--- a/sound/usb/format.c
+++ b/sound/usb/format.c
-@@ -461,7 +461,7 @@ static int parse_uac2_sample_rate_range(
+@@ -399,7 +399,7 @@ static int parse_uac2_sample_rate_range(
nr_rates++;
if (nr_rates >= MAX_NR_RATES) {
usb_audio_err(chip, "invalid uac2 rates\n");
Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- drivers/gpu/drm/sun4i/sun4i_backend.c | 3 ++-
+ drivers/gpu/drm/sun4i/sun4i_backend.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c
-index a812de372437b..5f0b58be6afb8 100644
--- a/drivers/gpu/drm/sun4i/sun4i_backend.c
+++ b/drivers/gpu/drm/sun4i/sun4i_backend.c
-@@ -879,7 +879,8 @@ static int sun4i_backend_bind(struct device *dev, struct device *master,
+@@ -876,7 +876,8 @@ static int sun4i_backend_bind(struct dev
&sun4i_backend_regmap_config);
if (IS_ERR(backend->engine.regs)) {
dev_err(dev, "Couldn't create the backend regmap\n");
}
list_add_tail(&backend->engine.list, &drv->engine_list);
---
-2.53.0
-
+++ /dev/null
-From 7b32286981d332a4970cd8847bdf3808f229908e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 27 May 2026 16:37:47 +0800
-Subject: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue
-
-From: Adrian Hunter <adrian.hunter@intel.com>
-
-[ Upstream commit b795e68bf3073d67bebbb5a44d93f49efc5b8cc7 ]
-
-The logic used to abort the DMA ring contains several flaws:
-
- 1. The driver unconditionally issues a ring abort even when the ring has
- already stopped.
- 2. The completion used to wait for abort completion is never
- re-initialized, resulting in incorrect wait behavior.
- 3. The abort sequence unintentionally clears RING_CTRL_ENABLE, which
- resets hardware ring pointers and disrupts the controller state.
- 4. If the ring is already stopped, the abort operation should be
- considered successful without attempting further action.
-
-Fix the abort handling by checking whether the ring is running before
-issuing an abort, re-initializing the completion when needed, ensuring that
-RING_CTRL_ENABLE remains asserted during abort, and treating an already
-stopped ring as a successful condition.
-
-Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver")
-Cc: stable@vger.kernel.org
-Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
-Reviewed-by: Frank Li <Frank.Li@nxp.com>
-Link: https://patch.msgid.link/20260306072451.11131-9-adrian.hunter@intel.com
-Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
-Signed-off-by: Jianqiang kang <jianqkang@sina.cn>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/i3c/master/mipi-i3c-hci/dma.c | 27 +++++++++++++++++----------
- 1 file changed, 17 insertions(+), 10 deletions(-)
-
-diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c
-index 168b21f6cf37c..d6678bee725b6 100644
---- a/drivers/i3c/master/mipi-i3c-hci/dma.c
-+++ b/drivers/i3c/master/mipi-i3c-hci/dma.c
-@@ -448,16 +448,23 @@ static bool hci_dma_dequeue_xfer(struct i3c_hci *hci,
- struct hci_rh_data *rh = &rings->headers[xfer_list[0].ring_number];
- unsigned int i;
- bool did_unqueue = false;
--
-- /* stop the ring */
-- rh_reg_write(RING_CONTROL, RING_CTRL_ABORT);
-- if (wait_for_completion_timeout(&rh->op_done, HZ) == 0) {
-- /*
-- * We're deep in it if ever this condition is ever met.
-- * Hardware might still be writing to memory, etc.
-- */
-- dev_crit(&hci->master.dev, "unable to abort the ring\n");
-- WARN_ON(1);
-+ u32 ring_status;
-+
-+ ring_status = rh_reg_read(RING_STATUS);
-+ if (ring_status & RING_STATUS_RUNNING) {
-+ /* stop the ring */
-+ reinit_completion(&rh->op_done);
-+ rh_reg_write(RING_CONTROL, RING_CTRL_ENABLE | RING_CTRL_ABORT);
-+ wait_for_completion_timeout(&rh->op_done, HZ);
-+ ring_status = rh_reg_read(RING_STATUS);
-+ if (ring_status & RING_STATUS_RUNNING) {
-+ /*
-+ * We're deep in it if ever this condition is ever met.
-+ * Hardware might still be writing to memory, etc.
