- Linux-stable-mirror - lists.linaro.org

[PATCH 6.11 v4 0/3] Fix PPS channel routing

by Csókás, Bence

On certain i.MX8 series parts [1], the PPS channel 0 is routed internally to eDMA, and the external PPS pin is available on channel 1. In addition, on certain boards, the PPS may be wired on the PCB to an EVENTOUTn pin other than 0. On these systems it is necessary that the PPS channel be able to be configured from the Device Tree. [1] https://lore.kernel.org/all/ZrPYOWA3FESx197L@lizhi-Precision-Tower-5810/ Changes in v2: * add upstream hash (pick -x) Changes in v3: * Add S-o-b despite Sasha's complaining bot Changes in v4: * Remove blank line in S-o-b area Francesco Dolcini (3): dt-bindings: net: fec: add pps channel property net: fec: refactor PPS channel configuration net: fec: make PPS channel configurable Documentation/devicetree/bindings/net/fsl,fec.yaml | 7 +++++++ drivers/net/ethernet/freescale/fec_ptp.c | 11 ++++++----- 2 files changed, 13 insertions(+), 5 deletions(-) -- 2.34.1

4 months, 3 weeks

3
7
0 0

[PATCH 4.19] Revert "drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()"

by Zhang Zekun

This reverts commit 673bdb4200c092692f83b5f7ba3df57021d52d29. The origin mainline patch fix a buffer overflow issue in amdgpu_debugfs_gprwave_read(), but it has not been introduced in kernel 6.1 and older kernels. This patch add a check in a wrong function in the same file. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c index 4776196b2021..98bd8a23e5b0 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c @@ -394,7 +394,7 @@ static ssize_t amdgpu_debugfs_regs_smc_read(struct file *f, char __user *buf, if (!adev->smc_rreg) return -EOPNOTSUPP; - if (size > 4096 || size & 0x3 || *pos & 0x3) + if (size & 0x3 || *pos & 0x3) return -EINVAL; while (size) { -- 2.17.1

4 months, 3 weeks

3
2
0 0

FAILED: patch "[PATCH] perf/x86/intel/pt: Fix buffer full but size is 0 case" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y git checkout FETCH_HEAD git cherry-pick -x 5b590160d2cf776b304eb054afafea2bd55e3620 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120221-raft-bully-e091@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 5b590160d2cf776b304eb054afafea2bd55e3620 Mon Sep 17 00:00:00 2001 From: Adrian Hunter <adrian.hunter(a)intel.com> Date: Tue, 22 Oct 2024 18:59:07 +0300 Subject: [PATCH] perf/x86/intel/pt: Fix buffer full but size is 0 case If the trace data buffer becomes full, a truncated flag [T] is reported in PERF_RECORD_AUX. In some cases, the size reported is 0, even though data must have been added to make the buffer full. That happens when the buffer fills up from empty to full before the Intel PT driver has updated the buffer position. Then the driver calculates the new buffer position before calculating the data size. If the old and new positions are the same, the data size is reported as 0, even though it is really the whole buffer size. Fix by detecting when the buffer position is wrapped, and adjust the data size calculation accordingly. Example Use a very small buffer size (8K) and observe the size of truncated [T] data. Before the fix, it is possible to see records of 0 size. Before: $ perf record -m,8K -e intel_pt// uname Linux [ perf record: Woken up 2 times to write data ] [ perf record: Captured and wrote 0.105 MB perf.data ] $ perf script -D --no-itrace | grep AUX | grep -F '[T]' Warning: AUX data lost 2 times out of 3! 5 19462712368111 0x19710 [0x40]: PERF_RECORD_AUX offset: 0 size: 0 flags: 0x1 [T] 5 19462712700046 0x19ba8 [0x40]: PERF_RECORD_AUX offset: 0x170 size: 0xe90 flags: 0x1 [T] After: $ perf record -m,8K -e intel_pt// uname Linux [ perf record: Woken up 3 times to write data ] [ perf record: Captured and wrote 0.040 MB perf.data ] $ perf script -D --no-itrace | grep AUX | grep -F '[T]' Warning: AUX data lost 2 times out of 3! 1 113720802995 0x4948 [0x40]: PERF_RECORD_AUX offset: 0 size: 0x2000 flags: 0x1 [T] 1 113720979812 0x6b10 [0x40]: PERF_RECORD_AUX offset: 0x2000 size: 0x2000 flags: 0x1 [T] Fixes: 52ca9ced3f70 ("perf/x86/intel/pt: Add Intel PT PMU driver") Signed-off-by: Adrian Hunter <adrian.hunter(a)intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: stable(a)vger.kernel.org Link: https://lkml.kernel.org/r/20241022155920.17511-2-adrian.hunter@intel.com diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c index fd4670a6694e..a087bc0c5498 100644 --- a/arch/x86/events/intel/pt.c +++ b/arch/x86/events/intel/pt.c @@ -828,11 +828,13 @@ static void pt_buffer_advance(struct pt_buffer *buf) buf->cur_idx++; if (buf->cur_idx == buf->cur->last) { - if (buf->cur == buf->last) + if (buf->cur == buf->last) { buf->cur = buf->first; - else + buf->wrapped = true; + } else { buf->cur = list_entry(buf->cur->list.next, struct topa, list); + } buf->cur_idx = 0; } } @@ -846,8 +848,11 @@ static void pt_buffer_advance(struct pt_buffer *buf) static void pt_update_head(struct pt *pt) { struct pt_buffer *buf = perf_get_aux(&pt->handle); + bool wrapped = buf->wrapped; u64 topa_idx, base, old; + buf->wrapped = false; + if (buf->single) { local_set(&buf->data_size, buf->output_off); return; @@ -865,7 +870,7 @@ static void pt_update_head(struct pt *pt) } else { old = (local64_xchg(&buf->head, base) & ((buf->nr_pages << PAGE_SHIFT) - 1)); - if (base < old) + if (base < old || (base == old && wrapped)) base += buf->nr_pages << PAGE_SHIFT; local_add(base - old, &buf->data_size); diff --git a/arch/x86/events/intel/pt.h b/arch/x86/events/intel/pt.h index f5e46c04c145..a1b6c04b7f68 100644 --- a/arch/x86/events/intel/pt.h +++ b/arch/x86/events/intel/pt.h @@ -65,6 +65,7 @@ struct pt_pmu { * @head: logical write offset inside the buffer * @snapshot: if this is for a snapshot/overwrite counter * @single: use Single Range Output instead of ToPA + * @wrapped: buffer advance wrapped back to the first topa table * @stop_pos: STOP topa entry index * @intr_pos: INT topa entry index * @stop_te: STOP topa entry pointer @@ -82,6 +83,7 @@ struct pt_buffer { local64_t head; bool snapshot; bool single; + bool wrapped; long stop_pos, intr_pos; struct topa_entry *stop_te, *intr_te; void **data_pages;

4 months, 3 weeks

4
3
0 0

[PATCH 4.19.y 1/3] KVM: arm64: vgic-its: Add a data length check in vgic_its_save_*

by Jing Zhang

commit 7fe28d7e68f92cc3d0668b8f2fbdf5c303ac3022 upstream. In all the vgic_its_save_*() functinos, they do not check whether the data length is 8 bytes before calling vgic_write_guest_lock. This patch adds the check. To prevent the kernel from being blown up when the fault occurs, KVM_BUG_ON() is used. And the other BUG_ON()s are replaced together. Cc: stable(a)vger.kernel.org Signed-off-by: Kunkun Jiang <jiangkunkun(a)huawei.com> [Jing: Update with the new entry read/write helpers] Signed-off-by: Jing Zhang <jingzhangos(a)google.com> Link: https://lore.kernel.org/r/20241107214137.428439-4-jingzhangos@google.com Signed-off-by: Oliver Upton <oliver.upton(a)linux.dev> --- virt/kvm/arm/vgic/vgic-its.c | 20 ++++++++------------ virt/kvm/arm/vgic/vgic.h | 24 ++++++++++++++++++++++++ 2 files changed, 32 insertions(+), 12 deletions(-) diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c index 2fb26bd3106e..7fcf903fa5b0 100644 --- a/virt/kvm/arm/vgic/vgic-its.c +++ b/virt/kvm/arm/vgic/vgic-its.c @@ -1949,7 +1949,6 @@ static int scan_its_table(struct vgic_its *its, gpa_t base, int size, u32 esz, static int vgic_its_save_ite(struct vgic_its *its, struct its_device *dev, struct its_ite *ite, gpa_t gpa, int ite_esz) { - struct kvm *kvm = its->dev->kvm; u32 next_offset; u64 val; @@ -1958,7 +1957,8 @@ static int vgic_its_save_ite(struct vgic_its *its, struct its_device *dev, ((u64)ite->irq->intid << KVM_ITS_ITE_PINTID_SHIFT) | ite->collection->collection_id; val = cpu_to_le64(val); - return kvm_write_guest_lock(kvm, gpa, &val, ite_esz); + + return vgic_its_write_entry_lock(its, gpa, val, ite_esz); } /** @@ -2094,7 +2094,6 @@ static int vgic_its_restore_itt(struct vgic_its *its, struct its_device *dev) static int vgic_its_save_dte(struct vgic_its *its, struct its_device *dev, gpa_t ptr, int dte_esz) { - struct kvm *kvm = its->dev->kvm; u64 val, itt_addr_field; u32 next_offset; @@ -2105,7 +2104,8 @@ static int vgic_its_save_dte(struct vgic_its *its, struct its_device *dev, (itt_addr_field << KVM_ITS_DTE_ITTADDR_SHIFT) | (dev->num_eventid_bits - 1)); val = cpu_to_le64(val); - return kvm_write_guest_lock(kvm, ptr, &val, dte_esz); + + return vgic_its_write_entry_lock(its, ptr, val, dte_esz); } /** @@ -2285,7 +2285,8 @@ static int vgic_its_save_cte(struct vgic_its *its, ((u64)collection->target_addr << KVM_ITS_CTE_RDBASE_SHIFT) | collection->collection_id); val = cpu_to_le64(val); - return kvm_write_guest_lock(its->dev->kvm, gpa, &val, esz); + + return vgic_its_write_entry_lock(its, gpa, val, esz); } static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz) @@ -2296,8 +2297,7 @@ static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz) u64 val; int ret; - BUG_ON(esz > sizeof(val)); - ret = kvm_read_guest_lock(kvm, gpa, &val, esz); + ret = vgic_its_read_entry_lock(its, gpa, &val, esz); if (ret) return ret; val = le64_to_cpu(val); @@ -2331,7 +2331,6 @@ static int vgic_its_save_collection_table(struct vgic_its *its) u64 baser = its->baser_coll_table; gpa_t gpa = BASER_ADDRESS(baser); struct its_collection *collection; - u64 val; size_t max_size, filled = 0; int ret, cte_esz = abi->cte_esz; @@ -2355,10 +2354,7 @@ static int vgic_its_save_collection_table(struct vgic_its *its) * table is not fully filled, add a last dummy element * with valid bit unset */ - val = 0; - BUG_ON(cte_esz > sizeof(val)); - ret = kvm_write_guest_lock(its->dev->kvm, gpa, &val, cte_esz); - return ret; + return vgic_its_write_entry_lock(its, gpa, 0, cte_esz); } /** diff --git a/virt/kvm/arm/vgic/vgic.h b/virt/kvm/arm/vgic/vgic.h index d5e454279925..e5a307dab61e 100644 --- a/virt/kvm/arm/vgic/vgic.h +++ b/virt/kvm/arm/vgic/vgic.h @@ -17,6 +17,7 @@ #define __KVM_ARM_VGIC_NEW_H__ #include <linux/irqchip/arm-gic-common.h> +#include <asm/kvm_mmu.h> #define PRODUCT_ID_KVM 0x4b /* ASCII code K */ #define IMPLEMENTER_ARM 0x43b @@ -137,6 +138,29 @@ static inline bool vgic_irq_is_multi_sgi(struct vgic_irq *irq) return vgic_irq_get_lr_count(irq) > 1; } +static inline int vgic_its_read_entry_lock(struct vgic_its *its, gpa_t eaddr, + u64 *eval, unsigned long esize) +{ + struct kvm *kvm = its->dev->kvm; + + if (KVM_BUG_ON(esize != sizeof(*eval), kvm)) + return -EINVAL; + + return kvm_read_guest_lock(kvm, eaddr, eval, esize); + +} + +static inline int vgic_its_write_entry_lock(struct vgic_its *its, gpa_t eaddr, + u64 eval, unsigned long esize) +{ + struct kvm *kvm = its->dev->kvm; + + if (KVM_BUG_ON(esize != sizeof(eval), kvm)) + return -EINVAL; + + return kvm_write_guest_lock(kvm, eaddr, &eval, esize); +} + /* * This struct provides an intermediate representation of the fields contained * in the GICH_VMCR and ICH_VMCR registers, such that code exporting the GIC base-commit: 708f578f2a8f702d2f2a0ef5e6eac28e08206e03 -- 2.47.0.338.g60cca15819-goog

