From: Sasha Levin Date: Wed, 15 Oct 2025 11:34:43 +0000 (-0400) Subject: Fixes for all trees X-Git-Tag: v5.15.195~109^2 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b0dfa19b44f45df714499fb91dc412835e23477c;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for all trees Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch b/queue-5.10/bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch new file mode 100644 index 0000000000..f687f57859 --- /dev/null +++ b/queue-5.10/bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch @@ -0,0 +1,64 @@ +From eea4d9d7a69ffb2d766214f5484450e9066f8b6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 09:34:18 +0200 +Subject: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} + +From: Daniel Borkmann + +[ Upstream commit 23f3770e1a53e6c7a553135011f547209e141e72 ] + +Cilium has a BPF egress gateway feature which forces outgoing K8s Pod +traffic to pass through dedicated egress gateways which then SNAT the +traffic in order to interact with stable IPs outside the cluster. + +The traffic is directed to the gateway via vxlan tunnel in collect md +mode. A recent BPF change utilized the bpf_redirect_neigh() helper to +forward packets after the arrival and decap on vxlan, which turned out +over time that the kmalloc-256 slab usage in kernel was ever-increasing. + +The issue was that vxlan allocates the metadata_dst object and attaches +it through a fake dst entry to the skb. The latter was never released +though given bpf_redirect_neigh() was merely setting the new dst entry +via skb_dst_set() without dropping an existing one first. + +Fixes: b4ab31414970 ("bpf: Add redirect_neigh helper as redirect drop-in") +Reported-by: Yusuke Suzuki +Reported-by: Julian Wiedmann +Signed-off-by: Daniel Borkmann +Cc: Martin KaFai Lau +Cc: Jakub Kicinski +Cc: Jordan Rife +Reviewed-by: Simon Horman +Reviewed-by: Jordan Rife +Reviewed-by: Jakub Kicinski +Reviewed-by: Martin KaFai Lau +Link: https://lore.kernel.org/r/20251003073418.291171-1-daniel@iogearbox.net +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/core/filter.c b/net/core/filter.c +index e7d3398c4d23b..1d1d4e92cb662 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -2268,6 +2268,7 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev, + if (IS_ERR(dst)) + goto out_drop; + ++ skb_dst_drop(skb); + skb_dst_set(skb, dst); + } else if (nh->nh_family != AF_INET6) { + goto out_drop; +@@ -2383,6 +2384,7 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev, + goto out_drop; + } + ++ skb_dst_drop(skb); + skb_dst_set(skb, &rt->dst); + } + +-- +2.51.0 + diff --git a/queue-5.10/clk-at91-peripheral-fix-return-value.patch b/queue-5.10/clk-at91-peripheral-fix-return-value.patch new file mode 100644 index 0000000000..2f0f78bcda --- /dev/null +++ b/queue-5.10/clk-at91-peripheral-fix-return-value.patch @@ -0,0 +1,44 @@ +From 145eb9da88d7cf00a33a9eee1fb4640cac5408f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 11:17:53 -0400 +Subject: clk: at91: peripheral: fix return value + +From: Brian Masney + +[ Upstream commit 47b13635dabc14f1c2fdcaa5468b47ddadbdd1b5 ] + +determine_rate() is expected to return an error code, or 0 on success. +clk_sam9x5_peripheral_determine_rate() has a branch that returns the +parent rate on a certain case. This is the behavior of round_rate(), +so let's go ahead and fix this by setting req->rate. + +Fixes: b4c115c76184f ("clk: at91: clk-peripheral: add support for changeable parent rate") +Reviewed-by: Alexander Sverdlin +Acked-by: Nicolas Ferre +Signed-off-by: Brian Masney +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/clk-peripheral.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/at91/clk-peripheral.c b/drivers/clk/at91/clk-peripheral.c +index 7a27ba8e05779..7605ab23dc8ed 100644 +--- a/drivers/clk/at91/clk-peripheral.c ++++ b/drivers/clk/at91/clk-peripheral.c +@@ -268,8 +268,11 @@ static int clk_sam9x5_peripheral_determine_rate(struct clk_hw *hw, + long best_diff = LONG_MIN; + u32 shift; + +- if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max) +- return parent_rate; ++ if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max) { ++ req->rate = parent_rate; ++ ++ return 0; ++ } + + /* Fist step: check the available dividers. */ + for (shift = 0; shift <= PERIPHERAL_MAX_SHIFT; shift++) { +-- +2.51.0 + diff --git a/queue-5.10/clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch b/queue-5.10/clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch new file mode 100644 index 0000000000..a41d12cc63 --- /dev/null +++ b/queue-5.10/clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch @@ -0,0 +1,50 @@ +From 6be90a5ef7410e6f0950a46ad037fcf25aa969c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Jul 2025 13:11:55 -0700 +Subject: clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver + +From: Alok Tiwari + +[ Upstream commit 1624dead9a4d288a594fdf19735ebfe4bb567cb8 ] + +The conditional check for the PLL0 multiplier 'm' used a logical AND +instead of OR, making the range check ineffective. This patch replaces +&& with || to correctly reject invalid values of 'm' that are either +less than or equal to 0 or greater than LPC18XX_PLL0_MSEL_MAX. + +This ensures proper bounds checking during clk rate setting and rounding. + +Fixes: b04e0b8fd544 ("clk: add lpc18xx cgu clk driver") +Signed-off-by: Alok Tiwari +[sboyd@kernel.org: 'm' is unsigned so remove < condition] +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/nxp/clk-lpc18xx-cgu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c +index 44e07a3c253b9..ab8741fe57c99 100644 +--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c ++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c +@@ -385,7 +385,7 @@ static int lpc18xx_pll0_determine_rate(struct clk_hw *hw, + } + + m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2); +- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { ++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) { + pr_warn("%s: unable to support rate %lu\n", __func__, req->rate); + return -EINVAL; + } +@@ -408,7 +408,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, + } + + m = DIV_ROUND_UP_ULL(parent_rate, rate * 2); +- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { ++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) { + pr_warn("%s: unable to support rate %lu\n", __func__, rate); + return -EINVAL; + } +-- +2.51.0 + diff --git a/queue-5.10/clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch b/queue-5.10/clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch new file mode 100644 index 0000000000..697c22f9b1 --- /dev/null +++ b/queue-5.10/clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch @@ -0,0 +1,68 @@ +From 81574441774c59486c0989a14078679b7a160932 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 11:18:29 -0400 +Subject: clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() + +From: Brian Masney + +[ Upstream commit b46a3d323a5b7942e65025254c13801d0f475f02 ] + +The round_rate() clk ops is deprecated, so migrate this driver from +round_rate() to determine_rate() using the Coccinelle semantic patch +on the cover letter of this series. + +Signed-off-by: Brian Masney +Stable-dep-of: 1624dead9a4d ("clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver") +Signed-off-by: Sasha Levin +--- + drivers/clk/nxp/clk-lpc18xx-cgu.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c +index 8b686da5577b3..44e07a3c253b9 100644 +--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c ++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c +@@ -374,23 +374,25 @@ static unsigned long lpc18xx_pll0_recalc_rate(struct clk_hw *hw, + return 0; + } + +-static long lpc18xx_pll0_round_rate(struct clk_hw *hw, unsigned long rate, +- unsigned long *prate) ++static int lpc18xx_pll0_determine_rate(struct clk_hw *hw, ++ struct clk_rate_request *req) + { + unsigned long m; + +- if (*prate < rate) { ++ if (req->best_parent_rate < req->rate) { + pr_warn("%s: pll dividers not supported\n", __func__); + return -EINVAL; + } + +- m = DIV_ROUND_UP_ULL(*prate, rate * 2); ++ m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2); + if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { +- pr_warn("%s: unable to support rate %lu\n", __func__, rate); ++ pr_warn("%s: unable to support rate %lu\n", __func__, req->rate); + return -EINVAL; + } + +- return 2 * *prate * m; ++ req->rate = 2 * req->best_parent_rate * m; ++ ++ return 0; + } + + static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, +@@ -447,7 +449,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, + + static const struct clk_ops lpc18xx_pll0_ops = { + .recalc_rate = lpc18xx_pll0_recalc_rate, +- .round_rate = lpc18xx_pll0_round_rate, ++ .determine_rate = lpc18xx_pll0_determine_rate, + .set_rate = lpc18xx_pll0_set_rate, + }; + +-- +2.51.0 + diff --git a/queue-5.10/crypto-essiv-check-ssize-for-decryption-and-in-place.patch b/queue-5.10/crypto-essiv-check-ssize-for-decryption-and-in-place.patch new file mode 100644 index 0000000000..bc783f66a0 --- /dev/null +++ b/queue-5.10/crypto-essiv-check-ssize-for-decryption-and-in-place.patch @@ -0,0 +1,63 @@ +From b40fdd795a7fec9152bc6d1f0c0764410deb5995 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 15:54:20 +0800 +Subject: crypto: essiv - Check ssize for decryption and in-place encryption + +From: Herbert Xu + +[ Upstream commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f ] + +Move the ssize check to the start in essiv_aead_crypt so that +it's also checked for decryption and in-place encryption. + +Reported-by: Muhammad Alifa Ramdhan +Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation") +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/essiv.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/crypto/essiv.c b/crypto/essiv.c +index 85bb624e32b9b..7db206fc97f21 100644 +--- a/crypto/essiv.c ++++ b/crypto/essiv.c +@@ -185,9 +185,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) + const struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm); + struct essiv_aead_request_ctx *rctx = aead_request_ctx(req); + struct aead_request *subreq = &rctx->aead_req; ++ int ivsize = crypto_aead_ivsize(tfm); ++ int ssize = req->assoclen - ivsize; + struct scatterlist *src = req->src; + int err; + ++ if (ssize < 0) ++ return -EINVAL; ++ + crypto_cipher_encrypt_one(tctx->essiv_cipher, req->iv, req->iv); + + /* +@@ -197,19 +202,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) + */ + rctx->assoc = NULL; + if (req->src == req->dst || !enc) { +- scatterwalk_map_and_copy(req->iv, req->dst, +- req->assoclen - crypto_aead_ivsize(tfm), +- crypto_aead_ivsize(tfm), 1); ++ scatterwalk_map_and_copy(req->iv, req->dst, ssize, ivsize, 1); + } else { + u8 *iv = (u8 *)aead_request_ctx(req) + tctx->ivoffset; +- int ivsize = crypto_aead_ivsize(tfm); +- int ssize = req->assoclen - ivsize; + struct scatterlist *sg; + int nents; + +- if (ssize < 0) +- return -EINVAL; +- + nents = sg_nents_for_len(req->src, ssize); + if (nents < 0) + return -EINVAL; +-- +2.51.0 + diff --git a/queue-5.10/drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch b/queue-5.10/drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch new file mode 100644 index 0000000000..dffce037b2 --- /dev/null +++ b/queue-5.10/drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch @@ -0,0 +1,39 @@ +From 801468fa5f819043db8bc0df0544355c6dc7330e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:22 +0200 +Subject: drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit d60f9c45d1bff7e20ecd57492ef7a5e33c94a37c ] + +Without these, it's impossible to program these registers. + +Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +index cbce194ec7b82..ff746fba850bc 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +@@ -155,6 +155,8 @@ + SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \ + SRI(VIEWPORT_START, SCL, id), \ + SRI(VIEWPORT_SIZE, SCL, id), \ ++ SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \ ++ SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \ + SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \ + SRI(SCL_VERT_FILTER_SCALE_RATIO, SCL, id), \ + SRI(SCL_VERT_FILTER_INIT, SCL, id), \ +-- +2.51.0 + diff --git a/queue-5.10/drm-amd-display-properly-clear-scl_-_filter_control-.patch b/queue-5.10/drm-amd-display-properly-clear-scl_-_filter_control-.patch new file mode 100644 index 0000000000..5f33ec4a43 --- /dev/null +++ b/queue-5.10/drm-amd-display-properly-clear-scl_-_filter_control-.patch @@ -0,0 +1,51 @@ +From 51d5ea3a1a9bd32deb7036eef09d2637fd290053 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:23 +0200 +Subject: drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit c0aa7cf49dd6cb302fe28e7183992b772cb7420c ] + +Previously, the code would set a bit field which didn't exist +on DCE6 so it would be effectively a no-op. + +Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +index a54a309879246..a3f4fa346b77e 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +@@ -528,8 +528,7 @@ static void dce60_transform_set_scaler( + if (coeffs_v != xfm_dce->filter_v || coeffs_h != xfm_dce->filter_h) { + /* 4. Program vertical filters */ + if (xfm_dce->filter_v == NULL) +- REG_SET(SCL_VERT_FILTER_CONTROL, 0, +- SCL_V_2TAP_HARDCODE_COEF_EN, 0); ++ REG_WRITE(SCL_VERT_FILTER_CONTROL, 0); + program_multi_taps_filter( + xfm_dce, + data->taps.v_taps, +@@ -543,8 +542,7 @@ static void dce60_transform_set_scaler( + + /* 5. Program horizontal filters */ + if (xfm_dce->filter_h == NULL) +- REG_SET(SCL_HORZ_FILTER_CONTROL, 0, +- SCL_H_2TAP_HARDCODE_COEF_EN, 0); ++ REG_WRITE(SCL_HORZ_FILTER_CONTROL, 0); + program_multi_taps_filter( + xfm_dce, + data->taps.h_taps, +-- +2.51.0 + diff --git a/queue-5.10/drm-amd-display-properly-disable-scaling-on-dce6.patch b/queue-5.10/drm-amd-display-properly-disable-scaling-on-dce6.patch new file mode 100644 index 0000000000..a5b722d2ca --- /dev/null +++ b/queue-5.10/drm-amd-display-properly-disable-scaling-on-dce6.patch @@ -0,0 +1,101 @@ +From 42b5037dc3272673058998a339c678848c34bba8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:24 +0200 +Subject: drm/amd/display: Properly disable scaling on DCE6 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit a7dc87f3448bea5ebe054f14e861074b9c289c65 ] + +SCL_SCALER_ENABLE can be used to enable/disable the scaler +on DCE6. Program it to 0 when scaling isn't used, 1 when used. +Additionally, clear some other registers when scaling is +disabled and program the SCL_UPDATE register as recommended. + +This fixes visible glitches for users whose BIOS sets up a +mode with scaling at boot, which DC was unable to clean up. + +Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/dce/dce_transform.c | 15 +++++++++++---- + .../gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++ + 2 files changed, 13 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +index a3f4fa346b77e..19859c44f9d51 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +@@ -154,10 +154,13 @@ static bool dce60_setup_scaling_configuration( + REG_SET(SCL_BYPASS_CONTROL, 0, SCL_BYPASS_MODE, 0); + + if (data->taps.h_taps + data->taps.v_taps <= 2) { +- /* Set bypass */ +- +- /* DCE6 has no SCL_MODE register, skip scale mode programming */ ++ /* Disable scaler functionality */ ++ REG_WRITE(SCL_SCALER_ENABLE, 0); + ++ /* Clear registers that can cause glitches even when the scaler is off */ ++ REG_WRITE(SCL_TAP_CONTROL, 0); ++ REG_WRITE(SCL_AUTOMATIC_MODE_CONTROL, 0); ++ REG_WRITE(SCL_F_SHARP_CONTROL, 0); + return false; + } + +@@ -165,7 +168,7 @@ static bool dce60_setup_scaling_configuration( + SCL_H_NUM_OF_TAPS, data->taps.h_taps - 1, + SCL_V_NUM_OF_TAPS, data->taps.v_taps - 1); + +- /* DCE6 has no SCL_MODE register, skip scale mode programming */ ++ REG_WRITE(SCL_SCALER_ENABLE, 1); + + /* DCE6 has no SCL_BOUNDARY_MODE bit, skip replace out of bound pixels */ + +@@ -503,6 +506,8 @@ static void dce60_transform_set_scaler( + REG_SET(DC_LB_MEM_SIZE, 0, + DC_LB_MEM_SIZE, xfm_dce->lb_memory_size); + ++ REG_WRITE(SCL_UPDATE, 0x00010000); ++ + /* Clear SCL_F_SHARP_CONTROL value to 0 */ + REG_WRITE(SCL_F_SHARP_CONTROL, 0); + +@@ -566,6 +571,8 @@ static void dce60_transform_set_scaler( + /* DCE6 has no SCL_COEF_UPDATE_COMPLETE bit to flip to new coefficient memory */ + + /* DCE6 DATA_FORMAT register does not support ALPHA_EN */ ++ ++ REG_WRITE(SCL_UPDATE, 0); + } + #endif + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +index ff746fba850bc..eb716e8337e23 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +@@ -155,6 +155,7 @@ + SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \ + SRI(VIEWPORT_START, SCL, id), \ + SRI(VIEWPORT_SIZE, SCL, id), \ ++ SRI(SCL_SCALER_ENABLE, SCL, id), \ + SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \ + SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \ + SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \ +@@ -592,6 +593,7 @@ struct dce_transform_registers { + uint32_t SCL_VERT_FILTER_SCALE_RATIO; + uint32_t SCL_HORZ_FILTER_INIT; + #if defined(CONFIG_DRM_AMD_DC_SI) ++ uint32_t SCL_SCALER_ENABLE; + uint32_t SCL_HORZ_FILTER_INIT_RGB_LUMA; + uint32_t SCL_HORZ_FILTER_INIT_CHROMA; + #endif +-- +2.51.0 + diff --git a/queue-5.10/drm-amdgpu-add-additional-dce6-scl-registers.patch b/queue-5.10/drm-amdgpu-add-additional-dce6-scl-registers.patch new file mode 100644 index 0000000000..11fbfbf8bb --- /dev/null +++ b/queue-5.10/drm-amdgpu-add-additional-dce6-scl-registers.patch @@ -0,0 +1,93 @@ +From 21a5e9a7cf0b05cb956d4b569f793e86b770504a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:21 +0200 +Subject: drm/amdgpu: Add additional DCE6 SCL registers + +From: Alex Deucher + +[ Upstream commit 507296328b36ffd00ec1f4fde5b8acafb7222ec7 ] + +Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)") +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h | 7 +++++++ + drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h | 2 ++ + 2 files changed, 9 insertions(+) + +diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h +index 9de01ae574c03..067eddd9c62d8 100644 +--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h ++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h +@@ -4115,6 +4115,7 @@ + #define mmSCL0_SCL_COEF_RAM_CONFLICT_STATUS 0x1B55 + #define mmSCL0_SCL_COEF_RAM_SELECT 0x1B40 + #define mmSCL0_SCL_COEF_RAM_TAP_DATA 0x1B41 ++#define mmSCL0_SCL_SCALER_ENABLE 0x1B42 + #define mmSCL0_SCL_CONTROL 0x1B44 + #define mmSCL0_SCL_DEBUG 0x1B6A + #define mmSCL0_SCL_DEBUG2 0x1B69 +@@ -4144,6 +4145,7 @@ + #define mmSCL1_SCL_COEF_RAM_CONFLICT_STATUS 0x1E55 + #define mmSCL1_SCL_COEF_RAM_SELECT 0x1E40 + #define mmSCL1_SCL_COEF_RAM_TAP_DATA 0x1E41 ++#define mmSCL1_SCL_SCALER_ENABLE 0x1E42 + #define mmSCL1_SCL_CONTROL 0x1E44 + #define mmSCL1_SCL_DEBUG 0x1E6A + #define mmSCL1_SCL_DEBUG2 0x1E69 +@@ -4173,6 +4175,7 @@ + #define mmSCL2_SCL_COEF_RAM_CONFLICT_STATUS 0x4155 + #define mmSCL2_SCL_COEF_RAM_SELECT 0x4140 + #define mmSCL2_SCL_COEF_RAM_TAP_DATA 0x4141 ++#define mmSCL2_SCL_SCALER_ENABLE 0x4142 + #define mmSCL2_SCL_CONTROL 0x4144 + #define mmSCL2_SCL_DEBUG 0x416A + #define mmSCL2_SCL_DEBUG2 0x4169 +@@ -4202,6 +4205,7 @@ + #define mmSCL3_SCL_COEF_RAM_CONFLICT_STATUS 0x4455 + #define mmSCL3_SCL_COEF_RAM_SELECT 0x4440 + #define mmSCL3_SCL_COEF_RAM_TAP_DATA 0x4441 ++#define mmSCL3_SCL_SCALER_ENABLE 0x4442 + #define mmSCL3_SCL_CONTROL 0x4444 + #define mmSCL3_SCL_DEBUG 0x446A + #define mmSCL3_SCL_DEBUG2 0x4469 +@@ -4231,6 +4235,7 @@ + #define mmSCL4_SCL_COEF_RAM_CONFLICT_STATUS 0x4755 + #define mmSCL4_SCL_COEF_RAM_SELECT 0x4740 + #define mmSCL4_SCL_COEF_RAM_TAP_DATA 0x4741 ++#define mmSCL4_SCL_SCALER_ENABLE 0x4742 + #define mmSCL4_SCL_CONTROL 0x4744 + #define mmSCL4_SCL_DEBUG 0x476A + #define mmSCL4_SCL_DEBUG2 0x4769 +@@ -4260,6 +4265,7 @@ + #define mmSCL5_SCL_COEF_RAM_CONFLICT_STATUS 0x4A55 + #define mmSCL5_SCL_COEF_RAM_SELECT 0x4A40 + #define mmSCL5_SCL_COEF_RAM_TAP_DATA 0x4A41 ++#define mmSCL5_SCL_SCALER_ENABLE 0x4A42 + #define mmSCL5_SCL_CONTROL 0x4A44 + #define mmSCL5_SCL_DEBUG 0x4A6A + #define mmSCL5_SCL_DEBUG2 0x4A69 +@@ -4287,6 +4293,7 @@ + #define mmSCL_COEF_RAM_CONFLICT_STATUS 0x1B55 + #define mmSCL_COEF_RAM_SELECT 0x1B40 + #define mmSCL_COEF_RAM_TAP_DATA 0x1B41 ++#define mmSCL_SCALER_ENABLE 0x1B42 + #define mmSCL_CONTROL 0x1B44 + #define mmSCL_DEBUG 0x1B6A + #define mmSCL_DEBUG2 0x1B69 +diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h +index 41c4a46ce3572..afe7303802c61 100644 +--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h ++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h +@@ -8646,6 +8646,8 @@ + #define REGAMMA_LUT_INDEX__REGAMMA_LUT_INDEX__SHIFT 0x00000000 + #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK_MASK 0x00000007L + #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK__SHIFT 0x00000000 ++#define SCL_SCALER_ENABLE__SCL_SCALE_EN_MASK 0x00000001L ++#define SCL_SCALER_ENABLE__SCL_SCALE_EN__SHIFT 0x00000000 + #define SCL_ALU_CONTROL__SCL_ALU_DISABLE_MASK 0x00000001L + #define SCL_ALU_CONTROL__SCL_ALU_DISABLE__SHIFT 0x00000000 + #define SCL_BYPASS_CONTROL__SCL_BYPASS_MODE_MASK 0x00000003L +-- +2.51.0 + diff --git a/queue-5.10/drm-vmwgfx-fix-use-after-free-in-validation.patch b/queue-5.10/drm-vmwgfx-fix-use-after-free-in-validation.patch new file mode 100644 index 0000000000..767bc6f79c --- /dev/null +++ b/queue-5.10/drm-vmwgfx-fix-use-after-free-in-validation.patch @@ -0,0 +1,44 @@ +From abe21d3cbc2b3a8f5c8506a03d33faf855c738a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 14:54:25 -0500 +Subject: drm/vmwgfx: Fix Use-after-free in validation + +From: Ian Forbes + +[ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ] + +Nodes stored in the validation duplicates hashtable come from an arena +allocator that is cleared at the end of vmw_execbuf_process. All nodes +are expected to be cleared in vmw_validation_drop_ht but this node escaped +because its resource was destroyed prematurely. + +Fixes: 64ad2abfe9a6 ("drm/vmwgfx: Adapt validation code for reference-free lookups") +Reported-by: Kuzey Arda Bulut +Signed-off-by: Ian Forbes +Reviewed-by: Zack Rusin +Signed-off-by: Zack Rusin +Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +index cc1cfc827bb9a..44bb3ccc31574 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +@@ -342,8 +342,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx, + } + } + node->res = vmw_resource_reference_unless_doomed(res); +- if (!node->res) ++ if (!node->res) { ++ hash_del_rcu(&node->hash.head); + return -ESRCH; ++ } + + node->first_usage = 1; + if (!res->dev_priv->has_mob) { +-- +2.51.0 + diff --git a/queue-5.10/gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch b/queue-5.10/gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch new file mode 100644 index 0000000000..3e359a3dfc --- /dev/null +++ b/queue-5.10/gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch @@ -0,0 +1,37 @@ +From 860707128ae71485d1f4dcd26c1520c43c00e7de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 16:51:29 +0200 +Subject: gpio: wcd934x: mark the GPIO controller as sleeping + +From: Bartosz Golaszewski + +[ Upstream commit b5f8aa8d4bde0cf3e4595af5a536da337e5f1c78 ] + +The slimbus regmap passed to the GPIO driver down from MFD does not use +fast_io. This means a mutex is used for locking and thus this GPIO chip +must not be used in atomic context. Change the can_sleep switch in +struct gpio_chip to true. + +Fixes: 59c324683400 ("gpio: wcd934x: Add support to wcd934x gpio controller") +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-wcd934x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-wcd934x.c b/drivers/gpio/gpio-wcd934x.c +index cbbbd105a5a7b..26d70ac90933c 100644 +--- a/drivers/gpio/gpio-wcd934x.c ++++ b/drivers/gpio/gpio-wcd934x.c +@@ -101,7 +101,7 @@ static int wcd_gpio_probe(struct platform_device *pdev) + chip->base = -1; + chip->ngpio = WCD934X_NPINS; + chip->label = dev_name(dev); +- chip->can_sleep = false; ++ chip->can_sleep = true; + + return devm_gpiochip_add_data(dev, chip, data); + } +-- +2.51.0 + diff --git a/queue-5.10/gpio-wcd934x-remove-duplicate-assignment-of-of_gpio_.patch b/queue-5.10/gpio-wcd934x-remove-duplicate-assignment-of-of_gpio_.patch new file mode 100644 index 0000000000..d561b7741b --- /dev/null +++ b/queue-5.10/gpio-wcd934x-remove-duplicate-assignment-of-of_gpio_.patch @@ -0,0 +1,35 @@ +From 37e791b86698b3efbd3ab77b0ecac008495522e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jan 2023 20:26:18 +0200 +Subject: gpio: wcd934x: Remove duplicate assignment of of_gpio_n_cells + +From: Andy Shevchenko + +[ Upstream commit a060dc6620c13435b78e92cd2ebdbb6d11af237a ] + +The of_gpio_n_cells default is 2 when ->of_xlate() callback is +not defined. No need to assign it explicitly in the driver. + +Signed-off-by: Andy Shevchenko +Signed-off-by: Bartosz Golaszewski +Stable-dep-of: b5f8aa8d4bde ("gpio: wcd934x: mark the GPIO controller as sleeping") +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-wcd934x.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpio/gpio-wcd934x.c b/drivers/gpio/gpio-wcd934x.c +index c00968ce7a569..cbbbd105a5a7b 100644 +--- a/drivers/gpio/gpio-wcd934x.c ++++ b/drivers/gpio/gpio-wcd934x.c +@@ -101,7 +101,6 @@ static int wcd_gpio_probe(struct platform_device *pdev) + chip->base = -1; + chip->ngpio = WCD934X_NPINS; + chip->label = dev_name(dev); +- chip->of_gpio_n_cells = 2; + chip->can_sleep = false; + + return devm_gpiochip_add_data(dev, chip, data); +-- +2.51.0 + diff --git a/queue-5.10/libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch b/queue-5.10/libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch new file mode 100644 index 0000000000..81aa3eef4b --- /dev/null +++ b/queue-5.10/libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch @@ -0,0 +1,59 @@ +From 441b5e1de08b3ff58be2d509b8c393fe058335a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:19 -0700 +Subject: libperf event: Ensure tracing data is multiple of 8 sized + +From: Ian Rogers + +[ Upstream commit b39c915a4f365cce6bdc0e538ed95d31823aea8f ] + +Perf's synthetic-events.c will ensure 8-byte alignment of tracing +data, writing it after a perf_record_header_tracing_data event. + +Add padding to struct perf_record_header_tracing_data to make it 16-byte +rather than 12-byte sized. + +Fixes: 055c67ed39887c55 ("perf tools: Move event synthesizing routines to separate .c file") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Acked-by: Namhyung Kim +Tested-by: Arnaldo Carvalho de Melo +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Blake Jones +Cc: Chun-Tse Shao +Cc: Collin Funk +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jan Polensky +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Li Huafei +Cc: Mark Rutland +Cc: Nam Cao +Cc: Peter Zijlstra +Cc: Steinar H. Gunderson +Cc: Thomas Gleixner +Link: https://lore.kernel.org/r/20250821163820.1132977-6-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/perf/include/perf/event.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/lib/perf/include/perf/event.h b/tools/lib/perf/include/perf/event.h +index 4a24b855d3ce2..4b0f576e1e6c0 100644 +--- a/tools/lib/perf/include/perf/event.h ++++ b/tools/lib/perf/include/perf/event.h +@@ -201,6 +201,7 @@ struct perf_record_header_event_type { + struct perf_record_header_tracing_data { + struct perf_event_header header; + __u32 size; ++ __u32 pad; + }; + + #define PERF_RECORD_MISC_BUILD_ID_SIZE (1 << 15) +-- +2.51.0 + diff --git a/queue-5.10/mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch b/queue-5.10/mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch new file mode 100644 index 0000000000..f55395635e --- /dev/null +++ b/queue-5.10/mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch @@ -0,0 +1,48 @@ +From 44d1d373806470825379337d22f9e38df91540e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 13:07:21 +0530 +Subject: mailbox: zynqmp-ipi: Remove dev.parent check in + zynqmp_ipi_free_mboxes + +From: Harini T + +[ Upstream commit 019e3f4550fc7d319a7fd03eff487255f8e8aecd ] + +The ipi_mbox->dev.parent check is unreliable proxy for registration +status as it fails to protect against probe failures that occur after +the parent is assigned but before device_register() completes. + +device_is_registered() is the canonical and robust method to verify the +registration status. + +Remove ipi_mbox->dev.parent check in zynqmp_ipi_free_mboxes(). + +Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") +Signed-off-by: Harini T +Reviewed-by: Peng Fan +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/zynqmp-ipi-mailbox.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c +index 136c1f67dd223..e64f7157f065f 100644 +--- a/drivers/mailbox/zynqmp-ipi-mailbox.c ++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c +@@ -618,10 +618,8 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) + i = pdata->num_mboxes; + for (; i >= 0; i--) { + ipi_mbox = &pdata->ipi_mboxes[i]; +- if (ipi_mbox->dev.parent) { +- if (device_is_registered(&ipi_mbox->dev)) +- device_unregister(&ipi_mbox->dev); +- } ++ if (device_is_registered(&ipi_mbox->dev)) ++ device_unregister(&ipi_mbox->dev); + } + } + +-- +2.51.0 + diff --git a/queue-5.10/mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch b/queue-5.10/mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch new file mode 100644 index 0000000000..567b726ef1 --- /dev/null +++ b/queue-5.10/mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch @@ -0,0 +1,43 @@ +From 9d6de1be71c0fdbc5bc0131f415ab807cf6c34b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 13:07:20 +0530 +Subject: mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() + call + +From: Harini T + +[ Upstream commit 341867f730d3d3bb54491ee64e8b1a0c446656e7 ] + +The controller is registered using the device-managed function +'devm_mbox_controller_register()'. As documented in mailbox.c, this +ensures the devres framework automatically calls +mbox_controller_unregister() when device_unregister() is invoked, making +the explicit call unnecessary. + +Remove redundant mbox_controller_unregister() call as +device_unregister() handles controller cleanup. + +Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") +Signed-off-by: Harini T +Reviewed-by: Peng Fan +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/zynqmp-ipi-mailbox.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c +index be06de791c544..136c1f67dd223 100644 +--- a/drivers/mailbox/zynqmp-ipi-mailbox.c ++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c +@@ -619,7 +619,6 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) + for (; i >= 0; i--) { + ipi_mbox = &pdata->ipi_mboxes[i]; + if (ipi_mbox->dev.parent) { +- mbox_controller_unregister(&ipi_mbox->mbox); + if (device_is_registered(&ipi_mbox->dev)) + device_unregister(&ipi_mbox->dev); + } +-- +2.51.0 + diff --git a/queue-5.10/net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch b/queue-5.10/net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch new file mode 100644 index 0000000000..7e60729b95 --- /dev/null +++ b/queue-5.10/net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch @@ -0,0 +1,41 @@ +From cbdec358757832d3b0a278b14a574f44cad50d04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 20:46:17 +0300 +Subject: net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe + +From: Erick Karanja + +[ Upstream commit 521405cb54cd2812bbb6dedd5afc14bca1e7e98a ] + +Add missing of_node_put call to release device node tbi obtained +via for_each_child_of_node. + +Fixes: afae5ad78b342 ("net/fsl_pq_mdio: streamline probing of MDIO nodes") +Signed-off-by: Erick Karanja +Link: https://patch.msgid.link/20251002174617.960521-1-karanja99erick@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c +index c6481bd612390..565a8bfe5692a 100644 +--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c ++++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c +@@ -482,10 +482,12 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev) + "missing 'reg' property in node %pOF\n", + tbi); + err = -EBUSY; ++ of_node_put(tbi); + goto error; + } + set_tbipa(*prop, pdev, + data->get_tbipa, priv->map, &res); ++ of_node_put(tbi); + } + } + +-- +2.51.0 + diff --git a/queue-5.10/net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch b/queue-5.10/net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch new file mode 100644 index 0000000000..d57ec1e6c0 --- /dev/null +++ b/queue-5.10/net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch @@ -0,0 +1,41 @@ +From c19bd971798ba090095811423b86146fdb6beb6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 15:25:01 +0300 +Subject: net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() + +From: Dan Carpenter + +[ Upstream commit 4f0d91ba72811fd5dd577bcdccd7fed649aae62c ] + +Print "entry->mac" before freeing "entry". The "entry" pointer is +freed with kfree_rcu() so it's unlikely that we would trigger this +in real life, but it's safer to re-order it. + +Fixes: cc5387f7346a ("net/mlx4_en: Add unicast MAC filtering") +Signed-off-by: Dan Carpenter +Reviewed-by: Tariq Toukan +Link: https://patch.msgid.link/aNvMHX4g8RksFFvV@stanley.mountain +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +index a0551d6c2ffd6..264f5ae76e072 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +@@ -1176,9 +1176,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv, + mlx4_unregister_mac(mdev->dev, priv->port, mac); + + hlist_del_rcu(&entry->hlist); +- kfree_rcu(entry, rcu); + en_dbg(DRV, priv, "Removed MAC %pM on port:%d\n", + entry->mac, priv->port); ++ kfree_rcu(entry, rcu); + ++removed; + } + } +-- +2.51.0 + diff --git a/queue-5.10/net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch b/queue-5.10/net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch new file mode 100644 index 0000000000..e8a4509258 --- /dev/null +++ b/queue-5.10/net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch @@ -0,0 +1,42 @@ +From aeccab5c1b67892cc969a6022e7101a87881d7e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 12:14:47 +0300 +Subject: net/sctp: fix a null dereference in sctp_disposition + sctp_sf_do_5_1D_ce() + +From: Alexandr Sapozhnikov + +[ Upstream commit 2f3119686ef50319490ccaec81a575973da98815 ] + +If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 +and sctp_ulpevent_make_authkey() returns 0, then the variable +ai_ev remains zero and the zero will be dereferenced +in the sctp_ulpevent_free() function. + +Signed-off-by: Alexandr Sapozhnikov +Acked-by: Xin Long +Fixes: 30f6ebf65bc4 ("sctp: add SCTP_AUTH_NO_AUTH type for AUTHENTICATION_EVENT") +Link: https://patch.msgid.link/20251002091448.11-1-alsp705@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sctp/sm_statefuns.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index 93ebd14b48ed7..2832af34216d5 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -873,7 +873,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net, + return SCTP_DISPOSITION_CONSUME; + + nomem_authev: +- sctp_ulpevent_free(ai_ev); ++ if (ai_ev) ++ sctp_ulpevent_free(ai_ev); + nomem_aiev: + sctp_ulpevent_free(ev); + nomem_ev: +-- +2.51.0 + diff --git a/queue-5.10/perf-session-fix-handling-when-buffer-exceeds-2-gib.patch b/queue-5.10/perf-session-fix-handling-when-buffer-exceeds-2-gib.patch new file mode 100644 index 0000000000..3563373b6a --- /dev/null +++ b/queue-5.10/perf-session-fix-handling-when-buffer-exceeds-2-gib.patch @@ -0,0 +1,53 @@ +From d876f64205286a2998f680cfa17abdb680c77cd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Aug 2025 14:24:40 +0100 +Subject: perf session: Fix handling when buffer exceeds 2 GiB +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leo Yan + +[ Upstream commit c17dda8013495d8132c976cbf349be9949d0fbd1 ] + +If a user specifies an AUX buffer larger than 2 GiB, the returned size +may exceed 0x80000000. Since the err variable is defined as a signed +32-bit integer, such a value overflows and becomes negative. + +As a result, the perf record command reports an error: + + 0x146e8 [0x30]: failed to process type: 71 [Unknown error 183711232] + +Change the type of the err variable to a signed 64-bit integer to +accommodate large buffer sizes correctly. + +Fixes: d5652d865ea734a1 ("perf session: Add ability to skip 4GiB or more") +Reported-by: Tamas Zsoldos +Signed-off-by: Leo Yan +Acked-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Jiri Olsa +Link: https://lore.kernel.org/r/20250808-perf_fix_big_buffer_size-v1-1-45f45444a9a4@arm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/session.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c +index 81b7ec2ae8615..17bfcd8b7fbb1 100644 +--- a/tools/perf/util/session.c ++++ b/tools/perf/util/session.c +@@ -1570,7 +1570,7 @@ static s64 perf_session__process_user_event(struct perf_session *session, + struct perf_tool *tool = session->tool; + struct perf_sample sample = { .time = 0, }; + int fd = perf_data__fd(session->data); +- int err; ++ s64 err; + + if (event->header.type != PERF_RECORD_COMPRESSED || + tool->compressed == perf_session__process_compressed_event_stub) +-- +2.51.0 + diff --git a/queue-5.10/perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch b/queue-5.10/perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch new file mode 100644 index 0000000000..118ca2d315 --- /dev/null +++ b/queue-5.10/perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch @@ -0,0 +1,202 @@ +From d1dca40086f08f3f57133962e15b469c4d0096ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 15:22:00 -0700 +Subject: perf test: Don't leak workload gopipe in PERF_RECORD_* + +From: Ian Rogers + +[ Upstream commit 48918cacefd226af44373e914e63304927c0e7dc ] + +The test starts a workload and then opens events. If the events fail +to open, for example because of perf_event_paranoid, the gopipe of the +workload is leaked and the file descriptor leak check fails when the +test exits. To avoid this cancel the workload when opening the events +fails. + +Before: +``` +$ perf test -vv 7 + 7: PERF_RECORD_* events & perf_sample fields: + --- start --- +test child forked, pid 1189568 +Using CPUID GenuineIntel-6-B7-1 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 +sys_perf_event_open failed, error -13 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + exclude_kernel 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 +sys_perf_event_open failed, error -13 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + exclude_kernel 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3 +Attempt to add: software/cpu-clock/ +..after resolving event: software/config=0/ +cpu-clock -> software/cpu-clock/ + ------------------------------------------------------------ +perf_event_attr: + type 1 (PERF_TYPE_SOFTWARE) + size 136 + config 0x9 (PERF_COUNT_SW_DUMMY) + sample_type IP|TID|TIME|CPU + read_format ID|LOST + disabled 1 + inherit 1 + mmap 1 + comm 1 + enable_on_exec 1 + task 1 + sample_id_all 1 + mmap2 1 + comm_exec 1 + ksymbol 1 + bpf_event 1 + { wakeup_events, wakeup_watermark } 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 1189569 cpu 0 group_fd -1 flags 0x8 +sys_perf_event_open failed, error -13 +perf_evlist__open: Permission denied + ---- end(-2) ---- +Leak of file descriptor 6 that opened: 'pipe:[14200347]' + ---- unexpected signal (6) ---- +iFailed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon + #0 0x565358f6666e in child_test_sig_handler builtin-test.c:311 + #1 0x7f29ce849df0 in __restore_rt libc_sigaction.c:0 + #2 0x7f29ce89e95c in __pthread_kill_implementation pthread_kill.c:44 + #3 0x7f29ce849cc2 in raise raise.c:27 + #4 0x7f29ce8324ac in abort abort.c:81 + #5 0x565358f662d4 in check_leaks builtin-test.c:226 + #6 0x565358f6682e in run_test_child builtin-test.c:344 + #7 0x565358ef7121 in start_command run-command.c:128 + #8 0x565358f67273 in start_test builtin-test.c:545 + #9 0x565358f6771d in __cmd_test builtin-test.c:647 + #10 0x565358f682bd in cmd_test builtin-test.c:849 + #11 0x565358ee5ded in run_builtin perf.c:349 + #12 0x565358ee6085 in handle_internal_command perf.c:401 + #13 0x565358ee61de in run_argv perf.c:448 + #14 0x565358ee6527 in main perf.c:555 + #15 0x7f29ce833ca8 in __libc_start_call_main libc_start_call_main.h:74 + #16 0x7f29ce833d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128 + #17 0x565358e391c1 in _start perf[851c1] + 7: PERF_RECORD_* events & perf_sample fields : FAILED! +``` + +After: +``` +$ perf test 7 + 7: PERF_RECORD_* events & perf_sample fields : Skip (permissions) +``` + +Fixes: 16d00fee703866c6 ("perf tests: Move test__PERF_RECORD into separate object") +Signed-off-by: Ian Rogers +Tested-by: Arnaldo Carvalho de Melo +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Chun-Tse Shao +Cc: Howard Chu +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/perf-record.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/tools/perf/tests/perf-record.c b/tools/perf/tests/perf-record.c +index 67d3f5aad0167..160691a1d5522 100644 +--- a/tools/perf/tests/perf-record.c ++++ b/tools/perf/tests/perf-record.c +@@ -115,6 +115,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus + if (err < 0) { + pr_debug("sched__get_first_possible_cpu: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +@@ -126,6 +127,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus + if (sched_setaffinity(evlist->workload.pid, cpu_mask_size, &cpu_mask) < 0) { + pr_debug("sched_setaffinity: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +@@ -137,6 +139,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus + if (err < 0) { + pr_debug("perf_evlist__open: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +@@ -149,6 +152,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus + if (err < 0) { + pr_debug("evlist__mmap: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +-- +2.51.0 + diff --git a/queue-5.10/perf-util-fix-compression-checks-returning-1-as-bool.patch b/queue-5.10/perf-util-fix-compression-checks-returning-1-as-bool.patch new file mode 100644 index 0000000000..6f841ba922 --- /dev/null +++ b/queue-5.10/perf-util-fix-compression-checks-returning-1-as-bool.patch @@ -0,0 +1,67 @@ +From 1f26ebb31e0e9ec3a7eba8ae83ebc3873091426d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 16:25:08 +0000 +Subject: perf util: Fix compression checks returning -1 as bool + +From: Yunseong Kim + +[ Upstream commit 43fa1141e2c1af79c91aaa4df03e436c415a6fc3 ] + +The lzma_is_compressed and gzip_is_compressed functions are declared +to return a "bool" type, but in case of an error (e.g., file open +failure), they incorrectly returned -1. + +A bool type is a boolean value that is either true or false. +Returning -1 for a bool return type can lead to unexpected behavior +and may violate strict type-checking in some compilers. + +Fix the return value to be false in error cases, ensuring the function +adheres to its declared return type improves for preventing potential +bugs related to type mismatch. + +Fixes: 4b57fd44b61beb51 ("perf tools: Add lzma_is_compressed function") +Reviewed-by: Ian Rogers +Signed-off-by: Yunseong Kim +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Namhyung Kim +Cc: Stephen Brennan +Link: https://lore.kernel.org/r/20250822162506.316844-3-ysk@kzalloc.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/lzma.c | 2 +- + tools/perf/util/zlib.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/lzma.c b/tools/perf/util/lzma.c +index 51424cdc3b682..aa9a0ebc1f937 100644 +--- a/tools/perf/util/lzma.c ++++ b/tools/perf/util/lzma.c +@@ -115,7 +115,7 @@ bool lzma_is_compressed(const char *input) + ssize_t rc; + + if (fd < 0) +- return -1; ++ return false; + + rc = read(fd, buf, sizeof(buf)); + close(fd); +diff --git a/tools/perf/util/zlib.c b/tools/perf/util/zlib.c +index 78d2297c1b674..1f7c065230599 100644 +--- a/tools/perf/util/zlib.c ++++ b/tools/perf/util/zlib.c +@@ -88,7 +88,7 @@ bool gzip_is_compressed(const char *input) + ssize_t rc; + + if (fd < 0) +- return -1; ++ return false; + + rc = read(fd, buf, sizeof(buf)); + close(fd); +-- +2.51.0 + diff --git a/queue-5.10/rtc-x1205-fix-xicor-x1205-vendor-prefix.patch b/queue-5.10/rtc-x1205-fix-xicor-x1205-vendor-prefix.patch new file mode 100644 index 0000000000..da04c73892 --- /dev/null +++ b/queue-5.10/rtc-x1205-fix-xicor-x1205-vendor-prefix.patch @@ -0,0 +1,39 @@ +From 41c9479c435299ce64b771b9ab6645fdf46cc42f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 16:57:02 -0500 +Subject: rtc: x1205: Fix Xicor X1205 vendor prefix + +From: Rob Herring (Arm) + +[ Upstream commit 606d19ee37de3a72f1b6e95a4ea544f6f20dbb46 ] + +The vendor for the X1205 RTC is not Xircom, but Xicor which was acquired +by Intersil. Since the I2C subsystem drops the vendor prefix for driver +matching, the vendor prefix hasn't mattered. + +Fixes: 6875404fdb44 ("rtc: x1205: Add DT probing support") +Signed-off-by: Rob Herring (Arm) +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20250821215703.869628-2-robh@kernel.org +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-x1205.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-x1205.c b/drivers/rtc/rtc-x1205.c +index d1d5a44d9122a..3b3aaa7d8283c 100644 +--- a/drivers/rtc/rtc-x1205.c ++++ b/drivers/rtc/rtc-x1205.c +@@ -671,7 +671,7 @@ static const struct i2c_device_id x1205_id[] = { + MODULE_DEVICE_TABLE(i2c, x1205_id); + + static const struct of_device_id x1205_dt_ids[] = { +- { .compatible = "xircom,x1205", }, ++ { .compatible = "xicor,x1205", }, + {}, + }; + MODULE_DEVICE_TABLE(of, x1205_dt_ids); +-- +2.51.0 + diff --git a/queue-5.10/scsi-libsas-add-sas_task_find_rq.patch b/queue-5.10/scsi-libsas-add-sas_task_find_rq.patch new file mode 100644 index 0000000000..576ffb0773 --- /dev/null +++ b/queue-5.10/scsi-libsas-add-sas_task_find_rq.patch @@ -0,0 +1,59 @@ +From b37f6614629bc16560cee0f48a85f95ada14bd0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 19:15:57 +0800 +Subject: scsi: libsas: Add sas_task_find_rq() + +From: John Garry + +[ Upstream commit a9ee3f840646e2ec419c734e592ffe997195435e ] + +blk-mq already provides a unique tag per request. Some libsas LLDDs - like +hisi_sas - already use this tag as the unique per-I/O HW tag. + +Add a common function to provide the request associated with a sas_task for +all libsas LLDDs. + +Signed-off-by: John Garry +Link: https://lore.kernel.org/r/1666091763-11023-2-git-send-email-john.garry@huawei.com +Reviewed-by: Jack Wang +Reviewed-by: Jason Yan +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue") +Signed-off-by: Sasha Levin +--- + include/scsi/libsas.h | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h +index daf9b07956abf..a4d34c118f8f7 100644 +--- a/include/scsi/libsas.h ++++ b/include/scsi/libsas.h +@@ -622,6 +622,24 @@ extern struct sas_task *sas_alloc_task(gfp_t flags); + extern struct sas_task *sas_alloc_slow_task(gfp_t flags); + extern void sas_free_task(struct sas_task *task); + ++static inline struct request *sas_task_find_rq(struct sas_task *task) ++{ ++ struct scsi_cmnd *scmd; ++ ++ if (task->task_proto & SAS_PROTOCOL_STP_ALL) { ++ struct ata_queued_cmd *qc = task->uldd_task; ++ ++ scmd = qc ? qc->scsicmd : NULL; ++ } else { ++ scmd = task->uldd_task; ++ } ++ ++ if (!scmd) ++ return NULL; ++ ++ return scsi_cmd_to_rq(scmd); ++} ++ + struct sas_domain_function_template { + /* The class calls these to notify the LLDD of an event. */ + void (*lldd_port_formed)(struct asd_sas_phy *); +-- +2.51.0 + diff --git a/queue-5.10/scsi-mvsas-delete-mvs_tag_init.patch b/queue-5.10/scsi-mvsas-delete-mvs_tag_init.patch new file mode 100644 index 0000000000..e8fcdfae7f --- /dev/null +++ b/queue-5.10/scsi-mvsas-delete-mvs_tag_init.patch @@ -0,0 +1,72 @@ +From f2459efd2cc587707d039435d73945ca843e8ebc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 19:16:02 +0800 +Subject: scsi: mvsas: Delete mvs_tag_init() + +From: John Garry + +[ Upstream commit ffc9f9bf3f14876d019f67ef17d41138802529a8 ] + +All mvs_tag_init() does is zero the tag bitmap, but this is already done +with the kzalloc() call to alloc the tags, so delete this unneeded +function. + +Signed-off-by: John Garry +Link: https://lore.kernel.org/r/1666091763-11023-7-git-send-email-john.garry@huawei.com +Reviewed-by: Damien Le Moal +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue") +Signed-off-by: Sasha Levin +--- + drivers/scsi/mvsas/mv_init.c | 2 -- + drivers/scsi/mvsas/mv_sas.c | 7 ------- + drivers/scsi/mvsas/mv_sas.h | 1 - + 3 files changed, 10 deletions(-) + +diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c +index 85ca8421fb862..17a4fc7cd14bb 100644 +--- a/drivers/scsi/mvsas/mv_init.c ++++ b/drivers/scsi/mvsas/mv_init.c +@@ -287,8 +287,6 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host *shost) + } + mvi->tags_num = slot_nr; + +- /* Initialize tags */ +- mvs_tag_init(mvi); + return 0; + err_out: + return 1; +diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c +index 239b81ab924f7..4450641f6e736 100644 +--- a/drivers/scsi/mvsas/mv_sas.c ++++ b/drivers/scsi/mvsas/mv_sas.c +@@ -51,13 +51,6 @@ inline int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out) + return 0; + } + +-void mvs_tag_init(struct mvs_info *mvi) +-{ +- int i; +- for (i = 0; i < mvi->tags_num; ++i) +- mvs_tag_clear(mvi, i); +-} +- + static struct mvs_info *mvs_find_dev_mvi(struct domain_device *dev) + { + unsigned long i = 0, j = 0, hi = 0; +diff --git a/drivers/scsi/mvsas/mv_sas.h b/drivers/scsi/mvsas/mv_sas.h +index 327fdd5ee962f..8617a5ff5fe93 100644 +--- a/drivers/scsi/mvsas/mv_sas.h ++++ b/drivers/scsi/mvsas/mv_sas.h +@@ -428,7 +428,6 @@ void mvs_tag_clear(struct mvs_info *mvi, u32 tag); + void mvs_tag_free(struct mvs_info *mvi, u32 tag); + void mvs_tag_set(struct mvs_info *mvi, unsigned int tag); + int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out); +-void mvs_tag_init(struct mvs_info *mvi); + void mvs_iounmap(void __iomem *regs); + int mvs_ioremap(struct mvs_info *mvi, int bar, int bar_ex); + void mvs_phys_reset(struct mvs_info *mvi, u32 phy_mask, int hard); +-- +2.51.0 + diff --git a/queue-5.10/scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch b/queue-5.10/scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch new file mode 100644 index 0000000000..fa2277a35c --- /dev/null +++ b/queue-5.10/scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch @@ -0,0 +1,56 @@ +From b98ed88bce00d6283fe55988a103113f5abfe32a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Sep 2025 21:42:01 +0800 +Subject: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue + +From: Duoming Zhou + +[ Upstream commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 ] + +During the detaching of Marvell's SAS/SATA controller, the original code +calls cancel_delayed_work() in mvs_free() to cancel the delayed work +item mwq->work_q. However, if mwq->work_q is already running, the +cancel_delayed_work() may fail to cancel it. This can lead to +use-after-free scenarios where mvs_free() frees the mvs_info while +mvs_work_queue() is still executing and attempts to access the +already-freed mvs_info. + +A typical race condition is illustrated below: + +CPU 0 (remove) | CPU 1 (delayed work callback) +mvs_pci_remove() | + mvs_free() | mvs_work_queue() + cancel_delayed_work() | + kfree(mvi) | + | mvi-> // UAF + +Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure +that the delayed work item is properly canceled and any executing +delayed work item completes before the mvs_info is deallocated. + +This bug was found by static analysis. + +Fixes: 20b09c2992fe ("[SCSI] mvsas: add support for 94xx; layout change; bug fixes") +Signed-off-by: Duoming Zhou +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mvsas/mv_init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c +index ccbea18f8ee12..c9dfbc1e37655 100644 +--- a/drivers/scsi/mvsas/mv_init.c ++++ b/drivers/scsi/mvsas/mv_init.c +@@ -142,7 +142,7 @@ static void mvs_free(struct mvs_info *mvi) + if (mvi->shost) + scsi_host_put(mvi->shost); + list_for_each_entry(mwq, &mvi->wq_list, entry) +- cancel_delayed_work(&mwq->work_q); ++ cancel_delayed_work_sync(&mwq->work_q); + kfree(mvi->rsvd_tags); + kfree(mvi); + } +-- +2.51.0 + diff --git a/queue-5.10/scsi-mvsas-use-sas_task_find_rq-for-tagging.patch b/queue-5.10/scsi-mvsas-use-sas_task_find_rq-for-tagging.patch new file mode 100644 index 0000000000..1b1ac16c5a --- /dev/null +++ b/queue-5.10/scsi-mvsas-use-sas_task_find_rq-for-tagging.patch @@ -0,0 +1,201 @@ +From a0c5512022779c7fc68399f51c7a5a9ba96f606a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 19:16:03 +0800 +Subject: scsi: mvsas: Use sas_task_find_rq() for tagging + +From: John Garry + +[ Upstream commit 2acf97f199f9eba8321390325519e9b6bff60108 ] + +The request associated with a SCSI command coming from the block layer has +a unique tag, so use that when possible for getting a slot. + +Unfortunately we don't support reserved commands in the SCSI midlayer yet. +As such, SMP tasks - as an example - will not have a request associated, so +in the interim continue to manage those tags for that type of sas_task +internally. + +We reserve an arbitrary 4 tags for these internal tags. Indeed, we already +decrement MVS_RSVD_SLOTS by 2 for the shost can_queue when flag +MVF_FLAG_SOC is set. This change was made in commit 20b09c2992fe ("[SCSI] +mvsas: add support for 94xx; layout change; bug fixes"), but what those 2 +slots are used for is not obvious. + +Also make the tag management functions static, where possible. + +Signed-off-by: John Garry +Link: https://lore.kernel.org/r/1666091763-11023-8-git-send-email-john.garry@huawei.com +Signed-off-by: Martin K. Petersen +Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue") +Signed-off-by: Sasha Levin +--- + drivers/scsi/mvsas/mv_defs.h | 1 + + drivers/scsi/mvsas/mv_init.c | 9 +++++---- + drivers/scsi/mvsas/mv_sas.c | 35 ++++++++++++++++++++++------------- + drivers/scsi/mvsas/mv_sas.h | 7 +------ + 4 files changed, 29 insertions(+), 23 deletions(-) + +diff --git a/drivers/scsi/mvsas/mv_defs.h b/drivers/scsi/mvsas/mv_defs.h +index 199ab49aa047f..3ec1c7546cdb4 100644 +--- a/drivers/scsi/mvsas/mv_defs.h ++++ b/drivers/scsi/mvsas/mv_defs.h +@@ -40,6 +40,7 @@ enum driver_configuration { + MVS_ATA_CMD_SZ = 96, /* SATA command table buffer size */ + MVS_OAF_SZ = 64, /* Open address frame buffer size */ + MVS_QUEUE_SIZE = 64, /* Support Queue depth */ ++ MVS_RSVD_SLOTS = 4, + MVS_SOC_CAN_QUEUE = MVS_SOC_SLOTS - 2, + }; + +diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c +index 17a4fc7cd14bb..ccbea18f8ee12 100644 +--- a/drivers/scsi/mvsas/mv_init.c ++++ b/drivers/scsi/mvsas/mv_init.c +@@ -143,7 +143,7 @@ static void mvs_free(struct mvs_info *mvi) + scsi_host_put(mvi->shost); + list_for_each_entry(mwq, &mvi->wq_list, entry) + cancel_delayed_work(&mwq->work_q); +- kfree(mvi->tags); ++ kfree(mvi->rsvd_tags); + kfree(mvi); + } + +@@ -285,7 +285,6 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host *shost) + printk(KERN_DEBUG "failed to create dma pool %s.\n", pool_name); + goto err_out; + } +- mvi->tags_num = slot_nr; + + return 0; + err_out: +@@ -368,8 +367,8 @@ static struct mvs_info *mvs_pci_alloc(struct pci_dev *pdev, + mvi->sas = sha; + mvi->shost = shost; + +- mvi->tags = kzalloc(MVS_CHIP_SLOT_SZ>>3, GFP_KERNEL); +- if (!mvi->tags) ++ mvi->rsvd_tags = bitmap_zalloc(MVS_RSVD_SLOTS, GFP_KERNEL); ++ if (!mvi->rsvd_tags) + goto err_out; + + if (MVS_CHIP_DISP->chip_ioremap(mvi)) +@@ -470,6 +469,8 @@ static void mvs_post_sas_ha_init(struct Scsi_Host *shost, + else + can_queue = MVS_CHIP_SLOT_SZ; + ++ can_queue -= MVS_RSVD_SLOTS; ++ + shost->sg_tablesize = min_t(u16, SG_ALL, MVS_MAX_SG); + shost->can_queue = can_queue; + mvi->shost->cmd_per_lun = MVS_QUEUE_SIZE; +diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c +index 4450641f6e736..6fca411007343 100644 +--- a/drivers/scsi/mvsas/mv_sas.c ++++ b/drivers/scsi/mvsas/mv_sas.c +@@ -20,31 +20,34 @@ static int mvs_find_tag(struct mvs_info *mvi, struct sas_task *task, u32 *tag) + return 0; + } + +-void mvs_tag_clear(struct mvs_info *mvi, u32 tag) ++static void mvs_tag_clear(struct mvs_info *mvi, u32 tag) + { +- void *bitmap = mvi->tags; ++ void *bitmap = mvi->rsvd_tags; + clear_bit(tag, bitmap); + } + +-void mvs_tag_free(struct mvs_info *mvi, u32 tag) ++static void mvs_tag_free(struct mvs_info *mvi, u32 tag) + { ++ if (tag >= MVS_RSVD_SLOTS) ++ return; ++ + mvs_tag_clear(mvi, tag); + } + +-void mvs_tag_set(struct mvs_info *mvi, unsigned int tag) ++static void mvs_tag_set(struct mvs_info *mvi, unsigned int tag) + { +- void *bitmap = mvi->tags; ++ void *bitmap = mvi->rsvd_tags; + set_bit(tag, bitmap); + } + +-inline int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out) ++static int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out) + { + unsigned int index, tag; +- void *bitmap = mvi->tags; ++ void *bitmap = mvi->rsvd_tags; + +- index = find_first_zero_bit(bitmap, mvi->tags_num); ++ index = find_first_zero_bit(bitmap, MVS_RSVD_SLOTS); + tag = index; +- if (tag >= mvi->tags_num) ++ if (tag >= MVS_RSVD_SLOTS) + return -SAS_QUEUE_FULL; + mvs_tag_set(mvi, tag); + *tag_out = tag; +@@ -691,6 +694,7 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf + struct mvs_task_exec_info tei; + struct mvs_slot_info *slot; + u32 tag = 0xdeadbeef, n_elem = 0; ++ struct request *rq; + int rc = 0; + + if (!dev->port) { +@@ -755,9 +759,14 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf + n_elem = task->num_scatter; + } + +- rc = mvs_tag_alloc(mvi, &tag); +- if (rc) +- goto err_out; ++ rq = sas_task_find_rq(task); ++ if (rq) { ++ tag = rq->tag + MVS_RSVD_SLOTS; ++ } else { ++ rc = mvs_tag_alloc(mvi, &tag); ++ if (rc) ++ goto err_out; ++ } + + slot = &mvi->slot_info[tag]; + +@@ -860,7 +869,7 @@ int mvs_queue_command(struct sas_task *task, gfp_t gfp_flags) + static void mvs_slot_free(struct mvs_info *mvi, u32 rx_desc) + { + u32 slot_idx = rx_desc & RXQ_SLOT_MASK; +- mvs_tag_clear(mvi, slot_idx); ++ mvs_tag_free(mvi, slot_idx); + } + + static void mvs_slot_task_free(struct mvs_info *mvi, struct sas_task *task, +diff --git a/drivers/scsi/mvsas/mv_sas.h b/drivers/scsi/mvsas/mv_sas.h +index 8617a5ff5fe93..ab1f7fb85574d 100644 +--- a/drivers/scsi/mvsas/mv_sas.h ++++ b/drivers/scsi/mvsas/mv_sas.h +@@ -370,8 +370,7 @@ struct mvs_info { + u32 chip_id; + const struct mvs_chip_info *chip; + +- int tags_num; +- unsigned long *tags; ++ unsigned long *rsvd_tags; + /* further per-slot information */ + struct mvs_phy phy[MVS_MAX_PHYS]; + struct mvs_port port[MVS_MAX_PHYS]; +@@ -424,10 +423,6 @@ struct mvs_task_exec_info { + + /******************** function prototype *********************/ + void mvs_get_sas_addr(void *buf, u32 buflen); +-void mvs_tag_clear(struct mvs_info *mvi, u32 tag); +-void mvs_tag_free(struct mvs_info *mvi, u32 tag); +-void mvs_tag_set(struct mvs_info *mvi, unsigned int tag); +-int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out); + void mvs_iounmap(void __iomem *regs); + int mvs_ioremap(struct mvs_info *mvi, int bar, int bar_ex); + void mvs_phys_reset(struct mvs_info *mvi, u32 phy_mask, int hard); +-- +2.51.0 + diff --git a/queue-5.10/series b/queue-5.10/series index 3ad7e9e2b1..4d8b668ff6 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -96,3 +96,32 @@ bus-fsl-mc-check-return-value-of-platform_get_resource.patch fs-always-return-zero-on-success-from-replace_fd.patch clocksource-drivers-clps711x-fix-resource-leaks-in-error-paths.patch iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch +libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch +clk-at91-peripheral-fix-return-value.patch +perf-util-fix-compression-checks-returning-1-as-bool.patch +rtc-x1205-fix-xicor-x1205-vendor-prefix.patch +perf-session-fix-handling-when-buffer-exceeds-2-gib.patch +perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch +clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch +clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch +scsi-libsas-add-sas_task_find_rq.patch +scsi-mvsas-delete-mvs_tag_init.patch +scsi-mvsas-use-sas_task_find_rq-for-tagging.patch +scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch +net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch +drm-vmwgfx-fix-use-after-free-in-validation.patch +net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch +tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch +net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch +tools-build-align-warning-options-with-perf.patch +mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch +mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch +bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch +drm-amdgpu-add-additional-dce6-scl-registers.patch +drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch +drm-amd-display-properly-clear-scl_-_filter_control-.patch +drm-amd-display-properly-disable-scaling-on-dce6.patch +crypto-essiv-check-ssize-for-decryption-and-in-place.patch +tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch +gpio-wcd934x-remove-duplicate-assignment-of-of_gpio_.patch +gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch diff --git a/queue-5.10/tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch b/queue-5.10/tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch new file mode 100644 index 0000000000..ea436a83fa --- /dev/null +++ b/queue-5.10/tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch @@ -0,0 +1,87 @@ +From 1cd2eb3874d6965c0304390ad20d8ab2e9a06ca2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 23:37:54 +0000 +Subject: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). + +From: Kuniyuki Iwashima + +[ Upstream commit 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c ] + +syzbot reported the splat below in tcp_conn_request(). [0] + +If a listener is close()d while a TFO socket is being processed in +tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk +and calls inet_child_forget(), which calls tcp_disconnect() for the +TFO socket. + +After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), +where reqsk_put() is called due to !reqsk->sk. + +Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the +last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the +drop_and_free label causes the refcount underflow for the listener +and double-free of the reqsk. + +Let's remove reqsk_fastopen_remove() in tcp_conn_request(). + +Note that other callers make sure tp->fastopen_rsk is not NULL. + +[0]: +refcount_t: underflow; use-after-free. +WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) +Modules linked in: +CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 +RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) +Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 +RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 +RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 +RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280 +RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 +R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 +R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8 +FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0 +Call Trace: + + tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) + tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) + tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) + tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) + ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) + ip6_input (net/ipv6/ip6_input.c:500) + ipv6_rcv (net/ipv6/ip6_input.c:311) + __netif_receive_skb (net/core/dev.c:6104) + process_backlog (net/core/dev.c:6456) + __napi_poll (net/core/dev.c:7506) + net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) + handle_softirqs (kernel/softirq.c:579) + do_softirq (kernel/softirq.c:480) + + +Fixes: 45c8a6cc2bcd ("tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().") +Reported-by: syzkaller +Signed-off-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20251001233755.1340927-1-kuniyu@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 64a87a39287a1..50af55778617c 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -7000,7 +7000,6 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, + &foc, TCP_SYNACK_FASTOPEN, skb); + /* Add the child socket directly into the accept queue */ + if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) { +- reqsk_fastopen_remove(fastopen_sk, req, false); + bh_unlock_sock(fastopen_sk); + sock_put(fastopen_sk); + goto drop_and_free; +-- +2.51.0 + diff --git a/queue-5.10/tools-build-align-warning-options-with-perf.patch b/queue-5.10/tools-build-align-warning-options-with-perf.patch new file mode 100644 index 0000000000..d0ddc2d87d --- /dev/null +++ b/queue-5.10/tools-build-align-warning-options-with-perf.patch @@ -0,0 +1,62 @@ +From ea8d41e1a0ac7800575fc763588f78a80c1eb0e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Oct 2025 17:21:23 +0100 +Subject: tools build: Align warning options with perf + +From: Leo Yan + +[ Upstream commit 53d067feb8c4f16d1f24ce3f4df4450bb18c555f ] + +The feature test programs are built without enabling '-Wall -Werror' +options. As a result, a feature may appear to be available, but later +building in perf can fail with stricter checks. + +Make the feature test program use the same warning options as perf. + +Fixes: 1925459b4d92 ("tools build: Fix feature Makefile issues with 'O='") +Signed-off-by: Leo Yan +Reviewed-by: Ian Rogers +Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-1-4305590795b2@arm.com +Cc: Palmer Dabbelt +Cc: Albert Ou +Cc: Alexandre Ghiti +Cc: Nick Desaulniers +Cc: Justin Stitt +Cc: Bill Wendling +Cc: Adrian Hunter +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Nathan Chancellor +Cc: James Clark +Cc: linux-riscv@lists.infradead.org +Cc: llvm@lists.linux.dev +Cc: Paul Walmsley +Cc: linux-kernel@vger.kernel.org +Cc: linux-perf-users@vger.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/build/feature/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile +index 221250973d078..432a35bb5e90a 100644 +--- a/tools/build/feature/Makefile ++++ b/tools/build/feature/Makefile +@@ -263,10 +263,10 @@ $(OUTPUT)test-sync-compare-and-swap.bin: + $(BUILD) + + $(OUTPUT)test-compile-32.bin: +- $(CC) -m32 -o $@ test-compile.c ++ $(CC) -m32 -Wall -Werror -o $@ test-compile.c + + $(OUTPUT)test-compile-x32.bin: +- $(CC) -mx32 -o $@ test-compile.c ++ $(CC) -mx32 -Wall -Werror -o $@ test-compile.c + + $(OUTPUT)test-zlib.bin: + $(BUILD) -lz +-- +2.51.0 + diff --git a/queue-5.10/tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch b/queue-5.10/tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch new file mode 100644 index 0000000000..63f2e2b38f --- /dev/null +++ b/queue-5.10/tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch @@ -0,0 +1,42 @@ +From c0bec29f27d85f85f3e4aa2129d2c853dc26cc45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 18:49:40 +0300 +Subject: tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single + +From: Gunnar Kudrjavets + +[ Upstream commit 8a81236f2cb0882c7ea6c621ce357f7f3f601fe5 ] + +The tpm_tis_write8() call specifies arguments in wrong order. Should be +(data, addr, value) not (data, value, addr). The initial correct order +was changed during the major refactoring when the code was split. + +Fixes: 41a5e1cf1fe1 ("tpm/tpm_tis: Split tpm_tis driver into a core and TCG TIS compliant phy") +Signed-off-by: Gunnar Kudrjavets +Reviewed-by: Justinien Bouron +Reviewed-by: Jarkko Sakkinen +Reviewed-by: Paul Menzel +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index b3452259d6e0b..c8c68301543b2 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -831,8 +831,8 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, + * will call disable_irq which undoes all of the above. + */ + if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) { +- tpm_tis_write8(priv, original_int_vec, +- TPM_INT_VECTOR(priv->locality)); ++ tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), ++ original_int_vec); + rc = -1; + } + +-- +2.51.0 + diff --git a/queue-5.15/bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch b/queue-5.15/bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch new file mode 100644 index 0000000000..87b97fd237 --- /dev/null +++ b/queue-5.15/bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch @@ -0,0 +1,74 @@ +From 515ed2ae9787de0bdd40da26ae643d2572c9b6eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 18:26:26 +0800 +Subject: bpf: Avoid RCU context warning when unpinning htab with internal + structs + +From: KaFai Wan + +[ Upstream commit 4f375ade6aa9f37fd72d7a78682f639772089eed ] + +When unpinning a BPF hash table (htab or htab_lru) that contains internal +structures (timer, workqueue, or task_work) in its values, a BUG warning +is triggered: + BUG: sleeping function called from invalid context at kernel/bpf/hashtab.c:244 + in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 14, name: ksoftirqd/0 + ... + +The issue arises from the interaction between BPF object unpinning and +RCU callback mechanisms: +1. BPF object unpinning uses ->free_inode() which schedules cleanup via + call_rcu(), deferring the actual freeing to an RCU callback that + executes within the RCU_SOFTIRQ context. +2. During cleanup of hash tables containing internal structures, + htab_map_free_internal_structs() is invoked, which includes + cond_resched() or cond_resched_rcu() calls to yield the CPU during + potentially long operations. + +However, cond_resched() or cond_resched_rcu() cannot be safely called from +atomic RCU softirq context, leading to the BUG warning when attempting +to reschedule. + +Fix this by changing from ->free_inode() to ->destroy_inode() and rename +bpf_free_inode() to bpf_destroy_inode() for BPF objects (prog, map, link). +This allows direct inode freeing without RCU callback scheduling, +avoiding the invalid context warning. + +Reported-by: Le Chen +Closes: https://lore.kernel.org/all/1444123482.1827743.1750996347470.JavaMail.zimbra@sjtu.edu.cn/ +Fixes: 68134668c17f ("bpf: Add map side support for bpf timers.") +Suggested-by: Alexei Starovoitov +Signed-off-by: KaFai Wan +Acked-by: Yonghong Song +Link: https://lore.kernel.org/r/20251008102628.808045-2-kafai.wan@linux.dev +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/inode.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c +index 5a8d9f7467bf4..849df8268af57 100644 +--- a/kernel/bpf/inode.c ++++ b/kernel/bpf/inode.c +@@ -610,7 +610,7 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root) + return 0; + } + +-static void bpf_free_inode(struct inode *inode) ++static void bpf_destroy_inode(struct inode *inode) + { + enum bpf_type type; + +@@ -625,7 +625,7 @@ static const struct super_operations bpf_super_ops = { + .statfs = simple_statfs, + .drop_inode = generic_delete_inode, + .show_options = bpf_show_options, +- .free_inode = bpf_free_inode, ++ .destroy_inode = bpf_destroy_inode, + }; + + enum { +-- +2.51.0 + diff --git a/queue-5.15/bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch b/queue-5.15/bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch new file mode 100644 index 0000000000..488fd99413 --- /dev/null +++ b/queue-5.15/bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch @@ -0,0 +1,64 @@ +From d70eeb15268aae3e4440bf9d691e418d45adaa6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 09:34:18 +0200 +Subject: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} + +From: Daniel Borkmann + +[ Upstream commit 23f3770e1a53e6c7a553135011f547209e141e72 ] + +Cilium has a BPF egress gateway feature which forces outgoing K8s Pod +traffic to pass through dedicated egress gateways which then SNAT the +traffic in order to interact with stable IPs outside the cluster. + +The traffic is directed to the gateway via vxlan tunnel in collect md +mode. A recent BPF change utilized the bpf_redirect_neigh() helper to +forward packets after the arrival and decap on vxlan, which turned out +over time that the kmalloc-256 slab usage in kernel was ever-increasing. + +The issue was that vxlan allocates the metadata_dst object and attaches +it through a fake dst entry to the skb. The latter was never released +though given bpf_redirect_neigh() was merely setting the new dst entry +via skb_dst_set() without dropping an existing one first. + +Fixes: b4ab31414970 ("bpf: Add redirect_neigh helper as redirect drop-in") +Reported-by: Yusuke Suzuki +Reported-by: Julian Wiedmann +Signed-off-by: Daniel Borkmann +Cc: Martin KaFai Lau +Cc: Jakub Kicinski +Cc: Jordan Rife +Reviewed-by: Simon Horman +Reviewed-by: Jordan Rife +Reviewed-by: Jakub Kicinski +Reviewed-by: Martin KaFai Lau +Link: https://lore.kernel.org/r/20251003073418.291171-1-daniel@iogearbox.net +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/core/filter.c b/net/core/filter.c +index b95af925b9c27..1403829b96db9 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -2257,6 +2257,7 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev, + if (IS_ERR(dst)) + goto out_drop; + ++ skb_dst_drop(skb); + skb_dst_set(skb, dst); + } else if (nh->nh_family != AF_INET6) { + goto out_drop; +@@ -2364,6 +2365,7 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev, + goto out_drop; + } + ++ skb_dst_drop(skb); + skb_dst_set(skb, &rt->dst); + } + +-- +2.51.0 + diff --git a/queue-5.15/bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch b/queue-5.15/bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch new file mode 100644 index 0000000000..ef70111c54 --- /dev/null +++ b/queue-5.15/bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch @@ -0,0 +1,50 @@ +From 124309be0414dbafbbd0e9db669a7b38c957507e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 10:15:01 +0200 +Subject: bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() + +From: Eric Woudstra + +[ Upstream commit bbf0c98b3ad9edaea1f982de6c199cc11d3b7705 ] + +net/bridge/br_private.h:1627 suspicious rcu_dereference_protected() usage! +other info that might help us debug this: + +rcu_scheduler_active = 2, debug_locks = 1 +7 locks held by socat/410: + #0: ffff88800d7a9c90 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_stream_connect+0x43/0xa0 + #1: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x62/0x1830 + [..] + #6: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: nf_hook.constprop.0+0x8a/0x440 + +Call Trace: + lockdep_rcu_suspicious.cold+0x4f/0xb1 + br_vlan_fill_forward_path_pvid+0x32c/0x410 [bridge] + br_fill_forward_path+0x7a/0x4d0 [bridge] + +Use to correct helper, non _rcu variant requires RTNL mutex. + +Fixes: bcf2766b1377 ("net: bridge: resolve forwarding path for VLAN tag actions in bridge devices") +Signed-off-by: Eric Woudstra +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/bridge/br_vlan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c +index 86441ff78a0f8..055d988d280cd 100644 +--- a/net/bridge/br_vlan.c ++++ b/net/bridge/br_vlan.c +@@ -1391,7 +1391,7 @@ void br_vlan_fill_forward_path_pvid(struct net_bridge *br, + if (!br_opt_get(br, BROPT_VLAN_ENABLED)) + return; + +- vg = br_vlan_group(br); ++ vg = br_vlan_group_rcu(br); + + if (idx >= 0 && + ctx->vlan[idx].proto == br->vlan_proto) { +-- +2.51.0 + diff --git a/queue-5.15/clk-at91-peripheral-fix-return-value.patch b/queue-5.15/clk-at91-peripheral-fix-return-value.patch new file mode 100644 index 0000000000..600269ff4a --- /dev/null +++ b/queue-5.15/clk-at91-peripheral-fix-return-value.patch @@ -0,0 +1,44 @@ +From 068e81844cb00d85dfda423f75eb827249cb4e3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 11:17:53 -0400 +Subject: clk: at91: peripheral: fix return value + +From: Brian Masney + +[ Upstream commit 47b13635dabc14f1c2fdcaa5468b47ddadbdd1b5 ] + +determine_rate() is expected to return an error code, or 0 on success. +clk_sam9x5_peripheral_determine_rate() has a branch that returns the +parent rate on a certain case. This is the behavior of round_rate(), +so let's go ahead and fix this by setting req->rate. + +Fixes: b4c115c76184f ("clk: at91: clk-peripheral: add support for changeable parent rate") +Reviewed-by: Alexander Sverdlin +Acked-by: Nicolas Ferre +Signed-off-by: Brian Masney +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/clk-peripheral.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/at91/clk-peripheral.c b/drivers/clk/at91/clk-peripheral.c +index 7a27ba8e05779..7605ab23dc8ed 100644 +--- a/drivers/clk/at91/clk-peripheral.c ++++ b/drivers/clk/at91/clk-peripheral.c +@@ -268,8 +268,11 @@ static int clk_sam9x5_peripheral_determine_rate(struct clk_hw *hw, + long best_diff = LONG_MIN; + u32 shift; + +- if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max) +- return parent_rate; ++ if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max) { ++ req->rate = parent_rate; ++ ++ return 0; ++ } + + /* Fist step: check the available dividers. */ + for (shift = 0; shift <= PERIPHERAL_MAX_SHIFT; shift++) { +-- +2.51.0 + diff --git a/queue-5.15/clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch b/queue-5.15/clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch new file mode 100644 index 0000000000..d0fa9e1fa7 --- /dev/null +++ b/queue-5.15/clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch @@ -0,0 +1,50 @@ +From 37a7cfed7e8f169c4f368ddccdef41995e4128ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Jul 2025 13:11:55 -0700 +Subject: clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver + +From: Alok Tiwari + +[ Upstream commit 1624dead9a4d288a594fdf19735ebfe4bb567cb8 ] + +The conditional check for the PLL0 multiplier 'm' used a logical AND +instead of OR, making the range check ineffective. This patch replaces +&& with || to correctly reject invalid values of 'm' that are either +less than or equal to 0 or greater than LPC18XX_PLL0_MSEL_MAX. + +This ensures proper bounds checking during clk rate setting and rounding. + +Fixes: b04e0b8fd544 ("clk: add lpc18xx cgu clk driver") +Signed-off-by: Alok Tiwari +[sboyd@kernel.org: 'm' is unsigned so remove < condition] +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/nxp/clk-lpc18xx-cgu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c +index 44e07a3c253b9..ab8741fe57c99 100644 +--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c ++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c +@@ -385,7 +385,7 @@ static int lpc18xx_pll0_determine_rate(struct clk_hw *hw, + } + + m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2); +- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { ++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) { + pr_warn("%s: unable to support rate %lu\n", __func__, req->rate); + return -EINVAL; + } +@@ -408,7 +408,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, + } + + m = DIV_ROUND_UP_ULL(parent_rate, rate * 2); +- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { ++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) { + pr_warn("%s: unable to support rate %lu\n", __func__, rate); + return -EINVAL; + } +-- +2.51.0 + diff --git a/queue-5.15/clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch b/queue-5.15/clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch new file mode 100644 index 0000000000..1cb07d62b0 --- /dev/null +++ b/queue-5.15/clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch @@ -0,0 +1,68 @@ +From 91edd49af18954bb2b1394a10be463e4a2c71828 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 11:18:29 -0400 +Subject: clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() + +From: Brian Masney + +[ Upstream commit b46a3d323a5b7942e65025254c13801d0f475f02 ] + +The round_rate() clk ops is deprecated, so migrate this driver from +round_rate() to determine_rate() using the Coccinelle semantic patch +on the cover letter of this series. + +Signed-off-by: Brian Masney +Stable-dep-of: 1624dead9a4d ("clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver") +Signed-off-by: Sasha Levin +--- + drivers/clk/nxp/clk-lpc18xx-cgu.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c +index 8b686da5577b3..44e07a3c253b9 100644 +--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c ++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c +@@ -374,23 +374,25 @@ static unsigned long lpc18xx_pll0_recalc_rate(struct clk_hw *hw, + return 0; + } + +-static long lpc18xx_pll0_round_rate(struct clk_hw *hw, unsigned long rate, +- unsigned long *prate) ++static int lpc18xx_pll0_determine_rate(struct clk_hw *hw, ++ struct clk_rate_request *req) + { + unsigned long m; + +- if (*prate < rate) { ++ if (req->best_parent_rate < req->rate) { + pr_warn("%s: pll dividers not supported\n", __func__); + return -EINVAL; + } + +- m = DIV_ROUND_UP_ULL(*prate, rate * 2); ++ m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2); + if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { +- pr_warn("%s: unable to support rate %lu\n", __func__, rate); ++ pr_warn("%s: unable to support rate %lu\n", __func__, req->rate); + return -EINVAL; + } + +- return 2 * *prate * m; ++ req->rate = 2 * req->best_parent_rate * m; ++ ++ return 0; + } + + static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, +@@ -447,7 +449,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, + + static const struct clk_ops lpc18xx_pll0_ops = { + .recalc_rate = lpc18xx_pll0_recalc_rate, +- .round_rate = lpc18xx_pll0_round_rate, ++ .determine_rate = lpc18xx_pll0_determine_rate, + .set_rate = lpc18xx_pll0_set_rate, + }; + +-- +2.51.0 + diff --git a/queue-5.15/cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch b/queue-5.15/cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch new file mode 100644 index 0000000000..755dcd6ad1 --- /dev/null +++ b/queue-5.15/cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch @@ -0,0 +1,47 @@ +From fa7cd048eeb4cfafc01684c88510a3f02b814cc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 21:48:12 -0500 +Subject: cpufreq: tegra186: Set target frequency for all cpus in policy + +From: Aaron Kling + +[ Upstream commit 0b1bb980fd7cae126ee3d59f817068a13e321b07 ] + +The original commit set all cores in a cluster to a shared policy, but +did not update set_target to apply a frequency change to all cores for +the policy. This caused most cores to remain stuck at their boot +frequency. + +Fixes: be4ae8c19492 ("cpufreq: tegra186: Share policy per cluster") +Signed-off-by: Aaron Kling +Reviewed-by: Mikko Perttunen +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/tegra186-cpufreq.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c +index 5d1943e787b0c..af7edddaa84e4 100644 +--- a/drivers/cpufreq/tegra186-cpufreq.c ++++ b/drivers/cpufreq/tegra186-cpufreq.c +@@ -86,10 +86,14 @@ static int tegra186_cpufreq_set_target(struct cpufreq_policy *policy, + { + struct tegra186_cpufreq_data *data = cpufreq_get_driver_data(); + struct cpufreq_frequency_table *tbl = policy->freq_table + index; +- unsigned int edvd_offset = data->cpus[policy->cpu].edvd_offset; ++ unsigned int edvd_offset; + u32 edvd_val = tbl->driver_data; ++ u32 cpu; + +- writel(edvd_val, data->regs + edvd_offset); ++ for_each_cpu(cpu, policy->cpus) { ++ edvd_offset = data->cpus[cpu].edvd_offset; ++ writel(edvd_val, data->regs + edvd_offset); ++ } + + return 0; + } +-- +2.51.0 + diff --git a/queue-5.15/crypto-essiv-check-ssize-for-decryption-and-in-place.patch b/queue-5.15/crypto-essiv-check-ssize-for-decryption-and-in-place.patch new file mode 100644 index 0000000000..c0cfb5956d --- /dev/null +++ b/queue-5.15/crypto-essiv-check-ssize-for-decryption-and-in-place.patch @@ -0,0 +1,63 @@ +From 042d8ede72e8c29e7ddd4d930879e20106829240 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 15:54:20 +0800 +Subject: crypto: essiv - Check ssize for decryption and in-place encryption + +From: Herbert Xu + +[ Upstream commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f ] + +Move the ssize check to the start in essiv_aead_crypt so that +it's also checked for decryption and in-place encryption. + +Reported-by: Muhammad Alifa Ramdhan +Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation") +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/essiv.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/crypto/essiv.c b/crypto/essiv.c +index 3505b071e6471..365f3082ea041 100644 +--- a/crypto/essiv.c ++++ b/crypto/essiv.c +@@ -186,9 +186,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) + const struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm); + struct essiv_aead_request_ctx *rctx = aead_request_ctx(req); + struct aead_request *subreq = &rctx->aead_req; ++ int ivsize = crypto_aead_ivsize(tfm); ++ int ssize = req->assoclen - ivsize; + struct scatterlist *src = req->src; + int err; + ++ if (ssize < 0) ++ return -EINVAL; ++ + crypto_cipher_encrypt_one(tctx->essiv_cipher, req->iv, req->iv); + + /* +@@ -198,19 +203,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) + */ + rctx->assoc = NULL; + if (req->src == req->dst || !enc) { +- scatterwalk_map_and_copy(req->iv, req->dst, +- req->assoclen - crypto_aead_ivsize(tfm), +- crypto_aead_ivsize(tfm), 1); ++ scatterwalk_map_and_copy(req->iv, req->dst, ssize, ivsize, 1); + } else { + u8 *iv = (u8 *)aead_request_ctx(req) + tctx->ivoffset; +- int ivsize = crypto_aead_ivsize(tfm); +- int ssize = req->assoclen - ivsize; + struct scatterlist *sg; + int nents; + +- if (ssize < 0) +- return -EINVAL; +- + nents = sg_nents_for_len(req->src, ssize); + if (nents < 0) + return -EINVAL; +-- +2.51.0 + diff --git a/queue-5.15/drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch b/queue-5.15/drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch new file mode 100644 index 0000000000..da47f3b16a --- /dev/null +++ b/queue-5.15/drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch @@ -0,0 +1,39 @@ +From fce5162ae03b85152928c540e605123b83c696ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:22 +0200 +Subject: drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit d60f9c45d1bff7e20ecd57492ef7a5e33c94a37c ] + +Without these, it's impossible to program these registers. + +Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +index cbce194ec7b82..ff746fba850bc 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +@@ -155,6 +155,8 @@ + SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \ + SRI(VIEWPORT_START, SCL, id), \ + SRI(VIEWPORT_SIZE, SCL, id), \ ++ SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \ ++ SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \ + SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \ + SRI(SCL_VERT_FILTER_SCALE_RATIO, SCL, id), \ + SRI(SCL_VERT_FILTER_INIT, SCL, id), \ +-- +2.51.0 + diff --git a/queue-5.15/drm-amd-display-properly-clear-scl_-_filter_control-.patch b/queue-5.15/drm-amd-display-properly-clear-scl_-_filter_control-.patch new file mode 100644 index 0000000000..55fe9fef3b --- /dev/null +++ b/queue-5.15/drm-amd-display-properly-clear-scl_-_filter_control-.patch @@ -0,0 +1,51 @@ +From 783bab93b2f6347401f89056425e79766b163bab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:23 +0200 +Subject: drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit c0aa7cf49dd6cb302fe28e7183992b772cb7420c ] + +Previously, the code would set a bit field which didn't exist +on DCE6 so it would be effectively a no-op. + +Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +index 670d5ab9d9984..b761dda491d54 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +@@ -527,8 +527,7 @@ static void dce60_transform_set_scaler( + if (coeffs_v != xfm_dce->filter_v || coeffs_h != xfm_dce->filter_h) { + /* 4. Program vertical filters */ + if (xfm_dce->filter_v == NULL) +- REG_SET(SCL_VERT_FILTER_CONTROL, 0, +- SCL_V_2TAP_HARDCODE_COEF_EN, 0); ++ REG_WRITE(SCL_VERT_FILTER_CONTROL, 0); + program_multi_taps_filter( + xfm_dce, + data->taps.v_taps, +@@ -542,8 +541,7 @@ static void dce60_transform_set_scaler( + + /* 5. Program horizontal filters */ + if (xfm_dce->filter_h == NULL) +- REG_SET(SCL_HORZ_FILTER_CONTROL, 0, +- SCL_H_2TAP_HARDCODE_COEF_EN, 0); ++ REG_WRITE(SCL_HORZ_FILTER_CONTROL, 0); + program_multi_taps_filter( + xfm_dce, + data->taps.h_taps, +-- +2.51.0 + diff --git a/queue-5.15/drm-amd-display-properly-disable-scaling-on-dce6.patch b/queue-5.15/drm-amd-display-properly-disable-scaling-on-dce6.patch new file mode 100644 index 0000000000..e7d684da8f --- /dev/null +++ b/queue-5.15/drm-amd-display-properly-disable-scaling-on-dce6.patch @@ -0,0 +1,101 @@ +From 1c4b75ec00bed019af33a1722f5b17959a0d6845 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:24 +0200 +Subject: drm/amd/display: Properly disable scaling on DCE6 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit a7dc87f3448bea5ebe054f14e861074b9c289c65 ] + +SCL_SCALER_ENABLE can be used to enable/disable the scaler +on DCE6. Program it to 0 when scaling isn't used, 1 when used. +Additionally, clear some other registers when scaling is +disabled and program the SCL_UPDATE register as recommended. + +This fixes visible glitches for users whose BIOS sets up a +mode with scaling at boot, which DC was unable to clean up. + +Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/dce/dce_transform.c | 15 +++++++++++---- + .../gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++ + 2 files changed, 13 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +index b761dda491d54..f97c182677082 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +@@ -154,10 +154,13 @@ static bool dce60_setup_scaling_configuration( + REG_SET(SCL_BYPASS_CONTROL, 0, SCL_BYPASS_MODE, 0); + + if (data->taps.h_taps + data->taps.v_taps <= 2) { +- /* Set bypass */ +- +- /* DCE6 has no SCL_MODE register, skip scale mode programming */ ++ /* Disable scaler functionality */ ++ REG_WRITE(SCL_SCALER_ENABLE, 0); + ++ /* Clear registers that can cause glitches even when the scaler is off */ ++ REG_WRITE(SCL_TAP_CONTROL, 0); ++ REG_WRITE(SCL_AUTOMATIC_MODE_CONTROL, 0); ++ REG_WRITE(SCL_F_SHARP_CONTROL, 0); + return false; + } + +@@ -165,7 +168,7 @@ static bool dce60_setup_scaling_configuration( + SCL_H_NUM_OF_TAPS, data->taps.h_taps - 1, + SCL_V_NUM_OF_TAPS, data->taps.v_taps - 1); + +- /* DCE6 has no SCL_MODE register, skip scale mode programming */ ++ REG_WRITE(SCL_SCALER_ENABLE, 1); + + /* DCE6 has no SCL_BOUNDARY_MODE bit, skip replace out of bound pixels */ + +@@ -502,6 +505,8 @@ static void dce60_transform_set_scaler( + REG_SET(DC_LB_MEM_SIZE, 0, + DC_LB_MEM_SIZE, xfm_dce->lb_memory_size); + ++ REG_WRITE(SCL_UPDATE, 0x00010000); ++ + /* Clear SCL_F_SHARP_CONTROL value to 0 */ + REG_WRITE(SCL_F_SHARP_CONTROL, 0); + +@@ -564,6 +569,8 @@ static void dce60_transform_set_scaler( + /* DCE6 has no SCL_COEF_UPDATE_COMPLETE bit to flip to new coefficient memory */ + + /* DCE6 DATA_FORMAT register does not support ALPHA_EN */ ++ ++ REG_WRITE(SCL_UPDATE, 0); + } + #endif + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +index ff746fba850bc..eb716e8337e23 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +@@ -155,6 +155,7 @@ + SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \ + SRI(VIEWPORT_START, SCL, id), \ + SRI(VIEWPORT_SIZE, SCL, id), \ ++ SRI(SCL_SCALER_ENABLE, SCL, id), \ + SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \ + SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \ + SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \ +@@ -592,6 +593,7 @@ struct dce_transform_registers { + uint32_t SCL_VERT_FILTER_SCALE_RATIO; + uint32_t SCL_HORZ_FILTER_INIT; + #if defined(CONFIG_DRM_AMD_DC_SI) ++ uint32_t SCL_SCALER_ENABLE; + uint32_t SCL_HORZ_FILTER_INIT_RGB_LUMA; + uint32_t SCL_HORZ_FILTER_INIT_CHROMA; + #endif +-- +2.51.0 + diff --git a/queue-5.15/drm-amdgpu-add-additional-dce6-scl-registers.patch b/queue-5.15/drm-amdgpu-add-additional-dce6-scl-registers.patch new file mode 100644 index 0000000000..43ef08c3bc --- /dev/null +++ b/queue-5.15/drm-amdgpu-add-additional-dce6-scl-registers.patch @@ -0,0 +1,93 @@ +From d519df15bb8c1df276b1896b151f6feafb8bbd42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:21 +0200 +Subject: drm/amdgpu: Add additional DCE6 SCL registers + +From: Alex Deucher + +[ Upstream commit 507296328b36ffd00ec1f4fde5b8acafb7222ec7 ] + +Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)") +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h | 7 +++++++ + drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h | 2 ++ + 2 files changed, 9 insertions(+) + +diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h +index 9de01ae574c03..067eddd9c62d8 100644 +--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h ++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h +@@ -4115,6 +4115,7 @@ + #define mmSCL0_SCL_COEF_RAM_CONFLICT_STATUS 0x1B55 + #define mmSCL0_SCL_COEF_RAM_SELECT 0x1B40 + #define mmSCL0_SCL_COEF_RAM_TAP_DATA 0x1B41 ++#define mmSCL0_SCL_SCALER_ENABLE 0x1B42 + #define mmSCL0_SCL_CONTROL 0x1B44 + #define mmSCL0_SCL_DEBUG 0x1B6A + #define mmSCL0_SCL_DEBUG2 0x1B69 +@@ -4144,6 +4145,7 @@ + #define mmSCL1_SCL_COEF_RAM_CONFLICT_STATUS 0x1E55 + #define mmSCL1_SCL_COEF_RAM_SELECT 0x1E40 + #define mmSCL1_SCL_COEF_RAM_TAP_DATA 0x1E41 ++#define mmSCL1_SCL_SCALER_ENABLE 0x1E42 + #define mmSCL1_SCL_CONTROL 0x1E44 + #define mmSCL1_SCL_DEBUG 0x1E6A + #define mmSCL1_SCL_DEBUG2 0x1E69 +@@ -4173,6 +4175,7 @@ + #define mmSCL2_SCL_COEF_RAM_CONFLICT_STATUS 0x4155 + #define mmSCL2_SCL_COEF_RAM_SELECT 0x4140 + #define mmSCL2_SCL_COEF_RAM_TAP_DATA 0x4141 ++#define mmSCL2_SCL_SCALER_ENABLE 0x4142 + #define mmSCL2_SCL_CONTROL 0x4144 + #define mmSCL2_SCL_DEBUG 0x416A + #define mmSCL2_SCL_DEBUG2 0x4169 +@@ -4202,6 +4205,7 @@ + #define mmSCL3_SCL_COEF_RAM_CONFLICT_STATUS 0x4455 + #define mmSCL3_SCL_COEF_RAM_SELECT 0x4440 + #define mmSCL3_SCL_COEF_RAM_TAP_DATA 0x4441 ++#define mmSCL3_SCL_SCALER_ENABLE 0x4442 + #define mmSCL3_SCL_CONTROL 0x4444 + #define mmSCL3_SCL_DEBUG 0x446A + #define mmSCL3_SCL_DEBUG2 0x4469 +@@ -4231,6 +4235,7 @@ + #define mmSCL4_SCL_COEF_RAM_CONFLICT_STATUS 0x4755 + #define mmSCL4_SCL_COEF_RAM_SELECT 0x4740 + #define mmSCL4_SCL_COEF_RAM_TAP_DATA 0x4741 ++#define mmSCL4_SCL_SCALER_ENABLE 0x4742 + #define mmSCL4_SCL_CONTROL 0x4744 + #define mmSCL4_SCL_DEBUG 0x476A + #define mmSCL4_SCL_DEBUG2 0x4769 +@@ -4260,6 +4265,7 @@ + #define mmSCL5_SCL_COEF_RAM_CONFLICT_STATUS 0x4A55 + #define mmSCL5_SCL_COEF_RAM_SELECT 0x4A40 + #define mmSCL5_SCL_COEF_RAM_TAP_DATA 0x4A41 ++#define mmSCL5_SCL_SCALER_ENABLE 0x4A42 + #define mmSCL5_SCL_CONTROL 0x4A44 + #define mmSCL5_SCL_DEBUG 0x4A6A + #define mmSCL5_SCL_DEBUG2 0x4A69 +@@ -4287,6 +4293,7 @@ + #define mmSCL_COEF_RAM_CONFLICT_STATUS 0x1B55 + #define mmSCL_COEF_RAM_SELECT 0x1B40 + #define mmSCL_COEF_RAM_TAP_DATA 0x1B41 ++#define mmSCL_SCALER_ENABLE 0x1B42 + #define mmSCL_CONTROL 0x1B44 + #define mmSCL_DEBUG 0x1B6A + #define mmSCL_DEBUG2 0x1B69 +diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h +index 41c4a46ce3572..afe7303802c61 100644 +--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h ++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h +@@ -8646,6 +8646,8 @@ + #define REGAMMA_LUT_INDEX__REGAMMA_LUT_INDEX__SHIFT 0x00000000 + #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK_MASK 0x00000007L + #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK__SHIFT 0x00000000 ++#define SCL_SCALER_ENABLE__SCL_SCALE_EN_MASK 0x00000001L ++#define SCL_SCALER_ENABLE__SCL_SCALE_EN__SHIFT 0x00000000 + #define SCL_ALU_CONTROL__SCL_ALU_DISABLE_MASK 0x00000001L + #define SCL_ALU_CONTROL__SCL_ALU_DISABLE__SHIFT 0x00000000 + #define SCL_BYPASS_CONTROL__SCL_BYPASS_MODE_MASK 0x00000003L +-- +2.51.0 + diff --git a/queue-5.15/drm-vmwgfx-copy-drm-hash-table-code-into-driver.patch b/queue-5.15/drm-vmwgfx-copy-drm-hash-table-code-into-driver.patch new file mode 100644 index 0000000000..34adc0e993 --- /dev/null +++ b/queue-5.15/drm-vmwgfx-copy-drm-hash-table-code-into-driver.patch @@ -0,0 +1,854 @@ +From 1e00178bb3f0c1b59bfdeeaff08c2a1d7bd8a511 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Nov 2021 10:48:40 +0100 +Subject: drm/vmwgfx: Copy DRM hash-table code into driver + +From: Thomas Zimmermann + +[ Upstream commit 2985c96485b7ef4e015d13dc3081fb0479260951 ] + +Besides some legacy code, vmwgfx is the only user of DRM's hash- +table implementation. Copy the code into the driver, so that the +core code can be retired. + +No functional changes. However, the real solution for vmwgfx is to +use Linux' generic hash-table functions. + +v2: + * add TODO item for updating vmwgfx (Sam) + +Signed-off-by: Thomas Zimmermann +Acked-by: Daniel Vetter +Acked-by: Alex Deucher +Link: https://patchwork.freedesktop.org/patch/msgid/20211129094841.22499-3-tzimmermann@suse.de +Stable-dep-of: dfe1323ab3c8 ("drm/vmwgfx: Fix Use-after-free in validation") +Signed-off-by: Sasha Levin +--- + Documentation/gpu/todo.rst | 11 ++ + drivers/gpu/drm/vmwgfx/Makefile | 2 +- + drivers/gpu/drm/vmwgfx/ttm_object.c | 52 +++--- + drivers/gpu/drm/vmwgfx/ttm_object.h | 3 +- + drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 24 +-- + drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 2 +- + drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 6 +- + drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +- + drivers/gpu/drm/vmwgfx/vmwgfx_hashtab.c | 199 +++++++++++++++++++++ + drivers/gpu/drm/vmwgfx/vmwgfx_hashtab.h | 83 +++++++++ + drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 22 +-- + drivers/gpu/drm/vmwgfx/vmwgfx_validation.h | 7 +- + 12 files changed, 353 insertions(+), 60 deletions(-) + create mode 100644 drivers/gpu/drm/vmwgfx/vmwgfx_hashtab.c + create mode 100644 drivers/gpu/drm/vmwgfx/vmwgfx_hashtab.h + +diff --git a/Documentation/gpu/todo.rst b/Documentation/gpu/todo.rst +index 67de1e94fdf76..f31a838d09fbb 100644 +--- a/Documentation/gpu/todo.rst ++++ b/Documentation/gpu/todo.rst +@@ -635,6 +635,17 @@ See drivers/gpu/drm/amd/display/TODO for tasks. + + Contact: Harry Wentland, Alex Deucher + ++vmwgfx: Replace hashtable with Linux' implementation ++---------------------------------------------------- ++ ++The vmwgfx driver uses its own hashtable implementation. Replace the ++code with Linux' implementation and update the callers. It's mostly a ++refactoring task, but the interfaces are different. ++ ++Contact: Zack Rusin, Thomas Zimmermann ++ ++Level: Intermediate ++ + Bootsplash + ========== + +diff --git a/drivers/gpu/drm/vmwgfx/Makefile b/drivers/gpu/drm/vmwgfx/Makefile +index 18edc7ca5b454..59b0b77456dd2 100644 +--- a/drivers/gpu/drm/vmwgfx/Makefile ++++ b/drivers/gpu/drm/vmwgfx/Makefile +@@ -1,5 +1,5 @@ + # SPDX-License-Identifier: GPL-2.0 +-vmwgfx-y := vmwgfx_execbuf.o vmwgfx_gmr.o vmwgfx_kms.o vmwgfx_drv.o \ ++vmwgfx-y := vmwgfx_execbuf.o vmwgfx_gmr.o vmwgfx_hashtab.o vmwgfx_kms.o vmwgfx_drv.o \ + vmwgfx_ioctl.o vmwgfx_resource.o vmwgfx_ttm_buffer.o \ + vmwgfx_cmd.o vmwgfx_irq.o vmwgfx_ldu.o vmwgfx_ttm_glue.o \ + vmwgfx_overlay.o vmwgfx_gmrid_manager.o vmwgfx_fence.o \ +diff --git a/drivers/gpu/drm/vmwgfx/ttm_object.c b/drivers/gpu/drm/vmwgfx/ttm_object.c +index 04789b2bb2a26..123ab2cbec484 100644 +--- a/drivers/gpu/drm/vmwgfx/ttm_object.c ++++ b/drivers/gpu/drm/vmwgfx/ttm_object.c +@@ -70,7 +70,7 @@ struct ttm_object_file { + struct ttm_object_device *tdev; + spinlock_t lock; + struct list_head ref_list; +- struct drm_open_hash ref_hash[TTM_REF_NUM]; ++ struct vmwgfx_open_hash ref_hash[TTM_REF_NUM]; + struct kref refcount; + }; + +@@ -88,7 +88,7 @@ struct ttm_object_file { + + struct ttm_object_device { + spinlock_t object_lock; +- struct drm_open_hash object_hash; ++ struct vmwgfx_open_hash object_hash; + atomic_t object_count; + struct ttm_mem_global *mem_glob; + struct dma_buf_ops ops; +@@ -120,7 +120,7 @@ struct ttm_object_device { + + struct ttm_ref_object { + struct rcu_head rcu_head; +- struct drm_hash_item hash; ++ struct vmwgfx_hash_item hash; + struct list_head head; + struct kref kref; + enum ttm_ref_type ref_type; +@@ -244,12 +244,12 @@ void ttm_base_object_unref(struct ttm_base_object **p_base) + struct ttm_base_object * + ttm_base_object_noref_lookup(struct ttm_object_file *tfile, uint32_t key) + { +- struct drm_hash_item *hash; +- struct drm_open_hash *ht = &tfile->ref_hash[TTM_REF_USAGE]; ++ struct vmwgfx_hash_item *hash; ++ struct vmwgfx_open_hash *ht = &tfile->ref_hash[TTM_REF_USAGE]; + int ret; + + rcu_read_lock(); +- ret = drm_ht_find_item_rcu(ht, key, &hash); ++ ret = vmwgfx_ht_find_item_rcu(ht, key, &hash); + if (ret) { + rcu_read_unlock(); + return NULL; +@@ -264,12 +264,12 @@ struct ttm_base_object *ttm_base_object_lookup(struct ttm_object_file *tfile, + uint32_t key) + { + struct ttm_base_object *base = NULL; +- struct drm_hash_item *hash; +- struct drm_open_hash *ht = &tfile->ref_hash[TTM_REF_USAGE]; ++ struct vmwgfx_hash_item *hash; ++ struct vmwgfx_open_hash *ht = &tfile->ref_hash[TTM_REF_USAGE]; + int ret; + + rcu_read_lock(); +- ret = drm_ht_find_item_rcu(ht, key, &hash); ++ ret = vmwgfx_ht_find_item_rcu(ht, key, &hash); + + if (likely(ret == 0)) { + base = drm_hash_entry(hash, struct ttm_ref_object, hash)->obj; +@@ -309,12 +309,12 @@ ttm_base_object_lookup_for_ref(struct ttm_object_device *tdev, uint32_t key) + bool ttm_ref_object_exists(struct ttm_object_file *tfile, + struct ttm_base_object *base) + { +- struct drm_open_hash *ht = &tfile->ref_hash[TTM_REF_USAGE]; +- struct drm_hash_item *hash; ++ struct vmwgfx_open_hash *ht = &tfile->ref_hash[TTM_REF_USAGE]; ++ struct vmwgfx_hash_item *hash; + struct ttm_ref_object *ref; + + rcu_read_lock(); +- if (unlikely(drm_ht_find_item_rcu(ht, base->handle, &hash) != 0)) ++ if (unlikely(vmwgfx_ht_find_item_rcu(ht, base->handle, &hash) != 0)) + goto out_false; + + /* +@@ -346,9 +346,9 @@ int ttm_ref_object_add(struct ttm_object_file *tfile, + enum ttm_ref_type ref_type, bool *existed, + bool require_existed) + { +- struct drm_open_hash *ht = &tfile->ref_hash[ref_type]; ++ struct vmwgfx_open_hash *ht = &tfile->ref_hash[ref_type]; + struct ttm_ref_object *ref; +- struct drm_hash_item *hash; ++ struct vmwgfx_hash_item *hash; + struct ttm_mem_global *mem_glob = tfile->tdev->mem_glob; + struct ttm_operation_ctx ctx = { + .interruptible = false, +@@ -364,7 +364,7 @@ int ttm_ref_object_add(struct ttm_object_file *tfile, + + while (ret == -EINVAL) { + rcu_read_lock(); +- ret = drm_ht_find_item_rcu(ht, base->handle, &hash); ++ ret = vmwgfx_ht_find_item_rcu(ht, base->handle, &hash); + + if (ret == 0) { + ref = drm_hash_entry(hash, struct ttm_ref_object, hash); +@@ -395,7 +395,7 @@ int ttm_ref_object_add(struct ttm_object_file *tfile, + kref_init(&ref->kref); + + spin_lock(&tfile->lock); +- ret = drm_ht_insert_item_rcu(ht, &ref->hash); ++ ret = vmwgfx_ht_insert_item_rcu(ht, &ref->hash); + + if (likely(ret == 0)) { + list_add_tail(&ref->head, &tfile->ref_list); +@@ -423,11 +423,11 @@ ttm_ref_object_release(struct kref *kref) + container_of(kref, struct ttm_ref_object, kref); + struct ttm_base_object *base = ref->obj; + struct ttm_object_file *tfile = ref->tfile; +- struct drm_open_hash *ht; ++ struct vmwgfx_open_hash *ht; + struct ttm_mem_global *mem_glob = tfile->tdev->mem_glob; + + ht = &tfile->ref_hash[ref->ref_type]; +- (void)drm_ht_remove_item_rcu(ht, &ref->hash); ++ (void)vmwgfx_ht_remove_item_rcu(ht, &ref->hash); + list_del(&ref->head); + spin_unlock(&tfile->lock); + +@@ -443,13 +443,13 @@ ttm_ref_object_release(struct kref *kref) + int ttm_ref_object_base_unref(struct ttm_object_file *tfile, + unsigned long key, enum ttm_ref_type ref_type) + { +- struct drm_open_hash *ht = &tfile->ref_hash[ref_type]; ++ struct vmwgfx_open_hash *ht = &tfile->ref_hash[ref_type]; + struct ttm_ref_object *ref; +- struct drm_hash_item *hash; ++ struct vmwgfx_hash_item *hash; + int ret; + + spin_lock(&tfile->lock); +- ret = drm_ht_find_item(ht, key, &hash); ++ ret = vmwgfx_ht_find_item(ht, key, &hash); + if (unlikely(ret != 0)) { + spin_unlock(&tfile->lock); + return -EINVAL; +@@ -483,7 +483,7 @@ void ttm_object_file_release(struct ttm_object_file **p_tfile) + + spin_unlock(&tfile->lock); + for (i = 0; i < TTM_REF_NUM; ++i) +- drm_ht_remove(&tfile->ref_hash[i]); ++ vmwgfx_ht_remove(&tfile->ref_hash[i]); + + ttm_object_file_unref(&tfile); + } +@@ -505,7 +505,7 @@ struct ttm_object_file *ttm_object_file_init(struct ttm_object_device *tdev, + INIT_LIST_HEAD(&tfile->ref_list); + + for (i = 0; i < TTM_REF_NUM; ++i) { +- ret = drm_ht_create(&tfile->ref_hash[i], hash_order); ++ ret = vmwgfx_ht_create(&tfile->ref_hash[i], hash_order); + if (ret) { + j = i; + goto out_err; +@@ -515,7 +515,7 @@ struct ttm_object_file *ttm_object_file_init(struct ttm_object_device *tdev, + return tfile; + out_err: + for (i = 0; i < j; ++i) +- drm_ht_remove(&tfile->ref_hash[i]); ++ vmwgfx_ht_remove(&tfile->ref_hash[i]); + + kfree(tfile); + +@@ -536,7 +536,7 @@ ttm_object_device_init(struct ttm_mem_global *mem_glob, + tdev->mem_glob = mem_glob; + spin_lock_init(&tdev->object_lock); + atomic_set(&tdev->object_count, 0); +- ret = drm_ht_create(&tdev->object_hash, hash_order); ++ ret = vmwgfx_ht_create(&tdev->object_hash, hash_order); + if (ret != 0) + goto out_no_object_hash; + +@@ -561,7 +561,7 @@ void ttm_object_device_release(struct ttm_object_device **p_tdev) + + WARN_ON_ONCE(!idr_is_empty(&tdev->idr)); + idr_destroy(&tdev->idr); +- drm_ht_remove(&tdev->object_hash); ++ vmwgfx_ht_remove(&tdev->object_hash); + + kfree(tdev); + } +diff --git a/drivers/gpu/drm/vmwgfx/ttm_object.h b/drivers/gpu/drm/vmwgfx/ttm_object.h +index 49b064f0cb19c..6885ccbeec7a1 100644 +--- a/drivers/gpu/drm/vmwgfx/ttm_object.h ++++ b/drivers/gpu/drm/vmwgfx/ttm_object.h +@@ -42,9 +42,8 @@ + #include + #include + +-#include +- + #include "ttm_memory.h" ++#include "vmwgfx_hashtab.h" + + /** + * enum ttm_ref_type +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c +index 8381750db81b6..494cb98061f22 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c +@@ -42,7 +42,7 @@ + */ + struct vmw_cmdbuf_res { + struct vmw_resource *res; +- struct drm_hash_item hash; ++ struct vmwgfx_hash_item hash; + struct list_head head; + enum vmw_cmdbuf_res_state state; + struct vmw_cmdbuf_res_manager *man; +@@ -59,7 +59,7 @@ struct vmw_cmdbuf_res { + * @resources and @list are protected by the cmdbuf mutex for now. + */ + struct vmw_cmdbuf_res_manager { +- struct drm_open_hash resources; ++ struct vmwgfx_open_hash resources; + struct list_head list; + struct vmw_private *dev_priv; + }; +@@ -81,11 +81,11 @@ vmw_cmdbuf_res_lookup(struct vmw_cmdbuf_res_manager *man, + enum vmw_cmdbuf_res_type res_type, + u32 user_key) + { +- struct drm_hash_item *hash; ++ struct vmwgfx_hash_item *hash; + int ret; + unsigned long key = user_key | (res_type << 24); + +- ret = drm_ht_find_item(&man->resources, key, &hash); ++ ret = vmwgfx_ht_find_item(&man->resources, key, &hash); + if (unlikely(ret != 0)) + return ERR_PTR(ret); + +@@ -105,7 +105,7 @@ static void vmw_cmdbuf_res_free(struct vmw_cmdbuf_res_manager *man, + struct vmw_cmdbuf_res *entry) + { + list_del(&entry->head); +- WARN_ON(drm_ht_remove_item(&man->resources, &entry->hash)); ++ WARN_ON(vmwgfx_ht_remove_item(&man->resources, &entry->hash)); + vmw_resource_unreference(&entry->res); + kfree(entry); + } +@@ -167,7 +167,7 @@ void vmw_cmdbuf_res_revert(struct list_head *list) + vmw_cmdbuf_res_free(entry->man, entry); + break; + case VMW_CMDBUF_RES_DEL: +- ret = drm_ht_insert_item(&entry->man->resources, &entry->hash); ++ ret = vmwgfx_ht_insert_item(&entry->man->resources, &entry->hash); + BUG_ON(ret); + list_move_tail(&entry->head, &entry->man->list); + entry->state = VMW_CMDBUF_RES_COMMITTED; +@@ -206,7 +206,7 @@ int vmw_cmdbuf_res_add(struct vmw_cmdbuf_res_manager *man, + return -ENOMEM; + + cres->hash.key = user_key | (res_type << 24); +- ret = drm_ht_insert_item(&man->resources, &cres->hash); ++ ret = vmwgfx_ht_insert_item(&man->resources, &cres->hash); + if (unlikely(ret != 0)) { + kfree(cres); + goto out_invalid_key; +@@ -244,10 +244,10 @@ int vmw_cmdbuf_res_remove(struct vmw_cmdbuf_res_manager *man, + struct vmw_resource **res_p) + { + struct vmw_cmdbuf_res *entry; +- struct drm_hash_item *hash; ++ struct vmwgfx_hash_item *hash; + int ret; + +- ret = drm_ht_find_item(&man->resources, user_key | (res_type << 24), ++ ret = vmwgfx_ht_find_item(&man->resources, user_key | (res_type << 24), + &hash); + if (likely(ret != 0)) + return -EINVAL; +@@ -260,7 +260,7 @@ int vmw_cmdbuf_res_remove(struct vmw_cmdbuf_res_manager *man, + *res_p = NULL; + break; + case VMW_CMDBUF_RES_COMMITTED: +- (void) drm_ht_remove_item(&man->resources, &entry->hash); ++ (void) vmwgfx_ht_remove_item(&man->resources, &entry->hash); + list_del(&entry->head); + entry->state = VMW_CMDBUF_RES_DEL; + list_add_tail(&entry->head, list); +@@ -295,7 +295,7 @@ vmw_cmdbuf_res_man_create(struct vmw_private *dev_priv) + + man->dev_priv = dev_priv; + INIT_LIST_HEAD(&man->list); +- ret = drm_ht_create(&man->resources, VMW_CMDBUF_RES_MAN_HT_ORDER); ++ ret = vmwgfx_ht_create(&man->resources, VMW_CMDBUF_RES_MAN_HT_ORDER); + if (ret == 0) + return man; + +@@ -320,7 +320,7 @@ void vmw_cmdbuf_res_man_destroy(struct vmw_cmdbuf_res_manager *man) + list_for_each_entry_safe(entry, next, &man->list, head) + vmw_cmdbuf_res_free(man, entry); + +- drm_ht_remove(&man->resources); ++ vmwgfx_ht_remove(&man->resources); + kfree(man); + } + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +index 0f09a9116b054..4fea95a650418 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +@@ -1149,7 +1149,7 @@ static void vmw_driver_unload(struct drm_device *dev) + unregister_pm_notifier(&dev_priv->pm_nb); + + if (dev_priv->ctx.res_ht_initialized) +- drm_ht_remove(&dev_priv->ctx.res_ht); ++ vmwgfx_ht_remove(&dev_priv->ctx.res_ht); + vfree(dev_priv->ctx.cmd_bounce); + if (dev_priv->enable_fb) { + vmw_fb_off(dev_priv); +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h +index 9c60bb2aefe1f..1099cb5e25006 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h +@@ -34,7 +34,6 @@ + #include + #include + #include +-#include + #include + + #include +@@ -43,6 +42,7 @@ + #include "ttm_object.h" + + #include "vmwgfx_fence.h" ++#include "vmwgfx_hashtab.h" + #include "vmwgfx_reg.h" + #include "vmwgfx_validation.h" + +@@ -131,7 +131,7 @@ struct vmw_buffer_object { + */ + struct vmw_validate_buffer { + struct ttm_validate_buffer base; +- struct drm_hash_item hash; ++ struct vmwgfx_hash_item hash; + bool validate_as_mob; + }; + +@@ -404,7 +404,7 @@ struct vmw_ctx_validation_info; + * @ctx: The validation context + */ + struct vmw_sw_context{ +- struct drm_open_hash res_ht; ++ struct vmwgfx_open_hash res_ht; + bool res_ht_initialized; + bool kernel; + struct vmw_fpriv *fp; +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +index 21134c7f18382..7dd42c5a7fd62 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +@@ -4112,7 +4112,7 @@ int vmw_execbuf_process(struct drm_file *file_priv, + vmw_binding_state_reset(sw_context->staged_bindings); + + if (!sw_context->res_ht_initialized) { +- ret = drm_ht_create(&sw_context->res_ht, VMW_RES_HT_ORDER); ++ ret = vmwgfx_ht_create(&sw_context->res_ht, VMW_RES_HT_ORDER); + if (unlikely(ret != 0)) + goto out_unlock; + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_hashtab.c b/drivers/gpu/drm/vmwgfx/vmwgfx_hashtab.c +new file mode 100644 +index 0000000000000..06aebc12774e7 +--- /dev/null ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_hashtab.c +@@ -0,0 +1,199 @@ ++/* ++ * Copyright 2006 Tungsten Graphics, Inc., Bismarck, ND. USA. ++ * All Rights Reserved. ++ * ++ * Permission is hereby granted, free of charge, to any person obtaining a ++ * copy of this software and associated documentation files (the ++ * "Software"), to deal in the Software without restriction, including ++ * without limitation the rights to use, copy, modify, merge, publish, ++ * distribute, sub license, and/or sell copies of the Software, and to ++ * permit persons to whom the Software is furnished to do so, subject to ++ * the following conditions: ++ * ++ * The above copyright notice and this permission notice (including the ++ * next paragraph) shall be included in all copies or substantial portions ++ * of the Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR ++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, ++ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL ++ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, ++ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR ++ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE ++ * USE OR OTHER DEALINGS IN THE SOFTWARE. ++ */ ++ ++/* ++ * Simple open hash tab implementation. ++ * ++ * Authors: ++ * Thomas Hellström ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#include ++ ++#include "vmwgfx_hashtab.h" ++ ++int vmwgfx_ht_create(struct vmwgfx_open_hash *ht, unsigned int order) ++{ ++ unsigned int size = 1 << order; ++ ++ ht->order = order; ++ ht->table = NULL; ++ if (size <= PAGE_SIZE / sizeof(*ht->table)) ++ ht->table = kcalloc(size, sizeof(*ht->table), GFP_KERNEL); ++ else ++ ht->table = vzalloc(array_size(size, sizeof(*ht->table))); ++ if (!ht->table) { ++ DRM_ERROR("Out of memory for hash table\n"); ++ return -ENOMEM; ++ } ++ return 0; ++} ++ ++void vmwgfx_ht_verbose_list(struct vmwgfx_open_hash *ht, unsigned long key) ++{ ++ struct vmwgfx_hash_item *entry; ++ struct hlist_head *h_list; ++ unsigned int hashed_key; ++ int count = 0; ++ ++ hashed_key = hash_long(key, ht->order); ++ DRM_DEBUG("Key is 0x%08lx, Hashed key is 0x%08x\n", key, hashed_key); ++ h_list = &ht->table[hashed_key]; ++ hlist_for_each_entry(entry, h_list, head) ++ DRM_DEBUG("count %d, key: 0x%08lx\n", count++, entry->key); ++} ++ ++static struct hlist_node *vmwgfx_ht_find_key(struct vmwgfx_open_hash *ht, unsigned long key) ++{ ++ struct vmwgfx_hash_item *entry; ++ struct hlist_head *h_list; ++ unsigned int hashed_key; ++ ++ hashed_key = hash_long(key, ht->order); ++ h_list = &ht->table[hashed_key]; ++ hlist_for_each_entry(entry, h_list, head) { ++ if (entry->key == key) ++ return &entry->head; ++ if (entry->key > key) ++ break; ++ } ++ return NULL; ++} ++ ++static struct hlist_node *vmwgfx_ht_find_key_rcu(struct vmwgfx_open_hash *ht, unsigned long key) ++{ ++ struct vmwgfx_hash_item *entry; ++ struct hlist_head *h_list; ++ unsigned int hashed_key; ++ ++ hashed_key = hash_long(key, ht->order); ++ h_list = &ht->table[hashed_key]; ++ hlist_for_each_entry_rcu(entry, h_list, head) { ++ if (entry->key == key) ++ return &entry->head; ++ if (entry->key > key) ++ break; ++ } ++ return NULL; ++} ++ ++int vmwgfx_ht_insert_item(struct vmwgfx_open_hash *ht, struct vmwgfx_hash_item *item) ++{ ++ struct vmwgfx_hash_item *entry; ++ struct hlist_head *h_list; ++ struct hlist_node *parent; ++ unsigned int hashed_key; ++ unsigned long key = item->key; ++ ++ hashed_key = hash_long(key, ht->order); ++ h_list = &ht->table[hashed_key]; ++ parent = NULL; ++ hlist_for_each_entry(entry, h_list, head) { ++ if (entry->key == key) ++ return -EINVAL; ++ if (entry->key > key) ++ break; ++ parent = &entry->head; ++ } ++ if (parent) ++ hlist_add_behind_rcu(&item->head, parent); ++ else ++ hlist_add_head_rcu(&item->head, h_list); ++ return 0; ++} ++ ++/* ++ * Just insert an item and return any "bits" bit key that hasn't been ++ * used before. ++ */ ++int vmwgfx_ht_just_insert_please(struct vmwgfx_open_hash *ht, struct vmwgfx_hash_item *item, ++ unsigned long seed, int bits, int shift, ++ unsigned long add) ++{ ++ int ret; ++ unsigned long mask = (1UL << bits) - 1; ++ unsigned long first, unshifted_key; ++ ++ unshifted_key = hash_long(seed, bits); ++ first = unshifted_key; ++ do { ++ item->key = (unshifted_key << shift) + add; ++ ret = vmwgfx_ht_insert_item(ht, item); ++ if (ret) ++ unshifted_key = (unshifted_key + 1) & mask; ++ } while (ret && (unshifted_key != first)); ++ ++ if (ret) { ++ DRM_ERROR("Available key bit space exhausted\n"); ++ return -EINVAL; ++ } ++ return 0; ++} ++ ++int vmwgfx_ht_find_item(struct vmwgfx_open_hash *ht, unsigned long key, ++ struct vmwgfx_hash_item **item) ++{ ++ struct hlist_node *list; ++ ++ list = vmwgfx_ht_find_key_rcu(ht, key); ++ if (!list) ++ return -EINVAL; ++ ++ *item = hlist_entry(list, struct vmwgfx_hash_item, head); ++ return 0; ++} ++ ++int vmwgfx_ht_remove_key(struct vmwgfx_open_hash *ht, unsigned long key) ++{ ++ struct hlist_node *list; ++ ++ list = vmwgfx_ht_find_key(ht, key); ++ if (list) { ++ hlist_del_init_rcu(list); ++ return 0; ++ } ++ return -EINVAL; ++} ++ ++int vmwgfx_ht_remove_item(struct vmwgfx_open_hash *ht, struct vmwgfx_hash_item *item) ++{ ++ hlist_del_init_rcu(&item->head); ++ return 0; ++} ++ ++void vmwgfx_ht_remove(struct vmwgfx_open_hash *ht) ++{ ++ if (ht->table) { ++ kvfree(ht->table); ++ ht->table = NULL; ++ } ++} +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_hashtab.h b/drivers/gpu/drm/vmwgfx/vmwgfx_hashtab.h +new file mode 100644 +index 0000000000000..a9ce12922e21c +--- /dev/null ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_hashtab.h +@@ -0,0 +1,83 @@ ++/* ++ * Copyright 2006 Tungsten Graphics, Inc., Bismack, ND. USA. ++ * All Rights Reserved. ++ * ++ * Permission is hereby granted, free of charge, to any person obtaining a ++ * copy of this software and associated documentation files (the ++ * "Software"), to deal in the Software without restriction, including ++ * without limitation the rights to use, copy, modify, merge, publish, ++ * distribute, sub license, and/or sell copies of the Software, and to ++ * permit persons to whom the Software is furnished to do so, subject to ++ * the following conditions: ++ * ++ * The above copyright notice and this permission notice (including the ++ * next paragraph) shall be included in all copies or substantial portions ++ * of the Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR ++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, ++ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL ++ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, ++ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR ++ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE ++ * USE OR OTHER DEALINGS IN THE SOFTWARE. ++ */ ++ ++/* ++ * Simple open hash tab implementation. ++ * ++ * Authors: ++ * Thomas Hellström ++ */ ++ ++/* ++ * TODO: Replace this hashtable with Linux' generic implementation ++ * from . ++ */ ++ ++#ifndef VMWGFX_HASHTAB_H ++#define VMWGFX_HASHTAB_H ++ ++#include ++ ++#define drm_hash_entry(_ptr, _type, _member) container_of(_ptr, _type, _member) ++ ++struct vmwgfx_hash_item { ++ struct hlist_node head; ++ unsigned long key; ++}; ++ ++struct vmwgfx_open_hash { ++ struct hlist_head *table; ++ u8 order; ++}; ++ ++int vmwgfx_ht_create(struct vmwgfx_open_hash *ht, unsigned int order); ++int vmwgfx_ht_insert_item(struct vmwgfx_open_hash *ht, struct vmwgfx_hash_item *item); ++int vmwgfx_ht_just_insert_please(struct vmwgfx_open_hash *ht, struct vmwgfx_hash_item *item, ++ unsigned long seed, int bits, int shift, ++ unsigned long add); ++int vmwgfx_ht_find_item(struct vmwgfx_open_hash *ht, unsigned long key, ++ struct vmwgfx_hash_item **item); ++ ++void vmwgfx_ht_verbose_list(struct vmwgfx_open_hash *ht, unsigned long key); ++int vmwgfx_ht_remove_key(struct vmwgfx_open_hash *ht, unsigned long key); ++int vmwgfx_ht_remove_item(struct vmwgfx_open_hash *ht, struct vmwgfx_hash_item *item); ++void vmwgfx_ht_remove(struct vmwgfx_open_hash *ht); ++ ++/* ++ * RCU-safe interface ++ * ++ * The user of this API needs to make sure that two or more instances of the ++ * hash table manipulation functions are never run simultaneously. ++ * The lookup function vmwgfx_ht_find_item_rcu may, however, run simultaneously ++ * with any of the manipulation functions as long as it's called from within ++ * an RCU read-locked section. ++ */ ++#define vmwgfx_ht_insert_item_rcu vmwgfx_ht_insert_item ++#define vmwgfx_ht_just_insert_please_rcu vmwgfx_ht_just_insert_please ++#define vmwgfx_ht_remove_key_rcu vmwgfx_ht_remove_key ++#define vmwgfx_ht_remove_item_rcu vmwgfx_ht_remove_item ++#define vmwgfx_ht_find_item_rcu vmwgfx_ht_find_item ++ ++#endif +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +index b09094b50c5d0..41b7417cb5d3d 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +@@ -43,7 +43,7 @@ + */ + struct vmw_validation_bo_node { + struct ttm_validate_buffer base; +- struct drm_hash_item hash; ++ struct vmwgfx_hash_item hash; + unsigned int coherent_count; + u32 as_mob : 1; + u32 cpu_blit : 1; +@@ -72,7 +72,7 @@ struct vmw_validation_bo_node { + */ + struct vmw_validation_res_node { + struct list_head head; +- struct drm_hash_item hash; ++ struct vmwgfx_hash_item hash; + struct vmw_resource *res; + struct vmw_buffer_object *new_backup; + unsigned long new_backup_offset; +@@ -184,9 +184,9 @@ vmw_validation_find_bo_dup(struct vmw_validation_context *ctx, + return NULL; + + if (ctx->ht) { +- struct drm_hash_item *hash; ++ struct vmwgfx_hash_item *hash; + +- if (!drm_ht_find_item(ctx->ht, (unsigned long) vbo, &hash)) ++ if (!vmwgfx_ht_find_item(ctx->ht, (unsigned long) vbo, &hash)) + bo_node = container_of(hash, typeof(*bo_node), hash); + } else { + struct vmw_validation_bo_node *entry; +@@ -221,9 +221,9 @@ vmw_validation_find_res_dup(struct vmw_validation_context *ctx, + return NULL; + + if (ctx->ht) { +- struct drm_hash_item *hash; ++ struct vmwgfx_hash_item *hash; + +- if (!drm_ht_find_item(ctx->ht, (unsigned long) res, &hash)) ++ if (!vmwgfx_ht_find_item(ctx->ht, (unsigned long) res, &hash)) + res_node = container_of(hash, typeof(*res_node), hash); + } else { + struct vmw_validation_res_node *entry; +@@ -280,7 +280,7 @@ int vmw_validation_add_bo(struct vmw_validation_context *ctx, + + if (ctx->ht) { + bo_node->hash.key = (unsigned long) vbo; +- ret = drm_ht_insert_item(ctx->ht, &bo_node->hash); ++ ret = vmwgfx_ht_insert_item(ctx->ht, &bo_node->hash); + if (ret) { + DRM_ERROR("Failed to initialize a buffer " + "validation entry.\n"); +@@ -335,7 +335,7 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx, + + if (ctx->ht) { + node->hash.key = (unsigned long) res; +- ret = drm_ht_insert_item(ctx->ht, &node->hash); ++ ret = vmwgfx_ht_insert_item(ctx->ht, &node->hash); + if (ret) { + DRM_ERROR("Failed to initialize a resource validation " + "entry.\n"); +@@ -688,13 +688,13 @@ void vmw_validation_drop_ht(struct vmw_validation_context *ctx) + return; + + list_for_each_entry(entry, &ctx->bo_list, base.head) +- (void) drm_ht_remove_item(ctx->ht, &entry->hash); ++ (void) vmwgfx_ht_remove_item(ctx->ht, &entry->hash); + + list_for_each_entry(val, &ctx->resource_list, head) +- (void) drm_ht_remove_item(ctx->ht, &val->hash); ++ (void) vmwgfx_ht_remove_item(ctx->ht, &val->hash); + + list_for_each_entry(val, &ctx->resource_ctx_list, head) +- (void) drm_ht_remove_item(ctx->ht, &val->hash); ++ (void) vmwgfx_ht_remove_item(ctx->ht, &val->hash); + + ctx->ht = NULL; + } +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h +index 739906d1b3ebb..495fd504b8c62 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h +@@ -31,9 +31,10 @@ + #include + #include + +-#include + #include + ++#include "vmwgfx_hashtab.h" ++ + #define VMW_RES_DIRTY_NONE 0 + #define VMW_RES_DIRTY_SET BIT(0) + #define VMW_RES_DIRTY_CLEAR BIT(1) +@@ -73,7 +74,7 @@ struct vmw_validation_mem { + * @total_mem: Amount of reserved memory. + */ + struct vmw_validation_context { +- struct drm_open_hash *ht; ++ struct vmwgfx_open_hash *ht; + struct list_head resource_list; + struct list_head resource_ctx_list; + struct list_head bo_list; +@@ -151,7 +152,7 @@ vmw_validation_set_val_mem(struct vmw_validation_context *ctx, + * available at validation context declaration time + */ + static inline void vmw_validation_set_ht(struct vmw_validation_context *ctx, +- struct drm_open_hash *ht) ++ struct vmwgfx_open_hash *ht) + { + ctx->ht = ht; + } +-- +2.51.0 + diff --git a/queue-5.15/drm-vmwgfx-fix-use-after-free-in-validation.patch b/queue-5.15/drm-vmwgfx-fix-use-after-free-in-validation.patch new file mode 100644 index 0000000000..c1ae392849 --- /dev/null +++ b/queue-5.15/drm-vmwgfx-fix-use-after-free-in-validation.patch @@ -0,0 +1,44 @@ +From fea81d37e21083f9b63a6b989df28431f8ca89b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 14:54:25 -0500 +Subject: drm/vmwgfx: Fix Use-after-free in validation + +From: Ian Forbes + +[ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ] + +Nodes stored in the validation duplicates hashtable come from an arena +allocator that is cleared at the end of vmw_execbuf_process. All nodes +are expected to be cleared in vmw_validation_drop_ht but this node escaped +because its resource was destroyed prematurely. + +Fixes: 64ad2abfe9a6 ("drm/vmwgfx: Adapt validation code for reference-free lookups") +Reported-by: Kuzey Arda Bulut +Signed-off-by: Ian Forbes +Reviewed-by: Zack Rusin +Signed-off-by: Zack Rusin +Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +index 41b7417cb5d3d..4633bd3081852 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +@@ -343,8 +343,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx, + } + } + node->res = vmw_resource_reference_unless_doomed(res); +- if (!node->res) ++ if (!node->res) { ++ hash_del_rcu(&node->hash.head); + return -ESRCH; ++ } + + node->first_usage = 1; + if (!res->dev_priv->has_mob) { +-- +2.51.0 + diff --git a/queue-5.15/gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch b/queue-5.15/gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch new file mode 100644 index 0000000000..f4709fc063 --- /dev/null +++ b/queue-5.15/gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch @@ -0,0 +1,37 @@ +From 75593dc6a09e0723a69306785d9ff1ff301fb0d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 16:51:29 +0200 +Subject: gpio: wcd934x: mark the GPIO controller as sleeping + +From: Bartosz Golaszewski + +[ Upstream commit b5f8aa8d4bde0cf3e4595af5a536da337e5f1c78 ] + +The slimbus regmap passed to the GPIO driver down from MFD does not use +fast_io. This means a mutex is used for locking and thus this GPIO chip +must not be used in atomic context. Change the can_sleep switch in +struct gpio_chip to true. + +Fixes: 59c324683400 ("gpio: wcd934x: Add support to wcd934x gpio controller") +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-wcd934x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-wcd934x.c b/drivers/gpio/gpio-wcd934x.c +index cbbbd105a5a7b..26d70ac90933c 100644 +--- a/drivers/gpio/gpio-wcd934x.c ++++ b/drivers/gpio/gpio-wcd934x.c +@@ -101,7 +101,7 @@ static int wcd_gpio_probe(struct platform_device *pdev) + chip->base = -1; + chip->ngpio = WCD934X_NPINS; + chip->label = dev_name(dev); +- chip->can_sleep = false; ++ chip->can_sleep = true; + + return devm_gpiochip_add_data(dev, chip, data); + } +-- +2.51.0 + diff --git a/queue-5.15/gpio-wcd934x-remove-duplicate-assignment-of-of_gpio_.patch b/queue-5.15/gpio-wcd934x-remove-duplicate-assignment-of-of_gpio_.patch new file mode 100644 index 0000000000..c6772ac62f --- /dev/null +++ b/queue-5.15/gpio-wcd934x-remove-duplicate-assignment-of-of_gpio_.patch @@ -0,0 +1,35 @@ +From 072019ce77219728f87d7b460ec4bf98efa27d72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jan 2023 20:26:18 +0200 +Subject: gpio: wcd934x: Remove duplicate assignment of of_gpio_n_cells + +From: Andy Shevchenko + +[ Upstream commit a060dc6620c13435b78e92cd2ebdbb6d11af237a ] + +The of_gpio_n_cells default is 2 when ->of_xlate() callback is +not defined. No need to assign it explicitly in the driver. + +Signed-off-by: Andy Shevchenko +Signed-off-by: Bartosz Golaszewski +Stable-dep-of: b5f8aa8d4bde ("gpio: wcd934x: mark the GPIO controller as sleeping") +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-wcd934x.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpio/gpio-wcd934x.c b/drivers/gpio/gpio-wcd934x.c +index c00968ce7a569..cbbbd105a5a7b 100644 +--- a/drivers/gpio/gpio-wcd934x.c ++++ b/drivers/gpio/gpio-wcd934x.c +@@ -101,7 +101,6 @@ static int wcd_gpio_probe(struct platform_device *pdev) + chip->base = -1; + chip->ngpio = WCD934X_NPINS; + chip->label = dev_name(dev); +- chip->of_gpio_n_cells = 2; + chip->can_sleep = false; + + return devm_gpiochip_add_data(dev, chip, data); +-- +2.51.0 + diff --git a/queue-5.15/libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch b/queue-5.15/libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch new file mode 100644 index 0000000000..dbce51bf84 --- /dev/null +++ b/queue-5.15/libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch @@ -0,0 +1,59 @@ +From 28950f1fc7915ecfc6851edfa36a799e635e7a97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:19 -0700 +Subject: libperf event: Ensure tracing data is multiple of 8 sized + +From: Ian Rogers + +[ Upstream commit b39c915a4f365cce6bdc0e538ed95d31823aea8f ] + +Perf's synthetic-events.c will ensure 8-byte alignment of tracing +data, writing it after a perf_record_header_tracing_data event. + +Add padding to struct perf_record_header_tracing_data to make it 16-byte +rather than 12-byte sized. + +Fixes: 055c67ed39887c55 ("perf tools: Move event synthesizing routines to separate .c file") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Acked-by: Namhyung Kim +Tested-by: Arnaldo Carvalho de Melo +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Blake Jones +Cc: Chun-Tse Shao +Cc: Collin Funk +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jan Polensky +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Li Huafei +Cc: Mark Rutland +Cc: Nam Cao +Cc: Peter Zijlstra +Cc: Steinar H. Gunderson +Cc: Thomas Gleixner +Link: https://lore.kernel.org/r/20250821163820.1132977-6-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/perf/include/perf/event.