-+ */
-+ dev_crit(&hci->master.dev, "unable to abort the ring\n");
-+ WARN_ON(1);
-+ }
- }
-
- for (i = 0; i < n; i++) {
---
-2.53.0
-
kvm-x86-acquire-srcu-in-kvm_get_mp_state-to-protect-.patch
revert-s390-cio-fix-device-lifecycle-handling-in-css.patch
smb-client-reject-userspace-cifs.spnego-descriptions.patch
-i3c-mipi-i3c-hci-correct-ring_ctrl_abort-handling-in.patch
sysfs-don-t-remove-existing-directory-on-update-failure.patch
hwmon-pmbus-adm1266-widen-blackbox-info-buffer-to-i2c_smbus_block_max.patch
alsa-ua101-reject-too-short-usb-descriptors.patch
--- a/sound/usb/format.c
+++ b/sound/usb/format.c
-@@ -461,7 +461,7 @@ static int parse_uac2_sample_rate_range(
+@@ -399,7 +399,7 @@ static int parse_uac2_sample_rate_range(
nr_rates++;
if (nr_rates >= MAX_NR_RATES) {
usb_audio_err(chip, "invalid uac2 rates\n");
+++ /dev/null
-From 65cff8906fcf152c60bf7130fb4004824dc54288 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 27 May 2026 14:21:07 +0800
-Subject: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue
-
-From: Adrian Hunter <adrian.hunter@intel.com>
-
-[ Upstream commit b795e68bf3073d67bebbb5a44d93f49efc5b8cc7 ]
-
-The logic used to abort the DMA ring contains several flaws:
-
- 1. The driver unconditionally issues a ring abort even when the ring has
- already stopped.
- 2. The completion used to wait for abort completion is never
- re-initialized, resulting in incorrect wait behavior.
- 3. The abort sequence unintentionally clears RING_CTRL_ENABLE, which
- resets hardware ring pointers and disrupts the controller state.
- 4. If the ring is already stopped, the abort operation should be
- considered successful without attempting further action.
-
-Fix the abort handling by checking whether the ring is running before
-issuing an abort, re-initializing the completion when needed, ensuring that
-RING_CTRL_ENABLE remains asserted during abort, and treating an already
-stopped ring as a successful condition.
-
-Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver")
-Cc: stable@vger.kernel.org
-Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
-Reviewed-by: Frank Li <Frank.Li@nxp.com>
-Link: https://patch.msgid.link/20260306072451.11131-9-adrian.hunter@intel.com
-Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
-Signed-off-by: Jianqiang kang <jianqkang@sina.cn>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/i3c/master/mipi-i3c-hci/dma.c | 27 +++++++++++++++++----------
- 1 file changed, 17 insertions(+), 10 deletions(-)
-
-diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c
-index 624d00b853a51..61007167606fd 100644
---- a/drivers/i3c/master/mipi-i3c-hci/dma.c
-+++ b/drivers/i3c/master/mipi-i3c-hci/dma.c
-@@ -448,16 +448,23 @@ static bool hci_dma_dequeue_xfer(struct i3c_hci *hci,
- struct hci_rh_data *rh = &rings->headers[xfer_list[0].ring_number];
- unsigned int i;
- bool did_unqueue = false;
--
-- /* stop the ring */
-- rh_reg_write(RING_CONTROL, RING_CTRL_ABORT);
-- if (wait_for_completion_timeout(&rh->op_done, HZ) == 0) {
-- /*
-- * We're deep in it if ever this condition is ever met.
-- * Hardware might still be writing to memory, etc.
-- */
-- dev_crit(&hci->master.dev, "unable to abort the ring\n");
-- WARN_ON(1);
-+ u32 ring_status;
-+
-+ ring_status = rh_reg_read(RING_STATUS);
-+ if (ring_status & RING_STATUS_RUNNING) {
-+ /* stop the ring */
-+ reinit_completion(&rh->op_done);
-+ rh_reg_write(RING_CONTROL, RING_CTRL_ENABLE | RING_CTRL_ABORT);
-+ wait_for_completion_timeout(&rh->op_done, HZ);
-+ ring_status = rh_reg_read(RING_STATUS);
-+ if (ring_status & RING_STATUS_RUNNING) {
-+ /*
-+ * We're deep in it if ever this condition is ever met.
-+ * Hardware might still be writing to memory, etc.
