From 2e3c941f56aee639cc986200a054f9699799029b Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Thu, 6 Nov 2025 09:32:04 -0500 Subject: [PATCH] Fixes for all trees Signed-off-by: Sasha Levin --- ...-sys-fs-9p-caches-overwriting-itself.patch | 41 +++ ..._init-don-t-hardcode-error-to-enomem.patch | 46 ++++ ...turn-present-device-nodes-only-on-fw.patch | 75 ++++++ ...-and-restore-acr-during-pll-disable-.patch | 59 +++++ ...u-encoder-i2s-fix-bit-clock-polarity.patch | 53 ++++ ...g-of-wait_for_completion_killable-re.patch | 50 ++++ ...-checking-in-bit_putcs-to-fix-vmallo.patch | 69 +++++ ...r-code-for-new_inode-failure-in-mkdi.patch | 97 +++++++ queue-5.10/series | 10 + ...-missing-asm-generic-bitsperlong.h-i.patch | 66 +++++ .../um-fix-help-message-for-ssl-non-raw.patch | 36 +++ ...-sys-fs-9p-caches-overwriting-itself.patch | 41 +++ ..._init-don-t-hardcode-error-to-enomem.patch | 46 ++++ ...turn-present-device-nodes-only-on-fw.patch | 75 ++++++ ...-and-restore-acr-during-pll-disable-.patch | 59 +++++ ...u-encoder-i2s-fix-bit-clock-polarity.patch | 53 ++++ ...g-of-wait_for_completion_killable-re.patch | 50 ++++ ...clk-master-add-check-for-divide-by-3.patch | 38 +++ ...xx-keep-wkup_debugss_clkctrl-enabled.patch | 44 ++++ ...-initialize-all-cores-to-max-frequen.patch | 102 ++++++++ ...-checking-in-bit_putcs-to-fix-vmallo.patch | 69 +++++ ...r-code-for-new_inode-failure-in-mkdi.patch | 97 +++++++ ...cf2127-clear-minute-second-interrupt.patch | 70 +++++ queue-5.15/series | 14 + ...-missing-asm-generic-bitsperlong.h-i.patch | 66 +++++ .../um-fix-help-message-for-ssl-non-raw.patch | 36 +++ ...-sys-fs-9p-caches-overwriting-itself.patch | 41 +++ ..._init-don-t-hardcode-error-to-enomem.patch | 46 ++++ ...turn-present-device-nodes-only-on-fw.patch | 75 ++++++ ...g-of-wait_for_completion_killable-re.patch | 50 ++++ ...-checking-in-bit_putcs-to-fix-vmallo.patch | 69 +++++ ...r-code-for-new_inode-failure-in-mkdi.patch | 97 +++++++ queue-5.4/series | 7 + ...-missing-asm-generic-bitsperlong.h-i.patch | 66 +++++ ...-sys-fs-9p-caches-overwriting-itself.patch | 41 +++ ..._init-don-t-hardcode-error-to-enomem.patch | 46 ++++ ...turn-present-device-nodes-only-on-fw.patch | 75 ++++++ ...-and-restore-acr-during-pll-disable-.patch | 59 +++++ ...u-encoder-i2s-fix-bit-clock-polarity.patch | 53 ++++ ...g-of-wait_for_completion_killable-re.patch | 50 ++++ ...clk-master-add-check-for-divide-by-3.patch | 38 +++ ...9x60-pll-force-write-to-pll_updt-reg.patch | 214 +++++++++++++++ ...unxi-ng-sun6i-rtc-add-a523-specifics.patch | 57 ++++ ...xx-keep-wkup_debugss_clkctrl-enabled.patch | 44 ++++ ...-initialize-all-cores-to-max-frequen.patch | 102 ++++++++ ...-checking-in-bit_putcs-to-fix-vmallo.patch | 69 +++++ ...r-code-for-new_inode-failure-in-mkdi.patch | 97 +++++++ ...trip-comments-before-size-type-check.patch | 52 ++++ .../ntb-epf-allow-arbitrary-bar-mapping.patch | 246 ++++++++++++++++++ ...cf2127-clear-minute-second-interrupt.patch | 70 +++++ ...nclude-utp-error-in-int_fatal_errors.patch | 77 ++++++ queue-6.1/series | 21 ++ ...-missing-asm-generic-bitsperlong.h-i.patch | 66 +++++ ...rmal-don-t-preserve-owner-in-install.patch | 41 +++ ...rmal-use-pkg-config-to-locate-libnl3.patch | 49 ++++ .../um-fix-help-message-for-ssl-non-raw.patch | 36 +++ ...-sys-fs-9p-caches-overwriting-itself.patch | 41 +++ ..._init-don-t-hardcode-error-to-enomem.patch | 46 ++++ ...fd_request-kick-rx-thread-if-epollin.patch | 69 +++++ ...turn-present-device-nodes-only-on-fw.patch | 75 ++++++ ...-and-restore-acr-during-pll-disable-.patch | 59 +++++ ...u-encoder-i2s-fix-bit-clock-polarity.patch | 53 ++++ ...g-of-wait_for_completion_killable-re.patch | 50 ++++ ...ceph-fix-multifs-mds-auth-caps-issue.patch | 175 +++++++++++++ ...al-race-condition-in-ceph_ioctl_lazy.patch | 79 ++++++ ...actor-wake_up_bit-pattern-of-calling.patch | 78 ++++++ ...clk-master-add-check-for-divide-by-3.patch | 38 +++ ...9x60-pll-force-write-to-pll_updt-reg.patch | 214 +++++++++++++++ ...x7-add-peripheral-clock-id-for-pmecc.patch | 36 +++ ...ard-fix-output-clock-register-offset.patch | 40 +++ ...6018-rework-nss_port5-clock-to-multi.patch | 140 ++++++++++ ...y-cycle-ops-only-when-duty-cycle-is-.patch | 53 ++++ ...unxi-ng-sun6i-rtc-add-a523-specifics.patch | 57 ++++ ...xx-keep-wkup_debugss_clkctrl-enabled.patch | 44 ++++ ...-initialize-all-cores-to-max-frequen.patch | 102 ++++++++ ...dkfd-fix-mmap-write-lock-not-release.patch | 41 +++ ...-checking-in-bit_putcs-to-fix-vmallo.patch | 69 +++++ ...r-code-for-new_inode-failure-in-mkdi.patch | 97 +++++++ ...trip-comments-before-size-type-check.patch | 52 ++++ ...e-new-atomic-instructions-for-probes.patch | 79 ++++++ ...wan-t7xx-add-support-for-hp-drmr-h01.patch | 34 +++ .../ntb-epf-allow-arbitrary-bar-mapping.patch | 246 ++++++++++++++++++ ...cf2127-clear-minute-second-interrupt.patch | 70 +++++ ...x-watchdog-interrupt-mask-on-pcf2131.patch | 50 ++++ ...nclude-utp-error-in-int_fatal_errors.patch | 77 ++++++ queue-6.12/series | 36 +++ ...-missing-asm-generic-bitsperlong.h-i.patch | 66 +++++ ...rmal-don-t-preserve-owner-in-install.patch | 41 +++ ...rmal-use-pkg-config-to-locate-libnl3.patch | 49 ++++ .../um-fix-help-message-for-ssl-non-raw.patch | 36 +++ ...t-add-the-runtime_const_ptr-assembly.patch | 80 ++++++ ...t-use-runtime-const-rewriting-in-mod.patch | 128 +++++++++ ...86-use-cmov-for-user-address-masking.patch | 87 +++++++ ...-sys-fs-9p-caches-overwriting-itself.patch | 41 +++ ..._init-don-t-hardcode-error-to-enomem.patch | 46 ++++ ...fd_request-kick-rx-thread-if-epollin.patch | 69 +++++ ...turn-present-device-nodes-only-on-fw.patch | 75 ++++++ ...-add-quirk-for-asus-rog-zephyrus-duo.patch | 63 +++++ ...-and-restore-acr-during-pll-disable-.patch | 59 +++++ ...u-encoder-i2s-fix-bit-clock-polarity.patch | 53 ++++ .../asoc-rt722-add-settings-for-rt722vb.patch | 114 ++++++++ ...g-of-wait_for_completion_killable-re.patch | 50 ++++ ...ceph-fix-multifs-mds-auth-caps-issue.patch | 175 +++++++++++++ ...al-race-condition-in-ceph_ioctl_lazy.patch | 79 ++++++ ...actor-wake_up_bit-pattern-of-calling.patch | 78 ++++++ ...clk-at91-add-acr-in-all-pll-settings.patch | 160 ++++++++++++ ...clk-master-add-check-for-divide-by-3.patch | 38 +++ ...9x60-pll-force-write-to-pll_updt-reg.patch | 214 +++++++++++++++ ...x7-add-peripheral-clock-id-for-pmecc.patch | 36 +++ ...ard-fix-output-clock-register-offset.patch | 40 +++ ...6018-rework-nss_port5-clock-to-multi.patch | 140 ++++++++++ ...h-re-assert-reset-on-deassert-timeou.patch | 57 ++++ ...os990-add-missing-usb-clock-register.patch | 36 +++ ...y-cycle-ops-only-when-duty-cycle-is-.patch | 53 ++++ ...unxi-ng-sun6i-rtc-add-a523-specifics.patch | 57 ++++ ...-ap-set-all-axi-clocks-to-clk_is_cri.patch | 165 ++++++++++++ ...xx-keep-wkup_debugss_clkctrl-enabled.patch | 44 ++++ ...r-v-skip-unnecessary-checks-for-the-.patch | 88 +++++++ ...-initialize-all-cores-to-max-frequen.patch | 102 ++++++++ ...amdgpu-report-individual-reset-error.patch | 82 ++++++ ...dkfd-fix-mmap-write-lock-not-release.patch | 41 +++ ...-checking-in-bit_putcs-to-fix-vmallo.patch | 69 +++++ ...re-fix-ubsan-warning-in-pixel_to_pat.patch | 37 +++ ...r-code-for-new_inode-failure-in-mkdi.patch | 97 +++++++ ...ng-field-to-hv_output_map_device_int.patch | 36 +++ ...trip-comments-before-size-type-check.patch | 52 ++++ ...e-new-atomic-instructions-for-probes.patch | 79 ++++++ ...wan-t7xx-add-support-for-hp-drmr-h01.patch | 34 +++ .../ntb-epf-allow-arbitrary-bar-mapping.patch | 246 ++++++++++++++++++ ...cf2127-clear-minute-second-interrupt.patch | 70 +++++ ...x-watchdog-interrupt-mask-on-pcf2131.patch | 50 ++++ ...re-alarm-functionality-after-kexec-t.patch | 79 ++++++ ...nclude-utp-error-in-int_fatal_errors.patch | 77 ++++++ queue-6.17/series | 45 ++++ ...-missing-asm-generic-bitsperlong.h-i.patch | 66 +++++ ...rmal-don-t-preserve-owner-in-install.patch | 41 +++ ...rmal-use-pkg-config-to-locate-libnl3.patch | 49 ++++ .../um-fix-help-message-for-ssl-non-raw.patch | 36 +++ ...t-use-runtime-const-rewriting-in-mod.patch | 128 +++++++++ ...-sys-fs-9p-caches-overwriting-itself.patch | 41 +++ ..._init-don-t-hardcode-error-to-enomem.patch | 46 ++++ ...turn-present-device-nodes-only-on-fw.patch | 75 ++++++ ...-and-restore-acr-during-pll-disable-.patch | 59 +++++ ...u-encoder-i2s-fix-bit-clock-polarity.patch | 53 ++++ ...g-of-wait_for_completion_killable-re.patch | 50 ++++ ...actor-wake_up_bit-pattern-of-calling.patch | 78 ++++++ ...clk-master-add-check-for-divide-by-3.patch | 38 +++ ...9x60-pll-force-write-to-pll_updt-reg.patch | 214 +++++++++++++++ ...unxi-ng-sun6i-rtc-add-a523-specifics.patch | 57 ++++ ...xx-keep-wkup_debugss_clkctrl-enabled.patch | 44 ++++ ...-initialize-all-cores-to-max-frequen.patch | 102 ++++++++ ...-checking-in-bit_putcs-to-fix-vmallo.patch | 69 +++++ ...r-code-for-new_inode-failure-in-mkdi.patch | 97 +++++++ ...trip-comments-before-size-type-check.patch | 52 ++++ .../ntb-epf-allow-arbitrary-bar-mapping.patch | 246 ++++++++++++++++++ ...cf2127-clear-minute-second-interrupt.patch | 70 +++++ ...x-watchdog-interrupt-mask-on-pcf2131.patch | 50 ++++ ...nclude-utp-error-in-int_fatal_errors.patch | 77 ++++++ queue-6.6/series | 23 ++ ...-missing-asm-generic-bitsperlong.h-i.patch | 66 +++++ ...rmal-don-t-preserve-owner-in-install.patch | 41 +++ ...rmal-use-pkg-config-to-locate-libnl3.patch | 49 ++++ .../um-fix-help-message-for-ssl-non-raw.patch | 36 +++ 163 files changed, 11582 insertions(+) create mode 100644 queue-5.10/9p-fix-sys-fs-9p-caches-overwriting-itself.patch create mode 100644 queue-5.10/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch create mode 100644 queue-5.10/acpi-property-return-present-device-nodes-only-on-fw.patch create mode 100644 queue-5.10/arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch create mode 100644 queue-5.10/asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch create mode 100644 queue-5.10/ceph-add-checking-of-wait_for_completion_killable-re.patch create mode 100644 queue-5.10/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch create mode 100644 queue-5.10/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch create mode 100644 queue-5.10/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch create mode 100644 queue-5.10/um-fix-help-message-for-ssl-non-raw.patch create mode 100644 queue-5.15/9p-fix-sys-fs-9p-caches-overwriting-itself.patch create mode 100644 queue-5.15/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch create mode 100644 queue-5.15/acpi-property-return-present-device-nodes-only-on-fw.patch create mode 100644 queue-5.15/arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch create mode 100644 queue-5.15/asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch create mode 100644 queue-5.15/ceph-add-checking-of-wait_for_completion_killable-re.patch create mode 100644 queue-5.15/clk-at91-clk-master-add-check-for-divide-by-3.patch create mode 100644 queue-5.15/clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch create mode 100644 queue-5.15/cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch create mode 100644 queue-5.15/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch create mode 100644 queue-5.15/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch create mode 100644 queue-5.15/rtc-pcf2127-clear-minute-second-interrupt.patch create mode 100644 queue-5.15/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch create mode 100644 queue-5.15/um-fix-help-message-for-ssl-non-raw.patch create mode 100644 queue-5.4/9p-fix-sys-fs-9p-caches-overwriting-itself.patch create mode 100644 queue-5.4/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch create mode 100644 queue-5.4/acpi-property-return-present-device-nodes-only-on-fw.patch create mode 100644 queue-5.4/ceph-add-checking-of-wait_for_completion_killable-re.patch create mode 100644 queue-5.4/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch create mode 100644 queue-5.4/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch create mode 100644 queue-5.4/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch create mode 100644 queue-6.1/9p-fix-sys-fs-9p-caches-overwriting-itself.patch create mode 100644 queue-6.1/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch create mode 100644 queue-6.1/acpi-property-return-present-device-nodes-only-on-fw.patch create mode 100644 queue-6.1/arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch create mode 100644 queue-6.1/asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch create mode 100644 queue-6.1/ceph-add-checking-of-wait_for_completion_killable-re.patch create mode 100644 queue-6.1/clk-at91-clk-master-add-check-for-divide-by-3.patch create mode 100644 queue-6.1/clk-at91-clk-sam9x60-pll-force-write-to-pll_updt-reg.patch create mode 100644 queue-6.1/clk-sunxi-ng-sun6i-rtc-add-a523-specifics.patch create mode 100644 queue-6.1/clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch create mode 100644 queue-6.1/cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch create mode 100644 queue-6.1/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch create mode 100644 queue-6.1/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch create mode 100644 queue-6.1/kbuild-uapi-strip-comments-before-size-type-check.patch create mode 100644 queue-6.1/ntb-epf-allow-arbitrary-bar-mapping.patch create mode 100644 queue-6.1/rtc-pcf2127-clear-minute-second-interrupt.patch create mode 100644 queue-6.1/scsi-ufs-core-include-utp-error-in-int_fatal_errors.patch create mode 100644 queue-6.1/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch create mode 100644 queue-6.1/tools-lib-thermal-don-t-preserve-owner-in-install.patch create mode 100644 queue-6.1/tools-lib-thermal-use-pkg-config-to-locate-libnl3.patch create mode 100644 queue-6.1/um-fix-help-message-for-ssl-non-raw.patch create mode 100644 queue-6.12/9p-fix-sys-fs-9p-caches-overwriting-itself.patch create mode 100644 queue-6.12/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch create mode 100644 queue-6.12/9p-trans_fd-p9_fd_request-kick-rx-thread-if-epollin.patch create mode 100644 queue-6.12/acpi-property-return-present-device-nodes-only-on-fw.patch create mode 100644 queue-6.12/arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch create mode 100644 queue-6.12/asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch create mode 100644 queue-6.12/ceph-add-checking-of-wait_for_completion_killable-re.patch create mode 100644 queue-6.12/ceph-fix-multifs-mds-auth-caps-issue.patch create mode 100644 queue-6.12/ceph-fix-potential-race-condition-in-ceph_ioctl_lazy.patch create mode 100644 queue-6.12/ceph-refactor-wake_up_bit-pattern-of-calling.patch create mode 100644 queue-6.12/clk-at91-clk-master-add-check-for-divide-by-3.patch create mode 100644 queue-6.12/clk-at91-clk-sam9x60-pll-force-write-to-pll_updt-reg.patch create mode 100644 queue-6.12/clk-at91-sam9x7-add-peripheral-clock-id-for-pmecc.patch create mode 100644 queue-6.12/clk-clocking-wizard-fix-output-clock-register-offset.patch create mode 100644 queue-6.12/clk-qcom-gcc-ipq6018-rework-nss_port5-clock-to-multi.patch create mode 100644 queue-6.12/clk-scmi-add-duty-cycle-ops-only-when-duty-cycle-is-.patch create mode 100644 queue-6.12/clk-sunxi-ng-sun6i-rtc-add-a523-specifics.patch create mode 100644 queue-6.12/clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch create mode 100644 queue-6.12/cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch create mode 100644 queue-6.12/drm-amdkfd-fix-mmap-write-lock-not-release.patch create mode 100644 queue-6.12/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch create mode 100644 queue-6.12/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch create mode 100644 queue-6.12/kbuild-uapi-strip-comments-before-size-type-check.patch create mode 100644 queue-6.12/loongarch-handle-new-atomic-instructions-for-probes.patch create mode 100644 queue-6.12/net-wwan-t7xx-add-support-for-hp-drmr-h01.patch create mode 100644 queue-6.12/ntb-epf-allow-arbitrary-bar-mapping.patch create mode 100644 queue-6.12/rtc-pcf2127-clear-minute-second-interrupt.patch create mode 100644 queue-6.12/rtc-pcf2127-fix-watchdog-interrupt-mask-on-pcf2131.patch create mode 100644 queue-6.12/scsi-ufs-core-include-utp-error-in-int_fatal_errors.patch create mode 100644 queue-6.12/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch create mode 100644 queue-6.12/tools-lib-thermal-don-t-preserve-owner-in-install.patch create mode 100644 queue-6.12/tools-lib-thermal-use-pkg-config-to-locate-libnl3.patch create mode 100644 queue-6.12/um-fix-help-message-for-ssl-non-raw.patch create mode 100644 queue-6.12/x86-runtime-const-add-the-runtime_const_ptr-assembly.patch create mode 100644 queue-6.12/x86-uaccess-don-t-use-runtime-const-rewriting-in-mod.patch create mode 100644 queue-6.12/x86-use-cmov-for-user-address-masking.patch create mode 100644 queue-6.17/9p-fix-sys-fs-9p-caches-overwriting-itself.patch create mode 100644 queue-6.17/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch create mode 100644 queue-6.17/9p-trans_fd-p9_fd_request-kick-rx-thread-if-epollin.patch create mode 100644 queue-6.17/acpi-property-return-present-device-nodes-only-on-fw.patch create mode 100644 queue-6.17/alsa-hda-realtek-add-quirk-for-asus-rog-zephyrus-duo.patch create mode 100644 queue-6.17/arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch create mode 100644 queue-6.17/asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch create mode 100644 queue-6.17/asoc-rt722-add-settings-for-rt722vb.patch create mode 100644 queue-6.17/ceph-add-checking-of-wait_for_completion_killable-re.patch create mode 100644 queue-6.17/ceph-fix-multifs-mds-auth-caps-issue.patch create mode 100644 queue-6.17/ceph-fix-potential-race-condition-in-ceph_ioctl_lazy.patch create mode 100644 queue-6.17/ceph-refactor-wake_up_bit-pattern-of-calling.patch create mode 100644 queue-6.17/clk-at91-add-acr-in-all-pll-settings.patch create mode 100644 queue-6.17/clk-at91-clk-master-add-check-for-divide-by-3.patch create mode 100644 queue-6.17/clk-at91-clk-sam9x60-pll-force-write-to-pll_updt-reg.patch create mode 100644 queue-6.17/clk-at91-sam9x7-add-peripheral-clock-id-for-pmecc.patch create mode 100644 queue-6.17/clk-clocking-wizard-fix-output-clock-register-offset.patch create mode 100644 queue-6.17/clk-qcom-gcc-ipq6018-rework-nss_port5-clock-to-multi.patch create mode 100644 queue-6.17/clk-renesas-rzv2h-re-assert-reset-on-deassert-timeou.patch create mode 100644 queue-6.17/clk-samsung-exynos990-add-missing-usb-clock-register.patch create mode 100644 queue-6.17/clk-scmi-add-duty-cycle-ops-only-when-duty-cycle-is-.patch create mode 100644 queue-6.17/clk-sunxi-ng-sun6i-rtc-add-a523-specifics.patch create mode 100644 queue-6.17/clk-thead-th1520-ap-set-all-axi-clocks-to-clk_is_cri.patch create mode 100644 queue-6.17/clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch create mode 100644 queue-6.17/clocksource-hyper-v-skip-unnecessary-checks-for-the-.patch create mode 100644 queue-6.17/cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch create mode 100644 queue-6.17/drm-amdgpu-report-individual-reset-error.patch create mode 100644 queue-6.17/drm-amdkfd-fix-mmap-write-lock-not-release.patch create mode 100644 queue-6.17/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch create mode 100644 queue-6.17/fbdev-core-fix-ubsan-warning-in-pixel_to_pat.patch create mode 100644 queue-6.17/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch create mode 100644 queue-6.17/hyperv-add-missing-field-to-hv_output_map_device_int.patch create mode 100644 queue-6.17/kbuild-uapi-strip-comments-before-size-type-check.patch create mode 100644 queue-6.17/loongarch-handle-new-atomic-instructions-for-probes.patch create mode 100644 queue-6.17/net-wwan-t7xx-add-support-for-hp-drmr-h01.patch create mode 100644 queue-6.17/ntb-epf-allow-arbitrary-bar-mapping.patch create mode 100644 queue-6.17/rtc-pcf2127-clear-minute-second-interrupt.patch create mode 100644 queue-6.17/rtc-pcf2127-fix-watchdog-interrupt-mask-on-pcf2131.patch create mode 100644 queue-6.17/rtc-zynqmp-restore-alarm-functionality-after-kexec-t.patch create mode 100644 queue-6.17/scsi-ufs-core-include-utp-error-in-int_fatal_errors.patch create mode 100644 queue-6.17/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch create mode 100644 queue-6.17/tools-lib-thermal-don-t-preserve-owner-in-install.patch create mode 100644 queue-6.17/tools-lib-thermal-use-pkg-config-to-locate-libnl3.patch create mode 100644 queue-6.17/um-fix-help-message-for-ssl-non-raw.patch create mode 100644 queue-6.17/x86-uaccess-don-t-use-runtime-const-rewriting-in-mod.patch create mode 100644 queue-6.6/9p-fix-sys-fs-9p-caches-overwriting-itself.patch create mode 100644 queue-6.6/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch create mode 100644 queue-6.6/acpi-property-return-present-device-nodes-only-on-fw.patch create mode 100644 queue-6.6/arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch create mode 100644 queue-6.6/asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch create mode 100644 queue-6.6/ceph-add-checking-of-wait_for_completion_killable-re.patch create mode 100644 queue-6.6/ceph-refactor-wake_up_bit-pattern-of-calling.patch create mode 100644 queue-6.6/clk-at91-clk-master-add-check-for-divide-by-3.patch create mode 100644 queue-6.6/clk-at91-clk-sam9x60-pll-force-write-to-pll_updt-reg.patch create mode 100644 queue-6.6/clk-sunxi-ng-sun6i-rtc-add-a523-specifics.patch create mode 100644 queue-6.6/clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch create mode 100644 queue-6.6/cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch create mode 100644 queue-6.6/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch create mode 100644 queue-6.6/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch create mode 100644 queue-6.6/kbuild-uapi-strip-comments-before-size-type-check.patch create mode 100644 queue-6.6/ntb-epf-allow-arbitrary-bar-mapping.patch create mode 100644 queue-6.6/rtc-pcf2127-clear-minute-second-interrupt.patch create mode 100644 queue-6.6/rtc-pcf2127-fix-watchdog-interrupt-mask-on-pcf2131.patch create mode 100644 queue-6.6/scsi-ufs-core-include-utp-error-in-int_fatal_errors.patch create mode 100644 queue-6.6/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch create mode 100644 queue-6.6/tools-lib-thermal-don-t-preserve-owner-in-install.patch create mode 100644 queue-6.6/tools-lib-thermal-use-pkg-config-to-locate-libnl3.patch create mode 100644 queue-6.6/um-fix-help-message-for-ssl-non-raw.patch diff --git a/queue-5.10/9p-fix-sys-fs-9p-caches-overwriting-itself.patch b/queue-5.10/9p-fix-sys-fs-9p-caches-overwriting-itself.patch new file mode 100644 index 0000000000..e4cb6dc1da --- /dev/null +++ b/queue-5.10/9p-fix-sys-fs-9p-caches-overwriting-itself.patch @@ -0,0 +1,41 @@ +From b88b5ac5bc9125c5d92e30b0c83f0dd6052b2bb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 18:27:30 +0900 +Subject: 9p: fix /sys/fs/9p/caches overwriting itself +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Randall P. Embry + +[ Upstream commit 86db0c32f16c5538ddb740f54669ace8f3a1f3d7 ] + +caches_show() overwrote its buffer on each iteration, +so only the last cache tag was visible in sysfs output. + +Properly append with snprintf(buf + count, …). + +Signed-off-by: Randall P. Embry +Message-ID: <20250926-v9fs_misc-v1-2-a8b3907fc04d@codewreck.org> +Signed-off-by: Dominique Martinet +Signed-off-by: Sasha Levin +--- + fs/9p/v9fs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c +index 39def020a074b..b304e070139ca 100644 +--- a/fs/9p/v9fs.c ++++ b/fs/9p/v9fs.c +@@ -558,7 +558,7 @@ static ssize_t caches_show(struct kobject *kobj, + spin_lock(&v9fs_sessionlist_lock); + list_for_each_entry(v9ses, &v9fs_sessionlist, slist) { + if (v9ses->cachetag) { +- n = snprintf(buf, limit, "%s\n", v9ses->cachetag); ++ n = snprintf(buf + count, limit, "%s\n", v9ses->cachetag); + if (n < 0) { + count = n; + break; +-- +2.51.0 + diff --git a/queue-5.10/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch b/queue-5.10/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch new file mode 100644 index 0000000000..f35f4d0022 --- /dev/null +++ b/queue-5.10/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch @@ -0,0 +1,46 @@ +From 9a145325ccac4fc7fa12ef3bcbeee6dde12ac7ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 18:27:31 +0900 +Subject: 9p: sysfs_init: don't hardcode error to ENOMEM + +From: Randall P. Embry + +[ Upstream commit 528f218b31aac4bbfc58914d43766a22ab545d48 ] + +v9fs_sysfs_init() always returned -ENOMEM on failure; +return the actual sysfs_create_group() error instead. + +Signed-off-by: Randall P. Embry +Message-ID: <20250926-v9fs_misc-v1-3-a8b3907fc04d@codewreck.org> +Signed-off-by: Dominique Martinet +Signed-off-by: Sasha Levin +--- + fs/9p/v9fs.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c +index b304e070139ca..1dd8a735bf7f6 100644 +--- a/fs/9p/v9fs.c ++++ b/fs/9p/v9fs.c +@@ -594,13 +594,16 @@ static struct attribute_group v9fs_attr_group = { + + static int __init v9fs_sysfs_init(void) + { ++ int ret; ++ + v9fs_kobj = kobject_create_and_add("9p", fs_kobj); + if (!v9fs_kobj) + return -ENOMEM; + +- if (sysfs_create_group(v9fs_kobj, &v9fs_attr_group)) { ++ ret = sysfs_create_group(v9fs_kobj, &v9fs_attr_group); ++ if (ret) { + kobject_put(v9fs_kobj); +- return -ENOMEM; ++ return ret; + } + + return 0; +-- +2.51.0 + diff --git a/queue-5.10/acpi-property-return-present-device-nodes-only-on-fw.patch b/queue-5.10/acpi-property-return-present-device-nodes-only-on-fw.patch new file mode 100644 index 0000000000..ec521c770f --- /dev/null +++ b/queue-5.10/acpi-property-return-present-device-nodes-only-on-fw.patch @@ -0,0 +1,75 @@ +From 3472a0c204b42c411115b9a0480c4c828b9f9198 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 13:26:36 +0300 +Subject: ACPI: property: Return present device nodes only on fwnode interface + +From: Sakari Ailus + +[ Upstream commit d9f866b2bb3eec38b3734f1fed325ec7c55ccdfa ] + +fwnode_graph_get_next_subnode() may return fwnode backed by ACPI +device nodes and there has been no check these devices are present +in the system, unlike there has been on fwnode OF backend. + +In order to provide consistent behaviour towards callers, +add a check for device presence by introducing +a new function acpi_get_next_present_subnode(), used as the +get_next_child_node() fwnode operation that also checks device +node presence. + +Signed-off-by: Sakari Ailus +Reviewed-by: Laurent Pinchart +Reviewed-by: Jonathan Cameron +Link: https://patch.msgid.link/20251001102636.1272722-2-sakari.ailus@linux.intel.com +[ rjw: Kerneldoc comment and changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/property.c | 24 +++++++++++++++++++++++- + 1 file changed, 23 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c +index cf872dc5b07a6..821150dcb9762 100644 +--- a/drivers/acpi/property.c ++++ b/drivers/acpi/property.c +@@ -1107,6 +1107,28 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode, + return NULL; + } + ++/* ++ * acpi_get_next_present_subnode - Return the next present child node handle ++ * @fwnode: Firmware node to find the next child node for. ++ * @child: Handle to one of the device's child nodes or a null handle. ++ * ++ * Like acpi_get_next_subnode(), but the device nodes returned by ++ * acpi_get_next_present_subnode() are guaranteed to be present. ++ * ++ * Returns: The fwnode handle of the next present sub-node. ++ */ ++static struct fwnode_handle * ++acpi_get_next_present_subnode(const struct fwnode_handle *fwnode, ++ struct fwnode_handle *child) ++{ ++ do { ++ child = acpi_get_next_subnode(fwnode, child); ++ } while (is_acpi_device_node(child) && ++ !acpi_device_is_present(to_acpi_device_node(child))); ++ ++ return child; ++} ++ + /** + * acpi_node_get_parent - Return parent fwnode of this fwnode + * @fwnode: Firmware node whose parent to get +@@ -1421,7 +1443,7 @@ acpi_fwnode_device_get_match_data(const struct fwnode_handle *fwnode, + .property_read_string_array = \ + acpi_fwnode_property_read_string_array, \ + .get_parent = acpi_node_get_parent, \ +- .get_next_child_node = acpi_get_next_subnode, \ ++ .get_next_child_node = acpi_get_next_present_subnode, \ + .get_named_child_node = acpi_fwnode_get_named_child_node, \ + .get_name = acpi_fwnode_get_name, \ + .get_name_prefix = acpi_fwnode_get_name_prefix, \ +-- +2.51.0 + diff --git a/queue-5.10/arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch b/queue-5.10/arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch new file mode 100644 index 0000000000..26b83062c5 --- /dev/null +++ b/queue-5.10/arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch @@ -0,0 +1,59 @@ +From e4bda7b1999449b1188c0c143c1dee65461d5ed7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 16:54:27 +0200 +Subject: ARM: at91: pm: save and restore ACR during PLL disable/enable + +From: Nicolas Ferre + +[ Upstream commit 0c01fe49651d387776abed6a28541e80c8a93319 ] + +Add a new word in assembly to store ACR value during the calls +to at91_plla_disable/at91_plla_enable macros and use it. + +Signed-off-by: Nicolas Ferre +[cristian.birsan@microchip.com: remove ACR_DEFAULT_PLLA loading] +Signed-off-by: Cristian Birsan +Link: https://lore.kernel.org/r/20250827145427.46819-4-nicolas.ferre@microchip.com +Reviewed-by: Alexandre Belloni +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + arch/arm/mach-at91/pm_suspend.S | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S +index b683c2caa40b9..80494afb28a33 100644 +--- a/arch/arm/mach-at91/pm_suspend.S ++++ b/arch/arm/mach-at91/pm_suspend.S +@@ -373,6 +373,10 @@ ENDPROC(at91_backup_mode) + bic tmp2, tmp2, #AT91_PMC_PLL_UPDT_ID + str tmp2, [pmc, #AT91_PMC_PLL_UPDT] + ++ /* save acr */ ++ ldr tmp2, [pmc, #AT91_PMC_PLL_ACR] ++ str tmp2, .saved_acr ++ + /* save div. */ + mov tmp1, #0 + ldr tmp2, [pmc, #AT91_PMC_PLL_CTRL0] +@@ -442,7 +446,7 @@ ENDPROC(at91_backup_mode) + str tmp1, [pmc, #AT91_PMC_PLL_UPDT] + + /* step 2. */ +- ldr tmp1, =AT91_PMC_PLL_ACR_DEFAULT_PLLA ++ ldr tmp1, .saved_acr + str tmp1, [pmc, #AT91_PMC_PLL_ACR] + + /* step 3. */ +@@ -694,6 +698,8 @@ ENDPROC(at91_sramc_self_refresh) + .word 0 + .saved_mckr: + .word 0 ++.saved_acr: ++ .word 0 + .saved_pllar: + .word 0 + .saved_sam9_lpr: +-- +2.51.0 + diff --git a/queue-5.10/asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch b/queue-5.10/asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch new file mode 100644 index 0000000000..f84bf1568b --- /dev/null +++ b/queue-5.10/asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch @@ -0,0 +1,53 @@ +From db97dadd7dace073c45a59505aa3fb90fad9a33f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 00:12:19 +0200 +Subject: ASoC: meson: aiu-encoder-i2s: fix bit clock polarity + +From: Valerio Setti + +[ Upstream commit 4c4ed5e073a923fb3323022e1131cb51ad8df7a0 ] + +According to I2S specs audio data is sampled on the rising edge of the +clock and it can change on the falling one. When operating in normal mode +this SoC behaves the opposite so a clock polarity inversion is required +in this case. + +This was tested on an OdroidC2 (Amlogic S905 SoC) board. + +Signed-off-by: Valerio Setti +Reviewed-by: Jerome Brunet +Tested-by: Jerome Brunet +Link: https://patch.msgid.link/20251007-fix-i2s-polarity-v1-1-86704d9cda10@baylibre.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/meson/aiu-encoder-i2s.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/meson/aiu-encoder-i2s.c b/sound/soc/meson/aiu-encoder-i2s.c +index 67729de41a73e..a512cd49bc507 100644 +--- a/sound/soc/meson/aiu-encoder-i2s.c ++++ b/sound/soc/meson/aiu-encoder-i2s.c +@@ -236,8 +236,12 @@ static int aiu_encoder_i2s_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) + inv == SND_SOC_DAIFMT_IB_IF) + val |= AIU_CLK_CTRL_LRCLK_INVERT; + +- if (inv == SND_SOC_DAIFMT_IB_NF || +- inv == SND_SOC_DAIFMT_IB_IF) ++ /* ++ * The SoC changes data on the rising edge of the bitclock ++ * so an inversion of the bitclock is required in normal mode ++ */ ++ if (inv == SND_SOC_DAIFMT_NB_NF || ++ inv == SND_SOC_DAIFMT_NB_IF) + val |= AIU_CLK_CTRL_AOCLK_INVERT; + + /* Signal skew */ +@@ -328,4 +332,3 @@ const struct snd_soc_dai_ops aiu_encoder_i2s_dai_ops = { + .startup = aiu_encoder_i2s_startup, + .shutdown = aiu_encoder_i2s_shutdown, + }; +- +-- +2.51.0 + diff --git a/queue-5.10/ceph-add-checking-of-wait_for_completion_killable-re.patch b/queue-5.10/ceph-add-checking-of-wait_for_completion_killable-re.patch new file mode 100644 index 0000000000..80a461b667 --- /dev/null +++ b/queue-5.10/ceph-add-checking-of-wait_for_completion_killable-re.patch @@ -0,0 +1,50 @@ +From 7689c4723734d2c8db1adfd0507d5670bc773fec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jun 2025 12:04:32 -0700 +Subject: ceph: add checking of wait_for_completion_killable() return value + +From: Viacheslav Dubeyko + +[ Upstream commit b7ed1e29cfe773d648ca09895b92856bd3a2092d ] + +The Coverity Scan service has detected the calling of +wait_for_completion_killable() without checking the return +value in ceph_lock_wait_for_completion() [1]. The CID 1636232 +defect contains explanation: "If the function returns an error +value, the error value may be mistaken for a normal value. +In ceph_lock_wait_for_completion(): Value returned from +a function is not checked for errors before being used. (CWE-252)". + +The patch adds the checking of wait_for_completion_killable() +return value and return the error code from +ceph_lock_wait_for_completion(). + +[1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1636232 + +Signed-off-by: Viacheslav Dubeyko +Reviewed-by: Alex Markuze +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/locks.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c +index 674d6ea89f717..642582a642a3a 100644 +--- a/fs/ceph/locks.c ++++ b/fs/ceph/locks.c +@@ -202,7 +202,10 @@ static int ceph_lock_wait_for_completion(struct ceph_mds_client *mdsc, + if (err && err != -ERESTARTSYS) + return err; + +- wait_for_completion_killable(&req->r_safe_completion); ++ err = wait_for_completion_killable(&req->r_safe_completion); ++ if (err) ++ return err; ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-5.10/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch b/queue-5.10/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch new file mode 100644 index 0000000000..3a2e2ad483 --- /dev/null +++ b/queue-5.10/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch @@ -0,0 +1,69 @@ +From e1804f7a7b53e07be770bfeaac8efb61f7036d98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 03:32:09 -0400 +Subject: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds + +From: Albin Babu Varghese + +[ Upstream commit 3637d34b35b287ab830e66048841ace404382b67 ] + +Add bounds checking to prevent writes past framebuffer boundaries when +rendering text near screen edges. Return early if the Y position is off-screen +and clip image height to screen boundary. Break from the rendering loop if the +X position is off-screen. When clipping image width to fit the screen, update +the character count to match the clipped width to prevent buffer size +mismatches. + +Without the character count update, bit_putcs_aligned and bit_putcs_unaligned +receive mismatched parameters where the buffer is allocated for the clipped +width but cnt reflects the original larger count, causing out-of-bounds writes. + +Reported-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190 +Suggested-by: Helge Deller +Tested-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com +Signed-off-by: Albin Babu Varghese +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/core/bitblit.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c +index 4e774010d09f6..7c2fc9f83a848 100644 +--- a/drivers/video/fbdev/core/bitblit.c ++++ b/drivers/video/fbdev/core/bitblit.c +@@ -168,6 +168,11 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, + image.height = vc->vc_font.height; + image.depth = 1; + ++ if (image.dy >= info->var.yres) ++ return; ++ ++ image.height = min(image.height, info->var.yres - image.dy); ++ + if (attribute) { + buf = kmalloc(cellsize, GFP_ATOMIC); + if (!buf) +@@ -181,6 +186,18 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, + cnt = count; + + image.width = vc->vc_font.width * cnt; ++ ++ if (image.dx >= info->var.xres) ++ break; ++ ++ if (image.dx + image.width > info->var.xres) { ++ image.width = info->var.xres - image.dx; ++ cnt = image.width / vc->vc_font.width; ++ if (cnt == 0) ++ break; ++ image.width = cnt * vc->vc_font.width; ++ } ++ + pitch = DIV_ROUND_UP(image.width, 8) + scan_align; + pitch &= ~scan_align; + size = pitch * image.height + buf_align; +-- +2.51.0 + diff --git a/queue-5.10/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch b/queue-5.10/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch new file mode 100644 index 0000000000..1626932268 --- /dev/null +++ b/queue-5.10/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch @@ -0,0 +1,97 @@ +From c0c2ac2d80f64cd3944d2f5dacdde32bccbfb68a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 May 2025 20:44:34 -0500 +Subject: fs/hpfs: Fix error code for new_inode() failure in + mkdir/create/mknod/symlink + +From: Yikang Yue + +[ Upstream commit 32058c38d3b79a28963a59ac0353644dc24775cd ] + +The function call new_inode() is a primitive for allocating an inode in memory, +rather than planning disk space for it. Therefore, -ENOMEM should be returned +as the error code rather than -ENOSPC. + +To be specific, new_inode()'s call path looks like this: +new_inode + new_inode_pseudo + alloc_inode + ops->alloc_inode (hpfs_alloc_inode) + alloc_inode_sb + kmem_cache_alloc_lru + +Therefore, the failure of new_inode() indicates a memory presure issue (-ENOMEM), +not a lack of disk space. However, the current implementation of +hpfs_mkdir/create/mknod/symlink incorrectly returns -ENOSPC when new_inode() fails. +This patch fix this by set err to -ENOMEM before the goto statement. + +BTW, we also noticed that other nested calls within these four functions, +like hpfs_alloc_f/dnode and hpfs_add_dirent, might also fail due to memory presure. +But similarly, only -ENOSPC is returned. Addressing these will involve code +modifications in other functions, and we plan to submit dedicated patches for these +issues in the future. For this patch, we focus on new_inode(). + +Signed-off-by: Yikang Yue +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + fs/hpfs/namei.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c +index 1aee39160ac5b..bc1309ef4cfa5 100644 +--- a/fs/hpfs/namei.c ++++ b/fs/hpfs/namei.c +@@ -52,8 +52,10 @@ static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) + dee.fnode = cpu_to_le32(fno); + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail2; ++ } + hpfs_init_inode(result); + result->i_ino = fno; + hpfs_i(result)->i_parent_dir = dir->i_ino; +@@ -154,9 +156,10 @@ static int hpfs_create(struct inode *dir, struct dentry *dentry, umode_t mode, b + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail1; +- ++ } + hpfs_init_inode(result); + result->i_ino = fno; + result->i_mode |= S_IFREG; +@@ -241,9 +244,10 @@ static int hpfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, de + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail1; +- ++ } + hpfs_init_inode(result); + result->i_ino = fno; + hpfs_i(result)->i_parent_dir = dir->i_ino; +@@ -317,8 +321,10 @@ static int hpfs_symlink(struct inode *dir, struct dentry *dentry, const char *sy + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail1; ++ } + result->i_ino = fno; + hpfs_init_inode(result); + hpfs_i(result)->i_parent_dir = dir->i_ino; +-- +2.51.0 + diff --git a/queue-5.10/series b/queue-5.10/series index 21d2403c13..e42929598d 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -143,3 +143,13 @@ page_pool-clamp-pool-size-to-max-16k-pages.patch orangefs-fix-xattr-related-buffer-overflow.patch acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch btrfs-mark-dirty-extent-range-for-out-of-bound-preal.patch +fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch +um-fix-help-message-for-ssl-non-raw.patch +arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch +9p-fix-sys-fs-9p-caches-overwriting-itself.patch +9p-sysfs_init-don-t-hardcode-error-to-enomem.patch +acpi-property-return-present-device-nodes-only-on-fw.patch +tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch +fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch +asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch +ceph-add-checking-of-wait_for_completion_killable-re.patch diff --git a/queue-5.10/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch b/queue-5.10/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch new file mode 100644 index 0000000000..be9a061d11 --- /dev/null +++ b/queue-5.10/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch @@ -0,0 +1,66 @@ +From 0430138bed32614aec8697650a0f3962e1c0b1d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 15:47:06 -0700 +Subject: tools bitmap: Add missing asm-generic/bitsperlong.h include +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ian Rogers + +[ Upstream commit f38ce0209ab4553906b44bd1159e35c740a84161 ] + +small_const_nbits is defined in asm-generic/bitsperlong.h which +bitmap.h uses but doesn't include causing build failures in some build +systems. Add the missing #include. + +Note the bitmap.h in tools has diverged from that of the kernel, so no +changes are made there. + +Signed-off-by: Ian Rogers +Acked-by: Yury Norov +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: André Almeida +Cc: Daniel Borkmann +Cc: Darren Hart +Cc: David S. Miller +Cc: Davidlohr Bueso +Cc: Ido Schimmel +Cc: Ingo Molnar +Cc: Jakub Kicinski +Cc: Jamal Hadi Salim +Cc: Jason Xing +Cc: Jiri Olsa +Cc: Jonas Gottlieb +Cc: Kan Liang +Cc: Mark Rutland +Cc: Maurice Lambert +Cc: Namhyung Kim +Cc: Paolo Abeni +Cc: Peter Zijlstra +Cc: Petr Machata +Cc: Rasmus Villemoes +Cc: Thomas Gleixner +Cc: Yuyang Huang +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/include/linux/bitmap.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/include/linux/bitmap.h b/tools/include/linux/bitmap.h +index de45cad6cec19..1eeba6a147fb6 100644 +--- a/tools/include/linux/bitmap.h ++++ b/tools/include/linux/bitmap.h +@@ -3,6 +3,7 @@ + #define _PERF_BITOPS_H + + #include ++#include + #include + #include + #include +-- +2.51.0 + diff --git a/queue-5.10/um-fix-help-message-for-ssl-non-raw.patch b/queue-5.10/um-fix-help-message-for-ssl-non-raw.patch new file mode 100644 index 0000000000..9a8d7c4dfb --- /dev/null +++ b/queue-5.10/um-fix-help-message-for-ssl-non-raw.patch @@ -0,0 +1,36 @@ +From 7d680d99ee191a2441d78034a1b859924afea941 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 08:56:59 +0800 +Subject: um: Fix help message for ssl-non-raw + +From: Tiwei Bie + +[ Upstream commit 725e9d81868fcedaeef775948e699955b01631ae ] + +Add the missing option name in the help message. Additionally, +switch to __uml_help(), because this is a global option rather +than a per-channel option. + +Signed-off-by: Tiwei Bie +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + arch/um/drivers/ssl.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/um/drivers/ssl.c b/arch/um/drivers/ssl.c +index 6476b28d7c5ec..63da74e3f2776 100644 +--- a/arch/um/drivers/ssl.c ++++ b/arch/um/drivers/ssl.c +@@ -202,4 +202,7 @@ static int ssl_non_raw_setup(char *str) + return 1; + } + __setup("ssl-non-raw", ssl_non_raw_setup); +-__channel_help(ssl_non_raw_setup, "set serial lines to non-raw mode"); ++__uml_help(ssl_non_raw_setup, ++"ssl-non-raw\n" ++" Set serial lines to non-raw mode.\n\n" ++); +-- +2.51.0 + diff --git a/queue-5.15/9p-fix-sys-fs-9p-caches-overwriting-itself.patch b/queue-5.15/9p-fix-sys-fs-9p-caches-overwriting-itself.patch new file mode 100644 index 0000000000..115c28b4d2 --- /dev/null +++ b/queue-5.15/9p-fix-sys-fs-9p-caches-overwriting-itself.patch @@ -0,0 +1,41 @@ +From 93ca50406bfdc88af14127df6c7b3c61fec9cd7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 18:27:30 +0900 +Subject: 9p: fix /sys/fs/9p/caches overwriting itself +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Randall P. Embry + +[ Upstream commit 86db0c32f16c5538ddb740f54669ace8f3a1f3d7 ] + +caches_show() overwrote its buffer on each iteration, +so only the last cache tag was visible in sysfs output. + +Properly append with snprintf(buf + count, …). + +Signed-off-by: Randall P. Embry +Message-ID: <20250926-v9fs_misc-v1-2-a8b3907fc04d@codewreck.org> +Signed-off-by: Dominique Martinet +Signed-off-by: Sasha Levin +--- + fs/9p/v9fs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c +index 141067379f5e4..52765f7a3375a 100644 +--- a/fs/9p/v9fs.c ++++ b/fs/9p/v9fs.c +@@ -558,7 +558,7 @@ static ssize_t caches_show(struct kobject *kobj, + spin_lock(&v9fs_sessionlist_lock); + list_for_each_entry(v9ses, &v9fs_sessionlist, slist) { + if (v9ses->cachetag) { +- n = snprintf(buf, limit, "%s\n", v9ses->cachetag); ++ n = snprintf(buf + count, limit, "%s\n", v9ses->cachetag); + if (n < 0) { + count = n; + break; +-- +2.51.0 + diff --git a/queue-5.15/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch b/queue-5.15/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch new file mode 100644 index 0000000000..6f3d84111d --- /dev/null +++ b/queue-5.15/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch @@ -0,0 +1,46 @@ +From 1a69fa131936921aed8f29a6e8a12088376c666f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 18:27:31 +0900 +Subject: 9p: sysfs_init: don't hardcode error to ENOMEM + +From: Randall P. Embry + +[ Upstream commit 528f218b31aac4bbfc58914d43766a22ab545d48 ] + +v9fs_sysfs_init() always returned -ENOMEM on failure; +return the actual sysfs_create_group() error instead. + +Signed-off-by: Randall P. Embry +Message-ID: <20250926-v9fs_misc-v1-3-a8b3907fc04d@codewreck.org> +Signed-off-by: Dominique Martinet +Signed-off-by: Sasha Levin +--- + fs/9p/v9fs.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c +index 52765f7a3375a..3a44a77e276b8 100644 +--- a/fs/9p/v9fs.c ++++ b/fs/9p/v9fs.c +@@ -594,13 +594,16 @@ static const struct attribute_group v9fs_attr_group = { + + static int __init v9fs_sysfs_init(void) + { ++ int ret; ++ + v9fs_kobj = kobject_create_and_add("9p", fs_kobj); + if (!v9fs_kobj) + return -ENOMEM; + +- if (sysfs_create_group(v9fs_kobj, &v9fs_attr_group)) { ++ ret = sysfs_create_group(v9fs_kobj, &v9fs_attr_group); ++ if (ret) { + kobject_put(v9fs_kobj); +- return -ENOMEM; ++ return ret; + } + + return 0; +-- +2.51.0 + diff --git a/queue-5.15/acpi-property-return-present-device-nodes-only-on-fw.patch b/queue-5.15/acpi-property-return-present-device-nodes-only-on-fw.patch new file mode 100644 index 0000000000..43c43695df --- /dev/null +++ b/queue-5.15/acpi-property-return-present-device-nodes-only-on-fw.patch @@ -0,0 +1,75 @@ +From 9cdc4ace6b8a59526c1a4a27d982b7f4162913f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 13:26:36 +0300 +Subject: ACPI: property: Return present device nodes only on fwnode interface + +From: Sakari Ailus + +[ Upstream commit d9f866b2bb3eec38b3734f1fed325ec7c55ccdfa ] + +fwnode_graph_get_next_subnode() may return fwnode backed by ACPI +device nodes and there has been no check these devices are present +in the system, unlike there has been on fwnode OF backend. + +In order to provide consistent behaviour towards callers, +add a check for device presence by introducing +a new function acpi_get_next_present_subnode(), used as the +get_next_child_node() fwnode operation that also checks device +node presence. + +Signed-off-by: Sakari Ailus +Reviewed-by: Laurent Pinchart +Reviewed-by: Jonathan Cameron +Link: https://patch.msgid.link/20251001102636.1272722-2-sakari.ailus@linux.intel.com +[ rjw: Kerneldoc comment and changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/property.c | 24 +++++++++++++++++++++++- + 1 file changed, 23 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c +index 9ab7f7184343a..4205c7fdc4cc9 100644 +--- a/drivers/acpi/property.c ++++ b/drivers/acpi/property.c +@@ -1087,6 +1087,28 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode, + return NULL; + } + ++/* ++ * acpi_get_next_present_subnode - Return the next present child node handle ++ * @fwnode: Firmware node to find the next child node for. ++ * @child: Handle to one of the device's child nodes or a null handle. ++ * ++ * Like acpi_get_next_subnode(), but the device nodes returned by ++ * acpi_get_next_present_subnode() are guaranteed to be present. ++ * ++ * Returns: The fwnode handle of the next present sub-node. ++ */ ++static struct fwnode_handle * ++acpi_get_next_present_subnode(const struct fwnode_handle *fwnode, ++ struct fwnode_handle *child) ++{ ++ do { ++ child = acpi_get_next_subnode(fwnode, child); ++ } while (is_acpi_device_node(child) && ++ !acpi_device_is_present(to_acpi_device_node(child))); ++ ++ return child; ++} ++ + /** + * acpi_node_get_parent - Return parent fwnode of this fwnode + * @fwnode: Firmware node whose parent to get +@@ -1400,7 +1422,7 @@ acpi_fwnode_device_get_match_data(const struct fwnode_handle *fwnode, + .property_read_string_array = \ + acpi_fwnode_property_read_string_array, \ + .get_parent = acpi_node_get_parent, \ +- .get_next_child_node = acpi_get_next_subnode, \ ++ .get_next_child_node = acpi_get_next_present_subnode, \ + .get_named_child_node = acpi_fwnode_get_named_child_node, \ + .get_name = acpi_fwnode_get_name, \ + .get_name_prefix = acpi_fwnode_get_name_prefix, \ +-- +2.51.0 + diff --git a/queue-5.15/arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch b/queue-5.15/arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch new file mode 100644 index 0000000000..dcd3b63c82 --- /dev/null +++ b/queue-5.15/arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch @@ -0,0 +1,59 @@ +From 9f541fcea9a9e7f845a6c398c9a30457f5dda072 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 16:54:27 +0200 +Subject: ARM: at91: pm: save and restore ACR during PLL disable/enable + +From: Nicolas Ferre + +[ Upstream commit 0c01fe49651d387776abed6a28541e80c8a93319 ] + +Add a new word in assembly to store ACR value during the calls +to at91_plla_disable/at91_plla_enable macros and use it. + +Signed-off-by: Nicolas Ferre +[cristian.birsan@microchip.com: remove ACR_DEFAULT_PLLA loading] +Signed-off-by: Cristian Birsan +Link: https://lore.kernel.org/r/20250827145427.46819-4-nicolas.ferre@microchip.com +Reviewed-by: Alexandre Belloni +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + arch/arm/mach-at91/pm_suspend.S | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S +index 60f9d6f5f8229..1b8d1fbb41ef4 100644 +--- a/arch/arm/mach-at91/pm_suspend.S ++++ b/arch/arm/mach-at91/pm_suspend.S +@@ -685,6 +685,10 @@ sr_dis_exit: + bic tmp2, tmp2, #AT91_PMC_PLL_UPDT_ID + str tmp2, [pmc, #AT91_PMC_PLL_UPDT] + ++ /* save acr */ ++ ldr tmp2, [pmc, #AT91_PMC_PLL_ACR] ++ str tmp2, .saved_acr ++ + /* save div. */ + mov tmp1, #0 + ldr tmp2, [pmc, #AT91_PMC_PLL_CTRL0] +@@ -754,7 +758,7 @@ sr_dis_exit: + str tmp1, [pmc, #AT91_PMC_PLL_UPDT] + + /* step 2. */ +- ldr tmp1, =AT91_PMC_PLL_ACR_DEFAULT_PLLA ++ ldr tmp1, .saved_acr + str tmp1, [pmc, #AT91_PMC_PLL_ACR] + + /* step 3. */ +@@ -1130,6 +1134,8 @@ ENDPROC(at91_pm_suspend_in_sram) + .word 0 + .saved_mckr: + .word 0 ++.saved_acr: ++ .word 0 + .saved_pllar: + .word 0 + .saved_sam9_lpr: +-- +2.51.0 + diff --git a/queue-5.15/asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch b/queue-5.15/asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch new file mode 100644 index 0000000000..9419c7692c --- /dev/null +++ b/queue-5.15/asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch @@ -0,0 +1,53 @@ +From eac92281b780af587eb4b1ebbd2e76fae4b976d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 00:12:19 +0200 +Subject: ASoC: meson: aiu-encoder-i2s: fix bit clock polarity + +From: Valerio Setti + +[ Upstream commit 4c4ed5e073a923fb3323022e1131cb51ad8df7a0 ] + +According to I2S specs audio data is sampled on the rising edge of the +clock and it can change on the falling one. When operating in normal mode +this SoC behaves the opposite so a clock polarity inversion is required +in this case. + +This was tested on an OdroidC2 (Amlogic S905 SoC) board. + +Signed-off-by: Valerio Setti +Reviewed-by: Jerome Brunet +Tested-by: Jerome Brunet +Link: https://patch.msgid.link/20251007-fix-i2s-polarity-v1-1-86704d9cda10@baylibre.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/meson/aiu-encoder-i2s.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/meson/aiu-encoder-i2s.c b/sound/soc/meson/aiu-encoder-i2s.c +index 67729de41a73e..a512cd49bc507 100644 +--- a/sound/soc/meson/aiu-encoder-i2s.c ++++ b/sound/soc/meson/aiu-encoder-i2s.c +@@ -236,8 +236,12 @@ static int aiu_encoder_i2s_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) + inv == SND_SOC_DAIFMT_IB_IF) + val |= AIU_CLK_CTRL_LRCLK_INVERT; + +- if (inv == SND_SOC_DAIFMT_IB_NF || +- inv == SND_SOC_DAIFMT_IB_IF) ++ /* ++ * The SoC changes data on the rising edge of the bitclock ++ * so an inversion of the bitclock is required in normal mode ++ */ ++ if (inv == SND_SOC_DAIFMT_NB_NF || ++ inv == SND_SOC_DAIFMT_NB_IF) + val |= AIU_CLK_CTRL_AOCLK_INVERT; + + /* Signal skew */ +@@ -328,4 +332,3 @@ const struct snd_soc_dai_ops aiu_encoder_i2s_dai_ops = { + .startup = aiu_encoder_i2s_startup, + .shutdown = aiu_encoder_i2s_shutdown, + }; +- +-- +2.51.0 + diff --git a/queue-5.15/ceph-add-checking-of-wait_for_completion_killable-re.patch b/queue-5.15/ceph-add-checking-of-wait_for_completion_killable-re.patch new file mode 100644 index 0000000000..9afd000781 --- /dev/null +++ b/queue-5.15/ceph-add-checking-of-wait_for_completion_killable-re.patch @@ -0,0 +1,50 @@ +From 11c1d22be757fcd24308ac2f9e880d4ddb10cd0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jun 2025 12:04:32 -0700 +Subject: ceph: add checking of wait_for_completion_killable() return value + +From: Viacheslav Dubeyko + +[ Upstream commit b7ed1e29cfe773d648ca09895b92856bd3a2092d ] + +The Coverity Scan service has detected the calling of +wait_for_completion_killable() without checking the return +value in ceph_lock_wait_for_completion() [1]. The CID 1636232 +defect contains explanation: "If the function returns an error +value, the error value may be mistaken for a normal value. +In ceph_lock_wait_for_completion(): Value returned from +a function is not checked for errors before being used. (CWE-252)". + +The patch adds the checking of wait_for_completion_killable() +return value and return the error code from +ceph_lock_wait_for_completion(). + +[1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1636232 + +Signed-off-by: Viacheslav Dubeyko +Reviewed-by: Alex Markuze +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/locks.