4 months, 3 weeks

4
7
0 0

[PATCH 6.12 000/826] 6.12.2-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.2 release. There are 826 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 05 Dec 2024 14:45:11 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.2-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.2-rc1 Ming Lei <ming.lei(a)redhat.com> block: don't verify IO lock for freeze/unfreeze in elevator_init_mq() Ming Lei <ming.lei(a)redhat.com> block: always verify unfreeze lock on the owner task Patryk Wlazlyn <patryk.wlazlyn(a)linux.intel.com> tools/power turbostat: Fix child's argument forwarding Zhang Rui <rui.zhang(a)intel.com> tools/power turbostat: Fix trailing '\n' parsing Dan Carpenter <dan.carpenter(a)linaro.org> sh: intc: Fix use-after-free bug in register_intc_controller() Zhang Xianwei <zhang.xianwei8(a)zte.com.cn> brd: decrease the number of allocated pages which discarded Yu Kuai <yukuai3(a)huawei.com> block, bfq: fix bfqq uaf in bfq_limit_depth() Benjamin Coddington <bcodding(a)redhat.com> nfs/blocklayout: Limit repeat device registration on failure Benjamin Coddington <bcodding(a)redhat.com> nfs/blocklayout: Don't attempt unregister for invalid block device Liu Jian <liujian56(a)huawei.com> sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket Benjamin Coddington <bcodding(a)redhat.com> SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT Liu Jian <liujian56(a)huawei.com> sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport Li Lingfeng <lilingfeng3(a)huawei.com> nfs: ignore SB_RDONLY when mounting nfs Dan Carpenter <dan.carpenter(a)linaro.org> cifs: unlock on error in smb3_reconfigure() Shyam Prasad N <sprasad(a)microsoft.com> cifs: during remount, make sure passwords are in sync Masahiro Yamada <masahiroy(a)kernel.org> modpost: remove incorrect code in do_eisa_entry() John Garry <john.g.garry(a)oracle.com> block: Don't allow an atomic write be truncated in blkdev_write_iter() Paul Aurich <paul(a)darkrain42.org> smb: Initialize cfid->tcon before performing network ops Matt Fleming <mfleming(a)cloudflare.com> kbuild: deb-pkg: Don't fail if modules.order is missing Masahiro Yamada <masahiroy(a)kernel.org> Rename .data.once to .data..once to fix resetting WARN*_ONCE Masahiro Yamada <masahiroy(a)kernel.org> Rename .data.unlikely to .data..unlikely Maxime Chevallier <maxime.chevallier(a)bootlin.com> rtc: ab-eoz9: don't fail temperature reads on undervoltage notification Pali Rohár <pali(a)kernel.org> cifs: Fix parsing reparse point with native symlink in SMB1 non-UNICODE session Pali Rohár <pali(a)kernel.org> cifs: Fix parsing native symlinks relative to the export Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> x86/Documentation: Update algo in init_size description of boot protocol Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: disable directory caching when dir_cache_timeout is zero Namhyung Kim <namhyung(a)kernel.org> perf/arm-cmn: Ensure port and device id bits are set properly Chun-Tse Shao <ctshao(a)google.com> perf/arm-smmuv3: Fix lockdep assert in ->event_init() Alex Zenla <alex(a)edera.dev> 9p/xen: fix release of IRQ Alex Zenla <alex(a)edera.dev> 9p/xen: fix init sequence Nilay Shroff <nilay(a)linux.ibm.com> nvme-fabrics: fix kernel crash while shutting down controller Christoph Hellwig <hch(a)lst.de> block: return unsigned int from bdev_io_min Yu Kuai <yukuai3(a)huawei.com> block: fix uaf for flush rq while iterating tags Ming Lei <ming.lei(a)redhat.com> block: model freeze & enter queue as lock for supporting lockdep Ming Lei <ming.lei(a)redhat.com> blk-mq: add non_owner variant of start_freeze/unfreeze queue APIs Breno Leitao <leitao(a)debian.org> nvme/multipath: Fix RCU list traversal to use SRCU primitive Trond Myklebust <trond.myklebust(a)hammerspace.com> Revert "nfs: don't reuse partially completed requests in nfs_lock_and_join_requests" Wolfram Sang <wsa+renesas(a)sang-engineering.com> rtc: rzn1: fix BCD to rtc_time conversion errors Mirsad Todorovac <mtodorovac69(a)gmail.com> net/9p/usbg: fix handling of the failed kzalloc() memory allocation ZhangPeng <zhangpeng362(a)huawei.com> hostfs: Fix the NULL vs IS_ERR() bug for __filemap_get_folio() Qingfang Deng <qingfang.deng(a)siflower.com.cn> jffs2: fix use of uninitialized variable Waqar Hameed <waqar.hameed(a)axis.com> ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit Zhihao Cheng <chengzhihao1(a)huawei.com> ubi: fastmap: Fix duplicate slab cache names while attaching Zhihao Cheng <chengzhihao1(a)huawei.com> ubifs: Correct the total block count by deducting journal reservation Zhihao Cheng <chengzhihao1(a)huawei.com> ubi: fastmap: wl: Schedule fm_work if wear-leveling pool is empty Yongliang Gao <leonylgao(a)tencent.com> rtc: check if __rtc_read_time was successful in rtc_timer_do_work() Nobuhiro Iwamatsu <iwamatsu(a)nigauri.org> rtc: abx80x: Fix WDT bit position of the status register Jinjie Ruan <ruanjinjie(a)huawei.com> rtc: st-lpc: Use IRQF_NO_AUTOEN flag in request_irq() NeilBrown <neilb(a)suse.de> nfs/localio: must clear res.replen in nfs_local_read_done Trond Myklebust <trond.myklebust(a)hammerspace.com> NFSv4.0: Fix a use-after-free problem in the asynchronous open() Tiwei Bie <tiwei.btw(a)antgroup.com> um: Always dump trace for specified task in show_stack Tiwei Bie <tiwei.btw(a)antgroup.com> um: ubd: Initialize ubd's disk pointer in ubd_add Christoph Hellwig <hch(a)lst.de> kfifo: don't include dma-mapping.h in kfifo.h Tiwei Bie <tiwei.btw(a)antgroup.com> um: Fix the return value of elf_core_copy_task_fpregs Tiwei Bie <tiwei.btw(a)antgroup.com> um: Fix potential integer overflow during physmem setup Yang Erkun <yangerkun(a)huawei.com> SUNRPC: make sure cache entry active before cache_show Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent a potential integer overflow Yuan Can <yuancan(a)huawei.com> Input: cs40l50 - fix wrong usage of INIT_WORK() Ma Wupeng <mawupeng1(a)huawei.com> ipc: fix memleak if msg_init_ns failed in create_ipc_ns Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on node blkaddr in truncate_node() Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> lib: string_helpers: silence snprintf() output truncation warning Ming Lei <ming.lei(a)redhat.com> ublk: fix error code for unsupported command Javier Carrasco <javier.carrasco.cruz(a)gmail.com> counter: stm32-timer-cnt: fix device_node handling in probe_encoder() Javier Carrasco <javier.carrasco.cruz(a)gmail.com> staging: vchiq_arm: Fix missing refcount decrement in error path for fw_node Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: gadget: Fix looping of queued SG entries Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: gadget: Fix checking for number of TRBs left Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: gadget: Add missing check for single port RAM in TxFIFO resizing logic Hubert Wiśniewski <hubert.wisniewski.25632(a)gmail.com> usb: musb: Fix hardware lockup on first Rx endpoint request Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED Stanislaw Gruszka <stanislaw.gruszka(a)linux.intel.com> usb: misc: ljca: move usb_autopm_put_interface() after wait for response Stanislaw Gruszka <stanislaw.gruszka(a)linux.intel.com> usb: misc: ljca: set small runtime autosuspend delay Paul Aurich <paul(a)darkrain42.org> smb: During unmount, ensure all cached dir instances drop their dentry Paul Aurich <paul(a)darkrain42.org> smb: prevent use-after-free due to open_cached_dir error paths Paul Aurich <paul(a)darkrain42.org> smb: Don't leak cfid when reconnect races with open_cached_dir Paulo Alcantara <pc(a)manguebit.com> smb: client: handle max length for SMB symlinks Steve French <stfrench(a)microsoft.com> smb3: request handle caching when caching directories Paulo Alcantara <pc(a)manguebit.com> smb: client: fix use-after-free of signing key Ralph Boehme <slow(a)samba.org> fs/smb/client: implement chmod() for SMB3 POSIX Extensions Takashi Iwai <tiwai(a)suse.de> ALSA: hda/realtek: Apply quirk for Medion E15433 Dirk Su <dirk.su(a)canonical.com> ALSA: hda/realtek: fix mute/micmute LEDs don't work for EliteBook X G1i Dinesh Kumar <desikumar81(a)gmail.com> ALSA: hda/realtek: Fix Internal Speaker and Mic boost of Infinix Y4 Max Kailang Yang <kailang(a)realtek.com> ALSA: hda/realtek: Set PCBeep to default value for ALC274 Kailang Yang <kailang(a)realtek.com> ALSA: hda/realtek: Enable speaker pins for Medion E15443 platform Kailang Yang <kailang(a)realtek.com> ALSA: hda/realtek: Update ALC225 depop procedure Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: Add sanity NULL check for the default mmap fault handler Takashi Iwai <tiwai(a)suse.de> ALSA: ump: Fix evaluation of MIDI 1.0 FB info Takashi Iwai <tiwai(a)suse.de> ALSA: rawmidi: Fix kvfree() call in spinlock Borislav Petkov (AMD) <bp(a)alien8.de> x86/microcode/AMD: Flush patch buffer mapping after application Borislav Petkov (AMD) <bp(a)alien8.de> x86/mm: Carve out INVLPG inline asm for use by others Hans Verkuil <hverkuil(a)xs4all.nl> media: v4l2-core: v4l2-dv-timings: check cvt/gtf result Javier Carrasco <javier.carrasco.cruz(a)gmail.com> soc: fsl: rcpm: fix missing of_node_put() in copy_ippdexpcr1_setting() Herve Codina <herve.codina(a)bootlin.com> soc: fsl: cpm1: qmc: Set the ret error code on platform_get_irq() failure Joe Damato <jdamato(a)fastly.com> netdev-genl: Hold rcu_read_lock in napi_get Chen-Yu Tsai <wenst(a)chromium.org> arm64: dts: mediatek: mt8186-corsola-voltorb: Merge speaker codec nodes Stanislaw Gruszka <stanislaw.gruszka(a)linux.intel.com> media: intel/ipu6: do not handle interrupts when device is disabled Qiu-ji Chen <chenqiuji666(a)gmail.com> media: wl128x: Fix atomicity violation in fmc_send_cmd() Peter Große <pegro(a)friiks.de> i40e: Fix handling changed priv flags Jason Gerecke <jason.gerecke(a)wacom.com> HID: wacom: Interpret tilt data from Intuos Pro BT as signed values Ziwei Xiao <ziweixiao(a)google.com> gve: Flow steering trigger reset only for timeout error Bart Van Assche <bvanassche(a)acm.org> blk-mq: Make blk_mq_quiesce_tagset() hold the tag list mutex less long Muchun Song <muchun.song(a)linux.dev> block: fix ordering between checking BLK_MQ_S_STOPPED request adding Muchun Song <muchun.song(a)linux.dev> block: fix ordering between checking QUEUE_FLAG_QUIESCED request adding Muchun Song <muchun.song(a)linux.dev> block: fix missing dispatching request when queue is started or unquiesced Will Deacon <will(a)kernel.org> arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled Ming Lei <ming.lei(a)redhat.com> ublk: fix ublk_ch_mmap() for 64K page size Zicheng Qu <quzicheng(a)huawei.com> iio: gts: Fix uninitialized symbol 'ret' Huacai Chen <chenhuacai(a)kernel.org> sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK Tiwei Bie <tiwei.btw(a)antgroup.com> um: vector: Do not use drvdata in release Damien Le Moal <dlemoal(a)kernel.org> block: Prevent potential deadlock in blk_revalidate_disk_zones() Javier Carrasco <javier.carrasco.cruz(a)gmail.com> mtd: ubi: fix unreleased fwnode_handle in find_volume_fwnode() Zach Wade <zachwade.k(a)gmail.com> Revert "block, bfq: merge bfq_release_process_ref() into bfq_put_cooperator()" Arnd Bergmann <arnd(a)arndb.de> serial: amba-pl011: fix build regression Kartik Rajput <kkartik(a)nvidia.com> serial: amba-pl011: Fix RX stall when DMA is used Bin Liu <b-liu(a)ti.com> serial: 8250: omap: Move pm_runtime_get_sync Filip Brozovic <fbrozovic(a)gmail.com> serial: 8250_fintek: Add support for F81216E Michal Simek <michal.simek(a)amd.com> dt-bindings: serial: rs485: Fix rs485-rts-delay property Tiwei Bie <tiwei.btw(a)antgroup.com> um: net: Do not use drvdata in release Tiwei Bie <tiwei.btw(a)antgroup.com> um: ubd: Do not use drvdata in release Zhihao Cheng <chengzhihao1(a)huawei.com> ubi: wl: Put source PEB into correct list if trying locking LEB failed Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> x86/CPU/AMD: Terminate the erratum_1386_microcode array Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> irqchip/irq-mvebu-sei: Move misplaced select() callback to SEI CP domain Javier Carrasco <javier.carrasco.cruz(a)gmail.com> platform/chrome: cros_ec_typec: fix missing fwnode reference decrement Paulo Alcantara <pc(a)manguebit.com> smb: client: fix NULL ptr deref in crypto_aead_setkey() Yunseong Kim <yskelg(a)gmail.com> ksmbd: fix use-after-free in SMB request handling Jesse Taube <jesse(a)rivosinc.com> RISC-V: Check scalar unaligned access on all CPUs Jesse Taube <jesse(a)rivosinc.com> RISC-V: Scalar unaligned access emulated on hotplug CPUs Josh Poimboeuf <jpoimboe(a)kernel.org> parisc/ftrace: Fix function graph tracing disablement Meetakshi Setiya <msetiya(a)microsoft.com> cifs: support mounting with alternate password to allow password rotation Jinjie Ruan <ruanjinjie(a)huawei.com> cpufreq: mediatek-hw: Fix wrong return value in mtk_cpufreq_get_cpu_power() Cheng Ming Lin <chengminglin(a)mxic.com.tw> mtd: spi-nor: core: replace dummy buswidth from addr to data Stanislaw Gruszka <stanislaw.gruszka(a)linux.intel.com> spi: Fix acpi deferred irq probe Jeongjun Park <aha310510(a)gmail.com> netfilter: ipset: add missing range check in bitmap_ip_uadt Sai Kumar Cholleti <skmr537(a)gmail.com> gpio: exar: set value when external pull-up or pull-down is present Mikulas Patocka <mpatocka(a)redhat.com> blk-settings: round down io_opt to physical_block_size Pavel Begunkov <asml.silence(a)gmail.com> io_uring: check for overflows in io_pin_pages Pavel Begunkov <asml.silence(a)gmail.com> io_uring: fix corner case forgetting to vunmap Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit" Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> serial: sh-sci: Clean sci_ports[0] after at earlycon exit Michal Vrastil <michal.vrastil(a)hidglobal.com> Revert "usb: gadget: composite: fix OS descriptors w_value logic" Jaegeuk Kim <jaegeuk(a)kernel.org> Revert "f2fs: remove unreachable lazytime mount option parsing" Christian Brauner <brauner(a)kernel.org> Revert "fs: don't block i_writecount during exec" Javier Carrasco <javier.carrasco.cruz(a)gmail.com> wifi: brcmfmac: release 'root' node in all execution paths Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath12k: fix crash when unbinding Aleksei Vetrov <vvvvvv(a)google.com> wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan Guilherme G. Piccoli <gpiccoli(a)igalia.com> wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath12k: fix warning when unbinding Andreas Kemnade <andreas(a)kemnade.info> ARM: dts: omap36xx: declare 1GHz OPP as turbo again Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Avoid queuing redundant Stop Endpoint commands Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Fix TD invalidation under pending Set TR Dequeue Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Limit Stop Endpoint retries Andrej Shadura <andrew.shadura(a)collabora.co.uk> Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}() Kuangyi Chiang <ki.chiang65(a)gmail.com> xhci: Don't issue Reset Device command to Etron xHCI host Kuangyi Chiang <ki.chiang65(a)gmail.com> xhci: Don't perform Soft Retry for Etron xHCI host Kuangyi Chiang <ki.chiang65(a)gmail.com> xhci: Combine two if statements for Etron xHCI host Kuangyi Chiang <ki.chiang65(a)gmail.com> xhci: Fix control transfer error on Etron xHCI host Yuezhang Mo <Yuezhang.Mo(a)sony.com> exfat: fix out-of-bounds access of directory entries Namjae Jeon <linkinjeon(a)kernel.org> exfat: fix uninit-value in __exfat_get_dentry_set Angelo Dureghello <adureghello(a)baylibre.com> dt-bindings: iio: dac: ad3552r: fix maximum spi speed Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> dt-bindings: pinctrl: samsung: Fix interrupt constraint for variants with fallbacks Johan Hovold <johan+linaro(a)kernel.org> pinctrl: qcom: spmi: fix debugfs drive strength Christian Brauner <brauner(a)kernel.org> fcntl: make F_DUPFD_QUERY associative Thomas Weißschuh <thomas.weissschuh(a)linutronix.de> tools/nolibc: s390: include std.h Ahmed Ehab <bottaawesome633(a)gmail.com> locking/lockdep: Avoid creating new name string literals in lockdep_set_subclass() Nicolas Bouchinet <nicolas.bouchinet(a)ssi.gouv.fr> tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler Angelo Dureghello <adureghello(a)baylibre.com> iio: dac: adi-axi-dac: fix wrong register bitfield Jinjie Ruan <ruanjinjie(a)huawei.com> apparmor: test: Fix memory leak for aa_unpack_strdup() Jann Horn <jannh(a)google.com> comedi: Flush partial mappings in error case Jann Horn <jannh(a)google.com> fsnotify: Fix ordering of iput() and watched_objects decrement Amir Goldstein <amir73il(a)gmail.com> fsnotify: fix sending inotify event with unexpected filename Gustavo A. R. Silva <gustavoars(a)kernel.org> clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access Gustavo A. R. Silva <gustavoars(a)kernel.org> clk: clk-loongson2: Fix memory corruption bug in struct loongson2_clk_provider Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Explicitly specify code model in Makefile Lukas Wunner <lukas(a)wunner.de> PCI: Fix use-after-free of slot->bus on hot remove Jan Hendrik Farr <kernel(a)jfarr.cc> Compiler Attributes: disable __counted_by for clang < 19.1.3 Kunkun Jiang <jiangkunkun(a)huawei.com> KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device Jing Zhang <jingzhangos(a)google.com> KVM: arm64: vgic-its: Add a data length check in vgic_its_save_* Raghavendra Rao Ananta <rananta(a)google.com> KVM: arm64: Get rid of userspace_irqchip_in_use Kunkun Jiang <jiangkunkun(a)huawei.com> KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE Oliver Upton <oliver.upton(a)linux.dev> KVM: arm64: Don't retire aborted MMIO instruction Sean Christopherson <seanjc(a)google.com> Revert "KVM: VMX: Move LOAD_IA32_PERF_GLOBAL_CTRL errata handling out of setup_vmcs_config()" Raghavendra Rao Ananta <rananta(a)google.com> KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status Marc Zyngier <maz(a)kernel.org> KVM: arm64: vgic-v3: Sanitise guest writes to GICR_INVLPIR Gautam Menghani <gautam(a)linux.ibm.com> powerpc/pseries: Fix KVM guest detection for disabling hardlockup detector Sean Christopherson <seanjc(a)google.com> KVM: x86: Break CONFIG_KVM_X86's direct dependency on KVM_INTEL || KVM_AMD Arnd Bergmann <arnd(a)arndb.de> KVM: x86: add back X86_LOCAL_APIC dependency Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Skip the "try unsync" path iff the old SPTE was a leaf SPTE Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: switch hugepage recovery thread to vhost_task Eric Biggers <ebiggers(a)google.com> crypto: x86/aegis128 - access 32-bit arguments as 32-bit Adrian Hunter <adrian.hunter(a)intel.com> perf/x86/intel/pt: Fix buffer full but size is 0 case Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> ASoC: da7213: Populate max_register to regmap_config Qiu-ji Chen <chenqiuji666(a)gmail.com> ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata() Ilya Zverev <ilya(a)zverev.info> ASoC: amd: yc: Add a quirk for microfone on Lenovo ThinkPad P14s Gen 5 21MES00B00 Artem Sadovnikov <ancowi69(a)gmail.com> jfs: xattr: check invalid xattr size more strictly Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> docs: media: update location of the media patches Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> MAINTAINERS: update location of media main tree Theodore Ts'o <tytso(a)mit.edu> ext4: fix FS_IOC_GETFSMAP handling Jeongjun Park <aha310510(a)gmail.com> ext4: supress data-race warnings in ext4_free_inodes_{count,set}() Darrick J. Wong <djwong(a)kernel.org> xfs: fix simplify extent lookup in xfs_can_free_eofblocks Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> usb: typec: ucsi: glink: fix off-by-one in connector_status Vitalii Mordan <mordan(a)ispras.ru> usb: ehci-spear: fix call balance of sehci clk handling routines Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Fix out of bounds reads when finding clock sources Benoît Sevens <bsevens(a)google.com> ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices Qiu-ji Chen <chenqiuji666(a)gmail.com> xen: Fix the issue of resource not being properly released in xenbus_dev_probe() Jakub Kicinski <kuba(a)kernel.org> net_sched: sch_fq: don't follow the fast path if Tx is behind now Xiuhong Wang <xiuhong.wang(a)unisoc.com> f2fs: fix fiemap failure issue when page size is 16KB Niklas Schnelle <schnelle(a)linux.ibm.com> s390/pci: Fix potential double remove of hotplug slot Nícolas F. R. A. Prado <nfraprado(a)collabora.com> ASoC: mediatek: Check num_codecs is not zero to avoid panic during probe Venkata Prasad Potturu <venkataprasad.potturu(a)amd.com> ASoC: amd: yc: Fix for enabling DMIC on acp6x via _DSD entry Zichen Xie <zichenxie0106(a)gmail.com> ALSA: core: Fix possible NULL dereference caused by kunit_kzalloc() chao liu <liuzgyid(a)outlook.com> apparmor: fix 'Do simple duplicate message elimination' Nirmoy Das <nirmoy.das(a)intel.com> drm/xe/ufence: Wake up waiters after setting ufence->signalled Charles Han <hanchunchao(a)inspur.com> ASoC: imx-audmix: Add NULL check in imx_audmix_probe Zicheng Qu <quzicheng(a)huawei.com> drm/amd/display: Fix null check for pipe_ctx->plane_state in hwss_setup_dpp Zicheng Qu <quzicheng(a)huawei.com> drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe Steven 'Steve' Kendall <skend(a)chromium.org> drm/radeon: Fix spurious unplug event on radeon HDMI Kailang Yang <kailang(a)realtek.com> ALSA: hda/realtek: Update ALC256 depop procedure Gaosheng Cui <cuigaosheng1(a)huawei.com> firmware_loader: Fix possible resource leak in fw_log_firmware_info() Dan Carpenter <dan.carpenter(a)linaro.org> usb: typec: fix potential array underflow in ucsi_ccg_sync_control() Carl Vanderlip <quic_carlv(a)quicinc.com> bus: mhi: host: Switch trace_mhi_gen_tre fields to native endian Jiasheng Jiang <jiashengjiangcool(a)gmail.com> counter: ti-ecap-capture: Add check for clk_enable() Jiasheng Jiang <jiashengjiangcool(a)gmail.com> counter: stm32-timer-cnt: Add check for clk_enable() Charles Han <hanchunchao(a)inspur.com> phy: realtek: usb: fix NULL deref in rtk_usb3phy_probe Charles Han <hanchunchao(a)inspur.com> phy: realtek: usb: fix NULL deref in rtk_usb2phy_probe Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: accel: adxl380: fix raw sample read Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> iio: adc: pac1921: Check for error code from devm_mutex_init() call Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> iio: adc: ad4000: Check for error code from devm_mutex_init() call David Lechner <dlechner(a)baylibre.com> iio: adc: ad4000: fix reading unsigned data Yang Yingliang <yangyingliang(a)huawei.com> iio: backend: fix wrong pointer passed to IS_ERR() Raviteja Laggyshetty <quic_rlaggysh(a)quicinc.com> interconnect: qcom: icc-rpmh: probe defer incase of missing QoS clock dependency Michael Grzeschik <m.grzeschik(a)pengutronix.de> usb: gadget: uvc: wake pump everytime we update the free list Keita Morisaki <keyz(a)google.com> devres: Fix page faults when tracing devres from unloaded modules Jinjie Ruan <ruanjinjie(a)huawei.com> misc: apds990x: Fix missing pm_runtime_disable() Edward Adam Davis <eadavis(a)qq.com> USB: chaoskey: Fix possible deadlock chaoskey_list_lock Oliver Neukum <oneukum(a)suse.com> USB: chaoskey: fail open after removal Oliver Neukum <oneukum(a)suse.com> usb: yurex: make waiting on yurex_write interruptible Jeongjun Park <aha310510(a)gmail.com> usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> iio: light: al3010: Fix an error handling path in al3010_probe() Paolo Abeni <pabeni(a)redhat.com> ipmr: fix tables suspicious RCU usage Paolo Abeni <pabeni(a)redhat.com> ip6mr: fix tables suspicious RCU usage Kuniyuki Iwashima <kuniyu(a)amazon.com> tcp: Fix use-after-free of nreq in reqsk_timer_handler(). Michal Luczaj <mhal(a)rbox.co> rxrpc: Improve setsockopt() handling of malformed user input Michal Luczaj <mhal(a)rbox.co> llc: Improve setsockopt() handling of malformed user input Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: MGMT: Fix possible deadlocks Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Unregister PTP during PCI shutdown and suspend Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Refactor bnxt_ptp_init() Shravya KN <shravya.k-n(a)broadcom.com> bnxt_en: Fix receive ring space parameters when XDP is active Somnath Kotur <somnath.kotur(a)broadcom.com> bnxt_en: Fix queue start to update vnic RSS table Shravya KN <shravya.k-n(a)broadcom.com> bnxt_en: Set backplane link modes correctly for ethtool Saravanan Vajravel <saravanan.vajravel(a)broadcom.com> bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down Eric Dumazet <edumazet(a)google.com> net: hsr: fix hsr_init_sk() vs network/transport headers. Csókás, Bence <csokas.bence(a)prolan.hu> spi: atmel-quadspi: Fix register name in verbose logging function Hariprasad Kelam <hkelam(a)marvell.com> octeontx2-af: Quiesce traffic before NIX block reset Hariprasad Kelam <hkelam(a)marvell.com> octeontx2-af: RPM: fix stale FCFEC counters Hariprasad Kelam <hkelam(a)marvell.com> octeontx2-af: RPM: fix stale RSFEC counters Hariprasad Kelam <hkelam(a)marvell.com> octeontx2-af: RPM: Fix low network performance Hariprasad Kelam <hkelam(a)marvell.com> octeontx2-af: RPM: Fix mismatch in lmac type Maxime Chevallier <maxime.chevallier(a)bootlin.com> net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken Vitalii Mordan <mordan(a)ispras.ru> marvell: pxa168_eth: fix call balance of pep->clk handling routines Rosen Penev <rosenp(a)gmail.com> net: mdio-ipq4019: add missing error check Hangbin Liu <liuhangbin(a)gmail.com> net/ipv6: delete temporary address if mngtmpaddr is removed or unmanaged Justin Lai <justinlai0215(a)realtek.com> rtase: Corrects error handling of the rtase_check_mac_version_valid() Justin Lai <justinlai0215(a)realtek.com> rtase: Correct the speed for RTL907XD-V1 Justin Lai <justinlai0215(a)realtek.com> rtase: Refactor the rtase_check_mac_version_valid() function Sidraya Jayagond <sidraya(a)linux.ibm.com> s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() James Chapman <jchapman(a)katalix.com> net/l2tp: fix warning in l2tp_exit_net found by syzbot Yuezhang Mo <Yuezhang.Mo(a)sony.com> exfat: fix file being changed by unaligned direct write Jakub Kicinski <kuba(a)kernel.org> netlink: fix false positive warning in extack during dumps Guenter Roeck <linux(a)roeck-us.net> net: microchip: vcap: Add typegroup table terminators in kunit tests Oleksij Rempel <o.rempel(a)pengutronix.de> net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration Pavan Chebbi <pavan.chebbi(a)broadcom.com> tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets Oleksij Rempel <o.rempel(a)pengutronix.de> net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device Oleksij Rempel <o.rempel(a)pengutronix.de> net: usb: lan78xx: Fix double free issue with interrupt buffer allocation Arnd Bergmann <arnd(a)arndb.de> power: reset: ep93xx: add AUXILIARY_BUS dependency Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: Equivalent transition from page to folio ChiYuan Huang <cy_huang(a)richtek.com> power: supply: rt9471: Use IC status regfield to report real charger status ChiYuan Huang <cy_huang(a)richtek.com> power: supply: rt9471: Fix wrong WDT function regfield declaration Barnabás Czémán <barnabas.czeman(a)mainlining.org> power: supply: bq27xxx: Fix registers of bq27426 Bart Van Assche <bvanassche(a)acm.org> power: supply: core: Remove might_sleep() from power_supply_put() Tiezhu Yang <yangtiezhu(a)loongson.cn> LoongArch: BPF: Sign-extend return values Tiezhu Yang <yangtiezhu(a)loongson.cn> LoongArch: Fix build failure with GCC 15 (-std=gnu23) Randy Dunlap <rdunlap(a)infradead.org> fs_parser: update mount_api doc to match function signature Avihai Horon <avihaih(a)nvidia.com> vfio/pci: Properly hide first-in-list PCIe extended capability Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> gpio: zevio: Add missed label initialisation Michael Ellerman <mpe(a)ellerman.id.au> selftests/mount_setattr: Fix failures on 64K PAGE_SIZE kernels Yishai Hadas <yishaih(a)nvidia.com> vfio/mlx5: Fix unwind flows in mlx5vf_pci_save/resume_device_data() Yishai Hadas <yishaih(a)nvidia.com> vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() Si-Wei Liu <si-wei.liu(a)oracle.com> vdpa/mlx5: Fix suboptimal range on iotlb iteration Lorenzo Bianconi <lorenzo(a)kernel.org> phy: airoha: Fix REG_CSR_2L_RX{0,1}_REV0 definitions Lorenzo Bianconi <lorenzo(a)kernel.org> phy: airoha: Fix REG_CSR_2L_JCPLL_SDM_HREN config in airoha_pcie_phy_init_ssc_jcpll() Lorenzo Bianconi <lorenzo(a)kernel.org> phy: airoha: Fix REG_PCIE_PMA_TX_RESET config in airoha_pcie_phy_init_csr_2l() Lorenzo Bianconi <lorenzo(a)kernel.org> phy: airoha: Fix REG_CSR_2L_PLL_CMN_RESERVE0 config in airoha_pcie_phy_init_clk_out() Aleksa Savic <savicaleksa83(a)gmail.com> hwmon: (aquacomputer_d5next) Fix length of speed_input array Murad Masimov <m.masimov(a)maxima.ru> hwmon: (tps23861) Fix reporting of negative temperatures Hao Ge <gehao(a)kylinos.cn> perf bpf-filter: Return -ENOMEM directly when pfi allocation fails Chao Yu <chao(a)kernel.org> f2fs: fix to do cast in F2FS_{BLK_TO_BYTES, BTYES_TO_BLK} to avoid overflow Mike Snitzer <snitzer(a)kernel.org> nfs_common: must not hold RCU while calling nfsd_file_put_local Chuck Lever <chuck.lever(a)oracle.com> NFSD: Fix nfsd4_shutdown_copy() Ye Bin <yebin10(a)huawei.com> svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() Yang Erkun <yangerkun(a)huawei.com> nfsd: release svc_expkey/svc_export with rcu_work Chuck Lever <chuck.lever(a)oracle.com> NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir() Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent NULL dereference in nfsd4_process_cb_update() Zhongqiu Han <quic_zhonhan(a)quicinc.com> PCI: endpoint: epf-mhi: Avoid NULL dereference if DT lacks 'mmio' Sibi Sankar <quic_sibis(a)quicinc.com> remoteproc: qcom_q6v5_mss: Re-order writes to the IMEM region Jonathan Marek <jonathan(a)marek.ca> rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> remoteproc: qcom: pas: add minidump_id to SM8350 resources Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> remoteproc: qcom: adsp: Remove subdevs on the error path of adsp_probe() Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> remoteproc: qcom: pas: Remove subdevs on the error path of adsp_probe() Benjamin Peterson <benjamin(a)engflow.com> perf trace: Avoid garbage when not printing a syscall's arguments Benjamin Peterson <benjamin(a)engflow.com> perf trace: Do not lose last events in a race Howard Chu <howardchu95(a)gmail.com> perf trace: Fix tracing itself, creating feedback loops Jean-Philippe Romain <jean-philippe.romain(a)foss.st.com> perf list: Fix topic and pmu_name argument order Jeff Layton <jlayton(a)kernel.org> nfsd: drop inode parameter from nfsd4_change_attribute() Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Address an integer overflow Antonio Quartulli <antonio(a)mandelbit.com> m68k: coldfire/device.c: only build FEC when HW macros are defined Jean-Michel Hautbois <jeanmichel.hautbois(a)yoseli.org> m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x Benjamin Peterson <benjamin(a)engflow.com> perf trace: avoid garbage when not printing a trace event's arguments Chao Yu <chao(a)kernel.org> f2fs: fix to avoid forcing direct write to use buffered IO on inline_data inode Chao Yu <chao(a)kernel.org> f2fs: fix to map blocks correctly for direct write Long Li <leo.lilong(a)huawei.com> f2fs: fix race in concurrent f2fs_stop_gc_thread Yicong Yang <yangyicong(a)hisilicon.com> perf build: Add missing cflags when building with custom libtraceevent Siddharth Vadapalli <s-vadapalli(a)ti.com> PCI: j721e: Deassert PERST# after a delay of PCIE_T_PVPERL_MS milliseconds Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> PCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert() Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert() Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported Zhiguo Niu <zhiguo.niu(a)unisoc.com> f2fs: fix to avoid use GC_AT when setting gc_mode as GC_URGENT_LOW or GC_URGENT_MID Chao Yu <chao(a)kernel.org> f2fs: fix to avoid potential deadlock in f2fs_record_stop_reason() Zeng Heng <zengheng4(a)huawei.com> f2fs: Fix not used variable 'index' Yongpeng Yang <yangyongpeng1(a)oppo.com> f2fs: check curseg->inited before write_sum_page in change_curseg LongPing Wei <weilongping(a)oppo.com> f2fs: fix the wrong f2fs_bug_on condition in f2fs_do_replace_block Frank Li <Frank.Li(a)nxp.com> i3c: master: Remove i3c_dev_disable_ibi_locked(olddev) on device hotjoin Arnaldo Carvalho de Melo <acme(a)kernel.org> perf ftrace latency: Fix unit on histogram first entry when using --use-nsec Hou Tao <houtao1(a)huawei.com> virtiofs: use pages instead of pointer for kernel direct IO Li Huafei <lihuafei1(a)huawei.com> perf disasm: Fix not cleaning up disasm_line in symbol__disassemble_raw() Li Huafei <lihuafei1(a)huawei.com> perf disasm: Use disasm_line__free() to properly free disasm_line Francesco Zardi <frazar00(a)gmail.com> rust: block: fix formatting of `kernel::block::mq::request` module Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> PCI: cpqphp: Fix PCIBIOS_* return value confusion Paolo Bonzini <pbonzini(a)redhat.com> rust: macros: fix documentation of the paste! macro Yutaro Ohno <yutaro.ono.418(a)gmail.com> rust: kernel: fix THIS_MODULE header path in ThisModule doc comment Leo Yan <leo.yan(a)arm.com> perf probe: Correct demangled symbols in C++ program Ian Rogers <irogers(a)google.com> perf probe: Fix libdw memory leak Ian Rogers <irogers(a)google.com> perf disasm: Fix capstone memory leak Veronika Molnarova <vmolnaro(a)redhat.com> perf dso: Fix symtab_type for kmod compression Chao Yu <chao(a)kernel.org> f2fs: fix to account dirty data in __get_secs_required() Arnd Bergmann <arnd(a)arndb.de> mailbox, remoteproc: k3-m4+: fix compile testing Ye Bin <yebin10(a)huawei.com> f2fs: fix null-ptr-deref in f2fs_submit_page_bio() Qi Han <hanqi(a)vivo.com> f2fs: compress: fix inconsistent update of i_blocks in release_compress_blocks and reserve_compress_blocks Miguel Ojeda <ojeda(a)kernel.org> rust: rbtree: fix `SAFETY` comments that should be `# Safety` sections Veronika Molnarova <vmolnaro(a)redhat.com> perf test attr: Add back missing topdown events Michael Petlan <mpetlan(a)redhat.com> perf trace: Keep exited threads for summary Ian Rogers <irogers(a)google.com> perf stat: Fix affinity memory leaks on error path Levi Yun <yeoreum.yun(a)arm.com> perf stat: Close cork_fd when create_perf_stat_counter() failed Kan Liang <kan.liang(a)linux.intel.com> perf jevents: Don't stop at the first matched pmu when searching a events table Todd Kjos <tkjos(a)google.com> PCI: Fix reset_method_store() memory leak Fei Shao <fshao(a)chromium.org> dt-bindings: PCI: mediatek-gen3: Allow exact number of clocks only Thomas Falcon <thomas.falcon(a)intel.com> perf mem: Fix printing PERF_MEM_LVLNUM_{L2_MHB|MSC} Ian Rogers <irogers(a)google.com> perf stat: Uniquify event name improvements Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: Fix unlinked inode cleanup Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: Allow immediate GLF_VERIFY_DELETE work Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE James Clark <james.clark(a)linaro.org> perf cs-etm: Don't flush when packet_queue fills up David Laight <David.Laight(a)ACULAB.COM> x86: fix off-by-one in access_ok() Dan Carpenter <dan.carpenter(a)linaro.org> mailbox: arm_mhuv2: clean up loop in get_irq_chan_comb() Yang Yingliang <yangyingliang(a)huawei.com> mailbox: mtk-cmdq: fix wrong use of sizeof in cmdq_get_clocks() Paul Aurich <paul(a)darkrain42.org> smb: cached directories can be more than root file handle Tomas Glozar <tglozar(a)redhat.com> rtla/timerlat: Do not set params->user_workload with -U zhang jiao <zhangjiao2(a)cmss.chinamobile.com> pinctrl: k210: Undef K210_PC_DEFAULT Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> arm64: dts: qcom: sc8180x: Add a SoC-specific compatible to cpufreq-hw Kalesh AP <kalesh-anakkur.purayil(a)broadcom.com> RDMA/bnxt_re: Correct the sequence of device suspend Liu Shixin <liushixin2(a)huawei.com> zram: fix NULL pointer in comp_algorithm_show() Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: permit only one post-processing operation at a time Nuno Sa <nuno.sa(a)analog.com> clk: clk-axi-clkgen: make sure to enable the AXI bus clock Nuno Sa <nuno.sa(a)analog.com> dt-bindings: clock: axi-clkgen: include AXI clk Lorenzo Bianconi <lorenzo(a)kernel.org> clk: en7523: fix estimation of fixed rate for EN7581 Lorenzo Bianconi <lorenzo(a)kernel.org> clk: en7523: introduce chip_scu regmap Lorenzo Bianconi <lorenzo(a)kernel.org> clk: en7523: move clock_register in hw_init callback Lorenzo Bianconi <lorenzo(a)kernel.org> clk: en7523: remove REG_PCIE*_{MEM,MEM_MASK} configuration Sergio Paracuellos <sergio.paracuellos(a)gmail.com> clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs Sergio Paracuellos <sergio.paracuellos(a)gmail.com> clk: ralink: mtmips: fix clock plan for Ralink SoC RT3883 Charles Han <hanchunchao(a)inspur.com> clk: clk-apple-nco: Add NULL check in applnco_probe Patrisious Haddad <phaddad(a)nvidia.com> RDMA/mlx5: Move events notifier registration to be after device registration Zhen Lei <thunder.leizhen(a)huawei.com> fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() Zhang Zekun <zhangzekun11(a)huawei.com> powerpc/kexec: Fix return of uninitialized variable Kajol Jain <kjain(a)linux.ibm.com> KVM: PPC: Book3S HV: Fix kmv -> kvm typo Feng Fang <fangfeng4(a)huawei.com> RDMA/hns: Fix different dgids mapping to the same dip_idx Michal Suchanek <msuchanek(a)suse.de> powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static Gautam Menghani <gautam(a)linux.ibm.com> KVM: PPC: Book3S HV: Avoid returning to nested hypervisor on pending doorbells Gautam Menghani <gautam(a)linux.ibm.com> KVM: PPC: Book3S HV: Stop using vc->dpdes for nested KVM guests Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> dax: delete a stale directory pmem Nicolin Chen <nicolinc(a)nvidia.com> iommu/tegra241-cmdqv: Fix alignment failure at max_n_shift Geert Uytterhoeven <geert(a)linux-m68k.org> zram: ZRAM_DEF_COMP should depend on ZRAM Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: fix uninitialized value in ocfs2_file_read_iter() Dan Carpenter <dan.carpenter(a)linaro.org> kunit: skb: use "gfp" variable instead of hardcoding GFP_KERNEL Sabyrzhan Tasbolatov <snovitoll(a)gmail.com> kasan: move checks to do_strncpy_from_user Jinjie Ruan <ruanjinjie(a)huawei.com> cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_power() Jinjie Ruan <ruanjinjie(a)huawei.com> cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_cost() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> cpufreq: loongson3: Check for error code from devm_mutex_init() call Junxian Huang <huangjunxian6(a)hisilicon.com> RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg() Junxian Huang <huangjunxian6(a)hisilicon.com> RDMA/hns: Fix out-of-order issue of requester when setting FENCE Sourabh Jain <sourabhjain(a)linux.ibm.com> fadump: reserve param area if below boot_mem_top Hari Bathini <hbathini(a)linux.ibm.com> powerpc/fadump: allocate memory for additional parameters early Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> x86/tdx: Dynamically disable SEPT violations from causing #VEs Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> x86/tdx: Rename tdx_parse_tdinfo() to tdx_setup() Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> x86/tdx: Introduce wrappers to read and write TD metadata Bart Van Assche <bvanassche(a)acm.org> scsi: sg: Enable runtime power management Zhen Lei <thunder.leizhen(a)huawei.com> scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() Zhen Lei <thunder.leizhen(a)huawei.com> scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() Zeng Heng <zengheng4(a)huawei.com> scsi: fusion: Remove unused variable 'rc' Ye Bin <yebin10(a)huawei.com> scsi: bfa: Fix use-after-free in bfad_im_module_exit() Baolin Liu <liubaolin(a)kylinos.cn> scsi: target: Fix incorrect function name in pscsi_create_type_disk() Mirsad Todorovac <mtodorovac69(a)gmail.com> fs/proc/kcore.c: fix coccinelle reported ERROR instances Raymond Hackley <raymondhackley(a)protonmail.com> leds: ktd2692: Set missing timing properties Javier Carrasco <javier.carrasco.cruz(a)gmail.com> leds: max5970: Fix unreleased fwnode_handle in probe function Zhang Changzhong <zhangchangzhong(a)huawei.com> mfd: rt5033: Fix missing regmap_del_irq_chip() Tamir Duberstein <tamird(a)gmail.com> checkpatch: always parse orig_commit in fixes tag Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommu/vt-d: Fix checks and print in pgtable_walk() Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommu/vt-d: Fix checks and print in dmar_fault_dump_ptes() Yang Yingliang <yangyingliang(a)huawei.com> clk: imx: imx8-acm: Fix return value check in clk_imx_acm_attach_pm_domains() Dong Aisheng <aisheng.dong(a)nxp.com> clk: imx: clk-scu: fix clk enable state save and restore Peng Fan <peng.fan(a)nxp.com> clk: imx: fracn-gppll: fix pll power up Peng Fan <peng.fan(a)nxp.com> clk: imx: fracn-gppll: correct PLL initialization flow Peng Fan <peng.fan(a)nxp.com> clk: imx: lpcg-scu: SW workaround for errata (e10858) Björn Töpel <bjorn(a)rivosinc.com> riscv: kvm: Fix out-of-bounds array access Yong-Xuan Wang <yongxuan.wang(a)sifive.com> RISC-V: KVM: Fix APLIC in_clrip and clripnum write emulation Chiara Meiohas <cmeiohas(a)nvidia.com> RDMA/mlx5: Ensure active slave attachment to the bond IB device Chiara Meiohas <cmeiohas(a)nvidia.com> RDMA/core: Implement RoCE GID port rescan and export delete function Chiara Meiohas <cmeiohas(a)nvidia.com> RDMA/mlx5: Call dev_put() after the blocking notifier Liu Jian <liujian56(a)huawei.com> RDMA/rxe: Set queue pair cur_qp_state when being queried Biju Das <biju.das.jz(a)bp.renesas.com> clk: renesas: rzg2l: Fix FOUTPOSTDIV clk Andre Przywara <andre.przywara(a)arm.com> clk: sunxi-ng: d1: Fix PLL_AUDIO0 preset Kashyap Desai <kashyap.desai(a)broadcom.com> RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey Zhu Yanjun <yanjun.zhu(a)linux.dev> RDMA/rxe: Fix the qp flush warnings in req wenglianfa <wenglianfa(a)huawei.com> RDMA/hns: Fix cpu stuck caused by printings during reset Junxian Huang <huangjunxian6(a)hisilicon.com> RDMA/hns: Use dev_* printings in hem code instead of ibdev_* Yuyu Li <liyuyu6(a)huawei.com> RDMA/hns: Modify debugfs name wenglianfa <wenglianfa(a)huawei.com> RDMA/hns: Fix flush cqe error when racing with destroy qp wenglianfa <wenglianfa(a)huawei.com> RDMA/hns: Fix an AEQE overflow error caused by untimely update of eq_db_ci Vasant Hegde <vasant.hegde(a)amd.com> iommu/amd/pgtbl_v2: Take protection domain lock before invalidating TLB Jinjie Ruan <ruanjinjie(a)huawei.com> cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost() Jinjie Ruan <ruanjinjie(a)huawei.com> cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw() Michael Ellerman <mpe(a)ellerman.id.au> powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore Takahiro Kuwano <Takahiro.Kuwano(a)infineon.com> mtd: spi-nor: spansion: Use nor->addr_nbytes in octal DTR mode in RD_ANY_REG_OP Zichen Xie <zichenxie0106(a)gmail.com> clk: sophgo: avoid integer overflow in sg2042_pll_recalc_rate() Nicolin Chen <nicolinc(a)nvidia.com> iommu/tegra241-cmdqv: Staticize cmdqv_debugfs_dir Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> powerpc/mm/fault: Fix kfence page fault reporting Stephen Boyd <sboyd(a)kernel.org> clk: Allow kunit tests to run without OF_OVERLAY enabled Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: rawnand: atmel: Fix possible memory leak Biju Das <biju.das.jz(a)bp.renesas.com> mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> powerpc/fadump: Refactor and prepare fadump_cma_init for late init Yuan Can <yuancan(a)huawei.com> cpufreq: loongson2: Unregister platform_driver on failure Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> mfd: intel_soc_pmic_bxtwc: Fix IRQ domain names duplication Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device Marcus Folkesson <marcus.folkesson(a)gmail.com> mfd: da9052-spi: Change read-mask to write-mask Jinjie Ruan <ruanjinjie(a)huawei.com> mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/vdso: Flag VDSO64 entry points as functions Yihang Li <liyihang9(a)huawei.com> scsi: hisi_sas: Enable all PHYs that are not disabled by user during controller reset Matthew Rosato <mjrosato(a)linux.ibm.com> iommu/s390: Implement blocking domain Jonathan Marek <jonathan(a)marek.ca> clk: qcom: videocc-sm8550: depend on either gcc-sm8550 or gcc-sm8650 Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> pinctrl: renesas: Select PINCTRL_RZG2L for RZ/V2H(P) SoC Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> pinctrl: zynqmp: drop excess struct member description Levi Yun <yeoreum.yun(a)arm.com> trace/trace_event_perf: remove duplicate samples on the first tracepoint event Lukas Bulwahn <lukas.bulwahn(a)redhat.com> clk: mediatek: drop two dead config options Biju Das <biju.das.jz(a)bp.renesas.com> pinctrl: renesas: rzg2l: Fix missing return in rzg2l_pinctrl_register() Chengchang Tang <tangchengchang(a)huawei.com> RDMA/hns: Disassociate mmap pages for all uctx when HW is being reset Chengchang Tang <tangchengchang(a)huawei.com> RDMA/core: Provide rdma_user_mmap_disassociate() to disassociate mmap pages Jie Zhan <zhanjie9(a)hisilicon.com> cppc_cpufreq: Use desired perf if feedback ctrs are 0 or unchanged André Almeida <andrealmeid(a)igalia.com> unicode: Fix utf8_load() error path Jiayuan Chen <mrpre(a)163.com> bpf: fix recursive lock when verdict program return SK_PASS Hangbin Liu <liuhangbin(a)gmail.com> wireguard: selftests: load nf_conntrack if not present Breno Leitao <leitao(a)debian.org> netpoll: Use rcu_access_pointer() in netpoll_poll_lock Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix null pointer to pcs Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: remove GPIO interrupt controller Jakub Kicinski <kuba(a)kernel.org> eth: fbnic: don't disable the PCI device twice Alexander Aring <aahringo(a)redhat.com> dlm: fix dlm_recover_members refcount on error Gao Xiang <xiang(a)kernel.org> erofs: handle NONHEAD !delta[1] lclusters gracefully Hongzhen Luo <hongzhen(a)linux.alibaba.com> erofs: fix blksize < PAGE_SIZE for file-backed mounts Gao Xiang <xiang(a)kernel.org> erofs: fix file-backed mounts over FUSE Felix Maurer <fmaurer(a)redhat.com> xsk: Free skb when TX metadata options are invalid Dmitry Antipov <dmantipov(a)yandex.ru> Bluetooth: fix use-after-free in device_for_each_child() Iulia Tanasescu <iulia.tanasescu(a)nxp.com> Bluetooth: ISO: Send BIG Create Sync via hci_sync Iulia Tanasescu <iulia.tanasescu(a)nxp.com> Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending Iulia Tanasescu <iulia.tanasescu(a)nxp.com> Bluetooth: ISO: Do not emit LE PA Create Sync if previous is pending Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: ISO: Use kref to track lifetime of iso_conn Javier Carrasco <javier.carrasco.cruz(a)gmail.com> Bluetooth: btbcm: fix missing of_node_put() in btbcm_get_board_name() Chris Lu <chris.lu(a)mediatek.com> Bluetooth: btmtk: adjust the position to init iso data anchor Kiran K <kiran.k(a)intel.com> Bluetooth: btintel: Do no pass vendor events to stack Kiran K <kiran.k(a)intel.com> Bluetooth: btintel_pcie: Add handshake between driver and firmware guanjing <guanjing(a)cmss.chinamobile.com> selftests: netfilter: Fix missing return values in conntrack_dump_flush Igor Pylypiv <ipylypiv(a)google.com> i2c: dev: Fix memory leak when underlying adapter does not support I2C Takashi Iwai <tiwai(a)suse.de> ALSA: 6fire: Release resources at card release Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Use snd_card_free_when_closed() at disconnection Takashi Iwai <tiwai(a)suse.de> ALSA: us122l: Use snd_card_free_when_closed() at disconnection Takashi Iwai <tiwai(a)suse.de> ALSA: usx2y: Use snd_card_free_when_closed() at disconnection Xu Kuohai <xukuohai(a)huawei.com> bpf: Add kernel symbol for struct_ops trampoline Xu Kuohai <xukuohai(a)huawei.com> bpf: Use function pointers count as struct_ops links count Kalle Valo <kvalo(a)kernel.org> Revert "wifi: iwlegacy: do not skip frames with bad FCS" Mingwei Zheng <zmw12306(a)gmail.com> net: rfkill: gpio: Add check for clk_enable() Omid Ehtemam-Haghighi <omid.ehtemamhaghighi(a)menlosecurity.com> ipv6: Fix soft lockups in fib6_select_path under high next hop churn Viktor Malik <vmalik(a)redhat.com> selftests/bpf: skip the timer_lockup test for single-CPU nodes Jiri Olsa <jolsa(a)kernel.org> bpf: Force uprobe bpf program to always return 0 Jiri Olsa <jolsa(a)kernel.org> bpf: Allow return values 0 and 1 for kprobe session Yuan Can <yuancan(a)huawei.com> drm/amdkfd: Fix wrong usage of INIT_WORK() Lijo Lazar <lijo.lazar(a)amd.com> drm/amdgpu: Fix map/unmap queue logic Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: fix ACA bank count boundary check error Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> wifi: iwlwifi: mvm: tell iwlmei when we finished suspending Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> wifi: iwlwifi: allow fast resume on ax200 Lingbo Kong <quic_lingbok(a)quicinc.com> wifi: cfg80211: Remove the Medium Synchronization Delay validity check Paolo Abeni <pabeni(a)redhat.com> selftests: net: really check for bg process completion Paolo Abeni <pabeni(a)redhat.com> ipv6: release nexthop on device removal Zijian Zhang <zijianzhang(a)bytedance.com> bpf, sockmap: Fix sk_msg_reset_curr Zijian Zhang <zijianzhang(a)bytedance.com> bpf, sockmap: Several fixes to bpf_msg_pop_data Zijian Zhang <zijianzhang(a)bytedance.com> bpf, sockmap: Several fixes to bpf_msg_push_data Zijian Zhang <zijianzhang(a)bytedance.com> selftests/bpf: Add push/pop checking for msg_verify_data in test_sockmap Zijian Zhang <zijianzhang(a)bytedance.com> selftests/bpf: Fix total_bytes in msg_loop_rx in test_sockmap Zijian Zhang <zijianzhang(a)bytedance.com> selftests/bpf: Fix SENDPAGE data logic in test_sockmap Zijian Zhang <zijianzhang(a)bytedance.com> selftests/bpf: Add txmsg_pass to pull/push/pop in test_sockmap Hao Ge <gehao(a)kylinos.cn> isofs: avoid memory leak in iocharset Adrián Larumbe <adrian.larumbe(a)collabora.com> drm/panthor: Fix OPP refcnt leaks in devfreq initialisation Adrián Larumbe <adrian.larumbe(a)collabora.com> drm/panthor: record current and maximum device clock frequencies Adrián Larumbe <adrian.larumbe(a)collabora.com> drm/panthor: introduce job cycle and timestamp accounting Adrián Larumbe <adrian.larumbe(a)collabora.com> drm/panfrost: Add missing OPP table refcnt decremental Pei Xiao <xiaopei01(a)kylinos.cn> wifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg() Maurice Lambert <mauricelambert434(a)gmail.com> netlink: typographical error in nlmsg_type constants definition Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: must hold rcu read lock while iterating object type list Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: must hold rcu read lock while iterating expression type list Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion Jonathan Gray <jsg(a)jsg.id.au> drm: use ATOMIC64_INIT() for atomic64_t Kumar Kartikeya Dwivedi <memxor(a)gmail.com> bpf: Mark raw_tp arguments with PTR_MAYBE_NULL Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amdkfd: Use dynamic allocation for CU occupancy array in 'kfd_get_cu_occupancy()' Li Huafei <lihuafei1(a)huawei.com> drm/amdgpu: Fix the memory allocation issue in amdgpu_discovery_get_nps_info() José Expósito <jose.exposito89(a)gmail.com> drm/vkms: Drop unnecessary call to drm_crtc_cleanup() Kumar Kartikeya Dwivedi <memxor(a)gmail.com> bpf: Tighten tail call checks for lingering locks, RCU, preempt_disable Leon Hwang <leon.hwang(a)linux.dev> bpf, bpftool: Fix incorrect disasm pc Zichen Xie <zichenxie0106(a)gmail.com> drm/msm/dpu: cast crtc_clk calculation to u64 in _dpu_core_perf_calc_clk() Linus Walleij <linus.walleij(a)linaro.org> wifi: cw1200: Fix potential NULL dereference Yuan Can <yuancan(a)huawei.com> wifi: wfx: Fix error handling in wfx_core_init() Steffen Dirkwinkel <s.dirkwinkel(a)beckhoff.com> drm: xlnx: zynqmp_disp: layer may be null while releasing Sean Anderson <sean.anderson(a)linux.dev> drm: zynqmp_kms: Unplug DRM device before removal Li Huafei <lihuafei1(a)huawei.com> drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new() Fangzhi Zuo <Jerry.Zuo(a)amd.com> drm/amd/display: Reduce HPD Detection Interval for IPS Roman Li <Roman.Li(a)amd.com> drm/amd/display: Increase idle worker HPD detection time Lucas Stach <l.stach(a)pengutronix.de> drm/etnaviv: hold GPU lock across perfmon sampling Xiaolei Wang <xiaolei.wang(a)windriver.com> drm/etnaviv: Request pages from DMA32 zone on addressing_limited Suraj Kandpal <suraj.kandpal(a)intel.com> drm/xe/hdcp: Fix gsc structure check in fw check status Lukasz Luba <lukasz.luba(a)arm.com> drm/msm/gpu: Check the status of registration to PM QoS Jinjie Ruan <ruanjinjie(a)huawei.com> drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq() Xu Kuohai <xukuohai(a)huawei.com> bpf, arm64: Remove garbage frame for struct_ops trampoline Steven Price <steven.price(a)arm.com> drm/panfrost: Remove unused id_mask from struct panfrost_model Dan Carpenter <dan.carpenter(a)linaro.org> wifi: rtw89: unlock on error path in rtw89_ops_unassign_vif_chanctx() Po-Hao Huang <phhuang(a)realtek.com> wifi: rtw89: Fix TX fail with A2DP after scanning Zong-Zhe Yang <kevin_yang(a)realtek.com> wifi: rtw89: tweak driver architecture for impending MLO support Zong-Zhe Yang <kevin_yang(a)realtek.com> wifi: rtw89: refactor STA related func ahead for MLO Zong-Zhe Yang <kevin_yang(a)realtek.com> wifi: rtw89: refactor VIF related func ahead for MLO Zong-Zhe Yang <kevin_yang(a)realtek.com> wifi: rtw89: read link_sta corresponding to the link Zong-Zhe Yang <kevin_yang(a)realtek.com> wifi: rtw89: read bss_conf corresponding to the link Zong-Zhe Yang <kevin_yang(a)realtek.com> wifi: rtw89: rename rtw89_sta to rtw89_sta_link ahead for MLO Zong-Zhe Yang <kevin_yang(a)realtek.com> wifi: rtw89: rename rtw89_vif to rtw89_vif_link ahead for MLO Andrii Nakryiko <andrii(a)kernel.org> libbpf: move global data mmap()'ing into bpf_object__load() Andrii Nakryiko <andrii(a)kernel.org> selftests/bpf: fix test_spin_lock_fail.c's global vars usage Dipendra Khadka <kdipendra88(a)gmail.com> octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c Dipendra Khadka <kdipendra88(a)gmail.com> octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c Dipendra Khadka <kdipendra88(a)gmail.com> octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c Dipendra Khadka <kdipendra88(a)gmail.com> octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c Dipendra Khadka <kdipendra88(a)gmail.com> octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c Dipendra Khadka <kdipendra88(a)gmail.com> octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/msm/dpu: drop LM_3 / LM_4 on MSM8998 Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/msm/dpu: drop LM_3 / LM_4 on SDM845 Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/msm/dpu: on SDM845 move DSPP_3 to LM_5 block Ryan Walklin <ryan(a)testtoast.com> drm: panel: nv3052c: correct spi_device_id for RG35XX panel Matthias Schiffer <matthias.schiffer(a)tq-group.com> drm: fsl-dcu: enable PIXCLK on LS1021A Alper Nebi Yasak <alpernebiyasak(a)gmail.com> wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() Marek Vasut <marex(a)denx.de> wifi: wilc1000: Set MAC after operation mode Sascha Hauer <s.hauer(a)pengutronix.de> wifi: mwifiex: add missing locking for cfg80211 calls Zijian Zhang <zijianzhang(a)bytedance.com> selftests/bpf: Fix txmsg_redir of test_txmsg_pull in test_sockmap Zijian Zhang <zijianzhang(a)bytedance.com> selftests/bpf: Fix msg_verify_data in test_sockmap Miguel Ojeda <ojeda(a)kernel.org> drm/panic: Select ZLIB_DEFLATE for DRM_PANIC_SCREEN_QR_CODE Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> drm/bridge: tc358767: Fix link properties discovery Hangbin Liu <liuhangbin(a)gmail.com> netdevsim: copy addresses for both in and out paths Andrii Nakryiko <andrii(a)kernel.org> libbpf: never interpret subprogs in .text as entry programs Everest K.C <everestkc(a)everestkc.com.np> ASoC: rt722-sdca: Remove logically deadcode in rt722-sdca.c Karol Wachowski <karol.wachowski(a)intel.com> accel/ivpu: Prevent recovery invocation during probe and resume Andrii Nakryiko <andrii(a)kernel.org> libbpf: fix sym_is_subprog() logic for weak global subprogs Dave Stevenson <dave.stevenson(a)raspberrypi.com> drm/vc4: Correct generation check in vc4_hvs_lut_load Dave Stevenson <dave.stevenson(a)raspberrypi.com> drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_atomic_flush Dave Stevenson <dave.stevenson(a)raspberrypi.com> drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_lut_load Maxime Ripard <mripard(a)kernel.org> drm/vc4: Introduce generation number enum Dom Cobley <popcornmix(a)gmail.com> drm/vc4: hdmi: Increase audio MAI fifo dreq threshold Jacob Keller <jacob.e.keller(a)intel.com> ice: consistently use q_idx in ice_vc_cfg_qs_msg() Karthikeyan Periyasamy <quic_periyasa(a)quicinc.com> wifi: cfg80211: check radio iface combination for multi radio per wiphy Alexis Lothoré (eBPF Foundation) <alexis.lothore(a)bootlin.com> selftests/bpf: add missing header include for htons Balaji Pothunoori <quic_bpothuno(a)quicinc.com> wifi: ath11k: Fix CE offset address calculation for WCN6750 in SSR Eduard Zingerman <eddyz87(a)gmail.com> selftests/bpf: Fix backtrace printing for selftests crashes Yuan Chen <chenyuan(a)kylinos.cn> bpf: Fix the xdp_adjust_tail sample prog issue Björn Töpel <bjorn(a)rivosinc.com> selftests: bpf: Add missing per-arch include path Björn Töpel <bjorn(a)rivosinc.com> libbpf: Add missing per-arch include path Arnd Bergmann <arnd(a)arndb.de> wifi: ath12k: fix one more memcpy size error Rameshkumar Sundaram <quic_ramess(a)quicinc.com> wifi: ath12k: fix use-after-free in ath12k_dp_cc_cleanup() Aurabindo Pillai <aurabindo.pillai(a)amd.com> drm/amd/display: fix a memleak issue when driver is removed Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> ASoC: amd: acp: fix for cpu dai index logic Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> ASoC: amd: acp: fix for inconsistent indenting Martin Kaistra <martin.kaistra(a)linutronix.de> wifi: rtl8xxxu: Perform update_beacon_work when beaconing is enabled Alexander Aring <aahringo(a)redhat.com> dlm: fix swapped args sb_flags vs sb_status Alan Maguire <alan.maguire(a)oracle.com> selftests/bpf: Fix uprobe_multi compilation error Tony Ambardar <tony.ambardar(a)gmail.com> libbpf: Fix output .symtab byte-order during linking Tao Chen <chen.dylane(a)gmail.com> libbpf: Fix expected_attach_type set handling in program load callback Pin-yen Lin <treapking(a)chromium.org> drm/bridge: it6505: Drop EDID cache on bridge power off Pin-yen Lin <treapking(a)chromium.org> drm/bridge: anx7625: Drop EDID cache on bridge power off Geert Uytterhoeven <geert+renesas(a)glider.be> ASoC: fsl-asoc-card: Add missing handling of {hp,mic}-dt-gpios Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amdgpu/gfx9: Add Cleaner Shader Deinitialization in gfx_v9_0 Module Macpaul Lin <macpaul.lin(a)mediatek.com> ASoC: dt-bindings: mt6359: Update generic node name and dmic-mode Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_micfil: fix regmap_write_bits usage Igor Prusov <ivprusov(a)salutedevices.com> dt-bindings: vendor-prefixes: Add NeoFidelity, Inc Ramya Gnanasekar <quic_rgnanase(a)quicinc.com> wifi: ath12k: Skip Rx TID cleanup for self peer Baochen Qiang <quic_bqiang(a)quicinc.com> wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss2 Baochen Qiang <quic_bqiang(a)quicinc.com> wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss1 Lijo Lazar <lijo.lazar(a)amd.com> drm/amdgpu: Fix JPEG v4.0.3 register write Maíra Canal <mcanal(a)igalia.com> drm/v3d: Flush the MMU before we supply more memory to the binner Maíra Canal <mcanal(a)igalia.com> drm/v3d: Address race-condition in MMU flush Linus Walleij <linus.walleij(a)linaro.org> drm/panel: nt35510: Make new commands optional Alexander Stein <alexander.stein(a)ew.tq-group.com> drm/imx: Add missing DRM_BRIDGE_CONNECTOR dependency Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/imx: parallel-display: switch to drm_panel_bridge Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/imx: ldb: switch to drm_panel_bridge Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/imx: ldb: drop custom DDC bus support Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/imx: ldb: drop custom EDID support Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/imx: parallel-display: drop edid override support Jinjie Ruan <ruanjinjie(a)huawei.com> drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq() Jinjie Ruan <ruanjinjie(a)huawei.com> drm/imx/dcss: Use IRQF_NO_AUTOEN flag in request_irq() Huan Yang <link(a)vivo.com> udmabuf: fix vmap_udmabuf error page set Huan Yang <link(a)vivo.com> udmabuf: change folios array from kmalloc to kvmalloc Jinjie Ruan <ruanjinjie(a)huawei.com> wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq() Jinjie Ruan <ruanjinjie(a)huawei.com> wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq() Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> drm/v3d: Appease lockdep while updating GPU stats Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> drm/omap: Fix locking in omap_gem_new_dmabuf() Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> drm/omap: Fix possible NULL dereference Jeongjun Park <aha310510(a)gmail.com> wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() Dave Stevenson <dave.stevenson(a)raspberrypi.com> drm/vc4: hvs: Correct logic on stopping an HVS channel Dave Stevenson <dave.stevenson(a)raspberrypi.com> drm/vc4: hvs: Remove incorrect limit from hvs_dlist debugfs function Dave Stevenson <dave.stevenson(a)raspberrypi.com> drm/vc4: hvs: Fix dlist debug not resetting the next entry pointer Dom Cobley <popcornmix(a)gmail.com> drm/vc4: hdmi: Avoid hang with debug registers when suspended Dave Stevenson <dave.stevenson(a)raspberrypi.com> drm/vc4: hvs: Don't write gamma luts on 2711 Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused Matt Coster <Matt.Coster(a)imgtec.com> drm/imagination: Use pvr_vm_context_get() Chen Yufan <chenyufan(a)vivo.com> drm/imagination: Convert to use time_before macro Yao Zi <ziyao(a)disroot.org> platform/x86: panasonic-laptop: Return errno correctly in show callback Michael J. Ruhl <michael.j.ruhl(a)intel.com> platform/x86/intel/pmt: allow user offset for PMT callbacks Armin Wolf <W_Armin(a)gmx.de> platform/x86: asus-wmi: Fix inconsistent use of thermal policies Vitaly Kuznetsov <vkuznets(a)redhat.com> HID: hyperv: streamline driver probe to avoid devres issues Tejun Heo <tj(a)kernel.org> sched_ext: scx_bpf_dispatch_from_dsq_set_*() are allowed from unlocked context Chris Morgan <macromorgan(a)hotmail.com> arm64: dts: rockchip: correct analog audio name on Indiedroid Nova Li Huafei <lihuafei1(a)huawei.com> media: atomisp: Add check for rgby_data memory allocation failure Uwe Kleine-König <u.kleine-koenig(a)baylibre.com> pwm: Assume a disabled PWM to emit a constant inactive output Sergey Senozhatsky <senozhatsky(a)chromium.org> media: venus: sync with threaded IRQ during inst destruction Sergey Senozhatsky <senozhatsky(a)chromium.org> media: venus: fix enc/dec destruction order Bingbu Cao <bingbu.cao(a)intel.com> media: ipu6: remove architecture DMA ops dependency in Kconfig Bingbu Cao <bingbu.cao(a)intel.com> media: ipu6: not override the dma_ops of device in driver Sakari Ailus <sakari.ailus(a)linux.intel.com> media: ipu6: Fix DMA and physical address debugging messages for 32-bit Luo Qiu <luoqiu(a)kylinsec.com.cn> firmware: arm_scpi: Check the DVFS OPP count returned by the firmware Reinette Chatre <reinette.chatre(a)intel.com> selftests/resctrl: Protect against array overrun during iMC config parsing Reinette Chatre <reinette.chatre(a)intel.com> selftests/resctrl: Fix memory overflow due to unhandled wraparound Reinette Chatre <reinette.chatre(a)intel.com> selftests/resctrl: Print accurate buffer size as part of MBM results Chen-Yu Tsai <wenst(a)chromium.org> arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add supplies for fixed regulators Chen-Yu Tsai <wenst(a)chromium.org> arm64: dts: mediatek: mt8183-kukui-jacuzzi: Fix DP bridge supply names Macpaul Lin <macpaul.lin(a)mediatek.com> arm64: dts: mediatek: mt6358: fix dtbs_check error Frank Li <Frank.Li(a)nxp.com> arm64: dts: imx8mn-tqma8mqnl-mba8mx-usbot: fix coexistence of output-low and output-high in GPIO Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> arm64: dts: renesas: hihope: Drop #sound-dai-cells Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> regmap: irq: Set lockdep class for hierarchical IRQ domains Jinjie Ruan <ruanjinjie(a)huawei.com> spi: zynqmp-gqspi: Undo runtime PM changes at driver exit time Breno Leitao <leitao(a)debian.org> spi: tegra210-quad: Avoid shift-out-of-bounds Zhang Zekun <zhangzekun11(a)huawei.com> pmdomain: ti-sci: Add missing of_node_put() for args.np Usama Arif <usamaarif642(a)gmail.com> of/fdt: add dt_phys arg to early_init_dt_scan and early_init_dt_verify Abel Vesa <abel.vesa(a)linaro.org> dt-bindings: cache: qcom,llcc: Fix X1E80100 reg entries Konrad Dybcio <konradybcio(a)kernel.org> arm64: dts: qcom: x1e80100: Update C4/C5 residency/exit numbers Niklas Schnelle <schnelle(a)linux.ibm.com> watchdog: Add HAS_IOPORT dependency for SBC8360 and SBC7240 Anurag Dutta <a-dutta(a)ti.com> arm64: dts: ti: k3-j721s2: Fix clock IDs for MCSPI instances Anurag Dutta <a-dutta(a)ti.com> arm64: dts: ti: k3-j721e: Fix clock IDs for MCSPI instances Anurag Dutta <a-dutta(a)ti.com> arm64: dts: ti: k3-j7200: Fix clock ids for MCSPI instances Jared McArthur <j-mcarthur(a)ti.com> arm64: dts: ti: k3-j7200: Fix register map for main domain pmx Andre Przywara <andre.przywara(a)arm.com> ARM: dts: cubieboard4: Fix DCDC5 regulator constraints Clark Wang <xiaoning.wang(a)nxp.com> pwm: imx27: Workaround of the pwm output bug when decrease the duty cycle Daolong Zhu <jg_daolongzhu(a)mediatek.corp-partner.google.com> arm64: dts: mt8183: Damu: add i2c2's i2c-scl-internal-delay-ns Daolong Zhu <jg_daolongzhu(a)mediatek.corp-partner.google.com> arm64: dts: mt8183: cozmo: add i2c2's i2c-scl-internal-delay-ns Daolong Zhu <jg_daolongzhu(a)mediatek.corp-partner.google.com> arm64: dts: mt8183: burnet: add i2c2's i2c-scl-internal-delay-ns Daolong Zhu <jg_daolongzhu(a)mediatek.corp-partner.google.com> arm64: dts: mt8183: fennel: add i2c2's i2c-scl-internal-delay-ns Heiko Stuebner <heiko(a)sntech.de> arm64: dts: rockchip: Remove 'enable-active-low' from two boards Tomasz Maciej Nowak <tmn505(a)gmail.com> arm64: tegra: p2180: Add mandatory compatible for WiFi node Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> power: sequencing: make the QCom PMU pwrseq driver depend on CONFIG_OF Dragan Simic <dsimic(a)manjaro.org> regulator: rk808: Restrict DVS GPIOs to the RK808 variant only Chen Ridong <chenridong(a)huawei.com> cgroup/bpf: only cgroup v2 can be attached by bpf programs Chen Ridong <chenridong(a)huawei.com> Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline" Fei Shao <fshao(a)chromium.org> arm64: dts: mediatek: mt8195-cherry: Use correct audio codec DAI Fei Shao <fshao(a)chromium.org> arm64: dts: mediatek: mt8188: Fix USB3 PHY port default status Chen-Yu Tsai <wenst(a)chromium.org> arm64: dts: mediatek: mt8173-elm-hana: Add vdd-supply to second source trackpad Srikar Dronamraju <srikar(a)linux.ibm.com> gpio: sloppy-logic-analyzer remove reference to rcu_momentary_dyntick_idle() Nathan Morrisson <nmorrisson(a)phytec.com> arm64: dts: ti: k3-am62x-phyboard-lyra: Drop unnecessary McASP AFIFOs Randy Dunlap <rdunlap(a)infradead.org> kernel-doc: allow object-like macros in ReST output Sibi Sankar <quic_sibis(a)quicinc.com> arm64: dts: qcom: x1e80100: Resize GIC Redistributor register region Hsin-Te Yuan <yuanhsinte(a)chromium.org> arm64: dts: mt8183: kukui: Fix the address of eeprom at i2c4 Hsin-Te Yuan <yuanhsinte(a)chromium.org> arm64: dts: mt8183: krane: Fix the address of eeprom at i2c4 Colin Ian King <colin.i.king(a)gmail.com> media: i2c: ds90ub960: Fix missing return check on ub960_rxport_read call Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> media: i2c: vgxy61: Fix an error handling path in vgxy61_detect() Dan Carpenter <dan.carpenter(a)linaro.org> media: i2c: max96717: clean up on error in max96717_subdev_init() Gregory Price <gourry(a)gourry.net> tpm: fix signed/unsigned bug when checking event logs Jonathan Marek <jonathan(a)marek.ca> efi/libstub: fix efi_parse_options() ignoring the default command line Stafford Horne <shorne(a)gmail.com> openrisc: Implement fixmap to fix earlycon Abel Vesa <abel.vesa(a)linaro.org> arm64: dts: qcom: x1e80100-vivobook-s15: Drop orientation-switch from USB SS[0-1] QMP PHYs Abel Vesa <abel.vesa(a)linaro.org> arm64: dts: qcom: x1e80100-slim7x: Drop orientation-switch from USB SS[0-1] QMP PHYs Chen-Yu Tsai <wenst(a)chromium.org> scripts/kernel-doc: Do not track section counter across processed files Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> mmc: mmc_spi: drop buggy snprintf() Andrei Simion <andrei.simion(a)microchip.com> ARM: dts: microchip: sam9x60: Add missing property atmel,usart-mode Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> arm64: dts: qcom: sda660-ifc6560: fix l10a voltage ranges Luca Weiss <luca.weiss(a)fairphone.com> arm64: dts: qcom: sm6350: Fix GPU frequencies missing on some speedbins Dan Carpenter <dan.carpenter(a)linaro.org> soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() Jinjie Ruan <ruanjinjie(a)huawei.com> soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq() Pin-yen Lin <treapking(a)chromium.org> arm64: dts: mt8183: Add port node to dpi node Alper Nebi Yasak <alpernebiyasak(a)gmail.com> arm64: dts: mediatek: mt8183-kukui: Disable DPI display interface Macpaul Lin <macpaul.lin(a)mediatek.com> arm64: dts: mt8195: Fix dtbs_check error for infracfg_ao node Macpaul Lin <macpaul.lin(a)mediatek.com> arm64: dts: mt8195: Fix dtbs_check error for mutex node Macpaul Lin <macpaul.lin(a)mediatek.com> arm64: dts: mediatek: mt8395-genio-1200-evk: Fix dtbs_check error for phy Pablo Sun <pablo.sun(a)mediatek.com> arm64: dts: mediatek: mt8188: Fix wrong clock provider in MFG1 power domain Michal Simek <michal.simek(a)amd.com> microblaze: Export xmb_manager functions Gaosheng Cui <cuigaosheng1(a)huawei.com> drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend() Wolfram Sang <wsa+renesas(a)sang-engineering.com> ARM: dts: renesas: genmai: Fix partition size for QSPI NOR Flash Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> arm64: dts: qcom: qcs6390-rb3gen2: use modem.mbn for modem DSP Jinjie Ruan <ruanjinjie(a)huawei.com> spi: spi-fsl-lpspi: Use IRQF_NO_AUTOEN flag in request_irq() Min-Hua Chen <minhuadotchen(a)gmail.com> regulator: qcom-smd: make smd_vreg_rpm static Samuel Holland <samuel.holland(a)sifive.com> irqchip/riscv-aplic: Prevent crash when MSI domain is missing Javier Carrasco <javier.carrasco.cruz(a)gmail.com> clocksource/drivers/timer-ti-dm: Fix child node refcount handling Mark Brown <broonie(a)kernel.org> clocksource/drivers:sp804: Make user selectable Eder Zulian <ezulian(a)redhat.com> rust: helpers: Avoid raw_spin_lock initialization for PREEMPT_RT Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> locking/rt: Add sparse annotation PREEMPT_RT's sleeping locks. Thomas Gleixner <tglx(a)linutronix.de> sched/ext: Remove sched_fork() hack Marco Elver <elver(a)google.com> kcsan, seqlock: Fix incorrect assumption in read_seqbegin() Marco Elver <elver(a)google.com> kcsan, seqlock: Support seqcount_latch_t Uros Bizjak <ubizjak(a)gmail.com> locking/atomic/x86: Use ALT_OUTPUT_SP() for __arch_{,try_}cmpxchg64_emu() Uros Bizjak <ubizjak(a)gmail.com> locking/atomic/x86: Use ALT_OUTPUT_SP() for __alternative_atomic64() Thomas Gleixner <tglx(a)linutronix.de> timers: Add missing READ_ONCE() in __run_timer_base() Miguel Ojeda <ojeda(a)kernel.org> time: Fix references to _msecs_to_jiffies() handling of values Miguel Ojeda <ojeda(a)kernel.org> time: Partially revert cleanup on msecs_to_jiffies() documentation Uros Bizjak <ubizjak(a)gmail.com> cleanup: Remove address space of returned pointer Carlos Llamas <cmllamas(a)google.com> Revert "scripts/faddr2line: Check only two symbols when calculating symbol size" Zheng Yejian <zhengyejian(a)huaweicloud.com> x86/unwind/orc: Fix unwind for newly forked tasks Daniel Lezcano <daniel.lezcano(a)linaro.org> thermal/lib: Fix memory leak on error in thermal_genl_auto() Daniel Lezcano <daniel.lezcano(a)linaro.org> tools/lib/thermal: Make more generic the command encoding function Uladzislau Rezki (Sony) <urezki(a)gmail.com> rcuscale: Do a proper cleanup if kfree_scale_init() fails Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> crypto: cavium - Fix an error handling path in cpt_ucode_load_fw() Michal Suchanek <msuchanek(a)suse.de> crypto: aes-gcm-p10 - Use the correct bit to test for P10 Chen Ridong <chenridong(a)huawei.com> crypto: bcm - add error check in the ahash_hmac_init function Chen Ridong <chenridong(a)huawei.com> crypto: caam - add error check to caam_rsa_set_priv_key_form Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: testing: Initialize some variables annoteded with _free() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: testing: Use DEFINE_FREE() and __free() to simplify code Lifeng Zheng <zhenglifeng1(a)huawei.com> ACPI: CPPC: Fix _CPC register setting issue Pei Xiao <xiaopei01(a)kylinos.cn> hwmon: (nct6775-core) Fix overflows seen when writing limit attributes Jerome Brunet <jbrunet(a)baylibre.com> hwmon: (pmbus/core) clear faults after setting smbalert mask Zqiang <qiang.zhang1211(a)gmail.com> rcu/nocb: Fix missed RCU barrier on deoffloading Uladzislau Rezki (Sony) <urezki(a)gmail.com> rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu Michal Schmidt <mschmidt(a)redhat.com> rcu/srcutiny: don't return before reenabling preemption Baruch Siach <baruch(a)tkos.co.il> doc: rcu: update printed dynticks counter bits Christian Loehle <christian.loehle(a)arm.com> sched/cpufreq: Ensure sd is rebuilt for EAS check Li Huafei <lihuafei1(a)huawei.com> crypto: inside-secure - Fix the return value of safexcel_xcbcmac_cra_init() Wang Hai <wanghai38(a)huawei.com> crypto: qat - Fix missing destroy_workqueue in adf_init_aer() Orange Kao <orange(a)aiven.io> EDAC/igen6: Avoid segmentation fault on module unload Weili Qian <qianweili(a)huawei.com> crypto: hisilicon/qm - disable same error report before resetting Gautham R. Shenoy <gautham.shenoy(a)amd.com> amd-pstate: Set min_perf to nominal_perf for active mode performance gov Mario Limonciello <mario.limonciello(a)amd.com> cpufreq/amd-pstate: Don't update CPPC request in amd_pstate_cpu_boost_update() Everest K.C <everestkc(a)everestkc.com.np> crypto: cavium - Fix the if condition to exit loop after timeout Yi Yang <yiyang13(a)huawei.com> crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY Qiuxu Zhuo <qiuxu.zhuo(a)intel.com> EDAC/{skx_common,i10nm}: Fix incorrect far-memory error source indicator Qiuxu Zhuo <qiuxu.zhuo(a)intel.com> EDAC/skx_common: Differentiate memory error sources Priyanka Singh <priyanka.singh(a)nxp.com> EDAC/fsl_ddr: Fix bad bit shift operations Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix race between zone registration and system suspend Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Mark thermal zones as initializing to start with Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Represent suspend-related thermal zone flags as bits Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Rearrange PM notification code Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Initialize thermal zones before registering them Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - remove faulty arbiter config reset David Thompson <davthompson(a)nvidia.com> EDAC/bluefield: Fix potential integer overflow Yuan Can <yuancan(a)huawei.com> firmware: google: Unregister driver_info on failure Dan Carpenter <dan.carpenter(a)linaro.org> crypto: qat/qat_4xxx - fix off by one in uof_get_name() Dan Carpenter <dan.carpenter(a)linaro.org> crypto: qat/qat_420xx - fix off by one in uof_get_name() Danny Tsen <dtsen(a)linux.ibm.com> crypto: powerpc/p10-aes-gcm - Add dependency on CRYPTO_SIMDand re-enable CRYPTO_AES_GCM_P10 Danny Tsen <dtsen(a)linux.ibm.com> crypto: powerpc/p10-aes-gcm - Register modules as SIMD Cabiddu, Giovanni <giovanni.cabiddu(a)intel.com> crypto: qat - remove check after debugfs_create_dir() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> crypto: caam - Fix the pointer passed to caam_qi_shutdown() Tomas Paukrt <tomaspaukrt(a)email.cz> crypto: mxs-dcp - Fix AES-CBC with hardware-bound keys Christoph Hellwig <hch(a)lst.de> virtio_blk: reverse request order in virtio_queue_rqs Christoph Hellwig <hch(a)lst.de> nvme-pci: reverse request order in nvme_queue_rqs Long Li <leo.lilong(a)huawei.com> ext4: fix race in buffer_head read fault injection Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> hfsplus: don't query the device logical block size multiple times Masahiro Yamada <masahiroy(a)kernel.org> s390/syscalls: Avoid creation of arch/arch/ directory Christoph Hellwig <hch(a)lst.de> block: fix bio_split_rw_at to take zone_write_granularity into account Christoph Hellwig <hch(a)lst.de> block: take chunk_sectors into account in bio_split_write_zeroes Zizhi Wo <wozizhi(a)huawei.com> netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING Zizhi Wo <wozizhi(a)huawei.com> cachefiles: Fix NULL pointer dereference in object->file Zizhi Wo <wozizhi(a)huawei.com> cachefiles: Fix missing pos updates in cachefiles_ondemand_fd_write_iter() Zizhi Wo <wozizhi(a)huawei.com> cachefiles: Fix incorrect length return value in cachefiles_ondemand_fd_write_iter() Li Wang <liwang(a)redhat.com> loop: fix type of block size Aleksandr Mishin <amishin(a)t-argos.ru> acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block() Masahiro Yamada <masahiroy(a)kernel.org> arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG Daniel Palmer <daniel(a)0x0f.com> m68k: mvme147: Reinstate early console Daniel Palmer <daniel(a)0x0f.com> m68k: mvme147: Fix SCSI controller IRQ numbers Christoph Hellwig <hch(a)lst.de> nvme-pci: fix freeing of the HMB descriptor table Mark Brown <broonie(a)kernel.org> kselftest/arm64: Fix encoding for SVE B16B16 test Marc Zyngier <maz(a)kernel.org> arm64: Expose ID_AA64ISAR1_EL1.XS to sanitised feature consumers David Disseldorp <ddiss(a)suse.de> initramfs: avoid filename buffer overrun Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_sf: Fix and protect memory allocation of SDBs with mutex Jonas Gorski <jonas.gorski(a)gmail.com> mips: asm: fix warning when disabling MIPS_FP_SUPPORT Jan Kara <jack(a)suse.cz> ext4: avoid remount errors with 'abort' mount option Yang Erkun <yangerkun(a)huawei.com> brd: defer automatic disk creation until module initialization succeeds Ard Biesheuvel <ardb(a)kernel.org> x86/pvh: Call C code via the kernel virtual mapping Heiko Carstens <hca(a)linux.ibm.com> s390/pageattr: Implement missing kernel_page_present() Vineeth Vijayan <vneethv(a)linux.ibm.com> s390/cio: Do not unregister the subchannel based on DNV John Garry <john.g.garry(a)oracle.com> fs/block: Check for IOCB_DIRECT in generic_atomic_write_valid() John Garry <john.g.garry(a)oracle.com> block/fs: Pass an iocb to generic_atomic_write_valid() Andre Przywara <andre.przywara(a)arm.com> kselftest/arm64: mte: fix printf type warnings about longs Andre Przywara <andre.przywara(a)arm.com> kselftest/arm64: mte: fix printf type warnings about __u64 Andre Przywara <andre.przywara(a)arm.com> kselftest/arm64: hwcap: fix f8dp2 cpuinfo name Kristina Martsenko <kristina.martsenko(a)arm.com> arm64: probes: Disable kprobes/uprobes on MOPS instructions Bill O'Donnell <bodonnel(a)redhat.com> efs: fix the efs new mount api implementation Halil Pasic <pasic(a)linux.ibm.com> s390/virtio_ccw: Fix dma_parm pointer not set up Gerd Bayer <gbayer(a)linux.ibm.com> s390/facilities: Fix warning about shadow of global variable Fangzhi Zuo <Jerry.Zuo(a)amd.com> drm/amd/display: Fix incorrect DSC recompute trigger Fangzhi Zuo <Jerry.Zuo(a)amd.com> drm/amd/display: Skip Invalid Streams from DSC Policy Darrick J. Wong <djwong(a)kernel.org> MAINTAINERS: appoint myself the XFS maintainer for 6.12 LTS ------------- Diffstat: Documentation/ABI/testing/sysfs-fs-f2fs | 7 +- Documentation/RCU/stallwarn.rst | 2 +- Documentation/admin-guide/blockdev/zram.rst | 2 + Documentation/admin-guide/media/building.rst | 2 +- Documentation/admin-guide/media/saa7134.rst | 2 +- Documentation/arch/x86/boot.rst | 17 +- .../devicetree/bindings/cache/qcom,llcc.yaml | 38 +- .../devicetree/bindings/clock/adi,axi-clkgen.yaml | 22 +- .../devicetree/bindings/iio/dac/adi,ad3552r.yaml | 2 +- .../bindings/pci/mediatek-pcie-gen3.yaml | 5 +- .../pinctrl/samsung,pinctrl-wakeup-interrupt.yaml | 19 +- .../devicetree/bindings/serial/rs485.yaml | 19 +- .../devicetree/bindings/sound/mt6359.yaml | 10 +- .../devicetree/bindings/vendor-prefixes.yaml | 2 + Documentation/filesystems/mount_api.rst | 3 +- Documentation/locking/seqlock.rst | 2 +- MAINTAINERS | 335 ++++---- Makefile | 4 +- arch/arc/kernel/devtree.c | 2 +- .../boot/dts/allwinner/sun9i-a80-cubieboard4.dts | 4 +- arch/arm/boot/dts/microchip/sam9x60.dtsi | 12 + arch/arm/boot/dts/renesas/r7s72100-genmai.dts | 2 +- arch/arm/boot/dts/ti/omap/omap36xx.dtsi | 1 + arch/arm/kernel/devtree.c | 2 +- .../freescale/imx8mn-tqma8mqnl-mba8mx-usbotg.dtso | 29 +- arch/arm64/boot/dts/mediatek/mt6358.dtsi | 4 +- arch/arm64/boot/dts/mediatek/mt8173-elm-hana.dtsi | 8 + .../dts/mediatek/mt8183-kukui-jacuzzi-burnet.dts | 3 + .../dts/mediatek/mt8183-kukui-jacuzzi-cozmo.dts | 2 + .../dts/mediatek/mt8183-kukui-jacuzzi-damu.dts | 3 + .../dts/mediatek/mt8183-kukui-jacuzzi-fennel.dtsi | 3 + .../boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi | 30 +- .../boot/dts/mediatek/mt8183-kukui-kakadu.dtsi | 4 +- .../boot/dts/mediatek/mt8183-kukui-kodama.dtsi | 4 +- .../boot/dts/mediatek/mt8183-kukui-krane.dtsi | 4 +- arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 5 + arch/arm64/boot/dts/mediatek/mt8183.dtsi | 4 + .../boot/dts/mediatek/mt8186-corsola-voltorb.dtsi | 21 +- arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi | 8 +- arch/arm64/boot/dts/mediatek/mt8188.dtsi | 5 +- arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi | 6 +- arch/arm64/boot/dts/mediatek/mt8195.dtsi | 4 +- .../boot/dts/mediatek/mt8395-genio-1200-evk.dts | 2 +- arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi | 2 +- arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts | 2 +- arch/arm64/boot/dts/qcom/sc8180x.dtsi | 2 +- .../arm64/boot/dts/qcom/sda660-inforce-ifc6560.dts | 2 +- arch/arm64/boot/dts/qcom/sm6350.dtsi | 14 +- .../boot/dts/qcom/x1e80100-asus-vivobook-s15.dts | 4 - .../boot/dts/qcom/x1e80100-lenovo-yoga-slim7x.dts | 4 - arch/arm64/boot/dts/qcom/x1e80100.dtsi | 8 +- arch/arm64/boot/dts/renesas/hihope-rev2.dtsi | 3 - arch/arm64/boot/dts/renesas/hihope-rev4.dtsi | 3 - .../rk3568-wolfvision-pf5-io-expander.dtso | 1 - .../boot/dts/rockchip/rk3588s-indiedroid-nova.dts | 2 +- .../arm64/boot/dts/rockchip/rk3588s-orangepi-5.dts | 1 - arch/arm64/boot/dts/ti/k3-am62x-phyboard-lyra.dtsi | 2 - .../boot/dts/ti/k3-j7200-common-proc-board.dts | 2 +- arch/arm64/boot/dts/ti/k3-j7200-main.dtsi | 38 +- arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi | 6 +- arch/arm64/boot/dts/ti/k3-j721e-mcu-wakeup.dtsi | 6 +- arch/arm64/boot/dts/ti/k3-j721s2-main.dtsi | 16 +- arch/arm64/boot/dts/ti/k3-j721s2-mcu-wakeup.dtsi | 6 +- arch/arm64/include/asm/insn.h | 1 + arch/arm64/include/asm/kvm_host.h | 2 - arch/arm64/kernel/cpufeature.c | 1 + arch/arm64/kernel/probes/decode-insn.c | 7 +- arch/arm64/kernel/process.c | 2 +- arch/arm64/kernel/setup.c | 6 +- arch/arm64/kernel/vmlinux.lds.S | 6 +- arch/arm64/kvm/arch_timer.c | 3 +- arch/arm64/kvm/arm.c | 18 +- arch/arm64/kvm/mmio.c | 32 +- arch/arm64/kvm/pmu-emul.c | 1 - arch/arm64/kvm/vgic/vgic-its.c | 32 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 7 +- arch/arm64/kvm/vgic/vgic.h | 23 + arch/arm64/net/bpf_jit_comp.c | 47 +- arch/csky/kernel/setup.c | 4 +- arch/loongarch/Makefile | 4 +- arch/loongarch/kernel/setup.c | 2 +- arch/loongarch/net/bpf_jit.c | 2 +- arch/loongarch/vdso/Makefile | 2 +- arch/m68k/coldfire/device.c | 8 +- arch/m68k/include/asm/mcfgpio.h | 2 +- arch/m68k/include/asm/mvme147hw.h | 4 +- arch/m68k/kernel/early_printk.c | 5 +- arch/m68k/mvme147/config.c | 30 + arch/m68k/mvme147/mvme147.h | 6 + arch/microblaze/kernel/microblaze_ksyms.c | 10 + arch/microblaze/kernel/prom.c | 2 +- arch/mips/include/asm/switch_to.h | 2 +- arch/mips/kernel/prom.c | 2 +- arch/mips/kernel/relocate.c | 2 +- arch/nios2/kernel/prom.c | 4 +- arch/openrisc/Kconfig | 3 + arch/openrisc/include/asm/fixmap.h | 21 +- arch/openrisc/kernel/prom.c | 2 +- arch/openrisc/mm/init.c | 37 + arch/parisc/kernel/ftrace.c | 2 +- arch/powerpc/crypto/Kconfig | 2 +- arch/powerpc/crypto/aes-gcm-p10-glue.c | 141 +++- arch/powerpc/include/asm/dtl.h | 4 +- arch/powerpc/include/asm/fadump.h | 9 + arch/powerpc/include/asm/kvm_book3s_64.h | 4 +- arch/powerpc/include/asm/sstep.h | 5 - arch/powerpc/include/asm/vdso.h | 1 + arch/powerpc/kernel/dt_cpu_ftrs.c | 2 +- arch/powerpc/kernel/fadump.c | 40 +- arch/powerpc/kernel/prom.c | 5 +- arch/powerpc/kernel/setup-common.c | 6 +- arch/powerpc/kernel/setup_64.c | 1 + arch/powerpc/kexec/file_load_64.c | 9 +- arch/powerpc/kvm/book3s_hv.c | 14 +- arch/powerpc/kvm/book3s_hv_nested.c | 14 +- arch/powerpc/kvm/trace_hv.h | 2 +- arch/powerpc/lib/sstep.c | 12 +- arch/powerpc/mm/fault.c | 10 +- arch/powerpc/platforms/pseries/dtl.c | 8 +- arch/powerpc/platforms/pseries/lpar.c | 8 +- arch/powerpc/platforms/pseries/plpks.c | 2 +- arch/riscv/include/asm/cpufeature.h | 2 + arch/riscv/kernel/setup.c | 2 +- arch/riscv/kernel/traps_misaligned.c | 14 +- arch/riscv/kernel/unaligned_access_speed.c | 1 + arch/riscv/kvm/aia_aplic.c | 3 +- arch/riscv/kvm/vcpu_sbi.c | 11 +- arch/s390/include/asm/facility.h | 18 +- arch/s390/include/asm/pci.h | 4 +- arch/s390/include/asm/set_memory.h | 1 + arch/s390/kernel/perf_cpum_sf.c | 2 +- arch/s390/kernel/syscalls/Makefile | 2 +- arch/s390/mm/pageattr.c | 15 + arch/s390/pci/pci.c | 37 +- arch/s390/pci/pci_debug.c | 10 +- arch/sh/kernel/cpu/proc.c | 2 +- arch/sh/kernel/setup.c | 2 +- arch/um/drivers/net_kern.c | 2 +- arch/um/drivers/ubd_kern.c | 4 +- arch/um/drivers/vector_kern.c | 3 +- arch/um/kernel/dtb.c | 2 +- arch/um/kernel/physmem.c | 6 +- arch/um/kernel/process.c | 2 +- arch/um/kernel/sysrq.c | 2 +- arch/x86/coco/tdx/tdx.c | 111 ++- arch/x86/crypto/aegis128-aesni-asm.S | 29 +- arch/x86/events/intel/pt.c | 11 +- arch/x86/events/intel/pt.h | 2 + arch/x86/include/asm/atomic64_32.h | 3 +- arch/x86/include/asm/cmpxchg_32.h | 6 +- arch/x86/include/asm/kvm_host.h | 4 +- arch/x86/include/asm/shared/tdx.h | 11 +- arch/x86/include/asm/tlb.h | 4 + arch/x86/kernel/cpu/amd.c | 1 + arch/x86/kernel/cpu/common.c | 4 +- arch/x86/kernel/cpu/microcode/amd.c | 25 +- arch/x86/kernel/devicetree.c | 2 +- arch/x86/kernel/unwind_orc.c | 2 +- arch/x86/kvm/Kconfig | 5 +- arch/x86/kvm/mmu/mmu.c | 68 +- arch/x86/kvm/mmu/spte.c | 18 +- arch/x86/kvm/vmx/vmx.c | 54 +- arch/x86/mm/tlb.c | 3 +- arch/x86/platform/pvh/head.S | 9 +- arch/xtensa/kernel/setup.c | 2 +- block/bfq-cgroup.c | 1 + block/bfq-iosched.c | 43 +- block/blk-core.c | 18 +- block/blk-merge.c | 45 +- block/blk-mq.c | 148 +++- block/blk-mq.h | 13 + block/blk-settings.c | 7 + block/blk-sysfs.c | 6 +- block/blk-zoned.c | 14 +- block/blk.h | 30 +- block/elevator.c | 10 +- block/fops.c | 25 +- block/genhd.c | 24 +- crypto/pcrypt.c | 12 +- drivers/accel/ivpu/ivpu_ipc.c | 35 +- drivers/accel/ivpu/ivpu_ipc.h | 7 +- drivers/accel/ivpu/ivpu_jsm_msg.c | 19 +- drivers/acpi/arm64/gtdt.c | 2 +- drivers/acpi/cppc_acpi.c | 1 - drivers/base/firmware_loader/main.c | 5 +- drivers/base/regmap/regmap-irq.c | 4 + drivers/base/trace.h | 6 +- drivers/block/brd.c | 70 +- drivers/block/loop.c | 6 +- drivers/block/ublk_drv.c | 17 +- drivers/block/virtio_blk.c | 46 +- drivers/block/zram/Kconfig | 1 + drivers/block/zram/zram_drv.c | 21 +- drivers/block/zram/zram_drv.h | 1 + drivers/bluetooth/btbcm.c | 4 +- drivers/bluetooth/btintel.c | 62 +- drivers/bluetooth/btintel.h | 7 + drivers/bluetooth/btintel_pcie.c | 265 +++++- drivers/bluetooth/btintel_pcie.h | 16 +- drivers/bluetooth/btmtk.c | 1 - drivers/bluetooth/btusb.c | 1 + drivers/bus/mhi/host/trace.h | 25 +- drivers/clk/.kunitconfig | 1 + drivers/clk/Kconfig | 2 - drivers/clk/clk-apple-nco.c | 3 + drivers/clk/clk-axi-clkgen.c | 22 +- drivers/clk/clk-en7523.c | 270 +++++-- drivers/clk/clk-loongson2.c | 6 +- drivers/clk/imx/clk-fracn-gppll.c | 10 +- drivers/clk/imx/clk-imx8-acm.c | 4 +- drivers/clk/imx/clk-lpcg-scu.c | 37 +- drivers/clk/imx/clk-scu.c | 2 +- drivers/clk/mediatek/Kconfig | 15 - drivers/clk/qcom/Kconfig | 4 +- drivers/clk/ralink/clk-mtmips.c | 26 +- drivers/clk/renesas/rzg2l-cpg.c | 11 +- drivers/clk/sophgo/clk-sg2042-pll.c | 2 +- drivers/clk/sunxi-ng/ccu-sun20i-d1.c | 2 +- drivers/clocksource/Kconfig | 3 +- drivers/clocksource/timer-ti-dm-systimer.c | 4 +- drivers/comedi/comedi_fops.c | 12 + drivers/counter/stm32-timer-cnt.c | 17 +- drivers/counter/ti-ecap-capture.c | 7 +- drivers/cpufreq/amd-pstate.c | 26 +- drivers/cpufreq/cppc_cpufreq.c | 63 +- drivers/cpufreq/loongson2_cpufreq.c | 4 +- drivers/cpufreq/loongson3_cpufreq.c | 7 +- drivers/cpufreq/mediatek-cpufreq-hw.c | 2 +- drivers/crypto/bcm/cipher.c | 5 +- drivers/crypto/caam/caampkc.c | 11 +- drivers/crypto/caam/qi.c | 2 +- drivers/crypto/cavium/cpt/cptpf_main.c | 6 +- drivers/crypto/hisilicon/hpre/hpre_main.c | 35 +- drivers/crypto/hisilicon/qm.c | 47 +- drivers/crypto/hisilicon/sec2/sec_main.c | 35 +- drivers/crypto/hisilicon/zip/zip_main.c | 35 +- drivers/crypto/inside-secure/safexcel_hash.c | 2 +- .../crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c | 2 +- .../crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c | 2 +- drivers/crypto/intel/qat/qat_common/adf_aer.c | 5 +- drivers/crypto/intel/qat/qat_common/adf_dbgfs.c | 13 +- .../crypto/intel/qat/qat_common/adf_hw_arbiter.c | 4 - drivers/crypto/mxs-dcp.c | 20 +- drivers/dax/pmem/Makefile | 7 - drivers/dax/pmem/pmem.c | 10 - drivers/dma-buf/Kconfig | 1 + drivers/dma-buf/udmabuf.c | 44 +- drivers/edac/bluefield_edac.c | 2 +- drivers/edac/fsl_ddr_edac.c | 22 +- drivers/edac/i10nm_base.c | 1 + drivers/edac/igen6_edac.c | 2 + drivers/edac/skx_common.c | 57 +- drivers/edac/skx_common.h | 8 + drivers/firmware/arm_scpi.c | 3 + drivers/firmware/efi/libstub/efi-stub.c | 2 +- drivers/firmware/efi/tpm.c | 17 +- drivers/firmware/google/gsmi.c | 6 +- drivers/gpio/gpio-exar.c | 10 +- drivers/gpio/gpio-zevio.c | 6 + drivers/gpu/drm/Kconfig | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 63 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 7 + drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 + drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 18 +- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 14 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 32 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 3 + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 4 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 11 +- .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 15 +- .../gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 3 + .../drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 6 +- drivers/gpu/drm/bridge/analogix/anx7625.c | 2 + drivers/gpu/drm/bridge/ite-it6505.c | 2 + drivers/gpu/drm/bridge/tc358767.c | 7 + drivers/gpu/drm/drm_file.c | 2 +- drivers/gpu/drm/drm_mm.c | 2 +- drivers/gpu/drm/etnaviv/etnaviv_drv.c | 10 + drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 28 +- drivers/gpu/drm/fsl-dcu/Kconfig | 1 + drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 15 + drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h | 3 + drivers/gpu/drm/imagination/pvr_ccb.c | 2 +- drivers/gpu/drm/imagination/pvr_vm.c | 4 +- drivers/gpu/drm/imx/dcss/dcss-crtc.c | 6 +- drivers/gpu/drm/imx/ipuv3/Kconfig | 11 +- drivers/gpu/drm/imx/ipuv3/imx-ldb.c | 122 +-- drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c | 6 +- drivers/gpu/drm/imx/ipuv3/parallel-display.c | 51 +- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 4 +- .../drm/msm/disp/dpu1/catalog/dpu_3_0_msm8998.h | 12 - .../gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h | 14 +- drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c | 2 +- drivers/gpu/drm/msm/msm_gpu_devfreq.c | 9 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 1 + drivers/gpu/drm/omapdrm/dss/base.c | 25 +- drivers/gpu/drm/omapdrm/dss/omapdss.h | 3 +- drivers/gpu/drm/omapdrm/omap_drv.c | 4 +- drivers/gpu/drm/omapdrm/omap_gem.c | 10 +- drivers/gpu/drm/panel/panel-newvision-nv3052c.c | 2 +- drivers/gpu/drm/panel/panel-novatek-nt35510.c | 15 +- drivers/gpu/drm/panfrost/panfrost_devfreq.c | 3 +- drivers/gpu/drm/panfrost/panfrost_gpu.c | 1 - drivers/gpu/drm/panthor/panthor_devfreq.c | 29 +- drivers/gpu/drm/panthor/panthor_device.h | 28 + drivers/gpu/drm/panthor/panthor_sched.c | 351 ++++++-- drivers/gpu/drm/radeon/radeon_audio.c | 12 +- drivers/gpu/drm/v3d/v3d_drv.h | 1 + drivers/gpu/drm/v3d/v3d_irq.c | 2 + drivers/gpu/drm/v3d/v3d_mmu.c | 31 +- drivers/gpu/drm/v3d/v3d_sched.c | 44 +- drivers/gpu/drm/vc4/tests/vc4_mock.c | 12 +- drivers/gpu/drm/vc4/vc4_bo.c | 28 +- drivers/gpu/drm/vc4/vc4_crtc.c | 13 +- drivers/gpu/drm/vc4/vc4_drv.c | 22 +- drivers/gpu/drm/vc4/vc4_drv.h | 8 +- drivers/gpu/drm/vc4/vc4_gem.c | 24 +- drivers/gpu/drm/vc4/vc4_hdmi.c | 22 +- drivers/gpu/drm/vc4/vc4_hvs.c | 64 +- drivers/gpu/drm/vc4/vc4_irq.c | 10 +- drivers/gpu/drm/vc4/vc4_kms.c | 14 +- drivers/gpu/drm/vc4/vc4_perfmon.c | 20 +- drivers/gpu/drm/vc4/vc4_plane.c | 12 +- drivers/gpu/drm/vc4/vc4_render_cl.c | 2 +- drivers/gpu/drm/vc4/vc4_v3d.c | 10 +- drivers/gpu/drm/vc4/vc4_validate.c | 8 +- drivers/gpu/drm/vc4/vc4_validate_shaders.c | 2 +- drivers/gpu/drm/vkms/vkms_output.c | 5 +- drivers/gpu/drm/xe/display/xe_hdcp_gsc.c | 2 +- drivers/gpu/drm/xe/xe_sync.c | 6 +- drivers/gpu/drm/xlnx/zynqmp_disp.c | 3 + drivers/gpu/drm/xlnx/zynqmp_kms.c | 2 +- drivers/hid/hid-hyperv.c | 58 +- drivers/hid/wacom_wac.c | 4 +- drivers/hwmon/aquacomputer_d5next.c | 2 +- drivers/hwmon/nct6775-core.c | 7 +- drivers/hwmon/pmbus/pmbus_core.c | 12 +- drivers/hwmon/tps23861.c | 2 +- drivers/i2c/i2c-dev.c | 17 +- drivers/i3c/master.c | 13 +- drivers/iio/accel/adxl380.c | 2 +- drivers/iio/adc/ad4000.c | 6 +- drivers/iio/adc/pac1921.c | 4 +- drivers/iio/dac/adi-axi-dac.c | 2 +- drivers/iio/industrialio-backend.c | 4 +- drivers/iio/industrialio-gts-helper.c | 2 +- drivers/iio/light/al3010.c | 11 +- drivers/infiniband/core/roce_gid_mgmt.c | 30 +- drivers/infiniband/core/uverbs.h | 2 + drivers/infiniband/core/uverbs_main.c | 43 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 7 +- drivers/infiniband/hw/bnxt_re/main.c | 28 +- drivers/infiniband/hw/bnxt_re/qplib_fp.h | 2 +- drivers/infiniband/hw/hns/hns_roce_cq.c | 4 +- drivers/infiniband/hw/hns/hns_roce_debugfs.c | 3 +- drivers/infiniband/hw/hns/hns_roce_device.h | 14 +- drivers/infiniband/hw/hns/hns_roce_hem.c | 48 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 257 +++--- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 8 +- drivers/infiniband/hw/hns/hns_roce_main.c | 7 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 11 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 79 +- drivers/infiniband/hw/hns/hns_roce_srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 69 +- drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 +- drivers/infiniband/sw/rxe/rxe_qp.c | 1 + drivers/infiniband/sw/rxe/rxe_req.c | 6 +- drivers/input/misc/cs40l50-vibra.c | 6 +- drivers/interconnect/qcom/icc-rpmh.c | 3 + drivers/iommu/amd/io_pgtable_v2.c | 3 + drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 5 +- drivers/iommu/intel/iommu.c | 40 +- drivers/iommu/s390-iommu.c | 75 +- drivers/irqchip/irq-mvebu-sei.c | 2 +- drivers/irqchip/irq-riscv-aplic-main.c | 3 +- drivers/irqchip/irq-riscv-aplic-msi.c | 3 + drivers/leds/flash/leds-ktd2692.c | 1 + drivers/leds/leds-max5970.c | 5 +- drivers/mailbox/arm_mhuv2.c | 8 +- drivers/mailbox/mtk-cmdq-mailbox.c | 2 +- drivers/mailbox/omap-mailbox.c | 1 + drivers/media/i2c/adv7604.c | 5 +- drivers/media/i2c/adv7842.c | 13 +- drivers/media/i2c/ds90ub960.c | 2 +- drivers/media/i2c/max96717.c | 6 +- drivers/media/i2c/vgxy61.c | 2 +- drivers/media/pci/intel/ipu6/Kconfig | 6 - drivers/media/pci/intel/ipu6/ipu6-bus.c | 6 - drivers/media/pci/intel/ipu6/ipu6-buttress.c | 34 +- drivers/media/pci/intel/ipu6/ipu6-cpd.c | 18 +- drivers/media/pci/intel/ipu6/ipu6-dma.c | 202 +++-- drivers/media/pci/intel/ipu6/ipu6-dma.h | 34 +- drivers/media/pci/intel/ipu6/ipu6-fw-com.c | 14 +- drivers/media/pci/intel/ipu6/ipu6-mmu.c | 28 +- drivers/media/pci/intel/ipu6/ipu6.c | 3 + drivers/media/platform/qcom/venus/vdec.c | 19 +- drivers/media/platform/qcom/venus/venc.c | 18 +- drivers/media/radio/wl128x/fmdrv_common.c | 3 +- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 15 +- drivers/media/v4l2-core/v4l2-dv-timings.c | 132 +-- drivers/message/fusion/mptsas.c | 4 +- drivers/mfd/da9052-spi.c | 2 +- drivers/mfd/intel_soc_pmic_bxtwc.c | 144 ++-- drivers/mfd/rt5033.c | 4 +- drivers/mfd/tps65010.c | 8 +- drivers/misc/apds990x.c | 12 +- drivers/misc/lkdtm/bugs.c | 2 +- drivers/mmc/host/mmc_spi.c | 9 +- drivers/mtd/hyperbus/rpc-if.c | 7 + drivers/mtd/nand/raw/atmel/pmecc.c | 8 +- drivers/mtd/nand/raw/atmel/pmecc.h | 2 - drivers/mtd/spi-nor/core.c | 2 +- drivers/mtd/spi-nor/spansion.c | 1 + drivers/mtd/ubi/attach.c | 12 +- drivers/mtd/ubi/fastmap-wl.c | 19 +- drivers/mtd/ubi/vmt.c | 2 + drivers/mtd/ubi/wl.c | 11 +- drivers/mtd/ubi/wl.h | 3 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 37 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 9 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.h | 3 +- drivers/net/ethernet/broadcom/tg3.c | 3 + drivers/net/ethernet/google/gve/gve_adminq.c | 4 +- drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 2 +- drivers/net/ethernet/intel/ice/ice_virtchnl.c | 21 +- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 70 +- drivers/net/ethernet/marvell/octeontx2/af/cgx.h | 5 + .../ethernet/marvell/octeontx2/af/lmac_common.h | 7 +- drivers/net/ethernet/marvell/octeontx2/af/rpm.c | 87 +- drivers/net/ethernet/marvell/octeontx2/af/rpm.h | 18 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 1 + drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 45 +- drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c | 5 + .../ethernet/marvell/octeontx2/nic/otx2_common.c | 4 + .../ethernet/marvell/octeontx2/nic/otx2_dcbnl.c | 5 + .../ethernet/marvell/octeontx2/nic/otx2_dmac_flt.c | 9 + .../ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 10 + .../ethernet/marvell/octeontx2/nic/otx2_flows.c | 10 + drivers/net/ethernet/marvell/pxa168_eth.c | 14 +- drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 12 + drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 2 - .../net/ethernet/microchip/vcap/vcap_api_kunit.c | 17 +- drivers/net/ethernet/realtek/rtase/rtase.h | 7 +- drivers/net/ethernet/realtek/rtase/rtase_main.c | 43 +- .../net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 2 + drivers/net/ethernet/wangxun/txgbe/txgbe_irq.c | 24 +- drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 1 - drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 168 +--- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.h | 2 - drivers/net/ethernet/wangxun/txgbe/txgbe_type.h | 7 +- drivers/net/mdio/mdio-ipq4019.c | 5 +- drivers/net/netdevsim/ipsec.c | 11 +- drivers/net/usb/lan78xx.c | 42 +- drivers/net/wireless/ath/ath10k/mac.c | 4 +- drivers/net/wireless/ath/ath11k/qmi.c | 3 + drivers/net/wireless/ath/ath12k/dp.c | 19 +- drivers/net/wireless/ath/ath12k/mac.c | 5 +- drivers/net/wireless/ath/ath12k/wow.c | 2 +- drivers/net/wireless/ath/ath9k/htc_hst.c | 3 + .../net/wireless/broadcom/brcm80211/brcmfmac/of.c | 3 +- drivers/net/wireless/intel/iwlegacy/3945.c | 2 +- drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 8 +- drivers/net/wireless/intersil/p54/p54spi.c | 4 +- drivers/net/wireless/marvell/mwifiex/cmdevt.c | 2 + drivers/net/wireless/marvell/mwifiex/fw.h | 2 +- drivers/net/wireless/marvell/mwifiex/main.c | 4 +- drivers/net/wireless/marvell/mwifiex/util.c | 2 + drivers/net/wireless/microchip/wilc1000/netdev.c | 6 +- drivers/net/wireless/realtek/rtl8xxxu/core.c | 6 +- drivers/net/wireless/realtek/rtlwifi/efuse.c | 11 +- drivers/net/wireless/realtek/rtw89/cam.c | 259 ++++-- drivers/net/wireless/realtek/rtw89/cam.h | 24 +- drivers/net/wireless/realtek/rtw89/chan.c | 219 +++-- drivers/net/wireless/realtek/rtw89/chan.h | 4 +- drivers/net/wireless/realtek/rtw89/coex.c | 157 ++-- drivers/net/wireless/realtek/rtw89/coex.h | 6 +- drivers/net/wireless/realtek/rtw89/core.c | 887 ++++++++++++++------- drivers/net/wireless/realtek/rtw89/core.h | 421 +++++++--- drivers/net/wireless/realtek/rtw89/debug.c | 127 ++- drivers/net/wireless/realtek/rtw89/fw.c | 637 ++++++++------- drivers/net/wireless/realtek/rtw89/fw.h | 192 +++-- drivers/net/wireless/realtek/rtw89/mac.c | 698 +++++++++------- drivers/net/wireless/realtek/rtw89/mac.h | 98 ++- drivers/net/wireless/realtek/rtw89/mac80211.c | 657 ++++++++++++--- drivers/net/wireless/realtek/rtw89/mac_be.c | 69 +- drivers/net/wireless/realtek/rtw89/phy.c | 401 ++++++---- drivers/net/wireless/realtek/rtw89/phy.h | 7 +- drivers/net/wireless/realtek/rtw89/ps.c | 109 ++- drivers/net/wireless/realtek/rtw89/ps.h | 14 +- drivers/net/wireless/realtek/rtw89/regd.c | 79 +- drivers/net/wireless/realtek/rtw89/rtw8851b.c | 13 +- drivers/net/wireless/realtek/rtw89/rtw8852a.c | 12 +- drivers/net/wireless/realtek/rtw89/rtw8852b.c | 13 +- drivers/net/wireless/realtek/rtw89/rtw8852bt.c | 13 +- drivers/net/wireless/realtek/rtw89/rtw8852c.c | 12 +- drivers/net/wireless/realtek/rtw89/rtw8922a.c | 10 +- drivers/net/wireless/realtek/rtw89/ser.c | 37 +- drivers/net/wireless/realtek/rtw89/wow.c | 217 ++--- drivers/net/wireless/realtek/rtw89/wow.h | 10 +- drivers/net/wireless/silabs/wfx/main.c | 17 +- drivers/net/wireless/st/cw1200/cw1200_spi.c | 2 +- drivers/nvme/host/core.c | 5 + drivers/nvme/host/multipath.c | 21 +- drivers/nvme/host/pci.c | 55 +- drivers/of/fdt.c | 14 +- drivers/of/kexec.c | 2 +- drivers/pci/controller/cadence/pci-j721e.c | 26 +- drivers/pci/controller/dwc/pcie-qcom-ep.c | 6 +- drivers/pci/controller/dwc/pcie-qcom.c | 4 +- drivers/pci/controller/dwc/pcie-tegra194.c | 7 +- drivers/pci/endpoint/functions/pci-epf-mhi.c | 6 + drivers/pci/hotplug/cpqphp_pci.c | 15 +- drivers/pci/pci.c | 5 +- drivers/pci/slot.c | 4 +- drivers/perf/arm-cmn.c | 4 +- drivers/perf/arm_smmuv3_pmu.c | 19 +- drivers/phy/phy-airoha-pcie-regs.h | 6 +- drivers/phy/phy-airoha-pcie.c | 8 +- drivers/phy/realtek/phy-rtk-usb2.c | 2 + drivers/phy/realtek/phy-rtk-usb3.c | 2 + drivers/pinctrl/pinctrl-k210.c | 2 +- drivers/pinctrl/pinctrl-zynqmp.c | 1 - drivers/pinctrl/qcom/pinctrl-spmi-gpio.c | 2 +- drivers/pinctrl/renesas/Kconfig | 1 + drivers/pinctrl/renesas/pinctrl-rzg2l.c | 2 +- drivers/platform/chrome/cros_ec_typec.c | 1 + drivers/platform/x86/asus-wmi.c | 64 +- drivers/platform/x86/intel/bxtwc_tmu.c | 22 +- drivers/platform/x86/intel/pmt/class.c | 8 +- drivers/platform/x86/intel/pmt/class.h | 2 +- drivers/platform/x86/intel/pmt/telemetry.c | 2 +- drivers/platform/x86/panasonic-laptop.c | 10 +- drivers/pmdomain/ti/ti_sci_pm_domains.c | 4 + drivers/power/reset/Kconfig | 1 + drivers/power/sequencing/Kconfig | 1 + drivers/power/supply/bq27xxx_battery.c | 37 +- drivers/power/supply/power_supply_core.c | 2 - drivers/power/supply/rt9471.c | 52 +- drivers/pwm/core.c | 10 +- drivers/pwm/pwm-imx27.c | 98 ++- drivers/regulator/qcom_smd-regulator.c | 2 +- drivers/regulator/rk808-regulator.c | 15 +- drivers/remoteproc/Kconfig | 6 +- drivers/remoteproc/qcom_q6v5_adsp.c | 11 +- drivers/remoteproc/qcom_q6v5_mss.c | 6 +- drivers/remoteproc/qcom_q6v5_pas.c | 22 +- drivers/rpmsg/qcom_glink_native.c | 3 +- drivers/rtc/interface.c | 7 +- drivers/rtc/rtc-ab-eoz9.c | 7 - drivers/rtc/rtc-abx80x.c | 2 +- drivers/rtc/rtc-rzn1.c | 8 +- drivers/rtc/rtc-st-lpc.c | 5 +- drivers/s390/cio/cio.c | 6 +- drivers/s390/cio/device.c | 18 +- drivers/s390/virtio/virtio_ccw.c | 4 + drivers/scsi/bfa/bfad.c | 3 +- drivers/scsi/hisi_sas/hisi_sas_main.c | 8 +- drivers/scsi/qedf/qedf_main.c | 1 + drivers/scsi/qedi/qedi_main.c | 1 + drivers/scsi/sg.c | 9 +- drivers/sh/intc/core.c | 2 +- drivers/soc/fsl/qe/qmc.c | 4 +- drivers/soc/fsl/rcpm.c | 1 + drivers/soc/qcom/qcom-geni-se.c | 3 +- drivers/soc/ti/smartreflex.c | 4 +- drivers/soc/xilinx/xlnx_event_manager.c | 4 +- drivers/spi/atmel-quadspi.c | 2 +- drivers/spi/spi-fsl-lpspi.c | 12 +- drivers/spi/spi-tegra210-quad.c | 2 +- drivers/spi/spi-zynqmp-gqspi.c | 2 + drivers/spi/spi.c | 13 +- drivers/staging/media/atomisp/pci/sh_css_params.c | 2 + .../vc04_services/interface/vchiq_arm/vchiq_arm.c | 6 +- drivers/target/target_core_pscsi.c | 2 +- drivers/thermal/testing/zone.c | 32 +- drivers/thermal/thermal_core.c | 123 +-- drivers/thermal/thermal_core.h | 12 +- drivers/tty/serial/8250/8250_fintek.c | 14 +- drivers/tty/serial/8250/8250_omap.c | 4 +- drivers/tty/serial/amba-pl011.c | 7 + drivers/tty/tty_io.c | 2 +- drivers/usb/dwc3/core.h | 4 + drivers/usb/dwc3/ep0.c | 2 +- drivers/usb/dwc3/gadget.c | 69 +- drivers/usb/gadget/composite.c | 18 +- drivers/usb/gadget/function/uvc_video.c | 4 + drivers/usb/host/ehci-spear.c | 7 +- drivers/usb/host/xhci-pci.c | 10 +- drivers/usb/host/xhci-ring.c | 73 +- drivers/usb/host/xhci.c | 40 +- drivers/usb/host/xhci.h | 3 + drivers/usb/misc/chaoskey.c | 35 +- drivers/usb/misc/iowarrior.c | 50 +- drivers/usb/misc/usb-ljca.c | 20 +- drivers/usb/misc/yurex.c | 5 +- drivers/usb/musb/musb_gadget.c | 13 +- drivers/usb/typec/tcpm/wcove.c | 4 - drivers/usb/typec/ucsi/ucsi_ccg.c | 5 + drivers/usb/typec/ucsi/ucsi_glink.c | 2 +- drivers/vdpa/mlx5/core/mr.c | 4 +- drivers/vfio/pci/mlx5/cmd.c | 6 +- drivers/vfio/pci/mlx5/main.c | 35 +- drivers/vfio/pci/vfio_pci_config.c | 16 +- drivers/video/fbdev/sh7760fb.c | 3 +- drivers/watchdog/Kconfig | 4 +- drivers/xen/xenbus/xenbus_probe.c | 8 +- fs/binfmt_elf.c | 2 + fs/binfmt_elf_fdpic.c | 5 +- fs/binfmt_misc.c | 7 +- fs/cachefiles/interface.c | 14 +- fs/cachefiles/ondemand.c | 38 +- fs/dlm/ast.c | 2 +- fs/dlm/recoverd.c | 2 +- fs/efs/super.c | 43 +- fs/erofs/data.c | 10 +- fs/erofs/internal.h | 1 + fs/erofs/super.c | 6 +- fs/erofs/zmap.c | 17 +- fs/exec.c | 23 +- fs/exfat/file.c | 10 + fs/exfat/namei.c | 21 +- fs/ext4/balloc.c | 4 +- fs/ext4/ext4.h | 12 +- fs/ext4/extents.c | 2 +- fs/ext4/fsmap.c | 54 +- fs/ext4/ialloc.c | 5 +- fs/ext4/indirect.c | 2 +- fs/ext4/inode.c | 4 +- fs/ext4/mballoc.c | 18 +- fs/ext4/mballoc.h | 1 + fs/ext4/mmp.c | 2 +- fs/ext4/move_extent.c | 2 +- fs/ext4/resize.c | 2 +- fs/ext4/super.c | 42 +- fs/f2fs/checkpoint.c | 2 +- fs/f2fs/data.c | 29 +- fs/f2fs/f2fs.h | 3 +- fs/f2fs/file.c | 17 +- fs/f2fs/gc.c | 2 + fs/f2fs/node.c | 10 + fs/f2fs/segment.c | 5 +- fs/f2fs/segment.h | 35 +- fs/f2fs/super.c | 37 +- fs/fcntl.c | 3 + fs/fuse/file.c | 62 +- fs/fuse/fuse_i.h | 6 + fs/fuse/virtio_fs.c | 1 + fs/gfs2/glock.c | 19 +- fs/gfs2/glock.h | 1 + fs/gfs2/incore.h | 2 +- fs/gfs2/rgrp.c | 2 +- fs/gfs2/super.c | 2 +- fs/hfsplus/hfsplus_fs.h | 3 +- fs/hfsplus/wrapper.c | 2 + fs/hostfs/hostfs_kern.c | 4 +- fs/isofs/inode.c | 8 +- fs/jffs2/erase.c | 7 +- fs/jfs/xattr.c | 2 +- fs/netfs/fscache_volume.c | 3 +- fs/nfs/blocklayout/blocklayout.c | 15 +- fs/nfs/blocklayout/dev.c | 6 +- fs/nfs/internal.h | 2 +- fs/nfs/localio.c | 6 + fs/nfs/nfs4proc.c | 8 +- fs/nfs/write.c | 49 +- fs/nfs_common/nfslocalio.c | 8 +- fs/nfsd/export.c | 31 +- fs/nfsd/export.h | 4 +- fs/nfsd/filecache.c | 14 +- fs/nfsd/filecache.h | 2 +- fs/nfsd/nfs4callback.c | 16 +- fs/nfsd/nfs4proc.c | 7 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4state.c | 5 +- fs/nfsd/nfs4xdr.c | 2 +- fs/nfsd/nfsfh.c | 20 +- fs/nfsd/nfsfh.h | 3 +- fs/notify/fsnotify.c | 23 +- fs/notify/mark.c | 12 +- fs/ntfs3/file.c | 2 +- fs/ocfs2/aops.h | 2 + fs/ocfs2/file.c | 4 + fs/proc/kcore.c | 10 +- fs/read_write.c | 15 +- fs/smb/client/cached_dir.c | 229 ++++-- fs/smb/client/cached_dir.h | 6 +- fs/smb/client/cifsacl.c | 50 +- fs/smb/client/cifsfs.c | 12 +- fs/smb/client/cifsglob.h | 4 +- fs/smb/client/cifsproto.h | 5 +- fs/smb/client/connect.c | 59 +- fs/smb/client/fs_context.c | 85 +- fs/smb/client/fs_context.h | 1 + fs/smb/client/inode.c | 8 +- fs/smb/client/reparse.c | 95 ++- fs/smb/client/reparse.h | 6 +- fs/smb/client/smb1ops.c | 4 +- fs/smb/client/smb2file.c | 21 +- fs/smb/client/smb2inode.c | 6 +- fs/smb/client/smb2ops.c | 2 +- fs/smb/client/smb2pdu.c | 6 +- fs/smb/client/smb2proto.h | 11 +- fs/smb/client/smb2transport.c | 56 +- fs/smb/client/trace.h | 3 + fs/smb/server/server.c | 4 + fs/ubifs/super.c | 6 +- fs/ubifs/tnc_commit.c | 2 + fs/unicode/utf8-core.c | 2 +- fs/xfs/xfs_bmap_util.c | 8 +- include/asm-generic/vmlinux.lds.h | 4 +- include/kunit/skbuff.h | 2 +- include/linux/blk-mq.h | 2 + include/linux/blkdev.h | 12 +- include/linux/bpf.h | 9 +- include/linux/cleanup.h | 4 +- include/linux/compiler_attributes.h | 13 - include/linux/compiler_types.h | 19 + include/linux/f2fs_fs.h | 6 +- include/linux/fs.h | 2 +- include/linux/hisi_acc_qm.h | 8 +- include/linux/intel_vsec.h | 3 +- include/linux/jiffies.h | 2 +- include/linux/kfifo.h | 1 - include/linux/kvm_host.h | 6 - include/linux/lockdep.h | 2 +- include/linux/mmdebug.h | 6 +- include/linux/netpoll.h | 2 +- include/linux/nfslocalio.h | 18 +- include/linux/of_fdt.h | 5 +- include/linux/once.h | 4 +- include/linux/once_lite.h | 2 +- include/linux/rcupdate.h | 2 +- include/linux/rwlock_rt.h | 10 +- include/linux/sched/ext.h | 1 - include/linux/seqlock.h | 98 ++- include/linux/spinlock_rt.h | 23 +- include/media/v4l2-dv-timings.h | 18 +- include/net/bluetooth/hci.h | 4 +- include/net/bluetooth/hci_core.h | 63 ++ include/net/net_debug.h | 2 +- include/rdma/ib_verbs.h | 11 + include/uapi/linux/rtnetlink.h | 2 +- init/Kconfig | 9 + init/initramfs.c | 15 + io_uring/memmap.c | 11 +- ipc/namespace.c | 4 +- kernel/bpf/bpf_struct_ops.c | 114 ++- kernel/bpf/btf.c | 5 +- kernel/bpf/dispatcher.c | 3 +- kernel/bpf/trampoline.c | 9 +- kernel/bpf/verifier.c | 103 ++- kernel/cgroup/cgroup.c | 21 +- kernel/fork.c | 26 +- kernel/rcu/rcuscale.c | 6 +- kernel/rcu/srcutiny.c | 2 +- kernel/rcu/tree.c | 14 +- kernel/rcu/tree_nocb.h | 13 +- kernel/sched/cpufreq_schedutil.c | 3 +- kernel/sched/ext.c | 9 +- kernel/time/time.c | 4 +- kernel/time/timer.c | 3 +- kernel/trace/bpf_trace.c | 5 +- kernel/trace/trace_event_perf.c | 6 + lib/overflow_kunit.c | 2 +- lib/string_helpers.c | 2 +- lib/strncpy_from_user.c | 5 +- mm/internal.h | 2 +- net/9p/trans_usbg.c | 4 +- net/9p/trans_xen.c | 9 +- net/bluetooth/hci_conn.c | 225 ++++-- net/bluetooth/hci_event.c | 39 +- net/bluetooth/hci_sysfs.c | 15 +- net/bluetooth/iso.c | 101 ++- net/bluetooth/mgmt.c | 38 +- net/bluetooth/rfcomm/sock.c | 10 +- net/core/filter.c | 88 +- net/core/netdev-genl.c | 2 + net/core/skmsg.c | 4 +- net/hsr/hsr_device.c | 4 +- net/ipv4/inet_connection_sock.c | 2 +- net/ipv4/ipmr.c | 44 +- net/ipv6/addrconf.c | 41 +- net/ipv6/ip6_fib.c | 8 +- net/ipv6/ip6mr.c | 40 +- net/ipv6/route.c | 51 +- net/iucv/af_iucv.c | 26 +- net/l2tp/l2tp_core.c | 22 +- net/llc/af_llc.c | 2 +- net/netfilter/ipset/ip_set_bitmap_ip.c | 7 +- net/netfilter/nf_tables_api.c | 62 +- net/netlink/af_netlink.c | 21 +- net/rfkill/rfkill-gpio.c | 8 +- net/rxrpc/af_rxrpc.c | 7 +- net/sched/sch_fq.c | 6 + net/sunrpc/cache.c | 4 +- net/sunrpc/svcsock.c | 4 + net/sunrpc/xprtrdma/svc_rdma.c | 19 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 8 +- net/sunrpc/xprtsock.c | 17 +- net/wireless/core.c | 64 +- net/wireless/mlme.c | 6 - net/wireless/nl80211.c | 1 + net/xdp/xsk.c | 11 +- rust/helpers/spinlock.c | 8 +- rust/kernel/block/mq/request.rs | 67 +- rust/kernel/lib.rs | 2 +- rust/kernel/rbtree.rs | 9 +- rust/macros/lib.rs | 2 +- samples/bpf/xdp_adjust_tail_kern.c | 1 + samples/kfifo/dma-example.c | 1 + scripts/checkpatch.pl | 37 +- scripts/faddr2line | 2 +- scripts/kernel-doc | 47 +- scripts/mod/file2alias.c | 5 +- scripts/package/builddeb | 20 +- security/apparmor/capability.c | 2 + security/apparmor/policy_unpack_test.c | 6 + sound/core/pcm_native.c | 6 +- sound/core/rawmidi.c | 4 +- sound/core/sound_kunit.c | 11 + sound/core/ump.c | 5 +- sound/pci/hda/patch_realtek.c | 153 ++-- sound/soc/amd/acp/acp-sdw-sof-mach.c | 16 +- sound/soc/amd/yc/acp6x-mach.c | 25 +- sound/soc/codecs/da7213.c | 1 + sound/soc/codecs/da7219.c | 9 +- sound/soc/codecs/rt722-sdca.c | 8 +- sound/soc/fsl/fsl-asoc-card.c | 8 +- sound/soc/fsl/fsl_micfil.c | 4 +- sound/soc/fsl/imx-audmix.c | 3 + sound/soc/mediatek/mt8188/mt8188-mt6359.c | 9 +- .../mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c | 4 +- sound/soc/mediatek/mt8195/mt8195-mt6359.c | 9 +- sound/usb/6fire/chip.c | 10 +- sound/usb/caiaq/audio.c | 10 +- sound/usb/caiaq/audio.h | 1 + sound/usb/caiaq/device.c | 19 +- sound/usb/caiaq/input.c | 12 +- sound/usb/caiaq/input.h | 1 + sound/usb/clock.c | 24 +- sound/usb/quirks.c | 27 +- sound/usb/usx2y/us122l.c | 5 +- sound/usb/usx2y/usbusx2y.c | 2 +- tools/bpf/bpftool/jit_disasm.c | 40 +- tools/gpio/gpio-sloppy-logic-analyzer.sh | 2 +- tools/include/nolibc/arch-s390.h | 1 + tools/lib/bpf/Makefile | 3 +- tools/lib/bpf/libbpf.c | 99 +-- tools/lib/bpf/linker.c | 2 + tools/lib/thermal/commands.c | 52 +- tools/perf/Makefile.config | 2 +- tools/perf/builtin-ftrace.c | 2 +- tools/perf/builtin-list.c | 4 +- tools/perf/builtin-stat.c | 52 +- tools/perf/builtin-trace.c | 23 +- tools/perf/pmu-events/empty-pmu-events.c | 2 +- tools/perf/pmu-events/jevents.py | 2 +- tools/perf/tests/attr/test-stat-default | 94 ++- tools/perf/tests/attr/test-stat-detailed-1 | 110 ++- tools/perf/tests/attr/test-stat-detailed-2 | 134 ++-- tools/perf/tests/attr/test-stat-detailed-3 | 142 ++-- tools/perf/tests/shell/test_stat_intel_tpebs.sh | 11 +- tools/perf/util/bpf-filter.c | 2 +- tools/perf/util/cs-etm.c | 25 +- tools/perf/util/disasm.c | 15 +- tools/perf/util/evlist.c | 19 +- tools/perf/util/evlist.h | 1 + tools/perf/util/machine.c | 2 +- tools/perf/util/mem-events.c | 8 +- tools/perf/util/pfm.c | 4 +- tools/perf/util/pmus.c | 2 +- tools/perf/util/probe-finder.c | 21 +- tools/perf/util/probe-finder.h | 4 +- tools/perf/util/stat-display.c | 101 ++- tools/power/x86/turbostat/turbostat.c | 5 +- tools/testing/selftests/arm64/abi/hwcap.c | 6 +- .../selftests/arm64/mte/check_tags_inclusion.c | 4 +- .../testing/selftests/arm64/mte/mte_common_util.c | 4 +- tools/testing/selftests/bpf/Makefile | 3 +- tools/testing/selftests/bpf/network_helpers.h | 1 + .../selftests/bpf/prog_tests/timer_lockup.c | 6 + .../selftests/bpf/progs/test_spin_lock_fail.c | 4 +- .../selftests/bpf/progs/test_tp_btf_nullable.c | 6 +- tools/testing/selftests/bpf/test_progs.c | 9 +- tools/testing/selftests/bpf/test_sockmap.c | 165 +++- tools/testing/selftests/bpf/uprobe_multi.c | 4 + .../selftests/mount_setattr/mount_setattr_test.c | 2 +- tools/testing/selftests/net/Makefile | 1 + .../selftests/net/ipv6_route_update_soft_lockup.sh | 262 ++++++ .../selftests/net/netfilter/conntrack_dump_flush.c | 6 + tools/testing/selftests/net/pmtu.sh | 2 +- tools/testing/selftests/resctrl/fill_buf.c | 2 +- tools/testing/selftests/resctrl/mbm_test.c | 16 +- tools/testing/selftests/resctrl/resctrl_val.c | 3 +- tools/testing/selftests/vDSO/parse_vdso.c | 3 +- tools/testing/selftests/wireguard/netns.sh | 1 + tools/tracing/rtla/src/timerlat_hist.c | 2 +- tools/tracing/rtla/src/timerlat_top.c | 2 +- virt/kvm/kvm_main.c | 103 --- 905 files changed, 13449 insertions(+), 6768 deletions(-)

