(&dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n"); +- if (errata.piix4.fdma) +- dev_dbg(&dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n"); ++ if (ide_dev) ++ dev_dbg(&ide_dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n"); ++ ++ if (isa_dev) ++ dev_dbg(&isa_dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n"); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.6/acpica-abort-aml-bytecode-execution-when-executing-a.patch b/queue-6.6/acpica-abort-aml-bytecode-execution-when-executing-a.patch new file mode 100644 index 00000000000..40274fbb7a9 --- /dev/null +++ b/queue-6.6/acpica-abort-aml-bytecode-execution-when-executing-a.patch @@ -0,0 +1,129 @@ +From 46290166990146f3a0a08a33991518145687f8f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 13:25:33 +0100 +Subject: ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP + +From: Armin Wolf + +[ Upstream commit 026ad376a6a48538b576f3589331daa94daae6f0 ] + +The ACPI specification states that when executing AML_FATAL_OP, +the OS should log the fatal error event and shutdown in a timely +fashion. + +Windows complies with this requirement by immediatly entering a +Bso_d, effectively aborting the execution of the AML bytecode in +question. + +ACPICA however might continue with the AML bytecode execution +should acpi_os_signal() simply return AE_OK. This will cause issues +because ACPI BIOS implementations might assume that the Fatal() +operator does not return. + +Fix this by aborting the AML bytecode execution in such a case +by returning AE_ERROR. Also turn struct acpi_signal_fatal_info into a +local variable because of its small size (12 bytes) and to ensure +that acpi_os_signal() always receives valid information about the +fatal ACPI BIOS error. + +Link: https://github.com/acpica/acpica/commit/d516c7758ba6 +Signed-off-by: Armin Wolf +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/3325491.5fSG56mABF@rafael.j.wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/exoparg3.c | 46 +++++++++++++--------------------- + 1 file changed, 18 insertions(+), 28 deletions(-) + +diff --git a/drivers/acpi/acpica/exoparg3.c b/drivers/acpi/acpica/exoparg3.c +index d3091f619909e..41758343657dd 100644 +--- a/drivers/acpi/acpica/exoparg3.c ++++ b/drivers/acpi/acpica/exoparg3.c +@@ -10,6 +10,7 @@ + #include + #include "accommon.h" + #include "acinterp.h" ++#include + #include "acparser.h" + #include "amlcode.h" + +@@ -51,8 +52,7 @@ ACPI_MODULE_NAME("exoparg3") + acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state) + { + union acpi_operand_object **operand = &walk_state->operands[0]; +- struct acpi_signal_fatal_info *fatal; +- acpi_status status = AE_OK; ++ struct acpi_signal_fatal_info fatal; + + ACPI_FUNCTION_TRACE_STR(ex_opcode_3A_0T_0R, + acpi_ps_get_opcode_name(walk_state->opcode)); +@@ -60,28 +60,23 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state) + switch (walk_state->opcode) { + case AML_FATAL_OP: /* Fatal (fatal_type fatal_code fatal_arg) */ + +- ACPI_DEBUG_PRINT((ACPI_DB_INFO, +- "FatalOp: Type %X Code %X Arg %X " +- "<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n", +- (u32)operand[0]->integer.value, +- (u32)operand[1]->integer.value, +- (u32)operand[2]->integer.value)); +- +- fatal = ACPI_ALLOCATE(sizeof(struct acpi_signal_fatal_info)); +- if (fatal) { +- fatal->type = (u32) operand[0]->integer.value; +- fatal->code = (u32) operand[1]->integer.value; +- fatal->argument = (u32) operand[2]->integer.value; +- } ++ fatal.type = (u32)operand[0]->integer.value; ++ fatal.code = (u32)operand[1]->integer.value; ++ fatal.argument = (u32)operand[2]->integer.value; + +- /* Always signal the OS! */ ++ ACPI_BIOS_ERROR((AE_INFO, ++ "Fatal ACPI BIOS error (Type 0x%X Code 0x%X Arg 0x%X)\n", ++ fatal.type, fatal.code, fatal.argument)); + +- status = acpi_os_signal(ACPI_SIGNAL_FATAL, fatal); ++ /* Always signal the OS! */ + +- /* Might return while OS is shutting down, just continue */ ++ acpi_os_signal(ACPI_SIGNAL_FATAL, &fatal); + +- ACPI_FREE(fatal); +- goto cleanup; ++ /* ++ * Might return while OS is shutting down, so abort the AML execution ++ * by returning an error. ++ */ ++ return_ACPI_STATUS(AE_ERROR); + + case AML_EXTERNAL_OP: + /* +@@ -93,21 +88,16 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state) + * wrong if an external opcode ever gets here. + */ + ACPI_ERROR((AE_INFO, "Executed External Op")); +- status = AE_OK; +- goto cleanup; ++ ++ return_ACPI_STATUS(AE_OK); + + default: + + ACPI_ERROR((AE_INFO, "Unknown AML opcode 0x%X", + walk_state->opcode)); + +- status = AE_AML_BAD_OPCODE; +- goto cleanup; ++ return_ACPI_STATUS(AE_AML_BAD_OPCODE); + } +- +-cleanup: +- +- return_ACPI_STATUS(status); + } + + /******************************************************************************* +-- +2.51.0 + diff --git a/queue-6.6/alsa-hda-conexant-add-headset-mic-fix-for-mechrevo-w.patch b/queue-6.6/alsa-hda-conexant-add-headset-mic-fix-for-mechrevo-w.patch new file mode 100644 index 00000000000..2beccdfac2f --- /dev/null +++ b/queue-6.6/alsa-hda-conexant-add-headset-mic-fix-for-mechrevo-w.patch @@ -0,0 +1,36 @@ +From 8bb32205f8b4cb46ae6e4553a375e26ac7005753 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 23:55:01 +0800 +Subject: ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro + +From: gongqi <550230171hxy@gmail.com> + +[ Upstream commit f2581ea2d9f30844c437e348a462027ea25c12e9 ] + +The headset microphone on the MECHREVO Wujie 15X Pro requires the +CXT_FIXUP_HEADSET_MIC quirk to function properly. Add the PCI SSID +(0x1d05:0x3012) to the quirk table. + +Signed-off-by: gongqi <550230171hxy@gmail.com> +Link: https://patch.msgid.link/20260122155501.376199-5-550230171hxy@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_conexant.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index 157efd1530fbf..fd141185ce2b9 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -1127,6 +1127,7 @@ static const struct hda_quirk cxt5066_fixups[] = { + SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", CXT_FIXUP_THINKPAD_ACPI), + SND_PCI_QUIRK(0x1c06, 0x2011, "Lemote A1004", CXT_PINCFG_LEMOTE_A1004), + SND_PCI_QUIRK(0x1c06, 0x2012, "Lemote A1205", CXT_PINCFG_LEMOTE_A1205), ++ SND_PCI_QUIRK(0x1d05, 0x3012, "MECHREVO Wujie 15X Pro", CXT_FIXUP_HEADSET_MIC), + HDA_CODEC_QUIRK(0x2782, 0x12c3, "Sirius Gen1", CXT_PINCFG_TOP_SPEAKER), + HDA_CODEC_QUIRK(0x2782, 0x12c5, "Sirius Gen2", CXT_PINCFG_TOP_SPEAKER), + {} +-- +2.51.0 + diff --git a/queue-6.6/alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch b/queue-6.6/alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch new file mode 100644 index 00000000000..ba8f2f03287 --- /dev/null +++ b/queue-6.6/alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch @@ -0,0 +1,42 @@ +From b2d6b4634f08f6d4b48dab6bd2c05db9a949058b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 08:38:29 +0000 +Subject: ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio + +From: Lianqin Hu + +[ Upstream commit ac656d7d7c70f7c352c7652bc2bb0c1c8c2dde08 ] + +Setting up the interface when suspended/resumeing fail on this card. +Adding a reset and delay quirk will eliminate this problem. + +usb 1-1: New USB device found, idVendor=001f, idProduct=0b21 +usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 +usb 1-1: Product: AB13X USB Audio +usb 1-1: Manufacturer: Generic +usb 1-1: SerialNumber: 20210926172016 + +Signed-off-by: Lianqin Hu +Link: https://patch.msgid.link/TYUPR06MB6217522D0DB6E2C9DF46B56ED265A@TYUPR06MB6217.apcprd06.prod.outlook.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/quirks.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index cde5b5c165096..ff2bbe761ee3a 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -2047,6 +2047,8 @@ struct usb_audio_quirk_flags_table { + + static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + /* Device matches */ ++ DEVICE_FLG(0x001f, 0x0b21, /* AB13X USB Audio */ ++ QUIRK_FLAG_FORCE_IFACE_RESET | QUIRK_FLAG_IFACE_DELAY), + DEVICE_FLG(0x03f0, 0x654a, /* HP 320 FHD Webcam */ + QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16), + DEVICE_FLG(0x041e, 0x3000, /* Creative SB Extigy */ +-- +2.51.0 + diff --git a/queue-6.6/alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch b/queue-6.6/alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch new file mode 100644 index 00000000000..be267389258 --- /dev/null +++ b/queue-6.6/alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch @@ -0,0 +1,108 @@ +From 1be1cf1dfca3b8abe16679fcf35eae60a1ba4160 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Feb 2026 15:12:07 +0100 +Subject: ALSA: usb-audio: Add sanity check for OOB writes at silencing + +From: Takashi Iwai + +[ Upstream commit fba2105a157fffcf19825e4eea498346738c9948 ] + +At silencing the playback URB packets in the implicit fb mode before +the actual playback, we blindly assume that the received packets fit +with the buffer size. But when the setup in the capture stream +differs from the playback stream (e.g. due to the USB core limitation +of max packet size), such an inconsistency may lead to OOB writes to +the buffer, resulting in a crash. + +For addressing it, add a sanity check of the transfer buffer size at +prepare_silent_urb(), and stop the data copy if the received data +overflows. Also, report back the transfer error properly from there, +too. + +Note that this doesn't fix the root cause of the playback error +itself, but this merely covers the kernel Oops. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076 +Link: https://patch.msgid.link/20260216141209.1849200-4-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/endpoint.c | 39 ++++++++++++++++++++++----------------- + 1 file changed, 22 insertions(+), 17 deletions(-) + +diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c +index d33835a769f5e..1092b964167e9 100644 +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -278,8 +278,8 @@ static inline bool has_tx_length_quirk(struct snd_usb_audio *chip) + return chip->quirk_flags & QUIRK_FLAG_TX_LENGTH; + } + +-static void prepare_silent_urb(struct snd_usb_endpoint *ep, +- struct snd_urb_ctx *ctx) ++static int prepare_silent_urb(struct snd_usb_endpoint *ep, ++ struct snd_urb_ctx *ctx) + { + struct urb *urb = ctx->urb; + unsigned int offs = 0; +@@ -292,28 +292,34 @@ static void prepare_silent_urb(struct snd_usb_endpoint *ep, + extra = sizeof(packet_length); + + for (i = 0; i < ctx->packets; ++i) { +- unsigned int offset; +- unsigned int length; +- int counts; +- +- counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0); +- length = counts * ep->stride; /* number of silent bytes */ +- offset = offs * ep->stride + extra * i; +- urb->iso_frame_desc[i].offset = offset; ++ int length; ++ ++ length = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0); ++ if (length < 0) ++ return length; ++ length *= ep->stride; /* number of silent bytes */ ++ if (offs + length + extra > ctx->buffer_size) ++ break; ++ urb->iso_frame_desc[i].offset = offs; + urb->iso_frame_desc[i].length = length + extra; + if (extra) { + packet_length = cpu_to_le32(length); +- memcpy(urb->transfer_buffer + offset, ++ memcpy(urb->transfer_buffer + offs, + &packet_length, sizeof(packet_length)); ++ offs += extra; + } +- memset(urb->transfer_buffer + offset + extra, ++ memset(urb->transfer_buffer + offs, + ep->silence_value, length); +- offs += counts; ++ offs += length; + } + +- urb->number_of_packets = ctx->packets; +- urb->transfer_buffer_length = offs * ep->stride + ctx->packets * extra; ++ if (!offs) ++ return -EPIPE; ++ ++ urb->number_of_packets = i; ++ urb->transfer_buffer_length = offs; + ctx->queued = 0; ++ return 0; + } + + /* +@@ -335,8 +341,7 @@ static int prepare_outbound_urb(struct snd_usb_endpoint *ep, + if (data_subs && ep->prepare_data_urb) + return ep->prepare_data_urb(data_subs, urb, in_stream_lock); + /* no data provider, so send silence */ +- prepare_silent_urb(ep, ctx); +- break; ++ return prepare_silent_urb(ep, ctx); + + case SND_USB_ENDPOINT_TYPE_SYNC: + if (snd_usb_get_speed(ep->chip->dev) >= USB_SPEED_HIGH) { +-- +2.51.0 + diff --git a/queue-6.6/alsa-usb-audio-update-the-number-of-packets-properly.patch b/queue-6.6/alsa-usb-audio-update-the-number-of-packets-properly.patch new file mode 100644 index 00000000000..e1d1de9f895 --- /dev/null +++ b/queue-6.6/alsa-usb-audio-update-the-number-of-packets-properly.patch @@ -0,0 +1,37 @@ +From b2eecf54a9b9d5f04700a78e61f275382e227cf5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Feb 2026 15:12:05 +0100 +Subject: ALSA: usb-audio: Update the number of packets properly at receiving + +From: Takashi Iwai + +[ Upstream commit cf044e44190234a41a788de1cdbb6c21f4a52e1e ] + +At receiving the packets from the implicit feedback source, we didn't +update ctx->packets field but only the ctx->packet_size[] data. +In exceptional cases, this might lead to unexpectedly superfluous data +transfer (although this won't happen usually due to the nature of USB +isochronous transfer). Fix it to update the field properly. + +Link: https://patch.msgid.link/20260216141209.1849200-2-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/endpoint.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c +index 17ae74b067c5e..d33835a769f5e 100644 +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -489,6 +489,7 @@ int snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep, + + /* copy over the length information */ + if (implicit_fb) { ++ ctx->packets = packet->packets; + for (i = 0; i < packet->packets; i++) + ctx->packet_size[i] = packet->packet_size[i]; + } +-- +2.51.0 + diff --git a/queue-6.6/apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch b/queue-6.6/apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch new file mode 100644 index 00000000000..c1cd505d2f9 --- /dev/null +++ b/queue-6.6/apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch @@ -0,0 +1,137 @@ +From 9c7637ef2a414220be06a3e15a3a2196e637b295 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:35:05 +0100 +Subject: APEI/GHES: ensure that won't go past CPER allocated record + +From: Mauro Carvalho Chehab + +[ Upstream commit fa2408a24f8f0db14d9cfc613ef162dc267d7ad4 ] + +The logic at ghes_new() prevents allocating too large records, by +checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB). +Yet, the allocation is done with the actual number of pages from the +CPER bios table location, which can be smaller. + +Yet, a bad firmware could send data with a different size, which might +be bigger than the allocated memory, causing an OOPS: + + Unable to handle kernel paging request at virtual address fff00000f9b40000 + Mem abort info: + ESR = 0x0000000096000007 + EC = 0x25: DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 + FSC = 0x07: level 3 translation fault + Data abort info: + ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 + CM = 0, WnR = 0, TnD = 0, TagAccess = 0 + GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 + swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000 + [fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000 + Internal error: Oops: 0000000096000007 [#1] SMP + Modules linked in: + CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT + Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022 + Workqueue: kacpi_notify acpi_os_execute_deferred + pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) + pc : hex_dump_to_buffer+0x30c/0x4a0 + lr : hex_dump_to_buffer+0x328/0x4a0 + sp : ffff800080e13880 + x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083 + x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004 + x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083 + x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010 + x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020 + x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008 + x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000 + x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020 + x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000 + x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008 + Call trace: + hex_dump_to_buffer+0x30c/0x4a0 (P) + print_hex_dump+0xac/0x170 + cper_estatus_print_section+0x90c/0x968 + cper_estatus_print+0xf0/0x158 + __ghes_print_estatus+0xa0/0x148 + ghes_proc+0x1bc/0x220 + ghes_notify_hed+0x5c/0xb8 + notifier_call_chain+0x78/0x148 + blocking_notifier_call_chain+0x4c/0x80 + acpi_hed_notify+0x28/0x40 + acpi_ev_notify_dispatch+0x50/0x80 + acpi_os_execute_deferred+0x24/0x48 + process_one_work+0x15c/0x3b0 + worker_thread+0x2d0/0x400 + kthread+0x148/0x228 + ret_from_fork+0x10/0x20 + Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44) + ---[ end trace 0000000000000000 ]--- + +Prevent that by taking the actual allocated are into account when +checking for CPER length. + +Signed-off-by: Mauro Carvalho Chehab +Reviewed-by: Jonathan Cameron +Acked-by: Ard Biesheuvel +Reviewed-by: Hanjun Guo +[ rjw: Subject tweaks ] +Link: https://patch.msgid.link/4e70310a816577fabf37d94ed36cde4ad62b1e0a.1767871950.git.mchehab+huawei@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/apei/ghes.c | 6 +++++- + include/acpi/ghes.h | 1 + + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c +index e768dfd345fb2..9c0d256fc72b1 100644 +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -290,6 +291,7 @@ static struct ghes *ghes_new(struct acpi_hest_generic *generic) + error_block_length = GHES_ESTATUS_MAX_SIZE; + } + ghes->estatus = kmalloc(error_block_length, GFP_KERNEL); ++ ghes->estatus_length = error_block_length; + if (!ghes->estatus) { + rc = -ENOMEM; + goto err_unmap_status_addr; +@@ -361,13 +363,15 @@ static int __ghes_check_estatus(struct ghes *ghes, + struct acpi_hest_generic_status *estatus) + { + u32 len = cper_estatus_len(estatus); ++ u32 max_len = min(ghes->generic->error_block_length, ++ ghes->estatus_length); + + if (len < sizeof(*estatus)) { + pr_warn_ratelimited(FW_WARN GHES_PFX "Truncated error status block!\n"); + return -EIO; + } + +- if (len > ghes->generic->error_block_length) { ++ if (!len || len > max_len) { + pr_warn_ratelimited(FW_WARN GHES_PFX "Invalid error status block length!\n"); + return -EIO; + } +diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h +index be1dd4c1a9174..16646fdd1f841 100644 +--- a/include/acpi/ghes.h ++++ b/include/acpi/ghes.h +@@ -21,6 +21,7 @@ struct ghes { + struct acpi_hest_generic_v2 *generic_v2; + }; + struct acpi_hest_generic_status *estatus; ++ unsigned int estatus_length; + unsigned long flags; + union { + struct list_head list; +-- +2.51.0 + diff --git a/queue-6.6/arm-9467-1-mm-don-t-use-pk-through-printk.patch b/queue-6.6/arm-9467-1-mm-don-t-use-pk-through-printk.patch new file mode 100644 index 00000000000..8a9ef0491b3 --- /dev/null +++ b/queue-6.6/arm-9467-1-mm-don-t-use-pk-through-printk.patch @@ -0,0 +1,42 @@ +From 350ba285a6bf9cb894974938f2a7f23e0ea151a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 10:56:33 +0100 +Subject: ARM: 9467/1: mm: Don't use %pK through printk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weissschuh + +[ Upstream commit 012ea376a5948b025f260aa45d2a6ec5d96674ea ] + +Restricted pointers ("%pK") were never meant to be used +through printk(). They can acquire sleeping locks in atomic contexts. + +Switch to %px over the more secure %p as this usage is a debugging aid, +gated behind CONFIG_DEBUG_VIRTUAL and used by WARN(). + +Link: https://lore.kernel.org/lkml/20250113171731-dc10e3c1-da64-4af0-b767-7c7070468023@linutronix.de/ +Signed-off-by: Thomas Weißschuh +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/mm/physaddr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/mm/physaddr.c b/arch/arm/mm/physaddr.c +index 3f263c840ebc4..1a37ebfacbba9 100644 +--- a/arch/arm/mm/physaddr.c ++++ b/arch/arm/mm/physaddr.c +@@ -38,7 +38,7 @@ static inline bool __virt_addr_valid(unsigned long x) + phys_addr_t __virt_to_phys(unsigned long x) + { + WARN(!__virt_addr_valid(x), +- "virt_to_phys used for non-linear address: %pK (%pS)\n", ++ "virt_to_phys used for non-linear address: %px (%pS)\n", + (void *)x, (void *)x); + + return __virt_to_phys_nodebug(x); +-- +2.51.0 + diff --git a/queue-6.6/arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch b/queue-6.6/arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch new file mode 100644 index 00000000000..759c6356214 --- /dev/null +++ b/queue-6.6/arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch @@ -0,0 +1,37 @@ +From 7ad3c74f3e17464007c6b5788b50fe0b0d6e83f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Dec 2025 17:24:48 +0800 +Subject: arm64: Add support for TSV110 Spectre-BHB mitigation + +From: Jinqian Yang + +[ Upstream commit e3baa5d4b361276efeb87b20d8beced451a7dbd5 ] + +The TSV110 processor is vulnerable to the Spectre-BHB (Branch History +Buffer) attack, which can be exploited to leak information through +branch prediction side channels. This commit adds the MIDR of TSV110 +to the list for software mitigation. + +Signed-off-by: Jinqian Yang +Reviewed-by: Zenghui Yu +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/proton-pack.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c +index 2c81e0efaf378..19518a9da53f8 100644 +--- a/arch/arm64/kernel/proton-pack.c ++++ b/arch/arm64/kernel/proton-pack.c +@@ -896,6 +896,7 @@ static u8 spectre_bhb_loop_affected(void) + MIDR_ALL_VERSIONS(MIDR_CORTEX_X2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), ++ MIDR_ALL_VERSIONS(MIDR_HISI_TSV110), + {}, + }; + static const struct midr_range spectre_bhb_k24_list[] = { +-- +2.51.0 + diff --git a/queue-6.6/arm64-tegra-smaug-add-usb-role-switch-support.patch b/queue-6.6/arm64-tegra-smaug-add-usb-role-switch-support.patch new file mode 100644 index 00000000000..a1e7894dc89 --- /dev/null +++ b/queue-6.6/arm64-tegra-smaug-add-usb-role-switch-support.patch @@ -0,0 +1,37 @@ +From 85deb4a27b3ffa9810780cff62a617922c99c842 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Dec 2025 21:27:21 +0000 +Subject: arm64: tegra: smaug: Add usb-role-switch support + +From: Diogo Ivo + +[ Upstream commit dfa93788dd8b2f9c59adf45ecf592082b1847b7b ] + +The USB2 port on Smaug is configured for OTG operation but lacked the +required 'usb-role-switch' property, leading to a failed probe and a +non-functioning USB port. Add the property along with setting the default +role to host. + +Signed-off-by: Diogo Ivo +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/nvidia/tegra210-smaug.dts | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts +index 53805555dd2d2..a75c6c1928a4a 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts ++++ b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts +@@ -1724,6 +1724,8 @@ usb2-0 { + status = "okay"; + vbus-supply = <&usbc_vbus>; + mode = "otg"; ++ usb-role-switch; ++ role-switch-default-mode = "host"; + }; + + usb3-0 { +-- +2.51.0 + diff --git a/queue-6.6/asoc-codecs-max98390-check-return-value-of-devm_gpio.patch b/queue-6.6/asoc-codecs-max98390-check-return-value-of-devm_gpio.patch new file mode 100644 index 00000000000..53fc6b523d0 --- /dev/null +++ b/queue-6.6/asoc-codecs-max98390-check-return-value-of-devm_gpio.patch @@ -0,0 +1,44 @@ +From 0fc0733d12eedf8951e071011b9d2931ca084835 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 17:19:04 +0800 +Subject: ASoC: codecs: max98390: Check return value of + devm_gpiod_get_optional() in max98390_i2c_probe() + +From: Chen Ni + +[ Upstream commit a1d14d8364eac2611fe1391c73ff0e5b26064f0e ] + +The devm_gpiod_get_optional() function may return an error pointer +(ERR_PTR) in case of a genuine failure during GPIO acquisition, +not just NULL which indicates the legitimate absence of an optional +GPIO. + +Add an IS_ERR() check after the function call to catch such errors and +propagate them to the probe function, ensuring the driver fails to load +safely rather than proceeding with an invalid pointer. + +Signed-off-by: Chen Ni +Link: https://patch.msgid.link/20260130091904.3426149-1-nichen@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98390.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/codecs/max98390.c b/sound/soc/codecs/max98390.c +index 5b8e78e516302..f2a1306d042b7 100644 +--- a/sound/soc/codecs/max98390.c ++++ b/sound/soc/codecs/max98390.c +@@ -1076,6 +1076,9 @@ static int max98390_i2c_probe(struct i2c_client *i2c) + + reset_gpio = devm_gpiod_get_optional(&i2c->dev, + "reset", GPIOD_OUT_HIGH); ++ if (IS_ERR(reset_gpio)) ++ return dev_err_probe(&i2c->dev, PTR_ERR(reset_gpio), ++ "Failed to get reset gpio\n"); + + /* Power on device */ + if (reset_gpio) { +-- +2.51.0 + diff --git a/queue-6.6/asoc-es8328-add-error-unwind-in-resume.patch b/queue-6.6/asoc-es8328-add-error-unwind-in-resume.patch new file mode 100644 index 00000000000..abbd9d56ace --- /dev/null +++ b/queue-6.6/asoc-es8328-add-error-unwind-in-resume.patch @@ -0,0 +1,57 @@ +From 7e0582a5f58ea53997019ae4034a5e7e27f7b761 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Jan 2026 00:00:17 +0800 +Subject: ASoC: es8328: Add error unwind in resume + +From: Hsieh Hung-En + +[ Upstream commit 8232e6079ae6f8d3a61d87973cb427385aa469b9 ] + +Handle failures in the resume path by unwinding previously enabled +resources. + +If enabling regulators or syncing the regcache fails, disable regulators +and unprepare the clock to avoid leaking resources and leaving the device +in a partially resumed state. + +Signed-off-by: Hsieh Hung-En +Link: https://patch.msgid.link/20260130160017.2630-6-hungen3108@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/es8328.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c +index 43792e175d75f..864c6a858628d 100644 +--- a/sound/soc/codecs/es8328.c ++++ b/sound/soc/codecs/es8328.c +@@ -750,17 +750,23 @@ static int es8328_resume(struct snd_soc_component *component) + es8328->supplies); + if (ret) { + dev_err(component->dev, "unable to enable regulators\n"); +- return ret; ++ goto err_clk; + } + + regcache_mark_dirty(regmap); + ret = regcache_sync(regmap); + if (ret) { + dev_err(component->dev, "unable to sync regcache\n"); +- return ret; ++ goto err_regulators; + } + + return 0; ++ ++err_regulators: ++ regulator_bulk_disable(ARRAY_SIZE(es8328->supplies), es8328->supplies); ++err_clk: ++ clk_disable_unprepare(es8328->clk); ++ return ret; + } + + static int es8328_component_probe(struct snd_soc_component *component) +-- +2.51.0 + diff --git a/queue-6.6/asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch b/queue-6.6/asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch new file mode 100644 index 00000000000..72a9635d677 --- /dev/null +++ b/queue-6.6/asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch @@ -0,0 +1,37 @@ +From 60695e1a55c8bed1224eb20e26efc5f9fbfa26b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 11:32:50 +0800 +Subject: ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio + +From: Chen Ni + +[ Upstream commit 74823db9ba2e13f3ec007b354759b3d8125e462c ] + +Add check for the return value of devm_regmap_init_mmio() and return the +error if it fails in order to catch the error. + +Signed-off-by: Chen Ni +Link: https://patch.msgid.link/20260127033250.2044608-1-nichen@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sunxi/sun50i-dmic.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/sunxi/sun50i-dmic.c b/sound/soc/sunxi/sun50i-dmic.c +index 2599683a582dc..9071bc4835759 100644 +--- a/sound/soc/sunxi/sun50i-dmic.c ++++ b/sound/soc/sunxi/sun50i-dmic.c +@@ -324,6 +324,9 @@ static int sun50i_dmic_probe(struct platform_device *pdev) + + host->regmap = devm_regmap_init_mmio(&pdev->dev, base, + &sun50i_dmic_regmap_config); ++ if (IS_ERR(host->regmap)) ++ return dev_err_probe(&pdev->dev, PTR_ERR(host->regmap), ++ "failed to initialise regmap\n"); + + /* Clocks */ + host->bus_clk = devm_clk_get(&pdev->dev, "bus"); +-- +2.51.0 + diff --git a/queue-6.6/asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch b/queue-6.6/asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch new file mode 100644 index 00000000000..dc6244fa855 --- /dev/null +++ b/queue-6.6/asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch @@ -0,0 +1,36 @@ +From 6980cfc036becd6207b3a381d3a54fcd6645596b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 04:02:08 +0100 +Subject: ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask + +From: Sebastian Krzyszkowiak + +[ Upstream commit 66c26346ae30c883eef70acf9cf9054dfdb4fb2f ] + +This bit is handled by a separate control. + +Signed-off-by: Sebastian Krzyszkowiak +Reviewed-by: Charles Keepax +Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-1-f4f4eeacf089@puri.sm +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index 4f50b07848fd8..8aaa91a16d8b9 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -1759,7 +1759,7 @@ SND_SOC_BYTES("EQR Coefficients", WM8962_EQ24, 18), + + + SOC_SINGLE("3D Switch", WM8962_THREED1, 0, 1, 0), +-SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA), ++SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA | WM8962_ADC_MONOMIX), + + SOC_SINGLE("DF1 Switch", WM8962_DF1, 0, 1, 0), + SND_SOC_BYTES_MASK("DF1 Coefficients", WM8962_DF1, 7, WM8962_DF1_ENA), +-- +2.51.0 + diff --git a/queue-6.6/asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch b/queue-6.6/asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch new file mode 100644 index 00000000000..9b2419ca5a9 --- /dev/null +++ b/queue-6.6/asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch @@ -0,0 +1,58 @@ +From 64c7058e6d91976095c8b4ee2ab64419d0be39fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 04:02:10 +0100 +Subject: ASoC: wm8962: Don't report a microphone if it's shorted to ground on + plug + +From: Sebastian Krzyszkowiak + +[ Upstream commit e590752119029d87ce46d725e11245a52d22e1fe ] + +This usually means that a TRS plug with no microphone pin has been plugged +into a TRRS socket. Cases where a user is plugging in a microphone while +pressing a button will be handled via incoming interrupt after the user +releases the button, so the microphone will still be detected once it +becomes usable. + +Signed-off-by: Sebastian Krzyszkowiak +Reviewed-by: Charles Keepax +Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-3-f4f4eeacf089@puri.sm +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index 8aaa91a16d8b9..68a5ca176d6f0 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -67,6 +67,8 @@ struct wm8962_priv { + struct mutex dsp2_ena_lock; + u16 dsp2_ena; + ++ int mic_status; ++ + struct delayed_work mic_work; + struct snd_soc_jack *jack; + +@@ -3073,8 +3075,16 @@ static void wm8962_mic_work(struct work_struct *work) + if (reg & WM8962_MICSHORT_STS) { + status |= SND_JACK_BTN_0; + irq_pol |= WM8962_MICSCD_IRQ_POL; ++ ++ /* Don't report a microphone if it's shorted right after ++ * plugging in, as this may be a TRS plug in a TRRS socket. ++ */ ++ if (!(wm8962->mic_status & WM8962_MICDET_STS)) ++ status = 0; + } + ++ wm8962->mic_status = status; ++ + snd_soc_jack_report(wm8962->jack, status, + SND_JACK_MICROPHONE | SND_JACK_BTN_0); + +-- +2.51.0 + diff --git a/queue-6.6/ata-libata-avoid-long-timeouts-on-hot-unplugged-sata.patch b/queue-6.6/ata-libata-avoid-long-timeouts-on-hot-unplugged-sata.patch new file mode 100644 index 00000000000..ab2ac75064b --- /dev/null +++ b/queue-6.6/ata-libata-avoid-long-timeouts-on-hot-unplugged-sata.patch @@ -0,0 +1,160 @@ +From 761bd80303d90e09e0abb93ced17c54d973670f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 17:46:22 +0800 +Subject: ata: libata: avoid long timeouts on hot-unplugged SATA DAS + +From: Henry Tseng + +[ Upstream commit 151cabd140322205e27dae5c4bbf261ede0056e3 ] + +When a SATA DAS enclosure is connected behind a Thunderbolt PCIe +switch, hot-unplugging the whole enclosure causes pciehp to tear down +the PCI hierarchy before the SCSI layer issues SYNCHRONIZE CACHE and +START STOP UNIT for the disks. + +libata still queues these commands and the AHCI driver tries to access +the HBA registers even though the PCI channel is already offline. This +results in a series of timeouts and error recovery attempts, e.g.: + + [ 824.778346] pcieport 0000:00:07.0: pciehp: Slot(14): Link Down + [ 891.612720] ata8.00: qc timeout after 5000 msecs (cmd 0xec) + [ 902.876501] ata8.00: qc timeout after 10000 msecs (cmd 0xec) + [ 934.107998] ata8.00: qc timeout after 30000 msecs (cmd 0xec) + [ 936.206431] sd 7:0:0:0: [sda] Synchronize Cache(10) failed: + Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK + ... + [ 1006.298356] ata1.00: qc timeout after 5000 msecs (cmd 0xec) + [ 1017.561926] ata1.00: qc timeout after 10000 msecs (cmd 0xec) + [ 1048.791790] ata1.00: qc timeout after 30000 msecs (cmd 0xec) + [ 1050.890035] sd 0:0:0:0: [sdb] Synchronize Cache(10) failed: + Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK + +With this patch applied, the same hot-unplug looks like: + + [ 59.965496] pcieport 0000:00:07.0: pciehp: Slot(14): Link Down + [ 60.002502] sd 7:0:0:0: [sda] Synchronize Cache(10) failed: + Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK + ... + [ 60.103050] sd 0:0:0:0: [sdb] Synchronize Cache(10) failed: + Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK + +In this test setup with two disks, the hot-unplug sequence shrinks from +about 226 seconds (~3.8 minutes) between the Link Down event and the +last SYNCHRONIZE CACHE failure to under a second. Without this patch the +total delay grows roughly with the number of disks, because each disk +gets its own SYNCHRONIZE CACHE and qc timeout series. + +If the underlying PCI device is already gone, these commands cannot +succeed anyway. Avoid issuing them by introducing +ata_adapter_is_online(), which checks pci_channel_offline() for +PCI-based hosts. It is used from ata_scsi_find_dev() to return NULL, +causing the SCSI layer to fail new commands with DID_BAD_TARGET +immediately, and from ata_qc_issue() to bail out before touching the +HBA registers. + +Since such failures would otherwise trigger libata error handling, +ata_adapter_is_online() is also consulted from ata_scsi_port_error_handler(). +When the adapter is offline, libata skips ap->ops->error_handler(ap) and +completes error handling using the existing path, rather than running +a full EH sequence against a dead adapter. + +With this change, SYNCHRONIZE CACHE and START STOP UNIT commands +issued during hot-unplug fail quickly once the PCI channel is offline, +without qc timeout spam or long libata EH delays. + +Suggested-by: Damien Le Moal +Signed-off-by: Henry Tseng +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/libata-core.c | 24 ++++++++++++++++++++++++ + drivers/ata/libata-eh.c | 3 ++- + drivers/ata/libata-scsi.c | 3 +++ + drivers/ata/libata.h | 1 + + 4 files changed, 30 insertions(+), 1 deletion(-) + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index d5e713f284b71..91c6291b01f4e 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -2318,6 +2318,24 @@ static bool ata_dev_check_adapter(struct ata_device *dev, + return false; + } + ++bool ata_adapter_is_online(struct ata_port *ap) ++{ ++ struct device *dev; ++ ++ if (!ap || !ap->host) ++ return false; ++ ++ dev = ap->host->dev; ++ if (!dev) ++ return false; ++ ++ if (dev_is_pci(dev) && ++ pci_channel_offline(to_pci_dev(dev))) ++ return false; ++ ++ return true; ++} ++ + static int ata_dev_config_ncq(struct ata_device *dev, + char *desc, size_t desc_sz) + { +@@ -5023,6 +5041,12 @@ void ata_qc_issue(struct ata_queued_cmd *qc) + qc->flags |= ATA_QCFLAG_ACTIVE; + ap->qc_active |= 1ULL << qc->tag; + ++ /* Make sure the device is still accessible. */ ++ if (!ata_adapter_is_online(ap)) { ++ qc->err_mask |= AC_ERR_HOST_BUS; ++ goto sys_err; ++ } ++ + /* + * We guarantee to LLDs that they will have at least one + * non-zero sg if the command is a data command. +diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c +index 3263fc13491e1..fc2c508c41bd4 100644 +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -723,7 +723,8 @@ void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap) + spin_unlock_irqrestore(ap->lock, flags); + + /* invoke EH, skip if unloading or suspended */ +- if (!(ap->pflags & (ATA_PFLAG_UNLOADING | ATA_PFLAG_SUSPENDED))) ++ if (!(ap->pflags & (ATA_PFLAG_UNLOADING | ATA_PFLAG_SUSPENDED)) && ++ ata_adapter_is_online(ap)) + ap->ops->error_handler(ap); + else { + /* if unloading, commence suicide */ +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index 8f6a7acf770e4..51980996200c8 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -2867,6 +2867,9 @@ ata_scsi_find_dev(struct ata_port *ap, const struct scsi_device *scsidev) + { + struct ata_device *dev = __ata_scsi_find_dev(ap, scsidev); + ++ if (!ata_adapter_is_online(ap)) ++ return NULL; ++ + if (unlikely(!dev || !ata_dev_enabled(dev))) + return NULL; + +diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h +index 05ac80da8ebc7..9927d79e55878 100644 +--- a/drivers/ata/libata.h ++++ b/drivers/ata/libata.h +@@ -75,6 +75,7 @@ extern int atapi_check_dma(struct ata_queued_cmd *qc); + extern void swap_buf_le16(u16 *buf, unsigned int buf_words); + extern bool ata_phys_link_online(struct ata_link *link); + extern bool ata_phys_link_offline(struct ata_link *link); ++bool ata_adapter_is_online(struct ata_port *ap); + extern void ata_dev_init(struct ata_device *dev); + extern void ata_link_init(struct ata_port *ap, struct ata_link *link, int pmp); + extern int sata_link_init_spd(struct ata_link *link); +-- +2.51.0 + diff --git a/queue-6.6/audit-add-fchmodat2-to-change-attributes-class.patch b/queue-6.6/audit-add-fchmodat2-to-change-attributes-class.patch new file mode 100644 index 00000000000..bcd94d763d9 --- /dev/null +++ b/queue-6.6/audit-add-fchmodat2-to-change-attributes-class.patch @@ -0,0 +1,42 @@ +From 0c4ebabf73a9c8cdf111e1f5b56cf90bba980641 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 20:49:30 +0100 +Subject: audit: add fchmodat2() to change attributes class + +From: Jeffrey Bencteux + +[ Upstream commit 4f493a6079b588cf1f04ce5ed6cdad45ab0d53dc ] + +fchmodat2(), introduced in version 6.6 is currently not in the change +attribute class of audit. Calling fchmodat2() to change a file +attribute in the same fashion than chmod() or fchmodat() will bypass +audit rules such as: + +-w /tmp/test -p rwa -k test_rwa + +The current patch adds fchmodat2() to the change attributes class. + +Signed-off-by: Jeffrey Bencteux +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + include/asm-generic/audit_change_attr.h | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/include/asm-generic/audit_change_attr.h b/include/asm-generic/audit_change_attr.h +index 331670807cf01..6c311d4d37f4e 100644 +--- a/include/asm-generic/audit_change_attr.h ++++ b/include/asm-generic/audit_change_attr.h +@@ -20,6 +20,9 @@ __NR_fremovexattr, + __NR_fchownat, + __NR_fchmodat, + #endif ++#ifdef __NR_fchmodat2 ++__NR_fchmodat2, ++#endif + #ifdef __NR_chown32 + __NR_chown32, + __NR_fchown32, +-- +2.51.0 + diff --git a/queue-6.6/audit-add-missing-syscalls-to-read-class.patch b/queue-6.6/audit-add-missing-syscalls-to-read-class.patch new file mode 100644 index 00000000000..9d84d38f649 --- /dev/null +++ b/queue-6.6/audit-add-missing-syscalls-to-read-class.patch @@ -0,0 +1,47 @@ +From 44f325108849c74a8a9ddf3c8e0238710da6ae16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Dec 2025 09:39:24 +0100 +Subject: audit: add missing syscalls to read class + +From: Jeffrey Bencteux + +[ Upstream commit bcb90a2834c7393c26df9609b889a3097b7700cd ] + +The "at" variant of getxattr() and listxattr() are missing from the +audit read class. Calling getxattrat() or listxattrat() on a file to +read its extended attributes will bypass audit rules such as: + +-w /tmp/test -p rwa -k test_rwa + +The current patch adds missing syscalls to the audit read class. + +Signed-off-by: Jeffrey Bencteux +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + include/asm-generic/audit_read.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/include/asm-generic/audit_read.h b/include/asm-generic/audit_read.h +index 7bb7b5a83ae2e..fb9991f53fb6f 100644 +--- a/include/asm-generic/audit_read.h ++++ b/include/asm-generic/audit_read.h +@@ -4,9 +4,15 @@ __NR_readlink, + #endif + __NR_quotactl, + __NR_listxattr, ++#ifdef __NR_listxattrat ++__NR_listxattrat, ++#endif + __NR_llistxattr, + __NR_flistxattr, + __NR_getxattr, ++#ifdef __NR_getxattrat ++__NR_getxattrat, ++#endif + __NR_lgetxattr, + __NR_fgetxattr, + #ifdef __NR_readlinkat +-- +2.51.0 + diff --git a/queue-6.6/binder-don-t-use-pk-through-printk.patch b/queue-6.6/binder-don-t-use-pk-through-printk.patch new file mode 100644 index 00000000000..67ad4dd014b --- /dev/null +++ b/queue-6.6/binder-don-t-use-pk-through-printk.patch @@ -0,0 +1,83 @@ +From 0cd4003159944ef5eeb0259c85a90b32e68a0681 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 15:29:50 +0100 +Subject: binder: don't use %pK through printk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 56d21267663bad91e8b10121224ec46366a7937e ] + +In the past %pK was preferable to %p as it would not leak raw pointer +values into the kernel log. Since commit ad67b74d2469 ("printk: hash +addresses printed with %p") the regular %p has been improved to avoid +this issue. Furthermore, restricted pointers ("%pK") were never meant +to be used through printk(). They can still unintentionally leak raw +pointers or acquire sleeping locks in atomic contexts. + +Switch to the regular pointer formatting which is safer and +easier to reason about. + +There are still a few users of %pK left, but these use it through +seq_file, for which its usage is safe. + +Signed-off-by: Thomas Weißschuh +Acked-by: Carlos Llamas +Reviewed-by: Alice Ryhl +Link: https://patch.msgid.link/20260107-restricted-pointers-binder-v1-1-181018bf3812@linutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/android/binder.c | 2 +- + drivers/android/binder_alloc.c | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/android/binder.c b/drivers/android/binder.c +index 43f11f66970b2..73408a5b45b3b 100644 +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -4211,7 +4211,7 @@ static int binder_thread_write(struct binder_proc *proc, + } + } + binder_debug(BINDER_DEBUG_DEAD_BINDER, +- "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n", ++ "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n", + proc->pid, thread->pid, (u64)cookie, + death); + if (death == NULL) { +diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c +index 34c27223cb7dd..6a4be6087ae6b 100644 +--- a/drivers/android/binder_alloc.c ++++ b/drivers/android/binder_alloc.c +@@ -79,7 +79,7 @@ static void binder_insert_free_buffer(struct binder_alloc *alloc, + new_buffer_size = binder_alloc_buffer_size(alloc, new_buffer); + + binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC, +- "%d: add free buffer, size %zd, at %pK\n", ++ "%d: add free buffer, size %zd, at %p\n", + alloc->pid, new_buffer_size, new_buffer); + + while (*p) { +@@ -474,7 +474,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked( + } + + binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC, +- "%d: binder_alloc_buf size %zd got buffer %pK size %zd\n", ++ "%d: binder_alloc_buf size %zd got buffer %p size %zd\n", + alloc->pid, size, buffer, buffer_size); + + has_page_addr = (void __user *) +@@ -646,7 +646,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc, + ALIGN(buffer->extra_buffers_size, sizeof(void *)); + + binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC, +- "%d: binder_free_buf %pK size %zd buffer_size %zd\n", ++ "%d: binder_free_buf %p size %zd buffer_size %zd\n", + alloc->pid, buffer, size, buffer_size); + + BUG_ON(buffer->free); +-- +2.51.0 + diff --git a/queue-6.6/blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch b/queue-6.6/blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch new file mode 100644 index 00000000000..a22de6b3187 --- /dev/null +++ b/queue-6.6/blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch @@ -0,0 +1,42 @@ +From 8a7c8abb60095c3f418891f4ef9b53197311a107 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 16:05:22 +0800 +Subject: blk-mq-debugfs: add missing debugfs_mutex in + blk_mq_debugfs_register_hctxs() + +From: Yu Kuai + +[ Upstream commit 9d20fd6ce1ba9733cd5ac96fcab32faa9fc404dd ] + +In blk_mq_update_nr_hw_queues(), debugfs_mutex is not held while +creating debugfs entries for hctxs. Hence add debugfs_mutex there, +it's safe because queue is not frozen. + +Signed-off-by: Yu Kuai +Reviewed-by: Nilay Shroff +Reviewed-by: Ming Lei +Reviewed-by: Hannes Reinecke +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-debugfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c +index c3b5930106b28..e0677043f00de 100644 +--- a/block/blk-mq-debugfs.c ++++ b/block/blk-mq-debugfs.c +@@ -730,8 +730,10 @@ void blk_mq_debugfs_register_hctxs(struct request_queue *q) + struct blk_mq_hw_ctx *hctx; + unsigned long i; + ++ mutex_lock(&q->debugfs_mutex); + queue_for_each_hw_ctx(q, hctx, i) + blk_mq_debugfs_register_hctx(q, hctx); ++ mutex_unlock(&q->debugfs_mutex); + } + + void blk_mq_debugfs_unregister_hctxs(struct request_queue *q) +-- +2.51.0 + diff --git a/queue-6.6/bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch b/queue-6.6/bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch new file mode 100644 index 00000000000..7b23a92f14b --- /dev/null +++ b/queue-6.6/bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch @@ -0,0 +1,37 @@ +From ece9ed9ba24416b1739275afd8cc15aea5c1001d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 10:13:04 +0100 +Subject: Bluetooth: btusb: Add device ID for Realtek RTL8761BU + +From: Jacopo Scannella + +[ Upstream commit cc6383d4f0cf6127c0552f94cae517a06ccc6b17 ] + +Add USB device ID 0x2c0a:0x8761 to the btusb driver fo the Realtek +RTL8761BU Bluetooth adapter. + +Reference: +https://www.startech.com/en-us/networking-io/av53c1-usb-bluetooth + +Signed-off-by: Jacopo Scannella +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 5381fa17d5e89..168e46ce59976 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -721,6 +721,7 @@ static const struct usb_device_id quirks_table[] = { + + /* Additional Realtek 8723BU Bluetooth devices */ + { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK }, ++ { USB_DEVICE(0x2c0a, 0x8761), .driver_info = BTUSB_REALTEK }, + + /* Additional Realtek 8723DE Bluetooth devices */ + { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK }, +-- +2.51.0 + diff --git a/queue-6.6/bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch b/queue-6.6/bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch new file mode 100644 index 00000000000..672cc70aba9 --- /dev/null +++ b/queue-6.6/bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch @@ -0,0 +1,74 @@ +From 8fe298ac8594ab69373c333e6a99ddbf81ac74e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 15:03:35 +1100 +Subject: Bluetooth: btusb: Add new VID/PID for RTL8852CE + +From: Shell Chen + +[ Upstream commit d9f7c39c6b7548bd70519b241b6c2d1bcc658d4b ] + +Add VID:PID 13d3:3612 to the quirks_table. + +This ID pair is found in the Realtek RTL8852CE PCIe module +in an ASUS TUF A14 2025 (FA401KM) laptop. + +Tested on aforementioned laptop. + +The device info from /sys/kernel/debug/usb/devices is listed as below. + +T: Bus=03 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 +D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=13d3 ProdID=3612 Rev= 0.00 +S: Manufacturer=Realtek +S: Product=Bluetooth Radio +S: SerialNumber=00e04c000001 +C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms + +Signed-off-by: Shell Chen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index eaeacdadb2023..5381fa17d5e89 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -548,6 +548,8 @@ static const struct usb_device_id quirks_table[] = { + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x13d3, 0x3592), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, ++ { USB_DEVICE(0x13d3, 0x3612), .driver_info = BTUSB_REALTEK | ++ BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0489, 0xe122), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, + +-- +2.51.0 + diff --git a/queue-6.6/bluetooth-hci_conn-set-link_policy-on-incoming-acl-c.patch b/queue-6.6/bluetooth-hci_conn-set-link_policy-on-incoming-acl-c.patch new file mode 100644 index 00000000000..bef313be4ab --- /dev/null +++ b/queue-6.6/bluetooth-hci_conn-set-link_policy-on-incoming-acl-c.patch @@ -0,0 +1,54 @@ +From 3f9baf0e0e4f21c236a14774ddcd66696710f302 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 10:20:10 +0100 +Subject: Bluetooth: hci_conn: Set link_policy on incoming ACL connections +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stefan Sørensen + +[ Upstream commit 4bb091013ab0f2edfed3f58bebe658a798cbcc4d ] + +The connection link policy is only set when establishing an outgoing +ACL connection causing connection idle modes not to be available on +incoming connections. Move the setting of the link policy to the +creation of the connection so all ACL connection will use the link +policy set on the HCI device. + +Signed-off-by: Stefan Sørensen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_conn.c | 1 + + net/bluetooth/hci_sync.c | 2 -- + 2 files changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index ff9d2520ba749..a7a37dfa47d5a 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -951,6 +951,7 @@ static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t + switch (type) { + case ACL_LINK: + conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK; ++ conn->link_policy = hdev->link_policy; + conn->mtu = hdev->acl_mtu; + break; + case LE_LINK: +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index f0eb52d5c0581..6a14f76071077 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -6860,8 +6860,6 @@ static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data) + + conn->attempt++; + +- conn->link_policy = hdev->link_policy; +- + memset(&cp, 0, sizeof(cp)); + bacpy(&cp.bdaddr, &conn->dst); + cp.pscan_rep_mode = 0x02; +-- +2.51.0 + diff --git a/queue-6.6/bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch b/queue-6.6/bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch new file mode 100644 index 00000000000..92d0fd8ce3a --- /dev/null +++ b/queue-6.6/bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch @@ -0,0 +1,46 @@ +From a39be69ef613374eeb59eb0f4a3313380784d4df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 10:20:09 +0100 +Subject: Bluetooth: hci_conn: use mod_delayed_work for active mode timeout +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stefan Sørensen + +[ Upstream commit 49d0901e260739de2fcc90c0c29f9e31e39a2d9b ] + +hci_conn_enter_active_mode() uses queue_delayed_work() with the +intention that the work will run after the given timeout. However, +queue_delayed_work() does nothing if the work is already queued, so +depending on the link policy we may end up putting the connection +into idle mode every hdev->idle_timeout ms. + +Use mod_delayed_work() instead so the work is queued if not already +queued, and the timeout is updated otherwise. + +Signed-off-by: Stefan Sørensen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_conn.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index a7a37dfa47d5a..30feeaf7e6424 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -2518,8 +2518,8 @@ void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active) + + timer: + if (hdev->idle_timeout > 0) +- queue_delayed_work(hdev->workqueue, &conn->idle_work, +- msecs_to_jiffies(hdev->idle_timeout)); ++ mod_delayed_work(hdev->workqueue, &conn->idle_work, ++ msecs_to_jiffies(hdev->idle_timeout)); + } + + /* Drop all connection on the device */ +-- +2.51.0 + diff --git a/queue-6.6/bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch b/queue-6.6/bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch new file mode 100644 index 00000000000..6fb53e9893c --- /dev/null +++ b/queue-6.6/bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch @@ -0,0 +1,72 @@ +From a414212c48c22f36bae0506e0c60960a83f99ad5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 18:02:19 +0000 +Subject: bpf: verifier improvement in 32bit shift sign extension pattern + +From: Cupertino Miranda + +[ Upstream commit d18dec4b8990048ce75f0ece32bb96b3fbd3f422 ] + +This patch improves the verifier to correctly compute bounds for +sign extension compiler pattern composed of left shift by 32bits +followed by a sign right shift by 32bits. Pattern in the verifier was +limitted to positive value bounds and would reset bound computation for +negative values. New code allows both positive and negative values for +sign extension without compromising bound computation and verifier to +pass. + +This change is required by GCC which generate such pattern, and was +detected in the context of systemd, as described in the following GCC +bugzilla: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119731 + +Three new tests were added in verifier_subreg.c. + +Signed-off-by: Cupertino Miranda +Signed-off-by: Andrew Pinski +Acked-by: Eduard Zingerman +Cc: David Faust +Cc: Jose Marchesi +Cc: Elena Zannoni +Link: https://lore.kernel.org/r/20251202180220.11128-2-cupertino.miranda@oracle.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 18 +++++++----------- + 1 file changed, 7 insertions(+), 11 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 45b2f06de452c..4af7c96f6985d 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -13136,21 +13136,17 @@ static void __scalar64_min_max_lsh(struct bpf_reg_state *dst_reg, + u64 umin_val, u64 umax_val) + { + /* Special case <<32 because it is a common compiler pattern to sign +- * extend subreg by doing <<32 s>>32. In this case if 32bit bounds are +- * positive we know this shift will also be positive so we can track +- * bounds correctly. Otherwise we lose all sign bit information except +- * what we can pick up from var_off. Perhaps we can generalize this +- * later to shifts of any length. ++ * extend subreg by doing <<32 s>>32. smin/smax assignments are correct ++ * because s32 bounds don't flip sign when shifting to the left by ++ * 32bits. + */ +- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_max_value >= 0) ++ if (umin_val == 32 && umax_val == 32) { + dst_reg->smax_value = (s64)dst_reg->s32_max_value << 32; +- else +- dst_reg->smax_value = S64_MAX; +- +- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_min_value >= 0) + dst_reg->smin_value = (s64)dst_reg->s32_min_value << 32; +- else ++ } else { ++ dst_reg->smax_value = S64_MAX; + dst_reg->smin_value = S64_MIN; ++ } + + /* If we might shift our top bit out, then we know nothing */ + if (dst_reg->umax_value > 1ULL << (63 - umax_val)) { +-- +2.51.0 + diff --git a/queue-6.6/btrfs-handle-user-interrupt-properly-in-btrfs_trim_f.patch b/queue-6.6/btrfs-handle-user-interrupt-properly-in-btrfs_trim_f.patch new file mode 100644 index 00000000000..c8c00f809fa --- /dev/null +++ b/queue-6.6/btrfs-handle-user-interrupt-properly-in-btrfs_trim_f.patch @@ -0,0 +1,76 @@ +From f3378b78e1dd6732716d620ba03fb9a1b44955c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 07:06:40 +0000 +Subject: btrfs: handle user interrupt properly in btrfs_trim_fs() + +From: jinbaohong + +[ Upstream commit bfb670b9183b0e4ba660aff2e396ec1cc01d0761 ] + +When a fatal signal is pending or the process is freezing, +btrfs_trim_block_group() and btrfs_trim_free_extents() return -ERESTARTSYS. +Currently this is treated as a regular error: the loops continue to the +next iteration and count it as a block group or device failure. + +Instead, break out of the loops immediately and return -ERESTARTSYS to +userspace without counting it as a failure. Also skip the device loop +entirely if the block group loop was interrupted. + +Reviewed-by: Qu Wenruo +Signed-off-by: Robbie Ko +Signed-off-by: jinbaohong +Reviewed-by: Filipe Manana +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/extent-tree.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 5e3d1a87b7e9d..8f9d2392dc5a4 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -6196,6 +6196,10 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range) + range->minlen); + + trimmed += group_trimmed; ++ if (ret == -ERESTARTSYS || ret == -EINTR) { ++ btrfs_put_block_group(cache); ++ break; ++ } + if (ret) { + bg_failed++; + bg_ret = ret; +@@ -6209,6 +6213,9 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range) + "failed to trim %llu block group(s), last error %d", + bg_failed, bg_ret); + ++ if (ret == -ERESTARTSYS || ret == -EINTR) ++ return ret; ++ + mutex_lock(&fs_devices->device_list_mutex); + list_for_each_entry(device, &fs_devices->devices, dev_list) { + if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state)) +@@ -6217,6 +6224,8 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range) + ret = btrfs_trim_free_extents(device, &group_trimmed); + + trimmed += group_trimmed; ++ if (ret == -ERESTARTSYS || ret == -EINTR) ++ break; + if (ret) { + dev_failed++; + dev_ret = ret; +@@ -6230,6 +6239,8 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range) + "failed to trim %llu device(s), last error %d", + dev_failed, dev_ret); + range->len = trimmed; ++ if (ret == -ERESTARTSYS || ret == -EINTR) ++ return ret; + if (bg_ret) + return bg_ret; + return dev_ret; +-- +2.51.0 + diff --git a/queue-6.6/btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch b/queue-6.6/btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch new file mode 100644 index 00000000000..e1a2768ab1f --- /dev/null +++ b/queue-6.6/btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch @@ -0,0 +1,46 @@ +From 9fc0a1239153213541674b0b09500b03c6bff804 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 22:53:57 +0530 +Subject: btrfs: replace BUG() with error handling in __btrfs_balance() + +From: Adarsh Das + +[ Upstream commit be6324a809dbda76d5fdb23720ad9b20e5c1905c ] + +We search with offset (u64)-1 which should never match exactly. +Previously this was handled with BUG(). Now logs an error +and return -EUCLEAN. + +Reviewed-by: Qu Wenruo +Signed-off-by: Adarsh Das +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/volumes.