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c +index 3e3b8be76b21e..38974c54240d6 100644 +--- a/fs/ceph/locks.c ++++ b/fs/ceph/locks.c +@@ -202,7 +202,10 @@ static int ceph_lock_wait_for_completion(struct ceph_mds_client *mdsc, + if (err && err != -ERESTARTSYS) + return err; + +- wait_for_completion_killable(&req->r_safe_completion); ++ err = wait_for_completion_killable(&req->r_safe_completion); ++ if (err) ++ return err; ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-5.15/clk-at91-clk-master-add-check-for-divide-by-3.patch b/queue-5.15/clk-at91-clk-master-add-check-for-divide-by-3.patch new file mode 100644 index 0000000000..e2d981b19a --- /dev/null +++ b/queue-5.15/clk-at91-clk-master-add-check-for-divide-by-3.patch @@ -0,0 +1,38 @@ +From 363aaa1e0dc9698fbc46f6e1a166247bd174a930 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 13:07:17 -0700 +Subject: clk: at91: clk-master: Add check for divide by 3 + +From: Ryan Wanner + +[ Upstream commit e0237f5635727d64635ec6665e1de9f4cacce35c ] + +A potential divider for the master clock is div/3. The register +configuration for div/3 is MASTER_PRES_MAX. The current bit shifting +method does not work for this case. Checking for MASTER_PRES_MAX will +ensure the correct decimal value is stored in the system. + +Signed-off-by: Ryan Wanner +Signed-off-by: Nicolas Ferre +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/clk-master.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/clk/at91/clk-master.c b/drivers/clk/at91/clk-master.c +index 04d0dd8385945..3f4a071e4dab4 100644 +--- a/drivers/clk/at91/clk-master.c ++++ b/drivers/clk/at91/clk-master.c +@@ -437,6 +437,9 @@ clk_sama7g5_master_recalc_rate(struct clk_hw *hw, + { + struct clk_master *master = to_clk_master(hw); + ++ if (master->div == MASTER_PRES_MAX) ++ return DIV_ROUND_CLOSEST_ULL(parent_rate, 3); ++ + return DIV_ROUND_CLOSEST_ULL(parent_rate, (1 << master->div)); + } + +-- +2.51.0 + diff --git a/queue-5.15/clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch b/queue-5.15/clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch new file mode 100644 index 0000000000..c6eeefa815 --- /dev/null +++ b/queue-5.15/clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch @@ -0,0 +1,44 @@ +From 44e840dc72c7d55e09be72afd261a8f6aaf35dcd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 16:08:11 +0200 +Subject: clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled + +From: Matthias Schiffer + +[ Upstream commit 1e0d75258bd09323cb452655549e03975992b29e ] + +As described in AM335x Errata Advisory 1.0.42, WKUP_DEBUGSS_CLKCTRL +can't be disabled - the clock module will just be stuck in transitioning +state forever, resulting in the following warning message after the wait +loop times out: + + l3-aon-clkctrl:0000:0: failed to disable + +Just add the clock to enable_init_clks, so no attempt is made to disable +it. + +Signed-off-by: Matthias Schiffer +Signed-off-by: Alexander Stein +Acked-by: Kevin Hilman +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/ti/clk-33xx.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/ti/clk-33xx.c b/drivers/clk/ti/clk-33xx.c +index f2c22120aaa75..37bb20e92f787 100644 +--- a/drivers/clk/ti/clk-33xx.c ++++ b/drivers/clk/ti/clk-33xx.c +@@ -266,6 +266,8 @@ static const char *enable_init_clks[] = { + "dpll_ddr_m2_ck", + "dpll_mpu_m2_ck", + "l3_gclk", ++ /* WKUP_DEBUGSS_CLKCTRL - disable fails, AM335x Errata Advisory 1.0.42 */ ++ "l3-aon-clkctrl:0000:0", + /* AM3_L3_L3_MAIN_CLKCTRL, needed during suspend */ + "l3-clkctrl:00bc:0", + "l4hs_gclk", +-- +2.51.0 + diff --git a/queue-5.15/cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch b/queue-5.15/cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch new file mode 100644 index 0000000000..120634bdee --- /dev/null +++ b/queue-5.15/cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch @@ -0,0 +1,102 @@ +From 63fd32580fb8541c5026bbf0e02b380d15b90832 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 21:48:13 -0500 +Subject: cpufreq: tegra186: Initialize all cores to max frequencies + +From: Aaron Kling + +[ Upstream commit ba6018929165fc914c665f071f8e8cdbac844a49 ] + +During initialization, the EDVD_COREx_VOLT_FREQ registers for some cores +are still at reset values and not reflecting the actual frequency. This +causes get calls to fail. Set all cores to their respective max +frequency during probe to initialize the registers to working values. + +Suggested-by: Mikko Perttunen +Signed-off-by: Aaron Kling +Reviewed-by: Mikko Perttunen +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/tegra186-cpufreq.c | 27 +++++++++++++++++++++------ + 1 file changed, 21 insertions(+), 6 deletions(-) + +diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c +index af7edddaa84e4..cf37d2db1a899 100644 +--- a/drivers/cpufreq/tegra186-cpufreq.c ++++ b/drivers/cpufreq/tegra186-cpufreq.c +@@ -132,13 +132,14 @@ static struct cpufreq_driver tegra186_cpufreq_driver = { + + static struct cpufreq_frequency_table *init_vhint_table( + struct platform_device *pdev, struct tegra_bpmp *bpmp, +- struct tegra186_cpufreq_cluster *cluster, unsigned int cluster_id) ++ struct tegra186_cpufreq_cluster *cluster, unsigned int cluster_id, ++ int *num_rates) + { + struct cpufreq_frequency_table *table; + struct mrq_cpu_vhint_request req; + struct tegra_bpmp_message msg; + struct cpu_vhint_data *data; +- int err, i, j, num_rates = 0; ++ int err, i, j; + dma_addr_t phys; + void *virt; + +@@ -164,6 +165,7 @@ static struct cpufreq_frequency_table *init_vhint_table( + goto free; + } + ++ *num_rates = 0; + for (i = data->vfloor; i <= data->vceil; i++) { + u16 ndiv = data->ndiv[i]; + +@@ -174,10 +176,10 @@ static struct cpufreq_frequency_table *init_vhint_table( + if (i > 0 && ndiv == data->ndiv[i - 1]) + continue; + +- num_rates++; ++ (*num_rates)++; + } + +- table = devm_kcalloc(&pdev->dev, num_rates + 1, sizeof(*table), ++ table = devm_kcalloc(&pdev->dev, *num_rates + 1, sizeof(*table), + GFP_KERNEL); + if (!table) { + table = ERR_PTR(-ENOMEM); +@@ -219,7 +221,9 @@ static int tegra186_cpufreq_probe(struct platform_device *pdev) + { + struct tegra186_cpufreq_data *data; + struct tegra_bpmp *bpmp; +- unsigned int i = 0, err; ++ unsigned int i = 0, err, edvd_offset; ++ int num_rates = 0; ++ u32 edvd_val, cpu; + + data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL); + if (!data) +@@ -245,10 +249,21 @@ static int tegra186_cpufreq_probe(struct platform_device *pdev) + for (i = 0; i < TEGRA186_NUM_CLUSTERS; i++) { + struct tegra186_cpufreq_cluster *cluster = &data->clusters[i]; + +- cluster->table = init_vhint_table(pdev, bpmp, cluster, i); ++ cluster->table = init_vhint_table(pdev, bpmp, cluster, i, &num_rates); + if (IS_ERR(cluster->table)) { + err = PTR_ERR(cluster->table); + goto put_bpmp; ++ } else if (!num_rates) { ++ err = -EINVAL; ++ goto put_bpmp; ++ } ++ ++ for (cpu = 0; cpu < ARRAY_SIZE(tegra186_cpus); cpu++) { ++ if (data->cpus[cpu].bpmp_cluster_id == i) { ++ edvd_val = cluster->table[num_rates - 1].driver_data; ++ edvd_offset = data->cpus[cpu].edvd_offset; ++ writel(edvd_val, data->regs + edvd_offset); ++ } + } + } + +-- +2.51.0 + diff --git a/queue-5.15/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch b/queue-5.15/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch new file mode 100644 index 0000000000..6eab606dbb --- /dev/null +++ b/queue-5.15/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch @@ -0,0 +1,69 @@ +From 295f37f57e2333ee1f2f130737b14e38c9561edb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 03:32:09 -0400 +Subject: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds + +From: Albin Babu Varghese + +[ Upstream commit 3637d34b35b287ab830e66048841ace404382b67 ] + +Add bounds checking to prevent writes past framebuffer boundaries when +rendering text near screen edges. Return early if the Y position is off-screen +and clip image height to screen boundary. Break from the rendering loop if the +X position is off-screen. When clipping image width to fit the screen, update +the character count to match the clipped width to prevent buffer size +mismatches. + +Without the character count update, bit_putcs_aligned and bit_putcs_unaligned +receive mismatched parameters where the buffer is allocated for the clipped +width but cnt reflects the original larger count, causing out-of-bounds writes. + +Reported-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190 +Suggested-by: Helge Deller +Tested-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com +Signed-off-by: Albin Babu Varghese +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/core/bitblit.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c +index a4b4e1ec702e5..8563264d11fac 100644 +--- a/drivers/video/fbdev/core/bitblit.c ++++ b/drivers/video/fbdev/core/bitblit.c +@@ -168,6 +168,11 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, + image.height = vc->vc_font.height; + image.depth = 1; + ++ if (image.dy >= info->var.yres) ++ return; ++ ++ image.height = min(image.height, info->var.yres - image.dy); ++ + if (attribute) { + buf = kmalloc(cellsize, GFP_ATOMIC); + if (!buf) +@@ -181,6 +186,18 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, + cnt = count; + + image.width = vc->vc_font.width * cnt; ++ ++ if (image.dx >= info->var.xres) ++ break; ++ ++ if (image.dx + image.width > info->var.xres) { ++ image.width = info->var.xres - image.dx; ++ cnt = image.width / vc->vc_font.width; ++ if (cnt == 0) ++ break; ++ image.width = cnt * vc->vc_font.width; ++ } ++ + pitch = DIV_ROUND_UP(image.width, 8) + scan_align; + pitch &= ~scan_align; + size = pitch * image.height + buf_align; +-- +2.51.0 + diff --git a/queue-5.15/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch b/queue-5.15/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch new file mode 100644 index 0000000000..7601ae0866 --- /dev/null +++ b/queue-5.15/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch @@ -0,0 +1,97 @@ +From 45cdaa1d70eb432b0a2c8fdf291082891d25c178 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 May 2025 20:44:34 -0500 +Subject: fs/hpfs: Fix error code for new_inode() failure in + mkdir/create/mknod/symlink + +From: Yikang Yue + +[ Upstream commit 32058c38d3b79a28963a59ac0353644dc24775cd ] + +The function call new_inode() is a primitive for allocating an inode in memory, +rather than planning disk space for it. Therefore, -ENOMEM should be returned +as the error code rather than -ENOSPC. + +To be specific, new_inode()'s call path looks like this: +new_inode + new_inode_pseudo + alloc_inode + ops->alloc_inode (hpfs_alloc_inode) + alloc_inode_sb + kmem_cache_alloc_lru + +Therefore, the failure of new_inode() indicates a memory presure issue (-ENOMEM), +not a lack of disk space. However, the current implementation of +hpfs_mkdir/create/mknod/symlink incorrectly returns -ENOSPC when new_inode() fails. +This patch fix this by set err to -ENOMEM before the goto statement. + +BTW, we also noticed that other nested calls within these four functions, +like hpfs_alloc_f/dnode and hpfs_add_dirent, might also fail due to memory presure. +But similarly, only -ENOSPC is returned. Addressing these will involve code +modifications in other functions, and we plan to submit dedicated patches for these +issues in the future. For this patch, we focus on new_inode(). + +Signed-off-by: Yikang Yue +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + fs/hpfs/namei.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c +index d73f8a67168e9..c1c53602e4130 100644 +--- a/fs/hpfs/namei.c ++++ b/fs/hpfs/namei.c +@@ -53,8 +53,10 @@ static int hpfs_mkdir(struct user_namespace *mnt_userns, struct inode *dir, + dee.fnode = cpu_to_le32(fno); + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail2; ++ } + hpfs_init_inode(result); + result->i_ino = fno; + hpfs_i(result)->i_parent_dir = dir->i_ino; +@@ -156,9 +158,10 @@ static int hpfs_create(struct user_namespace *mnt_userns, struct inode *dir, + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail1; +- ++ } + hpfs_init_inode(result); + result->i_ino = fno; + result->i_mode |= S_IFREG; +@@ -244,9 +247,10 @@ static int hpfs_mknod(struct user_namespace *mnt_userns, struct inode *dir, + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail1; +- ++ } + hpfs_init_inode(result); + result->i_ino = fno; + hpfs_i(result)->i_parent_dir = dir->i_ino; +@@ -321,8 +325,10 @@ static int hpfs_symlink(struct user_namespace *mnt_userns, struct inode *dir, + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail1; ++ } + result->i_ino = fno; + hpfs_init_inode(result); + hpfs_i(result)->i_parent_dir = dir->i_ino; +-- +2.51.0 + diff --git a/queue-5.15/rtc-pcf2127-clear-minute-second-interrupt.patch b/queue-5.15/rtc-pcf2127-clear-minute-second-interrupt.patch new file mode 100644 index 0000000000..3f5d00ef08 --- /dev/null +++ b/queue-5.15/rtc-pcf2127-clear-minute-second-interrupt.patch @@ -0,0 +1,70 @@ +From ccb940e9823249d52ba3c0fc0e03daaf56f2e458 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 19:54:09 +0200 +Subject: rtc: pcf2127: clear minute/second interrupt + +From: Josua Mayer + +[ Upstream commit a6f1a4f05970664004a9370459c6799c1b2f2dcf ] + +PCF2127 can generate interrupt every full second or minute configured +from control and status register 1, bits MI (1) and SI (0). + +On interrupt control register 2 bit MSF (7) is set and must be cleared +to continue normal operation. + +While the driver never enables this interrupt on its own, users or +firmware may do so - e.g. as an easy way to test the interrupt. + +Add preprocessor definition for MSF bit and include it in the irq +bitmask to ensure minute and second interrupts are cleared when fired. + +This fixes an issue where the rtc enters a test mode and becomes +unresponsive after a second interrupt has fired and is not cleared in +time. In this state register writes to control registers have no +effect and the interrupt line is kept asserted [1]: + +[1] userspace commands to put rtc into unresponsive state: +$ i2cget -f -y 2 0x51 0x00 +0x04 +$ i2cset -f -y 2 0x51 0x00 0x05 # set bit 0 SI +$ i2cget -f -y 2 0x51 0x00 +0x84 # bit 8 EXT_TEST set +$ i2cset -f -y 2 0x51 0x00 0x05 # try overwrite control register +$ i2cget -f -y 2 0x51 0x00 +0x84 # no change + +Signed-off-by: Josua Mayer +Reviewed-by: Bruno Thomsen +Link: https://lore.kernel.org/r/20250825-rtc-irq-v1-1-0133319406a7@solid-run.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-pcf2127.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c +index 43f8011070952..f12d854d67b5e 100644 +--- a/drivers/rtc/rtc-pcf2127.c ++++ b/drivers/rtc/rtc-pcf2127.c +@@ -35,6 +35,7 @@ + #define PCF2127_BIT_CTRL2_AF BIT(4) + #define PCF2127_BIT_CTRL2_TSF2 BIT(5) + #define PCF2127_BIT_CTRL2_WDTF BIT(6) ++#define PCF2127_BIT_CTRL2_MSF BIT(7) + /* Control register 3 */ + #define PCF2127_REG_CTRL3 0x02 + #define PCF2127_BIT_CTRL3_BLIE BIT(0) +@@ -99,7 +100,8 @@ + #define PCF2127_CTRL2_IRQ_MASK ( \ + PCF2127_BIT_CTRL2_AF | \ + PCF2127_BIT_CTRL2_WDTF | \ +- PCF2127_BIT_CTRL2_TSF2) ++ PCF2127_BIT_CTRL2_TSF2 | \ ++ PCF2127_BIT_CTRL2_MSF) + + struct pcf2127 { + struct rtc_device *rtc; +-- +2.51.0 + diff --git a/queue-5.15/series b/queue-5.15/series index 3c3c1f7148..73445f21ee 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -192,3 +192,17 @@ rdma-irdma-remove-unused-struct-irdma_cq-fields.patch rdma-irdma-set-irdma_cq-cq_num-field-during-cq-creat.patch rdma-hns-fix-wrong-wqe-data-when-qp-wraps-around.patch btrfs-mark-dirty-extent-range-for-out-of-bound-preal.patch +fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch +um-fix-help-message-for-ssl-non-raw.patch +rtc-pcf2127-clear-minute-second-interrupt.patch +arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch +clk-at91-clk-master-add-check-for-divide-by-3.patch +clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch +9p-fix-sys-fs-9p-caches-overwriting-itself.patch +cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch +9p-sysfs_init-don-t-hardcode-error-to-enomem.patch +acpi-property-return-present-device-nodes-only-on-fw.patch +tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch +fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch +asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch +ceph-add-checking-of-wait_for_completion_killable-re.patch diff --git a/queue-5.15/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch b/queue-5.15/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch new file mode 100644 index 0000000000..9e73f08d99 --- /dev/null +++ b/queue-5.15/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch @@ -0,0 +1,66 @@ +From 57302daa9a0026053191219259fd89acf099fa45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 15:47:06 -0700 +Subject: tools bitmap: Add missing asm-generic/bitsperlong.h include +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ian Rogers + +[ Upstream commit f38ce0209ab4553906b44bd1159e35c740a84161 ] + +small_const_nbits is defined in asm-generic/bitsperlong.h which +bitmap.h uses but doesn't include causing build failures in some build +systems. Add the missing #include. + +Note the bitmap.h in tools has diverged from that of the kernel, so no +changes are made there. + +Signed-off-by: Ian Rogers +Acked-by: Yury Norov +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: André Almeida +Cc: Daniel Borkmann +Cc: Darren Hart +Cc: David S. Miller +Cc: Davidlohr Bueso +Cc: Ido Schimmel +Cc: Ingo Molnar +Cc: Jakub Kicinski +Cc: Jamal Hadi Salim +Cc: Jason Xing +Cc: Jiri Olsa +Cc: Jonas Gottlieb +Cc: Kan Liang +Cc: Mark Rutland +Cc: Maurice Lambert +Cc: Namhyung Kim +Cc: Paolo Abeni +Cc: Peter Zijlstra +Cc: Petr Machata +Cc: Rasmus Villemoes +Cc: Thomas Gleixner +Cc: Yuyang Huang +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/include/linux/bitmap.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/include/linux/bitmap.h b/tools/include/linux/bitmap.h +index a83ffdf1e2117..e65a7e84c7541 100644 +--- a/tools/include/linux/bitmap.h ++++ b/tools/include/linux/bitmap.h +@@ -3,6 +3,7 @@ + #define _PERF_BITOPS_H + + #include ++#include + #include + #include + #include +-- +2.51.0 + diff --git a/queue-5.15/um-fix-help-message-for-ssl-non-raw.patch b/queue-5.15/um-fix-help-message-for-ssl-non-raw.patch new file mode 100644 index 0000000000..3632a773c9 --- /dev/null +++ b/queue-5.15/um-fix-help-message-for-ssl-non-raw.patch @@ -0,0 +1,36 @@ +From 6595131bbf9e7b195a28bf356147fbe3d0f407ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 08:56:59 +0800 +Subject: um: Fix help message for ssl-non-raw + +From: Tiwei Bie + +[ Upstream commit 725e9d81868fcedaeef775948e699955b01631ae ] + +Add the missing option name in the help message. Additionally, +switch to __uml_help(), because this is a global option rather +than a per-channel option. + +Signed-off-by: Tiwei Bie +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + arch/um/drivers/ssl.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/um/drivers/ssl.c b/arch/um/drivers/ssl.c +index 8514966778d53..1bb657a296906 100644 +--- a/arch/um/drivers/ssl.c ++++ b/arch/um/drivers/ssl.c +@@ -199,4 +199,7 @@ static int ssl_non_raw_setup(char *str) + return 1; + } + __setup("ssl-non-raw", ssl_non_raw_setup); +-__channel_help(ssl_non_raw_setup, "set serial lines to non-raw mode"); ++__uml_help(ssl_non_raw_setup, ++"ssl-non-raw\n" ++" Set serial lines to non-raw mode.\n\n" ++); +-- +2.51.0 + diff --git a/queue-5.4/9p-fix-sys-fs-9p-caches-overwriting-itself.patch b/queue-5.4/9p-fix-sys-fs-9p-caches-overwriting-itself.patch new file mode 100644 index 0000000000..c4a91ea557 --- /dev/null +++ b/queue-5.4/9p-fix-sys-fs-9p-caches-overwriting-itself.patch @@ -0,0 +1,41 @@ +From 15bd8e11d267425db8ab5c1e995d179b5f634dfc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 18:27:30 +0900 +Subject: 9p: fix /sys/fs/9p/caches overwriting itself +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Randall P. Embry + +[ Upstream commit 86db0c32f16c5538ddb740f54669ace8f3a1f3d7 ] + +caches_show() overwrote its buffer on each iteration, +so only the last cache tag was visible in sysfs output. + +Properly append with snprintf(buf + count, …). + +Signed-off-by: Randall P. Embry +Message-ID: <20250926-v9fs_misc-v1-2-a8b3907fc04d@codewreck.org> +Signed-off-by: Dominique Martinet +Signed-off-by: Sasha Levin +--- + fs/9p/v9fs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c +index 39def020a074b..b304e070139ca 100644 +--- a/fs/9p/v9fs.c ++++ b/fs/9p/v9fs.c +@@ -558,7 +558,7 @@ static ssize_t caches_show(struct kobject *kobj, + spin_lock(&v9fs_sessionlist_lock); + list_for_each_entry(v9ses, &v9fs_sessionlist, slist) { + if (v9ses->cachetag) { +- n = snprintf(buf, limit, "%s\n", v9ses->cachetag); ++ n = snprintf(buf + count, limit, "%s\n", v9ses->cachetag); + if (n < 0) { + count = n; + break; +-- +2.51.0 + diff --git a/queue-5.4/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch b/queue-5.4/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch new file mode 100644 index 0000000000..7dd19d97f4 --- /dev/null +++ b/queue-5.4/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch @@ -0,0 +1,46 @@ +From 837ad89b1fba8553ad8556a451de788044430e1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 18:27:31 +0900 +Subject: 9p: sysfs_init: don't hardcode error to ENOMEM + +From: Randall P. Embry + +[ Upstream commit 528f218b31aac4bbfc58914d43766a22ab545d48 ] + +v9fs_sysfs_init() always returned -ENOMEM on failure; +return the actual sysfs_create_group() error instead. + +Signed-off-by: Randall P. Embry +Message-ID: <20250926-v9fs_misc-v1-3-a8b3907fc04d@codewreck.org> +Signed-off-by: Dominique Martinet +Signed-off-by: Sasha Levin +--- + fs/9p/v9fs.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c +index b304e070139ca..1dd8a735bf7f6 100644 +--- a/fs/9p/v9fs.c ++++ b/fs/9p/v9fs.c +@@ -594,13 +594,16 @@ static struct attribute_group v9fs_attr_group = { + + static int __init v9fs_sysfs_init(void) + { ++ int ret; ++ + v9fs_kobj = kobject_create_and_add("9p", fs_kobj); + if (!v9fs_kobj) + return -ENOMEM; + +- if (sysfs_create_group(v9fs_kobj, &v9fs_attr_group)) { ++ ret = sysfs_create_group(v9fs_kobj, &v9fs_attr_group); ++ if (ret) { + kobject_put(v9fs_kobj); +- return -ENOMEM; ++ return ret; + } + + return 0; +-- +2.51.0 + diff --git a/queue-5.4/acpi-property-return-present-device-nodes-only-on-fw.patch b/queue-5.4/acpi-property-return-present-device-nodes-only-on-fw.patch new file mode 100644 index 0000000000..141dbd99db --- /dev/null +++ b/queue-5.4/acpi-property-return-present-device-nodes-only-on-fw.patch @@ -0,0 +1,75 @@ +From b07a8000a87688c85f11724f7a14337808df1a3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 13:26:36 +0300 +Subject: ACPI: property: Return present device nodes only on fwnode interface + +From: Sakari Ailus + +[ Upstream commit d9f866b2bb3eec38b3734f1fed325ec7c55ccdfa ] + +fwnode_graph_get_next_subnode() may return fwnode backed by ACPI +device nodes and there has been no check these devices are present +in the system, unlike there has been on fwnode OF backend. + +In order to provide consistent behaviour towards callers, +add a check for device presence by introducing +a new function acpi_get_next_present_subnode(), used as the +get_next_child_node() fwnode operation that also checks device +node presence. + +Signed-off-by: Sakari Ailus +Reviewed-by: Laurent Pinchart +Reviewed-by: Jonathan Cameron +Link: https://patch.msgid.link/20251001102636.1272722-2-sakari.ailus@linux.intel.com +[ rjw: Kerneldoc comment and changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/property.c | 24 +++++++++++++++++++++++- + 1 file changed, 23 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c +index 5906e247b9fa1..c25fe9b86e237 100644 +--- a/drivers/acpi/property.c ++++ b/drivers/acpi/property.c +@@ -1114,6 +1114,28 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode, + return NULL; + } + ++/* ++ * acpi_get_next_present_subnode - Return the next present child node handle ++ * @fwnode: Firmware node to find the next child node for. ++ * @child: Handle to one of the device's child nodes or a null handle. ++ * ++ * Like acpi_get_next_subnode(), but the device nodes returned by ++ * acpi_get_next_present_subnode() are guaranteed to be present. ++ * ++ * Returns: The fwnode handle of the next present sub-node. ++ */ ++static struct fwnode_handle * ++acpi_get_next_present_subnode(const struct fwnode_handle *fwnode, ++ struct fwnode_handle *child) ++{ ++ do { ++ child = acpi_get_next_subnode(fwnode, child); ++ } while (is_acpi_device_node(child) && ++ !acpi_device_is_present(to_acpi_device_node(child))); ++ ++ return child; ++} ++ + /** + * acpi_node_get_parent - Return parent fwnode of this fwnode + * @fwnode: Firmware node whose parent to get +@@ -1387,7 +1409,7 @@ acpi_fwnode_device_get_match_data(const struct fwnode_handle *fwnode, + .property_read_string_array = \ + acpi_fwnode_property_read_string_array, \ + .get_parent = acpi_node_get_parent, \ +- .get_next_child_node = acpi_get_next_subnode, \ ++ .get_next_child_node = acpi_get_next_present_subnode, \ + .get_named_child_node = acpi_fwnode_get_named_child_node, \ + .get_reference_args = acpi_fwnode_get_reference_args, \ + .graph_get_next_endpoint = \ +-- +2.51.0 + diff --git a/queue-5.4/ceph-add-checking-of-wait_for_completion_killable-re.patch b/queue-5.4/ceph-add-checking-of-wait_for_completion_killable-re.patch new file mode 100644 index 0000000000..e6ebd0b1ac --- /dev/null +++ b/queue-5.4/ceph-add-checking-of-wait_for_completion_killable-re.patch @@ -0,0 +1,50 @@ +From 8ce5e4f9e60b48cfe6f89429167050fb3c53bdac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jun 2025 12:04:32 -0700 +Subject: ceph: add checking of wait_for_completion_killable() return value + +From: Viacheslav Dubeyko + +[ Upstream commit b7ed1e29cfe773d648ca09895b92856bd3a2092d ] + +The Coverity Scan service has detected the calling of +wait_for_completion_killable() without checking the return +value in ceph_lock_wait_for_completion() [1]. The CID 1636232 +defect contains explanation: "If the function returns an error +value, the error value may be mistaken for a normal value. +In ceph_lock_wait_for_completion(): Value returned from +a function is not checked for errors before being used. (CWE-252)". + +The patch adds the checking of wait_for_completion_killable() +return value and return the error code from +ceph_lock_wait_for_completion(). + +[1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1636232 + +Signed-off-by: Viacheslav Dubeyko +Reviewed-by: Alex Markuze +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/locks.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c +index 544e9e85b1202..d93515c2fa56f 100644 +--- a/fs/ceph/locks.c ++++ b/fs/ceph/locks.c +@@ -206,7 +206,10 @@ static int ceph_lock_wait_for_completion(struct ceph_mds_client *mdsc, + if (err && err != -ERESTARTSYS) + return err; + +- wait_for_completion_killable(&req->r_safe_completion); ++ err = wait_for_completion_killable(&req->r_safe_completion); ++ if (err) ++ return err; ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-5.4/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch b/queue-5.4/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch new file mode 100644 index 0000000000..c9e55dd8ee --- /dev/null +++ b/queue-5.4/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch @@ -0,0 +1,69 @@ +From 1057e4d7177add1d23dace671efe697ddcbac639 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 03:32:09 -0400 +Subject: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds + +From: Albin Babu Varghese + +[ Upstream commit 3637d34b35b287ab830e66048841ace404382b67 ] + +Add bounds checking to prevent writes past framebuffer boundaries when +rendering text near screen edges. Return early if the Y position is off-screen +and clip image height to screen boundary. Break from the rendering loop if the +X position is off-screen. When clipping image width to fit the screen, update +the character count to match the clipped width to prevent buffer size +mismatches. + +Without the character count update, bit_putcs_aligned and bit_putcs_unaligned +receive mismatched parameters where the buffer is allocated for the clipped +width but cnt reflects the original larger count, causing out-of-bounds writes. + +Reported-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190 +Suggested-by: Helge Deller +Tested-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com +Signed-off-by: Albin Babu Varghese +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/core/bitblit.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c +index 99a4f048b96ac..75c20f8e58e33 100644 +--- a/drivers/video/fbdev/core/bitblit.c ++++ b/drivers/video/fbdev/core/bitblit.c +@@ -169,6 +169,11 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, + image.height = vc->vc_font.height; + image.depth = 1; + ++ if (image.dy >= info->var.yres) ++ return; ++ ++ image.height = min(image.height, info->var.yres - image.dy); ++ + if (attribute) { + buf = kmalloc(cellsize, GFP_ATOMIC); + if (!buf) +@@ -182,6 +187,18 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, + cnt = count; + + image.width = vc->vc_font.width * cnt; ++ ++ if (image.dx >= info->var.xres) ++ break; ++ ++ if (image.dx + image.width > info->var.xres) { ++ image.width = info->var.xres - image.dx; ++ cnt = image.width / vc->vc_font.width; ++ if (cnt == 0) ++ break; ++ image.width = cnt * vc->vc_font.width; ++ } ++ + pitch = DIV_ROUND_UP(image.width, 8) + scan_align; + pitch &= ~scan_align; + size = pitch * image.height + buf_align; +-- +2.51.0 + diff --git a/queue-5.4/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch b/queue-5.4/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch new file mode 100644 index 0000000000..beda7a5bcc --- /dev/null +++ b/queue-5.4/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch @@ -0,0 +1,97 @@ +From 58a455d2e08191c6e44e771c2d2c0c45f58fe518 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 May 2025 20:44:34 -0500 +Subject: fs/hpfs: Fix error code for new_inode() failure in + mkdir/create/mknod/symlink + +From: Yikang Yue + +[ Upstream commit 32058c38d3b79a28963a59ac0353644dc24775cd ] + +The function call new_inode() is a primitive for allocating an inode in memory, +rather than planning disk space for it. Therefore, -ENOMEM should be returned +as the error code rather than -ENOSPC. + +To be specific, new_inode()'s call path looks like this: +new_inode + new_inode_pseudo + alloc_inode + ops->alloc_inode (hpfs_alloc_inode) + alloc_inode_sb + kmem_cache_alloc_lru + +Therefore, the failure of new_inode() indicates a memory presure issue (-ENOMEM), +not a lack of disk space. However, the current implementation of +hpfs_mkdir/create/mknod/symlink incorrectly returns -ENOSPC when new_inode() fails. +This patch fix this by set err to -ENOMEM before the goto statement. + +BTW, we also noticed that other nested calls within these four functions, +like hpfs_alloc_f/dnode and hpfs_add_dirent, might also fail due to memory presure. +But similarly, only -ENOSPC is returned. Addressing these will involve code +modifications in other functions, and we plan to submit dedicated patches for these +issues in the future. For this patch, we focus on new_inode(). + +Signed-off-by: Yikang Yue +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + fs/hpfs/namei.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c +index 1aee39160ac5b..bc1309ef4cfa5 100644 +--- a/fs/hpfs/namei.c ++++ b/fs/hpfs/namei.c +@@ -52,8 +52,10 @@ static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) + dee.fnode = cpu_to_le32(fno); + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail2; ++ } + hpfs_init_inode(result); + result->i_ino = fno; + hpfs_i(result)->i_parent_dir = dir->i_ino; +@@ -154,9 +156,10 @@ static int hpfs_create(struct inode *dir, struct dentry *dentry, umode_t mode, b + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail1; +- ++ } + hpfs_init_inode(result); + result->i_ino = fno; + result->i_mode |= S_IFREG; +@@ -241,9 +244,10 @@ static int hpfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, de + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail1; +- ++ } + hpfs_init_inode(result); + result->i_ino = fno; + hpfs_i(result)->i_parent_dir = dir->i_ino; +@@ -317,8 +321,10 @@ static int hpfs_symlink(struct inode *dir, struct dentry *dentry, const char *sy + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail1; ++ } + result->i_ino = fno; + hpfs_init_inode(result); + hpfs_i(result)->i_parent_dir = dir->i_ino; +-- +2.51.0 + diff --git a/queue-5.4/series b/queue-5.4/series index cd9c0d5063..a0b05c43e4 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -104,3 +104,10 @@ bluetooth-bcsp-receive-data-only-if-registered.patch page_pool-clamp-pool-size-to-max-16k-pages.patch orangefs-fix-xattr-related-buffer-overflow.patch acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch +fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch +9p-fix-sys-fs-9p-caches-overwriting-itself.patch +9p-sysfs_init-don-t-hardcode-error-to-enomem.patch +acpi-property-return-present-device-nodes-only-on-fw.patch +tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch +fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch +ceph-add-checking-of-wait_for_completion_killable-re.patch diff --git a/queue-5.4/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch b/queue-5.4/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch new file mode 100644 index 0000000000..2e89876a99 --- /dev/null +++ b/queue-5.4/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch @@ -0,0 +1,66 @@ +From badfd5e0bfb9e452ee05578edc90f0a5f28f6732 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 15:47:06 -0700 +Subject: tools bitmap: Add missing asm-generic/bitsperlong.h include +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ian Rogers + +[ Upstream commit f38ce0209ab4553906b44bd1159e35c740a84161 ] + +small_const_nbits is defined in asm-generic/bitsperlong.h which +bitmap.h uses but doesn't include causing build failures in some build +systems. Add the missing #include. + +Note the bitmap.h in tools has diverged from that of the kernel, so no +changes are made there. + +Signed-off-by: Ian Rogers +Acked-by: Yury Norov +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: André Almeida +Cc: Daniel Borkmann +Cc: Darren Hart +Cc: David S. Miller +Cc: Davidlohr Bueso +Cc: Ido Schimmel +Cc: Ingo Molnar +Cc: Jakub Kicinski +Cc: Jamal Hadi Salim +Cc: Jason Xing +Cc: Jiri Olsa +Cc: Jonas Gottlieb +Cc: Kan Liang +Cc: Mark Rutland +Cc: Maurice Lambert +Cc: Namhyung Kim +Cc: Paolo Abeni +Cc: Peter Zijlstra +Cc: Petr Machata +Cc: Rasmus Villemoes +Cc: Thomas Gleixner +Cc: Yuyang Huang +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/include/linux/bitmap.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/include/linux/bitmap.h b/tools/include/linux/bitmap.h +index 61cf3b9a23a6f..614df0e8822c4 100644 +--- a/tools/include/linux/bitmap.h ++++ b/tools/include/linux/bitmap.h +@@ -3,6 +3,7 @@ + #define _PERF_BITOPS_H + + #include ++#include + #include + #include + #include +-- +2.51.0 + diff --git a/queue-6.1/9p-fix-sys-fs-9p-caches-overwriting-itself.patch b/queue-6.1/9p-fix-sys-fs-9p-caches-overwriting-itself.patch new file mode 100644 index 0000000000..ea4fd1edce --- /dev/null +++ b/queue-6.1/9p-fix-sys-fs-9p-caches-overwriting-itself.patch @@ -0,0 +1,41 @@ +From c9777a98b64d0f64cdfb3c927f948be2661765a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 18:27:30 +0900 +Subject: 9p: fix /sys/fs/9p/caches overwriting itself +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Randall P. Embry + +[ Upstream commit 86db0c32f16c5538ddb740f54669ace8f3a1f3d7 ] + +caches_show() overwrote its buffer on each iteration, +so only the last cache tag was visible in sysfs output. + +Properly append with snprintf(buf + count, …). + +Signed-off-by: Randall P. Embry +Message-ID: <20250926-v9fs_misc-v1-2-a8b3907fc04d@codewreck.org> +Signed-off-by: Dominique Martinet +Signed-off-by: Sasha Levin +--- + fs/9p/v9fs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c +index 0129de2ea31ae..fc3dadbd2e11c 100644 +--- a/fs/9p/v9fs.c ++++ b/fs/9p/v9fs.c +@@ -561,7 +561,7 @@ static ssize_t caches_show(struct kobject *kobj, + spin_lock(&v9fs_sessionlist_lock); + list_for_each_entry(v9ses, &v9fs_sessionlist, slist) { + if (v9ses->cachetag) { +- n = snprintf(buf, limit, "%s\n", v9ses->cachetag); ++ n = snprintf(buf + count, limit, "%s\n", v9ses->cachetag); + if (n < 0) { + count = n; + break; +-- +2.51.0 + diff --git a/queue-6.1/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch b/queue-6.1/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch new file mode 100644 index 0000000000..1c93d5eb1f --- /dev/null +++ b/queue-6.1/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch @@ -0,0 +1,46 @@ +From ca6accca5d94f9371619bf54357f548267352735 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 18:27:31 +0900 +Subject: 9p: sysfs_init: don't hardcode error to ENOMEM + +From: Randall P. Embry + +[ Upstream commit 528f218b31aac4bbfc58914d43766a22ab545d48 ] + +v9fs_sysfs_init() always returned -ENOMEM on failure; +return the actual sysfs_create_group() error instead. + +Signed-off-by: Randall P. Embry +Message-ID: <20250926-v9fs_misc-v1-3-a8b3907fc04d@codewreck.org> +Signed-off-by: Dominique Martinet +Signed-off-by: Sasha Levin +--- + fs/9p/v9fs.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c +index fc3dadbd2e11c..2a6988db807b3 100644 +--- a/fs/9p/v9fs.c ++++ b/fs/9p/v9fs.c +@@ -597,13 +597,16 @@ static const struct attribute_group v9fs_attr_group = { + + static int __init v9fs_sysfs_init(void) + { ++ int ret; ++ + v9fs_kobj = kobject_create_and_add("9p", fs_kobj); + if (!v9fs_kobj) + return -ENOMEM; + +- if (sysfs_create_group(v9fs_kobj, &v9fs_attr_group)) { ++ ret = sysfs_create_group(v9fs_kobj, &v9fs_attr_group); ++ if (ret) { + kobject_put(v9fs_kobj); +- return -ENOMEM; ++ return ret; + } + + return 0; +-- +2.51.0 + diff --git a/queue-6.1/acpi-property-return-present-device-nodes-only-on-fw.patch b/queue-6.1/acpi-property-return-present-device-nodes-only-on-fw.patch new file mode 100644 index 0000000000..13d092fa0a --- /dev/null +++ b/queue-6.1/acpi-property-return-present-device-nodes-only-on-fw.patch @@ -0,0 +1,75 @@ +From c7574896b6f4de38ca36e09dc5b42f07caa5e81b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 13:26:36 +0300 +Subject: ACPI: property: Return present device nodes only on fwnode interface + +From: Sakari Ailus + +[ Upstream commit d9f866b2bb3eec38b3734f1fed325ec7c55ccdfa ] + +fwnode_graph_get_next_subnode() may return fwnode backed by ACPI +device nodes and there has been no check these devices are present +in the system, unlike there has been on fwnode OF backend. + +In order to provide consistent behaviour towards callers, +add a check for device presence by introducing +a new function acpi_get_next_present_subnode(), used as the +get_next_child_node() fwnode operation that also checks device +node presence. + +Signed-off-by: Sakari Ailus +Reviewed-by: Laurent Pinchart +Reviewed-by: Jonathan Cameron +Link: https://patch.msgid.link/20251001102636.1272722-2-sakari.ailus@linux.intel.com +[ rjw: Kerneldoc comment and changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/property.c | 24 +++++++++++++++++++++++- + 1 file changed, 23 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c +index 46003b642b597..9f7880cc2bd8c 100644 +--- a/drivers/acpi/property.c ++++ b/drivers/acpi/property.c +@@ -1298,6 +1298,28 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode, + return NULL; + } + ++/* ++ * acpi_get_next_present_subnode - Return the next present child node handle ++ * @fwnode: Firmware node to find the next child node for. ++ * @child: Handle to one of the device's child nodes or a null handle. ++ * ++ * Like acpi_get_next_subnode(), but the device nodes returned by ++ * acpi_get_next_present_subnode() are guaranteed to be present. ++ * ++ * Returns: The fwnode handle of the next present sub-node. ++ */ ++static struct fwnode_handle * ++acpi_get_next_present_subnode(const struct fwnode_handle *fwnode, ++ struct fwnode_handle *child) ++{ ++ do { ++ child = acpi_get_next_subnode(fwnode, child); ++ } while (is_acpi_device_node(child) && ++ !acpi_device_is_present(to_acpi_device_node(child))); ++ ++ return child; ++} ++ + /** + * acpi_node_get_parent - Return parent fwnode of this fwnode + * @fwnode: Firmware node whose parent to get +@@ -1641,7 +1663,7 @@ static int acpi_fwnode_irq_get(const struct fwnode_handle *fwnode, + .property_read_string_array = \ + acpi_fwnode_property_read_string_array, \ + .get_parent = acpi_node_get_parent, \ +- .get_next_child_node = acpi_get_next_subnode, \ ++ .get_next_child_node = acpi_get_next_present_subnode, \ + .get_named_child_node = acpi_fwnode_get_named_child_node, \ + .get_name = acpi_fwnode_get_name, \ + .get_name_prefix = acpi_fwnode_get_name_prefix, \ +-- +2.51.0 + diff --git a/queue-6.1/arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch b/queue-6.1/arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch new file mode 100644 index 0000000000..0209ee7ef6 --- /dev/null +++ b/queue-6.1/arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch @@ -0,0 +1,59 @@ +From 27a6ffac2013c4e13f4eaaff8d5ae0befe0f7239 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 16:54:27 +0200 +Subject: ARM: at91: pm: save and restore ACR during PLL disable/enable + +From: Nicolas Ferre + +[ Upstream commit 0c01fe49651d387776abed6a28541e80c8a93319 ] + +Add a new word in assembly to store ACR value during the calls +to at91_plla_disable/at91_plla_enable macros and use it. + +Signed-off-by: Nicolas Ferre +[cristian.birsan@microchip.com: remove ACR_DEFAULT_PLLA loading] +Signed-off-by: Cristian Birsan +Link: https://lore.kernel.org/r/20250827145427.46819-4-nicolas.ferre@microchip.com +Reviewed-by: Alexandre Belloni +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + arch/arm/mach-at91/pm_suspend.S | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S +index 0af2598899fc5..c410da92ce38b 100644 +--- a/arch/arm/mach-at91/pm_suspend.S ++++ b/arch/arm/mach-at91/pm_suspend.S +@@ -685,6 +685,10 @@ sr_dis_exit: + bic tmp2, tmp2, #AT91_PMC_PLL_UPDT_ID + str tmp2, [pmc, #AT91_PMC_PLL_UPDT] + ++ /* save acr */ ++ ldr tmp2, [pmc, #AT91_PMC_PLL_ACR] ++ str tmp2, .saved_acr ++ + /* save div. */ + mov tmp1, #0 + ldr tmp2, [pmc, #AT91_PMC_PLL_CTRL0] +@@ -754,7 +758,7 @@ sr_dis_exit: + str tmp1, [pmc, #AT91_PMC_PLL_UPDT] + + /* step 2. */ +- ldr tmp1, =AT91_PMC_PLL_ACR_DEFAULT_PLLA ++ ldr tmp1, .saved_acr + str tmp1, [pmc, #AT91_PMC_PLL_ACR] + + /* step 3. */ +@@ -1130,6 +1134,8 @@ ENDPROC(at91_pm_suspend_in_sram) + .word 0 + .saved_mckr: + .word 0 ++.saved_acr: ++ .word 0 + .saved_pllar: + .word 0 + .saved_sam9_lpr: +-- +2.51.0 + diff --git a/queue-6.1/asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch b/queue-6.1/asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch new file mode 100644 index 0000000000..2e44a6a556 --- /dev/null +++ b/queue-6.1/asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch @@ -0,0 +1,53 @@ +From 7d0f59bd304bd00f432e610d12c2a88679af9d30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 00:12:19 +0200 +Subject: ASoC: meson: aiu-encoder-i2s: fix bit clock polarity + +From: Valerio Setti + +[ Upstream commit 4c4ed5e073a923fb3323022e1131cb51ad8df7a0 ] + +According to I2S specs audio data is sampled on the rising edge of the +clock and it can change on the falling one. When operating in normal mode +this SoC behaves the opposite so a clock polarity inversion is required +in this case. + +This was tested on an OdroidC2 (Amlogic S905 SoC) board. + +Signed-off-by: Valerio Setti +Reviewed-by: Jerome Brunet +Tested-by: Jerome Brunet +Link: https://patch.msgid.link/20251007-fix-i2s-polarity-v1-1-86704d9cda10@baylibre.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/meson/aiu-encoder-i2s.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/meson/aiu-encoder-i2s.c b/sound/soc/meson/aiu-encoder-i2s.c +index a0dd914c8ed13..3b4061508c180 100644 +--- a/sound/soc/meson/aiu-encoder-i2s.c ++++ b/sound/soc/meson/aiu-encoder-i2s.c +@@ -236,8 +236,12 @@ static int aiu_encoder_i2s_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) + inv == SND_SOC_DAIFMT_IB_IF) + val |= AIU_CLK_CTRL_LRCLK_INVERT; + +- if (inv == SND_SOC_DAIFMT_IB_NF || +- inv == SND_SOC_DAIFMT_IB_IF) ++ /* ++ * The SoC changes data on the rising edge of the bitclock ++ * so an inversion of the bitclock is required in normal mode ++ */ ++ if (inv == SND_SOC_DAIFMT_NB_NF || ++ inv == SND_SOC_DAIFMT_NB_IF) + val |= AIU_CLK_CTRL_AOCLK_INVERT; + + /* Signal skew */ +@@ -328,4 +332,3 @@ const struct snd_soc_dai_ops aiu_encoder_i2s_dai_ops = { + .startup = aiu_encoder_i2s_startup, + .shutdown = aiu_encoder_i2s_shutdown, + }; +- +-- +2.51.0 + diff --git a/queue-6.1/ceph-add-checking-of-wait_for_completion_killable-re.patch b/queue-6.1/ceph-add-checking-of-wait_for_completion_killable-re.patch new file mode 100644 index 0000000000..af49c6eeb8 --- /dev/null +++ b/queue-6.1/ceph-add-checking-of-wait_for_completion_killable-re.patch @@ -0,0 +1,50 @@ +From f9719d05e573125bf958fcc8cb7eff538470343d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jun 2025 12:04:32 -0700 +Subject: ceph: add checking of wait_for_completion_killable() return value + +From: Viacheslav Dubeyko + +[ Upstream commit b7ed1e29cfe773d648ca09895b92856bd3a2092d ] + +The Coverity Scan service has detected the calling of +wait_for_completion_killable() without checking the return +value in ceph_lock_wait_for_completion() [1]. The CID 1636232 +defect contains explanation: "If the function returns an error +value, the error value may be mistaken for a normal value. +In ceph_lock_wait_for_completion(): Value returned from +a function is not checked for errors before being used. (CWE-252)". + +The patch adds the checking of wait_for_completion_killable() +return value and return the error code from +ceph_lock_wait_for_completion(). + +[1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1636232 + +Signed-off-by: Viacheslav Dubeyko +Reviewed-by: Alex Markuze +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/locks.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c +index b191426bf880c..3da9e53f80918 100644 +--- a/fs/ceph/locks.c ++++ b/fs/ceph/locks.c +@@ -202,7 +202,10 @@ static int ceph_lock_wait_for_completion(struct ceph_mds_client *mdsc, + if (err && err != -ERESTARTSYS) + return err; + +- wait_for_completion_killable(&req->r_safe_completion); ++ err = wait_for_completion_killable(&req->r_safe_completion); ++ if (err) ++ return err; ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.1/clk-at91-clk-master-add-check-for-divide-by-3.patch b/queue-6.1/clk-at91-clk-master-add-check-for-divide-by-3.patch new file mode 100644 index 0000000000..64e192d896 --- /dev/null +++ b/queue-6.1/clk-at91-clk-master-add-check-for-divide-by-3.patch @@ -0,0 +1,38 @@ +From f894511f5dd052d3d776cb4c95c7a8e525060a0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 13:07:17 -0700 +Subject: clk: at91: clk-master: Add check for divide by 3 + +From: Ryan Wanner + +[ Upstream commit e0237f5635727d64635ec6665e1de9f4cacce35c ] + +A potential divider for the master clock is div/3. The register +configuration for div/3 is MASTER_PRES_MAX. The current bit shifting +method does not work for this case. Checking for MASTER_PRES_MAX will +ensure the correct decimal value is stored in the system. + +Signed-off-by: Ryan Wanner +Signed-off-by: Nicolas Ferre +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/clk-master.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/clk/at91/clk-master.c b/drivers/clk/at91/clk-master.c +index b7cd1924de52a..1f07a5d292602 100644 +--- a/drivers/clk/at91/clk-master.c ++++ b/drivers/clk/at91/clk-master.c +@@ -574,6 +574,9 @@ clk_sama7g5_master_recalc_rate(struct clk_hw *hw, + { + struct clk_master *master = to_clk_master(hw); + ++ if (master->div == MASTER_PRES_MAX) ++ return DIV_ROUND_CLOSEST_ULL(parent_rate, 3); ++ + return DIV_ROUND_CLOSEST_ULL(parent_rate, (1 << master->div)); + } + +-- +2.51.0 + diff --git a/queue-6.1/clk-at91-clk-sam9x60-pll-force-write-to-pll_updt-reg.patch b/queue-6.1/clk-at91-clk-sam9x60-pll-force-write-to-pll_updt-reg.patch new file mode 100644 index 0000000000..c1f99da5eb --- /dev/null +++ b/queue-6.1/clk-at91-clk-sam9x60-pll-force-write-to-pll_updt-reg.patch @@ -0,0 +1,214 @@ +From ff70bd7dadcc0b43d72a204d14f3ab25fce4018f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 17:08:10 +0200 +Subject: clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register + +From: Nicolas Ferre + +[ Upstream commit af98caeaa7b6ad11eb7b7c8bfaddc769df2889f3 ] + +This register is important for sequencing the commands to PLLs, so +actually write the update bits with regmap_write_bits() instead of +relying on a read/modify/write regmap command that could skip the actual +hardware write if the value is identical to the one read. + +It's changed when modification is needed to the PLL, when +read-only operation is done, we could keep the call to +regmap_update_bits(). + +Add a comment to the sam9x60_div_pll_set_div() function that uses this +PLL_UPDT register so that it's used consistently, according to the +product's datasheet. + +Signed-off-by: Nicolas Ferre +Tested-by: Ryan Wanner # on sama7d65 and sam9x75 +Link: https://lore.kernel.org/r/20250827150811.82496-1-nicolas.ferre@microchip.com +[claudiu.beznea: fix "Alignment should match open parenthesis" + checkpatch.pl check] +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/clk-sam9x60-pll.c | 75 ++++++++++++++++-------------- + 1 file changed, 39 insertions(+), 36 deletions(-) + +diff --git a/drivers/clk/at91/clk-sam9x60-pll.c b/drivers/clk/at91/clk-sam9x60-pll.c +index 0882ed01d5c27..a010a8fce58b2 100644 +--- a/drivers/clk/at91/clk-sam9x60-pll.c ++++ b/drivers/clk/at91/clk-sam9x60-pll.c +@@ -90,8 +90,8 @@ static int sam9x60_frac_pll_set(struct sam9x60_pll_core *core) + + spin_lock_irqsave(core->lock, flags); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_ID_MSK, core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_ID_MSK, core->id); + regmap_read(regmap, AT91_PMC_PLL_CTRL1, &val); + cmul = (val & core->layout->mul_mask) >> core->layout->mul_shift; + cfrac = (val & core->layout->frac_mask) >> core->layout->frac_shift; +@@ -125,17 +125,17 @@ static int sam9x60_frac_pll_set(struct sam9x60_pll_core *core) + udelay(10); + } + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, + AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL, + AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + while (!sam9x60_pll_ready(regmap, core->id)) + cpu_relax(); +@@ -161,8 +161,8 @@ static void sam9x60_frac_pll_unprepare(struct clk_hw *hw) + + spin_lock_irqsave(core->lock, flags); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_ID_MSK, core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_ID_MSK, core->id); + + regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, AT91_PMC_PLL_CTRL0_ENPLL, 0); + +@@ -170,9 +170,9 @@ static void sam9x60_frac_pll_unprepare(struct clk_hw *hw) + regmap_update_bits(regmap, AT91_PMC_PLL_ACR, + AT91_PMC_PLL_ACR_UTMIBG | AT91_PMC_PLL_ACR_UTMIVR, 0); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + spin_unlock_irqrestore(core->lock, flags); + } +@@ -257,8 +257,8 @@ static int sam9x60_frac_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate, + + spin_lock_irqsave(core->lock, irqflags); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, +- core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, ++ core->id); + regmap_read(regmap, AT91_PMC_PLL_CTRL1, &val); + cmul = (val & core->layout->mul_mask) >> core->layout->mul_shift; + cfrac = (val & core->layout->frac_mask) >> core->layout->frac_shift; +@@ -270,18 +270,18 @@ static int sam9x60_frac_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate, + (frac->mul << core->layout->mul_shift) | + (frac->frac << core->layout->frac_shift)); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, + AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL, + AT91_PMC_PLL_CTRL0_ENLOCK | + AT91_PMC_PLL_CTRL0_ENPLL); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + while (!sam9x60_pll_ready(regmap, core->id)) + cpu_relax(); +@@ -333,7 +333,10 @@ static const struct clk_ops sam9x60_frac_pll_ops_chg = { + .restore_context = sam9x60_frac_pll_restore_context, + }; + +-/* This function should be called with spinlock acquired. */ ++/* This function should be called with spinlock acquired. ++ * Warning: this function must be called only if the same PLL ID was set in ++ * PLL_UPDT register previously. ++ */ + static void sam9x60_div_pll_set_div(struct sam9x60_pll_core *core, u32 div, + bool enable) + { +@@ -345,9 +348,9 @@ static void sam9x60_div_pll_set_div(struct sam9x60_pll_core *core, u32 div, + core->layout->div_mask | ena_msk, + (div << core->layout->div_shift) | ena_val); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + while (!sam9x60_pll_ready(regmap, core->id)) + cpu_relax(); +@@ -361,8 +364,8 @@ static int sam9x60_div_pll_set(struct sam9x60_pll_core *core) + unsigned int val, cdiv; + + spin_lock_irqsave(core->lock, flags); +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_ID_MSK, core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_ID_MSK, core->id); + regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val); + cdiv = (val & core->layout->div_mask) >> core->layout->div_shift; + +@@ -393,15 +396,15 @@ static void sam9x60_div_pll_unprepare(struct clk_hw *hw) + + spin_lock_irqsave(core->lock, flags); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_ID_MSK, core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_ID_MSK, core->id); + + regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, + core->layout->endiv_mask, 0); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + spin_unlock_irqrestore(core->lock, flags); + } +@@ -507,8 +510,8 @@ static int sam9x60_div_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate, + div->div = DIV_ROUND_CLOSEST(parent_rate, rate) - 1; + + spin_lock_irqsave(core->lock, irqflags); +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, +- core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, ++ core->id); + regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val); + cdiv = (val & core->layout->div_mask) >> core->layout->div_shift; + +@@ -563,8 +566,8 @@ static int sam9x60_div_pll_notifier_fn(struct notifier_block *notifier, + div->div = div->safe_div; + + spin_lock_irqsave(core.lock, irqflags); +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, +- core.id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, ++ core.id); + regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val); + cdiv = (val & core.layout->div_mask) >> core.layout->div_shift; + +-- +2.51.0 + diff --git a/queue-6.1/clk-sunxi-ng-sun6i-rtc-add-a523-specifics.patch b/queue-6.1/clk-sunxi-ng-sun6i-rtc-add-a523-specifics.patch new file mode 100644 index 0000000000..f2b08dc970 --- /dev/null +++ b/queue-6.1/clk-sunxi-ng-sun6i-rtc-add-a523-specifics.patch @@ -0,0 +1,57 @@ +From edabc77b0da4fc325a7b7f23cc79b58e5c44b9ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 01:09:47 +0800 +Subject: clk: sunxi-ng: sun6i-rtc: Add A523 specifics + +From: Chen-Yu Tsai + +[ Upstream commit 7aa8781f379c32c31bd78f1408a31765b2297c43 ] + +The A523's RTC block is backward compatible with the R329's, but it also +has a calibration function for its internal oscillator, which would +allow it to provide a clock rate closer to the desired 32.768 KHz. This +is useful on the Radxa Cubie A5E, which does not have an external 32.768 +KHz crystal. + +Add new compatible-specific data for it. + +Acked-by: Jernej Skrabec +Link: https://patch.msgid.link/20250909170947.2221611-1-wens@kernel.org +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi-ng/ccu-sun6i-rtc.