4 months, 3 weeks

19
856
0 0

[PATCH v2] mm: Respect mmap hint address when aligning for THP

by Kalesh Singh

Commit efa7df3e3bb5 ("mm: align larger anonymous mappings on THP boundaries") updated __get_unmapped_area() to align the start address for the VMA to a PMD boundary if CONFIG_TRANSPARENT_HUGEPAGE=y. It does this by effectively looking up a region that is of size, request_size + PMD_SIZE, and aligning up the start to a PMD boundary. Commit 4ef9ad19e176 ("mm: huge_memory: don't force huge page alignment on 32 bit") opted out of this for 32bit due to regressions in mmap base randomization. Commit d4148aeab412 ("mm, mmap: limit THP alignment of anonymous mappings to PMD-aligned sizes") restricted this to only mmap sizes that are multiples of the PMD_SIZE due to reported regressions in some performance benchmarks -- which seemed mostly due to the reduced spatial locality of related mappings due to the forced PMD-alignment. Another unintended side effect has emerged: When a user specifies an mmap hint address, the THP alignment logic modifies the behavior, potentially ignoring the hint even if a sufficiently large gap exists at the requested hint location. Example Scenario: Consider the following simplified virtual address (VA) space: ... 0x200000-0x400000 --- VMA A 0x400000-0x600000 --- Hole 0x600000-0x800000 --- VMA B ... A call to mmap() with hint=0x400000 and len=0x200000 behaves differently: - Before THP alignment: The requested region (size 0x200000) fits into the gap at 0x400000, so the hint is respected. - After alignment: The logic searches for a region of size 0x400000 (len + PMD_SIZE) starting at 0x400000. This search fails due to the mapping at 0x600000 (VMA B), and the hint is ignored, falling back to arch_get_unmapped_area[_topdown](). In general the hint is effectively ignored, if there is any existing mapping in the below range: [mmap_hint + mmap_size, mmap_hint + mmap_size + PMD_SIZE) This changes the semantics of mmap hint; from ""Respect the hint if a sufficiently large gap exists at the requested location" to "Respect the hint only if an additional PMD-sized gap exists beyond the requested size". This has performance implications for allocators that allocate their heap using mmap but try to keep it "as contiguous as possible" by using the end of the exisiting heap as the address hint. With the new behavior it's more likely to get a much less contiguous heap, adding extra fragmentation and performance overhead. To restore the expected behavior; don't use thp_get_unmapped_area_vmflags() when the user provided a hint address, for anonymous mappings. Note: As, Yang Shi, pointed out: the issue still remains for filesystems which are using thp_get_unmapped_area() for their get_unmapped_area() op. It is unclear what worklaods will regress for if we ignore THP alignment when the hint address is provided for such file backed mappings -- so this fix will be handled separately. Cc: Andrew Morton <akpm(a)linux-foundation.org> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Yang Shi <yang(a)os.amperecomputing.com> Cc: Rik van Riel <riel(a)surriel.com> Cc: Ryan Roberts <ryan.roberts(a)arm.com> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Minchan Kim <minchan(a)kernel.org> Cc: Hans Boehm <hboehm(a)google.com> Cc: Lokesh Gidra <lokeshgidra(a)google.com> Cc: <stable(a)vger.kernel.org> Fixes: efa7df3e3bb5 ("mm: align larger anonymous mappings on THP boundaries") Signed-off-by: Kalesh Singh <kaleshsingh(a)google.com> Reviewed-by: Rik van Riel <riel(a)surriel.com> Reviewed-by: Vlastimil Babka <vbabka(a)suse.cz> --- Changes in v2: - Clarify the handling of file backed mappings, as highlighted by Yang - Collect Vlastimil's and Rik's Reviewed-by's mm/mmap.c | 1 + 1 file changed, 1 insertion(+) diff --git a/mm/mmap.c b/mm/mmap.c index 79d541f1502b..2f01f1a8e304 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -901,6 +901,7 @@ __get_unmapped_area(struct file *file, unsigned long addr, unsigned long len, if (get_area) { addr = get_area(file, addr, len, pgoff, flags); } else if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) + && !addr /* no hint */ && IS_ALIGNED(len, PMD_SIZE)) { /* Ensures that larger anonymous mappings are THP aligned. */ addr = thp_get_unmapped_area_vmflags(file, addr, len, base-commit: 2d5404caa8c7bb5c4e0435f94b28834ae5456623 -- 2.47.0.338.g60cca15819-goog

4 months, 3 weeks

4
4
0 0

[PATCH v2] USB: core: Disable LPM only for non-suspended ports

by Kai-Heng Feng

There's USB error when tegra board is shutting down: [ 180.919315] usb 2-3: Failed to set U1 timeout to 0x0,error code -113 [ 180.919995] usb 2-3: Failed to set U1 timeout to 0xa,error code -113 [ 180.920512] usb 2-3: Failed to set U2 timeout to 0x4,error code -113 [ 186.157172] tegra-xusb 3610000.usb: xHCI host controller not responding, assume dead [ 186.157858] tegra-xusb 3610000.usb: HC died; cleaning up [ 186.317280] tegra-xusb 3610000.usb: Timeout while waiting for evaluate context command The issue is caused by disabling LPM on already suspended ports. For USB2 LPM, the LPM is already disabled during port suspend. For USB3 LPM, port won't transit to U1/U2 when it's already suspended in U3, hence disabling LPM is only needed for ports that are not suspended. Cc: Wayne Chang <waynec(a)nvidia.com> Cc: stable(a)vger.kernel.org Fixes: d920a2ed8620 ("usb: Disable USB3 LPM at shutdown") Signed-off-by: Kai-Heng Feng <kaihengf(a)nvidia.com> --- v2: Add "Cc: stable(a)vger.kernel.org" drivers/usb/core/port.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/usb/core/port.c b/drivers/usb/core/port.c index e7da2fca11a4..d50b9e004e76 100644 --- a/drivers/usb/core/port.c +++ b/drivers/usb/core/port.c @@ -452,10 +452,11 @@ static int usb_port_runtime_suspend(struct device *dev) static void usb_port_shutdown(struct device *dev) { struct usb_port *port_dev = to_usb_port(dev); + struct usb_device *udev = port_dev->child; - if (port_dev->child) { - usb_disable_usb2_hardware_lpm(port_dev->child); - usb_unlocked_disable_lpm(port_dev->child); + if (udev && !pm_runtime_suspended(&udev->dev)) { + usb_disable_usb2_hardware_lpm(udev); + usb_unlocked_disable_lpm(udev); } } -- 2.47.0

4 months, 3 weeks

2
2
0 0

Linux 6.12.3

by Greg Kroah-Hartman

I'm announcing the release of the 6.12.3 kernel. All users of the 6.12 kernel series must upgrade. The updated 6.12.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.12.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 +- kernel/sched/core.c | 12 +++++------- 2 files changed, 6 insertions(+), 8 deletions(-) Greg Kroah-Hartman (1): Linux 6.12.3 Thomas Gleixner (1): sched: Initialize idle tasks only once

4 months, 3 weeks

1
1
0 0

[PATCH v2 5.10.y] ALSA: usb-audio: Fix out of bounds reads when finding clock sources

by Benoît Sevens

From: Takashi Iwai <tiwai(a)suse.de> Upstream commit a3dd4d63eeb452cfb064a13862fb376ab108f6a6 The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check. This patch ports the upstream commit a3dd4d63eeb4 to trees that do not include the refactoring commit 9ec730052fa2 ("ALSA: usb-audio: Refactoring UAC2/3 clock setup code"). That commit provides union objects for pointing both UAC2 and UAC3 objects and unifies the clock source, selector and multiplier helper functions. This means we need to perform the check in each version specific helper function, but on the other hand do not need to do version specific union dereferencing in the macros and helper functions. Reported-by: Benoît Sevens <bsevens(a)google.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/20241121140613.3651-1-bsevens@google.com Link: https://patch.msgid.link/20241125144629.20757-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> (cherry picked from commit a3dd4d63eeb452cfb064a13862fb376ab108f6a6) Signed-off-by: Benoît Sevens <bsevens(a)google.com> --- sound/usb/clock.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/sound/usb/clock.c b/sound/usb/clock.c index 3d1c0ec11753..58902275c815 100644 --- a/sound/usb/clock.c +++ b/sound/usb/clock.c @@ -21,6 +21,10 @@ #include "clock.h" #include "quirks.h" +/* check whether the descriptor bLength has the minimal length */ +#define DESC_LENGTH_CHECK(p) \ + (p->bLength >= sizeof(*p)) + static void *find_uac_clock_desc(struct usb_host_interface *iface, int id, bool (*validator)(void *, int), u8 type) { @@ -38,36 +42,60 @@ static void *find_uac_clock_desc(struct usb_host_interface *iface, int id, static bool validate_clock_source_v2(void *p, int id) { struct uac_clock_source_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_source_v3(void *p, int id) { struct uac3_clock_source_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_selector_v2(void *p, int id) { struct uac_clock_selector_descriptor *cs = p; - return cs->bClockID == id; + if (!DESC_LENGTH_CHECK(cs)) + return false; + if (cs->bClockID != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + return cs->bLength >= sizeof(*cs) + cs->bNrInPins + + 1 /* bmControls */ + 1 /* iClockSelector */; } static bool validate_clock_selector_v3(void *p, int id) { struct uac3_clock_selector_descriptor *cs = p; - return cs->bClockID == id; + if (!DESC_LENGTH_CHECK(cs)) + return false; + if (cs->bClockID != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + return cs->bLength >= sizeof(*cs) + cs->bNrInPins + + 4 /* bmControls */ + 2 /* wCSelectorDescrStr */; } static bool validate_clock_multiplier_v2(void *p, int id) { struct uac_clock_multiplier_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_multiplier_v3(void *p, int id) { struct uac3_clock_multiplier_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } -- 2.47.0.338.g60cca15819-goog

4 months, 3 weeks

3
4
0 0

Linux 6.12.2

by Greg Kroah-Hartman

I'm announcing the release of the 6.12.2 kernel. All users of the 6.12 kernel series must upgrade. The updated 6.12.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.12.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/ABI/testing/sysfs-fs-f2fs | 7 Documentation/RCU/stallwarn.rst | 2 Documentation/admin-guide/blockdev/zram.rst | 2 Documentation/admin-guide/media/building.rst | 2 Documentation/admin-guide/media/saa7134.rst | 2 Documentation/arch/x86/boot.rst | 17 Documentation/devicetree/bindings/cache/qcom,llcc.yaml | 36 Documentation/devicetree/bindings/clock/adi,axi-clkgen.yaml | 22 Documentation/devicetree/bindings/iio/dac/adi,ad3552r.yaml | 2 Documentation/devicetree/bindings/pci/mediatek-pcie-gen3.yaml | 5 Documentation/devicetree/bindings/pinctrl/samsung,pinctrl-wakeup-interrupt.yaml | 19 Documentation/devicetree/bindings/serial/rs485.yaml | 19 Documentation/devicetree/bindings/sound/mt6359.yaml | 10 Documentation/devicetree/bindings/vendor-prefixes.yaml | 2 Documentation/filesystems/mount_api.rst | 3 Documentation/locking/seqlock.rst | 2 MAINTAINERS | 335 +-- Makefile | 2 arch/arc/kernel/devtree.c | 2 arch/arm/boot/dts/allwinner/sun9i-a80-cubieboard4.dts | 4 arch/arm/boot/dts/microchip/sam9x60.dtsi | 12 arch/arm/boot/dts/renesas/r7s72100-genmai.dts | 2 arch/arm/boot/dts/ti/omap/omap36xx.dtsi | 1 arch/arm/kernel/devtree.c | 2 arch/arm64/boot/dts/freescale/imx8mn-tqma8mqnl-mba8mx-usbotg.dtso | 29 arch/arm64/boot/dts/mediatek/mt6358.dtsi | 4 arch/arm64/boot/dts/mediatek/mt8173-elm-hana.dtsi | 8 arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-burnet.dts | 3 arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-cozmo.dts | 2 arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts | 3 arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-fennel.dtsi | 3 arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi | 30 arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi | 4 arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi | 4 arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi | 4 arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 5 arch/arm64/boot/dts/mediatek/mt8183.dtsi | 4 arch/arm64/boot/dts/mediatek/mt8186-corsola-voltorb.dtsi | 21 arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi | 8 arch/arm64/boot/dts/mediatek/mt8188.dtsi | 5 arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi | 6 arch/arm64/boot/dts/mediatek/mt8195.dtsi | 4 arch/arm64/boot/dts/mediatek/mt8395-genio-1200-evk.dts | 2 arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi | 2 arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts | 2 arch/arm64/boot/dts/qcom/sc8180x.dtsi | 2 arch/arm64/boot/dts/qcom/sda660-inforce-ifc6560.dts | 2 arch/arm64/boot/dts/qcom/sm6350.dtsi | 14 arch/arm64/boot/dts/qcom/x1e80100-asus-vivobook-s15.dts | 4 arch/arm64/boot/dts/qcom/x1e80100-lenovo-yoga-slim7x.dts | 4 arch/arm64/boot/dts/qcom/x1e80100.dtsi | 8 arch/arm64/boot/dts/renesas/hihope-rev2.dtsi | 3 arch/arm64/boot/dts/renesas/hihope-rev4.dtsi | 3 arch/arm64/boot/dts/rockchip/rk3568-wolfvision-pf5-io-expander.dtso | 1 arch/arm64/boot/dts/rockchip/rk3588s-indiedroid-nova.dts | 2 arch/arm64/boot/dts/rockchip/rk3588s-orangepi-5.dts | 1 arch/arm64/boot/dts/ti/k3-am62x-phyboard-lyra.dtsi | 2 arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts | 2 arch/arm64/boot/dts/ti/k3-j7200-main.dtsi | 38 arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi | 6 arch/arm64/boot/dts/ti/k3-j721e-mcu-wakeup.dtsi | 6 arch/arm64/boot/dts/ti/k3-j721s2-main.dtsi | 16 arch/arm64/boot/dts/ti/k3-j721s2-mcu-wakeup.dtsi | 6 arch/arm64/include/asm/insn.h | 1 arch/arm64/include/asm/kvm_host.h | 2 arch/arm64/kernel/cpufeature.c | 1 arch/arm64/kernel/probes/decode-insn.c | 7 arch/arm64/kernel/process.c | 2 arch/arm64/kernel/setup.c | 6 arch/arm64/kernel/vmlinux.lds.S | 6 arch/arm64/kvm/arch_timer.c | 3 arch/arm64/kvm/arm.c | 18 arch/arm64/kvm/mmio.c | 32 arch/arm64/kvm/pmu-emul.c | 1 arch/arm64/kvm/vgic/vgic-its.c | 32 arch/arm64/kvm/vgic/vgic-mmio-v3.c | 7 arch/arm64/kvm/vgic/vgic.h | 23 arch/arm64/net/bpf_jit_comp.c | 47 arch/csky/kernel/setup.c | 4 arch/loongarch/Makefile | 4 arch/loongarch/kernel/setup.c | 2 arch/loongarch/net/bpf_jit.c | 2 arch/loongarch/vdso/Makefile | 2 arch/m68k/coldfire/device.c | 8 arch/m68k/include/asm/mcfgpio.h | 2 arch/m68k/include/asm/mvme147hw.h | 4 arch/m68k/kernel/early_printk.c | 5 arch/m68k/mvme147/config.c | 30 arch/m68k/mvme147/mvme147.h | 6 arch/microblaze/kernel/microblaze_ksyms.c | 10 arch/microblaze/kernel/prom.c | 2 arch/mips/include/asm/switch_to.h | 2 arch/mips/kernel/prom.c | 2 arch/mips/kernel/relocate.c | 2 arch/nios2/kernel/prom.c | 4 arch/openrisc/Kconfig | 3 arch/openrisc/include/asm/fixmap.h | 21 arch/openrisc/kernel/prom.c | 2 arch/openrisc/mm/init.c | 37 arch/parisc/kernel/ftrace.c | 2 arch/powerpc/include/asm/dtl.h | 4 arch/powerpc/include/asm/fadump.h | 9 arch/powerpc/include/asm/kvm_book3s_64.h | 4 arch/powerpc/include/asm/sstep.h | 5 arch/powerpc/include/asm/vdso.h | 1 arch/powerpc/kernel/dt_cpu_ftrs.c | 2 arch/powerpc/kernel/fadump.c | 40 arch/powerpc/kernel/prom.c | 5 arch/powerpc/kernel/setup-common.c | 6 arch/powerpc/kernel/setup_64.c | 1 arch/powerpc/kexec/file_load_64.c | 9 arch/powerpc/kvm/book3s_hv.c | 14 arch/powerpc/kvm/book3s_hv_nested.c | 14 arch/powerpc/kvm/trace_hv.h | 2 arch/powerpc/lib/sstep.c | 12 arch/powerpc/mm/fault.c | 10 arch/powerpc/platforms/pseries/dtl.c | 8 arch/powerpc/platforms/pseries/lpar.c | 8 arch/powerpc/platforms/pseries/plpks.c | 2 arch/riscv/include/asm/cpufeature.h | 2 arch/riscv/kernel/setup.c | 2 arch/riscv/kernel/traps_misaligned.c | 14 arch/riscv/kernel/unaligned_access_speed.c | 1 arch/riscv/kvm/aia_aplic.c | 3 arch/riscv/kvm/vcpu_sbi.c | 11 arch/s390/include/asm/facility.h | 18 arch/s390/include/asm/pci.h | 4 arch/s390/include/asm/set_memory.h | 1 arch/s390/kernel/perf_cpum_sf.c | 2 arch/s390/kernel/syscalls/Makefile | 2 arch/s390/mm/pageattr.c | 15 arch/s390/pci/pci.c | 37 arch/s390/pci/pci_debug.c | 10 arch/sh/kernel/cpu/proc.c | 2 arch/sh/kernel/setup.c | 2 arch/um/drivers/net_kern.c | 2 arch/um/drivers/ubd_kern.c | 4 arch/um/drivers/vector_kern.c | 3 arch/um/kernel/dtb.c | 2 arch/um/kernel/physmem.c | 6 arch/um/kernel/process.c | 2 arch/um/kernel/sysrq.c | 2 arch/x86/coco/tdx/tdx.c | 111 + arch/x86/crypto/aegis128-aesni-asm.S | 29 arch/x86/events/intel/pt.c | 11 arch/x86/events/intel/pt.h | 2 arch/x86/include/asm/atomic64_32.h | 3 arch/x86/include/asm/cmpxchg_32.h | 6 arch/x86/include/asm/kvm_host.h | 4 arch/x86/include/asm/shared/tdx.h | 11 arch/x86/include/asm/tlb.h | 4 arch/x86/kernel/cpu/amd.c | 1 arch/x86/kernel/cpu/common.c | 4 arch/x86/kernel/cpu/microcode/amd.c | 25 arch/x86/kernel/devicetree.c | 2 arch/x86/kernel/unwind_orc.c | 2 arch/x86/kvm/Kconfig | 5 arch/x86/kvm/mmu/mmu.c | 68 arch/x86/kvm/mmu/spte.c | 18 arch/x86/kvm/vmx/vmx.c | 54 arch/x86/mm/tlb.c | 3 arch/x86/platform/pvh/head.S | 9 arch/xtensa/kernel/setup.c | 2 block/bfq-cgroup.c | 1 block/bfq-iosched.c | 43 block/blk-core.c | 18 block/blk-merge.c | 45 block/blk-mq.c | 148 + block/blk-mq.h | 13 block/blk-settings.c | 7 block/blk-sysfs.c | 6 block/blk-zoned.c | 14 block/blk.h | 30 block/elevator.c | 10 block/fops.c | 25 block/genhd.c | 24 crypto/pcrypt.c | 12 drivers/accel/ivpu/ivpu_ipc.c | 35 drivers/accel/ivpu/ivpu_ipc.h | 7 drivers/accel/ivpu/ivpu_jsm_msg.c | 19 drivers/acpi/arm64/gtdt.c | 2 drivers/acpi/cppc_acpi.c | 1 drivers/base/firmware_loader/main.c | 5 drivers/base/regmap/regmap-irq.c | 4 drivers/base/trace.h | 6 drivers/block/brd.c | 70 drivers/block/loop.c | 6 drivers/block/ublk_drv.c | 17 drivers/block/virtio_blk.c | 46 drivers/block/zram/Kconfig | 1 drivers/block/zram/zram_drv.c | 21 drivers/block/zram/zram_drv.h | 1 drivers/bluetooth/btbcm.c | 4 drivers/bluetooth/btintel.c | 62 drivers/bluetooth/btintel.h | 7 drivers/bluetooth/btintel_pcie.c | 265 ++ drivers/bluetooth/btintel_pcie.h | 16 drivers/bluetooth/btmtk.c | 1 drivers/bluetooth/btusb.c | 1 drivers/bus/mhi/host/trace.h | 25 drivers/clk/.kunitconfig | 1 drivers/clk/Kconfig | 2 drivers/clk/clk-apple-nco.c | 3 drivers/clk/clk-axi-clkgen.c | 22 drivers/clk/clk-en7523.c | 264 ++ drivers/clk/clk-loongson2.c | 6 drivers/clk/imx/clk-fracn-gppll.c | 10 drivers/clk/imx/clk-imx8-acm.c | 4 drivers/clk/imx/clk-lpcg-scu.c | 37 drivers/clk/imx/clk-scu.c | 2 drivers/clk/mediatek/Kconfig | 15 drivers/clk/qcom/Kconfig | 4 drivers/clk/ralink/clk-mtmips.c | 26 drivers/clk/renesas/rzg2l-cpg.c | 11 drivers/clk/sophgo/clk-sg2042-pll.c | 2 drivers/clk/sunxi-ng/ccu-sun20i-d1.c | 2 drivers/clocksource/Kconfig | 3 drivers/clocksource/timer-ti-dm-systimer.c | 4 drivers/comedi/comedi_fops.c | 12 drivers/counter/stm32-timer-cnt.c | 17 drivers/counter/ti-ecap-capture.c | 7 drivers/cpufreq/amd-pstate.c | 26 drivers/cpufreq/cppc_cpufreq.c | 63 drivers/cpufreq/loongson2_cpufreq.c | 4 drivers/cpufreq/loongson3_cpufreq.c | 7 drivers/cpufreq/mediatek-cpufreq-hw.c | 2 drivers/crypto/bcm/cipher.c | 5 drivers/crypto/caam/caampkc.c | 11 drivers/crypto/caam/qi.c | 2 drivers/crypto/cavium/cpt/cptpf_main.c | 6 drivers/crypto/hisilicon/hpre/hpre_main.c | 35 drivers/crypto/hisilicon/qm.c | 47 drivers/crypto/hisilicon/sec2/sec_main.c | 35 drivers/crypto/hisilicon/zip/zip_main.c | 35 drivers/crypto/inside-secure/safexcel_hash.c | 2 drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c | 2 drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c | 2 drivers/crypto/intel/qat/qat_common/adf_aer.c | 5 drivers/crypto/intel/qat/qat_common/adf_dbgfs.c | 13 drivers/crypto/intel/qat/qat_common/adf_hw_arbiter.c | 4 drivers/crypto/mxs-dcp.c | 20 drivers/dax/pmem/Makefile | 7 drivers/dax/pmem/pmem.c | 10 drivers/dma-buf/Kconfig | 1 drivers/dma-buf/udmabuf.c | 44 drivers/edac/bluefield_edac.c | 2 drivers/edac/fsl_ddr_edac.c | 22 drivers/edac/i10nm_base.c | 1 drivers/edac/igen6_edac.c | 2 drivers/edac/skx_common.c | 57 drivers/edac/skx_common.h | 8 drivers/firmware/arm_scpi.c | 3 drivers/firmware/efi/libstub/efi-stub.c | 2 drivers/firmware/efi/tpm.c | 17 drivers/firmware/google/gsmi.c | 6 drivers/gpio/gpio-exar.c | 10 drivers/gpio/gpio-zevio.c | 6 drivers/gpu/drm/Kconfig | 1 drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 2 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 13 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 8 drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 63 drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 7 drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 18 drivers/gpu/drm/amd/amdkfd/kfd_process.c | 14 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 32 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 3 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 4 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 13 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 15 drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 3 drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 6 drivers/gpu/drm/bridge/analogix/anx7625.c | 2 drivers/gpu/drm/bridge/ite-it6505.c | 2 drivers/gpu/drm/bridge/tc358767.c | 7 drivers/gpu/drm/drm_file.c | 2 drivers/gpu/drm/drm_mm.c | 2 drivers/gpu/drm/etnaviv/etnaviv_drv.c | 10 drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 28 drivers/gpu/drm/fsl-dcu/Kconfig | 1 drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 15 drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h | 3 drivers/gpu/drm/imagination/pvr_ccb.c | 2 drivers/gpu/drm/imagination/pvr_vm.c | 4 drivers/gpu/drm/imx/dcss/dcss-crtc.c | 6 drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c | 6 drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 4 drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_0_msm8998.h | 12 drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h | 14 drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c | 2 drivers/gpu/drm/msm/msm_gpu_devfreq.c | 9 drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 1 drivers/gpu/drm/omapdrm/dss/base.c | 25 drivers/gpu/drm/omapdrm/dss/omapdss.h | 3 drivers/gpu/drm/omapdrm/omap_drv.c | 4 drivers/gpu/drm/omapdrm/omap_gem.c | 10 drivers/gpu/drm/panel/panel-newvision-nv3052c.c | 2 drivers/gpu/drm/panel/panel-novatek-nt35510.c | 15 drivers/gpu/drm/panfrost/panfrost_devfreq.c | 3 drivers/gpu/drm/panfrost/panfrost_gpu.c | 1 drivers/gpu/drm/panthor/panthor_devfreq.c | 29 drivers/gpu/drm/panthor/panthor_device.h | 28 drivers/gpu/drm/panthor/panthor_sched.c | 333 +++ drivers/gpu/drm/radeon/radeon_audio.c | 12 drivers/gpu/drm/v3d/v3d_drv.h | 1 drivers/gpu/drm/v3d/v3d_irq.c | 2 drivers/gpu/drm/v3d/v3d_mmu.c | 31 drivers/gpu/drm/v3d/v3d_sched.c | 46 drivers/gpu/drm/vc4/tests/vc4_mock.c | 12 drivers/gpu/drm/vc4/vc4_bo.c | 28 drivers/gpu/drm/vc4/vc4_crtc.c | 13 drivers/gpu/drm/vc4/vc4_drv.c | 22 drivers/gpu/drm/vc4/vc4_drv.h | 8 drivers/gpu/drm/vc4/vc4_gem.c | 24 drivers/gpu/drm/vc4/vc4_hdmi.c | 22 drivers/gpu/drm/vc4/vc4_hvs.c | 64 drivers/gpu/drm/vc4/vc4_irq.c | 10 drivers/gpu/drm/vc4/vc4_kms.c | 14 drivers/gpu/drm/vc4/vc4_perfmon.c | 20 drivers/gpu/drm/vc4/vc4_plane.c | 12 drivers/gpu/drm/vc4/vc4_render_cl.c | 2 drivers/gpu/drm/vc4/vc4_v3d.c | 10 drivers/gpu/drm/vc4/vc4_validate.c | 8 drivers/gpu/drm/vc4/vc4_validate_shaders.c | 2 drivers/gpu/drm/vkms/vkms_output.c | 5 drivers/gpu/drm/xe/display/xe_hdcp_gsc.c | 2 drivers/gpu/drm/xe/xe_sync.c | 6 drivers/gpu/drm/xlnx/zynqmp_disp.c | 3 drivers/gpu/drm/xlnx/zynqmp_kms.c | 2 drivers/hid/hid-hyperv.c | 58 drivers/hid/wacom_wac.c | 4 drivers/hwmon/aquacomputer_d5next.c | 2 drivers/hwmon/nct6775-core.c | 7 drivers/hwmon/pmbus/pmbus_core.c | 12 drivers/hwmon/tps23861.c | 2 drivers/i2c/i2c-dev.c | 17 drivers/i3c/master.c | 13 drivers/iio/accel/adxl380.c | 2 drivers/iio/adc/ad4000.c | 6 drivers/iio/adc/pac1921.c | 4 drivers/iio/dac/adi-axi-dac.c | 2 drivers/iio/industrialio-backend.c | 4 drivers/iio/industrialio-gts-helper.c | 2 drivers/iio/light/al3010.c | 11 drivers/infiniband/core/roce_gid_mgmt.c | 30 drivers/infiniband/core/uverbs.h | 2 drivers/infiniband/core/uverbs_main.c | 43 drivers/infiniband/hw/bnxt_re/ib_verbs.c | 7 drivers/infiniband/hw/bnxt_re/main.c | 28 drivers/infiniband/hw/bnxt_re/qplib_fp.h | 2 drivers/infiniband/hw/hns/hns_roce_cq.c | 4 drivers/infiniband/hw/hns/hns_roce_debugfs.c | 3 drivers/infiniband/hw/hns/hns_roce_device.h | 14 drivers/infiniband/hw/hns/hns_roce_hem.c | 48 drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 257 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 8 drivers/infiniband/hw/hns/hns_roce_main.c | 7 drivers/infiniband/hw/hns/hns_roce_mr.c | 11 drivers/infiniband/hw/hns/hns_roce_qp.c | 77 drivers/infiniband/hw/hns/hns_roce_srq.c | 4 drivers/infiniband/hw/mlx5/main.c | 69 drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 drivers/infiniband/sw/rxe/rxe_qp.c | 1 drivers/infiniband/sw/rxe/rxe_req.c | 6 drivers/input/misc/cs40l50-vibra.c | 6 drivers/interconnect/qcom/icc-rpmh.c | 3 drivers/iommu/amd/io_pgtable_v2.c | 3 drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 5 drivers/iommu/intel/iommu.c | 40 drivers/iommu/s390-iommu.c | 73 drivers/irqchip/irq-mvebu-sei.c | 2 drivers/irqchip/irq-riscv-aplic-main.c | 3 drivers/irqchip/irq-riscv-aplic-msi.c | 3 drivers/leds/flash/leds-ktd2692.c | 1 drivers/leds/leds-max5970.c | 5 drivers/mailbox/arm_mhuv2.c | 8 drivers/mailbox/mtk-cmdq-mailbox.c | 2 drivers/mailbox/omap-mailbox.c | 1 drivers/media/i2c/adv7604.c | 5 drivers/media/i2c/adv7842.c | 13 drivers/media/i2c/ds90ub960.c | 2 drivers/media/i2c/max96717.c | 6 drivers/media/i2c/vgxy61.c | 2 drivers/media/pci/intel/ipu6/Kconfig | 6 drivers/media/pci/intel/ipu6/ipu6-bus.c | 6 drivers/media/pci/intel/ipu6/ipu6-buttress.c | 34 drivers/media/pci/intel/ipu6/ipu6-cpd.c | 18 drivers/media/pci/intel/ipu6/ipu6-dma.c | 202 +- drivers/media/pci/intel/ipu6/ipu6-dma.h | 34 drivers/media/pci/intel/ipu6/ipu6-fw-com.c | 14 drivers/media/pci/intel/ipu6/ipu6-mmu.c | 28 drivers/media/pci/intel/ipu6/ipu6.c | 3 drivers/media/radio/wl128x/fmdrv_common.c | 3 drivers/media/test-drivers/vivid/vivid-vid-cap.c | 15 drivers/media/v4l2-core/v4l2-dv-timings.c | 132 - drivers/message/fusion/mptsas.c | 4 drivers/mfd/da9052-spi.c | 2 drivers/mfd/intel_soc_pmic_bxtwc.c | 132 - drivers/mfd/rt5033.c | 4 drivers/mfd/tps65010.c | 8 drivers/misc/apds990x.c | 12 drivers/misc/lkdtm/bugs.c | 2 drivers/mmc/host/mmc_spi.c | 9 drivers/mtd/hyperbus/rpc-if.c | 7 drivers/mtd/nand/raw/atmel/pmecc.c | 8 drivers/mtd/nand/raw/atmel/pmecc.h | 2 drivers/mtd/spi-nor/core.c | 2 drivers/mtd/spi-nor/spansion.c | 1 drivers/mtd/ubi/attach.c | 12 drivers/mtd/ubi/fastmap-wl.c | 19 drivers/mtd/ubi/vmt.c | 2 drivers/mtd/ubi/wl.c | 11 drivers/mtd/ubi/wl.h | 3 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 37 drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 9 drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 4 drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.h | 3 drivers/net/ethernet/broadcom/tg3.c | 3 drivers/net/ethernet/google/gve/gve_adminq.c | 4 drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 2 drivers/net/ethernet/intel/ice/ice_virtchnl.c | 21 drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 70 drivers/net/ethernet/marvell/octeontx2/af/cgx.h | 5 drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h | 7 drivers/net/ethernet/marvell/octeontx2/af/rpm.c | 87 drivers/net/ethernet/marvell/octeontx2/af/rpm.h | 18 drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 1 drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 45 drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c | 5 drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 4 drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c | 5 drivers/net/ethernet/marvell/octeontx2/nic/otx2_dmac_flt.c | 9 drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 10 drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c | 10 drivers/net/ethernet/marvell/pxa168_eth.c | 14 drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 12 drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 2 drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c | 17 drivers/net/ethernet/realtek/rtase/rtase.h | 7 drivers/net/ethernet/realtek/rtase/rtase_main.c | 43 drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 2 drivers/net/ethernet/wangxun/txgbe/txgbe_irq.c | 24 drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 1 drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 168 - drivers/net/ethernet/wangxun/txgbe/txgbe_phy.h | 2 drivers/net/ethernet/wangxun/txgbe/txgbe_type.h | 7 drivers/net/mdio/mdio-ipq4019.c | 5 drivers/net/netdevsim/ipsec.c | 11 drivers/net/usb/lan78xx.c | 40 drivers/net/wireless/ath/ath10k/mac.c | 4 drivers/net/wireless/ath/ath11k/qmi.c | 3 drivers/net/wireless/ath/ath12k/dp.c | 19 drivers/net/wireless/ath/ath12k/mac.c | 5 drivers/net/wireless/ath/ath12k/wow.c | 2 drivers/net/wireless/ath/ath9k/htc_hst.c | 3 drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c | 3 drivers/net/wireless/intel/iwlegacy/3945.c | 2 drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 8 drivers/net/wireless/intersil/p54/p54spi.c | 4 drivers/net/wireless/marvell/mwifiex/cmdevt.c | 2 drivers/net/wireless/marvell/mwifiex/fw.h | 2 drivers/net/wireless/marvell/mwifiex/main.c | 4 drivers/net/wireless/marvell/mwifiex/util.c | 2 drivers/net/wireless/microchip/wilc1000/netdev.c | 6 drivers/net/wireless/realtek/rtl8xxxu/core.c | 6 drivers/net/wireless/realtek/rtlwifi/efuse.c | 11 drivers/net/wireless/realtek/rtw89/cam.c | 259 ++ drivers/net/wireless/realtek/rtw89/cam.h | 24 drivers/net/wireless/realtek/rtw89/chan.c | 215 +- drivers/net/wireless/realtek/rtw89/chan.h | 4 drivers/net/wireless/realtek/rtw89/coex.c | 157 + drivers/net/wireless/realtek/rtw89/coex.h | 6 drivers/net/wireless/realtek/rtw89/core.c | 887 ++++++---- drivers/net/wireless/realtek/rtw89/core.h | 421 +++- drivers/net/wireless/realtek/rtw89/debug.c | 127 + drivers/net/wireless/realtek/rtw89/fw.c | 637 ++++--- drivers/net/wireless/realtek/rtw89/fw.h | 192 +- drivers/net/wireless/realtek/rtw89/mac.c | 700 ++++--- drivers/net/wireless/realtek/rtw89/mac.h | 98 - drivers/net/wireless/realtek/rtw89/mac80211.c | 653 +++++-- drivers/net/wireless/realtek/rtw89/mac_be.c | 69 drivers/net/wireless/realtek/rtw89/phy.c | 399 ++-- drivers/net/wireless/realtek/rtw89/phy.h | 7 drivers/net/wireless/realtek/rtw89/ps.c | 109 - drivers/net/wireless/realtek/rtw89/ps.h | 14 drivers/net/wireless/realtek/rtw89/regd.c | 79 drivers/net/wireless/realtek/rtw89/rtw8851b.c | 13 drivers/net/wireless/realtek/rtw89/rtw8852a.c | 12 drivers/net/wireless/realtek/rtw89/rtw8852b.c | 13 drivers/net/wireless/realtek/rtw89/rtw8852bt.c | 13 drivers/net/wireless/realtek/rtw89/rtw8852c.c | 12 drivers/net/wireless/realtek/rtw89/rtw8922a.c | 10 drivers/net/wireless/realtek/rtw89/ser.c | 37 drivers/net/wireless/realtek/rtw89/wow.c | 217 +- drivers/net/wireless/realtek/rtw89/wow.h | 10 drivers/net/wireless/silabs/wfx/main.c | 17 drivers/net/wireless/st/cw1200/cw1200_spi.c | 2 drivers/nvme/host/core.c | 5 drivers/nvme/host/multipath.c | 21 drivers/nvme/host/pci.c | 55 drivers/of/fdt.c | 14 drivers/of/kexec.c | 2 drivers/pci/controller/cadence/pci-j721e.c | 26 drivers/pci/controller/dwc/pcie-qcom-ep.c | 6 drivers/pci/controller/dwc/pcie-qcom.c | 4 drivers/pci/controller/dwc/pcie-tegra194.c | 7 drivers/pci/endpoint/functions/pci-epf-mhi.c | 6 drivers/pci/hotplug/cpqphp_pci.c | 15 drivers/pci/pci.c | 5 drivers/pci/slot.c | 4 drivers/perf/arm-cmn.c | 4 drivers/perf/arm_smmuv3_pmu.c | 19 drivers/phy/phy-airoha-pcie-regs.h | 6 drivers/phy/phy-airoha-pcie.c | 8 drivers/phy/realtek/phy-rtk-usb2.c | 2 drivers/phy/realtek/phy-rtk-usb3.c | 2 drivers/pinctrl/pinctrl-k210.c | 2 drivers/pinctrl/pinctrl-zynqmp.c | 1 drivers/pinctrl/qcom/pinctrl-spmi-gpio.c | 2 drivers/pinctrl/renesas/Kconfig | 1 drivers/pinctrl/renesas/pinctrl-rzg2l.c | 2 drivers/platform/chrome/cros_ec_typec.c | 1 drivers/platform/x86/asus-wmi.c | 64 drivers/platform/x86/intel/bxtwc_tmu.c | 22 drivers/platform/x86/intel/pmt/class.c | 8 drivers/platform/x86/intel/pmt/class.h | 2 drivers/platform/x86/intel/pmt/telemetry.c | 2 drivers/platform/x86/panasonic-laptop.c | 10 drivers/pmdomain/ti/ti_sci_pm_domains.c | 4 drivers/power/reset/Kconfig | 1 drivers/power/sequencing/Kconfig | 1 drivers/power/supply/bq27xxx_battery.c | 37 drivers/power/supply/power_supply_core.c | 2 drivers/power/supply/rt9471.c | 52 drivers/pwm/core.c | 10 drivers/pwm/pwm-imx27.c | 98 + drivers/regulator/qcom_smd-regulator.c | 2 drivers/regulator/rk808-regulator.c | 15 drivers/remoteproc/Kconfig | 6 drivers/remoteproc/qcom_q6v5_adsp.c | 11 drivers/remoteproc/qcom_q6v5_mss.c | 6 drivers/remoteproc/qcom_q6v5_pas.c | 22 drivers/rpmsg/qcom_glink_native.c | 3 drivers/rtc/interface.c | 7 drivers/rtc/rtc-ab-eoz9.c | 7 drivers/rtc/rtc-abx80x.c | 2 drivers/rtc/rtc-rzn1.c | 8 drivers/rtc/rtc-st-lpc.c | 5 drivers/s390/cio/cio.c | 6 drivers/s390/cio/device.c | 18 drivers/s390/virtio/virtio_ccw.c | 4 drivers/scsi/bfa/bfad.c | 3 drivers/scsi/hisi_sas/hisi_sas_main.c | 8 drivers/scsi/qedf/qedf_main.c | 1 drivers/scsi/qedi/qedi_main.c | 1 drivers/scsi/sg.c | 9 drivers/sh/intc/core.c | 2 drivers/soc/fsl/qe/qmc.c | 4 drivers/soc/fsl/rcpm.c | 1 drivers/soc/qcom/qcom-geni-se.c | 3 drivers/soc/ti/smartreflex.c | 4 drivers/soc/xilinx/xlnx_event_manager.c | 4 drivers/spi/atmel-quadspi.c | 2 drivers/spi/spi-fsl-lpspi.c | 12 drivers/spi/spi-tegra210-quad.c | 2 drivers/spi/spi-zynqmp-gqspi.c | 2 drivers/spi/spi.c | 13 drivers/staging/media/atomisp/pci/sh_css_params.c | 2 drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 6 drivers/target/target_core_pscsi.c | 2 drivers/thermal/testing/zone.c | 32 drivers/thermal/thermal_core.c | 123 - drivers/thermal/thermal_core.h | 12 drivers/tty/serial/8250/8250_fintek.c | 14 drivers/tty/serial/8250/8250_omap.c | 4 drivers/tty/serial/amba-pl011.c | 7 drivers/tty/tty_io.c | 2 drivers/usb/dwc3/core.h | 4 drivers/usb/dwc3/ep0.c | 2 drivers/usb/dwc3/gadget.c | 69 drivers/usb/gadget/composite.c | 18 drivers/usb/gadget/function/uvc_video.c | 4 drivers/usb/host/ehci-spear.c | 7 drivers/usb/host/xhci-pci.c | 10 drivers/usb/host/xhci-ring.c | 73 drivers/usb/host/xhci.c | 40 drivers/usb/host/xhci.h | 3 drivers/usb/misc/chaoskey.c | 35 drivers/usb/misc/iowarrior.c | 50 drivers/usb/misc/usb-ljca.c | 20 drivers/usb/misc/yurex.c | 5 drivers/usb/musb/musb_gadget.c | 13 drivers/usb/typec/tcpm/wcove.c | 4 drivers/usb/typec/ucsi/ucsi_ccg.c | 5 drivers/usb/typec/ucsi/ucsi_glink.c | 2 drivers/vdpa/mlx5/core/mr.c | 4 drivers/vfio/pci/mlx5/cmd.c | 6 drivers/vfio/pci/mlx5/main.c | 35 drivers/vfio/pci/vfio_pci_config.c | 16 drivers/video/fbdev/sh7760fb.c | 3 drivers/watchdog/Kconfig | 4 drivers/xen/xenbus/xenbus_probe.c | 8 fs/binfmt_elf.c | 2 fs/binfmt_elf_fdpic.c | 5 fs/binfmt_misc.c | 7 fs/cachefiles/interface.c | 14 fs/cachefiles/ondemand.c | 38 fs/dlm/ast.c | 2 fs/dlm/recoverd.c | 2 fs/efs/super.c | 43 fs/erofs/data.c | 10 fs/erofs/internal.h | 1 fs/erofs/super.c | 6 fs/erofs/zmap.c | 17 fs/exec.c | 23 fs/exfat/file.c | 10 fs/exfat/namei.c | 21 fs/ext4/balloc.c | 4 fs/ext4/ext4.h | 12 fs/ext4/extents.c | 2 fs/ext4/fsmap.c | 54 fs/ext4/ialloc.c | 5 fs/ext4/indirect.c | 2 fs/ext4/inode.c | 4 fs/ext4/mballoc.c | 18 fs/ext4/mballoc.h | 1 fs/ext4/mmp.c | 2 fs/ext4/move_extent.c | 2 fs/ext4/resize.c | 2 fs/ext4/super.c | 42 fs/f2fs/checkpoint.c | 2 fs/f2fs/data.c | 29 fs/f2fs/f2fs.h | 3 fs/f2fs/file.c | 17 fs/f2fs/gc.c | 2 fs/f2fs/node.c | 10 fs/f2fs/segment.c | 5 fs/f2fs/segment.h | 35 fs/f2fs/super.c | 37 fs/fcntl.c | 3 fs/fuse/file.c | 62 fs/fuse/fuse_i.h | 6 fs/fuse/virtio_fs.c | 1 fs/gfs2/glock.c | 19 fs/gfs2/glock.h | 1 fs/gfs2/incore.h | 2 fs/gfs2/rgrp.c | 2 fs/gfs2/super.c | 2 fs/hfsplus/hfsplus_fs.h | 3 fs/hfsplus/wrapper.c | 2 fs/hostfs/hostfs_kern.c | 4 fs/isofs/inode.c | 8 fs/jffs2/erase.c | 7 fs/jfs/xattr.c | 2 fs/netfs/fscache_volume.c | 3 fs/nfs/blocklayout/blocklayout.c | 15 fs/nfs/blocklayout/dev.c | 6 fs/nfs/internal.h | 2 fs/nfs/localio.c | 6 fs/nfs/nfs4proc.c | 8 fs/nfs/write.c | 49 fs/nfs_common/nfslocalio.c | 8 fs/nfsd/export.c | 31 fs/nfsd/export.h | 4 fs/nfsd/filecache.c | 14 fs/nfsd/filecache.h | 2 fs/nfsd/nfs4callback.c | 16 fs/nfsd/nfs4proc.c | 7 fs/nfsd/nfs4recover.c | 3 fs/nfsd/nfs4state.c | 5 fs/nfsd/nfs4xdr.c | 2 fs/nfsd/nfsfh.c | 20 fs/nfsd/nfsfh.h | 3 fs/notify/fsnotify.c | 23 fs/notify/mark.c | 12 fs/ntfs3/file.c | 2 fs/ocfs2/aops.h | 2 fs/ocfs2/file.c | 4 fs/proc/kcore.c | 10 fs/read_write.c | 15 fs/smb/client/cached_dir.c | 229 +- fs/smb/client/cached_dir.h | 6 fs/smb/client/cifsacl.c | 50 fs/smb/client/cifsfs.c | 12 fs/smb/client/cifsglob.h | 4 fs/smb/client/cifsproto.h | 5 fs/smb/client/connect.c | 59 fs/smb/client/fs_context.c | 85 fs/smb/client/fs_context.h | 1 fs/smb/client/inode.c | 8 fs/smb/client/reparse.c | 95 - fs/smb/client/reparse.h | 6 fs/smb/client/smb1ops.c | 4 fs/smb/client/smb2file.c | 21 fs/smb/client/smb2inode.c | 6 fs/smb/client/smb2ops.c | 2 fs/smb/client/smb2pdu.c | 6 fs/smb/client/smb2proto.h | 11 fs/smb/client/smb2transport.c | 56 fs/smb/client/trace.h | 3 fs/smb/server/server.c | 4 fs/ubifs/super.c | 6 fs/ubifs/tnc_commit.c | 2 fs/unicode/utf8-core.c | 2 fs/xfs/xfs_bmap_util.c | 8 include/asm-generic/vmlinux.lds.h | 4 include/kunit/skbuff.h | 2 include/linux/blk-mq.h | 2 include/linux/blkdev.h | 12 include/linux/bpf.h | 9 include/linux/cleanup.h | 4 include/linux/compiler_attributes.h | 13 include/linux/compiler_types.h | 19 include/linux/f2fs_fs.h | 6 include/linux/fs.h | 2 include/linux/hisi_acc_qm.h | 8 include/linux/intel_vsec.h | 3 include/linux/jiffies.h | 2 include/linux/kfifo.h | 1 include/linux/kvm_host.h | 6 include/linux/lockdep.h | 2 include/linux/mmdebug.h | 6 include/linux/netpoll.h | 2 include/linux/nfslocalio.h | 18 include/linux/of_fdt.h | 5 include/linux/once.h | 4 include/linux/once_lite.h | 2 include/linux/rcupdate.h | 2 include/linux/rwlock_rt.h | 10 include/linux/sched/ext.h | 1 include/linux/seqlock.h | 98 - include/linux/spinlock_rt.h | 23 include/media/v4l2-dv-timings.h | 18 include/net/bluetooth/hci.h | 4 include/net/bluetooth/hci_core.h | 63 include/net/net_debug.h | 2 include/rdma/ib_verbs.h | 11 include/uapi/linux/rtnetlink.h | 2 init/Kconfig | 9 init/initramfs.c | 15 io_uring/memmap.c | 11 ipc/namespace.c | 4 kernel/bpf/bpf_struct_ops.c | 114 + kernel/bpf/btf.c | 5 kernel/bpf/dispatcher.c | 3 kernel/bpf/trampoline.c | 9 kernel/bpf/verifier.c | 103 + kernel/cgroup/cgroup.c | 21 kernel/fork.c | 26 kernel/rcu/rcuscale.c | 6 kernel/rcu/srcutiny.c | 2 kernel/rcu/tree.c | 14 kernel/rcu/tree_nocb.h | 13 kernel/sched/cpufreq_schedutil.c | 3 kernel/sched/ext.c | 9 kernel/time/time.c | 4 kernel/time/timer.c | 3 kernel/trace/bpf_trace.c | 5 kernel/trace/trace_event_perf.c | 6 lib/overflow_kunit.c | 2 lib/string_helpers.c | 2 lib/strncpy_from_user.c | 5 mm/internal.h | 2 net/9p/trans_usbg.c | 4 net/9p/trans_xen.c | 9 net/bluetooth/hci_conn.c | 219 +- net/bluetooth/hci_event.c | 39 net/bluetooth/hci_sysfs.c | 15 net/bluetooth/iso.c | 101 - net/bluetooth/mgmt.c | 38 net/bluetooth/rfcomm/sock.c | 10 net/core/filter.c | 88 net/core/netdev-genl.c | 2 net/core/skmsg.c | 4 net/hsr/hsr_device.c | 4 net/ipv4/inet_connection_sock.c | 2 net/ipv4/ipmr.c | 42 net/ipv6/addrconf.c | 41 net/ipv6/ip6_fib.c | 8 net/ipv6/ip6mr.c | 38 net/ipv6/route.c | 51 net/iucv/af_iucv.c | 26 net/l2tp/l2tp_core.c | 22 net/llc/af_llc.c | 2 net/netfilter/ipset/ip_set_bitmap_ip.c | 7 net/netfilter/nf_tables_api.c | 60 net/netlink/af_netlink.c | 21 net/rfkill/rfkill-gpio.c | 8 net/rxrpc/af_rxrpc.c | 7 net/sched/sch_fq.c | 6 net/sunrpc/cache.c | 4 net/sunrpc/svcsock.c | 4 net/sunrpc/xprtrdma/svc_rdma.c | 19 net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 8 net/sunrpc/xprtsock.c | 17 net/wireless/core.c | 64 net/wireless/mlme.c | 6 net/wireless/nl80211.c | 1 net/xdp/xsk.c | 11 rust/helpers/spinlock.c | 8 rust/kernel/block/mq/request.rs | 67 rust/kernel/lib.rs | 2 rust/kernel/rbtree.rs | 9 rust/macros/lib.rs | 2 samples/bpf/xdp_adjust_tail_kern.c | 1 samples/kfifo/dma-example.c | 1 scripts/checkpatch.pl | 37 scripts/faddr2line | 2 scripts/kernel-doc | 47 scripts/mod/file2alias.c | 5 scripts/package/builddeb | 22 security/apparmor/capability.c | 2 security/apparmor/policy_unpack_test.c | 6 sound/core/pcm_native.c | 6 sound/core/rawmidi.c | 4 sound/core/sound_kunit.c | 11 sound/core/ump.c | 5 sound/pci/hda/patch_realtek.c | 153 - sound/soc/amd/acp/acp-sdw-sof-mach.c | 16 sound/soc/amd/yc/acp6x-mach.c | 25 sound/soc/codecs/da7213.c | 1 sound/soc/codecs/da7219.c | 9 sound/soc/codecs/rt722-sdca.c | 8 sound/soc/fsl/fsl-asoc-card.c | 8 sound/soc/fsl/fsl_micfil.c | 4 sound/soc/fsl/imx-audmix.c | 3 sound/soc/mediatek/mt8188/mt8188-mt6359.c | 9 sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c | 4 sound/soc/mediatek/mt8195/mt8195-mt6359.c | 9 sound/usb/6fire/chip.c | 10 sound/usb/caiaq/audio.c | 10 sound/usb/caiaq/audio.h | 1 sound/usb/caiaq/device.c | 19 sound/usb/caiaq/input.c | 12 sound/usb/caiaq/input.h | 1 sound/usb/clock.c | 24 sound/usb/quirks.c | 27 sound/usb/usx2y/us122l.c | 5 sound/usb/usx2y/usbusx2y.c | 2 tools/bpf/bpftool/jit_disasm.c | 40 tools/gpio/gpio-sloppy-logic-analyzer.sh | 2 tools/include/nolibc/arch-s390.h | 1 tools/lib/bpf/Makefile | 3 tools/lib/bpf/libbpf.c | 99 - tools/lib/bpf/linker.c | 2 tools/lib/thermal/commands.c | 52 tools/perf/Makefile.config | 2 tools/perf/builtin-ftrace.c | 2 tools/perf/builtin-list.c | 4 tools/perf/builtin-stat.c | 52 tools/perf/builtin-trace.c | 23 tools/perf/pmu-events/empty-pmu-events.c | 2 tools/perf/pmu-events/jevents.py | 2 tools/perf/tests/attr/test-stat-default | 90 - tools/perf/tests/attr/test-stat-detailed-1 | 106 - tools/perf/tests/attr/test-stat-detailed-2 | 130 - tools/perf/tests/attr/test-stat-detailed-3 | 138 + tools/perf/util/bpf-filter.c | 2 tools/perf/util/cs-etm.c | 25 tools/perf/util/disasm.c | 15 tools/perf/util/evlist.c | 19 tools/perf/util/evlist.h | 1 tools/perf/util/machine.c | 2 tools/perf/util/mem-events.c | 8 tools/perf/util/pfm.c | 4 tools/perf/util/pmus.c | 2 tools/perf/util/probe-finder.c | 21 tools/perf/util/probe-finder.h | 4 tools/power/x86/turbostat/turbostat.c | 5 tools/testing/selftests/arm64/abi/hwcap.c | 6 tools/testing/selftests/arm64/mte/check_tags_inclusion.c | 4 tools/testing/selftests/arm64/mte/mte_common_util.c | 4 tools/testing/selftests/bpf/Makefile | 3 tools/testing/selftests/bpf/network_helpers.h | 1 tools/testing/selftests/bpf/prog_tests/timer_lockup.c | 6 tools/testing/selftests/bpf/progs/test_spin_lock_fail.c | 4 tools/testing/selftests/bpf/progs/test_tp_btf_nullable.c | 6 tools/testing/selftests/bpf/test_progs.c | 9 tools/testing/selftests/bpf/test_sockmap.c | 165 + tools/testing/selftests/bpf/uprobe_multi.c | 4 tools/testing/selftests/mount_setattr/mount_setattr_test.c | 2 tools/testing/selftests/net/Makefile | 1 tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh | 262 ++ tools/testing/selftests/net/netfilter/conntrack_dump_flush.c | 6 tools/testing/selftests/net/pmtu.sh | 2 tools/testing/selftests/resctrl/fill_buf.c | 2 tools/testing/selftests/resctrl/mbm_test.c | 16 tools/testing/selftests/resctrl/resctrl_val.c | 3 tools/testing/selftests/vDSO/parse_vdso.c | 3 tools/testing/selftests/wireguard/netns.sh | 1 tools/tracing/rtla/src/timerlat_hist.c | 2 tools/tracing/rtla/src/timerlat_top.c | 2 virt/kvm/kvm_main.c | 103 - 896 files changed, 13140 insertions(+), 6525 deletions(-) Abel Vesa (3): arm64: dts: qcom: x1e80100-slim7x: Drop orientation-switch from USB SS[0-1] QMP PHYs arm64: dts: qcom: x1e80100-vivobook-s15: Drop orientation-switch from USB SS[0-1] QMP PHYs dt-bindings: cache: qcom,llcc: Fix X1E80100 reg entries Adrian Hunter (1): perf/x86/intel/pt: Fix buffer full but size is 0 case Adrián Larumbe (4): drm/panfrost: Add missing OPP table refcnt decremental drm/panthor: introduce job cycle and timestamp accounting drm/panthor: record current and maximum device clock frequencies drm/panthor: Fix OPP refcnt leaks in devfreq initialisation Ahmed Ehab (1): locking/lockdep: Avoid creating new name string literals in lockdep_set_subclass() Ahsan Atta (1): crypto: qat - remove faulty arbiter config reset Alan Maguire (1): selftests/bpf: Fix uprobe_multi compilation error Aleksa Savic (1): hwmon: (aquacomputer_d5next) Fix length of speed_input array Aleksandr Mishin (1): acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block() Aleksei Vetrov (1): wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan Alex Zenla (2): 9p/xen: fix init sequence 9p/xen: fix release of IRQ Alexander Aring (2): dlm: fix swapped args sb_flags vs sb_status dlm: fix dlm_recover_members refcount on error Alexis Lothoré (eBPF Foundation) (1): selftests/bpf: add missing header include for htons Alper Nebi Yasak (2): arm64: dts: mediatek: mt8183-kukui: Disable DPI display interface wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() Amir Goldstein (1): fsnotify: fix sending inotify event with unexpected filename Andre Przywara (5): kselftest/arm64: hwcap: fix f8dp2 cpuinfo name kselftest/arm64: mte: fix printf type warnings about __u64 kselftest/arm64: mte: fix printf type warnings about longs ARM: dts: cubieboard4: Fix DCDC5 regulator constraints clk: sunxi-ng: d1: Fix PLL_AUDIO0 preset Andreas Gruenbacher (3): gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE gfs2: Allow immediate GLF_VERIFY_DELETE work gfs2: Fix unlinked inode cleanup Andreas Kemnade (1): ARM: dts: omap36xx: declare 1GHz OPP as turbo again Andrei Simion (1): ARM: dts: microchip: sam9x60: Add missing property atmel,usart-mode Andrej Shadura (1): Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}() Andrii Nakryiko (4): libbpf: fix sym_is_subprog() logic for weak global subprogs libbpf: never interpret subprogs in .text as entry programs selftests/bpf: fix test_spin_lock_fail.c's global vars usage libbpf: move global data mmap()'ing into bpf_object__load() André Almeida (1): unicode: Fix utf8_load() error path Andy Shevchenko (11): regmap: irq: Set lockdep class for hierarchical IRQ domains drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices mfd: intel_soc_pmic_bxtwc: Fix IRQ domain names duplication cpufreq: loongson3: Check for error code from devm_mutex_init() call gpio: zevio: Add missed label initialisation iio: adc: ad4000: Check for error code from devm_mutex_init() call iio: adc: pac1921: Check for error code from devm_mutex_init() call x86/Documentation: Update algo in init_size description of boot protocol Angelo Dureghello (2): iio: dac: adi-axi-dac: fix wrong register bitfield dt-bindings: iio: dac: ad3552r: fix maximum spi speed Antonio Quartulli (1): m68k: coldfire/device.c: only build FEC when HW macros are defined Antoniu Miclaus (1): iio: accel: adxl380: fix raw sample read Anurag Dutta (3): arm64: dts: ti: k3-j7200: Fix clock ids for MCSPI instances arm64: dts: ti: k3-j721e: Fix clock IDs for MCSPI instances arm64: dts: ti: k3-j721s2: Fix clock IDs for MCSPI instances Ard Biesheuvel (1): x86/pvh: Call C code via the kernel virtual mapping Armin Wolf (1): platform/x86: asus-wmi: Fix inconsistent use of thermal policies Arnaldo Carvalho de Melo (1): perf ftrace latency: Fix unit on histogram first entry when using --use-nsec Arnd Bergmann (5): wifi: ath12k: fix one more memcpy size error mailbox, remoteproc: k3-m4+: fix compile testing power: reset: ep93xx: add AUXILIARY_BUS dependency KVM: x86: add back X86_LOCAL_APIC dependency serial: amba-pl011: fix build regression Artem Sadovnikov (1): jfs: xattr: check invalid xattr size more strictly Aurabindo Pillai (1): drm/amd/display: fix a memleak issue when driver is removed Avihai Horon (1): vfio/pci: Properly hide first-in-list PCIe extended capability Balaji Pothunoori (1): wifi: ath11k: Fix CE offset address calculation for WCN6750 in SSR Baochen Qiang (2): wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss1 wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss2 Baolin Liu (1): scsi: target: Fix incorrect function name in pscsi_create_type_disk() Barnabás Czémán (1): power: supply: bq27xxx: Fix registers of bq27426 Bart Van Assche (3): scsi: sg: Enable runtime power management power: supply: core: Remove might_sleep() from power_supply_put() blk-mq: Make blk_mq_quiesce_tagset() hold the tag list mutex less long Bartosz Golaszewski (4): mmc: mmc_spi: drop buggy snprintf() power: sequencing: make the QCom PMU pwrseq driver depend on CONFIG_OF pinctrl: zynqmp: drop excess struct member description lib: string_helpers: silence snprintf() output truncation warning Baruch Siach (1): doc: rcu: update printed dynticks counter bits Benjamin Coddington (3): SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT nfs/blocklayout: Don't attempt unregister for invalid block device nfs/blocklayout: Limit repeat device registration on failure Benjamin Peterson (3): perf trace: avoid garbage when not printing a trace event's arguments perf trace: Do not lose last events in a race perf trace: Avoid garbage when not printing a syscall's arguments Benoît Sevens (1): ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices Biju Das (3): pinctrl: renesas: rzg2l: Fix missing return in rzg2l_pinctrl_register() mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE clk: renesas: rzg2l: Fix FOUTPOSTDIV clk Bill O'Donnell (1): efs: fix the efs new mount api implementation Bin Liu (1): serial: 8250: omap: Move pm_runtime_get_sync Bingbu Cao (2): media: ipu6: not override the dma_ops of device in driver media: ipu6: remove architecture DMA ops dependency in Kconfig Björn Töpel (3): libbpf: Add missing per-arch include path selftests: bpf: Add missing per-arch include path riscv: kvm: Fix out-of-bounds array access Borislav Petkov (AMD) (2): x86/mm: Carve out INVLPG inline asm for use by others x86/microcode/AMD: Flush patch buffer mapping after application Breno Leitao (3): spi: tegra210-quad: Avoid shift-out-of-bounds netpoll: Use rcu_access_pointer() in netpoll_poll_lock nvme/multipath: Fix RCU list traversal to use SRCU primitive Cabiddu, Giovanni (1): crypto: qat - remove check after debugfs_create_dir() Carl Vanderlip (1): bus: mhi: host: Switch trace_mhi_gen_tre fields to native endian Carlos Llamas (1): Revert "scripts/faddr2line: Check only two symbols when calculating symbol size" Chao Yu (6): f2fs: fix to account dirty data in __get_secs_required() f2fs: fix to avoid potential deadlock in f2fs_record_stop_reason() f2fs: fix to map blocks correctly for direct write f2fs: fix to avoid forcing direct write to use buffered IO on inline_data inode f2fs: fix to do cast in F2FS_{BLK_TO_BYTES, BTYES_TO_BLK} to avoid overflow f2fs: fix to do sanity check on node blkaddr in truncate_node() Charles Han (4): clk: clk-apple-nco: Add NULL check in applnco_probe phy: realtek: usb: fix NULL deref in rtk_usb2phy_probe phy: realtek: usb: fix NULL deref in rtk_usb3phy_probe ASoC: imx-audmix: Add NULL check in imx_audmix_probe Chen Ridong (4): crypto: caam - add error check to caam_rsa_set_priv_key_form crypto: bcm - add error check in the ahash_hmac_init function Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline" cgroup/bpf: only cgroup v2 can be attached by bpf programs Chen Yufan (1): drm/imagination: Convert to use time_before macro Chen-Yu Tsai (5): scripts/kernel-doc: Do not track section counter across processed files arm64: dts: mediatek: mt8173-elm-hana: Add vdd-supply to second source trackpad arm64: dts: mediatek: mt8183-kukui-jacuzzi: Fix DP bridge supply names arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add supplies for fixed regulators arm64: dts: mediatek: mt8186-corsola-voltorb: Merge speaker codec nodes Cheng Ming Lin (1): mtd: spi-nor: core: replace dummy buswidth from addr to data Chengchang Tang (2): RDMA/core: Provide rdma_user_mmap_disassociate() to disassociate mmap pages RDMA/hns: Disassociate mmap pages for all uctx when HW is being reset ChiYuan Huang (2): power: supply: rt9471: Fix wrong WDT function regfield declaration power: supply: rt9471: Use IC status regfield to report real charger status Chiara Meiohas (3): RDMA/mlx5: Call dev_put() after the blocking notifier RDMA/core: Implement RoCE GID port rescan and export delete function RDMA/mlx5: Ensure active slave attachment to the bond IB device Chris Lu (1): Bluetooth: btmtk: adjust the position to init iso data anchor Chris Morgan (1): arm64: dts: rockchip: correct analog audio name on Indiedroid Nova Christian Brauner (2): fcntl: make F_DUPFD_QUERY associative Revert "fs: don't block i_writecount during exec" Christian Loehle (1): sched/cpufreq: Ensure sd is rebuilt for EAS check Christoph Hellwig (7): nvme-pci: fix freeing of the HMB descriptor table block: take chunk_sectors into account in bio_split_write_zeroes block: fix bio_split_rw_at to take zone_write_granularity into account nvme-pci: reverse request order in nvme_queue_rqs virtio_blk: reverse request order in virtio_queue_rqs kfifo: don't include dma-mapping.h in kfifo.h block: return unsigned int from bdev_io_min Christophe JAILLET (4): crypto: caam - Fix the pointer passed to caam_qi_shutdown() crypto: cavium - Fix an error handling path in cpt_ucode_load_fw() media: i2c: vgxy61: Fix an error handling path in vgxy61_detect() iio: light: al3010: Fix an error handling path in al3010_probe() Christophe Leroy (1): powerpc/vdso: Flag VDSO64 entry points as functions Chuck Lever (5): svcrdma: Address an integer overflow NFSD: Prevent NULL dereference in nfsd4_process_cb_update() NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir() NFSD: Fix nfsd4_shutdown_copy() NFSD: Prevent a potential integer overflow Chun-Tse Shao (1): perf/arm-smmuv3: Fix lockdep assert in ->event_init() Clark Wang (1): pwm: imx27: Workaround of the pwm output bug when decrease the duty cycle Claudiu Beznea (2): ASoC: da7213: Populate max_register to regmap_config serial: sh-sci: Clean sci_ports[0] after at earlycon exit Colin Ian King (1): media: i2c: ds90ub960: Fix missing return check on ub960_rxport_read call Csókás, Bence (1): spi: atmel-quadspi: Fix register name in verbose logging function Damien Le Moal (1): block: Prevent potential deadlock in blk_revalidate_disk_zones() Dan Carpenter (10): crypto: qat/qat_420xx - fix off by one in uof_get_name() crypto: qat/qat_4xxx - fix off by one in uof_get_name() soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() media: i2c: max96717: clean up on error in max96717_subdev_init() wifi: rtw89: unlock on error path in rtw89_ops_unassign_vif_chanctx() kunit: skb: use "gfp" variable instead of hardcoding GFP_KERNEL mailbox: arm_mhuv2: clean up loop in get_irq_chan_comb() usb: typec: fix potential array underflow in ucsi_ccg_sync_control() cifs: unlock on error in smb3_reconfigure() sh: intc: Fix use-after-free bug in register_intc_controller() Daniel Lezcano (2): tools/lib/thermal: Make more generic the command encoding function thermal/lib: Fix memory leak on error in thermal_genl_auto() Daniel Palmer (2): m68k: mvme147: Fix SCSI controller IRQ numbers m68k: mvme147: Reinstate early console Daolong Zhu (4): arm64: dts: mt8183: fennel: add i2c2's i2c-scl-internal-delay-ns arm64: dts: mt8183: burnet: add i2c2's i2c-scl-internal-delay-ns arm64: dts: mt8183: cozmo: add i2c2's i2c-scl-internal-delay-ns arm64: dts: mt8183: Damu: add i2c2's i2c-scl-internal-delay-ns Darrick J. Wong (2): MAINTAINERS: appoint myself the XFS maintainer for 6.12 LTS xfs: fix simplify extent lookup in xfs_can_free_eofblocks Dave Stevenson (7): drm/vc4: hvs: Don't write gamma luts on 2711 drm/vc4: hvs: Fix dlist debug not resetting the next entry pointer drm/vc4: hvs: Remove incorrect limit from hvs_dlist debugfs function drm/vc4: hvs: Correct logic on stopping an HVS channel drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_lut_load drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_atomic_flush drm/vc4: Correct generation check in vc4_hvs_lut_load David Disseldorp (1): initramfs: avoid filename buffer overrun David Laight (1): x86: fix off-by-one in access_ok() David Lechner (1): iio: adc: ad4000: fix reading unsigned data David Thompson (1): EDAC/bluefield: Fix potential integer overflow Dinesh Kumar (1): ALSA: hda/realtek: Fix Internal Speaker and Mic boost of Infinix Y4 Max Dipendra Khadka (6): octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c Dirk Su (1): ALSA: hda/realtek: fix mute/micmute LEDs don't work for EliteBook X G1i Dmitry Antipov (2): Bluetooth: fix use-after-free in device_for_each_child() ocfs2: fix uninitialized value in ocfs2_file_read_iter() Dmitry Baryshkov (7): arm64: dts: qcom: qcs6390-rb3gen2: use modem.mbn for modem DSP arm64: dts: qcom: sda660-ifc6560: fix l10a voltage ranges drm/msm/dpu: on SDM845 move DSPP_3 to LM_5 block drm/msm/dpu: drop LM_3 / LM_4 on SDM845 drm/msm/dpu: drop LM_3 / LM_4 on MSM8998 remoteproc: qcom: pas: add minidump_id to SM8350 resources usb: typec: ucsi: glink: fix off-by-one in connector_status Dom Cobley (2): drm/vc4: hdmi: Avoid hang with debug registers when suspended drm/vc4: hdmi: Increase audio MAI fifo dreq threshold Dong Aisheng (1): clk: imx: clk-scu: fix clk enable state save and restore Dragan Simic (1): regulator: rk808: Restrict DVS GPIOs to the RK808 variant only Eder Zulian (1): rust: helpers: Avoid raw_spin_lock initialization for PREEMPT_RT Eduard Zingerman (1): selftests/bpf: Fix backtrace printing for selftests crashes Edward Adam Davis (1): USB: chaoskey: Fix possible deadlock chaoskey_list_lock Emmanuel Grumbach (2): wifi: iwlwifi: allow fast resume on ax200 wifi: iwlwifi: mvm: tell iwlmei when we finished suspending Eric Biggers (1): crypto: x86/aegis128 - access 32-bit arguments as 32-bit Eric Dumazet (1): net: hsr: fix hsr_init_sk() vs network/transport headers. Everest K.C (2): crypto: cavium - Fix the if condition to exit loop after timeout ASoC: rt722-sdca: Remove logically deadcode in rt722-sdca.c Fangzhi Zuo (3): drm/amd/display: Skip Invalid Streams from DSC Policy drm/amd/display: Fix incorrect DSC recompute trigger drm/amd/display: Reduce HPD Detection Interval for IPS Fei Shao (3): arm64: dts: mediatek: mt8188: Fix USB3 PHY port default status arm64: dts: mediatek: mt8195-cherry: Use correct audio codec DAI dt-bindings: PCI: mediatek-gen3: Allow exact number of clocks only Felix Maurer (1): xsk: Free skb when TX metadata options are invalid Feng Fang (1): RDMA/hns: Fix different dgids mapping to the same dip_idx Filip Brozovic (1): serial: 8250_fintek: Add support for F81216E Florian Westphal (3): netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion netfilter: nf_tables: must hold rcu read lock while iterating expression type list netfilter: nf_tables: must hold rcu read lock while iterating object type list Francesco Zardi (1): rust: block: fix formatting of `kernel::block::mq::request` module Frank Li (2): arm64: dts: imx8mn-tqma8mqnl-mba8mx-usbot: fix coexistence of output-low and output-high in GPIO i3c: master: Remove i3c_dev_disable_ibi_locked(olddev) on device hotjoin Gao Xiang (2): erofs: fix file-backed mounts over FUSE erofs: handle NONHEAD !delta[1] lclusters gracefully Gaosheng Cui (2): drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend() firmware_loader: Fix possible resource leak in fw_log_firmware_info() Gautam Menghani (3): KVM: PPC: Book3S HV: Stop using vc->dpdes for nested KVM guests KVM: PPC: Book3S HV: Avoid returning to nested hypervisor on pending doorbells powerpc/pseries: Fix KVM guest detection for disabling hardlockup detector Gautham R. Shenoy (1): amd-pstate: Set min_perf to nominal_perf for active mode performance gov Geert Uytterhoeven (2): ASoC: fsl-asoc-card: Add missing handling of {hp,mic}-dt-gpios zram: ZRAM_DEF_COMP should depend on ZRAM Gerd Bayer (1): s390/facilities: Fix warning about shadow of global variable Greg Kroah-Hartman (2): Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit" Linux 6.12.2 Gregory Price (1): tpm: fix signed/unsigned bug when checking event logs Guenter Roeck (1): net: microchip: vcap: Add typegroup table terminators in kunit tests Guilherme G. Piccoli (1): wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures Gustavo A. R. Silva (2): clk: clk-loongson2: Fix memory corruption bug in struct loongson2_clk_provider clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access Halil Pasic (1): s390/virtio_ccw: Fix dma_parm pointer not set up Hangbin Liu (3): netdevsim: copy addresses for both in and out paths wireguard: selftests: load nf_conntrack if not present net/ipv6: delete temporary address if mngtmpaddr is removed or unmanaged Hans Verkuil (1): media: v4l2-core: v4l2-dv-timings: check cvt/gtf result Hao Ge (2): isofs: avoid memory leak in iocharset perf bpf-filter: Return -ENOMEM directly when pfi allocation fails Hari Bathini (1): powerpc/fadump: allocate memory for additional parameters early Hariprasad Kelam (5): octeontx2-af: RPM: Fix mismatch in lmac type octeontx2-af: RPM: Fix low network performance octeontx2-af: RPM: fix stale RSFEC counters octeontx2-af: RPM: fix stale FCFEC counters octeontx2-af: Quiesce traffic before NIX block reset Harshit Mogalapalli (1): dax: delete a stale directory pmem Heiko Carstens (1): s390/pageattr: Implement missing kernel_page_present() Heiko Stuebner (1): arm64: dts: rockchip: Remove 'enable-active-low' from two boards Henrique Carvalho (1): smb: client: disable directory caching when dir_cache_timeout is zero Herve Codina (1): soc: fsl: cpm1: qmc: Set the ret error code on platform_get_irq() failure Hongzhen Luo (1): erofs: fix blksize < PAGE_SIZE for file-backed mounts Hou Tao (1): virtiofs: use pages instead of pointer for kernel direct IO Howard Chu (1): perf trace: Fix tracing itself, creating feedback loops Hsin-Te Yuan (2): arm64: dts: mt8183: krane: Fix the address of eeprom at i2c4 arm64: dts: mt8183: kukui: Fix the address of eeprom at i2c4 Huacai Chen (2): LoongArch: Explicitly specify code model in Makefile sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK Huan Yang (2): udmabuf: change folios array from kmalloc to kvmalloc udmabuf: fix vmap_udmabuf error page set Hubert Wiśniewski (1): usb: musb: Fix hardware lockup on first Rx endpoint request Ian Rogers (3): perf stat: Fix affinity memory leaks on error path perf disasm: Fix capstone memory leak perf probe: Fix libdw memory leak Igor Prusov (1): dt-bindings: vendor-prefixes: Add NeoFidelity, Inc Igor Pylypiv (1): i2c: dev: Fix memory leak when underlying adapter does not support I2C Ilpo Järvinen (1): PCI: cpqphp: Fix PCIBIOS_* return value confusion Ilya Zverev (1): ASoC: amd: yc: Add a quirk for microfone on Lenovo ThinkPad P14s Gen 5 21MES00B00 Iulia Tanasescu (3): Bluetooth: ISO: Do not emit LE PA Create Sync if previous is pending Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending Bluetooth: ISO: Send BIG Create Sync via hci_sync Jacob Keller (1): ice: consistently use q_idx in ice_vc_cfg_qs_msg() Jaegeuk Kim (1): Revert "f2fs: remove unreachable lazytime mount option parsing" Jakub Kicinski (3): eth: fbnic: don't disable the PCI device twice netlink: fix false positive warning in extack during dumps net_sched: sch_fq: don't follow the fast path if Tx is behind now James Chapman (1): net/l2tp: fix warning in l2tp_exit_net found by syzbot James Clark (1): perf cs-etm: Don't flush when packet_queue fills up Jan Hendrik Farr (1): Compiler Attributes: disable __counted_by for clang < 19.1.3 Jan Kara (1): ext4: avoid remount errors with 'abort' mount option Jann Horn (2): fsnotify: Fix ordering of iput() and watched_objects decrement comedi: Flush partial mappings in error case Jared McArthur (1): arm64: dts: ti: k3-j7200: Fix register map for main domain pmx Jason Gerecke (1): HID: wacom: Interpret tilt data from Intuos Pro BT as signed values Javier Carrasco (9): clocksource/drivers/timer-ti-dm: Fix child node refcount handling Bluetooth: btbcm: fix missing of_node_put() in btbcm_get_board_name() leds: max5970: Fix unreleased fwnode_handle in probe function wifi: brcmfmac: release 'root' node in all execution paths platform/chrome: cros_ec_typec: fix missing fwnode reference decrement mtd: ubi: fix unreleased fwnode_handle in find_volume_fwnode() soc: fsl: rcpm: fix missing of_node_put() in copy_ippdexpcr1_setting() staging: vchiq_arm: Fix missing refcount decrement in error path for fw_node counter: stm32-timer-cnt: fix device_node handling in probe_encoder() Jean-Michel Hautbois (1): m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x Jean-Philippe Romain (1): perf list: Fix topic and pmu_name argument order Jeff Layton (1): nfsd: drop inode parameter from nfsd4_change_attribute() Jeongjun Park (4): wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read() ext4: supress data-race warnings in ext4_free_inodes_{count,set}() netfilter: ipset: add missing range check in bitmap_ip_uadt Jerome Brunet (1): hwmon: (pmbus/core) clear faults after setting smbalert mask Jesse Taube (2): RISC-V: Scalar unaligned access emulated on hotplug CPUs RISC-V: Check scalar unaligned access on all CPUs Jiasheng Jiang (2): counter: stm32-timer-cnt: Add check for clk_enable() counter: ti-ecap-capture: Add check for clk_enable() Jiawen Wu (2): net: txgbe: remove GPIO interrupt controller net: txgbe: fix null pointer to pcs Jiayuan Chen (1): bpf: fix recursive lock when verdict program return SK_PASS Jie Zhan (1): cppc_cpufreq: Use desired perf if feedback ctrs are 0 or unchanged Jing Zhang (1): KVM: arm64: vgic-its: Add a data length check in vgic_its_save_* Jinjie Ruan (17): spi: spi-fsl-lpspi: Use IRQF_NO_AUTOEN flag in request_irq() soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq() spi: zynqmp-gqspi: Undo runtime PM changes at driver exit time wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq() wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq() drm/imx/dcss: Use IRQF_NO_AUTOEN flag in request_irq() drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq() drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq() mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw() cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost() cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_cost() cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_power() misc: apds990x: Fix missing pm_runtime_disable() apparmor: test: Fix memory leak for aa_unpack_strdup() cpufreq: mediatek-hw: Fix wrong return value in mtk_cpufreq_get_cpu_power() rtc: st-lpc: Use IRQF_NO_AUTOEN flag in request_irq() Jiri Olsa (2): bpf: Allow return values 0 and 1 for kprobe session bpf: Force uprobe bpf program to always return 0 Joe Damato (1): netdev-genl: Hold rcu_read_lock in napi_get Joe Hattori (2): remoteproc: qcom: pas: Remove subdevs on the error path of adsp_probe() remoteproc: qcom: adsp: Remove subdevs on the error path of adsp_probe() Johan Hovold (1): pinctrl: qcom: spmi: fix debugfs drive strength John Garry (3): block/fs: Pass an iocb to generic_atomic_write_valid() fs/block: Check for IOCB_DIRECT in generic_atomic_write_valid() block: Don't allow an atomic write be truncated in blkdev_write_iter() Jonas Gorski (1): mips: asm: fix warning when disabling MIPS_FP_SUPPORT Jonathan Gray (1): drm: use ATOMIC64_INIT() for atomic64_t Jonathan Marek (3): efi/libstub: fix efi_parse_options() ignoring the default command line clk: qcom: videocc-sm8550: depend on either gcc-sm8550 or gcc-sm8650 rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length Jose Ignacio Tornos Martinez (2): wifi: ath12k: fix warning when unbinding wifi: ath12k: fix crash when unbinding Josh Poimboeuf (1): parisc/ftrace: Fix function graph tracing disablement José Expósito (1): drm/vkms: Drop unnecessary call to drm_crtc_cleanup() Junxian Huang (3): RDMA/hns: Use dev_* printings in hem code instead of ibdev_* RDMA/hns: Fix out-of-order issue of requester when setting FENCE RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg() Justin Lai (3): rtase: Refactor the rtase_check_mac_version_valid() function rtase: Correct the speed for RTL907XD-V1 rtase: Corrects error handling of the rtase_check_mac_version_valid() Kailang Yang (4): ALSA: hda/realtek: Update ALC256 depop procedure ALSA: hda/realtek: Update ALC225 depop procedure ALSA: hda/realtek: Enable speaker pins for Medion E15443 platform ALSA: hda/realtek: Set PCBeep to default value for ALC274 Kajol Jain (1): KVM: PPC: Book3S HV: Fix kmv -> kvm typo Kalesh AP (1): RDMA/bnxt_re: Correct the sequence of device suspend Kalle Valo (1): Revert "wifi: iwlegacy: do not skip frames with bad FCS" Kan Liang (1): perf jevents: Don't stop at the first matched pmu when searching a events table Karol Wachowski (1): accel/ivpu: Prevent recovery invocation during probe and resume Karthikeyan Periyasamy (1): wifi: cfg80211: check radio iface combination for multi radio per wiphy Kartik Rajput (1): serial: amba-pl011: Fix RX stall when DMA is used Kashyap Desai (1): RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey Keita Morisaki (1): devres: Fix page faults when tracing devres from unloaded modules Kiran K (2): Bluetooth: btintel_pcie: Add handshake between driver and firmware Bluetooth: btintel: Do no pass vendor events to stack Kirill A. Shutemov (3): x86/tdx: Introduce wrappers to read and write TD metadata x86/tdx: Rename tdx_parse_tdinfo() to tdx_setup() x86/tdx: Dynamically disable SEPT violations from causing #VEs Konrad Dybcio (2): arm64: dts: qcom: x1e80100: Update C4/C5 residency/exit numbers arm64: dts: qcom: sc8180x: Add a SoC-specific compatible to cpufreq-hw Konstantin Komarov (1): fs/ntfs3: Equivalent transition from page to folio Kristina Martsenko (1): arm64: probes: Disable kprobes/uprobes on MOPS instructions Krzysztof Kozlowski (1): dt-bindings: pinctrl: samsung: Fix interrupt constraint for variants with fallbacks Kuangyi Chiang (4): xhci: Fix control transfer error on Etron xHCI host xhci: Combine two if statements for Etron xHCI host xhci: Don't perform Soft Retry for Etron xHCI host xhci: Don't issue Reset Device command to Etron xHCI host Kumar Kartikeya Dwivedi (2): bpf: Tighten tail call checks for lingering locks, RCU, preempt_disable bpf: Mark raw_tp arguments with PTR_MAYBE_NULL Kuniyuki Iwashima (1): tcp: Fix use-after-free of nreq in reqsk_timer_handler(). Kunkun Jiang (2): KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device Lad Prabhakar (2): arm64: dts: renesas: hihope: Drop #sound-dai-cells pinctrl: renesas: Select PINCTRL_RZG2L for RZ/V2H(P) SoC Leo Yan (1): perf probe: Correct demangled symbols in C++ program Leon Hwang (1): bpf, bpftool: Fix incorrect disasm pc Levi Yun (2): trace/trace_event_perf: remove duplicate samples on the first tracepoint event perf stat: Close cork_fd when create_perf_stat_counter() failed Li Huafei (6): crypto: inside-secure - Fix the return value of safexcel_xcbcmac_cra_init() media: atomisp: Add check for rgby_data memory allocation failure drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new() drm/amdgpu: Fix the memory allocation issue in amdgpu_discovery_get_nps_info() perf disasm: Use disasm_line__free() to properly free disasm_line perf disasm: Fix not cleaning up disasm_line in symbol__disassemble_raw() Li Lingfeng (1): nfs: ignore SB_RDONLY when mounting nfs Li Wang (1): loop: fix type of block size Lifeng Zheng (1): ACPI: CPPC: Fix _CPC register setting issue Lijo Lazar (2): drm/amdgpu: Fix JPEG v4.0.3 register write drm/amdgpu: Fix map/unmap queue logic Lingbo Kong (1): wifi: cfg80211: Remove the Medium Synchronization Delay validity check Linus Walleij (2): drm/panel: nt35510: Make new commands optional wifi: cw1200: Fix potential NULL dereference Liu Jian (3): RDMA/rxe: Set queue pair cur_qp_state when being queried sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket Liu Shixin (1): zram: fix NULL pointer in comp_algorithm_show() Long Li (2): ext4: fix race in buffer_head read fault injection f2fs: fix race in concurrent f2fs_stop_gc_thread LongPing Wei (1): f2fs: fix the wrong f2fs_bug_on condition in f2fs_do_replace_block Lorenzo Bianconi (8): clk: en7523: remove REG_PCIE*_{MEM,MEM_MASK} configuration clk: en7523: move clock_register in hw_init callback clk: en7523: introduce chip_scu regmap clk: en7523: fix estimation of fixed rate for EN7581 phy: airoha: Fix REG_CSR_2L_PLL_CMN_RESERVE0 config in airoha_pcie_phy_init_clk_out() phy: airoha: Fix REG_PCIE_PMA_TX_RESET config in airoha_pcie_phy_init_csr_2l() phy: airoha: Fix REG_CSR_2L_JCPLL_SDM_HREN config in airoha_pcie_phy_init_ssc_jcpll() phy: airoha: Fix REG_CSR_2L_RX{0,1}_REV0 definitions Luca Weiss (1): arm64: dts: qcom: sm6350: Fix GPU frequencies missing on some speedbins Lucas Stach (1): drm/etnaviv: hold GPU lock across perfmon sampling Luiz Augusto von Dentz (3): Bluetooth: ISO: Use kref to track lifetime of iso_conn Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync Bluetooth: MGMT: Fix possible deadlocks Lukas Bulwahn (1): clk: mediatek: drop two dead config options Lukas Wunner (1): PCI: Fix use-after-free of slot->bus on hot remove Lukasz Luba (1): drm/msm/gpu: Check the status of registration to PM QoS Luo Qiu (1): firmware: arm_scpi: Check the DVFS OPP count returned by the firmware Ma Wupeng (1): ipc: fix memleak if msg_init_ns failed in create_ipc_ns Macpaul Lin (5): arm64: dts: mediatek: mt8395-genio-1200-evk: Fix dtbs_check error for phy arm64: dts: mt8195: Fix dtbs_check error for mutex node arm64: dts: mt8195: Fix dtbs_check error for infracfg_ao node arm64: dts: mediatek: mt6358: fix dtbs_check error ASoC: dt-bindings: mt6359: Update generic node name and dmic-mode Manivannan Sadhasivam (3): PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert() PCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert() Marc Zyngier (2): arm64: Expose ID_AA64ISAR1_EL1.XS to sanitised feature consumers KVM: arm64: vgic-v3: Sanitise guest writes to GICR_INVLPIR Marco Elver (2): kcsan, seqlock: Support seqcount_latch_t kcsan, seqlock: Fix incorrect assumption in read_seqbegin() Marcus Folkesson (1): mfd: da9052-spi: Change read-mask to write-mask Marek Vasut (1): wifi: wilc1000: Set MAC after operation mode Mario Limonciello (1): cpufreq/amd-pstate: Don't update CPPC request in amd_pstate_cpu_boost_update() Mark Brown (2): kselftest/arm64: Fix encoding for SVE B16B16 test clocksource/drivers:sp804: Make user selectable Martin Kaistra (1): wifi: rtl8xxxu: Perform update_beacon_work when beaconing is enabled Masahiro Yamada (5): arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG s390/syscalls: Avoid creation of arch/arch/ directory Rename .data.unlikely to .data..unlikely Rename .data.once to .data..once to fix resetting WARN*_ONCE modpost: remove incorrect code in do_eisa_entry() Matt Coster (1): drm/imagination: Use pvr_vm_context_get() Matt Fleming (1): kbuild: deb-pkg: Don't fail if modules.order is missing Matthew Rosato (1): iommu/s390: Implement blocking domain Matthias Schiffer (1): drm: fsl-dcu: enable PIXCLK on LS1021A Maurice Lambert (1): netlink: typographical error in nlmsg_type constants definition Mauro Carvalho Chehab (2): MAINTAINERS: update location of media main tree docs: media: update location of the media patches Maxime Chevallier (2): net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken rtc: ab-eoz9: don't fail temperature reads on undervoltage notification Maxime Ripard (1): drm/vc4: Introduce generation number enum Maíra Canal (2): drm/v3d: Address race-condition in MMU flush drm/v3d: Flush the MMU before we supply more memory to the binner Meetakshi Setiya (1): cifs: support mounting with alternate password to allow password rotation Michael Chan (2): bnxt_en: Refactor bnxt_ptp_init() bnxt_en: Unregister PTP during PCI shutdown and suspend Michael Ellerman (2): powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore selftests/mount_setattr: Fix failures on 64K PAGE_SIZE kernels Michael Grzeschik (1): usb: gadget: uvc: wake pump everytime we update the free list Michael J. Ruhl (1): platform/x86/intel/pmt: allow user offset for PMT callbacks Michael Petlan (1): perf trace: Keep exited threads for summary Michal Luczaj (2): llc: Improve setsockopt() handling of malformed user input rxrpc: Improve setsockopt() handling of malformed user input Michal Pecio (3): usb: xhci: Limit Stop Endpoint retries usb: xhci: Fix TD invalidation under pending Set TR Dequeue usb: xhci: Avoid queuing redundant Stop Endpoint commands Michal Schmidt (1): rcu/srcutiny: don't return before reenabling preemption Michal Simek (2): microblaze: Export xmb_manager functions dt-bindings: serial: rs485: Fix rs485-rts-delay property Michal Suchanek (1): powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static Michal Vrastil (1): Revert "usb: gadget: composite: fix OS descriptors w_value logic" Miguel Ojeda (4): time: Partially revert cleanup on msecs_to_jiffies() documentation time: Fix references to _msecs_to_jiffies() handling of values drm/panic: Select ZLIB_DEFLATE for DRM_PANIC_SCREEN_QR_CODE rust: rbtree: fix `SAFETY` comments that should be `# Safety` sections Mike Snitzer (1): nfs_common: must not hold RCU while calling nfsd_file_put_local Mikulas Patocka (1): blk-settings: round down io_opt to physical_block_size Min-Hua Chen (1): regulator: qcom-smd: make smd_vreg_rpm static Ming Lei (6): ublk: fix ublk_ch_mmap() for 64K page size ublk: fix error code for unsupported command blk-mq: add non_owner variant of start_freeze/unfreeze queue APIs block: model freeze & enter queue as lock for supporting lockdep block: always verify unfreeze lock on the owner task block: don't verify IO lock for freeze/unfreeze in elevator_init_mq() Mingwei Zheng (1): net: rfkill: gpio: Add check for clk_enable() Miquel Raynal (1): mtd: rawnand: atmel: Fix possible memory leak Mirsad Todorovac (2): fs/proc/kcore.c: fix coccinelle reported ERROR instances net/9p/usbg: fix handling of the failed kzalloc() memory allocation Muchun Song (3): block: fix missing dispatching request when queue is started or unquiesced block: fix ordering between checking QUEUE_FLAG_QUIESCED request adding block: fix ordering between checking BLK_MQ_S_STOPPED request adding Murad Masimov (1): hwmon: (tps23861) Fix reporting of negative temperatures Namhyung Kim (1): perf/arm-cmn: Ensure port and device id bits are set properly Namjae Jeon (1): exfat: fix uninit-value in __exfat_get_dentry_set Nathan Morrisson (1): arm64: dts: ti: k3-am62x-phyboard-lyra: Drop unnecessary McASP AFIFOs NeilBrown (1): nfs/localio: must clear res.replen in nfs_local_read_done Nicolas Bouchinet (1): tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler Nicolin Chen (2): iommu/tegra241-cmdqv: Staticize cmdqv_debugfs_dir iommu/tegra241-cmdqv: Fix alignment failure at max_n_shift Niklas Schnelle (2): watchdog: Add HAS_IOPORT dependency for SBC8360 and SBC7240 s390/pci: Fix potential double remove of hotplug slot Nilay Shroff (1): nvme-fabrics: fix kernel crash while shutting down controller Nirmoy Das (1): drm/xe/ufence: Wake up waiters after setting ufence->signalled Nobuhiro Iwamatsu (1): rtc: abx80x: Fix WDT bit position of the status register Nuno Sa (2): dt-bindings: clock: axi-clkgen: include AXI clk clk: clk-axi-clkgen: make sure to enable the AXI bus clock Nícolas F. R. A. Prado (1): ASoC: mediatek: Check num_codecs is not zero to avoid panic during probe Oleksij Rempel (3): net: usb: lan78xx: Fix double free issue with interrupt buffer allocation net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration Oliver Neukum (2): usb: yurex: make waiting on yurex_write interruptible USB: chaoskey: fail open after removal Oliver Upton (1): KVM: arm64: Don't retire aborted MMIO instruction Omid Ehtemam-Haghighi (1): ipv6: Fix soft lockups in fib6_select_path under high next hop churn Orange Kao (1): EDAC/igen6: Avoid segmentation fault on module unload Pablo Sun (1): arm64: dts: mediatek: mt8188: Fix wrong clock provider in MFG1 power domain Pali Rohár (2): cifs: Fix parsing native symlinks relative to the export cifs: Fix parsing reparse point with native symlink in SMB1 non-UNICODE session Paolo Abeni (4): ipv6: release nexthop on device removal selftests: net: really check for bg process completion ip6mr: fix tables suspicious RCU usage ipmr: fix tables suspicious RCU usage Paolo Bonzini (2): rust: macros: fix documentation of the paste! macro KVM: x86: switch hugepage recovery thread to vhost_task Patrisious Haddad (1): RDMA/mlx5: Move events notifier registration to be after device registration Patryk Wlazlyn (1): tools/power turbostat: Fix child's argument forwarding Paul Aurich (5): smb: cached directories can be more than root file handle smb: Don't leak cfid when reconnect races with open_cached_dir smb: prevent use-after-free due to open_cached_dir error paths smb: During unmount, ensure all cached dir instances drop their dentry smb: Initialize cfid->tcon before performing network ops Paulo Alcantara (3): smb: client: fix NULL ptr deref in crypto_aead_setkey() smb: client: fix use-after-free of signing key smb: client: handle max length for SMB symlinks Pavan Chebbi (1): tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets Pavel Begunkov (2): io_uring: fix corner case forgetting to vunmap io_uring: check for overflows in io_pin_pages Pei Xiao (2): hwmon: (nct6775-core) Fix overflows seen when writing limit attributes wifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg() Peng Fan (3): clk: imx: lpcg-scu: SW workaround for errata (e10858) clk: imx: fracn-gppll: correct PLL initialization flow clk: imx: fracn-gppll: fix pll power up Peter Große (1): i40e: Fix handling changed priv flags Pin-yen Lin (3): arm64: dts: mt8183: Add port node to dpi node drm/bridge: anx7625: Drop EDID cache on bridge power off drm/bridge: it6505: Drop EDID cache on bridge power off Po-Hao Huang (1): wifi: rtw89: Fix TX fail with A2DP after scanning Priyanka Singh (1): EDAC/fsl_ddr: Fix bad bit shift operations Qi Han (1): f2fs: compress: fix inconsistent update of i_blocks in release_compress_blocks and reserve_compress_blocks Qingfang Deng (1): jffs2: fix use of uninitialized variable Qiu-ji Chen (3): xen: Fix the issue of resource not being properly released in xenbus_dev_probe() ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata() media: wl128x: Fix atomicity violation in fmc_send_cmd() Qiuxu Zhuo (2): EDAC/skx_common: Differentiate memory error sources EDAC/{skx_common,i10nm}: Fix incorrect far-memory error source indicator Rafael J. Wysocki (7): thermal: core: Initialize thermal zones before registering them thermal: core: Rearrange PM notification code thermal: core: Represent suspend-related thermal zone flags as bits thermal: core: Mark thermal zones as initializing to start with thermal: core: Fix race between zone registration and system suspend thermal: testing: Use DEFINE_FREE() and __free() to simplify code thermal: testing: Initialize some variables annoteded with _free() Raghavendra Rao Ananta (2): KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status KVM: arm64: Get rid of userspace_irqchip_in_use Ralph Boehme (1): fs/smb/client: implement chmod() for SMB3 POSIX Extensions Rameshkumar Sundaram (1): wifi: ath12k: fix use-after-free in ath12k_dp_cc_cleanup() Ramya Gnanasekar (1): wifi: ath12k: Skip Rx TID cleanup for self peer Randy Dunlap (2): kernel-doc: allow object-like macros in ReST output fs_parser: update mount_api doc to match function signature Raviteja Laggyshetty (1): interconnect: qcom: icc-rpmh: probe defer incase of missing QoS clock dependency Raymond Hackley (1): leds: ktd2692: Set missing timing properties Reinette Chatre (3): selftests/resctrl: Print accurate buffer size as part of MBM results selftests/resctrl: Fix memory overflow due to unhandled wraparound selftests/resctrl: Protect against array overrun during iMC config parsing Ritesh Harjani (IBM) (3): powerpc/fadump: Refactor and prepare fadump_cma_init for late init powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init() powerpc/mm/fault: Fix kfence page fault reporting Roman Li (1): drm/amd/display: Increase idle worker HPD detection time Rosen Penev (1): net: mdio-ipq4019: add missing error check Russell King (Oracle) (1): irqchip/irq-mvebu-sei: Move misplaced select() callback to SEI CP domain Ryan Walklin (1): drm: panel: nv3052c: correct spi_device_id for RG35XX panel Sabyrzhan Tasbolatov (1): kasan: move checks to do_strncpy_from_user Sai Kumar Cholleti (1): gpio: exar: set value when external pull-up or pull-down is present Sakari Ailus (1): media: ipu6: Fix DMA and physical address debugging messages for 32-bit Samuel Holland (1): irqchip/riscv-aplic: Prevent crash when MSI domain is missing Saravanan Vajravel (1): bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down Sascha Hauer (1): wifi: mwifiex: add missing locking for cfg80211 calls Sean Anderson (1): drm: zynqmp_kms: Unplug DRM device before removal Sean Christopherson (3): KVM: x86/mmu: Skip the "try unsync" path iff the old SPTE was a leaf SPTE KVM: x86: Break CONFIG_KVM_X86's direct dependency on KVM_INTEL || KVM_AMD Revert "KVM: VMX: Move LOAD_IA32_PERF_GLOBAL_CTRL errata handling out of setup_vmcs_config()" Sebastian Andrzej Siewior (2): locking/rt: Add sparse annotation PREEMPT_RT's sleeping locks. x86/CPU/AMD: Terminate the erratum_1386_microcode array Selvarasu Ganesan (1): usb: dwc3: gadget: Add missing check for single port RAM in TxFIFO resizing logic Sergey Senozhatsky (1): zram: permit only one post-processing operation at a time Sergio Paracuellos (2): clk: ralink: mtmips: fix clock plan for Ralink SoC RT3883 clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs Shengjiu Wang (1): ASoC: fsl_micfil: fix regmap_write_bits usage Shravya KN (2): bnxt_en: Set backplane link modes correctly for ethtool bnxt_en: Fix receive ring space parameters when XDP is active Shyam Prasad N (1): cifs: during remount, make sure passwords are in sync Si-Wei Liu (1): vdpa/mlx5: Fix suboptimal range on iotlb iteration Sibi Sankar (2): arm64: dts: qcom: x1e80100: Resize GIC Redistributor register region remoteproc: qcom_q6v5_mss: Re-order writes to the IMEM region Siddharth Vadapalli (1): PCI: j721e: Deassert PERST# after a delay of PCIE_T_PVPERL_MS milliseconds Sidraya Jayagond (1): s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() Somnath Kotur (1): bnxt_en: Fix queue start to update vnic RSS table Sourabh Jain (1): fadump: reserve param area if below boot_mem_top Srikar Dronamraju (1): gpio: sloppy-logic-analyzer remove reference to rcu_momentary_dyntick_idle() Srinivasan Shanmugam (2): drm/amdgpu/gfx9: Add Cleaner Shader Deinitialization in gfx_v9_0 Module drm/amdkfd: Use dynamic allocation for CU occupancy array in 'kfd_get_cu_occupancy()' Stafford Horne (1): openrisc: Implement fixmap to fix earlycon Stanislaw Gruszka (4): spi: Fix acpi deferred irq probe media: intel/ipu6: do not handle interrupts when device is disabled usb: misc: ljca: set small runtime autosuspend delay usb: misc: ljca: move usb_autopm_put_interface() after wait for response Steffen Dirkwinkel (1): drm: xlnx: zynqmp_disp: layer may be null while releasing Stephen Boyd (1): clk: Allow kunit tests to run without OF_OVERLAY enabled Steve French (1): smb3: request handle caching when caching directories Steven 'Steve' Kendall (1): drm/radeon: Fix spurious unplug event on radeon HDMI Steven Price (1): drm/panfrost: Remove unused id_mask from struct panfrost_model Suraj Kandpal (1): drm/xe/hdcp: Fix gsc structure check in fw check status Takahiro Kuwano (1): mtd: spi-nor: spansion: Use nor->addr_nbytes in octal DTR mode in RD_ANY_REG_OP Takashi Iwai (9): ALSA: usx2y: Use snd_card_free_when_closed() at disconnection ALSA: us122l: Use snd_card_free_when_closed() at disconnection ALSA: caiaq: Use snd_card_free_when_closed() at disconnection ALSA: 6fire: Release resources at card release ALSA: usb-audio: Fix out of bounds reads when finding clock sources ALSA: rawmidi: Fix kvfree() call in spinlock ALSA: ump: Fix evaluation of MIDI 1.0 FB info ALSA: pcm: Add sanity NULL check for the default mmap fault handler ALSA: hda/realtek: Apply quirk for Medion E15433 Tamir Duberstein (1): checkpatch: always parse orig_commit in fixes tag Tao Chen (1): libbpf: Fix expected_attach_type set handling in program load callback Tejun Heo (1): sched_ext: scx_bpf_dispatch_from_dsq_set_*() are allowed from unlocked context Thadeu Lima de Souza Cascardo (1): hfsplus: don't query the device logical block size multiple times Theodore Ts'o (1): ext4: fix FS_IOC_GETFSMAP handling Thinh Nguyen (3): usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED usb: dwc3: gadget: Fix checking for number of TRBs left usb: dwc3: gadget: Fix looping of queued SG entries Thomas Falcon (1): perf mem: Fix printing PERF_MEM_LVLNUM_{L2_MHB|MSC} Thomas Gleixner (2): timers: Add missing READ_ONCE() in __run_timer_base() sched/ext: Remove sched_fork() hack Thomas Richter (1): s390/cpum_sf: Fix and protect memory allocation of SDBs with mutex Thomas Weißschuh (1): tools/nolibc: s390: include std.h Tiezhu Yang (2): LoongArch: Fix build failure with GCC 15 (-std=gnu23) LoongArch: BPF: Sign-extend return values Tiwei Bie (7): um: ubd: Do not use drvdata in release um: net: Do not use drvdata in release um: vector: Do not use drvdata in release um: Fix potential integer overflow during physmem setup um: Fix the return value of elf_core_copy_task_fpregs um: ubd: Initialize ubd's disk pointer in ubd_add um: Always dump trace for specified task in show_stack Todd Kjos (1): PCI: Fix reset_method_store() memory leak Tomas Glozar (1): rtla/timerlat: Do not set params->user_workload with -U Tomas Paukrt (1): crypto: mxs-dcp - Fix AES-CBC with hardware-bound keys Tomasz Maciej Nowak (1): arm64: tegra: p2180: Add mandatory compatible for WiFi node Tomi Valkeinen (3): drm/omap: Fix possible NULL dereference drm/omap: Fix locking in omap_gem_new_dmabuf() drm/bridge: tc358767: Fix link properties discovery Tony Ambardar (1): libbpf: Fix output .symtab byte-order during linking Trond Myklebust (2): NFSv4.0: Fix a use-after-free problem in the asynchronous open() Revert "nfs: don't reuse partially completed requests in nfs_lock_and_join_requests" Tvrtko Ursulin (1): drm/v3d: Appease lockdep while updating GPU stats Uladzislau Rezki (Sony) (2): rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu rcuscale: Do a proper cleanup if kfree_scale_init() fails Uros Bizjak (3): cleanup: Remove address space of returned pointer locking/atomic/x86: Use ALT_OUTPUT_SP() for __alternative_atomic64() locking/atomic/x86: Use ALT_OUTPUT_SP() for __arch_{,try_}cmpxchg64_emu() Usama Arif (1): of/fdt: add dt_phys arg to early_init_dt_scan and early_init_dt_verify Uwe Kleine-König (1): pwm: Assume a disabled PWM to emit a constant inactive output Vasant Hegde (1): iommu/amd/pgtbl_v2: Take protection domain lock before invalidating TLB Venkata Prasad Potturu (1): ASoC: amd: yc: Fix for enabling DMIC on acp6x via _DSD entry Veronika Molnarova (2): perf test attr: Add back missing topdown events perf dso: Fix symtab_type for kmod compression Vijendar Mukunda (2): ASoC: amd: acp: fix for inconsistent indenting ASoC: amd: acp: fix for cpu dai index logic Viktor Malik (1): selftests/bpf: skip the timer_lockup test for single-CPU nodes Vineeth Vijayan (1): s390/cio: Do not unregister the subchannel based on DNV Vitalii Mordan (2): marvell: pxa168_eth: fix call balance of pep->clk handling routines usb: ehci-spear: fix call balance of sehci clk handling routines Vitaly Kuznetsov (1): HID: hyperv: streamline driver probe to avoid devres issues Wang Hai (1): crypto: qat - Fix missing destroy_workqueue in adf_init_aer() Waqar Hameed (1): ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit Weili Qian (1): crypto: hisilicon/qm - disable same error report before resetting Will Deacon (1): arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled Wolfram Sang (2): ARM: dts: renesas: genmai: Fix partition size for QSPI NOR Flash rtc: rzn1: fix BCD to rtc_time conversion errors Xiaolei Wang (1): drm/etnaviv: Request pages from DMA32 zone on addressing_limited Xiuhong Wang (1): f2fs: fix fiemap failure issue when page size is 16KB Xu Kuohai (3): bpf, arm64: Remove garbage frame for struct_ops trampoline bpf: Use function pointers count as struct_ops links count bpf: Add kernel symbol for struct_ops trampoline Yang Erkun (3): brd: defer automatic disk creation until module initialization succeeds nfsd: release svc_expkey/svc_export with rcu_work SUNRPC: make sure cache entry active before cache_show Yang Wang (1): drm/amdgpu: fix ACA bank count boundary check error Yang Yingliang (3): clk: imx: imx8-acm: Fix return value check in clk_imx_acm_attach_pm_domains() mailbox: mtk-cmdq: fix wrong use of sizeof in cmdq_get_clocks() iio: backend: fix wrong pointer passed to IS_ERR() Yao Zi (1): platform/x86: panasonic-laptop: Return errno correctly in show callback Ye Bin (3): scsi: bfa: Fix use-after-free in bfad_im_module_exit() f2fs: fix null-ptr-deref in f2fs_submit_page_bio() svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() Yi Yang (1): crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY Yicong Yang (1): perf build: Add missing cflags when building with custom libtraceevent Yihang Li (1): scsi: hisi_sas: Enable all PHYs that are not disabled by user during controller reset Yishai Hadas (2): vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() vfio/mlx5: Fix unwind flows in mlx5vf_pci_save/resume_device_data() Yong-Xuan Wang (1): RISC-V: KVM: Fix APLIC in_clrip and clripnum write emulation Yongliang Gao (1): rtc: check if __rtc_read_time was successful in rtc_timer_do_work() Yongpeng Yang (1): f2fs: check curseg->inited before write_sum_page in change_curseg Yu Kuai (2): block: fix uaf for flush rq while iterating tags block, bfq: fix bfqq uaf in bfq_limit_depth() Yuan Can (5): firmware: google: Unregister driver_info on failure wifi: wfx: Fix error handling in wfx_core_init() drm/amdkfd: Fix wrong usage of INIT_WORK() cpufreq: loongson2: Unregister platform_driver on failure Input: cs40l50 - fix wrong usage of INIT_WORK() Yuan Chen (1): bpf: Fix the xdp_adjust_tail sample prog issue Yuezhang Mo (2): exfat: fix file being changed by unaligned direct write exfat: fix out-of-bounds access of directory entries Yunseong Kim (1): ksmbd: fix use-after-free in SMB request handling Yutaro Ohno (1): rust: kernel: fix THIS_MODULE header path in ThisModule doc comment Yuyu Li (1): RDMA/hns: Modify debugfs name Zach Wade (1): Revert "block, bfq: merge bfq_release_process_ref() into bfq_put_cooperator()" Zeng Heng (2): scsi: fusion: Remove unused variable 'rc' f2fs: Fix not used variable 'index' Zhang Changzhong (1): mfd: rt5033: Fix missing regmap_del_irq_chip() Zhang Rui (1): tools/power turbostat: Fix trailing '\n' parsing Zhang Xianwei (1): brd: decrease the number of allocated pages which discarded Zhang Zekun (2): pmdomain: ti-sci: Add missing of_node_put() for args.np powerpc/kexec: Fix return of uninitialized variable ZhangPeng (1): hostfs: Fix the NULL vs IS_ERR() bug for __filemap_get_folio() Zhen Lei (3): scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() Zheng Yejian (1): x86/unwind/orc: Fix unwind for newly forked tasks Zhenzhong Duan (2): iommu/vt-d: Fix checks and print in dmar_fault_dump_ptes() iommu/vt-d: Fix checks and print in pgtable_walk() Zhiguo Niu (1): f2fs: fix to avoid use GC_AT when setting gc_mode as GC_URGENT_LOW or GC_URGENT_MID Zhihao Cheng (4): ubi: wl: Put source PEB into correct list if trying locking LEB failed ubi: fastmap: wl: Schedule fm_work if wear-leveling pool is empty ubifs: Correct the total block count by deducting journal reservation ubi: fastmap: Fix duplicate slab cache names while attaching Zhongqiu Han (1): PCI: endpoint: epf-mhi: Avoid NULL dereference if DT lacks 'mmio' Zhu Yanjun (1): RDMA/rxe: Fix the qp flush warnings in req Zichen Xie (3): drm/msm/dpu: cast crtc_clk calculation to u64 in _dpu_core_perf_calc_clk() clk: sophgo: avoid integer overflow in sg2042_pll_recalc_rate() ALSA: core: Fix possible NULL dereference caused by kunit_kzalloc() Zicheng Qu (3): drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe drm/amd/display: Fix null check for pipe_ctx->plane_state in hwss_setup_dpp iio: gts: Fix uninitialized symbol 'ret' Zijian Zhang (9): selftests/bpf: Fix msg_verify_data in test_sockmap selftests/bpf: Fix txmsg_redir of test_txmsg_pull in test_sockmap selftests/bpf: Add txmsg_pass to pull/push/pop in test_sockmap selftests/bpf: Fix SENDPAGE data logic in test_sockmap selftests/bpf: Fix total_bytes in msg_loop_rx in test_sockmap selftests/bpf: Add push/pop checking for msg_verify_data in test_sockmap bpf, sockmap: Several fixes to bpf_msg_push_data bpf, sockmap: Several fixes to bpf_msg_pop_data bpf, sockmap: Fix sk_msg_reset_curr Ziwei Xiao (1): gve: Flow steering trigger reset only for timeout error Zizhi Wo (4): cachefiles: Fix incorrect length return value in cachefiles_ondemand_fd_write_iter() cachefiles: Fix missing pos updates in cachefiles_ondemand_fd_write_iter() cachefiles: Fix NULL pointer dereference in object->file netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING Zong-Zhe Yang (7): wifi: rtw89: rename rtw89_vif to rtw89_vif_link ahead for MLO wifi: rtw89: rename rtw89_sta to rtw89_sta_link ahead for MLO wifi: rtw89: read bss_conf corresponding to the link wifi: rtw89: read link_sta corresponding to the link wifi: rtw89: refactor VIF related func ahead for MLO wifi: rtw89: refactor STA related func ahead for MLO wifi: rtw89: tweak driver architecture for impending MLO support Zqiang (1): rcu/nocb: Fix missed RCU barrier on deoffloading chao liu (1): apparmor: fix 'Do simple duplicate message elimination' guanjing (1): selftests: netfilter: Fix missing return values in conntrack_dump_flush wenglianfa (3): RDMA/hns: Fix an AEQE overflow error caused by untimely update of eq_db_ci RDMA/hns: Fix flush cqe error when racing with destroy qp RDMA/hns: Fix cpu stuck caused by printings during reset zhang jiao (1): pinctrl: k210: Undef K210_PC_DEFAULT