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/lib/perf/include/perf/event.h b/tools/lib/perf/include/perf/event.h +index 4d0c02ba3f7d3..1187415e26990 100644 +--- a/tools/lib/perf/include/perf/event.h ++++ b/tools/lib/perf/include/perf/event.h +@@ -211,6 +211,7 @@ struct perf_record_header_event_type { + struct perf_record_header_tracing_data { + struct perf_event_header header; + __u32 size; ++ __u32 pad; + }; + + #define PERF_RECORD_MISC_BUILD_ID_SIZE (1 << 15) +-- +2.51.0 + diff --git a/queue-5.15/mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch b/queue-5.15/mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch new file mode 100644 index 0000000000..ad7ace6be6 --- /dev/null +++ b/queue-5.15/mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch @@ -0,0 +1,48 @@ +From ecc6cf15b36ca568b923e85ec1c75818d7e3fb20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 13:07:21 +0530 +Subject: mailbox: zynqmp-ipi: Remove dev.parent check in + zynqmp_ipi_free_mboxes + +From: Harini T + +[ Upstream commit 019e3f4550fc7d319a7fd03eff487255f8e8aecd ] + +The ipi_mbox->dev.parent check is unreliable proxy for registration +status as it fails to protect against probe failures that occur after +the parent is assigned but before device_register() completes. + +device_is_registered() is the canonical and robust method to verify the +registration status. + +Remove ipi_mbox->dev.parent check in zynqmp_ipi_free_mboxes(). + +Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") +Signed-off-by: Harini T +Reviewed-by: Peng Fan +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/zynqmp-ipi-mailbox.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c +index 136c1f67dd223..e64f7157f065f 100644 +--- a/drivers/mailbox/zynqmp-ipi-mailbox.c ++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c +@@ -618,10 +618,8 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) + i = pdata->num_mboxes; + for (; i >= 0; i--) { + ipi_mbox = &pdata->ipi_mboxes[i]; +- if (ipi_mbox->dev.parent) { +- if (device_is_registered(&ipi_mbox->dev)) +- device_unregister(&ipi_mbox->dev); +- } ++ if (device_is_registered(&ipi_mbox->dev)) ++ device_unregister(&ipi_mbox->dev); + } + } + +-- +2.51.0 + diff --git a/queue-5.15/mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch b/queue-5.15/mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch new file mode 100644 index 0000000000..34265d8e65 --- /dev/null +++ b/queue-5.15/mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch @@ -0,0 +1,43 @@ +From 16600b073e50a08cf18cf05a67c2aa3618fbf847 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 13:07:20 +0530 +Subject: mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() + call + +From: Harini T + +[ Upstream commit 341867f730d3d3bb54491ee64e8b1a0c446656e7 ] + +The controller is registered using the device-managed function +'devm_mbox_controller_register()'. As documented in mailbox.c, this +ensures the devres framework automatically calls +mbox_controller_unregister() when device_unregister() is invoked, making +the explicit call unnecessary. + +Remove redundant mbox_controller_unregister() call as +device_unregister() handles controller cleanup. + +Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") +Signed-off-by: Harini T +Reviewed-by: Peng Fan +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/zynqmp-ipi-mailbox.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c +index be06de791c544..136c1f67dd223 100644 +--- a/drivers/mailbox/zynqmp-ipi-mailbox.c ++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c +@@ -619,7 +619,6 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) + for (; i >= 0; i--) { + ipi_mbox = &pdata->ipi_mboxes[i]; + if (ipi_mbox->dev.parent) { +- mbox_controller_unregister(&ipi_mbox->mbox); + if (device_is_registered(&ipi_mbox->dev)) + device_unregister(&ipi_mbox->dev); + } +-- +2.51.0 + diff --git a/queue-5.15/net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch b/queue-5.15/net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch new file mode 100644 index 0000000000..ffb3198f37 --- /dev/null +++ b/queue-5.15/net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch @@ -0,0 +1,41 @@ +From 61c65078f3c7ab903ee8ab0855ec8f835a963e35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 20:46:17 +0300 +Subject: net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe + +From: Erick Karanja + +[ Upstream commit 521405cb54cd2812bbb6dedd5afc14bca1e7e98a ] + +Add missing of_node_put call to release device node tbi obtained +via for_each_child_of_node. + +Fixes: afae5ad78b342 ("net/fsl_pq_mdio: streamline probing of MDIO nodes") +Signed-off-by: Erick Karanja +Link: https://patch.msgid.link/20251002174617.960521-1-karanja99erick@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c +index 9d58d83344670..ea49b0df397e5 100644 +--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c ++++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c +@@ -482,10 +482,12 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev) + "missing 'reg' property in node %pOF\n", + tbi); + err = -EBUSY; ++ of_node_put(tbi); + goto error; + } + set_tbipa(*prop, pdev, + data->get_tbipa, priv->map, &res); ++ of_node_put(tbi); + } + } + +-- +2.51.0 + diff --git a/queue-5.15/net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch b/queue-5.15/net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch new file mode 100644 index 0000000000..8ff6571d12 --- /dev/null +++ b/queue-5.15/net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch @@ -0,0 +1,41 @@ +From 7c7e156202a0a27f4ddeb90dc136b16bb19c4f58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 15:25:01 +0300 +Subject: net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() + +From: Dan Carpenter + +[ Upstream commit 4f0d91ba72811fd5dd577bcdccd7fed649aae62c ] + +Print "entry->mac" before freeing "entry". The "entry" pointer is +freed with kfree_rcu() so it's unlikely that we would trigger this +in real life, but it's safer to re-order it. + +Fixes: cc5387f7346a ("net/mlx4_en: Add unicast MAC filtering") +Signed-off-by: Dan Carpenter +Reviewed-by: Tariq Toukan +Link: https://patch.msgid.link/aNvMHX4g8RksFFvV@stanley.mountain +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +index 3bd3603873e32..efbb01460f4ba 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +@@ -1176,9 +1176,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv, + mlx4_unregister_mac(mdev->dev, priv->port, mac); + + hlist_del_rcu(&entry->hlist); +- kfree_rcu(entry, rcu); + en_dbg(DRV, priv, "Removed MAC %pM on port:%d\n", + entry->mac, priv->port); ++ kfree_rcu(entry, rcu); + ++removed; + } + } +-- +2.51.0 + diff --git a/queue-5.15/net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch b/queue-5.15/net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch new file mode 100644 index 0000000000..43454183c2 --- /dev/null +++ b/queue-5.15/net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch @@ -0,0 +1,42 @@ +From 6260e303bbf3e865ac3b2b54cebe637de68cd5bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 12:14:47 +0300 +Subject: net/sctp: fix a null dereference in sctp_disposition + sctp_sf_do_5_1D_ce() + +From: Alexandr Sapozhnikov + +[ Upstream commit 2f3119686ef50319490ccaec81a575973da98815 ] + +If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 +and sctp_ulpevent_make_authkey() returns 0, then the variable +ai_ev remains zero and the zero will be dereferenced +in the sctp_ulpevent_free() function. + +Signed-off-by: Alexandr Sapozhnikov +Acked-by: Xin Long +Fixes: 30f6ebf65bc4 ("sctp: add SCTP_AUTH_NO_AUTH type for AUTHENTICATION_EVENT") +Link: https://patch.msgid.link/20251002091448.11-1-alsp705@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sctp/sm_statefuns.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index b5f5ee233b59d..5a883bd722f5d 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -880,7 +880,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net, + return SCTP_DISPOSITION_CONSUME; + + nomem_authev: +- sctp_ulpevent_free(ai_ev); ++ if (ai_ev) ++ sctp_ulpevent_free(ai_ev); + nomem_aiev: + sctp_ulpevent_free(ev); + nomem_ev: +-- +2.51.0 + diff --git a/queue-5.15/perf-arm-spe-augment-the-data-source-type-with-neove.patch b/queue-5.15/perf-arm-spe-augment-the-data-source-type-with-neove.patch new file mode 100644 index 0000000000..bb5455e4ce --- /dev/null +++ b/queue-5.15/perf-arm-spe-augment-the-data-source-type-with-neove.patch @@ -0,0 +1,62 @@ +From 653349d60f4c061dcccbc356f7c33d79f9efd095 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Sep 2022 21:03:16 +0800 +Subject: perf arm-spe: augment the data source type with neoverse_spe list + +From: Jing Zhang + +[ Upstream commit 74a61d53a6d1ca1172d85964d15c83c2cc3670b3 ] + +When synthesizing event with SPE data source, commit 4e6430cbb1a9("perf +arm-spe: Use SPE data source for neoverse cores") augment the type with +source information by MIDR. However, is_midr_in_range only compares the +first entry in neoverse_spe. + +Change is_midr_in_range to is_midr_in_range_list to traverse the +neoverse_spe array so that all neoverse cores synthesize event with data +source packet. + +Fixes: 4e6430cbb1a9f1dc ("perf arm-spe: Use SPE data source for neoverse cores") +Reviewed-by: Ali Saidi +Reviewed-by: Leo Yan +Signed-off-by: Jing Zhang +Cc: Alexander Shishkin +Cc: Ali Saidi +Cc: German Gomez +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: John Garry +Cc: linux-arm-kernel@lists.infradead.org +Cc: Mark Rutland +Cc: Mike Leach +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Shuai Xue +Cc: Timothy Hayes +Cc: Will Deacon +Cc: Zhuo Song +Link: https://lore.kernel.org/r/1664197396-42672-1-git-send-email-renyu.zj@linux.alibaba.com +Signed-off-by: Arnaldo Carvalho de Melo +Stable-dep-of: cb300e351505 ("perf arm_spe: Correct memory level for remote access") +Signed-off-by: Sasha Levin +--- + tools/perf/util/arm-spe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c +index 9e7e56596c60e..2d7fc2b01f36b 100644 +--- a/tools/perf/util/arm-spe.c ++++ b/tools/perf/util/arm-spe.c +@@ -423,7 +423,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco + static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr) + { + union perf_mem_data_src data_src = { 0 }; +- bool is_neoverse = is_midr_in_range(midr, neoverse_spe); ++ bool is_neoverse = is_midr_in_range_list(midr, neoverse_spe); + + if (record->op == ARM_SPE_LD) + data_src.mem_op = PERF_MEM_OP_LOAD; +-- +2.51.0 + diff --git a/queue-5.15/perf-arm-spe-refactor-arm-spe-to-support-operation-p.patch b/queue-5.15/perf-arm-spe-refactor-arm-spe-to-support-operation-p.patch new file mode 100644 index 0000000000..336bf78b34 --- /dev/null +++ b/queue-5.15/perf-arm-spe-refactor-arm-spe-to-support-operation-p.patch @@ -0,0 +1,183 @@ +From 4ec36ddd5da5384e5bf6e39fcd97518c65ab172b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 15:15:06 +0000 +Subject: perf arm-spe: Refactor arm-spe to support operation packet type + +From: German Gomez + +[ Upstream commit 0066015a3d8f9c01a17eb04579edba7dac9510af ] + +Extend the decoder of Arm SPE records to support more fields from the +operation packet type. + +Not all fields are being decoded by this commit. Only those needed to +support the use-case SVE load/store/other operations. + +Suggested-by: Leo Yan +Signed-off-by: German Gomez +Acked-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Anshuman.Khandual@arm.com +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: John Garry +Cc: Mark Rutland +Cc: Mike Leach +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Will Deacon +Cc: linux-arm-kernel@lists.infradead.org +Link: https://lore.kernel.org/r/20230320151509.1137462-2-james.clark@arm.com +Signed-off-by: James Clark +Signed-off-by: Arnaldo Carvalho de Melo +Stable-dep-of: cb300e351505 ("perf arm_spe: Correct memory level for remote access") +Signed-off-by: Sasha Levin +--- + .../util/arm-spe-decoder/arm-spe-decoder.c | 30 ++++++++++-- + .../util/arm-spe-decoder/arm-spe-decoder.h | 47 +++++++++++++++---- + tools/perf/util/arm-spe.c | 8 ++-- + 3 files changed, 67 insertions(+), 18 deletions(-) + +diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c +index 3e36934477154..3b937e89654f4 100644 +--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c ++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c +@@ -184,11 +184,27 @@ static int arm_spe_read_record(struct arm_spe_decoder *decoder) + decoder->record.context_id = payload; + break; + case ARM_SPE_OP_TYPE: +- if (idx == SPE_OP_PKT_HDR_CLASS_LD_ST_ATOMIC) { +- if (payload & 0x1) +- decoder->record.op = ARM_SPE_ST; ++ switch (idx) { ++ case SPE_OP_PKT_HDR_CLASS_LD_ST_ATOMIC: ++ decoder->record.op |= ARM_SPE_OP_LDST; ++ if (payload & SPE_OP_PKT_ST) ++ decoder->record.op |= ARM_SPE_OP_ST; + else +- decoder->record.op = ARM_SPE_LD; ++ decoder->record.op |= ARM_SPE_OP_LD; ++ if (SPE_OP_PKT_IS_LDST_SVE(payload)) ++ decoder->record.op |= ARM_SPE_OP_SVE_LDST; ++ break; ++ case SPE_OP_PKT_HDR_CLASS_OTHER: ++ decoder->record.op |= ARM_SPE_OP_OTHER; ++ if (SPE_OP_PKT_IS_OTHER_SVE_OP(payload)) ++ decoder->record.op |= ARM_SPE_OP_SVE_OTHER; ++ break; ++ case SPE_OP_PKT_HDR_CLASS_BR_ERET: ++ decoder->record.op |= ARM_SPE_OP_BRANCH_ERET; ++ break; ++ default: ++ pr_err("Get packet error!\n"); ++ return -1; + } + break; + case ARM_SPE_EVENTS: +@@ -216,6 +232,12 @@ static int arm_spe_read_record(struct arm_spe_decoder *decoder) + if (payload & BIT(EV_MISPRED)) + decoder->record.type |= ARM_SPE_BRANCH_MISS; + ++ if (payload & BIT(EV_PARTIAL_PREDICATE)) ++ decoder->record.type |= ARM_SPE_SVE_PARTIAL_PRED; ++ ++ if (payload & BIT(EV_EMPTY_PREDICATE)) ++ decoder->record.type |= ARM_SPE_SVE_EMPTY_PRED; ++ + break; + case ARM_SPE_DATA_SOURCE: + decoder->record.source = payload; +diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +index c3943eb95e305..fa269c9c53b33 100644 +--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h ++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +@@ -14,19 +14,46 @@ + #include "arm-spe-pkt-decoder.h" + + enum arm_spe_sample_type { +- ARM_SPE_L1D_ACCESS = 1 << 0, +- ARM_SPE_L1D_MISS = 1 << 1, +- ARM_SPE_LLC_ACCESS = 1 << 2, +- ARM_SPE_LLC_MISS = 1 << 3, +- ARM_SPE_TLB_ACCESS = 1 << 4, +- ARM_SPE_TLB_MISS = 1 << 5, +- ARM_SPE_BRANCH_MISS = 1 << 6, +- ARM_SPE_REMOTE_ACCESS = 1 << 7, ++ ARM_SPE_L1D_ACCESS = 1 << 0, ++ ARM_SPE_L1D_MISS = 1 << 1, ++ ARM_SPE_LLC_ACCESS = 1 << 2, ++ ARM_SPE_LLC_MISS = 1 << 3, ++ ARM_SPE_TLB_ACCESS = 1 << 4, ++ ARM_SPE_TLB_MISS = 1 << 5, ++ ARM_SPE_BRANCH_MISS = 1 << 6, ++ ARM_SPE_REMOTE_ACCESS = 1 << 7, ++ ARM_SPE_SVE_PARTIAL_PRED = 1 << 8, ++ ARM_SPE_SVE_EMPTY_PRED = 1 << 9, + }; + + enum arm_spe_op_type { +- ARM_SPE_LD = 1 << 0, +- ARM_SPE_ST = 1 << 1, ++ /* First level operation type */ ++ ARM_SPE_OP_OTHER = 1 << 0, ++ ARM_SPE_OP_LDST = 1 << 1, ++ ARM_SPE_OP_BRANCH_ERET = 1 << 2, ++ ++ /* Second level operation type for OTHER */ ++ ARM_SPE_OP_SVE_OTHER = 1 << 16, ++ ARM_SPE_OP_SVE_FP = 1 << 17, ++ ARM_SPE_OP_SVE_PRED_OTHER = 1 << 18, ++ ++ /* Second level operation type for LDST */ ++ ARM_SPE_OP_LD = 1 << 16, ++ ARM_SPE_OP_ST = 1 << 17, ++ ARM_SPE_OP_ATOMIC = 1 << 18, ++ ARM_SPE_OP_EXCL = 1 << 19, ++ ARM_SPE_OP_AR = 1 << 20, ++ ARM_SPE_OP_SIMD_FP = 1 << 21, ++ ARM_SPE_OP_GP_REG = 1 << 22, ++ ARM_SPE_OP_UNSPEC_REG = 1 << 23, ++ ARM_SPE_OP_NV_SYSREG = 1 << 24, ++ ARM_SPE_OP_SVE_LDST = 1 << 25, ++ ARM_SPE_OP_SVE_PRED_LDST = 1 << 26, ++ ARM_SPE_OP_SVE_SG = 1 << 27, ++ ++ /* Second level operation type for BRANCH_ERET */ ++ ARM_SPE_OP_BR_COND = 1 << 16, ++ ARM_SPE_OP_BR_INDIRECT = 1 << 17, + }; + + enum arm_spe_neoverse_data_source { +diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c +index 2d7fc2b01f36b..c86e60b5954c5 100644 +--- a/tools/perf/util/arm-spe.c ++++ b/tools/perf/util/arm-spe.c +@@ -336,7 +336,7 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec + * We have no data on the hit level or data source for stores in the + * Neoverse SPE records. + */ +- if (record->op & ARM_SPE_ST) { ++ if (record->op & ARM_SPE_OP_ST) { + data_src->mem_lvl = PERF_MEM_LVL_NA; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_NA; + data_src->mem_snoop = PERF_MEM_SNOOP_NA; +@@ -422,12 +422,12 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco + + static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr) + { +- union perf_mem_data_src data_src = { 0 }; ++ union perf_mem_data_src data_src = { .mem_op = PERF_MEM_OP_NA }; + bool is_neoverse = is_midr_in_range_list(midr, neoverse_spe); + +- if (record->op == ARM_SPE_LD) ++ if (record->op & ARM_SPE_OP_LD) + data_src.mem_op = PERF_MEM_OP_LOAD; +- else if (record->op == ARM_SPE_ST) ++ else if (record->op & ARM_SPE_OP_ST) + data_src.mem_op = PERF_MEM_OP_STORE; + else + return 0; +-- +2.51.0 + diff --git a/queue-5.15/perf-arm-spe-rename-the-common-data-source-encoding.patch b/queue-5.15/perf-arm-spe-rename-the-common-data-source-encoding.patch new file mode 100644 index 0000000000..e4d36f6f11 --- /dev/null +++ b/queue-5.15/perf-arm-spe-rename-the-common-data-source-encoding.patch @@ -0,0 +1,158 @@ +From 2682f978eb47e3f63dc0745dbbb1a849e1b07584 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Oct 2024 19:53:17 +0100 +Subject: perf arm-spe: Rename the common data source encoding + +From: Leo Yan + +[ Upstream commit 50b8f1d5bf4ad7f09ef8012ccf5f94f741df827b ] + +The Neoverse CPUs follow the common data source encoding, and other +CPU variants can share the same format. + +Rename the CPU list and data source definitions as common data source +names. This change prepares for appending more CPU variants. + +Signed-off-by: Leo Yan +Reviewed-by: James Clark +Link: https://lore.kernel.org/r/20241003185322.192357-3-leo.yan@arm.com +Signed-off-by: Namhyung Kim +Stable-dep-of: cb300e351505 ("perf arm_spe: Correct memory level for remote access") +Signed-off-by: Sasha Levin +--- + .../util/arm-spe-decoder/arm-spe-decoder.h | 18 ++++++------ + tools/perf/util/arm-spe.c | 28 +++++++++---------- + 2 files changed, 23 insertions(+), 23 deletions(-) + +diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +index fa269c9c53b33..d9166794e527f 100644 +--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h ++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +@@ -56,15 +56,15 @@ enum arm_spe_op_type { + ARM_SPE_OP_BR_INDIRECT = 1 << 17, + }; + +-enum arm_spe_neoverse_data_source { +- ARM_SPE_NV_L1D = 0x0, +- ARM_SPE_NV_L2 = 0x8, +- ARM_SPE_NV_PEER_CORE = 0x9, +- ARM_SPE_NV_LOCAL_CLUSTER = 0xa, +- ARM_SPE_NV_SYS_CACHE = 0xb, +- ARM_SPE_NV_PEER_CLUSTER = 0xc, +- ARM_SPE_NV_REMOTE = 0xd, +- ARM_SPE_NV_DRAM = 0xe, ++enum arm_spe_common_data_source { ++ ARM_SPE_COMMON_DS_L1D = 0x0, ++ ARM_SPE_COMMON_DS_L2 = 0x8, ++ ARM_SPE_COMMON_DS_PEER_CORE = 0x9, ++ ARM_SPE_COMMON_DS_LOCAL_CLUSTER = 0xa, ++ ARM_SPE_COMMON_DS_SYS_CACHE = 0xb, ++ ARM_SPE_COMMON_DS_PEER_CLUSTER = 0xc, ++ ARM_SPE_COMMON_DS_REMOTE = 0xd, ++ ARM_SPE_COMMON_DS_DRAM = 0xe, + }; + + struct arm_spe_record { +diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c +index c86e60b5954c5..68445c1e1db3b 100644 +--- a/tools/perf/util/arm-spe.c ++++ b/tools/perf/util/arm-spe.c +@@ -314,15 +314,15 @@ static int arm_spe__synth_branch_sample(struct arm_spe_queue *speq, + return arm_spe_deliver_synth_event(spe, speq, event, &sample); + } + +-static const struct midr_range neoverse_spe[] = { ++static const struct midr_range common_ds_encoding_cpus[] = { + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), + {}, + }; + +-static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *record, +- union perf_mem_data_src *data_src) ++static void arm_spe__synth_data_source_common(const struct arm_spe_record *record, ++ union perf_mem_data_src *data_src) + { + /* + * Even though four levels of cache hierarchy are possible, no known +@@ -344,17 +344,17 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec + } + + switch (record->source) { +- case ARM_SPE_NV_L1D: ++ case ARM_SPE_COMMON_DS_L1D: + data_src->mem_lvl = PERF_MEM_LVL_L1 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L1; + data_src->mem_snoop = PERF_MEM_SNOOP_NONE; + break; +- case ARM_SPE_NV_L2: ++ case ARM_SPE_COMMON_DS_L2: + data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2; + data_src->mem_snoop = PERF_MEM_SNOOP_NONE; + break; +- case ARM_SPE_NV_PEER_CORE: ++ case ARM_SPE_COMMON_DS_PEER_CORE: + data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; +@@ -363,8 +363,8 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec + * We don't know if this is L1, L2 but we do know it was a cache-2-cache + * transfer, so set SNOOPX_PEER + */ +- case ARM_SPE_NV_LOCAL_CLUSTER: +- case ARM_SPE_NV_PEER_CLUSTER: ++ case ARM_SPE_COMMON_DS_LOCAL_CLUSTER: ++ case ARM_SPE_COMMON_DS_PEER_CLUSTER: + data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; +@@ -372,7 +372,7 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec + /* + * System cache is assumed to be L3 + */ +- case ARM_SPE_NV_SYS_CACHE: ++ case ARM_SPE_COMMON_DS_SYS_CACHE: + data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3; + data_src->mem_snoop = PERF_MEM_SNOOP_HIT; +@@ -381,13 +381,13 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec + * We don't know what level it hit in, except it came from the other + * socket + */ +- case ARM_SPE_NV_REMOTE: ++ case ARM_SPE_COMMON_DS_REMOTE: + data_src->mem_lvl = PERF_MEM_LVL_REM_CCE1; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_ANY_CACHE; + data_src->mem_remote = PERF_MEM_REMOTE_REMOTE; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; + break; +- case ARM_SPE_NV_DRAM: ++ case ARM_SPE_COMMON_DS_DRAM: + data_src->mem_lvl = PERF_MEM_LVL_LOC_RAM | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_RAM; + data_src->mem_snoop = PERF_MEM_SNOOP_NONE; +@@ -423,7 +423,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco + static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr) + { + union perf_mem_data_src data_src = { .mem_op = PERF_MEM_OP_NA }; +- bool is_neoverse = is_midr_in_range_list(midr, neoverse_spe); ++ bool is_common = is_midr_in_range_list(midr, common_ds_encoding_cpus); + + if (record->op & ARM_SPE_OP_LD) + data_src.mem_op = PERF_MEM_OP_LOAD; +@@ -432,8 +432,8 @@ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 m + else + return 0; + +- if (is_neoverse) +- arm_spe__synth_data_source_neoverse(record, &data_src); ++ if (is_common) ++ arm_spe__synth_data_source_common(record, &data_src); + else + arm_spe__synth_data_source_generic(record, &data_src); + +-- +2.51.0 + diff --git a/queue-5.15/perf-arm-spe-save-context-id-in-record.patch b/queue-5.15/perf-arm-spe-save-context-id-in-record.patch new file mode 100644 index 0000000000..890cc1dd84 --- /dev/null +++ b/queue-5.15/perf-arm-spe-save-context-id-in-record.patch @@ -0,0 +1,66 @@ +From ad7020e05e83a6049b828ad6de58864d864d02c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Nov 2021 13:36:24 +0000 +Subject: perf arm-spe: Save context ID in record + +From: German Gomez + +[ Upstream commit 169de64f5dc22d9984d45c1f119fb644fa16d64a ] + +This patch is to save context ID in record, this will be used to set TID +for samples. + +Reviewed-by: Leo Yan +Signed-off-by: German Gomez +Acked-by: Namhyung Kim +Cc: Alexander Shishkin +Cc: Jiri Olsa +Cc: John Garry +Cc: Mark Rutland +Cc: Mathieu Poirier +Cc: Will Deacon +Cc: linux-arm-kernel@lists.infradead.org +Link: https://lore.kernel.org/r/20211111133625.193568-4-german.gomez@arm.com +Signed-off-by: Arnaldo Carvalho de Melo +Stable-dep-of: 039fd0634a06 ("perf arm_spe: Correct setting remote access") +Signed-off-by: Sasha Levin +--- + tools/perf/util/arm-spe-decoder/arm-spe-decoder.c | 2 ++ + tools/perf/util/arm-spe-decoder/arm-spe-decoder.h | 1 + + 2 files changed, 3 insertions(+) + +diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c +index 32fe41835fa68..3fc528c9270c2 100644 +--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c ++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c +@@ -151,6 +151,7 @@ static int arm_spe_read_record(struct arm_spe_decoder *decoder) + u64 payload, ip; + + memset(&decoder->record, 0x0, sizeof(decoder->record)); ++ decoder->record.context_id = (u64)-1; + + while (1) { + err = arm_spe_get_next_packet(decoder); +@@ -180,6 +181,7 @@ static int arm_spe_read_record(struct arm_spe_decoder *decoder) + case ARM_SPE_COUNTER: + break; + case ARM_SPE_CONTEXT: ++ decoder->record.context_id = payload; + break; + case ARM_SPE_OP_TYPE: + if (idx == SPE_OP_PKT_HDR_CLASS_LD_ST_ATOMIC) { +diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +index 59bdb73096741..46a8556a9e956 100644 +--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h ++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +@@ -38,6 +38,7 @@ struct arm_spe_record { + u64 timestamp; + u64 virt_addr; + u64 phys_addr; ++ u64 context_id; + }; + + struct arm_spe_insn; +-- +2.51.0 + diff --git a/queue-5.15/perf-arm-spe-use-spe-data-source-for-neoverse-cores.patch b/queue-5.15/perf-arm-spe-use-spe-data-source-for-neoverse-cores.patch new file mode 100644 index 0000000000..0b02040db0 --- /dev/null +++ b/queue-5.15/perf-arm-spe-use-spe-data-source-for-neoverse-cores.patch @@ -0,0 +1,286 @@ +From c921941a6d3aafe12beba046b9e0b95909d3dc54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Aug 2022 14:24:39 +0800 +Subject: perf arm-spe: Use SPE data source for neoverse cores + +From: Ali Saidi + +[ Upstream commit 4e6430cbb1a9f1dc0a698f93026b6178da437798 ] + +When synthesizing data from SPE, augment the type with source information +for Arm Neoverse cores. The field is IMPLDEF but the Neoverse cores all use +the same encoding. I can't find encoding information for any other SPE +implementations to unify their choices with Arm's thus that is left for +future work. + +This change populates the mem_lvl_num for Neoverse cores as well as the +deprecated mem_lvl namespace. + +Reviewed-by: German Gomez +Reviewed-by: Leo Yan +Signed-off-by: Ali Saidi +Tested-by: Leo Yan +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Anshuman Khandual +Cc: Gustavo A. R. Silva +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: John Garry +Cc: Kajol Jain +Cc: Like Xu +Cc: Mark Rutland +Cc: Mike Leach +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Timothy Hayes +Cc: Will Deacon +Cc: linux-arm-kernel@lists.infradead.org +Link: https://lore.kernel.org/r/20220811062451.435810-4-leo.yan@linaro.org +Signed-off-by: Leo Yan +Signed-off-by: Arnaldo Carvalho de Melo +Stable-dep-of: 039fd0634a06 ("perf arm_spe: Correct setting remote access") +Signed-off-by: Sasha Levin +--- + .../util/arm-spe-decoder/arm-spe-decoder.c | 1 + + .../util/arm-spe-decoder/arm-spe-decoder.h | 12 ++ + tools/perf/util/arm-spe.c | 130 +++++++++++++++--- + 3 files changed, 127 insertions(+), 16 deletions(-) + +diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c +index 3fc528c9270c2..3e36934477154 100644 +--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c ++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c +@@ -218,6 +218,7 @@ static int arm_spe_read_record(struct arm_spe_decoder *decoder) + + break; + case ARM_SPE_DATA_SOURCE: ++ decoder->record.source = payload; + break; + case ARM_SPE_BAD: + break; +diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +index 46a8556a9e956..c3943eb95e305 100644 +--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h ++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +@@ -29,6 +29,17 @@ enum arm_spe_op_type { + ARM_SPE_ST = 1 << 1, + }; + ++enum arm_spe_neoverse_data_source { ++ ARM_SPE_NV_L1D = 0x0, ++ ARM_SPE_NV_L2 = 0x8, ++ ARM_SPE_NV_PEER_CORE = 0x9, ++ ARM_SPE_NV_LOCAL_CLUSTER = 0xa, ++ ARM_SPE_NV_SYS_CACHE = 0xb, ++ ARM_SPE_NV_PEER_CLUSTER = 0xc, ++ ARM_SPE_NV_REMOTE = 0xd, ++ ARM_SPE_NV_DRAM = 0xe, ++}; ++ + struct arm_spe_record { + enum arm_spe_sample_type type; + int err; +@@ -39,6 +50,7 @@ struct arm_spe_record { + u64 virt_addr; + u64 phys_addr; + u64 context_id; ++ u16 source; + }; + + struct arm_spe_insn; +diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c +index 569e1b8ad0abc..7b16898af4e7f 100644 +--- a/tools/perf/util/arm-spe.c ++++ b/tools/perf/util/arm-spe.c +@@ -34,6 +34,7 @@ + #include "arm-spe-decoder/arm-spe-decoder.h" + #include "arm-spe-decoder/arm-spe-pkt-decoder.h" + ++#include "../../arch/arm64/include/asm/cputype.h" + #define MAX_TIMESTAMP (~0ULL) + + struct arm_spe { +@@ -45,6 +46,7 @@ struct arm_spe { + struct perf_session *session; + struct machine *machine; + u32 pmu_type; ++ u64 midr; + + struct perf_tsc_conversion tc; + +@@ -312,35 +314,128 @@ static int arm_spe__synth_branch_sample(struct arm_spe_queue *speq, + return arm_spe_deliver_synth_event(spe, speq, event, &sample); + } + +-static u64 arm_spe__synth_data_source(const struct arm_spe_record *record) ++static const struct midr_range neoverse_spe[] = { ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1), ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), ++ {}, ++}; ++ ++static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *record, ++ union perf_mem_data_src *data_src) + { +- union perf_mem_data_src data_src = { 0 }; ++ /* ++ * Even though four levels of cache hierarchy are possible, no known ++ * production Neoverse systems currently include more than three levels ++ * so for the time being we assume three exist. If a production system ++ * is built with four the this function would have to be changed to ++ * detect the number of levels for reporting. ++ */ + +- if (record->op == ARM_SPE_LD) +- data_src.mem_op = PERF_MEM_OP_LOAD; +- else if (record->op == ARM_SPE_ST) +- data_src.mem_op = PERF_MEM_OP_STORE; +- else +- return 0; ++ /* ++ * We have no data on the hit level or data source for stores in the ++ * Neoverse SPE records. ++ */ ++ if (record->op & ARM_SPE_ST) { ++ data_src->mem_lvl = PERF_MEM_LVL_NA; ++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_NA; ++ data_src->mem_snoop = PERF_MEM_SNOOP_NA; ++ return; ++ } ++ ++ switch (record->source) { ++ case ARM_SPE_NV_L1D: ++ data_src->mem_lvl = PERF_MEM_LVL_L1 | PERF_MEM_LVL_HIT; ++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L1; ++ data_src->mem_snoop = PERF_MEM_SNOOP_NONE; ++ break; ++ case ARM_SPE_NV_L2: ++ data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT; ++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2; ++ data_src->mem_snoop = PERF_MEM_SNOOP_NONE; ++ break; ++ case ARM_SPE_NV_PEER_CORE: ++ data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT; ++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2; ++ data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; ++ break; ++ /* ++ * We don't know if this is L1, L2 but we do know it was a cache-2-cache ++ * transfer, so set SNOOPX_PEER ++ */ ++ case ARM_SPE_NV_LOCAL_CLUSTER: ++ case ARM_SPE_NV_PEER_CLUSTER: ++ data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT; ++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3; ++ data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; ++ break; ++ /* ++ * System cache is assumed to be L3 ++ */ ++ case ARM_SPE_NV_SYS_CACHE: ++ data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT; ++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3; ++ data_src->mem_snoop = PERF_MEM_SNOOP_HIT; ++ break; ++ /* ++ * We don't know what level it hit in, except it came from the other ++ * socket ++ */ ++ case ARM_SPE_NV_REMOTE: ++ data_src->mem_lvl = PERF_MEM_LVL_REM_CCE1; ++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_ANY_CACHE; ++ data_src->mem_remote = PERF_MEM_REMOTE_REMOTE; ++ data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; ++ break; ++ case ARM_SPE_NV_DRAM: ++ data_src->mem_lvl = PERF_MEM_LVL_LOC_RAM | PERF_MEM_LVL_HIT; ++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_RAM; ++ data_src->mem_snoop = PERF_MEM_SNOOP_NONE; ++ break; ++ default: ++ break; ++ } ++} + ++static void arm_spe__synth_data_source_generic(const struct arm_spe_record *record, ++ union perf_mem_data_src *data_src) ++{ + if (record->type & (ARM_SPE_LLC_ACCESS | ARM_SPE_LLC_MISS)) { +- data_src.mem_lvl = PERF_MEM_LVL_L3; ++ data_src->mem_lvl = PERF_MEM_LVL_L3; + + if (record->type & ARM_SPE_LLC_MISS) +- data_src.mem_lvl |= PERF_MEM_LVL_MISS; ++ data_src->mem_lvl |= PERF_MEM_LVL_MISS; + else +- data_src.mem_lvl |= PERF_MEM_LVL_HIT; ++ data_src->mem_lvl |= PERF_MEM_LVL_HIT; + } else if (record->type & (ARM_SPE_L1D_ACCESS | ARM_SPE_L1D_MISS)) { +- data_src.mem_lvl = PERF_MEM_LVL_L1; ++ data_src->mem_lvl = PERF_MEM_LVL_L1; + + if (record->type & ARM_SPE_L1D_MISS) +- data_src.mem_lvl |= PERF_MEM_LVL_MISS; ++ data_src->mem_lvl |= PERF_MEM_LVL_MISS; + else +- data_src.mem_lvl |= PERF_MEM_LVL_HIT; ++ data_src->mem_lvl |= PERF_MEM_LVL_HIT; + } + + if (record->type & ARM_SPE_REMOTE_ACCESS) +- data_src.mem_lvl |= PERF_MEM_LVL_REM_CCE1; ++ data_src->mem_lvl |= PERF_MEM_LVL_REM_CCE1; ++} ++ ++static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr) ++{ ++ union perf_mem_data_src data_src = { 0 }; ++ bool is_neoverse = is_midr_in_range(midr, neoverse_spe); ++ ++ if (record->op == ARM_SPE_LD) ++ data_src.mem_op = PERF_MEM_OP_LOAD; ++ else if (record->op == ARM_SPE_ST) ++ data_src.mem_op = PERF_MEM_OP_STORE; ++ else ++ return 0; ++ ++ if (is_neoverse) ++ arm_spe__synth_data_source_neoverse(record, &data_src); ++ else ++ arm_spe__synth_data_source_generic(record, &data_src); + + if (record->type & (ARM_SPE_TLB_ACCESS | ARM_SPE_TLB_MISS)) { + data_src.mem_dtlb = PERF_MEM_TLB_WK; +@@ -361,7 +456,7 @@ static int arm_spe_sample(struct arm_spe_queue *speq) + u64 data_src; + int err; + +- data_src = arm_spe__synth_data_source(record); ++ data_src = arm_spe__synth_data_source(record, spe->midr); + + if (spe->sample_flc) { + if (record->type & ARM_SPE_L1D_MISS) { +@@ -1047,6 +1142,8 @@ int arm_spe_process_auxtrace_info(union perf_event *event, + struct perf_record_auxtrace_info *auxtrace_info = &event->auxtrace_info; + size_t min_sz = sizeof(u64) * ARM_SPE_AUXTRACE_PRIV_MAX; + struct perf_record_time_conv *tc = &session->time_conv; ++ const char *cpuid = perf_env__cpuid(session->evlist->env); ++ u64 midr = strtol(cpuid, NULL, 16); + struct arm_spe *spe; + int err; + +@@ -1066,6 +1163,7 @@ int arm_spe_process_auxtrace_info(union perf_event *event, + spe->machine = &session->machines.host; /* No kvm support */ + spe->auxtrace_type = auxtrace_info->type; + spe->pmu_type = auxtrace_info->priv[ARM_SPE_PMU_TYPE]; ++ spe->midr = midr; + + spe->timeless_decoding = arm_spe__is_timeless_decoding(spe); + +-- +2.51.0 + diff --git a/queue-5.15/perf-arm_spe-correct-memory-level-for-remote-access.patch b/queue-5.15/perf-arm_spe-correct-memory-level-for-remote-access.patch new file mode 100644 index 0000000000..17d7e9e20f --- /dev/null +++ b/queue-5.15/perf-arm_spe-correct-memory-level-for-remote-access.patch @@ -0,0 +1,49 @@ +From 67f619bb4b76be404b427893d3befb7b3aad0929 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 16:42:09 +0100 +Subject: perf arm_spe: Correct memory level for remote access + +From: Leo Yan + +[ Upstream commit cb300e3515057fb555983ce47e8acc86a5c69c3c ] + +For remote accesses, the data source packet does not contain information +about the memory level. To avoid misinformation, set the memory level to +NA (Not Available). + +Fixes: 4e6430cbb1a9f1dc ("perf arm-spe: Use SPE data source for neoverse cores") +Reviewed-by: James Clark +Signed-off-by: Leo Yan +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ali Saidi +Cc: German Gomez +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Will Deacon +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/arm-spe.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c +index 68445c1e1db3b..98d6cfadb1130 100644 +--- a/tools/perf/util/arm-spe.c ++++ b/tools/perf/util/arm-spe.c +@@ -382,8 +382,8 @@ static void arm_spe__synth_data_source_common(const struct arm_spe_record *recor + * socket + */ + case ARM_SPE_COMMON_DS_REMOTE: +- data_src->mem_lvl = PERF_MEM_LVL_REM_CCE1; +- data_src->mem_lvl_num = PERF_MEM_LVLNUM_ANY_CACHE; ++ data_src->mem_lvl = PERF_MEM_LVL_NA; ++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_NA; + data_src->mem_remote = PERF_MEM_REMOTE_REMOTE; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; + break; +-- +2.51.0 + diff --git a/queue-5.15/perf-arm_spe-correct-setting-remote-access.patch b/queue-5.15/perf-arm_spe-correct-setting-remote-access.patch new file mode 100644 index 0000000000..451d787a3a --- /dev/null +++ b/queue-5.15/perf-arm_spe-correct-setting-remote-access.patch @@ -0,0 +1,46 @@ +From 0c2f44bd920716a99c70d623ef2a7ab46d06dbb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 16:42:08 +0100 +Subject: perf arm_spe: Correct setting remote access + +From: Leo Yan + +[ Upstream commit 039fd0634a0629132432632d7ac9a14915406b5c ] + +Set the mem_remote field for a remote access to appropriately represent +the event. + +Fixes: a89dbc9b988f3ba8 ("perf arm-spe: Set sample's data source field") +Reviewed-by: James Clark +Signed-off-by: Leo Yan +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ali Saidi +Cc: German Gomez +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Will Deacon +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/arm-spe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c +index 7b16898af4e7f..9e7e56596c60e 100644 +--- a/tools/perf/util/arm-spe.c ++++ b/tools/perf/util/arm-spe.c +@@ -417,7 +417,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco + } + + if (record->type & ARM_SPE_REMOTE_ACCESS) +- data_src->mem_lvl |= PERF_MEM_LVL_REM_CCE1; ++ data_src->mem_remote = PERF_MEM_REMOTE_REMOTE; + } + + static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr) +-- +2.51.0 + diff --git a/queue-5.15/perf-evsel-avoid-container_of-on-a-null-leader.patch b/queue-5.15/perf-evsel-avoid-container_of-on-a-null-leader.patch new file mode 100644 index 0000000000..09bb423f96 --- /dev/null +++ b/queue-5.15/perf-evsel-avoid-container_of-on-a-null-leader.patch @@ -0,0 +1,59 @@ +From e2ec384b9c03c92b759b2975e509b8270d8a3aa7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:17 -0700 +Subject: perf evsel: Avoid container_of on a NULL leader + +From: Ian Rogers + +[ Upstream commit 2354479026d726954ff86ce82f4b649637319661 ] + +An evsel should typically have a leader of itself, however, in tests +like 'Sample parsing' a NULL leader may occur and the container_of +will return a corrupt pointer. + +Avoid this with an explicit NULL test. + +Fixes: fba7c86601e2e42d ("libperf: Move 'leader' from tools/perf to perf_evsel::leader") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Acked-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Blake Jones +Cc: Chun-Tse Shao +Cc: Collin Funk +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jan Polensky +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Li Huafei +Cc: Mark Rutland +Cc: Nam Cao +Cc: Peter Zijlstra +Cc: Steinar H. Gunderson +Cc: Thomas Gleixner +Link: https://lore.kernel.org/r/20250821163820.1132977-4-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/evsel.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index f14c83e6829a8..a9cb1aede476e 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -2930,6 +2930,8 @@ bool evsel__is_hybrid(struct evsel *evsel) + + struct evsel *evsel__leader(struct evsel *evsel) + { ++ if (evsel->core.leader == NULL) ++ return NULL; + return container_of(evsel->core.leader, struct evsel, core); + } + +-- +2.51.0 + diff --git a/queue-5.15/perf-session-fix-handling-when-buffer-exceeds-2-gib.patch b/queue-5.15/perf-session-fix-handling-when-buffer-exceeds-2-gib.patch new file mode 100644 index 0000000000..511d855a57 --- /dev/null +++ b/queue-5.15/perf-session-fix-handling-when-buffer-exceeds-2-gib.patch @@ -0,0 +1,53 @@ +From 9728ce23678e16d4400a57aa4ce4547876f1f9f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Aug 2025 14:24:40 +0100 +Subject: perf session: Fix handling when buffer exceeds 2 GiB +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leo Yan + +[ Upstream commit c17dda8013495d8132c976cbf349be9949d0fbd1 ] + +If a user specifies an AUX buffer larger than 2 GiB, the returned size +may exceed 0x80000000. Since the err variable is defined as a signed +32-bit integer, such a value overflows and becomes negative. + +As a result, the perf record command reports an error: + + 0x146e8 [0x30]: failed to process type: 71 [Unknown error 183711232] + +Change the type of the err variable to a signed 64-bit integer to +accommodate large buffer sizes correctly. + +Fixes: d5652d865ea734a1 ("perf session: Add ability to skip 4GiB or more") +Reported-by: Tamas Zsoldos +Signed-off-by: Leo Yan +Acked-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Jiri Olsa +Link: https://lore.kernel.org/r/20250808-perf_fix_big_buffer_size-v1-1-45f45444a9a4@arm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/session.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c +index 562e9b8080272..0ecfda9d9f8b4 100644 +--- a/tools/perf/util/session.c ++++ b/tools/perf/util/session.c +@@ -1598,7 +1598,7 @@ static s64 perf_session__process_user_event(struct perf_session *session, + struct perf_tool *tool = session->tool; + struct perf_sample sample = { .time = 0, }; + int fd = perf_data__fd(session->data); +- int err; ++ s64 err; + + if (event->header.type != PERF_RECORD_COMPRESSED || + tool->compressed == perf_session__process_compressed_event_stub) +-- +2.51.0 + diff --git a/queue-5.15/perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch b/queue-5.15/perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch new file mode 100644 index 0000000000..646c5a2b14 --- /dev/null +++ b/queue-5.15/perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch @@ -0,0 +1,202 @@ +From 3e0dc42387952be7a10faadf2d1bca783739e099 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 15:22:00 -0700 +Subject: perf test: Don't leak workload gopipe in PERF_RECORD_* + +From: Ian Rogers + +[ Upstream commit 48918cacefd226af44373e914e63304927c0e7dc ] + +The test starts a workload and then opens events. If the events fail +to open, for example because of perf_event_paranoid, the gopipe of the +workload is leaked and the file descriptor leak check fails when the +test exits. To avoid this cancel the workload when opening the events +fails. + +Before: +``` +$ perf test -vv 7 + 7: PERF_RECORD_* events & perf_sample fields: + --- start --- +test child forked, pid 1189568 +Using CPUID GenuineIntel-6-B7-1 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 +sys_perf_event_open failed, error -13 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + exclude_kernel 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 +sys_perf_event_open failed, error -13 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + exclude_kernel 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3 +Attempt to add: software/cpu-clock/ +..after resolving event: software/config=0/ +cpu-clock -> software/cpu-clock/ + ------------------------------------------------------------ +perf_event_attr: + type 1 (PERF_TYPE_SOFTWARE) + size 136 + config 0x9 (PERF_COUNT_SW_DUMMY) + sample_type IP|TID|TIME|CPU + read_format ID|LOST + disabled 1 + inherit 1 + mmap 1 + comm 1 + enable_on_exec 1 + task 1 + sample_id_all 1 + mmap2 1 + comm_exec 1 + ksymbol 1 + bpf_event 1 + { wakeup_events, wakeup_watermark } 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 1189569 cpu 0 group_fd -1 flags 0x8 +sys_perf_event_open failed, error -13 +perf_evlist__open: Permission denied + ---- end(-2) ---- +Leak of file descriptor 6 that opened: 'pipe:[14200347]' + ---- unexpected signal (6) ---- +iFailed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon + #0 0x565358f6666e in child_test_sig_handler builtin-test.c:311 + #1 0x7f29ce849df0 in __restore_rt libc_sigaction.c:0 + #2 0x7f29ce89e95c in __pthread_kill_implementation pthread_kill.c:44 + #3 0x7f29ce849cc2 in raise raise.c:27 + #4 0x7f29ce8324ac in abort abort.c:81 + #5 0x565358f662d4 in check_leaks builtin-test.c:226 + #6 0x565358f6682e in run_test_child builtin-test.c:344 + #7 0x565358ef7121 in start_command run-command.c:128 + #8 0x565358f67273 in start_test builtin-test.c:545 + #9 0x565358f6771d in __cmd_test builtin-test.c:647 + #10 0x565358f682bd in cmd_test builtin-test.c:849 + #11 0x565358ee5ded in run_builtin perf.c:349 + #12 0x565358ee6085 in handle_internal_command perf.c:401 + #13 0x565358ee61de in run_argv perf.c:448 + #14 0x565358ee6527 in main perf.c:555 + #15 0x7f29ce833ca8 in __libc_start_call_main libc_start_call_main.h:74 + #16 0x7f29ce833d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128 + #17 0x565358e391c1 in _start perf[851c1] + 7: PERF_RECORD_* events & perf_sample fields : FAILED! +``` + +After: +``` +$ perf test 7 + 7: PERF_RECORD_* events & perf_sample fields : Skip (permissions) +``` + +Fixes: 16d00fee703866c6 ("perf tests: Move test__PERF_RECORD into separate object") +Signed-off-by: Ian Rogers +Tested-by: Arnaldo Carvalho de Melo +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Chun-Tse Shao +Cc: Howard Chu +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/perf-record.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/tools/perf/tests/perf-record.c b/tools/perf/tests/perf-record.c +index 0df471bf1590e..b215e89b65f7d 100644 +--- a/tools/perf/tests/perf-record.c ++++ b/tools/perf/tests/perf-record.c +@@ -115,6 +115,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus + if (err < 0) { + pr_debug("sched__get_first_possible_cpu: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +@@ -126,6 +127,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus + if (sched_setaffinity(evlist->workload.pid, cpu_mask_size, &cpu_mask) < 0) { + pr_debug("sched_setaffinity: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +@@ -137,6 +139,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus + if (err < 0) { + pr_debug("perf_evlist__open: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +@@ -149,6 +152,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus + if (err < 0) { + pr_debug("evlist__mmap: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +-- +2.51.0 + diff --git a/queue-5.15/perf-util-fix-compression-checks-returning-1-as-bool.patch b/queue-5.15/perf-util-fix-compression-checks-returning-1-as-bool.patch new file mode 100644 index 0000000000..ef4c5d2ac4 --- /dev/null +++ b/queue-5.15/perf-util-fix-compression-checks-returning-1-as-bool.patch @@ -0,0 +1,67 @@ +From 00f972eb3ec07f28ffaac17af9e6c9ead32ffe65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 16:25:08 +0000 +Subject: perf util: Fix compression checks returning -1 as bool + +From: Yunseong Kim + +[ Upstream commit 43fa1141e2c1af79c91aaa4df03e436c415a6fc3 ] + +The lzma_is_compressed and gzip_is_compressed functions are declared +to return a "bool" type, but in case of an error (e.g., file open +failure), they incorrectly returned -1. + +A bool type is a boolean value that is either true or false. +Returning -1 for a bool return type can lead to unexpected behavior +and may violate strict type-checking in some compilers. + +Fix the return value to be false in error cases, ensuring the function +adheres to its declared return type improves for preventing potential +bugs related to type mismatch. + +Fixes: 4b57fd44b61beb51 ("perf tools: Add lzma_is_compressed function") +Reviewed-by: Ian Rogers +Signed-off-by: Yunseong Kim +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Namhyung Kim +Cc: Stephen Brennan +Link: https://lore.kernel.org/r/20250822162506.316844-3-ysk@kzalloc.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/lzma.c | 2 +- + tools/perf/util/zlib.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/lzma.c b/tools/perf/util/lzma.c +index 51424cdc3b682..aa9a0ebc1f937 100644 +--- a/tools/perf/util/lzma.c ++++ b/tools/perf/util/lzma.c +@@ -115,7 +115,7 @@ bool lzma_is_compressed(const char *input) + ssize_t rc; + + if (fd < 0) +- return -1; ++ return false; + + rc = read(fd, buf, sizeof(buf)); + close(fd); +diff --git a/tools/perf/util/zlib.c b/tools/perf/util/zlib.c +index 78d2297c1b674..1f7c065230599 100644 +--- a/tools/perf/util/zlib.c ++++ b/tools/perf/util/zlib.c +@@ -88,7 +88,7 @@ bool gzip_is_compressed(const char *input) + ssize_t rc; + + if (fd < 0) +- return -1; ++ return false; + + rc = read(fd, buf, sizeof(buf)); + close(fd); +-- +2.51.0 + diff --git a/queue-5.15/rtc-x1205-fix-xicor-x1205-vendor-prefix.patch b/queue-5.15/rtc-x1205-fix-xicor-x1205-vendor-prefix.patch new file mode 100644 index 0000000000..f625c52f87 --- /dev/null +++ b/queue-5.15/rtc-x1205-fix-xicor-x1205-vendor-prefix.patch @@ -0,0 +1,39 @@ +From f6ab06696028b1447be33b6248564916b643b638 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 16:57:02 -0500 +Subject: rtc: x1205: Fix Xicor X1205 vendor prefix + +From: Rob Herring (Arm) + +[ Upstream commit 606d19ee37de3a72f1b6e95a4ea544f6f20dbb46 ] + +The vendor for the X1205 RTC is not Xircom, but Xicor which was acquired +by Intersil. Since the I2C subsystem drops the vendor prefix for driver +matching, the vendor prefix hasn't mattered. + +Fixes: 6875404fdb44 ("rtc: x1205: Add DT probing support") +Signed-off-by: Rob Herring (Arm) +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20250821215703.869628-2-robh@kernel.org +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-x1205.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-x1205.c b/drivers/rtc/rtc-x1205.c +index d1d5a44d9122a..3b3aaa7d8283c 100644 +--- a/drivers/rtc/rtc-x1205.c ++++ b/drivers/rtc/rtc-x1205.c +@@ -671,7 +671,7 @@ static const struct i2c_device_id x1205_id[] = { + MODULE_DEVICE_TABLE(i2c, x1205_id); + + static const struct of_device_id x1205_dt_ids[] = { +- { .compatible = "xircom,x1205", }, ++ { .compatible = "xicor,x1205", }, + {}, + }; + MODULE_DEVICE_TABLE(of, x1205_dt_ids); +-- +2.51.0 + diff --git a/queue-5.15/s390-cio-unregister-the-subchannel-while-purging.patch b/queue-5.15/s390-cio-unregister-the-subchannel-while-purging.patch new file mode 100644 index 0000000000..31e8e0d712 --- /dev/null +++ b/queue-5.15/s390-cio-unregister-the-subchannel-while-purging.patch @@ -0,0 +1,52 @@ +From d892992f8b682b77fbbe3a078c51c9ed25816ee8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Sep 2021 13:39:16 +0200 +Subject: s390/cio: unregister the subchannel while purging + +From: Vineeth Vijayan + +[ Upstream commit fa172f043f5bc21c357c54a6ca2e9c8acd18c3db ] + +The cio_ignore list is used to create and maintain the list of devices +which is to be ignored by Linux. During boot-time, this list is adjusted +and accommodate all the devices which are configured on the HMC +interface. Once these devices are accessible, they are then available to +Linux and set online. + +cio_ignore purge function should align with this functionality. But +currently, the subchannel associated with the offline-devices are not +unregistered during purge. Add an explicit subchannel-unregister function +in the purge_fn callback. + +Signed-off-by: Vineeth Vijayan +Reviewed-by: Peter Oberparleiter +Signed-off-by: Vasily Gorbik +Stable-dep-of: 9daa5a879586 ("s390/cio: Update purge function to unregister the unused subchannels") +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/device.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c +index c2ed91b69f079..70c5b85d2dfc9 100644 +--- a/drivers/s390/cio/device.c ++++ b/drivers/s390/cio/device.c +@@ -1327,6 +1327,7 @@ static int purge_fn(struct device *dev, void *data) + { + struct ccw_device *cdev = to_ccwdev(dev); + struct ccw_dev_id *id = &cdev->private->dev_id; ++ struct subchannel *sch = to_subchannel(cdev->dev.parent); + + spin_lock_irq(cdev->ccwlock); + if (is_blacklisted(id->ssid, id->devno) && +@@ -1335,6 +1336,7 @@ static int purge_fn(struct device *dev, void *data) + CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x\n", id->ssid, + id->devno); + ccw_device_sched_todo(cdev, CDEV_TODO_UNREG); ++ css_sched_sch_todo(sch, SCH_TODO_UNREG); + atomic_set(&cdev->private->onoff, 0); + } + spin_unlock_irq(cdev->ccwlock); +-- +2.51.0 + diff --git a/queue-5.15/s390-cio-update-purge-function-to-unregister-the-unu.patch b/queue-5.15/s390-cio-update-purge-function-to-unregister-the-unu.patch new file mode 100644 index 0000000000..2dd5441d01 --- /dev/null +++ b/queue-5.15/s390-cio-update-purge-function-to-unregister-the-unu.patch @@ -0,0 +1,96 @@ +From 74b0bb4c573f9eca8e5d9227f7c6e357c20a402b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 15:38:17 +0200 +Subject: s390/cio: Update purge function to unregister the unused subchannels + +From: Vineeth Vijayan + +[ Upstream commit 9daa5a8795865f9a3c93d8d1066785b07ded6073 ] + +Starting with 'commit 2297791c92d0 ("s390/cio: dont unregister +subchannel from child-drivers")', cio no longer unregisters +subchannels when the attached device is invalid or unavailable. + +As an unintended side-effect, the cio_ignore purge function no longer +removes subchannels for devices on the cio_ignore list if no CCW device +is attached. This situation occurs when a CCW device is non-operational +or unavailable + +To ensure the same outcome of the purge function as when the +current cio_ignore list had been active during boot, update the purge +function to remove I/O subchannels without working CCW devices if the +associated device number is found on the cio_ignore list. + +Fixes: 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers") +Suggested-by: Peter Oberparleiter +Reviewed-by: Peter Oberparleiter +Signed-off-by: Vineeth Vijayan +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/device.c | 37 ++++++++++++++++++++++++------------- + 1 file changed, 24 insertions(+), 13 deletions(-) + +diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c +index 70c5b85d2dfc9..22fa1296a5168 100644 +--- a/drivers/s390/cio/device.c ++++ b/drivers/s390/cio/device.c +@@ -1323,23 +1323,34 @@ void ccw_device_schedule_recovery(void) + spin_unlock_irqrestore(&recovery_lock, flags); + } + +-static int purge_fn(struct device *dev, void *data) ++static int purge_fn(struct subchannel *sch, void *data) + { +- struct ccw_device *cdev = to_ccwdev(dev); +- struct ccw_dev_id *id = &cdev->private->dev_id; +- struct subchannel *sch = to_subchannel(cdev->dev.parent); ++ struct ccw_device *cdev; + +- spin_lock_irq(cdev->ccwlock); +- if (is_blacklisted(id->ssid, id->devno) && +- (cdev->private->state == DEV_STATE_OFFLINE) && +- (atomic_cmpxchg(&cdev->private->onoff, 0, 1) == 0)) { +- CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x\n", id->ssid, +- id->devno); ++ spin_lock_irq(&sch->lock); ++ if (sch->st != SUBCHANNEL_TYPE_IO || !sch->schib.pmcw.dnv) ++ goto unlock; ++ ++ if (!is_blacklisted(sch->schid.ssid, sch->schib.pmcw.dev)) ++ goto unlock; ++ ++ cdev = sch_get_cdev(sch); ++ if (cdev) { ++ if (cdev->private->state != DEV_STATE_OFFLINE) ++ goto unlock; ++ ++ if (atomic_cmpxchg(&cdev->private->onoff, 0, 1) != 0) ++ goto unlock; + ccw_device_sched_todo(cdev, CDEV_TODO_UNREG); +- css_sched_sch_todo(sch, SCH_TODO_UNREG); + atomic_set(&cdev->private->onoff, 0); + } +- spin_unlock_irq(cdev->ccwlock); ++ ++ css_sched_sch_todo(sch, SCH_TODO_UNREG); ++ CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x%s\n", sch->schid.ssid, ++ sch->schib.pmcw.dev, cdev ? "" : " (no cdev)"); ++ ++unlock: ++ spin_unlock_irq(&sch->lock); + /* Abort loop in case of pending signal. */ + if (signal_pending(current)) + return -EINTR; +@@ -1355,7 +1366,7 @@ static int purge_fn(struct device *dev, void *data) + int ccw_purge_blacklisted(void) + { + CIO_MSG_EVENT(2, "ccw: purging blacklisted devices\n"); +- bus_for_each_dev(&ccw_bus_type, NULL, NULL, purge_fn); ++ for_each_subchannel_staged(purge_fn, NULL, NULL); + return 0; + } + +-- +2.51.0 + diff --git a/queue-5.15/scsi-libsas-add-sas_task_find_rq.patch b/queue-5.15/scsi-libsas-add-sas_task_find_rq.patch new file mode 100644 index 0000000000..4114a834aa --- /dev/null +++ b/queue-5.15/scsi-libsas-add-sas_task_find_rq.patch @@ -0,0 +1,59 @@ +From 393b5fd8b6f9e7b0e352a2e733f8eee9ba9f09d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 19:15:57 +0800 +Subject: scsi: libsas: Add sas_task_find_rq() + +From: John Garry + +[ Upstream commit a9ee3f840646e2ec419c734e592ffe997195435e ] + +blk-mq already provides a unique tag per request. Some libsas LLDDs - like +hisi_sas - already use this tag as the unique per-I/O HW tag. + +Add a common function to provide the request associated with a sas_task for +all libsas LLDDs. + +Signed-off-by: John Garry +Link: https://lore.kernel.org/r/1666091763-11023-2-git-send-email-john.garry@huawei.com +Reviewed-by: Jack Wang +Reviewed-by: Jason Yan +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue") +Signed-off-by: Sasha Levin +--- + include/scsi/libsas.h | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h +index 306005b3b60f3..97e99385f70ce 100644 +--- a/include/scsi/libsas.h ++++ b/include/scsi/libsas.h +@@ -631,6 +631,24 @@ extern struct sas_task *sas_alloc_task(gfp_t flags); + extern struct sas_task *sas_alloc_slow_task(gfp_t flags); + extern void sas_free_task(struct sas_task *task); + ++static inline struct request *sas_task_find_rq(struct sas_task *task) ++{ ++ struct scsi_cmnd *scmd; ++ ++ if (task->task_proto & SAS_PROTOCOL_STP_ALL) { ++ struct ata_queued_cmd *qc = task->uldd_task; ++ ++ scmd = qc ? qc->scsicmd : NULL; ++ } else { ++ scmd = task->uldd_task; ++ } ++ ++ if (!scmd) ++ return NULL; ++ ++ return scsi_cmd_to_rq(scmd); ++} ++ + struct sas_domain_function_template { + /* The class calls these to notify the LLDD of an event. */ + void (*lldd_port_formed)(struct asd_sas_phy *); +-- +2.51.0 + diff --git a/queue-5.15/scsi-mvsas-delete-mvs_tag_init.patch b/queue-5.15/scsi-mvsas-delete-mvs_tag_init.patch new file mode 100644 index 0000000000..2d263059db --- /dev/null +++ b/queue-5.15/scsi-mvsas-delete-mvs_tag_init.patch @@ -0,0 +1,72 @@ +From 81e9b927529f27e4896cc2ea78af5a6c465456ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 19:16:02 +0800 +Subject: scsi: mvsas: Delete mvs_tag_init() + +From: John Garry + +[ Upstream commit ffc9f9bf3f14876d019f67ef17d41138802529a8 ] + +All mvs_tag_init() does is zero the tag bitmap, but this is already done +with the kzalloc() call to alloc the tags, so delete this unneeded +function. + +Signed-off-by: John Garry +Link: https://lore.kernel.org/r/1666091763-11023-7-git-send-email-john.garry@huawei.com +Reviewed-by: Damien Le Moal +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue") +Signed-off-by: Sasha Levin +--- + drivers/scsi/mvsas/mv_init.c | 2 -- + drivers/scsi/mvsas/mv_sas.c | 7 ------- + drivers/scsi/mvsas/mv_sas.h | 1 - + 3 files changed, 10 deletions(-) + +diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c +index 1c98662db080f..e2093e7637d82 100644 +--- a/drivers/scsi/mvsas/mv_init.c ++++ b/drivers/scsi/mvsas/mv_init.c +@@ -286,8 +286,6 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host *shost) + } + mvi->tags_num = slot_nr; + +- /* Initialize tags */ +- mvs_tag_init(mvi); + return 0; + err_out: + return 1; +diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c +index efd11fabff937..3b4576dba590e 100644 +--- a/drivers/scsi/mvsas/mv_sas.c ++++ b/drivers/scsi/mvsas/mv_sas.c +@@ -51,13 +51,6 @@ inline int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out) + return 0; + } + +-void mvs_tag_init(struct mvs_info *mvi) +-{ +- int i; +- for (i = 0; i < mvi->tags_num; ++i) +- mvs_tag_clear(mvi, i); +-} +- + static struct mvs_info *mvs_find_dev_mvi(struct domain_device *dev) + { + unsigned long i = 0, j = 0, hi = 0; +diff --git a/drivers/scsi/mvsas/mv_sas.h b/drivers/scsi/mvsas/mv_sas.h +index fa654c73beeee..8dd30f8b478ec 100644 +--- a/drivers/scsi/mvsas/mv_sas.h ++++ b/drivers/scsi/mvsas/mv_sas.h +@@ -428,7 +428,6 @@ void mvs_tag_clear(struct mvs_info *mvi, u32 tag); + void mvs_tag_free(struct mvs_info *mvi, u32 tag); + void mvs_tag_set(struct mvs_info *mvi, unsigned int tag); + int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out); +-void mvs_tag_init(struct mvs_info *mvi); + void mvs_iounmap(void __iomem *regs); + int mvs_ioremap(struct mvs_info *mvi, int bar, int bar_ex); + void mvs_phys_reset(struct mvs_info *mvi, u32 phy_mask, int hard); +-- +2.51.0 + diff --git a/queue-5.15/scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch b/queue-5.15/scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch new file mode 100644 index 0000000000..870a271914 --- /dev/null +++ b/queue-5.15/scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch @@ -0,0 +1,56 @@ +From 263bd482bf21b8ff1de7f420321969dab6157737 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Sep 2025 21:42:01 +0800 +Subject: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue + +From: Duoming Zhou + +[ Upstream commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 ] + +During the detaching of Marvell's SAS/SATA controller, the original code +calls cancel_delayed_work() in mvs_free() to cancel the delayed work +item mwq->work_q. However, if mwq->work_q is already running, the +cancel_delayed_work() may fail to cancel it. This can lead to +use-after-free scenarios where mvs_free() frees the mvs_info while +mvs_work_queue() is still executing and attempts to access the +already-freed mvs_info. + +A typical race condition is illustrated below: + +CPU 0 (remove) | CPU 1 (delayed work callback) +mvs_pci_remove() | + mvs_free() | mvs_work_queue() + cancel_delayed_work() | + kfree(mvi) | + | mvi-> // UAF + +Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure +that the delayed work item is properly canceled and any executing +delayed work item completes before the mvs_info is deallocated. + +This bug was found by static analysis. + +Fixes: 20b09c2992fe ("[SCSI] mvsas: add support for 94xx; layout change; bug fixes") +Signed-off-by: Duoming Zhou +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mvsas/mv_init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c +index 5f217f9ab5223..d348350c15094 100644 +--- a/drivers/scsi/mvsas/mv_init.c ++++ b/drivers/scsi/mvsas/mv_init.c +@@ -141,7 +141,7 @@ static void mvs_free(struct mvs_info *mvi) + if (mvi->shost) + scsi_host_put(mvi->shost); + list_for_each_entry(mwq, &mvi->wq_list, entry) +- cancel_delayed_work(&mwq->work_q); ++ cancel_delayed_work_sync(&mwq->work_q); + kfree(mvi->rsvd_tags); + kfree(mvi); + } +-- +2.51.0 + diff --git a/queue-5.15/scsi-mvsas-use-sas_task_find_rq-for-tagging.patch b/queue-5.15/scsi-mvsas-use-sas_task_find_rq-for-tagging.patch new file mode 100644 index 0000000000..32d998b9ec --- /dev/null +++ b/queue-5.15/scsi-mvsas-use-sas_task_find_rq-for-tagging.patch @@ -0,0 +1,201 @@ +From 33e1645e9ee8d12b5eb93435bb4937834787ebcc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 19:16:03 +0800 +Subject: scsi: mvsas: Use sas_task_find_rq() for tagging + +From: John Garry + +[ Upstream commit 2acf97f199f9eba8321390325519e9b6bff60108 ] + +The request associated with a SCSI command coming from the block layer has +a unique tag, so use that when possible for getting a slot. + +Unfortunately we don't support reserved commands in the SCSI midlayer yet. +As such, SMP tasks - as an example - will not have a request associated, so +in the interim continue to manage those tags for that type of sas_task +internally. + +We reserve an arbitrary 4 tags for these internal tags. Indeed, we already +decrement MVS_RSVD_SLOTS by 2 for the shost can_queue when flag +MVF_FLAG_SOC is set. This change was made in commit 20b09c2992fe ("[SCSI] +mvsas: add support for 94xx; layout change; bug fixes"), but what those 2 +slots are used for is not obvious. + +Also make the tag management functions static, where possible. + +Signed-off-by: John Garry +Link: https://lore.kernel.org/r/1666091763-11023-8-git-send-email-john.garry@huawei.com +Signed-off-by: Martin K. Petersen +Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue") +Signed-off-by: Sasha Levin +--- + drivers/scsi/mvsas/mv_defs.h | 1 + + drivers/scsi/mvsas/mv_init.c | 9 +++++---- + drivers/scsi/mvsas/mv_sas.c | 35 ++++++++++++++++++++++------------- + drivers/scsi/mvsas/mv_sas.h | 7 +------ + 4 files changed, 29 insertions(+), 23 deletions(-) + +diff --git a/drivers/scsi/mvsas/mv_defs.h b/drivers/scsi/mvsas/mv_defs.h +index 7123a2efbf583..8ef174cd4d374 100644 +--- a/drivers/scsi/mvsas/mv_defs.h ++++ b/drivers/scsi/mvsas/mv_defs.h +@@ -40,6 +40,7 @@ enum driver_configuration { + MVS_ATA_CMD_SZ = 96, /* SATA command table buffer size */ + MVS_OAF_SZ = 64, /* Open address frame buffer size */ + MVS_QUEUE_SIZE = 64, /* Support Queue depth */ ++ MVS_RSVD_SLOTS = 4, + MVS_SOC_CAN_QUEUE = MVS_SOC_SLOTS - 2, + }; + +diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c +index e2093e7637d82..5f217f9ab5223 100644 +--- a/drivers/scsi/mvsas/mv_init.c ++++ b/drivers/scsi/mvsas/mv_init.c +@@ -142,7 +142,7 @@ static void mvs_free(struct mvs_info *mvi) + scsi_host_put(mvi->shost); + list_for_each_entry(mwq, &mvi->wq_list, entry) + cancel_delayed_work(&mwq->work_q); +- kfree(mvi->tags); ++ kfree(mvi->rsvd_tags); + kfree(mvi); + } + +@@ -284,7 +284,6 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host *shost) + printk(KERN_DEBUG "failed to create dma pool %s.\n", pool_name); + goto err_out; + } +- mvi->tags_num = slot_nr; + + return 0; + err_out: +@@ -367,8 +366,8 @@ static struct mvs_info *mvs_pci_alloc(struct pci_dev *pdev, + mvi->sas = sha; + mvi->shost = shost; + +- mvi->tags = kzalloc(MVS_CHIP_SLOT_SZ>>3, GFP_KERNEL); +- if (!mvi->tags) ++ mvi->rsvd_tags = bitmap_zalloc(MVS_RSVD_SLOTS, GFP_KERNEL); ++ if (!mvi->rsvd_tags) + goto err_out; + + if (MVS_CHIP_DISP->chip_ioremap(mvi)) +@@ -469,6 +468,8 @@ static void mvs_post_sas_ha_init(struct Scsi_Host *shost, + else + can_queue = MVS_CHIP_SLOT_SZ; + ++ can_queue -= MVS_RSVD_SLOTS; ++ + shost->sg_tablesize = min_t(u16, SG_ALL, MVS_MAX_SG); + shost->can_queue = can_queue; + mvi->shost->cmd_per_lun = MVS_QUEUE_SIZE; +diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c +index 3b4576dba590e..e79297395ac77 100644 +--- a/drivers/scsi/mvsas/mv_sas.c ++++ b/drivers/scsi/mvsas/mv_sas.c +@@ -20,31 +20,34 @@ static int mvs_find_tag(struct mvs_info *mvi, struct sas_task *task, u32 *tag) + return 0; + } + +-void mvs_tag_clear(struct mvs_info *mvi, u32 tag) ++static void mvs_tag_clear(struct mvs_info *mvi, u32 tag) + { +- void *bitmap = mvi->tags; ++ void *bitmap = mvi->rsvd_tags; + clear_bit(tag, bitmap); + } + +-void mvs_tag_free(struct mvs_info *mvi, u32 tag) ++static void mvs_tag_free(struct mvs_info *mvi, u32 tag) + { ++ if (tag >= MVS_RSVD_SLOTS) ++ return; ++ + mvs_tag_clear(mvi, tag); + } + +-void mvs_tag_set(struct mvs_info *mvi, unsigned int tag) ++static void mvs_tag_set(struct mvs_info *mvi, unsigned int tag) + { +- void *bitmap = mvi->tags; ++ void *bitmap = mvi->rsvd_tags; + set_bit(tag, bitmap); + } + +-inline int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out) ++static int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out) + { + unsigned int index, tag; +- void *bitmap = mvi->tags; ++ void *bitmap = mvi->rsvd_tags; + +- index = find_first_zero_bit(bitmap, mvi->tags_num); ++ index = find_first_zero_bit(bitmap, MVS_RSVD_SLOTS); + tag = index; +- if (tag >= mvi->tags_num) ++ if (tag >= MVS_RSVD_SLOTS) + return -SAS_QUEUE_FULL; + mvs_tag_set(mvi, tag); + *tag_out = tag; +@@ -691,6 +694,7 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf + struct mvs_task_exec_info tei; + struct mvs_slot_info *slot; + u32 tag = 0xdeadbeef, n_elem = 0; ++ struct request *rq; + int rc = 0; + + if (!dev->port) { +@@ -755,9 +759,14 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf + n_elem = task->num_scatter; + } + +- rc = mvs_tag_alloc(mvi, &tag); +- if (rc) +- goto err_out; ++ rq = sas_task_find_rq(task); ++ if (rq) { ++ tag = rq->tag + MVS_RSVD_SLOTS; ++ } else { ++ rc = mvs_tag_alloc(mvi, &tag); ++ if (rc) ++ goto err_out; ++ } + + slot = &mvi->slot_info[tag]; + +@@ -860,7 +869,7 @@ int mvs_queue_command(struct sas_task *task, gfp_t gfp_flags) + static void mvs_slot_free(struct mvs_info *mvi, u32 rx_desc) + { + u32 slot_idx = rx_desc & RXQ_SLOT_MASK; +- mvs_tag_clear(mvi, slot_idx); ++ mvs_tag_free(mvi, slot_idx); + } + + static void mvs_slot_task_free(struct mvs_info *mvi, struct sas_task *task, +diff --git a/drivers/scsi/mvsas/mv_sas.h b/drivers/scsi/mvsas/mv_sas.h +index 8dd30f8b478ec..cba6e7667a7ba 100644 +--- a/drivers/scsi/mvsas/mv_sas.h ++++ b/drivers/scsi/mvsas/mv_sas.h +@@ -370,8 +370,7 @@ struct mvs_info { + u32 chip_id; + const struct mvs_chip_info *chip; + +- int tags_num; +- unsigned long *tags; ++ unsigned long *rsvd_tags; + /* further per-slot information */ + struct mvs_phy phy[MVS_MAX_PHYS]; + struct mvs_port port[MVS_MAX_PHYS]; +@@ -424,10 +423,6 @@ struct mvs_task_exec_info { + + /******************** function prototype *********************/ + void mvs_get_sas_addr(void *buf, u32 buflen); +-void mvs_tag_clear(struct mvs_info *mvi, u32 tag); +-void mvs_tag_free(struct mvs_info *mvi, u32 tag); +-void mvs_tag_set(struct mvs_info *mvi, unsigned int tag); +-int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out); + void mvs_iounmap(void __iomem *regs); + int mvs_ioremap(struct mvs_info *mvi, int bar, int bar_ex); + void mvs_phys_reset(struct mvs_info *mvi, u32 phy_mask, int hard); +-- +2.51.0 + diff --git a/queue-5.15/series b/queue-5.15/series index be04cdac6e..badb1c3363 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -120,3 +120,46 @@ usb-cdns3-cdnsp-pci-remove-redundant-pci_disable_device-call.patch fs-always-return-zero-on-success-from-replace_fd.patch clocksource-drivers-clps711x-fix-resource-leaks-in-error-paths.patch iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch +perf-evsel-avoid-container_of-on-a-null-leader.patch +libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch +clk-at91-peripheral-fix-return-value.patch +perf-util-fix-compression-checks-returning-1-as-bool.patch +rtc-x1205-fix-xicor-x1205-vendor-prefix.patch +perf-arm-spe-save-context-id-in-record.patch +perf-arm-spe-use-spe-data-source-for-neoverse-cores.patch +perf-arm_spe-correct-setting-remote-access.patch +perf-arm-spe-augment-the-data-source-type-with-neove.patch +perf-arm-spe-refactor-arm-spe-to-support-operation-p.patch +perf-arm-spe-rename-the-common-data-source-encoding.patch +perf-arm_spe-correct-memory-level-for-remote-access.patch +perf-session-fix-handling-when-buffer-exceeds-2-gib.patch +perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch +clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch +clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch +cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch +scsi-libsas-add-sas_task_find_rq.patch +scsi-mvsas-delete-mvs_tag_init.patch +scsi-mvsas-use-sas_task_find_rq-for-tagging.patch +scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch +net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch +s390-cio-unregister-the-subchannel-while-purging.patch +s390-cio-update-purge-function-to-unregister-the-unu.patch +drm-vmwgfx-copy-drm-hash-table-code-into-driver.patch +drm-vmwgfx-fix-use-after-free-in-validation.patch +net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch +tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch +net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch +tools-build-align-warning-options-with-perf.patch +mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch +mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch +bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch +drm-amdgpu-add-additional-dce6-scl-registers.patch +drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch +drm-amd-display-properly-clear-scl_-_filter_control-.patch +drm-amd-display-properly-disable-scaling-on-dce6.patch +bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch +crypto-essiv-check-ssize-for-decryption-and-in-place.patch +tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch +gpio-wcd934x-remove-duplicate-assignment-of-of_gpio_.patch +gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch +bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch diff --git a/queue-5.15/tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch b/queue-5.15/tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch new file mode 100644 index 0000000000..a167aaad97 --- /dev/null +++ b/queue-5.15/tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch @@ -0,0 +1,87 @@ +From c13e5146f0632f83abaf551fd0dd6df0f70d6ccd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 23:37:54 +0000 +Subject: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). + +From: Kuniyuki Iwashima + +[ Upstream commit 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c ] + +syzbot reported the splat below in tcp_conn_request(). [0] + +If a listener is close()d while a TFO socket is being processed in +tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk +and calls inet_child_forget(), which calls tcp_disconnect() for the +TFO socket. + +After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), +where reqsk_put() is called due to !reqsk->sk. + +Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the +last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the +drop_and_free label causes the refcount underflow for the listener +and double-free of the reqsk. + +Let's remove reqsk_fastopen_remove() in tcp_conn_request(). + +Note that other callers make sure tp->fastopen_rsk is not NULL. + +[0]: +refcount_t: underflow; use-after-free. +WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) +Modules linked in: +CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 +RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) +Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 +RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 +RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 +RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280 +RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 +R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 +R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8 +FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0 +Call Trace: + + tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) + tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) + tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) + tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) + ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) + ip6_input (net/ipv6/ip6_input.c:500) + ipv6_rcv (net/ipv6/ip6_input.c:311) + __netif_receive_skb (net/core/dev.c:6104) + process_backlog (net/core/dev.c:6456) + __napi_poll (net/core/dev.c:7506) + net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) + handle_softirqs (kernel/softirq.c:579) + do_softirq (kernel/softirq.c:480) + + +Fixes: 45c8a6cc2bcd ("tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().") +Reported-by: syzkaller +Signed-off-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20251001233755.1340927-1-kuniyu@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index fea019cc92d3c..15548dc3cc5c5 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -7060,7 +7060,6 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, + &foc, TCP_SYNACK_FASTOPEN, skb); + /* Add the child socket directly into the accept queue */ + if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) { +- reqsk_fastopen_remove(fastopen_sk, req, false); + bh_unlock_sock(fastopen_sk); + sock_put(fastopen_sk); + goto drop_and_free; +-- +2.51.0 + diff --git a/queue-5.15/tools-build-align-warning-options-with-perf.patch b/queue-5.15/tools-build-align-warning-options-with-perf.patch new file mode 100644 index 0000000000..491cb6ffc1 --- /dev/null +++ b/queue-5.15/tools-build-align-warning-options-with-perf.patch @@ -0,0 +1,62 @@ +From d02b22d79cb5eae6e93ec260e8de9504d40b5848 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Oct 2025 17:21:23 +0100 +Subject: tools build: Align warning options with perf + +From: Leo Yan + +[ Upstream commit 53d067feb8c4f16d1f24ce3f4df4450bb18c555f ] + +The feature test programs are built without enabling '-Wall -Werror' +options. As a result, a feature may appear to be available, but later +building in perf can fail with stricter checks. + +Make the feature test program use the same warning options as perf. + +Fixes: 1925459b4d92 ("tools build: Fix feature Makefile issues with 'O='") +Signed-off-by: Leo Yan +Reviewed-by: Ian Rogers +Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-1-4305590795b2@arm.com +Cc: Palmer Dabbelt +Cc: Albert Ou +Cc: Alexandre Ghiti +Cc: Nick Desaulniers +Cc: Justin Stitt +Cc: Bill Wendling +Cc: Adrian Hunter +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Nathan Chancellor +Cc: James Clark +Cc: linux-riscv@lists.infradead.org +Cc: llvm@lists.linux.dev +Cc: Paul Walmsley +Cc: linux-kernel@vger.kernel.org +Cc: linux-perf-users@vger.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/build/feature/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile +index aa3b0d75e44b7..37aa85a81e0a0 100644 +--- a/tools/build/feature/Makefile ++++ b/tools/build/feature/Makefile +@@ -268,10 +268,10 @@ $(OUTPUT)test-libbabeltrace.bin: + $(BUILD) # -lbabeltrace provided by $(FEATURE_CHECK_LDFLAGS-libbabeltrace) + + $(OUTPUT)test-compile-32.bin: +- $(CC) -m32 -o $@ test-compile.c ++ $(CC) -m32 -Wall -Werror -o $@ test-compile.c + + $(OUTPUT)test-compile-x32.bin: +- $(CC) -mx32 -o $@ test-compile.c ++ $(CC) -mx32 -Wall -Werror -o $@ test-compile.c + + $(OUTPUT)test-zlib.bin: + $(BUILD) -lz +-- +2.51.0 + diff --git a/queue-5.15/tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch b/queue-5.15/tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch new file mode 100644 index 0000000000..78111774a3 --- /dev/null +++ b/queue-5.15/tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch @@ -0,0 +1,42 @@ +From 193e0180c608ccf9700552e3f642b1f138a38f4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 18:49:40 +0300 +Subject: tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single + +From: Gunnar Kudrjavets + +[ Upstream commit 8a81236f2cb0882c7ea6c621ce357f7f3f601fe5 ] + +The tpm_tis_write8() call specifies arguments in wrong order. Should be +(data, addr, value) not (data, value, addr). The initial correct order +was changed during the major refactoring when the code was split. + +Fixes: 41a5e1cf1fe1 ("tpm/tpm_tis: Split tpm_tis driver into a core and TCG TIS compliant phy") +Signed-off-by: Gunnar Kudrjavets +Reviewed-by: Justinien Bouron +Reviewed-by: Jarkko Sakkinen +Reviewed-by: Paul Menzel +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index b3452259d6e0b..c8c68301543b2 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -831,8 +831,8 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, + * will call disable_irq which undoes all of the above. + */ + if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) { +- tpm_tis_write8(priv, original_int_vec, +- TPM_INT_VECTOR(priv->locality)); ++ tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), ++ original_int_vec); + rc = -1; + } + +-- +2.51.0 + diff --git a/queue-5.4/clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch b/queue-5.4/clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch new file mode 100644 index 0000000000..afa33ae8bd --- /dev/null +++ b/queue-5.4/clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch @@ -0,0 +1,50 @@ +From 9e1b4edc6b181870c737fdde49a413ce6dbdee1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Jul 2025 13:11:55 -0700 +Subject: clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver + +From: Alok Tiwari + +[ Upstream commit 1624dead9a4d288a594fdf19735ebfe4bb567cb8 ] + +The conditional check for the PLL0 multiplier 'm' used a logical AND +instead of OR, making the range check ineffective. This patch replaces +&& with || to correctly reject invalid values of 'm' that are either +less than or equal to 0 or greater than LPC18XX_PLL0_MSEL_MAX. + +This ensures proper bounds checking during clk rate setting and rounding. + +Fixes: b04e0b8fd544 ("clk: add lpc18xx cgu clk driver") +Signed-off-by: Alok Tiwari +[sboyd@kernel.org: 'm' is unsigned so remove < condition] +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/nxp/clk-lpc18xx-cgu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c +index 44e07a3c253b9..ab8741fe57c99 100644 +--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c ++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c +@@ -385,7 +385,7 @@ static int lpc18xx_pll0_determine_rate(struct clk_hw *hw, + } + + m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2); +- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { ++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) { + pr_warn("%s: unable to support rate %lu\n", __func__, req->rate); + return -EINVAL; + } +@@ -408,7 +408,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, + } + + m = DIV_ROUND_UP_ULL(parent_rate, rate * 2); +- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { ++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) { + pr_warn("%s: unable to support rate %lu\n", __func__, rate); + return -EINVAL; + } +-- +2.51.0 + diff --git a/queue-5.4/clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch b/queue-5.4/clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch new file mode 100644 index 0000000000..42873aa0b4 --- /dev/null +++ b/queue-5.4/clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch @@ -0,0 +1,68 @@ +From 5054d771cfe4c1720e1e3de4e40227ad1a20cd95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 11:18:29 -0400 +Subject: clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() + +From: Brian Masney + +[ Upstream commit b46a3d323a5b7942e65025254c13801d0f475f02 ] + +The round_rate() clk ops is deprecated, so migrate this driver from +round_rate() to determine_rate() using the Coccinelle semantic patch +on the cover letter of this series. + +Signed-off-by: Brian Masney +Stable-dep-of: 1624dead9a4d ("clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver") +Signed-off-by: Sasha Levin +--- + drivers/clk/nxp/clk-lpc18xx-cgu.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c +index 8b686da5577b3..44e07a3c253b9 100644 +--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c ++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c +@@ -374,23 +374,25 @@ static unsigned long lpc18xx_pll0_recalc_rate(struct clk_hw *hw, + return 0; + } + +-static long lpc18xx_pll0_round_rate(struct clk_hw *hw, unsigned long rate, +- unsigned long *prate) ++static int lpc18xx_pll0_determine_rate(struct clk_hw *hw, ++ struct clk_rate_request *req) + { + unsigned long m; + +- if (*prate < rate) { ++ if (req->best_parent_rate < req->rate) { + pr_warn("%s: pll dividers not supported\n", __func__); + return -EINVAL; + } + +- m = DIV_ROUND_UP_ULL(*prate, rate * 2); ++ m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2); + if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { +- pr_warn("%s: unable to support rate %lu\n", __func__, rate); ++ pr_warn("%s: unable to support rate %lu\n", __func__, req->rate); + return -EINVAL; + } + +- return 2 * *prate * m; ++ req->rate = 2 * req->best_parent_rate * m; ++ ++ return 0; + } + + static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, +@@ -447,7 +449,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, + + static const struct clk_ops lpc18xx_pll0_ops = { + .recalc_rate = lpc18xx_pll0_recalc_rate, +- .round_rate = lpc18xx_pll0_round_rate, ++ .determine_rate = lpc18xx_pll0_determine_rate, + .set_rate = lpc18xx_pll0_set_rate, + }; + +-- +2.51.0 + diff --git a/queue-5.4/crypto-essiv-check-ssize-for-decryption-and-in-place.patch b/queue-5.4/crypto-essiv-check-ssize-for-decryption-and-in-place.patch new file mode 100644 index 0000000000..5ebb5523c0 --- /dev/null +++ b/queue-5.4/crypto-essiv-check-ssize-for-decryption-and-in-place.patch @@ -0,0 +1,63 @@ +From bbdfece1925e6400915ab7b866343aef550e8d36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 15:54:20 +0800 +Subject: crypto: essiv - Check ssize for decryption and in-place encryption + +From: Herbert Xu + +[ Upstream commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f ] + +Move the ssize check to the start in essiv_aead_crypt so that +it's also checked for decryption and in-place encryption. + +Reported-by: Muhammad Alifa Ramdhan +Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation") +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/essiv.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/crypto/essiv.c b/crypto/essiv.c +index aa6b89e91ac80..8a74cc34ac50a 100644 +--- a/crypto/essiv.c ++++ b/crypto/essiv.c +@@ -203,9 +203,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) + const struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm); + struct essiv_aead_request_ctx *rctx = aead_request_ctx(req); + struct aead_request *subreq = &rctx->aead_req; ++ int ivsize = crypto_aead_ivsize(tfm); ++ int ssize = req->assoclen - ivsize; + struct scatterlist *src = req->src; + int err; + ++ if (ssize < 0) ++ return -EINVAL; ++ + crypto_cipher_encrypt_one(tctx->essiv_cipher, req->iv, req->iv); + + /* +@@ -215,19 +220,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) + */ + rctx->assoc = NULL; + if (req->src == req->dst || !enc) { +- scatterwalk_map_and_copy(req->iv, req->dst, +- req->assoclen - crypto_aead_ivsize(tfm), +- crypto_aead_ivsize(tfm), 1); ++ scatterwalk_map_and_copy(req->iv, req->dst, ssize, ivsize, 1); + } else { + u8 *iv = (u8 *)aead_request_ctx(req) + tctx->ivoffset; +- int ivsize = crypto_aead_ivsize(tfm); +- int ssize = req->assoclen - ivsize; + struct scatterlist *sg; + int nents; + +- if (ssize < 0) +- return -EINVAL; +- + nents = sg_nents_for_len(req->src, ssize); + if (nents < 0) + return -EINVAL; +-- +2.51.0 + diff --git a/queue-5.4/drm-vmwgfx-fix-use-after-free-in-validation.patch b/queue-5.4/drm-vmwgfx-fix-use-after-free-in-validation.patch new file mode 100644 index 0000000000..e08d6badaa --- /dev/null +++ b/queue-5.4/drm-vmwgfx-fix-use-after-free-in-validation.patch @@ -0,0 +1,44 @@ +From eaae681910c1c0ffbd9521cea815ab51ec5bada6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 14:54:25 -0500 +Subject: drm/vmwgfx: Fix Use-after-free in validation + +From: Ian Forbes + +[ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ] + +Nodes stored in the validation duplicates hashtable come from an arena +allocator that is cleared at the end of vmw_execbuf_process. All nodes +are expected to be cleared in vmw_validation_drop_ht but this node escaped +because its resource was destroyed prematurely. + +Fixes: 64ad2abfe9a6 ("drm/vmwgfx: Adapt validation code for reference-free lookups") +Reported-by: Kuzey Arda Bulut +Signed-off-by: Ian Forbes +Reviewed-by: Zack Rusin +Signed-off-by: Zack Rusin +Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +index f611b2290a1b9..a18b9bb0631c2 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +@@ -339,8 +339,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx, + } + } + node->res = vmw_resource_reference_unless_doomed(res); +- if (!node->res) ++ if (!node->res) { ++ hash_del_rcu(&node->hash.head); + return -ESRCH; ++ } + + node->first_usage = 1; + if (!res->dev_priv->has_mob) { +-- +2.51.0 + diff --git a/queue-5.4/mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch b/queue-5.4/mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch new file mode 100644 index 0000000000..1c20502ade --- /dev/null +++ b/queue-5.4/mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch @@ -0,0 +1,48 @@ +From dea19fe54d0969037c134b8fe9583ab1324f829b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 13:07:21 +0530 +Subject: mailbox: zynqmp-ipi: Remove dev.parent check in + zynqmp_ipi_free_mboxes + +From: Harini T + +[ Upstream commit 019e3f4550fc7d319a7fd03eff487255f8e8aecd ] + +The ipi_mbox->dev.parent check is unreliable proxy for registration +status as it fails to protect against probe failures that occur after +the parent is assigned but before device_register() completes. + +device_is_registered() is the canonical and robust method to verify the +registration status. + +Remove ipi_mbox->dev.parent check in zynqmp_ipi_free_mboxes(). + +Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") +Signed-off-by: Harini T +Reviewed-by: Peng Fan +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/zynqmp-ipi-mailbox.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c +index 8395f4013b111..dcabf38859ec5 100644 +--- a/drivers/mailbox/zynqmp-ipi-mailbox.c ++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c +@@ -618,10 +618,8 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) + i = pdata->num_mboxes; + for (; i >= 0; i--) { + ipi_mbox = &pdata->ipi_mboxes[i]; +- if (ipi_mbox->dev.parent) { +- if (device_is_registered(&ipi_mbox->dev)) +- device_unregister(&ipi_mbox->dev); +- } ++ if (device_is_registered(&ipi_mbox->dev)) ++ device_unregister(&ipi_mbox->dev); + } + } + +-- +2.51.0 + diff --git a/queue-5.4/mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch b/queue-5.4/mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch new file mode 100644 index 0000000000..6764b54786 --- /dev/null +++ b/queue-5.4/mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch @@ -0,0 +1,43 @@ +From e8c1b50298779ff0cce6f54da36ff803efdbdf90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 13:07:20 +0530 +Subject: mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() + call + +From: Harini T + +[ Upstream commit 341867f730d3d3bb54491ee64e8b1a0c446656e7 ] + +The controller is registered using the device-managed function +'devm_mbox_controller_register()'. As documented in mailbox.c, this +ensures the devres framework automatically calls +mbox_controller_unregister() when device_unregister() is invoked, making +the explicit call unnecessary. + +Remove redundant mbox_controller_unregister() call as +device_unregister() handles controller cleanup. + +Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") +Signed-off-by: Harini T +Reviewed-by: Peng Fan +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/zynqmp-ipi-mailbox.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c +index bb7bb17386475..8395f4013b111 100644 +--- a/drivers/mailbox/zynqmp-ipi-mailbox.c ++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c +@@ -619,7 +619,6 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) + for (; i >= 0; i--) { + ipi_mbox = &pdata->ipi_mboxes[i]; + if (ipi_mbox->dev.parent) { +- mbox_controller_unregister(&ipi_mbox->mbox); + if (device_is_registered(&ipi_mbox->dev)) + device_unregister(&ipi_mbox->dev); + } +-- +2.51.0 + diff --git a/queue-5.4/net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch b/queue-5.4/net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch new file mode 100644 index 0000000000..642b9369ef --- /dev/null +++ b/queue-5.4/net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch @@ -0,0 +1,41 @@ +From ad2144886156e22740f4425dc7632427e6965f13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 20:46:17 +0300 +Subject: net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe + +From: Erick Karanja + +[ Upstream commit 521405cb54cd2812bbb6dedd5afc14bca1e7e98a ] + +Add missing of_node_put call to release device node tbi obtained +via for_each_child_of_node. + +Fixes: afae5ad78b342 ("net/fsl_pq_mdio: streamline probing of MDIO nodes") +Signed-off-by: Erick Karanja +Link: https://patch.msgid.link/20251002174617.960521-1-karanja99erick@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c +index c6481bd612390..565a8bfe5692a 100644 +--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c ++++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c +@@ -482,10 +482,12 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev) + "missing 'reg' property in node %pOF\n", + tbi); + err = -EBUSY; ++ of_node_put(tbi); + goto error; + } + set_tbipa(*prop, pdev, + data->get_tbipa, priv->map, &res); ++ of_node_put(tbi); + } + } + +-- +2.51.0 + diff --git a/queue-5.4/net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch b/queue-5.4/net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch new file mode 100644 index 0000000000..7266c377e4 --- /dev/null +++ b/queue-5.4/net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch @@ -0,0 +1,41 @@ +From b79d06ead324a1922516550c35cab532f5b3a832 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 15:25:01 +0300 +Subject: net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() + +From: Dan Carpenter + +[ Upstream commit 4f0d91ba72811fd5dd577bcdccd7fed649aae62c ] + +Print "entry->mac" before freeing "entry". The "entry" pointer is +freed with kfree_rcu() so it's unlikely that we would trigger this +in real life, but it's safer to re-order it. + +Fixes: cc5387f7346a ("net/mlx4_en: Add unicast MAC filtering") +Signed-off-by: Dan Carpenter +Reviewed-by: Tariq Toukan +Link: https://patch.msgid.link/aNvMHX4g8RksFFvV@stanley.mountain +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +index 91334229c1205..545658afb4f5c 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +@@ -1175,9 +1175,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv, + mlx4_unregister_mac(mdev->dev, priv->port, mac); + + hlist_del_rcu(&entry->hlist); +- kfree_rcu(entry, rcu); + en_dbg(DRV, priv, "Removed MAC %pM on port:%d\n", + entry->mac, priv->port); ++ kfree_rcu(entry, rcu); + ++removed; + } + } +-- +2.51.0 + diff --git a/queue-5.4/net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch b/queue-5.4/net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch new file mode 100644 index 0000000000..f6ddada16f --- /dev/null +++ b/queue-5.4/net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch @@ -0,0 +1,42 @@ +From 3fc1663366503c62cdc919f1657f0db1dfa4fd5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 12:14:47 +0300 +Subject: net/sctp: fix a null dereference in sctp_disposition + sctp_sf_do_5_1D_ce() + +From: Alexandr Sapozhnikov + +[ Upstream commit 2f3119686ef50319490ccaec81a575973da98815 ] + +If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 +and sctp_ulpevent_make_authkey() returns 0, then the variable +ai_ev remains zero and the zero will be dereferenced +in the sctp_ulpevent_free() function. + +Signed-off-by: Alexandr Sapozhnikov +Acked-by: Xin Long +Fixes: 30f6ebf65bc4 ("sctp: add SCTP_AUTH_NO_AUTH type for AUTHENTICATION_EVENT") +Link: https://patch.msgid.link/20251002091448.11-1-alsp705@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sctp/sm_statefuns.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index 6b613569372a0..9c714a6c93076 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -873,7 +873,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net, + return SCTP_DISPOSITION_CONSUME; + + nomem_authev: +- sctp_ulpevent_free(ai_ev); ++ if (ai_ev) ++ sctp_ulpevent_free(ai_ev); + nomem_aiev: + sctp_ulpevent_free(ev); + nomem_ev: +-- +2.51.0 + diff --git a/queue-5.4/perf-session-fix-handling-when-buffer-exceeds-2-gib.patch b/queue-5.4/perf-session-fix-handling-when-buffer-exceeds-2-gib.patch new file mode 100644 index 0000000000..3287a81fcd --- /dev/null +++ b/queue-5.4/perf-session-fix-handling-when-buffer-exceeds-2-gib.patch @@ -0,0 +1,53 @@ +From feba4e9ccd6b4577192b167f7a9b9b6f59255440 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Aug 2025 14:24:40 +0100 +Subject: perf session: Fix handling when buffer exceeds 2 GiB +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leo Yan + +[ Upstream commit c17dda8013495d8132c976cbf349be9949d0fbd1 ] + +If a user specifies an AUX buffer larger than 2 GiB, the returned size +may exceed 0x80000000. Since the err variable is defined as a signed +32-bit integer, such a value overflows and becomes negative. + +As a result, the perf record command reports an error: + + 0x146e8 [0x30]: failed to process type: 71 [Unknown error 183711232] + +Change the type of the err variable to a signed 64-bit integer to +accommodate large buffer sizes correctly. + +Fixes: d5652d865ea734a1 ("perf session: Add ability to skip 4GiB or more") +Reported-by: Tamas Zsoldos +Signed-off-by: Leo Yan +Acked-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Jiri Olsa +Link: https://lore.kernel.org/r/20250808-perf_fix_big_buffer_size-v1-1-45f45444a9a4@arm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/session.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c +index 01e15b445cb58..cd60a878752f2 100644 +--- a/tools/perf/util/session.c ++++ b/tools/perf/util/session.c +@@ -1504,7 +1504,7 @@ static s64 perf_session__process_user_event(struct perf_session *session, + struct perf_tool *tool = session->tool; + struct perf_sample sample = { .time = 0, }; + int fd = perf_data__fd(session->data); +- int err; ++ s64 err; + + if (event->header.type != PERF_RECORD_COMPRESSED || + tool->compressed == perf_session__process_compressed_event_stub) +-- +2.51.0 + diff --git a/queue-5.4/perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch b/queue-5.4/perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch new file mode 100644 index 0000000000..b90e8cd48a --- /dev/null +++ b/queue-5.4/perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch @@ -0,0 +1,202 @@ +From d9e2c984129ee2f288d5f86682143dc9665b33c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 15:22:00 -0700 +Subject: perf test: Don't leak workload gopipe in PERF_RECORD_* + +From: Ian Rogers + +[ Upstream commit 48918cacefd226af44373e914e63304927c0e7dc ] + +The test starts a workload and then opens events. If the events fail +to open, for example because of perf_event_paranoid, the gopipe of the +workload is leaked and the file descriptor leak check fails when the +test exits. To avoid this cancel the workload when opening the events +fails. + +Before: +``` +$ perf test -vv 7 + 7: PERF_RECORD_* events & perf_sample fields: + --- start --- +test child forked, pid 1189568 +Using CPUID GenuineIntel-6-B7-1 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 +sys_perf_event_open failed, error -13 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + exclude_kernel 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 +sys_perf_event_open failed, error -13 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + exclude_kernel 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3 +Attempt to add: software/cpu-clock/ +..after resolving event: software/config=0/ +cpu-clock -> software/cpu-clock/ + ------------------------------------------------------------ +perf_event_attr: + type 1 (PERF_TYPE_SOFTWARE) + size 136 + config 0x9 (PERF_COUNT_SW_DUMMY) + sample_type IP|TID|TIME|CPU + read_format ID|LOST + disabled 1 + inherit 1 + mmap 1 + comm 1 + enable_on_exec 1 + task 1 + sample_id_all 1 + mmap2 1 + comm_exec 1 + ksymbol 1 + bpf_event 1 + { wakeup_events, wakeup_watermark } 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 1189569 cpu 0 group_fd -1 flags 0x8 +sys_perf_event_open failed, error -13 +perf_evlist__open: Permission denied + ---- end(-2) ---- +Leak of file descriptor 6 that opened: 'pipe:[14200347]' + ---- unexpected signal (6) ---- +iFailed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon + #0 0x565358f6666e in child_test_sig_handler builtin-test.c:311 + #1 0x7f29ce849df0 in __restore_rt libc_sigaction.c:0 + #2 0x7f29ce89e95c in __pthread_kill_implementation pthread_kill.c:44 + #3 0x7f29ce849cc2 in raise raise.c:27 + #4 0x7f29ce8324ac in abort abort.c:81 + #5 0x565358f662d4 in check_leaks builtin-test.c:226 + #6 0x565358f6682e in run_test_child builtin-test.c:344 + #7 0x565358ef7121 in start_command run-command.c:128 + #8 0x565358f67273 in start_test builtin-test.c:545 + #9 0x565358f6771d in __cmd_test builtin-test.c:647 + #10 0x565358f682bd in cmd_test builtin-test.c:849 + #11 0x565358ee5ded in run_builtin perf.c:349 + #12 0x565358ee6085 in handle_internal_command perf.c:401 + #13 0x565358ee61de in run_argv perf.c:448 + #14 0x565358ee6527 in main perf.c:555 + #15 0x7f29ce833ca8 in __libc_start_call_main libc_start_call_main.h:74 + #16 0x7f29ce833d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128 + #17 0x565358e391c1 in _start perf[851c1] + 7: PERF_RECORD_* events & perf_sample fields : FAILED! +``` + +After: +``` +$ perf test 7 + 7: PERF_RECORD_* events & perf_sample fields : Skip (permissions) +``` + +Fixes: 16d00fee703866c6 ("perf tests: Move test__PERF_RECORD into separate object") +Signed-off-by: Ian Rogers +Tested-by: Arnaldo Carvalho de Melo +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Chun-Tse Shao +Cc: Howard Chu +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/perf-record.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/tools/perf/tests/perf-record.c b/tools/perf/tests/perf-record.c +index 437426be29e99..21c4169d0c9d0 100644 +--- a/tools/perf/tests/perf-record.c ++++ b/tools/perf/tests/perf-record.c +@@ -114,6 +114,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus + if (err < 0) { + pr_debug("sched__get_first_possible_cpu: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +@@ -125,6 +126,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus + if (sched_setaffinity(evlist->workload.pid, cpu_mask_size, &cpu_mask) < 0) { + pr_debug("sched_setaffinity: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +@@ -136,6 +138,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus + if (err < 0) { + pr_debug("perf_evlist__open: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +@@ -148,6 +151,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus + if (err < 0) { + pr_debug("evlist__mmap: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +-- +2.51.0 + diff --git a/queue-5.4/perf-util-fix-compression-checks-returning-1-as-bool.patch b/queue-5.4/perf-util-fix-compression-checks-returning-1-as-bool.patch new file mode 100644 index 0000000000..f9fad3c647 --- /dev/null +++ b/queue-5.4/perf-util-fix-compression-checks-returning-1-as-bool.patch @@ -0,0 +1,67 @@ +From b20ce115c67d98132897386acb7406397e20e20a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 16:25:08 +0000 +Subject: perf util: Fix compression checks returning -1 as bool + +From: Yunseong Kim + +[ Upstream commit 43fa1141e2c1af79c91aaa4df03e436c415a6fc3 ] + +The lzma_is_compressed and gzip_is_compressed functions are declared +to return a "bool" type, but in case of an error (e.g., file open +failure), they incorrectly returned -1. + +A bool type is a boolean value that is either true or false. +Returning -1 for a bool return type can lead to unexpected behavior +and may violate strict type-checking in some compilers. + +Fix the return value to be false in error cases, ensuring the function +adheres to its declared return type improves for preventing potential +bugs related to type mismatch. + +Fixes: 4b57fd44b61beb51 ("perf tools: Add lzma_is_compressed function") +Reviewed-by: Ian Rogers +Signed-off-by: Yunseong Kim +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Namhyung Kim +Cc: Stephen Brennan +Link: https://lore.kernel.org/r/20250822162506.316844-3-ysk@kzalloc.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/lzma.c | 2 +- + tools/perf/util/zlib.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/lzma.c b/tools/perf/util/lzma.c +index 51424cdc3b682..aa9a0ebc1f937 100644 +--- a/tools/perf/util/lzma.c ++++ b/tools/perf/util/lzma.c +@@ -115,7 +115,7 @@ bool lzma_is_compressed(const char *input) + ssize_t rc; + + if (fd < 0) +- return -1; ++ return false; + + rc = read(fd, buf, sizeof(buf)); + close(fd); +diff --git a/tools/perf/util/zlib.c b/tools/perf/util/zlib.c +index 78d2297c1b674..1f7c065230599 100644 +--- a/tools/perf/util/zlib.c ++++ b/tools/perf/util/zlib.c +@@ -88,7 +88,7 @@ bool gzip_is_compressed(const char *input) + ssize_t rc; + + if (fd < 0) +- return -1; ++ return false; + + rc = read(fd, buf, sizeof(buf)); + close(fd); +-- +2.51.0 + diff --git a/queue-5.4/rtc-x1205-fix-xicor-x1205-vendor-prefix.patch b/queue-5.4/rtc-x1205-fix-xicor-x1205-vendor-prefix.patch new file mode 100644 index 0000000000..e5980bec10 --- /dev/null +++ b/queue-5.4/rtc-x1205-fix-xicor-x1205-vendor-prefix.patch @@ -0,0 +1,39 @@ +From 3e9e786d0d7a2954da92a283ea5bdc8cb711e8fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 16:57:02 -0500 +Subject: rtc: x1205: Fix Xicor X1205 vendor prefix + +From: Rob Herring (Arm) + +[ Upstream commit 606d19ee37de3a72f1b6e95a4ea544f6f20dbb46 ] + +The vendor for the X1205 RTC is not Xircom, but Xicor which was acquired +by Intersil. Since the I2C subsystem drops the vendor prefix for driver +matching, the vendor prefix hasn't mattered. + +Fixes: 6875404fdb44 ("rtc: x1205: Add DT probing support") +Signed-off-by: Rob Herring (Arm) +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20250821215703.869628-2-robh@kernel.org +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-x1205.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-x1205.c b/drivers/rtc/rtc-x1205.c +index d1d5a44d9122a..3b3aaa7d8283c 100644 +--- a/drivers/rtc/rtc-x1205.c ++++ b/drivers/rtc/rtc-x1205.c +@@ -671,7 +671,7 @@ static const struct i2c_device_id x1205_id[] = { + MODULE_DEVICE_TABLE(i2c, x1205_id); + + static const struct of_device_id x1205_dt_ids[] = { +- { .compatible = "xircom,x1205", }, ++ { .compatible = "xicor,x1205", }, + {}, + }; + MODULE_DEVICE_TABLE(of, x1205_dt_ids); +-- +2.51.0 + diff --git a/queue-5.4/scsi-libsas-add-sas_task_find_rq.patch b/queue-5.4/scsi-libsas-add-sas_task_find_rq.patch new file mode 100644 index 0000000000..5d9ee64abb --- /dev/null +++ b/queue-5.4/scsi-libsas-add-sas_task_find_rq.patch @@ -0,0 +1,59 @@ +From 7126251637f06db0cf2ad4071f8cf8f7a3f6c73c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 19:15:57 +0800 +Subject: scsi: libsas: Add sas_task_find_rq() + +From: John Garry + +[ Upstream commit a9ee3f840646e2ec419c734e592ffe997195435e ] + +blk-mq already provides a unique tag per request. Some libsas LLDDs - like +hisi_sas - already use this tag as the unique per-I/O HW tag. + +Add a common function to provide the request associated with a sas_task for +all libsas LLDDs. + +Signed-off-by: John Garry +Link: https://lore.kernel.org/r/1666091763-11023-2-git-send-email-john.garry@huawei.com +Reviewed-by: Jack Wang +Reviewed-by: Jason Yan +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue") +Signed-off-by: Sasha Levin +--- + include/scsi/libsas.h | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h +index 4e2d61e8fb1ed..8461fad88a119 100644 +--- a/include/scsi/libsas.h ++++ b/include/scsi/libsas.h +@@ -620,6 +620,24 @@ extern struct sas_task *sas_alloc_task(gfp_t flags); + extern struct sas_task *sas_alloc_slow_task(gfp_t flags); + extern void sas_free_task(struct sas_task *task); + ++static inline struct request *sas_task_find_rq(struct sas_task *task) ++{ ++ struct scsi_cmnd *scmd; ++ ++ if (task->task_proto & SAS_PROTOCOL_STP_ALL) { ++ struct ata_queued_cmd *qc = task->uldd_task; ++ ++ scmd = qc ? qc->scsicmd : NULL; ++ } else { ++ scmd = task->uldd_task; ++ } ++ ++ if (!scmd) ++ return NULL; ++ ++ return scsi_cmd_to_rq(scmd); ++} ++ + struct sas_domain_function_template { + /* The class calls these to notify the LLDD of an event. */ + void (*lldd_port_formed)(struct asd_sas_phy *); +-- +2.51.0 + diff --git a/queue-5.4/scsi-mvsas-delete-mvs_tag_init.patch b/queue-5.4/scsi-mvsas-delete-mvs_tag_init.patch new file mode 100644 index 0000000000..16c3fe2b18 --- /dev/null +++ b/queue-5.4/scsi-mvsas-delete-mvs_tag_init.patch @@ -0,0 +1,72 @@ +From e56f1ccb66b5b3d18eeee2b3e8301ae4d2e045a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 19:16:02 +0800 +Subject: scsi: mvsas: Delete mvs_tag_init() + +From: John Garry + +[ Upstream commit ffc9f9bf3f14876d019f67ef17d41138802529a8 ] + +All mvs_tag_init() does is zero the tag bitmap, but this is already done +with the kzalloc() call to alloc the tags, so delete this unneeded +function. + +Signed-off-by: John Garry +Link: https://lore.kernel.org/r/1666091763-11023-7-git-send-email-john.garry@huawei.com +Reviewed-by: Damien Le Moal +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue") +Signed-off-by: Sasha Levin +--- + drivers/scsi/mvsas/mv_init.c | 2 -- + drivers/scsi/mvsas/mv_sas.c | 7 ------- + drivers/scsi/mvsas/mv_sas.h | 1 - + 3 files changed, 10 deletions(-) + +diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c +index 0c5e2c6105867..7622de9d7d8ba 100644 +--- a/drivers/scsi/mvsas/mv_init.c ++++ b/drivers/scsi/mvsas/mv_init.c +@@ -286,8 +286,6 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host *shost) + } + mvi->tags_num = slot_nr; + +- /* Initialize tags */ +- mvs_tag_init(mvi); + return 0; + err_out: + return 1; +diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c +index 68caeaf9e6369..377b931f46dcf 100644 +--- a/drivers/scsi/mvsas/mv_sas.c ++++ b/drivers/scsi/mvsas/mv_sas.c +@@ -51,13 +51,6 @@ inline int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out) + return 0; + } + +-void mvs_tag_init(struct mvs_info *mvi) +-{ +- int i; +- for (i = 0; i < mvi->tags_num; ++i) +- mvs_tag_clear(mvi, i); +-} +- + static struct mvs_info *mvs_find_dev_mvi(struct domain_device *dev) + { + unsigned long i = 0, j = 0, hi = 0; +diff --git a/drivers/scsi/mvsas/mv_sas.h b/drivers/scsi/mvsas/mv_sas.h +index 519edc796691a..6689481779343 100644 +--- a/drivers/scsi/mvsas/mv_sas.h ++++ b/drivers/scsi/mvsas/mv_sas.h +@@ -428,7 +428,6 @@ void mvs_tag_clear(struct mvs_info *mvi, u32 tag); + void mvs_tag_free(struct mvs_info *mvi, u32 tag); + void mvs_tag_set(struct mvs_info *mvi, unsigned int tag); + int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out); +-void mvs_tag_init(struct mvs_info *mvi); + void mvs_iounmap(void __iomem *regs); + int mvs_ioremap(struct mvs_info *mvi, int bar, int bar_ex); + void mvs_phys_reset(struct mvs_info *mvi, u32 phy_mask, int hard); +-- +2.51.0 + diff --git a/queue-5.4/scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch b/queue-5.4/scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch new file mode 100644 index 0000000000..9e0ca8bd98 --- /dev/null +++ b/queue-5.4/scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch @@ -0,0 +1,56 @@ +From 2edab7fc73e57be688947fb5c3b739543d0d90d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Sep 2025 21:42:01 +0800 +Subject: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue + +From: Duoming Zhou + +[ Upstream commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 ] + +During the detaching of Marvell's SAS/SATA controller, the original code +calls cancel_delayed_work() in mvs_free() to cancel the delayed work +item mwq->work_q. However, if mwq->work_q is already running, the +cancel_delayed_work() may fail to cancel it. This can lead to +use-after-free scenarios where mvs_free() frees the mvs_info while +mvs_work_queue() is still executing and attempts to access the +already-freed mvs_info. + +A typical race condition is illustrated below: + +CPU 0 (remove) | CPU 1 (delayed work callback) +mvs_pci_remove() | + mvs_free() | mvs_work_queue() + cancel_delayed_work() | + kfree(mvi) | + | mvi-> // UAF + +Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure +that the delayed work item is properly canceled and any executing +delayed work item completes before the mvs_info is deallocated. + +This bug was found by static analysis. + +Fixes: 20b09c2992fe ("[SCSI] mvsas: add support for 94xx; layout change; bug fixes") +Signed-off-by: Duoming Zhou +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mvsas/mv_init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c +index 264f32065ea7a..d0a6639c3542d 100644 +--- a/drivers/scsi/mvsas/mv_init.c ++++ b/drivers/scsi/mvsas/mv_init.c +@@ -138,7 +138,7 @@ static void mvs_free(struct mvs_info *mvi) + if (mvi->shost) + scsi_host_put(mvi->shost); + list_for_each_entry(mwq, &mvi->wq_list, entry) +- cancel_delayed_work(&mwq->work_q); ++ cancel_delayed_work_sync(&mwq->work_q); + kfree(mvi->rsvd_tags); + kfree(mvi); + } +-- +2.51.0 + diff --git a/queue-5.4/scsi-mvsas-use-sas_task_find_rq-for-tagging.patch b/queue-5.4/scsi-mvsas-use-sas_task_find_rq-for-tagging.patch new file mode 100644 index 0000000000..6cd3a335bd --- /dev/null +++ b/queue-5.4/scsi-mvsas-use-sas_task_find_rq-for-tagging.patch @@ -0,0 +1,201 @@ +From 67245162e189b5fdcfa97069aa41a632c4d0b1fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 19:16:03 +0800 +Subject: scsi: mvsas: Use sas_task_find_rq() for tagging + +From: John Garry + +[ Upstream commit 2acf97f199f9eba8321390325519e9b6bff60108 ] + +The request associated with a SCSI command coming from the block layer has +a unique tag, so use that when possible for getting a slot. + +Unfortunately we don't support reserved commands in the SCSI midlayer yet. +As such, SMP tasks - as an example - will not have a request associated, so +in the interim continue to manage those tags for that type of sas_task +internally. + +We reserve an arbitrary 4 tags for these internal tags. Indeed, we already +decrement MVS_RSVD_SLOTS by 2 for the shost can_queue when flag +MVF_FLAG_SOC is set. This change was made in commit 20b09c2992fe ("[SCSI] +mvsas: add support for 94xx; layout change; bug fixes"), but what those 2 +slots are used for is not obvious. + +Also make the tag management functions static, where possible. + +Signed-off-by: John Garry +Link: https://lore.kernel.org/r/1666091763-11023-8-git-send-email-john.garry@huawei.com +Signed-off-by: Martin K. Petersen +Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue") +Signed-off-by: Sasha Levin +--- + drivers/scsi/mvsas/mv_defs.h | 1 + + drivers/scsi/mvsas/mv_init.c | 9 +++++---- + drivers/scsi/mvsas/mv_sas.c | 35 ++++++++++++++++++++++------------- + drivers/scsi/mvsas/mv_sas.h | 7 +------ + 4 files changed, 29 insertions(+), 23 deletions(-) + +diff --git a/drivers/scsi/mvsas/mv_defs.h b/drivers/scsi/mvsas/mv_defs.h +index 199ab49aa047f..3ec1c7546cdb4 100644 +--- a/drivers/scsi/mvsas/mv_defs.h ++++ b/drivers/scsi/mvsas/mv_defs.h +@@ -40,6 +40,7 @@ enum driver_configuration { + MVS_ATA_CMD_SZ = 96, /* SATA command table buffer size */ + MVS_OAF_SZ = 64, /* Open address frame buffer size */ + MVS_QUEUE_SIZE = 64, /* Support Queue depth */ ++ MVS_RSVD_SLOTS = 4, + MVS_SOC_CAN_QUEUE = MVS_SOC_SLOTS - 2, + }; + +diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c +index 7622de9d7d8ba..264f32065ea7a 100644 +--- a/drivers/scsi/mvsas/mv_init.c ++++ b/drivers/scsi/mvsas/mv_init.c +@@ -139,7 +139,7 @@ static void mvs_free(struct mvs_info *mvi) + scsi_host_put(mvi->shost); + list_for_each_entry(mwq, &mvi->wq_list, entry) + cancel_delayed_work(&mwq->work_q); +- kfree(mvi->tags); ++ kfree(mvi->rsvd_tags); + kfree(mvi); + } + +@@ -284,7 +284,6 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host *shost) + printk(KERN_DEBUG "failed to create dma pool %s.\n", pool_name); + goto err_out; + } +- mvi->tags_num = slot_nr; + + return 0; + err_out: +@@ -368,8 +367,8 @@ static struct mvs_info *mvs_pci_alloc(struct pci_dev *pdev, + mvi->sas = sha; + mvi->shost = shost; + +- mvi->tags = kzalloc(MVS_CHIP_SLOT_SZ>>3, GFP_KERNEL); +- if (!mvi->tags) ++ mvi->rsvd_tags = bitmap_zalloc(MVS_RSVD_SLOTS, GFP_KERNEL); ++ if (!mvi->rsvd_tags) + goto err_out; + + if (MVS_CHIP_DISP->chip_ioremap(mvi)) +@@ -470,6 +469,8 @@ static void mvs_post_sas_ha_init(struct Scsi_Host *shost, + else + can_queue = MVS_CHIP_SLOT_SZ; + ++ can_queue -= MVS_RSVD_SLOTS; ++ + shost->sg_tablesize = min_t(u16, SG_ALL, MVS_MAX_SG); + shost->can_queue = can_queue; + mvi->shost->cmd_per_lun = MVS_QUEUE_SIZE; +diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c +index 377b931f46dcf..393a8ee551e4d 100644 +--- a/drivers/scsi/mvsas/mv_sas.c ++++ b/drivers/scsi/mvsas/mv_sas.c +@@ -20,31 +20,34 @@ static int mvs_find_tag(struct mvs_info *mvi, struct sas_task *task, u32 *tag) + return 0; + } + +-void mvs_tag_clear(struct mvs_info *mvi, u32 tag) ++static void mvs_tag_clear(struct mvs_info *mvi, u32 tag) + { +- void *bitmap = mvi->tags; ++ void *bitmap = mvi->rsvd_tags; + clear_bit(tag, bitmap); + } + +-void mvs_tag_free(struct mvs_info *mvi, u32 tag) ++static void mvs_tag_free(struct mvs_info *mvi, u32 tag) + { ++ if (tag >= MVS_RSVD_SLOTS) ++ return; ++ + mvs_tag_clear(mvi, tag); + } + +-void mvs_tag_set(struct mvs_info *mvi, unsigned int tag) ++static void mvs_tag_set(struct mvs_info *mvi, unsigned int tag) + { +- void *bitmap = mvi->tags; ++ void *bitmap = mvi->rsvd_tags; + set_bit(tag, bitmap); + } + +-inline int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out) ++static int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out) + { + unsigned int index, tag; +- void *bitmap = mvi->tags; ++ void *bitmap = mvi->rsvd_tags; + +- index = find_first_zero_bit(bitmap, mvi->tags_num); ++ index = find_first_zero_bit(bitmap, MVS_RSVD_SLOTS); + tag = index; +- if (tag >= mvi->tags_num) ++ if (tag >= MVS_RSVD_SLOTS) + return -SAS_QUEUE_FULL; + mvs_tag_set(mvi, tag); + *tag_out = tag; +@@ -693,6 +696,7 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf + struct mvs_task_exec_info tei; + struct mvs_slot_info *slot; + u32 tag = 0xdeadbeef, n_elem = 0; ++ struct request *rq; + int rc = 0; + + if (!dev->port) { +@@ -757,9 +761,14 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf + n_elem = task->num_scatter; + } + +- rc = mvs_tag_alloc(mvi, &tag); +- if (rc) +- goto err_out; ++ rq = sas_task_find_rq(task); ++ if (rq) { ++ tag = rq->tag + MVS_RSVD_SLOTS; ++ } else { ++ rc = mvs_tag_alloc(mvi, &tag); ++ if (rc) ++ goto err_out; ++ } + + slot = &mvi->slot_info[tag]; + +@@ -862,7 +871,7 @@ int mvs_queue_command(struct sas_task *task, gfp_t gfp_flags) + static void mvs_slot_free(struct mvs_info *mvi, u32 rx_desc) + { + u32 slot_idx = rx_desc & RXQ_SLOT_MASK; +- mvs_tag_clear(mvi, slot_idx); ++ mvs_tag_free(mvi, slot_idx); + } + + static void mvs_slot_task_free(struct mvs_info *mvi, struct sas_task *task, +diff --git a/drivers/scsi/mvsas/mv_sas.h b/drivers/scsi/mvsas/mv_sas.h +index 6689481779343..42caca5bb874a 100644 +--- a/drivers/scsi/mvsas/mv_sas.h ++++ b/drivers/scsi/mvsas/mv_sas.h +@@ -370,8 +370,7 @@ struct mvs_info { + u32 chip_id; + const struct mvs_chip_info *chip; + +- int tags_num; +- unsigned long *tags; ++ unsigned long *rsvd_tags; + /* further per-slot information */ + struct mvs_phy phy[MVS_MAX_PHYS]; + struct mvs_port port[MVS_MAX_PHYS]; +@@ -424,10 +423,6 @@ struct mvs_task_exec_info { + + /******************** function prototype *********************/ + void mvs_get_sas_addr(void *buf, u32 buflen); +-void mvs_tag_clear(struct mvs_info *mvi, u32 tag); +-void mvs_tag_free(struct mvs_info *mvi, u32 tag); +-void mvs_tag_set(struct mvs_info *mvi, unsigned int tag); +-int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out); + void mvs_iounmap(void __iomem *regs); + int mvs_ioremap(struct mvs_info *mvi, int bar, int bar_ex); + void mvs_phys_reset(struct mvs_info *mvi, u32 phy_mask, int hard); +-- +2.51.0 + diff --git a/queue-5.4/series b/queue-5.4/series index b65d8ddae9..79558d0af5 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -77,3 +77,24 @@ input-uinput-zero-initialize-uinput_ff_upload_compat-to-avoid-info-leak.patch pinctrl-check-the-return-value-of-pinmux_ops-get_function_name.patch clocksource-drivers-clps711x-fix-resource-leaks-in-error-paths.patch iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch +perf-util-fix-compression-checks-returning-1-as-bool.patch +rtc-x1205-fix-xicor-x1205-vendor-prefix.patch +perf-session-fix-handling-when-buffer-exceeds-2-gib.patch +perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch +clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch +clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch +scsi-libsas-add-sas_task_find_rq.patch +scsi-mvsas-delete-mvs_tag_init.patch +scsi-mvsas-use-sas_task_find_rq-for-tagging.patch +scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch +net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch +drm-vmwgfx-fix-use-after-free-in-validation.patch +net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch +tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch +net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch +tools-build-align-warning-options-with-perf.patch +mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch +mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch +crypto-essiv-check-ssize-for-decryption-and-in-place.patch +tpm-tpm_tis-claim-locality-before-writing-interrupt-.patch +tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch diff --git a/queue-5.4/tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch b/queue-5.4/tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch new file mode 100644 index 0000000000..96b9c52d07 --- /dev/null +++ b/queue-5.4/tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch @@ -0,0 +1,87 @@ +From 45b112b95ac78733d58540228913fc0595bf0946 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 23:37:54 +0000 +Subject: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). + +From: Kuniyuki Iwashima + +[ Upstream commit 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c ] + +syzbot reported the splat below in tcp_conn_request(). [0] + +If a listener is close()d while a TFO socket is being processed in +tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk +and calls inet_child_forget(), which calls tcp_disconnect() for the +TFO socket. + +After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), +where reqsk_put() is called due to !reqsk->sk. + +Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the +last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the +drop_and_free label causes the refcount underflow for the listener +and double-free of the reqsk. + +Let's remove reqsk_fastopen_remove() in tcp_conn_request(). + +Note that other callers make sure tp->fastopen_rsk is not NULL. + +[0]: +refcount_t: underflow; use-after-free. +WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) +Modules linked in: +CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 +RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) +Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 +RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 +RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 +RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280 +RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 +R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 +R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8 +FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0 +Call Trace: + + tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) + tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) + tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) + tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) + ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) + ip6_input (net/ipv6/ip6_input.c:500) + ipv6_rcv (net/ipv6/ip6_input.c:311) + __netif_receive_skb (net/core/dev.c:6104) + process_backlog (net/core/dev.c:6456) + __napi_poll (net/core/dev.c:7506) + net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) + handle_softirqs (kernel/softirq.c:579) + do_softirq (kernel/softirq.c:480) + + +Fixes: 45c8a6cc2bcd ("tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().") +Reported-by: syzkaller +Signed-off-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20251001233755.1340927-1-kuniyu@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 9d65e684e626c..541f9a89b4902 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -6800,7 +6800,6 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, + &foc, TCP_SYNACK_FASTOPEN); + /* Add the child socket directly into the accept queue */ + if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) { +- reqsk_fastopen_remove(fastopen_sk, req, false); + bh_unlock_sock(fastopen_sk); + sock_put(fastopen_sk); + goto drop_and_free; +-- +2.51.0 + diff --git a/queue-5.4/tools-build-align-warning-options-with-perf.patch b/queue-5.4/tools-build-align-warning-options-with-perf.patch new file mode 100644 index 0000000000..5cd9e0d7c6 --- /dev/null +++ b/queue-5.4/tools-build-align-warning-options-with-perf.patch @@ -0,0 +1,62 @@ +From ba47c78d8b540455554b51bb01061db11feb6b9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Oct 2025 17:21:23 +0100 +Subject: tools build: Align warning options with perf + +From: Leo Yan + +[ Upstream commit 53d067feb8c4f16d1f24ce3f4df4450bb18c555f ] + +The feature test programs are built without enabling '-Wall -Werror' +options. As a result, a feature may appear to be available, but later +building in perf can fail with stricter checks. + +Make the feature test program use the same warning options as perf. + +Fixes: 1925459b4d92 ("tools build: Fix feature Makefile issues with 'O='") +Signed-off-by: Leo Yan +Reviewed-by: Ian Rogers +Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-1-4305590795b2@arm.com +Cc: Palmer Dabbelt +Cc: Albert Ou +Cc: Alexandre Ghiti +Cc: Nick Desaulniers +Cc: Justin Stitt +Cc: Bill Wendling +Cc: Adrian Hunter +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Nathan Chancellor +Cc: James Clark +Cc: linux-riscv@lists.infradead.org +Cc: llvm@lists.linux.dev +Cc: Paul Walmsley +Cc: linux-kernel@vger.kernel.org +Cc: linux-perf-users@vger.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/build/feature/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile +index 8104e505efde6..f5b7b1489e1fc 100644 +--- a/tools/build/feature/Makefile ++++ b/tools/build/feature/Makefile +@@ -258,10 +258,10 @@ $(OUTPUT)test-sync-compare-and-swap.bin: + $(BUILD) + + $(OUTPUT)test-compile-32.bin: +- $(CC) -m32 -o $@ test-compile.c ++ $(CC) -m32 -Wall -Werror -o $@ test-compile.c + + $(OUTPUT)test-compile-x32.bin: +- $(CC) -mx32 -o $@ test-compile.c ++ $(CC) -mx32 -Wall -Werror -o $@ test-compile.c + + $(OUTPUT)test-zlib.bin: + $(BUILD) -lz +-- +2.51.0 + diff --git a/queue-5.4/tpm-tpm_tis-claim-locality-before-writing-interrupt-.patch b/queue-5.4/tpm-tpm_tis-claim-locality-before-writing-interrupt-.patch new file mode 100644 index 0000000000..3b90b7464c --- /dev/null +++ b/queue-5.4/tpm-tpm_tis-claim-locality-before-writing-interrupt-.patch @@ -0,0 +1,85 @@ +From 834b2e51ce026e61ffdf97111dd9b9a75707fef9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Nov 2022 14:55:29 +0100 +Subject: tpm, tpm_tis: Claim locality before writing interrupt registers + +From: Lino Sanfilippo + +[ Upstream commit 15d7aa4e46eba87242a320f39773aa16faddadee ] + +In tpm_tis_probe_single_irq() interrupt registers TPM_INT_VECTOR, +TPM_INT_STATUS and TPM_INT_ENABLE are modified to setup the interrupts. +Currently these modifications are done without holding a locality thus they +have no effect. Fix this by claiming the (default) locality before the +registers are written. + +Since now tpm_tis_gen_interrupt() is called with the locality already +claimed remove locality request and release from this function. + +Signed-off-by: Lino Sanfilippo +Tested-by: Jarkko Sakkinen +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Stable-dep-of: 8a81236f2cb0 ("tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single") +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_core.