-+ */
-+ dev_crit(&hci->master.dev, "unable to abort the ring\n");
-+ WARN_ON(1);
-+ }
- }
-
- for (i = 0; i < n; i++) {
---
-2.53.0
-
revert-x86-vdso-fix-output-operand-size-of-rdpid.patch
revert-s390-cio-fix-device-lifecycle-handling-in-css.patch
smb-client-reject-userspace-cifs.spnego-descriptions.patch
-i3c-mipi-i3c-hci-correct-ring_ctrl_abort-handling-in.patch
sysfs-don-t-remove-existing-directory-on-update-failure.patch
hwmon-pmbus-adm1266-widen-blackbox-info-buffer-to-i2c_smbus_block_max.patch
alsa-ua101-reject-too-short-usb-descriptors.patch
+++ /dev/null
-From 840018a00e1073ee50daf3f11644707b6c5bc9a1 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 27 May 2026 14:19:33 +0800
-Subject: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue
-
-From: Adrian Hunter <adrian.hunter@intel.com>
-
-[ Upstream commit b795e68bf3073d67bebbb5a44d93f49efc5b8cc7 ]
-
-The logic used to abort the DMA ring contains several flaws:
-
- 1. The driver unconditionally issues a ring abort even when the ring has
- already stopped.
- 2. The completion used to wait for abort completion is never
- re-initialized, resulting in incorrect wait behavior.
- 3. The abort sequence unintentionally clears RING_CTRL_ENABLE, which
- resets hardware ring pointers and disrupts the controller state.
- 4. If the ring is already stopped, the abort operation should be
- considered successful without attempting further action.
-
-Fix the abort handling by checking whether the ring is running before
-issuing an abort, re-initializing the completion when needed, ensuring that
-RING_CTRL_ENABLE remains asserted during abort, and treating an already
-stopped ring as a successful condition.
-
-Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver")
-Cc: stable@vger.kernel.org
-Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
-Reviewed-by: Frank Li <Frank.Li@nxp.com>
-Link: https://patch.msgid.link/20260306072451.11131-9-adrian.hunter@intel.com
-Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
-Signed-off-by: Jianqiang kang <jianqkang@sina.cn>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/i3c/master/mipi-i3c-hci/dma.c | 27 +++++++++++++++++----------
- 1 file changed, 17 insertions(+), 10 deletions(-)
-
-diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c
-index b9496e8c4784d..44461f13b54cd 100644
---- a/drivers/i3c/master/mipi-i3c-hci/dma.c
-+++ b/drivers/i3c/master/mipi-i3c-hci/dma.c
-@@ -457,16 +457,23 @@ static bool hci_dma_dequeue_xfer(struct i3c_hci *hci,
- struct hci_rh_data *rh = &rings->headers[xfer_list[0].ring_number];
- unsigned int i;
- bool did_unqueue = false;
--
-- /* stop the ring */
-- rh_reg_write(RING_CONTROL, RING_CTRL_ABORT);
-- if (wait_for_completion_timeout(&rh->op_done, HZ) == 0) {
-- /*
-- * We're deep in it if ever this condition is ever met.
-- * Hardware might still be writing to memory, etc.
-- */
-- dev_crit(&hci->master.dev, "unable to abort the ring\n");
-- WARN_ON(1);
-+ u32 ring_status;
-+
-+ ring_status = rh_reg_read(RING_STATUS);
-+ if (ring_status & RING_STATUS_RUNNING) {
-+ /* stop the ring */
-+ reinit_completion(&rh->op_done);
-+ rh_reg_write(RING_CONTROL, RING_CTRL_ENABLE | RING_CTRL_ABORT);
-+ wait_for_completion_timeout(&rh->op_done, HZ);
-+ ring_status = rh_reg_read(RING_STATUS);
-+ if (ring_status & RING_STATUS_RUNNING) {
-+ /*
-+ * We're deep in it if ever this condition is ever met.
-+ * Hardware might still be writing to memory, etc.