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 8207b0b4c43a0..6ce083a6ed61f 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -3980,8 +3980,14 @@ static int __btrfs_balance(struct btrfs_fs_info *fs_info) + * this shouldn't happen, it means the last relocate + * failed + */ +- if (ret == 0) +- BUG(); /* FIXME break ? */ ++ if (unlikely(ret == 0)) { ++ btrfs_err(fs_info, ++ "unexpected exact match of CHUNK_ITEM in chunk tree, offset 0x%llx", ++ key.offset); ++ mutex_unlock(&fs_info->reclaim_bgs_lock); ++ ret = -EUCLEAN; ++ goto error; ++ } + + ret = btrfs_previous_item(chunk_root, path, 0, + BTRFS_CHUNK_ITEM_KEY); +-- +2.51.0 + diff --git a/queue-6.6/ceph-supply-snapshot-context-in-ceph_uninline_data.patch b/queue-6.6/ceph-supply-snapshot-context-in-ceph_uninline_data.patch new file mode 100644 index 00000000000..aa171905185 --- /dev/null +++ b/queue-6.6/ceph-supply-snapshot-context-in-ceph_uninline_data.patch @@ -0,0 +1,127 @@ +From 23df5e56ee1922c45ff1840763d39efc54ea54a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 18:42:06 +0800 +Subject: ceph: supply snapshot context in ceph_uninline_data() + +From: ethanwu + +[ Upstream commit 305ff6b3a03c230d3c07b61457e961406d979693 ] + +The ceph_uninline_data function was missing proper snapshot context +handling for its OSD write operations. Both CEPH_OSD_OP_CREATE and +CEPH_OSD_OP_WRITE requests were passing NULL instead of the appropriate +snapshot context, which could lead to unnecessary object clone. + +Reproducer: +../src/vstart.sh --new -x --localhost --bluestore +// turn on cephfs inline data +./bin/ceph fs set a inline_data true --yes-i-really-really-mean-it +// allow fs_a client to take snapshot +./bin/ceph auth caps client.fs_a mds 'allow rwps fsname=a' mon 'allow r fsname=a' osd 'allow rw tag cephfs data=a' +// mount cephfs with fuse, since kernel cephfs doesn't support inline write +ceph-fuse --id fs_a -m 127.0.0.1:40318 --conf ceph.conf -d /mnt/mycephfs/ +// bump snapshot seq +mkdir /mnt/mycephfs/.snap/snap1 +echo "foo" > /mnt/mycephfs/test +// umount and mount it again using kernel cephfs client +umount /mnt/mycephfs +mount -t ceph fs_a@.a=/ /mnt/mycephfs/ -o conf=./ceph.conf +echo "bar" >> /mnt/mycephfs/test +./bin/rados listsnaps -p cephfs.a.data $(printf "%x\n" $(stat -c %i /mnt/mycephfs/test)).00000000 + +will see this object does unnecessary clone +1000000000a.00000000 (seq:2): +cloneid snaps size overlap +2 2 4 [] +head - 8 + +but it's expected to see +10000000000.00000000 (seq:2): +cloneid snaps size overlap +head - 8 + +since there's no snapshot between these 2 writes + +clone happened because the first osd request CEPH_OSD_OP_CREATE doesn't +pass snap context so object is created with snap seq 0, but later data +writeback is equipped with snapshot context. +snap.seq(1) > object snap seq(0), so osd does object clone. + +This fix properly acquiring the snapshot context before performing +write operations. + +Signed-off-by: ethanwu +Reviewed-by: Viacheslav Dubeyko +Tested-by: Viacheslav Dubeyko +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/addr.c | 24 ++++++++++++++++++++++-- + 1 file changed, 22 insertions(+), 2 deletions(-) + +diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c +index 2c92de964c5a2..db4d11604e9d5 100644 +--- a/fs/ceph/addr.c ++++ b/fs/ceph/addr.c +@@ -1833,6 +1833,7 @@ int ceph_uninline_data(struct file *file) + struct ceph_osd_request *req = NULL; + struct ceph_cap_flush *prealloc_cf = NULL; + struct folio *folio = NULL; ++ struct ceph_snap_context *snapc = NULL; + u64 inline_version = CEPH_INLINE_NONE; + struct page *pages[1]; + int err = 0; +@@ -1860,6 +1861,24 @@ int ceph_uninline_data(struct file *file) + if (inline_version == 1) /* initial version, no data */ + goto out_uninline; + ++ down_read(&fsc->mdsc->snap_rwsem); ++ spin_lock(&ci->i_ceph_lock); ++ if (__ceph_have_pending_cap_snap(ci)) { ++ struct ceph_cap_snap *capsnap = ++ list_last_entry(&ci->i_cap_snaps, ++ struct ceph_cap_snap, ++ ci_item); ++ snapc = ceph_get_snap_context(capsnap->context); ++ } else { ++ if (!ci->i_head_snapc) { ++ ci->i_head_snapc = ceph_get_snap_context( ++ ci->i_snap_realm->cached_context); ++ } ++ snapc = ceph_get_snap_context(ci->i_head_snapc); ++ } ++ spin_unlock(&ci->i_ceph_lock); ++ up_read(&fsc->mdsc->snap_rwsem); ++ + folio = read_mapping_folio(inode->i_mapping, 0, file); + if (IS_ERR(folio)) { + err = PTR_ERR(folio); +@@ -1875,7 +1894,7 @@ int ceph_uninline_data(struct file *file) + req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout, + ceph_vino(inode), 0, &len, 0, 1, + CEPH_OSD_OP_CREATE, CEPH_OSD_FLAG_WRITE, +- NULL, 0, 0, false); ++ snapc, 0, 0, false); + if (IS_ERR(req)) { + err = PTR_ERR(req); + goto out_unlock; +@@ -1891,7 +1910,7 @@ int ceph_uninline_data(struct file *file) + req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout, + ceph_vino(inode), 0, &len, 1, 3, + CEPH_OSD_OP_WRITE, CEPH_OSD_FLAG_WRITE, +- NULL, ci->i_truncate_seq, ++ snapc, ci->i_truncate_seq, + ci->i_truncate_size, false); + if (IS_ERR(req)) { + err = PTR_ERR(req); +@@ -1954,6 +1973,7 @@ int ceph_uninline_data(struct file *file) + folio_put(folio); + } + out: ++ ceph_put_snap_context(snapc); + ceph_free_cap_flush(prealloc_cf); + dout("uninline_data %p %llx.%llx inline_version %llu = %d\n", + inode, ceph_vinop(inode), inline_version, err); +-- +2.51.0 + diff --git a/queue-6.6/char-tpm-cr50-remove-irqf_oneshot.patch b/queue-6.6/char-tpm-cr50-remove-irqf_oneshot.patch new file mode 100644 index 00000000000..0577458a855 --- /dev/null +++ b/queue-6.6/char-tpm-cr50-remove-irqf_oneshot.patch @@ -0,0 +1,59 @@ +From 8938fbfe24fb3c2e5db94ce29dc1d97db4cb8c59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:29 +0100 +Subject: char: tpm: cr50: Remove IRQF_ONESHOT + +From: Sebastian Andrzej Siewior + +[ Upstream commit 1affd29ffbd50125a5492c6be1dbb1f04be18d4f ] + +Passing IRQF_ONESHOT ensures that the interrupt source is masked until +the secondary (threaded) handler is done. If only a primary handler is +used then the flag makes no sense because the interrupt can not fire +(again) while its handler is running. + +The flag also prevents force-threading of the primary handler and the +irq-core will warn about this. + +Remove IRQF_ONESHOT from irqflags. + +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Thomas Gleixner +Reviewed-by: Jarkko Sakkinen +Link: https://patch.msgid.link/20260128095540.863589-10-bigeasy@linutronix.de +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_i2c_cr50.c | 3 +-- + drivers/char/tpm/tpm_tis_spi_cr50.c | 2 +- + 2 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_i2c_cr50.c b/drivers/char/tpm/tpm_tis_i2c_cr50.c +index e70abd69e1ae3..0f589f301e5bb 100644 +--- a/drivers/char/tpm/tpm_tis_i2c_cr50.c ++++ b/drivers/char/tpm/tpm_tis_i2c_cr50.c +@@ -713,8 +713,7 @@ static int tpm_cr50_i2c_probe(struct i2c_client *client) + + if (client->irq > 0) { + rc = devm_request_irq(dev, client->irq, tpm_cr50_i2c_int_handler, +- IRQF_TRIGGER_FALLING | IRQF_ONESHOT | +- IRQF_NO_AUTOEN, ++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN, + dev->driver->name, chip); + if (rc < 0) { + dev_err(dev, "Failed to probe IRQ %d\n", client->irq); +diff --git a/drivers/char/tpm/tpm_tis_spi_cr50.c b/drivers/char/tpm/tpm_tis_spi_cr50.c +index f4937280e9406..32920b4cecfb4 100644 +--- a/drivers/char/tpm/tpm_tis_spi_cr50.c ++++ b/drivers/char/tpm/tpm_tis_spi_cr50.c +@@ -287,7 +287,7 @@ int cr50_spi_probe(struct spi_device *spi) + if (spi->irq > 0) { + ret = devm_request_irq(&spi->dev, spi->irq, + cr50_spi_irq_handler, +- IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ IRQF_TRIGGER_RISING, + "cr50_spi", cr50_phy); + if (ret < 0) { + if (ret == -EPROBE_DEFER) +-- +2.51.0 + diff --git a/queue-6.6/clk-microchip-core-correct-return-value-on-_get_pare.patch b/queue-6.6/clk-microchip-core-correct-return-value-on-_get_pare.patch new file mode 100644 index 00000000000..680692572af --- /dev/null +++ b/queue-6.6/clk-microchip-core-correct-return-value-on-_get_pare.patch @@ -0,0 +1,80 @@ +From eb175365f9afbd619a494a8e124eaf58c845f40c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 14:46:28 -0500 +Subject: clk: microchip: core: correct return value on *_get_parent() + +From: Brian Masney + +[ Upstream commit 5df96d141cccb37f0c3112a22fc1112ea48e9246 ] + +roclk_get_parent() and sclk_get_parent() has the possibility of +returning -EINVAL, however the framework expects this call to always +succeed since the return value is unsigned. + +If there is no parent map defined, then the current value programmed in +the hardware is used. Let's use that same value in the case where +-EINVAL is currently returned. + +This index is only used by clk_core_get_parent_by_index(), and it +validates that it doesn't overflow the number of available parents. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202512050233.R9hAWsJN-lkp@intel.com/ +Signed-off-by: Brian Masney +Reviewed-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20251205-clk-microchip-fixes-v3-2-a02190705e47@redhat.com +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + drivers/clk/microchip/clk-core.c | 25 ++++++++++++------------- + 1 file changed, 12 insertions(+), 13 deletions(-) + +diff --git a/drivers/clk/microchip/clk-core.c b/drivers/clk/microchip/clk-core.c +index 1b4f023cdc8be..71fbaf8318f22 100644 +--- a/drivers/clk/microchip/clk-core.c ++++ b/drivers/clk/microchip/clk-core.c +@@ -281,14 +281,13 @@ static u8 roclk_get_parent(struct clk_hw *hw) + + v = (readl(refo->ctrl_reg) >> REFO_SEL_SHIFT) & REFO_SEL_MASK; + +- if (!refo->parent_map) +- return v; +- +- for (i = 0; i < clk_hw_get_num_parents(hw); i++) +- if (refo->parent_map[i] == v) +- return i; ++ if (refo->parent_map) { ++ for (i = 0; i < clk_hw_get_num_parents(hw); i++) ++ if (refo->parent_map[i] == v) ++ return i; ++ } + +- return -EINVAL; ++ return v; + } + + static unsigned long roclk_calc_rate(unsigned long parent_rate, +@@ -823,13 +822,13 @@ static u8 sclk_get_parent(struct clk_hw *hw) + + v = (readl(sclk->mux_reg) >> OSC_CUR_SHIFT) & OSC_CUR_MASK; + +- if (!sclk->parent_map) +- return v; ++ if (sclk->parent_map) { ++ for (i = 0; i < clk_hw_get_num_parents(hw); i++) ++ if (sclk->parent_map[i] == v) ++ return i; ++ } + +- for (i = 0; i < clk_hw_get_num_parents(hw); i++) +- if (sclk->parent_map[i] == v) +- return i; +- return -EINVAL; ++ return v; + } + + static int sclk_set_parent(struct clk_hw *hw, u8 index) +-- +2.51.0 + diff --git a/queue-6.6/clocksource-drivers-sh_tmu-always-leave-device-runni.patch b/queue-6.6/clocksource-drivers-sh_tmu-always-leave-device-runni.patch new file mode 100644 index 00000000000..378d4e50040 --- /dev/null +++ b/queue-6.6/clocksource-drivers-sh_tmu-always-leave-device-runni.patch @@ -0,0 +1,149 @@ +From 2572715e988dca357b0dac0b1e675a7b69a614f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 23:13:41 +0100 +Subject: clocksource/drivers/sh_tmu: Always leave device running after probe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Niklas Söderlund + +[ Upstream commit b1278972b08e480990e2789bdc6a7c918bc349be ] + +The TMU device can be used as both a clocksource and a clockevent +provider. The driver tries to be smart and power itself on and off, as +well as enabling and disabling its clock when it's not in operation. +This behavior is slightly altered if the TMU is used as an early +platform device in which case the device is left powered on after probe, +but the clock is still enabled and disabled at runtime. + +This has worked for a long time, but recent improvements in PREEMPT_RT +and PROVE_LOCKING have highlighted an issue. As the TMU registers itself +as a clockevent provider, clockevents_register_device(), it needs to use +raw spinlocks internally as this is the context of which the clockevent +framework interacts with the TMU driver. However in the context of +holding a raw spinlock the TMU driver can't really manage its power +state or clock with calls to pm_runtime_*() and clk_*() as these calls +end up in other platform drivers using regular spinlocks to control +power and clocks. + +This mix of spinlock contexts trips a lockdep warning. + + ============================= + [ BUG: Invalid wait context ] + 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 Not tainted + ----------------------------- + swapper/0/0 is trying to lock: + ffff000008c9e180 (&dev->power.lock){-...}-{3:3}, at: __pm_runtime_resume+0x38/0x88 + other info that might help us debug this: + context-{5:5} + 1 lock held by swapper/0/0: + ccree e6601000.crypto: ARM CryptoCell 630P Driver: HW version 0xAF400001/0xDCC63000, Driver version 5.0 + #0: ffff8000817ec298 + ccree e6601000.crypto: ARM ccree device initialized + (tick_broadcast_lock){-...}-{2:2}, at: __tick_broadcast_oneshot_control+0xa4/0x3a8 + stack backtrace: + CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 PREEMPT + Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT) + Call trace: + show_stack+0x14/0x1c (C) + dump_stack_lvl+0x6c/0x90 + dump_stack+0x14/0x1c + __lock_acquire+0x904/0x1584 + lock_acquire+0x220/0x34c + _raw_spin_lock_irqsave+0x58/0x80 + __pm_runtime_resume+0x38/0x88 + sh_tmu_clock_event_set_oneshot+0x84/0xd4 + clockevents_switch_state+0xfc/0x13c + tick_broadcast_set_event+0x30/0xa4 + __tick_broadcast_oneshot_control+0x1e0/0x3a8 + tick_broadcast_oneshot_control+0x30/0x40 + cpuidle_enter_state+0x40c/0x680 + cpuidle_enter+0x30/0x40 + do_idle+0x1f4/0x280 + cpu_startup_entry+0x34/0x40 + kernel_init+0x0/0x130 + do_one_initcall+0x0/0x230 + __primary_switched+0x88/0x90 + +For non-PREEMPT_RT builds this is not really an issue, but for +PREEMPT_RT builds where normal spinlocks can sleep this might be an +issue. Be cautious and always leave the power and clock running after +probe. + +Signed-off-by: Niklas Söderlund +Signed-off-by: Daniel Lezcano +Tested-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20251202221341.1856773-1-niklas.soderlund+renesas@ragnatech.se +Signed-off-by: Sasha Levin +--- + drivers/clocksource/sh_tmu.c | 18 ------------------ + 1 file changed, 18 deletions(-) + +diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c +index beffff81c00f3..3fc6ed9b56300 100644 +--- a/drivers/clocksource/sh_tmu.c ++++ b/drivers/clocksource/sh_tmu.c +@@ -143,16 +143,6 @@ static void sh_tmu_start_stop_ch(struct sh_tmu_channel *ch, int start) + + static int __sh_tmu_enable(struct sh_tmu_channel *ch) + { +- int ret; +- +- /* enable clock */ +- ret = clk_enable(ch->tmu->clk); +- if (ret) { +- dev_err(&ch->tmu->pdev->dev, "ch%u: cannot enable clock\n", +- ch->index); +- return ret; +- } +- + /* make sure channel is disabled */ + sh_tmu_start_stop_ch(ch, 0); + +@@ -174,7 +164,6 @@ static int sh_tmu_enable(struct sh_tmu_channel *ch) + if (ch->enable_count++ > 0) + return 0; + +- pm_runtime_get_sync(&ch->tmu->pdev->dev); + dev_pm_syscore_device(&ch->tmu->pdev->dev, true); + + return __sh_tmu_enable(ch); +@@ -187,9 +176,6 @@ static void __sh_tmu_disable(struct sh_tmu_channel *ch) + + /* disable interrupts in TMU block */ + sh_tmu_write(ch, TCR, TCR_TPSC_CLK4); +- +- /* stop clock */ +- clk_disable(ch->tmu->clk); + } + + static void sh_tmu_disable(struct sh_tmu_channel *ch) +@@ -203,7 +189,6 @@ static void sh_tmu_disable(struct sh_tmu_channel *ch) + __sh_tmu_disable(ch); + + dev_pm_syscore_device(&ch->tmu->pdev->dev, false); +- pm_runtime_put(&ch->tmu->pdev->dev); + } + + static void sh_tmu_set_next(struct sh_tmu_channel *ch, unsigned long delta, +@@ -552,7 +537,6 @@ static int sh_tmu_setup(struct sh_tmu_device *tmu, struct platform_device *pdev) + goto err_clk_unprepare; + + tmu->rate = clk_get_rate(tmu->clk) / 4; +- clk_disable(tmu->clk); + + /* Map the memory resource. */ + ret = sh_tmu_map_memory(tmu); +@@ -626,8 +610,6 @@ static int sh_tmu_probe(struct platform_device *pdev) + out: + if (tmu->has_clockevent || tmu->has_clocksource) + pm_runtime_irq_safe(&pdev->dev); +- else +- pm_runtime_idle(&pdev->dev); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.6/clocksource-drivers-timer-integrator-ap-add-missing-.patch b/queue-6.6/clocksource-drivers-timer-integrator-ap-add-missing-.patch new file mode 100644 index 00000000000..8f16a03aab2 --- /dev/null +++ b/queue-6.6/clocksource-drivers-timer-integrator-ap-add-missing-.patch @@ -0,0 +1,38 @@ +From a778f17367d213b95dd8f8890a7e094aac9a2c6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jan 2026 12:17:23 +0100 +Subject: clocksource/drivers/timer-integrator-ap: Add missing Kconfig + dependency on OF + +From: Bartosz Golaszewski + +[ Upstream commit 2246464821e2820572e6feefca2029f17629cc50 ] + +This driver accesses the of_aliases global variable declared in +linux/of.h and defined in drivers/base/of.c. It requires OF support or +will cause a link failure. Add the missing Kconfig dependency. + +Closes: https://lore.kernel.org/oe-kbuild-all/202601152233.og6LdeUo-lkp@intel.com/ +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Daniel Lezcano +Link: https://patch.msgid.link/20260116111723.10585-1-bartosz.golaszewski@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/clocksource/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig +index 8208a3d895634..5b526b74e5dee 100644 +--- a/drivers/clocksource/Kconfig ++++ b/drivers/clocksource/Kconfig +@@ -236,6 +236,7 @@ config KEYSTONE_TIMER + + config INTEGRATOR_AP_TIMER + bool "Integrator-AP timer driver" if COMPILE_TEST ++ depends on OF + select CLKSRC_MMIO + help + Enables support for the Integrator-AP timer. +-- +2.51.0 + diff --git a/queue-6.6/cpufreq-dt-platdev-block-the-driver-from-probing-on-.patch b/queue-6.6/cpufreq-dt-platdev-block-the-driver-from-probing-on-.patch new file mode 100644 index 00000000000..76ceaff645c --- /dev/null +++ b/queue-6.6/cpufreq-dt-platdev-block-the-driver-from-probing-on-.patch @@ -0,0 +1,39 @@ +From b91ed55c59dfd7fe01be661f126fc792d1f3d24c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 16:25:35 +0100 +Subject: cpufreq: dt-platdev: Block the driver from probing on more QC + platforms + +From: Konrad Dybcio + +[ Upstream commit 7b781899072c5701ef9538c365757ee9ab9c00bd ] + +Add a number of QC platforms to the blocklist, they all use either the +qcom-cpufreq-hw driver. + +Signed-off-by: Konrad Dybcio +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq-dt-platdev.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c +index 8b53388280d73..ad4f23e2158be 100644 +--- a/drivers/cpufreq/cpufreq-dt-platdev.c ++++ b/drivers/cpufreq/cpufreq-dt-platdev.c +@@ -158,8 +158,11 @@ static const struct of_device_id blocklist[] __initconst = { + { .compatible = "qcom,sdm845", }, + { .compatible = "qcom,sdx75", }, + { .compatible = "qcom,sm6115", }, ++ { .compatible = "qcom,sm6125", }, ++ { .compatible = "qcom,sm6150", }, + { .compatible = "qcom,sm6350", }, + { .compatible = "qcom,sm6375", }, ++ { .compatible = "qcom,sm7125", }, + { .compatible = "qcom,sm7225", }, + { .compatible = "qcom,sm8150", }, + { .compatible = "qcom,sm8250", }, +-- +2.51.0 + diff --git a/queue-6.6/crypto-hisilicon-qm-move-the-barrier-before-writing-.patch b/queue-6.6/crypto-hisilicon-qm-move-the-barrier-before-writing-.patch new file mode 100644 index 00000000000..9557d387cdb --- /dev/null +++ b/queue-6.6/crypto-hisilicon-qm-move-the-barrier-before-writing-.patch @@ -0,0 +1,45 @@ +From f58855f435dd61f7e37a78caf7fe19291df9382f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jan 2026 18:18:03 +0800 +Subject: crypto: hisilicon/qm - move the barrier before writing to the mailbox + register + +From: Chenghai Huang + +[ Upstream commit ebf35d8f9368816c930f5d70783a72716fab5e19 ] + +Before sending the data via the mailbox to the hardware, to ensure +that the data accessed by the hardware is the most up-to-date, +a write barrier should be added before writing to the mailbox register. +The current memory barrier is placed after writing to the register, +the barrier order should be modified to be before writing to the register. + +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/qm.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c +index 2c0ca68914e2f..e09357fea057c 100644 +--- a/drivers/crypto/hisilicon/qm.c ++++ b/drivers/crypto/hisilicon/qm.c +@@ -633,9 +633,13 @@ static void qm_mb_write(struct hisi_qm *qm, const void *src) + } + + #if IS_ENABLED(CONFIG_ARM64) ++ /* ++ * The dmb oshst instruction ensures that the data in the ++ * mailbox is written before it is sent to the hardware. ++ */ + asm volatile("ldp %0, %1, %3\n" +- "stp %0, %1, %2\n" + "dmb oshst\n" ++ "stp %0, %1, %2\n" + : "=&r" (tmp0), + "=&r" (tmp1), + "+Q" (*((char __iomem *)fun_base)) +-- +2.51.0 + diff --git a/queue-6.6/dm-remove-fake-timeout-to-avoid-leak-request.patch b/queue-6.6/dm-remove-fake-timeout-to-avoid-leak-request.patch new file mode 100644 index 00000000000..cbb718cb9f6 --- /dev/null +++ b/queue-6.6/dm-remove-fake-timeout-to-avoid-leak-request.patch @@ -0,0 +1,86 @@ +From e6c21fc194b151447a476c4469a7b3a128403f42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Dec 2025 20:03:50 +0800 +Subject: dm: remove fake timeout to avoid leak request + +From: Ding Hui + +[ Upstream commit f3a9c95a15d2f4466acad5c68faeff79ca5e9f47 ] + +Since commit 15f73f5b3e59 ("blk-mq: move failure injection out of +blk_mq_complete_request"), drivers are responsible for calling +blk_should_fake_timeout() at appropriate code paths and opportunities. + +However, the dm driver does not implement its own timeout handler and +relies on the timeout handling of its slave devices. + +If an io-timeout-fail error is injected to a dm device, the request +will be leaked and never completed, causing tasks to hang indefinitely. + +Reproduce: +1. prepare dm which has iscsi slave device +2. inject io-timeout-fail to dm + echo 1 >/sys/class/block/dm-0/io-timeout-fail + echo 100 >/sys/kernel/debug/fail_io_timeout/probability + echo 10 >/sys/kernel/debug/fail_io_timeout/times +3. read/write dm +4. iscsiadm -m node -u + +Result: hang task like below +[ 862.243768] INFO: task kworker/u514:2:151 blocked for more than 122 seconds. +[ 862.244133] Tainted: G E 6.19.0-rc1+ #51 +[ 862.244337] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 862.244718] task:kworker/u514:2 state:D stack:0 pid:151 tgid:151 ppid:2 task_flags:0x4288060 flags:0x00080000 +[ 862.245024] Workqueue: iscsi_ctrl_3:1 __iscsi_unbind_session [scsi_transport_iscsi] +[ 862.245264] Call Trace: +[ 862.245587] +[ 862.245814] __schedule+0x810/0x15c0 +[ 862.246557] schedule+0x69/0x180 +[ 862.246760] blk_mq_freeze_queue_wait+0xde/0x120 +[ 862.247688] elevator_change+0x16d/0x460 +[ 862.247893] elevator_set_none+0x87/0xf0 +[ 862.248798] blk_unregister_queue+0x12e/0x2a0 +[ 862.248995] __del_gendisk+0x231/0x7e0 +[ 862.250143] del_gendisk+0x12f/0x1d0 +[ 862.250339] sd_remove+0x85/0x130 [sd_mod] +[ 862.250650] device_release_driver_internal+0x36d/0x530 +[ 862.250849] bus_remove_device+0x1dd/0x3f0 +[ 862.251042] device_del+0x38a/0x930 +[ 862.252095] __scsi_remove_device+0x293/0x360 +[ 862.252291] scsi_remove_target+0x486/0x760 +[ 862.252654] __iscsi_unbind_session+0x18a/0x3e0 [scsi_transport_iscsi] +[ 862.252886] process_one_work+0x633/0xe50 +[ 862.253101] worker_thread+0x6df/0xf10 +[ 862.253647] kthread+0x36d/0x720 +[ 862.254533] ret_from_fork+0x2a6/0x470 +[ 862.255852] ret_from_fork_asm+0x1a/0x30 +[ 862.256037] + +Remove the blk_should_fake_timeout() check from dm, as dm has no +native timeout handling and should not attempt to fake timeouts. + +Signed-off-by: Ding Hui +Reviewed-by: Christoph Hellwig +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + drivers/md/dm-rq.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c +index 499f8cc8a39fb..92d3d3de37ca6 100644 +--- a/drivers/md/dm-rq.c ++++ b/drivers/md/dm-rq.c +@@ -278,8 +278,7 @@ static void dm_complete_request(struct request *rq, blk_status_t error) + struct dm_rq_target_io *tio = tio_from_request(rq); + + tio->error = error; +- if (likely(!blk_should_fake_timeout(rq->q))) +- blk_mq_complete_request(rq); ++ blk_mq_complete_request(rq); + } + + /* +-- +2.51.0 + diff --git a/queue-6.6/dm-replace-eexist-with-ebusy.patch b/queue-6.6/dm-replace-eexist-with-ebusy.patch new file mode 100644 index 00000000000..20281edf740 --- /dev/null +++ b/queue-6.6/dm-replace-eexist-with-ebusy.patch @@ -0,0 +1,89 @@ +From 28c64d8bdccce6f8f404c86e29559809f6cd8631 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Dec 2025 04:49:37 +0100 +Subject: dm: replace -EEXIST with -EBUSY + +From: Daniel Gomez + +[ Upstream commit b13ef361d47f09b7aecd18e0383ecc83ff61057e ] + +The -EEXIST error code is reserved by the module loading infrastructure +to indicate that a module is already loaded. When a module's init +function returns -EEXIST, userspace tools like kmod interpret this as +"module already loaded" and treat the operation as successful, returning +0 to the user even though the module initialization actually failed. + +This follows the precedent set by commit 54416fd76770 ("netfilter: +conntrack: helper: Replace -EEXIST by -EBUSY") which fixed the same +issue in nf_conntrack_helper_register(). + +Affected modules: + * dm_cache dm_clone dm_integrity dm_mirror dm_multipath dm_pcache + * dm_vdo dm-ps-round-robin dm_historical_service_time dm_io_affinity + * dm_queue_length dm_service_time dm_snapshot + +Signed-off-by: Daniel Gomez +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + drivers/md/dm-exception-store.c | 2 +- + drivers/md/dm-log.c | 2 +- + drivers/md/dm-path-selector.c | 2 +- + drivers/md/dm-target.c | 2 +- + 4 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c +index c3799757bf4a0..88f119a0a2ae0 100644 +--- a/drivers/md/dm-exception-store.c ++++ b/drivers/md/dm-exception-store.c +@@ -116,7 +116,7 @@ int dm_exception_store_type_register(struct dm_exception_store_type *type) + if (!__find_exception_store_type(type->name)) + list_add(&type->list, &_exception_store_types); + else +- r = -EEXIST; ++ r = -EBUSY; + spin_unlock(&_lock); + + return r; +diff --git a/drivers/md/dm-log.c b/drivers/md/dm-log.c +index f7f9c2100937b..e215478bcee04 100644 +--- a/drivers/md/dm-log.c ++++ b/drivers/md/dm-log.c +@@ -121,7 +121,7 @@ int dm_dirty_log_type_register(struct dm_dirty_log_type *type) + if (!__find_dirty_log_type(type->name)) + list_add(&type->list, &_log_types); + else +- r = -EEXIST; ++ r = -EBUSY; + spin_unlock(&_lock); + + return r; +diff --git a/drivers/md/dm-path-selector.c b/drivers/md/dm-path-selector.c +index 3e4cb81ce512c..78f98545ca72d 100644 +--- a/drivers/md/dm-path-selector.c ++++ b/drivers/md/dm-path-selector.c +@@ -107,7 +107,7 @@ int dm_register_path_selector(struct path_selector_type *pst) + + if (__find_path_selector_type(pst->name)) { + kfree(psi); +- r = -EEXIST; ++ r = -EBUSY; + } else + list_add(&psi->list, &_path_selectors); + +diff --git a/drivers/md/dm-target.c b/drivers/md/dm-target.c +index 27e2992ff2492..4d1f04b40653f 100644 +--- a/drivers/md/dm-target.c ++++ b/drivers/md/dm-target.c +@@ -88,7 +88,7 @@ int dm_register_target(struct target_type *tt) + if (__find_target_type(tt->name)) { + DMERR("%s: '%s' target already registered", + __func__, tt->name); +- rv = -EEXIST; ++ rv = -EBUSY; + } else { + list_add(&tt->list, &_targets); + } +-- +2.51.0 + diff --git a/queue-6.6/dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch b/queue-6.6/dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch new file mode 100644 index 00000000000..8a800520e02 --- /dev/null +++ b/queue-6.6/dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch @@ -0,0 +1,51 @@ +From 505a91a1de60f7a3130358d8056a1533d8794734 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Dec 2025 09:15:03 +0100 +Subject: dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix + warnings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Le Goffic + +[ Upstream commit aaf3bc0265744adbc2d364964ef409cf118d193d ] + +m2m_hw_period is initialized only when chan_config->m2m_hw is true. This +triggers a warning: +‘m2m_hw_period’ may be used uninitialized [-Wmaybe-uninitialized] +Although m2m_hw_period is only used when chan_config->m2m_hw is true and +ignored otherwise, initialize it unconditionally to 0. + +ccr is initialized by stm32_mdma_set_xfer_param() when the sg list is not +empty. This triggers a warning: +‘ccr’ may be used uninitialized [-Wmaybe-uninitialized] +Indeed, it could be used uninitialized if the sg list is empty. Initialize +it to 0. + +Signed-off-by: Clément Le Goffic +Reviewed-by: Clément Le Goffic +Signed-off-by: Amelie Delaunay +Link: https://patch.msgid.link/20251217-mdma_warnings_fix-v2-1-340200e0bb55@foss.st.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/stm32-mdma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c +index f414efdbd809e..87956563cb1d3 100644 +--- a/drivers/dma/stm32-mdma.c ++++ b/drivers/dma/stm32-mdma.c +@@ -732,7 +732,7 @@ static int stm32_mdma_setup_xfer(struct stm32_mdma_chan *chan, + struct stm32_mdma_chan_config *chan_config = &chan->chan_config; + struct scatterlist *sg; + dma_addr_t src_addr, dst_addr; +- u32 m2m_hw_period, ccr, ctcr, ctbr; ++ u32 m2m_hw_period = 0, ccr = 0, ctcr, ctbr; + int i, ret = 0; + + if (chan_config->m2m_hw) +-- +2.51.0 + diff --git a/queue-6.6/dmaengine-sun6i-choose-appropriate-burst-length-unde.patch b/queue-6.6/dmaengine-sun6i-choose-appropriate-burst-length-unde.patch new file mode 100644 index 00000000000..5943dca963b --- /dev/null +++ b/queue-6.6/dmaengine-sun6i-choose-appropriate-burst-length-unde.patch @@ -0,0 +1,80 @@ +From e733149ce3194dde2d78db99b9152062bf600335 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Dec 2025 16:04:48 +0800 +Subject: dmaengine: sun6i: Choose appropriate burst length under maxburst + +From: Chen-Yu Tsai + +[ Upstream commit 7178c3586ab42693b28bb81014320a7783e5c435 ] + +maxburst, as provided by the client, specifies the largest amount of +data that is allowed to be transferred in one burst. This limit is +normally provided to avoid a data burst overflowing the target FIFO. +It does not mean that the DMA engine can only do bursts in that size. + +Let the driver pick the largest supported burst length within the +given limit. This lets the driver work correctly with some clients that +give a large maxburst value. In particular, the 8250_dw driver will give +a quarter of the UART's FIFO size as maxburst. On some systems the FIFO +size is 256 bytes, giving a maxburst of 64 bytes, while the hardware +only supports bursts of up to 16 bytes. + +Signed-off-by: Chen-Yu Tsai +Reviewed-by: Jernej Skrabec +Link: https://patch.msgid.link/20251221080450.1813479-1-wens@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/sun6i-dma.c | 26 ++++++++++++++++++++------ + 1 file changed, 20 insertions(+), 6 deletions(-) + +diff --git a/drivers/dma/sun6i-dma.c b/drivers/dma/sun6i-dma.c +index 2469efddf5401..6a384bd469528 100644 +--- a/drivers/dma/sun6i-dma.c ++++ b/drivers/dma/sun6i-dma.c +@@ -582,6 +582,22 @@ static irqreturn_t sun6i_dma_interrupt(int irq, void *dev_id) + return ret; + } + ++static u32 find_burst_size(const u32 burst_lengths, u32 maxburst) ++{ ++ if (!maxburst) ++ return 1; ++ ++ if (BIT(maxburst) & burst_lengths) ++ return maxburst; ++ ++ /* Hardware only does power-of-two bursts. */ ++ for (u32 burst = rounddown_pow_of_two(maxburst); burst > 0; burst /= 2) ++ if (BIT(burst) & burst_lengths) ++ return burst; ++ ++ return 1; ++} ++ + static int set_config(struct sun6i_dma_dev *sdev, + struct dma_slave_config *sconfig, + enum dma_transfer_direction direction, +@@ -615,15 +631,13 @@ static int set_config(struct sun6i_dma_dev *sdev, + return -EINVAL; + if (!(BIT(dst_addr_width) & sdev->slave.dst_addr_widths)) + return -EINVAL; +- if (!(BIT(src_maxburst) & sdev->cfg->src_burst_lengths)) +- return -EINVAL; +- if (!(BIT(dst_maxburst) & sdev->cfg->dst_burst_lengths)) +- return -EINVAL; + + src_width = convert_buswidth(src_addr_width); + dst_width = convert_buswidth(dst_addr_width); +- dst_burst = convert_burst(dst_maxburst); +- src_burst = convert_burst(src_maxburst); ++ src_burst = find_burst_size(sdev->cfg->src_burst_lengths, src_maxburst); ++ dst_burst = find_burst_size(sdev->cfg->dst_burst_lengths, dst_maxburst); ++ dst_burst = convert_burst(dst_burst); ++ src_burst = convert_burst(src_burst); + + *p_cfg = DMA_CHAN_CFG_SRC_WIDTH(src_width) | + DMA_CHAN_CFG_DST_WIDTH(dst_width); +-- +2.51.0 + diff --git a/queue-6.6/drm-account-property-blob-allocations-to-memcg.patch b/queue-6.6/drm-account-property-blob-allocations-to-memcg.patch new file mode 100644 index 00000000000..f89b3a1d509 --- /dev/null +++ b/queue-6.6/drm-account-property-blob-allocations-to-memcg.patch @@ -0,0 +1,46 @@ +From eaa622f798c193f02aa9fef8c6d41df67c970a13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jan 2026 08:22:26 -0500 +Subject: drm: Account property blob allocations to memcg + +From: Xiao Kan <814091656@qq.com> + +[ Upstream commit 26b4309a3ab82a0697751cde52eb336c29c19035 ] + +DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized +property blobs backed by kernel memory. + +Currently, the blob data allocation is not accounted to the allocating +process's memory cgroup, allowing unprivileged users to trigger unbounded +kernel memory consumption and potentially cause system-wide OOM. + +Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory +is properly charged to the caller's memcg. This ensures existing cgroup +memory limits apply and prevents uncontrolled kernel memory growth without +introducing additional policy or per-file limits. + +Signed-off-by: Xiao Kan <814091656@qq.com> +Signed-off-by: Xiao Kan +Link: https://patch.msgid.link/tencent_D12AA2DEDE6F359E1AF59405242FB7A5FD05@qq.com +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_property.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c +index dfec479830e49..b4ee7d4110f84 100644 +--- a/drivers/gpu/drm/drm_property.c ++++ b/drivers/gpu/drm/drm_property.c +@@ -561,7 +561,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length, + if (!length || length > INT_MAX - sizeof(struct drm_property_blob)) + return ERR_PTR(-EINVAL); + +- blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL); ++ blob = kvzalloc(sizeof(struct drm_property_blob) + length, GFP_KERNEL_ACCOUNT); + if (!blob) + return ERR_PTR(-ENOMEM); + +-- +2.51.0 + diff --git a/queue-6.6/drm-amd-display-avoid-updating-surface-with-the-same.patch b/queue-6.6/drm-amd-display-avoid-updating-surface-with-the-same.patch new file mode 100644 index 00000000000..afbfb333149 --- /dev/null +++ b/queue-6.6/drm-amd-display-avoid-updating-surface-with-the-same.patch @@ -0,0 +1,43 @@ +From 04ee48240351ec4766b1701307b899e629f472b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 14:47:01 +0800 +Subject: drm/amd/display: Avoid updating surface with the same surface under + MPO + +From: Wayne Lin + +[ Upstream commit 1a38ded4bc8ac09fd029ec656b1e2c98cc0d238c ] + +[Why & How] +Although it's dummy updates of surface update for committing stream +updates, we should not have dummy_updates[j].surface all indicating +to the same surface under multiple surfaces case. Otherwise, +copy_surface_update_to_plane() in update_planes_and_stream_state() +will update to the same surface only. + +Reviewed-by: Harry Wentland +Signed-off-by: Wayne Lin +Signed-off-by: Tom Chung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index faef07fdfd302..26047109726eb 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -8934,7 +8934,7 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state) + */ + dummy_updates = kzalloc(sizeof(struct dc_surface_update) * MAX_SURFACES, GFP_ATOMIC); + for (j = 0; j < status->plane_count; j++) +- dummy_updates[j].surface = status->plane_states[0]; ++ dummy_updates[j].surface = status->plane_states[j]; + + + mutex_lock(&dm->dc_lock); +-- +2.51.0 + diff --git a/queue-6.6/drm-amd-display-ensure-link-output-is-disabled-in-ba.patch b/queue-6.6/drm-amd-display-ensure-link-output-is-disabled-in-ba.patch new file mode 100644 index 00000000000..4e1cd1bc93d --- /dev/null +++ b/queue-6.6/drm-amd-display-ensure-link-output-is-disabled-in-ba.patch @@ -0,0 +1,59 @@ +From dbd867ccbedca73e627cb8733d7d5c5e6c70b216 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 11:11:19 -0500 +Subject: drm/amd/display: Ensure link output is disabled in backend reset for + PLL_ON + +From: Nicholas Kazlauskas + +[ Upstream commit 4589712e0111352973131bad975023b25569287c ] + +[Why] +We're missing the code to actually disable the link output when we have +to leave the SYMCLK_ON but the TX remains OFF. + +[How] +Port the code from DCN401 that detects SYMCLK_ON_TX_OFF and disable +the link output when the backend is reset. + +Reviewed-by: Ovidiu (Ovi) Bunea +Signed-off-by: Nicholas Kazlauskas +Signed-off-by: Matthew Stewart +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/dcn31/dcn31_hwseq.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hwseq.c +index 22da2007601ee..a782ffc5f4cf9 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hwseq.c +@@ -523,8 +523,22 @@ static void dcn31_reset_back_end_for_pipe( + if (pipe_ctx->stream_res.tg->funcs->set_odm_bypass) + pipe_ctx->stream_res.tg->funcs->set_odm_bypass( + pipe_ctx->stream_res.tg, &pipe_ctx->stream->timing); ++ /* ++ * TODO - convert symclk_ref_cnts for otg to a bit map to solve ++ * the case where the same symclk is shared across multiple otg ++ * instances ++ */ + if (dc_is_hdmi_tmds_signal(pipe_ctx->stream->signal)) +- pipe_ctx->stream->link->phy_state.symclk_ref_cnts.otg = 0; ++ link->phy_state.symclk_ref_cnts.otg = 0; ++ ++ if (pipe_ctx->top_pipe == NULL) { ++ if (link->phy_state.symclk_state == SYMCLK_ON_TX_OFF) { ++ const struct link_hwss *link_hwss = get_link_hwss(link, &pipe_ctx->link_res); ++ ++ link_hwss->disable_link_output(link, &pipe_ctx->link_res, pipe_ctx->stream->signal); ++ link->phy_state.symclk_state = SYMCLK_OFF_TX_OFF; ++ } ++ } + + if (pipe_ctx->stream_res.tg->funcs->set_drr) + pipe_ctx->stream_res.tg->funcs->set_drr( +-- +2.51.0 + diff --git a/queue-6.6/drm-amd-display-remove-conditional-for-shaper-3dlut-.patch b/queue-6.6/drm-amd-display-remove-conditional-for-shaper-3dlut-.patch new file mode 100644 index 00000000000..a0626089d4c --- /dev/null +++ b/queue-6.6/drm-amd-display-remove-conditional-for-shaper-3dlut-.patch @@ -0,0 +1,44 @@ +From f5147f8223067558045a12f11a5cbb5514af4241 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 22:05:16 -0700 +Subject: drm/amd/display: Remove conditional for shaper 3DLUT power-on + +From: Alex Hung + +[ Upstream commit 1b38a87b8f8020e8ef4563e7752a64182b5a39b9 ] + +[Why] +Shaper programming has high chance to fail on first time after +power-on or reboot. This can be verified by running IGT's kms_colorop. + +[How] +Always power on the shaper and 3DLUT before programming by +removing the debug flag of low power mode. + +Reviewed-by: Aurabindo Pillai +Signed-off-by: Alex Hung +Signed-off-by: Ray Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c +index 1d052f08aff5e..f20f0b2be4c7d 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c +@@ -716,8 +716,7 @@ bool mpc32_program_shaper( + return false; + } + +- if (mpc->ctx->dc->debug.enable_mem_low_power.bits.mpc) +- mpc32_power_on_shaper_3dlut(mpc, mpcc_id, true); ++ mpc32_power_on_shaper_3dlut(mpc, mpcc_id, true); + + current_mode = mpc32_get_shaper_current(mpc, mpcc_id); + +-- +2.51.0 + diff --git a/queue-6.6/drm-amdgpu-add-hainan-clock-adjustment.patch b/queue-6.6/drm-amdgpu-add-hainan-clock-adjustment.patch new file mode 100644 index 00000000000..acfa7e7a415 --- /dev/null +++ b/queue-6.6/drm-amdgpu-add-hainan-clock-adjustment.patch @@ -0,0 +1,39 @@ +From b2ff2c4fdef6b11778fd29ea3236ac4abafc5be0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Feb 2026 07:24:01 +0000 +Subject: drm/amdgpu: Add HAINAN clock adjustment + +From: decce6 + +[ Upstream commit 49fe2c57bdc0acff9d2551ae337270b6fd8119d9 ] + +This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from +850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This +patch is for amdgpu. + +Signed-off-by: decce6 +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index caf590caaf2c7..e759004046938 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -3449,6 +3449,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + max_sclk = 60000; + max_mclk = 80000; + } ++ if ((adev->pdev->device == 0x666f) && ++ (adev->pdev->revision == 0x00)) { ++ max_sclk = 80000; ++ max_mclk = 95000; ++ } + } else if (adev->asic_type == CHIP_OLAND) { + if ((adev->pdev->revision == 0xC7) || + (adev->pdev->revision == 0x80) || +-- +2.51.0 + diff --git a/queue-6.6/drm-amdgpu-add-support-for-hdp-ip-version-6.1.1.patch b/queue-6.6/drm-amdgpu-add-support-for-hdp-ip-version-6.1.1.patch new file mode 100644 index 00000000000..70d35ed0de8 --- /dev/null +++ b/queue-6.6/drm-amdgpu-add-support-for-hdp-ip-version-6.1.1.patch @@ -0,0 +1,34 @@ +From bda724c80ca8da8d66ceefa672d612146bce2cc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Dec 2024 10:46:47 +0800 +Subject: drm/amdgpu: add support for HDP IP version 6.1.1 + +From: Tim Huang + +[ Upstream commit e2fd14f579b841f54a9b7162fef15234d8c0627a ] + +This initializes HDP IP version 6.1.1. + +Reviewed-by: Mario Limonciello +Signed-off-by: Tim Huang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +index 2e492f779b54c..5c4aa5ff873b6 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +@@ -2491,6 +2491,7 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev) + case IP_VERSION(6, 0, 0): + case IP_VERSION(6, 0, 1): + case IP_VERSION(6, 1, 0): ++ case IP_VERSION(6, 1, 1): + adev->hdp.funcs = &hdp_v6_0_funcs; + break; + default: +-- +2.51.0 + diff --git a/queue-6.6/drm-amdgpu-adjust-usleep_range-in-fence-wait.patch b/queue-6.6/drm-amdgpu-adjust-usleep_range-in-fence-wait.patch new file mode 100644 index 00000000000..118150f7fca --- /dev/null +++ b/queue-6.6/drm-amdgpu-adjust-usleep_range-in-fence-wait.patch @@ -0,0 +1,38 @@ +From efffc39192b14cbc18a2b8cf5ef092d442121c7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Feb 2026 15:32:01 +0800 +Subject: drm/amdgpu: Adjust usleep_range in fence wait + +From: Ce Sun + +[ Upstream commit 3ee1c72606bd2842f0f377fd4b118362af0323ae ] + +Tune the sleep interval in the PSP fence wait loop from 10-100us to +60-100us.This adjustment results in an overall wait window of 1.2s +(60us * 20000 iterations) to 2 seconds (100us * 20000 iterations), +which guarantees that we can retrieve the correct fence value + +Signed-off-by: Ce Sun +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index 08886e0ee6428..2ef87646e6bb1 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -656,7 +656,7 @@ psp_cmd_submit_buf(struct psp_context *psp, + ras_intr = amdgpu_ras_intr_triggered(); + if (ras_intr) + break; +- usleep_range(10, 100); ++ usleep_range(60, 100); + amdgpu_device_invalidate_hdp(psp->adev, NULL); + } + +-- +2.51.0 + diff --git a/queue-6.6/drm-amdgpu-avoid-a-warning-in-timedout-job-handler.patch b/queue-6.6/drm-amdgpu-avoid-a-warning-in-timedout-job-handler.patch new file mode 100644 index 00000000000..18d7f4a504f --- /dev/null +++ b/queue-6.6/drm-amdgpu-avoid-a-warning-in-timedout-job-handler.patch @@ -0,0 +1,41 @@ +From 7c5f374ed6a015ecc0e8778f7af60ed53ed768f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Dec 2025 11:46:48 -0500 +Subject: drm/amdgpu: avoid a warning in timedout job handler +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +[ Upstream commit c8cf9ddc549fb93cb5a35f3fe23487b1e6707e74 ] + +Only set an error on the fence if the fence is not +signalled. We can end up with a warning if the +per queue reset path signals the fence and sets an error +as part of the reset, but fails to recover. + +Reviewed-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c +index e9adfc88a54ab..8175d831abd4d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c +@@ -65,7 +65,8 @@ static enum drm_gpu_sched_stat amdgpu_job_timedout(struct drm_sched_job *s_job) + DRM_ERROR("Process information: process %s pid %d thread %s pid %d\n", + ti.process_name, ti.tgid, ti.task_name, ti.pid); + +- dma_fence_set_error(&s_job->s_fence->finished, -ETIME); ++ if (dma_fence_get_status(&s_job->s_fence->finished) == 0) ++ dma_fence_set_error(&s_job->s_fence->finished, -ETIME); + + if (amdgpu_device_should_recover_gpu(ring->adev)) { + struct amdgpu_reset_context reset_context; +-- +2.51.0 + diff --git a/queue-6.6/drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch b/queue-6.6/drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch new file mode 100644 index 00000000000..fd7d7702612 --- /dev/null +++ b/queue-6.6/drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch @@ -0,0 +1,51 @@ +From d008452b5ab113a5617c9275033fb90645404b33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 19:36:56 +0530 +Subject: drm/amdkfd: Fix GART PTE for non-4K pagesize in + svm_migrate_gart_map() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Donet Tom + +[ Upstream commit 6c160001661b6c4e20f5c31909c722741e14c2d8 ] + +In svm_migrate_gart_map(), while migrating GART mapping, the number of +bytes copied for the GART table only accounts for CPU pages. On non-4K +systems, each CPU page can contain multiple GPU pages, and the GART +requires one 8-byte PTE per GPU page. As a result, an incorrect size was +passed to the DMA, causing only a partial update of the GART table. + +Fix this function to work correctly on non-4K page-size systems by +accounting for the number of GPU pages per CPU page when calculating the +number of bytes to be copied. + +Acked-by: Christian König +Reviewed-by: Philip Yang +Signed-off-by: Ritesh Harjani (IBM) +Signed-off-by: Donet Tom +Signed-off-by: Felix Kuehling +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +index f99e3b812ee44..59575e2424d07 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +@@ -62,7 +62,7 @@ svm_migrate_gart_map(struct amdgpu_ring *ring, uint64_t npages, + *gart_addr = adev->gmc.gart_start; + + num_dw = ALIGN(adev->mman.buffer_funcs->copy_num_dw, 8); +- num_bytes = npages * 8; ++ num_bytes = npages * 8 * AMDGPU_GPU_PAGES_IN_CPU_PAGE; + + r = amdgpu_job_alloc_with_ib(adev, &adev->mman.high_pr, + AMDGPU_FENCE_OWNER_UNDEFINED, +-- +2.51.0 + diff --git a/queue-6.6/drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch b/queue-6.6/drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch new file mode 100644 index 00000000000..37f2789c461 --- /dev/null +++ b/queue-6.6/drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch @@ -0,0 +1,73 @@ +From 87a3dbb602ce585d10c977c81759106975561ac4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Nov 2025 11:38:25 +0100 +Subject: drm/atmel-hlcdc: don't reject the commit if the src rect has + fractional parts +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ludovic Desroches + +[ Upstream commit 06682206e2a1883354ed758c09efeb51f435adbd ] + +Don’t reject the commit when the source rectangle has fractional parts. +This can occur due to scaling: drm_atomic_helper_check_plane_state() calls +drm_rect_clip_scaled(), which may introduce fractional parts while +computing the clipped source rectangle. This does not imply the commit is +invalid, so we should accept it instead of discarding it. + +Signed-off-by: Ludovic Desroches +Reviewed-by: Manikandan Muralidharan +Link: https://patch.msgid.link/20251120-lcd_scaling_fix-v1-1-5ffc98557923@microchip.com +Signed-off-by: Manikandan Muralidharan +Signed-off-by: Sasha Levin +--- + .../gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 19 ++++--------------- + 1 file changed, 4 insertions(+), 15 deletions(-) + +diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +index 390c4fc62af7c..ec4fe0de989d4 100644 +--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c ++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +@@ -78,8 +78,6 @@ drm_plane_state_to_atmel_hlcdc_plane_state(struct drm_plane_state *s) + return container_of(s, struct atmel_hlcdc_plane_state, base); + } + +-#define SUBPIXEL_MASK 0xffff +- + static uint32_t rgb_formats[] = { + DRM_FORMAT_C8, + DRM_FORMAT_XRGB4444, +@@ -619,24 +617,15 @@ static int atmel_hlcdc_plane_atomic_check(struct drm_plane *p, + if (ret || !s->visible) + return ret; + +- hstate->src_x = s->src.x1; +- hstate->src_y = s->src.y1; +- hstate->src_w = drm_rect_width(&s->src); +- hstate->src_h = drm_rect_height(&s->src); ++ hstate->src_x = s->src.x1 >> 16; ++ hstate->src_y = s->src.y1 >> 16; ++ hstate->src_w = drm_rect_width(&s->src) >> 16; ++ hstate->src_h = drm_rect_height(&s->src) >> 16; + hstate->crtc_x = s->dst.x1; + hstate->crtc_y = s->dst.y1; + hstate->crtc_w = drm_rect_width(&s->dst); + hstate->crtc_h = drm_rect_height(&s->dst); + +- if ((hstate->src_x | hstate->src_y | hstate->src_w | hstate->src_h) & +- SUBPIXEL_MASK) +- return -EINVAL; +- +- hstate->src_x >>= 16; +- hstate->src_y >>= 16; +- hstate->src_w >>= 16; +- hstate->src_h >>= 16; +- + hstate->nplanes = fb->format->num_planes; + if (hstate->nplanes > ATMEL_HLCDC_LAYER_MAX_PLANES) + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.6/drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch b/queue-6.6/drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch new file mode 100644 index 00000000000..e7162b9677d --- /dev/null +++ b/queue-6.6/drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch @@ -0,0 +1,61 @@ +From f4a0f9926a1b30361417c01ec8ea1902c038c5af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Oct 2025 18:14:52 +0200 +Subject: drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state + callback + +From: Ludovic Desroches + +[ Upstream commit f12352471061df83a36edf54bbb16284793284e4 ] + +After several commits, the slab memory increases. Some drm_crtc_commit +objects are not freed. The atomic_destroy_state callback only put the +framebuffer. Use the __drm_atomic_helper_plane_destroy_state() function +to put all the objects that are no longer needed. + +It has been seen after hours of usage of a graphics application or using +kmemleak: + +unreferenced object 0xc63a6580 (size 64): + comm "egt_basic", pid 171, jiffies 4294940784 + hex dump (first 32 bytes): + 40 50 34 c5 01 00 00 00 ff ff ff ff 8c 65 3a c6 @P4..........e:. + 8c 65 3a c6 ff ff ff ff 98 65 3a c6 98 65 3a c6 .e:......e:..e:. + backtrace (crc c25aa925): + kmemleak_alloc+0x34/0x3c + __kmalloc_cache_noprof+0x150/0x1a4 + drm_atomic_helper_setup_commit+0x1e8/0x7bc + drm_atomic_helper_commit+0x3c/0x15c + drm_atomic_commit+0xc0/0xf4 + drm_atomic_helper_set_config+0x84/0xb8 + drm_mode_setcrtc+0x32c/0x810 + drm_ioctl+0x20c/0x488 + sys_ioctl+0x14c/0xc20 + ret_fast_syscall+0x0/0x54 + +Signed-off-by: Ludovic Desroches +Reviewed-by: Manikandan Muralidharan +Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-1-79b615130dc3@microchip.com +Signed-off-by: Manikandan Muralidharan +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +index daa508504f47d..390c4fc62af7c 100644 +--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c ++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +@@ -934,8 +934,7 @@ static void atmel_hlcdc_plane_atomic_destroy_state(struct drm_plane *p, + state->dscrs[i]->self); + } + +- if (s->fb) +- drm_framebuffer_put(s->fb); ++ __drm_atomic_helper_plane_destroy_state(s); + + kfree(state); + } +-- +2.51.0 + diff --git a/queue-6.6/drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch b/queue-6.6/drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch new file mode 100644 index 00000000000..f26d2525fd6 --- /dev/null +++ b/queue-6.6/drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch @@ -0,0 +1,81 @@ +From f505e86c76cbf975609d62b45b849a87ee09c8df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Oct 2025 18:14:53 +0200 +Subject: drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release + +From: Ludovic Desroches + +[ Upstream commit bc847787233277a337788568e90a6ee1557595eb ] + +The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying +the atmel_hlcdc_plane state structure without properly duplicating the +drm_plane_state. In particular, state->commit remained set to the old +state commit, which can lead to a use-after-free in the next +drm_atomic_commit() call. + +Fix this by calling +__drm_atomic_helper_duplicate_plane_state(), which correctly clones +the base drm_plane_state (including the ->commit pointer). + +It has been seen when closing and re-opening the device node while +another DRM client (e.g. fbdev) is still attached: + +============================================================================= +BUG kmalloc-64 (Not tainted): Poison overwritten +----------------------------------------------------------------------------- + +0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b +FIX kmalloc-64: Restoring Poison 0xc611b344-0xc611b344=0x6b +Allocated in drm_atomic_helper_setup_commit+0x1e8/0x7bc age=178 cpu=0 +pid=29 + drm_atomic_helper_setup_commit+0x1e8/0x7bc + drm_atomic_helper_commit+0x3c/0x15c + drm_atomic_commit+0xc0/0xf4 + drm_framebuffer_remove+0x4cc/0x5a8 + drm_mode_rmfb_work_fn+0x6c/0x80 + process_one_work+0x12c/0x2cc + worker_thread+0x2a8/0x400 + kthread+0xc0/0xdc + ret_from_fork+0x14/0x28 +Freed in drm_atomic_helper_commit_hw_done+0x100/0x150 age=8 cpu=0 +pid=169 + drm_atomic_helper_commit_hw_done+0x100/0x150 + drm_atomic_helper_commit_tail+0x64/0x8c + commit_tail+0x168/0x18c + drm_atomic_helper_commit+0x138/0x15c + drm_atomic_commit+0xc0/0xf4 + drm_atomic_helper_set_config+0x84/0xb8 + drm_mode_setcrtc+0x32c/0x810 + drm_ioctl+0x20c/0x488 + sys_ioctl+0x14c/0xc20 + ret_fast_syscall+0x0/0x54 +Slab 0xef8bc360 objects=21 used=16 fp=0xc611b7c0 +flags=0x200(workingset|zone=0) +Object 0xc611b340 @offset=832 fp=0xc611b7c0 + +Signed-off-by: Ludovic Desroches +Reviewed-by: Manikandan Muralidharan +Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-2-79b615130dc3@microchip.com +Signed-off-by: Manikandan Muralidharan +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +index ec4fe0de989d4..b35d367b86141 100644 +--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c ++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +@@ -904,8 +904,7 @@ atmel_hlcdc_plane_atomic_duplicate_state(struct drm_plane *p) + return NULL; + } + +- if (copy->base.fb) +- drm_framebuffer_get(copy->base.fb); ++ __drm_atomic_helper_plane_duplicate_state(p, ©->base); + + return ©->base; + } +-- +2.51.0 + diff --git a/queue-6.6/drm-display-dp_mst-add-protection-against-0-vcpi.patch b/queue-6.6/drm-display-dp_mst-add-protection-against-0-vcpi.patch new file mode 100644 index 00000000000..3d9a04b0124 --- /dev/null +++ b/queue-6.6/drm-display-dp_mst-add-protection-against-0-vcpi.patch @@ -0,0 +1,96 @@ +From b9b6b0f7f195745a355048a836b7d944ceb8022e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 15:16:50 +0530 +Subject: drm/display/dp_mst: Add protection against 0 vcpi + +From: Suraj Kandpal + +[ Upstream commit 342ccffd9f77fc29fe1c05fd145e4d842bd2feaa ] + +When releasing a timeslot there is a slight chance we may end up +with the wrong payload mask due to overflow if the delayed_destroy_work +ends up coming into play after a DP 2.1 monitor gets disconnected +which causes vcpi to become 0 then we try to make the payload = +~BIT(vcpi - 1) which is a negative shift. VCPI id should never +really be 0 hence skip changing the payload mask if VCPI is 0. + +Otherwise it leads to +<7> [515.287237] xe 0000:03:00.0: [drm:drm_dp_mst_get_port_malloc +[drm_display_helper]] port ffff888126ce9000 (3) +<4> [515.287267] -----------[ cut here ]----------- +<3> [515.287268] UBSAN: shift-out-of-bounds in +../drivers/gpu/drm/display/drm_dp_mst_topology.c:4575:36 +<3> [515.287271] shift exponent -1 is negative +<4> [515.287275] CPU: 7 UID: 0 PID: 3108 Comm: kworker/u64:33 Tainted: G +S U 6.17.0-rc6-lgci-xe-xe-3795-3e79699fa1b216e92+ #1 PREEMPT(voluntary) +<4> [515.287279] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER +<4> [515.287279] Hardware name: ASUS System Product Name/PRIME Z790-P +WIFI, BIOS 1645 03/15/2024 +<4> [515.287281] Workqueue: drm_dp_mst_wq drm_dp_delayed_destroy_work +[drm_display_helper] +<4> [515.287303] Call Trace: +<4> [515.287304] +<4> [515.287306] dump_stack_lvl+0xc1/0xf0 +<4> [515.287313] dump_stack+0x10/0x20 +<4> [515.287316] __ubsan_handle_shift_out_of_bounds+0x133/0x2e0 +<4> [515.287324] ? drm_atomic_get_private_obj_state+0x186/0x1d0 +<4> [515.287333] drm_dp_atomic_release_time_slots.cold+0x17/0x3d +[drm_display_helper] +<4> [515.287355] mst_connector_atomic_check+0x159/0x180 [xe] +<4> [515.287546] drm_atomic_helper_check_modeset+0x4d9/0xfa0 +<4> [515.287550] ? __ww_mutex_lock.constprop.0+0x6f/0x1a60 +<4> [515.287562] intel_atomic_check+0x119/0x2b80 [xe] +<4> [515.287740] ? find_held_lock+0x31/0x90 +<4> [515.287747] ? lock_release+0xce/0x2a0 +<4> [515.287754] drm_atomic_check_only+0x6a2/0xb40 +<4> [515.287758] ? drm_atomic_add_affected_connectors+0x12b/0x140 +<4> [515.287765] drm_atomic_commit+0x6e/0xf0 +<4> [515.287766] ? _pfx__drm_printfn_info+0x10/0x10 +<4> [515.287774] drm_client_modeset_commit_atomic+0x25c/0x2b0 +<4> [515.287794] drm_client_modeset_commit_locked+0x60/0x1b0 +<4> [515.287795] ? mutex_lock_nested+0x1b/0x30 +<4> [515.287801] drm_client_modeset_commit+0x26/0x50 +<4> [515.287804] __drm_fb_helper_restore_fbdev_mode_unlocked+0xdc/0x110 +<4> [515.287810] drm_fb_helper_hotplug_event+0x120/0x140 +<4> [515.287814] drm_fbdev_client_hotplug+0x28/0xd0 +<4> [515.287819] drm_client_hotplug+0x6c/0xf0 +<4> [515.287824] drm_client_dev_hotplug+0x9e/0xd0 +<4> [515.287829] drm_kms_helper_hotplug_event+0x1a/0x30 +<4> [515.287834] drm_dp_delayed_destroy_work+0x3df/0x410 +[drm_display_helper] +<4> [515.287861] process_one_work+0x22b/0x6f0 +<4> [515.287874] worker_thread+0x1e8/0x3d0 +<4> [515.287879] ? __pfx_worker_thread+0x10/0x10 +<4> [515.287882] kthread+0x11c/0x250 +<4> [515.287886] ? __pfx_kthread+0x10/0x10 +<4> [515.287890] ret_from_fork+0x2d7/0x310 +<4> [515.287894] ? __pfx_kthread+0x10/0x10 +<4> [515.287897] ret_from_fork_asm+0x1a/0x30 + +Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6303 +Signed-off-by: Suraj Kandpal +Reviewed-by: Imre Deak +Reviewed-by: Lyude Paul +Link: https://patch.msgid.link/20251119094650.799135-1-suraj.kandpal@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/display/drm_dp_mst_topology.