release 6.16.6-1

2025-09-09 21:22:32 +03:00
parent bbfd90d5dc
commit 818a459fa3
25 changed files with 170 additions and 1493 deletions
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
 linux (6.16.6-1) sid; urgency=medium
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.6
 -- Konstantin Demin <rockdrilla@gmail.com>  Tue, 09 Sep 2025 20:27:56 +0300
 linux (6.16.5-1) sid; urgency=medium
  * New upstream stable update:
--- a/debian/config/amd64/config.mobile
+++ b/debian/config/amd64/config.mobile
@@ -31,7 +31,7 @@ CONFIG_MODIFY_LDT_SYSCALL=y
 ##
 ## file: arch/x86/Kconfig.cpu
 ##
-CONFIG_X86_64_VERSION=2
+CONFIG_X86_64_VERSION=3
 ##
 ## file: arch/x86/Kconfig.debug
--- a/debian/patches/bugfix/all/proc-fix-missing-pde_set_flags-for-net-proc-files.patch
+++ b/debian/patches/bugfix/all/proc-fix-missing-pde_set_flags-for-net-proc-files.patch
@@ -1,108 +0,0 @@
 From: wangzijie <wangzijie1@honor.com>
 Subject: proc: fix missing pde_set_flags() for net proc files
 Date: Thu, 21 Aug 2025 18:58:06 +0800
 Origin: https://lore.kernel.org/stable/20250821105806.1453833-1-wangzijie1@honor.com/
 To avoid potential UAF issues during module removal races, we use pde_set_flags()
 to save proc_ops flags in PDE itself before proc_register(), and then use
 pde_has_proc_*() helpers instead of directly dereferencing pde->proc_ops->*.
 However, the pde_set_flags() call was missing when creating net related proc files.
 This omission caused incorrect behavior which FMODE_LSEEK was being cleared
 inappropriately in proc_reg_open() for net proc files. Lars reported it in this link[1].
 Fix this by ensuring pde_set_flags() is called when register proc entry, and add
 NULL check for proc_ops in pde_set_flags().
 [1]: https://lore.kernel.org/all/20250815195616.64497967@chagall.paradoxon.rec/
 Fixes: ff7ec8dc1b64 ("proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al")
 Cc: stable@vger.kernel.org
 Reported-by: Lars Wendler <polynomial-c@gmx.de>
 Signed-off-by: wangzijie <wangzijie1@honor.com>
 ---
 fs/proc/generic.c | 38 +++++++++++++++++++++-----------------
 1 file changed, 21 insertions(+), 17 deletions(-)
 --- a/fs/proc/generic.c
 +++ b/fs/proc/generic.c
@@ -364,6 +364,25 @@ static const struct inode_operations pro
 	.setattr	= proc_notify_change,
 };
 +static void pde_set_flags(struct proc_dir_entry *pde)
 +{
 +	const struct proc_ops *proc_ops = pde->proc_ops;
 +
 +	if (!proc_ops)
 +		return;
 +
 +	if (proc_ops->proc_flags & PROC_ENTRY_PERMANENT)
 +		pde->flags |= PROC_ENTRY_PERMANENT;
 +	if (proc_ops->proc_read_iter)
 +		pde->flags |= PROC_ENTRY_proc_read_iter;
 +#ifdef CONFIG_COMPAT
 +	if (proc_ops->proc_compat_ioctl)
 +		pde->flags |= PROC_ENTRY_proc_compat_ioctl;
 +#endif
 +	if (proc_ops->proc_lseek)
 +		pde->flags |= PROC_ENTRY_proc_lseek;
 +}
 +
 /* returns the registered entry, or frees dp and returns NULL on failure */
 struct proc_dir_entry *proc_register(struct proc_dir_entry *dir,
 		struct proc_dir_entry *dp)
@@ -371,6 +390,8 @@ struct proc_dir_entry *proc_register(str
 	if (proc_alloc_inum(&dp->low_ino))
 		goto out_free_entry;
 +	pde_set_flags(dp);
 +
 	write_lock(&proc_subdir_lock);
 	dp->parent = dir;
 	if (pde_subdir_insert(dir, dp) == false) {
@@ -559,20 +580,6 @@ struct proc_dir_entry *proc_create_reg(c
 	return p;
 }
 -static void pde_set_flags(struct proc_dir_entry *pde)
 -{
 -	if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT)
 -		pde->flags |= PROC_ENTRY_PERMANENT;
 -	if (pde->proc_ops->proc_read_iter)
 -		pde->flags |= PROC_ENTRY_proc_read_iter;
 -#ifdef CONFIG_COMPAT
 -	if (pde->proc_ops->proc_compat_ioctl)
 -		pde->flags |= PROC_ENTRY_proc_compat_ioctl;
 -#endif
 -	if (pde->proc_ops->proc_lseek)
 -		pde->flags |= PROC_ENTRY_proc_lseek;
 -}
 -
 struct proc_dir_entry *proc_create_data(const char *name, umode_t mode,
 		struct proc_dir_entry *parent,
 		const struct proc_ops *proc_ops, void *data)
@@ -583,7 +590,6 @@ struct proc_dir_entry *proc_create_data(
 	if (!p)
 		return NULL;
 	p->proc_ops = proc_ops;
 -	pde_set_flags(p);
 	return proc_register(parent, p);
 }
 EXPORT_SYMBOL(proc_create_data);
@@ -634,7 +640,6 @@ struct proc_dir_entry *proc_create_seq_p
 	p->proc_ops = &proc_seq_ops;
 	p->seq_ops = ops;
 	p->state_size = state_size;
 -	pde_set_flags(p);
 	return proc_register(parent, p);
 }
 EXPORT_SYMBOL(proc_create_seq_private);
@@ -665,7 +670,6 @@ struct proc_dir_entry *proc_create_singl
 		return NULL;
 	p->proc_ops = &proc_single_ops;
 	p->single_show = show;
 -	pde_set_flags(p);
 	return proc_register(parent, p);
 }
 EXPORT_SYMBOL(proc_create_single_data);
--- a/debian/patches/patchset-pf/steady/0008-ALSA-usb-audio-Add-mute-TLV-for-playback-volumes-on-.patch
+++ b/debian/patches/patchset-pf/steady/0008-ALSA-usb-audio-Add-mute-TLV-for-playback-volumes-on-.patch
@@ -1,32 +0,0 @@
 From 3bcf08cb1e242f8407315c5dea83a79340b1146a Mon Sep 17 00:00:00 2001
 From: Cryolitia PukNgae <cryolitia@uniontech.com>
 Date: Fri, 22 Aug 2025 20:58:08 +0800
 Subject: ALSA: usb-audio: Add mute TLV for playback volumes on some devices
 Applying the quirk of that, the lowest Playback mixer volume setting
 mutes the audio output, on more devices.
 Link: https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/2514
 Cc: <stable@vger.kernel.org>
 Tested-by: Guoli An <anguoli@uniontech.com>
 Signed-off-by: Cryolitia PukNgae <cryolitia@uniontech.com>
 Link: https://patch.msgid.link/20250822-mixer-quirk-v1-1-b19252239c1c@uniontech.com
 Signed-off-by: Takashi Iwai <tiwai@suse.de>
 ---
 sound/usb/mixer_quirks.c | 2 ++
 1 file changed, 2 insertions(+)
 --- a/sound/usb/mixer_quirks.c
 +++ b/sound/usb/mixer_quirks.c
@@ -4339,9 +4339,11 @@ void snd_usb_mixer_fu_apply_quirk(struct
 			snd_dragonfly_quirk_db_scale(mixer, cval, kctl);
 		break;
 	/* lowest playback value is muted on some devices */
 +	case USB_ID(0x0572, 0x1b09): /* Conexant Systems (Rockwell), Inc. */
 	case USB_ID(0x0d8c, 0x000c): /* C-Media */
 	case USB_ID(0x0d8c, 0x0014): /* C-Media */
 	case USB_ID(0x19f7, 0x0003): /* RODE NT-USB */
 +	case USB_ID(0x2d99, 0x0026): /* HECATE G2 GAMING HEADSET */
 		if (strstr(kctl->id.name, "Playback"))
 			cval->min_mute = 1;
 		break;
--- a/debian/patches/patchset-pf/steady/0008-mm-damon-core-prevent-unnecessary-overflow-in-damos_.patch
+++ b/debian/patches/patchset-pf/steady/0008-mm-damon-core-prevent-unnecessary-overflow-in-damos_.patch
--- a/debian/patches/patchset-pf/steady/0009-ALSA-hda-realtek-Fix-headset-mic-for-TongFang-X6-AF-.patch
+++ b/debian/patches/patchset-pf/steady/0009-ALSA-hda-realtek-Fix-headset-mic-for-TongFang-X6-AF-.patch
@@ -1,27 +0,0 @@
 From c97fe55036b080fd5342059e2ba8d6fc7a9157f0 Mon Sep 17 00:00:00 2001
 From: Aaron Erhardt <aer@tuxedocomputers.com>
 Date: Tue, 26 Aug 2025 16:10:54 +0200
 Subject: ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY
 Add a PCI quirk to enable microphone detection on the headphone jack of
 TongFang X6AR5xxY and X6FR5xxY devices.
 Signed-off-by: Aaron Erhardt <aer@tuxedocomputers.com>
 Cc: <stable@vger.kernel.org>
 Link: https://patch.msgid.link/20250826141054.1201482-1-aer@tuxedocomputers.com
 Signed-off-by: Takashi Iwai <tiwai@suse.de>
 ---
 sound/pci/hda/patch_realtek.c | 2 ++
 1 file changed, 2 insertions(+)
 --- a/sound/pci/hda/patch_realtek.c
 +++ b/sound/pci/hda/patch_realtek.c
@@ -11427,6 +11427,8 @@ static const struct hda_quirk alc269_fix
 	SND_PCI_QUIRK(0x1d05, 0x121b, "TongFang GMxAGxx", ALC269_FIXUP_NO_SHUTUP),
 	SND_PCI_QUIRK(0x1d05, 0x1387, "TongFang GMxIXxx", ALC2XX_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1d05, 0x1409, "TongFang GMxIXxx", ALC2XX_FIXUP_HEADSET_MIC),
 +	SND_PCI_QUIRK(0x1d05, 0x300f, "TongFang X6AR5xxY", ALC2XX_FIXUP_HEADSET_MIC),
 +	SND_PCI_QUIRK(0x1d05, 0x3019, "TongFang X6FR5xxY", ALC2XX_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1d17, 0x3288, "Haier Boyue G42", ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS),
 	SND_PCI_QUIRK(0x1d72, 0x1602, "RedmiBook", ALC255_FIXUP_XIAOMI_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1d72, 0x1701, "XiaomiNotebook Pro", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE),
--- a/debian/patches/patchset-pf/steady/0009-iwlwifi-Patch-to-fix-130-1030.patch
+++ b/debian/patches/patchset-pf/steady/0009-iwlwifi-Patch-to-fix-130-1030.patch
@@ -0,0 +1,55 @@
 From fdafd071d48a1f425b54882acf2e4d08163e85b2 Mon Sep 17 00:00:00 2001
 From: "Jan Alexander Steffens (heftig)" <heftig@archlinux.org>
 Date: Fri, 5 Sep 2025 01:08:14 +0200
 Subject: iwlwifi: Patch to fix 130/1030
 Apply Johannes Berg's patch for BKO 220472.