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c b/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c +index d65398497d5f6..e42348bda20f8 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c ++++ b/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c +@@ -323,6 +323,13 @@ static const struct sun6i_rtc_match_data sun50i_r329_rtc_ccu_data = { + .osc32k_fanout_nparents = ARRAY_SIZE(sun50i_r329_osc32k_fanout_parents), + }; + ++static const struct sun6i_rtc_match_data sun55i_a523_rtc_ccu_data = { ++ .have_ext_osc32k = true, ++ .have_iosc_calibration = true, ++ .osc32k_fanout_parents = sun50i_r329_osc32k_fanout_parents, ++ .osc32k_fanout_nparents = ARRAY_SIZE(sun50i_r329_osc32k_fanout_parents), ++}; ++ + static const struct of_device_id sun6i_rtc_ccu_match[] = { + { + .compatible = "allwinner,sun50i-h616-rtc", +@@ -332,6 +339,10 @@ static const struct of_device_id sun6i_rtc_ccu_match[] = { + .compatible = "allwinner,sun50i-r329-rtc", + .data = &sun50i_r329_rtc_ccu_data, + }, ++ { ++ .compatible = "allwinner,sun55i-a523-rtc", ++ .data = &sun55i_a523_rtc_ccu_data, ++ }, + {}, + }; + +-- +2.51.0 + diff --git a/queue-6.1/clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch b/queue-6.1/clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch new file mode 100644 index 0000000000..d99a82e64d --- /dev/null +++ b/queue-6.1/clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch @@ -0,0 +1,44 @@ +From db779ee61260ac8faf91d3aeb9ad54f266bdd343 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 16:08:11 +0200 +Subject: clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled + +From: Matthias Schiffer + +[ Upstream commit 1e0d75258bd09323cb452655549e03975992b29e ] + +As described in AM335x Errata Advisory 1.0.42, WKUP_DEBUGSS_CLKCTRL +can't be disabled - the clock module will just be stuck in transitioning +state forever, resulting in the following warning message after the wait +loop times out: + + l3-aon-clkctrl:0000:0: failed to disable + +Just add the clock to enable_init_clks, so no attempt is made to disable +it. + +Signed-off-by: Matthias Schiffer +Signed-off-by: Alexander Stein +Acked-by: Kevin Hilman +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/ti/clk-33xx.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/ti/clk-33xx.c b/drivers/clk/ti/clk-33xx.c +index 85c50ea39e6da..9269e6a0db6a4 100644 +--- a/drivers/clk/ti/clk-33xx.c ++++ b/drivers/clk/ti/clk-33xx.c +@@ -258,6 +258,8 @@ static const char *enable_init_clks[] = { + "dpll_ddr_m2_ck", + "dpll_mpu_m2_ck", + "l3_gclk", ++ /* WKUP_DEBUGSS_CLKCTRL - disable fails, AM335x Errata Advisory 1.0.42 */ ++ "l3-aon-clkctrl:0000:0", + /* AM3_L3_L3_MAIN_CLKCTRL, needed during suspend */ + "l3-clkctrl:00bc:0", + "l4hs_gclk", +-- +2.51.0 + diff --git a/queue-6.1/cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch b/queue-6.1/cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch new file mode 100644 index 0000000000..e50057b7e9 --- /dev/null +++ b/queue-6.1/cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch @@ -0,0 +1,102 @@ +From ddc4f9c71c13b5ca1cdc941c4d86c302148cd639 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 21:48:13 -0500 +Subject: cpufreq: tegra186: Initialize all cores to max frequencies + +From: Aaron Kling + +[ Upstream commit ba6018929165fc914c665f071f8e8cdbac844a49 ] + +During initialization, the EDVD_COREx_VOLT_FREQ registers for some cores +are still at reset values and not reflecting the actual frequency. This +causes get calls to fail. Set all cores to their respective max +frequency during probe to initialize the registers to working values. + +Suggested-by: Mikko Perttunen +Signed-off-by: Aaron Kling +Reviewed-by: Mikko Perttunen +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/tegra186-cpufreq.c | 27 +++++++++++++++++++++------ + 1 file changed, 21 insertions(+), 6 deletions(-) + +diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c +index ee57676bbee14..db27aa0e35074 100644 +--- a/drivers/cpufreq/tegra186-cpufreq.c ++++ b/drivers/cpufreq/tegra186-cpufreq.c +@@ -132,13 +132,14 @@ static struct cpufreq_driver tegra186_cpufreq_driver = { + + static struct cpufreq_frequency_table *init_vhint_table( + struct platform_device *pdev, struct tegra_bpmp *bpmp, +- struct tegra186_cpufreq_cluster *cluster, unsigned int cluster_id) ++ struct tegra186_cpufreq_cluster *cluster, unsigned int cluster_id, ++ int *num_rates) + { + struct cpufreq_frequency_table *table; + struct mrq_cpu_vhint_request req; + struct tegra_bpmp_message msg; + struct cpu_vhint_data *data; +- int err, i, j, num_rates = 0; ++ int err, i, j; + dma_addr_t phys; + void *virt; + +@@ -168,6 +169,7 @@ static struct cpufreq_frequency_table *init_vhint_table( + goto free; + } + ++ *num_rates = 0; + for (i = data->vfloor; i <= data->vceil; i++) { + u16 ndiv = data->ndiv[i]; + +@@ -178,10 +180,10 @@ static struct cpufreq_frequency_table *init_vhint_table( + if (i > 0 && ndiv == data->ndiv[i - 1]) + continue; + +- num_rates++; ++ (*num_rates)++; + } + +- table = devm_kcalloc(&pdev->dev, num_rates + 1, sizeof(*table), ++ table = devm_kcalloc(&pdev->dev, *num_rates + 1, sizeof(*table), + GFP_KERNEL); + if (!table) { + table = ERR_PTR(-ENOMEM); +@@ -223,7 +225,9 @@ static int tegra186_cpufreq_probe(struct platform_device *pdev) + { + struct tegra186_cpufreq_data *data; + struct tegra_bpmp *bpmp; +- unsigned int i = 0, err; ++ unsigned int i = 0, err, edvd_offset; ++ int num_rates = 0; ++ u32 edvd_val, cpu; + + data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL); + if (!data) +@@ -249,10 +253,21 @@ static int tegra186_cpufreq_probe(struct platform_device *pdev) + for (i = 0; i < TEGRA186_NUM_CLUSTERS; i++) { + struct tegra186_cpufreq_cluster *cluster = &data->clusters[i]; + +- cluster->table = init_vhint_table(pdev, bpmp, cluster, i); ++ cluster->table = init_vhint_table(pdev, bpmp, cluster, i, &num_rates); + if (IS_ERR(cluster->table)) { + err = PTR_ERR(cluster->table); + goto put_bpmp; ++ } else if (!num_rates) { ++ err = -EINVAL; ++ goto put_bpmp; ++ } ++ ++ for (cpu = 0; cpu < ARRAY_SIZE(tegra186_cpus); cpu++) { ++ if (data->cpus[cpu].bpmp_cluster_id == i) { ++ edvd_val = cluster->table[num_rates - 1].driver_data; ++ edvd_offset = data->cpus[cpu].edvd_offset; ++ writel(edvd_val, data->regs + edvd_offset); ++ } + } + } + +-- +2.51.0 + diff --git a/queue-6.1/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch b/queue-6.1/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch new file mode 100644 index 0000000000..42dfdf9234 --- /dev/null +++ b/queue-6.1/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch @@ -0,0 +1,69 @@ +From c85b3d6d031b54580b26bb3cc195b977b818c166 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 03:32:09 -0400 +Subject: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds + +From: Albin Babu Varghese + +[ Upstream commit 3637d34b35b287ab830e66048841ace404382b67 ] + +Add bounds checking to prevent writes past framebuffer boundaries when +rendering text near screen edges. Return early if the Y position is off-screen +and clip image height to screen boundary. Break from the rendering loop if the +X position is off-screen. When clipping image width to fit the screen, update +the character count to match the clipped width to prevent buffer size +mismatches. + +Without the character count update, bit_putcs_aligned and bit_putcs_unaligned +receive mismatched parameters where the buffer is allocated for the clipped +width but cnt reflects the original larger count, causing out-of-bounds writes. + +Reported-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190 +Suggested-by: Helge Deller +Tested-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com +Signed-off-by: Albin Babu Varghese +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/core/bitblit.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c +index a4b4e1ec702e5..8563264d11fac 100644 +--- a/drivers/video/fbdev/core/bitblit.c ++++ b/drivers/video/fbdev/core/bitblit.c +@@ -168,6 +168,11 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, + image.height = vc->vc_font.height; + image.depth = 1; + ++ if (image.dy >= info->var.yres) ++ return; ++ ++ image.height = min(image.height, info->var.yres - image.dy); ++ + if (attribute) { + buf = kmalloc(cellsize, GFP_ATOMIC); + if (!buf) +@@ -181,6 +186,18 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, + cnt = count; + + image.width = vc->vc_font.width * cnt; ++ ++ if (image.dx >= info->var.xres) ++ break; ++ ++ if (image.dx + image.width > info->var.xres) { ++ image.width = info->var.xres - image.dx; ++ cnt = image.width / vc->vc_font.width; ++ if (cnt == 0) ++ break; ++ image.width = cnt * vc->vc_font.width; ++ } ++ + pitch = DIV_ROUND_UP(image.width, 8) + scan_align; + pitch &= ~scan_align; + size = pitch * image.height + buf_align; +-- +2.51.0 + diff --git a/queue-6.1/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch b/queue-6.1/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch new file mode 100644 index 0000000000..1536b43c9e --- /dev/null +++ b/queue-6.1/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch @@ -0,0 +1,97 @@ +From 6936edd0b11ff4aacc0d0ca572c759c885e6614d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 May 2025 20:44:34 -0500 +Subject: fs/hpfs: Fix error code for new_inode() failure in + mkdir/create/mknod/symlink + +From: Yikang Yue + +[ Upstream commit 32058c38d3b79a28963a59ac0353644dc24775cd ] + +The function call new_inode() is a primitive for allocating an inode in memory, +rather than planning disk space for it. Therefore, -ENOMEM should be returned +as the error code rather than -ENOSPC. + +To be specific, new_inode()'s call path looks like this: +new_inode + new_inode_pseudo + alloc_inode + ops->alloc_inode (hpfs_alloc_inode) + alloc_inode_sb + kmem_cache_alloc_lru + +Therefore, the failure of new_inode() indicates a memory presure issue (-ENOMEM), +not a lack of disk space. However, the current implementation of +hpfs_mkdir/create/mknod/symlink incorrectly returns -ENOSPC when new_inode() fails. +This patch fix this by set err to -ENOMEM before the goto statement. + +BTW, we also noticed that other nested calls within these four functions, +like hpfs_alloc_f/dnode and hpfs_add_dirent, might also fail due to memory presure. +But similarly, only -ENOSPC is returned. Addressing these will involve code +modifications in other functions, and we plan to submit dedicated patches for these +issues in the future. For this patch, we focus on new_inode(). + +Signed-off-by: Yikang Yue +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + fs/hpfs/namei.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c +index 15fc63276caae..63779d978c6db 100644 +--- a/fs/hpfs/namei.c ++++ b/fs/hpfs/namei.c +@@ -53,8 +53,10 @@ static int hpfs_mkdir(struct user_namespace *mnt_userns, struct inode *dir, + dee.fnode = cpu_to_le32(fno); + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail2; ++ } + hpfs_init_inode(result); + result->i_ino = fno; + hpfs_i(result)->i_parent_dir = dir->i_ino; +@@ -156,9 +158,10 @@ static int hpfs_create(struct user_namespace *mnt_userns, struct inode *dir, + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail1; +- ++ } + hpfs_init_inode(result); + result->i_ino = fno; + result->i_mode |= S_IFREG; +@@ -244,9 +247,10 @@ static int hpfs_mknod(struct user_namespace *mnt_userns, struct inode *dir, + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail1; +- ++ } + hpfs_init_inode(result); + result->i_ino = fno; + hpfs_i(result)->i_parent_dir = dir->i_ino; +@@ -321,8 +325,10 @@ static int hpfs_symlink(struct user_namespace *mnt_userns, struct inode *dir, + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail1; ++ } + result->i_ino = fno; + hpfs_init_inode(result); + hpfs_i(result)->i_parent_dir = dir->i_ino; +-- +2.51.0 + diff --git a/queue-6.1/kbuild-uapi-strip-comments-before-size-type-check.patch b/queue-6.1/kbuild-uapi-strip-comments-before-size-type-check.patch new file mode 100644 index 0000000000..5b819d3b2d --- /dev/null +++ b/queue-6.1/kbuild-uapi-strip-comments-before-size-type-check.patch @@ -0,0 +1,52 @@ +From acb3f652aa865e40d1203c3f662bcef61665c2b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Oct 2025 14:33:42 +0200 +Subject: kbuild: uapi: Strip comments before size type check +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit 66128f4287b04aef4d4db9bf5035985ab51487d5 ] + +On m68k, check_sizetypes in headers_check reports: + + ./usr/include/asm/bootinfo-amiga.h:17: found __[us]{8,16,32,64} type without #include + +This header file does not use any of the Linux-specific integer types, +but merely refers to them from comments, so this is a false positive. +As of commit c3a9d74ee413bdb3 ("kbuild: uapi: upgrade check_sizetypes() +warning to error"), this check was promoted to an error, breaking m68k +all{mod,yes}config builds. + +Fix this by stripping simple comments before looking for Linux-specific +integer types. + +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Thomas Weißschuh +Link: https://patch.msgid.link/949f096337e28d50510e970ae3ba3ec9c1342ec0.1759753998.git.geert@linux-m68k.org +[nathan: Adjust comment and remove unnecessary escaping from slashes in + regex] +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + usr/include/headers_check.pl | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/usr/include/headers_check.pl b/usr/include/headers_check.pl +index b6aec5e4365f9..682980781eb37 100755 +--- a/usr/include/headers_check.pl ++++ b/usr/include/headers_check.pl +@@ -160,6 +160,8 @@ sub check_sizetypes + if (my $included = ($line =~ /^\s*#\s*include\s+[<"](\S+)[>"]/)[0]) { + check_include_typesh($included); + } ++ # strip single-line comments, as types may be referenced within them ++ $line =~ s@/\*.*?\*/@@; + if ($line =~ m/__[us](8|16|32|64)\b/) { + printf STDERR "$filename:$lineno: " . + "found __[us]{8,16,32,64} type " . +-- +2.51.0 + diff --git a/queue-6.1/ntb-epf-allow-arbitrary-bar-mapping.patch b/queue-6.1/ntb-epf-allow-arbitrary-bar-mapping.patch new file mode 100644 index 0000000000..ea127e1b90 --- /dev/null +++ b/queue-6.1/ntb-epf-allow-arbitrary-bar-mapping.patch @@ -0,0 +1,246 @@ +From e627e3158d013b9671d0a03b61526299adf95099 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Jul 2025 18:48:33 +0200 +Subject: NTB: epf: Allow arbitrary BAR mapping + +From: Jerome Brunet + +[ Upstream commit 5ad865862a0fd349163243e1834ed98ba9b81905 ] + +The NTB epf host driver assumes the BAR number associated with a memory +window is just incremented from the BAR number associated with MW1. This +seems to have been enough so far but this is not really how the endpoint +side work and the two could easily become mis-aligned. + +ntb_epf_mw_to_bar() even assumes that the BAR number is the memory window +index + 2, which means the function only returns a proper result if BAR_2 +is associated with MW1. + +Instead, fully describe and allow arbitrary NTB BAR mapping. + +Signed-off-by: Jerome Brunet +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/hw/epf/ntb_hw_epf.c | 103 ++++++++++++++++---------------- + 1 file changed, 53 insertions(+), 50 deletions(-) + +diff --git a/drivers/ntb/hw/epf/ntb_hw_epf.c b/drivers/ntb/hw/epf/ntb_hw_epf.c +index 3ece49cb18ffa..9a0745664dcc7 100644 +--- a/drivers/ntb/hw/epf/ntb_hw_epf.c ++++ b/drivers/ntb/hw/epf/ntb_hw_epf.c +@@ -49,6 +49,7 @@ + #define NTB_EPF_COMMAND_TIMEOUT 1000 /* 1 Sec */ + + enum pci_barno { ++ NO_BAR = -1, + BAR_0, + BAR_1, + BAR_2, +@@ -57,16 +58,26 @@ enum pci_barno { + BAR_5, + }; + ++enum epf_ntb_bar { ++ BAR_CONFIG, ++ BAR_PEER_SPAD, ++ BAR_DB, ++ BAR_MW1, ++ BAR_MW2, ++ BAR_MW3, ++ BAR_MW4, ++ NTB_BAR_NUM, ++}; ++ ++#define NTB_EPF_MAX_MW_COUNT (NTB_BAR_NUM - BAR_MW1) ++ + struct ntb_epf_dev { + struct ntb_dev ntb; + struct device *dev; + /* Mutex to protect providing commands to NTB EPF */ + struct mutex cmd_lock; + +- enum pci_barno ctrl_reg_bar; +- enum pci_barno peer_spad_reg_bar; +- enum pci_barno db_reg_bar; +- enum pci_barno mw_bar; ++ const enum pci_barno *barno_map; + + unsigned int mw_count; + unsigned int spad_count; +@@ -85,17 +96,6 @@ struct ntb_epf_dev { + + #define ntb_ndev(__ntb) container_of(__ntb, struct ntb_epf_dev, ntb) + +-struct ntb_epf_data { +- /* BAR that contains both control region and self spad region */ +- enum pci_barno ctrl_reg_bar; +- /* BAR that contains peer spad region */ +- enum pci_barno peer_spad_reg_bar; +- /* BAR that contains Doorbell region and Memory window '1' */ +- enum pci_barno db_reg_bar; +- /* BAR that contains memory windows*/ +- enum pci_barno mw_bar; +-}; +- + static int ntb_epf_send_command(struct ntb_epf_dev *ndev, u32 command, + u32 argument) + { +@@ -144,7 +144,7 @@ static int ntb_epf_mw_to_bar(struct ntb_epf_dev *ndev, int idx) + return -EINVAL; + } + +- return idx + 2; ++ return ndev->barno_map[BAR_MW1 + idx]; + } + + static int ntb_epf_mw_count(struct ntb_dev *ntb, int pidx) +@@ -413,7 +413,9 @@ static int ntb_epf_mw_set_trans(struct ntb_dev *ntb, int pidx, int idx, + return -EINVAL; + } + +- bar = idx + ndev->mw_bar; ++ bar = ntb_epf_mw_to_bar(ndev, idx); ++ if (bar < 0) ++ return bar; + + mw_size = pci_resource_len(ntb->pdev, bar); + +@@ -455,7 +457,9 @@ static int ntb_epf_peer_mw_get_addr(struct ntb_dev *ntb, int idx, + if (idx == 0) + offset = readl(ndev->ctrl_reg + NTB_EPF_MW1_OFFSET); + +- bar = idx + ndev->mw_bar; ++ bar = ntb_epf_mw_to_bar(ndev, idx); ++ if (bar < 0) ++ return bar; + + if (base) + *base = pci_resource_start(ndev->ntb.pdev, bar) + offset; +@@ -560,6 +564,11 @@ static int ntb_epf_init_dev(struct ntb_epf_dev *ndev) + ndev->mw_count = readl(ndev->ctrl_reg + NTB_EPF_MW_COUNT); + ndev->spad_count = readl(ndev->ctrl_reg + NTB_EPF_SPAD_COUNT); + ++ if (ndev->mw_count > NTB_EPF_MAX_MW_COUNT) { ++ dev_err(dev, "Unsupported MW count: %u\n", ndev->mw_count); ++ return -EINVAL; ++ } ++ + return 0; + } + +@@ -596,14 +605,15 @@ static int ntb_epf_init_pci(struct ntb_epf_dev *ndev, + dev_warn(&pdev->dev, "Cannot DMA highmem\n"); + } + +- ndev->ctrl_reg = pci_iomap(pdev, ndev->ctrl_reg_bar, 0); ++ ndev->ctrl_reg = pci_iomap(pdev, ndev->barno_map[BAR_CONFIG], 0); + if (!ndev->ctrl_reg) { + ret = -EIO; + goto err_dma_mask; + } + +- if (ndev->peer_spad_reg_bar) { +- ndev->peer_spad_reg = pci_iomap(pdev, ndev->peer_spad_reg_bar, 0); ++ if (ndev->barno_map[BAR_PEER_SPAD] != ndev->barno_map[BAR_CONFIG]) { ++ ndev->peer_spad_reg = pci_iomap(pdev, ++ ndev->barno_map[BAR_PEER_SPAD], 0); + if (!ndev->peer_spad_reg) { + ret = -EIO; + goto err_dma_mask; +@@ -614,7 +624,7 @@ static int ntb_epf_init_pci(struct ntb_epf_dev *ndev, + ndev->peer_spad_reg = ndev->ctrl_reg + spad_off + spad_sz; + } + +- ndev->db_reg = pci_iomap(pdev, ndev->db_reg_bar, 0); ++ ndev->db_reg = pci_iomap(pdev, ndev->barno_map[BAR_DB], 0); + if (!ndev->db_reg) { + ret = -EIO; + goto err_dma_mask; +@@ -663,12 +673,7 @@ static void ntb_epf_cleanup_isr(struct ntb_epf_dev *ndev) + static int ntb_epf_pci_probe(struct pci_dev *pdev, + const struct pci_device_id *id) + { +- enum pci_barno peer_spad_reg_bar = BAR_1; +- enum pci_barno ctrl_reg_bar = BAR_0; +- enum pci_barno db_reg_bar = BAR_2; +- enum pci_barno mw_bar = BAR_2; + struct device *dev = &pdev->dev; +- struct ntb_epf_data *data; + struct ntb_epf_dev *ndev; + int ret; + +@@ -679,18 +684,10 @@ static int ntb_epf_pci_probe(struct pci_dev *pdev, + if (!ndev) + return -ENOMEM; + +- data = (struct ntb_epf_data *)id->driver_data; +- if (data) { +- peer_spad_reg_bar = data->peer_spad_reg_bar; +- ctrl_reg_bar = data->ctrl_reg_bar; +- db_reg_bar = data->db_reg_bar; +- mw_bar = data->mw_bar; +- } ++ ndev->barno_map = (const enum pci_barno *)id->driver_data; ++ if (!ndev->barno_map) ++ return -EINVAL; + +- ndev->peer_spad_reg_bar = peer_spad_reg_bar; +- ndev->ctrl_reg_bar = ctrl_reg_bar; +- ndev->db_reg_bar = db_reg_bar; +- ndev->mw_bar = mw_bar; + ndev->dev = dev; + + ntb_epf_init_struct(ndev, pdev); +@@ -734,30 +731,36 @@ static void ntb_epf_pci_remove(struct pci_dev *pdev) + ntb_epf_deinit_pci(ndev); + } + +-static const struct ntb_epf_data j721e_data = { +- .ctrl_reg_bar = BAR_0, +- .peer_spad_reg_bar = BAR_1, +- .db_reg_bar = BAR_2, +- .mw_bar = BAR_2, ++static const enum pci_barno j721e_map[NTB_BAR_NUM] = { ++ [BAR_CONFIG] = BAR_0, ++ [BAR_PEER_SPAD] = BAR_1, ++ [BAR_DB] = BAR_2, ++ [BAR_MW1] = BAR_2, ++ [BAR_MW2] = BAR_3, ++ [BAR_MW3] = BAR_4, ++ [BAR_MW4] = BAR_5 + }; + +-static const struct ntb_epf_data mx8_data = { +- .ctrl_reg_bar = BAR_0, +- .peer_spad_reg_bar = BAR_0, +- .db_reg_bar = BAR_2, +- .mw_bar = BAR_4, ++static const enum pci_barno mx8_map[NTB_BAR_NUM] = { ++ [BAR_CONFIG] = BAR_0, ++ [BAR_PEER_SPAD] = BAR_0, ++ [BAR_DB] = BAR_2, ++ [BAR_MW1] = BAR_4, ++ [BAR_MW2] = BAR_5, ++ [BAR_MW3] = NO_BAR, ++ [BAR_MW4] = NO_BAR + }; + + static const struct pci_device_id ntb_epf_pci_tbl[] = { + { + PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_J721E), + .class = PCI_CLASS_MEMORY_RAM << 8, .class_mask = 0xffff00, +- .driver_data = (kernel_ulong_t)&j721e_data, ++ .driver_data = (kernel_ulong_t)j721e_map, + }, + { + PCI_DEVICE(PCI_VENDOR_ID_FREESCALE, 0x0809), + .class = PCI_CLASS_MEMORY_RAM << 8, .class_mask = 0xffff00, +- .driver_data = (kernel_ulong_t)&mx8_data, ++ .driver_data = (kernel_ulong_t)mx8_map, + }, + { }, + }; +-- +2.51.0 + diff --git a/queue-6.1/rtc-pcf2127-clear-minute-second-interrupt.patch b/queue-6.1/rtc-pcf2127-clear-minute-second-interrupt.patch new file mode 100644 index 0000000000..7a6e384982 --- /dev/null +++ b/queue-6.1/rtc-pcf2127-clear-minute-second-interrupt.patch @@ -0,0 +1,70 @@ +From c8ae7744b156370f43fe893276a969e3befac1df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 19:54:09 +0200 +Subject: rtc: pcf2127: clear minute/second interrupt + +From: Josua Mayer + +[ Upstream commit a6f1a4f05970664004a9370459c6799c1b2f2dcf ] + +PCF2127 can generate interrupt every full second or minute configured +from control and status register 1, bits MI (1) and SI (0). + +On interrupt control register 2 bit MSF (7) is set and must be cleared +to continue normal operation. + +While the driver never enables this interrupt on its own, users or +firmware may do so - e.g. as an easy way to test the interrupt. + +Add preprocessor definition for MSF bit and include it in the irq +bitmask to ensure minute and second interrupts are cleared when fired. + +This fixes an issue where the rtc enters a test mode and becomes +unresponsive after a second interrupt has fired and is not cleared in +time. In this state register writes to control registers have no +effect and the interrupt line is kept asserted [1]: + +[1] userspace commands to put rtc into unresponsive state: +$ i2cget -f -y 2 0x51 0x00 +0x04 +$ i2cset -f -y 2 0x51 0x00 0x05 # set bit 0 SI +$ i2cget -f -y 2 0x51 0x00 +0x84 # bit 8 EXT_TEST set +$ i2cset -f -y 2 0x51 0x00 0x05 # try overwrite control register +$ i2cget -f -y 2 0x51 0x00 +0x84 # no change + +Signed-off-by: Josua Mayer +Reviewed-by: Bruno Thomsen +Link: https://lore.kernel.org/r/20250825-rtc-irq-v1-1-0133319406a7@solid-run.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-pcf2127.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c +index 87f4fc9df68b4..ae2c52a0dab25 100644 +--- a/drivers/rtc/rtc-pcf2127.c ++++ b/drivers/rtc/rtc-pcf2127.c +@@ -35,6 +35,7 @@ + #define PCF2127_BIT_CTRL2_AF BIT(4) + #define PCF2127_BIT_CTRL2_TSF2 BIT(5) + #define PCF2127_BIT_CTRL2_WDTF BIT(6) ++#define PCF2127_BIT_CTRL2_MSF BIT(7) + /* Control register 3 */ + #define PCF2127_REG_CTRL3 0x02 + #define PCF2127_BIT_CTRL3_BLIE BIT(0) +@@ -99,7 +100,8 @@ + #define PCF2127_CTRL2_IRQ_MASK ( \ + PCF2127_BIT_CTRL2_AF | \ + PCF2127_BIT_CTRL2_WDTF | \ +- PCF2127_BIT_CTRL2_TSF2) ++ PCF2127_BIT_CTRL2_TSF2 | \ ++ PCF2127_BIT_CTRL2_MSF) + + struct pcf2127 { + struct rtc_device *rtc; +-- +2.51.0 + diff --git a/queue-6.1/scsi-ufs-core-include-utp-error-in-int_fatal_errors.patch b/queue-6.1/scsi-ufs-core-include-utp-error-in-int_fatal_errors.patch new file mode 100644 index 0000000000..322edccfd6 --- /dev/null +++ b/queue-6.1/scsi-ufs-core-include-utp-error-in-int_fatal_errors.patch @@ -0,0 +1,77 @@ +From 3ad113273a7f180112c32ace3c186a2e5846012d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 15:14:28 +0900 +Subject: scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS + +From: Hoyoung Seo + +[ Upstream commit 558ae4579810fa0fef011944230c65a6f3087f85 ] + +When a UTP error occurs in isolation, UFS is not currently recoverable. +This is because the UTP error is not considered fatal in the error +handling code, leading to either an I/O timeout or an OCS error. + +Add the UTP error flag to INT_FATAL_ERRORS so the controller will be +reset in this situation. + + sd 0:0:0:0: [sda] tag#38 UNKNOWN(0x2003) Result: hostbyte=0x07 + driverbyte=DRIVER_OK cmd_age=0s + sd 0:0:0:0: [sda] tag#38 CDB: opcode=0x28 28 00 00 51 24 e2 00 00 08 00 + I/O error, dev sda, sector 42542864 op 0x0:(READ) flags 0x80700 phys_seg + 8 prio class 2 + OCS error from controller = 9 for tag 39 + pa_err[1] = 0x80000010 at 2667224756 us + pa_err: total cnt=2 + dl_err[0] = 0x80000002 at 2667148060 us + dl_err[1] = 0x80002000 at 2667282844 us + No record of nl_err + No record of tl_err + No record of dme_err + No record of auto_hibern8_err + fatal_err[0] = 0x804 at 2667282836 us + + --------------------------------------------------- + REGISTER + --------------------------------------------------- + NAME OFFSET VALUE + STD HCI SFR 0xfffffff0 0x0 + AHIT 0x18 0x814 + INTERRUPT STATUS 0x20 0x1000 + INTERRUPT ENABLE 0x24 0x70ef5 + +[mkp: commit desc] + +Signed-off-by: Hoyoung Seo +Reviewed-by: Bart Van Assche +Message-Id: <20250930061428.617955-1-hy50.seo@samsung.com> +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + include/ufs/ufshci.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/include/ufs/ufshci.h b/include/ufs/ufshci.h +index f525566a0864d..6e80ed46e44ae 100644 +--- a/include/ufs/ufshci.h ++++ b/include/ufs/ufshci.h +@@ -123,6 +123,7 @@ static inline u32 ufshci_version(u32 major, u32 minor) + #define UTP_TASK_REQ_COMPL 0x200 + #define UIC_COMMAND_COMPL 0x400 + #define DEVICE_FATAL_ERROR 0x800 ++#define UTP_ERROR 0x1000 + #define CONTROLLER_FATAL_ERROR 0x10000 + #define SYSTEM_BUS_FATAL_ERROR 0x20000 + #define CRYPTO_ENGINE_FATAL_ERROR 0x40000 +@@ -141,7 +142,8 @@ static inline u32 ufshci_version(u32 major, u32 minor) + CONTROLLER_FATAL_ERROR |\ + SYSTEM_BUS_FATAL_ERROR |\ + CRYPTO_ENGINE_FATAL_ERROR |\ +- UIC_LINK_LOST) ++ UIC_LINK_LOST |\ ++ UTP_ERROR) + + /* HCS - Host Controller Status 30h */ + #define DEVICE_PRESENT 0x1 +-- +2.51.0 + diff --git a/queue-6.1/series b/queue-6.1/series index c02850c7c0..67d2e71291 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -277,3 +277,24 @@ rdma-irdma-set-irdma_cq-cq_num-field-during-cq-creat.patch rdma-hns-fix-the-modification-of-max_send_sge.patch rdma-hns-fix-wrong-wqe-data-when-qp-wraps-around.patch btrfs-mark-dirty-extent-range-for-out-of-bound-preal.patch +fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch +um-fix-help-message-for-ssl-non-raw.patch +clk-sunxi-ng-sun6i-rtc-add-a523-specifics.patch +rtc-pcf2127-clear-minute-second-interrupt.patch +arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch +clk-at91-clk-master-add-check-for-divide-by-3.patch +clk-at91-clk-sam9x60-pll-force-write-to-pll_updt-reg.patch +clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch +ntb-epf-allow-arbitrary-bar-mapping.patch +9p-fix-sys-fs-9p-caches-overwriting-itself.patch +cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch +9p-sysfs_init-don-t-hardcode-error-to-enomem.patch +scsi-ufs-core-include-utp-error-in-int_fatal_errors.patch +acpi-property-return-present-device-nodes-only-on-fw.patch +tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch +tools-lib-thermal-don-t-preserve-owner-in-install.patch +tools-lib-thermal-use-pkg-config-to-locate-libnl3.patch +fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch +kbuild-uapi-strip-comments-before-size-type-check.patch +asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch +ceph-add-checking-of-wait_for_completion_killable-re.patch diff --git a/queue-6.1/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch b/queue-6.1/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch new file mode 100644 index 0000000000..554c615303 --- /dev/null +++ b/queue-6.1/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch @@ -0,0 +1,66 @@ +From 78a7c2b6a8c7e4bdd9de99068a267f264db370ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 15:47:06 -0700 +Subject: tools bitmap: Add missing asm-generic/bitsperlong.h include +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ian Rogers + +[ Upstream commit f38ce0209ab4553906b44bd1159e35c740a84161 ] + +small_const_nbits is defined in asm-generic/bitsperlong.h which +bitmap.h uses but doesn't include causing build failures in some build +systems. Add the missing #include. + +Note the bitmap.h in tools has diverged from that of the kernel, so no +changes are made there. + +Signed-off-by: Ian Rogers +Acked-by: Yury Norov +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: André Almeida +Cc: Daniel Borkmann +Cc: Darren Hart +Cc: David S. Miller +Cc: Davidlohr Bueso +Cc: Ido Schimmel +Cc: Ingo Molnar +Cc: Jakub Kicinski +Cc: Jamal Hadi Salim +Cc: Jason Xing +Cc: Jiri Olsa +Cc: Jonas Gottlieb +Cc: Kan Liang +Cc: Mark Rutland +Cc: Maurice Lambert +Cc: Namhyung Kim +Cc: Paolo Abeni +Cc: Peter Zijlstra +Cc: Petr Machata +Cc: Rasmus Villemoes +Cc: Thomas Gleixner +Cc: Yuyang Huang +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/include/linux/bitmap.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/include/linux/bitmap.h b/tools/include/linux/bitmap.h +index 2cbabc1dcf0fd..937e1e181775f 100644 +--- a/tools/include/linux/bitmap.h ++++ b/tools/include/linux/bitmap.h +@@ -3,6 +3,7 @@ + #define _TOOLS_LINUX_BITMAP_H + + #include ++#include + #include + #include + #include +-- +2.51.0 + diff --git a/queue-6.1/tools-lib-thermal-don-t-preserve-owner-in-install.patch b/queue-6.1/tools-lib-thermal-don-t-preserve-owner-in-install.patch new file mode 100644 index 0000000000..b28e3b1a7f --- /dev/null +++ b/queue-6.1/tools-lib-thermal-don-t-preserve-owner-in-install.patch @@ -0,0 +1,41 @@ +From 6b81c1fda8bf92bcf6bf7543b6475ebefa795d66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 13:40:56 +0200 +Subject: tools: lib: thermal: don't preserve owner in install + +From: Emil Dahl Juhl + +[ Upstream commit 1375152bb02ab2a8435e87ea27034482dbc95f57 ] + +Instead of preserving mode, timestamp, and owner, for the object files +during installation, just preserve the mode and timestamp. + +When installing as root, the installed files should be owned by root. +When installing as user, --preserve=ownership doesn't work anyway. This +makes --preserve=ownership rather pointless. + +Signed-off-by: Emil Dahl Juhl +Signed-off-by: Sascha Hauer +Acked-by: Daniel Lezcano +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + tools/lib/thermal/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/thermal/Makefile b/tools/lib/thermal/Makefile +index 8890fd57b110c..1694889847caf 100644 +--- a/tools/lib/thermal/Makefile ++++ b/tools/lib/thermal/Makefile +@@ -147,7 +147,7 @@ endef + install_lib: libs + $(call QUIET_INSTALL, $(LIBTHERMAL_ALL)) \ + $(call do_install_mkdir,$(libdir_SQ)); \ +- cp -fpR $(LIBTHERMAL_ALL) $(DESTDIR)$(libdir_SQ) ++ cp -fR --preserve=mode,timestamp $(LIBTHERMAL_ALL) $(DESTDIR)$(libdir_SQ) + + install_headers: + $(call QUIET_INSTALL, headers) \ +-- +2.51.0 + diff --git a/queue-6.1/tools-lib-thermal-use-pkg-config-to-locate-libnl3.patch b/queue-6.1/tools-lib-thermal-use-pkg-config-to-locate-libnl3.patch new file mode 100644 index 0000000000..fb3039df2c --- /dev/null +++ b/queue-6.1/tools-lib-thermal-use-pkg-config-to-locate-libnl3.patch @@ -0,0 +1,49 @@ +From 6791067336804318857912d4ffa16c772c81effa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 13:40:55 +0200 +Subject: tools: lib: thermal: use pkg-config to locate libnl3 + +From: Sascha Hauer + +[ Upstream commit b31f7f725cd932e2c2b41f3e4b66273653953687 ] + +To make libthermal more cross compile friendly use pkg-config to locate +libnl3. Only if that fails fall back to hardcoded /usr/include/libnl3. + +Signed-off-by: Sascha Hauer +Acked-by: Daniel Lezcano +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + tools/lib/thermal/Makefile | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/tools/lib/thermal/Makefile b/tools/lib/thermal/Makefile +index 1694889847caf..8d21ea1950a31 100644 +--- a/tools/lib/thermal/Makefile ++++ b/tools/lib/thermal/Makefile +@@ -59,8 +59,12 @@ else + CFLAGS := -g -Wall + endif + ++NL3_CFLAGS = $(shell pkg-config --cflags libnl-3.0 2>/dev/null) ++ifeq ($(NL3_CFLAGS),) ++NL3_CFLAGS = -I/usr/include/libnl3 ++endif ++ + INCLUDES = \ +--I/usr/include/libnl3 \ + -I$(srctree)/tools/lib/thermal/include \ + -I$(srctree)/tools/lib/ \ + -I$(srctree)/tools/include \ +@@ -72,6 +76,7 @@ INCLUDES = \ + override CFLAGS += $(EXTRA_WARNINGS) + override CFLAGS += -Werror -Wall + override CFLAGS += -fPIC ++override CFLAGS += $(NL3_CFLAGS) + override CFLAGS += $(INCLUDES) + override CFLAGS += -fvisibility=hidden + override CFGLAS += -Wl,-L. +-- +2.51.0 + diff --git a/queue-6.1/um-fix-help-message-for-ssl-non-raw.patch b/queue-6.1/um-fix-help-message-for-ssl-non-raw.patch new file mode 100644 index 0000000000..e9e27eff31 --- /dev/null +++ b/queue-6.1/um-fix-help-message-for-ssl-non-raw.patch @@ -0,0 +1,36 @@ +From 8c3a5703e1835fb1425475ab3a5d5c030e39c5f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 08:56:59 +0800 +Subject: um: Fix help message for ssl-non-raw + +From: Tiwei Bie + +[ Upstream commit 725e9d81868fcedaeef775948e699955b01631ae ] + +Add the missing option name in the help message. Additionally, +switch to __uml_help(), because this is a global option rather +than a per-channel option. + +Signed-off-by: Tiwei Bie +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + arch/um/drivers/ssl.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/um/drivers/ssl.c b/arch/um/drivers/ssl.c +index 277cea3d30eb5..8006a5bd578c2 100644 +--- a/arch/um/drivers/ssl.c ++++ b/arch/um/drivers/ssl.c +@@ -199,4 +199,7 @@ static int ssl_non_raw_setup(char *str) + return 1; + } + __setup("ssl-non-raw", ssl_non_raw_setup); +-__channel_help(ssl_non_raw_setup, "set serial lines to non-raw mode"); ++__uml_help(ssl_non_raw_setup, ++"ssl-non-raw\n" ++" Set serial lines to non-raw mode.\n\n" ++); +-- +2.51.0 + diff --git a/queue-6.12/9p-fix-sys-fs-9p-caches-overwriting-itself.patch b/queue-6.12/9p-fix-sys-fs-9p-caches-overwriting-itself.patch new file mode 100644 index 0000000000..bc865e0b25 --- /dev/null +++ b/queue-6.12/9p-fix-sys-fs-9p-caches-overwriting-itself.patch @@ -0,0 +1,41 @@ +From 8f190fb7d3b8d82cbc74cb588da1276b017941ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 18:27:30 +0900 +Subject: 9p: fix /sys/fs/9p/caches overwriting itself +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Randall P. Embry + +[ Upstream commit 86db0c32f16c5538ddb740f54669ace8f3a1f3d7 ] + +caches_show() overwrote its buffer on each iteration, +so only the last cache tag was visible in sysfs output. + +Properly append with snprintf(buf + count, …). + +Signed-off-by: Randall P. Embry +Message-ID: <20250926-v9fs_misc-v1-2-a8b3907fc04d@codewreck.org> +Signed-off-by: Dominique Martinet +Signed-off-by: Sasha Levin +--- + fs/9p/v9fs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c +index 281a1ed03a041..e35b30534787d 100644 +--- a/fs/9p/v9fs.c ++++ b/fs/9p/v9fs.c +@@ -561,7 +561,7 @@ static ssize_t caches_show(struct kobject *kobj, + spin_lock(&v9fs_sessionlist_lock); + list_for_each_entry(v9ses, &v9fs_sessionlist, slist) { + if (v9ses->cachetag) { +- n = snprintf(buf, limit, "%s\n", v9ses->cachetag); ++ n = snprintf(buf + count, limit, "%s\n", v9ses->cachetag); + if (n < 0) { + count = n; + break; +-- +2.51.0 + diff --git a/queue-6.12/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch b/queue-6.12/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch new file mode 100644 index 0000000000..8a247e7283 --- /dev/null +++ b/queue-6.12/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch @@ -0,0 +1,46 @@ +From 902f96a96938718ff1b8ba6850ae347fd0c1447e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 18:27:31 +0900 +Subject: 9p: sysfs_init: don't hardcode error to ENOMEM + +From: Randall P. Embry + +[ Upstream commit 528f218b31aac4bbfc58914d43766a22ab545d48 ] + +v9fs_sysfs_init() always returned -ENOMEM on failure; +return the actual sysfs_create_group() error instead. + +Signed-off-by: Randall P. Embry +Message-ID: <20250926-v9fs_misc-v1-3-a8b3907fc04d@codewreck.org> +Signed-off-by: Dominique Martinet +Signed-off-by: Sasha Levin +--- + fs/9p/v9fs.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c +index e35b30534787d..ccf00a948146a 100644 +--- a/fs/9p/v9fs.c ++++ b/fs/9p/v9fs.c +@@ -597,13 +597,16 @@ static const struct attribute_group v9fs_attr_group = { + + static int __init v9fs_sysfs_init(void) + { ++ int ret; ++ + v9fs_kobj = kobject_create_and_add("9p", fs_kobj); + if (!v9fs_kobj) + return -ENOMEM; + +- if (sysfs_create_group(v9fs_kobj, &v9fs_attr_group)) { ++ ret = sysfs_create_group(v9fs_kobj, &v9fs_attr_group); ++ if (ret) { + kobject_put(v9fs_kobj); +- return -ENOMEM; ++ return ret; + } + + return 0; +-- +2.51.0 + diff --git a/queue-6.12/9p-trans_fd-p9_fd_request-kick-rx-thread-if-epollin.patch b/queue-6.12/9p-trans_fd-p9_fd_request-kick-rx-thread-if-epollin.patch new file mode 100644 index 0000000000..ff88f03842 --- /dev/null +++ b/queue-6.12/9p-trans_fd-p9_fd_request-kick-rx-thread-if-epollin.patch @@ -0,0 +1,69 @@ +From f9e5fb5d6d0c79fb721b8947d4fc0416c890e740 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Aug 2025 18:10:13 +0200 +Subject: 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN + +From: Oleg Nesterov + +[ Upstream commit e8fe3f07a357c39d429e02ca34f740692d88967a ] + +p9_read_work() doesn't set Rworksched and doesn't do schedule_work(m->rq) +if list_empty(&m->req_list). + +However, if the pipe is full, we need to read more data and this used to +work prior to commit aaec5a95d59615 ("pipe_read: don't wake up the writer +if the pipe is still full"). + +p9_read_work() does p9_fd_read() -> ... -> anon_pipe_read() which (before +the commit above) triggered the unnecessary wakeup. This wakeup calls +p9_pollwake() which kicks p9_poll_workfn() -> p9_poll_mux(), p9_poll_mux() +will notice EPOLLIN and schedule_work(&m->rq). + +This no longer happens after the optimization above, change p9_fd_request() +to use p9_poll_mux() instead of only checking for EPOLLOUT. + +Reported-by: syzbot+d1b5dace43896bc386c3@syzkaller.appspotmail.com +Tested-by: syzbot+d1b5dace43896bc386c3@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/68a2de8f.050a0220.e29e5.0097.GAE@google.com/ +Link: https://lore.kernel.org/all/67dedd2f.050a0220.31a16b.003f.GAE@google.com/ +Co-developed-by: K Prateek Nayak +Signed-off-by: K Prateek Nayak +Signed-off-by: Oleg Nesterov +Tested-by: K Prateek Nayak +Message-ID: <20250819161013.GB11345@redhat.com> +Signed-off-by: Dominique Martinet +Signed-off-by: Sasha Levin +--- + net/9p/trans_fd.c | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c +index 7e9d731c45976..5bdfc25689169 100644 +--- a/net/9p/trans_fd.c ++++ b/net/9p/trans_fd.c +@@ -665,7 +665,6 @@ static void p9_poll_mux(struct p9_conn *m) + + static int p9_fd_request(struct p9_client *client, struct p9_req_t *req) + { +- __poll_t n; + int err; + struct p9_trans_fd *ts = client->trans; + struct p9_conn *m = &ts->conn; +@@ -685,13 +684,7 @@ static int p9_fd_request(struct p9_client *client, struct p9_req_t *req) + list_add_tail(&req->req_list, &m->unsent_req_list); + spin_unlock(&m->req_lock); + +- if (test_and_clear_bit(Wpending, &m->wsched)) +- n = EPOLLOUT; +- else +- n = p9_fd_poll(m->client, NULL, NULL); +- +- if (n & EPOLLOUT && !test_and_set_bit(Wworksched, &m->wsched)) +- schedule_work(&m->wq); ++ p9_poll_mux(m); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.12/acpi-property-return-present-device-nodes-only-on-fw.patch b/queue-6.12/acpi-property-return-present-device-nodes-only-on-fw.patch new file mode 100644 index 0000000000..e9296fc897 --- /dev/null +++ b/queue-6.12/acpi-property-return-present-device-nodes-only-on-fw.patch @@ -0,0 +1,75 @@ +From 8cd1a1763f1fc3ca2774fdf944014101943ff948 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 13:26:36 +0300 +Subject: ACPI: property: Return present device nodes only on fwnode interface + +From: Sakari Ailus + +[ Upstream commit d9f866b2bb3eec38b3734f1fed325ec7c55ccdfa ] + +fwnode_graph_get_next_subnode() may return fwnode backed by ACPI +device nodes and there has been no check these devices are present +in the system, unlike there has been on fwnode OF backend. + +In order to provide consistent behaviour towards callers, +add a check for device presence by introducing +a new function acpi_get_next_present_subnode(), used as the +get_next_child_node() fwnode operation that also checks device +node presence. + +Signed-off-by: Sakari Ailus +Reviewed-by: Laurent Pinchart +Reviewed-by: Jonathan Cameron +Link: https://patch.msgid.link/20251001102636.1272722-2-sakari.ailus@linux.intel.com +[ rjw: Kerneldoc comment and changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/property.c | 24 +++++++++++++++++++++++- + 1 file changed, 23 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c +index 342e7cef723cc..b51b947b0ca5b 100644 +--- a/drivers/acpi/property.c ++++ b/drivers/acpi/property.c +@@ -1357,6 +1357,28 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode, + return NULL; + } + ++/* ++ * acpi_get_next_present_subnode - Return the next present child node handle ++ * @fwnode: Firmware node to find the next child node for. ++ * @child: Handle to one of the device's child nodes or a null handle. ++ * ++ * Like acpi_get_next_subnode(), but the device nodes returned by ++ * acpi_get_next_present_subnode() are guaranteed to be present. ++ * ++ * Returns: The fwnode handle of the next present sub-node. ++ */ ++static struct fwnode_handle * ++acpi_get_next_present_subnode(const struct fwnode_handle *fwnode, ++ struct fwnode_handle *child) ++{ ++ do { ++ child = acpi_get_next_subnode(fwnode, child); ++ } while (is_acpi_device_node(child) && ++ !acpi_device_is_present(to_acpi_device_node(child))); ++ ++ return child; ++} ++ + /** + * acpi_node_get_parent - Return parent fwnode of this fwnode + * @fwnode: Firmware node whose parent to get +@@ -1700,7 +1722,7 @@ static int acpi_fwnode_irq_get(const struct fwnode_handle *fwnode, + .property_read_string_array = \ + acpi_fwnode_property_read_string_array, \ + .get_parent = acpi_node_get_parent, \ +- .get_next_child_node = acpi_get_next_subnode, \ ++ .get_next_child_node = acpi_get_next_present_subnode, \ + .get_named_child_node = acpi_fwnode_get_named_child_node, \ + .get_name = acpi_fwnode_get_name, \ + .get_name_prefix = acpi_fwnode_get_name_prefix, \ +-- +2.51.0 + diff --git a/queue-6.12/arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch b/queue-6.12/arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch new file mode 100644 index 0000000000..e5507a49c1 --- /dev/null +++ b/queue-6.12/arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch @@ -0,0 +1,59 @@ +From 12b805c433092ab43952e0182016e57651359304 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 16:54:27 +0200 +Subject: ARM: at91: pm: save and restore ACR during PLL disable/enable + +From: Nicolas Ferre + +[ Upstream commit 0c01fe49651d387776abed6a28541e80c8a93319 ] + +Add a new word in assembly to store ACR value during the calls +to at91_plla_disable/at91_plla_enable macros and use it. + +Signed-off-by: Nicolas Ferre +[cristian.birsan@microchip.com: remove ACR_DEFAULT_PLLA loading] +Signed-off-by: Cristian Birsan +Link: https://lore.kernel.org/r/20250827145427.46819-4-nicolas.ferre@microchip.com +Reviewed-by: Alexandre Belloni +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + arch/arm/mach-at91/pm_suspend.S | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S +index 94dece1839af3..99aaf5cf89696 100644 +--- a/arch/arm/mach-at91/pm_suspend.S ++++ b/arch/arm/mach-at91/pm_suspend.S +@@ -689,6 +689,10 @@ sr_dis_exit: + bic tmp2, tmp2, #AT91_PMC_PLL_UPDT_ID + str tmp2, [pmc, #AT91_PMC_PLL_UPDT] + ++ /* save acr */ ++ ldr tmp2, [pmc, #AT91_PMC_PLL_ACR] ++ str tmp2, .saved_acr ++ + /* save div. */ + mov tmp1, #0 + ldr tmp2, [pmc, #AT91_PMC_PLL_CTRL0] +@@ -758,7 +762,7 @@ sr_dis_exit: + str tmp1, [pmc, #AT91_PMC_PLL_UPDT] + + /* step 2. */ +- ldr tmp1, =AT91_PMC_PLL_ACR_DEFAULT_PLLA ++ ldr tmp1, .saved_acr + str tmp1, [pmc, #AT91_PMC_PLL_ACR] + + /* step 3. */ +@@ -1134,6 +1138,8 @@ ENDPROC(at91_pm_suspend_in_sram) + .word 0 + .saved_mckr: + .word 0 ++.saved_acr: ++ .word 0 + .saved_pllar: + .word 0 + .saved_sam9_lpr: +-- +2.51.0 + diff --git a/queue-6.12/asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch b/queue-6.12/asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch new file mode 100644 index 0000000000..bbce1851fe --- /dev/null +++ b/queue-6.12/asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch @@ -0,0 +1,53 @@ +From 11c7f376065155ed1c583e45217957fd37bfd58a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 00:12:19 +0200 +Subject: ASoC: meson: aiu-encoder-i2s: fix bit clock polarity + +From: Valerio Setti + +[ Upstream commit 4c4ed5e073a923fb3323022e1131cb51ad8df7a0 ] + +According to I2S specs audio data is sampled on the rising edge of the +clock and it can change on the falling one. When operating in normal mode +this SoC behaves the opposite so a clock polarity inversion is required +in this case. + +This was tested on an OdroidC2 (Amlogic S905 SoC) board. + +Signed-off-by: Valerio Setti +Reviewed-by: Jerome Brunet +Tested-by: Jerome Brunet +Link: https://patch.msgid.link/20251007-fix-i2s-polarity-v1-1-86704d9cda10@baylibre.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/meson/aiu-encoder-i2s.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/meson/aiu-encoder-i2s.c b/sound/soc/meson/aiu-encoder-i2s.c +index a0dd914c8ed13..3b4061508c180 100644 +--- a/sound/soc/meson/aiu-encoder-i2s.c ++++ b/sound/soc/meson/aiu-encoder-i2s.c +@@ -236,8 +236,12 @@ static int aiu_encoder_i2s_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) + inv == SND_SOC_DAIFMT_IB_IF) + val |= AIU_CLK_CTRL_LRCLK_INVERT; + +- if (inv == SND_SOC_DAIFMT_IB_NF || +- inv == SND_SOC_DAIFMT_IB_IF) ++ /* ++ * The SoC changes data on the rising edge of the bitclock ++ * so an inversion of the bitclock is required in normal mode ++ */ ++ if (inv == SND_SOC_DAIFMT_NB_NF || ++ inv == SND_SOC_DAIFMT_NB_IF) + val |= AIU_CLK_CTRL_AOCLK_INVERT; + + /* Signal skew */ +@@ -328,4 +332,3 @@ const struct snd_soc_dai_ops aiu_encoder_i2s_dai_ops = { + .startup = aiu_encoder_i2s_startup, + .shutdown = aiu_encoder_i2s_shutdown, + }; +- +-- +2.51.0 + diff --git a/queue-6.12/ceph-add-checking-of-wait_for_completion_killable-re.patch b/queue-6.12/ceph-add-checking-of-wait_for_completion_killable-re.patch new file mode 100644 index 0000000000..9a6e814441 --- /dev/null +++ b/queue-6.12/ceph-add-checking-of-wait_for_completion_killable-re.patch @@ -0,0 +1,50 @@ +From 90d1c7860a1e2a3c7e5e1887f7fb6348c2243b23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jun 2025 12:04:32 -0700 +Subject: ceph: add checking of wait_for_completion_killable() return value + +From: Viacheslav Dubeyko + +[ Upstream commit b7ed1e29cfe773d648ca09895b92856bd3a2092d ] + +The Coverity Scan service has detected the calling of +wait_for_completion_killable() without checking the return +value in ceph_lock_wait_for_completion() [1]. The CID 1636232 +defect contains explanation: "If the function returns an error +value, the error value may be mistaken for a normal value. +In ceph_lock_wait_for_completion(): Value returned from +a function is not checked for errors before being used. (CWE-252)". + +The patch adds the checking of wait_for_completion_killable() +return value and return the error code from +ceph_lock_wait_for_completion(). + +[1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1636232 + +Signed-off-by: Viacheslav Dubeyko +Reviewed-by: Alex Markuze +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/locks.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c +index ebf4ac0055ddc..dd764f9c64b9f 100644 +--- a/fs/ceph/locks.c ++++ b/fs/ceph/locks.c +@@ -221,7 +221,10 @@ static int ceph_lock_wait_for_completion(struct ceph_mds_client *mdsc, + if (err && err != -ERESTARTSYS) + return err; + +- wait_for_completion_killable(&req->r_safe_completion); ++ err = wait_for_completion_killable(&req->r_safe_completion); ++ if (err) ++ return err; ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.12/ceph-fix-multifs-mds-auth-caps-issue.patch b/queue-6.12/ceph-fix-multifs-mds-auth-caps-issue.patch new file mode 100644 index 0000000000..eb8ed9ef78 --- /dev/null +++ b/queue-6.12/ceph-fix-multifs-mds-auth-caps-issue.patch @@ -0,0 +1,175 @@ +From feef08f8b88d7777c458971bda0818f465874f4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Sep 2025 15:02:35 +0530 +Subject: ceph: fix multifs mds auth caps issue + +From: Kotresh HR + +[ Upstream commit 22c73d52a6d05c5a2053385c0d6cd9984732799d ] + +The mds auth caps check should also validate the +fsname along with the associated caps. Not doing +so would result in applying the mds auth caps of +one fs on to the other fs in a multifs ceph cluster. +The bug causes multiple issues w.r.t user +authentication, following is one such example. + +Steps to Reproduce (on vstart cluster): +1. Create two file systems in a cluster, say 'fsname1' and 'fsname2' +2. Authorize read only permission to the user 'client.usr' on fs 'fsname1' + $ceph fs authorize fsname1 client.usr / r +3. Authorize read and write permission to the same user 'client.usr' on fs 'fsname2' + $ceph fs authorize fsname2 client.usr / rw +4. Update the keyring + $ceph auth get client.usr >> ./keyring + +With above permssions for the user 'client.usr', following is the +expectation. + a. The 'client.usr' should be able to only read the contents + and not allowed to create or delete files on file system 'fsname1'. + b. The 'client.usr' should be able to read/write on file system 'fsname2'. + +But, with this bug, the 'client.usr' is allowed to read/write on file +system 'fsname1'. See below. + +5. Mount the file system 'fsname1' with the user 'client.usr' + $sudo bin/mount.ceph usr@.fsname1=/ /kmnt_fsname1_usr/ +6. Try creating a file on file system 'fsname1' with user 'client.usr'. This + should fail but passes with this bug. + $touch /kmnt_fsname1_usr/file1 +7. Mount the file system 'fsname1' with the user 'client.admin' and create a + file. + $sudo bin/mount.ceph admin@.fsname1=/ /kmnt_fsname1_admin + $echo "data" > /kmnt_fsname1_admin/admin_file1 +8. Try removing an existing file on file system 'fsname1' with the user + 'client.usr'. This shoudn't succeed but succeeds with the bug. + $rm -f /kmnt_fsname1_usr/admin_file1 + +For more information, please take a look at the corresponding mds/fuse patch +and tests added by looking into the tracker mentioned below. + +v2: Fix a possible null dereference in doutc +v3: Don't store fsname from mdsmap, validate against + ceph_mount_options's fsname and use it +v4: Code refactor, better warning message and + fix possible compiler warning + +[ Slava.Dubeyko: "fsname check failed" -> "fsname mismatch" ] + +Link: https://tracker.ceph.com/issues/72167 +Signed-off-by: Kotresh HR +Reviewed-by: Viacheslav Dubeyko +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/mds_client.c | 8 ++++++++ + fs/ceph/mdsmap.c | 14 +++++++++++++- + fs/ceph/super.c | 14 -------------- + fs/ceph/super.h | 14 ++++++++++++++ + 4 files changed, 35 insertions(+), 15 deletions(-) + +diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c +index df89d45f33a1f..50587c64f6144 100644 +--- a/fs/ceph/mds_client.c ++++ b/fs/ceph/mds_client.c +@@ -5652,11 +5652,19 @@ static int ceph_mds_auth_match(struct ceph_mds_client *mdsc, + u32 caller_uid = from_kuid(&init_user_ns, cred->fsuid); + u32 caller_gid = from_kgid(&init_user_ns, cred->fsgid); + struct ceph_client *cl = mdsc->fsc->client; ++ const char *fs_name = mdsc->fsc->mount_options->mds_namespace; + const char *spath = mdsc->fsc->mount_options->server_path; + bool gid_matched = false; + u32 gid, tlen, len; + int i, j; + ++ doutc(cl, "fsname check fs_name=%s match.fs_name=%s\n", ++ fs_name, auth->match.fs_name ? auth->match.fs_name : ""); ++ if (auth->match.fs_name && strcmp(auth->match.fs_name, fs_name)) { ++ /* fsname mismatch, try next one */ ++ return 0; ++ } ++ + doutc(cl, "match.uid %lld\n", auth->match.uid); + if (auth->match.uid != MDS_AUTH_UID_ANY) { + if (auth->match.uid != caller_uid) +diff --git a/fs/ceph/mdsmap.c b/fs/ceph/mdsmap.c +index 8109aba66e023..2c7b151a7c95c 100644 +--- a/fs/ceph/mdsmap.c ++++ b/fs/ceph/mdsmap.c +@@ -353,10 +353,22 @@ struct ceph_mdsmap *ceph_mdsmap_decode(struct ceph_mds_client *mdsc, void **p, + __decode_and_drop_type(p, end, u8, bad_ext); + } + if (mdsmap_ev >= 8) { ++ u32 fsname_len; + /* enabled */ + ceph_decode_8_safe(p, end, m->m_enabled, bad_ext); + /* fs_name */ +- ceph_decode_skip_string(p, end, bad_ext); ++ ceph_decode_32_safe(p, end, fsname_len, bad_ext); ++ ++ /* validate fsname against mds_namespace */ ++ if (!namespace_equals(mdsc->fsc->mount_options, *p, ++ fsname_len)) { ++ pr_warn_client(cl, "fsname %*pE doesn't match mds_namespace %s\n", ++ (int)fsname_len, (char *)*p, ++ mdsc->fsc->mount_options->mds_namespace); ++ goto bad; ++ } ++ /* skip fsname after validation */ ++ ceph_decode_skip_n(p, end, fsname_len, bad); + } + /* damaged */ + if (mdsmap_ev >= 9) { +diff --git a/fs/ceph/super.c b/fs/ceph/super.c +index b61074b377ac5..96d582f71beaa 100644 +--- a/fs/ceph/super.c ++++ b/fs/ceph/super.c +@@ -246,20 +246,6 @@ static void canonicalize_path(char *path) + path[j] = '\0'; + } + +-/* +- * Check if the mds namespace in ceph_mount_options matches +- * the passed in namespace string. First time match (when +- * ->mds_namespace is NULL) is treated specially, since +- * ->mds_namespace needs to be initialized by the caller. +- */ +-static int namespace_equals(struct ceph_mount_options *fsopt, +- const char *namespace, size_t len) +-{ +- return !