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c +index 21ff7ef7ce920..d4a5489d010c4 100644 +--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c +@@ -4527,7 +4527,8 @@ int drm_dp_atomic_release_time_slots(struct drm_atomic_state *state, + if (!payload->delete) { + payload->pbn = 0; + payload->delete = true; +- topology_state->payload_mask &= ~BIT(payload->vcpi - 1); ++ if (payload->vcpi > 0) ++ topology_state->payload_mask &= ~BIT(payload->vcpi - 1); + } + + return 0; +-- +2.51.0 + diff --git a/queue-6.6/drm-radeon-add-hainan-clock-adjustment.patch b/queue-6.6/drm-radeon-add-hainan-clock-adjustment.patch new file mode 100644 index 00000000000..271fc278b2b --- /dev/null +++ b/queue-6.6/drm-radeon-add-hainan-clock-adjustment.patch @@ -0,0 +1,39 @@ +From 28144826725702dc94c6d1d9d4dee9d02003a5e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Feb 2026 07:26:00 +0000 +Subject: drm/radeon: Add HAINAN clock adjustment + +From: decce6 + +[ Upstream commit 908d318f23d6b5d625bea093c5fc056238cdb7ff ] + +This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from +850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This +patch is for radeon. + +Signed-off-by: decce6 +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/si_dpm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c +index fbf968e3f6d78..c688b4d914819 100644 +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -2969,6 +2969,11 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev, + max_sclk = 60000; + max_mclk = 80000; + } ++ if ((rdev->pdev->device == 0x666f) && ++ (rdev->pdev->revision == 0x00)) { ++ max_sclk = 80000; ++ max_mclk = 95000; ++ } + } else if (rdev->family == CHIP_OLAND) { + if ((rdev->pdev->revision == 0xC7) || + (rdev->pdev->revision == 0x80) || +-- +2.51.0 + diff --git a/queue-6.6/drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch b/queue-6.6/drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch new file mode 100644 index 00000000000..15194e1d528 --- /dev/null +++ b/queue-6.6/drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch @@ -0,0 +1,71 @@ +From a759d9ccd4408576718365a52793d69b060bb2c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Dec 2025 21:03:23 +0800 +Subject: drm/v3d: Set DMA segment size to avoid debug warnings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Xiaolei Wang + +[ Upstream commit 9eb018828b1b30dfba689c060735c50fc5b9f704 ] + +When using V3D rendering with CONFIG_DMA_API_DEBUG enabled, the +kernel occasionally reports a segment size mismatch. This is because +'max_seg_size' is not set. The kernel defaults to 64K. setting +'max_seg_size' to the maximum will prevent 'debug_dma_map_sg()' +from complaining about the over-mapping of the V3D segment length. + +DMA-API: v3d 1002000000.v3d: mapping sg segment longer than device + claims to support [len=8290304] [max=65536] +WARNING: CPU: 0 PID: 493 at kernel/dma/debug.c:1179 debug_dma_map_sg+0x330/0x388 +CPU: 0 UID: 0 PID: 493 Comm: Xorg Not tainted 6.12.53-yocto-standard #1 +Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT) +pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : debug_dma_map_sg+0x330/0x388 +lr : debug_dma_map_sg+0x330/0x388 +sp : ffff8000829a3ac0 +x29: ffff8000829a3ac0 x28: 0000000000000001 x27: ffff8000813fe000 +x26: ffffc1ffc0000000 x25: ffff00010fdeb760 x24: 0000000000000000 +x23: ffff8000816a9bf0 x22: 0000000000000001 x21: 0000000000000002 +x20: 0000000000000002 x19: ffff00010185e810 x18: ffffffffffffffff +x17: 69766564206e6168 x16: 74207265676e6f6c x15: 20746e656d676573 +x14: 20677320676e6970 x13: 5d34303334393134 x12: 0000000000000000 +x11: 00000000000000c0 x10: 00000000000009c0 x9 : ffff8000800e0b7c +x8 : ffff00010a315ca0 x7 : ffff8000816a5110 x6 : 0000000000000001 +x5 : 000000000000002b x4 : 0000000000000002 x3 : 0000000000000008 +x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00010a315280 +Call trace: + debug_dma_map_sg+0x330/0x388 + __dma_map_sg_attrs+0xc0/0x278 + dma_map_sgtable+0x30/0x58 + drm_gem_shmem_get_pages_sgt+0xb4/0x140 + v3d_bo_create_finish+0x28/0x130 [v3d] + v3d_create_bo_ioctl+0x54/0x180 [v3d] + drm_ioctl_kernel+0xc8/0x140 + drm_ioctl+0x2d4/0x4d8 + +Signed-off-by: Xiaolei Wang +Link: https://patch.msgid.link/20251203130323.2247072-1-xiaolei.wang@windriver.com +Signed-off-by: Maíra Canal +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/v3d/v3d_drv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c +index 0e8ea99011884..691a8c8848e40 100644 +--- a/drivers/gpu/drm/v3d/v3d_drv.c ++++ b/drivers/gpu/drm/v3d/v3d_drv.c +@@ -242,6 +242,8 @@ static int v3d_platform_drm_probe(struct platform_device *pdev) + if (ret) + goto clk_disable; + ++ dma_set_max_seg_size(&pdev->dev, UINT_MAX); ++ + v3d->va_width = 30 + V3D_GET_FIELD(mmu_debug, V3D_MMU_VA_WIDTH); + + ident1 = V3D_READ(V3D_HUB_IDENT1); +-- +2.51.0 + diff --git a/queue-6.6/efi-cper-don-t-dump-the-entire-memory-region.patch b/queue-6.6/efi-cper-don-t-dump-the-entire-memory-region.patch new file mode 100644 index 00000000000..efea05e07a9 --- /dev/null +++ b/queue-6.6/efi-cper-don-t-dump-the-entire-memory-region.patch @@ -0,0 +1,54 @@ +From a0db68a0d2b436e3ea5444e7d8a834026eb737af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:35:06 +0100 +Subject: EFI/CPER: don't dump the entire memory region + +From: Mauro Carvalho Chehab + +[ Upstream commit 55cc6fe5716f678f06bcb95140882dfa684464ec ] + +The current logic at cper_print_fw_err() doesn't check if the +error record length is big enough to handle offset. On a bad firmware, +if the ofset is above the actual record, length -= offset will +underflow, making it dump the entire memory. + +The end result can be: + + - the logic taking a lot of time dumping large regions of memory; + - data disclosure due to the memory dumps; + - an OOPS, if it tries to dump an unmapped memory region. + +Fix it by checking if the section length is too small before doing +a hex dump. + +Signed-off-by: Mauro Carvalho Chehab +Reviewed-by: Jonathan Cameron +Acked-by: Ard Biesheuvel +Reviewed-by: Hanjun Guo +[ rjw: Subject tweaks ] +Link: https://patch.msgid.link/1752b5ba63a3e2f148ddee813b36c996cc617e86.1767871950.git.mchehab+huawei@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/cper.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c +index 74ffaf44d74ce..4e744ce7256d5 100644 +--- a/drivers/firmware/efi/cper.c ++++ b/drivers/firmware/efi/cper.c +@@ -555,6 +555,11 @@ static void cper_print_fw_err(const char *pfx, + } else { + offset = sizeof(*fw_err); + } ++ if (offset > length) { ++ printk("%s""error section length is too small: offset=%d, length=%d\n", ++ pfx, offset, length); ++ return; ++ } + + buf += offset; + length -= offset; +-- +2.51.0 + diff --git a/queue-6.6/efi-cper-don-t-go-past-the-arm-processor-cper-record.patch b/queue-6.6/efi-cper-don-t-go-past-the-arm-processor-cper-record.patch new file mode 100644 index 00000000000..d3fa88db9df --- /dev/null +++ b/queue-6.6/efi-cper-don-t-go-past-the-arm-processor-cper-record.patch @@ -0,0 +1,107 @@ +From dc6fc2adb4e438e40aefd1289f2b7ba6e8efd7d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:35:04 +0100 +Subject: EFI/CPER: don't go past the ARM processor CPER record buffer + +From: Mauro Carvalho Chehab + +[ Upstream commit eae21beecb95a3b69ee5c38a659f774e171d730e ] + +There's a logic inside GHES/CPER to detect if the section_length +is too small, but it doesn't detect if it is too big. + +Currently, if the firmware receives an ARM processor CPER record +stating that a section length is big, kernel will blindly trust +section_length, producing a very long dump. For instance, a 67 +bytes record with ERR_INFO_NUM set 46198 and section length +set to 854918320 would dump a lot of data going a way past the +firmware memory-mapped area. + +Fix it by adding a logic to prevent it to go past the buffer +if ERR_INFO_NUM is too big, making it report instead: + + [Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1 + [Hardware Error]: event severity: recoverable + [Hardware Error]: Error 0, type: recoverable + [Hardware Error]: section_type: ARM processor error + [Hardware Error]: MIDR: 0xff304b2f8476870a + [Hardware Error]: section length: 854918320, CPER size: 67 + [Hardware Error]: section length is too big + [Hardware Error]: firmware-generated error record is incorrect + [Hardware Error]: ERR_INFO_NUM is 46198 + +Signed-off-by: Mauro Carvalho Chehab +Reviewed-by: Jonathan Cameron +Acked-by: Ard Biesheuvel +Reviewed-by: Hanjun Guo +[ rjw: Subject and changelog tweaks ] +Link: https://patch.msgid.link/41cd9f6b3ace3cdff7a5e864890849e4b1c58b63.1767871950.git.mchehab+huawei@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/cper-arm.c | 12 ++++++++---- + drivers/firmware/efi/cper.c | 3 ++- + include/linux/cper.h | 3 ++- + 3 files changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/firmware/efi/cper-arm.c b/drivers/firmware/efi/cper-arm.c +index 52d18490b59e3..70e1735dfcdd4 100644 +--- a/drivers/firmware/efi/cper-arm.c ++++ b/drivers/firmware/efi/cper-arm.c +@@ -226,7 +226,8 @@ static void cper_print_arm_err_info(const char *pfx, u32 type, + } + + void cper_print_proc_arm(const char *pfx, +- const struct cper_sec_proc_arm *proc) ++ const struct cper_sec_proc_arm *proc, ++ u32 length) + { + int i, len, max_ctx_type; + struct cper_arm_err_info *err_info; +@@ -238,9 +239,12 @@ void cper_print_proc_arm(const char *pfx, + + len = proc->section_length - (sizeof(*proc) + + proc->err_info_num * (sizeof(*err_info))); +- if (len < 0) { +- printk("%ssection length: %d\n", pfx, proc->section_length); +- printk("%ssection length is too small\n", pfx); ++ ++ if (len < 0 || proc->section_length > length) { ++ printk("%ssection length: %d, CPER size: %d\n", ++ pfx, proc->section_length, length); ++ printk("%ssection length is too %s\n", pfx, ++ (len < 0) ? "small" : "big"); + printk("%sfirmware-generated error record is incorrect\n", pfx); + printk("%sERR_INFO_NUM is %d\n", pfx, proc->err_info_num); + return; +diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c +index 4e744ce7256d5..9d0f0bf3067cc 100644 +--- a/drivers/firmware/efi/cper.c ++++ b/drivers/firmware/efi/cper.c +@@ -640,7 +640,8 @@ cper_estatus_print_section(const char *pfx, struct acpi_hest_generic_data *gdata + + printk("%ssection_type: ARM processor error\n", newpfx); + if (gdata->error_data_length >= sizeof(*arm_err)) +- cper_print_proc_arm(newpfx, arm_err); ++ cper_print_proc_arm(newpfx, arm_err, ++ gdata->error_data_length); + else + goto err_section_too_small; + #endif +diff --git a/include/linux/cper.h b/include/linux/cper.h +index ad1ed24730917..c588e5c2a96c6 100644 +--- a/include/linux/cper.h ++++ b/include/linux/cper.h +@@ -568,7 +568,8 @@ void cper_mem_err_pack(const struct cper_sec_mem_err *, + const char *cper_mem_err_unpack(struct trace_seq *, + struct cper_mem_err_compact *); + void cper_print_proc_arm(const char *pfx, +- const struct cper_sec_proc_arm *proc); ++ const struct cper_sec_proc_arm *proc, ++ u32 length); + void cper_print_proc_ia(const char *pfx, + const struct cper_sec_proc_ia *proc); + int cper_mem_err_location(struct cper_mem_err_compact *mem, char *msg); +-- +2.51.0 + diff --git a/queue-6.6/ext4-mark-group-add-fast-commit-ineligible.patch b/queue-6.6/ext4-mark-group-add-fast-commit-ineligible.patch new file mode 100644 index 00000000000..bb63b3be960 --- /dev/null +++ b/queue-6.6/ext4-mark-group-add-fast-commit-ineligible.patch @@ -0,0 +1,68 @@ +From 4bf155f186349ad94cf3a11a15615e55cf776140 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 19:51:41 +0800 +Subject: ext4: mark group add fast-commit ineligible + +From: Li Chen + +[ Upstream commit 89b4336fd5ec78f51f9d3a1d100f3ffa3228e604 ] + +Fast commits only log operations that have dedicated replay support. +Online resize via EXT4_IOC_GROUP_ADD updates the superblock and group +descriptor metadata without going through the fast commit tracking +paths. +In practice these operations are rare and usually followed by further +updates, but mixing them into a fast commit makes the overall +semantics harder to reason about and risks replay gaps if new call +sites appear. + +Teach ext4 to mark the filesystem fast-commit ineligible when +ext4_ioctl_group_add() adds new block groups. +This forces those transactions to fall back to a full commit, +ensuring that the filesystem geometry updates are captured by the +normal journal rather than partially encoded in fast commit TLVs. +This change should not affect common workloads but makes online +resize via GROUP_ADD safer and easier to reason about under fast +commit. + +Testing: +1. prepare: + dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256 + mkfs.ext4 -O fast_commit -F /root/fc_resize.img + mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize +2. Ran a helper that issues EXT4_IOC_GROUP_ADD on the mounted + filesystem and checked the resize ineligible reason: + ./group_add_helper /mnt/fc_resize + cat /proc/fs/ext4/loop0/fc_info + shows "Resize": > 0. +3. Fsynced a file on the resized filesystem and verified that the fast + commit stats report at least one ineligible commit: + touch /mnt/fc_resize/file + /root/fsync_file /mnt/fc_resize/file + sync + cat /proc/fs/ext4/loop0/fc_info + shows fc stats ineligible > 0. + +Signed-off-by: Li Chen +Link: https://patch.msgid.link/20251211115146.897420-5-me@linux.beauty +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/ioctl.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c +index 4f931f80cb348..2a9d944ccad79 100644 +--- a/fs/ext4/ioctl.c ++++ b/fs/ext4/ioctl.c +@@ -963,6 +963,7 @@ static long ext4_ioctl_group_add(struct file *file, + + err = ext4_group_add(sb, input); + if (EXT4_SB(sb)->s_journal) { ++ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE, NULL); + jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal); + err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0); + jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal); +-- +2.51.0 + diff --git a/queue-6.6/ext4-mark-group-extend-fast-commit-ineligible.patch b/queue-6.6/ext4-mark-group-extend-fast-commit-ineligible.patch new file mode 100644 index 00000000000..81c783f4676 --- /dev/null +++ b/queue-6.6/ext4-mark-group-extend-fast-commit-ineligible.patch @@ -0,0 +1,69 @@ +From 79356352260f8c095b8f1bc70f2fcec27dd5d587 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 19:51:42 +0800 +Subject: ext4: mark group extend fast-commit ineligible + +From: Li Chen + +[ Upstream commit 1f8dd813a1c771b13c303f73d876164bc9b327cc ] + +Fast commits only log operations that have dedicated replay support. +EXT4_IOC_GROUP_EXTEND grows the filesystem to the end of the last +block group and updates the same on-disk metadata without going +through the fast commit tracking paths. +In practice these operations are rare and usually followed by further +updates, but mixing them into a fast commit makes the overall +semantics harder to reason about and risks replay gaps if new call +sites appear. + +Teach ext4 to mark the filesystem fast-commit ineligible when +EXT4_IOC_GROUP_EXTEND grows the filesystem. +This forces those transactions to fall back to a full commit, +ensuring that the group extension changes are captured by the normal +journal rather than partially encoded in fast commit TLVs. +This change should not affect common workloads but makes online +resize via GROUP_EXTEND safer and easier to reason about under fast +commit. + +Testing: +1. prepare: + dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256 + mkfs.ext4 -O fast_commit -F /root/fc_resize.img + mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize +2. Extended the filesystem to the end of the last block group using a + helper that calls EXT4_IOC_GROUP_EXTEND on the mounted filesystem + and checked fc_info: + ./group_extend_helper /mnt/fc_resize + cat /proc/fs/ext4/loop0/fc_info + shows the "Resize" ineligible reason increased. +3. Fsynced a file on the resized filesystem and confirmed that the fast + commit ineligible counter incremented for the resize transaction: + touch /mnt/fc_resize/file + /root/fsync_file /mnt/fc_resize/file + sync + cat /proc/fs/ext4/loop0/fc_info + +Signed-off-by: Li Chen +Link: https://patch.msgid.link/20251211115146.897420-6-me@linux.beauty +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/ioctl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c +index 2a9d944ccad79..d34affd2075eb 100644 +--- a/fs/ext4/ioctl.c ++++ b/fs/ext4/ioctl.c +@@ -1316,6 +1316,8 @@ static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) + + err = ext4_group_extend(sb, EXT4_SB(sb)->s_es, n_blocks_count); + if (EXT4_SB(sb)->s_journal) { ++ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE, ++ NULL); + jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal); + err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0); + jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal); +-- +2.51.0 + diff --git a/queue-6.6/ext4-move-ext4_percpu_param_init-before-ext4_mb_init.patch b/queue-6.6/ext4-move-ext4_percpu_param_init-before-ext4_mb_init.patch new file mode 100644 index 00000000000..01fdd6ef262 --- /dev/null +++ b/queue-6.6/ext4-move-ext4_percpu_param_init-before-ext4_mb_init.patch @@ -0,0 +1,104 @@ +From a014797cca6e8d7b0a9d04719ab5af7d8bb08b7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Dec 2025 21:31:16 +0800 +Subject: ext4: move ext4_percpu_param_init() before ext4_mb_init() + +From: Baokun Li + +[ Upstream commit 270564513489d98b721a1e4a10017978d5213bff ] + +When running `kvm-xfstests -c ext4/1k -C 1 generic/383` with the +`DOUBLE_CHECK` macro defined, the following panic is triggered: + +================================================================== +EXT4-fs error (device vdc): ext4_validate_block_bitmap:423: + comm mount: bg 0: bad block bitmap checksum +BUG: unable to handle page fault for address: ff110000fa2cc000 +PGD 3e01067 P4D 3e02067 PUD 0 +Oops: Oops: 0000 [#1] SMP NOPTI +CPU: 0 UID: 0 PID: 2386 Comm: mount Tainted: G W + 6.18.0-gba65a4e7120a-dirty #1152 PREEMPT(none) +RIP: 0010:percpu_counter_add_batch+0x13/0xa0 +Call Trace: + + ext4_mark_group_bitmap_corrupted+0xcb/0xe0 + ext4_validate_block_bitmap+0x2a1/0x2f0 + ext4_read_block_bitmap+0x33/0x50 + mb_group_bb_bitmap_alloc+0x33/0x80 + ext4_mb_add_groupinfo+0x190/0x250 + ext4_mb_init_backend+0x87/0x290 + ext4_mb_init+0x456/0x640 + __ext4_fill_super+0x1072/0x1680 + ext4_fill_super+0xd3/0x280 + get_tree_bdev_flags+0x132/0x1d0 + vfs_get_tree+0x29/0xd0 + vfs_cmd_create+0x59/0xe0 + __do_sys_fsconfig+0x4f6/0x6b0 + do_syscall_64+0x50/0x1f0 + entry_SYSCALL_64_after_hwframe+0x76/0x7e +================================================================== + +This issue can be reproduced using the following commands: + mkfs.ext4 -F -q -b 1024 /dev/sda 5G + tune2fs -O quota,project /dev/sda + mount /dev/sda /tmp/test + +With DOUBLE_CHECK defined, mb_group_bb_bitmap_alloc() reads +and validates the block bitmap. When the validation fails, +ext4_mark_group_bitmap_corrupted() attempts to update +sbi->s_freeclusters_counter. However, this percpu_counter has not been +initialized yet at this point, which leads to the panic described above. + +Fix this by moving the execution of ext4_percpu_param_init() to occur +before ext4_mb_init(), ensuring the per-CPU counters are initialized +before they are used. + +Signed-off-by: Baokun Li +Reviewed-by: Zhang Yi +Reviewed-by: Jan Kara +Link: https://patch.msgid.link/20251209133116.731350-1-libaokun@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/super.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index c5c6faa995e1c..561f670768f96 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -5563,6 +5563,10 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb) + clear_opt2(sb, MB_OPTIMIZE_SCAN); + } + ++ err = ext4_percpu_param_init(sbi); ++ if (err) ++ goto failed_mount5; ++ + err = ext4_mb_init(sb); + if (err) { + ext4_msg(sb, KERN_ERR, "failed to initialize mballoc (%d)", +@@ -5578,10 +5582,6 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb) + sbi->s_journal->j_commit_callback = + ext4_journal_commit_callback; + +- err = ext4_percpu_param_init(sbi); +- if (err) +- goto failed_mount6; +- + if (ext4_has_feature_flex_bg(sb)) + if (!ext4_fill_flex_info(sb)) { + ext4_msg(sb, KERN_ERR, +@@ -5661,8 +5661,8 @@ failed_mount8: __maybe_unused + failed_mount6: + ext4_mb_release(sb); + ext4_flex_groups_free(sbi); +- ext4_percpu_param_destroy(sbi); + failed_mount5: ++ ext4_percpu_param_destroy(sbi); + ext4_ext_release(sb); + ext4_release_system_zone(sb); + failed_mount4a: +-- +2.51.0 + diff --git a/queue-6.6/fix-it87_wdt-early-reboot-by-reporting-running-timer.patch b/queue-6.6/fix-it87_wdt-early-reboot-by-reporting-running-timer.patch new file mode 100644 index 00000000000..02ef0092251 --- /dev/null +++ b/queue-6.6/fix-it87_wdt-early-reboot-by-reporting-running-timer.patch @@ -0,0 +1,60 @@ +From 8dfe53d30bec87aa9a7ff02e15c3a18c3eaf1299 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 13:11:24 +0100 +Subject: fix it87_wdt early reboot by reporting running timer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: René Rebe + +[ Upstream commit 88b2ab346436f799b99894a3e9518a3ffa344524 ] + +Some products, such as the Ugreen DXP4800 Plus NAS, ship with the it87 +wdt enabled by the firmware and a broken BIOS option that does not +allow to change the time or turn it off. As this makes installing +Linux rather difficult, change the it87_wdt to report it running to +the watchdog core. + +Signed-off-by: René Rebe +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/it87_wdt.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/watchdog/it87_wdt.c b/drivers/watchdog/it87_wdt.c +index 239947df613db..1392e557fa371 100644 +--- a/drivers/watchdog/it87_wdt.c ++++ b/drivers/watchdog/it87_wdt.c +@@ -183,6 +183,12 @@ static void _wdt_update_timeout(unsigned int t) + superio_outb(t >> 8, WDTVALMSB); + } + ++/* Internal function, should be called after superio_select(GPIO) */ ++static bool _wdt_running(void) ++{ ++ return superio_inb(WDTVALLSB) || (max_units > 255 && superio_inb(WDTVALMSB)); ++} ++ + static int wdt_update_timeout(unsigned int t) + { + int ret; +@@ -365,6 +371,12 @@ static int __init it87_wdt_init(void) + } + } + ++ /* wdt already left running by firmware? */ ++ if (_wdt_running()) { ++ pr_info("Left running by firmware.\n"); ++ set_bit(WDOG_HW_RUNNING, &wdt_dev.status); ++ } ++ + superio_exit(); + + if (timeout < 1 || timeout > max_units * 60) { +-- +2.51.0 + diff --git a/queue-6.6/fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch b/queue-6.6/fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch new file mode 100644 index 00000000000..12782fb6066 --- /dev/null +++ b/queue-6.6/fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch @@ -0,0 +1,58 @@ +From ee5a9ecdcb7ea50526143a5f10b46bb222b70a2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Nov 2025 16:58:48 +0100 +Subject: fpga: of-fpga-region: Fail if any bridge is missing + +From: Romain Gantois + +[ Upstream commit c141c8221bc5089de915d9f26044df892c343c7e ] + +When parsing the region bridge list from the "fpga-bridges" device tree +property, the of-fpga-region driver will silently ignore bridges which fail +to be obtained, for example due to a missing bridge driver or invalid +phandle. + +This can lead to hardware issues if a region bridge stays coupled when +partial programming is performed. + +Fail if any of the bridges specified in "fpga-bridges" cannot be obtained. + +Signed-off-by: Romain Gantois +Link: https://lore.kernel.org/r/20251127-of-fpga-region-fail-if-bridges-not-found-v1-1-ca674f8d07eb@bootlin.com +Reviewed-by: Xu Yilun +Signed-off-by: Xu Yilun +Signed-off-by: Sasha Levin +--- + drivers/fpga/of-fpga-region.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/fpga/of-fpga-region.c b/drivers/fpga/of-fpga-region.c +index a6affd83f2757..ed6eae9851179 100644 +--- a/drivers/fpga/of-fpga-region.c ++++ b/drivers/fpga/of-fpga-region.c +@@ -83,7 +83,7 @@ static struct fpga_manager *of_fpga_region_get_mgr(struct device_node *np) + * done with the bridges. + * + * Return: 0 for success (even if there are no bridges specified) +- * or -EBUSY if any of the bridges are in use. ++ * or an error code if any of the bridges are not available. + */ + static int of_fpga_region_get_bridges(struct fpga_region *region) + { +@@ -130,10 +130,10 @@ static int of_fpga_region_get_bridges(struct fpga_region *region) + ®ion->bridge_list); + of_node_put(br); + +- /* If any of the bridges are in use, give up */ +- if (ret == -EBUSY) { ++ /* If any of the bridges are not available, give up */ ++ if (ret) { + fpga_bridges_put(®ion->bridge_list); +- return -EBUSY; ++ return ret; + } + } + +-- +2.51.0 + diff --git a/queue-6.6/fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch b/queue-6.6/fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch new file mode 100644 index 00000000000..604f1ff7119 --- /dev/null +++ b/queue-6.6/fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch @@ -0,0 +1,50 @@ +From 9d5d2b732aba6125a69076eaebfd7e981c18033b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 18:42:11 +0530 +Subject: fs/buffer: add alert in try_to_free_buffers() for folios without + buffers + +From: Deepakkumar Karn + +[ Upstream commit b68f91ef3b3fe82ad78c417de71b675699a8467c ] + +try_to_free_buffers() can be called on folios with no buffers attached +when filemap_release_folio() is invoked on a folio belonging to a mapping +with AS_RELEASE_ALWAYS set but no release_folio operation defined. + +In such cases, folio_needs_release() returns true because of the +AS_RELEASE_ALWAYS flag, but the folio has no private buffer data. This +causes try_to_free_buffers() to call drop_buffers() on a folio with no +buffers, leading to a null pointer dereference. + +Adding a check in try_to_free_buffers() to return early if the folio has no +buffers attached, with WARN_ON_ONCE() to alert about the misconfiguration. +This provides defensive hardening. + +Signed-off-by: Deepakkumar Karn +Link: https://patch.msgid.link/20251211131211.308021-1-dkarn@redhat.com +Reviewed-by: Jan Kara +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/buffer.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/buffer.c b/fs/buffer.c +index 32df6163ffed5..c225eef13279b 100644 +--- a/fs/buffer.c ++++ b/fs/buffer.c +@@ -2950,6 +2950,10 @@ bool try_to_free_buffers(struct folio *folio) + if (folio_test_writeback(folio)) + return false; + ++ /* Misconfigured folio check */ ++ if (WARN_ON_ONCE(!folio_buffers(folio))) ++ return true; ++ + if (mapping == NULL) { /* can this still happen? */ + ret = drop_buffers(folio, &buffers_to_free); + goto out; +-- +2.51.0 + diff --git a/queue-6.6/fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch b/queue-6.6/fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch new file mode 100644 index 00000000000..4c7e7a6a2c7 --- /dev/null +++ b/queue-6.6/fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch @@ -0,0 +1,45 @@ +From 4fb3af601cf3297d54716164aec82198698fa4dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 16:07:32 +0100 +Subject: fs/ntfs3: avoid calling run_get_entry() when run == NULL in + ntfs_read_run_nb_ra() + +From: Konstantin Komarov + +[ Upstream commit c5226b96c08a010ebef5fdf4c90572bcd89e4299 ] + +When ntfs_read_run_nb_ra() is invoked with run == NULL the code later +assumes run is valid and may call run_get_entry(NULL, ...), and also +uses clen/idx without initializing them. Smatch reported uninitialized +variable warnings and this can lead to undefined behaviour. This patch +fixes it. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202512230646.v5hrYXL0-lkp@intel.com/ +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/fsntfs.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c +index 446079b0866d4..e17d4c1ba06f0 100644 +--- a/fs/ntfs3/fsntfs.c ++++ b/fs/ntfs3/fsntfs.c +@@ -1272,6 +1272,12 @@ int ntfs_read_run_nb(struct ntfs_sb_info *sbi, const struct runs_tree *run, + + } while (len32); + ++ if (!run) { ++ err = -EINVAL; ++ goto out; ++ } ++ ++ /* Get next fragment to read. */ + vcn_next = vcn + clen; + if (!run_get_entry(run, ++idx, &vcn, &lcn, &clen) || + vcn != vcn_next) { +-- +2.51.0 + diff --git a/queue-6.6/fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch b/queue-6.6/fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch new file mode 100644 index 00000000000..66be38e0835 --- /dev/null +++ b/queue-6.6/fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch @@ -0,0 +1,58 @@ +From 9b47a311c9c6b5e266e2fcb422465ad23d4d3af3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 19:59:59 +0900 +Subject: fs: ntfs3: check return value of indx_find to avoid infinite loop + +From: Jaehun Gou + +[ Upstream commit 1732053c8a6b360e2d5afb1b34fe9779398b072c ] + +We found an infinite loop bug in the ntfs3 file system that can lead to a +Denial-of-Service (DoS) condition. + +A malformed dentry in the ntfs3 filesystem can cause the kernel to hang +during the lookup operations. By setting the HAS_SUB_NODE flag in an +INDEX_ENTRY within a directory's INDEX_ALLOCATION block and manipulating the +VCN pointer, an attacker can cause the indx_find() function to repeatedly +read the same block, allocating 4 KB of memory each time. The kernel lacks +VCN loop detection and depth limits, causing memory exhaustion and an OOM +crash. + +This patch adds a return value check for fnd_push() to prevent a memory +exhaustion vulnerability caused by infinite loops. When the index exceeds the +size of the fnd->nodes array, fnd_push() returns -EINVAL. The indx_find() +function checks this return value and stops processing, preventing further +memory allocation. + +Co-developed-by: Seunghun Han +Signed-off-by: Seunghun Han +Co-developed-by: Jihoon Kwon +Signed-off-by: Jihoon Kwon +Signed-off-by: Jaehun Gou +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/index.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c +index f227db9f76c2b..4330c2b39e505 100644 +--- a/fs/ntfs3/index.c ++++ b/fs/ntfs3/index.c +@@ -1192,7 +1192,12 @@ int indx_find(struct ntfs_index *indx, struct ntfs_inode *ni, + return -EINVAL; + } + +- fnd_push(fnd, node, e); ++ err = fnd_push(fnd, node, e); ++ ++ if (err) { ++ put_indx_node(node); ++ return err; ++ } + } + + *entry = e; +-- +2.51.0 + diff --git a/queue-6.6/fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch b/queue-6.6/fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch new file mode 100644 index 00000000000..ea45ba172f0 --- /dev/null +++ b/queue-6.6/fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch @@ -0,0 +1,38 @@ +From 8e7c8296aef739d31801beed64e70c215c556ae5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Dec 2025 14:27:48 +0300 +Subject: fs/ntfs3: drop preallocated clusters for sparse and compressed files + +From: Konstantin Komarov + +[ Upstream commit 3a6aba7f3cf2b46816e08548c254d98de9c74eba ] + +Do not keep preallocated clusters for sparsed and compressed files. +Preserving preallocation in these cases causes fsx failures when running +with sparse files and preallocation enabled. + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index ca9ee8eddcf4b..8f033e30e0d79 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -449,8 +449,10 @@ int attr_set_size(struct ntfs_inode *ni, enum ATTR_TYPE type, + + is_ext = is_attr_ext(attr_b); + align = sbi->cluster_size; +- if (is_ext) ++ if (is_ext) { + align <<= attr_b->nres.c_unit; ++ keep_prealloc = false; ++ } + + old_valid = le64_to_cpu(attr_b->nres.valid_size); + old_size = le64_to_cpu(attr_b->nres.data_size); +-- +2.51.0 + diff --git a/queue-6.6/fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch b/queue-6.6/fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch new file mode 100644 index 00000000000..c63c48e0e24 --- /dev/null +++ b/queue-6.6/fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch @@ -0,0 +1,83 @@ +From 4ff1fb3c378eed4973c23650ecffbc48ad13daab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 20:01:09 +0900 +Subject: fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent + metadata + +From: Jaehun Gou + +[ Upstream commit 4b90f16e4bb5607fb35e7802eb67874038da4640 ] + +We found an infinite loop bug in the ntfs3 file system that can lead to a +Denial-of-Service (DoS) condition. + +A malformed NTFS image can cause an infinite loop when an attribute header +indicates an empty run list, while directory entries reference it as +containing actual data. In NTFS, setting evcn=-1 with svcn=0 is a valid way +to represent an empty run list, and run_unpack() correctly handles this by +checking if evcn + 1 equals svcn and returning early without parsing any run +data. However, this creates a problem when there is metadata inconsistency, +where the attribute header claims to be empty (evcn=-1) but the caller +expects to read actual data. When run_unpack() immediately returns success +upon seeing this condition, it leaves the runs_tree uninitialized with +run->runs as a NULL. The calling function attr_load_runs_range() assumes +that a successful return means that the runs were loaded and sets clen to 0, +expecting the next run_lookup_entry() call to succeed. Because runs_tree +remains uninitialized, run_lookup_entry() continues to fail, and the loop +increments vcn by zero (vcn += 0), leading to an infinite loop. + +This patch adds a retry counter to detect when run_lookup_entry() fails +consecutively after attr_load_runs_vcn(). If the run is still not found on +the second attempt, it indicates corrupted metadata and returns -EINVAL, +preventing the Denial-of-Service (DoS) vulnerability. + +Co-developed-by: Seunghun Han +Signed-off-by: Seunghun Han +Co-developed-by: Jihoon Kwon +Signed-off-by: Jihoon Kwon +Signed-off-by: Jaehun Gou +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index e25989dd2c6bb..ca9ee8eddcf4b 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -1367,19 +1367,28 @@ int attr_load_runs_range(struct ntfs_inode *ni, enum ATTR_TYPE type, + CLST vcn; + CLST vcn_last = (to - 1) >> cluster_bits; + CLST lcn, clen; +- int err; ++ int err = 0; ++ int retry = 0; + + for (vcn = from >> cluster_bits; vcn <= vcn_last; vcn += clen) { + if (!run_lookup_entry(run, vcn, &lcn, &clen, NULL)) { ++ if (retry != 0) { /* Next run_lookup_entry(vcn) also failed. */ ++ err = -EINVAL; ++ break; ++ } + err = attr_load_runs_vcn(ni, type, name, name_len, run, + vcn); + if (err) +- return err; ++ break; ++ + clen = 0; /* Next run_lookup_entry(vcn) must be success. */ ++ retry++; + } ++ else ++ retry = 0; + } + +- return 0; ++ return err; + } + + #ifdef CONFIG_NTFS3_LZX_XPRESS +-- +2.51.0 + diff --git a/queue-6.6/fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch b/queue-6.6/fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch new file mode 100644 index 00000000000..ab51b171614 --- /dev/null +++ b/queue-6.6/fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch @@ -0,0 +1,68 @@ +From b1850bfee548aae045d0d810380dac07e2177dad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 20:01:46 +0900 +Subject: fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST + +From: Jaehun Gou + +[ Upstream commit 06909b2549d631a47fcda249d34be26f7ca1711d ] + +We found an infinite loop bug in the ntfs3 file system that can lead to a +Denial-of-Service (DoS) condition. + +A malformed NTFS image can cause an infinite loop when an ATTR_LIST attribute +indicates a zero data size while the driver allocates memory for it. + +When ntfs_load_attr_list() processes a resident ATTR_LIST with data_size set +to zero, it still allocates memory because of al_aligned(0). This creates an +inconsistent state where ni->attr_list.size is zero, but ni->attr_list.le is +non-null. This causes ni_enum_attr_ex to incorrectly assume that no attribute +list exists and enumerates only the primary MFT record. When it finds +ATTR_LIST, the code reloads it and restarts the enumeration, repeating +indefinitely. The mount operation never completes, hanging the kernel thread. + +This patch adds validation to ensure that data_size is non-zero before memory +allocation. When a zero-sized ATTR_LIST is detected, the function returns +-EINVAL, preventing a DoS vulnerability. + +Co-developed-by: Seunghun Han +Signed-off-by: Seunghun Han +Co-developed-by: Jihoon Kwon +Signed-off-by: Jihoon Kwon +Signed-off-by: Jaehun Gou +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrlist.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/fs/ntfs3/attrlist.c b/fs/ntfs3/attrlist.c +index 9f4bd8d260901..9355b4416719d 100644 +--- a/fs/ntfs3/attrlist.c ++++ b/fs/ntfs3/attrlist.c +@@ -52,6 +52,11 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr) + + if (!attr->non_res) { + lsize = le32_to_cpu(attr->res.data_size); ++ if (!lsize) { ++ err = -EINVAL; ++ goto out; ++ } ++ + /* attr is resident: lsize < record_size (1K or 4K) */ + le = kvmalloc(al_aligned(lsize), GFP_KERNEL); + if (!le) { +@@ -66,6 +71,10 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr) + u16 run_off = le16_to_cpu(attr->nres.run_off); + + lsize = le64_to_cpu(attr->nres.data_size); ++ if (!lsize) { ++ err = -EINVAL; ++ goto out; ++ } + + run_init(&ni->attr_list.run); + +-- +2.51.0 + diff --git a/queue-6.6/gfs2-fiemap-page-fault-fix.patch b/queue-6.6/gfs2-fiemap-page-fault-fix.patch new file mode 100644 index 00000000000..0870f4fba09 --- /dev/null +++ b/queue-6.6/gfs2-fiemap-page-fault-fix.patch @@ -0,0 +1,69 @@ +From afb35d5bee9bc3ca54568961199f3c9cab91ab01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Feb 2026 15:52:57 +0100 +Subject: gfs2: fiemap page fault fix + +From: Andreas Gruenbacher + +[ Upstream commit e411d74cc5ba290f85d0dd5e4d1df8f1d6d975d2 ] + +In gfs2_fiemap(), we are calling iomap_fiemap() while holding the inode +glock. This can lead to recursive glock taking if the fiemap buffer is +memory mapped to the same inode and accessing it triggers a page fault. + +Fix by disabling page faults for iomap_fiemap() and faulting in the +buffer by hand if necessary. + +Fixes xfstest generic/742. + +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/inode.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c +index b65444bc1b5f2..45040622d316e 100644 +--- a/fs/gfs2/inode.c ++++ b/fs/gfs2/inode.c +@@ -2105,6 +2105,14 @@ static int gfs2_getattr(struct mnt_idmap *idmap, + return 0; + } + ++static bool fault_in_fiemap(struct fiemap_extent_info *fi) ++{ ++ struct fiemap_extent __user *dest = fi->fi_extents_start; ++ size_t size = sizeof(*dest) * fi->fi_extents_max; ++ ++ return fault_in_safe_writeable((char __user *)dest, size) == 0; ++} ++ + static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, + u64 start, u64 len) + { +@@ -2114,14 +2122,22 @@ static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, + + inode_lock_shared(inode); + ++retry: + ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_SHARED, 0, &gh); + if (ret) + goto out; + ++ pagefault_disable(); + ret = iomap_fiemap(inode, fieinfo, start, len, &gfs2_iomap_ops); ++ pagefault_enable(); + + gfs2_glock_dq_uninit(&gh); + ++ if (ret == -EFAULT && fault_in_fiemap(fieinfo)) { ++ fieinfo->fi_extents_mapped = 0; ++ goto retry; ++ } ++ + out: + inode_unlock_shared(inode); + return ret; +-- +2.51.0 + diff --git a/queue-6.6/gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch b/queue-6.6/gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch new file mode 100644 index 00000000000..050f9dba93d --- /dev/null +++ b/queue-6.6/gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch @@ -0,0 +1,56 @@ +From 6b2cc62710004f405f78311a19c3637ffac99f0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 17:26:26 +0800 +Subject: gpio: aspeed-sgpio: Change the macro to support deferred probe + +From: Billy Tsai + +[ Upstream commit e18533b023ec7a33488bcf33140ce69bbba2894f ] + +Use module_platform_driver() to replace module_platform_driver_probe(). +The former utilizes platform_driver_register(), which allows the driver to +defer probing when it doesn't acquire the necessary resources due to probe +order. In contrast, the latter uses __platform_driver_probe(), which +includes the comment "Note that this is incompatible with deferred +probing." Since our SGPIO driver requires access to the clock resource, the +former is more suitable. + +Reviewed-by: Linus Walleij +Signed-off-by: Billy Tsai +Link: https://lore.kernel.org/r/20260123-upstream_sgpio-v2-1-69cfd1631400@aspeedtech.com +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-aspeed-sgpio.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpio/gpio-aspeed-sgpio.c b/drivers/gpio/gpio-aspeed-sgpio.c +index 72755fee64784..e69a6ce7be3fb 100644 +--- a/drivers/gpio/gpio-aspeed-sgpio.c ++++ b/drivers/gpio/gpio-aspeed-sgpio.c +@@ -534,7 +534,7 @@ static const struct of_device_id aspeed_sgpio_of_table[] = { + + MODULE_DEVICE_TABLE(of, aspeed_sgpio_of_table); + +-static int __init aspeed_sgpio_probe(struct platform_device *pdev) ++static int aspeed_sgpio_probe(struct platform_device *pdev) + { + u32 nr_gpios, sgpio_freq, sgpio_clk_div, gpio_cnt_regval, pin_mask; + const struct aspeed_sgpio_pdata *pdata; +@@ -629,11 +629,12 @@ static int __init aspeed_sgpio_probe(struct platform_device *pdev) + } + + static struct platform_driver aspeed_sgpio_driver = { ++ .probe = aspeed_sgpio_probe, + .driver = { + .name = KBUILD_MODNAME, + .of_match_table = aspeed_sgpio_of_table, + }, + }; + +-module_platform_driver_probe(aspeed_sgpio_driver, aspeed_sgpio_probe); ++module_platform_driver(aspeed_sgpio_driver); + MODULE_DESCRIPTION("Aspeed Serial GPIO Driver"); +-- +2.51.0 + diff --git a/queue-6.6/gro-change-the-bug_on-in-gro_pull_from_frag0.patch b/queue-6.6/gro-change-the-bug_on-in-gro_pull_from_frag0.patch new file mode 100644 index 00000000000..8e569cdefa6 --- /dev/null +++ b/queue-6.6/gro-change-the-bug_on-in-gro_pull_from_frag0.patch @@ -0,0 +1,46 @@ +From d9fe9a87c1949cb4e2d2bfc361f52cdcfe9da576 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 04:57:17 +0000 +Subject: gro: change the BUG_ON() in gro_pull_from_frag0() + +From: Eric Dumazet + +[ Upstream commit cbe41362be2c27e0237a94a404ae413cec9c2ad9 ] + +Replace the BUG_ON() which never fired with a DEBUG_NET_WARN_ON_ONCE() + +$ scripts/bloat-o-meter -t vmlinux.1 vmlinux.2 +add/remove: 2/2 grow/shrink: 1/1 up/down: 370/-254 (116) +Function old new delta +gro_try_pull_from_frag0 - 196 +196 +napi_gro_frags 771 929 +158 +__pfx_gro_try_pull_from_frag0 - 16 +16 +__pfx_gro_pull_from_frag0 16 - -16 +dev_gro_receive 1514 1464 -50 +gro_pull_from_frag0 188 - -188 +Total: Before=22565899, After=22566015, chg +0.00% + +Signed-off-by: Eric Dumazet +Link: https://patch.msgid.link/20260122045720.1221017-3-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/gro.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/gro.c b/net/core/gro.c +index 87889cb75d219..92cb86d4ce50a 100644 +--- a/net/core/gro.c ++++ b/net/core/gro.c +@@ -386,7 +386,7 @@ static void gro_pull_from_frag0(struct sk_buff *skb, int grow) + { + struct skb_shared_info *pinfo = skb_shinfo(skb); + +- BUG_ON(skb->end - skb->tail < grow); ++ DEBUG_NET_WARN_ON_ONCE(skb->end - skb->tail < grow); + + memcpy(skb_tail_pointer(skb), NAPI_GRO_CB(skb)->frag0, grow); + +-- +2.51.0 + diff --git a/queue-6.6/hfsplus-fix-volume-corruption-issue-for-generic-498.patch b/queue-6.6/hfsplus-fix-volume-corruption-issue-for-generic-498.patch new file mode 100644 index 00000000000..149a4c815d1 --- /dev/null +++ b/queue-6.6/hfsplus-fix-volume-corruption-issue-for-generic-498.patch @@ -0,0 +1,150 @@ +From d6a85fedceb45748a32d583764e8f17edfc57613 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Dec 2025 19:58:22 -0800 +Subject: hfsplus: fix volume corruption issue for generic/498 + +From: Viacheslav Dubeyko + +[ Upstream commit 9a8c4ad44721da4c48e1ff240ac76286c82837fe ] + +The xfstests' test-case generic/498 leaves HFS+ volume +in corrupted state: + +sudo ./check generic/498 +FSTYP -- hfsplus +PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #18 SMP PREEMPT_DYNAMIC Thu Dec 4 12:24:45 PST 2025 +MKFS_OPTIONS -- /dev/loop51 +MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch + +generic/498 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent +(see XFSTESTS-2/xfstests-dev/results//generic/498.full for details) + +Ran: generic/498 +Failures: generic/498 +Failed 1 of 1 tests + +sudo fsck.hfsplus -d /dev/loop51 +** /dev/loop51 +Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K. +Executing fsck_hfs (version 540.1-Linux). +** Checking non-journaled HFS Plus Volume. +The volume name is untitled +** Checking extents overflow file. +** Checking catalog file. +Invalid leaf record count +(It should be 16 instead of 2) +** Checking multi-linked files. +CheckHardLinks: found 1 pre-Leopard file inodes. +** Checking catalog hierarchy. +** Checking extended attributes file. +** Checking volume bitmap. +** Checking volume information. +Verify Status: VIStat = 0x0000, ABTStat = 0x0000 EBTStat = 0x0000 +CBTStat = 0x8000 CatStat = 0x00000000 +** Repairing volume. +** Rechecking volume. +** Checking non-journaled HFS Plus Volume. +The volume name is untitled +** Checking extents overflow file. +** Checking catalog file. +** Checking multi-linked files. +CheckHardLinks: found 1 pre-Leopard file inodes. +** Checking catalog hierarchy. +** Checking extended attributes file. +** Checking volume bitmap. +** Checking volume information. +** The volume untitled was repaired successfully. + +The generic/498 test executes such steps on final phase: + +mkdir $SCRATCH_MNT/A +mkdir $SCRATCH_MNT/B +mkdir $SCRATCH_MNT/A/C +touch $SCRATCH_MNT/B/foo +$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/B/foo + +ln $SCRATCH_MNT/B/foo $SCRATCH_MNT/A/C/foo +$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/A + +"Simulate a power failure and mount the filesystem +to check that what we explicitly fsync'ed exists." + +_flakey_drop_and_remount + +The FSCK tool complains about "Invalid leaf record count". +HFS+ b-tree header contains leaf_count field is updated +by hfs_brec_insert() and hfs_brec_remove(). The hfs_brec_insert() +is involved into hard link creation process. However, +modified in-core leaf_count field is stored into HFS+ +b-tree header by hfs_btree_write() method. But, +unfortunately, hfs_btree_write() hasn't been called +by hfsplus_cat_write_inode() and hfsplus_file_fsync() +stores not fully consistent state of the Catalog File's +b-tree. + +This patch adds calling hfs_btree_write() method in +the hfsplus_cat_write_inode() with the goal of +storing consistent state of Catalog File's b-tree. +Finally, it makes FSCK tool happy. + +sudo ./check generic/498 +FSTYP -- hfsplus +PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #22 SMP PREEMPT_DYNAMIC Sat Dec 6 17:01:31 PST 2025 +MKFS_OPTIONS -- /dev/loop51 +MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch + +generic/498 33s ... 31s +Ran: generic/498 +Passed all 1 tests + +Signed-off-by: Viacheslav Dubeyko +cc: John Paul Adrian Glaubitz +cc: Yangtao Li +cc: linux-fsdevel@vger.kernel.org +Link: https://lore.kernel.org/r/20251207035821.3863657-1-slava@dubeyko.com +Signed-off-by: Viacheslav Dubeyko +Signed-off-by: Sasha Levin +--- + fs/hfsplus/inode.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c +index 2619e5371ec9c..2dd17192d11c3 100644 +--- a/fs/hfsplus/inode.c ++++ b/fs/hfsplus/inode.c +@@ -604,6 +604,7 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd) + int hfsplus_cat_write_inode(struct inode *inode) + { + struct inode *main_inode = inode; ++ struct hfs_btree *tree = HFSPLUS_SB(inode->i_sb)->cat_tree; + struct hfs_find_data fd; + hfsplus_cat_entry entry; + int res = 0; +@@ -614,7 +615,7 @@ int hfsplus_cat_write_inode(struct inode *inode) + if (!main_inode->i_nlink) + return 0; + +- if (hfs_find_init(HFSPLUS_SB(main_inode->i_sb)->cat_tree, &fd)) ++ if (hfs_find_init(tree, &fd)) + /* panic? */ + return -EIO; + +@@ -679,6 +680,15 @@ int hfsplus_cat_write_inode(struct inode *inode) + set_bit(HFSPLUS_I_CAT_DIRTY, &HFSPLUS_I(inode)->flags); + out: + hfs_find_exit(&fd); ++ ++ if (!res) { ++ res = hfs_btree_write(tree); ++ if (res) { ++ pr_err("b-tree write err: %d, ino %lu\n", ++ res, inode->i_ino); ++ } ++ } ++ + return res; + } + +-- +2.51.0 + diff --git a/queue-6.6/hfsplus-pretend-special-inodes-as-regular-files.patch b/queue-6.6/hfsplus-pretend-special-inodes-as-regular-files.patch new file mode 100644 index 00000000000..b1a28f1a921 --- /dev/null +++ b/queue-6.6/hfsplus-pretend-special-inodes-as-regular-files.patch @@ -0,0 +1,45 @@ +From 17f67ed0df33d6adb61c8d520fc6cb426ca9068b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 18:39:33 +0900 +Subject: hfsplus: pretend special inodes as regular files + +From: Tetsuo Handa + +[ Upstream commit ed8889ca21b6ab37bc1435c4009ce37a79acb9e6 ] + +Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()") +requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/ +S_IFIFO/S_IFSOCK type, use S_IFREG for special inodes. + +Reported-by: syzbot +Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d +Signed-off-by: Tetsuo Handa +Reviewed-by: Viacheslav Dubeyko +Signed-off-by: Viacheslav Dubeyko +Link: https://lore.kernel.org/r/d0a07b1b-8b73-4002-8e29-e2bd56871262@I-love.SAKURA.ne.jp +Signed-off-by: Viacheslav Dubeyko +Signed-off-by: Sasha Levin +--- + fs/hfsplus/super.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c +index 7e889820a63d0..954ceaa748e62 100644 +--- a/fs/hfsplus/super.c ++++ b/fs/hfsplus/super.c +@@ -52,6 +52,12 @@ static int hfsplus_system_read_inode(struct inode *inode) + return -EIO; + } + ++ /* ++ * Assign a dummy file type, for may_open() requires that ++ * an inode has a valid file type. ++ */ ++ inode->i_mode = S_IFREG; ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.6/hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch b/queue-6.6/hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch new file mode 100644 index 00000000000..05bb60d56c4 --- /dev/null +++ b/queue-6.6/hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch @@ -0,0 +1,37 @@ +From e4603667da8e357191cc18f8bfae883e5a4eddd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Nov 2025 06:06:23 +0000 +Subject: HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple + keyboards + +From: Joey Bednar + +[ Upstream commit 7273acfd0aef106093a8ffa3b4973eb70e5a3799 ] + +The SoNiX KN85 keyboard identifies as the "Apple, Inc. Aluminium +Keyboard" and is not recognized as a non-apple keyboard. Adding "SoNiX +KN85 Keyboard" to the list of non-apple keyboards fixes the function +keys. + +Signed-off-by: Joey Bednar +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-apple.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c +index 2b8021628d3c6..9dd5c698fefe0 100644 +--- a/drivers/hid/hid-apple.c ++++ b/drivers/hid/hid-apple.c +@@ -340,6 +340,7 @@ static const struct apple_key_translation swapped_fn_leftctrl_keys[] = { + }; + + static const struct apple_non_apple_keyboard non_apple_keyboards[] = { ++ { "SONiX KN85 Keyboard" }, + { "SONiX USB DEVICE" }, + { "SONiX AK870 PRO" }, + { "Keychron" }, +-- +2.51.0 + diff --git a/queue-6.6/hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch b/queue-6.6/hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch new file mode 100644 index 00000000000..3cfaf3c4bed --- /dev/null +++ b/queue-6.6/hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch @@ -0,0 +1,141 @@ +From 8a6a22b18a3485883ad5a5670b43682de4d2a76b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 12:56:09 +0900 +Subject: HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK + +From: David Phillips + +[ Upstream commit b8e5fdf0bd022cd5493a5987ef66f5a24f8352d8 ] + +New model in the ELECOM HUGE trackball line that has 8 buttons but the +report descriptor specifies only 5. The HUGE Plus supports connecting via +Bluetooth, 2.4GHz wireless USB dongle, and directly via a USB-C cable. +Each connection type reports a different device id, 01AA for cable, +01AB for USB dongle, and 01AC for Bluetooth. + +This patch adds these device IDs and applies the fixups similar to the +other ELECOM devices to get all 8 buttons working for all 3 connection +types. + +For reference, the usbhid-dump output: +001:013:001:DESCRIPTOR 1769085639.598405 + 05 01 09 02 A1 01 85 01 09 01 A1 00 05 09 19 01 + 29 05 15 00 25 01 75 01 95 05 81 02 75 03 95 01 + 81 01 05 01 09 30 09 31 16 01 80 26 FF 7F 75 10 + 95 02 81 06 09 38 15 81 25 7F 75 08 95 01 81 06 + 05 0C 0A 38 02 15 81 25 7F 75 08 95 01 81 06 C0 + C0 05 0C 09 01 A1 01 85 02 15 01 26 8C 02 19 01 + 2A 8C 02 75 10 95 01 81 00 C0 05 01 09 80 A1 01 + 85 03 09 82 09 81 09 83 15 00 25 01 19 01 29 03 + 75 01 95 03 81 02 95 05 81 01 C0 06 01 FF 09 00 + A1 01 85 08 09 00 15 00 26 FF 00 75 08 95 07 81 + 02 C0 06 02 FF 09 02 A1 01 85 06 09 02 15 00 26 + FF 00 75 08 95 07 B1 02 C0 + +Signed-off-by: David Phillips +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/Kconfig | 1 + + drivers/hid/hid-elecom.c | 16 ++++++++++++++++ + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/hid-quirks.c | 3 +++ + 4 files changed, 23 insertions(+) + +diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig +index ffbeb39341e1a..851ddbc25bedd 100644 +--- a/drivers/hid/Kconfig ++++ b/drivers/hid/Kconfig +@@ -328,6 +328,7 @@ config HID_ELECOM + - EX-G Trackballs (M-XT3DRBK, M-XT3URBK) + - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK) + - HUGE Trackballs (M-HT1DRBK, M-HT1URBK) ++ - HUGE Plus Trackball (M-HT1MRBK) + + config HID_ELO + tristate "ELO USB 4000/4500 touchscreen" +diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c +index f76fec79e8903..9aeb2d2b43a43 100644 +--- a/drivers/hid/hid-elecom.c ++++ b/drivers/hid/hid-elecom.c +@@ -5,6 +5,7 @@ + * - EX-G Trackballs (M-XT3DRBK, M-XT3URBK, M-XT4DRBK) + * - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK) + * - HUGE Trackballs (M-HT1DRBK, M-HT1URBK) ++ * - HUGE Plus Trackball (M-HT1MRBK) + * + * Copyright (c) 2010 Richard Nauber + * Copyright (c) 2016 Yuxuan Shui +@@ -111,12 +112,25 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc, + */ + mouse_button_fixup(hdev, rdesc, *rsize, 22, 30, 24, 16, 8); + break; ++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK: ++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB: ++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC: ++ /* ++ * Report descriptor format: ++ * 24: button bit count ++ * 28: padding bit count ++ * 22: button report size ++ * 16: button usage maximum ++ */ ++ mouse_button_fixup(hdev, rdesc, *rsize, 24, 28, 22, 16, 8); ++ break; + } + return rdesc; + } + + static const struct hid_device_id elecom_devices[] = { + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, ++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, +@@ -127,6 +141,8 @@ static const struct hid_device_id elecom_devices[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) }, + { } + }; + MODULE_DEVICE_TABLE(hid, elecom_devices); +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index fa54c0303d8b0..a1910e12f7e05 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -453,6 +453,9 @@ + #define USB_DEVICE_ID_ELECOM_M_HT1URBK 0x010c + #define USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D 0x010d + #define USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C 0x011c ++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK 0x01aa ++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB 0x01ab ++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC 0x01ac + + #define USB_VENDOR_ID_DREAM_CHEEKY 0x1d34 + #define USB_DEVICE_ID_DREAM_CHEEKY_WN 0x0004 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 1f531626192cd..7a3e0675d9ba2 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -415,6 +415,7 @@ static const struct hid_device_id hid_have_special_driver[] = { + #if IS_ENABLED(CONFIG_HID_ELECOM) + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, ++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) }, +@@ -424,6 +425,8 @@ static const struct hid_device_id hid_have_special_driver[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) }, + #endif + #if IS_ENABLED(CONFIG_HID_ELO) + { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) }, +-- +2.51.0 + diff --git a/queue-6.6/hid-multitouch-add-egalaxtouch-exc3188-support.patch b/queue-6.6/hid-multitouch-add-egalaxtouch-exc3188-support.patch new file mode 100644 index 00000000000..40355d65d68 --- /dev/null +++ b/queue-6.6/hid-multitouch-add-egalaxtouch-exc3188-support.patch @@ -0,0 +1,49 @@ +From ceef55048c7e1b294e9058b50642ba654206b56f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 09:57:05 +0100 +Subject: HID: multitouch: add eGalaxTouch EXC3188 support + +From: Thorsten Schmelzer + +[ Upstream commit 8e4ac86b2ddd36fe501e20ecfcc080e536df1f48 ] + +Add support for the for the EXC3188 touchscreen from eGalaxy. + +Signed-off-by: Thorsten Schmelzer +Signed-off-by: Michael Tretter +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-multitouch.c | 3 +++ + 2 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 931746cf36302..fa54c0303d8b0 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -427,6 +427,7 @@ + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7349 0x7349 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7 0x73f7 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001 ++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000 0xc000 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002 0xc002 + + #define USB_VENDOR_ID_EDIFIER 0x2d99 +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 6d9a85c5fc409..b6c2cb7153fde 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -2020,6 +2020,9 @@ static const struct hid_device_id mt_devices[] = { + { .driver_data = MT_CLS_EGALAX_SERIAL, + MT_USB_DEVICE(USB_VENDOR_ID_DWAV, + USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) }, ++ { .driver_data = MT_CLS_EGALAX_SERIAL, ++ MT_USB_DEVICE(USB_VENDOR_ID_DWAV, ++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000) }, + { .driver_data = MT_CLS_EGALAX, + MT_USB_DEVICE(USB_VENDOR_ID_DWAV, + USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002) }, +-- +2.51.0 + diff --git a/queue-6.6/hisi_acc_vfio_pci-update-status-after-ras-error.patch b/queue-6.6/hisi_acc_vfio_pci-update-status-after-ras-error.patch new file mode 100644 index 00000000000..72202c28aba --- /dev/null +++ b/queue-6.6/hisi_acc_vfio_pci-update-status-after-ras-error.patch @@ -0,0 +1,41 @@ +From 52d854c0b0a4c2e9747f5b3567ba9da18fa71ad2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 10:02:03 +0800 +Subject: hisi_acc_vfio_pci: update status after RAS error + +From: Longfang Liu + +[ Upstream commit 8be14dd48dfee0df91e511acceb4beeb2461a083 ] + +After a RAS error occurs on the accelerator device, the accelerator +device will be reset. The live migration state will be abnormal +after reset, and the original state needs to be restored during +the reset process. +Therefore, reset processing needs to be performed in a live +migration scenario. + +Signed-off-by: Longfang Liu +Link: https://lore.kernel.org/r/20260122020205.2884497-3-liulongfang@huawei.