4 months, 3 weeks

3
5
0 0

[merged mm-hotfixes-stable] sched-numa-fix-memory-leak-due-to-the-overwritten-vma-numab_state.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: sched/numa: fix memory leak due to the overwritten vma->numab_state has been removed from the -mm tree. Its filename was sched-numa-fix-memory-leak-due-to-the-overwritten-vma-numab_state.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Adrian Huang <ahuang12(a)lenovo.com> Subject: sched/numa: fix memory leak due to the overwritten vma->numab_state Date: Wed, 13 Nov 2024 18:21:46 +0800 [Problem Description] When running the hackbench program of LTP, the following memory leak is reported by kmemleak. # /opt/ltp/testcases/bin/hackbench 20 thread 1000 Running with 20*40 (== 800) tasks. # dmesg | grep kmemleak ... kmemleak: 480 new suspected memory leaks (see /sys/kernel/debug/kmemleak) kmemleak: 665 new suspected memory leaks (see /sys/kernel/debug/kmemleak) # cat /sys/kernel/debug/kmemleak unreferenced object 0xffff888cd8ca2c40 (size 64): comm "hackbench", pid 17142, jiffies 4299780315 hex dump (first 32 bytes): ac 74 49 00 01 00 00 00 4c 84 49 00 01 00 00 00 .tI.....L.I..... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc bff18fd4): [<ffffffff81419a89>] __kmalloc_cache_noprof+0x2f9/0x3f0 [<ffffffff8113f715>] task_numa_work+0x725/0xa00 [<ffffffff8110f878>] task_work_run+0x58/0x90 [<ffffffff81ddd9f8>] syscall_exit_to_user_mode+0x1c8/0x1e0 [<ffffffff81dd78d5>] do_syscall_64+0x85/0x150 [<ffffffff81e0012b>] entry_SYSCALL_64_after_hwframe+0x76/0x7e ... This issue can be consistently reproduced on three different servers: * a 448-core server * a 256-core server * a 192-core server [Root Cause] Since multiple threads are created by the hackbench program (along with the command argument 'thread'), a shared vma might be accessed by two or more cores simultaneously. When two or more cores observe that vma->numab_state is NULL at the same time, vma->numab_state will be overwritten. Although current code ensures that only one thread scans the VMAs in a single 'numa_scan_period', there might be a chance for another thread to enter in the next 'numa_scan_period' while we have not gotten till numab_state allocation [1]. Note that the command `/opt/ltp/testcases/bin/hackbench 50 process 1000` cannot the reproduce the issue. It is verified with 200+ test runs. [Solution] Use the cmpxchg atomic operation to ensure that only one thread executes the vma->numab_state assignment. [1] https://lore.kernel.org/lkml/1794be3c-358c-4cdc-a43d-a1f841d91ef7@amd.com/ Link: https://lkml.kernel.org/r/20241113102146.2384-1-ahuang12@lenovo.com Fixes: ef6a22b70f6d ("sched/numa: apply the scan delay to every new vma") Signed-off-by: Adrian Huang <ahuang12(a)lenovo.com> Reported-by: Jiwei Sun <sunjw10(a)lenovo.com> Reviewed-by: Raghavendra K T <raghavendra.kt(a)amd.com> Reviewed-by: Vlastimil Babka <vbabka(a)suse.cz> Cc: Ben Segall <bsegall(a)google.com> Cc: Dietmar Eggemann <dietmar.eggemann(a)arm.com> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Juri Lelli <juri.lelli(a)redhat.com> Cc: Mel Gorman <mgorman(a)suse.de> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Steven Rostedt <rostedt(a)goodmis.org> Cc: Valentin Schneider <vschneid(a)redhat.com> Cc: Vincent Guittot <vincent.guittot(a)linaro.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- kernel/sched/fair.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) --- a/kernel/sched/fair.c~sched-numa-fix-memory-leak-due-to-the-overwritten-vma-numab_state +++ a/kernel/sched/fair.c @@ -3399,10 +3399,16 @@ retry_pids: /* Initialise new per-VMA NUMAB state. */ if (!vma->numab_state) { - vma->numab_state = kzalloc(sizeof(struct vma_numab_state), - GFP_KERNEL); - if (!vma->numab_state) + struct vma_numab_state *ptr; + + ptr = kzalloc(sizeof(*ptr), GFP_KERNEL); + if (!ptr) + continue; + + if (cmpxchg(&vma->numab_state, NULL, ptr)) { + kfree(ptr); continue; + } vma->numab_state->start_scan_seq = mm->numa_scan_seq; _ Patches currently in -mm which might be from ahuang12(a)lenovo.com are

4 months, 3 weeks

1
0
0 0

[merged mm-hotfixes-stable] mm-damon-fix-order-of-arguments-in-damos_before_apply-tracepoint.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm/damon: fix order of arguments in damos_before_apply tracepoint has been removed from the -mm tree. Its filename was mm-damon-fix-order-of-arguments-in-damos_before_apply-tracepoint.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Akinobu Mita <akinobu.mita(a)gmail.com> Subject: mm/damon: fix order of arguments in damos_before_apply tracepoint Date: Fri, 15 Nov 2024 10:20:23 -0800 Since the order of the scheme_idx and target_idx arguments in TP_ARGS is reversed, they are stored in the trace record in reverse. Link: https://lkml.kernel.org/r/20241115182023.43118-1-sj@kernel.org Link: https://patch.msgid.link/20241112154828.40307-1-akinobu.mita@gmail.com Fixes: c603c630b509 ("mm/damon/core: add a tracepoint for damos apply target regions") Signed-off-by: Akinobu Mita <akinobu.mita(a)gmail.com> Signed-off-by: SeongJae Park <sj(a)kernel.org> Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Steven Rostedt <rostedt(a)goodmis.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/trace/events/damon.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/include/trace/events/damon.h~mm-damon-fix-order-of-arguments-in-damos_before_apply-tracepoint +++ a/include/trace/events/damon.h @@ -15,7 +15,7 @@ TRACE_EVENT_CONDITION(damos_before_apply unsigned int target_idx, struct damon_region *r, unsigned int nr_regions, bool do_trace), - TP_ARGS(context_idx, target_idx, scheme_idx, r, nr_regions, do_trace), + TP_ARGS(context_idx, scheme_idx, target_idx, r, nr_regions, do_trace), TP_CONDITION(do_trace), _ Patches currently in -mm which might be from akinobu.mita(a)gmail.com are

4 months, 3 weeks

1
0
0 0

[merged mm-hotfixes-stable] lib-stackinit-hide-never-taken-branch-from-compiler.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: lib: stackinit: hide never-taken branch from compiler has been removed from the -mm tree. Its filename was lib-stackinit-hide-never-taken-branch-from-compiler.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Kees Cook <kees(a)kernel.org> Subject: lib: stackinit: hide never-taken branch from compiler Date: Sun, 17 Nov 2024 03:38:13 -0800 The never-taken branch leads to an invalid bounds condition, which is by design. To avoid the unwanted warning from the compiler, hide the variable from the optimizer. ../lib/stackinit_kunit.c: In function 'do_nothing_u16_zero': ../lib/stackinit_kunit.c:51:49: error: array subscript 1 is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Werror=array-bounds=] 51 | #define DO_NOTHING_RETURN_SCALAR(ptr) *(ptr) | ^~~~~~ ../lib/stackinit_kunit.c:219:24: note: in expansion of macro 'DO_NOTHING_RETURN_SCALAR' 219 | return DO_NOTHING_RETURN_ ## which(ptr + 1); \ | ^~~~~~~~~~~~~~~~~~ Link: https://lkml.kernel.org/r/20241117113813.work.735-kees@kernel.org Signed-off-by: Kees Cook <kees(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- lib/stackinit_kunit.c | 1 + 1 file changed, 1 insertion(+) --- a/lib/stackinit_kunit.c~lib-stackinit-hide-never-taken-branch-from-compiler +++ a/lib/stackinit_kunit.c @@ -212,6 +212,7 @@ static noinline void test_ ## name (stru static noinline DO_NOTHING_TYPE_ ## which(var_type) \ do_nothing_ ## name(var_type *ptr) \ { \ + OPTIMIZER_HIDE_VAR(ptr); \ /* Will always be true, but compiler doesn't know. */ \ if ((unsigned long)ptr > 0x2) \ return DO_NOTHING_RETURN_ ## which(ptr); \ _ Patches currently in -mm which might be from kees(a)kernel.org are

4 months, 3 weeks

1
0
0 0

[merged mm-hotfixes-stable] mm-respect-mmap-hint-address-when-aligning-for-thp.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm: respect mmap hint address when aligning for THP has been removed from the -mm tree. Its filename was mm-respect-mmap-hint-address-when-aligning-for-thp.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Kalesh Singh <kaleshsingh(a)google.com> Subject: mm: respect mmap hint address when aligning for THP Date: Mon, 18 Nov 2024 13:46:48 -0800 Commit efa7df3e3bb5 ("mm: align larger anonymous mappings on THP boundaries") updated __get_unmapped_area() to align the start address for the VMA to a PMD boundary if CONFIG_TRANSPARENT_HUGEPAGE=y. It does this by effectively looking up a region that is of size, request_size + PMD_SIZE, and aligning up the start to a PMD boundary. Commit 4ef9ad19e176 ("mm: huge_memory: don't force huge page alignment on 32 bit") opted out of this for 32bit due to regressions in mmap base randomization. Commit d4148aeab412 ("mm, mmap: limit THP alignment of anonymous mappings to PMD-aligned sizes") restricted this to only mmap sizes that are multiples of the PMD_SIZE due to reported regressions in some performance benchmarks -- which seemed mostly due to the reduced spatial locality of related mappings due to the forced PMD-alignment. Another unintended side effect has emerged: When a user specifies an mmap hint address, the THP alignment logic modifies the behavior, potentially ignoring the hint even if a sufficiently large gap exists at the requested hint location. Example Scenario: Consider the following simplified virtual address (VA) space: ... 0x200000-0x400000 --- VMA A 0x400000-0x600000 --- Hole 0x600000-0x800000 --- VMA B ... A call to mmap() with hint=0x400000 and len=0x200000 behaves differently: - Before THP alignment: The requested region (size 0x200000) fits into the gap at 0x400000, so the hint is respected. - After alignment: The logic searches for a region of size 0x400000 (len + PMD_SIZE) starting at 0x400000. This search fails due to the mapping at 0x600000 (VMA B), and the hint is ignored, falling back to arch_get_unmapped_area[_topdown](). In general the hint is effectively ignored, if there is any existing mapping in the below range: [mmap_hint + mmap_size, mmap_hint + mmap_size + PMD_SIZE) This changes the semantics of mmap hint; from ""Respect the hint if a sufficiently large gap exists at the requested location" to "Respect the hint only if an additional PMD-sized gap exists beyond the requested size". This has performance implications for allocators that allocate their heap using mmap but try to keep it "as contiguous as possible" by using the end of the exisiting heap as the address hint. With the new behavior it's more likely to get a much less contiguous heap, adding extra fragmentation and performance overhead. To restore the expected behavior; don't use thp_get_unmapped_area_vmflags() when the user provided a hint address, for anonymous mappings. Note: As Yang Shi pointed out: the issue still remains for filesystems which are using thp_get_unmapped_area() for their get_unmapped_area() op. It is unclear what worklaods will regress for if we ignore THP alignment when the hint address is provided for such file backed mappings -- so this fix will be handled separately. Link: https://lkml.kernel.org/r/20241118214650.3667577-1-kaleshsingh@google.com Fixes: efa7df3e3bb5 ("mm: align larger anonymous mappings on THP boundaries") Signed-off-by: Kalesh Singh <kaleshsingh(a)google.com> Reviewed-by: Rik van Riel <riel(a)surriel.com> Reviewed-by: Vlastimil Babka <vbabka(a)suse.cz> Reviewed-by: David Hildenbrand <david(a)redhat.com> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Yang Shi <yang(a)os.amperecomputing.com> Cc: Rik van Riel <riel(a)surriel.com> Cc: Ryan Roberts <ryan.roberts(a)arm.com> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Minchan Kim <minchan(a)kernel.org> Cc: Hans Boehm <hboehm(a)google.com> Cc: Lokesh Gidra <lokeshgidra(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/mmap.c | 1 + 1 file changed, 1 insertion(+) --- a/mm/mmap.c~mm-respect-mmap-hint-address-when-aligning-for-thp +++ a/mm/mmap.c @@ -889,6 +889,7 @@ __get_unmapped_area(struct file *file, u if (get_area) { addr = get_area(file, addr, len, pgoff, flags); } else if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) + && !addr /* no hint */ && IS_ALIGNED(len, PMD_SIZE)) { /* Ensures that larger anonymous mappings are THP aligned. */ addr = thp_get_unmapped_area_vmflags(file, addr, len, _ Patches currently in -mm which might be from kaleshsingh(a)google.com are

4 months, 3 weeks

1
0
0 0

[merged mm-hotfixes-stable] mm-memcg-declare-do_memsw_account-inline.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm: memcg: declare do_memsw_account inline has been removed from the -mm tree. Its filename was mm-memcg-declare-do_memsw_account-inline.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: John Sperbeck <jsperbeck(a)google.com> Subject: mm: memcg: declare do_memsw_account inline Date: Thu, 28 Nov 2024 12:39:59 -0800 In commit 66d60c428b23 ("mm: memcg: move legacy memcg event code into memcontrol-v1.c"), the static do_memsw_account() function was moved from a .c file to a .h file. Unfortunately, the traditional inline keyword wasn't added. If a file (e.g., a unit test) includes the .h file, but doesn't refer to do_memsw_account(), it will get a warning like: mm/memcontrol-v1.h:41:13: warning: unused function 'do_memsw_account' [-Wunused-function] 41 | static bool do_memsw_account(void) | ^~~~~~~~~~~~~~~~ Link: https://lkml.kernel.org/r/20241128203959.726527-1-jsperbeck@google.com Fixes: 66d60c428b23 ("mm: memcg: move legacy memcg event code into memcontrol-v1.c") Signed-off-by: John Sperbeck <jsperbeck(a)google.com> Acked-by: Roman Gushchin <roman.gushchin(a)linux.dev> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Shakeel Butt <shakeel.butt(a)linux.dev> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/memcontrol-v1.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/mm/memcontrol-v1.h~mm-memcg-declare-do_memsw_account-inline +++ a/mm/memcontrol-v1.h @@ -38,7 +38,7 @@ void mem_cgroup_id_put_many(struct mem_c iter = mem_cgroup_iter(NULL, iter, NULL)) /* Whether legacy memory+swap accounting is active */ -static bool do_memsw_account(void) +static inline bool do_memsw_account(void) { return !cgroup_subsys_on_dfl(memory_cgrp_subsys); } _ Patches currently in -mm which might be from jsperbeck(a)google.com are

4 months, 3 weeks

1
0
0 0

[merged mm-hotfixes-stable] ocfs2-update-seq_file-index-in-ocfs2_dlm_seq_next-v2.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: ocfs2: update seq_file index in ocfs2_dlm_seq_next has been removed from the -mm tree. Its filename was ocfs2-update-seq_file-index-in-ocfs2_dlm_seq_next-v2.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Wengang Wang <wen.gang.wang(a)oracle.com> Subject: ocfs2: update seq_file index in ocfs2_dlm_seq_next Date: Tue, 19 Nov 2024 09:45:00 -0800 The following INFO level message was seen: seq_file: buggy .next function ocfs2_dlm_seq_next [ocfs2] did not update position index Fix: Update *pos (so m->index) to make seq_read_iter happy though the index its self makes no sense to ocfs2_dlm_seq_next. Link: https://lkml.kernel.org/r/20241119174500.9198-1-wen.gang.wang@oracle.com Signed-off-by: Wengang Wang <wen.gang.wang(a)oracle.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/ocfs2/dlmglue.c | 1 + 1 file changed, 1 insertion(+) --- a/fs/ocfs2/dlmglue.c~ocfs2-update-seq_file-index-in-ocfs2_dlm_seq_next-v2 +++ a/fs/ocfs2/dlmglue.c @@ -3110,6 +3110,7 @@ static void *ocfs2_dlm_seq_next(struct s struct ocfs2_lock_res *iter = v; struct ocfs2_lock_res *dummy = &priv->p_iter_res; + (*pos)++; spin_lock(&ocfs2_dlm_tracking_lock); iter = ocfs2_dlm_next_res(iter, priv); list_del_init(&dummy->l_debug_list); _ Patches currently in -mm which might be from wen.gang.wang(a)oracle.com are

4 months, 3 weeks

1
0
0 0

[merged mm-hotfixes-stable] stackdepot-fix-stack_depot_save_flags-in-nmi-context.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: stackdepot: fix stack_depot_save_flags() in NMI context has been removed from the -mm tree. Its filename was stackdepot-fix-stack_depot_save_flags-in-nmi-context.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Marco Elver <elver(a)google.com> Subject: stackdepot: fix stack_depot_save_flags() in NMI context Date: Fri, 22 Nov 2024 16:39:47 +0100 Per documentation, stack_depot_save_flags() was meant to be usable from NMI context if STACK_DEPOT_FLAG_CAN_ALLOC is unset. However, it still would try to take the pool_lock in an attempt to save a stack trace in the current pool (if space is available). This could result in deadlock if an NMI is handled while pool_lock is already held. To avoid deadlock, only try to take the lock in NMI context and give up if unsuccessful. The documentation is fixed to clearly convey this. Link: https://lkml.kernel.org/r/Z0CcyfbPqmxJ9uJH@elver.google.com Link: https://lkml.kernel.org/r/20241122154051.3914732-1-elver@google.com Fixes: 4434a56ec209 ("stackdepot: make fast paths lock-less again") Signed-off-by: Marco Elver <elver(a)google.com> Reported-by: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Reviewed-by: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Cc: Alexander Potapenko <glider(a)google.com> Cc: Andrey Konovalov <andreyknvl(a)gmail.com> Cc: Dmitry Vyukov <dvyukov(a)google.com> Cc: Oscar Salvador <osalvador(a)suse.de> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/stackdepot.h | 6 +++--- lib/stackdepot.c | 10 +++++++++- 2 files changed, 12 insertions(+), 4 deletions(-) --- a/include/linux/stackdepot.h~stackdepot-fix-stack_depot_save_flags-in-nmi-context +++ a/include/linux/stackdepot.h @@ -147,7 +147,7 @@ static inline int stack_depot_early_init * If the provided stack trace comes from the interrupt context, only the part * up to the interrupt entry is saved. * - * Context: Any context, but setting STACK_DEPOT_FLAG_CAN_ALLOC is required if + * Context: Any context, but unsetting STACK_DEPOT_FLAG_CAN_ALLOC is required if * alloc_pages() cannot be used from the current context. Currently * this is the case for contexts where neither %GFP_ATOMIC nor * %GFP_NOWAIT can be used (NMI, raw_spin_lock). @@ -156,7 +156,7 @@ static inline int stack_depot_early_init */ depot_stack_handle_t stack_depot_save_flags(unsigned long *entries, unsigned int nr_entries, - gfp_t gfp_flags, + gfp_t alloc_flags, depot_flags_t depot_flags); /** @@ -175,7 +175,7 @@ depot_stack_handle_t stack_depot_save_fl * Return: Handle of the stack trace stored in depot, 0 on failure */ depot_stack_handle_t stack_depot_save(unsigned long *entries, - unsigned int nr_entries, gfp_t gfp_flags); + unsigned int nr_entries, gfp_t alloc_flags); /** * __stack_depot_get_stack_record - Get a pointer to a stack_record struct --- a/lib/stackdepot.c~stackdepot-fix-stack_depot_save_flags-in-nmi-context +++ a/lib/stackdepot.c @@ -630,7 +630,15 @@ depot_stack_handle_t stack_depot_save_fl prealloc = page_address(page); } - raw_spin_lock_irqsave(&pool_lock, flags); + if (in_nmi()) { + /* We can never allocate in NMI context. */ + WARN_ON_ONCE(can_alloc); + /* Best effort; bail if we fail to take the lock. */ + if (!raw_spin_trylock_irqsave(&pool_lock, flags)) + goto exit; + } else { + raw_spin_lock_irqsave(&pool_lock, flags); + } printk_deferred_enter(); /* Try to find again, to avoid concurrently inserting duplicates. */ _ Patches currently in -mm which might be from elver(a)google.com are

4 months, 3 weeks

1
0
0 0

[merged mm-hotfixes-stable] mm-open-code-page_folio-in-dump_page.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm: open-code page_folio() in dump_page() has been removed from the -mm tree. Its filename was mm-open-code-page_folio-in-dump_page.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: "Matthew Wilcox (Oracle)" <willy(a)infradead.org> Subject: mm: open-code page_folio() in dump_page() Date: Mon, 25 Nov 2024 20:17:19 +0000 page_folio() calls page_fixed_fake_head() which will misidentify this page as being a fake head and load off the end of 'precise'. We may have a pointer to a fake head, but that's OK because it contains the right information for dump_page(). gcc-15 is smart enough to catch this with -Warray-bounds: In function 'page_fixed_fake_head', inlined from '_compound_head' at ../include/linux/page-flags.h:251:24, inlined from '__dump_page' at ../mm/debug.c:123:11: ../include/asm-generic/rwonce.h:44:26: warning: array subscript 9 is outside +array bounds of 'struct page[1]' [-Warray-bounds=] Link: https://lkml.kernel.org/r/20241125201721.2963278-2-willy@infradead.org Fixes: fae7d834c43c ("mm: add __dump_folio()") Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org> Reported-by: Kees Cook <kees(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/debug.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) --- a/mm/debug.c~mm-open-code-page_folio-in-dump_page +++ a/mm/debug.c @@ -124,19 +124,22 @@ static void __dump_page(const struct pag { struct folio *foliop, folio; struct page precise; + unsigned long head; unsigned long pfn = page_to_pfn(page); unsigned long idx, nr_pages = 1; int loops = 5; again: memcpy(&precise, page, sizeof(*page)); - foliop = page_folio(&precise); - if (foliop == (struct folio *)&precise) { + head = precise.compound_head; + if ((head & 1) == 0) { + foliop = (struct folio *)&precise; idx = 0; if (!folio_test_large(foliop)) goto dump; foliop = (struct folio *)page; } else { + foliop = (struct folio *)(head - 1); idx = folio_page_idx(foliop, page); } _ Patches currently in -mm which might be from willy(a)infradead.org are mm-page_alloc-cache-page_zone-result-in-free_unref_page.patch mm-make-alloc_pages_mpol-static.patch mm-page_alloc-export-free_frozen_pages-instead-of-free_unref_page.patch mm-page_alloc-move-set_page_refcounted-to-callers-of-post_alloc_hook.patch mm-page_alloc-move-set_page_refcounted-to-callers-of-prep_new_page.patch mm-page_alloc-move-set_page_refcounted-to-callers-of-get_page_from_freelist.patch mm-page_alloc-move-set_page_refcounted-to-callers-of-__alloc_pages_cpuset_fallback.patch mm-page_alloc-move-set_page_refcounted-to-callers-of-__alloc_pages_may_oom.patch mm-page_alloc-move-set_page_refcounted-to-callers-of-__alloc_pages_direct_compact.patch mm-page_alloc-move-set_page_refcounted-to-callers-of-__alloc_pages_direct_reclaim.patch mm-page_alloc-move-set_page_refcounted-to-callers-of-__alloc_pages_slowpath.patch mm-page_alloc-move-set_page_refcounted-to-end-of-__alloc_pages.patch mm-page_alloc-add-__alloc_frozen_pages.patch mm-mempolicy-add-alloc_frozen_pages.patch slab-allocate-frozen-pages.patch

4 months, 3 weeks

1
0
0 0

[merged mm-hotfixes-stable] mm-open-code-pagetail-in-folio_flags-and-const_folio_flags.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm: open-code PageTail in folio_flags() and const_folio_flags() has been removed from the -mm tree. Its filename was mm-open-code-pagetail-in-folio_flags-and-const_folio_flags.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: "Matthew Wilcox (Oracle)" <willy(a)infradead.org> Subject: mm: open-code PageTail in folio_flags() and const_folio_flags() Date: Mon, 25 Nov 2024 20:17:18 +0000 It is unsafe to call PageTail() in dump_page() as page_is_fake_head() will almost certainly return true when called on a head page that is copied to the stack. That will cause the VM_BUG_ON_PGFLAGS() in const_folio_flags() to trigger when it shouldn't. Fortunately, we don't need to call PageTail() here; it's fine to have a pointer to a virtual alias of the page's flag word rather than the real page's flag word. Link: https://lkml.kernel.org/r/20241125201721.2963278-1-willy@infradead.org Fixes: fae7d834c43c ("mm: add __dump_folio()") Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Kees Cook <kees(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/page-flags.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/include/linux/page-flags.h~mm-open-code-pagetail-in-folio_flags-and-const_folio_flags +++ a/include/linux/page-flags.h @@ -306,7 +306,7 @@ static const unsigned long *const_folio_ { const struct page *page = &folio->page; - VM_BUG_ON_PGFLAGS(PageTail(page), page); + VM_BUG_ON_PGFLAGS(page->compound_head & 1, page); VM_BUG_ON_PGFLAGS(n > 0 && !test_bit(PG_head, &page->flags), page); return &page[n].flags; } @@ -315,7 +315,7 @@ static unsigned long *folio_flags(struct { struct page *page = &folio->page; - VM_BUG_ON_PGFLAGS(PageTail(page), page); + VM_BUG_ON_PGFLAGS(page->compound_head & 1, page); VM_BUG_ON_PGFLAGS(n > 0 && !test_bit(PG_head, &page->flags), page); return &page[n].flags; } _ Patches currently in -mm which might be from willy(a)infradead.org are mm-page_alloc-cache-page_zone-result-in-free_unref_page.patch mm-make-alloc_pages_mpol-static.patch mm-page_alloc-export-free_frozen_pages-instead-of-free_unref_page.patch mm-page_alloc-move-set_page_refcounted-to-callers-of-post_alloc_hook.patch mm-page_alloc-move-set_page_refcounted-to-callers-of-prep_new_page.patch mm-page_alloc-move-set_page_refcounted-to-callers-of-get_page_from_freelist.patch mm-page_alloc-move-set_page_refcounted-to-callers-of-__alloc_pages_cpuset_fallback.patch mm-page_alloc-move-set_page_refcounted-to-callers-of-__alloc_pages_may_oom.patch mm-page_alloc-move-set_page_refcounted-to-callers-of-__alloc_pages_direct_compact.patch mm-page_alloc-move-set_page_refcounted-to-callers-of-__alloc_pages_direct_reclaim.patch mm-page_alloc-move-set_page_refcounted-to-callers-of-__alloc_pages_slowpath.patch mm-page_alloc-move-set_page_refcounted-to-end-of-__alloc_pages.patch mm-page_alloc-add-__alloc_frozen_pages.patch mm-mempolicy-add-alloc_frozen_pages.patch slab-allocate-frozen-pages.patch

4 months, 3 weeks

1
0
0 0

[merged mm-hotfixes-stable] mm-fix-vreallocs-kasan-poisoning-logic.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm: fix vrealloc()'s KASAN poisoning logic has been removed from the -mm tree. Its filename was mm-fix-vreallocs-kasan-poisoning-logic.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Andrii Nakryiko <andrii(a)kernel.org> Subject: mm: fix vrealloc()'s KASAN poisoning logic Date: Mon, 25 Nov 2024 16:52:06 -0800 When vrealloc() reuses already allocated vmap_area, we need to re-annotate poisoned and unpoisoned portions of underlying memory according to the new size. This results in a KASAN splat recorded at [1]. A KASAN mis-reporting issue where there is none. Note, hard-coding KASAN_VMALLOC_PROT_NORMAL might not be exactly correct, but KASAN flag logic is pretty involved and spread out throughout __vmalloc_node_range_noprof(), so I'm using the bare minimum flag here and leaving the rest to mm people to refactor this logic and reuse it here. Link: https://lkml.kernel.org/r/20241126005206.3457974-1-andrii@kernel.org Link: https://lore.kernel.org/bpf/67450f9b.050a0220.21d33d.0004.GAE@google.com/ [1] Fixes: 3ddc2fefe6f3 ("mm: vmalloc: implement vrealloc()") Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Cc: Alexei Starovoitov <ast(a)kernel.org> Cc: Christoph Hellwig <hch(a)infradead.org> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Uladzislau Rezki (Sony) <urezki(a)gmail.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/vmalloc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/mm/vmalloc.c~mm-fix-vreallocs-kasan-poisoning-logic +++ a/mm/vmalloc.c @@ -4093,7 +4093,8 @@ void *vrealloc_noprof(const void *p, siz /* Zero out spare memory. */ if (want_init_on_alloc(flags)) memset((void *)p + size, 0, old_size - size); - + kasan_poison_vmalloc(p + size, old_size - size); + kasan_unpoison_vmalloc(p, size, KASAN_VMALLOC_PROT_NORMAL); return (void *)p; } _ Patches currently in -mm which might be from andrii(a)kernel.org are

4 months, 3 weeks

1
0
0 0

[merged mm-hotfixes-stable] revert-readahead-properly-shorten-readahead-when-falling-back-to-do_page_cache_ra.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: Revert "readahead: properly shorten readahead when falling back to do_page_cache_ra()" has been removed from the -mm tree. Its filename was revert-readahead-properly-shorten-readahead-when-falling-back-to-do_page_cache_ra.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Jan Kara <jack(a)suse.cz> Subject: Revert "readahead: properly shorten readahead when falling back to do_page_cache_ra()" Date: Tue, 26 Nov 2024 15:52:08 +0100 This reverts commit 7c877586da3178974a8a94577b6045a48377ff25. Anders and Philippe have reported that recent kernels occasionally hang when used with NFS in readahead code. The problem has been bisected to 7c877586da3 ("readahead: properly shorten readahead when falling back to do_page_cache_ra()"). The cause of the problem is that ra->size can be shrunk by read_pages() call and subsequently we end up calling do_page_cache_ra() with negative (read huge positive) number of pages. Let's revert 7c877586da3 for now until we can find a proper way how the logic in read_pages() and page_cache_ra_order() can coexist. This can lead to reduced readahead throughput due to readahead window confusion but that's better than outright hangs. Link: https://lkml.kernel.org/r/20241126145208.985-1-jack@suse.cz Fixes: 7c877586da31 ("readahead: properly shorten readahead when falling back to do_page_cache_ra()") Reported-by: Anders Blomdell <anders.blomdell(a)gmail.com> Reported-by: Philippe Troin <phil(a)fifi.org> Signed-off-by: Jan Kara <jack(a)suse.cz> Tested-by: Philippe Troin <phil(a)fifi.org> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/readahead.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) --- a/mm/readahead.c~revert-readahead-properly-shorten-readahead-when-falling-back-to-do_page_cache_ra +++ a/mm/readahead.c @@ -458,8 +458,7 @@ void page_cache_ra_order(struct readahea struct file_ra_state *ra, unsigned int new_order) { struct address_space *mapping = ractl->mapping; - pgoff_t start = readahead_index(ractl); - pgoff_t index = start; + pgoff_t index = readahead_index(ractl); unsigned int min_order = mapping_min_folio_order(mapping); pgoff_t limit = (i_size_read(mapping->host) - 1) >> PAGE_SHIFT; pgoff_t mark = index + ra->size - ra->async_size; @@ -522,7 +521,7 @@ void page_cache_ra_order(struct readahea if (!err) return; fallback: - do_page_cache_ra(ractl, ra->size - (index - start), ra->async_size); + do_page_cache_ra(ractl, ra->size, ra->async_size); } static unsigned long ractl_max_pages(struct readahead_control *ractl, _ Patches currently in -mm which might be from jack(a)suse.cz are readahead-dont-shorted-readahead-window-in-read_pages.patch readahead-properly-shorten-readahead-when-falling-back-to-do_page_cache_ra.patch

4 months, 3 weeks

1
0
0 0

[merged mm-hotfixes-stable] selftests-damon-add-_damon_sysfspy-to-test_files.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: selftests/damon: add _damon_sysfs.py to TEST_FILES has been removed from the -mm tree. Its filename was selftests-damon-add-_damon_sysfspy-to-test_files.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Maximilian Heyne <mheyne(a)amazon.de> Subject: selftests/damon: add _damon_sysfs.py to TEST_FILES Date: Wed, 27 Nov 2024 12:08:53 +0000 When running selftests I encountered the following error message with some damon tests: # Traceback (most recent call last): # File "[...]/damon/./damos_quota.py", line 7, in <module> # import _damon_sysfs # ModuleNotFoundError: No module named '_damon_sysfs' Fix this by adding the _damon_sysfs.py file to TEST_FILES so that it will be available when running the respective damon selftests. Link: https://lkml.kernel.org/r/20241127-picks-visitor-7416685b-mheyne@amazon.de Fixes: 306abb63a8ca ("selftests/damon: implement a python module for test-purpose DAMON sysfs controls") Signed-off-by: Maximilian Heyne <mheyne(a)amazon.de> Reviewed-by: SeongJae Park <sj(a)kernel.org> Cc: Shuah Khan <shuah(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- tools/testing/selftests/damon/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/tools/testing/selftests/damon/Makefile~selftests-damon-add-_damon_sysfspy-to-test_files +++ a/tools/testing/selftests/damon/Makefile @@ -6,7 +6,7 @@ TEST_GEN_FILES += debugfs_target_ids_rea TEST_GEN_FILES += debugfs_target_ids_pid_leak TEST_GEN_FILES += access_memory access_memory_even -TEST_FILES = _chk_dependency.sh _debugfs_common.sh +TEST_FILES = _chk_dependency.sh _debugfs_common.sh _damon_sysfs.py # functionality tests TEST_PROGS = debugfs_attrs.sh debugfs_schemes.sh debugfs_target_ids.sh _ Patches currently in -mm which might be from mheyne(a)amazon.de are

4 months, 3 weeks

1
0
0 0

[merged mm-hotfixes-stable] selftest-hugetlb_dio-fix-test-naming.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: selftest: hugetlb_dio: fix test naming has been removed from the -mm tree. Its filename was selftest-hugetlb_dio-fix-test-naming.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Mark Brown <broonie(a)kernel.org> Subject: selftest: hugetlb_dio: fix test naming Date: Wed, 27 Nov 2024 16:14:22 +0000 The string logged when a test passes or fails is used by the selftest framework to identify which test is being reported. The hugetlb_dio test not only uses the same strings for every test that is run but it also uses different strings for test passes and failures which means that test automation is unable to follow what the test is doing at all. Pull the existing duplicated logging of the number of free huge pages before and after the test out of the conditional and replace that and the logging of the result with a single ksft_print_result() which incorporates the parameters passed into the test into the output. Link: https://lkml.kernel.org/r/20241127-kselftest-mm-hugetlb-dio-names-v1-1-22aa… Fixes: fae1980347bf ("selftests: hugetlb_dio: fixup check for initial conditions to skip in the start") Signed-off-by: Mark Brown <broonie(a)kernel.org> Reviewed-by: Muhammad Usama Anjum <usama.anjum(a)collabora.com> Cc: Donet Tom <donettom(a)linux.ibm.com> Cc: Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- tools/testing/selftests/mm/hugetlb_dio.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) --- a/tools/testing/selftests/mm/hugetlb_dio.c~selftest-hugetlb_dio-fix-test-naming +++ a/tools/testing/selftests/mm/hugetlb_dio.c @@ -76,19 +76,15 @@ void run_dio_using_hugetlb(unsigned int /* Get the free huge pages after unmap*/ free_hpage_a = get_free_hugepages(); + ksft_print_msg("No. Free pages before allocation : %d\n", free_hpage_b); + ksft_print_msg("No. Free pages after munmap : %d\n", free_hpage_a); + /* * If the no. of free hugepages before allocation and after unmap does * not match - that means there could still be a page which is pinned. */ - if (free_hpage_a != free_hpage_b) { - ksft_print_msg("No. Free pages before allocation : %d\n", free_hpage_b); - ksft_print_msg("No. Free pages after munmap : %d\n", free_hpage_a); - ksft_test_result_fail(": Huge pages not freed!\n"); - } else { - ksft_print_msg("No. Free pages before allocation : %d\n", free_hpage_b); - ksft_print_msg("No. Free pages after munmap : %d\n", free_hpage_a); - ksft_test_result_pass(": Huge pages freed successfully !\n"); - } + ksft_test_result(free_hpage_a == free_hpage_b, + "free huge pages from %u-%u\n", start_off, end_off); } int main(void) _ Patches currently in -mm which might be from broonie(a)kernel.org are

4 months, 3 weeks

1
0
0 0

[merged mm-hotfixes-stable] nilfs2-fix-potential-out-of-bounds-memory-access-in-nilfs_find_entry.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() has been removed from the -mm tree. Its filename was nilfs2-fix-potential-out-of-bounds-memory-access-in-nilfs_find_entry.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Subject: nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() Date: Wed, 20 Nov 2024 02:23:37 +0900 Syzbot reported that when searching for records in a directory where the inode's i_size is corrupted and has a large value, memory access outside the folio/page range may occur, or a use-after-free bug may be detected if KASAN is enabled. This is because nilfs_last_byte(), which is called by nilfs_find_entry() and others to calculate the number of valid bytes of directory data in a page from i_size and the page index, loses the upper 32 bits of the 64-bit size information due to an inappropriate type of local variable to which the i_size value is assigned. This caused a large byte offset value due to underflow in the end address calculation in the calling nilfs_find_entry(), resulting in memory access that exceeds the folio/page size. Fix this issue by changing the type of the local variable causing the bit loss from "unsigned int" to "u64". The return value of nilfs_last_byte() is also of type "unsigned int", but it is truncated so as not to exceed PAGE_SIZE and no bit loss occurs, so no change is required. Link: https://lkml.kernel.org/r/20241119172403.9292-1-konishi.ryusuke@gmail.com Fixes: 2ba466d74ed7 ("nilfs2: directory entry operations") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+96d5d14c47d97015c624(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=96d5d14c47d97015c624 Tested-by: syzbot+96d5d14c47d97015c624(a)syzkaller.appspotmail.com Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/nilfs2/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/nilfs2/dir.c~nilfs2-fix-potential-out-of-bounds-memory-access-in-nilfs_find_entry +++ a/fs/nilfs2/dir.c @@ -70,7 +70,7 @@ static inline unsigned int nilfs_chunk_s */ static unsigned int nilfs_last_byte(struct inode *inode, unsigned long page_nr) { - unsigned int last_byte = inode->i_size; + u64 last_byte = inode->i_size; last_byte -= page_nr << PAGE_SHIFT; if (last_byte > PAGE_SIZE) _ Patches currently in -mm which might be from konishi.ryusuke(a)gmail.com are

4 months, 3 weeks

1
0
0 0

[merged mm-hotfixes-stable] kasan-make-report_lock-a-raw-spinlock.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: kasan: make report_lock a raw spinlock has been removed from the -mm tree. Its filename was kasan-make-report_lock-a-raw-spinlock.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Jared Kangas <jkangas(a)redhat.com> Subject: kasan: make report_lock a raw spinlock Date: Tue, 19 Nov 2024 13:02:34 -0800 If PREEMPT_RT is enabled, report_lock is a sleeping spinlock and must not be locked when IRQs are disabled. However, KASAN reports may be triggered in such contexts. For example: char *s = kzalloc(1, GFP_KERNEL); kfree(s); local_irq_disable(); char c = *s; /* KASAN report here leads to spin_lock() */ local_irq_enable(); Make report_spinlock a raw spinlock to prevent rescheduling when PREEMPT_RT is enabled. Link: https://lkml.kernel.org/r/20241119210234.1602529-1-jkangas@redhat.com Fixes: 342a93247e08 ("locking/spinlock: Provide RT variant header: <linux/spinlock_rt.h>") Signed-off-by: Jared Kangas <jkangas(a)redhat.com> Cc: Alexander Potapenko <glider(a)google.com> Cc: Andrey Konovalov <andreyknvl(a)gmail.com> Cc: Andrey Ryabinin <ryabinin.a.a(a)gmail.com> Cc: Dmitry Vyukov <dvyukov(a)google.com> Cc: Vincenzo Frascino <vincenzo.frascino(a)arm.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/kasan/report.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/mm/kasan/report.c~kasan-make-report_lock-a-raw-spinlock +++ a/mm/kasan/report.c @@ -201,7 +201,7 @@ static inline void fail_non_kasan_kunit_ #endif /* CONFIG_KUNIT */ -static DEFINE_SPINLOCK(report_lock); +static DEFINE_RAW_SPINLOCK(report_lock); static void start_report(unsigned long *flags, bool sync) { @@ -212,7 +212,7 @@ static void start_report(unsigned long * lockdep_off(); /* Make sure we don't end up in loop. */ report_suppress_start(); - spin_lock_irqsave(&report_lock, *flags); + raw_spin_lock_irqsave(&report_lock, *flags); pr_err("==================================================================\n"); } @@ -222,7 +222,7 @@ static void end_report(unsigned long *fl trace_error_report_end(ERROR_DETECTOR_KASAN, (unsigned long)addr); pr_err("==================================================================\n"); - spin_unlock_irqrestore(&report_lock, *flags); + raw_spin_unlock_irqrestore(&report_lock, *flags); if (!test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags)) check_panic_on_warn("KASAN"); switch (kasan_arg_fault) { _ Patches currently in -mm which might be from jkangas(a)redhat.com are