(fsopt->mds_namespace && +- (strlen(fsopt->mds_namespace) != len || +- strncmp(fsopt->mds_namespace, namespace, len))); +-} +- + static int ceph_parse_old_source(const char *dev_name, const char *dev_name_end, + struct fs_context *fc) + { +diff --git a/fs/ceph/super.h b/fs/ceph/super.h +index 037eac35a9e02..caa01a564925c 100644 +--- a/fs/ceph/super.h ++++ b/fs/ceph/super.h +@@ -104,6 +104,20 @@ struct ceph_mount_options { + struct fscrypt_dummy_policy dummy_enc_policy; + }; + ++/* ++ * Check if the mds namespace in ceph_mount_options matches ++ * the passed in namespace string. First time match (when ++ * ->mds_namespace is NULL) is treated specially, since ++ * ->mds_namespace needs to be initialized by the caller. ++ */ ++static inline int namespace_equals(struct ceph_mount_options *fsopt, ++ const char *namespace, size_t len) ++{ ++ return !(fsopt->mds_namespace && ++ (strlen(fsopt->mds_namespace) != len || ++ strncmp(fsopt->mds_namespace, namespace, len))); ++} ++ + /* mount state */ + enum { + CEPH_MOUNT_MOUNTING, +-- +2.51.0 + diff --git a/queue-6.12/ceph-fix-potential-race-condition-in-ceph_ioctl_lazy.patch b/queue-6.12/ceph-fix-potential-race-condition-in-ceph_ioctl_lazy.patch new file mode 100644 index 0000000000..ab18294d69 --- /dev/null +++ b/queue-6.12/ceph-fix-potential-race-condition-in-ceph_ioctl_lazy.patch @@ -0,0 +1,79 @@ +From 6506421c65be985383f5524d25317639260e3e1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jun 2025 11:31:08 -0700 +Subject: ceph: fix potential race condition in ceph_ioctl_lazyio() + +From: Viacheslav Dubeyko + +[ Upstream commit 5824ccba9a39a3ad914fc9b2972a2c1119abaac9 ] + +The Coverity Scan service has detected potential +race condition in ceph_ioctl_lazyio() [1]. + +The CID 1591046 contains explanation: "Check of thread-shared +field evades lock acquisition (LOCK_EVASION). Thread1 sets +fmode to a new value. Now the two threads have an inconsistent +view of fmode and updates to fields correlated with fmode +may be lost. The data guarded by this critical section may +be read while in an inconsistent state or modified by multiple +racing threads. In ceph_ioctl_lazyio: Checking the value of +a thread-shared field outside of a locked region to determine +if a locked operation involving that thread shared field +has completed. (CWE-543)". + +The patch places fi->fmode field access under ci->i_ceph_lock +protection. Also, it introduces the is_file_already_lazy +variable that is set under the lock and it is checked later +out of scope of critical section. + +[1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1591046 + +Signed-off-by: Viacheslav Dubeyko +Reviewed-by: Alex Markuze +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/ioctl.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/fs/ceph/ioctl.c b/fs/ceph/ioctl.c +index e861de3c79b9e..15cde055f3da1 100644 +--- a/fs/ceph/ioctl.c ++++ b/fs/ceph/ioctl.c +@@ -246,21 +246,28 @@ static long ceph_ioctl_lazyio(struct file *file) + struct ceph_inode_info *ci = ceph_inode(inode); + struct ceph_mds_client *mdsc = ceph_inode_to_fs_client(inode)->mdsc; + struct ceph_client *cl = mdsc->fsc->client; ++ bool is_file_already_lazy = false; + ++ spin_lock(&ci->i_ceph_lock); + if ((fi->fmode & CEPH_FILE_MODE_LAZY) == 0) { +- spin_lock(&ci->i_ceph_lock); + fi->fmode |= CEPH_FILE_MODE_LAZY; + ci->i_nr_by_mode[ffs(CEPH_FILE_MODE_LAZY)]++; + __ceph_touch_fmode(ci, mdsc, fi->fmode); +- spin_unlock(&ci->i_ceph_lock); ++ } else { ++ is_file_already_lazy = true; ++ } ++ spin_unlock(&ci->i_ceph_lock); ++ ++ if (is_file_already_lazy) { ++ doutc(cl, "file %p %p %llx.%llx already lazy\n", file, inode, ++ ceph_vinop(inode)); ++ } else { + doutc(cl, "file %p %p %llx.%llx marked lazy\n", file, inode, + ceph_vinop(inode)); + + ceph_check_caps(ci, 0); +- } else { +- doutc(cl, "file %p %p %llx.%llx already lazy\n", file, inode, +- ceph_vinop(inode)); + } ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.12/ceph-refactor-wake_up_bit-pattern-of-calling.patch b/queue-6.12/ceph-refactor-wake_up_bit-pattern-of-calling.patch new file mode 100644 index 0000000000..0ab08708e8 --- /dev/null +++ b/queue-6.12/ceph-refactor-wake_up_bit-pattern-of-calling.patch @@ -0,0 +1,78 @@ +From f03d323b0ccdb5516694255745202c3e1561bef2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Jul 2025 12:20:57 -0700 +Subject: ceph: refactor wake_up_bit() pattern of calling + +From: Viacheslav Dubeyko + +[ Upstream commit 53db6f25ee47cb1265141d31562604e56146919a ] + +The wake_up_bit() is called in ceph_async_unlink_cb(), +wake_async_create_waiters(), and ceph_finish_async_create(). +It makes sense to switch on clear_bit() function, because +it makes the code much cleaner and easier to understand. +More important rework is the adding of smp_mb__after_atomic() +memory barrier after the bit modification and before +wake_up_bit() call. It can prevent potential race condition +of accessing the modified bit in other threads. Luckily, +clear_and_wake_up_bit() already implements the required +functionality pattern: + +static inline void clear_and_wake_up_bit(int bit, unsigned long *word) +{ + clear_bit_unlock(bit, word); + /* See wake_up_bit() for which memory barrier you need to use. */ + smp_mb__after_atomic(); + wake_up_bit(word, bit); +} + +Signed-off-by: Viacheslav Dubeyko +Reviewed-by: Alex Markuze +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/dir.c | 3 +-- + fs/ceph/file.c | 6 ++---- + 2 files changed, 3 insertions(+), 6 deletions(-) + +diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c +index 16c25c48465e5..ba960a9bfbc8b 100644 +--- a/fs/ceph/dir.c ++++ b/fs/ceph/dir.c +@@ -1252,8 +1252,7 @@ static void ceph_async_unlink_cb(struct ceph_mds_client *mdsc, + spin_unlock(&fsc->async_unlink_conflict_lock); + + spin_lock(&dentry->d_lock); +- di->flags &= ~CEPH_DENTRY_ASYNC_UNLINK; +- wake_up_bit(&di->flags, CEPH_DENTRY_ASYNC_UNLINK_BIT); ++ clear_and_wake_up_bit(CEPH_DENTRY_ASYNC_UNLINK_BIT, &di->flags); + spin_unlock(&dentry->d_lock); + + synchronize_rcu(); +diff --git a/fs/ceph/file.c b/fs/ceph/file.c +index 6587c2d5af1e0..147126d2fa0c7 100644 +--- a/fs/ceph/file.c ++++ b/fs/ceph/file.c +@@ -579,8 +579,7 @@ static void wake_async_create_waiters(struct inode *inode, + + spin_lock(&ci->i_ceph_lock); + if (ci->i_ceph_flags & CEPH_I_ASYNC_CREATE) { +- ci->i_ceph_flags &= ~CEPH_I_ASYNC_CREATE; +- wake_up_bit(&ci->i_ceph_flags, CEPH_ASYNC_CREATE_BIT); ++ clear_and_wake_up_bit(CEPH_ASYNC_CREATE_BIT, &ci->i_ceph_flags); + + if (ci->i_ceph_flags & CEPH_I_ASYNC_CHECK_CAPS) { + ci->i_ceph_flags &= ~CEPH_I_ASYNC_CHECK_CAPS; +@@ -762,8 +761,7 @@ static int ceph_finish_async_create(struct inode *dir, struct inode *inode, + } + + spin_lock(&dentry->d_lock); +- di->flags &= ~CEPH_DENTRY_ASYNC_CREATE; +- wake_up_bit(&di->flags, CEPH_DENTRY_ASYNC_CREATE_BIT); ++ clear_and_wake_up_bit(CEPH_DENTRY_ASYNC_CREATE_BIT, &di->flags); + spin_unlock(&dentry->d_lock); + + return ret; +-- +2.51.0 + diff --git a/queue-6.12/clk-at91-clk-master-add-check-for-divide-by-3.patch b/queue-6.12/clk-at91-clk-master-add-check-for-divide-by-3.patch new file mode 100644 index 0000000000..18ff6068fb --- /dev/null +++ b/queue-6.12/clk-at91-clk-master-add-check-for-divide-by-3.patch @@ -0,0 +1,38 @@ +From ff81db1b67b6caca982b02dc1ac7c4ac797270f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 13:07:17 -0700 +Subject: clk: at91: clk-master: Add check for divide by 3 + +From: Ryan Wanner + +[ Upstream commit e0237f5635727d64635ec6665e1de9f4cacce35c ] + +A potential divider for the master clock is div/3. The register +configuration for div/3 is MASTER_PRES_MAX. The current bit shifting +method does not work for this case. Checking for MASTER_PRES_MAX will +ensure the correct decimal value is stored in the system. + +Signed-off-by: Ryan Wanner +Signed-off-by: Nicolas Ferre +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/clk-master.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/clk/at91/clk-master.c b/drivers/clk/at91/clk-master.c +index 15c46489ba850..4c87a0f789de1 100644 +--- a/drivers/clk/at91/clk-master.c ++++ b/drivers/clk/at91/clk-master.c +@@ -580,6 +580,9 @@ clk_sama7g5_master_recalc_rate(struct clk_hw *hw, + { + struct clk_master *master = to_clk_master(hw); + ++ if (master->div == MASTER_PRES_MAX) ++ return DIV_ROUND_CLOSEST_ULL(parent_rate, 3); ++ + return DIV_ROUND_CLOSEST_ULL(parent_rate, (1 << master->div)); + } + +-- +2.51.0 + diff --git a/queue-6.12/clk-at91-clk-sam9x60-pll-force-write-to-pll_updt-reg.patch b/queue-6.12/clk-at91-clk-sam9x60-pll-force-write-to-pll_updt-reg.patch new file mode 100644 index 0000000000..aef41e80ca --- /dev/null +++ b/queue-6.12/clk-at91-clk-sam9x60-pll-force-write-to-pll_updt-reg.patch @@ -0,0 +1,214 @@ +From 5606a6730159c4bcac3ea448fe0d4cc171fc3dd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 17:08:10 +0200 +Subject: clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register + +From: Nicolas Ferre + +[ Upstream commit af98caeaa7b6ad11eb7b7c8bfaddc769df2889f3 ] + +This register is important for sequencing the commands to PLLs, so +actually write the update bits with regmap_write_bits() instead of +relying on a read/modify/write regmap command that could skip the actual +hardware write if the value is identical to the one read. + +It's changed when modification is needed to the PLL, when +read-only operation is done, we could keep the call to +regmap_update_bits(). + +Add a comment to the sam9x60_div_pll_set_div() function that uses this +PLL_UPDT register so that it's used consistently, according to the +product's datasheet. + +Signed-off-by: Nicolas Ferre +Tested-by: Ryan Wanner # on sama7d65 and sam9x75 +Link: https://lore.kernel.org/r/20250827150811.82496-1-nicolas.ferre@microchip.com +[claudiu.beznea: fix "Alignment should match open parenthesis" + checkpatch.pl check] +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/clk-sam9x60-pll.c | 75 ++++++++++++++++-------------- + 1 file changed, 39 insertions(+), 36 deletions(-) + +diff --git a/drivers/clk/at91/clk-sam9x60-pll.c b/drivers/clk/at91/clk-sam9x60-pll.c +index fda0411022246..e05d036252e0e 100644 +--- a/drivers/clk/at91/clk-sam9x60-pll.c ++++ b/drivers/clk/at91/clk-sam9x60-pll.c +@@ -93,8 +93,8 @@ static int sam9x60_frac_pll_set(struct sam9x60_pll_core *core) + + spin_lock_irqsave(core->lock, flags); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_ID_MSK, core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_ID_MSK, core->id); + regmap_read(regmap, AT91_PMC_PLL_CTRL1, &val); + cmul = (val & core->layout->mul_mask) >> core->layout->mul_shift; + cfrac = (val & core->layout->frac_mask) >> core->layout->frac_shift; +@@ -128,17 +128,17 @@ static int sam9x60_frac_pll_set(struct sam9x60_pll_core *core) + udelay(10); + } + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, + AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL, + AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + while (!sam9x60_pll_ready(regmap, core->id)) + cpu_relax(); +@@ -164,8 +164,8 @@ static void sam9x60_frac_pll_unprepare(struct clk_hw *hw) + + spin_lock_irqsave(core->lock, flags); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_ID_MSK, core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_ID_MSK, core->id); + + regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, AT91_PMC_PLL_CTRL0_ENPLL, 0); + +@@ -173,9 +173,9 @@ static void sam9x60_frac_pll_unprepare(struct clk_hw *hw) + regmap_update_bits(regmap, AT91_PMC_PLL_ACR, + AT91_PMC_PLL_ACR_UTMIBG | AT91_PMC_PLL_ACR_UTMIVR, 0); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + spin_unlock_irqrestore(core->lock, flags); + } +@@ -262,8 +262,8 @@ static int sam9x60_frac_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate, + + spin_lock_irqsave(core->lock, irqflags); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, +- core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, ++ core->id); + regmap_read(regmap, AT91_PMC_PLL_CTRL1, &val); + cmul = (val & core->layout->mul_mask) >> core->layout->mul_shift; + cfrac = (val & core->layout->frac_mask) >> core->layout->frac_shift; +@@ -275,18 +275,18 @@ static int sam9x60_frac_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate, + (frac->mul << core->layout->mul_shift) | + (frac->frac << core->layout->frac_shift)); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, + AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL, + AT91_PMC_PLL_CTRL0_ENLOCK | + AT91_PMC_PLL_CTRL0_ENPLL); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + while (!sam9x60_pll_ready(regmap, core->id)) + cpu_relax(); +@@ -338,7 +338,10 @@ static const struct clk_ops sam9x60_frac_pll_ops_chg = { + .restore_context = sam9x60_frac_pll_restore_context, + }; + +-/* This function should be called with spinlock acquired. */ ++/* This function should be called with spinlock acquired. ++ * Warning: this function must be called only if the same PLL ID was set in ++ * PLL_UPDT register previously. ++ */ + static void sam9x60_div_pll_set_div(struct sam9x60_pll_core *core, u32 div, + bool enable) + { +@@ -350,9 +353,9 @@ static void sam9x60_div_pll_set_div(struct sam9x60_pll_core *core, u32 div, + core->layout->div_mask | ena_msk, + (div << core->layout->div_shift) | ena_val); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + while (!sam9x60_pll_ready(regmap, core->id)) + cpu_relax(); +@@ -366,8 +369,8 @@ static int sam9x60_div_pll_set(struct sam9x60_pll_core *core) + unsigned int val, cdiv; + + spin_lock_irqsave(core->lock, flags); +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_ID_MSK, core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_ID_MSK, core->id); + regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val); + cdiv = (val & core->layout->div_mask) >> core->layout->div_shift; + +@@ -398,15 +401,15 @@ static void sam9x60_div_pll_unprepare(struct clk_hw *hw) + + spin_lock_irqsave(core->lock, flags); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_ID_MSK, core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_ID_MSK, core->id); + + regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, + core->layout->endiv_mask, 0); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + spin_unlock_irqrestore(core->lock, flags); + } +@@ -518,8 +521,8 @@ static int sam9x60_div_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate, + div->div = DIV_ROUND_CLOSEST(parent_rate, rate) - 1; + + spin_lock_irqsave(core->lock, irqflags); +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, +- core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, ++ core->id); + regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val); + cdiv = (val & core->layout->div_mask) >> core->layout->div_shift; + +@@ -574,8 +577,8 @@ static int sam9x60_div_pll_notifier_fn(struct notifier_block *notifier, + div->div = div->safe_div; + + spin_lock_irqsave(core.lock, irqflags); +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, +- core.id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, ++ core.id); + regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val); + cdiv = (val & core.layout->div_mask) >> core.layout->div_shift; + +-- +2.51.0 + diff --git a/queue-6.12/clk-at91-sam9x7-add-peripheral-clock-id-for-pmecc.patch b/queue-6.12/clk-at91-sam9x7-add-peripheral-clock-id-for-pmecc.patch new file mode 100644 index 0000000000..1fcdeec2a7 --- /dev/null +++ b/queue-6.12/clk-at91-sam9x7-add-peripheral-clock-id-for-pmecc.patch @@ -0,0 +1,36 @@ +From 9803582586aa326c65a1bf3a2c9ba20ff0d8c353 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 16:08:17 +0530 +Subject: clk: at91: sam9x7: Add peripheral clock id for pmecc + +From: Balamanikandan Gunasundar + +[ Upstream commit 94a1274100e397a27361ae53ace37be6da42a079 ] + +Add pmecc instance id in peripheral clock description. + +Signed-off-by: Balamanikandan Gunasundar +Link: https://lore.kernel.org/r/20250909103817.49334-1-balamanikandan.gunasundar@microchip.com +[claudiu.beznea@tuxon.dev: use tabs instead of spaces] +Signed-off-by: Claudiu Beznea +Signed-off-by: Nicolas Ferre +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/sam9x7.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/at91/sam9x7.c b/drivers/clk/at91/sam9x7.c +index ffab32b047a01..740f52906f6b4 100644 +--- a/drivers/clk/at91/sam9x7.c ++++ b/drivers/clk/at91/sam9x7.c +@@ -403,6 +403,7 @@ static const struct { + { .n = "pioD_clk", .id = 44, }, + { .n = "tcb1_clk", .id = 45, }, + { .n = "dbgu_clk", .id = 47, }, ++ { .n = "pmecc_clk", .id = 48, }, + /* + * mpddr_clk feeds DDR controller and is enabled by bootloader thus we + * need to keep it enabled in case there is no Linux consumer for it. +-- +2.51.0 + diff --git a/queue-6.12/clk-clocking-wizard-fix-output-clock-register-offset.patch b/queue-6.12/clk-clocking-wizard-fix-output-clock-register-offset.patch new file mode 100644 index 0000000000..d6283eadff --- /dev/null +++ b/queue-6.12/clk-clocking-wizard-fix-output-clock-register-offset.patch @@ -0,0 +1,40 @@ +From 1d2ba1f75477ae2290d7c71c05f1b92a256e15b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 14:40:02 +0530 +Subject: clk: clocking-wizard: Fix output clock register offset for Versal + platforms + +From: Shubhrajyoti Datta + +[ Upstream commit 7c2e86f7b5af93d0e78c16e4359318fe7797671d ] + +The output clock register offset used in clk_wzrd_register_output_clocks +was incorrectly referencing 0x3C instead of 0x38, which caused +misconfiguration of output dividers on Versal platforms. + +Correcting the off-by-one error ensures proper configuration of output +clocks. + +Signed-off-by: Shubhrajyoti Datta +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/xilinx/clk-xlnx-clock-wizard.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c +index 7a0269bdfbb38..d2142bab5e289 100644 +--- a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c ++++ b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c +@@ -1153,7 +1153,7 @@ static int clk_wzrd_probe(struct platform_device *pdev) + (&pdev->dev, + clkout_name, clk_name, 0, + clk_wzrd->base, +- (WZRD_CLK_CFG_REG(is_versal, 3) + i * 8), ++ (WZRD_CLK_CFG_REG(is_versal, 2) + i * 8), + WZRD_CLKOUT_DIVIDE_SHIFT, + WZRD_CLKOUT_DIVIDE_WIDTH, + CLK_DIVIDER_ONE_BASED | +-- +2.51.0 + diff --git a/queue-6.12/clk-qcom-gcc-ipq6018-rework-nss_port5-clock-to-multi.patch b/queue-6.12/clk-qcom-gcc-ipq6018-rework-nss_port5-clock-to-multi.patch new file mode 100644 index 0000000000..a14c2e1afe --- /dev/null +++ b/queue-6.12/clk-qcom-gcc-ipq6018-rework-nss_port5-clock-to-multi.patch @@ -0,0 +1,140 @@ +From 132ac8cf50009d11dfa8e196a8e54bc7017e602b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Aug 2025 12:55:46 +0300 +Subject: clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marko Mäkelä + +[ Upstream commit 2f7b168323c22faafb1fbf94ef93b7ce5efc15c6 ] + +Rework nss_port5 to use the new multiple configuration implementation +and correctly fix the clocks for this port under some corner case. + +In OpenWrt, this patch avoids intermittent dmesg errors of the form +nss_port5_rx_clk_src: rcg didn't update its configuration. + +This is a mechanical, straightforward port of +commit e88f03230dc07aa3293b6aeb078bd27370bb2594 +("clk: qcom: gcc-ipq8074: rework nss_port5/6 clock to multiple conf") +to gcc-ipq6018, with two conflicts resolved: different frequency of the +P_XO clock source, and only 5 Ethernet ports. + +This was originally developed by JiaY-shi . + +Link: https://lore.kernel.org/all/20231220221724.3822-4-ansuelsmth@gmail.com/ +Signed-off-by: Marko Mäkelä +Tested-by: Marko Mäkelä +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20250802095546.295448-1-marko.makela@iki.fi +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq6018.c | 60 +++++++++++++++++++++------------- + 1 file changed, 38 insertions(+), 22 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-ipq6018.c b/drivers/clk/qcom/gcc-ipq6018.c +index ab0f7fc665a97..c04a7a961a24a 100644 +--- a/drivers/clk/qcom/gcc-ipq6018.c ++++ b/drivers/clk/qcom/gcc-ipq6018.c +@@ -511,15 +511,23 @@ static struct clk_rcg2 apss_ahb_clk_src = { + }, + }; + +-static const struct freq_tbl ftbl_nss_port5_rx_clk_src[] = { +- F(24000000, P_XO, 1, 0, 0), +- F(25000000, P_UNIPHY1_RX, 12.5, 0, 0), +- F(25000000, P_UNIPHY0_RX, 5, 0, 0), +- F(78125000, P_UNIPHY1_RX, 4, 0, 0), +- F(125000000, P_UNIPHY1_RX, 2.5, 0, 0), +- F(125000000, P_UNIPHY0_RX, 1, 0, 0), +- F(156250000, P_UNIPHY1_RX, 2, 0, 0), +- F(312500000, P_UNIPHY1_RX, 1, 0, 0), ++static const struct freq_conf ftbl_nss_port5_rx_clk_src_25[] = { ++ C(P_UNIPHY1_RX, 12.5, 0, 0), ++ C(P_UNIPHY0_RX, 5, 0, 0), ++}; ++ ++static const struct freq_conf ftbl_nss_port5_rx_clk_src_125[] = { ++ C(P_UNIPHY1_RX, 2.5, 0, 0), ++ C(P_UNIPHY0_RX, 1, 0, 0), ++}; ++ ++static const struct freq_multi_tbl ftbl_nss_port5_rx_clk_src[] = { ++ FMS(24000000, P_XO, 1, 0, 0), ++ FM(25000000, ftbl_nss_port5_rx_clk_src_25), ++ FMS(78125000, P_UNIPHY1_RX, 4, 0, 0), ++ FM(125000000, ftbl_nss_port5_rx_clk_src_125), ++ FMS(156250000, P_UNIPHY1_RX, 2, 0, 0), ++ FMS(312500000, P_UNIPHY1_RX, 1, 0, 0), + { } + }; + +@@ -547,26 +555,34 @@ gcc_xo_uniphy0_rx_tx_uniphy1_rx_tx_ubi32_bias_map[] = { + + static struct clk_rcg2 nss_port5_rx_clk_src = { + .cmd_rcgr = 0x68060, +- .freq_tbl = ftbl_nss_port5_rx_clk_src, ++ .freq_multi_tbl = ftbl_nss_port5_rx_clk_src, + .hid_width = 5, + .parent_map = gcc_xo_uniphy0_rx_tx_uniphy1_rx_tx_ubi32_bias_map, + .clkr.hw.init = &(struct clk_init_data){ + .name = "nss_port5_rx_clk_src", + .parent_data = gcc_xo_uniphy0_rx_tx_uniphy1_rx_tx_ubi32_bias, + .num_parents = 7, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_fm_ops, + }, + }; + +-static const struct freq_tbl ftbl_nss_port5_tx_clk_src[] = { +- F(24000000, P_XO, 1, 0, 0), +- F(25000000, P_UNIPHY1_TX, 12.5, 0, 0), +- F(25000000, P_UNIPHY0_TX, 5, 0, 0), +- F(78125000, P_UNIPHY1_TX, 4, 0, 0), +- F(125000000, P_UNIPHY1_TX, 2.5, 0, 0), +- F(125000000, P_UNIPHY0_TX, 1, 0, 0), +- F(156250000, P_UNIPHY1_TX, 2, 0, 0), +- F(312500000, P_UNIPHY1_TX, 1, 0, 0), ++static const struct freq_conf ftbl_nss_port5_tx_clk_src_25[] = { ++ C(P_UNIPHY1_TX, 12.5, 0, 0), ++ C(P_UNIPHY0_TX, 5, 0, 0), ++}; ++ ++static const struct freq_conf ftbl_nss_port5_tx_clk_src_125[] = { ++ C(P_UNIPHY1_TX, 2.5, 0, 0), ++ C(P_UNIPHY0_TX, 1, 0, 0), ++}; ++ ++static const struct freq_multi_tbl ftbl_nss_port5_tx_clk_src[] = { ++ FMS(24000000, P_XO, 1, 0, 0), ++ FM(25000000, ftbl_nss_port5_tx_clk_src_25), ++ FMS(78125000, P_UNIPHY1_TX, 4, 0, 0), ++ FM(125000000, ftbl_nss_port5_tx_clk_src_125), ++ FMS(156250000, P_UNIPHY1_TX, 2, 0, 0), ++ FMS(312500000, P_UNIPHY1_TX, 1, 0, 0), + { } + }; + +@@ -594,14 +610,14 @@ gcc_xo_uniphy0_tx_rx_uniphy1_tx_rx_ubi32_bias_map[] = { + + static struct clk_rcg2 nss_port5_tx_clk_src = { + .cmd_rcgr = 0x68068, +- .freq_tbl = ftbl_nss_port5_tx_clk_src, ++ .freq_multi_tbl = ftbl_nss_port5_tx_clk_src, + .hid_width = 5, + .parent_map = gcc_xo_uniphy0_tx_rx_uniphy1_tx_rx_ubi32_bias_map, + .clkr.hw.init = &(struct clk_init_data){ + .name = "nss_port5_tx_clk_src", + .parent_data = gcc_xo_uniphy0_tx_rx_uniphy1_tx_rx_ubi32_bias, + .num_parents = 7, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_fm_ops, + }, + }; + +-- +2.51.0 + diff --git a/queue-6.12/clk-scmi-add-duty-cycle-ops-only-when-duty-cycle-is-.patch b/queue-6.12/clk-scmi-add-duty-cycle-ops-only-when-duty-cycle-is-.patch new file mode 100644 index 0000000000..b89b2397b5 --- /dev/null +++ b/queue-6.12/clk-scmi-add-duty-cycle-ops-only-when-duty-cycle-is-.patch @@ -0,0 +1,53 @@ +From 3d7a70d5a0e459d44426c5796c7f686347140e1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 15:04:46 +0800 +Subject: clk: scmi: Add duty cycle ops only when duty cycle is supported + +From: Jacky Bai + +[ Upstream commit 18db1ff2dea0f97dedaeadd18b0cb0a0d76154df ] + +For some of the SCMI based platforms, the oem extended config may be +supported, but not for duty cycle purpose. Skip the duty cycle ops if +err return when trying to get duty cycle info. + +Signed-off-by: Jacky Bai +Reviewed-by: Sudeep Holla +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-scmi.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/clk-scmi.c b/drivers/clk/clk-scmi.c +index 1b1561c84127b..7b7ea36333a6b 100644 +--- a/drivers/clk/clk-scmi.c ++++ b/drivers/clk/clk-scmi.c +@@ -349,6 +349,8 @@ scmi_clk_ops_select(struct scmi_clk *sclk, bool atomic_capable, + unsigned int atomic_threshold_us, + const struct clk_ops **clk_ops_db, size_t db_size) + { ++ int ret; ++ u32 val; + const struct scmi_clock_info *ci = sclk->info; + unsigned int feats_key = 0; + const struct clk_ops *ops; +@@ -370,8 +372,13 @@ scmi_clk_ops_select(struct scmi_clk *sclk, bool atomic_capable, + if (!ci->parent_ctrl_forbidden) + feats_key |= BIT(SCMI_CLK_PARENT_CTRL_SUPPORTED); + +- if (ci->extended_config) +- feats_key |= BIT(SCMI_CLK_DUTY_CYCLE_SUPPORTED); ++ if (ci->extended_config) { ++ ret = scmi_proto_clk_ops->config_oem_get(sclk->ph, sclk->id, ++ SCMI_CLOCK_CFG_DUTY_CYCLE, ++ &val, NULL, false); ++ if (!ret) ++ feats_key |= BIT(SCMI_CLK_DUTY_CYCLE_SUPPORTED); ++ } + + if (WARN_ON(feats_key >= db_size)) + return NULL; +-- +2.51.0 + diff --git a/queue-6.12/clk-sunxi-ng-sun6i-rtc-add-a523-specifics.patch b/queue-6.12/clk-sunxi-ng-sun6i-rtc-add-a523-specifics.patch new file mode 100644 index 0000000000..f6d1475ebf --- /dev/null +++ b/queue-6.12/clk-sunxi-ng-sun6i-rtc-add-a523-specifics.patch @@ -0,0 +1,57 @@ +From a62e0b8b1804e1402a988f51ed80870b68b7bbc1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 01:09:47 +0800 +Subject: clk: sunxi-ng: sun6i-rtc: Add A523 specifics + +From: Chen-Yu Tsai + +[ Upstream commit 7aa8781f379c32c31bd78f1408a31765b2297c43 ] + +The A523's RTC block is backward compatible with the R329's, but it also +has a calibration function for its internal oscillator, which would +allow it to provide a clock rate closer to the desired 32.768 KHz. This +is useful on the Radxa Cubie A5E, which does not have an external 32.768 +KHz crystal. + +Add new compatible-specific data for it. + +Acked-by: Jernej Skrabec +Link: https://patch.msgid.link/20250909170947.2221611-1-wens@kernel.org +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi-ng/ccu-sun6i-rtc.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c b/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c +index 87e23d16ed0f3..50a85f33b8fbb 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c ++++ b/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c +@@ -325,6 +325,13 @@ static const struct sun6i_rtc_match_data sun50i_r329_rtc_ccu_data = { + .osc32k_fanout_nparents = ARRAY_SIZE(sun50i_r329_osc32k_fanout_parents), + }; + ++static const struct sun6i_rtc_match_data sun55i_a523_rtc_ccu_data = { ++ .have_ext_osc32k = true, ++ .have_iosc_calibration = true, ++ .osc32k_fanout_parents = sun50i_r329_osc32k_fanout_parents, ++ .osc32k_fanout_nparents = ARRAY_SIZE(sun50i_r329_osc32k_fanout_parents), ++}; ++ + static const struct of_device_id sun6i_rtc_ccu_match[] = { + { + .compatible = "allwinner,sun50i-h616-rtc", +@@ -334,6 +341,10 @@ static const struct of_device_id sun6i_rtc_ccu_match[] = { + .compatible = "allwinner,sun50i-r329-rtc", + .data = &sun50i_r329_rtc_ccu_data, + }, ++ { ++ .compatible = "allwinner,sun55i-a523-rtc", ++ .data = &sun55i_a523_rtc_ccu_data, ++ }, + {}, + }; + MODULE_DEVICE_TABLE(of, sun6i_rtc_ccu_match); +-- +2.51.0 + diff --git a/queue-6.12/clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch b/queue-6.12/clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch new file mode 100644 index 0000000000..4cc3764510 --- /dev/null +++ b/queue-6.12/clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch @@ -0,0 +1,44 @@ +From 228e2a5c8866fd66f9afe14344056806848ac21e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 16:08:11 +0200 +Subject: clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled + +From: Matthias Schiffer + +[ Upstream commit 1e0d75258bd09323cb452655549e03975992b29e ] + +As described in AM335x Errata Advisory 1.0.42, WKUP_DEBUGSS_CLKCTRL +can't be disabled - the clock module will just be stuck in transitioning +state forever, resulting in the following warning message after the wait +loop times out: + + l3-aon-clkctrl:0000:0: failed to disable + +Just add the clock to enable_init_clks, so no attempt is made to disable +it. + +Signed-off-by: Matthias Schiffer +Signed-off-by: Alexander Stein +Acked-by: Kevin Hilman +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/ti/clk-33xx.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/ti/clk-33xx.c b/drivers/clk/ti/clk-33xx.c +index 85c50ea39e6da..9269e6a0db6a4 100644 +--- a/drivers/clk/ti/clk-33xx.c ++++ b/drivers/clk/ti/clk-33xx.c +@@ -258,6 +258,8 @@ static const char *enable_init_clks[] = { + "dpll_ddr_m2_ck", + "dpll_mpu_m2_ck", + "l3_gclk", ++ /* WKUP_DEBUGSS_CLKCTRL - disable fails, AM335x Errata Advisory 1.0.42 */ ++ "l3-aon-clkctrl:0000:0", + /* AM3_L3_L3_MAIN_CLKCTRL, needed during suspend */ + "l3-clkctrl:00bc:0", + "l4hs_gclk", +-- +2.51.0 + diff --git a/queue-6.12/cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch b/queue-6.12/cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch new file mode 100644 index 0000000000..852ee3404a --- /dev/null +++ b/queue-6.12/cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch @@ -0,0 +1,102 @@ +From ecfa2bbab2e11b120d951f590c1e0e867a107161 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 21:48:13 -0500 +Subject: cpufreq: tegra186: Initialize all cores to max frequencies + +From: Aaron Kling + +[ Upstream commit ba6018929165fc914c665f071f8e8cdbac844a49 ] + +During initialization, the EDVD_COREx_VOLT_FREQ registers for some cores +are still at reset values and not reflecting the actual frequency. This +causes get calls to fail. Set all cores to their respective max +frequency during probe to initialize the registers to working values. + +Suggested-by: Mikko Perttunen +Signed-off-by: Aaron Kling +Reviewed-by: Mikko Perttunen +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/tegra186-cpufreq.c | 27 +++++++++++++++++++++------ + 1 file changed, 21 insertions(+), 6 deletions(-) + +diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c +index 39186008afbfd..233c82a834086 100644 +--- a/drivers/cpufreq/tegra186-cpufreq.c ++++ b/drivers/cpufreq/tegra186-cpufreq.c +@@ -132,13 +132,14 @@ static struct cpufreq_driver tegra186_cpufreq_driver = { + + static struct cpufreq_frequency_table *init_vhint_table( + struct platform_device *pdev, struct tegra_bpmp *bpmp, +- struct tegra186_cpufreq_cluster *cluster, unsigned int cluster_id) ++ struct tegra186_cpufreq_cluster *cluster, unsigned int cluster_id, ++ int *num_rates) + { + struct cpufreq_frequency_table *table; + struct mrq_cpu_vhint_request req; + struct tegra_bpmp_message msg; + struct cpu_vhint_data *data; +- int err, i, j, num_rates = 0; ++ int err, i, j; + dma_addr_t phys; + void *virt; + +@@ -168,6 +169,7 @@ static struct cpufreq_frequency_table *init_vhint_table( + goto free; + } + ++ *num_rates = 0; + for (i = data->vfloor; i <= data->vceil; i++) { + u16 ndiv = data->ndiv[i]; + +@@ -178,10 +180,10 @@ static struct cpufreq_frequency_table *init_vhint_table( + if (i > 0 && ndiv == data->ndiv[i - 1]) + continue; + +- num_rates++; ++ (*num_rates)++; + } + +- table = devm_kcalloc(&pdev->dev, num_rates + 1, sizeof(*table), ++ table = devm_kcalloc(&pdev->dev, *num_rates + 1, sizeof(*table), + GFP_KERNEL); + if (!table) { + table = ERR_PTR(-ENOMEM); +@@ -223,7 +225,9 @@ static int tegra186_cpufreq_probe(struct platform_device *pdev) + { + struct tegra186_cpufreq_data *data; + struct tegra_bpmp *bpmp; +- unsigned int i = 0, err; ++ unsigned int i = 0, err, edvd_offset; ++ int num_rates = 0; ++ u32 edvd_val, cpu; + + data = devm_kzalloc(&pdev->dev, + struct_size(data, clusters, TEGRA186_NUM_CLUSTERS), +@@ -246,10 +250,21 @@ static int tegra186_cpufreq_probe(struct platform_device *pdev) + for (i = 0; i < TEGRA186_NUM_CLUSTERS; i++) { + struct tegra186_cpufreq_cluster *cluster = &data->clusters[i]; + +- cluster->table = init_vhint_table(pdev, bpmp, cluster, i); ++ cluster->table = init_vhint_table(pdev, bpmp, cluster, i, &num_rates); + if (IS_ERR(cluster->table)) { + err = PTR_ERR(cluster->table); + goto put_bpmp; ++ } else if (!num_rates) { ++ err = -EINVAL; ++ goto put_bpmp; ++ } ++ ++ for (cpu = 0; cpu < ARRAY_SIZE(tegra186_cpus); cpu++) { ++ if (data->cpus[cpu].bpmp_cluster_id == i) { ++ edvd_val = cluster->table[num_rates - 1].driver_data; ++ edvd_offset = data->cpus[cpu].edvd_offset; ++ writel(edvd_val, data->regs + edvd_offset); ++ } + } + } + +-- +2.51.0 + diff --git a/queue-6.12/drm-amdkfd-fix-mmap-write-lock-not-release.patch b/queue-6.12/drm-amdkfd-fix-mmap-write-lock-not-release.patch new file mode 100644 index 0000000000..2e501c624c --- /dev/null +++ b/queue-6.12/drm-amdkfd-fix-mmap-write-lock-not-release.patch @@ -0,0 +1,41 @@ +From 827fd8dd126cf4d6aeb45de9733493c60e93870b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 15:57:32 -0400 +Subject: drm/amdkfd: Fix mmap write lock not release + +From: Philip Yang + +[ Upstream commit 7574f30337e19045f03126b4c51f525b84e5049e ] + +If mmap write lock is taken while draining retry fault, mmap write lock +is not released because svm_range_restore_pages calls mmap_read_unlock +then returns. This causes deadlock and system hangs later because mmap +read or write lock cannot be taken. + +Downgrade mmap write lock to read lock if draining retry fault fix this +bug. + +Signed-off-by: Philip Yang +Reviewed-by: Harish Kasiviswanathan +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +index 155948dc3d07a..0d950a20741d8 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +@@ -3036,6 +3036,8 @@ svm_range_restore_pages(struct amdgpu_device *adev, unsigned int pasid, + if (svms->checkpoint_ts[gpuidx] != 0) { + if (amdgpu_ih_ts_after_or_equal(ts, svms->checkpoint_ts[gpuidx])) { + pr_debug("draining retry fault, drop fault 0x%llx\n", addr); ++ if (write_locked) ++ mmap_write_downgrade(mm); + r = -EAGAIN; + goto out_unlock_svms; + } else { +-- +2.51.0 + diff --git a/queue-6.12/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch b/queue-6.12/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch new file mode 100644 index 0000000000..873013f4fc --- /dev/null +++ b/queue-6.12/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch @@ -0,0 +1,69 @@ +From 20b4a03a171d60ba9721ff65e9f32be2a69f1ce7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 03:32:09 -0400 +Subject: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds + +From: Albin Babu Varghese + +[ Upstream commit 3637d34b35b287ab830e66048841ace404382b67 ] + +Add bounds checking to prevent writes past framebuffer boundaries when +rendering text near screen edges. Return early if the Y position is off-screen +and clip image height to screen boundary. Break from the rendering loop if the +X position is off-screen. When clipping image width to fit the screen, update +the character count to match the clipped width to prevent buffer size +mismatches. + +Without the character count update, bit_putcs_aligned and bit_putcs_unaligned +receive mismatched parameters where the buffer is allocated for the clipped +width but cnt reflects the original larger count, causing out-of-bounds writes. + +Reported-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190 +Suggested-by: Helge Deller +Tested-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com +Signed-off-by: Albin Babu Varghese +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/core/bitblit.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c +index 2e46c41a706a2..dc5ad3fcc7be4 100644 +--- a/drivers/video/fbdev/core/bitblit.c ++++ b/drivers/video/fbdev/core/bitblit.c +@@ -168,6 +168,11 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, + image.height = vc->vc_font.height; + image.depth = 1; + ++ if (image.dy >= info->var.yres) ++ return; ++ ++ image.height = min(image.height, info->var.yres - image.dy); ++ + if (attribute) { + buf = kmalloc(cellsize, GFP_ATOMIC); + if (!buf) +@@ -181,6 +186,18 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, + cnt = count; + + image.width = vc->vc_font.width * cnt; ++ ++ if (image.dx >= info->var.xres) ++ break; ++ ++ if (image.dx + image.width > info->var.xres) { ++ image.width = info->var.xres - image.dx; ++ cnt = image.width / vc->vc_font.width; ++ if (cnt == 0) ++ break; ++ image.width = cnt * vc->vc_font.width; ++ } ++ + pitch = DIV_ROUND_UP(image.width, 8) + scan_align; + pitch &= ~scan_align; + size = pitch * image.height + buf_align; +-- +2.51.0 + diff --git a/queue-6.12/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch b/queue-6.12/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch new file mode 100644 index 0000000000..8b4921798a --- /dev/null +++ b/queue-6.12/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch @@ -0,0 +1,97 @@ +From 1cc01f5e62854ee4d16ce00f152308a45fea6e41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 May 2025 20:44:34 -0500 +Subject: fs/hpfs: Fix error code for new_inode() failure in + mkdir/create/mknod/symlink + +From: Yikang Yue + +[ Upstream commit 32058c38d3b79a28963a59ac0353644dc24775cd ] + +The function call new_inode() is a primitive for allocating an inode in memory, +rather than planning disk space for it. Therefore, -ENOMEM should be returned +as the error code rather than -ENOSPC. + +To be specific, new_inode()'s call path looks like this: +new_inode + new_inode_pseudo + alloc_inode + ops->alloc_inode (hpfs_alloc_inode) + alloc_inode_sb + kmem_cache_alloc_lru + +Therefore, the failure of new_inode() indicates a memory presure issue (-ENOMEM), +not a lack of disk space. However, the current implementation of +hpfs_mkdir/create/mknod/symlink incorrectly returns -ENOSPC when new_inode() fails. +This patch fix this by set err to -ENOMEM before the goto statement. + +BTW, we also noticed that other nested calls within these four functions, +like hpfs_alloc_f/dnode and hpfs_add_dirent, might also fail due to memory presure. +But similarly, only -ENOSPC is returned. Addressing these will involve code +modifications in other functions, and we plan to submit dedicated patches for these +issues in the future. For this patch, we focus on new_inode(). + +Signed-off-by: Yikang Yue +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + fs/hpfs/namei.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c +index d0edf9ed33b60..9a40068b59b77 100644 +--- a/fs/hpfs/namei.c ++++ b/fs/hpfs/namei.c +@@ -52,8 +52,10 @@ static int hpfs_mkdir(struct mnt_idmap *idmap, struct inode *dir, + dee.fnode = cpu_to_le32(fno); + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail2; ++ } + hpfs_init_inode(result); + result->i_ino = fno; + hpfs_i(result)->i_parent_dir = dir->i_ino; +@@ -153,9 +155,10 @@ static int hpfs_create(struct mnt_idmap *idmap, struct inode *dir, + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail1; +- ++ } + hpfs_init_inode(result); + result->i_ino = fno; + result->i_mode |= S_IFREG; +@@ -239,9 +242,10 @@ static int hpfs_mknod(struct mnt_idmap *idmap, struct inode *dir, + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail1; +- ++ } + hpfs_init_inode(result); + result->i_ino = fno; + hpfs_i(result)->i_parent_dir = dir->i_ino; +@@ -314,8 +318,10 @@ static int hpfs_symlink(struct mnt_idmap *idmap, struct inode *dir, + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail1; ++ } + result->i_ino = fno; + hpfs_init_inode(result); + hpfs_i(result)->i_parent_dir = dir->i_ino; +-- +2.51.0 + diff --git a/queue-6.12/kbuild-uapi-strip-comments-before-size-type-check.patch b/queue-6.12/kbuild-uapi-strip-comments-before-size-type-check.patch new file mode 100644 index 0000000000..2f68f2e02d --- /dev/null +++ b/queue-6.12/kbuild-uapi-strip-comments-before-size-type-check.patch @@ -0,0 +1,52 @@ +From f0a5ba2d6672681a5efe4c5890ebb0ae1c71c814 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Oct 2025 14:33:42 +0200 +Subject: kbuild: uapi: Strip comments before size type check +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit 66128f4287b04aef4d4db9bf5035985ab51487d5 ] + +On m68k, check_sizetypes in headers_check reports: + + ./usr/include/asm/bootinfo-amiga.h:17: found __[us]{8,16,32,64} type without #include + +This header file does not use any of the Linux-specific integer types, +but merely refers to them from comments, so this is a false positive. +As of commit c3a9d74ee413bdb3 ("kbuild: uapi: upgrade check_sizetypes() +warning to error"), this check was promoted to an error, breaking m68k +all{mod,yes}config builds. + +Fix this by stripping simple comments before looking for Linux-specific +integer types. + +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Thomas Weißschuh +Link: https://patch.msgid.link/949f096337e28d50510e970ae3ba3ec9c1342ec0.1759753998.git.geert@linux-m68k.org +[nathan: Adjust comment and remove unnecessary escaping from slashes in + regex] +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + usr/include/headers_check.pl | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/usr/include/headers_check.pl b/usr/include/headers_check.pl +index b6aec5e4365f9..682980781eb37 100755 +--- a/usr/include/headers_check.pl ++++ b/usr/include/headers_check.pl +@@ -160,6 +160,8 @@ sub check_sizetypes + if (my $included = ($line =~ /^\s*#\s*include\s+[<"](\S+)[>"]/)[0]) { + check_include_typesh($included); + } ++ # strip single-line comments, as types may be referenced within them ++ $line =~ s@/\*.*?\*/@@; + if ($line =~ m/__[us](8|16|32|64)\b/) { + printf STDERR "$filename:$lineno: " . + "found __[us]{8,16,32,64} type " . +-- +2.51.0 + diff --git a/queue-6.12/loongarch-handle-new-atomic-instructions-for-probes.patch b/queue-6.12/loongarch-handle-new-atomic-instructions-for-probes.patch new file mode 100644 index 0000000000..1334a6c38f --- /dev/null +++ b/queue-6.12/loongarch-handle-new-atomic-instructions-for-probes.patch @@ -0,0 +1,79 @@ +From 51b40ffd22fd07b38489b05e0c12bcc48080f3b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 22:39:35 +0800 +Subject: LoongArch: Handle new atomic instructions for probes + +From: Tiezhu Yang + +[ Upstream commit db740f5689e61f2e75b73e5c8e7c985a3b4bc045 ] + +The atomic instructions sc.q, llacq.{w/d}, screl.{w/d} were newly added +in the LoongArch Reference Manual v1.10, it is necessary to handle them +in insns_not_supported() to avoid putting a breakpoint in the middle of +a ll/sc atomic sequence, otherwise it will loop forever for kprobes and +uprobes. + +Signed-off-by: Tiezhu Yang +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/include/asm/inst.h | 5 +++++ + arch/loongarch/kernel/inst.c | 12 ++++++++++++ + 2 files changed, 17 insertions(+) + +diff --git a/arch/loongarch/include/asm/inst.h b/arch/loongarch/include/asm/inst.h +index 3089785ca97e7..bec5b63e46888 100644 +--- a/arch/loongarch/include/asm/inst.h ++++ b/arch/loongarch/include/asm/inst.h +@@ -77,6 +77,10 @@ enum reg2_op { + iocsrwrh_op = 0x19205, + iocsrwrw_op = 0x19206, + iocsrwrd_op = 0x19207, ++ llacqw_op = 0xe15e0, ++ screlw_op = 0xe15e1, ++ llacqd_op = 0xe15e2, ++ screld_op = 0xe15e3, + }; + + enum reg2i5_op { +@@ -189,6 +193,7 @@ enum reg3_op { + fldxd_op = 0x7068, + fstxs_op = 0x7070, + fstxd_op = 0x7078, ++ scq_op = 0x70ae, + amswapw_op = 0x70c0, + amswapd_op = 0x70c1, + amaddw_op = 0x70c2, +diff --git a/arch/loongarch/kernel/inst.c b/arch/loongarch/kernel/inst.c +index 14d7d700bcb98..e6896a40017ea 100644 +--- a/arch/loongarch/kernel/inst.c ++++ b/arch/loongarch/kernel/inst.c +@@ -139,6 +139,9 @@ bool insns_not_supported(union loongarch_instruction insn) + case amswapw_op ... ammindbdu_op: + pr_notice("atomic memory access instructions are not supported\n"); + return true; ++ case scq_op: ++ pr_notice("sc.q instruction is not supported\n"); ++ return true; + } + + switch (insn.reg2i14_format.opcode) { +@@ -150,6 +153,15 @@ bool insns_not_supported(union loongarch_instruction insn) + return true; + } + ++ switch (insn.reg2_format.opcode) { ++ case llacqw_op: ++ case llacqd_op: ++ case screlw_op: ++ case screld_op: ++ pr_notice("llacq and screl instructions are not supported\n"); ++ return true; ++ } ++ + switch (insn.reg1i21_format.opcode) { + case bceqz_op: + pr_notice("bceqz and bcnez instructions are not supported\n"); +-- +2.51.0 + diff --git a/queue-6.12/net-wwan-t7xx-add-support-for-hp-drmr-h01.patch b/queue-6.12/net-wwan-t7xx-add-support-for-hp-drmr-h01.patch new file mode 100644 index 0000000000..e609e0b17c --- /dev/null +++ b/queue-6.12/net-wwan-t7xx-add-support-for-hp-drmr-h01.patch @@ -0,0 +1,34 @@ +From 05024c4fb6d940a89afc50f886bc5fe592a97589 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 10:48:41 +0800 +Subject: net: wwan: t7xx: add support for HP DRMR-H01 + +From: Sammy Hsu + +[ Upstream commit 370e98728bda92b1bdffb448d1acdcbe19dadb4c ] + +add support for HP DRMR-H01 (0x03f0, 0x09c8) + +Signed-off-by: Sammy Hsu +Link: https://patch.msgid.link/20251002024841.5979-1-sammy.hsu@wnc.com.tw +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/wwan/t7xx/t7xx_pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wwan/t7xx/t7xx_pci.c b/drivers/net/wwan/t7xx/t7xx_pci.c +index e556e5bd49abc..c7020d107903a 100644 +--- a/drivers/net/wwan/t7xx/t7xx_pci.c ++++ b/drivers/net/wwan/t7xx/t7xx_pci.c +@@ -885,6 +885,7 @@ static void t7xx_pci_remove(struct pci_dev *pdev) + + static const struct pci_device_id t7xx_pci_table[] = { + { PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x4d75) }, ++ { PCI_DEVICE(0x03f0, 0x09c8) }, // HP DRMR-H01 + { PCI_DEVICE(0x14c0, 0x4d75) }, // Dell DW5933e + { } + }; +-- +2.51.0 + diff --git a/queue-6.12/ntb-epf-allow-arbitrary-bar-mapping.patch b/queue-6.12/ntb-epf-allow-arbitrary-bar-mapping.patch new file mode 100644 index 0000000000..0f4e73c046 --- /dev/null +++ b/queue-6.12/ntb-epf-allow-arbitrary-bar-mapping.patch @@ -0,0 +1,246 @@ +From 4f4b44661f80b78c75d0d1b41b4b06c590afd911 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Jul 2025 18:48:33 +0200 +Subject: NTB: epf: Allow arbitrary BAR mapping + +From: Jerome Brunet + +[ Upstream commit 5ad865862a0fd349163243e1834ed98ba9b81905 ] + +The NTB epf host driver assumes the BAR number associated with a memory +window is just incremented from the BAR number associated with MW1. This +seems to have been enough so far but this is not really how the endpoint +side work and the two could easily become mis-aligned. + +ntb_epf_mw_to_bar() even assumes that the BAR number is the memory window +index + 2, which means the function only returns a proper result if BAR_2 +is associated with MW1. + +Instead, fully describe and allow arbitrary NTB BAR mapping. + +Signed-off-by: Jerome Brunet +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/hw/epf/ntb_hw_epf.c | 103 ++++++++++++++++---------------- + 1 file changed, 53 insertions(+), 50 deletions(-) + +diff --git a/drivers/ntb/hw/epf/ntb_hw_epf.c b/drivers/ntb/hw/epf/ntb_hw_epf.c +index 00f0e78f685bf..2b51156e01b0f 100644 +--- a/drivers/ntb/hw/epf/ntb_hw_epf.c ++++ b/drivers/ntb/hw/epf/ntb_hw_epf.c +@@ -49,6 +49,7 @@ + #define NTB_EPF_COMMAND_TIMEOUT 1000 /* 1 Sec */ + + enum pci_barno { ++ NO_BAR = -1, + BAR_0, + BAR_1, + BAR_2, +@@ -57,16 +58,26 @@ enum pci_barno { + BAR_5, + }; + ++enum epf_ntb_bar { ++ BAR_CONFIG, ++ BAR_PEER_SPAD, ++ BAR_DB, ++ BAR_MW1, ++ BAR_MW2, ++ BAR_MW3, ++ BAR_MW4, ++ NTB_BAR_NUM, ++}; ++ ++#define NTB_EPF_MAX_MW_COUNT (NTB_BAR_NUM - BAR_MW1) ++ + struct ntb_epf_dev { + struct ntb_dev ntb; + struct device *dev; + /* Mutex to protect providing commands to NTB EPF */ + struct mutex cmd_lock; + +- enum pci_barno ctrl_reg_bar; +- enum pci_barno peer_spad_reg_bar; +- enum pci_barno db_reg_bar; +- enum pci_barno mw_bar; ++ const enum pci_barno *barno_map; + + unsigned int mw_count; + unsigned int spad_count; +@@ -85,17 +96,6 @@ struct ntb_epf_dev { + + #define ntb_ndev(__ntb) container_of(__ntb, struct ntb_epf_dev, ntb) + +-struct ntb_epf_data { +- /* BAR that contains both control region and self spad region */ +- enum pci_barno ctrl_reg_bar; +- /* BAR that contains peer spad region */ +- enum pci_barno peer_spad_reg_bar; +- /* BAR that contains Doorbell region and Memory window '1' */ +- enum pci_barno db_reg_bar; +- /* BAR that contains memory windows*/ +- enum pci_barno mw_bar; +-}; +- + static int ntb_epf_send_command(struct ntb_epf_dev *ndev, u32 command, + u32 argument) + { +@@ -144,7 +144,7 @@ static int ntb_epf_mw_to_bar(struct ntb_epf_dev *ndev, int idx) + return -EINVAL; + } + +- return idx + 2; ++ return ndev->barno_map[BAR_MW1 + idx]; + } + + static int ntb_epf_mw_count(struct ntb_dev *ntb, int pidx) +@@ -413,7 +413,9 @@ static int ntb_epf_mw_set_trans(struct ntb_dev *ntb, int pidx, int idx, + return -EINVAL; + } + +- bar = idx + ndev->mw_bar; ++ bar = ntb_epf_mw_to_bar(ndev, idx); ++ if (bar < 0) ++ return bar; + + mw_size = pci_resource_len(ntb->pdev, bar); + +@@ -455,7 +457,9 @@ static int ntb_epf_peer_mw_get_addr(struct ntb_dev *ntb, int idx, + if (idx == 0) + offset = readl(ndev->ctrl_reg + NTB_EPF_MW1_OFFSET); + +- bar = idx + ndev->mw_bar; ++ bar = ntb_epf_mw_to_bar(ndev, idx); ++ if (bar < 0) ++ return bar; + + if (base) + *base = pci_resource_start(ndev->ntb.pdev, bar) + offset; +@@ -560,6 +564,11 @@ static int ntb_epf_init_dev(struct ntb_epf_dev *ndev) + ndev->mw_count = readl(ndev->ctrl_reg + NTB_EPF_MW_COUNT); + ndev->spad_count = readl(ndev->ctrl_reg + NTB_EPF_SPAD_COUNT); + ++ if (ndev->mw_count > NTB_EPF_MAX_MW_COUNT) { ++ dev_err(dev, "Unsupported MW count: %u\n", ndev->mw_count); ++ return -EINVAL; ++ } ++ + return 0; + } + +@@ -596,14 +605,15 @@ static int ntb_epf_init_pci(struct ntb_epf_dev *ndev, + dev_warn(&pdev->dev, "Cannot DMA highmem\n"); + } + +- ndev->ctrl_reg = pci_iomap(pdev, ndev->ctrl_reg_bar, 0); ++ ndev->ctrl_reg = pci_iomap(pdev, ndev->barno_map[BAR_CONFIG], 0); + if (!ndev->ctrl_reg) { + ret = -EIO; + goto err_pci_regions; + } + +- if (ndev->peer_spad_reg_bar) { +- ndev->peer_spad_reg = pci_iomap(pdev, ndev->peer_spad_reg_bar, 0); ++ if (ndev->barno_map[BAR_PEER_SPAD] != ndev->barno_map[BAR_CONFIG]) { ++ ndev->peer_spad_reg = pci_iomap(pdev, ++ ndev->barno_map[BAR_PEER_SPAD], 0); + if (!ndev->peer_spad_reg) { + ret = -EIO; + goto err_pci_regions; +@@ -614,7 +624,7 @@ static int ntb_epf_init_pci(struct ntb_epf_dev *ndev, + ndev->peer_spad_reg = ndev->ctrl_reg + spad_off + spad_sz; + } + +- ndev->db_reg = pci_iomap(pdev, ndev->db_reg_bar, 0); ++ ndev->db_reg = pci_iomap(pdev, ndev->barno_map[BAR_DB], 0); + if (!ndev->db_reg) { + ret = -EIO; + goto err_pci_regions; +@@ -659,12 +669,7 @@ static void ntb_epf_cleanup_isr(struct ntb_epf_dev *ndev) + static int ntb_epf_pci_probe(struct pci_dev *pdev, + const struct pci_device_id *id) + { +- enum pci_barno peer_spad_reg_bar = BAR_1; +- enum pci_barno ctrl_reg_bar = BAR_0; +- enum pci_barno db_reg_bar = BAR_2; +- enum pci_barno mw_bar = BAR_2; + struct device *dev = &pdev->dev; +- struct ntb_epf_data *data; + struct ntb_epf_dev *ndev; + int ret; + +@@ -675,18 +680,10 @@ static int ntb_epf_pci_probe(struct pci_dev *pdev, + if (!ndev) + return -ENOMEM; + +- data = (struct ntb_epf_data *)id->driver_data; +- if (data) { +- peer_spad_reg_bar = data->peer_spad_reg_bar; +- ctrl_reg_bar = data->ctrl_reg_bar; +- db_reg_bar = data->db_reg_bar; +- mw_bar = data->mw_bar; +- } ++ ndev->barno_map = (const enum pci_barno *)id->driver_data; ++ if (!ndev->barno_map) ++ return -EINVAL; + +- ndev->peer_spad_reg_bar = peer_spad_reg_bar; +- ndev->ctrl_reg_bar = ctrl_reg_bar; +- ndev->db_reg_bar = db_reg_bar; +- ndev->mw_bar = mw_bar; + ndev->dev = dev; + + ntb_epf_init_struct(ndev, pdev); +@@ -730,30 +727,36 @@ static void ntb_epf_pci_remove(struct pci_dev *pdev) + ntb_epf_deinit_pci(ndev); + } + +-static const struct ntb_epf_data j721e_data = { +- .ctrl_reg_bar = BAR_0, +- .peer_spad_reg_bar = BAR_1, +- .db_reg_bar = BAR_2, +- .mw_bar = BAR_2, ++static const enum pci_barno j721e_map[NTB_BAR_NUM] = { ++ [BAR_CONFIG] = BAR_0, ++ [BAR_PEER_SPAD] = BAR_1, ++ [BAR_DB] = BAR_2, ++ [BAR_MW1] = BAR_2, ++ [BAR_MW2] = BAR_3, ++ [BAR_MW3] = BAR_4, ++ [BAR_MW4] = BAR_5 + }; + +-static const struct ntb_epf_data mx8_data = { +- .ctrl_reg_bar = BAR_0, +- .peer_spad_reg_bar = BAR_0, +- .db_reg_bar = BAR_2, +- .mw_bar = BAR_4, ++static const enum pci_barno mx8_map[NTB_BAR_NUM] = { ++ [BAR_CONFIG] = BAR_0, ++ [BAR_PEER_SPAD] = BAR_0, ++ [BAR_DB] = BAR_2, ++ [BAR_MW1] = BAR_4, ++ [BAR_MW2] = BAR_5, ++ [BAR_MW3] = NO_BAR, ++ [BAR_MW4] = NO_BAR + }; + + static const struct pci_device_id ntb_epf_pci_tbl[] = { + { + PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_J721E), + .class = PCI_CLASS_MEMORY_RAM << 8, .class_mask = 0xffff00, +- .driver_data = (kernel_ulong_t)&j721e_data, ++ .driver_data = (kernel_ulong_t)j721e_map, + }, + { + PCI_DEVICE(PCI_VENDOR_ID_FREESCALE, 0x0809), + .class = PCI_CLASS_MEMORY_RAM << 8, .class_mask = 0xffff00, +- .driver_data = (kernel_ulong_t)&mx8_data, ++ .driver_data = (kernel_ulong_t)mx8_map, + }, + { }, + }; +-- +2.51.0 + diff --git a/queue-6.12/rtc-pcf2127-clear-minute-second-interrupt.patch b/queue-6.12/rtc-pcf2127-clear-minute-second-interrupt.patch new file mode 100644 index 0000000000..88792cdcca --- /dev/null +++ b/queue-6.12/rtc-pcf2127-clear-minute-second-interrupt.patch @@ -0,0 +1,70 @@ +From bfbcb15043bd360bb516a6e4a8e77e2a52ba06e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 19:54:09 +0200 +Subject: rtc: pcf2127: clear minute/second interrupt + +From: Josua Mayer + +[ Upstream commit a6f1a4f05970664004a9370459c6799c1b2f2dcf ] + +PCF2127 can generate interrupt every full second or minute configured +from control and status register 1, bits MI (1) and SI (0). + +On interrupt control register 2 bit MSF (7) is set and must be cleared +to continue normal operation. + +While the driver never enables this interrupt on its own, users or +firmware may do so - e.g. as an easy way to test the interrupt. + +Add preprocessor definition for MSF bit and include it in the irq +bitmask to ensure minute and second interrupts are cleared when fired. + +This fixes an issue where the rtc enters a test mode and becomes +unresponsive after a second interrupt has fired and is not cleared in +time. In this state register writes to control registers have no +effect and the interrupt line is kept asserted [1]: + +[1] userspace commands to put rtc into unresponsive state: +$ i2cget -f -y 2 0x51 0x00 +0x04 +$ i2cset -f -y 2 0x51 0x00 0x05 # set bit 0 SI +$ i2cget -f -y 2 0x51 0x00 +0x84 # bit 8 EXT_TEST set +$ i2cset -f -y 2 0x51 0x00 0x05 # try overwrite control register +$ i2cget -f -y 2 0x51 0x00 +0x84 # no change + +Signed-off-by: Josua Mayer +Reviewed-by: Bruno Thomsen +Link: https://lore.kernel.org/r/20250825-rtc-irq-v1-1-0133319406a7@solid-run.