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c +index 712b178c42aae..e544fd0a710c0 100644 +--- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c ++++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c +@@ -1152,8 +1152,7 @@ static void hisi_acc_vf_pci_aer_reset_done(struct pci_dev *pdev) + { + struct hisi_acc_vf_core_device *hisi_acc_vdev = hisi_acc_drvdata(pdev); + +- if (hisi_acc_vdev->core_device.vdev.migration_flags != +- VFIO_MIGRATION_STOP_COPY) ++ if (!hisi_acc_vdev->core_device.vdev.mig_ops) + return; + + /* +-- +2.51.0 + diff --git a/queue-6.6/hwmon-f71882fg-add-f81968-support.patch b/queue-6.6/hwmon-f71882fg-add-f81968-support.patch new file mode 100644 index 00000000000..ceb78fb2c3b --- /dev/null +++ b/queue-6.6/hwmon-f71882fg-add-f81968-support.patch @@ -0,0 +1,59 @@ +From 18d0fc58b98941020e01c1d6a14f4a6faef9e782 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Dec 2025 13:10:40 +0800 +Subject: hwmon: (f71882fg) Add F81968 support + +From: Ji-Ze Hong (Peter Hong) + +[ Upstream commit e4a3d6f79c9933fece64368168c46d6cf5fc2e52 ] + +Add hardware monitoring support for the Fintek F81968 Super I/O chip. +It is fully compatible with F81866. + +Several products share compatibility with the F81866. To better distinguish +between them, ensure that the Product ID is displayed when the device is +probed. + +Signed-off-by: Ji-Ze Hong (Peter Hong) +Link: https://lore.kernel.org/r/20251223051040.10227-1-peter_hong@fintek.com.tw +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/f71882fg.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c +index 27207ec6f7feb..5e3c8be255e87 100644 +--- a/drivers/hwmon/f71882fg.c ++++ b/drivers/hwmon/f71882fg.c +@@ -51,6 +51,7 @@ + #define SIO_F81866_ID 0x1010 /* Chipset ID */ + #define SIO_F71858AD_ID 0x0903 /* Chipset ID */ + #define SIO_F81966_ID 0x1502 /* Chipset ID */ ++#define SIO_F81968_ID 0x1806 /* Chipset ID */ + + #define REGION_LENGTH 8 + #define ADDR_REG_OFFSET 5 +@@ -2571,6 +2572,7 @@ static int __init f71882fg_find(int sioaddr, struct f71882fg_sio_data *sio_data) + break; + case SIO_F81866_ID: + case SIO_F81966_ID: ++ case SIO_F81968_ID: + sio_data->type = f81866a; + break; + default: +@@ -2600,9 +2602,9 @@ static int __init f71882fg_find(int sioaddr, struct f71882fg_sio_data *sio_data) + address &= ~(REGION_LENGTH - 1); /* Ignore 3 LSB */ + + err = address; +- pr_info("Found %s chip at %#x, revision %d\n", ++ pr_info("Found %s chip at %#x, revision %d, devid: %04x\n", + f71882fg_names[sio_data->type], (unsigned int)address, +- (int)superio_inb(sioaddr, SIO_REG_DEVREV)); ++ (int)superio_inb(sioaddr, SIO_REG_DEVREV), devid); + exit: + superio_exit(sioaddr); + return err; +-- +2.51.0 + diff --git a/queue-6.6/hwmon-nct6775-add-asus-pro-ws-wrx90e-sage-se.patch b/queue-6.6/hwmon-nct6775-add-asus-pro-ws-wrx90e-sage-se.patch new file mode 100644 index 00000000000..68a53e9ec59 --- /dev/null +++ b/queue-6.6/hwmon-nct6775-add-asus-pro-ws-wrx90e-sage-se.patch @@ -0,0 +1,39 @@ +From 6b0a784d75c2f8e3054baa1cd98649d22c84737c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Dec 2025 17:53:14 +0200 +Subject: hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE + +From: Denis Pauk + +[ Upstream commit 246167b17c14e8a5142368ac6457e81622055e0a ] + +Boards Pro WS WRX90E-SAGE SE has got a nct6775 chip, but by default there's +no use of it because of resource conflict with WMI method. + +Add the board to the WMI monitoring list. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=204807 +Signed-off-by: Denis Pauk +Tested-by: Marcus +Link: https://lore.kernel.org/r/20251231155316.2048-1-pauk.denis@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/nct6775-platform.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hwmon/nct6775-platform.c b/drivers/hwmon/nct6775-platform.c +index 7e0ac3fcbc050..b09fd5791db8e 100644 +--- a/drivers/hwmon/nct6775-platform.c ++++ b/drivers/hwmon/nct6775-platform.c +@@ -1356,6 +1356,7 @@ static const char * const asus_msi_boards[] = { + "Pro WS W680-ACE IPMI", + "Pro WS W790-ACE", + "Pro WS W790E-SAGE SE", ++ "Pro WS WRX90E-SAGE SE", + "ProArt B650-CREATOR", + "ProArt B660-CREATOR D4", + "ProArt B760-CREATOR D4", +-- +2.51.0 + diff --git a/queue-6.6/hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch b/queue-6.6/hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch new file mode 100644 index 00000000000..f62ea71bdd6 --- /dev/null +++ b/queue-6.6/hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch @@ -0,0 +1,61 @@ +From d05e746b985864e77aec90c67dc3012eaa178b37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 08:35:44 +0100 +Subject: hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 1e5271393d777f6159d896943b4c44c4f3ecff52 ] + +The unpacked union within a packed struct generates alignment warnings +on clang for 32-bit ARM: + +./usr/include/linux/hyperv.h:361:2: error: field within 'struct hv_kvp_exchg_msg_value' + is less aligned than 'union hv_kvp_exchg_msg_value::(anonymous at ./usr/include/linux/hyperv.h:361:2)' + and is usually due to 'struct hv_kvp_exchg_msg_value' being packed, + which can lead to unaligned accesses [-Werror,-Wunaligned-access] + 361 | union { + | ^ + +With the recent changes to compile-test the UAPI headers in more cases, +this warning in combination with CONFIG_WERROR breaks the build. + +Fix the warning. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/ +Reported-by: Nathan Chancellor +Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/ +Suggested-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/ +Signed-off-by: Thomas Weißschuh +Acked-by: Wei Liu (Microsoft) +Tested-by: Nicolas Schier +Reviewed-by: Nicolas Schier +Acked-by: Greg Kroah-Hartman +Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-1-076aed1623ff@linutronix.de +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + include/uapi/linux/hyperv.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/hyperv.h b/include/uapi/linux/hyperv.h +index aaa502a7bff46..1749b35ab2c21 100644 +--- a/include/uapi/linux/hyperv.h ++++ b/include/uapi/linux/hyperv.h +@@ -362,7 +362,7 @@ struct hv_kvp_exchg_msg_value { + __u8 value[HV_KVP_EXCHANGE_MAX_VALUE_SIZE]; + __u32 value_u32; + __u64 value_u64; +- }; ++ } __attribute__((packed)); + } __attribute__((packed)); + + struct hv_kvp_msg_enumerate { +-- +2.51.0 + diff --git a/queue-6.6/i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch b/queue-6.6/i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch new file mode 100644 index 00000000000..b9c09738b87 --- /dev/null +++ b/queue-6.6/i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch @@ -0,0 +1,49 @@ +From 7a7dc687b9597eb74006840919fa8ee7160f32ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 15:08:51 -0500 +Subject: i3c: master: svc: Initialize 'dev' to NULL in + svc_i3c_master_ibi_isr() + +From: Frank Li + +[ Upstream commit 3c9ffb4db787428a5851d5865823ab23842d5103 ] + +Initialize the 'dev' pointer to NULL in svc_i3c_master_ibi_isr() and add +a NULL check in the error path. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/r/202512131016.YCKIsDXM-lkp@intel.com/ +Signed-off-by: Frank Li +Link: https://patch.msgid.link/20251215200852.3079073-1-Frank.Li@nxp.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/svc-i3c-master.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c +index 3222b8f56a926..94792f3559a0f 100644 +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -418,8 +418,8 @@ static void svc_i3c_master_ibi_work(struct work_struct *work) + { + struct svc_i3c_master *master = container_of(work, struct svc_i3c_master, ibi_work); + struct svc_i3c_i2c_dev_data *data; ++ struct i3c_dev_desc *dev = NULL; + unsigned int ibitype, ibiaddr; +- struct i3c_dev_desc *dev; + u32 status, val; + int ret; + +@@ -503,7 +503,7 @@ static void svc_i3c_master_ibi_work(struct work_struct *work) + * for the slave to interrupt again. + */ + if (svc_i3c_master_error(master)) { +- if (master->ibi.tbq_slot) { ++ if (master->ibi.tbq_slot && dev) { + data = i3c_dev_get_master_data(dev); + i3c_generic_ibi_recycle_slot(data->ibi_pool, + master->ibi.tbq_slot); +-- +2.51.0 + diff --git a/queue-6.6/iio-magnetometer-remove-irqf_oneshot.patch b/queue-6.6/iio-magnetometer-remove-irqf_oneshot.patch new file mode 100644 index 00000000000..6780bec0618 --- /dev/null +++ b/queue-6.6/iio-magnetometer-remove-irqf_oneshot.patch @@ -0,0 +1,49 @@ +From 43027fd97c554f125508544d7d562e46e3510380 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:38 +0100 +Subject: iio: magnetometer: Remove IRQF_ONESHOT +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sebastian Andrzej Siewior + +[ Upstream commit a54e9440925e6617c98669066b4753c4cdcea8a0 ] + +Passing IRQF_ONESHOT ensures that the interrupt source is masked until +the secondary (threaded) handler is done. If only a primary handler is +used then the flag makes no sense because the interrupt can not fire +(again) while its handler is running. +The flag also disallows force-threading of the primary handler and the +irq-core will warn about this. +The force-threading functionality is required on PREEMPT_RT because the +handler is using locks with can sleep on PREEMPT_RT. + +Remove IRQF_ONESHOT from irqflags. + +Tested-by: Geert Uytterhoeven +Signed-off-by: Sebastian Andrzej Siewior +Reviewed-by: Andy Shevchenko +Reviewed-by: Nuno Sá +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/magnetometer/ak8975.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c +index 3a98d6bae1b20..c1894a26ffd67 100644 +--- a/drivers/iio/magnetometer/ak8975.c ++++ b/drivers/iio/magnetometer/ak8975.c +@@ -542,7 +542,7 @@ static int ak8975_setup_irq(struct ak8975_data *data) + irq = gpiod_to_irq(data->eoc_gpiod); + + rc = devm_request_irq(&client->dev, irq, ak8975_irq_handler, +- IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ IRQF_TRIGGER_RISING, + dev_name(&client->dev), data); + if (rc < 0) { + dev_err(&client->dev, "irq %d request failed: %d\n", irq, rc); +-- +2.51.0 + diff --git a/queue-6.6/iio-use-irqf_no_thread.patch b/queue-6.6/iio-use-irqf_no_thread.patch new file mode 100644 index 00000000000..e1ab076b039 --- /dev/null +++ b/queue-6.6/iio-use-irqf_no_thread.patch @@ -0,0 +1,90 @@ +From 9f6038e65e684bdfc5d314d63c72ca963f29fa7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:36 +0100 +Subject: iio: Use IRQF_NO_THREAD + +From: Sebastian Andrzej Siewior + +[ Upstream commit 04d390af97f2c28166f7ddfe1a6bda622e3a4766 ] + +The interrupt handler iio_trigger_generic_data_rdy_poll() will invoke +other interrupt handler and this supposed to happen from within the +hardirq. + +Use IRQF_NO_THREAD to forbid forced-threading. + +Signed-off-by: Sebastian Andrzej Siewior +Reviewed-by: Andy Shevchenko +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/accel/bma180.c | 5 +++-- + drivers/iio/adc/ad7766.c | 2 +- + drivers/iio/gyro/itg3200_buffer.c | 8 +++----- + drivers/iio/light/si1145.c | 2 +- + 4 files changed, 8 insertions(+), 9 deletions(-) + +diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c +index 13439f52d26db..0eabcd6957979 100644 +--- a/drivers/iio/accel/bma180.c ++++ b/drivers/iio/accel/bma180.c +@@ -996,8 +996,9 @@ static int bma180_probe(struct i2c_client *client) + } + + ret = devm_request_irq(dev, client->irq, +- iio_trigger_generic_data_rdy_poll, IRQF_TRIGGER_RISING, +- "bma180_event", data->trig); ++ iio_trigger_generic_data_rdy_poll, ++ IRQF_TRIGGER_RISING | IRQF_NO_THREAD, ++ "bma180_event", data->trig); + if (ret) { + dev_err(dev, "unable to request IRQ\n"); + goto err_trigger_free; +diff --git a/drivers/iio/adc/ad7766.c b/drivers/iio/adc/ad7766.c +index 3079a0872947e..d1d010c1dbf6c 100644 +--- a/drivers/iio/adc/ad7766.c ++++ b/drivers/iio/adc/ad7766.c +@@ -261,7 +261,7 @@ static int ad7766_probe(struct spi_device *spi) + * don't enable the interrupt to avoid extra load on the system + */ + ret = devm_request_irq(&spi->dev, spi->irq, ad7766_irq, +- IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN, ++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN | IRQF_NO_THREAD, + dev_name(&spi->dev), + ad7766->trig); + if (ret < 0) +diff --git a/drivers/iio/gyro/itg3200_buffer.c b/drivers/iio/gyro/itg3200_buffer.c +index 4cfa0d4395605..d1c125a77308a 100644 +--- a/drivers/iio/gyro/itg3200_buffer.c ++++ b/drivers/iio/gyro/itg3200_buffer.c +@@ -118,11 +118,9 @@ int itg3200_probe_trigger(struct iio_dev *indio_dev) + if (!st->trig) + return -ENOMEM; + +- ret = request_irq(st->i2c->irq, +- &iio_trigger_generic_data_rdy_poll, +- IRQF_TRIGGER_RISING, +- "itg3200_data_rdy", +- st->trig); ++ ret = request_irq(st->i2c->irq, &iio_trigger_generic_data_rdy_poll, ++ IRQF_TRIGGER_RISING | IRQF_NO_THREAD, ++ "itg3200_data_rdy", st->trig); + if (ret) + goto error_free_trig; + +diff --git a/drivers/iio/light/si1145.c b/drivers/iio/light/si1145.c +index 77666b780a5c5..9655214a38276 100644 +--- a/drivers/iio/light/si1145.c ++++ b/drivers/iio/light/si1145.c +@@ -1251,7 +1251,7 @@ static int si1145_probe_trigger(struct iio_dev *indio_dev) + + ret = devm_request_irq(&client->dev, client->irq, + iio_trigger_generic_data_rdy_poll, +- IRQF_TRIGGER_FALLING, ++ IRQF_TRIGGER_FALLING | IRQF_NO_THREAD, + "si1145_irq", + trig); + if (ret < 0) { +-- +2.51.0 + diff --git a/queue-6.6/include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch b/queue-6.6/include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch new file mode 100644 index 00000000000..9b74db1b42b --- /dev/null +++ b/queue-6.6/include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch @@ -0,0 +1,42 @@ +From ead903f96e4ff4639a71381bfc8b4b4943e1d0b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Feb 2026 15:54:06 +0100 +Subject: include: uapi: netfilter_bridge.h: Cover for musl libc + +From: Phil Sutter + +[ Upstream commit 4edd4ba71ce0df015303dba75ea9d20d1a217546 ] + +Musl defines its own struct ethhdr and thus defines __UAPI_DEF_ETHHDR to +zero. To avoid struct redefinition errors, user space is therefore +supposed to include netinet/if_ether.h before (or instead of) +linux/if_ether.h. To relieve them from this burden, include the libc +header here if not building for kernel space. + +Reported-by: Alyssa Ross +Suggested-by: Florian Westphal +Signed-off-by: Phil Sutter +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + include/uapi/linux/netfilter_bridge.h | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/include/uapi/linux/netfilter_bridge.h b/include/uapi/linux/netfilter_bridge.h +index 1610fdbab98df..ad520d3e9df8f 100644 +--- a/include/uapi/linux/netfilter_bridge.h ++++ b/include/uapi/linux/netfilter_bridge.h +@@ -5,6 +5,10 @@ + /* bridge-specific defines for netfilter. + */ + ++#ifndef __KERNEL__ ++#include /* for __UAPI_DEF_ETHHDR if defined */ ++#endif ++ + #include + #include + #include +-- +2.51.0 + diff --git a/queue-6.6/iommu-amd-move-wait_on_sem-out-of-spinlock.patch b/queue-6.6/iommu-amd-move-wait_on_sem-out-of-spinlock.patch new file mode 100644 index 00000000000..9764ce693a4 --- /dev/null +++ b/queue-6.6/iommu-amd-move-wait_on_sem-out-of-spinlock.patch @@ -0,0 +1,87 @@ +From a3b4987ebcdef9e6ec8a928987f31e97a830b16d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 14:39:40 +0000 +Subject: iommu/amd: move wait_on_sem() out of spinlock + +From: Ankit Soni + +[ Upstream commit d2a0cac10597068567d336e85fa3cbdbe8ca62bf ] + +With iommu.strict=1, the existing completion wait path can cause soft +lockups under stressed environment, as wait_on_sem() busy-waits under the +spinlock with interrupts disabled. + +Move the completion wait in iommu_completion_wait() out of the spinlock. +wait_on_sem() only polls the hardware-updated cmd_sem and does not require +iommu->lock, so holding the lock during the busy wait unnecessarily +increases contention and extends the time with interrupts disabled. + +Signed-off-by: Ankit Soni +Reviewed-by: Vasant Hegde +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd/iommu.c | 25 +++++++++++++++++-------- + 1 file changed, 17 insertions(+), 8 deletions(-) + +diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c +index 23cfb98fe90a7..d119a104a3436 100644 +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -941,7 +941,12 @@ static int wait_on_sem(struct amd_iommu *iommu, u64 data) + { + int i = 0; + +- while (*iommu->cmd_sem != data && i < LOOP_TIMEOUT) { ++ /* ++ * cmd_sem holds a monotonically non-decreasing completion sequence ++ * number. ++ */ ++ while ((__s64)(READ_ONCE(*iommu->cmd_sem) - data) < 0 && ++ i < LOOP_TIMEOUT) { + udelay(1); + i += 1; + } +@@ -1210,14 +1215,13 @@ static int iommu_completion_wait(struct amd_iommu *iommu) + raw_spin_lock_irqsave(&iommu->lock, flags); + + ret = __iommu_queue_command_sync(iommu, &cmd, false); ++ raw_spin_unlock_irqrestore(&iommu->lock, flags); ++ + if (ret) +- goto out_unlock; ++ return ret; + + ret = wait_on_sem(iommu, data); + +-out_unlock: +- raw_spin_unlock_irqrestore(&iommu->lock, flags); +- + return ret; + } + +@@ -2879,13 +2883,18 @@ static void iommu_flush_irt_and_complete(struct amd_iommu *iommu, u16 devid) + raw_spin_lock_irqsave(&iommu->lock, flags); + ret = __iommu_queue_command_sync(iommu, &cmd, true); + if (ret) +- goto out; ++ goto out_err; + ret = __iommu_queue_command_sync(iommu, &cmd2, false); + if (ret) +- goto out; ++ goto out_err; ++ raw_spin_unlock_irqrestore(&iommu->lock, flags); ++ + wait_on_sem(iommu, data); +-out: ++ return; ++ ++out_err: + raw_spin_unlock_irqrestore(&iommu->lock, flags); ++ return; + } + + static void set_dte_irq_entry(struct amd_iommu *iommu, u16 devid, +-- +2.51.0 + diff --git a/queue-6.6/iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch b/queue-6.6/iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch new file mode 100644 index 00000000000..493bb5e904d --- /dev/null +++ b/queue-6.6/iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch @@ -0,0 +1,134 @@ +From 5c91d29986205c48554e0f0dd0eb309b0754bb79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 13:28:57 -0800 +Subject: iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency + +From: Alexander Grest + +[ Upstream commit df180b1a4cc51011c5f8c52c7ec02ad2e42962de ] + +The SMMU CMDQ lock is highly contentious when there are multiple CPUs +issuing commands and the queue is nearly full. + +The lock has the following states: + - 0: Unlocked + - >0: Shared lock held with count + - INT_MIN+N: Exclusive lock held, where N is the # of shared waiters + - INT_MIN: Exclusive lock held, no shared waiters + +When multiple CPUs are polling for space in the queue, they attempt to +grab the exclusive lock to update the cons pointer from the hardware. If +they fail to get the lock, they will spin until either the cons pointer +is updated by another CPU. + +The current code allows the possibility of shared lock starvation +if there is a constant stream of CPUs trying to grab the exclusive lock. +This leads to severe latency issues and soft lockups. + +Consider the following scenario where CPU1's attempt to acquire the +shared lock is starved by CPU2 and CPU0 contending for the exclusive +lock. + +CPU0 (exclusive) | CPU1 (shared) | CPU2 (exclusive) | `cmdq->lock` +-------------------------------------------------------------------------- +trylock() //takes | | | 0 + | shared_lock() | | INT_MIN + | fetch_inc() | | INT_MIN + | no return | | INT_MIN + 1 + | spins // VAL >= 0 | | INT_MIN + 1 +unlock() | spins... | | INT_MIN + 1 +set_release(0) | spins... | | 0 see[NOTE] +(done) | (sees 0) | trylock() // takes | 0 + | *exits loop* | cmpxchg(0, INT_MIN) | 0 + | | *cuts in* | INT_MIN + | cmpxchg(0, 1) | | INT_MIN + | fails // != 0 | | INT_MIN + | spins // VAL >= 0 | | INT_MIN + | *starved* | | INT_MIN + +[NOTE] The current code resets the exclusive lock to 0 regardless of the +state of the lock. This causes two problems: +1. It opens the possibility of back-to-back exclusive locks and the + downstream effect of starving shared lock. +2. The count of shared lock waiters are lost. + +To mitigate this, we release the exclusive lock by only clearing the sign +bit while retaining the shared lock waiter count as a way to avoid +starving the shared lock waiters. + +Also deleted cmpxchg loop while trying to acquire the shared lock as it +is not needed. The waiters can see the positive lock count and proceed +immediately after the exclusive lock is released. + +Exclusive lock is not starved in that submitters will try exclusive lock +first when new spaces become available. + +Reviewed-by: Mostafa Saleh +Reviewed-by: Nicolin Chen +Signed-off-by: Alexander Grest +Signed-off-by: Jacob Pan +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 31 ++++++++++++++------- + 1 file changed, 21 insertions(+), 10 deletions(-) + +diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +index f2260f45728e7..bb7365b432198 100644 +--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c ++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +@@ -443,20 +443,26 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu) + */ + static void arm_smmu_cmdq_shared_lock(struct arm_smmu_cmdq *cmdq) + { +- int val; +- + /* +- * We can try to avoid the cmpxchg() loop by simply incrementing the +- * lock counter. When held in exclusive state, the lock counter is set +- * to INT_MIN so these increments won't hurt as the value will remain +- * negative. ++ * When held in exclusive state, the lock counter is set to INT_MIN ++ * so these increments won't hurt as the value will remain negative. ++ * The increment will also signal the exclusive locker that there are ++ * shared waiters. + */ + if (atomic_fetch_inc_relaxed(&cmdq->lock) >= 0) + return; + +- do { +- val = atomic_cond_read_relaxed(&cmdq->lock, VAL >= 0); +- } while (atomic_cmpxchg_relaxed(&cmdq->lock, val, val + 1) != val); ++ /* ++ * Someone else is holding the lock in exclusive state, so wait ++ * for them to finish. Since we already incremented the lock counter, ++ * no exclusive lock can be acquired until we finish. We don't need ++ * the return value since we only care that the exclusive lock is ++ * released (i.e. the lock counter is non-negative). ++ * Once the exclusive locker releases the lock, the sign bit will ++ * be cleared and our increment will make the lock counter positive, ++ * allowing us to proceed. ++ */ ++ atomic_cond_read_relaxed(&cmdq->lock, VAL > 0); + } + + static void arm_smmu_cmdq_shared_unlock(struct arm_smmu_cmdq *cmdq) +@@ -483,9 +489,14 @@ static bool arm_smmu_cmdq_shared_tryunlock(struct arm_smmu_cmdq *cmdq) + __ret; \ + }) + ++/* ++ * Only clear the sign bit when releasing the exclusive lock this will ++ * allow any shared_lock() waiters to proceed without the possibility ++ * of entering the exclusive lock in a tight loop. ++ */ + #define arm_smmu_cmdq_exclusive_unlock_irqrestore(cmdq, flags) \ + ({ \ +- atomic_set_release(&cmdq->lock, 0); \ ++ atomic_fetch_andnot_release(INT_MIN, &cmdq->lock); \ + local_irq_restore(flags); \ + }) + +-- +2.51.0 + diff --git a/queue-6.6/ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch b/queue-6.6/ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch new file mode 100644 index 00000000000..ece0fabb61b --- /dev/null +++ b/queue-6.6/ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch @@ -0,0 +1,123 @@ +From ccf6562acd023907c3e856ae07e0f6857bcb7b71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 04:35:24 +0000 +Subject: ipv4: fib: Annotate access to struct fib_alias.fa_state. + +From: Kuniyuki Iwashima + +[ Upstream commit 6e84fc395e90465f1418f582a9f7d53c87ab010e ] + +syzbot reported that struct fib_alias.fa_state can be +modified locklessly by RCU readers. [0] + +Let's use READ_ONCE()/WRITE_ONCE() properly. + +[0]: +BUG: KCSAN: data-race in fib_table_lookup / fib_table_lookup + +write to 0xffff88811b06a7fa of 1 bytes by task 4167 on cpu 0: + fib_alias_accessed net/ipv4/fib_lookup.h:32 [inline] + fib_table_lookup+0x361/0xd60 net/ipv4/fib_trie.c:1565 + fib_lookup include/net/ip_fib.h:390 [inline] + ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814 + ip_route_output_key_hash net/ipv4/route.c:2705 [inline] + __ip_route_output_key include/net/route.h:169 [inline] + ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932 + udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450 + inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859 + sock_sendmsg_nosec net/socket.c:727 [inline] + __sock_sendmsg net/socket.c:742 [inline] + ____sys_sendmsg+0x53a/0x600 net/socket.c:2592 + ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646 + __sys_sendmmsg+0x185/0x320 net/socket.c:2735 + __do_sys_sendmmsg net/socket.c:2762 [inline] + __se_sys_sendmmsg net/socket.c:2759 [inline] + __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759 + x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +read to 0xffff88811b06a7fa of 1 bytes by task 4168 on cpu 1: + fib_alias_accessed net/ipv4/fib_lookup.h:31 [inline] + fib_table_lookup+0x338/0xd60 net/ipv4/fib_trie.c:1565 + fib_lookup include/net/ip_fib.h:390 [inline] + ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814 + ip_route_output_key_hash net/ipv4/route.c:2705 [inline] + __ip_route_output_key include/net/route.h:169 [inline] + ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932 + udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450 + inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859 + sock_sendmsg_nosec net/socket.c:727 [inline] + __sock_sendmsg net/socket.c:742 [inline] + ____sys_sendmsg+0x53a/0x600 net/socket.c:2592 + ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646 + __sys_sendmmsg+0x185/0x320 net/socket.c:2735 + __do_sys_sendmmsg net/socket.c:2762 [inline] + __se_sys_sendmmsg net/socket.c:2759 [inline] + __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759 + x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +value changed: 0x00 -> 0x01 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 1 UID: 0 PID: 4168 Comm: syz.4.206 Not tainted syzkaller #0 PREEMPT(voluntary) +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 + +Reported-by: syzbot+d24f940f770afda885cf@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/69783ead.050a0220.c9109.0013.GAE@google.com/ +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260127043528.514160-1-kuniyu@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/fib_lookup.h | 6 ++++-- + net/ipv4/fib_trie.c | 4 ++-- + 2 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h +index f9b9e26c32c19..0b72796dd1ad3 100644 +--- a/net/ipv4/fib_lookup.h ++++ b/net/ipv4/fib_lookup.h +@@ -28,8 +28,10 @@ struct fib_alias { + /* Don't write on fa_state unless needed, to keep it shared on all cpus */ + static inline void fib_alias_accessed(struct fib_alias *fa) + { +- if (!(fa->fa_state & FA_S_ACCESSED)) +- fa->fa_state |= FA_S_ACCESSED; ++ u8 fa_state = READ_ONCE(fa->fa_state); ++ ++ if (!(fa_state & FA_S_ACCESSED)) ++ WRITE_ONCE(fa->fa_state, fa_state | FA_S_ACCESSED); + } + + /* Exported by fib_semantics.c */ +diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c +index 4d148d0892327..c9e1526e749b2 100644 +--- a/net/ipv4/fib_trie.c ++++ b/net/ipv4/fib_trie.c +@@ -1285,7 +1285,7 @@ int fib_table_insert(struct net *net, struct fib_table *tb, + new_fa->fa_dscp = fa->fa_dscp; + new_fa->fa_info = fi; + new_fa->fa_type = cfg->fc_type; +- state = fa->fa_state; ++ state = READ_ONCE(fa->fa_state); + new_fa->fa_state = state & ~FA_S_ACCESSED; + new_fa->fa_slen = fa->fa_slen; + new_fa->tb_id = tb->tb_id; +@@ -1751,7 +1751,7 @@ int fib_table_delete(struct net *net, struct fib_table *tb, + + fib_remove_alias(t, tp, l, fa_to_delete); + +- if (fa_to_delete->fa_state & FA_S_ACCESSED) ++ if (READ_ONCE(fa_to_delete->fa_state) & FA_S_ACCESSED) + rt_cache_flush(cfg->fc_nlinfo.nl_net); + + fib_release_info(fa_to_delete->fa_info); +-- +2.51.0 + diff --git a/queue-6.6/ipv4-igmp-annotate-data-races-around-idev-mr_maxdela.patch b/queue-6.6/ipv4-igmp-annotate-data-races-around-idev-mr_maxdela.patch new file mode 100644 index 00000000000..ed4b9146c8a --- /dev/null +++ b/queue-6.6/ipv4-igmp-annotate-data-races-around-idev-mr_maxdela.patch @@ -0,0 +1,66 @@ +From 37cae65d949dc03c7dbb849d48b4cef22d3cf58b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 17:22:47 +0000 +Subject: ipv4: igmp: annotate data-races around idev->mr_maxdelay + +From: Eric Dumazet + +[ Upstream commit e4faaf65a75f650ac4366ddff5dabb826029ca5a ] + +idev->mr_maxdelay is read and written locklessly, +add READ_ONCE()/WRITE_ONCE() annotations. + +While we are at it, make this field an u32. + +Signed-off-by: Eric Dumazet +Reviewed-by: David Ahern +Link: https://patch.msgid.link/20260122172247.2429403-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/linux/inetdevice.h | 2 +- + net/ipv4/igmp.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h +index ddb27fc0ee8c8..b157ff4f727fb 100644 +--- a/include/linux/inetdevice.h ++++ b/include/linux/inetdevice.h +@@ -38,11 +38,11 @@ struct in_device { + struct ip_mc_list *mc_tomb; + unsigned long mr_v1_seen; + unsigned long mr_v2_seen; +- unsigned long mr_maxdelay; + unsigned long mr_qi; /* Query Interval */ + unsigned long mr_qri; /* Query Response Interval */ + unsigned char mr_qrv; /* Query Robustness Variable */ + unsigned char mr_gq_running; ++ u32 mr_maxdelay; + u32 mr_ifc_count; + struct timer_list mr_gq_timer; /* general query timer */ + struct timer_list mr_ifc_timer; /* interface change timer */ +diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c +index d515881d02a6f..2836020bf12d5 100644 +--- a/net/ipv4/igmp.c ++++ b/net/ipv4/igmp.c +@@ -224,7 +224,7 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay) + + static void igmp_gq_start_timer(struct in_device *in_dev) + { +- int tv = get_random_u32_below(in_dev->mr_maxdelay); ++ int tv = get_random_u32_below(READ_ONCE(in_dev->mr_maxdelay)); + unsigned long exp = jiffies + tv + 2; + + if (in_dev->mr_gq_running && +@@ -1006,7 +1006,7 @@ static bool igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb, + max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE); + if (!max_delay) + max_delay = 1; /* can't mod w/ 0 */ +- in_dev->mr_maxdelay = max_delay; ++ WRITE_ONCE(in_dev->mr_maxdelay, max_delay); + + /* RFC3376, 4.1.6. QRV and 4.1.7. QQIC, when the most recently + * received value was zero, use the default or statically +-- +2.51.0 + diff --git a/queue-6.6/ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch b/queue-6.6/ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch new file mode 100644 index 00000000000..8b2674daa9c --- /dev/null +++ b/queue-6.6/ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch @@ -0,0 +1,41 @@ +From 801cb6f43aead3c5b9b6009dc367943203fd00fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 09:41:37 +0000 +Subject: ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() + +From: Eric Dumazet + +[ Upstream commit 03e9d91dd64e2f5ea632df5d59568d91757efc4d ] + +Add missing READ_ONCE() when reading sysctl values. + +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260115094141.3124990-5-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/ipv6.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/net/ipv6.h b/include/net/ipv6.h +index 9e5e44c6da0a6..d98f5390ffad3 100644 +--- a/include/net/ipv6.h ++++ b/include/net/ipv6.h +@@ -1017,11 +1017,11 @@ static inline int ip6_default_np_autolabel(struct net *net) + #if IS_ENABLED(CONFIG_IPV6) + static inline int ip6_multipath_hash_policy(const struct net *net) + { +- return net->ipv6.sysctl.multipath_hash_policy; ++ return READ_ONCE(net->ipv6.sysctl.multipath_hash_policy); + } + static inline u32 ip6_multipath_hash_fields(const struct net *net) + { +- return net->ipv6.sysctl.multipath_hash_fields; ++ return READ_ONCE(net->ipv6.sysctl.multipath_hash_fields); + } + #else + static inline int ip6_multipath_hash_policy(const struct net *net) +-- +2.51.0 + diff --git a/queue-6.6/ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch b/queue-6.6/ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch new file mode 100644 index 00000000000..72e56301de2 --- /dev/null +++ b/queue-6.6/ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch @@ -0,0 +1,66 @@ +From b5821a8c6ecec3b1acc7ae44f0dca71347f8c211 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 09:41:40 +0000 +Subject: ipv6: exthdrs: annotate data-race over multiple sysctl + +From: Eric Dumazet + +[ Upstream commit 978b67d28358b0b4eacfa94453d1ad4e09b123ad ] + +Following four sysctls can change under us, add missing READ_ONCE(). + +- ipv6.sysctl.max_dst_opts_len +- ipv6.sysctl.max_dst_opts_cnt +- ipv6.sysctl.max_hbh_opts_len +- ipv6.sysctl.max_hbh_opts_cnt + +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260115094141.3124990-8-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/exthdrs.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c +index 02e9ffb63af19..d0aaa35fc2e9e 100644 +--- a/net/ipv6/exthdrs.c ++++ b/net/ipv6/exthdrs.c +@@ -313,7 +313,7 @@ static int ipv6_destopt_rcv(struct sk_buff *skb) + } + + extlen = (skb_transport_header(skb)[1] + 1) << 3; +- if (extlen > net->ipv6.sysctl.max_dst_opts_len) ++ if (extlen > READ_ONCE(net->ipv6.sysctl.max_dst_opts_len)) + goto fail_and_free; + + opt->lastopt = opt->dst1 = skb_network_header_len(skb); +@@ -321,7 +321,8 @@ static int ipv6_destopt_rcv(struct sk_buff *skb) + dstbuf = opt->dst1; + #endif + +- if (ip6_parse_tlv(false, skb, net->ipv6.sysctl.max_dst_opts_cnt)) { ++ if (ip6_parse_tlv(false, skb, ++ READ_ONCE(net->ipv6.sysctl.max_dst_opts_cnt))) { + skb->transport_header += extlen; + opt = IP6CB(skb); + #if IS_ENABLED(CONFIG_IPV6_MIP6) +@@ -1053,11 +1054,12 @@ int ipv6_parse_hopopts(struct sk_buff *skb) + } + + extlen = (skb_transport_header(skb)[1] + 1) << 3; +- if (extlen > net->ipv6.sysctl.max_hbh_opts_len) ++ if (extlen > READ_ONCE(net->ipv6.sysctl.max_hbh_opts_len)) + goto fail_and_free; + + opt->flags |= IP6SKB_HOPBYHOP; +- if (ip6_parse_tlv(true, skb, net->ipv6.sysctl.max_hbh_opts_cnt)) { ++ if (ip6_parse_tlv(true, skb, ++ READ_ONCE(net->ipv6.sysctl.max_hbh_opts_cnt))) { + skb->transport_header += extlen; + opt = IP6CB(skb); + opt->nhoff = sizeof(struct ipv6hdr); +-- +2.51.0 + diff --git a/queue-6.6/jfs-add-missing-set_freezable-for-freezable-kthread.patch b/queue-6.6/jfs-add-missing-set_freezable-for-freezable-kthread.patch new file mode 100644 index 00000000000..239ea900703 --- /dev/null +++ b/queue-6.6/jfs-add-missing-set_freezable-for-freezable-kthread.patch @@ -0,0 +1,37 @@ +From f0097270e345304dc682c0f1bedf178376af71f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 19:38:01 +0800 +Subject: jfs: Add missing set_freezable() for freezable kthread + +From: Haotian Zhang + +[ Upstream commit eb0cfcf265714b419cc3549895a00632e76732ae ] + +The jfsIOWait() thread calls try_to_freeze() but lacks set_freezable(), +causing it to remain non-freezable by default. This prevents proper +freezing during system suspend. + +Add set_freezable() to make the thread freezable as intended. + +Signed-off-by: Haotian Zhang +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_logmgr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c +index cb6d1fda66a70..32e589bb663ae 100644 +--- a/fs/jfs/jfs_logmgr.c ++++ b/fs/jfs/jfs_logmgr.c +@@ -2312,6 +2312,7 @@ int jfsIOWait(void *arg) + { + struct lbuf *bp; + ++ set_freezable(); + do { + spin_lock_irq(&log_redrive_lock); + while ((bp = log_redrive_list)) { +-- +2.51.0 + diff --git a/queue-6.6/jfs-nlink-overflow-in-jfs_rename.patch b/queue-6.6/jfs-nlink-overflow-in-jfs_rename.patch new file mode 100644 index 00000000000..63c115f7592 --- /dev/null +++ b/queue-6.6/jfs-nlink-overflow-in-jfs_rename.patch @@ -0,0 +1,54 @@ +From 5400fcdd5dd1dc40cb5fb549b4bd0c872b7c1a54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Oct 2025 13:22:12 +0100 +Subject: jfs: nlink overflow in jfs_rename + +From: Jori Koolstra + +[ Upstream commit 9218dc26fd922b09858ecd3666ed57dfd8098da8 ] + +If nlink is maximal for a directory (-1) and inside that directory you +perform a rename for some child directory (not moving from the parent), +then the nlink of the first directory is first incremented and later +decremented. Normally this is fine, but when nlink = -1 this causes a +wrap around to 0, and then drop_nlink issues a warning. + +After applying the patch syzbot no longer issues any warnings. I also +ran some basic fs tests to look for any regressions. + +Signed-off-by: Jori Koolstra +Reported-by: syzbot+9131ddfd7870623b719f@syzkaller.appspotmail.com +Closes: https://syzbot.org/bug?extid=9131ddfd7870623b719f +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/namei.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c +index 57d7a4300210d..649184d712ad0 100644 +--- a/fs/jfs/namei.c ++++ b/fs/jfs/namei.c +@@ -1227,7 +1227,7 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir, + jfs_err("jfs_rename: dtInsert returned -EIO"); + goto out_tx; + } +- if (S_ISDIR(old_ip->i_mode)) ++ if (S_ISDIR(old_ip->i_mode) && old_dir != new_dir) + inc_nlink(new_dir); + } + /* +@@ -1243,7 +1243,9 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir, + goto out_tx; + } + if (S_ISDIR(old_ip->i_mode)) { +- drop_nlink(old_dir); ++ if (new_ip || old_dir != new_dir) ++ drop_nlink(old_dir); ++ + if (old_dir != new_dir) { + /* + * Change inode number of parent for moved directory +-- +2.51.0 + diff --git a/queue-6.6/libceph-define-and-enforce-ceph_max_key_len.patch b/queue-6.6/libceph-define-and-enforce-ceph_max_key_len.patch new file mode 100644 index 00000000000..05128009631 --- /dev/null +++ b/queue-6.6/libceph-define-and-enforce-ceph_max_key_len.patch @@ -0,0 +1,82 @@ +From 3befba1c0e375acfb3529d977c7c2b38a0b63915 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jul 2025 16:30:50 +0200 +Subject: libceph: define and enforce CEPH_MAX_KEY_LEN + +From: Ilya Dryomov + +[ Upstream commit ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf ] + +When decoding the key, verify that the key material would fit into +a fixed-size buffer in process_auth_done() and generally has a sane +length. + +The new CEPH_MAX_KEY_LEN check replaces the existing check for a key +with no key material which is a) not universal since CEPH_CRYPTO_NONE +has to be excluded and b) doesn't provide much value since a smaller +than needed key is just as invalid as no key -- this has to be handled +elsewhere anyway. + +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + net/ceph/crypto.c | 8 +++++--- + net/ceph/crypto.h | 2 +- + net/ceph/messenger_v2.c | 2 +- + 3 files changed, 7 insertions(+), 5 deletions(-) + +diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c +index 051d22c0e4ad4..3397d105f74f9 100644 +--- a/net/ceph/crypto.c ++++ b/net/ceph/crypto.c +@@ -37,9 +37,6 @@ static int set_secret(struct ceph_crypto_key *key, void *buf) + return -ENOTSUPP; + } + +- if (!key->len) +- return -EINVAL; +- + key->key = kmemdup(buf, key->len, GFP_NOIO); + if (!key->key) { + ret = -ENOMEM; +@@ -95,6 +92,11 @@ int ceph_crypto_key_decode(struct ceph_crypto_key *key, void **p, void *end) + ceph_decode_copy(p, &key->created, sizeof(key->created)); + key->len = ceph_decode_16(p); + ceph_decode_need(p, end, key->len, bad); ++ if (key->len > CEPH_MAX_KEY_LEN) { ++ pr_err("secret too big %d\n", key->len); ++ return -EINVAL; ++ } ++ + ret = set_secret(key, *p); + memzero_explicit(*p, key->len); + *p += key->len; +diff --git a/net/ceph/crypto.h b/net/ceph/crypto.h +index 13bd526349fa1..0d32f1649f3d0 100644 +--- a/net/ceph/crypto.h ++++ b/net/ceph/crypto.h +@@ -5,7 +5,7 @@ + #include + #include + +-#define CEPH_KEY_LEN 16 ++#define CEPH_MAX_KEY_LEN 16 + #define CEPH_MAX_CON_SECRET_LEN 64 + + /* +diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c +index 8581987244396..f82029bd33db8 100644 +--- a/net/ceph/messenger_v2.c ++++ b/net/ceph/messenger_v2.c +@@ -2393,7 +2393,7 @@ static int process_auth_reply_more(struct ceph_connection *con, + */ + static int process_auth_done(struct ceph_connection *con, void *p, void *end) + { +- u8 session_key_buf[CEPH_KEY_LEN + 16]; ++ u8 session_key_buf[CEPH_MAX_KEY_LEN + 16]; + u8 con_secret_buf[CEPH_MAX_CON_SECRET_LEN + 16]; + u8 *session_key = PTR_ALIGN(&session_key_buf[0], 16); + u8 *con_secret = PTR_ALIGN(&con_secret_buf[0], 16); +-- +2.51.0 + diff --git a/queue-6.6/libperf-build-always-place-libperf-includes-first.patch b/queue-6.6/libperf-build-always-place-libperf-includes-first.patch new file mode 100644 index 00000000000..01d3af4f780 --- /dev/null +++ b/queue-6.6/libperf-build-always-place-libperf-includes-first.patch @@ -0,0 +1,56 @@ +From 29b130121f9fc5b67863da362b610d0b54222177 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 22:09:18 -0800 +Subject: libperf build: Always place libperf includes first + +From: Ian Rogers + +[ Upstream commit 8c5b40678c63be6b85f1c2dc8c8b89d632faf988 ] + +When building tools/perf the CFLAGS can contain a directory for the +installed headers. + +As the headers may be being installed while building libperf.a this can +cause headers to be partially installed and found in the include path +while building an object file for libperf.a. + +The installed header may reference other installed headers that are +missing given the partial nature of the install and then the build fails +with a missing header file. + +Avoid this by ensuring the libperf source headers are always first in +the CFLAGS. + +Fixes: 3143504918105156 ("libperf: Make libperf.a part of the perf build") +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/perf/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/perf/Makefile b/tools/lib/perf/Makefile +index 478fe57bf8cee..703a8ff0b3430 100644 +--- a/tools/lib/perf/Makefile ++++ b/tools/lib/perf/Makefile +@@ -63,9 +63,9 @@ INCLUDES = \ + -I$(srctree)/tools/include/uapi + + # Append required CFLAGS ++override CFLAGS := $(INCLUDES) $(CFLAGS) + override CFLAGS += -g -Werror -Wall + override CFLAGS += -fPIC +-override CFLAGS += $(INCLUDES) + override CFLAGS += -fvisibility=hidden + override CFLAGS += $(EXTRA_WARNINGS) + override CFLAGS += $(EXTRA_CFLAGS) +-- +2.51.0 + diff --git a/queue-6.6/libperf-don-t-remove-g-when-extra_cflags-are-used.patch b/queue-6.6/libperf-don-t-remove-g-when-extra_cflags-are-used.patch new file mode 100644 index 00000000000..a785e08bdb8 --- /dev/null +++ b/queue-6.6/libperf-don-t-remove-g-when-extra_cflags-are-used.patch @@ -0,0 +1,66 @@ +From f8ad878710fce9c3ccab55f335315be9d6d1c632 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Mar 2025 11:40:09 +0000 +Subject: libperf: Don't remove -g when EXTRA_CFLAGS are used + +From: James Clark + +[ Upstream commit f5b07010c13c77541e8ade167d05bef3b8a63739 ] + +When using EXTRA_CFLAGS, for example "EXTRA_CFLAGS=-DREFCNT_CHECKING=1", +this construct stops setting -g which you'd expect would not be affected +by adding extra flags. Additionally, EXTRA_CFLAGS should be the last +thing to be appended so that it can be used to undo any defaults. And no +condition is required, just += appends to any existing CFLAGS and also +appends or doesn't append EXTRA_CFLAGS if they are or aren't set. + +It's not clear why DEBUG=1 is required for -g in Perf when in libperf +it's always on, but I don't think we need to change that behavior now +because someone may be depending on it. + +Signed-off-by: James Clark +Reviewed-by: Ian Rogers +Link: https://lore.kernel.org/r/20250319114009.417865-1-james.clark@linaro.org +Signed-off-by: Namhyung Kim +Stable-dep-of: 8c5b40678c63 ("libperf build: Always place libperf includes first") +Signed-off-by: Sasha Levin +--- + tools/lib/perf/Makefile | 12 +++--------- + 1 file changed, 3 insertions(+), 9 deletions(-) + +diff --git a/tools/lib/perf/Makefile b/tools/lib/perf/Makefile +index 3a9b2140aa048..478fe57bf8cee 100644 +--- a/tools/lib/perf/Makefile ++++ b/tools/lib/perf/Makefile +@@ -54,13 +54,6 @@ endif + + TEST_ARGS := $(if $(V),-v) + +-# Set compile option CFLAGS +-ifdef EXTRA_CFLAGS +- CFLAGS := $(EXTRA_CFLAGS) +-else +- CFLAGS := -g -Wall +-endif +- + INCLUDES = \ + -I$(srctree)/tools/lib/perf/include \ + -I$(srctree)/tools/lib/ \ +@@ -70,11 +63,12 @@ INCLUDES = \ + -I$(srctree)/tools/include/uapi + + # Append required CFLAGS +-override CFLAGS += $(EXTRA_WARNINGS) +-override CFLAGS += -Werror -Wall ++override CFLAGS += -g -Werror -Wall + override CFLAGS += -fPIC + override CFLAGS += $(INCLUDES) + override CFLAGS += -fvisibility=hidden ++override CFLAGS += $(EXTRA_WARNINGS) ++override CFLAGS += $(EXTRA_CFLAGS) + + all: + +-- +2.51.0 + diff --git a/queue-6.6/libsubcmd-fix-null-intersection-case-in-exclude_cmds.patch b/queue-6.6/libsubcmd-fix-null-intersection-case-in-exclude_cmds.patch new file mode 100644 index 00000000000..ef80a39b873 --- /dev/null +++ b/queue-6.6/libsubcmd-fix-null-intersection-case-in-exclude_cmds.patch @@ -0,0 +1,67 @@ +From c1be1435b195224c1efa9b3e28090758f8ff8ca4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 16:36:32 -0500 +Subject: libsubcmd: Fix null intersection case in exclude_cmds() + +From: Sri Jayaramappa + +[ Upstream commit b6ee9b6e206b288921c14c906eebf4b32fe0c0d8 ] + +When there is no exclusion occurring from the cmds list - for example - +cmds contains ["read-vdso32"] and excludes contains ["archive"] - the +main loop completes with ci == cj == 0. In the original code the loop +processing the remaining elements in the list was conditional: + + if (ci != cj) { ...} + +So we end up in the assertion loop since ci < cmds->cnt and we +incorrectly try to assert the list elements to be NULL and fail with +the following error + + help.c:104: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed. + +Fix this by moving the if (ci != cj) check inside of a broader loop. +If ci != cj, left shift the list elements, as before, and then +unconditionally advance the ci and cj indicies which also covers the +ci == cj case. + +Fixes: 1fdf938168c4d26f ("perf tools: Fix use-after-free in help_unknown_cmd()") +Reviewed-by: Guilherme Amadio +Signed-off-by: Sri Jayaramappa +Tested-by: Guilherme Amadio +Tested-by: Ian Rogers +Cc: Joshua Hunt +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20251202213632.2873731-1-sjayaram@akamai.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/subcmd/help.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c +index ddaeb4eb3e249..db94aa685b73b 100644 +--- a/tools/lib/subcmd/help.c ++++ b/tools/lib/subcmd/help.c +@@ -97,11 +97,13 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes) + ei++; + } + } +- if (ci != cj) { +- while (ci < cmds->cnt) { +- cmds->names[cj++] = cmds->names[ci]; +- cmds->names[ci++] = NULL; ++ while (ci < cmds->cnt) { ++ if (ci != cj) { ++ cmds->names[cj] = cmds->names[ci]; ++ cmds->names[ci] = NULL; + } ++ ci++; ++ cj++; + } + for (ci = cj; ci < cmds->cnt; ci++) + assert(cmds->names[ci] == NULL); +-- +2.51.0 + diff --git a/queue-6.6/m68k-nommu-fix-memmove-with-differently-aligned-src-.patch b/queue-6.6/m68k-nommu-fix-memmove-with-differently-aligned-src-.patch new file mode 100644 index 00000000000..02054275c88 --- /dev/null +++ b/queue-6.6/m68k-nommu-fix-memmove-with-differently-aligned-src-.patch @@ -0,0 +1,69 @@ +From 00e80e09637b04d35ba7782eeb8ff6b20b2f0303 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Dec 2025 21:04:01 +0900 +Subject: m68k: nommu: fix memmove() with differently aligned src and dest for + 68000 + +From: Daniel Palmer + +[ Upstream commit 590fe2f46c8698bb758f9002cb247ca10ce95569 ] + +68000 has different alignment needs to 68020+. +memcpy() checks if the destination is aligned and does a smaller copy +to fix the alignment and then critically for 68000 it checks if the +source is still unaligned and if it is reverts to smaller copies. + +memmove() does not currently do the second part and malfunctions if +one of the pointers is aligned and the other isn't. + +This is apparently getting triggered by printk. If I put breakpoints +into the new checks added by this commit the first hit looks like this: + +memmove (n=205, src=0x2f3971 , dest=0x2f3980 ) at arch/m68k/lib/memmove.c:82 + +Signed-off-by: Daniel Palmer +Signed-off-by: Greg Ungerer +Signed-off-by: Sasha Levin +--- + arch/m68k/lib/memmove.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/arch/m68k/lib/memmove.c b/arch/m68k/lib/memmove.c +index 6519f7f349f66..e33f00b02e4c0 100644 +--- a/arch/m68k/lib/memmove.c ++++ b/arch/m68k/lib/memmove.c +@@ -24,6 +24,15 @@ void *memmove(void *dest, const void *src, size_t n) + src = csrc; + n--; + } ++#if defined(CONFIG_M68000) ++ if ((long)src & 1) { ++ char *cdest = dest; ++ const char *csrc = src; ++ for (; n; n--) ++ *cdest++ = *csrc++; ++ return xdest; ++ } ++#endif + if (n > 2 && (long)dest & 2) { + short *sdest = dest; + const short *ssrc = src; +@@ -66,6 +75,15 @@ void *memmove(void *dest, const void *src, size_t n) + src = csrc; + n--; + } ++#if defined(CONFIG_M68000) ++ if ((long)src & 1) { ++ char *cdest = dest; ++ const char *csrc = src; ++ for (; n; n--) ++ *--cdest = *--csrc; ++ return xdest; ++ } ++#endif + if (n > 2 && (long)dest & 2) { + short *sdest = dest; + const short *ssrc = src; +-- +2.51.0 + diff --git a/queue-6.6/mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch b/queue-6.6/mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch new file mode 100644 index 00000000000..40a9d990ab7 --- /dev/null +++ b/queue-6.6/mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch @@ -0,0 +1,66 @@ +From dfb052dd18d33dad7c995f95d0482df82a604f2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:24 +0100 +Subject: mailbox: bcm-ferxrm-mailbox: Use default primary handler + +From: Sebastian Andrzej Siewior + +[ Upstream commit 03843d95a4a4e0ba22ad4fcda65ccf21822b104c ] + +request_threaded_irq() is invoked with a primary and a secondary handler +and no flags are passed. The primary handler is the same as +irq_default_primary_handler() so there is no need to have an identical +copy. + +The lack of the IRQF_ONESHOT flag can be dangerous because the interrupt +source is not masked while the threaded handler is active. This means, +especially on LEVEL typed interrupt lines, the interrupt can fire again +before the threaded handler had a chance to run. + +Use the default primary interrupt handler by specifying NULL and set +IRQF_ONESHOT so the interrupt source is masked until the secondary handler +is done. + +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Thomas Gleixner +Link: https://patch.msgid.link/20260128095540.863589-5-bigeasy@linutronix.de +Signed-off-by: Sasha Levin +--- + drivers/mailbox/bcm-flexrm-mailbox.c | 14 ++------------ + 1 file changed, 2 insertions(+), 12 deletions(-) + +diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c +index a2b8839d4e7c5..a1e02efe93ad2 100644 +--- a/drivers/mailbox/bcm-flexrm-mailbox.c ++++ b/drivers/mailbox/bcm-flexrm-mailbox.c +@@ -1173,14 +1173,6 @@ static int flexrm_debugfs_stats_show(struct seq_file *file, void *offset) + + /* ====== FlexRM interrupt handler ===== */ + +-static irqreturn_t flexrm_irq_event(int irq, void *dev_id) +-{ +- /* We only have MSI for completions so just wakeup IRQ thread */ +- /* Ring related errors will be informed via completion descriptors */ +- +- return IRQ_WAKE_THREAD; +-} +- + static irqreturn_t flexrm_irq_thread(int irq, void *dev_id) + { + flexrm_process_completions(dev_id); +@@ -1271,10 +1263,8 @@ static int flexrm_startup(struct mbox_chan *chan) + ret = -ENODEV; + goto fail_free_cmpl_memory; + } +- ret = request_threaded_irq(ring->irq, +- flexrm_irq_event, +- flexrm_irq_thread, +- 0, dev_name(ring->mbox->dev), ring); ++ ret = request_threaded_irq(ring->irq, NULL, flexrm_irq_thread, ++ IRQF_ONESHOT, dev_name(ring->mbox->dev), ring); + if (ret) { + dev_err(ring->mbox->dev, + "failed to request ring%d IRQ\n", ring->num); +-- +2.51.0 + diff --git a/queue-6.6/mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch b/queue-6.6/mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch new file mode 100644 index 00000000000..d57461108d2 --- /dev/null +++ b/queue-6.6/mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch @@ -0,0 +1,77 @@ +From 8d94b95eb70b7dd20ab6991d4c0169a6a6a4fdce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 16:00:54 +0800 +Subject: mailbox: imx: Skip the suspend flag for i.MX7ULP + +From: Jacky Bai + +[ Upstream commit 673b570825ace0dcb2ac0c676080559d505c6f40 ] + +In current imx-mailbox driver, the MU IRQ is configured with +'IRQF_NO_SUSPEND' flag set. So during linux suspend/resume flow, +the MU IRQ is always enabled. With commit 892cb524ae8a ("mailbox: imx: +fix wakeup failure from freeze mode"), if the MU IRQ is triggered after +the priv->suspended flag has been set, the system suspend will be +aborted. + +On i.MX7ULP platform, certain drivers that depend on rpmsg may need +to send rpmsg request and receive an acknowledgment from the remote +core during the late_suspend stage. Early suspend abort is not +expected, and the i.MX7ULP already has additional hardware and +software to make sure the system can be wakeup from freeze mode +correctly when MU IRQ is trigger. + +Skip the 'suspend' flag handling logic on i.MX7ULP to avoid the +early abort when doing suspend. + +Signed-off-by: Jacky Bai +Reviewed-by: Peng Fan +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/imx-mailbox.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/mailbox/imx-mailbox.c b/drivers/mailbox/imx-mailbox.c +index 3ef4dd8adf5db..5eef59f00abd5 100644 +--- a/drivers/mailbox/imx-mailbox.c ++++ b/drivers/mailbox/imx-mailbox.c +@@ -113,6 +113,7 @@ struct imx_mu_dcfg { + u32 xRR; /* Receive Register0 */ + u32 xSR[IMX_MU_xSR_MAX]; /* Status Registers */ + u32 xCR[IMX_MU_xCR_MAX]; /* Control Registers */ ++ bool skip_suspend_flag; + }; + + #define IMX_MU_xSR_GIPn(type, x) (type & IMX_MU_V2 ? BIT(x) : BIT(28 + (3 - (x)))) +@@ -906,6 +907,7 @@ static const struct imx_mu_dcfg imx_mu_cfg_imx7ulp = { + .xRR = 0x40, + .xSR = {0x60, 0x60, 0x60, 0x60}, + .xCR = {0x64, 0x64, 0x64, 0x64, 0x64}, ++ .skip_suspend_flag = true, + }; + + static const struct imx_mu_dcfg imx_mu_cfg_imx8ulp = { +@@ -986,7 +988,8 @@ static int __maybe_unused imx_mu_suspend_noirq(struct device *dev) + priv->xcr[i] = imx_mu_read(priv, priv->dcfg->xCR[i]); + } + +- priv->suspend = true; ++ if (!priv->dcfg->skip_suspend_flag) ++ priv->suspend = true; + + return 0; + } +@@ -1009,7 +1012,8 @@ static int __maybe_unused imx_mu_resume_noirq(struct device *dev) + imx_mu_write(priv, priv->xcr[i], priv->dcfg->xCR[i]); + } + +- priv->suspend = false; ++ if (!priv->dcfg->skip_suspend_flag) ++ priv->suspend = false; + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.6/mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch b/queue-6.6/mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch new file mode 100644 index 00000000000..2cbae4a8f23 --- /dev/null +++ b/queue-6.6/mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch @@ -0,0 +1,41 @@ +From bcd998e875f9cc3c312e505bc1c569de1a45569e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jan 2026 14:07:40 +0000 +Subject: mailbox: pcc: Remove spurious IRQF_ONESHOT usage + +From: Mark Brown + +[ Upstream commit 673327028cd61db68a1e0c708be2e302c082adf9 ] + +The PCC code currently specifies IRQF_ONESHOT if the interrupt could +potentially be shared but doesn't actually use request_threaded_irq() and +the interrupt handler does not use IRQ_WAKE_THREAD so IRQF_ONESHOT is +never relevant. Since commit aef30c8d569c ("genirq: Warn about using +IRQF_ONESHOT without a threaded handler") specifying it has resulted in a +WARN_ON(), fix this by removing IRQF_ONESHOT. + +Reported-by: Aishwarya TCV +Signed-off-by: Mark Brown +Reviewed-by: Sudeep Holla +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/pcc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c +index 2b7d0bc920726..1d4191cb91380 100644 +--- a/drivers/mailbox/pcc.c ++++ b/drivers/mailbox/pcc.c +@@ -481,7 +481,7 @@ static int pcc_startup(struct mbox_chan *chan) + + if (pchan->plat_irq > 0) { + irqflags = pcc_chan_plat_irq_can_be_shared(pchan) ? +- IRQF_SHARED | IRQF_ONESHOT : 0; ++ IRQF_SHARED : 0; + rc = devm_request_irq(chan->mbox->dev, pchan->plat_irq, pcc_mbox_irq, + irqflags, MBOX_IRQ_NAME, chan); + if (unlikely(rc)) { +-- +2.51.0 + diff --git a/queue-6.6/mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch b/queue-6.6/mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch new file mode 100644 index 00000000000..7e7c17c76c2 --- /dev/null +++ b/queue-6.6/mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch @@ -0,0 +1,57 @@ +From c215b8ce2379ea4f430f0ca8af32b35bf5e9f5ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 16:43:36 +0100 +Subject: mailbox: sprd: clear delivery flag before handling TX done +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Otto Pflüger + +[ Upstream commit c77661d60d4223bf2ff10d409beb0c3b2021183b ] + +If there are any pending messages in the mailbox queue, they are sent +as soon as a TX done event arrives from the driver. This may trigger a +new delivery interrupt while the previous one is still being handled. +If the delivery status is cleared after this, the interrupt is lost. +To prevent this from happening, clear the delivery status immediately +after checking it and before any new messages are sent. + +Signed-off-by: Otto Pflüger +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/sprd-mailbox.