-+ */
-+ dev_crit(&hci->master.dev, "unable to abort the ring\n");
-+ WARN_ON(1);
-+ }
- }
-
- for (i = 0; i < n; i++) {
---
-2.53.0
-
riscv-fgraph-fix-stack-layout-to-match-__arch_ftrace.patch
hwmon-pmbus-core-protect-regulator-operations-with-m.patch
arm64-kconfig-remove-selecting-replaced-have_functio.patch
-i3c-mipi-i3c-hci-correct-ring_ctrl_abort-handling-in.patch
sysfs-don-t-remove-existing-directory-on-update-failure.patch
mm-damon-sysfs-schemes-call-missing-mem_cgroup_iter_break.patch
ksmbd-fix-null-pointer-dereference-in-compare_guid_key.patch
+++ /dev/null
-From 05e5798e389f1bc3a815f1eeefd0c0c2641bbbd0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 27 May 2026 14:20:39 +0800
-Subject: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue
-
-From: Adrian Hunter <adrian.hunter@intel.com>
-
-[ Upstream commit b795e68bf3073d67bebbb5a44d93f49efc5b8cc7 ]
-
-The logic used to abort the DMA ring contains several flaws:
-
- 1. The driver unconditionally issues a ring abort even when the ring has
- already stopped.
- 2. The completion used to wait for abort completion is never
- re-initialized, resulting in incorrect wait behavior.
- 3. The abort sequence unintentionally clears RING_CTRL_ENABLE, which
- resets hardware ring pointers and disrupts the controller state.
- 4. If the ring is already stopped, the abort operation should be
- considered successful without attempting further action.
-
-Fix the abort handling by checking whether the ring is running before
-issuing an abort, re-initializing the completion when needed, ensuring that
-RING_CTRL_ENABLE remains asserted during abort, and treating an already
-stopped ring as a successful condition.
-
-Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver")
-Cc: stable@vger.kernel.org
-Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
-Reviewed-by: Frank Li <Frank.Li@nxp.com>
-Link: https://patch.msgid.link/20260306072451.11131-9-adrian.hunter@intel.com
-Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
-Signed-off-by: Jianqiang kang <jianqkang@sina.cn>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/i3c/master/mipi-i3c-hci/dma.c | 27 +++++++++++++++++----------
- 1 file changed, 17 insertions(+), 10 deletions(-)
-
-diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c
-index 624d00b853a51..61007167606fd 100644
---- a/drivers/i3c/master/mipi-i3c-hci/dma.c
-+++ b/drivers/i3c/master/mipi-i3c-hci/dma.c
-@@ -448,16 +448,23 @@ static bool hci_dma_dequeue_xfer(struct i3c_hci *hci,
- struct hci_rh_data *rh = &rings->headers[xfer_list[0].ring_number];
- unsigned int i;
- bool did_unqueue = false;
--
-- /* stop the ring */
-- rh_reg_write(RING_CONTROL, RING_CTRL_ABORT);
-- if (wait_for_completion_timeout(&rh->op_done, HZ) == 0) {
-- /*
-- * We're deep in it if ever this condition is ever met.
-- * Hardware might still be writing to memory, etc.
-- */
-- dev_crit(&hci->master.dev, "unable to abort the ring\n");
-- WARN_ON(1);
-+ u32 ring_status;
-+
-+ ring_status = rh_reg_read(RING_STATUS);
-+ if (ring_status & RING_STATUS_RUNNING) {
-+ /* stop the ring */
-+ reinit_completion(&rh->op_done);
-+ rh_reg_write(RING_CONTROL, RING_CTRL_ENABLE | RING_CTRL_ABORT);
-+ wait_for_completion_timeout(&rh->op_done, HZ);
-+ ring_status = rh_reg_read(RING_STATUS);
-+ if (ring_status & RING_STATUS_RUNNING) {
-+ /*
-+ * We're deep in it if ever this condition is ever met.
-+ * Hardware might still be writing to memory, etc.
-+ */
-+ dev_crit(&hci->master.dev, "unable to abort the ring\n");
-+ WARN_ON(1);
-+ }
- }
-
- for (i = 0; i < n; i++) {
---
-2.53.0
-
revert-ice-remove-jumbo_remove-step-from-tx-path.patch
revert-s390-cio-update-purge-function-to-unregister-.patch
revert-af_unix-reject-siocatmark-on-non-stream-socke.patch
-i3c-mipi-i3c-hci-correct-ring_ctrl_abort-handling-in.patch
sysfs-don-t-remove-existing-directory-on-update-failure.patch
mm-damon-sysfs-schemes-call-missing-mem_cgroup_iter_break.patch
ksmbd-fix-null-pointer-dereference-in-compare_guid_key.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