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-pcf2127.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c +index 502571f0c203f..e793c019fb9d7 100644 +--- a/drivers/rtc/rtc-pcf2127.c ++++ b/drivers/rtc/rtc-pcf2127.c +@@ -41,6 +41,7 @@ + #define PCF2127_BIT_CTRL2_AF BIT(4) + #define PCF2127_BIT_CTRL2_TSF2 BIT(5) + #define PCF2127_BIT_CTRL2_WDTF BIT(6) ++#define PCF2127_BIT_CTRL2_MSF BIT(7) + /* Control register 3 */ + #define PCF2127_REG_CTRL3 0x02 + #define PCF2127_BIT_CTRL3_BLIE BIT(0) +@@ -94,7 +95,8 @@ + #define PCF2127_CTRL2_IRQ_MASK ( \ + PCF2127_BIT_CTRL2_AF | \ + PCF2127_BIT_CTRL2_WDTF | \ +- PCF2127_BIT_CTRL2_TSF2) ++ PCF2127_BIT_CTRL2_TSF2 | \ ++ PCF2127_BIT_CTRL2_MSF) + + #define PCF2127_MAX_TS_SUPPORTED 4 + +-- +2.51.0 + diff --git a/queue-6.12/rtc-pcf2127-fix-watchdog-interrupt-mask-on-pcf2131.patch b/queue-6.12/rtc-pcf2127-fix-watchdog-interrupt-mask-on-pcf2131.patch new file mode 100644 index 0000000000..6aa39c79c2 --- /dev/null +++ b/queue-6.12/rtc-pcf2127-fix-watchdog-interrupt-mask-on-pcf2131.patch @@ -0,0 +1,50 @@ +From 525e7c556beb17821dcdd7b4e36acef62ed616f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 20:22:35 +0200 +Subject: rtc: pcf2127: fix watchdog interrupt mask on pcf2131 + +From: Bruno Thomsen + +[ Upstream commit 87064da2db7be537a7da20a25c18ba912c4db9e1 ] + +When using interrupt pin (INT A) as watchdog output all other +interrupt sources need to be disabled to avoid additional +resets. Resulting INT_A_MASK1 value is 55 (0x37). + +Signed-off-by: Bruno Thomsen +Link: https://lore.kernel.org/r/20250902182235.6825-1-bruno.thomsen@gmail.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-pcf2127.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c +index e793c019fb9d7..05a54f4d4d9a6 100644 +--- a/drivers/rtc/rtc-pcf2127.c ++++ b/drivers/rtc/rtc-pcf2127.c +@@ -528,6 +528,21 @@ static int pcf2127_watchdog_init(struct device *dev, struct pcf2127 *pcf2127) + set_bit(WDOG_HW_RUNNING, &pcf2127->wdd.status); + } + ++ /* ++ * When using interrupt pin (INT A) as watchdog output, only allow ++ * watchdog interrupt (PCF2131_BIT_INT_WD_CD) and disable (mask) all ++ * other interrupts. ++ */ ++ if (pcf2127->cfg->type == PCF2131) { ++ ret = regmap_write(pcf2127->regmap, ++ PCF2131_REG_INT_A_MASK1, ++ PCF2131_BIT_INT_BLIE | ++ PCF2131_BIT_INT_BIE | ++ PCF2131_BIT_INT_AIE | ++ PCF2131_BIT_INT_SI | ++ PCF2131_BIT_INT_MI); ++ } ++ + return devm_watchdog_register_device(dev, &pcf2127->wdd); + } + +-- +2.51.0 + diff --git a/queue-6.12/scsi-ufs-core-include-utp-error-in-int_fatal_errors.patch b/queue-6.12/scsi-ufs-core-include-utp-error-in-int_fatal_errors.patch new file mode 100644 index 0000000000..0bdde03442 --- /dev/null +++ b/queue-6.12/scsi-ufs-core-include-utp-error-in-int_fatal_errors.patch @@ -0,0 +1,77 @@ +From 67477d6e368fe1b091e1097cc41129ce6ecc7ca3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 15:14:28 +0900 +Subject: scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS + +From: Hoyoung Seo + +[ Upstream commit 558ae4579810fa0fef011944230c65a6f3087f85 ] + +When a UTP error occurs in isolation, UFS is not currently recoverable. +This is because the UTP error is not considered fatal in the error +handling code, leading to either an I/O timeout or an OCS error. + +Add the UTP error flag to INT_FATAL_ERRORS so the controller will be +reset in this situation. + + sd 0:0:0:0: [sda] tag#38 UNKNOWN(0x2003) Result: hostbyte=0x07 + driverbyte=DRIVER_OK cmd_age=0s + sd 0:0:0:0: [sda] tag#38 CDB: opcode=0x28 28 00 00 51 24 e2 00 00 08 00 + I/O error, dev sda, sector 42542864 op 0x0:(READ) flags 0x80700 phys_seg + 8 prio class 2 + OCS error from controller = 9 for tag 39 + pa_err[1] = 0x80000010 at 2667224756 us + pa_err: total cnt=2 + dl_err[0] = 0x80000002 at 2667148060 us + dl_err[1] = 0x80002000 at 2667282844 us + No record of nl_err + No record of tl_err + No record of dme_err + No record of auto_hibern8_err + fatal_err[0] = 0x804 at 2667282836 us + + --------------------------------------------------- + REGISTER + --------------------------------------------------- + NAME OFFSET VALUE + STD HCI SFR 0xfffffff0 0x0 + AHIT 0x18 0x814 + INTERRUPT STATUS 0x20 0x1000 + INTERRUPT ENABLE 0x24 0x70ef5 + +[mkp: commit desc] + +Signed-off-by: Hoyoung Seo +Reviewed-by: Bart Van Assche +Message-Id: <20250930061428.617955-1-hy50.seo@samsung.com> +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + include/ufs/ufshci.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/include/ufs/ufshci.h b/include/ufs/ufshci.h +index 27364c4a6ef9f..63ae3150f6be3 100644 +--- a/include/ufs/ufshci.h ++++ b/include/ufs/ufshci.h +@@ -185,6 +185,7 @@ static inline u32 ufshci_version(u32 major, u32 minor) + #define UTP_TASK_REQ_COMPL 0x200 + #define UIC_COMMAND_COMPL 0x400 + #define DEVICE_FATAL_ERROR 0x800 ++#define UTP_ERROR 0x1000 + #define CONTROLLER_FATAL_ERROR 0x10000 + #define SYSTEM_BUS_FATAL_ERROR 0x20000 + #define CRYPTO_ENGINE_FATAL_ERROR 0x40000 +@@ -204,7 +205,8 @@ static inline u32 ufshci_version(u32 major, u32 minor) + CONTROLLER_FATAL_ERROR |\ + SYSTEM_BUS_FATAL_ERROR |\ + CRYPTO_ENGINE_FATAL_ERROR |\ +- UIC_LINK_LOST) ++ UIC_LINK_LOST |\ ++ UTP_ERROR) + + /* HCS - Host Controller Status 30h */ + #define DEVICE_PRESENT 0x1 +-- +2.51.0 + diff --git a/queue-6.12/series b/queue-6.12/series index 624e93780e..615b34c713 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -455,3 +455,39 @@ rdma-hns-fix-the-modification-of-max_send_sge.patch rdma-hns-fix-wrong-wqe-data-when-qp-wraps-around.patch btrfs-fix-memory-leak-of-qgroup_list-in-btrfs_add_qg.patch btrfs-mark-dirty-extent-range-for-out-of-bound-preal.patch +clk-qcom-gcc-ipq6018-rework-nss_port5-clock-to-multi.patch +fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch +um-fix-help-message-for-ssl-non-raw.patch +clk-sunxi-ng-sun6i-rtc-add-a523-specifics.patch +rtc-pcf2127-clear-minute-second-interrupt.patch +arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch +clk-at91-sam9x7-add-peripheral-clock-id-for-pmecc.patch +clk-at91-clk-master-add-check-for-divide-by-3.patch +clk-at91-clk-sam9x60-pll-force-write-to-pll_updt-reg.patch +9p-trans_fd-p9_fd_request-kick-rx-thread-if-epollin.patch +clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch +clk-scmi-add-duty-cycle-ops-only-when-duty-cycle-is-.patch +clk-clocking-wizard-fix-output-clock-register-offset.patch +ntb-epf-allow-arbitrary-bar-mapping.patch +9p-fix-sys-fs-9p-caches-overwriting-itself.patch +cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch +9p-sysfs_init-don-t-hardcode-error-to-enomem.patch +scsi-ufs-core-include-utp-error-in-int_fatal_errors.patch +acpi-property-return-present-device-nodes-only-on-fw.patch +loongarch-handle-new-atomic-instructions-for-probes.patch +tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch +tools-lib-thermal-don-t-preserve-owner-in-install.patch +tools-lib-thermal-use-pkg-config-to-locate-libnl3.patch +fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch +rtc-pcf2127-fix-watchdog-interrupt-mask-on-pcf2131.patch +net-wwan-t7xx-add-support-for-hp-drmr-h01.patch +kbuild-uapi-strip-comments-before-size-type-check.patch +asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch +drm-amdkfd-fix-mmap-write-lock-not-release.patch +ceph-add-checking-of-wait_for_completion_killable-re.patch +ceph-fix-potential-race-condition-in-ceph_ioctl_lazy.patch +ceph-refactor-wake_up_bit-pattern-of-calling.patch +ceph-fix-multifs-mds-auth-caps-issue.patch +x86-use-cmov-for-user-address-masking.patch +x86-runtime-const-add-the-runtime_const_ptr-assembly.patch +x86-uaccess-don-t-use-runtime-const-rewriting-in-mod.patch diff --git a/queue-6.12/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch b/queue-6.12/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch new file mode 100644 index 0000000000..6e35c5ee6b --- /dev/null +++ b/queue-6.12/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch @@ -0,0 +1,66 @@ +From f6767e116bdd50d450a080ab0500fa8f47e3389f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 15:47:06 -0700 +Subject: tools bitmap: Add missing asm-generic/bitsperlong.h include +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ian Rogers + +[ Upstream commit f38ce0209ab4553906b44bd1159e35c740a84161 ] + +small_const_nbits is defined in asm-generic/bitsperlong.h which +bitmap.h uses but doesn't include causing build failures in some build +systems. Add the missing #include. + +Note the bitmap.h in tools has diverged from that of the kernel, so no +changes are made there. + +Signed-off-by: Ian Rogers +Acked-by: Yury Norov +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: André Almeida +Cc: Daniel Borkmann +Cc: Darren Hart +Cc: David S. Miller +Cc: Davidlohr Bueso +Cc: Ido Schimmel +Cc: Ingo Molnar +Cc: Jakub Kicinski +Cc: Jamal Hadi Salim +Cc: Jason Xing +Cc: Jiri Olsa +Cc: Jonas Gottlieb +Cc: Kan Liang +Cc: Mark Rutland +Cc: Maurice Lambert +Cc: Namhyung Kim +Cc: Paolo Abeni +Cc: Peter Zijlstra +Cc: Petr Machata +Cc: Rasmus Villemoes +Cc: Thomas Gleixner +Cc: Yuyang Huang +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/include/linux/bitmap.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/include/linux/bitmap.h b/tools/include/linux/bitmap.h +index 2a7f260ef9dc5..7081f4a8d634b 100644 +--- a/tools/include/linux/bitmap.h ++++ b/tools/include/linux/bitmap.h +@@ -3,6 +3,7 @@ + #define _TOOLS_LINUX_BITMAP_H + + #include ++#include + #include + #include + #include +-- +2.51.0 + diff --git a/queue-6.12/tools-lib-thermal-don-t-preserve-owner-in-install.patch b/queue-6.12/tools-lib-thermal-don-t-preserve-owner-in-install.patch new file mode 100644 index 0000000000..b5b140164f --- /dev/null +++ b/queue-6.12/tools-lib-thermal-don-t-preserve-owner-in-install.patch @@ -0,0 +1,41 @@ +From f054c1c970b1ff2631405d59c940ac704bbaa06b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 13:40:56 +0200 +Subject: tools: lib: thermal: don't preserve owner in install + +From: Emil Dahl Juhl + +[ Upstream commit 1375152bb02ab2a8435e87ea27034482dbc95f57 ] + +Instead of preserving mode, timestamp, and owner, for the object files +during installation, just preserve the mode and timestamp. + +When installing as root, the installed files should be owned by root. +When installing as user, --preserve=ownership doesn't work anyway. This +makes --preserve=ownership rather pointless. + +Signed-off-by: Emil Dahl Juhl +Signed-off-by: Sascha Hauer +Acked-by: Daniel Lezcano +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + tools/lib/thermal/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/thermal/Makefile b/tools/lib/thermal/Makefile +index 8890fd57b110c..1694889847caf 100644 +--- a/tools/lib/thermal/Makefile ++++ b/tools/lib/thermal/Makefile +@@ -147,7 +147,7 @@ endef + install_lib: libs + $(call QUIET_INSTALL, $(LIBTHERMAL_ALL)) \ + $(call do_install_mkdir,$(libdir_SQ)); \ +- cp -fpR $(LIBTHERMAL_ALL) $(DESTDIR)$(libdir_SQ) ++ cp -fR --preserve=mode,timestamp $(LIBTHERMAL_ALL) $(DESTDIR)$(libdir_SQ) + + install_headers: + $(call QUIET_INSTALL, headers) \ +-- +2.51.0 + diff --git a/queue-6.12/tools-lib-thermal-use-pkg-config-to-locate-libnl3.patch b/queue-6.12/tools-lib-thermal-use-pkg-config-to-locate-libnl3.patch new file mode 100644 index 0000000000..751aa78b2d --- /dev/null +++ b/queue-6.12/tools-lib-thermal-use-pkg-config-to-locate-libnl3.patch @@ -0,0 +1,49 @@ +From f73bf9dacd2e018a736d5358a62d210051a63a15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 13:40:55 +0200 +Subject: tools: lib: thermal: use pkg-config to locate libnl3 + +From: Sascha Hauer + +[ Upstream commit b31f7f725cd932e2c2b41f3e4b66273653953687 ] + +To make libthermal more cross compile friendly use pkg-config to locate +libnl3. Only if that fails fall back to hardcoded /usr/include/libnl3. + +Signed-off-by: Sascha Hauer +Acked-by: Daniel Lezcano +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + tools/lib/thermal/Makefile | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/tools/lib/thermal/Makefile b/tools/lib/thermal/Makefile +index 1694889847caf..8d21ea1950a31 100644 +--- a/tools/lib/thermal/Makefile ++++ b/tools/lib/thermal/Makefile +@@ -59,8 +59,12 @@ else + CFLAGS := -g -Wall + endif + ++NL3_CFLAGS = $(shell pkg-config --cflags libnl-3.0 2>/dev/null) ++ifeq ($(NL3_CFLAGS),) ++NL3_CFLAGS = -I/usr/include/libnl3 ++endif ++ + INCLUDES = \ +--I/usr/include/libnl3 \ + -I$(srctree)/tools/lib/thermal/include \ + -I$(srctree)/tools/lib/ \ + -I$(srctree)/tools/include \ +@@ -72,6 +76,7 @@ INCLUDES = \ + override CFLAGS += $(EXTRA_WARNINGS) + override CFLAGS += -Werror -Wall + override CFLAGS += -fPIC ++override CFLAGS += $(NL3_CFLAGS) + override CFLAGS += $(INCLUDES) + override CFLAGS += -fvisibility=hidden + override CFGLAS += -Wl,-L. +-- +2.51.0 + diff --git a/queue-6.12/um-fix-help-message-for-ssl-non-raw.patch b/queue-6.12/um-fix-help-message-for-ssl-non-raw.patch new file mode 100644 index 0000000000..b4c28d668c --- /dev/null +++ b/queue-6.12/um-fix-help-message-for-ssl-non-raw.patch @@ -0,0 +1,36 @@ +From d3aa7e9538ce3ce41085473b7749b72534d22199 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 08:56:59 +0800 +Subject: um: Fix help message for ssl-non-raw + +From: Tiwei Bie + +[ Upstream commit 725e9d81868fcedaeef775948e699955b01631ae ] + +Add the missing option name in the help message. Additionally, +switch to __uml_help(), because this is a global option rather +than a per-channel option. + +Signed-off-by: Tiwei Bie +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + arch/um/drivers/ssl.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/um/drivers/ssl.c b/arch/um/drivers/ssl.c +index 277cea3d30eb5..8006a5bd578c2 100644 +--- a/arch/um/drivers/ssl.c ++++ b/arch/um/drivers/ssl.c +@@ -199,4 +199,7 @@ static int ssl_non_raw_setup(char *str) + return 1; + } + __setup("ssl-non-raw", ssl_non_raw_setup); +-__channel_help(ssl_non_raw_setup, "set serial lines to non-raw mode"); ++__uml_help(ssl_non_raw_setup, ++"ssl-non-raw\n" ++" Set serial lines to non-raw mode.\n\n" ++); +-- +2.51.0 + diff --git a/queue-6.12/x86-runtime-const-add-the-runtime_const_ptr-assembly.patch b/queue-6.12/x86-runtime-const-add-the-runtime_const_ptr-assembly.patch new file mode 100644 index 0000000000..d41b85f42e --- /dev/null +++ b/queue-6.12/x86-runtime-const-add-the-runtime_const_ptr-assembly.patch @@ -0,0 +1,80 @@ +From 2c680779ffe53d74a3e5e3d67dac3ead1d03ba18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Mar 2025 17:33:42 +0200 +Subject: x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro + +From: Kirill A. Shutemov + +[ Upstream commit bd72baff229920da1d57c14364c11ecdbaf5b458 ] + +Add an assembly macro to refer runtime cost. It hides linker magic and +makes assembly more readable. + +Signed-off-by: Kirill A. Shutemov +Signed-off-by: Ingo Molnar +Cc: Brian Gerst +Cc: H. Peter Anvin +Cc: Linus Torvalds +Link: https://lore.kernel.org/r/20250304153342.2016569-1-kirill.shutemov@linux.intel.com +Stable-dep-of: 284922f4c563 ("x86: uaccess: don't use runtime-const rewriting in modules") +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/runtime-const.h | 13 +++++++++++++ + arch/x86/lib/getuser.S | 7 ++----- + 2 files changed, 15 insertions(+), 5 deletions(-) + +diff --git a/arch/x86/include/asm/runtime-const.h b/arch/x86/include/asm/runtime-const.h +index 6652ebddfd02f..8d983cfd06ea6 100644 +--- a/arch/x86/include/asm/runtime-const.h ++++ b/arch/x86/include/asm/runtime-const.h +@@ -2,6 +2,18 @@ + #ifndef _ASM_RUNTIME_CONST_H + #define _ASM_RUNTIME_CONST_H + ++#ifdef __ASSEMBLY__ ++ ++.macro RUNTIME_CONST_PTR sym reg ++ movq $0x0123456789abcdef, %\reg ++ 1: ++ .pushsection runtime_ptr_\sym, "a" ++ .long 1b - 8 - . ++ .popsection ++.endm ++ ++#else /* __ASSEMBLY__ */ ++ + #define runtime_const_ptr(sym) ({ \ + typeof(sym) __ret; \ + asm_inline("mov %1,%0\n1:\n" \ +@@ -58,4 +70,5 @@ static inline void runtime_const_fixup(void (*fn)(void *, unsigned long), + } + } + ++#endif /* __ASSEMBLY__ */ + #endif +diff --git a/arch/x86/lib/getuser.S b/arch/x86/lib/getuser.S +index 89ecd57c9d423..853a2e6287698 100644 +--- a/arch/x86/lib/getuser.S ++++ b/arch/x86/lib/getuser.S +@@ -34,16 +34,13 @@ + #include + #include + #include ++#include + + #define ASM_BARRIER_NOSPEC ALTERNATIVE "", "lfence", X86_FEATURE_LFENCE_RDTSC + + .macro check_range size:req + .if IS_ENABLED(CONFIG_X86_64) +- movq $0x0123456789abcdef,%rdx +- 1: +- .pushsection runtime_ptr_USER_PTR_MAX,"a" +- .long 1b - 8 - . +- .popsection ++ RUNTIME_CONST_PTR USER_PTR_MAX, rdx + cmp %rdx, %rax + cmova %rdx, %rax + .else +-- +2.51.0 + diff --git a/queue-6.12/x86-uaccess-don-t-use-runtime-const-rewriting-in-mod.patch b/queue-6.12/x86-uaccess-don-t-use-runtime-const-rewriting-in-mod.patch new file mode 100644 index 0000000000..9c82b32f5a --- /dev/null +++ b/queue-6.12/x86-uaccess-don-t-use-runtime-const-rewriting-in-mod.patch @@ -0,0 +1,128 @@ +From 6216035330ef8304a38e8875f805ed839801ed1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 15:25:20 +0900 +Subject: x86: uaccess: don't use runtime-const rewriting in modules + +From: Linus Torvalds + +[ Upstream commit 284922f4c563aa3a8558a00f2a05722133237fe8 ] + +The runtime-const infrastructure was never designed to handle the +modular case, because the constant fixup is only done at boot time for +core kernel code. + +But by the time I used it for the x86-64 user space limit handling in +commit 86e6b1547b3d ("x86: fix user address masking non-canonical +speculation issue"), I had completely repressed that fact. + +And it all happens to work because the only code that currently actually +gets inlined by modules is for the access_ok() limit check, where the +default constant value works even when not fixed up. Because at least I +had intentionally made it be something that is in the non-canonical +address space region. + +But it's technically very wrong, and it does mean that at least in +theory, the use of 'access_ok()' + '__get_user()' can trigger the same +speculation issue with non-canonical addresses that the original commit +was all about. + +The pattern is unusual enough that this probably doesn't matter in +practice, but very wrong is still very wrong. Also, let's fix it before +the nice optimized scoped user accessor helpers that Thomas Gleixner is +working on cause this pseudo-constant to then be more widely used. + +This all came up due to an unrelated discussion with Mateusz Guzik about +using the runtime const infrastructure for names_cachep accesses too. +There the modular case was much more obviously broken, and Mateusz noted +it in his 'v2' of the patch series. + +That then made me notice how broken 'access_ok()' had been in modules +all along. Mea culpa, mea maxima culpa. + +Fix it by simply not using the runtime-const code in modules, and just +using the USER_PTR_MAX variable value instead. This is not +performance-critical like the core user accessor functions (get_user() +and friends) are. + +Also make sure this doesn't get forgotten the next time somebody wants +to do runtime constant optimizations by having the x86 runtime-const.h +header file error out if included by modules. + +Fixes: 86e6b1547b3d ("x86: fix user address masking non-canonical speculation issue") +Acked-by: Borislav Petkov +Acked-by: Sean Christopherson +Cc: Thomas Gleixner +Triggered-by: Mateusz Guzik +Link: https://lore.kernel.org/all/20251030105242.801528-1-mjguzik@gmail.com/ +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/runtime-const.h | 4 ++++ + arch/x86/include/asm/uaccess_64.h | 10 +++++----- + arch/x86/kernel/cpu/common.c | 6 +++++- + 3 files changed, 14 insertions(+), 6 deletions(-) + +diff --git a/arch/x86/include/asm/runtime-const.h b/arch/x86/include/asm/runtime-const.h +index 8d983cfd06ea6..e5a13dc8816e2 100644 +--- a/arch/x86/include/asm/runtime-const.h ++++ b/arch/x86/include/asm/runtime-const.h +@@ -2,6 +2,10 @@ + #ifndef _ASM_RUNTIME_CONST_H + #define _ASM_RUNTIME_CONST_H + ++#ifdef MODULE ++ #error "Cannot use runtime-const infrastructure from modules" ++#endif ++ + #ifdef __ASSEMBLY__ + + .macro RUNTIME_CONST_PTR sym reg +diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h +index c52f0133425b9..3f843369f4097 100644 +--- a/arch/x86/include/asm/uaccess_64.h ++++ b/arch/x86/include/asm/uaccess_64.h +@@ -12,12 +12,12 @@ + #include + #include + #include +-#include + +-/* +- * Virtual variable: there's no actual backing store for this, +- * it can purely be used as 'runtime_const_ptr(USER_PTR_MAX)' +- */ ++#ifdef MODULE ++ #define runtime_const_ptr(sym) (sym) ++#else ++ #include ++#endif + extern unsigned long USER_PTR_MAX; + + #ifdef CONFIG_ADDRESS_MASKING +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index bc51fccba4cb6..b54717e6fc606 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -76,6 +76,10 @@ + DEFINE_PER_CPU_READ_MOSTLY(struct cpuinfo_x86, cpu_info); + EXPORT_PER_CPU_SYMBOL(cpu_info); + ++/* Used for modules: built-in code uses runtime constants */ ++unsigned long USER_PTR_MAX; ++EXPORT_SYMBOL(USER_PTR_MAX); ++ + u32 elf_hwcap2 __read_mostly; + + /* Number of siblings per CPU package */ +@@ -2473,7 +2477,7 @@ void __init arch_cpu_finalize_init(void) + alternative_instructions(); + + if (IS_ENABLED(CONFIG_X86_64)) { +- unsigned long USER_PTR_MAX = TASK_SIZE_MAX; ++ USER_PTR_MAX = TASK_SIZE_MAX; + + /* + * Enable this when LAM is gated on LASS support +-- +2.51.0 + diff --git a/queue-6.12/x86-use-cmov-for-user-address-masking.patch b/queue-6.12/x86-use-cmov-for-user-address-masking.patch new file mode 100644 index 0000000000..5d4daf6c8e --- /dev/null +++ b/queue-6.12/x86-use-cmov-for-user-address-masking.patch @@ -0,0 +1,87 @@ +From be5b93a58835133902b9bfa9db98d4495b112573 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 10:25:04 -0800 +Subject: x86: use cmov for user address masking +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linus Torvalds + +[ Upstream commit 91309a70829d94c735c8bb1cc383e78c96127a16 ] + +This was a suggestion by David Laight, and while I was slightly worried +that some micro-architecture would predict cmov like a conditional +branch, there is little reason to actually believe any core would be +that broken. + +Intel documents that their existing cores treat CMOVcc as a data +dependency that will constrain speculation in their "Speculative +Execution Side Channel Mitigations" whitepaper: + + "Other instructions such as CMOVcc, AND, ADC, SBB and SETcc can also + be used to prevent bounds check bypass by constraining speculative + execution on current family 6 processors (Intel® Core™, Intel® Atom™, + Intel® Xeon® and Intel® Xeon Phi™ processors)" + +and while that leaves the future uarch issues open, that's certainly +true of our traditional SBB usage too. + +Any core that predicts CMOV will be unusable for various crypto +algorithms that need data-independent timing stability, so let's just +treat CMOV as the safe choice that simplifies the address masking by +avoiding an extra instruction and doesn't need a temporary register. + +Suggested-by: David Laight +Link: https://www.intel.com/content/dam/develop/external/us/en/documents/336996-speculative-execution-side-channel-mitigations.pdf +Signed-off-by: Linus Torvalds +Stable-dep-of: 284922f4c563 ("x86: uaccess: don't use runtime-const rewriting in modules") +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/uaccess_64.h | 12 ++++++------ + arch/x86/lib/getuser.S | 5 ++--- + 2 files changed, 8 insertions(+), 9 deletions(-) + +diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h +index b0a887209400d..c52f0133425b9 100644 +--- a/arch/x86/include/asm/uaccess_64.h ++++ b/arch/x86/include/asm/uaccess_64.h +@@ -63,13 +63,13 @@ static inline unsigned long __untagged_addr_remote(struct mm_struct *mm, + */ + static inline void __user *mask_user_address(const void __user *ptr) + { +- unsigned long mask; ++ void __user *ret; + asm("cmp %1,%0\n\t" +- "sbb %0,%0" +- :"=r" (mask) +- :"r" (ptr), +- "0" (runtime_const_ptr(USER_PTR_MAX))); +- return (__force void __user *)(mask | (__force unsigned long)ptr); ++ "cmova %1,%0" ++ :"=r" (ret) ++ :"r" (runtime_const_ptr(USER_PTR_MAX)), ++ "0" (ptr)); ++ return ret; + } + #define masked_user_access_begin(x) ({ \ + __auto_type __masked_ptr = (x); \ +diff --git a/arch/x86/lib/getuser.S b/arch/x86/lib/getuser.S +index 4357ec2a0bfc2..89ecd57c9d423 100644 +--- a/arch/x86/lib/getuser.S ++++ b/arch/x86/lib/getuser.S +@@ -44,9 +44,8 @@ + .pushsection runtime_ptr_USER_PTR_MAX,"a" + .long 1b - 8 - . + .popsection +- cmp %rax, %rdx +- sbb %rdx, %rdx +- or %rdx, %rax ++ cmp %rdx, %rax ++ cmova %rdx, %rax + .else + cmp $TASK_SIZE_MAX-\size+1, %eax + jae .Lbad_get_user +-- +2.51.0 + diff --git a/queue-6.17/9p-fix-sys-fs-9p-caches-overwriting-itself.patch b/queue-6.17/9p-fix-sys-fs-9p-caches-overwriting-itself.patch new file mode 100644 index 0000000000..f576341081 --- /dev/null +++ b/queue-6.17/9p-fix-sys-fs-9p-caches-overwriting-itself.patch @@ -0,0 +1,41 @@ +From aba7e2f068b8a2284f0f34401c6490b96308d48b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 18:27:30 +0900 +Subject: 9p: fix /sys/fs/9p/caches overwriting itself +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Randall P. Embry + +[ Upstream commit 86db0c32f16c5538ddb740f54669ace8f3a1f3d7 ] + +caches_show() overwrote its buffer on each iteration, +so only the last cache tag was visible in sysfs output. + +Properly append with snprintf(buf + count, …). + +Signed-off-by: Randall P. Embry +Message-ID: <20250926-v9fs_misc-v1-2-a8b3907fc04d@codewreck.org> +Signed-off-by: Dominique Martinet +Signed-off-by: Sasha Levin +--- + fs/9p/v9fs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c +index 77e9c4387c1df..714cfe76ee651 100644 +--- a/fs/9p/v9fs.c ++++ b/fs/9p/v9fs.c +@@ -561,7 +561,7 @@ static ssize_t caches_show(struct kobject *kobj, + spin_lock(&v9fs_sessionlist_lock); + list_for_each_entry(v9ses, &v9fs_sessionlist, slist) { + if (v9ses->cachetag) { +- n = snprintf(buf, limit, "%s\n", v9ses->cachetag); ++ n = snprintf(buf + count, limit, "%s\n", v9ses->cachetag); + if (n < 0) { + count = n; + break; +-- +2.51.0 + diff --git a/queue-6.17/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch b/queue-6.17/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch new file mode 100644 index 0000000000..bb72566372 --- /dev/null +++ b/queue-6.17/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch @@ -0,0 +1,46 @@ +From 3a2e2c7d6437f2b186ce623025990ca6e70ebf01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 18:27:31 +0900 +Subject: 9p: sysfs_init: don't hardcode error to ENOMEM + +From: Randall P. Embry + +[ Upstream commit 528f218b31aac4bbfc58914d43766a22ab545d48 ] + +v9fs_sysfs_init() always returned -ENOMEM on failure; +return the actual sysfs_create_group() error instead. + +Signed-off-by: Randall P. Embry +Message-ID: <20250926-v9fs_misc-v1-3-a8b3907fc04d@codewreck.org> +Signed-off-by: Dominique Martinet +Signed-off-by: Sasha Levin +--- + fs/9p/v9fs.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c +index 714cfe76ee651..a59c26cc3c7d9 100644 +--- a/fs/9p/v9fs.c ++++ b/fs/9p/v9fs.c +@@ -597,13 +597,16 @@ static const struct attribute_group v9fs_attr_group = { + + static int __init v9fs_sysfs_init(void) + { ++ int ret; ++ + v9fs_kobj = kobject_create_and_add("9p", fs_kobj); + if (!v9fs_kobj) + return -ENOMEM; + +- if (sysfs_create_group(v9fs_kobj, &v9fs_attr_group)) { ++ ret = sysfs_create_group(v9fs_kobj, &v9fs_attr_group); ++ if (ret) { + kobject_put(v9fs_kobj); +- return -ENOMEM; ++ return ret; + } + + return 0; +-- +2.51.0 + diff --git a/queue-6.17/9p-trans_fd-p9_fd_request-kick-rx-thread-if-epollin.patch b/queue-6.17/9p-trans_fd-p9_fd_request-kick-rx-thread-if-epollin.patch new file mode 100644 index 0000000000..77e853c185 --- /dev/null +++ b/queue-6.17/9p-trans_fd-p9_fd_request-kick-rx-thread-if-epollin.patch @@ -0,0 +1,69 @@ +From bbf20db8fddaed474a517eb73638e624755f614f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Aug 2025 18:10:13 +0200 +Subject: 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN + +From: Oleg Nesterov + +[ Upstream commit e8fe3f07a357c39d429e02ca34f740692d88967a ] + +p9_read_work() doesn't set Rworksched and doesn't do schedule_work(m->rq) +if list_empty(&m->req_list). + +However, if the pipe is full, we need to read more data and this used to +work prior to commit aaec5a95d59615 ("pipe_read: don't wake up the writer +if the pipe is still full"). + +p9_read_work() does p9_fd_read() -> ... -> anon_pipe_read() which (before +the commit above) triggered the unnecessary wakeup. This wakeup calls +p9_pollwake() which kicks p9_poll_workfn() -> p9_poll_mux(), p9_poll_mux() +will notice EPOLLIN and schedule_work(&m->rq). + +This no longer happens after the optimization above, change p9_fd_request() +to use p9_poll_mux() instead of only checking for EPOLLOUT. + +Reported-by: syzbot+d1b5dace43896bc386c3@syzkaller.appspotmail.com +Tested-by: syzbot+d1b5dace43896bc386c3@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/68a2de8f.050a0220.e29e5.0097.GAE@google.com/ +Link: https://lore.kernel.org/all/67dedd2f.050a0220.31a16b.003f.GAE@google.com/ +Co-developed-by: K Prateek Nayak +Signed-off-by: K Prateek Nayak +Signed-off-by: Oleg Nesterov +Tested-by: K Prateek Nayak +Message-ID: <20250819161013.GB11345@redhat.com> +Signed-off-by: Dominique Martinet +Signed-off-by: Sasha Levin +--- + net/9p/trans_fd.c | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c +index 8992d8bebbddf..a516745f732f7 100644 +--- a/net/9p/trans_fd.c ++++ b/net/9p/trans_fd.c +@@ -666,7 +666,6 @@ static void p9_poll_mux(struct p9_conn *m) + + static int p9_fd_request(struct p9_client *client, struct p9_req_t *req) + { +- __poll_t n; + int err; + struct p9_trans_fd *ts = client->trans; + struct p9_conn *m = &ts->conn; +@@ -686,13 +685,7 @@ static int p9_fd_request(struct p9_client *client, struct p9_req_t *req) + list_add_tail(&req->req_list, &m->unsent_req_list); + spin_unlock(&m->req_lock); + +- if (test_and_clear_bit(Wpending, &m->wsched)) +- n = EPOLLOUT; +- else +- n = p9_fd_poll(m->client, NULL, NULL); +- +- if (n & EPOLLOUT && !test_and_set_bit(Wworksched, &m->wsched)) +- schedule_work(&m->wq); ++ p9_poll_mux(m); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.17/acpi-property-return-present-device-nodes-only-on-fw.patch b/queue-6.17/acpi-property-return-present-device-nodes-only-on-fw.patch new file mode 100644 index 0000000000..476afc1005 --- /dev/null +++ b/queue-6.17/acpi-property-return-present-device-nodes-only-on-fw.patch @@ -0,0 +1,75 @@ +From f57494d05ab0bcec590e8543bc09ad7edc44d08a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 13:26:36 +0300 +Subject: ACPI: property: Return present device nodes only on fwnode interface + +From: Sakari Ailus + +[ Upstream commit d9f866b2bb3eec38b3734f1fed325ec7c55ccdfa ] + +fwnode_graph_get_next_subnode() may return fwnode backed by ACPI +device nodes and there has been no check these devices are present +in the system, unlike there has been on fwnode OF backend. + +In order to provide consistent behaviour towards callers, +add a check for device presence by introducing +a new function acpi_get_next_present_subnode(), used as the +get_next_child_node() fwnode operation that also checks device +node presence. + +Signed-off-by: Sakari Ailus +Reviewed-by: Laurent Pinchart +Reviewed-by: Jonathan Cameron +Link: https://patch.msgid.link/20251001102636.1272722-2-sakari.ailus@linux.intel.com +[ rjw: Kerneldoc comment and changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/property.c | 24 +++++++++++++++++++++++- + 1 file changed, 23 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c +index c086786fe84cb..d74678f0ba4af 100644 +--- a/drivers/acpi/property.c ++++ b/drivers/acpi/property.c +@@ -1357,6 +1357,28 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode, + return NULL; + } + ++/* ++ * acpi_get_next_present_subnode - Return the next present child node handle ++ * @fwnode: Firmware node to find the next child node for. ++ * @child: Handle to one of the device's child nodes or a null handle. ++ * ++ * Like acpi_get_next_subnode(), but the device nodes returned by ++ * acpi_get_next_present_subnode() are guaranteed to be present. ++ * ++ * Returns: The fwnode handle of the next present sub-node. ++ */ ++static struct fwnode_handle * ++acpi_get_next_present_subnode(const struct fwnode_handle *fwnode, ++ struct fwnode_handle *child) ++{ ++ do { ++ child = acpi_get_next_subnode(fwnode, child); ++ } while (is_acpi_device_node(child) && ++ !acpi_device_is_present(to_acpi_device_node(child))); ++ ++ return child; ++} ++ + /** + * acpi_node_get_parent - Return parent fwnode of this fwnode + * @fwnode: Firmware node whose parent to get +@@ -1701,7 +1723,7 @@ static int acpi_fwnode_irq_get(const struct fwnode_handle *fwnode, + .property_read_string_array = \ + acpi_fwnode_property_read_string_array, \ + .get_parent = acpi_node_get_parent, \ +- .get_next_child_node = acpi_get_next_subnode, \ ++ .get_next_child_node = acpi_get_next_present_subnode, \ + .get_named_child_node = acpi_fwnode_get_named_child_node, \ + .get_name = acpi_fwnode_get_name, \ + .get_name_prefix = acpi_fwnode_get_name_prefix, \ +-- +2.51.0 + diff --git a/queue-6.17/alsa-hda-realtek-add-quirk-for-asus-rog-zephyrus-duo.patch b/queue-6.17/alsa-hda-realtek-add-quirk-for-asus-rog-zephyrus-duo.patch new file mode 100644 index 0000000000..47fd88c5e2 --- /dev/null +++ b/queue-6.17/alsa-hda-realtek-add-quirk-for-asus-rog-zephyrus-duo.patch @@ -0,0 +1,63 @@ +From 936a8271b2cd133176e0f0c9bcdbcce1533c8344 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 11:09:14 -0400 +Subject: ALSA: hda/realtek: Add quirk for ASUS ROG Zephyrus Duo + +From: Adam Holliday + +[ Upstream commit 328b80b29a6a165c47fcc04d2bef3e09ed1d28f9 ] + +The ASUS ROG Zephyrus Duo 15 SE (GX551QS) with ALC 289 codec requires specific +pin configuration for proper volume control. Without this quirk, volume +adjustments produce a muffled sound effect as only certain channels attenuate, +leaving bass frequency at full volume. + +Testing with hdajackretask confirms these pin tweaks fix the issue: +- Pin 0x17: Internal Speaker (LFE) +- Pin 0x1e: Internal Speaker + +Signed-off-by: Adam Holliday +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/codecs/realtek/alc269.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c +index 8fb1a5c6ff6df..28297e936a96f 100644 +--- a/sound/hda/codecs/realtek/alc269.c ++++ b/sound/hda/codecs/realtek/alc269.c +@@ -3737,6 +3737,7 @@ enum { + ALC285_FIXUP_ASUS_GA605K_HEADSET_MIC, + ALC285_FIXUP_ASUS_GA605K_I2C_SPEAKER2_TO_DAC1, + ALC269_FIXUP_POSITIVO_P15X_HEADSET_MIC, ++ ALC289_FIXUP_ASUS_ZEPHYRUS_DUAL_SPK, + }; + + /* A special fixup for Lenovo C940 and Yoga Duet 7; +@@ -6166,6 +6167,14 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC269VC_FIXUP_ACER_MIC_NO_PRESENCE, + }, ++ [ALC289_FIXUP_ASUS_ZEPHYRUS_DUAL_SPK] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x17, 0x90170151 }, /* Internal Speaker LFE */ ++ { 0x1e, 0x90170150 }, /* Internal Speaker */ ++ { } ++ }, ++ } + }; + + static const struct hda_quirk alc269_fixup_tbl[] = { +@@ -6721,6 +6730,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A), + SND_PCI_QUIRK(0x1043, 0x1533, "ASUS GV302XA/XJ/XQ/XU/XV/XI", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x1043, 0x1573, "ASUS GZ301VV/VQ/VU/VJ/VA/VC/VE/VVC/VQC/VUC/VJC/VEC/VCC", ALC285_FIXUP_ASUS_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1043, 0x1652, "ASUS ROG Zephyrus Do 15 SE", ALC289_FIXUP_ASUS_ZEPHYRUS_DUAL_SPK), + SND_PCI_QUIRK(0x1043, 0x1662, "ASUS GV301QH", ALC294_FIXUP_ASUS_DUAL_SPK), + SND_PCI_QUIRK(0x1043, 0x1663, "ASUS GU603ZI/ZJ/ZQ/ZU/ZV", ALC285_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x1683, "ASUS UM3402YAR", ALC287_FIXUP_CS35L41_I2C_2), +-- +2.51.0 + diff --git a/queue-6.17/arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch b/queue-6.17/arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch new file mode 100644 index 0000000000..7b609d9c30 --- /dev/null +++ b/queue-6.17/arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch @@ -0,0 +1,59 @@ +From c78247bd0b701bb0004fd8ecc8ea43c13daf2d7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 16:54:27 +0200 +Subject: ARM: at91: pm: save and restore ACR during PLL disable/enable + +From: Nicolas Ferre + +[ Upstream commit 0c01fe49651d387776abed6a28541e80c8a93319 ] + +Add a new word in assembly to store ACR value during the calls +to at91_plla_disable/at91_plla_enable macros and use it. + +Signed-off-by: Nicolas Ferre +[cristian.birsan@microchip.com: remove ACR_DEFAULT_PLLA loading] +Signed-off-by: Cristian Birsan +Link: https://lore.kernel.org/r/20250827145427.46819-4-nicolas.ferre@microchip.com +Reviewed-by: Alexandre Belloni +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + arch/arm/mach-at91/pm_suspend.S | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S +index 7e6c94f8edeef..aad53ec9e957b 100644 +--- a/arch/arm/mach-at91/pm_suspend.S ++++ b/arch/arm/mach-at91/pm_suspend.S +@@ -689,6 +689,10 @@ sr_dis_exit: + bic tmp2, tmp2, #AT91_PMC_PLL_UPDT_ID + str tmp2, [pmc, #AT91_PMC_PLL_UPDT] + ++ /* save acr */ ++ ldr tmp2, [pmc, #AT91_PMC_PLL_ACR] ++ str tmp2, .saved_acr ++ + /* save div. */ + mov tmp1, #0 + ldr tmp2, [pmc, #AT91_PMC_PLL_CTRL0] +@@ -758,7 +762,7 @@ sr_dis_exit: + str tmp1, [pmc, #AT91_PMC_PLL_UPDT] + + /* step 2. */ +- ldr tmp1, =AT91_PMC_PLL_ACR_DEFAULT_PLLA ++ ldr tmp1, .saved_acr + str tmp1, [pmc, #AT91_PMC_PLL_ACR] + + /* step 3. */ +@@ -1207,6 +1211,8 @@ ENDPROC(at91_pm_suspend_in_sram) + #endif + .saved_mckr: + .word 0 ++.saved_acr: ++ .word 0 + .saved_pllar: + .word 0 + .saved_sam9_lpr: +-- +2.51.0 + diff --git a/queue-6.17/asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch b/queue-6.17/asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch new file mode 100644 index 0000000000..e38d219d06 --- /dev/null +++ b/queue-6.17/asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch @@ -0,0 +1,53 @@ +From 4e588d3407806ccafe7e63d05325f24dfa9ac8e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 00:12:19 +0200 +Subject: ASoC: meson: aiu-encoder-i2s: fix bit clock polarity + +From: Valerio Setti + +[ Upstream commit 4c4ed5e073a923fb3323022e1131cb51ad8df7a0 ] + +According to I2S specs audio data is sampled on the rising edge of the +clock and it can change on the falling one. When operating in normal mode +this SoC behaves the opposite so a clock polarity inversion is required +in this case. + +This was tested on an OdroidC2 (Amlogic S905 SoC) board. + +Signed-off-by: Valerio Setti +Reviewed-by: Jerome Brunet +Tested-by: Jerome Brunet +Link: https://patch.msgid.link/20251007-fix-i2s-polarity-v1-1-86704d9cda10@baylibre.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/meson/aiu-encoder-i2s.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/meson/aiu-encoder-i2s.c b/sound/soc/meson/aiu-encoder-i2s.c +index a0dd914c8ed13..3b4061508c180 100644 +--- a/sound/soc/meson/aiu-encoder-i2s.c ++++ b/sound/soc/meson/aiu-encoder-i2s.c +@@ -236,8 +236,12 @@ static int aiu_encoder_i2s_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) + inv == SND_SOC_DAIFMT_IB_IF) + val |= AIU_CLK_CTRL_LRCLK_INVERT; + +- if (inv == SND_SOC_DAIFMT_IB_NF || +- inv == SND_SOC_DAIFMT_IB_IF) ++ /* ++ * The SoC changes data on the rising edge of the bitclock ++ * so an inversion of the bitclock is required in normal mode ++ */ ++ if (inv == SND_SOC_DAIFMT_NB_NF || ++ inv == SND_SOC_DAIFMT_NB_IF) + val |= AIU_CLK_CTRL_AOCLK_INVERT; + + /* Signal skew */ +@@ -328,4 +332,3 @@ const struct snd_soc_dai_ops aiu_encoder_i2s_dai_ops = { + .startup = aiu_encoder_i2s_startup, + .shutdown = aiu_encoder_i2s_shutdown, + }; +- +-- +2.51.0 + diff --git a/queue-6.17/asoc-rt722-add-settings-for-rt722vb.patch b/queue-6.17/asoc-rt722-add-settings-for-rt722vb.patch new file mode 100644 index 0000000000..6fa8a454e3 --- /dev/null +++ b/queue-6.17/asoc-rt722-add-settings-for-rt722vb.patch @@ -0,0 +1,114 @@ +From e860c2ca270dd4c802b521f5c179df52ddfa441d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 16:09:50 +0800 +Subject: ASoC: rt722: add settings for rt722VB + +From: Shuming Fan + +[ Upstream commit a27539810e1e61efcfdeb51777ed875dc61e9d49 ] + +This patch adds settings for RT722VB. + +Signed-off-by: Shuming Fan +Link: https://patch.msgid.link/20251007080950.1999411-1-shumingf@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt722-sdca-sdw.c | 2 +- + sound/soc/codecs/rt722-sdca.c | 14 ++++++++++++++ + sound/soc/codecs/rt722-sdca.h | 6 ++++++ + 3 files changed, 21 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt722-sdca-sdw.c b/sound/soc/codecs/rt722-sdca-sdw.c +index 70700bdb80a14..5ea40c1b159a8 100644 +--- a/sound/soc/codecs/rt722-sdca-sdw.c ++++ b/sound/soc/codecs/rt722-sdca-sdw.c +@@ -21,7 +21,7 @@ static int rt722_sdca_mbq_size(struct device *dev, unsigned int reg) + switch (reg) { + case 0x2f01 ... 0x2f0a: + case 0x2f35 ... 0x2f36: +- case 0x2f50: ++ case 0x2f50 ... 0x2f52: + case 0x2f54: + case 0x2f58 ... 0x2f5d: + case SDW_SDCA_CTL(FUNC_NUM_JACK_CODEC, RT722_SDCA_ENT0, RT722_SDCA_CTL_FUNC_STATUS, 0): +diff --git a/sound/soc/codecs/rt722-sdca.c b/sound/soc/codecs/rt722-sdca.c +index 333611490ae35..79b8b7e70a334 100644 +--- a/sound/soc/codecs/rt722-sdca.c ++++ b/sound/soc/codecs/rt722-sdca.c +@@ -1378,6 +1378,9 @@ static void rt722_sdca_dmic_preset(struct rt722_sdca_priv *rt722) + /* PHYtiming TDZ/TZD control */ + regmap_write(rt722->regmap, 0x2f03, 0x06); + ++ if (rt722->hw_vid == RT722_VB) ++ regmap_write(rt722->regmap, 0x2f52, 0x00); ++ + /* clear flag */ + regmap_write(rt722->regmap, + SDW_SDCA_CTL(FUNC_NUM_MIC_ARRAY, RT722_SDCA_ENT0, RT722_SDCA_CTL_FUNC_STATUS, 0), +@@ -1415,6 +1418,9 @@ static void rt722_sdca_amp_preset(struct rt722_sdca_priv *rt722) + SDW_SDCA_CTL(FUNC_NUM_AMP, RT722_SDCA_ENT_OT23, + RT722_SDCA_CTL_VENDOR_DEF, CH_08), 0x04); + ++ if (rt722->hw_vid == RT722_VB) ++ regmap_write(rt722->regmap, 0x2f54, 0x00); ++ + /* clear flag */ + regmap_write(rt722->regmap, + SDW_SDCA_CTL(FUNC_NUM_AMP, RT722_SDCA_ENT0, RT722_SDCA_CTL_FUNC_STATUS, 0), +@@ -1506,6 +1512,9 @@ static void rt722_sdca_jack_preset(struct rt722_sdca_priv *rt722) + rt722_sdca_index_write(rt722, RT722_VENDOR_REG, RT722_DIGITAL_MISC_CTRL4, + 0x0010); + ++ if (rt722->hw_vid == RT722_VB) ++ regmap_write(rt722->regmap, 0x2f51, 0x00); ++ + /* clear flag */ + regmap_write(rt722->regmap, + SDW_SDCA_CTL(FUNC_NUM_JACK_CODEC, RT722_SDCA_ENT0, RT722_SDCA_CTL_FUNC_STATUS, 0), +@@ -1516,6 +1525,7 @@ static void rt722_sdca_jack_preset(struct rt722_sdca_priv *rt722) + int rt722_sdca_io_init(struct device *dev, struct sdw_slave *slave) + { + struct rt722_sdca_priv *rt722 = dev_get_drvdata(dev); ++ unsigned int val; + + rt722->disable_irq = false; + +@@ -1545,6 +1555,10 @@ int rt722_sdca_io_init(struct device *dev, struct sdw_slave *slave) + + pm_runtime_get_noresume(&slave->dev); + ++ rt722_sdca_index_read(rt722, RT722_VENDOR_REG, RT722_JD_PRODUCT_NUM, &val); ++ rt722->hw_vid = (val & 0x0f00) >> 8; ++ dev_dbg(&slave->dev, "%s hw_vid=0x%x\n", __func__, rt722->hw_vid); ++ + rt722_sdca_dmic_preset(rt722); + rt722_sdca_amp_preset(rt722); + rt722_sdca_jack_preset(rt722); +diff --git a/sound/soc/codecs/rt722-sdca.h b/sound/soc/codecs/rt722-sdca.h +index 3c383705dd3cd..823abee9ab76c 100644 +--- a/sound/soc/codecs/rt722-sdca.h ++++ b/sound/soc/codecs/rt722-sdca.h +@@ -39,6 +39,7 @@ struct rt722_sdca_priv { + /* For DMIC */ + bool fu1e_dapm_mute; + bool fu1e_mixer_mute[4]; ++ int hw_vid; + }; + + struct rt722_sdca_dmic_kctrl_priv { +@@ -233,6 +234,11 @@ enum rt722_sdca_jd_src { + RT722_JD1, + }; + ++enum rt722_sdca_version { ++ RT722_VA, ++ RT722_VB, ++}; ++ + int rt722_sdca_io_init(struct device *dev, struct sdw_slave *slave); + int rt722_sdca_init(struct device *dev, struct regmap *regmap, struct sdw_slave *slave); + int rt722_sdca_index_write(struct rt722_sdca_priv *rt722, +-- +2.51.0 + diff --git a/queue-6.17/ceph-add-checking-of-wait_for_completion_killable-re.patch b/queue-6.17/ceph-add-checking-of-wait_for_completion_killable-re.patch new file mode 100644 index 0000000000..07c09f4c34 --- /dev/null +++ b/queue-6.17/ceph-add-checking-of-wait_for_completion_killable-re.patch @@ -0,0 +1,50 @@ +From 3c6afecb041121388c0c857c8b93866a5c883b8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jun 2025 12:04:32 -0700 +Subject: ceph: add checking of wait_for_completion_killable() return value + +From: Viacheslav Dubeyko + +[ Upstream commit b7ed1e29cfe773d648ca09895b92856bd3a2092d ] + +The Coverity Scan service has detected the calling of +wait_for_completion_killable() without checking the return +value in ceph_lock_wait_for_completion() [1]. The CID 1636232 +defect contains explanation: "If the function returns an error +value, the error value may be mistaken for a normal value. +In ceph_lock_wait_for_completion(): Value returned from +a function is not checked for errors before being used. (CWE-252)". + +The patch adds the checking of wait_for_completion_killable() +return value and return the error code from +ceph_lock_wait_for_completion(). + +[1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1636232 + +Signed-off-by: Viacheslav Dubeyko +Reviewed-by: Alex Markuze +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/locks.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c +index ebf4ac0055ddc..dd764f9c64b9f 100644 +--- a/fs/ceph/locks.c ++++ b/fs/ceph/locks.c +@@ -221,7 +221,10 @@ static int ceph_lock_wait_for_completion(struct ceph_mds_client *mdsc, + if (err && err != -ERESTARTSYS) + return err; + +- wait_for_completion_killable(&req->r_safe_completion); ++ err = wait_for_completion_killable(&req->r_safe_completion); ++ if (err) ++ return err; ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.17/ceph-fix-multifs-mds-auth-caps-issue.patch b/queue-6.17/ceph-fix-multifs-mds-auth-caps-issue.patch new file mode 100644 index 0000000000..42ec0780fb --- /dev/null +++ b/queue-6.17/ceph-fix-multifs-mds-auth-caps-issue.patch @@ -0,0 +1,175 @@ +From ffa2a9eed483dbd67f578430a1ec114494745e5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Sep 2025 15:02:35 +0530 +Subject: ceph: fix multifs mds auth caps issue + +From: Kotresh HR + +[ Upstream commit 22c73d52a6d05c5a2053385c0d6cd9984732799d ] + +The mds auth caps check should also validate the +fsname along with the associated caps. Not doing +so would result in applying the mds auth caps of +one fs on to the other fs in a multifs ceph cluster. +The bug causes multiple issues w.r.t user +authentication, following is one such example. + +Steps to Reproduce (on vstart cluster): +1. Create two file systems in a cluster, say 'fsname1' and 'fsname2' +2. Authorize read only permission to the user 'client.usr' on fs 'fsname1' + $ceph fs authorize fsname1 client.usr / r +3. Authorize read and write permission to the same user 'client.usr' on fs 'fsname2' + $ceph fs authorize fsname2 client.usr / rw +4. Update the keyring + $ceph auth get client.usr >> ./keyring + +With above permssions for the user 'client.usr', following is the +expectation. + a. The 'client.usr' should be able to only read the contents + and not allowed to create or delete files on file system 'fsname1'. + b. The 'client.usr' should be able to read/write on file system 'fsname2'. + +But, with this bug, the 'client.usr' is allowed to read/write on file +system 'fsname1'. See below. + +5. Mount the file system 'fsname1' with the user 'client.usr' + $sudo bin/mount.ceph usr@.fsname1=/ /kmnt_fsname1_usr/ +6. Try creating a file on file system 'fsname1' with user 'client.usr'. This + should fail but passes with this bug. + $touch /kmnt_fsname1_usr/file1 +7. Mount the file system 'fsname1' with the user 'client.admin' and create a + file. + $sudo bin/mount.ceph admin@.fsname1=/ /kmnt_fsname1_admin + $echo "data" > /kmnt_fsname1_admin/admin_file1 +8. Try removing an existing file on file system 'fsname1' with the user + 'client.usr'. This shoudn't succeed but succeeds with the bug. + $rm -f /kmnt_fsname1_usr/admin_file1 + +For more information, please take a look at the corresponding mds/fuse patch +and tests added by looking into the tracker mentioned below. + +v2: Fix a possible null dereference in doutc +v3: Don't store fsname from mdsmap, validate against + ceph_mount_options's fsname and use it +v4: Code refactor, better warning message and + fix possible compiler warning + +[ Slava.Dubeyko: "fsname check failed" -> "fsname mismatch" ] + +Link: https://tracker.ceph.com/issues/72167 +Signed-off-by: Kotresh HR +Reviewed-by: Viacheslav Dubeyko +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/mds_client.c | 8 ++++++++ + fs/ceph/mdsmap.c | 14 +++++++++++++- + fs/ceph/super.c | 14 -------------- + fs/ceph/super.h | 14 ++++++++++++++ + 4 files changed, 35 insertions(+), 15 deletions(-) + +diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c +index 3bc72b47fe4d4..3efbc11596e00 100644 +--- a/fs/ceph/mds_client.c ++++ b/fs/ceph/mds_client.c +@@ -5649,11 +5649,19 @@ static int ceph_mds_auth_match(struct ceph_mds_client *mdsc, + u32 caller_uid = from_kuid(&init_user_ns, cred->fsuid); + u32 caller_gid = from_kgid(&init_user_ns, cred->fsgid); + struct ceph_client *cl = mdsc->fsc->client; ++ const char *fs_name = mdsc->fsc->mount_options->mds_namespace; + const char *spath = mdsc->fsc->mount_options->server_path; + bool gid_matched = false; + u32 gid, tlen, len; + int i, j; + ++ doutc(cl, "fsname check fs_name=%s match.fs_name=%s\n", ++ fs_name, auth->match.fs_name ? auth->match.fs_name : ""); ++ if (auth->match.fs_name && strcmp(auth->match.fs_name, fs_name)) { ++ /* fsname mismatch, try next one */ ++ return 0; ++ } ++ + doutc(cl, "match.uid %lld\n", auth->match.uid); + if (auth->match.uid != MDS_AUTH_UID_ANY) { + if (auth->match.uid != caller_uid) +diff --git a/fs/ceph/mdsmap.c b/fs/ceph/mdsmap.c +index 8109aba66e023..2c7b151a7c95c 100644 +--- a/fs/ceph/mdsmap.c ++++ b/fs/ceph/mdsmap.c +@@ -353,10 +353,22 @@ struct ceph_mdsmap *ceph_mdsmap_decode(struct ceph_mds_client *mdsc, void **p, + __decode_and_drop_type(p, end, u8, bad_ext); + } + if (mdsmap_ev >= 8) { ++ u32 fsname_len; + /* enabled */ + ceph_decode_8_safe(p, end, m->m_enabled, bad_ext); + /* fs_name */ +- ceph_decode_skip_string(p, end, bad_ext); ++ ceph_decode_32_safe(p, end, fsname_len, bad_ext); ++ ++ /* validate fsname against mds_namespace */ ++ if (!namespace_equals(mdsc->fsc->mount_options, *p, ++ fsname_len)) { ++ pr_warn_client(cl, "fsname %*pE doesn't match mds_namespace %s\n", ++ (int)fsname_len, (char *)*p, ++ mdsc->fsc->mount_options->mds_namespace); ++ goto bad; ++ } ++ /* skip fsname after validation */ ++ ceph_decode_skip_n(p, end, fsname_len, bad); + } + /* damaged */ + if (mdsmap_ev >= 9) { +diff --git a/fs/ceph/super.c b/fs/ceph/super.c +index c3eb651862c55..ebef5244ae25a 100644 +--- a/fs/ceph/super.c ++++ b/fs/ceph/super.c +@@ -246,20 +246,6 @@ static void canonicalize_path(char *path) + path[j] = '\0'; + } + +-/* +- * Check if the mds namespace in ceph_mount_options matches +- * the passed in namespace string. First time match (when +- * ->mds_namespace is NULL) is treated specially, since +- * ->mds_namespace needs to be initialized by the caller. +- */ +-static int namespace_equals(struct ceph_mount_options *fsopt, +- const char *namespace, size_t len) +-{ +- return !(fsopt->mds_namespace && +- (strlen(fsopt->mds_namespace) != len || +- strncmp(fsopt->mds_namespace, namespace, len))); +-} +- + static int ceph_parse_old_source(const char *dev_name, const char *dev_name_end, + struct fs_context *fc) + { +diff --git a/fs/ceph/super.h b/fs/ceph/super.h +index cf176aab0f823..4ac6561285b18 100644 +--- a/fs/ceph/super.h ++++ b/fs/ceph/super.h +@@ -104,6 +104,20 @@ struct ceph_mount_options { + struct fscrypt_dummy_policy dummy_enc_policy; + }; + ++/* ++ * Check if the mds namespace in ceph_mount_options matches ++ * the passed in namespace string. First time match (when ++ * ->mds_namespace is NULL) is treated specially, since ++ * ->mds_namespace needs to be initialized by the caller. ++ */ ++static inline int namespace_equals(struct ceph_mount_options *fsopt, ++ const char *namespace, size_t len) ++{ ++ return !