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c +index 845ceb041464e..109ff60c4ac74 100644 +--- a/drivers/mailbox/sprd-mailbox.c ++++ b/drivers/mailbox/sprd-mailbox.c +@@ -167,6 +167,11 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data) + return IRQ_NONE; + } + ++ /* Clear FIFO delivery and overflow status first */ ++ writel(fifo_sts & ++ (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK), ++ priv->inbox_base + SPRD_MBOX_FIFO_RST); ++ + while (send_sts) { + id = __ffs(send_sts); + send_sts &= (send_sts - 1); +@@ -182,11 +187,6 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data) + mbox_chan_txdone(chan, 0); + } + +- /* Clear FIFO delivery and overflow status */ +- writel(fifo_sts & +- (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK), +- priv->inbox_base + SPRD_MBOX_FIFO_RST); +- + /* Clear irq status */ + writel(SPRD_MBOX_IRQ_CLR, priv->inbox_base + SPRD_MBOX_IRQ_STS); + +-- +2.51.0 + diff --git a/queue-6.6/mailbox-sprd-mask-interrupts-that-are-not-handled.patch b/queue-6.6/mailbox-sprd-mask-interrupts-that-are-not-handled.patch new file mode 100644 index 00000000000..95435dff904 --- /dev/null +++ b/queue-6.6/mailbox-sprd-mask-interrupts-that-are-not-handled.patch @@ -0,0 +1,55 @@ +From c7b3cca8ece8474ea4918422920eb06abc4e240b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 16:43:38 +0100 +Subject: mailbox: sprd: mask interrupts that are not handled +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Otto Pflüger + +[ Upstream commit 75df94d05fc03fd9d861eaf79ce10fbb7a548bd8 ] + +To reduce the amount of spurious interrupts, disable the interrupts that +are not handled in this driver. + +Signed-off-by: Otto Pflüger +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/sprd-mailbox.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c +index 9ae57de77d4d7..845ceb041464e 100644 +--- a/drivers/mailbox/sprd-mailbox.c ++++ b/drivers/mailbox/sprd-mailbox.c +@@ -244,21 +244,19 @@ static int sprd_mbox_startup(struct mbox_chan *chan) + /* Select outbox FIFO mode and reset the outbox FIFO status */ + writel(0x0, priv->outbox_base + SPRD_MBOX_FIFO_RST); + +- /* Enable inbox FIFO overflow and delivery interrupt */ +- val = readl(priv->inbox_base + SPRD_MBOX_IRQ_MSK); +- val &= ~(SPRD_INBOX_FIFO_OVERFLOW_IRQ | SPRD_INBOX_FIFO_DELIVER_IRQ); ++ /* Enable inbox FIFO delivery interrupt */ ++ val = SPRD_INBOX_FIFO_IRQ_MASK; ++ val &= ~SPRD_INBOX_FIFO_DELIVER_IRQ; + writel(val, priv->inbox_base + SPRD_MBOX_IRQ_MSK); + + /* Enable outbox FIFO not empty interrupt */ +- val = readl(priv->outbox_base + SPRD_MBOX_IRQ_MSK); ++ val = SPRD_OUTBOX_FIFO_IRQ_MASK; + val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ; + writel(val, priv->outbox_base + SPRD_MBOX_IRQ_MSK); + + /* Enable supplementary outbox as the fundamental one */ + if (priv->supp_base) { + writel(0x0, priv->supp_base + SPRD_MBOX_FIFO_RST); +- val = readl(priv->supp_base + SPRD_MBOX_IRQ_MSK); +- val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ; + writel(val, priv->supp_base + SPRD_MBOX_IRQ_MSK); + } + } +-- +2.51.0 + diff --git a/queue-6.6/md-cluster-fix-null-pointer-dereference-in-process_m.patch b/queue-6.6/md-cluster-fix-null-pointer-dereference-in-process_m.patch new file mode 100644 index 00000000000..e654f56c61e --- /dev/null +++ b/queue-6.6/md-cluster-fix-null-pointer-dereference-in-process_m.patch @@ -0,0 +1,61 @@ +From 9de752bf9a4e926764a97b4c40c112acee6b3e9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jan 2026 14:59:03 +0000 +Subject: md-cluster: fix NULL pointer dereference in process_metadata_update + +From: Jiasheng Jiang + +[ Upstream commit f150e753cb8dd756085f46e86f2c35ce472e0a3c ] + +The function process_metadata_update() blindly dereferences the 'thread' +pointer (acquired via rcu_dereference_protected) within the wait_event() +macro. + +While the code comment states "daemon thread must exist", there is a valid +race condition window during the MD array startup sequence (md_run): + +1. bitmap_load() is called, which invokes md_cluster_ops->join(). +2. join() starts the "cluster_recv" thread (recv_daemon). +3. At this point, recv_daemon is active and processing messages. +4. However, mddev->thread (the main MD thread) is not initialized until + later in md_run(). + +If a METADATA_UPDATED message is received from a remote node during this +specific window, process_metadata_update() will be called while +mddev->thread is still NULL, leading to a kernel panic. + +To fix this, we must validate the 'thread' pointer. If it is NULL, we +release the held lock (no_new_dev_lockres) and return early, safely +ignoring the update request as the array is not yet fully ready to +process it. + +Link: https://lore.kernel.org/linux-raid/20260117145903.28921-1-jiashengjiangcool@gmail.com +Signed-off-by: Jiasheng Jiang +Signed-off-by: Yu Kuai +Signed-off-by: Sasha Levin +--- + drivers/md/md-cluster.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c +index 6a89f6b5d64f9..54f90afbafe96 100644 +--- a/drivers/md/md-cluster.c ++++ b/drivers/md/md-cluster.c +@@ -532,8 +532,13 @@ static void process_metadata_update(struct mddev *mddev, struct cluster_msg *msg + + dlm_lock_sync(cinfo->no_new_dev_lockres, DLM_LOCK_CR); + +- /* daemaon thread must exist */ + thread = rcu_dereference_protected(mddev->thread, true); ++ if (!thread) { ++ pr_warn("md-cluster: Received metadata update but MD thread is not ready\n"); ++ dlm_unlock_sync(cinfo->no_new_dev_lockres); ++ return; ++ } ++ + wait_event(thread->wqueue, + (got_lock = mddev_trylock(mddev)) || + test_bit(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD, &cinfo->state)); +-- +2.51.0 + diff --git a/queue-6.6/media-adv7180-fix-frame-interval-in-progressive-mode.patch b/queue-6.6/media-adv7180-fix-frame-interval-in-progressive-mode.patch new file mode 100644 index 00000000000..1e46c69adc5 --- /dev/null +++ b/queue-6.6/media-adv7180-fix-frame-interval-in-progressive-mode.patch @@ -0,0 +1,49 @@ +From 882795e2890602a6980ba4cbc3dfbfd400934b31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 15:29:57 +0100 +Subject: media: adv7180: fix frame interval in progressive mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thorsten Schmelzer + +[ Upstream commit 90289b67c5c1d4c18784059b27460d292e16d208 ] + +The ADV7280-M may internally convert interlaced video input to +progressive video. If this mode is enabled, the ADV7280-M delivers +progressive video frames at the field rate of 50 fields per second (PAL) +or 60 fields per second (NTSC). + +Fix the reported frame interval if progressive video is enabled. + +Signed-off-by: Thorsten Schmelzer +Reviewed-by: Niklas Söderlund +Signed-off-by: Michael Tretter +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/adv7180.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c +index ecb0e7b1f2a5f..4778ae653ca9d 100644 +--- a/drivers/media/i2c/adv7180.c ++++ b/drivers/media/i2c/adv7180.c +@@ -471,6 +471,13 @@ static int adv7180_g_frame_interval(struct v4l2_subdev *sd, + fi->interval.denominator = 25; + } + ++ /* ++ * If the de-interlacer is active, the chip produces full video frames ++ * at the field rate. ++ */ ++ if (state->field == V4L2_FIELD_NONE) ++ fi->interval.denominator *= 2; ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.6/media-amphion-clear-last_buffer_dequeued-flag-for-de.patch b/queue-6.6/media-amphion-clear-last_buffer_dequeued-flag-for-de.patch new file mode 100644 index 00000000000..68d7136ab45 --- /dev/null +++ b/queue-6.6/media-amphion-clear-last_buffer_dequeued-flag-for-de.patch @@ -0,0 +1,38 @@ +From fe77c7342873ce5c647a2f9db8c72b06fff3b54b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Dec 2025 11:02:22 +0800 +Subject: media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START + +From: Ming Qian + +[ Upstream commit d85f3207d75df6d7a08be6526b15ff398668206c ] + +The V4L2_DEC_CMD_START command may be used to handle the dynamic source +change, which will triggers an implicit decoder drain. +The last_buffer_dequeued flag is set in the implicit decoder drain, +so driver need to clear it to continue the following decoding flow. + +Signed-off-by: Ming Qian +Reviewed-by: Nicolas Dufresne +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/amphion/vdec.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/platform/amphion/vdec.c b/drivers/media/platform/amphion/vdec.c +index 4f438eaa7d385..d7e477f0eb430 100644 +--- a/drivers/media/platform/amphion/vdec.c ++++ b/drivers/media/platform/amphion/vdec.c +@@ -630,6 +630,7 @@ static int vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd + switch (cmd->cmd) { + case V4L2_DEC_CMD_START: + vdec_cmd_start(inst); ++ vb2_clear_last_buffer_dequeued(v4l2_m2m_get_dst_vq(inst->fh.m2m_ctx)); + break; + case V4L2_DEC_CMD_STOP: + vdec_cmd_stop(inst); +-- +2.51.0 + diff --git a/queue-6.6/media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch b/queue-6.6/media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch new file mode 100644 index 00000000000..c5b7bab16c3 --- /dev/null +++ b/queue-6.6/media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch @@ -0,0 +1,34 @@ +From 8cb1c8bed953845eafe02fb10e6ffa08df7d7601 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Jan 2026 15:46:47 +0800 +Subject: media: cx25821: Fix a resource leak in cx25821_dev_setup() + +From: Haoxiang Li + +[ Upstream commit 68cd8ac994cac38a305200f638b30e13c690753b ] + +Add release_mem_region() if ioremap() fails to release the memory +region obtained by cx25821_get_resources(). + +Signed-off-by: Haoxiang Li +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/cx25821/cx25821-core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c +index 6627fa9166d30..a7336be444748 100644 +--- a/drivers/media/pci/cx25821/cx25821-core.c ++++ b/drivers/media/pci/cx25821/cx25821-core.c +@@ -908,6 +908,7 @@ static int cx25821_dev_setup(struct cx25821_dev *dev) + + if (!dev->lmmio) { + CX25821_ERR("ioremap failed, maybe increasing __VMALLOC_RESERVE in page.h\n"); ++ release_mem_region(dev->base_io_addr, pci_resource_len(dev->pci, 0)); + cx25821_iounmap(dev); + return -ENOMEM; + } +-- +2.51.0 + diff --git a/queue-6.6/media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch b/queue-6.6/media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch new file mode 100644 index 00000000000..a04bf4331e2 --- /dev/null +++ b/queue-6.6/media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch @@ -0,0 +1,110 @@ +From da1f55557a34021d85c63f73fe478b32d6768bc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Jun 2025 08:57:35 +0200 +Subject: media: dvb-core: dmxdevfilter must always flush bufs + +From: Hans Verkuil + +[ Upstream commit c4e620eccbef76aa5564ebb295e23d6540e27215 ] + +Currently the buffers are being filled until full, which works fine +for the transport stream, but not when reading sections, those have +to be returned to userspace immediately, otherwise dvbv5-scan will +just wait forever. + +Add a 'flush' argument to dvb_vb2_fill_buffer to indicate whether +the buffer must be flushed or wait until it is full. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-core/dmxdev.c | 8 ++++---- + drivers/media/dvb-core/dvb_vb2.c | 5 +++-- + include/media/dvb_vb2.h | 6 ++++-- + 3 files changed, 11 insertions(+), 8 deletions(-) + +diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c +index 9ce5f010de3f8..804fb339f7355 100644 +--- a/drivers/media/dvb-core/dmxdev.c ++++ b/drivers/media/dvb-core/dmxdev.c +@@ -396,11 +396,11 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len, + if (dvb_vb2_is_streaming(&dmxdevfilter->vb2_ctx)) { + ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx, + buffer1, buffer1_len, +- buffer_flags); ++ buffer_flags, true); + if (ret == buffer1_len) + ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx, + buffer2, buffer2_len, +- buffer_flags); ++ buffer_flags, true); + } else { + ret = dvb_dmxdev_buffer_write(&dmxdevfilter->buffer, + buffer1, buffer1_len); +@@ -451,10 +451,10 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len, + + if (dvb_vb2_is_streaming(ctx)) { + ret = dvb_vb2_fill_buffer(ctx, buffer1, buffer1_len, +- buffer_flags); ++ buffer_flags, false); + if (ret == buffer1_len) + ret = dvb_vb2_fill_buffer(ctx, buffer2, buffer2_len, +- buffer_flags); ++ buffer_flags, false); + } else { + if (buffer->error) { + spin_unlock(&dmxdevfilter->dev->lock); +diff --git a/drivers/media/dvb-core/dvb_vb2.c b/drivers/media/dvb-core/dvb_vb2.c +index 909df82fed332..8950e608a87a4 100644 +--- a/drivers/media/dvb-core/dvb_vb2.c ++++ b/drivers/media/dvb-core/dvb_vb2.c +@@ -252,7 +252,8 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx) + + int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx, + const unsigned char *src, int len, +- enum dmx_buffer_flags *buffer_flags) ++ enum dmx_buffer_flags *buffer_flags, ++ bool flush) + { + unsigned long flags = 0; + void *vbuf = NULL; +@@ -309,7 +310,7 @@ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx, + } + } + +- if (ctx->nonblocking && ctx->buf) { ++ if (flush && ctx->buf) { + vb2_set_plane_payload(&ctx->buf->vb, 0, ll); + vb2_buffer_done(&ctx->buf->vb, VB2_BUF_STATE_DONE); + list_del(&ctx->buf->list); +diff --git a/include/media/dvb_vb2.h b/include/media/dvb_vb2.h +index 8cb88452cd6c2..0fbbfc65157e6 100644 +--- a/include/media/dvb_vb2.h ++++ b/include/media/dvb_vb2.h +@@ -124,7 +124,7 @@ static inline int dvb_vb2_release(struct dvb_vb2_ctx *ctx) + return 0; + }; + #define dvb_vb2_is_streaming(ctx) (0) +-#define dvb_vb2_fill_buffer(ctx, file, wait, flags) (0) ++#define dvb_vb2_fill_buffer(ctx, file, wait, flags, flush) (0) + + static inline __poll_t dvb_vb2_poll(struct dvb_vb2_ctx *ctx, + struct file *file, +@@ -166,10 +166,12 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx); + * @buffer_flags: + * pointer to buffer flags as defined by &enum dmx_buffer_flags. + * can be NULL. ++ * @flush: flush the buffer, even if it isn't full. + */ + int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx, + const unsigned char *src, int len, +- enum dmx_buffer_flags *buffer_flags); ++ enum dmx_buffer_flags *buffer_flags, ++ bool flush); + + /** + * dvb_vb2_poll - Wrapper to vb2_core_streamon() for Digital TV +-- +2.51.0 + diff --git a/queue-6.6/media-mediatek-vcodec-don-t-try-to-decode-422-444-vp.patch b/queue-6.6/media-mediatek-vcodec-don-t-try-to-decode-422-444-vp.patch new file mode 100644 index 00000000000..7e11cacdad2 --- /dev/null +++ b/queue-6.6/media-mediatek-vcodec-don-t-try-to-decode-422-444-vp.patch @@ -0,0 +1,40 @@ +From 250cc23f2062648d908ae667989f9c1da82d5fc5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Nov 2025 14:16:16 -0500 +Subject: media: mediatek: vcodec: Don't try to decode 422/444 VP9 + +From: Nicolas Dufresne + +[ Upstream commit 3e92d7e4935084ecdbdc88880cc4688618ae1557 ] + +This is not supported by the hardware and trying to decode +these leads to LAT timeout errors. + +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c +index e29c9c58f3dac..fb629a7cd8127 100644 +--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c ++++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c +@@ -475,6 +475,12 @@ static int mtk_vdec_s_ctrl(struct v4l2_ctrl *ctrl) + mtk_v4l2_vdec_err(ctx, "VP9: bit_depth:%d", frame->bit_depth); + return -EINVAL; + } ++ ++ if (!(frame->flags & V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING) || ++ !(frame->flags & V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING)) { ++ mtk_v4l2_vdec_err(ctx, "VP9: only 420 subsampling is supported"); ++ return -EINVAL; ++ } + break; + case V4L2_CID_STATELESS_AV1_SEQUENCE: + seq = (struct v4l2_ctrl_av1_sequence *)hdr_ctrl->p_new.p; +-- +2.51.0 + diff --git a/queue-6.6/media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch b/queue-6.6/media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch new file mode 100644 index 00000000000..d4ec5aa3b20 --- /dev/null +++ b/queue-6.6/media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch @@ -0,0 +1,53 @@ +From c89968f84572346d817cd0001a9d4503d9d89534 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Oct 2025 15:26:40 +0200 +Subject: media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes + +From: Hans Verkuil + +[ Upstream commit 44c03802a5191626996ee9db4bac090b164ca340 ] + +The isp_video_mbus_to_pix/pix_to_mbus functions did not take +the last empty entry { 0, } of the formats array into account. + +As a result, isp_video_mbus_to_pix would accept code 0 and +isp_video_pix_to_mbus would select code 0 if no match was found. + +Signed-off-by: Hans Verkuil +Acked-by: Sakari Ailus +Signed-off-by: Sasha Levin +--- + drivers/media/platform/ti/omap3isp/ispvideo.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/ti/omap3isp/ispvideo.c b/drivers/media/platform/ti/omap3isp/ispvideo.c +index daca689dc0825..7334e1b4f0b2b 100644 +--- a/drivers/media/platform/ti/omap3isp/ispvideo.c ++++ b/drivers/media/platform/ti/omap3isp/ispvideo.c +@@ -148,12 +148,12 @@ static unsigned int isp_video_mbus_to_pix(const struct isp_video *video, + pix->width = mbus->width; + pix->height = mbus->height; + +- for (i = 0; i < ARRAY_SIZE(formats); ++i) { ++ for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) { + if (formats[i].code == mbus->code) + break; + } + +- if (WARN_ON(i == ARRAY_SIZE(formats))) ++ if (WARN_ON(i == ARRAY_SIZE(formats) - 1)) + return 0; + + min_bpl = pix->width * formats[i].bpp; +@@ -191,7 +191,7 @@ static void isp_video_pix_to_mbus(const struct v4l2_pix_format *pix, + /* Skip the last format in the loop so that it will be selected if no + * match is found. + */ +- for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) { ++ for (i = 0; i < ARRAY_SIZE(formats) - 2; ++i) { + if (formats[i].pixelformat == pix->pixelformat) + break; + } +-- +2.51.0 + diff --git a/queue-6.6/media-omap3isp-isppreview-always-clamp-in-preview_tr.patch b/queue-6.6/media-omap3isp-isppreview-always-clamp-in-preview_tr.patch new file mode 100644 index 00000000000..e1e7584db2f --- /dev/null +++ b/queue-6.6/media-omap3isp-isppreview-always-clamp-in-preview_tr.patch @@ -0,0 +1,63 @@ +From 815e07362053bcd159c262633d4819e1cdab5925 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 17:09:18 +0200 +Subject: media: omap3isp: isppreview: always clamp in preview_try_format() + +From: Hans Verkuil + +[ Upstream commit 17e1e1641f74a89824d4de3aa38c78daa5686cc1 ] + +If prev->input != PREVIEW_INPUT_MEMORY the width and height weren't +clamped. Just always clamp. + +This fixes a v4l2-compliance error: + + fail: v4l2-test-subdevs.cpp(171): fse.max_width == ~0U || fse.max_height == ~0U + fail: v4l2-test-subdevs.cpp(270): ret && ret != ENOTTY +test Try VIDIOC_SUBDEV_ENUM_MBUS_CODE/FRAME_SIZE/FRAME_INTERVAL: FAIL + +Signed-off-by: Hans Verkuil +Acked-by: Sakari Ailus +Signed-off-by: Sasha Levin +--- + .../media/platform/ti/omap3isp/isppreview.c | 21 +++++++------------ + 1 file changed, 8 insertions(+), 13 deletions(-) + +diff --git a/drivers/media/platform/ti/omap3isp/isppreview.c b/drivers/media/platform/ti/omap3isp/isppreview.c +index 53aedec7990da..32e4348e6837a 100644 +--- a/drivers/media/platform/ti/omap3isp/isppreview.c ++++ b/drivers/media/platform/ti/omap3isp/isppreview.c +@@ -1744,22 +1744,17 @@ static void preview_try_format(struct isp_prev_device *prev, + + switch (pad) { + case PREV_PAD_SINK: +- /* When reading data from the CCDC, the input size has already +- * been mangled by the CCDC output pad so it can be accepted +- * as-is. +- * +- * When reading data from memory, clamp the requested width and +- * height. The TRM doesn't specify a minimum input height, make ++ /* ++ * Clamp the requested width and height. ++ * The TRM doesn't specify a minimum input height, make + * sure we got enough lines to enable the noise filter and color + * filter array interpolation. + */ +- if (prev->input == PREVIEW_INPUT_MEMORY) { +- fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH, +- preview_max_out_width(prev)); +- fmt->height = clamp_t(u32, fmt->height, +- PREV_MIN_IN_HEIGHT, +- PREV_MAX_IN_HEIGHT); +- } ++ fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH, ++ preview_max_out_width(prev)); ++ fmt->height = clamp_t(u32, fmt->height, ++ PREV_MIN_IN_HEIGHT, ++ PREV_MAX_IN_HEIGHT); + + fmt->colorspace = V4L2_COLORSPACE_SRGB; + +-- +2.51.0 + diff --git a/queue-6.6/media-omap3isp-set-initial-format.patch b/queue-6.6/media-omap3isp-set-initial-format.patch new file mode 100644 index 00000000000..130773b03ae --- /dev/null +++ b/queue-6.6/media-omap3isp-set-initial-format.patch @@ -0,0 +1,51 @@ +From 99b07f5a5bb0b0c98ed689586d6b2c8ae40e48c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Apr 2025 09:21:53 +0200 +Subject: media: omap3isp: set initial format + +From: Hans Verkuil + +[ Upstream commit 7575b8dfa91f82fcb34ffd5568ff415ac4685794 ] + +Initialize the v4l2_format to a default. Empty formats are +not allowed in V4L2, so this fixes v4l2-compliance issues: + + fail: v4l2-test-formats.cpp(514): !pix.width || !pix.height +test VIDIOC_G_FMT: FAIL + +Signed-off-by: Hans Verkuil +Acked-by: Sakari Ailus +Signed-off-by: Sasha Levin +--- + drivers/media/platform/ti/omap3isp/ispvideo.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/media/platform/ti/omap3isp/ispvideo.c b/drivers/media/platform/ti/omap3isp/ispvideo.c +index 7334e1b4f0b2b..b9e0b6215fa04 100644 +--- a/drivers/media/platform/ti/omap3isp/ispvideo.c ++++ b/drivers/media/platform/ti/omap3isp/ispvideo.c +@@ -1288,6 +1288,7 @@ static const struct v4l2_ioctl_ops isp_video_ioctl_ops = { + static int isp_video_open(struct file *file) + { + struct isp_video *video = video_drvdata(file); ++ struct v4l2_mbus_framefmt fmt; + struct isp_video_fh *handle; + struct vb2_queue *queue; + int ret = 0; +@@ -1329,6 +1330,13 @@ static int isp_video_open(struct file *file) + + memset(&handle->format, 0, sizeof(handle->format)); + handle->format.type = video->type; ++ handle->format.fmt.pix.width = 720; ++ handle->format.fmt.pix.height = 480; ++ handle->format.fmt.pix.pixelformat = V4L2_PIX_FMT_UYVY; ++ handle->format.fmt.pix.field = V4L2_FIELD_NONE; ++ handle->format.fmt.pix.colorspace = V4L2_COLORSPACE_SRGB; ++ isp_video_pix_to_mbus(&handle->format.fmt.pix, &fmt); ++ isp_video_mbus_to_pix(video, &fmt, &handle->format.fmt.pix); + handle->timeperframe.denominator = 1; + + handle->video = video; +-- +2.51.0 + diff --git a/queue-6.6/media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch b/queue-6.6/media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch new file mode 100644 index 00000000000..80238659ae5 --- /dev/null +++ b/queue-6.6/media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch @@ -0,0 +1,48 @@ +From f3e024f16a8a927677a27331b67781649c2a483f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Dec 2025 19:24:19 +0100 +Subject: media: pvrusb2: fix URB leak in pvr2_send_request_ex + +From: Szymon Wilczek + +[ Upstream commit a8333c8262aed2aedf608c18edd39cf5342680a7 ] + +When pvr2_send_request_ex() submits a write URB successfully but fails to +submit the read URB (e.g. returns -ENOMEM), it returns immediately without +waiting for the write URB to complete. Since the driver reuses the same +URB structure, a subsequent call to pvr2_send_request_ex() attempts to +submit the still-active write URB, triggering a 'URB submitted while +active' warning in usb_submit_urb(). + +Fix this by ensuring the write URB is unlinked and waited upon if the read +URB submission fails. + +Reported-by: syzbot+405dcd13121ff75a9e16@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=405dcd13121ff75a9e16 +Signed-off-by: Szymon Wilczek +Acked-by: Mike Isely +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +index 2de104736f874..943d56b10251b 100644 +--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c ++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +@@ -3709,6 +3709,11 @@ status); + "Failed to submit read-control URB status=%d", + status); + hdw->ctl_read_pend_flag = 0; ++ if (hdw->ctl_write_pend_flag) { ++ usb_unlink_urb(hdw->ctl_write_urb); ++ while (hdw->ctl_write_pend_flag) ++ wait_for_completion(&hdw->ctl_done); ++ } + goto done; + } + } +-- +2.51.0 + diff --git a/queue-6.6/media-rkisp1-fix-filter-mode-register-configuration.patch b/queue-6.6/media-rkisp1-fix-filter-mode-register-configuration.patch new file mode 100644 index 00000000000..446f157d5bf --- /dev/null +++ b/queue-6.6/media-rkisp1-fix-filter-mode-register-configuration.patch @@ -0,0 +1,53 @@ +From f7cdf8ded8a460b4b0dd4ba870e8347ea6e0cd6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jan 2026 12:11:42 -0500 +Subject: media: rkisp1: Fix filter mode register configuration + +From: Rui Wang + +[ Upstream commit 5a50f2b61104d0d351b59ec179f67abab7870453 ] + +The rkisp1_flt_config() function performs an initial direct write to +RKISP1_CIF_ISP_FILT_MODE without including the RKISP1_CIF_ISP_FLT_ENA +bit, which clears the filter enable bit in the hardware. + +The subsequent read/modify/write sequence then reads back the register +with the enable bit already cleared and cannot restore it, resulting in +the filter being inadvertently disabled. + +Remove the redundant direct write. The read/modify/write sequence alone +correctly preserves the existing enable bit state while updating the +DNR mode and filter configuration bits. + +Signed-off-by: Rui Wang +Reviewed-by: Stefan Klug +Reviewed-by: Kieran Bingham +Reviewed-by: Laurent Pinchart +Link: https://patch.msgid.link/20260105171142.147792-2-rui.wang@ideasonboard.com +Signed-off-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rockchip/rkisp1/rkisp1-params.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c +index 3482f7d707b75..09c20fb2d92ee 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c +@@ -385,12 +385,6 @@ static void rkisp1_flt_config(struct rkisp1_params *params, + rkisp1_write(params->rkisp1, RKISP1_CIF_ISP_FILT_LUM_WEIGHT, + arg->lum_weight); + +- rkisp1_write(params->rkisp1, RKISP1_CIF_ISP_FILT_MODE, +- (arg->mode ? RKISP1_CIF_ISP_FLT_MODE_DNR : 0) | +- RKISP1_CIF_ISP_FLT_CHROMA_V_MODE(arg->chr_v_mode) | +- RKISP1_CIF_ISP_FLT_CHROMA_H_MODE(arg->chr_h_mode) | +- RKISP1_CIF_ISP_FLT_GREEN_STAGE1(arg->grn_stage1)); +- + /* avoid to override the old enable value */ + filt_mode = rkisp1_read(params->rkisp1, RKISP1_CIF_ISP_FILT_MODE); + filt_mode &= RKISP1_CIF_ISP_FLT_ENA; +-- +2.51.0 + diff --git a/queue-6.6/media-solo6x10-check-for-out-of-bounds-chip_id.patch b/queue-6.6/media-solo6x10-check-for-out-of-bounds-chip_id.patch new file mode 100644 index 00000000000..7bd61139c23 --- /dev/null +++ b/queue-6.6/media-solo6x10-check-for-out-of-bounds-chip_id.patch @@ -0,0 +1,68 @@ +From 05354e2680367ca92bcb4f47deeedc24452e6edc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 19:00:35 -0800 +Subject: media: solo6x10: Check for out of bounds chip_id + +From: Kees Cook + +[ Upstream commit 0fdf6323c35a134f206dcad5babb4ff488552076 ] + +Clang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type +(literal "1" is an "int") could end up being shifted beyond 32 bits, +so instrumentation was added (and due to the double is_tw286x() call +seen via inlining), Clang decides the second one must now be undefined +behavior and elides the rest of the function[1]. This is a known problem +with Clang (that is still being worked on), but we can avoid the entire +problem by actually checking the existing max chip ID, and now there is +no runtime instrumentation added at all since everything is known to be +within bounds. + +Additionally use an unsigned value for the shift to remove the +instrumentation even without the explicit bounds checking. + +Link: https://github.com/ClangBuiltLinux/linux/issues/2144 [1] +Suggested-by: Nathan Chancellor +Signed-off-by: Kees Cook +Signed-off-by: Hans Verkuil +[hverkuil: fix checkpatch warning for is_tw286x] +Signed-off-by: Sasha Levin +--- + drivers/media/pci/solo6x10/solo6x10-tw28.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/pci/solo6x10/solo6x10-tw28.c b/drivers/media/pci/solo6x10/solo6x10-tw28.c +index 1b7c22a9bc94f..8f53946c67928 100644 +--- a/drivers/media/pci/solo6x10/solo6x10-tw28.c ++++ b/drivers/media/pci/solo6x10/solo6x10-tw28.c +@@ -166,7 +166,7 @@ static const u8 tbl_tw2865_pal_template[] = { + 0x64, 0x51, 0x40, 0xaf, 0xFF, 0xF0, 0x00, 0xC0, + }; + +-#define is_tw286x(__solo, __id) (!(__solo->tw2815 & (1 << __id))) ++#define is_tw286x(__solo, __id) (!((__solo)->tw2815 & (1U << (__id)))) + + static u8 tw_readbyte(struct solo_dev *solo_dev, int chip_id, u8 tw6x_off, + u8 tw_off) +@@ -686,6 +686,9 @@ int tw28_set_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch, + chip_num = ch / 4; + ch %= 4; + ++ if (chip_num >= TW_NUM_CHIP) ++ return -EINVAL; ++ + if (val > 255 || val < 0) + return -ERANGE; + +@@ -758,6 +761,9 @@ int tw28_get_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch, + chip_num = ch / 4; + ch %= 4; + ++ if (chip_num >= TW_NUM_CHIP) ++ return -EINVAL; ++ + switch (ctrl) { + case V4L2_CID_SHARPNESS: + /* Only 286x has sharpness */ +-- +2.51.0 + diff --git a/queue-6.6/media-v4l2-async-fix-error-handling-on-steps-after-f.patch b/queue-6.6/media-v4l2-async-fix-error-handling-on-steps-after-f.patch new file mode 100644 index 00000000000..af334a35712 --- /dev/null +++ b/queue-6.6/media-v4l2-async-fix-error-handling-on-steps-after-f.patch @@ -0,0 +1,131 @@ +From dbe1f7a373bee781b3b4445c6e9cee77bfda57a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 13:48:40 +0200 +Subject: media: v4l2-async: Fix error handling on steps after finding a match + +From: Sakari Ailus + +[ Upstream commit 7345d6d356336c448d6b9230ed8704f39679fd12 ] + +Once an async connection is found to be matching with an fwnode, a +sub-device may be registered (in case it wasn't already), its bound +operation is called, ancillary links are created, the async connection +is added to the sub-device's list of connections and removed from the +global waiting connection list. Further on, the sub-device's possible own +notifier is searched for possible additional matches. + +Fix these specific issues: + +- If v4l2_async_match_notify() failed before the sub-notifier handling, + the async connection was unbound and its entry removed from the + sub-device's async connection list. The latter part was also done in + v4l2_async_match_notify(). + +- The async connection's sd field was only set after creating ancillary + links in v4l2_async_match_notify(). It was however dereferenced in + v4l2_async_unbind_subdev_one(), which was called on error path of + v4l2_async_match_notify() failure. + +Signed-off-by: Sakari Ailus +Tested-by: "Yew, Chang Ching" +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-async.c | 45 +++++++++++++++++++--------- + 1 file changed, 31 insertions(+), 14 deletions(-) + +diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c +index ac4d987bba255..cf2923dea84b3 100644 +--- a/drivers/media/v4l2-core/v4l2-async.c ++++ b/drivers/media/v4l2-core/v4l2-async.c +@@ -339,7 +339,6 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier, + struct v4l2_subdev *sd, + struct v4l2_async_connection *asc) + { +- struct v4l2_async_notifier *subdev_notifier; + bool registered = false; + int ret; + +@@ -385,6 +384,25 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier, + dev_dbg(notifier_dev(notifier), "v4l2-async: %s bound (ret %d)\n", + dev_name(sd->dev), ret); + ++ return 0; ++ ++err_call_unbind: ++ v4l2_async_nf_call_unbind(notifier, sd, asc); ++ list_del(&asc->asc_subdev_entry); ++ ++err_unregister_subdev: ++ if (registered) ++ v4l2_device_unregister_subdev(sd); ++ ++ return ret; ++} ++ ++static int ++v4l2_async_nf_try_subdev_notifier(struct v4l2_async_notifier *notifier, ++ struct v4l2_subdev *sd) ++{ ++ struct v4l2_async_notifier *subdev_notifier; ++ + /* + * See if the sub-device has a notifier. If not, return here. + */ +@@ -400,16 +418,6 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier, + subdev_notifier->parent = notifier; + + return v4l2_async_nf_try_all_subdevs(subdev_notifier); +- +-err_call_unbind: +- v4l2_async_nf_call_unbind(notifier, sd, asc); +- list_del(&asc->asc_subdev_entry); +- +-err_unregister_subdev: +- if (registered) +- v4l2_device_unregister_subdev(sd); +- +- return ret; + } + + /* Test all async sub-devices in a notifier for a match. */ +@@ -441,6 +449,10 @@ v4l2_async_nf_try_all_subdevs(struct v4l2_async_notifier *notifier) + if (ret < 0) + return ret; + ++ ret = v4l2_async_nf_try_subdev_notifier(notifier, sd); ++ if (ret < 0) ++ return ret; ++ + /* + * v4l2_async_match_notify() may lead to registering a + * new notifier and thus changing the async subdevs +@@ -823,7 +835,11 @@ int v4l2_async_register_subdev(struct v4l2_subdev *sd) + ret = v4l2_async_match_notify(notifier, v4l2_dev, sd, + asc); + if (ret) +- goto err_unbind; ++ goto err_unlock; ++ ++ ret = v4l2_async_nf_try_subdev_notifier(notifier, sd); ++ if (ret) ++ goto err_unbind_one; + + ret = v4l2_async_nf_try_complete(notifier); + if (ret) +@@ -847,9 +863,10 @@ int v4l2_async_register_subdev(struct v4l2_subdev *sd) + if (subdev_notifier) + v4l2_async_nf_unbind_all_subdevs(subdev_notifier); + +- if (asc) +- v4l2_async_unbind_subdev_one(notifier, asc); ++err_unbind_one: ++ v4l2_async_unbind_subdev_one(notifier, asc); + ++err_unlock: + mutex_unlock(&list_lock); + + return ret; +-- +2.51.0 + diff --git a/queue-6.6/minix-add-required-sanity-checking-to-minix_check_su.patch b/queue-6.6/minix-add-required-sanity-checking-to-minix_check_su.patch new file mode 100644 index 00000000000..c56999300ac --- /dev/null +++ b/queue-6.6/minix-add-required-sanity-checking-to-minix_check_su.patch @@ -0,0 +1,103 @@ +From 4904d3a0a71248341dac15586eaae3b1c52b438e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 16:39:47 +0100 +Subject: minix: Add required sanity checking to minix_check_superblock() + +From: Jori Koolstra + +[ Upstream commit 8c97a6ddc95690a938ded44b4e3202f03f15078c ] + +The fs/minix implementation of the minix filesystem does not currently +support any other value for s_log_zone_size than 0. This is also the +only value supported in util-linux; see mkfs.minix.c line 511. In +addition, this patch adds some sanity checking for the other minix +superblock fields, and moves the minix_blocks_needed() checks for the +zmap and imap also to minix_check_super_block(). + +This also closes a related syzbot bug report. + +Signed-off-by: Jori Koolstra +Link: https://patch.msgid.link/20251208153947.108343-1-jkoolstra@xs4all.nl +Reviewed-by: Jan Kara +Reported-by: syzbot+5ad0824204c7bf9b67f2@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=5ad0824204c7bf9b67f2 +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/minix/inode.c | 50 ++++++++++++++++++++++++++++-------------------- + 1 file changed, 29 insertions(+), 21 deletions(-) + +diff --git a/fs/minix/inode.c b/fs/minix/inode.c +index ee8a6fe360e72..820c7753bd105 100644 +--- a/fs/minix/inode.c ++++ b/fs/minix/inode.c +@@ -153,10 +153,38 @@ static int minix_remount (struct super_block * sb, int * flags, char * data) + static bool minix_check_superblock(struct super_block *sb) + { + struct minix_sb_info *sbi = minix_sb(sb); ++ unsigned long block; + +- if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0) ++ if (sbi->s_log_zone_size != 0) { ++ printk("minix-fs error: zone size must equal block size. " ++ "s_log_zone_size > 0 is not supported.\n"); ++ return false; ++ } ++ ++ if (sbi->s_ninodes < 1 || sbi->s_firstdatazone <= 4 || ++ sbi->s_firstdatazone >= sbi->s_nzones) + return false; + ++ /* Apparently minix can create filesystems that allocate more blocks for ++ * the bitmaps than needed. We simply ignore that, but verify it didn't ++ * create one with not enough blocks and bail out if so. ++ */ ++ block = minix_blocks_needed(sbi->s_ninodes, sb->s_blocksize); ++ if (sbi->s_imap_blocks < block) { ++ printk("MINIX-fs: file system does not have enough " ++ "imap blocks allocated. Refusing to mount.\n"); ++ return false; ++ } ++ ++ block = minix_blocks_needed( ++ (sbi->s_nzones - sbi->s_firstdatazone + 1), ++ sb->s_blocksize); ++ if (sbi->s_zmap_blocks < block) { ++ printk("MINIX-fs: file system does not have enough " ++ "zmap blocks allocated. Refusing to mount.\n"); ++ return false; ++ } ++ + /* + * s_max_size must not exceed the block mapping limitation. This check + * is only needed for V1 filesystems, since V2/V3 support an extra level +@@ -275,26 +303,6 @@ static int minix_fill_super(struct super_block *s, void *data, int silent) + minix_set_bit(0,sbi->s_imap[0]->b_data); + minix_set_bit(0,sbi->s_zmap[0]->b_data); + +- /* Apparently minix can create filesystems that allocate more blocks for +- * the bitmaps than needed. We simply ignore that, but verify it didn't +- * create one with not enough blocks and bail out if so. +- */ +- block = minix_blocks_needed(sbi->s_ninodes, s->s_blocksize); +- if (sbi->s_imap_blocks < block) { +- printk("MINIX-fs: file system does not have enough " +- "imap blocks allocated. Refusing to mount.\n"); +- goto out_no_bitmap; +- } +- +- block = minix_blocks_needed( +- (sbi->s_nzones - sbi->s_firstdatazone + 1), +- s->s_blocksize); +- if (sbi->s_zmap_blocks < block) { +- printk("MINIX-fs: file system does not have enough " +- "zmap blocks allocated. Refusing to mount.\n"); +- goto out_no_bitmap; +- } +- + /* set up enough so that it can read an inode */ + s->s_op = &minix_sops; + s->s_time_min = 0; +-- +2.51.0 + diff --git a/queue-6.6/mips-loongson-make-cpumask_of_node-robust-against-nu.patch b/queue-6.6/mips-loongson-make-cpumask_of_node-robust-against-nu.patch new file mode 100644 index 00000000000..09b7d4bfdcf --- /dev/null +++ b/queue-6.6/mips-loongson-make-cpumask_of_node-robust-against-nu.patch @@ -0,0 +1,36 @@ +From 2d0c3ad253d007a138098f383afd949759b31409 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 09:40:06 +0000 +Subject: MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE + +From: John Garry + +[ Upstream commit d55d3fe2d1470ac5b6e93efe7998b728013c9fc8 ] + +The arch definition of cpumask_of_node() cannot handle NUMA_NO_NODE - which +is a valid index - so add a check for this. + +Signed-off-by: John Garry +Reviewed-by: Huacai Chen +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/mach-loongson64/topology.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/include/asm/mach-loongson64/topology.h b/arch/mips/include/asm/mach-loongson64/topology.h +index 3414a1fd17835..89bb4deab98a6 100644 +--- a/arch/mips/include/asm/mach-loongson64/topology.h ++++ b/arch/mips/include/asm/mach-loongson64/topology.h +@@ -7,7 +7,7 @@ + #define cpu_to_node(cpu) (cpu_logical_map(cpu) >> 2) + + extern cpumask_t __node_cpumask[]; +-#define cpumask_of_node(node) (&__node_cpumask[node]) ++#define cpumask_of_node(node) ((node) == NUMA_NO_NODE ? cpu_all_mask : &__node_cpumask[node]) + + struct pci_bus; + extern int pcibus_to_node(struct pci_bus *); +-- +2.51.0 + diff --git a/queue-6.6/misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch b/queue-6.6/misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch new file mode 100644 index 00000000000..bdfbf2de3a3 --- /dev/null +++ b/queue-6.6/misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch @@ -0,0 +1,75 @@ +From 4853805b346c5bcfa5d92a673685637ee009430b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Dec 2025 14:36:37 +0800 +Subject: misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() + +From: Tuo Li + +[ Upstream commit ba75ecb97d3f4e95d59002c13afb6519205be6cb ] + +In the function bcm_vk_read(), the pointer entry is checked, indicating +that it can be NULL. If entry is NULL and rc is set to -EMSGSIZE, the +following code may cause null-pointer dereferences: + + struct vk_msg_blk tmp_msg = entry->to_h_msg[0]; + set_msg_id(&tmp_msg, entry->usr_msg_id); + tmp_msg.size = entry->to_h_blks - 1; + +To prevent these possible null-pointer dereferences, copy to_h_msg, +usr_msg_id, and to_h_blks from iter into temporary variables, and return +these temporary variables to the application instead of accessing them +through a potentially NULL entry. + +Signed-off-by: Tuo Li +Reviewed-by: Scott Branden +Link: https://patch.msgid.link/20251211063637.3987937-1-islituo@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/bcm-vk/bcm_vk_msg.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/misc/bcm-vk/bcm_vk_msg.c b/drivers/misc/bcm-vk/bcm_vk_msg.c +index e17d81231ea6d..54e25e9bc51b1 100644 +--- a/drivers/misc/bcm-vk/bcm_vk_msg.c ++++ b/drivers/misc/bcm-vk/bcm_vk_msg.c +@@ -1010,6 +1010,9 @@ ssize_t bcm_vk_read(struct file *p_file, + struct device *dev = &vk->pdev->dev; + struct bcm_vk_msg_chan *chan = &vk->to_h_msg_chan; + struct bcm_vk_wkent *entry = NULL, *iter; ++ struct vk_msg_blk tmp_msg; ++ u32 tmp_usr_msg_id; ++ u32 tmp_blks; + u32 q_num; + u32 rsp_length; + +@@ -1034,6 +1037,9 @@ ssize_t bcm_vk_read(struct file *p_file, + entry = iter; + } else { + /* buffer not big enough */ ++ tmp_msg = iter->to_h_msg[0]; ++ tmp_usr_msg_id = iter->usr_msg_id; ++ tmp_blks = iter->to_h_blks; + rc = -EMSGSIZE; + } + goto read_loop_exit; +@@ -1052,14 +1058,12 @@ ssize_t bcm_vk_read(struct file *p_file, + + bcm_vk_free_wkent(dev, entry); + } else if (rc == -EMSGSIZE) { +- struct vk_msg_blk tmp_msg = entry->to_h_msg[0]; +- + /* + * in this case, return just the first block, so + * that app knows what size it is looking for. + */ +- set_msg_id(&tmp_msg, entry->usr_msg_id); +- tmp_msg.size = entry->to_h_blks - 1; ++ set_msg_id(&tmp_msg, tmp_usr_msg_id); ++ tmp_msg.size = tmp_blks - 1; + if (copy_to_user(buf, &tmp_msg, VK_MSGQ_BLK_SIZE) != 0) { + dev_err(dev, "Error return 1st block in -EMSGSIZE\n"); + rc = -EFAULT; +-- +2.51.0 + diff --git a/queue-6.6/misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch b/queue-6.6/misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch new file mode 100644 index 00000000000..669117e5070 --- /dev/null +++ b/queue-6.6/misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch @@ -0,0 +1,67 @@ +From c29e4f8a5a31d2da136cc257f2f7c49a770c4504 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 11:48:24 +0100 +Subject: misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 + +From: Markus Perkins + +[ Upstream commit b54c82d6cbfc76647ba558e8e3647eb2b0ba0e2b ] + +commit 14374fbb3f06 ("misc: eeprom_93xx46: Add new 93c56 and 93c66 +compatible strings") added support for 93xx56 and 93xx66 eeproms, but +didn't take into account that the write enable/disable + erase all +commands are hardcoded for the 6-bit address of the 93xx46. + +This commit fixes the command word generation by increasing the number +of shifts as the address field grows, keeping the command intact. + +Also, the check for 8-bit or 16-bit mode is no longer required as this +is already taken into account in the edev->addrlen field. + +Signed-off-by: Markus Perkins +Link: https://patch.msgid.link/20251202104823.429869-3-markus@notsyncing.net +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/eeprom/eeprom_93xx46.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c +index b630625b3024b..b510d0b5ddfa7 100644 +--- a/drivers/misc/eeprom/eeprom_93xx46.c ++++ b/drivers/misc/eeprom/eeprom_93xx46.c +@@ -23,6 +23,7 @@ + #define OP_START 0x4 + #define OP_WRITE (OP_START | 0x1) + #define OP_READ (OP_START | 0x2) ++/* The following addresses are offset for the 1K EEPROM variant in 16-bit mode */ + #define ADDR_EWDS 0x00 + #define ADDR_ERAL 0x20 + #define ADDR_EWEN 0x30 +@@ -173,10 +174,7 @@ static int eeprom_93xx46_ew(struct eeprom_93xx46_dev *edev, int is_on) + bits = edev->addrlen + 3; + + cmd_addr = OP_START << edev->addrlen; +- if (edev->pdata->flags & EE_ADDR8) +- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << 1; +- else +- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS); ++ cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << (edev->addrlen - 6); + + if (has_quirk_instruction_length(edev)) { + cmd_addr <<= 2; +@@ -320,10 +318,7 @@ static int eeprom_93xx46_eral(struct eeprom_93xx46_dev *edev) + bits = edev->addrlen + 3; + + cmd_addr = OP_START << edev->addrlen; +- if (edev->pdata->flags & EE_ADDR8) +- cmd_addr |= ADDR_ERAL << 1; +- else +- cmd_addr |= ADDR_ERAL; ++ cmd_addr |= ADDR_ERAL << (edev->addrlen - 6); + + if (has_quirk_instruction_length(edev)) { + cmd_addr <<= 2; +-- +2.51.0 + diff --git a/queue-6.6/modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch b/queue-6.6/modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch new file mode 100644 index 00000000000..5d32f2bb94b --- /dev/null +++ b/queue-6.6/modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch @@ -0,0 +1,56 @@ +From 124513a43ec3761abadfaae64afb6efed2989d12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Nov 2025 13:13:30 +0100 +Subject: modpost: Amend ppc64 save/restfpr symnames for -Os build +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: René Rebe + +[ Upstream commit 3cd9763ce4ad999d015cf0734e6b968cead95077 ] + +Building a size optimized ppc64 kernel (-Os), gcc emits more FP +save/restore symbols, that the linker generates on demand into the +.sfpr section. Explicitly allow-list those in scripts/mod/modpost.c, +too. They are needed for the amdgpu in-kernel floating point support. + +MODPOST Module.symvers +ERROR: modpost: "_restfpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_26" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savegpr1_27" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savegpr1_25" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_28" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savegpr1_29" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savefpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_savefpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +ERROR: modpost: "_restfpr_15" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! +WARNING: modpost: suppressed 56 unresolved symbol warnings because there were too many) + +Signed-off-by: René Rebe +Link: https://patch.msgid.link/20251123.131330.407910684435629198.rene@exactco.de +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + scripts/mod/modpost.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index 3eb7fda8a98ff..96a6e68730981 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -608,6 +608,10 @@ static int ignore_undef_symbol(struct elf_info *info, const char *symname) + /* Special register function linked on all modules during final link of .ko */ + if (strstarts(symname, "_restgpr0_") || + strstarts(symname, "_savegpr0_") || ++ strstarts(symname, "_restgpr1_") || ++ strstarts(symname, "_savegpr1_") || ++ strstarts(symname, "_restfpr_") || ++ strstarts(symname, "_savefpr_") || + strstarts(symname, "_restvr_") || + strstarts(symname, "_savevr_") || + strcmp(symname, ".TOC.") == 0) +-- +2.51.0 + diff --git a/queue-6.6/myri10ge-avoid-uninitialized-variable-use.patch b/queue-6.6/myri10ge-avoid-uninitialized-variable-use.patch new file mode 100644 index 00000000000..3890924c49f --- /dev/null +++ b/queue-6.6/myri10ge-avoid-uninitialized-variable-use.patch @@ -0,0 +1,162 @@ +From e92cb3e2c881c4620239b73ca5d12237389a438b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Feb 2026 17:28:09 +0100 +Subject: myri10ge: avoid uninitialized variable use + +From: Arnd Bergmann + +[ Upstream commit fd24173439c033ffb3c2a2628fcbc9cb65e62bdb ] + +While compile testing on less common architectures, I noticed that gcc-10 on +s390 finds a bug that all other configurations seem to miss: + +drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_set_multicast_list': +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:391:25: error: 'cmd.data0' is used uninitialized in this function [-Werror=uninitialized] + 391 | buf->data0 = htonl(data->data0); + | ^~ +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:25: error: '*((void *)&cmd+4)' is used uninitialized in this function [-Werror=uninitialized] + 392 | buf->data1 = htonl(data->data1); + | ^~ +drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_allocate_rings': +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:13: error: 'cmd.data1' is used uninitialized in this function [-Werror=uninitialized] + 392 | buf->data1 = htonl(data->data1); +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data1' was declared here + 1939 | struct myri10ge_cmd cmd; + | ^~~ +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:393:13: error: 'cmd.data2' is used uninitialized in this function [-Werror=uninitialized] + 393 | buf->data2 = htonl(data->data2); +drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data2' was declared here + 1939 | struct myri10ge_cmd cmd; + +It would be nice to understand how to make other compilers catch this as +well, but for the moment I'll just shut up the warning by fixing the +undefined behavior in this driver. + +Signed-off-by: Arnd Bergmann +Link: https://patch.msgid.link/20260205162935.2126442-1-arnd@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/myricom/myri10ge/myri10ge.c | 28 ++++++++++++++++++- + 1 file changed, 27 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c +index 7b7e1c5b00f47..f3b1605f6adc9 100644 +--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c ++++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c +@@ -688,6 +688,9 @@ static int myri10ge_get_firmware_capabilities(struct myri10ge_priv *mgp) + + /* probe for IPv6 TSO support */ + mgp->features = NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_TSO; ++ cmd.data0 = 0, ++ cmd.data1 = 0, ++ cmd.data2 = 0, + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_MAX_TSO6_HDR_SIZE, + &cmd, 0); + if (status == 0) { +@@ -806,6 +809,7 @@ static int myri10ge_update_mac_address(struct myri10ge_priv *mgp, + | (addr[2] << 8) | addr[3]); + + cmd.data1 = ((addr[4] << 8) | (addr[5])); ++ cmd.data2 = 0; + + status = myri10ge_send_cmd(mgp, MXGEFW_SET_MAC_ADDRESS, &cmd, 0); + return status; +@@ -817,6 +821,9 @@ static int myri10ge_change_pause(struct myri10ge_priv *mgp, int pause) + int status, ctl; + + ctl = pause ? MXGEFW_ENABLE_FLOW_CONTROL : MXGEFW_DISABLE_FLOW_CONTROL; ++ cmd.data0 = 0, ++ cmd.data1 = 0, ++ cmd.data2 = 0, + status = myri10ge_send_cmd(mgp, ctl, &cmd, 0); + + if (status) { +@@ -834,6 +841,9 @@ myri10ge_change_promisc(struct myri10ge_priv *mgp, int promisc, int atomic) + int status, ctl; + + ctl = promisc ? MXGEFW_ENABLE_PROMISC : MXGEFW_DISABLE_PROMISC; ++ cmd.data0 = 0; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, ctl, &cmd, atomic); + if (status) + netdev_err(mgp->dev, "Failed to set promisc mode\n"); +@@ -1946,6 +1956,8 @@ static int myri10ge_allocate_rings(struct myri10ge_slice_state *ss) + /* get ring sizes */ + slice = ss - mgp->ss; + cmd.data0 = slice; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_RING_SIZE, &cmd, 0); + tx_ring_size = cmd.data0; + cmd.data0 = slice; +@@ -2238,12 +2250,16 @@ static int myri10ge_get_txrx(struct myri10ge_priv *mgp, int slice) + status = 0; + if (slice == 0 || (mgp->dev->real_num_tx_queues > 1)) { + cmd.data0 = slice; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_OFFSET, + &cmd, 0); + ss->tx.lanai = (struct mcp_kreq_ether_send __iomem *) + (mgp->sram + cmd.data0); + } + cmd.data0 = slice; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status |= myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SMALL_RX_OFFSET, + &cmd, 0); + ss->rx_small.lanai = (struct mcp_kreq_ether_recv __iomem *) +@@ -2312,6 +2328,7 @@ static int myri10ge_open(struct net_device *dev) + if (mgp->num_slices > 1) { + cmd.data0 = mgp->num_slices; + cmd.data1 = MXGEFW_SLICE_INTR_MODE_ONE_PER_SLICE; ++ cmd.data2 = 0; + if (mgp->dev->real_num_tx_queues > 1) + cmd.data1 |= MXGEFW_SLICE_ENABLE_MULTIPLE_TX_QUEUES; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_ENABLE_RSS_QUEUES, +@@ -2414,6 +2431,8 @@ static int myri10ge_open(struct net_device *dev) + + /* now give firmware buffers sizes, and MTU */ + cmd.data0 = dev->mtu + ETH_HLEN + VLAN_HLEN; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = myri10ge_send_cmd(mgp, MXGEFW_CMD_SET_MTU, &cmd, 0); + cmd.data0 = mgp->small_bytes; + status |= +@@ -2472,7 +2491,6 @@ static int myri10ge_open(struct net_device *dev) + static int myri10ge_close(struct net_device *dev) + { + struct myri10ge_priv *mgp = netdev_priv(dev); +- struct myri10ge_cmd cmd; + int status, old_down_cnt; + int i; + +@@ -2491,8 +2509,13 @@ static int myri10ge_close(struct net_device *dev) + + netif_tx_stop_all_queues(dev); + if (mgp->rebooted == 0) { ++ struct myri10ge_cmd cmd; ++ + old_down_cnt = mgp->down_cnt; + mb(); ++ cmd.data0 = 0; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + status = + myri10ge_send_cmd(mgp, MXGEFW_CMD_ETHERNET_DOWN, &cmd, 0); + if (status) +@@ -2956,6 +2979,9 @@ static void myri10ge_set_multicast_list(struct net_device *dev) + + /* Disable multicast filtering */ + ++ cmd.data0 = 0; ++ cmd.data1 = 0; ++ cmd.data2 = 0; + err = myri10ge_send_cmd(mgp, MXGEFW_ENABLE_ALLMULTI, &cmd, 1); + if (err != 0) { + netdev_err(dev, "Failed MXGEFW_ENABLE_ALLMULTI, error status: %d\n", +-- +2.51.0 + diff --git a/queue-6.6/net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch b/queue-6.6/net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch new file mode 100644 index 00000000000..5c4fbbb7aa4 --- /dev/null +++ b/queue-6.6/net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch @@ -0,0 +1,70 @@ +From 5f1dd221b45c918ffbc336e090bdd79c63fa4fdb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 17:47:55 +0800 +Subject: net: hns3: extend HCLGE_FD_AD_QID to 11 bits + +From: Jijie Shao + +[ Upstream commit 878406d4d6ef85c37fab52074771cc916e532c16 ] + +Currently, HCLGE_FD_AD_QID has only 10 bits and supports a +maximum of 1023 queues. However, there are actually scenarios +where the queue_id exceeds 1023. + +This patch adds an additional bit to HCLGE_FD_AD_QID to ensure +that queue_id greater than 1023 are supported. + +Signed-off-by: Jijie Shao +Link: https://patch.msgid.link/20260123094756.3718516-2-shaojijie@huawei.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 5 +++-- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 +++- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +index 659d6351f26c8..f404a4c10e8f5 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +@@ -727,8 +727,8 @@ struct hclge_fd_tcam_config_3_cmd { + + #define HCLGE_FD_AD_DROP_B 0 + #define HCLGE_FD_AD_DIRECT_QID_B 1 +-#define HCLGE_FD_AD_QID_S 2 +-#define HCLGE_FD_AD_QID_M GENMASK(11, 2) ++#define HCLGE_FD_AD_QID_L_S 2 ++#define HCLGE_FD_AD_QID_L_M GENMASK(11, 2) + #define HCLGE_FD_AD_USE_COUNTER_B 12 + #define HCLGE_FD_AD_COUNTER_NUM_S 13 + #define HCLGE_FD_AD_COUNTER_NUM_M GENMASK(19, 13) +@@ -741,6 +741,7 @@ struct hclge_fd_tcam_config_3_cmd { + #define HCLGE_FD_AD_TC_OVRD_B 16 + #define HCLGE_FD_AD_TC_SIZE_S 17 + #define HCLGE_FD_AD_TC_SIZE_M GENMASK(20, 17) ++#define HCLGE_FD_AD_QID_H_B 21 + + struct hclge_fd_ad_config_cmd { + u8 stage; +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 72a5df4e3a329..04c58928585ca 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -5606,11 +5606,13 @@ static int hclge_fd_ad_config(struct hclge_dev *hdev, u8 stage, int loc, + hnae3_set_field(ad_data, HCLGE_FD_AD_TC_SIZE_M, + HCLGE_FD_AD_TC_SIZE_S, (u32)action->tc_size); + } ++ hnae3_set_bit(ad_data, HCLGE_FD_AD_QID_H_B, ++ action->queue_id >= HCLGE_TQP_MAX_SIZE_DEV_V2 ? 1 : 0); + ad_data <<= 32; + hnae3_set_bit(ad_data, HCLGE_FD_AD_DROP_B, action->drop_packet); + hnae3_set_bit(ad_data, HCLGE_FD_AD_DIRECT_QID_B, + action->forward_to_direct_queue); +- hnae3_set_field(ad_data, HCLGE_FD_AD_QID_M, HCLGE_FD_AD_QID_S, ++ hnae3_set_field(ad_data, HCLGE_FD_AD_QID_L_M, HCLGE_FD_AD_QID_L_S, + action->queue_id); + hnae3_set_bit(ad_data, HCLGE_FD_AD_USE_COUNTER_B, action->use_counter); + hnae3_set_field(ad_data, HCLGE_FD_AD_COUNTER_NUM_M, +-- +2.51.0 + diff --git a/queue-6.6/net-rds-clear-reconnect-pending-bit.patch b/queue-6.6/net-rds-clear-reconnect-pending-bit.patch new file mode 100644 index 00000000000..60d2eb80e63 --- /dev/null +++ b/queue-6.6/net-rds-clear-reconnect-pending-bit.patch @@ -0,0 +1,42 @@ +From a2b2efedce92716ec4f3e502f7a1c4825dc94cbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 22:57:20 -0700 +Subject: net/rds: Clear reconnect pending bit +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: HÃ¥kon Bugge + +[ Upstream commit b89fc7c2523b2b0750d91840f4e52521270d70ed ] + +When canceling the reconnect worker, care must be taken to reset the +reconnect-pending bit. If the reconnect worker has not yet been +scheduled before it is canceled, the reconnect-pending bit will stay +on forever. + +Signed-off-by: HÃ¥kon Bugge +Signed-off-by: Allison Henderson +Link: https://patch.msgid.link/20260203055723.1085751-6-achender@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/rds/connection.