 See: https://bugzilla.kernel.org/show_bug.cgi?id=220472
 Cherry-picked-for: https://gitlab.archlinux.org/archlinux/packaging/packages/linux/-/issues/153
 ---
 drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 26 +++++++++----------
 1 file changed, 13 insertions(+), 13 deletions(-)
 --- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
 +++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -124,13 +124,13 @@ VISIBLE_IF_IWLWIFI_KUNIT const struct pc
 	{IWL_PCI_DEVICE(0x0082, 0x1304, iwl6005_mac_cfg)},/* low 5GHz active */
 	{IWL_PCI_DEVICE(0x0082, 0x1305, iwl6005_mac_cfg)},/* high 5GHz active */
 -/* 6x30 Series */
 -	{IWL_PCI_DEVICE(0x008A, 0x5305, iwl1000_mac_cfg)},
 -	{IWL_PCI_DEVICE(0x008A, 0x5307, iwl1000_mac_cfg)},
 -	{IWL_PCI_DEVICE(0x008A, 0x5325, iwl1000_mac_cfg)},
 -	{IWL_PCI_DEVICE(0x008A, 0x5327, iwl1000_mac_cfg)},
 -	{IWL_PCI_DEVICE(0x008B, 0x5315, iwl1000_mac_cfg)},
 -	{IWL_PCI_DEVICE(0x008B, 0x5317, iwl1000_mac_cfg)},
 +/* 1030/6x30 Series */
 +	{IWL_PCI_DEVICE(0x008A, 0x5305, iwl6030_mac_cfg)},
 +	{IWL_PCI_DEVICE(0x008A, 0x5307, iwl6030_mac_cfg)},
 +	{IWL_PCI_DEVICE(0x008A, 0x5325, iwl6030_mac_cfg)},
 +	{IWL_PCI_DEVICE(0x008A, 0x5327, iwl6030_mac_cfg)},
 +	{IWL_PCI_DEVICE(0x008B, 0x5315, iwl6030_mac_cfg)},
 +	{IWL_PCI_DEVICE(0x008B, 0x5317, iwl6030_mac_cfg)},
 	{IWL_PCI_DEVICE(0x0090, 0x5211, iwl6030_mac_cfg)},
 	{IWL_PCI_DEVICE(0x0090, 0x5215, iwl6030_mac_cfg)},
 	{IWL_PCI_DEVICE(0x0090, 0x5216, iwl6030_mac_cfg)},
@@ -181,12 +181,12 @@ VISIBLE_IF_IWLWIFI_KUNIT const struct pc
 	{IWL_PCI_DEVICE(0x08AE, 0x1027, iwl1000_mac_cfg)},
 /* 130 Series WiFi */
 -	{IWL_PCI_DEVICE(0x0896, 0x5005, iwl1000_mac_cfg)},
 -	{IWL_PCI_DEVICE(0x0896, 0x5007, iwl1000_mac_cfg)},
 -	{IWL_PCI_DEVICE(0x0897, 0x5015, iwl1000_mac_cfg)},
 -	{IWL_PCI_DEVICE(0x0897, 0x5017, iwl1000_mac_cfg)},
 -	{IWL_PCI_DEVICE(0x0896, 0x5025, iwl1000_mac_cfg)},
 -	{IWL_PCI_DEVICE(0x0896, 0x5027, iwl1000_mac_cfg)},
 +	{IWL_PCI_DEVICE(0x0896, 0x5005, iwl6030_mac_cfg)},
 +	{IWL_PCI_DEVICE(0x0896, 0x5007, iwl6030_mac_cfg)},
 +	{IWL_PCI_DEVICE(0x0897, 0x5015, iwl6030_mac_cfg)},
 +	{IWL_PCI_DEVICE(0x0897, 0x5017, iwl6030_mac_cfg)},
 +	{IWL_PCI_DEVICE(0x0896, 0x5025, iwl6030_mac_cfg)},
 +	{IWL_PCI_DEVICE(0x0896, 0x5027, iwl6030_mac_cfg)},
 /* 2x00 Series */
 	{IWL_PCI_DEVICE(0x0890, 0x4022, iwl2000_mac_cfg)},
--- a/debian/patches/patchset-pf/steady/0010-fuse-do-not-allow-mapping-a-non-regular-backing-file.patch
+++ b/debian/patches/patchset-pf/steady/0010-fuse-do-not-allow-mapping-a-non-regular-backing-file.patch
@@ -0,0 +1,31 @@
 From 862ed307cdb6281d669ac6a3124b109bac9d401c Mon Sep 17 00:00:00 2001
 From: Amir Goldstein <amir73il@gmail.com>
 Date: Thu, 10 Jul 2025 12:08:30 +0200
 Subject: fuse: do not allow mapping a non-regular backing file
 We do not support passthrough operations other than read/write on
 regular file, so allowing non-regular backing files makes no sense.
 Fixes: efad7153bf93 ("fuse: allow O_PATH fd for FUSE_DEV_IOC_BACKING_OPEN")
 Cc: stable@vger.kernel.org
 Signed-off-by: Amir Goldstein <amir73il@gmail.com>
 Reviewed-by: Bernd Schubert <bschubert@ddn.com>
 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
 ---
 fs/fuse/passthrough.c | 5 +++++
 1 file changed, 5 insertions(+)
 --- a/fs/fuse/passthrough.c
 +++ b/fs/fuse/passthrough.c
@@ -237,6 +237,11 @@ int fuse_backing_open(struct fuse_conn *
 	if (!file)
 		goto out;
 +	/* read/write/splice/mmap passthrough only relevant for regular files */
 +	res = d_is_dir(file->f_path.dentry) ? -EISDIR : -EINVAL;
 +	if (!d_is_reg(file->f_path.dentry))
 +		goto out_fput;
 +
 	backing_sb = file_inode(file)->i_sb;
 	res = -ELOOP;
 	if (backing_sb->s_stack_depth >= fc->max_stack_depth)
--- a/debian/patches/patchset-pf/steady/0010-of_numa-fix-uninitialized-memory-nodes-causing-kerne.patch
+++ b/debian/patches/patchset-pf/steady/0010-of_numa-fix-uninitialized-memory-nodes-causing-kerne.patch
@@ -1,128 +0,0 @@
 From 488f95db8bbdc251cae8548294a09832840c9333 Mon Sep 17 00:00:00 2001
 From: Yin Tirui <yintirui@huawei.com>
 Date: Tue, 19 Aug 2025 15:55:10 +0800
 Subject: of_numa: fix uninitialized memory nodes causing kernel panic
 When there are memory-only nodes (nodes without CPUs), these nodes are not
 properly initialized, causing kernel panic during boot.
 of_numa_init
 	of_numa_parse_cpu_nodes
 		node_set(nid, numa_nodes_parsed);
 	of_numa_parse_memory_nodes
 In of_numa_parse_cpu_nodes, numa_nodes_parsed gets updated only for nodes
 containing CPUs.  Memory-only nodes should have been updated in
 of_numa_parse_memory_nodes, but they weren't.
 Subsequently, when free_area_init() attempts to access NODE_DATA() for
 these uninitialized memory nodes, the kernel panics due to NULL pointer
 dereference.
 This can be reproduced on ARM64 QEMU with 1 CPU and 2 memory nodes:
 qemu-system-aarch64 \
 -cpu host -nographic \
 -m 4G -smp 1 \
 -machine virt,accel=kvm,gic-version=3,iommu=smmuv3 \
 -object memory-backend-ram,size=2G,id=mem0 \
 -object memory-backend-ram,size=2G,id=mem1 \
 -numa node,nodeid=0,memdev=mem0 \
 -numa node,nodeid=1,memdev=mem1 \
 -kernel $IMAGE \
 -hda $DISK \
 -append "console=ttyAMA0 root=/dev/vda rw earlycon"
 [    0.000000] Booting Linux on physical CPU 0x0000000000 [0x481fd010]
 [    0.000000] Linux version 6.17.0-rc1-00001-gabb4b3daf18c-dirty (yintirui@local) (gcc (GCC) 12.3.1, GNU ld (GNU Binutils) 2.41) #52 SMP PREEMPT Mon Aug 18 09:49:40 CST 2025
 [    0.000000] KASLR enabled
 [    0.000000] random: crng init done
 [    0.000000] Machine model: linux,dummy-virt
 [    0.000000] efi: UEFI not found.
 [    0.000000] earlycon: pl11 at MMIO 0x0000000009000000 (options '')
 [    0.000000] printk: legacy bootconsole [pl11] enabled
 [    0.000000] OF: reserved mem: Reserved memory: No reserved-memory node in the DT
 [    0.000000] NODE_DATA(0) allocated [mem 0xbfffd9c0-0xbfffffff]
 [    0.000000] node 1 must be removed before remove section 23
 [    0.000000] Zone ranges:
 [    0.000000]   DMA      [mem 0x0000000040000000-0x00000000ffffffff]
 [    0.000000]   DMA32    empty
 [    0.000000]   Normal   [mem 0x0000000100000000-0x000000013fffffff]
 [    0.000000] Movable zone start for each node
 [    0.000000] Early memory node ranges
 [    0.000000]   node   0: [mem 0x0000000040000000-0x00000000bfffffff]
 [    0.000000]   node   1: [mem 0x00000000c0000000-0x000000013fffffff]
 [    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x00000000bfffffff]
 [    0.000000] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a0
 [    0.000000] Mem abort info:
 [    0.000000]   ESR = 0x0000000096000004
 [    0.000000]   EC = 0x25: DABT (current EL), IL = 32 bits
 [    0.000000]   SET = 0, FnV = 0
 [    0.000000]   EA = 0, S1PTW = 0
 [    0.000000]   FSC = 0x04: level 0 translation fault
 [    0.000000] Data abort info:
 [    0.000000]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
 [    0.000000]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
 [    0.000000]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
 [    0.000000] [00000000000000a0] user address but active_mm is swapper
 [    0.000000] Internal error: Oops: 0000000096000004 [#1]  SMP
 [    0.000000] Modules linked in:
 [    0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 6.17.0-rc1-00001-g760c6dabf762-dirty #54 PREEMPT
 [    0.000000] Hardware name: linux,dummy-virt (DT)
 [    0.000000] pstate: 800000c5 (Nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
 [    0.000000] pc : free_area_init+0x50c/0xf9c
 [    0.000000] lr : free_area_init+0x5c0/0xf9c
 [    0.000000] sp : ffffa02ca0f33c00
 [    0.000000] x29: ffffa02ca0f33cb0 x28: 0000000000000000 x27: 0000000000000000
 [    0.000000] x26: 4ec4ec4ec4ec4ec5 x25: 00000000000c0000 x24: 00000000000c0000
 [    0.000000] x23: 0000000000040000 x22: 0000000000000000 x21: ffffa02ca0f3b368
 [    0.000000] x20: ffffa02ca14c7b98 x19: 0000000000000000 x18: 0000000000000002
 [    0.000000] x17: 000000000000cacc x16: 0000000000000001 x15: 0000000000000001
 [    0.000000] x14: 0000000080000000 x13: 0000000000000018 x12: 0000000000000002
 [    0.000000] x11: ffffa02ca0fd4f00 x10: ffffa02ca14bab20 x9 : ffffa02ca14bab38
 [    0.000000] x8 : 00000000000c0000 x7 : 0000000000000001 x6 : 0000000000000002
 [    0.000000] x5 : 0000000140000000 x4 : ffffa02ca0f33c90 x3 : ffffa02ca0f33ca0
 [    0.000000] x2 : ffffa02ca0f33c98 x1 : 0000000080000000 x0 : 0000000000000001
 [    0.000000] Call trace:
 [    0.000000]  free_area_init+0x50c/0xf9c (P)
 [    0.000000]  bootmem_init+0x110/0x1dc
 [    0.000000]  setup_arch+0x278/0x60c
 [    0.000000]  start_kernel+0x70/0x748
 [    0.000000]  __primary_switched+0x88/0x90
 [    0.000000] Code: d503201f b98093e0 52800016 f8607a93 (f9405260)
 [    0.000000] ---[ end trace 0000000000000000 ]---
 [    0.000000] Kernel panic - not syncing: Attempted to kill the idle task!