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index a084f732c1804..60f4b8b9c6f14 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -633,16 +633,10 @@ static void tpm_tis_gen_interrupt(struct tpm_chip *chip) + cap_t cap; + int ret; + +- ret = request_locality(chip, 0); +- if (ret < 0) +- return; +- + if (chip->flags & TPM_CHIP_FLAG_TPM2) + ret = tpm2_get_tpm_pt(chip, 0x100, &cap2, desc); + else + ret = tpm1_getcap(chip, TPM_CAP_PROP_TIS_TIMEOUT, &cap, desc, 0); +- +- release_locality(chip, 0); + } + + /* Register the IRQ and issue a command that will cause an interrupt. If an +@@ -665,10 +659,16 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, + } + priv->irq = irq; + ++ rc = request_locality(chip, 0); ++ if (rc < 0) ++ return rc; ++ + rc = tpm_tis_read8(priv, TPM_INT_VECTOR(priv->locality), + &original_int_vec); +- if (rc < 0) ++ if (rc < 0) { ++ release_locality(chip, priv->locality); + return rc; ++ } + + rc = tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), irq); + if (rc < 0) +@@ -702,10 +702,12 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, + if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) { + tpm_tis_write8(priv, original_int_vec, + TPM_INT_VECTOR(priv->locality)); +- return -1; ++ rc = -1; + } + +- return 0; ++ release_locality(chip, priv->locality); ++ ++ return rc; + } + + /* Try to find the IRQ the TPM is using. This is for legacy x86 systems that +-- +2.51.0 + diff --git a/queue-5.4/tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch b/queue-5.4/tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch new file mode 100644 index 0000000000..c70b6f84fb --- /dev/null +++ b/queue-5.4/tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch @@ -0,0 +1,42 @@ +From 18472f7c5fa6077fd9bfbd7d42d4c7f6a308e0e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 18:49:40 +0300 +Subject: tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single + +From: Gunnar Kudrjavets + +[ Upstream commit 8a81236f2cb0882c7ea6c621ce357f7f3f601fe5 ] + +The tpm_tis_write8() call specifies arguments in wrong order. Should be +(data, addr, value) not (data, value, addr). The initial correct order +was changed during the major refactoring when the code was split. + +Fixes: 41a5e1cf1fe1 ("tpm/tpm_tis: Split tpm_tis driver into a core and TCG TIS compliant phy") +Signed-off-by: Gunnar Kudrjavets +Reviewed-by: Justinien Bouron +Reviewed-by: Jarkko Sakkinen +Reviewed-by: Paul Menzel +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index 60f4b8b9c6f14..b538db3052b77 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -700,8 +700,8 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, + * will call disable_irq which undoes all of the above. + */ + if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) { +- tpm_tis_write8(priv, original_int_vec, +- TPM_INT_VECTOR(priv->locality)); ++ tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), ++ original_int_vec); + rc = -1; + } + +-- +2.51.0 + diff --git a/queue-6.1/bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch b/queue-6.1/bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch new file mode 100644 index 0000000000..f889b2746a --- /dev/null +++ b/queue-6.1/bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch @@ -0,0 +1,74 @@ +From d87b3c47efe09ac03b63e9164311638279c7682f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 18:26:26 +0800 +Subject: bpf: Avoid RCU context warning when unpinning htab with internal + structs + +From: KaFai Wan + +[ Upstream commit 4f375ade6aa9f37fd72d7a78682f639772089eed ] + +When unpinning a BPF hash table (htab or htab_lru) that contains internal +structures (timer, workqueue, or task_work) in its values, a BUG warning +is triggered: + BUG: sleeping function called from invalid context at kernel/bpf/hashtab.c:244 + in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 14, name: ksoftirqd/0 + ... + +The issue arises from the interaction between BPF object unpinning and +RCU callback mechanisms: +1. BPF object unpinning uses ->free_inode() which schedules cleanup via + call_rcu(), deferring the actual freeing to an RCU callback that + executes within the RCU_SOFTIRQ context. +2. During cleanup of hash tables containing internal structures, + htab_map_free_internal_structs() is invoked, which includes + cond_resched() or cond_resched_rcu() calls to yield the CPU during + potentially long operations. + +However, cond_resched() or cond_resched_rcu() cannot be safely called from +atomic RCU softirq context, leading to the BUG warning when attempting +to reschedule. + +Fix this by changing from ->free_inode() to ->destroy_inode() and rename +bpf_free_inode() to bpf_destroy_inode() for BPF objects (prog, map, link). +This allows direct inode freeing without RCU callback scheduling, +avoiding the invalid context warning. + +Reported-by: Le Chen +Closes: https://lore.kernel.org/all/1444123482.1827743.1750996347470.JavaMail.zimbra@sjtu.edu.cn/ +Fixes: 68134668c17f ("bpf: Add map side support for bpf timers.") +Suggested-by: Alexei Starovoitov +Signed-off-by: KaFai Wan +Acked-by: Yonghong Song +Link: https://lore.kernel.org/r/20251008102628.808045-2-kafai.wan@linux.dev +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/inode.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c +index 4f841e16779e7..9b184f3fbf45f 100644 +--- a/kernel/bpf/inode.c ++++ b/kernel/bpf/inode.c +@@ -610,7 +610,7 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root) + return 0; + } + +-static void bpf_free_inode(struct inode *inode) ++static void bpf_destroy_inode(struct inode *inode) + { + enum bpf_type type; + +@@ -625,7 +625,7 @@ static const struct super_operations bpf_super_ops = { + .statfs = simple_statfs, + .drop_inode = generic_delete_inode, + .show_options = bpf_show_options, +- .free_inode = bpf_free_inode, ++ .destroy_inode = bpf_destroy_inode, + }; + + enum { +-- +2.51.0 + diff --git a/queue-6.1/bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch b/queue-6.1/bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch new file mode 100644 index 0000000000..40c9cf2005 --- /dev/null +++ b/queue-6.1/bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch @@ -0,0 +1,64 @@ +From 148976afa9d974ff69aaa93f53246eaad83908e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 09:34:18 +0200 +Subject: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} + +From: Daniel Borkmann + +[ Upstream commit 23f3770e1a53e6c7a553135011f547209e141e72 ] + +Cilium has a BPF egress gateway feature which forces outgoing K8s Pod +traffic to pass through dedicated egress gateways which then SNAT the +traffic in order to interact with stable IPs outside the cluster. + +The traffic is directed to the gateway via vxlan tunnel in collect md +mode. A recent BPF change utilized the bpf_redirect_neigh() helper to +forward packets after the arrival and decap on vxlan, which turned out +over time that the kmalloc-256 slab usage in kernel was ever-increasing. + +The issue was that vxlan allocates the metadata_dst object and attaches +it through a fake dst entry to the skb. The latter was never released +though given bpf_redirect_neigh() was merely setting the new dst entry +via skb_dst_set() without dropping an existing one first. + +Fixes: b4ab31414970 ("bpf: Add redirect_neigh helper as redirect drop-in") +Reported-by: Yusuke Suzuki +Reported-by: Julian Wiedmann +Signed-off-by: Daniel Borkmann +Cc: Martin KaFai Lau +Cc: Jakub Kicinski +Cc: Jordan Rife +Reviewed-by: Simon Horman +Reviewed-by: Jordan Rife +Reviewed-by: Jakub Kicinski +Reviewed-by: Martin KaFai Lau +Link: https://lore.kernel.org/r/20251003073418.291171-1-daniel@iogearbox.net +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/core/filter.c b/net/core/filter.c +index 183ede9345e61..9b4254feefccd 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -2266,6 +2266,7 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev, + if (IS_ERR(dst)) + goto out_drop; + ++ skb_dst_drop(skb); + skb_dst_set(skb, dst); + } else if (nh->nh_family != AF_INET6) { + goto out_drop; +@@ -2375,6 +2376,7 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev, + goto out_drop; + } + ++ skb_dst_drop(skb); + skb_dst_set(skb, &rt->dst); + } + +-- +2.51.0 + diff --git a/queue-6.1/bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch b/queue-6.1/bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch new file mode 100644 index 0000000000..bc5476d331 --- /dev/null +++ b/queue-6.1/bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch @@ -0,0 +1,50 @@ +From 227a118569c3e270b81c2bbc9a63627b8514eafb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 10:15:01 +0200 +Subject: bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() + +From: Eric Woudstra + +[ Upstream commit bbf0c98b3ad9edaea1f982de6c199cc11d3b7705 ] + +net/bridge/br_private.h:1627 suspicious rcu_dereference_protected() usage! +other info that might help us debug this: + +rcu_scheduler_active = 2, debug_locks = 1 +7 locks held by socat/410: + #0: ffff88800d7a9c90 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_stream_connect+0x43/0xa0 + #1: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x62/0x1830 + [..] + #6: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: nf_hook.constprop.0+0x8a/0x440 + +Call Trace: + lockdep_rcu_suspicious.cold+0x4f/0xb1 + br_vlan_fill_forward_path_pvid+0x32c/0x410 [bridge] + br_fill_forward_path+0x7a/0x4d0 [bridge] + +Use to correct helper, non _rcu variant requires RTNL mutex. + +Fixes: bcf2766b1377 ("net: bridge: resolve forwarding path for VLAN tag actions in bridge devices") +Signed-off-by: Eric Woudstra +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/bridge/br_vlan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c +index 23a82567fe624..54b0f24eb08ff 100644 +--- a/net/bridge/br_vlan.c ++++ b/net/bridge/br_vlan.c +@@ -1455,7 +1455,7 @@ void br_vlan_fill_forward_path_pvid(struct net_bridge *br, + if (!br_opt_get(br, BROPT_VLAN_ENABLED)) + return; + +- vg = br_vlan_group(br); ++ vg = br_vlan_group_rcu(br); + + if (idx >= 0 && + ctx->vlan[idx].proto == br->vlan_proto) { +-- +2.51.0 + diff --git a/queue-6.1/clk-at91-peripheral-fix-return-value.patch b/queue-6.1/clk-at91-peripheral-fix-return-value.patch new file mode 100644 index 0000000000..30d55fc667 --- /dev/null +++ b/queue-6.1/clk-at91-peripheral-fix-return-value.patch @@ -0,0 +1,44 @@ +From c3b72e9908f04f6b7715a97f4565605cb04b0baf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 11:17:53 -0400 +Subject: clk: at91: peripheral: fix return value + +From: Brian Masney + +[ Upstream commit 47b13635dabc14f1c2fdcaa5468b47ddadbdd1b5 ] + +determine_rate() is expected to return an error code, or 0 on success. +clk_sam9x5_peripheral_determine_rate() has a branch that returns the +parent rate on a certain case. This is the behavior of round_rate(), +so let's go ahead and fix this by setting req->rate. + +Fixes: b4c115c76184f ("clk: at91: clk-peripheral: add support for changeable parent rate") +Reviewed-by: Alexander Sverdlin +Acked-by: Nicolas Ferre +Signed-off-by: Brian Masney +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/clk-peripheral.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/at91/clk-peripheral.c b/drivers/clk/at91/clk-peripheral.c +index 5104d4025484c..a5e8f5949d770 100644 +--- a/drivers/clk/at91/clk-peripheral.c ++++ b/drivers/clk/at91/clk-peripheral.c +@@ -275,8 +275,11 @@ static int clk_sam9x5_peripheral_determine_rate(struct clk_hw *hw, + long best_diff = LONG_MIN; + u32 shift; + +- if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max) +- return parent_rate; ++ if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max) { ++ req->rate = parent_rate; ++ ++ return 0; ++ } + + /* Fist step: check the available dividers. */ + for (shift = 0; shift <= PERIPHERAL_MAX_SHIFT; shift++) { +-- +2.51.0 + diff --git a/queue-6.1/clk-mediatek-clk-mux-do-not-pass-flags-to-clk_mux_de.patch b/queue-6.1/clk-mediatek-clk-mux-do-not-pass-flags-to-clk_mux_de.patch new file mode 100644 index 0000000000..36edd0d1d8 --- /dev/null +++ b/queue-6.1/clk-mediatek-clk-mux-do-not-pass-flags-to-clk_mux_de.patch @@ -0,0 +1,42 @@ +From 903f7279f82e8ce48af230aca91ec081d6784349 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 23:09:31 +0800 +Subject: clk: mediatek: clk-mux: Do not pass flags to + clk_mux_determine_rate_flags() + +From: Chen-Yu Tsai + +[ Upstream commit 5e121370a7ad3414c7f3a77002e2b18abe5c6fe1 ] + +The `flags` in |struct mtk_mux| are core clk flags, not mux clk flags. +Passing one to the other is wrong. + +Since there aren't any actual users adding CLK_MUX_* flags, just drop it +for now. + +Fixes: b05ea3314390 ("clk: mediatek: clk-mux: Add .determine_rate() callback") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mux.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/clk/mediatek/clk-mux.c b/drivers/clk/mediatek/clk-mux.c +index c8593554239d6..93fa67294e5ab 100644 +--- a/drivers/clk/mediatek/clk-mux.c ++++ b/drivers/clk/mediatek/clk-mux.c +@@ -132,9 +132,7 @@ static int mtk_clk_mux_set_parent_setclr_lock(struct clk_hw *hw, u8 index) + static int mtk_clk_mux_determine_rate(struct clk_hw *hw, + struct clk_rate_request *req) + { +- struct mtk_clk_mux *mux = to_mtk_clk_mux(hw); +- +- return clk_mux_determine_rate_flags(hw, req, mux->data->flags); ++ return clk_mux_determine_rate_flags(hw, req, 0); + } + + const struct clk_ops mtk_mux_clr_set_upd_ops = { +-- +2.51.0 + diff --git a/queue-6.1/clk-mediatek-mt8195-infra_ao-fix-parent-for-infra_ao.patch b/queue-6.1/clk-mediatek-mt8195-infra_ao-fix-parent-for-infra_ao.patch new file mode 100644 index 0000000000..3f91170688 --- /dev/null +++ b/queue-6.1/clk-mediatek-mt8195-infra_ao-fix-parent-for-infra_ao.patch @@ -0,0 +1,39 @@ +From d9a37ac6df83d21dfea4f0344aab1bbee3576da8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 10:38:28 +0200 +Subject: clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m + +From: AngeloGioacchino Del Regno + +[ Upstream commit 6c4c26b624790098988c1034541087e3e5ed5bed ] + +The infrastructure gate for the HDMI specific crystal needs the +top_hdmi_xtal clock to be configured in order to ungate the 26m +clock to the HDMI IP, and it wouldn't work without. + +Reparent the infra_ao_hdmi_26m clock to top_hdmi_xtal to fix that. + +Fixes: e2edf59dec0b ("clk: mediatek: Add MT8195 infrastructure clock support") +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mt8195-infra_ao.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/mediatek/clk-mt8195-infra_ao.c b/drivers/clk/mediatek/clk-mt8195-infra_ao.c +index fcd410461d3bb..516b5830f16e1 100644 +--- a/drivers/clk/mediatek/clk-mt8195-infra_ao.c ++++ b/drivers/clk/mediatek/clk-mt8195-infra_ao.c +@@ -103,7 +103,7 @@ static const struct mtk_gate infra_ao_clks[] = { + GATE_INFRA_AO0(CLK_INFRA_AO_CQ_DMA_FPC, "infra_ao_cq_dma_fpc", "fpc", 28), + GATE_INFRA_AO0(CLK_INFRA_AO_UART5, "infra_ao_uart5", "top_uart", 29), + /* INFRA_AO1 */ +- GATE_INFRA_AO1(CLK_INFRA_AO_HDMI_26M, "infra_ao_hdmi_26m", "clk26m", 0), ++ GATE_INFRA_AO1(CLK_INFRA_AO_HDMI_26M, "infra_ao_hdmi_26m", "top_hdmi_xtal", 0), + GATE_INFRA_AO1(CLK_INFRA_AO_SPI0, "infra_ao_spi0", "top_spi", 1), + GATE_INFRA_AO1(CLK_INFRA_AO_MSDC0, "infra_ao_msdc0", "top_msdc50_0_hclk", 2), + GATE_INFRA_AO1(CLK_INFRA_AO_MSDC1, "infra_ao_msdc1", "top_axi", 4), +-- +2.51.0 + diff --git a/queue-6.1/clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch b/queue-6.1/clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch new file mode 100644 index 0000000000..1a8cf8036a --- /dev/null +++ b/queue-6.1/clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch @@ -0,0 +1,50 @@ +From 0b587a93dc207856a3aac83d6310d03eb00e81fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Jul 2025 13:11:55 -0700 +Subject: clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver + +From: Alok Tiwari + +[ Upstream commit 1624dead9a4d288a594fdf19735ebfe4bb567cb8 ] + +The conditional check for the PLL0 multiplier 'm' used a logical AND +instead of OR, making the range check ineffective. This patch replaces +&& with || to correctly reject invalid values of 'm' that are either +less than or equal to 0 or greater than LPC18XX_PLL0_MSEL_MAX. + +This ensures proper bounds checking during clk rate setting and rounding. + +Fixes: b04e0b8fd544 ("clk: add lpc18xx cgu clk driver") +Signed-off-by: Alok Tiwari +[sboyd@kernel.org: 'm' is unsigned so remove < condition] +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/nxp/clk-lpc18xx-cgu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c +index 821155f79b015..bbd7d64038fab 100644 +--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c ++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c +@@ -382,7 +382,7 @@ static int lpc18xx_pll0_determine_rate(struct clk_hw *hw, + } + + m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2); +- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { ++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) { + pr_warn("%s: unable to support rate %lu\n", __func__, req->rate); + return -EINVAL; + } +@@ -405,7 +405,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, + } + + m = DIV_ROUND_UP_ULL(parent_rate, rate * 2); +- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { ++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) { + pr_warn("%s: unable to support rate %lu\n", __func__, rate); + return -EINVAL; + } +-- +2.51.0 + diff --git a/queue-6.1/clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch b/queue-6.1/clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch new file mode 100644 index 0000000000..60b5547b06 --- /dev/null +++ b/queue-6.1/clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch @@ -0,0 +1,68 @@ +From e6d908750da55a1e9f288087d0312307cf526241 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 11:18:29 -0400 +Subject: clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() + +From: Brian Masney + +[ Upstream commit b46a3d323a5b7942e65025254c13801d0f475f02 ] + +The round_rate() clk ops is deprecated, so migrate this driver from +round_rate() to determine_rate() using the Coccinelle semantic patch +on the cover letter of this series. + +Signed-off-by: Brian Masney +Stable-dep-of: 1624dead9a4d ("clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver") +Signed-off-by: Sasha Levin +--- + drivers/clk/nxp/clk-lpc18xx-cgu.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c +index 69ebf65081b81..821155f79b015 100644 +--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c ++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c +@@ -371,23 +371,25 @@ static unsigned long lpc18xx_pll0_recalc_rate(struct clk_hw *hw, + return 0; + } + +-static long lpc18xx_pll0_round_rate(struct clk_hw *hw, unsigned long rate, +- unsigned long *prate) ++static int lpc18xx_pll0_determine_rate(struct clk_hw *hw, ++ struct clk_rate_request *req) + { + unsigned long m; + +- if (*prate < rate) { ++ if (req->best_parent_rate < req->rate) { + pr_warn("%s: pll dividers not supported\n", __func__); + return -EINVAL; + } + +- m = DIV_ROUND_UP_ULL(*prate, rate * 2); ++ m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2); + if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { +- pr_warn("%s: unable to support rate %lu\n", __func__, rate); ++ pr_warn("%s: unable to support rate %lu\n", __func__, req->rate); + return -EINVAL; + } + +- return 2 * *prate * m; ++ req->rate = 2 * req->best_parent_rate * m; ++ ++ return 0; + } + + static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, +@@ -444,7 +446,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, + + static const struct clk_ops lpc18xx_pll0_ops = { + .recalc_rate = lpc18xx_pll0_recalc_rate, +- .round_rate = lpc18xx_pll0_round_rate, ++ .determine_rate = lpc18xx_pll0_determine_rate, + .set_rate = lpc18xx_pll0_set_rate, + }; + +-- +2.51.0 + diff --git a/queue-6.1/clk-tegra-do-not-overallocate-memory-for-bpmp-clocks.patch b/queue-6.1/clk-tegra-do-not-overallocate-memory-for-bpmp-clocks.patch new file mode 100644 index 0000000000..866f4899cc --- /dev/null +++ b/queue-6.1/clk-tegra-do-not-overallocate-memory-for-bpmp-clocks.patch @@ -0,0 +1,43 @@ +From 815f25e376ca23f9b1da84d7115e20d527abcdb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Apr 2025 15:54:28 +0300 +Subject: clk: tegra: do not overallocate memory for bpmp clocks + +From: Fedor Pchelkin + +[ Upstream commit 49ef6491106209c595476fc122c3922dfd03253f ] + +struct tegra_bpmp::clocks is a pointer to a dynamically allocated array +of pointers to 'struct tegra_bpmp_clk'. + +But the size of the allocated area is calculated like it is an array +containing actual 'struct tegra_bpmp_clk' objects - it's not true, there +are just pointers. + +Found by Linux Verification Center (linuxtesting.org) with Svace static +analysis tool. + +Fixes: 2db12b15c6f3 ("clk: tegra: Register clocks from root to leaf") +Signed-off-by: Fedor Pchelkin +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/tegra/clk-bpmp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/tegra/clk-bpmp.c b/drivers/clk/tegra/clk-bpmp.c +index 39241662a412a..3bc56a3c6b240 100644 +--- a/drivers/clk/tegra/clk-bpmp.c ++++ b/drivers/clk/tegra/clk-bpmp.c +@@ -603,7 +603,7 @@ static int tegra_bpmp_register_clocks(struct tegra_bpmp *bpmp, + + bpmp->num_clocks = count; + +- bpmp->clocks = devm_kcalloc(bpmp->dev, count, sizeof(struct tegra_bpmp_clk), GFP_KERNEL); ++ bpmp->clocks = devm_kcalloc(bpmp->dev, count, sizeof(*bpmp->clocks), GFP_KERNEL); + if (!bpmp->clocks) + return -ENOMEM; + +-- +2.51.0 + diff --git a/queue-6.1/cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch b/queue-6.1/cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch new file mode 100644 index 0000000000..ebd2d47fb2 --- /dev/null +++ b/queue-6.1/cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch @@ -0,0 +1,47 @@ +From 230db12153e34ebeddc36802021772535fcda012 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 21:48:12 -0500 +Subject: cpufreq: tegra186: Set target frequency for all cpus in policy + +From: Aaron Kling + +[ Upstream commit 0b1bb980fd7cae126ee3d59f817068a13e321b07 ] + +The original commit set all cores in a cluster to a shared policy, but +did not update set_target to apply a frequency change to all cores for +the policy. This caused most cores to remain stuck at their boot +frequency. + +Fixes: be4ae8c19492 ("cpufreq: tegra186: Share policy per cluster") +Signed-off-by: Aaron Kling +Reviewed-by: Mikko Perttunen +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/tegra186-cpufreq.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c +index 6c88827f4e625..ee57676bbee14 100644 +--- a/drivers/cpufreq/tegra186-cpufreq.c ++++ b/drivers/cpufreq/tegra186-cpufreq.c +@@ -86,10 +86,14 @@ static int tegra186_cpufreq_set_target(struct cpufreq_policy *policy, + { + struct tegra186_cpufreq_data *data = cpufreq_get_driver_data(); + struct cpufreq_frequency_table *tbl = policy->freq_table + index; +- unsigned int edvd_offset = data->cpus[policy->cpu].edvd_offset; ++ unsigned int edvd_offset; + u32 edvd_val = tbl->driver_data; ++ u32 cpu; + +- writel(edvd_val, data->regs + edvd_offset); ++ for_each_cpu(cpu, policy->cpus) { ++ edvd_offset = data->cpus[cpu].edvd_offset; ++ writel(edvd_val, data->regs + edvd_offset); ++ } + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.1/crypto-essiv-check-ssize-for-decryption-and-in-place.patch b/queue-6.1/crypto-essiv-check-ssize-for-decryption-and-in-place.patch new file mode 100644 index 0000000000..be04c3fc02 --- /dev/null +++ b/queue-6.1/crypto-essiv-check-ssize-for-decryption-and-in-place.patch @@ -0,0 +1,63 @@ +From 15a87a53de79b28e362ccac46d25da4bae9965c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 15:54:20 +0800 +Subject: crypto: essiv - Check ssize for decryption and in-place encryption + +From: Herbert Xu + +[ Upstream commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f ] + +Move the ssize check to the start in essiv_aead_crypt so that +it's also checked for decryption and in-place encryption. + +Reported-by: Muhammad Alifa Ramdhan +Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation") +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/essiv.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/crypto/essiv.c b/crypto/essiv.c +index 307eba74b901e..9aa8603fcf63b 100644 +--- a/crypto/essiv.c ++++ b/crypto/essiv.c +@@ -186,9 +186,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) + const struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm); + struct essiv_aead_request_ctx *rctx = aead_request_ctx(req); + struct aead_request *subreq = &rctx->aead_req; ++ int ivsize = crypto_aead_ivsize(tfm); ++ int ssize = req->assoclen - ivsize; + struct scatterlist *src = req->src; + int err; + ++ if (ssize < 0) ++ return -EINVAL; ++ + crypto_cipher_encrypt_one(tctx->essiv_cipher, req->iv, req->iv); + + /* +@@ -198,19 +203,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) + */ + rctx->assoc = NULL; + if (req->src == req->dst || !enc) { +- scatterwalk_map_and_copy(req->iv, req->dst, +- req->assoclen - crypto_aead_ivsize(tfm), +- crypto_aead_ivsize(tfm), 1); ++ scatterwalk_map_and_copy(req->iv, req->dst, ssize, ivsize, 1); + } else { + u8 *iv = (u8 *)aead_request_ctx(req) + tctx->ivoffset; +- int ivsize = crypto_aead_ivsize(tfm); +- int ssize = req->assoclen - ivsize; + struct scatterlist *sg; + int nents; + +- if (ssize < 0) +- return -EINVAL; +- + nents = sg_nents_for_len(req->src, ssize); + if (nents < 0) + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.1/drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch b/queue-6.1/drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch new file mode 100644 index 0000000000..7933ec792c --- /dev/null +++ b/queue-6.1/drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch @@ -0,0 +1,39 @@ +From f925b779753f7bd8c69e18eb899250e9f6fbc089 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:22 +0200 +Subject: drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit d60f9c45d1bff7e20ecd57492ef7a5e33c94a37c ] + +Without these, it's impossible to program these registers. + +Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +index cbce194ec7b82..ff746fba850bc 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +@@ -155,6 +155,8 @@ + SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \ + SRI(VIEWPORT_START, SCL, id), \ + SRI(VIEWPORT_SIZE, SCL, id), \ ++ SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \ ++ SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \ + SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \ + SRI(SCL_VERT_FILTER_SCALE_RATIO, SCL, id), \ + SRI(SCL_VERT_FILTER_INIT, SCL, id), \ +-- +2.51.0 + diff --git a/queue-6.1/drm-amd-display-properly-clear-scl_-_filter_control-.patch b/queue-6.1/drm-amd-display-properly-clear-scl_-_filter_control-.patch new file mode 100644 index 0000000000..0188242d81 --- /dev/null +++ b/queue-6.1/drm-amd-display-properly-clear-scl_-_filter_control-.patch @@ -0,0 +1,51 @@ +From a6cc6038e8d4ef94d0d41ffab06fdb014b1373c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:23 +0200 +Subject: drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit c0aa7cf49dd6cb302fe28e7183992b772cb7420c ] + +Previously, the code would set a bit field which didn't exist +on DCE6 so it would be effectively a no-op. + +Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +index 670d5ab9d9984..b761dda491d54 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +@@ -527,8 +527,7 @@ static void dce60_transform_set_scaler( + if (coeffs_v != xfm_dce->filter_v || coeffs_h != xfm_dce->filter_h) { + /* 4. Program vertical filters */ + if (xfm_dce->filter_v == NULL) +- REG_SET(SCL_VERT_FILTER_CONTROL, 0, +- SCL_V_2TAP_HARDCODE_COEF_EN, 0); ++ REG_WRITE(SCL_VERT_FILTER_CONTROL, 0); + program_multi_taps_filter( + xfm_dce, + data->taps.v_taps, +@@ -542,8 +541,7 @@ static void dce60_transform_set_scaler( + + /* 5. Program horizontal filters */ + if (xfm_dce->filter_h == NULL) +- REG_SET(SCL_HORZ_FILTER_CONTROL, 0, +- SCL_H_2TAP_HARDCODE_COEF_EN, 0); ++ REG_WRITE(SCL_HORZ_FILTER_CONTROL, 0); + program_multi_taps_filter( + xfm_dce, + data->taps.h_taps, +-- +2.51.0 + diff --git a/queue-6.1/drm-amd-display-properly-disable-scaling-on-dce6.patch b/queue-6.1/drm-amd-display-properly-disable-scaling-on-dce6.patch new file mode 100644 index 0000000000..fa8869c231 --- /dev/null +++ b/queue-6.1/drm-amd-display-properly-disable-scaling-on-dce6.patch @@ -0,0 +1,101 @@ +From 02043d2ab08bdfd42d342ec0215627a8d3621457 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:24 +0200 +Subject: drm/amd/display: Properly disable scaling on DCE6 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit a7dc87f3448bea5ebe054f14e861074b9c289c65 ] + +SCL_SCALER_ENABLE can be used to enable/disable the scaler +on DCE6. Program it to 0 when scaling isn't used, 1 when used. +Additionally, clear some other registers when scaling is +disabled and program the SCL_UPDATE register as recommended. + +This fixes visible glitches for users whose BIOS sets up a +mode with scaling at boot, which DC was unable to clean up. + +Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/dce/dce_transform.c | 15 +++++++++++---- + .../gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++ + 2 files changed, 13 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +index b761dda491d54..f97c182677082 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +@@ -154,10 +154,13 @@ static bool dce60_setup_scaling_configuration( + REG_SET(SCL_BYPASS_CONTROL, 0, SCL_BYPASS_MODE, 0); + + if (data->taps.h_taps + data->taps.v_taps <= 2) { +- /* Set bypass */ +- +- /* DCE6 has no SCL_MODE register, skip scale mode programming */ ++ /* Disable scaler functionality */ ++ REG_WRITE(SCL_SCALER_ENABLE, 0); + ++ /* Clear registers that can cause glitches even when the scaler is off */ ++ REG_WRITE(SCL_TAP_CONTROL, 0); ++ REG_WRITE(SCL_AUTOMATIC_MODE_CONTROL, 0); ++ REG_WRITE(SCL_F_SHARP_CONTROL, 0); + return false; + } + +@@ -165,7 +168,7 @@ static bool dce60_setup_scaling_configuration( + SCL_H_NUM_OF_TAPS, data->taps.h_taps - 1, + SCL_V_NUM_OF_TAPS, data->taps.v_taps - 1); + +- /* DCE6 has no SCL_MODE register, skip scale mode programming */ ++ REG_WRITE(SCL_SCALER_ENABLE, 1); + + /* DCE6 has no SCL_BOUNDARY_MODE bit, skip replace out of bound pixels */ + +@@ -502,6 +505,8 @@ static void dce60_transform_set_scaler( + REG_SET(DC_LB_MEM_SIZE, 0, + DC_LB_MEM_SIZE, xfm_dce->lb_memory_size); + ++ REG_WRITE(SCL_UPDATE, 0x00010000); ++ + /* Clear SCL_F_SHARP_CONTROL value to 0 */ + REG_WRITE(SCL_F_SHARP_CONTROL, 0); + +@@ -564,6 +569,8 @@ static void dce60_transform_set_scaler( + /* DCE6 has no SCL_COEF_UPDATE_COMPLETE bit to flip to new coefficient memory */ + + /* DCE6 DATA_FORMAT register does not support ALPHA_EN */ ++ ++ REG_WRITE(SCL_UPDATE, 0); + } + #endif + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +index ff746fba850bc..eb716e8337e23 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +@@ -155,6 +155,7 @@ + SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \ + SRI(VIEWPORT_START, SCL, id), \ + SRI(VIEWPORT_SIZE, SCL, id), \ ++ SRI(SCL_SCALER_ENABLE, SCL, id), \ + SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \ + SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \ + SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \ +@@ -592,6 +593,7 @@ struct dce_transform_registers { + uint32_t SCL_VERT_FILTER_SCALE_RATIO; + uint32_t SCL_HORZ_FILTER_INIT; + #if defined(CONFIG_DRM_AMD_DC_SI) ++ uint32_t SCL_SCALER_ENABLE; + uint32_t SCL_HORZ_FILTER_INIT_RGB_LUMA; + uint32_t SCL_HORZ_FILTER_INIT_CHROMA; + #endif +-- +2.51.0 + diff --git a/queue-6.1/drm-amdgpu-add-additional-dce6-scl-registers.patch b/queue-6.1/drm-amdgpu-add-additional-dce6-scl-registers.patch new file mode 100644 index 0000000000..d462f65c36 --- /dev/null +++ b/queue-6.1/drm-amdgpu-add-additional-dce6-scl-registers.patch @@ -0,0 +1,93 @@ +From 7074521df91856baf5f663a26124f97ad17bd126 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:21 +0200 +Subject: drm/amdgpu: Add additional DCE6 SCL registers + +From: Alex Deucher + +[ Upstream commit 507296328b36ffd00ec1f4fde5b8acafb7222ec7 ] + +Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)") +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h | 7 +++++++ + drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h | 2 ++ + 2 files changed, 9 insertions(+) + +diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h +index 9de01ae574c03..067eddd9c62d8 100644 +--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h ++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h +@@ -4115,6 +4115,7 @@ + #define mmSCL0_SCL_COEF_RAM_CONFLICT_STATUS 0x1B55 + #define mmSCL0_SCL_COEF_RAM_SELECT 0x1B40 + #define mmSCL0_SCL_COEF_RAM_TAP_DATA 0x1B41 ++#define mmSCL0_SCL_SCALER_ENABLE 0x1B42 + #define mmSCL0_SCL_CONTROL 0x1B44 + #define mmSCL0_SCL_DEBUG 0x1B6A + #define mmSCL0_SCL_DEBUG2 0x1B69 +@@ -4144,6 +4145,7 @@ + #define mmSCL1_SCL_COEF_RAM_CONFLICT_STATUS 0x1E55 + #define mmSCL1_SCL_COEF_RAM_SELECT 0x1E40 + #define mmSCL1_SCL_COEF_RAM_TAP_DATA 0x1E41 ++#define mmSCL1_SCL_SCALER_ENABLE 0x1E42 + #define mmSCL1_SCL_CONTROL 0x1E44 + #define mmSCL1_SCL_DEBUG 0x1E6A + #define mmSCL1_SCL_DEBUG2 0x1E69 +@@ -4173,6 +4175,7 @@ + #define mmSCL2_SCL_COEF_RAM_CONFLICT_STATUS 0x4155 + #define mmSCL2_SCL_COEF_RAM_SELECT 0x4140 + #define mmSCL2_SCL_COEF_RAM_TAP_DATA 0x4141 ++#define mmSCL2_SCL_SCALER_ENABLE 0x4142 + #define mmSCL2_SCL_CONTROL 0x4144 + #define mmSCL2_SCL_DEBUG 0x416A + #define mmSCL2_SCL_DEBUG2 0x4169 +@@ -4202,6 +4205,7 @@ + #define mmSCL3_SCL_COEF_RAM_CONFLICT_STATUS 0x4455 + #define mmSCL3_SCL_COEF_RAM_SELECT 0x4440 + #define mmSCL3_SCL_COEF_RAM_TAP_DATA 0x4441 ++#define mmSCL3_SCL_SCALER_ENABLE 0x4442 + #define mmSCL3_SCL_CONTROL 0x4444 + #define mmSCL3_SCL_DEBUG 0x446A + #define mmSCL3_SCL_DEBUG2 0x4469 +@@ -4231,6 +4235,7 @@ + #define mmSCL4_SCL_COEF_RAM_CONFLICT_STATUS 0x4755 + #define mmSCL4_SCL_COEF_RAM_SELECT 0x4740 + #define mmSCL4_SCL_COEF_RAM_TAP_DATA 0x4741 ++#define mmSCL4_SCL_SCALER_ENABLE 0x4742 + #define mmSCL4_SCL_CONTROL 0x4744 + #define mmSCL4_SCL_DEBUG 0x476A + #define mmSCL4_SCL_DEBUG2 0x4769 +@@ -4260,6 +4265,7 @@ + #define mmSCL5_SCL_COEF_RAM_CONFLICT_STATUS 0x4A55 + #define mmSCL5_SCL_COEF_RAM_SELECT 0x4A40 + #define mmSCL5_SCL_COEF_RAM_TAP_DATA 0x4A41 ++#define mmSCL5_SCL_SCALER_ENABLE 0x4A42 + #define mmSCL5_SCL_CONTROL 0x4A44 + #define mmSCL5_SCL_DEBUG 0x4A6A + #define mmSCL5_SCL_DEBUG2 0x4A69 +@@ -4287,6 +4293,7 @@ + #define mmSCL_COEF_RAM_CONFLICT_STATUS 0x1B55 + #define mmSCL_COEF_RAM_SELECT 0x1B40 + #define mmSCL_COEF_RAM_TAP_DATA 0x1B41 ++#define mmSCL_SCALER_ENABLE 0x1B42 + #define mmSCL_CONTROL 0x1B44 + #define mmSCL_DEBUG 0x1B6A + #define mmSCL_DEBUG2 0x1B69 +diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h +index bd8085ec54ed5..da5596fbfdcb3 100644 +--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h ++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h +@@ -8648,6 +8648,8 @@ + #define REGAMMA_LUT_INDEX__REGAMMA_LUT_INDEX__SHIFT 0x00000000 + #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK_MASK 0x00000007L + #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK__SHIFT 0x00000000 ++#define SCL_SCALER_ENABLE__SCL_SCALE_EN_MASK 0x00000001L ++#define SCL_SCALER_ENABLE__SCL_SCALE_EN__SHIFT 0x00000000 + #define SCL_ALU_CONTROL__SCL_ALU_DISABLE_MASK 0x00000001L + #define SCL_ALU_CONTROL__SCL_ALU_DISABLE__SHIFT 0x00000000 + #define SCL_BYPASS_CONTROL__SCL_BYPASS_MODE_MASK 0x00000003L +-- +2.51.0 + diff --git a/queue-6.1/drm-vmwgfx-fix-copy-paste-typo-in-validation.patch b/queue-6.1/drm-vmwgfx-fix-copy-paste-typo-in-validation.patch new file mode 100644 index 0000000000..3765241334 --- /dev/null +++ b/queue-6.1/drm-vmwgfx-fix-copy-paste-typo-in-validation.patch @@ -0,0 +1,37 @@ +From a4b416f614548f7de46cafbdd941dd531760c00c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 14:54:26 -0500 +Subject: drm/vmwgfx: Fix copy-paste typo in validation + +From: Ian Forbes + +[ Upstream commit 228c5d44dffe8c293cd2d2f0e7ea45e64565b1c4 ] + +'entry' should be 'val' which is the loop iterator. + +Fixes: 9e931f2e0970 ("drm/vmwgfx: Refactor resource validation hashtable to use linux/hashtable implementation.") +Signed-off-by: Ian Forbes +Reviewed-by: Zack Rusin +Signed-off-by: Zack Rusin +Link: https://lore.kernel.org/r/20250926195427.1405237-2-ian.forbes@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +index d37cf22e9caeb..27f33297fcf3e 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +@@ -692,7 +692,7 @@ void vmw_validation_drop_ht(struct vmw_validation_context *ctx) + hash_del_rcu(&val->hash.head); + + list_for_each_entry(val, &ctx->resource_ctx_list, head) +- hash_del_rcu(&entry->hash.head); ++ hash_del_rcu(&val->hash.head); + + ctx->sw_context = NULL; + } +-- +2.51.0 + diff --git a/queue-6.1/drm-vmwgfx-fix-use-after-free-in-validation.patch b/queue-6.1/drm-vmwgfx-fix-use-after-free-in-validation.patch new file mode 100644 index 0000000000..9561263449 --- /dev/null +++ b/queue-6.1/drm-vmwgfx-fix-use-after-free-in-validation.patch @@ -0,0 +1,44 @@ +From 00ac99ed79808d4f67b69c054966e4dce9ddf28e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 14:54:25 -0500 +Subject: drm/vmwgfx: Fix Use-after-free in validation + +From: Ian Forbes + +[ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ] + +Nodes stored in the validation duplicates hashtable come from an arena +allocator that is cleared at the end of vmw_execbuf_process. All nodes +are expected to be cleared in vmw_validation_drop_ht but this node escaped +because its resource was destroyed prematurely. + +Fixes: 64ad2abfe9a6 ("drm/vmwgfx: Adapt validation code for reference-free lookups") +Reported-by: Kuzey Arda Bulut +Signed-off-by: Ian Forbes +Reviewed-by: Zack Rusin +Signed-off-by: Zack Rusin +Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +index f5c4a40fb16d7..d37cf22e9caeb 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +@@ -339,8 +339,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx, + hash_add_rcu(ctx->sw_context->res_ht, &node->hash.head, node->hash.key); + } + node->res = vmw_resource_reference_unless_doomed(res); +- if (!node->res) ++ if (!node->res) { ++ hash_del_rcu(&node->hash.head); + return -ESRCH; ++ } + + node->first_usage = 1; + if (!res->dev_priv->has_mob) { +-- +2.51.0 + diff --git a/queue-6.1/gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch b/queue-6.1/gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch new file mode 100644 index 0000000000..9f7241cd58 --- /dev/null +++ b/queue-6.1/gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch @@ -0,0 +1,37 @@ +From eb8bdd92f2973af950551ea6f7790f2e542c9a51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 16:51:29 +0200 +Subject: gpio: wcd934x: mark the GPIO controller as sleeping + +From: Bartosz Golaszewski + +[ Upstream commit b5f8aa8d4bde0cf3e4595af5a536da337e5f1c78 ] + +The slimbus regmap passed to the GPIO driver down from MFD does not use +fast_io. This means a mutex is used for locking and thus this GPIO chip +must not be used in atomic context. Change the can_sleep switch in +struct gpio_chip to true. + +Fixes: 59c324683400 ("gpio: wcd934x: Add support to wcd934x gpio controller") +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-wcd934x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-wcd934x.c b/drivers/gpio/gpio-wcd934x.c +index cbbbd105a5a7b..26d70ac90933c 100644 +--- a/drivers/gpio/gpio-wcd934x.c ++++ b/drivers/gpio/gpio-wcd934x.c +@@ -101,7 +101,7 @@ static int wcd_gpio_probe(struct platform_device *pdev) + chip->base = -1; + chip->ngpio = WCD934X_NPINS; + chip->label = dev_name(dev); +- chip->can_sleep = false; ++ chip->can_sleep = true; + + return devm_gpiochip_add_data(dev, chip, data); + } +-- +2.51.0 + diff --git a/queue-6.1/gpio-wcd934x-remove-duplicate-assignment-of-of_gpio_.patch b/queue-6.1/gpio-wcd934x-remove-duplicate-assignment-of-of_gpio_.patch new file mode 100644 index 0000000000..5a8cf86e3f --- /dev/null +++ b/queue-6.1/gpio-wcd934x-remove-duplicate-assignment-of-of_gpio_.patch @@ -0,0 +1,35 @@ +From 30545b34024126493a88f22a2d24282466a03939 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jan 2023 20:26:18 +0200 +Subject: gpio: wcd934x: Remove duplicate assignment of of_gpio_n_cells + +From: Andy Shevchenko + +[ Upstream commit a060dc6620c13435b78e92cd2ebdbb6d11af237a ] + +The of_gpio_n_cells default is 2 when ->of_xlate() callback is +not defined. No need to assign it explicitly in the driver. + +Signed-off-by: Andy Shevchenko +Signed-off-by: Bartosz Golaszewski +Stable-dep-of: b5f8aa8d4bde ("gpio: wcd934x: mark the GPIO controller as sleeping") +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-wcd934x.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpio/gpio-wcd934x.c b/drivers/gpio/gpio-wcd934x.c +index c00968ce7a569..cbbbd105a5a7b 100644 +--- a/drivers/gpio/gpio-wcd934x.c ++++ b/drivers/gpio/gpio-wcd934x.c +@@ -101,7 +101,6 @@ static int wcd_gpio_probe(struct platform_device *pdev) + chip->base = -1; + chip->ngpio = WCD934X_NPINS; + chip->label = dev_name(dev); +- chip->of_gpio_n_cells = 2; + chip->can_sleep = false; + + return devm_gpiochip_add_data(dev, chip, data); +-- +2.51.0 + diff --git a/queue-6.1/libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch b/queue-6.1/libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch new file mode 100644 index 0000000000..51203a63fa --- /dev/null +++ b/queue-6.1/libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch @@ -0,0 +1,59 @@ +From 0b60ab1c278f49c12cd4b2461e35395ce3beffc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:19 -0700 +Subject: libperf event: Ensure tracing data is multiple of 8 sized + +From: Ian Rogers + +[ Upstream commit b39c915a4f365cce6bdc0e538ed95d31823aea8f ] + +Perf's synthetic-events.c will ensure 8-byte alignment of tracing +data, writing it after a perf_record_header_tracing_data event. + +Add padding to struct perf_record_header_tracing_data to make it 16-byte +rather than 12-byte sized. + +Fixes: 055c67ed39887c55 ("perf tools: Move event synthesizing routines to separate .c file") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Acked-by: Namhyung Kim +Tested-by: Arnaldo Carvalho de Melo +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Blake Jones +Cc: Chun-Tse Shao +Cc: Collin Funk +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jan Polensky +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Li Huafei +Cc: Mark Rutland +Cc: Nam Cao +Cc: Peter Zijlstra +Cc: Steinar H. Gunderson +Cc: Thomas Gleixner +Link: https://lore.kernel.org/r/20250821163820.1132977-6-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/perf/include/perf/event.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/lib/perf/include/perf/event.h b/tools/lib/perf/include/perf/event.h +index ad47d7b31046c..91db42a9f6589 100644 +--- a/tools/lib/perf/include/perf/event.h ++++ b/tools/lib/perf/include/perf/event.h +@@ -273,6 +273,7 @@ struct perf_record_header_event_type { + struct perf_record_header_tracing_data { + struct perf_event_header header; + __u32 size; ++ __u32 pad; + }; + + #define PERF_RECORD_MISC_BUILD_ID_SIZE (1 << 15) +-- +2.51.0 + diff --git a/queue-6.1/loongarch-init-acpi_gbl_use_global_lock-to-false.patch b/queue-6.1/loongarch-init-acpi_gbl_use_global_lock-to-false.patch new file mode 100644 index 0000000000..6390225f57 --- /dev/null +++ b/queue-6.1/loongarch-init-acpi_gbl_use_global_lock-to-false.patch @@ -0,0 +1,37 @@ +From 65a6305dc4c8efe4ca484e07d3192c2f16bc2670 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 22:38:57 +0800 +Subject: LoongArch: Init acpi_gbl_use_global_lock to false + +From: Huacai Chen + +[ Upstream commit 98662be7ef20d2b88b598f72e7ce9b6ac26a40f9 ] + +Init acpi_gbl_use_global_lock to false, in order to void error messages +during boot phase: + + ACPI Error: Could not enable GlobalLock event (20240827/evxfevnt-182) + ACPI Error: No response from Global Lock hardware, disabling lock (20240827/evglock-59) + +Fixes: 628c3bb40e9a8cefc0a6 ("LoongArch: Add boot and setup routines") +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/kernel/setup.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c +index 55efe2f5fa1c3..e2d294aebab2a 100644 +--- a/arch/loongarch/kernel/setup.c ++++ b/arch/loongarch/kernel/setup.c +@@ -254,6 +254,7 @@ void __init platform_init(void) + + #ifdef CONFIG_ACPI + acpi_table_upgrade(); ++ acpi_gbl_use_global_lock = false; + acpi_gbl_use_default_register_widths = false; + acpi_boot_table_init(); + #endif +-- +2.51.0 + diff --git a/queue-6.1/loongarch-remove-config_acpi_table_upgrade-in-platfo.patch b/queue-6.1/loongarch-remove-config_acpi_table_upgrade-in-platfo.patch new file mode 100644 index 0000000000..319aebf871 --- /dev/null +++ b/queue-6.1/loongarch-remove-config_acpi_table_upgrade-in-platfo.patch @@ -0,0 +1,65 @@ +From 48fc21db1fd7373eaad2152d34de7d6e73816290 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 15:45:53 +0800 +Subject: LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() + +From: Tiezhu Yang + +[ Upstream commit 6c3ca6654a74dd396bc477839ba8d9792eced441 ] + +Both acpi_table_upgrade() and acpi_boot_table_init() are defined as +empty functions under !CONFIG_ACPI_TABLE_UPGRADE and !CONFIG_ACPI in +include/linux/acpi.h, there are no implicit declaration errors with +various configs. + + #ifdef CONFIG_ACPI_TABLE_UPGRADE + void acpi_table_upgrade(void); + #else + static inline void acpi_table_upgrade(void) { } + #endif + + #ifdef CONFIG_ACPI + ... + void acpi_boot_table_init (void); + ... + #else /* !CONFIG_ACPI */ + ... + static inline void acpi_boot_table_init(void) + { + } + ... + #endif /* !CONFIG_ACPI */ + +As Huacai suggested, CONFIG_ACPI_TABLE_UPGRADE is ugly and not necessary +here, just remove it. At the same time, just keep CONFIG_ACPI to prevent +potential build errors in future, and give a signal to indicate the code +is ACPI-specific. For the same reason, we also put acpi_table_upgrade() +under CONFIG_ACPI. + +Signed-off-by: Tiezhu Yang +Signed-off-by: Huacai Chen +Stable-dep-of: 98662be7ef20 ("LoongArch: Init acpi_gbl_use_global_lock to false") +Signed-off-by: Sasha Levin +--- + arch/loongarch/kernel/setup.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c +index b00e885d98458..55efe2f5fa1c3 100644 +--- a/arch/loongarch/kernel/setup.c ++++ b/arch/loongarch/kernel/setup.c +@@ -252,10 +252,8 @@ void __init platform_init(void) + arch_reserve_vmcore(); + arch_parse_crashkernel(); + +-#ifdef CONFIG_ACPI_TABLE_UPGRADE +- acpi_table_upgrade(); +-#endif + #ifdef CONFIG_ACPI ++ acpi_table_upgrade(); + acpi_gbl_use_default_register_widths = false; + acpi_boot_table_init(); + #endif +-- +2.51.0 + diff --git a/queue-6.1/mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch b/queue-6.1/mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch new file mode 100644 index 0000000000..30b4b930e2 --- /dev/null +++ b/queue-6.1/mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch @@ -0,0 +1,48 @@ +From cec4f955658eeebe2cd955bce22f60d4c0b31b89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 13:07:21 +0530 +Subject: mailbox: zynqmp-ipi: Remove dev.parent check in + zynqmp_ipi_free_mboxes + +From: Harini T + +[ Upstream commit 019e3f4550fc7d319a7fd03eff487255f8e8aecd ] + +The ipi_mbox->dev.parent check is unreliable proxy for registration +status as it fails to protect against probe failures that occur after +the parent is assigned but before device_register() completes. + +device_is_registered() is the canonical and robust method to verify the +registration status. + +Remove ipi_mbox->dev.parent check in zynqmp_ipi_free_mboxes(). + +Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") +Signed-off-by: Harini T +Reviewed-by: Peng Fan +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/zynqmp-ipi-mailbox.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c +index 406821a78d510..6a48b832950db 100644 +--- a/drivers/mailbox/zynqmp-ipi-mailbox.c ++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c +@@ -618,10 +618,8 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) + i = pdata->num_mboxes; + for (; i >= 0; i--) { + ipi_mbox = &pdata->ipi_mboxes[i]; +- if (ipi_mbox->dev.parent) { +- if (device_is_registered(&ipi_mbox->dev)) +- device_unregister(&ipi_mbox->dev); +- } ++ if (device_is_registered(&ipi_mbox->dev)) ++ device_unregister(&ipi_mbox->dev); + } + } + +-- +2.51.0 + diff --git a/queue-6.1/mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch b/queue-6.1/mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch new file mode 100644 index 0000000000..fc58e4e3ba --- /dev/null +++ b/queue-6.1/mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch @@ -0,0 +1,43 @@ +From 43d8526ed3cfdf907b61dd1d8ee26d1e232c54a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 13:07:20 +0530 +Subject: mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() + call + +From: Harini T + +[ Upstream commit 341867f730d3d3bb54491ee64e8b1a0c446656e7 ] + +The controller is registered using the device-managed function +'devm_mbox_controller_register()'. As documented in mailbox.c, this +ensures the devres framework automatically calls +mbox_controller_unregister() when device_unregister() is invoked, making +the explicit call unnecessary. + +Remove redundant mbox_controller_unregister() call as +device_unregister() handles controller cleanup. + +Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") +Signed-off-by: Harini T +Reviewed-by: Peng Fan +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/zynqmp-ipi-mailbox.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c +index d097f45b0e5f5..406821a78d510 100644 +--- a/drivers/mailbox/zynqmp-ipi-mailbox.c ++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c +@@ -619,7 +619,6 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) + for (; i >= 0; i--) { + ipi_mbox = &pdata->ipi_mboxes[i]; + if (ipi_mbox->dev.parent) { +- mbox_controller_unregister(&ipi_mbox->mbox); + if (device_is_registered(&ipi_mbox->dev)) + device_unregister(&ipi_mbox->dev); + } +-- +2.51.0 + diff --git a/queue-6.1/net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch b/queue-6.1/net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch new file mode 100644 index 0000000000..021e513d98 --- /dev/null +++ b/queue-6.1/net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch @@ -0,0 +1,41 @@ +From a2043cff303930c4223cdac9e06ca9fd4063fd42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 20:46:17 +0300 +Subject: net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe + +From: Erick Karanja + +[ Upstream commit 521405cb54cd2812bbb6dedd5afc14bca1e7e98a ] + +Add missing of_node_put call to release device node tbi obtained +via for_each_child_of_node. + +Fixes: afae5ad78b342 ("net/fsl_pq_mdio: streamline probing of MDIO nodes") +Signed-off-by: Erick Karanja +Link: https://patch.msgid.link/20251002174617.960521-1-karanja99erick@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c +index 9d58d83344670..ea49b0df397e5 100644 +--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c ++++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c +@@ -482,10 +482,12 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev) + "missing 'reg' property in node %pOF\n", + tbi); + err = -EBUSY; ++ of_node_put(tbi); + goto error; + } + set_tbipa(*prop, pdev, + data->get_tbipa, priv->map, &res); ++ of_node_put(tbi); + } + } + +-- +2.51.0 + diff --git a/queue-6.1/net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch b/queue-6.1/net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch new file mode 100644 index 0000000000..aedff86b10 --- /dev/null +++ b/queue-6.1/net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch @@ -0,0 +1,41 @@ +From 742629eab31b39f2334448c325d2e1ae6429a70f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 15:25:01 +0300 +Subject: net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() + +From: Dan Carpenter + +[ Upstream commit 4f0d91ba72811fd5dd577bcdccd7fed649aae62c ] + +Print "entry->mac" before freeing "entry". The "entry" pointer is +freed with kfree_rcu() so it's unlikely that we would trigger this +in real life, but it's safer to re-order it. + +Fixes: cc5387f7346a ("net/mlx4_en: Add unicast MAC filtering") +Signed-off-by: Dan Carpenter +Reviewed-by: Tariq Toukan +Link: https://patch.msgid.link/aNvMHX4g8RksFFvV@stanley.mountain +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +index ca4b93a010346..e66f77af677cf 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +@@ -1177,9 +1177,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv, + mlx4_unregister_mac(mdev->dev, priv->port, mac); + + hlist_del_rcu(&entry->hlist); +- kfree_rcu(entry, rcu); + en_dbg(DRV, priv, "Removed MAC %pM on port:%d\n", + entry->mac, priv->port); ++ kfree_rcu(entry, rcu); + ++removed; + } + } +-- +2.51.0 + diff --git a/queue-6.1/net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch b/queue-6.1/net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch new file mode 100644 index 0000000000..74478c2fa4 --- /dev/null +++ b/queue-6.1/net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch @@ -0,0 +1,42 @@ +From 3646afdb3b2a183b587b995da24ab57a35ada601 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 12:14:47 +0300 +Subject: net/sctp: fix a null dereference in sctp_disposition + sctp_sf_do_5_1D_ce() + +From: Alexandr Sapozhnikov + +[ Upstream commit 2f3119686ef50319490ccaec81a575973da98815 ] + +If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 +and sctp_ulpevent_make_authkey() returns 0, then the variable +ai_ev remains zero and the zero will be dereferenced +in the sctp_ulpevent_free() function. + +Signed-off-by: Alexandr Sapozhnikov +Acked-by: Xin Long +Fixes: 30f6ebf65bc4 ("sctp: add SCTP_AUTH_NO_AUTH type for AUTHENTICATION_EVENT") +Link: https://patch.msgid.link/20251002091448.11-1-alsp705@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sctp/sm_statefuns.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index 4848d5d50a5f5..1ca9073c95835 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -885,7 +885,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net, + return SCTP_DISPOSITION_CONSUME; + + nomem_authev: +- sctp_ulpevent_free(ai_ev); ++ if (ai_ev) ++ sctp_ulpevent_free(ai_ev); + nomem_aiev: + sctp_ulpevent_free(ev); + nomem_ev: +-- +2.51.0 + diff --git a/queue-6.1/perf-arm-spe-refactor-arm-spe-to-support-operation-p.patch b/queue-6.1/perf-arm-spe-refactor-arm-spe-to-support-operation-p.patch new file mode 100644 index 0000000000..7737279c9d --- /dev/null +++ b/queue-6.1/perf-arm-spe-refactor-arm-spe-to-support-operation-p.patch @@ -0,0 +1,183 @@ +From 1045187a5f9e3ba99f7ad96430f0f84a46a987b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 15:15:06 +0000 +Subject: perf arm-spe: Refactor arm-spe to support operation packet type + +From: German Gomez + +[ Upstream commit 0066015a3d8f9c01a17eb04579edba7dac9510af ] + +Extend the decoder of Arm SPE records to support more fields from the +operation packet type. + +Not all fields are being decoded by this commit. Only those needed to +support the use-case SVE load/store/other operations. + +Suggested-by: Leo Yan +Signed-off-by: German Gomez +Acked-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Anshuman.Khandual@arm.com +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: John Garry +Cc: Mark Rutland +Cc: Mike Leach +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Will Deacon +Cc: linux-arm-kernel@lists.infradead.org +Link: https://lore.kernel.org/r/20230320151509.1137462-2-james.clark@arm.com +Signed-off-by: James Clark +Signed-off-by: Arnaldo Carvalho de Melo +Stable-dep-of: cb300e351505 ("perf arm_spe: Correct memory level for remote access") +Signed-off-by: Sasha Levin +--- + .../util/arm-spe-decoder/arm-spe-decoder.c | 30 ++++++++++-- + .../util/arm-spe-decoder/arm-spe-decoder.h | 47 +++++++++++++++---- + tools/perf/util/arm-spe.c | 8 ++-- + 3 files changed, 67 insertions(+), 18 deletions(-) + +diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c +index 091987dd39668..709d3f6b58c68 100644 +--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c ++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c +@@ -186,11 +186,27 @@ static int arm_spe_read_record(struct arm_spe_decoder *decoder) + decoder->record.context_id = payload; + break; + case ARM_SPE_OP_TYPE: +- if (idx == SPE_OP_PKT_HDR_CLASS_LD_ST_ATOMIC) { +- if (payload & 0x1) +- decoder->record.op = ARM_SPE_ST; ++ switch (idx) { ++ case SPE_OP_PKT_HDR_CLASS_LD_ST_ATOMIC: ++ decoder->record.op |= ARM_SPE_OP_LDST; ++ if (payload & SPE_OP_PKT_ST) ++ decoder->record.op |= ARM_SPE_OP_ST; + else +- decoder->record.op = ARM_SPE_LD; ++ decoder->record.op |= ARM_SPE_OP_LD; ++ if (SPE_OP_PKT_IS_LDST_SVE(payload)) ++ decoder->record.op |= ARM_SPE_OP_SVE_LDST; ++ break; ++ case SPE_OP_PKT_HDR_CLASS_OTHER: ++ decoder->record.op |= ARM_SPE_OP_OTHER; ++ if (SPE_OP_PKT_IS_OTHER_SVE_OP(payload)) ++ decoder->record.op |= ARM_SPE_OP_SVE_OTHER; ++ break; ++ case SPE_OP_PKT_HDR_CLASS_BR_ERET: ++ decoder->record.op |= ARM_SPE_OP_BRANCH_ERET; ++ break; ++ default: ++ pr_err("Get packet error!\n"); ++ return -1; + } + break; + case ARM_SPE_EVENTS: +@@ -218,6 +234,12 @@ static int arm_spe_read_record(struct arm_spe_decoder *decoder) + if (payload & BIT(EV_MISPRED)) + decoder->record.type |= ARM_SPE_BRANCH_MISS; + ++ if (payload & BIT(EV_PARTIAL_PREDICATE)) ++ decoder->record.type |= ARM_SPE_SVE_PARTIAL_PRED; ++ ++ if (payload & BIT(EV_EMPTY_PREDICATE)) ++ decoder->record.type |= ARM_SPE_SVE_EMPTY_PRED; ++ + break; + case ARM_SPE_DATA_SOURCE: + decoder->record.source = payload; +diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +index 46a61df1145b6..1443c28545a94 100644 +--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h ++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +@@ -14,19 +14,46 @@ + #include "arm-spe-pkt-decoder.h" + + enum arm_spe_sample_type { +- ARM_SPE_L1D_ACCESS = 1 << 0, +- ARM_SPE_L1D_MISS = 1 << 1, +- ARM_SPE_LLC_ACCESS = 1 << 2, +- ARM_SPE_LLC_MISS = 1 << 3, +- ARM_SPE_TLB_ACCESS = 1 << 4, +- ARM_SPE_TLB_MISS = 1 << 5, +- ARM_SPE_BRANCH_MISS = 1 << 6, +- ARM_SPE_REMOTE_ACCESS = 1 << 7, ++ ARM_SPE_L1D_ACCESS = 1 << 0, ++ ARM_SPE_L1D_MISS = 1 << 1, ++ ARM_SPE_LLC_ACCESS = 1 << 2, ++ ARM_SPE_LLC_MISS = 1 << 3, ++ ARM_SPE_TLB_ACCESS = 1 << 4, ++ ARM_SPE_TLB_MISS = 1 << 5, ++ ARM_SPE_BRANCH_MISS = 1 << 6, ++ ARM_SPE_REMOTE_ACCESS = 1 << 7, ++ ARM_SPE_SVE_PARTIAL_PRED = 1 << 8, ++ ARM_SPE_SVE_EMPTY_PRED = 1 << 9, + }; + + enum arm_spe_op_type { +- ARM_SPE_LD = 1 << 0, +- ARM_SPE_ST = 1 << 1, ++ /* First level operation type */ ++ ARM_SPE_OP_OTHER = 1 << 0, ++ ARM_SPE_OP_LDST = 1 << 1, ++ ARM_SPE_OP_BRANCH_ERET = 1 << 2, ++ ++ /* Second level operation type for OTHER */ ++ ARM_SPE_OP_SVE_OTHER = 1 << 16, ++ ARM_SPE_OP_SVE_FP = 1 << 17, ++ ARM_SPE_OP_SVE_PRED_OTHER = 1 << 18, ++ ++ /* Second level operation type for LDST */ ++ ARM_SPE_OP_LD = 1 << 16, ++ ARM_SPE_OP_ST = 1 << 17, ++ ARM_SPE_OP_ATOMIC = 1 << 18, ++ ARM_SPE_OP_EXCL = 1 << 19, ++ ARM_SPE_OP_AR = 1 << 20, ++ ARM_SPE_OP_SIMD_FP = 1 << 21, ++ ARM_SPE_OP_GP_REG = 1 << 22, ++ ARM_SPE_OP_UNSPEC_REG = 1 << 23, ++ ARM_SPE_OP_NV_SYSREG = 1 << 24, ++ ARM_SPE_OP_SVE_LDST = 1 << 25, ++ ARM_SPE_OP_SVE_PRED_LDST = 1 << 26, ++ ARM_SPE_OP_SVE_SG = 1 << 27, ++ ++ /* Second level operation type for BRANCH_ERET */ ++ ARM_SPE_OP_BR_COND = 1 << 16, ++ ARM_SPE_OP_BR_INDIRECT = 1 << 17, + }; + + enum arm_spe_neoverse_data_source { +diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c +index 98e3c3fce05a2..9f0c4565bc5be 100644 +--- a/tools/perf/util/arm-spe.c ++++ b/tools/perf/util/arm-spe.c +@@ -411,7 +411,7 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec + * We have no data on the hit level or data source for stores in the + * Neoverse SPE records. + */ +- if (record->op & ARM_SPE_ST) { ++ if (record->op & ARM_SPE_OP_ST) { + data_src->mem_lvl = PERF_MEM_LVL_NA; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_NA; + data_src->mem_snoop = PERF_MEM_SNOOP_NA; +@@ -497,12 +497,12 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco + + static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr) + { +- union perf_mem_data_src data_src = { 0 }; ++ union perf_mem_data_src data_src = { .mem_op = PERF_MEM_OP_NA }; + bool is_neoverse = is_midr_in_range_list(midr, neoverse_spe); + +- if (record->op == ARM_SPE_LD) ++ if (record->op & ARM_SPE_OP_LD) + data_src.mem_op = PERF_MEM_OP_LOAD; +- else if (record->op == ARM_SPE_ST) ++ else if (record->op & ARM_SPE_OP_ST) + data_src.mem_op = PERF_MEM_OP_STORE; + else + return 0; +-- +2.51.0 + diff --git a/queue-6.1/perf-arm-spe-rename-the-common-data-source-encoding.patch b/queue-6.1/perf-arm-spe-rename-the-common-data-source-encoding.patch new file mode 100644 index 0000000000..27f142ee54 --- /dev/null +++ b/queue-6.1/perf-arm-spe-rename-the-common-data-source-encoding.patch @@ -0,0 +1,158 @@ +From e47e4690e3e4cd34c555a9a1b29d8292adb68846 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Oct 2024 19:53:17 +0100 +Subject: perf arm-spe: Rename the common data source encoding + +From: Leo Yan + +[ Upstream commit 50b8f1d5bf4ad7f09ef8012ccf5f94f741df827b ] + +The Neoverse CPUs follow the common data source encoding, and other +CPU variants can share the same format. + +Rename the CPU list and data source definitions as common data source +names. This change prepares for appending more CPU variants. + +Signed-off-by: Leo Yan +Reviewed-by: James Clark +Link: https://lore.kernel.org/r/20241003185322.192357-3-leo.yan@arm.com +Signed-off-by: Namhyung Kim +Stable-dep-of: cb300e351505 ("perf arm_spe: Correct memory level for remote access") +Signed-off-by: Sasha Levin +--- + .../util/arm-spe-decoder/arm-spe-decoder.h | 18 ++++++------ + tools/perf/util/arm-spe.c | 28 +++++++++---------- + 2 files changed, 23 insertions(+), 23 deletions(-) + +diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +index 1443c28545a94..358c611eeddbb 100644 +--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h ++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +@@ -56,15 +56,15 @@ enum arm_spe_op_type { + ARM_SPE_OP_BR_INDIRECT = 1 << 17, + }; + +-enum arm_spe_neoverse_data_source { +- ARM_SPE_NV_L1D = 0x0, +- ARM_SPE_NV_L2 = 0x8, +- ARM_SPE_NV_PEER_CORE = 0x9, +- ARM_SPE_NV_LOCAL_CLUSTER = 0xa, +- ARM_SPE_NV_SYS_CACHE = 0xb, +- ARM_SPE_NV_PEER_CLUSTER = 0xc, +- ARM_SPE_NV_REMOTE = 0xd, +- ARM_SPE_NV_DRAM = 0xe, ++enum arm_spe_common_data_source { ++ ARM_SPE_COMMON_DS_L1D = 0x0, ++ ARM_SPE_COMMON_DS_L2 = 0x8, ++ ARM_SPE_COMMON_DS_PEER_CORE = 0x9, ++ ARM_SPE_COMMON_DS_LOCAL_CLUSTER = 0xa, ++ ARM_SPE_COMMON_DS_SYS_CACHE = 0xb, ++ ARM_SPE_COMMON_DS_PEER_CLUSTER = 0xc, ++ ARM_SPE_COMMON_DS_REMOTE = 0xd, ++ ARM_SPE_COMMON_DS_DRAM = 0xe, + }; + + struct arm_spe_record { +diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c +index 9f0c4565bc5be..36f03d532d5bc 100644 +--- a/tools/perf/util/arm-spe.c ++++ b/tools/perf/util/arm-spe.c +@@ -389,15 +389,15 @@ static int arm_spe__synth_instruction_sample(struct arm_spe_queue *speq, + return arm_spe_deliver_synth_event(spe, speq, event, &sample); + } + +-static const struct midr_range neoverse_spe[] = { ++static const struct midr_range common_ds_encoding_cpus[] = { + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), + {}, + }; + +-static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *record, +- union perf_mem_data_src *data_src) ++static void arm_spe__synth_data_source_common(const struct arm_spe_record *record, ++ union perf_mem_data_src *data_src) + { + /* + * Even though four levels of cache hierarchy are possible, no known +@@ -419,17 +419,17 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec + } + + switch (record->source) { +- case ARM_SPE_NV_L1D: ++ case ARM_SPE_COMMON_DS_L1D: + data_src->mem_lvl = PERF_MEM_LVL_L1 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L1; + data_src->mem_snoop = PERF_MEM_SNOOP_NONE; + break; +- case ARM_SPE_NV_L2: ++ case ARM_SPE_COMMON_DS_L2: + data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2; + data_src->mem_snoop = PERF_MEM_SNOOP_NONE; + break; +- case ARM_SPE_NV_PEER_CORE: ++ case ARM_SPE_COMMON_DS_PEER_CORE: + data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; +@@ -438,8 +438,8 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec + * We don't know if this is L1, L2 but we do know it was a cache-2-cache + * transfer, so set SNOOPX_PEER + */ +- case ARM_SPE_NV_LOCAL_CLUSTER: +- case ARM_SPE_NV_PEER_CLUSTER: ++ case ARM_SPE_COMMON_DS_LOCAL_CLUSTER: ++ case ARM_SPE_COMMON_DS_PEER_CLUSTER: + data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; +@@ -447,7 +447,7 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec + /* + * System cache is assumed to be L3 + */ +- case ARM_SPE_NV_SYS_CACHE: ++ case ARM_SPE_COMMON_DS_SYS_CACHE: + data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3; + data_src->mem_snoop = PERF_MEM_SNOOP_HIT; +@@ -456,13 +456,13 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec + * We don't know what level it hit in, except it came from the other + * socket + */ +- case ARM_SPE_NV_REMOTE: ++ case ARM_SPE_COMMON_DS_REMOTE: + data_src->mem_lvl = PERF_MEM_LVL_REM_CCE1; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_ANY_CACHE; + data_src->mem_remote = PERF_MEM_REMOTE_REMOTE; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; + break; +- case ARM_SPE_NV_DRAM: ++ case ARM_SPE_COMMON_DS_DRAM: + data_src->mem_lvl = PERF_MEM_LVL_LOC_RAM | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_RAM; + data_src->mem_snoop = PERF_MEM_SNOOP_NONE; +@@ -498,7 +498,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco + static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr) + { + union perf_mem_data_src data_src = { .mem_op = PERF_MEM_OP_NA }; +- bool is_neoverse = is_midr_in_range_list(midr, neoverse_spe); ++ bool is_common = is_midr_in_range_list(midr, common_ds_encoding_cpus); + + if (record->op & ARM_SPE_OP_LD) + data_src.mem_op = PERF_MEM_OP_LOAD; +@@ -507,8 +507,8 @@ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 m + else + return 0; + +- if (is_neoverse) +- arm_spe__synth_data_source_neoverse(record, &data_src); ++ if (is_common) ++ arm_spe__synth_data_source_common(record, &data_src); + else + arm_spe__synth_data_source_generic(record, &data_src); + +-- +2.51.0 + diff --git a/queue-6.1/perf-arm_spe-correct-memory-level-for-remote-access.patch b/queue-6.1/perf-arm_spe-correct-memory-level-for-remote-access.patch new file mode 100644 index 0000000000..0d9b9df100 --- /dev/null +++ b/queue-6.1/perf-arm_spe-correct-memory-level-for-remote-access.patch @@ -0,0 +1,49 @@ +From 5bc81ff3190ae04b9e75e4eb05fd14000cda3375 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 16:42:09 +0100 +Subject: perf arm_spe: Correct memory level for remote access + +From: Leo Yan + +[ Upstream commit cb300e3515057fb555983ce47e8acc86a5c69c3c ] + +For remote accesses, the data source packet does not contain information +about the memory level. To avoid misinformation, set the memory level to +NA (Not Available). + +Fixes: 4e6430cbb1a9f1dc ("perf arm-spe: Use SPE data source for neoverse cores") +Reviewed-by: James Clark +Signed-off-by: Leo Yan +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ali Saidi +Cc: German Gomez +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Will Deacon +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/arm-spe.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c +index 36f03d532d5bc..383eda614f5c4 100644 +--- a/tools/perf/util/arm-spe.c ++++ b/tools/perf/util/arm-spe.c +@@ -457,8 +457,8 @@ static void arm_spe__synth_data_source_common(const struct arm_spe_record *recor + * socket + */ + case ARM_SPE_COMMON_DS_REMOTE: +- data_src->mem_lvl = PERF_MEM_LVL_REM_CCE1; +- data_src->mem_lvl_num = PERF_MEM_LVLNUM_ANY_CACHE; ++ data_src->mem_lvl = PERF_MEM_LVL_NA; ++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_NA; + data_src->mem_remote = PERF_MEM_REMOTE_REMOTE; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; + break; +-- +2.51.0 + diff --git a/queue-6.1/perf-arm_spe-correct-setting-remote-access.patch b/queue-6.1/perf-arm_spe-correct-setting-remote-access.patch new file mode 100644 index 0000000000..df9e4b8dc5 --- /dev/null +++ b/queue-6.1/perf-arm_spe-correct-setting-remote-access.patch @@ -0,0 +1,46 @@ +From 3ce4f35a8129659eb3ea3d3113a78841eb2e4de5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 16:42:08 +0100 +Subject: perf arm_spe: Correct setting remote access + +From: Leo Yan + +[ Upstream commit 039fd0634a0629132432632d7ac9a14915406b5c ] + +Set the mem_remote field for a remote access to appropriately represent +the event. + +Fixes: a89dbc9b988f3ba8 ("perf arm-spe: Set sample's data source field") +Reviewed-by: James Clark +Signed-off-by: Leo Yan +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ali Saidi +Cc: German Gomez +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Will Deacon +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/arm-spe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c +index 906476a839e1f..98e3c3fce05a2 100644 +--- a/tools/perf/util/arm-spe.c ++++ b/tools/perf/util/arm-spe.c +@@ -492,7 +492,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco + } + + if (record->type & ARM_SPE_REMOTE_ACCESS) +- data_src->mem_lvl |= PERF_MEM_LVL_REM_CCE1; ++ data_src->mem_remote = PERF_MEM_REMOTE_REMOTE; + } + + static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr) +-- +2.51.0 + diff --git a/queue-6.1/perf-evsel-avoid-container_of-on-a-null-leader.patch b/queue-6.1/perf-evsel-avoid-container_of-on-a-null-leader.patch new file mode 100644 index 0000000000..b819b88464 --- /dev/null +++ b/queue-6.1/perf-evsel-avoid-container_of-on-a-null-leader.patch @@ -0,0 +1,59 @@ +From f2f6cbd9583284265c973eeeb79d131deaa060f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:17 -0700 +Subject: perf evsel: Avoid container_of on a NULL leader + +From: Ian Rogers + +[ Upstream commit 2354479026d726954ff86ce82f4b649637319661 ] + +An evsel should typically have a leader of itself, however, in tests +like 'Sample parsing' a NULL leader may occur and the container_of +will return a corrupt pointer. + +Avoid this with an explicit NULL test. + +Fixes: fba7c86601e2e42d ("libperf: Move 'leader' from tools/perf to perf_evsel::leader") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Acked-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Blake Jones +Cc: Chun-Tse Shao +Cc: Collin Funk +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jan Polensky +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Li Huafei +Cc: Mark Rutland +Cc: Nam Cao +Cc: Peter Zijlstra +Cc: Steinar H. Gunderson +Cc: Thomas Gleixner +Link: https://lore.kernel.org/r/20250821163820.1132977-4-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/evsel.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index 22969cc00a5fc..755da242f2670 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -3146,6 +3146,8 @@ bool evsel__is_hybrid(struct evsel *evsel) + + struct evsel *evsel__leader(struct evsel *evsel) + { ++ if (evsel->core.leader == NULL) ++ return NULL; + return container_of(evsel->core.leader, struct evsel, core); + } + +-- +2.51.0 + diff --git a/queue-6.1/perf-session-fix-handling-when-buffer-exceeds-2-gib.patch b/queue-6.1/perf-session-fix-handling-when-buffer-exceeds-2-gib.patch new file mode 100644 index 0000000000..f078ce8393 --- /dev/null +++ b/queue-6.1/perf-session-fix-handling-when-buffer-exceeds-2-gib.patch @@ -0,0 +1,53 @@ +From 300182fa1514641f330551b1b36de135e06df005 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Aug 2025 14:24:40 +0100 +Subject: perf session: Fix handling when buffer exceeds 2 GiB +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leo Yan + +[ Upstream commit c17dda8013495d8132c976cbf349be9949d0fbd1 ] + +If a user specifies an AUX buffer larger than 2 GiB, the returned size +may exceed 0x80000000. Since the err variable is defined as a signed +32-bit integer, such a value overflows and becomes negative. + +As a result, the perf record command reports an error: + + 0x146e8 [0x30]: failed to process type: 71 [Unknown error 183711232] + +Change the type of the err variable to a signed 64-bit integer to +accommodate large buffer sizes correctly. + +Fixes: d5652d865ea734a1 ("perf session: Add ability to skip 4GiB or more") +Reported-by: Tamas Zsoldos +Signed-off-by: Leo Yan +Acked-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Jiri Olsa +Link: https://lore.kernel.org/r/20250808-perf_fix_big_buffer_size-v1-1-45f45444a9a4@arm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/session.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c +index c8f7634f9846c..1c4d124b10531 100644 +--- a/tools/perf/util/session.c ++++ b/tools/perf/util/session.c +@@ -1658,7 +1658,7 @@ static s64 perf_session__process_user_event(struct perf_session *session, + struct perf_tool *tool = session->tool; + struct perf_sample sample = { .time = 0, }; + int fd = perf_data__fd(session->data); +- int err; ++ s64 err; + + if (event->header.type != PERF_RECORD_COMPRESSED || + tool->compressed == perf_session__process_compressed_event_stub) +-- +2.51.0 + diff --git a/queue-6.1/perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch b/queue-6.1/perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch new file mode 100644 index 0000000000..0f6a5930a3 --- /dev/null +++ b/queue-6.1/perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch @@ -0,0 +1,202 @@ +From 52673f839027ea46c1df1cf53f4a2ed6db504c9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 15:22:00 -0700 +Subject: perf test: Don't leak workload gopipe in PERF_RECORD_* + +From: Ian Rogers + +[ Upstream commit 48918cacefd226af44373e914e63304927c0e7dc ] + +The test starts a workload and then opens events. If the events fail +to open, for example because of perf_event_paranoid, the gopipe of the +workload is leaked and the file descriptor leak check fails when the +test exits. To avoid this cancel the workload when opening the events +fails. + +Before: +``` +$ perf test -vv 7 + 7: PERF_RECORD_* events & perf_sample fields: + --- start --- +test child forked, pid 1189568 +Using CPUID GenuineIntel-6-B7-1 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 +sys_perf_event_open failed, error -13 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + exclude_kernel 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 +sys_perf_event_open failed, error -13 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + exclude_kernel 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3 +Attempt to add: software/cpu-clock/ +..after resolving event: software/config=0/ +cpu-clock -> software/cpu-clock/ + ------------------------------------------------------------ +perf_event_attr: + type 1 (PERF_TYPE_SOFTWARE) + size 136 + config 0x9 (PERF_COUNT_SW_DUMMY) + sample_type IP|TID|TIME|CPU + read_format ID|LOST + disabled 1 + inherit 1 + mmap 1 + comm 1 + enable_on_exec 1 + task 1 + sample_id_all 1 + mmap2 1 + comm_exec 1 + ksymbol 1 + bpf_event 1 + { wakeup_events, wakeup_watermark } 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 1189569 cpu 0 group_fd -1 flags 0x8 +sys_perf_event_open failed, error -13 +perf_evlist__open: Permission denied + ---- end(-2) ---- +Leak of file descriptor 6 that opened: 'pipe:[14200347]' + ---- unexpected signal (6) ---- +iFailed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon + #0 0x565358f6666e in child_test_sig_handler builtin-test.c:311 + #1 0x7f29ce849df0 in __restore_rt libc_sigaction.c:0 + #2 0x7f29ce89e95c in __pthread_kill_implementation pthread_kill.c:44 + #3 0x7f29ce849cc2 in raise raise.c:27 + #4 0x7f29ce8324ac in abort abort.c:81 + #5 0x565358f662d4 in check_leaks builtin-test.c:226 + #6 0x565358f6682e in run_test_child builtin-test.c:344 + #7 0x565358ef7121 in start_command run-command.c:128 + #8 0x565358f67273 in start_test builtin-test.c:545 + #9 0x565358f6771d in __cmd_test builtin-test.c:647 + #10 0x565358f682bd in cmd_test builtin-test.c:849 + #11 0x565358ee5ded in run_builtin perf.c:349 + #12 0x565358ee6085 in handle_internal_command perf.c:401 + #13 0x565358ee61de in run_argv perf.c:448 + #14 0x565358ee6527 in main perf.c:555 + #15 0x7f29ce833ca8 in __libc_start_call_main libc_start_call_main.h:74 + #16 0x7f29ce833d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128 + #17 0x565358e391c1 in _start perf[851c1] + 7: PERF_RECORD_* events & perf_sample fields : FAILED! +``` + +After: +``` +$ perf test 7 + 7: PERF_RECORD_* events & perf_sample fields : Skip (permissions) +``` + +Fixes: 16d00fee703866c6 ("perf tests: Move test__PERF_RECORD into separate object") +Signed-off-by: Ian Rogers +Tested-by: Arnaldo Carvalho de Melo +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Chun-Tse Shao +Cc: Howard Chu +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/perf-record.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/tools/perf/tests/perf-record.c b/tools/perf/tests/perf-record.c +index 7aa946aa886de..c410ce87323b0 100644 +--- a/tools/perf/tests/perf-record.c ++++ b/tools/perf/tests/perf-record.c +@@ -113,6 +113,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest + if (err < 0) { + pr_debug("sched__get_first_possible_cpu: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +@@ -124,6 +125,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest + if (sched_setaffinity(evlist->workload.pid, cpu_mask_size, &cpu_mask) < 0) { + pr_debug("sched_setaffinity: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +@@ -135,6 +137,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest + if (err < 0) { + pr_debug("perf_evlist__open: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +@@ -147,6 +150,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest + if (err < 0) { + pr_debug("evlist__mmap: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +-- +2.51.0 + diff --git a/queue-6.1/perf-util-fix-compression-checks-returning-1-as-bool.patch b/queue-6.1/perf-util-fix-compression-checks-returning-1-as-bool.patch new file mode 100644 index 0000000000..48ed467075 --- /dev/null +++ b/queue-6.1/perf-util-fix-compression-checks-returning-1-as-bool.patch @@ -0,0 +1,67 @@ +From e3897524845934cc23c0f1bb22d43afd6841a63f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 16:25:08 +0000 +Subject: perf util: Fix compression checks returning -1 as bool + +From: Yunseong Kim + +[ Upstream commit 43fa1141e2c1af79c91aaa4df03e436c415a6fc3 ] + +The lzma_is_compressed and gzip_is_compressed functions are declared +to return a "bool" type, but in case of an error (e.g., file open +failure), they incorrectly returned -1. + +A bool type is a boolean value that is either true or false. +Returning -1 for a bool return type can lead to unexpected behavior +and may violate strict type-checking in some compilers. + +Fix the return value to be false in error cases, ensuring the function +adheres to its declared return type improves for preventing potential +bugs related to type mismatch. + +Fixes: 4b57fd44b61beb51 ("perf tools: Add lzma_is_compressed function") +Reviewed-by: Ian Rogers +Signed-off-by: Yunseong Kim +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Namhyung Kim +Cc: Stephen Brennan +Link: https://lore.kernel.org/r/20250822162506.316844-3-ysk@kzalloc.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/lzma.c | 2 +- + tools/perf/util/zlib.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/lzma.c b/tools/perf/util/lzma.c +index 51424cdc3b682..aa9a0ebc1f937 100644 +--- a/tools/perf/util/lzma.c ++++ b/tools/perf/util/lzma.c +@@ -115,7 +115,7 @@ bool lzma_is_compressed(const char *input) + ssize_t rc; + + if (fd < 0) +- return -1; ++ return false; + + rc = read(fd, buf, sizeof(buf)); + close(fd); +diff --git a/tools/perf/util/zlib.c b/tools/perf/util/zlib.c +index 78d2297c1b674..1f7c065230599 100644 +--- a/tools/perf/util/zlib.c ++++ b/tools/perf/util/zlib.c +@@ -88,7 +88,7 @@ bool gzip_is_compressed(const char *input) + ssize_t rc; + + if (fd < 0) +- return -1; ++ return false; + + rc = read(fd, buf, sizeof(buf)); + close(fd); +-- +2.51.0 + diff --git a/queue-6.1/rtc-optee-fix-memory-leak-on-driver-removal.patch b/queue-6.1/rtc-optee-fix-memory-leak-on-driver-removal.patch new file mode 100644 index 0000000000..1061769467 --- /dev/null +++ b/queue-6.1/rtc-optee-fix-memory-leak-on-driver-removal.patch @@ -0,0 +1,40 @@ +From a58d505536283496e90d4e8c57c36599cd358daa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Jul 2025 16:07:13 +0200 +Subject: rtc: optee: fix memory leak on driver removal +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Le Goffic + +[ Upstream commit a531350d2fe58f7fc4516e555f22391dee94efd9 ] + +Fix a memory leak in case of driver removal. +Free the shared memory used for arguments exchanges between kernel and +OP-TEE RTC PTA. + +Fixes: 81c2f059ab90 ("rtc: optee: add RTC driver for OP-TEE RTC PTA") +Signed-off-by: Clément Le Goffic +Link: https://lore.kernel.org/r/20250715-upstream-optee-rtc-v1-1-e0fdf8aae545@foss.st.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-optee.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/rtc/rtc-optee.c b/drivers/rtc/rtc-optee.c +index 9f8b5d4a8f6b6..6b77c122fdc10 100644 +--- a/drivers/rtc/rtc-optee.c ++++ b/drivers/rtc/rtc-optee.c +@@ -320,6 +320,7 @@ static int optee_rtc_remove(struct device *dev) + { + struct optee_rtc *priv = dev_get_drvdata(dev); + ++ tee_shm_free(priv->shm); + tee_client_close_session(priv->ctx, priv->session_id); + tee_client_close_context(priv->ctx); + +-- +2.51.0 + diff --git a/queue-6.1/rtc-x1205-fix-xicor-x1205-vendor-prefix.patch b/queue-6.1/rtc-x1205-fix-xicor-x1205-vendor-prefix.patch new file mode 100644 index 0000000000..46449a338d --- /dev/null +++ b/queue-6.1/rtc-x1205-fix-xicor-x1205-vendor-prefix.patch @@ -0,0 +1,39 @@ +From 43d3e442bdf992564be2978b58929eeda46abc19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 16:57:02 -0500 +Subject: rtc: x1205: Fix Xicor X1205 vendor prefix + +From: Rob Herring (Arm) + +[ Upstream commit 606d19ee37de3a72f1b6e95a4ea544f6f20dbb46 ] + +The vendor for the X1205 RTC is not Xircom, but Xicor which was acquired +by Intersil. Since the I2C subsystem drops the vendor prefix for driver +matching, the vendor prefix hasn't mattered. + +Fixes: 6875404fdb44 ("rtc: x1205: Add DT probing support") +Signed-off-by: Rob Herring (Arm) +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20250821215703.869628-2-robh@kernel.org +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-x1205.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-x1205.c b/drivers/rtc/rtc-x1205.c +index f587afa843573..6ae7b6f1f3167 100644 +--- a/drivers/rtc/rtc-x1205.c ++++ b/drivers/rtc/rtc-x1205.c +@@ -669,7 +669,7 @@ static const struct i2c_device_id x1205_id[] = { + MODULE_DEVICE_TABLE(i2c, x1205_id); + + static const struct of_device_id x1205_dt_ids[] = { +- { .compatible = "xircom,x1205", }, ++ { .compatible = "xicor,x1205", }, + {}, + }; + MODULE_DEVICE_TABLE(of, x1205_dt_ids); +-- +2.51.0 + diff --git a/queue-6.1/s390-cio-update-purge-function-to-unregister-the-unu.patch b/queue-6.1/s390-cio-update-purge-function-to-unregister-the-unu.patch new file mode 100644 index 0000000000..d4cc914059 --- /dev/null +++ b/queue-6.1/s390-cio-update-purge-function-to-unregister-the-unu.patch @@ -0,0 +1,96 @@ +From 39fe5b5fd2e22570728839a83d642a6d1dc04eef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 15:38:17 +0200 +Subject: s390/cio: Update purge function to unregister the unused subchannels + +From: Vineeth Vijayan + +[ Upstream commit 9daa5a8795865f9a3c93d8d1066785b07ded6073 ] + +Starting with 'commit 2297791c92d0 ("s390/cio: dont unregister +subchannel from child-drivers")', cio no longer unregisters +subchannels when the attached device is invalid or unavailable. + +As an unintended side-effect, the cio_ignore purge function no longer +removes subchannels for devices on the cio_ignore list if no CCW device +is attached. This situation occurs when a CCW device is non-operational +or unavailable + +To ensure the same outcome of the purge function as when the +current cio_ignore list had been active during boot, update the purge +function to remove I/O subchannels without working CCW devices if the +associated device number is found on the cio_ignore list. + +Fixes: 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers") +Suggested-by: Peter Oberparleiter +Reviewed-by: Peter Oberparleiter +Signed-off-by: Vineeth Vijayan +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/device.c | 37 ++++++++++++++++++++++++------------- + 1 file changed, 24 insertions(+), 13 deletions(-) + +diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c +index bdf5a50bd931d..c3cb73cbd0fc3 100644 +--- a/drivers/s390/cio/device.c ++++ b/drivers/s390/cio/device.c +@@ -1309,23 +1309,34 @@ void ccw_device_schedule_recovery(void) + spin_unlock_irqrestore(&recovery_lock, flags); + } + +-static int purge_fn(struct device *dev, void *data) ++static int purge_fn(struct subchannel *sch, void *data) + { +- struct ccw_device *cdev = to_ccwdev(dev); +- struct ccw_dev_id *id = &cdev->private->dev_id; +- struct subchannel *sch = to_subchannel(cdev->dev.parent); ++ struct ccw_device *cdev; + +- spin_lock_irq(cdev->ccwlock); +- if (is_blacklisted(id->ssid, id->devno) && +- (cdev->private->state == DEV_STATE_OFFLINE) && +- (atomic_cmpxchg(&cdev->private->onoff, 0, 1) == 0)) { +- CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x\n", id->ssid, +- id->devno); ++ spin_lock_irq(&sch->lock); ++ if (sch->st != SUBCHANNEL_TYPE_IO || !sch->schib.pmcw.dnv) ++ goto unlock; ++ ++ if (!is_blacklisted(sch->schid.ssid, sch->schib.pmcw.dev)) ++ goto unlock; ++ ++ cdev = sch_get_cdev(sch); ++ if (cdev) { ++ if (cdev->private->state != DEV_STATE_OFFLINE) ++ goto unlock; ++ ++ if (atomic_cmpxchg(&cdev->private->onoff, 0, 1) != 0) ++ goto unlock; + ccw_device_sched_todo(cdev, CDEV_TODO_UNREG); +- css_sched_sch_todo(sch, SCH_TODO_UNREG); + atomic_set(&cdev->private->onoff, 0); + } +- spin_unlock_irq(cdev->ccwlock); ++ ++ css_sched_sch_todo(sch, SCH_TODO_UNREG); ++ CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x%s\n", sch->schid.ssid, ++ sch->schib.pmcw.dev, cdev ? "" : " (no cdev)"); ++ ++unlock: ++ spin_unlock_irq(&sch->lock); + /* Abort loop in case of pending signal. */ + if (signal_pending(current)) + return -EINTR; +@@ -1341,7 +1352,7 @@ static int purge_fn(struct device *dev, void *data) + int ccw_purge_blacklisted(void) + { + CIO_MSG_EVENT(2, "ccw: purging blacklisted devices\n"); +- bus_for_each_dev(&ccw_bus_type, NULL, NULL, purge_fn); ++ for_each_subchannel_staged(purge_fn, NULL, NULL); + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.1/scsi-libsas-add-sas_task_find_rq.patch b/queue-6.1/scsi-libsas-add-sas_task_find_rq.patch new file mode 100644 index 0000000000..85dbf04f21 --- /dev/null +++ b/queue-6.1/scsi-libsas-add-sas_task_find_rq.patch @@ -0,0 +1,59 @@ +From 1a390a6bf30d6ddef5a6524b50f8378ca907efb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 19:15:57 +0800 +Subject: scsi: libsas: Add sas_task_find_rq() + +From: John Garry + +[ Upstream commit a9ee3f840646e2ec419c734e592ffe997195435e ] + +blk-mq already provides a unique tag per request. Some libsas LLDDs - like +hisi_sas - already use this tag as the unique per-I/O HW tag. + +Add a common function to provide the request associated with a sas_task for +all libsas LLDDs. + +Signed-off-by: John Garry +Link: https://lore.kernel.org/r/1666091763-11023-2-git-send-email-john.garry@huawei.com +Reviewed-by: Jack Wang +Reviewed-by: Jason Yan +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue") +Signed-off-by: Sasha Levin +--- + include/scsi/libsas.h | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h +index 2dbead74a2afe..9e9dff75a02bc 100644 +--- a/include/scsi/libsas.h ++++ b/include/scsi/libsas.h +@@ -648,6 +648,24 @@ static inline bool sas_is_internal_abort(struct sas_task *task) + return task->task_proto == SAS_PROTOCOL_INTERNAL_ABORT; + } + ++static inline struct request *sas_task_find_rq(struct sas_task *task) ++{ ++ struct scsi_cmnd *scmd; ++ ++ if (task->task_proto & SAS_PROTOCOL_STP_ALL) { ++ struct ata_queued_cmd *qc = task->uldd_task; ++ ++ scmd = qc ? qc->scsicmd : NULL; ++ } else { ++ scmd = task->uldd_task; ++ } ++ ++ if (!scmd) ++ return NULL; ++ ++ return scsi_cmd_to_rq(scmd); ++} ++ + struct sas_domain_function_template { + /* The class calls these to notify the LLDD of an event. */ + void (*lldd_port_formed)(struct asd_sas_phy *); +-- +2.51.0 + diff --git a/queue-6.1/scsi-mvsas-delete-mvs_tag_init.patch b/queue-6.1/scsi-mvsas-delete-mvs_tag_init.patch new file mode 100644 index 0000000000..301d425924 --- /dev/null +++ b/queue-6.1/scsi-mvsas-delete-mvs_tag_init.patch @@ -0,0 +1,72 @@ +From 1ba768044a2a195e8284462e75b76d357efbfba1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 19:16:02 +0800 +Subject: scsi: mvsas: Delete mvs_tag_init() + +From: John Garry + +[ Upstream commit ffc9f9bf3f14876d019f67ef17d41138802529a8 ] + +All mvs_tag_init() does is zero the tag bitmap, but this is already done +with the kzalloc() call to alloc the tags, so delete this unneeded +function. + +Signed-off-by: John Garry +Link: https://lore.kernel.org/r/1666091763-11023-7-git-send-email-john.garry@huawei.com +Reviewed-by: Damien Le Moal +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue") +Signed-off-by: Sasha Levin +--- + drivers/scsi/mvsas/mv_init.c | 2 -- + drivers/scsi/mvsas/mv_sas.c | 7 ------- + drivers/scsi/mvsas/mv_sas.h | 1 - + 3 files changed, 10 deletions(-) + +diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c +index 2fde496fff5f7..c85fb812ad437 100644 +--- a/drivers/scsi/mvsas/mv_init.c ++++ b/drivers/scsi/mvsas/mv_init.c +@@ -286,8 +286,6 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host *shost) + } + mvi->tags_num = slot_nr; + +- /* Initialize tags */ +- mvs_tag_init(mvi); + return 0; + err_out: + return 1; +diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c +index 1275f3be530f7..82a308840b117 100644 +--- a/drivers/scsi/mvsas/mv_sas.c ++++ b/drivers/scsi/mvsas/mv_sas.c +@@ -51,13 +51,6 @@ inline int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out) + return 0; + } + +-void mvs_tag_init(struct mvs_info *mvi) +-{ +- int i; +- for (i = 0; i < mvi->tags_num; ++i) +- mvs_tag_clear(mvi, i); +-} +- + static struct mvs_info *mvs_find_dev_mvi(struct domain_device *dev) + { + unsigned long i = 0, j = 0, hi = 0; +diff --git a/drivers/scsi/mvsas/mv_sas.h b/drivers/scsi/mvsas/mv_sas.h +index 509d8f32a04ff..fe57665bdb505 100644 +--- a/drivers/scsi/mvsas/mv_sas.h ++++ b/drivers/scsi/mvsas/mv_sas.h +@@ -428,7 +428,6 @@ void mvs_tag_clear(struct mvs_info *mvi, u32 tag); + void mvs_tag_free(struct mvs_info *mvi, u32 tag); + void mvs_tag_set(struct mvs_info *mvi, unsigned int tag); + int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out); +-void mvs_tag_init(struct mvs_info *mvi); + void mvs_iounmap(void __iomem *regs); + int mvs_ioremap(struct mvs_info *mvi, int bar, int bar_ex); + void mvs_phys_reset(struct mvs_info *mvi, u32 phy_mask, int hard); +-- +2.51.0 + diff --git a/queue-6.1/scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch b/queue-6.1/scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch new file mode 100644 index 0000000000..b85b200af0 --- /dev/null +++ b/queue-6.1/scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch @@ -0,0 +1,56 @@ +From c209d3d5c8c03a41421977e68a5a44cb039be1b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Sep 2025 21:42:01 +0800 +Subject: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue + +From: Duoming Zhou + +[ Upstream commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 ] + +During the detaching of Marvell's SAS/SATA controller, the original code +calls cancel_delayed_work() in mvs_free() to cancel the delayed work +item mwq->work_q. However, if mwq->work_q is already running, the +cancel_delayed_work() may fail to cancel it. This can lead to +use-after-free scenarios where mvs_free() frees the mvs_info while +mvs_work_queue() is still executing and attempts to access the +already-freed mvs_info. + +A typical race condition is illustrated below: + +CPU 0 (remove) | CPU 1 (delayed work callback) +mvs_pci_remove() | + mvs_free() | mvs_work_queue() + cancel_delayed_work() | + kfree(mvi) | + | mvi-> // UAF + +Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure +that the delayed work item is properly canceled and any executing +delayed work item completes before the mvs_info is deallocated. + +This bug was found by static analysis. + +Fixes: 20b09c2992fe ("[SCSI] mvsas: add support for 94xx; layout change; bug fixes") +Signed-off-by: Duoming Zhou +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mvsas/mv_init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c +index cfe84473a5153..b500c343cad75 100644 +--- a/drivers/scsi/mvsas/mv_init.c ++++ b/drivers/scsi/mvsas/mv_init.c +@@ -141,7 +141,7 @@ static void mvs_free(struct mvs_info *mvi) + if (mvi->shost) + scsi_host_put(mvi->shost); + list_for_each_entry(mwq, &mvi->wq_list, entry) +- cancel_delayed_work(&mwq->work_q); ++ cancel_delayed_work_sync(&mwq->work_q); + kfree(mvi->rsvd_tags); + kfree(mvi); + } +-- +2.51.0 + diff --git a/queue-6.1/scsi-mvsas-use-sas_task_find_rq-for-tagging.patch b/queue-6.1/scsi-mvsas-use-sas_task_find_rq-for-tagging.patch new file mode 100644 index 0000000000..44d8c9634e --- /dev/null +++ b/queue-6.1/scsi-mvsas-use-sas_task_find_rq-for-tagging.patch @@ -0,0 +1,201 @@ +From 4e32a966607c841d49f87f8a8deaca6153490dbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 19:16:03 +0800 +Subject: scsi: mvsas: Use sas_task_find_rq() for tagging + +From: John Garry + +[ Upstream commit 2acf97f199f9eba8321390325519e9b6bff60108 ] + +The request associated with a SCSI command coming from the block layer has +a unique tag, so use that when possible for getting a slot. + +Unfortunately we don't support reserved commands in the SCSI midlayer yet. +As such, SMP tasks - as an example - will not have a request associated, so +in the interim continue to manage those tags for that type of sas_task +internally. + +We reserve an arbitrary 4 tags for these internal tags. Indeed, we already +decrement MVS_RSVD_SLOTS by 2 for the shost can_queue when flag +MVF_FLAG_SOC is set. This change was made in commit 20b09c2992fe ("[SCSI] +mvsas: add support for 94xx; layout change; bug fixes"), but what those 2 +slots are used for is not obvious. + +Also make the tag management functions static, where possible. + +Signed-off-by: John Garry +Link: https://lore.kernel.org/r/1666091763-11023-8-git-send-email-john.garry@huawei.com +Signed-off-by: Martin K. Petersen +Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue") +Signed-off-by: Sasha Levin +--- + drivers/scsi/mvsas/mv_defs.h | 1 + + drivers/scsi/mvsas/mv_init.c | 9 +++++---- + drivers/scsi/mvsas/mv_sas.c | 35 ++++++++++++++++++++++------------- + drivers/scsi/mvsas/mv_sas.h | 7 +------ + 4 files changed, 29 insertions(+), 23 deletions(-) + +diff --git a/drivers/scsi/mvsas/mv_defs.h b/drivers/scsi/mvsas/mv_defs.h +index 7123a2efbf583..8ef174cd4d374 100644 +--- a/drivers/scsi/mvsas/mv_defs.h ++++ b/drivers/scsi/mvsas/mv_defs.h +@@ -40,6 +40,7 @@ enum driver_configuration { + MVS_ATA_CMD_SZ = 96, /* SATA command table buffer size */ + MVS_OAF_SZ = 64, /* Open address frame buffer size */ + MVS_QUEUE_SIZE = 64, /* Support Queue depth */ ++ MVS_RSVD_SLOTS = 4, + MVS_SOC_CAN_QUEUE = MVS_SOC_SLOTS - 2, + }; + +diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c +index c85fb812ad437..cfe84473a5153 100644 +--- a/drivers/scsi/mvsas/mv_init.c ++++ b/drivers/scsi/mvsas/mv_init.c +@@ -142,7 +142,7 @@ static void mvs_free(struct mvs_info *mvi) + scsi_host_put(mvi->shost); + list_for_each_entry(mwq, &mvi->wq_list, entry) + cancel_delayed_work(&mwq->work_q); +- kfree(mvi->tags); ++ kfree(mvi->rsvd_tags); + kfree(mvi); + } + +@@ -284,7 +284,6 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host *shost) + printk(KERN_DEBUG "failed to create dma pool %s.\n", pool_name); + goto err_out; + } +- mvi->tags_num = slot_nr; + + return 0; + err_out: +@@ -367,8 +366,8 @@ static struct mvs_info *mvs_pci_alloc(struct pci_dev *pdev, + mvi->sas = sha; + mvi->shost = shost; + +- mvi->tags = kzalloc(MVS_CHIP_SLOT_SZ>>3, GFP_KERNEL); +- if (!mvi->tags) ++ mvi->rsvd_tags = bitmap_zalloc(MVS_RSVD_SLOTS, GFP_KERNEL); ++ if (!mvi->rsvd_tags) + goto err_out; + + if (MVS_CHIP_DISP->chip_ioremap(mvi)) +@@ -469,6 +468,8 @@ static void mvs_post_sas_ha_init(struct Scsi_Host *shost, + else + can_queue = MVS_CHIP_SLOT_SZ; + ++ can_queue -= MVS_RSVD_SLOTS; ++ + shost->sg_tablesize = min_t(u16, SG_ALL, MVS_MAX_SG); + shost->can_queue = can_queue; + mvi->shost->cmd_per_lun = MVS_QUEUE_SIZE; +diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c +index 82a308840b117..fd73fcf71bd1d 100644 +--- a/drivers/scsi/mvsas/mv_sas.c ++++ b/drivers/scsi/mvsas/mv_sas.c +@@ -20,31 +20,34 @@ static int mvs_find_tag(struct mvs_info *mvi, struct sas_task *task, u32 *tag) + return 0; + } + +-void mvs_tag_clear(struct mvs_info *mvi, u32 tag) ++static void mvs_tag_clear(struct mvs_info *mvi, u32 tag) + { +- void *bitmap = mvi->tags; ++ void *bitmap = mvi->rsvd_tags; + clear_bit(tag, bitmap); + } + +-void mvs_tag_free(struct mvs_info *mvi, u32 tag) ++static void mvs_tag_free(struct mvs_info *mvi, u32 tag) + { ++ if (tag >= MVS_RSVD_SLOTS) ++ return; ++ + mvs_tag_clear(mvi, tag); + } + +-void mvs_tag_set(struct mvs_info *mvi, unsigned int tag) ++static void mvs_tag_set(struct mvs_info *mvi, unsigned int tag) + { +- void *bitmap = mvi->tags; ++ void *bitmap = mvi->rsvd_tags; + set_bit(tag, bitmap); + } + +-inline int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out) ++static int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out) + { + unsigned int index, tag; +- void *bitmap = mvi->tags; ++ void *bitmap = mvi->rsvd_tags; + +- index = find_first_zero_bit(bitmap, mvi->tags_num); ++ index = find_first_zero_bit(bitmap, MVS_RSVD_SLOTS); + tag = index; +- if (tag >= mvi->tags_num) ++ if (tag >= MVS_RSVD_SLOTS) + return -SAS_QUEUE_FULL; + mvs_tag_set(mvi, tag); + *tag_out = tag; +@@ -696,6 +699,7 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf + struct mvs_task_exec_info tei; + struct mvs_slot_info *slot; + u32 tag = 0xdeadbeef, n_elem = 0; ++ struct request *rq; + int rc = 0; + + if (!dev->port) { +@@ -760,9 +764,14 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf + n_elem = task->num_scatter; + } + +- rc = mvs_tag_alloc(mvi, &tag); +- if (rc) +- goto err_out; ++ rq = sas_task_find_rq(task); ++ if (rq) { ++ tag = rq->tag + MVS_RSVD_SLOTS; ++ } else { ++ rc = mvs_tag_alloc(mvi, &tag); ++ if (rc) ++ goto err_out; ++ } + + slot = &mvi->slot_info[tag]; + +@@ -857,7 +866,7 @@ int mvs_queue_command(struct sas_task *task, gfp_t gfp_flags) + static void mvs_slot_free(struct mvs_info *mvi, u32 rx_desc) + { + u32 slot_idx = rx_desc & RXQ_SLOT_MASK; +- mvs_tag_clear(mvi, slot_idx); ++ mvs_tag_free(mvi, slot_idx); + } + + static void mvs_slot_task_free(struct mvs_info *mvi, struct sas_task *task, +diff --git a/drivers/scsi/mvsas/mv_sas.h b/drivers/scsi/mvsas/mv_sas.h +index fe57665bdb505..68df771e29759 100644 +--- a/drivers/scsi/mvsas/mv_sas.h ++++ b/drivers/scsi/mvsas/mv_sas.h +@@ -370,8 +370,7 @@ struct mvs_info { + u32 chip_id; + const struct mvs_chip_info *chip; + +- int tags_num; +- unsigned long *tags; ++ unsigned long *rsvd_tags; + /* further per-slot information */ + struct mvs_phy phy[MVS_MAX_PHYS]; + struct mvs_port port[MVS_MAX_PHYS]; +@@ -424,10 +423,6 @@ struct mvs_task_exec_info { + + /******************** function prototype *********************/ + void mvs_get_sas_addr(void *buf, u32 buflen); +-void mvs_tag_clear(struct mvs_info *mvi, u32 tag); +-void mvs_tag_free(struct mvs_info *mvi, u32 tag); +-void mvs_tag_set(struct mvs_info *mvi, unsigned int tag); +-int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out); + void mvs_iounmap(void __iomem *regs); + int mvs_ioremap(struct mvs_info *mvi, int bar, int bar_ex); + void mvs_phys_reset(struct mvs_info *mvi, u32 phy_mask, int hard); +-- +2.51.0 + diff --git a/queue-6.1/series b/queue-6.1/series index 2fca31c252..4bde662084 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -3,3 +3,48 @@ fscontext-do-not-consume-log-entries-when-returning-emsgsize.patch clocksource-drivers-clps711x-fix-resource-leaks-in-error-paths.patch iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch media-v4l2-subdev-fix-alloc-failure-check-in-v4l2_subdev_call_state_try.patch +perf-evsel-avoid-container_of-on-a-null-leader.patch +libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch +clk-at91-peripheral-fix-return-value.patch +perf-util-fix-compression-checks-returning-1-as-bool.patch +rtc-x1205-fix-xicor-x1205-vendor-prefix.patch +rtc-optee-fix-memory-leak-on-driver-removal.patch +perf-arm_spe-correct-setting-remote-access.patch +perf-arm-spe-refactor-arm-spe-to-support-operation-p.patch +perf-arm-spe-rename-the-common-data-source-encoding.patch +perf-arm_spe-correct-memory-level-for-remote-access.patch +perf-session-fix-handling-when-buffer-exceeds-2-gib.patch +perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch +clk-mediatek-mt8195-infra_ao-fix-parent-for-infra_ao.patch +clk-mediatek-clk-mux-do-not-pass-flags-to-clk_mux_de.patch +clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch +clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch +clk-tegra-do-not-overallocate-memory-for-bpmp-clocks.patch +cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch +scsi-libsas-add-sas_task_find_rq.patch +scsi-mvsas-delete-mvs_tag_init.patch +scsi-mvsas-use-sas_task_find_rq-for-tagging.patch +scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch +loongarch-remove-config_acpi_table_upgrade-in-platfo.patch +loongarch-init-acpi_gbl_use_global_lock-to-false.patch +net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch +s390-cio-update-purge-function-to-unregister-the-unu.patch +drm-vmwgfx-fix-use-after-free-in-validation.patch +drm-vmwgfx-fix-copy-paste-typo-in-validation.patch +net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch +tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch +net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch +tools-build-align-warning-options-with-perf.patch +mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch +mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch +bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch +drm-amdgpu-add-additional-dce6-scl-registers.patch +drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch +drm-amd-display-properly-clear-scl_-_filter_control-.patch +drm-amd-display-properly-disable-scaling-on-dce6.patch +bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch +crypto-essiv-check-ssize-for-decryption-and-in-place.patch +tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch +gpio-wcd934x-remove-duplicate-assignment-of-of_gpio_.patch +gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch +bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch diff --git a/queue-6.1/tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch b/queue-6.1/tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch new file mode 100644 index 0000000000..6125490d3f --- /dev/null +++ b/queue-6.1/tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch @@ -0,0 +1,87 @@ +From 5d036e4484abd69d50c2185ce86cf49537dae392 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 23:37:54 +0000 +Subject: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). + +From: Kuniyuki Iwashima + +[ Upstream commit 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c ] + +syzbot reported the splat below in tcp_conn_request(). [0] + +If a listener is close()d while a TFO socket is being processed in +tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk +and calls inet_child_forget(), which calls tcp_disconnect() for the +TFO socket. + +After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), +where reqsk_put() is called due to !reqsk->sk. + +Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the +last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the +drop_and_free label causes the refcount underflow for the listener +and double-free of the reqsk. + +Let's remove reqsk_fastopen_remove() in tcp_conn_request(). + +Note that other callers make sure tp->fastopen_rsk is not NULL. + +[0]: +refcount_t: underflow; use-after-free. +WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) +Modules linked in: +CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 +RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) +Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 +RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 +RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 +RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280 +RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 +R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 +R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8 +FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0 +Call Trace: + + tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) + tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) + tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) + tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) + ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) + ip6_input (net/ipv6/ip6_input.c:500) + ipv6_rcv (net/ipv6/ip6_input.c:311) + __netif_receive_skb (net/core/dev.c:6104) + process_backlog (net/core/dev.c:6456) + __napi_poll (net/core/dev.c:7506) + net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) + handle_softirqs (kernel/softirq.c:579) + do_softirq (kernel/softirq.c:480) + + +Fixes: 45c8a6cc2bcd ("tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().") +Reported-by: syzkaller +Signed-off-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20251001233755.1340927-1-kuniyu@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 5ee1e1c2082cf..1820e297e8ea0 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -7125,7 +7125,6 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, + &foc, TCP_SYNACK_FASTOPEN, skb); + /* Add the child socket directly into the accept queue */ + if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) { +- reqsk_fastopen_remove(fastopen_sk, req, false); + bh_unlock_sock(fastopen_sk); + sock_put(fastopen_sk); + goto drop_and_free; +-- +2.51.0 + diff --git a/queue-6.1/tools-build-align-warning-options-with-perf.patch b/queue-6.1/tools-build-align-warning-options-with-perf.patch new file mode 100644 index 0000000000..0f977f0f04 --- /dev/null +++ b/queue-6.1/tools-build-align-warning-options-with-perf.patch @@ -0,0 +1,62 @@ +From 8ba0e02486a66808d8eb2016f99fdf81a599db49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Oct 2025 17:21:23 +0100 +Subject: tools build: Align warning options with perf + +From: Leo Yan + +[ Upstream commit 53d067feb8c4f16d1f24ce3f4df4450bb18c555f ] + +The feature test programs are built without enabling '-Wall -Werror' +options. As a result, a feature may appear to be available, but later +building in perf can fail with stricter checks. + +Make the feature test program use the same warning options as perf. + +Fixes: 1925459b4d92 ("tools build: Fix feature Makefile issues with 'O='") +Signed-off-by: Leo Yan +Reviewed-by: Ian Rogers +Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-1-4305590795b2@arm.com +Cc: Palmer Dabbelt +Cc: Albert Ou +Cc: Alexandre Ghiti +Cc: Nick Desaulniers +Cc: Justin Stitt +Cc: Bill Wendling +Cc: Adrian Hunter +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Nathan Chancellor +Cc: James Clark +Cc: linux-riscv@lists.infradead.org +Cc: llvm@lists.linux.dev +Cc: Paul Walmsley +Cc: linux-kernel@vger.kernel.org +Cc: linux-perf-users@vger.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/build/feature/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile +index 690fe97be1904..1b7886cbbb65a 100644 +--- a/tools/build/feature/Makefile ++++ b/tools/build/feature/Makefile +@@ -282,10 +282,10 @@ $(OUTPUT)test-libbabeltrace.bin: + $(BUILD) # -lbabeltrace provided by $(FEATURE_CHECK_LDFLAGS-libbabeltrace) + + $(OUTPUT)test-compile-32.bin: +- $(CC) -m32 -o $@ test-compile.c ++ $(CC) -m32 -Wall -Werror -o $@ test-compile.c + + $(OUTPUT)test-compile-x32.bin: +- $(CC) -mx32 -o $@ test-compile.c ++ $(CC) -mx32 -Wall -Werror -o $@ test-compile.c + + $(OUTPUT)test-zlib.bin: + $(BUILD) -lz +-- +2.51.0 + diff --git a/queue-6.1/tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch b/queue-6.1/tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch new file mode 100644 index 0000000000..a1faf4a469 --- /dev/null +++ b/queue-6.1/tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch @@ -0,0 +1,42 @@ +From fe985041fc529ff00cd867dab49a9210c73ab5ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 18:49:40 +0300 +Subject: tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single + +From: Gunnar Kudrjavets + +[ Upstream commit 8a81236f2cb0882c7ea6c621ce357f7f3f601fe5 ] + +The tpm_tis_write8() call specifies arguments in wrong order. Should be +(data, addr, value) not (data, value, addr). The initial correct order +was changed during the major refactoring when the code was split. + +Fixes: 41a5e1cf1fe1 ("tpm/tpm_tis: Split tpm_tis driver into a core and TCG TIS compliant phy") +Signed-off-by: Gunnar Kudrjavets +Reviewed-by: Justinien Bouron +Reviewed-by: Jarkko Sakkinen +Reviewed-by: Paul Menzel +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index caf9ba2dc0b13..968b891bcb030 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -878,8 +878,8 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, + * will call disable_irq which undoes all of the above. + */ + if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) { +- tpm_tis_write8(priv, original_int_vec, +- TPM_INT_VECTOR(priv->locality)); ++ tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), ++ original_int_vec); + rc = -1; + } + +-- +2.51.0 + diff --git a/queue-6.12/asoc-sof-intel-hda-pcm-place-the-constraint-on-perio.patch b/queue-6.12/asoc-sof-intel-hda-pcm-place-the-constraint-on-perio.patch new file mode 100644 index 0000000000..d3d3f41c4e --- /dev/null +++ b/queue-6.12/asoc-sof-intel-hda-pcm-place-the-constraint-on-perio.patch @@ -0,0 +1,83 @@ +From 664c87e3c02ac3c428afee0745c4a271b3455b23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 16:57:52 +0300 +Subject: ASoC: SOF: Intel: hda-pcm: Place the constraint on period time + instead of buffer time + +From: Peter Ujfalusi + +[ Upstream commit 45ad27d9a6f7c620d8bbc80be3bab1faf37dfa0a ] + +Instead of constraining the ALSA buffer time to be double of the firmware +host buffer size, it is better to set it for the period time. +This will implicitly constrain the buffer time to a safe value +(num_periods is at least 2) and prohibits applications to set smaller +period size than what will be covered by the initial DMA burst. + +Fixes: fe76d2e75a6d ("ASoC: SOF: Intel: hda-pcm: Use dsp_max_burst_size_in_ms to place constraint") +Signed-off-by: Peter Ujfalusi +Reviewed-by: Ranjani Sridharan +Reviewed-by: Kai Vehmanen +Reviewed-by: Bard Liao +Link: https://patch.msgid.link/20251002135752.2430-4-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-pcm.c | 29 +++++++++++++++++++++-------- + 1 file changed, 21 insertions(+), 8 deletions(-) + +diff --git a/sound/soc/sof/intel/hda-pcm.c b/sound/soc/sof/intel/hda-pcm.c +index f6e24edd7adbe..898e4fcde2dde 100644 +--- a/sound/soc/sof/intel/hda-pcm.c ++++ b/sound/soc/sof/intel/hda-pcm.c +@@ -29,6 +29,8 @@ + #define SDnFMT_BITS(x) ((x) << 4) + #define SDnFMT_CHAN(x) ((x) << 0) + ++#define HDA_MAX_PERIOD_TIME_HEADROOM 10 ++ + static bool hda_always_enable_dmi_l1; + module_param_named(always_enable_dmi_l1, hda_always_enable_dmi_l1, bool, 0444); + MODULE_PARM_DESC(always_enable_dmi_l1, "SOF HDA always enable DMI l1"); +@@ -276,19 +278,30 @@ int hda_dsp_pcm_open(struct snd_sof_dev *sdev, + * On playback start the DMA will transfer dsp_max_burst_size_in_ms + * amount of data in one initial burst to fill up the host DMA buffer. + * Consequent DMA burst sizes are shorter and their length can vary. +- * To make sure that userspace allocate large enough ALSA buffer we need +- * to place a constraint on the buffer time. ++ * To avoid immediate xrun by the initial burst we need to place ++ * constraint on the period size (via PERIOD_TIME) to cover the size of ++ * the host buffer. ++ * We need to add headroom of max 10ms as the firmware needs time to ++ * settle to the 1ms pacing and initially it can run faster for few ++ * internal periods. + * + * On capture the DMA will transfer 1ms chunks. +- * +- * Exact dsp_max_burst_size_in_ms constraint is racy, so set the +- * constraint to a minimum of 2x dsp_max_burst_size_in_ms. + */ +- if (spcm->stream[direction].dsp_max_burst_size_in_ms) ++ if (spcm->stream[direction].dsp_max_burst_size_in_ms) { ++ unsigned int period_time = spcm->stream[direction].dsp_max_burst_size_in_ms; ++ ++ /* ++ * add headroom over the maximum burst size to cover the time ++ * needed for the DMA pace to settle. ++ * Limit the headroom time to HDA_MAX_PERIOD_TIME_HEADROOM ++ */ ++ period_time += min(period_time, HDA_MAX_PERIOD_TIME_HEADROOM); ++ + snd_pcm_hw_constraint_minmax(substream->runtime, +- SNDRV_PCM_HW_PARAM_BUFFER_TIME, +- spcm->stream[direction].dsp_max_burst_size_in_ms * USEC_PER_MSEC * 2, ++ SNDRV_PCM_HW_PARAM_PERIOD_TIME, ++ period_time * USEC_PER_MSEC, + UINT_MAX); ++ } + + /* binding pcm substream to hda stream */ + substream->runtime->private_data = &dsp_stream->hstream; +-- +2.51.0 + diff --git a/queue-6.12/asoc-sof-intel-read-the-llp-via-the-associated-link-.patch b/queue-6.12/asoc-sof-intel-read-the-llp-via-the-associated-link-.patch new file mode 100644 index 0000000000..a2db15b58f --- /dev/null +++ b/queue-6.12/asoc-sof-intel-read-the-llp-via-the-associated-link-.patch @@ -0,0 +1,82 @@ +From 935e433b6112028267d1283303cdbff57a65ebee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 10:47:19 +0300 +Subject: ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel + +From: Peter Ujfalusi + +[ Upstream commit aaab61de1f1e44a2ab527e935474e2e03a0f6b08 ] + +It is allowed to mix Link and Host DMA channels in a way that their index +is different. In this case we would read the LLP from a channel which is +not used or used for other operation. + +Such case can be reproduced on cAVS2.5 or ACE1 platforms with soundwire +configuration: +playback to SDW would take Host channel 0 (stream_tag 1) and no Link DMA +used +Second playback to HDMI (HDA) would use Host channel 1 (stream_tag 2) and +Link channel 0 (stream_tag 1). + +In this case reading the LLP from channel 2 is incorrect as that is not the +Link channel used for the HDMI playback. + +To correct this, we should look up the BE and get the channel used on the +Link side. + +Fixes: 67b182bea08a ("ASoC: SOF: Intel: hda: Implement get_stream_position (Linear Link Position)") +Signed-off-by: Peter Ujfalusi +Reviewed-by: Kai Vehmanen +Reviewed-by: Ranjani Sridharan +Link: https://patch.msgid.link/20251002074719.2084-6-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-stream.c | 29 +++++++++++++++++++++++++++-- + 1 file changed, 27 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sof/intel/hda-stream.c b/sound/soc/sof/intel/hda-stream.c +index 24f3cc7676142..2be0d02f9cf9b 100644 +--- a/sound/soc/sof/intel/hda-stream.c ++++ b/sound/soc/sof/intel/hda-stream.c +@@ -1103,10 +1103,35 @@ u64 hda_dsp_get_stream_llp(struct snd_sof_dev *sdev, + struct snd_soc_component *component, + struct snd_pcm_substream *substream) + { +- struct hdac_stream *hstream = substream->runtime->private_data; +- struct hdac_ext_stream *hext_stream = stream_to_hdac_ext_stream(hstream); ++ struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream); ++ struct snd_soc_pcm_runtime *be_rtd = NULL; ++ struct hdac_ext_stream *hext_stream; ++ struct snd_soc_dai *cpu_dai; ++ struct snd_soc_dpcm *dpcm; + u32 llp_l, llp_u; + ++ /* ++ * The LLP needs to be read from the Link DMA used for this FE as it is ++ * allowed to use any combination of Link and Host channels ++ */ ++ for_each_dpcm_be(rtd, substream->stream, dpcm) { ++ if (dpcm->fe != rtd) ++ continue; ++ ++ be_rtd = dpcm->be; ++ } ++ ++ if (!be_rtd) ++ return 0; ++ ++ cpu_dai = snd_soc_rtd_to_cpu(be_rtd, 0); ++ if (!cpu_dai) ++ return 0; ++ ++ hext_stream = snd_soc_dai_get_dma_data(cpu_dai, substream); ++ if (!hext_stream) ++ return 0; ++ + /* + * The pplc_addr have been calculated during probe in + * hda_dsp_stream_init(): +-- +2.51.0 + diff --git a/queue-6.12/asoc-sof-ipc4-topology-account-for-different-chaindm.patch b/queue-6.12/asoc-sof-ipc4-topology-account-for-different-chaindm.patch new file mode 100644 index 0000000000..c8b253790a --- /dev/null +++ b/queue-6.12/asoc-sof-ipc4-topology-account-for-different-chaindm.patch @@ -0,0 +1,64 @@ +From be2894ff5da9d0b9715d66f12f9fea05826b3857 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 16:57:51 +0300 +Subject: ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer + size + +From: Peter Ujfalusi + +[ Upstream commit 3dcf683bf1062d69014fe81b90d285c7eb85ca8a ] + +For ChainDMA the firmware allocates 5ms host buffer instead of the standard +4ms which should be taken into account when setting the constraint on the +buffer size. + +Fixes: 842bb8b62cc6 ("ASoC: SOF: ipc4-topology: Save the DMA maximum burst size for PCMs") +Signed-off-by: Peter Ujfalusi +Reviewed-by: Ranjani Sridharan +Reviewed-by: Kai Vehmanen +Reviewed-by: Bard Liao +Link: https://patch.msgid.link/20251002135752.2430-3-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/ipc4-topology.c | 9 +++++++-- + sound/soc/sof/ipc4-topology.h | 3 +++ + 2 files changed, 10 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sof/ipc4-topology.c b/sound/soc/sof/ipc4-topology.c +index f82db7f2a6b7e..ac836d0d20de0 100644 +--- a/sound/soc/sof/ipc4-topology.c ++++ b/sound/soc/sof/ipc4-topology.c +@@ -519,8 +519,13 @@ static int sof_ipc4_widget_setup_pcm(struct snd_sof_widget *swidget) + swidget->tuples, + swidget->num_tuples, sizeof(u32), 1); + /* Set default DMA buffer size if it is not specified in topology */ +- if (!sps->dsp_max_burst_size_in_ms) +- sps->dsp_max_burst_size_in_ms = SOF_IPC4_MIN_DMA_BUFFER_SIZE; ++ if (!sps->dsp_max_burst_size_in_ms) { ++ struct snd_sof_widget *pipe_widget = swidget->spipe->pipe_widget; ++ struct sof_ipc4_pipeline *pipeline = pipe_widget->private; ++ ++ sps->dsp_max_burst_size_in_ms = pipeline->use_chain_dma ? ++ SOF_IPC4_CHAIN_DMA_BUFFER_SIZE : SOF_IPC4_MIN_DMA_BUFFER_SIZE; ++ } + } else { + /* Capture data is copied from DSP to host in 1ms bursts */ + spcm->stream[dir].dsp_max_burst_size_in_ms = 1; +diff --git a/sound/soc/sof/ipc4-topology.h b/sound/soc/sof/ipc4-topology.h +index 187e186ba4f8f..adb52a1eff85f 100644 +--- a/sound/soc/sof/ipc4-topology.h ++++ b/sound/soc/sof/ipc4-topology.h +@@ -63,6 +63,9 @@ + /* FW requires minimum 4ms DMA buffer size */ + #define SOF_IPC4_MIN_DMA_BUFFER_SIZE 4 + ++/* ChainDMA in fw uses 5ms DMA buffer */ ++#define SOF_IPC4_CHAIN_DMA_BUFFER_SIZE 5 ++ + /* + * The base of multi-gateways. Multi-gateways addressing starts from + * ALH_MULTI_GTW_BASE and there are ALH_MULTI_GTW_COUNT multi-sources +-- +2.51.0 + diff --git a/queue-6.12/asoc-sof-ipc4-topology-correct-the-minimum-host-dma-.patch b/queue-6.12/asoc-sof-ipc4-topology-correct-the-minimum-host-dma-.patch new file mode 100644 index 0000000000..761a794539 --- /dev/null +++ b/queue-6.12/asoc-sof-ipc4-topology-correct-the-minimum-host-dma-.patch @@ -0,0 +1,45 @@ +From 3eeb9509e2b04e4bc18f8030637862ff892589ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 16:57:50 +0300 +Subject: ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size + +From: Peter Ujfalusi + +[ Upstream commit a7fe5ff832d61d9393095bc3dd5f06f4af7da3c1 ] + +The firmware has changed the minimum host buffer size from 2 periods to +4 periods (1 period is 1ms) which was missed by the kernel side. + +Adjust the SOF_IPC4_MIN_DMA_BUFFER_SIZE to 4 ms to align with firmware. + +Link: https://github.com/thesofproject/sof/commit/f0a14a3f410735db18a79eb7a5f40dc49fdee7a7 +Fixes: 594c1bb9ff73 ("ASoC: SOF: ipc4-topology: Do not parse the DMA_BUFFER_SIZE token") +Signed-off-by: Peter Ujfalusi +Reviewed-by: Ranjani Sridharan +Reviewed-by: Kai Vehmanen +Reviewed-by: Bard Liao +Link: https://patch.msgid.link/20251002135752.2430-2-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/ipc4-topology.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sof/ipc4-topology.h b/sound/soc/sof/ipc4-topology.h +index f4dc499c0ffe5..187e186ba4f8f 100644 +--- a/sound/soc/sof/ipc4-topology.h ++++ b/sound/soc/sof/ipc4-topology.h +@@ -60,8 +60,8 @@ + + #define SOF_IPC4_INVALID_NODE_ID 0xffffffff + +-/* FW requires minimum 2ms DMA buffer size */ +-#define SOF_IPC4_MIN_DMA_BUFFER_SIZE 2 ++/* FW requires minimum 4ms DMA buffer size */ ++#define SOF_IPC4_MIN_DMA_BUFFER_SIZE 4 + + /* + * The base of multi-gateways. Multi-gateways addressing starts from +-- +2.51.0 + diff --git a/queue-6.12/bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch b/queue-6.12/bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch new file mode 100644 index 0000000000..fce2b8b096 --- /dev/null +++ b/queue-6.12/bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch @@ -0,0 +1,74 @@ +From ddd61beef9b8337b981be7541a09028c1849490b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 18:26:26 +0800 +Subject: bpf: Avoid RCU context warning when unpinning htab with internal + structs + +From: KaFai Wan + +[ Upstream commit 4f375ade6aa9f37fd72d7a78682f639772089eed ] + +When unpinning a BPF hash table (htab or htab_lru) that contains internal +structures (timer, workqueue, or task_work) in its values, a BUG warning +is triggered: + BUG: sleeping function called from invalid context at kernel/bpf/hashtab.c:244 + in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 14, name: ksoftirqd/0 + ... + +The issue arises from the interaction between BPF object unpinning and +RCU callback mechanisms: +1. BPF object unpinning uses ->free_inode() which schedules cleanup via + call_rcu(), deferring the actual freeing to an RCU callback that + executes within the RCU_SOFTIRQ context. +2. During cleanup of hash tables containing internal structures, + htab_map_free_internal_structs() is invoked, which includes + cond_resched() or cond_resched_rcu() calls to yield the CPU during + potentially long operations. + +However, cond_resched() or cond_resched_rcu() cannot be safely called from +atomic RCU softirq context, leading to the BUG warning when attempting +to reschedule. + +Fix this by changing from ->free_inode() to ->destroy_inode() and rename +bpf_free_inode() to bpf_destroy_inode() for BPF objects (prog, map, link). +This allows direct inode freeing without RCU callback scheduling, +avoiding the invalid context warning. + +Reported-by: Le Chen +Closes: https://lore.kernel.org/all/1444123482.1827743.1750996347470.JavaMail.zimbra@sjtu.edu.cn/ +Fixes: 68134668c17f ("bpf: Add map side support for bpf timers.") +Suggested-by: Alexei Starovoitov +Signed-off-by: KaFai Wan +Acked-by: Yonghong Song +Link: https://lore.kernel.org/r/20251008102628.808045-2-kafai.wan@linux.dev +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/inode.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c +index 9aaf5124648bd..746b5644d9a19 100644 +--- a/kernel/bpf/inode.c ++++ b/kernel/bpf/inode.c +@@ -775,7 +775,7 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root) + return 0; + } + +-static void bpf_free_inode(struct inode *inode) ++static void bpf_destroy_inode(struct inode *inode) + { + enum bpf_type type; + +@@ -790,7 +790,7 @@ const struct super_operations bpf_super_ops = { + .statfs = simple_statfs, + .drop_inode = generic_delete_inode, + .show_options = bpf_show_options, +- .free_inode = bpf_free_inode, ++ .destroy_inode = bpf_destroy_inode, + }; + + enum { +-- +2.51.0 + diff --git a/queue-6.12/bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch b/queue-6.12/bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch new file mode 100644 index 0000000000..13db1eef4f --- /dev/null +++ b/queue-6.12/bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch @@ -0,0 +1,64 @@ +From a9e4389a5b0704abf4fec816ad8341b68e2b3063 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 09:34:18 +0200 +Subject: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} + +From: Daniel Borkmann + +[ Upstream commit 23f3770e1a53e6c7a553135011f547209e141e72 ] + +Cilium has a BPF egress gateway feature which forces outgoing K8s Pod +traffic to pass through dedicated egress gateways which then SNAT the +traffic in order to interact with stable IPs outside the cluster. + +The traffic is directed to the gateway via vxlan tunnel in collect md +mode. A recent BPF change utilized the bpf_redirect_neigh() helper to +forward packets after the arrival and decap on vxlan, which turned out +over time that the kmalloc-256 slab usage in kernel was ever-increasing. + +The issue was that vxlan allocates the metadata_dst object and attaches +it through a fake dst entry to the skb. The latter was never released +though given bpf_redirect_neigh() was merely setting the new dst entry +via skb_dst_set() without dropping an existing one first. + +Fixes: b4ab31414970 ("bpf: Add redirect_neigh helper as redirect drop-in") +Reported-by: Yusuke Suzuki +Reported-by: Julian Wiedmann +Signed-off-by: Daniel Borkmann +Cc: Martin KaFai Lau +Cc: Jakub Kicinski +Cc: Jordan Rife +Reviewed-by: Simon Horman +Reviewed-by: Jordan Rife +Reviewed-by: Jakub Kicinski +Reviewed-by: Martin KaFai Lau +Link: https://lore.kernel.org/r/20251003073418.291171-1-daniel@iogearbox.net +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/core/filter.c b/net/core/filter.c +index c850e5d6cbd87..fef4d85fee008 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -2289,6 +2289,7 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev, + if (IS_ERR(dst)) + goto out_drop; + ++ skb_dst_drop(skb); + skb_dst_set(skb, dst); + } else if (nh->nh_family != AF_INET6) { + goto out_drop; +@@ -2397,6 +2398,7 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev, + goto out_drop; + } + ++ skb_dst_drop(skb); + skb_dst_set(skb, &rt->dst); + } + +-- +2.51.0 + diff --git a/queue-6.12/bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch b/queue-6.12/bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch new file mode 100644 index 0000000000..f100819c15 --- /dev/null +++ b/queue-6.12/bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch @@ -0,0 +1,50 @@ +From c4effc09cb7d9513db8cb931f4e8ffc733162561 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 10:15:01 +0200 +Subject: bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() + +From: Eric Woudstra + +[ Upstream commit bbf0c98b3ad9edaea1f982de6c199cc11d3b7705 ] + +net/bridge/br_private.h:1627 suspicious rcu_dereference_protected() usage! +other info that might help us debug this: + +rcu_scheduler_active = 2, debug_locks = 1 +7 locks held by socat/410: + #0: ffff88800d7a9c90 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_stream_connect+0x43/0xa0 + #1: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x62/0x1830 + [..] + #6: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: nf_hook.constprop.0+0x8a/0x440 + +Call Trace: + lockdep_rcu_suspicious.cold+0x4f/0xb1 + br_vlan_fill_forward_path_pvid+0x32c/0x410 [bridge] + br_fill_forward_path+0x7a/0x4d0 [bridge] + +Use to correct helper, non _rcu variant requires RTNL mutex. + +Fixes: bcf2766b1377 ("net: bridge: resolve forwarding path for VLAN tag actions in bridge devices") +Signed-off-by: Eric Woudstra +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/bridge/br_vlan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c +index f2efb58d152bc..13d6c3f51c29d 100644 +--- a/net/bridge/br_vlan.c ++++ b/net/bridge/br_vlan.c +@@ -1455,7 +1455,7 @@ void br_vlan_fill_forward_path_pvid(struct net_bridge *br, + if (!br_opt_get(br, BROPT_VLAN_ENABLED)) + return; + +- vg = br_vlan_group(br); ++ vg = br_vlan_group_rcu(br); + + if (idx >= 0 && + ctx->vlan[idx].proto == br->vlan_proto) { +-- +2.51.0 + diff --git a/queue-6.12/cifs-fix-copy_to_iter-return-value-check.patch b/queue-6.12/cifs-fix-copy_to_iter-return-value-check.patch new file mode 100644 index 0000000000..27404486f9 --- /dev/null +++ b/queue-6.12/cifs-fix-copy_to_iter-return-value-check.patch @@ -0,0 +1,54 @@ +From 4036e2a1844870b3c1f23065bfe3f131f1c71339 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 16:26:03 +0800 +Subject: cifs: Fix copy_to_iter return value check + +From: Fushuai Wang + +[ Upstream commit 0cc380d0e1d36b8f2703379890e90f896f68e9e8 ] + +The return value of copy_to_iter() function will never be negative, +it is the number of bytes copied, or zero if nothing was copied. +Update the check to treat 0 as an error, and return -1 in that case. + +Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") +Acked-by: Tom Talpey +Reviewed-by: David Howells +Signed-off-by: Fushuai Wang +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2ops.