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/rds/connection.c b/net/rds/connection.c +index 00bda534b9ce2..98c0d5ff9de9c 100644 +--- a/net/rds/connection.c ++++ b/net/rds/connection.c +@@ -428,6 +428,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp) + * to the conn hash, so we never trigger a reconnect on this + * conn - the reconnect is always triggered by the active peer. */ + cancel_delayed_work_sync(&cp->cp_conn_w); ++ ++ clear_bit(RDS_RECONNECT_PENDING, &cp->cp_flags); + rcu_read_lock(); + if (!hlist_unhashed(&conn->c_hash_node)) { + rcu_read_unlock(); +-- +2.51.0 + diff --git a/queue-6.6/net-rds-no-shortcut-out-of-rds_conn_error.patch b/queue-6.6/net-rds-no-shortcut-out-of-rds_conn_error.patch new file mode 100644 index 00000000000..8e6f4cacb61 --- /dev/null +++ b/queue-6.6/net-rds-no-shortcut-out-of-rds_conn_error.patch @@ -0,0 +1,92 @@ +From e5e12a9e76a764ea1baa468c29f44e60a1f8eb7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jan 2026 22:52:12 -0700 +Subject: net/rds: No shortcut out of RDS_CONN_ERROR + +From: Gerd Rausch + +[ Upstream commit ad22d24be635c6beab6a1fdd3f8b1f3c478d15da ] + +RDS connections carry a state "rds_conn_path::cp_state" +and transitions from one state to another and are conditional +upon an expected state: "rds_conn_path_transition." + +There is one exception to this conditionality, which is +"RDS_CONN_ERROR" that can be enforced by "rds_conn_path_drop" +regardless of what state the condition is currently in. + +But as soon as a connection enters state "RDS_CONN_ERROR", +the connection handling code expects it to go through the +shutdown-path. + +The RDS/TCP multipath changes added a shortcut out of +"RDS_CONN_ERROR" straight back to "RDS_CONN_CONNECTING" +via "rds_tcp_accept_one_path" (e.g. after "rds_tcp_state_change"). + +A subsequent "rds_tcp_reset_callbacks" can then transition +the state to "RDS_CONN_RESETTING" with a shutdown-worker queued. + +That'll trip up "rds_conn_init_shutdown", which was +never adjusted to handle "RDS_CONN_RESETTING" and subsequently +drops the connection with the dreaded "DR_INV_CONN_STATE", +which leaves "RDS_SHUTDOWN_WORK_QUEUED" on forever. + +So we do two things here: + +a) Don't shortcut "RDS_CONN_ERROR", but take the longer + path through the shutdown code. + +b) Add "RDS_CONN_RESETTING" to the expected states in + "rds_conn_init_shutdown" so that we won't error out + and get stuck, if we ever hit weird state transitions + like this again." + +Signed-off-by: Gerd Rausch +Signed-off-by: Allison Henderson +Link: https://patch.msgid.link/20260122055213.83608-2-achender@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/rds/connection.c | 2 ++ + net/rds/tcp_listen.c | 5 ----- + 2 files changed, 2 insertions(+), 5 deletions(-) + +diff --git a/net/rds/connection.c b/net/rds/connection.c +index b4cc699c5fad3..00bda534b9ce2 100644 +--- a/net/rds/connection.c ++++ b/net/rds/connection.c +@@ -381,6 +381,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp) + if (!rds_conn_path_transition(cp, RDS_CONN_UP, + RDS_CONN_DISCONNECTING) && + !rds_conn_path_transition(cp, RDS_CONN_ERROR, ++ RDS_CONN_DISCONNECTING) && ++ !rds_conn_path_transition(cp, RDS_CONN_RESETTING, + RDS_CONN_DISCONNECTING)) { + rds_conn_path_error(cp, + "shutdown called in state %d\n", +diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c +index 53b3535a1e4a8..2e2f1a6750496 100644 +--- a/net/rds/tcp_listen.c ++++ b/net/rds/tcp_listen.c +@@ -59,9 +59,6 @@ void rds_tcp_keepalive(struct socket *sock) + * socket and force a reconneect from smaller -> larger ip addr. The reason + * we special case cp_index 0 is to allow the rds probe ping itself to itself + * get through efficiently. +- * Since reconnects are only initiated from the node with the numerically +- * smaller ip address, we recycle conns in RDS_CONN_ERROR on the passive side +- * by moving them to CONNECTING in this function. + */ + static + struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn) +@@ -86,8 +83,6 @@ struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn) + struct rds_conn_path *cp = &conn->c_path[i]; + + if (rds_conn_path_transition(cp, RDS_CONN_DOWN, +- RDS_CONN_CONNECTING) || +- rds_conn_path_transition(cp, RDS_CONN_ERROR, + RDS_CONN_CONNECTING)) { + return cp->cp_transport_data; + } +-- +2.51.0 + diff --git a/queue-6.6/net-usb-r8152-fix-transmit-queue-timeout.patch b/queue-6.6/net-usb-r8152-fix-transmit-queue-timeout.patch new file mode 100644 index 00000000000..7ad99c1b979 --- /dev/null +++ b/queue-6.6/net-usb-r8152-fix-transmit-queue-timeout.patch @@ -0,0 +1,42 @@ +From b0ff36ebc31034ade020c9cb3e892c67e97cf32b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 09:59:49 +0800 +Subject: net: usb: r8152: fix transmit queue timeout + +From: Mingj Ye + +[ Upstream commit 833dcd75d54f0bf5aa0a0781ff57456b421fbb40 ] + +When the TX queue length reaches the threshold, the netdev watchdog +immediately detects a TX queue timeout. + +This patch updates the trans_start timestamp of the transmit queue +on every asynchronous USB URB submission along the transmit path, +ensuring that the network watchdog accurately reflects ongoing +transmission activity. + +Signed-off-by: Mingj Ye +Reviewed-by: Hayes Wang +Link: https://patch.msgid.link/20260120015949.84996-1-insyelu@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 386376ceeda25..a2e3f9583def7 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -2445,6 +2445,8 @@ static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg) + ret = usb_submit_urb(agg->urb, GFP_ATOMIC); + if (ret < 0) + usb_autopm_put_interface_async(tp->intf); ++ else ++ netif_trans_update(tp->netdev); + + out_tx_fill: + return ret; +-- +2.51.0 + diff --git a/queue-6.6/net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch b/queue-6.6/net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch new file mode 100644 index 00000000000..e0a22d55888 --- /dev/null +++ b/queue-6.6/net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch @@ -0,0 +1,117 @@ +From b2be4e1c3e27a129524b20b2c6352f283f50d61a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 17:39:09 -0800 +Subject: net: usb: sr9700: remove code to drive nonexistent multicast filter + +From: Ethan Nelson-Moore + +[ Upstream commit 9a9424c756feee9ee6e717405a9d6fa7bacdef08 ] + +Several registers referenced in this driver's source code do not +actually exist (they are not writable and read as zero in my testing). +They exist in this driver because it originated as a copy of the dm9601 +driver. Notably, these include the multicast filter registers - this +causes the driver to not support multicast packets correctly. Remove +the multicast filter code and register definitions. Instead, set the +chip to receive all multicast filter packets when any multicast +addresses are in the list. + +Reviewed-by: Simon Horman (from v1) +Signed-off-by: Ethan Nelson-Moore +Link: https://patch.msgid.link/20260203013924.28582-1-enelsonmoore@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/Kconfig | 1 - + drivers/net/usb/sr9700.c | 25 ++++--------------------- + drivers/net/usb/sr9700.h | 7 +------ + 3 files changed, 5 insertions(+), 28 deletions(-) + +diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig +index 3fd7dccf0f9c9..fe9e8483e8c59 100644 +--- a/drivers/net/usb/Kconfig ++++ b/drivers/net/usb/Kconfig +@@ -320,7 +320,6 @@ config USB_NET_DM9601 + config USB_NET_SR9700 + tristate "CoreChip-sz SR9700 based USB 1.1 10/100 ethernet devices" + depends on USB_USBNET +- select CRC32 + help + This option adds support for CoreChip-sz SR9700 based USB 1.1 + 10/100 Ethernet adapters. +diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c +index 213b4817cfdf6..e4d7bcd0d99c2 100644 +--- a/drivers/net/usb/sr9700.c ++++ b/drivers/net/usb/sr9700.c +@@ -18,7 +18,6 @@ + #include + #include + #include +-#include + #include + + #include "sr9700.h" +@@ -265,31 +264,15 @@ static const struct ethtool_ops sr9700_ethtool_ops = { + static void sr9700_set_multicast(struct net_device *netdev) + { + struct usbnet *dev = netdev_priv(netdev); +- /* We use the 20 byte dev->data for our 8 byte filter buffer +- * to avoid allocating memory that is tricky to free later +- */ +- u8 *hashes = (u8 *)&dev->data; + /* rx_ctl setting : enable, disable_long, disable_crc */ + u8 rx_ctl = RCR_RXEN | RCR_DIS_CRC | RCR_DIS_LONG; + +- memset(hashes, 0x00, SR_MCAST_SIZE); +- /* broadcast address */ +- hashes[SR_MCAST_SIZE - 1] |= SR_MCAST_ADDR_FLAG; +- if (netdev->flags & IFF_PROMISC) { ++ if (netdev->flags & IFF_PROMISC) + rx_ctl |= RCR_PRMSC; +- } else if (netdev->flags & IFF_ALLMULTI || +- netdev_mc_count(netdev) > SR_MCAST_MAX) { +- rx_ctl |= RCR_RUNT; +- } else if (!netdev_mc_empty(netdev)) { +- struct netdev_hw_addr *ha; +- +- netdev_for_each_mc_addr(ha, netdev) { +- u32 crc = ether_crc(ETH_ALEN, ha->addr) >> 26; +- hashes[crc >> 3] |= 1 << (crc & 0x7); +- } +- } ++ else if (netdev->flags & IFF_ALLMULTI || !netdev_mc_empty(netdev)) ++ /* The chip has no multicast filter */ ++ rx_ctl |= RCR_ALL; + +- sr_write_async(dev, SR_MAR, SR_MCAST_SIZE, hashes); + sr_write_reg_async(dev, SR_RCR, rx_ctl); + } + +diff --git a/drivers/net/usb/sr9700.h b/drivers/net/usb/sr9700.h +index ea2b4de621c86..c479908f7d823 100644 +--- a/drivers/net/usb/sr9700.h ++++ b/drivers/net/usb/sr9700.h +@@ -104,9 +104,7 @@ + #define WCR_LINKEN (1 << 5) + /* Physical Address Reg */ + #define SR_PAR 0x10 /* 0x10 ~ 0x15 6 bytes for PAR */ +-/* Multicast Address Reg */ +-#define SR_MAR 0x16 /* 0x16 ~ 0x1D 8 bytes for MAR */ +-/* 0x1e unused */ ++/* 0x16 --> 0x1E unused */ + /* Phy Reset Reg */ + #define SR_PRR 0x1F + #define PRR_PHY_RST (1 << 0) +@@ -161,9 +159,6 @@ + /* parameters */ + #define SR_SHARE_TIMEOUT 1000 + #define SR_EEPROM_LEN 256 +-#define SR_MCAST_SIZE 8 +-#define SR_MCAST_ADDR_FLAG 0x80 +-#define SR_MCAST_MAX 64 + #define SR_TX_OVERHEAD 2 /* 2bytes header */ + #define SR_RX_OVERHEAD 7 /* 3bytes header + 4crc tail */ + +-- +2.51.0 + diff --git a/queue-6.6/netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch b/queue-6.6/netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch new file mode 100644 index 00000000000..1ad395d0738 --- /dev/null +++ b/queue-6.6/netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch @@ -0,0 +1,41 @@ +From 36c7a4950071ceaa30669b656f75d07ce74d490a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Dec 2025 20:53:51 +0900 +Subject: netfilter: nf_conntrack: Add allow_clash to generic protocol handler + +From: Yuto Hamaguchi + +[ Upstream commit 8a49fc8d8a3e83dc51ec05bcd4007bdea3c56eec ] + +The upstream commit, 71d8c47fc653711c41bc3282e5b0e605b3727956 + ("netfilter: conntrack: introduce clash resolution on insertion race"), +sets allow_clash=true in the UDP/UDPLITE protocol handler +but does not set it in the generic protocol handler. + +As a result, packets composed of connectionless protocols at each layer, +such as UDP over IP-in-IP, still drop packets due to conflicts during conntrack insertion. + +To resolve this, this patch sets allow_clash in the nf_conntrack_l4proto_generic. + +Signed-off-by: Yuto Hamaguchi +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_proto_generic.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c +index e831637bc8ca8..cb260eb3d012c 100644 +--- a/net/netfilter/nf_conntrack_proto_generic.c ++++ b/net/netfilter/nf_conntrack_proto_generic.c +@@ -67,6 +67,7 @@ void nf_conntrack_generic_init_net(struct net *net) + const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic = + { + .l4proto = 255, ++ .allow_clash = true, + #ifdef CONFIG_NF_CONNTRACK_TIMEOUT + .ctnl_timeout = { + .nlattr_to_obj = generic_timeout_nlattr_to_obj, +-- +2.51.0 + diff --git a/queue-6.6/netfilter-xt_tcpmss-check-remaining-length-before-re.patch b/queue-6.6/netfilter-xt_tcpmss-check-remaining-length-before-re.patch new file mode 100644 index 00000000000..c0c6371a181 --- /dev/null +++ b/queue-6.6/netfilter-xt_tcpmss-check-remaining-length-before-re.patch @@ -0,0 +1,42 @@ +From fcc78087507bbba7cc44c88d41006c29dfd9484d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 12:30:42 +0100 +Subject: netfilter: xt_tcpmss: check remaining length before reading optlen + +From: Florian Westphal + +[ Upstream commit 735ee8582da3d239eb0c7a53adca61b79fb228b3 ] + +Quoting reporter: + In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads + op[i+1] directly without validating the remaining option length. + + If the last byte of the option field is not EOL/NOP (0/1), the code attempts + to index op[i+1]. In the case where i + 1 == optlen, this causes an + out-of-bounds read, accessing memory past the optlen boundary + (either reading beyond the stack buffer _opt or the + following payload). + +Reported-by: sungzii +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/xt_tcpmss.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c +index 37704ab017992..0d32d4841cb32 100644 +--- a/net/netfilter/xt_tcpmss.c ++++ b/net/netfilter/xt_tcpmss.c +@@ -61,7 +61,7 @@ tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par) + return (mssval >= info->mss_min && + mssval <= info->mss_max) ^ info->invert; + } +- if (op[i] < 2) ++ if (op[i] < 2 || i == optlen - 1) + i++; + else + i += op[i+1] ? : 1; +-- +2.51.0 + diff --git a/queue-6.6/nfc-nxp-nci-remove-interrupt-trigger-type.patch b/queue-6.6/nfc-nxp-nci-remove-interrupt-trigger-type.patch new file mode 100644 index 00000000000..711091bcffa --- /dev/null +++ b/queue-6.6/nfc-nxp-nci-remove-interrupt-trigger-type.patch @@ -0,0 +1,42 @@ +From db93742bd3132c498d9ec8a15d7a27b1dc8be6a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Feb 2026 19:11:39 +0800 +Subject: nfc: nxp-nci: remove interrupt trigger type + +From: Carl Lee + +[ Upstream commit 57be33f85e369ce9f69f61eaa34734e0d3bd47a7 ] + +For NXP NCI devices (e.g. PN7150), the interrupt is level-triggered and +active high, not edge-triggered. + +Using IRQF_TRIGGER_RISING in the driver can cause interrupts to fail +to trigger correctly. + +Remove IRQF_TRIGGER_RISING and rely on the IRQ trigger type configured +via Device Tree. + +Signed-off-by: Carl Lee +Link: https://patch.msgid.link/20260205-fc-nxp-nci-remove-interrupt-trigger-type-v2-1-79d2ed4a7e42@amd.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/nfc/nxp-nci/i2c.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c +index 3ae4b41c59ac3..edf5514795fd0 100644 +--- a/drivers/nfc/nxp-nci/i2c.c ++++ b/drivers/nfc/nxp-nci/i2c.c +@@ -305,7 +305,7 @@ static int nxp_nci_i2c_probe(struct i2c_client *client) + + r = request_threaded_irq(client->irq, NULL, + nxp_nci_i2c_irq_thread_fn, +- IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ IRQF_ONESHOT, + NXP_NCI_I2C_DRIVER_NAME, phy); + if (r < 0) + nfc_err(&client->dev, "Unable to register IRQ handler\n"); +-- +2.51.0 + diff --git a/queue-6.6/ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch b/queue-6.6/ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch new file mode 100644 index 00000000000..23ca6755235 --- /dev/null +++ b/queue-6.6/ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch @@ -0,0 +1,40 @@ +From 2f6ca6c4fe96a26444aecfeca5b5d13ce9aab288 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2025 14:53:18 -0800 +Subject: ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access + +From: Maciej Grochowski + +[ Upstream commit c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface ] + +Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS, +This patch protects against invalid index out of bounds access to mw_sizes +When invalid access print message to user that configuration is not valid. + +Signed-off-by: Maciej Grochowski +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +index b5f93f07e22a4..c60adef1ba727 100644 +--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c ++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +@@ -1314,6 +1314,12 @@ static void switchtec_ntb_init_shared(struct switchtec_ntb *sndev) + for (i = 0; i < sndev->nr_lut_mw; i++) { + int idx = sndev->nr_direct_mw + i; + ++ if (idx >= MAX_MWS) { ++ dev_err(&sndev->stdev->dev, ++ "Total number of MW cannot be bigger than %d", MAX_MWS); ++ break; ++ } ++ + sndev->self_shared->mw_sizes[idx] = LUT_SIZE; + } + } +-- +2.51.0 + diff --git a/queue-6.6/ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch b/queue-6.6/ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch new file mode 100644 index 00000000000..0ca9e951eb2 --- /dev/null +++ b/queue-6.6/ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch @@ -0,0 +1,48 @@ +From 142c7f6eda6e0f3fbaa222b6133891f17bd11b50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2025 14:53:17 -0800 +Subject: ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut + +From: Maciej Grochowski + +[ Upstream commit 186615f8855a0be4ee7d3fcd09a8ecc10e783b08 ] + +Number of MW LUTs depends on NTB configuration and can be set to zero, +in such scenario rounddown_pow_of_two will cause undefined behaviour and +should not be performed. +This patch ensures that rounddown_pow_of_two is called on valid value. + +Signed-off-by: Maciej Grochowski +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +index c60adef1ba727..7f23f10ef64e4 100644 +--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c ++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +@@ -1202,7 +1202,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev) + sndev->mmio_self_ctrl); + + sndev->nr_lut_mw = ioread16(&sndev->mmio_self_ctrl->lut_table_entries); +- sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw); ++ if (sndev->nr_lut_mw) ++ sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw); + + dev_dbg(&sndev->stdev->dev, "MWs: %d direct, %d lut\n", + sndev->nr_direct_mw, sndev->nr_lut_mw); +@@ -1212,7 +1213,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev) + + sndev->peer_nr_lut_mw = + ioread16(&sndev->mmio_peer_ctrl->lut_table_entries); +- sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw); ++ if (sndev->peer_nr_lut_mw) ++ sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw); + + dev_dbg(&sndev->stdev->dev, "Peer MWs: %d direct, %d lut\n", + sndev->peer_nr_direct_mw, sndev->peer_nr_lut_mw); +-- +2.51.0 + diff --git a/queue-6.6/octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch b/queue-6.6/octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch new file mode 100644 index 00000000000..644afaa3f5a --- /dev/null +++ b/queue-6.6/octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch @@ -0,0 +1,69 @@ +From 2256bfdb47bfc505ca592f02752f501ce2190cc2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 18:21:47 +0530 +Subject: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geetha sowjanya + +[ Upstream commit 70e9a5760abfb6338d63994d4de6b0778ec795d6 ] + +NIX SQ manager sticky mode is known to cause stalls when multiple SQs +share an SMQ and transmit concurrently. Additionally, PSE may deadlock +on transitions between sticky and non-sticky transmissions. There is +also a credit drop issue observed when certain condition clocks are +gated. + +work around these hardware errata by: +- Disabling SQM sticky operation: + - Clear TM6 (bit 15) + - Clear TM11 (bit 14) +- Disabling sticky → non-sticky transition path that can deadlock PSE: + - Clear TM5 (bit 23) +- Preventing credit drops by keeping the control-flow clock enabled: + - Set TM9 (bit 21) + +These changes are applied via NIX_AF_SQM_DBG_CTL_STATUS. With this +configuration the SQM/PSE maintain forward progress under load without +credit loss, at the cost of disabling sticky optimizations. + +Signed-off-by: Geetha sowjanya +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260127125147.1642-1-gakula@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +index 29487518ca672..0703b0d8df783 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +@@ -4509,12 +4509,18 @@ static int rvu_nix_block_init(struct rvu *rvu, struct nix_hw *nix_hw) + /* Set chan/link to backpressure TL3 instead of TL2 */ + rvu_write64(rvu, blkaddr, NIX_AF_PSE_CHANNEL_LEVEL, 0x01); + +- /* Disable SQ manager's sticky mode operation (set TM6 = 0) ++ /* Disable SQ manager's sticky mode operation (set TM6 = 0, TM11 = 0) + * This sticky mode is known to cause SQ stalls when multiple +- * SQs are mapped to same SMQ and transmitting pkts at a time. ++ * SQs are mapped to same SMQ and transmitting pkts simultaneously. ++ * NIX PSE may deadlock when there are any sticky to non-sticky ++ * transmission. Hence disable it (TM5 = 0). + */ + cfg = rvu_read64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS); +- cfg &= ~BIT_ULL(15); ++ cfg &= ~(BIT_ULL(15) | BIT_ULL(14) | BIT_ULL(23)); ++ /* NIX may drop credits when condition clocks are turned off. ++ * Hence enable control flow clk (set TM9 = 1). ++ */ ++ cfg |= BIT_ULL(21); + rvu_write64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS, cfg); + + ltdefs = rvu->kpu.lt_def; +-- +2.51.0 + diff --git a/queue-6.6/openrisc-define-arch-specific-version-of-nop.patch b/queue-6.6/openrisc-define-arch-specific-version-of-nop.patch new file mode 100644 index 00000000000..41499b117f8 --- /dev/null +++ b/queue-6.6/openrisc-define-arch-specific-version-of-nop.patch @@ -0,0 +1,53 @@ +From 805154f0762008a9c942504a416584a096ff69e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 12:07:23 -0500 +Subject: openrisc: define arch-specific version of nop() + +From: Brian Masney + +[ Upstream commit 0dfffa5479d6260d04d021f69203b1926f73d889 ] + +When compiling a driver written for MIPS on OpenRISC that uses the nop() +function, it fails due to the following error: + + drivers/watchdog/pic32-wdt.c: Assembler messages: + drivers/watchdog/pic32-wdt.c:125: Error: unrecognized instruction `nop' + +The driver currently uses the generic version of nop() from +include/asm-generic/barrier.h: + + #ifndef nop + #define nop() asm volatile ("nop") + #endif + +Let's fix this on OpenRISC by defining an architecture-specific version +of nop(). + +This was tested by performing an allmodconfig openrisc cross compile on +an aarch64 host. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202601180236.BVy480We-lkp@intel.com/ +Signed-off-by: Brian Masney +Signed-off-by: Stafford Horne +Signed-off-by: Sasha Levin +--- + arch/openrisc/include/asm/barrier.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h +index 7538294721bed..8e592c9909023 100644 +--- a/arch/openrisc/include/asm/barrier.h ++++ b/arch/openrisc/include/asm/barrier.h +@@ -4,6 +4,8 @@ + + #define mb() asm volatile ("l.msync" ::: "memory") + ++#define nop() asm volatile ("l.nop") ++ + #include + + #endif /* __ASM_BARRIER_H */ +-- +2.51.0 + diff --git a/queue-6.6/parisc-prevent-interrupts-during-reboot.patch b/queue-6.6/parisc-prevent-interrupts-during-reboot.patch new file mode 100644 index 00000000000..35774147ea7 --- /dev/null +++ b/queue-6.6/parisc-prevent-interrupts-during-reboot.patch @@ -0,0 +1,32 @@ +From 0f93d584b5f65c2d59bfea042bfe6ef29221cf9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 17:58:55 +0100 +Subject: parisc: Prevent interrupts during reboot + +From: Helge Deller + +[ Upstream commit 35ac5a728c878594f2ea6c43b57652a16be3c968 ] + +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/kernel/process.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c +index ed93bd8c15453..d7b0f233f2cc9 100644 +--- a/arch/parisc/kernel/process.c ++++ b/arch/parisc/kernel/process.c +@@ -85,6 +85,9 @@ void machine_restart(char *cmd) + #endif + /* set up a new led state on systems shipped with a LED State panel */ + pdc_chassis_send_status(PDC_CHASSIS_DIRECT_SHUTDOWN); ++ ++ /* prevent interrupts during reboot */ ++ set_eiem(0); + + /* "Normal" system reset */ + pdc_do_reset(); +-- +2.51.0 + diff --git a/queue-6.6/pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch b/queue-6.6/pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch new file mode 100644 index 00000000000..deaabe8325a --- /dev/null +++ b/queue-6.6/pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch @@ -0,0 +1,41 @@ +From dcee68c345470ba045a2643b105e536806471358 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jan 2026 13:53:32 +0530 +Subject: PCI: Add ACS quirk for Qualcomm Hamoa & Glymur + +From: Krishna Chaitanya Chundru + +[ Upstream commit 44d2f70b1fd72c339c72983fcffa181beae3e113 ] + +The Qualcomm Hamoa & Glymur Root Ports don't advertise an ACS capability, +but they do provide ACS-like features to disable peer transactions and +validate bus numbers in requests. + +Add an ACS quirk for Hamoa & Glymur. + +Signed-off-by: Krishna Chaitanya Chundru +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20260109-acs_quirk-v1-1-82adf95a89ae@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 082facd11ddf3..ddfc48f894db6 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -5110,6 +5110,10 @@ static const struct pci_dev_acs_enabled { + { PCI_VENDOR_ID_QCOM, 0x0401, pci_quirk_qcom_rp_acs }, + /* QCOM SA8775P root port */ + { PCI_VENDOR_ID_QCOM, 0x0115, pci_quirk_qcom_rp_acs }, ++ /* QCOM Hamoa root port */ ++ { PCI_VENDOR_ID_QCOM, 0x0111, pci_quirk_qcom_rp_acs }, ++ /* QCOM Glymur root port */ ++ { PCI_VENDOR_ID_QCOM, 0x0120, pci_quirk_qcom_rp_acs }, + /* HXT SD4800 root ports. The ACS design is same as QCOM QDF2xxx */ + { PCI_VENDOR_ID_HXT, 0x0401, pci_quirk_qcom_rp_acs }, + /* Intel PCH root ports */ +-- +2.51.0 + diff --git a/queue-6.6/pci-dw-rockchip-disable-bar-0-and-bar-1-for-root-por.patch b/queue-6.6/pci-dw-rockchip-disable-bar-0-and-bar-1-for-root-por.patch new file mode 100644 index 00000000000..e70241b1566 --- /dev/null +++ b/queue-6.6/pci-dw-rockchip-disable-bar-0-and-bar-1-for-root-por.patch @@ -0,0 +1,74 @@ +From a8bd3c2682a380673b27b52e5f935cb73b706e7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Dec 2025 18:01:01 +0800 +Subject: PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port + +From: Shawn Lin + +[ Upstream commit b5d712e5b87fc56ff838684afb1bae359eb8069f ] + +Some Rockchip PCIe Root Ports report bogus size of 1GiB for the BAR +memories and they cause below resource allocation issue during probe. + + pci 0000:00:00.0: [1d87:3588] type 01 class 0x060400 PCIe Root Port + pci 0000:00:00.0: BAR 0 [mem 0x00000000-0x3fffffff] + pci 0000:00:00.0: BAR 1 [mem 0x00000000-0x3fffffff] + pci 0000:00:00.0: ROM [mem 0x00000000-0x0000ffff pref] + ... + pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: assigned + pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: can't assign; no space + pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: failed to assign + pci 0000:00:00.0: ROM [mem 0xf0200000-0xf020ffff pref]: assigned + pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: releasing + pci 0000:00:00.0: ROM [mem 0xf0200000-0xf020ffff pref]: releasing + pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: assigned + pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: can't assign; no space + pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: failed to assign + +Since there is no use of the Root Port BAR memories, disable both of them. + +Signed-off-by: Shawn Lin +[mani: reworded the description and comment] +Signed-off-by: Manivannan Sadhasivam +Link: https://patch.msgid.link/1766570461-138256-1-git-send-email-shawn.lin@rock-chips.com +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-dw-rockchip.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/pci/controller/dwc/pcie-dw-rockchip.c b/drivers/pci/controller/dwc/pcie-dw-rockchip.c +index 8af7a837a0612..615bb9b42c513 100644 +--- a/drivers/pci/controller/dwc/pcie-dw-rockchip.c ++++ b/drivers/pci/controller/dwc/pcie-dw-rockchip.c +@@ -48,6 +48,8 @@ + #define PCIE_LTSSM_ENABLE_ENHANCE BIT(4) + #define PCIE_LTSSM_STATUS_MASK GENMASK(5, 0) + ++#define PCIE_TYPE0_HDR_DBI2_OFFSET 0x100000 ++ + struct rockchip_pcie { + struct dw_pcie pci; + void __iomem *apb_base; +@@ -198,6 +200,8 @@ static int rockchip_pcie_host_init(struct dw_pcie_rp *pp) + if (irq < 0) + return irq; + ++ pci->dbi_base2 = pci->dbi_base + PCIE_TYPE0_HDR_DBI2_OFFSET; ++ + ret = rockchip_pcie_init_irq_domain(rockchip); + if (ret < 0) + dev_err(dev, "failed to init irq domain\n"); +@@ -211,6 +215,10 @@ static int rockchip_pcie_host_init(struct dw_pcie_rp *pp) + rockchip_pcie_writel_apb(rockchip, PCIE_CLIENT_RC_MODE, + PCIE_CLIENT_GENERAL_CONTROL); + ++ /* Disable Root Ports BAR0 and BAR1 as they report bogus size */ ++ dw_pcie_writel_dbi2(pci, PCI_BASE_ADDRESS_0, 0x0); ++ dw_pcie_writel_dbi2(pci, PCI_BASE_ADDRESS_1, 0x0); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.6/pci-enable-acs-after-configuring-iommu-for-of-platfo.patch b/queue-6.6/pci-enable-acs-after-configuring-iommu-for-of-platfo.patch new file mode 100644 index 00000000000..3a5f66c778f --- /dev/null +++ b/queue-6.6/pci-enable-acs-after-configuring-iommu-for-of-platfo.patch @@ -0,0 +1,136 @@ +From 9c5bdd4194fa9eed95b2ee7af8cb065934607cfa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jan 2026 21:04:47 +0530 +Subject: PCI: Enable ACS after configuring IOMMU for OF platforms + +From: Manivannan Sadhasivam + +[ Upstream commit c41e2fb67e26b04d919257875fa954aa5f6e392e ] + +Platform, ACPI, or IOMMU drivers call pci_request_acs(), which sets +'pci_acs_enable' to request that ACS be enabled for any devices enumerated +in the future. + +OF platforms called pci_enable_acs() for the first device before +of_iommu_configure() called pci_request_acs(), so ACS was never enabled for +that device (typically a Root Port). + +Call pci_enable_acs() later, from pci_dma_configure(), after +of_dma_configure() has had a chance to call pci_request_acs(). + +Here's the call path, showing the move of pci_enable_acs() from +pci_acs_init() to pci_dma_configure(), where it always happens after +pci_request_acs(): + + pci_device_add + pci_init_capabilities + pci_acs_init + - pci_enable_acs + - if (pci_acs_enable) <-- previous test + - ... + device_add + bus_notify(BUS_NOTIFY_ADD_DEVICE) + iommu_bus_notifier + iommu_probe_device + iommu_init_device + dev->bus->dma_configure + pci_dma_configure # pci_bus_type.dma_configure + of_dma_configure + of_iommu_configure + pci_request_acs + pci_acs_enable = 1 <-- set + + pci_enable_acs + + if (pci_acs_enable) <-- new test + + ... + bus_probe_device + device_initial_probe + ... + really_probe + dev->bus->dma_configure + pci_dma_configure # pci_bus_type.dma_configure + ... + pci_enable_acs + +Note that we will now call pci_enable_acs() twice for every device, first +from the iommu_probe_device() path and again from the really_probe() path. +Presumably that's not an issue since we also call dev->bus->dma_configure() +twice. + +For the ACPI platforms, pci_request_acs() is called during ACPI +initialization time itself, independent of the IOMMU framework. + +Signed-off-by: Manivannan Sadhasivam +[bhelgaas: commit log] +Signed-off-by: Bjorn Helgaas +Tested-by: Marek Szyprowski +Tested-by: Naresh Kamboju +Link: https://patch.msgid.link/20260102-pci_acs-v3-1-72280b94d288@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/pci/pci-driver.c | 8 ++++++++ + drivers/pci/pci.c | 10 +--------- + drivers/pci/pci.h | 1 + + 3 files changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c +index 8c941d6267a5c..b7a6d8a28fe93 100644 +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -1668,6 +1668,14 @@ static int pci_dma_configure(struct device *dev) + ret = acpi_dma_configure(dev, acpi_get_dma_attr(adev)); + } + ++ /* ++ * Attempt to enable ACS regardless of capability because some Root ++ * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have ++ * the standard ACS capability but still support ACS via those ++ * quirks. ++ */ ++ pci_enable_acs(to_pci_dev(dev)); ++ + pci_put_host_bridge_device(bridge); + + if (!ret && !driver->driver_managed_dma) { +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 4cce61a6aba0b..9730b58164270 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -986,7 +986,7 @@ static void pci_std_enable_acs(struct pci_dev *dev) + * pci_enable_acs - enable ACS if hardware support it + * @dev: the PCI device + */ +-static void pci_enable_acs(struct pci_dev *dev) ++void pci_enable_acs(struct pci_dev *dev) + { + if (!pci_acs_enable) + goto disable_acs_redir; +@@ -3761,14 +3761,6 @@ bool pci_acs_path_enabled(struct pci_dev *start, + void pci_acs_init(struct pci_dev *dev) + { + dev->acs_cap = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ACS); +- +- /* +- * Attempt to enable ACS regardless of capability because some Root +- * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have +- * the standard ACS capability but still support ACS via those +- * quirks. +- */ +- pci_enable_acs(dev); + } + + /** +diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h +index 24441a26be1e6..485f917641e11 100644 +--- a/drivers/pci/pci.h ++++ b/drivers/pci/pci.h +@@ -555,6 +555,7 @@ static inline resource_size_t pci_resource_alignment(struct pci_dev *dev, + } + + void pci_acs_init(struct pci_dev *dev); ++void pci_enable_acs(struct pci_dev *dev); + #ifdef CONFIG_PCI_QUIRKS + int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags); + int pci_dev_specific_enable_acs(struct pci_dev *dev); +-- +2.51.0 + diff --git a/queue-6.6/pci-fix-pci_slot_lock-device-locking.patch b/queue-6.6/pci-fix-pci_slot_lock-device-locking.patch new file mode 100644 index 00000000000..22f9a31799f --- /dev/null +++ b/queue-6.6/pci-fix-pci_slot_lock-device-locking.patch @@ -0,0 +1,97 @@ +From 771ea160f67de4398317174e4b0057d83eec67d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 08:59:51 -0800 +Subject: PCI: Fix pci_slot_lock () device locking + +From: Keith Busch + +[ Upstream commit 1f5e57c622b4dc9b8e7d291d560138d92cfbe5bf ] + +Like pci_bus_lock(), pci_slot_lock() needs to lock the bridge device to +prevent warnings like: + + pcieport 0000:e2:05.0: unlocked secondary bus reset via: pciehp_reset_slot+0x55/0xa0 + +Take and release the lock for the bridge providing the slot for the +lock/trylock and unlock routines. + +Signed-off-by: Keith Busch +Signed-off-by: Bjorn Helgaas +Reviewed-by: Dan Williams +Link: https://patch.msgid.link/20260130165953.751063-3-kbusch@meta.com +Signed-off-by: Sasha Levin +--- + drivers/pci/pci.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 2f6c5bf2ae2f5..4cce61a6aba0b 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -5793,10 +5793,9 @@ static int pci_bus_trylock(struct pci_bus *bus) + /* Do any devices on or below this slot prevent a bus reset? */ + static bool pci_slot_resettable(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; + +- if (slot->bus->self && +- (slot->bus->self->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET)) ++ if (bridge && (bridge->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET)) + return false; + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { +@@ -5813,7 +5812,10 @@ static bool pci_slot_resettable(struct pci_slot *slot) + /* Lock devices from the top of the tree down */ + static void pci_slot_lock(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; ++ ++ if (bridge) ++ pci_dev_lock(bridge); + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { + if (!dev->slot || dev->slot != slot) +@@ -5828,7 +5830,7 @@ static void pci_slot_lock(struct pci_slot *slot) + /* Unlock devices from the bottom of the tree up */ + static void pci_slot_unlock(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { + if (!dev->slot || dev->slot != slot) +@@ -5838,12 +5840,18 @@ static void pci_slot_unlock(struct pci_slot *slot) + else + pci_dev_unlock(dev); + } ++ ++ if (bridge) ++ pci_dev_unlock(bridge); + } + + /* Return 1 on successful lock, 0 on contention */ + static int pci_slot_trylock(struct pci_slot *slot) + { +- struct pci_dev *dev; ++ struct pci_dev *dev, *bridge = slot->bus->self; ++ ++ if (bridge && !pci_dev_trylock(bridge)) ++ return 0; + + list_for_each_entry(dev, &slot->bus->devices, bus_list) { + if (!dev->slot || dev->slot != slot) +@@ -5868,6 +5876,9 @@ static int pci_slot_trylock(struct pci_slot *slot) + else + pci_dev_unlock(dev); + } ++ ++ if (bridge) ++ pci_dev_unlock(bridge); + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.6/pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch b/queue-6.6/pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch new file mode 100644 index 00000000000..0a66f85147b --- /dev/null +++ b/queue-6.6/pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch @@ -0,0 +1,51 @@ +From 8ce4d48227b7bc909f4ec975fa85194222b7e1a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 17:02:08 -0700 +Subject: PCI: Mark ASM1164 SATA controller to avoid bus reset + +From: Alex Williamson + +[ Upstream commit beb2f81792a8a619e5122b6b24a374861309c54b ] + +User forums report issues when assigning ASM1164 SATA controllers to VMs, +especially in configurations with multiple controllers. Logs show the +device fails to retrain after bus reset. Reports suggest this is an issue +across multiple platforms. The device indicates support for PM reset, +therefore the device still has a viable function level reset mechanism. +The reporting user confirms the device is well behaved in this use case +with bus reset disabled. + +Reported-by: Patrick Bianchi +Link: https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/ +Signed-off-by: Alex Williamson +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20260109000211.398300-1-alex.williamson@nvidia.com +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index f89070b1379fe..082facd11ddf3 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3784,6 +3784,16 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_CAVIUM, 0xa100, quirk_no_bus_reset); + */ + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TI, 0xb005, quirk_no_bus_reset); + ++/* ++ * Reports from users making use of PCI device assignment with ASM1164 ++ * controllers indicate an issue with bus reset where the device fails to ++ * retrain. The issue appears more common in configurations with multiple ++ * controllers. The device does indicate PM reset support (NoSoftRst-), ++ * therefore this still leaves a viable reset method. ++ * https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/ ++ */ ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ASMEDIA, 0x1164, quirk_no_bus_reset); ++ + static void quirk_no_pm_reset(struct pci_dev *dev) + { + /* +-- +2.51.0 + diff --git a/queue-6.6/pci-mark-nvidia-gb10-to-avoid-bus-reset.patch b/queue-6.6/pci-mark-nvidia-gb10-to-avoid-bus-reset.patch new file mode 100644 index 00000000000..5d3f7023d9d --- /dev/null +++ b/queue-6.6/pci-mark-nvidia-gb10-to-avoid-bus-reset.patch @@ -0,0 +1,47 @@ +From 41193f9b974e472e5280ae221319ebc66db43a5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Nov 2025 16:44:06 +0800 +Subject: PCI: Mark Nvidia GB10 to avoid bus reset + +From: Johnny-CC Chang + +[ Upstream commit c81a2ce6b6a844d1a57d2a69833a9d0f00403f00 ] + +After asserting Secondary Bus Reset to downstream devices via a GB10 Root +Port, the link may not retrain correctly, e.g., the link may retrain with a +lower lane count or config accesses to downstream devices may fail. + +Prevent use of Secondary Bus Reset for devices below GB10. + +Signed-off-by: Johnny-CC Chang +[bhelgaas: drop pci_ids.h update (only used once), update commit log] +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Link: https://patch.msgid.link/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index ddfc48f894db6..cab4cdbb31387 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3741,6 +3741,14 @@ static void quirk_no_bus_reset(struct pci_dev *dev) + dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET; + } + ++/* ++ * After asserting Secondary Bus Reset to downstream devices via a GB10 ++ * Root Port, the link may not retrain correctly. ++ * https://lore.kernel.org/r/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com ++ */ ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22CE, quirk_no_bus_reset); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22D0, quirk_no_bus_reset); ++ + /* + * Some NVIDIA GPU devices do not work with bus reset, SBR needs to be + * prevented for those affected devices. +-- +2.51.0 + diff --git a/queue-6.6/pci-msi-unmap-msi-x-region-on-error.patch b/queue-6.6/pci-msi-unmap-msi-x-region-on-error.patch new file mode 100644 index 00000000000..d7b7a37a347 --- /dev/null +++ b/queue-6.6/pci-msi-unmap-msi-x-region-on-error.patch @@ -0,0 +1,49 @@ +From 1c9e931ff0df57c4d33d8897dac3137ca7a1e290 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 22:44:52 +0800 +Subject: PCI/MSI: Unmap MSI-X region on error + +From: Haoxiang Li + +[ Upstream commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202 ] + +msix_capability_init() fails to unmap the MSI-X region if +msix_setup_interrupts() fails. + +Add the missing iounmap() for that error path. + +[ tglx: Massaged change log ] + +Signed-off-by: Haoxiang Li +Signed-off-by: Thomas Gleixner +Link: https://patch.msgid.link/20260125144452.2103812-1-lihaoxiang@isrc.iscas.ac.cn +Signed-off-by: Sasha Levin +--- + drivers/pci/msi/msi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c +index b638731aa5ff2..f6f4a778a9867 100644 +--- a/drivers/pci/msi/msi.c ++++ b/drivers/pci/msi/msi.c +@@ -737,7 +737,7 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries, + + ret = msix_setup_interrupts(dev, entries, nvec, affd); + if (ret) +- goto out_disable; ++ goto out_unmap; + + /* Disable INTX */ + pci_intx_for_msi(dev, 0); +@@ -756,6 +756,8 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries, + pcibios_free_irq(dev); + return 0; + ++out_unmap: ++ iounmap(dev->msix_base); + out_disable: + dev->msix_enabled = 0; + pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL | PCI_MSIX_FLAGS_ENABLE, 0); +-- +2.51.0 + diff --git a/queue-6.6/perf-arm-cmn-support-cmn-600ae.patch b/queue-6.6/perf-arm-cmn-support-cmn-600ae.patch new file mode 100644 index 00000000000..fc8f37490f6 --- /dev/null +++ b/queue-6.6/perf-arm-cmn-support-cmn-600ae.patch @@ -0,0 +1,50 @@ +From 14c105323409829f3ab5b1aa7809b0a58ce4f2c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 16:39:54 +0000 +Subject: perf/arm-cmn: Support CMN-600AE + +From: Robin Murphy + +[ Upstream commit 12a94953c37e834c3eabb839ce057094946fe67a ] + +The functional safety features of CMN-600AE have little to no impact on +the PMU relative to the base CMN-600 design, so for simplicity we can +reasonably just treat it as the same thing. The only obvious difference +is that the revision numbers aren't aligned, so we may hide some aliases +for events which do actually exist, but those can still be specified via +the underlying "type,eventid" format so it's not too big a deal. + +Signed-off-by: Robin Murphy +Reviewed-by: Ilkka Koskinen +Tested-by: Michal Simek +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm-cmn.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c +index 77aa37de59880..be02b00a70610 100644 +--- a/drivers/perf/arm-cmn.c ++++ b/drivers/perf/arm-cmn.c +@@ -205,6 +205,7 @@ enum cmn_model { + enum cmn_part { + PART_CMN600 = 0x434, + PART_CMN650 = 0x436, ++ PART_CMN600AE = 0x438, + PART_CMN700 = 0x43c, + PART_CI700 = 0x43a, + }; +@@ -2167,6 +2168,9 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset) + reg = readq_relaxed(cfg_region + CMN_CFGM_PERIPH_ID_01); + part = FIELD_GET(CMN_CFGM_PID0_PART_0, reg); + part |= FIELD_GET(CMN_CFGM_PID1_PART_1, reg) << 8; ++ /* 600AE is close enough that it's not really worth more complexity */ ++ if (part == PART_CMN600AE) ++ part = PART_CMN600; + if (cmn->part && cmn->part != part) + dev_warn(cmn->dev, + "Firmware binding mismatch: expected part number 0x%x, found 0x%x\n", +-- +2.51.0 + diff --git a/queue-6.6/perf-callchain-fix-srcline-printing-with-inlines.patch b/queue-6.6/perf-callchain-fix-srcline-printing-with-inlines.patch new file mode 100644 index 00000000000..c083793e6ad --- /dev/null +++ b/queue-6.6/perf-callchain-fix-srcline-printing-with-inlines.patch @@ -0,0 +1,55 @@ +From d00cc8050475ff91e90e56e3e89253c088da7d5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 20:13:36 -0800 +Subject: perf callchain: Fix srcline printing with inlines + +From: Ian Rogers + +[ Upstream commit abec464767b5d26f0612250d511c18f420826ca1 ] + +sample__fprintf_callchain() was using map__fprintf_srcline() which won't +report inline line numbers. + +Fix by using the srcline from the callchain and falling back to the map +variant. + +Fixes: 25da4fab5f66e659 ("perf evsel: Move fprintf methods to separate source file") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Stephen Brennan +Cc: Tony Jones +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/evsel_fprintf.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/evsel_fprintf.c b/tools/perf/util/evsel_fprintf.c +index 8719b3cb56466..99310f8423967 100644 +--- a/tools/perf/util/evsel_fprintf.c ++++ b/tools/perf/util/evsel_fprintf.c +@@ -181,8 +181,12 @@ int sample__fprintf_callchain(struct perf_sample *sample, int left_alignment, + if (print_dso && (!sym || !sym->inlined)) + printed += map__fprintf_dsoname_dsoff(map, print_dsoff, addr, fp); + +- if (print_srcline) +- printed += map__fprintf_srcline(map, addr, "\n ", fp); ++ if (print_srcline) { ++ if (node->srcline) ++ printed += fprintf(fp, "\n %s", node->srcline); ++ else ++ printed += map__fprintf_srcline(map, addr, "\n ", fp); ++ } + + if (sym && sym->inlined) + printed += fprintf(fp, " (inlined)"); +-- +2.51.0 + diff --git a/queue-6.6/perf-cxlpmu-replace-irqf_oneshot-with-irqf_no_thread.patch b/queue-6.6/perf-cxlpmu-replace-irqf_oneshot-with-irqf_no_thread.patch new file mode 100644 index 00000000000..d901132161b --- /dev/null +++ b/queue-6.6/perf-cxlpmu-replace-irqf_oneshot-with-irqf_no_thread.patch @@ -0,0 +1,44 @@ +From 7752794dca43c722c35dd4bb754802f3c975e2f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 10:55:34 +0100 +Subject: perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD + +From: Sebastian Andrzej Siewior + +[ Upstream commit ab26d9c85554c4ff1d95ca8341522880ed9219d6 ] + +Passing IRQF_ONESHOT ensures that the interrupt source is masked until +the secondary (threaded) handler is done. If only a primary handler is +used then the flag makes no sense because the interrupt can not fire +(again) while its handler is running. +The flag also disallows force-threading of the primary handler and the +irq-core will warn about this. + +The intention here was probably not allowing forced-threading. + +Replace IRQF_ONESHOT with IRQF_NO_THREAD. + +Reviewed-by: Jonathan Cameron +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/cxl_pmu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/perf/cxl_pmu.c b/drivers/perf/cxl_pmu.c +index c03df0f528898..3e1a4f9006119 100644 +--- a/drivers/perf/cxl_pmu.c ++++ b/drivers/perf/cxl_pmu.c +@@ -885,7 +885,7 @@ static int cxl_pmu_probe(struct device *dev) + if (!irq_name) + return -ENOMEM; + +- rc = devm_request_irq(dev, irq, cxl_pmu_irq, IRQF_SHARED | IRQF_ONESHOT, ++ rc = devm_request_irq(dev, irq, cxl_pmu_irq, IRQF_SHARED | IRQF_NO_THREAD, + irq_name, info); + if (rc) + return rc; +-- +2.51.0 + diff --git a/queue-6.6/perf-test-stat-tests-fix-for-virtualized-machines.patch b/queue-6.6/perf-test-stat-tests-fix-for-virtualized-machines.patch new file mode 100644 index 00000000000..807971ed8c4 --- /dev/null +++ b/queue-6.6/perf-test-stat-tests-fix-for-virtualized-machines.patch @@ -0,0 +1,80 @@ +From 1e8d937529e16c3180cf584567eb9873ad64c369 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 14:32:16 +0100 +Subject: perf test stat tests: Fix for virtualized machines + +From: Thomas Richter + +[ Upstream commit e272628902c1c96731e2d9f62a7fc77767686eb0 ] + +On s390 'perf test's 'perf stat tests', subtest test_hybrid fails for +z/VM systems. The root cause is this statement: + + $(perf stat -a -- sleep 0.1 2>&1 |\ + grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* -c) + +The 'perf stat' output on a s390 z/VM system is + + # perf stat -a -- sleep 0.1 2>&1 + Performance counter stats for 'system wide': + + 56 context-switches # 46.3 cs/sec cs_per_second + 1,210.41 msec cpu-clock # 11.9 CPUs CPUs_utilized + 12 cpu-migrations # 9.9 migrations/sec ... + 81 page-faults # 66.9 faults/sec ... + + 0.100891009 seconds time elapsed + +The grep command does not match any single line and exits with error +code 1. + +As the bash script is executed with 'set -e', it aborts with the first +error code being non-zero. + +Fix this and use 'wc -l' to count matching lines instead of 'grep ... -c'. + +Output before: + + # perf test 102 + 102: perf stat tests : FAILED! + # + +Output after: + + # perf test 102 + 102: perf stat tests : Ok + # + +Fixes: bb6e7cb11d97ce19 ("perf tools: Add fallback for exclude_guest") +Reviewed-by: Ian Rogers +Reviewed-by: James Clark +Signed-off-by: Thomas Richter +Cc: Alexander Gordeev +Cc: Heiko Carstens +Cc: Jan Polensky +Cc: linux-s390@vger.kernel.org +Cc: Namhyung Kim +Cc: Sumanth Korikkar +Cc: Vasily Gorbik +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/stat.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh +index a20bf3bdcb9f8..a76ccf2deb563 100755 +--- a/tools/perf/tests/shell/stat.sh ++++ b/tools/perf/tests/shell/stat.sh +@@ -159,7 +159,7 @@ test_hybrid() { + fi + + # Run default Perf stat +- cycles_events=$(perf stat -a -- sleep 0.1 2>&1 | grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* " -c) ++ cycles_events=$(perf stat -a -- sleep 0.1 2>&1 | grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* " | wc -l) + + # The expectation is that default output will have a cycles events on each + # hybrid PMU. In situations with no cycles PMU events, like virtualized, this +-- +2.51.0 + diff --git a/queue-6.6/perf-test-stat-update-test-expectations-and-events.patch b/queue-6.6/perf-test-stat-update-test-expectations-and-events.patch new file mode 100644 index 00000000000..cd1a7f41776 --- /dev/null +++ b/queue-6.6/perf-test-stat-update-test-expectations-and-events.patch @@ -0,0 +1,58 @@ +From 6cadf744a4b2926ba13754cca58f3cc4a4685f49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Nov 2025 13:22:04 -0800 +Subject: perf test stat: Update test expectations and events + +From: Ian Rogers + +[ Upstream commit a48cd551d7436be3b1bd65c63a6d00163f7e7706 ] + +test_stat_record_report and test_stat_record_script used default +output which triggers a bug when sending metrics. As this isn't +relevant to the test switch to using named software events. + +Update the match in test_hybrid as the cycles event is now cpu-cycles +to workaround potential ARM issues. + +Signed-off-by: Ian Rogers +Signed-off-by: Namhyung Kim +Stable-dep-of: e272628902c1 ("perf test stat tests: Fix for virtualized machines") +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/stat.sh | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh +index 62f13dfeae8e4..a20bf3bdcb9f8 100755 +--- a/tools/perf/tests/shell/stat.sh ++++ b/tools/perf/tests/shell/stat.sh +@@ -18,7 +18,7 @@ test_default_stat() { + + test_stat_record_report() { + echo "stat record and report test" +- if ! perf stat record -o - true | perf stat report -i - 2>&1 | \ ++ if ! perf stat record -e task-clock -o - true | perf stat report -i - 2>&1 | \ + grep -E -q "Performance counter stats for 'pipe':" + then + echo "stat record and report test [Failed]" +@@ -30,7 +30,7 @@ test_stat_record_report() { + + test_stat_record_script() { + echo "stat record and script test" +- if ! perf stat record -o - true | perf script -i - 2>&1 | \ ++ if ! perf stat record -e task-clock -o - true | perf script -i - 2>&1 | \ + grep -E -q "CPU[[:space:]]+THREAD[[:space:]]+VAL[[:space:]]+ENA[[:space:]]+RUN[[:space:]]+TIME[[:space:]]+EVENT" + then + echo "stat record and script test [Failed]" +@@ -159,7 +159,7 @@ test_hybrid() { + fi + + # Run default Perf stat +- cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/[uH]*| cycles[:uH]* " -c) ++ cycles_events=$(perf stat -a -- sleep 0.1 2>&1 | grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* " -c) + + # The expectation is that default output will have a cycles events on each + # hybrid PMU. In situations with no cycles PMU events, like virtualized, this +-- +2.51.0 + diff --git a/queue-6.6/perf-unwind-libdw-fix-invalid-reference-counts.patch b/queue-6.6/perf-unwind-libdw-fix-invalid-reference-counts.patch new file mode 100644 index 00000000000..32be1384302 --- /dev/null +++ b/queue-6.6/perf-unwind-libdw-fix-invalid-reference-counts.patch @@ -0,0 +1,59 @@ +From 6bd2026706308e15070a5af86679aced18520457 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 20:13:32 -0800 +Subject: perf unwind-libdw: Fix invalid reference counts + +From: Ian Rogers + +[ Upstream commit f815fc0c66e777c727689666cfb46b8d461c2f99 ] + +The addition of addr_location__exit() causes use-after put on the maps +and map references in the unwind info. Add the gets and then add the +map_symbol__exit() calls. + +Fixes: 0dd5041c9a0eaf8c ("perf addr_location: Add init/exit/copy functions") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Stephen Brennan +Cc: Tony Jones +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/unwind-libdw.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c +index 6013335a8daea..bd027fdf6af17 100644 +--- a/tools/perf/util/unwind-libdw.c ++++ b/tools/perf/util/unwind-libdw.c +@@ -133,8 +133,8 @@ static int entry(u64 ip, struct unwind_info *ui) + } + + e->ip = ip; +- e->ms.maps = al.maps; +- e->ms.map = al.map; ++ e->ms.maps = maps__get(al.maps); ++ e->ms.map = map__get(al.map); + e->ms.sym = al.sym; + + pr_debug("unwind: %s:ip = 0x%" PRIx64 " (0x%" PRIx64 ")\n", +@@ -319,6 +319,9 @@ int unwind__get_entries(unwind_entry_cb_t cb, void *arg, + if (err) + pr_debug("unwind: failed with '%s'\n", dwfl_errmsg(-1)); + ++ for (i = 0; i < ui->idx; i++) ++ map_symbol__exit(&ui->entries[i].ms); ++ + dwfl_end(ui->dwfl); + free(ui); + return 0; +-- +2.51.0 + diff --git a/queue-6.6/phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch b/queue-6.6/phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch new file mode 100644 index 00000000000..0f6289c91ea --- /dev/null +++ b/queue-6.6/phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch @@ -0,0 +1,38 @@ +From f1de4c9506267e5fb53ed319e2b8a37776a0831c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 19:17:12 +0800 +Subject: phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature + +From: Xu Yang + +[ Upstream commit 27ee0869d77b2cb404770ac49bdceae3aedf658b ] + +Disabling PHYs in runtime usually causes the client with external abort +exception or similar issue due to lack of API to notify clients about PHY +removal. This patch removes the possibility to unbind i.MX PHY drivers in +runtime. + +Signed-off-by: Xu Yang +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20260120111712.3159782-1-xu.yang_2@nxp.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c +index 043063699e064..41194083e358c 100644 +--- a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c ++++ b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c +@@ -411,6 +411,7 @@ static struct platform_driver imx8mq_usb_phy_driver = { + .driver = { + .name = "imx8mq-usb-phy", + .of_match_table = imx8mq_usb_phy_of_match, ++ .suppress_bind_attrs = true, + } + }; + module_platform_driver(imx8mq_usb_phy_driver); +-- +2.51.0 + diff --git a/queue-6.6/phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch b/queue-6.6/phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch new file mode 100644 index 00000000000..e8669a4b019 --- /dev/null +++ b/queue-6.6/phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch @@ -0,0 +1,43 @@ +From 0baec6bff3b5a39f68cac85470d11bf0d47dcc93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jan 2026 15:06:43 +0000 +Subject: phy: mvebu-cp110-utmi: fix dr_mode property read from dts + +From: Aleksandar Gerasimovski + +[ Upstream commit e2ce913452ab56b3330539cc443b97b7ea8c3a1a ] + +The problem with the current implementation is that it does not consider +that the USB controller can have multiple PHY handles with different +arguments count, as for example we have in our cn9131 based platform: +"phys = <&cp0_comphy1 0>, <&cp0_utmi0>;". + +In such case calling "of_usb_get_dr_mode_by_phy" with -1 (no phy-cells) +leads to not proper phy detection, taking the "marvell,cp110-utmi-phy" +dts definition we can call the "of_usb_get_dr_mode_by_phy" with 0 +(#phy-cells = <0>) and safely look for that phy. + +Signed-off-by: Aleksandar Gerasimovski +Link: https://patch.msgid.link/20260106150643.922110-1-aleksandar.gerasimovski@belden.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/marvell/phy-mvebu-cp110-utmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c +index 4922a5f3327d5..30391d0d7d4b4 100644 +--- a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c ++++ b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c +@@ -326,7 +326,7 @@ static int mvebu_cp110_utmi_phy_probe(struct platform_device *pdev) + return -ENOMEM; + } + +- port->dr_mode = of_usb_get_dr_mode_by_phy(child, -1); ++ port->dr_mode = of_usb_get_dr_mode_by_phy(child, 0); + if ((port->dr_mode != USB_DR_MODE_HOST) && + (port->dr_mode != USB_DR_MODE_PERIPHERAL)) { + dev_err(&pdev->dev, +-- +2.51.0 + diff --git a/queue-6.6/pstore-ram_core-fix-incorrect-success-return-when-vm.patch b/queue-6.6/pstore-ram_core-fix-incorrect-success-return-when-vm.patch new file mode 100644 index 00000000000..8ee845c8cdd --- /dev/null +++ b/queue-6.6/pstore-ram_core-fix-incorrect-success-return-when-vm.patch @@ -0,0 +1,49 @@ +From 411723637ee4b5200a6dacff905beea3bfcdc13f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 10:03:58 +0800 +Subject: pstore: ram_core: fix incorrect success return when vmap() fails + +From: Ruipeng Qi + +[ Upstream commit 05363abc7625cf18c96e67f50673cd07f11da5e9 ] + +In persistent_ram_vmap(), vmap() may return NULL on failure. + +If offset is non-zero, adding offset_in_page(start) causes the function +to return a non-NULL pointer even though the mapping failed. +persistent_ram_buffer_map() therefore incorrectly returns success. + +Subsequent access to prz->buffer may dereference an invalid address +and cause crashes. + +Add proper NULL checking for vmap() failures. + +Signed-off-by: Ruipeng Qi +Link: https://patch.msgid.link/20260203020358.3315299-1-ruipengqi3@gmail.com +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + fs/pstore/ram_core.