4 months, 3 weeks

1
0
0 0

[merged mm-hotfixes-stable] mm-mempolicy-fix-migrate_to_node-assuming-there-is-at-least-one-vma-in-a-mm.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM has been removed from the -mm tree. Its filename was mm-mempolicy-fix-migrate_to_node-assuming-there-is-at-least-one-vma-in-a-mm.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: David Hildenbrand <david(a)redhat.com> Subject: mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM Date: Wed, 20 Nov 2024 21:11:51 +0100 We currently assume that there is at least one VMA in a MM, which isn't true. So we might end up having find_vma() return NULL, to then de-reference NULL. So properly handle find_vma() returning NULL. This fixes the report: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 UID: 0 PID: 6021 Comm: syz-executor284 Not tainted 6.12.0-rc7-syzkaller-00187-gf868cd251776 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 RIP: 0010:migrate_to_node mm/mempolicy.c:1090 [inline] RIP: 0010:do_migrate_pages+0x403/0x6f0 mm/mempolicy.c:1194 Code: ... RSP: 0018:ffffc9000375fd08 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffc9000375fd78 RCX: 0000000000000000 RDX: ffff88807e171300 RSI: dffffc0000000000 RDI: ffff88803390c044 RBP: ffff88807e171428 R08: 0000000000000014 R09: fffffbfff2039ef1 R10: ffffffff901cf78f R11: 0000000000000000 R12: 0000000000000003 R13: ffffc9000375fe90 R14: ffffc9000375fe98 R15: ffffc9000375fdf8 FS: 00005555919e1380(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005555919e1ca8 CR3: 000000007f12a000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> kernel_migrate_pages+0x5b2/0x750 mm/mempolicy.c:1709 __do_sys_migrate_pages mm/mempolicy.c:1727 [inline] __se_sys_migrate_pages mm/mempolicy.c:1723 [inline] __x64_sys_migrate_pages+0x96/0x100 mm/mempolicy.c:1723 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f [akpm(a)linux-foundation.org: add unlikely()] Link: https://lkml.kernel.org/r/20241120201151.9518-1-david@redhat.com Fixes: 39743889aaf7 ("[PATCH] Swap Migration V5: sys_migrate_pages interface") Signed-off-by: David Hildenbrand <david(a)redhat.com> Reported-by: syzbot+3511625422f7aa637f0d(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/lkml/673d2696.050a0220.3c9d61.012f.GAE@google.com/T/ Reviewed-by: Liam R. Howlett <Liam.Howlett(a)Oracle.com> Reviewed-by: Christoph Lameter <cl(a)linux.com> Cc: Liam R. Howlett <Liam.Howlett(a)Oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/mempolicy.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/mm/mempolicy.c~mm-mempolicy-fix-migrate_to_node-assuming-there-is-at-least-one-vma-in-a-mm +++ a/mm/mempolicy.c @@ -1080,6 +1080,10 @@ static long migrate_to_node(struct mm_st mmap_read_lock(mm); vma = find_vma(mm, 0); + if (unlikely(!vma)) { + mmap_read_unlock(mm); + return 0; + } /* * This does not migrate the range, but isolates all pages that _ Patches currently in -mm which might be from david(a)redhat.com are docs-tmpfs-update-the-large-folios-policy-for-tmpfs-and-shmem.patch mm-memory_hotplug-move-debug_pagealloc_map_pages-into-online_pages_range.patch mm-page_isolation-dont-pass-gfp-flags-to-isolate_single_pageblock.patch mm-page_isolation-dont-pass-gfp-flags-to-start_isolate_page_range.patch mm-page_alloc-make-__alloc_contig_migrate_range-static.patch mm-page_alloc-sort-out-the-alloc_contig_range-gfp-flags-mess.patch mm-page_alloc-forward-the-gfp-flags-from-alloc_contig_range-to-post_alloc_hook.patch powernv-memtrace-use-__gfp_zero-with-alloc_contig_pages.patch mm-hugetlb-dont-map-folios-writable-without-vm_write-when-copying-during-fork.patch fs-proc-vmcore-convert-vmcore_cb_lock-into-vmcore_mutex.patch fs-proc-vmcore-replace-vmcoredd_mutex-by-vmcore_mutex.patch fs-proc-vmcore-disallow-vmcore-modifications-while-the-vmcore-is-open.patch fs-proc-vmcore-prefix-all-pr_-with-vmcore.patch fs-proc-vmcore-move-vmcore-definitions-out-of-kcoreh.patch fs-proc-vmcore-factor-out-allocating-a-vmcore-range-and-adding-it-to-a-list.patch fs-proc-vmcore-factor-out-freeing-a-list-of-vmcore-ranges.patch fs-proc-vmcore-introduce-proc_vmcore_device_ram-to-detect-device-ram-ranges-in-2nd-kernel.patch virtio-mem-mark-device-ready-before-registering-callbacks-in-kdump-mode.patch virtio-mem-remember-usable-region-size.patch virtio-mem-support-config_proc_vmcore_device_ram.patch s390-kdump-virtio-mem-kdump-support-config_proc_vmcore_device_ram.patch

4 months, 3 weeks

1
0
0 0

[merged mm-hotfixes-stable] mm-gup-handle-null-pages-in-unpin_user_pages.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm/gup: handle NULL pages in unpin_user_pages() has been removed from the -mm tree. Its filename was mm-gup-handle-null-pages-in-unpin_user_pages.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: John Hubbard <jhubbard(a)nvidia.com> Subject: mm/gup: handle NULL pages in unpin_user_pages() Date: Wed, 20 Nov 2024 19:49:33 -0800 The recent addition of "pofs" (pages or folios) handling to gup has a flaw: it assumes that unpin_user_pages() handles NULL pages in the pages** array. That's not the case, as I discovered when I ran on a new configuration on my test machine. Fix this by skipping NULL pages in unpin_user_pages(), just like unpin_folios() already does. Details: when booting on x86 with "numa=fake=2 movablecore=4G" on Linux 6.12, and running this: tools/testing/selftests/mm/gup_longterm ...I get the following crash: BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:sanity_check_pinned_pages+0x3a/0x2d0 ... Call Trace: <TASK> ? __die_body+0x66/0xb0 ? page_fault_oops+0x30c/0x3b0 ? do_user_addr_fault+0x6c3/0x720 ? irqentry_enter+0x34/0x60 ? exc_page_fault+0x68/0x100 ? asm_exc_page_fault+0x22/0x30 ? sanity_check_pinned_pages+0x3a/0x2d0 unpin_user_pages+0x24/0xe0 check_and_migrate_movable_pages_or_folios+0x455/0x4b0 __gup_longterm_locked+0x3bf/0x820 ? mmap_read_lock_killable+0x12/0x50 ? __pfx_mmap_read_lock_killable+0x10/0x10 pin_user_pages+0x66/0xa0 gup_test_ioctl+0x358/0xb20 __se_sys_ioctl+0x6b/0xc0 do_syscall_64+0x7b/0x150 entry_SYSCALL_64_after_hwframe+0x76/0x7e Link: https://lkml.kernel.org/r/20241121034933.77502-1-jhubbard@nvidia.com Fixes: 94efde1d1539 ("mm/gup: avoid an unnecessary allocation call for FOLL_LONGTERM cases") Signed-off-by: John Hubbard <jhubbard(a)nvidia.com> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Oscar Salvador <osalvador(a)suse.de> Cc: Vivek Kasireddy <vivek.kasireddy(a)intel.com> Cc: Dave Airlie <airlied(a)redhat.com> Cc: Gerd Hoffmann <kraxel(a)redhat.com> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: Christoph Hellwig <hch(a)infradead.org> Cc: Jason Gunthorpe <jgg(a)nvidia.com> Cc: Peter Xu <peterx(a)redhat.com> Cc: Arnd Bergmann <arnd(a)arndb.de> Cc: Daniel Vetter <daniel.vetter(a)ffwll.ch> Cc: Dongwon Kim <dongwon.kim(a)intel.com> Cc: Hugh Dickins <hughd(a)google.com> Cc: Junxiao Chang <junxiao.chang(a)intel.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/gup.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) --- a/mm/gup.c~mm-gup-handle-null-pages-in-unpin_user_pages +++ a/mm/gup.c @@ -52,7 +52,12 @@ static inline void sanity_check_pinned_p */ for (; npages; npages--, pages++) { struct page *page = *pages; - struct folio *folio = page_folio(page); + struct folio *folio; + + if (!page) + continue; + + folio = page_folio(page); if (is_zero_page(page) || !folio_test_anon(folio)) @@ -409,6 +414,10 @@ void unpin_user_pages(struct page **page sanity_check_pinned_pages(pages, npages); for (i = 0; i < npages; i += nr) { + if (!pages[i]) { + nr = 1; + continue; + } folio = gup_folio_next(pages, npages, i, &nr); gup_put_folio(folio, nr, FOLL_PIN); } _ Patches currently in -mm which might be from jhubbard(a)nvidia.com are

4 months, 3 weeks

1
0
0 0

+ mm-shmem-fix-shmemhugepages-at-swapout.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: mm: shmem: fix ShmemHugePages at swapout has been added to the -mm mm-hotfixes-unstable branch. Its filename is mm-shmem-fix-shmemhugepages-at-swapout.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Hugh Dickins <hughd(a)google.com> Subject: mm: shmem: fix ShmemHugePages at swapout Date: Wed, 4 Dec 2024 22:50:06 -0800 (PST) /proc/meminfo ShmemHugePages has been showing overlarge amounts (more than Shmem) after swapping out THPs: we forgot to update NR_SHMEM_THPS. Add shmem_update_stats(), to avoid repetition, and risk of making that mistake again: the call from shmem_delete_from_page_cache() is the bugfix; the call from shmem_replace_folio() is reassuring, but not really a bugfix (replace corrects misplaced swapin readahead, but huge swapin readahead would be a mistake). Link: https://lkml.kernel.org/r/5ba477c8-a569-70b5-923e-09ab221af45b@google.com Fixes: 809bc86517cc ("mm: shmem: support large folio swap out") Signed-off-by: Hugh Dickins <hughd(a)google.com> Reviewed-by: Shakeel Butt <shakeel.butt(a)linux.dev> Reviewed-by: Yosry Ahmed <yosryahmed(a)google.com> Cc: Baolin Wang <baolin.wang(a)linux.alibaba.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/shmem.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) --- a/mm/shmem.c~mm-shmem-fix-shmemhugepages-at-swapout +++ a/mm/shmem.c @@ -787,6 +787,14 @@ static bool shmem_huge_global_enabled(st } #endif /* CONFIG_TRANSPARENT_HUGEPAGE */ +static void shmem_update_stats(struct folio *folio, int nr_pages) +{ + if (folio_test_pmd_mappable(folio)) + __lruvec_stat_mod_folio(folio, NR_SHMEM_THPS, nr_pages); + __lruvec_stat_mod_folio(folio, NR_FILE_PAGES, nr_pages); + __lruvec_stat_mod_folio(folio, NR_SHMEM, nr_pages); +} + /* * Somewhat like filemap_add_folio, but error if expected item has gone. */ @@ -821,10 +829,7 @@ static int shmem_add_to_page_cache(struc xas_store(&xas, folio); if (xas_error(&xas)) goto unlock; - if (folio_test_pmd_mappable(folio)) - __lruvec_stat_mod_folio(folio, NR_SHMEM_THPS, nr); - __lruvec_stat_mod_folio(folio, NR_FILE_PAGES, nr); - __lruvec_stat_mod_folio(folio, NR_SHMEM, nr); + shmem_update_stats(folio, nr); mapping->nrpages += nr; unlock: xas_unlock_irq(&xas); @@ -852,8 +857,7 @@ static void shmem_delete_from_page_cache error = shmem_replace_entry(mapping, folio->index, folio, radswap); folio->mapping = NULL; mapping->nrpages -= nr; - __lruvec_stat_mod_folio(folio, NR_FILE_PAGES, -nr); - __lruvec_stat_mod_folio(folio, NR_SHMEM, -nr); + shmem_update_stats(folio, -nr); xa_unlock_irq(&mapping->i_pages); folio_put_refs(folio, nr); BUG_ON(error); @@ -1969,10 +1973,8 @@ static int shmem_replace_folio(struct fo } if (!error) { mem_cgroup_replace_folio(old, new); - __lruvec_stat_mod_folio(new, NR_FILE_PAGES, nr_pages); - __lruvec_stat_mod_folio(new, NR_SHMEM, nr_pages); - __lruvec_stat_mod_folio(old, NR_FILE_PAGES, -nr_pages); - __lruvec_stat_mod_folio(old, NR_SHMEM, -nr_pages); + shmem_update_stats(new, nr_pages); + shmem_update_stats(old, -nr_pages); } xa_unlock_irq(&swap_mapping->i_pages); _ Patches currently in -mm which might be from hughd(a)google.com are mm-shmem-fix-shmemhugepages-at-swapout.patch

4 months, 4 weeks

1
0
0 0

+ ocfs2-fix-the-space-leak-in-la-when-releasing-la.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: ocfs2: fix the space leak in LA when releasing LA has been added to the -mm mm-hotfixes-unstable branch. Its filename is ocfs2-fix-the-space-leak-in-la-when-releasing-la.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Heming Zhao <heming.zhao(a)suse.com> Subject: ocfs2: fix the space leak in LA when releasing LA Date: Thu, 5 Dec 2024 18:48:33 +0800 Commit 30dd3478c3cd ("ocfs2: correctly use ocfs2_find_next_zero_bit()") introduced an issue, the ocfs2_sync_local_to_main() ignores the last contiguous free bits, which causes an OCFS2 volume to lose the last free clusters of LA window during the release routine. Please note, because commit dfe6c5692fb5 ("ocfs2: fix the la space leak when unmounting an ocfs2 volume") was reverted, this commit is a replacement fix for commit dfe6c5692fb5. Link: https://lkml.kernel.org/r/20241205104835.18223-3-heming.zhao@suse.com Fixes: 30dd3478c3cd ("ocfs2: correctly use ocfs2_find_next_zero_bit()") Signed-off-by: Heming Zhao <heming.zhao(a)suse.com> Suggested-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/ocfs2/localalloc.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) --- a/fs/ocfs2/localalloc.c~ocfs2-fix-the-space-leak-in-la-when-releasing-la +++ a/fs/ocfs2/localalloc.c @@ -971,9 +971,9 @@ static int ocfs2_sync_local_to_main(stru start = count = 0; left = le32_to_cpu(alloc->id1.bitmap1.i_total); - while ((bit_off = ocfs2_find_next_zero_bit(bitmap, left, start)) < - left) { - if (bit_off == start) { + while (1) { + bit_off = ocfs2_find_next_zero_bit(bitmap, left, start); + if ((bit_off < left) && (bit_off == start)) { count++; start++; continue; @@ -998,6 +998,8 @@ static int ocfs2_sync_local_to_main(stru } } + if (bit_off >= left) + break; count = 1; start = bit_off + 1; } _ Patches currently in -mm which might be from heming.zhao(a)suse.com are ocfs2-revert-ocfs2-fix-the-la-space-leak-when-unmounting-an-ocfs2-volume.patch ocfs2-fix-the-space-leak-in-la-when-releasing-la.patch

4 months, 4 weeks

1
0
0 0

+ ocfs2-revert-ocfs2-fix-the-la-space-leak-when-unmounting-an-ocfs2-volume.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: ocfs2: revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume" has been added to the -mm mm-hotfixes-unstable branch. Its filename is ocfs2-revert-ocfs2-fix-the-la-space-leak-when-unmounting-an-ocfs2-volume.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Heming Zhao <heming.zhao(a)suse.com> Subject: ocfs2: revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume" Date: Thu, 5 Dec 2024 18:48:32 +0800 Patch series "Revert ocfs2 commit dfe6c5692fb5 and provide a new fix". SUSE QA team detected a mistake in my commit dfe6c5692fb5 ("ocfs2: fix the la space leak when unmounting an ocfs2 volume"). I am very sorry for my error. (If my eyes are correct) From the mailling list mails, this patch shouldn't be applied to 4.19 5.4 5.10 5.15 6.1 6.6, and these branches should perform a revert operation. Reason for revert: In commit dfe6c5692fb5, I mistakenly wrote: "This bug has existed since the initial OCFS2 code.". The statement is wrong. The correct introduction commit is 30dd3478c3cd. IOW, if the branch doesn't include 30dd3478c3cd, dfe6c5692fb5 should also not be included. This reverts commit dfe6c5692fb5 ("ocfs2: fix the la space leak when unmounting an ocfs2 volume"). In commit dfe6c5692fb5, the commit log "This bug has existed since the initial OCFS2 code." is wrong. The correct introduction commit is 30dd3478c3cd ("ocfs2: correctly use ocfs2_find_next_zero_bit()"). The influence of commit dfe6c5692fb5 is that it provides a correct fix for the latest kernel. however, it shouldn't be pushed to stable branches. Let's use this commit to revert all branches that include dfe6c5692fb5 and use a new fix method to fix commit 30dd3478c3cd. Link: https://lkml.kernel.org/r/20241205104835.18223-1-heming.zhao@suse.com Link: https://lkml.kernel.org/r/20241205104835.18223-2-heming.zhao@suse.com Fixes: dfe6c5692fb5 ("ocfs2: fix the la space leak when unmounting an ocfs2 volume") Signed-off-by: Heming Zhao <heming.zhao(a)suse.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/ocfs2/localalloc.c | 19 ------------------- 1 file changed, 19 deletions(-) --- a/fs/ocfs2/localalloc.c~ocfs2-revert-ocfs2-fix-the-la-space-leak-when-unmounting-an-ocfs2-volume +++ a/fs/ocfs2/localalloc.c @@ -1002,25 +1002,6 @@ static int ocfs2_sync_local_to_main(stru start = bit_off + 1; } - /* clear the contiguous bits until the end boundary */ - if (count) { - blkno = la_start_blk + - ocfs2_clusters_to_blocks(osb->sb, - start - count); - - trace_ocfs2_sync_local_to_main_free( - count, start - count, - (unsigned long long)la_start_blk, - (unsigned long long)blkno); - - status = ocfs2_release_clusters(handle, - main_bm_inode, - main_bm_bh, blkno, - count); - if (status < 0) - mlog_errno(status); - } - bail: if (status) mlog_errno(status); _ Patches currently in -mm which might be from heming.zhao(a)suse.com are ocfs2-revert-ocfs2-fix-the-la-space-leak-when-unmounting-an-ocfs2-volume.patch ocfs2-fix-the-space-leak-in-la-when-releasing-la.patch

4 months, 4 weeks

1
0
0 0

+ selftests-memfd-run-sysctl-tests-when-pid-namespace-support-is-enabled.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: selftests/memfd: run sysctl tests when PID namespace support is enabled has been added to the -mm mm-hotfixes-unstable branch. Its filename is selftests-memfd-run-sysctl-tests-when-pid-namespace-support-is-enabled.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: "Isaac J. Manjarres" <isaacmanjarres(a)google.com> Subject: selftests/memfd: run sysctl tests when PID namespace support is enabled Date: Thu, 5 Dec 2024 11:29:41 -0800 The sysctl tests for vm.memfd_noexec rely on the kernel to support PID namespaces (i.e. the kernel is built with CONFIG_PID_NS=y). If the kernel the test runs on does not support PID namespaces, the first sysctl test will fail when attempting to spawn a new thread in a new PID namespace, abort the test, preventing the remaining tests from being run. This is not desirable, as not all kernels need PID namespaces, but can still use the other features provided by memfd. Therefore, only run the sysctl tests if the kernel supports PID namespaces. Otherwise, skip those tests and emit an informative message to let the user know why the sysctl tests are not being run. Link: https://lkml.kernel.org/r/20241205192943.3228757-1-isaacmanjarres@google.com Fixes: 11f75a01448f ("selftests/memfd: add tests for MFD_NOEXEC_SEAL MFD_EXEC") Signed-off-by: Isaac J. Manjarres <isaacmanjarres(a)google.com> Reviewed-by: Jeff Xu <jeffxu(a)google.com> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Kalesh Singh <kaleshsingh(a)google.com> Cc: <stable(a)vger.kernel.org> [6.6+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- tools/testing/selftests/memfd/memfd_test.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) --- a/tools/testing/selftests/memfd/memfd_test.c~selftests-memfd-run-sysctl-tests-when-pid-namespace-support-is-enabled +++ a/tools/testing/selftests/memfd/memfd_test.c @@ -9,6 +9,7 @@ #include <fcntl.h> #include <linux/memfd.h> #include <sched.h> +#include <stdbool.h> #include <stdio.h> #include <stdlib.h> #include <signal.h> @@ -1599,6 +1600,11 @@ static void test_share_fork(char *banner close(fd); } +static bool pid_ns_supported(void) +{ + return access("/proc/self/ns/pid", F_OK) == 0; +} + int main(int argc, char **argv) { pid_t pid; @@ -1634,8 +1640,12 @@ int main(int argc, char **argv) test_seal_grow(); test_seal_resize(); - test_sysctl_simple(); - test_sysctl_nested(); + if (pid_ns_supported()) { + test_sysctl_simple(); + test_sysctl_nested(); + } else { + printf("PID namespaces are not supported; skipping sysctl tests\n"); + } test_share_dup("SHARE-DUP", ""); test_share_mmap("SHARE-MMAP", ""); _ Patches currently in -mm which might be from isaacmanjarres(a)google.com are selftests-memfd-run-sysctl-tests-when-pid-namespace-support-is-enabled.patch

4 months, 4 weeks

1
0
0 0

[PATCH bpf v2 1/1] selftests/bpf: Actuate tx_metadata_len in xdp_hw_metadata

by Song Yoong Siang

set XDP_UMEM_TX_METADATA_LEN flag to reserve tx_metadata_len bytes of per-chunk metadata. Fixes: d5e726d9143c ("xsk: Require XDP_UMEM_TX_METADATA_LEN to actuate tx_metadata_len") Cc: stable(a)vger.kernel.org # v6.11 Signed-off-by: Song Yoong Siang <yoong.siang.song(a)intel.com> Acked-by: Stanislav Fomichev <sdf(a)fomichev.me> --- v1: https://patchwork.kernel.org/project/netdevbpf/patch/20241204115715.3148412… v1->v2 changelog: - Add Fixes tag (Stanislav). - Add stable(a)vger.kernel.org in email cc list. - Separate the patch into two, current one submit to bpf, another one submit to bpf-next. - Update the commit title. --- tools/testing/selftests/bpf/xdp_hw_metadata.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/testing/selftests/bpf/xdp_hw_metadata.c b/tools/testing/selftests/bpf/xdp_hw_metadata.c index 6f9956eed797..ad6c08dfd6c8 100644 --- a/tools/testing/selftests/bpf/xdp_hw_metadata.c +++ b/tools/testing/selftests/bpf/xdp_hw_metadata.c @@ -79,7 +79,7 @@ static int open_xsk(int ifindex, struct xsk *xsk, __u32 queue_id) .fill_size = XSK_RING_PROD__DEFAULT_NUM_DESCS, .comp_size = XSK_RING_CONS__DEFAULT_NUM_DESCS, .frame_size = XSK_UMEM__DEFAULT_FRAME_SIZE, - .flags = XSK_UMEM__DEFAULT_FLAGS, + .flags = XDP_UMEM_TX_METADATA_LEN, .tx_metadata_len = sizeof(struct xsk_tx_metadata), }; __u32 idx = 0; -- 2.34.1

4 months, 4 weeks

2
1
0 0

[PATCH 6.1.y 1/3] KVM: arm64: vgic-its: Add a data length check in vgic_its_save_*

by Jing Zhang

commit 7fe28d7e68f92cc3d0668b8f2fbdf5c303ac3022 upstream. In all the vgic_its_save_*() functinos, they do not check whether the data length is 8 bytes before calling vgic_write_guest_lock. This patch adds the check. To prevent the kernel from being blown up when the fault occurs, KVM_BUG_ON() is used. And the other BUG_ON()s are replaced together. Cc: stable(a)vger.kernel.org Signed-off-by: Kunkun Jiang <jiangkunkun(a)huawei.com> [Jing: Update with the new entry read/write helpers] Signed-off-by: Jing Zhang <jingzhangos(a)google.com> Link: https://lore.kernel.org/r/20241107214137.428439-4-jingzhangos@google.com Signed-off-by: Oliver Upton <oliver.upton(a)linux.dev> --- arch/arm64/kvm/vgic/vgic-its.c | 20 ++++++++------------ arch/arm64/kvm/vgic/vgic.h | 24 ++++++++++++++++++++++++ 2 files changed, 32 insertions(+), 12 deletions(-) diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c index 092327665a6e..84499545bd8d 100644 --- a/arch/arm64/kvm/vgic/vgic-its.c +++ b/arch/arm64/kvm/vgic/vgic-its.c @@ -2207,7 +2207,6 @@ static int scan_its_table(struct vgic_its *its, gpa_t base, int size, u32 esz, static int vgic_its_save_ite(struct vgic_its *its, struct its_device *dev, struct its_ite *ite, gpa_t gpa, int ite_esz) { - struct kvm *kvm = its->dev->kvm; u32 next_offset; u64 val; @@ -2216,7 +2215,8 @@ static int vgic_its_save_ite(struct vgic_its *its, struct its_device *dev, ((u64)ite->irq->intid << KVM_ITS_ITE_PINTID_SHIFT) | ite->collection->collection_id; val = cpu_to_le64(val); - return kvm_write_guest_lock(kvm, gpa, &val, ite_esz); + + return vgic_its_write_entry_lock(its, gpa, val, ite_esz); } /** @@ -2357,7 +2357,6 @@ static int vgic_its_restore_itt(struct vgic_its *its, struct its_device *dev) static int vgic_its_save_dte(struct vgic_its *its, struct its_device *dev, gpa_t ptr, int dte_esz) { - struct kvm *kvm = its->dev->kvm; u64 val, itt_addr_field; u32 next_offset; @@ -2368,7 +2367,8 @@ static int vgic_its_save_dte(struct vgic_its *its, struct its_device *dev, (itt_addr_field << KVM_ITS_DTE_ITTADDR_SHIFT) | (dev->num_eventid_bits - 1)); val = cpu_to_le64(val); - return kvm_write_guest_lock(kvm, ptr, &val, dte_esz); + + return vgic_its_write_entry_lock(its, ptr, val, dte_esz); } /** @@ -2555,7 +2555,8 @@ static int vgic_its_save_cte(struct vgic_its *its, ((u64)collection->target_addr << KVM_ITS_CTE_RDBASE_SHIFT) | collection->collection_id); val = cpu_to_le64(val); - return kvm_write_guest_lock(its->dev->kvm, gpa, &val, esz); + + return vgic_its_write_entry_lock(its, gpa, val, esz); } /* @@ -2571,8 +2572,7 @@ static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz) u64 val; int ret; - BUG_ON(esz > sizeof(val)); - ret = kvm_read_guest_lock(kvm, gpa, &val, esz); + ret = vgic_its_read_entry_lock(its, gpa, &val, esz); if (ret) return ret; val = le64_to_cpu(val); @@ -2610,7 +2610,6 @@ static int vgic_its_save_collection_table(struct vgic_its *its) u64 baser = its->baser_coll_table; gpa_t gpa = GITS_BASER_ADDR_48_to_52(baser); struct its_collection *collection; - u64 val; size_t max_size, filled = 0; int ret, cte_esz = abi->cte_esz; @@ -2634,10 +2633,7 @@ static int vgic_its_save_collection_table(struct vgic_its *its) * table is not fully filled, add a last dummy element * with valid bit unset */ - val = 0; - BUG_ON(cte_esz > sizeof(val)); - ret = kvm_write_guest_lock(its->dev->kvm, gpa, &val, cte_esz); - return ret; + return vgic_its_write_entry_lock(its, gpa, 0, cte_esz); } /** diff --git a/arch/arm64/kvm/vgic/vgic.h b/arch/arm64/kvm/vgic/vgic.h index bc898229167b..056fcee46165 100644 --- a/arch/arm64/kvm/vgic/vgic.h +++ b/arch/arm64/kvm/vgic/vgic.h @@ -6,6 +6,7 @@ #define __KVM_ARM_VGIC_NEW_H__ #include <linux/irqchip/arm-gic-common.h> +#include <asm/kvm_mmu.h> #define PRODUCT_ID_KVM 0x4b /* ASCII code K */ #define IMPLEMENTER_ARM 0x43b @@ -131,6 +132,29 @@ static inline bool vgic_irq_is_multi_sgi(struct vgic_irq *irq) return vgic_irq_get_lr_count(irq) > 1; } +static inline int vgic_its_read_entry_lock(struct vgic_its *its, gpa_t eaddr, + u64 *eval, unsigned long esize) +{ + struct kvm *kvm = its->dev->kvm; + + if (KVM_BUG_ON(esize != sizeof(*eval), kvm)) + return -EINVAL; + + return kvm_read_guest_lock(kvm, eaddr, eval, esize); + +} + +static inline int vgic_its_write_entry_lock(struct vgic_its *its, gpa_t eaddr, + u64 eval, unsigned long esize) +{ + struct kvm *kvm = its->dev->kvm; + + if (KVM_BUG_ON(esize != sizeof(eval), kvm)) + return -EINVAL; + + return kvm_write_guest_lock(kvm, eaddr, &eval, esize); +} + /* * This struct provides an intermediate representation of the fields contained * in the GICH_VMCR and ICH_VMCR registers, such that code exporting the GIC base-commit: e4d90d63d385228b1e0bcf31cc15539bbbc28f7f -- 2.47.0.338.g60cca15819-goog

4 months, 4 weeks

3
6
0 0

[PATCH 5.15.y 1/3] KVM: arm64: vgic-its: Add a data length check in vgic_its_save_*

by Jing Zhang

commit 7fe28d7e68f92cc3d0668b8f2fbdf5c303ac3022 upstream. In all the vgic_its_save_*() functinos, they do not check whether the data length is 8 bytes before calling vgic_write_guest_lock. This patch adds the check. To prevent the kernel from being blown up when the fault occurs, KVM_BUG_ON() is used. And the other BUG_ON()s are replaced together. Cc: stable(a)vger.kernel.org Signed-off-by: Kunkun Jiang <jiangkunkun(a)huawei.com> [Jing: Update with the new entry read/write helpers] Signed-off-by: Jing Zhang <jingzhangos(a)google.com> Link: https://lore.kernel.org/r/20241107214137.428439-4-jingzhangos@google.com Signed-off-by: Oliver Upton <oliver.upton(a)linux.dev> --- arch/arm64/kvm/vgic/vgic-its.c | 20 ++++++++------------ arch/arm64/kvm/vgic/vgic.h | 24 ++++++++++++++++++++++++ 2 files changed, 32 insertions(+), 12 deletions(-) diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c index 02ab6ab6ba91..bff7c49dfda5 100644 --- a/arch/arm64/kvm/vgic/vgic-its.c +++ b/arch/arm64/kvm/vgic/vgic-its.c @@ -2135,7 +2135,6 @@ static int scan_its_table(struct vgic_its *its, gpa_t base, int size, u32 esz, static int vgic_its_save_ite(struct vgic_its *its, struct its_device *dev, struct its_ite *ite, gpa_t gpa, int ite_esz) { - struct kvm *kvm = its->dev->kvm; u32 next_offset; u64 val; @@ -2144,7 +2143,8 @@ static int vgic_its_save_ite(struct vgic_its *its, struct its_device *dev, ((u64)ite->irq->intid << KVM_ITS_ITE_PINTID_SHIFT) | ite->collection->collection_id; val = cpu_to_le64(val); - return kvm_write_guest_lock(kvm, gpa, &val, ite_esz); + + return vgic_its_write_entry_lock(its, gpa, val, ite_esz); } /** @@ -2280,7 +2280,6 @@ static int vgic_its_restore_itt(struct vgic_its *its, struct its_device *dev) static int vgic_its_save_dte(struct vgic_its *its, struct its_device *dev, gpa_t ptr, int dte_esz) { - struct kvm *kvm = its->dev->kvm; u64 val, itt_addr_field; u32 next_offset; @@ -2291,7 +2290,8 @@ static int vgic_its_save_dte(struct vgic_its *its, struct its_device *dev, (itt_addr_field << KVM_ITS_DTE_ITTADDR_SHIFT) | (dev->num_eventid_bits - 1)); val = cpu_to_le64(val); - return kvm_write_guest_lock(kvm, ptr, &val, dte_esz); + + return vgic_its_write_entry_lock(its, ptr, val, dte_esz); } /** @@ -2471,7 +2471,8 @@ static int vgic_its_save_cte(struct vgic_its *its, ((u64)collection->target_addr << KVM_ITS_CTE_RDBASE_SHIFT) | collection->collection_id); val = cpu_to_le64(val); - return kvm_write_guest_lock(its->dev->kvm, gpa, &val, esz); + + return vgic_its_write_entry_lock(its, gpa, val, esz); } static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz) @@ -2482,8 +2483,7 @@ static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz) u64 val; int ret; - BUG_ON(esz > sizeof(val)); - ret = kvm_read_guest_lock(kvm, gpa, &val, esz); + ret = vgic_its_read_entry_lock(its, gpa, &val, esz); if (ret) return ret; val = le64_to_cpu(val); @@ -2517,7 +2517,6 @@ static int vgic_its_save_collection_table(struct vgic_its *its) u64 baser = its->baser_coll_table; gpa_t gpa = GITS_BASER_ADDR_48_to_52(baser); struct its_collection *collection; - u64 val; size_t max_size, filled = 0; int ret, cte_esz = abi->cte_esz; @@ -2541,10 +2540,7 @@ static int vgic_its_save_collection_table(struct vgic_its *its) * table is not fully filled, add a last dummy element * with valid bit unset */ - val = 0; - BUG_ON(cte_esz > sizeof(val)); - ret = kvm_write_guest_lock(its->dev->kvm, gpa, &val, cte_esz); - return ret; + return vgic_its_write_entry_lock(its, gpa, 0, cte_esz); } /** diff --git a/arch/arm64/kvm/vgic/vgic.h b/arch/arm64/kvm/vgic/vgic.h index 2be4b0759f5b..d2fc5ecb223e 100644 --- a/arch/arm64/kvm/vgic/vgic.h +++ b/arch/arm64/kvm/vgic/vgic.h @@ -6,6 +6,7 @@ #define __KVM_ARM_VGIC_NEW_H__ #include <linux/irqchip/arm-gic-common.h> +#include <asm/kvm_mmu.h> #define PRODUCT_ID_KVM 0x4b /* ASCII code K */ #define IMPLEMENTER_ARM 0x43b @@ -126,6 +127,29 @@ static inline bool vgic_irq_is_multi_sgi(struct vgic_irq *irq) return vgic_irq_get_lr_count(irq) > 1; } +static inline int vgic_its_read_entry_lock(struct vgic_its *its, gpa_t eaddr, + u64 *eval, unsigned long esize) +{ + struct kvm *kvm = its->dev->kvm; + + if (KVM_BUG_ON(esize != sizeof(*eval), kvm)) + return -EINVAL; + + return kvm_read_guest_lock(kvm, eaddr, eval, esize); + +} + +static inline int vgic_its_write_entry_lock(struct vgic_its *its, gpa_t eaddr, + u64 eval, unsigned long esize) +{ + struct kvm *kvm = its->dev->kvm; + + if (KVM_BUG_ON(esize != sizeof(eval), kvm)) + return -EINVAL; + + return kvm_write_guest_lock(kvm, eaddr, &eval, esize); +} + /* * This struct provides an intermediate representation of the fields contained * in the GICH_VMCR and ICH_VMCR registers, such that code exporting the GIC base-commit: 0a51d2d4527b43c5e467ffa6897deefeaf499358 -- 2.47.0.338.g60cca15819-goog

4 months, 4 weeks

3
6
0 0

[PATCH 5.10.y 1/3] KVM: arm64: vgic-its: Add a data length check in vgic_its_save_*

by Jing Zhang

commit 7fe28d7e68f92cc3d0668b8f2fbdf5c303ac3022 upstream. In all the vgic_its_save_*() functinos, they do not check whether the data length is 8 bytes before calling vgic_write_guest_lock. This patch adds the check. To prevent the kernel from being blown up when the fault occurs, KVM_BUG_ON() is used. And the other BUG_ON()s are replaced together. Cc: stable(a)vger.kernel.org Signed-off-by: Kunkun Jiang <jiangkunkun(a)huawei.com> [Jing: Update with the new entry read/write helpers] Signed-off-by: Jing Zhang <jingzhangos(a)google.com> Link: https://lore.kernel.org/r/20241107214137.428439-4-jingzhangos@google.com Signed-off-by: Oliver Upton <oliver.upton(a)linux.dev> --- arch/arm64/kvm/vgic/vgic-its.c | 20 ++++++++------------ arch/arm64/kvm/vgic/vgic.h | 24 ++++++++++++++++++++++++ 2 files changed, 32 insertions(+), 12 deletions(-) diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c index 93c0365cdd7b..d3ea81d947b7 100644 --- a/arch/arm64/kvm/vgic/vgic-its.c +++ b/arch/arm64/kvm/vgic/vgic-its.c @@ -2135,7 +2135,6 @@ static int scan_its_table(struct vgic_its *its, gpa_t base, int size, u32 esz, static int vgic_its_save_ite(struct vgic_its *its, struct its_device *dev, struct its_ite *ite, gpa_t gpa, int ite_esz) { - struct kvm *kvm = its->dev->kvm; u32 next_offset; u64 val; @@ -2144,7 +2143,8 @@ static int vgic_its_save_ite(struct vgic_its *its, struct its_device *dev, ((u64)ite->irq->intid << KVM_ITS_ITE_PINTID_SHIFT) | ite->collection->collection_id; val = cpu_to_le64(val); - return kvm_write_guest_lock(kvm, gpa, &val, ite_esz); + + return vgic_its_write_entry_lock(its, gpa, val, ite_esz); } /** @@ -2280,7 +2280,6 @@ static int vgic_its_restore_itt(struct vgic_its *its, struct its_device *dev) static int vgic_its_save_dte(struct vgic_its *its, struct its_device *dev, gpa_t ptr, int dte_esz) { - struct kvm *kvm = its->dev->kvm; u64 val, itt_addr_field; u32 next_offset; @@ -2291,7 +2290,8 @@ static int vgic_its_save_dte(struct vgic_its *its, struct its_device *dev, (itt_addr_field << KVM_ITS_DTE_ITTADDR_SHIFT) | (dev->num_eventid_bits - 1)); val = cpu_to_le64(val); - return kvm_write_guest_lock(kvm, ptr, &val, dte_esz); + + return vgic_its_write_entry_lock(its, ptr, val, dte_esz); } /** @@ -2471,7 +2471,8 @@ static int vgic_its_save_cte(struct vgic_its *its, ((u64)collection->target_addr << KVM_ITS_CTE_RDBASE_SHIFT) | collection->collection_id); val = cpu_to_le64(val); - return kvm_write_guest_lock(its->dev->kvm, gpa, &val, esz); + + return vgic_its_write_entry_lock(its, gpa, val, esz); } static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz) @@ -2482,8 +2483,7 @@ static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz) u64 val; int ret; - BUG_ON(esz > sizeof(val)); - ret = kvm_read_guest_lock(kvm, gpa, &val, esz); + ret = vgic_its_read_entry_lock(its, gpa, &val, esz); if (ret) return ret; val = le64_to_cpu(val); @@ -2517,7 +2517,6 @@ static int vgic_its_save_collection_table(struct vgic_its *its) u64 baser = its->baser_coll_table; gpa_t gpa = GITS_BASER_ADDR_48_to_52(baser); struct its_collection *collection; - u64 val; size_t max_size, filled = 0; int ret, cte_esz = abi->cte_esz; @@ -2541,10 +2540,7 @@ static int vgic_its_save_collection_table(struct vgic_its *its) * table is not fully filled, add a last dummy element * with valid bit unset */ - val = 0; - BUG_ON(cte_esz > sizeof(val)); - ret = kvm_write_guest_lock(its->dev->kvm, gpa, &val, cte_esz); - return ret; + return vgic_its_write_entry_lock(its, gpa, 0, cte_esz); } /** diff --git a/arch/arm64/kvm/vgic/vgic.h b/arch/arm64/kvm/vgic/vgic.h index 3d7fa7ef353e..db99a1b167d8 100644 --- a/arch/arm64/kvm/vgic/vgic.h +++ b/arch/arm64/kvm/vgic/vgic.h @@ -6,6 +6,7 @@ #define __KVM_ARM_VGIC_NEW_H__ #include <linux/irqchip/arm-gic-common.h> +#include <asm/kvm_mmu.h> #define PRODUCT_ID_KVM 0x4b /* ASCII code K */ #define IMPLEMENTER_ARM 0x43b @@ -126,6 +127,29 @@ static inline bool vgic_irq_is_multi_sgi(struct vgic_irq *irq) return vgic_irq_get_lr_count(irq) > 1; } +static inline int vgic_its_read_entry_lock(struct vgic_its *its, gpa_t eaddr, + u64 *eval, unsigned long esize) +{ + struct kvm *kvm = its->dev->kvm; + + if (KVM_BUG_ON(esize != sizeof(*eval), kvm)) + return -EINVAL; + + return kvm_read_guest_lock(kvm, eaddr, eval, esize); + +} + +static inline int vgic_its_write_entry_lock(struct vgic_its *its, gpa_t eaddr, + u64 eval, unsigned long esize) +{ + struct kvm *kvm = its->dev->kvm; + + if (KVM_BUG_ON(esize != sizeof(eval), kvm)) + return -EINVAL; + + return kvm_write_guest_lock(kvm, eaddr, &eval, esize); +} + /* * This struct provides an intermediate representation of the fields contained * in the GICH_VMCR and ICH_VMCR registers, such that code exporting the GIC base-commit: 711d99f845cdb587b7d7cf5e56c289c3d96d27c5 -- 2.47.0.338.g60cca15819-goog

4 months, 4 weeks

3
6
0 0

[PATCH 5.4.y 1/3] KVM: arm64: vgic-its: Add a data length check in vgic_its_save_*

by Jing Zhang

commit 7fe28d7e68f92cc3d0668b8f2fbdf5c303ac3022 upstream. In all the vgic_its_save_*() functinos, they do not check whether the data length is 8 bytes before calling vgic_write_guest_lock. This patch adds the check. To prevent the kernel from being blown up when the fault occurs, KVM_BUG_ON() is used. And the other BUG_ON()s are replaced together. Cc: stable(a)vger.kernel.org Signed-off-by: Kunkun Jiang <jiangkunkun(a)huawei.com> [Jing: Update with the new entry read/write helpers] Signed-off-by: Jing Zhang <jingzhangos(a)google.com> Link: https://lore.kernel.org/r/20241107214137.428439-4-jingzhangos@google.com Signed-off-by: Oliver Upton <oliver.upton(a)linux.dev> --- virt/kvm/arm/vgic/vgic-its.c | 20 ++++++++------------ virt/kvm/arm/vgic/vgic.h | 24 ++++++++++++++++++++++++ 2 files changed, 32 insertions(+), 12 deletions(-) diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c index f4ce08c0d0be..f091d4c9120a 100644 --- a/virt/kvm/arm/vgic/vgic-its.c +++ b/virt/kvm/arm/vgic/vgic-its.c @@ -2134,7 +2134,6 @@ static int scan_its_table(struct vgic_its *its, gpa_t base, int size, u32 esz, static int vgic_its_save_ite(struct vgic_its *its, struct its_device *dev, struct its_ite *ite, gpa_t gpa, int ite_esz) { - struct kvm *kvm = its->dev->kvm; u32 next_offset; u64 val; @@ -2143,7 +2142,8 @@ static int vgic_its_save_ite(struct vgic_its *its, struct its_device *dev, ((u64)ite->irq->intid << KVM_ITS_ITE_PINTID_SHIFT) | ite->collection->collection_id; val = cpu_to_le64(val); - return kvm_write_guest_lock(kvm, gpa, &val, ite_esz); + + return vgic_its_write_entry_lock(its, gpa, val, ite_esz); } /** @@ -2279,7 +2279,6 @@ static int vgic_its_restore_itt(struct vgic_its *its, struct its_device *dev) static int vgic_its_save_dte(struct vgic_its *its, struct its_device *dev, gpa_t ptr, int dte_esz) { - struct kvm *kvm = its->dev->kvm; u64 val, itt_addr_field; u32 next_offset; @@ -2290,7 +2289,8 @@ static int vgic_its_save_dte(struct vgic_its *its, struct its_device *dev, (itt_addr_field << KVM_ITS_DTE_ITTADDR_SHIFT) | (dev->num_eventid_bits - 1)); val = cpu_to_le64(val); - return kvm_write_guest_lock(kvm, ptr, &val, dte_esz); + + return vgic_its_write_entry_lock(its, ptr, val, dte_esz); } /** @@ -2470,7 +2470,8 @@ static int vgic_its_save_cte(struct vgic_its *its, ((u64)collection->target_addr << KVM_ITS_CTE_RDBASE_SHIFT) | collection->collection_id); val = cpu_to_le64(val); - return kvm_write_guest_lock(its->dev->kvm, gpa, &val, esz); + + return vgic_its_write_entry_lock(its, gpa, val, esz); } static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz) @@ -2481,8 +2482,7 @@ static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz) u64 val; int ret; - BUG_ON(esz > sizeof(val)); - ret = kvm_read_guest_lock(kvm, gpa, &val, esz); + ret = vgic_its_read_entry_lock(its, gpa, &val, esz); if (ret) return ret; val = le64_to_cpu(val); @@ -2516,7 +2516,6 @@ static int vgic_its_save_collection_table(struct vgic_its *its) u64 baser = its->baser_coll_table; gpa_t gpa = GITS_BASER_ADDR_48_to_52(baser); struct its_collection *collection; - u64 val; size_t max_size, filled = 0; int ret, cte_esz = abi->cte_esz; @@ -2540,10 +2539,7 @@ static int vgic_its_save_collection_table(struct vgic_its *its) * table is not fully filled, add a last dummy element * with valid bit unset */ - val = 0; - BUG_ON(cte_esz > sizeof(val)); - ret = kvm_write_guest_lock(its->dev->kvm, gpa, &val, cte_esz); - return ret; + return vgic_its_write_entry_lock(its, gpa, 0, cte_esz); } /** diff --git a/virt/kvm/arm/vgic/vgic.h b/virt/kvm/arm/vgic/vgic.h index 83066a81b16a..ac553f9171a6 100644 --- a/virt/kvm/arm/vgic/vgic.h +++ b/virt/kvm/arm/vgic/vgic.h @@ -6,6 +6,7 @@ #define __KVM_ARM_VGIC_NEW_H__ #include <linux/irqchip/arm-gic-common.h> +#include <asm/kvm_mmu.h> #define PRODUCT_ID_KVM 0x4b /* ASCII code K */ #define IMPLEMENTER_ARM 0x43b @@ -126,6 +127,29 @@ static inline bool vgic_irq_is_multi_sgi(struct vgic_irq *irq) return vgic_irq_get_lr_count(irq) > 1; } +static inline int vgic_its_read_entry_lock(struct vgic_its *its, gpa_t eaddr, + u64 *eval, unsigned long esize) +{ + struct kvm *kvm = its->dev->kvm; + + if (KVM_BUG_ON(esize != sizeof(*eval), kvm)) + return -EINVAL; + + return kvm_read_guest_lock(kvm, eaddr, eval, esize); + +} + +static inline int vgic_its_write_entry_lock(struct vgic_its *its, gpa_t eaddr, + u64 eval, unsigned long esize) +{ + struct kvm *kvm = its->dev->kvm; + + if (KVM_BUG_ON(esize != sizeof(eval), kvm)) + return -EINVAL; + + return kvm_write_guest_lock(kvm, eaddr, &eval, esize); +} + /* * This struct provides an intermediate representation of the fields contained * in the GICH_VMCR and ICH_VMCR registers, such that code exporting the GIC base-commit: cd5b619ac41b6b1a8167380ca6655df7ccf5b5eb -- 2.47.0.338.g60cca15819-goog

4 months, 4 weeks

3
6
0 0

[PATCH net-next v3 0/7] virtio_net: correct netdev_tx_reset_queue() invocation points

by Koichiro Den

When virtnet_close is followed by virtnet_open, some TX completions can possibly remain unconsumed, until they are finally processed during the first NAPI poll after the netdev_tx_reset_queue(), resulting in a crash [1]. Commit b96ed2c97c79 ("virtio_net: move netdev_tx_reset_queue() call before RX napi enable") was not sufficient to eliminate all BQL crash cases for virtio-net. This issue can be reproduced with the latest net-next master by running: `while :; do ip l set DEV down; ip l set DEV up; done` under heavy network TX load from inside the machine. This patch series resolves the issue and also addresses similar existing problems: (a). Drop netdev_tx_reset_queue() from open/close path. This eliminates the BQL crashes due to the problematic open/close path. (b). As a result of (a), netdev_tx_reset_queue() is now explicitly required in freeze/restore path. Add netdev_tx_reset_queue() to free_unused_bufs(). (c). Fix missing resetting in virtnet_tx_resize(). virtnet_tx_resize() has lacked proper resetting since commit c8bd1f7f3e61 ("virtio_net: add support for Byte Queue Limits"). (d). Fix missing resetting in the XDP_SETUP_XSK_POOL path. Similar to (c), this path lacked proper resetting. Call netdev_tx_reset_queue() when virtqueue_reset() has actually recycled unused buffers. This patch series consists of five commits: [1/7]: Resolves (a) and (b). [2/7[: Minor fix to make [3/7] streamlined. [3/7]: Prerequisite for (c) and (d). [4/7]: Prerequisite for (c). [5/7]: Resolves (c). [6/7]: Preresuisite for (d). [7/7]: Resolves (d). Changes for v3: - replace 'flushed' argument with 'recycle_done' Changes for v2: - add tx queue resetting for (b) to (d) above v2: https://lore.kernel.org/all/20241203073025.67065-1-koichiro.den@canonical.c… v1: https://lore.kernel.org/all/20241130181744.3772632-1-koichiro.den@canonical… [1]: ------------[ cut here ]------------ kernel BUG at lib/dynamic_queue_limits.c:99! Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 7 UID: 0 PID: 1598 Comm: ip Tainted: G N 6.12.0net-next_main+ #2 Tainted: [N]=TEST Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), \ BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:dql_completed+0x26b/0x290 Code: b7 c2 49 89 e9 44 89 da 89 c6 4c 89 d7 e8 ed 17 47 00 58 65 ff 0d 4d 27 90 7e 0f 85 fd fe ff ff e8 ea 53 8d ff e9 f3 fe ff ff <0f> 0b 01 d2 44 89 d1 29 d1 ba 00 00 00 00 0f 48 ca e9 28 ff ff ff RSP: 0018:ffffc900002b0d08 EFLAGS: 00010297 RAX: 0000000000000000 RBX: ffff888102398c80 RCX: 0000000080190009 RDX: 0000000000000000 RSI: 000000000000006a RDI: 0000000000000000 RBP: ffff888102398c00 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000000000ca R11: 0000000000015681 R12: 0000000000000001 R13: ffffc900002b0d68 R14: ffff88811115e000 R15: ffff8881107aca40 FS: 00007f41ded69500(0000) GS:ffff888667dc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000556ccc2dc1a0 CR3: 0000000104fd8003 CR4: 0000000000772ef0 PKRU: 55555554 Call Trace: <IRQ> ? die+0x32/0x80 ? do_trap+0xd9/0x100 ? dql_completed+0x26b/0x290 ? dql_completed+0x26b/0x290 ? do_error_trap+0x6d/0xb0 ? dql_completed+0x26b/0x290 ? exc_invalid_op+0x4c/0x60 ? dql_completed+0x26b/0x290 ? asm_exc_invalid_op+0x16/0x20 ? dql_completed+0x26b/0x290 __free_old_xmit+0xff/0x170 [virtio_net] free_old_xmit+0x54/0xc0 [virtio_net] virtnet_poll+0xf4/0xe30 [virtio_net] ? __update_load_avg_cfs_rq+0x264/0x2d0 ? update_curr+0x35/0x260 ? reweight_entity+0x1be/0x260 __napi_poll.constprop.0+0x28/0x1c0 net_rx_action+0x329/0x420 ? enqueue_hrtimer+0x35/0x90 ? trace_hardirqs_on+0x1d/0x80 ? kvm_sched_clock_read+0xd/0x20 ? sched_clock+0xc/0x30 ? kvm_sched_clock_read+0xd/0x20 ? sched_clock+0xc/0x30 ? sched_clock_cpu+0xd/0x1a0 handle_softirqs+0x138/0x3e0 do_softirq.part.0+0x89/0xc0 </IRQ> <TASK> __local_bh_enable_ip+0xa7/0xb0 virtnet_open+0xc8/0x310 [virtio_net] __dev_open+0xfa/0x1b0 __dev_change_flags+0x1de/0x250 dev_change_flags+0x22/0x60 do_setlink.isra.0+0x2df/0x10b0 ? rtnetlink_rcv_msg+0x34f/0x3f0 ? netlink_rcv_skb+0x54/0x100 ? netlink_unicast+0x23e/0x390 ? netlink_sendmsg+0x21e/0x490 ? ____sys_sendmsg+0x31b/0x350 ? avc_has_perm_noaudit+0x67/0xf0 ? cred_has_capability.isra.0+0x75/0x110 ? __nla_validate_parse+0x5f/0xee0 ? __pfx___probestub_irq_enable+0x3/0x10 ? __create_object+0x5e/0x90 ? security_capable+0x3b/0x7[I0 rtnl_newlink+0x784/0xaf0 ? avc_has_perm_noaudit+0x67/0xf0 ? cred_has_capability.isra.0+0x75/0x110 ? stack_depot_save_flags+0x24/0x6d0 ? __pfx_rtnl_newlink+0x10/0x10 rtnetlink_rcv_msg+0x34f/0x3f0 ? do_syscall_64+0x6c/0x180 ? entry_SYSCALL_64_after_hwframe+0x76/0x7e ? __pfx_rtnetlink_rcv_msg+0x10/0x10 netlink_rcv_skb+0x54/0x100 netlink_unicast+0x23e/0x390 netlink_sendmsg+0x21e/0x490 ____sys_sendmsg+0x31b/0x350 ? copy_msghdr_from_user+0x6d/0xa0 ___sys_sendmsg+0x86/0xd0 ? __pte_offset_map+0x17/0x160 ? preempt_count_add+0x69/0xa0 ? __call_rcu_common.constprop.0+0x147/0x610 ? preempt_count_add+0x69/0xa0 ? preempt_count_add+0x69/0xa0 ? _raw_spin_trylock+0x13/0x60 ? trace_hardirqs_on+0x1d/0x80 __sys_sendmsg+0x66/0xc0 do_syscall_64+0x6c/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f41defe5b34 Code: 15 e1 12 0f 00 f7 d8 64 89 02 b8 ff ff ff ff eb bf 0f 1f 44 00 00 f3 0f 1e fa 80 3d 35 95 0f 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 4c c3 0f 1f 00 55 48 89 e5 48 83 ec 20 89 55 RSP: 002b:00007ffe5336ecc8 EFLAGS: 00000202 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f41defe5b34 RDX: 0000000000000000 RSI: 00007ffe5336ed30 RDI: 0000000000000003 RBP: 00007ffe5336eda0 R08: 0000000000000010 R09: 0000000000000001 R10: 00007ffe5336f6f9 R11: 0000000000000202 R12: 0000000000000003 R13: 0000000067452259 R14: 0000556ccc28b040 R15: 0000000000000000 </TASK> [...] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- Koichiro Den (7): virtio_net: correct netdev_tx_reset_queue() invocation point virtio_ring: add a func argument 'recycle_done' to virtqueue_resize() virtio_net: replace vq2rxq with vq2txq where appropriate virtio_net: introduce virtnet_sq_free_unused_buf_done() virtio_net: ensure netdev_tx_reset_queue is called on tx ring resize virtio_ring: add a func argument 'recycle_done' to virtqueue_reset() virtio_net: ensure netdev_tx_reset_queue is called on bind xsk for tx drivers/net/virtio_net.c | 23 +++++++++++++++++------ drivers/virtio/virtio_ring.c | 12 ++++++++++-- include/linux/virtio.h | 6 ++++-- 3 files changed, 31 insertions(+), 10 deletions(-) -- 2.43.0

4 months, 4 weeks

4
25
0 0

[PATCH AUTOSEL 6.12 01/15] usb: chipidea: add CI_HDRC_HAS_SHORT_PKT_LIMIT flag

by Sasha Levin

From: Xu Yang <xu.yang_2(a)nxp.com> [ Upstream commit ec841b8d73cff37f8960e209017efe1eb2fb21f2 ] Currently, the imx deivice controller has below limitations: 1. can't generate short packet interrupt if IOC not set in dTD. So if one request span more than one dTDs and only the last dTD set IOC, the usb request will pending there if no more data comes. 2. the controller can't accurately deliver data to differtent usb requests in some cases due to short packet. For example: one usb request span 3 dTDs, then if the controller received a short packet the next packet will go to 2nd dTD of current request rather than the first dTD of next request. 3. can't build a bus packet use multiple dTDs. For example: controller needs to send one packet of 512 bytes use dTD1 (200 bytes) + dTD2 (312 bytes), actually the host side will see 200 bytes short packet. Based on these limits, add CI_HDRC_HAS_SHORT_PKT_LIMIT flag and use it on imx platforms. Signed-off-by: Xu Yang <xu.yang_2(a)nxp.com> Acked-by: Peter Chen <peter.chen(a)kernel.org> Link: https://lore.kernel.org/r/20240923081203.2851768-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/usb/chipidea/ci.h | 1 + drivers/usb/chipidea/ci_hdrc_imx.c | 1 + drivers/usb/chipidea/core.c | 2 ++ include/linux/usb/chipidea.h | 1 + 4 files changed, 5 insertions(+) diff --git a/drivers/usb/chipidea/ci.h b/drivers/usb/chipidea/ci.h index 2a38e1eb65466..e4b003d060c26 100644 --- a/drivers/usb/chipidea/ci.h +++ b/drivers/usb/chipidea/ci.h @@ -260,6 +260,7 @@ struct ci_hdrc { bool b_sess_valid_event; bool imx28_write_fix; bool has_portsc_pec_bug; + bool has_short_pkt_limit; bool supports_runtime_pm; bool in_lpm; bool wakeup_int; diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c index c64ab0e07ea03..17b3ac2ac8a1e 100644 --- a/drivers/usb/chipidea/ci_hdrc_imx.c +++ b/drivers/usb/chipidea/ci_hdrc_imx.c @@ -342,6 +342,7 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) struct ci_hdrc_platform_data pdata = { .name = dev_name(&pdev->dev), .capoffset = DEF_CAPOFFSET, + .flags = CI_HDRC_HAS_SHORT_PKT_LIMIT, .notify_event = ci_hdrc_imx_notify_event, }; int ret; diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c index 835bf2428dc6e..5aa16dbfc289c 100644 --- a/drivers/usb/chipidea/core.c +++ b/drivers/usb/chipidea/core.c @@ -1076,6 +1076,8 @@ static int ci_hdrc_probe(struct platform_device *pdev) CI_HDRC_SUPPORTS_RUNTIME_PM); ci->has_portsc_pec_bug = !!(ci->platdata->flags & CI_HDRC_HAS_PORTSC_PEC_MISSED); + ci->has_short_pkt_limit = !!(ci->platdata->flags & + CI_HDRC_HAS_SHORT_PKT_LIMIT); platform_set_drvdata(pdev, ci); ret = hw_device_init(ci, base); diff --git a/include/linux/usb/chipidea.h b/include/linux/usb/chipidea.h index 5a7f96684ea22..ebdfef124b2bc 100644 --- a/include/linux/usb/chipidea.h +++ b/include/linux/usb/chipidea.h @@ -65,6 +65,7 @@ struct ci_hdrc_platform_data { #define CI_HDRC_PHY_VBUS_CONTROL BIT(16) #define CI_HDRC_HAS_PORTSC_PEC_MISSED BIT(17) #define CI_HDRC_FORCE_VBUS_ACTIVE_ALWAYS BIT(18) +#define CI_HDRC_HAS_SHORT_PKT_LIMIT BIT(19) enum usb_dr_mode dr_mode; #define CI_HDRC_CONTROLLER_RESET_EVENT 0 #define CI_HDRC_CONTROLLER_STOPPED_EVENT 1 -- 2.43.0

4 months, 4 weeks

2
16
0 0

[PATCH AUTOSEL 6.6 01/10] usb: chipidea: udc: create bounce buffer for problem sglist entries if possible

by Sasha Levin

From: Xu Yang <xu.yang_2(a)nxp.com> [ Upstream commit edfcc455c85ccc5855f0c329ca5a2d85cc9fc6c6 ] The chipidea controller doesn't fully support sglist, such as it can not transfer data spanned more dTDs to form a bus packet, so it can only work on very limited cases. The limitations as below: 1. the end address of the first sg buffer must be 4KB aligned. 2. the start and end address of the middle sg buffer must be 4KB aligned. 3. the start address of the first sg buffer must be 4KB aligned. However, not all the use cases violate these limitations. To make the controller compatible with most of the cases, this will try to bounce the problem sglist entries which can be found by sglist_get_invalid_entry(). Then a bounced line buffer (the size will roundup to page size) will be allocated to replace the remaining problem sg entries. The data will be copied between problem sg entries and bounce buffer according to the transfer direction. The bounce buffer will be freed when the request completed. Acked-by: Peter Chen <peter.chen(a)kernel.com> Signed-off-by: Xu Yang <xu.yang_2(a)nxp.com> Link: https://lore.kernel.org/r/20240923081203.2851768-3-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/usb/chipidea/udc.c | 148 +++++++++++++++++++++++++++++++++++++ drivers/usb/chipidea/udc.h | 2 + 2 files changed, 150 insertions(+) diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c index f70ceedfb468f..bd409b18d01ba 100644 --- a/drivers/usb/chipidea/udc.c +++ b/drivers/usb/chipidea/udc.c @@ -10,6 +10,7 @@ #include <linux/delay.h> #include <linux/device.h> #include <linux/dmapool.h> +#include <linux/dma-direct.h> #include <linux/err.h> #include <linux/irqreturn.h> #include <linux/kernel.h> @@ -540,6 +541,126 @@ static int prepare_td_for_sg(struct ci_hw_ep *hwep, struct ci_hw_req *hwreq) return ret; } +/* + * Verify if the scatterlist is valid by iterating each sg entry. + * Return invalid sg entry index which is less than num_sgs. + */ +static int sglist_get_invalid_entry(struct device *dma_dev, u8 dir, + struct usb_request *req) +{ + int i; + struct scatterlist *s = req->sg; + + if (req->num_sgs == 1) + return 1; + + dir = dir ? DMA_TO_DEVICE : DMA_FROM_DEVICE; + + for (i = 0; i < req->num_sgs; i++, s = sg_next(s)) { + /* Only small sg (generally last sg) may be bounced. If + * that happens. we can't ensure the addr is page-aligned + * after dma map. + */ + if (dma_kmalloc_needs_bounce(dma_dev, s->length, dir)) + break; + + /* Make sure each sg start address (except first sg) is + * page-aligned and end address (except last sg) is also + * page-aligned. + */ + if (i == 0) { + if (!IS_ALIGNED(s->offset + s->length, + CI_HDRC_PAGE_SIZE)) + break; + } else { + if (s->offset) + break; + if (!sg_is_last(s) && !IS_ALIGNED(s->length, + CI_HDRC_PAGE_SIZE)) + break; + } + } + + return i; +} + +static int sglist_do_bounce(struct ci_hw_req *hwreq, int index, + bool copy, unsigned int *bounced) +{ + void *buf; + int i, ret, nents, num_sgs; + unsigned int rest, rounded; + struct scatterlist *sg, *src, *dst; + + nents = index + 1; + ret = sg_alloc_table(&hwreq->sgt, nents, GFP_KERNEL); + if (ret) + return ret; + + sg = src = hwreq->req.sg; + num_sgs = hwreq->req.num_sgs; + rest = hwreq->req.length; + dst = hwreq->sgt.sgl; + + for (i = 0; i < index; i++) { + memcpy(dst, src, sizeof(*src)); + rest -= src->length; + src = sg_next(src); + dst = sg_next(dst); + } + + /* create one bounce buffer */ + rounded = round_up(rest, CI_HDRC_PAGE_SIZE); + buf = kmalloc(rounded, GFP_KERNEL); + if (!buf) { + sg_free_table(&hwreq->sgt); + return -ENOMEM; + } + + sg_set_buf(dst, buf, rounded); + + hwreq->req.sg = hwreq->sgt.sgl; + hwreq->req.num_sgs = nents; + hwreq->sgt.sgl = sg; + hwreq->sgt.nents = num_sgs; + + if (copy) + sg_copy_to_buffer(src, num_sgs - index, buf, rest); + + *bounced = rest; + + return 0; +} + +static void sglist_do_debounce(struct ci_hw_req *hwreq, bool copy) +{ + void *buf; + int i, nents, num_sgs; + struct scatterlist *sg, *src, *dst; + + sg = hwreq->req.sg; + num_sgs = hwreq->req.num_sgs; + src = sg_last(sg, num_sgs); + buf = sg_virt(src); + + if (copy) { + dst = hwreq->sgt.sgl; + for (i = 0; i < num_sgs - 1; i++) + dst = sg_next(dst); + + nents = hwreq->sgt.nents - num_sgs + 1; + sg_copy_from_buffer(dst, nents, buf, sg_dma_len(src)); + } + + hwreq->req.sg = hwreq->sgt.sgl; + hwreq->req.num_sgs = hwreq->sgt.nents; + hwreq->sgt.sgl = sg; + hwreq->sgt.nents = num_sgs; + + kfree(buf); + sg_free_table(&hwreq->sgt); +} + /** * _hardware_enqueue: configures a request at hardware level * @hwep: endpoint @@ -552,6 +673,8 @@ static int _hardware_enqueue(struct ci_hw_ep *hwep, struct ci_hw_req *hwreq) struct ci_hdrc *ci = hwep->ci; int ret = 0; struct td_node *firstnode, *lastnode; + unsigned int bounced_size; + struct scatterlist *sg; /* don't queue twice */ if (hwreq->req.status == -EALREADY) @@ -559,11 +682,29 @@ static int _hardware_enqueue(struct ci_hw_ep *hwep, struct ci_hw_req *hwreq) hwreq->req.status = -EALREADY; + if (hwreq->req.num_sgs && hwreq->req.length && + ci->has_short_pkt_limit) { + ret = sglist_get_invalid_entry(ci->dev->parent, hwep->dir, + &hwreq->req); + if (ret < hwreq->req.num_sgs) { + ret = sglist_do_bounce(hwreq, ret, hwep->dir == TX, + &bounced_size); + if (ret) + return ret; + } + } + ret = usb_gadget_map_request_by_dev(ci->dev->parent, &hwreq->req, hwep->dir); if (ret) return ret; + if (hwreq->sgt.sgl) { + /* We've mapped a bigger buffer, now recover the actual size */ + sg = sg_last(hwreq->req.sg, hwreq->req.num_sgs); + sg_dma_len(sg) = min(sg_dma_len(sg), bounced_size); + } + if (hwreq->req.num_mapped_sgs) ret = prepare_td_for_sg(hwep, hwreq); else @@ -732,6 +873,10 @@ static int _hardware_dequeue(struct ci_hw_ep *hwep, struct ci_hw_req *hwreq) usb_gadget_unmap_request_by_dev(hwep->ci->dev->parent, &hwreq->req, hwep->dir); + /* sglist bounced */ + if (hwreq->sgt.sgl) + sglist_do_debounce(hwreq, hwep->dir == RX); + hwreq->req.actual += actual; if (hwreq->req.status) @@ -1573,6 +1718,9 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req) usb_gadget_unmap_request(&hwep->ci->gadget, req, hwep->dir); + if (hwreq->sgt.sgl) + sglist_do_debounce(hwreq, false); + req->status = -ECONNRESET; if (hwreq->req.complete != NULL) { diff --git a/drivers/usb/chipidea/udc.h b/drivers/usb/chipidea/udc.h index 5193df1e18c75..c8a47389a46bb 100644 --- a/drivers/usb/chipidea/udc.h +++ b/drivers/usb/chipidea/udc.h @@ -69,11 +69,13 @@ struct td_node { * @req: request structure for gadget drivers * @queue: link to QH list * @tds: link to TD list + * @sgt: hold original sglist when bounce sglist */ struct ci_hw_req { struct usb_request req; struct list_head queue; struct list_head tds; + struct sg_table sgt; }; #ifdef CONFIG_USB_CHIPIDEA_UDC -- 2.43.0

4 months, 4 weeks

2
11
0 0

[PATCH AUTOSEL 6.1 1/8] usb: chipidea: udc: create bounce buffer for problem sglist entries if possible

by Sasha Levin

From: Xu Yang <xu.yang_2(a)nxp.com> [ Upstream commit edfcc455c85ccc5855f0c329ca5a2d85cc9fc6c6 ] The chipidea controller doesn't fully support sglist, such as it can not transfer data spanned more dTDs to form a bus packet, so it can only work on very limited cases. The limitations as below: 1. the end address of the first sg buffer must be 4KB aligned. 2. the start and end address of the middle sg buffer must be 4KB aligned. 3. the start address of the first sg buffer must be 4KB aligned. However, not all the use cases violate these limitations. To make the controller compatible with most of the cases, this will try to bounce the problem sglist entries which can be found by sglist_get_invalid_entry(). Then a bounced line buffer (the size will roundup to page size) will be allocated to replace the remaining problem sg entries. The data will be copied between problem sg entries and bounce buffer according to the transfer direction. The bounce buffer will be freed when the request completed. Acked-by: Peter Chen <peter.chen(a)kernel.com> Signed-off-by: Xu Yang <xu.yang_2(a)nxp.com> Link: https://lore.kernel.org/r/20240923081203.2851768-3-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/usb/chipidea/udc.c | 148 +++++++++++++++++++++++++++++++++++++ drivers/usb/chipidea/udc.h | 2 + 2 files changed, 150 insertions(+) diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c index 35dfc05854fb7..3af0a7ef19f61 100644 --- a/drivers/usb/chipidea/udc.c +++ b/drivers/usb/chipidea/udc.c @@ -10,6 +10,7 @@ #include <linux/delay.h> #include <linux/device.h> #include <linux/dmapool.h> +#include <linux/dma-direct.h> #include <linux/err.h> #include <linux/irqreturn.h> #include <linux/kernel.h> @@ -540,6 +541,126 @@ static int prepare_td_for_sg(struct ci_hw_ep *hwep, struct ci_hw_req *hwreq) return ret; } +/* + * Verify if the scatterlist is valid by iterating each sg entry. + * Return invalid sg entry index which is less than num_sgs. + */ +static int sglist_get_invalid_entry(struct device *dma_dev, u8 dir, + struct usb_request *req) +{ + int i; + struct scatterlist *s = req->sg; + + if (req->num_sgs == 1) + return 1; + + dir = dir ? DMA_TO_DEVICE : DMA_FROM_DEVICE; + + for (i = 0; i < req->num_sgs; i++, s = sg_next(s)) { + /* Only small sg (generally last sg) may be bounced. If + * that happens. we can't ensure the addr is page-aligned + * after dma map. + */ + if (dma_kmalloc_needs_bounce(dma_dev, s->length, dir)) + break; + + /* Make sure each sg start address (except first sg) is + * page-aligned and end address (except last sg) is also + * page-aligned. + */ + if (i == 0) { + if (!IS_ALIGNED(s->offset + s->length, + CI_HDRC_PAGE_SIZE)) + break; + } else { + if (s->offset) + break; + if (!sg_is_last(s) && !IS_ALIGNED(s->length, + CI_HDRC_PAGE_SIZE)) + break; + } + } + + return i; +} + +static int sglist_do_bounce(struct ci_hw_req *hwreq, int index, + bool copy, unsigned int *bounced) +{ + void *buf; + int i, ret, nents, num_sgs; + unsigned int rest, rounded; + struct scatterlist *sg, *src, *dst; + + nents = index + 1; + ret = sg_alloc_table(&hwreq->sgt, nents, GFP_KERNEL); + if (ret) + return ret; + + sg = src = hwreq->req.sg; + num_sgs = hwreq->req.num_sgs; + rest = hwreq->req.length; + dst = hwreq->sgt.sgl; + + for (i = 0; i < index; i++) { + memcpy(dst, src, sizeof(*src)); + rest -= src->length; + src = sg_next(src); + dst = sg_next(dst); + } + + /* create one bounce buffer */ + rounded = round_up(rest, CI_HDRC_PAGE_SIZE); + buf = kmalloc(rounded, GFP_KERNEL); + if (!buf) { + sg_free_table(&hwreq->sgt); + return -ENOMEM; + } + + sg_set_buf(dst, buf, rounded); + + hwreq->req.sg = hwreq->sgt.sgl; + hwreq->req.num_sgs = nents; + hwreq->sgt.sgl = sg; + hwreq->sgt.nents = num_sgs; + + if (copy) + sg_copy_to_buffer(src, num_sgs - index, buf, rest); + + *bounced = rest; + + return 0; +} + +static void sglist_do_debounce(struct ci_hw_req *hwreq, bool copy) +{ + void *buf; + int i, nents, num_sgs; + struct scatterlist *sg, *src, *dst; + + sg = hwreq->req.sg; + num_sgs = hwreq->req.num_sgs; + src = sg_last(sg, num_sgs); + buf = sg_virt(src); + + if (copy) { + dst = hwreq->sgt.sgl; + for (i = 0; i < num_sgs - 1; i++) + dst = sg_next(dst); + + nents = hwreq->sgt.nents - num_sgs + 1; + sg_copy_from_buffer(dst, nents, buf, sg_dma_len(src)); + } + + hwreq->req.sg = hwreq->sgt.sgl; + hwreq->req.num_sgs = hwreq->sgt.nents; + hwreq->sgt.sgl = sg; + hwreq->sgt.nents = num_sgs; + + kfree(buf); + sg_free_table(&hwreq->sgt); +} + /** * _hardware_enqueue: configures a request at hardware level * @hwep: endpoint @@ -552,6 +673,8 @@ static int _hardware_enqueue(struct ci_hw_ep *hwep, struct ci_hw_req *hwreq) struct ci_hdrc *ci = hwep->ci; int ret = 0; struct td_node *firstnode, *lastnode; + unsigned int bounced_size; + struct scatterlist *sg; /* don't queue twice */ if (hwreq->req.status == -EALREADY) @@ -559,11 +682,29 @@ static int _hardware_enqueue(struct ci_hw_ep *hwep, struct ci_hw_req *hwreq) hwreq->req.status = -EALREADY; + if (hwreq->req.num_sgs && hwreq->req.length && + ci->has_short_pkt_limit) { + ret = sglist_get_invalid_entry(ci->dev->parent, hwep->dir, + &hwreq->req); + if (ret < hwreq->req.num_sgs) { + ret = sglist_do_bounce(hwreq, ret, hwep->dir == TX, + &bounced_size); + if (ret) + return ret; + } + } + ret = usb_gadget_map_request_by_dev(ci->dev->parent, &hwreq->req, hwep->dir); if (ret) return ret; + if (hwreq->sgt.sgl) { + /* We've mapped a bigger buffer, now recover the actual size */ + sg = sg_last(hwreq->req.sg, hwreq->req.num_sgs); + sg_dma_len(sg) = min(sg_dma_len(sg), bounced_size); + } + if (hwreq->req.num_mapped_sgs) ret = prepare_td_for_sg(hwep, hwreq); else @@ -732,6 +873,10 @@ static int _hardware_dequeue(struct ci_hw_ep *hwep, struct ci_hw_req *hwreq) usb_gadget_unmap_request_by_dev(hwep->ci->dev->parent, &hwreq->req, hwep->dir); + /* sglist bounced */ + if (hwreq->sgt.sgl) + sglist_do_debounce(hwreq, hwep->dir == RX); + hwreq->req.actual += actual; if (hwreq->req.status) @@ -1573,6 +1718,9 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req) usb_gadget_unmap_request(&hwep->ci->gadget, req, hwep->dir); + if (hwreq->sgt.sgl) + sglist_do_debounce(hwreq, false); + req->status = -ECONNRESET; if (hwreq->req.complete != NULL) { diff --git a/drivers/usb/chipidea/udc.h b/drivers/usb/chipidea/udc.h index 5193df1e18c75..c8a47389a46bb 100644 --- a/drivers/usb/chipidea/udc.h +++ b/drivers/usb/chipidea/udc.h @@ -69,11 +69,13 @@ struct td_node { * @req: request structure for gadget drivers * @queue: link to QH list * @tds: link to TD list + * @sgt: hold original sglist when bounce sglist */ struct ci_hw_req { struct usb_request req; struct list_head queue; struct list_head tds; + struct sg_table sgt; }; #ifdef CONFIG_USB_CHIPIDEA_UDC -- 2.43.0