 [    0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]---
 Link: https://lkml.kernel.org/r/20250819075510.2079961-1-yintirui@huawei.com
 Fixes: 767507654c22 ("arch_numa: switch over to numa_memblks")
 Signed-off-by: Yin Tirui <yintirui@huawei.com>
 Acked-by: David Hildenbrand <david@redhat.com>
 Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
 Reviewed-by: Kefeng Wang <wangkefeng.wang@huawei.com>
 Cc: Chen Jun <chenjun102@huawei.com>
 Cc: Dan Williams <dan.j.williams@intel.com>
 Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
 Cc: Rob Herring <robh@kernel.org>
 Cc: Saravana Kannan <saravanak@google.com>
 Cc: <stable@vger.kernel.org>
 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 ---
 drivers/of/of_numa.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
 --- a/drivers/of/of_numa.c
 +++ b/drivers/of/of_numa.c
@@ -59,8 +59,11 @@ static int __init of_numa_parse_memory_n
 			r = -EINVAL;
 		}
 -		for (i = 0; !r && !of_address_to_resource(np, i, &rsrc); i++)
 +		for (i = 0; !r && !of_address_to_resource(np, i, &rsrc); i++) {
 			r = numa_add_memblk(nid, rsrc.start, rsrc.end + 1);
 +			if (!r)
 +				node_set(nid, numa_nodes_parsed);
 +		}
 		if (!i || r) {
 			of_node_put(np);
--- a/debian/patches/patchset-pf/steady/0011-fuse-check-if-copy_file_range-returns-larger-than-re.patch
+++ b/debian/patches/patchset-pf/steady/0011-fuse-check-if-copy_file_range-returns-larger-than-re.patch
@@ -0,0 +1,29 @@
 From a8da10d61b16a9c719708b07bce976afce86f372 Mon Sep 17 00:00:00 2001
 From: Miklos Szeredi <mszeredi@redhat.com>
 Date: Tue, 12 Aug 2025 14:07:54 +0200
 Subject: fuse: check if copy_file_range() returns larger than requested size
 Just like write(), copy_file_range() should check if the return value is
 less or equal to the requested number of bytes.
 Reported-by: Chunsheng Luo <luochunsheng@ustc.edu>
 Closes: https://lore.kernel.org/all/20250807062425.694-1-luochunsheng@ustc.edu/
 Fixes: 88bc7d5097a1 ("fuse: add support for copy_file_range()")
 Cc: <stable@vger.kernel.org> # v4.20
 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
 ---
 fs/fuse/file.c | 3 +++
 1 file changed, 3 insertions(+)
 --- a/fs/fuse/file.c
 +++ b/fs/fuse/file.c
@@ -3079,6 +3079,9 @@ static ssize_t __fuse_copy_file_range(st
 		fc->no_copy_file_range = 1;
 		err = -EOPNOTSUPP;
 	}
 +	if (!err && outarg.size > len)
 +		err = -EIO;
 +
 	if (err)
 		goto out;
--- a/debian/patches/patchset-pf/steady/0011-mm-userfaultfd-fix-kmap_local-LIFO-ordering-for-CONF.patch
+++ b/debian/patches/patchset-pf/steady/0011-mm-userfaultfd-fix-kmap_local-LIFO-ordering-for-CONF.patch
@@ -1,56 +0,0 @@
 From d165b8446312b442d98a7072eebdbf98f30cdb11 Mon Sep 17 00:00:00 2001
 From: Sasha Levin <sashal@kernel.org>
 Date: Thu, 31 Jul 2025 10:44:31 -0400
 Subject: mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE
 With CONFIG_HIGHPTE on 32-bit ARM, move_pages_pte() maps PTE pages using
 kmap_local_page(), which requires unmapping in Last-In-First-Out order.
 The current code maps dst_pte first, then src_pte, but unmaps them in the
 same order (dst_pte, src_pte), violating the LIFO requirement.  This
 causes the warning in kunmap_local_indexed():
  WARNING: CPU: 0 PID: 604 at mm/highmem.c:622 kunmap_local_indexed+0x178/0x17c
  addr \!= __fix_to_virt(FIX_KMAP_BEGIN + idx)
 Fix this by reversing the unmap order to respect LIFO ordering.
 This issue follows the same pattern as similar fixes:
 - commit eca6828403b8 ("crypto: skcipher - fix mismatch between mapping and unmapping order")
 - commit 8cf57c6df818 ("nilfs2: eliminate staggered calls to kunmap in nilfs_rename")
 Both of which addressed the same fundamental requirement that kmap_local
 operations must follow LIFO ordering.
 Link: https://lkml.kernel.org/r/20250731144431.773923-1-sashal@kernel.org
 Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
 Signed-off-by: Sasha Levin <sashal@kernel.org>
 Acked-by: David Hildenbrand <david@redhat.com>
 Reviewed-by: Suren Baghdasaryan <surenb@google.com>
 Cc: Andrea Arcangeli <aarcange@redhat.com>
 Cc: <stable@vger.kernel.org>
 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 ---
 mm/userfaultfd.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)
 --- a/mm/userfaultfd.c
 +++ b/mm/userfaultfd.c
@@ -1453,10 +1453,15 @@ out:
 		folio_unlock(src_folio);
 		folio_put(src_folio);
 	}
 -	if (dst_pte)
 -		pte_unmap(dst_pte);
 +	/*
 +	 * Unmap in reverse order (LIFO) to maintain proper kmap_local
 +	 * index ordering when CONFIG_HIGHPTE is enabled. We mapped dst_pte
 +	 * first, then src_pte, so we must unmap src_pte first, then dst_pte.
 +	 */
 	if (src_pte)
 		pte_unmap(src_pte);
 +	if (dst_pte)
 +		pte_unmap(dst_pte);
 	mmu_notifier_invalidate_range_end(&range);
 	if (si)
 		put_swap_device(si);
--- a/debian/patches/patchset-pf/steady/0012-fuse-prevent-overflow-in-copy_file_range-return-valu.patch
+++ b/debian/patches/patchset-pf/steady/0012-fuse-prevent-overflow-in-copy_file_range-return-valu.patch
@@ -0,0 +1,33 @@
 From 2f371362d8ae6573b5b7bbc1b4fd8a100b11c5dc Mon Sep 17 00:00:00 2001
 From: Miklos Szeredi <mszeredi@redhat.com>
 Date: Tue, 12 Aug 2025 14:46:34 +0200
 Subject: fuse: prevent overflow in copy_file_range return value
 The FUSE protocol uses struct fuse_write_out to convey the return value of
 copy_file_range, which is restricted to uint32_t.  But the COPY_FILE_RANGE
 interface supports a 64-bit size copies.
 Currently the number of bytes copied is silently truncated to 32-bit, which
 may result in poor performance or even failure to copy in case of
 truncation to zero.
 Reported-by: Florian Weimer <fweimer@redhat.com>
 Closes: https://lore.kernel.org/all/lhuh5ynl8z5.fsf@oldenburg.str.redhat.com/
 Fixes: 88bc7d5097a1 ("fuse: add support for copy_file_range()")
 Cc: <stable@vger.kernel.org> # v4.20
 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
 ---
 fs/fuse/file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 --- a/fs/fuse/file.c
 +++ b/fs/fuse/file.c
@@ -3013,7 +3013,7 @@ static ssize_t __fuse_copy_file_range(st
 		.nodeid_out = ff_out->nodeid,
 		.fh_out = ff_out->fh,
 		.off_out = pos_out,
 -		.len = len,
 +		.len = min_t(size_t, len, UINT_MAX & PAGE_MASK),
 		.flags = flags
 	};
 	struct fuse_write_out outarg;
--- a/debian/patches/patchset-pf/steady/0013-mm-fix-accounting-of-memmap-pages.patch
+++ b/debian/patches/patchset-pf/steady/0013-mm-fix-accounting-of-memmap-pages.patch
@@ -1,104 +0,0 @@
 From 3254cafc371c874a98f74f571decff95ca77df76 Mon Sep 17 00:00:00 2001
 From: Sumanth Korikkar <sumanthk@linux.ibm.com>
 Date: Thu, 7 Aug 2025 20:35:45 +0200
 Subject: mm: fix accounting of memmap pages
 For !CONFIG_SPARSEMEM_VMEMMAP, memmap page accounting is currently done
 upfront in sparse_buffer_init().  However, sparse_buffer_alloc() may
 return NULL in failure scenario.
 Also, memmap pages may be allocated either from the memblock allocator
 during early boot or from the buddy allocator.  When removed via
 arch_remove_memory(), accounting of memmap pages must reflect the original
 allocation source.
 To ensure correctness:
 * Account memmap pages after successful allocation in sparse_init_nid()
  and section_activate().
 * Account memmap pages in section_deactivate() based on allocation
  source.
 Link: https://lkml.kernel.org/r/20250807183545.1424509-1-sumanthk@linux.ibm.com
 Fixes: 15995a352474 ("mm: report per-page metadata information")
 Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
 Suggested-by: David Hildenbrand <david@redhat.com>
 Reviewed-by: Wei Yang <richard.weiyang@gmail.com>
 Cc: Alexander Gordeev <agordeev@linux.ibm.com>
 Cc: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
 Cc: Heiko Carstens <hca@linux.ibm.com>
 Cc: Vasily Gorbik <gor@linux.ibm.com>
 Cc: <stable@vger.kernel.org>
 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 ---
 mm/sparse-vmemmap.c |  5 -----
 mm/sparse.c         | 15 +++++++++------
 2 files changed, 9 insertions(+), 11 deletions(-)
 --- a/mm/sparse-vmemmap.c
 +++ b/mm/sparse-vmemmap.c
@@ -578,11 +578,6 @@ struct page * __meminit __populate_secti
 	if (r < 0)
 		return NULL;
 -	if (system_state == SYSTEM_BOOTING)
 -		memmap_boot_pages_add(DIV_ROUND_UP(end - start, PAGE_SIZE));
 -	else
 -		memmap_pages_add(DIV_ROUND_UP(end - start, PAGE_SIZE));
 -
 	return pfn_to_page(pfn);
 }
 --- a/mm/sparse.c
 +++ b/mm/sparse.c
@@ -454,9 +454,6 @@ static void __init sparse_buffer_init(un
 	 */
 	sparsemap_buf = memmap_alloc(size, section_map_size(), addr, nid, true);
 	sparsemap_buf_end = sparsemap_buf + size;
 -#ifndef CONFIG_SPARSEMEM_VMEMMAP
 -	memmap_boot_pages_add(DIV_ROUND_UP(size, PAGE_SIZE));
 -#endif
 }
 static void __init sparse_buffer_fini(void)
@@ -567,6 +564,8 @@ static void __init sparse_init_nid(int n
 				sparse_buffer_fini();
 				goto failed;
 			}
 +			memmap_boot_pages_add(DIV_ROUND_UP(PAGES_PER_SECTION * sizeof(struct page),
 +							   PAGE_SIZE));
 			sparse_init_early_section(nid, map, pnum, 0);
 		}
 	}
@@ -680,7 +679,6 @@ static void depopulate_section_memmap(un
 	unsigned long start = (unsigned long) pfn_to_page(pfn);
 	unsigned long end = start + nr_pages * sizeof(struct page);
 -	memmap_pages_add(-1L * (DIV_ROUND_UP(end - start, PAGE_SIZE)));
 	vmemmap_free(start, end, altmap);
 }
 static void free_map_bootmem(struct page *memmap)
@@ -856,10 +854,14 @@ static void section_deactivate(unsigned
 	 * The memmap of early sections is always fully populated. See
 	 * section_activate() and pfn_valid() .