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c +index c9eaacdec37e4..7b6d6378a3b87 100644 +--- a/fs/pstore/ram_core.c ++++ b/fs/pstore/ram_core.c +@@ -457,6 +457,13 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size, + vaddr = vmap(pages, page_count, VM_MAP | VM_IOREMAP, prot); + kfree(pages); + ++ /* ++ * vmap() may fail and return NULL. Do not add the offset in this ++ * case, otherwise a NULL mapping would appear successful. ++ */ ++ if (!vaddr) ++ return NULL; ++ + /* + * Since vmap() uses page granularity, we must add the offset + * into the page here, to get the byte granularity address +-- +2.51.0 + diff --git a/queue-6.6/rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch b/queue-6.6/rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch new file mode 100644 index 00000000000..3178312e706 --- /dev/null +++ b/queue-6.6/rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch @@ -0,0 +1,47 @@ +From a4602585630abd4bb57ae3a307c506b04742a7eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jan 2026 17:15:16 +0100 +Subject: RDMA/rtrs-clt: For conn rejection use actual err number + +From: Md Haris Iqbal + +[ Upstream commit fc290630702b530c2969061e7ef0d869a5b6dc4f ] + +When the connection establishment request is rejected from the server +side, then the actual error number sent back should be used. + +Signed-off-by: Md Haris Iqbal +Link: https://patch.msgid.link/20260107161517.56357-10-haris.iqbal@ionos.com +Reviewed-by: Grzegorz Prajsner +Reviewed-by: Jack Wang +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +index eaf911e2ffa9f..1af2ee8c8ed5e 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +@@ -1922,7 +1922,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con, + struct rtrs_path *s = con->c.path; + const struct rtrs_msg_conn_rsp *msg; + const char *rej_msg; +- int status, errno; ++ int status, errno = -ECONNRESET; + u8 data_len; + + status = ev->status; +@@ -1944,7 +1944,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con, + status, rej_msg); + } + +- return -ECONNRESET; ++ return errno; + } + + void rtrs_clt_close_conns(struct rtrs_clt_path *clt_path, bool wait) +-- +2.51.0 + diff --git a/queue-6.6/remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch b/queue-6.6/remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch new file mode 100644 index 00000000000..45897d7c972 --- /dev/null +++ b/queue-6.6/remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch @@ -0,0 +1,51 @@ +From 8b6713c6f0c8151f2cb7ce70959ce18f581217c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Dec 2025 14:28:23 +0200 +Subject: remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox + TX channel is uninitialized + +From: Iuliana Prodan + +[ Upstream commit d62e0e92e589c53c4320ed5914af5fe103f5ce7e ] + +Firmwares that do not use mailbox communication (e.g., the hello_world +sample) leave priv->tx_ch as NULL. The current suspend logic +unconditionally sends RP_MBOX_SUSPEND_SYSTEM, which is invalid without +an initialized TX channel. + +Detect the no_mailboxes case early and skip sending the suspend +message. Instead, proceed directly to the runtime PM suspend path, +which is the correct behavior for firmwares that cannot respond to +mailbox requests. + +Signed-off-by: Iuliana Prodan +Link: https://lore.kernel.org/r/20251204122825.756106-1-iuliana.prodan@oss.nxp.com +Signed-off-by: Mathieu Poirier +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/imx_dsp_rproc.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/remoteproc/imx_dsp_rproc.c b/drivers/remoteproc/imx_dsp_rproc.c +index 8fcda9b745459..960fbd4b1d9b9 100644 +--- a/drivers/remoteproc/imx_dsp_rproc.c ++++ b/drivers/remoteproc/imx_dsp_rproc.c +@@ -1250,6 +1250,15 @@ static int imx_dsp_suspend(struct device *dev) + if (rproc->state != RPROC_RUNNING) + goto out; + ++ /* ++ * No channel available for sending messages; ++ * indicates no mailboxes present, so trigger PM runtime suspend ++ */ ++ if (!priv->tx_ch) { ++ dev_dbg(dev, "No initialized mbox tx channel, suspend directly.\n"); ++ goto out; ++ } ++ + reinit_completion(&priv->pm_comp); + + /* Tell DSP that suspend is happening */ +-- +2.51.0 + diff --git a/queue-6.6/remoteproc-mediatek-break-lock-dependency-to-prepare.patch b/queue-6.6/remoteproc-mediatek-break-lock-dependency-to-prepare.patch new file mode 100644 index 00000000000..20ff6101c1a --- /dev/null +++ b/queue-6.6/remoteproc-mediatek-break-lock-dependency-to-prepare.patch @@ -0,0 +1,261 @@ +From 0aae9d10b74295142f3c414ed8df63e67808713d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 11:07:55 +0000 +Subject: remoteproc: mediatek: Break lock dependency to `prepare_lock` + +From: Tzung-Bi Shih + +[ Upstream commit d935187cfb27fc4168f78f3959aef4eafaae76bb ] + +A potential circular locking dependency (ABBA deadlock) exists between +`ec_dev->lock` and the clock framework's `prepare_lock`. + +The first order (A -> B) occurs when scp_ipi_send() is called while +`ec_dev->lock` is held (e.g., within cros_ec_cmd_xfer()): +1. cros_ec_cmd_xfer() acquires `ec_dev->lock` and calls scp_ipi_send(). +2. scp_ipi_send() calls clk_prepare_enable(), which acquires + `prepare_lock`. +See #0 in the following example calling trace. +(Lock Order: `ec_dev->lock` -> `prepare_lock`) + +The reverse order (B -> A) is more complex and has been observed +(learned) by lockdep. It involves the clock prepare operation +triggering power domain changes, which then propagates through sysfs +and power supply uevents, eventually calling back into the ChromeOS EC +driver and attempting to acquire `ec_dev->lock`: +1. Something calls clk_prepare(), which acquires `prepare_lock`. It + then triggers genpd operations like genpd_runtime_resume(), which + takes `&genpd->mlock`. +2. Power domain changes can trigger regulator changes; regulator + changes can then trigger device link changes; device link changes + can then trigger sysfs changes. Eventually, power_supply_uevent() + is called. +3. This leads to calls like cros_usbpd_charger_get_prop(), which calls + cros_ec_cmd_xfer_status(), which then attempts to acquire + `ec_dev->lock`. +See #1 ~ #6 in the following example calling trace. +(Lock Order: `prepare_lock` -> `&genpd->mlock` -> ... -> `&ec_dev->lock`) + +Move the clk_prepare()/clk_unprepare() operations for `scp->clk` to the +remoteproc prepare()/unprepare() callbacks. This ensures `prepare_lock` +is only acquired in prepare()/unprepare() callbacks. Since +`ec_dev->lock` is not involved in the callbacks, the dependency loop is +broken. + +This means the clock is always "prepared" when the SCP is running. The +prolonged "prepared time" for the clock should be acceptable as SCP is +designed to be a very power efficient processor. The power consumption +impact can be negligible. + +A simplified calling trace reported by lockdep: +> -> #6 (&ec_dev->lock) +> cros_ec_cmd_xfer +> cros_ec_cmd_xfer_status +> cros_usbpd_charger_get_port_status +> cros_usbpd_charger_get_prop +> power_supply_get_property +> power_supply_show_property +> power_supply_uevent +> dev_uevent +> uevent_show +> dev_attr_show +> sysfs_kf_seq_show +> kernfs_seq_show +> -> #5 (kn->active#2) +> kernfs_drain +> __kernfs_remove +> kernfs_remove_by_name_ns +> sysfs_remove_file_ns +> device_del +> __device_link_del +> device_links_driver_bound +> -> #4 (device_links_lock) +> device_link_remove +> _regulator_put +> regulator_put +> -> #3 (regulator_list_mutex) +> regulator_lock_dependent +> regulator_disable +> scpsys_power_off +> _genpd_power_off +> genpd_power_off +> -> #2 (&genpd->mlock/1) +> genpd_add_subdomain +> pm_genpd_add_subdomain +> scpsys_add_subdomain +> scpsys_probe +> -> #1 (&genpd->mlock) +> genpd_runtime_resume +> __rpm_callback +> rpm_callback +> rpm_resume +> __pm_runtime_resume +> clk_core_prepare +> clk_prepare +> -> #0 (prepare_lock) +> clk_prepare +> scp_ipi_send +> scp_send_ipi +> mtk_rpmsg_send +> rpmsg_send +> cros_ec_pkt_xfer_rpmsg + +Signed-off-by: Tzung-Bi Shih +Reviewed-by: Chen-Yu Tsai +Tested-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20260112110755.2435899-1-tzungbi@kernel.org +Signed-off-by: Mathieu Poirier +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/mtk_scp.c | 39 +++++++++++++++++++++++--------- + drivers/remoteproc/mtk_scp_ipi.c | 4 ++-- + 2 files changed, 30 insertions(+), 13 deletions(-) + +diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c +index c4c535b011812..ecbece2b5ce7c 100644 +--- a/drivers/remoteproc/mtk_scp.c ++++ b/drivers/remoteproc/mtk_scp.c +@@ -225,7 +225,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv) + struct mtk_scp *scp = priv; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(scp->dev, "failed to enable clocks\n"); + return IRQ_NONE; +@@ -233,7 +233,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv) + + scp->data->scp_irq_handler(scp); + +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + + return IRQ_HANDLED; + } +@@ -467,7 +467,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw) + struct device *dev = scp->dev; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(dev, "failed to enable clocks\n"); + return ret; +@@ -482,7 +482,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw) + + ret = scp_elf_load_segments(rproc, fw); + leave: +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + + return ret; + } +@@ -493,14 +493,14 @@ static int scp_parse_fw(struct rproc *rproc, const struct firmware *fw) + struct device *dev = scp->dev; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(dev, "failed to enable clocks\n"); + return ret; + } + + ret = scp_ipi_init(scp, fw); +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + return ret; + } + +@@ -511,7 +511,7 @@ static int scp_start(struct rproc *rproc) + struct scp_run *run = &scp->run; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(dev, "failed to enable clocks\n"); + return ret; +@@ -536,14 +536,14 @@ static int scp_start(struct rproc *rproc) + goto stop; + } + +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + dev_info(dev, "SCP is ready. FW version %s\n", run->fw_ver); + + return 0; + + stop: + scp->data->scp_reset_assert(scp); +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + return ret; + } + +@@ -638,7 +638,7 @@ static int scp_stop(struct rproc *rproc) + struct mtk_scp *scp = rproc->priv; + int ret; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(scp->dev, "failed to enable clocks\n"); + return ret; +@@ -646,12 +646,29 @@ static int scp_stop(struct rproc *rproc) + + scp->data->scp_reset_assert(scp); + scp->data->scp_stop(scp); +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + + return 0; + } + ++static int scp_prepare(struct rproc *rproc) ++{ ++ struct mtk_scp *scp = rproc->priv; ++ ++ return clk_prepare(scp->clk); ++} ++ ++static int scp_unprepare(struct rproc *rproc) ++{ ++ struct mtk_scp *scp = rproc->priv; ++ ++ clk_unprepare(scp->clk); ++ return 0; ++} ++ + static const struct rproc_ops scp_ops = { ++ .prepare = scp_prepare, ++ .unprepare = scp_unprepare, + .start = scp_start, + .stop = scp_stop, + .load = scp_load, +diff --git a/drivers/remoteproc/mtk_scp_ipi.c b/drivers/remoteproc/mtk_scp_ipi.c +index 9c7c17b9d181f..0c3ed37bd0821 100644 +--- a/drivers/remoteproc/mtk_scp_ipi.c ++++ b/drivers/remoteproc/mtk_scp_ipi.c +@@ -168,7 +168,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len, + WARN_ON(len > sizeof(send_obj->share_buf)) || WARN_ON(!buf)) + return -EINVAL; + +- ret = clk_prepare_enable(scp->clk); ++ ret = clk_enable(scp->clk); + if (ret) { + dev_err(scp->dev, "failed to enable clock\n"); + return ret; +@@ -208,7 +208,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len, + + unlock_mutex: + mutex_unlock(&scp->send_lock); +- clk_disable_unprepare(scp->clk); ++ clk_disable(scp->clk); + + return ret; + } +-- +2.51.0 + diff --git a/queue-6.6/revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch b/queue-6.6/revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch new file mode 100644 index 00000000000..346e09c96c0 --- /dev/null +++ b/queue-6.6/revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch @@ -0,0 +1,42 @@ +From 84fcd6ae0954241cdc5f1c93ecee29e200dd8c0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Nov 2025 17:16:51 +0100 +Subject: Revert "mfd: da9052-spi: Change read-mask to write-mask" + +From: Marcus Folkesson + +[ Upstream commit 12daa9c1954542bf98bb942fb2dadf19de79a44b ] + +This reverts commit 2e3378f6c79a1b3f7855ded1ef306ea4406352ed. + +Almost every register in this chip can be customized via OTP +memory. Somehow the value for R19, which decide if the flag is set +on read or write operation, seems to have been overwritten for the chip +the original patch were written for. + +Revert the change to follow the default behavior. + +Signed-off-by: Marcus Folkesson +Link: https://patch.msgid.link/20251124-da9052-revert-v1-1-fbeb2c894002@gmail.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/da9052-spi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mfd/da9052-spi.c b/drivers/mfd/da9052-spi.c +index 80fc5c0cac2fb..be5f2b34e18ae 100644 +--- a/drivers/mfd/da9052-spi.c ++++ b/drivers/mfd/da9052-spi.c +@@ -37,7 +37,7 @@ static int da9052_spi_probe(struct spi_device *spi) + spi_set_drvdata(spi, da9052); + + config = da9052_regmap_config; +- config.write_flag_mask = 1; ++ config.read_flag_mask = 1; + config.reg_bits = 7; + config.pad_bits = 1; + config.val_bits = 8; +-- +2.51.0 + diff --git a/queue-6.6/rnbd-srv-zero-the-rsp-buffer-before-using-it.patch b/queue-6.6/rnbd-srv-zero-the-rsp-buffer-before-using-it.patch new file mode 100644 index 00000000000..f961f207306 --- /dev/null +++ b/queue-6.6/rnbd-srv-zero-the-rsp-buffer-before-using-it.patch @@ -0,0 +1,47 @@ +From e9b5b5964ca6699d5a15fb601a42f9298b086b40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 13:47:33 +0100 +Subject: rnbd-srv: Zero the rsp buffer before using it + +From: Md Haris Iqbal + +[ Upstream commit 69d26698e4fd44935510553809007151b2fe4db5 ] + +Before using the data buffer to send back the response message, zero it +completely. This prevents any stray bytes to be picked up by the client +side when there the message is exchanged between different protocol +versions. + +Signed-off-by: Md Haris Iqbal +Signed-off-by: Jack Wang +Signed-off-by: Grzegorz Prajsner +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/rnbd/rnbd-srv.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c +index b67e39a34010b..ebc0f4c091051 100644 +--- a/drivers/block/rnbd/rnbd-srv.c ++++ b/drivers/block/rnbd/rnbd-srv.c +@@ -536,6 +536,8 @@ static void rnbd_srv_fill_msg_open_rsp(struct rnbd_msg_open_rsp *rsp, + { + struct block_device *bdev = sess_dev->bdev; + ++ memset(rsp, 0, sizeof(*rsp)); ++ + rsp->hdr.type = cpu_to_le16(RNBD_MSG_OPEN_RSP); + rsp->device_id = cpu_to_le32(sess_dev->device_id); + rsp->nsectors = cpu_to_le64(bdev_nr_sectors(bdev)); +@@ -641,6 +643,7 @@ static void process_msg_sess_info(struct rnbd_srv_session *srv_sess, + + trace_process_msg_sess_info(srv_sess, sess_info_msg); + ++ memset(rsp, 0, sizeof(*rsp)); + rsp->hdr.type = cpu_to_le16(RNBD_MSG_SESS_INFO_RSP); + rsp->ver = srv_sess->ver; + } +-- +2.51.0 + diff --git a/queue-6.6/rtc-interface-alarm-race-handling-should-not-discard.patch b/queue-6.6/rtc-interface-alarm-race-handling-should-not-discard.patch new file mode 100644 index 00000000000..311c0f8d305 --- /dev/null +++ b/queue-6.6/rtc-interface-alarm-race-handling-should-not-discard.patch @@ -0,0 +1,53 @@ +From a88edc45b6500221268143febcaec1c749dc2d46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 17:35:19 +0000 +Subject: rtc: interface: Alarm race handling should not discard preceding + error + +From: Anthony Pighin (Nokia) + +[ Upstream commit 81be22cd4ace020045cc6d31255c6f7c071eb7c0 ] + +Commit 795cda8338ea ("rtc: interface: Fix long-standing race when setting +alarm") should not discard any errors from the preceding validations. + +Prior to that commit, if the alarm feature was disabled, or the +set_alarm failed, a meaningful error code would be returned to the +caller for further action. + +After, more often than not, the __rtc_read_time will cause a success +return code instead, misleading the caller. + +An example of this is when timer_enqueue is called for a rtc-abx080x +device. Since that driver does not clear the alarm feature bit, but +instead relies on the set_alarm operation to return invalid, the discard +of the return code causes very different behaviour; i.e. + hwclock: select() to /dev/rtc0 to wait for clock tick timed out + +Fixes: 795cda8338ea ("rtc: interface: Fix long-standing race when setting alarm") +Signed-off-by: Anthony Pighin (Nokia) +Reviewed-by: Esben Haabendal +Tested-by: Nick Bowler +Link: https://patch.msgid.link/BN0PR08MB6951415A751F236375A2945683D1A@BN0PR08MB6951.namprd08.prod.outlook.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/interface.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c +index 93baffe110c00..13de2cb07f75d 100644 +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -457,7 +457,7 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm) + * are in, we can return -ETIME to signal that the timer has already + * expired, which is true in both cases. + */ +- if ((scheduled - now) <= 1) { ++ if (!err && (scheduled - now) <= 1) { + err = __rtc_read_time(rtc, &tm); + if (err) + return err; +-- +2.51.0 + diff --git a/queue-6.6/rtc-zynqmp-correct-frequency-value.patch b/queue-6.6/rtc-zynqmp-correct-frequency-value.patch new file mode 100644 index 00000000000..348e45c238e --- /dev/null +++ b/queue-6.6/rtc-zynqmp-correct-frequency-value.patch @@ -0,0 +1,42 @@ +From 2d6327e62d065d3b3bf8db23ce67dc97e1d5bbb8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 13:53:45 +0000 +Subject: rtc: zynqmp: correct frequency value + +From: Tomas Melin + +[ Upstream commit 2724fb4d429cbb724dcb6fa17953040918ebe3a2 ] + +Fix calibration value in case a clock reference is provided. +The actual calibration value written into register is +frequency - 1. + +Reviewed-by: Harini T +Tested-by: Harini T +Signed-off-by: Tomas Melin +Acked-by: Michal Simek +Link: https://patch.msgid.link/20260122-zynqmp-rtc-updates-v4-1-d4edb966b499@vaisala.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-zynqmp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/rtc/rtc-zynqmp.c b/drivers/rtc/rtc-zynqmp.c +index b6f96c10196ae..f49af7d963fbd 100644 +--- a/drivers/rtc/rtc-zynqmp.c ++++ b/drivers/rtc/rtc-zynqmp.c +@@ -330,7 +330,10 @@ static int xlnx_rtc_probe(struct platform_device *pdev) + &xrtcdev->freq); + if (ret) + xrtcdev->freq = RTC_CALIB_DEF; ++ } else { ++ xrtcdev->freq--; + } ++ + ret = readl(xrtcdev->reg_base + RTC_CALIB_RD); + if (!ret) + writel(xrtcdev->freq, (xrtcdev->reg_base + RTC_CALIB_WR)); +-- +2.51.0 + diff --git a/queue-6.6/s390-perf-disable-register-readout-on-sampling-event.patch b/queue-6.6/s390-perf-disable-register-readout-on-sampling-event.patch new file mode 100644 index 00000000000..1a44cbe9188 --- /dev/null +++ b/queue-6.6/s390-perf-disable-register-readout-on-sampling-event.patch @@ -0,0 +1,53 @@ +From 5c32838614e1002a9aef324b8f6866578d806c0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 10:14:12 +0100 +Subject: s390/perf: Disable register readout on sampling events + +From: Thomas Richter + +[ Upstream commit b2c04fc1239062b39ddfdd8731ee1a10810dfb74 ] + +Running commands + # ./perf record -IR0,R1 -a sleep 1 +extracts and displays register value of general purpose register r1 and r0. +However the value displayed of any register is random and does not +reflect the register value recorded at the time of the sample interrupt. + +The sampling device driver on s390 creates a very large buffer +for the hardware to store the samples. Only when that large buffer +gets full an interrupt is generated and many hundreds of sample +entries are processed and copied to the kernel ring buffer and +eventually get copied to the perf tool. It is during the copy +to the kernel ring buffer that each sample is processed (on s390) +and at that time the register values are extracted. +This is not the original goal, the register values should be read +when the samples are created not when the samples are copied to the +kernel ring buffer. + +Prevent this event from being installed in the first place and +return -EOPNOTSUPP. This is already the case for PERF_SAMPLE_REGS_USER. + +Signed-off-by: Thomas Richter +Reviewed-by: Jan Polensky +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/perf_cpum_sf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c +index e52c89739bc9a..c6cac49f3ae72 100644 +--- a/arch/s390/kernel/perf_cpum_sf.c ++++ b/arch/s390/kernel/perf_cpum_sf.c +@@ -925,7 +925,7 @@ static bool is_callchain_event(struct perf_event *event) + u64 sample_type = event->attr.sample_type; + + return sample_type & (PERF_SAMPLE_CALLCHAIN | PERF_SAMPLE_REGS_USER | +- PERF_SAMPLE_STACK_USER); ++ PERF_SAMPLE_REGS_INTR | PERF_SAMPLE_STACK_USER); + } + + static int cpumsf_pmu_event_init(struct perf_event *event) +-- +2.51.0 + diff --git a/queue-6.6/s390-purgatory-add-wno-default-const-init-unsafe-to-.patch b/queue-6.6/s390-purgatory-add-wno-default-const-init-unsafe-to-.patch new file mode 100644 index 00000000000..e32bffe8f10 --- /dev/null +++ b/queue-6.6/s390-purgatory-add-wno-default-const-init-unsafe-to-.patch @@ -0,0 +1,45 @@ +From 54f8e1c2755e6b6e764e602e6c9b2615baa2ef2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Dec 2025 16:47:07 +0100 +Subject: s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS + +From: Heiko Carstens + +[ Upstream commit b4780fe4ddf04b51127a33d705f4a2e224df00fa ] + +Add -Wno-default-const-init-unsafe to purgatory KBUILD_CFLAGS, similar +to scripts/Makefile.extrawarn, since clang generates warnings for the +dummy variable in typecheck(): + + CC arch/s390/purgatory/purgatory.o + arch/s390/include/asm/ptrace.h:221:9: warning: default initialization of an object of type 'typeof (regs->psw)' (aka 'const psw_t') leaves the object uninitialized [-Wdefault-const-init-var-unsafe] + 221 | return psw_bits(regs->psw).pstate; + | ^ + arch/s390/include/asm/ptrace.h:98:2: note: expanded from macro 'psw_bits' + 98 | typecheck(psw_t, __psw); \ + | ^ + include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck' + 11 | typeof(x) __dummy2; \ + | ^ + +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/purgatory/Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/s390/purgatory/Makefile b/arch/s390/purgatory/Makefile +index fe7e71f91711b..0cbfa716a64a7 100644 +--- a/arch/s390/purgatory/Makefile ++++ b/arch/s390/purgatory/Makefile +@@ -29,6 +29,7 @@ KBUILD_CFLAGS += -fno-stack-protector + KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING + KBUILD_CFLAGS += $(CLANG_FLAGS) + KBUILD_CFLAGS += $(call cc-option,-fno-PIE) ++KBUILD_CFLAGS += $(call cc-option, -Wno-default-const-init-unsafe) + KBUILD_AFLAGS := $(filter-out -DCC_USING_EXPOLINE,$(KBUILD_AFLAGS)) + + # Since we link purgatory with -r unresolved symbols are not checked, so we +-- +2.51.0 + diff --git a/queue-6.6/scsi-buslogic-reduce-stack-usage.patch b/queue-6.6/scsi-buslogic-reduce-stack-usage.patch new file mode 100644 index 00000000000..9be2c41d8ad --- /dev/null +++ b/queue-6.6/scsi-buslogic-reduce-stack-usage.patch @@ -0,0 +1,66 @@ +From 5907f3fa6bce8dba6995dc901fbfa9d95c1d9b3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 17:33:15 +0100 +Subject: scsi: buslogic: Reduce stack usage + +From: Arnd Bergmann + +[ Upstream commit e17f0d4cc006265dd92129db4bf9da3a2e4a4f66 ] + +Some randconfig builds run into excessive stack usage with gcc-14 or +higher, which use __attribute__((cold)) where earlier versions did not do +that: + +drivers/scsi/BusLogic.c: In function 'blogic_init': +drivers/scsi/BusLogic.c:2398:1: error: the frame size of 1680 bytes is larger than 1536 bytes [-Werror=frame-larger-than=] + +The problem is that a lot of code gets inlined into blogic_init() here. Two +functions stick out, but they are a bit different: + + - blogic_init_probeinfo_list() actually uses a few hundred bytes of kernel + stack, which is a problem in combination with other functions that also + do. Marking this one as noinline means that the stack slots get get + reused between function calls + + - blogic_reportconfig() has a few large variables, but whenever it is not + inlined into its caller, the compiler is actually smart enough to reuse + stack slots for these automatically, so marking it as noinline saves + most of the stack space by itself. + +The combination of both of these should avoid the problem entirely. + +Signed-off-by: Arnd Bergmann +Link: https://patch.msgid.link/20260203163321.2598593-1-arnd@kernel.org +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/BusLogic.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c +index 72ceaf650b0d5..dfe97e25635ed 100644 +--- a/drivers/scsi/BusLogic.c ++++ b/drivers/scsi/BusLogic.c +@@ -919,7 +919,8 @@ static int __init blogic_init_fp_probeinfo(struct blogic_adapter *adapter) + a particular probe order. + */ + +-static void __init blogic_init_probeinfo_list(struct blogic_adapter *adapter) ++static noinline_for_stack void __init ++blogic_init_probeinfo_list(struct blogic_adapter *adapter) + { + /* + If a PCI BIOS is present, interrogate it for MultiMaster and +@@ -1689,7 +1690,8 @@ static bool __init blogic_rdconfig(struct blogic_adapter *adapter) + blogic_reportconfig reports the configuration of Host Adapter. + */ + +-static bool __init blogic_reportconfig(struct blogic_adapter *adapter) ++static noinline_for_stack bool __init ++blogic_reportconfig(struct blogic_adapter *adapter) + { + unsigned short alltgt_mask = (1 << adapter->maxdev) - 1; + unsigned short sync_ok, fast_ok; +-- +2.51.0 + diff --git a/queue-6.6/serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch b/queue-6.6/serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch new file mode 100644 index 00000000000..6bb30184e07 --- /dev/null +++ b/queue-6.6/serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch @@ -0,0 +1,46 @@ +From bd54ef7056c4b2aa72d076ed014233e390479297 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 13:48:29 +0530 +Subject: serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA + termination is done + +From: Moteen Shah + +[ Upstream commit a5fd8945a478ff9be14812693891d7c9b4185a50 ] + +Clear rx_running flag only after DMA teardown polling completes. In the +previous implementation the flag was being cleared while hardware teardown +was still in progress, creating a mismatch between software state +(flag = 0, "ready") and hardware state (still terminating). + +Signed-off-by: Moteen Shah +Link: https://patch.msgid.link/20260112081829.63049-3-m-shah@ti.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 9ed62bc7cdd83..776373423b2a0 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -924,7 +924,6 @@ static void __dma_rx_do_complete(struct uart_8250_port *p) + goto out; + + cookie = dma->rx_cookie; +- dma->rx_running = 0; + + /* Re-enable RX FIFO interrupt now that transfer is complete */ + if (priv->habit & UART_HAS_RHR_IT_DIS) { +@@ -958,6 +957,7 @@ static void __dma_rx_do_complete(struct uart_8250_port *p) + goto out; + ret = tty_insert_flip_string(tty_port, dma->rx_buf, count); + ++ dma->rx_running = 0; + p->port.icount.rx += ret; + p->port.icount.buf_overrun += count - ret; + out: +-- +2.51.0 + diff --git a/queue-6.6/serial-8250_dw-handle-clock-enable-errors-in-runtime.patch b/queue-6.6/serial-8250_dw-handle-clock-enable-errors-in-runtime.patch new file mode 100644 index 00000000000..f7137d142c7 --- /dev/null +++ b/queue-6.6/serial-8250_dw-handle-clock-enable-errors-in-runtime.patch @@ -0,0 +1,57 @@ +From d6e4295fb919543bd701d6980bec4201240ff03e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 17:54:25 +0300 +Subject: serial: 8250_dw: handle clock enable errors in runtime_resume + +From: Artem Shimko + +[ Upstream commit d31228143a489ba6ba797896a07541ce06828c09 ] + +Add error checking for clk_prepare_enable() calls in +dw8250_runtime_resume(). Currently if either clock fails to enable, +the function returns success while leaving clocks in inconsistent state. + +This change implements comprehensive error handling by checking the return +values of both clk_prepare_enable() calls. If the second clock enable +operation fails after the first clock has already been successfully +enabled, the code now properly cleans up by disabling and unpreparing +the first clock before returning. The error code is then propagated to +the caller, ensuring that clock enable failures are properly reported +rather than being silently ignored. + +Signed-off-by: Artem Shimko +Link: https://patch.msgid.link/20251104145433.2316165-2-a.shimko.dev@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_dw.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c +index 57b27f9ea1f03..60a05bfecde39 100644 +--- a/drivers/tty/serial/8250/8250_dw.c ++++ b/drivers/tty/serial/8250/8250_dw.c +@@ -753,11 +753,18 @@ static int dw8250_runtime_suspend(struct device *dev) + + static int dw8250_runtime_resume(struct device *dev) + { ++ int ret; + struct dw8250_data *data = dev_get_drvdata(dev); + +- clk_prepare_enable(data->pclk); ++ ret = clk_prepare_enable(data->pclk); ++ if (ret) ++ return ret; + +- clk_prepare_enable(data->clk); ++ ret = clk_prepare_enable(data->clk); ++ if (ret) { ++ clk_disable_unprepare(data->pclk); ++ return ret; ++ } + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.6/series b/queue-6.6/series index f7530b4a042..76ac4e19b93 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -332,3 +332,197 @@ sunrpc-fix-gss_auth-kref-leak-in-gss_alloc_msg-error-path.patch asoc-dt-bindings-asahi-kasei-ak4458-set-unevaluatedproperties-false.patch asoc-dt-bindings-asahi-kasei-ak4458-fix-the-supply-names.patch asoc-dt-bindings-asahi-kasei-ak5558-fix-the-supply-names.patch +perf-test-stat-update-test-expectations-and-events.patch +perf-test-stat-tests-fix-for-virtualized-machines.patch +perf-unwind-libdw-fix-invalid-reference-counts.patch +perf-callchain-fix-srcline-printing-with-inlines.patch +libsubcmd-fix-null-intersection-case-in-exclude_cmds.patch +libperf-don-t-remove-g-when-extra_cflags-are-used.patch +libperf-build-always-place-libperf-includes-first.patch +rtc-interface-alarm-race-handling-should-not-discard.patch +audit-add-fchmodat2-to-change-attributes-class.patch +hfsplus-fix-volume-corruption-issue-for-generic-498.patch +fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch +audit-add-missing-syscalls-to-read-class.patch +hfsplus-pretend-special-inodes-as-regular-files.patch +i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch +minix-add-required-sanity-checking-to-minix_check_su.patch +btrfs-handle-user-interrupt-properly-in-btrfs_trim_f.patch +smb-client-add-proper-locking-around-ses-iface_last_.patch +gfs2-fiemap-page-fault-fix.patch +smb-client-prevent-races-in-query_interfaces.patch +tools-power-cpupower-reset-errno-before-strtoull.patch +s390-purgatory-add-wno-default-const-init-unsafe-to-.patch +perf-arm-cmn-support-cmn-600ae.patch +arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch +rnbd-srv-zero-the-rsp-buffer-before-using-it.patch +x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch +efi-cper-don-t-dump-the-entire-memory-region.patch +apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch +efi-cper-don-t-go-past-the-arm-processor-cper-record.patch +acpi-processor-fix-null-pointer-dereference-in-acpi_.patch +acpica-abort-aml-bytecode-execution-when-executing-a.patch +md-cluster-fix-null-pointer-dereference-in-process_m.patch +cpufreq-dt-platdev-block-the-driver-from-probing-on-.patch +s390-perf-disable-register-readout-on-sampling-event.patch +perf-cxlpmu-replace-irqf_oneshot-with-irqf_no_thread.patch +xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch +blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch +sparc-synchronize-user-stack-on-fork-and-clone.patch +sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch +bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch +clocksource-drivers-sh_tmu-always-leave-device-runni.patch +clocksource-drivers-timer-integrator-ap-add-missing-.patch +pci-msi-unmap-msi-x-region-on-error.patch +crypto-hisilicon-qm-move-the-barrier-before-writing-.patch +mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch +char-tpm-cr50-remove-irqf_oneshot.patch +pstore-ram_core-fix-incorrect-success-return-when-vm.patch +arm64-tegra-smaug-add-usb-role-switch-support.patch +parisc-prevent-interrupts-during-reboot.patch +drm-display-dp_mst-add-protection-against-0-vcpi.patch +spi-geni-qcom-initialize-mode-related-registers-to-0.patch +spi-geni-qcom-use-xfer-bits_per_word-for-can_dma.patch +media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch +spi-stm32-fix-overrun-issue-at-8bpw.patch +drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch +media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch +media-omap3isp-isppreview-always-clamp-in-preview_tr.patch +media-omap3isp-set-initial-format.patch +media-mediatek-vcodec-don-t-try-to-decode-422-444-vp.patch +drm-amdgpu-add-support-for-hdp-ip-version-6.1.1.patch +drm-amdgpu-avoid-a-warning-in-timedout-job-handler.patch +hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch +asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch +asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch +spi-spi-mem-limit-octal-dtr-constraints-to-octal-dtr.patch +media-amphion-clear-last_buffer_dequeued-flag-for-de.patch +media-adv7180-fix-frame-interval-in-progressive-mode.patch +media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch +media-solo6x10-check-for-out-of-bounds-chip_id.patch +media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch +media-v4l2-async-fix-error-handling-on-steps-after-f.patch +drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch +drm-account-property-blob-allocations-to-memcg.patch +hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch +virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch +drm-amd-display-ensure-link-output-is-disabled-in-ba.patch +drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch +drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch +drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch +media-rkisp1-fix-filter-mode-register-configuration.patch +hid-multitouch-add-egalaxtouch-exc3188-support.patch +hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch +alsa-hda-conexant-add-headset-mic-fix-for-mechrevo-w.patch +gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch +asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch +spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch +asoc-codecs-max98390-check-return-value-of-devm_gpio.patch +hwmon-nct6775-add-asus-pro-ws-wrx90e-sage-se.patch +hwmon-f71882fg-add-f81968-support.patch +asoc-es8328-add-error-unwind-in-resume.patch +modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch +alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch +jfs-add-missing-set_freezable-for-freezable-kthread.patch +jfs-nlink-overflow-in-jfs_rename.patch +wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch +wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch +wifi-rtw88-rtw8821cu-add-id-for-mercusys-mu6h.patch +dm-replace-eexist-with-ebusy.patch +dm-remove-fake-timeout-to-avoid-leak-request.patch +iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch +wifi-libertas-fix-warning-in-usb_tx_block.patch +iommu-amd-move-wait_on_sem-out-of-spinlock.patch +wifi-rtw89-wow-add-reason-codes-for-disassociation-i.patch +pci-dw-rockchip-disable-bar-0-and-bar-1-for-root-por.patch +wifi-ath11k-add-pm-quirk-for-thinkpad-z13-z16-gen1.patch +wifi-ath12k-fix-preferred-hardware-mode-calculation.patch +ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch +ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch +ext4-mark-group-add-fast-commit-ineligible.patch +ext4-move-ext4_percpu_param_init-before-ext4_mb_init.patch +ext4-mark-group-extend-fast-commit-ineligible.patch +netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch +netfilter-xt_tcpmss-check-remaining-length-before-re.patch +openrisc-define-arch-specific-version-of-nop.patch +net-usb-r8152-fix-transmit-queue-timeout.patch +wifi-iwlwifi-mvm-check-the-validity-of-noa_len.patch +net-rds-no-shortcut-out-of-rds_conn_error.patch +gro-change-the-bug_on-in-gro_pull_from_frag0.patch +ipv4-igmp-annotate-data-races-around-idev-mr_maxdela.patch +net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch +wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch +wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch +ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch +bluetooth-hci_conn-set-link_policy-on-incoming-acl-c.patch +bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch +bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch +bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch +octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch +wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch +wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch +net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch +vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch +net-rds-clear-reconnect-pending-bit.patch +pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch +pci-fix-pci_slot_lock-device-locking.patch +pci-enable-acs-after-configuring-iommu-for-of-platfo.patch +pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch +pci-mark-nvidia-gb10-to-avoid-bus-reset.patch +myri10ge-avoid-uninitialized-variable-use.patch +nfc-nxp-nci-remove-interrupt-trigger-type.patch +rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch +ata-libata-avoid-long-timeouts-on-hot-unplugged-sata.patch +hisi_acc_vfio_pci-update-status-after-ras-error.patch +scsi-buslogic-reduce-stack-usage.patch +vhost-fix-caching-attributes-of-mmio-regions-by-sett.patch +tracing-fix-false-sharing-in-hwlat-get_sample.patch +remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch +mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch +mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch +mailbox-sprd-mask-interrupts-that-are-not-handled.patch +remoteproc-mediatek-break-lock-dependency-to-prepare.patch +mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch +clk-microchip-core-correct-return-value-on-_get_pare.patch +m68k-nommu-fix-memmove-with-differently-aligned-src-.patch +soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch +staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch +serial-8250_dw-handle-clock-enable-errors-in-runtime.patch +usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch +fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch +dmaengine-sun6i-choose-appropriate-burst-length-unde.patch +dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch +misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch +misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch +staging-rtl8723bs-fix-memory-leak-on-failure-path.patch +serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch +fix-it87_wdt-early-reboot-by-reporting-running-timer.patch +binder-don-t-use-pk-through-printk.patch +watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch +phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch +phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch +revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch +iio-use-irqf_no_thread.patch +iio-magnetometer-remove-irqf_oneshot.patch +mips-loongson-make-cpumask_of_node-robust-against-nu.patch +fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch +fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch +fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch +fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch +fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch +ceph-supply-snapshot-context-in-ceph_uninline_data.patch +libceph-define-and-enforce-ceph_max_key_len.patch +thermal-int340x-fix-sysfs-group-leak-on-dlvr-registr.patch +include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch +arm-9467-1-mm-don-t-use-pk-through-printk.patch +drm-amd-display-avoid-updating-surface-with-the-same.patch +drm-amdgpu-adjust-usleep_range-in-fence-wait.patch +alsa-usb-audio-update-the-number-of-packets-properly.patch +drm-amdgpu-add-hainan-clock-adjustment.patch +drm-radeon-add-hainan-clock-adjustment.patch +alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch +btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch +drm-amd-display-remove-conditional-for-shaper-3dlut-.patch +rtc-zynqmp-correct-frequency-value.patch +ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch +ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch diff --git a/queue-6.6/smb-client-add-proper-locking-around-ses-iface_last_.patch b/queue-6.6/smb-client-add-proper-locking-around-ses-iface_last_.patch new file mode 100644 index 00000000000..bd8d340343d --- /dev/null +++ b/queue-6.6/smb-client-add-proper-locking-around-ses-iface_last_.patch @@ -0,0 +1,36 @@ +From 02c41a70f57a7efbb1d045b7fb58f7dd647511e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 14:54:45 -0300 +Subject: smb: client: add proper locking around ses->iface_last_update + +From: Henrique Carvalho + +[ Upstream commit e97dcac3dc0bd37e4b56aaa6874b572a3a461102 ] + +There is a missing ses->iface_lock in cifs_setup_session, +around ses->iface_last_update. + +Signed-off-by: Henrique Carvalho +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/connect.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c +index 86c89917f18e9..59220ebd6ecce 100644 +--- a/fs/smb/client/connect.c ++++ b/fs/smb/client/connect.c +@@ -4065,7 +4065,9 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses, + ses->ses_status = SES_IN_SETUP; + + /* force iface_list refresh */ ++ spin_lock(&ses->iface_lock); + ses->iface_last_update = 0; ++ spin_unlock(&ses->iface_lock); + } + spin_unlock(&ses->ses_lock); + +-- +2.51.0 + diff --git a/queue-6.6/smb-client-prevent-races-in-query_interfaces.patch b/queue-6.6/smb-client-prevent-races-in-query_interfaces.patch new file mode 100644 index 00000000000..71e4e0a3e29 --- /dev/null +++ b/queue-6.6/smb-client-prevent-races-in-query_interfaces.patch @@ -0,0 +1,79 @@ +From cfcbb96a7c7afb173f11cc35495dba654ec6d128 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 14:54:44 -0300 +Subject: smb: client: prevent races in ->query_interfaces() + +From: Henrique Carvalho + +[ Upstream commit c3c06e42e1527716c54f3ad2ced6a034b5f3a489 ] + +It was possible for two query interface works to be concurrently trying +to update the interfaces. + +Prevent this by checking and updating iface_last_update under +iface_lock. + +Signed-off-by: Henrique Carvalho +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2ops.c | 19 ++++++++----------- + 1 file changed, 8 insertions(+), 11 deletions(-) + +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index 138b3ed08217c..a745ed9e20460 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -595,13 +595,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, + p = buf; + + spin_lock(&ses->iface_lock); +- /* do not query too frequently, this time with lock held */ +- if (ses->iface_last_update && +- time_before(jiffies, ses->iface_last_update + +- (SMB_INTERFACE_POLL_INTERVAL * HZ))) { +- spin_unlock(&ses->iface_lock); +- return 0; +- } + + /* + * Go through iface_list and mark them as inactive +@@ -624,7 +617,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, + "Empty network interface list returned by server %s\n", + ses->server->hostname); + rc = -EOPNOTSUPP; +- ses->iface_last_update = jiffies; + goto out; + } + +@@ -753,8 +745,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, + + sizeof(p->Next) && p->Next)) + cifs_dbg(VFS, "%s: incomplete interface info\n", __func__); + +- ses->iface_last_update = jiffies; +- + out: + /* + * Go through the list again and put the inactive entries +@@ -783,10 +773,17 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon, bool in_ + struct TCP_Server_Info *pserver; + + /* do not query too frequently */ ++ spin_lock(&ses->iface_lock); + if (ses->iface_last_update && + time_before(jiffies, ses->iface_last_update + +- (SMB_INTERFACE_POLL_INTERVAL * HZ))) ++ (SMB_INTERFACE_POLL_INTERVAL * HZ))) { ++ spin_unlock(&ses->iface_lock); + return 0; ++ } ++ ++ ses->iface_last_update = jiffies; ++ ++ spin_unlock(&ses->iface_lock); + + rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, + FSCTL_QUERY_NETWORK_INTERFACE_INFO, +-- +2.51.0 + diff --git a/queue-6.6/soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch b/queue-6.6/soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch new file mode 100644 index 00000000000..1ddfeba6d18 --- /dev/null +++ b/queue-6.6/soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch @@ -0,0 +1,49 @@ +From 03b8acfacc2688eb14397bb725f2d050e9ba1e9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 15:09:47 +0200 +Subject: soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of + NUC15) + +From: Peter Ujfalusi + +[ Upstream commit 59946373755d71dbd7614ba235e0093159f80b69 ] + +Avell B.ON is an OEM re-branded NUC15 'Bishop County' LAPBC510 and +LAPBC710. + +Link: https://github.com/thesofproject/linux/issues/5529 +Signed-off-by: Peter Ujfalusi +Reviewed-by: Kai Vehmanen +Reviewed-by: Bard Liao +Link: https://patch.msgid.link/20251215130947.31385-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/dmi-quirks.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/soundwire/dmi-quirks.c b/drivers/soundwire/dmi-quirks.c +index 91ab97a456fa9..5854218e1a274 100644 +--- a/drivers/soundwire/dmi-quirks.c ++++ b/drivers/soundwire/dmi-quirks.c +@@ -122,6 +122,17 @@ static const struct dmi_system_id adr_remap_quirk_table[] = { + }, + .driver_data = (void *)intel_tgl_bios, + }, ++ { ++ /* ++ * quirk used for Avell B.ON (OEM rebrand of NUC15 'Bishop County' ++ * LAPBC510 and LAPBC710) ++ */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Avell High Performance"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "B.ON"), ++ }, ++ .driver_data = (void *)intel_tgl_bios, ++ }, + { + /* quirk used for NUC15 'Rooks County' LAPRC510 and LAPRC710 skews */ + .matches = { +-- +2.51.0 + diff --git a/queue-6.6/sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch b/queue-6.6/sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch new file mode 100644 index 00000000000..18c6c26b9ed --- /dev/null +++ b/queue-6.6/sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch @@ -0,0 +1,50 @@ +From 40680d7bd2ba00d39fa78a9b96efc6240f751bf3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 13:40:29 +0000 +Subject: sparc: don't reference obsolete termio struct for TC* constants + +From: Sam James + +[ Upstream commit be0bccffcde3308150d2a90e55fc10e249098909 ] + +Similar in nature to commit ab107276607a ("powerpc: Fix struct termio related ioctl macros"). + +glibc-2.42 drops the legacy termio struct, but the ioctls.h header still +defines some TC* constants in terms of termio (via sizeof). Hardcode the +values instead. + +This fixes building Python for example, which falls over like: + ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio' + +Link: https://bugs.gentoo.org/961769 +Link: https://bugs.gentoo.org/962600 +Signed-off-by: Sam James +Reviewed-by: Andreas Larsson +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/include/uapi/asm/ioctls.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/sparc/include/uapi/asm/ioctls.h b/arch/sparc/include/uapi/asm/ioctls.h +index 7fd2f5873c9e7..a8bbdf9877a41 100644 +--- a/arch/sparc/include/uapi/asm/ioctls.h ++++ b/arch/sparc/include/uapi/asm/ioctls.h +@@ -5,10 +5,10 @@ + #include + + /* Big T */ +-#define TCGETA _IOR('T', 1, struct termio) +-#define TCSETA _IOW('T', 2, struct termio) +-#define TCSETAW _IOW('T', 3, struct termio) +-#define TCSETAF _IOW('T', 4, struct termio) ++#define TCGETA 0x40125401 /* _IOR('T', 1, struct termio) */ ++#define TCSETA 0x80125402 /* _IOW('T', 2, struct termio) */ ++#define TCSETAW 0x80125403 /* _IOW('T', 3, struct termio) */ ++#define TCSETAF 0x80125404 /* _IOW('T', 4, struct termio) */ + #define TCSBRK _IO('T', 5) + #define TCXONC _IO('T', 6) + #define TCFLSH _IO('T', 7) +-- +2.51.0 + diff --git a/queue-6.6/sparc-synchronize-user-stack-on-fork-and-clone.patch b/queue-6.6/sparc-synchronize-user-stack-on-fork-and-clone.patch new file mode 100644 index 00000000000..51abc2ee732 --- /dev/null +++ b/queue-6.6/sparc-synchronize-user-stack-on-fork-and-clone.patch @@ -0,0 +1,114 @@ +From 111943969e7629851b38dfef7ed33d752f36f2db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 15:47:52 +0100 +Subject: sparc: Synchronize user stack on fork and clone + +From: Andreas Larsson + +[ Upstream commit e38eba3b77878ada327a572a41596a3b0b44e522 ] + +Flush all uncommitted user windows before calling the generic syscall +handlers for clone, fork, and vfork. + +Prior to entering the arch common handlers sparc_{clone|fork|vfork}, the +arch-specific syscall wrappers for these syscalls will attempt to flush +all windows (including user windows). + +In the window overflow trap handlers on both SPARC{32|64}, +if the window can't be stored (i.e due to MMU related faults) the routine +backups the user window and increments a thread counter (wsaved). + +By adding a synchronization point after the flush attempt, when fault +handling is enabled, any uncommitted user windows will be flushed. + +Link: https://sourceware.org/bugzilla/show_bug.cgi?id=31394 +Closes: https://lore.kernel.org/sparclinux/fe5cc47167430007560501aabb28ba154985b661.camel@physik.fu-berlin.de/ +Signed-off-by: Andreas Larsson +Signed-off-by: Ludwig Rydberg +Tested-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/20260119144753.27945-2-ludwig.rydberg@gaisler.com +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/kernel/process.c | 38 +++++++++++++++++++++++-------------- + 1 file changed, 24 insertions(+), 14 deletions(-) + +diff --git a/arch/sparc/kernel/process.c b/arch/sparc/kernel/process.c +index 0442ab00518d3..7d69877511fac 100644 +--- a/arch/sparc/kernel/process.c ++++ b/arch/sparc/kernel/process.c +@@ -17,14 +17,18 @@ + + asmlinkage long sparc_fork(struct pt_regs *regs) + { +- unsigned long orig_i1 = regs->u_regs[UREG_I1]; ++ unsigned long orig_i1; + long ret; + struct kernel_clone_args args = { + .exit_signal = SIGCHLD, +- /* Reuse the parent's stack for the child. */ +- .stack = regs->u_regs[UREG_FP], + }; + ++ synchronize_user_stack(); ++ ++ orig_i1 = regs->u_regs[UREG_I1]; ++ /* Reuse the parent's stack for the child. */ ++ args.stack = regs->u_regs[UREG_FP]; ++ + ret = kernel_clone(&args); + + /* If we get an error and potentially restart the system +@@ -40,16 +44,19 @@ asmlinkage long sparc_fork(struct pt_regs *regs) + + asmlinkage long sparc_vfork(struct pt_regs *regs) + { +- unsigned long orig_i1 = regs->u_regs[UREG_I1]; ++ unsigned long orig_i1; + long ret; +- + struct kernel_clone_args args = { + .flags = CLONE_VFORK | CLONE_VM, + .exit_signal = SIGCHLD, +- /* Reuse the parent's stack for the child. */ +- .stack = regs->u_regs[UREG_FP], + }; + ++ synchronize_user_stack(); ++ ++ orig_i1 = regs->u_regs[UREG_I1]; ++ /* Reuse the parent's stack for the child. */ ++ args.stack = regs->u_regs[UREG_FP]; ++ + ret = kernel_clone(&args); + + /* If we get an error and potentially restart the system +@@ -65,15 +72,18 @@ asmlinkage long sparc_vfork(struct pt_regs *regs) + + asmlinkage long sparc_clone(struct pt_regs *regs) + { +- unsigned long orig_i1 = regs->u_regs[UREG_I1]; +- unsigned int flags = lower_32_bits(regs->u_regs[UREG_I0]); ++ unsigned long orig_i1; ++ unsigned int flags; + long ret; ++ struct kernel_clone_args args = {0}; + +- struct kernel_clone_args args = { +- .flags = (flags & ~CSIGNAL), +- .exit_signal = (flags & CSIGNAL), +- .tls = regs->u_regs[UREG_I3], +- }; ++ synchronize_user_stack(); ++ ++ orig_i1 = regs->u_regs[UREG_I1]; ++ flags = lower_32_bits(regs->u_regs[UREG_I0]); ++ args.flags = (flags & ~CSIGNAL); ++ args.exit_signal = (flags & CSIGNAL); ++ args.tls = regs->u_regs[UREG_I3]; + + #ifdef CONFIG_COMPAT + if (test_thread_flag(TIF_32BIT)) { +-- +2.51.0 + diff --git a/queue-6.6/spi-geni-qcom-initialize-mode-related-registers-to-0.patch b/queue-6.6/spi-geni-qcom-initialize-mode-related-registers-to-0.patch new file mode 100644 index 00000000000..2078043a505 --- /dev/null +++ b/queue-6.6/spi-geni-qcom-initialize-mode-related-registers-to-0.patch @@ -0,0 +1,40 @@ +From 8c2c878fa0a8f6a2e9c0c15e869f8f3f98c629ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Nov 2025 16:12:01 -0500 +Subject: spi-geni-qcom: initialize mode related registers to 0 + +From: Jonathan Marek + +[ Upstream commit 739062a9f1e9a77a9687c8fd30f8e5dd12ec70be ] + +setup_fifo_params assumes these will be zero, it won't write these +registers if the initial mode is zero. + +Signed-off-by: Jonathan Marek +Link: https://patch.msgid.link/20251120211204.24078-4-jonathan@marek.ca +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-geni-qcom.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c +index 6a3b41dbfa701..f163d724b43f1 100644 +--- a/drivers/spi/spi-geni-qcom.c ++++ b/drivers/spi/spi-geni-qcom.c +@@ -710,6 +710,12 @@ static int spi_geni_init(struct spi_geni_master *mas) + case 0: + mas->cur_xfer_mode = GENI_SE_FIFO; + geni_se_select_mode(se, GENI_SE_FIFO); ++ /* setup_fifo_params assumes that these registers start with a zero value */ ++ writel(0, se->base + SE_SPI_LOOPBACK); ++ writel(0, se->base + SE_SPI_DEMUX_SEL); ++ writel(0, se->base + SE_SPI_CPHA); ++ writel(0, se->base + SE_SPI_CPOL); ++ writel(0, se->base + SE_SPI_DEMUX_OUTPUT_INV); + ret = 0; + break; + } +-- +2.51.0 + diff --git a/queue-6.6/spi-geni-qcom-use-xfer-bits_per_word-for-can_dma.patch b/queue-6.6/spi-geni-qcom-use-xfer-bits_per_word-for-can_dma.patch new file mode 100644 index 00000000000..9f87edf0805 --- /dev/null +++ b/queue-6.6/spi-geni-qcom-use-xfer-bits_per_word-for-can_dma.patch @@ -0,0 +1,50 @@ +From 4166688480442d48cc21a4be95b039f9e6fa7934 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Nov 2025 16:12:00 -0500 +Subject: spi-geni-qcom: use xfer->bits_per_word for can_dma() + +From: Jonathan Marek + +[ Upstream commit fb2bbe3838728f572485706677590e4fc41eec5c ] + +mas->cur_bits_per_word may not reflect the value of xfer->bits_per_word +when can_dma() is called. Use the right value instead. + +Signed-off-by: Jonathan Marek +Link: https://patch.msgid.link/20251120211204.24078-3-jonathan@marek.ca +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-geni-qcom.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c +index f163d724b43f1..37a20652fd2e7 100644 +--- a/drivers/spi/spi-geni-qcom.c ++++ b/drivers/spi/spi-geni-qcom.c +@@ -548,10 +548,10 @@ static u32 get_xfer_len_in_words(struct spi_transfer *xfer, + { + u32 len; + +- if (!(mas->cur_bits_per_word % MIN_WORD_LEN)) +- len = xfer->len * BITS_PER_BYTE / mas->cur_bits_per_word; ++ if (!(xfer->bits_per_word % MIN_WORD_LEN)) ++ len = xfer->len * BITS_PER_BYTE / xfer->bits_per_word; + else +- len = xfer->len / (mas->cur_bits_per_word / BITS_PER_BYTE + 1); ++ len = xfer->len / (xfer->bits_per_word / BITS_PER_BYTE + 1); + len &= TRANS_LEN_MSK; + + return len; +@@ -571,7 +571,7 @@ static bool geni_can_dma(struct spi_controller *ctlr, + return true; + + len = get_xfer_len_in_words(xfer, mas); +- fifo_size = mas->tx_fifo_depth * mas->fifo_width_bits / mas->cur_bits_per_word; ++ fifo_size = mas->tx_fifo_depth * mas->fifo_width_bits / xfer->bits_per_word; + + if (len > fifo_size) + return true; +-- +2.51.0 + diff --git a/queue-6.6/spi-spi-mem-limit-octal-dtr-constraints-to-octal-dtr.patch b/queue-6.6/spi-spi-mem-limit-octal-dtr-constraints-to-octal-dtr.patch new file mode 100644 index 00000000000..3f837217d3e --- /dev/null +++ b/queue-6.6/spi-spi-mem-limit-octal-dtr-constraints-to-octal-dtr.patch @@ -0,0 +1,62 @@ +From beb02e829f7c743b8944084984d24ed4bc00bc54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jan 2026 18:18:01 +0100 +Subject: spi: spi-mem: Limit octal DTR constraints to octal DTR situations + +From: Miquel Raynal + +[ Upstream commit 8618271887ca10ac5108fe7e1d82ba8f1b152cf9 ] + +In this helper, any operation with a single DTR cycle (like 1S-1S-8D) is +considered requiring a duplicated command opcode. This is wrong as this +constraint only applies to octal DTR operations (8D-8D-8D). + +Narrow the application of this constraint to the concerned bus +interface. + +Note: none of the possible XD-XD-XD pattern, with X being one of {1, 2, +4} would benefit from this check either as there is only in octal DTR +mode that a single clock edge would be enough to transmit the full +opcode. + +Make sure the constraint of expecting two bytes for the command is +applied to the relevant bus interface. + +Reviewed-by: Tudor Ambarus +Signed-off-by: Miquel Raynal +Link: https://patch.msgid.link/20260109-winbond-v6-17-rc1-oddr-v2-3-1fff6a2ddb80@bootlin.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-mem.