4 months, 4 weeks

2
9
0 0

[PATCH AUTOSEL 5.15 1/5] usb: chipidea: udc: create bounce buffer for problem sglist entries if possible

by Sasha Levin

From: Xu Yang <xu.yang_2(a)nxp.com> [ Upstream commit edfcc455c85ccc5855f0c329ca5a2d85cc9fc6c6 ] The chipidea controller doesn't fully support sglist, such as it can not transfer data spanned more dTDs to form a bus packet, so it can only work on very limited cases. The limitations as below: 1. the end address of the first sg buffer must be 4KB aligned. 2. the start and end address of the middle sg buffer must be 4KB aligned. 3. the start address of the first sg buffer must be 4KB aligned. However, not all the use cases violate these limitations. To make the controller compatible with most of the cases, this will try to bounce the problem sglist entries which can be found by sglist_get_invalid_entry(). Then a bounced line buffer (the size will roundup to page size) will be allocated to replace the remaining problem sg entries. The data will be copied between problem sg entries and bounce buffer according to the transfer direction. The bounce buffer will be freed when the request completed. Acked-by: Peter Chen <peter.chen(a)kernel.com> Signed-off-by: Xu Yang <xu.yang_2(a)nxp.com> Link: https://lore.kernel.org/r/20240923081203.2851768-3-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/usb/chipidea/udc.c | 148 +++++++++++++++++++++++++++++++++++++ drivers/usb/chipidea/udc.h | 2 + 2 files changed, 150 insertions(+) diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c index 8b6745b7588c7..d3be658768a9a 100644 --- a/drivers/usb/chipidea/udc.c +++ b/drivers/usb/chipidea/udc.c @@ -10,6 +10,7 @@ #include <linux/delay.h> #include <linux/device.h> #include <linux/dmapool.h> +#include <linux/dma-direct.h> #include <linux/err.h> #include <linux/irqreturn.h> #include <linux/kernel.h> @@ -538,6 +539,126 @@ static int prepare_td_for_sg(struct ci_hw_ep *hwep, struct ci_hw_req *hwreq) return ret; } +/* + * Verify if the scatterlist is valid by iterating each sg entry. + * Return invalid sg entry index which is less than num_sgs. + */ +static int sglist_get_invalid_entry(struct device *dma_dev, u8 dir, + struct usb_request *req) +{ + int i; + struct scatterlist *s = req->sg; + + if (req->num_sgs == 1) + return 1; + + dir = dir ? DMA_TO_DEVICE : DMA_FROM_DEVICE; + + for (i = 0; i < req->num_sgs; i++, s = sg_next(s)) { + /* Only small sg (generally last sg) may be bounced. If + * that happens. we can't ensure the addr is page-aligned + * after dma map. + */ + if (dma_kmalloc_needs_bounce(dma_dev, s->length, dir)) + break; + + /* Make sure each sg start address (except first sg) is + * page-aligned and end address (except last sg) is also + * page-aligned. + */ + if (i == 0) { + if (!IS_ALIGNED(s->offset + s->length, + CI_HDRC_PAGE_SIZE)) + break; + } else { + if (s->offset) + break; + if (!sg_is_last(s) && !IS_ALIGNED(s->length, + CI_HDRC_PAGE_SIZE)) + break; + } + } + + return i; +} + +static int sglist_do_bounce(struct ci_hw_req *hwreq, int index, + bool copy, unsigned int *bounced) +{ + void *buf; + int i, ret, nents, num_sgs; + unsigned int rest, rounded; + struct scatterlist *sg, *src, *dst; + + nents = index + 1; + ret = sg_alloc_table(&hwreq->sgt, nents, GFP_KERNEL); + if (ret) + return ret; + + sg = src = hwreq->req.sg; + num_sgs = hwreq->req.num_sgs; + rest = hwreq->req.length; + dst = hwreq->sgt.sgl; + + for (i = 0; i < index; i++) { + memcpy(dst, src, sizeof(*src)); + rest -= src->length; + src = sg_next(src); + dst = sg_next(dst); + } + + /* create one bounce buffer */ + rounded = round_up(rest, CI_HDRC_PAGE_SIZE); + buf = kmalloc(rounded, GFP_KERNEL); + if (!buf) { + sg_free_table(&hwreq->sgt); + return -ENOMEM; + } + + sg_set_buf(dst, buf, rounded); + + hwreq->req.sg = hwreq->sgt.sgl; + hwreq->req.num_sgs = nents; + hwreq->sgt.sgl = sg; + hwreq->sgt.nents = num_sgs; + + if (copy) + sg_copy_to_buffer(src, num_sgs - index, buf, rest); + + *bounced = rest; + + return 0; +} + +static void sglist_do_debounce(struct ci_hw_req *hwreq, bool copy) +{ + void *buf; + int i, nents, num_sgs; + struct scatterlist *sg, *src, *dst; + + sg = hwreq->req.sg; + num_sgs = hwreq->req.num_sgs; + src = sg_last(sg, num_sgs); + buf = sg_virt(src); + + if (copy) { + dst = hwreq->sgt.sgl; + for (i = 0; i < num_sgs - 1; i++) + dst = sg_next(dst); + + nents = hwreq->sgt.nents - num_sgs + 1; + sg_copy_from_buffer(dst, nents, buf, sg_dma_len(src)); + } + + hwreq->req.sg = hwreq->sgt.sgl; + hwreq->req.num_sgs = hwreq->sgt.nents; + hwreq->sgt.sgl = sg; + hwreq->sgt.nents = num_sgs; + + kfree(buf); + sg_free_table(&hwreq->sgt); +} + /** * _hardware_enqueue: configures a request at hardware level * @hwep: endpoint @@ -550,6 +671,8 @@ static int _hardware_enqueue(struct ci_hw_ep *hwep, struct ci_hw_req *hwreq) struct ci_hdrc *ci = hwep->ci; int ret = 0; struct td_node *firstnode, *lastnode; + unsigned int bounced_size; + struct scatterlist *sg; /* don't queue twice */ if (hwreq->req.status == -EALREADY) @@ -557,11 +680,29 @@ static int _hardware_enqueue(struct ci_hw_ep *hwep, struct ci_hw_req *hwreq) hwreq->req.status = -EALREADY; + if (hwreq->req.num_sgs && hwreq->req.length && + ci->has_short_pkt_limit) { + ret = sglist_get_invalid_entry(ci->dev->parent, hwep->dir, + &hwreq->req); + if (ret < hwreq->req.num_sgs) { + ret = sglist_do_bounce(hwreq, ret, hwep->dir == TX, + &bounced_size); + if (ret) + return ret; + } + } + ret = usb_gadget_map_request_by_dev(ci->dev->parent, &hwreq->req, hwep->dir); if (ret) return ret; + if (hwreq->sgt.sgl) { + /* We've mapped a bigger buffer, now recover the actual size */ + sg = sg_last(hwreq->req.sg, hwreq->req.num_sgs); + sg_dma_len(sg) = min(sg_dma_len(sg), bounced_size); + } + if (hwreq->req.num_mapped_sgs) ret = prepare_td_for_sg(hwep, hwreq); else @@ -724,6 +865,10 @@ static int _hardware_dequeue(struct ci_hw_ep *hwep, struct ci_hw_req *hwreq) usb_gadget_unmap_request_by_dev(hwep->ci->dev->parent, &hwreq->req, hwep->dir); + /* sglist bounced */ + if (hwreq->sgt.sgl) + sglist_do_debounce(hwreq, hwep->dir == RX); + hwreq->req.actual += actual; if (hwreq->req.status) @@ -1565,6 +1710,9 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req) usb_gadget_unmap_request(&hwep->ci->gadget, req, hwep->dir); + if (hwreq->sgt.sgl) + sglist_do_debounce(hwreq, false); + req->status = -ECONNRESET; if (hwreq->req.complete != NULL) { diff --git a/drivers/usb/chipidea/udc.h b/drivers/usb/chipidea/udc.h index 5193df1e18c75..c8a47389a46bb 100644 --- a/drivers/usb/chipidea/udc.h +++ b/drivers/usb/chipidea/udc.h @@ -69,11 +69,13 @@ struct td_node { * @req: request structure for gadget drivers * @queue: link to QH list * @tds: link to TD list + * @sgt: hold original sglist when bounce sglist */ struct ci_hw_req { struct usb_request req; struct list_head queue; struct list_head tds; + struct sg_table sgt; }; #ifdef CONFIG_USB_CHIPIDEA_UDC -- 2.43.0

4 months, 4 weeks

2
5
0 0

[PATCH AUTOSEL 5.10 1/5] usb: chipidea: udc: create bounce buffer for problem sglist entries if possible

by Sasha Levin

From: Xu Yang <xu.yang_2(a)nxp.com> [ Upstream commit edfcc455c85ccc5855f0c329ca5a2d85cc9fc6c6 ] The chipidea controller doesn't fully support sglist, such as it can not transfer data spanned more dTDs to form a bus packet, so it can only work on very limited cases. The limitations as below: 1. the end address of the first sg buffer must be 4KB aligned. 2. the start and end address of the middle sg buffer must be 4KB aligned. 3. the start address of the first sg buffer must be 4KB aligned. However, not all the use cases violate these limitations. To make the controller compatible with most of the cases, this will try to bounce the problem sglist entries which can be found by sglist_get_invalid_entry(). Then a bounced line buffer (the size will roundup to page size) will be allocated to replace the remaining problem sg entries. The data will be copied between problem sg entries and bounce buffer according to the transfer direction. The bounce buffer will be freed when the request completed. Acked-by: Peter Chen <peter.chen(a)kernel.com> Signed-off-by: Xu Yang <xu.yang_2(a)nxp.com> Link: https://lore.kernel.org/r/20240923081203.2851768-3-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/usb/chipidea/udc.c | 148 +++++++++++++++++++++++++++++++++++++ drivers/usb/chipidea/udc.h | 2 + 2 files changed, 150 insertions(+) diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c index 5cdf03534c0c7..f4661f654af88 100644 --- a/drivers/usb/chipidea/udc.c +++ b/drivers/usb/chipidea/udc.c @@ -10,6 +10,7 @@ #include <linux/delay.h> #include <linux/device.h> #include <linux/dmapool.h> +#include <linux/dma-direct.h> #include <linux/err.h> #include <linux/irqreturn.h> #include <linux/kernel.h> @@ -537,6 +538,126 @@ static int prepare_td_for_sg(struct ci_hw_ep *hwep, struct ci_hw_req *hwreq) return ret; } +/* + * Verify if the scatterlist is valid by iterating each sg entry. + * Return invalid sg entry index which is less than num_sgs. + */ +static int sglist_get_invalid_entry(struct device *dma_dev, u8 dir, + struct usb_request *req) +{ + int i; + struct scatterlist *s = req->sg; + + if (req->num_sgs == 1) + return 1; + + dir = dir ? DMA_TO_DEVICE : DMA_FROM_DEVICE; + + for (i = 0; i < req->num_sgs; i++, s = sg_next(s)) { + /* Only small sg (generally last sg) may be bounced. If + * that happens. we can't ensure the addr is page-aligned + * after dma map. + */ + if (dma_kmalloc_needs_bounce(dma_dev, s->length, dir)) + break; + + /* Make sure each sg start address (except first sg) is + * page-aligned and end address (except last sg) is also + * page-aligned. + */ + if (i == 0) { + if (!IS_ALIGNED(s->offset + s->length, + CI_HDRC_PAGE_SIZE)) + break; + } else { + if (s->offset) + break; + if (!sg_is_last(s) && !IS_ALIGNED(s->length, + CI_HDRC_PAGE_SIZE)) + break; + } + } + + return i; +} + +static int sglist_do_bounce(struct ci_hw_req *hwreq, int index, + bool copy, unsigned int *bounced) +{ + void *buf; + int i, ret, nents, num_sgs; + unsigned int rest, rounded; + struct scatterlist *sg, *src, *dst; + + nents = index + 1; + ret = sg_alloc_table(&hwreq->sgt, nents, GFP_KERNEL); + if (ret) + return ret; + + sg = src = hwreq->req.sg; + num_sgs = hwreq->req.num_sgs; + rest = hwreq->req.length; + dst = hwreq->sgt.sgl; + + for (i = 0; i < index; i++) { + memcpy(dst, src, sizeof(*src)); + rest -= src->length; + src = sg_next(src); + dst = sg_next(dst); + } + + /* create one bounce buffer */ + rounded = round_up(rest, CI_HDRC_PAGE_SIZE); + buf = kmalloc(rounded, GFP_KERNEL); + if (!buf) { + sg_free_table(&hwreq->sgt); + return -ENOMEM; + } + + sg_set_buf(dst, buf, rounded); + + hwreq->req.sg = hwreq->sgt.sgl; + hwreq->req.num_sgs = nents; + hwreq->sgt.sgl = sg; + hwreq->sgt.nents = num_sgs; + + if (copy) + sg_copy_to_buffer(src, num_sgs - index, buf, rest); + + *bounced = rest; + + return 0; +} + +static void sglist_do_debounce(struct ci_hw_req *hwreq, bool copy) +{ + void *buf; + int i, nents, num_sgs; + struct scatterlist *sg, *src, *dst; + + sg = hwreq->req.sg; + num_sgs = hwreq->req.num_sgs; + src = sg_last(sg, num_sgs); + buf = sg_virt(src); + + if (copy) { + dst = hwreq->sgt.sgl; + for (i = 0; i < num_sgs - 1; i++) + dst = sg_next(dst); + + nents = hwreq->sgt.nents - num_sgs + 1; + sg_copy_from_buffer(dst, nents, buf, sg_dma_len(src)); + } + + hwreq->req.sg = hwreq->sgt.sgl; + hwreq->req.num_sgs = hwreq->sgt.nents; + hwreq->sgt.sgl = sg; + hwreq->sgt.nents = num_sgs; + + kfree(buf); + sg_free_table(&hwreq->sgt); +} + /** * _hardware_enqueue: configures a request at hardware level * @hwep: endpoint @@ -549,6 +670,8 @@ static int _hardware_enqueue(struct ci_hw_ep *hwep, struct ci_hw_req *hwreq) struct ci_hdrc *ci = hwep->ci; int ret = 0; struct td_node *firstnode, *lastnode; + unsigned int bounced_size; + struct scatterlist *sg; /* don't queue twice */ if (hwreq->req.status == -EALREADY) @@ -556,11 +679,29 @@ static int _hardware_enqueue(struct ci_hw_ep *hwep, struct ci_hw_req *hwreq) hwreq->req.status = -EALREADY; + if (hwreq->req.num_sgs && hwreq->req.length && + ci->has_short_pkt_limit) { + ret = sglist_get_invalid_entry(ci->dev->parent, hwep->dir, + &hwreq->req); + if (ret < hwreq->req.num_sgs) { + ret = sglist_do_bounce(hwreq, ret, hwep->dir == TX, + &bounced_size); + if (ret) + return ret; + } + } + ret = usb_gadget_map_request_by_dev(ci->dev->parent, &hwreq->req, hwep->dir); if (ret) return ret; + if (hwreq->sgt.sgl) { + /* We've mapped a bigger buffer, now recover the actual size */ + sg = sg_last(hwreq->req.sg, hwreq->req.num_sgs); + sg_dma_len(sg) = min(sg_dma_len(sg), bounced_size); + } + if (hwreq->req.num_mapped_sgs) ret = prepare_td_for_sg(hwep, hwreq); else @@ -718,6 +859,10 @@ static int _hardware_dequeue(struct ci_hw_ep *hwep, struct ci_hw_req *hwreq) usb_gadget_unmap_request_by_dev(hwep->ci->dev->parent, &hwreq->req, hwep->dir); + /* sglist bounced */ + if (hwreq->sgt.sgl) + sglist_do_debounce(hwreq, hwep->dir == RX); + hwreq->req.actual += actual; if (hwreq->req.status) @@ -1559,6 +1704,9 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req) usb_gadget_unmap_request(&hwep->ci->gadget, req, hwep->dir); + if (hwreq->sgt.sgl) + sglist_do_debounce(hwreq, false); + req->status = -ECONNRESET; if (hwreq->req.complete != NULL) { diff --git a/drivers/usb/chipidea/udc.h b/drivers/usb/chipidea/udc.h index 5193df1e18c75..c8a47389a46bb 100644 --- a/drivers/usb/chipidea/udc.h +++ b/drivers/usb/chipidea/udc.h @@ -69,11 +69,13 @@ struct td_node { * @req: request structure for gadget drivers * @queue: link to QH list * @tds: link to TD list + * @sgt: hold original sglist when bounce sglist */ struct ci_hw_req { struct usb_request req; struct list_head queue; struct list_head tds; + struct sg_table sgt; }; #ifdef CONFIG_USB_CHIPIDEA_UDC -- 2.43.0

4 months, 4 weeks

2
5
0 0

[PATCH AUTOSEL 5.4 1/3] usb: chipidea: udc: handle USB Error Interrupt if IOC not set

by Sasha Levin

From: Xu Yang <xu.yang_2(a)nxp.com> [ Upstream commit 548f48b66c0c5d4b9795a55f304b7298cde2a025 ] As per USBSTS register description about UEI: When completion of a USB transaction results in an error condition, this bit is set by the Host/Device Controller. This bit is set along with the USBINT bit, if the TD on which the error interrupt occurred also had its interrupt on complete (IOC) bit set. UI is set only when IOC set. Add checking UEI to fix miss call isr_tr_complete_handler() when IOC have not set and transfer error happen. Acked-by: Peter Chen <peter.chen(a)kernel.com> Signed-off-by: Xu Yang <xu.yang_2(a)nxp.com> Link: https://lore.kernel.org/r/20240926022906.473319-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/usb/chipidea/udc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c index 72d62abb6f285..a6ce6b89b271a 100644 --- a/drivers/usb/chipidea/udc.c +++ b/drivers/usb/chipidea/udc.c @@ -1902,7 +1902,7 @@ static irqreturn_t udc_irq(struct ci_hdrc *ci) } } - if (USBi_UI & intr) + if ((USBi_UI | USBi_UEI) & intr) isr_tr_complete_handler(ci); if ((USBi_SLI & intr) && !(ci->suspended)) { -- 2.43.0

4 months, 4 weeks

2
3
0 0

[PATCH AUTOSEL 4.19 1/3] usb: chipidea: udc: handle USB Error Interrupt if IOC not set

by Sasha Levin

From: Xu Yang <xu.yang_2(a)nxp.com> [ Upstream commit 548f48b66c0c5d4b9795a55f304b7298cde2a025 ] As per USBSTS register description about UEI: When completion of a USB transaction results in an error condition, this bit is set by the Host/Device Controller. This bit is set along with the USBINT bit, if the TD on which the error interrupt occurred also had its interrupt on complete (IOC) bit set. UI is set only when IOC set. Add checking UEI to fix miss call isr_tr_complete_handler() when IOC have not set and transfer error happen. Acked-by: Peter Chen <peter.chen(a)kernel.com> Signed-off-by: Xu Yang <xu.yang_2(a)nxp.com> Link: https://lore.kernel.org/r/20240926022906.473319-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/usb/chipidea/udc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c index 6a626f41cded1..27be93d12b59c 100644 --- a/drivers/usb/chipidea/udc.c +++ b/drivers/usb/chipidea/udc.c @@ -1902,7 +1902,7 @@ static irqreturn_t udc_irq(struct ci_hdrc *ci) } } - if (USBi_UI & intr) + if ((USBi_UI | USBi_UEI) & intr) isr_tr_complete_handler(ci); if ((USBi_SLI & intr) && !(ci->suspended)) { -- 2.43.0

4 months, 4 weeks

2
3
0 0

[PATCH] padata: Fix refcnt handling in padata_free_shell() again

by Zach Wade

testcases/kernel/crypto/pcrypt_aead01.c of LTP project has UAF. Steps to reproduce: 1. /sys/module/cryptomgr/parameters/notests is N 2. run LTP ./testcases/bin/pcrypt_aead01 There is a race condition when padata_free_shell is released, which causes it to be accessed after being released. We should use the rcu mechanism to protect it. cpu0 | cpu1 ================================================================ padata_do_parallel | padata_free_shell rcu_read_lock_bh | refcount_dec_and_test # run to here <- 1 | # run to here <- 2 refcount_inc(&pd->refcnt); | padata_free_pd <- 3 padata_work_alloc | ... rcu_read_unlock_bh | | There is a possibility of UAF after refcount_inc(&pd->refcnt). kasan report: [158753.658839] ================================================================== [158753.658851] BUG: KASAN: slab-use-after-free in padata_find_next+0x2d6/0x3f0 [158753.658868] Read of size 4 at addr ffff88812f8b8524 by task kworker/u158:0/988818 [158753.658878] [158753.658885] CPU: 23 UID: 0 PID: 988818 Comm: kworker/u158:0 Kdump: loaded Tainted: G W E 6.12.0-dirty #33 [158753.658902] Tainted: [W]=WARN, [E]=UNSIGNED_MODULE [158753.658907] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.20192059.B64.2207280713 07/28/2022 [158753.658914] Workqueue: pdecrypt_parallel padata_parallel_worker [158753.658927] Call Trace: [158753.658932] <TASK> [158753.658938] dump_stack_lvl+0x5d/0x80 [158753.658960] print_report+0x174/0x505 [158753.658992] kasan_report+0xe0/0x160 [158753.659013] padata_find_next+0x2d6/0x3f0 [158753.659035] padata_reorder+0x1cc/0x400 [158753.659043] padata_parallel_worker+0x70/0x160 [158753.659051] process_one_work+0x646/0xeb0 [158753.659061] worker_thread+0x619/0x10e0 [158753.659092] kthread+0x28d/0x350 [158753.659102] ret_from_fork+0x31/0x70 [158753.659111] ret_from_fork_asm+0x1a/0x30 [158753.659117] </TASK> [158753.659119] [158753.659120] Allocated by task 1027931: [158753.659123] kasan_save_stack+0x30/0x50 [158753.659126] kasan_save_track+0x14/0x30 [158753.659128] __kasan_kmalloc+0xaa/0xb0 [158753.659130] padata_alloc_pd+0x69/0x9f0 [158753.659132] padata_alloc_shell+0x82/0x210 [158753.659134] pcrypt_create+0x13b/0x7a0 [pcrypt] [158753.659139] cryptomgr_probe+0x8d/0x230 [158753.659144] kthread+0x28d/0x350 [158753.659147] ret_from_fork+0x31/0x70 [158753.659150] ret_from_fork_asm+0x1a/0x30 [158753.659152] [158753.659153] Freed by task 1024357: [158753.659155] kasan_save_stack+0x30/0x50 [158753.659158] kasan_save_track+0x14/0x30 [158753.659160] kasan_save_free_info+0x3b/0x70 [158753.659164] __kasan_slab_free+0x4f/0x70 [158753.659167] kfree+0x119/0x440 [158753.659172] padata_free_shell+0x262/0x320 [158753.659174] pcrypt_free+0x43/0x90 [pcrypt] [158753.659177] crypto_destroy_instance_workfn+0x79/0xc0 [158753.659182] process_one_work+0x646/0xeb0 [158753.659184] worker_thread+0x619/0x10e0 [158753.659186] kthread+0x28d/0x350 [158753.659188] ret_from_fork+0x31/0x70 [158753.659191] ret_from_fork_asm+0x1a/0x30 [158753.659194] [158753.659195] The buggy address belongs to the object at ffff88812f8b8500 which belongs to the cache kmalloc-192 of size 192 [158753.659198] The buggy address is located 36 bytes inside of freed 192-byte region [ffff88812f8b8500, ffff88812f8b85c0) [158753.659202] [158753.659203] The buggy address belongs to the physical page: [158753.659205] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12f8b8 [158753.659209] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [158753.659212] anon flags: 0x10000000000040(head|node=0|zone=2) [158753.659216] page_type: f5(slab) [158753.659220] raw: 0010000000000040 ffff88810004c3c0 0000000000000000 dead000000000001 [158753.659223] raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000 [158753.659225] head: 0010000000000040 ffff88810004c3c0 0000000000000000 dead000000000001 [158753.659228] head: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000 [158753.659230] head: 0010000000000001 ffffea0004be2e01 ffffffffffffffff 0000000000000000 [158753.659232] head: ffff888100000002 0000000000000000 00000000ffffffff 0000000000000000 [158753.659234] page dumped because: kasan: bad access detected [158753.659235] [158753.659236] Memory state around the buggy address: [158753.659238] ffff88812f8b8400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [158753.659240] ffff88812f8b8480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [158753.659242] >ffff88812f8b8500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [158753.659243] ^ [158753.659245] ffff88812f8b8580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [158753.659247] ffff88812f8b8600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [158753.659248] ================================================================== Fixes: 07928d9bfc81 ("padata: Remove broken queue flushing") Co-developed-by: Ding Hui <dinghui(a)sangfor.com.cn> Signed-off-by: Ding Hui <dinghui(a)sangfor.com.cn> Signed-off-by: Zach Wade <zachwade.k(a)gmail.com> --- include/linux/padata.h | 1 + kernel/padata.c | 11 +++++++++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/include/linux/padata.h b/include/linux/padata.h index 0146daf34430..ee6155689e47 100644 --- a/include/linux/padata.h +++ b/include/linux/padata.h @@ -103,6 +103,7 @@ struct parallel_data { int cpu; struct padata_cpumask cpumask; struct work_struct reorder_work; + struct rcu_head rcu; spinlock_t ____cacheline_aligned lock; }; diff --git a/kernel/padata.c b/kernel/padata.c index d51bbc76b227..3afdccc7e20e 100644 --- a/kernel/padata.c +++ b/kernel/padata.c @@ -1109,6 +1109,14 @@ struct padata_shell *padata_alloc_shell(struct padata_instance *pinst) } EXPORT_SYMBOL(padata_alloc_shell); +static void __padata_put_pd(struct rcu_head *head) +{ + struct parallel_data *pd = container_of(head, struct parallel_data, rcu); + + if (refcount_dec_and_test(&pd->refcnt)) + padata_free_pd(pd); +} + /** * padata_free_shell - free a padata shell * @@ -1124,9 +1132,8 @@ void padata_free_shell(struct padata_shell *ps) mutex_lock(&ps->pinst->lock); list_del(&ps->list); pd = rcu_dereference_protected(ps->pd, 1); - if (refcount_dec_and_test(&pd->refcnt)) - padata_free_pd(pd); mutex_unlock(&ps->pinst->lock); + call_rcu(&pd->rcu, __padata_put_pd); kfree(ps); } -- 2.46.0

4 months, 4 weeks

3
2
0 0

[PATCH v3] ARM: dts: ti/omap: gta04: fix pm issues caused by spi module

by Andreas Kemnade

Despite CM_IDLEST1_CORE and CM_FCLKEN1_CORE behaving normal, disabling SPI leads to messages like when suspending: Powerdomain (core_pwrdm) didn't enter target state 0 and according to /sys/kernel/debug/pm_debug/count off state is not entered. That was not connected to SPI during the discussion of disabling SPI. See: https://lore.kernel.org/linux-omap/20230122100852.32ae082c@aktux/ The reason is that SPI is per default in slave mode. Linux driver will turn it to master per default. It slave mode, the powerdomain seems to be kept active if active chip select input is sensed. Fix that by explicitly disabling the SPI3 pins which used to be muxed by the bootloader since they are available on an optionally fitted header which would require dtb overlays anyways. Fixes: a622310f7f01 ("ARM: dts: gta04: fix excess dma channel usage") CC: stable(a)vger.kernel.org Signed-off-by: Andreas Kemnade <andreas(a)kemnade.info> --- Changes in V3: - use gpio mode instead of mode7 which is not safe mode in this special case Changes in V2: - instead of reenabling mcspi, do a fix more near the root of the problem arch/arm/boot/dts/ti/omap/omap3-gta04.dtsi | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/arch/arm/boot/dts/ti/omap/omap3-gta04.dtsi b/arch/arm/boot/dts/ti/omap/omap3-gta04.dtsi index 2ee3ddd640209..536070e80b2c6 100644 --- a/arch/arm/boot/dts/ti/omap/omap3-gta04.dtsi +++ b/arch/arm/boot/dts/ti/omap/omap3-gta04.dtsi @@ -446,6 +446,7 @@ &omap3_pmx_core2 { pinctrl-names = "default"; pinctrl-0 = < &hsusb2_2_pins + &mcspi3hog_pins >; hsusb2_2_pins: hsusb2-2-pins { @@ -459,6 +460,15 @@ OMAP3630_CORE2_IOPAD(0x25fa, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d15.hsusb2_d >; }; + mcspi3hog_pins: mcspi3hog-pins { + pinctrl-single,pins = < + OMAP3630_CORE2_IOPAD(0x25dc, PIN_OUTPUT_PULLDOWN | MUX_MODE4) /* etk_d0 */ + OMAP3630_CORE2_IOPAD(0x25de, PIN_OUTPUT_PULLDOWN | MUX_MODE4) /* etk_d1 */ + OMAP3630_CORE2_IOPAD(0x25e0, PIN_OUTPUT_PULLDOWN | MUX_MODE4) /* etk_d2 */ + OMAP3630_CORE2_IOPAD(0x25e2, PIN_OUTPUT_PULLDOWN | MUX_MODE4) /* etk_d3 */ + >; + }; + spi_gpio_pins: spi-gpio-pinmux-pins { pinctrl-single,pins = < OMAP3630_CORE2_IOPAD(0x25d8, PIN_OUTPUT | MUX_MODE4) /* clk */ -- 2.39.2

4 months, 4 weeks

3
2
0 0

[PATCH v2] ARM: dts: dra7: Add bus_dma_limit for l4 cfg bus

by Romain Naour

From: Romain Naour <romain.naour(a)skf.com> A bus_dma_limit was added for l3 bus by commit cfb5d65f2595 ("ARM: dts: dra7: Add bus_dma_limit for L3 bus") to fix an issue observed only with SATA on DRA7-EVM with 4GB RAM and CONFIG_ARM_LPAE enabled. Since kernel 5.13, the SATA issue can be reproduced again following the SATA node move from L3 bus to L4_cfg in commit 8af15365a368 ("ARM: dts: Configure interconnect target module for dra7 sata"). Fix it by adding an empty dma-ranges property to l4_cfg and segment@100000 nodes (parent device tree node of SATA controller) to inherit the 2GB dma ranges limit from l3 bus node. Note: A similar fix was applied for PCIe controller by commit 90d4d3f4ea45 ("ARM: dts: dra7: Fix bus_dma_limit for PCIe"). Fixes: 8af15365a368 ("ARM: dts: Configure interconnect target module for dra7 sata"). Link: https://lore.kernel.org/linux-omap/c583e1bb-f56b-4489-8012-ce742e85f233@smi… Cc: <stable(a)vger.kernel.org> # 5.13 Signed-off-by: Romain Naour <romain.naour(a)skf.com> --- v2: add stable tag --- arch/arm/boot/dts/ti/omap/dra7-l4.dtsi | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm/boot/dts/ti/omap/dra7-l4.dtsi b/arch/arm/boot/dts/ti/omap/dra7-l4.dtsi index 6e67d99832ac..ba7fdaae9c6e 100644 --- a/arch/arm/boot/dts/ti/omap/dra7-l4.dtsi +++ b/arch/arm/boot/dts/ti/omap/dra7-l4.dtsi @@ -12,6 +12,7 @@ &l4_cfg { /* 0x4a000000 */ ranges = <0x00000000 0x4a000000 0x100000>, /* segment 0 */ <0x00100000 0x4a100000 0x100000>, /* segment 1 */ <0x00200000 0x4a200000 0x100000>; /* segment 2 */ + dma-ranges; segment@0 { /* 0x4a000000 */ compatible = "simple-pm-bus"; @@ -557,6 +558,7 @@ segment@100000 { /* 0x4a100000 */ <0x0007e000 0x0017e000 0x001000>, /* ap 124 */ <0x00059000 0x00159000 0x001000>, /* ap 125 */ <0x0005a000 0x0015a000 0x001000>; /* ap 126 */ + dma-ranges; target-module@2000 { /* 0x4a102000, ap 27 3c.0 */ compatible = "ti,sysc"; -- 2.45.0

4 months, 4 weeks

2
1
0 0

[PATCH] cpufreq: fix using cpufreq-dt as module

by Andreas Kemnade

E.g. omap2plus_defconfig compiles cpufreq-dt as module. As there is no module alias nor a module_init(), cpufreq-dt-platdev will not be used and therefore on several omap platforms there is no cpufreq. Enforce builtin compile of cpufreq-dt-platdev to make it effective. Fixes: 3b062a086984 ("cpufreq: dt-platdev: Support building as module") Cc: stable(a)vger.kernel.org Signed-off-by: Andreas Kemnade <andreas(a)kemnade.info> --- drivers/cpufreq/Kconfig | 2 +- drivers/cpufreq/cpufreq-dt-platdev.c | 2 -- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/cpufreq/Kconfig b/drivers/cpufreq/Kconfig index 2561b215432a8..4547adf5d2a7d 100644 --- a/drivers/cpufreq/Kconfig +++ b/drivers/cpufreq/Kconfig @@ -218,7 +218,7 @@ config CPUFREQ_DT If in doubt, say N. config CPUFREQ_DT_PLATDEV - tristate "Generic DT based cpufreq platdev driver" + bool "Generic DT based cpufreq platdev driver" depends on OF help This adds a generic DT based cpufreq platdev driver for frequency diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c index 18942bfe9c95f..78ad3221fe077 100644 --- a/drivers/cpufreq/cpufreq-dt-platdev.c +++ b/drivers/cpufreq/cpufreq-dt-platdev.c @@ -234,5 +234,3 @@ static int __init cpufreq_dt_platdev_init(void) sizeof(struct cpufreq_dt_platform_data))); } core_initcall(cpufreq_dt_platdev_init); -MODULE_DESCRIPTION("Generic DT based cpufreq platdev driver"); -MODULE_LICENSE("GPL"); -- 2.39.2

4 months, 4 weeks

3
4
0 0

[PATCH] nvme-pci: Remove O2 Queue Depth quirk

by Gwendal Grignou

PCI_DEVICE(0x1217, 0x8760) (O2 Micro, Inc. FORESEE E2M2 NVMe SSD) is a NMVe to eMMC bridge, that can be used with different eMMC memory devices. The NVMe device name contains the eMMC device name, for instance: `BAYHUB SanDisk-DA4128-91904055-128GB` The bridge is known to work with many eMMC devices, we need to limit the queue depth once we know which eMMC device is behind the bridge. Fixes: commit 83bdfcbdbe5d ("nvme-pci: qdepth 1 quirk") Cc: stable(a)vger.kernel.org Signed-off-by: Gwendal Grignou <gwendal(a)chromium.org> --- drivers/nvme/host/pci.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index 4b9fda0b1d9a3..1c908e129fddf 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -3448,8 +3448,6 @@ static const struct pci_device_id nvme_id_table[] = { NVME_QUIRK_BOGUS_NID, }, { PCI_VDEVICE(REDHAT, 0x0010), /* Qemu emulated controller */ .driver_data = NVME_QUIRK_BOGUS_NID, }, - { PCI_DEVICE(0x1217, 0x8760), /* O2 Micro 64GB Steam Deck */ - .driver_data = NVME_QUIRK_QDEPTH_ONE }, { PCI_DEVICE(0x126f, 0x2262), /* Silicon Motion generic */ .driver_data = NVME_QUIRK_NO_DEEPEST_PS | NVME_QUIRK_BOGUS_NID, }, -- 2.47.0.163.g1226f6d8fa-goog

4 months, 4 weeks

5
7
0 0

[PATCH v1] selftests/memfd: Run sysctl tests when PID namespace support is enabled

by Isaac J. Manjarres

The sysctl tests for vm.memfd_noexec rely on the kernel to support PID namespaces (i.e. the kernel is built with CONFIG_PID_NS=y). If the kernel the test runs on does not support PID namespaces, the first sysctl test will fail when attempting to spawn a new thread in a new PID namespace, abort the test, preventing the remaining tests from being run. This is not desirable, as not all kernels need PID namespaces, but can still use the other features provided by memfd. Therefore, only run the sysctl tests if the kernel supports PID namespaces. Otherwise, skip those tests and emit an informative message to let the user know why the sysctl tests are not being run. Fixes: 11f75a01448f ("selftests/memfd: add tests for MFD_NOEXEC_SEAL MFD_EXEC") Cc: stable(a)vger.kernel.org # v6.6+ Cc: Jeff Xu <jeffxu(a)google.com> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Kalesh Singh <kaleshsingh(a)google.com> Signed-off-by: Isaac J. Manjarres <isaacmanjarres(a)google.com> --- tools/testing/selftests/memfd/memfd_test.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/memfd/memfd_test.c b/tools/testing/selftests/memfd/memfd_test.c index 95af2d78fd31..0a0b55516028 100644 --- a/tools/testing/selftests/memfd/memfd_test.c +++ b/tools/testing/selftests/memfd/memfd_test.c @@ -9,6 +9,7 @@ #include <fcntl.h> #include <linux/memfd.h> #include <sched.h> +#include <stdbool.h> #include <stdio.h> #include <stdlib.h> #include <signal.h> @@ -1557,6 +1558,11 @@ static void test_share_fork(char *banner, char *b_suffix) close(fd); } +static bool pid_ns_supported(void) +{ + return access("/proc/self/ns/pid", F_OK) == 0; +} + int main(int argc, char **argv) { pid_t pid; @@ -1591,8 +1597,12 @@ int main(int argc, char **argv) test_seal_grow(); test_seal_resize(); - test_sysctl_simple(); - test_sysctl_nested(); + if (pid_ns_supported()) { + test_sysctl_simple(); + test_sysctl_nested(); + } else { + printf("PID namespaces are not supported; skipping sysctl tests\n"); + } test_share_dup("SHARE-DUP", ""); test_share_mmap("SHARE-MMAP", ""); -- 2.47.0.338.g60cca15819-goog

4 months, 4 weeks

2
1
0 0

QNX6 Linux kernel module RO limitation

by Richa Sahasrabudhe

Hi I am trying to use the linux qnx6 module to mount a QNX6 filesystem partition from an SSD onto a linux host. I am able to mount the partition, however any file > 2GB get truncated (or corrupted?) to 2GB when read from the mountpoint. Questions - Is there a limitation on maximum file size that the module supports? I have tried formatting the QNX6 partition to use 1K, 4K, and 16K block size. The linux module could only mount ones with 1K & 4K bs. However, both cannot read files >2GB without corruption. 16K did not mount — “mount: /mnt/qnx6_16kbs: wrong fs type, bad option, bad superblock on /dev/nvme1n3p2, missing codepage or helper program, or other error.” Is there a limitation on block size supported by this module? I browsed the kernel source code to look for any such limitations, but I could not find any. I want to patch the module to add support for files >2GB. Can you please provide some inputs that will help me find the appropriate part of the code? $ modinfo qnx6 filename: /lib/modules/6.8.0-45-generic/kernel/fs/qnx6/qnx6.ko license: GPL alias: fs-qnx6 srcversion: B81F3D9620B1753DF4431D7 depends: retpoline: Y intree: Y name: qnx6 vermagic: 6.8.0-45-generic SMP preempt mod_unload modversions sig_id: PKCS#7 signer: Build time autogenerated kernel key sig_key: 03:0B:6C:98:F4:46:33:57:AA:65:3F:5B:DF:E4:5A:02:84:DF:3A:24 sig_hashalgo: sha512 signature: 0D:5A:21:4B:A4:74:DF:06:9C:63:9F:51:02:7A:DD:54:EE:94:A8:F5: 22:3F:B2:1A:F7:1B:BC:55:3B:D5:25:A2:01:C7:40:9B:E8:A1:50:F5: 67:25:1B:5E:2A:F4:F0:6F:B2:50:1F:0C:86:39:5F:0D:03:B4:68:F5: C9:F7:A5:29:78:01:FE:4E:28:75:94:17:0D:9A:B7:D0:24:E3:1B:3A: 80:C3:FB:DE:04:66:75:2A:4B:BF:D1:3D:6E:49:C7:52:81:B8:00:F7: 53:B8:58:67:42:85:7A:87:76:07:0D:75:E8:D4:18:7D:D7:03:6F:5B: 37:25:99:A4:CD:19:9D:A5:57:11:B9:2A:12:00:F2:F6:23:69:67:59: F9:BA:D1:2B:69:C7:4D:9E:57:3E:ED:11:6B:64:E2:9F:68:99:71:3D: EC:21:FE:E5:3A:21:D2:5A:75:9C:FF:CB:79:65:11:C1:05:49:17:73: 98:B0:D2:2B:68:11:FD:ED:02:64:5E:B8:80:85:59:5A:33:A5:9D:B9: 51:49:A2:E2:7B:BB:75:C7:AB:A6:68:C5:99:51:07:F6:49:07:B0:F1: BE:72:21:42:B7:2C:81:03:AC:63:BD:C6:C6:F6:D4:B9:BC:D3:93:BA: F6:E2:16:B6:DA:1A:F6:1F:89:CF:B5:40:A8:C0:6B:70:7F:A2:08:EE: 03:9D:4D:7E:81:4F:45:D2:61:77:AE:60:01:30:E5:AE:B9:42:63:6A: FC:7F:95:78:73:9C:24:D2:C5:F0:58:C2:10:14:18:08:DF:57:50:34: 35:50:4F:DA:D6:29:78:75:9C:1E:1F:1F:9D:C0:A1:1A:2E:02:2B:A5: B0:FB:C6:F3:F1:42:B4:03:49:25:20:5F:C9:1F:5A:C1:2B:CE:71:A9: 5C:F6:9D:04:25:41:52:F9:E7:64:1A:0B:85:85:D3:20:7E:AC:93:5C: 83:F7:FB:78:59:33:30:AE:66:A9:00:0A:66:B2:5B:37:1C:5B:4B:C3: CD:48:9F:A4:96:28:BA:12:EF:7D:CB:75:D7:55:A5:FA:03:D7:1B:E0: FE:14:A4:68:38:87:1D:39:58:B1:85:09:1B:6C:FC:30:1A:FD:A5:AE: 1F:73:1D:B1:5E:22:0A:D6:13:85:93:DA:A7:C1:65:63:CB:E8:86:28: 79:38:FD:8A:84:DE:C4:BB:C6:07:83:4C:58:95:D4:C7:DB:41:DE:52: 27:09:96:CF:43:CD:35:DC:12:92:13:3A:80:8C:04:B1:33:1D:A2:14: 1F:58:6A:DE:DB:D0:D8:78:0D:B8:AF:0C:3B:2C:DA:3A:67:F0:57:EE: AE:DE:22:BB:DF:E1:CC:11:E9:33:A6:49 Thanks! - Richa

4 months, 4 weeks

1
0
0 0

[PATCHSET v2] xfs: proposed bug fixes for 6.13

by Darrick J. Wong

Hi all, Here are even more bugfixes for 6.13 that have been accumulating since 6.12 was released. If you're going to start using this code, I strongly recommend pulling from my git trees, which are linked below. With a bit of luck, this should all go splendidly. Comments and questions are, as always, welcome. --D kernel git tree: https://git.kernel.org/cgit/linux/kernel/git/djwong/xfs-linux.git/log/?h=pr… --- Commits in this patchset: * xfs: don't move nondir/nonreg temporary repair files to the metadir namespace * xfs: don't crash on corrupt /quotas dirent * xfs: check pre-metadir fields correctly * xfs: fix zero byte checking in the superblock scrubber * xfs: return from xfs_symlink_verify early on V4 filesystems * xfs: port xfs_ioc_start_commit to multigrain timestamps --- fs/xfs/libxfs/xfs_symlink_remote.c | 4 ++ fs/xfs/scrub/agheader.c | 66 ++++++++++++++++++++++++++++-------- fs/xfs/scrub/tempfile.c | 3 ++ fs/xfs/xfs_exchrange.c | 14 ++++---- fs/xfs/xfs_qm.c | 7 ++++ 5 files changed, 71 insertions(+), 23 deletions(-)

4 months, 4 weeks

5
34
0 0

[PATCH] usb: ohci-spear: fix call balance of sohci_p->clk handling routines

by Vitalii Mordan

If the clock sohci_p->clk was not enabled in spear_ohci_hcd_drv_probe, it should not be disabled in any path. Conversely, if it was enabled in spear_ohci_hcd_drv_probe, it must be disabled in all error paths to ensure proper cleanup. The check inside spear_ohci_hcd_drv_resume() actually doesn't prevent the clock to be unconditionally disabled later during the driver removal but it is still good to have the check at least so that the PM core would duly print the errors in the system log. This would also be consistent with the similar code paths in ->resume() functions of other usb drivers, e.g. in exynos_ehci_resume(). Found by Linux Verification Center (linuxtesting.org) with Klever. Fixes: 1cc6ac59ffaa ("USB: OHCI: make ohci-spear a separate driver") Cc: stable(a)vger.kernel.org Signed-off-by: Vitalii Mordan <mordan(a)ispras.ru> --- drivers/usb/host/ohci-spear.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/usb/host/ohci-spear.c b/drivers/usb/host/ohci-spear.c index 993f347c5c28..6f6ae6fadfe5 100644 --- a/drivers/usb/host/ohci-spear.c +++ b/drivers/usb/host/ohci-spear.c @@ -80,7 +80,9 @@ static int spear_ohci_hcd_drv_probe(struct platform_device *pdev) sohci_p = to_spear_ohci(hcd); sohci_p->clk = usbh_clk; - clk_prepare_enable(sohci_p->clk); + retval = clk_prepare_enable(sohci_p->clk); + if (retval) + goto err_put_hcd; retval = usb_add_hcd(hcd, irq, 0); if (retval == 0) { @@ -103,8 +105,7 @@ static void spear_ohci_hcd_drv_remove(struct platform_device *pdev) struct spear_ohci *sohci_p = to_spear_ohci(hcd); usb_remove_hcd(hcd); - if (sohci_p->clk) - clk_disable_unprepare(sohci_p->clk); + clk_disable_unprepare(sohci_p->clk); usb_put_hcd(hcd); } @@ -137,12 +138,15 @@ static int spear_ohci_hcd_drv_resume(struct platform_device *dev) struct usb_hcd *hcd = platform_get_drvdata(dev); struct ohci_hcd *ohci = hcd_to_ohci(hcd); struct spear_ohci *sohci_p = to_spear_ohci(hcd); + int ret; if (time_before(jiffies, ohci->next_statechange)) msleep(5); ohci->next_statechange = jiffies; - clk_prepare_enable(sohci_p->clk); + ret = clk_prepare_enable(sohci_p->clk); + if (ret) + return ret; ohci_resume(hcd, false); return 0; } -- 2.25.1

4 months, 4 weeks

2
1
0 0

[tip: x86/urgent] x86/cpu/topology: Remove limit of CPUs due to disabled IO/APIC

by tip-bot2 for Fernando Fernandez Mancera

The following commit has been merged into the x86/urgent branch of tip: Commit-ID: 73da582a476ea6e3512f89f8ed57dfed945829a2 Gitweb: https://git.kernel.org/tip/73da582a476ea6e3512f89f8ed57dfed945829a2 Author: Fernando Fernandez Mancera <ffmancera(a)riseup.net> AuthorDate: Mon, 02 Dec 2024 14:58:45 Committer: Thomas Gleixner <tglx(a)linutronix.de> CommitterDate: Thu, 05 Dec 2024 14:43:32 +01:00 x86/cpu/topology: Remove limit of CPUs due to disabled IO/APIC The rework of possible CPUs management erroneously disabled SMP when the IO/APIC is disabled either by the 'noapic' command line parameter or during IO/APIC setup. SMP is possible without IO/APIC. Remove the ioapic_is_disabled conditions from the relevant possible CPU management code paths to restore the orgininal behaviour. Fixes: 7c0edad3643f ("x86/cpu/topology: Rework possible CPU management") Signed-off-by: Fernando Fernandez Mancera <ffmancera(a)riseup.net> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/20241202145905.1482-1-ffmancera@riseup.net --- arch/x86/kernel/cpu/topology.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/x86/kernel/cpu/topology.c b/arch/x86/kernel/cpu/topology.c index 621a151..b2e313e 100644 --- a/arch/x86/kernel/cpu/topology.c +++ b/arch/x86/kernel/cpu/topology.c @@ -428,8 +428,8 @@ void __init topology_apply_cmdline_limits_early(void) { unsigned int possible = nr_cpu_ids; - /* 'maxcpus=0' 'nosmp' 'nolapic' 'disableapic' 'noapic' */ - if (!setup_max_cpus || ioapic_is_disabled || apic_is_disabled) + /* 'maxcpus=0' 'nosmp' 'nolapic' 'disableapic' */ + if (!setup_max_cpus || apic_is_disabled) possible = 1; /* 'possible_cpus=N' */ @@ -443,7 +443,7 @@ void __init topology_apply_cmdline_limits_early(void) static __init bool restrict_to_up(void) { - if (!smp_found_config || ioapic_is_disabled) + if (!smp_found_config) return true; /* * XEN PV is special as it does not advertise the local APIC

4 months, 4 weeks

1
0
0 0

[PATCH v2 3/6] arm64/kvm: Configure HYP TCR.PS/DS based on host stage1

by Ard Biesheuvel

From: Ard Biesheuvel <ardb(a)kernel.org> When the host stage1 is configured for LPA2, the value currently being programmed into TCR_EL2.T0SZ may be invalid unless LPA2 is configured at HYP as well. This means kvm_lpa2_is_enabled() is not the right condition to test when setting TCR_EL2.DS, as it will return false if LPA2 is only available for stage 1 but not for stage 2. Similary, programming TCR_EL2.PS based on a limited IPA range due to lack of stage2 LPA2 support could potentially result in problems. So use lpa2_is_enabled() instead, and set the PS field according to the host's IPS, which is capped at 48 bits if LPA2 support is absent or disabled. Whether or not we can make meaningful use of such a configuration is a different question. Cc: <stable(a)vger.kernel.org> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> --- arch/arm64/kvm/arm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index a102c3aebdbc..7b2735ad32e9 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -1990,8 +1990,7 @@ static int kvm_init_vector_slots(void) static void __init cpu_prepare_hyp_mode(int cpu, u32 hyp_va_bits) { struct kvm_nvhe_init_params *params = per_cpu_ptr_nvhe_sym(kvm_init_params, cpu); - u64 mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1); - unsigned long tcr; + unsigned long tcr, ips; /* * Calculate the raw per-cpu offset without a translation from the @@ -2005,6 +2004,7 @@ static void __init cpu_prepare_hyp_mode(int cpu, u32 hyp_va_bits) params->mair_el2 = read_sysreg(mair_el1); tcr = read_sysreg(tcr_el1); + ips = FIELD_GET(TCR_IPS_MASK, tcr); if (cpus_have_final_cap(ARM64_KVM_HVHE)) { tcr |= TCR_EPD1_MASK; } else { @@ -2014,8 +2014,8 @@ static void __init cpu_prepare_hyp_mode(int cpu, u32 hyp_va_bits) tcr &= ~TCR_T0SZ_MASK; tcr |= TCR_T0SZ(hyp_va_bits); tcr &= ~TCR_EL2_PS_MASK; - tcr |= FIELD_PREP(TCR_EL2_PS_MASK, kvm_get_parange(mmfr0)); - if (kvm_lpa2_is_enabled()) + tcr |= FIELD_PREP(TCR_EL2_PS_MASK, ips); + if (lpa2_is_enabled()) tcr |= TCR_EL2_DS; params->tcr_el2 = tcr; -- 2.47.0.338.g60cca15819-goog

4 months, 4 weeks

1
0
0 0

[PATCH v2 2/6] arm64/mm: Override PARange for !LPA2 and use it consistently

by Ard Biesheuvel

From: Ard Biesheuvel <ardb(a)kernel.org> When FEAT_LPA{,2} are not implemented, the ID_AA64MMFR0_EL1.PARange and TCR.IPS values corresponding with 52-bit physical addressing are reserved. Setting the TCR.IPS field to 0b110 (52-bit physical addressing) has side effects, such as how the TTBRn_ELx.BADDR fields are interpreted, and so it is important that disabling FEAT_LPA2 (by overriding the ID_AA64MMFR0.TGran fields) also presents a PARange field consistent with that. So limit the field to 48 bits unless LPA2 is enabled, and update existing references to use the override consistently. Fixes: 352b0395b505 ("arm64: Enable 52-bit virtual addressing for 4k and 16k granule configs") Cc: <stable(a)vger.kernel.org> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> --- arch/arm64/include/asm/assembler.h | 5 +++++ arch/arm64/kernel/cpufeature.c | 2 +- arch/arm64/kernel/pi/idreg-override.c | 9 +++++++++ arch/arm64/kernel/pi/map_kernel.c | 6 ++++++ arch/arm64/mm/init.c | 7 ++++++- 5 files changed, 27 insertions(+), 2 deletions(-) diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h index 3d8d534a7a77..ad63457a05c5 100644 --- a/arch/arm64/include/asm/assembler.h +++ b/arch/arm64/include/asm/assembler.h @@ -343,6 +343,11 @@ alternative_cb_end // Narrow PARange to fit the PS field in TCR_ELx ubfx \tmp0, \tmp0, #ID_AA64MMFR0_EL1_PARANGE_SHIFT, #3 mov \tmp1, #ID_AA64MMFR0_EL1_PARANGE_MAX +#ifdef CONFIG_ARM64_LPA2 +alternative_if_not ARM64_HAS_VA52 + mov \tmp1, #ID_AA64MMFR0_EL1_PARANGE_48 +alternative_else_nop_endif +#endif cmp \tmp0, \tmp1 csel \tmp0, \tmp1, \tmp0, hi bfi \tcr, \tmp0, \pos, #3 diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index 6ce71f444ed8..f8cb8a6ab98a 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -3478,7 +3478,7 @@ static void verify_hyp_capabilities(void) return; safe_mmfr1 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR1_EL1); - mmfr0 = read_cpuid(ID_AA64MMFR0_EL1); + mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1); mmfr1 = read_cpuid(ID_AA64MMFR1_EL1); /* Verify VMID bits */ diff --git a/arch/arm64/kernel/pi/idreg-override.c b/arch/arm64/kernel/pi/idreg-override.c index 22159251eb3a..c6b185b885f7 100644 --- a/arch/arm64/kernel/pi/idreg-override.c +++ b/arch/arm64/kernel/pi/idreg-override.c @@ -83,6 +83,15 @@ static bool __init mmfr2_varange_filter(u64 val) id_aa64mmfr0_override.val |= (ID_AA64MMFR0_EL1_TGRAN_LPA2 - 1) << ID_AA64MMFR0_EL1_TGRAN_SHIFT; id_aa64mmfr0_override.mask |= 0xfU << ID_AA64MMFR0_EL1_TGRAN_SHIFT; + + /* + * Override PARange to 48 bits - the override will just be + * ignored if the actual PARange is smaller, but this is + * unlikely to be the case for LPA2 capable silicon. + */ + id_aa64mmfr0_override.val |= + ID_AA64MMFR0_EL1_PARANGE_48 << ID_AA64MMFR0_EL1_PARANGE_SHIFT; + id_aa64mmfr0_override.mask |= 0xfU << ID_AA64MMFR0_EL1_PARANGE_SHIFT; } #endif return true; diff --git a/arch/arm64/kernel/pi/map_kernel.c b/arch/arm64/kernel/pi/map_kernel.c index f374a3e5a5fe..e57b043f324b 100644 --- a/arch/arm64/kernel/pi/map_kernel.c +++ b/arch/arm64/kernel/pi/map_kernel.c @@ -136,6 +136,12 @@ static void noinline __section(".idmap.text") set_ttbr0_for_lpa2(u64 ttbr) { u64 sctlr = read_sysreg(sctlr_el1); u64 tcr = read_sysreg(tcr_el1) | TCR_DS; + u64 mmfr0 = read_sysreg(id_aa64mmfr0_el1); + u64 parange = cpuid_feature_extract_unsigned_field(mmfr0, + ID_AA64MMFR0_EL1_PARANGE_SHIFT); + + tcr &= ~TCR_IPS_MASK; + tcr |= parange << TCR_IPS_SHIFT; asm(" msr sctlr_el1, %0 ;" " isb ;" diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c index d21f67d67cf5..2b2289d55eaa 100644 --- a/arch/arm64/mm/init.c +++ b/arch/arm64/mm/init.c @@ -280,7 +280,12 @@ void __init arm64_memblock_init(void) if (IS_ENABLED(CONFIG_RANDOMIZE_BASE)) { extern u16 memstart_offset_seed; - u64 mmfr0 = read_cpuid(ID_AA64MMFR0_EL1); + + /* + * Use the sanitised version of id_aa64mmfr0_el1 so that linear + * map randomization can be enabled by shrinking the IPA space. + */ + u64 mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1); int parange = cpuid_feature_extract_unsigned_field( mmfr0, ID_AA64MMFR0_EL1_PARANGE_SHIFT); s64 range = linear_region_size - -- 2.47.0.338.g60cca15819-goog