 	 */
 -	if (!section_is_early)
 +	if (!section_is_early) {
 +		memmap_pages_add(-1L * (DIV_ROUND_UP(nr_pages * sizeof(struct page), PAGE_SIZE)));
 		depopulate_section_memmap(pfn, nr_pages, altmap);
 -	else if (memmap)
 +	} else if (memmap) {
 +		memmap_boot_pages_add(-1L * (DIV_ROUND_UP(nr_pages * sizeof(struct page),
 +							  PAGE_SIZE)));
 		free_map_bootmem(memmap);
 +	}
 	if (empty)
 		ms->section_mem_map = (unsigned long)NULL;
@@ -904,6 +906,7 @@ static struct page * __meminit section_a
 		section_deactivate(pfn, nr_pages, altmap);
 		return ERR_PTR(-ENOMEM);
 	}
 +	memmap_pages_add(DIV_ROUND_UP(nr_pages * sizeof(struct page), PAGE_SIZE));
 	return memmap;
 }
--- a/debian/patches/patchset-pf/steady/0014-mm-move-page-table-sync-declarations-to-linux-pgtabl.patch
+++ b/debian/patches/patchset-pf/steady/0014-mm-move-page-table-sync-declarations-to-linux-pgtabl.patch
@@ -1,209 +0,0 @@
 From adfa22dd89640042c0df2d8906781ea74da9166c Mon Sep 17 00:00:00 2001
 From: Harry Yoo <harry.yoo@oracle.com>
 Date: Mon, 18 Aug 2025 11:02:04 +0900
 Subject: mm: move page table sync declarations to linux/pgtable.h
 During our internal testing, we started observing intermittent boot
 failures when the machine uses 4-level paging and has a large amount of
 persistent memory:
  BUG: unable to handle page fault for address: ffffe70000000034
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD 0 P4D 0
  Oops: 0002 [#1] SMP NOPTI
  RIP: 0010:__init_single_page+0x9/0x6d
  Call Trace:
   <TASK>
   __init_zone_device_page+0x17/0x5d
   memmap_init_zone_device+0x154/0x1bb
   pagemap_range+0x2e0/0x40f
   memremap_pages+0x10b/0x2f0
   devm_memremap_pages+0x1e/0x60
   dev_dax_probe+0xce/0x2ec [device_dax]
   dax_bus_probe+0x6d/0xc9
   [... snip ...]
   </TASK>
 It turns out that the kernel panics while initializing vmemmap (struct
 page array) when the vmemmap region spans two PGD entries, because the new
 PGD entry is only installed in init_mm.pgd, but not in the page tables of
 other tasks.
 And looking at __populate_section_memmap():
  if (vmemmap_can_optimize(altmap, pgmap))
          // does not sync top level page tables
          r = vmemmap_populate_compound_pages(pfn, start, end, nid, pgmap);
  else
          // sync top level page tables in x86
          r = vmemmap_populate(start, end, nid, altmap);
 In the normal path, vmemmap_populate() in arch/x86/mm/init_64.c
 synchronizes the top level page table (See commit 9b861528a801 ("x86-64,
 mem: Update all PGDs for direct mapping and vmemmap mapping changes")) so
 that all tasks in the system can see the new vmemmap area.
 However, when vmemmap_can_optimize() returns true, the optimized path
 skips synchronization of top-level page tables.  This is because
 vmemmap_populate_compound_pages() is implemented in core MM code, which
 does not handle synchronization of the top-level page tables.  Instead,
 the core MM has historically relied on each architecture to perform this
 synchronization manually.
 We're not the first party to encounter a crash caused by not-sync'd top
 level page tables: earlier this year, Gwan-gyeong Mun attempted to address
 the issue [1] [2] after hitting a kernel panic when x86 code accessed the
 vmemmap area before the corresponding top-level entries were synced.  At
 that time, the issue was believed to be triggered only when struct page
 was enlarged for debugging purposes, and the patch did not get further
 updates.
 It turns out that current approach of relying on each arch to handle the
 page table sync manually is fragile because 1) it's easy to forget to sync
 the top level page table, and 2) it's also easy to overlook that the
 kernel should not access the vmemmap and direct mapping areas before the
 sync.
 To address this, Dave Hansen suggested [3] [4] introducing
 {pgd,p4d}_populate_kernel() for updating kernel portion of the page tables
 and allow each architecture to explicitly perform synchronization when
 installing top-level entries.  With this approach, we no longer need to
 worry about missing the sync step, reducing the risk of future
 regressions.
 The new interface reuses existing ARCH_PAGE_TABLE_SYNC_MASK,
 PGTBL_P*D_MODIFIED and arch_sync_kernel_mappings() facility used by
 vmalloc and ioremap to synchronize page tables.
 pgd_populate_kernel() looks like this:
 static inline void pgd_populate_kernel(unsigned long addr, pgd_t *pgd,
                                       p4d_t *p4d)
 {
        pgd_populate(&init_mm, pgd, p4d);
        if (ARCH_PAGE_TABLE_SYNC_MASK & PGTBL_PGD_MODIFIED)
                arch_sync_kernel_mappings(addr, addr);
 }
 It is worth noting that vmalloc() and apply_to_range() carefully
 synchronizes page tables by calling p*d_alloc_track() and
 arch_sync_kernel_mappings(), and thus they are not affected by this patch
 series.
 This series was hugely inspired by Dave Hansen's suggestion and hence
 added Suggested-by: Dave Hansen.
 Cc stable because lack of this series opens the door to intermittent
 boot failures.
 This patch (of 3):
 Move ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() to
 linux/pgtable.h so that they can be used outside of vmalloc and ioremap.
 Link: https://lkml.kernel.org/r/20250818020206.4517-1-harry.yoo@oracle.com
 Link: https://lkml.kernel.org/r/20250818020206.4517-2-harry.yoo@oracle.com
 Link: https://lore.kernel.org/linux-mm/20250220064105.808339-1-gwan-gyeong.mun@intel.com [1]
 Link: https://lore.kernel.org/linux-mm/20250311114420.240341-1-gwan-gyeong.mun@intel.com [2]
 Link: https://lore.kernel.org/linux-mm/d1da214c-53d3-45ac-a8b6-51821c5416e4@intel.com [3]
 Link: https://lore.kernel.org/linux-mm/4d800744-7b88-41aa-9979-b245e8bf794b@intel.com  [4]
 Fixes: 8d400913c231 ("x86/vmemmap: handle unpopulated sub-pmd ranges")
 Signed-off-by: Harry Yoo <harry.yoo@oracle.com>
 Acked-by: Kiryl Shutsemau <kas@kernel.org>
 Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
 Reviewed-by: "Uladzislau Rezki (Sony)" <urezki@gmail.com>
 Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
 Acked-by: David Hildenbrand <david@redhat.com>
 Cc: Alexander Potapenko <glider@google.com>
 Cc: Alistair Popple <apopple@nvidia.com>
 Cc: Andrey Konovalov <andreyknvl@gmail.com>
 Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
 Cc: Andy Lutomirski <luto@kernel.org>
 Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.ibm.com>
 Cc: Anshuman Khandual <anshuman.khandual@arm.com>
 Cc: Ard Biesheuvel <ardb@kernel.org>
 Cc: Arnd Bergmann <arnd@arndb.de>
 Cc: bibo mao <maobibo@loongson.cn>
 Cc: Borislav Betkov <bp@alien8.de>
 Cc: Christoph Lameter (Ampere) <cl@gentwo.org>
 Cc: Dennis Zhou <dennis@kernel.org>
 Cc: Dev Jain <dev.jain@arm.com>
 Cc: Dmitriy Vyukov <dvyukov@google.com>
 Cc: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
 Cc: Ingo Molnar <mingo@redhat.com>
 Cc: Jane Chu <jane.chu@oracle.com>
 Cc: Joao Martins <joao.m.martins@oracle.com>
 Cc: Joerg Roedel <joro@8bytes.org>
 Cc: John Hubbard <jhubbard@nvidia.com>
 Cc: Kevin Brodsky <kevin.brodsky@arm.com>
 Cc: Liam Howlett <liam.howlett@oracle.com>
 Cc: Michal Hocko <mhocko@suse.com>
 Cc: Oscar Salvador <osalvador@suse.de>
 Cc: Peter Xu <peterx@redhat.com>
 Cc: Peter Zijlstra <peterz@infradead.org>
 Cc: Qi Zheng <zhengqi.arch@bytedance.com>
 Cc: Ryan Roberts <ryan.roberts@arm.com>
 Cc: Suren Baghdasaryan <surenb@google.com>
 Cc: Tejun Heo <tj@kernel.org>
 Cc: Thomas Gleinxer <tglx@linutronix.de>
 Cc: Thomas Huth <thuth@redhat.com>
 Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
 Cc: Vlastimil Babka <vbabka@suse.cz>
 Cc: Dave Hansen <dave.hansen@linux.intel.com>
 Cc: <stable@vger.kernel.org>
 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 ---
 include/linux/pgtable.h | 17 +++++++++++++++++
 include/linux/vmalloc.h | 16 ----------------
 2 files changed, 17 insertions(+), 16 deletions(-)
 --- a/include/linux/pgtable.h
 +++ b/include/linux/pgtable.h
@@ -1329,6 +1329,23 @@ static inline void ptep_modify_prot_comm
 	__ptep_modify_prot_commit(vma, addr, ptep, pte);
 }
 #endif /* __HAVE_ARCH_PTEP_MODIFY_PROT_TRANSACTION */
 +
 +/*
 + * Architectures can set this mask to a combination of PGTBL_P?D_MODIFIED values
 + * and let generic vmalloc and ioremap code know when arch_sync_kernel_mappings()
 + * needs to be called.
 + */
 +#ifndef ARCH_PAGE_TABLE_SYNC_MASK
 +#define ARCH_PAGE_TABLE_SYNC_MASK 0
 +#endif
 +
 +/*
 + * There is no default implementation for arch_sync_kernel_mappings(). It is
 + * relied upon the compiler to optimize calls out if ARCH_PAGE_TABLE_SYNC_MASK
 + * is 0.
 + */
 +void arch_sync_kernel_mappings(unsigned long start, unsigned long end);
 +
 #endif /* CONFIG_MMU */
 /*
 --- a/include/linux/vmalloc.h
 +++ b/include/linux/vmalloc.h
@@ -220,22 +220,6 @@ int vmap_pages_range(unsigned long addr,
 		     struct page **pages, unsigned int page_shift);
 /*
 - * Architectures can set this mask to a combination of PGTBL_P?D_MODIFIED values
 - * and let generic vmalloc and ioremap code know when arch_sync_kernel_mappings()
 - * needs to be called.
 - */
 -#ifndef ARCH_PAGE_TABLE_SYNC_MASK
 -#define ARCH_PAGE_TABLE_SYNC_MASK 0
 -#endif
 -
 -/*
 - * There is no default implementation for arch_sync_kernel_mappings(). It is
 - * relied upon the compiler to optimize calls out if ARCH_PAGE_TABLE_SYNC_MASK
 - * is 0.
 - */
 -void arch_sync_kernel_mappings(unsigned long start, unsigned long end);
 -
 -/*
  *	Lowlevel-APIs (not for driver use!)
  */
--- a/debian/patches/patchset-pf/steady/0015-mm-introduce-and-use-pgd-p4d-_populate_kernel.patch
+++ b/debian/patches/patchset-pf/steady/0015-mm-introduce-and-use-pgd-p4d-_populate_kernel.patch
@@ -1,278 +0,0 @@
 From ed7c5f96ef6426a46c255706667dde67063110cb Mon Sep 17 00:00:00 2001
 From: Harry Yoo <harry.yoo@oracle.com>
 Date: Mon, 18 Aug 2025 11:02:05 +0900
 Subject: mm: introduce and use {pgd,p4d}_populate_kernel()
 Introduce and use {pgd,p4d}_populate_kernel() in core MM code when
 populating PGD and P4D entries for the kernel address space.  These
 helpers ensure proper synchronization of page tables when updating the
 kernel portion of top-level page tables.
 Until now, the kernel has relied on each architecture to handle
 synchronization of top-level page tables in an ad-hoc manner.  For
 example, see commit 9b861528a801 ("x86-64, mem: Update all PGDs for direct
 mapping and vmemmap mapping changes").
 However, this approach has proven fragile for following reasons:
  1) It is easy to forget to perform the necessary page table
     synchronization when introducing new changes.
     For instance, commit 4917f55b4ef9 ("mm/sparse-vmemmap: improve memory
     savings for compound devmaps") overlooked the need to synchronize
     page tables for the vmemmap area.
  2) It is also easy to overlook that the vmemmap and direct mapping areas
     must not be accessed before explicit page table synchronization.