(fsopt->mds_namespace && ++ (strlen(fsopt->mds_namespace) != len || ++ strncmp(fsopt->mds_namespace, namespace, len))); ++} ++ + /* mount state */ + enum { + CEPH_MOUNT_MOUNTING, +-- +2.51.0 + diff --git a/queue-6.17/ceph-fix-potential-race-condition-in-ceph_ioctl_lazy.patch b/queue-6.17/ceph-fix-potential-race-condition-in-ceph_ioctl_lazy.patch new file mode 100644 index 0000000000..63318ec97e --- /dev/null +++ b/queue-6.17/ceph-fix-potential-race-condition-in-ceph_ioctl_lazy.patch @@ -0,0 +1,79 @@ +From ef060e252a477b4569a5060aab7c5d7136d277f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jun 2025 11:31:08 -0700 +Subject: ceph: fix potential race condition in ceph_ioctl_lazyio() + +From: Viacheslav Dubeyko + +[ Upstream commit 5824ccba9a39a3ad914fc9b2972a2c1119abaac9 ] + +The Coverity Scan service has detected potential +race condition in ceph_ioctl_lazyio() [1]. + +The CID 1591046 contains explanation: "Check of thread-shared +field evades lock acquisition (LOCK_EVASION). Thread1 sets +fmode to a new value. Now the two threads have an inconsistent +view of fmode and updates to fields correlated with fmode +may be lost. The data guarded by this critical section may +be read while in an inconsistent state or modified by multiple +racing threads. In ceph_ioctl_lazyio: Checking the value of +a thread-shared field outside of a locked region to determine +if a locked operation involving that thread shared field +has completed. (CWE-543)". + +The patch places fi->fmode field access under ci->i_ceph_lock +protection. Also, it introduces the is_file_already_lazy +variable that is set under the lock and it is checked later +out of scope of critical section. + +[1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1591046 + +Signed-off-by: Viacheslav Dubeyko +Reviewed-by: Alex Markuze +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/ioctl.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/fs/ceph/ioctl.c b/fs/ceph/ioctl.c +index e861de3c79b9e..15cde055f3da1 100644 +--- a/fs/ceph/ioctl.c ++++ b/fs/ceph/ioctl.c +@@ -246,21 +246,28 @@ static long ceph_ioctl_lazyio(struct file *file) + struct ceph_inode_info *ci = ceph_inode(inode); + struct ceph_mds_client *mdsc = ceph_inode_to_fs_client(inode)->mdsc; + struct ceph_client *cl = mdsc->fsc->client; ++ bool is_file_already_lazy = false; + ++ spin_lock(&ci->i_ceph_lock); + if ((fi->fmode & CEPH_FILE_MODE_LAZY) == 0) { +- spin_lock(&ci->i_ceph_lock); + fi->fmode |= CEPH_FILE_MODE_LAZY; + ci->i_nr_by_mode[ffs(CEPH_FILE_MODE_LAZY)]++; + __ceph_touch_fmode(ci, mdsc, fi->fmode); +- spin_unlock(&ci->i_ceph_lock); ++ } else { ++ is_file_already_lazy = true; ++ } ++ spin_unlock(&ci->i_ceph_lock); ++ ++ if (is_file_already_lazy) { ++ doutc(cl, "file %p %p %llx.%llx already lazy\n", file, inode, ++ ceph_vinop(inode)); ++ } else { + doutc(cl, "file %p %p %llx.%llx marked lazy\n", file, inode, + ceph_vinop(inode)); + + ceph_check_caps(ci, 0); +- } else { +- doutc(cl, "file %p %p %llx.%llx already lazy\n", file, inode, +- ceph_vinop(inode)); + } ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.17/ceph-refactor-wake_up_bit-pattern-of-calling.patch b/queue-6.17/ceph-refactor-wake_up_bit-pattern-of-calling.patch new file mode 100644 index 0000000000..b299fb4a34 --- /dev/null +++ b/queue-6.17/ceph-refactor-wake_up_bit-pattern-of-calling.patch @@ -0,0 +1,78 @@ +From c6e2e1f8577df4a55ad05338c6202a0d385fd8b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Jul 2025 12:20:57 -0700 +Subject: ceph: refactor wake_up_bit() pattern of calling + +From: Viacheslav Dubeyko + +[ Upstream commit 53db6f25ee47cb1265141d31562604e56146919a ] + +The wake_up_bit() is called in ceph_async_unlink_cb(), +wake_async_create_waiters(), and ceph_finish_async_create(). +It makes sense to switch on clear_bit() function, because +it makes the code much cleaner and easier to understand. +More important rework is the adding of smp_mb__after_atomic() +memory barrier after the bit modification and before +wake_up_bit() call. It can prevent potential race condition +of accessing the modified bit in other threads. Luckily, +clear_and_wake_up_bit() already implements the required +functionality pattern: + +static inline void clear_and_wake_up_bit(int bit, unsigned long *word) +{ + clear_bit_unlock(bit, word); + /* See wake_up_bit() for which memory barrier you need to use. */ + smp_mb__after_atomic(); + wake_up_bit(word, bit); +} + +Signed-off-by: Viacheslav Dubeyko +Reviewed-by: Alex Markuze +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/dir.c | 3 +-- + fs/ceph/file.c | 6 ++---- + 2 files changed, 3 insertions(+), 6 deletions(-) + +diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c +index 32973c62c1a23..d18c0eaef9b7e 100644 +--- a/fs/ceph/dir.c ++++ b/fs/ceph/dir.c +@@ -1260,8 +1260,7 @@ static void ceph_async_unlink_cb(struct ceph_mds_client *mdsc, + spin_unlock(&fsc->async_unlink_conflict_lock); + + spin_lock(&dentry->d_lock); +- di->flags &= ~CEPH_DENTRY_ASYNC_UNLINK; +- wake_up_bit(&di->flags, CEPH_DENTRY_ASYNC_UNLINK_BIT); ++ clear_and_wake_up_bit(CEPH_DENTRY_ASYNC_UNLINK_BIT, &di->flags); + spin_unlock(&dentry->d_lock); + + synchronize_rcu(); +diff --git a/fs/ceph/file.c b/fs/ceph/file.c +index 978acd3d4b329..d7b943feb9320 100644 +--- a/fs/ceph/file.c ++++ b/fs/ceph/file.c +@@ -579,8 +579,7 @@ static void wake_async_create_waiters(struct inode *inode, + + spin_lock(&ci->i_ceph_lock); + if (ci->i_ceph_flags & CEPH_I_ASYNC_CREATE) { +- ci->i_ceph_flags &= ~CEPH_I_ASYNC_CREATE; +- wake_up_bit(&ci->i_ceph_flags, CEPH_ASYNC_CREATE_BIT); ++ clear_and_wake_up_bit(CEPH_ASYNC_CREATE_BIT, &ci->i_ceph_flags); + + if (ci->i_ceph_flags & CEPH_I_ASYNC_CHECK_CAPS) { + ci->i_ceph_flags &= ~CEPH_I_ASYNC_CHECK_CAPS; +@@ -762,8 +761,7 @@ static int ceph_finish_async_create(struct inode *dir, struct inode *inode, + } + + spin_lock(&dentry->d_lock); +- di->flags &= ~CEPH_DENTRY_ASYNC_CREATE; +- wake_up_bit(&di->flags, CEPH_DENTRY_ASYNC_CREATE_BIT); ++ clear_and_wake_up_bit(CEPH_DENTRY_ASYNC_CREATE_BIT, &di->flags); + spin_unlock(&dentry->d_lock); + + return ret; +-- +2.51.0 + diff --git a/queue-6.17/clk-at91-add-acr-in-all-pll-settings.patch b/queue-6.17/clk-at91-add-acr-in-all-pll-settings.patch new file mode 100644 index 0000000000..84aa8115ad --- /dev/null +++ b/queue-6.17/clk-at91-add-acr-in-all-pll-settings.patch @@ -0,0 +1,160 @@ +From facbebb6e1420216c384564470ac0db9ba1f0e0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Nov 2024 17:47:17 +0200 +Subject: clk: at91: add ACR in all PLL settings + +From: Cristian Birsan + +[ Upstream commit bfa2bddf6ffe0ac034d02cda20c74ef05571210e ] + +Add the ACR register to all PLL settings and provide the correct +ACR value for each PLL used in different SoCs. + +Suggested-by: Mihai Sain +Signed-off-by: Cristian Birsan +[nicolas.ferre@microchip.com: add sama7d65 and review commit message] +Signed-off-by: Nicolas Ferre +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/pmc.h | 1 + + drivers/clk/at91/sam9x60.c | 2 ++ + drivers/clk/at91/sam9x7.c | 5 +++++ + drivers/clk/at91/sama7d65.c | 4 ++++ + drivers/clk/at91/sama7g5.c | 2 ++ + 5 files changed, 14 insertions(+) + +diff --git a/drivers/clk/at91/pmc.h b/drivers/clk/at91/pmc.h +index 4fb29ca111f7d..5daa32c4cf254 100644 +--- a/drivers/clk/at91/pmc.h ++++ b/drivers/clk/at91/pmc.h +@@ -80,6 +80,7 @@ struct clk_pll_characteristics { + u16 *icpll; + u8 *out; + u8 upll : 1; ++ u32 acr; + }; + + struct clk_programmable_layout { +diff --git a/drivers/clk/at91/sam9x60.c b/drivers/clk/at91/sam9x60.c +index db6db9e2073eb..18baf4a256f47 100644 +--- a/drivers/clk/at91/sam9x60.c ++++ b/drivers/clk/at91/sam9x60.c +@@ -36,6 +36,7 @@ static const struct clk_pll_characteristics plla_characteristics = { + .num_output = ARRAY_SIZE(plla_outputs), + .output = plla_outputs, + .core_output = core_outputs, ++ .acr = UL(0x00020010), + }; + + static const struct clk_range upll_outputs[] = { +@@ -48,6 +49,7 @@ static const struct clk_pll_characteristics upll_characteristics = { + .output = upll_outputs, + .core_output = core_outputs, + .upll = true, ++ .acr = UL(0x12023010), /* fIN = [18 MHz, 32 MHz]*/ + }; + + static const struct clk_pll_layout pll_frac_layout = { +diff --git a/drivers/clk/at91/sam9x7.c b/drivers/clk/at91/sam9x7.c +index ffab32b047a01..7322220418b45 100644 +--- a/drivers/clk/at91/sam9x7.c ++++ b/drivers/clk/at91/sam9x7.c +@@ -107,6 +107,7 @@ static const struct clk_pll_characteristics plla_characteristics = { + .num_output = ARRAY_SIZE(plla_outputs), + .output = plla_outputs, + .core_output = plla_core_outputs, ++ .acr = UL(0x00020010), /* Old ACR_DEFAULT_PLLA value */ + }; + + static const struct clk_pll_characteristics upll_characteristics = { +@@ -115,6 +116,7 @@ static const struct clk_pll_characteristics upll_characteristics = { + .output = upll_outputs, + .core_output = upll_core_outputs, + .upll = true, ++ .acr = UL(0x12023010), /* fIN=[20 MHz, 32 MHz] */ + }; + + static const struct clk_pll_characteristics lvdspll_characteristics = { +@@ -122,6 +124,7 @@ static const struct clk_pll_characteristics lvdspll_characteristics = { + .num_output = ARRAY_SIZE(lvdspll_outputs), + .output = lvdspll_outputs, + .core_output = lvdspll_core_outputs, ++ .acr = UL(0x12023010), /* fIN=[20 MHz, 32 MHz] */ + }; + + static const struct clk_pll_characteristics audiopll_characteristics = { +@@ -129,6 +132,7 @@ static const struct clk_pll_characteristics audiopll_characteristics = { + .num_output = ARRAY_SIZE(audiopll_outputs), + .output = audiopll_outputs, + .core_output = audiopll_core_outputs, ++ .acr = UL(0x12023010), /* fIN=[20 MHz, 32 MHz] */ + }; + + static const struct clk_pll_characteristics plladiv2_characteristics = { +@@ -136,6 +140,7 @@ static const struct clk_pll_characteristics plladiv2_characteristics = { + .num_output = ARRAY_SIZE(plladiv2_outputs), + .output = plladiv2_outputs, + .core_output = plladiv2_core_outputs, ++ .acr = UL(0x00020010), /* Old ACR_DEFAULT_PLLA value */ + }; + + /* Layout for fractional PLL ID PLLA. */ +diff --git a/drivers/clk/at91/sama7d65.c b/drivers/clk/at91/sama7d65.c +index a5d40df8b2f27..7dee2b160ffb3 100644 +--- a/drivers/clk/at91/sama7d65.c ++++ b/drivers/clk/at91/sama7d65.c +@@ -138,6 +138,7 @@ static const struct clk_pll_characteristics cpu_pll_characteristics = { + .num_output = ARRAY_SIZE(cpu_pll_outputs), + .output = cpu_pll_outputs, + .core_output = core_outputs, ++ .acr = UL(0x00070010), + }; + + /* PLL characteristics. */ +@@ -146,6 +147,7 @@ static const struct clk_pll_characteristics pll_characteristics = { + .num_output = ARRAY_SIZE(pll_outputs), + .output = pll_outputs, + .core_output = core_outputs, ++ .acr = UL(0x00070010), + }; + + static const struct clk_pll_characteristics lvdspll_characteristics = { +@@ -153,6 +155,7 @@ static const struct clk_pll_characteristics lvdspll_characteristics = { + .num_output = ARRAY_SIZE(lvdspll_outputs), + .output = lvdspll_outputs, + .core_output = lvdspll_core_outputs, ++ .acr = UL(0x00070010), + }; + + static const struct clk_pll_characteristics upll_characteristics = { +@@ -160,6 +163,7 @@ static const struct clk_pll_characteristics upll_characteristics = { + .num_output = ARRAY_SIZE(upll_outputs), + .output = upll_outputs, + .core_output = upll_core_outputs, ++ .acr = UL(0x12020010), + .upll = true, + }; + +diff --git a/drivers/clk/at91/sama7g5.c b/drivers/clk/at91/sama7g5.c +index 8385badc1c706..1340c2b006192 100644 +--- a/drivers/clk/at91/sama7g5.c ++++ b/drivers/clk/at91/sama7g5.c +@@ -113,6 +113,7 @@ static const struct clk_pll_characteristics cpu_pll_characteristics = { + .num_output = ARRAY_SIZE(cpu_pll_outputs), + .output = cpu_pll_outputs, + .core_output = core_outputs, ++ .acr = UL(0x00070010), + }; + + /* PLL characteristics. */ +@@ -121,6 +122,7 @@ static const struct clk_pll_characteristics pll_characteristics = { + .num_output = ARRAY_SIZE(pll_outputs), + .output = pll_outputs, + .core_output = core_outputs, ++ .acr = UL(0x00070010), + }; + + /* +-- +2.51.0 + diff --git a/queue-6.17/clk-at91-clk-master-add-check-for-divide-by-3.patch b/queue-6.17/clk-at91-clk-master-add-check-for-divide-by-3.patch new file mode 100644 index 0000000000..ddd43c83d9 --- /dev/null +++ b/queue-6.17/clk-at91-clk-master-add-check-for-divide-by-3.patch @@ -0,0 +1,38 @@ +From 33e888bab078071c138d0e2b7342c3aed3a1b3c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 13:07:17 -0700 +Subject: clk: at91: clk-master: Add check for divide by 3 + +From: Ryan Wanner + +[ Upstream commit e0237f5635727d64635ec6665e1de9f4cacce35c ] + +A potential divider for the master clock is div/3. The register +configuration for div/3 is MASTER_PRES_MAX. The current bit shifting +method does not work for this case. Checking for MASTER_PRES_MAX will +ensure the correct decimal value is stored in the system. + +Signed-off-by: Ryan Wanner +Signed-off-by: Nicolas Ferre +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/clk-master.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/clk/at91/clk-master.c b/drivers/clk/at91/clk-master.c +index 7a544e429d34e..d5ea2069ec83a 100644 +--- a/drivers/clk/at91/clk-master.c ++++ b/drivers/clk/at91/clk-master.c +@@ -580,6 +580,9 @@ clk_sama7g5_master_recalc_rate(struct clk_hw *hw, + { + struct clk_master *master = to_clk_master(hw); + ++ if (master->div == MASTER_PRES_MAX) ++ return DIV_ROUND_CLOSEST_ULL(parent_rate, 3); ++ + return DIV_ROUND_CLOSEST_ULL(parent_rate, (1 << master->div)); + } + +-- +2.51.0 + diff --git a/queue-6.17/clk-at91-clk-sam9x60-pll-force-write-to-pll_updt-reg.patch b/queue-6.17/clk-at91-clk-sam9x60-pll-force-write-to-pll_updt-reg.patch new file mode 100644 index 0000000000..3d1c451eb3 --- /dev/null +++ b/queue-6.17/clk-at91-clk-sam9x60-pll-force-write-to-pll_updt-reg.patch @@ -0,0 +1,214 @@ +From a0c2d76e9a64f7351fffe9fcd9a1a8855fc9541a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 17:08:10 +0200 +Subject: clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register + +From: Nicolas Ferre + +[ Upstream commit af98caeaa7b6ad11eb7b7c8bfaddc769df2889f3 ] + +This register is important for sequencing the commands to PLLs, so +actually write the update bits with regmap_write_bits() instead of +relying on a read/modify/write regmap command that could skip the actual +hardware write if the value is identical to the one read. + +It's changed when modification is needed to the PLL, when +read-only operation is done, we could keep the call to +regmap_update_bits(). + +Add a comment to the sam9x60_div_pll_set_div() function that uses this +PLL_UPDT register so that it's used consistently, according to the +product's datasheet. + +Signed-off-by: Nicolas Ferre +Tested-by: Ryan Wanner # on sama7d65 and sam9x75 +Link: https://lore.kernel.org/r/20250827150811.82496-1-nicolas.ferre@microchip.com +[claudiu.beznea: fix "Alignment should match open parenthesis" + checkpatch.pl check] +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/clk-sam9x60-pll.c | 75 ++++++++++++++++-------------- + 1 file changed, 39 insertions(+), 36 deletions(-) + +diff --git a/drivers/clk/at91/clk-sam9x60-pll.c b/drivers/clk/at91/clk-sam9x60-pll.c +index cefd9948e1039..a035dc15454b0 100644 +--- a/drivers/clk/at91/clk-sam9x60-pll.c ++++ b/drivers/clk/at91/clk-sam9x60-pll.c +@@ -93,8 +93,8 @@ static int sam9x60_frac_pll_set(struct sam9x60_pll_core *core) + + spin_lock_irqsave(core->lock, flags); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_ID_MSK, core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_ID_MSK, core->id); + regmap_read(regmap, AT91_PMC_PLL_CTRL1, &val); + cmul = (val & core->layout->mul_mask) >> core->layout->mul_shift; + cfrac = (val & core->layout->frac_mask) >> core->layout->frac_shift; +@@ -128,17 +128,17 @@ static int sam9x60_frac_pll_set(struct sam9x60_pll_core *core) + udelay(10); + } + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, + AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL, + AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + while (!sam9x60_pll_ready(regmap, core->id)) + cpu_relax(); +@@ -164,8 +164,8 @@ static void sam9x60_frac_pll_unprepare(struct clk_hw *hw) + + spin_lock_irqsave(core->lock, flags); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_ID_MSK, core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_ID_MSK, core->id); + + regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, AT91_PMC_PLL_CTRL0_ENPLL, 0); + +@@ -173,9 +173,9 @@ static void sam9x60_frac_pll_unprepare(struct clk_hw *hw) + regmap_update_bits(regmap, AT91_PMC_PLL_ACR, + AT91_PMC_PLL_ACR_UTMIBG | AT91_PMC_PLL_ACR_UTMIVR, 0); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + spin_unlock_irqrestore(core->lock, flags); + } +@@ -262,8 +262,8 @@ static int sam9x60_frac_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate, + + spin_lock_irqsave(core->lock, irqflags); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, +- core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, ++ core->id); + regmap_read(regmap, AT91_PMC_PLL_CTRL1, &val); + cmul = (val & core->layout->mul_mask) >> core->layout->mul_shift; + cfrac = (val & core->layout->frac_mask) >> core->layout->frac_shift; +@@ -275,18 +275,18 @@ static int sam9x60_frac_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate, + (frac->mul << core->layout->mul_shift) | + (frac->frac << core->layout->frac_shift)); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, + AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL, + AT91_PMC_PLL_CTRL0_ENLOCK | + AT91_PMC_PLL_CTRL0_ENPLL); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + while (!sam9x60_pll_ready(regmap, core->id)) + cpu_relax(); +@@ -338,7 +338,10 @@ static const struct clk_ops sam9x60_frac_pll_ops_chg = { + .restore_context = sam9x60_frac_pll_restore_context, + }; + +-/* This function should be called with spinlock acquired. */ ++/* This function should be called with spinlock acquired. ++ * Warning: this function must be called only if the same PLL ID was set in ++ * PLL_UPDT register previously. ++ */ + static void sam9x60_div_pll_set_div(struct sam9x60_pll_core *core, u32 div, + bool enable) + { +@@ -350,9 +353,9 @@ static void sam9x60_div_pll_set_div(struct sam9x60_pll_core *core, u32 div, + core->layout->div_mask | ena_msk, + (div << core->layout->div_shift) | ena_val); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + while (!sam9x60_pll_ready(regmap, core->id)) + cpu_relax(); +@@ -366,8 +369,8 @@ static int sam9x60_div_pll_set(struct sam9x60_pll_core *core) + unsigned int val, cdiv; + + spin_lock_irqsave(core->lock, flags); +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_ID_MSK, core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_ID_MSK, core->id); + regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val); + cdiv = (val & core->layout->div_mask) >> core->layout->div_shift; + +@@ -398,15 +401,15 @@ static void sam9x60_div_pll_unprepare(struct clk_hw *hw) + + spin_lock_irqsave(core->lock, flags); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_ID_MSK, core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_ID_MSK, core->id); + + regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, + core->layout->endiv_mask, 0); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + spin_unlock_irqrestore(core->lock, flags); + } +@@ -518,8 +521,8 @@ static int sam9x60_div_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate, + div->div = DIV_ROUND_CLOSEST(parent_rate, rate) - 1; + + spin_lock_irqsave(core->lock, irqflags); +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, +- core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, ++ core->id); + regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val); + cdiv = (val & core->layout->div_mask) >> core->layout->div_shift; + +@@ -574,8 +577,8 @@ static int sam9x60_div_pll_notifier_fn(struct notifier_block *notifier, + div->div = div->safe_div; + + spin_lock_irqsave(core.lock, irqflags); +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, +- core.id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, ++ core.id); + regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val); + cdiv = (val & core.layout->div_mask) >> core.layout->div_shift; + +-- +2.51.0 + diff --git a/queue-6.17/clk-at91-sam9x7-add-peripheral-clock-id-for-pmecc.patch b/queue-6.17/clk-at91-sam9x7-add-peripheral-clock-id-for-pmecc.patch new file mode 100644 index 0000000000..9f7e8382ed --- /dev/null +++ b/queue-6.17/clk-at91-sam9x7-add-peripheral-clock-id-for-pmecc.patch @@ -0,0 +1,36 @@ +From d86499862e80a6179c1c831f1adb05bd96767203 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 16:08:17 +0530 +Subject: clk: at91: sam9x7: Add peripheral clock id for pmecc + +From: Balamanikandan Gunasundar + +[ Upstream commit 94a1274100e397a27361ae53ace37be6da42a079 ] + +Add pmecc instance id in peripheral clock description. + +Signed-off-by: Balamanikandan Gunasundar +Link: https://lore.kernel.org/r/20250909103817.49334-1-balamanikandan.gunasundar@microchip.com +[claudiu.beznea@tuxon.dev: use tabs instead of spaces] +Signed-off-by: Claudiu Beznea +Signed-off-by: Nicolas Ferre +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/sam9x7.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/at91/sam9x7.c b/drivers/clk/at91/sam9x7.c +index 7322220418b45..89868a0aeaba9 100644 +--- a/drivers/clk/at91/sam9x7.c ++++ b/drivers/clk/at91/sam9x7.c +@@ -408,6 +408,7 @@ static const struct { + { .n = "pioD_clk", .id = 44, }, + { .n = "tcb1_clk", .id = 45, }, + { .n = "dbgu_clk", .id = 47, }, ++ { .n = "pmecc_clk", .id = 48, }, + /* + * mpddr_clk feeds DDR controller and is enabled by bootloader thus we + * need to keep it enabled in case there is no Linux consumer for it. +-- +2.51.0 + diff --git a/queue-6.17/clk-clocking-wizard-fix-output-clock-register-offset.patch b/queue-6.17/clk-clocking-wizard-fix-output-clock-register-offset.patch new file mode 100644 index 0000000000..c4569a5e73 --- /dev/null +++ b/queue-6.17/clk-clocking-wizard-fix-output-clock-register-offset.patch @@ -0,0 +1,40 @@ +From 999022ab0502c6fdc7cf7419bfefb796a050b7ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 14:40:02 +0530 +Subject: clk: clocking-wizard: Fix output clock register offset for Versal + platforms + +From: Shubhrajyoti Datta + +[ Upstream commit 7c2e86f7b5af93d0e78c16e4359318fe7797671d ] + +The output clock register offset used in clk_wzrd_register_output_clocks +was incorrectly referencing 0x3C instead of 0x38, which caused +misconfiguration of output dividers on Versal platforms. + +Correcting the off-by-one error ensures proper configuration of output +clocks. + +Signed-off-by: Shubhrajyoti Datta +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/xilinx/clk-xlnx-clock-wizard.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c +index 0295a13a811cf..f209a02e82725 100644 +--- a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c ++++ b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c +@@ -1108,7 +1108,7 @@ static int clk_wzrd_register_output_clocks(struct device *dev, int nr_outputs) + (dev, + clkout_name, clk_name, 0, + clk_wzrd->base, +- (WZRD_CLK_CFG_REG(is_versal, 3) + i * 8), ++ (WZRD_CLK_CFG_REG(is_versal, 2) + i * 8), + WZRD_CLKOUT_DIVIDE_SHIFT, + WZRD_CLKOUT_DIVIDE_WIDTH, + CLK_DIVIDER_ONE_BASED | +-- +2.51.0 + diff --git a/queue-6.17/clk-qcom-gcc-ipq6018-rework-nss_port5-clock-to-multi.patch b/queue-6.17/clk-qcom-gcc-ipq6018-rework-nss_port5-clock-to-multi.patch new file mode 100644 index 0000000000..510eb9847b --- /dev/null +++ b/queue-6.17/clk-qcom-gcc-ipq6018-rework-nss_port5-clock-to-multi.patch @@ -0,0 +1,140 @@ +From 411bed4e1ae37f0ded589cb6d506a80b705a6d43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Aug 2025 12:55:46 +0300 +Subject: clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marko Mäkelä + +[ Upstream commit 2f7b168323c22faafb1fbf94ef93b7ce5efc15c6 ] + +Rework nss_port5 to use the new multiple configuration implementation +and correctly fix the clocks for this port under some corner case. + +In OpenWrt, this patch avoids intermittent dmesg errors of the form +nss_port5_rx_clk_src: rcg didn't update its configuration. + +This is a mechanical, straightforward port of +commit e88f03230dc07aa3293b6aeb078bd27370bb2594 +("clk: qcom: gcc-ipq8074: rework nss_port5/6 clock to multiple conf") +to gcc-ipq6018, with two conflicts resolved: different frequency of the +P_XO clock source, and only 5 Ethernet ports. + +This was originally developed by JiaY-shi . + +Link: https://lore.kernel.org/all/20231220221724.3822-4-ansuelsmth@gmail.com/ +Signed-off-by: Marko Mäkelä +Tested-by: Marko Mäkelä +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20250802095546.295448-1-marko.makela@iki.fi +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq6018.c | 60 +++++++++++++++++++++------------- + 1 file changed, 38 insertions(+), 22 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-ipq6018.c b/drivers/clk/qcom/gcc-ipq6018.c +index d861191b0c85c..d4fc491a18b22 100644 +--- a/drivers/clk/qcom/gcc-ipq6018.c ++++ b/drivers/clk/qcom/gcc-ipq6018.c +@@ -511,15 +511,23 @@ static struct clk_rcg2 apss_ahb_clk_src = { + }, + }; + +-static const struct freq_tbl ftbl_nss_port5_rx_clk_src[] = { +- F(24000000, P_XO, 1, 0, 0), +- F(25000000, P_UNIPHY1_RX, 12.5, 0, 0), +- F(25000000, P_UNIPHY0_RX, 5, 0, 0), +- F(78125000, P_UNIPHY1_RX, 4, 0, 0), +- F(125000000, P_UNIPHY1_RX, 2.5, 0, 0), +- F(125000000, P_UNIPHY0_RX, 1, 0, 0), +- F(156250000, P_UNIPHY1_RX, 2, 0, 0), +- F(312500000, P_UNIPHY1_RX, 1, 0, 0), ++static const struct freq_conf ftbl_nss_port5_rx_clk_src_25[] = { ++ C(P_UNIPHY1_RX, 12.5, 0, 0), ++ C(P_UNIPHY0_RX, 5, 0, 0), ++}; ++ ++static const struct freq_conf ftbl_nss_port5_rx_clk_src_125[] = { ++ C(P_UNIPHY1_RX, 2.5, 0, 0), ++ C(P_UNIPHY0_RX, 1, 0, 0), ++}; ++ ++static const struct freq_multi_tbl ftbl_nss_port5_rx_clk_src[] = { ++ FMS(24000000, P_XO, 1, 0, 0), ++ FM(25000000, ftbl_nss_port5_rx_clk_src_25), ++ FMS(78125000, P_UNIPHY1_RX, 4, 0, 0), ++ FM(125000000, ftbl_nss_port5_rx_clk_src_125), ++ FMS(156250000, P_UNIPHY1_RX, 2, 0, 0), ++ FMS(312500000, P_UNIPHY1_RX, 1, 0, 0), + { } + }; + +@@ -547,26 +555,34 @@ gcc_xo_uniphy0_rx_tx_uniphy1_rx_tx_ubi32_bias_map[] = { + + static struct clk_rcg2 nss_port5_rx_clk_src = { + .cmd_rcgr = 0x68060, +- .freq_tbl = ftbl_nss_port5_rx_clk_src, ++ .freq_multi_tbl = ftbl_nss_port5_rx_clk_src, + .hid_width = 5, + .parent_map = gcc_xo_uniphy0_rx_tx_uniphy1_rx_tx_ubi32_bias_map, + .clkr.hw.init = &(struct clk_init_data){ + .name = "nss_port5_rx_clk_src", + .parent_data = gcc_xo_uniphy0_rx_tx_uniphy1_rx_tx_ubi32_bias, + .num_parents = 7, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_fm_ops, + }, + }; + +-static const struct freq_tbl ftbl_nss_port5_tx_clk_src[] = { +- F(24000000, P_XO, 1, 0, 0), +- F(25000000, P_UNIPHY1_TX, 12.5, 0, 0), +- F(25000000, P_UNIPHY0_TX, 5, 0, 0), +- F(78125000, P_UNIPHY1_TX, 4, 0, 0), +- F(125000000, P_UNIPHY1_TX, 2.5, 0, 0), +- F(125000000, P_UNIPHY0_TX, 1, 0, 0), +- F(156250000, P_UNIPHY1_TX, 2, 0, 0), +- F(312500000, P_UNIPHY1_TX, 1, 0, 0), ++static const struct freq_conf ftbl_nss_port5_tx_clk_src_25[] = { ++ C(P_UNIPHY1_TX, 12.5, 0, 0), ++ C(P_UNIPHY0_TX, 5, 0, 0), ++}; ++ ++static const struct freq_conf ftbl_nss_port5_tx_clk_src_125[] = { ++ C(P_UNIPHY1_TX, 2.5, 0, 0), ++ C(P_UNIPHY0_TX, 1, 0, 0), ++}; ++ ++static const struct freq_multi_tbl ftbl_nss_port5_tx_clk_src[] = { ++ FMS(24000000, P_XO, 1, 0, 0), ++ FM(25000000, ftbl_nss_port5_tx_clk_src_25), ++ FMS(78125000, P_UNIPHY1_TX, 4, 0, 0), ++ FM(125000000, ftbl_nss_port5_tx_clk_src_125), ++ FMS(156250000, P_UNIPHY1_TX, 2, 0, 0), ++ FMS(312500000, P_UNIPHY1_TX, 1, 0, 0), + { } + }; + +@@ -594,14 +610,14 @@ gcc_xo_uniphy0_tx_rx_uniphy1_tx_rx_ubi32_bias_map[] = { + + static struct clk_rcg2 nss_port5_tx_clk_src = { + .cmd_rcgr = 0x68068, +- .freq_tbl = ftbl_nss_port5_tx_clk_src, ++ .freq_multi_tbl = ftbl_nss_port5_tx_clk_src, + .hid_width = 5, + .parent_map = gcc_xo_uniphy0_tx_rx_uniphy1_tx_rx_ubi32_bias_map, + .clkr.hw.init = &(struct clk_init_data){ + .name = "nss_port5_tx_clk_src", + .parent_data = gcc_xo_uniphy0_tx_rx_uniphy1_tx_rx_ubi32_bias, + .num_parents = 7, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_fm_ops, + }, + }; + +-- +2.51.0 + diff --git a/queue-6.17/clk-renesas-rzv2h-re-assert-reset-on-deassert-timeou.patch b/queue-6.17/clk-renesas-rzv2h-re-assert-reset-on-deassert-timeou.patch new file mode 100644 index 0000000000..bce6494072 --- /dev/null +++ b/queue-6.17/clk-renesas-rzv2h-re-assert-reset-on-deassert-timeou.patch @@ -0,0 +1,57 @@ +From 1169d9f7d2800ebdafbe279c345706864ad2f4af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 10:27:52 +0200 +Subject: clk: renesas: rzv2h: Re-assert reset on deassert timeout + +From: Tommaso Merciai + +[ Upstream commit f8c002165ca27d95d3d15e865dd0a47c0a1b14dd ] + +Prevent issues during reset deassertion by re-asserting the reset if a +timeout occurs when trying to deassert. This ensures the reset line is in a +known state and improves reliability for hardware that may not immediately +clear the reset monitor bit. + +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Tommaso Merciai +Link: https://lore.kernel.org/20250903082757.115778-4-tommaso.merciai.xr@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/clk/renesas/rzv2h-cpg.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/clk/renesas/rzv2h-cpg.c b/drivers/clk/renesas/rzv2h-cpg.c +index f468afbb54e2d..5dfe660d13422 100644 +--- a/drivers/clk/renesas/rzv2h-cpg.c ++++ b/drivers/clk/renesas/rzv2h-cpg.c +@@ -864,6 +864,7 @@ static int __rzv2h_cpg_assert(struct reset_controller_dev *rcdev, + u32 mask = BIT(priv->resets[id].reset_bit); + u8 monbit = priv->resets[id].mon_bit; + u32 value = mask << 16; ++ int ret; + + dev_dbg(rcdev->dev, "%s id:%ld offset:0x%x\n", + assert ? "assert" : "deassert", id, reg); +@@ -875,9 +876,15 @@ static int __rzv2h_cpg_assert(struct reset_controller_dev *rcdev, + reg = GET_RST_MON_OFFSET(priv->resets[id].mon_index); + mask = BIT(monbit); + +- return readl_poll_timeout_atomic(priv->base + reg, value, +- assert ? (value & mask) : !(value & mask), +- 10, 200); ++ ret = readl_poll_timeout_atomic(priv->base + reg, value, ++ assert ? (value & mask) : !(value & mask), ++ 10, 200); ++ if (ret && !assert) { ++ value = mask << 16; ++ writel(value, priv->base + GET_RST_OFFSET(priv->resets[id].reset_index)); ++ } ++ ++ return ret; + } + + static int rzv2h_cpg_assert(struct reset_controller_dev *rcdev, +-- +2.51.0 + diff --git a/queue-6.17/clk-samsung-exynos990-add-missing-usb-clock-register.patch b/queue-6.17/clk-samsung-exynos990-add-missing-usb-clock-register.patch new file mode 100644 index 0000000000..97a864b5cd --- /dev/null +++ b/queue-6.17/clk-samsung-exynos990-add-missing-usb-clock-register.patch @@ -0,0 +1,36 @@ +From f88345c028a79304262b8550c5283b834ae19265 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Aug 2025 12:13:16 +0000 +Subject: clk: samsung: exynos990: Add missing USB clock registers to HSI0 + +From: Denzeel Oliva + +[ Upstream commit f00a5dc81744250e7a3f843adfe12d7883282c56 ] + +These registers are required for proper USB operation and were omitted +in the initial clock controller setup. + +Signed-off-by: Denzeel Oliva +Link: https://lore.kernel.org/r/20250831-usb-v2-3-00b9c0559733@gmail.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/clk/samsung/clk-exynos990.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/samsung/clk-exynos990.c b/drivers/clk/samsung/clk-exynos990.c +index 8571c225d0907..7cf5932e914c2 100644 +--- a/drivers/clk/samsung/clk-exynos990.c ++++ b/drivers/clk/samsung/clk-exynos990.c +@@ -1198,6 +1198,8 @@ static const unsigned long hsi0_clk_regs[] __initconst = { + CLK_CON_GAT_GOUT_BLK_HSI0_UID_SYSMMU_USB_IPCLKPORT_CLK_S2, + CLK_CON_GAT_GOUT_BLK_HSI0_UID_SYSREG_HSI0_IPCLKPORT_PCLK, + CLK_CON_GAT_GOUT_BLK_HSI0_UID_USB31DRD_IPCLKPORT_ACLK_PHYCTRL, ++ CLK_CON_GAT_GOUT_BLK_HSI0_UID_USB31DRD_IPCLKPORT_I_USB31DRD_REF_CLK_40, ++ CLK_CON_GAT_GOUT_BLK_HSI0_UID_USB31DRD_IPCLKPORT_I_USBDPPHY_REF_SOC_PLL, + CLK_CON_GAT_GOUT_BLK_HSI0_UID_USB31DRD_IPCLKPORT_I_USBDPPHY_SCL_APB_PCLK, + CLK_CON_GAT_GOUT_BLK_HSI0_UID_USB31DRD_IPCLKPORT_I_USBPCS_APB_CLK, + CLK_CON_GAT_GOUT_BLK_HSI0_UID_USB31DRD_IPCLKPORT_BUS_CLK_EARLY, +-- +2.51.0 + diff --git a/queue-6.17/clk-scmi-add-duty-cycle-ops-only-when-duty-cycle-is-.patch b/queue-6.17/clk-scmi-add-duty-cycle-ops-only-when-duty-cycle-is-.patch new file mode 100644 index 0000000000..350d1d6efc --- /dev/null +++ b/queue-6.17/clk-scmi-add-duty-cycle-ops-only-when-duty-cycle-is-.patch @@ -0,0 +1,53 @@ +From 718368b8a0b84518ddba41bacb089912288c523b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 15:04:46 +0800 +Subject: clk: scmi: Add duty cycle ops only when duty cycle is supported + +From: Jacky Bai + +[ Upstream commit 18db1ff2dea0f97dedaeadd18b0cb0a0d76154df ] + +For some of the SCMI based platforms, the oem extended config may be +supported, but not for duty cycle purpose. Skip the duty cycle ops if +err return when trying to get duty cycle info. + +Signed-off-by: Jacky Bai +Reviewed-by: Sudeep Holla +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-scmi.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/clk-scmi.c b/drivers/clk/clk-scmi.c +index d2408403283fc..c2f3ef4e58fe3 100644 +--- a/drivers/clk/clk-scmi.c ++++ b/drivers/clk/clk-scmi.c +@@ -349,6 +349,8 @@ scmi_clk_ops_select(struct scmi_clk *sclk, bool atomic_capable, + unsigned int atomic_threshold_us, + const struct clk_ops **clk_ops_db, size_t db_size) + { ++ int ret; ++ u32 val; + const struct scmi_clock_info *ci = sclk->info; + unsigned int feats_key = 0; + const struct clk_ops *ops; +@@ -370,8 +372,13 @@ scmi_clk_ops_select(struct scmi_clk *sclk, bool atomic_capable, + if (!ci->parent_ctrl_forbidden) + feats_key |= BIT(SCMI_CLK_PARENT_CTRL_SUPPORTED); + +- if (ci->extended_config) +- feats_key |= BIT(SCMI_CLK_DUTY_CYCLE_SUPPORTED); ++ if (ci->extended_config) { ++ ret = scmi_proto_clk_ops->config_oem_get(sclk->ph, sclk->id, ++ SCMI_CLOCK_CFG_DUTY_CYCLE, ++ &val, NULL, false); ++ if (!ret) ++ feats_key |= BIT(SCMI_CLK_DUTY_CYCLE_SUPPORTED); ++ } + + if (WARN_ON(feats_key >= db_size)) + return NULL; +-- +2.51.0 + diff --git a/queue-6.17/clk-sunxi-ng-sun6i-rtc-add-a523-specifics.patch b/queue-6.17/clk-sunxi-ng-sun6i-rtc-add-a523-specifics.patch new file mode 100644 index 0000000000..69e8ed2a75 --- /dev/null +++ b/queue-6.17/clk-sunxi-ng-sun6i-rtc-add-a523-specifics.patch @@ -0,0 +1,57 @@ +From 05b641e708818297c08f71c7785f25d2a0b34007 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 01:09:47 +0800 +Subject: clk: sunxi-ng: sun6i-rtc: Add A523 specifics + +From: Chen-Yu Tsai + +[ Upstream commit 7aa8781f379c32c31bd78f1408a31765b2297c43 ] + +The A523's RTC block is backward compatible with the R329's, but it also +has a calibration function for its internal oscillator, which would +allow it to provide a clock rate closer to the desired 32.768 KHz. This +is useful on the Radxa Cubie A5E, which does not have an external 32.768 +KHz crystal. + +Add new compatible-specific data for it. + +Acked-by: Jernej Skrabec +Link: https://patch.msgid.link/20250909170947.2221611-1-wens@kernel.org +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi-ng/ccu-sun6i-rtc.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c b/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c +index 0536e880b80fe..f6bfeba009e8e 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c ++++ b/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c +@@ -325,6 +325,13 @@ static const struct sun6i_rtc_match_data sun50i_r329_rtc_ccu_data = { + .osc32k_fanout_nparents = ARRAY_SIZE(sun50i_r329_osc32k_fanout_parents), + }; + ++static const struct sun6i_rtc_match_data sun55i_a523_rtc_ccu_data = { ++ .have_ext_osc32k = true, ++ .have_iosc_calibration = true, ++ .osc32k_fanout_parents = sun50i_r329_osc32k_fanout_parents, ++ .osc32k_fanout_nparents = ARRAY_SIZE(sun50i_r329_osc32k_fanout_parents), ++}; ++ + static const struct of_device_id sun6i_rtc_ccu_match[] = { + { + .compatible = "allwinner,sun50i-h616-rtc", +@@ -334,6 +341,10 @@ static const struct of_device_id sun6i_rtc_ccu_match[] = { + .compatible = "allwinner,sun50i-r329-rtc", + .data = &sun50i_r329_rtc_ccu_data, + }, ++ { ++ .compatible = "allwinner,sun55i-a523-rtc", ++ .data = &sun55i_a523_rtc_ccu_data, ++ }, + {}, + }; + MODULE_DEVICE_TABLE(of, sun6i_rtc_ccu_match); +-- +2.51.0 + diff --git a/queue-6.17/clk-thead-th1520-ap-set-all-axi-clocks-to-clk_is_cri.patch b/queue-6.17/clk-thead-th1520-ap-set-all-axi-clocks-to-clk_is_cri.patch new file mode 100644 index 0000000000..53272377cb --- /dev/null +++ b/queue-6.17/clk-thead-th1520-ap-set-all-axi-clocks-to-clk_is_cri.patch @@ -0,0 +1,165 @@ +From aca627083aa4a62368013eda6cddd86b0ddf4436 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 16 Aug 2025 17:11:13 +0800 +Subject: clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL + +From: Icenowy Zheng + +[ Upstream commit c567bc5fc68c4388c00e11fc65fd14fe86b52070 ] + +The AXI crossbar of TH1520 has no proper timeout handling, which means +gating AXI clocks can easily lead to bus timeout and thus system hang. + +Set all AXI clock gates to CLK_IS_CRITICAL. All these clock gates are +ungated by default on system reset. + +In addition, convert all current CLK_IGNORE_UNUSED usage to +CLK_IS_CRITICAL to prevent unwanted clock gating. + +Signed-off-by: Icenowy Zheng +Reviewed-by: Drew Fustini +Signed-off-by: Drew Fustini +Signed-off-by: Sasha Levin +--- + drivers/clk/thead/clk-th1520-ap.c | 44 +++++++++++++++---------------- + 1 file changed, 22 insertions(+), 22 deletions(-) + +diff --git a/drivers/clk/thead/clk-th1520-ap.c b/drivers/clk/thead/clk-th1520-ap.c +index ec52726fbea95..6c1976aa1ae62 100644 +--- a/drivers/clk/thead/clk-th1520-ap.c ++++ b/drivers/clk/thead/clk-th1520-ap.c +@@ -480,7 +480,7 @@ static struct ccu_div axi4_cpusys2_aclk = { + .hw.init = CLK_HW_INIT_PARENTS_HW("axi4-cpusys2-aclk", + gmac_pll_clk_parent, + &ccu_div_ops, +- 0), ++ CLK_IS_CRITICAL), + }, + }; + +@@ -502,7 +502,7 @@ static struct ccu_div axi_aclk = { + .hw.init = CLK_HW_INIT_PARENTS_DATA("axi-aclk", + axi_parents, + &ccu_div_ops, +- 0), ++ CLK_IS_CRITICAL), + }, + }; + +@@ -651,7 +651,7 @@ static struct ccu_div apb_pclk = { + .hw.init = CLK_HW_INIT_PARENTS_DATA("apb-pclk", + apb_parents, + &ccu_div_ops, +- CLK_IGNORE_UNUSED), ++ CLK_IS_CRITICAL), + }, + }; + +@@ -682,7 +682,7 @@ static struct ccu_div vi_clk = { + .hw.init = CLK_HW_INIT_PARENTS_HW("vi", + video_pll_clk_parent, + &ccu_div_ops, +- 0), ++ CLK_IS_CRITICAL), + }, + }; + +@@ -707,7 +707,7 @@ static struct ccu_div vo_axi_clk = { + .hw.init = CLK_HW_INIT_PARENTS_HW("vo-axi", + video_pll_clk_parent, + &ccu_div_ops, +- 0), ++ CLK_IS_CRITICAL), + }, + }; + +@@ -732,7 +732,7 @@ static struct ccu_div vp_axi_clk = { + .hw.init = CLK_HW_INIT_PARENTS_HW("vp-axi", + video_pll_clk_parent, + &ccu_div_ops, +- CLK_IGNORE_UNUSED), ++ CLK_IS_CRITICAL), + }, + }; + +@@ -791,27 +791,27 @@ static const struct clk_parent_data emmc_sdio_ref_clk_pd[] = { + static CCU_GATE(CLK_BROM, brom_clk, "brom", ahb2_cpusys_hclk_pd, 0x100, 4, 0); + static CCU_GATE(CLK_BMU, bmu_clk, "bmu", axi4_cpusys2_aclk_pd, 0x100, 5, 0); + static CCU_GATE(CLK_AON2CPU_A2X, aon2cpu_a2x_clk, "aon2cpu-a2x", axi4_cpusys2_aclk_pd, +- 0x134, 8, 0); ++ 0x134, 8, CLK_IS_CRITICAL); + static CCU_GATE(CLK_X2X_CPUSYS, x2x_cpusys_clk, "x2x-cpusys", axi4_cpusys2_aclk_pd, +- 0x134, 7, 0); ++ 0x134, 7, CLK_IS_CRITICAL); + static CCU_GATE(CLK_CPU2AON_X2H, cpu2aon_x2h_clk, "cpu2aon-x2h", axi_aclk_pd, +- 0x138, 8, CLK_IGNORE_UNUSED); ++ 0x138, 8, CLK_IS_CRITICAL); + static CCU_GATE(CLK_CPU2PERI_X2H, cpu2peri_x2h_clk, "cpu2peri-x2h", axi4_cpusys2_aclk_pd, +- 0x140, 9, CLK_IGNORE_UNUSED); ++ 0x140, 9, CLK_IS_CRITICAL); + static CCU_GATE(CLK_PERISYS_APB1_HCLK, perisys_apb1_hclk, "perisys-apb1-hclk", perisys_ahb_hclk_pd, +- 0x150, 9, CLK_IGNORE_UNUSED); ++ 0x150, 9, CLK_IS_CRITICAL); + static CCU_GATE(CLK_PERISYS_APB2_HCLK, perisys_apb2_hclk, "perisys-apb2-hclk", perisys_ahb_hclk_pd, +- 0x150, 10, CLK_IGNORE_UNUSED); ++ 0x150, 10, CLK_IS_CRITICAL); + static CCU_GATE(CLK_PERISYS_APB3_HCLK, perisys_apb3_hclk, "perisys-apb3-hclk", perisys_ahb_hclk_pd, +- 0x150, 11, CLK_IGNORE_UNUSED); ++ 0x150, 11, CLK_IS_CRITICAL); + static CCU_GATE(CLK_PERISYS_APB4_HCLK, perisys_apb4_hclk, "perisys-apb4-hclk", perisys_ahb_hclk_pd, + 0x150, 12, 0); + static const struct clk_parent_data perisys_apb4_hclk_pd[] = { + { .hw = &perisys_apb4_hclk.gate.hw }, + }; + +-static CCU_GATE(CLK_NPU_AXI, npu_axi_clk, "npu-axi", axi_aclk_pd, 0x1c8, 5, 0); +-static CCU_GATE(CLK_CPU2VP, cpu2vp_clk, "cpu2vp", axi_aclk_pd, 0x1e0, 13, 0); ++static CCU_GATE(CLK_NPU_AXI, npu_axi_clk, "npu-axi", axi_aclk_pd, 0x1c8, 5, CLK_IS_CRITICAL); ++static CCU_GATE(CLK_CPU2VP, cpu2vp_clk, "cpu2vp", axi_aclk_pd, 0x1e0, 13, CLK_IS_CRITICAL); + static CCU_GATE(CLK_EMMC_SDIO, emmc_sdio_clk, "emmc-sdio", emmc_sdio_ref_clk_pd, 0x204, 30, 0); + static CCU_GATE(CLK_GMAC1, gmac1_clk, "gmac1", gmac_pll_clk_pd, 0x204, 26, 0); + static CCU_GATE(CLK_PADCTRL1, padctrl1_clk, "padctrl1", perisys_apb_pclk_pd, 0x204, 24, 0); +@@ -855,11 +855,11 @@ static CCU_GATE(CLK_SRAM2, sram2_clk, "sram2", axi_aclk_pd, 0x20c, 2, 0); + static CCU_GATE(CLK_SRAM3, sram3_clk, "sram3", axi_aclk_pd, 0x20c, 1, 0); + + static CCU_GATE(CLK_AXI4_VO_ACLK, axi4_vo_aclk, "axi4-vo-aclk", +- video_pll_clk_pd, 0x0, 0, 0); ++ video_pll_clk_pd, 0x0, 0, CLK_IS_CRITICAL); + static CCU_GATE(CLK_GPU_CORE, gpu_core_clk, "gpu-core-clk", video_pll_clk_pd, + 0x0, 3, 0); + static CCU_GATE(CLK_GPU_CFG_ACLK, gpu_cfg_aclk, "gpu-cfg-aclk", +- video_pll_clk_pd, 0x0, 4, 0); ++ video_pll_clk_pd, 0x0, 4, CLK_IS_CRITICAL); + static CCU_GATE(CLK_DPU_PIXELCLK0, dpu0_pixelclk, "dpu0-pixelclk", + dpu0_clk_pd, 0x0, 5, 0); + static CCU_GATE(CLK_DPU_PIXELCLK1, dpu1_pixelclk, "dpu1-pixelclk", +@@ -891,9 +891,9 @@ static CCU_GATE(CLK_MIPI_DSI1_REFCLK, mipi_dsi1_refclk, "mipi-dsi1-refclk", + static CCU_GATE(CLK_HDMI_I2S, hdmi_i2s_clk, "hdmi-i2s-clk", video_pll_clk_pd, + 0x0, 19, 0); + static CCU_GATE(CLK_X2H_DPU1_ACLK, x2h_dpu1_aclk, "x2h-dpu1-aclk", +- video_pll_clk_pd, 0x0, 20, 0); ++ video_pll_clk_pd, 0x0, 20, CLK_IS_CRITICAL); + static CCU_GATE(CLK_X2H_DPU_ACLK, x2h_dpu_aclk, "x2h-dpu-aclk", +- video_pll_clk_pd, 0x0, 21, 0); ++ video_pll_clk_pd, 0x0, 21, CLK_IS_CRITICAL); + static CCU_GATE(CLK_AXI4_VO_PCLK, axi4_vo_pclk, "axi4-vo-pclk", + video_pll_clk_pd, 0x0, 22, 0); + static CCU_GATE(CLK_IOPMP_VOSYS_DPU_PCLK, iopmp_vosys_dpu_pclk, +@@ -903,11 +903,11 @@ static CCU_GATE(CLK_IOPMP_VOSYS_DPU1_PCLK, iopmp_vosys_dpu1_pclk, + static CCU_GATE(CLK_IOPMP_VOSYS_GPU_PCLK, iopmp_vosys_gpu_pclk, + "iopmp-vosys-gpu-pclk", video_pll_clk_pd, 0x0, 25, 0); + static CCU_GATE(CLK_IOPMP_DPU1_ACLK, iopmp_dpu1_aclk, "iopmp-dpu1-aclk", +- video_pll_clk_pd, 0x0, 27, 0); ++ video_pll_clk_pd, 0x0, 27, CLK_IS_CRITICAL); + static CCU_GATE(CLK_IOPMP_DPU_ACLK, iopmp_dpu_aclk, "iopmp-dpu-aclk", +- video_pll_clk_pd, 0x0, 28, 0); ++ video_pll_clk_pd, 0x0, 28, CLK_IS_CRITICAL); + static CCU_GATE(CLK_IOPMP_GPU_ACLK, iopmp_gpu_aclk, "iopmp-gpu-aclk", +- video_pll_clk_pd, 0x0, 29, 0); ++ video_pll_clk_pd, 0x0, 29, CLK_IS_CRITICAL); + static CCU_GATE(CLK_MIPIDSI0_PIXCLK, mipi_dsi0_pixclk, "mipi-dsi0-pixclk", + video_pll_clk_pd, 0x0, 30, 0); + static CCU_GATE(CLK_MIPIDSI1_PIXCLK, mipi_dsi1_pixclk, "mipi-dsi1-pixclk", +-- +2.51.0 + diff --git a/queue-6.17/clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch b/queue-6.17/clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch new file mode 100644 index 0000000000..4af5aa7488 --- /dev/null +++ b/queue-6.17/clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch @@ -0,0 +1,44 @@ +From 4848d59d2beea598f34d0e7a6901eb1a8bd49fa3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 16:08:11 +0200 +Subject: clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled + +From: Matthias Schiffer + +[ Upstream commit 1e0d75258bd09323cb452655549e03975992b29e ] + +As described in AM335x Errata Advisory 1.0.42, WKUP_DEBUGSS_CLKCTRL +can't be disabled - the clock module will just be stuck in transitioning +state forever, resulting in the following warning message after the wait +loop times out: + + l3-aon-clkctrl:0000:0: failed to disable + +Just add the clock to enable_init_clks, so no attempt is made to disable +it. + +Signed-off-by: Matthias Schiffer +Signed-off-by: Alexander Stein +Acked-by: Kevin Hilman +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/ti/clk-33xx.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/ti/clk-33xx.c b/drivers/clk/ti/clk-33xx.c +index 85c50ea39e6da..9269e6a0db6a4 100644 +--- a/drivers/clk/ti/clk-33xx.c ++++ b/drivers/clk/ti/clk-33xx.c +@@ -258,6 +258,8 @@ static const char *enable_init_clks[] = { + "dpll_ddr_m2_ck", + "dpll_mpu_m2_ck", + "l3_gclk", ++ /* WKUP_DEBUGSS_CLKCTRL - disable fails, AM335x Errata Advisory 1.0.42 */ ++ "l3-aon-clkctrl:0000:0", + /* AM3_L3_L3_MAIN_CLKCTRL, needed during suspend */ + "l3-clkctrl:00bc:0", + "l4hs_gclk", +-- +2.51.0 + diff --git a/queue-6.17/clocksource-hyper-v-skip-unnecessary-checks-for-the-.patch b/queue-6.17/clocksource-hyper-v-skip-unnecessary-checks-for-the-.patch new file mode 100644 index 0000000000..7a8380d30b --- /dev/null +++ b/queue-6.17/clocksource-hyper-v-skip-unnecessary-checks-for-the-.patch @@ -0,0 +1,88 @@ +From b19eca3f89f34995584b9dee6d79f1fbf3bfcb31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 19:48:45 +0000 +Subject: clocksource: hyper-v: Skip unnecessary checks for the root partition + +From: Wei Liu + +[ Upstream commit 47691ced158ab3a7ce2189b857b19c0c99a9aa80 ] + +The HV_ACCESS_TSC_INVARIANT bit is always zero when Linux runs as the +root partition. The root partition will see directly what the hardware +provides. + +The old logic in ms_hyperv_init_platform caused the native TSC clock +source to be incorrectly marked as unstable on x86. Fix it. + +Skip the unnecessary checks in code for the root partition. Add one +extra comment in code to clarify the behavior. + +Reviewed-by: Nuno Das Neves +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/mshyperv.c | 11 ++++++++++- + drivers/clocksource/hyperv_timer.c | 10 +++++++++- + 2 files changed, 19 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c +index c78f860419d69..25773af116bc4 100644 +--- a/arch/x86/kernel/cpu/mshyperv.c ++++ b/arch/x86/kernel/cpu/mshyperv.c +@@ -565,6 +565,11 @@ static void __init ms_hyperv_init_platform(void) + machine_ops.crash_shutdown = hv_machine_crash_shutdown; + #endif + #endif ++ /* ++ * HV_ACCESS_TSC_INVARIANT is always zero for the root partition. Root ++ * partition doesn't need to write to synthetic MSR to enable invariant ++ * TSC feature. It sees what the hardware provides. ++ */ + if (ms_hyperv.features & HV_ACCESS_TSC_INVARIANT) { + /* + * Writing to synthetic MSR 0x40000118 updates/changes the +@@ -636,8 +641,12 @@ static void __init ms_hyperv_init_platform(void) + * TSC should be marked as unstable only after Hyper-V + * clocksource has been initialized. This ensures that the + * stability of the sched_clock is not altered. ++ * ++ * HV_ACCESS_TSC_INVARIANT is always zero for the root partition. No ++ * need to check for it. + */ +- if (!(ms_hyperv.features & HV_ACCESS_TSC_INVARIANT)) ++ if (!hv_root_partition() && ++ !(ms_hyperv.features & HV_ACCESS_TSC_INVARIANT)) + mark_tsc_unstable("running on Hyper-V"); + + hardlockup_detector_disable(); +diff --git a/drivers/clocksource/hyperv_timer.c b/drivers/clocksource/hyperv_timer.c +index 2edc13ca184e0..10356d4ec55c3 100644 +--- a/drivers/clocksource/hyperv_timer.c ++++ b/drivers/clocksource/hyperv_timer.c +@@ -549,14 +549,22 @@ static void __init hv_init_tsc_clocksource(void) + union hv_reference_tsc_msr tsc_msr; + + /* ++ * When running as a guest partition: ++ * + * If Hyper-V offers TSC_INVARIANT, then the virtualized TSC correctly + * handles frequency and offset changes due to live migration, + * pause/resume, and other VM management operations. So lower the + * Hyper-V Reference TSC rating, causing the generic TSC to be used. + * TSC_INVARIANT is not offered on ARM64, so the Hyper-V Reference + * TSC will be preferred over the virtualized ARM64 arch counter. ++ * ++ * When running as the root partition: ++ * ++ * There is no HV_ACCESS_TSC_INVARIANT feature. Always lower the rating ++ * of the Hyper-V Reference TSC. + */ +- if (ms_hyperv.features & HV_ACCESS_TSC_INVARIANT) { ++ if ((ms_hyperv.features & HV_ACCESS_TSC_INVARIANT) || ++ hv_root_partition()) { + hyperv_cs_tsc.rating = 250; + hyperv_cs_msr.rating = 245; + } +-- +2.51.0 + diff --git a/queue-6.17/cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch b/queue-6.17/cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch new file mode 100644 index 0000000000..e2473b894a --- /dev/null +++ b/queue-6.17/cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch @@ -0,0 +1,102 @@ +From 28d274bd1026ac24302492350394a92ad321ea36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 21:48:13 -0500 +Subject: cpufreq: tegra186: Initialize all cores to max frequencies + +From: Aaron Kling + +[ Upstream commit ba6018929165fc914c665f071f8e8cdbac844a49 ] + +During initialization, the EDVD_COREx_VOLT_FREQ registers for some cores +are still at reset values and not reflecting the actual frequency. This +causes get calls to fail. Set all cores to their respective max +frequency during probe to initialize the registers to working values. + +Suggested-by: Mikko Perttunen +Signed-off-by: Aaron Kling +Reviewed-by: Mikko Perttunen +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/tegra186-cpufreq.c | 27 +++++++++++++++++++++------ + 1 file changed, 21 insertions(+), 6 deletions(-) + +diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c +index 6c394b429b618..bd94beebc4cc2 100644 +--- a/drivers/cpufreq/tegra186-cpufreq.c ++++ b/drivers/cpufreq/tegra186-cpufreq.c +@@ -138,13 +138,14 @@ static struct cpufreq_driver tegra186_cpufreq_driver = { + + static struct cpufreq_frequency_table *init_vhint_table( + struct platform_device *pdev, struct tegra_bpmp *bpmp, +- struct tegra186_cpufreq_cluster *cluster, unsigned int cluster_id) ++ struct tegra186_cpufreq_cluster *cluster, unsigned int cluster_id, ++ int *num_rates) + { + struct cpufreq_frequency_table *table; + struct mrq_cpu_vhint_request req; + struct tegra_bpmp_message msg; + struct cpu_vhint_data *data; +- int err, i, j, num_rates = 0; ++ int err, i, j; + dma_addr_t phys; + void *virt; + +@@ -174,6 +175,7 @@ static struct cpufreq_frequency_table *init_vhint_table( + goto free; + } + ++ *num_rates = 0; + for (i = data->vfloor; i <= data->vceil; i++) { + u16 ndiv = data->ndiv[i]; + +@@ -184,10 +186,10 @@ static struct cpufreq_frequency_table *init_vhint_table( + if (i > 0 && ndiv == data->ndiv[i - 1]) + continue; + +- num_rates++; ++ (*num_rates)++; + } + +- table = devm_kcalloc(&pdev->dev, num_rates + 1, sizeof(*table), ++ table = devm_kcalloc(&pdev->dev, *num_rates + 1, sizeof(*table), + GFP_KERNEL); + if (!table) { + table = ERR_PTR(-ENOMEM); +@@ -229,7 +231,9 @@ static int tegra186_cpufreq_probe(struct platform_device *pdev) + { + struct tegra186_cpufreq_data *data; + struct tegra_bpmp *bpmp; +- unsigned int i = 0, err; ++ unsigned int i = 0, err, edvd_offset; ++ int num_rates = 0; ++ u32 edvd_val, cpu; + + data = devm_kzalloc(&pdev->dev, + struct_size(data, clusters, TEGRA186_NUM_CLUSTERS), +@@ -252,10 +256,21 @@ static int tegra186_cpufreq_probe(struct platform_device *pdev) + for (i = 0; i < TEGRA186_NUM_CLUSTERS; i++) { + struct tegra186_cpufreq_cluster *cluster = &data->clusters[i]; + +- cluster->table = init_vhint_table(pdev, bpmp, cluster, i); ++ cluster->table = init_vhint_table(pdev, bpmp, cluster, i, &num_rates); + if (IS_ERR(cluster->table)) { + err = PTR_ERR(cluster->table); + goto put_bpmp; ++ } else if (!num_rates) { ++ err = -EINVAL; ++ goto put_bpmp; ++ } ++ ++ for (cpu = 0; cpu < ARRAY_SIZE(tegra186_cpus); cpu++) { ++ if (data->cpus[cpu].bpmp_cluster_id == i) { ++ edvd_val = cluster->table[num_rates - 1].driver_data; ++ edvd_offset = data->cpus[cpu].edvd_offset; ++ writel(edvd_val, data->regs + edvd_offset); ++ } + } + } + +-- +2.51.0 + diff --git a/queue-6.17/drm-amdgpu-report-individual-reset-error.patch b/queue-6.17/drm-amdgpu-report-individual-reset-error.patch new file mode 100644 index 0000000000..90456c9ba5 --- /dev/null +++ b/queue-6.17/drm-amdgpu-report-individual-reset-error.patch @@ -0,0 +1,82 @@ +From d33ea2fd00fee90d06b5f4dd65ece6a6eee4588e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Oct 2025 10:39:03 +0530 +Subject: drm/amdgpu: Report individual reset error + +From: Lijo Lazar + +[ Upstream commit 2e97663760e5fb7ee14f399c68e57b894f01e505 ] + +If reinitialization of one of the GPUs fails after reset, it logs +failure on all subsequent GPUs eventhough they have resumed +successfully. + +A sample log where only device at 0000:95:00.0 had a failure - + + amdgpu 0000:15:00.0: amdgpu: GPU reset(19) succeeded! + amdgpu 0000:65:00.0: amdgpu: GPU reset(19) succeeded! + amdgpu 0000:75:00.0: amdgpu: GPU reset(19) succeeded! + amdgpu 0000:85:00.0: amdgpu: GPU reset(19) succeeded! + amdgpu 0000:95:00.0: amdgpu: GPU reset(19) failed + amdgpu 0000:e5:00.0: amdgpu: GPU reset(19) failed + amdgpu 0000:f5:00.0: amdgpu: GPU reset(19) failed + amdgpu 0000:05:00.0: amdgpu: GPU reset(19) failed + amdgpu 0000:15:00.0: amdgpu: GPU reset end with ret = -5 + +To avoid confusion, report the error for each device +separately and return the first error as the overall result. + +Signed-off-by: Lijo Lazar +Reviewed-by: Asad Kamal +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 25 +++++++++++++--------- + 1 file changed, 15 insertions(+), 10 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index 1115af343e013..ddd0e7ab82be7 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -6337,23 +6337,28 @@ static int amdgpu_device_sched_resume(struct list_head *device_list, + if (!drm_drv_uses_atomic_modeset(adev_to_drm(tmp_adev)) && !job_signaled) + drm_helper_resume_force_mode(adev_to_drm(tmp_adev)); + +- if (tmp_adev->asic_reset_res) +- r = tmp_adev->asic_reset_res; +- +- tmp_adev->asic_reset_res = 0; +- +- if (r) { ++ if (tmp_adev->asic_reset_res) { + /* bad news, how to tell it to userspace ? + * for ras error, we should report GPU bad status instead of + * reset failure + */ + if (reset_context->src != AMDGPU_RESET_SRC_RAS || + !amdgpu_ras_eeprom_check_err_threshold(tmp_adev)) +- dev_info(tmp_adev->dev, "GPU reset(%d) failed\n", +- atomic_read(&tmp_adev->gpu_reset_counter)); +- amdgpu_vf_error_put(tmp_adev, AMDGIM_ERROR_VF_GPU_RESET_FAIL, 0, r); ++ dev_info( ++ tmp_adev->dev, ++ "GPU reset(%d) failed with error %d \n", ++ atomic_read( ++ &tmp_adev->gpu_reset_counter), ++ tmp_adev->asic_reset_res); ++ amdgpu_vf_error_put(tmp_adev, ++ AMDGIM_ERROR_VF_GPU_RESET_FAIL, 0, ++ tmp_adev->asic_reset_res); ++ if (!r) ++ r = tmp_adev->asic_reset_res; ++ tmp_adev->asic_reset_res = 0; + } else { +- dev_info(tmp_adev->dev, "GPU reset(%d) succeeded!