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index c946c3a09245c..1b30035d02bc5 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -4657,7 +4657,7 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid, + unsigned int pad_len; + struct cifs_io_subrequest *rdata = mid->callback_data; + struct smb2_hdr *shdr = (struct smb2_hdr *)buf; +- int length; ++ size_t copied; + bool use_rdma_mr = false; + + if (shdr->Command != SMB2_READ) { +@@ -4770,10 +4770,10 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid, + } else if (buf_len >= data_offset + data_len) { + /* read response payload is in buf */ + WARN_ONCE(buffer, "read data can be either in buf or in buffer"); +- length = copy_to_iter(buf + data_offset, data_len, &rdata->subreq.io_iter); +- if (length < 0) +- return length; +- rdata->got_bytes = data_len; ++ copied = copy_to_iter(buf + data_offset, data_len, &rdata->subreq.io_iter); ++ if (copied == 0) ++ return -EIO; ++ rdata->got_bytes = copied; + } else { + /* read response payload cannot be in both buf and pages */ + WARN_ONCE(1, "buf can not contain only a part of read data"); +-- +2.51.0 + diff --git a/queue-6.12/cifs-query-ea-lxmod-in-cifs_query_path_info-for-wsl-.patch b/queue-6.12/cifs-query-ea-lxmod-in-cifs_query_path_info-for-wsl-.patch new file mode 100644 index 0000000000..8c6a7fdce5 --- /dev/null +++ b/queue-6.12/cifs-query-ea-lxmod-in-cifs_query_path_info-for-wsl-.patch @@ -0,0 +1,114 @@ +From 0eff0f0819abd5fac655b8b337ab938c5c051026 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Jun 2025 18:11:10 +0200 +Subject: cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse + points +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 057ac50638bcece64b3b436d3a61b70ed6c01a34 ] + +EA $LXMOD is required for WSL non-symlink reparse points. + +Fixes: ef86ab131d91 ("cifs: Fix querying of WSL CHR and BLK reparse points over SMB1") +Signed-off-by: Pali Rohár +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb1ops.c | 62 +++++++++++++++++++++++++++++++++++++++-- + 1 file changed, 60 insertions(+), 2 deletions(-) + +diff --git a/fs/smb/client/smb1ops.c b/fs/smb/client/smb1ops.c +index 0385a514f59e9..4670c3e451a75 100644 +--- a/fs/smb/client/smb1ops.c ++++ b/fs/smb/client/smb1ops.c +@@ -671,14 +671,72 @@ static int cifs_query_path_info(const unsigned int xid, + } + + #ifdef CONFIG_CIFS_XATTR ++ /* ++ * For non-symlink WSL reparse points it is required to fetch ++ * EA $LXMOD which contains in its S_DT part the mandatory file type. ++ */ ++ if (!rc && data->reparse_point) { ++ struct smb2_file_full_ea_info *ea; ++ u32 next = 0; ++ ++ ea = (struct smb2_file_full_ea_info *)data->wsl.eas; ++ do { ++ ea = (void *)((u8 *)ea + next); ++ next = le32_to_cpu(ea->next_entry_offset); ++ } while (next); ++ if (le16_to_cpu(ea->ea_value_length)) { ++ ea->next_entry_offset = cpu_to_le32(ALIGN(sizeof(*ea) + ++ ea->ea_name_length + 1 + ++ le16_to_cpu(ea->ea_value_length), 4)); ++ ea = (void *)((u8 *)ea + le32_to_cpu(ea->next_entry_offset)); ++ } ++ ++ rc = CIFSSMBQAllEAs(xid, tcon, full_path, SMB2_WSL_XATTR_MODE, ++ &ea->ea_data[SMB2_WSL_XATTR_NAME_LEN + 1], ++ SMB2_WSL_XATTR_MODE_SIZE, cifs_sb); ++ if (rc == SMB2_WSL_XATTR_MODE_SIZE) { ++ ea->next_entry_offset = cpu_to_le32(0); ++ ea->flags = 0; ++ ea->ea_name_length = SMB2_WSL_XATTR_NAME_LEN; ++ ea->ea_value_length = cpu_to_le16(SMB2_WSL_XATTR_MODE_SIZE); ++ memcpy(&ea->ea_data[0], SMB2_WSL_XATTR_MODE, SMB2_WSL_XATTR_NAME_LEN + 1); ++ data->wsl.eas_len += ALIGN(sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 + ++ SMB2_WSL_XATTR_MODE_SIZE, 4); ++ rc = 0; ++ } else if (rc >= 0) { ++ /* It is an error if EA $LXMOD has wrong size. */ ++ rc = -EINVAL; ++ } else { ++ /* ++ * In all other cases ignore error if fetching ++ * of EA $LXMOD failed. It is needed only for ++ * non-symlink WSL reparse points and wsl_to_fattr() ++ * handle the case when EA is missing. ++ */ ++ rc = 0; ++ } ++ } ++ + /* + * For WSL CHR and BLK reparse points it is required to fetch + * EA $LXDEV which contains major and minor device numbers. + */ + if (!rc && data->reparse_point) { + struct smb2_file_full_ea_info *ea; ++ u32 next = 0; + + ea = (struct smb2_file_full_ea_info *)data->wsl.eas; ++ do { ++ ea = (void *)((u8 *)ea + next); ++ next = le32_to_cpu(ea->next_entry_offset); ++ } while (next); ++ if (le16_to_cpu(ea->ea_value_length)) { ++ ea->next_entry_offset = cpu_to_le32(ALIGN(sizeof(*ea) + ++ ea->ea_name_length + 1 + ++ le16_to_cpu(ea->ea_value_length), 4)); ++ ea = (void *)((u8 *)ea + le32_to_cpu(ea->next_entry_offset)); ++ } ++ + rc = CIFSSMBQAllEAs(xid, tcon, full_path, SMB2_WSL_XATTR_DEV, + &ea->ea_data[SMB2_WSL_XATTR_NAME_LEN + 1], + SMB2_WSL_XATTR_DEV_SIZE, cifs_sb); +@@ -688,8 +746,8 @@ static int cifs_query_path_info(const unsigned int xid, + ea->ea_name_length = SMB2_WSL_XATTR_NAME_LEN; + ea->ea_value_length = cpu_to_le16(SMB2_WSL_XATTR_DEV_SIZE); + memcpy(&ea->ea_data[0], SMB2_WSL_XATTR_DEV, SMB2_WSL_XATTR_NAME_LEN + 1); +- data->wsl.eas_len = sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 + +- SMB2_WSL_XATTR_DEV_SIZE; ++ data->wsl.eas_len += ALIGN(sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 + ++ SMB2_WSL_XATTR_MODE_SIZE, 4); + rc = 0; + } else if (rc >= 0) { + /* It is an error if EA $LXDEV has wrong size. */ +-- +2.51.0 + diff --git a/queue-6.12/clk-at91-peripheral-fix-return-value.patch b/queue-6.12/clk-at91-peripheral-fix-return-value.patch new file mode 100644 index 0000000000..fd295b0c62 --- /dev/null +++ b/queue-6.12/clk-at91-peripheral-fix-return-value.patch @@ -0,0 +1,44 @@ +From d1ea8714deed9b33022296ae5f7efbb27619cfa9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 11:17:53 -0400 +Subject: clk: at91: peripheral: fix return value + +From: Brian Masney + +[ Upstream commit 47b13635dabc14f1c2fdcaa5468b47ddadbdd1b5 ] + +determine_rate() is expected to return an error code, or 0 on success. +clk_sam9x5_peripheral_determine_rate() has a branch that returns the +parent rate on a certain case. This is the behavior of round_rate(), +so let's go ahead and fix this by setting req->rate. + +Fixes: b4c115c76184f ("clk: at91: clk-peripheral: add support for changeable parent rate") +Reviewed-by: Alexander Sverdlin +Acked-by: Nicolas Ferre +Signed-off-by: Brian Masney +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/clk-peripheral.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/at91/clk-peripheral.c b/drivers/clk/at91/clk-peripheral.c +index c173a44c800aa..629f050a855aa 100644 +--- a/drivers/clk/at91/clk-peripheral.c ++++ b/drivers/clk/at91/clk-peripheral.c +@@ -279,8 +279,11 @@ static int clk_sam9x5_peripheral_determine_rate(struct clk_hw *hw, + long best_diff = LONG_MIN; + u32 shift; + +- if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max) +- return parent_rate; ++ if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max) { ++ req->rate = parent_rate; ++ ++ return 0; ++ } + + /* Fist step: check the available dividers. */ + for (shift = 0; shift <= PERIPHERAL_MAX_SHIFT; shift++) { +-- +2.51.0 + diff --git a/queue-6.12/clk-mediatek-clk-mux-do-not-pass-flags-to-clk_mux_de.patch b/queue-6.12/clk-mediatek-clk-mux-do-not-pass-flags-to-clk_mux_de.patch new file mode 100644 index 0000000000..a0d4cc736f --- /dev/null +++ b/queue-6.12/clk-mediatek-clk-mux-do-not-pass-flags-to-clk_mux_de.patch @@ -0,0 +1,42 @@ +From 3a672fe574842ee11a9d9cee4e0a969071202d94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 23:09:31 +0800 +Subject: clk: mediatek: clk-mux: Do not pass flags to + clk_mux_determine_rate_flags() + +From: Chen-Yu Tsai + +[ Upstream commit 5e121370a7ad3414c7f3a77002e2b18abe5c6fe1 ] + +The `flags` in |struct mtk_mux| are core clk flags, not mux clk flags. +Passing one to the other is wrong. + +Since there aren't any actual users adding CLK_MUX_* flags, just drop it +for now. + +Fixes: b05ea3314390 ("clk: mediatek: clk-mux: Add .determine_rate() callback") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mux.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/clk/mediatek/clk-mux.c b/drivers/clk/mediatek/clk-mux.c +index 60990296450bb..9a12e58230bed 100644 +--- a/drivers/clk/mediatek/clk-mux.c ++++ b/drivers/clk/mediatek/clk-mux.c +@@ -146,9 +146,7 @@ static int mtk_clk_mux_set_parent_setclr_lock(struct clk_hw *hw, u8 index) + static int mtk_clk_mux_determine_rate(struct clk_hw *hw, + struct clk_rate_request *req) + { +- struct mtk_clk_mux *mux = to_mtk_clk_mux(hw); +- +- return clk_mux_determine_rate_flags(hw, req, mux->data->flags); ++ return clk_mux_determine_rate_flags(hw, req, 0); + } + + const struct clk_ops mtk_mux_clr_set_upd_ops = { +-- +2.51.0 + diff --git a/queue-6.12/clk-mediatek-mt8195-infra_ao-fix-parent-for-infra_ao.patch b/queue-6.12/clk-mediatek-mt8195-infra_ao-fix-parent-for-infra_ao.patch new file mode 100644 index 0000000000..80eabbc676 --- /dev/null +++ b/queue-6.12/clk-mediatek-mt8195-infra_ao-fix-parent-for-infra_ao.patch @@ -0,0 +1,39 @@ +From 4a451f2d1c1c89c868ead27fcceaeb07766b7be9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 10:38:28 +0200 +Subject: clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m + +From: AngeloGioacchino Del Regno + +[ Upstream commit 6c4c26b624790098988c1034541087e3e5ed5bed ] + +The infrastructure gate for the HDMI specific crystal needs the +top_hdmi_xtal clock to be configured in order to ungate the 26m +clock to the HDMI IP, and it wouldn't work without. + +Reparent the infra_ao_hdmi_26m clock to top_hdmi_xtal to fix that. + +Fixes: e2edf59dec0b ("clk: mediatek: Add MT8195 infrastructure clock support") +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mt8195-infra_ao.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/mediatek/clk-mt8195-infra_ao.c b/drivers/clk/mediatek/clk-mt8195-infra_ao.c +index bb648a88e43af..ad47fdb234607 100644 +--- a/drivers/clk/mediatek/clk-mt8195-infra_ao.c ++++ b/drivers/clk/mediatek/clk-mt8195-infra_ao.c +@@ -103,7 +103,7 @@ static const struct mtk_gate infra_ao_clks[] = { + GATE_INFRA_AO0(CLK_INFRA_AO_CQ_DMA_FPC, "infra_ao_cq_dma_fpc", "fpc", 28), + GATE_INFRA_AO0(CLK_INFRA_AO_UART5, "infra_ao_uart5", "top_uart", 29), + /* INFRA_AO1 */ +- GATE_INFRA_AO1(CLK_INFRA_AO_HDMI_26M, "infra_ao_hdmi_26m", "clk26m", 0), ++ GATE_INFRA_AO1(CLK_INFRA_AO_HDMI_26M, "infra_ao_hdmi_26m", "top_hdmi_xtal", 0), + GATE_INFRA_AO1(CLK_INFRA_AO_SPI0, "infra_ao_spi0", "top_spi", 1), + GATE_INFRA_AO1(CLK_INFRA_AO_MSDC0, "infra_ao_msdc0", "top_msdc50_0_hclk", 2), + GATE_INFRA_AO1(CLK_INFRA_AO_MSDC1, "infra_ao_msdc1", "top_axi", 4), +-- +2.51.0 + diff --git a/queue-6.12/clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch b/queue-6.12/clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch new file mode 100644 index 0000000000..80c2ec0df5 --- /dev/null +++ b/queue-6.12/clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch @@ -0,0 +1,50 @@ +From 356b5e626a2e9f2bc075c678cb6b7edeea54d30e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Jul 2025 13:11:55 -0700 +Subject: clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver + +From: Alok Tiwari + +[ Upstream commit 1624dead9a4d288a594fdf19735ebfe4bb567cb8 ] + +The conditional check for the PLL0 multiplier 'm' used a logical AND +instead of OR, making the range check ineffective. This patch replaces +&& with || to correctly reject invalid values of 'm' that are either +less than or equal to 0 or greater than LPC18XX_PLL0_MSEL_MAX. + +This ensures proper bounds checking during clk rate setting and rounding. + +Fixes: b04e0b8fd544 ("clk: add lpc18xx cgu clk driver") +Signed-off-by: Alok Tiwari +[sboyd@kernel.org: 'm' is unsigned so remove < condition] +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/nxp/clk-lpc18xx-cgu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c +index 30e0b283ca608..b9e204d63a972 100644 +--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c ++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c +@@ -381,7 +381,7 @@ static int lpc18xx_pll0_determine_rate(struct clk_hw *hw, + } + + m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2); +- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { ++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) { + pr_warn("%s: unable to support rate %lu\n", __func__, req->rate); + return -EINVAL; + } +@@ -404,7 +404,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, + } + + m = DIV_ROUND_UP_ULL(parent_rate, rate * 2); +- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { ++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) { + pr_warn("%s: unable to support rate %lu\n", __func__, rate); + return -EINVAL; + } +-- +2.51.0 + diff --git a/queue-6.12/clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch b/queue-6.12/clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch new file mode 100644 index 0000000000..3837708693 --- /dev/null +++ b/queue-6.12/clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch @@ -0,0 +1,68 @@ +From 74d09cabce90bb7a391394adfa9326804c0303ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 11:18:29 -0400 +Subject: clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() + +From: Brian Masney + +[ Upstream commit b46a3d323a5b7942e65025254c13801d0f475f02 ] + +The round_rate() clk ops is deprecated, so migrate this driver from +round_rate() to determine_rate() using the Coccinelle semantic patch +on the cover letter of this series. + +Signed-off-by: Brian Masney +Stable-dep-of: 1624dead9a4d ("clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver") +Signed-off-by: Sasha Levin +--- + drivers/clk/nxp/clk-lpc18xx-cgu.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c +index 81efa885069b2..30e0b283ca608 100644 +--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c ++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c +@@ -370,23 +370,25 @@ static unsigned long lpc18xx_pll0_recalc_rate(struct clk_hw *hw, + return 0; + } + +-static long lpc18xx_pll0_round_rate(struct clk_hw *hw, unsigned long rate, +- unsigned long *prate) ++static int lpc18xx_pll0_determine_rate(struct clk_hw *hw, ++ struct clk_rate_request *req) + { + unsigned long m; + +- if (*prate < rate) { ++ if (req->best_parent_rate < req->rate) { + pr_warn("%s: pll dividers not supported\n", __func__); + return -EINVAL; + } + +- m = DIV_ROUND_UP_ULL(*prate, rate * 2); ++ m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2); + if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { +- pr_warn("%s: unable to support rate %lu\n", __func__, rate); ++ pr_warn("%s: unable to support rate %lu\n", __func__, req->rate); + return -EINVAL; + } + +- return 2 * *prate * m; ++ req->rate = 2 * req->best_parent_rate * m; ++ ++ return 0; + } + + static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, +@@ -443,7 +445,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, + + static const struct clk_ops lpc18xx_pll0_ops = { + .recalc_rate = lpc18xx_pll0_recalc_rate, +- .round_rate = lpc18xx_pll0_round_rate, ++ .determine_rate = lpc18xx_pll0_determine_rate, + .set_rate = lpc18xx_pll0_set_rate, + }; + +-- +2.51.0 + diff --git a/queue-6.12/clk-qcom-common-fix-null-vs-is_err-check-in-qcom_cc_.patch b/queue-6.12/clk-qcom-common-fix-null-vs-is_err-check-in-qcom_cc_.patch new file mode 100644 index 0000000000..39d75c42c1 --- /dev/null +++ b/queue-6.12/clk-qcom-common-fix-null-vs-is_err-check-in-qcom_cc_.patch @@ -0,0 +1,43 @@ +From f90b540cb5d97f197205579f5930e1513696d314 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 09:33:36 +0300 +Subject: clk: qcom: common: Fix NULL vs IS_ERR() check in + qcom_cc_icc_register() + +From: Dan Carpenter + +[ Upstream commit 1e50f5c9965252ed6657b8692cd7366784d60616 ] + +The devm_clk_hw_get_clk() function doesn't return NULL, it returns error +pointers. Update the checking to match. + +Fixes: 8737ec830ee3 ("clk: qcom: common: Add interconnect clocks support") +Signed-off-by: Dan Carpenter +Reviewed-by: Imran Shaik +Reviewed-by: Konrad Dybcio +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/aLaPwL2gFS85WsfD@stanley.mountain +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/common.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/qcom/common.c b/drivers/clk/qcom/common.c +index 33cc1f73c69d1..cab2dbb7a8d49 100644 +--- a/drivers/clk/qcom/common.c ++++ b/drivers/clk/qcom/common.c +@@ -273,8 +273,8 @@ static int qcom_cc_icc_register(struct device *dev, + icd[i].slave_id = desc->icc_hws[i].slave_id; + hws = &desc->clks[desc->icc_hws[i].clk_id]->hw; + icd[i].clk = devm_clk_hw_get_clk(dev, hws, "icc"); +- if (!icd[i].clk) +- return dev_err_probe(dev, -ENOENT, ++ if (IS_ERR(icd[i].clk)) ++ return dev_err_probe(dev, PTR_ERR(icd[i].clk), + "(%d) clock entry is null\n", i); + icd[i].name = clk_hw_get_name(hws); + } +-- +2.51.0 + diff --git a/queue-6.12/clk-renesas-cpg-mssr-fix-memory-leak-in-cpg_mssr_res.patch b/queue-6.12/clk-renesas-cpg-mssr-fix-memory-leak-in-cpg_mssr_res.patch new file mode 100644 index 0000000000..3bba6fb3d4 --- /dev/null +++ b/queue-6.12/clk-renesas-cpg-mssr-fix-memory-leak-in-cpg_mssr_res.patch @@ -0,0 +1,54 @@ +From 754c5b629729a5e539919dbd9c3b14d622370b19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 02:28:10 +0100 +Subject: clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() + +From: Yuan CHen + +[ Upstream commit cc55fc58fc1b7f405003fd2ecf79e74653461f0b ] + +In case of krealloc_array() failure, the current error handling just +returns from the function without freeing the original array. +Fix this memory leak by freeing the original array. + +Fixes: 6aa1754764901668 ("clk: renesas: cpg-mssr: Ignore all clocks assigned to non-Linux system") +Signed-off-by: Yuan CHen +Reviewed-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20250908012810.4767-1-chenyuan_fl@163.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/clk/renesas/renesas-cpg-mssr.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/renesas/renesas-cpg-mssr.c b/drivers/clk/renesas/renesas-cpg-mssr.c +index 0f27c33192e10..112ed81f648ee 100644 +--- a/drivers/clk/renesas/renesas-cpg-mssr.c ++++ b/drivers/clk/renesas/renesas-cpg-mssr.c +@@ -1012,6 +1012,7 @@ static int __init cpg_mssr_reserved_init(struct cpg_mssr_priv *priv, + + of_for_each_phandle(&it, rc, node, "clocks", "#clock-cells", -1) { + int idx; ++ unsigned int *new_ids; + + if (it.node != priv->np) + continue; +@@ -1022,11 +1023,13 @@ static int __init cpg_mssr_reserved_init(struct cpg_mssr_priv *priv, + if (args[0] != CPG_MOD) + continue; + +- ids = krealloc_array(ids, (num + 1), sizeof(*ids), GFP_KERNEL); +- if (!ids) { ++ new_ids = krealloc_array(ids, (num + 1), sizeof(*ids), GFP_KERNEL); ++ if (!new_ids) { + of_node_put(it.node); ++ kfree(ids); + return -ENOMEM; + } ++ ids = new_ids; + + if (priv->reg_layout == CLK_REG_LAYOUT_RZ_A) + idx = MOD_CLK_PACK_10(args[1]); /* for DEF_MOD_STB() */ +-- +2.51.0 + diff --git a/queue-6.12/clk-tegra-do-not-overallocate-memory-for-bpmp-clocks.patch b/queue-6.12/clk-tegra-do-not-overallocate-memory-for-bpmp-clocks.patch new file mode 100644 index 0000000000..6b04607f15 --- /dev/null +++ b/queue-6.12/clk-tegra-do-not-overallocate-memory-for-bpmp-clocks.patch @@ -0,0 +1,43 @@ +From 79c4fe3b859c0b05d9e8fbb030bcce67a3655b69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Apr 2025 15:54:28 +0300 +Subject: clk: tegra: do not overallocate memory for bpmp clocks + +From: Fedor Pchelkin + +[ Upstream commit 49ef6491106209c595476fc122c3922dfd03253f ] + +struct tegra_bpmp::clocks is a pointer to a dynamically allocated array +of pointers to 'struct tegra_bpmp_clk'. + +But the size of the allocated area is calculated like it is an array +containing actual 'struct tegra_bpmp_clk' objects - it's not true, there +are just pointers. + +Found by Linux Verification Center (linuxtesting.org) with Svace static +analysis tool. + +Fixes: 2db12b15c6f3 ("clk: tegra: Register clocks from root to leaf") +Signed-off-by: Fedor Pchelkin +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/tegra/clk-bpmp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/tegra/clk-bpmp.c b/drivers/clk/tegra/clk-bpmp.c +index 7bfba0afd7783..4ec408c3a26aa 100644 +--- a/drivers/clk/tegra/clk-bpmp.c ++++ b/drivers/clk/tegra/clk-bpmp.c +@@ -635,7 +635,7 @@ static int tegra_bpmp_register_clocks(struct tegra_bpmp *bpmp, + + bpmp->num_clocks = count; + +- bpmp->clocks = devm_kcalloc(bpmp->dev, count, sizeof(struct tegra_bpmp_clk), GFP_KERNEL); ++ bpmp->clocks = devm_kcalloc(bpmp->dev, count, sizeof(*bpmp->clocks), GFP_KERNEL); + if (!bpmp->clocks) + return -ENOMEM; + +-- +2.51.0 + diff --git a/queue-6.12/cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch b/queue-6.12/cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch new file mode 100644 index 0000000000..01cd6e4be8 --- /dev/null +++ b/queue-6.12/cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch @@ -0,0 +1,47 @@ +From dca6c7f56dd453cd32ab1c86d1c6d47868e05b05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 21:48:12 -0500 +Subject: cpufreq: tegra186: Set target frequency for all cpus in policy + +From: Aaron Kling + +[ Upstream commit 0b1bb980fd7cae126ee3d59f817068a13e321b07 ] + +The original commit set all cores in a cluster to a shared policy, but +did not update set_target to apply a frequency change to all cores for +the policy. This caused most cores to remain stuck at their boot +frequency. + +Fixes: be4ae8c19492 ("cpufreq: tegra186: Share policy per cluster") +Signed-off-by: Aaron Kling +Reviewed-by: Mikko Perttunen +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/tegra186-cpufreq.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c +index 7b8fcfa55038b..39186008afbfd 100644 +--- a/drivers/cpufreq/tegra186-cpufreq.c ++++ b/drivers/cpufreq/tegra186-cpufreq.c +@@ -86,10 +86,14 @@ static int tegra186_cpufreq_set_target(struct cpufreq_policy *policy, + { + struct tegra186_cpufreq_data *data = cpufreq_get_driver_data(); + struct cpufreq_frequency_table *tbl = policy->freq_table + index; +- unsigned int edvd_offset = data->cpus[policy->cpu].edvd_offset; ++ unsigned int edvd_offset; + u32 edvd_val = tbl->driver_data; ++ u32 cpu; + +- writel(edvd_val, data->regs + edvd_offset); ++ for_each_cpu(cpu, policy->cpus) { ++ edvd_offset = data->cpus[cpu].edvd_offset; ++ writel(edvd_val, data->regs + edvd_offset); ++ } + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.12/crypto-essiv-check-ssize-for-decryption-and-in-place.patch b/queue-6.12/crypto-essiv-check-ssize-for-decryption-and-in-place.patch new file mode 100644 index 0000000000..2a46f5d8ed --- /dev/null +++ b/queue-6.12/crypto-essiv-check-ssize-for-decryption-and-in-place.patch @@ -0,0 +1,63 @@ +From 2bed23ed7562998d0b6546553376d76c04737a5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 15:54:20 +0800 +Subject: crypto: essiv - Check ssize for decryption and in-place encryption + +From: Herbert Xu + +[ Upstream commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f ] + +Move the ssize check to the start in essiv_aead_crypt so that +it's also checked for decryption and in-place encryption. + +Reported-by: Muhammad Alifa Ramdhan +Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation") +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/essiv.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/crypto/essiv.c b/crypto/essiv.c +index e63fc6442e320..aa7ebc1235274 100644 +--- a/crypto/essiv.c ++++ b/crypto/essiv.c +@@ -186,9 +186,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) + const struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm); + struct essiv_aead_request_ctx *rctx = aead_request_ctx(req); + struct aead_request *subreq = &rctx->aead_req; ++ int ivsize = crypto_aead_ivsize(tfm); ++ int ssize = req->assoclen - ivsize; + struct scatterlist *src = req->src; + int err; + ++ if (ssize < 0) ++ return -EINVAL; ++ + crypto_cipher_encrypt_one(tctx->essiv_cipher, req->iv, req->iv); + + /* +@@ -198,19 +203,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) + */ + rctx->assoc = NULL; + if (req->src == req->dst || !enc) { +- scatterwalk_map_and_copy(req->iv, req->dst, +- req->assoclen - crypto_aead_ivsize(tfm), +- crypto_aead_ivsize(tfm), 1); ++ scatterwalk_map_and_copy(req->iv, req->dst, ssize, ivsize, 1); + } else { + u8 *iv = (u8 *)aead_request_ctx(req) + tctx->ivoffset; +- int ivsize = crypto_aead_ivsize(tfm); +- int ssize = req->assoclen - ivsize; + struct scatterlist *sg; + int nents; + +- if (ssize < 0) +- return -EINVAL; +- + nents = sg_nents_for_len(req->src, ssize); + if (nents < 0) + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch b/queue-6.12/drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch new file mode 100644 index 0000000000..6c1dd1b774 --- /dev/null +++ b/queue-6.12/drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch @@ -0,0 +1,39 @@ +From 4314f4ed6fe392982d768f8e1b50b903039d64d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:22 +0200 +Subject: drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit d60f9c45d1bff7e20ecd57492ef7a5e33c94a37c ] + +Without these, it's impossible to program these registers. + +Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +index cbce194ec7b82..ff746fba850bc 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +@@ -155,6 +155,8 @@ + SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \ + SRI(VIEWPORT_START, SCL, id), \ + SRI(VIEWPORT_SIZE, SCL, id), \ ++ SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \ ++ SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \ + SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \ + SRI(SCL_VERT_FILTER_SCALE_RATIO, SCL, id), \ + SRI(SCL_VERT_FILTER_INIT, SCL, id), \ +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-display-properly-clear-scl_-_filter_control-.patch b/queue-6.12/drm-amd-display-properly-clear-scl_-_filter_control-.patch new file mode 100644 index 0000000000..a1b2cb9acf --- /dev/null +++ b/queue-6.12/drm-amd-display-properly-clear-scl_-_filter_control-.patch @@ -0,0 +1,51 @@ +From e7945c1e97de643b77f205b0c83aca5d99c2c7f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:23 +0200 +Subject: drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit c0aa7cf49dd6cb302fe28e7183992b772cb7420c ] + +Previously, the code would set a bit field which didn't exist +on DCE6 so it would be effectively a no-op. + +Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +index 2b1673d69ea83..e5c2fb134d14d 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +@@ -527,8 +527,7 @@ static void dce60_transform_set_scaler( + if (coeffs_v != xfm_dce->filter_v || coeffs_h != xfm_dce->filter_h) { + /* 4. Program vertical filters */ + if (xfm_dce->filter_v == NULL) +- REG_SET(SCL_VERT_FILTER_CONTROL, 0, +- SCL_V_2TAP_HARDCODE_COEF_EN, 0); ++ REG_WRITE(SCL_VERT_FILTER_CONTROL, 0); + program_multi_taps_filter( + xfm_dce, + data->taps.v_taps, +@@ -542,8 +541,7 @@ static void dce60_transform_set_scaler( + + /* 5. Program horizontal filters */ + if (xfm_dce->filter_h == NULL) +- REG_SET(SCL_HORZ_FILTER_CONTROL, 0, +- SCL_H_2TAP_HARDCODE_COEF_EN, 0); ++ REG_WRITE(SCL_HORZ_FILTER_CONTROL, 0); + program_multi_taps_filter( + xfm_dce, + data->taps.h_taps, +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-display-properly-disable-scaling-on-dce6.patch b/queue-6.12/drm-amd-display-properly-disable-scaling-on-dce6.patch new file mode 100644 index 0000000000..0773667d15 --- /dev/null +++ b/queue-6.12/drm-amd-display-properly-disable-scaling-on-dce6.patch @@ -0,0 +1,101 @@ +From a91ecbb051bde34e4b6fce9e218d0fec9c26d3fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:24 +0200 +Subject: drm/amd/display: Properly disable scaling on DCE6 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit a7dc87f3448bea5ebe054f14e861074b9c289c65 ] + +SCL_SCALER_ENABLE can be used to enable/disable the scaler +on DCE6. Program it to 0 when scaling isn't used, 1 when used. +Additionally, clear some other registers when scaling is +disabled and program the SCL_UPDATE register as recommended. + +This fixes visible glitches for users whose BIOS sets up a +mode with scaling at boot, which DC was unable to clean up. + +Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/dce/dce_transform.c | 15 +++++++++++---- + .../gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++ + 2 files changed, 13 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +index e5c2fb134d14d..1ab5ae9b5ea51 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +@@ -154,10 +154,13 @@ static bool dce60_setup_scaling_configuration( + REG_SET(SCL_BYPASS_CONTROL, 0, SCL_BYPASS_MODE, 0); + + if (data->taps.h_taps + data->taps.v_taps <= 2) { +- /* Set bypass */ +- +- /* DCE6 has no SCL_MODE register, skip scale mode programming */ ++ /* Disable scaler functionality */ ++ REG_WRITE(SCL_SCALER_ENABLE, 0); + ++ /* Clear registers that can cause glitches even when the scaler is off */ ++ REG_WRITE(SCL_TAP_CONTROL, 0); ++ REG_WRITE(SCL_AUTOMATIC_MODE_CONTROL, 0); ++ REG_WRITE(SCL_F_SHARP_CONTROL, 0); + return false; + } + +@@ -165,7 +168,7 @@ static bool dce60_setup_scaling_configuration( + SCL_H_NUM_OF_TAPS, data->taps.h_taps - 1, + SCL_V_NUM_OF_TAPS, data->taps.v_taps - 1); + +- /* DCE6 has no SCL_MODE register, skip scale mode programming */ ++ REG_WRITE(SCL_SCALER_ENABLE, 1); + + /* DCE6 has no SCL_BOUNDARY_MODE bit, skip replace out of bound pixels */ + +@@ -502,6 +505,8 @@ static void dce60_transform_set_scaler( + REG_SET(DC_LB_MEM_SIZE, 0, + DC_LB_MEM_SIZE, xfm_dce->lb_memory_size); + ++ REG_WRITE(SCL_UPDATE, 0x00010000); ++ + /* Clear SCL_F_SHARP_CONTROL value to 0 */ + REG_WRITE(SCL_F_SHARP_CONTROL, 0); + +@@ -564,6 +569,8 @@ static void dce60_transform_set_scaler( + /* DCE6 has no SCL_COEF_UPDATE_COMPLETE bit to flip to new coefficient memory */ + + /* DCE6 DATA_FORMAT register does not support ALPHA_EN */ ++ ++ REG_WRITE(SCL_UPDATE, 0); + } + #endif + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +index ff746fba850bc..eb716e8337e23 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +@@ -155,6 +155,7 @@ + SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \ + SRI(VIEWPORT_START, SCL, id), \ + SRI(VIEWPORT_SIZE, SCL, id), \ ++ SRI(SCL_SCALER_ENABLE, SCL, id), \ + SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \ + SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \ + SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \ +@@ -592,6 +593,7 @@ struct dce_transform_registers { + uint32_t SCL_VERT_FILTER_SCALE_RATIO; + uint32_t SCL_HORZ_FILTER_INIT; + #if defined(CONFIG_DRM_AMD_DC_SI) ++ uint32_t SCL_SCALER_ENABLE; + uint32_t SCL_HORZ_FILTER_INIT_RGB_LUMA; + uint32_t SCL_HORZ_FILTER_INIT_CHROMA; + #endif +-- +2.51.0 + diff --git a/queue-6.12/drm-amdgpu-add-additional-dce6-scl-registers.patch b/queue-6.12/drm-amdgpu-add-additional-dce6-scl-registers.patch new file mode 100644 index 0000000000..24eecf8849 --- /dev/null +++ b/queue-6.12/drm-amdgpu-add-additional-dce6-scl-registers.patch @@ -0,0 +1,93 @@ +From 5875e6005baa8acf96c3ed524c1d98ab47164edb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:21 +0200 +Subject: drm/amdgpu: Add additional DCE6 SCL registers + +From: Alex Deucher + +[ Upstream commit 507296328b36ffd00ec1f4fde5b8acafb7222ec7 ] + +Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)") +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h | 7 +++++++ + drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h | 2 ++ + 2 files changed, 9 insertions(+) + +diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h +index 9de01ae574c03..067eddd9c62d8 100644 +--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h ++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h +@@ -4115,6 +4115,7 @@ + #define mmSCL0_SCL_COEF_RAM_CONFLICT_STATUS 0x1B55 + #define mmSCL0_SCL_COEF_RAM_SELECT 0x1B40 + #define mmSCL0_SCL_COEF_RAM_TAP_DATA 0x1B41 ++#define mmSCL0_SCL_SCALER_ENABLE 0x1B42 + #define mmSCL0_SCL_CONTROL 0x1B44 + #define mmSCL0_SCL_DEBUG 0x1B6A + #define mmSCL0_SCL_DEBUG2 0x1B69 +@@ -4144,6 +4145,7 @@ + #define mmSCL1_SCL_COEF_RAM_CONFLICT_STATUS 0x1E55 + #define mmSCL1_SCL_COEF_RAM_SELECT 0x1E40 + #define mmSCL1_SCL_COEF_RAM_TAP_DATA 0x1E41 ++#define mmSCL1_SCL_SCALER_ENABLE 0x1E42 + #define mmSCL1_SCL_CONTROL 0x1E44 + #define mmSCL1_SCL_DEBUG 0x1E6A + #define mmSCL1_SCL_DEBUG2 0x1E69 +@@ -4173,6 +4175,7 @@ + #define mmSCL2_SCL_COEF_RAM_CONFLICT_STATUS 0x4155 + #define mmSCL2_SCL_COEF_RAM_SELECT 0x4140 + #define mmSCL2_SCL_COEF_RAM_TAP_DATA 0x4141 ++#define mmSCL2_SCL_SCALER_ENABLE 0x4142 + #define mmSCL2_SCL_CONTROL 0x4144 + #define mmSCL2_SCL_DEBUG 0x416A + #define mmSCL2_SCL_DEBUG2 0x4169 +@@ -4202,6 +4205,7 @@ + #define mmSCL3_SCL_COEF_RAM_CONFLICT_STATUS 0x4455 + #define mmSCL3_SCL_COEF_RAM_SELECT 0x4440 + #define mmSCL3_SCL_COEF_RAM_TAP_DATA 0x4441 ++#define mmSCL3_SCL_SCALER_ENABLE 0x4442 + #define mmSCL3_SCL_CONTROL 0x4444 + #define mmSCL3_SCL_DEBUG 0x446A + #define mmSCL3_SCL_DEBUG2 0x4469 +@@ -4231,6 +4235,7 @@ + #define mmSCL4_SCL_COEF_RAM_CONFLICT_STATUS 0x4755 + #define mmSCL4_SCL_COEF_RAM_SELECT 0x4740 + #define mmSCL4_SCL_COEF_RAM_TAP_DATA 0x4741 ++#define mmSCL4_SCL_SCALER_ENABLE 0x4742 + #define mmSCL4_SCL_CONTROL 0x4744 + #define mmSCL4_SCL_DEBUG 0x476A + #define mmSCL4_SCL_DEBUG2 0x4769 +@@ -4260,6 +4265,7 @@ + #define mmSCL5_SCL_COEF_RAM_CONFLICT_STATUS 0x4A55 + #define mmSCL5_SCL_COEF_RAM_SELECT 0x4A40 + #define mmSCL5_SCL_COEF_RAM_TAP_DATA 0x4A41 ++#define mmSCL5_SCL_SCALER_ENABLE 0x4A42 + #define mmSCL5_SCL_CONTROL 0x4A44 + #define mmSCL5_SCL_DEBUG 0x4A6A + #define mmSCL5_SCL_DEBUG2 0x4A69 +@@ -4287,6 +4293,7 @@ + #define mmSCL_COEF_RAM_CONFLICT_STATUS 0x1B55 + #define mmSCL_COEF_RAM_SELECT 0x1B40 + #define mmSCL_COEF_RAM_TAP_DATA 0x1B41 ++#define mmSCL_SCALER_ENABLE 0x1B42 + #define mmSCL_CONTROL 0x1B44 + #define mmSCL_DEBUG 0x1B6A + #define mmSCL_DEBUG2 0x1B69 +diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h +index bd8085ec54ed5..da5596fbfdcb3 100644 +--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h ++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h +@@ -8648,6 +8648,8 @@ + #define REGAMMA_LUT_INDEX__REGAMMA_LUT_INDEX__SHIFT 0x00000000 + #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK_MASK 0x00000007L + #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK__SHIFT 0x00000000 ++#define SCL_SCALER_ENABLE__SCL_SCALE_EN_MASK 0x00000001L ++#define SCL_SCALER_ENABLE__SCL_SCALE_EN__SHIFT 0x00000000 + #define SCL_ALU_CONTROL__SCL_ALU_DISABLE_MASK 0x00000001L + #define SCL_ALU_CONTROL__SCL_ALU_DISABLE__SHIFT 0x00000000 + #define SCL_BYPASS_CONTROL__SCL_BYPASS_MODE_MASK 0x00000003L +-- +2.51.0 + diff --git a/queue-6.12/drm-vmwgfx-fix-a-null-ptr-access-in-the-cursor-snoop.patch b/queue-6.12/drm-vmwgfx-fix-a-null-ptr-access-in-the-cursor-snoop.patch new file mode 100644 index 0000000000..1e0d8b239b --- /dev/null +++ b/queue-6.12/drm-vmwgfx-fix-a-null-ptr-access-in-the-cursor-snoop.patch @@ -0,0 +1,79 @@ +From e9aaf2fc458567ae4fd4b146d1773ea3b8f71b80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 11:36:55 -0400 +Subject: drm/vmwgfx: Fix a null-ptr access in the cursor snooper + +From: Zack Rusin + +[ Upstream commit 5ac2c0279053a2c5265d46903432fb26ae2d0da2 ] + +Check that the resource which is converted to a surface exists before +trying to use the cursor snooper on it. + +vmw_cmd_res_check allows explicit invalid (SVGA3D_INVALID_ID) identifiers +because some svga commands accept SVGA3D_INVALID_ID to mean "no surface", +unfortunately functions that accept the actual surfaces as objects might +(and in case of the cursor snooper, do not) be able to handle null +objects. Make sure that we validate not only the identifier (via the +vmw_cmd_res_check) but also check that the actual resource exists before +trying to do something with it. + +Fixes unchecked null-ptr reference in the snooping code. + +Signed-off-by: Zack Rusin +Fixes: c0951b797e7d ("drm/vmwgfx: Refactor resource management") +Reported-by: Kuzey Arda Bulut +Cc: Broadcom internal kernel review list +Cc: dri-devel@lists.freedesktop.org +Reviewed-by: Ian Forbes +Link: https://lore.kernel.org/r/20250917153655.1968583-1-zack.rusin@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +index ea741bc4ac3fc..8b72848bb25cd 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +@@ -1515,6 +1515,7 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, + SVGA3dCmdHeader *header) + { + struct vmw_bo *vmw_bo = NULL; ++ struct vmw_resource *res; + struct vmw_surface *srf = NULL; + VMW_DECLARE_CMD_VAR(*cmd, SVGA3dCmdSurfaceDMA); + int ret; +@@ -1550,18 +1551,24 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, + + dirty = (cmd->body.transfer == SVGA3D_WRITE_HOST_VRAM) ? + VMW_RES_DIRTY_SET : 0; +- ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, +- dirty, user_surface_converter, +- &cmd->body.host.sid, NULL); ++ ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, dirty, ++ user_surface_converter, &cmd->body.host.sid, ++ NULL); + if (unlikely(ret != 0)) { + if (unlikely(ret != -ERESTARTSYS)) + VMW_DEBUG_USER("could not find surface for DMA.\n"); + return ret; + } + +- srf = vmw_res_to_srf(sw_context->res_cache[vmw_res_surface].res); ++ res = sw_context->res_cache[vmw_res_surface].res; ++ if (!res) { ++ VMW_DEBUG_USER("Invalid DMA surface.\n"); ++ return -EINVAL; ++ } + +- vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo, header); ++ srf = vmw_res_to_srf(res); ++ vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo, ++ header); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.12/drm-vmwgfx-fix-copy-paste-typo-in-validation.patch b/queue-6.12/drm-vmwgfx-fix-copy-paste-typo-in-validation.patch new file mode 100644 index 0000000000..93fe13c374 --- /dev/null +++ b/queue-6.12/drm-vmwgfx-fix-copy-paste-typo-in-validation.patch @@ -0,0 +1,37 @@ +From 90b1be3c3555082f5d106b74967d682b62a654f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 14:54:26 -0500 +Subject: drm/vmwgfx: Fix copy-paste typo in validation + +From: Ian Forbes + +[ Upstream commit 228c5d44dffe8c293cd2d2f0e7ea45e64565b1c4 ] + +'entry' should be 'val' which is the loop iterator. + +Fixes: 9e931f2e0970 ("drm/vmwgfx: Refactor resource validation hashtable to use linux/hashtable implementation.") +Signed-off-by: Ian Forbes +Reviewed-by: Zack Rusin +Signed-off-by: Zack Rusin +Link: https://lore.kernel.org/r/20250926195427.1405237-2-ian.forbes@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +index c18dc414a047f..80e8bbc3021d1 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +@@ -639,7 +639,7 @@ void vmw_validation_drop_ht(struct vmw_validation_context *ctx) + hash_del_rcu(&val->hash.head); + + list_for_each_entry(val, &ctx->resource_ctx_list, head) +- hash_del_rcu(&entry->hash.head); ++ hash_del_rcu(&val->hash.head); + + ctx->sw_context = NULL; + } +-- +2.51.0 + diff --git a/queue-6.12/drm-vmwgfx-fix-use-after-free-in-validation.patch b/queue-6.12/drm-vmwgfx-fix-use-after-free-in-validation.patch new file mode 100644 index 0000000000..e4adc018f7 --- /dev/null +++ b/queue-6.12/drm-vmwgfx-fix-use-after-free-in-validation.patch @@ -0,0 +1,44 @@ +From b62990f36e8fc0f8045413276e1081152cc115e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 14:54:25 -0500 +Subject: drm/vmwgfx: Fix Use-after-free in validation + +From: Ian Forbes + +[ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ] + +Nodes stored in the validation duplicates hashtable come from an arena +allocator that is cleared at the end of vmw_execbuf_process. All nodes +are expected to be cleared in vmw_validation_drop_ht but this node escaped +because its resource was destroyed prematurely. + +Fixes: 64ad2abfe9a6 ("drm/vmwgfx: Adapt validation code for reference-free lookups") +Reported-by: Kuzey Arda Bulut +Signed-off-by: Ian Forbes +Reviewed-by: Zack Rusin +Signed-off-by: Zack Rusin +Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +index e7625b3f71e0e..c18dc414a047f 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +@@ -309,8 +309,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx, + hash_add_rcu(ctx->sw_context->res_ht, &node->hash.head, node->hash.key); + } + node->res = vmw_resource_reference_unless_doomed(res); +- if (!node->res) ++ if (!node->res) { ++ hash_del_rcu(&node->hash.head); + return -ESRCH; ++ } + + node->first_usage = 1; + if (!res->dev_priv->has_mob) { +-- +2.51.0 + diff --git a/queue-6.12/drm-xe-hw_engine_group-fix-double-write-lock-release.patch b/queue-6.12/drm-xe-hw_engine_group-fix-double-write-lock-release.patch new file mode 100644 index 0000000000..b9305cc4ce --- /dev/null +++ b/queue-6.12/drm-xe-hw_engine_group-fix-double-write-lock-release.patch @@ -0,0 +1,59 @@ +From 54dce7d343d41f3e71d0506fb5439d6a67e2d50e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 02:31:46 +0000 +Subject: drm/xe/hw_engine_group: Fix double write lock release in error path + +From: Shuicheng Lin + +[ Upstream commit 08fdfd260e641da203f80aff8d3ed19c5ecceb7d ] + +In xe_hw_engine_group_get_mode(), a write lock is acquired before +calling switch_mode(), which in turn invokes +xe_hw_engine_group_suspend_faulting_lr_jobs(). + +On failure inside xe_hw_engine_group_suspend_faulting_lr_jobs(), +the write lock is released there, and then again in +xe_hw_engine_group_get_mode(), leading to a double release. + +Fix this by keeping both acquire and release operation in +xe_hw_engine_group_get_mode(). + +Fixes: 770bd1d34113 ("drm/xe/hw_engine_group: Ensure safe transition between execution modes") +Cc: Francois Dugast +Signed-off-by: Shuicheng Lin +Reviewed-by: Francois Dugast +Link: https://lore.kernel.org/r/20250925023145.1203004-2-shuicheng.lin@intel.com +Signed-off-by: Lucas De Marchi +(cherry picked from commit 662d98b8b373007fa1b08ba93fee11f6fd3e387c) +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_hw_engine_group.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_hw_engine_group.c b/drivers/gpu/drm/xe/xe_hw_engine_group.c +index 82750520a90a5..f14a3cc7d1173 100644 +--- a/drivers/gpu/drm/xe/xe_hw_engine_group.c ++++ b/drivers/gpu/drm/xe/xe_hw_engine_group.c +@@ -237,17 +237,13 @@ static int xe_hw_engine_group_suspend_faulting_lr_jobs(struct xe_hw_engine_group + + err = q->ops->suspend_wait(q); + if (err) +- goto err_suspend; ++ return err; + } + + if (need_resume) + xe_hw_engine_group_resume_faulting_lr_jobs(group); + + return 0; +- +-err_suspend: +- up_write(&group->mode_sem); +- return err; + } + + /** +-- +2.51.0 + diff --git a/queue-6.12/gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch b/queue-6.12/gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch new file mode 100644 index 0000000000..7c9a4f02df --- /dev/null +++ b/queue-6.12/gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch @@ -0,0 +1,37 @@ +From 0488f6cec6ee263577c2795fec3fa1d38368ba59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 16:51:29 +0200 +Subject: gpio: wcd934x: mark the GPIO controller as sleeping + +From: Bartosz Golaszewski + +[ Upstream commit b5f8aa8d4bde0cf3e4595af5a536da337e5f1c78 ] + +The slimbus regmap passed to the GPIO driver down from MFD does not use +fast_io. This means a mutex is used for locking and thus this GPIO chip +must not be used in atomic context. Change the can_sleep switch in +struct gpio_chip to true. + +Fixes: 59c324683400 ("gpio: wcd934x: Add support to wcd934x gpio controller") +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-wcd934x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-wcd934x.c b/drivers/gpio/gpio-wcd934x.c +index cfa7b0a50c8e3..03b16b8f639ad 100644 +--- a/drivers/gpio/gpio-wcd934x.c ++++ b/drivers/gpio/gpio-wcd934x.c +@@ -102,7 +102,7 @@ static int wcd_gpio_probe(struct platform_device *pdev) + chip->base = -1; + chip->ngpio = WCD934X_NPINS; + chip->label = dev_name(dev); +- chip->can_sleep = false; ++ chip->can_sleep = true; + + return devm_gpiochip_add_data(dev, chip, data); + } +-- +2.51.0 + diff --git a/queue-6.12/ice-ice_adapter-release-xa-entry-on-adapter-allocati.patch b/queue-6.12/ice-ice_adapter-release-xa-entry-on-adapter-allocati.patch new file mode 100644 index 0000000000..e0fd3f4c53 --- /dev/null +++ b/queue-6.12/ice-ice_adapter-release-xa-entry-on-adapter-allocati.patch @@ -0,0 +1,66 @@ +From 220139711abf18538502ca18b1d70bc4de624bcc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 19:53:36 +0800 +Subject: ice: ice_adapter: release xa entry on adapter allocation failure + +From: Haotian Zhang + +[ Upstream commit 2db687f3469dbc5c59bc53d55acafd75d530b497 ] + +When ice_adapter_new() fails, the reserved XArray entry created by +xa_insert() is not released. This causes subsequent insertions at +the same index to return -EBUSY, potentially leading to +NULL pointer dereferences. + +Reorder the operations as suggested by Przemek Kitszel: +1. Check if adapter already exists (xa_load) +2. Reserve the XArray slot (xa_reserve) +3. Allocate the adapter (ice_adapter_new) +4. Store the adapter (xa_store) + +Fixes: 0f0023c649c7 ("ice: do not init struct ice_adapter more times than needed") +Suggested-by: Przemek Kitszel +Suggested-by: Jacob Keller +Signed-off-by: Haotian Zhang +Reviewed-by: Aleksandr Loktionov +Reviewed-by: Jacob Keller +Link: https://patch.msgid.link/20251001115336.1707-1-vulab@iscas.ac.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_adapter.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_adapter.c b/drivers/net/ethernet/intel/ice/ice_adapter.c +index 10285995c9edd..cc4798026182e 100644 +--- a/drivers/net/ethernet/intel/ice/ice_adapter.c ++++ b/drivers/net/ethernet/intel/ice/ice_adapter.c +@@ -98,19 +98,21 @@ struct ice_adapter *ice_adapter_get(struct pci_dev *pdev) + + index = ice_adapter_xa_index(pdev); + scoped_guard(mutex, &ice_adapters_mutex) { +- err = xa_insert(&ice_adapters, index, NULL, GFP_KERNEL); +- if (err == -EBUSY) { +- adapter = xa_load(&ice_adapters, index); ++ adapter = xa_load(&ice_adapters, index); ++ if (adapter) { + refcount_inc(&adapter->refcount); + WARN_ON_ONCE(adapter->index != ice_adapter_index(pdev)); + return adapter; + } ++ err = xa_reserve(&ice_adapters, index, GFP_KERNEL); + if (err) + return ERR_PTR(err); + + adapter = ice_adapter_new(pdev); +- if (!adapter) ++ if (!adapter) { ++ xa_release(&ice_adapters, index); + return ERR_PTR(-ENOMEM); ++ } + xa_store(&ice_adapters, index, adapter, GFP_KERNEL); + } + return adapter; +-- +2.51.0 + diff --git a/queue-6.12/libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch b/queue-6.12/libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch new file mode 100644 index 0000000000..0ce01eed8a --- /dev/null +++ b/queue-6.12/libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch @@ -0,0 +1,59 @@ +From 7474113d633e0d0b73540d1b8f6e907fd01bf3e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:19 -0700 +Subject: libperf event: Ensure tracing data is multiple of 8 sized + +From: Ian Rogers + +[ Upstream commit b39c915a4f365cce6bdc0e538ed95d31823aea8f ] + +Perf's synthetic-events.c will ensure 8-byte alignment of tracing +data, writing it after a perf_record_header_tracing_data event. + +Add padding to struct perf_record_header_tracing_data to make it 16-byte +rather than 12-byte sized. + +Fixes: 055c67ed39887c55 ("perf tools: Move event synthesizing routines to separate .c file") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Acked-by: Namhyung Kim +Tested-by: Arnaldo Carvalho de Melo +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Blake Jones +Cc: Chun-Tse Shao +Cc: Collin Funk +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jan Polensky +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Li Huafei +Cc: Mark Rutland +Cc: Nam Cao +Cc: Peter Zijlstra +Cc: Steinar H. Gunderson +Cc: Thomas Gleixner +Link: https://lore.kernel.org/r/20250821163820.1132977-6-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/perf/include/perf/event.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/lib/perf/include/perf/event.h b/tools/lib/perf/include/perf/event.h +index 37bb7771d9143..32b75c0326c93 100644 +--- a/tools/lib/perf/include/perf/event.h ++++ b/tools/lib/perf/include/perf/event.h +@@ -291,6 +291,7 @@ struct perf_record_header_event_type { + struct perf_record_header_tracing_data { + struct perf_event_header header; + __u32 size; ++ __u32 pad; + }; + + #define PERF_RECORD_MISC_BUILD_ID_SIZE (1 << 15) +-- +2.51.0 + diff --git a/queue-6.12/loongarch-add-cflag-fno-isolate-erroneous-paths-dere.patch b/queue-6.12/loongarch-add-cflag-fno-isolate-erroneous-paths-dere.patch new file mode 100644 index 0000000000..55b9bdbd7a --- /dev/null +++ b/queue-6.12/loongarch-add-cflag-fno-isolate-erroneous-paths-dere.patch @@ -0,0 +1,59 @@ +From bc956915916a8d30ff7f5d107af36eee42d6f824 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 22:38:57 +0800 +Subject: LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference + +From: Tiezhu Yang + +[ Upstream commit abb2a5572264b425e6dd9c213b735a82ab0ca68a ] + +Currently, when compiling with GCC, there is no "break 7" instruction +for zero division due to using the option -mno-check-zero-division, but +the compiler still generates "break 0" instruction for zero division. + +Here is a simple example: + + $ cat test.c + int div(int a) + { + return a / 0; + } + $ gcc -O2 -S test.c -o test.s + +GCC generates "break 0" on LoongArch and "ud2" on x86, objtool decodes +"ud2" as INSN_BUG for x86, so decode "break 0" as INSN_BUG can fix the +objtool warnings for LoongArch, but this is not the intention. + +When decoding "break 0" as INSN_TRAP in the previous commit, the aim is +to handle "break 0" as a trap. The generated "break 0" for zero division +by GCC is not proper, it should generate a break instruction with proper +bug type, so add the GCC option -fno-isolate-erroneous-paths-dereference +to avoid generating the unexpected "break 0" instruction for now. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/r/202509200413.7uihAxJ5-lkp@intel.com/ +Fixes: baad7830ee9a ("objtool/LoongArch: Mark types based on break immediate code") +Suggested-by: WANG Rui +Signed-off-by: Tiezhu Yang +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/loongarch/Makefile b/arch/loongarch/Makefile +index 567bd122a9ee4..c14ae21075c5f 100644 +--- a/arch/loongarch/Makefile ++++ b/arch/loongarch/Makefile +@@ -114,7 +114,7 @@ KBUILD_RUSTFLAGS_KERNEL += -Crelocation-model=pie + LDFLAGS_vmlinux += -static -pie --no-dynamic-linker -z notext $(call ld-option, --apply-dynamic-relocs) + endif + +-cflags-y += $(call cc-option, -mno-check-zero-division) ++cflags-y += $(call cc-option, -mno-check-zero-division -fno-isolate-erroneous-paths-dereference) + + ifndef CONFIG_KASAN + cflags-y += -fno-builtin-memcpy -fno-builtin-memmove -fno-builtin-memset +-- +2.51.0 + diff --git a/queue-6.12/loongarch-init-acpi_gbl_use_global_lock-to-false.patch b/queue-6.12/loongarch-init-acpi_gbl_use_global_lock-to-false.patch new file mode 100644 index 0000000000..bd868af920 --- /dev/null +++ b/queue-6.12/loongarch-init-acpi_gbl_use_global_lock-to-false.patch @@ -0,0 +1,37 @@ +From abbcba805d220623909699cbeb81b739d3dd5a06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 22:38:57 +0800 +Subject: LoongArch: Init acpi_gbl_use_global_lock to false + +From: Huacai Chen + +[ Upstream commit 98662be7ef20d2b88b598f72e7ce9b6ac26a40f9 ] + +Init acpi_gbl_use_global_lock to false, in order to void error messages +during boot phase: + + ACPI Error: Could not enable GlobalLock event (20240827/evxfevnt-182) + ACPI Error: No response from Global Lock hardware, disabling lock (20240827/evglock-59) + +Fixes: 628c3bb40e9a8cefc0a6 ("LoongArch: Add boot and setup routines") +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/kernel/setup.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c +index 1fa6a604734ef..2ceb198ae8c80 100644 +--- a/arch/loongarch/kernel/setup.c ++++ b/arch/loongarch/kernel/setup.c +@@ -354,6 +354,7 @@ void __init platform_init(void) + + #ifdef CONFIG_ACPI + acpi_table_upgrade(); ++ acpi_gbl_use_global_lock = false; + acpi_gbl_use_default_register_widths = false; + acpi_boot_table_init(); + #endif +-- +2.51.0 + diff --git a/queue-6.12/mailbox-mtk-cmdq-mailbox-switch-to-__pm_runtime_put_.patch b/queue-6.12/mailbox-mtk-cmdq-mailbox-switch-to-__pm_runtime_put_.patch new file mode 100644 index 0000000000..16aff61c88 --- /dev/null +++ b/queue-6.12/mailbox-mtk-cmdq-mailbox-switch-to-__pm_runtime_put_.patch @@ -0,0 +1,75 @@ +From 99783625101e75347e94fbe9beb11f01ec10462c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Oct 2024 12:41:23 +0300 +Subject: mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() + +From: Sakari Ailus + +[ Upstream commit 08fb6d8ff900a1d06ef2f4a6ded45cdaa7140c01 ] + +pm_runtime_put_autosuspend() will soon be changed to include a call to +pm_runtime_mark_last_busy(). This patch switches the current users to +__pm_runtime_put_autosuspend() which will continue to have the +functionality of old pm_runtime_put_autosuspend(). + +Signed-off-by: Sakari Ailus +Reviewed-by: Matthias Brugger +Signed-off-by: Jassi Brar +Stable-dep-of: 3f39f5652037 ("mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data()") +Signed-off-by: Sasha Levin +--- + drivers/mailbox/mtk-cmdq-mailbox.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c +index d24f71819c3d6..4e093b58fb7b5 100644 +--- a/drivers/mailbox/mtk-cmdq-mailbox.c ++++ b/drivers/mailbox/mtk-cmdq-mailbox.c +@@ -390,7 +390,7 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data) + + task = kzalloc(sizeof(*task), GFP_ATOMIC); + if (!task) { +- pm_runtime_put_autosuspend(cmdq->mbox.dev); ++ __pm_runtime_put_autosuspend(cmdq->mbox.dev); + return -ENOMEM; + } + +@@ -440,7 +440,7 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data) + list_move_tail(&task->list_entry, &thread->task_busy_list); + + pm_runtime_mark_last_busy(cmdq->mbox.dev); +- pm_runtime_put_autosuspend(cmdq->mbox.dev); ++ __pm_runtime_put_autosuspend(cmdq->mbox.dev); + + return 0; + } +@@ -488,7 +488,7 @@ static void cmdq_mbox_shutdown(struct mbox_chan *chan) + spin_unlock_irqrestore(&thread->chan->lock, flags); + + pm_runtime_mark_last_busy(cmdq->mbox.dev); +- pm_runtime_put_autosuspend(cmdq->mbox.dev); ++ __pm_runtime_put_autosuspend(cmdq->mbox.dev); + } + + static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout) +@@ -528,7 +528,7 @@ static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout) + out: + spin_unlock_irqrestore(&thread->chan->lock, flags); + pm_runtime_mark_last_busy(cmdq->mbox.dev); +- pm_runtime_put_autosuspend(cmdq->mbox.dev); ++ __pm_runtime_put_autosuspend(cmdq->mbox.dev); + + return 0; + +@@ -543,7 +543,7 @@ static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout) + return -EFAULT; + } + pm_runtime_mark_last_busy(cmdq->mbox.dev); +- pm_runtime_put_autosuspend(cmdq->mbox.dev); ++ __pm_runtime_put_autosuspend(cmdq->mbox.dev); + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.12/mailbox-mtk-cmdq-remove-pm_runtime-apis-from-cmdq_mb.patch b/queue-6.12/mailbox-mtk-cmdq-remove-pm_runtime-apis-from-cmdq_mb.patch new file mode 100644 index 0000000000..9576ee3a76 --- /dev/null +++ b/queue-6.12/mailbox-mtk-cmdq-remove-pm_runtime-apis-from-cmdq_mb.patch @@ -0,0 +1,96 @@ +From c07c48777be2beee8885e3588124f62ce5c990af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 17:15:58 +0800 +Subject: mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() + +From: Jason-JH Lin + +[ Upstream commit 3f39f56520374cf56872644acf9afcc618a4b674 ] + +pm_runtime_get_sync() and pm_runtime_put_autosuspend() were previously +called in cmdq_mbox_send_data(), which is under a spinlock in msg_submit() +(mailbox.c). This caused lockdep warnings such as "sleeping function +called from invalid context" when running with lockdebug enabled. + +The BUG report: + BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1164 + in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 3616, name: kworker/u17:3 + preempt_count: 1, expected: 0 + RCU nest depth: 0, expected: 0 + INFO: lockdep is turned off. + irq event stamp: 0 + CPU: 1 PID: 3616 Comm: kworker/u17:3 Not tainted 6.1.87-lockdep-14133-g26e933aca785 #1 + Hardware name: Google Ciri sku0/unprovisioned board (DT) + Workqueue: imgsys_runner imgsys_runner_func + Call trace: + dump_backtrace+0x100/0x120 + show_stack+0x20/0x2c + dump_stack_lvl+0x84/0xb4 + dump_stack+0x18/0x48 + __might_resched+0x354/0x4c0 + __might_sleep+0x98/0xe4 + __pm_runtime_resume+0x70/0x124 + cmdq_mbox_send_data+0xe4/0xb1c + msg_submit+0x194/0x2dc + mbox_send_message+0x190/0x330 + imgsys_cmdq_sendtask+0x1618/0x2224 + imgsys_runner_func+0xac/0x11c + process_one_work+0x638/0xf84 + worker_thread+0x808/0xcd0 + kthread+0x24c/0x324 + ret_from_fork+0x10/0x20 + +Additionally, pm_runtime_put_autosuspend() should be invoked from the +GCE IRQ handler to ensure the hardware has actually completed its work. + +To resolve these issues, remove the pm_runtime calls from +cmdq_mbox_send_data() and delegate power management responsibilities +to the client driver. + +Fixes: 8afe816b0c99 ("mailbox: mtk-cmdq-mailbox: Implement Runtime PM with autosuspend") +Signed-off-by: Jason-JH Lin +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/mtk-cmdq-mailbox.c | 12 +----------- + 1 file changed, 1 insertion(+), 11 deletions(-) + +diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c +index d24f71819c3d6..38ab35157c85f 100644 +--- a/drivers/mailbox/mtk-cmdq-mailbox.c ++++ b/drivers/mailbox/mtk-cmdq-mailbox.c +@@ -379,20 +379,13 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data) + struct cmdq *cmdq = dev_get_drvdata(chan->mbox->dev); + struct cmdq_task *task; + unsigned long curr_pa, end_pa; +- int ret; + + /* Client should not flush new tasks if suspended. */ + WARN_ON(cmdq->suspended); + +- ret = pm_runtime_get_sync(cmdq->mbox.dev); +- if (ret < 0) +- return ret; +- + task = kzalloc(sizeof(*task), GFP_ATOMIC); +- if (!task) { +- pm_runtime_put_autosuspend(cmdq->mbox.dev); ++ if (!task) + return -ENOMEM; +- } + + task->cmdq = cmdq; + INIT_LIST_HEAD(&task->list_entry); +@@ -439,9 +432,6 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data) + } + list_move_tail(&task->list_entry, &thread->task_busy_list); + +- pm_runtime_mark_last_busy(cmdq->mbox.dev); +- pm_runtime_put_autosuspend(cmdq->mbox.dev); +- + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.12/mailbox-mtk-cmdq-switch-to-pm_runtime_put_autosuspen.patch b/queue-6.12/mailbox-mtk-cmdq-switch-to-pm_runtime_put_autosuspen.patch new file mode 100644 index 0000000000..169d69ba34 --- /dev/null +++ b/queue-6.12/mailbox-mtk-cmdq-switch-to-pm_runtime_put_autosuspen.patch @@ -0,0 +1,75 @@ +From f52221d673534050bf0f95ef72ded92025e14d83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jun 2025 11:15:01 +0300 +Subject: mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() + +From: Sakari Ailus + +[ Upstream commit 472f8a3fccbb579cb98c1821da4cb9cbd51ee3e4 ] + +__pm_runtime_put_autosuspend() was meant to be used by callers that needed +to put the Runtime PM usage_count without marking the device's last busy +timestamp. It was however seen that the Runtime PM autosuspend related +functions should include that call. Thus switch the driver to +use pm_runtime_put_autosuspend(). + +Signed-off-by: Sakari Ailus +Signed-off-by: Jassi Brar +Stable-dep-of: 3f39f5652037 ("mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data()") +Signed-off-by: Sasha Levin +--- + drivers/mailbox/mtk-cmdq-mailbox.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c +index 4e093b58fb7b5..d24f71819c3d6 100644 +--- a/drivers/mailbox/mtk-cmdq-mailbox.c ++++ b/drivers/mailbox/mtk-cmdq-mailbox.c +@@ -390,7 +390,7 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data) + + task = kzalloc(sizeof(*task), GFP_ATOMIC); + if (!task) { +- __pm_runtime_put_autosuspend(cmdq->mbox.dev); ++ pm_runtime_put_autosuspend(cmdq->mbox.dev); + return -ENOMEM; + } + +@@ -440,7 +440,7 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data) + list_move_tail(&task->list_entry, &thread->task_busy_list); + + pm_runtime_mark_last_busy(cmdq->mbox.dev); +- __pm_runtime_put_autosuspend(cmdq->mbox.dev); ++ pm_runtime_put_autosuspend(cmdq->mbox.dev); + + return 0; + } +@@ -488,7 +488,7 @@ static void cmdq_mbox_shutdown(struct mbox_chan *chan) + spin_unlock_irqrestore(&thread->chan->lock, flags); + + pm_runtime_mark_last_busy(cmdq->mbox.dev); +- __pm_runtime_put_autosuspend(cmdq->mbox.dev); ++ pm_runtime_put_autosuspend(cmdq->mbox.dev); + } + + static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout) +@@ -528,7 +528,7 @@ static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout) + out: + spin_unlock_irqrestore(&thread->chan->lock, flags); + pm_runtime_mark_last_busy(cmdq->mbox.dev); +- __pm_runtime_put_autosuspend(cmdq->mbox.dev); ++ pm_runtime_put_autosuspend(cmdq->mbox.dev); + + return 0; + +@@ -543,7 +543,7 @@ static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout) + return -EFAULT; + } + pm_runtime_mark_last_busy(cmdq->mbox.dev); +- __pm_runtime_put_autosuspend(cmdq->mbox.dev); ++ pm_runtime_put_autosuspend(cmdq->mbox.dev); + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.12/mailbox-zynqmp-ipi-fix-out-of-bounds-access-in-mailb.patch b/queue-6.12/mailbox-zynqmp-ipi-fix-out-of-bounds-access-in-mailb.patch new file mode 100644 index 0000000000..52804ffd79 --- /dev/null +++ b/queue-6.12/mailbox-zynqmp-ipi-fix-out-of-bounds-access-in-mailb.patch @@ -0,0 +1,39 @@ +From a02e648c43cc5c15514a1001a8fdef178b27427c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 13:07:22 +0530 +Subject: mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop + +From: Harini T + +[ Upstream commit 0aead8197fc1a85b0a89646e418feb49a564b029 ] + +The cleanup loop was starting at the wrong array index, causing +out-of-bounds access. +Start the loop at the correct index for zero-indexed arrays to prevent +accessing memory beyond the allocated array bounds. + +Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") +Signed-off-by: Harini T +Reviewed-by: Peng Fan +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/zynqmp-ipi-mailbox.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c +index 411bbc10edeaf..fab897b5724c1 100644 +--- a/drivers/mailbox/zynqmp-ipi-mailbox.c ++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c +@@ -890,7 +890,7 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) + if (pdata->irq < MAX_SGI) + xlnx_mbox_cleanup_sgi(pdata); + +- i = pdata->num_mboxes; ++ i = pdata->num_mboxes - 1; + for (; i >= 0; i--) { + ipi_mbox = &pdata->ipi_mboxes[i]; + if (device_is_registered(&ipi_mbox->dev)) +-- +2.51.0 + diff --git a/queue-6.12/mailbox-zynqmp-ipi-fix-sgi-cleanup-on-unbind.patch b/queue-6.12/mailbox-zynqmp-ipi-fix-sgi-cleanup-on-unbind.patch new file mode 100644 index 0000000000..8b4efed03a --- /dev/null +++ b/queue-6.12/mailbox-zynqmp-ipi-fix-sgi-cleanup-on-unbind.patch @@ -0,0 +1,87 @@ +From 20a1ea6d3ad5ee8b0ca3a96928c7e733a492bac6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 13:07:23 +0530 +Subject: mailbox: zynqmp-ipi: Fix SGI cleanup on unbind + +From: Harini T + +[ Upstream commit bb160e791ab15b89188a7a19589b8e11f681bef3 ] + +The driver incorrectly determines SGI vs SPI interrupts by checking IRQ +number < 16, which fails with dynamic IRQ allocation. During unbind, +this causes improper SGI cleanup leading to kernel crash. + +Add explicit irq_type field to pdata for reliable identification of SGI +interrupts (type-2) and only clean up SGI resources when appropriate. + +Fixes: 6ffb1635341b ("mailbox: zynqmp: handle SGI for shared IPI") +Signed-off-by: Harini T +Reviewed-by: Peng Fan +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/zynqmp-ipi-mailbox.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c +index fab897b5724c1..5bf81b60e9e67 100644 +--- a/drivers/mailbox/zynqmp-ipi-mailbox.c ++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c +@@ -62,7 +62,8 @@ + #define DST_BIT_POS 9U + #define SRC_BITMASK GENMASK(11, 8) + +-#define MAX_SGI 16 ++/* Macro to represent SGI type for IPI IRQs */ ++#define IPI_IRQ_TYPE_SGI 2 + + /* + * Module parameters +@@ -121,6 +122,7 @@ struct zynqmp_ipi_mbox { + * @dev: device pointer corresponding to the Xilinx ZynqMP + * IPI agent + * @irq: IPI agent interrupt ID ++ * @irq_type: IPI SGI or SPI IRQ type + * @method: IPI SMC or HVC is going to be used + * @local_id: local IPI agent ID + * @virq_sgi: IRQ number mapped to SGI +@@ -130,6 +132,7 @@ struct zynqmp_ipi_mbox { + struct zynqmp_ipi_pdata { + struct device *dev; + int irq; ++ unsigned int irq_type; + unsigned int method; + u32 local_id; + int virq_sgi; +@@ -887,7 +890,7 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) + struct zynqmp_ipi_mbox *ipi_mbox; + int i; + +- if (pdata->irq < MAX_SGI) ++ if (pdata->irq_type == IPI_IRQ_TYPE_SGI) + xlnx_mbox_cleanup_sgi(pdata); + + i = pdata->num_mboxes - 1; +@@ -956,14 +959,16 @@ static int zynqmp_ipi_probe(struct platform_device *pdev) + dev_err(dev, "failed to parse interrupts\n"); + goto free_mbox_dev; + } +- ret = out_irq.args[1]; ++ ++ /* Use interrupt type to distinguish SGI and SPI interrupts */ ++ pdata->irq_type = out_irq.args[0]; + + /* + * If Interrupt number is in SGI range, then request SGI else request + * IPI system IRQ. + */ +- if (ret < MAX_SGI) { +- pdata->irq = ret; ++ if (pdata->irq_type == IPI_IRQ_TYPE_SGI) { ++ pdata->irq = out_irq.args[1]; + ret = xlnx_mbox_init_sgi(pdev, pdata->irq, pdata); + if (ret) + goto free_mbox_dev; +-- +2.51.0 + diff --git a/queue-6.12/mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch b/queue-6.12/mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch new file mode 100644 index 0000000000..1ecfa99466 --- /dev/null +++ b/queue-6.12/mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch @@ -0,0 +1,48 @@ +From 14472a3333819e4a70486bfd3b1b64e0d1250608 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 13:07:21 +0530 +Subject: mailbox: zynqmp-ipi: Remove dev.parent check in + zynqmp_ipi_free_mboxes + +From: Harini T + +[ Upstream commit 019e3f4550fc7d319a7fd03eff487255f8e8aecd ] + +The ipi_mbox->dev.parent check is unreliable proxy for registration +status as it fails to protect against probe failures that occur after +the parent is assigned but before device_register() completes. + +device_is_registered() is the canonical and robust method to verify the +registration status. + +Remove ipi_mbox->dev.parent check in zynqmp_ipi_free_mboxes(). + +Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") +Signed-off-by: Harini T +Reviewed-by: Peng Fan +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/zynqmp-ipi-mailbox.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c +index 388f418aebb72..411bbc10edeaf 100644 +--- a/drivers/mailbox/zynqmp-ipi-mailbox.c ++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c +@@ -893,10 +893,8 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) + i = pdata->num_mboxes; + for (; i >= 0; i--) { + ipi_mbox = &pdata->ipi_mboxes[i]; +- if (ipi_mbox->dev.parent) { +- if (device_is_registered(&ipi_mbox->dev)) +- device_unregister(&ipi_mbox->dev); +- } ++ if (device_is_registered(&ipi_mbox->dev)) ++ device_unregister(&ipi_mbox->dev); + } + } + +-- +2.51.0 + diff --git a/queue-6.12/mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch b/queue-6.12/mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch new file mode 100644 index 0000000000..7fead45fd4 --- /dev/null +++ b/queue-6.12/mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch @@ -0,0 +1,43 @@ +From fe3da23bac6c9a5403efaaff9e02a74536761cc1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 13:07:20 +0530 +Subject: mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() + call + +From: Harini T + +[ Upstream commit 341867f730d3d3bb54491ee64e8b1a0c446656e7 ] + +The controller is registered using the device-managed function +'devm_mbox_controller_register()'. As documented in mailbox.c, this +ensures the devres framework automatically calls +mbox_controller_unregister() when device_unregister() is invoked, making +the explicit call unnecessary. + +Remove redundant mbox_controller_unregister() call as +device_unregister() handles controller cleanup. + +Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") +Signed-off-by: Harini T +Reviewed-by: Peng Fan +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/zynqmp-ipi-mailbox.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c +index d59fcb74b3479..388f418aebb72 100644 +--- a/drivers/mailbox/zynqmp-ipi-mailbox.c ++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c +@@ -894,7 +894,6 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) + for (; i >= 0; i--) { + ipi_mbox = &pdata->ipi_mboxes[i]; + if (ipi_mbox->dev.parent) { +- mbox_controller_unregister(&ipi_mbox->mbox); + if (device_is_registered(&ipi_mbox->dev)) + device_unregister(&ipi_mbox->dev); + } +-- +2.51.0 + diff --git a/queue-6.12/net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch b/queue-6.12/net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch new file mode 100644 index 0000000000..2c1522ac22 --- /dev/null +++ b/queue-6.12/net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch @@ -0,0 +1,41 @@ +From bbc6ebdf6890b7048a2a6f28a0a0c2139490fe2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 20:46:17 +0300 +Subject: net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe + +From: Erick Karanja + +[ Upstream commit 521405cb54cd2812bbb6dedd5afc14bca1e7e98a ] + +Add missing of_node_put call to release device node tbi obtained +via for_each_child_of_node. + +Fixes: afae5ad78b342 ("net/fsl_pq_mdio: streamline probing of MDIO nodes") +Signed-off-by: Erick Karanja +Link: https://patch.msgid.link/20251002174617.960521-1-karanja99erick@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c +index 026f7270a54de..fb5d12a87872e 100644 +--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c ++++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c +@@ -479,10 +479,12 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev) + "missing 'reg' property in node %pOF\n", + tbi); + err = -EBUSY; ++ of_node_put(tbi); + goto error; + } + set_tbipa(*prop, pdev, + data->get_tbipa, priv->map, &res); ++ of_node_put(tbi); + } + } + +-- +2.51.0 + diff --git a/queue-6.12/net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch b/queue-6.12/net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch new file mode 100644 index 0000000000..65c83345b3 --- /dev/null +++ b/queue-6.12/net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch @@ -0,0 +1,41 @@ +From 3c7bd5a5792e8524f9d3b6542065882e4433e835 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 15:25:01 +0300 +Subject: net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() + +From: Dan Carpenter + +[ Upstream commit 4f0d91ba72811fd5dd577bcdccd7fed649aae62c ] + +Print "entry->mac" before freeing "entry". The "entry" pointer is +freed with kfree_rcu() so it's unlikely that we would trigger this +in real life, but it's safer to re-order it. + +Fixes: cc5387f7346a ("net/mlx4_en: Add unicast MAC filtering") +Signed-off-by: Dan Carpenter +Reviewed-by: Tariq Toukan +Link: https://patch.msgid.link/aNvMHX4g8RksFFvV@stanley.mountain +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +index 281b34af0bb48..3160a1a2d2ab3 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +@@ -1180,9 +1180,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv, + mlx4_unregister_mac(mdev->dev, priv->port, mac); + + hlist_del_rcu(&entry->hlist); +- kfree_rcu(entry, rcu); + en_dbg(DRV, priv, "Removed MAC %pM on port:%d\n", + entry->mac, priv->port); ++ kfree_rcu(entry, rcu); + ++removed; + } + } +-- +2.51.0 + diff --git a/queue-6.12/net-mscc-ocelot-fix-use-after-free-caused-by-cyclic-.patch b/queue-6.12/net-mscc-ocelot-fix-use-after-free-caused-by-cyclic-.patch new file mode 100644 index 0000000000..92beb4418f --- /dev/null +++ b/queue-6.12/net-mscc-ocelot-fix-use-after-free-caused-by-cyclic-.patch @@ -0,0 +1,129 @@ +From 0b83ef6d4795ac2855cdbf8d0d6c70742ec0de62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 09:11:49 +0800 +Subject: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work + +From: Duoming Zhou + +[ Upstream commit bc9ea787079671cb19a8b25ff9f02be5ef6bfcf5 ] + +The origin code calls cancel_delayed_work() in ocelot_stats_deinit() +to cancel the cyclic delayed work item ocelot->stats_work. However, +cancel_delayed_work() may fail to cancel the work item if it is already +executing. While destroy_workqueue() does wait for all pending work items +in the work queue to complete before destroying the work queue, it cannot +prevent the delayed work item from being rescheduled within the +ocelot_check_stats_work() function. This limitation exists because the +delayed work item is only enqueued into the work queue after its timer +expires. Before the timer expiration, destroy_workqueue() has no visibility +of this pending work item. Once the work queue appears empty, +destroy_workqueue() proceeds with destruction. When the timer eventually +expires, the delayed work item gets queued again, leading to the following +warning: + +workqueue: cannot queue ocelot_check_stats_work on wq ocelot-switch-stats +WARNING: CPU: 2 PID: 0 at kernel/workqueue.c:2255 __queue_work+0x875/0xaf0 +... +RIP: 0010:__queue_work+0x875/0xaf0 +... +RSP: 0018:ffff88806d108b10 EFLAGS: 00010086 +RAX: 0000000000000000 RBX: 0000000000000101 RCX: 0000000000000027 +RDX: 0000000000000027 RSI: 0000000000000004 RDI: ffff88806d123e88 +RBP: ffffffff813c3170 R08: 0000000000000000 R09: ffffed100da247d2 +R10: ffffed100da247d1 R11: ffff88806d123e8b R12: ffff88800c00f000 +R13: ffff88800d7285c0 R14: ffff88806d0a5580 R15: ffff88800d7285a0 +FS: 0000000000000000(0000) GS:ffff8880e5725000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007fe18e45ea10 CR3: 0000000005e6c000 CR4: 00000000000006f0 +Call Trace: + + ? kasan_report+0xc6/0xf0 + ? __pfx_delayed_work_timer_fn+0x10/0x10 + ? __pfx_delayed_work_timer_fn+0x10/0x10 + call_timer_fn+0x25/0x1c0 + __run_timer_base.part.0+0x3be/0x8c0 + ? __pfx_delayed_work_timer_fn+0x10/0x10 + ? rcu_sched_clock_irq+0xb06/0x27d0 + ? __pfx___run_timer_base.part.0+0x10/0x10 + ? try_to_wake_up+0xb15/0x1960 + ? _raw_spin_lock_irq+0x80/0xe0 + ? __pfx__raw_spin_lock_irq+0x10/0x10 + tmigr_handle_remote_up+0x603/0x7e0 + ? __pfx_tmigr_handle_remote_up+0x10/0x10 + ? sched_balance_trigger+0x1c0/0x9f0 + ? sched_tick+0x221/0x5a0 + ? _raw_spin_lock_irq+0x80/0xe0 + ? __pfx__raw_spin_lock_irq+0x10/0x10 + ? tick_nohz_handler+0x339/0x440 + ? __pfx_tmigr_handle_remote_up+0x10/0x10 + __walk_groups.isra.0+0x42/0x150 + tmigr_handle_remote+0x1f4/0x2e0 + ? __pfx_tmigr_handle_remote+0x10/0x10 + ? ktime_get+0x60/0x140 + ? lapic_next_event+0x11/0x20 + ? clockevents_program_event+0x1d4/0x2a0 + ? hrtimer_interrupt+0x322/0x780 + handle_softirqs+0x16a/0x550 + irq_exit_rcu+0xaf/0xe0 + sysvec_apic_timer_interrupt+0x70/0x80 + +... + +The following diagram reveals the cause of the above warning: + +CPU 0 (remove) | CPU 1 (delayed work callback) +mscc_ocelot_remove() | + ocelot_deinit() | ocelot_check_stats_work() + ocelot_stats_deinit() | + cancel_delayed_work()| ... + | queue_delayed_work() + destroy_workqueue() | (wait a time) + | __queue_work() //UAF + +The above scenario actually constitutes a UAF vulnerability. + +The ocelot_stats_deinit() is only invoked when initialization +failure or resource destruction, so we must ensure that any +delayed work items cannot be rescheduled. + +Replace cancel_delayed_work() with disable_delayed_work_sync() +to guarantee proper cancellation of the delayed work item and +ensure completion of any currently executing work before the +workqueue is deallocated. + +A deadlock concern was considered: ocelot_stats_deinit() is called +in a process context and is not holding any locks that the delayed +work item might also need. Therefore, the use of the _sync() variant +is safe here. + +This bug was identified through static analysis. To reproduce the +issue and validate the fix, I simulated ocelot-switch device by +writing a kernel module and prepared the necessary resources for +the virtual ocelot-switch device's probe process. Then, removing +the virtual device will trigger the mscc_ocelot_remove() function, +which in turn destroys the workqueue. + +Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support") +Signed-off-by: Duoming Zhou +Link: https://patch.msgid.link/20251001011149.55073-1-duoming@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mscc/ocelot_stats.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mscc/ocelot_stats.c b/drivers/net/ethernet/mscc/ocelot_stats.c +index c018783757fb2..858d4cbc83d3f 100644 +--- a/drivers/net/ethernet/mscc/ocelot_stats.c ++++ b/drivers/net/ethernet/mscc/ocelot_stats.c +@@ -984,6 +984,6 @@ int ocelot_stats_init(struct ocelot *ocelot) + + void ocelot_stats_deinit(struct ocelot *ocelot) + { +- cancel_delayed_work(&ocelot->stats_work); ++ disable_delayed_work_sync(&ocelot->stats_work); + destroy_workqueue(ocelot->stats_queue); + } +-- +2.51.0 + diff --git a/queue-6.12/net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch b/queue-6.12/net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch new file mode 100644 index 0000000000..fd1c0a8524 --- /dev/null +++ b/queue-6.12/net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch @@ -0,0 +1,42 @@ +From 3db7406c0f520353415d901d1e4e31b877a5c640 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 12:14:47 +0300 +Subject: net/sctp: fix a null dereference in sctp_disposition + sctp_sf_do_5_1D_ce() + +From: Alexandr Sapozhnikov + +[ Upstream commit 2f3119686ef50319490ccaec81a575973da98815 ] + +If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 +and sctp_ulpevent_make_authkey() returns 0, then the variable +ai_ev remains zero and the zero will be dereferenced +in the sctp_ulpevent_free() function. + +Signed-off-by: Alexandr Sapozhnikov +Acked-by: Xin Long +Fixes: 30f6ebf65bc4 ("sctp: add SCTP_AUTH_NO_AUTH type for AUTHENTICATION_EVENT") +Link: https://patch.msgid.link/20251002091448.11-1-alsp705@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sctp/sm_statefuns.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index a0524ba8d7878..93cac73472c79 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -885,7 +885,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net, + return SCTP_DISPOSITION_CONSUME; + + nomem_authev: +- sctp_ulpevent_free(ai_ev); ++ if (ai_ev) ++ sctp_ulpevent_free(ai_ev); + nomem_aiev: + sctp_ulpevent_free(ev); + nomem_ev: +-- +2.51.0 + diff --git a/queue-6.12/netfilter-nft_objref-validate-objref-and-objrefmap-e.patch b/queue-6.12/netfilter-nft_objref-validate-objref-and-objrefmap-e.patch new file mode 100644 index 0000000000..158c1a1465 --- /dev/null +++ b/queue-6.12/netfilter-nft_objref-validate-objref-and-objrefmap-e.patch @@ -0,0 +1,131 @@ +From f443f5ae7b103a387b7d1b9a0d219a595cd7c399 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 12:08:16 +0200 +Subject: netfilter: nft_objref: validate objref and objrefmap expressions + +From: Fernando Fernandez Mancera + +[ Upstream commit f359b809d54c6e3dd1d039b97e0b68390b0e53e4 ] + +Referencing a synproxy stateful object from OUTPUT hook causes kernel +crash due to infinite recursive calls: + +BUG: TASK stack guard page was hit at 000000008bda5b8c (stack is 000000003ab1c4a5..00000000494d8b12) +[...] +Call Trace: + __find_rr_leaf+0x99/0x230 + fib6_table_lookup+0x13b/0x2d0 + ip6_pol_route+0xa4/0x400 + fib6_rule_lookup+0x156/0x240 + ip6_route_output_flags+0xc6/0x150 + __nf_ip6_route+0x23/0x50 + synproxy_send_tcp_ipv6+0x106/0x200 + synproxy_send_client_synack_ipv6+0x1aa/0x1f0 + nft_synproxy_do_eval+0x263/0x310 + nft_do_chain+0x5a8/0x5f0 [nf_tables + nft_do_chain_inet+0x98/0x110 + nf_hook_slow+0x43/0xc0 + __ip6_local_out+0xf0/0x170 + ip6_local_out+0x17/0x70 + synproxy_send_tcp_ipv6+0x1a2/0x200 + synproxy_send_client_synack_ipv6+0x1aa/0x1f0 +[...] + +Implement objref and objrefmap expression validate functions. + +Currently, only NFT_OBJECT_SYNPROXY object type requires validation. +This will also handle a jump to a chain using a synproxy object from the +OUTPUT hook. + +Now when trying to reference a synproxy object in the OUTPUT hook, nft +will produce the following error: + +synproxy_crash.nft: Error: Could not process rule: Operation not supported + synproxy name mysynproxy + ^^^^^^^^^^^^^^^^^^^^^^^^ + +Fixes: ee394f96ad75 ("netfilter: nft_synproxy: add synproxy stateful object support") +Reported-by: Georg Pfuetzenreuter +Closes: https://bugzilla.suse.com/1250237 +Signed-off-by: Fernando Fernandez Mancera +Reviewed-by: Pablo Neira Ayuso +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_objref.c | 39 ++++++++++++++++++++++++++++++++++++++ + 1 file changed, 39 insertions(+) + +diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c +index 8ee66a86c3bc7..1a62e384766a7 100644 +--- a/net/netfilter/nft_objref.c ++++ b/net/netfilter/nft_objref.c +@@ -22,6 +22,35 @@ void nft_objref_eval(const struct nft_expr *expr, + obj->ops->eval(obj, regs, pkt); + } + ++static int nft_objref_validate_obj_type(const struct nft_ctx *ctx, u32 type) ++{ ++ unsigned int hooks; ++ ++ switch (type) { ++ case NFT_OBJECT_SYNPROXY: ++ if (ctx->family != NFPROTO_IPV4 && ++ ctx->family != NFPROTO_IPV6 && ++ ctx->family != NFPROTO_INET) ++ return -EOPNOTSUPP; ++ ++ hooks = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD); ++ ++ return nft_chain_validate_hooks(ctx->chain, hooks); ++ default: ++ break; ++ } ++ ++ return 0; ++} ++ ++static int nft_objref_validate(const struct nft_ctx *ctx, ++ const struct nft_expr *expr) ++{ ++ struct nft_object *obj = nft_objref_priv(expr); ++ ++ return nft_objref_validate_obj_type(ctx, obj->ops->type->type); ++} ++ + static int nft_objref_init(const struct nft_ctx *ctx, + const struct nft_expr *expr, + const struct nlattr * const tb[]) +@@ -93,6 +122,7 @@ static const struct nft_expr_ops nft_objref_ops = { + .activate = nft_objref_activate, + .deactivate = nft_objref_deactivate, + .dump = nft_objref_dump, ++ .validate = nft_objref_validate, + .reduce = NFT_REDUCE_READONLY, + }; + +@@ -197,6 +227,14 @@ static void nft_objref_map_destroy(const struct nft_ctx *ctx, + nf_tables_destroy_set(ctx, priv->set); + } + ++static int nft_objref_map_validate(const struct nft_ctx *ctx, ++ const struct nft_expr *expr) ++{ ++ const struct nft_objref_map *priv = nft_expr_priv(expr); ++ ++ return nft_objref_validate_obj_type(ctx, priv->set->objtype); ++} ++ + static const struct nft_expr_ops nft_objref_map_ops = { + .type = &nft_objref_type, + .size = NFT_EXPR_SIZE(sizeof(struct nft_objref_map)), +@@ -206,6 +244,7 @@ static const struct nft_expr_ops nft_objref_map_ops = { + .deactivate = nft_objref_map_deactivate, + .destroy = nft_objref_map_destroy, + .dump = nft_objref_map_dump, ++ .validate = nft_objref_map_validate, + .reduce = NFT_REDUCE_READONLY, + }; + +-- +2.51.0 + diff --git a/queue-6.12/perf-arm-spe-rename-the-common-data-source-encoding.patch b/queue-6.12/perf-arm-spe-rename-the-common-data-source-encoding.patch new file mode 100644 index 0000000000..e63a5dbe16 --- /dev/null +++ b/queue-6.12/perf-arm-spe-rename-the-common-data-source-encoding.patch @@ -0,0 +1,158 @@ +From 7c75a466267a2dbba8d6ccf1c253566aaf8ef413 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Oct 2024 19:53:17 +0100 +Subject: perf arm-spe: Rename the common data source encoding + +From: Leo Yan + +[ Upstream commit 50b8f1d5bf4ad7f09ef8012ccf5f94f741df827b ] + +The Neoverse CPUs follow the common data source encoding, and other +CPU variants can share the same format. + +Rename the CPU list and data source definitions as common data source +names. This change prepares for appending more CPU variants. + +Signed-off-by: Leo Yan +Reviewed-by: James Clark +Link: https://lore.kernel.org/r/20241003185322.192357-3-leo.yan@arm.com +Signed-off-by: Namhyung Kim +Stable-dep-of: cb300e351505 ("perf arm_spe: Correct memory level for remote access") +Signed-off-by: Sasha Levin +--- + .../util/arm-spe-decoder/arm-spe-decoder.h | 18 ++++++------ + tools/perf/util/arm-spe.c | 28 +++++++++---------- + 2 files changed, 23 insertions(+), 23 deletions(-) + +diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +index 1443c28545a94..358c611eeddbb 100644 +--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h ++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +@@ -56,15 +56,15 @@ enum arm_spe_op_type { + ARM_SPE_OP_BR_INDIRECT = 1 << 17, + }; + +-enum arm_spe_neoverse_data_source { +- ARM_SPE_NV_L1D = 0x0, +- ARM_SPE_NV_L2 = 0x8, +- ARM_SPE_NV_PEER_CORE = 0x9, +- ARM_SPE_NV_LOCAL_CLUSTER = 0xa, +- ARM_SPE_NV_SYS_CACHE = 0xb, +- ARM_SPE_NV_PEER_CLUSTER = 0xc, +- ARM_SPE_NV_REMOTE = 0xd, +- ARM_SPE_NV_DRAM = 0xe, ++enum arm_spe_common_data_source { ++ ARM_SPE_COMMON_DS_L1D = 0x0, ++ ARM_SPE_COMMON_DS_L2 = 0x8, ++ ARM_SPE_COMMON_DS_PEER_CORE = 0x9, ++ ARM_SPE_COMMON_DS_LOCAL_CLUSTER = 0xa, ++ ARM_SPE_COMMON_DS_SYS_CACHE = 0xb, ++ ARM_SPE_COMMON_DS_PEER_CLUSTER = 0xc, ++ ARM_SPE_COMMON_DS_REMOTE = 0xd, ++ ARM_SPE_COMMON_DS_DRAM = 0xe, + }; + + struct arm_spe_record { +diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c +index 921b1c6e11379..4754d247dbe73 100644 +--- a/tools/perf/util/arm-spe.c ++++ b/tools/perf/util/arm-spe.c +@@ -411,15 +411,15 @@ static int arm_spe__synth_instruction_sample(struct arm_spe_queue *speq, + return arm_spe_deliver_synth_event(spe, speq, event, &sample); + } + +-static const struct midr_range neoverse_spe[] = { ++static const struct midr_range common_ds_encoding_cpus[] = { + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), + {}, + }; + +-static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *record, +- union perf_mem_data_src *data_src) ++static void arm_spe__synth_data_source_common(const struct arm_spe_record *record, ++ union perf_mem_data_src *data_src) + { + /* + * Even though four levels of cache hierarchy are possible, no known +@@ -441,17 +441,17 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec + } + + switch (record->source) { +- case ARM_SPE_NV_L1D: ++ case ARM_SPE_COMMON_DS_L1D: + data_src->mem_lvl = PERF_MEM_LVL_L1 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L1; + data_src->mem_snoop = PERF_MEM_SNOOP_NONE; + break; +- case ARM_SPE_NV_L2: ++ case ARM_SPE_COMMON_DS_L2: + data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2; + data_src->mem_snoop = PERF_MEM_SNOOP_NONE; + break; +- case ARM_SPE_NV_PEER_CORE: ++ case ARM_SPE_COMMON_DS_PEER_CORE: + data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; +@@ -460,8 +460,8 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec + * We don't know if this is L1, L2 but we do know it was a cache-2-cache + * transfer, so set SNOOPX_PEER + */ +- case ARM_SPE_NV_LOCAL_CLUSTER: +- case ARM_SPE_NV_PEER_CLUSTER: ++ case ARM_SPE_COMMON_DS_LOCAL_CLUSTER: ++ case ARM_SPE_COMMON_DS_PEER_CLUSTER: + data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; +@@ -469,7 +469,7 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec + /* + * System cache is assumed to be L3 + */ +- case ARM_SPE_NV_SYS_CACHE: ++ case ARM_SPE_COMMON_DS_SYS_CACHE: + data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3; + data_src->mem_snoop = PERF_MEM_SNOOP_HIT; +@@ -478,13 +478,13 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec + * We don't know what level it hit in, except it came from the other + * socket + */ +- case ARM_SPE_NV_REMOTE: ++ case ARM_SPE_COMMON_DS_REMOTE: + data_src->mem_lvl = PERF_MEM_LVL_REM_CCE1; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_ANY_CACHE; + data_src->mem_remote = PERF_MEM_REMOTE_REMOTE; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; + break; +- case ARM_SPE_NV_DRAM: ++ case ARM_SPE_COMMON_DS_DRAM: + data_src->mem_lvl = PERF_MEM_LVL_LOC_RAM | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_RAM; + data_src->mem_snoop = PERF_MEM_SNOOP_NONE; +@@ -520,7 +520,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco + static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr) + { + union perf_mem_data_src data_src = { .mem_op = PERF_MEM_OP_NA }; +- bool is_neoverse = is_midr_in_range_list(midr, neoverse_spe); ++ bool is_common = is_midr_in_range_list(midr, common_ds_encoding_cpus); + + /* Only synthesize data source for LDST operations */ + if (!is_ldst_op(record->op)) +@@ -533,8 +533,8 @@ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 m + else + return 0; + +- if (is_neoverse) +- arm_spe__synth_data_source_neoverse(record, &data_src); ++ if (is_common) ++ arm_spe__synth_data_source_common(record, &data_src); + else + arm_spe__synth_data_source_generic(record, &data_src); + +-- +2.51.0 + diff --git a/queue-6.12/perf-arm_spe-correct-memory-level-for-remote-access.patch b/queue-6.12/perf-arm_spe-correct-memory-level-for-remote-access.patch new file mode 100644 index 0000000000..5a0a07dc80 --- /dev/null +++ b/queue-6.12/perf-arm_spe-correct-memory-level-for-remote-access.patch @@ -0,0 +1,49 @@ +From 46357687a4fc2fadf7a9ce49e316f856df51c4b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 16:42:09 +0100 +Subject: perf arm_spe: Correct memory level for remote access + +From: Leo Yan + +[ Upstream commit cb300e3515057fb555983ce47e8acc86a5c69c3c ] + +For remote accesses, the data source packet does not contain information +about the memory level. To avoid misinformation, set the memory level to +NA (Not Available). + +Fixes: 4e6430cbb1a9f1dc ("perf arm-spe: Use SPE data source for neoverse cores") +Reviewed-by: James Clark +Signed-off-by: Leo Yan +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ali Saidi +Cc: German Gomez +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Will Deacon +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/arm-spe.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c +index 4754d247dbe73..9890b17241c34 100644 +--- a/tools/perf/util/arm-spe.c ++++ b/tools/perf/util/arm-spe.c +@@ -479,8 +479,8 @@ static void arm_spe__synth_data_source_common(const struct arm_spe_record *recor + * socket + */ + case ARM_SPE_COMMON_DS_REMOTE: +- data_src->mem_lvl = PERF_MEM_LVL_REM_CCE1; +- data_src->mem_lvl_num = PERF_MEM_LVLNUM_ANY_CACHE; ++ data_src->mem_lvl = PERF_MEM_LVL_NA; ++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_NA; + data_src->mem_remote = PERF_MEM_REMOTE_REMOTE; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; + break; +-- +2.51.0 + diff --git a/queue-6.12/perf-arm_spe-correct-setting-remote-access.patch b/queue-6.12/perf-arm_spe-correct-setting-remote-access.patch new file mode 100644 index 0000000000..488d8916cd --- /dev/null +++ b/queue-6.12/perf-arm_spe-correct-setting-remote-access.patch @@ -0,0 +1,46 @@ +From e134eb59cb43e169a0f05e52f80bb90a9dcea50d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 16:42:08 +0100 +Subject: perf arm_spe: Correct setting remote access + +From: Leo Yan + +[ Upstream commit 039fd0634a0629132432632d7ac9a14915406b5c ] + +Set the mem_remote field for a remote access to appropriately represent +the event. + +Fixes: a89dbc9b988f3ba8 ("perf arm-spe: Set sample's data source field") +Reviewed-by: James Clark +Signed-off-by: Leo Yan +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ali Saidi +Cc: German Gomez +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Will Deacon +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/arm-spe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c +index 2c06f2a85400e..921b1c6e11379 100644 +--- a/tools/perf/util/arm-spe.c ++++ b/tools/perf/util/arm-spe.c +@@ -514,7 +514,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco + } + + if (record->type & ARM_SPE_REMOTE_ACCESS) +- data_src->mem_lvl |= PERF_MEM_LVL_REM_CCE1; ++ data_src->mem_remote = PERF_MEM_REMOTE_REMOTE; + } + + static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr) +-- +2.51.0 + diff --git a/queue-6.12/perf-disasm-avoid-undefined-behavior-in-incrementing.patch b/queue-6.12/perf-disasm-avoid-undefined-behavior-in-incrementing.patch new file mode 100644 index 0000000000..c8e7fa4108 --- /dev/null +++ b/queue-6.12/perf-disasm-avoid-undefined-behavior-in-incrementing.patch @@ -0,0 +1,70 @@ +From e2d75c18f131b3e760a8f84ebf0ed6fe828bc9f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:15 -0700 +Subject: perf disasm: Avoid undefined behavior in incrementing NULL + +From: Ian Rogers + +[ Upstream commit 78d853512d6f979cf0cc41566e4f6cd82995ff34 ] + +Incrementing NULL is undefined behavior and triggers ubsan during the +perf annotate test. + +Split a compound statement over two lines to avoid this. + +Fixes: 98f69a573c668a18 ("perf annotate: Split out util/disasm.c") +Reviewed-by: Collin Funk +Reviewed-by: James Clark +Reviewed-by: Kuan-Wei Chiu +Signed-off-by: Ian Rogers +Acked-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Blake Jones +Cc: Chun-Tse Shao +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jan Polensky +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Li Huafei +Cc: Mark Rutland +Cc: Nam Cao +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Steinar H. Gunderson +Cc: Thomas Gleixner +Link: https://lore.kernel.org/r/20250821163820.1132977-2-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/disasm.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/disasm.c b/tools/perf/util/disasm.c +index 648e8d87ef194..a228a7ba30caa 100644 +--- a/tools/perf/util/disasm.c ++++ b/tools/perf/util/disasm.c +@@ -389,13 +389,16 @@ static int jump__parse(struct arch *arch, struct ins_operands *ops, struct map_s + * skip over possible up to 2 operands to get to address, e.g.: + * tbnz w0, #26, ffff0000083cd190 + */ +- if (c++ != NULL) { ++ if (c != NULL) { ++ c++; + ops->target.addr = strtoull(c, NULL, 16); + if (!ops->target.addr) { + c = strchr(c, ','); + c = validate_comma(c, ops); +- if (c++ != NULL) ++ if (c != NULL) { ++ c++; + ops->target.addr = strtoull(c, NULL, 16); ++ } + } + } else { + ops->target.addr = strtoull(ops->raw, NULL, 16); +-- +2.51.0 + diff --git a/queue-6.12/perf-evsel-avoid-container_of-on-a-null-leader.patch b/queue-6.12/perf-evsel-avoid-container_of-on-a-null-leader.patch new file mode 100644 index 0000000000..05874ec359 --- /dev/null +++ b/queue-6.12/perf-evsel-avoid-container_of-on-a-null-leader.patch @@ -0,0 +1,59 @@ +From 7733f45f7ea226e9a300b57d37fe08952a7e9d5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:17 -0700 +Subject: perf evsel: Avoid container_of on a NULL leader + +From: Ian Rogers + +[ Upstream commit 2354479026d726954ff86ce82f4b649637319661 ] + +An evsel should typically have a leader of itself, however, in tests +like 'Sample parsing' a NULL leader may occur and the container_of +will return a corrupt pointer. + +Avoid this with an explicit NULL test. + +Fixes: fba7c86601e2e42d ("libperf: Move 'leader' from tools/perf to perf_evsel::leader") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Acked-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Blake Jones +Cc: Chun-Tse Shao +Cc: Collin Funk +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jan Polensky +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Li Huafei +Cc: Mark Rutland +Cc: Nam Cao +Cc: Peter Zijlstra +Cc: Steinar H. Gunderson +Cc: Thomas Gleixner +Link: https://lore.kernel.org/r/20250821163820.1132977-4-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/evsel.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index 6d7249cc1a993..b3de8ce559998 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -3497,6 +3497,8 @@ bool evsel__is_hybrid(const struct evsel *evsel) + + struct evsel *evsel__leader(const struct evsel *evsel) + { ++ if (evsel->core.leader == NULL) ++ return NULL; + return container_of(evsel->core.leader, struct evsel, core); + } + +-- +2.51.0 + diff --git a/queue-6.12/perf-evsel-ensure-the-fallback-message-is-always-wri.patch b/queue-6.12/perf-evsel-ensure-the-fallback-message-is-always-wri.patch new file mode 100644 index 0000000000..e1ff9cd720 --- /dev/null +++ b/queue-6.12/perf-evsel-ensure-the-fallback-message-is-always-wri.patch @@ -0,0 +1,81 @@ +From b1f19e549f2b18801f6ceb0b5b39dc6f42320f32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 10:24:15 -0700 +Subject: perf evsel: Ensure the fallback message is always written to + +From: Ian Rogers + +[ Upstream commit 24937ee839e4bbc097acde73eeed67812bad2d99 ] + +The fallback message is unconditionally printed in places like +record__open(). + +If no fallback is attempted this can lead to printing uninitialized +data, crashes, etc. + +Fixes: c0a54341c0e89333 ("perf evsel: Introduce event fallback method") +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Howard Chu +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/evsel.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index 70c4e06da7a03..dda107b12b8c6 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -3237,7 +3237,7 @@ bool evsel__fallback(struct evsel *evsel, struct target *target, int err, + + /* If event has exclude user then don't exclude kernel. */ + if (evsel->core.attr.exclude_user) +- return false; ++ goto no_fallback; + + /* Is there already the separator in the name. */ + if (strchr(name, '/') || +@@ -3245,7 +3245,7 @@ bool evsel__fallback(struct evsel *evsel, struct target *target, int err, + sep = ""; + + if (asprintf(&new_name, "%s%su", name, sep) < 0) +- return false; ++ goto no_fallback; + + free(evsel->name); + evsel->name = new_name; +@@ -3268,17 +3268,19 @@ bool evsel__fallback(struct evsel *evsel, struct target *target, int err, + sep = ""; + + if (asprintf(&new_name, "%s%sH", name, sep) < 0) +- return false; ++ goto no_fallback; + + free(evsel->name); + evsel->name = new_name; + /* Apple M1 requires exclude_guest */ +- scnprintf(msg, msgsize, "trying to fall back to excluding guest samples"); ++ scnprintf(msg, msgsize, "Trying to fall back to excluding guest samples"); + evsel->core.attr.exclude_guest = 1; + + return true; + } +- ++no_fallback: ++ scnprintf(msg, msgsize, "No fallback found for '%s' for error %d", ++ evsel__name(evsel), err); + return false; + } + +-- +2.51.0 + diff --git a/queue-6.12/perf-python-split-clang-options-when-invoking-popen.patch b/queue-6.12/perf-python-split-clang-options-when-invoking-popen.patch new file mode 100644 index 0000000000..399d31ec9f --- /dev/null +++ b/queue-6.12/perf-python-split-clang-options-when-invoking-popen.patch @@ -0,0 +1,82 @@ +From feeac2b5d801ecce7e219db3c27c8f8cbd94b1e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Oct 2025 17:21:24 +0100 +Subject: perf python: split Clang options when invoking Popen + +From: Leo Yan + +[ Upstream commit c6a43bc3e8f6102a47da0d2e53428d08f00172fb ] + +When passing a list to subprocess.Popen, each element maps to one argv +token. Current code bundles multiple Clang flags into a single element, +something like: + + cmd = ['clang', + '--target=x86_64-linux-gnu -fintegrated-as -Wno-cast-function-type-mismatch', + 'test-hello.c'] + +So Clang only sees one long, invalid option instead of separate flags, +as a result, the script cannot capture any log via PIPE. + +Fix this by using shlex.split() to separate the string so each option +becomes its own argv element. The fixed list will be: + + cmd = ['clang', + '--target=x86_64-linux-gnu', + '-fintegrated-as', + '-Wno-cast-function-type-mismatch', + 'test-hello.c'] + +Fixes: 09e6f9f98370 ("perf python: Fix splitting CC into compiler and options") +Signed-off-by: Leo Yan +Reviewed-by: Ian Rogers +Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-2-4305590795b2@arm.com +Cc: Palmer Dabbelt +Cc: Albert Ou +Cc: Alexandre Ghiti +Cc: Nick Desaulniers +Cc: Justin Stitt +Cc: Bill Wendling +Cc: Adrian Hunter +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Nathan Chancellor +Cc: James Clark +Cc: linux-riscv@lists.infradead.org +Cc: llvm@lists.linux.dev +Cc: Paul Walmsley +Cc: linux-kernel@vger.kernel.org +Cc: linux-perf-users@vger.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/setup.py | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py +index 649550e9b7aa8..abb567de3e8a9 100644 +--- a/tools/perf/util/setup.py ++++ b/tools/perf/util/setup.py +@@ -1,6 +1,7 @@ + from os import getenv, path + from subprocess import Popen, PIPE + from re import sub ++import shlex + + cc = getenv("CC") + +@@ -16,7 +17,9 @@ cc_is_clang = b"clang version" in Popen([cc, "-v"], stderr=PIPE).stderr.readline + src_feature_tests = getenv('srctree') + '/tools/build/feature' + + def clang_has_option(option): +- cc_output = Popen([cc, cc_options + option, path.join(src_feature_tests, "test-hello.c") ], stderr=PIPE).stderr.readlines() ++ cmd = shlex.split(f"{cc} {cc_options} {option}") ++ cmd.append(path.join(src_feature_tests, "test-hello.c")) ++ cc_output = Popen(cmd, stderr=PIPE).stderr.readlines() + return [o for o in cc_output if ((b"unknown argument" in o) or (b"is not supported" in o) or (b"unknown warning option" in o))] == [ ] + + if cc_is_clang: +-- +2.51.0 + diff --git a/queue-6.12/perf-session-fix-handling-when-buffer-exceeds-2-gib.patch b/queue-6.12/perf-session-fix-handling-when-buffer-exceeds-2-gib.patch new file mode 100644 index 0000000000..36c2b46527 --- /dev/null +++ b/queue-6.12/perf-session-fix-handling-when-buffer-exceeds-2-gib.patch @@ -0,0 +1,53 @@ +From e04213ee4c16b8088d8cd69a7dbae4d1c1b532e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Aug 2025 14:24:40 +0100 +Subject: perf session: Fix handling when buffer exceeds 2 GiB +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leo Yan + +[ Upstream commit c17dda8013495d8132c976cbf349be9949d0fbd1 ] + +If a user specifies an AUX buffer larger than 2 GiB, the returned size +may exceed 0x80000000. Since the err variable is defined as a signed +32-bit integer, such a value overflows and becomes negative. + +As a result, the perf record command reports an error: + + 0x146e8 [0x30]: failed to process type: 71 [Unknown error 183711232] + +Change the type of the err variable to a signed 64-bit integer to +accommodate large buffer sizes correctly. + +Fixes: d5652d865ea734a1 ("perf session: Add ability to skip 4GiB or more") +Reported-by: Tamas Zsoldos +Signed-off-by: Leo Yan +Acked-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Jiri Olsa +Link: https://lore.kernel.org/r/20250808-perf_fix_big_buffer_size-v1-1-45f45444a9a4@arm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/session.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c +index dbaf07bf6c5fb..89e5354fa094c 100644 +--- a/tools/perf/util/session.c ++++ b/tools/perf/util/session.c +@@ -1371,7 +1371,7 @@ static s64 perf_session__process_user_event(struct perf_session *session, + const struct perf_tool *tool = session->tool; + struct perf_sample sample = { .time = 0, }; + int fd = perf_data__fd(session->data); +- int err; ++ s64 err; + + if (event->header.type != PERF_RECORD_COMPRESSED || perf_tool__compressed_is_stub(tool)) + dump_event(session->evlist, event, file_offset, &sample, file_path); +-- +2.51.0 + diff --git a/queue-6.12/perf-test-add-a-test-for-default-perf-stat-command.patch b/queue-6.12/perf-test-add-a-test-for-default-perf-stat-command.patch new file mode 100644 index 0000000000..9f5d9bdc9e --- /dev/null +++ b/queue-6.12/perf-test-add-a-test-for-default-perf-stat-command.patch @@ -0,0 +1,90 @@ +From 750a3ffe122cd3c1459e134edbd1ca5e4b1d60ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Sep 2024 15:48:38 +0100 +Subject: perf test: Add a test for default perf stat command + +From: James Clark + +[ Upstream commit 65d11821910bd910a2b4b5b005360d036c76ecef ] + +Test that one cycles event is opened for each core PMU when "perf stat" +is run without arguments. + +The event line can either be output as "pmu/cycles/" or just "cycles" if +there is only one PMU. Include 2 spaces for padding in the one PMU case +to avoid matching when the word cycles is included in metric +descriptions. + +Acked-by: Namhyung Kim +Acked-by: Kan Liang +Signed-off-by: James Clark +Cc: Yang Jihong +Cc: Dominique Martinet +Cc: Colin Ian King +Cc: Howard Chu +Cc: Ze Gao +Cc: Yicong Yang +Cc: Weilin Wang +Cc: Will Deacon +Cc: Mike Leach +Cc: Jing Zhang +Cc: Yang Li +Cc: Leo Yan +Cc: ak@linux.intel.com +Cc: Athira Rajeev +Cc: linux-arm-kernel@lists.infradead.org +Cc: Yanteng Si +Cc: Sun Haiyong +Cc: John Garry +Link: https://lore.kernel.org/r/20240926144851.245903-8-james.clark@linaro.org +Signed-off-by: Namhyung Kim +Stable-dep-of: 24937ee839e4 ("perf evsel: Ensure the fallback message is always written to") +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/stat.sh | 25 +++++++++++++++++++++++++ + 1 file changed, 25 insertions(+) + +diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh +index 3f1e67795490a..c6df7eec96b98 100755 +--- a/tools/perf/tests/shell/stat.sh ++++ b/tools/perf/tests/shell/stat.sh +@@ -146,6 +146,30 @@ test_cputype() { + echo "cputype test [Success]" + } + ++test_hybrid() { ++ # Test the default stat command on hybrid devices opens one cycles event for ++ # each CPU type. ++ echo "hybrid test" ++ ++ # Count the number of core PMUs, assume minimum of 1 ++ pmus=$(ls /sys/bus/event_source/devices/*/cpus 2>/dev/null | wc -l) ++ if [ "$pmus" -lt 1 ] ++ then ++ pmus=1 ++ fi ++ ++ # Run default Perf stat ++ cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/| cycles " | wc -l) ++ ++ if [ "$pmus" -ne "$cycles_events" ] ++ then ++ echo "hybrid test [Found $pmus PMUs but $cycles_events cycles events. Failed]" ++ err=1 ++ return ++ fi ++ echo "hybrid test [Success]" ++} ++ + test_default_stat + test_stat_record_report + test_stat_record_script +@@ -153,4 +177,5 @@ test_stat_repeat_weak_groups + test_topdown_groups + test_topdown_weak_groups + test_cputype ++test_hybrid + exit $err +-- +2.51.0 + diff --git a/queue-6.12/perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch b/queue-6.12/perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch new file mode 100644 index 0000000000..f60685ed79 --- /dev/null +++ b/queue-6.12/perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch @@ -0,0 +1,202 @@ +From c13e7ab2c06eeb0cb02d121724d156ac03bb7550 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 15:22:00 -0700 +Subject: perf test: Don't leak workload gopipe in PERF_RECORD_* + +From: Ian Rogers + +[ Upstream commit 48918cacefd226af44373e914e63304927c0e7dc ] + +The test starts a workload and then opens events. If the events fail +to open, for example because of perf_event_paranoid, the gopipe of the +workload is leaked and the file descriptor leak check fails when the +test exits. To avoid this cancel the workload when opening the events +fails. + +Before: +``` +$ perf test -vv 7 + 7: PERF_RECORD_* events & perf_sample fields: + --- start --- +test child forked, pid 1189568 +Using CPUID GenuineIntel-6-B7-1 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 +sys_perf_event_open failed, error -13 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + exclude_kernel 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 +sys_perf_event_open failed, error -13 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + exclude_kernel 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3 +Attempt to add: software/cpu-clock/ +..after resolving event: software/config=0/ +cpu-clock -> software/cpu-clock/ + ------------------------------------------------------------ +perf_event_attr: + type 1 (PERF_TYPE_SOFTWARE) + size 136 + config 0x9 (PERF_COUNT_SW_DUMMY) + sample_type IP|TID|TIME|CPU + read_format ID|LOST + disabled 1 + inherit 1 + mmap 1 + comm 1 + enable_on_exec 1 + task 1 + sample_id_all 1 + mmap2 1 + comm_exec 1 + ksymbol 1 + bpf_event 1 + { wakeup_events, wakeup_watermark } 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 1189569 cpu 0 group_fd -1 flags 0x8 +sys_perf_event_open failed, error -13 +perf_evlist__open: Permission denied + ---- end(-2) ---- +Leak of file descriptor 6 that opened: 'pipe:[14200347]' + ---- unexpected signal (6) ---- +iFailed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon + #0 0x565358f6666e in child_test_sig_handler builtin-test.c:311 + #1 0x7f29ce849df0 in __restore_rt libc_sigaction.c:0 + #2 0x7f29ce89e95c in __pthread_kill_implementation pthread_kill.c:44 + #3 0x7f29ce849cc2 in raise raise.c:27 + #4 0x7f29ce8324ac in abort abort.c:81 + #5 0x565358f662d4 in check_leaks builtin-test.c:226 + #6 0x565358f6682e in run_test_child builtin-test.c:344 + #7 0x565358ef7121 in start_command run-command.c:128 + #8 0x565358f67273 in start_test builtin-test.c:545 + #9 0x565358f6771d in __cmd_test builtin-test.c:647 + #10 0x565358f682bd in cmd_test builtin-test.c:849 + #11 0x565358ee5ded in run_builtin perf.c:349 + #12 0x565358ee6085 in handle_internal_command perf.c:401 + #13 0x565358ee61de in run_argv perf.c:448 + #14 0x565358ee6527 in main perf.c:555 + #15 0x7f29ce833ca8 in __libc_start_call_main libc_start_call_main.h:74 + #16 0x7f29ce833d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128 + #17 0x565358e391c1 in _start perf[851c1] + 7: PERF_RECORD_* events & perf_sample fields : FAILED! +``` + +After: +``` +$ perf test 7 + 7: PERF_RECORD_* events & perf_sample fields : Skip (permissions) +``` + +Fixes: 16d00fee703866c6 ("perf tests: Move test__PERF_RECORD into separate object") +Signed-off-by: Ian Rogers +Tested-by: Arnaldo Carvalho de Melo +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Chun-Tse Shao +Cc: Howard Chu +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/perf-record.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/tools/perf/tests/perf-record.c b/tools/perf/tests/perf-record.c +index 1c4feec1adff1..6e7f053006b4f 100644 +--- a/tools/perf/tests/perf-record.c ++++ b/tools/perf/tests/perf-record.c +@@ -115,6 +115,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest + if (err < 0) { + pr_debug("sched__get_first_possible_cpu: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +@@ -126,6 +127,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest + if (sched_setaffinity(evlist->workload.pid, cpu_mask_size, &cpu_mask) < 0) { + pr_debug("sched_setaffinity: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +@@ -137,6 +139,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest + if (err < 0) { + pr_debug("perf_evlist__open: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +@@ -149,6 +152,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest + if (err < 0) { + pr_debug("evlist__mmap: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +-- +2.51.0 + diff --git a/queue-6.12/perf-test-shell-lbr-avoid-failures-with-perf-event-p.patch b/queue-6.12/perf-test-shell-lbr-avoid-failures-with-perf-event-p.patch new file mode 100644 index 0000000000..75f5d41481 --- /dev/null +++ b/queue-6.12/perf-test-shell-lbr-avoid-failures-with-perf-event-p.patch @@ -0,0 +1,113 @@ +From db24c410eae2afd2630e073fed08370ffe5e65a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 15:18:31 -0700 +Subject: perf test shell lbr: Avoid failures with perf event paranoia + +From: Ian Rogers + +[ Upstream commit 48314d20fe467d6653783cbf5536cb2fcc9bdd7c ] + +When not running as root and with higher perf event paranoia values +the perf record LBR tests could fail rather than skipping the +problematic tests. + +Add the sensitivity to the test and confirm it passes with paranoia +values from -1 to 2. + +Committer testing: + +Testing with '$ perf test -vv lbr', i.e. as non root, and then comparing +the output shows the mentioned errors before this patch: + + acme@x1:~$ grep -m1 "model name" /proc/cpuinfo + model name : 13th Gen Intel(R) Core(TM) i7-1365U + acme@x1:~$ + +Before: + + 132: perf record LBR tests : Skip + +After: + + 132: perf record LBR tests : Ok + +Fixes: 32559b99e0f59070 ("perf test: Add set of perf record LBR tests") +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Chun-Tse Shao +Cc: Howard Chu +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/record_lbr.sh | 26 ++++++++++++++++++++------ + 1 file changed, 20 insertions(+), 6 deletions(-) + +diff --git a/tools/perf/tests/shell/record_lbr.sh b/tools/perf/tests/shell/record_lbr.sh +index ab6f2825f7903..5984ca9b78f8a 100755 +--- a/tools/perf/tests/shell/record_lbr.sh ++++ b/tools/perf/tests/shell/record_lbr.sh +@@ -4,6 +4,10 @@ + + set -e + ++ParanoidAndNotRoot() { ++ [ "$(id -u)" != 0 ] && [ "$(cat /proc/sys/kernel/perf_event_paranoid)" -gt $1 ] ++} ++ + if [ ! -f /sys/bus/event_source/devices/cpu/caps/branches ] && + [ ! -f /sys/bus/event_source/devices/cpu_core/caps/branches ] + then +@@ -23,6 +27,7 @@ cleanup() { + } + + trap_cleanup() { ++ echo "Unexpected signal in ${FUNCNAME[1]}" + cleanup + exit 1 + } +@@ -123,8 +128,11 @@ lbr_test "-j ind_call" "any indirect call" 2 + lbr_test "-j ind_jmp" "any indirect jump" 100 + lbr_test "-j call" "direct calls" 2 + lbr_test "-j ind_call,u" "any indirect user call" 100 +-lbr_test "-a -b" "system wide any branch" 2 +-lbr_test "-a -j any_call" "system wide any call" 2 ++if ! ParanoidAndNotRoot 1 ++then ++ lbr_test "-a -b" "system wide any branch" 2 ++ lbr_test "-a -j any_call" "system wide any call" 2 ++fi + + # Parallel + parallel_lbr_test "-b" "parallel any branch" 100 & +@@ -141,10 +149,16 @@ parallel_lbr_test "-j call" "parallel direct calls" 100 & + pid6=$! + parallel_lbr_test "-j ind_call,u" "parallel any indirect user call" 100 & + pid7=$! +-parallel_lbr_test "-a -b" "parallel system wide any branch" 100 & +-pid8=$! +-parallel_lbr_test "-a -j any_call" "parallel system wide any call" 100 & +-pid9=$! ++if ParanoidAndNotRoot 1 ++then ++ pid8= ++ pid9= ++else ++ parallel_lbr_test "-a -b" "parallel system wide any branch" 100 & ++ pid8=$! ++ parallel_lbr_test "-a -j any_call" "parallel system wide any call" 100 & ++ pid9=$! ++fi + + for pid in $pid1 $pid2 $pid3 $pid4 $pid5 $pid6 $pid7 $pid8 $pid9 + do +-- +2.51.0 + diff --git a/queue-6.12/perf-test-trace_btf_enum-skip-if-permissions-are-ins.patch b/queue-6.12/perf-test-trace_btf_enum-skip-if-permissions-are-ins.patch new file mode 100644 index 0000000000..8f24cb102d --- /dev/null +++ b/queue-6.12/perf-test-trace_btf_enum-skip-if-permissions-are-ins.patch @@ -0,0 +1,72 @@ +From 7a6796eb76678f8f5d595447d466170763ee7327 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:16 -0700 +Subject: perf test trace_btf_enum: Skip if permissions are insufficient + +From: Ian Rogers + +[ Upstream commit 4bd5bd8dbd41a208fb73afb65bda6f38e2b5a637 ] + +Modify test behavior to skip if BPF calls fail with "Operation not +permitted". + +Fixes: d66763fed30f0bd8 ("perf test trace_btf_enum: Add regression test for the BTF augmentation of enums in 'perf trace'") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Acked-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Blake Jones +Cc: Chun-Tse Shao +Cc: Collin Funk +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jan Polensky +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Li Huafei +Cc: Mark Rutland +Cc: Nam Cao +Cc: Peter Zijlstra +Cc: Steinar H. Gunderson +Cc: Thomas Gleixner +Link: https://lore.kernel.org/r/20250821163820.1132977-3-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/trace_btf_enum.sh | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/tools/perf/tests/shell/trace_btf_enum.sh b/tools/perf/tests/shell/trace_btf_enum.sh +index 8d1e6bbeac906..1447d7425f381 100755 +--- a/tools/perf/tests/shell/trace_btf_enum.sh ++++ b/tools/perf/tests/shell/trace_btf_enum.sh +@@ -23,6 +23,14 @@ check_vmlinux() { + fi + } + ++check_permissions() { ++ if perf trace -e $syscall $TESTPROG 2>&1 | grep -q "Operation not permitted" ++ then ++ echo "trace+enum test [Skipped permissions]" ++ err=2 ++ fi ++} ++ + trace_landlock() { + echo "Tracing syscall ${syscall}" + +@@ -54,6 +62,9 @@ trace_non_syscall() { + } + + check_vmlinux ++if [ $err = 0 ]; then ++ check_permissions ++fi + + if [ $err = 0 ]; then + trace_landlock +-- +2.51.0 + diff --git a/queue-6.12/perf-test-update-sysfs-path-for-core-pmu-caps.patch b/queue-6.12/perf-test-update-sysfs-path-for-core-pmu-caps.patch new file mode 100644 index 0000000000..d83a1f2f4c --- /dev/null +++ b/queue-6.12/perf-test-update-sysfs-path-for-core-pmu-caps.patch @@ -0,0 +1,44 @@ +From da39e2f431f216234c0e884251e99690c7002c0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 May 2025 14:30:17 -0700 +Subject: perf test: Update sysfs path for core PMU caps + +From: Namhyung Kim + +[ Upstream commit b9228817127430356c929847f111197776201225 ] + +While CPU is a system device, it'd be better to use a path for +event_source devices when it checks PMU capability. + +Reviewed-by: Ian Rogers +Signed-off-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20250509213017.204343-2-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Stable-dep-of: 48314d20fe46 ("perf test shell lbr: Avoid failures with perf event paranoia") +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/record_lbr.sh | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/tests/shell/record_lbr.sh b/tools/perf/tests/shell/record_lbr.sh +index 32314641217e6..ab6f2825f7903 100755 +--- a/tools/perf/tests/shell/record_lbr.sh ++++ b/tools/perf/tests/shell/record_lbr.sh +@@ -4,7 +4,8 @@ + + set -e + +-if [ ! -f /sys/devices/cpu/caps/branches ] && [ ! -f /sys/devices/cpu_core/caps/branches ] ++if [ ! -f /sys/bus/event_source/devices/cpu/caps/branches ] && ++ [ ! -f /sys/bus/event_source/devices/cpu_core/caps/branches ] + then + echo "Skip: only x86 CPUs support LBR" + exit 2 +-- +2.51.0 + diff --git a/queue-6.12/perf-tools-add-fallback-for-exclude_guest.patch b/queue-6.12/perf-tools-add-fallback-for-exclude_guest.patch new file mode 100644 index 0000000000..ba95a82c09 --- /dev/null +++ b/queue-6.12/perf-tools-add-fallback-for-exclude_guest.patch @@ -0,0 +1,131 @@ +From 461ad8be5d59f2c84281833691239ed27dcc3974 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Oct 2024 23:23:51 -0700 +Subject: perf tools: Add fallback for exclude_guest + +From: Namhyung Kim + +[ Upstream commit bb6e7cb11d97ce1957894d30d13bfad3e8bfefe9 ] + +Commit 7b100989b4f6bce70 ("perf evlist: Remove __evlist__add_default") +changed to parse "cycles:P" event instead of creating a new cycles +event for perf record. But it also changed the way how modifiers are +handled so it doesn't set the exclude_guest bit by default. + +It seems Apple M1 PMU requires exclude_guest set and returns EOPNOTSUPP +if not. Let's add a fallback so that it can work with default events. + +Also update perf stat hybrid tests to handle possible u or H modifiers. + +Reviewed-by: Ian Rogers +Reviewed-by: James Clark +Reviewed-by: Ravi Bangoria +Acked-by: Kan Liang +Cc: James Clark +Cc: Atish Patra +Cc: Mingwei Zhang +Cc: Kajol Jain +Cc: Thomas Richter +Cc: Palmer Dabbelt +Link: https://lore.kernel.org/r/20241016062359.264929-2-namhyung@kernel.org +Fixes: 7b100989b4f6bce70 ("perf evlist: Remove __evlist__add_default") +Signed-off-by: Namhyung Kim +Stable-dep-of: 24937ee839e4 ("perf evsel: Ensure the fallback message is always written to") +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-stat.c | 18 +++++++++++++++--- + tools/perf/tests/shell/stat.sh | 2 +- + tools/perf/util/evsel.c | 21 +++++++++++++++++++++ + 3 files changed, 37 insertions(+), 4 deletions(-) + +diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c +index 628c61397d2d3..b578930ed76a4 100644 +--- a/tools/perf/builtin-stat.c ++++ b/tools/perf/builtin-stat.c +@@ -639,8 +639,7 @@ static enum counter_recovery stat_handle_error(struct evsel *counter) + * (behavior changed with commit b0a873e). + */ + if (errno == EINVAL || errno == ENOSYS || +- errno == ENOENT || errno == EOPNOTSUPP || +- errno == ENXIO) { ++ errno == ENOENT || errno == ENXIO) { + if (verbose > 0) + ui__warning("%s event is not supported by the kernel.\n", + evsel__name(counter)); +@@ -658,7 +657,7 @@ static enum counter_recovery stat_handle_error(struct evsel *counter) + if (verbose > 0) + ui__warning("%s\n", msg); + return COUNTER_RETRY; +- } else if (target__has_per_thread(&target) && ++ } else if (target__has_per_thread(&target) && errno != EOPNOTSUPP && + evsel_list->core.threads && + evsel_list->core.threads->err_thread != -1) { + /* +@@ -679,6 +678,19 @@ static enum counter_recovery stat_handle_error(struct evsel *counter) + return COUNTER_SKIP; + } + ++ if (errno == EOPNOTSUPP) { ++ if (verbose > 0) { ++ ui__warning("%s event is not supported by the kernel.\n", ++ evsel__name(counter)); ++ } ++ counter->supported = false; ++ counter->errored = true; ++ ++ if ((evsel__leader(counter) != counter) || ++ !(counter->core.leader->nr_members > 1)) ++ return COUNTER_SKIP; ++ } ++ + evsel__open_strerror(counter, &target, errno, msg, sizeof(msg)); + ui__error("%s\n", msg); + +diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh +index c6df7eec96b98..c4bef71568970 100755 +--- a/tools/perf/tests/shell/stat.sh ++++ b/tools/perf/tests/shell/stat.sh +@@ -159,7 +159,7 @@ test_hybrid() { + fi + + # Run default Perf stat +- cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/| cycles " | wc -l) ++ cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/[uH]*| cycles[:uH]* " -c) + + if [ "$pmus" -ne "$cycles_events" ] + then +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index b3de8ce559998..70c4e06da7a03 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -3255,6 +3255,27 @@ bool evsel__fallback(struct evsel *evsel, struct target *target, int err, + evsel->core.attr.exclude_kernel = 1; + evsel->core.attr.exclude_hv = 1; + ++ return true; ++ } else if (err == EOPNOTSUPP && !evsel->core.attr.exclude_guest && ++ !evsel->exclude_GH) { ++ const char *name = evsel__name(evsel); ++ char *new_name; ++ const char *sep = ":"; ++ ++ /* Is there already the separator in the name. */ ++ if (strchr(name, '/') || ++ (strchr(name, ':') && !evsel->is_libpfm_event)) ++ sep = ""; ++ ++ if (asprintf(&new_name, "%s%sH", name, sep) < 0) ++ return false; ++ ++ free(evsel->name); ++ evsel->name = new_name; ++ /* Apple M1 requires exclude_guest */ ++ scnprintf(msg, msgsize, "trying to fall back to excluding guest samples"); ++ evsel->core.attr.exclude_guest = 1; ++ + return true; + } + +-- +2.51.0 + diff --git a/queue-6.12/perf-util-fix-compression-checks-returning-1-as-bool.patch b/queue-6.12/perf-util-fix-compression-checks-returning-1-as-bool.patch new file mode 100644 index 0000000000..149e4fc6b7 --- /dev/null +++ b/queue-6.12/perf-util-fix-compression-checks-returning-1-as-bool.patch @@ -0,0 +1,67 @@ +From 10400ec17f6dffc4ddb9b3ff8e3ba855021de432 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 16:25:08 +0000 +Subject: perf util: Fix compression checks returning -1 as bool + +From: Yunseong Kim + +[ Upstream commit 43fa1141e2c1af79c91aaa4df03e436c415a6fc3 ] + +The lzma_is_compressed and gzip_is_compressed functions are declared +to return a "bool" type, but in case of an error (e.g., file open +failure), they incorrectly returned -1. + +A bool type is a boolean value that is either true or false. +Returning -1 for a bool return type can lead to unexpected behavior +and may violate strict type-checking in some compilers. + +Fix the return value to be false in error cases, ensuring the function +adheres to its declared return type improves for preventing potential +bugs related to type mismatch. + +Fixes: 4b57fd44b61beb51 ("perf tools: Add lzma_is_compressed function") +Reviewed-by: Ian Rogers +Signed-off-by: Yunseong Kim +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Namhyung Kim +Cc: Stephen Brennan +Link: https://lore.kernel.org/r/20250822162506.316844-3-ysk@kzalloc.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/lzma.c | 2 +- + tools/perf/util/zlib.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/lzma.c b/tools/perf/util/lzma.c +index af9a97612f9df..f61574d1581e3 100644 +--- a/tools/perf/util/lzma.c ++++ b/tools/perf/util/lzma.c +@@ -113,7 +113,7 @@ bool lzma_is_compressed(const char *input) + ssize_t rc; + + if (fd < 0) +- return -1; ++ return false; + + rc = read(fd, buf, sizeof(buf)); + close(fd); +diff --git a/tools/perf/util/zlib.c b/tools/perf/util/zlib.c +index 78d2297c1b674..1f7c065230599 100644 +--- a/tools/perf/util/zlib.c ++++ b/tools/perf/util/zlib.c +@@ -88,7 +88,7 @@ bool gzip_is_compressed(const char *input) + ssize_t rc; + + if (fd < 0) +- return -1; ++ return false; + + rc = read(fd, buf, sizeof(buf)); + close(fd); +-- +2.51.0 + diff --git a/queue-6.12/perf-vendor-events-arm64-ampereonex-fix-typo-should-.patch b/queue-6.12/perf-vendor-events-arm64-ampereonex-fix-typo-should-.patch new file mode 100644 index 0000000000..17a3d620d5 --- /dev/null +++ b/queue-6.12/perf-vendor-events-arm64-ampereonex-fix-typo-should-.patch @@ -0,0 +1,88 @@ +From 161eba9d2f89eec4a72b75b854e6fcbf44096c83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 12:52:12 -0700 +Subject: perf vendor events arm64 AmpereOneX: Fix typo - should be + l1d_cache_access_prefetches + +From: Ilkka Koskinen + +[ Upstream commit 97996580da08f06f8b09a86f3384ed9fa7a52e32 ] + +Add missing 'h' to l1d_cache_access_prefetces + +Also fix a couple of typos and use consistent term in brief descriptions + +Fixes: 16438b652b464ef7 ("perf vendor events arm64 AmpereOneX: Add core PMU events and metrics") +Reviewed-by: James Clark +Signed-off-by: Ilkka Koskinen +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ilkka Koskinen +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: John Garry +Cc: Kan Liang +Cc: Leo Yan +Cc: Mark Rutland +Cc: Mike Leach +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Will Deacon +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + .../arch/arm64/ampere/ampereonex/metrics.json | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/tools/perf/pmu-events/arch/arm64/ampere/ampereonex/metrics.json b/tools/perf/pmu-events/arch/arm64/ampere/ampereonex/metrics.json +index 5228f94a793f9..6817cac149e0b 100644 +--- a/tools/perf/pmu-events/arch/arm64/ampere/ampereonex/metrics.json ++++ b/tools/perf/pmu-events/arch/arm64/ampere/ampereonex/metrics.json +@@ -113,7 +113,7 @@ + { + "MetricName": "load_store_spec_rate", + "MetricExpr": "LDST_SPEC / INST_SPEC", +- "BriefDescription": "The rate of load or store instructions speculatively executed to overall instructions speclatively executed", ++ "BriefDescription": "The rate of load or store instructions speculatively executed to overall instructions speculatively executed", + "MetricGroup": "Operation_Mix", + "ScaleUnit": "100percent of operations" + }, +@@ -132,7 +132,7 @@ + { + "MetricName": "pc_write_spec_rate", + "MetricExpr": "PC_WRITE_SPEC / INST_SPEC", +- "BriefDescription": "The rate of software change of the PC speculatively executed to overall instructions speclatively executed", ++ "BriefDescription": "The rate of software change of the PC speculatively executed to overall instructions speculatively executed", + "MetricGroup": "Operation_Mix", + "ScaleUnit": "100percent of operations" + }, +@@ -195,14 +195,14 @@ + { + "MetricName": "stall_frontend_cache_rate", + "MetricExpr": "STALL_FRONTEND_CACHE / CPU_CYCLES", +- "BriefDescription": "Proportion of cycles stalled and no ops delivered from frontend and cache miss", ++ "BriefDescription": "Proportion of cycles stalled and no operations delivered from frontend and cache miss", + "MetricGroup": "Stall", + "ScaleUnit": "100percent of cycles" + }, + { + "MetricName": "stall_frontend_tlb_rate", + "MetricExpr": "STALL_FRONTEND_TLB / CPU_CYCLES", +- "BriefDescription": "Proportion of cycles stalled and no ops delivered from frontend and TLB miss", ++ "BriefDescription": "Proportion of cycles stalled and no operations delivered from frontend and TLB miss", + "MetricGroup": "Stall", + "ScaleUnit": "100percent of cycles" + }, +@@ -391,7 +391,7 @@ + "ScaleUnit": "100percent of cache acceses" + }, + { +- "MetricName": "l1d_cache_access_prefetces", ++ "MetricName": "l1d_cache_access_prefetches", + "MetricExpr": "L1D_CACHE_PRFM / L1D_CACHE", + "BriefDescription": "L1D cache access - prefetch", + "MetricGroup": "Cache", +-- +2.51.0 + diff --git a/queue-6.12/rtc-optee-fix-memory-leak-on-driver-removal.patch b/queue-6.12/rtc-optee-fix-memory-leak-on-driver-removal.patch new file mode 100644 index 0000000000..1a5bde926e --- /dev/null +++ b/queue-6.12/rtc-optee-fix-memory-leak-on-driver-removal.patch @@ -0,0 +1,40 @@ +From 9bb216c11660860dac93774b739226d1e0b590ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Jul 2025 16:07:13 +0200 +Subject: rtc: optee: fix memory leak on driver removal +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Le Goffic + +[ Upstream commit a531350d2fe58f7fc4516e555f22391dee94efd9 ] + +Fix a memory leak in case of driver removal. +Free the shared memory used for arguments exchanges between kernel and +OP-TEE RTC PTA. + +Fixes: 81c2f059ab90 ("rtc: optee: add RTC driver for OP-TEE RTC PTA") +Signed-off-by: Clément Le Goffic +Link: https://lore.kernel.org/r/20250715-upstream-optee-rtc-v1-1-e0fdf8aae545@foss.st.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-optee.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/rtc/rtc-optee.c b/drivers/rtc/rtc-optee.c +index 9f8b5d4a8f6b6..6b77c122fdc10 100644 +--- a/drivers/rtc/rtc-optee.c ++++ b/drivers/rtc/rtc-optee.c +@@ -320,6 +320,7 @@ static int optee_rtc_remove(struct device *dev) + { + struct optee_rtc *priv = dev_get_drvdata(dev); + ++ tee_shm_free(priv->shm); + tee_client_close_session(priv->ctx, priv->session_id); + tee_client_close_context(priv->ctx); + +-- +2.51.0 + diff --git a/queue-6.12/rtc-x1205-fix-xicor-x1205-vendor-prefix.patch b/queue-6.12/rtc-x1205-fix-xicor-x1205-vendor-prefix.patch new file mode 100644 index 0000000000..a486180fca --- /dev/null +++ b/queue-6.12/rtc-x1205-fix-xicor-x1205-vendor-prefix.patch @@ -0,0 +1,39 @@ +From 0249dc93784e9a6a0ba07062bc38479a56f879f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 16:57:02 -0500 +Subject: rtc: x1205: Fix Xicor X1205 vendor prefix + +From: Rob Herring (Arm) + +[ Upstream commit 606d19ee37de3a72f1b6e95a4ea544f6f20dbb46 ] + +The vendor for the X1205 RTC is not Xircom, but Xicor which was acquired +by Intersil. Since the I2C subsystem drops the vendor prefix for driver +matching, the vendor prefix hasn't mattered. + +Fixes: 6875404fdb44 ("rtc: x1205: Add DT probing support") +Signed-off-by: Rob Herring (Arm) +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20250821215703.869628-2-robh@kernel.org +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-x1205.