     For example, commit 8d400913c231 ("x86/vmemmap: handle unpopulated
     sub-pmd ranges")) caused crashes by accessing the vmemmap area
     before calling sync_global_pgds().
 To address this, as suggested by Dave Hansen, introduce _kernel() variants
 of the page table population helpers, which invoke architecture-specific
 hooks to properly synchronize page tables.  These are introduced in a new
 header file, include/linux/pgalloc.h, so they can be called from common
 code.
 They reuse existing infrastructure for vmalloc and ioremap.
 Synchronization requirements are determined by ARCH_PAGE_TABLE_SYNC_MASK,
 and the actual synchronization is performed by
 arch_sync_kernel_mappings().
 This change currently targets only x86_64, so only PGD and P4D level
 helpers are introduced.  Currently, these helpers are no-ops since no
 architecture sets PGTBL_{PGD,P4D}_MODIFIED in ARCH_PAGE_TABLE_SYNC_MASK.
 In theory, PUD and PMD level helpers can be added later if needed by other
 architectures.  For now, 32-bit architectures (x86-32 and arm) only handle
 PGTBL_PMD_MODIFIED, so p*d_populate_kernel() will never affect them unless
 we introduce a PMD level helper.
 [harry.yoo@oracle.com: fix KASAN build error due to p*d_populate_kernel()]
  Link: https://lkml.kernel.org/r/20250822020727.202749-1-harry.yoo@oracle.com
 Link: https://lkml.kernel.org/r/20250818020206.4517-3-harry.yoo@oracle.com
 Fixes: 8d400913c231 ("x86/vmemmap: handle unpopulated sub-pmd ranges")
 Signed-off-by: Harry Yoo <harry.yoo@oracle.com>
 Suggested-by: Dave Hansen <dave.hansen@linux.intel.com>
 Acked-by: Kiryl Shutsemau <kas@kernel.org>
 Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
 Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
 Acked-by: David Hildenbrand <david@redhat.com>
 Cc: Alexander Potapenko <glider@google.com>
 Cc: Alistair Popple <apopple@nvidia.com>
 Cc: Andrey Konovalov <andreyknvl@gmail.com>
 Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
 Cc: Andy Lutomirski <luto@kernel.org>
 Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.ibm.com>
 Cc: Anshuman Khandual <anshuman.khandual@arm.com>
 Cc: Ard Biesheuvel <ardb@kernel.org>
 Cc: Arnd Bergmann <arnd@arndb.de>
 Cc: bibo mao <maobibo@loongson.cn>
 Cc: Borislav Betkov <bp@alien8.de>
 Cc: Christoph Lameter (Ampere) <cl@gentwo.org>
 Cc: Dennis Zhou <dennis@kernel.org>
 Cc: Dev Jain <dev.jain@arm.com>
 Cc: Dmitriy Vyukov <dvyukov@google.com>
 Cc: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
 Cc: Ingo Molnar <mingo@redhat.com>
 Cc: Jane Chu <jane.chu@oracle.com>
 Cc: Joao Martins <joao.m.martins@oracle.com>
 Cc: Joerg Roedel <joro@8bytes.org>
 Cc: John Hubbard <jhubbard@nvidia.com>
 Cc: Kevin Brodsky <kevin.brodsky@arm.com>
 Cc: Liam Howlett <liam.howlett@oracle.com>
 Cc: Michal Hocko <mhocko@suse.com>
 Cc: Oscar Salvador <osalvador@suse.de>
 Cc: Peter Xu <peterx@redhat.com>
 Cc: Peter Zijlstra <peterz@infradead.org>
 Cc: Qi Zheng <zhengqi.arch@bytedance.com>
 Cc: Ryan Roberts <ryan.roberts@arm.com>
 Cc: Suren Baghdasaryan <surenb@google.com>
 Cc: Tejun Heo <tj@kernel.org>
 Cc: Thomas Gleinxer <tglx@linutronix.de>
 Cc: Thomas Huth <thuth@redhat.com>
 Cc: "Uladzislau Rezki (Sony)" <urezki@gmail.com>
 Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
 Cc: Vlastimil Babka <vbabka@suse.cz>
 Cc: <stable@vger.kernel.org>
 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 ---
 include/linux/pgalloc.h | 29 +++++++++++++++++++++++++++++
 include/linux/pgtable.h | 13 +++++++------
 mm/kasan/init.c         | 12 ++++++------
 mm/percpu.c             |  6 +++---
 mm/sparse-vmemmap.c     |  6 +++---
 5 files changed, 48 insertions(+), 18 deletions(-)
 create mode 100644 include/linux/pgalloc.h
 --- /dev/null
 +++ b/include/linux/pgalloc.h
@@ -0,0 +1,29 @@
 +/* SPDX-License-Identifier: GPL-2.0 */
 +#ifndef _LINUX_PGALLOC_H
 +#define _LINUX_PGALLOC_H
 +
 +#include <linux/pgtable.h>
 +#include <asm/pgalloc.h>
 +
 +/*
 + * {pgd,p4d}_populate_kernel() are defined as macros to allow
 + * compile-time optimization based on the configured page table levels.
 + * Without this, linking may fail because callers (e.g., KASAN) may rely
 + * on calls to these functions being optimized away when passing symbols
 + * that exist only for certain page table levels.
 + */
 +#define pgd_populate_kernel(addr, pgd, p4d)				\
 +	do {								\
 +		pgd_populate(&init_mm, pgd, p4d);			\
 +		if (ARCH_PAGE_TABLE_SYNC_MASK & PGTBL_PGD_MODIFIED)	\
 +			arch_sync_kernel_mappings(addr, addr);		\
 +	} while (0)
 +
 +#define p4d_populate_kernel(addr, p4d, pud)				\
 +	do {								\
 +		p4d_populate(&init_mm, p4d, pud);			\
 +		if (ARCH_PAGE_TABLE_SYNC_MASK & PGTBL_P4D_MODIFIED)	\
 +			arch_sync_kernel_mappings(addr, addr);		\
 +	} while (0)
 +
 +#endif /* _LINUX_PGALLOC_H */
 --- a/include/linux/pgtable.h
 +++ b/include/linux/pgtable.h
@@ -1332,8 +1332,8 @@ static inline void ptep_modify_prot_comm
 /*
  * Architectures can set this mask to a combination of PGTBL_P?D_MODIFIED values
 - * and let generic vmalloc and ioremap code know when arch_sync_kernel_mappings()
 - * needs to be called.
 + * and let generic vmalloc, ioremap and page table update code know when
 + * arch_sync_kernel_mappings() needs to be called.
  */
 #ifndef ARCH_PAGE_TABLE_SYNC_MASK
 #define ARCH_PAGE_TABLE_SYNC_MASK 0
@@ -1832,10 +1832,11 @@ static inline bool arch_has_pfn_modify_c
 /*
  * Page Table Modification bits for pgtbl_mod_mask.
  *
 - * These are used by the p?d_alloc_track*() set of functions an in the generic
 - * vmalloc/ioremap code to track at which page-table levels entries have been
 - * modified. Based on that the code can better decide when vmalloc and ioremap
 - * mapping changes need to be synchronized to other page-tables in the system.
 + * These are used by the p?d_alloc_track*() and p*d_populate_kernel()
 + * functions in the generic vmalloc, ioremap and page table update code
 + * to track at which page-table levels entries have been modified.
 + * Based on that the code can better decide when page table changes need
 + * to be synchronized to other page-tables in the system.
  */
 #define		__PGTBL_PGD_MODIFIED	0
 #define		__PGTBL_P4D_MODIFIED	1
 --- a/mm/kasan/init.c
 +++ b/mm/kasan/init.c
@@ -13,9 +13,9 @@
 #include <linux/mm.h>
 #include <linux/pfn.h>
 #include <linux/slab.h>
 +#include <linux/pgalloc.h>
 #include <asm/page.h>
 -#include <asm/pgalloc.h>
 #include "kasan.h"
@@ -191,7 +191,7 @@ static int __ref zero_p4d_populate(pgd_t
 			pud_t *pud;
 			pmd_t *pmd;
 -			p4d_populate(&init_mm, p4d,
 +			p4d_populate_kernel(addr, p4d,
 					lm_alias(kasan_early_shadow_pud));
 			pud = pud_offset(p4d, addr);
 			pud_populate(&init_mm, pud,
@@ -212,7 +212,7 @@ static int __ref zero_p4d_populate(pgd_t
 			} else {
 				p = early_alloc(PAGE_SIZE, NUMA_NO_NODE);
 				pud_init(p);
 -				p4d_populate(&init_mm, p4d, p);
 +				p4d_populate_kernel(addr, p4d, p);
 			}
 		}
 		zero_pud_populate(p4d, addr, next);
@@ -251,10 +251,10 @@ int __ref kasan_populate_early_shadow(co
 			 * puds,pmds, so pgd_populate(), pud_populate()
 			 * is noops.
 			 */
 -			pgd_populate(&init_mm, pgd,
 +			pgd_populate_kernel(addr, pgd,
 					lm_alias(kasan_early_shadow_p4d));
 			p4d = p4d_offset(pgd, addr);
 -			p4d_populate(&init_mm, p4d,
 +			p4d_populate_kernel(addr, p4d,
 					lm_alias(kasan_early_shadow_pud));
 			pud = pud_offset(p4d, addr);
 			pud_populate(&init_mm, pud,
@@ -273,7 +273,7 @@ int __ref kasan_populate_early_shadow(co
 				if (!p)
 					return -ENOMEM;
 			} else {
 -				pgd_populate(&init_mm, pgd,
 +				pgd_populate_kernel(addr, pgd,
 					early_alloc(PAGE_SIZE, NUMA_NO_NODE));
 			}
 		}
 --- a/mm/percpu.c
 +++ b/mm/percpu.c
@@ -3108,7 +3108,7 @@ out_free:
 #endif /* BUILD_EMBED_FIRST_CHUNK */
 #ifdef BUILD_PAGE_FIRST_CHUNK
 -#include <asm/pgalloc.h>
 +#include <linux/pgalloc.h>
 #ifndef P4D_TABLE_SIZE
 #define P4D_TABLE_SIZE PAGE_SIZE
@@ -3134,13 +3134,13 @@ void __init __weak pcpu_populate_pte(uns
 	if (pgd_none(*pgd)) {
 		p4d = memblock_alloc_or_panic(P4D_TABLE_SIZE, P4D_TABLE_SIZE);
 -		pgd_populate(&init_mm, pgd, p4d);
 +		pgd_populate_kernel(addr, pgd, p4d);
 	}
 	p4d = p4d_offset(pgd, addr);
 	if (p4d_none(*p4d)) {
 		pud = memblock_alloc_or_panic(PUD_TABLE_SIZE, PUD_TABLE_SIZE);
 -		p4d_populate(&init_mm, p4d, pud);
 +		p4d_populate_kernel(addr, p4d, pud);
 	}
 	pud = pud_offset(p4d, addr);
 --- a/mm/sparse-vmemmap.c
 +++ b/mm/sparse-vmemmap.c
@@ -27,9 +27,9 @@
 #include <linux/spinlock.h>
 #include <linux/vmalloc.h>
 #include <linux/sched.h>
 +#include <linux/pgalloc.h>
 #include <asm/dma.h>
 -#include <asm/pgalloc.h>
 #include <asm/tlbflush.h>
 #include "hugetlb_vmemmap.h"
@@ -229,7 +229,7 @@ p4d_t * __meminit vmemmap_p4d_populate(p
 		if (!p)
 			return NULL;
 		pud_init(p);
 -		p4d_populate(&init_mm, p4d, p);
 +		p4d_populate_kernel(addr, p4d, p);
 	}
 	return p4d;
 }
@@ -241,7 +241,7 @@ pgd_t * __meminit vmemmap_pgd_populate(u
 		void *p = vmemmap_alloc_block_zero(PAGE_SIZE, node);
 		if (!p)
 			return NULL;
 -		pgd_populate(&init_mm, pgd, p);
 +		pgd_populate_kernel(addr, pgd, p);
 	}
 	return pgd;
 }
--- a/debian/patches/patchset-pf/steady/0016-x86-mm-64-define-ARCH_PAGE_TABLE_SYNC_MASK-and-arch_.patch
+++ b/debian/patches/patchset-pf/steady/0016-x86-mm-64-define-ARCH_PAGE_TABLE_SYNC_MASK-and-arch_.patch
@@ -1,149 +0,0 @@
 From 2bde279ccdb076a93a167ab4a2b7202e46d83a2f Mon Sep 17 00:00:00 2001
 From: Harry Yoo <harry.yoo@oracle.com>
 Date: Mon, 18 Aug 2025 11:02:06 +0900
 Subject: x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and
 arch_sync_kernel_mappings()
 Define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() to ensure
 page tables are properly synchronized when calling p*d_populate_kernel().