4 months, 4 weeks

1
0
0 0

[PATCH 6.11 000/817] 6.11.11-rc1 review

by Greg Kroah-Hartman

----------- Note, this is will probably be the last 6.11.y kernel to be released. Please move to the 6.12.y branch at this time. ----------- This is the start of the stable review cycle for the 6.11.11 release. There are 817 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 05 Dec 2024 14:36:47 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.11.11-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.11.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.11.11-rc1 Ming Lei <ming.lei(a)redhat.com> block: don't verify IO lock for freeze/unfreeze in elevator_init_mq() Ming Lei <ming.lei(a)redhat.com> block: always verify unfreeze lock on the owner task Patryk Wlazlyn <patryk.wlazlyn(a)linux.intel.com> tools/power turbostat: Fix child's argument forwarding Zhang Rui <rui.zhang(a)intel.com> tools/power turbostat: Fix trailing '\n' parsing Dan Carpenter <dan.carpenter(a)linaro.org> sh: intc: Fix use-after-free bug in register_intc_controller() Zhang Xianwei <zhang.xianwei8(a)zte.com.cn> brd: decrease the number of allocated pages which discarded Yu Kuai <yukuai3(a)huawei.com> block, bfq: fix bfqq uaf in bfq_limit_depth() Benjamin Coddington <bcodding(a)redhat.com> nfs/blocklayout: Limit repeat device registration on failure Benjamin Coddington <bcodding(a)redhat.com> nfs/blocklayout: Don't attempt unregister for invalid block device Liu Jian <liujian56(a)huawei.com> sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket Benjamin Coddington <bcodding(a)redhat.com> SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT Liu Jian <liujian56(a)huawei.com> sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport Li Lingfeng <lilingfeng3(a)huawei.com> nfs: ignore SB_RDONLY when mounting nfs Dan Carpenter <dan.carpenter(a)linaro.org> cifs: unlock on error in smb3_reconfigure() Shyam Prasad N <sprasad(a)microsoft.com> cifs: during remount, make sure passwords are in sync Masahiro Yamada <masahiroy(a)kernel.org> modpost: remove incorrect code in do_eisa_entry() John Garry <john.g.garry(a)oracle.com> block: Don't allow an atomic write be truncated in blkdev_write_iter() Paul Aurich <paul(a)darkrain42.org> smb: Initialize cfid->tcon before performing network ops Matt Fleming <mfleming(a)cloudflare.com> kbuild: deb-pkg: Don't fail if modules.order is missing Masahiro Yamada <masahiroy(a)kernel.org> Rename .data.once to .data..once to fix resetting WARN*_ONCE Masahiro Yamada <masahiroy(a)kernel.org> Rename .data.unlikely to .data..unlikely Maxime Chevallier <maxime.chevallier(a)bootlin.com> rtc: ab-eoz9: don't fail temperature reads on undervoltage notification Pali Rohár <pali(a)kernel.org> cifs: Fix parsing reparse point with native symlink in SMB1 non-UNICODE session Pali Rohár <pali(a)kernel.org> cifs: Fix parsing native symlinks relative to the export Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> x86/Documentation: Update algo in init_size description of boot protocol Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: disable directory caching when dir_cache_timeout is zero Namhyung Kim <namhyung(a)kernel.org> perf/arm-cmn: Ensure port and device id bits are set properly Chun-Tse Shao <ctshao(a)google.com> perf/arm-smmuv3: Fix lockdep assert in ->event_init() Alex Zenla <alex(a)edera.dev> 9p/xen: fix release of IRQ Alex Zenla <alex(a)edera.dev> 9p/xen: fix init sequence Nilay Shroff <nilay(a)linux.ibm.com> nvme-fabrics: fix kernel crash while shutting down controller Christoph Hellwig <hch(a)lst.de> block: return unsigned int from bdev_io_min Yu Kuai <yukuai3(a)huawei.com> block: fix uaf for flush rq while iterating tags Ming Lei <ming.lei(a)redhat.com> block: model freeze & enter queue as lock for supporting lockdep Ming Lei <ming.lei(a)redhat.com> blk-mq: add non_owner variant of start_freeze/unfreeze queue APIs Breno Leitao <leitao(a)debian.org> nvme/multipath: Fix RCU list traversal to use SRCU primitive Hannes Reinecke <hare(a)kernel.org> nvme-multipath: avoid hang on inaccessible namespaces Trond Myklebust <trond.myklebust(a)hammerspace.com> Revert "nfs: don't reuse partially completed requests in nfs_lock_and_join_requests" Wolfram Sang <wsa+renesas(a)sang-engineering.com> rtc: rzn1: fix BCD to rtc_time conversion errors Qingfang Deng <qingfang.deng(a)siflower.com.cn> jffs2: fix use of uninitialized variable Waqar Hameed <waqar.hameed(a)axis.com> ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit Zhihao Cheng <chengzhihao1(a)huawei.com> ubi: fastmap: Fix duplicate slab cache names while attaching Zhihao Cheng <chengzhihao1(a)huawei.com> ubifs: Correct the total block count by deducting journal reservation Zhihao Cheng <chengzhihao1(a)huawei.com> ubi: fastmap: wl: Schedule fm_work if wear-leveling pool is empty Yongliang Gao <leonylgao(a)tencent.com> rtc: check if __rtc_read_time was successful in rtc_timer_do_work() Nobuhiro Iwamatsu <iwamatsu(a)nigauri.org> rtc: abx80x: Fix WDT bit position of the status register Jinjie Ruan <ruanjinjie(a)huawei.com> rtc: st-lpc: Use IRQF_NO_AUTOEN flag in request_irq() Trond Myklebust <trond.myklebust(a)hammerspace.com> NFSv4.0: Fix a use-after-free problem in the asynchronous open() Tiwei Bie <tiwei.btw(a)antgroup.com> um: Always dump trace for specified task in show_stack Tiwei Bie <tiwei.btw(a)antgroup.com> um: ubd: Initialize ubd's disk pointer in ubd_add Christoph Hellwig <hch(a)lst.de> kfifo: don't include dma-mapping.h in kfifo.h Tiwei Bie <tiwei.btw(a)antgroup.com> um: Fix the return value of elf_core_copy_task_fpregs Tiwei Bie <tiwei.btw(a)antgroup.com> um: Fix potential integer overflow during physmem setup Yang Erkun <yangerkun(a)huawei.com> SUNRPC: make sure cache entry active before cache_show Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent a potential integer overflow Yuan Can <yuancan(a)huawei.com> Input: cs40l50 - fix wrong usage of INIT_WORK() Ma Wupeng <mawupeng1(a)huawei.com> ipc: fix memleak if msg_init_ns failed in create_ipc_ns Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on node blkaddr in truncate_node() Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> lib: string_helpers: silence snprintf() output truncation warning Ming Lei <ming.lei(a)redhat.com> ublk: fix error code for unsupported command Javier Carrasco <javier.carrasco.cruz(a)gmail.com> counter: stm32-timer-cnt: fix device_node handling in probe_encoder() Javier Carrasco <javier.carrasco.cruz(a)gmail.com> staging: vchiq_arm: Fix missing refcount decrement in error path for fw_node Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: gadget: Fix looping of queued SG entries Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: gadget: Fix checking for number of TRBs left Hubert Wiśniewski <hubert.wisniewski.25632(a)gmail.com> usb: musb: Fix hardware lockup on first Rx endpoint request Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED Stanislaw Gruszka <stanislaw.gruszka(a)linux.intel.com> usb: misc: ljca: move usb_autopm_put_interface() after wait for response Stanislaw Gruszka <stanislaw.gruszka(a)linux.intel.com> usb: misc: ljca: set small runtime autosuspend delay Paul Aurich <paul(a)darkrain42.org> smb: During unmount, ensure all cached dir instances drop their dentry Paul Aurich <paul(a)darkrain42.org> smb: prevent use-after-free due to open_cached_dir error paths Paul Aurich <paul(a)darkrain42.org> smb: Don't leak cfid when reconnect races with open_cached_dir Paulo Alcantara <pc(a)manguebit.com> smb: client: handle max length for SMB symlinks Steve French <stfrench(a)microsoft.com> smb3: request handle caching when caching directories Takashi Iwai <tiwai(a)suse.de> ALSA: hda/realtek: Apply quirk for Medion E15433 Dinesh Kumar <desikumar81(a)gmail.com> ALSA: hda/realtek: Fix Internal Speaker and Mic boost of Infinix Y4 Max Kailang Yang <kailang(a)realtek.com> ALSA: hda/realtek: Set PCBeep to default value for ALC274 Kailang Yang <kailang(a)realtek.com> ALSA: hda/realtek: Update ALC225 depop procedure Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: Add sanity NULL check for the default mmap fault handler Takashi Iwai <tiwai(a)suse.de> ALSA: ump: Fix evaluation of MIDI 1.0 FB info Takashi Iwai <tiwai(a)suse.de> ALSA: rawmidi: Fix kvfree() call in spinlock Hans Verkuil <hverkuil(a)xs4all.nl> media: v4l2-core: v4l2-dv-timings: check cvt/gtf result Javier Carrasco <javier.carrasco.cruz(a)gmail.com> soc: fsl: rcpm: fix missing of_node_put() in copy_ippdexpcr1_setting() Joe Damato <jdamato(a)fastly.com> netdev-genl: Hold rcu_read_lock in napi_get Chen-Yu Tsai <wenst(a)chromium.org> arm64: dts: mediatek: mt8186-corsola-voltorb: Merge speaker codec nodes Stanislaw Gruszka <stanislaw.gruszka(a)linux.intel.com> media: intel/ipu6: do not handle interrupts when device is disabled Qiu-ji Chen <chenqiuji666(a)gmail.com> media: wl128x: Fix atomicity violation in fmc_send_cmd() Peter Große <pegro(a)friiks.de> i40e: Fix handling changed priv flags Jason Gerecke <jason.gerecke(a)wacom.com> HID: wacom: Interpret tilt data from Intuos Pro BT as signed values Ziwei Xiao <ziweixiao(a)google.com> gve: Flow steering trigger reset only for timeout error Bart Van Assche <bvanassche(a)acm.org> blk-mq: Make blk_mq_quiesce_tagset() hold the tag list mutex less long Muchun Song <muchun.song(a)linux.dev> block: fix ordering between checking BLK_MQ_S_STOPPED request adding Muchun Song <muchun.song(a)linux.dev> block: fix ordering between checking QUEUE_FLAG_QUIESCED request adding Muchun Song <muchun.song(a)linux.dev> block: fix missing dispatching request when queue is started or unquiesced Will Deacon <will(a)kernel.org> arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled Ming Lei <ming.lei(a)redhat.com> ublk: fix ublk_ch_mmap() for 64K page size Zicheng Qu <quzicheng(a)huawei.com> iio: gts: Fix uninitialized symbol 'ret' Huacai Chen <chenhuacai(a)kernel.org> sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK Tiwei Bie <tiwei.btw(a)antgroup.com> um: vector: Do not use drvdata in release Damien Le Moal <dlemoal(a)kernel.org> block: Prevent potential deadlock in blk_revalidate_disk_zones() Javier Carrasco <javier.carrasco.cruz(a)gmail.com> mtd: ubi: fix unreleased fwnode_handle in find_volume_fwnode() Arnd Bergmann <arnd(a)arndb.de> serial: amba-pl011: fix build regression Kartik Rajput <kkartik(a)nvidia.com> serial: amba-pl011: Fix RX stall when DMA is used Bin Liu <b-liu(a)ti.com> serial: 8250: omap: Move pm_runtime_get_sync Filip Brozovic <fbrozovic(a)gmail.com> serial: 8250_fintek: Add support for F81216E Michal Simek <michal.simek(a)amd.com> dt-bindings: serial: rs485: Fix rs485-rts-delay property Tiwei Bie <tiwei.btw(a)antgroup.com> um: net: Do not use drvdata in release Tiwei Bie <tiwei.btw(a)antgroup.com> um: ubd: Do not use drvdata in release Zhihao Cheng <chengzhihao1(a)huawei.com> ubi: wl: Put source PEB into correct list if trying locking LEB failed Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> x86/CPU/AMD: Terminate the erratum_1386_microcode array Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> irqchip/irq-mvebu-sei: Move misplaced select() callback to SEI CP domain Javier Carrasco <javier.carrasco.cruz(a)gmail.com> platform/chrome: cros_ec_typec: fix missing fwnode reference decrement Paulo Alcantara <pc(a)manguebit.com> smb: client: fix NULL ptr deref in crypto_aead_setkey() Yunseong Kim <yskelg(a)gmail.com> ksmbd: fix use-after-free in SMB request handling Jesse Taube <jesse(a)rivosinc.com> RISC-V: Check scalar unaligned access on all CPUs Jesse Taube <jesse(a)rivosinc.com> RISC-V: Scalar unaligned access emulated on hotplug CPUs Josh Poimboeuf <jpoimboe(a)kernel.org> parisc/ftrace: Fix function graph tracing disablement Meetakshi Setiya <msetiya(a)microsoft.com> cifs: support mounting with alternate password to allow password rotation Jinjie Ruan <ruanjinjie(a)huawei.com> cpufreq: mediatek-hw: Fix wrong return value in mtk_cpufreq_get_cpu_power() Cheng Ming Lin <chengminglin(a)mxic.com.tw> mtd: spi-nor: core: replace dummy buswidth from addr to data Stanislaw Gruszka <stanislaw.gruszka(a)linux.intel.com> spi: Fix acpi deferred irq probe Jeongjun Park <aha310510(a)gmail.com> netfilter: ipset: add missing range check in bitmap_ip_uadt Sai Kumar Cholleti <skmr537(a)gmail.com> gpio: exar: set value when external pull-up or pull-down is present Mikulas Patocka <mpatocka(a)redhat.com> blk-settings: round down io_opt to physical_block_size Pavel Begunkov <asml.silence(a)gmail.com> io_uring: check for overflows in io_pin_pages Pavel Begunkov <asml.silence(a)gmail.com> io_uring: fix corner case forgetting to vunmap Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit" Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> serial: sh-sci: Clean sci_ports[0] after at earlycon exit Michal Vrastil <michal.vrastil(a)hidglobal.com> Revert "usb: gadget: composite: fix OS descriptors w_value logic" Jaegeuk Kim <jaegeuk(a)kernel.org> Revert "f2fs: remove unreachable lazytime mount option parsing" Christian Brauner <brauner(a)kernel.org> Revert "fs: don't block i_writecount during exec" Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "exec: don't WARN for racy path_noexec check" Javier Carrasco <javier.carrasco.cruz(a)gmail.com> wifi: brcmfmac: release 'root' node in all execution paths Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath12k: fix crash when unbinding Aleksei Vetrov <vvvvvv(a)google.com> wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan Guilherme G. Piccoli <gpiccoli(a)igalia.com> wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath12k: fix warning when unbinding Andreas Kemnade <andreas(a)kemnade.info> ARM: dts: omap36xx: declare 1GHz OPP as turbo again Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Avoid queuing redundant Stop Endpoint commands Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Fix TD invalidation under pending Set TR Dequeue Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Limit Stop Endpoint retries Andrej Shadura <andrew.shadura(a)collabora.co.uk> Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}() Kuangyi Chiang <ki.chiang65(a)gmail.com> xhci: Don't issue Reset Device command to Etron xHCI host Kuangyi Chiang <ki.chiang65(a)gmail.com> xhci: Don't perform Soft Retry for Etron xHCI host Kuangyi Chiang <ki.chiang65(a)gmail.com> xhci: Combine two if statements for Etron xHCI host Kuangyi Chiang <ki.chiang65(a)gmail.com> xhci: Fix control transfer error on Etron xHCI host Yuezhang Mo <Yuezhang.Mo(a)sony.com> exfat: fix out-of-bounds access of directory entries Namjae Jeon <linkinjeon(a)kernel.org> exfat: fix uninit-value in __exfat_get_dentry_set Angelo Dureghello <adureghello(a)baylibre.com> dt-bindings: iio: dac: ad3552r: fix maximum spi speed Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> dt-bindings: pinctrl: samsung: Fix interrupt constraint for variants with fallbacks Johan Hovold <johan+linaro(a)kernel.org> pinctrl: qcom: spmi: fix debugfs drive strength Thomas Weißschuh <thomas.weissschuh(a)linutronix.de> tools/nolibc: s390: include std.h Ahmed Ehab <bottaawesome633(a)gmail.com> locking/lockdep: Avoid creating new name string literals in lockdep_set_subclass() Nicolas Bouchinet <nicolas.bouchinet(a)ssi.gouv.fr> tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler Angelo Dureghello <adureghello(a)baylibre.com> iio: dac: adi-axi-dac: fix wrong register bitfield Jinjie Ruan <ruanjinjie(a)huawei.com> apparmor: test: Fix memory leak for aa_unpack_strdup() Jann Horn <jannh(a)google.com> comedi: Flush partial mappings in error case Jann Horn <jannh(a)google.com> fsnotify: Fix ordering of iput() and watched_objects decrement Amir Goldstein <amir73il(a)gmail.com> fsnotify: fix sending inotify event with unexpected filename Gustavo A. R. Silva <gustavoars(a)kernel.org> clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access Gustavo A. R. Silva <gustavoars(a)kernel.org> clk: clk-loongson2: Fix memory corruption bug in struct loongson2_clk_provider Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Explicitly specify code model in Makefile Lukas Wunner <lukas(a)wunner.de> PCI: Fix use-after-free of slot->bus on hot remove Jan Hendrik Farr <kernel(a)jfarr.cc> Compiler Attributes: disable __counted_by for clang < 19.1.3 Kunkun Jiang <jiangkunkun(a)huawei.com> KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device Jing Zhang <jingzhangos(a)google.com> KVM: arm64: vgic-its: Add a data length check in vgic_its_save_* Raghavendra Rao Ananta <rananta(a)google.com> KVM: arm64: Get rid of userspace_irqchip_in_use Kunkun Jiang <jiangkunkun(a)huawei.com> KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE Oliver Upton <oliver.upton(a)linux.dev> KVM: arm64: Don't retire aborted MMIO instruction Raghavendra Rao Ananta <rananta(a)google.com> KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status Marc Zyngier <maz(a)kernel.org> KVM: arm64: vgic-v3: Sanitise guest writes to GICR_INVLPIR Gautam Menghani <gautam(a)linux.ibm.com> powerpc/pseries: Fix KVM guest detection for disabling hardlockup detector Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Skip the "try unsync" path iff the old SPTE was a leaf SPTE Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: switch hugepage recovery thread to vhost_task Eric Biggers <ebiggers(a)google.com> crypto: x86/aegis128 - access 32-bit arguments as 32-bit Adrian Hunter <adrian.hunter(a)intel.com> perf/x86/intel/pt: Fix buffer full but size is 0 case Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> ASoC: da7213: Populate max_register to regmap_config Qiu-ji Chen <chenqiuji666(a)gmail.com> ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata() Ilya Zverev <ilya(a)zverev.info> ASoC: amd: yc: Add a quirk for microfone on Lenovo ThinkPad P14s Gen 5 21MES00B00 Artem Sadovnikov <ancowi69(a)gmail.com> jfs: xattr: check invalid xattr size more strictly Theodore Ts'o <tytso(a)mit.edu> ext4: fix FS_IOC_GETFSMAP handling Jeongjun Park <aha310510(a)gmail.com> ext4: supress data-race warnings in ext4_free_inodes_{count,set}() Matti Vaittinen <mazziesaccount(a)gmail.com> irqdomain: Always associate interrupts for legacy domains Manikanta Mylavarapu <quic_mmanikan(a)quicinc.com> soc: qcom: socinfo: fix revision check in qcom_socinfo_probe() Hans de Goede <hdegoede(a)redhat.com> ASoC: Intel: sst: Fix used of uninitialized ctx to log an error Mikulas Patocka <mpatocka(a)redhat.com> dm-bufio: fix warnings about duplicate slab caches Mikulas Patocka <mpatocka(a)redhat.com> dm-cache: fix warnings about duplicate slab caches Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> usb: typec: ucsi: glink: fix off-by-one in connector_status Vitalii Mordan <mordan(a)ispras.ru> usb: ehci-spear: fix call balance of sehci clk handling routines Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Fix out of bounds reads when finding clock sources Benoît Sevens <bsevens(a)google.com> ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices Qiu-ji Chen <chenqiuji666(a)gmail.com> xen: Fix the issue of resource not being properly released in xenbus_dev_probe() Jakub Kicinski <kuba(a)kernel.org> net_sched: sch_fq: don't follow the fast path if Tx is behind now Niklas Schnelle <schnelle(a)linux.ibm.com> s390/pci: Fix potential double remove of hotplug slot Nícolas F. R. A. Prado <nfraprado(a)collabora.com> ASoC: mediatek: Check num_codecs is not zero to avoid panic during probe Venkata Prasad Potturu <venkataprasad.potturu(a)amd.com> ASoC: amd: yc: Fix for enabling DMIC on acp6x via _DSD entry Zichen Xie <zichenxie0106(a)gmail.com> ALSA: core: Fix possible NULL dereference caused by kunit_kzalloc() chao liu <liuzgyid(a)outlook.com> apparmor: fix 'Do simple duplicate message elimination' Nirmoy Das <nirmoy.das(a)intel.com> drm/xe/ufence: Wake up waiters after setting ufence->signalled Charles Han <hanchunchao(a)inspur.com> ASoC: imx-audmix: Add NULL check in imx_audmix_probe Zicheng Qu <quzicheng(a)huawei.com> drm/amd/display: Fix null check for pipe_ctx->plane_state in hwss_setup_dpp Zicheng Qu <quzicheng(a)huawei.com> drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe Steven 'Steve' Kendall <skend(a)chromium.org> drm/radeon: Fix spurious unplug event on radeon HDMI Wu Hoi Pok <wuhoipok(a)gmail.com> drm/radeon: change rdev->ddev to rdev_to_drm(rdev) Wu Hoi Pok <wuhoipok(a)gmail.com> drm/radeon: add helper rdev_to_drm(rdev) Kailang Yang <kailang(a)realtek.com> ALSA: hda/realtek: Update ALC256 depop procedure Gaosheng Cui <cuigaosheng1(a)huawei.com> firmware_loader: Fix possible resource leak in fw_log_firmware_info() Dan Carpenter <dan.carpenter(a)linaro.org> usb: typec: fix potential array underflow in ucsi_ccg_sync_control() Carl Vanderlip <quic_carlv(a)quicinc.com> bus: mhi: host: Switch trace_mhi_gen_tre fields to native endian Jiasheng Jiang <jiashengjiangcool(a)gmail.com> counter: ti-ecap-capture: Add check for clk_enable() Jiasheng Jiang <jiashengjiangcool(a)gmail.com> counter: stm32-timer-cnt: Add check for clk_enable() Charles Han <hanchunchao(a)inspur.com> phy: realtek: usb: fix NULL deref in rtk_usb3phy_probe Charles Han <hanchunchao(a)inspur.com> phy: realtek: usb: fix NULL deref in rtk_usb2phy_probe Raviteja Laggyshetty <quic_rlaggysh(a)quicinc.com> interconnect: qcom: icc-rpmh: probe defer incase of missing QoS clock dependency Michael Grzeschik <m.grzeschik(a)pengutronix.de> usb: gadget: uvc: wake pump everytime we update the free list Keita Morisaki <keyz(a)google.com> devres: Fix page faults when tracing devres from unloaded modules Jinjie Ruan <ruanjinjie(a)huawei.com> misc: apds990x: Fix missing pm_runtime_disable() Edward Adam Davis <eadavis(a)qq.com> USB: chaoskey: Fix possible deadlock chaoskey_list_lock Oliver Neukum <oneukum(a)suse.com> USB: chaoskey: fail open after removal Oliver Neukum <oneukum(a)suse.com> usb: yurex: make waiting on yurex_write interruptible Jeongjun Park <aha310510(a)gmail.com> usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> iio: light: al3010: Fix an error handling path in al3010_probe() Paolo Abeni <pabeni(a)redhat.com> ipmr: fix tables suspicious RCU usage Paolo Abeni <pabeni(a)redhat.com> ip6mr: fix tables suspicious RCU usage Kuniyuki Iwashima <kuniyu(a)amazon.com> tcp: Fix use-after-free of nreq in reqsk_timer_handler(). Michal Luczaj <mhal(a)rbox.co> rxrpc: Improve setsockopt() handling of malformed user input Michal Luczaj <mhal(a)rbox.co> llc: Improve setsockopt() handling of malformed user input Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: MGMT: Fix possible deadlocks Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Unregister PTP during PCI shutdown and suspend Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Refactor bnxt_ptp_init() Shravya KN <shravya.k-n(a)broadcom.com> bnxt_en: Fix receive ring space parameters when XDP is active Shravya KN <shravya.k-n(a)broadcom.com> bnxt_en: Set backplane link modes correctly for ethtool Saravanan Vajravel <saravanan.vajravel(a)broadcom.com> bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down Eric Dumazet <edumazet(a)google.com> net: hsr: fix hsr_init_sk() vs network/transport headers. Csókás, Bence <csokas.bence(a)prolan.hu> spi: atmel-quadspi: Fix register name in verbose logging function Hariprasad Kelam <hkelam(a)marvell.com> octeontx2-af: Quiesce traffic before NIX block reset Hariprasad Kelam <hkelam(a)marvell.com> octeontx2-af: RPM: fix stale FCFEC counters Hariprasad Kelam <hkelam(a)marvell.com> octeontx2-af: RPM: fix stale RSFEC counters Hariprasad Kelam <hkelam(a)marvell.com> octeontx2-af: RPM: Fix low network performance Hariprasad Kelam <hkelam(a)marvell.com> octeontx2-af: RPM: Fix mismatch in lmac type Maxime Chevallier <maxime.chevallier(a)bootlin.com> net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken Vitalii Mordan <mordan(a)ispras.ru> marvell: pxa168_eth: fix call balance of pep->clk handling routines Rosen Penev <rosenp(a)gmail.com> net: mdio-ipq4019: add missing error check Hangbin Liu <liuhangbin(a)gmail.com> net/ipv6: delete temporary address if mngtmpaddr is removed or unmanaged Sidraya Jayagond <sidraya(a)linux.ibm.com> s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() Yuezhang Mo <Yuezhang.Mo(a)sony.com> exfat: fix file being changed by unaligned direct write Jakub Kicinski <kuba(a)kernel.org> netlink: fix false positive warning in extack during dumps Guenter Roeck <linux(a)roeck-us.net> net: microchip: vcap: Add typegroup table terminators in kunit tests Oleksij Rempel <o.rempel(a)pengutronix.de> net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration Pavan Chebbi <pavan.chebbi(a)broadcom.com> tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets Oleksij Rempel <o.rempel(a)pengutronix.de> net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device Oleksij Rempel <o.rempel(a)pengutronix.de> net: usb: lan78xx: Fix double free issue with interrupt buffer allocation ChiYuan Huang <cy_huang(a)richtek.com> power: supply: rt9471: Use IC status regfield to report real charger status ChiYuan Huang <cy_huang(a)richtek.com> power: supply: rt9471: Fix wrong WDT function regfield declaration Barnabás Czémán <barnabas.czeman(a)mainlining.org> power: supply: bq27xxx: Fix registers of bq27426 Bart Van Assche <bvanassche(a)acm.org> power: supply: core: Remove might_sleep() from power_supply_put() Tiezhu Yang <yangtiezhu(a)loongson.cn> LoongArch: BPF: Sign-extend return values Tiezhu Yang <yangtiezhu(a)loongson.cn> LoongArch: Fix build failure with GCC 15 (-std=gnu23) Randy Dunlap <rdunlap(a)infradead.org> fs_parser: update mount_api doc to match function signature Avihai Horon <avihaih(a)nvidia.com> vfio/pci: Properly hide first-in-list PCIe extended capability Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> gpio: zevio: Add missed label initialisation Michael Ellerman <mpe(a)ellerman.id.au> selftests/mount_setattr: Fix failures on 64K PAGE_SIZE kernels Yishai Hadas <yishaih(a)nvidia.com> vfio/mlx5: Fix unwind flows in mlx5vf_pci_save/resume_device_data() Yishai Hadas <yishaih(a)nvidia.com> vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() Si-Wei Liu <si-wei.liu(a)oracle.com> vdpa/mlx5: Fix suboptimal range on iotlb iteration Lorenzo Bianconi <lorenzo(a)kernel.org> phy: airoha: Fix REG_CSR_2L_RX{0,1}_REV0 definitions Lorenzo Bianconi <lorenzo(a)kernel.org> phy: airoha: Fix REG_CSR_2L_JCPLL_SDM_HREN config in airoha_pcie_phy_init_ssc_jcpll() Lorenzo Bianconi <lorenzo(a)kernel.org> phy: airoha: Fix REG_PCIE_PMA_TX_RESET config in airoha_pcie_phy_init_csr_2l() Lorenzo Bianconi <lorenzo(a)kernel.org> phy: airoha: Fix REG_CSR_2L_PLL_CMN_RESERVE0 config in airoha_pcie_phy_init_clk_out() Aleksa Savic <savicaleksa83(a)gmail.com> hwmon: (aquacomputer_d5next) Fix length of speed_input array Murad Masimov <m.masimov(a)maxima.ru> hwmon: (tps23861) Fix reporting of negative temperatures Chao Yu <chao(a)kernel.org> f2fs: fix to do cast in F2FS_{BLK_TO_BYTES, BTYES_TO_BLK} to avoid overflow Zhiguo Niu <zhiguo.niu(a)unisoc.com> f2fs: clean up val{>>,<<}F2FS_BLKSIZE_BITS Chuck Lever <chuck.lever(a)oracle.com> NFSD: Fix nfsd4_shutdown_copy() Ye Bin <yebin10(a)huawei.com> svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() Yang Erkun <yangerkun(a)huawei.com> nfsd: release svc_expkey/svc_export with rcu_work Chuck Lever <chuck.lever(a)oracle.com> NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir() Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent NULL dereference in nfsd4_process_cb_update() Zhongqiu Han <quic_zhonhan(a)quicinc.com> PCI: endpoint: epf-mhi: Avoid NULL dereference if DT lacks 'mmio' Sibi Sankar <quic_sibis(a)quicinc.com> remoteproc: qcom_q6v5_mss: Re-order writes to the IMEM region Jonathan Marek <jonathan(a)marek.ca> rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> remoteproc: qcom: pas: add minidump_id to SM8350 resources Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> remoteproc: qcom: adsp: Remove subdevs on the error path of adsp_probe() Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> remoteproc: qcom: pas: Remove subdevs on the error path of adsp_probe() Benjamin Peterson <benjamin(a)engflow.com> perf trace: Avoid garbage when not printing a syscall's arguments Benjamin Peterson <benjamin(a)engflow.com> perf trace: Do not lose last events in a race Howard Chu <howardchu95(a)gmail.com> perf trace: Fix tracing itself, creating feedback loops Jean-Philippe Romain <jean-philippe.romain(a)foss.st.com> perf list: Fix topic and pmu_name argument order Jeff Layton <jlayton(a)kernel.org> nfsd: drop inode parameter from nfsd4_change_attribute() Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Address an integer overflow Antonio Quartulli <antonio(a)mandelbit.com> m68k: coldfire/device.c: only build FEC when HW macros are defined Jean-Michel Hautbois <jeanmichel.hautbois(a)yoseli.org> m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x Benjamin Peterson <benjamin(a)engflow.com> perf trace: avoid garbage when not printing a trace event's arguments Chao Yu <chao(a)kernel.org> f2fs: fix to avoid forcing direct write to use buffered IO on inline_data inode Chao Yu <chao(a)kernel.org> f2fs: fix to map blocks correctly for direct write Long Li <leo.lilong(a)huawei.com> f2fs: fix race in concurrent f2fs_stop_gc_thread Yicong Yang <yangyicong(a)hisilicon.com> perf build: Add missing cflags when building with custom libtraceevent Siddharth Vadapalli <s-vadapalli(a)ti.com> PCI: j721e: Deassert PERST# after a delay of PCIE_T_PVPERL_MS milliseconds Théo Lebrun <theo.lebrun(a)bootlin.com> PCI: j721e: Add suspend and resume support Thomas Richard <thomas.richard(a)bootlin.com> PCI: j721e: Use T_PERST_CLK_US macro Théo Lebrun <theo.lebrun(a)bootlin.com> PCI: j721e: Add reset GPIO to struct j721e_pcie Thomas Richard <thomas.richard(a)bootlin.com> PCI: cadence: Set cdns_pcie_host_init() global Thomas Richard <thomas.richard(a)bootlin.com> PCI: cadence: Extract link setup sequence from cdns_pcie_host_setup() Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> PCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert() Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert() Zhiguo Niu <zhiguo.niu(a)unisoc.com> f2fs: fix to avoid use GC_AT when setting gc_mode as GC_URGENT_LOW or GC_URGENT_MID Chao Yu <chao(a)kernel.org> f2fs: fix to avoid potential deadlock in f2fs_record_stop_reason() Zeng Heng <zengheng4(a)huawei.com> f2fs: Fix not used variable 'index' Yongpeng Yang <yangyongpeng1(a)oppo.com> f2fs: check curseg->inited before write_sum_page in change_curseg LongPing Wei <weilongping(a)oppo.com> f2fs: fix the wrong f2fs_bug_on condition in f2fs_do_replace_block Frank Li <Frank.Li(a)nxp.com> i3c: master: Remove i3c_dev_disable_ibi_locked(olddev) on device hotjoin Arnaldo Carvalho de Melo <acme(a)kernel.org> perf ftrace latency: Fix unit on histogram first entry when using --use-nsec Hou Tao <houtao1(a)huawei.com> virtiofs: use pages instead of pointer for kernel direct IO Li Huafei <lihuafei1(a)huawei.com> perf disasm: Use disasm_line__free() to properly free disasm_line Francesco Zardi <frazar00(a)gmail.com> rust: block: fix formatting of `kernel::block::mq::request` module Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> PCI: cpqphp: Fix PCIBIOS_* return value confusion weiyufeng <weiyufeng(a)kylinos.cn> PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads Paolo Bonzini <pbonzini(a)redhat.com> rust: macros: fix documentation of the paste! macro Yutaro Ohno <yutaro.ono.418(a)gmail.com> rust: kernel: fix THIS_MODULE header path in ThisModule doc comment Leo Yan <leo.yan(a)arm.com> perf probe: Correct demangled symbols in C++ program Ian Rogers <irogers(a)google.com> perf probe: Fix libdw memory leak Veronika Molnarova <vmolnaro(a)redhat.com> perf dso: Fix symtab_type for kmod compression Chao Yu <chao(a)kernel.org> f2fs: fix to account dirty data in __get_secs_required() Ye Bin <yebin10(a)huawei.com> f2fs: fix null-ptr-deref in f2fs_submit_page_bio() Qi Han <hanqi(a)vivo.com> f2fs: compress: fix inconsistent update of i_blocks in release_compress_blocks and reserve_compress_blocks Veronika Molnarova <vmolnaro(a)redhat.com> perf test attr: Add back missing topdown events Michael Petlan <mpetlan(a)redhat.com> perf trace: Keep exited threads for summary Ian Rogers <irogers(a)google.com> perf stat: Fix affinity memory leaks on error path Levi Yun <yeoreum.yun(a)arm.com> perf stat: Close cork_fd when create_perf_stat_counter() failed Todd Kjos <tkjos(a)google.com> PCI: Fix reset_method_store() memory leak Thomas Falcon <thomas.falcon(a)intel.com> perf mem: Fix printing PERF_MEM_LVLNUM_{L2_MHB|MSC} Ian Rogers <irogers(a)google.com> perf stat: Uniquify event name improvements Weilin Wang <weilin.wang(a)intel.com> perf test: Add test for Intel TPEBS counting mode Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: Fix unlinked inode cleanup Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: Allow immediate GLF_VERIFY_DELETE work Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE James Clark <james.clark(a)linaro.org> perf cs-etm: Don't flush when packet_queue fills up David Laight <David.Laight(a)ACULAB.COM> x86: fix off-by-one in access_ok() Dan Carpenter <dan.carpenter(a)linaro.org> mailbox: arm_mhuv2: clean up loop in get_irq_chan_comb() Yang Yingliang <yangyingliang(a)huawei.com> mailbox: mtk-cmdq: fix wrong use of sizeof in cmdq_get_clocks() Paul Aurich <paul(a)darkrain42.org> smb: cached directories can be more than root file handle Tomas Glozar <tglozar(a)redhat.com> rtla/timerlat: Do not set params->user_workload with -U zhang jiao <zhangjiao2(a)cmss.chinamobile.com> pinctrl: k210: Undef K210_PC_DEFAULT Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> arm64: dts: qcom: sc8180x: Add a SoC-specific compatible to cpufreq-hw Nuno Sa <nuno.sa(a)analog.com> clk: clk-axi-clkgen: make sure to enable the AXI bus clock Nuno Sa <nuno.sa(a)analog.com> dt-bindings: clock: axi-clkgen: include AXI clk Lorenzo Bianconi <lorenzo(a)kernel.org> clk: en7523: fix estimation of fixed rate for EN7581 Lorenzo Bianconi <lorenzo(a)kernel.org> clk: en7523: introduce chip_scu regmap Lorenzo Bianconi <lorenzo(a)kernel.org> clk: en7523: move clock_register in hw_init callback Lorenzo Bianconi <lorenzo(a)kernel.org> clk: en7523: remove REG_PCIE*_{MEM,MEM_MASK} configuration Sergio Paracuellos <sergio.paracuellos(a)gmail.com> clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs Sergio Paracuellos <sergio.paracuellos(a)gmail.com> clk: ralink: mtmips: fix clock plan for Ralink SoC RT3883 Charles Han <hanchunchao(a)inspur.com> clk: clk-apple-nco: Add NULL check in applnco_probe Patrisious Haddad <phaddad(a)nvidia.com> RDMA/mlx5: Move events notifier registration to be after device registration Zhen Lei <thunder.leizhen(a)huawei.com> fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() Zhang Zekun <zhangzekun11(a)huawei.com> powerpc/kexec: Fix return of uninitialized variable Kajol Jain <kjain(a)linux.ibm.com> KVM: PPC: Book3S HV: Fix kmv -> kvm typo Feng Fang <fangfeng4(a)huawei.com> RDMA/hns: Fix different dgids mapping to the same dip_idx Michal Suchanek <msuchanek(a)suse.de> powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static Gautam Menghani <gautam(a)linux.ibm.com> KVM: PPC: Book3S HV: Avoid returning to nested hypervisor on pending doorbells Gautam Menghani <gautam(a)linux.ibm.com> KVM: PPC: Book3S HV: Stop using vc->dpdes for nested KVM guests Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> dax: delete a stale directory pmem Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: fix uninitialized value in ocfs2_file_read_iter() Dan Carpenter <dan.carpenter(a)linaro.org> kunit: skb: use "gfp" variable instead of hardcoding GFP_KERNEL Sabyrzhan Tasbolatov <snovitoll(a)gmail.com> kasan: move checks to do_strncpy_from_user Jinjie Ruan <ruanjinjie(a)huawei.com> cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_power() Jinjie Ruan <ruanjinjie(a)huawei.com> cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_cost() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> cpufreq: loongson3: Check for error code from devm_mutex_init() call Junxian Huang <huangjunxian6(a)hisilicon.com> RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg() Junxian Huang <huangjunxian6(a)hisilicon.com> RDMA/hns: Fix out-of-order issue of requester when setting FENCE Sourabh Jain <sourabhjain(a)linux.ibm.com> fadump: reserve param area if below boot_mem_top Hari Bathini <hbathini(a)linux.ibm.com> powerpc/fadump: allocate memory for additional parameters early Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> x86/tdx: Dynamically disable SEPT violations from causing #VEs Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> x86/tdx: Rename tdx_parse_tdinfo() to tdx_setup() Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> x86/tdx: Introduce wrappers to read and write TD metadata Bart Van Assche <bvanassche(a)acm.org> scsi: sg: Enable runtime power management Zhen Lei <thunder.leizhen(a)huawei.com> scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() Zhen Lei <thunder.leizhen(a)huawei.com> scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() Zeng Heng <zengheng4(a)huawei.com> scsi: fusion: Remove unused variable 'rc' Ye Bin <yebin10(a)huawei.com> scsi: bfa: Fix use-after-free in bfad_im_module_exit() Baolin Liu <liubaolin(a)kylinos.cn> scsi: target: Fix incorrect function name in pscsi_create_type_disk() Mirsad Todorovac <mtodorovac69(a)gmail.com> fs/proc/kcore.c: fix coccinelle reported ERROR instances Raymond Hackley <raymondhackley(a)protonmail.com> leds: ktd2692: Set missing timing properties Javier Carrasco <javier.carrasco.cruz(a)gmail.com> leds: max5970: Fix unreleased fwnode_handle in probe function Zhang Changzhong <zhangchangzhong(a)huawei.com> mfd: rt5033: Fix missing regmap_del_irq_chip() Tamir Duberstein <tamird(a)gmail.com> checkpatch: always parse orig_commit in fixes tag Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommu/vt-d: Fix checks and print in pgtable_walk() Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommu/vt-d: Fix checks and print in dmar_fault_dump_ptes() Yang Yingliang <yangyingliang(a)huawei.com> clk: imx: imx8-acm: Fix return value check in clk_imx_acm_attach_pm_domains() Dong Aisheng <aisheng.dong(a)nxp.com> clk: imx: clk-scu: fix clk enable state save and restore Peng Fan <peng.fan(a)nxp.com> clk: imx: fracn-gppll: fix pll power up Peng Fan <peng.fan(a)nxp.com> clk: imx: fracn-gppll: correct PLL initialization flow Peng Fan <peng.fan(a)nxp.com> clk: imx: lpcg-scu: SW workaround for errata (e10858) Björn Töpel <bjorn(a)rivosinc.com> riscv: kvm: Fix out-of-bounds array access Yong-Xuan Wang <yongxuan.wang(a)sifive.com> RISC-V: KVM: Fix APLIC in_clrip and clripnum write emulation Liu Jian <liujian56(a)huawei.com> RDMA/rxe: Set queue pair cur_qp_state when being queried Biju Das <biju.das.jz(a)bp.renesas.com> clk: renesas: rzg2l: Fix FOUTPOSTDIV clk Andre Przywara <andre.przywara(a)arm.com> clk: sunxi-ng: d1: Fix PLL_AUDIO0 preset Kashyap Desai <kashyap.desai(a)broadcom.com> RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey Zhu Yanjun <yanjun.zhu(a)linux.dev> RDMA/rxe: Fix the qp flush warnings in req wenglianfa <wenglianfa(a)huawei.com> RDMA/hns: Fix cpu stuck caused by printings during reset Junxian Huang <huangjunxian6(a)hisilicon.com> RDMA/hns: Use dev_* printings in hem code instead of ibdev_* Yuyu Li <liyuyu6(a)huawei.com> RDMA/hns: Modify debugfs name wenglianfa <wenglianfa(a)huawei.com> RDMA/hns: Fix flush cqe error when racing with destroy qp wenglianfa <wenglianfa(a)huawei.com> RDMA/hns: Fix an AEQE overflow error caused by untimely update of eq_db_ci Vasant Hegde <vasant.hegde(a)amd.com> iommu/amd/pgtbl_v2: Take protection domain lock before invalidating TLB Jason Gunthorpe <jgg(a)ziepe.ca> iommu/amd: Narrow the use of struct protection_domain to invalidation Jason Gunthorpe <jgg(a)ziepe.ca> iommu/amd: Store the nid in io_pgtable_cfg instead of the domain Jason Gunthorpe <jgg(a)ziepe.ca> iommu/amd: Rename struct amd_io_pgtable iopt to pgtbl Jason Gunthorpe <jgg(a)ziepe.ca> iommu/amd: Remove the amd_iommu_domain_set_pt_root() and related Jason Gunthorpe <jgg(a)ziepe.ca> iommu/amd: Remove amd_iommu_domain_update() from page table freeing Jinjie Ruan <ruanjinjie(a)huawei.com> cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost() Jinjie Ruan <ruanjinjie(a)huawei.com> cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw() Michael Ellerman <mpe(a)ellerman.id.au> powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore Takahiro Kuwano <Takahiro.Kuwano(a)infineon.com> mtd: spi-nor: spansion: Use nor->addr_nbytes in octal DTR mode in RD_ANY_REG_OP Zichen Xie <zichenxie0106(a)gmail.com> clk: sophgo: avoid integer overflow in sg2042_pll_recalc_rate() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> powerpc/mm/fault: Fix kfence page fault reporting Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: rawnand: atmel: Fix possible memory leak Biju Das <biju.das.jz(a)bp.renesas.com> mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> powerpc/fadump: Refactor and prepare fadump_cma_init for late init Yuan Can <yuancan(a)huawei.com> cpufreq: loongson2: Unregister platform_driver on failure Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> mfd: intel_soc_pmic_bxtwc: Fix IRQ domain names duplication Matti Vaittinen <mazziesaccount(a)gmail.com> regmap: Allow setting IRQ domain name suffix Matti Vaittinen <mazziesaccount(a)gmail.com> irqdomain: Allow giving name suffix for domain Thomas Gleixner <tglx(a)linutronix.de> irqdomain: Cleanup domain name allocation Matti Vaittinen <mazziesaccount(a)gmail.com> irqdomain: Simplify simple and legacy domain creation Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device Marcus Folkesson <marcus.folkesson(a)gmail.com> mfd: da9052-spi: Change read-mask to write-mask Jinjie Ruan <ruanjinjie(a)huawei.com> mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/vdso: Flag VDSO64 entry points as functions Yihang Li <liyihang9(a)huawei.com> scsi: hisi_sas: Enable all PHYs that are not disabled by user during controller reset Matthew Rosato <mjrosato(a)linux.ibm.com> iommu/s390: Implement blocking domain Jonathan Marek <jonathan(a)marek.ca> clk: qcom: videocc-sm8550: depend on either gcc-sm8550 or gcc-sm8650 Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> pinctrl: renesas: Select PINCTRL_RZG2L for RZ/V2H(P) SoC Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> pinctrl: zynqmp: drop excess struct member description Levi Yun <yeoreum.yun(a)arm.com> trace/trace_event_perf: remove duplicate samples on the first tracepoint event Lukas Bulwahn <lukas.bulwahn(a)redhat.com> clk: mediatek: drop two dead config options Chengchang Tang <tangchengchang(a)huawei.com> RDMA/hns: Disassociate mmap pages for all uctx when HW is being reset Chengchang Tang <tangchengchang(a)huawei.com> RDMA/core: Provide rdma_user_mmap_disassociate() to disassociate mmap pages Jie Zhan <zhanjie9(a)hisilicon.com> cppc_cpufreq: Use desired perf if feedback ctrs are 0 or unchanged André Almeida <andrealmeid(a)igalia.com> unicode: Fix utf8_load() error path Jiayuan Chen <mrpre(a)163.com> bpf: fix recursive lock when verdict program return SK_PASS Hangbin Liu <liuhangbin(a)gmail.com> wireguard: selftests: load nf_conntrack if not present Breno Leitao <leitao(a)debian.org> netpoll: Use rcu_access_pointer() in netpoll_poll_lock Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix null pointer to pcs Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: remove GPIO interrupt controller Jakub Kicinski <kuba(a)kernel.org> eth: fbnic: don't disable the PCI device twice Alexander Aring <aahringo(a)redhat.com> dlm: fix dlm_recover_members refcount on error Gao Xiang <xiang(a)kernel.org> erofs: handle NONHEAD !delta[1] lclusters gracefully Felix Maurer <fmaurer(a)redhat.com> xsk: Free skb when TX metadata options are invalid Dmitry Antipov <dmantipov(a)yandex.ru> Bluetooth: fix use-after-free in device_for_each_child() Iulia Tanasescu <iulia.tanasescu(a)nxp.com> Bluetooth: ISO: Send BIG Create Sync via hci_sync Iulia Tanasescu <iulia.tanasescu(a)nxp.com> Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending Iulia Tanasescu <iulia.tanasescu(a)nxp.com> Bluetooth: ISO: Do not emit LE PA Create Sync if previous is pending Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: ISO: Use kref to track lifetime of iso_conn Javier Carrasco <javier.carrasco.cruz(a)gmail.com> Bluetooth: btbcm: fix missing of_node_put() in btbcm_get_board_name() Chris Lu <chris.lu(a)mediatek.com> Bluetooth: btmtk: adjust the position to init iso data anchor Kiran K <kiran.k(a)intel.com> Bluetooth: btintel: Do no pass vendor events to stack Kiran K <kiran.k(a)intel.com> Bluetooth: btintel_pcie: Add handshake between driver and firmware guanjing <guanjing(a)cmss.chinamobile.com> selftests: netfilter: Fix missing return values in conntrack_dump_flush Igor Pylypiv <ipylypiv(a)google.com> i2c: dev: Fix memory leak when underlying adapter does not support I2C Takashi Iwai <tiwai(a)suse.de> ALSA: 6fire: Release resources at card release Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Use snd_card_free_when_closed() at disconnection Takashi Iwai <tiwai(a)suse.de> ALSA: us122l: Use snd_card_free_when_closed() at disconnection Takashi Iwai <tiwai(a)suse.de> ALSA: usx2y: Use snd_card_free_when_closed() at disconnection Xu Kuohai <xukuohai(a)huawei.com> bpf: Add kernel symbol for struct_ops trampoline Xu Kuohai <xukuohai(a)huawei.com> bpf: Use function pointers count as struct_ops links count Kalle Valo <kvalo(a)kernel.org> Revert "wifi: iwlegacy: do not skip frames with bad FCS" Mingwei Zheng <zmw12306(a)gmail.com> net: rfkill: gpio: Add check for clk_enable() Omid Ehtemam-Haghighi <omid.ehtemamhaghighi(a)menlosecurity.com> ipv6: Fix soft lockups in fib6_select_path under high next hop churn Viktor Malik <vmalik(a)redhat.com> selftests/bpf: skip the timer_lockup test for single-CPU nodes Jiri Olsa <jolsa(a)kernel.org> bpf: Force uprobe bpf program to always return 0 Jiri Olsa <jolsa(a)kernel.org> bpf: Allow return values 0 and 1 for kprobe session Yuan Can <yuancan(a)huawei.com> drm/amdkfd: Fix wrong usage of INIT_WORK() Lijo Lazar <lijo.lazar(a)amd.com> drm/amdgpu: Fix map/unmap queue logic Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: fix ACA bank count boundary check error Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> wifi: iwlwifi: mvm: tell iwlmei when we finished suspending Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> wifi: iwlwifi: allow fast resume on ax200 Lingbo Kong <quic_lingbok(a)quicinc.com> wifi: cfg80211: Remove the Medium Synchronization Delay validity check Paolo Abeni <pabeni(a)redhat.com> selftests: net: really check for bg process completion Paolo Abeni <pabeni(a)redhat.com> ipv6: release nexthop on device removal Zijian Zhang <zijianzhang(a)bytedance.com> bpf, sockmap: Fix sk_msg_reset_curr Zijian Zhang <zijianzhang(a)bytedance.com> bpf, sockmap: Several fixes to bpf_msg_pop_data Zijian Zhang <zijianzhang(a)bytedance.com> bpf, sockmap: Several fixes to bpf_msg_push_data Zijian Zhang <zijianzhang(a)bytedance.com> selftests/bpf: Add push/pop checking for msg_verify_data in test_sockmap Zijian Zhang <zijianzhang(a)bytedance.com> selftests/bpf: Fix total_bytes in msg_loop_rx in test_sockmap Zijian Zhang <zijianzhang(a)bytedance.com> selftests/bpf: Fix SENDPAGE data logic in test_sockmap Zijian Zhang <zijianzhang(a)bytedance.com> selftests/bpf: Add txmsg_pass to pull/push/pop in test_sockmap Hao Ge <gehao(a)kylinos.cn> isofs: avoid memory leak in iocharset Adrián Larumbe <adrian.larumbe(a)collabora.com> drm/panthor: Fix OPP refcnt leaks in devfreq initialisation Adrián Larumbe <adrian.larumbe(a)collabora.com> drm/panthor: record current and maximum device clock frequencies Adrián Larumbe <adrian.larumbe(a)collabora.com> drm/panthor: introduce job cycle and timestamp accounting Adrián Larumbe <adrian.larumbe(a)collabora.com> drm/panfrost: Add missing OPP table refcnt decremental Pei Xiao <xiaopei01(a)kylinos.cn> wifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg() Maurice Lambert <mauricelambert434(a)gmail.com> netlink: typographical error in nlmsg_type constants definition Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: must hold rcu read lock while iterating object type list Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: must hold rcu read lock while iterating expression type list Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion Jonathan Gray <jsg(a)jsg.id.au> drm: use ATOMIC64_INIT() for atomic64_t Kumar Kartikeya Dwivedi <memxor(a)gmail.com> bpf: Mark raw_tp arguments with PTR_MAYBE_NULL Philo Lu <lulie(a)linux.alibaba.com> selftests/bpf: Add test for __nullable suffix in tp_btf Philo Lu <lulie(a)linux.alibaba.com> bpf: Support __nullable argument suffix for tp_btf Li Huafei <lihuafei1(a)huawei.com> drm/amdgpu: Fix the memory allocation issue in amdgpu_discovery_get_nps_info() José Expósito <jose.exposito89(a)gmail.com> drm/vkms: Drop unnecessary call to drm_crtc_cleanup() Kumar Kartikeya Dwivedi <memxor(a)gmail.com> bpf: Tighten tail call checks for lingering locks, RCU, preempt_disable Leon Hwang <leon.hwang(a)linux.dev> bpf, bpftool: Fix incorrect disasm pc Zichen Xie <zichenxie0106(a)gmail.com> drm/msm/dpu: cast crtc_clk calculation to u64 in _dpu_core_perf_calc_clk() Linus Walleij <linus.walleij(a)linaro.org> wifi: cw1200: Fix potential NULL dereference Yuan Can <yuancan(a)huawei.com> wifi: wfx: Fix error handling in wfx_core_init() Steffen Dirkwinkel <s.dirkwinkel(a)beckhoff.com> drm: xlnx: zynqmp_disp: layer may be null while releasing Sean Anderson <sean.anderson(a)linux.dev> drm: zynqmp_kms: Unplug DRM device before removal Li Huafei <lihuafei1(a)huawei.com> drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new() Fangzhi Zuo <Jerry.Zuo(a)amd.com> drm/amd/display: Reduce HPD Detection Interval for IPS Roman Li <Roman.Li(a)amd.com> drm/amd/display: Increase idle worker HPD detection time Lucas Stach <l.stach(a)pengutronix.de> drm/etnaviv: hold GPU lock across perfmon sampling Xiaolei Wang <xiaolei.wang(a)windriver.com> drm/etnaviv: Request pages from DMA32 zone on addressing_limited Suraj Kandpal <suraj.kandpal(a)intel.com> drm/xe/hdcp: Fix gsc structure check in fw check status Lukasz Luba <lukasz.luba(a)arm.com> drm/msm/gpu: Check the status of registration to PM QoS Jinjie Ruan <ruanjinjie(a)huawei.com> drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq() Xu Kuohai <xukuohai(a)huawei.com> bpf, arm64: Remove garbage frame for struct_ops trampoline Steven Price <steven.price(a)arm.com> drm/panfrost: Remove unused id_mask from struct panfrost_model Andrii Nakryiko <andrii(a)kernel.org> libbpf: move global data mmap()'ing into bpf_object__load() Andrii Nakryiko <andrii(a)kernel.org> selftests/bpf: fix test_spin_lock_fail.c's global vars usage Dipendra Khadka <kdipendra88(a)gmail.com> octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c Dipendra Khadka <kdipendra88(a)gmail.com> octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c Dipendra Khadka <kdipendra88(a)gmail.com> octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c Dipendra Khadka <kdipendra88(a)gmail.com> octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c Dipendra Khadka <kdipendra88(a)gmail.com> octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c Dipendra Khadka <kdipendra88(a)gmail.com> octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/msm/dpu: drop LM_3 / LM_4 on MSM8998 Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/msm/dpu: drop LM_3 / LM_4 on SDM845 Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/msm/dpu: on SDM845 move DSPP_3 to LM_5 block Ryan Walklin <ryan(a)testtoast.com> drm: panel: nv3052c: correct spi_device_id for RG35XX panel Matthias Schiffer <matthias.schiffer(a)tq-group.com> drm: fsl-dcu: enable PIXCLK on LS1021A Alper Nebi Yasak <alpernebiyasak(a)gmail.com> wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() Marek Vasut <marex(a)denx.de> wifi: wilc1000: Set MAC after operation mode Zijian Zhang <zijianzhang(a)bytedance.com> selftests/bpf: Fix txmsg_redir of test_txmsg_pull in test_sockmap Zijian Zhang <zijianzhang(a)bytedance.com> selftests/bpf: Fix msg_verify_data in test_sockmap Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> drm/bridge: tc358767: Fix link properties discovery Hangbin Liu <liuhangbin(a)gmail.com> netdevsim: copy addresses for both in and out paths Andrii Nakryiko <andrii(a)kernel.org> libbpf: never interpret subprogs in .text as entry programs Everest K.C <everestkc(a)everestkc.com.np> ASoC: rt722-sdca: Remove logically deadcode in rt722-sdca.c Karol Wachowski <karol.wachowski(a)intel.com> accel/ivpu: Prevent recovery invocation during probe and resume Andrii Nakryiko <andrii(a)kernel.org> libbpf: fix sym_is_subprog() logic for weak global subprogs Dave Stevenson <dave.stevenson(a)raspberrypi.com> drm/vc4: Correct generation check in vc4_hvs_lut_load Dave Stevenson <dave.stevenson(a)raspberrypi.com> drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_atomic_flush Dave Stevenson <dave.stevenson(a)raspberrypi.com> drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_lut_load Maxime Ripard <mripard(a)kernel.org> drm/vc4: Introduce generation number enum Dom Cobley <popcornmix(a)gmail.com> drm/vc4: hdmi: Increase audio MAI fifo dreq threshold Jacob Keller <jacob.e.keller(a)intel.com> ice: consistently use q_idx in ice_vc_cfg_qs_msg() Karthikeyan Periyasamy <quic_periyasa(a)quicinc.com> wifi: cfg80211: check radio iface combination for multi radio per wiphy Alexis Lothoré (eBPF Foundation) <alexis.lothore(a)bootlin.com> selftests/bpf: add missing header include for htons Balaji Pothunoori <quic_bpothuno(a)quicinc.com> wifi: ath11k: Fix CE offset address calculation for WCN6750 in SSR Eduard Zingerman <eddyz87(a)gmail.com> selftests/bpf: Fix backtrace printing for selftests crashes Kui-Feng Lee <thinker.li(a)gmail.com> selftests/bpf: netns_new() and netns_free() helpers. Yuan Chen <chenyuan(a)kylinos.cn> bpf: Fix the xdp_adjust_tail sample prog issue Arnd Bergmann <arnd(a)arndb.de> wifi: ath12k: fix one more memcpy size error Rameshkumar Sundaram <quic_ramess(a)quicinc.com> wifi: ath12k: fix use-after-free in ath12k_dp_cc_cleanup() Aurabindo Pillai <aurabindo.pillai(a)amd.com> drm/amd/display: fix a memleak issue when driver is removed Martin Kaistra <martin.kaistra(a)linutronix.de> wifi: rtl8xxxu: Perform update_beacon_work when beaconing is enabled Alexander Aring <aahringo(a)redhat.com> dlm: fix swapped args sb_flags vs sb_status Tony Ambardar <tony.ambardar(a)gmail.com> libbpf: Fix output .symtab byte-order during linking Tao Chen <chen.dylane(a)gmail.com> libbpf: Fix expected_attach_type set handling in program load callback Pin-yen Lin <treapking(a)chromium.org> drm/bridge: it6505: Drop EDID cache on bridge power off Pin-yen Lin <treapking(a)chromium.org> drm/bridge: anx7625: Drop EDID cache on bridge power off Geert Uytterhoeven <geert+renesas(a)glider.be> ASoC: fsl-asoc-card: Add missing handling of {hp,mic}-dt-gpios Macpaul Lin <macpaul.lin(a)mediatek.com> ASoC: dt-bindings: mt6359: Update generic node name and dmic-mode Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_micfil: fix regmap_write_bits usage Igor Prusov <ivprusov(a)salutedevices.com> dt-bindings: vendor-prefixes: Add NeoFidelity, Inc Ramya Gnanasekar <quic_rgnanase(a)quicinc.com> wifi: ath12k: Skip Rx TID cleanup for self peer Baochen Qiang <quic_bqiang(a)quicinc.com> wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss2 Baochen Qiang <quic_bqiang(a)quicinc.com> wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss1 Lijo Lazar <lijo.lazar(a)amd.com> drm/amdgpu: Fix JPEG v4.0.3 register write Maíra Canal <mcanal(a)igalia.com> drm/v3d: Flush the MMU before we supply more memory to the binner Maíra Canal <mcanal(a)igalia.com> drm/v3d: Address race-condition in MMU flush Linus Walleij <linus.walleij(a)linaro.org> drm/panel: nt35510: Make new commands optional Alexander Stein <alexander.stein(a)ew.tq-group.com> drm/imx: Add missing DRM_BRIDGE_CONNECTOR dependency Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/imx: parallel-display: switch to drm_panel_bridge Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/imx: ldb: switch to drm_panel_bridge Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/imx: ldb: drop custom DDC bus support Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/imx: ldb: drop custom EDID support Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/imx: parallel-display: drop edid override support Jani Nikula <jani.nikula(a)intel.com> drm/ipuv3/parallel: convert to struct drm_edid Jinjie Ruan <ruanjinjie(a)huawei.com> drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq() Jinjie Ruan <ruanjinjie(a)huawei.com> drm/imx/dcss: Use IRQF_NO_AUTOEN flag in request_irq() Huan Yang <link(a)vivo.com> udmabuf: fix vmap_udmabuf error page set Huan Yang <link(a)vivo.com> udmabuf: change folios array from kmalloc to kvmalloc Jinjie Ruan <ruanjinjie(a)huawei.com> wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq() Jinjie Ruan <ruanjinjie(a)huawei.com> wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq() Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> drm/v3d: Appease lockdep while updating GPU stats Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> drm/omap: Fix locking in omap_gem_new_dmabuf() Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> drm/omap: Fix possible NULL dereference Jeongjun Park <aha310510(a)gmail.com> wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() Dave Stevenson <dave.stevenson(a)raspberrypi.com> drm/vc4: hvs: Correct logic on stopping an HVS channel Dave Stevenson <dave.stevenson(a)raspberrypi.com> drm/vc4: hvs: Remove incorrect limit from hvs_dlist debugfs function Dave Stevenson <dave.stevenson(a)raspberrypi.com> drm/vc4: hvs: Fix dlist debug not resetting the next entry pointer Dom Cobley <popcornmix(a)gmail.com> drm/vc4: hdmi: Avoid hang with debug registers when suspended Dave Stevenson <dave.stevenson(a)raspberrypi.com> drm/vc4: hvs: Don't write gamma luts on 2711 Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused Matt Coster <Matt.Coster(a)imgtec.com> drm/imagination: Use pvr_vm_context_get() Chen Yufan <chenyufan(a)vivo.com> drm/imagination: Convert to use time_before macro Yao Zi <ziyao(a)disroot.org> platform/x86: panasonic-laptop: Return errno correctly in show callback Vitaly Kuznetsov <vkuznets(a)redhat.com> HID: hyperv: streamline driver probe to avoid devres issues Chris Morgan <macromorgan(a)hotmail.com> arm64: dts: rockchip: correct analog audio name on Indiedroid Nova Li Huafei <lihuafei1(a)huawei.com> media: atomisp: Add check for rgby_data memory allocation failure Uwe Kleine-König <u.kleine-koenig(a)baylibre.com> pwm: Assume a disabled PWM to emit a constant inactive output Sergey Senozhatsky <senozhatsky(a)chromium.org> media: venus: sync with threaded IRQ during inst destruction Sergey Senozhatsky <senozhatsky(a)chromium.org> media: venus: fix enc/dec destruction order Bingbu Cao <bingbu.cao(a)intel.com> media: ipu6: not override the dma_ops of device in driver Sakari Ailus <sakari.ailus(a)linux.intel.com> media: ipu6: Fix DMA and physical address debugging messages for 32-bit Luo Qiu <luoqiu(a)kylinsec.com.cn> firmware: arm_scpi: Check the DVFS OPP count returned by the firmware Reinette Chatre <reinette.chatre(a)intel.com> selftests/resctrl: Protect against array overrun during iMC config parsing Reinette Chatre <reinette.chatre(a)intel.com> selftests/resctrl: Fix memory overflow due to unhandled wraparound Reinette Chatre <reinette.chatre(a)intel.com> selftests/resctrl: Print accurate buffer size as part of MBM results Chen-Yu Tsai <wenst(a)chromium.org> arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add supplies for fixed regulators Chen-Yu Tsai <wenst(a)chromium.org> arm64: dts: mediatek: mt8183-kukui-jacuzzi: Fix DP bridge supply names Macpaul Lin <macpaul.lin(a)mediatek.com> arm64: dts: mediatek: mt6358: fix dtbs_check error AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> arm64: dts: mediatek: Add ADC node on MT6357, MT6358, MT6359 PMICs Frank Li <Frank.Li(a)nxp.com> arm64: dts: imx8mn-tqma8mqnl-mba8mx-usbot: fix coexistence of output-low and output-high in GPIO Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> arm64: dts: renesas: hihope: Drop #sound-dai-cells Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> regmap: irq: Set lockdep class for hierarchical IRQ domains Jinjie Ruan <ruanjinjie(a)huawei.com> spi: zynqmp-gqspi: Undo runtime PM changes at driver exit time Breno Leitao <leitao(a)debian.org> spi: tegra210-quad: Avoid shift-out-of-bounds Zhang Zekun <zhangzekun11(a)huawei.com> pmdomain: ti-sci: Add missing of_node_put() for args.np Usama Arif <usamaarif642(a)gmail.com> of/fdt: add dt_phys arg to early_init_dt_scan and early_init_dt_verify Abel Vesa <abel.vesa(a)linaro.org> dt-bindings: cache: qcom,llcc: Fix X1E80100 reg entries Konrad Dybcio <konradybcio(a)kernel.org> arm64: dts: qcom: x1e80100: Update C4/C5 residency/exit numbers Niklas Schnelle <schnelle(a)linux.ibm.com> watchdog: Add HAS_IOPORT dependency for SBC8360 and SBC7240 Anurag Dutta <a-dutta(a)ti.com> arm64: dts: ti: k3-j721s2: Fix clock IDs for MCSPI instances Anurag Dutta <a-dutta(a)ti.com> arm64: dts: ti: k3-j721e: Fix clock IDs for MCSPI instances Anurag Dutta <a-dutta(a)ti.com> arm64: dts: ti: k3-j7200: Fix clock ids for MCSPI instances Jared McArthur <j-mcarthur(a)ti.com> arm64: dts: ti: k3-j7200: Fix register map for main domain pmx Andre Przywara <andre.przywara(a)arm.com> ARM: dts: cubieboard4: Fix DCDC5 regulator constraints Clark Wang <xiaoning.wang(a)nxp.com> pwm: imx27: Workaround of the pwm output bug when decrease the duty cycle Daolong Zhu <jg_daolongzhu(a)mediatek.corp-partner.google.com> arm64: dts: mt8183: Damu: add i2c2's i2c-scl-internal-delay-ns Daolong Zhu <jg_daolongzhu(a)mediatek.corp-partner.google.com> arm64: dts: mt8183: cozmo: add i2c2's i2c-scl-internal-delay-ns Daolong Zhu <jg_daolongzhu(a)mediatek.corp-partner.google.com> arm64: dts: mt8183: burnet: add i2c2's i2c-scl-internal-delay-ns Daolong Zhu <jg_daolongzhu(a)mediatek.corp-partner.google.com> arm64: dts: mt8183: fennel: add i2c2's i2c-scl-internal-delay-ns Heiko Stuebner <heiko(a)sntech.de> arm64: dts: rockchip: Remove 'enable-active-low' from two boards Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> power: sequencing: make the QCom PMU pwrseq driver depend on CONFIG_OF Dragan Simic <dsimic(a)manjaro.org> regulator: rk808: Restrict DVS GPIOs to the RK808 variant only Chen Ridong <chenridong(a)huawei.com> cgroup/bpf: only cgroup v2 can be attached by bpf programs Chen Ridong <chenridong(a)huawei.com> Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline" Fei Shao <fshao(a)chromium.org> arm64: dts: mediatek: mt8195-cherry: Use correct audio codec DAI Fei Shao <fshao(a)chromium.org> arm64: dts: mediatek: mt8188: Fix USB3 PHY port default status Chen-Yu Tsai <wenst(a)chromium.org> arm64: dts: mediatek: mt8173-elm-hana: Add vdd-supply to second source trackpad Nathan Morrisson <nmorrisson(a)phytec.com> arm64: dts: ti: k3-am62x-phyboard-lyra: Drop unnecessary McASP AFIFOs Randy Dunlap <rdunlap(a)infradead.org> kernel-doc: allow object-like macros in ReST output Sibi Sankar <quic_sibis(a)quicinc.com> arm64: dts: qcom: x1e80100: Resize GIC Redistributor register region Hsin-Te Yuan <yuanhsinte(a)chromium.org> arm64: dts: mt8183: kukui: Fix the address of eeprom at i2c4 Hsin-Te Yuan <yuanhsinte(a)chromium.org> arm64: dts: mt8183: krane: Fix the address of eeprom at i2c4 Colin Ian King <colin.i.king(a)gmail.com> media: i2c: ds90ub960: Fix missing return check on ub960_rxport_read call Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> media: i2c: vgxy61: Fix an error handling path in vgxy61_detect() Gregory Price <gourry(a)gourry.net> tpm: fix signed/unsigned bug when checking event logs Jonathan Marek <jonathan(a)marek.ca> efi/libstub: fix efi_parse_options() ignoring the default command line Stafford Horne <shorne(a)gmail.com> openrisc: Implement fixmap to fix earlycon Abel Vesa <abel.vesa(a)linaro.org> arm64: dts: qcom: x1e80100-vivobook-s15: Drop orientation-switch from USB SS[0-1] QMP PHYs Abel Vesa <abel.vesa(a)linaro.org> arm64: dts: qcom: x1e80100-slim7x: Drop orientation-switch from USB SS[0-1] QMP PHYs Chen-Yu Tsai <wenst(a)chromium.org> scripts/kernel-doc: Do not track section counter across processed files Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> mmc: mmc_spi: drop buggy snprintf() Andrei Simion <andrei.simion(a)microchip.com> ARM: dts: microchip: sam9x60: Add missing property atmel,usart-mode Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> arm64: dts: qcom: sda660-ifc6560: fix l10a voltage ranges Luca Weiss <luca.weiss(a)fairphone.com> arm64: dts: qcom: sm6350: Fix GPU frequencies missing on some speedbins Dan Carpenter <dan.carpenter(a)linaro.org> soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() Jinjie Ruan <ruanjinjie(a)huawei.com> soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq() Macpaul Lin <macpaul.lin(a)mediatek.com> arm64: dts: mt8195: Fix dtbs_check error for infracfg_ao node Macpaul Lin <macpaul.lin(a)mediatek.com> arm64: dts: mt8195: Fix dtbs_check error for mutex node Macpaul Lin <macpaul.lin(a)mediatek.com> arm64: dts: mediatek: mt8395-genio-1200-evk: Fix dtbs_check error for phy Pablo Sun <pablo.sun(a)mediatek.com> arm64: dts: mediatek: mt8188: Fix wrong clock provider in MFG1 power domain Michal Simek <michal.simek(a)amd.com> microblaze: Export xmb_manager functions Gaosheng Cui <cuigaosheng1(a)huawei.com> drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend() Wolfram Sang <wsa+renesas(a)sang-engineering.com> ARM: dts: renesas: genmai: Fix partition size for QSPI NOR Flash Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> arm64: dts: qcom: qcs6390-rb3gen2: use modem.mbn for modem DSP Jinjie Ruan <ruanjinjie(a)huawei.com> spi: spi-fsl-lpspi: Use IRQF_NO_AUTOEN flag in request_irq() Min-Hua Chen <minhuadotchen(a)gmail.com> regulator: qcom-smd: make smd_vreg_rpm static Javier Carrasco <javier.carrasco.cruz(a)gmail.com> clocksource/drivers/timer-ti-dm: Fix child node refcount handling Mark Brown <broonie(a)kernel.org> clocksource/drivers:sp804: Make user selectable Marco Elver <elver(a)google.com> kcsan, seqlock: Fix incorrect assumption in read_seqbegin() Marco Elver <elver(a)google.com> kcsan, seqlock: Support seqcount_latch_t Uros Bizjak <ubizjak(a)gmail.com> locking/atomic/x86: Use ALT_OUTPUT_SP() for __arch_{,try_}cmpxchg64_emu() Uros Bizjak <ubizjak(a)gmail.com> locking/atomic/x86: Use ALT_OUTPUT_SP() for __alternative_atomic64() Miguel Ojeda <ojeda(a)kernel.org> time: Fix references to _msecs_to_jiffies() handling of values Miguel Ojeda <ojeda(a)kernel.org> time: Partially revert cleanup on msecs_to_jiffies() documentation Uros Bizjak <ubizjak(a)gmail.com> cleanup: Remove address space of returned pointer Carlos Llamas <cmllamas(a)google.com> Revert "scripts/faddr2line: Check only two symbols when calculating symbol size" Zheng Yejian <zhengyejian(a)huaweicloud.com> x86/unwind/orc: Fix unwind for newly forked tasks Daniel Lezcano <daniel.lezcano(a)linaro.org> thermal/lib: Fix memory leak on error in thermal_genl_auto() Daniel Lezcano <daniel.lezcano(a)linaro.org> tools/lib/thermal: Make more generic the command encoding function Uladzislau Rezki (Sony) <urezki(a)gmail.com> rcuscale: Do a proper cleanup if kfree_scale_init() fails Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> crypto: cavium - Fix an error handling path in cpt_ucode_load_fw() Michal Suchanek <msuchanek(a)suse.de> crypto: aes-gcm-p10 - Use the correct bit to test for P10 Chen Ridong <chenridong(a)huawei.com> crypto: bcm - add error check in the ahash_hmac_init function Chen Ridong <chenridong(a)huawei.com> crypto: caam - add error check to caam_rsa_set_priv_key_form Lifeng Zheng <zhenglifeng1(a)huawei.com> ACPI: CPPC: Fix _CPC register setting issue Pei Xiao <xiaopei01(a)kylinos.cn> hwmon: (nct6775-core) Fix overflows seen when writing limit attributes Jerome Brunet <jbrunet(a)baylibre.com> hwmon: (pmbus/core) clear faults after setting smbalert mask Uladzislau Rezki (Sony) <urezki(a)gmail.com> rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu Michal Schmidt <mschmidt(a)redhat.com> rcu/srcutiny: don't return before reenabling preemption Baruch Siach <baruch(a)tkos.co.il> doc: rcu: update printed dynticks counter bits Christian Loehle <christian.loehle(a)arm.com> sched/cpufreq: Ensure sd is rebuilt for EAS check Li Huafei <lihuafei1(a)huawei.com> crypto: inside-secure - Fix the return value of safexcel_xcbcmac_cra_init() Wang Hai <wanghai38(a)huawei.com> crypto: qat - Fix missing destroy_workqueue in adf_init_aer() Orange Kao <orange(a)aiven.io> EDAC/igen6: Avoid segmentation fault on module unload Weili Qian <qianweili(a)huawei.com> crypto: hisilicon/qm - disable same error report before resetting Gautham R. Shenoy <gautham.shenoy(a)amd.com> amd-pstate: Set min_perf to nominal_perf for active mode performance gov Mario Limonciello <mario.limonciello(a)amd.com> cpufreq/amd-pstate: Don't update CPPC request in amd_pstate_cpu_boost_update() Everest K.C <everestkc(a)everestkc.com.np> crypto: cavium - Fix the if condition to exit loop after timeout Yi Yang <yiyang13(a)huawei.com> crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY Qiuxu Zhuo <qiuxu.zhuo(a)intel.com> EDAC/{skx_common,i10nm}: Fix incorrect far-memory error source indicator Qiuxu Zhuo <qiuxu.zhuo(a)intel.com> EDAC/skx_common: Differentiate memory error sources Priyanka Singh <priyanka.singh(a)nxp.com> EDAC/fsl_ddr: Fix bad bit shift operations Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix race between zone registration and system suspend Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Mark thermal zones as initializing to start with Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Represent suspend-related thermal zone flags as bits Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Rearrange PM notification code Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Drop thermal_zone_device_is_enabled() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Initialize thermal zones before registering them Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - remove faulty arbiter config reset David Thompson <davthompson(a)nvidia.com> EDAC/bluefield: Fix potential integer overflow Yuan Can <yuancan(a)huawei.com> firmware: google: Unregister driver_info on failure Dan Carpenter <dan.carpenter(a)linaro.org> crypto: qat/qat_4xxx - fix off by one in uof_get_name() Dan Carpenter <dan.carpenter(a)linaro.org> crypto: qat/qat_420xx - fix off by one in uof_get_name() Danny Tsen <dtsen(a)linux.ibm.com> crypto: powerpc/p10-aes-gcm - Add dependency on CRYPTO_SIMDand re-enable CRYPTO_AES_GCM_P10 Danny Tsen <dtsen(a)linux.ibm.com> crypto: powerpc/p10-aes-gcm - Register modules as SIMD Cabiddu, Giovanni <giovanni.cabiddu(a)intel.com> crypto: qat - remove check after debugfs_create_dir() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> crypto: caam - Fix the pointer passed to caam_qi_shutdown() Tomas Paukrt <tomaspaukrt(a)email.cz> crypto: mxs-dcp - Fix AES-CBC with hardware-bound keys Christoph Hellwig <hch(a)lst.de> virtio_blk: reverse request order in virtio_queue_rqs Christoph Hellwig <hch(a)lst.de> nvme-pci: reverse request order in nvme_queue_rqs Long Li <leo.lilong(a)huawei.com> ext4: fix race in buffer_head read fault injection Matthew Wilcox (Oracle) <willy(a)infradead.org> ext4: remove array of buffer_heads from mext_page_mkuptodate() Matthew Wilcox (Oracle) <willy(a)infradead.org> ext4: pipeline buffer reads in mext_page_mkuptodate() Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> hfsplus: don't query the device logical block size multiple times Masahiro Yamada <masahiroy(a)kernel.org> s390/syscalls: Avoid creation of arch/arch/ directory Christoph Hellwig <hch(a)lst.de> block: fix bio_split_rw_at to take zone_write_granularity into account Christoph Hellwig <hch(a)lst.de> block: take chunk_sectors into account in bio_split_write_zeroes Christoph Hellwig <hch(a)lst.de> block: properly handle REQ_OP_ZONE_APPEND in __bio_split_to_limits Christoph Hellwig <hch(a)lst.de> block: constify the lim argument to queue_limits_max_zone_append_sectors Zizhi Wo <wozizhi(a)huawei.com> netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING Zizhi Wo <wozizhi(a)huawei.com> cachefiles: Fix NULL pointer dereference in object->file Zizhi Wo <wozizhi(a)huawei.com> cachefiles: Fix missing pos updates in cachefiles_ondemand_fd_write_iter() Zizhi Wo <wozizhi(a)huawei.com> cachefiles: Fix incorrect length return value in cachefiles_ondemand_fd_write_iter() Li Wang <liwang(a)redhat.com> loop: fix type of block size Aleksandr Mishin <amishin(a)t-argos.ru> acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block() Masahiro Yamada <masahiroy(a)kernel.org> arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG Daniel Palmer <daniel(a)0x0f.com> m68k: mvme147: Reinstate early console Daniel Palmer <daniel(a)0x0f.com> m68k: mvme147: Fix SCSI controller IRQ numbers Christoph Hellwig <hch(a)lst.de> nvme-pci: fix freeing of the HMB descriptor table Mark Brown <broonie(a)kernel.org> kselftest/arm64: Fix encoding for SVE B16B16 test Marc Zyngier <maz(a)kernel.org> arm64: Expose ID_AA64ISAR1_EL1.XS to sanitised feature consumers David Disseldorp <ddiss(a)suse.de> initramfs: avoid filename buffer overrun Jonas Gorski <jonas.gorski(a)gmail.com> mips: asm: fix warning when disabling MIPS_FP_SUPPORT Jan Kara <jack(a)suse.cz> ext4: avoid remount errors with 'abort' mount option Yang Erkun <yangerkun(a)huawei.com> brd: defer automatic disk creation until module initialization succeeds Ard Biesheuvel <ardb(a)kernel.org> x86/pvh: Call C code via the kernel virtual mapping Jason Andryuk <jason.andryuk(a)amd.com> x86/pvh: Set phys_base when calling xen_prepare_pvh() Heiko Carstens <hca(a)linux.ibm.com> s390/pageattr: Implement missing kernel_page_present() Vineeth Vijayan <vneethv(a)linux.ibm.com> s390/cio: Do not unregister the subchannel based on DNV John Garry <john.g.garry(a)oracle.com> fs/block: Check for IOCB_DIRECT in generic_atomic_write_valid() John Garry <john.g.garry(a)oracle.com> block/fs: Pass an iocb to generic_atomic_write_valid() Andre Przywara <andre.przywara(a)arm.com> kselftest/arm64: mte: fix printf type warnings about longs Andre Przywara <andre.przywara(a)arm.com> kselftest/arm64: mte: fix printf type warnings about __u64 Andre Przywara <andre.przywara(a)arm.com> kselftest/arm64: hwcap: fix f8dp2 cpuinfo name Kristina Martsenko <kristina.martsenko(a)arm.com> arm64: probes: Disable kprobes/uprobes on MOPS instructions Bill O'Donnell <bodonnel(a)redhat.com> efs: fix the efs new mount api implementation Gerd Bayer <gbayer(a)linux.ibm.com> s390/facilities: Fix warning about shadow of global variable Fangzhi Zuo <Jerry.Zuo(a)amd.com> drm/amd/display: Fix incorrect DSC recompute trigger Fangzhi Zuo <Jerry.Zuo(a)amd.com> drm/amd/display: Skip Invalid Streams from DSC Policy Xiuhong Wang <xiuhong.wang(a)unisoc.com> f2fs: fix fiemap failure issue when page size is 16KB Breno Leitao <leitao(a)debian.org> ipmr: Fix access to mfc_cache_list without lock held Linus Walleij <linus.walleij(a)linaro.org> ARM: 9434/1: cfi: Fix compilation corner case Harith G <harith.g(a)alifsemi.com> ARM: 9420/1: smp: Fix SMP for xip kernels Eryk Zagorski <erykzagorski(a)gmail.com> ALSA: usb-audio: Fix Yamaha P-125 Quirk Entry Mark Brown <broonie(a)kernel.org> ASoC: max9768: Fix event generation for playback mute Yuli Wang <wangyuli(a)uniontech.com> LoongArch: Define a default value for VM_DATA_DEFAULT_FLAGS Huacai Chen <chenhuacai(a)kernel.org> LoongArch: For all possible CPUs setup logical-physical CPU mapping John Watts <contact(a)jookia.org> ASoC: audio-graph-card2: Purge absent supplies for device tree nodes Gustavo A. R. Silva <gustavoars(a)kernel.org> integrity: Use static_assert() to check struct sizes David Wang <00107082(a)163.com> proc/softirqs: replace seq_printf with seq_put_decimal_ull_width Hans de Goede <hdegoede(a)redhat.com> drm: panel-orientation-quirks: Make Lenovo Yoga Tab 3 X90F DMI match less strict Luo Yifan <luoyifan(a)cmss.chinamobile.com> ASoC: stm: Prevent potential division by zero in stm32_sai_get_clk_div() Luo Yifan <luoyifan(a)cmss.chinamobile.com> ASoC: stm: Prevent potential division by zero in stm32_sai_mclk_round_rate() Markus Petri <mp(a)mpetri.org> ASoC: amd: yc: Support dmic on another model of Lenovo Thinkpad E14 Gen 6 Vishnu Sankar <vishnuocv(a)gmail.com> platform/x86: thinkpad_acpi: Fix for ThinkPad's with ECFW showing incorrect fan speed Alexander Hölzl <alexander.hoelzl(a)gmx.net> can: j1939: fix error in J1939 documentation. zhang jiao <zhangjiao2(a)cmss.chinamobile.com> tools/lib/thermal: Remove the thermal.h soft link when doing make clean Shenghao Ding <shenghao-ding(a)ti.com> ASoC: tas2781: Add new driver version for tas2563 & tas2781 qfn chip Renato Caldas <renato(a)calgera.com> platform/x86: ideapad-laptop: add missing Ideapad Pro 5 fn keys Kurt Borja <kuurtb(a)gmail.com> platform/x86: dell-wmi-base: Handle META key Lock/Unlock events Kurt Borja <kuurtb(a)gmail.com> platform/x86: dell-smbios-base: Extends support to Alienware products Mikhail Rudenko <mike.rudenko(a)gmail.com> regulator: rk808: Add apply_bit for BUCK3 on RK809 Cristian Marussi <cristian.marussi(a)arm.com> firmware: arm_scmi: Reject clear channel request on A2P Charles Han <hanchunchao(a)inspur.com> soc: qcom: Add check devm_kasprintf() returned value Benoît Monin <benoit.monin(a)gmx.fr> net: usb: qmi_wwan: add Quectel RG650V Jiayuan Chen <mrpre(a)163.com> bpf: fix filed access without lock Arnd Bergmann <arnd(a)arndb.de> x86/amd_nb: Fix compile-testing without CONFIG_AMD_NB Alexey Klimov <alexey.klimov(a)linaro.org> ASoC: codecs: wcd937x: relax the AUX PDM watchdog Alexey Klimov <alexey.klimov(a)linaro.org> ASoC: codecs: wcd937x: add missing LO Switch control Piyush Raj Chouhan <piyushchouhan1598(a)gmail.com> ALSA: hda/realtek: Add subwoofer quirk for Infinix ZERO BOOK 13 Li Zhijian <lizhijian(a)fujitsu.com> selftests/watchdog-test: Fix system accidentally reset after watchdog-test Javier Carrasco <javier.carrasco.cruz(a)gmail.com> usb: typec: use cleanup facility for 'altmodes_node' Benjamin Große <ste3ls(a)gmail.com> usb: add support for new USB device ID 0x17EF:0x3098 for the r8152 driver Ben Greear <greearb(a)candelatech.com> mac80211: fix user-power when emulating chanctx Anjaneyulu <pagadala.yesu.anjaneyulu(a)intel.com> wifi: iwlwifi: mvm: SAR table alignment Daniel Gabay <daniel.gabay(a)intel.com> wifi: iwlwifi: mvm: Use the sync timepoint API in suspend Hans de Goede <hdegoede(a)redhat.com> ASoC: Intel: sst: Support LPE0F28 ACPI HID Hans de Goede <hdegoede(a)redhat.com> ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet Hans de Goede <hdegoede(a)redhat.com> ASoC: Intel: bytcr_rt5640: Add support for non ACPI instantiated codec Hans de Goede <hdegoede(a)redhat.com> ASoC: codecs: rt5640: Always disable IRQs from rt5640_cancel_work() Alain Volmat <alain.volmat(a)foss.st.com> spi: stm32: fix missing device mode capability in stm32mp25 Gustavo A. R. Silva <gustavoars(a)kernel.org> wifi: radiotap: Avoid -Wflex-array-member-not-at-end warnings Remi Pommarel <repk(a)triplefau.lt> wifi: mac80211: Convert color collision detection to wiphy work Remi Pommarel <repk(a)triplefau.lt> wifi: cfg80211: Add wiphy_delayed_work_pending() Ben Greear <greearb(a)candelatech.com> wifi: mac80211: Fix setting txpower with emulate_chanctx ------------- Diffstat: Documentation/ABI/testing/sysfs-fs-f2fs | 7 +- Documentation/RCU/stallwarn.rst | 2 +- Documentation/arch/x86/boot.rst | 17 +- .../devicetree/bindings/cache/qcom,llcc.yaml | 38 ++- .../devicetree/bindings/clock/adi,axi-clkgen.yaml | 22 +- .../devicetree/bindings/iio/dac/adi,ad3552r.yaml | 2 +- .../pinctrl/samsung,pinctrl-wakeup-interrupt.yaml | 19 +- .../devicetree/bindings/serial/rs485.yaml | 19 +- .../devicetree/bindings/sound/mt6359.yaml | 10 +- .../devicetree/bindings/vendor-prefixes.yaml | 2 + Documentation/filesystems/mount_api.rst | 3 +- Documentation/locking/seqlock.rst | 2 +- Documentation/networking/j1939.rst | 2 +- Makefile | 4 +- arch/arc/kernel/devtree.c | 2 +- .../boot/dts/allwinner/sun9i-a80-cubieboard4.dts | 4 +- arch/arm/boot/dts/microchip/sam9x60.dtsi | 12 + arch/arm/boot/dts/renesas/r7s72100-genmai.dts | 2 +- arch/arm/boot/dts/ti/omap/omap36xx.dtsi | 1 + arch/arm/kernel/devtree.c | 2 +- arch/arm/kernel/head.S | 4 + arch/arm/kernel/psci_smp.c | 7 + arch/arm/mm/idmap.c | 7 + arch/arm/mm/proc-v7.S | 2 +- .../freescale/imx8mn-tqma8mqnl-mba8mx-usbotg.dtso | 29 +- arch/arm64/boot/dts/mediatek/mt6357.dtsi | 5 + arch/arm64/boot/dts/mediatek/mt6358.dtsi | 9 +- arch/arm64/boot/dts/mediatek/mt6359.dtsi | 5 + arch/arm64/boot/dts/mediatek/mt8173-elm-hana.dtsi | 8 + .../dts/mediatek/mt8183-kukui-jacuzzi-burnet.dts | 3 + .../dts/mediatek/mt8183-kukui-jacuzzi-cozmo.dts | 2 + .../dts/mediatek/mt8183-kukui-jacuzzi-damu.dts | 3 + .../dts/mediatek/mt8183-kukui-jacuzzi-fennel.dtsi | 3 + .../boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi | 30 +- .../boot/dts/mediatek/mt8183-kukui-kakadu.dtsi | 4 +- .../boot/dts/mediatek/mt8183-kukui-kodama.dtsi | 4 +- .../boot/dts/mediatek/mt8183-kukui-krane.dtsi | 4 +- .../boot/dts/mediatek/mt8186-corsola-voltorb.dtsi | 21 +- arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi | 8 +- arch/arm64/boot/dts/mediatek/mt8188.dtsi | 5 +- arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi | 6 +- arch/arm64/boot/dts/mediatek/mt8195.dtsi | 4 +- .../boot/dts/mediatek/mt8395-genio-1200-evk.dts | 2 +- arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts | 2 +- arch/arm64/boot/dts/qcom/sc8180x.dtsi | 2 +- .../arm64/boot/dts/qcom/sda660-inforce-ifc6560.dts | 2 +- arch/arm64/boot/dts/qcom/sm6350.dtsi | 14 +- .../boot/dts/qcom/x1e80100-asus-vivobook-s15.dts | 4 - .../boot/dts/qcom/x1e80100-lenovo-yoga-slim7x.dts | 4 - arch/arm64/boot/dts/qcom/x1e80100.dtsi | 8 +- arch/arm64/boot/dts/renesas/hihope-rev2.dtsi | 3 - arch/arm64/boot/dts/renesas/hihope-rev4.dtsi | 3 - .../rk3568-wolfvision-pf5-io-expander.dtso | 1 - .../boot/dts/rockchip/rk3588s-indiedroid-nova.dts | 2 +- .../arm64/boot/dts/rockchip/rk3588s-orangepi-5.dts | 1 - arch/arm64/boot/dts/ti/k3-am62x-phyboard-lyra.dtsi | 2 - .../boot/dts/ti/k3-j7200-common-proc-board.dts | 2 +- arch/arm64/boot/dts/ti/k3-j7200-main.dtsi | 38 ++- arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi | 6 +- arch/arm64/boot/dts/ti/k3-j721e-mcu-wakeup.dtsi | 6 +- arch/arm64/boot/dts/ti/k3-j721s2-main.dtsi | 16 +- arch/arm64/boot/dts/ti/k3-j721s2-mcu-wakeup.dtsi | 6 +- arch/arm64/include/asm/insn.h | 1 + arch/arm64/include/asm/kvm_host.h | 2 - arch/arm64/kernel/cpufeature.c | 1 + arch/arm64/kernel/probes/decode-insn.c | 7 +- arch/arm64/kernel/process.c | 2 +- arch/arm64/kernel/setup.c | 6 +- arch/arm64/kernel/vmlinux.lds.S | 6 +- arch/arm64/kvm/arch_timer.c | 3 +- arch/arm64/kvm/arm.c | 18 +- arch/arm64/kvm/mmio.c | 32 +- arch/arm64/kvm/pmu-emul.c | 1 - arch/arm64/kvm/vgic/vgic-its.c | 32 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 7 +- arch/arm64/kvm/vgic/vgic.h | 23 ++ arch/arm64/net/bpf_jit_comp.c | 47 ++- arch/csky/kernel/setup.c | 4 +- arch/loongarch/Makefile | 4 +- arch/loongarch/include/asm/page.h | 5 +- arch/loongarch/kernel/acpi.c | 81 +++-- arch/loongarch/kernel/setup.c | 2 +- arch/loongarch/kernel/smp.c | 3 +- arch/loongarch/net/bpf_jit.c | 2 +- arch/loongarch/vdso/Makefile | 2 +- arch/m68k/coldfire/device.c | 8 +- arch/m68k/include/asm/mcfgpio.h | 2 +- arch/m68k/include/asm/mvme147hw.h | 4 +- arch/m68k/kernel/early_printk.c | 5 +- arch/m68k/mvme147/config.c | 30 ++ arch/m68k/mvme147/mvme147.h | 6 + arch/microblaze/kernel/microblaze_ksyms.c | 10 + arch/microblaze/kernel/prom.c | 2 +- arch/mips/include/asm/switch_to.h | 2 +- arch/mips/kernel/prom.c | 2 +- arch/mips/kernel/relocate.c | 2 +- arch/nios2/kernel/prom.c | 4 +- arch/openrisc/Kconfig | 3 + arch/openrisc/include/asm/fixmap.h | 21 +- arch/openrisc/kernel/prom.c | 2 +- arch/openrisc/mm/init.c | 37 +++ arch/parisc/kernel/ftrace.c | 2 +- arch/powerpc/crypto/Kconfig | 2 +- arch/powerpc/crypto/aes-gcm-p10-glue.c | 141 +++++++-- arch/powerpc/include/asm/dtl.h | 4 +- arch/powerpc/include/asm/fadump.h | 9 + arch/powerpc/include/asm/kvm_book3s_64.h | 4 +- arch/powerpc/include/asm/sstep.h | 5 - arch/powerpc/include/asm/vdso.h | 1 + arch/powerpc/kernel/dt_cpu_ftrs.c | 2 +- arch/powerpc/kernel/fadump.c | 40 ++- arch/powerpc/kernel/prom.c | 5 +- arch/powerpc/kernel/setup-common.c | 6 +- arch/powerpc/kernel/setup_64.c | 1 + arch/powerpc/kexec/file_load_64.c | 9 +- arch/powerpc/kvm/book3s_hv.c | 14 +- arch/powerpc/kvm/book3s_hv_nested.c | 14 +- arch/powerpc/kvm/trace_hv.h | 2 +- arch/powerpc/lib/sstep.c | 12 +- arch/powerpc/mm/fault.c | 10 +- arch/powerpc/platforms/pseries/dtl.c | 8 +- arch/powerpc/platforms/pseries/lpar.c | 8 +- arch/powerpc/platforms/pseries/plpks.c | 2 +- arch/riscv/include/asm/cpufeature.h | 2 + arch/riscv/kernel/setup.c | 2 +- arch/riscv/kernel/traps_misaligned.c | 14 +- arch/riscv/kernel/unaligned_access_speed.c | 1 + arch/riscv/kvm/aia_aplic.c | 3 +- arch/riscv/kvm/vcpu_sbi.c | 11 +- arch/s390/include/asm/facility.h | 18 +- arch/s390/include/asm/pci.h | 4 +- arch/s390/include/asm/set_memory.h | 1 + arch/s390/kernel/syscalls/Makefile | 2 +- arch/s390/mm/pageattr.c | 15 + arch/s390/pci/pci.c | 37 +-- arch/s390/pci/pci_debug.c | 10 +- arch/sh/kernel/cpu/proc.c | 2 +- arch/sh/kernel/setup.c | 2 +- arch/um/drivers/net_kern.c | 2 +- arch/um/drivers/ubd_kern.c | 4 +- arch/um/drivers/vector_kern.c | 3 +- arch/um/kernel/dtb.c | 2 +- arch/um/kernel/physmem.c | 6 +- arch/um/kernel/process.c | 2 +- arch/um/kernel/sysrq.c | 2 +- arch/x86/coco/tdx/tdx.c | 111 +++++-- arch/x86/crypto/aegis128-aesni-asm.S | 29 +- arch/x86/events/intel/pt.c | 11 +- arch/x86/events/intel/pt.h | 2 + arch/x86/include/asm/amd_nb.h | 5 +- arch/x86/include/asm/atomic64_32.h | 3 +- arch/x86/include/asm/cmpxchg_32.h | 6 +- arch/x86/include/asm/kvm_host.h | 4 +- arch/x86/include/asm/shared/tdx.h | 11 +- arch/x86/kernel/cpu/amd.c | 1 + arch/x86/kernel/cpu/common.c | 4 +- arch/x86/kernel/devicetree.c | 2 +- arch/x86/kernel/unwind_orc.c | 2 +- arch/x86/kvm/Kconfig | 1 + arch/x86/kvm/mmu/mmu.c | 68 ++-- arch/x86/kvm/mmu/spte.c | 18 +- arch/x86/platform/pvh/head.S | 22 +- arch/xtensa/kernel/setup.c | 2 +- block/bfq-iosched.c | 37 ++- block/blk-core.c | 18 +- block/blk-merge.c | 65 +++- block/blk-mq.c | 148 ++++++++- block/blk-mq.h | 13 + block/blk-settings.c | 7 + block/blk-sysfs.c | 6 +- block/blk-zoned.c | 14 +- block/blk.h | 34 +- block/elevator.c | 10 +- block/fops.c | 25 +- block/genhd.c | 24 +- crypto/pcrypt.c | 12 +- drivers/accel/ivpu/ivpu_ipc.c | 35 +- drivers/accel/ivpu/ivpu_ipc.h | 7 +- drivers/accel/ivpu/ivpu_jsm_msg.c | 19 +- drivers/acpi/arm64/gtdt.c | 2 +- drivers/acpi/cppc_acpi.c | 1 - drivers/base/firmware_loader/main.c | 5 +- drivers/base/regmap/regmap-irq.c | 41 ++- drivers/base/trace.h | 6 +- drivers/block/brd.c | 70 ++-- drivers/block/loop.c | 6 +- drivers/block/ublk_drv.c | 17 +- drivers/block/virtio_blk.c | 46 ++- drivers/bluetooth/btbcm.c | 4 +- drivers/bluetooth/btintel.c | 62 +++- drivers/bluetooth/btintel.h | 7 + drivers/bluetooth/btintel_pcie.c | 265 +++++++++++++++- drivers/bluetooth/btintel_pcie.h | 16 +- drivers/bluetooth/btmtk.c | 1 - drivers/bluetooth/btusb.c | 1 + drivers/bus/mhi/host/trace.h | 25 +- drivers/clk/clk-apple-nco.c | 3 + drivers/clk/clk-axi-clkgen.c | 22 +- drivers/clk/clk-en7523.c | 270 ++++++++++++---- drivers/clk/clk-loongson2.c | 6 +- drivers/clk/imx/clk-fracn-gppll.c | 10 +- drivers/clk/imx/clk-imx8-acm.c | 4 +- drivers/clk/imx/clk-lpcg-scu.c | 37 ++- drivers/clk/imx/clk-scu.c | 2 +- drivers/clk/mediatek/Kconfig | 15 - drivers/clk/qcom/Kconfig | 4 +- drivers/clk/ralink/clk-mtmips.c | 26 +- drivers/clk/renesas/rzg2l-cpg.c | 11 +- drivers/clk/sophgo/clk-sg2042-pll.c | 2 +- drivers/clk/sunxi-ng/ccu-sun20i-d1.c | 2 +- drivers/clocksource/Kconfig | 3 +- drivers/clocksource/timer-ti-dm-systimer.c | 4 +- drivers/comedi/comedi_fops.c | 12 + drivers/counter/stm32-timer-cnt.c | 17 +- drivers/counter/ti-ecap-capture.c | 7 +- drivers/cpufreq/amd-pstate.c | 26 +- drivers/cpufreq/cppc_cpufreq.c | 63 +++- drivers/cpufreq/loongson2_cpufreq.c | 4 +- drivers/cpufreq/loongson3_cpufreq.c | 7 +- drivers/cpufreq/mediatek-cpufreq-hw.c | 2 +- drivers/crypto/bcm/cipher.c | 5 +- drivers/crypto/caam/caampkc.c | 11 +- drivers/crypto/caam/qi.c | 2 +- drivers/crypto/cavium/cpt/cptpf_main.c | 6 +- drivers/crypto/hisilicon/hpre/hpre_main.c | 35 +- drivers/crypto/hisilicon/qm.c | 47 +-- drivers/crypto/hisilicon/sec2/sec_main.c | 35 +- drivers/crypto/hisilicon/zip/zip_main.c | 35 +- drivers/crypto/inside-secure/safexcel_hash.c | 2 +- .../crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c | 2 +- .../crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c | 2 +- drivers/crypto/intel/qat/qat_common/adf_aer.c | 5 +- drivers/crypto/intel/qat/qat_common/adf_dbgfs.c | 13 +- .../crypto/intel/qat/qat_common/adf_hw_arbiter.c | 4 - drivers/crypto/mxs-dcp.c | 20 +- drivers/dax/pmem/Makefile | 7 - drivers/dax/pmem/pmem.c | 10 - drivers/dma-buf/Kconfig | 1 + drivers/dma-buf/udmabuf.c | 44 +-- drivers/edac/bluefield_edac.c | 2 +- drivers/edac/fsl_ddr_edac.c | 22 +- drivers/edac/i10nm_base.c | 1 + drivers/edac/igen6_edac.c | 2 + drivers/edac/skx_common.c | 57 ++-- drivers/edac/skx_common.h | 8 + drivers/firmware/arm_scmi/common.h | 2 + drivers/firmware/arm_scmi/driver.c | 6 + drivers/firmware/arm_scpi.c | 3 + drivers/firmware/efi/libstub/efi-stub.c | 2 +- drivers/firmware/efi/tpm.c | 17 +- drivers/firmware/google/gsmi.c | 6 +- drivers/gpio/gpio-exar.c | 10 +- drivers/gpio/gpio-zevio.c | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 63 ++-- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 7 + drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 18 +- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 5 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 32 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 3 + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 4 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 11 +- .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 15 +- .../gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 3 + .../drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 6 +- drivers/gpu/drm/bridge/analogix/anx7625.c | 2 + drivers/gpu/drm/bridge/ite-it6505.c | 2 + drivers/gpu/drm/bridge/tc358767.c | 7 + drivers/gpu/drm/drm_file.c | 2 +- drivers/gpu/drm/drm_mm.c | 2 +- drivers/gpu/drm/drm_panel_orientation_quirks.c | 1 - drivers/gpu/drm/etnaviv/etnaviv_drv.c | 10 + drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 28 +- drivers/gpu/drm/fsl-dcu/Kconfig | 1 + drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 15 + drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h | 3 + drivers/gpu/drm/imagination/pvr_ccb.c | 2 +- drivers/gpu/drm/imagination/pvr_vm.c | 4 +- drivers/gpu/drm/imx/dcss/dcss-crtc.c | 6 +- drivers/gpu/drm/imx/ipuv3/Kconfig | 11 +- drivers/gpu/drm/imx/ipuv3/imx-ldb.c | 122 ++----- drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c | 6 +- drivers/gpu/drm/imx/ipuv3/parallel-display.c | 47 +-- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 4 +- .../drm/msm/disp/dpu1/catalog/dpu_3_0_msm8998.h | 12 - .../gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h | 14 +- drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c | 2 +- drivers/gpu/drm/msm/msm_gpu_devfreq.c | 9 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 1 + drivers/gpu/drm/omapdrm/dss/base.c | 25 +- drivers/gpu/drm/omapdrm/dss/omapdss.h | 3 +- drivers/gpu/drm/omapdrm/omap_drv.c | 4 +- drivers/gpu/drm/omapdrm/omap_gem.c | 10 +- drivers/gpu/drm/panel/panel-newvision-nv3052c.c | 2 +- drivers/gpu/drm/panel/panel-novatek-nt35510.c | 15 +- drivers/gpu/drm/panfrost/panfrost_devfreq.c | 3 +- drivers/gpu/drm/panfrost/panfrost_gpu.c | 1 - drivers/gpu/drm/panthor/panthor_devfreq.c | 29 +- drivers/gpu/drm/panthor/panthor_device.h | 28 ++ drivers/gpu/drm/panthor/panthor_sched.c | 351 +++++++++++++++++---- drivers/gpu/drm/radeon/atombios_encoders.c | 2 +- drivers/gpu/drm/radeon/cik.c | 14 +- drivers/gpu/drm/radeon/dce6_afmt.c | 2 +- drivers/gpu/drm/radeon/evergreen.c | 12 +- drivers/gpu/drm/radeon/ni.c | 2 +- drivers/gpu/drm/radeon/r100.c | 24 +- drivers/gpu/drm/radeon/r300.c | 6 +- drivers/gpu/drm/radeon/r420.c | 6 +- drivers/gpu/drm/radeon/r520.c | 2 +- drivers/gpu/drm/radeon/r600.c | 12 +- drivers/gpu/drm/radeon/r600_cs.c | 2 +- drivers/gpu/drm/radeon/r600_dpm.c | 4 +- drivers/gpu/drm/radeon/r600_hdmi.c | 2 +- drivers/gpu/drm/radeon/radeon.h | 5 + drivers/gpu/drm/radeon/radeon_acpi.c | 10 +- drivers/gpu/drm/radeon/radeon_agp.c | 2 +- drivers/gpu/drm/radeon/radeon_atombios.c | 2 +- drivers/gpu/drm/radeon/radeon_audio.c | 14 +- drivers/gpu/drm/radeon/radeon_combios.c | 12 +- drivers/gpu/drm/radeon/radeon_device.c | 10 +- drivers/gpu/drm/radeon/radeon_display.c | 74 ++--- drivers/gpu/drm/radeon/radeon_fbdev.c | 26 +- drivers/gpu/drm/radeon/radeon_fence.c | 8 +- drivers/gpu/drm/radeon/radeon_gem.c | 2 +- drivers/gpu/drm/radeon/radeon_i2c.c | 2 +- drivers/gpu/drm/radeon/radeon_ib.c | 2 +- drivers/gpu/drm/radeon/radeon_irq_kms.c | 12 +- drivers/gpu/drm/radeon/radeon_object.c | 2 +- drivers/gpu/drm/radeon/radeon_pm.c | 20 +- drivers/gpu/drm/radeon/radeon_ring.c | 2 +- drivers/gpu/drm/radeon/radeon_ttm.c | 6 +- drivers/gpu/drm/radeon/rs400.c | 6 +- drivers/gpu/drm/radeon/rs600.c | 14 +- drivers/gpu/drm/radeon/rs690.c | 2 +- drivers/gpu/drm/radeon/rv515.c | 4 +- drivers/gpu/drm/radeon/rv770.c | 2 +- drivers/gpu/drm/radeon/si.c | 4 +- drivers/gpu/drm/v3d/v3d_drv.h | 1 + drivers/gpu/drm/v3d/v3d_irq.c | 2 + drivers/gpu/drm/v3d/v3d_mmu.c | 31 +- drivers/gpu/drm/v3d/v3d_sched.c | 44 ++- drivers/gpu/drm/vc4/tests/vc4_mock.c | 12 +- drivers/gpu/drm/vc4/vc4_bo.c | 28 +- drivers/gpu/drm/vc4/vc4_crtc.c | 13 +- drivers/gpu/drm/vc4/vc4_drv.c | 22 +- drivers/gpu/drm/vc4/vc4_drv.h | 8 +- drivers/gpu/drm/vc4/vc4_gem.c | 24 +- drivers/gpu/drm/vc4/vc4_hdmi.c | 22 +- drivers/gpu/drm/vc4/vc4_hvs.c | 64 ++-- drivers/gpu/drm/vc4/vc4_irq.c | 10 +- drivers/gpu/drm/vc4/vc4_kms.c | 14 +- drivers/gpu/drm/vc4/vc4_perfmon.c | 20 +- drivers/gpu/drm/vc4/vc4_plane.c | 12 +- drivers/gpu/drm/vc4/vc4_render_cl.c | 2 +- drivers/gpu/drm/vc4/vc4_v3d.c | 10 +- drivers/gpu/drm/vc4/vc4_validate.c | 8 +- drivers/gpu/drm/vc4/vc4_validate_shaders.c | 2 +- drivers/gpu/drm/vkms/vkms_output.c | 5 +- drivers/gpu/drm/xe/display/xe_hdcp_gsc.c | 2 +- drivers/gpu/drm/xe/xe_sync.c | 6 +- drivers/gpu/drm/xlnx/zynqmp_disp.c | 3 + drivers/gpu/drm/xlnx/zynqmp_kms.c | 2 +- drivers/hid/hid-hyperv.c | 58 +++- drivers/hid/wacom_wac.c | 4 +- drivers/hwmon/aquacomputer_d5next.c | 2 +- drivers/hwmon/nct6775-core.c | 7 +- drivers/hwmon/pmbus/pmbus_core.c | 12 +- drivers/hwmon/tps23861.c | 2 +- drivers/i2c/i2c-dev.c | 17 +- drivers/i3c/master.c | 13 +- drivers/iio/dac/adi-axi-dac.c | 2 +- drivers/iio/industrialio-gts-helper.c | 2 +- drivers/iio/light/al3010.c | 11 +- drivers/infiniband/core/uverbs.h | 2 + drivers/infiniband/core/uverbs_main.c | 43 ++- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 7 +- drivers/infiniband/hw/bnxt_re/qplib_fp.h | 2 +- drivers/infiniband/hw/hns/hns_roce_cq.c | 4 +- drivers/infiniband/hw/hns/hns_roce_debugfs.c | 3 +- drivers/infiniband/hw/hns/hns_roce_device.h | 14 +- drivers/infiniband/hw/hns/hns_roce_hem.c | 48 +-- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 257 +++++++++------ drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 8 +- drivers/infiniband/hw/hns/hns_roce_main.c | 7 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 11 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 79 +++-- drivers/infiniband/hw/hns/hns_roce_srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 40 ++- drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 +- drivers/infiniband/sw/rxe/rxe_qp.c | 1 + drivers/infiniband/sw/rxe/rxe_req.c | 6 +- drivers/input/misc/cs40l50-vibra.c | 6 +- drivers/interconnect/qcom/icc-rpmh.c | 3 + drivers/iommu/amd/amd_iommu.h | 15 +- drivers/iommu/amd/amd_iommu_types.h | 5 +- drivers/iommu/amd/io_pgtable.c | 76 ++--- drivers/iommu/amd/io_pgtable_v2.c | 29 +- drivers/iommu/amd/iommu.c | 28 +- drivers/iommu/amd/pasid.c | 2 +- drivers/iommu/intel/iommu.c | 40 ++- drivers/iommu/s390-iommu.c | 75 +++-- drivers/irqchip/irq-mvebu-sei.c | 2 +- drivers/leds/flash/leds-ktd2692.c | 1 + drivers/leds/leds-max5970.c | 5 +- drivers/mailbox/arm_mhuv2.c | 8 +- drivers/mailbox/mtk-cmdq-mailbox.c | 2 +- drivers/mailbox/omap-mailbox.c | 1 + drivers/md/dm-bufio.c | 12 +- drivers/md/dm-cache-background-tracker.c | 25 +- drivers/md/dm-cache-background-tracker.h | 8 + drivers/md/dm-cache-target.c | 25 +- drivers/media/i2c/adv7604.c | 5 +- drivers/media/i2c/adv7842.c | 13 +- drivers/media/i2c/ds90ub960.c | 2 +- drivers/media/i2c/vgxy61.c | 2 +- drivers/media/pci/intel/ipu6/ipu6-bus.c | 6 - drivers/media/pci/intel/ipu6/ipu6-buttress.c | 34 +- drivers/media/pci/intel/ipu6/ipu6-cpd.c | 18 +- drivers/media/pci/intel/ipu6/ipu6-dma.c | 202 ++++++------ drivers/media/pci/intel/ipu6/ipu6-dma.h | 34 +- drivers/media/pci/intel/ipu6/ipu6-fw-com.c | 14 +- drivers/media/pci/intel/ipu6/ipu6-mmu.c | 28 +- drivers/media/pci/intel/ipu6/ipu6.c | 3 + drivers/media/platform/qcom/venus/vdec.c | 19 +- drivers/media/platform/qcom/venus/venc.c | 18 +- drivers/media/radio/wl128x/fmdrv_common.c | 3 +- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 15 +- drivers/media/v4l2-core/v4l2-dv-timings.c | 132 ++++---- drivers/message/fusion/mptsas.c | 4 +- drivers/mfd/da9052-spi.c | 2 +- drivers/mfd/intel_soc_pmic_bxtwc.c | 144 +++++---- drivers/mfd/rt5033.c | 4 +- drivers/mfd/tps65010.c | 8 +- drivers/misc/apds990x.c | 12 +- drivers/misc/lkdtm/bugs.c | 2 +- drivers/mmc/host/mmc_spi.c | 9 +- drivers/mtd/hyperbus/rpc-if.c | 7 + drivers/mtd/nand/raw/atmel/pmecc.c | 8 +- drivers/mtd/nand/raw/atmel/pmecc.h | 2 - drivers/mtd/spi-nor/core.c | 2 +- drivers/mtd/spi-nor/spansion.c | 1 + drivers/mtd/ubi/attach.c | 12 +- drivers/mtd/ubi/fastmap-wl.c | 19 +- drivers/mtd/ubi/vmt.c | 2 + drivers/mtd/ubi/wl.c | 11 +- drivers/mtd/ubi/wl.h | 3 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 30 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 9 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.h | 3 +- drivers/net/ethernet/broadcom/tg3.c | 3 + drivers/net/ethernet/google/gve/gve_adminq.c | 4 +- drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 2 +- drivers/net/ethernet/intel/ice/ice_virtchnl.c | 21 +- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 70 +++- drivers/net/ethernet/marvell/octeontx2/af/cgx.h | 5 + .../ethernet/marvell/octeontx2/af/lmac_common.h | 7 +- drivers/net/ethernet/marvell/octeontx2/af/rpm.c | 87 +++-- drivers/net/ethernet/marvell/octeontx2/af/rpm.h | 18 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 1 + drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 45 ++- drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c | 5 + .../ethernet/marvell/octeontx2/nic/otx2_common.c | 4 + .../ethernet/marvell/octeontx2/nic/otx2_dcbnl.c | 5 + .../ethernet/marvell/octeontx2/nic/otx2_dmac_flt.c | 9 + .../ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 10 + .../ethernet/marvell/octeontx2/nic/otx2_flows.c | 10 + drivers/net/ethernet/marvell/pxa168_eth.c | 14 +- drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 2 - .../net/ethernet/microchip/vcap/vcap_api_kunit.c | 17 +- .../net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 2 + drivers/net/ethernet/wangxun/txgbe/txgbe_irq.c | 24 +- drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 1 - drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 168 +--------- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.h | 2 - drivers/net/ethernet/wangxun/txgbe/txgbe_type.h | 7 +- drivers/net/mdio/mdio-ipq4019.c | 5 +- drivers/net/netdevsim/ipsec.c | 11 +- drivers/net/usb/lan78xx.c | 42 +-- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/usb/r8152.c | 1 + drivers/net/wireless/ath/ath10k/mac.c | 4 +- drivers/net/wireless/ath/ath11k/qmi.c | 3 + drivers/net/wireless/ath/ath12k/dp.c | 19 +- drivers/net/wireless/ath/ath12k/mac.c | 5 +- drivers/net/wireless/ath/ath12k/wow.c | 2 +- drivers/net/wireless/ath/ath9k/htc_hst.c | 3 + drivers/net/wireless/ath/wil6210/txrx.c | 2 +- .../net/wireless/broadcom/brcm80211/brcmfmac/of.c | 3 +- drivers/net/wireless/intel/ipw2x00/ipw2100.c | 2 +- drivers/net/wireless/intel/ipw2x00/ipw2200.h | 2 +- drivers/net/wireless/intel/iwlegacy/3945.c | 2 +- drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 +- drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 96 +++--- drivers/net/wireless/intel/iwlwifi/fw/init.c | 4 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 2 + drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 8 +- drivers/net/wireless/intersil/p54/p54spi.c | 4 +- drivers/net/wireless/marvell/libertas/radiotap.h | 4 +- drivers/net/wireless/marvell/mwifiex/fw.h | 2 +- drivers/net/wireless/marvell/mwifiex/main.c | 4 +- drivers/net/wireless/microchip/wilc1000/mon.c | 4 +- drivers/net/wireless/microchip/wilc1000/netdev.c | 6 +- drivers/net/wireless/realtek/rtl8xxxu/core.c | 6 +- drivers/net/wireless/realtek/rtlwifi/efuse.c | 11 +- drivers/net/wireless/realtek/rtw89/coex.c | 4 + drivers/net/wireless/silabs/wfx/main.c | 17 +- drivers/net/wireless/st/cw1200/cw1200_spi.c | 2 +- drivers/net/wireless/virtual/mac80211_hwsim.c | 4 +- drivers/nvme/host/core.c | 5 + drivers/nvme/host/multipath.c | 33 +- drivers/nvme/host/pci.c | 55 ++-- drivers/of/fdt.c | 14 +- drivers/of/kexec.c | 2 +- drivers/pci/controller/cadence/pci-j721e.c | 100 +++++- drivers/pci/controller/cadence/pcie-cadence-host.c | 44 ++- drivers/pci/controller/cadence/pcie-cadence.h | 12 + drivers/pci/controller/dwc/pcie-qcom-ep.c | 6 +- drivers/pci/controller/dwc/pcie-tegra194.c | 7 +- drivers/pci/endpoint/functions/pci-epf-mhi.c | 6 + drivers/pci/hotplug/cpqphp_pci.c | 19 +- drivers/pci/pci.c | 5 +- drivers/pci/slot.c | 4 +- drivers/perf/arm-cmn.c | 4 +- drivers/perf/arm_smmuv3_pmu.c | 19 +- drivers/phy/phy-airoha-pcie-regs.h | 6 +- drivers/phy/phy-airoha-pcie.c | 8 +- drivers/phy/realtek/phy-rtk-usb2.c | 2 + drivers/phy/realtek/phy-rtk-usb3.c | 2 + drivers/pinctrl/pinctrl-k210.c | 2 +- drivers/pinctrl/pinctrl-zynqmp.c | 1 - drivers/pinctrl/qcom/pinctrl-spmi-gpio.c | 2 +- drivers/pinctrl/renesas/Kconfig | 1 + drivers/platform/chrome/cros_ec_typec.c | 1 + drivers/platform/x86/dell/dell-smbios-base.c | 1 + drivers/platform/x86/dell/dell-wmi-base.c | 6 + drivers/platform/x86/ideapad-laptop.c | 3 + drivers/platform/x86/intel/bxtwc_tmu.c | 22 +- drivers/platform/x86/panasonic-laptop.c | 10 +- drivers/platform/x86/thinkpad_acpi.c | 28 +- drivers/pmdomain/ti/ti_sci_pm_domains.c | 4 + drivers/power/sequencing/Kconfig | 1 + drivers/power/supply/bq27xxx_battery.c | 37 ++- drivers/power/supply/power_supply_core.c | 2 - drivers/power/supply/rt9471.c | 52 +-- drivers/pwm/core.c | 10 +- drivers/pwm/pwm-imx27.c | 98 +++++- drivers/regulator/qcom_smd-regulator.c | 2 +- drivers/regulator/rk808-regulator.c | 17 +- drivers/remoteproc/qcom_q6v5_adsp.c | 11 +- drivers/remoteproc/qcom_q6v5_mss.c | 6 +- drivers/remoteproc/qcom_q6v5_pas.c | 22 +- drivers/rpmsg/qcom_glink_native.c | 3 +- drivers/rtc/interface.c | 7 +- drivers/rtc/rtc-ab-eoz9.c | 7 - drivers/rtc/rtc-abx80x.c | 2 +- drivers/rtc/rtc-rzn1.c | 8 +- drivers/rtc/rtc-st-lpc.c | 5 +- drivers/s390/cio/cio.c | 6 +- drivers/s390/cio/device.c | 18 +- drivers/scsi/bfa/bfad.c | 3 +- drivers/scsi/hisi_sas/hisi_sas_main.c | 8 +- drivers/scsi/qedf/qedf_main.c | 1 + drivers/scsi/qedi/qedi_main.c | 1 + drivers/scsi/sg.c | 9 +- drivers/sh/intc/core.c | 2 +- drivers/soc/fsl/rcpm.c | 1 + drivers/soc/qcom/qcom-geni-se.c | 3 +- drivers/soc/qcom/socinfo.c | 8 +- drivers/soc/ti/smartreflex.c | 4 +- drivers/soc/xilinx/xlnx_event_manager.c | 4 +- drivers/spi/atmel-quadspi.c | 2 +- drivers/spi/spi-fsl-lpspi.c | 12 +- drivers/spi/spi-stm32.c | 1 + drivers/spi/spi-tegra210-quad.c | 2 +- drivers/spi/spi-zynqmp-gqspi.c | 2 + drivers/spi/spi.c | 13 +- drivers/staging/media/atomisp/pci/sh_css_params.c | 2 + .../vc04_services/interface/vchiq_arm/vchiq_arm.c | 6 +- drivers/target/target_core_pscsi.c | 2 +- drivers/thermal/thermal_core.c | 133 ++++---- drivers/thermal/thermal_core.h | 15 +- drivers/thermal/thermal_sysfs.c | 2 +- drivers/tty/serial/8250/8250_fintek.c | 14 +- drivers/tty/serial/8250/8250_omap.c | 4 +- drivers/tty/serial/amba-pl011.c | 7 + drivers/tty/tty_io.c | 2 +- drivers/usb/dwc3/ep0.c | 2 +- drivers/usb/dwc3/gadget.c | 15 +- drivers/usb/gadget/composite.c | 18 +- drivers/usb/gadget/function/uvc_video.c | 4 + drivers/usb/host/ehci-spear.c | 7 +- drivers/usb/host/xhci-pci.c | 10 +- drivers/usb/host/xhci-ring.c | 73 ++++- drivers/usb/host/xhci.c | 40 ++- drivers/usb/host/xhci.h | 3 + drivers/usb/misc/chaoskey.c | 35 +- drivers/usb/misc/iowarrior.c | 50 ++- drivers/usb/misc/usb-ljca.c | 20 +- drivers/usb/misc/yurex.c | 5 +- drivers/usb/musb/musb_gadget.c | 13 +- drivers/usb/typec/class.c | 6 +- drivers/usb/typec/tcpm/wcove.c | 4 - drivers/usb/typec/ucsi/ucsi_ccg.c | 5 + drivers/usb/typec/ucsi/ucsi_glink.c | 2 +- drivers/vdpa/mlx5/core/mr.c | 4 +- drivers/vfio/pci/mlx5/cmd.c | 6 +- drivers/vfio/pci/mlx5/main.c | 35 +- drivers/vfio/pci/vfio_pci_config.c | 16 +- drivers/video/fbdev/sh7760fb.c | 3 +- drivers/watchdog/Kconfig | 4 +- drivers/xen/xenbus/xenbus_probe.c | 8 +- fs/binfmt_elf.c | 2 + fs/binfmt_elf_fdpic.c | 5 +- fs/binfmt_misc.c | 7 +- fs/cachefiles/interface.c | 14 +- fs/cachefiles/ondemand.c | 38 ++- fs/dlm/ast.c | 2 +- fs/dlm/recoverd.c | 2 +- fs/efs/super.c | 43 +-- fs/erofs/zmap.c | 17 +- fs/exec.c | 45 ++- fs/exfat/file.c | 10 + fs/exfat/namei.c | 21 +- fs/ext4/balloc.c | 4 +- fs/ext4/ext4.h | 12 +- fs/ext4/extents.c | 2 +- fs/ext4/fsmap.c | 54 +++- fs/ext4/ialloc.c | 5 +- fs/ext4/indirect.c | 2 +- fs/ext4/inode.c | 4 +- fs/ext4/mballoc.c | 18 +- fs/ext4/mballoc.h | 1 + fs/ext4/mmp.c | 2 +- fs/ext4/move_extent.c | 43 ++- fs/ext4/resize.c | 2 +- fs/ext4/super.c | 42 ++- fs/f2fs/checkpoint.c | 4 +- fs/f2fs/data.c | 29 +- fs/f2fs/debug.c | 2 +- fs/f2fs/f2fs.h | 3 +- fs/f2fs/file.c | 23 +- fs/f2fs/gc.c | 2 + fs/f2fs/node.c | 14 +- fs/f2fs/segment.c | 5 +- fs/f2fs/segment.h | 35 +- fs/f2fs/super.c | 37 ++- fs/fuse/file.c | 62 ++-- fs/fuse/fuse_i.h | 6 + fs/fuse/virtio_fs.c | 1 + fs/gfs2/glock.c | 19 +- fs/gfs2/glock.h | 1 + fs/gfs2/incore.h | 2 +- fs/gfs2/rgrp.c | 2 +- fs/gfs2/super.c | 2 +- fs/hfsplus/hfsplus_fs.h | 3 +- fs/hfsplus/wrapper.c | 2 + fs/isofs/inode.c | 8 +- fs/jffs2/erase.c | 7 +- fs/jfs/xattr.c | 2 +- fs/netfs/fscache_volume.c | 3 +- fs/nfs/blocklayout/blocklayout.c | 15 +- fs/nfs/blocklayout/dev.c | 6 +- fs/nfs/internal.h | 2 +- fs/nfs/nfs4proc.c | 8 +- fs/nfs/write.c | 49 +-- fs/nfsd/export.c | 31 +- fs/nfsd/export.h | 4 +- fs/nfsd/nfs4callback.c | 16 +- fs/nfsd/nfs4proc.c | 7 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4state.c | 5 +- fs/nfsd/nfs4xdr.c | 2 +- fs/nfsd/nfsfh.c | 20 +- fs/nfsd/nfsfh.h | 3 +- fs/notify/fsnotify.c | 23 +- fs/notify/mark.c | 12 +- fs/ocfs2/aops.h | 2 + fs/ocfs2/file.c | 4 + fs/proc/kcore.c | 10 +- fs/proc/softirqs.c | 2 +- fs/read_write.c | 15 +- fs/smb/client/cached_dir.c | 229 +++++++++----- fs/smb/client/cached_dir.h | 6 +- fs/smb/client/cifsfs.c | 12 +- fs/smb/client/cifsglob.h | 4 +- fs/smb/client/cifsproto.h | 1 + fs/smb/client/connect.c | 59 +++- fs/smb/client/fs_context.c | 85 ++++- fs/smb/client/fs_context.h | 1 + fs/smb/client/inode.c | 4 +- fs/smb/client/reparse.c | 95 +++++- fs/smb/client/reparse.h | 6 +- fs/smb/client/smb1ops.c | 4 +- fs/smb/client/smb2file.c | 21 +- fs/smb/client/smb2inode.c | 6 +- fs/smb/client/smb2ops.c | 2 +- fs/smb/client/smb2pdu.c | 4 +- fs/smb/client/smb2proto.h | 9 +- fs/smb/client/trace.h | 3 + fs/smb/server/server.c | 4 + fs/ubifs/super.c | 6 +- fs/ubifs/tnc_commit.c | 2 + fs/unicode/utf8-core.c | 2 +- include/asm-generic/vmlinux.lds.h | 4 +- include/kunit/skbuff.h | 2 +- include/linux/blk-mq.h | 2 + include/linux/blkdev.h | 15 +- include/linux/bpf.h | 9 +- include/linux/cleanup.h | 4 +- include/linux/compiler_attributes.h | 13 - include/linux/compiler_types.h | 19 ++ include/linux/f2fs_fs.h | 6 +- include/linux/fs.h | 2 +- include/linux/hisi_acc_qm.h | 8 +- include/linux/io-pgtable.h | 4 + include/linux/irqdomain.h | 8 + include/linux/jiffies.h | 2 +- include/linux/kfifo.h | 1 - include/linux/kvm_host.h | 6 - include/linux/lockdep.h | 2 +- include/linux/mmdebug.h | 6 +- include/linux/netpoll.h | 2 +- include/linux/of_fdt.h | 5 +- include/linux/once.h | 4 +- include/linux/once_lite.h | 2 +- include/linux/rcupdate.h | 2 +- include/linux/regmap.h | 4 + include/linux/seqlock.h | 98 ++++-- include/media/v4l2-dv-timings.h | 18 +- include/net/bluetooth/hci.h | 4 +- include/net/bluetooth/hci_core.h | 63 ++++ include/net/cfg80211.h | 44 +++ include/net/ieee80211_radiotap.h | 37 ++- include/net/net_debug.h | 2 +- include/rdma/ib_verbs.h | 8 + include/uapi/linux/rtnetlink.h | 2 +- init/Kconfig | 9 + init/initramfs.c | 15 + io_uring/memmap.c | 11 +- ipc/namespace.c | 4 +- kernel/bpf/bpf_struct_ops.c | 114 ++++++- kernel/bpf/btf.c | 6 + kernel/bpf/dispatcher.c | 3 +- kernel/bpf/trampoline.c | 9 +- kernel/bpf/verifier.c | 139 +++++++- kernel/cgroup/cgroup.c | 21 +- kernel/fork.c | 26 +- kernel/irq/irqdomain.c | 202 +++++++----- kernel/rcu/rcuscale.c | 6 +- kernel/rcu/srcutiny.c | 2 +- kernel/rcu/tree.c | 14 +- kernel/sched/cpufreq_schedutil.c | 3 +- kernel/time/time.c | 4 +- kernel/trace/bpf_trace.c | 5 +- kernel/trace/trace_event_perf.c | 6 + lib/overflow_kunit.c | 2 +- lib/string_helpers.c | 2 +- lib/strncpy_from_user.c | 5 +- mm/internal.h | 2 +- net/9p/trans_xen.c | 9 +- net/bluetooth/hci_conn.c | 225 ++++++++++--- net/bluetooth/hci_event.c | 39 ++- net/bluetooth/hci_sysfs.c | 15 +- net/bluetooth/iso.c | 101 ++++-- net/bluetooth/mgmt.c | 38 ++- net/bluetooth/rfcomm/sock.c | 10 +- net/core/filter.c | 88 +++--- net/core/netdev-genl.c | 2 + net/core/skmsg.c | 4 +- net/hsr/hsr_device.c | 4 +- net/ipv4/inet_connection_sock.c | 2 +- net/ipv4/ipmr.c | 44 ++- net/ipv4/ipmr_base.c | 3 +- net/ipv4/tcp_bpf.c | 7 +- net/ipv6/addrconf.c | 41 ++- net/ipv6/ip6_fib.c | 8 +- net/ipv6/ip6mr.c | 40 ++- net/ipv6/route.c | 51 +-- net/iucv/af_iucv.c | 26 +- net/llc/af_llc.c | 2 +- net/mac80211/cfg.c | 22 +- net/mac80211/ieee80211_i.h | 5 +- net/mac80211/link.c | 7 +- net/mac80211/main.c | 2 + net/netfilter/ipset/ip_set_bitmap_ip.c | 7 +- net/netfilter/nf_tables_api.c | 62 ++-- net/netlink/af_netlink.c | 21 +- net/rfkill/rfkill-gpio.c | 8 +- net/rxrpc/af_rxrpc.c | 7 +- net/sched/sch_fq.c | 6 + net/sunrpc/cache.c | 4 +- net/sunrpc/svcsock.c | 4 + net/sunrpc/xprtrdma/svc_rdma.c | 19 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 8 +- net/sunrpc/xprtsock.c | 17 +- net/wireless/core.c | 71 ++++- net/wireless/mlme.c | 6 - net/wireless/nl80211.c | 1 + net/xdp/xsk.c | 11 +- rust/kernel/block/mq/request.rs | 67 ++-- rust/kernel/lib.rs | 2 +- rust/macros/lib.rs | 2 +- samples/bpf/xdp_adjust_tail_kern.c | 1 + samples/kfifo/dma-example.c | 1 + scripts/checkpatch.pl | 37 +-- scripts/faddr2line | 2 +- scripts/kernel-doc | 47 ++- scripts/mod/file2alias.c | 5 +- scripts/package/builddeb | 20 +- security/apparmor/capability.c | 2 + security/apparmor/policy_unpack_test.c | 6 + security/integrity/integrity.h | 4 + sound/core/pcm_native.c | 6 +- sound/core/rawmidi.c | 4 +- sound/core/sound_kunit.c | 11 + sound/core/ump.c | 5 +- sound/hda/intel-dsp-config.c | 4 + sound/pci/hda/patch_realtek.c | 155 ++++----- sound/soc/amd/yc/acp6x-mach.c | 32 +- sound/soc/codecs/da7213.c | 1 + sound/soc/codecs/da7219.c | 9 +- sound/soc/codecs/max9768.c | 11 +- sound/soc/codecs/rt5640.c | 27 +- sound/soc/codecs/rt722-sdca.c | 8 +- sound/soc/codecs/tas2781-fmwlib.c | 1 + sound/soc/codecs/wcd937x.c | 12 +- sound/soc/codecs/wcd937x.h | 4 + sound/soc/fsl/fsl-asoc-card.c | 8 +- sound/soc/fsl/fsl_micfil.c | 4 +- sound/soc/fsl/imx-audmix.c | 3 + sound/soc/generic/audio-graph-card2.c | 3 + sound/soc/intel/atom/sst/sst_acpi.c | 64 +++- sound/soc/intel/boards/bytcr_rt5640.c | 48 ++- sound/soc/mediatek/mt8188/mt8188-mt6359.c | 9 +- .../mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c | 4 +- sound/soc/mediatek/mt8195/mt8195-mt6359.c | 9 +- sound/soc/stm/stm32_sai_sub.c | 6 +- sound/usb/6fire/chip.c | 10 +- sound/usb/caiaq/audio.c | 10 +- sound/usb/caiaq/audio.h | 1 + sound/usb/caiaq/device.c | 19 +- sound/usb/caiaq/input.c | 12 +- sound/usb/caiaq/input.h | 1 + sound/usb/clock.c | 24 +- sound/usb/quirks-table.h | 14 +- sound/usb/quirks.c | 27 +- sound/usb/usx2y/us122l.c | 5 +- sound/usb/usx2y/usbusx2y.c | 2 +- tools/bpf/bpftool/jit_disasm.c | 40 ++- tools/include/nolibc/arch-s390.h | 1 + tools/lib/bpf/libbpf.c | 99 +++--- tools/lib/bpf/linker.c | 2 + tools/lib/thermal/Makefile | 4 +- tools/lib/thermal/commands.c | 52 ++- tools/perf/Makefile.config | 2 +- tools/perf/builtin-ftrace.c | 2 +- tools/perf/builtin-list.c | 4 +- tools/perf/builtin-stat.c | 52 ++- tools/perf/builtin-trace.c | 23 +- tools/perf/tests/attr/test-stat-default | 94 ++++-- tools/perf/tests/attr/test-stat-detailed-1 | 110 +++++-- tools/perf/tests/attr/test-stat-detailed-2 | 134 +++++--- tools/perf/tests/attr/test-stat-detailed-3 | 142 ++++++--- tools/perf/tests/shell/test_stat_intel_tpebs.sh | 22 ++ tools/perf/util/cs-etm.c | 25 +- tools/perf/util/disasm.c | 2 +- tools/perf/util/evlist.c | 19 +- tools/perf/util/evlist.h | 1 + tools/perf/util/machine.c | 2 +- tools/perf/util/mem-events.c | 8 +- tools/perf/util/pfm.c | 4 +- tools/perf/util/pmus.c | 2 +- tools/perf/util/probe-finder.c | 21 +- tools/perf/util/probe-finder.h | 4 +- tools/perf/util/stat-display.c | 101 ++++-- tools/power/x86/turbostat/turbostat.c | 5 +- tools/testing/selftests/arm64/abi/hwcap.c | 6 +- .../selftests/arm64/mte/check_tags_inclusion.c | 4 +- .../testing/selftests/arm64/mte/mte_common_util.c | 4 +- .../selftests/bpf/bpf_testmod/bpf_testmod-events.h | 6 + .../selftests/bpf/bpf_testmod/bpf_testmod.c | 2 + tools/testing/selftests/bpf/network_helpers.c | 46 +++ tools/testing/selftests/bpf/network_helpers.h | 3 + .../selftests/bpf/prog_tests/timer_lockup.c | 6 + .../selftests/bpf/prog_tests/tp_btf_nullable.c | 14 + .../selftests/bpf/progs/test_spin_lock_fail.c | 4 +- .../selftests/bpf/progs/test_tp_btf_nullable.c | 28 ++ tools/testing/selftests/bpf/test_progs.c | 97 +++++- tools/testing/selftests/bpf/test_progs.h | 4 + tools/testing/selftests/bpf/test_sockmap.c | 165 ++++++++-- .../selftests/mount_setattr/mount_setattr_test.c | 2 +- tools/testing/selftests/net/Makefile | 1 + .../selftests/net/ipv6_route_update_soft_lockup.sh | 262 +++++++++++++++ .../selftests/net/netfilter/conntrack_dump_flush.c | 6 + tools/testing/selftests/net/pmtu.sh | 2 +- tools/testing/selftests/resctrl/fill_buf.c | 2 +- tools/testing/selftests/resctrl/mbm_test.c | 16 +- tools/testing/selftests/resctrl/resctrl_val.c | 3 +- tools/testing/selftests/vDSO/parse_vdso.c | 3 +- tools/testing/selftests/watchdog/watchdog-test.c | 6 + tools/testing/selftests/wireguard/netns.sh | 1 + tools/tracing/rtla/src/timerlat_hist.c | 2 +- tools/tracing/rtla/src/timerlat_top.c | 2 +- virt/kvm/kvm_main.c | 103 ------ 908 files changed, 10577 insertions(+), 4981 deletions(-)