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-x1205.c b/drivers/rtc/rtc-x1205.c +index 4bcd7ca32f27b..b8a0fccef14e0 100644 +--- a/drivers/rtc/rtc-x1205.c ++++ b/drivers/rtc/rtc-x1205.c +@@ -669,7 +669,7 @@ static const struct i2c_device_id x1205_id[] = { + MODULE_DEVICE_TABLE(i2c, x1205_id); + + static const struct of_device_id x1205_dt_ids[] = { +- { .compatible = "xircom,x1205", }, ++ { .compatible = "xicor,x1205", }, + {}, + }; + MODULE_DEVICE_TABLE(of, x1205_dt_ids); +-- +2.51.0 + diff --git a/queue-6.12/s390-cio-update-purge-function-to-unregister-the-unu.patch b/queue-6.12/s390-cio-update-purge-function-to-unregister-the-unu.patch new file mode 100644 index 0000000000..4d7c93cf65 --- /dev/null +++ b/queue-6.12/s390-cio-update-purge-function-to-unregister-the-unu.patch @@ -0,0 +1,96 @@ +From 52ea9c0b67fe1bb36fd300d68b5039573071c982 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 15:38:17 +0200 +Subject: s390/cio: Update purge function to unregister the unused subchannels + +From: Vineeth Vijayan + +[ Upstream commit 9daa5a8795865f9a3c93d8d1066785b07ded6073 ] + +Starting with 'commit 2297791c92d0 ("s390/cio: dont unregister +subchannel from child-drivers")', cio no longer unregisters +subchannels when the attached device is invalid or unavailable. + +As an unintended side-effect, the cio_ignore purge function no longer +removes subchannels for devices on the cio_ignore list if no CCW device +is attached. This situation occurs when a CCW device is non-operational +or unavailable + +To ensure the same outcome of the purge function as when the +current cio_ignore list had been active during boot, update the purge +function to remove I/O subchannels without working CCW devices if the +associated device number is found on the cio_ignore list. + +Fixes: 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers") +Suggested-by: Peter Oberparleiter +Reviewed-by: Peter Oberparleiter +Signed-off-by: Vineeth Vijayan +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/device.c | 37 ++++++++++++++++++++++++------------- + 1 file changed, 24 insertions(+), 13 deletions(-) + +diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c +index 9498825d9c7a5..858a9e171351b 100644 +--- a/drivers/s390/cio/device.c ++++ b/drivers/s390/cio/device.c +@@ -1318,23 +1318,34 @@ void ccw_device_schedule_recovery(void) + spin_unlock_irqrestore(&recovery_lock, flags); + } + +-static int purge_fn(struct device *dev, void *data) ++static int purge_fn(struct subchannel *sch, void *data) + { +- struct ccw_device *cdev = to_ccwdev(dev); +- struct ccw_dev_id *id = &cdev->private->dev_id; +- struct subchannel *sch = to_subchannel(cdev->dev.parent); ++ struct ccw_device *cdev; + +- spin_lock_irq(cdev->ccwlock); +- if (is_blacklisted(id->ssid, id->devno) && +- (cdev->private->state == DEV_STATE_OFFLINE) && +- (atomic_cmpxchg(&cdev->private->onoff, 0, 1) == 0)) { +- CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x\n", id->ssid, +- id->devno); ++ spin_lock_irq(&sch->lock); ++ if (sch->st != SUBCHANNEL_TYPE_IO || !sch->schib.pmcw.dnv) ++ goto unlock; ++ ++ if (!is_blacklisted(sch->schid.ssid, sch->schib.pmcw.dev)) ++ goto unlock; ++ ++ cdev = sch_get_cdev(sch); ++ if (cdev) { ++ if (cdev->private->state != DEV_STATE_OFFLINE) ++ goto unlock; ++ ++ if (atomic_cmpxchg(&cdev->private->onoff, 0, 1) != 0) ++ goto unlock; + ccw_device_sched_todo(cdev, CDEV_TODO_UNREG); +- css_sched_sch_todo(sch, SCH_TODO_UNREG); + atomic_set(&cdev->private->onoff, 0); + } +- spin_unlock_irq(cdev->ccwlock); ++ ++ css_sched_sch_todo(sch, SCH_TODO_UNREG); ++ CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x%s\n", sch->schid.ssid, ++ sch->schib.pmcw.dev, cdev ? "" : " (no cdev)"); ++ ++unlock: ++ spin_unlock_irq(&sch->lock); + /* Abort loop in case of pending signal. */ + if (signal_pending(current)) + return -EINTR; +@@ -1350,7 +1361,7 @@ static int purge_fn(struct device *dev, void *data) + int ccw_purge_blacklisted(void) + { + CIO_MSG_EVENT(2, "ccw: purging blacklisted devices\n"); +- bus_for_each_dev(&ccw_bus_type, NULL, NULL, purge_fn); ++ for_each_subchannel_staged(purge_fn, NULL, NULL); + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.12/s390-vmlinux.lds.s-move-.vmlinux.info-to-end-of-allo.patch b/queue-6.12/s390-vmlinux.lds.s-move-.vmlinux.info-to-end-of-allo.patch new file mode 100644 index 0000000000..d70a6a9cd2 --- /dev/null +++ b/queue-6.12/s390-vmlinux.lds.s-move-.vmlinux.info-to-end-of-allo.patch @@ -0,0 +1,104 @@ +From 9bf16ede05381cf62198b19b2501aea346f01442 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 15:46:46 -0700 +Subject: s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections + +From: Nathan Chancellor + +[ Upstream commit 9338d660b79a0dfe4eb3fe9bd748054cded87d4f ] + +When building s390 defconfig with binutils older than 2.32, there are +several warnings during the final linking stage: + + s390-linux-ld: .tmp_vmlinux1: warning: allocated section `.got.plt' not in segment + s390-linux-ld: .tmp_vmlinux2: warning: allocated section `.got.plt' not in segment + s390-linux-ld: vmlinux.unstripped: warning: allocated section `.got.plt' not in segment + s390-linux-objcopy: vmlinux: warning: allocated section `.got.plt' not in segment + s390-linux-objcopy: st7afZyb: warning: allocated section `.got.plt' not in segment + +binutils commit afca762f598 ("S/390: Improve partial relro support for +64 bit") [1] in 2.32 changed where .got.plt is emitted, avoiding the +warning. + +The :NONE in the .vmlinux.info output section description changes the +segment for subsequent allocated sections. Move .vmlinux.info right +above the discards section to place all other sections in the previously +defined segment, .data. + +Fixes: 30226853d6ec ("s390: vmlinux.lds.S: explicitly handle '.got' and '.plt' sections") +Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=afca762f598d453c563f244cd3777715b1a0cb72 [1] +Acked-by: Alexander Gordeev +Acked-by: Alexey Gladkov +Acked-by: Nicolas Schier +Link: https://patch.msgid.link/20251008-kbuild-fix-modinfo-regressions-v1-3-9fc776c5887c@kernel.org +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/vmlinux.lds.S | 44 +++++++++++++++++----------------- + 1 file changed, 22 insertions(+), 22 deletions(-) + +diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S +index 3f2f90e38808c..0d18d3267bc4f 100644 +--- a/arch/s390/kernel/vmlinux.lds.S ++++ b/arch/s390/kernel/vmlinux.lds.S +@@ -207,6 +207,28 @@ SECTIONS + DWARF_DEBUG + ELF_DETAILS + ++ /* ++ * Make sure that the .got.plt is either completely empty or it ++ * contains only the three reserved double words. ++ */ ++ .got.plt : { ++ *(.got.plt) ++ } ++ ASSERT(SIZEOF(.got.plt) == 0 || SIZEOF(.got.plt) == 0x18, "Unexpected GOT/PLT entries detected!") ++ ++ /* ++ * Sections that should stay zero sized, which is safer to ++ * explicitly check instead of blindly discarding. ++ */ ++ .plt : { ++ *(.plt) *(.plt.*) *(.iplt) *(.igot .igot.plt) ++ } ++ ASSERT(SIZEOF(.plt) == 0, "Unexpected run-time procedure linkages detected!") ++ .rela.dyn : { ++ *(.rela.*) *(.rela_*) ++ } ++ ASSERT(SIZEOF(.rela.dyn) == 0, "Unexpected run-time relocations (.rela) detected!") ++ + /* + * uncompressed image info used by the decompressor + * it should match struct vmlinux_info +@@ -237,28 +259,6 @@ SECTIONS + #endif + } :NONE + +- /* +- * Make sure that the .got.plt is either completely empty or it +- * contains only the three reserved double words. +- */ +- .got.plt : { +- *(.got.plt) +- } +- ASSERT(SIZEOF(.got.plt) == 0 || SIZEOF(.got.plt) == 0x18, "Unexpected GOT/PLT entries detected!") +- +- /* +- * Sections that should stay zero sized, which is safer to +- * explicitly check instead of blindly discarding. +- */ +- .plt : { +- *(.plt) *(.plt.*) *(.iplt) *(.igot .igot.plt) +- } +- ASSERT(SIZEOF(.plt) == 0, "Unexpected run-time procedure linkages detected!") +- .rela.dyn : { +- *(.rela.*) *(.rela_*) +- } +- ASSERT(SIZEOF(.rela.dyn) == 0, "Unexpected run-time relocations (.rela) detected!") +- + /* Sections to be discarded */ + DISCARDS + /DISCARD/ : { +-- +2.51.0 + diff --git a/queue-6.12/s390-vmlinux.lds.s-reorder-sections.patch b/queue-6.12/s390-vmlinux.lds.s-reorder-sections.patch new file mode 100644 index 0000000000..9edc25bb95 --- /dev/null +++ b/queue-6.12/s390-vmlinux.lds.s-reorder-sections.patch @@ -0,0 +1,69 @@ +From 7512fbe57e6c7f95e713361a2c1076f1b8898c48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 10:05:45 +0200 +Subject: s390: vmlinux.lds.S: Reorder sections + +From: Alexey Gladkov + +[ Upstream commit 8d18ef04f940a8d336fe7915b5ea419c3eb0c0a6 ] + +In the upcoming changes, the ELF_DETAILS macro will be extended with +the ".modinfo" section, which will cause an error: + +>> s390x-linux-ld: .tmp_vmlinux1: warning: allocated section `.modinfo' not in segment +>> s390x-linux-ld: .tmp_vmlinux2: warning: allocated section `.modinfo' not in segment +>> s390x-linux-ld: vmlinux.unstripped: warning: allocated section `.modinfo' not in segment + +This happens because the .vmlinux.info use :NONE to override the default +segment and tell the linker to not put the section in any segment at all. + +To avoid this, we need to change the sections order that will be placed +in the default segment. + +Cc: Heiko Carstens +Cc: Vasily Gorbik +Cc: Alexander Gordeev +Cc: linux-s390@vger.kernel.org +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202506062053.zbkFBEnJ-lkp@intel.com/ +Signed-off-by: Alexey Gladkov +Acked-by: Heiko Carstens +Link: https://patch.msgid.link/20d40a7a3a053ba06a54155e777dcde7fdada1db.1758182101.git.legion@kernel.org +Signed-off-by: Nathan Chancellor +Stable-dep-of: 9338d660b79a ("s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections") +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/vmlinux.lds.S | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S +index ff1ddba96352a..3f2f90e38808c 100644 +--- a/arch/s390/kernel/vmlinux.lds.S ++++ b/arch/s390/kernel/vmlinux.lds.S +@@ -202,6 +202,11 @@ SECTIONS + . = ALIGN(PAGE_SIZE); + _end = . ; + ++ /* Debugging sections. */ ++ STABS_DEBUG ++ DWARF_DEBUG ++ ELF_DETAILS ++ + /* + * uncompressed image info used by the decompressor + * it should match struct vmlinux_info +@@ -232,11 +237,6 @@ SECTIONS + #endif + } :NONE + +- /* Debugging sections. */ +- STABS_DEBUG +- DWARF_DEBUG +- ELF_DETAILS +- + /* + * Make sure that the .got.plt is either completely empty or it + * contains only the three reserved double words. +-- +2.51.0 + diff --git a/queue-6.12/scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch b/queue-6.12/scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch new file mode 100644 index 0000000000..d2de378f4f --- /dev/null +++ b/queue-6.12/scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch @@ -0,0 +1,56 @@ +From 5a6dac8702ed5e56b76a7e94159f0cfc371a45fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Sep 2025 21:42:01 +0800 +Subject: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue + +From: Duoming Zhou + +[ Upstream commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 ] + +During the detaching of Marvell's SAS/SATA controller, the original code +calls cancel_delayed_work() in mvs_free() to cancel the delayed work +item mwq->work_q. However, if mwq->work_q is already running, the +cancel_delayed_work() may fail to cancel it. This can lead to +use-after-free scenarios where mvs_free() frees the mvs_info while +mvs_work_queue() is still executing and attempts to access the +already-freed mvs_info. + +A typical race condition is illustrated below: + +CPU 0 (remove) | CPU 1 (delayed work callback) +mvs_pci_remove() | + mvs_free() | mvs_work_queue() + cancel_delayed_work() | + kfree(mvi) | + | mvi-> // UAF + +Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure +that the delayed work item is properly canceled and any executing +delayed work item completes before the mvs_info is deallocated. + +This bug was found by static analysis. + +Fixes: 20b09c2992fe ("[SCSI] mvsas: add support for 94xx; layout change; bug fixes") +Signed-off-by: Duoming Zhou +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mvsas/mv_init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c +index 020037cbf0d91..655cca5fe7ccb 100644 +--- a/drivers/scsi/mvsas/mv_init.c ++++ b/drivers/scsi/mvsas/mv_init.c +@@ -124,7 +124,7 @@ static void mvs_free(struct mvs_info *mvi) + if (mvi->shost) + scsi_host_put(mvi->shost); + list_for_each_entry(mwq, &mvi->wq_list, entry) +- cancel_delayed_work(&mwq->work_q); ++ cancel_delayed_work_sync(&mwq->work_q); + kfree(mvi->rsvd_tags); + kfree(mvi); + } +-- +2.51.0 + diff --git a/queue-6.12/selftests-netfilter-query-conntrack-state-to-check-f.patch b/queue-6.12/selftests-netfilter-query-conntrack-state-to-check-f.patch new file mode 100644 index 0000000000..50ea9546c4 --- /dev/null +++ b/queue-6.12/selftests-netfilter-query-conntrack-state-to-check-f.patch @@ -0,0 +1,130 @@ +From fd969f84b855b87bbab540510470da97e27e9a3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 15:05:41 +0200 +Subject: selftests: netfilter: query conntrack state to check for port clash + resolution + +From: Florian Westphal + +[ Upstream commit e84945bdc619ed4243ba4298dbb8ca2062026474 ] + +Jakub reported this self test flaking occasionally (fails, but passes on +re-run) on debug kernels. + +This is because the test checks for elapsed time to determine if both +connections were established in parallel. + +Rework this to no longer depend on timing. +Use busywait helper to check that both sockets have moved to established +state and then query the conntrack engine for the two entries. + +Reported-by: Jakub Kicinski +Closes: https://lore.kernel.org/netfilter-devel/20250926163318.40d1a502@kernel.org/ +Fixes: 117e149e26d1 ("selftests: netfilter: test nat source port clash resolution interaction with tcp early demux") +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + .../selftests/net/netfilter/nf_nat_edemux.sh | 58 +++++++++++++------ + 1 file changed, 41 insertions(+), 17 deletions(-) + +diff --git a/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh b/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh +index 1014551dd7694..6731fe1eaf2e9 100755 +--- a/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh ++++ b/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh +@@ -17,9 +17,31 @@ cleanup() + + checktool "socat -h" "run test without socat" + checktool "iptables --version" "run test without iptables" ++checktool "conntrack --version" "run test without conntrack" + + trap cleanup EXIT + ++connect_done() ++{ ++ local ns="$1" ++ local port="$2" ++ ++ ip netns exec "$ns" ss -nt -o state established "dport = :$port" | grep -q "$port" ++} ++ ++check_ctstate() ++{ ++ local ns="$1" ++ local dp="$2" ++ ++ if ! ip netns exec "$ns" conntrack --get -s 192.168.1.2 -d 192.168.1.1 -p tcp \ ++ --sport 10000 --dport "$dp" --state ESTABLISHED > /dev/null 2>&1;then ++ echo "FAIL: Did not find expected state for dport $2" ++ ip netns exec "$ns" bash -c 'conntrack -L; conntrack -S; ss -nt' ++ ret=1 ++ fi ++} ++ + setup_ns ns1 ns2 + + # Connect the namespaces using a veth pair +@@ -44,15 +66,18 @@ socatpid=$! + ip netns exec "$ns2" sysctl -q net.ipv4.ip_local_port_range="10000 10000" + + # add a virtual IP using DNAT +-ip netns exec "$ns2" iptables -t nat -A OUTPUT -d 10.96.0.1/32 -p tcp --dport 443 -j DNAT --to-destination 192.168.1.1:5201 ++ip netns exec "$ns2" iptables -t nat -A OUTPUT -d 10.96.0.1/32 -p tcp --dport 443 -j DNAT --to-destination 192.168.1.1:5201 || exit 1 + + # ... and route it to the other namespace + ip netns exec "$ns2" ip route add 10.96.0.1 via 192.168.1.1 + +-# add a persistent connection from the other namespace +-ip netns exec "$ns2" socat -t 10 - TCP:192.168.1.1:5201 > /dev/null & ++# listener should be up by now, wait if it isn't yet. ++wait_local_port_listen "$ns1" 5201 tcp + +-sleep 1 ++# add a persistent connection from the other namespace ++sleep 10 | ip netns exec "$ns2" socat -t 10 - TCP:192.168.1.1:5201 > /dev/null & ++cpid0=$! ++busywait "$BUSYWAIT_TIMEOUT" connect_done "$ns2" "5201" + + # ip daddr:dport will be rewritten to 192.168.1.1 5201 + # NAT must reallocate source port 10000 because +@@ -71,26 +96,25 @@ fi + ip netns exec "$ns1" iptables -t nat -A PREROUTING -p tcp --dport 5202 -j REDIRECT --to-ports 5201 + ip netns exec "$ns1" iptables -t nat -A PREROUTING -p tcp --dport 5203 -j REDIRECT --to-ports 5201 + +-sleep 5 | ip netns exec "$ns2" socat -t 5 -u STDIN TCP:192.168.1.1:5202,connect-timeout=5 >/dev/null & ++sleep 5 | ip netns exec "$ns2" socat -T 5 -u STDIN TCP:192.168.1.1:5202,connect-timeout=5 >/dev/null & ++cpid1=$! + +-# if connect succeeds, client closes instantly due to EOF on stdin. +-# if connect hangs, it will time out after 5s. +-echo | ip netns exec "$ns2" socat -t 3 -u STDIN TCP:192.168.1.1:5203,connect-timeout=5 >/dev/null & ++sleep 5 | ip netns exec "$ns2" socat -T 5 -u STDIN TCP:192.168.1.1:5203,connect-timeout=5 >/dev/null & + cpid2=$! + +-time_then=$(date +%s) +-wait $cpid2 +-rv=$? +-time_now=$(date +%s) ++busywait "$BUSYWAIT_TIMEOUT" connect_done "$ns2" 5202 ++busywait "$BUSYWAIT_TIMEOUT" connect_done "$ns2" 5203 + +-# Check how much time has elapsed, expectation is for +-# 'cpid2' to connect and then exit (and no connect delay). +-delta=$((time_now - time_then)) ++check_ctstate "$ns1" 5202 ++check_ctstate "$ns1" 5203 + +-if [ $delta -lt 2 ] && [ $rv -eq 0 ]; then ++kill $socatpid $cpid0 $cpid1 $cpid2 ++socatpid=0 ++ ++if [ $ret -eq 0 ]; then + echo "PASS: could connect to service via redirected ports" + else +- echo "FAIL: socat cannot connect to service via redirect ($delta seconds elapsed, returned $rv)" ++ echo "FAIL: socat cannot connect to service via redirect" + ret=1 + fi + +-- +2.51.0 + diff --git a/queue-6.12/series b/queue-6.12/series index e139b2a127..609bebe6ac 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -10,3 +10,75 @@ kvm-svm-emulate-perf_cntr_global_status_set-for-perfmonv2.patch iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch media-v4l2-subdev-fix-alloc-failure-check-in-v4l2_subdev_call_state_try.patch asm-generic-io.h-skip-trace-helpers-if-rwmmio-events-are-disabled.patch +perf-disasm-avoid-undefined-behavior-in-incrementing.patch +perf-test-trace_btf_enum-skip-if-permissions-are-ins.patch +perf-evsel-avoid-container_of-on-a-null-leader.patch +libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch +clk-qcom-common-fix-null-vs-is_err-check-in-qcom_cc_.patch +clk-at91-peripheral-fix-return-value.patch +clk-renesas-cpg-mssr-fix-memory-leak-in-cpg_mssr_res.patch +perf-util-fix-compression-checks-returning-1-as-bool.patch +rtc-x1205-fix-xicor-x1205-vendor-prefix.patch +rtc-optee-fix-memory-leak-on-driver-removal.patch +perf-arm_spe-correct-setting-remote-access.patch +perf-arm-spe-rename-the-common-data-source-encoding.patch +perf-arm_spe-correct-memory-level-for-remote-access.patch +perf-vendor-events-arm64-ampereonex-fix-typo-should-.patch +perf-test-update-sysfs-path-for-core-pmu-caps.patch +perf-test-shell-lbr-avoid-failures-with-perf-event-p.patch +perf-session-fix-handling-when-buffer-exceeds-2-gib.patch +perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch +perf-test-add-a-test-for-default-perf-stat-command.patch +perf-tools-add-fallback-for-exclude_guest.patch +perf-evsel-ensure-the-fallback-message-is-always-wri.patch +clk-mediatek-mt8195-infra_ao-fix-parent-for-infra_ao.patch +clk-mediatek-clk-mux-do-not-pass-flags-to-clk_mux_de.patch +clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch +clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch +clk-tegra-do-not-overallocate-memory-for-bpmp-clocks.patch +cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch +scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch +asoc-sof-ipc4-topology-correct-the-minimum-host-dma-.patch +asoc-sof-ipc4-topology-account-for-different-chaindm.patch +asoc-sof-intel-hda-pcm-place-the-constraint-on-perio.patch +loongarch-add-cflag-fno-isolate-erroneous-paths-dere.patch +loongarch-init-acpi_gbl_use_global_lock-to-false.patch +asoc-sof-intel-read-the-llp-via-the-associated-link-.patch +net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch +drm-xe-hw_engine_group-fix-double-write-lock-release.patch +s390-cio-update-purge-function-to-unregister-the-unu.patch +drm-vmwgfx-fix-a-null-ptr-access-in-the-cursor-snoop.patch +drm-vmwgfx-fix-use-after-free-in-validation.patch +drm-vmwgfx-fix-copy-paste-typo-in-validation.patch +net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch +tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch +net-mscc-ocelot-fix-use-after-free-caused-by-cyclic-.patch +ice-ice_adapter-release-xa-entry-on-adapter-allocati.patch +net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch +tools-build-align-warning-options-with-perf.patch +perf-python-split-clang-options-when-invoking-popen.patch +tcp-take-care-of-zero-tp-window_clamp-in-tcp_set_rcv.patch +mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch +mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch +mailbox-zynqmp-ipi-fix-out-of-bounds-access-in-mailb.patch +mailbox-zynqmp-ipi-fix-sgi-cleanup-on-unbind.patch +bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch +mailbox-mtk-cmdq-mailbox-switch-to-__pm_runtime_put_.patch +mailbox-mtk-cmdq-switch-to-pm_runtime_put_autosuspen.patch +mailbox-mtk-cmdq-remove-pm_runtime-apis-from-cmdq_mb.patch +drm-amdgpu-add-additional-dce6-scl-registers.patch +drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch +drm-amd-display-properly-clear-scl_-_filter_control-.patch +drm-amd-display-properly-disable-scaling-on-dce6.patch +netfilter-nft_objref-validate-objref-and-objrefmap-e.patch +bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch +selftests-netfilter-query-conntrack-state-to-check-f.patch +crypto-essiv-check-ssize-for-decryption-and-in-place.patch +cifs-fix-copy_to_iter-return-value-check.patch +smb-client-fix-missing-timestamp-updates-after-utime.patch +cifs-query-ea-lxmod-in-cifs_query_path_info-for-wsl-.patch +tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch +gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch +bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch +s390-vmlinux.lds.s-reorder-sections.patch +s390-vmlinux.lds.s-move-.vmlinux.info-to-end-of-allo.patch diff --git a/queue-6.12/smb-client-fix-missing-timestamp-updates-after-utime.patch b/queue-6.12/smb-client-fix-missing-timestamp-updates-after-utime.patch new file mode 100644 index 0000000000..01944d9bb9 --- /dev/null +++ b/queue-6.12/smb-client-fix-missing-timestamp-updates-after-utime.patch @@ -0,0 +1,108 @@ +From f43e7335728f1d12bffcab083c21bf5bb25fd3ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 16:23:24 -0300 +Subject: smb: client: fix missing timestamp updates after utime(2) + +From: Paulo Alcantara + +[ Upstream commit b95cd1bdf5aa9221c98fc9259014b8bb8d1829d7 ] + +Don't reuse open handle when changing timestamps to prevent the server +from disabling automatic timestamp updates as per MS-FSA 2.1.4.17. + +---8<--- +import os +import time + +filename = '/mnt/foo' + +def print_stat(prefix): + st = os.stat(filename) + print(prefix, ': ', time.ctime(st.st_atime), time.ctime(st.st_ctime)) + +fd = os.open(filename, os.O_CREAT|os.O_TRUNC|os.O_WRONLY, 0o644) +print_stat('old') +os.utime(fd, None) +time.sleep(2) +os.write(fd, b'foo') +os.close(fd) +time.sleep(2) +print_stat('new') +---8<--- + +Before patch: + +$ mount.cifs //srv/share /mnt -o ... +$ python3 run.py +old : Fri Oct 3 14:01:21 2025 Fri Oct 3 14:01:21 2025 +new : Fri Oct 3 14:01:21 2025 Fri Oct 3 14:01:21 2025 + +After patch: + +$ mount.cifs //srv/share /mnt -o ... +$ python3 run.py +old : Fri Oct 3 17:03:34 2025 Fri Oct 3 17:03:34 2025 +new : Fri Oct 3 17:03:36 2025 Fri Oct 3 17:03:36 2025 + +Fixes: b6f2a0f89d7e ("cifs: for compound requests, use open handle if possible") +Signed-off-by: Paulo Alcantara (Red Hat) +Cc: Frank Sorenson +Reviewed-by: David Howells +Cc: linux-cifs@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2inode.c | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c +index 104a563dc317f..cb049bc70e0cb 100644 +--- a/fs/smb/client/smb2inode.c ++++ b/fs/smb/client/smb2inode.c +@@ -1220,31 +1220,33 @@ int + smb2_set_file_info(struct inode *inode, const char *full_path, + FILE_BASIC_INFO *buf, const unsigned int xid) + { +- struct cifs_open_parms oparms; ++ struct kvec in_iov = { .iov_base = buf, .iov_len = sizeof(*buf), }; + struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb); ++ struct cifsFileInfo *cfile = NULL; ++ struct cifs_open_parms oparms; + struct tcon_link *tlink; + struct cifs_tcon *tcon; +- struct cifsFileInfo *cfile; +- struct kvec in_iov = { .iov_base = buf, .iov_len = sizeof(*buf), }; +- int rc; +- +- if ((buf->CreationTime == 0) && (buf->LastAccessTime == 0) && +- (buf->LastWriteTime == 0) && (buf->ChangeTime == 0) && +- (buf->Attributes == 0)) +- return 0; /* would be a no op, no sense sending this */ ++ int rc = 0; + + tlink = cifs_sb_tlink(cifs_sb); + if (IS_ERR(tlink)) + return PTR_ERR(tlink); + tcon = tlink_tcon(tlink); + +- cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile); ++ if ((buf->CreationTime == 0) && (buf->LastAccessTime == 0) && ++ (buf->LastWriteTime == 0) && (buf->ChangeTime == 0)) { ++ if (buf->Attributes == 0) ++ goto out; /* would be a no op, no sense sending this */ ++ cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile); ++ } ++ + oparms = CIFS_OPARMS(cifs_sb, tcon, full_path, FILE_WRITE_ATTRIBUTES, + FILE_OPEN, 0, ACL_NO_MODE); + rc = smb2_compound_op(xid, tcon, cifs_sb, + full_path, &oparms, &in_iov, + &(int){SMB2_OP_SET_INFO}, 1, + cfile, NULL, NULL, NULL); ++out: + cifs_put_tlink(tlink); + return rc; + } +-- +2.51.0 + diff --git a/queue-6.12/tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch b/queue-6.12/tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch new file mode 100644 index 0000000000..64cd0f6f71 --- /dev/null +++ b/queue-6.12/tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch @@ -0,0 +1,87 @@ +From fd68c746825e188e69f5fbc03fc95538555aff65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 23:37:54 +0000 +Subject: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). + +From: Kuniyuki Iwashima + +[ Upstream commit 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c ] + +syzbot reported the splat below in tcp_conn_request(). [0] + +If a listener is close()d while a TFO socket is being processed in +tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk +and calls inet_child_forget(), which calls tcp_disconnect() for the +TFO socket. + +After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), +where reqsk_put() is called due to !reqsk->sk. + +Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the +last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the +drop_and_free label causes the refcount underflow for the listener +and double-free of the reqsk. + +Let's remove reqsk_fastopen_remove() in tcp_conn_request(). + +Note that other callers make sure tp->fastopen_rsk is not NULL. + +[0]: +refcount_t: underflow; use-after-free. +WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) +Modules linked in: +CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 +RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) +Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 +RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 +RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 +RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280 +RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 +R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 +R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8 +FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0 +Call Trace: + + tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) + tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) + tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) + tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) + ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) + ip6_input (net/ipv6/ip6_input.c:500) + ipv6_rcv (net/ipv6/ip6_input.c:311) + __netif_receive_skb (net/core/dev.c:6104) + process_backlog (net/core/dev.c:6456) + __napi_poll (net/core/dev.c:7506) + net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) + handle_softirqs (kernel/softirq.c:579) + do_softirq (kernel/softirq.c:480) + + +Fixes: 45c8a6cc2bcd ("tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().") +Reported-by: syzkaller +Signed-off-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20251001233755.1340927-1-kuniyu@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 30f4375f8431b..4c8d84fc27ca3 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -7338,7 +7338,6 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, + &foc, TCP_SYNACK_FASTOPEN, skb); + /* Add the child socket directly into the accept queue */ + if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) { +- reqsk_fastopen_remove(fastopen_sk, req, false); + bh_unlock_sock(fastopen_sk); + sock_put(fastopen_sk); + goto drop_and_free; +-- +2.51.0 + diff --git a/queue-6.12/tcp-take-care-of-zero-tp-window_clamp-in-tcp_set_rcv.patch b/queue-6.12/tcp-take-care-of-zero-tp-window_clamp-in-tcp_set_rcv.patch new file mode 100644 index 0000000000..22ab1e3680 --- /dev/null +++ b/queue-6.12/tcp-take-care-of-zero-tp-window_clamp-in-tcp_set_rcv.patch @@ -0,0 +1,64 @@ +From 1c17a977f9c9a01cfaec86f15c56a8502b6555e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 18:41:19 +0000 +Subject: tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() + +From: Eric Dumazet + +[ Upstream commit 21b29e74ffe5a6c851c235bb80bf5ee26292c67b ] + +Some applications (like selftests/net/tcp_mmap.c) call SO_RCVLOWAT +on their listener, before accept(). + +This has an unfortunate effect on wscale selection in +tcp_select_initial_window() during 3WHS. + +For instance, tcp_mmap was negotiating wscale 4, regardless +of tcp_rmem[2] and sysctl_rmem_max. + +Do not change tp->window_clamp if it is zero +or bigger than our computed value. + +Zero value is special, it allows tcp_select_initial_window() +to enable autotuning. + +Note that SO_RCVLOWAT use on listener is probably not wise, +because tp->scaling_ratio has a default value, possibly wrong. + +Fixes: d1361840f8c5 ("tcp: fix SO_RCVLOWAT and RCVBUF autotuning") +Signed-off-by: Eric Dumazet +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Neal Cardwell +Link: https://patch.msgid.link/20251003184119.2526655-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 739931aabb4e3..795ffa62cc0e6 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -1735,6 +1735,7 @@ EXPORT_SYMBOL(tcp_peek_len); + /* Make sure sk_rcvbuf is big enough to satisfy SO_RCVLOWAT hint */ + int tcp_set_rcvlowat(struct sock *sk, int val) + { ++ struct tcp_sock *tp = tcp_sk(sk); + int space, cap; + + if (sk->sk_userlocks & SOCK_RCVBUF_LOCK) +@@ -1753,7 +1754,9 @@ int tcp_set_rcvlowat(struct sock *sk, int val) + space = tcp_space_from_win(sk, val); + if (space > sk->sk_rcvbuf) { + WRITE_ONCE(sk->sk_rcvbuf, space); +- WRITE_ONCE(tcp_sk(sk)->window_clamp, val); ++ ++ if (tp->window_clamp && tp->window_clamp < val) ++ WRITE_ONCE(tp->window_clamp, val); + } + return 0; + } +-- +2.51.0 + diff --git a/queue-6.12/tools-build-align-warning-options-with-perf.patch b/queue-6.12/tools-build-align-warning-options-with-perf.patch new file mode 100644 index 0000000000..d22a77bdcf --- /dev/null +++ b/queue-6.12/tools-build-align-warning-options-with-perf.patch @@ -0,0 +1,62 @@ +From ff50833397c808c1e969dede98a0501987cf77d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Oct 2025 17:21:23 +0100 +Subject: tools build: Align warning options with perf + +From: Leo Yan + +[ Upstream commit 53d067feb8c4f16d1f24ce3f4df4450bb18c555f ] + +The feature test programs are built without enabling '-Wall -Werror' +options. As a result, a feature may appear to be available, but later +building in perf can fail with stricter checks. + +Make the feature test program use the same warning options as perf. + +Fixes: 1925459b4d92 ("tools build: Fix feature Makefile issues with 'O='") +Signed-off-by: Leo Yan +Reviewed-by: Ian Rogers +Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-1-4305590795b2@arm.com +Cc: Palmer Dabbelt +Cc: Albert Ou +Cc: Alexandre Ghiti +Cc: Nick Desaulniers +Cc: Justin Stitt +Cc: Bill Wendling +Cc: Adrian Hunter +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Nathan Chancellor +Cc: James Clark +Cc: linux-riscv@lists.infradead.org +Cc: llvm@lists.linux.dev +Cc: Paul Walmsley +Cc: linux-kernel@vger.kernel.org +Cc: linux-perf-users@vger.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/build/feature/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile +index 1658596188bf8..592ca17b4b74a 100644 +--- a/tools/build/feature/Makefile ++++ b/tools/build/feature/Makefile +@@ -327,10 +327,10 @@ $(OUTPUT)test-libcapstone.bin: + $(BUILD) # -lcapstone provided by $(FEATURE_CHECK_LDFLAGS-libcapstone) + + $(OUTPUT)test-compile-32.bin: +- $(CC) -m32 -o $@ test-compile.c ++ $(CC) -m32 -Wall -Werror -o $@ test-compile.c + + $(OUTPUT)test-compile-x32.bin: +- $(CC) -mx32 -o $@ test-compile.c ++ $(CC) -mx32 -Wall -Werror -o $@ test-compile.c + + $(OUTPUT)test-zlib.bin: + $(BUILD) -lz +-- +2.51.0 + diff --git a/queue-6.12/tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch b/queue-6.12/tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch new file mode 100644 index 0000000000..822c088921 --- /dev/null +++ b/queue-6.12/tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch @@ -0,0 +1,42 @@ +From e109cb3ff54f3eff31b1d5edac684905d3e4c430 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 18:49:40 +0300 +Subject: tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single + +From: Gunnar Kudrjavets + +[ Upstream commit 8a81236f2cb0882c7ea6c621ce357f7f3f601fe5 ] + +The tpm_tis_write8() call specifies arguments in wrong order. Should be +(data, addr, value) not (data, value, addr). The initial correct order +was changed during the major refactoring when the code was split. + +Fixes: 41a5e1cf1fe1 ("tpm/tpm_tis: Split tpm_tis driver into a core and TCG TIS compliant phy") +Signed-off-by: Gunnar Kudrjavets +Reviewed-by: Justinien Bouron +Reviewed-by: Jarkko Sakkinen +Reviewed-by: Paul Menzel +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index ed0d3d8449b30..59e992dc65c4c 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -977,8 +977,8 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, + * will call disable_irq which undoes all of the above. + */ + if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) { +- tpm_tis_write8(priv, original_int_vec, +- TPM_INT_VECTOR(priv->locality)); ++ tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), ++ original_int_vec); + rc = -1; + } + +-- +2.51.0 + diff --git a/queue-6.17/asoc-sof-intel-hda-pcm-place-the-constraint-on-perio.patch b/queue-6.17/asoc-sof-intel-hda-pcm-place-the-constraint-on-perio.patch new file mode 100644 index 0000000000..0775a91b2e --- /dev/null +++ b/queue-6.17/asoc-sof-intel-hda-pcm-place-the-constraint-on-perio.patch @@ -0,0 +1,83 @@ +From 471c139749625c2031b1addd5fbd30e15adb06bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 16:57:52 +0300 +Subject: ASoC: SOF: Intel: hda-pcm: Place the constraint on period time + instead of buffer time + +From: Peter Ujfalusi + +[ Upstream commit 45ad27d9a6f7c620d8bbc80be3bab1faf37dfa0a ] + +Instead of constraining the ALSA buffer time to be double of the firmware +host buffer size, it is better to set it for the period time. +This will implicitly constrain the buffer time to a safe value +(num_periods is at least 2) and prohibits applications to set smaller +period size than what will be covered by the initial DMA burst. + +Fixes: fe76d2e75a6d ("ASoC: SOF: Intel: hda-pcm: Use dsp_max_burst_size_in_ms to place constraint") +Signed-off-by: Peter Ujfalusi +Reviewed-by: Ranjani Sridharan +Reviewed-by: Kai Vehmanen +Reviewed-by: Bard Liao +Link: https://patch.msgid.link/20251002135752.2430-4-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-pcm.c | 29 +++++++++++++++++++++-------- + 1 file changed, 21 insertions(+), 8 deletions(-) + +diff --git a/sound/soc/sof/intel/hda-pcm.c b/sound/soc/sof/intel/hda-pcm.c +index 1dd8d2092c3b4..da6c1e7263cde 100644 +--- a/sound/soc/sof/intel/hda-pcm.c ++++ b/sound/soc/sof/intel/hda-pcm.c +@@ -29,6 +29,8 @@ + #define SDnFMT_BITS(x) ((x) << 4) + #define SDnFMT_CHAN(x) ((x) << 0) + ++#define HDA_MAX_PERIOD_TIME_HEADROOM 10 ++ + static bool hda_always_enable_dmi_l1; + module_param_named(always_enable_dmi_l1, hda_always_enable_dmi_l1, bool, 0444); + MODULE_PARM_DESC(always_enable_dmi_l1, "SOF HDA always enable DMI l1"); +@@ -291,19 +293,30 @@ int hda_dsp_pcm_open(struct snd_sof_dev *sdev, + * On playback start the DMA will transfer dsp_max_burst_size_in_ms + * amount of data in one initial burst to fill up the host DMA buffer. + * Consequent DMA burst sizes are shorter and their length can vary. +- * To make sure that userspace allocate large enough ALSA buffer we need +- * to place a constraint on the buffer time. ++ * To avoid immediate xrun by the initial burst we need to place ++ * constraint on the period size (via PERIOD_TIME) to cover the size of ++ * the host buffer. ++ * We need to add headroom of max 10ms as the firmware needs time to ++ * settle to the 1ms pacing and initially it can run faster for few ++ * internal periods. + * + * On capture the DMA will transfer 1ms chunks. +- * +- * Exact dsp_max_burst_size_in_ms constraint is racy, so set the +- * constraint to a minimum of 2x dsp_max_burst_size_in_ms. + */ +- if (spcm->stream[direction].dsp_max_burst_size_in_ms) ++ if (spcm->stream[direction].dsp_max_burst_size_in_ms) { ++ unsigned int period_time = spcm->stream[direction].dsp_max_burst_size_in_ms; ++ ++ /* ++ * add headroom over the maximum burst size to cover the time ++ * needed for the DMA pace to settle. ++ * Limit the headroom time to HDA_MAX_PERIOD_TIME_HEADROOM ++ */ ++ period_time += min(period_time, HDA_MAX_PERIOD_TIME_HEADROOM); ++ + snd_pcm_hw_constraint_minmax(substream->runtime, +- SNDRV_PCM_HW_PARAM_BUFFER_TIME, +- spcm->stream[direction].dsp_max_burst_size_in_ms * USEC_PER_MSEC * 2, ++ SNDRV_PCM_HW_PARAM_PERIOD_TIME, ++ period_time * USEC_PER_MSEC, + UINT_MAX); ++ } + + /* binding pcm substream to hda stream */ + substream->runtime->private_data = &dsp_stream->hstream; +-- +2.51.0 + diff --git a/queue-6.17/asoc-sof-intel-read-the-llp-via-the-associated-link-.patch b/queue-6.17/asoc-sof-intel-read-the-llp-via-the-associated-link-.patch new file mode 100644 index 0000000000..36de163203 --- /dev/null +++ b/queue-6.17/asoc-sof-intel-read-the-llp-via-the-associated-link-.patch @@ -0,0 +1,82 @@ +From fb814d1de0f47b5efccec492a793982fcf5ab34d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 10:47:19 +0300 +Subject: ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel + +From: Peter Ujfalusi + +[ Upstream commit aaab61de1f1e44a2ab527e935474e2e03a0f6b08 ] + +It is allowed to mix Link and Host DMA channels in a way that their index +is different. In this case we would read the LLP from a channel which is +not used or used for other operation. + +Such case can be reproduced on cAVS2.5 or ACE1 platforms with soundwire +configuration: +playback to SDW would take Host channel 0 (stream_tag 1) and no Link DMA +used +Second playback to HDMI (HDA) would use Host channel 1 (stream_tag 2) and +Link channel 0 (stream_tag 1). + +In this case reading the LLP from channel 2 is incorrect as that is not the +Link channel used for the HDMI playback. + +To correct this, we should look up the BE and get the channel used on the +Link side. + +Fixes: 67b182bea08a ("ASoC: SOF: Intel: hda: Implement get_stream_position (Linear Link Position)") +Signed-off-by: Peter Ujfalusi +Reviewed-by: Kai Vehmanen +Reviewed-by: Ranjani Sridharan +Link: https://patch.msgid.link/20251002074719.2084-6-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-stream.c | 29 +++++++++++++++++++++++++++-- + 1 file changed, 27 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sof/intel/hda-stream.c b/sound/soc/sof/intel/hda-stream.c +index a34f472ef1751..9c3b3a9aaf83c 100644 +--- a/sound/soc/sof/intel/hda-stream.c ++++ b/sound/soc/sof/intel/hda-stream.c +@@ -1129,10 +1129,35 @@ u64 hda_dsp_get_stream_llp(struct snd_sof_dev *sdev, + struct snd_soc_component *component, + struct snd_pcm_substream *substream) + { +- struct hdac_stream *hstream = substream->runtime->private_data; +- struct hdac_ext_stream *hext_stream = stream_to_hdac_ext_stream(hstream); ++ struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream); ++ struct snd_soc_pcm_runtime *be_rtd = NULL; ++ struct hdac_ext_stream *hext_stream; ++ struct snd_soc_dai *cpu_dai; ++ struct snd_soc_dpcm *dpcm; + u32 llp_l, llp_u; + ++ /* ++ * The LLP needs to be read from the Link DMA used for this FE as it is ++ * allowed to use any combination of Link and Host channels ++ */ ++ for_each_dpcm_be(rtd, substream->stream, dpcm) { ++ if (dpcm->fe != rtd) ++ continue; ++ ++ be_rtd = dpcm->be; ++ } ++ ++ if (!be_rtd) ++ return 0; ++ ++ cpu_dai = snd_soc_rtd_to_cpu(be_rtd, 0); ++ if (!cpu_dai) ++ return 0; ++ ++ hext_stream = snd_soc_dai_get_dma_data(cpu_dai, substream); ++ if (!hext_stream) ++ return 0; ++ + /* + * The pplc_addr have been calculated during probe in + * hda_dsp_stream_init(): +-- +2.51.0 + diff --git a/queue-6.17/asoc-sof-ipc4-topology-account-for-different-chaindm.patch b/queue-6.17/asoc-sof-ipc4-topology-account-for-different-chaindm.patch new file mode 100644 index 0000000000..aa456955a6 --- /dev/null +++ b/queue-6.17/asoc-sof-ipc4-topology-account-for-different-chaindm.patch @@ -0,0 +1,64 @@ +From 86916cace9abe91fb771dc2086cb9431fc4dea03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 16:57:51 +0300 +Subject: ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer + size + +From: Peter Ujfalusi + +[ Upstream commit 3dcf683bf1062d69014fe81b90d285c7eb85ca8a ] + +For ChainDMA the firmware allocates 5ms host buffer instead of the standard +4ms which should be taken into account when setting the constraint on the +buffer size. + +Fixes: 842bb8b62cc6 ("ASoC: SOF: ipc4-topology: Save the DMA maximum burst size for PCMs") +Signed-off-by: Peter Ujfalusi +Reviewed-by: Ranjani Sridharan +Reviewed-by: Kai Vehmanen +Reviewed-by: Bard Liao +Link: https://patch.msgid.link/20251002135752.2430-3-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/ipc4-topology.c | 9 +++++++-- + sound/soc/sof/ipc4-topology.h | 3 +++ + 2 files changed, 10 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sof/ipc4-topology.c b/sound/soc/sof/ipc4-topology.c +index c93db452bbc07..16053d224dcdb 100644 +--- a/sound/soc/sof/ipc4-topology.c ++++ b/sound/soc/sof/ipc4-topology.c +@@ -623,8 +623,13 @@ static int sof_ipc4_widget_setup_pcm(struct snd_sof_widget *swidget) + swidget->tuples, + swidget->num_tuples, sizeof(u32), 1); + /* Set default DMA buffer size if it is not specified in topology */ +- if (!sps->dsp_max_burst_size_in_ms) +- sps->dsp_max_burst_size_in_ms = SOF_IPC4_MIN_DMA_BUFFER_SIZE; ++ if (!sps->dsp_max_burst_size_in_ms) { ++ struct snd_sof_widget *pipe_widget = swidget->spipe->pipe_widget; ++ struct sof_ipc4_pipeline *pipeline = pipe_widget->private; ++ ++ sps->dsp_max_burst_size_in_ms = pipeline->use_chain_dma ? ++ SOF_IPC4_CHAIN_DMA_BUFFER_SIZE : SOF_IPC4_MIN_DMA_BUFFER_SIZE; ++ } + } else { + /* Capture data is copied from DSP to host in 1ms bursts */ + spcm->stream[dir].dsp_max_burst_size_in_ms = 1; +diff --git a/sound/soc/sof/ipc4-topology.h b/sound/soc/sof/ipc4-topology.h +index ce5c69cb9ea4e..2a2afd0e83338 100644 +--- a/sound/soc/sof/ipc4-topology.h ++++ b/sound/soc/sof/ipc4-topology.h +@@ -64,6 +64,9 @@ + /* FW requires minimum 4ms DMA buffer size */ + #define SOF_IPC4_MIN_DMA_BUFFER_SIZE 4 + ++/* ChainDMA in fw uses 5ms DMA buffer */ ++#define SOF_IPC4_CHAIN_DMA_BUFFER_SIZE 5 ++ + /* + * The base of multi-gateways. Multi-gateways addressing starts from + * ALH_MULTI_GTW_BASE and there are ALH_MULTI_GTW_COUNT multi-sources +-- +2.51.0 + diff --git a/queue-6.17/asoc-sof-ipc4-topology-correct-the-minimum-host-dma-.patch b/queue-6.17/asoc-sof-ipc4-topology-correct-the-minimum-host-dma-.patch new file mode 100644 index 0000000000..1adc1f33aa --- /dev/null +++ b/queue-6.17/asoc-sof-ipc4-topology-correct-the-minimum-host-dma-.patch @@ -0,0 +1,45 @@ +From 88f92fa53658c6d5a67651380475dd8eddffdde3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 16:57:50 +0300 +Subject: ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size + +From: Peter Ujfalusi + +[ Upstream commit a7fe5ff832d61d9393095bc3dd5f06f4af7da3c1 ] + +The firmware has changed the minimum host buffer size from 2 periods to +4 periods (1 period is 1ms) which was missed by the kernel side. + +Adjust the SOF_IPC4_MIN_DMA_BUFFER_SIZE to 4 ms to align with firmware. + +Link: https://github.com/thesofproject/sof/commit/f0a14a3f410735db18a79eb7a5f40dc49fdee7a7 +Fixes: 594c1bb9ff73 ("ASoC: SOF: ipc4-topology: Do not parse the DMA_BUFFER_SIZE token") +Signed-off-by: Peter Ujfalusi +Reviewed-by: Ranjani Sridharan +Reviewed-by: Kai Vehmanen +Reviewed-by: Bard Liao +Link: https://patch.msgid.link/20251002135752.2430-2-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/ipc4-topology.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sof/ipc4-topology.h b/sound/soc/sof/ipc4-topology.h +index 659e1ae0a85f9..ce5c69cb9ea4e 100644 +--- a/sound/soc/sof/ipc4-topology.h ++++ b/sound/soc/sof/ipc4-topology.h +@@ -61,8 +61,8 @@ + #define SOF_IPC4_CHAIN_DMA_NODE_ID 0x7fffffff + #define SOF_IPC4_INVALID_NODE_ID 0xffffffff + +-/* FW requires minimum 2ms DMA buffer size */ +-#define SOF_IPC4_MIN_DMA_BUFFER_SIZE 2 ++/* FW requires minimum 4ms DMA buffer size */ ++#define SOF_IPC4_MIN_DMA_BUFFER_SIZE 4 + + /* + * The base of multi-gateways. Multi-gateways addressing starts from +-- +2.51.0 + diff --git a/queue-6.17/bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch b/queue-6.17/bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch new file mode 100644 index 0000000000..4fbd0d132a --- /dev/null +++ b/queue-6.17/bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch @@ -0,0 +1,74 @@ +From aa7aca8378fa61239116f9552edd289ab42a23ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 18:26:26 +0800 +Subject: bpf: Avoid RCU context warning when unpinning htab with internal + structs + +From: KaFai Wan + +[ Upstream commit 4f375ade6aa9f37fd72d7a78682f639772089eed ] + +When unpinning a BPF hash table (htab or htab_lru) that contains internal +structures (timer, workqueue, or task_work) in its values, a BUG warning +is triggered: + BUG: sleeping function called from invalid context at kernel/bpf/hashtab.c:244 + in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 14, name: ksoftirqd/0 + ... + +The issue arises from the interaction between BPF object unpinning and +RCU callback mechanisms: +1. BPF object unpinning uses ->free_inode() which schedules cleanup via + call_rcu(), deferring the actual freeing to an RCU callback that + executes within the RCU_SOFTIRQ context. +2. During cleanup of hash tables containing internal structures, + htab_map_free_internal_structs() is invoked, which includes + cond_resched() or cond_resched_rcu() calls to yield the CPU during + potentially long operations. + +However, cond_resched() or cond_resched_rcu() cannot be safely called from +atomic RCU softirq context, leading to the BUG warning when attempting +to reschedule. + +Fix this by changing from ->free_inode() to ->destroy_inode() and rename +bpf_free_inode() to bpf_destroy_inode() for BPF objects (prog, map, link). +This allows direct inode freeing without RCU callback scheduling, +avoiding the invalid context warning. + +Reported-by: Le Chen +Closes: https://lore.kernel.org/all/1444123482.1827743.1750996347470.JavaMail.zimbra@sjtu.edu.cn/ +Fixes: 68134668c17f ("bpf: Add map side support for bpf timers.") +Suggested-by: Alexei Starovoitov +Signed-off-by: KaFai Wan +Acked-by: Yonghong Song +Link: https://lore.kernel.org/r/20251008102628.808045-2-kafai.wan@linux.dev +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/inode.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c +index 5c2e96b19392a..1a31c87234877 100644 +--- a/kernel/bpf/inode.c ++++ b/kernel/bpf/inode.c +@@ -775,7 +775,7 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root) + return 0; + } + +-static void bpf_free_inode(struct inode *inode) ++static void bpf_destroy_inode(struct inode *inode) + { + enum bpf_type type; + +@@ -790,7 +790,7 @@ const struct super_operations bpf_super_ops = { + .statfs = simple_statfs, + .drop_inode = generic_delete_inode, + .show_options = bpf_show_options, +- .free_inode = bpf_free_inode, ++ .destroy_inode = bpf_destroy_inode, + }; + + enum { +-- +2.51.0 + diff --git a/queue-6.17/bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch b/queue-6.17/bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch new file mode 100644 index 0000000000..3bdc87b16a --- /dev/null +++ b/queue-6.17/bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch @@ -0,0 +1,64 @@ +From c511da4ad6cc1ac3c124fbb314166a4c9085e3cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 09:34:18 +0200 +Subject: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} + +From: Daniel Borkmann + +[ Upstream commit 23f3770e1a53e6c7a553135011f547209e141e72 ] + +Cilium has a BPF egress gateway feature which forces outgoing K8s Pod +traffic to pass through dedicated egress gateways which then SNAT the +traffic in order to interact with stable IPs outside the cluster. + +The traffic is directed to the gateway via vxlan tunnel in collect md +mode. A recent BPF change utilized the bpf_redirect_neigh() helper to +forward packets after the arrival and decap on vxlan, which turned out +over time that the kmalloc-256 slab usage in kernel was ever-increasing. + +The issue was that vxlan allocates the metadata_dst object and attaches +it through a fake dst entry to the skb. The latter was never released +though given bpf_redirect_neigh() was merely setting the new dst entry +via skb_dst_set() without dropping an existing one first. + +Fixes: b4ab31414970 ("bpf: Add redirect_neigh helper as redirect drop-in") +Reported-by: Yusuke Suzuki +Reported-by: Julian Wiedmann +Signed-off-by: Daniel Borkmann +Cc: Martin KaFai Lau +Cc: Jakub Kicinski +Cc: Jordan Rife +Reviewed-by: Simon Horman +Reviewed-by: Jordan Rife +Reviewed-by: Jakub Kicinski +Reviewed-by: Martin KaFai Lau +Link: https://lore.kernel.org/r/20251003073418.291171-1-daniel@iogearbox.net +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/core/filter.c b/net/core/filter.c +index 2d326d35c3871..c5cdf3b08341a 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -2281,6 +2281,7 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev, + if (IS_ERR(dst)) + goto out_drop; + ++ skb_dst_drop(skb); + skb_dst_set(skb, dst); + } else if (nh->nh_family != AF_INET6) { + goto out_drop; +@@ -2389,6 +2390,7 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev, + goto out_drop; + } + ++ skb_dst_drop(skb); + skb_dst_set(skb, &rt->dst); + } + +-- +2.51.0 + diff --git a/queue-6.17/bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch b/queue-6.17/bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch new file mode 100644 index 0000000000..0bfc1ce265 --- /dev/null +++ b/queue-6.17/bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch @@ -0,0 +1,50 @@ +From 01014f0c90925478838ac92119f5379e948e0654 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 10:15:01 +0200 +Subject: bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() + +From: Eric Woudstra + +[ Upstream commit bbf0c98b3ad9edaea1f982de6c199cc11d3b7705 ] + +net/bridge/br_private.h:1627 suspicious rcu_dereference_protected() usage! +other info that might help us debug this: + +rcu_scheduler_active = 2, debug_locks = 1 +7 locks held by socat/410: + #0: ffff88800d7a9c90 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_stream_connect+0x43/0xa0 + #1: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x62/0x1830 + [..] + #6: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: nf_hook.constprop.0+0x8a/0x440 + +Call Trace: + lockdep_rcu_suspicious.cold+0x4f/0xb1 + br_vlan_fill_forward_path_pvid+0x32c/0x410 [bridge] + br_fill_forward_path+0x7a/0x4d0 [bridge] + +Use to correct helper, non _rcu variant requires RTNL mutex. + +Fixes: bcf2766b1377 ("net: bridge: resolve forwarding path for VLAN tag actions in bridge devices") +Signed-off-by: Eric Woudstra +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/bridge/br_vlan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c +index 939a3aa78d5c4..54993a05037c1 100644 +--- a/net/bridge/br_vlan.c ++++ b/net/bridge/br_vlan.c +@@ -1455,7 +1455,7 @@ void br_vlan_fill_forward_path_pvid(struct net_bridge *br, + if (!br_opt_get(br, BROPT_VLAN_ENABLED)) + return; + +- vg = br_vlan_group(br); ++ vg = br_vlan_group_rcu(br); + + if (idx >= 0 && + ctx->vlan[idx].proto == br->vlan_proto) { +-- +2.51.0 + diff --git a/queue-6.17/cifs-fix-copy_to_iter-return-value-check.patch b/queue-6.17/cifs-fix-copy_to_iter-return-value-check.patch new file mode 100644 index 0000000000..9efb320d0c --- /dev/null +++ b/queue-6.17/cifs-fix-copy_to_iter-return-value-check.patch @@ -0,0 +1,54 @@ +From 75aec55750180aac6f051bb5bbc8d67fea31bb95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 16:26:03 +0800 +Subject: cifs: Fix copy_to_iter return value check + +From: Fushuai Wang + +[ Upstream commit 0cc380d0e1d36b8f2703379890e90f896f68e9e8 ] + +The return value of copy_to_iter() function will never be negative, +it is the number of bytes copied, or zero if nothing was copied. +Update the check to treat 0 as an error, and return -1 in that case. + +Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") +Acked-by: Tom Talpey +Reviewed-by: David Howells +Signed-off-by: Fushuai Wang +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2ops.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index 68286673afc99..328fdeecae29a 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -4653,7 +4653,7 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid, + unsigned int pad_len; + struct cifs_io_subrequest *rdata = mid->callback_data; + struct smb2_hdr *shdr = (struct smb2_hdr *)buf; +- int length; ++ size_t copied; + bool use_rdma_mr = false; + + if (shdr->Command != SMB2_READ) { +@@ -4766,10 +4766,10 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid, + } else if (buf_len >= data_offset + data_len) { + /* read response payload is in buf */ + WARN_ONCE(buffer, "read data can be either in buf or in buffer"); +- length = copy_to_iter(buf + data_offset, data_len, &rdata->subreq.io_iter); +- if (length < 0) +- return length; +- rdata->got_bytes = data_len; ++ copied = copy_to_iter(buf + data_offset, data_len, &rdata->subreq.io_iter); ++ if (copied == 0) ++ return -EIO; ++ rdata->got_bytes = copied; + } else { + /* read response payload cannot be in both buf and pages */ + WARN_ONCE(1, "buf can not contain only a part of read data"); +-- +2.51.0 + diff --git a/queue-6.17/cifs-query-ea-lxmod-in-cifs_query_path_info-for-wsl-.patch b/queue-6.17/cifs-query-ea-lxmod-in-cifs_query_path_info-for-wsl-.patch new file mode 100644 index 0000000000..19d6433dc5 --- /dev/null +++ b/queue-6.17/cifs-query-ea-lxmod-in-cifs_query_path_info-for-wsl-.patch @@ -0,0 +1,114 @@ +From f61b2b5d2b2cb492cb863cf1a3e53c9e86037261 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Jun 2025 18:11:10 +0200 +Subject: cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse + points +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 057ac50638bcece64b3b436d3a61b70ed6c01a34 ] + +EA $LXMOD is required for WSL non-symlink reparse points. + +Fixes: ef86ab131d91 ("cifs: Fix querying of WSL CHR and BLK reparse points over SMB1") +Signed-off-by: Pali Rohár +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb1ops.c | 62 +++++++++++++++++++++++++++++++++++++++-- + 1 file changed, 60 insertions(+), 2 deletions(-) + +diff --git a/fs/smb/client/smb1ops.c b/fs/smb/client/smb1ops.c +index a02d41d1ce4a3..3fdbb71036cff 100644 +--- a/fs/smb/client/smb1ops.c ++++ b/fs/smb/client/smb1ops.c +@@ -651,14 +651,72 @@ static int cifs_query_path_info(const unsigned int xid, + } + + #ifdef CONFIG_CIFS_XATTR ++ /* ++ * For non-symlink WSL reparse points it is required to fetch ++ * EA $LXMOD which contains in its S_DT part the mandatory file type. ++ */ ++ if (!rc && data->reparse_point) { ++ struct smb2_file_full_ea_info *ea; ++ u32 next = 0; ++ ++ ea = (struct smb2_file_full_ea_info *)data->wsl.eas; ++ do { ++ ea = (void *)((u8 *)ea + next); ++ next = le32_to_cpu(ea->next_entry_offset); ++ } while (next); ++ if (le16_to_cpu(ea->ea_value_length)) { ++ ea->next_entry_offset = cpu_to_le32(ALIGN(sizeof(*ea) + ++ ea->ea_name_length + 1 + ++ le16_to_cpu(ea->ea_value_length), 4)); ++ ea = (void *)((u8 *)ea + le32_to_cpu(ea->next_entry_offset)); ++ } ++ ++ rc = CIFSSMBQAllEAs(xid, tcon, full_path, SMB2_WSL_XATTR_MODE, ++ &ea->ea_data[SMB2_WSL_XATTR_NAME_LEN + 1], ++ SMB2_WSL_XATTR_MODE_SIZE, cifs_sb); ++ if (rc == SMB2_WSL_XATTR_MODE_SIZE) { ++ ea->next_entry_offset = cpu_to_le32(0); ++ ea->flags = 0; ++ ea->ea_name_length = SMB2_WSL_XATTR_NAME_LEN; ++ ea->ea_value_length = cpu_to_le16(SMB2_WSL_XATTR_MODE_SIZE); ++ memcpy(&ea->ea_data[0], SMB2_WSL_XATTR_MODE, SMB2_WSL_XATTR_NAME_LEN + 1); ++ data->wsl.eas_len += ALIGN(sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 + ++ SMB2_WSL_XATTR_MODE_SIZE, 4); ++ rc = 0; ++ } else if (rc >= 0) { ++ /* It is an error if EA $LXMOD has wrong size. */ ++ rc = -EINVAL; ++ } else { ++ /* ++ * In all other cases ignore error if fetching ++ * of EA $LXMOD failed. It is needed only for ++ * non-symlink WSL reparse points and wsl_to_fattr() ++ * handle the case when EA is missing. ++ */ ++ rc = 0; ++ } ++ } ++ + /* + * For WSL CHR and BLK reparse points it is required to fetch + * EA $LXDEV which contains major and minor device numbers. + */ + if (!rc && data->reparse_point) { + struct smb2_file_full_ea_info *ea; ++ u32 next = 0; + + ea = (struct smb2_file_full_ea_info *)data->wsl.eas; ++ do { ++ ea = (void *)((u8 *)ea + next); ++ next = le32_to_cpu(ea->next_entry_offset); ++ } while (next); ++ if (le16_to_cpu(ea->ea_value_length)) { ++ ea->next_entry_offset = cpu_to_le32(ALIGN(sizeof(*ea) + ++ ea->ea_name_length + 1 + ++ le16_to_cpu(ea->ea_value_length), 4)); ++ ea = (void *)((u8 *)ea + le32_to_cpu(ea->next_entry_offset)); ++ } ++ + rc = CIFSSMBQAllEAs(xid, tcon, full_path, SMB2_WSL_XATTR_DEV, + &ea->ea_data[SMB2_WSL_XATTR_NAME_LEN + 1], + SMB2_WSL_XATTR_DEV_SIZE, cifs_sb); +@@ -668,8 +726,8 @@ static int cifs_query_path_info(const unsigned int xid, + ea->ea_name_length = SMB2_WSL_XATTR_NAME_LEN; + ea->ea_value_length = cpu_to_le16(SMB2_WSL_XATTR_DEV_SIZE); + memcpy(&ea->ea_data[0], SMB2_WSL_XATTR_DEV, SMB2_WSL_XATTR_NAME_LEN + 1); +- data->wsl.eas_len = sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 + +- SMB2_WSL_XATTR_DEV_SIZE; ++ data->wsl.eas_len += ALIGN(sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 + ++ SMB2_WSL_XATTR_MODE_SIZE, 4); + rc = 0; + } else if (rc >= 0) { + /* It is an error if EA $LXDEV has wrong size. */ +-- +2.51.0 + diff --git a/queue-6.17/clk-at91-peripheral-fix-return-value.patch b/queue-6.17/clk-at91-peripheral-fix-return-value.patch new file mode 100644 index 0000000000..e9d0ca8c24 --- /dev/null +++ b/queue-6.17/clk-at91-peripheral-fix-return-value.patch @@ -0,0 +1,44 @@ +From cbddc84a11e6112835fced8f7266d9810efc52f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 11:17:53 -0400 +Subject: clk: at91: peripheral: fix return value + +From: Brian Masney + +[ Upstream commit 47b13635dabc14f1c2fdcaa5468b47ddadbdd1b5 ] + +determine_rate() is expected to return an error code, or 0 on success. +clk_sam9x5_peripheral_determine_rate() has a branch that returns the +parent rate on a certain case. This is the behavior of round_rate(), +so let's go ahead and fix this by setting req->rate. + +Fixes: b4c115c76184f ("clk: at91: clk-peripheral: add support for changeable parent rate") +Reviewed-by: Alexander Sverdlin +Acked-by: Nicolas Ferre +Signed-off-by: Brian Masney +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/clk-peripheral.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/at91/clk-peripheral.c b/drivers/clk/at91/clk-peripheral.c +index c173a44c800aa..629f050a855aa 100644 +--- a/drivers/clk/at91/clk-peripheral.c ++++ b/drivers/clk/at91/clk-peripheral.c +@@ -279,8 +279,11 @@ static int clk_sam9x5_peripheral_determine_rate(struct clk_hw *hw, + long best_diff = LONG_MIN; + u32 shift; + +- if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max) +- return parent_rate; ++ if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max) { ++ req->rate = parent_rate; ++ ++ return 0; ++ } + + /* Fist step: check the available dividers. */ + for (shift = 0; shift <= PERIPHERAL_MAX_SHIFT; shift++) { +-- +2.51.0 + diff --git a/queue-6.17/clk-mediatek-clk-mux-do-not-pass-flags-to-clk_mux_de.patch b/queue-6.17/clk-mediatek-clk-mux-do-not-pass-flags-to-clk_mux_de.patch new file mode 100644 index 0000000000..86b291d8b5 --- /dev/null +++ b/queue-6.17/clk-mediatek-clk-mux-do-not-pass-flags-to-clk_mux_de.patch @@ -0,0 +1,42 @@ +From 504d735fd054d22130eeaa883879487a396f4266 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 23:09:31 +0800 +Subject: clk: mediatek: clk-mux: Do not pass flags to + clk_mux_determine_rate_flags() + +From: Chen-Yu Tsai + +[ Upstream commit 5e121370a7ad3414c7f3a77002e2b18abe5c6fe1 ] + +The `flags` in |struct mtk_mux| are core clk flags, not mux clk flags. +Passing one to the other is wrong. + +Since there aren't any actual users adding CLK_MUX_* flags, just drop it +for now. + +Fixes: b05ea3314390 ("clk: mediatek: clk-mux: Add .determine_rate() callback") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mux.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/clk/mediatek/clk-mux.c b/drivers/clk/mediatek/clk-mux.c +index 60990296450bb..9a12e58230bed 100644 +--- a/drivers/clk/mediatek/clk-mux.c ++++ b/drivers/clk/mediatek/clk-mux.c +@@ -146,9 +146,7 @@ static int mtk_clk_mux_set_parent_setclr_lock(struct clk_hw *hw, u8 index) + static int mtk_clk_mux_determine_rate(struct clk_hw *hw, + struct clk_rate_request *req) + { +- struct mtk_clk_mux *mux = to_mtk_clk_mux(hw); +- +- return clk_mux_determine_rate_flags(hw, req, mux->data->flags); ++ return clk_mux_determine_rate_flags(hw, req, 0); + } + + const struct clk_ops mtk_mux_clr_set_upd_ops = { +-- +2.51.0 + diff --git a/queue-6.17/clk-mediatek-mt8195-infra_ao-fix-parent-for-infra_ao.patch b/queue-6.17/clk-mediatek-mt8195-infra_ao-fix-parent-for-infra_ao.patch new file mode 100644 index 0000000000..f57a45e57f --- /dev/null +++ b/queue-6.17/clk-mediatek-mt8195-infra_ao-fix-parent-for-infra_ao.patch @@ -0,0 +1,39 @@ +From 3e0ad475c16d64f8267b423f214b2de263bd09a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 10:38:28 +0200 +Subject: clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m + +From: AngeloGioacchino Del Regno + +[ Upstream commit 6c4c26b624790098988c1034541087e3e5ed5bed ] + +The infrastructure gate for the HDMI specific crystal needs the +top_hdmi_xtal clock to be configured in order to ungate the 26m +clock to the HDMI IP, and it wouldn't work without. + +Reparent the infra_ao_hdmi_26m clock to top_hdmi_xtal to fix that. + +Fixes: e2edf59dec0b ("clk: mediatek: Add MT8195 infrastructure clock support") +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mt8195-infra_ao.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/mediatek/clk-mt8195-infra_ao.c b/drivers/clk/mediatek/clk-mt8195-infra_ao.c +index bb648a88e43af..ad47fdb234607 100644 +--- a/drivers/clk/mediatek/clk-mt8195-infra_ao.c ++++ b/drivers/clk/mediatek/clk-mt8195-infra_ao.c +@@ -103,7 +103,7 @@ static const struct mtk_gate infra_ao_clks[] = { + GATE_INFRA_AO0(CLK_INFRA_AO_CQ_DMA_FPC, "infra_ao_cq_dma_fpc", "fpc", 28), + GATE_INFRA_AO0(CLK_INFRA_AO_UART5, "infra_ao_uart5", "top_uart", 29), + /* INFRA_AO1 */ +- GATE_INFRA_AO1(CLK_INFRA_AO_HDMI_26M, "infra_ao_hdmi_26m", "clk26m", 0), ++ GATE_INFRA_AO1(CLK_INFRA_AO_HDMI_26M, "infra_ao_hdmi_26m", "top_hdmi_xtal", 0), + GATE_INFRA_AO1(CLK_INFRA_AO_SPI0, "infra_ao_spi0", "top_spi", 1), + GATE_INFRA_AO1(CLK_INFRA_AO_MSDC0, "infra_ao_msdc0", "top_msdc50_0_hclk", 2), + GATE_INFRA_AO1(CLK_INFRA_AO_MSDC1, "infra_ao_msdc1", "top_axi", 4), +-- +2.51.0 + diff --git a/queue-6.17/clk-npcm-select-config_auxiliary_bus.patch b/queue-6.17/clk-npcm-select-config_auxiliary_bus.patch new file mode 100644 index 0000000000..21b3721169 --- /dev/null +++ b/queue-6.17/clk-npcm-select-config_auxiliary_bus.patch @@ -0,0 +1,42 @@ +From d135686b97c6508893976b32bbdae318caf2b49e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 09:22:37 +0200 +Subject: clk: npcm: select CONFIG_AUXILIARY_BUS + +From: Arnd Bergmann + +[ Upstream commit c123519bffd29e6320d3a8c4977f9e5a86d6b83d ] + +There are very rare randconfig builds that turn on this driver but +don't already select CONFIG_AUXILIARY_BUS from another driver, and +this results in a build failure: + +arm-linux-gnueabi-ld: drivers/clk/clk-npcm8xx.o: in function `npcm8xx_clock_driver_init': +clk-npcm8xx.c:(.init.text+0x18): undefined reference to `__auxiliary_driver_register' + +Select the bus here, as all other clk drivers using it do. + +Fixes: e0b255df027e ("clk: npcm8xx: add clock controller") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20250807072241.4190376-1-arnd@kernel.org +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig +index 4d56475f94fc1..b1425aed65938 100644 +--- a/drivers/clk/Kconfig ++++ b/drivers/clk/Kconfig +@@ -364,6 +364,7 @@ config COMMON_CLK_LOCHNAGAR + config COMMON_CLK_NPCM8XX + tristate "Clock driver for the NPCM8XX SoC Family" + depends on ARCH_NPCM || COMPILE_TEST ++ select AUXILIARY_BUS + help + This driver supports the clocks on the Nuvoton BMC NPCM8XX SoC Family, + all the clocks are initialized by the bootloader, so this driver +-- +2.51.0 + diff --git a/queue-6.17/clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch b/queue-6.17/clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch new file mode 100644 index 0000000000..f08ad50ddf --- /dev/null +++ b/queue-6.17/clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch @@ -0,0 +1,50 @@ +From 67b3f59871d60571cc6f9858d220511e96934522 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Jul 2025 13:11:55 -0700 +Subject: clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver + +From: Alok Tiwari + +[ Upstream commit 1624dead9a4d288a594fdf19735ebfe4bb567cb8 ] + +The conditional check for the PLL0 multiplier 'm' used a logical AND +instead of OR, making the range check ineffective. This patch replaces +&& with || to correctly reject invalid values of 'm' that are either +less than or equal to 0 or greater than LPC18XX_PLL0_MSEL_MAX. + +This ensures proper bounds checking during clk rate setting and rounding. + +Fixes: b04e0b8fd544 ("clk: add lpc18xx cgu clk driver") +Signed-off-by: Alok Tiwari +[sboyd@kernel.org: 'm' is unsigned so remove < condition] +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/nxp/clk-lpc18xx-cgu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c +index 30e0b283ca608..b9e204d63a972 100644 +--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c ++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c +@@ -381,7 +381,7 @@ static int lpc18xx_pll0_determine_rate(struct clk_hw *hw, + } + + m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2); +- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { ++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) { + pr_warn("%s: unable to support rate %lu\n", __func__, req->rate); + return -EINVAL; + } +@@ -404,7 +404,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, + } + + m = DIV_ROUND_UP_ULL(parent_rate, rate * 2); +- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { ++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) { + pr_warn("%s: unable to support rate %lu\n", __func__, rate); + return -EINVAL; + } +-- +2.51.0 + diff --git a/queue-6.17/clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch b/queue-6.17/clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch new file mode 100644 index 0000000000..48d549ee75 --- /dev/null +++ b/queue-6.17/clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch @@ -0,0 +1,68 @@ +From 163768c4047e0f6c18d2e8cae0e81630347eb4e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 11:18:29 -0400 +Subject: clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() + +From: Brian Masney + +[ Upstream commit b46a3d323a5b7942e65025254c13801d0f475f02 ] + +The round_rate() clk ops is deprecated, so migrate this driver from +round_rate() to determine_rate() using the Coccinelle semantic patch +on the cover letter of this series. + +Signed-off-by: Brian Masney +Stable-dep-of: 1624dead9a4d ("clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver") +Signed-off-by: Sasha Levin +--- + drivers/clk/nxp/clk-lpc18xx-cgu.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c +index 81efa885069b2..30e0b283ca608 100644 +--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c ++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c +@@ -370,23 +370,25 @@ static unsigned long lpc18xx_pll0_recalc_rate(struct clk_hw *hw, + return 0; + } + +-static long lpc18xx_pll0_round_rate(struct clk_hw *hw, unsigned long rate, +- unsigned long *prate) ++static int lpc18xx_pll0_determine_rate(struct clk_hw *hw, ++ struct clk_rate_request *req) + { + unsigned long m; + +- if (*prate < rate) { ++ if (req->best_parent_rate < req->rate) { + pr_warn("%s: pll dividers not supported\n", __func__); + return -EINVAL; + } + +- m = DIV_ROUND_UP_ULL(*prate, rate * 2); ++ m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2); + if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { +- pr_warn("%s: unable to support rate %lu\n", __func__, rate); ++ pr_warn("%s: unable to support rate %lu\n", __func__, req->rate); + return -EINVAL; + } + +- return 2 * *prate * m; ++ req->rate = 2 * req->best_parent_rate * m; ++ ++ return 0; + } + + static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, +@@ -443,7 +445,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, + + static const struct clk_ops lpc18xx_pll0_ops = { + .recalc_rate = lpc18xx_pll0_recalc_rate, +- .round_rate = lpc18xx_pll0_round_rate, ++ .determine_rate = lpc18xx_pll0_determine_rate, + .set_rate = lpc18xx_pll0_set_rate, + }; + +-- +2.51.0 + diff --git a/queue-6.17/clk-qcom-common-fix-null-vs-is_err-check-in-qcom_cc_.patch b/queue-6.17/clk-qcom-common-fix-null-vs-is_err-check-in-qcom_cc_.patch new file mode 100644 index 0000000000..58b254cf75 --- /dev/null +++ b/queue-6.17/clk-qcom-common-fix-null-vs-is_err-check-in-qcom_cc_.patch @@ -0,0 +1,43 @@ +From dc7cf885642f1cb22589dfce1ba2f694d0a0eb40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 09:33:36 +0300 +Subject: clk: qcom: common: Fix NULL vs IS_ERR() check in + qcom_cc_icc_register() + +From: Dan Carpenter + +[ Upstream commit 1e50f5c9965252ed6657b8692cd7366784d60616 ] + +The devm_clk_hw_get_clk() function doesn't return NULL, it returns error +pointers. Update the checking to match. + +Fixes: 8737ec830ee3 ("clk: qcom: common: Add interconnect clocks support") +Signed-off-by: Dan Carpenter +Reviewed-by: Imran Shaik +Reviewed-by: Konrad Dybcio +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/aLaPwL2gFS85WsfD@stanley.mountain +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/common.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/qcom/common.c b/drivers/clk/qcom/common.c +index 37c3008e6c1be..1215918867741 100644 +--- a/drivers/clk/qcom/common.c ++++ b/drivers/clk/qcom/common.c +@@ -277,8 +277,8 @@ static int qcom_cc_icc_register(struct device *dev, + icd[i].slave_id = desc->icc_hws[i].slave_id; + hws = &desc->clks[desc->icc_hws[i].clk_id]->hw; + icd[i].clk = devm_clk_hw_get_clk(dev, hws, "icc"); +- if (!icd[i].clk) +- return dev_err_probe(dev, -ENOENT, ++ if (IS_ERR(icd[i].clk)) ++ return dev_err_probe(dev, PTR_ERR(icd[i].clk), + "(%d) clock entry is null\n", i); + icd[i].name = clk_hw_get_name(hws); + } +-- +2.51.0 + diff --git a/queue-6.17/clk-qcom-select-the-intended-config-in-qcs_dispcc_61.patch b/queue-6.17/clk-qcom-select-the-intended-config-in-qcs_dispcc_61.patch new file mode 100644 index 0000000000..b857a465fa --- /dev/null +++ b/queue-6.17/clk-qcom-select-the-intended-config-in-qcs_dispcc_61.patch @@ -0,0 +1,44 @@ +From 69806146d40127167430c1c2c555099735ebf56b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 14:17:54 +0200 +Subject: clk: qcom: Select the intended config in QCS_DISPCC_615 + +From: Lukas Bulwahn + +[ Upstream commit 9524f95c4042545ee8fc3191b9b89c61a1aca6fb ] + +Commit 9b47105f5434 ("clk: qcom: dispcc-qcs615: Add QCS615 display clock +controller driver") adds the config QCS_DISPCC_615, which selects the +non-existing config QCM_GCC_615. Probably, this is just a three-letter +abbreviation mix-up here, though. There is a config named QCS_GCC_615, +and the related config QCS_CAMCC_615 selects that config. + +Fix the typo and use the intended config name in the select command. + +Fixes: 9b47105f5434 ("clk: qcom: dispcc-qcs615: Add QCS615 display clock controller driver") +Signed-off-by: Lukas Bulwahn +Reviewed-by: Imran Shaik +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20250902121754.277452-1-lukas.bulwahn@redhat.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/Kconfig b/drivers/clk/qcom/Kconfig +index 6cb6cd3e1778a..e721b23234ddd 100644 +--- a/drivers/clk/qcom/Kconfig ++++ b/drivers/clk/qcom/Kconfig +@@ -495,7 +495,7 @@ config QCM_DISPCC_2290 + + config QCS_DISPCC_615 + tristate "QCS615 Display Clock Controller" +- select QCM_GCC_615 ++ select QCS_GCC_615 + help + Support for the display clock controller on Qualcomm Technologies, Inc + QCS615 devices. +-- +2.51.0 + diff --git a/queue-6.17/clk-renesas-cpg-mssr-fix-memory-leak-in-cpg_mssr_res.patch b/queue-6.17/clk-renesas-cpg-mssr-fix-memory-leak-in-cpg_mssr_res.patch new file mode 100644 index 0000000000..1deda48068 --- /dev/null +++ b/queue-6.17/clk-renesas-cpg-mssr-fix-memory-leak-in-cpg_mssr_res.patch @@ -0,0 +1,54 @@ +From bb6f9b0a5630926f6183705cf88ed7f3e5bdd13b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 02:28:10 +0100 +Subject: clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() + +From: Yuan CHen + +[ Upstream commit cc55fc58fc1b7f405003fd2ecf79e74653461f0b ] + +In case of krealloc_array() failure, the current error handling just +returns from the function without freeing the original array. +Fix this memory leak by freeing the original array. + +Fixes: 6aa1754764901668 ("clk: renesas: cpg-mssr: Ignore all clocks assigned to non-Linux system") +Signed-off-by: Yuan CHen +Reviewed-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20250908012810.4767-1-chenyuan_fl@163.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/clk/renesas/renesas-cpg-mssr.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/renesas/renesas-cpg-mssr.c b/drivers/clk/renesas/renesas-cpg-mssr.c +index 5ff6ee1f7d4b7..de1cf7ba45b78 100644 +--- a/drivers/clk/renesas/renesas-cpg-mssr.c ++++ b/drivers/clk/renesas/renesas-cpg-mssr.c +@@ -1082,6 +1082,7 @@ static int __init cpg_mssr_reserved_init(struct cpg_mssr_priv *priv, + + of_for_each_phandle(&it, rc, node, "clocks", "#clock-cells", -1) { + int idx; ++ unsigned int *new_ids; + + if (it.node != priv->np) + continue; +@@ -1092,11 +1093,13 @@ static int __init cpg_mssr_reserved_init(struct cpg_mssr_priv *priv, + if (args[0] != CPG_MOD) + continue; + +- ids = krealloc_array(ids, (num + 1), sizeof(*ids), GFP_KERNEL); +- if (!ids) { ++ new_ids = krealloc_array(ids, (num + 1), sizeof(*ids), GFP_KERNEL); ++ if (!new_ids) { + of_node_put(it.node); ++ kfree(ids); + return -ENOMEM; + } ++ ids = new_ids; + + if (priv->reg_layout == CLK_REG_LAYOUT_RZ_A) + idx = MOD_CLK_PACK_10(args[1]); /* for DEF_MOD_STB() */ +-- +2.51.0 + diff --git a/queue-6.17/clk-renesas-r9a08g045-add-mstop-for-gpio.patch b/queue-6.17/clk-renesas-r9a08g045-add-mstop-for-gpio.patch new file mode 100644 index 0000000000..cfcebe5fc2 --- /dev/null +++ b/queue-6.17/clk-renesas-r9a08g045-add-mstop-for-gpio.patch @@ -0,0 +1,39 @@ +From 3e367f90ac2ef6218484845a25063336087d132e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 12:21:26 +0300 +Subject: clk: renesas: r9a08g045: Add MSTOP for GPIO + +From: Claudiu Beznea + +[ Upstream commit f0cb3463d0244765ab66792a88dc5e2152c130e1 ] + +The GPIO module also supports MSTOP. Add it in the description of the gpio +clock. + +Fixes: c49695952746 ("clk: renesas: r9a08g045: Drop power domain instantiation") +Signed-off-by: Claudiu Beznea +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20250806092129.621194-2-claudiu.beznea.uj@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/clk/renesas/r9a08g045-cpg.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/renesas/r9a08g045-cpg.c b/drivers/clk/renesas/r9a08g045-cpg.c +index ed0661997928b..3b28edfabc34e 100644 +--- a/drivers/clk/renesas/r9a08g045-cpg.c ++++ b/drivers/clk/renesas/r9a08g045-cpg.c +@@ -284,7 +284,8 @@ static const struct rzg2l_mod_clk r9a08g045_mod_clks[] = { + MSTOP(BUS_MCPU2, BIT(5))), + DEF_MOD("scif5_clk_pck", R9A08G045_SCIF5_CLK_PCK, R9A08G045_CLK_P0, 0x584, 5, + MSTOP(BUS_MCPU3, BIT(4))), +- DEF_MOD("gpio_hclk", R9A08G045_GPIO_HCLK, R9A08G045_OSCCLK, 0x598, 0, 0), ++ DEF_MOD("gpio_hclk", R9A08G045_GPIO_HCLK, R9A08G045_OSCCLK, 0x598, 0, ++ MSTOP(BUS_PERI_CPU, BIT(6))), + DEF_MOD("adc_adclk", R9A08G045_ADC_ADCLK, R9A08G045_CLK_TSU, 0x5a8, 0, + MSTOP(BUS_MCPU2, BIT(14))), + DEF_MOD("adc_pclk", R9A08G045_ADC_PCLK, R9A08G045_CLK_TSU, 0x5a8, 1, +-- +2.51.0 + diff --git a/queue-6.17/clk-tegra-do-not-overallocate-memory-for-bpmp-clocks.patch b/queue-6.17/clk-tegra-do-not-overallocate-memory-for-bpmp-clocks.patch new file mode 100644 index 0000000000..49c4ff25d3 --- /dev/null +++ b/queue-6.17/clk-tegra-do-not-overallocate-memory-for-bpmp-clocks.patch @@ -0,0 +1,43 @@ +From 7dedd1d8c2e6b00af77e1d2dd14456233ca6edfd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Apr 2025 15:54:28 +0300 +Subject: clk: tegra: do not overallocate memory for bpmp clocks + +From: Fedor Pchelkin + +[ Upstream commit 49ef6491106209c595476fc122c3922dfd03253f ] + +struct tegra_bpmp::clocks is a pointer to a dynamically allocated array +of pointers to 'struct tegra_bpmp_clk'. + +But the size of the allocated area is calculated like it is an array +containing actual 'struct tegra_bpmp_clk' objects - it's not true, there +are just pointers. + +Found by Linux Verification Center (linuxtesting.org) with Svace static +analysis tool. + +Fixes: 2db12b15c6f3 ("clk: tegra: Register clocks from root to leaf") +Signed-off-by: Fedor Pchelkin +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/tegra/clk-bpmp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/tegra/clk-bpmp.c b/drivers/clk/tegra/clk-bpmp.c +index b2323cb8eddcc..77a2586dbe000 100644 +--- a/drivers/clk/tegra/clk-bpmp.c ++++ b/drivers/clk/tegra/clk-bpmp.c +@@ -635,7 +635,7 @@ static int tegra_bpmp_register_clocks(struct tegra_bpmp *bpmp, + + bpmp->num_clocks = count; + +- bpmp->clocks = devm_kcalloc(bpmp->dev, count, sizeof(struct tegra_bpmp_clk), GFP_KERNEL); ++ bpmp->clocks = devm_kcalloc(bpmp->dev, count, sizeof(*bpmp->clocks), GFP_KERNEL); + if (!bpmp->clocks) + return -ENOMEM; + +-- +2.51.0 + diff --git a/queue-6.17/clk-thead-correct-parent-for-dpu-pixel-clocks.patch b/queue-6.17/clk-thead-correct-parent-for-dpu-pixel-clocks.patch new file mode 100644 index 0000000000..5c80e52d8b --- /dev/null +++ b/queue-6.17/clk-thead-correct-parent-for-dpu-pixel-clocks.patch @@ -0,0 +1,74 @@ +From 50a5a8cc68941ca05b708800ca8ab937c3c0710d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 16 Aug 2025 17:11:10 +0800 +Subject: clk: thead: Correct parent for DPU pixel clocks + +From: Michal Wilczynski + +[ Upstream commit c51a37ffea3813374a8f7955abbba6da25357388 ] + +The dpu0_pixelclk and dpu1_pixelclk gates were incorrectly parented to +the video_pll_clk. + +According to the TH1520 TRM, the "dpu0_pixelclk" should be sourced from +"DPU0 PLL DIV CLK". In this driver, "DPU0 PLL DIV CLK" corresponds to +the `dpu0_clk` clock, which is a divider whose parent is the +`dpu0_pll_clk`. + +This patch corrects the clock hierarchy by reparenting `dpu0_pixelclk` +to `dpu0_clk`. By symmetry, `dpu1_pixelclk` is also reparented to its +correct source, `dpu1_clk`. + +Fixes: 50d4b157fa96 ("clk: thead: Add clock support for VO subsystem in T-HEAD TH1520 SoC") +Reported-by: Icenowy Zheng +Signed-off-by: Michal Wilczynski +[Icenowy: add Drew's R-b and rebased atop ccu_gate refactor] +Reviewed-by: Drew Fustini +Signed-off-by: Icenowy Zheng +Signed-off-by: Drew Fustini +Signed-off-by: Sasha Levin +--- + drivers/clk/thead/clk-th1520-ap.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/thead/clk-th1520-ap.c b/drivers/clk/thead/clk-th1520-ap.c +index 8a5d699638379..ec52726fbea95 100644 +--- a/drivers/clk/thead/clk-th1520-ap.c ++++ b/drivers/clk/thead/clk-th1520-ap.c +@@ -761,6 +761,10 @@ static struct ccu_div dpu0_clk = { + }, + }; + ++static const struct clk_parent_data dpu0_clk_pd[] = { ++ { .hw = &dpu0_clk.common.hw } ++}; ++ + static struct ccu_div dpu1_clk = { + .div = TH_CCU_DIV_FLAGS(0, 8, CLK_DIVIDER_ONE_BASED), + .common = { +@@ -773,6 +777,10 @@ static struct ccu_div dpu1_clk = { + }, + }; + ++static const struct clk_parent_data dpu1_clk_pd[] = { ++ { .hw = &dpu1_clk.common.hw } ++}; ++ + static CLK_FIXED_FACTOR_HW(emmc_sdio_ref_clk, "emmc-sdio-ref", + &video_pll_clk.common.hw, 4, 1, 0); + +@@ -853,9 +861,9 @@ static CCU_GATE(CLK_GPU_CORE, gpu_core_clk, "gpu-core-clk", video_pll_clk_pd, + static CCU_GATE(CLK_GPU_CFG_ACLK, gpu_cfg_aclk, "gpu-cfg-aclk", + video_pll_clk_pd, 0x0, 4, 0); + static CCU_GATE(CLK_DPU_PIXELCLK0, dpu0_pixelclk, "dpu0-pixelclk", +- video_pll_clk_pd, 0x0, 5, 0); ++ dpu0_clk_pd, 0x0, 5, 0); + static CCU_GATE(CLK_DPU_PIXELCLK1, dpu1_pixelclk, "dpu1-pixelclk", +- video_pll_clk_pd, 0x0, 6, 0); ++ dpu1_clk_pd, 0x0, 6, 0); + static CCU_GATE(CLK_DPU_HCLK, dpu_hclk, "dpu-hclk", video_pll_clk_pd, 0x0, + 7, 0); + static CCU_GATE(CLK_DPU_ACLK, dpu_aclk, "dpu-aclk", video_pll_clk_pd, 0x0, +-- +2.51.0 + diff --git a/queue-6.17/clk-thead-th1520-ap-describe-gate-clocks-with-clk_ga.patch b/queue-6.17/clk-thead-th1520-ap-describe-gate-clocks-with-clk_ga.patch new file mode 100644 index 0000000000..c823c9569f --- /dev/null +++ b/queue-6.17/clk-thead-th1520-ap-describe-gate-clocks-with-clk_ga.patch @@ -0,0 +1,517 @@ +From 3f53623131d0fdcc527952dfaf60abd90d1196b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 16 Aug 2025 16:44:44 +0800 +Subject: clk: thead: th1520-ap: describe gate clocks with clk_gate + +From: Icenowy Zheng + +[ Upstream commit aaa75cbd5d4f63e4edf8b74118d367361dcf92f7 ] + +Similar to previous situation of mux clocks, the gate clocks of +clk-th1520-ap drivers are also using a helper that creates a temporary +struct clk_hw and abandons the struct clk_hw in struct ccu_common, which +prevents clock gates to be clock parents. + +Do the similar refactor of dropping struct ccu_common and directly use +struct clk_gate here. + +This patch mimics the refactor done on struct ccu_mux in 54edba916e29 +("clk: thead: th1520-ap: Describe mux clocks with clk_mux"). + +Fixes: ae81b69fd2b1 ("clk: thead: Add support for T-Head TH1520 AP_SUBSYS clocks") +Signed-off-by: Icenowy Zheng +Reviewed-by: Drew Fustini +Signed-off-by: Drew Fustini +Signed-off-by: Sasha Levin +--- + drivers/clk/thead/clk-th1520-ap.c | 382 +++++++++++++++--------------- + 1 file changed, 185 insertions(+), 197 deletions(-) + +diff --git a/drivers/clk/thead/clk-th1520-ap.c b/drivers/clk/thead/clk-th1520-ap.c +index cf1bba58f641e..4dbd1df9a86d4 100644 +--- a/drivers/clk/thead/clk-th1520-ap.c ++++ b/drivers/clk/thead/clk-th1520-ap.c +@@ -48,8 +48,9 @@ struct ccu_mux { + }; + + struct ccu_gate { +- u32 enable; +- struct ccu_common common; ++ int clkid; ++ u32 reg; ++ struct clk_gate gate; + }; + + struct ccu_div { +@@ -87,12 +88,12 @@ struct ccu_pll { + 0), \ + } + +-#define CCU_GATE(_clkid, _struct, _name, _parent, _reg, _gate, _flags) \ ++#define CCU_GATE(_clkid, _struct, _name, _parent, _reg, _bit, _flags) \ + struct ccu_gate _struct = { \ +- .enable = _gate, \ +- .common = { \ +- .clkid = _clkid, \ +- .cfg0 = _reg, \ ++ .clkid = _clkid, \ ++ .reg = _reg, \ ++ .gate = { \ ++ .bit_idx = _bit, \ + .hw.init = CLK_HW_INIT_PARENTS_DATA( \ + _name, \ + _parent, \ +@@ -120,13 +121,6 @@ static inline struct ccu_div *hw_to_ccu_div(struct clk_hw *hw) + return container_of(common, struct ccu_div, common); + } + +-static inline struct ccu_gate *hw_to_ccu_gate(struct clk_hw *hw) +-{ +- struct ccu_common *common = hw_to_ccu_common(hw); +- +- return container_of(common, struct ccu_gate, common); +-} +- + static u8 ccu_get_parent_helper(struct ccu_common *common, + struct ccu_internal *mux) + { +@@ -786,128 +780,128 @@ static const struct clk_parent_data emmc_sdio_ref_clk_pd[] = { + { .hw = &emmc_sdio_ref_clk.hw }, + }; + +-static CCU_GATE(CLK_BROM, brom_clk, "brom", ahb2_cpusys_hclk_pd, 0x100, BIT(4), 0); +-static CCU_GATE(CLK_BMU, bmu_clk, "bmu", axi4_cpusys2_aclk_pd, 0x100, BIT(5), 0); ++static CCU_GATE(CLK_BROM, brom_clk, "brom", ahb2_cpusys_hclk_pd, 0x100, 4, 0); ++static CCU_GATE(CLK_BMU, bmu_clk, "bmu", axi4_cpusys2_aclk_pd, 0x100, 5, 0); + static CCU_GATE(CLK_AON2CPU_A2X, aon2cpu_a2x_clk, "aon2cpu-a2x", axi4_cpusys2_aclk_pd, +- 0x134, BIT(8), 0); ++ 0x134, 8, 0); + static CCU_GATE(CLK_X2X_CPUSYS, x2x_cpusys_clk, "x2x-cpusys", axi4_cpusys2_aclk_pd, +- 0x134, BIT(7), 0); ++ 0x134, 7, 0); + static CCU_GATE(CLK_CPU2AON_X2H, cpu2aon_x2h_clk, "cpu2aon-x2h", axi_aclk_pd, +- 0x138, BIT(8), CLK_IGNORE_UNUSED); ++ 0x138, 8, CLK_IGNORE_UNUSED); + static CCU_GATE(CLK_CPU2PERI_X2H, cpu2peri_x2h_clk, "cpu2peri-x2h", axi4_cpusys2_aclk_pd, +- 0x140, BIT(9), CLK_IGNORE_UNUSED); ++ 0x140, 9, CLK_IGNORE_UNUSED); + static CCU_GATE(CLK_PERISYS_APB1_HCLK, perisys_apb1_hclk, "perisys-apb1-hclk", perisys_ahb_hclk_pd, +- 0x150, BIT(9), CLK_IGNORE_UNUSED); ++ 0x150, 9, CLK_IGNORE_UNUSED); + static CCU_GATE(CLK_PERISYS_APB2_HCLK, perisys_apb2_hclk, "perisys-apb2-hclk", perisys_ahb_hclk_pd, +- 0x150, BIT(10), CLK_IGNORE_UNUSED); ++ 0x150, 10, CLK_IGNORE_UNUSED); + static CCU_GATE(CLK_PERISYS_APB3_HCLK, perisys_apb3_hclk, "perisys-apb3-hclk", perisys_ahb_hclk_pd, +- 0x150, BIT(11), CLK_IGNORE_UNUSED); ++ 0x150, 11, CLK_IGNORE_UNUSED); + static CCU_GATE(CLK_PERISYS_APB4_HCLK, perisys_apb4_hclk, "perisys-apb4-hclk", perisys_ahb_hclk_pd, +- 0x150, BIT(12), 0); +-static CCU_GATE(CLK_NPU_AXI, npu_axi_clk, "npu-axi", axi_aclk_pd, 0x1c8, BIT(5), 0); +-static CCU_GATE(CLK_CPU2VP, cpu2vp_clk, "cpu2vp", axi_aclk_pd, 0x1e0, BIT(13), 0); +-static CCU_GATE(CLK_EMMC_SDIO, emmc_sdio_clk, "emmc-sdio", emmc_sdio_ref_clk_pd, 0x204, BIT(30), 0); +-static CCU_GATE(CLK_GMAC1, gmac1_clk, "gmac1", gmac_pll_clk_pd, 0x204, BIT(26), 0); +-static CCU_GATE(CLK_PADCTRL1, padctrl1_clk, "padctrl1", perisys_apb_pclk_pd, 0x204, BIT(24), 0); +-static CCU_GATE(CLK_DSMART, dsmart_clk, "dsmart", perisys_apb_pclk_pd, 0x204, BIT(23), 0); +-static CCU_GATE(CLK_PADCTRL0, padctrl0_clk, "padctrl0", perisys_apb_pclk_pd, 0x204, BIT(22), 0); +-static CCU_GATE(CLK_GMAC_AXI, gmac_axi_clk, "gmac-axi", axi4_cpusys2_aclk_pd, 0x204, BIT(21), 0); +-static CCU_GATE(CLK_GPIO3, gpio3_clk, "gpio3-clk", peri2sys_apb_pclk_pd, 0x204, BIT(20), 0); +-static CCU_GATE(CLK_GMAC0, gmac0_clk, "gmac0", gmac_pll_clk_pd, 0x204, BIT(19), 0); +-static CCU_GATE(CLK_PWM, pwm_clk, "pwm", perisys_apb_pclk_pd, 0x204, BIT(18), 0); +-static CCU_GATE(CLK_QSPI0, qspi0_clk, "qspi0", video_pll_clk_pd, 0x204, BIT(17), 0); +-static CCU_GATE(CLK_QSPI1, qspi1_clk, "qspi1", video_pll_clk_pd, 0x204, BIT(16), 0); +-static CCU_GATE(CLK_SPI, spi_clk, "spi", video_pll_clk_pd, 0x204, BIT(15), 0); +-static CCU_GATE(CLK_UART0_PCLK, uart0_pclk, "uart0-pclk", perisys_apb_pclk_pd, 0x204, BIT(14), 0); +-static CCU_GATE(CLK_UART1_PCLK, uart1_pclk, "uart1-pclk", perisys_apb_pclk_pd, 0x204, BIT(13), 0); +-static CCU_GATE(CLK_UART2_PCLK, uart2_pclk, "uart2-pclk", perisys_apb_pclk_pd, 0x204, BIT(12), 0); +-static CCU_GATE(CLK_UART3_PCLK, uart3_pclk, "uart3-pclk", perisys_apb_pclk_pd, 0x204, BIT(11), 0); +-static CCU_GATE(CLK_UART4_PCLK, uart4_pclk, "uart4-pclk", perisys_apb_pclk_pd, 0x204, BIT(10), 0); +-static CCU_GATE(CLK_UART5_PCLK, uart5_pclk, "uart5-pclk", perisys_apb_pclk_pd, 0x204, BIT(9), 0); +-static CCU_GATE(CLK_GPIO0, gpio0_clk, "gpio0-clk", perisys_apb_pclk_pd, 0x204, BIT(8), 0); +-static CCU_GATE(CLK_GPIO1, gpio1_clk, "gpio1-clk", perisys_apb_pclk_pd, 0x204, BIT(7), 0); +-static CCU_GATE(CLK_GPIO2, gpio2_clk, "gpio2-clk", peri2sys_apb_pclk_pd, 0x204, BIT(6), 0); +-static CCU_GATE(CLK_I2C0, i2c0_clk, "i2c0", perisys_apb_pclk_pd, 0x204, BIT(5), 0); +-static CCU_GATE(CLK_I2C1, i2c1_clk, "i2c1", perisys_apb_pclk_pd, 0x204, BIT(4), 0); +-static CCU_GATE(CLK_I2C2, i2c2_clk, "i2c2", perisys_apb_pclk_pd, 0x204, BIT(3), 0); +-static CCU_GATE(CLK_I2C3, i2c3_clk, "i2c3", perisys_apb_pclk_pd, 0x204, BIT(2), 0); +-static CCU_GATE(CLK_I2C4, i2c4_clk, "i2c4", perisys_apb_pclk_pd, 0x204, BIT(1), 0); +-static CCU_GATE(CLK_I2C5, i2c5_clk, "i2c5", perisys_apb_pclk_pd, 0x204, BIT(0), 0); +-static CCU_GATE(CLK_SPINLOCK, spinlock_clk, "spinlock", ahb2_cpusys_hclk_pd, 0x208, BIT(10), 0); +-static CCU_GATE(CLK_DMA, dma_clk, "dma", axi4_cpusys2_aclk_pd, 0x208, BIT(8), 0); +-static CCU_GATE(CLK_MBOX0, mbox0_clk, "mbox0", apb3_cpusys_pclk_pd, 0x208, BIT(7), 0); +-static CCU_GATE(CLK_MBOX1, mbox1_clk, "mbox1", apb3_cpusys_pclk_pd, 0x208, BIT(6), 0); +-static CCU_GATE(CLK_MBOX2, mbox2_clk, "mbox2", apb3_cpusys_pclk_pd, 0x208, BIT(5), 0); +-static CCU_GATE(CLK_MBOX3, mbox3_clk, "mbox3", apb3_cpusys_pclk_pd, 0x208, BIT(4), 0); +-static CCU_GATE(CLK_WDT0, wdt0_clk, "wdt0", apb3_cpusys_pclk_pd, 0x208, BIT(3), 0); +-static CCU_GATE(CLK_WDT1, wdt1_clk, "wdt1", apb3_cpusys_pclk_pd, 0x208, BIT(2), 0); +-static CCU_GATE(CLK_TIMER0, timer0_clk, "timer0", apb3_cpusys_pclk_pd, 0x208, BIT(1), 0); +-static CCU_GATE(CLK_TIMER1, timer1_clk, "timer1", apb3_cpusys_pclk_pd, 0x208, BIT(0), 0); +-static CCU_GATE(CLK_SRAM0, sram0_clk, "sram0", axi_aclk_pd, 0x20c, BIT(4), 0); +-static CCU_GATE(CLK_SRAM1, sram1_clk, "sram1", axi_aclk_pd, 0x20c, BIT(3), 0); +-static CCU_GATE(CLK_SRAM2, sram2_clk, "sram2", axi_aclk_pd, 0x20c, BIT(2), 0); +-static CCU_GATE(CLK_SRAM3, sram3_clk, "sram3", axi_aclk_pd, 0x20c, BIT(1), 0); ++ 0x150, 12, 0); ++static CCU_GATE(CLK_NPU_AXI, npu_axi_clk, "npu-axi", axi_aclk_pd, 0x1c8, 5, 0); ++static CCU_GATE(CLK_CPU2VP, cpu2vp_clk, "cpu2vp", axi_aclk_pd, 0x1e0, 13, 0); ++static CCU_GATE(CLK_EMMC_SDIO, emmc_sdio_clk, "emmc-sdio", emmc_sdio_ref_clk_pd, 0x204, 30, 0); ++static CCU_GATE(CLK_GMAC1, gmac1_clk, "gmac1", gmac_pll_clk_pd, 0x204, 26, 0); ++static CCU_GATE(CLK_PADCTRL1, padctrl1_clk, "padctrl1", perisys_apb_pclk_pd, 0x204, 24, 0); ++static CCU_GATE(CLK_DSMART, dsmart_clk, "dsmart", perisys_apb_pclk_pd, 0x204, 23, 0); ++static CCU_GATE(CLK_PADCTRL0, padctrl0_clk, "padctrl0", perisys_apb_pclk_pd, 0x204, 22, 0); ++static CCU_GATE(CLK_GMAC_AXI, gmac_axi_clk, "gmac-axi", axi4_cpusys2_aclk_pd, 0x204, 21, 0); ++static CCU_GATE(CLK_GPIO3, gpio3_clk, "gpio3-clk", peri2sys_apb_pclk_pd, 0x204, 20, 0); ++static CCU_GATE(CLK_GMAC0, gmac0_clk, "gmac0", gmac_pll_clk_pd, 0x204, 19, 0); ++static CCU_GATE(CLK_PWM, pwm_clk, "pwm", perisys_apb_pclk_pd, 0x204, 18, 0); ++static CCU_GATE(CLK_QSPI0, qspi0_clk, "qspi0", video_pll_clk_pd, 0x204, 17, 0); ++static CCU_GATE(CLK_QSPI1, qspi1_clk, "qspi1", video_pll_clk_pd, 0x204, 16, 0); ++static CCU_GATE(CLK_SPI, spi_clk, "spi", video_pll_clk_pd, 0x204, 15, 0); ++static CCU_GATE(CLK_UART0_PCLK, uart0_pclk, "uart0-pclk", perisys_apb_pclk_pd, 0x204, 14, 0); ++static CCU_GATE(CLK_UART1_PCLK, uart1_pclk, "uart1-pclk", perisys_apb_pclk_pd, 0x204, 13, 0); ++static CCU_GATE(CLK_UART2_PCLK, uart2_pclk, "uart2-pclk", perisys_apb_pclk_pd, 0x204, 12, 0); ++static CCU_GATE(CLK_UART3_PCLK, uart3_pclk, "uart3-pclk", perisys_apb_pclk_pd, 0x204, 11, 0); ++static CCU_GATE(CLK_UART4_PCLK, uart4_pclk, "uart4-pclk", perisys_apb_pclk_pd, 0x204, 10, 0); ++static CCU_GATE(CLK_UART5_PCLK, uart5_pclk, "uart5-pclk", perisys_apb_pclk_pd, 0x204, 9, 0); ++static CCU_GATE(CLK_GPIO0, gpio0_clk, "gpio0-clk", perisys_apb_pclk_pd, 0x204, 8, 0); ++static CCU_GATE(CLK_GPIO1, gpio1_clk, "gpio1-clk", perisys_apb_pclk_pd, 0x204, 7, 0); ++static CCU_GATE(CLK_GPIO2, gpio2_clk, "gpio2-clk", peri2sys_apb_pclk_pd, 0x204, 6, 0); ++static CCU_GATE(CLK_I2C0, i2c0_clk, "i2c0", perisys_apb_pclk_pd, 0x204, 5, 0); ++static CCU_GATE(CLK_I2C1, i2c1_clk, "i2c1", perisys_apb_pclk_pd, 0x204, 4, 0); ++static CCU_GATE(CLK_I2C2, i2c2_clk, "i2c2", perisys_apb_pclk_pd, 0x204, 3, 0); ++static CCU_GATE(CLK_I2C3, i2c3_clk, "i2c3", perisys_apb_pclk_pd, 0x204, 2, 0); ++static CCU_GATE(CLK_I2C4, i2c4_clk, "i2c4", perisys_apb_pclk_pd, 0x204, 1, 0); ++static CCU_GATE(CLK_I2C5, i2c5_clk, "i2c5", perisys_apb_pclk_pd, 0x204, 0, 0); ++static CCU_GATE(CLK_SPINLOCK, spinlock_clk, "spinlock", ahb2_cpusys_hclk_pd, 0x208, 10, 0); ++static CCU_GATE(CLK_DMA, dma_clk, "dma", axi4_cpusys2_aclk_pd, 0x208, 8, 0); ++static CCU_GATE(CLK_MBOX0, mbox0_clk, "mbox0", apb3_cpusys_pclk_pd, 0x208, 7, 0); ++static CCU_GATE(CLK_MBOX1, mbox1_clk, "mbox1", apb3_cpusys_pclk_pd, 0x208, 6, 0); ++static CCU_GATE(CLK_MBOX2, mbox2_clk, "mbox2", apb3_cpusys_pclk_pd, 0x208, 5, 0); ++static CCU_GATE(CLK_MBOX3, mbox3_clk, "mbox3", apb3_cpusys_pclk_pd, 0x208, 4, 0); ++static CCU_GATE(CLK_WDT0, wdt0_clk, "wdt0", apb3_cpusys_pclk_pd, 0x208, 3, 0); ++static CCU_GATE(CLK_WDT1, wdt1_clk, "wdt1", apb3_cpusys_pclk_pd, 0x208, 2, 0); ++static CCU_GATE(CLK_TIMER0, timer0_clk, "timer0", apb3_cpusys_pclk_pd, 0x208, 1, 0); ++static CCU_GATE(CLK_TIMER1, timer1_clk, "timer1", apb3_cpusys_pclk_pd, 0x208, 0, 0); ++static CCU_GATE(CLK_SRAM0, sram0_clk, "sram0", axi_aclk_pd, 0x20c, 4, 0); ++static CCU_GATE(CLK_SRAM1, sram1_clk, "sram1", axi_aclk_pd, 0x20c, 3, 0); ++static CCU_GATE(CLK_SRAM2, sram2_clk, "sram2", axi_aclk_pd, 0x20c, 2, 0); ++static CCU_GATE(CLK_SRAM3, sram3_clk, "sram3", axi_aclk_pd, 0x20c, 1, 0); + + static CCU_GATE(CLK_AXI4_VO_ACLK, axi4_vo_aclk, "axi4-vo-aclk", +- video_pll_clk_pd, 0x0, BIT(0), 0); ++ video_pll_clk_pd, 0x0, 0, 0); + static CCU_GATE(CLK_GPU_CORE, gpu_core_clk, "gpu-core-clk", video_pll_clk_pd, +- 0x0, BIT(3), 0); ++ 0x0, 3, 0); + static CCU_GATE(CLK_GPU_CFG_ACLK, gpu_cfg_aclk, "gpu-cfg-aclk", +- video_pll_clk_pd, 0x0, BIT(4), 0); ++ video_pll_clk_pd, 0x0, 4, 0); + static CCU_GATE(CLK_DPU_PIXELCLK0, dpu0_pixelclk, "dpu0-pixelclk", +- video_pll_clk_pd, 0x0, BIT(5), 0); ++ video_pll_clk_pd, 0x0, 5, 0); + static CCU_GATE(CLK_DPU_PIXELCLK1, dpu1_pixelclk, "dpu1-pixelclk", +- video_pll_clk_pd, 0x0, BIT(6), 0); ++ video_pll_clk_pd, 0x0, 6, 0); + static CCU_GATE(CLK_DPU_HCLK, dpu_hclk, "dpu-hclk", video_pll_clk_pd, 0x0, +- BIT(7), 0); ++ 7, 0); + static CCU_GATE(CLK_DPU_ACLK, dpu_aclk, "dpu-aclk", video_pll_clk_pd, 0x0, +- BIT(8), 0); ++ 8, 0); + static CCU_GATE(CLK_DPU_CCLK, dpu_cclk, "dpu-cclk", video_pll_clk_pd, 0x0, +- BIT(9), 0); ++ 9, 0); + static CCU_GATE(CLK_HDMI_SFR, hdmi_sfr_clk, "hdmi-sfr-clk", video_pll_clk_pd, +- 0x0, BIT(10), 0); ++ 0x0, 10, 0); + static CCU_GATE(CLK_HDMI_PCLK, hdmi_pclk, "hdmi-pclk", video_pll_clk_pd, 0x0, +- BIT(11), 0); ++ 11, 0); + static CCU_GATE(CLK_HDMI_CEC, hdmi_cec_clk, "hdmi-cec-clk", video_pll_clk_pd, +- 0x0, BIT(12), 0); ++ 0x0, 12, 0); + static CCU_GATE(CLK_MIPI_DSI0_PCLK, mipi_dsi0_pclk, "mipi-dsi0-pclk", +- video_pll_clk_pd, 0x0, BIT(13), 0); ++ video_pll_clk_pd, 0x0, 13, 0); + static CCU_GATE(CLK_MIPI_DSI1_PCLK, mipi_dsi1_pclk, "mipi-dsi1-pclk", +- video_pll_clk_pd, 0x0, BIT(14), 0); ++ video_pll_clk_pd, 0x0, 14, 0); + static CCU_GATE(CLK_MIPI_DSI0_CFG, mipi_dsi0_cfg_clk, "mipi-dsi0-cfg-clk", +- video_pll_clk_pd, 0x0, BIT(15), 0); ++ video_pll_clk_pd, 0x0, 15, 0); + static CCU_GATE(CLK_MIPI_DSI1_CFG, mipi_dsi1_cfg_clk, "mipi-dsi1-cfg-clk", +- video_pll_clk_pd, 0x0, BIT(16), 0); ++ video_pll_clk_pd, 0x0, 16, 0); + static CCU_GATE(CLK_MIPI_DSI0_REFCLK, mipi_dsi0_refclk, "mipi-dsi0-refclk", +- video_pll_clk_pd, 0x0, BIT(17), 0); ++ video_pll_clk_pd, 0x0, 17, 0); + static CCU_GATE(CLK_MIPI_DSI1_REFCLK, mipi_dsi1_refclk, "mipi-dsi1-refclk", +- video_pll_clk_pd, 0x0, BIT(18), 0); ++ video_pll_clk_pd, 0x0, 18, 0); + static CCU_GATE(CLK_HDMI_I2S, hdmi_i2s_clk, "hdmi-i2s-clk", video_pll_clk_pd, +- 0x0, BIT(19), 0); ++ 0x0, 19, 0); + static CCU_GATE(CLK_X2H_DPU1_ACLK, x2h_dpu1_aclk, "x2h-dpu1-aclk", +- video_pll_clk_pd, 0x0, BIT(20), 0); ++ video_pll_clk_pd, 0x0, 20, 0); + static CCU_GATE(CLK_X2H_DPU_ACLK, x2h_dpu_aclk, "x2h-dpu-aclk", +- video_pll_clk_pd, 0x0, BIT(21), 0); ++ video_pll_clk_pd, 0x0, 21, 0); + static CCU_GATE(CLK_AXI4_VO_PCLK, axi4_vo_pclk, "axi4-vo-pclk", +- video_pll_clk_pd, 0x0, BIT(22), 0); ++ video_pll_clk_pd, 0x0, 22, 0); + static CCU_GATE(CLK_IOPMP_VOSYS_DPU_PCLK, iopmp_vosys_dpu_pclk, +- "iopmp-vosys-dpu-pclk", video_pll_clk_pd, 0x0, BIT(23), 0); ++ "iopmp-vosys-dpu-pclk", video_pll_clk_pd, 0x0, 23, 0); + static CCU_GATE(CLK_IOPMP_VOSYS_DPU1_PCLK, iopmp_vosys_dpu1_pclk, +- "iopmp-vosys-dpu1-pclk", video_pll_clk_pd, 0x0, BIT(24), 0); ++ "iopmp-vosys-dpu1-pclk", video_pll_clk_pd, 0x0, 24, 0); + static CCU_GATE(CLK_IOPMP_VOSYS_GPU_PCLK, iopmp_vosys_gpu_pclk, +- "iopmp-vosys-gpu-pclk", video_pll_clk_pd, 0x0, BIT(25), 0); ++ "iopmp-vosys-gpu-pclk", video_pll_clk_pd, 0x0, 25, 0); + static CCU_GATE(CLK_IOPMP_DPU1_ACLK, iopmp_dpu1_aclk, "iopmp-dpu1-aclk", +- video_pll_clk_pd, 0x0, BIT(27), 0); ++ video_pll_clk_pd, 0x0, 27, 0); + static CCU_GATE(CLK_IOPMP_DPU_ACLK, iopmp_dpu_aclk, "iopmp-dpu-aclk", +- video_pll_clk_pd, 0x0, BIT(28), 0); ++ video_pll_clk_pd, 0x0, 28, 0); + static CCU_GATE(CLK_IOPMP_GPU_ACLK, iopmp_gpu_aclk, "iopmp-gpu-aclk", +- video_pll_clk_pd, 0x0, BIT(29), 0); ++ video_pll_clk_pd, 0x0, 29, 0); + static CCU_GATE(CLK_MIPIDSI0_PIXCLK, mipi_dsi0_pixclk, "mipi-dsi0-pixclk", +- video_pll_clk_pd, 0x0, BIT(30), 0); ++ video_pll_clk_pd, 0x0, 30, 0); + static CCU_GATE(CLK_MIPIDSI1_PIXCLK, mipi_dsi1_pixclk, "mipi-dsi1-pixclk", +- video_pll_clk_pd, 0x0, BIT(31), 0); ++ video_pll_clk_pd, 0x0, 31, 0); + static CCU_GATE(CLK_HDMI_PIXCLK, hdmi_pixclk, "hdmi-pixclk", video_pll_clk_pd, +- 0x4, BIT(0), 0); ++ 0x4, 0, 0); + + static CLK_FIXED_FACTOR_HW(gmac_pll_clk_100m, "gmac-pll-clk-100m", + &gmac_pll_clk.common.hw, 10, 1, 0); +@@ -963,93 +957,93 @@ static struct ccu_mux *th1520_mux_clks[] = { + &uart_sclk, + }; + +-static struct ccu_common *th1520_gate_clks[] = { +- &emmc_sdio_clk.common, +- &aon2cpu_a2x_clk.common, +- &x2x_cpusys_clk.common, +- &brom_clk.common, +- &bmu_clk.common, +- &cpu2aon_x2h_clk.common, +- &cpu2peri_x2h_clk.common, +- &cpu2vp_clk.common, +- &perisys_apb1_hclk.common, +- &perisys_apb2_hclk.common, +- &perisys_apb3_hclk.common, +- &perisys_apb4_hclk.common, +- &npu_axi_clk.common, +- &gmac1_clk.common, +- &padctrl1_clk.common, +- &dsmart_clk.common, +- &padctrl0_clk.common, +- &gmac_axi_clk.common, +- &gpio3_clk.common, +- &gmac0_clk.common, +- &pwm_clk.common, +- &qspi0_clk.common, +- &qspi1_clk.common, +- &spi_clk.common, +- &uart0_pclk.common, +- &uart1_pclk.common, +- &uart2_pclk.common, +- &uart3_pclk.common, +- &uart4_pclk.common, +- &uart5_pclk.common, +- &gpio0_clk.common, +- &gpio1_clk.common, +- &gpio2_clk.common, +- &i2c0_clk.common, +- &i2c1_clk.common, +- &i2c2_clk.common, +- &i2c3_clk.common, +- &i2c4_clk.common, +- &i2c5_clk.common, +- &spinlock_clk.common, +- &dma_clk.common, +- &mbox0_clk.common, +- &mbox1_clk.common, +- &mbox2_clk.common, +- &mbox3_clk.common, +- &wdt0_clk.common, +- &wdt1_clk.common, +- &timer0_clk.common, +- &timer1_clk.common, +- &sram0_clk.common, +- &sram1_clk.common, +- &sram2_clk.common, +- &sram3_clk.common, +-}; +- +-static struct ccu_common *th1520_vo_gate_clks[] = { +- &axi4_vo_aclk.common, +- &gpu_core_clk.common, +- &gpu_cfg_aclk.common, +- &dpu0_pixelclk.common, +- &dpu1_pixelclk.common, +- &dpu_hclk.common, +- &dpu_aclk.common, +- &dpu_cclk.common, +- &hdmi_sfr_clk.common, +- &hdmi_pclk.common, +- &hdmi_cec_clk.common, +- &mipi_dsi0_pclk.common, +- &mipi_dsi1_pclk.common, +- &mipi_dsi0_cfg_clk.common, +- &mipi_dsi1_cfg_clk.common, +- &mipi_dsi0_refclk.common, +- &mipi_dsi1_refclk.common, +- &hdmi_i2s_clk.common, +- &x2h_dpu1_aclk.common, +- &x2h_dpu_aclk.common, +- &axi4_vo_pclk.common, +- &iopmp_vosys_dpu_pclk.common, +- &iopmp_vosys_dpu1_pclk.common, +- &iopmp_vosys_gpu_pclk.common, +- &iopmp_dpu1_aclk.common, +- &iopmp_dpu_aclk.common, +- &iopmp_gpu_aclk.common, +- &mipi_dsi0_pixclk.common, +- &mipi_dsi1_pixclk.common, +- &hdmi_pixclk.common ++static struct ccu_gate *th1520_gate_clks[] = { ++ &emmc_sdio_clk, ++ &aon2cpu_a2x_clk, ++ &x2x_cpusys_clk, ++ &brom_clk, ++ &bmu_clk, ++ &cpu2aon_x2h_clk, ++ &cpu2peri_x2h_clk, ++ &cpu2vp_clk, ++ &perisys_apb1_hclk, ++ &perisys_apb2_hclk, ++ &perisys_apb3_hclk, ++ &perisys_apb4_hclk, ++ &npu_axi_clk, ++ &gmac1_clk, ++ &padctrl1_clk, ++ &dsmart_clk, ++ &padctrl0_clk, ++ &gmac_axi_clk, ++ &gpio3_clk, ++ &gmac0_clk, ++ &pwm_clk, ++ &qspi0_clk, ++ &qspi1_clk, ++ &spi_clk, ++ &uart0_pclk, ++ &uart1_pclk, ++ &uart2_pclk, ++ &uart3_pclk, ++ &uart4_pclk, ++ &uart5_pclk, ++ &gpio0_clk, ++ &gpio1_clk, ++ &gpio2_clk, ++ &i2c0_clk, ++ &i2c1_clk, ++ &i2c2_clk, ++ &i2c3_clk, ++ &i2c4_clk, ++ &i2c5_clk, ++ &spinlock_clk, ++ &dma_clk, ++ &mbox0_clk, ++ &mbox1_clk, ++ &mbox2_clk, ++ &mbox3_clk, ++ &wdt0_clk, ++ &wdt1_clk, ++ &timer0_clk, ++ &timer1_clk, ++ &sram0_clk, ++ &sram1_clk, ++ &sram2_clk, ++ &sram3_clk, ++}; ++ ++static struct ccu_gate *th1520_vo_gate_clks[] = { ++ &axi4_vo_aclk, ++ &gpu_core_clk, ++ &gpu_cfg_aclk, ++ &dpu0_pixelclk, ++ &dpu1_pixelclk, ++ &dpu_hclk, ++ &dpu_aclk, ++ &dpu_cclk, ++ &hdmi_sfr_clk, ++ &hdmi_pclk, ++ &hdmi_cec_clk, ++ &mipi_dsi0_pclk, ++ &mipi_dsi1_pclk, ++ &mipi_dsi0_cfg_clk, ++ &mipi_dsi1_cfg_clk, ++ &mipi_dsi0_refclk, ++ &mipi_dsi1_refclk, ++ &hdmi_i2s_clk, ++ &x2h_dpu1_aclk, ++ &x2h_dpu_aclk, ++ &axi4_vo_pclk, ++ &iopmp_vosys_dpu_pclk, ++ &iopmp_vosys_dpu1_pclk, ++ &iopmp_vosys_gpu_pclk, ++ &iopmp_dpu1_aclk, ++ &iopmp_dpu_aclk, ++ &iopmp_gpu_aclk, ++ &mipi_dsi0_pixclk, ++ &mipi_dsi1_pixclk, ++ &hdmi_pixclk + }; + + static const struct regmap_config th1520_clk_regmap_config = { +@@ -1063,7 +1057,7 @@ struct th1520_plat_data { + struct ccu_common **th1520_pll_clks; + struct ccu_common **th1520_div_clks; + struct ccu_mux **th1520_mux_clks; +- struct ccu_common **th1520_gate_clks; ++ struct ccu_gate **th1520_gate_clks; + + int nr_clks; + int nr_pll_clks; +@@ -1102,7 +1096,6 @@ static int th1520_clk_probe(struct platform_device *pdev) + + struct regmap *map; + void __iomem *base; +- struct clk_hw *hw; + int ret, i; + + plat_data = device_get_match_data(&pdev->dev); +@@ -1161,20 +1154,15 @@ static int th1520_clk_probe(struct platform_device *pdev) + } + + for (i = 0; i < plat_data->nr_gate_clks; i++) { +- struct ccu_gate *cg = hw_to_ccu_gate(&plat_data->th1520_gate_clks[i]->hw); ++ struct ccu_gate *cg = plat_data->th1520_gate_clks[i]; + +- plat_data->th1520_gate_clks[i]->map = map; ++ cg->gate.reg = base + cg->reg; + +- hw = devm_clk_hw_register_gate_parent_data(dev, +- cg->common.hw.init->name, +- cg->common.hw.init->parent_data, +- cg->common.hw.init->flags, +- base + cg->common.cfg0, +- ffs(cg->enable) - 1, 0, NULL); +- if (IS_ERR(hw)) +- return PTR_ERR(hw); ++ ret = devm_clk_hw_register(dev, &cg->gate.hw); ++ if (ret) ++ return ret; + +- priv->hws[cg->common.clkid] = hw; ++ priv->hws[cg->clkid] = &cg->gate.hw; + } + + if (plat_data == &th1520_ap_platdata) { +-- +2.51.0 + diff --git a/queue-6.17/clk-thead-th1520-ap-fix-parent-of-padctrl0-clock.patch b/queue-6.17/clk-thead-th1520-ap-fix-parent-of-padctrl0-clock.patch new file mode 100644 index 0000000000..1f9a0afb33 --- /dev/null +++ b/queue-6.17/clk-thead-th1520-ap-fix-parent-of-padctrl0-clock.patch @@ -0,0 +1,50 @@ +From a4e727de2064633821d573b2910041b850208b07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 16 Aug 2025 16:44:45 +0800 +Subject: clk: thead: th1520-ap: fix parent of padctrl0 clock + +From: Icenowy Zheng + +[ Upstream commit 9e99b992c8874f323091d50a5e4727bbd138192d ] + +The padctrl0 clock seems to be a child of the perisys_apb4_hclk clock, +gating the later makes padctrl0 registers stuck too. + +Fix this relationship. + +Fixes: ae81b69fd2b1 ("clk: thead: Add support for T-Head TH1520 AP_SUBSYS clocks") +Signed-off-by: Icenowy Zheng +Reviewed-by: Drew Fustini +Reviewed-by: Troy Mitchell +Signed-off-by: Drew Fustini +Signed-off-by: Sasha Levin +--- + drivers/clk/thead/clk-th1520-ap.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/thead/clk-th1520-ap.c b/drivers/clk/thead/clk-th1520-ap.c +index 4dbd1df9a86d4..8a5d699638379 100644 +--- a/drivers/clk/thead/clk-th1520-ap.c ++++ b/drivers/clk/thead/clk-th1520-ap.c +@@ -798,13 +798,17 @@ static CCU_GATE(CLK_PERISYS_APB3_HCLK, perisys_apb3_hclk, "perisys-apb3-hclk", p + 0x150, 11, CLK_IGNORE_UNUSED); + static CCU_GATE(CLK_PERISYS_APB4_HCLK, perisys_apb4_hclk, "perisys-apb4-hclk", perisys_ahb_hclk_pd, + 0x150, 12, 0); ++static const struct clk_parent_data perisys_apb4_hclk_pd[] = { ++ { .hw = &perisys_apb4_hclk.gate.hw }, ++}; ++ + static CCU_GATE(CLK_NPU_AXI, npu_axi_clk, "npu-axi", axi_aclk_pd, 0x1c8, 5, 0); + static CCU_GATE(CLK_CPU2VP, cpu2vp_clk, "cpu2vp", axi_aclk_pd, 0x1e0, 13, 0); + static CCU_GATE(CLK_EMMC_SDIO, emmc_sdio_clk, "emmc-sdio", emmc_sdio_ref_clk_pd, 0x204, 30, 0); + static CCU_GATE(CLK_GMAC1, gmac1_clk, "gmac1", gmac_pll_clk_pd, 0x204, 26, 0); + static CCU_GATE(CLK_PADCTRL1, padctrl1_clk, "padctrl1", perisys_apb_pclk_pd, 0x204, 24, 0); + static CCU_GATE(CLK_DSMART, dsmart_clk, "dsmart", perisys_apb_pclk_pd, 0x204, 23, 0); +-static CCU_GATE(CLK_PADCTRL0, padctrl0_clk, "padctrl0", perisys_apb_pclk_pd, 0x204, 22, 0); ++static CCU_GATE(CLK_PADCTRL0, padctrl0_clk, "padctrl0", perisys_apb4_hclk_pd, 0x204, 22, 0); + static CCU_GATE(CLK_GMAC_AXI, gmac_axi_clk, "gmac-axi", axi4_cpusys2_aclk_pd, 0x204, 21, 0); + static CCU_GATE(CLK_GPIO3, gpio3_clk, "gpio3-clk", peri2sys_apb_pclk_pd, 0x204, 20, 0); + static CCU_GATE(CLK_GMAC0, gmac0_clk, "gmac0", gmac_pll_clk_pd, 0x204, 19, 0); +-- +2.51.0 + diff --git a/queue-6.17/cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch b/queue-6.17/cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch new file mode 100644 index 0000000000..3a8d10381c --- /dev/null +++ b/queue-6.17/cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch @@ -0,0 +1,47 @@ +From 02d3b72c30a485aacbcc0c825c85e6aca030ff22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 21:48:12 -0500 +Subject: cpufreq: tegra186: Set target frequency for all cpus in policy + +From: Aaron Kling + +[ Upstream commit 0b1bb980fd7cae126ee3d59f817068a13e321b07 ] + +The original commit set all cores in a cluster to a shared policy, but +did not update set_target to apply a frequency change to all cores for +the policy. This caused most cores to remain stuck at their boot +frequency. + +Fixes: be4ae8c19492 ("cpufreq: tegra186: Share policy per cluster") +Signed-off-by: Aaron Kling +Reviewed-by: Mikko Perttunen +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/tegra186-cpufreq.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c +index cbabb726c6645..6c394b429b618 100644 +--- a/drivers/cpufreq/tegra186-cpufreq.c ++++ b/drivers/cpufreq/tegra186-cpufreq.c +@@ -93,10 +93,14 @@ static int tegra186_cpufreq_set_target(struct cpufreq_policy *policy, + { + struct tegra186_cpufreq_data *data = cpufreq_get_driver_data(); + struct cpufreq_frequency_table *tbl = policy->freq_table + index; +- unsigned int edvd_offset = data->cpus[policy->cpu].edvd_offset; ++ unsigned int edvd_offset; + u32 edvd_val = tbl->driver_data; ++ u32 cpu; + +- writel(edvd_val, data->regs + edvd_offset); ++ for_each_cpu(cpu, policy->cpus) { ++ edvd_offset = data->cpus[cpu].edvd_offset; ++ writel(edvd_val, data->regs + edvd_offset); ++ } + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.17/crypto-essiv-check-ssize-for-decryption-and-in-place.patch b/queue-6.17/crypto-essiv-check-ssize-for-decryption-and-in-place.patch new file mode 100644 index 0000000000..987f1530b8 --- /dev/null +++ b/queue-6.17/crypto-essiv-check-ssize-for-decryption-and-in-place.patch @@ -0,0 +1,63 @@ +From 38983261a14e9bb29b00cc2bb4fcc5a693a85699 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 15:54:20 +0800 +Subject: crypto: essiv - Check ssize for decryption and in-place encryption + +From: Herbert Xu + +[ Upstream commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f ] + +Move the ssize check to the start in essiv_aead_crypt so that +it's also checked for decryption and in-place encryption. + +Reported-by: Muhammad Alifa Ramdhan +Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation") +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/essiv.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/crypto/essiv.c b/crypto/essiv.c +index d003b78fcd855..a47a3eab69351 100644 +--- a/crypto/essiv.c ++++ b/crypto/essiv.c +@@ -186,9 +186,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) + const struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm); + struct essiv_aead_request_ctx *rctx = aead_request_ctx(req); + struct aead_request *subreq = &rctx->aead_req; ++ int ivsize = crypto_aead_ivsize(tfm); ++ int ssize = req->assoclen - ivsize; + struct scatterlist *src = req->src; + int err; + ++ if (ssize < 0) ++ return -EINVAL; ++ + crypto_cipher_encrypt_one(tctx->essiv_cipher, req->iv, req->iv); + + /* +@@ -198,19 +203,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) + */ + rctx->assoc = NULL; + if (req->src == req->dst || !enc) { +- scatterwalk_map_and_copy(req->iv, req->dst, +- req->assoclen - crypto_aead_ivsize(tfm), +- crypto_aead_ivsize(tfm), 1); ++ scatterwalk_map_and_copy(req->iv, req->dst, ssize, ivsize, 1); + } else { + u8 *iv = (u8 *)aead_request_ctx(req) + tctx->ivoffset; +- int ivsize = crypto_aead_ivsize(tfm); +- int ssize = req->assoclen - ivsize; + struct scatterlist *sg; + int nents; + +- if (ssize < 0) +- return -EINVAL; +- + nents = sg_nents_for_len(req->src, ssize); + if (nents < 0) + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.17/crypto-skcipher-fix-reqsize-handling.patch b/queue-6.17/crypto-skcipher-fix-reqsize-handling.patch new file mode 100644 index 0000000000..4038d86e2c --- /dev/null +++ b/queue-6.17/crypto-skcipher-fix-reqsize-handling.patch @@ -0,0 +1,53 @@ +From 8565f2bb86aada0ef6de75dc25f0aa6864360be2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 19:27:51 +0530 +Subject: crypto: skcipher - Fix reqsize handling + +From: T Pratham + +[ Upstream commit 229c586b5e86979badb7cb0d38717b88a9e95ddd ] + +Commit afddce13ce81d ("crypto: api - Add reqsize to crypto_alg") +introduced cra_reqsize field in crypto_alg struct to replace type +specific reqsize fields. It looks like this was introduced specifically +for ahash and acomp from the commit description as subsequent commits +add necessary changes in these alg frameworks. + +However, this is being recommended for use in all crypto algs [1] +instead of setting reqsize using crypto_*_set_reqsize(). Using +cra_reqsize in skcipher algorithms, hence, causes memory +corruptions and crashes as the underlying functions in the algorithm +framework have not been updated to set the reqsize properly from +cra_reqsize. [2] + +Add proper set_reqsize calls in the skcipher init function to +properly initialize reqsize for these algorithms in the framework. + +[1]: https://lore.kernel.org/linux-crypto/aCL8BxpHr5OpT04k@gondor.apana.org.au/ +[2]: https://gist.github.com/Pratham-T/24247446f1faf4b7843e4014d5089f6b + +Fixes: afddce13ce81d ("crypto: api - Add reqsize to crypto_alg") +Fixes: 52f641bc63a4 ("crypto: ti - Add driver for DTHE V2 AES Engine (ECB, CBC)") +Signed-off-by: T Pratham +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/skcipher.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/crypto/skcipher.c b/crypto/skcipher.c +index de5fc91bba267..8fa5d9686d085 100644 +--- a/crypto/skcipher.c ++++ b/crypto/skcipher.c +@@ -294,6 +294,8 @@ static int crypto_skcipher_init_tfm(struct crypto_tfm *tfm) + return crypto_init_lskcipher_ops_sg(tfm); + } + ++ crypto_skcipher_set_reqsize(skcipher, crypto_tfm_alg_reqsize(tfm)); ++ + if (alg->exit) + skcipher->base.exit = crypto_skcipher_exit_tfm; + +-- +2.51.0 + diff --git a/queue-6.17/drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch b/queue-6.17/drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch new file mode 100644 index 0000000000..90371ad020 --- /dev/null +++ b/queue-6.17/drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch @@ -0,0 +1,39 @@ +From def966884617de6b114ad7b7770568232e9f19ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:22 +0200 +Subject: drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit d60f9c45d1bff7e20ecd57492ef7a5e33c94a37c ] + +Without these, it's impossible to program these registers. + +Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +index cbce194ec7b82..ff746fba850bc 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +@@ -155,6 +155,8 @@ + SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \ + SRI(VIEWPORT_START, SCL, id), \ + SRI(VIEWPORT_SIZE, SCL, id), \ ++ SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \ ++ SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \ + SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \ + SRI(SCL_VERT_FILTER_SCALE_RATIO, SCL, id), \ + SRI(SCL_VERT_FILTER_INIT, SCL, id), \ +-- +2.51.0 + diff --git a/queue-6.17/drm-amd-display-disable-scaling-on-dce6-for-now.patch b/queue-6.17/drm-amd-display-disable-scaling-on-dce6-for-now.patch new file mode 100644 index 0000000000..117a2baeeb --- /dev/null +++ b/queue-6.17/drm-amd-display-disable-scaling-on-dce6-for-now.patch @@ -0,0 +1,51 @@ +From 298ac1edcd8b2f35ef4a200740b47d3f8ed2c4fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:25 +0200 +Subject: drm/amd/display: Disable scaling on DCE6 for now +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 0e190a0446ec517666dab4691b296a9b758e590f ] + +Scaling doesn't work on DCE6 at the moment, the current +register programming produces incorrect output when using +fractional scaling (between 100-200%) on resolutions higher +than 1080p. + +Disable it until we figure out how to program it properly. + +Fixes: 7c15fd86aaec ("drm/amd/display: dc/dce: add initial DCE6 support (v10)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c +index 53b60044653f8..f887d59da7c6f 100644 +--- a/drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c +@@ -403,13 +403,13 @@ static const struct dc_plane_cap plane_cap = { + }, + + .max_upscale_factor = { +- .argb8888 = 16000, ++ .argb8888 = 1, + .nv12 = 1, + .fp16 = 1 + }, + + .max_downscale_factor = { +- .argb8888 = 250, ++ .argb8888 = 1, + .nv12 = 1, + .fp16 = 1 + } +-- +2.51.0 + diff --git a/queue-6.17/drm-amd-display-properly-clear-scl_-_filter_control-.patch b/queue-6.17/drm-amd-display-properly-clear-scl_-_filter_control-.patch new file mode 100644 index 0000000000..a9cbaaf11b --- /dev/null +++ b/queue-6.17/drm-amd-display-properly-clear-scl_-_filter_control-.patch @@ -0,0 +1,51 @@ +From db58495bfc7f1ae538b72f4e61c635ad32463a8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:23 +0200 +Subject: drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit c0aa7cf49dd6cb302fe28e7183992b772cb7420c ] + +Previously, the code would set a bit field which didn't exist +on DCE6 so it would be effectively a no-op. + +Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +index 2b1673d69ea83..e5c2fb134d14d 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +@@ -527,8 +527,7 @@ static void dce60_transform_set_scaler( + if (coeffs_v != xfm_dce->filter_v || coeffs_h != xfm_dce->filter_h) { + /* 4. Program vertical filters */ + if (xfm_dce->filter_v == NULL) +- REG_SET(SCL_VERT_FILTER_CONTROL, 0, +- SCL_V_2TAP_HARDCODE_COEF_EN, 0); ++ REG_WRITE(SCL_VERT_FILTER_CONTROL, 0); + program_multi_taps_filter( + xfm_dce, + data->taps.v_taps, +@@ -542,8 +541,7 @@ static void dce60_transform_set_scaler( + + /* 5. Program horizontal filters */ + if (xfm_dce->filter_h == NULL) +- REG_SET(SCL_HORZ_FILTER_CONTROL, 0, +- SCL_H_2TAP_HARDCODE_COEF_EN, 0); ++ REG_WRITE(SCL_HORZ_FILTER_CONTROL, 0); + program_multi_taps_filter( + xfm_dce, + data->taps.h_taps, +-- +2.51.0 + diff --git a/queue-6.17/drm-amd-display-properly-disable-scaling-on-dce6.patch b/queue-6.17/drm-amd-display-properly-disable-scaling-on-dce6.patch new file mode 100644 index 0000000000..4469efbaaa --- /dev/null +++ b/queue-6.17/drm-amd-display-properly-disable-scaling-on-dce6.patch @@ -0,0 +1,101 @@ +From 7e8b1d6fb4ebc3883c4a4c525ffb0159528590c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:24 +0200 +Subject: drm/amd/display: Properly disable scaling on DCE6 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit a7dc87f3448bea5ebe054f14e861074b9c289c65 ] + +SCL_SCALER_ENABLE can be used to enable/disable the scaler +on DCE6. Program it to 0 when scaling isn't used, 1 when used. +Additionally, clear some other registers when scaling is +disabled and program the SCL_UPDATE register as recommended. + +This fixes visible glitches for users whose BIOS sets up a +mode with scaling at boot, which DC was unable to clean up. + +Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/dce/dce_transform.c | 15 +++++++++++---- + .../gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++ + 2 files changed, 13 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +index e5c2fb134d14d..1ab5ae9b5ea51 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +@@ -154,10 +154,13 @@ static bool dce60_setup_scaling_configuration( + REG_SET(SCL_BYPASS_CONTROL, 0, SCL_BYPASS_MODE, 0); + + if (data->taps.h_taps + data->taps.v_taps <= 2) { +- /* Set bypass */ +- +- /* DCE6 has no SCL_MODE register, skip scale mode programming */ ++ /* Disable scaler functionality */ ++ REG_WRITE(SCL_SCALER_ENABLE, 0); + ++ /* Clear registers that can cause glitches even when the scaler is off */ ++ REG_WRITE(SCL_TAP_CONTROL, 0); ++ REG_WRITE(SCL_AUTOMATIC_MODE_CONTROL, 0); ++ REG_WRITE(SCL_F_SHARP_CONTROL, 0); + return false; + } + +@@ -165,7 +168,7 @@ static bool dce60_setup_scaling_configuration( + SCL_H_NUM_OF_TAPS, data->taps.h_taps - 1, + SCL_V_NUM_OF_TAPS, data->taps.v_taps - 1); + +- /* DCE6 has no SCL_MODE register, skip scale mode programming */ ++ REG_WRITE(SCL_SCALER_ENABLE, 1); + + /* DCE6 has no SCL_BOUNDARY_MODE bit, skip replace out of bound pixels */ + +@@ -502,6 +505,8 @@ static void dce60_transform_set_scaler( + REG_SET(DC_LB_MEM_SIZE, 0, + DC_LB_MEM_SIZE, xfm_dce->lb_memory_size); + ++ REG_WRITE(SCL_UPDATE, 0x00010000); ++ + /* Clear SCL_F_SHARP_CONTROL value to 0 */ + REG_WRITE(SCL_F_SHARP_CONTROL, 0); + +@@ -564,6 +569,8 @@ static void dce60_transform_set_scaler( + /* DCE6 has no SCL_COEF_UPDATE_COMPLETE bit to flip to new coefficient memory */ + + /* DCE6 DATA_FORMAT register does not support ALPHA_EN */ ++ ++ REG_WRITE(SCL_UPDATE, 0); + } + #endif + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +index ff746fba850bc..eb716e8337e23 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +@@ -155,6 +155,7 @@ + SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \ + SRI(VIEWPORT_START, SCL, id), \ + SRI(VIEWPORT_SIZE, SCL, id), \ ++ SRI(SCL_SCALER_ENABLE, SCL, id), \ + SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \ + SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \ + SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \ +@@ -592,6 +593,7 @@ struct dce_transform_registers { + uint32_t SCL_VERT_FILTER_SCALE_RATIO; + uint32_t SCL_HORZ_FILTER_INIT; + #if defined(CONFIG_DRM_AMD_DC_SI) ++ uint32_t SCL_SCALER_ENABLE; + uint32_t SCL_HORZ_FILTER_INIT_RGB_LUMA; + uint32_t SCL_HORZ_FILTER_INIT_CHROMA; + #endif +-- +2.51.0 + diff --git a/queue-6.17/drm-amdgpu-add-additional-dce6-scl-registers.patch b/queue-6.17/drm-amdgpu-add-additional-dce6-scl-registers.patch new file mode 100644 index 0000000000..577e49a8b5 --- /dev/null +++ b/queue-6.17/drm-amdgpu-add-additional-dce6-scl-registers.patch @@ -0,0 +1,93 @@ +From 56e960d2d06b9a35ce86b0dcbfeede5cd469d7a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:21 +0200 +Subject: drm/amdgpu: Add additional DCE6 SCL registers + +From: Alex Deucher + +[ Upstream commit 507296328b36ffd00ec1f4fde5b8acafb7222ec7 ] + +Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)") +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h | 7 +++++++ + drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h | 2 ++ + 2 files changed, 9 insertions(+) + +diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h +index 9de01ae574c03..067eddd9c62d8 100644 +--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h ++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h +@@ -4115,6 +4115,7 @@ + #define mmSCL0_SCL_COEF_RAM_CONFLICT_STATUS 0x1B55 + #define mmSCL0_SCL_COEF_RAM_SELECT 0x1B40 + #define mmSCL0_SCL_COEF_RAM_TAP_DATA 0x1B41 ++#define mmSCL0_SCL_SCALER_ENABLE 0x1B42 + #define mmSCL0_SCL_CONTROL 0x1B44 + #define mmSCL0_SCL_DEBUG 0x1B6A + #define mmSCL0_SCL_DEBUG2 0x1B69 +@@ -4144,6 +4145,7 @@ + #define mmSCL1_SCL_COEF_RAM_CONFLICT_STATUS 0x1E55 + #define mmSCL1_SCL_COEF_RAM_SELECT 0x1E40 + #define mmSCL1_SCL_COEF_RAM_TAP_DATA 0x1E41 ++#define mmSCL1_SCL_SCALER_ENABLE 0x1E42 + #define mmSCL1_SCL_CONTROL 0x1E44 + #define mmSCL1_SCL_DEBUG 0x1E6A + #define mmSCL1_SCL_DEBUG2 0x1E69 +@@ -4173,6 +4175,7 @@ + #define mmSCL2_SCL_COEF_RAM_CONFLICT_STATUS 0x4155 + #define mmSCL2_SCL_COEF_RAM_SELECT 0x4140 + #define mmSCL2_SCL_COEF_RAM_TAP_DATA 0x4141 ++#define mmSCL2_SCL_SCALER_ENABLE 0x4142 + #define mmSCL2_SCL_CONTROL 0x4144 + #define mmSCL2_SCL_DEBUG 0x416A + #define mmSCL2_SCL_DEBUG2 0x4169 +@@ -4202,6 +4205,7 @@ + #define mmSCL3_SCL_COEF_RAM_CONFLICT_STATUS 0x4455 + #define mmSCL3_SCL_COEF_RAM_SELECT 0x4440 + #define mmSCL3_SCL_COEF_RAM_TAP_DATA 0x4441 ++#define mmSCL3_SCL_SCALER_ENABLE 0x4442 + #define mmSCL3_SCL_CONTROL 0x4444 + #define mmSCL3_SCL_DEBUG 0x446A + #define mmSCL3_SCL_DEBUG2 0x4469 +@@ -4231,6 +4235,7 @@ + #define mmSCL4_SCL_COEF_RAM_CONFLICT_STATUS 0x4755 + #define mmSCL4_SCL_COEF_RAM_SELECT 0x4740 + #define mmSCL4_SCL_COEF_RAM_TAP_DATA 0x4741 ++#define mmSCL4_SCL_SCALER_ENABLE 0x4742 + #define mmSCL4_SCL_CONTROL 0x4744 + #define mmSCL4_SCL_DEBUG 0x476A + #define mmSCL4_SCL_DEBUG2 0x4769 +@@ -4260,6 +4265,7 @@ + #define mmSCL5_SCL_COEF_RAM_CONFLICT_STATUS 0x4A55 + #define mmSCL5_SCL_COEF_RAM_SELECT 0x4A40 + #define mmSCL5_SCL_COEF_RAM_TAP_DATA 0x4A41 ++#define mmSCL5_SCL_SCALER_ENABLE 0x4A42 + #define mmSCL5_SCL_CONTROL 0x4A44 + #define mmSCL5_SCL_DEBUG 0x4A6A + #define mmSCL5_SCL_DEBUG2 0x4A69 +@@ -4287,6 +4293,7 @@ + #define mmSCL_COEF_RAM_CONFLICT_STATUS 0x1B55 + #define mmSCL_COEF_RAM_SELECT 0x1B40 + #define mmSCL_COEF_RAM_TAP_DATA 0x1B41 ++#define mmSCL_SCALER_ENABLE 0x1B42 + #define mmSCL_CONTROL 0x1B44 + #define mmSCL_DEBUG 0x1B6A + #define mmSCL_DEBUG2 0x1B69 +diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h +index 2d6a598a6c25c..9317a7afa6211 100644 +--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h ++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h +@@ -8650,6 +8650,8 @@ + #define REGAMMA_LUT_INDEX__REGAMMA_LUT_INDEX__SHIFT 0x00000000 + #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK_MASK 0x00000007L + #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK__SHIFT 0x00000000 ++#define SCL_SCALER_ENABLE__SCL_SCALE_EN_MASK 0x00000001L ++#define SCL_SCALER_ENABLE__SCL_SCALE_EN__SHIFT 0x00000000 + #define SCL_ALU_CONTROL__SCL_ALU_DISABLE_MASK 0x00000001L + #define SCL_ALU_CONTROL__SCL_ALU_DISABLE__SHIFT 0x00000000 + #define SCL_BYPASS_CONTROL__SCL_BYPASS_MODE_MASK 0x00000003L +-- +2.51.0 + diff --git a/queue-6.17/drm-amdkfd-fix-kfd-process-ref-leaking-when-userptr-.patch b/queue-6.17/drm-amdkfd-fix-kfd-process-ref-leaking-when-userptr-.patch new file mode 100644 index 0000000000..a2fe26bb86 --- /dev/null +++ b/queue-6.17/drm-amdkfd-fix-kfd-process-ref-leaking-when-userptr-.patch @@ -0,0 +1,52 @@ +From 7d58d04da7ddc318cc5790573d6e7328e4ca168d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 May 2025 11:09:53 -0400 +Subject: drm/amdkfd: Fix kfd process ref leaking when userptr unmapping + +From: Philip Yang + +[ Upstream commit 58e6fc2fb94f0f409447e5d46cf6a417b6397fbc ] + +kfd_lookup_process_by_pid hold the kfd process reference to ensure it +doesn't get destroyed while sending the segfault event to user space. + +Calling kfd_lookup_process_by_pid as function parameter leaks the kfd +process refcount and miss the NULL pointer check if app process is +already destroyed. + +Fixes: 2d274bf7099b ("amd/amdkfd: Trigger segfault for early userptr unmmapping") +Signed-off-by: Philip Yang +Reviewed-by: Harish Kasiviswanathan +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +index b16cce7c22c37..d5f9d48bf8842 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +@@ -2583,12 +2583,17 @@ static int update_invalid_user_pages(struct amdkfd_process_info *process_info, + * from the KFD, trigger a segmentation fault in VM debug mode. + */ + if (amdgpu_ttm_adev(bo->tbo.bdev)->debug_vm_userptr) { ++ struct kfd_process *p; ++ + pr_err("Pid %d unmapped memory before destroying userptr at GPU addr 0x%llx\n", + pid_nr(process_info->pid), mem->va); + + // Send GPU VM fault to user space +- kfd_signal_vm_fault_event_with_userptr(kfd_lookup_process_by_pid(process_info->pid), +- mem->va); ++ p = kfd_lookup_process_by_pid(process_info->pid); ++ if (p) { ++ kfd_signal_vm_fault_event_with_userptr(p, mem->va); ++ kfd_unref_process(p); ++ } + } + + ret = 0; +-- +2.51.0 + diff --git a/queue-6.17/drm-vmwgfx-fix-a-null-ptr-access-in-the-cursor-snoop.patch b/queue-6.17/drm-vmwgfx-fix-a-null-ptr-access-in-the-cursor-snoop.patch new file mode 100644 index 0000000000..19adb63ef5 --- /dev/null +++ b/queue-6.17/drm-vmwgfx-fix-a-null-ptr-access-in-the-cursor-snoop.patch @@ -0,0 +1,79 @@ +From 4cd98cd1a8b2112d700a747427033b93c2c97a42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 11:36:55 -0400 +Subject: drm/vmwgfx: Fix a null-ptr access in the cursor snooper + +From: Zack Rusin + +[ Upstream commit 5ac2c0279053a2c5265d46903432fb26ae2d0da2 ] + +Check that the resource which is converted to a surface exists before +trying to use the cursor snooper on it. + +vmw_cmd_res_check allows explicit invalid (SVGA3D_INVALID_ID) identifiers +because some svga commands accept SVGA3D_INVALID_ID to mean "no surface", +unfortunately functions that accept the actual surfaces as objects might +(and in case of the cursor snooper, do not) be able to handle null +objects. Make sure that we validate not only the identifier (via the +vmw_cmd_res_check) but also check that the actual resource exists before +trying to do something with it. + +Fixes unchecked null-ptr reference in the snooping code. + +Signed-off-by: Zack Rusin +Fixes: c0951b797e7d ("drm/vmwgfx: Refactor resource management") +Reported-by: Kuzey Arda Bulut +Cc: Broadcom internal kernel review list +Cc: dri-devel@lists.freedesktop.org +Reviewed-by: Ian Forbes +Link: https://lore.kernel.org/r/20250917153655.1968583-1-zack.rusin@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +index 819704ac675d0..d539f25b5fbe0 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +@@ -1497,6 +1497,7 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, + SVGA3dCmdHeader *header) + { + struct vmw_bo *vmw_bo = NULL; ++ struct vmw_resource *res; + struct vmw_surface *srf = NULL; + VMW_DECLARE_CMD_VAR(*cmd, SVGA3dCmdSurfaceDMA); + int ret; +@@ -1532,18 +1533,24 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, + + dirty = (cmd->body.transfer == SVGA3D_WRITE_HOST_VRAM) ? + VMW_RES_DIRTY_SET : 0; +- ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, +- dirty, user_surface_converter, +- &cmd->body.host.sid, NULL); ++ ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, dirty, ++ user_surface_converter, &cmd->body.host.sid, ++ NULL); + if (unlikely(ret != 0)) { + if (unlikely(ret != -ERESTARTSYS)) + VMW_DEBUG_USER("could not find surface for DMA.\n"); + return ret; + } + +- srf = vmw_res_to_srf(sw_context->res_cache[vmw_res_surface].res); ++ res = sw_context->res_cache[vmw_res_surface].res; ++ if (!res) { ++ VMW_DEBUG_USER("Invalid DMA surface.