 For 5-level paging, synchronization is performed via
 pgd_populate_kernel().  In 4-level paging, pgd_populate() is a no-op, so
 synchronization is instead performed at the P4D level via
 p4d_populate_kernel().
 This fixes intermittent boot failures on systems using 4-level paging and
 a large amount of persistent memory:
  BUG: unable to handle page fault for address: ffffe70000000034
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD 0 P4D 0
  Oops: 0002 [#1] SMP NOPTI
  RIP: 0010:__init_single_page+0x9/0x6d
  Call Trace:
   <TASK>
   __init_zone_device_page+0x17/0x5d
   memmap_init_zone_device+0x154/0x1bb
   pagemap_range+0x2e0/0x40f
   memremap_pages+0x10b/0x2f0
   devm_memremap_pages+0x1e/0x60
   dev_dax_probe+0xce/0x2ec [device_dax]
   dax_bus_probe+0x6d/0xc9
   [... snip ...]
   </TASK>
 It also fixes a crash in vmemmap_set_pmd() caused by accessing vmemmap
 before sync_global_pgds() [1]:
  BUG: unable to handle page fault for address: ffffeb3ff1200000
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD 0 P4D 0
  Oops: Oops: 0002 [#1] PREEMPT SMP NOPTI
  Tainted: [W]=WARN
  RIP: 0010:vmemmap_set_pmd+0xff/0x230
   <TASK>
   vmemmap_populate_hugepages+0x176/0x180
   vmemmap_populate+0x34/0x80
   __populate_section_memmap+0x41/0x90
   sparse_add_section+0x121/0x3e0
   __add_pages+0xba/0x150
   add_pages+0x1d/0x70
   memremap_pages+0x3dc/0x810
   devm_memremap_pages+0x1c/0x60
   xe_devm_add+0x8b/0x100 [xe]
   xe_tile_init_noalloc+0x6a/0x70 [xe]
   xe_device_probe+0x48c/0x740 [xe]
   [... snip ...]
 Link: https://lkml.kernel.org/r/20250818020206.4517-4-harry.yoo@oracle.com
 Fixes: 8d400913c231 ("x86/vmemmap: handle unpopulated sub-pmd ranges")
 Signed-off-by: Harry Yoo <harry.yoo@oracle.com>
 Closes: https://lore.kernel.org/linux-mm/20250311114420.240341-1-gwan-gyeong.mun@intel.com [1]
 Suggested-by: Dave Hansen <dave.hansen@linux.intel.com>
 Acked-by: Kiryl Shutsemau <kas@kernel.org>
 Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
 Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
 Acked-by: David Hildenbrand <david@redhat.com>
 Cc: Alexander Potapenko <glider@google.com>
 Cc: Alistair Popple <apopple@nvidia.com>
 Cc: Andrey Konovalov <andreyknvl@gmail.com>
 Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
 Cc: Andy Lutomirski <luto@kernel.org>
 Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.ibm.com>
 Cc: Anshuman Khandual <anshuman.khandual@arm.com>
 Cc: Ard Biesheuvel <ardb@kernel.org>
 Cc: Arnd Bergmann <arnd@arndb.de>
 Cc: bibo mao <maobibo@loongson.cn>
 Cc: Borislav Betkov <bp@alien8.de>
 Cc: Christoph Lameter (Ampere) <cl@gentwo.org>
 Cc: Dennis Zhou <dennis@kernel.org>
 Cc: Dev Jain <dev.jain@arm.com>
 Cc: Dmitriy Vyukov <dvyukov@google.com>
 Cc: Ingo Molnar <mingo@redhat.com>
 Cc: Jane Chu <jane.chu@oracle.com>
 Cc: Joao Martins <joao.m.martins@oracle.com>
 Cc: Joerg Roedel <joro@8bytes.org>
 Cc: John Hubbard <jhubbard@nvidia.com>
 Cc: Kevin Brodsky <kevin.brodsky@arm.com>
 Cc: Liam Howlett <liam.howlett@oracle.com>
 Cc: Michal Hocko <mhocko@suse.com>
 Cc: Oscar Salvador <osalvador@suse.de>
 Cc: Peter Xu <peterx@redhat.com>
 Cc: Peter Zijlstra <peterz@infradead.org>
 Cc: Qi Zheng <zhengqi.arch@bytedance.com>
 Cc: Ryan Roberts <ryan.roberts@arm.com>
 Cc: Suren Baghdasaryan <surenb@google.com>
 Cc: Tejun Heo <tj@kernel.org>
 Cc: Thomas Gleinxer <tglx@linutronix.de>
 Cc: Thomas Huth <thuth@redhat.com>
 Cc: "Uladzislau Rezki (Sony)" <urezki@gmail.com>
 Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
 Cc: Vlastimil Babka <vbabka@suse.cz>
 Cc: <stable@vger.kernel.org>
 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 ---
 arch/x86/include/asm/pgtable_64_types.h |  3 +++
 arch/x86/mm/init_64.c                   | 18 ++++++++++++++++++
 2 files changed, 21 insertions(+)
 --- a/arch/x86/include/asm/pgtable_64_types.h
 +++ b/arch/x86/include/asm/pgtable_64_types.h
@@ -36,6 +36,9 @@ static inline bool pgtable_l5_enabled(vo
 #define pgtable_l5_enabled() cpu_feature_enabled(X86_FEATURE_LA57)
 #endif /* USE_EARLY_PGTABLE_L5 */
 +#define ARCH_PAGE_TABLE_SYNC_MASK \
 +	(pgtable_l5_enabled() ? PGTBL_PGD_MODIFIED : PGTBL_P4D_MODIFIED)
 +
 extern unsigned int pgdir_shift;
 extern unsigned int ptrs_per_p4d;
 --- a/arch/x86/mm/init_64.c
 +++ b/arch/x86/mm/init_64.c
@@ -224,6 +224,24 @@ static void sync_global_pgds(unsigned lo
 }
 /*
 + * Make kernel mappings visible in all page tables in the system.
 + * This is necessary except when the init task populates kernel mappings
 + * during the boot process. In that case, all processes originating from
 + * the init task copies the kernel mappings, so there is no issue.
 + * Otherwise, missing synchronization could lead to kernel crashes due
 + * to missing page table entries for certain kernel mappings.
 + *
 + * Synchronization is performed at the top level, which is the PGD in
 + * 5-level paging systems. But in 4-level paging systems, however,
 + * pgd_populate() is a no-op, so synchronization is done at the P4D level.
 + * sync_global_pgds() handles this difference between paging levels.
 + */
 +void arch_sync_kernel_mappings(unsigned long start, unsigned long end)
 +{
 +	sync_global_pgds(start, end);
 +}
 +
 +/*
  * NOTE: This function is marked __ref because it calls __init function
  * (alloc_bootmem_pages). It's safe to do it ONLY when after_bootmem == 0.
  */
--- a/debian/patches/patchset-pf/steady/0017-ALSA-hda-tas2781-fix-tas2563-EFI-data-endianness.patch
+++ b/debian/patches/patchset-pf/steady/0017-ALSA-hda-tas2781-fix-tas2563-EFI-data-endianness.patch
@@ -1,41 +0,0 @@
 From 8622915ef6b2bdd5779ebe986d9ad1a360246377 Mon Sep 17 00:00:00 2001
 From: Gergo Koteles <soyer@irl.hu>
 Date: Fri, 29 Aug 2025 18:04:49 +0200
 Subject: ALSA: hda: tas2781: fix tas2563 EFI data endianness
 Before conversion to unify the calibration data management, the
 tas2563_apply_calib() function performed the big endian conversion and
 wrote the calibration data to the device. The writing is now done by the
 common tasdev_load_calibrated_data() function, but without conversion.
 Put the values into the calibration data buffer with the expected
 endianness.
 Fixes: 4fe238513407 ("ALSA: hda/tas2781: Move and unified the calibrated-data getting function for SPI and I2C into the tas2781_hda lib")
 Cc: <stable@vger.kernel.org>
 Signed-off-by: Gergo Koteles <soyer@irl.hu>
 Link: https://patch.msgid.link/20250829160450.66623-1-soyer@irl.hu
 Signed-off-by: Takashi Iwai <tiwai@suse.de>
 ---
 sound/pci/hda/tas2781_hda_i2c.c | 3 +++
 1 file changed, 3 insertions(+)
 --- a/sound/pci/hda/tas2781_hda_i2c.c
 +++ b/sound/pci/hda/tas2781_hda_i2c.c
@@ -292,6 +292,7 @@ static int tas2563_save_calibration(stru
 	struct cali_reg *r = &cd->cali_reg_array;
 	unsigned int offset = 0;
 	unsigned char *data;
 +	__be32 bedata;
 	efi_status_t status;
 	unsigned int attr;
 	int ret, i, j, k;
@@ -333,6 +334,8 @@ static int tas2563_save_calibration(stru
 					i, j, status);
 				return -EINVAL;
 			}
 +			bedata = cpu_to_be32(*(uint32_t *)&data[offset]);
 +			memcpy(&data[offset], &bedata, sizeof(bedata));
 			offset += TAS2563_CAL_DATA_SIZE;
 		}
 	}
--- a/debian/patches/patchset-pf/steady/0018-ALSA-hda-tas2781-reorder-tas2563-calibration-variabl.patch
+++ b/debian/patches/patchset-pf/steady/0018-ALSA-hda-tas2781-reorder-tas2563-calibration-variabl.patch
@@ -1,32 +0,0 @@
 From b5891607a373a8585971c9365748382bfdd7dc6f Mon Sep 17 00:00:00 2001
 From: Gergo Koteles <soyer@irl.hu>
 Date: Fri, 29 Aug 2025 18:04:50 +0200
 Subject: ALSA: hda: tas2781: reorder tas2563 calibration variables
 The tasdev_load_calibrated_data() function expects the calibration data
 values in the cali_data buffer as R0, R0Low, InvR0, Power, TLim which
 is not the same as what tas2563_save_calibration() writes to the buffer.
 Reorder the EFI variables in the tas2563_save_calibration() function
 to put the values in the buffer in the correct order.
 Fixes: 4fe238513407 ("ALSA: hda/tas2781: Move and unified the calibrated-data getting function for SPI and I2C into the tas2781_hda lib")
 Cc: <stable@vger.kernel.org>
 Signed-off-by: Gergo Koteles <soyer@irl.hu>
 Link: https://patch.msgid.link/20250829160450.66623-2-soyer@irl.hu
 Signed-off-by: Takashi Iwai <tiwai@suse.de>
 ---
 sound/pci/hda/tas2781_hda_i2c.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 --- a/sound/pci/hda/tas2781_hda_i2c.c
 +++ b/sound/pci/hda/tas2781_hda_i2c.c
@@ -282,7 +282,7 @@ static int tas2563_save_calibration(stru
 {
 	efi_guid_t efi_guid = tasdev_fct_efi_guid[LENOVO];
 	char *vars[TASDEV_CALIB_N] = {
 -		"R0_%d", "InvR0_%d", "R0_Low_%d", "Power_%d", "TLim_%d"
 +		"R0_%d", "R0_Low_%d", "InvR0_%d", "Power_%d", "TLim_%d"
 	};
 	efi_char16_t efi_name[TAS2563_CAL_VAR_NAME_MAX];
 	unsigned long max_size = TAS2563_CAL_DATA_SIZE;
--- a/debian/patches/patchset-pf/steady/0019-ALSA-hda-hdmi-Add-pin-fix-for-another-HP-EliteDesk-8.patch
+++ b/debian/patches/patchset-pf/steady/0019-ALSA-hda-hdmi-Add-pin-fix-for-another-HP-EliteDesk-8.patch
@@ -1,26 +0,0 @@
 From 25878599a2cfe0b5bd6c6cd5a978aa3f05cb9afd Mon Sep 17 00:00:00 2001
 From: Takashi Iwai <tiwai@suse.de>
 Date: Mon, 1 Sep 2025 13:50:08 +0200
 Subject: ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
 It was reported that HP EliteDesk 800 G4 DM 65W (SSID 103c:845a) needs
 the similar quirk for enabling HDMI outputs, too.  This patch adds the
 corresponding quirk entry.