\n", atomic_read(&tmp_adev->gpu_reset_counter)); ++ dev_info(tmp_adev->dev, "GPU reset(%d) succeeded!\n", ++ atomic_read(&tmp_adev->gpu_reset_counter)); + if (amdgpu_acpi_smart_shift_update(tmp_adev, + AMDGPU_SS_DEV_D0)) + dev_warn(tmp_adev->dev, +-- +2.51.0 + diff --git a/queue-6.17/drm-amdkfd-fix-mmap-write-lock-not-release.patch b/queue-6.17/drm-amdkfd-fix-mmap-write-lock-not-release.patch new file mode 100644 index 0000000000..a5501d2050 --- /dev/null +++ b/queue-6.17/drm-amdkfd-fix-mmap-write-lock-not-release.patch @@ -0,0 +1,41 @@ +From e869e70c966c082d969f290643e5268fcf185327 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 15:57:32 -0400 +Subject: drm/amdkfd: Fix mmap write lock not release + +From: Philip Yang + +[ Upstream commit 7574f30337e19045f03126b4c51f525b84e5049e ] + +If mmap write lock is taken while draining retry fault, mmap write lock +is not released because svm_range_restore_pages calls mmap_read_unlock +then returns. This causes deadlock and system hangs later because mmap +read or write lock cannot be taken. + +Downgrade mmap write lock to read lock if draining retry fault fix this +bug. + +Signed-off-by: Philip Yang +Reviewed-by: Harish Kasiviswanathan +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +index cecdbcea0bb90..827507cfed7aa 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +@@ -3046,6 +3046,8 @@ svm_range_restore_pages(struct amdgpu_device *adev, unsigned int pasid, + if (svms->checkpoint_ts[gpuidx] != 0) { + if (amdgpu_ih_ts_after_or_equal(ts, svms->checkpoint_ts[gpuidx])) { + pr_debug("draining retry fault, drop fault 0x%llx\n", addr); ++ if (write_locked) ++ mmap_write_downgrade(mm); + r = -EAGAIN; + goto out_unlock_svms; + } else { +-- +2.51.0 + diff --git a/queue-6.17/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch b/queue-6.17/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch new file mode 100644 index 0000000000..abf36314ff --- /dev/null +++ b/queue-6.17/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch @@ -0,0 +1,69 @@ +From 60d2987102395e5714d463bcf11539bdeeb4499e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 03:32:09 -0400 +Subject: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds + +From: Albin Babu Varghese + +[ Upstream commit 3637d34b35b287ab830e66048841ace404382b67 ] + +Add bounds checking to prevent writes past framebuffer boundaries when +rendering text near screen edges. Return early if the Y position is off-screen +and clip image height to screen boundary. Break from the rendering loop if the +X position is off-screen. When clipping image width to fit the screen, update +the character count to match the clipped width to prevent buffer size +mismatches. + +Without the character count update, bit_putcs_aligned and bit_putcs_unaligned +receive mismatched parameters where the buffer is allocated for the clipped +width but cnt reflects the original larger count, causing out-of-bounds writes. + +Reported-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190 +Suggested-by: Helge Deller +Tested-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com +Signed-off-by: Albin Babu Varghese +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/core/bitblit.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c +index 2e46c41a706a2..dc5ad3fcc7be4 100644 +--- a/drivers/video/fbdev/core/bitblit.c ++++ b/drivers/video/fbdev/core/bitblit.c +@@ -168,6 +168,11 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, + image.height = vc->vc_font.height; + image.depth = 1; + ++ if (image.dy >= info->var.yres) ++ return; ++ ++ image.height = min(image.height, info->var.yres - image.dy); ++ + if (attribute) { + buf = kmalloc(cellsize, GFP_ATOMIC); + if (!buf) +@@ -181,6 +186,18 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, + cnt = count; + + image.width = vc->vc_font.width * cnt; ++ ++ if (image.dx >= info->var.xres) ++ break; ++ ++ if (image.dx + image.width > info->var.xres) { ++ image.width = info->var.xres - image.dx; ++ cnt = image.width / vc->vc_font.width; ++ if (cnt == 0) ++ break; ++ image.width = cnt * vc->vc_font.width; ++ } ++ + pitch = DIV_ROUND_UP(image.width, 8) + scan_align; + pitch &= ~scan_align; + size = pitch * image.height + buf_align; +-- +2.51.0 + diff --git a/queue-6.17/fbdev-core-fix-ubsan-warning-in-pixel_to_pat.patch b/queue-6.17/fbdev-core-fix-ubsan-warning-in-pixel_to_pat.patch new file mode 100644 index 0000000000..98be817c8f --- /dev/null +++ b/queue-6.17/fbdev-core-fix-ubsan-warning-in-pixel_to_pat.patch @@ -0,0 +1,37 @@ +From 3c6a13ce76fa1c1fd02b90b7064b7372d1eae973 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 04:42:48 +0200 +Subject: fbdev: core: Fix ubsan warning in pixel_to_pat + +From: Zsolt Kajtar + +[ Upstream commit aad1d99beaaf132e2024a52727c24894cdf9474a ] + +It could be triggered on 32 bit big endian machines at 32 bpp in the +pattern realignment. In this case just return early as the result is +an identity. + +Signed-off-by: Zsolt Kajtar +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/core/fb_fillrect.h | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/video/fbdev/core/fb_fillrect.h b/drivers/video/fbdev/core/fb_fillrect.h +index 66042e534de77..f366670a53af8 100644 +--- a/drivers/video/fbdev/core/fb_fillrect.h ++++ b/drivers/video/fbdev/core/fb_fillrect.h +@@ -92,8 +92,7 @@ static unsigned long pixel_to_pat(int bpp, u32 color) + pattern = pattern | pattern << bpp; + break; + default: +- pattern = color; +- break; ++ return color; + } + #ifndef __LITTLE_ENDIAN + pattern <<= (BITS_PER_LONG % bpp); +-- +2.51.0 + diff --git a/queue-6.17/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch b/queue-6.17/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch new file mode 100644 index 0000000000..de073144b0 --- /dev/null +++ b/queue-6.17/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch @@ -0,0 +1,97 @@ +From fe3b2ff95854988edf5a3132582be5e019ffeba6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 May 2025 20:44:34 -0500 +Subject: fs/hpfs: Fix error code for new_inode() failure in + mkdir/create/mknod/symlink + +From: Yikang Yue + +[ Upstream commit 32058c38d3b79a28963a59ac0353644dc24775cd ] + +The function call new_inode() is a primitive for allocating an inode in memory, +rather than planning disk space for it. Therefore, -ENOMEM should be returned +as the error code rather than -ENOSPC. + +To be specific, new_inode()'s call path looks like this: +new_inode + new_inode_pseudo + alloc_inode + ops->alloc_inode (hpfs_alloc_inode) + alloc_inode_sb + kmem_cache_alloc_lru + +Therefore, the failure of new_inode() indicates a memory presure issue (-ENOMEM), +not a lack of disk space. However, the current implementation of +hpfs_mkdir/create/mknod/symlink incorrectly returns -ENOSPC when new_inode() fails. +This patch fix this by set err to -ENOMEM before the goto statement. + +BTW, we also noticed that other nested calls within these four functions, +like hpfs_alloc_f/dnode and hpfs_add_dirent, might also fail due to memory presure. +But similarly, only -ENOSPC is returned. Addressing these will involve code +modifications in other functions, and we plan to submit dedicated patches for these +issues in the future. For this patch, we focus on new_inode(). + +Signed-off-by: Yikang Yue +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + fs/hpfs/namei.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c +index e3cdc421dfba7..353e13a615f56 100644 +--- a/fs/hpfs/namei.c ++++ b/fs/hpfs/namei.c +@@ -52,8 +52,10 @@ static struct dentry *hpfs_mkdir(struct mnt_idmap *idmap, struct inode *dir, + dee.fnode = cpu_to_le32(fno); + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail2; ++ } + hpfs_init_inode(result); + result->i_ino = fno; + hpfs_i(result)->i_parent_dir = dir->i_ino; +@@ -153,9 +155,10 @@ static int hpfs_create(struct mnt_idmap *idmap, struct inode *dir, + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail1; +- ++ } + hpfs_init_inode(result); + result->i_ino = fno; + result->i_mode |= S_IFREG; +@@ -239,9 +242,10 @@ static int hpfs_mknod(struct mnt_idmap *idmap, struct inode *dir, + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail1; +- ++ } + hpfs_init_inode(result); + result->i_ino = fno; + hpfs_i(result)->i_parent_dir = dir->i_ino; +@@ -314,8 +318,10 @@ static int hpfs_symlink(struct mnt_idmap *idmap, struct inode *dir, + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail1; ++ } + result->i_ino = fno; + hpfs_init_inode(result); + hpfs_i(result)->i_parent_dir = dir->i_ino; +-- +2.51.0 + diff --git a/queue-6.17/hyperv-add-missing-field-to-hv_output_map_device_int.patch b/queue-6.17/hyperv-add-missing-field-to-hv_output_map_device_int.patch new file mode 100644 index 0000000000..03d118043f --- /dev/null +++ b/queue-6.17/hyperv-add-missing-field-to-hv_output_map_device_int.patch @@ -0,0 +1,36 @@ +From e59f02e310c930b221070999c83b6522c7f57253 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 11:20:57 -0700 +Subject: hyperv: Add missing field to hv_output_map_device_interrupt + +From: Nuno Das Neves + +[ Upstream commit 4cd661c248b6671914ad59e16760bb6d908dfc61 ] + +This field is unused, but the correct structure size is needed +when computing the amount of space for the output argument to +reside, so that it does not cross a page boundary. + +Signed-off-by: Nuno Das Neves +Reviewed-by: Michael Kelley +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + include/hyperv/hvhdk_mini.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/hyperv/hvhdk_mini.h b/include/hyperv/hvhdk_mini.h +index 42e7876455b5b..858f6a3925b30 100644 +--- a/include/hyperv/hvhdk_mini.h ++++ b/include/hyperv/hvhdk_mini.h +@@ -301,6 +301,7 @@ struct hv_input_map_device_interrupt { + /* HV_OUTPUT_MAP_DEVICE_INTERRUPT */ + struct hv_output_map_device_interrupt { + struct hv_interrupt_entry interrupt_entry; ++ u64 ext_status_deprecated[5]; + } __packed; + + /* HV_INPUT_UNMAP_DEVICE_INTERRUPT */ +-- +2.51.0 + diff --git a/queue-6.17/kbuild-uapi-strip-comments-before-size-type-check.patch b/queue-6.17/kbuild-uapi-strip-comments-before-size-type-check.patch new file mode 100644 index 0000000000..d7c1754e81 --- /dev/null +++ b/queue-6.17/kbuild-uapi-strip-comments-before-size-type-check.patch @@ -0,0 +1,52 @@ +From 5b34ac16e3908ed3c50d055a7ffbc7117533a0b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Oct 2025 14:33:42 +0200 +Subject: kbuild: uapi: Strip comments before size type check +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit 66128f4287b04aef4d4db9bf5035985ab51487d5 ] + +On m68k, check_sizetypes in headers_check reports: + + ./usr/include/asm/bootinfo-amiga.h:17: found __[us]{8,16,32,64} type without #include + +This header file does not use any of the Linux-specific integer types, +but merely refers to them from comments, so this is a false positive. +As of commit c3a9d74ee413bdb3 ("kbuild: uapi: upgrade check_sizetypes() +warning to error"), this check was promoted to an error, breaking m68k +all{mod,yes}config builds. + +Fix this by stripping simple comments before looking for Linux-specific +integer types. + +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Thomas Weißschuh +Link: https://patch.msgid.link/949f096337e28d50510e970ae3ba3ec9c1342ec0.1759753998.git.geert@linux-m68k.org +[nathan: Adjust comment and remove unnecessary escaping from slashes in + regex] +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + usr/include/headers_check.pl | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/usr/include/headers_check.pl b/usr/include/headers_check.pl +index 2b70bfa5558e6..02767e8bf22d0 100755 +--- a/usr/include/headers_check.pl ++++ b/usr/include/headers_check.pl +@@ -155,6 +155,8 @@ sub check_sizetypes + if (my $included = ($line =~ /^\s*#\s*include\s+[<"](\S+)[>"]/)[0]) { + check_include_typesh($included); + } ++ # strip single-line comments, as types may be referenced within them ++ $line =~ s@/\*.*?\*/@@; + if ($line =~ m/__[us](8|16|32|64)\b/) { + printf STDERR "$filename:$lineno: " . + "found __[us]{8,16,32,64} type " . +-- +2.51.0 + diff --git a/queue-6.17/loongarch-handle-new-atomic-instructions-for-probes.patch b/queue-6.17/loongarch-handle-new-atomic-instructions-for-probes.patch new file mode 100644 index 0000000000..dbe27c6b4b --- /dev/null +++ b/queue-6.17/loongarch-handle-new-atomic-instructions-for-probes.patch @@ -0,0 +1,79 @@ +From 6a3f635ea2b2588a4e76aebc01186ce97389c87f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 22:39:35 +0800 +Subject: LoongArch: Handle new atomic instructions for probes + +From: Tiezhu Yang + +[ Upstream commit db740f5689e61f2e75b73e5c8e7c985a3b4bc045 ] + +The atomic instructions sc.q, llacq.{w/d}, screl.{w/d} were newly added +in the LoongArch Reference Manual v1.10, it is necessary to handle them +in insns_not_supported() to avoid putting a breakpoint in the middle of +a ll/sc atomic sequence, otherwise it will loop forever for kprobes and +uprobes. + +Signed-off-by: Tiezhu Yang +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/include/asm/inst.h | 5 +++++ + arch/loongarch/kernel/inst.c | 12 ++++++++++++ + 2 files changed, 17 insertions(+) + +diff --git a/arch/loongarch/include/asm/inst.h b/arch/loongarch/include/asm/inst.h +index 277d2140676b6..55e64a12a124a 100644 +--- a/arch/loongarch/include/asm/inst.h ++++ b/arch/loongarch/include/asm/inst.h +@@ -77,6 +77,10 @@ enum reg2_op { + iocsrwrh_op = 0x19205, + iocsrwrw_op = 0x19206, + iocsrwrd_op = 0x19207, ++ llacqw_op = 0xe15e0, ++ screlw_op = 0xe15e1, ++ llacqd_op = 0xe15e2, ++ screld_op = 0xe15e3, + }; + + enum reg2i5_op { +@@ -189,6 +193,7 @@ enum reg3_op { + fldxd_op = 0x7068, + fstxs_op = 0x7070, + fstxd_op = 0x7078, ++ scq_op = 0x70ae, + amswapw_op = 0x70c0, + amswapd_op = 0x70c1, + amaddw_op = 0x70c2, +diff --git a/arch/loongarch/kernel/inst.c b/arch/loongarch/kernel/inst.c +index 72ecfed29d55a..bf037f0c6b26c 100644 +--- a/arch/loongarch/kernel/inst.c ++++ b/arch/loongarch/kernel/inst.c +@@ -141,6 +141,9 @@ bool insns_not_supported(union loongarch_instruction insn) + case amswapw_op ... ammindbdu_op: + pr_notice("atomic memory access instructions are not supported\n"); + return true; ++ case scq_op: ++ pr_notice("sc.q instruction is not supported\n"); ++ return true; + } + + switch (insn.reg2i14_format.opcode) { +@@ -152,6 +155,15 @@ bool insns_not_supported(union loongarch_instruction insn) + return true; + } + ++ switch (insn.reg2_format.opcode) { ++ case llacqw_op: ++ case llacqd_op: ++ case screlw_op: ++ case screld_op: ++ pr_notice("llacq and screl instructions are not supported\n"); ++ return true; ++ } ++ + switch (insn.reg1i21_format.opcode) { + case bceqz_op: + pr_notice("bceqz and bcnez instructions are not supported\n"); +-- +2.51.0 + diff --git a/queue-6.17/net-wwan-t7xx-add-support-for-hp-drmr-h01.patch b/queue-6.17/net-wwan-t7xx-add-support-for-hp-drmr-h01.patch new file mode 100644 index 0000000000..7da9b5bada --- /dev/null +++ b/queue-6.17/net-wwan-t7xx-add-support-for-hp-drmr-h01.patch @@ -0,0 +1,34 @@ +From bb8cb20603c805c53c0f524afae77bd5bbe80045 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 10:48:41 +0800 +Subject: net: wwan: t7xx: add support for HP DRMR-H01 + +From: Sammy Hsu + +[ Upstream commit 370e98728bda92b1bdffb448d1acdcbe19dadb4c ] + +add support for HP DRMR-H01 (0x03f0, 0x09c8) + +Signed-off-by: Sammy Hsu +Link: https://patch.msgid.link/20251002024841.5979-1-sammy.hsu@wnc.com.tw +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/wwan/t7xx/t7xx_pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wwan/t7xx/t7xx_pci.c b/drivers/net/wwan/t7xx/t7xx_pci.c +index 8bf63f2dcbbfd..eb137e0784232 100644 +--- a/drivers/net/wwan/t7xx/t7xx_pci.c ++++ b/drivers/net/wwan/t7xx/t7xx_pci.c +@@ -939,6 +939,7 @@ static void t7xx_pci_remove(struct pci_dev *pdev) + + static const struct pci_device_id t7xx_pci_table[] = { + { PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x4d75) }, ++ { PCI_DEVICE(0x03f0, 0x09c8) }, // HP DRMR-H01 + { PCI_DEVICE(0x14c0, 0x4d75) }, // Dell DW5933e + { } + }; +-- +2.51.0 + diff --git a/queue-6.17/ntb-epf-allow-arbitrary-bar-mapping.patch b/queue-6.17/ntb-epf-allow-arbitrary-bar-mapping.patch new file mode 100644 index 0000000000..6de1fc56f5 --- /dev/null +++ b/queue-6.17/ntb-epf-allow-arbitrary-bar-mapping.patch @@ -0,0 +1,246 @@ +From 94e33ee1d079c418331b0a0f303631744251ea19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Jul 2025 18:48:33 +0200 +Subject: NTB: epf: Allow arbitrary BAR mapping + +From: Jerome Brunet + +[ Upstream commit 5ad865862a0fd349163243e1834ed98ba9b81905 ] + +The NTB epf host driver assumes the BAR number associated with a memory +window is just incremented from the BAR number associated with MW1. This +seems to have been enough so far but this is not really how the endpoint +side work and the two could easily become mis-aligned. + +ntb_epf_mw_to_bar() even assumes that the BAR number is the memory window +index + 2, which means the function only returns a proper result if BAR_2 +is associated with MW1. + +Instead, fully describe and allow arbitrary NTB BAR mapping. + +Signed-off-by: Jerome Brunet +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/hw/epf/ntb_hw_epf.c | 103 ++++++++++++++++---------------- + 1 file changed, 53 insertions(+), 50 deletions(-) + +diff --git a/drivers/ntb/hw/epf/ntb_hw_epf.c b/drivers/ntb/hw/epf/ntb_hw_epf.c +index 00f0e78f685bf..2b51156e01b0f 100644 +--- a/drivers/ntb/hw/epf/ntb_hw_epf.c ++++ b/drivers/ntb/hw/epf/ntb_hw_epf.c +@@ -49,6 +49,7 @@ + #define NTB_EPF_COMMAND_TIMEOUT 1000 /* 1 Sec */ + + enum pci_barno { ++ NO_BAR = -1, + BAR_0, + BAR_1, + BAR_2, +@@ -57,16 +58,26 @@ enum pci_barno { + BAR_5, + }; + ++enum epf_ntb_bar { ++ BAR_CONFIG, ++ BAR_PEER_SPAD, ++ BAR_DB, ++ BAR_MW1, ++ BAR_MW2, ++ BAR_MW3, ++ BAR_MW4, ++ NTB_BAR_NUM, ++}; ++ ++#define NTB_EPF_MAX_MW_COUNT (NTB_BAR_NUM - BAR_MW1) ++ + struct ntb_epf_dev { + struct ntb_dev ntb; + struct device *dev; + /* Mutex to protect providing commands to NTB EPF */ + struct mutex cmd_lock; + +- enum pci_barno ctrl_reg_bar; +- enum pci_barno peer_spad_reg_bar; +- enum pci_barno db_reg_bar; +- enum pci_barno mw_bar; ++ const enum pci_barno *barno_map; + + unsigned int mw_count; + unsigned int spad_count; +@@ -85,17 +96,6 @@ struct ntb_epf_dev { + + #define ntb_ndev(__ntb) container_of(__ntb, struct ntb_epf_dev, ntb) + +-struct ntb_epf_data { +- /* BAR that contains both control region and self spad region */ +- enum pci_barno ctrl_reg_bar; +- /* BAR that contains peer spad region */ +- enum pci_barno peer_spad_reg_bar; +- /* BAR that contains Doorbell region and Memory window '1' */ +- enum pci_barno db_reg_bar; +- /* BAR that contains memory windows*/ +- enum pci_barno mw_bar; +-}; +- + static int ntb_epf_send_command(struct ntb_epf_dev *ndev, u32 command, + u32 argument) + { +@@ -144,7 +144,7 @@ static int ntb_epf_mw_to_bar(struct ntb_epf_dev *ndev, int idx) + return -EINVAL; + } + +- return idx + 2; ++ return ndev->barno_map[BAR_MW1 + idx]; + } + + static int ntb_epf_mw_count(struct ntb_dev *ntb, int pidx) +@@ -413,7 +413,9 @@ static int ntb_epf_mw_set_trans(struct ntb_dev *ntb, int pidx, int idx, + return -EINVAL; + } + +- bar = idx + ndev->mw_bar; ++ bar = ntb_epf_mw_to_bar(ndev, idx); ++ if (bar < 0) ++ return bar; + + mw_size = pci_resource_len(ntb->pdev, bar); + +@@ -455,7 +457,9 @@ static int ntb_epf_peer_mw_get_addr(struct ntb_dev *ntb, int idx, + if (idx == 0) + offset = readl(ndev->ctrl_reg + NTB_EPF_MW1_OFFSET); + +- bar = idx + ndev->mw_bar; ++ bar = ntb_epf_mw_to_bar(ndev, idx); ++ if (bar < 0) ++ return bar; + + if (base) + *base = pci_resource_start(ndev->ntb.pdev, bar) + offset; +@@ -560,6 +564,11 @@ static int ntb_epf_init_dev(struct ntb_epf_dev *ndev) + ndev->mw_count = readl(ndev->ctrl_reg + NTB_EPF_MW_COUNT); + ndev->spad_count = readl(ndev->ctrl_reg + NTB_EPF_SPAD_COUNT); + ++ if (ndev->mw_count > NTB_EPF_MAX_MW_COUNT) { ++ dev_err(dev, "Unsupported MW count: %u\n", ndev->mw_count); ++ return -EINVAL; ++ } ++ + return 0; + } + +@@ -596,14 +605,15 @@ static int ntb_epf_init_pci(struct ntb_epf_dev *ndev, + dev_warn(&pdev->dev, "Cannot DMA highmem\n"); + } + +- ndev->ctrl_reg = pci_iomap(pdev, ndev->ctrl_reg_bar, 0); ++ ndev->ctrl_reg = pci_iomap(pdev, ndev->barno_map[BAR_CONFIG], 0); + if (!ndev->ctrl_reg) { + ret = -EIO; + goto err_pci_regions; + } + +- if (ndev->peer_spad_reg_bar) { +- ndev->peer_spad_reg = pci_iomap(pdev, ndev->peer_spad_reg_bar, 0); ++ if (ndev->barno_map[BAR_PEER_SPAD] != ndev->barno_map[BAR_CONFIG]) { ++ ndev->peer_spad_reg = pci_iomap(pdev, ++ ndev->barno_map[BAR_PEER_SPAD], 0); + if (!ndev->peer_spad_reg) { + ret = -EIO; + goto err_pci_regions; +@@ -614,7 +624,7 @@ static int ntb_epf_init_pci(struct ntb_epf_dev *ndev, + ndev->peer_spad_reg = ndev->ctrl_reg + spad_off + spad_sz; + } + +- ndev->db_reg = pci_iomap(pdev, ndev->db_reg_bar, 0); ++ ndev->db_reg = pci_iomap(pdev, ndev->barno_map[BAR_DB], 0); + if (!ndev->db_reg) { + ret = -EIO; + goto err_pci_regions; +@@ -659,12 +669,7 @@ static void ntb_epf_cleanup_isr(struct ntb_epf_dev *ndev) + static int ntb_epf_pci_probe(struct pci_dev *pdev, + const struct pci_device_id *id) + { +- enum pci_barno peer_spad_reg_bar = BAR_1; +- enum pci_barno ctrl_reg_bar = BAR_0; +- enum pci_barno db_reg_bar = BAR_2; +- enum pci_barno mw_bar = BAR_2; + struct device *dev = &pdev->dev; +- struct ntb_epf_data *data; + struct ntb_epf_dev *ndev; + int ret; + +@@ -675,18 +680,10 @@ static int ntb_epf_pci_probe(struct pci_dev *pdev, + if (!ndev) + return -ENOMEM; + +- data = (struct ntb_epf_data *)id->driver_data; +- if (data) { +- peer_spad_reg_bar = data->peer_spad_reg_bar; +- ctrl_reg_bar = data->ctrl_reg_bar; +- db_reg_bar = data->db_reg_bar; +- mw_bar = data->mw_bar; +- } ++ ndev->barno_map = (const enum pci_barno *)id->driver_data; ++ if (!ndev->barno_map) ++ return -EINVAL; + +- ndev->peer_spad_reg_bar = peer_spad_reg_bar; +- ndev->ctrl_reg_bar = ctrl_reg_bar; +- ndev->db_reg_bar = db_reg_bar; +- ndev->mw_bar = mw_bar; + ndev->dev = dev; + + ntb_epf_init_struct(ndev, pdev); +@@ -730,30 +727,36 @@ static void ntb_epf_pci_remove(struct pci_dev *pdev) + ntb_epf_deinit_pci(ndev); + } + +-static const struct ntb_epf_data j721e_data = { +- .ctrl_reg_bar = BAR_0, +- .peer_spad_reg_bar = BAR_1, +- .db_reg_bar = BAR_2, +- .mw_bar = BAR_2, ++static const enum pci_barno j721e_map[NTB_BAR_NUM] = { ++ [BAR_CONFIG] = BAR_0, ++ [BAR_PEER_SPAD] = BAR_1, ++ [BAR_DB] = BAR_2, ++ [BAR_MW1] = BAR_2, ++ [BAR_MW2] = BAR_3, ++ [BAR_MW3] = BAR_4, ++ [BAR_MW4] = BAR_5 + }; + +-static const struct ntb_epf_data mx8_data = { +- .ctrl_reg_bar = BAR_0, +- .peer_spad_reg_bar = BAR_0, +- .db_reg_bar = BAR_2, +- .mw_bar = BAR_4, ++static const enum pci_barno mx8_map[NTB_BAR_NUM] = { ++ [BAR_CONFIG] = BAR_0, ++ [BAR_PEER_SPAD] = BAR_0, ++ [BAR_DB] = BAR_2, ++ [BAR_MW1] = BAR_4, ++ [BAR_MW2] = BAR_5, ++ [BAR_MW3] = NO_BAR, ++ [BAR_MW4] = NO_BAR + }; + + static const struct pci_device_id ntb_epf_pci_tbl[] = { + { + PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_J721E), + .class = PCI_CLASS_MEMORY_RAM << 8, .class_mask = 0xffff00, +- .driver_data = (kernel_ulong_t)&j721e_data, ++ .driver_data = (kernel_ulong_t)j721e_map, + }, + { + PCI_DEVICE(PCI_VENDOR_ID_FREESCALE, 0x0809), + .class = PCI_CLASS_MEMORY_RAM << 8, .class_mask = 0xffff00, +- .driver_data = (kernel_ulong_t)&mx8_data, ++ .driver_data = (kernel_ulong_t)mx8_map, + }, + { }, + }; +-- +2.51.0 + diff --git a/queue-6.17/rtc-pcf2127-clear-minute-second-interrupt.patch b/queue-6.17/rtc-pcf2127-clear-minute-second-interrupt.patch new file mode 100644 index 0000000000..1e17fed2ab --- /dev/null +++ b/queue-6.17/rtc-pcf2127-clear-minute-second-interrupt.patch @@ -0,0 +1,70 @@ +From 7ca0fb867546d53e121c1c5f2271ec6157011240 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 19:54:09 +0200 +Subject: rtc: pcf2127: clear minute/second interrupt + +From: Josua Mayer + +[ Upstream commit a6f1a4f05970664004a9370459c6799c1b2f2dcf ] + +PCF2127 can generate interrupt every full second or minute configured +from control and status register 1, bits MI (1) and SI (0). + +On interrupt control register 2 bit MSF (7) is set and must be cleared +to continue normal operation. + +While the driver never enables this interrupt on its own, users or +firmware may do so - e.g. as an easy way to test the interrupt. + +Add preprocessor definition for MSF bit and include it in the irq +bitmask to ensure minute and second interrupts are cleared when fired. + +This fixes an issue where the rtc enters a test mode and becomes +unresponsive after a second interrupt has fired and is not cleared in +time. In this state register writes to control registers have no +effect and the interrupt line is kept asserted [1]: + +[1] userspace commands to put rtc into unresponsive state: +$ i2cget -f -y 2 0x51 0x00 +0x04 +$ i2cset -f -y 2 0x51 0x00 0x05 # set bit 0 SI +$ i2cget -f -y 2 0x51 0x00 +0x84 # bit 8 EXT_TEST set +$ i2cset -f -y 2 0x51 0x00 0x05 # try overwrite control register +$ i2cget -f -y 2 0x51 0x00 +0x84 # no change + +Signed-off-by: Josua Mayer +Reviewed-by: Bruno Thomsen +Link: https://lore.kernel.org/r/20250825-rtc-irq-v1-1-0133319406a7@solid-run.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-pcf2127.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c +index 2e1ac0c42e932..3ba1de30e89c2 100644 +--- a/drivers/rtc/rtc-pcf2127.c ++++ b/drivers/rtc/rtc-pcf2127.c +@@ -42,6 +42,7 @@ + #define PCF2127_BIT_CTRL2_AF BIT(4) + #define PCF2127_BIT_CTRL2_TSF2 BIT(5) + #define PCF2127_BIT_CTRL2_WDTF BIT(6) ++#define PCF2127_BIT_CTRL2_MSF BIT(7) + /* Control register 3 */ + #define PCF2127_REG_CTRL3 0x02 + #define PCF2127_BIT_CTRL3_BLIE BIT(0) +@@ -96,7 +97,8 @@ + #define PCF2127_CTRL2_IRQ_MASK ( \ + PCF2127_BIT_CTRL2_AF | \ + PCF2127_BIT_CTRL2_WDTF | \ +- PCF2127_BIT_CTRL2_TSF2) ++ PCF2127_BIT_CTRL2_TSF2 | \ ++ PCF2127_BIT_CTRL2_MSF) + + #define PCF2127_MAX_TS_SUPPORTED 4 + +-- +2.51.0 + diff --git a/queue-6.17/rtc-pcf2127-fix-watchdog-interrupt-mask-on-pcf2131.patch b/queue-6.17/rtc-pcf2127-fix-watchdog-interrupt-mask-on-pcf2131.patch new file mode 100644 index 0000000000..4780cfd20c --- /dev/null +++ b/queue-6.17/rtc-pcf2127-fix-watchdog-interrupt-mask-on-pcf2131.patch @@ -0,0 +1,50 @@ +From 5fd2b60cd795ed2c468c1c820150508cdaf47d00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 20:22:35 +0200 +Subject: rtc: pcf2127: fix watchdog interrupt mask on pcf2131 + +From: Bruno Thomsen + +[ Upstream commit 87064da2db7be537a7da20a25c18ba912c4db9e1 ] + +When using interrupt pin (INT A) as watchdog output all other +interrupt sources need to be disabled to avoid additional +resets. Resulting INT_A_MASK1 value is 55 (0x37). + +Signed-off-by: Bruno Thomsen +Link: https://lore.kernel.org/r/20250902182235.6825-1-bruno.thomsen@gmail.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-pcf2127.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c +index 3ba1de30e89c2..bb4fe81d3d62c 100644 +--- a/drivers/rtc/rtc-pcf2127.c ++++ b/drivers/rtc/rtc-pcf2127.c +@@ -608,6 +608,21 @@ static int pcf2127_watchdog_init(struct device *dev, struct pcf2127 *pcf2127) + set_bit(WDOG_HW_RUNNING, &pcf2127->wdd.status); + } + ++ /* ++ * When using interrupt pin (INT A) as watchdog output, only allow ++ * watchdog interrupt (PCF2131_BIT_INT_WD_CD) and disable (mask) all ++ * other interrupts. ++ */ ++ if (pcf2127->cfg->type == PCF2131) { ++ ret = regmap_write(pcf2127->regmap, ++ PCF2131_REG_INT_A_MASK1, ++ PCF2131_BIT_INT_BLIE | ++ PCF2131_BIT_INT_BIE | ++ PCF2131_BIT_INT_AIE | ++ PCF2131_BIT_INT_SI | ++ PCF2131_BIT_INT_MI); ++ } ++ + return devm_watchdog_register_device(dev, &pcf2127->wdd); + } + +-- +2.51.0 + diff --git a/queue-6.17/rtc-zynqmp-restore-alarm-functionality-after-kexec-t.patch b/queue-6.17/rtc-zynqmp-restore-alarm-functionality-after-kexec-t.patch new file mode 100644 index 0000000000..8ea0348530 --- /dev/null +++ b/queue-6.17/rtc-zynqmp-restore-alarm-functionality-after-kexec-t.patch @@ -0,0 +1,79 @@ +From 697100d76960b648fd2cc40d167737cbfe5750ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jul 2025 19:51:10 +0530 +Subject: rtc: zynqmp: Restore alarm functionality after kexec transition + +From: Harini T + +[ Upstream commit e22f4d1321e0055065f274e20bf6d1dbf4b500f5 ] + +During kexec reboots, RTC alarms that are fired during the kernel +transition experience delayed execution. The new kernel would eventually +honor these alarms, but the interrupt handlers would only execute after +the driver probe is completed rather than at the intended alarm time. + +This is because pending alarm interrupt status from the previous kernel +is not properly cleared during driver initialization, causing timing +discrepancies in alarm delivery. + +To ensure precise alarm timing across kexec transitions, enhance the +probe function to: +1. Clear any pending alarm interrupt status from previous boot. +2. Detect existing valid alarms and preserve their state. +3. Re-enable alarm interrupts for future alarms. + +Signed-off-by: Harini T +Link: https://lore.kernel.org/r/20250730142110.2354507-1-harini.t@amd.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-zynqmp.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/drivers/rtc/rtc-zynqmp.c b/drivers/rtc/rtc-zynqmp.c +index f39102b66eac2..3baa2b481d9f2 100644 +--- a/drivers/rtc/rtc-zynqmp.c ++++ b/drivers/rtc/rtc-zynqmp.c +@@ -277,6 +277,10 @@ static irqreturn_t xlnx_rtc_interrupt(int irq, void *id) + static int xlnx_rtc_probe(struct platform_device *pdev) + { + struct xlnx_rtc_dev *xrtcdev; ++ bool is_alarm_set = false; ++ u32 pending_alrm_irq; ++ u32 current_time; ++ u32 alarm_time; + int ret; + + xrtcdev = devm_kzalloc(&pdev->dev, sizeof(*xrtcdev), GFP_KERNEL); +@@ -296,6 +300,17 @@ static int xlnx_rtc_probe(struct platform_device *pdev) + if (IS_ERR(xrtcdev->reg_base)) + return PTR_ERR(xrtcdev->reg_base); + ++ /* Clear any pending alarm interrupts from previous kernel/boot */ ++ pending_alrm_irq = readl(xrtcdev->reg_base + RTC_INT_STS) & RTC_INT_ALRM; ++ if (pending_alrm_irq) ++ writel(pending_alrm_irq, xrtcdev->reg_base + RTC_INT_STS); ++ ++ /* Check if a valid alarm is already set from previous kernel/boot */ ++ alarm_time = readl(xrtcdev->reg_base + RTC_ALRM); ++ current_time = readl(xrtcdev->reg_base + RTC_CUR_TM); ++ if (alarm_time > current_time && alarm_time != 0) ++ is_alarm_set = true; ++ + xrtcdev->alarm_irq = platform_get_irq_byname(pdev, "alarm"); + if (xrtcdev->alarm_irq < 0) + return xrtcdev->alarm_irq; +@@ -337,6 +352,10 @@ static int xlnx_rtc_probe(struct platform_device *pdev) + + xlnx_init_rtc(xrtcdev); + ++ /* Re-enable alarm interrupt if a valid alarm was found */ ++ if (is_alarm_set) ++ writel(RTC_INT_ALRM, xrtcdev->reg_base + RTC_INT_EN); ++ + device_init_wakeup(&pdev->dev, true); + + return devm_rtc_register_device(xrtcdev->rtc); +-- +2.51.0 + diff --git a/queue-6.17/scsi-ufs-core-include-utp-error-in-int_fatal_errors.patch b/queue-6.17/scsi-ufs-core-include-utp-error-in-int_fatal_errors.patch new file mode 100644 index 0000000000..5db58ef253 --- /dev/null +++ b/queue-6.17/scsi-ufs-core-include-utp-error-in-int_fatal_errors.patch @@ -0,0 +1,77 @@ +From 492ee5312ecf3685d671db6a2fee249c984a6a32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 15:14:28 +0900 +Subject: scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS + +From: Hoyoung Seo + +[ Upstream commit 558ae4579810fa0fef011944230c65a6f3087f85 ] + +When a UTP error occurs in isolation, UFS is not currently recoverable. +This is because the UTP error is not considered fatal in the error +handling code, leading to either an I/O timeout or an OCS error. + +Add the UTP error flag to INT_FATAL_ERRORS so the controller will be +reset in this situation. + + sd 0:0:0:0: [sda] tag#38 UNKNOWN(0x2003) Result: hostbyte=0x07 + driverbyte=DRIVER_OK cmd_age=0s + sd 0:0:0:0: [sda] tag#38 CDB: opcode=0x28 28 00 00 51 24 e2 00 00 08 00 + I/O error, dev sda, sector 42542864 op 0x0:(READ) flags 0x80700 phys_seg + 8 prio class 2 + OCS error from controller = 9 for tag 39 + pa_err[1] = 0x80000010 at 2667224756 us + pa_err: total cnt=2 + dl_err[0] = 0x80000002 at 2667148060 us + dl_err[1] = 0x80002000 at 2667282844 us + No record of nl_err + No record of tl_err + No record of dme_err + No record of auto_hibern8_err + fatal_err[0] = 0x804 at 2667282836 us + + --------------------------------------------------- + REGISTER + --------------------------------------------------- + NAME OFFSET VALUE + STD HCI SFR 0xfffffff0 0x0 + AHIT 0x18 0x814 + INTERRUPT STATUS 0x20 0x1000 + INTERRUPT ENABLE 0x24 0x70ef5 + +[mkp: commit desc] + +Signed-off-by: Hoyoung Seo +Reviewed-by: Bart Van Assche +Message-Id: <20250930061428.617955-1-hy50.seo@samsung.com> +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + include/ufs/ufshci.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/include/ufs/ufshci.h b/include/ufs/ufshci.h +index 612500a7088f0..e64b701321010 100644 +--- a/include/ufs/ufshci.h ++++ b/include/ufs/ufshci.h +@@ -180,6 +180,7 @@ static inline u32 ufshci_version(u32 major, u32 minor) + #define UTP_TASK_REQ_COMPL 0x200 + #define UIC_COMMAND_COMPL 0x400 + #define DEVICE_FATAL_ERROR 0x800 ++#define UTP_ERROR 0x1000 + #define CONTROLLER_FATAL_ERROR 0x10000 + #define SYSTEM_BUS_FATAL_ERROR 0x20000 + #define CRYPTO_ENGINE_FATAL_ERROR 0x40000 +@@ -199,7 +200,8 @@ static inline u32 ufshci_version(u32 major, u32 minor) + CONTROLLER_FATAL_ERROR |\ + SYSTEM_BUS_FATAL_ERROR |\ + CRYPTO_ENGINE_FATAL_ERROR |\ +- UIC_LINK_LOST) ++ UIC_LINK_LOST |\ ++ UTP_ERROR) + + /* HCS - Host Controller Status 30h */ + #define DEVICE_PRESENT 0x1 +-- +2.51.0 + diff --git a/queue-6.17/series b/queue-6.17/series index 0b3769eb89..e4932f420a 100644 --- a/queue-6.17/series +++ b/queue-6.17/series @@ -691,3 +691,48 @@ rdma-hns-fix-the-modification-of-max_send_sge.patch rdma-hns-fix-wrong-wqe-data-when-qp-wraps-around.patch btrfs-fix-memory-leak-of-qgroup_list-in-btrfs_add_qg.patch btrfs-mark-dirty-extent-range-for-out-of-bound-preal.patch +clk-qcom-gcc-ipq6018-rework-nss_port5-clock-to-multi.patch +clk-thead-th1520-ap-set-all-axi-clocks-to-clk_is_cri.patch +clk-renesas-rzv2h-re-assert-reset-on-deassert-timeou.patch +clk-samsung-exynos990-add-missing-usb-clock-register.patch +fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch +clocksource-hyper-v-skip-unnecessary-checks-for-the-.patch +hyperv-add-missing-field-to-hv_output_map_device_int.patch +um-fix-help-message-for-ssl-non-raw.patch +clk-sunxi-ng-sun6i-rtc-add-a523-specifics.patch +rtc-pcf2127-clear-minute-second-interrupt.patch +arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch +clk-at91-add-acr-in-all-pll-settings.patch +clk-at91-sam9x7-add-peripheral-clock-id-for-pmecc.patch +clk-at91-clk-master-add-check-for-divide-by-3.patch +clk-at91-clk-sam9x60-pll-force-write-to-pll_updt-reg.patch +9p-trans_fd-p9_fd_request-kick-rx-thread-if-epollin.patch +clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch +clk-scmi-add-duty-cycle-ops-only-when-duty-cycle-is-.patch +clk-clocking-wizard-fix-output-clock-register-offset.patch +ntb-epf-allow-arbitrary-bar-mapping.patch +9p-fix-sys-fs-9p-caches-overwriting-itself.patch +cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch +9p-sysfs_init-don-t-hardcode-error-to-enomem.patch +scsi-ufs-core-include-utp-error-in-int_fatal_errors.patch +fbdev-core-fix-ubsan-warning-in-pixel_to_pat.patch +acpi-property-return-present-device-nodes-only-on-fw.patch +loongarch-handle-new-atomic-instructions-for-probes.patch +tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch +tools-lib-thermal-don-t-preserve-owner-in-install.patch +tools-lib-thermal-use-pkg-config-to-locate-libnl3.patch +fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch +alsa-hda-realtek-add-quirk-for-asus-rog-zephyrus-duo.patch +rtc-zynqmp-restore-alarm-functionality-after-kexec-t.patch +rtc-pcf2127-fix-watchdog-interrupt-mask-on-pcf2131.patch +net-wwan-t7xx-add-support-for-hp-drmr-h01.patch +kbuild-uapi-strip-comments-before-size-type-check.patch +asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch +asoc-rt722-add-settings-for-rt722vb.patch +drm-amdkfd-fix-mmap-write-lock-not-release.patch +drm-amdgpu-report-individual-reset-error.patch +ceph-add-checking-of-wait_for_completion_killable-re.patch +ceph-fix-potential-race-condition-in-ceph_ioctl_lazy.patch +ceph-refactor-wake_up_bit-pattern-of-calling.patch +ceph-fix-multifs-mds-auth-caps-issue.patch +x86-uaccess-don-t-use-runtime-const-rewriting-in-mod.patch diff --git a/queue-6.17/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch b/queue-6.17/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch new file mode 100644 index 0000000000..1e8057efd5 --- /dev/null +++ b/queue-6.17/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch @@ -0,0 +1,66 @@ +From 8c3ca317840ad9d721eb5d6054e996409d1d5768 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 15:47:06 -0700 +Subject: tools bitmap: Add missing asm-generic/bitsperlong.h include +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ian Rogers + +[ Upstream commit f38ce0209ab4553906b44bd1159e35c740a84161 ] + +small_const_nbits is defined in asm-generic/bitsperlong.h which +bitmap.h uses but doesn't include causing build failures in some build +systems. Add the missing #include. + +Note the bitmap.h in tools has diverged from that of the kernel, so no +changes are made there. + +Signed-off-by: Ian Rogers +Acked-by: Yury Norov +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: André Almeida +Cc: Daniel Borkmann +Cc: Darren Hart +Cc: David S. Miller +Cc: Davidlohr Bueso +Cc: Ido Schimmel +Cc: Ingo Molnar +Cc: Jakub Kicinski +Cc: Jamal Hadi Salim +Cc: Jason Xing +Cc: Jiri Olsa +Cc: Jonas Gottlieb +Cc: Kan Liang +Cc: Mark Rutland +Cc: Maurice Lambert +Cc: Namhyung Kim +Cc: Paolo Abeni +Cc: Peter Zijlstra +Cc: Petr Machata +Cc: Rasmus Villemoes +Cc: Thomas Gleixner +Cc: Yuyang Huang +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/include/linux/bitmap.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/include/linux/bitmap.h b/tools/include/linux/bitmap.h +index d4d300040d019..0d992245c600d 100644 +--- a/tools/include/linux/bitmap.h ++++ b/tools/include/linux/bitmap.h +@@ -3,6 +3,7 @@ + #define _TOOLS_LINUX_BITMAP_H + + #include ++#include + #include + #include + #include +-- +2.51.0 + diff --git a/queue-6.17/tools-lib-thermal-don-t-preserve-owner-in-install.patch b/queue-6.17/tools-lib-thermal-don-t-preserve-owner-in-install.patch new file mode 100644 index 0000000000..b4e599adaf --- /dev/null +++ b/queue-6.17/tools-lib-thermal-don-t-preserve-owner-in-install.patch @@ -0,0 +1,41 @@ +From 81830aa27d84aee82ba7bd70af35679b006d2994 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 13:40:56 +0200 +Subject: tools: lib: thermal: don't preserve owner in install + +From: Emil Dahl Juhl + +[ Upstream commit 1375152bb02ab2a8435e87ea27034482dbc95f57 ] + +Instead of preserving mode, timestamp, and owner, for the object files +during installation, just preserve the mode and timestamp. + +When installing as root, the installed files should be owned by root. +When installing as user, --preserve=ownership doesn't work anyway. This +makes --preserve=ownership rather pointless. + +Signed-off-by: Emil Dahl Juhl +Signed-off-by: Sascha Hauer +Acked-by: Daniel Lezcano +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + tools/lib/thermal/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/thermal/Makefile b/tools/lib/thermal/Makefile +index a1f5e388644d3..ac918e98cd033 100644 +--- a/tools/lib/thermal/Makefile ++++ b/tools/lib/thermal/Makefile +@@ -134,7 +134,7 @@ endef + install_lib: libs + $(call QUIET_INSTALL, $(LIBTHERMAL_ALL)) \ + $(call do_install_mkdir,$(libdir_SQ)); \ +- cp -fpR $(LIBTHERMAL_ALL) $(DESTDIR)$(libdir_SQ) ++ cp -fR --preserve=mode,timestamp $(LIBTHERMAL_ALL) $(DESTDIR)$(libdir_SQ) + + install_headers: + $(call QUIET_INSTALL, headers) \ +-- +2.51.0 + diff --git a/queue-6.17/tools-lib-thermal-use-pkg-config-to-locate-libnl3.patch b/queue-6.17/tools-lib-thermal-use-pkg-config-to-locate-libnl3.patch new file mode 100644 index 0000000000..a9cbc02536 --- /dev/null +++ b/queue-6.17/tools-lib-thermal-use-pkg-config-to-locate-libnl3.patch @@ -0,0 +1,49 @@ +From 6f06eee12bad566d25b3c0fb31afa4d2b8e8732c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 13:40:55 +0200 +Subject: tools: lib: thermal: use pkg-config to locate libnl3 + +From: Sascha Hauer + +[ Upstream commit b31f7f725cd932e2c2b41f3e4b66273653953687 ] + +To make libthermal more cross compile friendly use pkg-config to locate +libnl3. Only if that fails fall back to hardcoded /usr/include/libnl3. + +Signed-off-by: Sascha Hauer +Acked-by: Daniel Lezcano +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + tools/lib/thermal/Makefile | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/tools/lib/thermal/Makefile b/tools/lib/thermal/Makefile +index ac918e98cd033..41aa7a324ff4d 100644 +--- a/tools/lib/thermal/Makefile ++++ b/tools/lib/thermal/Makefile +@@ -46,8 +46,12 @@ else + CFLAGS := -g -Wall + endif + ++NL3_CFLAGS = $(shell pkg-config --cflags libnl-3.0 2>/dev/null) ++ifeq ($(NL3_CFLAGS),) ++NL3_CFLAGS = -I/usr/include/libnl3 ++endif ++ + INCLUDES = \ +--I/usr/include/libnl3 \ + -I$(srctree)/tools/lib/thermal/include \ + -I$(srctree)/tools/lib/ \ + -I$(srctree)/tools/include \ +@@ -59,6 +63,7 @@ INCLUDES = \ + override CFLAGS += $(EXTRA_WARNINGS) + override CFLAGS += -Werror -Wall + override CFLAGS += -fPIC ++override CFLAGS += $(NL3_CFLAGS) + override CFLAGS += $(INCLUDES) + override CFLAGS += -fvisibility=hidden + override CFGLAS += -Wl,-L. +-- +2.51.0 + diff --git a/queue-6.17/um-fix-help-message-for-ssl-non-raw.patch b/queue-6.17/um-fix-help-message-for-ssl-non-raw.patch new file mode 100644 index 0000000000..e983d4fccc --- /dev/null +++ b/queue-6.17/um-fix-help-message-for-ssl-non-raw.patch @@ -0,0 +1,36 @@ +From 98be43096261705042c3f0207152fdae903e4f21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 08:56:59 +0800 +Subject: um: Fix help message for ssl-non-raw + +From: Tiwei Bie + +[ Upstream commit 725e9d81868fcedaeef775948e699955b01631ae ] + +Add the missing option name in the help message. Additionally, +switch to __uml_help(), because this is a global option rather +than a per-channel option. + +Signed-off-by: Tiwei Bie +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + arch/um/drivers/ssl.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/um/drivers/ssl.c b/arch/um/drivers/ssl.c +index 277cea3d30eb5..8006a5bd578c2 100644 +--- a/arch/um/drivers/ssl.c ++++ b/arch/um/drivers/ssl.c +@@ -199,4 +199,7 @@ static int ssl_non_raw_setup(char *str) + return 1; + } + __setup("ssl-non-raw", ssl_non_raw_setup); +-__channel_help(ssl_non_raw_setup, "set serial lines to non-raw mode"); ++__uml_help(ssl_non_raw_setup, ++"ssl-non-raw\n" ++" Set serial lines to non-raw mode.\n\n" ++); +-- +2.51.0 + diff --git a/queue-6.17/x86-uaccess-don-t-use-runtime-const-rewriting-in-mod.patch b/queue-6.17/x86-uaccess-don-t-use-runtime-const-rewriting-in-mod.patch new file mode 100644 index 0000000000..8ee926a655 --- /dev/null +++ b/queue-6.17/x86-uaccess-don-t-use-runtime-const-rewriting-in-mod.patch @@ -0,0 +1,128 @@ +From 8a10a91f0bc8cc23e6093d52014c06356e835e0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 15:25:20 +0900 +Subject: x86: uaccess: don't use runtime-const rewriting in modules + +From: Linus Torvalds + +[ Upstream commit 284922f4c563aa3a8558a00f2a05722133237fe8 ] + +The runtime-const infrastructure was never designed to handle the +modular case, because the constant fixup is only done at boot time for +core kernel code. + +But by the time I used it for the x86-64 user space limit handling in +commit 86e6b1547b3d ("x86: fix user address masking non-canonical +speculation issue"), I had completely repressed that fact. + +And it all happens to work because the only code that currently actually +gets inlined by modules is for the access_ok() limit check, where the +default constant value works even when not fixed up. Because at least I +had intentionally made it be something that is in the non-canonical +address space region. + +But it's technically very wrong, and it does mean that at least in +theory, the use of 'access_ok()' + '__get_user()' can trigger the same +speculation issue with non-canonical addresses that the original commit +was all about. + +The pattern is unusual enough that this probably doesn't matter in +practice, but very wrong is still very wrong. Also, let's fix it before +the nice optimized scoped user accessor helpers that Thomas Gleixner is +working on cause this pseudo-constant to then be more widely used. + +This all came up due to an unrelated discussion with Mateusz Guzik about +using the runtime const infrastructure for names_cachep accesses too. +There the modular case was much more obviously broken, and Mateusz noted +it in his 'v2' of the patch series. + +That then made me notice how broken 'access_ok()' had been in modules +all along. Mea culpa, mea maxima culpa. + +Fix it by simply not using the runtime-const code in modules, and just +using the USER_PTR_MAX variable value instead. This is not +performance-critical like the core user accessor functions (get_user() +and friends) are. + +Also make sure this doesn't get forgotten the next time somebody wants +to do runtime constant optimizations by having the x86 runtime-const.h +header file error out if included by modules. + +Fixes: 86e6b1547b3d ("x86: fix user address masking non-canonical speculation issue") +Acked-by: Borislav Petkov +Acked-by: Sean Christopherson +Cc: Thomas Gleixner +Triggered-by: Mateusz Guzik +Link: https://lore.kernel.org/all/20251030105242.801528-1-mjguzik@gmail.com/ +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/runtime-const.h | 4 ++++ + arch/x86/include/asm/uaccess_64.h | 10 +++++----- + arch/x86/kernel/cpu/common.c | 6 +++++- + 3 files changed, 14 insertions(+), 6 deletions(-) + +diff --git a/arch/x86/include/asm/runtime-const.h b/arch/x86/include/asm/runtime-const.h +index 8d983cfd06ea6..e5a13dc8816e2 100644 +--- a/arch/x86/include/asm/runtime-const.h ++++ b/arch/x86/include/asm/runtime-const.h +@@ -2,6 +2,10 @@ + #ifndef _ASM_RUNTIME_CONST_H + #define _ASM_RUNTIME_CONST_H + ++#ifdef MODULE ++ #error "Cannot use runtime-const infrastructure from modules" ++#endif ++ + #ifdef __ASSEMBLY__ + + .macro RUNTIME_CONST_PTR sym reg +diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h +index c8a5ae35c8714..641f45c22f9da 100644 +--- a/arch/x86/include/asm/uaccess_64.h ++++ b/arch/x86/include/asm/uaccess_64.h +@@ -12,12 +12,12 @@ + #include + #include + #include +-#include + +-/* +- * Virtual variable: there's no actual backing store for this, +- * it can purely be used as 'runtime_const_ptr(USER_PTR_MAX)' +- */ ++#ifdef MODULE ++ #define runtime_const_ptr(sym) (sym) ++#else ++ #include ++#endif + extern unsigned long USER_PTR_MAX; + + #ifdef CONFIG_ADDRESS_MASKING +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index f98ec9c7fc07f..c08fe6f6a186e 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -78,6 +78,10 @@ + DEFINE_PER_CPU_READ_MOSTLY(struct cpuinfo_x86, cpu_info); + EXPORT_PER_CPU_SYMBOL(cpu_info); + ++/* Used for modules: built-in code uses runtime constants */ ++unsigned long USER_PTR_MAX; ++EXPORT_SYMBOL(USER_PTR_MAX); ++ + u32 elf_hwcap2 __read_mostly; + + /* Number of siblings per CPU package */ +@@ -2578,7 +2582,7 @@ void __init arch_cpu_finalize_init(void) + alternative_instructions(); + + if (IS_ENABLED(CONFIG_X86_64)) { +- unsigned long USER_PTR_MAX = TASK_SIZE_MAX; ++ USER_PTR_MAX = TASK_SIZE_MAX; + + /* + * Enable this when LAM is gated on LASS support +-- +2.51.0 + diff --git a/queue-6.6/9p-fix-sys-fs-9p-caches-overwriting-itself.patch b/queue-6.6/9p-fix-sys-fs-9p-caches-overwriting-itself.patch new file mode 100644 index 0000000000..92261fd394 --- /dev/null +++ b/queue-6.6/9p-fix-sys-fs-9p-caches-overwriting-itself.patch @@ -0,0 +1,41 @@ +From 09a8f5293fdf6711c3ba823e0a5a4929d4912bb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 18:27:30 +0900 +Subject: 9p: fix /sys/fs/9p/caches overwriting itself +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Randall P. Embry + +[ Upstream commit 86db0c32f16c5538ddb740f54669ace8f3a1f3d7 ] + +caches_show() overwrote its buffer on each iteration, +so only the last cache tag was visible in sysfs output. + +Properly append with snprintf(buf + count, …). + +Signed-off-by: Randall P. Embry +Message-ID: <20250926-v9fs_misc-v1-2-a8b3907fc04d@codewreck.org> +Signed-off-by: Dominique Martinet +Signed-off-by: Sasha Levin +--- + fs/9p/v9fs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c +index d525957594b6b..af1921454ce87 100644 +--- a/fs/9p/v9fs.c ++++ b/fs/9p/v9fs.c +@@ -561,7 +561,7 @@ static ssize_t caches_show(struct kobject *kobj, + spin_lock(&v9fs_sessionlist_lock); + list_for_each_entry(v9ses, &v9fs_sessionlist, slist) { + if (v9ses->cachetag) { +- n = snprintf(buf, limit, "%s\n", v9ses->cachetag); ++ n = snprintf(buf + count, limit, "%s\n", v9ses->cachetag); + if (n < 0) { + count = n; + break; +-- +2.51.0 + diff --git a/queue-6.6/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch b/queue-6.6/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch new file mode 100644 index 0000000000..fc71fade66 --- /dev/null +++ b/queue-6.6/9p-sysfs_init-don-t-hardcode-error-to-enomem.patch @@ -0,0 +1,46 @@ +From 2c44c07fba8d7d50db5ec8fdf7906fa6cd31d9c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 18:27:31 +0900 +Subject: 9p: sysfs_init: don't hardcode error to ENOMEM + +From: Randall P. Embry + +[ Upstream commit 528f218b31aac4bbfc58914d43766a22ab545d48 ] + +v9fs_sysfs_init() always returned -ENOMEM on failure; +return the actual sysfs_create_group() error instead. + +Signed-off-by: Randall P. Embry +Message-ID: <20250926-v9fs_misc-v1-3-a8b3907fc04d@codewreck.org> +Signed-off-by: Dominique Martinet +Signed-off-by: Sasha Levin +--- + fs/9p/v9fs.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c +index af1921454ce87..be61810cb7798 100644 +--- a/fs/9p/v9fs.c ++++ b/fs/9p/v9fs.c +@@ -597,13 +597,16 @@ static const struct attribute_group v9fs_attr_group = { + + static int __init v9fs_sysfs_init(void) + { ++ int ret; ++ + v9fs_kobj = kobject_create_and_add("9p", fs_kobj); + if (!v9fs_kobj) + return -ENOMEM; + +- if (sysfs_create_group(v9fs_kobj, &v9fs_attr_group)) { ++ ret = sysfs_create_group(v9fs_kobj, &v9fs_attr_group); ++ if (ret) { + kobject_put(v9fs_kobj); +- return -ENOMEM; ++ return ret; + } + + return 0; +-- +2.51.0 + diff --git a/queue-6.6/acpi-property-return-present-device-nodes-only-on-fw.patch b/queue-6.6/acpi-property-return-present-device-nodes-only-on-fw.patch new file mode 100644 index 0000000000..c55c5ea4d7 --- /dev/null +++ b/queue-6.6/acpi-property-return-present-device-nodes-only-on-fw.patch @@ -0,0 +1,75 @@ +From 790ba1c3b74be7b3039c42e90d951e2b651d1f07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 13:26:36 +0300 +Subject: ACPI: property: Return present device nodes only on fwnode interface + +From: Sakari Ailus + +[ Upstream commit d9f866b2bb3eec38b3734f1fed325ec7c55ccdfa ] + +fwnode_graph_get_next_subnode() may return fwnode backed by ACPI +device nodes and there has been no check these devices are present +in the system, unlike there has been on fwnode OF backend. + +In order to provide consistent behaviour towards callers, +add a check for device presence by introducing +a new function acpi_get_next_present_subnode(), used as the +get_next_child_node() fwnode operation that also checks device +node presence. + +Signed-off-by: Sakari Ailus +Reviewed-by: Laurent Pinchart +Reviewed-by: Jonathan Cameron +Link: https://patch.msgid.link/20251001102636.1272722-2-sakari.ailus@linux.intel.com +[ rjw: Kerneldoc comment and changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/property.c | 24 +++++++++++++++++++++++- + 1 file changed, 23 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c +index 5898c3c8c2a7f..d02b332744e64 100644 +--- a/drivers/acpi/property.c ++++ b/drivers/acpi/property.c +@@ -1286,6 +1286,28 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode, + return NULL; + } + ++/* ++ * acpi_get_next_present_subnode - Return the next present child node handle ++ * @fwnode: Firmware node to find the next child node for. ++ * @child: Handle to one of the device's child nodes or a null handle. ++ * ++ * Like acpi_get_next_subnode(), but the device nodes returned by ++ * acpi_get_next_present_subnode() are guaranteed to be present. ++ * ++ * Returns: The fwnode handle of the next present sub-node. ++ */ ++static struct fwnode_handle * ++acpi_get_next_present_subnode(const struct fwnode_handle *fwnode, ++ struct fwnode_handle *child) ++{ ++ do { ++ child = acpi_get_next_subnode(fwnode, child); ++ } while (is_acpi_device_node(child) && ++ !acpi_device_is_present(to_acpi_device_node(child))); ++ ++ return child; ++} ++ + /** + * acpi_node_get_parent - Return parent fwnode of this fwnode + * @fwnode: Firmware node whose parent to get +@@ -1629,7 +1651,7 @@ static int acpi_fwnode_irq_get(const struct fwnode_handle *fwnode, + .property_read_string_array = \ + acpi_fwnode_property_read_string_array, \ + .get_parent = acpi_node_get_parent, \ +- .get_next_child_node = acpi_get_next_subnode, \ ++ .get_next_child_node = acpi_get_next_present_subnode, \ + .get_named_child_node = acpi_fwnode_get_named_child_node, \ + .get_name = acpi_fwnode_get_name, \ + .get_name_prefix = acpi_fwnode_get_name_prefix, \ +-- +2.51.0 + diff --git a/queue-6.6/arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch b/queue-6.6/arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch new file mode 100644 index 0000000000..ceeb94496f --- /dev/null +++ b/queue-6.6/arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch @@ -0,0 +1,59 @@ +From cd26b25f99dadfa9d3f1dc35e309e6895c3ff452 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 16:54:27 +0200 +Subject: ARM: at91: pm: save and restore ACR during PLL disable/enable + +From: Nicolas Ferre + +[ Upstream commit 0c01fe49651d387776abed6a28541e80c8a93319 ] + +Add a new word in assembly to store ACR value during the calls +to at91_plla_disable/at91_plla_enable macros and use it. + +Signed-off-by: Nicolas Ferre +[cristian.birsan@microchip.com: remove ACR_DEFAULT_PLLA loading] +Signed-off-by: Cristian Birsan +Link: https://lore.kernel.org/r/20250827145427.46819-4-nicolas.ferre@microchip.com +Reviewed-by: Alexandre Belloni +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + arch/arm/mach-at91/pm_suspend.S | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S +index 94dece1839af3..99aaf5cf89696 100644 +--- a/arch/arm/mach-at91/pm_suspend.S ++++ b/arch/arm/mach-at91/pm_suspend.S +@@ -689,6 +689,10 @@ sr_dis_exit: + bic tmp2, tmp2, #AT91_PMC_PLL_UPDT_ID + str tmp2, [pmc, #AT91_PMC_PLL_UPDT] + ++ /* save acr */ ++ ldr tmp2, [pmc, #AT91_PMC_PLL_ACR] ++ str tmp2, .saved_acr ++ + /* save div. */ + mov tmp1, #0 + ldr tmp2, [pmc, #AT91_PMC_PLL_CTRL0] +@@ -758,7 +762,7 @@ sr_dis_exit: + str tmp1, [pmc, #AT91_PMC_PLL_UPDT] + + /* step 2. */ +- ldr tmp1, =AT91_PMC_PLL_ACR_DEFAULT_PLLA ++ ldr tmp1, .saved_acr + str tmp1, [pmc, #AT91_PMC_PLL_ACR] + + /* step 3. */ +@@ -1134,6 +1138,8 @@ ENDPROC(at91_pm_suspend_in_sram) + .word 0 + .saved_mckr: + .word 0 ++.saved_acr: ++ .word 0 + .saved_pllar: + .word 0 + .saved_sam9_lpr: +-- +2.51.0 + diff --git a/queue-6.6/asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch b/queue-6.6/asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch new file mode 100644 index 0000000000..4c96899ebe --- /dev/null +++ b/queue-6.6/asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch @@ -0,0 +1,53 @@ +From f2c1ff797ab942552f203effa2ca2e996f6b8613 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 00:12:19 +0200 +Subject: ASoC: meson: aiu-encoder-i2s: fix bit clock polarity + +From: Valerio Setti + +[ Upstream commit 4c4ed5e073a923fb3323022e1131cb51ad8df7a0 ] + +According to I2S specs audio data is sampled on the rising edge of the +clock and it can change on the falling one. When operating in normal mode +this SoC behaves the opposite so a clock polarity inversion is required +in this case. + +This was tested on an OdroidC2 (Amlogic S905 SoC) board. + +Signed-off-by: Valerio Setti +Reviewed-by: Jerome Brunet +Tested-by: Jerome Brunet +Link: https://patch.msgid.link/20251007-fix-i2s-polarity-v1-1-86704d9cda10@baylibre.