\n"); ++ return -EINVAL; ++ } + +- vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo, header); ++ srf = vmw_res_to_srf(res); ++ vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo, ++ header); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.17/drm-vmwgfx-fix-copy-paste-typo-in-validation.patch b/queue-6.17/drm-vmwgfx-fix-copy-paste-typo-in-validation.patch new file mode 100644 index 0000000000..341b5aa8b2 --- /dev/null +++ b/queue-6.17/drm-vmwgfx-fix-copy-paste-typo-in-validation.patch @@ -0,0 +1,37 @@ +From ad52928021ca6735e3b7ca7641020e681aa68644 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 14:54:26 -0500 +Subject: drm/vmwgfx: Fix copy-paste typo in validation + +From: Ian Forbes + +[ Upstream commit 228c5d44dffe8c293cd2d2f0e7ea45e64565b1c4 ] + +'entry' should be 'val' which is the loop iterator. + +Fixes: 9e931f2e0970 ("drm/vmwgfx: Refactor resource validation hashtable to use linux/hashtable implementation.") +Signed-off-by: Ian Forbes +Reviewed-by: Zack Rusin +Signed-off-by: Zack Rusin +Link: https://lore.kernel.org/r/20250926195427.1405237-2-ian.forbes@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +index 4d0fb71f62111..35dc94c3db399 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +@@ -638,7 +638,7 @@ void vmw_validation_drop_ht(struct vmw_validation_context *ctx) + hash_del_rcu(&val->hash.head); + + list_for_each_entry(val, &ctx->resource_ctx_list, head) +- hash_del_rcu(&entry->hash.head); ++ hash_del_rcu(&val->hash.head); + + ctx->sw_context = NULL; + } +-- +2.51.0 + diff --git a/queue-6.17/drm-vmwgfx-fix-use-after-free-in-validation.patch b/queue-6.17/drm-vmwgfx-fix-use-after-free-in-validation.patch new file mode 100644 index 0000000000..c161313f9a --- /dev/null +++ b/queue-6.17/drm-vmwgfx-fix-use-after-free-in-validation.patch @@ -0,0 +1,44 @@ +From ac6dbf199fcc704fcd89edd6f6105c52ec0dc4e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 14:54:25 -0500 +Subject: drm/vmwgfx: Fix Use-after-free in validation + +From: Ian Forbes + +[ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ] + +Nodes stored in the validation duplicates hashtable come from an arena +allocator that is cleared at the end of vmw_execbuf_process. All nodes +are expected to be cleared in vmw_validation_drop_ht but this node escaped +because its resource was destroyed prematurely. + +Fixes: 64ad2abfe9a6 ("drm/vmwgfx: Adapt validation code for reference-free lookups") +Reported-by: Kuzey Arda Bulut +Signed-off-by: Ian Forbes +Reviewed-by: Zack Rusin +Signed-off-by: Zack Rusin +Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +index 7ee93e7191c7f..4d0fb71f62111 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +@@ -308,8 +308,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx, + hash_add_rcu(ctx->sw_context->res_ht, &node->hash.head, node->hash.key); + } + node->res = vmw_resource_reference_unless_doomed(res); +- if (!node->res) ++ if (!node->res) { ++ hash_del_rcu(&node->hash.head); + return -ESRCH; ++ } + + node->first_usage = 1; + if (!res->dev_priv->has_mob) { +-- +2.51.0 + diff --git a/queue-6.17/drm-xe-hw_engine_group-fix-double-write-lock-release.patch b/queue-6.17/drm-xe-hw_engine_group-fix-double-write-lock-release.patch new file mode 100644 index 0000000000..5a7a198118 --- /dev/null +++ b/queue-6.17/drm-xe-hw_engine_group-fix-double-write-lock-release.patch @@ -0,0 +1,59 @@ +From 054bf9b681bb31b8be512113a2a760e2ed3b7cdc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 02:31:46 +0000 +Subject: drm/xe/hw_engine_group: Fix double write lock release in error path + +From: Shuicheng Lin + +[ Upstream commit 08fdfd260e641da203f80aff8d3ed19c5ecceb7d ] + +In xe_hw_engine_group_get_mode(), a write lock is acquired before +calling switch_mode(), which in turn invokes +xe_hw_engine_group_suspend_faulting_lr_jobs(). + +On failure inside xe_hw_engine_group_suspend_faulting_lr_jobs(), +the write lock is released there, and then again in +xe_hw_engine_group_get_mode(), leading to a double release. + +Fix this by keeping both acquire and release operation in +xe_hw_engine_group_get_mode(). + +Fixes: 770bd1d34113 ("drm/xe/hw_engine_group: Ensure safe transition between execution modes") +Cc: Francois Dugast +Signed-off-by: Shuicheng Lin +Reviewed-by: Francois Dugast +Link: https://lore.kernel.org/r/20250925023145.1203004-2-shuicheng.lin@intel.com +Signed-off-by: Lucas De Marchi +(cherry picked from commit 662d98b8b373007fa1b08ba93fee11f6fd3e387c) +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_hw_engine_group.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_hw_engine_group.c b/drivers/gpu/drm/xe/xe_hw_engine_group.c +index c926f840c87b0..cb1d7ed54f429 100644 +--- a/drivers/gpu/drm/xe/xe_hw_engine_group.c ++++ b/drivers/gpu/drm/xe/xe_hw_engine_group.c +@@ -213,17 +213,13 @@ static int xe_hw_engine_group_suspend_faulting_lr_jobs(struct xe_hw_engine_group + + err = q->ops->suspend_wait(q); + if (err) +- goto err_suspend; ++ return err; + } + + if (need_resume) + xe_hw_engine_group_resume_faulting_lr_jobs(group); + + return 0; +- +-err_suspend: +- up_write(&group->mode_sem); +- return err; + } + + /** +-- +2.51.0 + diff --git a/queue-6.17/drm-xe-i2c-don-t-rely-on-d3cold.allowed-flag-in-syst.patch b/queue-6.17/drm-xe-i2c-don-t-rely-on-d3cold.allowed-flag-in-syst.patch new file mode 100644 index 0000000000..e988ae1ac9 --- /dev/null +++ b/queue-6.17/drm-xe-i2c-don-t-rely-on-d3cold.allowed-flag-in-syst.patch @@ -0,0 +1,43 @@ +From 6e2f90583e2942763437c86619e26e33360a773e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 16:02:00 +0530 +Subject: drm/xe/i2c: Don't rely on d3cold.allowed flag in system PM path + +From: Raag Jadav + +[ Upstream commit 1af59cd5cc2b65d7fc95165f056695ce3f171133 ] + +In S3 and above sleep states, the device can loose power regardless of +d3cold.allowed flag. Bring up I2C controller explicitly in system PM +path to ensure its normal operation after losing power. + +v2: Cover S3 and above states (Rodrigo) + +Fixes: 0ea07b69517a ("drm/xe/pm: Wire up suspend/resume for I2C controller") +Signed-off-by: Raag Jadav +Reviewed-by: Rodrigo Vivi +Link: https://lore.kernel.org/r/20250918103200.2952576-1-raag.jadav@intel.com +Signed-off-by: Rodrigo Vivi +(cherry picked from commit e4863f1159befcd70df24fcb5458afaf2feab043) +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_pm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/xe/xe_pm.c b/drivers/gpu/drm/xe/xe_pm.c +index bb9b6ecad2afc..3e301e42b2f19 100644 +--- a/drivers/gpu/drm/xe/xe_pm.c ++++ b/drivers/gpu/drm/xe/xe_pm.c +@@ -194,7 +194,7 @@ int xe_pm_resume(struct xe_device *xe) + if (err) + goto err; + +- xe_i2c_pm_resume(xe, xe->d3cold.allowed); ++ xe_i2c_pm_resume(xe, true); + + xe_irq_resume(xe); + +-- +2.51.0 + diff --git a/queue-6.17/gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch b/queue-6.17/gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch new file mode 100644 index 0000000000..a7989a643b --- /dev/null +++ b/queue-6.17/gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch @@ -0,0 +1,37 @@ +From e84e4a1ee31c8f623b5d7cd463ea4fccb7eeae8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 16:51:29 +0200 +Subject: gpio: wcd934x: mark the GPIO controller as sleeping + +From: Bartosz Golaszewski + +[ Upstream commit b5f8aa8d4bde0cf3e4595af5a536da337e5f1c78 ] + +The slimbus regmap passed to the GPIO driver down from MFD does not use +fast_io. This means a mutex is used for locking and thus this GPIO chip +must not be used in atomic context. Change the can_sleep switch in +struct gpio_chip to true. + +Fixes: 59c324683400 ("gpio: wcd934x: Add support to wcd934x gpio controller") +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-wcd934x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-wcd934x.c b/drivers/gpio/gpio-wcd934x.c +index 4af504c23e6ff..572b85e773700 100644 +--- a/drivers/gpio/gpio-wcd934x.c ++++ b/drivers/gpio/gpio-wcd934x.c +@@ -103,7 +103,7 @@ static int wcd_gpio_probe(struct platform_device *pdev) + chip->base = -1; + chip->ngpio = WCD934X_NPINS; + chip->label = dev_name(dev); +- chip->can_sleep = false; ++ chip->can_sleep = true; + + return devm_gpiochip_add_data(dev, chip, data); + } +-- +2.51.0 + diff --git a/queue-6.17/ice-ice_adapter-release-xa-entry-on-adapter-allocati.patch b/queue-6.17/ice-ice_adapter-release-xa-entry-on-adapter-allocati.patch new file mode 100644 index 0000000000..8973f68774 --- /dev/null +++ b/queue-6.17/ice-ice_adapter-release-xa-entry-on-adapter-allocati.patch @@ -0,0 +1,66 @@ +From 564dcdee53dbdf9030a67d57343fd834049bab72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 19:53:36 +0800 +Subject: ice: ice_adapter: release xa entry on adapter allocation failure + +From: Haotian Zhang + +[ Upstream commit 2db687f3469dbc5c59bc53d55acafd75d530b497 ] + +When ice_adapter_new() fails, the reserved XArray entry created by +xa_insert() is not released. This causes subsequent insertions at +the same index to return -EBUSY, potentially leading to +NULL pointer dereferences. + +Reorder the operations as suggested by Przemek Kitszel: +1. Check if adapter already exists (xa_load) +2. Reserve the XArray slot (xa_reserve) +3. Allocate the adapter (ice_adapter_new) +4. Store the adapter (xa_store) + +Fixes: 0f0023c649c7 ("ice: do not init struct ice_adapter more times than needed") +Suggested-by: Przemek Kitszel +Suggested-by: Jacob Keller +Signed-off-by: Haotian Zhang +Reviewed-by: Aleksandr Loktionov +Reviewed-by: Jacob Keller +Link: https://patch.msgid.link/20251001115336.1707-1-vulab@iscas.ac.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_adapter.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_adapter.c b/drivers/net/ethernet/intel/ice/ice_adapter.c +index b53561c347082..0a8a48cd4bce6 100644 +--- a/drivers/net/ethernet/intel/ice/ice_adapter.c ++++ b/drivers/net/ethernet/intel/ice/ice_adapter.c +@@ -99,19 +99,21 @@ struct ice_adapter *ice_adapter_get(struct pci_dev *pdev) + + index = ice_adapter_xa_index(pdev); + scoped_guard(mutex, &ice_adapters_mutex) { +- err = xa_insert(&ice_adapters, index, NULL, GFP_KERNEL); +- if (err == -EBUSY) { +- adapter = xa_load(&ice_adapters, index); ++ adapter = xa_load(&ice_adapters, index); ++ if (adapter) { + refcount_inc(&adapter->refcount); + WARN_ON_ONCE(adapter->index != ice_adapter_index(pdev)); + return adapter; + } ++ err = xa_reserve(&ice_adapters, index, GFP_KERNEL); + if (err) + return ERR_PTR(err); + + adapter = ice_adapter_new(pdev); +- if (!adapter) ++ if (!adapter) { ++ xa_release(&ice_adapters, index); + return ERR_PTR(-ENOMEM); ++ } + xa_store(&ice_adapters, index, adapter, GFP_KERNEL); + } + return adapter; +-- +2.51.0 + diff --git a/queue-6.17/io_uring-zcrx-increment-fallback-loop-src-offset.patch b/queue-6.17/io_uring-zcrx-increment-fallback-loop-src-offset.patch new file mode 100644 index 0000000000..4910fdf63d --- /dev/null +++ b/queue-6.17/io_uring-zcrx-increment-fallback-loop-src-offset.patch @@ -0,0 +1,36 @@ +From 62d754661cdc4ef253ebb9fbc16547a80feb2548 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 13:39:01 +0100 +Subject: io_uring/zcrx: increment fallback loop src offset + +From: Pavel Begunkov + +[ Upstream commit e9a9dcb4ccb32446165800a9d83058e95c4833d2 ] + +Don't forget to adjust the source offset in io_copy_page(), otherwise +it'll be copying into the same location in some cases for highmem +setups. + +Fixes: e67645bb7f3f4 ("io_uring/zcrx: prepare fallback for larger pages") +Signed-off-by: Pavel Begunkov +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/zcrx.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c +index 643a69f9ffe2a..2035c77a16357 100644 +--- a/io_uring/zcrx.c ++++ b/io_uring/zcrx.c +@@ -993,6 +993,7 @@ static ssize_t io_copy_page(struct io_copy_cache *cc, struct page *src_page, + + cc->size -= n; + cc->offset += n; ++ src_offset += n; + len -= n; + copied += n; + } +-- +2.51.0 + diff --git a/queue-6.17/kbuild-add-.rel.-strip-pattern-for-vmlinux.patch b/queue-6.17/kbuild-add-.rel.-strip-pattern-for-vmlinux.patch new file mode 100644 index 0000000000..fc1c14db10 --- /dev/null +++ b/queue-6.17/kbuild-add-.rel.-strip-pattern-for-vmlinux.patch @@ -0,0 +1,58 @@ +From 9287f74ff43ddaf256608b0daf12d8b67eaed1f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 15:46:45 -0700 +Subject: kbuild: Add '.rel.*' strip pattern for vmlinux + +From: Nathan Chancellor + +[ Upstream commit 8ec3af916fe3954381cf3555ea03dc5adf4d0e8e ] + +Prior to binutils commit c12d9fa2afe ("Support objcopy +--remove-section=.relaFOO") [1] in 2.32, stripping relocation sections +required the trailing period (i.e., '.rel.*') to work properly. + +After commit 3e86e4d74c04 ("kbuild: keep .modinfo section in +vmlinux.unstripped"), there is an error with binutils 2.31.1 or earlier +because these sections are not properly removed: + + s390-linux-objcopy: st6tO8Ev: symbol `.modinfo' required but not present + s390-linux-objcopy:st6tO8Ev: no symbols + +Add the old pattern to resolve this issue (along with a comment to allow +cleaning this when binutils 2.32 or newer is the minimum supported +version). While the aforementioned kbuild change exposes this, the +pattern was originally changed by commit 71d815bf5dfd ("kbuild: Strip +runtime const RELA sections correctly"), where it would still be +incorrect with binutils older than 2.32. + +Fixes: 71d815bf5dfd ("kbuild: Strip runtime const RELA sections correctly") +Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=c12d9fa2afe7abcbe407a00e15719e1a1350c2a7 [1] +Reported-by: Linux Kernel Functional Testing +Closes: https://lore.kernel.org/CA+G9fYvVktRhFtZXdNgVOL8j+ArsJDpvMLgCitaQvQmCx=hwOQ@mail.gmail.com/ +Acked-by: Ard Biesheuvel +Acked-by: Alexey Gladkov +Acked-by: Nicolas Schier +Link: https://patch.msgid.link/20251008-kbuild-fix-modinfo-regressions-v1-2-9fc776c5887c@kernel.org +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + scripts/Makefile.vmlinux | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/scripts/Makefile.vmlinux b/scripts/Makefile.vmlinux +index 7c6f0e882eabb..ffc7b49e54f70 100644 +--- a/scripts/Makefile.vmlinux ++++ b/scripts/Makefile.vmlinux +@@ -88,6 +88,9 @@ endif + + remove-section-y := .modinfo + remove-section-$(CONFIG_ARCH_VMLINUX_NEEDS_RELOCS) += '.rel*' '!.rel*.dyn' ++# for compatibility with binutils < 2.32 ++# https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=c12d9fa2afe7abcbe407a00e15719e1a1350c2a7 ++remove-section-$(CONFIG_ARCH_VMLINUX_NEEDS_RELOCS) += '.rel.*' + + # To avoid warnings: "empty loadable segment detected at ..." from GNU objcopy, + # it is necessary to remove the PT_LOAD flag from the segment. +-- +2.51.0 + diff --git a/queue-6.17/kbuild-always-create-intermediate-vmlinux.unstripped.patch b/queue-6.17/kbuild-always-create-intermediate-vmlinux.unstripped.patch new file mode 100644 index 0000000000..7c26d01661 --- /dev/null +++ b/queue-6.17/kbuild-always-create-intermediate-vmlinux.unstripped.patch @@ -0,0 +1,124 @@ +From 076a271cc7720fc06395bc43dadc3247efc8e42d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 10:05:46 +0200 +Subject: kbuild: always create intermediate vmlinux.unstripped + +From: Masahiro Yamada + +[ Upstream commit 0ce5139fd96e9d415d3faaef1c575e238f9bbd67 ] + +Generate the intermediate vmlinux.unstripped regardless of +CONFIG_ARCH_VMLINUX_NEEDS_RELOCS. + +If CONFIG_ARCH_VMLINUX_NEEDS_RELOCS is unset, vmlinux.unstripped and +vmlinux are identiacal. + +This simplifies the build rule, and allows to strip more sections +by adding them to remove-section-y. + +Signed-off-by: Masahiro Yamada +Reviewed-by: Nicolas Schier +Link: https://patch.msgid.link/a48ca543fa2305bd17324f41606dcaed9b19f2d4.1758182101.git.legion@kernel.org +Signed-off-by: Nathan Chancellor +Stable-dep-of: 8ec3af916fe3 ("kbuild: Add '.rel.*' strip pattern for vmlinux") +Signed-off-by: Sasha Levin +--- + scripts/Makefile.vmlinux | 45 ++++++++++++++++++++-------------------- + 1 file changed, 22 insertions(+), 23 deletions(-) + +diff --git a/scripts/Makefile.vmlinux b/scripts/Makefile.vmlinux +index b64862dc6f08d..4f2d4c3fb7372 100644 +--- a/scripts/Makefile.vmlinux ++++ b/scripts/Makefile.vmlinux +@@ -9,20 +9,6 @@ include $(srctree)/scripts/Makefile.lib + + targets := + +-ifdef CONFIG_ARCH_VMLINUX_NEEDS_RELOCS +-vmlinux-final := vmlinux.unstripped +- +-quiet_cmd_strip_relocs = RSTRIP $@ +- cmd_strip_relocs = $(OBJCOPY) --remove-section='.rel*' --remove-section=!'.rel*.dyn' $< $@ +- +-vmlinux: $(vmlinux-final) FORCE +- $(call if_changed,strip_relocs) +- +-targets += vmlinux +-else +-vmlinux-final := vmlinux +-endif +- + %.o: %.c FORCE + $(call if_changed_rule,cc_o_c) + +@@ -61,19 +47,19 @@ targets += .builtin-dtbs-list + + ifdef CONFIG_GENERIC_BUILTIN_DTB + targets += .builtin-dtbs.S .builtin-dtbs.o +-$(vmlinux-final): .builtin-dtbs.o ++vmlinux.unstripped: .builtin-dtbs.o + endif + +-# vmlinux ++# vmlinux.unstripped + # --------------------------------------------------------------------------- + + ifdef CONFIG_MODULES + targets += .vmlinux.export.o +-$(vmlinux-final): .vmlinux.export.o ++vmlinux.unstripped: .vmlinux.export.o + endif + + ifdef CONFIG_ARCH_WANTS_PRE_LINK_VMLINUX +-$(vmlinux-final): arch/$(SRCARCH)/tools/vmlinux.arch.o ++vmlinux.unstripped: arch/$(SRCARCH)/tools/vmlinux.arch.o + + arch/$(SRCARCH)/tools/vmlinux.arch.o: vmlinux.o FORCE + $(Q)$(MAKE) $(build)=arch/$(SRCARCH)/tools $@ +@@ -86,17 +72,30 @@ cmd_link_vmlinux = \ + $< "$(LD)" "$(KBUILD_LDFLAGS)" "$(LDFLAGS_vmlinux)" "$@"; \ + $(if $(ARCH_POSTLINK), $(MAKE) -f $(ARCH_POSTLINK) $@, true) + +-targets += $(vmlinux-final) +-$(vmlinux-final): scripts/link-vmlinux.sh vmlinux.o $(KBUILD_LDS) FORCE ++targets += vmlinux.unstripped ++vmlinux.unstripped: scripts/link-vmlinux.sh vmlinux.o $(KBUILD_LDS) FORCE + +$(call if_changed_dep,link_vmlinux) + ifdef CONFIG_DEBUG_INFO_BTF +-$(vmlinux-final): $(RESOLVE_BTFIDS) ++vmlinux.unstripped: $(RESOLVE_BTFIDS) + endif + + ifdef CONFIG_BUILDTIME_TABLE_SORT +-$(vmlinux-final): scripts/sorttable ++vmlinux.unstripped: scripts/sorttable + endif + ++# vmlinux ++# --------------------------------------------------------------------------- ++ ++remove-section-y := ++remove-section-$(CONFIG_ARCH_VMLINUX_NEEDS_RELOCS) += '.rel*' ++ ++quiet_cmd_strip_relocs = OBJCOPY $@ ++ cmd_strip_relocs = $(OBJCOPY) $(addprefix --remove-section=,$(remove-section-y)) $< $@ ++ ++targets += vmlinux ++vmlinux: vmlinux.unstripped FORCE ++ $(call if_changed,strip_relocs) ++ + # modules.builtin.ranges + # --------------------------------------------------------------------------- + ifdef CONFIG_BUILTIN_MODULE_RANGES +@@ -110,7 +109,7 @@ modules.builtin.ranges: $(srctree)/scripts/generate_builtin_ranges.awk \ + modules.builtin vmlinux.map vmlinux.o.map FORCE + $(call if_changed,modules_builtin_ranges) + +-vmlinux.map: $(vmlinux-final) ++vmlinux.map: vmlinux.unstripped + @: + + endif +-- +2.51.0 + diff --git a/queue-6.17/kbuild-keep-.modinfo-section-in-vmlinux.unstripped.patch b/queue-6.17/kbuild-keep-.modinfo-section-in-vmlinux.unstripped.patch new file mode 100644 index 0000000000..b33fba7707 --- /dev/null +++ b/queue-6.17/kbuild-keep-.modinfo-section-in-vmlinux.unstripped.patch @@ -0,0 +1,88 @@ +From deba498e21a8346d3e7c73f769d65c34227b226d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 10:05:47 +0200 +Subject: kbuild: keep .modinfo section in vmlinux.unstripped + +From: Masahiro Yamada + +[ Upstream commit 3e86e4d74c0490e5fc5a7f8de8f29e7579c9ffe5 ] + +Keep the .modinfo section during linking, but strip it from the final +vmlinux. + +Adjust scripts/mksysmap to exclude modinfo symbols from kallsyms. + +This change will allow the next commit to extract the .modinfo section +from the vmlinux.unstripped intermediate. + +Signed-off-by: Masahiro Yamada +Signed-off-by: Alexey Gladkov +Reviewed-by: Nicolas Schier +Link: https://patch.msgid.link/aaf67c07447215463300fccaa758904bac42f992.1758182101.git.legion@kernel.org +Signed-off-by: Nathan Chancellor +Stable-dep-of: 8ec3af916fe3 ("kbuild: Add '.rel.*' strip pattern for vmlinux") +Signed-off-by: Sasha Levin +--- + include/asm-generic/vmlinux.lds.h | 2 +- + scripts/Makefile.vmlinux | 7 +++++-- + scripts/mksysmap | 3 +++ + 3 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h +index 8efbe8c4874ee..d61a02fce7274 100644 +--- a/include/asm-generic/vmlinux.lds.h ++++ b/include/asm-generic/vmlinux.lds.h +@@ -832,6 +832,7 @@ defined(CONFIG_AUTOFDO_CLANG) || defined(CONFIG_PROPELLER_CLANG) + + /* Required sections not related to debugging. */ + #define ELF_DETAILS \ ++ .modinfo : { *(.modinfo) } \ + .comment 0 : { *(.comment) } \ + .symtab 0 : { *(.symtab) } \ + .strtab 0 : { *(.strtab) } \ +@@ -1045,7 +1046,6 @@ defined(CONFIG_AUTOFDO_CLANG) || defined(CONFIG_PROPELLER_CLANG) + *(.discard.*) \ + *(.export_symbol) \ + *(.no_trim_symbol) \ +- *(.modinfo) \ + /* ld.bfd warns about .gnu.version* even when not emitted */ \ + *(.gnu.version*) \ + +diff --git a/scripts/Makefile.vmlinux b/scripts/Makefile.vmlinux +index 4f2d4c3fb7372..70856dab0f541 100644 +--- a/scripts/Makefile.vmlinux ++++ b/scripts/Makefile.vmlinux +@@ -86,11 +86,14 @@ endif + # vmlinux + # --------------------------------------------------------------------------- + +-remove-section-y := ++remove-section-y := .modinfo + remove-section-$(CONFIG_ARCH_VMLINUX_NEEDS_RELOCS) += '.rel*' + ++# To avoid warnings: "empty loadable segment detected at ..." from GNU objcopy, ++# it is necessary to remove the PT_LOAD flag from the segment. + quiet_cmd_strip_relocs = OBJCOPY $@ +- cmd_strip_relocs = $(OBJCOPY) $(addprefix --remove-section=,$(remove-section-y)) $< $@ ++ cmd_strip_relocs = $(OBJCOPY) $(patsubst %,--set-section-flags %=noload,$(remove-section-y)) $< $@; \ ++ $(OBJCOPY) $(addprefix --remove-section=,$(remove-section-y)) $@ + + targets += vmlinux + vmlinux: vmlinux.unstripped FORCE +diff --git a/scripts/mksysmap b/scripts/mksysmap +index 3accbdb269ac7..a607a0059d119 100755 +--- a/scripts/mksysmap ++++ b/scripts/mksysmap +@@ -79,6 +79,9 @@ + / _SDA_BASE_$/d + / _SDA2_BASE_$/d + ++# MODULE_INFO() ++/ __UNIQUE_ID_modinfo[0-9]*$/d ++ + # --------------------------------------------------------------------------- + # Ignored patterns + # (symbols that contain the pattern are ignored) +-- +2.51.0 + diff --git a/queue-6.17/kbuild-restore-pattern-to-avoid-stripping-.rela.dyn-.patch b/queue-6.17/kbuild-restore-pattern-to-avoid-stripping-.rela.dyn-.patch new file mode 100644 index 0000000000..fa2a0b7274 --- /dev/null +++ b/queue-6.17/kbuild-restore-pattern-to-avoid-stripping-.rela.dyn-.patch @@ -0,0 +1,43 @@ +From 7b86ee5a6c97601167ceb47111a90a5130a3cd19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 15:46:44 -0700 +Subject: kbuild: Restore pattern to avoid stripping .rela.dyn from vmlinux + +From: Nathan Chancellor + +[ Upstream commit 4b47a3aefb29c523ca66f0d28de8db15a10f9352 ] + +Commit 0ce5139fd96e ("kbuild: always create intermediate +vmlinux.unstripped") removed the pattern to avoid stripping .rela.dyn +sections added by commit e9d86b8e17e7 ("scripts: Do not strip .rela.dyn +section"). Restore it so that .rela.dyn sections remain in the final +vmlinux. + +Fixes: 0ce5139fd96e ("kbuild: always create intermediate vmlinux.unstripped") +Acked-by: Ard Biesheuvel +Acked-by: Alexey Gladkov +Acked-by: Nicolas Schier +Link: https://patch.msgid.link/20251008-kbuild-fix-modinfo-regressions-v1-1-9fc776c5887c@kernel.org +Signed-off-by: Nathan Chancellor +Stable-dep-of: 8ec3af916fe3 ("kbuild: Add '.rel.*' strip pattern for vmlinux") +Signed-off-by: Sasha Levin +--- + scripts/Makefile.vmlinux | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/Makefile.vmlinux b/scripts/Makefile.vmlinux +index 70856dab0f541..7c6f0e882eabb 100644 +--- a/scripts/Makefile.vmlinux ++++ b/scripts/Makefile.vmlinux +@@ -87,7 +87,7 @@ endif + # --------------------------------------------------------------------------- + + remove-section-y := .modinfo +-remove-section-$(CONFIG_ARCH_VMLINUX_NEEDS_RELOCS) += '.rel*' ++remove-section-$(CONFIG_ARCH_VMLINUX_NEEDS_RELOCS) += '.rel*' '!.rel*.dyn' + + # To avoid warnings: "empty loadable segment detected at ..." from GNU objcopy, + # it is necessary to remove the PT_LOAD flag from the segment. +-- +2.51.0 + diff --git a/queue-6.17/libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch b/queue-6.17/libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch new file mode 100644 index 0000000000..7fc18a6120 --- /dev/null +++ b/queue-6.17/libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch @@ -0,0 +1,59 @@ +From 40b1b25a94e89833854bb01e5f89075dc1bbe2ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:19 -0700 +Subject: libperf event: Ensure tracing data is multiple of 8 sized + +From: Ian Rogers + +[ Upstream commit b39c915a4f365cce6bdc0e538ed95d31823aea8f ] + +Perf's synthetic-events.c will ensure 8-byte alignment of tracing +data, writing it after a perf_record_header_tracing_data event. + +Add padding to struct perf_record_header_tracing_data to make it 16-byte +rather than 12-byte sized. + +Fixes: 055c67ed39887c55 ("perf tools: Move event synthesizing routines to separate .c file") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Acked-by: Namhyung Kim +Tested-by: Arnaldo Carvalho de Melo +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Blake Jones +Cc: Chun-Tse Shao +Cc: Collin Funk +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jan Polensky +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Li Huafei +Cc: Mark Rutland +Cc: Nam Cao +Cc: Peter Zijlstra +Cc: Steinar H. Gunderson +Cc: Thomas Gleixner +Link: https://lore.kernel.org/r/20250821163820.1132977-6-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/perf/include/perf/event.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/lib/perf/include/perf/event.h b/tools/lib/perf/include/perf/event.h +index 6608f1e3701b4..aa1e91c97a226 100644 +--- a/tools/lib/perf/include/perf/event.h ++++ b/tools/lib/perf/include/perf/event.h +@@ -291,6 +291,7 @@ struct perf_record_header_event_type { + struct perf_record_header_tracing_data { + struct perf_event_header header; + __u32 size; ++ __u32 pad; + }; + + #define PERF_RECORD_MISC_BUILD_ID_SIZE (1 << 15) +-- +2.51.0 + diff --git a/queue-6.17/loongarch-add-cflag-fno-isolate-erroneous-paths-dere.patch b/queue-6.17/loongarch-add-cflag-fno-isolate-erroneous-paths-dere.patch new file mode 100644 index 0000000000..0d2a293cd5 --- /dev/null +++ b/queue-6.17/loongarch-add-cflag-fno-isolate-erroneous-paths-dere.patch @@ -0,0 +1,59 @@ +From f51f27f5584973fad3e1a1b621ce909d8fed38da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 22:38:57 +0800 +Subject: LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference + +From: Tiezhu Yang + +[ Upstream commit abb2a5572264b425e6dd9c213b735a82ab0ca68a ] + +Currently, when compiling with GCC, there is no "break 7" instruction +for zero division due to using the option -mno-check-zero-division, but +the compiler still generates "break 0" instruction for zero division. + +Here is a simple example: + + $ cat test.c + int div(int a) + { + return a / 0; + } + $ gcc -O2 -S test.c -o test.s + +GCC generates "break 0" on LoongArch and "ud2" on x86, objtool decodes +"ud2" as INSN_BUG for x86, so decode "break 0" as INSN_BUG can fix the +objtool warnings for LoongArch, but this is not the intention. + +When decoding "break 0" as INSN_TRAP in the previous commit, the aim is +to handle "break 0" as a trap. The generated "break 0" for zero division +by GCC is not proper, it should generate a break instruction with proper +bug type, so add the GCC option -fno-isolate-erroneous-paths-dereference +to avoid generating the unexpected "break 0" instruction for now. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/r/202509200413.7uihAxJ5-lkp@intel.com/ +Fixes: baad7830ee9a ("objtool/LoongArch: Mark types based on break immediate code") +Suggested-by: WANG Rui +Signed-off-by: Tiezhu Yang +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/loongarch/Makefile b/arch/loongarch/Makefile +index ae419e32f22e2..f2a585b4a9375 100644 +--- a/arch/loongarch/Makefile ++++ b/arch/loongarch/Makefile +@@ -129,7 +129,7 @@ KBUILD_RUSTFLAGS_KERNEL += -Crelocation-model=pie + LDFLAGS_vmlinux += -static -pie --no-dynamic-linker -z notext $(call ld-option, --apply-dynamic-relocs) + endif + +-cflags-y += $(call cc-option, -mno-check-zero-division) ++cflags-y += $(call cc-option, -mno-check-zero-division -fno-isolate-erroneous-paths-dereference) + + ifndef CONFIG_KASAN + cflags-y += -fno-builtin-memcpy -fno-builtin-memmove -fno-builtin-memset +-- +2.51.0 + diff --git a/queue-6.17/loongarch-fix-build-error-for-lto-with-llvm-18.patch b/queue-6.17/loongarch-fix-build-error-for-lto-with-llvm-18.patch new file mode 100644 index 0000000000..e79b70957a --- /dev/null +++ b/queue-6.17/loongarch-fix-build-error-for-lto-with-llvm-18.patch @@ -0,0 +1,46 @@ +From d9f4b12a8ffef167b61817697c369dee7bc3ed7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 22:38:57 +0800 +Subject: LoongArch: Fix build error for LTO with LLVM-18 + +From: Huacai Chen + +[ Upstream commit 19baac378a5f4c34e61007023cfcb605cc64c76d ] + +Commit b15212824a01 ("LoongArch: Make LTO case independent in Makefile") +moves "KBUILD_LDFLAGS += -mllvm --loongarch-annotate-tablejump" out of +CONFIG_CC_HAS_ANNOTATE_TABLEJUMP, which breaks the build for LLVM-18, as +'--loongarch-annotate-tablejump' is unimplemented there: + +ld.lld: error: -mllvm: ld.lld: Unknown command line argument '--loongarch-annotate-tablejump'. + +Call ld-option to detect '--loongarch-annotate-tablejump' before use, so +as to fix the build error. + +Fixes: b15212824a01 ("LoongArch: Make LTO case independent in Makefile") +Reported-by: Nathan Chancellor +Reviewed-by: Nathan Chancellor +Tested-by: Nathan Chancellor # build +Suggested-by: WANG Rui +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/loongarch/Makefile b/arch/loongarch/Makefile +index f2a585b4a9375..dc5bd3f1b8d2c 100644 +--- a/arch/loongarch/Makefile ++++ b/arch/loongarch/Makefile +@@ -115,7 +115,7 @@ ifdef CONFIG_LTO_CLANG + # The annotate-tablejump option can not be passed to LLVM backend when LTO is enabled. + # Ensure it is aware of linker with LTO, '--loongarch-annotate-tablejump' also needs to + # be passed via '-mllvm' to ld.lld. +-KBUILD_LDFLAGS += -mllvm --loongarch-annotate-tablejump ++KBUILD_LDFLAGS += $(call ld-option,-mllvm --loongarch-annotate-tablejump) + endif + endif + +-- +2.51.0 + diff --git a/queue-6.17/loongarch-init-acpi_gbl_use_global_lock-to-false.patch b/queue-6.17/loongarch-init-acpi_gbl_use_global_lock-to-false.patch new file mode 100644 index 0000000000..e88348ce95 --- /dev/null +++ b/queue-6.17/loongarch-init-acpi_gbl_use_global_lock-to-false.patch @@ -0,0 +1,37 @@ +From f66117b1b68bd8d082280f422878ee9c4942dac8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 22:38:57 +0800 +Subject: LoongArch: Init acpi_gbl_use_global_lock to false + +From: Huacai Chen + +[ Upstream commit 98662be7ef20d2b88b598f72e7ce9b6ac26a40f9 ] + +Init acpi_gbl_use_global_lock to false, in order to void error messages +during boot phase: + + ACPI Error: Could not enable GlobalLock event (20240827/evxfevnt-182) + ACPI Error: No response from Global Lock hardware, disabling lock (20240827/evglock-59) + +Fixes: 628c3bb40e9a8cefc0a6 ("LoongArch: Add boot and setup routines") +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/kernel/setup.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c +index 075b79b2c1d39..69c17d162fff3 100644 +--- a/arch/loongarch/kernel/setup.c ++++ b/arch/loongarch/kernel/setup.c +@@ -355,6 +355,7 @@ void __init platform_init(void) + + #ifdef CONFIG_ACPI + acpi_table_upgrade(); ++ acpi_gbl_use_global_lock = false; + acpi_gbl_use_default_register_widths = false; + acpi_boot_table_init(); + #endif +-- +2.51.0 + diff --git a/queue-6.17/mailbox-mtk-cmdq-remove-pm_runtime-apis-from-cmdq_mb.patch b/queue-6.17/mailbox-mtk-cmdq-remove-pm_runtime-apis-from-cmdq_mb.patch new file mode 100644 index 0000000000..be8c696ba5 --- /dev/null +++ b/queue-6.17/mailbox-mtk-cmdq-remove-pm_runtime-apis-from-cmdq_mb.patch @@ -0,0 +1,96 @@ +From 9ddff9bd5e9c7b734c091747c2cfeaf31976168b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 17:15:58 +0800 +Subject: mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() + +From: Jason-JH Lin + +[ Upstream commit 3f39f56520374cf56872644acf9afcc618a4b674 ] + +pm_runtime_get_sync() and pm_runtime_put_autosuspend() were previously +called in cmdq_mbox_send_data(), which is under a spinlock in msg_submit() +(mailbox.c). This caused lockdep warnings such as "sleeping function +called from invalid context" when running with lockdebug enabled. + +The BUG report: + BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1164 + in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 3616, name: kworker/u17:3 + preempt_count: 1, expected: 0 + RCU nest depth: 0, expected: 0 + INFO: lockdep is turned off. + irq event stamp: 0 + CPU: 1 PID: 3616 Comm: kworker/u17:3 Not tainted 6.1.87-lockdep-14133-g26e933aca785 #1 + Hardware name: Google Ciri sku0/unprovisioned board (DT) + Workqueue: imgsys_runner imgsys_runner_func + Call trace: + dump_backtrace+0x100/0x120 + show_stack+0x20/0x2c + dump_stack_lvl+0x84/0xb4 + dump_stack+0x18/0x48 + __might_resched+0x354/0x4c0 + __might_sleep+0x98/0xe4 + __pm_runtime_resume+0x70/0x124 + cmdq_mbox_send_data+0xe4/0xb1c + msg_submit+0x194/0x2dc + mbox_send_message+0x190/0x330 + imgsys_cmdq_sendtask+0x1618/0x2224 + imgsys_runner_func+0xac/0x11c + process_one_work+0x638/0xf84 + worker_thread+0x808/0xcd0 + kthread+0x24c/0x324 + ret_from_fork+0x10/0x20 + +Additionally, pm_runtime_put_autosuspend() should be invoked from the +GCE IRQ handler to ensure the hardware has actually completed its work. + +To resolve these issues, remove the pm_runtime calls from +cmdq_mbox_send_data() and delegate power management responsibilities +to the client driver. + +Fixes: 8afe816b0c99 ("mailbox: mtk-cmdq-mailbox: Implement Runtime PM with autosuspend") +Signed-off-by: Jason-JH Lin +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/mtk-cmdq-mailbox.c | 12 +----------- + 1 file changed, 1 insertion(+), 11 deletions(-) + +diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c +index 532929916e998..654a60f63756a 100644 +--- a/drivers/mailbox/mtk-cmdq-mailbox.c ++++ b/drivers/mailbox/mtk-cmdq-mailbox.c +@@ -379,20 +379,13 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data) + struct cmdq *cmdq = dev_get_drvdata(chan->mbox->dev); + struct cmdq_task *task; + unsigned long curr_pa, end_pa; +- int ret; + + /* Client should not flush new tasks if suspended. */ + WARN_ON(cmdq->suspended); + +- ret = pm_runtime_get_sync(cmdq->mbox.dev); +- if (ret < 0) +- return ret; +- + task = kzalloc(sizeof(*task), GFP_ATOMIC); +- if (!task) { +- pm_runtime_put_autosuspend(cmdq->mbox.dev); ++ if (!task) + return -ENOMEM; +- } + + task->cmdq = cmdq; + INIT_LIST_HEAD(&task->list_entry); +@@ -439,9 +432,6 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data) + } + list_move_tail(&task->list_entry, &thread->task_busy_list); + +- pm_runtime_mark_last_busy(cmdq->mbox.dev); +- pm_runtime_put_autosuspend(cmdq->mbox.dev); +- + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.17/mailbox-zynqmp-ipi-fix-out-of-bounds-access-in-mailb.patch b/queue-6.17/mailbox-zynqmp-ipi-fix-out-of-bounds-access-in-mailb.patch new file mode 100644 index 0000000000..8bf715e330 --- /dev/null +++ b/queue-6.17/mailbox-zynqmp-ipi-fix-out-of-bounds-access-in-mailb.patch @@ -0,0 +1,39 @@ +From f0da672f7345445f5f548875d6773b6a998c4490 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 13:07:22 +0530 +Subject: mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop + +From: Harini T + +[ Upstream commit 0aead8197fc1a85b0a89646e418feb49a564b029 ] + +The cleanup loop was starting at the wrong array index, causing +out-of-bounds access. +Start the loop at the correct index for zero-indexed arrays to prevent +accessing memory beyond the allocated array bounds. + +Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") +Signed-off-by: Harini T +Reviewed-by: Peng Fan +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/zynqmp-ipi-mailbox.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c +index bdcc6937ee309..dddbef6b2cb8f 100644 +--- a/drivers/mailbox/zynqmp-ipi-mailbox.c ++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c +@@ -890,7 +890,7 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) + if (pdata->irq < MAX_SGI) + xlnx_mbox_cleanup_sgi(pdata); + +- i = pdata->num_mboxes; ++ i = pdata->num_mboxes - 1; + for (; i >= 0; i--) { + ipi_mbox = &pdata->ipi_mboxes[i]; + if (device_is_registered(&ipi_mbox->dev)) +-- +2.51.0 + diff --git a/queue-6.17/mailbox-zynqmp-ipi-fix-sgi-cleanup-on-unbind.patch b/queue-6.17/mailbox-zynqmp-ipi-fix-sgi-cleanup-on-unbind.patch new file mode 100644 index 0000000000..32c250327f --- /dev/null +++ b/queue-6.17/mailbox-zynqmp-ipi-fix-sgi-cleanup-on-unbind.patch @@ -0,0 +1,87 @@ +From 616f7f736b5e82a7d659dcf1323be157b745472c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 13:07:23 +0530 +Subject: mailbox: zynqmp-ipi: Fix SGI cleanup on unbind + +From: Harini T + +[ Upstream commit bb160e791ab15b89188a7a19589b8e11f681bef3 ] + +The driver incorrectly determines SGI vs SPI interrupts by checking IRQ +number < 16, which fails with dynamic IRQ allocation. During unbind, +this causes improper SGI cleanup leading to kernel crash. + +Add explicit irq_type field to pdata for reliable identification of SGI +interrupts (type-2) and only clean up SGI resources when appropriate. + +Fixes: 6ffb1635341b ("mailbox: zynqmp: handle SGI for shared IPI") +Signed-off-by: Harini T +Reviewed-by: Peng Fan +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/zynqmp-ipi-mailbox.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c +index dddbef6b2cb8f..967967b2b8a96 100644 +--- a/drivers/mailbox/zynqmp-ipi-mailbox.c ++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c +@@ -62,7 +62,8 @@ + #define DST_BIT_POS 9U + #define SRC_BITMASK GENMASK(11, 8) + +-#define MAX_SGI 16 ++/* Macro to represent SGI type for IPI IRQs */ ++#define IPI_IRQ_TYPE_SGI 2 + + /* + * Module parameters +@@ -121,6 +122,7 @@ struct zynqmp_ipi_mbox { + * @dev: device pointer corresponding to the Xilinx ZynqMP + * IPI agent + * @irq: IPI agent interrupt ID ++ * @irq_type: IPI SGI or SPI IRQ type + * @method: IPI SMC or HVC is going to be used + * @local_id: local IPI agent ID + * @virq_sgi: IRQ number mapped to SGI +@@ -130,6 +132,7 @@ struct zynqmp_ipi_mbox { + struct zynqmp_ipi_pdata { + struct device *dev; + int irq; ++ unsigned int irq_type; + unsigned int method; + u32 local_id; + int virq_sgi; +@@ -887,7 +890,7 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) + struct zynqmp_ipi_mbox *ipi_mbox; + int i; + +- if (pdata->irq < MAX_SGI) ++ if (pdata->irq_type == IPI_IRQ_TYPE_SGI) + xlnx_mbox_cleanup_sgi(pdata); + + i = pdata->num_mboxes - 1; +@@ -956,14 +959,16 @@ static int zynqmp_ipi_probe(struct platform_device *pdev) + dev_err(dev, "failed to parse interrupts\n"); + goto free_mbox_dev; + } +- ret = out_irq.args[1]; ++ ++ /* Use interrupt type to distinguish SGI and SPI interrupts */ ++ pdata->irq_type = out_irq.args[0]; + + /* + * If Interrupt number is in SGI range, then request SGI else request + * IPI system IRQ. + */ +- if (ret < MAX_SGI) { +- pdata->irq = ret; ++ if (pdata->irq_type == IPI_IRQ_TYPE_SGI) { ++ pdata->irq = out_irq.args[1]; + ret = xlnx_mbox_init_sgi(pdev, pdata->irq, pdata); + if (ret) + goto free_mbox_dev; +-- +2.51.0 + diff --git a/queue-6.17/mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch b/queue-6.17/mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch new file mode 100644 index 0000000000..5537e3dcc9 --- /dev/null +++ b/queue-6.17/mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch @@ -0,0 +1,48 @@ +From f8de28d5d1068edff4c99fabd8c3408c793fe796 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 13:07:21 +0530 +Subject: mailbox: zynqmp-ipi: Remove dev.parent check in + zynqmp_ipi_free_mboxes + +From: Harini T + +[ Upstream commit 019e3f4550fc7d319a7fd03eff487255f8e8aecd ] + +The ipi_mbox->dev.parent check is unreliable proxy for registration +status as it fails to protect against probe failures that occur after +the parent is assigned but before device_register() completes. + +device_is_registered() is the canonical and robust method to verify the +registration status. + +Remove ipi_mbox->dev.parent check in zynqmp_ipi_free_mboxes(). + +Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") +Signed-off-by: Harini T +Reviewed-by: Peng Fan +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/zynqmp-ipi-mailbox.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c +index 263a3413a8c7f..bdcc6937ee309 100644 +--- a/drivers/mailbox/zynqmp-ipi-mailbox.c ++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c +@@ -893,10 +893,8 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) + i = pdata->num_mboxes; + for (; i >= 0; i--) { + ipi_mbox = &pdata->ipi_mboxes[i]; +- if (ipi_mbox->dev.parent) { +- if (device_is_registered(&ipi_mbox->dev)) +- device_unregister(&ipi_mbox->dev); +- } ++ if (device_is_registered(&ipi_mbox->dev)) ++ device_unregister(&ipi_mbox->dev); + } + } + +-- +2.51.0 + diff --git a/queue-6.17/mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch b/queue-6.17/mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch new file mode 100644 index 0000000000..1d28689ab9 --- /dev/null +++ b/queue-6.17/mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch @@ -0,0 +1,43 @@ +From 3f80c36bc124ca09ee1b8baeb5fc24f54995058c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 13:07:20 +0530 +Subject: mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() + call + +From: Harini T + +[ Upstream commit 341867f730d3d3bb54491ee64e8b1a0c446656e7 ] + +The controller is registered using the device-managed function +'devm_mbox_controller_register()'. As documented in mailbox.c, this +ensures the devres framework automatically calls +mbox_controller_unregister() when device_unregister() is invoked, making +the explicit call unnecessary. + +Remove redundant mbox_controller_unregister() call as +device_unregister() handles controller cleanup. + +Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") +Signed-off-by: Harini T +Reviewed-by: Peng Fan +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/zynqmp-ipi-mailbox.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c +index 0c143beaafda6..263a3413a8c7f 100644 +--- a/drivers/mailbox/zynqmp-ipi-mailbox.c ++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c +@@ -894,7 +894,6 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) + for (; i >= 0; i--) { + ipi_mbox = &pdata->ipi_mboxes[i]; + if (ipi_mbox->dev.parent) { +- mbox_controller_unregister(&ipi_mbox->mbox); + if (device_is_registered(&ipi_mbox->dev)) + device_unregister(&ipi_mbox->dev); + } +-- +2.51.0 + diff --git a/queue-6.17/mshv-handle-need_resched_lazy-before-transferring-to.patch b/queue-6.17/mshv-handle-need_resched_lazy-before-transferring-to.patch new file mode 100644 index 0000000000..bda95cb7a9 --- /dev/null +++ b/queue-6.17/mshv-handle-need_resched_lazy-before-transferring-to.patch @@ -0,0 +1,61 @@ +From bb8083a0632c6fbb3eec58e1fe84726c5e68cd95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 17:01:50 -0700 +Subject: mshv: Handle NEED_RESCHED_LAZY before transferring to guest + +From: Sean Christopherson + +[ Upstream commit 0ebac01a00be972020c002a7fe0bb6b6fca8410f ] + +Check for NEED_RESCHED_LAZY, not just NEED_RESCHED, prior to transferring +control to a guest. Failure to check for lazy resched can unnecessarily +delay rescheduling until the next tick when using a lazy preemption model. + +Note, ideally both the checking and processing of TIF bits would be handled +in common code, to avoid having to keep three separate paths synchronized, +but defer such cleanups to the future to keep the fix as standalone as +possible. + +Cc: Nuno Das Neves +Cc: Mukesh R +Fixes: 621191d709b1 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") +Signed-off-by: Sean Christopherson +Tested-by: Nuno Das Neves +Reviewed-by: Nuno Das Neves +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/hv/mshv_common.c | 2 +- + drivers/hv/mshv_root_main.c | 3 ++- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/hv/mshv_common.c b/drivers/hv/mshv_common.c +index 6f227a8a5af71..eb3df3e296bbe 100644 +--- a/drivers/hv/mshv_common.c ++++ b/drivers/hv/mshv_common.c +@@ -151,7 +151,7 @@ int mshv_do_pre_guest_mode_work(ulong th_flags) + if (th_flags & (_TIF_SIGPENDING | _TIF_NOTIFY_SIGNAL)) + return -EINTR; + +- if (th_flags & _TIF_NEED_RESCHED) ++ if (th_flags & (_TIF_NEED_RESCHED | _TIF_NEED_RESCHED_LAZY)) + schedule(); + + if (th_flags & _TIF_NOTIFY_RESUME) +diff --git a/drivers/hv/mshv_root_main.c b/drivers/hv/mshv_root_main.c +index 72df774e410ab..cad09ff5f94dc 100644 +--- a/drivers/hv/mshv_root_main.c ++++ b/drivers/hv/mshv_root_main.c +@@ -490,7 +490,8 @@ mshv_vp_wait_for_hv_kick(struct mshv_vp *vp) + static int mshv_pre_guest_mode_work(struct mshv_vp *vp) + { + const ulong work_flags = _TIF_NOTIFY_SIGNAL | _TIF_SIGPENDING | +- _TIF_NEED_RESCHED | _TIF_NOTIFY_RESUME; ++ _TIF_NEED_RESCHED | _TIF_NEED_RESCHED_LAZY | ++ _TIF_NOTIFY_RESUME; + ulong th_flags; + + th_flags = read_thread_flags(); +-- +2.51.0 + diff --git a/queue-6.17/net-airoha-fix-loopback-mode-configuration-for-gdm2-.patch b/queue-6.17/net-airoha-fix-loopback-mode-configuration-for-gdm2-.patch new file mode 100644 index 0000000000..f29d491cf4 --- /dev/null +++ b/queue-6.17/net-airoha-fix-loopback-mode-configuration-for-gdm2-.patch @@ -0,0 +1,55 @@ +From a92137dffc94760f0ae4bb19210b31aff1e1916c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 11:27:43 +0200 +Subject: net: airoha: Fix loopback mode configuration for GDM2 port + +From: Lorenzo Bianconi + +[ Upstream commit fea8cdf6738a8b25fccbb7b109b440795a0892cb ] + +Add missing configuration for loopback mode in airhoha_set_gdm2_loopback +routine. + +Fixes: 9cd451d414f6e ("net: airoha: Add loopback support for GDM2") +Signed-off-by: Lorenzo Bianconi +Reviewed-by: Jacob Keller +Link: https://patch.msgid.link/20251008-airoha-loopback-mode-fix-v2-1-045694fe7f60@kernel.org +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/airoha/airoha_eth.c | 4 +++- + drivers/net/ethernet/airoha/airoha_regs.h | 3 +++ + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/airoha/airoha_eth.c b/drivers/net/ethernet/airoha/airoha_eth.c +index e6b802e3d8449..6d23c5c049b9a 100644 +--- a/drivers/net/ethernet/airoha/airoha_eth.c ++++ b/drivers/net/ethernet/airoha/airoha_eth.c +@@ -1709,7 +1709,9 @@ static void airhoha_set_gdm2_loopback(struct airoha_gdm_port *port) + airoha_fe_wr(eth, REG_GDM_RXCHN_EN(2), 0xffff); + airoha_fe_rmw(eth, REG_GDM_LPBK_CFG(2), + LPBK_CHAN_MASK | LPBK_MODE_MASK | LPBK_EN_MASK, +- FIELD_PREP(LPBK_CHAN_MASK, chan) | LPBK_EN_MASK); ++ FIELD_PREP(LPBK_CHAN_MASK, chan) | ++ LBK_GAP_MODE_MASK | LBK_LEN_MODE_MASK | ++ LBK_CHAN_MODE_MASK | LPBK_EN_MASK); + airoha_fe_rmw(eth, REG_GDM_LEN_CFG(2), + GDM_SHORT_LEN_MASK | GDM_LONG_LEN_MASK, + FIELD_PREP(GDM_SHORT_LEN_MASK, 60) | +diff --git a/drivers/net/ethernet/airoha/airoha_regs.h b/drivers/net/ethernet/airoha/airoha_regs.h +index 150c85995cc1a..0c8f61081699c 100644 +--- a/drivers/net/ethernet/airoha/airoha_regs.h ++++ b/drivers/net/ethernet/airoha/airoha_regs.h +@@ -151,6 +151,9 @@ + #define LPBK_LEN_MASK GENMASK(23, 10) + #define LPBK_CHAN_MASK GENMASK(8, 4) + #define LPBK_MODE_MASK GENMASK(3, 1) ++#define LBK_GAP_MODE_MASK BIT(3) ++#define LBK_LEN_MODE_MASK BIT(2) ++#define LBK_CHAN_MODE_MASK BIT(1) + #define LPBK_EN_MASK BIT(0) + + #define REG_GDM_TXCHN_EN(_n) (GDM_BASE(_n) + 0x24) +-- +2.51.0 + diff --git a/queue-6.17/net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch b/queue-6.17/net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch new file mode 100644 index 0000000000..fdd6095e8e --- /dev/null +++ b/queue-6.17/net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch @@ -0,0 +1,41 @@ +From 464450de7f9d7d0ed0e0b3880fb106fc30fcb922 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 20:46:17 +0300 +Subject: net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe + +From: Erick Karanja + +[ Upstream commit 521405cb54cd2812bbb6dedd5afc14bca1e7e98a ] + +Add missing of_node_put call to release device node tbi obtained +via for_each_child_of_node. + +Fixes: afae5ad78b342 ("net/fsl_pq_mdio: streamline probing of MDIO nodes") +Signed-off-by: Erick Karanja +Link: https://patch.msgid.link/20251002174617.960521-1-karanja99erick@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c +index 577f9b1780ad6..de88776dd2a20 100644 +--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c ++++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c +@@ -479,10 +479,12 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev) + "missing 'reg' property in node %pOF\n", + tbi); + err = -EBUSY; ++ of_node_put(tbi); + goto error; + } + set_tbipa(*prop, pdev, + data->get_tbipa, priv->map, &res); ++ of_node_put(tbi); + } + } + +-- +2.51.0 + diff --git a/queue-6.17/net-mdio-mdio-i2c-hold-the-i2c-bus-lock-during-smbus.patch b/queue-6.17/net-mdio-mdio-i2c-hold-the-i2c-bus-lock-during-smbus.patch new file mode 100644 index 0000000000..e5317dcfec --- /dev/null +++ b/queue-6.17/net-mdio-mdio-i2c-hold-the-i2c-bus-lock-during-smbus.patch @@ -0,0 +1,112 @@ +From ba986dd6e8cd2deda5859117044f8436a5e6775c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 09:03:06 +0200 +Subject: net: mdio: mdio-i2c: Hold the i2c bus lock during smbus transactions + +From: Maxime Chevallier + +[ Upstream commit 4dc8b26a3ac2cb79f19f252d9077696d3ef0823a ] + +When accessing an MDIO register using single-byte smbus accesses, we have to +perform 2 consecutive operations targeting the same address, +first accessing the MSB then the LSB of the 16 bit register: + + read_1_byte(addr); <- returns MSB of register at address 'addr' + read_1_byte(addr); <- returns LSB + +Some PHY devices present in SFP such as the Broadcom 5461 don't like +seeing foreign i2c transactions in-between these 2 smbus accesses, and +will return the MSB a second time when trying to read the LSB : + + read_1_byte(addr); <- returns MSB + + i2c_transaction_for_other_device_on_the_bus(); + + read_1_byte(addr); <- returns MSB again + +Given the already fragile nature of accessing PHYs/SFPs with single-byte +smbus accesses, it's safe to say that this Broadcom PHY may not be the +only one acting like this. + +Let's therefore hold the i2c bus lock while performing our smbus +transactions to avoid interleaved accesses. + +Fixes: d4bd3aca33c2 ("net: mdio: mdio-i2c: Add support for single-byte SMBus operations") +Signed-off-by: Maxime Chevallier +Reviewed-by: Kory Maincent +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20251003070311.861135-1-maxime.chevallier@bootlin.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/mdio/mdio-i2c.c | 39 ++++++++++++++++++++++++------------- + 1 file changed, 25 insertions(+), 14 deletions(-) + +diff --git a/drivers/net/mdio/mdio-i2c.c b/drivers/net/mdio/mdio-i2c.c +index 53e96bfab5422..ed20352a589a3 100644 +--- a/drivers/net/mdio/mdio-i2c.c ++++ b/drivers/net/mdio/mdio-i2c.c +@@ -116,17 +116,23 @@ static int smbus_byte_mii_read_default_c22(struct mii_bus *bus, int phy_id, + if (!i2c_mii_valid_phy_id(phy_id)) + return 0; + +- ret = i2c_smbus_xfer(i2c, i2c_mii_phy_addr(phy_id), 0, +- I2C_SMBUS_READ, reg, +- I2C_SMBUS_BYTE_DATA, &smbus_data); ++ i2c_lock_bus(i2c, I2C_LOCK_SEGMENT); ++ ++ ret = __i2c_smbus_xfer(i2c, i2c_mii_phy_addr(phy_id), 0, ++ I2C_SMBUS_READ, reg, ++ I2C_SMBUS_BYTE_DATA, &smbus_data); + if (ret < 0) +- return ret; ++ goto unlock; + + val = (smbus_data.byte & 0xff) << 8; + +- ret = i2c_smbus_xfer(i2c, i2c_mii_phy_addr(phy_id), 0, +- I2C_SMBUS_READ, reg, +- I2C_SMBUS_BYTE_DATA, &smbus_data); ++ ret = __i2c_smbus_xfer(i2c, i2c_mii_phy_addr(phy_id), 0, ++ I2C_SMBUS_READ, reg, ++ I2C_SMBUS_BYTE_DATA, &smbus_data); ++ ++unlock: ++ i2c_unlock_bus(i2c, I2C_LOCK_SEGMENT); ++ + if (ret < 0) + return ret; + +@@ -147,17 +153,22 @@ static int smbus_byte_mii_write_default_c22(struct mii_bus *bus, int phy_id, + + smbus_data.byte = (val & 0xff00) >> 8; + +- ret = i2c_smbus_xfer(i2c, i2c_mii_phy_addr(phy_id), 0, +- I2C_SMBUS_WRITE, reg, +- I2C_SMBUS_BYTE_DATA, &smbus_data); ++ i2c_lock_bus(i2c, I2C_LOCK_SEGMENT); ++ ++ ret = __i2c_smbus_xfer(i2c, i2c_mii_phy_addr(phy_id), 0, ++ I2C_SMBUS_WRITE, reg, ++ I2C_SMBUS_BYTE_DATA, &smbus_data); + if (ret < 0) +- return ret; ++ goto unlock; + + smbus_data.byte = val & 0xff; + +- ret = i2c_smbus_xfer(i2c, i2c_mii_phy_addr(phy_id), 0, +- I2C_SMBUS_WRITE, reg, +- I2C_SMBUS_BYTE_DATA, &smbus_data); ++ ret = __i2c_smbus_xfer(i2c, i2c_mii_phy_addr(phy_id), 0, ++ I2C_SMBUS_WRITE, reg, ++ I2C_SMBUS_BYTE_DATA, &smbus_data); ++ ++unlock: ++ i2c_unlock_bus(i2c, I2C_LOCK_SEGMENT); + + return ret < 0 ? ret : 0; + } +-- +2.51.0 + diff --git a/queue-6.17/net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch b/queue-6.17/net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch new file mode 100644 index 0000000000..95d3575848 --- /dev/null +++ b/queue-6.17/net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch @@ -0,0 +1,41 @@ +From 60c4b6e57dfbf84af492a73e56e970f139d76e15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 15:25:01 +0300 +Subject: net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() + +From: Dan Carpenter + +[ Upstream commit 4f0d91ba72811fd5dd577bcdccd7fed649aae62c ] + +Print "entry->mac" before freeing "entry". The "entry" pointer is +freed with kfree_rcu() so it's unlikely that we would trigger this +in real life, but it's safer to re-order it. + +Fixes: cc5387f7346a ("net/mlx4_en: Add unicast MAC filtering") +Signed-off-by: Dan Carpenter +Reviewed-by: Tariq Toukan +Link: https://patch.msgid.link/aNvMHX4g8RksFFvV@stanley.mountain +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +index d2071aff7b8f3..308b4458e0d44 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +@@ -1180,9 +1180,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv, + mlx4_unregister_mac(mdev->dev, priv->port, mac); + + hlist_del_rcu(&entry->hlist); +- kfree_rcu(entry, rcu); + en_dbg(DRV, priv, "Removed MAC %pM on port:%d\n", + entry->mac, priv->port); ++ kfree_rcu(entry, rcu); + ++removed; + } + } +-- +2.51.0 + diff --git a/queue-6.17/net-mlx5-prevent-tunnel-mode-conflicts-between-fdb-a.patch b/queue-6.17/net-mlx5-prevent-tunnel-mode-conflicts-between-fdb-a.patch new file mode 100644 index 0000000000..5a7528494c --- /dev/null +++ b/queue-6.17/net-mlx5-prevent-tunnel-mode-conflicts-between-fdb-a.patch @@ -0,0 +1,134 @@ +From 52d873182640d8448ca9e6978c098c0d9697a391 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Oct 2025 11:29:57 +0300 +Subject: net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec + tables +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Carolina Jubran + +[ Upstream commit 7593439c13933164f701eed9c83d89358f203469 ] + +When creating IPsec flow tables with tunnel mode enabled, the driver +uses mlx5_eswitch_block_encap() to prevent tunnel encapsulation +conflicts across different domains (NIC_RX/NIC_TX and FDB), since the +firmware doesn’t allow both at the same time. + +Currently, the driver attempts to reserve tunnel mode unconditionally +for both NIC and FDB IPsec tables. This can lead to conflicting tunnel +mode setups, for example, if a flow table was created in the FDB +domain with tunnel offload enabled, and we later try to create another +one in the NIC, or vice versa. + +To resolve this, adjust the blocking logic so that tunnel mode is only +reserved by NIC flows. This ensures that tunnel offload is exclusively +used in either the NIC or the FDB, and avoids unintended offload +conflicts. + +Fixes: 1762f132d542 ("net/mlx5e: Support IPsec packet offload for RX in switchdev mode") +Fixes: c6c2bf5db4ea ("net/mlx5e: Support IPsec packet offload for TX in switchdev mode") +Signed-off-by: Carolina Jubran +Reviewed-by: Jianbo Liu +Reviewed-by: Leon Romanovsky +Signed-off-by: Tariq Toukan +Link: https://patch.msgid.link/1759652999-858513-2-git-send-email-tariqt@nvidia.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 8 ++++++-- + .../net/ethernet/mellanox/mlx5/core/eswitch.h | 5 +++-- + .../mellanox/mlx5/core/eswitch_offloads.c | 18 ++++++++++-------- + 3 files changed, 19 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +index 65dc3529283b6..b525f3f21c51f 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +@@ -1045,7 +1045,9 @@ static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, + + /* Create FT */ + if (mlx5_ipsec_device_caps(mdev) & MLX5_IPSEC_CAP_TUNNEL) +- rx->allow_tunnel_mode = mlx5_eswitch_block_encap(mdev); ++ rx->allow_tunnel_mode = ++ mlx5_eswitch_block_encap(mdev, rx == ipsec->rx_esw); ++ + if (rx->allow_tunnel_mode) + flags = MLX5_FLOW_TABLE_TUNNEL_EN_REFORMAT; + ft = ipsec_ft_create(attr.ns, attr.sa_level, attr.prio, 1, 2, flags); +@@ -1286,7 +1288,9 @@ static int tx_create(struct mlx5e_ipsec *ipsec, struct mlx5e_ipsec_tx *tx, + goto err_status_rule; + + if (mlx5_ipsec_device_caps(mdev) & MLX5_IPSEC_CAP_TUNNEL) +- tx->allow_tunnel_mode = mlx5_eswitch_block_encap(mdev); ++ tx->allow_tunnel_mode = ++ mlx5_eswitch_block_encap(mdev, tx == ipsec->tx_esw); ++ + if (tx->allow_tunnel_mode) + flags = MLX5_FLOW_TABLE_TUNNEL_EN_REFORMAT; + ft = ipsec_ft_create(tx->ns, attr.sa_level, attr.prio, 1, 4, flags); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +index 45506ad568470..53d7e33d6c0b1 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +@@ -851,7 +851,7 @@ void mlx5_eswitch_offloads_single_fdb_del_one(struct mlx5_eswitch *master_esw, + struct mlx5_eswitch *slave_esw); + int mlx5_eswitch_reload_ib_reps(struct mlx5_eswitch *esw); + +-bool mlx5_eswitch_block_encap(struct mlx5_core_dev *dev); ++bool mlx5_eswitch_block_encap(struct mlx5_core_dev *dev, bool from_fdb); + void mlx5_eswitch_unblock_encap(struct mlx5_core_dev *dev); + + int mlx5_eswitch_block_mode(struct mlx5_core_dev *dev); +@@ -943,7 +943,8 @@ mlx5_eswitch_reload_ib_reps(struct mlx5_eswitch *esw) + return 0; + } + +-static inline bool mlx5_eswitch_block_encap(struct mlx5_core_dev *dev) ++static inline bool ++mlx5_eswitch_block_encap(struct mlx5_core_dev *dev, bool from_fdb) + { + return true; + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +index bee906661282a..f358e8fe432cf 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +@@ -3938,23 +3938,25 @@ int mlx5_devlink_eswitch_inline_mode_get(struct devlink *devlink, u8 *mode) + return esw_inline_mode_to_devlink(esw->offloads.inline_mode, mode); + } + +-bool mlx5_eswitch_block_encap(struct mlx5_core_dev *dev) ++bool mlx5_eswitch_block_encap(struct mlx5_core_dev *dev, bool from_fdb) + { + struct mlx5_eswitch *esw = dev->priv.eswitch; ++ enum devlink_eswitch_encap_mode encap; ++ bool allow_tunnel = false; + + if (!mlx5_esw_allowed(esw)) + return true; + + down_write(&esw->mode_lock); +- if (esw->mode != MLX5_ESWITCH_LEGACY && +- esw->offloads.encap != DEVLINK_ESWITCH_ENCAP_MODE_NONE) { +- up_write(&esw->mode_lock); +- return false; ++ encap = esw->offloads.encap; ++ if (esw->mode == MLX5_ESWITCH_LEGACY || ++ (encap == DEVLINK_ESWITCH_ENCAP_MODE_NONE && !from_fdb)) { ++ allow_tunnel = true; ++ esw->offloads.num_block_encap++; + } +- +- esw->offloads.num_block_encap++; + up_write(&esw->mode_lock); +- return true; ++ ++ return allow_tunnel; + } + + void mlx5_eswitch_unblock_encap(struct mlx5_core_dev *dev) +-- +2.51.0 + diff --git a/queue-6.17/net-mlx5e-prevent-tunnel-reformat-when-tunnel-mode-n.patch b/queue-6.17/net-mlx5e-prevent-tunnel-reformat-when-tunnel-mode-n.patch new file mode 100644 index 0000000000..f31739b63f --- /dev/null +++ b/queue-6.17/net-mlx5e-prevent-tunnel-reformat-when-tunnel-mode-n.patch @@ -0,0 +1,187 @@ +From 6a6b35c1432cb8c6c74f49faf379ad8dcbce14ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Oct 2025 11:29:58 +0300 +Subject: net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed + +From: Carolina Jubran + +[ Upstream commit 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 ] + +When configuring IPsec packet offload in tunnel mode, the driver tries +to create tunnel reformat objects unconditionally. This is incorrect, +because tunnel mode is only permitted under specific encapsulation +settings, and that decision is already made when the flow table is +created. + +The offending commit attempted to block this case in the state add +path, but the check there happens too late and does not prevent the +reformat from being configured. + +Fix by taking short reservations for both the eswitch mode and the +encap at the start of state setup. This preserves the block ordering +(mode --> encap) used later: the mode is blocked during RX/TX get, and +the encap is blocked during flow-table creation. This lets us fail +early if either reservation cannot be obtained, it means a mode +transition is underway or a conflicting configuration already owns +encap. If both succeed, the flow-table path later takes the ownership +and the reservations are released on exit. + +Fixes: 146c196b60e4 ("net/mlx5e: Create IPsec table with tunnel support only when encap is disabled") +Signed-off-by: Carolina Jubran +Reviewed-by: Jianbo Liu +Reviewed-by: Leon Romanovsky +Signed-off-by: Tariq Toukan +Link: https://patch.msgid.link/1759652999-858513-3-git-send-email-tariqt@nvidia.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../mellanox/mlx5/core/en_accel/ipsec.c | 38 +++++++++++++------ + .../mellanox/mlx5/core/en_accel/ipsec.h | 2 +- + .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 24 +++++++----- + 3 files changed, 43 insertions(+), 21 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +index 00e77c71e201f..0a4fb8c922684 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +@@ -772,6 +772,7 @@ static int mlx5e_xfrm_add_state(struct net_device *dev, + struct netlink_ext_ack *extack) + { + struct mlx5e_ipsec_sa_entry *sa_entry = NULL; ++ bool allow_tunnel_mode = false; + struct mlx5e_ipsec *ipsec; + struct mlx5e_priv *priv; + gfp_t gfp; +@@ -803,6 +804,20 @@ static int mlx5e_xfrm_add_state(struct net_device *dev, + goto err_xfrm; + } + ++ if (mlx5_eswitch_block_mode(priv->mdev)) ++ goto unblock_ipsec; ++ ++ if (x->props.mode == XFRM_MODE_TUNNEL && ++ x->xso.type == XFRM_DEV_OFFLOAD_PACKET) { ++ allow_tunnel_mode = mlx5e_ipsec_fs_tunnel_allowed(sa_entry); ++ if (!allow_tunnel_mode) { ++ NL_SET_ERR_MSG_MOD(extack, ++ "Packet offload tunnel mode is disabled due to encap settings"); ++ err = -EINVAL; ++ goto unblock_mode; ++ } ++ } ++ + /* check esn */ + if (x->props.flags & XFRM_STATE_ESN) + mlx5e_ipsec_update_esn_state(sa_entry); +@@ -817,7 +832,7 @@ static int mlx5e_xfrm_add_state(struct net_device *dev, + + err = mlx5_ipsec_create_work(sa_entry); + if (err) +- goto unblock_ipsec; ++ goto unblock_encap; + + err = mlx5e_ipsec_create_dwork(sa_entry); + if (err) +@@ -832,14 +847,6 @@ static int mlx5e_xfrm_add_state(struct net_device *dev, + if (err) + goto err_hw_ctx; + +- if (x->props.mode == XFRM_MODE_TUNNEL && +- x->xso.type == XFRM_DEV_OFFLOAD_PACKET && +- !mlx5e_ipsec_fs_tunnel_enabled(sa_entry)) { +- NL_SET_ERR_MSG_MOD(extack, "Packet offload tunnel mode is disabled due to encap settings"); +- err = -EINVAL; +- goto err_add_rule; +- } +- + /* We use *_bh() variant because xfrm_timer_handler(), which runs + * in softirq context, can reach our state delete logic and we need + * xa_erase_bh() there. +@@ -855,8 +862,7 @@ static int mlx5e_xfrm_add_state(struct net_device *dev, + queue_delayed_work(ipsec->wq, &sa_entry->dwork->dwork, + MLX5_IPSEC_RESCHED); + +- if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET && +- x->props.mode == XFRM_MODE_TUNNEL) { ++ if (allow_tunnel_mode) { + xa_lock_bh(&ipsec->sadb); + __xa_set_mark(&ipsec->sadb, sa_entry->ipsec_obj_id, + MLX5E_IPSEC_TUNNEL_SA); +@@ -865,6 +871,11 @@ static int mlx5e_xfrm_add_state(struct net_device *dev, + + out: + x->xso.offload_handle = (unsigned long)sa_entry; ++ if (allow_tunnel_mode) ++ mlx5_eswitch_unblock_encap(priv->mdev); ++ ++ mlx5_eswitch_unblock_mode(priv->mdev); ++ + return 0; + + err_add_rule: +@@ -877,6 +888,11 @@ static int mlx5e_xfrm_add_state(struct net_device *dev, + if (sa_entry->work) + kfree(sa_entry->work->data); + kfree(sa_entry->work); ++unblock_encap: ++ if (allow_tunnel_mode) ++ mlx5_eswitch_unblock_encap(priv->mdev); ++unblock_mode: ++ mlx5_eswitch_unblock_mode(priv->mdev); + unblock_ipsec: + mlx5_eswitch_unblock_ipsec(priv->mdev); + err_xfrm: +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h +index 23703f28386ad..5d7c15abfcaf6 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h +@@ -319,7 +319,7 @@ void mlx5e_accel_ipsec_fs_del_rule(struct mlx5e_ipsec_sa_entry *sa_entry); + int mlx5e_accel_ipsec_fs_add_pol(struct mlx5e_ipsec_pol_entry *pol_entry); + void mlx5e_accel_ipsec_fs_del_pol(struct mlx5e_ipsec_pol_entry *pol_entry); + void mlx5e_accel_ipsec_fs_modify(struct mlx5e_ipsec_sa_entry *sa_entry); +-bool mlx5e_ipsec_fs_tunnel_enabled(struct mlx5e_ipsec_sa_entry *sa_entry); ++bool mlx5e_ipsec_fs_tunnel_allowed(struct mlx5e_ipsec_sa_entry *sa_entry); + + int mlx5_ipsec_create_sa_ctx(struct mlx5e_ipsec_sa_entry *sa_entry); + void mlx5_ipsec_free_sa_ctx(struct mlx5e_ipsec_sa_entry *sa_entry); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +index b525f3f21c51f..9e23652535638 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +@@ -2826,18 +2826,24 @@ void mlx5e_accel_ipsec_fs_modify(struct mlx5e_ipsec_sa_entry *sa_entry) + memcpy(sa_entry, &sa_entry_shadow, sizeof(*sa_entry)); + } + +-bool mlx5e_ipsec_fs_tunnel_enabled(struct mlx5e_ipsec_sa_entry *sa_entry) ++bool mlx5e_ipsec_fs_tunnel_allowed(struct mlx5e_ipsec_sa_entry *sa_entry) + { +- struct mlx5_accel_esp_xfrm_attrs *attrs = &sa_entry->attrs; +- struct mlx5e_ipsec_rx *rx; +- struct mlx5e_ipsec_tx *tx; ++ struct mlx5e_ipsec *ipsec = sa_entry->ipsec; ++ struct xfrm_state *x = sa_entry->x; ++ bool from_fdb; + +- rx = ipsec_rx(sa_entry->ipsec, attrs->addrs.family, attrs->type); +- tx = ipsec_tx(sa_entry->ipsec, attrs->type); +- if (sa_entry->attrs.dir == XFRM_DEV_OFFLOAD_OUT) +- return tx->allow_tunnel_mode; ++ if (x->xso.dir == XFRM_DEV_OFFLOAD_OUT) { ++ struct mlx5e_ipsec_tx *tx = ipsec_tx(ipsec, x->xso.type); ++ ++ from_fdb = (tx == ipsec->tx_esw); ++ } else { ++ struct mlx5e_ipsec_rx *rx = ipsec_rx(ipsec, x->props.family, ++ x->xso.type); ++ ++ from_fdb = (rx == ipsec->rx_esw); ++ } + +- return rx->allow_tunnel_mode; ++ return mlx5_eswitch_block_encap(ipsec->mdev, from_fdb); + } + + void mlx5e_ipsec_handle_mpv_event(int event, struct mlx5e_priv *slave_priv, +-- +2.51.0 + diff --git a/queue-6.17/net-mscc-ocelot-fix-use-after-free-caused-by-cyclic-.patch b/queue-6.17/net-mscc-ocelot-fix-use-after-free-caused-by-cyclic-.patch new file mode 100644 index 0000000000..1950716b21 --- /dev/null +++ b/queue-6.17/net-mscc-ocelot-fix-use-after-free-caused-by-cyclic-.patch @@ -0,0 +1,129 @@ +From a3bb774a3f7f28e88ac4d7baa478f06c92208c1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 09:11:49 +0800 +Subject: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work + +From: Duoming Zhou + +[ Upstream commit bc9ea787079671cb19a8b25ff9f02be5ef6bfcf5 ] + +The origin code calls cancel_delayed_work() in ocelot_stats_deinit() +to cancel the cyclic delayed work item ocelot->stats_work. However, +cancel_delayed_work() may fail to cancel the work item if it is already +executing. While destroy_workqueue() does wait for all pending work items +in the work queue to complete before destroying the work queue, it cannot +prevent the delayed work item from being rescheduled within the +ocelot_check_stats_work() function. This limitation exists because the +delayed work item is only enqueued into the work queue after its timer +expires. Before the timer expiration, destroy_workqueue() has no visibility +of this pending work item. Once the work queue appears empty, +destroy_workqueue() proceeds with destruction. When the timer eventually +expires, the delayed work item gets queued again, leading to the following +warning: + +workqueue: cannot queue ocelot_check_stats_work on wq ocelot-switch-stats +WARNING: CPU: 2 PID: 0 at kernel/workqueue.c:2255 __queue_work+0x875/0xaf0 +... +RIP: 0010:__queue_work+0x875/0xaf0 +... +RSP: 0018:ffff88806d108b10 EFLAGS: 00010086 +RAX: 0000000000000000 RBX: 0000000000000101 RCX: 0000000000000027 +RDX: 0000000000000027 RSI: 0000000000000004 RDI: ffff88806d123e88 +RBP: ffffffff813c3170 R08: 0000000000000000 R09: ffffed100da247d2 +R10: ffffed100da247d1 R11: ffff88806d123e8b R12: ffff88800c00f000 +R13: ffff88800d7285c0 R14: ffff88806d0a5580 R15: ffff88800d7285a0 +FS: 0000000000000000(0000) GS:ffff8880e5725000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007fe18e45ea10 CR3: 0000000005e6c000 CR4: 00000000000006f0 +Call Trace: + + ? kasan_report+0xc6/0xf0 + ? __pfx_delayed_work_timer_fn+0x10/0x10 + ? __pfx_delayed_work_timer_fn+0x10/0x10 + call_timer_fn+0x25/0x1c0 + __run_timer_base.part.0+0x3be/0x8c0 + ? __pfx_delayed_work_timer_fn+0x10/0x10 + ? rcu_sched_clock_irq+0xb06/0x27d0 + ? __pfx___run_timer_base.part.0+0x10/0x10 + ? try_to_wake_up+0xb15/0x1960 + ? _raw_spin_lock_irq+0x80/0xe0 + ? __pfx__raw_spin_lock_irq+0x10/0x10 + tmigr_handle_remote_up+0x603/0x7e0 + ? __pfx_tmigr_handle_remote_up+0x10/0x10 + ? sched_balance_trigger+0x1c0/0x9f0 + ? sched_tick+0x221/0x5a0 + ? _raw_spin_lock_irq+0x80/0xe0 + ? __pfx__raw_spin_lock_irq+0x10/0x10 + ? tick_nohz_handler+0x339/0x440 + ? __pfx_tmigr_handle_remote_up+0x10/0x10 + __walk_groups.isra.0+0x42/0x150 + tmigr_handle_remote+0x1f4/0x2e0 + ? __pfx_tmigr_handle_remote+0x10/0x10 + ? ktime_get+0x60/0x140 + ? lapic_next_event+0x11/0x20 + ? clockevents_program_event+0x1d4/0x2a0 + ? hrtimer_interrupt+0x322/0x780 + handle_softirqs+0x16a/0x550 + irq_exit_rcu+0xaf/0xe0 + sysvec_apic_timer_interrupt+0x70/0x80 + +... + +The following diagram reveals the cause of the above warning: + +CPU 0 (remove) | CPU 1 (delayed work callback) +mscc_ocelot_remove() | + ocelot_deinit() | ocelot_check_stats_work() + ocelot_stats_deinit() | + cancel_delayed_work()| ... + | queue_delayed_work() + destroy_workqueue() | (wait a time) + | __queue_work() //UAF + +The above scenario actually constitutes a UAF vulnerability. + +The ocelot_stats_deinit() is only invoked when initialization +failure or resource destruction, so we must ensure that any +delayed work items cannot be rescheduled. + +Replace cancel_delayed_work() with disable_delayed_work_sync() +to guarantee proper cancellation of the delayed work item and +ensure completion of any currently executing work before the +workqueue is deallocated. + +A deadlock concern was considered: ocelot_stats_deinit() is called +in a process context and is not holding any locks that the delayed +work item might also need. Therefore, the use of the _sync() variant +is safe here. + +This bug was identified through static analysis. To reproduce the +issue and validate the fix, I simulated ocelot-switch device by +writing a kernel module and prepared the necessary resources for +the virtual ocelot-switch device's probe process. Then, removing +the virtual device will trigger the mscc_ocelot_remove() function, +which in turn destroys the workqueue. + +Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support") +Signed-off-by: Duoming Zhou +Link: https://patch.msgid.link/20251001011149.55073-1-duoming@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mscc/ocelot_stats.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mscc/ocelot_stats.c b/drivers/net/ethernet/mscc/ocelot_stats.c +index 545710dadcf54..d2be1be377165 100644 +--- a/drivers/net/ethernet/mscc/ocelot_stats.c ++++ b/drivers/net/ethernet/mscc/ocelot_stats.c +@@ -1021,6 +1021,6 @@ int ocelot_stats_init(struct ocelot *ocelot) + + void ocelot_stats_deinit(struct ocelot *ocelot) + { +- cancel_delayed_work(&ocelot->stats_work); ++ disable_delayed_work_sync(&ocelot->stats_work); + destroy_workqueue(ocelot->stats_queue); + } +-- +2.51.0 + diff --git a/queue-6.17/net-pse-pd-tps23881-fix-current-measurement-scaling.patch b/queue-6.17/net-pse-pd-tps23881-fix-current-measurement-scaling.patch new file mode 100644 index 0000000000..f4e71aeb6e --- /dev/null +++ b/queue-6.17/net-pse-pd-tps23881-fix-current-measurement-scaling.patch @@ -0,0 +1,40 @@ +From 93ea5a583722872968868cdbf65ae9fcc694ba1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Oct 2025 22:40:29 +0200 +Subject: net: pse-pd: tps23881: Fix current measurement scaling + +From: Thomas Wismer + +[ Upstream commit 2c95a756e0cfc19af6d0b32b0c6cf3bada334998 ] + +The TPS23881 improves on the TPS23880 with current sense resistors reduced +from 255 mOhm to 200 mOhm. This has a direct impact on the scaling of the +current measurement. However, the latest TPS23881 data sheet from May 2023 +still shows the scaling of the TPS23880 model. + +Fixes: 7f076ce3f1733 ("net: pse-pd: tps23881: Add support for power limit and measurement features") +Signed-off-by: Thomas Wismer +Acked-by: Kory Maincent +Link: https://patch.msgid.link/20251006204029.7169-2-thomas@wismer.xyz +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/pse-pd/tps23881.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/pse-pd/tps23881.c b/drivers/net/pse-pd/tps23881.c +index 63f8f43062bce..b724b222ab44c 100644 +--- a/drivers/net/pse-pd/tps23881.c ++++ b/drivers/net/pse-pd/tps23881.c +@@ -62,7 +62,7 @@ + #define TPS23881_REG_SRAM_DATA 0x61 + + #define TPS23881_UV_STEP 3662 +-#define TPS23881_NA_STEP 70190 ++#define TPS23881_NA_STEP 89500 + #define TPS23881_MW_STEP 500 + #define TPS23881_MIN_PI_PW_LIMIT_MW 2000 + +-- +2.51.0 + diff --git a/queue-6.17/net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch b/queue-6.17/net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch new file mode 100644 index 0000000000..579cd645dc --- /dev/null +++ b/queue-6.17/net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch @@ -0,0 +1,42 @@ +From 4749addbc9e1e53136a8778ad9c302829e30e3ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 12:14:47 +0300 +Subject: net/sctp: fix a null dereference in sctp_disposition + sctp_sf_do_5_1D_ce() + +From: Alexandr Sapozhnikov + +[ Upstream commit 2f3119686ef50319490ccaec81a575973da98815 ] + +If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 +and sctp_ulpevent_make_authkey() returns 0, then the variable +ai_ev remains zero and the zero will be dereferenced +in the sctp_ulpevent_free() function. + +Signed-off-by: Alexandr Sapozhnikov +Acked-by: Xin Long +Fixes: 30f6ebf65bc4 ("sctp: add SCTP_AUTH_NO_AUTH type for AUTHENTICATION_EVENT") +Link: https://patch.msgid.link/20251002091448.11-1-alsp705@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sctp/sm_statefuns.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index a0524ba8d7878..93cac73472c79 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -885,7 +885,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net, + return SCTP_DISPOSITION_CONSUME; + + nomem_authev: +- sctp_ulpevent_free(ai_ev); ++ if (ai_ev) ++ sctp_ulpevent_free(ai_ev); + nomem_aiev: + sctp_ulpevent_free(ev); + nomem_ev: +-- +2.51.0 + diff --git a/queue-6.17/net-sparx5-lan969x-fix-flooding-configuration-on-bri.patch b/queue-6.17/net-sparx5-lan969x-fix-flooding-configuration-on-bri.patch new file mode 100644 index 0000000000..72991ab51b --- /dev/null +++ b/queue-6.17/net-sparx5-lan969x-fix-flooding-configuration-on-bri.patch @@ -0,0 +1,150 @@ +From 9ff6549e8e9be9ed92d537c084888680f8efd3a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 14:35:59 +0200 +Subject: net: sparx5/lan969x: fix flooding configuration on bridge join/leave +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Daniel Machon + +[ Upstream commit c9d1b0b54258ba13b567dd116ead3c7c30cba7d8 ] + +The sparx5 driver programs UC/MC/BC flooding in sparx5_update_fwd() by +unconditionally applying bridge_fwd_mask to all flood PGIDs. Any bridge +topology change that triggers sparx5_update_fwd() (for example enslaving +another port) therefore reinstalls flooding in hardware for already +bridged ports, regardless of their per-port flood flags. + +This results in clobbering of the flood masks, and desynchronization +between software and hardware: the bridge still reports “flood off” for +the port, but hardware has flooding enabled due to unconditional PGID +reprogramming. + +Steps to reproduce: + + $ ip link add br0 type bridge + $ ip link set br0 up + $ ip link set eth0 master br0 + $ ip link set eth0 up + $ bridge link set dev eth0 flood off + $ ip link set eth1 master br0 + $ ip link set eth1 up + +At this point, flooding is silently re-enabled for eth0. Software still +shows “flood off” for eth0, but hardware has flooding enabled. + +To fix this, flooding is now set explicitly during bridge join/leave, +through sparx5_port_attr_bridge_flags(): + + On bridge join, UC/MC/BC flooding is enabled by default. + + On bridge leave, UC/MC/BC flooding is disabled. + + sparx5_update_fwd() no longer touches the flood PGIDs, clobbering + the flood masks, and desynchronizing software and hardware. + + Initialization of the flooding PGIDs have been moved to + sparx5_start(). This is required as flooding PGIDs defaults to + 0x3fffffff in hardware and the initialization was previously handled + in sparx5_update_fwd(), which was removed. + +With this change, user-configured flooding flags persist across bridge +updates and are no longer overridden by sparx5_update_fwd(). + +Fixes: d6fce5141929 ("net: sparx5: add switching support") +Signed-off-by: Daniel Machon +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20251003-fix-flood-fwd-v1-1-48eb478b2904@microchip.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/microchip/sparx5/sparx5_main.c | 5 +++++ + .../net/ethernet/microchip/sparx5/sparx5_switchdev.c | 12 ++++++++++++ + drivers/net/ethernet/microchip/sparx5/sparx5_vlan.c | 10 ---------- + 3 files changed, 17 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_main.c b/drivers/net/ethernet/microchip/sparx5/sparx5_main.c +index 74ad1d73b4652..40b1bfc600a79 100644 +--- a/drivers/net/ethernet/microchip/sparx5/sparx5_main.c ++++ b/drivers/net/ethernet/microchip/sparx5/sparx5_main.c +@@ -708,6 +708,11 @@ static int sparx5_start(struct sparx5 *sparx5) + /* Init masks */ + sparx5_update_fwd(sparx5); + ++ /* Init flood masks */ ++ for (int pgid = sparx5_get_pgid(sparx5, PGID_UC_FLOOD); ++ pgid <= sparx5_get_pgid(sparx5, PGID_BCAST); pgid++) ++ sparx5_pgid_clear(sparx5, pgid); ++ + /* CPU copy CPU pgids */ + spx5_wr(ANA_AC_PGID_MISC_CFG_PGID_CPU_COPY_ENA_SET(1), sparx5, + ANA_AC_PGID_MISC_CFG(sparx5_get_pgid(sparx5, PGID_CPU))); +diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_switchdev.c b/drivers/net/ethernet/microchip/sparx5/sparx5_switchdev.c +index bc9ecb9392cd3..0a71abbd3da58 100644 +--- a/drivers/net/ethernet/microchip/sparx5/sparx5_switchdev.c ++++ b/drivers/net/ethernet/microchip/sparx5/sparx5_switchdev.c +@@ -176,6 +176,7 @@ static int sparx5_port_bridge_join(struct sparx5_port *port, + struct net_device *bridge, + struct netlink_ext_ack *extack) + { ++ struct switchdev_brport_flags flags = {0}; + struct sparx5 *sparx5 = port->sparx5; + struct net_device *ndev = port->ndev; + int err; +@@ -205,6 +206,11 @@ static int sparx5_port_bridge_join(struct sparx5_port *port, + */ + __dev_mc_unsync(ndev, sparx5_mc_unsync); + ++ /* Enable uc/mc/bc flooding */ ++ flags.mask = BR_FLOOD | BR_MCAST_FLOOD | BR_BCAST_FLOOD; ++ flags.val = flags.mask; ++ sparx5_port_attr_bridge_flags(port, flags); ++ + return 0; + + err_switchdev_offload: +@@ -215,6 +221,7 @@ static int sparx5_port_bridge_join(struct sparx5_port *port, + static void sparx5_port_bridge_leave(struct sparx5_port *port, + struct net_device *bridge) + { ++ struct switchdev_brport_flags flags = {0}; + struct sparx5 *sparx5 = port->sparx5; + + switchdev_bridge_port_unoffload(port->ndev, NULL, NULL, NULL); +@@ -234,6 +241,11 @@ static void sparx5_port_bridge_leave(struct sparx5_port *port, + + /* Port enters in host more therefore restore mc list */ + __dev_mc_sync(port->ndev, sparx5_mc_sync, sparx5_mc_unsync); ++ ++ /* Disable uc/mc/bc flooding */ ++ flags.mask = BR_FLOOD | BR_MCAST_FLOOD | BR_BCAST_FLOOD; ++ flags.val = 0; ++ sparx5_port_attr_bridge_flags(port, flags); + } + + static int sparx5_port_changeupper(struct net_device *dev, +diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_vlan.c b/drivers/net/ethernet/microchip/sparx5/sparx5_vlan.c +index d42097aa60a0e..4947828719038 100644 +--- a/drivers/net/ethernet/microchip/sparx5/sparx5_vlan.c ++++ b/drivers/net/ethernet/microchip/sparx5/sparx5_vlan.c +@@ -167,16 +167,6 @@ void sparx5_update_fwd(struct sparx5 *sparx5) + /* Divide up fwd mask in 32 bit words */ + bitmap_to_arr32(mask, sparx5->bridge_fwd_mask, SPX5_PORTS); + +- /* Update flood masks */ +- for (port = sparx5_get_pgid(sparx5, PGID_UC_FLOOD); +- port <= sparx5_get_pgid(sparx5, PGID_BCAST); port++) { +- spx5_wr(mask[0], sparx5, ANA_AC_PGID_CFG(port)); +- if (is_sparx5(sparx5)) { +- spx5_wr(mask[1], sparx5, ANA_AC_PGID_CFG1(port)); +- spx5_wr(mask[2], sparx5, ANA_AC_PGID_CFG2(port)); +- } +- } +- + /* Update SRC masks */ + for (port = 0; port < sparx5->data->consts->n_ports; port++) { + if (test_bit(port, sparx5->bridge_fwd_mask)) { +-- +2.51.0 + diff --git a/queue-6.17/net-usb-lan78xx-fix-lost-eeprom-read-timeout-error-e.patch b/queue-6.17/net-usb-lan78xx-fix-lost-eeprom-read-timeout-error-e.patch new file mode 100644 index 0000000000..81ec3d314e --- /dev/null +++ b/queue-6.17/net-usb-lan78xx-fix-lost-eeprom-read-timeout-error-e.patch @@ -0,0 +1,80 @@ +From 6f5ac41ee61424b5407adf5c7c3c89b3ef87ad70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 14:19:02 +0530 +Subject: net: usb: lan78xx: Fix lost EEPROM read timeout error(-ETIMEDOUT) in + lan78xx_read_raw_eeprom + +From: Bhanu Seshu Kumar Valluri + +[ Upstream commit 49bdb63ff64469a6de8ea901aef123c75be9bbe7 ] + +Syzbot reported read of uninitialized variable BUG with following call stack. + +lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): EEPROM read operation timeout +===================================================== +BUG: KMSAN: uninit-value in lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1095 [inline] +BUG: KMSAN: uninit-value in lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline] +BUG: KMSAN: uninit-value in lan78xx_reset+0x999/0x2cd0 drivers/net/usb/lan78xx.c:3241 + lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1095 [inline] + lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline] + lan78xx_reset+0x999/0x2cd0 drivers/net/usb/lan78xx.c:3241 + lan78xx_bind+0x711/0x1690 drivers/net/usb/lan78xx.c:3766 + lan78xx_probe+0x225c/0x3310 drivers/net/usb/lan78xx.c:4707 + +Local variable sig.i.i created at: + lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1092 [inline] + lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline] + lan78xx_reset+0x77e/0x2cd0 drivers/net/usb/lan78xx.c:3241 + lan78xx_bind+0x711/0x1690 drivers/net/usb/lan78xx.c:3766 + +The function lan78xx_read_raw_eeprom failed to properly propagate EEPROM +read timeout errors (-ETIMEDOUT). In the fallthrough path, it first +attempted to restore the pin configuration for LED outputs and then +returned only the status of that restore operation, discarding the +original timeout error. + +As a result, callers could mistakenly treat the data buffer as valid +even though the EEPROM read had actually timed out with no data or partial +data. + +To fix this, handle errors in restoring the LED pin configuration separately. +If the restore succeeds, return any prior EEPROM timeout error correctly +to the caller. + +Reported-by: syzbot+62ec8226f01cb4ca19d9@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=62ec8226f01cb4ca19d9 +Fixes: 8b1b2ca83b20 ("net: usb: lan78xx: Improve error handling in EEPROM and OTP operations") +Signed-off-by: Bhanu Seshu Kumar Valluri +Reviewed-by: Oleksij Rempel +Link: https://patch.msgid.link/20250930084902.19062-1-bhanuseshukumar@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/lan78xx.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 1ff25f57329a8..d75502ebbc0d9 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -1079,10 +1079,13 @@ static int lan78xx_read_raw_eeprom(struct lan78xx_net *dev, u32 offset, + } + + read_raw_eeprom_done: +- if (dev->chipid == ID_REV_CHIP_ID_7800_) +- return lan78xx_write_reg(dev, HW_CFG, saved); +- +- return 0; ++ if (dev->chipid == ID_REV_CHIP_ID_7800_) { ++ int rc = lan78xx_write_reg(dev, HW_CFG, saved); ++ /* If USB fails, there is nothing to do */ ++ if (rc < 0) ++ return rc; ++ } ++ return ret; + } + + static int lan78xx_read_eeprom(struct lan78xx_net *dev, u32 offset, +-- +2.51.0 + diff --git a/queue-6.17/netfilter-nft_objref-validate-objref-and-objrefmap-e.patch b/queue-6.17/netfilter-nft_objref-validate-objref-and-objrefmap-e.patch new file mode 100644 index 0000000000..1567bf43eb --- /dev/null +++ b/queue-6.17/netfilter-nft_objref-validate-objref-and-objrefmap-e.patch @@ -0,0 +1,131 @@ +From 1463749e06aa83213e2924c526204cef640a5a0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 12:08:16 +0200 +Subject: netfilter: nft_objref: validate objref and objrefmap expressions + +From: Fernando Fernandez Mancera + +[ Upstream commit f359b809d54c6e3dd1d039b97e0b68390b0e53e4 ] + +Referencing a synproxy stateful object from OUTPUT hook causes kernel +crash due to infinite recursive calls: + +BUG: TASK stack guard page was hit at 000000008bda5b8c (stack is 000000003ab1c4a5..00000000494d8b12) +[...] +Call Trace: + __find_rr_leaf+0x99/0x230 + fib6_table_lookup+0x13b/0x2d0 + ip6_pol_route+0xa4/0x400 + fib6_rule_lookup+0x156/0x240 + ip6_route_output_flags+0xc6/0x150 + __nf_ip6_route+0x23/0x50 + synproxy_send_tcp_ipv6+0x106/0x200 + synproxy_send_client_synack_ipv6+0x1aa/0x1f0 + nft_synproxy_do_eval+0x263/0x310 + nft_do_chain+0x5a8/0x5f0 [nf_tables + nft_do_chain_inet+0x98/0x110 + nf_hook_slow+0x43/0xc0 + __ip6_local_out+0xf0/0x170 + ip6_local_out+0x17/0x70 + synproxy_send_tcp_ipv6+0x1a2/0x200 + synproxy_send_client_synack_ipv6+0x1aa/0x1f0 +[...] + +Implement objref and objrefmap expression validate functions. + +Currently, only NFT_OBJECT_SYNPROXY object type requires validation. +This will also handle a jump to a chain using a synproxy object from the +OUTPUT hook. + +Now when trying to reference a synproxy object in the OUTPUT hook, nft +will produce the following error: + +synproxy_crash.nft: Error: Could not process rule: Operation not supported + synproxy name mysynproxy + ^^^^^^^^^^^^^^^^^^^^^^^^ + +Fixes: ee394f96ad75 ("netfilter: nft_synproxy: add synproxy stateful object support") +Reported-by: Georg Pfuetzenreuter +Closes: https://bugzilla.suse.com/1250237 +Signed-off-by: Fernando Fernandez Mancera +Reviewed-by: Pablo Neira Ayuso +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_objref.c | 39 ++++++++++++++++++++++++++++++++++++++ + 1 file changed, 39 insertions(+) + +diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c +index 8ee66a86c3bc7..1a62e384766a7 100644 +--- a/net/netfilter/nft_objref.c ++++ b/net/netfilter/nft_objref.c +@@ -22,6 +22,35 @@ void nft_objref_eval(const struct nft_expr *expr, + obj->ops->eval(obj, regs, pkt); + } + ++static int nft_objref_validate_obj_type(const struct nft_ctx *ctx, u32 type) ++{ ++ unsigned int hooks; ++ ++ switch (type) { ++ case NFT_OBJECT_SYNPROXY: ++ if (ctx->family != NFPROTO_IPV4 && ++ ctx->family != NFPROTO_IPV6 && ++ ctx->family != NFPROTO_INET) ++ return -EOPNOTSUPP; ++ ++ hooks = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD); ++ ++ return nft_chain_validate_hooks(ctx->chain, hooks); ++ default: ++ break; ++ } ++ ++ return 0; ++} ++ ++static int nft_objref_validate(const struct nft_ctx *ctx, ++ const struct nft_expr *expr) ++{ ++ struct nft_object *obj = nft_objref_priv(expr); ++ ++ return nft_objref_validate_obj_type(ctx, obj->ops->type->type); ++} ++ + static int nft_objref_init(const struct nft_ctx *ctx, + const struct nft_expr *expr, + const struct nlattr * const tb[]) +@@ -93,6 +122,7 @@ static const struct nft_expr_ops nft_objref_ops = { + .activate = nft_objref_activate, + .deactivate = nft_objref_deactivate, + .dump = nft_objref_dump, ++ .validate = nft_objref_validate, + .reduce = NFT_REDUCE_READONLY, + }; + +@@ -197,6 +227,14 @@ static void nft_objref_map_destroy(const struct nft_ctx *ctx, + nf_tables_destroy_set(ctx, priv->set); + } + ++static int nft_objref_map_validate(const struct nft_ctx *ctx, ++ const struct nft_expr *expr) ++{ ++ const struct nft_objref_map *priv = nft_expr_priv(expr); ++ ++ return nft_objref_validate_obj_type(ctx, priv->set->objtype); ++} ++ + static const struct nft_expr_ops nft_objref_map_ops = { + .type = &nft_objref_type, + .size = NFT_EXPR_SIZE(sizeof(struct nft_objref_map)), +@@ -206,6 +244,7 @@ static const struct nft_expr_ops nft_objref_map_ops = { + .deactivate = nft_objref_map_deactivate, + .destroy = nft_objref_map_destroy, + .dump = nft_objref_map_dump, ++ .validate = nft_objref_map_validate, + .reduce = NFT_REDUCE_READONLY, + }; + +-- +2.51.0 + diff --git a/queue-6.17/nfsd-fix-assignment-of-ia_ctime.tv_nsec-on-delegated.patch b/queue-6.17/nfsd-fix-assignment-of-ia_ctime.tv_nsec-on-delegated.patch new file mode 100644 index 0000000000..188d77c725 --- /dev/null +++ b/queue-6.17/nfsd-fix-assignment-of-ia_ctime.tv_nsec-on-delegated.patch @@ -0,0 +1,35 @@ +From a7db21f6869a681c01500d6e561a89b497d2659c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jul 2025 09:24:30 -0400 +Subject: nfsd: fix assignment of ia_ctime.tv_nsec on delegated mtime update + +From: Jeff Layton + +[ Upstream commit 2990b5a47984c27873d165de9e88099deee95c8d ] + +The ia_ctime.tv_nsec field should be set to modify.nseconds. + +Fixes: 7e13f4f8d27d ("nfsd: handle delegated timestamps in SETATTR") +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4xdr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index ea91bad4eee2c..1f3a20360d0c2 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -538,7 +538,7 @@ nfsd4_decode_fattr4(struct nfsd4_compoundargs *argp, u32 *bmval, u32 bmlen, + iattr->ia_mtime.tv_sec = modify.seconds; + iattr->ia_mtime.tv_nsec = modify.nseconds; + iattr->ia_ctime.tv_sec = modify.seconds; +- iattr->ia_ctime.tv_nsec = modify.seconds; ++ iattr->ia_ctime.tv_nsec = modify.nseconds; + iattr->ia_valid |= ATTR_CTIME | ATTR_MTIME | ATTR_MTIME_SET | ATTR_DELEG; + } + +-- +2.51.0 + diff --git a/queue-6.17/nfsd-fix-setattr-updates-for-delegated-timestamps.patch b/queue-6.17/nfsd-fix-setattr-updates-for-delegated-timestamps.patch new file mode 100644 index 0000000000..67ff5408f8 --- /dev/null +++ b/queue-6.17/nfsd-fix-setattr-updates-for-delegated-timestamps.patch @@ -0,0 +1,160 @@ +From 1788b5a83f24258857a5be4057e67b6862407d75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jul 2025 09:24:35 -0400 +Subject: nfsd: fix SETATTR updates for delegated timestamps + +From: Jeff Layton + +[ Upstream commit 3952f1cbcbc454b2cb639ddbf165c07068e90371 ] + +SETATTRs containing delegated timestamp updates are currently not being +vetted properly. Since we no longer need to compare the timestamps vs. +the current timestamps, move the vetting of delegated timestamps wholly +into nfsd. + +Rename the set_cb_time() helper to nfsd4_vet_deleg_time(), and make it +non-static. Add a new vet_deleg_attrs() helper that is called from +nfsd4_setattr that uses nfsd4_vet_deleg_time() to properly validate the +all the timestamps. If the validation indicates that the update should +be skipped, unset the appropriate flags in ia_valid. + +Fixes: 7e13f4f8d27d ("nfsd: handle delegated timestamps in SETATTR") +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4proc.c | 31 ++++++++++++++++++++++++++++++- + fs/nfsd/nfs4state.c | 24 +++++++++++------------- + fs/nfsd/state.h | 3 +++ + 3 files changed, 44 insertions(+), 14 deletions(-) + +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index 71b428efcbb59..9bd49783db932 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1133,6 +1133,33 @@ nfsd4_secinfo_no_name_release(union nfsd4_op_u *u) + exp_put(u->secinfo_no_name.sin_exp); + } + ++/* ++ * Validate that the requested timestamps are within the acceptable range. If ++ * timestamp appears to be in the future, then it will be clamped to ++ * current_time(). ++ */ ++static void ++vet_deleg_attrs(struct nfsd4_setattr *setattr, struct nfs4_delegation *dp) ++{ ++ struct timespec64 now = current_time(dp->dl_stid.sc_file->fi_inode); ++ struct iattr *iattr = &setattr->sa_iattr; ++ ++ if ((setattr->sa_bmval[2] & FATTR4_WORD2_TIME_DELEG_ACCESS) && ++ !nfsd4_vet_deleg_time(&iattr->ia_atime, &dp->dl_atime, &now)) ++ iattr->ia_valid &= ~(ATTR_ATIME | ATTR_ATIME_SET); ++ ++ if (setattr->sa_bmval[2] & FATTR4_WORD2_TIME_DELEG_MODIFY) { ++ if (nfsd4_vet_deleg_time(&iattr->ia_mtime, &dp->dl_mtime, &now)) { ++ iattr->ia_ctime = iattr->ia_mtime; ++ if (!nfsd4_vet_deleg_time(&iattr->ia_ctime, &dp->dl_ctime, &now)) ++ iattr->ia_valid &= ~(ATTR_CTIME | ATTR_CTIME_SET); ++ } else { ++ iattr->ia_valid &= ~(ATTR_CTIME | ATTR_CTIME_SET | ++ ATTR_MTIME | ATTR_MTIME_SET); ++ } ++ } ++} ++ + static __be32 + nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + union nfsd4_op_u *u) +@@ -1170,8 +1197,10 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + struct nfs4_delegation *dp = delegstateid(st); + + /* Only for *_ATTRS_DELEG flavors */ +- if (deleg_attrs_deleg(dp->dl_type)) ++ if (deleg_attrs_deleg(dp->dl_type)) { ++ vet_deleg_attrs(setattr, dp); + status = nfs_ok; ++ } + } + } + if (st) +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index 8737b721daf34..f2fd0cbe256b9 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -9135,25 +9135,25 @@ nfsd4_get_writestateid(struct nfsd4_compound_state *cstate, + } + + /** +- * set_cb_time - vet and set the timespec for a cb_getattr update +- * @cb: timestamp from the CB_GETATTR response ++ * nfsd4_vet_deleg_time - vet and set the timespec for a delegated timestamp update ++ * @req: timestamp from the client + * @orig: original timestamp in the inode + * @now: current time + * +- * Given a timestamp in a CB_GETATTR response, check it against the ++ * Given a timestamp from the client response, check it against the + * current timestamp in the inode and the current time. Returns true + * if the inode's timestamp needs to be updated, and false otherwise. +- * @cb may also be changed if the timestamp needs to be clamped. ++ * @req may also be changed if the timestamp needs to be clamped. + */ +-static bool set_cb_time(struct timespec64 *cb, const struct timespec64 *orig, +- const struct timespec64 *now) ++bool nfsd4_vet_deleg_time(struct timespec64 *req, const struct timespec64 *orig, ++ const struct timespec64 *now) + { + + /* + * "When the time presented is before the original time, then the + * update is ignored." Also no need to update if there is no change. + */ +- if (timespec64_compare(cb, orig) <= 0) ++ if (timespec64_compare(req, orig) <= 0) + return false; + + /* +@@ -9161,10 +9161,8 @@ static bool set_cb_time(struct timespec64 *cb, const struct timespec64 *orig, + * clamp the new time to the current time, or it may + * return NFS4ERR_DELAY to the client, allowing it to retry." + */ +- if (timespec64_compare(cb, now) > 0) { +- /* clamp it */ +- *cb = *now; +- } ++ if (timespec64_compare(req, now) > 0) ++ *req = *now; + + return true; + } +@@ -9184,10 +9182,10 @@ static int cb_getattr_update_times(struct dentry *dentry, struct nfs4_delegation + attrs.ia_atime = ncf->ncf_cb_atime; + attrs.ia_mtime = ncf->ncf_cb_mtime; + +- if (set_cb_time(&attrs.ia_atime, &atime, &now)) ++ if (nfsd4_vet_deleg_time(&attrs.ia_atime, &atime, &now)) + attrs.ia_valid |= ATTR_ATIME | ATTR_ATIME_SET; + +- if (set_cb_time(&attrs.ia_mtime, &mtime, &now)) { ++ if (nfsd4_vet_deleg_time(&attrs.ia_mtime, &mtime, &now)) { + attrs.ia_valid |= ATTR_CTIME | ATTR_CTIME_SET | + ATTR_MTIME | ATTR_MTIME_SET; + attrs.ia_ctime = attrs.ia_mtime; +diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h +index ce7c0d129ba33..bf9436cdb93c5 100644 +--- a/fs/nfsd/state.h ++++ b/fs/nfsd/state.h +@@ -247,6 +247,9 @@ static inline bool deleg_attrs_deleg(u32 dl_type) + dl_type == OPEN_DELEGATE_WRITE_ATTRS_DELEG; + } + ++bool nfsd4_vet_deleg_time(struct timespec64 *cb, const struct timespec64 *orig, ++ const struct timespec64 *now); ++ + #define cb_to_delegation(cb) \ + container_of(cb, struct nfs4_delegation, dl_recall) + +-- +2.51.0 + diff --git a/queue-6.17/nfsd-fix-timestamp-updates-in-cb_getattr.patch b/queue-6.17/nfsd-fix-timestamp-updates-in-cb_getattr.patch new file mode 100644 index 0000000000..8886767849 --- /dev/null +++ b/queue-6.17/nfsd-fix-timestamp-updates-in-cb_getattr.patch @@ -0,0 +1,57 @@ +From 0409f114971ba06fa43f2a359836b43165293843 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jul 2025 09:24:36 -0400 +Subject: nfsd: fix timestamp updates in CB_GETATTR + +From: Jeff Layton + +[ Upstream commit b40b1ba37ad5b6099c426765c4bc327c08b390b9 ] + +When updating the local timestamps from CB_GETATTR, the updated values +are not being properly vetted. + +Compare the update times vs. the saved times in the delegation rather +than the current times in the inode. Also, ensure that the ctime is +properly vetted vs. its original value. + +Fixes: 6ae30d6eb26b ("nfsd: add support for delegated timestamps") +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4state.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index f2fd0cbe256b9..205ee8cc6fa2b 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -9175,20 +9175,19 @@ static int cb_getattr_update_times(struct dentry *dentry, struct nfs4_delegation + int ret; + + if (deleg_attrs_deleg(dp->dl_type)) { +- struct timespec64 atime = inode_get_atime(inode); +- struct timespec64 mtime = inode_get_mtime(inode); + struct timespec64 now = current_time(inode); + + attrs.ia_atime = ncf->ncf_cb_atime; + attrs.ia_mtime = ncf->ncf_cb_mtime; + +- if (nfsd4_vet_deleg_time(&attrs.ia_atime, &atime, &now)) ++ if (nfsd4_vet_deleg_time(&attrs.ia_atime, &dp->dl_atime, &now)) + attrs.ia_valid |= ATTR_ATIME | ATTR_ATIME_SET; + +- if (nfsd4_vet_deleg_time(&attrs.ia_mtime, &mtime, &now)) { +- attrs.ia_valid |= ATTR_CTIME | ATTR_CTIME_SET | +- ATTR_MTIME | ATTR_MTIME_SET; ++ if (nfsd4_vet_deleg_time(&attrs.ia_mtime, &dp->dl_mtime, &now)) { ++ attrs.ia_valid |= ATTR_MTIME | ATTR_MTIME_SET; + attrs.ia_ctime = attrs.ia_mtime; ++ if (nfsd4_vet_deleg_time(&attrs.ia_ctime, &dp->dl_ctime, &now)) ++ attrs.ia_valid |= ATTR_CTIME | ATTR_CTIME_SET; + } + } else { + attrs.ia_valid |= ATTR_MTIME | ATTR_CTIME; +-- +2.51.0 + diff --git a/queue-6.17/nfsd-ignore-attr_deleg-when-checking-ia_valid-before.patch b/queue-6.17/nfsd-ignore-attr_deleg-when-checking-ia_valid-before.patch new file mode 100644 index 0000000000..d6cc977eb4 --- /dev/null +++ b/queue-6.17/nfsd-ignore-attr_deleg-when-checking-ia_valid-before.patch @@ -0,0 +1,36 @@ +From 2c432d461e39d9f46588d0450a3800ae6d9ee19e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jul 2025 09:24:31 -0400 +Subject: nfsd: ignore ATTR_DELEG when checking ia_valid before notify_change() + +From: Jeff Layton + +[ Upstream commit 5affb498e70bba3053b835c478a199bf92c99c4d ] + +If the only flag left is ATTR_DELEG, then there are no changes to be +made. + +Fixes: 7e13f4f8d27d ("nfsd: handle delegated timestamps in SETATTR") +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/vfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c +index edf050766e570..3cd3b9e069f4a 100644 +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -467,7 +467,7 @@ static int __nfsd_setattr(struct dentry *dentry, struct iattr *iap) + return 0; + } + +- if (!iap->ia_valid) ++ if ((iap->ia_valid & ~ATTR_DELEG) == 0) + return 0; + + /* +-- +2.51.0 + diff --git a/queue-6.17/nfsd-track-original-timestamps-in-nfs4_delegation.patch b/queue-6.17/nfsd-track-original-timestamps-in-nfs4_delegation.patch new file mode 100644 index 0000000000..8308a6dc15 --- /dev/null +++ b/queue-6.17/nfsd-track-original-timestamps-in-nfs4_delegation.patch @@ -0,0 +1,80 @@ +From 01273981a062a52723997c4c47ea3981b6c0ec0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jul 2025 09:24:34 -0400 +Subject: nfsd: track original timestamps in nfs4_delegation + +From: Jeff Layton + +[ Upstream commit 7663e963a51122792811811c8119fd55c9ab254a ] + +As Trond points out [1], the "original time" mentioned in RFC 9754 +refers to the timestamps on the files at the time that the delegation +was granted, and not the current timestamp of the file on the server. + +Store the current timestamps for the file in the nfs4_delegation when +granting one. Add STATX_ATIME and STATX_MTIME to the request mask in +nfs4_delegation_stat(). When granting OPEN_DELEGATE_READ_ATTRS_DELEG, do +a nfs4_delegation_stat() and save the correct atime. If the stat() fails +for any reason, fall back to granting a normal read deleg. + +[1]: https://lore.kernel.org/linux-nfs/47a4e40310e797f21b5137e847b06bb203d99e66.camel@kernel.org/ + +Fixes: 7e13f4f8d27d ("nfsd: handle delegated timestamps in SETATTR") +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4state.c | 11 ++++++++--- + fs/nfsd/state.h | 5 +++++ + 2 files changed, 13 insertions(+), 3 deletions(-) + +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index 77eea2ad93cc0..8737b721daf34 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -6157,7 +6157,8 @@ nfs4_delegation_stat(struct nfs4_delegation *dp, struct svc_fh *currentfh, + path.dentry = file_dentry(nf->nf_file); + + rc = vfs_getattr(&path, stat, +- (STATX_MODE | STATX_SIZE | STATX_CTIME | STATX_CHANGE_COOKIE), ++ STATX_MODE | STATX_SIZE | STATX_ATIME | ++ STATX_MTIME | STATX_CTIME | STATX_CHANGE_COOKIE, + AT_STATX_SYNC_AS_STAT); + + nfsd_file_put(nf); +@@ -6274,10 +6275,14 @@ nfs4_open_delegation(struct svc_rqst *rqstp, struct nfsd4_open *open, + OPEN_DELEGATE_WRITE; + dp->dl_cb_fattr.ncf_cur_fsize = stat.size; + dp->dl_cb_fattr.ncf_initial_cinfo = nfsd4_change_attribute(&stat); ++ dp->dl_atime = stat.atime; ++ dp->dl_ctime = stat.ctime; ++ dp->dl_mtime = stat.mtime; + trace_nfsd_deleg_write(&dp->dl_stid.sc_stateid); + } else { +- open->op_delegate_type = deleg_ts ? OPEN_DELEGATE_READ_ATTRS_DELEG : +- OPEN_DELEGATE_READ; ++ open->op_delegate_type = deleg_ts && nfs4_delegation_stat(dp, currentfh, &stat) ? ++ OPEN_DELEGATE_READ_ATTRS_DELEG : OPEN_DELEGATE_READ; ++ dp->dl_atime = stat.atime; + trace_nfsd_deleg_read(&dp->dl_stid.sc_stateid); + } + nfs4_put_stid(&dp->dl_stid); +diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h +index 8adc2550129e6..ce7c0d129ba33 100644 +--- a/fs/nfsd/state.h ++++ b/fs/nfsd/state.h +@@ -224,6 +224,11 @@ struct nfs4_delegation { + + /* for CB_GETATTR */ + struct nfs4_cb_fattr dl_cb_fattr; ++ ++ /* For delegated timestamps */ ++ struct timespec64 dl_atime; ++ struct timespec64 dl_mtime; ++ struct timespec64 dl_ctime; + }; + + static inline bool deleg_is_read(u32 dl_type) +-- +2.51.0 + diff --git a/queue-6.17/nfsd-use-attr_ctime_set-for-delegated-ctime-updates.patch b/queue-6.17/nfsd-use-attr_ctime_set-for-delegated-ctime-updates.patch new file mode 100644 index 0000000000..a4844c4a3b --- /dev/null +++ b/queue-6.17/nfsd-use-attr_ctime_set-for-delegated-ctime-updates.patch @@ -0,0 +1,76 @@ +From 2a70f1376dff02bc45258800afb3555c82e67202 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jul 2025 09:24:33 -0400 +Subject: nfsd: use ATTR_CTIME_SET for delegated ctime updates + +From: Jeff Layton + +[ Upstream commit c066ff58e5d6e5d7400e5fda0c33f95b8c37dd02 ] + +Ensure that notify_change() doesn't clobber a delegated ctime update +with current_time() by setting ATTR_CTIME_SET for those updates. + +Don't bother setting the timestamps in cb_getattr_update_times() in the +non-delegated case. notify_change() will do that itself. + +Fixes: 7e13f4f8d27d ("nfsd: handle delegated timestamps in SETATTR") +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4state.c | 6 +++--- + fs/nfsd/nfs4xdr.c | 3 ++- + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index 88c347957da5b..77eea2ad93cc0 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -9167,7 +9167,6 @@ static bool set_cb_time(struct timespec64 *cb, const struct timespec64 *orig, + static int cb_getattr_update_times(struct dentry *dentry, struct nfs4_delegation *dp) + { + struct inode *inode = d_inode(dentry); +- struct timespec64 now = current_time(inode); + struct nfs4_cb_fattr *ncf = &dp->dl_cb_fattr; + struct iattr attrs = { }; + int ret; +@@ -9175,6 +9174,7 @@ static int cb_getattr_update_times(struct dentry *dentry, struct nfs4_delegation + if (deleg_attrs_deleg(dp->dl_type)) { + struct timespec64 atime = inode_get_atime(inode); + struct timespec64 mtime = inode_get_mtime(inode); ++ struct timespec64 now = current_time(inode); + + attrs.ia_atime = ncf->ncf_cb_atime; + attrs.ia_mtime = ncf->ncf_cb_mtime; +@@ -9183,12 +9183,12 @@ static int cb_getattr_update_times(struct dentry *dentry, struct nfs4_delegation + attrs.ia_valid |= ATTR_ATIME | ATTR_ATIME_SET; + + if (set_cb_time(&attrs.ia_mtime, &mtime, &now)) { +- attrs.ia_valid |= ATTR_CTIME | ATTR_MTIME | ATTR_MTIME_SET; ++ attrs.ia_valid |= ATTR_CTIME | ATTR_CTIME_SET | ++ ATTR_MTIME | ATTR_MTIME_SET; + attrs.ia_ctime = attrs.ia_mtime; + } + } else { + attrs.ia_valid |= ATTR_MTIME | ATTR_CTIME; +- attrs.ia_mtime = attrs.ia_ctime = now; + } + + if (!attrs.ia_valid) +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index 1f3a20360d0c2..a00300b287754 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -539,7 +539,8 @@ nfsd4_decode_fattr4(struct nfsd4_compoundargs *argp, u32 *bmval, u32 bmlen, + iattr->ia_mtime.tv_nsec = modify.nseconds; + iattr->ia_ctime.tv_sec = modify.seconds; + iattr->ia_ctime.tv_nsec = modify.nseconds; +- iattr->ia_valid |= ATTR_CTIME | ATTR_MTIME | ATTR_MTIME_SET | ATTR_DELEG; ++ iattr->ia_valid |= ATTR_CTIME | ATTR_CTIME_SET | ++ ATTR_MTIME | ATTR_MTIME_SET | ATTR_DELEG; + } + + /* request sanity: did attrlist4 contain the expected number of words? */ +-- +2.51.0 + diff --git a/queue-6.17/perf-arm_spe-correct-memory-level-for-remote-access.patch b/queue-6.17/perf-arm_spe-correct-memory-level-for-remote-access.patch new file mode 100644 index 0000000000..e500887d7c --- /dev/null +++ b/queue-6.17/perf-arm_spe-correct-memory-level-for-remote-access.patch @@ -0,0 +1,49 @@ +From af8c8c7934236b3aa89df66e094a8e1aecffb64c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 16:42:09 +0100 +Subject: perf arm_spe: Correct memory level for remote access + +From: Leo Yan + +[ Upstream commit cb300e3515057fb555983ce47e8acc86a5c69c3c ] + +For remote accesses, the data source packet does not contain information +about the memory level. To avoid misinformation, set the memory level to +NA (Not Available). + +Fixes: 4e6430cbb1a9f1dc ("perf arm-spe: Use SPE data source for neoverse cores") +Reviewed-by: James Clark +Signed-off-by: Leo Yan +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ali Saidi +Cc: German Gomez +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Will Deacon +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/arm-spe.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c +index 8ecf7142dcd87..3086dad92965a 100644 +--- a/tools/perf/util/arm-spe.c ++++ b/tools/perf/util/arm-spe.c +@@ -670,8 +670,8 @@ static void arm_spe__synth_data_source_common(const struct arm_spe_record *recor + * socket + */ + case ARM_SPE_COMMON_DS_REMOTE: +- data_src->mem_lvl = PERF_MEM_LVL_REM_CCE1; +- data_src->mem_lvl_num = PERF_MEM_LVLNUM_ANY_CACHE; ++ data_src->mem_lvl = PERF_MEM_LVL_NA; ++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_NA; + data_src->mem_remote = PERF_MEM_REMOTE_REMOTE; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; + break; +-- +2.51.0 + diff --git a/queue-6.17/perf-arm_spe-correct-setting-remote-access.patch b/queue-6.17/perf-arm_spe-correct-setting-remote-access.patch new file mode 100644 index 0000000000..a6fad92e98 --- /dev/null +++ b/queue-6.17/perf-arm_spe-correct-setting-remote-access.patch @@ -0,0 +1,46 @@ +From 835dc3441e87287037cc064b4b631c757fc1d843 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 16:42:08 +0100 +Subject: perf arm_spe: Correct setting remote access + +From: Leo Yan + +[ Upstream commit 039fd0634a0629132432632d7ac9a14915406b5c ] + +Set the mem_remote field for a remote access to appropriately represent +the event. + +Fixes: a89dbc9b988f3ba8 ("perf arm-spe: Set sample's data source field") +Reviewed-by: James Clark +Signed-off-by: Leo Yan +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ali Saidi +Cc: German Gomez +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Will Deacon +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/arm-spe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c +index 8942fa598a84f..8ecf7142dcd87 100644 +--- a/tools/perf/util/arm-spe.c ++++ b/tools/perf/util/arm-spe.c +@@ -839,7 +839,7 @@ static void arm_spe__synth_memory_level(const struct arm_spe_record *record, + } + + if (record->type & ARM_SPE_REMOTE_ACCESS) +- data_src->mem_lvl |= PERF_MEM_LVL_REM_CCE1; ++ data_src->mem_remote = PERF_MEM_REMOTE_REMOTE; + } + + static bool arm_spe__synth_ds(struct arm_spe_queue *speq, +-- +2.51.0 + diff --git a/queue-6.17/perf-bpf-filter-fix-opts-declaration-on-older-libbpf.patch b/queue-6.17/perf-bpf-filter-fix-opts-declaration-on-older-libbpf.patch new file mode 100644 index 0000000000..56626c222f --- /dev/null +++ b/queue-6.17/perf-bpf-filter-fix-opts-declaration-on-older-libbpf.patch @@ -0,0 +1,69 @@ +From 199c7eb68a844773bb415ebbfdc2f808f55d508d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 22:35:49 -0700 +Subject: perf bpf-filter: Fix opts declaration on older libbpfs + +From: Ian Rogers + +[ Upstream commit 3a0f56d72a7575f03187a85b7869c76a862b40ab ] + +Building perf with LIBBPF_DYNAMIC (ie not the default static linking of +libbpf with perf) is breaking as the libbpf isn't version 1.7 or newer, +where dont_enable is added to bpf_perf_event_opts. + +To avoid this breakage add a compile time version check and don't +declare the variable when not present. + +Fixes: 5e2ac8e8571df54d ("perf bpf-filter: Enable events manually") +Signed-off-by: Ian Rogers +Tested-by: Arnaldo Carvalho de Melo +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Alexei Starovoitov +Cc: bpf@vger.kernel.org +Cc: Hao Ge +Cc: Ilya Leoshkevich +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Thomas Richter +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/bpf-filter.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/tools/perf/util/bpf-filter.c b/tools/perf/util/bpf-filter.c +index a0b11f35395f8..92308c38fbb56 100644 +--- a/tools/perf/util/bpf-filter.c ++++ b/tools/perf/util/bpf-filter.c +@@ -443,6 +443,10 @@ static int create_idx_hash(struct evsel *evsel, struct perf_bpf_filter_entry *en + return -1; + } + ++#define LIBBPF_CURRENT_VERSION_GEQ(major, minor) \ ++ (LIBBPF_MAJOR_VERSION > (major) || \ ++ (LIBBPF_MAJOR_VERSION == (major) && LIBBPF_MINOR_VERSION >= (minor))) ++ + int perf_bpf_filter__prepare(struct evsel *evsel, struct target *target) + { + int i, x, y, fd, ret; +@@ -451,8 +455,12 @@ int perf_bpf_filter__prepare(struct evsel *evsel, struct target *target) + struct bpf_link *link; + struct perf_bpf_filter_entry *entry; + bool needs_idx_hash = !target__has_cpu(target); ++#if LIBBPF_CURRENT_VERSION_GEQ(1, 7) + DECLARE_LIBBPF_OPTS(bpf_perf_event_opts, pe_opts, + .dont_enable = true); ++#else ++ DECLARE_LIBBPF_OPTS(bpf_perf_event_opts, pe_opts); ++#endif + + entry = calloc(MAX_FILTERS, sizeof(*entry)); + if (entry == NULL) +-- +2.51.0 + diff --git a/queue-6.17/perf-bpf_counter-fix-handling-of-cpumap-fixing-hybri.patch b/queue-6.17/perf-bpf_counter-fix-handling-of-cpumap-fixing-hybri.patch new file mode 100644 index 0000000000..b60cbece92 --- /dev/null +++ b/queue-6.17/perf-bpf_counter-fix-handling-of-cpumap-fixing-hybri.patch @@ -0,0 +1,166 @@ +From f2c2b010394e2fbdf30c8df8446c9d156c45ac74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 11:12:28 -0700 +Subject: perf bpf_counter: Fix handling of cpumap fixing hybrid + +From: Ian Rogers + +[ Upstream commit b91917c0c6fa6df97ec0222d8d6285ab2d60c21b ] + +Don't open evsels on all CPUs, open them just on the CPUs they +support. This avoids opening say an e-core event on a p-core and +getting a failure - achieve this by getting rid of the "all_cpu_map". + +In install_pe functions don't use the cpu_map_idx as a CPU number, +translate the cpu_map_idx, which is a dense index into the cpu_map +skipping holes at the beginning, to a proper CPU number. + +Before: +``` +$ perf stat --bpf-counters -a -e cycles,instructions -- sleep 1 + + Performance counter stats for 'system wide': + + cpu_atom/cycles/ + 566,270,672 cpu_core/cycles/ + cpu_atom/instructions/ + 572,792,836 cpu_core/instructions/ # 1.01 insn per cycle + + 1.001595384 seconds time elapsed +``` + +After: +``` +$ perf stat --bpf-counters -a -e cycles,instructions -- sleep 1 + + Performance counter stats for 'system wide': + + 443,299,201 cpu_atom/cycles/ + 1,233,919,737 cpu_core/cycles/ + 213,634,112 cpu_atom/instructions/ # 0.48 insn per cycle + 2,758,965,527 cpu_core/instructions/ # 2.24 insn per cycle + + 1.001699485 seconds time elapsed +``` + +Fixes: 7fac83aaf2eecc9e ("perf stat: Introduce 'bperf' to share hardware PMCs with BPF") +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: bpf@vger.kernel.org +Cc: Gabriele Monaco +Cc: Howard Chu +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Song Liu +Cc: Tengda Wu +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/bpf_counter.c | 26 ++++++++++---------------- + tools/perf/util/bpf_counter_cgroup.c | 3 ++- + 2 files changed, 12 insertions(+), 17 deletions(-) + +diff --git a/tools/perf/util/bpf_counter.c b/tools/perf/util/bpf_counter.c +index 73fcafbffc6a6..ed88ba570c80a 100644 +--- a/tools/perf/util/bpf_counter.c ++++ b/tools/perf/util/bpf_counter.c +@@ -278,6 +278,7 @@ static int bpf_program_profiler__install_pe(struct evsel *evsel, int cpu_map_idx + { + struct bpf_prog_profiler_bpf *skel; + struct bpf_counter *counter; ++ int cpu = perf_cpu_map__cpu(evsel->core.cpus, cpu_map_idx).cpu; + int ret; + + list_for_each_entry(counter, &evsel->bpf_counter_list, list) { +@@ -285,7 +286,7 @@ static int bpf_program_profiler__install_pe(struct evsel *evsel, int cpu_map_idx + assert(skel != NULL); + + ret = bpf_map_update_elem(bpf_map__fd(skel->maps.events), +- &cpu_map_idx, &fd, BPF_ANY); ++ &cpu, &fd, BPF_ANY); + if (ret) + return ret; + } +@@ -393,7 +394,6 @@ static int bperf_check_target(struct evsel *evsel, + return 0; + } + +-static struct perf_cpu_map *all_cpu_map; + static __u32 filter_entry_cnt; + + static int bperf_reload_leader_program(struct evsel *evsel, int attr_map_fd, +@@ -437,7 +437,7 @@ static int bperf_reload_leader_program(struct evsel *evsel, int attr_map_fd, + * following evsel__open_per_cpu call + */ + evsel->leader_skel = skel; +- evsel__open_per_cpu(evsel, all_cpu_map, -1); ++ evsel__open(evsel, evsel->core.cpus, evsel->core.threads); + + out: + bperf_leader_bpf__destroy(skel); +@@ -475,12 +475,6 @@ static int bperf__load(struct evsel *evsel, struct target *target) + if (bperf_check_target(evsel, target, &filter_type, &filter_entry_cnt)) + return -1; + +- if (!all_cpu_map) { +- all_cpu_map = perf_cpu_map__new_online_cpus(); +- if (!all_cpu_map) +- return -1; +- } +- + evsel->bperf_leader_prog_fd = -1; + evsel->bperf_leader_link_fd = -1; + +@@ -598,9 +592,10 @@ static int bperf__load(struct evsel *evsel, struct target *target) + static int bperf__install_pe(struct evsel *evsel, int cpu_map_idx, int fd) + { + struct bperf_leader_bpf *skel = evsel->leader_skel; ++ int cpu = perf_cpu_map__cpu(evsel->core.cpus, cpu_map_idx).cpu; + + return bpf_map_update_elem(bpf_map__fd(skel->maps.events), +- &cpu_map_idx, &fd, BPF_ANY); ++ &cpu, &fd, BPF_ANY); + } + + /* +@@ -609,13 +604,12 @@ static int bperf__install_pe(struct evsel *evsel, int cpu_map_idx, int fd) + */ + static int bperf_sync_counters(struct evsel *evsel) + { +- int num_cpu, i, cpu; ++ struct perf_cpu cpu; ++ int idx; ++ ++ perf_cpu_map__for_each_cpu(cpu, idx, evsel->core.cpus) ++ bperf_trigger_reading(evsel->bperf_leader_prog_fd, cpu.cpu); + +- num_cpu = perf_cpu_map__nr(all_cpu_map); +- for (i = 0; i < num_cpu; i++) { +- cpu = perf_cpu_map__cpu(all_cpu_map, i).cpu; +- bperf_trigger_reading(evsel->bperf_leader_prog_fd, cpu); +- } + return 0; + } + +diff --git a/tools/perf/util/bpf_counter_cgroup.c b/tools/perf/util/bpf_counter_cgroup.c +index 6ff42619de12b..883ce8a670bcd 100644 +--- a/tools/perf/util/bpf_counter_cgroup.c ++++ b/tools/perf/util/bpf_counter_cgroup.c +@@ -185,7 +185,8 @@ static int bperf_cgrp__load(struct evsel *evsel, + } + + static int bperf_cgrp__install_pe(struct evsel *evsel __maybe_unused, +- int cpu __maybe_unused, int fd __maybe_unused) ++ int cpu_map_idx __maybe_unused, ++ int fd __maybe_unused) + { + /* nothing to do */ + return 0; +-- +2.51.0 + diff --git a/queue-6.17/perf-build-id-ensure-snprintf-string-is-empty-when-s.patch b/queue-6.17/perf-build-id-ensure-snprintf-string-is-empty-when-s.patch new file mode 100644 index 0000000000..745eab7331 --- /dev/null +++ b/queue-6.17/perf-build-id-ensure-snprintf-string-is-empty-when-s.patch @@ -0,0 +1,57 @@ +From 6d543dcaa8625b4443d3cb732032d41766749c9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 10:24:16 -0700 +Subject: perf build-id: Ensure snprintf string is empty when size is 0 + +From: Ian Rogers + +[ Upstream commit 0dc96cae063cbf9ebf6631b33b08e9ba02324248 ] + +The string result of build_id__snprintf() is unconditionally used in +places like dsos__fprintf_buildid_cb(). If the build id has size 0 then +this creates a use of uninitialized memory. Add null termination for the +size 0 case. + +A similar fix was written by Jiri Olsa in commit 6311951d4f8f28c4 ("perf +tools: Initialize output buffer in build_id__sprintf") but lost in the +transition to snprintf. + +Fixes: fccaaf6fbbc59910 ("perf build-id: Change sprintf functions to snprintf") +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Howard Chu +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/build-id.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/tools/perf/util/build-id.c b/tools/perf/util/build-id.c +index bf7f3268b9a2f..35505a1ffd111 100644 +--- a/tools/perf/util/build-id.c ++++ b/tools/perf/util/build-id.c +@@ -86,6 +86,13 @@ int build_id__snprintf(const struct build_id *build_id, char *bf, size_t bf_size + { + size_t offs = 0; + ++ if (build_id->size == 0) { ++ /* Ensure bf is always \0 terminated. */ ++ if (bf_size > 0) ++ bf[0] = '\0'; ++ return 0; ++ } ++ + for (size_t i = 0; i < build_id->size && offs < bf_size; ++i) + offs += snprintf(bf + offs, bf_size - offs, "%02x", build_id->data[i]); + +-- +2.51.0 + diff --git a/queue-6.17/perf-completely-remove-possibility-to-override-max_n.patch b/queue-6.17/perf-completely-remove-possibility-to-override-max_n.patch new file mode 100644 index 0000000000..76d32863ce --- /dev/null +++ b/queue-6.17/perf-completely-remove-possibility-to-override-max_n.patch @@ -0,0 +1,74 @@ +From f0593c7524ab17e88e97dab8b7dd69547ae7a07a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Aug 2025 11:57:15 +0200 +Subject: perf: Completely remove possibility to override MAX_NR_CPUS + +From: Christophe Leroy + +[ Upstream commit 6f8fb022ef2c6694e47f6e2f5676eb63be66c208 ] + +Commit 21b8732eb447 ("perf tools: Allow overriding MAX_NR_CPUS at +compile time") added the capability to override MAX_NR_CPUS. At +that time it was necessary to reduce the huge amount of RAM used +by static stats variables. + +But this has been unnecessary since commit 6a1e2c5c2673 ("perf stat: +Remove a set of shadow stats static variables"), and +commit e8399d34d568 ("libperf cpumap: Hide/reduce scope of +MAX_NR_CPUS") broke the build in that case because it failed to +add the guard around the new definition of MAX_NR_CPUS. + +So cleanup things and remove guards completely to officialise it +is not necessary anymore to override MAX_NR_CPUS. + +Fixes: e8399d34d568d61c ("libperf cpumap: Hide/reduce scope of MAX_NR_CPUS") +Signed-off-by: Christophe Leroy +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Leo Yan +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: https://lore.kernel.org/all/8c8553387ebf904a9e5a93eaf643cb01164d9fb3.1736188471.git.christophe.leroy@csgroup.eu/ +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/perf.h | 2 -- + tools/perf/util/bpf_skel/kwork_top.bpf.c | 2 -- + 2 files changed, 4 deletions(-) + +diff --git a/tools/perf/perf.h b/tools/perf/perf.h +index 3cb40965549f5..e004178472d9e 100644 +--- a/tools/perf/perf.h ++++ b/tools/perf/perf.h +@@ -2,9 +2,7 @@ + #ifndef _PERF_PERF_H + #define _PERF_PERF_H + +-#ifndef MAX_NR_CPUS + #define MAX_NR_CPUS 4096 +-#endif + + enum perf_affinity { + PERF_AFFINITY_SYS = 0, +diff --git a/tools/perf/util/bpf_skel/kwork_top.bpf.c b/tools/perf/util/bpf_skel/kwork_top.bpf.c +index 73e32e0630301..6673386302e2f 100644 +--- a/tools/perf/util/bpf_skel/kwork_top.bpf.c ++++ b/tools/perf/util/bpf_skel/kwork_top.bpf.c +@@ -18,9 +18,7 @@ enum kwork_class_type { + }; + + #define MAX_ENTRIES 102400 +-#ifndef MAX_NR_CPUS + #define MAX_NR_CPUS 4096 +-#endif + #define PF_KTHREAD 0x00200000 + #define MAX_COMMAND_LEN 16 + +-- +2.51.0 + diff --git a/queue-6.17/perf-disasm-avoid-undefined-behavior-in-incrementing.patch b/queue-6.17/perf-disasm-avoid-undefined-behavior-in-incrementing.patch new file mode 100644 index 0000000000..30815cc7aa --- /dev/null +++ b/queue-6.17/perf-disasm-avoid-undefined-behavior-in-incrementing.patch @@ -0,0 +1,70 @@ +From a98cfdc4be5abf41993016f6cbdb6242d76f23f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:15 -0700 +Subject: perf disasm: Avoid undefined behavior in incrementing NULL + +From: Ian Rogers + +[ Upstream commit 78d853512d6f979cf0cc41566e4f6cd82995ff34 ] + +Incrementing NULL is undefined behavior and triggers ubsan during the +perf annotate test. + +Split a compound statement over two lines to avoid this. + +Fixes: 98f69a573c668a18 ("perf annotate: Split out util/disasm.c") +Reviewed-by: Collin Funk +Reviewed-by: James Clark +Reviewed-by: Kuan-Wei Chiu +Signed-off-by: Ian Rogers +Acked-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Blake Jones +Cc: Chun-Tse Shao +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jan Polensky +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Li Huafei +Cc: Mark Rutland +Cc: Nam Cao +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Steinar H. Gunderson +Cc: Thomas Gleixner +Link: https://lore.kernel.org/r/20250821163820.1132977-2-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/disasm.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/disasm.c b/tools/perf/util/disasm.c +index b1e4919d016f1..e257bd918c891 100644 +--- a/tools/perf/util/disasm.c ++++ b/tools/perf/util/disasm.c +@@ -390,13 +390,16 @@ static int jump__parse(struct arch *arch, struct ins_operands *ops, struct map_s + * skip over possible up to 2 operands to get to address, e.g.: + * tbnz w0, #26, ffff0000083cd190 + */ +- if (c++ != NULL) { ++ if (c != NULL) { ++ c++; + ops->target.addr = strtoull(c, NULL, 16); + if (!ops->target.addr) { + c = strchr(c, ','); + c = validate_comma(c, ops); +- if (c++ != NULL) ++ if (c != NULL) { ++ c++; + ops->target.addr = strtoull(c, NULL, 16); ++ } + } + } else { + ops->target.addr = strtoull(ops->raw, NULL, 16); +-- +2.51.0 + diff --git a/queue-6.17/perf-drm_pmu-fix-fd_dir-leaks-in-for_each_drm_fdinfo.patch b/queue-6.17/perf-drm_pmu-fix-fd_dir-leaks-in-for_each_drm_fdinfo.patch new file mode 100644 index 0000000000..26723efc27 --- /dev/null +++ b/queue-6.17/perf-drm_pmu-fix-fd_dir-leaks-in-for_each_drm_fdinfo.patch @@ -0,0 +1,51 @@ +From d6d0d092a923936e3c12b01eb555daadefa80040 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 14:52:03 +0800 +Subject: perf drm_pmu: Fix fd_dir leaks in for_each_drm_fdinfo_in_dir() + +From: GuoHan Zhao + +[ Upstream commit baa03483fdf3545f2b223a4ca775e1938d956284 ] + +Fix file descriptor leak when callback function returns error. The +function was directly returning without closing fdinfo_dir_fd and +fd_dir when cb() returned non-zero value. + +Fixes: 28917cb17f9df9c2 ("perf drm_pmu: Add a tool like PMU to expose DRM information") +Reviewed-by: Ian Rogers +Reviewed-by: Markus Elfring +Reviewed-by: Namhyung Kim +Signed-off-by: GuoHan Zhao +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20250908065203.22187-1-zhaoguohan@kylinos.cn +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/drm_pmu.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/drm_pmu.c b/tools/perf/util/drm_pmu.c +index 988890f37ba7a..98d4d2b556d4e 100644 +--- a/tools/perf/util/drm_pmu.c ++++ b/tools/perf/util/drm_pmu.c +@@ -458,8 +458,10 @@ static int for_each_drm_fdinfo_in_dir(int (*cb)(void *args, int fdinfo_dir_fd, c + } + ret = cb(args, fdinfo_dir_fd, fd_entry->d_name); + if (ret) +- return ret; ++ goto close_fdinfo; + } ++ ++close_fdinfo: + if (fdinfo_dir_fd != -1) + close(fdinfo_dir_fd); + closedir(fd_dir); +-- +2.51.0 + diff --git a/queue-6.17/perf-evsel-avoid-container_of-on-a-null-leader.patch b/queue-6.17/perf-evsel-avoid-container_of-on-a-null-leader.patch new file mode 100644 index 0000000000..0f9c102d63 --- /dev/null +++ b/queue-6.17/perf-evsel-avoid-container_of-on-a-null-leader.patch @@ -0,0 +1,59 @@ +From aee6f9c13327649a3804ce8f622b4f4d512a6ebb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:17 -0700 +Subject: perf evsel: Avoid container_of on a NULL leader + +From: Ian Rogers + +[ Upstream commit 2354479026d726954ff86ce82f4b649637319661 ] + +An evsel should typically have a leader of itself, however, in tests +like 'Sample parsing' a NULL leader may occur and the container_of +will return a corrupt pointer. + +Avoid this with an explicit NULL test. + +Fixes: fba7c86601e2e42d ("libperf: Move 'leader' from tools/perf to perf_evsel::leader") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Acked-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Blake Jones +Cc: Chun-Tse Shao +Cc: Collin Funk +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jan Polensky +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Li Huafei +Cc: Mark Rutland +Cc: Nam Cao +Cc: Peter Zijlstra +Cc: Steinar H. Gunderson +Cc: Thomas Gleixner +Link: https://lore.kernel.org/r/20250821163820.1132977-4-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/evsel.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index d264c143b5925..496f42434327b 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -3935,6 +3935,8 @@ bool evsel__is_hybrid(const struct evsel *evsel) + + struct evsel *evsel__leader(const struct evsel *evsel) + { ++ if (evsel->core.leader == NULL) ++ return NULL; + return container_of(evsel->core.leader, struct evsel, core); + } + +-- +2.51.0 + diff --git a/queue-6.17/perf-evsel-ensure-the-fallback-message-is-always-wri.patch b/queue-6.17/perf-evsel-ensure-the-fallback-message-is-always-wri.patch new file mode 100644 index 0000000000..843a6318a4 --- /dev/null +++ b/queue-6.17/perf-evsel-ensure-the-fallback-message-is-always-wri.patch @@ -0,0 +1,81 @@ +From 7be5c141c881a52c1ed1948e153a326eb0cf7bc1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 10:24:15 -0700 +Subject: perf evsel: Ensure the fallback message is always written to + +From: Ian Rogers + +[ Upstream commit 24937ee839e4bbc097acde73eeed67812bad2d99 ] + +The fallback message is unconditionally printed in places like +record__open(). + +If no fallback is attempted this can lead to printing uninitialized +data, crashes, etc. + +Fixes: c0a54341c0e89333 ("perf evsel: Introduce event fallback method") +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Howard Chu +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/evsel.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index 9c086d743d344..5df59812b80ca 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -3562,7 +3562,7 @@ bool evsel__fallback(struct evsel *evsel, struct target *target, int err, + + /* If event has exclude user then don't exclude kernel. */ + if (evsel->core.attr.exclude_user) +- return false; ++ goto no_fallback; + + /* Is there already the separator in the name. */ + if (strchr(name, '/') || +@@ -3570,7 +3570,7 @@ bool evsel__fallback(struct evsel *evsel, struct target *target, int err, + sep = ""; + + if (asprintf(&new_name, "%s%su", name, sep) < 0) +- return false; ++ goto no_fallback; + + free(evsel->name); + evsel->name = new_name; +@@ -3593,17 +3593,19 @@ bool evsel__fallback(struct evsel *evsel, struct target *target, int err, + sep = ""; + + if (asprintf(&new_name, "%s%sH", name, sep) < 0) +- return false; ++ goto no_fallback; + + free(evsel->name); + evsel->name = new_name; + /* Apple M1 requires exclude_guest */ +- scnprintf(msg, msgsize, "trying to fall back to excluding guest samples"); ++ scnprintf(msg, msgsize, "Trying to fall back to excluding guest samples"); + evsel->core.attr.exclude_guest = 1; + + return true; + } +- ++no_fallback: ++ scnprintf(msg, msgsize, "No fallback found for '%s' for error %d", ++ evsel__name(evsel), err); + return false; + } + +-- +2.51.0 + diff --git a/queue-6.17/perf-evsel-fix-uniquification-when-pmu-given-without.patch b/queue-6.17/perf-evsel-fix-uniquification-when-pmu-given-without.patch new file mode 100644 index 0000000000..9dcbe0258f --- /dev/null +++ b/queue-6.17/perf-evsel-fix-uniquification-when-pmu-given-without.patch @@ -0,0 +1,117 @@ +From 20dbd1e1987c837e5d4b13aa76b57b2d90d20744 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 15:22:01 -0700 +Subject: perf evsel: Fix uniquification when PMU given without suffix + +From: Ian Rogers + +[ Upstream commit 693101792e45eefc888c7ba10b91108047399f5d ] + +The PMU name is appearing twice in: +``` +$ perf stat -e uncore_imc_free_running/data_total/ -A true + + Performance counter stats for 'system wide': + +CPU0 1.57 MiB uncore_imc_free_running_0/uncore_imc_free_running,data_total/ +CPU0 1.58 MiB uncore_imc_free_running_1/uncore_imc_free_running,data_total/ + 0.000892376 seconds time elapsed +``` + +Use the pmu_name_len_no_suffix to avoid this problem. + +Committer testing: + +After this patch: + + root@x1:~# perf stat -e uncore_imc_free_running/data_total/ -A true + + Performance counter stats for 'system wide': + + CPU0 1.69 MiB uncore_imc_free_running_0/data_total/ + CPU0 1.68 MiB uncore_imc_free_running_1/data_total/ + + 0.002141605 seconds time elapsed + + root@x1:~# + +Fixes: 7d45f402d3117e0b ("perf evlist: Make uniquifying counter names consistent") +Signed-off-by: Ian Rogers +Tested-by: Arnaldo Carvalho de Melo +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Chun-Tse Shao +Cc: Howard Chu +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/evsel.c | 28 ++++++++++++++++++---------- + 1 file changed, 18 insertions(+), 10 deletions(-) + +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index 496f42434327b..9c086d743d344 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -4050,9 +4050,9 @@ bool evsel__set_needs_uniquify(struct evsel *counter, const struct perf_stat_con + + void evsel__uniquify_counter(struct evsel *counter) + { +- const char *name, *pmu_name; +- char *new_name, *config; +- int ret; ++ const char *name, *pmu_name, *config; ++ char *new_name; ++ int len, ret; + + /* No uniquification necessary. */ + if (!counter->needs_uniquify) +@@ -4066,15 +4066,23 @@ void evsel__uniquify_counter(struct evsel *counter) + counter->uniquified_name = true; + + name = evsel__name(counter); ++ config = strchr(name, '/'); + pmu_name = counter->pmu->name; +- /* Already prefixed by the PMU name. */ +- if (!strncmp(name, pmu_name, strlen(pmu_name))) +- return; + +- config = strchr(name, '/'); +- if (config) { +- int len = config - name; ++ /* Already prefixed by the PMU name? */ ++ len = pmu_name_len_no_suffix(pmu_name); ++ ++ if (!strncmp(name, pmu_name, len)) { ++ /* ++ * If the PMU name is there, then there is no sense in not ++ * having a slash. Do this for robustness. ++ */ ++ if (config == NULL) ++ config = name - 1; + ++ ret = asprintf(&new_name, "%s/%s", pmu_name, config + 1); ++ } else if (config) { ++ len = config - name; + if (config[1] == '/') { + /* case: event// */ + ret = asprintf(&new_name, "%s/%.