 Cc: <stable@vger.kernel.org>
 Link: https://patch.msgid.link/20250901115009.27498-1-tiwai@suse.de
 Signed-off-by: Takashi Iwai <tiwai@suse.de>
 ---
 sound/pci/hda/patch_hdmi.c | 1 +
 1 file changed, 1 insertion(+)
 --- a/sound/pci/hda/patch_hdmi.c
 +++ b/sound/pci/hda/patch_hdmi.c
@@ -1991,6 +1991,7 @@ static int hdmi_add_cvt(struct hda_codec
 static const struct snd_pci_quirk force_connect_list[] = {
 	SND_PCI_QUIRK(0x103c, 0x83e2, "HP EliteDesk 800 G4", 1),
 	SND_PCI_QUIRK(0x103c, 0x83ef, "HP MP9 G4 Retail System AMS", 1),
 +	SND_PCI_QUIRK(0x103c, 0x845a, "HP EliteDesk 800 G4 DM 65W", 1),
 	SND_PCI_QUIRK(0x103c, 0x870f, "HP", 1),
 	SND_PCI_QUIRK(0x103c, 0x871a, "HP", 1),
 	SND_PCI_QUIRK(0x103c, 0x8711, "HP", 1),
--- a/debian/patches/patchset-pf/steady/0020-mm-fix-possible-deadlock-in-kmemleak.patch
+++ b/debian/patches/patchset-pf/steady/0020-mm-fix-possible-deadlock-in-kmemleak.patch
@@ -1,110 +0,0 @@
 From 8b190cfe2c3ec71bbb031dcf4eab072a4c83c289 Mon Sep 17 00:00:00 2001
 From: Gu Bowen <gubowen5@huawei.com>
 Date: Fri, 22 Aug 2025 15:35:41 +0800
 Subject: mm: fix possible deadlock in kmemleak
 There are some AA deadlock issues in kmemleak, similar to the situation
 reported by Breno [1].  The deadlock path is as follows:
 mem_pool_alloc()
  -> raw_spin_lock_irqsave(&kmemleak_lock, flags);
      -> pr_warn()
          -> netconsole subsystem
 	     -> netpoll
 	         -> __alloc_skb
 		   -> __create_object
 		     -> raw_spin_lock_irqsave(&kmemleak_lock, flags);
 To solve this problem, switch to printk_safe mode before printing warning
 message, this will redirect all printk()-s to a special per-CPU buffer,
 which will be flushed later from a safe context (irq work), and this
 deadlock problem can be avoided.  The proper API to use should be
 printk_deferred_enter()/printk_deferred_exit() [2].  Another way is to
 place the warn print after kmemleak is released.
 Link: https://lkml.kernel.org/r/20250822073541.1886469-1-gubowen5@huawei.com
 Link: https://lore.kernel.org/all/20250731-kmemleak_lock-v1-1-728fd470198f@debian.org/#t [1]
 Link: https://lore.kernel.org/all/5ca375cd-4a20-4807-b897-68b289626550@redhat.com/ [2]
 Signed-off-by: Gu Bowen <gubowen5@huawei.com>
 Reviewed-by: Waiman Long <longman@redhat.com>
 Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
 Reviewed-by: Breno Leitao <leitao@debian.org>
 Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 Cc: John Ogness <john.ogness@linutronix.de>
 Cc: Lu Jialin <lujialin4@huawei.com>
 Cc: Petr Mladek <pmladek@suse.com>
 Cc: <stable@vger.kernel.org>
 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 ---
 mm/kmemleak.c | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)
 --- a/mm/kmemleak.c
 +++ b/mm/kmemleak.c
@@ -437,9 +437,15 @@ static struct kmemleak_object *__lookup_
 		else if (untagged_objp == untagged_ptr || alias)
 			return object;
 		else {
 +			/*
 +			 * Printk deferring due to the kmemleak_lock held.
 +			 * This is done to avoid deadlock.
 +			 */
 +			printk_deferred_enter();
 			kmemleak_warn("Found object by alias at 0x%08lx\n",
 				      ptr);
 			dump_object_info(object);
 +			printk_deferred_exit();
 			break;
 		}
 	}
@@ -736,6 +742,11 @@ static int __link_object(struct kmemleak
 		else if (untagged_objp + parent->size <= untagged_ptr)
 			link = &parent->rb_node.rb_right;
 		else {
 +			/*
 +			 * Printk deferring due to the kmemleak_lock held.
 +			 * This is done to avoid deadlock.
 +			 */
 +			printk_deferred_enter();
 			kmemleak_stop("Cannot insert 0x%lx into the object search tree (overlaps existing)\n",
 				      ptr);
 			/*
@@ -743,6 +754,7 @@ static int __link_object(struct kmemleak
 			 * be freed while the kmemleak_lock is held.
 			 */
 			dump_object_info(parent);
 +			printk_deferred_exit();
 			return -EEXIST;
 		}
 	}
@@ -856,13 +868,8 @@ static void delete_object_part(unsigned
 	raw_spin_lock_irqsave(&kmemleak_lock, flags);
 	object = __find_and_remove_object(ptr, 1, objflags);
 -	if (!object) {
 -#ifdef DEBUG
 -		kmemleak_warn("Partially freeing unknown object at 0x%08lx (size %zu)\n",
 -			      ptr, size);
 -#endif
 +	if (!object)
 		goto unlock;
 -	}
 	/*
 	 * Create one or two objects that may result from the memory block
@@ -882,8 +889,14 @@ static void delete_object_part(unsigned
 unlock:
 	raw_spin_unlock_irqrestore(&kmemleak_lock, flags);
 -	if (object)
 +	if (object) {
 		__delete_object(object);
 +	} else {
 +#ifdef DEBUG
 +		kmemleak_warn("Partially freeing unknown object at 0x%08lx (size %zu)\n",
 +			      ptr, size);
 +#endif
 +	}
 out:
 	if (object_l)
--- a/debian/patches/patchset-pf/steady/0021-kasan-fix-GCC-mem-intrinsic-prefix-with-sw-tags.patch
+++ b/debian/patches/patchset-pf/steady/0021-kasan-fix-GCC-mem-intrinsic-prefix-with-sw-tags.patch
@@ -1,69 +0,0 @@
 From 50b23170b0c522695761d31faafceb68ccab6d87 Mon Sep 17 00:00:00 2001
 From: Ada Couprie Diaz <ada.coupriediaz@arm.com>
 Date: Thu, 21 Aug 2025 13:07:35 +0100
 Subject: kasan: fix GCC mem-intrinsic prefix with sw tags
 GCC doesn't support "hwasan-kernel-mem-intrinsic-prefix", only
 "asan-kernel-mem-intrinsic-prefix"[0], while LLVM supports both.  This is
 already taken into account when checking
 "CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX", but not in the KASAN Makefile
 adding those parameters when "CONFIG_KASAN_SW_TAGS" is enabled.
 Replace the version check with "CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX",
 which already validates that mem-intrinsic prefix parameter can be used,
 and choose the correct name depending on compiler.
 GCC 13 and above trigger "CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX" which
 prevents `mem{cpy,move,set}()` being redefined in "mm/kasan/shadow.c"
 since commit 36be5cba99f6 ("kasan: treat meminstrinsic as builtins in
 uninstrumented files"), as we expect the compiler to prefix those calls
 with `__(hw)asan_` instead.  But as the option passed to GCC has been
 incorrect, the compiler has not been emitting those prefixes, effectively
 never calling the instrumented versions of `mem{cpy,move,set}()` with
 "CONFIG_KASAN_SW_TAGS" enabled.
 If "CONFIG_FORTIFY_SOURCES" is enabled, this issue would be mitigated as
 it redefines `mem{cpy,move,set}()` and properly aliases the
 `__underlying_mem*()` that will be called to the instrumented versions.
 Link: https://lkml.kernel.org/r/20250821120735.156244-1-ada.coupriediaz@arm.com
 Link: https://gcc.gnu.org/onlinedocs/gcc-13.4.0/gcc/Optimize-Options.html [0]
 Signed-off-by: Ada Couprie Diaz <ada.coupriediaz@arm.com>
 Fixes: 36be5cba99f6 ("kasan: treat meminstrinsic as builtins in uninstrumented files")
 Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
 Cc: Alexander Potapenko <glider@google.com>
 Cc: Andrey Konovalov <andreyknvl@gmail.com>
 Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
 Cc: Dmitriy Vyukov <dvyukov@google.com>
 Cc: Marco Elver <elver@google.com>
 Cc: Marc Rutland <mark.rutland@arm.com>
 Cc: Michael Ellerman <mpe@ellerman.id.au>
 Cc: Nathan Chancellor <nathan@kernel.org>
 Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
 Cc: <stable@vger.kernel.org>
 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 ---
 scripts/Makefile.kasan | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)
 --- a/scripts/Makefile.kasan
 +++ b/scripts/Makefile.kasan
@@ -86,10 +86,14 @@ kasan_params += hwasan-instrument-stack=
 		hwasan-use-short-granules=0 \
 		hwasan-inline-all-checks=0
 -# Instrument memcpy/memset/memmove calls by using instrumented __hwasan_mem*().
 -ifeq ($(call clang-min-version, 150000)$(call gcc-min-version, 130000),y)
 -	kasan_params += hwasan-kernel-mem-intrinsic-prefix=1
 -endif
 +# Instrument memcpy/memset/memmove calls by using instrumented __(hw)asan_mem*().
 +ifdef CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX
 +	ifdef CONFIG_CC_IS_GCC
 +		kasan_params += asan-kernel-mem-intrinsic-prefix=1
 +	else
 +		kasan_params += hwasan-kernel-mem-intrinsic-prefix=1
 +	endif
 +endif # CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX
 endif # CONFIG_KASAN_SW_TAGS
--- a/debian/patches/patchset-pf/steady/0022-sched-Fix-sched_numa_find_nth_cpu-if-mask-offline.patch
+++ b/debian/patches/patchset-pf/steady/0022-sched-Fix-sched_numa_find_nth_cpu-if-mask-offline.patch
@@ -1,105 +0,0 @@
 From a2324e3cf5378205b4a18c3fa2cfe702a26f81d4 Mon Sep 17 00:00:00 2001
 From: Christian Loehle <christian.loehle@arm.com>
 Date: Wed, 3 Sep 2025 16:48:32 +0100
 Subject: sched: Fix sched_numa_find_nth_cpu() if mask offline
 sched_numa_find_nth_cpu() uses a bsearch to look for the 'closest'
 CPU in sched_domains_numa_masks and given cpus mask. However they
 might not intersect if all CPUs in the cpus mask are offline. bsearch
 will return NULL in that case, bail out instead of dereferencing a
 bogus pointer.