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c +index c581aa5fbf7cf..e5c4da4c94557 100644 +--- a/drivers/spi/spi-mem.c ++++ b/drivers/spi/spi-mem.c +@@ -175,8 +175,19 @@ bool spi_mem_default_supports_op(struct spi_mem *mem, + if (op->data.swap16 && !spi_mem_controller_is_capable(ctlr, swap16)) + return false; + +- if (op->cmd.nbytes != 2) +- return false; ++ /* Extra 8D-8D-8D limitations */ ++ if (op->cmd.dtr && op->cmd.buswidth == 8) { ++ if (op->cmd.nbytes != 2) ++ return false; ++ ++ if ((op->addr.nbytes % 2) || ++ (op->dummy.nbytes % 2) || ++ (op->data.nbytes % 2)) { ++ dev_err(&ctlr->dev, ++ "Even byte numbers not allowed in octal DTR operations\n"); ++ return false; ++ } ++ } + } else { + if (op->cmd.nbytes != 1) + return false; +-- +2.51.0 + diff --git a/queue-6.6/spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch b/queue-6.6/spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch new file mode 100644 index 00000000000..cb6d4f83be4 --- /dev/null +++ b/queue-6.6/spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch @@ -0,0 +1,60 @@ +From eafd26196a3f8944aa9ac218aa6a53f5355f2db8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 20:30:04 +0800 +Subject: spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end + +From: Chin-Ting Kuo + +[ Upstream commit 53f826ff5e0e3ecb279862ca7cce1491b94bb017 ] + +spi_mem_dirmap_create() may reconfigure controller-wide settings, +which can interfere with concurrent transfers to other devices +sharing the same SPI controller but using different chip selects. + +Wrap the ->dirmap_create() callback with spi_mem_access_start() and +spi_mem_access_end() to serialize access and prevent cross-CS +interference during dirmap creation. + +This patch has been verified on a setup where a SPI TPM is connected +to CS0 of a SPI controller, while a SPI NOR flash is connected to CS1 +of the same controller. Without this patch, spi_mem_dirmap_create() +for the SPI NOR flash interferes with ongoing SPI TPM data transfers, +resulting in failure to create the TPM device. This was tested on an +ASPEED AST2700 EVB. + +Signed-off-by: Chin-Ting Kuo +Reviewed-by: Paul Menzel +Link: https://patch.msgid.link/20260120123005.1392071-2-chin-ting_kuo@aspeedtech.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-mem.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c +index e5c4da4c94557..932992b06022b 100644 +--- a/drivers/spi/spi-mem.c ++++ b/drivers/spi/spi-mem.c +@@ -601,9 +601,18 @@ spi_mem_dirmap_create(struct spi_mem *mem, + + desc->mem = mem; + desc->info = *info; +- if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create) ++ if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create) { ++ ret = spi_mem_access_start(mem); ++ if (ret) { ++ kfree(desc); ++ return ERR_PTR(ret); ++ } ++ + ret = ctlr->mem_ops->dirmap_create(desc); + ++ spi_mem_access_end(mem); ++ } ++ + if (ret) { + desc->nodirmap = true; + if (!spi_mem_supports_op(desc->mem, &desc->info.op_tmpl)) +-- +2.51.0 + diff --git a/queue-6.6/spi-stm32-fix-overrun-issue-at-8bpw.patch b/queue-6.6/spi-stm32-fix-overrun-issue-at-8bpw.patch new file mode 100644 index 00000000000..6cd838c6e1e --- /dev/null +++ b/queue-6.6/spi-stm32-fix-overrun-issue-at-8bpw.patch @@ -0,0 +1,53 @@ +From 0e23ef8ef9eaf3bf03c29602fd125f481e191b7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Dec 2025 11:48:28 +0100 +Subject: spi: stm32: fix Overrun issue at < 8bpw + +From: Deepak Kumar + +[ Upstream commit 1ac3be217c01d5df55ec5052f81e4f1708f46552 ] + +When SPI communication is suspended by hardware automatically, it could +happen that few bits of next frame are already clocked out due to +internal synchronization delay. + +To achieve a safe suspension, we need to ensure that each word must be +at least 8 SPI clock cycles long. That's why, if bpw is less than 8 +bits, we need to use midi to reach 8 SPI clock cycles at least. + +This will ensure that each word achieve safe suspension and prevent +overrun condition. + +Signed-off-by: Deepak Kumar +Signed-off-by: Alain Volmat +Link: https://patch.msgid.link/20251218-stm32-spi-enhancements-v2-2-3b69901ca9fe@foss.st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index 211d9c76665bc..96ee0e8456f4c 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -1507,11 +1507,12 @@ static void stm32h7_spi_data_idleness(struct stm32_spi *spi, u32 len) + cfg2_clrb |= STM32H7_SPI_CFG2_MIDI; + if ((len > 1) && (spi->cur_midi > 0)) { + u32 sck_period_ns = DIV_ROUND_UP(NSEC_PER_SEC, spi->cur_speed); +- u32 midi = min_t(u32, +- DIV_ROUND_UP(spi->cur_midi, sck_period_ns), +- FIELD_GET(STM32H7_SPI_CFG2_MIDI, +- STM32H7_SPI_CFG2_MIDI)); ++ u32 midi = DIV_ROUND_UP(spi->cur_midi, sck_period_ns); + ++ if ((spi->cur_bpw + midi) < 8) ++ midi = 8 - spi->cur_bpw; ++ ++ midi = min_t(u32, midi, FIELD_MAX(STM32H7_SPI_CFG2_MIDI)); + + dev_dbg(spi->dev, "period=%dns, midi=%d(=%dns)\n", + sck_period_ns, midi, midi * sck_period_ns); +-- +2.51.0 + diff --git a/queue-6.6/staging-rtl8723bs-fix-memory-leak-on-failure-path.patch b/queue-6.6/staging-rtl8723bs-fix-memory-leak-on-failure-path.patch new file mode 100644 index 00000000000..6d603d2e0dd --- /dev/null +++ b/queue-6.6/staging-rtl8723bs-fix-memory-leak-on-failure-path.patch @@ -0,0 +1,42 @@ +From e56ae32fc66f43966364e03469e9f1a0a0afa575 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 14:47:12 +0530 +Subject: staging: rtl8723bs: fix memory leak on failure path + +From: Diksha Kumari + +[ Upstream commit abe850d82c8cb72d28700673678724e779b1826e ] + +cfg80211_inform_bss_frame() may return NULL on failure. In that case, +the allocated buffer 'buf' is not freed and the function returns early, +leading to potential memory leak. +Fix this by ensuring that 'buf' is freed on both success and failure paths. + +Signed-off-by: Diksha Kumari +Reviewed-by: Mukesh Kumar Chaurasiya +Link: https://patch.msgid.link/20260113091712.7071-1-dikshakdevgan@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +index af155fca39b8c..f23aeb58d041d 100644 +--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c ++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +@@ -316,9 +316,10 @@ struct cfg80211_bss *rtw_cfg80211_inform_bss(struct adapter *padapter, struct wl + len, notify_signal, GFP_ATOMIC); + + if (unlikely(!bss)) +- goto exit; ++ goto free_buf; + + cfg80211_put_bss(wiphy, bss); ++free_buf: + kfree(buf); + + exit: +-- +2.51.0 + diff --git a/queue-6.6/staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch b/queue-6.6/staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch new file mode 100644 index 00000000000..96cd3504799 --- /dev/null +++ b/queue-6.6/staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch @@ -0,0 +1,44 @@ +From 963084e0b8a7b1614b732b033baa32ea3957906c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 17:27:28 +0800 +Subject: staging: rtl8723bs: fix missing status update on sdio_alloc_irq() + failure + +From: Liang Jie + +[ Upstream commit 618b4aec12faabc7579a6b0df046842d798a4c7c ] + +The return value of sdio_alloc_irq() was not stored in status. +If sdio_alloc_irq() fails after rtw_drv_register_netdev() succeeds, +status remains _SUCCESS and the error path skips resource cleanup, +while rtw_drv_init() still returns success. + +Store the return value of sdio_alloc_irq() in status and reuse the +existing error handling which relies on status. + +Reviewed-by: fanggeng +Signed-off-by: Liang Jie +Link: https://patch.msgid.link/20251208092730.262499-1-buaajxlj@163.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c +index 4904314845242..335e6002df70f 100644 +--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c ++++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c +@@ -380,7 +380,8 @@ static int rtw_drv_init( + if (status != _SUCCESS) + goto free_if1; + +- if (sdio_alloc_irq(dvobj) != _SUCCESS) ++ status = sdio_alloc_irq(dvobj); ++ if (status != _SUCCESS) + goto free_if1; + + rtw_ndev_notifier_register(); +-- +2.51.0 + diff --git a/queue-6.6/thermal-int340x-fix-sysfs-group-leak-on-dlvr-registr.patch b/queue-6.6/thermal-int340x-fix-sysfs-group-leak-on-dlvr-registr.patch new file mode 100644 index 00000000000..13f18defb9d --- /dev/null +++ b/queue-6.6/thermal-int340x-fix-sysfs-group-leak-on-dlvr-registr.patch @@ -0,0 +1,45 @@ +From 78bb128948593b0d8b229dc79a13eae3a4e74e87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Feb 2026 08:23:15 +0000 +Subject: thermal: int340x: Fix sysfs group leak on DLVR registration failure + +From: Kaushlendra Kumar + +[ Upstream commit 15176b818e048ccf6ef4b96db34eda7b7e98938a ] + +When DLVR sysfs group creation fails in proc_thermal_rfim_add(), +the function returns immediately without cleaning up the FIVR group +that may have been created earlier. + +Add proper error unwinding to remove the FIVR group before returning +failure. + +Signed-off-by: Kaushlendra Kumar +Acked-by: Srinivas Pandruvada +Link: https://patch.msgid.link/LV3PR11MB876881B77D32A2854AD2908EF563A@LV3PR11MB8768.namprd11.prod.outlook.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + .../thermal/intel/int340x_thermal/processor_thermal_rfim.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c +index 546b70434004c..8bcac4adb9ece 100644 +--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c ++++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c +@@ -348,8 +348,11 @@ int proc_thermal_rfim_add(struct pci_dev *pdev, struct proc_thermal_device *proc + + if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_DLVR) { + ret = sysfs_create_group(&pdev->dev.kobj, &dlvr_attribute_group); +- if (ret) ++ if (ret) { ++ if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_FIVR) ++ sysfs_remove_group(&pdev->dev.kobj, &fivr_attribute_group); + return ret; ++ } + } + + if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_DVFS) { +-- +2.51.0 + diff --git a/queue-6.6/tools-power-cpupower-reset-errno-before-strtoull.patch b/queue-6.6/tools-power-cpupower-reset-errno-before-strtoull.patch new file mode 100644 index 00000000000..4f77db304b0 --- /dev/null +++ b/queue-6.6/tools-power-cpupower-reset-errno-before-strtoull.patch @@ -0,0 +1,37 @@ +From 4d258ce58fc2fcaaf05101d7d23bfde9a03f17cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 17:47:45 +0530 +Subject: tools/power cpupower: Reset errno before strtoull() + +From: Kaushlendra Kumar + +[ Upstream commit f9bd3762cf1bd0c2465f2e6121b340883471d1bf ] + +cpuidle_state_get_one_value() never cleared errno before calling +strtoull(), so a prior ERANGE caused every cpuidle counter read to +return zero. Reset errno to 0 before the conversion so each sysfs read +is evaluated independently. + +Link: https://lore.kernel.org/r/20251201121745.3776703-1-kaushlendra.kumar@intel.com +Signed-off-by: Kaushlendra Kumar +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/power/cpupower/lib/cpuidle.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c +index c15d0de12357f..e7b8c56638370 100644 +--- a/tools/power/cpupower/lib/cpuidle.c ++++ b/tools/power/cpupower/lib/cpuidle.c +@@ -148,6 +148,7 @@ unsigned long long cpuidle_state_get_one_value(unsigned int cpu, + if (len == 0) + return 0; + ++ errno = 0; + value = strtoull(linebuf, &endp, 0); + + if (endp == linebuf || errno == ERANGE) +-- +2.51.0 + diff --git a/queue-6.6/tracing-fix-false-sharing-in-hwlat-get_sample.patch b/queue-6.6/tracing-fix-false-sharing-in-hwlat-get_sample.patch new file mode 100644 index 00000000000..07ecb593573 --- /dev/null +++ b/queue-6.6/tracing-fix-false-sharing-in-hwlat-get_sample.patch @@ -0,0 +1,113 @@ +From 13ca0f679e4b4bfa428b6640bbe157b75479d5eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Feb 2026 23:48:10 -0800 +Subject: tracing: Fix false sharing in hwlat get_sample() + +From: Colin Lord + +[ Upstream commit f743435f988cb0cf1f521035aee857851b25e06d ] + +The get_sample() function in the hwlat tracer assumes the caller holds +hwlat_data.lock, but this is not actually happening. The result is +unprotected data access to hwlat_data, and in per-cpu mode can result in +false sharing which may show up as false positive latency events. + +The specific case of false sharing observed was primarily between +hwlat_data.sample_width and hwlat_data.count. These are separated by +just 8B and are therefore likely to share a cache line. When one thread +modifies count, the cache line is in a modified state so when other +threads read sample_width in the main latency detection loop, they fetch +the modified cache line. On some systems, the fetch itself may be slow +enough to count as a latency event, which could set up a self +reinforcing cycle of latency events as each event increments count which +then causes more latency events, continuing the cycle. + +The other result of the unprotected data access is that hwlat_data.count +can end up with duplicate or missed values, which was observed on some +systems in testing. + +Convert hwlat_data.count to atomic64_t so it can be safely modified +without locking, and prevent false sharing by pulling sample_width into +a local variable. + +One system this was tested on was a dual socket server with 32 CPUs on +each numa node. With settings of 1us threshold, 1000us width, and +2000us window, this change reduced the number of latency events from +500 per second down to approximately 1 event per minute. Some machines +tested did not exhibit measurable latency from the false sharing. + +Cc: Masami Hiramatsu +Cc: Mathieu Desnoyers +Link: https://patch.msgid.link/20260210074810.6328-1-clord@mykolab.com +Signed-off-by: Colin Lord +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_hwlat.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c +index 3bd6071441ade..bc437b6ce8969 100644 +--- a/kernel/trace/trace_hwlat.c ++++ b/kernel/trace/trace_hwlat.c +@@ -102,9 +102,9 @@ struct hwlat_sample { + /* keep the global state somewhere. */ + static struct hwlat_data { + +- struct mutex lock; /* protect changes */ ++ struct mutex lock; /* protect changes */ + +- u64 count; /* total since reset */ ++ atomic64_t count; /* total since reset */ + + u64 sample_window; /* total sampling window (on+off) */ + u64 sample_width; /* active sampling portion of window */ +@@ -195,8 +195,7 @@ void trace_hwlat_callback(bool enter) + * get_sample - sample the CPU TSC and look for likely hardware latencies + * + * Used to repeatedly capture the CPU TSC (or similar), looking for potential +- * hardware-induced latency. Called with interrupts disabled and with +- * hwlat_data.lock held. ++ * hardware-induced latency. Called with interrupts disabled. + */ + static int get_sample(void) + { +@@ -206,6 +205,7 @@ static int get_sample(void) + time_type start, t1, t2, last_t2; + s64 diff, outer_diff, total, last_total = 0; + u64 sample = 0; ++ u64 sample_width = READ_ONCE(hwlat_data.sample_width); + u64 thresh = tracing_thresh; + u64 outer_sample = 0; + int ret = -1; +@@ -269,7 +269,7 @@ static int get_sample(void) + if (diff > sample) + sample = diff; /* only want highest value */ + +- } while (total <= hwlat_data.sample_width); ++ } while (total <= sample_width); + + barrier(); /* finish the above in the view for NMIs */ + trace_hwlat_callback_enabled = false; +@@ -287,8 +287,7 @@ static int get_sample(void) + if (kdata->nmi_total_ts) + do_div(kdata->nmi_total_ts, NSEC_PER_USEC); + +- hwlat_data.count++; +- s.seqnum = hwlat_data.count; ++ s.seqnum = atomic64_inc_return(&hwlat_data.count); + s.duration = sample; + s.outer_duration = outer_sample; + s.nmi_total_ts = kdata->nmi_total_ts; +@@ -837,7 +836,7 @@ static int hwlat_tracer_init(struct trace_array *tr) + + hwlat_trace = tr; + +- hwlat_data.count = 0; ++ atomic64_set(&hwlat_data.count, 0); + tr->max_latency = 0; + save_tracing_thresh = tracing_thresh; + +-- +2.51.0 + diff --git a/queue-6.6/usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch b/queue-6.6/usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch new file mode 100644 index 00000000000..36e7ac65b81 --- /dev/null +++ b/queue-6.6/usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch @@ -0,0 +1,122 @@ +From d4bbfb7b0147bd5523e5e14e68c32834e8b7ad1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 17:48:48 +0000 +Subject: usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs + +From: Benson Leung + +[ Upstream commit 6811e0a08bdce6b2767414caf17fda24c2e4e032 ] + +ucsi_psy_get_voltage_max and ucsi_psy_get_current_max are calculated +using whichever pdo is in the last position of the src_pdos array, presuming +it to be a fixed pdo, so the pdo_fixed_voltage or pdo_max_current +helpers are used on that last pdo. + +However, non-Fixed PDOs such as Battery PDOs, Augmented PDOs (used for AVS and +for PPS) may exist, and are always at the end of the array if they do. +In the event one of these more advanced chargers are attached the helpers for +fixed return mangled values. + +Here's an example case of a Google Pixel Flex Dual Port 67W USB-C Fast Charger +with PPS support: +POWER_SUPPLY_NAME=ucsi-source-psy-cros_ec_ucsi.4.auto2 +POWER_SUPPLY_TYPE=USB +POWER_SUPPLY_CHARGE_TYPE=Standard +POWER_SUPPLY_USB_TYPE=C [PD] PD_PPS PD_DRP +POWER_SUPPLY_ONLINE=1 +POWER_SUPPLY_VOLTAGE_MIN=5000000 +POWER_SUPPLY_VOLTAGE_MAX=13400000 +POWER_SUPPLY_VOLTAGE_NOW=20000000 +POWER_SUPPLY_CURRENT_MAX=5790000 +POWER_SUPPLY_CURRENT_NOW=3250000 + +Voltage Max is reading as 13.4V, but that's an incorrect decode of the PPS +APDO in the last position. Same goes for CURRENT_MAX. 5.79A is incorrect. + +Instead, enumerate through the src_pdos and filter just for Fixed PDOs for +now, and find the one with the highest voltage and current respectively. + +After, from the same charger: +POWER_SUPPLY_NAME=ucsi-source-psy-cros_ec_ucsi.4.auto2 +POWER_SUPPLY_TYPE=USB +POWER_SUPPLY_CHARGE_TYPE=Standard +POWER_SUPPLY_USB_TYPE=C [PD] PD_PPS PD_DRP +POWER_SUPPLY_ONLINE=1 +POWER_SUPPLY_VOLTAGE_MIN=5000000 +POWER_SUPPLY_VOLTAGE_MAX=20000000 +POWER_SUPPLY_VOLTAGE_NOW=20000000 +POWER_SUPPLY_CURRENT_MAX=4000000 +POWER_SUPPLY_CURRENT_NOW=3250000 + +Signed-off-by: Benson Leung +Reviewed-by: Heikki Krogerus +Link: https://patch.msgid.link/20251208174918.289394-3-bleung@chromium.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/ucsi/psy.c | 30 ++++++++++++++++++++---------- + 1 file changed, 20 insertions(+), 10 deletions(-) + +diff --git a/drivers/usb/typec/ucsi/psy.c b/drivers/usb/typec/ucsi/psy.c +index c80c23d3384e8..3fc524190baf6 100644 +--- a/drivers/usb/typec/ucsi/psy.c ++++ b/drivers/usb/typec/ucsi/psy.c +@@ -87,15 +87,20 @@ static int ucsi_psy_get_voltage_max(struct ucsi_connector *con, + union power_supply_propval *val) + { + u32 pdo; ++ int max_voltage = 0; + + switch (UCSI_CONSTAT_PWR_OPMODE(con->status.flags)) { + case UCSI_CONSTAT_PWR_OPMODE_PD: +- if (con->num_pdos > 0) { +- pdo = con->src_pdos[con->num_pdos - 1]; +- val->intval = pdo_fixed_voltage(pdo) * 1000; +- } else { +- val->intval = 0; ++ for (int i = 0; i < con->num_pdos; i++) { ++ int pdo_voltage = 0; ++ ++ pdo = con->src_pdos[i]; ++ if (pdo_type(pdo) == PDO_TYPE_FIXED) ++ pdo_voltage = pdo_fixed_voltage(pdo) * 1000; ++ max_voltage = (pdo_voltage > max_voltage) ? pdo_voltage ++ : max_voltage; + } ++ val->intval = max_voltage; + break; + case UCSI_CONSTAT_PWR_OPMODE_TYPEC3_0: + case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5: +@@ -143,6 +148,7 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con, + union power_supply_propval *val) + { + u32 pdo; ++ int max_current = 0; + + if (!(con->status.flags & UCSI_CONSTAT_CONNECTED)) { + val->intval = 0; +@@ -151,12 +157,16 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con, + + switch (UCSI_CONSTAT_PWR_OPMODE(con->status.flags)) { + case UCSI_CONSTAT_PWR_OPMODE_PD: +- if (con->num_pdos > 0) { +- pdo = con->src_pdos[con->num_pdos - 1]; +- val->intval = pdo_max_current(pdo) * 1000; +- } else { +- val->intval = 0; ++ for (int i = 0; i < con->num_pdos; i++) { ++ int pdo_current = 0; ++ ++ pdo = con->src_pdos[i]; ++ if (pdo_type(pdo) == PDO_TYPE_FIXED) ++ pdo_current = pdo_max_current(pdo) * 1000; ++ max_current = (pdo_current > max_current) ? pdo_current ++ : max_current; + } ++ val->intval = max_current; + break; + case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5: + val->intval = UCSI_TYPEC_1_5_CURRENT * 1000; +-- +2.51.0 + diff --git a/queue-6.6/vhost-fix-caching-attributes-of-mmio-regions-by-sett.patch b/queue-6.6/vhost-fix-caching-attributes-of-mmio-regions-by-sett.patch new file mode 100644 index 00000000000..d285df01592 --- /dev/null +++ b/queue-6.6/vhost-fix-caching-attributes-of-mmio-regions-by-sett.patch @@ -0,0 +1,42 @@ +From 2678ee24870ff0a5bba0d972424b5bdf231af258 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jan 2026 12:27:03 +0530 +Subject: vhost: fix caching attributes of MMIO regions by setting them + explicitly + +From: Kommula Shiva Shankar + +[ Upstream commit 5145b277309f3818e2db507f525d19ac3b910922 ] + +Explicitly set non-cached caching attributes for MMIO regions. +Default write-back mode can cause CPU to cache device memory, +causing invalid reads and unpredictable behavior. + +Invalid read and write issues were observed on ARM64 when mapping the +notification area to userspace via mmap. + +Signed-off-by: Kommula Shiva Shankar +Acked-by: Jason Wang +Reviewed-by: Jason Gunthorpe +Signed-off-by: Michael S. Tsirkin +Message-Id: <20260102065703.656255-1-kshankar@marvell.com> +Signed-off-by: Sasha Levin +--- + drivers/vhost/vdpa.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c +index c29a195a0175c..f4da76fa235ea 100644 +--- a/drivers/vhost/vdpa.c ++++ b/drivers/vhost/vdpa.c +@@ -1424,6 +1424,7 @@ static int vhost_vdpa_mmap(struct file *file, struct vm_area_struct *vma) + if (vma->vm_end - vma->vm_start != notify.size) + return -ENOTSUPP; + ++ vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); + vm_flags_set(vma, VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP); + vma->vm_ops = &vhost_vdpa_vm_ops; + return 0; +-- +2.51.0 + diff --git a/queue-6.6/virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch b/queue-6.6/virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch new file mode 100644 index 00000000000..86ae0e917c6 --- /dev/null +++ b/queue-6.6/virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch @@ -0,0 +1,75 @@ +From 91be1b29c4bb7e3275b130a100a0d6eb7f423ec2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 08:35:45 +0100 +Subject: virt: vbox: uapi: Mark inner unions in packed structs as packed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit c25d01e1c4f2d43f47af87c00e223f5ca7c71792 ] + +The unpacked unions within a packed struct generates alignment warnings +on clang for 32-bit ARM: + +./usr/include/linux/vbox_vmmdev_types.h:239:4: error: field u within 'struct vmmdev_hgcm_function_parameter32' + is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:223:2)' + and is usually due to 'struct vmmdev_hgcm_function_parameter32' being packed, + which can lead to unaligned accesses [-Werror,-Wunaligned-access] + 239 | } u; + | ^ + +./usr/include/linux/vbox_vmmdev_types.h:254:6: error: field u within + 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)' + is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:251:4)' and is usually due to + 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)' + being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] + +With the recent changes to compile-test the UAPI headers in more cases, +these warning in combination with CONFIG_WERROR breaks the build. + +Fix the warnings. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/ +Reported-by: Nathan Chancellor +Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/ +Suggested-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/ +Signed-off-by: Thomas Weißschuh +Tested-by: Nicolas Schier +Reviewed-by: Nicolas Schier +Acked-by: Greg Kroah-Hartman +Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-2-076aed1623ff@linutronix.de +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + include/uapi/linux/vbox_vmmdev_types.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/uapi/linux/vbox_vmmdev_types.h b/include/uapi/linux/vbox_vmmdev_types.h +index f8a8d6b3c5219..436678d4fb24f 100644 +--- a/include/uapi/linux/vbox_vmmdev_types.h ++++ b/include/uapi/linux/vbox_vmmdev_types.h +@@ -236,7 +236,7 @@ struct vmmdev_hgcm_function_parameter32 { + /** Relative to the request header. */ + __u32 offset; + } page_list; +- } u; ++ } __packed u; + } __packed; + VMMDEV_ASSERT_SIZE(vmmdev_hgcm_function_parameter32, 4 + 8); + +@@ -251,7 +251,7 @@ struct vmmdev_hgcm_function_parameter64 { + union { + __u64 phys_addr; + __u64 linear_addr; +- } u; ++ } __packed u; + } __packed pointer; + struct { + /** Size of the buffer described by the page list. */ +-- +2.51.0 + diff --git a/queue-6.6/vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch b/queue-6.6/vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch new file mode 100644 index 00000000000..01dafcc818e --- /dev/null +++ b/queue-6.6/vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch @@ -0,0 +1,62 @@ +From 1587c10c52e00c6675c56a2f389ff235fc580955 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 17:34:00 +0100 +Subject: vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 + +From: Arnd Bergmann + +[ Upstream commit e25dbf561e03c0c5e36228e3b8b784392819ce85 ] + +The gcc-16.0.1 snapshot produces a false-positive warning that turns +into a build failure with CONFIG_WERROR: + +In file included from arch/x86/include/asm/string.h:6, + from net/vmw_vsock/vmci_transport.c:10: +In function 'vmci_transport_packet_init', + inlined from '__vmci_transport_send_control_pkt.constprop' at net/vmw_vsock/vmci_transport.c:198:2: +arch/x86/include/asm/string_32.h:150:25: error: argument 2 null where non-null expected because argument 3 is nonzero [-Werror=nonnull] + 150 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n) + | ^~~~~~~~~~~~~~~~~~~~~~~~~ +net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy' + 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait)); + | ^~~~~~ +arch/x86/include/asm/string_32.h:150:25: note: in a call to built-in function '__builtin_memcpy' +net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy' + 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait)); + | ^~~~~~ + +This seems relatively harmless, and it so far the only instance of this +warning I have found. The __vmci_transport_send_control_pkt function +is called either with wait=NULL or with one of the type values that +pass 'wait' into memcpy() here, but not from the same caller. + +Replacing the memcpy with a struct assignment is otherwise the same +but avoids the warning. + +Signed-off-by: Arnd Bergmann +Reviewed-by: Bobby Eshleman +Reviewed-by: Stefano Garzarella +Reviewed-by: Bryan Tan +Link: https://patch.msgid.link/20260203163406.2636463-1-arnd@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/vmw_vsock/vmci_transport.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c +index 7eccd6708d664..aca3132689cf1 100644 +--- a/net/vmw_vsock/vmci_transport.c ++++ b/net/vmw_vsock/vmci_transport.c +@@ -161,7 +161,7 @@ vmci_transport_packet_init(struct vmci_transport_packet *pkt, + + case VMCI_TRANSPORT_PACKET_TYPE_WAITING_READ: + case VMCI_TRANSPORT_PACKET_TYPE_WAITING_WRITE: +- memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait)); ++ pkt->u.wait = *wait; + break; + + case VMCI_TRANSPORT_PACKET_TYPE_REQUEST2: +-- +2.51.0 + diff --git a/queue-6.6/watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch b/queue-6.6/watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch new file mode 100644 index 00000000000..3c6b912c60a --- /dev/null +++ b/queue-6.6/watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch @@ -0,0 +1,40 @@ +From 234735917b65564d577264b7623337332376649f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Nov 2025 22:24:33 +0200 +Subject: watchdog: imx7ulp_wdt: handle the nowayout option + +From: Oleksandr Suvorov + +[ Upstream commit d303d37ef5cf86c8c3b2daefd2a7d7fd8ca1ec14 ] + +The module parameter `nowayout` indicates whether the watchdog should ever +be allowed to stop, but the driver currently ignores this option. + +Pass the `nowayout` parameter to the watchdog core by setting the +WDOG_NO_WAY_OUT flag accordingly. + +Signed-off-by: Oleksandr Suvorov +Reviewed-by: Guenter Roeck +Reviewed-by: Frank Li +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/imx7ulp_wdt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/watchdog/imx7ulp_wdt.c b/drivers/watchdog/imx7ulp_wdt.c +index c703586c6e5f0..b6797845a48fb 100644 +--- a/drivers/watchdog/imx7ulp_wdt.c ++++ b/drivers/watchdog/imx7ulp_wdt.c +@@ -342,6 +342,7 @@ static int imx7ulp_wdt_probe(struct platform_device *pdev) + watchdog_stop_on_reboot(wdog); + watchdog_stop_on_unregister(wdog); + watchdog_set_drvdata(wdog, imx7ulp_wdt); ++ watchdog_set_nowayout(wdog, nowayout); + + imx7ulp_wdt->hw = of_device_get_match_data(dev); + ret = imx7ulp_wdt_init(imx7ulp_wdt, wdog->timeout * imx7ulp_wdt->hw->wdog_clock_rate); +-- +2.51.0 + diff --git a/queue-6.6/wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch b/queue-6.6/wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch new file mode 100644 index 00000000000..7fc9e027e99 --- /dev/null +++ b/queue-6.6/wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch @@ -0,0 +1,59 @@ +From e81507abddd3a390ae4b5697ae6c88210b9fc730 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 17:56:11 +0000 +Subject: wifi: ath10k: fix lock protection in + ath10k_wmi_event_peer_sta_ps_state_chg() + +From: Ziyi Guo + +[ Upstream commit 820ba7dd6859ef8b1eaf6014897e7aa4756fc65d ] + +ath10k_wmi_event_peer_sta_ps_state_chg() uses lockdep_assert_held() to +assert that ar->data_lock should be held by the caller, but neither +ath10k_wmi_10_2_op_rx() nor ath10k_wmi_10_4_op_rx() acquire this lock +before calling this function. + +The field arsta->peer_ps_state is documented as protected by +ar->data_lock in core.h, and other accessors (ath10k_peer_ps_state_disable, +ath10k_dbg_sta_read_peer_ps_state) properly acquire this lock. + +Add spin_lock_bh()/spin_unlock_bh() around the peer_ps_state update, +and remove the lockdep_assert_held() to be aligned with new locking, +following the pattern used by other WMI event handlers in the driver. + +Signed-off-by: Ziyi Guo +Reviewed-by: Baochen Qiang +Link: https://patch.msgid.link/20260123175611.767731-1-n7l8m4@u.northwestern.edu +[removed excess blank line] +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/wmi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c +index c7c96d210061d..ee41f45b3426c 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -5283,8 +5283,6 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb) + struct ath10k_sta *arsta; + u8 peer_addr[ETH_ALEN]; + +- lockdep_assert_held(&ar->data_lock); +- + ev = (struct wmi_peer_sta_ps_state_chg_event *)skb->data; + ether_addr_copy(peer_addr, ev->peer_macaddr.addr); + +@@ -5299,7 +5297,9 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb) + } + + arsta = (struct ath10k_sta *)sta->drv_priv; ++ spin_lock_bh(&ar->data_lock); + arsta->peer_ps_state = __le32_to_cpu(ev->peer_ps_state); ++ spin_unlock_bh(&ar->data_lock); + + exit: + rcu_read_unlock(); +-- +2.51.0 + diff --git a/queue-6.6/wifi-ath11k-add-pm-quirk-for-thinkpad-z13-z16-gen1.patch b/queue-6.6/wifi-ath11k-add-pm-quirk-for-thinkpad-z13-z16-gen1.patch new file mode 100644 index 00000000000..d5b6f31c702 --- /dev/null +++ b/queue-6.6/wifi-ath11k-add-pm-quirk-for-thinkpad-z13-z16-gen1.patch @@ -0,0 +1,72 @@ +From 6a1c5990b7bd3160e28dd38ffe3eb1413cc477b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Jan 2026 17:00:34 -0800 +Subject: wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 + +From: Ross Vandegrift + +[ Upstream commit 4015b1972763d7d513172276e51439f37e622a92 ] + +Z16 Gen1 has the wakeup-from-suspend issues from [1] but was never added +to the appropriate quirk list. I've tested this patch on top of 6.18.2, +it fixes the issue for me on 21D4 + +Mark Pearson provided the other product IDs covering the second Z16 Gen1 +and both Z13 Gen1 identifiers. They share the same firmware, and folks +in the bugzilla report do indeed see the problem on Z13. + +[1] - https://bugzilla.kernel.org/show_bug.cgi?id=219196 + +Signed-off-by: Ross Vandegrift +Reviewed-by: Baochen Qiang +Tested-by: Mark Pearson +Reviewed-by: Mark Pearson +Link: https://patch.msgid.link/wj7o2kmb7g54stdjvxp2hjqrnutnq3jbf4s2uh4ctvmlxdq7tf@nbkj2ebakhrd +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/core.c | 28 ++++++++++++++++++++++++++ + 1 file changed, 28 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c +index 355424baeedde..9eb8887f84e7e 100644 +--- a/drivers/net/wireless/ath/ath11k/core.c ++++ b/drivers/net/wireless/ath/ath11k/core.c +@@ -789,6 +789,34 @@ static const struct dmi_system_id ath11k_pm_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "21F9"), + }, + }, ++ { ++ .driver_data = (void *)ATH11K_PM_WOW, ++ .matches = { /* Z13 G1 */ ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21D2"), ++ }, ++ }, ++ { ++ .driver_data = (void *)ATH11K_PM_WOW, ++ .matches = { /* Z13 G1 */ ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21D3"), ++ }, ++ }, ++ { ++ .driver_data = (void *)ATH11K_PM_WOW, ++ .matches = { /* Z16 G1 */ ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21D4"), ++ }, ++ }, ++ { ++ .driver_data = (void *)ATH11K_PM_WOW, ++ .matches = { /* Z16 G1 */ ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21D5"), ++ }, ++ }, + {} + }; + +-- +2.51.0 + diff --git a/queue-6.6/wifi-ath12k-fix-preferred-hardware-mode-calculation.patch b/queue-6.6/wifi-ath12k-fix-preferred-hardware-mode-calculation.patch new file mode 100644 index 00000000000..b6619d8eb9d --- /dev/null +++ b/queue-6.6/wifi-ath12k-fix-preferred-hardware-mode-calculation.patch @@ -0,0 +1,50 @@ +From 702f59b1e36a48e74841aa2db176c281b4801947 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jan 2026 15:36:24 +0800 +Subject: wifi: ath12k: fix preferred hardware mode calculation + +From: Baochen Qiang + +[ Upstream commit 7f852de0003219c431a6f2ffd951fd82a4673660 ] + +For single pdev device like WCN7850/QCC2072, preferred_hw_mode is +initialized to WMI_HOST_HW_MODE_SINGLE. Later when firmware sends +supported modes to host, each mode is compared with the initial one +and if the priority of the new mode is higher, update the parameter +and store mode capability. + +For WCN7850, this does not result in issue, as one of the supported +mode indeed has a higher priority. However the only available mode of +QCC2072 at this stage is WMI_HOST_HW_MODE_SINGLE, which fails the +comparison, hence mode capability is not stored. Subsequently driver +initialization fails. + +Fix it by accepting a mode with the same priority. + +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 + +Signed-off-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-4-fc8ce1e43969@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/wmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c +index 7e400a0e0eb11..fe920ecd25baf 100644 +--- a/drivers/net/wireless/ath/ath12k/wmi.c ++++ b/drivers/net/wireless/ath/ath12k/wmi.c +@@ -3804,7 +3804,7 @@ static int ath12k_wmi_hw_mode_caps(struct ath12k_base *soc, + + pref = soc->wmi_ab.preferred_hw_mode; + +- if (ath12k_hw_mode_pri_map[mode] < ath12k_hw_mode_pri_map[pref]) { ++ if (ath12k_hw_mode_pri_map[mode] <= ath12k_hw_mode_pri_map[pref]) { + svc_rdy_ext->pref_hw_mode_caps = *hw_mode_caps; + soc->wmi_ab.preferred_hw_mode = mode; + } +-- +2.51.0 + diff --git a/queue-6.6/wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch b/queue-6.6/wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch new file mode 100644 index 00000000000..52fa492204f --- /dev/null +++ b/queue-6.6/wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch @@ -0,0 +1,48 @@ +From afe52c5c5a0613d1d05c380957e939060c910676 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 19:30:05 +0000 +Subject: wifi: iwlegacy: add missing mutex protection in + il3945_store_measurement() + +From: Ziyi Guo + +[ Upstream commit 4dd1dda65265ecbc9f43ffc08e333684cf715152 ] + +il3945_store_measurement() calls il3945_get_measurement() which internally +calls il_send_cmd_sync() without holding il->mutex. However, +il_send_cmd_sync() has lockdep_assert_held(&il->mutex) indicating that +callers must hold this lock. + +Other sysfs store functions in the same file properly acquire the mutex: +- il3945_store_flags() acquires mutex at 3945-mac.c:3110 +- il3945_store_filter_flags() acquires mutex at 3945-mac.c:3144 + +Add mutex_lock()/mutex_unlock() around the il3945_get_measurement() call +in the sysfs store function to fix the missing lock protection. + +Signed-off-by: Ziyi Guo +Acked-by: Stanislaw Gruszka +Link: https://patch.msgid.link/20260125193005.1090429-1-n7l8m4@u.northwestern.edu +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlegacy/3945-mac.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c +index 9eaf5ec133f9e..5d61cebbdc400 100644 +--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c ++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c +@@ -3262,7 +3262,9 @@ il3945_store_measurement(struct device *d, struct device_attribute *attr, + + D_INFO("Invoking measurement of type %d on " "channel %d (for '%s')\n", + type, params.channel, buf); ++ mutex_lock(&il->mutex); + il3945_get_measurement(il, ¶ms, type); ++ mutex_unlock(&il->mutex); + + return count; + } +-- +2.51.0 + diff --git a/queue-6.6/wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch b/queue-6.6/wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch new file mode 100644 index 00000000000..0de96426f79 --- /dev/null +++ b/queue-6.6/wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch @@ -0,0 +1,49 @@ +From 734cbabd0e800442174b88ceeaa4138823d0431e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jan 2026 19:40:39 +0000 +Subject: wifi: iwlegacy: add missing mutex protection in + il4965_store_tx_power() + +From: Ziyi Guo + +[ Upstream commit e31fa691d0b1c07b6094a6cf0cce894192c462b3 ] + +il4965_store_tx_power() calls il_set_tx_power() without holding il->mutex. +However, il_set_tx_power() has lockdep_assert_held(&il->mutex) indicating +that callers must hold this lock. + +All other callers of il_set_tx_power() properly acquire the mutex: +- il_bg_scan_completed() acquires mutex at common.c:1683 +- il_mac_config() acquires mutex at common.c:5006 +- il3945_commit_rxon() and il4965_commit_rxon() are called via work + queues that hold the mutex (like il4965_bg_alive_start) + +Add mutex_lock()/mutex_unlock() around the il_set_tx_power() call in +the sysfs store function to fix the missing lock protection. + +Signed-off-by: Ziyi Guo +Acked-by: Stanislaw Gruszka +Link: https://patch.msgid.link/20260125194039.1196488-1-n7l8m4@u.northwestern.edu +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c +index 75118e2406191..b345fa2256341 100644 +--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c ++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c +@@ -4612,7 +4612,9 @@ il4965_store_tx_power(struct device *d, struct device_attribute *attr, + if (ret) + IL_INFO("%s is not in decimal form.\n", buf); + else { ++ mutex_lock(&il->mutex); + ret = il_set_tx_power(il, val, false); ++ mutex_unlock(&il->mutex); + if (ret) + IL_ERR("failed setting tx power (0x%08x).\n", ret); + else +-- +2.51.0 + diff --git a/queue-6.6/wifi-iwlwifi-mvm-check-the-validity-of-noa_len.patch b/queue-6.6/wifi-iwlwifi-mvm-check-the-validity-of-noa_len.patch new file mode 100644 index 00000000000..55a1d987e4a --- /dev/null +++ b/queue-6.6/wifi-iwlwifi-mvm-check-the-validity-of-noa_len.patch @@ -0,0 +1,48 @@ +From 720eae6154ce7178d8753c5fb8ff99509290f21c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 15:02:15 +0200 +Subject: wifi: iwlwifi: mvm: check the validity of noa_len + +From: Miri Korenblit + +[ Upstream commit 1e3fb3c4a8e6c581d0f4533dba887fabf53d607d ] + +Validate iwl_probe_resp_data_notif::noa_attr::len_low since we are using +its value to determine the noa_len, which is later used for the NoA +attribute. + +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20251110150012.99b663d9b424.I206fd54c990ca9e1160b9b94fa8be44e67bcc1b9@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c +index 9c97691e60384..60472c89fca38 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c +@@ -1722,6 +1722,20 @@ void iwl_mvm_probe_resp_data_notif(struct iwl_mvm *mvm, + + mvmvif = iwl_mvm_vif_from_mac80211(vif); + ++ /* ++ * len_low should be 2 + n*13 (where n is the number of descriptors. ++ * 13 is the size of a NoA descriptor). We can have either one or two ++ * descriptors. ++ */ ++ if (IWL_FW_CHECK(mvm, notif->noa_active && ++ notif->noa_attr.len_low != 2 + ++ sizeof(struct ieee80211_p2p_noa_desc) && ++ notif->noa_attr.len_low != 2 + ++ sizeof(struct ieee80211_p2p_noa_desc) * 2, ++ "Invalid noa_attr.len_low (%d)\n", ++ notif->noa_attr.len_low)) ++ return; ++ + new_data = kzalloc(sizeof(*new_data), GFP_KERNEL); + if (!new_data) + return; +-- +2.51.0 + diff --git a/queue-6.6/wifi-libertas-fix-warning-in-usb_tx_block.patch b/queue-6.6/wifi-libertas-fix-warning-in-usb_tx_block.patch new file mode 100644 index 00000000000..de9e8ef7da3 --- /dev/null +++ b/queue-6.6/wifi-libertas-fix-warning-in-usb_tx_block.patch @@ -0,0 +1,44 @@ +From b130a0faf3795c2e244c2df9588eeadca38b02ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Dec 2025 16:58:06 +0100 +Subject: wifi: libertas: fix WARNING in usb_tx_block + +From: Szymon Wilczek + +[ Upstream commit d66676e6ca96bf8680f869a9bd6573b26c634622 ] + +The function usb_tx_block() submits cardp->tx_urb without ensuring that +any previous transmission on this URB has completed. If a second call +occurs while the URB is still active (e.g. during rapid firmware loading), +usb_submit_urb() detects the active state and triggers a warning: +'URB submitted while active'. + +Fix this by enforcing serialization: call usb_kill_urb() before +submitting the new request. This ensures the URB is idle and safe to reuse. + +Reported-by: syzbot+67969ab6a2551c27f71b@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=67969ab6a2551c27f71b +Signed-off-by: Szymon Wilczek +Link: https://patch.msgid.link/20251221155806.23925-1-swilczek.lx@gmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/libertas/if_usb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c +index 2240b4db8c036..d98c81539ba53 100644 +--- a/drivers/net/wireless/marvell/libertas/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas/if_usb.c +@@ -426,6 +426,8 @@ static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload, uint16_t nb + goto tx_ret; + } + ++ usb_kill_urb(cardp->tx_urb); ++ + usb_fill_bulk_urb(cardp->tx_urb, cardp->udev, + usb_sndbulkpipe(cardp->udev, + cardp->ep_out), +-- +2.51.0 + diff --git a/queue-6.6/wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch b/queue-6.6/wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch new file mode 100644 index 00000000000..3246a79e04d --- /dev/null +++ b/queue-6.6/wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch @@ -0,0 +1,86 @@ +From 9a31f7f450b8ce10711f2bbee9ff7aabf64bae11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Nov 2025 16:50:31 +0200 +Subject: wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() + +From: Bitterblue Smith + +[ Upstream commit 44d1f624bbdd2d60319374ba85f7195a28d00c90 ] + +rtw8822b_set_antenna() can be called from userspace when the chip is +powered off. In that case a WARNING is triggered in +rtw8822b_config_trx_mode() because trying to read the RF registers +when the chip is powered off returns an unexpected value. + +Call rtw8822b_config_trx_mode() in rtw8822b_set_antenna() only when +the chip is powered on. + +------------[ cut here ]------------ +write RF mode table fail +WARNING: CPU: 0 PID: 7183 at rtw8822b.c:824 rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b] +CPU: 0 UID: 0 PID: 7183 Comm: iw Tainted: G W OE 6.17.5-arch1-1 #1 PREEMPT(full) 01c39fc421df2af799dd5e9180b572af860b40c1 +Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE +Hardware name: LENOVO 82KR/LNVNB161216, BIOS HBCN18WW 08/27/2021 +RIP: 0010:rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b] +Call Trace: + + rtw8822b_set_antenna+0x57/0x70 [rtw88_8822b 370206f42e5890d8d5f48eb358b759efa37c422b] + rtw_ops_set_antenna+0x50/0x80 [rtw88_core 711c8fb4f686162be4625b1d0b8e8c6a5ac850fb] + ieee80211_set_antenna+0x60/0x100 [mac80211 f1845d85d2ecacf3b71867635a050ece90486cf3] + nl80211_set_wiphy+0x384/0xe00 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] + ? netdev_run_todo+0x63/0x550 + genl_family_rcv_msg_doit+0xfc/0x160 + genl_rcv_msg+0x1aa/0x2b0 + ? __pfx_nl80211_pre_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] + ? __pfx_nl80211_set_wiphy+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] + ? __pfx_nl80211_post_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] + ? __pfx_genl_rcv_msg+0x10/0x10 + netlink_rcv_skb+0x59/0x110 + genl_rcv+0x28/0x40 + netlink_unicast+0x285/0x3c0 + ? __alloc_skb+0xdb/0x1a0 + netlink_sendmsg+0x20d/0x430 + ____sys_sendmsg+0x39f/0x3d0 + ? import_iovec+0x2f/0x40 + ___sys_sendmsg+0x99/0xe0 + ? refill_obj_stock+0x12e/0x240 + __sys_sendmsg+0x8a/0xf0 + do_syscall_64+0x81/0x970 + ? do_syscall_64+0x81/0x970 + ? ksys_read+0x73/0xf0 + ? do_syscall_64+0x81/0x970 + ? count_memcg_events+0xc2/0x190 + ? handle_mm_fault+0x1d7/0x2d0 + ? do_user_addr_fault+0x21a/0x690 + ? exc_page_fault+0x7e/0x1a0 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +---[ end trace 0000000000000000 ]--- + +Link: https://github.com/lwfinger/rtw88/issues/366 +Signed-off-by: Bitterblue Smith +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/fb9a3444-9319-4aa2-8719-35a6308bf568@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/rtw8822b.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822b.c b/drivers/net/wireless/realtek/rtw88/rtw8822b.c +index 99318a82b43f4..e792d7c866991 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c ++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c +@@ -1044,7 +1044,8 @@ static int rtw8822b_set_antenna(struct rtw_dev *rtwdev, + hal->antenna_tx = antenna_tx; + hal->antenna_rx = antenna_rx; + +- rtw8822b_config_trx_mode(rtwdev, antenna_tx, antenna_rx, false); ++ if (test_bit(RTW_FLAG_POWERON, rtwdev->flags)) ++ rtw8822b_config_trx_mode(rtwdev, antenna_tx, antenna_rx, false); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.6/wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch b/queue-6.6/wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch new file mode 100644 index 00000000000..4abf61fe42c --- /dev/null +++ b/queue-6.6/wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch @@ -0,0 +1,65 @@ +From 51fb0ddf164c7d829f381a0d78d0e82fdaa20552 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Nov 2025 23:09:37 +0500 +Subject: wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero + +From: Roman Peshkichev + +[ Upstream commit 9f68fdcdc9dbf21be2a48feced90ff7f77d07443 ] + +The function rtw_set_dtim_period() accepted an 'int' dtim_period parameter, +while mac80211 provides dtim_period as 'u8' in struct ieee80211_bss_conf. +In IBSS (ad-hoc) mode mac80211 may set dtim_period to 0. + +The driver unconditionally wrote (dtim_period - 1) to +REG_DTIM_COUNTER_ROOT, which resulted in 0xFF when dtim_period was 0. This +caused delays in broadcast/multicast traffic processing and issues with +ad-hoc operation. + +Convert the function parameter to u8 to match ieee80211_bss_conf and avoid +the underflow by writing 0 when dtim_period is 0. + +Link: https://github.com/lwfinger/rtw88/issues/406 +Signed-off-by: Roman Peshkichev +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20251125180937.22977-1-roman.peshkichev@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/main.c | 4 ++-- + drivers/net/wireless/realtek/rtw88/main.h | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c +index c7396ae9256b9..9a4c23163fba4 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.c ++++ b/drivers/net/wireless/realtek/rtw88/main.c +@@ -710,10 +710,10 @@ void rtw_set_rx_freq_band(struct rtw_rx_pkt_stat *pkt_stat, u8 channel) + } + EXPORT_SYMBOL(rtw_set_rx_freq_band); + +-void rtw_set_dtim_period(struct rtw_dev *rtwdev, int dtim_period) ++void rtw_set_dtim_period(struct rtw_dev *rtwdev, u8 dtim_period) + { + rtw_write32_set(rtwdev, REG_TCR, BIT_TCR_UPDATE_TIMIE); +- rtw_write8(rtwdev, REG_DTIM_COUNTER_ROOT, dtim_period - 1); ++ rtw_write8(rtwdev, REG_DTIM_COUNTER_ROOT, dtim_period ? dtim_period - 1 : 0); + } + + void rtw_update_channel(struct rtw_dev *rtwdev, u8 center_channel, +diff --git a/drivers/net/wireless/realtek/rtw88/main.h b/drivers/net/wireless/realtek/rtw88/main.h +index c42ef8294d59e..6e0e1c9c28f70 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.h ++++ b/drivers/net/wireless/realtek/rtw88/main.h +@@ -2154,7 +2154,7 @@ enum nl80211_band rtw_hw_to_nl80211_band(enum rtw_supported_band hw_band) + } + + void rtw_set_rx_freq_band(struct rtw_rx_pkt_stat *pkt_stat, u8 channel); +-void rtw_set_dtim_period(struct rtw_dev *rtwdev, int dtim_period); ++void rtw_set_dtim_period(struct rtw_dev *rtwdev, u8 dtim_period); + void rtw_get_channel_params(struct cfg80211_chan_def *chandef, + struct rtw_channel_params *ch_param); + bool check_hw_ready(struct rtw_dev *rtwdev, u32 addr, u32 mask, u32 target); +-- +2.51.0 + diff --git a/queue-6.6/wifi-rtw88-rtw8821cu-add-id-for-mercusys-mu6h.patch b/queue-6.6/wifi-rtw88-rtw8821cu-add-id-for-mercusys-mu6h.patch new file mode 100644 index 00000000000..b8e10bc8de5 --- /dev/null +++ b/queue-6.6/wifi-rtw88-rtw8821cu-add-id-for-mercusys-mu6h.patch @@ -0,0 +1,37 @@ +From c62c276fa26609d3b2d291bcdb0bb5f7fc0e6674 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 08:32:04 +0800 +Subject: wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H + +From: Hsiu-Ming Chang + +[ Upstream commit 77653c327e11c71c5363b18a53fbf2b92ed21da4 ] + +Add support for Mercusys MU6H AC650 High Gain Wireless Dual Band USB +Adapter V1.30. It is based on RTL8811CU, usb device ID is 2c4e:0105. + +Signed-off-by: Hsiu-Ming Chang +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20251205003245.5762-1-cges30901@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/rtw8821cu.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8821cu.c b/drivers/net/wireless/realtek/rtw88/rtw8821cu.c +index a019f4085e738..1f5af09aed99f 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8821cu.c ++++ b/drivers/net/wireless/realtek/rtw88/rtw8821cu.c +@@ -37,6 +37,8 @@ static const struct usb_device_id rtw_8821cu_id_table[] = { + .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Edimax */ + { USB_DEVICE_AND_INTERFACE_INFO(0x7392, 0xd811, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Edimax */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2c4e, 0x0105, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Mercusys */ + {}, + }; + MODULE_DEVICE_TABLE(usb, rtw_8821cu_id_table); +-- +2.51.0 + diff --git a/queue-6.6/wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch b/queue-6.6/wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch new file mode 100644 index 00000000000..f0f13bb759c --- /dev/null +++ b/queue-6.6/wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch @@ -0,0 +1,36 @@ +From c3120daa0cf23ee1d387a3fbabf757517d61fe0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jan 2026 16:50:35 +0800 +Subject: wifi: rtw89: pci: restore LDO setting after device resume + +From: Dian-Syuan Yang + +[ Upstream commit af1e82232b988f8fc6d635c60609765e49221a64 ] + +The LDO (Low Dropout Regulator) setting is missing after suspend/resume +in some platforms, and it will cause card loss. Therefore, reconfigure +this setting to avoid it. + +Signed-off-by: Dian-Syuan Yang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260127085036.44060-6-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c +index 33b2543ee4d23..1ac5d021893d3 100644 +--- a/drivers/net/wireless/realtek/rtw89/pci.c ++++ b/drivers/net/wireless/realtek/rtw89/pci.c +@@ -3856,6 +3856,7 @@ static int __maybe_unused rtw89_pci_resume(struct device *dev) + rtw89_write32_clr(rtwdev, R_AX_PCIE_PS_CTRL_V1, + B_AX_SEL_REQ_ENTR_L1); + } ++ rtw89_pci_hci_ldo(rtwdev); + rtw89_pci_l2_hci_ldo(rtwdev); + rtw89_pci_filter_out(rtwdev); + rtw89_pci_link_cfg(rtwdev); +-- +2.51.0 + diff --git a/queue-6.6/wifi-rtw89-wow-add-reason-codes-for-disassociation-i.patch b/queue-6.6/wifi-rtw89-wow-add-reason-codes-for-disassociation-i.patch new file mode 100644 index 00000000000..d5a906798fc --- /dev/null +++ b/queue-6.6/wifi-rtw89-wow-add-reason-codes-for-disassociation-i.patch @@ -0,0 +1,53 @@ +From aa4a2281e121f185b668f485d031c23fa4d6610d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 10:20:13 +0800 +Subject: wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode + +From: Chin-Yen Lee + +[ Upstream commit 2fd8f953f25173d14981d8736b6f5bfcd757e51b ] + +Some APs disconnect clients by sending a Disassociation frame +rather than a Deauthentication frame. Since these frames use +different reason codes in WoWLAN mode, this commit adds support +for handling Disassociation to prevent missed disconnection events. + +Signed-off-by: Chin-Yen Lee +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260110022019.2254969-3-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/wow.c | 4 ++++ + drivers/net/wireless/realtek/rtw89/wow.h | 1 + + 2 files changed, 5 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/wow.c b/drivers/net/wireless/realtek/rtw89/wow.c +index aa9efca040253..f558df21a2fd0 100644 +--- a/drivers/net/wireless/realtek/rtw89/wow.c ++++ b/drivers/net/wireless/realtek/rtw89/wow.c +@@ -100,6 +100,10 @@ static void rtw89_wow_show_wakeup_reason(struct rtw89_dev *rtwdev) + reason = rtw89_read8(rtwdev, wow_reason_reg); + + switch (reason) { ++ case RTW89_WOW_RSN_RX_DISASSOC: ++ wakeup.disconnect = true; ++ rtw89_debug(rtwdev, RTW89_DBG_WOW, "WOW: Rx disassoc\n"); ++ break; + case RTW89_WOW_RSN_RX_DEAUTH: + wakeup.disconnect = true; + rtw89_debug(rtwdev, RTW89_DBG_WOW, "WOW: Rx deauth\n"); +diff --git a/drivers/net/wireless/realtek/rtw89/wow.h b/drivers/net/wireless/realtek/rtw89/wow.h +index a2f7b2e3cdb4d..fd85772ccb04e 100644 +--- a/drivers/net/wireless/realtek/rtw89/wow.h ++++ b/drivers/net/wireless/realtek/rtw89/wow.h +@@ -8,6 +8,7 @@ + enum rtw89_wake_reason { + RTW89_WOW_RSN_RX_PTK_REKEY = 0x1, + RTW89_WOW_RSN_RX_GTK_REKEY = 0x2, ++ RTW89_WOW_RSN_RX_DISASSOC = 0x4, + RTW89_WOW_RSN_RX_DEAUTH = 0x8, + RTW89_WOW_RSN_DISCONNECT = 0x10, + RTW89_WOW_RSN_RX_MAGIC_PKT = 0x21, +-- +2.51.0 + diff --git a/queue-6.6/x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch b/queue-6.6/x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch new file mode 100644 index 00000000000..9038906b612 --- /dev/null +++ b/queue-6.6/x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch @@ -0,0 +1,46 @@ +From 9ef87f7884fba99ff7ea857068154235f21ec8f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jan 2026 12:00:08 +0800 +Subject: x86/xen/pvh: Enable PAE mode for 32-bit guest only when + CONFIG_X86_PAE is set + +From: Hou Wenlong + +[ Upstream commit db9aded979b491a24871e1621cd4e8822dbca859 ] + +The PVH entry is available for 32-bit KVM guests, and 32-bit KVM guests +do not depend on CONFIG_X86_PAE. However, mk_early_pgtbl_32() builds +different pagetables depending on whether CONFIG_X86_PAE is set. +Therefore, enabling PAE mode for 32-bit KVM guests without +CONFIG_X86_PAE being set would result in a boot failure during CR3 +loading. + +Signed-off-by: Hou Wenlong +Reviewed-by: Juergen Gross +Signed-off-by: Juergen Gross +Message-ID: +Signed-off-by: Sasha Levin +--- + arch/x86/platform/pvh/head.S | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/x86/platform/pvh/head.S b/arch/x86/platform/pvh/head.S +index fc46b4dfbd747..10deae1a30c65 100644 +--- a/arch/x86/platform/pvh/head.S ++++ b/arch/x86/platform/pvh/head.S +@@ -70,10 +70,12 @@ SYM_CODE_START_LOCAL(pvh_start_xen) + + mov $_pa(early_stack_end), %esp + ++#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE) + /* Enable PAE mode. */ + mov %cr4, %eax + orl $X86_CR4_PAE, %eax + mov %eax, %cr4 ++#endif + + #ifdef CONFIG_X86_64 + /* Enable Long mode. */ +-- +2.51.0 + diff --git a/queue-6.6/xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch b/queue-6.6/xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch new file mode 100644 index 00000000000..a50067679bc --- /dev/null +++ b/queue-6.6/xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch @@ -0,0 +1,61 @@ +From 493a15c1c8c4714d8a905afb416b5bb77ac2a09c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 17:47:29 -0500 +Subject: xenbus: Use .freeze/.thaw to handle xenbus devices + +From: Jason Andryuk + +[ Upstream commit e08dd1ee49838750a514e83c0aa60cd12ba6ecbb ] + +The goal is to fix s2idle and S3 for Xen PV devices. A domain resuming +from s3 or s2idle disconnects its PV devices during resume. The +backends are not expecting this and do not reconnect. + +b3e96c0c7562 ("xen: use freeze/restore/thaw PM events for suspend/ +resume/chkpt") changed xen_suspend()/do_suspend() from +PMSG_SUSPEND/PMSG_RESUME to PMSG_FREEZE/PMSG_THAW/PMSG_RESTORE, but the +suspend/resume callbacks remained. + +.freeze/restore are used with hiberation where Linux restarts in a new +place in the future. .suspend/resume are useful for runtime power +management for the duration of a boot. + +The current behavior of the callbacks works for an xl save/restore or +live migration where the domain is restored/migrated to a new location +and connecting to a not-already-connected backend. + +Change xenbus_pm_ops to use .freeze/thaw/restore and drop the +.suspend/resume hook. This matches the use in drivers/xen/manage.c for +save/restore and live migration. With .suspend/resume empty, PV devices +are left connected during s2idle and s3, so PV devices are not changed +and work after resume. + +Signed-off-by: Jason Andryuk +Acked-by: Juergen Gross +Signed-off-by: Juergen Gross +Message-ID: <20251119224731.61497-2-jason.andryuk@amd.com> +Signed-off-by: Sasha Levin +--- + drivers/xen/xenbus/xenbus_probe_frontend.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c +index fcb335bb7b187..1fdf5be193430 100644 +--- a/drivers/xen/xenbus/xenbus_probe_frontend.c ++++ b/drivers/xen/xenbus/xenbus_probe_frontend.c +@@ -148,11 +148,9 @@ static void xenbus_frontend_dev_shutdown(struct device *_dev) + } + + static const struct dev_pm_ops xenbus_pm_ops = { +- .suspend = xenbus_dev_suspend, +- .resume = xenbus_frontend_dev_resume, + .freeze = xenbus_dev_suspend, + .thaw = xenbus_dev_cancel, +- .restore = xenbus_dev_resume, ++ .restore = xenbus_frontend_dev_resume, + }; + + static struct xen_bus_type xenbus_frontend = { +-- +2.51.0 +