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/meson/aiu-encoder-i2s.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/meson/aiu-encoder-i2s.c b/sound/soc/meson/aiu-encoder-i2s.c +index a0dd914c8ed13..3b4061508c180 100644 +--- a/sound/soc/meson/aiu-encoder-i2s.c ++++ b/sound/soc/meson/aiu-encoder-i2s.c +@@ -236,8 +236,12 @@ static int aiu_encoder_i2s_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) + inv == SND_SOC_DAIFMT_IB_IF) + val |= AIU_CLK_CTRL_LRCLK_INVERT; + +- if (inv == SND_SOC_DAIFMT_IB_NF || +- inv == SND_SOC_DAIFMT_IB_IF) ++ /* ++ * The SoC changes data on the rising edge of the bitclock ++ * so an inversion of the bitclock is required in normal mode ++ */ ++ if (inv == SND_SOC_DAIFMT_NB_NF || ++ inv == SND_SOC_DAIFMT_NB_IF) + val |= AIU_CLK_CTRL_AOCLK_INVERT; + + /* Signal skew */ +@@ -328,4 +332,3 @@ const struct snd_soc_dai_ops aiu_encoder_i2s_dai_ops = { + .startup = aiu_encoder_i2s_startup, + .shutdown = aiu_encoder_i2s_shutdown, + }; +- +-- +2.51.0 + diff --git a/queue-6.6/ceph-add-checking-of-wait_for_completion_killable-re.patch b/queue-6.6/ceph-add-checking-of-wait_for_completion_killable-re.patch new file mode 100644 index 0000000000..4842c300d8 --- /dev/null +++ b/queue-6.6/ceph-add-checking-of-wait_for_completion_killable-re.patch @@ -0,0 +1,50 @@ +From 2e395d8ff33296c1035448045d0403bf934bcf97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jun 2025 12:04:32 -0700 +Subject: ceph: add checking of wait_for_completion_killable() return value + +From: Viacheslav Dubeyko + +[ Upstream commit b7ed1e29cfe773d648ca09895b92856bd3a2092d ] + +The Coverity Scan service has detected the calling of +wait_for_completion_killable() without checking the return +value in ceph_lock_wait_for_completion() [1]. The CID 1636232 +defect contains explanation: "If the function returns an error +value, the error value may be mistaken for a normal value. +In ceph_lock_wait_for_completion(): Value returned from +a function is not checked for errors before being used. (CWE-252)". + +The patch adds the checking of wait_for_completion_killable() +return value and return the error code from +ceph_lock_wait_for_completion(). + +[1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1636232 + +Signed-off-by: Viacheslav Dubeyko +Reviewed-by: Alex Markuze +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/locks.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c +index cb51c7e9c8e22..02f5fbe83aa46 100644 +--- a/fs/ceph/locks.c ++++ b/fs/ceph/locks.c +@@ -219,7 +219,10 @@ static int ceph_lock_wait_for_completion(struct ceph_mds_client *mdsc, + if (err && err != -ERESTARTSYS) + return err; + +- wait_for_completion_killable(&req->r_safe_completion); ++ err = wait_for_completion_killable(&req->r_safe_completion); ++ if (err) ++ return err; ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.6/ceph-refactor-wake_up_bit-pattern-of-calling.patch b/queue-6.6/ceph-refactor-wake_up_bit-pattern-of-calling.patch new file mode 100644 index 0000000000..10421b0501 --- /dev/null +++ b/queue-6.6/ceph-refactor-wake_up_bit-pattern-of-calling.patch @@ -0,0 +1,78 @@ +From a53e88947ee2cc9f2c36b8d7c35e8f6765eb07c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Jul 2025 12:20:57 -0700 +Subject: ceph: refactor wake_up_bit() pattern of calling + +From: Viacheslav Dubeyko + +[ Upstream commit 53db6f25ee47cb1265141d31562604e56146919a ] + +The wake_up_bit() is called in ceph_async_unlink_cb(), +wake_async_create_waiters(), and ceph_finish_async_create(). +It makes sense to switch on clear_bit() function, because +it makes the code much cleaner and easier to understand. +More important rework is the adding of smp_mb__after_atomic() +memory barrier after the bit modification and before +wake_up_bit() call. It can prevent potential race condition +of accessing the modified bit in other threads. Luckily, +clear_and_wake_up_bit() already implements the required +functionality pattern: + +static inline void clear_and_wake_up_bit(int bit, unsigned long *word) +{ + clear_bit_unlock(bit, word); + /* See wake_up_bit() for which memory barrier you need to use. */ + smp_mb__after_atomic(); + wake_up_bit(word, bit); +} + +Signed-off-by: Viacheslav Dubeyko +Reviewed-by: Alex Markuze +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/dir.c | 3 +-- + fs/ceph/file.c | 6 ++---- + 2 files changed, 3 insertions(+), 6 deletions(-) + +diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c +index 1395b71df5ccc..529dd07fa459f 100644 +--- a/fs/ceph/dir.c ++++ b/fs/ceph/dir.c +@@ -1213,8 +1213,7 @@ static void ceph_async_unlink_cb(struct ceph_mds_client *mdsc, + spin_unlock(&fsc->async_unlink_conflict_lock); + + spin_lock(&dentry->d_lock); +- di->flags &= ~CEPH_DENTRY_ASYNC_UNLINK; +- wake_up_bit(&di->flags, CEPH_DENTRY_ASYNC_UNLINK_BIT); ++ clear_and_wake_up_bit(CEPH_DENTRY_ASYNC_UNLINK_BIT, &di->flags); + spin_unlock(&dentry->d_lock); + + synchronize_rcu(); +diff --git a/fs/ceph/file.c b/fs/ceph/file.c +index e12657b4c3e04..0ec78d87519ba 100644 +--- a/fs/ceph/file.c ++++ b/fs/ceph/file.c +@@ -539,8 +539,7 @@ static void wake_async_create_waiters(struct inode *inode, + + spin_lock(&ci->i_ceph_lock); + if (ci->i_ceph_flags & CEPH_I_ASYNC_CREATE) { +- ci->i_ceph_flags &= ~CEPH_I_ASYNC_CREATE; +- wake_up_bit(&ci->i_ceph_flags, CEPH_ASYNC_CREATE_BIT); ++ clear_and_wake_up_bit(CEPH_ASYNC_CREATE_BIT, &ci->i_ceph_flags); + + if (ci->i_ceph_flags & CEPH_I_ASYNC_CHECK_CAPS) { + ci->i_ceph_flags &= ~CEPH_I_ASYNC_CHECK_CAPS; +@@ -716,8 +715,7 @@ static int ceph_finish_async_create(struct inode *dir, struct inode *inode, + } + + spin_lock(&dentry->d_lock); +- di->flags &= ~CEPH_DENTRY_ASYNC_CREATE; +- wake_up_bit(&di->flags, CEPH_DENTRY_ASYNC_CREATE_BIT); ++ clear_and_wake_up_bit(CEPH_DENTRY_ASYNC_CREATE_BIT, &di->flags); + spin_unlock(&dentry->d_lock); + + return ret; +-- +2.51.0 + diff --git a/queue-6.6/clk-at91-clk-master-add-check-for-divide-by-3.patch b/queue-6.6/clk-at91-clk-master-add-check-for-divide-by-3.patch new file mode 100644 index 0000000000..52a8bbdbcc --- /dev/null +++ b/queue-6.6/clk-at91-clk-master-add-check-for-divide-by-3.patch @@ -0,0 +1,38 @@ +From fe01e8bc6b6361de36e05905fdc1b7913c940195 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 13:07:17 -0700 +Subject: clk: at91: clk-master: Add check for divide by 3 + +From: Ryan Wanner + +[ Upstream commit e0237f5635727d64635ec6665e1de9f4cacce35c ] + +A potential divider for the master clock is div/3. The register +configuration for div/3 is MASTER_PRES_MAX. The current bit shifting +method does not work for this case. Checking for MASTER_PRES_MAX will +ensure the correct decimal value is stored in the system. + +Signed-off-by: Ryan Wanner +Signed-off-by: Nicolas Ferre +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/clk-master.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/clk/at91/clk-master.c b/drivers/clk/at91/clk-master.c +index 15c46489ba850..4c87a0f789de1 100644 +--- a/drivers/clk/at91/clk-master.c ++++ b/drivers/clk/at91/clk-master.c +@@ -580,6 +580,9 @@ clk_sama7g5_master_recalc_rate(struct clk_hw *hw, + { + struct clk_master *master = to_clk_master(hw); + ++ if (master->div == MASTER_PRES_MAX) ++ return DIV_ROUND_CLOSEST_ULL(parent_rate, 3); ++ + return DIV_ROUND_CLOSEST_ULL(parent_rate, (1 << master->div)); + } + +-- +2.51.0 + diff --git a/queue-6.6/clk-at91-clk-sam9x60-pll-force-write-to-pll_updt-reg.patch b/queue-6.6/clk-at91-clk-sam9x60-pll-force-write-to-pll_updt-reg.patch new file mode 100644 index 0000000000..6a5d6ac435 --- /dev/null +++ b/queue-6.6/clk-at91-clk-sam9x60-pll-force-write-to-pll_updt-reg.patch @@ -0,0 +1,214 @@ +From 82a78d137bfe7286ce4c44f88f30ff71af7ee3e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 17:08:10 +0200 +Subject: clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register + +From: Nicolas Ferre + +[ Upstream commit af98caeaa7b6ad11eb7b7c8bfaddc769df2889f3 ] + +This register is important for sequencing the commands to PLLs, so +actually write the update bits with regmap_write_bits() instead of +relying on a read/modify/write regmap command that could skip the actual +hardware write if the value is identical to the one read. + +It's changed when modification is needed to the PLL, when +read-only operation is done, we could keep the call to +regmap_update_bits(). + +Add a comment to the sam9x60_div_pll_set_div() function that uses this +PLL_UPDT register so that it's used consistently, according to the +product's datasheet. + +Signed-off-by: Nicolas Ferre +Tested-by: Ryan Wanner # on sama7d65 and sam9x75 +Link: https://lore.kernel.org/r/20250827150811.82496-1-nicolas.ferre@microchip.com +[claudiu.beznea: fix "Alignment should match open parenthesis" + checkpatch.pl check] +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/clk-sam9x60-pll.c | 75 ++++++++++++++++-------------- + 1 file changed, 39 insertions(+), 36 deletions(-) + +diff --git a/drivers/clk/at91/clk-sam9x60-pll.c b/drivers/clk/at91/clk-sam9x60-pll.c +index ff65f7b916f07..57d7aef1ea865 100644 +--- a/drivers/clk/at91/clk-sam9x60-pll.c ++++ b/drivers/clk/at91/clk-sam9x60-pll.c +@@ -90,8 +90,8 @@ static int sam9x60_frac_pll_set(struct sam9x60_pll_core *core) + + spin_lock_irqsave(core->lock, flags); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_ID_MSK, core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_ID_MSK, core->id); + regmap_read(regmap, AT91_PMC_PLL_CTRL1, &val); + cmul = (val & core->layout->mul_mask) >> core->layout->mul_shift; + cfrac = (val & core->layout->frac_mask) >> core->layout->frac_shift; +@@ -125,17 +125,17 @@ static int sam9x60_frac_pll_set(struct sam9x60_pll_core *core) + udelay(10); + } + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, + AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL, + AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + while (!sam9x60_pll_ready(regmap, core->id)) + cpu_relax(); +@@ -161,8 +161,8 @@ static void sam9x60_frac_pll_unprepare(struct clk_hw *hw) + + spin_lock_irqsave(core->lock, flags); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_ID_MSK, core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_ID_MSK, core->id); + + regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, AT91_PMC_PLL_CTRL0_ENPLL, 0); + +@@ -170,9 +170,9 @@ static void sam9x60_frac_pll_unprepare(struct clk_hw *hw) + regmap_update_bits(regmap, AT91_PMC_PLL_ACR, + AT91_PMC_PLL_ACR_UTMIBG | AT91_PMC_PLL_ACR_UTMIVR, 0); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + spin_unlock_irqrestore(core->lock, flags); + } +@@ -257,8 +257,8 @@ static int sam9x60_frac_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate, + + spin_lock_irqsave(core->lock, irqflags); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, +- core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, ++ core->id); + regmap_read(regmap, AT91_PMC_PLL_CTRL1, &val); + cmul = (val & core->layout->mul_mask) >> core->layout->mul_shift; + cfrac = (val & core->layout->frac_mask) >> core->layout->frac_shift; +@@ -270,18 +270,18 @@ static int sam9x60_frac_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate, + (frac->mul << core->layout->mul_shift) | + (frac->frac << core->layout->frac_shift)); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, + AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL, + AT91_PMC_PLL_CTRL0_ENLOCK | + AT91_PMC_PLL_CTRL0_ENPLL); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + while (!sam9x60_pll_ready(regmap, core->id)) + cpu_relax(); +@@ -333,7 +333,10 @@ static const struct clk_ops sam9x60_frac_pll_ops_chg = { + .restore_context = sam9x60_frac_pll_restore_context, + }; + +-/* This function should be called with spinlock acquired. */ ++/* This function should be called with spinlock acquired. ++ * Warning: this function must be called only if the same PLL ID was set in ++ * PLL_UPDT register previously. ++ */ + static void sam9x60_div_pll_set_div(struct sam9x60_pll_core *core, u32 div, + bool enable) + { +@@ -345,9 +348,9 @@ static void sam9x60_div_pll_set_div(struct sam9x60_pll_core *core, u32 div, + core->layout->div_mask | ena_msk, + (div << core->layout->div_shift) | ena_val); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + while (!sam9x60_pll_ready(regmap, core->id)) + cpu_relax(); +@@ -361,8 +364,8 @@ static int sam9x60_div_pll_set(struct sam9x60_pll_core *core) + unsigned int val, cdiv; + + spin_lock_irqsave(core->lock, flags); +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_ID_MSK, core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_ID_MSK, core->id); + regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val); + cdiv = (val & core->layout->div_mask) >> core->layout->div_shift; + +@@ -393,15 +396,15 @@ static void sam9x60_div_pll_unprepare(struct clk_hw *hw) + + spin_lock_irqsave(core->lock, flags); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_ID_MSK, core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_ID_MSK, core->id); + + regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, + core->layout->endiv_mask, 0); + +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, +- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, +- AT91_PMC_PLL_UPDT_UPDATE | core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, ++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, ++ AT91_PMC_PLL_UPDT_UPDATE | core->id); + + spin_unlock_irqrestore(core->lock, flags); + } +@@ -507,8 +510,8 @@ static int sam9x60_div_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate, + div->div = DIV_ROUND_CLOSEST(parent_rate, rate) - 1; + + spin_lock_irqsave(core->lock, irqflags); +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, +- core->id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, ++ core->id); + regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val); + cdiv = (val & core->layout->div_mask) >> core->layout->div_shift; + +@@ -563,8 +566,8 @@ static int sam9x60_div_pll_notifier_fn(struct notifier_block *notifier, + div->div = div->safe_div; + + spin_lock_irqsave(core.lock, irqflags); +- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, +- core.id); ++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, ++ core.id); + regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val); + cdiv = (val & core.layout->div_mask) >> core.layout->div_shift; + +-- +2.51.0 + diff --git a/queue-6.6/clk-sunxi-ng-sun6i-rtc-add-a523-specifics.patch b/queue-6.6/clk-sunxi-ng-sun6i-rtc-add-a523-specifics.patch new file mode 100644 index 0000000000..ae27041037 --- /dev/null +++ b/queue-6.6/clk-sunxi-ng-sun6i-rtc-add-a523-specifics.patch @@ -0,0 +1,57 @@ +From ab5291ea1d7daa4a0a26e86dd255e68440f260fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 01:09:47 +0800 +Subject: clk: sunxi-ng: sun6i-rtc: Add A523 specifics + +From: Chen-Yu Tsai + +[ Upstream commit 7aa8781f379c32c31bd78f1408a31765b2297c43 ] + +The A523's RTC block is backward compatible with the R329's, but it also +has a calibration function for its internal oscillator, which would +allow it to provide a clock rate closer to the desired 32.768 KHz. This +is useful on the Radxa Cubie A5E, which does not have an external 32.768 +KHz crystal. + +Add new compatible-specific data for it. + +Acked-by: Jernej Skrabec +Link: https://patch.msgid.link/20250909170947.2221611-1-wens@kernel.org +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi-ng/ccu-sun6i-rtc.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c b/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c +index fdc8ccc586c99..ec1717ddaf275 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c ++++ b/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c +@@ -325,6 +325,13 @@ static const struct sun6i_rtc_match_data sun50i_r329_rtc_ccu_data = { + .osc32k_fanout_nparents = ARRAY_SIZE(sun50i_r329_osc32k_fanout_parents), + }; + ++static const struct sun6i_rtc_match_data sun55i_a523_rtc_ccu_data = { ++ .have_ext_osc32k = true, ++ .have_iosc_calibration = true, ++ .osc32k_fanout_parents = sun50i_r329_osc32k_fanout_parents, ++ .osc32k_fanout_nparents = ARRAY_SIZE(sun50i_r329_osc32k_fanout_parents), ++}; ++ + static const struct of_device_id sun6i_rtc_ccu_match[] = { + { + .compatible = "allwinner,sun50i-h616-rtc", +@@ -334,6 +341,10 @@ static const struct of_device_id sun6i_rtc_ccu_match[] = { + .compatible = "allwinner,sun50i-r329-rtc", + .data = &sun50i_r329_rtc_ccu_data, + }, ++ { ++ .compatible = "allwinner,sun55i-a523-rtc", ++ .data = &sun55i_a523_rtc_ccu_data, ++ }, + {}, + }; + +-- +2.51.0 + diff --git a/queue-6.6/clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch b/queue-6.6/clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch new file mode 100644 index 0000000000..fd3720203c --- /dev/null +++ b/queue-6.6/clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch @@ -0,0 +1,44 @@ +From cc4b70d8c848ad608309101382ed1e3be5b087a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 16:08:11 +0200 +Subject: clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled + +From: Matthias Schiffer + +[ Upstream commit 1e0d75258bd09323cb452655549e03975992b29e ] + +As described in AM335x Errata Advisory 1.0.42, WKUP_DEBUGSS_CLKCTRL +can't be disabled - the clock module will just be stuck in transitioning +state forever, resulting in the following warning message after the wait +loop times out: + + l3-aon-clkctrl:0000:0: failed to disable + +Just add the clock to enable_init_clks, so no attempt is made to disable +it. + +Signed-off-by: Matthias Schiffer +Signed-off-by: Alexander Stein +Acked-by: Kevin Hilman +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/ti/clk-33xx.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/ti/clk-33xx.c b/drivers/clk/ti/clk-33xx.c +index 85c50ea39e6da..9269e6a0db6a4 100644 +--- a/drivers/clk/ti/clk-33xx.c ++++ b/drivers/clk/ti/clk-33xx.c +@@ -258,6 +258,8 @@ static const char *enable_init_clks[] = { + "dpll_ddr_m2_ck", + "dpll_mpu_m2_ck", + "l3_gclk", ++ /* WKUP_DEBUGSS_CLKCTRL - disable fails, AM335x Errata Advisory 1.0.42 */ ++ "l3-aon-clkctrl:0000:0", + /* AM3_L3_L3_MAIN_CLKCTRL, needed during suspend */ + "l3-clkctrl:00bc:0", + "l4hs_gclk", +-- +2.51.0 + diff --git a/queue-6.6/cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch b/queue-6.6/cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch new file mode 100644 index 0000000000..f05abd6401 --- /dev/null +++ b/queue-6.6/cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch @@ -0,0 +1,102 @@ +From 3da1b7547eca4caa55b68a7ec848179577adfa9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 21:48:13 -0500 +Subject: cpufreq: tegra186: Initialize all cores to max frequencies + +From: Aaron Kling + +[ Upstream commit ba6018929165fc914c665f071f8e8cdbac844a49 ] + +During initialization, the EDVD_COREx_VOLT_FREQ registers for some cores +are still at reset values and not reflecting the actual frequency. This +causes get calls to fail. Set all cores to their respective max +frequency during probe to initialize the registers to working values. + +Suggested-by: Mikko Perttunen +Signed-off-by: Aaron Kling +Reviewed-by: Mikko Perttunen +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/tegra186-cpufreq.c | 27 +++++++++++++++++++++------ + 1 file changed, 21 insertions(+), 6 deletions(-) + +diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c +index 39186008afbfd..233c82a834086 100644 +--- a/drivers/cpufreq/tegra186-cpufreq.c ++++ b/drivers/cpufreq/tegra186-cpufreq.c +@@ -132,13 +132,14 @@ static struct cpufreq_driver tegra186_cpufreq_driver = { + + static struct cpufreq_frequency_table *init_vhint_table( + struct platform_device *pdev, struct tegra_bpmp *bpmp, +- struct tegra186_cpufreq_cluster *cluster, unsigned int cluster_id) ++ struct tegra186_cpufreq_cluster *cluster, unsigned int cluster_id, ++ int *num_rates) + { + struct cpufreq_frequency_table *table; + struct mrq_cpu_vhint_request req; + struct tegra_bpmp_message msg; + struct cpu_vhint_data *data; +- int err, i, j, num_rates = 0; ++ int err, i, j; + dma_addr_t phys; + void *virt; + +@@ -168,6 +169,7 @@ static struct cpufreq_frequency_table *init_vhint_table( + goto free; + } + ++ *num_rates = 0; + for (i = data->vfloor; i <= data->vceil; i++) { + u16 ndiv = data->ndiv[i]; + +@@ -178,10 +180,10 @@ static struct cpufreq_frequency_table *init_vhint_table( + if (i > 0 && ndiv == data->ndiv[i - 1]) + continue; + +- num_rates++; ++ (*num_rates)++; + } + +- table = devm_kcalloc(&pdev->dev, num_rates + 1, sizeof(*table), ++ table = devm_kcalloc(&pdev->dev, *num_rates + 1, sizeof(*table), + GFP_KERNEL); + if (!table) { + table = ERR_PTR(-ENOMEM); +@@ -223,7 +225,9 @@ static int tegra186_cpufreq_probe(struct platform_device *pdev) + { + struct tegra186_cpufreq_data *data; + struct tegra_bpmp *bpmp; +- unsigned int i = 0, err; ++ unsigned int i = 0, err, edvd_offset; ++ int num_rates = 0; ++ u32 edvd_val, cpu; + + data = devm_kzalloc(&pdev->dev, + struct_size(data, clusters, TEGRA186_NUM_CLUSTERS), +@@ -246,10 +250,21 @@ static int tegra186_cpufreq_probe(struct platform_device *pdev) + for (i = 0; i < TEGRA186_NUM_CLUSTERS; i++) { + struct tegra186_cpufreq_cluster *cluster = &data->clusters[i]; + +- cluster->table = init_vhint_table(pdev, bpmp, cluster, i); ++ cluster->table = init_vhint_table(pdev, bpmp, cluster, i, &num_rates); + if (IS_ERR(cluster->table)) { + err = PTR_ERR(cluster->table); + goto put_bpmp; ++ } else if (!num_rates) { ++ err = -EINVAL; ++ goto put_bpmp; ++ } ++ ++ for (cpu = 0; cpu < ARRAY_SIZE(tegra186_cpus); cpu++) { ++ if (data->cpus[cpu].bpmp_cluster_id == i) { ++ edvd_val = cluster->table[num_rates - 1].driver_data; ++ edvd_offset = data->cpus[cpu].edvd_offset; ++ writel(edvd_val, data->regs + edvd_offset); ++ } + } + } + +-- +2.51.0 + diff --git a/queue-6.6/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch b/queue-6.6/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch new file mode 100644 index 0000000000..8f55c13b24 --- /dev/null +++ b/queue-6.6/fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch @@ -0,0 +1,69 @@ +From 1e22afcf5d8eb387a89f16144ee9a46c04552684 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 03:32:09 -0400 +Subject: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds + +From: Albin Babu Varghese + +[ Upstream commit 3637d34b35b287ab830e66048841ace404382b67 ] + +Add bounds checking to prevent writes past framebuffer boundaries when +rendering text near screen edges. Return early if the Y position is off-screen +and clip image height to screen boundary. Break from the rendering loop if the +X position is off-screen. When clipping image width to fit the screen, update +the character count to match the clipped width to prevent buffer size +mismatches. + +Without the character count update, bit_putcs_aligned and bit_putcs_unaligned +receive mismatched parameters where the buffer is allocated for the clipped +width but cnt reflects the original larger count, causing out-of-bounds writes. + +Reported-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190 +Suggested-by: Helge Deller +Tested-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com +Signed-off-by: Albin Babu Varghese +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/core/bitblit.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c +index a4b4e1ec702e5..8563264d11fac 100644 +--- a/drivers/video/fbdev/core/bitblit.c ++++ b/drivers/video/fbdev/core/bitblit.c +@@ -168,6 +168,11 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, + image.height = vc->vc_font.height; + image.depth = 1; + ++ if (image.dy >= info->var.yres) ++ return; ++ ++ image.height = min(image.height, info->var.yres - image.dy); ++ + if (attribute) { + buf = kmalloc(cellsize, GFP_ATOMIC); + if (!buf) +@@ -181,6 +186,18 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, + cnt = count; + + image.width = vc->vc_font.width * cnt; ++ ++ if (image.dx >= info->var.xres) ++ break; ++ ++ if (image.dx + image.width > info->var.xres) { ++ image.width = info->var.xres - image.dx; ++ cnt = image.width / vc->vc_font.width; ++ if (cnt == 0) ++ break; ++ image.width = cnt * vc->vc_font.width; ++ } ++ + pitch = DIV_ROUND_UP(image.width, 8) + scan_align; + pitch &= ~scan_align; + size = pitch * image.height + buf_align; +-- +2.51.0 + diff --git a/queue-6.6/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch b/queue-6.6/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch new file mode 100644 index 0000000000..ac5fab2a00 --- /dev/null +++ b/queue-6.6/fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch @@ -0,0 +1,97 @@ +From ff83b707f16c2d901188f3e7e8e0d1a06c50676a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 May 2025 20:44:34 -0500 +Subject: fs/hpfs: Fix error code for new_inode() failure in + mkdir/create/mknod/symlink + +From: Yikang Yue + +[ Upstream commit 32058c38d3b79a28963a59ac0353644dc24775cd ] + +The function call new_inode() is a primitive for allocating an inode in memory, +rather than planning disk space for it. Therefore, -ENOMEM should be returned +as the error code rather than -ENOSPC. + +To be specific, new_inode()'s call path looks like this: +new_inode + new_inode_pseudo + alloc_inode + ops->alloc_inode (hpfs_alloc_inode) + alloc_inode_sb + kmem_cache_alloc_lru + +Therefore, the failure of new_inode() indicates a memory presure issue (-ENOMEM), +not a lack of disk space. However, the current implementation of +hpfs_mkdir/create/mknod/symlink incorrectly returns -ENOSPC when new_inode() fails. +This patch fix this by set err to -ENOMEM before the goto statement. + +BTW, we also noticed that other nested calls within these four functions, +like hpfs_alloc_f/dnode and hpfs_add_dirent, might also fail due to memory presure. +But similarly, only -ENOSPC is returned. Addressing these will involve code +modifications in other functions, and we plan to submit dedicated patches for these +issues in the future. For this patch, we focus on new_inode(). + +Signed-off-by: Yikang Yue +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + fs/hpfs/namei.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c +index f4eb8d6f59894..6cf17fe239c9a 100644 +--- a/fs/hpfs/namei.c ++++ b/fs/hpfs/namei.c +@@ -52,8 +52,10 @@ static int hpfs_mkdir(struct mnt_idmap *idmap, struct inode *dir, + dee.fnode = cpu_to_le32(fno); + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail2; ++ } + hpfs_init_inode(result); + result->i_ino = fno; + hpfs_i(result)->i_parent_dir = dir->i_ino; +@@ -153,9 +155,10 @@ static int hpfs_create(struct mnt_idmap *idmap, struct inode *dir, + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail1; +- ++ } + hpfs_init_inode(result); + result->i_ino = fno; + result->i_mode |= S_IFREG; +@@ -239,9 +242,10 @@ static int hpfs_mknod(struct mnt_idmap *idmap, struct inode *dir, + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail1; +- ++ } + hpfs_init_inode(result); + result->i_ino = fno; + hpfs_i(result)->i_parent_dir = dir->i_ino; +@@ -314,8 +318,10 @@ static int hpfs_symlink(struct mnt_idmap *idmap, struct inode *dir, + dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); + + result = new_inode(dir->i_sb); +- if (!result) ++ if (!result) { ++ err = -ENOMEM; + goto bail1; ++ } + result->i_ino = fno; + hpfs_init_inode(result); + hpfs_i(result)->i_parent_dir = dir->i_ino; +-- +2.51.0 + diff --git a/queue-6.6/kbuild-uapi-strip-comments-before-size-type-check.patch b/queue-6.6/kbuild-uapi-strip-comments-before-size-type-check.patch new file mode 100644 index 0000000000..e8bf548b0a --- /dev/null +++ b/queue-6.6/kbuild-uapi-strip-comments-before-size-type-check.patch @@ -0,0 +1,52 @@ +From ca49a2521e793856f13d2d5350ac47a9dc09abea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Oct 2025 14:33:42 +0200 +Subject: kbuild: uapi: Strip comments before size type check +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit 66128f4287b04aef4d4db9bf5035985ab51487d5 ] + +On m68k, check_sizetypes in headers_check reports: + + ./usr/include/asm/bootinfo-amiga.h:17: found __[us]{8,16,32,64} type without #include + +This header file does not use any of the Linux-specific integer types, +but merely refers to them from comments, so this is a false positive. +As of commit c3a9d74ee413bdb3 ("kbuild: uapi: upgrade check_sizetypes() +warning to error"), this check was promoted to an error, breaking m68k +all{mod,yes}config builds. + +Fix this by stripping simple comments before looking for Linux-specific +integer types. + +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Thomas Weißschuh +Link: https://patch.msgid.link/949f096337e28d50510e970ae3ba3ec9c1342ec0.1759753998.git.geert@linux-m68k.org +[nathan: Adjust comment and remove unnecessary escaping from slashes in + regex] +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + usr/include/headers_check.pl | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/usr/include/headers_check.pl b/usr/include/headers_check.pl +index b6aec5e4365f9..682980781eb37 100755 +--- a/usr/include/headers_check.pl ++++ b/usr/include/headers_check.pl +@@ -160,6 +160,8 @@ sub check_sizetypes + if (my $included = ($line =~ /^\s*#\s*include\s+[<"](\S+)[>"]/)[0]) { + check_include_typesh($included); + } ++ # strip single-line comments, as types may be referenced within them ++ $line =~ s@/\*.*?\*/@@; + if ($line =~ m/__[us](8|16|32|64)\b/) { + printf STDERR "$filename:$lineno: " . + "found __[us]{8,16,32,64} type " . +-- +2.51.0 + diff --git a/queue-6.6/ntb-epf-allow-arbitrary-bar-mapping.patch b/queue-6.6/ntb-epf-allow-arbitrary-bar-mapping.patch new file mode 100644 index 0000000000..b25fd5bc40 --- /dev/null +++ b/queue-6.6/ntb-epf-allow-arbitrary-bar-mapping.patch @@ -0,0 +1,246 @@ +From 98241f439f89a46df9d86d1b04716dd6a6d30cc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Jul 2025 18:48:33 +0200 +Subject: NTB: epf: Allow arbitrary BAR mapping + +From: Jerome Brunet + +[ Upstream commit 5ad865862a0fd349163243e1834ed98ba9b81905 ] + +The NTB epf host driver assumes the BAR number associated with a memory +window is just incremented from the BAR number associated with MW1. This +seems to have been enough so far but this is not really how the endpoint +side work and the two could easily become mis-aligned. + +ntb_epf_mw_to_bar() even assumes that the BAR number is the memory window +index + 2, which means the function only returns a proper result if BAR_2 +is associated with MW1. + +Instead, fully describe and allow arbitrary NTB BAR mapping. + +Signed-off-by: Jerome Brunet +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/hw/epf/ntb_hw_epf.c | 103 ++++++++++++++++---------------- + 1 file changed, 53 insertions(+), 50 deletions(-) + +diff --git a/drivers/ntb/hw/epf/ntb_hw_epf.c b/drivers/ntb/hw/epf/ntb_hw_epf.c +index b640aa0bf45e6..5e79cfce8649c 100644 +--- a/drivers/ntb/hw/epf/ntb_hw_epf.c ++++ b/drivers/ntb/hw/epf/ntb_hw_epf.c +@@ -49,6 +49,7 @@ + #define NTB_EPF_COMMAND_TIMEOUT 1000 /* 1 Sec */ + + enum pci_barno { ++ NO_BAR = -1, + BAR_0, + BAR_1, + BAR_2, +@@ -57,16 +58,26 @@ enum pci_barno { + BAR_5, + }; + ++enum epf_ntb_bar { ++ BAR_CONFIG, ++ BAR_PEER_SPAD, ++ BAR_DB, ++ BAR_MW1, ++ BAR_MW2, ++ BAR_MW3, ++ BAR_MW4, ++ NTB_BAR_NUM, ++}; ++ ++#define NTB_EPF_MAX_MW_COUNT (NTB_BAR_NUM - BAR_MW1) ++ + struct ntb_epf_dev { + struct ntb_dev ntb; + struct device *dev; + /* Mutex to protect providing commands to NTB EPF */ + struct mutex cmd_lock; + +- enum pci_barno ctrl_reg_bar; +- enum pci_barno peer_spad_reg_bar; +- enum pci_barno db_reg_bar; +- enum pci_barno mw_bar; ++ const enum pci_barno *barno_map; + + unsigned int mw_count; + unsigned int spad_count; +@@ -85,17 +96,6 @@ struct ntb_epf_dev { + + #define ntb_ndev(__ntb) container_of(__ntb, struct ntb_epf_dev, ntb) + +-struct ntb_epf_data { +- /* BAR that contains both control region and self spad region */ +- enum pci_barno ctrl_reg_bar; +- /* BAR that contains peer spad region */ +- enum pci_barno peer_spad_reg_bar; +- /* BAR that contains Doorbell region and Memory window '1' */ +- enum pci_barno db_reg_bar; +- /* BAR that contains memory windows*/ +- enum pci_barno mw_bar; +-}; +- + static int ntb_epf_send_command(struct ntb_epf_dev *ndev, u32 command, + u32 argument) + { +@@ -144,7 +144,7 @@ static int ntb_epf_mw_to_bar(struct ntb_epf_dev *ndev, int idx) + return -EINVAL; + } + +- return idx + 2; ++ return ndev->barno_map[BAR_MW1 + idx]; + } + + static int ntb_epf_mw_count(struct ntb_dev *ntb, int pidx) +@@ -413,7 +413,9 @@ static int ntb_epf_mw_set_trans(struct ntb_dev *ntb, int pidx, int idx, + return -EINVAL; + } + +- bar = idx + ndev->mw_bar; ++ bar = ntb_epf_mw_to_bar(ndev, idx); ++ if (bar < 0) ++ return bar; + + mw_size = pci_resource_len(ntb->pdev, bar); + +@@ -455,7 +457,9 @@ static int ntb_epf_peer_mw_get_addr(struct ntb_dev *ntb, int idx, + if (idx == 0) + offset = readl(ndev->ctrl_reg + NTB_EPF_MW1_OFFSET); + +- bar = idx + ndev->mw_bar; ++ bar = ntb_epf_mw_to_bar(ndev, idx); ++ if (bar < 0) ++ return bar; + + if (base) + *base = pci_resource_start(ndev->ntb.pdev, bar) + offset; +@@ -560,6 +564,11 @@ static int ntb_epf_init_dev(struct ntb_epf_dev *ndev) + ndev->mw_count = readl(ndev->ctrl_reg + NTB_EPF_MW_COUNT); + ndev->spad_count = readl(ndev->ctrl_reg + NTB_EPF_SPAD_COUNT); + ++ if (ndev->mw_count > NTB_EPF_MAX_MW_COUNT) { ++ dev_err(dev, "Unsupported MW count: %u\n", ndev->mw_count); ++ return -EINVAL; ++ } ++ + return 0; + } + +@@ -596,14 +605,15 @@ static int ntb_epf_init_pci(struct ntb_epf_dev *ndev, + dev_warn(&pdev->dev, "Cannot DMA highmem\n"); + } + +- ndev->ctrl_reg = pci_iomap(pdev, ndev->ctrl_reg_bar, 0); ++ ndev->ctrl_reg = pci_iomap(pdev, ndev->barno_map[BAR_CONFIG], 0); + if (!ndev->ctrl_reg) { + ret = -EIO; + goto err_pci_regions; + } + +- if (ndev->peer_spad_reg_bar) { +- ndev->peer_spad_reg = pci_iomap(pdev, ndev->peer_spad_reg_bar, 0); ++ if (ndev->barno_map[BAR_PEER_SPAD] != ndev->barno_map[BAR_CONFIG]) { ++ ndev->peer_spad_reg = pci_iomap(pdev, ++ ndev->barno_map[BAR_PEER_SPAD], 0); + if (!ndev->peer_spad_reg) { + ret = -EIO; + goto err_pci_regions; +@@ -614,7 +624,7 @@ static int ntb_epf_init_pci(struct ntb_epf_dev *ndev, + ndev->peer_spad_reg = ndev->ctrl_reg + spad_off + spad_sz; + } + +- ndev->db_reg = pci_iomap(pdev, ndev->db_reg_bar, 0); ++ ndev->db_reg = pci_iomap(pdev, ndev->barno_map[BAR_DB], 0); + if (!ndev->db_reg) { + ret = -EIO; + goto err_pci_regions; +@@ -659,12 +669,7 @@ static void ntb_epf_cleanup_isr(struct ntb_epf_dev *ndev) + static int ntb_epf_pci_probe(struct pci_dev *pdev, + const struct pci_device_id *id) + { +- enum pci_barno peer_spad_reg_bar = BAR_1; +- enum pci_barno ctrl_reg_bar = BAR_0; +- enum pci_barno db_reg_bar = BAR_2; +- enum pci_barno mw_bar = BAR_2; + struct device *dev = &pdev->dev; +- struct ntb_epf_data *data; + struct ntb_epf_dev *ndev; + int ret; + +@@ -675,18 +680,10 @@ static int ntb_epf_pci_probe(struct pci_dev *pdev, + if (!ndev) + return -ENOMEM; + +- data = (struct ntb_epf_data *)id->driver_data; +- if (data) { +- peer_spad_reg_bar = data->peer_spad_reg_bar; +- ctrl_reg_bar = data->ctrl_reg_bar; +- db_reg_bar = data->db_reg_bar; +- mw_bar = data->mw_bar; +- } ++ ndev->barno_map = (const enum pci_barno *)id->driver_data; ++ if (!ndev->barno_map) ++ return -EINVAL; + +- ndev->peer_spad_reg_bar = peer_spad_reg_bar; +- ndev->ctrl_reg_bar = ctrl_reg_bar; +- ndev->db_reg_bar = db_reg_bar; +- ndev->mw_bar = mw_bar; + ndev->dev = dev; + + ntb_epf_init_struct(ndev, pdev); +@@ -730,30 +727,36 @@ static void ntb_epf_pci_remove(struct pci_dev *pdev) + ntb_epf_deinit_pci(ndev); + } + +-static const struct ntb_epf_data j721e_data = { +- .ctrl_reg_bar = BAR_0, +- .peer_spad_reg_bar = BAR_1, +- .db_reg_bar = BAR_2, +- .mw_bar = BAR_2, ++static const enum pci_barno j721e_map[NTB_BAR_NUM] = { ++ [BAR_CONFIG] = BAR_0, ++ [BAR_PEER_SPAD] = BAR_1, ++ [BAR_DB] = BAR_2, ++ [BAR_MW1] = BAR_2, ++ [BAR_MW2] = BAR_3, ++ [BAR_MW3] = BAR_4, ++ [BAR_MW4] = BAR_5 + }; + +-static const struct ntb_epf_data mx8_data = { +- .ctrl_reg_bar = BAR_0, +- .peer_spad_reg_bar = BAR_0, +- .db_reg_bar = BAR_2, +- .mw_bar = BAR_4, ++static const enum pci_barno mx8_map[NTB_BAR_NUM] = { ++ [BAR_CONFIG] = BAR_0, ++ [BAR_PEER_SPAD] = BAR_0, ++ [BAR_DB] = BAR_2, ++ [BAR_MW1] = BAR_4, ++ [BAR_MW2] = BAR_5, ++ [BAR_MW3] = NO_BAR, ++ [BAR_MW4] = NO_BAR + }; + + static const struct pci_device_id ntb_epf_pci_tbl[] = { + { + PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_J721E), + .class = PCI_CLASS_MEMORY_RAM << 8, .class_mask = 0xffff00, +- .driver_data = (kernel_ulong_t)&j721e_data, ++ .driver_data = (kernel_ulong_t)j721e_map, + }, + { + PCI_DEVICE(PCI_VENDOR_ID_FREESCALE, 0x0809), + .class = PCI_CLASS_MEMORY_RAM << 8, .class_mask = 0xffff00, +- .driver_data = (kernel_ulong_t)&mx8_data, ++ .driver_data = (kernel_ulong_t)mx8_map, + }, + { }, + }; +-- +2.51.0 + diff --git a/queue-6.6/rtc-pcf2127-clear-minute-second-interrupt.patch b/queue-6.6/rtc-pcf2127-clear-minute-second-interrupt.patch new file mode 100644 index 0000000000..1c2a307407 --- /dev/null +++ b/queue-6.6/rtc-pcf2127-clear-minute-second-interrupt.patch @@ -0,0 +1,70 @@ +From 592edabbfcff23df29cd441b983a21f9bb58457b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 19:54:09 +0200 +Subject: rtc: pcf2127: clear minute/second interrupt + +From: Josua Mayer + +[ Upstream commit a6f1a4f05970664004a9370459c6799c1b2f2dcf ] + +PCF2127 can generate interrupt every full second or minute configured +from control and status register 1, bits MI (1) and SI (0). + +On interrupt control register 2 bit MSF (7) is set and must be cleared +to continue normal operation. + +While the driver never enables this interrupt on its own, users or +firmware may do so - e.g. as an easy way to test the interrupt. + +Add preprocessor definition for MSF bit and include it in the irq +bitmask to ensure minute and second interrupts are cleared when fired. + +This fixes an issue where the rtc enters a test mode and becomes +unresponsive after a second interrupt has fired and is not cleared in +time. In this state register writes to control registers have no +effect and the interrupt line is kept asserted [1]: + +[1] userspace commands to put rtc into unresponsive state: +$ i2cget -f -y 2 0x51 0x00 +0x04 +$ i2cset -f -y 2 0x51 0x00 0x05 # set bit 0 SI +$ i2cget -f -y 2 0x51 0x00 +0x84 # bit 8 EXT_TEST set +$ i2cset -f -y 2 0x51 0x00 0x05 # try overwrite control register +$ i2cget -f -y 2 0x51 0x00 +0x84 # no change + +Signed-off-by: Josua Mayer +Reviewed-by: Bruno Thomsen +Link: https://lore.kernel.org/r/20250825-rtc-irq-v1-1-0133319406a7@solid-run.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-pcf2127.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c +index 502571f0c203f..e793c019fb9d7 100644 +--- a/drivers/rtc/rtc-pcf2127.c ++++ b/drivers/rtc/rtc-pcf2127.c +@@ -41,6 +41,7 @@ + #define PCF2127_BIT_CTRL2_AF BIT(4) + #define PCF2127_BIT_CTRL2_TSF2 BIT(5) + #define PCF2127_BIT_CTRL2_WDTF BIT(6) ++#define PCF2127_BIT_CTRL2_MSF BIT(7) + /* Control register 3 */ + #define PCF2127_REG_CTRL3 0x02 + #define PCF2127_BIT_CTRL3_BLIE BIT(0) +@@ -94,7 +95,8 @@ + #define PCF2127_CTRL2_IRQ_MASK ( \ + PCF2127_BIT_CTRL2_AF | \ + PCF2127_BIT_CTRL2_WDTF | \ +- PCF2127_BIT_CTRL2_TSF2) ++ PCF2127_BIT_CTRL2_TSF2 | \ ++ PCF2127_BIT_CTRL2_MSF) + + #define PCF2127_MAX_TS_SUPPORTED 4 + +-- +2.51.0 + diff --git a/queue-6.6/rtc-pcf2127-fix-watchdog-interrupt-mask-on-pcf2131.patch b/queue-6.6/rtc-pcf2127-fix-watchdog-interrupt-mask-on-pcf2131.patch new file mode 100644 index 0000000000..9101348d87 --- /dev/null +++ b/queue-6.6/rtc-pcf2127-fix-watchdog-interrupt-mask-on-pcf2131.patch @@ -0,0 +1,50 @@ +From d688e21d195ca8e543124e016cf4067b5ac09d7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 20:22:35 +0200 +Subject: rtc: pcf2127: fix watchdog interrupt mask on pcf2131 + +From: Bruno Thomsen + +[ Upstream commit 87064da2db7be537a7da20a25c18ba912c4db9e1 ] + +When using interrupt pin (INT A) as watchdog output all other +interrupt sources need to be disabled to avoid additional +resets. Resulting INT_A_MASK1 value is 55 (0x37). + +Signed-off-by: Bruno Thomsen +Link: https://lore.kernel.org/r/20250902182235.6825-1-bruno.thomsen@gmail.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-pcf2127.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c +index e793c019fb9d7..05a54f4d4d9a6 100644 +--- a/drivers/rtc/rtc-pcf2127.c ++++ b/drivers/rtc/rtc-pcf2127.c +@@ -528,6 +528,21 @@ static int pcf2127_watchdog_init(struct device *dev, struct pcf2127 *pcf2127) + set_bit(WDOG_HW_RUNNING, &pcf2127->wdd.status); + } + ++ /* ++ * When using interrupt pin (INT A) as watchdog output, only allow ++ * watchdog interrupt (PCF2131_BIT_INT_WD_CD) and disable (mask) all ++ * other interrupts. ++ */ ++ if (pcf2127->cfg->type == PCF2131) { ++ ret = regmap_write(pcf2127->regmap, ++ PCF2131_REG_INT_A_MASK1, ++ PCF2131_BIT_INT_BLIE | ++ PCF2131_BIT_INT_BIE | ++ PCF2131_BIT_INT_AIE | ++ PCF2131_BIT_INT_SI | ++ PCF2131_BIT_INT_MI); ++ } ++ + return devm_watchdog_register_device(dev, &pcf2127->wdd); + } + +-- +2.51.0 + diff --git a/queue-6.6/scsi-ufs-core-include-utp-error-in-int_fatal_errors.patch b/queue-6.6/scsi-ufs-core-include-utp-error-in-int_fatal_errors.patch new file mode 100644 index 0000000000..9441553154 --- /dev/null +++ b/queue-6.6/scsi-ufs-core-include-utp-error-in-int_fatal_errors.patch @@ -0,0 +1,77 @@ +From b8cb0c828d7e07e2865638218ac6b0365f260e97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 15:14:28 +0900 +Subject: scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS + +From: Hoyoung Seo + +[ Upstream commit 558ae4579810fa0fef011944230c65a6f3087f85 ] + +When a UTP error occurs in isolation, UFS is not currently recoverable. +This is because the UTP error is not considered fatal in the error +handling code, leading to either an I/O timeout or an OCS error. + +Add the UTP error flag to INT_FATAL_ERRORS so the controller will be +reset in this situation. + + sd 0:0:0:0: [sda] tag#38 UNKNOWN(0x2003) Result: hostbyte=0x07 + driverbyte=DRIVER_OK cmd_age=0s + sd 0:0:0:0: [sda] tag#38 CDB: opcode=0x28 28 00 00 51 24 e2 00 00 08 00 + I/O error, dev sda, sector 42542864 op 0x0:(READ) flags 0x80700 phys_seg + 8 prio class 2 + OCS error from controller = 9 for tag 39 + pa_err[1] = 0x80000010 at 2667224756 us + pa_err: total cnt=2 + dl_err[0] = 0x80000002 at 2667148060 us + dl_err[1] = 0x80002000 at 2667282844 us + No record of nl_err + No record of tl_err + No record of dme_err + No record of auto_hibern8_err + fatal_err[0] = 0x804 at 2667282836 us + + --------------------------------------------------- + REGISTER + --------------------------------------------------- + NAME OFFSET VALUE + STD HCI SFR 0xfffffff0 0x0 + AHIT 0x18 0x814 + INTERRUPT STATUS 0x20 0x1000 + INTERRUPT ENABLE 0x24 0x70ef5 + +[mkp: commit desc] + +Signed-off-by: Hoyoung Seo +Reviewed-by: Bart Van Assche +Message-Id: <20250930061428.617955-1-hy50.seo@samsung.com> +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + include/ufs/ufshci.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/include/ufs/ufshci.h b/include/ufs/ufshci.h +index ae93b30d25893..725437f02b1fa 100644 +--- a/include/ufs/ufshci.h ++++ b/include/ufs/ufshci.h +@@ -182,6 +182,7 @@ static inline u32 ufshci_version(u32 major, u32 minor) + #define UTP_TASK_REQ_COMPL 0x200 + #define UIC_COMMAND_COMPL 0x400 + #define DEVICE_FATAL_ERROR 0x800 ++#define UTP_ERROR 0x1000 + #define CONTROLLER_FATAL_ERROR 0x10000 + #define SYSTEM_BUS_FATAL_ERROR 0x20000 + #define CRYPTO_ENGINE_FATAL_ERROR 0x40000 +@@ -201,7 +202,8 @@ static inline u32 ufshci_version(u32 major, u32 minor) + CONTROLLER_FATAL_ERROR |\ + SYSTEM_BUS_FATAL_ERROR |\ + CRYPTO_ENGINE_FATAL_ERROR |\ +- UIC_LINK_LOST) ++ UIC_LINK_LOST |\ ++ UTP_ERROR) + + /* HCS - Host Controller Status 30h */ + #define DEVICE_PRESENT 0x1 +-- +2.51.0 + diff --git a/queue-6.6/series b/queue-6.6/series index bacdebfd15..54f685960a 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -304,3 +304,26 @@ rdma-irdma-set-irdma_cq-cq_num-field-during-cq-creat.patch rdma-hns-fix-the-modification-of-max_send_sge.patch rdma-hns-fix-wrong-wqe-data-when-qp-wraps-around.patch btrfs-mark-dirty-extent-range-for-out-of-bound-preal.patch +fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch +um-fix-help-message-for-ssl-non-raw.patch +clk-sunxi-ng-sun6i-rtc-add-a523-specifics.patch +rtc-pcf2127-clear-minute-second-interrupt.patch +arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch +clk-at91-clk-master-add-check-for-divide-by-3.patch +clk-at91-clk-sam9x60-pll-force-write-to-pll_updt-reg.patch +clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch +ntb-epf-allow-arbitrary-bar-mapping.patch +9p-fix-sys-fs-9p-caches-overwriting-itself.patch +cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch +9p-sysfs_init-don-t-hardcode-error-to-enomem.patch +scsi-ufs-core-include-utp-error-in-int_fatal_errors.patch +acpi-property-return-present-device-nodes-only-on-fw.patch +tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch +tools-lib-thermal-don-t-preserve-owner-in-install.patch +tools-lib-thermal-use-pkg-config-to-locate-libnl3.patch +fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch +rtc-pcf2127-fix-watchdog-interrupt-mask-on-pcf2131.patch +kbuild-uapi-strip-comments-before-size-type-check.patch +asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch +ceph-add-checking-of-wait_for_completion_killable-re.patch +ceph-refactor-wake_up_bit-pattern-of-calling.patch diff --git a/queue-6.6/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch b/queue-6.6/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch new file mode 100644 index 0000000000..79aff1adb3 --- /dev/null +++ b/queue-6.6/tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch @@ -0,0 +1,66 @@ +From acfc8b70d8a0b72c6f569a73862e410072fdeace Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 15:47:06 -0700 +Subject: tools bitmap: Add missing asm-generic/bitsperlong.h include +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ian Rogers + +[ Upstream commit f38ce0209ab4553906b44bd1159e35c740a84161 ] + +small_const_nbits is defined in asm-generic/bitsperlong.h which +bitmap.h uses but doesn't include causing build failures in some build +systems. Add the missing #include. + +Note the bitmap.h in tools has diverged from that of the kernel, so no +changes are made there. + +Signed-off-by: Ian Rogers +Acked-by: Yury Norov +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: André Almeida +Cc: Daniel Borkmann +Cc: Darren Hart +Cc: David S. Miller +Cc: Davidlohr Bueso +Cc: Ido Schimmel +Cc: Ingo Molnar +Cc: Jakub Kicinski +Cc: Jamal Hadi Salim +Cc: Jason Xing +Cc: Jiri Olsa +Cc: Jonas Gottlieb +Cc: Kan Liang +Cc: Mark Rutland +Cc: Maurice Lambert +Cc: Namhyung Kim +Cc: Paolo Abeni +Cc: Peter Zijlstra +Cc: Petr Machata +Cc: Rasmus Villemoes +Cc: Thomas Gleixner +Cc: Yuyang Huang +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/include/linux/bitmap.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/include/linux/bitmap.h b/tools/include/linux/bitmap.h +index 210c13b1b8570..926f3117d8e4f 100644 +--- a/tools/include/linux/bitmap.h ++++ b/tools/include/linux/bitmap.h +@@ -3,6 +3,7 @@ + #define _TOOLS_LINUX_BITMAP_H + + #include ++#include + #include + #include + #include +-- +2.51.0 + diff --git a/queue-6.6/tools-lib-thermal-don-t-preserve-owner-in-install.patch b/queue-6.6/tools-lib-thermal-don-t-preserve-owner-in-install.patch new file mode 100644 index 0000000000..4309a7dae5 --- /dev/null +++ b/queue-6.6/tools-lib-thermal-don-t-preserve-owner-in-install.patch @@ -0,0 +1,41 @@ +From 63c0d237ada4355700b6d4217f878558c88cb413 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 13:40:56 +0200 +Subject: tools: lib: thermal: don't preserve owner in install + +From: Emil Dahl Juhl + +[ Upstream commit 1375152bb02ab2a8435e87ea27034482dbc95f57 ] + +Instead of preserving mode, timestamp, and owner, for the object files +during installation, just preserve the mode and timestamp. + +When installing as root, the installed files should be owned by root. +When installing as user, --preserve=ownership doesn't work anyway. This +makes --preserve=ownership rather pointless. + +Signed-off-by: Emil Dahl Juhl +Signed-off-by: Sascha Hauer +Acked-by: Daniel Lezcano +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + tools/lib/thermal/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/thermal/Makefile b/tools/lib/thermal/Makefile +index 8890fd57b110c..1694889847caf 100644 +--- a/tools/lib/thermal/Makefile ++++ b/tools/lib/thermal/Makefile +@@ -147,7 +147,7 @@ endef + install_lib: libs + $(call QUIET_INSTALL, $(LIBTHERMAL_ALL)) \ + $(call do_install_mkdir,$(libdir_SQ)); \ +- cp -fpR $(LIBTHERMAL_ALL) $(DESTDIR)$(libdir_SQ) ++ cp -fR --preserve=mode,timestamp $(LIBTHERMAL_ALL) $(DESTDIR)$(libdir_SQ) + + install_headers: + $(call QUIET_INSTALL, headers) \ +-- +2.51.0 + diff --git a/queue-6.6/tools-lib-thermal-use-pkg-config-to-locate-libnl3.patch b/queue-6.6/tools-lib-thermal-use-pkg-config-to-locate-libnl3.patch new file mode 100644 index 0000000000..3b7ca8a475 --- /dev/null +++ b/queue-6.6/tools-lib-thermal-use-pkg-config-to-locate-libnl3.patch @@ -0,0 +1,49 @@ +From 6ec5597c90b732401168f56227f4f6968466bb77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 13:40:55 +0200 +Subject: tools: lib: thermal: use pkg-config to locate libnl3 + +From: Sascha Hauer + +[ Upstream commit b31f7f725cd932e2c2b41f3e4b66273653953687 ] + +To make libthermal more cross compile friendly use pkg-config to locate +libnl3. Only if that fails fall back to hardcoded /usr/include/libnl3. + +Signed-off-by: Sascha Hauer +Acked-by: Daniel Lezcano +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + tools/lib/thermal/Makefile | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/tools/lib/thermal/Makefile b/tools/lib/thermal/Makefile +index 1694889847caf..8d21ea1950a31 100644 +--- a/tools/lib/thermal/Makefile ++++ b/tools/lib/thermal/Makefile +@@ -59,8 +59,12 @@ else + CFLAGS := -g -Wall + endif + ++NL3_CFLAGS = $(shell pkg-config --cflags libnl-3.0 2>/dev/null) ++ifeq ($(NL3_CFLAGS),) ++NL3_CFLAGS = -I/usr/include/libnl3 ++endif ++ + INCLUDES = \ +--I/usr/include/libnl3 \ + -I$(srctree)/tools/lib/thermal/include \ + -I$(srctree)/tools/lib/ \ + -I$(srctree)/tools/include \ +@@ -72,6 +76,7 @@ INCLUDES = \ + override CFLAGS += $(EXTRA_WARNINGS) + override CFLAGS += -Werror -Wall + override CFLAGS += -fPIC ++override CFLAGS += $(NL3_CFLAGS) + override CFLAGS += $(INCLUDES) + override CFLAGS += -fvisibility=hidden + override CFGLAS += -Wl,-L. +-- +2.51.0 + diff --git a/queue-6.6/um-fix-help-message-for-ssl-non-raw.patch b/queue-6.6/um-fix-help-message-for-ssl-non-raw.patch new file mode 100644 index 0000000000..6f87681f45 --- /dev/null +++ b/queue-6.6/um-fix-help-message-for-ssl-non-raw.patch @@ -0,0 +1,36 @@ +From ca9d8e4cc179a367b435cf264c86b45c51d3b7e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 08:56:59 +0800 +Subject: um: Fix help message for ssl-non-raw + +From: Tiwei Bie + +[ Upstream commit 725e9d81868fcedaeef775948e699955b01631ae ] + +Add the missing option name in the help message. Additionally, +switch to __uml_help(), because this is a global option rather +than a per-channel option. + +Signed-off-by: Tiwei Bie +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + arch/um/drivers/ssl.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/um/drivers/ssl.c b/arch/um/drivers/ssl.c +index 277cea3d30eb5..8006a5bd578c2 100644 +--- a/arch/um/drivers/ssl.c ++++ b/arch/um/drivers/ssl.c +@@ -199,4 +199,7 @@ static int ssl_non_raw_setup(char *str) + return 1; + } + __setup("ssl-non-raw", ssl_non_raw_setup); +-__channel_help(ssl_non_raw_setup, "set serial lines to non-raw mode"); ++__uml_help(ssl_non_raw_setup, ++"ssl-non-raw\n" ++" Set serial lines to non-raw mode.\n\n" ++); +-- +2.51.0 + -- 2.47.3