*s/%s", pmu_name, len, name, config + 2); +@@ -4086,7 +4094,7 @@ void evsel__uniquify_counter(struct evsel *counter) + config = strchr(name, ':'); + if (config) { + /* case: event:.. */ +- int len = config - name; ++ len = config - name; + + ret = asprintf(&new_name, "%s/%.*s/%s", pmu_name, len, name, config + 1); + } else { +-- +2.51.0 + diff --git a/queue-6.17/perf-parse-events-handle-fake-pmus-in-cpu-terms.patch b/queue-6.17/perf-parse-events-handle-fake-pmus-in-cpu-terms.patch new file mode 100644 index 0000000000..a7a8e56d04 --- /dev/null +++ b/queue-6.17/perf-parse-events-handle-fake-pmus-in-cpu-terms.patch @@ -0,0 +1,392 @@ +From 3b0d6e523e8139de16f76adecbed9894a34ffb6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Aug 2025 12:03:57 -0700 +Subject: perf parse-events: Handle fake PMUs in CPU terms +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ian Rogers + +[ Upstream commit 1a461a62fb422db9cf870a4f184885cc69873b7f ] + +The "Parsing of PMU event table metrics with fake PMUs" will test +metrics on machines/models that may be missing a PMU, in such a case +the fake_pmu should be used to avoid errors. + +Metrics that get the cpumask from a different PMU, such as +"tsc/cpu=cpu_atom/", also need to be resilient in this test. + +The parse_events_state fake_pmu is set when missing PMUs should be +ignored. + +So that it can be queried, pass it to the config term functions, as well +as to get_config_cpu, then ignore failures when fake_pmu is set. + +Some minor code refactoring to cut down on the indent and remove some +redundant checks. + +Fixes: bd741d80dc65922c ("perf parse-events: Allow the cpu term to be a PMU or CPU range") +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Andreas Färber +Cc: Caleb Biggers +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Kan Liang +Cc: linux-actions@lists.infradead.org +Cc: Manivannan Sadhasivam +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Thomas Falcon +Cc: Weilin Wang +Link: https://lore.kernel.org/r/20250818190416.145274-2-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/parse-events.c | 116 +++++++++++++++++---------------- + 1 file changed, 60 insertions(+), 56 deletions(-) + +diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c +index 8282ddf68b983..0026cff4d69e4 100644 +--- a/tools/perf/util/parse-events.c ++++ b/tools/perf/util/parse-events.c +@@ -126,7 +126,8 @@ static char *get_config_name(const struct parse_events_terms *head_terms) + return get_config_str(head_terms, PARSE_EVENTS__TERM_TYPE_NAME); + } + +-static struct perf_cpu_map *get_config_cpu(const struct parse_events_terms *head_terms) ++static struct perf_cpu_map *get_config_cpu(const struct parse_events_terms *head_terms, ++ bool fake_pmu) + { + struct parse_events_term *term; + struct perf_cpu_map *cpus = NULL; +@@ -135,24 +136,33 @@ static struct perf_cpu_map *get_config_cpu(const struct parse_events_terms *head + return NULL; + + list_for_each_entry(term, &head_terms->terms, list) { +- if (term->type_term == PARSE_EVENTS__TERM_TYPE_CPU) { +- struct perf_cpu_map *term_cpus; ++ struct perf_cpu_map *term_cpus; + +- if (term->type_val == PARSE_EVENTS__TERM_TYPE_NUM) { +- term_cpus = perf_cpu_map__new_int(term->val.num); ++ if (term->type_term != PARSE_EVENTS__TERM_TYPE_CPU) ++ continue; ++ ++ if (term->type_val == PARSE_EVENTS__TERM_TYPE_NUM) { ++ term_cpus = perf_cpu_map__new_int(term->val.num); ++ } else { ++ struct perf_pmu *pmu = perf_pmus__find(term->val.str); ++ ++ if (pmu) { ++ term_cpus = pmu->is_core && perf_cpu_map__is_empty(pmu->cpus) ++ ? cpu_map__online() ++ : perf_cpu_map__get(pmu->cpus); + } else { +- struct perf_pmu *pmu = perf_pmus__find(term->val.str); +- +- if (pmu && perf_cpu_map__is_empty(pmu->cpus)) +- term_cpus = pmu->is_core ? cpu_map__online() : NULL; +- else if (pmu) +- term_cpus = perf_cpu_map__get(pmu->cpus); +- else +- term_cpus = perf_cpu_map__new(term->val.str); ++ term_cpus = perf_cpu_map__new(term->val.str); ++ if (!term_cpus && fake_pmu) { ++ /* ++ * Assume the PMU string makes sense on a different ++ * machine and fake a value with all online CPUs. ++ */ ++ term_cpus = cpu_map__online(); ++ } + } +- perf_cpu_map__merge(&cpus, term_cpus); +- perf_cpu_map__put(term_cpus); + } ++ perf_cpu_map__merge(&cpus, term_cpus); ++ perf_cpu_map__put(term_cpus); + } + + return cpus; +@@ -369,13 +379,13 @@ static int parse_aliases(const char *str, const char *const names[][EVSEL__MAX_A + + typedef int config_term_func_t(struct perf_event_attr *attr, + struct parse_events_term *term, +- struct parse_events_error *err); ++ struct parse_events_state *parse_state); + static int config_term_common(struct perf_event_attr *attr, + struct parse_events_term *term, +- struct parse_events_error *err); ++ struct parse_events_state *parse_state); + static int config_attr(struct perf_event_attr *attr, + const struct parse_events_terms *head, +- struct parse_events_error *err, ++ struct parse_events_state *parse_state, + config_term_func_t config_term); + + /** +@@ -471,7 +481,7 @@ int parse_events_add_cache(struct list_head *list, int *idx, const char *name, + bool found_supported = false; + const char *config_name = get_config_name(parsed_terms); + const char *metric_id = get_config_metric_id(parsed_terms); +- struct perf_cpu_map *cpus = get_config_cpu(parsed_terms); ++ struct perf_cpu_map *cpus = get_config_cpu(parsed_terms, parse_state->fake_pmu); + int ret = 0; + struct evsel *first_wildcard_match = NULL; + +@@ -514,8 +524,7 @@ int parse_events_add_cache(struct list_head *list, int *idx, const char *name, + found_supported = true; + + if (parsed_terms) { +- if (config_attr(&attr, parsed_terms, parse_state->error, +- config_term_common)) { ++ if (config_attr(&attr, parsed_terms, parse_state, config_term_common)) { + ret = -EINVAL; + goto out_err; + } +@@ -767,8 +776,7 @@ int parse_events_add_breakpoint(struct parse_events_state *parse_state, + attr.sample_period = 1; + + if (head_config) { +- if (config_attr(&attr, head_config, parse_state->error, +- config_term_common)) ++ if (config_attr(&attr, head_config, parse_state, config_term_common)) + return -EINVAL; + + if (get_config_terms(head_config, &config_terms)) +@@ -903,12 +911,12 @@ void parse_events__shrink_config_terms(void) + + static int config_term_common(struct perf_event_attr *attr, + struct parse_events_term *term, +- struct parse_events_error *err) ++ struct parse_events_state *parse_state) + { +-#define CHECK_TYPE_VAL(type) \ +-do { \ +- if (check_type_val(term, err, PARSE_EVENTS__TERM_TYPE_ ## type)) \ +- return -EINVAL; \ ++#define CHECK_TYPE_VAL(type) \ ++do { \ ++ if (check_type_val(term, parse_state->error, PARSE_EVENTS__TERM_TYPE_ ## type)) \ ++ return -EINVAL; \ + } while (0) + + switch (term->type_term) { +@@ -939,7 +947,7 @@ do { \ + if (strcmp(term->val.str, "no") && + parse_branch_str(term->val.str, + &attr->branch_sample_type)) { +- parse_events_error__handle(err, term->err_val, ++ parse_events_error__handle(parse_state->error, term->err_val, + strdup("invalid branch sample type"), + NULL); + return -EINVAL; +@@ -948,7 +956,7 @@ do { \ + case PARSE_EVENTS__TERM_TYPE_TIME: + CHECK_TYPE_VAL(NUM); + if (term->val.num > 1) { +- parse_events_error__handle(err, term->err_val, ++ parse_events_error__handle(parse_state->error, term->err_val, + strdup("expected 0 or 1"), + NULL); + return -EINVAL; +@@ -990,7 +998,7 @@ do { \ + case PARSE_EVENTS__TERM_TYPE_PERCORE: + CHECK_TYPE_VAL(NUM); + if ((unsigned int)term->val.num > 1) { +- parse_events_error__handle(err, term->err_val, ++ parse_events_error__handle(parse_state->error, term->err_val, + strdup("expected 0 or 1"), + NULL); + return -EINVAL; +@@ -1005,7 +1013,7 @@ do { \ + case PARSE_EVENTS__TERM_TYPE_AUX_SAMPLE_SIZE: + CHECK_TYPE_VAL(NUM); + if (term->val.num > UINT_MAX) { +- parse_events_error__handle(err, term->err_val, ++ parse_events_error__handle(parse_state->error, term->err_val, + strdup("too big"), + NULL); + return -EINVAL; +@@ -1016,7 +1024,7 @@ do { \ + + if (term->type_val == PARSE_EVENTS__TERM_TYPE_NUM) { + if (term->val.num >= (u64)cpu__max_present_cpu().cpu) { +- parse_events_error__handle(err, term->err_val, ++ parse_events_error__handle(parse_state->error, term->err_val, + strdup("too big"), + /*help=*/NULL); + return -EINVAL; +@@ -1028,8 +1036,8 @@ do { \ + break; + + map = perf_cpu_map__new(term->val.str); +- if (!map) { +- parse_events_error__handle(err, term->err_val, ++ if (!map && !parse_state->fake_pmu) { ++ parse_events_error__handle(parse_state->error, term->err_val, + strdup("not a valid PMU or CPU number"), + /*help=*/NULL); + return -EINVAL; +@@ -1042,7 +1050,7 @@ do { \ + case PARSE_EVENTS__TERM_TYPE_LEGACY_CACHE: + case PARSE_EVENTS__TERM_TYPE_HARDWARE: + default: +- parse_events_error__handle(err, term->err_term, ++ parse_events_error__handle(parse_state->error, term->err_term, + strdup(parse_events__term_type_str(term->type_term)), + parse_events_formats_error_string(NULL)); + return -EINVAL; +@@ -1057,7 +1065,7 @@ do { \ + * if an invalid config term is provided for legacy events + * (for example, instructions/badterm/...), which is confusing. + */ +- if (!config_term_avail(term->type_term, err)) ++ if (!config_term_avail(term->type_term, parse_state->error)) + return -EINVAL; + return 0; + #undef CHECK_TYPE_VAL +@@ -1065,7 +1073,7 @@ do { \ + + static int config_term_pmu(struct perf_event_attr *attr, + struct parse_events_term *term, +- struct parse_events_error *err) ++ struct parse_events_state *parse_state) + { + if (term->type_term == PARSE_EVENTS__TERM_TYPE_LEGACY_CACHE) { + struct perf_pmu *pmu = perf_pmus__find_by_type(attr->type); +@@ -1074,7 +1082,7 @@ static int config_term_pmu(struct perf_event_attr *attr, + char *err_str; + + if (asprintf(&err_str, "Failed to find PMU for type %d", attr->type) >= 0) +- parse_events_error__handle(err, term->err_term, ++ parse_events_error__handle(parse_state->error, term->err_term, + err_str, /*help=*/NULL); + return -EINVAL; + } +@@ -1100,7 +1108,7 @@ static int config_term_pmu(struct perf_event_attr *attr, + char *err_str; + + if (asprintf(&err_str, "Failed to find PMU for type %d", attr->type) >= 0) +- parse_events_error__handle(err, term->err_term, ++ parse_events_error__handle(parse_state->error, term->err_term, + err_str, /*help=*/NULL); + return -EINVAL; + } +@@ -1128,12 +1136,12 @@ static int config_term_pmu(struct perf_event_attr *attr, + */ + return 0; + } +- return config_term_common(attr, term, err); ++ return config_term_common(attr, term, parse_state); + } + + static int config_term_tracepoint(struct perf_event_attr *attr, + struct parse_events_term *term, +- struct parse_events_error *err) ++ struct parse_events_state *parse_state) + { + switch (term->type_term) { + case PARSE_EVENTS__TERM_TYPE_CALLGRAPH: +@@ -1147,7 +1155,7 @@ static int config_term_tracepoint(struct perf_event_attr *attr, + case PARSE_EVENTS__TERM_TYPE_AUX_OUTPUT: + case PARSE_EVENTS__TERM_TYPE_AUX_ACTION: + case PARSE_EVENTS__TERM_TYPE_AUX_SAMPLE_SIZE: +- return config_term_common(attr, term, err); ++ return config_term_common(attr, term, parse_state); + case PARSE_EVENTS__TERM_TYPE_USER: + case PARSE_EVENTS__TERM_TYPE_CONFIG: + case PARSE_EVENTS__TERM_TYPE_CONFIG1: +@@ -1166,12 +1174,10 @@ static int config_term_tracepoint(struct perf_event_attr *attr, + case PARSE_EVENTS__TERM_TYPE_HARDWARE: + case PARSE_EVENTS__TERM_TYPE_CPU: + default: +- if (err) { +- parse_events_error__handle(err, term->err_term, ++ parse_events_error__handle(parse_state->error, term->err_term, + strdup(parse_events__term_type_str(term->type_term)), + strdup("valid terms: call-graph,stack-size\n") + ); +- } + return -EINVAL; + } + +@@ -1180,13 +1186,13 @@ static int config_term_tracepoint(struct perf_event_attr *attr, + + static int config_attr(struct perf_event_attr *attr, + const struct parse_events_terms *head, +- struct parse_events_error *err, ++ struct parse_events_state *parse_state, + config_term_func_t config_term) + { + struct parse_events_term *term; + + list_for_each_entry(term, &head->terms, list) +- if (config_term(attr, term, err)) ++ if (config_term(attr, term, parse_state)) + return -EINVAL; + + return 0; +@@ -1378,8 +1384,7 @@ int parse_events_add_tracepoint(struct parse_events_state *parse_state, + if (head_config) { + struct perf_event_attr attr; + +- if (config_attr(&attr, head_config, err, +- config_term_tracepoint)) ++ if (config_attr(&attr, head_config, parse_state, config_term_tracepoint)) + return -EINVAL; + } + +@@ -1408,8 +1413,7 @@ static int __parse_events_add_numeric(struct parse_events_state *parse_state, + } + + if (head_config) { +- if (config_attr(&attr, head_config, parse_state->error, +- config_term_common)) ++ if (config_attr(&attr, head_config, parse_state, config_term_common)) + return -EINVAL; + + if (get_config_terms(head_config, &config_terms)) +@@ -1418,7 +1422,7 @@ static int __parse_events_add_numeric(struct parse_events_state *parse_state, + + name = get_config_name(head_config); + metric_id = get_config_metric_id(head_config); +- cpus = get_config_cpu(head_config); ++ cpus = get_config_cpu(head_config, parse_state->fake_pmu); + ret = __add_event(list, &parse_state->idx, &attr, /*init_attr*/true, name, + metric_id, pmu, &config_terms, first_wildcard_match, + cpus, /*alternate_hw_config=*/PERF_COUNT_HW_MAX) ? 0 : -ENOMEM; +@@ -1531,7 +1535,7 @@ static int parse_events_add_pmu(struct parse_events_state *parse_state, + fix_raw(&parsed_terms, pmu); + + /* Configure attr/terms with a known PMU, this will set hardcoded terms. */ +- if (config_attr(&attr, &parsed_terms, parse_state->error, config_term_pmu)) { ++ if (config_attr(&attr, &parsed_terms, parse_state, config_term_pmu)) { + parse_events_terms__exit(&parsed_terms); + return -EINVAL; + } +@@ -1555,7 +1559,7 @@ static int parse_events_add_pmu(struct parse_events_state *parse_state, + + /* Configure attr/terms again if an alias was expanded. */ + if (alias_rewrote_terms && +- config_attr(&attr, &parsed_terms, parse_state->error, config_term_pmu)) { ++ config_attr(&attr, &parsed_terms, parse_state, config_term_pmu)) { + parse_events_terms__exit(&parsed_terms); + return -EINVAL; + } +@@ -1583,7 +1587,7 @@ static int parse_events_add_pmu(struct parse_events_state *parse_state, + return -EINVAL; + } + +- term_cpu = get_config_cpu(&parsed_terms); ++ term_cpu = get_config_cpu(&parsed_terms, parse_state->fake_pmu); + evsel = __add_event(list, &parse_state->idx, &attr, /*init_attr=*/true, + get_config_name(&parsed_terms), + get_config_metric_id(&parsed_terms), pmu, +-- +2.51.0 + diff --git a/queue-6.17/perf-python-split-clang-options-when-invoking-popen.patch b/queue-6.17/perf-python-split-clang-options-when-invoking-popen.patch new file mode 100644 index 0000000000..39b1ff2793 --- /dev/null +++ b/queue-6.17/perf-python-split-clang-options-when-invoking-popen.patch @@ -0,0 +1,82 @@ +From 427c051a621e097868476e43dc5b3d77b451b5e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Oct 2025 17:21:24 +0100 +Subject: perf python: split Clang options when invoking Popen + +From: Leo Yan + +[ Upstream commit c6a43bc3e8f6102a47da0d2e53428d08f00172fb ] + +When passing a list to subprocess.Popen, each element maps to one argv +token. Current code bundles multiple Clang flags into a single element, +something like: + + cmd = ['clang', + '--target=x86_64-linux-gnu -fintegrated-as -Wno-cast-function-type-mismatch', + 'test-hello.c'] + +So Clang only sees one long, invalid option instead of separate flags, +as a result, the script cannot capture any log via PIPE. + +Fix this by using shlex.split() to separate the string so each option +becomes its own argv element. The fixed list will be: + + cmd = ['clang', + '--target=x86_64-linux-gnu', + '-fintegrated-as', + '-Wno-cast-function-type-mismatch', + 'test-hello.c'] + +Fixes: 09e6f9f98370 ("perf python: Fix splitting CC into compiler and options") +Signed-off-by: Leo Yan +Reviewed-by: Ian Rogers +Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-2-4305590795b2@arm.com +Cc: Palmer Dabbelt +Cc: Albert Ou +Cc: Alexandre Ghiti +Cc: Nick Desaulniers +Cc: Justin Stitt +Cc: Bill Wendling +Cc: Adrian Hunter +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Nathan Chancellor +Cc: James Clark +Cc: linux-riscv@lists.infradead.org +Cc: llvm@lists.linux.dev +Cc: Paul Walmsley +Cc: linux-kernel@vger.kernel.org +Cc: linux-perf-users@vger.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/setup.py | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py +index dd289d15acfd6..9cae2c472f4ad 100644 +--- a/tools/perf/util/setup.py ++++ b/tools/perf/util/setup.py +@@ -1,6 +1,7 @@ + from os import getenv, path + from subprocess import Popen, PIPE + from re import sub ++import shlex + + cc = getenv("CC") + assert cc, "Environment variable CC not set" +@@ -22,7 +23,9 @@ assert srctree, "Environment variable srctree, for the Linux sources, not set" + src_feature_tests = f'{srctree}/tools/build/feature' + + def clang_has_option(option): +- cc_output = Popen([cc, cc_options + option, path.join(src_feature_tests, "test-hello.c") ], stderr=PIPE).stderr.readlines() ++ cmd = shlex.split(f"{cc} {cc_options} {option}") ++ cmd.append(path.join(src_feature_tests, "test-hello.c")) ++ cc_output = Popen(cmd, stderr=PIPE).stderr.readlines() + return [o for o in cc_output if ((b"unknown argument" in o) or (b"is not supported" in o) or (b"unknown warning option" in o))] == [ ] + + if cc_is_clang: +-- +2.51.0 + diff --git a/queue-6.17/perf-session-fix-handling-when-buffer-exceeds-2-gib.patch b/queue-6.17/perf-session-fix-handling-when-buffer-exceeds-2-gib.patch new file mode 100644 index 0000000000..39aa63e357 --- /dev/null +++ b/queue-6.17/perf-session-fix-handling-when-buffer-exceeds-2-gib.patch @@ -0,0 +1,53 @@ +From 3d1d5a69fbba6a65f0b10e2e6770a89d39d80744 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Aug 2025 14:24:40 +0100 +Subject: perf session: Fix handling when buffer exceeds 2 GiB +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leo Yan + +[ Upstream commit c17dda8013495d8132c976cbf349be9949d0fbd1 ] + +If a user specifies an AUX buffer larger than 2 GiB, the returned size +may exceed 0x80000000. Since the err variable is defined as a signed +32-bit integer, such a value overflows and becomes negative. + +As a result, the perf record command reports an error: + + 0x146e8 [0x30]: failed to process type: 71 [Unknown error 183711232] + +Change the type of the err variable to a signed 64-bit integer to +accommodate large buffer sizes correctly. + +Fixes: d5652d865ea734a1 ("perf session: Add ability to skip 4GiB or more") +Reported-by: Tamas Zsoldos +Signed-off-by: Leo Yan +Acked-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Jiri Olsa +Link: https://lore.kernel.org/r/20250808-perf_fix_big_buffer_size-v1-1-45f45444a9a4@arm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/session.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c +index 26ae078278cd6..09af486c83e4f 100644 +--- a/tools/perf/util/session.c ++++ b/tools/perf/util/session.c +@@ -1402,7 +1402,7 @@ static s64 perf_session__process_user_event(struct perf_session *session, + const struct perf_tool *tool = session->tool; + struct perf_sample sample; + int fd = perf_data__fd(session->data); +- int err; ++ s64 err; + + perf_sample__init(&sample, /*all=*/true); + if ((event->header.type != PERF_RECORD_COMPRESSED && +-- +2.51.0 + diff --git a/queue-6.17/perf-test-amd-ibs-swfilt-skip-kernel-tests-if-parano.patch b/queue-6.17/perf-test-amd-ibs-swfilt-skip-kernel-tests-if-parano.patch new file mode 100644 index 0000000000..76e19552e4 --- /dev/null +++ b/queue-6.17/perf-test-amd-ibs-swfilt-skip-kernel-tests-if-parano.patch @@ -0,0 +1,125 @@ +From ac37644019c00b6eb5cbf74392589aac2295f608 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 17:03:50 -0700 +Subject: perf test: AMD IBS swfilt skip kernel tests if paranoia is >1 + +From: Ian Rogers + +[ Upstream commit 2e3501212293c5005873c6ca6bb4f963a7eec442 ] + +If not root and the perf_event_paranoid is set >1 swfilt will fail to +open the event failing the test. Add check to skip the test in that +case. + +Fixes: 0e71bcdcf1f0b10b ("perf test: Add AMD IBS sw filter test") +Reviewed-by: Namhyung Kim +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Collin Funk +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Ravi Bangoria +Link: https://lore.kernel.org/r/20250913000350.1306948-1-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/amd-ibs-swfilt.sh | 51 ++++++++++++++++++------ + 1 file changed, 38 insertions(+), 13 deletions(-) + +diff --git a/tools/perf/tests/shell/amd-ibs-swfilt.sh b/tools/perf/tests/shell/amd-ibs-swfilt.sh +index 7045ec72ba4cf..e7f66df05c4b1 100755 +--- a/tools/perf/tests/shell/amd-ibs-swfilt.sh ++++ b/tools/perf/tests/shell/amd-ibs-swfilt.sh +@@ -1,6 +1,10 @@ + #!/bin/bash + # AMD IBS software filtering + ++ParanoidAndNotRoot() { ++ [ "$(id -u)" != 0 ] && [ "$(cat /proc/sys/kernel/perf_event_paranoid)" -gt $1 ] ++} ++ + echo "check availability of IBS swfilt" + + # check if IBS PMU is available +@@ -16,6 +20,7 @@ if [ ! -f /sys/bus/event_source/devices/ibs_op/format/swfilt ]; then + fi + + echo "run perf record with modifier and swfilt" ++err=0 + + # setting any modifiers should fail + perf record -B -e ibs_op//u -o /dev/null true 2> /dev/null +@@ -31,11 +36,17 @@ if [ $? -ne 0 ]; then + exit 1 + fi + +-# setting it with swfilt=1 should be fine +-perf record -B -e ibs_op/swfilt=1/k -o /dev/null true +-if [ $? -ne 0 ]; then +- echo "[FAIL] IBS op PMU cannot handle swfilt for exclude_user" +- exit 1 ++if ! ParanoidAndNotRoot 1 ++then ++ # setting it with swfilt=1 should be fine ++ perf record -B -e ibs_op/swfilt=1/k -o /dev/null true ++ if [ $? -ne 0 ]; then ++ echo "[FAIL] IBS op PMU cannot handle swfilt for exclude_user" ++ exit 1 ++ fi ++else ++ echo "[SKIP] not root and perf_event_paranoid too high for exclude_user" ++ err=2 + fi + + # check ibs_fetch PMU as well +@@ -46,10 +57,16 @@ if [ $? -ne 0 ]; then + fi + + # check system wide recording +-perf record -aB --synth=no -e ibs_op/swfilt/k -o /dev/null true +-if [ $? -ne 0 ]; then +- echo "[FAIL] IBS op PMU cannot handle swfilt in system-wide mode" +- exit 1 ++if ! ParanoidAndNotRoot 0 ++then ++ perf record -aB --synth=no -e ibs_op/swfilt/k -o /dev/null true ++ if [ $? -ne 0 ]; then ++ echo "[FAIL] IBS op PMU cannot handle swfilt in system-wide mode" ++ exit 1 ++ fi ++else ++ echo "[SKIP] not root and perf_event_paranoid too high for system-wide/exclude_user" ++ err=2 + fi + + echo "check number of samples with swfilt" +@@ -60,8 +77,16 @@ if [ ${kernel_sample} -ne 0 ]; then + exit 1 + fi + +-user_sample=$(perf record -e ibs_fetch/swfilt/k -o- true | perf script -i- -F misc | grep -c ^U) +-if [ ${user_sample} -ne 0 ]; then +- echo "[FAIL] unexpected user samples: " ${user_sample} +- exit 1 ++if ! ParanoidAndNotRoot 1 ++then ++ user_sample=$(perf record -e ibs_fetch/swfilt/k -o- true | perf script -i- -F misc | grep -c ^U) ++ if [ ${user_sample} -ne 0 ]; then ++ echo "[FAIL] unexpected user samples: " ${user_sample} ++ exit 1 ++ fi ++else ++ echo "[SKIP] not root and perf_event_paranoid too high for exclude_user" ++ err=2 + fi ++ ++exit $err +-- +2.51.0 + diff --git a/queue-6.17/perf-test-avoid-uncore_imc-clockticks-in-uniquificat.patch b/queue-6.17/perf-test-avoid-uncore_imc-clockticks-in-uniquificat.patch new file mode 100644 index 0000000000..caded116b6 --- /dev/null +++ b/queue-6.17/perf-test-avoid-uncore_imc-clockticks-in-uniquificat.patch @@ -0,0 +1,209 @@ +From 42d39842155d12ca2a3637bcdc1928942398d2b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 15:22:02 -0700 +Subject: perf test: Avoid uncore_imc/clockticks in uniquification test + +From: Ian Rogers + +[ Upstream commit edaeb4bcf1511fe4e464fff9dd4a3abf6b0096da ] + +The detection of uncore_imc may happen for free running PMUs and the +clockticks event may be present on uncore_clock. Rewrite the test to +detect duplicated/deduplicated events from perf list, not hardcoded to +uncore_imc. + +If perf stat fails then assume it is permissions and skip the test. + +Committer testing: + +Before: + + root@x1:~# perf test -vv uniquifyi + 96: perf stat events uniquifying: + --- start --- + test child forked, pid 220851 + stat event uniquifying test + grep: Unmatched [, [^, [:, [., or [= + Event is not uniquified [Failed] + perf stat -e clockticks -A -o /tmp/__perf_test.stat_output.X7ChD -- true + # started on Fri Sep 19 16:48:38 2025 + + Performance counter stats for 'system wide': + + CPU0 2,310,956 uncore_clock/clockticks/ + + 0.001746771 seconds time elapsed + + ---- end(-1) ---- + 96: perf stat events uniquifying : FAILED! + root@x1:~# + +After: + + root@x1:~# perf test -vv uniquifyi + 96: perf stat events uniquifying: + --- start --- + test child forked, pid 222366 + Uniquification of PMU sysfs events test + Testing event uncore_imc_free_running/data_read/ is uniquified to uncore_imc_free_running_0/data_read/ + Testing event uncore_imc_free_running/data_total/ is uniquified to uncore_imc_free_running_0/data_total/ + Testing event uncore_imc_free_running/data_write/ is uniquified to uncore_imc_free_running_0/data_write/ + Testing event uncore_imc_free_running/data_read/ is uniquified to uncore_imc_free_running_1/data_read/ + Testing event uncore_imc_free_running/data_total/ is uniquified to uncore_imc_free_running_1/data_total/ + Testing event uncore_imc_free_running/data_write/ is uniquified to uncore_imc_free_running_1/data_write/ + ---- end(0) ---- + 96: perf stat events uniquifying : Ok + root@x1:~# + +Fixes: 070b315333ee942f ("perf test: Restrict uniquifying test to machines with 'uncore_imc'") +Signed-off-by: Ian Rogers +Tested-by: Arnaldo Carvalho de Melo +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Chun-Tse Shao +Cc: Howard Chu +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + .../tests/shell/stat+event_uniquifying.sh | 109 ++++++++---------- + 1 file changed, 49 insertions(+), 60 deletions(-) + +diff --git a/tools/perf/tests/shell/stat+event_uniquifying.sh b/tools/perf/tests/shell/stat+event_uniquifying.sh +index bf54bd6c3e2e6..b5dec6b6da369 100755 +--- a/tools/perf/tests/shell/stat+event_uniquifying.sh ++++ b/tools/perf/tests/shell/stat+event_uniquifying.sh +@@ -4,74 +4,63 @@ + + set -e + +-stat_output=$(mktemp /tmp/__perf_test.stat_output.XXXXX) +-perf_tool=perf + err=0 ++stat_output=$(mktemp /tmp/__perf_test.stat_output.XXXXX) + +-test_event_uniquifying() { +- # We use `clockticks` in `uncore_imc` to verify the uniquify behavior. +- pmu="uncore_imc" +- event="clockticks" +- +- # If the `-A` option is added, the event should be uniquified. +- # +- # $perf list -v clockticks +- # +- # List of pre-defined events (to be used in -e or -M): +- # +- # uncore_imc_0/clockticks/ [Kernel PMU event] +- # uncore_imc_1/clockticks/ [Kernel PMU event] +- # uncore_imc_2/clockticks/ [Kernel PMU event] +- # uncore_imc_3/clockticks/ [Kernel PMU event] +- # uncore_imc_4/clockticks/ [Kernel PMU event] +- # uncore_imc_5/clockticks/ [Kernel PMU event] +- # +- # ... +- # +- # $perf stat -e clockticks -A -- true +- # +- # Performance counter stats for 'system wide': +- # +- # CPU0 3,773,018 uncore_imc_0/clockticks/ +- # CPU0 3,609,025 uncore_imc_1/clockticks/ +- # CPU0 0 uncore_imc_2/clockticks/ +- # CPU0 3,230,009 uncore_imc_3/clockticks/ +- # CPU0 3,049,897 uncore_imc_4/clockticks/ +- # CPU0 0 uncore_imc_5/clockticks/ +- # +- # 0.002029828 seconds time elapsed +- +- echo "stat event uniquifying test" +- uniquified_event_array=() ++cleanup() { ++ rm -f "${stat_output}" + +- # Skip if the machine does not have `uncore_imc` device. +- if ! ${perf_tool} list pmu | grep -q ${pmu}; then +- echo "Target does not support PMU ${pmu} [Skipped]" +- err=2 +- return +- fi ++ trap - EXIT TERM INT ++} + +- # Check how many uniquified events. +- while IFS= read -r line; do +- uniquified_event=$(echo "$line" | awk '{print $1}') +- uniquified_event_array+=("${uniquified_event}") +- done < <(${perf_tool} list -v ${event} | grep ${pmu}) ++trap_cleanup() { ++ echo "Unexpected signal in ${FUNCNAME[1]}" ++ cleanup ++ exit 1 ++} ++trap trap_cleanup EXIT TERM INT + +- perf_command="${perf_tool} stat -e $event -A -o ${stat_output} -- true" +- $perf_command ++test_event_uniquifying() { ++ echo "Uniquification of PMU sysfs events test" + +- # Check the output contains all uniquified events. +- for uniquified_event in "${uniquified_event_array[@]}"; do +- if ! cat "${stat_output}" | grep -q "${uniquified_event}"; then +- echo "Event is not uniquified [Failed]" +- echo "${perf_command}" +- cat "${stat_output}" +- err=1 +- break +- fi ++ # Read events from perf list with and without -v. With -v the duplicate PMUs ++ # aren't deduplicated. Note, json events are listed by perf list without a ++ # PMU. ++ read -ra pmu_events <<< "$(perf list --raw pmu)" ++ read -ra pmu_v_events <<< "$(perf list -v --raw pmu)" ++ # For all non-deduplicated events. ++ for pmu_v_event in "${pmu_v_events[@]}"; do ++ # If the event matches an event in the deduplicated events then it musn't ++ # be an event with duplicate PMUs, continue the outer loop. ++ for pmu_event in "${pmu_events[@]}"; do ++ if [[ "$pmu_v_event" == "$pmu_event" ]]; then ++ continue 2 ++ fi ++ done ++ # Strip the suffix from the non-deduplicated event's PMU. ++ event=$(echo "$pmu_v_event" | sed -E 's/_[0-9]+//') ++ for pmu_event in "${pmu_events[@]}"; do ++ if [[ "$event" == "$pmu_event" ]]; then ++ echo "Testing event ${event} is uniquified to ${pmu_v_event}" ++ if ! perf stat -e "$event" -A -o ${stat_output} -- true; then ++ echo "Error running perf stat for event '$event' [Skip]" ++ if [ $err = 0 ]; then ++ err=2 ++ fi ++ continue ++ fi ++ # Ensure the non-deduplicated event appears in the output. ++ if ! grep -q "${pmu_v_event}" "${stat_output}"; then ++ echo "Uniquification of PMU sysfs events test [Failed]" ++ cat "${stat_output}" ++ err=1 ++ fi ++ break ++ fi ++ done + done + } + + test_event_uniquifying +-rm -f "${stat_output}" ++cleanup + exit $err +-- +2.51.0 + diff --git a/queue-6.17/perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch b/queue-6.17/perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch new file mode 100644 index 0000000000..ed73f93599 --- /dev/null +++ b/queue-6.17/perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch @@ -0,0 +1,202 @@ +From 9cea61122d943ed5f07d021ae14f807dfba6236c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 15:22:00 -0700 +Subject: perf test: Don't leak workload gopipe in PERF_RECORD_* + +From: Ian Rogers + +[ Upstream commit 48918cacefd226af44373e914e63304927c0e7dc ] + +The test starts a workload and then opens events. If the events fail +to open, for example because of perf_event_paranoid, the gopipe of the +workload is leaked and the file descriptor leak check fails when the +test exits. To avoid this cancel the workload when opening the events +fails. + +Before: +``` +$ perf test -vv 7 + 7: PERF_RECORD_* events & perf_sample fields: + --- start --- +test child forked, pid 1189568 +Using CPUID GenuineIntel-6-B7-1 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 +sys_perf_event_open failed, error -13 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + exclude_kernel 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 +sys_perf_event_open failed, error -13 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + exclude_kernel 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3 +Attempt to add: software/cpu-clock/ +..after resolving event: software/config=0/ +cpu-clock -> software/cpu-clock/ + ------------------------------------------------------------ +perf_event_attr: + type 1 (PERF_TYPE_SOFTWARE) + size 136 + config 0x9 (PERF_COUNT_SW_DUMMY) + sample_type IP|TID|TIME|CPU + read_format ID|LOST + disabled 1 + inherit 1 + mmap 1 + comm 1 + enable_on_exec 1 + task 1 + sample_id_all 1 + mmap2 1 + comm_exec 1 + ksymbol 1 + bpf_event 1 + { wakeup_events, wakeup_watermark } 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 1189569 cpu 0 group_fd -1 flags 0x8 +sys_perf_event_open failed, error -13 +perf_evlist__open: Permission denied + ---- end(-2) ---- +Leak of file descriptor 6 that opened: 'pipe:[14200347]' + ---- unexpected signal (6) ---- +iFailed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon + #0 0x565358f6666e in child_test_sig_handler builtin-test.c:311 + #1 0x7f29ce849df0 in __restore_rt libc_sigaction.c:0 + #2 0x7f29ce89e95c in __pthread_kill_implementation pthread_kill.c:44 + #3 0x7f29ce849cc2 in raise raise.c:27 + #4 0x7f29ce8324ac in abort abort.c:81 + #5 0x565358f662d4 in check_leaks builtin-test.c:226 + #6 0x565358f6682e in run_test_child builtin-test.c:344 + #7 0x565358ef7121 in start_command run-command.c:128 + #8 0x565358f67273 in start_test builtin-test.c:545 + #9 0x565358f6771d in __cmd_test builtin-test.c:647 + #10 0x565358f682bd in cmd_test builtin-test.c:849 + #11 0x565358ee5ded in run_builtin perf.c:349 + #12 0x565358ee6085 in handle_internal_command perf.c:401 + #13 0x565358ee61de in run_argv perf.c:448 + #14 0x565358ee6527 in main perf.c:555 + #15 0x7f29ce833ca8 in __libc_start_call_main libc_start_call_main.h:74 + #16 0x7f29ce833d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128 + #17 0x565358e391c1 in _start perf[851c1] + 7: PERF_RECORD_* events & perf_sample fields : FAILED! +``` + +After: +``` +$ perf test 7 + 7: PERF_RECORD_* events & perf_sample fields : Skip (permissions) +``` + +Fixes: 16d00fee703866c6 ("perf tests: Move test__PERF_RECORD into separate object") +Signed-off-by: Ian Rogers +Tested-by: Arnaldo Carvalho de Melo +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Chun-Tse Shao +Cc: Howard Chu +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/perf-record.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/tools/perf/tests/perf-record.c b/tools/perf/tests/perf-record.c +index 0b3c37e668717..8c79b5166a058 100644 +--- a/tools/perf/tests/perf-record.c ++++ b/tools/perf/tests/perf-record.c +@@ -115,6 +115,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest + if (err < 0) { + pr_debug("sched__get_first_possible_cpu: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +@@ -126,6 +127,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest + if (sched_setaffinity(evlist->workload.pid, cpu_mask_size, &cpu_mask) < 0) { + pr_debug("sched_setaffinity: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +@@ -137,6 +139,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest + if (err < 0) { + pr_debug("perf_evlist__open: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +@@ -149,6 +152,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest + if (err < 0) { + pr_debug("evlist__mmap: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +-- +2.51.0 + diff --git a/queue-6.17/perf-test-shell-lbr-avoid-failures-with-perf-event-p.patch b/queue-6.17/perf-test-shell-lbr-avoid-failures-with-perf-event-p.patch new file mode 100644 index 0000000000..fca16dbcd1 --- /dev/null +++ b/queue-6.17/perf-test-shell-lbr-avoid-failures-with-perf-event-p.patch @@ -0,0 +1,113 @@ +From 63cdc58e3261893912aba400e70e67bc6a4d178f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 15:18:31 -0700 +Subject: perf test shell lbr: Avoid failures with perf event paranoia + +From: Ian Rogers + +[ Upstream commit 48314d20fe467d6653783cbf5536cb2fcc9bdd7c ] + +When not running as root and with higher perf event paranoia values +the perf record LBR tests could fail rather than skipping the +problematic tests. + +Add the sensitivity to the test and confirm it passes with paranoia +values from -1 to 2. + +Committer testing: + +Testing with '$ perf test -vv lbr', i.e. as non root, and then comparing +the output shows the mentioned errors before this patch: + + acme@x1:~$ grep -m1 "model name" /proc/cpuinfo + model name : 13th Gen Intel(R) Core(TM) i7-1365U + acme@x1:~$ + +Before: + + 132: perf record LBR tests : Skip + +After: + + 132: perf record LBR tests : Ok + +Fixes: 32559b99e0f59070 ("perf test: Add set of perf record LBR tests") +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Chun-Tse Shao +Cc: Howard Chu +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/record_lbr.sh | 26 ++++++++++++++++++++------ + 1 file changed, 20 insertions(+), 6 deletions(-) + +diff --git a/tools/perf/tests/shell/record_lbr.sh b/tools/perf/tests/shell/record_lbr.sh +index 6fcb5e52b9b4f..78a02e90ece1e 100755 +--- a/tools/perf/tests/shell/record_lbr.sh ++++ b/tools/perf/tests/shell/record_lbr.sh +@@ -4,6 +4,10 @@ + + set -e + ++ParanoidAndNotRoot() { ++ [ "$(id -u)" != 0 ] && [ "$(cat /proc/sys/kernel/perf_event_paranoid)" -gt $1 ] ++} ++ + if [ ! -f /sys/bus/event_source/devices/cpu/caps/branches ] && + [ ! -f /sys/bus/event_source/devices/cpu_core/caps/branches ] + then +@@ -23,6 +27,7 @@ cleanup() { + } + + trap_cleanup() { ++ echo "Unexpected signal in ${FUNCNAME[1]}" + cleanup + exit 1 + } +@@ -123,8 +128,11 @@ lbr_test "-j ind_call" "any indirect call" 2 + lbr_test "-j ind_jmp" "any indirect jump" 100 + lbr_test "-j call" "direct calls" 2 + lbr_test "-j ind_call,u" "any indirect user call" 100 +-lbr_test "-a -b" "system wide any branch" 2 +-lbr_test "-a -j any_call" "system wide any call" 2 ++if ! ParanoidAndNotRoot 1 ++then ++ lbr_test "-a -b" "system wide any branch" 2 ++ lbr_test "-a -j any_call" "system wide any call" 2 ++fi + + # Parallel + parallel_lbr_test "-b" "parallel any branch" 100 & +@@ -141,10 +149,16 @@ parallel_lbr_test "-j call" "parallel direct calls" 100 & + pid6=$! + parallel_lbr_test "-j ind_call,u" "parallel any indirect user call" 100 & + pid7=$! +-parallel_lbr_test "-a -b" "parallel system wide any branch" 100 & +-pid8=$! +-parallel_lbr_test "-a -j any_call" "parallel system wide any call" 100 & +-pid9=$! ++if ParanoidAndNotRoot 1 ++then ++ pid8= ++ pid9= ++else ++ parallel_lbr_test "-a -b" "parallel system wide any branch" 100 & ++ pid8=$! ++ parallel_lbr_test "-a -j any_call" "parallel system wide any call" 100 & ++ pid9=$! ++fi + + for pid in $pid1 $pid2 $pid3 $pid4 $pid5 $pid6 $pid7 $pid8 $pid9 + do +-- +2.51.0 + diff --git a/queue-6.17/perf-test-trace_btf_enum-skip-if-permissions-are-ins.patch b/queue-6.17/perf-test-trace_btf_enum-skip-if-permissions-are-ins.patch new file mode 100644 index 0000000000..3e714f9a16 --- /dev/null +++ b/queue-6.17/perf-test-trace_btf_enum-skip-if-permissions-are-ins.patch @@ -0,0 +1,72 @@ +From 631132a0623fd7a56e3dd9e8997a00fad986fd21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:16 -0700 +Subject: perf test trace_btf_enum: Skip if permissions are insufficient + +From: Ian Rogers + +[ Upstream commit 4bd5bd8dbd41a208fb73afb65bda6f38e2b5a637 ] + +Modify test behavior to skip if BPF calls fail with "Operation not +permitted". + +Fixes: d66763fed30f0bd8 ("perf test trace_btf_enum: Add regression test for the BTF augmentation of enums in 'perf trace'") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Acked-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Blake Jones +Cc: Chun-Tse Shao +Cc: Collin Funk +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jan Polensky +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Li Huafei +Cc: Mark Rutland +Cc: Nam Cao +Cc: Peter Zijlstra +Cc: Steinar H. Gunderson +Cc: Thomas Gleixner +Link: https://lore.kernel.org/r/20250821163820.1132977-3-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/trace_btf_enum.sh | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/tools/perf/tests/shell/trace_btf_enum.sh b/tools/perf/tests/shell/trace_btf_enum.sh +index 572001d75d781..03e9f680a4a69 100755 +--- a/tools/perf/tests/shell/trace_btf_enum.sh ++++ b/tools/perf/tests/shell/trace_btf_enum.sh +@@ -23,6 +23,14 @@ check_vmlinux() { + fi + } + ++check_permissions() { ++ if perf trace -e $syscall $TESTPROG 2>&1 | grep -q "Operation not permitted" ++ then ++ echo "trace+enum test [Skipped permissions]" ++ err=2 ++ fi ++} ++ + trace_landlock() { + echo "Tracing syscall ${syscall}" + +@@ -56,6 +64,9 @@ trace_non_syscall() { + } + + check_vmlinux ++if [ $err = 0 ]; then ++ check_permissions ++fi + + if [ $err = 0 ]; then + trace_landlock +-- +2.51.0 + diff --git a/queue-6.17/perf-tools-fix-arm64-libjvmti-build-by-generating-un.patch b/queue-6.17/perf-tools-fix-arm64-libjvmti-build-by-generating-un.patch new file mode 100644 index 0000000000..90f05fd9b8 --- /dev/null +++ b/queue-6.17/perf-tools-fix-arm64-libjvmti-build-by-generating-un.patch @@ -0,0 +1,53 @@ +From 1abb4dfca4755e745df6b62ce19c83082fbe01d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 07:37:02 +0200 +Subject: perf tools: Fix arm64 libjvmti build by generating unistd_64.h + +From: Vincent Minet + +[ Upstream commit f3b601f900902ab80902c44f820a8985384ac021 ] + +Since commit 22f72088ffe6 ("tools headers: Update the syscall table with +the kernel sources") the arm64 syscall header is generated at build +time. Later, commit bfb713ea53c7 ("perf tools: Fix arm64 build by +generating unistd_64.h") added a dependency to libperf to guarantee that +this header was created before building libperf or perf itself. + +However, libjvmti also requires this header but does not depend on +libperf, leading to build failures such as: + + In file included from /usr/include/sys/syscall.h:24, + from /usr/include/syscall.h:1, + from jvmti/jvmti_agent.c:36: + tools/arch/arm64/include/uapi/asm/unistd.h:2:10: fatal error: asm/unistd_64.h: No such file or directory + 2 | #include + +Fix this by ensuring that libperf is built before libjvmti, so that +unistd_64.h is always available. + +Fixes: 22f72088ffe69a37 ("tools headers: Update the syscall table with the kernel sources") +Cc: Namhyung Kim +Cc: Vincent Minet +Link: https://lore.kernel.org/r/20250922053702.2688374-1-v.minet@criteo.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/Makefile.perf | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf +index e2150acc2c133..f561025d4085e 100644 +--- a/tools/perf/Makefile.perf ++++ b/tools/perf/Makefile.perf +@@ -941,7 +941,7 @@ $(OUTPUT)dlfilters/%.so: $(OUTPUT)dlfilters/%.o + ifndef NO_JVMTI + LIBJVMTI_IN := $(OUTPUT)jvmti/jvmti-in.o + +-$(LIBJVMTI_IN): FORCE ++$(LIBJVMTI_IN): prepare FORCE + $(Q)$(MAKE) -f $(srctree)/tools/build/Makefile.build dir=jvmti obj=jvmti + + $(OUTPUT)$(LIBJVMTI): $(LIBJVMTI_IN) +-- +2.51.0 + diff --git a/queue-6.17/perf-trace-fix-is_err-vs-null-check-bug.patch b/queue-6.17/perf-trace-fix-is_err-vs-null-check-bug.patch new file mode 100644 index 0000000000..4aabcffc13 --- /dev/null +++ b/queue-6.17/perf-trace-fix-is_err-vs-null-check-bug.patch @@ -0,0 +1,57 @@ +From 6726f584009826377d2bb429ecb487cbd3d77396 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 17:54:22 +0800 +Subject: perf trace: Fix IS_ERR() vs NULL check bug + +From: Fushuai Wang + +[ Upstream commit b0f4ade163e551d0c470ead7ac57eaf373eec71a ] + +The alloc_syscall_stats() function always returns an error pointer +(ERR_PTR) on failure. + +So replace NULL check with IS_ERR() check after calling +alloc_syscall_stats() function. + +Fixes: fc00897c8a3f7f57 ("perf trace: Add --summary-mode option") +Reviewed-by: Ian Rogers +Signed-off-by: Fushuai Wang +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-trace.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c +index fe737b3ac6e67..25c41b89f8abb 100644 +--- a/tools/perf/builtin-trace.c ++++ b/tools/perf/builtin-trace.c +@@ -4440,7 +4440,7 @@ static int trace__run(struct trace *trace, int argc, const char **argv) + + if (trace->summary_mode == SUMMARY__BY_TOTAL && !trace->summary_bpf) { + trace->syscall_stats = alloc_syscall_stats(); +- if (trace->syscall_stats == NULL) ++ if (IS_ERR(trace->syscall_stats)) + goto out_delete_evlist; + } + +@@ -4748,7 +4748,7 @@ static int trace__replay(struct trace *trace) + + if (trace->summary_mode == SUMMARY__BY_TOTAL) { + trace->syscall_stats = alloc_syscall_stats(); +- if (trace->syscall_stats == NULL) ++ if (IS_ERR(trace->syscall_stats)) + goto out; + } + +-- +2.51.0 + diff --git a/queue-6.17/perf-util-fix-compression-checks-returning-1-as-bool.patch b/queue-6.17/perf-util-fix-compression-checks-returning-1-as-bool.patch new file mode 100644 index 0000000000..3389892c20 --- /dev/null +++ b/queue-6.17/perf-util-fix-compression-checks-returning-1-as-bool.patch @@ -0,0 +1,67 @@ +From fe1d0135931a68caae330f9201b73b0fad957625 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 16:25:08 +0000 +Subject: perf util: Fix compression checks returning -1 as bool + +From: Yunseong Kim + +[ Upstream commit 43fa1141e2c1af79c91aaa4df03e436c415a6fc3 ] + +The lzma_is_compressed and gzip_is_compressed functions are declared +to return a "bool" type, but in case of an error (e.g., file open +failure), they incorrectly returned -1. + +A bool type is a boolean value that is either true or false. +Returning -1 for a bool return type can lead to unexpected behavior +and may violate strict type-checking in some compilers. + +Fix the return value to be false in error cases, ensuring the function +adheres to its declared return type improves for preventing potential +bugs related to type mismatch. + +Fixes: 4b57fd44b61beb51 ("perf tools: Add lzma_is_compressed function") +Reviewed-by: Ian Rogers +Signed-off-by: Yunseong Kim +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Namhyung Kim +Cc: Stephen Brennan +Link: https://lore.kernel.org/r/20250822162506.316844-3-ysk@kzalloc.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/lzma.c | 2 +- + tools/perf/util/zlib.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/lzma.c b/tools/perf/util/lzma.c +index bbcd2ffcf4bd1..c355757ed3911 100644 +--- a/tools/perf/util/lzma.c ++++ b/tools/perf/util/lzma.c +@@ -120,7 +120,7 @@ bool lzma_is_compressed(const char *input) + ssize_t rc; + + if (fd < 0) +- return -1; ++ return false; + + rc = read(fd, buf, sizeof(buf)); + close(fd); +diff --git a/tools/perf/util/zlib.c b/tools/perf/util/zlib.c +index 78d2297c1b674..1f7c065230599 100644 +--- a/tools/perf/util/zlib.c ++++ b/tools/perf/util/zlib.c +@@ -88,7 +88,7 @@ bool gzip_is_compressed(const char *input) + ssize_t rc; + + if (fd < 0) +- return -1; ++ return false; + + rc = read(fd, buf, sizeof(buf)); + close(fd); +-- +2.51.0 + diff --git a/queue-6.17/perf-vendor-events-arm64-ampereonex-fix-typo-should-.patch b/queue-6.17/perf-vendor-events-arm64-ampereonex-fix-typo-should-.patch new file mode 100644 index 0000000000..b361cc81d1 --- /dev/null +++ b/queue-6.17/perf-vendor-events-arm64-ampereonex-fix-typo-should-.patch @@ -0,0 +1,88 @@ +From 02f1cd5912b21cdab6296e7c7e878fd7a79e78e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 12:52:12 -0700 +Subject: perf vendor events arm64 AmpereOneX: Fix typo - should be + l1d_cache_access_prefetches + +From: Ilkka Koskinen + +[ Upstream commit 97996580da08f06f8b09a86f3384ed9fa7a52e32 ] + +Add missing 'h' to l1d_cache_access_prefetces + +Also fix a couple of typos and use consistent term in brief descriptions + +Fixes: 16438b652b464ef7 ("perf vendor events arm64 AmpereOneX: Add core PMU events and metrics") +Reviewed-by: James Clark +Signed-off-by: Ilkka Koskinen +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ilkka Koskinen +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: John Garry +Cc: Kan Liang +Cc: Leo Yan +Cc: Mark Rutland +Cc: Mike Leach +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Will Deacon +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + .../arch/arm64/ampere/ampereonex/metrics.json | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/tools/perf/pmu-events/arch/arm64/ampere/ampereonex/metrics.json b/tools/perf/pmu-events/arch/arm64/ampere/ampereonex/metrics.json +index 5228f94a793f9..6817cac149e0b 100644 +--- a/tools/perf/pmu-events/arch/arm64/ampere/ampereonex/metrics.json ++++ b/tools/perf/pmu-events/arch/arm64/ampere/ampereonex/metrics.json +@@ -113,7 +113,7 @@ + { + "MetricName": "load_store_spec_rate", + "MetricExpr": "LDST_SPEC / INST_SPEC", +- "BriefDescription": "The rate of load or store instructions speculatively executed to overall instructions speclatively executed", ++ "BriefDescription": "The rate of load or store instructions speculatively executed to overall instructions speculatively executed", + "MetricGroup": "Operation_Mix", + "ScaleUnit": "100percent of operations" + }, +@@ -132,7 +132,7 @@ + { + "MetricName": "pc_write_spec_rate", + "MetricExpr": "PC_WRITE_SPEC / INST_SPEC", +- "BriefDescription": "The rate of software change of the PC speculatively executed to overall instructions speclatively executed", ++ "BriefDescription": "The rate of software change of the PC speculatively executed to overall instructions speculatively executed", + "MetricGroup": "Operation_Mix", + "ScaleUnit": "100percent of operations" + }, +@@ -195,14 +195,14 @@ + { + "MetricName": "stall_frontend_cache_rate", + "MetricExpr": "STALL_FRONTEND_CACHE / CPU_CYCLES", +- "BriefDescription": "Proportion of cycles stalled and no ops delivered from frontend and cache miss", ++ "BriefDescription": "Proportion of cycles stalled and no operations delivered from frontend and cache miss", + "MetricGroup": "Stall", + "ScaleUnit": "100percent of cycles" + }, + { + "MetricName": "stall_frontend_tlb_rate", + "MetricExpr": "STALL_FRONTEND_TLB / CPU_CYCLES", +- "BriefDescription": "Proportion of cycles stalled and no ops delivered from frontend and TLB miss", ++ "BriefDescription": "Proportion of cycles stalled and no operations delivered from frontend and TLB miss", + "MetricGroup": "Stall", + "ScaleUnit": "100percent of cycles" + }, +@@ -391,7 +391,7 @@ + "ScaleUnit": "100percent of cache acceses" + }, + { +- "MetricName": "l1d_cache_access_prefetces", ++ "MetricName": "l1d_cache_access_prefetches", + "MetricExpr": "L1D_CACHE_PRFM / L1D_CACHE", + "BriefDescription": "L1D cache access - prefetch", + "MetricGroup": "Cache", +-- +2.51.0 + diff --git a/queue-6.17/pm-core-add-two-macros-for-walking-device-links.patch b/queue-6.17/pm-core-add-two-macros-for-walking-device-links.patch new file mode 100644 index 0000000000..23847a92b9 --- /dev/null +++ b/queue-6.17/pm-core-add-two-macros-for-walking-device-links.patch @@ -0,0 +1,145 @@ +From 5c61177f5c837ace70b6bf49f0c0f48028d94022 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 15:45:14 +0200 +Subject: PM: core: Add two macros for walking device links + +From: Rafael J. Wysocki + +[ Upstream commit 3ce3f569991347d2085925041f4932232da43bcf ] + +Add separate macros for walking links to suppliers and consumers of a +device to help device links users to avoid exposing the internals of +struct dev_links_info in their code and possible coding mistakes related +to that. + +Accordingly, use the new macros to replace open-coded device links list +walks in the core power management code. + +No intentional functional impact. + +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Ulf Hansson +Acked-by: Greg Kroah-Hartman +Link: https://patch.msgid.link/1944671.tdWV9SEqCh@rafael.j.wysocki +Stable-dep-of: 632d31067be2 ("PM: sleep: Do not wait on SYNC_STATE_ONLY device links") +Signed-off-by: Sasha Levin +--- + drivers/base/base.h | 8 ++++++++ + drivers/base/power/main.c | 18 +++++++----------- + drivers/base/power/runtime.c | 3 +-- + 3 files changed, 16 insertions(+), 13 deletions(-) + +diff --git a/drivers/base/base.h b/drivers/base/base.h +index 123031a757d91..700aecd22fd34 100644 +--- a/drivers/base/base.h ++++ b/drivers/base/base.h +@@ -251,6 +251,14 @@ void device_links_unbind_consumers(struct device *dev); + void fw_devlink_drivers_done(void); + void fw_devlink_probing_done(void); + ++#define dev_for_each_link_to_supplier(__link, __dev) \ ++ list_for_each_entry_srcu(__link, &(__dev)->links.suppliers, c_node, \ ++ device_links_read_lock_held()) ++ ++#define dev_for_each_link_to_consumer(__link, __dev) \ ++ list_for_each_entry_srcu(__link, &(__dev)->links.consumers, s_node, \ ++ device_links_read_lock_held()) ++ + /* device pm support */ + void device_pm_move_to_tail(struct device *dev); + +diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c +index b6ab41265d7a3..b9a34c3425ecf 100644 +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -40,10 +40,6 @@ + + typedef int (*pm_callback_t)(struct device *); + +-#define list_for_each_entry_srcu_locked(pos, head, member) \ +- list_for_each_entry_srcu(pos, head, member, \ +- device_links_read_lock_held()) +- + /* + * The entries in the dpm_list list are in a depth first order, simply + * because children are guaranteed to be discovered after parents, and +@@ -281,7 +277,7 @@ static void dpm_wait_for_suppliers(struct device *dev, bool async) + * callbacks freeing the link objects for the links in the list we're + * walking. + */ +- list_for_each_entry_srcu_locked(link, &dev->links.suppliers, c_node) ++ dev_for_each_link_to_supplier(link, dev) + if (READ_ONCE(link->status) != DL_STATE_DORMANT) + dpm_wait(link->supplier, async); + +@@ -338,7 +334,7 @@ static void dpm_wait_for_consumers(struct device *dev, bool async) + * continue instead of trying to continue in parallel with its + * unregistration). + */ +- list_for_each_entry_srcu_locked(link, &dev->links.consumers, s_node) ++ dev_for_each_link_to_consumer(link, dev) + if (READ_ONCE(link->status) != DL_STATE_DORMANT) + dpm_wait(link->consumer, async); + +@@ -675,7 +671,7 @@ static void dpm_async_resume_subordinate(struct device *dev, async_func_t func) + idx = device_links_read_lock(); + + /* Start processing the device's "async" consumers. */ +- list_for_each_entry_srcu_locked(link, &dev->links.consumers, s_node) ++ dev_for_each_link_to_consumer(link, dev) + if (READ_ONCE(link->status) != DL_STATE_DORMANT) + dpm_async_with_cleanup(link->consumer, func); + +@@ -1342,7 +1338,7 @@ static void dpm_async_suspend_superior(struct device *dev, async_func_t func) + idx = device_links_read_lock(); + + /* Start processing the device's "async" suppliers. */ +- list_for_each_entry_srcu_locked(link, &dev->links.suppliers, c_node) ++ dev_for_each_link_to_supplier(link, dev) + if (READ_ONCE(link->status) != DL_STATE_DORMANT) + dpm_async_with_cleanup(link->supplier, func); + +@@ -1396,7 +1392,7 @@ static void dpm_superior_set_must_resume(struct device *dev) + + idx = device_links_read_lock(); + +- list_for_each_entry_srcu_locked(link, &dev->links.suppliers, c_node) ++ dev_for_each_link_to_supplier(link, dev) + link->supplier->power.must_resume = true; + + device_links_read_unlock(idx); +@@ -1825,7 +1821,7 @@ static void dpm_clear_superiors_direct_complete(struct device *dev) + + idx = device_links_read_lock(); + +- list_for_each_entry_srcu_locked(link, &dev->links.suppliers, c_node) { ++ dev_for_each_link_to_supplier(link, dev) { + spin_lock_irq(&link->supplier->power.lock); + link->supplier->power.direct_complete = false; + spin_unlock_irq(&link->supplier->power.lock); +@@ -2077,7 +2073,7 @@ static bool device_prepare_smart_suspend(struct device *dev) + + idx = device_links_read_lock(); + +- list_for_each_entry_srcu_locked(link, &dev->links.suppliers, c_node) { ++ dev_for_each_link_to_supplier(link, dev) { + if (!device_link_test(link, DL_FLAG_PM_RUNTIME)) + continue; + +diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c +index 8c23a11e80176..7420b9851fe0f 100644 +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -1903,8 +1903,7 @@ void pm_runtime_get_suppliers(struct device *dev) + + idx = device_links_read_lock(); + +- list_for_each_entry_srcu(link, &dev->links.suppliers, c_node, +- device_links_read_lock_held()) ++ dev_for_each_link_to_supplier(link, dev) + if (device_link_test(link, DL_FLAG_PM_RUNTIME)) { + link->supplier_preactivated = true; + pm_runtime_get_sync(link->supplier); +-- +2.51.0 + diff --git a/queue-6.17/pm-core-annotate-loops-walking-device-links-as-_srcu.patch b/queue-6.17/pm-core-annotate-loops-walking-device-links-as-_srcu.patch new file mode 100644 index 0000000000..b5e5c10264 --- /dev/null +++ b/queue-6.17/pm-core-annotate-loops-walking-device-links-as-_srcu.patch @@ -0,0 +1,123 @@ +From ad6517da7d76c75cd555dadba377b0bd2003283d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 15:43:50 +0200 +Subject: PM: core: Annotate loops walking device links as _srcu + +From: Rafael J. Wysocki + +[ Upstream commit fdd9ae23bb989fa9ed1beebba7d3e0c82c7c81ae ] + +Since SRCU is used for the protection of device link lists, the loops +over device link lists in multiple places in drivers/base/power/main.c +and in pm_runtime_get_suppliers() should be annotated as _srcu rather +than as _rcu which is the case currently. + +Change the annotations accordingly. + +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Ulf Hansson +Acked-by: Greg Kroah-Hartman +Link: https://patch.msgid.link/2393512.ElGaqSPkdT@rafael.j.wysocki +Stable-dep-of: 632d31067be2 ("PM: sleep: Do not wait on SYNC_STATE_ONLY device links") +Signed-off-by: Sasha Levin +--- + drivers/base/power/main.c | 18 +++++++++--------- + drivers/base/power/runtime.c | 4 ++-- + 2 files changed, 11 insertions(+), 11 deletions(-) + +diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c +index c883b01ffbddc..b6ab41265d7a3 100644 +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -40,8 +40,8 @@ + + typedef int (*pm_callback_t)(struct device *); + +-#define list_for_each_entry_rcu_locked(pos, head, member) \ +- list_for_each_entry_rcu(pos, head, member, \ ++#define list_for_each_entry_srcu_locked(pos, head, member) \ ++ list_for_each_entry_srcu(pos, head, member, \ + device_links_read_lock_held()) + + /* +@@ -281,7 +281,7 @@ static void dpm_wait_for_suppliers(struct device *dev, bool async) + * callbacks freeing the link objects for the links in the list we're + * walking. + */ +- list_for_each_entry_rcu_locked(link, &dev->links.suppliers, c_node) ++ list_for_each_entry_srcu_locked(link, &dev->links.suppliers, c_node) + if (READ_ONCE(link->status) != DL_STATE_DORMANT) + dpm_wait(link->supplier, async); + +@@ -338,7 +338,7 @@ static void dpm_wait_for_consumers(struct device *dev, bool async) + * continue instead of trying to continue in parallel with its + * unregistration). + */ +- list_for_each_entry_rcu_locked(link, &dev->links.consumers, s_node) ++ list_for_each_entry_srcu_locked(link, &dev->links.consumers, s_node) + if (READ_ONCE(link->status) != DL_STATE_DORMANT) + dpm_wait(link->consumer, async); + +@@ -675,7 +675,7 @@ static void dpm_async_resume_subordinate(struct device *dev, async_func_t func) + idx = device_links_read_lock(); + + /* Start processing the device's "async" consumers. */ +- list_for_each_entry_rcu_locked(link, &dev->links.consumers, s_node) ++ list_for_each_entry_srcu_locked(link, &dev->links.consumers, s_node) + if (READ_ONCE(link->status) != DL_STATE_DORMANT) + dpm_async_with_cleanup(link->consumer, func); + +@@ -1342,7 +1342,7 @@ static void dpm_async_suspend_superior(struct device *dev, async_func_t func) + idx = device_links_read_lock(); + + /* Start processing the device's "async" suppliers. */ +- list_for_each_entry_rcu_locked(link, &dev->links.suppliers, c_node) ++ list_for_each_entry_srcu_locked(link, &dev->links.suppliers, c_node) + if (READ_ONCE(link->status) != DL_STATE_DORMANT) + dpm_async_with_cleanup(link->supplier, func); + +@@ -1396,7 +1396,7 @@ static void dpm_superior_set_must_resume(struct device *dev) + + idx = device_links_read_lock(); + +- list_for_each_entry_rcu_locked(link, &dev->links.suppliers, c_node) ++ list_for_each_entry_srcu_locked(link, &dev->links.suppliers, c_node) + link->supplier->power.must_resume = true; + + device_links_read_unlock(idx); +@@ -1825,7 +1825,7 @@ static void dpm_clear_superiors_direct_complete(struct device *dev) + + idx = device_links_read_lock(); + +- list_for_each_entry_rcu_locked(link, &dev->links.suppliers, c_node) { ++ list_for_each_entry_srcu_locked(link, &dev->links.suppliers, c_node) { + spin_lock_irq(&link->supplier->power.lock); + link->supplier->power.direct_complete = false; + spin_unlock_irq(&link->supplier->power.lock); +@@ -2077,7 +2077,7 @@ static bool device_prepare_smart_suspend(struct device *dev) + + idx = device_links_read_lock(); + +- list_for_each_entry_rcu_locked(link, &dev->links.suppliers, c_node) { ++ list_for_each_entry_srcu_locked(link, &dev->links.suppliers, c_node) { + if (!device_link_test(link, DL_FLAG_PM_RUNTIME)) + continue; + +diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c +index 3e84dc4122def..8c23a11e80176 100644 +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -1903,8 +1903,8 @@ void pm_runtime_get_suppliers(struct device *dev) + + idx = device_links_read_lock(); + +- list_for_each_entry_rcu(link, &dev->links.suppliers, c_node, +- device_links_read_lock_held()) ++ list_for_each_entry_srcu(link, &dev->links.suppliers, c_node, ++ device_links_read_lock_held()) + if (device_link_test(link, DL_FLAG_PM_RUNTIME)) { + link->supplier_preactivated = true; + pm_runtime_get_sync(link->supplier); +-- +2.51.0 + diff --git a/queue-6.17/pm-sleep-do-not-wait-on-sync_state_only-device-links.patch b/queue-6.17/pm-sleep-do-not-wait-on-sync_state_only-device-links.patch new file mode 100644 index 0000000000..fbc58b765b --- /dev/null +++ b/queue-6.17/pm-sleep-do-not-wait-on-sync_state_only-device-links.patch @@ -0,0 +1,108 @@ +From 078d5e332701e3fce94e3ad2ae5e14c17474eb41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 18:23:18 +0800 +Subject: PM: sleep: Do not wait on SYNC_STATE_ONLY device links + +From: Pin-yen Lin + +[ Upstream commit 632d31067be2f414c57955efcf29c79290cc749b ] + +Device links with DL_FLAG_SYNC_STATE_ONLY should not affect system +suspend and resume, and functions like device_reorder_to_tail() and +device_link_add() don't try to reorder the consumers with that flag. + +However, dpm_wait_for_consumers() and dpm_wait_for_suppliers() don't +check thas flag before triggering dpm_wait(), leading to potential hang +during suspend/resume. + +This can be reproduced on MT8186 Corsola Chromebook with devicetree like: + +usb-a-connector { + compatible = "usb-a-connector"; + port { + usb_a_con: endpoint { + remote-endpoint = <&usb_hs>; + }; + }; +}; + +usb_host { + compatible = "mediatek,mt8186-xhci", "mediatek,mtk-xhci"; + port { + usb_hs: endpoint { + remote-endpoint = <&usb_a_con>; + }; + }; +}; + +In this case, the two nodes form a cycle and a SYNC_STATE_ONLY devlink +between usb_host (supplier) and usb-a-connector (consumer) is created. + +Address this by exporting device_link_flag_is_sync_state_only() and +making dpm_wait_for_consumers() and dpm_wait_for_suppliers() use it +when deciding if dpm_wait() should be called. + +Fixes: 05ef983e0d65a ("driver core: Add device link support for SYNC_STATE_ONLY flag") +Signed-off-by: Pin-yen Lin +Link: https://patch.msgid.link/20250926102320.4053167-1-treapking@chromium.org +[ rjw: Subject and changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/base/base.h | 1 + + drivers/base/core.c | 2 +- + drivers/base/power/main.c | 6 ++++-- + 3 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/base/base.h b/drivers/base/base.h +index 700aecd22fd34..86fa7fbb35489 100644 +--- a/drivers/base/base.h ++++ b/drivers/base/base.h +@@ -248,6 +248,7 @@ void device_links_driver_cleanup(struct device *dev); + void device_links_no_driver(struct device *dev); + bool device_links_busy(struct device *dev); + void device_links_unbind_consumers(struct device *dev); ++bool device_link_flag_is_sync_state_only(u32 flags); + void fw_devlink_drivers_done(void); + void fw_devlink_probing_done(void); + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index d22d6b23e7589..a54ec6df1058f 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -287,7 +287,7 @@ static bool device_is_ancestor(struct device *dev, struct device *target) + #define DL_MARKER_FLAGS (DL_FLAG_INFERRED | \ + DL_FLAG_CYCLE | \ + DL_FLAG_MANAGED) +-static inline bool device_link_flag_is_sync_state_only(u32 flags) ++bool device_link_flag_is_sync_state_only(u32 flags) + { + return (flags & ~DL_MARKER_FLAGS) == DL_FLAG_SYNC_STATE_ONLY; + } +diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c +index b9a34c3425ecf..e83503bdc1fdb 100644 +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -278,7 +278,8 @@ static void dpm_wait_for_suppliers(struct device *dev, bool async) + * walking. + */ + dev_for_each_link_to_supplier(link, dev) +- if (READ_ONCE(link->status) != DL_STATE_DORMANT) ++ if (READ_ONCE(link->status) != DL_STATE_DORMANT && ++ !device_link_flag_is_sync_state_only(link->flags)) + dpm_wait(link->supplier, async); + + device_links_read_unlock(idx); +@@ -335,7 +336,8 @@ static void dpm_wait_for_consumers(struct device *dev, bool async) + * unregistration). + */ + dev_for_each_link_to_consumer(link, dev) +- if (READ_ONCE(link->status) != DL_STATE_DORMANT) ++ if (READ_ONCE(link->status) != DL_STATE_DORMANT && ++ !device_link_flag_is_sync_state_only(link->flags)) + dpm_wait(link->consumer, async); + + device_links_read_unlock(idx); +-- +2.51.0 + diff --git a/queue-6.17/rtc-isl12022-fix-initial-enable_irq-disable_irq-bala.patch b/queue-6.17/rtc-isl12022-fix-initial-enable_irq-disable_irq-bala.patch new file mode 100644 index 0000000000..e58ae13090 --- /dev/null +++ b/queue-6.17/rtc-isl12022-fix-initial-enable_irq-disable_irq-bala.patch @@ -0,0 +1,37 @@ +From 0b253dea575ff13bdb7f62f739476a3c9ff71503 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 May 2025 09:23:36 +0200 +Subject: rtc: isl12022: Fix initial enable_irq/disable_irq balance + +From: Esben Haabendal + +[ Upstream commit 9ffe06b6ccd7a8eaa31d31625db009ea26a22a3c ] + +Interrupts are automatically enabled when requested, so we need to +initialize irq_enabled accordingly to avoid causing an unbalanced enable +warning. + +Fixes: c62d658e5253 ("rtc: isl12022: Add alarm support") +Signed-off-by: Esben Haabendal +Link: https://lore.kernel.org/r/20250516-rtc-uie-irq-fixes-v2-2-3de8e530a39e@geanix.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-isl12022.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/rtc/rtc-isl12022.c b/drivers/rtc/rtc-isl12022.c +index 9b44839a7402c..5fc52dc642130 100644 +--- a/drivers/rtc/rtc-isl12022.c ++++ b/drivers/rtc/rtc-isl12022.c +@@ -413,6 +413,7 @@ static int isl12022_setup_irq(struct device *dev, int irq) + if (ret) + return ret; + ++ isl12022->irq_enabled = true; + ret = devm_request_threaded_irq(dev, irq, NULL, + isl12022_rtc_interrupt, + IRQF_SHARED | IRQF_ONESHOT, +-- +2.51.0 + diff --git a/queue-6.17/rtc-optee-fix-memory-leak-on-driver-removal.patch b/queue-6.17/rtc-optee-fix-memory-leak-on-driver-removal.patch new file mode 100644 index 0000000000..537283b2b7 --- /dev/null +++ b/queue-6.17/rtc-optee-fix-memory-leak-on-driver-removal.patch @@ -0,0 +1,40 @@ +From e6b2dcc53811fc398e6eaeafe4796b5ab5661f32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Jul 2025 16:07:13 +0200 +Subject: rtc: optee: fix memory leak on driver removal +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Le Goffic + +[ Upstream commit a531350d2fe58f7fc4516e555f22391dee94efd9 ] + +Fix a memory leak in case of driver removal. +Free the shared memory used for arguments exchanges between kernel and +OP-TEE RTC PTA. + +Fixes: 81c2f059ab90 ("rtc: optee: add RTC driver for OP-TEE RTC PTA") +Signed-off-by: Clément Le Goffic +Link: https://lore.kernel.org/r/20250715-upstream-optee-rtc-v1-1-e0fdf8aae545@foss.st.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-optee.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/rtc/rtc-optee.c b/drivers/rtc/rtc-optee.c +index 9f8b5d4a8f6b6..6b77c122fdc10 100644 +--- a/drivers/rtc/rtc-optee.c ++++ b/drivers/rtc/rtc-optee.c +@@ -320,6 +320,7 @@ static int optee_rtc_remove(struct device *dev) + { + struct optee_rtc *priv = dev_get_drvdata(dev); + ++ tee_shm_free(priv->shm); + tee_client_close_session(priv->ctx, priv->session_id); + tee_client_close_context(priv->ctx); + +-- +2.51.0 + diff --git a/queue-6.17/rtc-x1205-fix-xicor-x1205-vendor-prefix.patch b/queue-6.17/rtc-x1205-fix-xicor-x1205-vendor-prefix.patch new file mode 100644 index 0000000000..0124b09f94 --- /dev/null +++ b/queue-6.17/rtc-x1205-fix-xicor-x1205-vendor-prefix.patch @@ -0,0 +1,39 @@ +From 150813b0af40ffe84d644ddca7ed1c76cbcdd62b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 16:57:02 -0500 +Subject: rtc: x1205: Fix Xicor X1205 vendor prefix + +From: Rob Herring (Arm) + +[ Upstream commit 606d19ee37de3a72f1b6e95a4ea544f6f20dbb46 ] + +The vendor for the X1205 RTC is not Xircom, but Xicor which was acquired +by Intersil. Since the I2C subsystem drops the vendor prefix for driver +matching, the vendor prefix hasn't mattered. + +Fixes: 6875404fdb44 ("rtc: x1205: Add DT probing support") +Signed-off-by: Rob Herring (Arm) +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20250821215703.869628-2-robh@kernel.org +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-x1205.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-x1205.c b/drivers/rtc/rtc-x1205.c +index 4bcd7ca32f27b..b8a0fccef14e0 100644 +--- a/drivers/rtc/rtc-x1205.c ++++ b/drivers/rtc/rtc-x1205.c +@@ -669,7 +669,7 @@ static const struct i2c_device_id x1205_id[] = { + MODULE_DEVICE_TABLE(i2c, x1205_id); + + static const struct of_device_id x1205_dt_ids[] = { +- { .compatible = "xircom,x1205", }, ++ { .compatible = "xicor,x1205", }, + {}, + }; + MODULE_DEVICE_TABLE(of, x1205_dt_ids); +-- +2.51.0 + diff --git a/queue-6.17/s390-cio-update-purge-function-to-unregister-the-unu.patch b/queue-6.17/s390-cio-update-purge-function-to-unregister-the-unu.patch new file mode 100644 index 0000000000..d8c59b68f3 --- /dev/null +++ b/queue-6.17/s390-cio-update-purge-function-to-unregister-the-unu.patch @@ -0,0 +1,96 @@ +From 109531d033db7ede6044ef5bb5f79c8b73ec3af5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 15:38:17 +0200 +Subject: s390/cio: Update purge function to unregister the unused subchannels + +From: Vineeth Vijayan + +[ Upstream commit 9daa5a8795865f9a3c93d8d1066785b07ded6073 ] + +Starting with 'commit 2297791c92d0 ("s390/cio: dont unregister +subchannel from child-drivers")', cio no longer unregisters +subchannels when the attached device is invalid or unavailable. + +As an unintended side-effect, the cio_ignore purge function no longer +removes subchannels for devices on the cio_ignore list if no CCW device +is attached. This situation occurs when a CCW device is non-operational +or unavailable + +To ensure the same outcome of the purge function as when the +current cio_ignore list had been active during boot, update the purge +function to remove I/O subchannels without working CCW devices if the +associated device number is found on the cio_ignore list. + +Fixes: 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers") +Suggested-by: Peter Oberparleiter +Reviewed-by: Peter Oberparleiter +Signed-off-by: Vineeth Vijayan +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/device.c | 37 ++++++++++++++++++++++++------------- + 1 file changed, 24 insertions(+), 13 deletions(-) + +diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c +index fb2c07cb4d3dd..4b2dae6eb3760 100644 +--- a/drivers/s390/cio/device.c ++++ b/drivers/s390/cio/device.c +@@ -1316,23 +1316,34 @@ void ccw_device_schedule_recovery(void) + spin_unlock_irqrestore(&recovery_lock, flags); + } + +-static int purge_fn(struct device *dev, void *data) ++static int purge_fn(struct subchannel *sch, void *data) + { +- struct ccw_device *cdev = to_ccwdev(dev); +- struct ccw_dev_id *id = &cdev->private->dev_id; +- struct subchannel *sch = to_subchannel(cdev->dev.parent); ++ struct ccw_device *cdev; + +- spin_lock_irq(cdev->ccwlock); +- if (is_blacklisted(id->ssid, id->devno) && +- (cdev->private->state == DEV_STATE_OFFLINE) && +- (atomic_cmpxchg(&cdev->private->onoff, 0, 1) == 0)) { +- CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x\n", id->ssid, +- id->devno); ++ spin_lock_irq(&sch->lock); ++ if (sch->st != SUBCHANNEL_TYPE_IO || !sch->schib.pmcw.dnv) ++ goto unlock; ++ ++ if (!is_blacklisted(sch->schid.ssid, sch->schib.pmcw.dev)) ++ goto unlock; ++ ++ cdev = sch_get_cdev(sch); ++ if (cdev) { ++ if (cdev->private->state != DEV_STATE_OFFLINE) ++ goto unlock; ++ ++ if (atomic_cmpxchg(&cdev->private->onoff, 0, 1) != 0) ++ goto unlock; + ccw_device_sched_todo(cdev, CDEV_TODO_UNREG); +- css_sched_sch_todo(sch, SCH_TODO_UNREG); + atomic_set(&cdev->private->onoff, 0); + } +- spin_unlock_irq(cdev->ccwlock); ++ ++ css_sched_sch_todo(sch, SCH_TODO_UNREG); ++ CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x%s\n", sch->schid.ssid, ++ sch->schib.pmcw.dev, cdev ? "" : " (no cdev)"); ++ ++unlock: ++ spin_unlock_irq(&sch->lock); + /* Abort loop in case of pending signal. */ + if (signal_pending(current)) + return -EINTR; +@@ -1348,7 +1359,7 @@ static int purge_fn(struct device *dev, void *data) + int ccw_purge_blacklisted(void) + { + CIO_MSG_EVENT(2, "ccw: purging blacklisted devices\n"); +- bus_for_each_dev(&ccw_bus_type, NULL, NULL, purge_fn); ++ for_each_subchannel_staged(purge_fn, NULL, NULL); + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.17/s390-vmlinux.lds.s-move-.vmlinux.info-to-end-of-allo.patch b/queue-6.17/s390-vmlinux.lds.s-move-.vmlinux.info-to-end-of-allo.patch new file mode 100644 index 0000000000..877c0c979a --- /dev/null +++ b/queue-6.17/s390-vmlinux.lds.s-move-.vmlinux.info-to-end-of-allo.patch @@ -0,0 +1,104 @@ +From b5c6b2a2b70a24e46ce23bb137b5add1d0e0edda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 15:46:46 -0700 +Subject: s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections + +From: Nathan Chancellor + +[ Upstream commit 9338d660b79a0dfe4eb3fe9bd748054cded87d4f ] + +When building s390 defconfig with binutils older than 2.32, there are +several warnings during the final linking stage: + + s390-linux-ld: .tmp_vmlinux1: warning: allocated section `.got.plt' not in segment + s390-linux-ld: .tmp_vmlinux2: warning: allocated section `.got.plt' not in segment + s390-linux-ld: vmlinux.unstripped: warning: allocated section `.got.plt' not in segment + s390-linux-objcopy: vmlinux: warning: allocated section `.got.plt' not in segment + s390-linux-objcopy: st7afZyb: warning: allocated section `.got.plt' not in segment + +binutils commit afca762f598 ("S/390: Improve partial relro support for +64 bit") [1] in 2.32 changed where .got.plt is emitted, avoiding the +warning. + +The :NONE in the .vmlinux.info output section description changes the +segment for subsequent allocated sections. Move .vmlinux.info right +above the discards section to place all other sections in the previously +defined segment, .data. + +Fixes: 30226853d6ec ("s390: vmlinux.lds.S: explicitly handle '.got' and '.plt' sections") +Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=afca762f598d453c563f244cd3777715b1a0cb72 [1] +Acked-by: Alexander Gordeev +Acked-by: Alexey Gladkov +Acked-by: Nicolas Schier +Link: https://patch.msgid.link/20251008-kbuild-fix-modinfo-regressions-v1-3-9fc776c5887c@kernel.org +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/vmlinux.lds.S | 44 +++++++++++++++++----------------- + 1 file changed, 22 insertions(+), 22 deletions(-) + +diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S +index feecf1a6ddb44..d74d4c52ccd05 100644 +--- a/arch/s390/kernel/vmlinux.lds.S ++++ b/arch/s390/kernel/vmlinux.lds.S +@@ -214,6 +214,28 @@ SECTIONS + DWARF_DEBUG + ELF_DETAILS + ++ /* ++ * Make sure that the .got.plt is either completely empty or it ++ * contains only the three reserved double words. ++ */ ++ .got.plt : { ++ *(.got.plt) ++ } ++ ASSERT(SIZEOF(.got.plt) == 0 || SIZEOF(.got.plt) == 0x18, "Unexpected GOT/PLT entries detected!") ++ ++ /* ++ * Sections that should stay zero sized, which is safer to ++ * explicitly check instead of blindly discarding. ++ */ ++ .plt : { ++ *(.plt) *(.plt.*) *(.iplt) *(.igot .igot.plt) ++ } ++ ASSERT(SIZEOF(.plt) == 0, "Unexpected run-time procedure linkages detected!") ++ .rela.dyn : { ++ *(.rela.*) *(.rela_*) ++ } ++ ASSERT(SIZEOF(.rela.dyn) == 0, "Unexpected run-time relocations (.rela) detected!") ++ + /* + * uncompressed image info used by the decompressor + * it should match struct vmlinux_info +@@ -244,28 +266,6 @@ SECTIONS + #endif + } :NONE + +- /* +- * Make sure that the .got.plt is either completely empty or it +- * contains only the three reserved double words. +- */ +- .got.plt : { +- *(.got.plt) +- } +- ASSERT(SIZEOF(.got.plt) == 0 || SIZEOF(.got.plt) == 0x18, "Unexpected GOT/PLT entries detected!") +- +- /* +- * Sections that should stay zero sized, which is safer to +- * explicitly check instead of blindly discarding. +- */ +- .plt : { +- *(.plt) *(.plt.*) *(.iplt) *(.igot .igot.plt) +- } +- ASSERT(SIZEOF(.plt) == 0, "Unexpected run-time procedure linkages detected!") +- .rela.dyn : { +- *(.rela.*) *(.rela_*) +- } +- ASSERT(SIZEOF(.rela.dyn) == 0, "Unexpected run-time relocations (.rela) detected!") +- + /* Sections to be discarded */ + DISCARDS + /DISCARD/ : { +-- +2.51.0 + diff --git a/queue-6.17/s390-vmlinux.lds.s-reorder-sections.patch b/queue-6.17/s390-vmlinux.lds.s-reorder-sections.patch new file mode 100644 index 0000000000..2f675c1d08 --- /dev/null +++ b/queue-6.17/s390-vmlinux.lds.s-reorder-sections.patch @@ -0,0 +1,69 @@ +From 106cf24aac7413e5fb6aa632707ff81451a202c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 10:05:45 +0200 +Subject: s390: vmlinux.lds.S: Reorder sections + +From: Alexey Gladkov + +[ Upstream commit 8d18ef04f940a8d336fe7915b5ea419c3eb0c0a6 ] + +In the upcoming changes, the ELF_DETAILS macro will be extended with +the ".modinfo" section, which will cause an error: + +>> s390x-linux-ld: .tmp_vmlinux1: warning: allocated section `.modinfo' not in segment +>> s390x-linux-ld: .tmp_vmlinux2: warning: allocated section `.modinfo' not in segment +>> s390x-linux-ld: vmlinux.unstripped: warning: allocated section `.modinfo' not in segment + +This happens because the .vmlinux.info use :NONE to override the default +segment and tell the linker to not put the section in any segment at all. + +To avoid this, we need to change the sections order that will be placed +in the default segment. + +Cc: Heiko Carstens +Cc: Vasily Gorbik +Cc: Alexander Gordeev +Cc: linux-s390@vger.kernel.org +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202506062053.zbkFBEnJ-lkp@intel.com/ +Signed-off-by: Alexey Gladkov +Acked-by: Heiko Carstens +Link: https://patch.msgid.link/20d40a7a3a053ba06a54155e777dcde7fdada1db.1758182101.git.legion@kernel.org +Signed-off-by: Nathan Chancellor +Stable-dep-of: 9338d660b79a ("s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections") +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/vmlinux.lds.S | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S +index 1c606dfa595d8..feecf1a6ddb44 100644 +--- a/arch/s390/kernel/vmlinux.lds.S ++++ b/arch/s390/kernel/vmlinux.lds.S +@@ -209,6 +209,11 @@ SECTIONS + . = ALIGN(PAGE_SIZE); + _end = . ; + ++ /* Debugging sections. */ ++ STABS_DEBUG ++ DWARF_DEBUG ++ ELF_DETAILS ++ + /* + * uncompressed image info used by the decompressor + * it should match struct vmlinux_info +@@ -239,11 +244,6 @@ SECTIONS + #endif + } :NONE + +- /* Debugging sections. */ +- STABS_DEBUG +- DWARF_DEBUG +- ELF_DETAILS +- + /* + * Make sure that the .got.plt is either completely empty or it + * contains only the three reserved double words. +-- +2.51.0 + diff --git a/queue-6.17/scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch b/queue-6.17/scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch new file mode 100644 index 0000000000..52860a7597 --- /dev/null +++ b/queue-6.17/scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch @@ -0,0 +1,56 @@ +From 2d512eda492dac3db66e7c3dfd02e837764c3cf4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Sep 2025 21:42:01 +0800 +Subject: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue + +From: Duoming Zhou + +[ Upstream commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 ] + +During the detaching of Marvell's SAS/SATA controller, the original code +calls cancel_delayed_work() in mvs_free() to cancel the delayed work +item mwq->work_q. However, if mwq->work_q is already running, the +cancel_delayed_work() may fail to cancel it. This can lead to +use-after-free scenarios where mvs_free() frees the mvs_info while +mvs_work_queue() is still executing and attempts to access the +already-freed mvs_info. + +A typical race condition is illustrated below: + +CPU 0 (remove) | CPU 1 (delayed work callback) +mvs_pci_remove() | + mvs_free() | mvs_work_queue() + cancel_delayed_work() | + kfree(mvi) | + | mvi-> // UAF + +Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure +that the delayed work item is properly canceled and any executing +delayed work item completes before the mvs_info is deallocated. + +This bug was found by static analysis. + +Fixes: 20b09c2992fe ("[SCSI] mvsas: add support for 94xx; layout change; bug fixes") +Signed-off-by: Duoming Zhou +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mvsas/mv_init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c +index 2c72da6b8cf0c..7f1ad305eee63 100644 +--- a/drivers/scsi/mvsas/mv_init.c ++++ b/drivers/scsi/mvsas/mv_init.c +@@ -124,7 +124,7 @@ static void mvs_free(struct mvs_info *mvi) + if (mvi->shost) + scsi_host_put(mvi->shost); + list_for_each_entry(mwq, &mvi->wq_list, entry) +- cancel_delayed_work(&mwq->work_q); ++ cancel_delayed_work_sync(&mwq->work_q); + kfree(mvi->rsvd_tags); + kfree(mvi); + } +-- +2.51.0 + diff --git a/queue-6.17/scsi-ufs-sysfs-make-hid-attributes-visible.patch b/queue-6.17/scsi-ufs-sysfs-make-hid-attributes-visible.patch new file mode 100644 index 0000000000..7698774496 --- /dev/null +++ b/queue-6.17/scsi-ufs-sysfs-make-hid-attributes-visible.patch @@ -0,0 +1,63 @@ +From f86b3407ad9aeabc190907fd43ece7f4b5955cdd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 18:09:39 -0700 +Subject: scsi: ufs: sysfs: Make HID attributes visible + +From: Daniel Lee + +[ Upstream commit bb7663dec67b691528f104894429b3859fb16c14 ] + +Call sysfs_update_group() after reading the device descriptor to ensure +the HID sysfs attributes are visible when the feature is supported. + +Fixes: ae7795a8c258 ("scsi: ufs: core: Add HID support") +Signed-off-by: Daniel Lee +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufs-sysfs.c | 2 +- + drivers/ufs/core/ufs-sysfs.h | 1 + + drivers/ufs/core/ufshcd.c | 2 ++ + 3 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/ufs/core/ufs-sysfs.c b/drivers/ufs/core/ufs-sysfs.c +index 0086816b27cd9..c040afc6668e8 100644 +--- a/drivers/ufs/core/ufs-sysfs.c ++++ b/drivers/ufs/core/ufs-sysfs.c +@@ -1949,7 +1949,7 @@ static umode_t ufs_sysfs_hid_is_visible(struct kobject *kobj, + return hba->dev_info.hid_sup ? attr->mode : 0; + } + +-static const struct attribute_group ufs_sysfs_hid_group = { ++const struct attribute_group ufs_sysfs_hid_group = { + .name = "hid", + .attrs = ufs_sysfs_hid, + .is_visible = ufs_sysfs_hid_is_visible, +diff --git a/drivers/ufs/core/ufs-sysfs.h b/drivers/ufs/core/ufs-sysfs.h +index 8d94af3b80771..6efb82a082fdd 100644 +--- a/drivers/ufs/core/ufs-sysfs.h ++++ b/drivers/ufs/core/ufs-sysfs.h +@@ -14,5 +14,6 @@ void ufs_sysfs_remove_nodes(struct device *dev); + + extern const struct attribute_group ufs_sysfs_unit_descriptor_group; + extern const struct attribute_group ufs_sysfs_lun_attributes_group; ++extern const struct attribute_group ufs_sysfs_hid_group; + + #endif +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index 96a0f5fcc0e57..465e66dbe08e8 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -8482,6 +8482,8 @@ static int ufs_get_device_desc(struct ufs_hba *hba) + DEVICE_DESC_PARAM_EXT_UFS_FEATURE_SUP) & + UFS_DEV_HID_SUPPORT; + ++ sysfs_update_group(&hba->dev->kobj, &ufs_sysfs_hid_group); ++ + model_index = desc_buf[DEVICE_DESC_PARAM_PRDCT_NAME]; + + err = ufshcd_read_string_desc(hba, model_index, +-- +2.51.0 + diff --git a/queue-6.17/selftest-net-ovpn-fix-uninit-return-values.patch b/queue-6.17/selftest-net-ovpn-fix-uninit-return-values.patch new file mode 100644 index 0000000000..792d735087 --- /dev/null +++ b/queue-6.17/selftest-net-ovpn-fix-uninit-return-values.patch @@ -0,0 +1,75 @@ +From 656df4fcfd24bde9c16541d5d4bf69a6fbb31bfa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 18:01:08 +0530 +Subject: selftest: net: ovpn: Fix uninit return values + +From: Sidharth Seela + +[ Upstream commit 7fc25c5a5ae6230d14b4c088fc94dbd58b2a9f3a ] + +Fix functions that return undefined values. These issues were caught by +running clang using LLVM=1 option. + +Clang warnings are as follows: +ovpn-cli.c:1587:6: warning: variable 'ret' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized] + 1587 | if (!sock) { + | ^~~~~ +ovpn-cli.c:1635:9: note: uninitialized use occurs here + 1635 | return ret; + | ^~~ +ovpn-cli.c:1587:2: note: remove the 'if' if its condition is always false + 1587 | if (!sock) { + | ^~~~~~~~~~~~ + 1588 | fprintf(stderr, "cannot allocate netlink socket\n"); + | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + 1589 | goto err_free; + | ~~~~~~~~~~~~~~ + 1590 | } + | ~ +ovpn-cli.c:1584:15: note: initialize the variable 'ret' to silence this warning + 1584 | int mcid, ret; + | ^ + | = 0 +ovpn-cli.c:2107:7: warning: variable 'ret' is used uninitialized whenever switch case is taken [-Wsometimes-uninitialized] + 2107 | case CMD_INVALID: + | ^~~~~~~~~~~ +ovpn-cli.c:2111:9: note: uninitialized use occurs here + 2111 | return ret; + | ^~~ +ovpn-cli.c:1939:12: note: initialize the variable 'ret' to silence this warning + 1939 | int n, ret; + | ^ + | + +Fixes: 959bc330a439 ("testing/selftests: add test tool and scripts for ovpn module") +Signed-off-by: Sidharth Seela +Link: https://patch.msgid.link/20251001123107.96244-2-sidharthseela@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/ovpn/ovpn-cli.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/testing/selftests/net/ovpn/ovpn-cli.c b/tools/testing/selftests/net/ovpn/ovpn-cli.c +index 9201f2905f2ce..8d0f2f61923c9 100644 +--- a/tools/testing/selftests/net/ovpn/ovpn-cli.c ++++ b/tools/testing/selftests/net/ovpn/ovpn-cli.c +@@ -1586,6 +1586,7 @@ static int ovpn_listen_mcast(void) + sock = nl_socket_alloc(); + if (!sock) { + fprintf(stderr, "cannot allocate netlink socket\n"); ++ ret = -ENOMEM; + goto err_free; + } + +@@ -2105,6 +2106,7 @@ static int ovpn_run_cmd(struct ovpn_ctx *ovpn) + ret = ovpn_listen_mcast(); + break; + case CMD_INVALID: ++ ret = -EINVAL; + break; + } + +-- +2.51.0 + diff --git a/queue-6.17/selftests-netfilter-nft_fib.sh-fix-spurious-test-fai.patch b/queue-6.17/selftests-netfilter-nft_fib.sh-fix-spurious-test-fai.patch new file mode 100644 index 0000000000..085ceb99c8 --- /dev/null +++ b/queue-6.17/selftests-netfilter-nft_fib.sh-fix-spurious-test-fai.patch @@ -0,0 +1,93 @@ +From e3e36450dff34aa12e6ed772b06dc378a3523753 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 15:00:06 +0200 +Subject: selftests: netfilter: nft_fib.sh: fix spurious test failures + +From: Florian Westphal + +[ Upstream commit a126ab6b26f107f4eb100c8c77e9f10b706f26e6 ] + +Jakub reports spurious failure of nft_fib.sh test. +This is caused by a subtle bug inherited when i moved faulty ping +from one test case to another. + +nft_fib.sh not only checks that the fib expression matched, it also +records the number of matches and then validates we have the expected +count. When I did this it was under the assumption that we would +have 0 to n matching packets. In case of the failure, the entry has +n+1 matching packets. + +This happens because ping_unreachable helper uses "ping -c 1 -w 1", +instead of the intended "-W". -w alters the meaning of -c (count), +namely, its then treated as number of wanted *replies* instead of +"number of packets to send". + +So, in some cases, ping -c 1 -w 1 ends up sending two packets which then +makes the test fail due to the higher-than-expected packet count. + +Fix the actual bug (s/-w/-W) and also change the error handling: +1. Show the number of expected packets in the error message +2. Always try to delete the key from the set. + Else, later test that makes sure we don't have unexpected keys + in there will always fail as well. + +Reported-by: Jakub Kicinski +Closes: https://lore.kernel.org/netfilter-devel/20250927090709.0b3cd783@kernel.org/ +Fixes: 98287045c979 ("selftests: netfilter: move fib vrf test to nft_fib.sh") +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/netfilter/nft_fib.sh | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/tools/testing/selftests/net/netfilter/nft_fib.sh b/tools/testing/selftests/net/netfilter/nft_fib.sh +index 9929a9ffef652..04544905c2164 100755 +--- a/tools/testing/selftests/net/netfilter/nft_fib.sh ++++ b/tools/testing/selftests/net/netfilter/nft_fib.sh +@@ -256,12 +256,12 @@ test_ping_unreachable() { + local daddr4=$1 + local daddr6=$2 + +- if ip netns exec "$ns1" ping -c 1 -w 1 -q "$daddr4" > /dev/null; then ++ if ip netns exec "$ns1" ping -c 1 -W 0.1 -q "$daddr4" > /dev/null; then + echo "FAIL: ${ns1} could reach $daddr4" 1>&2 + return 1 + fi + +- if ip netns exec "$ns1" ping -c 1 -w 1 -q "$daddr6" > /dev/null; then ++ if ip netns exec "$ns1" ping -c 1 -W 0.1 -q "$daddr6" > /dev/null; then + echo "FAIL: ${ns1} could reach $daddr6" 1>&2 + return 1 + fi +@@ -437,14 +437,17 @@ check_type() + local addr="$3" + local type="$4" + local count="$5" ++ local lret=0 + + [ -z "$count" ] && count=1 + + if ! ip netns exec "$nsrouter" nft get element inet t "$setname" { "$iifname" . "$addr" . "$type" } |grep -q "counter packets $count";then +- echo "FAIL: did not find $iifname . $addr . $type in $setname" ++ echo "FAIL: did not find $iifname . $addr . $type in $setname with $count packets" + ip netns exec "$nsrouter" nft list set inet t "$setname" + ret=1 +- return 1 ++ # do not fail right away, delete entry if it exists so later test that ++ # checks for unwanted keys don't get confused by this *expected* key. ++ lret=1 + fi + + # delete the entry, this allows to check if anything unexpected appeared +@@ -456,7 +459,7 @@ check_type() + return 1 + fi + +- return 0 ++ return $lret + } + + check_local() +-- +2.51.0 + diff --git a/queue-6.17/selftests-netfilter-query-conntrack-state-to-check-f.patch b/queue-6.17/selftests-netfilter-query-conntrack-state-to-check-f.patch new file mode 100644 index 0000000000..0a142de255 --- /dev/null +++ b/queue-6.17/selftests-netfilter-query-conntrack-state-to-check-f.patch @@ -0,0 +1,130 @@ +From b64c87e19c70a4c95fbb6a831a4cae5f253c4c61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 15:05:41 +0200 +Subject: selftests: netfilter: query conntrack state to check for port clash + resolution + +From: Florian Westphal + +[ Upstream commit e84945bdc619ed4243ba4298dbb8ca2062026474 ] + +Jakub reported this self test flaking occasionally (fails, but passes on +re-run) on debug kernels. + +This is because the test checks for elapsed time to determine if both +connections were established in parallel. + +Rework this to no longer depend on timing. +Use busywait helper to check that both sockets have moved to established +state and then query the conntrack engine for the two entries. + +Reported-by: Jakub Kicinski +Closes: https://lore.kernel.org/netfilter-devel/20250926163318.40d1a502@kernel.org/ +Fixes: 117e149e26d1 ("selftests: netfilter: test nat source port clash resolution interaction with tcp early demux") +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + .../selftests/net/netfilter/nf_nat_edemux.sh | 58 +++++++++++++------ + 1 file changed, 41 insertions(+), 17 deletions(-) + +diff --git a/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh b/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh +index 1014551dd7694..6731fe1eaf2e9 100755 +--- a/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh ++++ b/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh +@@ -17,9 +17,31 @@ cleanup() + + checktool "socat -h" "run test without socat" + checktool "iptables --version" "run test without iptables" ++checktool "conntrack --version" "run test without conntrack" + + trap cleanup EXIT + ++connect_done() ++{ ++ local ns="$1" ++ local port="$2" ++ ++ ip netns exec "$ns" ss -nt -o state established "dport = :$port" | grep -q "$port" ++} ++ ++check_ctstate() ++{ ++ local ns="$1" ++ local dp="$2" ++ ++ if ! ip netns exec "$ns" conntrack --get -s 192.168.1.2 -d 192.168.1.1 -p tcp \ ++ --sport 10000 --dport "$dp" --state ESTABLISHED > /dev/null 2>&1;then ++ echo "FAIL: Did not find expected state for dport $2" ++ ip netns exec "$ns" bash -c 'conntrack -L; conntrack -S; ss -nt' ++ ret=1 ++ fi ++} ++ + setup_ns ns1 ns2 + + # Connect the namespaces using a veth pair +@@ -44,15 +66,18 @@ socatpid=$! + ip netns exec "$ns2" sysctl -q net.ipv4.ip_local_port_range="10000 10000" + + # add a virtual IP using DNAT +-ip netns exec "$ns2" iptables -t nat -A OUTPUT -d 10.96.0.1/32 -p tcp --dport 443 -j DNAT --to-destination 192.168.1.1:5201 ++ip netns exec "$ns2" iptables -t nat -A OUTPUT -d 10.96.0.1/32 -p tcp --dport 443 -j DNAT --to-destination 192.168.1.1:5201 || exit 1 + + # ... and route it to the other namespace + ip netns exec "$ns2" ip route add 10.96.0.1 via 192.168.1.1 + +-# add a persistent connection from the other namespace +-ip netns exec "$ns2" socat -t 10 - TCP:192.168.1.1:5201 > /dev/null & ++# listener should be up by now, wait if it isn't yet. ++wait_local_port_listen "$ns1" 5201 tcp + +-sleep 1 ++# add a persistent connection from the other namespace ++sleep 10 | ip netns exec "$ns2" socat -t 10 - TCP:192.168.1.1:5201 > /dev/null & ++cpid0=$! ++busywait "$BUSYWAIT_TIMEOUT" connect_done "$ns2" "5201" + + # ip daddr:dport will be rewritten to 192.168.1.1 5201 + # NAT must reallocate source port 10000 because +@@ -71,26 +96,25 @@ fi + ip netns exec "$ns1" iptables -t nat -A PREROUTING -p tcp --dport 5202 -j REDIRECT --to-ports 5201 + ip netns exec "$ns1" iptables -t nat -A PREROUTING -p tcp --dport 5203 -j REDIRECT --to-ports 5201 + +-sleep 5 | ip netns exec "$ns2" socat -t 5 -u STDIN TCP:192.168.1.1:5202,connect-timeout=5 >/dev/null & ++sleep 5 | ip netns exec "$ns2" socat -T 5 -u STDIN TCP:192.168.1.1:5202,connect-timeout=5 >/dev/null & ++cpid1=$! + +-# if connect succeeds, client closes instantly due to EOF on stdin. +-# if connect hangs, it will time out after 5s. +-echo | ip netns exec "$ns2" socat -t 3 -u STDIN TCP:192.168.1.1:5203,connect-timeout=5 >/dev/null & ++sleep 5 | ip netns exec "$ns2" socat -T 5 -u STDIN TCP:192.168.1.1:5203,connect-timeout=5 >/dev/null & + cpid2=$! + +-time_then=$(date +%s) +-wait $cpid2 +-rv=$? +-time_now=$(date +%s) ++busywait "$BUSYWAIT_TIMEOUT" connect_done "$ns2" 5202 ++busywait "$BUSYWAIT_TIMEOUT" connect_done "$ns2" 5203 + +-# Check how much time has elapsed, expectation is for +-# 'cpid2' to connect and then exit (and no connect delay). +-delta=$((time_now - time_then)) ++check_ctstate "$ns1" 5202 ++check_ctstate "$ns1" 5203 + +-if [ $delta -lt 2 ] && [ $rv -eq 0 ]; then ++kill $socatpid $cpid0 $cpid1 $cpid2 ++socatpid=0 ++ ++if [ $ret -eq 0 ]; then + echo "PASS: could connect to service via redirected ports" + else +- echo "FAIL: socat cannot connect to service via redirect ($delta seconds elapsed, returned $rv)" ++ echo "FAIL: socat cannot connect to service via redirect" + ret=1 + fi + +-- +2.51.0 + diff --git a/queue-6.17/series b/queue-6.17/series index 490108944b..10ff2cfcc1 100644 --- a/queue-6.17/series +++ b/queue-6.17/series @@ -17,3 +17,119 @@ kvm-svm-emulate-perf_cntr_global_status_set-for-perfmonv2.patch iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch media-v4l2-subdev-fix-alloc-failure-check-in-v4l2_subdev_call_state_try.patch asm-generic-io.h-skip-trace-helpers-if-rwmmio-events-are-disabled.patch +clk-npcm-select-config_auxiliary_bus.patch +clk-thead-th1520-ap-describe-gate-clocks-with-clk_ga.patch +clk-thead-th1520-ap-fix-parent-of-padctrl0-clock.patch +clk-thead-correct-parent-for-dpu-pixel-clocks.patch +clk-renesas-r9a08g045-add-mstop-for-gpio.patch +perf-disasm-avoid-undefined-behavior-in-incrementing.patch +perf-test-trace_btf_enum-skip-if-permissions-are-ins.patch +perf-evsel-avoid-container_of-on-a-null-leader.patch +libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch +clk-qcom-common-fix-null-vs-is_err-check-in-qcom_cc_.patch +clk-qcom-select-the-intended-config-in-qcs_dispcc_61.patch +perf-parse-events-handle-fake-pmus-in-cpu-terms.patch +clk-at91-peripheral-fix-return-value.patch +clk-renesas-cpg-mssr-fix-memory-leak-in-cpg_mssr_res.patch +perf-completely-remove-possibility-to-override-max_n.patch +perf-drm_pmu-fix-fd_dir-leaks-in-for_each_drm_fdinfo.patch +perf-util-fix-compression-checks-returning-1-as-bool.patch +rtc-x1205-fix-xicor-x1205-vendor-prefix.patch +rtc-optee-fix-memory-leak-on-driver-removal.patch +perf-arm_spe-correct-setting-remote-access.patch +perf-arm_spe-correct-memory-level-for-remote-access.patch +perf-vendor-events-arm64-ampereonex-fix-typo-should-.patch +perf-test-amd-ibs-swfilt-skip-kernel-tests-if-parano.patch +perf-test-shell-lbr-avoid-failures-with-perf-event-p.patch +perf-trace-fix-is_err-vs-null-check-bug.patch +perf-session-fix-handling-when-buffer-exceeds-2-gib.patch +perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch +perf-evsel-fix-uniquification-when-pmu-given-without.patch +perf-test-avoid-uncore_imc-clockticks-in-uniquificat.patch +perf-evsel-ensure-the-fallback-message-is-always-wri.patch +perf-build-id-ensure-snprintf-string-is-empty-when-s.patch +clk-mediatek-mt8195-infra_ao-fix-parent-for-infra_ao.patch +clk-mediatek-clk-mux-do-not-pass-flags-to-clk_mux_de.patch +clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch +clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch +clk-tegra-do-not-overallocate-memory-for-bpmp-clocks.patch +nfsd-fix-assignment-of-ia_ctime.tv_nsec-on-delegated.patch +nfsd-ignore-attr_deleg-when-checking-ia_valid-before.patch +vfs-add-attr_ctime_set-flag.patch +nfsd-use-attr_ctime_set-for-delegated-ctime-updates.patch +nfsd-track-original-timestamps-in-nfs4_delegation.patch +nfsd-fix-setattr-updates-for-delegated-timestamps.patch +nfsd-fix-timestamp-updates-in-cb_getattr.patch +tracing-fix-the-bug-where-bpf_get_stackid-returns-ef.patch +pm-core-annotate-loops-walking-device-links-as-_srcu.patch +pm-core-add-two-macros-for-walking-device-links.patch +pm-sleep-do-not-wait-on-sync_state_only-device-links.patch +cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch +scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch +perf-bpf-filter-fix-opts-declaration-on-older-libbpf.patch +scsi-ufs-sysfs-make-hid-attributes-visible.patch +mshv-handle-need_resched_lazy-before-transferring-to.patch +perf-bpf_counter-fix-handling-of-cpumap-fixing-hybri.patch +asoc-sof-ipc4-topology-correct-the-minimum-host-dma-.patch +asoc-sof-ipc4-topology-account-for-different-chaindm.patch +asoc-sof-intel-hda-pcm-place-the-constraint-on-perio.patch +loongarch-add-cflag-fno-isolate-erroneous-paths-dere.patch +loongarch-fix-build-error-for-lto-with-llvm-18.patch +loongarch-init-acpi_gbl_use_global_lock-to-false.patch +asoc-sof-intel-read-the-llp-via-the-associated-link-.patch +net-usb-lan78xx-fix-lost-eeprom-read-timeout-error-e.patch +net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch +drm-xe-hw_engine_group-fix-double-write-lock-release.patch +drm-xe-i2c-don-t-rely-on-d3cold.allowed-flag-in-syst.patch +s390-cio-update-purge-function-to-unregister-the-unu.patch +drm-vmwgfx-fix-a-null-ptr-access-in-the-cursor-snoop.patch +drm-vmwgfx-fix-use-after-free-in-validation.patch +drm-vmwgfx-fix-copy-paste-typo-in-validation.patch +net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch +tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch +net-mscc-ocelot-fix-use-after-free-caused-by-cyclic-.patch +selftest-net-ovpn-fix-uninit-return-values.patch +ice-ice_adapter-release-xa-entry-on-adapter-allocati.patch +net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch +tools-build-align-warning-options-with-perf.patch +perf-python-split-clang-options-when-invoking-popen.patch +tcp-take-care-of-zero-tp-window_clamp-in-tcp_set_rcv.patch +perf-tools-fix-arm64-libjvmti-build-by-generating-un.patch +mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch +mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch +mailbox-zynqmp-ipi-fix-out-of-bounds-access-in-mailb.patch +mailbox-zynqmp-ipi-fix-sgi-cleanup-on-unbind.patch +bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch +net-mdio-mdio-i2c-hold-the-i2c-bus-lock-during-smbus.patch +net-sparx5-lan969x-fix-flooding-configuration-on-bri.patch +net-mlx5-prevent-tunnel-mode-conflicts-between-fdb-a.patch +net-mlx5e-prevent-tunnel-reformat-when-tunnel-mode-n.patch +mailbox-mtk-cmdq-remove-pm_runtime-apis-from-cmdq_mb.patch +drm-amdgpu-add-additional-dce6-scl-registers.patch +drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch +drm-amd-display-properly-clear-scl_-_filter_control-.patch +drm-amd-display-properly-disable-scaling-on-dce6.patch +drm-amd-display-disable-scaling-on-dce6-for-now.patch +drm-amdkfd-fix-kfd-process-ref-leaking-when-userptr-.patch +net-pse-pd-tps23881-fix-current-measurement-scaling.patch +crypto-skcipher-fix-reqsize-handling.patch +netfilter-nft_objref-validate-objref-and-objrefmap-e.patch +bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch +selftests-netfilter-nft_fib.sh-fix-spurious-test-fai.patch +selftests-netfilter-query-conntrack-state-to-check-f.patch +io_uring-zcrx-increment-fallback-loop-src-offset.patch +crypto-essiv-check-ssize-for-decryption-and-in-place.patch +net-airoha-fix-loopback-mode-configuration-for-gdm2-.patch +cifs-fix-copy_to_iter-return-value-check.patch +smb-client-fix-missing-timestamp-updates-after-utime.patch +rtc-isl12022-fix-initial-enable_irq-disable_irq-bala.patch +cifs-query-ea-lxmod-in-cifs_query_path_info-for-wsl-.patch +tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch +gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch +bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch +kbuild-always-create-intermediate-vmlinux.unstripped.patch +kbuild-keep-.modinfo-section-in-vmlinux.unstripped.patch +kbuild-restore-pattern-to-avoid-stripping-.rela.dyn-.patch +kbuild-add-.rel.-strip-pattern-for-vmlinux.patch +s390-vmlinux.lds.s-reorder-sections.patch +s390-vmlinux.lds.s-move-.vmlinux.info-to-end-of-allo.patch diff --git a/queue-6.17/smb-client-fix-missing-timestamp-updates-after-utime.patch b/queue-6.17/smb-client-fix-missing-timestamp-updates-after-utime.patch new file mode 100644 index 0000000000..cd95e27eca --- /dev/null +++ b/queue-6.17/smb-client-fix-missing-timestamp-updates-after-utime.patch @@ -0,0 +1,108 @@ +From 421052dd94cb1d32fa8a6b9a3e1390385d4ca4cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 16:23:24 -0300 +Subject: smb: client: fix missing timestamp updates after utime(2) + +From: Paulo Alcantara + +[ Upstream commit b95cd1bdf5aa9221c98fc9259014b8bb8d1829d7 ] + +Don't reuse open handle when changing timestamps to prevent the server +from disabling automatic timestamp updates as per MS-FSA 2.1.4.17. + +---8<--- +import os +import time + +filename = '/mnt/foo' + +def print_stat(prefix): + st = os.stat(filename) + print(prefix, ': ', time.ctime(st.st_atime), time.ctime(st.st_ctime)) + +fd = os.open(filename, os.O_CREAT|os.O_TRUNC|os.O_WRONLY, 0o644) +print_stat('old') +os.utime(fd, None) +time.sleep(2) +os.write(fd, b'foo') +os.close(fd) +time.sleep(2) +print_stat('new') +---8<--- + +Before patch: + +$ mount.cifs //srv/share /mnt -o ... +$ python3 run.py +old : Fri Oct 3 14:01:21 2025 Fri Oct 3 14:01:21 2025 +new : Fri Oct 3 14:01:21 2025 Fri Oct 3 14:01:21 2025 + +After patch: + +$ mount.cifs //srv/share /mnt -o ... +$ python3 run.py +old : Fri Oct 3 17:03:34 2025 Fri Oct 3 17:03:34 2025 +new : Fri Oct 3 17:03:36 2025 Fri Oct 3 17:03:36 2025 + +Fixes: b6f2a0f89d7e ("cifs: for compound requests, use open handle if possible") +Signed-off-by: Paulo Alcantara (Red Hat) +Cc: Frank Sorenson +Reviewed-by: David Howells +Cc: linux-cifs@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2inode.c | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c +index 0985db9f86e51..e441fa2e76897 100644 +--- a/fs/smb/client/smb2inode.c ++++ b/fs/smb/client/smb2inode.c +@@ -1382,31 +1382,33 @@ int + smb2_set_file_info(struct inode *inode, const char *full_path, + FILE_BASIC_INFO *buf, const unsigned int xid) + { +- struct cifs_open_parms oparms; ++ struct kvec in_iov = { .iov_base = buf, .iov_len = sizeof(*buf), }; + struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb); ++ struct cifsFileInfo *cfile = NULL; ++ struct cifs_open_parms oparms; + struct tcon_link *tlink; + struct cifs_tcon *tcon; +- struct cifsFileInfo *cfile; +- struct kvec in_iov = { .iov_base = buf, .iov_len = sizeof(*buf), }; +- int rc; +- +- if ((buf->CreationTime == 0) && (buf->LastAccessTime == 0) && +- (buf->LastWriteTime == 0) && (buf->ChangeTime == 0) && +- (buf->Attributes == 0)) +- return 0; /* would be a no op, no sense sending this */ ++ int rc = 0; + + tlink = cifs_sb_tlink(cifs_sb); + if (IS_ERR(tlink)) + return PTR_ERR(tlink); + tcon = tlink_tcon(tlink); + +- cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile); ++ if ((buf->CreationTime == 0) && (buf->LastAccessTime == 0) && ++ (buf->LastWriteTime == 0) && (buf->ChangeTime == 0)) { ++ if (buf->Attributes == 0) ++ goto out; /* would be a no op, no sense sending this */ ++ cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile); ++ } ++ + oparms = CIFS_OPARMS(cifs_sb, tcon, full_path, FILE_WRITE_ATTRIBUTES, + FILE_OPEN, 0, ACL_NO_MODE); + rc = smb2_compound_op(xid, tcon, cifs_sb, + full_path, &oparms, &in_iov, + &(int){SMB2_OP_SET_INFO}, 1, + cfile, NULL, NULL, NULL); ++out: + cifs_put_tlink(tlink); + return rc; + } +-- +2.51.0 + diff --git a/queue-6.17/tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch b/queue-6.17/tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch new file mode 100644 index 0000000000..266ad8b39b --- /dev/null +++ b/queue-6.17/tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch @@ -0,0 +1,87 @@ +From fa5edc9b80118b623c94a1c4048f1819b5f4f644 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 23:37:54 +0000 +Subject: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). + +From: Kuniyuki Iwashima + +[ Upstream commit 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c ] + +syzbot reported the splat below in tcp_conn_request(). [0] + +If a listener is close()d while a TFO socket is being processed in +tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk +and calls inet_child_forget(), which calls tcp_disconnect() for the +TFO socket. + +After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), +where reqsk_put() is called due to !reqsk->sk. + +Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the +last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the +drop_and_free label causes the refcount underflow for the listener +and double-free of the reqsk. + +Let's remove reqsk_fastopen_remove() in tcp_conn_request(). + +Note that other callers make sure tp->fastopen_rsk is not NULL. + +[0]: +refcount_t: underflow; use-after-free. +WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) +Modules linked in: +CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 +RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) +Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 +RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 +RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 +RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280 +RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 +R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 +R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8 +FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0 +Call Trace: + + tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) + tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) + tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) + tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) + ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) + ip6_input (net/ipv6/ip6_input.c:500) + ipv6_rcv (net/ipv6/ip6_input.c:311) + __netif_receive_skb (net/core/dev.c:6104) + process_backlog (net/core/dev.c:6456) + __napi_poll (net/core/dev.c:7506) + net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) + handle_softirqs (kernel/softirq.c:579) + do_softirq (kernel/softirq.c:480) + + +Fixes: 45c8a6cc2bcd ("tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().") +Reported-by: syzkaller +Signed-off-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20251001233755.1340927-1-kuniyu@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 64f93668a8452..a88e82f7ec485 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -7275,7 +7275,6 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, + &foc, TCP_SYNACK_FASTOPEN, skb); + /* Add the child socket directly into the accept queue */ + if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) { +- reqsk_fastopen_remove(fastopen_sk, req, false); + bh_unlock_sock(fastopen_sk); + sock_put(fastopen_sk); + goto drop_and_free; +-- +2.51.0 + diff --git a/queue-6.17/tcp-take-care-of-zero-tp-window_clamp-in-tcp_set_rcv.patch b/queue-6.17/tcp-take-care-of-zero-tp-window_clamp-in-tcp_set_rcv.patch new file mode 100644 index 0000000000..d0243a0a07 --- /dev/null +++ b/queue-6.17/tcp-take-care-of-zero-tp-window_clamp-in-tcp_set_rcv.patch @@ -0,0 +1,64 @@ +From d67b8e98569398275c1e3be85761c32775313793 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 18:41:19 +0000 +Subject: tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() + +From: Eric Dumazet + +[ Upstream commit 21b29e74ffe5a6c851c235bb80bf5ee26292c67b ] + +Some applications (like selftests/net/tcp_mmap.c) call SO_RCVLOWAT +on their listener, before accept(). + +This has an unfortunate effect on wscale selection in +tcp_select_initial_window() during 3WHS. + +For instance, tcp_mmap was negotiating wscale 4, regardless +of tcp_rmem[2] and sysctl_rmem_max. + +Do not change tp->window_clamp if it is zero +or bigger than our computed value. + +Zero value is special, it allows tcp_select_initial_window() +to enable autotuning. + +Note that SO_RCVLOWAT use on listener is probably not wise, +because tp->scaling_ratio has a default value, possibly wrong. + +Fixes: d1361840f8c5 ("tcp: fix SO_RCVLOWAT and RCVBUF autotuning") +Signed-off-by: Eric Dumazet +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Neal Cardwell +Link: https://patch.msgid.link/20251003184119.2526655-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 89040007c7b70..ba36f558f144c 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -1771,6 +1771,7 @@ EXPORT_IPV6_MOD(tcp_peek_len); + /* Make sure sk_rcvbuf is big enough to satisfy SO_RCVLOWAT hint */ + int tcp_set_rcvlowat(struct sock *sk, int val) + { ++ struct tcp_sock *tp = tcp_sk(sk); + int space, cap; + + if (sk->sk_userlocks & SOCK_RCVBUF_LOCK) +@@ -1789,7 +1790,9 @@ int tcp_set_rcvlowat(struct sock *sk, int val) + space = tcp_space_from_win(sk, val); + if (space > sk->sk_rcvbuf) { + WRITE_ONCE(sk->sk_rcvbuf, space); +- WRITE_ONCE(tcp_sk(sk)->window_clamp, val); ++ ++ if (tp->window_clamp && tp->window_clamp < val) ++ WRITE_ONCE(tp->window_clamp, val); + } + return 0; + } +-- +2.51.0 + diff --git a/queue-6.17/tools-build-align-warning-options-with-perf.patch b/queue-6.17/tools-build-align-warning-options-with-perf.patch new file mode 100644 index 0000000000..2cbe938dd2 --- /dev/null +++ b/queue-6.17/tools-build-align-warning-options-with-perf.patch @@ -0,0 +1,62 @@ +From f656ca700cd15b067b05e1de273e192163aed761 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Oct 2025 17:21:23 +0100 +Subject: tools build: Align warning options with perf + +From: Leo Yan + +[ Upstream commit 53d067feb8c4f16d1f24ce3f4df4450bb18c555f ] + +The feature test programs are built without enabling '-Wall -Werror' +options. As a result, a feature may appear to be available, but later +building in perf can fail with stricter checks. + +Make the feature test program use the same warning options as perf. + +Fixes: 1925459b4d92 ("tools build: Fix feature Makefile issues with 'O='") +Signed-off-by: Leo Yan +Reviewed-by: Ian Rogers +Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-1-4305590795b2@arm.com +Cc: Palmer Dabbelt +Cc: Albert Ou +Cc: Alexandre Ghiti +Cc: Nick Desaulniers +Cc: Justin Stitt +Cc: Bill Wendling +Cc: Adrian Hunter +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Nathan Chancellor +Cc: James Clark +Cc: linux-riscv@lists.infradead.org +Cc: llvm@lists.linux.dev +Cc: Paul Walmsley +Cc: linux-kernel@vger.kernel.org +Cc: linux-perf-users@vger.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/build/feature/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile +index b41a42818d8ac..bd615a708a0aa 100644 +--- a/tools/build/feature/Makefile ++++ b/tools/build/feature/Makefile +@@ -316,10 +316,10 @@ $(OUTPUT)test-libcapstone.bin: + $(BUILD) # -lcapstone provided by $(FEATURE_CHECK_LDFLAGS-libcapstone) + + $(OUTPUT)test-compile-32.bin: +- $(CC) -m32 -o $@ test-compile.c ++ $(CC) -m32 -Wall -Werror -o $@ test-compile.c + + $(OUTPUT)test-compile-x32.bin: +- $(CC) -mx32 -o $@ test-compile.c ++ $(CC) -mx32 -Wall -Werror -o $@ test-compile.c + + $(OUTPUT)test-zlib.bin: + $(BUILD) -lz +-- +2.51.0 + diff --git a/queue-6.17/tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch b/queue-6.17/tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch new file mode 100644 index 0000000000..5e460cf88c --- /dev/null +++ b/queue-6.17/tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch @@ -0,0 +1,42 @@ +From a93f20a8d1e8aca2927eaa48bcef30a3baaf01ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 18:49:40 +0300 +Subject: tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single + +From: Gunnar Kudrjavets + +[ Upstream commit 8a81236f2cb0882c7ea6c621ce357f7f3f601fe5 ] + +The tpm_tis_write8() call specifies arguments in wrong order. Should be +(data, addr, value) not (data, value, addr). The initial correct order +was changed during the major refactoring when the code was split. + +Fixes: 41a5e1cf1fe1 ("tpm/tpm_tis: Split tpm_tis driver into a core and TCG TIS compliant phy") +Signed-off-by: Gunnar Kudrjavets +Reviewed-by: Justinien Bouron +Reviewed-by: Jarkko Sakkinen +Reviewed-by: Paul Menzel +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index 4b12c4b9da8be..8954a8660ffc5 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -978,8 +978,8 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, + * will call disable_irq which undoes all of the above. + */ + if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) { +- tpm_tis_write8(priv, original_int_vec, +- TPM_INT_VECTOR(priv->locality)); ++ tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), ++ original_int_vec); + rc = -1; + } + +-- +2.51.0 + diff --git a/queue-6.17/tracing-fix-the-bug-where-bpf_get_stackid-returns-ef.patch b/queue-6.17/tracing-fix-the-bug-where-bpf_get_stackid-returns-ef.patch new file mode 100644 index 0000000000..42c5d9651d --- /dev/null +++ b/queue-6.17/tracing-fix-the-bug-where-bpf_get_stackid-returns-ef.patch @@ -0,0 +1,49 @@ +From c3325e2ad717a59f4df47b6b63f1c513b3a2b6b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 10:08:22 +0800 +Subject: tracing: Fix the bug where bpf_get_stackid returns -EFAULT on the + ARM64 + +From: Feng Yang + +[ Upstream commit fd2f74f8f3d3c1a524637caf5bead9757fae4332 ] + +When using bpf_program__attach_kprobe_multi_opts on ARM64 to hook a BPF program +that contains the bpf_get_stackid function, the BPF program fails +to obtain the stack trace and returns -EFAULT. + +This is because ftrace_partial_regs omits the configuration of the pstate register, +leaving pstate at the default value of 0. When get_perf_callchain executes, +it uses user_mode(regs) to determine whether it is in kernel mode. +This leads to a misjudgment that the code is in user mode, +so perf_callchain_kernel is not executed and the function returns directly. +As a result, trace->nr becomes 0, and finally -EFAULT is returned. + +Therefore, the assignment of the pstate register is added here. + +Fixes: b9b55c8912ce ("tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs") +Closes: https://lore.kernel.org/bpf/20250919071902.554223-1-yangfeng59949@163.com/ +Signed-off-by: Feng Yang +Tested-by: Jiri Olsa +Acked-by: Masami Hiramatsu (Google) +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/ftrace.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/include/asm/ftrace.h b/arch/arm64/include/asm/ftrace.h +index bfe3ce9df1978..ba7cf7fec5e97 100644 +--- a/arch/arm64/include/asm/ftrace.h ++++ b/arch/arm64/include/asm/ftrace.h +@@ -153,6 +153,7 @@ ftrace_partial_regs(const struct ftrace_regs *fregs, struct pt_regs *regs) + regs->pc = afregs->pc; + regs->regs[29] = afregs->fp; + regs->regs[30] = afregs->lr; ++ regs->pstate = PSR_MODE_EL1h; + return regs; + } + +-- +2.51.0 + diff --git a/queue-6.17/vfs-add-attr_ctime_set-flag.patch b/queue-6.17/vfs-add-attr_ctime_set-flag.patch new file mode 100644 index 0000000000..48f2c93290 --- /dev/null +++ b/queue-6.17/vfs-add-attr_ctime_set-flag.patch @@ -0,0 +1,118 @@ +From 4650ec53c9d142f0a801eadc593fa964425a26e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jul 2025 09:24:32 -0400 +Subject: vfs: add ATTR_CTIME_SET flag + +From: Jeff Layton + +[ Upstream commit afc5b36e29b95fbd31a60b9630d148857e5e513d ] + +When ATTR_ATIME_SET and ATTR_MTIME_SET are set in the ia_valid mask, the +notify_change() logic takes that to mean that the request should set +those values explicitly, and not override them with "now". + +With the advent of delegated timestamps, similar functionality is needed +for the ctime. Add a ATTR_CTIME_SET flag, and use that to indicate that +the ctime should be accepted as-is. Also, clean up the if statements to +eliminate the extra negatives. + +In setattr_copy() and setattr_copy_mgtime() use inode_set_ctime_deleg() +when ATTR_CTIME_SET is set, instead of basing the decision on ATTR_DELEG. + +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Stable-dep-of: c066ff58e5d6 ("nfsd: use ATTR_CTIME_SET for delegated ctime updates") +Signed-off-by: Sasha Levin +--- + fs/attr.c | 44 +++++++++++++++++++------------------------- + include/linux/fs.h | 1 + + 2 files changed, 20 insertions(+), 25 deletions(-) + +diff --git a/fs/attr.c b/fs/attr.c +index 5425c1dbbff92..795f231d00e8e 100644 +--- a/fs/attr.c ++++ b/fs/attr.c +@@ -286,20 +286,12 @@ static void setattr_copy_mgtime(struct inode *inode, const struct iattr *attr) + unsigned int ia_valid = attr->ia_valid; + struct timespec64 now; + +- if (ia_valid & ATTR_CTIME) { +- /* +- * In the case of an update for a write delegation, we must respect +- * the value in ia_ctime and not use the current time. +- */ +- if (ia_valid & ATTR_DELEG) +- now = inode_set_ctime_deleg(inode, attr->ia_ctime); +- else +- now = inode_set_ctime_current(inode); +- } else { +- /* If ATTR_CTIME isn't set, then ATTR_MTIME shouldn't be either. */ +- WARN_ON_ONCE(ia_valid & ATTR_MTIME); ++ if (ia_valid & ATTR_CTIME_SET) ++ now = inode_set_ctime_deleg(inode, attr->ia_ctime); ++ else if (ia_valid & ATTR_CTIME) ++ now = inode_set_ctime_current(inode); ++ else + now = current_time(inode); +- } + + if (ia_valid & ATTR_ATIME_SET) + inode_set_atime_to_ts(inode, attr->ia_atime); +@@ -359,12 +351,11 @@ void setattr_copy(struct mnt_idmap *idmap, struct inode *inode, + inode_set_atime_to_ts(inode, attr->ia_atime); + if (ia_valid & ATTR_MTIME) + inode_set_mtime_to_ts(inode, attr->ia_mtime); +- if (ia_valid & ATTR_CTIME) { +- if (ia_valid & ATTR_DELEG) +- inode_set_ctime_deleg(inode, attr->ia_ctime); +- else +- inode_set_ctime_to_ts(inode, attr->ia_ctime); +- } ++ ++ if (ia_valid & ATTR_CTIME_SET) ++ inode_set_ctime_deleg(inode, attr->ia_ctime); ++ else if (ia_valid & ATTR_CTIME) ++ inode_set_ctime_to_ts(inode, attr->ia_ctime); + } + EXPORT_SYMBOL(setattr_copy); + +@@ -463,15 +454,18 @@ int notify_change(struct mnt_idmap *idmap, struct dentry *dentry, + + now = current_time(inode); + +- attr->ia_ctime = now; +- if (!(ia_valid & ATTR_ATIME_SET)) +- attr->ia_atime = now; +- else ++ if (ia_valid & ATTR_ATIME_SET) + attr->ia_atime = timestamp_truncate(attr->ia_atime, inode); +- if (!(ia_valid & ATTR_MTIME_SET)) +- attr->ia_mtime = now; + else ++ attr->ia_atime = now; ++ if (ia_valid & ATTR_CTIME_SET) ++ attr->ia_ctime = timestamp_truncate(attr->ia_ctime, inode); ++ else ++ attr->ia_ctime = now; ++ if (ia_valid & ATTR_MTIME_SET) + attr->ia_mtime = timestamp_truncate(attr->ia_mtime, inode); ++ else ++ attr->ia_mtime = now; + + if (ia_valid & ATTR_KILL_PRIV) { + error = security_inode_need_killpriv(dentry); +diff --git a/include/linux/fs.h b/include/linux/fs.h +index 601d036a6c78e..74f2bfc519263 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -238,6 +238,7 @@ typedef int (dio_iodone_t)(struct kiocb *iocb, loff_t offset, + #define ATTR_ATIME_SET (1 << 7) + #define ATTR_MTIME_SET (1 << 8) + #define ATTR_FORCE (1 << 9) /* Not a change, but a change it */ ++#define ATTR_CTIME_SET (1 << 10) + #define ATTR_KILL_SUID (1 << 11) + #define ATTR_KILL_SGID (1 << 12) + #define ATTR_FILE (1 << 13) +-- +2.51.0 + diff --git a/queue-6.6/asoc-sof-ipc4-topology-correct-the-minimum-host-dma-.patch b/queue-6.6/asoc-sof-ipc4-topology-correct-the-minimum-host-dma-.patch new file mode 100644 index 0000000000..af92677be8 --- /dev/null +++ b/queue-6.6/asoc-sof-ipc4-topology-correct-the-minimum-host-dma-.patch @@ -0,0 +1,45 @@ +From 8774a788ebbe8d695ac2458f9d2e43fd41f63015 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 16:57:50 +0300 +Subject: ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size + +From: Peter Ujfalusi + +[ Upstream commit a7fe5ff832d61d9393095bc3dd5f06f4af7da3c1 ] + +The firmware has changed the minimum host buffer size from 2 periods to +4 periods (1 period is 1ms) which was missed by the kernel side. + +Adjust the SOF_IPC4_MIN_DMA_BUFFER_SIZE to 4 ms to align with firmware. + +Link: https://github.com/thesofproject/sof/commit/f0a14a3f410735db18a79eb7a5f40dc49fdee7a7 +Fixes: 594c1bb9ff73 ("ASoC: SOF: ipc4-topology: Do not parse the DMA_BUFFER_SIZE token") +Signed-off-by: Peter Ujfalusi +Reviewed-by: Ranjani Sridharan +Reviewed-by: Kai Vehmanen +Reviewed-by: Bard Liao +Link: https://patch.msgid.link/20251002135752.2430-2-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/ipc4-topology.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sof/ipc4-topology.h b/sound/soc/sof/ipc4-topology.h +index 0fb759c6eeaf9..07bd84204baa7 100644 +--- a/sound/soc/sof/ipc4-topology.h ++++ b/sound/soc/sof/ipc4-topology.h +@@ -59,8 +59,8 @@ + + #define SOF_IPC4_INVALID_NODE_ID 0xffffffff + +-/* FW requires minimum 2ms DMA buffer size */ +-#define SOF_IPC4_MIN_DMA_BUFFER_SIZE 2 ++/* FW requires minimum 4ms DMA buffer size */ ++#define SOF_IPC4_MIN_DMA_BUFFER_SIZE 4 + + /* + * The base of multi-gateways. Multi-gateways addressing starts from +-- +2.51.0 + diff --git a/queue-6.6/bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch b/queue-6.6/bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch new file mode 100644 index 0000000000..1aea9772a4 --- /dev/null +++ b/queue-6.6/bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch @@ -0,0 +1,74 @@ +From 5a2436e08f7b75565f6c36b59952f3a743dce014 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 18:26:26 +0800 +Subject: bpf: Avoid RCU context warning when unpinning htab with internal + structs + +From: KaFai Wan + +[ Upstream commit 4f375ade6aa9f37fd72d7a78682f639772089eed ] + +When unpinning a BPF hash table (htab or htab_lru) that contains internal +structures (timer, workqueue, or task_work) in its values, a BUG warning +is triggered: + BUG: sleeping function called from invalid context at kernel/bpf/hashtab.c:244 + in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 14, name: ksoftirqd/0 + ... + +The issue arises from the interaction between BPF object unpinning and +RCU callback mechanisms: +1. BPF object unpinning uses ->free_inode() which schedules cleanup via + call_rcu(), deferring the actual freeing to an RCU callback that + executes within the RCU_SOFTIRQ context. +2. During cleanup of hash tables containing internal structures, + htab_map_free_internal_structs() is invoked, which includes + cond_resched() or cond_resched_rcu() calls to yield the CPU during + potentially long operations. + +However, cond_resched() or cond_resched_rcu() cannot be safely called from +atomic RCU softirq context, leading to the BUG warning when attempting +to reschedule. + +Fix this by changing from ->free_inode() to ->destroy_inode() and rename +bpf_free_inode() to bpf_destroy_inode() for BPF objects (prog, map, link). +This allows direct inode freeing without RCU callback scheduling, +avoiding the invalid context warning. + +Reported-by: Le Chen +Closes: https://lore.kernel.org/all/1444123482.1827743.1750996347470.JavaMail.zimbra@sjtu.edu.cn/ +Fixes: 68134668c17f ("bpf: Add map side support for bpf timers.") +Suggested-by: Alexei Starovoitov +Signed-off-by: KaFai Wan +Acked-by: Yonghong Song +Link: https://lore.kernel.org/r/20251008102628.808045-2-kafai.wan@linux.dev +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/inode.