 The previous behaviour lead to this bug when using maxcpus=4 on an
 rk3399 (LLLLbb) (i.e. booting with all big CPUs offline):
 [    1.422922] Unable to handle kernel paging request at virtual address ffffff8000000000
 [    1.423635] Mem abort info:
 [    1.423889]   ESR = 0x0000000096000006
 [    1.424227]   EC = 0x25: DABT (current EL), IL = 32 bits
 [    1.424715]   SET = 0, FnV = 0
 [    1.424995]   EA = 0, S1PTW = 0
 [    1.425279]   FSC = 0x06: level 2 translation fault
 [    1.425735] Data abort info:
 [    1.425998]   ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000
 [    1.426499]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
 [    1.426952]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
 [    1.427428] swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000004a9f000
 [    1.428038] [ffffff8000000000] pgd=18000000f7fff403, p4d=18000000f7fff403, pud=18000000f7fff403, pmd=0000000000000000
 [    1.429014] Internal error: Oops: 0000000096000006 [#1]  SMP
 [    1.429525] Modules linked in:
 [    1.429813] CPU: 3 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.0-rc4-dirty #343 PREEMPT
 [    1.430559] Hardware name: Pine64 RockPro64 v2.1 (DT)
 [    1.431012] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
 [    1.431634] pc : sched_numa_find_nth_cpu+0x2a0/0x488
 [    1.432094] lr : sched_numa_find_nth_cpu+0x284/0x488
 [    1.432543] sp : ffffffc084e1b960
 [    1.432843] x29: ffffffc084e1b960 x28: ffffff80078a8800 x27: ffffffc0846eb1d0
 [    1.433495] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
 [    1.434144] x23: 0000000000000000 x22: fffffffffff7f093 x21: ffffffc081de6378
 [    1.434792] x20: 0000000000000000 x19: 0000000ffff7f093 x18: 00000000ffffffff
 [    1.435441] x17: 3030303866666666 x16: 66663d736b73616d x15: ffffffc104e1b5b7
 [    1.436091] x14: 0000000000000000 x13: ffffffc084712860 x12: 0000000000000372
 [    1.436739] x11: 0000000000000126 x10: ffffffc08476a860 x9 : ffffffc084712860
 [    1.437389] x8 : 00000000ffffefff x7 : ffffffc08476a860 x6 : 0000000000000000
 [    1.438036] x5 : 000000000000bff4 x4 : 0000000000000000 x3 : 0000000000000000
 [    1.438683] x2 : 0000000000000000 x1 : ffffffc0846eb000 x0 : ffffff8000407b68
 [    1.439332] Call trace:
 [    1.439559]  sched_numa_find_nth_cpu+0x2a0/0x488 (P)
 [    1.440016]  smp_call_function_any+0xc8/0xd0
 [    1.440416]  armv8_pmu_init+0x58/0x27c
 [    1.440770]  armv8_cortex_a72_pmu_init+0x20/0x2c
 [    1.441199]  arm_pmu_device_probe+0x1e4/0x5e8
 [    1.441603]  armv8_pmu_device_probe+0x1c/0x28
 [    1.442007]  platform_probe+0x5c/0xac
 [    1.442347]  really_probe+0xbc/0x298
 [    1.442683]  __driver_probe_device+0x78/0x12c
 [    1.443087]  driver_probe_device+0xdc/0x160
 [    1.443475]  __driver_attach+0x94/0x19c
 [    1.443833]  bus_for_each_dev+0x74/0xd4
 [    1.444190]  driver_attach+0x24/0x30
 [    1.444525]  bus_add_driver+0xe4/0x208
 [    1.444874]  driver_register+0x60/0x128
 [    1.445233]  __platform_driver_register+0x24/0x30
 [    1.445662]  armv8_pmu_driver_init+0x28/0x4c
 [    1.446059]  do_one_initcall+0x44/0x25c
 [    1.446416]  kernel_init_freeable+0x1dc/0x3bc
 [    1.446820]  kernel_init+0x20/0x1d8
 [    1.447151]  ret_from_fork+0x10/0x20
 [    1.447493] Code: 90022e21 f000e5f5 910de2b5 2a1703e2 (f8767803)
 [    1.448040] ---[ end trace 0000000000000000 ]---
 [    1.448483] note: swapper/0[1] exited with preempt_count 1
 [    1.449047] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
 [    1.449741] SMP: stopping secondary CPUs
 [    1.450105] Kernel Offset: disabled
 [    1.450419] CPU features: 0x000000,00080000,20002001,0400421b
 [    1.450935] Memory Limit: none
 [    1.451217] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]---
 Yury: with the fix, the function returns cpu == nr_cpu_ids, and later in
 	smp_call_function_any ->
 	  smp_call_function_single ->
 	     generic_exec_single
 we test the cpu for '>= nr_cpu_ids' and return -ENXIO. So everything is
 handled correctly.
 Fixes: cd7f55359c90 ("sched: add sched_numa_find_nth_cpu()")
 Cc: stable@vger.kernel.org
 Signed-off-by: Christian Loehle <christian.loehle@arm.com>
 Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
 ---
 kernel/sched/topology.c | 2 ++
 1 file changed, 2 insertions(+)
 --- a/kernel/sched/topology.c
 +++ b/kernel/sched/topology.c
@@ -2212,6 +2212,8 @@ int sched_numa_find_nth_cpu(const struct
 		goto unlock;
 	hop_masks = bsearch(&k, k.masks, sched_domains_numa_levels, sizeof(k.masks[0]), hop_cmp);
 +	if (!hop_masks)
 +		goto unlock;
 	hop = hop_masks	- k.masks;
 	ret = hop ?
--- a/debian/patches/patchset-xanmod/clearlinux/0001-sched-wait-Do-accept-in-LIFO-order-for-cache-efficie.patch
+++ b/debian/patches/patchset-xanmod/clearlinux/0001-sched-wait-Do-accept-in-LIFO-order-for-cache-efficie.patch
@@ -71,7 +71,7 @@ Signed-off-by: Alexandre Frade <kernel@xanmod.org>
 	wq_entry->flags = flags;
 --- a/net/ipv4/inet_connection_sock.c
 +++ b/net/ipv4/inet_connection_sock.c
-@@ -632,7 +632,7 @@ static int inet_csk_wait_for_connect(str
+@@ -629,7 +629,7 @@ static int inet_csk_wait_for_connect(str
 	 * having to remove and re-insert us on the wait queue.
 	 */
 	for (;;) {
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -67,7 +67,6 @@ features/x86/x86-make-x32-syscall-support-conditional.patch
 # Miscellaneous bug fixes
 bugfix/all/disable-some-marvell-phys.patch
 bugfix/all/fs-add-module_softdep-declarations-for-hard-coded-cr.patch
 bugfix/all/proc-fix-missing-pde_set_flags-for-net-proc-files.patch
 # Miscellaneous features
@@ -212,18 +211,8 @@ patchset-pf/steady/0004-fs-proc-task_mmu-remove-conversion-of-seq_file-posit.pat
 patchset-pf/steady/0005-cifs-Add-support-for-creating-reparse-points-over-SM.patch
 patchset-pf/steady/0006-smb-client-fix-creating-symlinks-under-POSIX-mounts.patch
 patchset-pf/steady/0007-watchdog-intel_oc_wdt-Do-not-try-to-write-into-const.patch
-patchset-pf/steady/0008-ALSA-usb-audio-Add-mute-TLV-for-playback-volumes-on-.patch
+patchset-pf/steady/0008-mm-damon-core-prevent-unnecessary-overflow-in-damos_.patch
-patchset-pf/steady/0009-ALSA-hda-realtek-Fix-headset-mic-for-TongFang-X6-AF-.patch
+patchset-pf/steady/0009-iwlwifi-Patch-to-fix-130-1030.patch
-patchset-pf/steady/0010-of_numa-fix-uninitialized-memory-nodes-causing-kerne.patch
+patchset-pf/steady/0010-fuse-do-not-allow-mapping-a-non-regular-backing-file.patch
-patchset-pf/steady/0011-mm-userfaultfd-fix-kmap_local-LIFO-ordering-for-CONF.patch
+patchset-pf/steady/0011-fuse-check-if-copy_file_range-returns-larger-than-re.patch
-patchset-pf/steady/0012-mm-damon-core-prevent-unnecessary-overflow-in-damos_.patch
+patchset-pf/steady/0012-fuse-prevent-overflow-in-copy_file_range-return-valu.patch
 patchset-pf/steady/0013-mm-fix-accounting-of-memmap-pages.patch
 patchset-pf/steady/0014-mm-move-page-table-sync-declarations-to-linux-pgtabl.patch
 patchset-pf/steady/0015-mm-introduce-and-use-pgd-p4d-_populate_kernel.patch
 patchset-pf/steady/0016-x86-mm-64-define-ARCH_PAGE_TABLE_SYNC_MASK-and-arch_.patch
 patchset-pf/steady/0017-ALSA-hda-tas2781-fix-tas2563-EFI-data-endianness.patch
 patchset-pf/steady/0018-ALSA-hda-tas2781-reorder-tas2563-calibration-variabl.patch
 patchset-pf/steady/0019-ALSA-hda-hdmi-Add-pin-fix-for-another-HP-EliteDesk-8.patch
 patchset-pf/steady/0020-mm-fix-possible-deadlock-in-kmemleak.patch
 patchset-pf/steady/0021-kasan-fix-GCC-mem-intrinsic-prefix-with-sw-tags.patch
 patchset-pf/steady/0022-sched-Fix-sched_numa_find_nth_cpu-if-mask-offline.patch
--- a/debian/rules.real
+++ b/debian/rules.real
@@ -34,6 +34,10 @@ stamp = [ -d $(dir $@) ] || mkdir $(dir $@); touch $@
 cleanup_config = sed -E -e '/CONFIG_(BUILD_SALT|MODULE_SIG_(ALL|KEY)|SYSTEM_TRUSTED_KEYS)[ =]/d' -e '/CONFIG_((AS|BINDGEN|CC|CLANG|GCC|LD|LLD|PAHOLE|RUSTC)_VERSION|RUSTC_LLVM_VERSION)/d'
 ## HACK: DISABLE sframe generation with recent binutils (2.45+) and gcc (14.3.x/15.2.x and newer)
 export KCFLAGS := -Wa,--gsframe=no
 export KAFLAGS := -Wa,--gsframe=no
 setup_env := env -u ABINAME -u ARCH -u FEATURESET -u FLAVOUR -u VERSION -u LOCALVERSION
 # XXX: All the tools leak flags between host and build all the time, just don't care.  See #1050991.
 setup_env += -u KBUILD_HOSTCFLAGS -u HOSTCFLAGS -u KBUILD_HOSTLDFLAGS
@@ -43,7 +47,7 @@ setup_env += KBUILD_BUILD_USER="krd"
 setup_env += KBUILD_BUILD_HOST="tempest"
 setup_env += KBUILD_VERBOSE=$(if $(filter verbose,$(DEB_BUILD_OPTIONS)),1,0)
-MAKE_CLEAN = $(setup_env) $(MAKE) KCFLAGS=-fdebug-prefix-map=$(CURDIR)/= KAFLAGS=-fdebug-prefix-map=$(CURDIR)/=
+MAKE_CLEAN = $(setup_env) $(MAKE) KCFLAGS='$(KCFLAGS) -fdebug-prefix-map=$(CURDIR)/=' KAFLAGS='$(KAFLAGS) -fdebug-prefix-map=$(CURDIR)/='
 MAKE_SELF := $(MAKE) -f debian/rules.real $(MAKEOVERRIDES)
 MAKEOVERRIDES =
@@ -159,6 +163,9 @@ endif
 ifdef KCFLAGS
 	echo 'override KCFLAGS += $(KCFLAGS)' >> '$(DIR)/.kernelvariables'
 endif
 ifdef KAFLAGS
 	echo 'override KAFLAGS += $(KAFLAGS)' >> '$(DIR)/.kernelvariables'
 endif
 ifdef COMPAT_GNU_TYPE
 	echo 'override CROSS_COMPILE_COMPAT = $(COMPAT_GNU_TYPE)-' >> '$(DIR)/.kernelvariables'
 	echo 'override CROSS32_COMPILE = $(COMPAT_GNU_TYPE)-' >> '$(DIR)/.kernelvariables'