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c +index 99d0625b6c828..9a9630adcba4f 100644 +--- a/kernel/bpf/inode.c ++++ b/kernel/bpf/inode.c +@@ -607,7 +607,7 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root) + return 0; + } + +-static void bpf_free_inode(struct inode *inode) ++static void bpf_destroy_inode(struct inode *inode) + { + enum bpf_type type; + +@@ -622,7 +622,7 @@ static const struct super_operations bpf_super_ops = { + .statfs = simple_statfs, + .drop_inode = generic_delete_inode, + .show_options = bpf_show_options, +- .free_inode = bpf_free_inode, ++ .destroy_inode = bpf_destroy_inode, + }; + + enum { +-- +2.51.0 + diff --git a/queue-6.6/bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch b/queue-6.6/bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch new file mode 100644 index 0000000000..5e287d2cd1 --- /dev/null +++ b/queue-6.6/bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch @@ -0,0 +1,64 @@ +From ac4398b502e8a5e50754bd3ac1709dc853e669ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 09:34:18 +0200 +Subject: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} + +From: Daniel Borkmann + +[ Upstream commit 23f3770e1a53e6c7a553135011f547209e141e72 ] + +Cilium has a BPF egress gateway feature which forces outgoing K8s Pod +traffic to pass through dedicated egress gateways which then SNAT the +traffic in order to interact with stable IPs outside the cluster. + +The traffic is directed to the gateway via vxlan tunnel in collect md +mode. A recent BPF change utilized the bpf_redirect_neigh() helper to +forward packets after the arrival and decap on vxlan, which turned out +over time that the kmalloc-256 slab usage in kernel was ever-increasing. + +The issue was that vxlan allocates the metadata_dst object and attaches +it through a fake dst entry to the skb. The latter was never released +though given bpf_redirect_neigh() was merely setting the new dst entry +via skb_dst_set() without dropping an existing one first. + +Fixes: b4ab31414970 ("bpf: Add redirect_neigh helper as redirect drop-in") +Reported-by: Yusuke Suzuki +Reported-by: Julian Wiedmann +Signed-off-by: Daniel Borkmann +Cc: Martin KaFai Lau +Cc: Jakub Kicinski +Cc: Jordan Rife +Reviewed-by: Simon Horman +Reviewed-by: Jordan Rife +Reviewed-by: Jakub Kicinski +Reviewed-by: Martin KaFai Lau +Link: https://lore.kernel.org/r/20251003073418.291171-1-daniel@iogearbox.net +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/core/filter.c b/net/core/filter.c +index b6dbcef649654..c2e888ea54abb 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -2273,6 +2273,7 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev, + if (IS_ERR(dst)) + goto out_drop; + ++ skb_dst_drop(skb); + skb_dst_set(skb, dst); + } else if (nh->nh_family != AF_INET6) { + goto out_drop; +@@ -2382,6 +2383,7 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev, + goto out_drop; + } + ++ skb_dst_drop(skb); + skb_dst_set(skb, &rt->dst); + } + +-- +2.51.0 + diff --git a/queue-6.6/bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch b/queue-6.6/bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch new file mode 100644 index 0000000000..73fc88bb8a --- /dev/null +++ b/queue-6.6/bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch @@ -0,0 +1,50 @@ +From e0d6d74dfa0dedef404b673d6b6351293e1c65ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 10:15:01 +0200 +Subject: bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() + +From: Eric Woudstra + +[ Upstream commit bbf0c98b3ad9edaea1f982de6c199cc11d3b7705 ] + +net/bridge/br_private.h:1627 suspicious rcu_dereference_protected() usage! +other info that might help us debug this: + +rcu_scheduler_active = 2, debug_locks = 1 +7 locks held by socat/410: + #0: ffff88800d7a9c90 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_stream_connect+0x43/0xa0 + #1: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x62/0x1830 + [..] + #6: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: nf_hook.constprop.0+0x8a/0x440 + +Call Trace: + lockdep_rcu_suspicious.cold+0x4f/0xb1 + br_vlan_fill_forward_path_pvid+0x32c/0x410 [bridge] + br_fill_forward_path+0x7a/0x4d0 [bridge] + +Use to correct helper, non _rcu variant requires RTNL mutex. + +Fixes: bcf2766b1377 ("net: bridge: resolve forwarding path for VLAN tag actions in bridge devices") +Signed-off-by: Eric Woudstra +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/bridge/br_vlan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c +index a1c22eab71ffe..cc54b8267bcc7 100644 +--- a/net/bridge/br_vlan.c ++++ b/net/bridge/br_vlan.c +@@ -1455,7 +1455,7 @@ void br_vlan_fill_forward_path_pvid(struct net_bridge *br, + if (!br_opt_get(br, BROPT_VLAN_ENABLED)) + return; + +- vg = br_vlan_group(br); ++ vg = br_vlan_group_rcu(br); + + if (idx >= 0 && + ctx->vlan[idx].proto == br->vlan_proto) { +-- +2.51.0 + diff --git a/queue-6.6/cifs-query-ea-lxmod-in-cifs_query_path_info-for-wsl-.patch b/queue-6.6/cifs-query-ea-lxmod-in-cifs_query_path_info-for-wsl-.patch new file mode 100644 index 0000000000..e4b9ccab90 --- /dev/null +++ b/queue-6.6/cifs-query-ea-lxmod-in-cifs_query_path_info-for-wsl-.patch @@ -0,0 +1,114 @@ +From 2c9569ff7796745fcfa9c14a510d1d46f6f89a3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Jun 2025 18:11:10 +0200 +Subject: cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse + points +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 057ac50638bcece64b3b436d3a61b70ed6c01a34 ] + +EA $LXMOD is required for WSL non-symlink reparse points. + +Fixes: ef86ab131d91 ("cifs: Fix querying of WSL CHR and BLK reparse points over SMB1") +Signed-off-by: Pali Rohár +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb1ops.c | 62 +++++++++++++++++++++++++++++++++++++++-- + 1 file changed, 60 insertions(+), 2 deletions(-) + +diff --git a/fs/smb/client/smb1ops.c b/fs/smb/client/smb1ops.c +index e62d9cc592e0c..c80b291a14a57 100644 +--- a/fs/smb/client/smb1ops.c ++++ b/fs/smb/client/smb1ops.c +@@ -671,14 +671,72 @@ static int cifs_query_path_info(const unsigned int xid, + } + + #ifdef CONFIG_CIFS_XATTR ++ /* ++ * For non-symlink WSL reparse points it is required to fetch ++ * EA $LXMOD which contains in its S_DT part the mandatory file type. ++ */ ++ if (!rc && data->reparse_point) { ++ struct smb2_file_full_ea_info *ea; ++ u32 next = 0; ++ ++ ea = (struct smb2_file_full_ea_info *)data->wsl.eas; ++ do { ++ ea = (void *)((u8 *)ea + next); ++ next = le32_to_cpu(ea->next_entry_offset); ++ } while (next); ++ if (le16_to_cpu(ea->ea_value_length)) { ++ ea->next_entry_offset = cpu_to_le32(ALIGN(sizeof(*ea) + ++ ea->ea_name_length + 1 + ++ le16_to_cpu(ea->ea_value_length), 4)); ++ ea = (void *)((u8 *)ea + le32_to_cpu(ea->next_entry_offset)); ++ } ++ ++ rc = CIFSSMBQAllEAs(xid, tcon, full_path, SMB2_WSL_XATTR_MODE, ++ &ea->ea_data[SMB2_WSL_XATTR_NAME_LEN + 1], ++ SMB2_WSL_XATTR_MODE_SIZE, cifs_sb); ++ if (rc == SMB2_WSL_XATTR_MODE_SIZE) { ++ ea->next_entry_offset = cpu_to_le32(0); ++ ea->flags = 0; ++ ea->ea_name_length = SMB2_WSL_XATTR_NAME_LEN; ++ ea->ea_value_length = cpu_to_le16(SMB2_WSL_XATTR_MODE_SIZE); ++ memcpy(&ea->ea_data[0], SMB2_WSL_XATTR_MODE, SMB2_WSL_XATTR_NAME_LEN + 1); ++ data->wsl.eas_len += ALIGN(sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 + ++ SMB2_WSL_XATTR_MODE_SIZE, 4); ++ rc = 0; ++ } else if (rc >= 0) { ++ /* It is an error if EA $LXMOD has wrong size. */ ++ rc = -EINVAL; ++ } else { ++ /* ++ * In all other cases ignore error if fetching ++ * of EA $LXMOD failed. It is needed only for ++ * non-symlink WSL reparse points and wsl_to_fattr() ++ * handle the case when EA is missing. ++ */ ++ rc = 0; ++ } ++ } ++ + /* + * For WSL CHR and BLK reparse points it is required to fetch + * EA $LXDEV which contains major and minor device numbers. + */ + if (!rc && data->reparse_point) { + struct smb2_file_full_ea_info *ea; ++ u32 next = 0; + + ea = (struct smb2_file_full_ea_info *)data->wsl.eas; ++ do { ++ ea = (void *)((u8 *)ea + next); ++ next = le32_to_cpu(ea->next_entry_offset); ++ } while (next); ++ if (le16_to_cpu(ea->ea_value_length)) { ++ ea->next_entry_offset = cpu_to_le32(ALIGN(sizeof(*ea) + ++ ea->ea_name_length + 1 + ++ le16_to_cpu(ea->ea_value_length), 4)); ++ ea = (void *)((u8 *)ea + le32_to_cpu(ea->next_entry_offset)); ++ } ++ + rc = CIFSSMBQAllEAs(xid, tcon, full_path, SMB2_WSL_XATTR_DEV, + &ea->ea_data[SMB2_WSL_XATTR_NAME_LEN + 1], + SMB2_WSL_XATTR_DEV_SIZE, cifs_sb); +@@ -688,8 +746,8 @@ static int cifs_query_path_info(const unsigned int xid, + ea->ea_name_length = SMB2_WSL_XATTR_NAME_LEN; + ea->ea_value_length = cpu_to_le16(SMB2_WSL_XATTR_DEV_SIZE); + memcpy(&ea->ea_data[0], SMB2_WSL_XATTR_DEV, SMB2_WSL_XATTR_NAME_LEN + 1); +- data->wsl.eas_len = sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 + +- SMB2_WSL_XATTR_DEV_SIZE; ++ data->wsl.eas_len += ALIGN(sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 + ++ SMB2_WSL_XATTR_MODE_SIZE, 4); + rc = 0; + } else if (rc >= 0) { + /* It is an error if EA $LXDEV has wrong size. */ +-- +2.51.0 + diff --git a/queue-6.6/clk-at91-peripheral-fix-return-value.patch b/queue-6.6/clk-at91-peripheral-fix-return-value.patch new file mode 100644 index 0000000000..5056706953 --- /dev/null +++ b/queue-6.6/clk-at91-peripheral-fix-return-value.patch @@ -0,0 +1,44 @@ +From 8d5b867c7006c43dcd60da89d899afe74c695d5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 11:17:53 -0400 +Subject: clk: at91: peripheral: fix return value + +From: Brian Masney + +[ Upstream commit 47b13635dabc14f1c2fdcaa5468b47ddadbdd1b5 ] + +determine_rate() is expected to return an error code, or 0 on success. +clk_sam9x5_peripheral_determine_rate() has a branch that returns the +parent rate on a certain case. This is the behavior of round_rate(), +so let's go ahead and fix this by setting req->rate. + +Fixes: b4c115c76184f ("clk: at91: clk-peripheral: add support for changeable parent rate") +Reviewed-by: Alexander Sverdlin +Acked-by: Nicolas Ferre +Signed-off-by: Brian Masney +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/clk-peripheral.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/at91/clk-peripheral.c b/drivers/clk/at91/clk-peripheral.c +index c173a44c800aa..629f050a855aa 100644 +--- a/drivers/clk/at91/clk-peripheral.c ++++ b/drivers/clk/at91/clk-peripheral.c +@@ -279,8 +279,11 @@ static int clk_sam9x5_peripheral_determine_rate(struct clk_hw *hw, + long best_diff = LONG_MIN; + u32 shift; + +- if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max) +- return parent_rate; ++ if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max) { ++ req->rate = parent_rate; ++ ++ return 0; ++ } + + /* Fist step: check the available dividers. */ + for (shift = 0; shift <= PERIPHERAL_MAX_SHIFT; shift++) { +-- +2.51.0 + diff --git a/queue-6.6/clk-mediatek-clk-mux-do-not-pass-flags-to-clk_mux_de.patch b/queue-6.6/clk-mediatek-clk-mux-do-not-pass-flags-to-clk_mux_de.patch new file mode 100644 index 0000000000..fe66caf86b --- /dev/null +++ b/queue-6.6/clk-mediatek-clk-mux-do-not-pass-flags-to-clk_mux_de.patch @@ -0,0 +1,42 @@ +From 8e3ea810c770da4d4bba39af474209535919297b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 23:09:31 +0800 +Subject: clk: mediatek: clk-mux: Do not pass flags to + clk_mux_determine_rate_flags() + +From: Chen-Yu Tsai + +[ Upstream commit 5e121370a7ad3414c7f3a77002e2b18abe5c6fe1 ] + +The `flags` in |struct mtk_mux| are core clk flags, not mux clk flags. +Passing one to the other is wrong. + +Since there aren't any actual users adding CLK_MUX_* flags, just drop it +for now. + +Fixes: b05ea3314390 ("clk: mediatek: clk-mux: Add .determine_rate() callback") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mux.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/clk/mediatek/clk-mux.c b/drivers/clk/mediatek/clk-mux.c +index c93bc7f926e5d..359f92df826b5 100644 +--- a/drivers/clk/mediatek/clk-mux.c ++++ b/drivers/clk/mediatek/clk-mux.c +@@ -132,9 +132,7 @@ static int mtk_clk_mux_set_parent_setclr_lock(struct clk_hw *hw, u8 index) + static int mtk_clk_mux_determine_rate(struct clk_hw *hw, + struct clk_rate_request *req) + { +- struct mtk_clk_mux *mux = to_mtk_clk_mux(hw); +- +- return clk_mux_determine_rate_flags(hw, req, mux->data->flags); ++ return clk_mux_determine_rate_flags(hw, req, 0); + } + + const struct clk_ops mtk_mux_clr_set_upd_ops = { +-- +2.51.0 + diff --git a/queue-6.6/clk-mediatek-mt8195-infra_ao-fix-parent-for-infra_ao.patch b/queue-6.6/clk-mediatek-mt8195-infra_ao-fix-parent-for-infra_ao.patch new file mode 100644 index 0000000000..b0b2171437 --- /dev/null +++ b/queue-6.6/clk-mediatek-mt8195-infra_ao-fix-parent-for-infra_ao.patch @@ -0,0 +1,39 @@ +From fed887ce8f5ec1e43018be7aae1837dd0b178fdb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 10:38:28 +0200 +Subject: clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m + +From: AngeloGioacchino Del Regno + +[ Upstream commit 6c4c26b624790098988c1034541087e3e5ed5bed ] + +The infrastructure gate for the HDMI specific crystal needs the +top_hdmi_xtal clock to be configured in order to ungate the 26m +clock to the HDMI IP, and it wouldn't work without. + +Reparent the infra_ao_hdmi_26m clock to top_hdmi_xtal to fix that. + +Fixes: e2edf59dec0b ("clk: mediatek: Add MT8195 infrastructure clock support") +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mt8195-infra_ao.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/mediatek/clk-mt8195-infra_ao.c b/drivers/clk/mediatek/clk-mt8195-infra_ao.c +index dfba6eb61ccfe..4ecdf9ae02443 100644 +--- a/drivers/clk/mediatek/clk-mt8195-infra_ao.c ++++ b/drivers/clk/mediatek/clk-mt8195-infra_ao.c +@@ -103,7 +103,7 @@ static const struct mtk_gate infra_ao_clks[] = { + GATE_INFRA_AO0(CLK_INFRA_AO_CQ_DMA_FPC, "infra_ao_cq_dma_fpc", "fpc", 28), + GATE_INFRA_AO0(CLK_INFRA_AO_UART5, "infra_ao_uart5", "top_uart", 29), + /* INFRA_AO1 */ +- GATE_INFRA_AO1(CLK_INFRA_AO_HDMI_26M, "infra_ao_hdmi_26m", "clk26m", 0), ++ GATE_INFRA_AO1(CLK_INFRA_AO_HDMI_26M, "infra_ao_hdmi_26m", "top_hdmi_xtal", 0), + GATE_INFRA_AO1(CLK_INFRA_AO_SPI0, "infra_ao_spi0", "top_spi", 1), + GATE_INFRA_AO1(CLK_INFRA_AO_MSDC0, "infra_ao_msdc0", "top_msdc50_0_hclk", 2), + GATE_INFRA_AO1(CLK_INFRA_AO_MSDC1, "infra_ao_msdc1", "top_axi", 4), +-- +2.51.0 + diff --git a/queue-6.6/clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch b/queue-6.6/clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch new file mode 100644 index 0000000000..d1edbe782c --- /dev/null +++ b/queue-6.6/clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch @@ -0,0 +1,50 @@ +From a4c00d35581dd6036ef246bd2bc2f3fda92d5417 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Jul 2025 13:11:55 -0700 +Subject: clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver + +From: Alok Tiwari + +[ Upstream commit 1624dead9a4d288a594fdf19735ebfe4bb567cb8 ] + +The conditional check for the PLL0 multiplier 'm' used a logical AND +instead of OR, making the range check ineffective. This patch replaces +&& with || to correctly reject invalid values of 'm' that are either +less than or equal to 0 or greater than LPC18XX_PLL0_MSEL_MAX. + +This ensures proper bounds checking during clk rate setting and rounding. + +Fixes: b04e0b8fd544 ("clk: add lpc18xx cgu clk driver") +Signed-off-by: Alok Tiwari +[sboyd@kernel.org: 'm' is unsigned so remove < condition] +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/nxp/clk-lpc18xx-cgu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c +index 821155f79b015..bbd7d64038fab 100644 +--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c ++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c +@@ -382,7 +382,7 @@ static int lpc18xx_pll0_determine_rate(struct clk_hw *hw, + } + + m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2); +- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { ++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) { + pr_warn("%s: unable to support rate %lu\n", __func__, req->rate); + return -EINVAL; + } +@@ -405,7 +405,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, + } + + m = DIV_ROUND_UP_ULL(parent_rate, rate * 2); +- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { ++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) { + pr_warn("%s: unable to support rate %lu\n", __func__, rate); + return -EINVAL; + } +-- +2.51.0 + diff --git a/queue-6.6/clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch b/queue-6.6/clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch new file mode 100644 index 0000000000..d2c79b030a --- /dev/null +++ b/queue-6.6/clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch @@ -0,0 +1,68 @@ +From bca610af3c1e998cd60ab219b703c70b11043dae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 11:18:29 -0400 +Subject: clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() + +From: Brian Masney + +[ Upstream commit b46a3d323a5b7942e65025254c13801d0f475f02 ] + +The round_rate() clk ops is deprecated, so migrate this driver from +round_rate() to determine_rate() using the Coccinelle semantic patch +on the cover letter of this series. + +Signed-off-by: Brian Masney +Stable-dep-of: 1624dead9a4d ("clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver") +Signed-off-by: Sasha Levin +--- + drivers/clk/nxp/clk-lpc18xx-cgu.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c +index 69ebf65081b81..821155f79b015 100644 +--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c ++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c +@@ -371,23 +371,25 @@ static unsigned long lpc18xx_pll0_recalc_rate(struct clk_hw *hw, + return 0; + } + +-static long lpc18xx_pll0_round_rate(struct clk_hw *hw, unsigned long rate, +- unsigned long *prate) ++static int lpc18xx_pll0_determine_rate(struct clk_hw *hw, ++ struct clk_rate_request *req) + { + unsigned long m; + +- if (*prate < rate) { ++ if (req->best_parent_rate < req->rate) { + pr_warn("%s: pll dividers not supported\n", __func__); + return -EINVAL; + } + +- m = DIV_ROUND_UP_ULL(*prate, rate * 2); ++ m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2); + if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { +- pr_warn("%s: unable to support rate %lu\n", __func__, rate); ++ pr_warn("%s: unable to support rate %lu\n", __func__, req->rate); + return -EINVAL; + } + +- return 2 * *prate * m; ++ req->rate = 2 * req->best_parent_rate * m; ++ ++ return 0; + } + + static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, +@@ -444,7 +446,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, + + static const struct clk_ops lpc18xx_pll0_ops = { + .recalc_rate = lpc18xx_pll0_recalc_rate, +- .round_rate = lpc18xx_pll0_round_rate, ++ .determine_rate = lpc18xx_pll0_determine_rate, + .set_rate = lpc18xx_pll0_set_rate, + }; + +-- +2.51.0 + diff --git a/queue-6.6/clk-tegra-do-not-overallocate-memory-for-bpmp-clocks.patch b/queue-6.6/clk-tegra-do-not-overallocate-memory-for-bpmp-clocks.patch new file mode 100644 index 0000000000..de3c4e16df --- /dev/null +++ b/queue-6.6/clk-tegra-do-not-overallocate-memory-for-bpmp-clocks.patch @@ -0,0 +1,43 @@ +From 5b25b374b98ea1b812a53e6a7069a40d1402343d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Apr 2025 15:54:28 +0300 +Subject: clk: tegra: do not overallocate memory for bpmp clocks + +From: Fedor Pchelkin + +[ Upstream commit 49ef6491106209c595476fc122c3922dfd03253f ] + +struct tegra_bpmp::clocks is a pointer to a dynamically allocated array +of pointers to 'struct tegra_bpmp_clk'. + +But the size of the allocated area is calculated like it is an array +containing actual 'struct tegra_bpmp_clk' objects - it's not true, there +are just pointers. + +Found by Linux Verification Center (linuxtesting.org) with Svace static +analysis tool. + +Fixes: 2db12b15c6f3 ("clk: tegra: Register clocks from root to leaf") +Signed-off-by: Fedor Pchelkin +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/tegra/clk-bpmp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/tegra/clk-bpmp.c b/drivers/clk/tegra/clk-bpmp.c +index 7bfba0afd7783..4ec408c3a26aa 100644 +--- a/drivers/clk/tegra/clk-bpmp.c ++++ b/drivers/clk/tegra/clk-bpmp.c +@@ -635,7 +635,7 @@ static int tegra_bpmp_register_clocks(struct tegra_bpmp *bpmp, + + bpmp->num_clocks = count; + +- bpmp->clocks = devm_kcalloc(bpmp->dev, count, sizeof(struct tegra_bpmp_clk), GFP_KERNEL); ++ bpmp->clocks = devm_kcalloc(bpmp->dev, count, sizeof(*bpmp->clocks), GFP_KERNEL); + if (!bpmp->clocks) + return -ENOMEM; + +-- +2.51.0 + diff --git a/queue-6.6/cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch b/queue-6.6/cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch new file mode 100644 index 0000000000..402ed7278f --- /dev/null +++ b/queue-6.6/cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch @@ -0,0 +1,47 @@ +From bbf40874408bee5bfe2ef502812020ae184e52a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 21:48:12 -0500 +Subject: cpufreq: tegra186: Set target frequency for all cpus in policy + +From: Aaron Kling + +[ Upstream commit 0b1bb980fd7cae126ee3d59f817068a13e321b07 ] + +The original commit set all cores in a cluster to a shared policy, but +did not update set_target to apply a frequency change to all cores for +the policy. This caused most cores to remain stuck at their boot +frequency. + +Fixes: be4ae8c19492 ("cpufreq: tegra186: Share policy per cluster") +Signed-off-by: Aaron Kling +Reviewed-by: Mikko Perttunen +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/tegra186-cpufreq.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c +index 7b8fcfa55038b..39186008afbfd 100644 +--- a/drivers/cpufreq/tegra186-cpufreq.c ++++ b/drivers/cpufreq/tegra186-cpufreq.c +@@ -86,10 +86,14 @@ static int tegra186_cpufreq_set_target(struct cpufreq_policy *policy, + { + struct tegra186_cpufreq_data *data = cpufreq_get_driver_data(); + struct cpufreq_frequency_table *tbl = policy->freq_table + index; +- unsigned int edvd_offset = data->cpus[policy->cpu].edvd_offset; ++ unsigned int edvd_offset; + u32 edvd_val = tbl->driver_data; ++ u32 cpu; + +- writel(edvd_val, data->regs + edvd_offset); ++ for_each_cpu(cpu, policy->cpus) { ++ edvd_offset = data->cpus[cpu].edvd_offset; ++ writel(edvd_val, data->regs + edvd_offset); ++ } + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.6/crypto-essiv-check-ssize-for-decryption-and-in-place.patch b/queue-6.6/crypto-essiv-check-ssize-for-decryption-and-in-place.patch new file mode 100644 index 0000000000..7a82d2da54 --- /dev/null +++ b/queue-6.6/crypto-essiv-check-ssize-for-decryption-and-in-place.patch @@ -0,0 +1,63 @@ +From 180a07eab4626678ae7c073a54b2f7c84552b59e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 15:54:20 +0800 +Subject: crypto: essiv - Check ssize for decryption and in-place encryption + +From: Herbert Xu + +[ Upstream commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f ] + +Move the ssize check to the start in essiv_aead_crypt so that +it's also checked for decryption and in-place encryption. + +Reported-by: Muhammad Alifa Ramdhan +Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation") +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/essiv.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/crypto/essiv.c b/crypto/essiv.c +index f7d4ef4837e54..4dbec116ddc3e 100644 +--- a/crypto/essiv.c ++++ b/crypto/essiv.c +@@ -186,9 +186,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) + const struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm); + struct essiv_aead_request_ctx *rctx = aead_request_ctx(req); + struct aead_request *subreq = &rctx->aead_req; ++ int ivsize = crypto_aead_ivsize(tfm); ++ int ssize = req->assoclen - ivsize; + struct scatterlist *src = req->src; + int err; + ++ if (ssize < 0) ++ return -EINVAL; ++ + crypto_cipher_encrypt_one(tctx->essiv_cipher, req->iv, req->iv); + + /* +@@ -198,19 +203,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) + */ + rctx->assoc = NULL; + if (req->src == req->dst || !enc) { +- scatterwalk_map_and_copy(req->iv, req->dst, +- req->assoclen - crypto_aead_ivsize(tfm), +- crypto_aead_ivsize(tfm), 1); ++ scatterwalk_map_and_copy(req->iv, req->dst, ssize, ivsize, 1); + } else { + u8 *iv = (u8 *)aead_request_ctx(req) + tctx->ivoffset; +- int ivsize = crypto_aead_ivsize(tfm); +- int ssize = req->assoclen - ivsize; + struct scatterlist *sg; + int nents; + +- if (ssize < 0) +- return -EINVAL; +- + nents = sg_nents_for_len(req->src, ssize); + if (nents < 0) + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.6/drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch b/queue-6.6/drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch new file mode 100644 index 0000000000..634a8e45e1 --- /dev/null +++ b/queue-6.6/drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch @@ -0,0 +1,39 @@ +From 58317fa2f28d6343afb6d515fcdb669341e2bf17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:22 +0200 +Subject: drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit d60f9c45d1bff7e20ecd57492ef7a5e33c94a37c ] + +Without these, it's impossible to program these registers. + +Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +index cbce194ec7b82..ff746fba850bc 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +@@ -155,6 +155,8 @@ + SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \ + SRI(VIEWPORT_START, SCL, id), \ + SRI(VIEWPORT_SIZE, SCL, id), \ ++ SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \ ++ SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \ + SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \ + SRI(SCL_VERT_FILTER_SCALE_RATIO, SCL, id), \ + SRI(SCL_VERT_FILTER_INIT, SCL, id), \ +-- +2.51.0 + diff --git a/queue-6.6/drm-amd-display-properly-clear-scl_-_filter_control-.patch b/queue-6.6/drm-amd-display-properly-clear-scl_-_filter_control-.patch new file mode 100644 index 0000000000..da6b1aabdd --- /dev/null +++ b/queue-6.6/drm-amd-display-properly-clear-scl_-_filter_control-.patch @@ -0,0 +1,51 @@ +From 5bd59e78d912645f36b2aec61a6e0eee47efaeca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:23 +0200 +Subject: drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit c0aa7cf49dd6cb302fe28e7183992b772cb7420c ] + +Previously, the code would set a bit field which didn't exist +on DCE6 so it would be effectively a no-op. + +Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +index 670d5ab9d9984..b761dda491d54 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +@@ -527,8 +527,7 @@ static void dce60_transform_set_scaler( + if (coeffs_v != xfm_dce->filter_v || coeffs_h != xfm_dce->filter_h) { + /* 4. Program vertical filters */ + if (xfm_dce->filter_v == NULL) +- REG_SET(SCL_VERT_FILTER_CONTROL, 0, +- SCL_V_2TAP_HARDCODE_COEF_EN, 0); ++ REG_WRITE(SCL_VERT_FILTER_CONTROL, 0); + program_multi_taps_filter( + xfm_dce, + data->taps.v_taps, +@@ -542,8 +541,7 @@ static void dce60_transform_set_scaler( + + /* 5. Program horizontal filters */ + if (xfm_dce->filter_h == NULL) +- REG_SET(SCL_HORZ_FILTER_CONTROL, 0, +- SCL_H_2TAP_HARDCODE_COEF_EN, 0); ++ REG_WRITE(SCL_HORZ_FILTER_CONTROL, 0); + program_multi_taps_filter( + xfm_dce, + data->taps.h_taps, +-- +2.51.0 + diff --git a/queue-6.6/drm-amd-display-properly-disable-scaling-on-dce6.patch b/queue-6.6/drm-amd-display-properly-disable-scaling-on-dce6.patch new file mode 100644 index 0000000000..747c93a369 --- /dev/null +++ b/queue-6.6/drm-amd-display-properly-disable-scaling-on-dce6.patch @@ -0,0 +1,101 @@ +From 2b44f195f7abdbfa9388335d6e1f5a33b5eb1104 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:24 +0200 +Subject: drm/amd/display: Properly disable scaling on DCE6 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit a7dc87f3448bea5ebe054f14e861074b9c289c65 ] + +SCL_SCALER_ENABLE can be used to enable/disable the scaler +on DCE6. Program it to 0 when scaling isn't used, 1 when used. +Additionally, clear some other registers when scaling is +disabled and program the SCL_UPDATE register as recommended. + +This fixes visible glitches for users whose BIOS sets up a +mode with scaling at boot, which DC was unable to clean up. + +Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/dce/dce_transform.c | 15 +++++++++++---- + .../gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++ + 2 files changed, 13 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +index b761dda491d54..f97c182677082 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +@@ -154,10 +154,13 @@ static bool dce60_setup_scaling_configuration( + REG_SET(SCL_BYPASS_CONTROL, 0, SCL_BYPASS_MODE, 0); + + if (data->taps.h_taps + data->taps.v_taps <= 2) { +- /* Set bypass */ +- +- /* DCE6 has no SCL_MODE register, skip scale mode programming */ ++ /* Disable scaler functionality */ ++ REG_WRITE(SCL_SCALER_ENABLE, 0); + ++ /* Clear registers that can cause glitches even when the scaler is off */ ++ REG_WRITE(SCL_TAP_CONTROL, 0); ++ REG_WRITE(SCL_AUTOMATIC_MODE_CONTROL, 0); ++ REG_WRITE(SCL_F_SHARP_CONTROL, 0); + return false; + } + +@@ -165,7 +168,7 @@ static bool dce60_setup_scaling_configuration( + SCL_H_NUM_OF_TAPS, data->taps.h_taps - 1, + SCL_V_NUM_OF_TAPS, data->taps.v_taps - 1); + +- /* DCE6 has no SCL_MODE register, skip scale mode programming */ ++ REG_WRITE(SCL_SCALER_ENABLE, 1); + + /* DCE6 has no SCL_BOUNDARY_MODE bit, skip replace out of bound pixels */ + +@@ -502,6 +505,8 @@ static void dce60_transform_set_scaler( + REG_SET(DC_LB_MEM_SIZE, 0, + DC_LB_MEM_SIZE, xfm_dce->lb_memory_size); + ++ REG_WRITE(SCL_UPDATE, 0x00010000); ++ + /* Clear SCL_F_SHARP_CONTROL value to 0 */ + REG_WRITE(SCL_F_SHARP_CONTROL, 0); + +@@ -564,6 +569,8 @@ static void dce60_transform_set_scaler( + /* DCE6 has no SCL_COEF_UPDATE_COMPLETE bit to flip to new coefficient memory */ + + /* DCE6 DATA_FORMAT register does not support ALPHA_EN */ ++ ++ REG_WRITE(SCL_UPDATE, 0); + } + #endif + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +index ff746fba850bc..eb716e8337e23 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +@@ -155,6 +155,7 @@ + SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \ + SRI(VIEWPORT_START, SCL, id), \ + SRI(VIEWPORT_SIZE, SCL, id), \ ++ SRI(SCL_SCALER_ENABLE, SCL, id), \ + SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \ + SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \ + SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \ +@@ -592,6 +593,7 @@ struct dce_transform_registers { + uint32_t SCL_VERT_FILTER_SCALE_RATIO; + uint32_t SCL_HORZ_FILTER_INIT; + #if defined(CONFIG_DRM_AMD_DC_SI) ++ uint32_t SCL_SCALER_ENABLE; + uint32_t SCL_HORZ_FILTER_INIT_RGB_LUMA; + uint32_t SCL_HORZ_FILTER_INIT_CHROMA; + #endif +-- +2.51.0 + diff --git a/queue-6.6/drm-amdgpu-add-additional-dce6-scl-registers.patch b/queue-6.6/drm-amdgpu-add-additional-dce6-scl-registers.patch new file mode 100644 index 0000000000..bdc785ad3f --- /dev/null +++ b/queue-6.6/drm-amdgpu-add-additional-dce6-scl-registers.patch @@ -0,0 +1,93 @@ +From 414d215de397e335ac8c7edd98b6126a74ad3897 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 20:45:21 +0200 +Subject: drm/amdgpu: Add additional DCE6 SCL registers + +From: Alex Deucher + +[ Upstream commit 507296328b36ffd00ec1f4fde5b8acafb7222ec7 ] + +Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)") +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h | 7 +++++++ + drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h | 2 ++ + 2 files changed, 9 insertions(+) + +diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h +index 9de01ae574c03..067eddd9c62d8 100644 +--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h ++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h +@@ -4115,6 +4115,7 @@ + #define mmSCL0_SCL_COEF_RAM_CONFLICT_STATUS 0x1B55 + #define mmSCL0_SCL_COEF_RAM_SELECT 0x1B40 + #define mmSCL0_SCL_COEF_RAM_TAP_DATA 0x1B41 ++#define mmSCL0_SCL_SCALER_ENABLE 0x1B42 + #define mmSCL0_SCL_CONTROL 0x1B44 + #define mmSCL0_SCL_DEBUG 0x1B6A + #define mmSCL0_SCL_DEBUG2 0x1B69 +@@ -4144,6 +4145,7 @@ + #define mmSCL1_SCL_COEF_RAM_CONFLICT_STATUS 0x1E55 + #define mmSCL1_SCL_COEF_RAM_SELECT 0x1E40 + #define mmSCL1_SCL_COEF_RAM_TAP_DATA 0x1E41 ++#define mmSCL1_SCL_SCALER_ENABLE 0x1E42 + #define mmSCL1_SCL_CONTROL 0x1E44 + #define mmSCL1_SCL_DEBUG 0x1E6A + #define mmSCL1_SCL_DEBUG2 0x1E69 +@@ -4173,6 +4175,7 @@ + #define mmSCL2_SCL_COEF_RAM_CONFLICT_STATUS 0x4155 + #define mmSCL2_SCL_COEF_RAM_SELECT 0x4140 + #define mmSCL2_SCL_COEF_RAM_TAP_DATA 0x4141 ++#define mmSCL2_SCL_SCALER_ENABLE 0x4142 + #define mmSCL2_SCL_CONTROL 0x4144 + #define mmSCL2_SCL_DEBUG 0x416A + #define mmSCL2_SCL_DEBUG2 0x4169 +@@ -4202,6 +4205,7 @@ + #define mmSCL3_SCL_COEF_RAM_CONFLICT_STATUS 0x4455 + #define mmSCL3_SCL_COEF_RAM_SELECT 0x4440 + #define mmSCL3_SCL_COEF_RAM_TAP_DATA 0x4441 ++#define mmSCL3_SCL_SCALER_ENABLE 0x4442 + #define mmSCL3_SCL_CONTROL 0x4444 + #define mmSCL3_SCL_DEBUG 0x446A + #define mmSCL3_SCL_DEBUG2 0x4469 +@@ -4231,6 +4235,7 @@ + #define mmSCL4_SCL_COEF_RAM_CONFLICT_STATUS 0x4755 + #define mmSCL4_SCL_COEF_RAM_SELECT 0x4740 + #define mmSCL4_SCL_COEF_RAM_TAP_DATA 0x4741 ++#define mmSCL4_SCL_SCALER_ENABLE 0x4742 + #define mmSCL4_SCL_CONTROL 0x4744 + #define mmSCL4_SCL_DEBUG 0x476A + #define mmSCL4_SCL_DEBUG2 0x4769 +@@ -4260,6 +4265,7 @@ + #define mmSCL5_SCL_COEF_RAM_CONFLICT_STATUS 0x4A55 + #define mmSCL5_SCL_COEF_RAM_SELECT 0x4A40 + #define mmSCL5_SCL_COEF_RAM_TAP_DATA 0x4A41 ++#define mmSCL5_SCL_SCALER_ENABLE 0x4A42 + #define mmSCL5_SCL_CONTROL 0x4A44 + #define mmSCL5_SCL_DEBUG 0x4A6A + #define mmSCL5_SCL_DEBUG2 0x4A69 +@@ -4287,6 +4293,7 @@ + #define mmSCL_COEF_RAM_CONFLICT_STATUS 0x1B55 + #define mmSCL_COEF_RAM_SELECT 0x1B40 + #define mmSCL_COEF_RAM_TAP_DATA 0x1B41 ++#define mmSCL_SCALER_ENABLE 0x1B42 + #define mmSCL_CONTROL 0x1B44 + #define mmSCL_DEBUG 0x1B6A + #define mmSCL_DEBUG2 0x1B69 +diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h +index bd8085ec54ed5..da5596fbfdcb3 100644 +--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h ++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h +@@ -8648,6 +8648,8 @@ + #define REGAMMA_LUT_INDEX__REGAMMA_LUT_INDEX__SHIFT 0x00000000 + #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK_MASK 0x00000007L + #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK__SHIFT 0x00000000 ++#define SCL_SCALER_ENABLE__SCL_SCALE_EN_MASK 0x00000001L ++#define SCL_SCALER_ENABLE__SCL_SCALE_EN__SHIFT 0x00000000 + #define SCL_ALU_CONTROL__SCL_ALU_DISABLE_MASK 0x00000001L + #define SCL_ALU_CONTROL__SCL_ALU_DISABLE__SHIFT 0x00000000 + #define SCL_BYPASS_CONTROL__SCL_BYPASS_MODE_MASK 0x00000003L +-- +2.51.0 + diff --git a/queue-6.6/drm-vmwgfx-fix-a-null-ptr-access-in-the-cursor-snoop.patch b/queue-6.6/drm-vmwgfx-fix-a-null-ptr-access-in-the-cursor-snoop.patch new file mode 100644 index 0000000000..a377841312 --- /dev/null +++ b/queue-6.6/drm-vmwgfx-fix-a-null-ptr-access-in-the-cursor-snoop.patch @@ -0,0 +1,79 @@ +From 60a5a43c29831574f91e8189752101b6bb73ba92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 11:36:55 -0400 +Subject: drm/vmwgfx: Fix a null-ptr access in the cursor snooper + +From: Zack Rusin + +[ Upstream commit 5ac2c0279053a2c5265d46903432fb26ae2d0da2 ] + +Check that the resource which is converted to a surface exists before +trying to use the cursor snooper on it. + +vmw_cmd_res_check allows explicit invalid (SVGA3D_INVALID_ID) identifiers +because some svga commands accept SVGA3D_INVALID_ID to mean "no surface", +unfortunately functions that accept the actual surfaces as objects might +(and in case of the cursor snooper, do not) be able to handle null +objects. Make sure that we validate not only the identifier (via the +vmw_cmd_res_check) but also check that the actual resource exists before +trying to do something with it. + +Fixes unchecked null-ptr reference in the snooping code. + +Signed-off-by: Zack Rusin +Fixes: c0951b797e7d ("drm/vmwgfx: Refactor resource management") +Reported-by: Kuzey Arda Bulut +Cc: Broadcom internal kernel review list +Cc: dri-devel@lists.freedesktop.org +Reviewed-by: Ian Forbes +Link: https://lore.kernel.org/r/20250917153655.1968583-1-zack.rusin@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +index b129ce873af3f..b235e7cc41f3f 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +@@ -1514,6 +1514,7 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, + SVGA3dCmdHeader *header) + { + struct vmw_bo *vmw_bo = NULL; ++ struct vmw_resource *res; + struct vmw_surface *srf = NULL; + VMW_DECLARE_CMD_VAR(*cmd, SVGA3dCmdSurfaceDMA); + int ret; +@@ -1549,18 +1550,24 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, + + dirty = (cmd->body.transfer == SVGA3D_WRITE_HOST_VRAM) ? + VMW_RES_DIRTY_SET : 0; +- ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, +- dirty, user_surface_converter, +- &cmd->body.host.sid, NULL); ++ ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, dirty, ++ user_surface_converter, &cmd->body.host.sid, ++ NULL); + if (unlikely(ret != 0)) { + if (unlikely(ret != -ERESTARTSYS)) + VMW_DEBUG_USER("could not find surface for DMA.\n"); + return ret; + } + +- srf = vmw_res_to_srf(sw_context->res_cache[vmw_res_surface].res); ++ res = sw_context->res_cache[vmw_res_surface].res; ++ if (!res) { ++ VMW_DEBUG_USER("Invalid DMA surface.\n"); ++ return -EINVAL; ++ } + +- vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo, header); ++ srf = vmw_res_to_srf(res); ++ vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo, ++ header); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.6/drm-vmwgfx-fix-copy-paste-typo-in-validation.patch b/queue-6.6/drm-vmwgfx-fix-copy-paste-typo-in-validation.patch new file mode 100644 index 0000000000..355489a5ae --- /dev/null +++ b/queue-6.6/drm-vmwgfx-fix-copy-paste-typo-in-validation.patch @@ -0,0 +1,37 @@ +From 250465e016445860a80ef2fb56df914881791712 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 14:54:26 -0500 +Subject: drm/vmwgfx: Fix copy-paste typo in validation + +From: Ian Forbes + +[ Upstream commit 228c5d44dffe8c293cd2d2f0e7ea45e64565b1c4 ] + +'entry' should be 'val' which is the loop iterator. + +Fixes: 9e931f2e0970 ("drm/vmwgfx: Refactor resource validation hashtable to use linux/hashtable implementation.") +Signed-off-by: Ian Forbes +Reviewed-by: Zack Rusin +Signed-off-by: Zack Rusin +Link: https://lore.kernel.org/r/20250926195427.1405237-2-ian.forbes@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +index a4a11e725d183..946f166d6fc76 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +@@ -656,7 +656,7 @@ void vmw_validation_drop_ht(struct vmw_validation_context *ctx) + hash_del_rcu(&val->hash.head); + + list_for_each_entry(val, &ctx->resource_ctx_list, head) +- hash_del_rcu(&entry->hash.head); ++ hash_del_rcu(&val->hash.head); + + ctx->sw_context = NULL; + } +-- +2.51.0 + diff --git a/queue-6.6/drm-vmwgfx-fix-use-after-free-in-validation.patch b/queue-6.6/drm-vmwgfx-fix-use-after-free-in-validation.patch new file mode 100644 index 0000000000..df3027926c --- /dev/null +++ b/queue-6.6/drm-vmwgfx-fix-use-after-free-in-validation.patch @@ -0,0 +1,44 @@ +From 243fdc3f62dcc2ab25bf0a78060a09723cf2f18c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 14:54:25 -0500 +Subject: drm/vmwgfx: Fix Use-after-free in validation + +From: Ian Forbes + +[ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ] + +Nodes stored in the validation duplicates hashtable come from an arena +allocator that is cleared at the end of vmw_execbuf_process. All nodes +are expected to be cleared in vmw_validation_drop_ht but this node escaped +because its resource was destroyed prematurely. + +Fixes: 64ad2abfe9a6 ("drm/vmwgfx: Adapt validation code for reference-free lookups") +Reported-by: Kuzey Arda Bulut +Signed-off-by: Ian Forbes +Reviewed-by: Zack Rusin +Signed-off-by: Zack Rusin +Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +index aaacbdcbd742f..a4a11e725d183 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +@@ -326,8 +326,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx, + hash_add_rcu(ctx->sw_context->res_ht, &node->hash.head, node->hash.key); + } + node->res = vmw_resource_reference_unless_doomed(res); +- if (!node->res) ++ if (!node->res) { ++ hash_del_rcu(&node->hash.head); + return -ESRCH; ++ } + + node->first_usage = 1; + if (!res->dev_priv->has_mob) { +-- +2.51.0 + diff --git a/queue-6.6/gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch b/queue-6.6/gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch new file mode 100644 index 0000000000..53dcdd667b --- /dev/null +++ b/queue-6.6/gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch @@ -0,0 +1,37 @@ +From 2718ead6dd7f159be888459541805543f025f507 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 16:51:29 +0200 +Subject: gpio: wcd934x: mark the GPIO controller as sleeping + +From: Bartosz Golaszewski + +[ Upstream commit b5f8aa8d4bde0cf3e4595af5a536da337e5f1c78 ] + +The slimbus regmap passed to the GPIO driver down from MFD does not use +fast_io. This means a mutex is used for locking and thus this GPIO chip +must not be used in atomic context. Change the can_sleep switch in +struct gpio_chip to true. + +Fixes: 59c324683400 ("gpio: wcd934x: Add support to wcd934x gpio controller") +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-wcd934x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-wcd934x.c b/drivers/gpio/gpio-wcd934x.c +index cfa7b0a50c8e3..03b16b8f639ad 100644 +--- a/drivers/gpio/gpio-wcd934x.c ++++ b/drivers/gpio/gpio-wcd934x.c +@@ -102,7 +102,7 @@ static int wcd_gpio_probe(struct platform_device *pdev) + chip->base = -1; + chip->ngpio = WCD934X_NPINS; + chip->label = dev_name(dev); +- chip->can_sleep = false; ++ chip->can_sleep = true; + + return devm_gpiochip_add_data(dev, chip, data); + } +-- +2.51.0 + diff --git a/queue-6.6/libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch b/queue-6.6/libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch new file mode 100644 index 0000000000..54a4dd890b --- /dev/null +++ b/queue-6.6/libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch @@ -0,0 +1,59 @@ +From 3b2b954470c72c4cc407ae9f264ec69475ba5d8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:19 -0700 +Subject: libperf event: Ensure tracing data is multiple of 8 sized + +From: Ian Rogers + +[ Upstream commit b39c915a4f365cce6bdc0e538ed95d31823aea8f ] + +Perf's synthetic-events.c will ensure 8-byte alignment of tracing +data, writing it after a perf_record_header_tracing_data event. + +Add padding to struct perf_record_header_tracing_data to make it 16-byte +rather than 12-byte sized. + +Fixes: 055c67ed39887c55 ("perf tools: Move event synthesizing routines to separate .c file") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Acked-by: Namhyung Kim +Tested-by: Arnaldo Carvalho de Melo +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Blake Jones +Cc: Chun-Tse Shao +Cc: Collin Funk +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jan Polensky +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Li Huafei +Cc: Mark Rutland +Cc: Nam Cao +Cc: Peter Zijlstra +Cc: Steinar H. Gunderson +Cc: Thomas Gleixner +Link: https://lore.kernel.org/r/20250821163820.1132977-6-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/perf/include/perf/event.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/lib/perf/include/perf/event.h b/tools/lib/perf/include/perf/event.h +index ae64090184d32..b50960cce23f2 100644 +--- a/tools/lib/perf/include/perf/event.h ++++ b/tools/lib/perf/include/perf/event.h +@@ -285,6 +285,7 @@ struct perf_record_header_event_type { + struct perf_record_header_tracing_data { + struct perf_event_header header; + __u32 size; ++ __u32 pad; + }; + + #define PERF_RECORD_MISC_BUILD_ID_SIZE (1 << 15) +-- +2.51.0 + diff --git a/queue-6.6/loongarch-init-acpi_gbl_use_global_lock-to-false.patch b/queue-6.6/loongarch-init-acpi_gbl_use_global_lock-to-false.patch new file mode 100644 index 0000000000..fc1dcb4427 --- /dev/null +++ b/queue-6.6/loongarch-init-acpi_gbl_use_global_lock-to-false.patch @@ -0,0 +1,37 @@ +From 50159db5e7de2e07a85c89e44f1365e8a10047e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 22:38:57 +0800 +Subject: LoongArch: Init acpi_gbl_use_global_lock to false + +From: Huacai Chen + +[ Upstream commit 98662be7ef20d2b88b598f72e7ce9b6ac26a40f9 ] + +Init acpi_gbl_use_global_lock to false, in order to void error messages +during boot phase: + + ACPI Error: Could not enable GlobalLock event (20240827/evxfevnt-182) + ACPI Error: No response from Global Lock hardware, disabling lock (20240827/evglock-59) + +Fixes: 628c3bb40e9a8cefc0a6 ("LoongArch: Add boot and setup routines") +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/kernel/setup.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c +index a494b13c9e90c..31be0d00976e2 100644 +--- a/arch/loongarch/kernel/setup.c ++++ b/arch/loongarch/kernel/setup.c +@@ -365,6 +365,7 @@ void __init platform_init(void) + + #ifdef CONFIG_ACPI + acpi_table_upgrade(); ++ acpi_gbl_use_global_lock = false; + acpi_gbl_use_default_register_widths = false; + acpi_boot_table_init(); + #endif +-- +2.51.0 + diff --git a/queue-6.6/loongarch-remove-config_acpi_table_upgrade-in-platfo.patch b/queue-6.6/loongarch-remove-config_acpi_table_upgrade-in-platfo.patch new file mode 100644 index 0000000000..38f34082f4 --- /dev/null +++ b/queue-6.6/loongarch-remove-config_acpi_table_upgrade-in-platfo.patch @@ -0,0 +1,65 @@ +From f1865fad188d3c8a08287fbdb8abe2978916b563 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 15:45:53 +0800 +Subject: LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() + +From: Tiezhu Yang + +[ Upstream commit 6c3ca6654a74dd396bc477839ba8d9792eced441 ] + +Both acpi_table_upgrade() and acpi_boot_table_init() are defined as +empty functions under !CONFIG_ACPI_TABLE_UPGRADE and !CONFIG_ACPI in +include/linux/acpi.h, there are no implicit declaration errors with +various configs. + + #ifdef CONFIG_ACPI_TABLE_UPGRADE + void acpi_table_upgrade(void); + #else + static inline void acpi_table_upgrade(void) { } + #endif + + #ifdef CONFIG_ACPI + ... + void acpi_boot_table_init (void); + ... + #else /* !CONFIG_ACPI */ + ... + static inline void acpi_boot_table_init(void) + { + } + ... + #endif /* !CONFIG_ACPI */ + +As Huacai suggested, CONFIG_ACPI_TABLE_UPGRADE is ugly and not necessary +here, just remove it. At the same time, just keep CONFIG_ACPI to prevent +potential build errors in future, and give a signal to indicate the code +is ACPI-specific. For the same reason, we also put acpi_table_upgrade() +under CONFIG_ACPI. + +Signed-off-by: Tiezhu Yang +Signed-off-by: Huacai Chen +Stable-dep-of: 98662be7ef20 ("LoongArch: Init acpi_gbl_use_global_lock to false") +Signed-off-by: Sasha Levin +--- + arch/loongarch/kernel/setup.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c +index 655dc2b1616f2..a494b13c9e90c 100644 +--- a/arch/loongarch/kernel/setup.c ++++ b/arch/loongarch/kernel/setup.c +@@ -363,10 +363,8 @@ void __init platform_init(void) + arch_reserve_vmcore(); + arch_parse_crashkernel(); + +-#ifdef CONFIG_ACPI_TABLE_UPGRADE +- acpi_table_upgrade(); +-#endif + #ifdef CONFIG_ACPI ++ acpi_table_upgrade(); + acpi_gbl_use_default_register_widths = false; + acpi_boot_table_init(); + #endif +-- +2.51.0 + diff --git a/queue-6.6/mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch b/queue-6.6/mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch new file mode 100644 index 0000000000..e0d8a07570 --- /dev/null +++ b/queue-6.6/mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch @@ -0,0 +1,48 @@ +From 2303ebcd4a4fe88b1534c9dd8e60e5a4ff0c40c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 13:07:21 +0530 +Subject: mailbox: zynqmp-ipi: Remove dev.parent check in + zynqmp_ipi_free_mboxes + +From: Harini T + +[ Upstream commit 019e3f4550fc7d319a7fd03eff487255f8e8aecd ] + +The ipi_mbox->dev.parent check is unreliable proxy for registration +status as it fails to protect against probe failures that occur after +the parent is assigned but before device_register() completes. + +device_is_registered() is the canonical and robust method to verify the +registration status. + +Remove ipi_mbox->dev.parent check in zynqmp_ipi_free_mboxes(). + +Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") +Signed-off-by: Harini T +Reviewed-by: Peng Fan +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/zynqmp-ipi-mailbox.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c +index 06529dc0daf3f..90f248ef2a1fc 100644 +--- a/drivers/mailbox/zynqmp-ipi-mailbox.c ++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c +@@ -616,10 +616,8 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) + i = pdata->num_mboxes; + for (; i >= 0; i--) { + ipi_mbox = &pdata->ipi_mboxes[i]; +- if (ipi_mbox->dev.parent) { +- if (device_is_registered(&ipi_mbox->dev)) +- device_unregister(&ipi_mbox->dev); +- } ++ if (device_is_registered(&ipi_mbox->dev)) ++ device_unregister(&ipi_mbox->dev); + } + } + +-- +2.51.0 + diff --git a/queue-6.6/mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch b/queue-6.6/mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch new file mode 100644 index 0000000000..f12ae97a61 --- /dev/null +++ b/queue-6.6/mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch @@ -0,0 +1,43 @@ +From 20f450a39a77e06135610480c35a7258c0cb8c35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 13:07:20 +0530 +Subject: mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() + call + +From: Harini T + +[ Upstream commit 341867f730d3d3bb54491ee64e8b1a0c446656e7 ] + +The controller is registered using the device-managed function +'devm_mbox_controller_register()'. As documented in mailbox.c, this +ensures the devres framework automatically calls +mbox_controller_unregister() when device_unregister() is invoked, making +the explicit call unnecessary. + +Remove redundant mbox_controller_unregister() call as +device_unregister() handles controller cleanup. + +Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") +Signed-off-by: Harini T +Reviewed-by: Peng Fan +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/zynqmp-ipi-mailbox.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c +index e4fcac97dbfaa..06529dc0daf3f 100644 +--- a/drivers/mailbox/zynqmp-ipi-mailbox.c ++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c +@@ -617,7 +617,6 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) + for (; i >= 0; i--) { + ipi_mbox = &pdata->ipi_mboxes[i]; + if (ipi_mbox->dev.parent) { +- mbox_controller_unregister(&ipi_mbox->mbox); + if (device_is_registered(&ipi_mbox->dev)) + device_unregister(&ipi_mbox->dev); + } +-- +2.51.0 + diff --git a/queue-6.6/net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch b/queue-6.6/net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch new file mode 100644 index 0000000000..37571d8f66 --- /dev/null +++ b/queue-6.6/net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch @@ -0,0 +1,41 @@ +From aed6c9dfa379dccab7909869b6c0c94f90a1db02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 20:46:17 +0300 +Subject: net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe + +From: Erick Karanja + +[ Upstream commit 521405cb54cd2812bbb6dedd5afc14bca1e7e98a ] + +Add missing of_node_put call to release device node tbi obtained +via for_each_child_of_node. + +Fixes: afae5ad78b342 ("net/fsl_pq_mdio: streamline probing of MDIO nodes") +Signed-off-by: Erick Karanja +Link: https://patch.msgid.link/20251002174617.960521-1-karanja99erick@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c +index eee675a25b2c3..ef9adecb639ae 100644 +--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c ++++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c +@@ -483,10 +483,12 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev) + "missing 'reg' property in node %pOF\n", + tbi); + err = -EBUSY; ++ of_node_put(tbi); + goto error; + } + set_tbipa(*prop, pdev, + data->get_tbipa, priv->map, &res); ++ of_node_put(tbi); + } + } + +-- +2.51.0 + diff --git a/queue-6.6/net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch b/queue-6.6/net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch new file mode 100644 index 0000000000..d6e4a39a48 --- /dev/null +++ b/queue-6.6/net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch @@ -0,0 +1,41 @@ +From 8e93e1382a320ecff7ad5d6d93de79670dee38bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 15:25:01 +0300 +Subject: net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() + +From: Dan Carpenter + +[ Upstream commit 4f0d91ba72811fd5dd577bcdccd7fed649aae62c ] + +Print "entry->mac" before freeing "entry". The "entry" pointer is +freed with kfree_rcu() so it's unlikely that we would trigger this +in real life, but it's safer to re-order it. + +Fixes: cc5387f7346a ("net/mlx4_en: Add unicast MAC filtering") +Signed-off-by: Dan Carpenter +Reviewed-by: Tariq Toukan +Link: https://patch.msgid.link/aNvMHX4g8RksFFvV@stanley.mountain +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +index 33bbcced81059..275561272721e 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +@@ -1177,9 +1177,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv, + mlx4_unregister_mac(mdev->dev, priv->port, mac); + + hlist_del_rcu(&entry->hlist); +- kfree_rcu(entry, rcu); + en_dbg(DRV, priv, "Removed MAC %pM on port:%d\n", + entry->mac, priv->port); ++ kfree_rcu(entry, rcu); + ++removed; + } + } +-- +2.51.0 + diff --git a/queue-6.6/net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch b/queue-6.6/net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch new file mode 100644 index 0000000000..2fb85dc937 --- /dev/null +++ b/queue-6.6/net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch @@ -0,0 +1,42 @@ +From 78a6b228cba6b73c19d4f7a5409e7f011ba3ef6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 12:14:47 +0300 +Subject: net/sctp: fix a null dereference in sctp_disposition + sctp_sf_do_5_1D_ce() + +From: Alexandr Sapozhnikov + +[ Upstream commit 2f3119686ef50319490ccaec81a575973da98815 ] + +If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 +and sctp_ulpevent_make_authkey() returns 0, then the variable +ai_ev remains zero and the zero will be dereferenced +in the sctp_ulpevent_free() function. + +Signed-off-by: Alexandr Sapozhnikov +Acked-by: Xin Long +Fixes: 30f6ebf65bc4 ("sctp: add SCTP_AUTH_NO_AUTH type for AUTHENTICATION_EVENT") +Link: https://patch.msgid.link/20251002091448.11-1-alsp705@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sctp/sm_statefuns.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index 808863e047e0c..2d88654e8d8e7 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -884,7 +884,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net, + return SCTP_DISPOSITION_CONSUME; + + nomem_authev: +- sctp_ulpevent_free(ai_ev); ++ if (ai_ev) ++ sctp_ulpevent_free(ai_ev); + nomem_aiev: + sctp_ulpevent_free(ev); + nomem_ev: +-- +2.51.0 + diff --git a/queue-6.6/netfilter-nf_tables-drop-unused-3rd-argument-from-va.patch b/queue-6.6/netfilter-nf_tables-drop-unused-3rd-argument-from-va.patch new file mode 100644 index 0000000000..605049c358 --- /dev/null +++ b/queue-6.6/netfilter-nf_tables-drop-unused-3rd-argument-from-va.patch @@ -0,0 +1,465 @@ +From f9d29e33a563575e27f639ff15ee848b2b03d7fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Aug 2024 11:34:02 +0200 +Subject: netfilter: nf_tables: drop unused 3rd argument from validate callback + ops + +From: Florian Westphal + +[ Upstream commit eaf9b2c875ece22768b78aa38da8b232e5de021b ] + +Since commit a654de8fdc18 ("netfilter: nf_tables: fix chain dependency validation") +the validate() callback no longer needs the return pointer argument. + +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Stable-dep-of: f359b809d54c ("netfilter: nft_objref: validate objref and objrefmap expressions") +Signed-off-by: Sasha Levin +--- + include/net/netfilter/nf_tables.h | 3 +-- + include/net/netfilter/nft_fib.h | 4 +--- + include/net/netfilter/nft_meta.h | 3 +-- + include/net/netfilter/nft_reject.h | 3 +-- + net/bridge/netfilter/nft_meta_bridge.c | 5 ++--- + net/bridge/netfilter/nft_reject_bridge.c | 3 +-- + net/netfilter/nf_tables_api.c | 3 +-- + net/netfilter/nft_compat.c | 6 ++---- + net/netfilter/nft_fib.c | 3 +-- + net/netfilter/nft_flow_offload.c | 3 +-- + net/netfilter/nft_fwd_netdev.c | 3 +-- + net/netfilter/nft_immediate.c | 3 +-- + net/netfilter/nft_lookup.c | 3 +-- + net/netfilter/nft_masq.c | 3 +-- + net/netfilter/nft_meta.c | 6 ++---- + net/netfilter/nft_nat.c | 3 +-- + net/netfilter/nft_osf.c | 3 +-- + net/netfilter/nft_queue.c | 3 +-- + net/netfilter/nft_redir.c | 3 +-- + net/netfilter/nft_reject.c | 3 +-- + net/netfilter/nft_reject_inet.c | 3 +-- + net/netfilter/nft_reject_netdev.c | 3 +-- + net/netfilter/nft_rt.c | 3 +-- + net/netfilter/nft_socket.c | 3 +-- + net/netfilter/nft_synproxy.c | 3 +-- + net/netfilter/nft_tproxy.c | 3 +-- + net/netfilter/nft_xfrm.c | 3 +-- + 27 files changed, 30 insertions(+), 60 deletions(-) + +diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h +index c0f4b91e4f5ec..32606d5430605 100644 +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -955,8 +955,7 @@ struct nft_expr_ops { + const struct nft_expr *expr, + bool reset); + int (*validate)(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data); ++ const struct nft_expr *expr); + bool (*reduce)(struct nft_regs_track *track, + const struct nft_expr *expr); + bool (*gc)(struct net *net, +diff --git a/include/net/netfilter/nft_fib.h b/include/net/netfilter/nft_fib.h +index 167640b843ef8..38cae7113de46 100644 +--- a/include/net/netfilter/nft_fib.h ++++ b/include/net/netfilter/nft_fib.h +@@ -21,9 +21,7 @@ nft_fib_is_loopback(const struct sk_buff *skb, const struct net_device *in) + int nft_fib_dump(struct sk_buff *skb, const struct nft_expr *expr, bool reset); + int nft_fib_init(const struct nft_ctx *ctx, const struct nft_expr *expr, + const struct nlattr * const tb[]); +-int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr, +- const struct nft_data **data); +- ++int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr); + + void nft_fib4_eval_type(const struct nft_expr *expr, struct nft_regs *regs, + const struct nft_pktinfo *pkt); +diff --git a/include/net/netfilter/nft_meta.h b/include/net/netfilter/nft_meta.h +index ba1238f12a487..d602263590fed 100644 +--- a/include/net/netfilter/nft_meta.h ++++ b/include/net/netfilter/nft_meta.h +@@ -41,8 +41,7 @@ void nft_meta_set_destroy(const struct nft_ctx *ctx, + const struct nft_expr *expr); + + int nft_meta_set_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data); ++ const struct nft_expr *expr); + + bool nft_meta_get_reduce(struct nft_regs_track *track, + const struct nft_expr *expr); +diff --git a/include/net/netfilter/nft_reject.h b/include/net/netfilter/nft_reject.h +index 6d9ba62efd750..19060212988a1 100644 +--- a/include/net/netfilter/nft_reject.h ++++ b/include/net/netfilter/nft_reject.h +@@ -15,8 +15,7 @@ struct nft_reject { + extern const struct nla_policy nft_reject_policy[]; + + int nft_reject_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data); ++ const struct nft_expr *expr); + + int nft_reject_init(const struct nft_ctx *ctx, + const struct nft_expr *expr, +diff --git a/net/bridge/netfilter/nft_meta_bridge.c b/net/bridge/netfilter/nft_meta_bridge.c +index bd4d1b4d745f6..affb740c8685e 100644 +--- a/net/bridge/netfilter/nft_meta_bridge.c ++++ b/net/bridge/netfilter/nft_meta_bridge.c +@@ -168,8 +168,7 @@ static bool nft_meta_bridge_set_reduce(struct nft_regs_track *track, + } + + static int nft_meta_bridge_set_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + struct nft_meta *priv = nft_expr_priv(expr); + unsigned int hooks; +@@ -179,7 +178,7 @@ static int nft_meta_bridge_set_validate(const struct nft_ctx *ctx, + hooks = 1 << NF_BR_PRE_ROUTING; + break; + default: +- return nft_meta_set_validate(ctx, expr, data); ++ return nft_meta_set_validate(ctx, expr); + } + + return nft_chain_validate_hooks(ctx->chain, hooks); +diff --git a/net/bridge/netfilter/nft_reject_bridge.c b/net/bridge/netfilter/nft_reject_bridge.c +index 71b54fed7263d..1cb5c16e97b7f 100644 +--- a/net/bridge/netfilter/nft_reject_bridge.c ++++ b/net/bridge/netfilter/nft_reject_bridge.c +@@ -170,8 +170,7 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr, + } + + static int nft_reject_bridge_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + return nft_chain_validate_hooks(ctx->chain, (1 << NF_BR_PRE_ROUTING) | + (1 << NF_BR_LOCAL_IN)); +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 4ffb5ef79ca13..5ca1d775e976d 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -3793,7 +3793,6 @@ static void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *r + int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain) + { + struct nft_expr *expr, *last; +- const struct nft_data *data; + struct nft_rule *rule; + int err; + +@@ -3814,7 +3813,7 @@ int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain) + /* This may call nft_chain_validate() recursively, + * callers that do so must increment ctx->level. + */ +- err = expr->ops->validate(ctx, expr, &data); ++ err = expr->ops->validate(ctx, expr); + if (err < 0) + return err; + } +diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c +index d3d11dede5450..52cdfee17f73f 100644 +--- a/net/netfilter/nft_compat.c ++++ b/net/netfilter/nft_compat.c +@@ -350,8 +350,7 @@ static int nft_target_dump(struct sk_buff *skb, + } + + static int nft_target_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + struct xt_target *target = expr->ops->data; + unsigned int hook_mask = 0; +@@ -611,8 +610,7 @@ static int nft_match_large_dump(struct sk_buff *skb, + } + + static int nft_match_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + struct xt_match *match = expr->ops->data; + unsigned int hook_mask = 0; +diff --git a/net/netfilter/nft_fib.c b/net/netfilter/nft_fib.c +index bf825f6cb974e..507b7eba9bcdc 100644 +--- a/net/netfilter/nft_fib.c ++++ b/net/netfilter/nft_fib.c +@@ -26,8 +26,7 @@ const struct nla_policy nft_fib_policy[NFTA_FIB_MAX + 1] = { + }; + EXPORT_SYMBOL(nft_fib_policy); + +-int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr, +- const struct nft_data **data) ++int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr) + { + const struct nft_fib *priv = nft_expr_priv(expr); + unsigned int hooks; +diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c +index 5a3d685420420..1894032a7971c 100644 +--- a/net/netfilter/nft_flow_offload.c ++++ b/net/netfilter/nft_flow_offload.c +@@ -385,8 +385,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, + } + + static int nft_flow_offload_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + unsigned int hook_mask = (1 << NF_INET_FORWARD); + +diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c +index a5268e6dd32f1..fa9e4ae00b16a 100644 +--- a/net/netfilter/nft_fwd_netdev.c ++++ b/net/netfilter/nft_fwd_netdev.c +@@ -204,8 +204,7 @@ static int nft_fwd_neigh_dump(struct sk_buff *skb, + } + + static int nft_fwd_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + return nft_chain_validate_hooks(ctx->chain, (1 << NF_NETDEV_INGRESS) | + (1 << NF_NETDEV_EGRESS)); +diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c +index ac2422c215e54..02ee5fb69871f 100644 +--- a/net/netfilter/nft_immediate.c ++++ b/net/netfilter/nft_immediate.c +@@ -244,8 +244,7 @@ static int nft_immediate_dump(struct sk_buff *skb, + } + + static int nft_immediate_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **d) ++ const struct nft_expr *expr) + { + const struct nft_immediate_expr *priv = nft_expr_priv(expr); + struct nft_ctx *pctx = (struct nft_ctx *)ctx; +diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c +index 1b9edf2b33937..dd5441f92fdb0 100644 +--- a/net/netfilter/nft_lookup.c ++++ b/net/netfilter/nft_lookup.c +@@ -206,8 +206,7 @@ static int nft_lookup_dump(struct sk_buff *skb, + } + + static int nft_lookup_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **d) ++ const struct nft_expr *expr) + { + const struct nft_lookup *priv = nft_expr_priv(expr); + struct nft_set_iter iter; +diff --git a/net/netfilter/nft_masq.c b/net/netfilter/nft_masq.c +index 8a14aaca93bbd..eee05394c5339 100644 +--- a/net/netfilter/nft_masq.c ++++ b/net/netfilter/nft_masq.c +@@ -27,8 +27,7 @@ static const struct nla_policy nft_masq_policy[NFTA_MASQ_MAX + 1] = { + }; + + static int nft_masq_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + int err; + +diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c +index 9139ce38ea7b9..dec76d28a0ac6 100644 +--- a/net/netfilter/nft_meta.c ++++ b/net/netfilter/nft_meta.c +@@ -581,8 +581,7 @@ static int nft_meta_get_validate_xfrm(const struct nft_ctx *ctx) + } + + static int nft_meta_get_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + const struct nft_meta *priv = nft_expr_priv(expr); + +@@ -600,8 +599,7 @@ static int nft_meta_get_validate(const struct nft_ctx *ctx, + } + + int nft_meta_set_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + struct nft_meta *priv = nft_expr_priv(expr); + unsigned int hooks; +diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c +index 808f5802c2704..3d3e639a7a837 100644 +--- a/net/netfilter/nft_nat.c ++++ b/net/netfilter/nft_nat.c +@@ -137,8 +137,7 @@ static const struct nla_policy nft_nat_policy[NFTA_NAT_MAX + 1] = { + }; + + static int nft_nat_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + struct nft_nat *priv = nft_expr_priv(expr); + int err; +diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c +index 7f61506e5b44b..123b4f47ccef4 100644 +--- a/net/netfilter/nft_osf.c ++++ b/net/netfilter/nft_osf.c +@@ -113,8 +113,7 @@ static int nft_osf_dump(struct sk_buff *skb, + } + + static int nft_osf_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + unsigned int hooks; + +diff --git a/net/netfilter/nft_queue.c b/net/netfilter/nft_queue.c +index b2b8127c8d438..b8ebb187814f2 100644 +--- a/net/netfilter/nft_queue.c ++++ b/net/netfilter/nft_queue.c +@@ -69,8 +69,7 @@ static void nft_queue_sreg_eval(const struct nft_expr *expr, + } + + static int nft_queue_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + static const unsigned int supported_hooks = ((1 << NF_INET_PRE_ROUTING) | + (1 << NF_INET_LOCAL_IN) | +diff --git a/net/netfilter/nft_redir.c b/net/netfilter/nft_redir.c +index a58bd8d291ff2..9051863509f31 100644 +--- a/net/netfilter/nft_redir.c ++++ b/net/netfilter/nft_redir.c +@@ -27,8 +27,7 @@ static const struct nla_policy nft_redir_policy[NFTA_REDIR_MAX + 1] = { + }; + + static int nft_redir_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + int err; + +diff --git a/net/netfilter/nft_reject.c b/net/netfilter/nft_reject.c +index ed2e668474d67..196a92c7ea09b 100644 +--- a/net/netfilter/nft_reject.c ++++ b/net/netfilter/nft_reject.c +@@ -24,8 +24,7 @@ const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = { + EXPORT_SYMBOL_GPL(nft_reject_policy); + + int nft_reject_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + return nft_chain_validate_hooks(ctx->chain, + (1 << NF_INET_LOCAL_IN) | +diff --git a/net/netfilter/nft_reject_inet.c b/net/netfilter/nft_reject_inet.c +index 973fa31a9dd6c..49020e67304ad 100644 +--- a/net/netfilter/nft_reject_inet.c ++++ b/net/netfilter/nft_reject_inet.c +@@ -61,8 +61,7 @@ static void nft_reject_inet_eval(const struct nft_expr *expr, + } + + static int nft_reject_inet_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + return nft_chain_validate_hooks(ctx->chain, + (1 << NF_INET_LOCAL_IN) | +diff --git a/net/netfilter/nft_reject_netdev.c b/net/netfilter/nft_reject_netdev.c +index 7865cd8b11bb6..2558ce1505d98 100644 +--- a/net/netfilter/nft_reject_netdev.c ++++ b/net/netfilter/nft_reject_netdev.c +@@ -145,8 +145,7 @@ static void nft_reject_netdev_eval(const struct nft_expr *expr, + } + + static int nft_reject_netdev_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + return nft_chain_validate_hooks(ctx->chain, (1 << NF_NETDEV_INGRESS)); + } +diff --git a/net/netfilter/nft_rt.c b/net/netfilter/nft_rt.c +index 2434c624aafde..9525f1e02a7d8 100644 +--- a/net/netfilter/nft_rt.c ++++ b/net/netfilter/nft_rt.c +@@ -160,8 +160,7 @@ static int nft_rt_get_dump(struct sk_buff *skb, + return -1; + } + +-static int nft_rt_validate(const struct nft_ctx *ctx, const struct nft_expr *expr, +- const struct nft_data **data) ++static int nft_rt_validate(const struct nft_ctx *ctx, const struct nft_expr *expr) + { + const struct nft_rt *priv = nft_expr_priv(expr); + unsigned int hooks; +diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c +index 187b667bad6c3..35d0409b00950 100644 +--- a/net/netfilter/nft_socket.c ++++ b/net/netfilter/nft_socket.c +@@ -275,8 +275,7 @@ static bool nft_socket_reduce(struct nft_regs_track *track, + } + + static int nft_socket_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + if (ctx->family != NFPROTO_IPV4 && + ctx->family != NFPROTO_IPV6 && +diff --git a/net/netfilter/nft_synproxy.c b/net/netfilter/nft_synproxy.c +index 1d737f89dfc18..5d3e518259859 100644 +--- a/net/netfilter/nft_synproxy.c ++++ b/net/netfilter/nft_synproxy.c +@@ -248,8 +248,7 @@ static void nft_synproxy_eval(const struct nft_expr *expr, + } + + static int nft_synproxy_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + if (ctx->family != NFPROTO_IPV4 && + ctx->family != NFPROTO_IPV6 && +diff --git a/net/netfilter/nft_tproxy.c b/net/netfilter/nft_tproxy.c +index 71412adb73d41..ed344af2a439b 100644 +--- a/net/netfilter/nft_tproxy.c ++++ b/net/netfilter/nft_tproxy.c +@@ -313,8 +313,7 @@ static int nft_tproxy_dump(struct sk_buff *skb, + } + + static int nft_tproxy_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + if (ctx->family != NFPROTO_IPV4 && + ctx->family != NFPROTO_IPV6 && +diff --git a/net/netfilter/nft_xfrm.c b/net/netfilter/nft_xfrm.c +index 1c866757db552..8a07b46cc8fb7 100644 +--- a/net/netfilter/nft_xfrm.c ++++ b/net/netfilter/nft_xfrm.c +@@ -229,8 +229,7 @@ static int nft_xfrm_get_dump(struct sk_buff *skb, + return 0; + } + +-static int nft_xfrm_validate(const struct nft_ctx *ctx, const struct nft_expr *expr, +- const struct nft_data **data) ++static int nft_xfrm_validate(const struct nft_ctx *ctx, const struct nft_expr *expr) + { + const struct nft_xfrm *priv = nft_expr_priv(expr); + unsigned int hooks; +-- +2.51.0 + diff --git a/queue-6.6/netfilter-nft_objref-validate-objref-and-objrefmap-e.patch b/queue-6.6/netfilter-nft_objref-validate-objref-and-objrefmap-e.patch new file mode 100644 index 0000000000..9828c1c019 --- /dev/null +++ b/queue-6.6/netfilter-nft_objref-validate-objref-and-objrefmap-e.patch @@ -0,0 +1,131 @@ +From 463dac4587a3d1920e0d80708f5a19e97ad4cb40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 12:08:16 +0200 +Subject: netfilter: nft_objref: validate objref and objrefmap expressions + +From: Fernando Fernandez Mancera + +[ Upstream commit f359b809d54c6e3dd1d039b97e0b68390b0e53e4 ] + +Referencing a synproxy stateful object from OUTPUT hook causes kernel +crash due to infinite recursive calls: + +BUG: TASK stack guard page was hit at 000000008bda5b8c (stack is 000000003ab1c4a5..00000000494d8b12) +[...] +Call Trace: + __find_rr_leaf+0x99/0x230 + fib6_table_lookup+0x13b/0x2d0 + ip6_pol_route+0xa4/0x400 + fib6_rule_lookup+0x156/0x240 + ip6_route_output_flags+0xc6/0x150 + __nf_ip6_route+0x23/0x50 + synproxy_send_tcp_ipv6+0x106/0x200 + synproxy_send_client_synack_ipv6+0x1aa/0x1f0 + nft_synproxy_do_eval+0x263/0x310 + nft_do_chain+0x5a8/0x5f0 [nf_tables + nft_do_chain_inet+0x98/0x110 + nf_hook_slow+0x43/0xc0 + __ip6_local_out+0xf0/0x170 + ip6_local_out+0x17/0x70 + synproxy_send_tcp_ipv6+0x1a2/0x200 + synproxy_send_client_synack_ipv6+0x1aa/0x1f0 +[...] + +Implement objref and objrefmap expression validate functions. + +Currently, only NFT_OBJECT_SYNPROXY object type requires validation. +This will also handle a jump to a chain using a synproxy object from the +OUTPUT hook. + +Now when trying to reference a synproxy object in the OUTPUT hook, nft +will produce the following error: + +synproxy_crash.nft: Error: Could not process rule: Operation not supported + synproxy name mysynproxy + ^^^^^^^^^^^^^^^^^^^^^^^^ + +Fixes: ee394f96ad75 ("netfilter: nft_synproxy: add synproxy stateful object support") +Reported-by: Georg Pfuetzenreuter +Closes: https://bugzilla.suse.com/1250237 +Signed-off-by: Fernando Fernandez Mancera +Reviewed-by: Pablo Neira Ayuso +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_objref.c | 39 ++++++++++++++++++++++++++++++++++++++ + 1 file changed, 39 insertions(+) + +diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c +index 509011b1ef597..08a27433e2f5f 100644 +--- a/net/netfilter/nft_objref.c ++++ b/net/netfilter/nft_objref.c +@@ -22,6 +22,35 @@ void nft_objref_eval(const struct nft_expr *expr, + obj->ops->eval(obj, regs, pkt); + } + ++static int nft_objref_validate_obj_type(const struct nft_ctx *ctx, u32 type) ++{ ++ unsigned int hooks; ++ ++ switch (type) { ++ case NFT_OBJECT_SYNPROXY: ++ if (ctx->family != NFPROTO_IPV4 && ++ ctx->family != NFPROTO_IPV6 && ++ ctx->family != NFPROTO_INET) ++ return -EOPNOTSUPP; ++ ++ hooks = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD); ++ ++ return nft_chain_validate_hooks(ctx->chain, hooks); ++ default: ++ break; ++ } ++ ++ return 0; ++} ++ ++static int nft_objref_validate(const struct nft_ctx *ctx, ++ const struct nft_expr *expr) ++{ ++ struct nft_object *obj = nft_objref_priv(expr); ++ ++ return nft_objref_validate_obj_type(ctx, obj->ops->type->type); ++} ++ + static int nft_objref_init(const struct nft_ctx *ctx, + const struct nft_expr *expr, + const struct nlattr * const tb[]) +@@ -93,6 +122,7 @@ static const struct nft_expr_ops nft_objref_ops = { + .activate = nft_objref_activate, + .deactivate = nft_objref_deactivate, + .dump = nft_objref_dump, ++ .validate = nft_objref_validate, + .reduce = NFT_REDUCE_READONLY, + }; + +@@ -198,6 +228,14 @@ static void nft_objref_map_destroy(const struct nft_ctx *ctx, + nf_tables_destroy_set(ctx, priv->set); + } + ++static int nft_objref_map_validate(const struct nft_ctx *ctx, ++ const struct nft_expr *expr) ++{ ++ const struct nft_objref_map *priv = nft_expr_priv(expr); ++ ++ return nft_objref_validate_obj_type(ctx, priv->set->objtype); ++} ++ + static const struct nft_expr_ops nft_objref_map_ops = { + .type = &nft_objref_type, + .size = NFT_EXPR_SIZE(sizeof(struct nft_objref_map)), +@@ -207,6 +245,7 @@ static const struct nft_expr_ops nft_objref_map_ops = { + .deactivate = nft_objref_map_deactivate, + .destroy = nft_objref_map_destroy, + .dump = nft_objref_map_dump, ++ .validate = nft_objref_map_validate, + .reduce = NFT_REDUCE_READONLY, + }; + +-- +2.51.0 + diff --git a/queue-6.6/perf-arm-spe-rename-the-common-data-source-encoding.patch b/queue-6.6/perf-arm-spe-rename-the-common-data-source-encoding.patch new file mode 100644 index 0000000000..1da1b19c33 --- /dev/null +++ b/queue-6.6/perf-arm-spe-rename-the-common-data-source-encoding.patch @@ -0,0 +1,158 @@ +From e1e7b3ff7de578cc0001c3bfb674d8964b4dfcd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Oct 2024 19:53:17 +0100 +Subject: perf arm-spe: Rename the common data source encoding + +From: Leo Yan + +[ Upstream commit 50b8f1d5bf4ad7f09ef8012ccf5f94f741df827b ] + +The Neoverse CPUs follow the common data source encoding, and other +CPU variants can share the same format. + +Rename the CPU list and data source definitions as common data source +names. This change prepares for appending more CPU variants. + +Signed-off-by: Leo Yan +Reviewed-by: James Clark +Link: https://lore.kernel.org/r/20241003185322.192357-3-leo.yan@arm.com +Signed-off-by: Namhyung Kim +Stable-dep-of: cb300e351505 ("perf arm_spe: Correct memory level for remote access") +Signed-off-by: Sasha Levin +--- + .../util/arm-spe-decoder/arm-spe-decoder.h | 18 ++++++------ + tools/perf/util/arm-spe.c | 28 +++++++++---------- + 2 files changed, 23 insertions(+), 23 deletions(-) + +diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +index 1443c28545a94..358c611eeddbb 100644 +--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h ++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +@@ -56,15 +56,15 @@ enum arm_spe_op_type { + ARM_SPE_OP_BR_INDIRECT = 1 << 17, + }; + +-enum arm_spe_neoverse_data_source { +- ARM_SPE_NV_L1D = 0x0, +- ARM_SPE_NV_L2 = 0x8, +- ARM_SPE_NV_PEER_CORE = 0x9, +- ARM_SPE_NV_LOCAL_CLUSTER = 0xa, +- ARM_SPE_NV_SYS_CACHE = 0xb, +- ARM_SPE_NV_PEER_CLUSTER = 0xc, +- ARM_SPE_NV_REMOTE = 0xd, +- ARM_SPE_NV_DRAM = 0xe, ++enum arm_spe_common_data_source { ++ ARM_SPE_COMMON_DS_L1D = 0x0, ++ ARM_SPE_COMMON_DS_L2 = 0x8, ++ ARM_SPE_COMMON_DS_PEER_CORE = 0x9, ++ ARM_SPE_COMMON_DS_LOCAL_CLUSTER = 0xa, ++ ARM_SPE_COMMON_DS_SYS_CACHE = 0xb, ++ ARM_SPE_COMMON_DS_PEER_CLUSTER = 0xc, ++ ARM_SPE_COMMON_DS_REMOTE = 0xd, ++ ARM_SPE_COMMON_DS_DRAM = 0xe, + }; + + struct arm_spe_record { +diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c +index 0faa4cfaf1f91..ba83cd13ff756 100644 +--- a/tools/perf/util/arm-spe.c ++++ b/tools/perf/util/arm-spe.c +@@ -411,15 +411,15 @@ static int arm_spe__synth_instruction_sample(struct arm_spe_queue *speq, + return arm_spe_deliver_synth_event(spe, speq, event, &sample); + } + +-static const struct midr_range neoverse_spe[] = { ++static const struct midr_range common_ds_encoding_cpus[] = { + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), + {}, + }; + +-static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *record, +- union perf_mem_data_src *data_src) ++static void arm_spe__synth_data_source_common(const struct arm_spe_record *record, ++ union perf_mem_data_src *data_src) + { + /* + * Even though four levels of cache hierarchy are possible, no known +@@ -441,17 +441,17 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec + } + + switch (record->source) { +- case ARM_SPE_NV_L1D: ++ case ARM_SPE_COMMON_DS_L1D: + data_src->mem_lvl = PERF_MEM_LVL_L1 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L1; + data_src->mem_snoop = PERF_MEM_SNOOP_NONE; + break; +- case ARM_SPE_NV_L2: ++ case ARM_SPE_COMMON_DS_L2: + data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2; + data_src->mem_snoop = PERF_MEM_SNOOP_NONE; + break; +- case ARM_SPE_NV_PEER_CORE: ++ case ARM_SPE_COMMON_DS_PEER_CORE: + data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; +@@ -460,8 +460,8 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec + * We don't know if this is L1, L2 but we do know it was a cache-2-cache + * transfer, so set SNOOPX_PEER + */ +- case ARM_SPE_NV_LOCAL_CLUSTER: +- case ARM_SPE_NV_PEER_CLUSTER: ++ case ARM_SPE_COMMON_DS_LOCAL_CLUSTER: ++ case ARM_SPE_COMMON_DS_PEER_CLUSTER: + data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; +@@ -469,7 +469,7 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec + /* + * System cache is assumed to be L3 + */ +- case ARM_SPE_NV_SYS_CACHE: ++ case ARM_SPE_COMMON_DS_SYS_CACHE: + data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3; + data_src->mem_snoop = PERF_MEM_SNOOP_HIT; +@@ -478,13 +478,13 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec + * We don't know what level it hit in, except it came from the other + * socket + */ +- case ARM_SPE_NV_REMOTE: ++ case ARM_SPE_COMMON_DS_REMOTE: + data_src->mem_lvl = PERF_MEM_LVL_REM_CCE1; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_ANY_CACHE; + data_src->mem_remote = PERF_MEM_REMOTE_REMOTE; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; + break; +- case ARM_SPE_NV_DRAM: ++ case ARM_SPE_COMMON_DS_DRAM: + data_src->mem_lvl = PERF_MEM_LVL_LOC_RAM | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_RAM; + data_src->mem_snoop = PERF_MEM_SNOOP_NONE; +@@ -520,7 +520,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco + static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr) + { + union perf_mem_data_src data_src = { .mem_op = PERF_MEM_OP_NA }; +- bool is_neoverse = is_midr_in_range_list(midr, neoverse_spe); ++ bool is_common = is_midr_in_range_list(midr, common_ds_encoding_cpus); + + /* Only synthesize data source for LDST operations */ + if (!is_ldst_op(record->op)) +@@ -533,8 +533,8 @@ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 m + else + return 0; + +- if (is_neoverse) +- arm_spe__synth_data_source_neoverse(record, &data_src); ++ if (is_common) ++ arm_spe__synth_data_source_common(record, &data_src); + else + arm_spe__synth_data_source_generic(record, &data_src); + +-- +2.51.0 + diff --git a/queue-6.6/perf-arm_spe-correct-memory-level-for-remote-access.patch b/queue-6.6/perf-arm_spe-correct-memory-level-for-remote-access.patch new file mode 100644 index 0000000000..1ccfa544ef --- /dev/null +++ b/queue-6.6/perf-arm_spe-correct-memory-level-for-remote-access.patch @@ -0,0 +1,49 @@ +From f7ee4ec3e2a59df91abbc023e2a692b16dc57172 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 16:42:09 +0100 +Subject: perf arm_spe: Correct memory level for remote access + +From: Leo Yan + +[ Upstream commit cb300e3515057fb555983ce47e8acc86a5c69c3c ] + +For remote accesses, the data source packet does not contain information +about the memory level. To avoid misinformation, set the memory level to +NA (Not Available). + +Fixes: 4e6430cbb1a9f1dc ("perf arm-spe: Use SPE data source for neoverse cores") +Reviewed-by: James Clark +Signed-off-by: Leo Yan +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ali Saidi +Cc: German Gomez +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Will Deacon +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/arm-spe.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c +index ba83cd13ff756..0302e6407b5a2 100644 +--- a/tools/perf/util/arm-spe.c ++++ b/tools/perf/util/arm-spe.c +@@ -479,8 +479,8 @@ static void arm_spe__synth_data_source_common(const struct arm_spe_record *recor + * socket + */ + case ARM_SPE_COMMON_DS_REMOTE: +- data_src->mem_lvl = PERF_MEM_LVL_REM_CCE1; +- data_src->mem_lvl_num = PERF_MEM_LVLNUM_ANY_CACHE; ++ data_src->mem_lvl = PERF_MEM_LVL_NA; ++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_NA; + data_src->mem_remote = PERF_MEM_REMOTE_REMOTE; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; + break; +-- +2.51.0 + diff --git a/queue-6.6/perf-arm_spe-correct-setting-remote-access.patch b/queue-6.6/perf-arm_spe-correct-setting-remote-access.patch new file mode 100644 index 0000000000..e697a1f102 --- /dev/null +++ b/queue-6.6/perf-arm_spe-correct-setting-remote-access.patch @@ -0,0 +1,46 @@ +From b591d4fd11517c990203005507250102b0cd4b0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 16:42:08 +0100 +Subject: perf arm_spe: Correct setting remote access + +From: Leo Yan + +[ Upstream commit 039fd0634a0629132432632d7ac9a14915406b5c ] + +Set the mem_remote field for a remote access to appropriately represent +the event. + +Fixes: a89dbc9b988f3ba8 ("perf arm-spe: Set sample's data source field") +Reviewed-by: James Clark +Signed-off-by: Leo Yan +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ali Saidi +Cc: German Gomez +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Will Deacon +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/arm-spe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c +index 9848310cee5f3..0faa4cfaf1f91 100644 +--- a/tools/perf/util/arm-spe.c ++++ b/tools/perf/util/arm-spe.c +@@ -514,7 +514,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco + } + + if (record->type & ARM_SPE_REMOTE_ACCESS) +- data_src->mem_lvl |= PERF_MEM_LVL_REM_CCE1; ++ data_src->mem_remote = PERF_MEM_REMOTE_REMOTE; + } + + static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr) +-- +2.51.0 + diff --git a/queue-6.6/perf-evsel-avoid-container_of-on-a-null-leader.patch b/queue-6.6/perf-evsel-avoid-container_of-on-a-null-leader.patch new file mode 100644 index 0000000000..3902c4065d --- /dev/null +++ b/queue-6.6/perf-evsel-avoid-container_of-on-a-null-leader.patch @@ -0,0 +1,59 @@ +From 7ffc53f14dc7734a85c95d2b5f2e8a49152b1c38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:17 -0700 +Subject: perf evsel: Avoid container_of on a NULL leader + +From: Ian Rogers + +[ Upstream commit 2354479026d726954ff86ce82f4b649637319661 ] + +An evsel should typically have a leader of itself, however, in tests +like 'Sample parsing' a NULL leader may occur and the container_of +will return a corrupt pointer. + +Avoid this with an explicit NULL test. + +Fixes: fba7c86601e2e42d ("libperf: Move 'leader' from tools/perf to perf_evsel::leader") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Acked-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Blake Jones +Cc: Chun-Tse Shao +Cc: Collin Funk +Cc: Howard Chu +Cc: Ingo Molnar +Cc: Jan Polensky +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Li Huafei +Cc: Mark Rutland +Cc: Nam Cao +Cc: Peter Zijlstra +Cc: Steinar H. Gunderson +Cc: Thomas Gleixner +Link: https://lore.kernel.org/r/20250821163820.1132977-4-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/evsel.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index 2a6295f1ac1bc..cdd13f576c191 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -3131,6 +3131,8 @@ bool evsel__is_hybrid(const struct evsel *evsel) + + struct evsel *evsel__leader(const struct evsel *evsel) + { ++ if (evsel->core.leader == NULL) ++ return NULL; + return container_of(evsel->core.leader, struct evsel, core); + } + +-- +2.51.0 + diff --git a/queue-6.6/perf-evsel-ensure-the-fallback-message-is-always-wri.patch b/queue-6.6/perf-evsel-ensure-the-fallback-message-is-always-wri.patch new file mode 100644 index 0000000000..570e33af4f --- /dev/null +++ b/queue-6.6/perf-evsel-ensure-the-fallback-message-is-always-wri.patch @@ -0,0 +1,81 @@ +From ac8d90acdcbe39ae7a7315945cd326dae9e44e43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 10:24:15 -0700 +Subject: perf evsel: Ensure the fallback message is always written to + +From: Ian Rogers + +[ Upstream commit 24937ee839e4bbc097acde73eeed67812bad2d99 ] + +The fallback message is unconditionally printed in places like +record__open(). + +If no fallback is attempted this can lead to printing uninitialized +data, crashes, etc. + +Fixes: c0a54341c0e89333 ("perf evsel: Introduce event fallback method") +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Howard Chu +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/evsel.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index c37faef63df99..6d1327f8c6043 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -2874,7 +2874,7 @@ bool evsel__fallback(struct evsel *evsel, int err, char *msg, size_t msgsize) + + /* If event has exclude user then don't exclude kernel. */ + if (evsel->core.attr.exclude_user) +- return false; ++ goto no_fallback; + + /* Is there already the separator in the name. */ + if (strchr(name, '/') || +@@ -2882,7 +2882,7 @@ bool evsel__fallback(struct evsel *evsel, int err, char *msg, size_t msgsize) + sep = ""; + + if (asprintf(&new_name, "%s%su", name, sep) < 0) +- return false; ++ goto no_fallback; + + free(evsel->name); + evsel->name = new_name; +@@ -2905,17 +2905,19 @@ bool evsel__fallback(struct evsel *evsel, int err, char *msg, size_t msgsize) + sep = ""; + + if (asprintf(&new_name, "%s%sH", name, sep) < 0) +- return false; ++ goto no_fallback; + + free(evsel->name); + evsel->name = new_name; + /* Apple M1 requires exclude_guest */ +- scnprintf(msg, msgsize, "trying to fall back to excluding guest samples"); ++ scnprintf(msg, msgsize, "Trying to fall back to excluding guest samples"); + evsel->core.attr.exclude_guest = 1; + + return true; + } +- ++no_fallback: ++ scnprintf(msg, msgsize, "No fallback found for '%s' for error %d", ++ evsel__name(evsel), err); + return false; + } + +-- +2.51.0 + diff --git a/queue-6.6/perf-python-split-clang-options-when-invoking-popen.patch b/queue-6.6/perf-python-split-clang-options-when-invoking-popen.patch new file mode 100644 index 0000000000..06e6fbb48a --- /dev/null +++ b/queue-6.6/perf-python-split-clang-options-when-invoking-popen.patch @@ -0,0 +1,82 @@ +From d53c785aaaf684d0c7f5990ab874270aee00dfce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Oct 2025 17:21:24 +0100 +Subject: perf python: split Clang options when invoking Popen + +From: Leo Yan + +[ Upstream commit c6a43bc3e8f6102a47da0d2e53428d08f00172fb ] + +When passing a list to subprocess.Popen, each element maps to one argv +token. Current code bundles multiple Clang flags into a single element, +something like: + + cmd = ['clang', + '--target=x86_64-linux-gnu -fintegrated-as -Wno-cast-function-type-mismatch', + 'test-hello.c'] + +So Clang only sees one long, invalid option instead of separate flags, +as a result, the script cannot capture any log via PIPE. + +Fix this by using shlex.split() to separate the string so each option +becomes its own argv element. The fixed list will be: + + cmd = ['clang', + '--target=x86_64-linux-gnu', + '-fintegrated-as', + '-Wno-cast-function-type-mismatch', + 'test-hello.c'] + +Fixes: 09e6f9f98370 ("perf python: Fix splitting CC into compiler and options") +Signed-off-by: Leo Yan +Reviewed-by: Ian Rogers +Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-2-4305590795b2@arm.com +Cc: Palmer Dabbelt +Cc: Albert Ou +Cc: Alexandre Ghiti +Cc: Nick Desaulniers +Cc: Justin Stitt +Cc: Bill Wendling +Cc: Adrian Hunter +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Nathan Chancellor +Cc: James Clark +Cc: linux-riscv@lists.infradead.org +Cc: llvm@lists.linux.dev +Cc: Paul Walmsley +Cc: linux-kernel@vger.kernel.org +Cc: linux-perf-users@vger.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/setup.py | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py +index e837132d5031b..eecb462c021cd 100644 +--- a/tools/perf/util/setup.py ++++ b/tools/perf/util/setup.py +@@ -1,6 +1,7 @@ + from os import getenv, path + from subprocess import Popen, PIPE + from re import sub ++import shlex + + cc = getenv("CC") + +@@ -16,7 +17,9 @@ cc_is_clang = b"clang version" in Popen([cc, "-v"], stderr=PIPE).stderr.readline + src_feature_tests = getenv('srctree') + '/tools/build/feature' + + def clang_has_option(option): +- cc_output = Popen([cc, cc_options + option, path.join(src_feature_tests, "test-hello.c") ], stderr=PIPE).stderr.readlines() ++ cmd = shlex.split(f"{cc} {cc_options} {option}") ++ cmd.append(path.join(src_feature_tests, "test-hello.c")) ++ cc_output = Popen(cmd, stderr=PIPE).stderr.readlines() + return [o for o in cc_output if ((b"unknown argument" in o) or (b"is not supported" in o) or (b"unknown warning option" in o))] == [ ] + + if cc_is_clang: +-- +2.51.0 + diff --git a/queue-6.6/perf-session-fix-handling-when-buffer-exceeds-2-gib.patch b/queue-6.6/perf-session-fix-handling-when-buffer-exceeds-2-gib.patch new file mode 100644 index 0000000000..6a0a03465e --- /dev/null +++ b/queue-6.6/perf-session-fix-handling-when-buffer-exceeds-2-gib.patch @@ -0,0 +1,53 @@ +From 9d4c7a475f280ea574cbe4795ac122e53c1dd44e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Aug 2025 14:24:40 +0100 +Subject: perf session: Fix handling when buffer exceeds 2 GiB +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leo Yan + +[ Upstream commit c17dda8013495d8132c976cbf349be9949d0fbd1 ] + +If a user specifies an AUX buffer larger than 2 GiB, the returned size +may exceed 0x80000000. Since the err variable is defined as a signed +32-bit integer, such a value overflows and becomes negative. + +As a result, the perf record command reports an error: + + 0x146e8 [0x30]: failed to process type: 71 [Unknown error 183711232] + +Change the type of the err variable to a signed 64-bit integer to +accommodate large buffer sizes correctly. + +Fixes: d5652d865ea734a1 ("perf session: Add ability to skip 4GiB or more") +Reported-by: Tamas Zsoldos +Signed-off-by: Leo Yan +Acked-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Jiri Olsa +Link: https://lore.kernel.org/r/20250808-perf_fix_big_buffer_size-v1-1-45f45444a9a4@arm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/session.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c +index 277b2cbd51861..e4d57e7df7ae1 100644 +--- a/tools/perf/util/session.c ++++ b/tools/perf/util/session.c +@@ -1662,7 +1662,7 @@ static s64 perf_session__process_user_event(struct perf_session *session, + struct perf_tool *tool = session->tool; + struct perf_sample sample = { .time = 0, }; + int fd = perf_data__fd(session->data); +- int err; ++ s64 err; + + if (event->header.type != PERF_RECORD_COMPRESSED || + tool->compressed == perf_session__process_compressed_event_stub) +-- +2.51.0 + diff --git a/queue-6.6/perf-test-add-a-test-for-default-perf-stat-command.patch b/queue-6.6/perf-test-add-a-test-for-default-perf-stat-command.patch new file mode 100644 index 0000000000..65de2a556a --- /dev/null +++ b/queue-6.6/perf-test-add-a-test-for-default-perf-stat-command.patch @@ -0,0 +1,90 @@ +From f904b1eda0fc7d9fbc107aca0e03601af984cd43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Sep 2024 15:48:38 +0100 +Subject: perf test: Add a test for default perf stat command + +From: James Clark + +[ Upstream commit 65d11821910bd910a2b4b5b005360d036c76ecef ] + +Test that one cycles event is opened for each core PMU when "perf stat" +is run without arguments. + +The event line can either be output as "pmu/cycles/" or just "cycles" if +there is only one PMU. Include 2 spaces for padding in the one PMU case +to avoid matching when the word cycles is included in metric +descriptions. + +Acked-by: Namhyung Kim +Acked-by: Kan Liang +Signed-off-by: James Clark +Cc: Yang Jihong +Cc: Dominique Martinet +Cc: Colin Ian King +Cc: Howard Chu +Cc: Ze Gao +Cc: Yicong Yang +Cc: Weilin Wang +Cc: Will Deacon +Cc: Mike Leach +Cc: Jing Zhang +Cc: Yang Li +Cc: Leo Yan +Cc: ak@linux.intel.com +Cc: Athira Rajeev +Cc: linux-arm-kernel@lists.infradead.org +Cc: Yanteng Si +Cc: Sun Haiyong +Cc: John Garry +Link: https://lore.kernel.org/r/20240926144851.245903-8-james.clark@linaro.org +Signed-off-by: Namhyung Kim +Stable-dep-of: 24937ee839e4 ("perf evsel: Ensure the fallback message is always written to") +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/stat.sh | 25 +++++++++++++++++++++++++ + 1 file changed, 25 insertions(+) + +diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh +index 3f1e67795490a..c6df7eec96b98 100755 +--- a/tools/perf/tests/shell/stat.sh ++++ b/tools/perf/tests/shell/stat.sh +@@ -146,6 +146,30 @@ test_cputype() { + echo "cputype test [Success]" + } + ++test_hybrid() { ++ # Test the default stat command on hybrid devices opens one cycles event for ++ # each CPU type. ++ echo "hybrid test" ++ ++ # Count the number of core PMUs, assume minimum of 1 ++ pmus=$(ls /sys/bus/event_source/devices/*/cpus 2>/dev/null | wc -l) ++ if [ "$pmus" -lt 1 ] ++ then ++ pmus=1 ++ fi ++ ++ # Run default Perf stat ++ cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/| cycles " | wc -l) ++ ++ if [ "$pmus" -ne "$cycles_events" ] ++ then ++ echo "hybrid test [Found $pmus PMUs but $cycles_events cycles events. Failed]" ++ err=1 ++ return ++ fi ++ echo "hybrid test [Success]" ++} ++ + test_default_stat + test_stat_record_report + test_stat_record_script +@@ -153,4 +177,5 @@ test_stat_repeat_weak_groups + test_topdown_groups + test_topdown_weak_groups + test_cputype ++test_hybrid + exit $err +-- +2.51.0 + diff --git a/queue-6.6/perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch b/queue-6.6/perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch new file mode 100644 index 0000000000..9ede3718c7 --- /dev/null +++ b/queue-6.6/perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch @@ -0,0 +1,202 @@ +From f4ca823b2a6531a31a260b48481902cc41732161 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 15:22:00 -0700 +Subject: perf test: Don't leak workload gopipe in PERF_RECORD_* + +From: Ian Rogers + +[ Upstream commit 48918cacefd226af44373e914e63304927c0e7dc ] + +The test starts a workload and then opens events. If the events fail +to open, for example because of perf_event_paranoid, the gopipe of the +workload is leaked and the file descriptor leak check fails when the +test exits. To avoid this cancel the workload when opening the events +fails. + +Before: +``` +$ perf test -vv 7 + 7: PERF_RECORD_* events & perf_sample fields: + --- start --- +test child forked, pid 1189568 +Using CPUID GenuineIntel-6-B7-1 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 +sys_perf_event_open failed, error -13 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + exclude_kernel 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 +sys_perf_event_open failed, error -13 + ------------------------------------------------------------ +perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/) + disabled 1 + exclude_kernel 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3 +Attempt to add: software/cpu-clock/ +..after resolving event: software/config=0/ +cpu-clock -> software/cpu-clock/ + ------------------------------------------------------------ +perf_event_attr: + type 1 (PERF_TYPE_SOFTWARE) + size 136 + config 0x9 (PERF_COUNT_SW_DUMMY) + sample_type IP|TID|TIME|CPU + read_format ID|LOST + disabled 1 + inherit 1 + mmap 1 + comm 1 + enable_on_exec 1 + task 1 + sample_id_all 1 + mmap2 1 + comm_exec 1 + ksymbol 1 + bpf_event 1 + { wakeup_events, wakeup_watermark } 1 + ------------------------------------------------------------ +sys_perf_event_open: pid 1189569 cpu 0 group_fd -1 flags 0x8 +sys_perf_event_open failed, error -13 +perf_evlist__open: Permission denied + ---- end(-2) ---- +Leak of file descriptor 6 that opened: 'pipe:[14200347]' + ---- unexpected signal (6) ---- +iFailed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon +Failed to read build ID for //anon + #0 0x565358f6666e in child_test_sig_handler builtin-test.c:311 + #1 0x7f29ce849df0 in __restore_rt libc_sigaction.c:0 + #2 0x7f29ce89e95c in __pthread_kill_implementation pthread_kill.c:44 + #3 0x7f29ce849cc2 in raise raise.c:27 + #4 0x7f29ce8324ac in abort abort.c:81 + #5 0x565358f662d4 in check_leaks builtin-test.c:226 + #6 0x565358f6682e in run_test_child builtin-test.c:344 + #7 0x565358ef7121 in start_command run-command.c:128 + #8 0x565358f67273 in start_test builtin-test.c:545 + #9 0x565358f6771d in __cmd_test builtin-test.c:647 + #10 0x565358f682bd in cmd_test builtin-test.c:849 + #11 0x565358ee5ded in run_builtin perf.c:349 + #12 0x565358ee6085 in handle_internal_command perf.c:401 + #13 0x565358ee61de in run_argv perf.c:448 + #14 0x565358ee6527 in main perf.c:555 + #15 0x7f29ce833ca8 in __libc_start_call_main libc_start_call_main.h:74 + #16 0x7f29ce833d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128 + #17 0x565358e391c1 in _start perf[851c1] + 7: PERF_RECORD_* events & perf_sample fields : FAILED! +``` + +After: +``` +$ perf test 7 + 7: PERF_RECORD_* events & perf_sample fields : Skip (permissions) +``` + +Fixes: 16d00fee703866c6 ("perf tests: Move test__PERF_RECORD into separate object") +Signed-off-by: Ian Rogers +Tested-by: Arnaldo Carvalho de Melo +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Chun-Tse Shao +Cc: Howard Chu +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/perf-record.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/tools/perf/tests/perf-record.c b/tools/perf/tests/perf-record.c +index 1c4feec1adff1..6e7f053006b4f 100644 +--- a/tools/perf/tests/perf-record.c ++++ b/tools/perf/tests/perf-record.c +@@ -115,6 +115,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest + if (err < 0) { + pr_debug("sched__get_first_possible_cpu: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +@@ -126,6 +127,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest + if (sched_setaffinity(evlist->workload.pid, cpu_mask_size, &cpu_mask) < 0) { + pr_debug("sched_setaffinity: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +@@ -137,6 +139,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest + if (err < 0) { + pr_debug("perf_evlist__open: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +@@ -149,6 +152,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest + if (err < 0) { + pr_debug("evlist__mmap: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +-- +2.51.0 + diff --git a/queue-6.6/perf-tools-add-fallback-for-exclude_guest.patch b/queue-6.6/perf-tools-add-fallback-for-exclude_guest.patch new file mode 100644 index 0000000000..83f0f39d79 --- /dev/null +++ b/queue-6.6/perf-tools-add-fallback-for-exclude_guest.patch @@ -0,0 +1,131 @@ +From 1c864d1857446825b387b61e4051dffe06eb12e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Oct 2024 23:23:51 -0700 +Subject: perf tools: Add fallback for exclude_guest + +From: Namhyung Kim + +[ Upstream commit bb6e7cb11d97ce1957894d30d13bfad3e8bfefe9 ] + +Commit 7b100989b4f6bce70 ("perf evlist: Remove __evlist__add_default") +changed to parse "cycles:P" event instead of creating a new cycles +event for perf record. But it also changed the way how modifiers are +handled so it doesn't set the exclude_guest bit by default. + +It seems Apple M1 PMU requires exclude_guest set and returns EOPNOTSUPP +if not. Let's add a fallback so that it can work with default events. + +Also update perf stat hybrid tests to handle possible u or H modifiers. + +Reviewed-by: Ian Rogers +Reviewed-by: James Clark +Reviewed-by: Ravi Bangoria +Acked-by: Kan Liang +Cc: James Clark +Cc: Atish Patra +Cc: Mingwei Zhang +Cc: Kajol Jain +Cc: Thomas Richter +Cc: Palmer Dabbelt +Link: https://lore.kernel.org/r/20241016062359.264929-2-namhyung@kernel.org +Fixes: 7b100989b4f6bce70 ("perf evlist: Remove __evlist__add_default") +Signed-off-by: Namhyung Kim +Stable-dep-of: 24937ee839e4 ("perf evsel: Ensure the fallback message is always written to") +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-stat.c | 18 +++++++++++++++--- + tools/perf/tests/shell/stat.sh | 2 +- + tools/perf/util/evsel.c | 21 +++++++++++++++++++++ + 3 files changed, 37 insertions(+), 4 deletions(-) + +diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c +index 9692ebdd7f11e..1512fedd90cf9 100644 +--- a/tools/perf/builtin-stat.c ++++ b/tools/perf/builtin-stat.c +@@ -638,8 +638,7 @@ static enum counter_recovery stat_handle_error(struct evsel *counter) + * (behavior changed with commit b0a873e). + */ + if (errno == EINVAL || errno == ENOSYS || +- errno == ENOENT || errno == EOPNOTSUPP || +- errno == ENXIO) { ++ errno == ENOENT || errno == ENXIO) { + if (verbose > 0) + ui__warning("%s event is not supported by the kernel.\n", + evsel__name(counter)); +@@ -657,7 +656,7 @@ static enum counter_recovery stat_handle_error(struct evsel *counter) + if (verbose > 0) + ui__warning("%s\n", msg); + return COUNTER_RETRY; +- } else if (target__has_per_thread(&target) && ++ } else if (target__has_per_thread(&target) && errno != EOPNOTSUPP && + evsel_list->core.threads && + evsel_list->core.threads->err_thread != -1) { + /* +@@ -678,6 +677,19 @@ static enum counter_recovery stat_handle_error(struct evsel *counter) + return COUNTER_SKIP; + } + ++ if (errno == EOPNOTSUPP) { ++ if (verbose > 0) { ++ ui__warning("%s event is not supported by the kernel.\n", ++ evsel__name(counter)); ++ } ++ counter->supported = false; ++ counter->errored = true; ++ ++ if ((evsel__leader(counter) != counter) || ++ !(counter->core.leader->nr_members > 1)) ++ return COUNTER_SKIP; ++ } ++ + evsel__open_strerror(counter, &target, errno, msg, sizeof(msg)); + ui__error("%s\n", msg); + +diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh +index c6df7eec96b98..c4bef71568970 100755 +--- a/tools/perf/tests/shell/stat.sh ++++ b/tools/perf/tests/shell/stat.sh +@@ -159,7 +159,7 @@ test_hybrid() { + fi + + # Run default Perf stat +- cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/| cycles " | wc -l) ++ cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/[uH]*| cycles[:uH]* " -c) + + if [ "$pmus" -ne "$cycles_events" ] + then +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index cdd13f576c191..c37faef63df99 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -2892,6 +2892,27 @@ bool evsel__fallback(struct evsel *evsel, int err, char *msg, size_t msgsize) + evsel->core.attr.exclude_kernel = 1; + evsel->core.attr.exclude_hv = 1; + ++ return true; ++ } else if (err == EOPNOTSUPP && !evsel->core.attr.exclude_guest && ++ !evsel->exclude_GH) { ++ const char *name = evsel__name(evsel); ++ char *new_name; ++ const char *sep = ":"; ++ ++ /* Is there already the separator in the name. */ ++ if (strchr(name, '/') || ++ (strchr(name, ':') && !evsel->is_libpfm_event)) ++ sep = ""; ++ ++ if (asprintf(&new_name, "%s%sH", name, sep) < 0) ++ return false; ++ ++ free(evsel->name); ++ evsel->name = new_name; ++ /* Apple M1 requires exclude_guest */ ++ scnprintf(msg, msgsize, "trying to fall back to excluding guest samples"); ++ evsel->core.attr.exclude_guest = 1; ++ + return true; + } + +-- +2.51.0 + diff --git a/queue-6.6/perf-util-fix-compression-checks-returning-1-as-bool.patch b/queue-6.6/perf-util-fix-compression-checks-returning-1-as-bool.patch new file mode 100644 index 0000000000..4a539a4b5a --- /dev/null +++ b/queue-6.6/perf-util-fix-compression-checks-returning-1-as-bool.patch @@ -0,0 +1,67 @@ +From 27eff733fe268b11c94867b2ee327ae680371a50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 16:25:08 +0000 +Subject: perf util: Fix compression checks returning -1 as bool + +From: Yunseong Kim + +[ Upstream commit 43fa1141e2c1af79c91aaa4df03e436c415a6fc3 ] + +The lzma_is_compressed and gzip_is_compressed functions are declared +to return a "bool" type, but in case of an error (e.g., file open +failure), they incorrectly returned -1. + +A bool type is a boolean value that is either true or false. +Returning -1 for a bool return type can lead to unexpected behavior +and may violate strict type-checking in some compilers. + +Fix the return value to be false in error cases, ensuring the function +adheres to its declared return type improves for preventing potential +bugs related to type mismatch. + +Fixes: 4b57fd44b61beb51 ("perf tools: Add lzma_is_compressed function") +Reviewed-by: Ian Rogers +Signed-off-by: Yunseong Kim +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Namhyung Kim +Cc: Stephen Brennan +Link: https://lore.kernel.org/r/20250822162506.316844-3-ysk@kzalloc.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/lzma.c | 2 +- + tools/perf/util/zlib.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/lzma.c b/tools/perf/util/lzma.c +index af9a97612f9df..f61574d1581e3 100644 +--- a/tools/perf/util/lzma.c ++++ b/tools/perf/util/lzma.c +@@ -113,7 +113,7 @@ bool lzma_is_compressed(const char *input) + ssize_t rc; + + if (fd < 0) +- return -1; ++ return false; + + rc = read(fd, buf, sizeof(buf)); + close(fd); +diff --git a/tools/perf/util/zlib.c b/tools/perf/util/zlib.c +index 78d2297c1b674..1f7c065230599 100644 +--- a/tools/perf/util/zlib.c ++++ b/tools/perf/util/zlib.c +@@ -88,7 +88,7 @@ bool gzip_is_compressed(const char *input) + ssize_t rc; + + if (fd < 0) +- return -1; ++ return false; + + rc = read(fd, buf, sizeof(buf)); + close(fd); +-- +2.51.0 + diff --git a/queue-6.6/rtc-optee-fix-memory-leak-on-driver-removal.patch b/queue-6.6/rtc-optee-fix-memory-leak-on-driver-removal.patch new file mode 100644 index 0000000000..3fc3a23580 --- /dev/null +++ b/queue-6.6/rtc-optee-fix-memory-leak-on-driver-removal.patch @@ -0,0 +1,40 @@ +From 5c82d0c1904b95e488c2c454cc4100f3c0c0bc15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Jul 2025 16:07:13 +0200 +Subject: rtc: optee: fix memory leak on driver removal +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Le Goffic + +[ Upstream commit a531350d2fe58f7fc4516e555f22391dee94efd9 ] + +Fix a memory leak in case of driver removal. +Free the shared memory used for arguments exchanges between kernel and +OP-TEE RTC PTA. + +Fixes: 81c2f059ab90 ("rtc: optee: add RTC driver for OP-TEE RTC PTA") +Signed-off-by: Clément Le Goffic +Link: https://lore.kernel.org/r/20250715-upstream-optee-rtc-v1-1-e0fdf8aae545@foss.st.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-optee.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/rtc/rtc-optee.c b/drivers/rtc/rtc-optee.c +index 9f8b5d4a8f6b6..6b77c122fdc10 100644 +--- a/drivers/rtc/rtc-optee.c ++++ b/drivers/rtc/rtc-optee.c +@@ -320,6 +320,7 @@ static int optee_rtc_remove(struct device *dev) + { + struct optee_rtc *priv = dev_get_drvdata(dev); + ++ tee_shm_free(priv->shm); + tee_client_close_session(priv->ctx, priv->session_id); + tee_client_close_context(priv->ctx); + +-- +2.51.0 + diff --git a/queue-6.6/rtc-x1205-fix-xicor-x1205-vendor-prefix.patch b/queue-6.6/rtc-x1205-fix-xicor-x1205-vendor-prefix.patch new file mode 100644 index 0000000000..82ea0da9fb --- /dev/null +++ b/queue-6.6/rtc-x1205-fix-xicor-x1205-vendor-prefix.patch @@ -0,0 +1,39 @@ +From 578c8c68044d09d27c54eaf9e47ee73dcabe7164 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 16:57:02 -0500 +Subject: rtc: x1205: Fix Xicor X1205 vendor prefix + +From: Rob Herring (Arm) + +[ Upstream commit 606d19ee37de3a72f1b6e95a4ea544f6f20dbb46 ] + +The vendor for the X1205 RTC is not Xircom, but Xicor which was acquired +by Intersil. Since the I2C subsystem drops the vendor prefix for driver +matching, the vendor prefix hasn't mattered. + +Fixes: 6875404fdb44 ("rtc: x1205: Add DT probing support") +Signed-off-by: Rob Herring (Arm) +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20250821215703.869628-2-robh@kernel.org +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-x1205.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-x1205.c b/drivers/rtc/rtc-x1205.c +index 807f953ae0aed..b7a7ea036f7ad 100644 +--- a/drivers/rtc/rtc-x1205.c ++++ b/drivers/rtc/rtc-x1205.c +@@ -669,7 +669,7 @@ static const struct i2c_device_id x1205_id[] = { + MODULE_DEVICE_TABLE(i2c, x1205_id); + + static const struct of_device_id x1205_dt_ids[] = { +- { .compatible = "xircom,x1205", }, ++ { .compatible = "xicor,x1205", }, + {}, + }; + MODULE_DEVICE_TABLE(of, x1205_dt_ids); +-- +2.51.0 + diff --git a/queue-6.6/s390-cio-update-purge-function-to-unregister-the-unu.patch b/queue-6.6/s390-cio-update-purge-function-to-unregister-the-unu.patch new file mode 100644 index 0000000000..aa245f7cfc --- /dev/null +++ b/queue-6.6/s390-cio-update-purge-function-to-unregister-the-unu.patch @@ -0,0 +1,96 @@ +From 71dcc2d598c665b5ed9024b2da55750049efac57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 15:38:17 +0200 +Subject: s390/cio: Update purge function to unregister the unused subchannels + +From: Vineeth Vijayan + +[ Upstream commit 9daa5a8795865f9a3c93d8d1066785b07ded6073 ] + +Starting with 'commit 2297791c92d0 ("s390/cio: dont unregister +subchannel from child-drivers")', cio no longer unregisters +subchannels when the attached device is invalid or unavailable. + +As an unintended side-effect, the cio_ignore purge function no longer +removes subchannels for devices on the cio_ignore list if no CCW device +is attached. This situation occurs when a CCW device is non-operational +or unavailable + +To ensure the same outcome of the purge function as when the +current cio_ignore list had been active during boot, update the purge +function to remove I/O subchannels without working CCW devices if the +associated device number is found on the cio_ignore list. + +Fixes: 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers") +Suggested-by: Peter Oberparleiter +Reviewed-by: Peter Oberparleiter +Signed-off-by: Vineeth Vijayan +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/device.c | 37 ++++++++++++++++++++++++------------- + 1 file changed, 24 insertions(+), 13 deletions(-) + +diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c +index 6b374026cd4f4..31f46b56e049d 100644 +--- a/drivers/s390/cio/device.c ++++ b/drivers/s390/cio/device.c +@@ -1318,23 +1318,34 @@ void ccw_device_schedule_recovery(void) + spin_unlock_irqrestore(&recovery_lock, flags); + } + +-static int purge_fn(struct device *dev, void *data) ++static int purge_fn(struct subchannel *sch, void *data) + { +- struct ccw_device *cdev = to_ccwdev(dev); +- struct ccw_dev_id *id = &cdev->private->dev_id; +- struct subchannel *sch = to_subchannel(cdev->dev.parent); ++ struct ccw_device *cdev; + +- spin_lock_irq(cdev->ccwlock); +- if (is_blacklisted(id->ssid, id->devno) && +- (cdev->private->state == DEV_STATE_OFFLINE) && +- (atomic_cmpxchg(&cdev->private->onoff, 0, 1) == 0)) { +- CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x\n", id->ssid, +- id->devno); ++ spin_lock_irq(&sch->lock); ++ if (sch->st != SUBCHANNEL_TYPE_IO || !sch->schib.pmcw.dnv) ++ goto unlock; ++ ++ if (!is_blacklisted(sch->schid.ssid, sch->schib.pmcw.dev)) ++ goto unlock; ++ ++ cdev = sch_get_cdev(sch); ++ if (cdev) { ++ if (cdev->private->state != DEV_STATE_OFFLINE) ++ goto unlock; ++ ++ if (atomic_cmpxchg(&cdev->private->onoff, 0, 1) != 0) ++ goto unlock; + ccw_device_sched_todo(cdev, CDEV_TODO_UNREG); +- css_sched_sch_todo(sch, SCH_TODO_UNREG); + atomic_set(&cdev->private->onoff, 0); + } +- spin_unlock_irq(cdev->ccwlock); ++ ++ css_sched_sch_todo(sch, SCH_TODO_UNREG); ++ CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x%s\n", sch->schid.ssid, ++ sch->schib.pmcw.dev, cdev ? "" : " (no cdev)"); ++ ++unlock: ++ spin_unlock_irq(&sch->lock); + /* Abort loop in case of pending signal. */ + if (signal_pending(current)) + return -EINTR; +@@ -1350,7 +1361,7 @@ static int purge_fn(struct device *dev, void *data) + int ccw_purge_blacklisted(void) + { + CIO_MSG_EVENT(2, "ccw: purging blacklisted devices\n"); +- bus_for_each_dev(&ccw_bus_type, NULL, NULL, purge_fn); ++ for_each_subchannel_staged(purge_fn, NULL, NULL); + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.6/scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch b/queue-6.6/scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch new file mode 100644 index 0000000000..912a7dabb2 --- /dev/null +++ b/queue-6.6/scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch @@ -0,0 +1,56 @@ +From a51d5d4e325c79b977e753e23d8dd0b0afb402c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Sep 2025 21:42:01 +0800 +Subject: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue + +From: Duoming Zhou + +[ Upstream commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 ] + +During the detaching of Marvell's SAS/SATA controller, the original code +calls cancel_delayed_work() in mvs_free() to cancel the delayed work +item mwq->work_q. However, if mwq->work_q is already running, the +cancel_delayed_work() may fail to cancel it. This can lead to +use-after-free scenarios where mvs_free() frees the mvs_info while +mvs_work_queue() is still executing and attempts to access the +already-freed mvs_info. + +A typical race condition is illustrated below: + +CPU 0 (remove) | CPU 1 (delayed work callback) +mvs_pci_remove() | + mvs_free() | mvs_work_queue() + cancel_delayed_work() | + kfree(mvi) | + | mvi-> // UAF + +Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure +that the delayed work item is properly canceled and any executing +delayed work item completes before the mvs_info is deallocated. + +This bug was found by static analysis. + +Fixes: 20b09c2992fe ("[SCSI] mvsas: add support for 94xx; layout change; bug fixes") +Signed-off-by: Duoming Zhou +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mvsas/mv_init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c +index 43ebb331e2167..47c4434dc7e79 100644 +--- a/drivers/scsi/mvsas/mv_init.c ++++ b/drivers/scsi/mvsas/mv_init.c +@@ -139,7 +139,7 @@ static void mvs_free(struct mvs_info *mvi) + if (mvi->shost) + scsi_host_put(mvi->shost); + list_for_each_entry(mwq, &mvi->wq_list, entry) +- cancel_delayed_work(&mwq->work_q); ++ cancel_delayed_work_sync(&mwq->work_q); + kfree(mvi->rsvd_tags); + kfree(mvi); + } +-- +2.51.0 + diff --git a/queue-6.6/series b/queue-6.6/series index bdbd8be7be..a847112bb4 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -5,3 +5,54 @@ kvm-svm-emulate-perf_cntr_global_status_set-for-perfmonv2.patch iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch media-v4l2-subdev-fix-alloc-failure-check-in-v4l2_subdev_call_state_try.patch asm-generic-io.h-skip-trace-helpers-if-rwmmio-events-are-disabled.patch +perf-evsel-avoid-container_of-on-a-null-leader.patch +libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch +clk-at91-peripheral-fix-return-value.patch +perf-util-fix-compression-checks-returning-1-as-bool.patch +rtc-x1205-fix-xicor-x1205-vendor-prefix.patch +rtc-optee-fix-memory-leak-on-driver-removal.patch +perf-arm_spe-correct-setting-remote-access.patch +perf-arm-spe-rename-the-common-data-source-encoding.patch +perf-arm_spe-correct-memory-level-for-remote-access.patch +perf-session-fix-handling-when-buffer-exceeds-2-gib.patch +perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch +perf-test-add-a-test-for-default-perf-stat-command.patch +perf-tools-add-fallback-for-exclude_guest.patch +perf-evsel-ensure-the-fallback-message-is-always-wri.patch +clk-mediatek-mt8195-infra_ao-fix-parent-for-infra_ao.patch +clk-mediatek-clk-mux-do-not-pass-flags-to-clk_mux_de.patch +clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch +clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch +clk-tegra-do-not-overallocate-memory-for-bpmp-clocks.patch +cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch +scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch +asoc-sof-ipc4-topology-correct-the-minimum-host-dma-.patch +loongarch-remove-config_acpi_table_upgrade-in-platfo.patch +loongarch-init-acpi_gbl_use_global_lock-to-false.patch +net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch +s390-cio-update-purge-function-to-unregister-the-unu.patch +drm-vmwgfx-fix-a-null-ptr-access-in-the-cursor-snoop.patch +drm-vmwgfx-fix-use-after-free-in-validation.patch +drm-vmwgfx-fix-copy-paste-typo-in-validation.patch +net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch +tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch +net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch +tools-build-align-warning-options-with-perf.patch +perf-python-split-clang-options-when-invoking-popen.patch +tcp-take-care-of-zero-tp-window_clamp-in-tcp_set_rcv.patch +mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch +mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch +bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch +drm-amdgpu-add-additional-dce6-scl-registers.patch +drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch +drm-amd-display-properly-clear-scl_-_filter_control-.patch +drm-amd-display-properly-disable-scaling-on-dce6.patch +netfilter-nf_tables-drop-unused-3rd-argument-from-va.patch +netfilter-nft_objref-validate-objref-and-objrefmap-e.patch +bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch +crypto-essiv-check-ssize-for-decryption-and-in-place.patch +smb-client-fix-missing-timestamp-updates-after-utime.patch +cifs-query-ea-lxmod-in-cifs_query_path_info-for-wsl-.patch +tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch +gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch +bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch diff --git a/queue-6.6/smb-client-fix-missing-timestamp-updates-after-utime.patch b/queue-6.6/smb-client-fix-missing-timestamp-updates-after-utime.patch new file mode 100644 index 0000000000..c861728cb9 --- /dev/null +++ b/queue-6.6/smb-client-fix-missing-timestamp-updates-after-utime.patch @@ -0,0 +1,108 @@ +From 2b027885d634356c37ea0e153d35596568b51235 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 16:23:24 -0300 +Subject: smb: client: fix missing timestamp updates after utime(2) + +From: Paulo Alcantara + +[ Upstream commit b95cd1bdf5aa9221c98fc9259014b8bb8d1829d7 ] + +Don't reuse open handle when changing timestamps to prevent the server +from disabling automatic timestamp updates as per MS-FSA 2.1.4.17. + +---8<--- +import os +import time + +filename = '/mnt/foo' + +def print_stat(prefix): + st = os.stat(filename) + print(prefix, ': ', time.ctime(st.st_atime), time.ctime(st.st_ctime)) + +fd = os.open(filename, os.O_CREAT|os.O_TRUNC|os.O_WRONLY, 0o644) +print_stat('old') +os.utime(fd, None) +time.sleep(2) +os.write(fd, b'foo') +os.close(fd) +time.sleep(2) +print_stat('new') +---8<--- + +Before patch: + +$ mount.cifs //srv/share /mnt -o ... +$ python3 run.py +old : Fri Oct 3 14:01:21 2025 Fri Oct 3 14:01:21 2025 +new : Fri Oct 3 14:01:21 2025 Fri Oct 3 14:01:21 2025 + +After patch: + +$ mount.cifs //srv/share /mnt -o ... +$ python3 run.py +old : Fri Oct 3 17:03:34 2025 Fri Oct 3 17:03:34 2025 +new : Fri Oct 3 17:03:36 2025 Fri Oct 3 17:03:36 2025 + +Fixes: b6f2a0f89d7e ("cifs: for compound requests, use open handle if possible") +Signed-off-by: Paulo Alcantara (Red Hat) +Cc: Frank Sorenson +Reviewed-by: David Howells +Cc: linux-cifs@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2inode.c | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c +index 79641d1ee8675..232a3c2890556 100644 +--- a/fs/smb/client/smb2inode.c ++++ b/fs/smb/client/smb2inode.c +@@ -1216,31 +1216,33 @@ int + smb2_set_file_info(struct inode *inode, const char *full_path, + FILE_BASIC_INFO *buf, const unsigned int xid) + { +- struct cifs_open_parms oparms; ++ struct kvec in_iov = { .iov_base = buf, .iov_len = sizeof(*buf), }; + struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb); ++ struct cifsFileInfo *cfile = NULL; ++ struct cifs_open_parms oparms; + struct tcon_link *tlink; + struct cifs_tcon *tcon; +- struct cifsFileInfo *cfile; +- struct kvec in_iov = { .iov_base = buf, .iov_len = sizeof(*buf), }; +- int rc; +- +- if ((buf->CreationTime == 0) && (buf->LastAccessTime == 0) && +- (buf->LastWriteTime == 0) && (buf->ChangeTime == 0) && +- (buf->Attributes == 0)) +- return 0; /* would be a no op, no sense sending this */ ++ int rc = 0; + + tlink = cifs_sb_tlink(cifs_sb); + if (IS_ERR(tlink)) + return PTR_ERR(tlink); + tcon = tlink_tcon(tlink); + +- cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile); ++ if ((buf->CreationTime == 0) && (buf->LastAccessTime == 0) && ++ (buf->LastWriteTime == 0) && (buf->ChangeTime == 0)) { ++ if (buf->Attributes == 0) ++ goto out; /* would be a no op, no sense sending this */ ++ cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile); ++ } ++ + oparms = CIFS_OPARMS(cifs_sb, tcon, full_path, FILE_WRITE_ATTRIBUTES, + FILE_OPEN, 0, ACL_NO_MODE); + rc = smb2_compound_op(xid, tcon, cifs_sb, + full_path, &oparms, &in_iov, + &(int){SMB2_OP_SET_INFO}, 1, + cfile, NULL, NULL, NULL); ++out: + cifs_put_tlink(tlink); + return rc; + } +-- +2.51.0 + diff --git a/queue-6.6/tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch b/queue-6.6/tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch new file mode 100644 index 0000000000..edea604d5d --- /dev/null +++ b/queue-6.6/tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch @@ -0,0 +1,87 @@ +From 505887d35ecafeac1f1818a78a5ef98d8aa39ef3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 23:37:54 +0000 +Subject: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). + +From: Kuniyuki Iwashima + +[ Upstream commit 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c ] + +syzbot reported the splat below in tcp_conn_request(). [0] + +If a listener is close()d while a TFO socket is being processed in +tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk +and calls inet_child_forget(), which calls tcp_disconnect() for the +TFO socket. + +After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), +where reqsk_put() is called due to !reqsk->sk. + +Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the +last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the +drop_and_free label causes the refcount underflow for the listener +and double-free of the reqsk. + +Let's remove reqsk_fastopen_remove() in tcp_conn_request(). + +Note that other callers make sure tp->fastopen_rsk is not NULL. + +[0]: +refcount_t: underflow; use-after-free. +WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) +Modules linked in: +CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 +RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) +Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 +RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 +RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 +RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280 +RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 +R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 +R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8 +FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0 +Call Trace: + + tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) + tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) + tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) + tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) + ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) + ip6_input (net/ipv6/ip6_input.c:500) + ipv6_rcv (net/ipv6/ip6_input.c:311) + __netif_receive_skb (net/core/dev.c:6104) + process_backlog (net/core/dev.c:6456) + __napi_poll (net/core/dev.c:7506) + net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) + handle_softirqs (kernel/softirq.c:579) + do_softirq (kernel/softirq.c:480) + + +Fixes: 45c8a6cc2bcd ("tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().") +Reported-by: syzkaller +Signed-off-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20251001233755.1340927-1-kuniyu@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index c6d00817ad3fd..8834cd41b3840 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -7200,7 +7200,6 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, + &foc, TCP_SYNACK_FASTOPEN, skb); + /* Add the child socket directly into the accept queue */ + if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) { +- reqsk_fastopen_remove(fastopen_sk, req, false); + bh_unlock_sock(fastopen_sk); + sock_put(fastopen_sk); + goto drop_and_free; +-- +2.51.0 + diff --git a/queue-6.6/tcp-take-care-of-zero-tp-window_clamp-in-tcp_set_rcv.patch b/queue-6.6/tcp-take-care-of-zero-tp-window_clamp-in-tcp_set_rcv.patch new file mode 100644 index 0000000000..087fa3cc24 --- /dev/null +++ b/queue-6.6/tcp-take-care-of-zero-tp-window_clamp-in-tcp_set_rcv.patch @@ -0,0 +1,64 @@ +From fd934eb77932988d473ba21792b54f9b3ac115e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 18:41:19 +0000 +Subject: tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() + +From: Eric Dumazet + +[ Upstream commit 21b29e74ffe5a6c851c235bb80bf5ee26292c67b ] + +Some applications (like selftests/net/tcp_mmap.c) call SO_RCVLOWAT +on their listener, before accept(). + +This has an unfortunate effect on wscale selection in +tcp_select_initial_window() during 3WHS. + +For instance, tcp_mmap was negotiating wscale 4, regardless +of tcp_rmem[2] and sysctl_rmem_max. + +Do not change tp->window_clamp if it is zero +or bigger than our computed value. + +Zero value is special, it allows tcp_select_initial_window() +to enable autotuning. + +Note that SO_RCVLOWAT use on listener is probably not wise, +because tp->scaling_ratio has a default value, possibly wrong. + +Fixes: d1361840f8c5 ("tcp: fix SO_RCVLOWAT and RCVBUF autotuning") +Signed-off-by: Eric Dumazet +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Neal Cardwell +Link: https://patch.msgid.link/20251003184119.2526655-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 7d824578f217a..5dde0aed31440 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -1724,6 +1724,7 @@ EXPORT_SYMBOL(tcp_peek_len); + /* Make sure sk_rcvbuf is big enough to satisfy SO_RCVLOWAT hint */ + int tcp_set_rcvlowat(struct sock *sk, int val) + { ++ struct tcp_sock *tp = tcp_sk(sk); + int space, cap; + + if (sk->sk_userlocks & SOCK_RCVBUF_LOCK) +@@ -1742,7 +1743,9 @@ int tcp_set_rcvlowat(struct sock *sk, int val) + space = tcp_space_from_win(sk, val); + if (space > sk->sk_rcvbuf) { + WRITE_ONCE(sk->sk_rcvbuf, space); +- WRITE_ONCE(tcp_sk(sk)->window_clamp, val); ++ ++ if (tp->window_clamp && tp->window_clamp < val) ++ WRITE_ONCE(tp->window_clamp, val); + } + return 0; + } +-- +2.51.0 + diff --git a/queue-6.6/tools-build-align-warning-options-with-perf.patch b/queue-6.6/tools-build-align-warning-options-with-perf.patch new file mode 100644 index 0000000000..13c031fd75 --- /dev/null +++ b/queue-6.6/tools-build-align-warning-options-with-perf.patch @@ -0,0 +1,62 @@ +From 542b44d79f37ca8281686cf6d598417b0708418e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Oct 2025 17:21:23 +0100 +Subject: tools build: Align warning options with perf + +From: Leo Yan + +[ Upstream commit 53d067feb8c4f16d1f24ce3f4df4450bb18c555f ] + +The feature test programs are built without enabling '-Wall -Werror' +options. As a result, a feature may appear to be available, but later +building in perf can fail with stricter checks. + +Make the feature test program use the same warning options as perf. + +Fixes: 1925459b4d92 ("tools build: Fix feature Makefile issues with 'O='") +Signed-off-by: Leo Yan +Reviewed-by: Ian Rogers +Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-1-4305590795b2@arm.com +Cc: Palmer Dabbelt +Cc: Albert Ou +Cc: Alexandre Ghiti +Cc: Nick Desaulniers +Cc: Justin Stitt +Cc: Bill Wendling +Cc: Adrian Hunter +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Nathan Chancellor +Cc: James Clark +Cc: linux-riscv@lists.infradead.org +Cc: llvm@lists.linux.dev +Cc: Paul Walmsley +Cc: linux-kernel@vger.kernel.org +Cc: linux-perf-users@vger.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/build/feature/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile +index 4f869fff28fe4..17e03236e3461 100644 +--- a/tools/build/feature/Makefile ++++ b/tools/build/feature/Makefile +@@ -306,10 +306,10 @@ $(OUTPUT)test-libbabeltrace.bin: + $(BUILD) # -lbabeltrace provided by $(FEATURE_CHECK_LDFLAGS-libbabeltrace) + + $(OUTPUT)test-compile-32.bin: +- $(CC) -m32 -o $@ test-compile.c ++ $(CC) -m32 -Wall -Werror -o $@ test-compile.c + + $(OUTPUT)test-compile-x32.bin: +- $(CC) -mx32 -o $@ test-compile.c ++ $(CC) -mx32 -Wall -Werror -o $@ test-compile.c + + $(OUTPUT)test-zlib.bin: + $(BUILD) -lz +-- +2.51.0 + diff --git a/queue-6.6/tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch b/queue-6.6/tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch new file mode 100644 index 0000000000..72eacee3aa --- /dev/null +++ b/queue-6.6/tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch @@ -0,0 +1,42 @@ +From cabb605c1d9875dcb4b944854b0b7491333b3b7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 18:49:40 +0300 +Subject: tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single + +From: Gunnar Kudrjavets + +[ Upstream commit 8a81236f2cb0882c7ea6c621ce357f7f3f601fe5 ] + +The tpm_tis_write8() call specifies arguments in wrong order. Should be +(data, addr, value) not (data, value, addr). The initial correct order +was changed during the major refactoring when the code was split. + +Fixes: 41a5e1cf1fe1 ("tpm/tpm_tis: Split tpm_tis driver into a core and TCG TIS compliant phy") +Signed-off-by: Gunnar Kudrjavets +Reviewed-by: Justinien Bouron +Reviewed-by: Jarkko Sakkinen +Reviewed-by: Paul Menzel +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index c71e61ccb95a2..5e6ee5b82b8ff 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -977,8 +977,8 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, + * will call disable_irq which undoes all of the above. + */ + if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) { +- tpm_tis_write8(priv, original_int_vec, +- TPM_INT_VECTOR(priv->locality)); ++ tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), ++ original_int_vec); + rc = -1; + } + +-- +2.51.0 +