4 months, 4 weeks

12
832
0 0

drm/amd/display: Pass pwrseq inst for backlight and ABM

by Alex Deucher

Hi Greg, Sasha, Please cherry pick upstream commit b17ef04bf3a4 ("drm/amd/display: Pass pwrseq inst for backlight and ABM") to stable kernel 6.6.x and newer. This fixes broken backlight adjustment on some AMD platforms with eDP panels. Thanks, Alex

4 months, 4 weeks

3
7
0 0

[PATCH v3 3/8] platform/x86: serdev_helpers: Check for serial_ctrl_uid == NULL

by Hans de Goede

dell_uart_bl_pdev_probe() calls get_serdev_controller() with the serial_ctrl_uid parameter set to NULL. In case of errors this NULL parameter then gets passed to pr_err() as argument matching a "%s" conversion specification. This leads to compiler warnings when building with "make W=1". Check serial_ctrl_uid before passing it to pr_err() to avoid these. Fixes: dc5afd720f84 ("platform/x86: Add new get_serdev_controller() helper") Cc: stable(a)vger.kernel.org Suggested-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> --- drivers/platform/x86/serdev_helpers.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/platform/x86/serdev_helpers.h b/drivers/platform/x86/serdev_helpers.h index bcf3a0c356ea..3bc7fd8e1e19 100644 --- a/drivers/platform/x86/serdev_helpers.h +++ b/drivers/platform/x86/serdev_helpers.h @@ -35,7 +35,7 @@ get_serdev_controller(const char *serial_ctrl_hid, ctrl_adev = acpi_dev_get_first_match_dev(serial_ctrl_hid, serial_ctrl_uid, -1); if (!ctrl_adev) { pr_err("error could not get %s/%s serial-ctrl adev\n", - serial_ctrl_hid, serial_ctrl_uid); + serial_ctrl_hid, serial_ctrl_uid ?: "*"); return ERR_PTR(-ENODEV); } @@ -43,7 +43,7 @@ get_serdev_controller(const char *serial_ctrl_hid, ctrl_dev = get_device(acpi_get_first_physical_node(ctrl_adev)); if (!ctrl_dev) { pr_err("error could not get %s/%s serial-ctrl physical node\n", - serial_ctrl_hid, serial_ctrl_uid); + serial_ctrl_hid, serial_ctrl_uid ?: "*"); ctrl_dev = ERR_PTR(-ENODEV); goto put_ctrl_adev; } -- 2.47.0

4 months, 4 weeks

4
3
0 0

Linux 6.11.11

by Greg Kroah-Hartman

I'm announcing the release of the 6.11.11 kernel. All users of the 6.11 kernel series must upgrade to the 6.12.y branch now. This branch is now end-of-life and will not be receiving any new updates. The updated 6.11.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.11.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/ABI/testing/sysfs-fs-f2fs | 7 Documentation/RCU/stallwarn.rst | 2 Documentation/arch/x86/boot.rst | 17 Documentation/devicetree/bindings/cache/qcom,llcc.yaml | 36 + Documentation/devicetree/bindings/clock/adi,axi-clkgen.yaml | 22 Documentation/devicetree/bindings/iio/dac/adi,ad3552r.yaml | 2 Documentation/devicetree/bindings/pinctrl/samsung,pinctrl-wakeup-interrupt.yaml | 19 Documentation/devicetree/bindings/serial/rs485.yaml | 19 Documentation/devicetree/bindings/sound/mt6359.yaml | 10 Documentation/devicetree/bindings/vendor-prefixes.yaml | 2 Documentation/filesystems/mount_api.rst | 3 Documentation/locking/seqlock.rst | 2 Documentation/networking/j1939.rst | 2 Makefile | 2 arch/arc/kernel/devtree.c | 2 arch/arm/boot/dts/allwinner/sun9i-a80-cubieboard4.dts | 4 arch/arm/boot/dts/microchip/sam9x60.dtsi | 12 arch/arm/boot/dts/renesas/r7s72100-genmai.dts | 2 arch/arm/boot/dts/ti/omap/omap36xx.dtsi | 1 arch/arm/kernel/devtree.c | 2 arch/arm/kernel/head.S | 4 arch/arm/kernel/psci_smp.c | 7 arch/arm/mm/idmap.c | 7 arch/arm/mm/proc-v7.S | 2 arch/arm64/boot/dts/freescale/imx8mn-tqma8mqnl-mba8mx-usbotg.dtso | 29 arch/arm64/boot/dts/mediatek/mt6357.dtsi | 5 arch/arm64/boot/dts/mediatek/mt6358.dtsi | 9 arch/arm64/boot/dts/mediatek/mt6359.dtsi | 5 arch/arm64/boot/dts/mediatek/mt8173-elm-hana.dtsi | 8 arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-burnet.dts | 3 arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-cozmo.dts | 2 arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts | 3 arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-fennel.dtsi | 3 arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi | 30 arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi | 4 arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi | 4 arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi | 4 arch/arm64/boot/dts/mediatek/mt8186-corsola-voltorb.dtsi | 21 arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi | 8 arch/arm64/boot/dts/mediatek/mt8188.dtsi | 5 arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi | 6 arch/arm64/boot/dts/mediatek/mt8195.dtsi | 4 arch/arm64/boot/dts/mediatek/mt8395-genio-1200-evk.dts | 2 arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts | 2 arch/arm64/boot/dts/qcom/sc8180x.dtsi | 2 arch/arm64/boot/dts/qcom/sda660-inforce-ifc6560.dts | 2 arch/arm64/boot/dts/qcom/sm6350.dtsi | 14 arch/arm64/boot/dts/qcom/x1e80100-asus-vivobook-s15.dts | 4 arch/arm64/boot/dts/qcom/x1e80100-lenovo-yoga-slim7x.dts | 4 arch/arm64/boot/dts/qcom/x1e80100.dtsi | 8 arch/arm64/boot/dts/renesas/hihope-rev2.dtsi | 3 arch/arm64/boot/dts/renesas/hihope-rev4.dtsi | 3 arch/arm64/boot/dts/rockchip/rk3568-wolfvision-pf5-io-expander.dtso | 1 arch/arm64/boot/dts/rockchip/rk3588s-indiedroid-nova.dts | 2 arch/arm64/boot/dts/rockchip/rk3588s-orangepi-5.dts | 1 arch/arm64/boot/dts/ti/k3-am62x-phyboard-lyra.dtsi | 2 arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts | 2 arch/arm64/boot/dts/ti/k3-j7200-main.dtsi | 38 - arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi | 6 arch/arm64/boot/dts/ti/k3-j721e-mcu-wakeup.dtsi | 6 arch/arm64/boot/dts/ti/k3-j721s2-main.dtsi | 16 arch/arm64/boot/dts/ti/k3-j721s2-mcu-wakeup.dtsi | 6 arch/arm64/include/asm/insn.h | 1 arch/arm64/include/asm/kvm_host.h | 2 arch/arm64/kernel/cpufeature.c | 1 arch/arm64/kernel/probes/decode-insn.c | 7 arch/arm64/kernel/process.c | 2 arch/arm64/kernel/setup.c | 6 arch/arm64/kernel/vmlinux.lds.S | 6 arch/arm64/kvm/arch_timer.c | 3 arch/arm64/kvm/arm.c | 18 arch/arm64/kvm/mmio.c | 32 arch/arm64/kvm/pmu-emul.c | 1 arch/arm64/kvm/vgic/vgic-its.c | 32 arch/arm64/kvm/vgic/vgic-mmio-v3.c | 7 arch/arm64/kvm/vgic/vgic.h | 23 arch/arm64/net/bpf_jit_comp.c | 47 - arch/csky/kernel/setup.c | 4 arch/loongarch/Makefile | 4 arch/loongarch/include/asm/page.h | 5 arch/loongarch/kernel/acpi.c | 81 +- arch/loongarch/kernel/setup.c | 2 arch/loongarch/kernel/smp.c | 3 arch/loongarch/net/bpf_jit.c | 2 arch/loongarch/vdso/Makefile | 2 arch/m68k/coldfire/device.c | 8 arch/m68k/include/asm/mcfgpio.h | 2 arch/m68k/include/asm/mvme147hw.h | 4 arch/m68k/kernel/early_printk.c | 5 arch/m68k/mvme147/config.c | 30 arch/m68k/mvme147/mvme147.h | 6 arch/microblaze/kernel/microblaze_ksyms.c | 10 arch/microblaze/kernel/prom.c | 2 arch/mips/include/asm/switch_to.h | 2 arch/mips/kernel/prom.c | 2 arch/mips/kernel/relocate.c | 2 arch/nios2/kernel/prom.c | 4 arch/openrisc/Kconfig | 3 arch/openrisc/include/asm/fixmap.h | 21 arch/openrisc/kernel/prom.c | 2 arch/openrisc/mm/init.c | 37 + arch/parisc/kernel/ftrace.c | 2 arch/powerpc/include/asm/dtl.h | 4 arch/powerpc/include/asm/fadump.h | 9 arch/powerpc/include/asm/kvm_book3s_64.h | 4 arch/powerpc/include/asm/sstep.h | 5 arch/powerpc/include/asm/vdso.h | 1 arch/powerpc/kernel/dt_cpu_ftrs.c | 2 arch/powerpc/kernel/fadump.c | 40 - arch/powerpc/kernel/prom.c | 5 arch/powerpc/kernel/setup-common.c | 6 arch/powerpc/kernel/setup_64.c | 1 arch/powerpc/kexec/file_load_64.c | 9 arch/powerpc/kvm/book3s_hv.c | 14 arch/powerpc/kvm/book3s_hv_nested.c | 14 arch/powerpc/kvm/trace_hv.h | 2 arch/powerpc/lib/sstep.c | 12 arch/powerpc/mm/fault.c | 10 arch/powerpc/platforms/pseries/dtl.c | 8 arch/powerpc/platforms/pseries/lpar.c | 8 arch/powerpc/platforms/pseries/plpks.c | 2 arch/riscv/include/asm/cpufeature.h | 2 arch/riscv/kernel/setup.c | 2 arch/riscv/kernel/traps_misaligned.c | 14 arch/riscv/kernel/unaligned_access_speed.c | 1 arch/riscv/kvm/aia_aplic.c | 3 arch/riscv/kvm/vcpu_sbi.c | 11 arch/s390/include/asm/facility.h | 18 arch/s390/include/asm/pci.h | 4 arch/s390/include/asm/set_memory.h | 1 arch/s390/kernel/syscalls/Makefile | 2 arch/s390/mm/pageattr.c | 15 arch/s390/pci/pci.c | 37 - arch/s390/pci/pci_debug.c | 10 arch/sh/kernel/cpu/proc.c | 2 arch/sh/kernel/setup.c | 2 arch/um/drivers/net_kern.c | 2 arch/um/drivers/ubd_kern.c | 4 arch/um/drivers/vector_kern.c | 3 arch/um/kernel/dtb.c | 2 arch/um/kernel/physmem.c | 6 arch/um/kernel/process.c | 2 arch/um/kernel/sysrq.c | 2 arch/x86/coco/tdx/tdx.c | 111 ++- arch/x86/crypto/aegis128-aesni-asm.S | 29 arch/x86/events/intel/pt.c | 11 arch/x86/events/intel/pt.h | 2 arch/x86/include/asm/amd_nb.h | 5 arch/x86/include/asm/atomic64_32.h | 3 arch/x86/include/asm/cmpxchg_32.h | 6 arch/x86/include/asm/kvm_host.h | 4 arch/x86/include/asm/shared/tdx.h | 11 arch/x86/kernel/cpu/amd.c | 1 arch/x86/kernel/cpu/common.c | 4 arch/x86/kernel/devicetree.c | 2 arch/x86/kernel/unwind_orc.c | 2 arch/x86/kvm/Kconfig | 1 arch/x86/kvm/mmu/mmu.c | 68 -- arch/x86/kvm/mmu/spte.c | 18 arch/x86/platform/pvh/head.S | 22 arch/xtensa/kernel/setup.c | 2 block/bfq-iosched.c | 37 - block/blk-core.c | 18 block/blk-merge.c | 65 + block/blk-mq.c | 148 +++- block/blk-mq.h | 13 block/blk-settings.c | 7 block/blk-sysfs.c | 6 block/blk-zoned.c | 14 block/blk.h | 34 - block/elevator.c | 10 block/fops.c | 25 block/genhd.c | 24 crypto/pcrypt.c | 12 drivers/accel/ivpu/ivpu_ipc.c | 35 - drivers/accel/ivpu/ivpu_ipc.h | 7 drivers/accel/ivpu/ivpu_jsm_msg.c | 19 drivers/acpi/arm64/gtdt.c | 2 drivers/acpi/cppc_acpi.c | 1 drivers/base/firmware_loader/main.c | 5 drivers/base/regmap/regmap-irq.c | 41 - drivers/base/trace.h | 6 drivers/block/brd.c | 70 +- drivers/block/loop.c | 6 drivers/block/ublk_drv.c | 17 drivers/block/virtio_blk.c | 46 - drivers/bluetooth/btbcm.c | 4 drivers/bluetooth/btintel.c | 62 + drivers/bluetooth/btintel.h | 7 drivers/bluetooth/btintel_pcie.c | 265 +++++++ drivers/bluetooth/btintel_pcie.h | 16 drivers/bluetooth/btmtk.c | 1 drivers/bluetooth/btusb.c | 1 drivers/bus/mhi/host/trace.h | 25 drivers/clk/clk-apple-nco.c | 3 drivers/clk/clk-axi-clkgen.c | 22 drivers/clk/clk-en7523.c | 264 ++++++- drivers/clk/clk-loongson2.c | 6 drivers/clk/imx/clk-fracn-gppll.c | 10 drivers/clk/imx/clk-imx8-acm.c | 4 drivers/clk/imx/clk-lpcg-scu.c | 37 - drivers/clk/imx/clk-scu.c | 2 drivers/clk/mediatek/Kconfig | 15 drivers/clk/qcom/Kconfig | 4 drivers/clk/ralink/clk-mtmips.c | 26 drivers/clk/renesas/rzg2l-cpg.c | 11 drivers/clk/sophgo/clk-sg2042-pll.c | 2 drivers/clk/sunxi-ng/ccu-sun20i-d1.c | 2 drivers/clocksource/Kconfig | 3 drivers/clocksource/timer-ti-dm-systimer.c | 4 drivers/comedi/comedi_fops.c | 12 drivers/counter/stm32-timer-cnt.c | 17 drivers/counter/ti-ecap-capture.c | 7 drivers/cpufreq/amd-pstate.c | 26 drivers/cpufreq/cppc_cpufreq.c | 63 + drivers/cpufreq/loongson2_cpufreq.c | 4 drivers/cpufreq/loongson3_cpufreq.c | 7 drivers/cpufreq/mediatek-cpufreq-hw.c | 2 drivers/crypto/bcm/cipher.c | 5 drivers/crypto/caam/caampkc.c | 11 drivers/crypto/caam/qi.c | 2 drivers/crypto/cavium/cpt/cptpf_main.c | 6 drivers/crypto/hisilicon/hpre/hpre_main.c | 35 - drivers/crypto/hisilicon/qm.c | 47 - drivers/crypto/hisilicon/sec2/sec_main.c | 35 - drivers/crypto/hisilicon/zip/zip_main.c | 35 - drivers/crypto/inside-secure/safexcel_hash.c | 2 drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c | 2 drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c | 2 drivers/crypto/intel/qat/qat_common/adf_aer.c | 5 drivers/crypto/intel/qat/qat_common/adf_dbgfs.c | 13 drivers/crypto/intel/qat/qat_common/adf_hw_arbiter.c | 4 drivers/crypto/mxs-dcp.c | 20 drivers/dax/pmem/Makefile | 7 drivers/dax/pmem/pmem.c | 10 drivers/dma-buf/Kconfig | 1 drivers/dma-buf/udmabuf.c | 44 - drivers/edac/bluefield_edac.c | 2 drivers/edac/fsl_ddr_edac.c | 22 drivers/edac/i10nm_base.c | 1 drivers/edac/igen6_edac.c | 2 drivers/edac/skx_common.c | 57 + drivers/edac/skx_common.h | 8 drivers/firmware/arm_scmi/common.h | 2 drivers/firmware/arm_scmi/driver.c | 6 drivers/firmware/arm_scpi.c | 3 drivers/firmware/efi/libstub/efi-stub.c | 2 drivers/firmware/efi/tpm.c | 17 drivers/firmware/google/gsmi.c | 6 drivers/gpio/gpio-exar.c | 10 drivers/gpio/gpio-zevio.c | 6 drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 2 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 13 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 8 drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 63 + drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 7 drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 18 drivers/gpu/drm/amd/amdkfd/kfd_process.c | 5 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 32 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 3 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 4 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 13 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 15 drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 3 drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 6 drivers/gpu/drm/bridge/analogix/anx7625.c | 2 drivers/gpu/drm/bridge/ite-it6505.c | 2 drivers/gpu/drm/bridge/tc358767.c | 7 drivers/gpu/drm/drm_file.c | 2 drivers/gpu/drm/drm_mm.c | 2 drivers/gpu/drm/drm_panel_orientation_quirks.c | 1 drivers/gpu/drm/etnaviv/etnaviv_drv.c | 10 drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 28 drivers/gpu/drm/fsl-dcu/Kconfig | 1 drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 15 drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h | 3 drivers/gpu/drm/imagination/pvr_ccb.c | 2 drivers/gpu/drm/imagination/pvr_vm.c | 4 drivers/gpu/drm/imx/dcss/dcss-crtc.c | 6 drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c | 6 drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 4 drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_0_msm8998.h | 12 drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h | 14 drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c | 2 drivers/gpu/drm/msm/msm_gpu_devfreq.c | 9 drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 1 drivers/gpu/drm/omapdrm/dss/base.c | 25 drivers/gpu/drm/omapdrm/dss/omapdss.h | 3 drivers/gpu/drm/omapdrm/omap_drv.c | 4 drivers/gpu/drm/omapdrm/omap_gem.c | 10 drivers/gpu/drm/panel/panel-newvision-nv3052c.c | 2 drivers/gpu/drm/panel/panel-novatek-nt35510.c | 15 drivers/gpu/drm/panfrost/panfrost_devfreq.c | 3 drivers/gpu/drm/panfrost/panfrost_gpu.c | 1 drivers/gpu/drm/panthor/panthor_devfreq.c | 29 drivers/gpu/drm/panthor/panthor_device.h | 28 drivers/gpu/drm/panthor/panthor_sched.c | 333 ++++++++-- drivers/gpu/drm/radeon/atombios_encoders.c | 2 drivers/gpu/drm/radeon/cik.c | 14 drivers/gpu/drm/radeon/dce6_afmt.c | 2 drivers/gpu/drm/radeon/evergreen.c | 12 drivers/gpu/drm/radeon/ni.c | 2 drivers/gpu/drm/radeon/r100.c | 24 drivers/gpu/drm/radeon/r300.c | 6 drivers/gpu/drm/radeon/r420.c | 6 drivers/gpu/drm/radeon/r520.c | 2 drivers/gpu/drm/radeon/r600.c | 12 drivers/gpu/drm/radeon/r600_cs.c | 2 drivers/gpu/drm/radeon/r600_dpm.c | 4 drivers/gpu/drm/radeon/r600_hdmi.c | 2 drivers/gpu/drm/radeon/radeon.h | 5 drivers/gpu/drm/radeon/radeon_acpi.c | 10 drivers/gpu/drm/radeon/radeon_agp.c | 2 drivers/gpu/drm/radeon/radeon_atombios.c | 2 drivers/gpu/drm/radeon/radeon_audio.c | 14 drivers/gpu/drm/radeon/radeon_combios.c | 12 drivers/gpu/drm/radeon/radeon_device.c | 10 drivers/gpu/drm/radeon/radeon_display.c | 74 +- drivers/gpu/drm/radeon/radeon_fbdev.c | 26 drivers/gpu/drm/radeon/radeon_fence.c | 8 drivers/gpu/drm/radeon/radeon_gem.c | 2 drivers/gpu/drm/radeon/radeon_i2c.c | 2 drivers/gpu/drm/radeon/radeon_ib.c | 2 drivers/gpu/drm/radeon/radeon_irq_kms.c | 12 drivers/gpu/drm/radeon/radeon_object.c | 2 drivers/gpu/drm/radeon/radeon_pm.c | 20 drivers/gpu/drm/radeon/radeon_ring.c | 2 drivers/gpu/drm/radeon/radeon_ttm.c | 6 drivers/gpu/drm/radeon/rs400.c | 6 drivers/gpu/drm/radeon/rs600.c | 14 drivers/gpu/drm/radeon/rs690.c | 2 drivers/gpu/drm/radeon/rv515.c | 4 drivers/gpu/drm/radeon/rv770.c | 2 drivers/gpu/drm/radeon/si.c | 4 drivers/gpu/drm/v3d/v3d_drv.h | 1 drivers/gpu/drm/v3d/v3d_irq.c | 2 drivers/gpu/drm/v3d/v3d_mmu.c | 31 drivers/gpu/drm/v3d/v3d_sched.c | 46 + drivers/gpu/drm/vc4/tests/vc4_mock.c | 12 drivers/gpu/drm/vc4/vc4_bo.c | 28 drivers/gpu/drm/vc4/vc4_crtc.c | 13 drivers/gpu/drm/vc4/vc4_drv.c | 22 drivers/gpu/drm/vc4/vc4_drv.h | 8 drivers/gpu/drm/vc4/vc4_gem.c | 24 drivers/gpu/drm/vc4/vc4_hdmi.c | 22 drivers/gpu/drm/vc4/vc4_hvs.c | 64 + drivers/gpu/drm/vc4/vc4_irq.c | 10 drivers/gpu/drm/vc4/vc4_kms.c | 14 drivers/gpu/drm/vc4/vc4_perfmon.c | 20 drivers/gpu/drm/vc4/vc4_plane.c | 12 drivers/gpu/drm/vc4/vc4_render_cl.c | 2 drivers/gpu/drm/vc4/vc4_v3d.c | 10 drivers/gpu/drm/vc4/vc4_validate.c | 8 drivers/gpu/drm/vc4/vc4_validate_shaders.c | 2 drivers/gpu/drm/vkms/vkms_output.c | 5 drivers/gpu/drm/xe/display/xe_hdcp_gsc.c | 2 drivers/gpu/drm/xe/xe_sync.c | 6 drivers/gpu/drm/xlnx/zynqmp_disp.c | 3 drivers/gpu/drm/xlnx/zynqmp_kms.c | 2 drivers/hid/hid-hyperv.c | 58 + drivers/hid/wacom_wac.c | 4 drivers/hwmon/aquacomputer_d5next.c | 2 drivers/hwmon/nct6775-core.c | 7 drivers/hwmon/pmbus/pmbus_core.c | 12 drivers/hwmon/tps23861.c | 2 drivers/i2c/i2c-dev.c | 17 drivers/i3c/master.c | 13 drivers/iio/dac/adi-axi-dac.c | 2 drivers/iio/industrialio-gts-helper.c | 2 drivers/iio/light/al3010.c | 11 drivers/infiniband/core/uverbs.h | 2 drivers/infiniband/core/uverbs_main.c | 43 + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 7 drivers/infiniband/hw/bnxt_re/qplib_fp.h | 2 drivers/infiniband/hw/hns/hns_roce_cq.c | 4 drivers/infiniband/hw/hns/hns_roce_debugfs.c | 3 drivers/infiniband/hw/hns/hns_roce_device.h | 14 drivers/infiniband/hw/hns/hns_roce_hem.c | 48 - drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 257 ++++--- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 8 drivers/infiniband/hw/hns/hns_roce_main.c | 7 drivers/infiniband/hw/hns/hns_roce_mr.c | 11 drivers/infiniband/hw/hns/hns_roce_qp.c | 77 +- drivers/infiniband/hw/hns/hns_roce_srq.c | 4 drivers/infiniband/hw/mlx5/main.c | 40 - drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 drivers/infiniband/sw/rxe/rxe_qp.c | 1 drivers/infiniband/sw/rxe/rxe_req.c | 6 drivers/input/misc/cs40l50-vibra.c | 6 drivers/interconnect/qcom/icc-rpmh.c | 3 drivers/iommu/amd/amd_iommu.h | 15 drivers/iommu/amd/amd_iommu_types.h | 5 drivers/iommu/amd/io_pgtable.c | 76 -- drivers/iommu/amd/io_pgtable_v2.c | 29 drivers/iommu/amd/iommu.c | 28 drivers/iommu/amd/pasid.c | 2 drivers/iommu/intel/iommu.c | 40 - drivers/iommu/s390-iommu.c | 73 +- drivers/irqchip/irq-mvebu-sei.c | 2 drivers/leds/flash/leds-ktd2692.c | 1 drivers/leds/leds-max5970.c | 5 drivers/mailbox/arm_mhuv2.c | 8 drivers/mailbox/mtk-cmdq-mailbox.c | 2 drivers/mailbox/omap-mailbox.c | 1 drivers/md/dm-bufio.c | 12 drivers/md/dm-cache-background-tracker.c | 25 drivers/md/dm-cache-background-tracker.h | 8 drivers/md/dm-cache-target.c | 25 drivers/media/i2c/adv7604.c | 5 drivers/media/i2c/adv7842.c | 13 drivers/media/i2c/ds90ub960.c | 2 drivers/media/i2c/vgxy61.c | 2 drivers/media/pci/intel/ipu6/ipu6-bus.c | 6 drivers/media/pci/intel/ipu6/ipu6-buttress.c | 34 - drivers/media/pci/intel/ipu6/ipu6-cpd.c | 18 drivers/media/pci/intel/ipu6/ipu6-dma.c | 202 ++---- drivers/media/pci/intel/ipu6/ipu6-dma.h | 34 - drivers/media/pci/intel/ipu6/ipu6-fw-com.c | 14 drivers/media/pci/intel/ipu6/ipu6-mmu.c | 28 drivers/media/pci/intel/ipu6/ipu6.c | 3 drivers/media/radio/wl128x/fmdrv_common.c | 3 drivers/media/test-drivers/vivid/vivid-vid-cap.c | 15 drivers/media/v4l2-core/v4l2-dv-timings.c | 132 ++- drivers/message/fusion/mptsas.c | 4 drivers/mfd/da9052-spi.c | 2 drivers/mfd/intel_soc_pmic_bxtwc.c | 132 ++- drivers/mfd/rt5033.c | 4 drivers/mfd/tps65010.c | 8 drivers/misc/apds990x.c | 12 drivers/misc/lkdtm/bugs.c | 2 drivers/mmc/host/mmc_spi.c | 9 drivers/mtd/hyperbus/rpc-if.c | 7 drivers/mtd/nand/raw/atmel/pmecc.c | 8 drivers/mtd/nand/raw/atmel/pmecc.h | 2 drivers/mtd/spi-nor/core.c | 2 drivers/mtd/spi-nor/spansion.c | 1 drivers/mtd/ubi/attach.c | 12 drivers/mtd/ubi/fastmap-wl.c | 19 drivers/mtd/ubi/vmt.c | 2 drivers/mtd/ubi/wl.c | 11 drivers/mtd/ubi/wl.h | 3 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 30 drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 9 drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 4 drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.h | 3 drivers/net/ethernet/broadcom/tg3.c | 3 drivers/net/ethernet/google/gve/gve_adminq.c | 4 drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 2 drivers/net/ethernet/intel/ice/ice_virtchnl.c | 21 drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 70 ++ drivers/net/ethernet/marvell/octeontx2/af/cgx.h | 5 drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h | 7 drivers/net/ethernet/marvell/octeontx2/af/rpm.c | 87 ++ drivers/net/ethernet/marvell/octeontx2/af/rpm.h | 18 drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 1 drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 45 + drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c | 5 drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 4 drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c | 5 drivers/net/ethernet/marvell/octeontx2/nic/otx2_dmac_flt.c | 9 drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 10 drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c | 10 drivers/net/ethernet/marvell/pxa168_eth.c | 14 drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 2 drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c | 17 drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 2 drivers/net/ethernet/wangxun/txgbe/txgbe_irq.c | 24 drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 1 drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 168 ----- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.h | 2 drivers/net/ethernet/wangxun/txgbe/txgbe_type.h | 7 drivers/net/mdio/mdio-ipq4019.c | 5 drivers/net/netdevsim/ipsec.c | 11 drivers/net/usb/lan78xx.c | 40 - drivers/net/usb/qmi_wwan.c | 1 drivers/net/usb/r8152.c | 1 drivers/net/wireless/ath/ath10k/mac.c | 4 drivers/net/wireless/ath/ath11k/qmi.c | 3 drivers/net/wireless/ath/ath12k/dp.c | 19 drivers/net/wireless/ath/ath12k/mac.c | 5 drivers/net/wireless/ath/ath12k/wow.c | 2 drivers/net/wireless/ath/ath9k/htc_hst.c | 3 drivers/net/wireless/ath/wil6210/txrx.c | 2 drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c | 3 drivers/net/wireless/intel/ipw2x00/ipw2100.c | 2 drivers/net/wireless/intel/ipw2x00/ipw2200.h | 2 drivers/net/wireless/intel/iwlegacy/3945.c | 2 drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 96 +- drivers/net/wireless/intel/iwlwifi/fw/init.c | 4 drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 2 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 8 drivers/net/wireless/intersil/p54/p54spi.c | 4 drivers/net/wireless/marvell/libertas/radiotap.h | 4 drivers/net/wireless/marvell/mwifiex/fw.h | 2 drivers/net/wireless/marvell/mwifiex/main.c | 4 drivers/net/wireless/microchip/wilc1000/mon.c | 4 drivers/net/wireless/microchip/wilc1000/netdev.c | 6 drivers/net/wireless/realtek/rtl8xxxu/core.c | 6 drivers/net/wireless/realtek/rtlwifi/efuse.c | 11 drivers/net/wireless/realtek/rtw89/coex.c | 4 drivers/net/wireless/silabs/wfx/main.c | 17 drivers/net/wireless/st/cw1200/cw1200_spi.c | 2 drivers/net/wireless/virtual/mac80211_hwsim.c | 4 drivers/nvme/host/core.c | 5 drivers/nvme/host/multipath.c | 33 drivers/nvme/host/pci.c | 55 - drivers/of/fdt.c | 14 drivers/of/kexec.c | 2 drivers/pci/controller/cadence/pci-j721e.c | 100 ++- drivers/pci/controller/cadence/pcie-cadence-host.c | 44 - drivers/pci/controller/cadence/pcie-cadence.h | 12 drivers/pci/controller/dwc/pcie-qcom-ep.c | 6 drivers/pci/controller/dwc/pcie-tegra194.c | 7 drivers/pci/endpoint/functions/pci-epf-mhi.c | 6 drivers/pci/hotplug/cpqphp_pci.c | 19 drivers/pci/pci.c | 5 drivers/pci/slot.c | 4 drivers/perf/arm-cmn.c | 4 drivers/perf/arm_smmuv3_pmu.c | 19 drivers/phy/phy-airoha-pcie-regs.h | 6 drivers/phy/phy-airoha-pcie.c | 8 drivers/phy/realtek/phy-rtk-usb2.c | 2 drivers/phy/realtek/phy-rtk-usb3.c | 2 drivers/pinctrl/pinctrl-k210.c | 2 drivers/pinctrl/pinctrl-zynqmp.c | 1 drivers/pinctrl/qcom/pinctrl-spmi-gpio.c | 2 drivers/pinctrl/renesas/Kconfig | 1 drivers/platform/chrome/cros_ec_typec.c | 1 drivers/platform/x86/dell/dell-smbios-base.c | 1 drivers/platform/x86/dell/dell-wmi-base.c | 6 drivers/platform/x86/ideapad-laptop.c | 3 drivers/platform/x86/intel/bxtwc_tmu.c | 22 drivers/platform/x86/panasonic-laptop.c | 10 drivers/platform/x86/thinkpad_acpi.c | 28 drivers/pmdomain/ti/ti_sci_pm_domains.c | 4 drivers/power/sequencing/Kconfig | 1 drivers/power/supply/bq27xxx_battery.c | 37 + drivers/power/supply/power_supply_core.c | 2 drivers/power/supply/rt9471.c | 52 - drivers/pwm/core.c | 10 drivers/pwm/pwm-imx27.c | 98 ++ drivers/regulator/qcom_smd-regulator.c | 2 drivers/regulator/rk808-regulator.c | 17 drivers/remoteproc/qcom_q6v5_adsp.c | 11 drivers/remoteproc/qcom_q6v5_mss.c | 6 drivers/remoteproc/qcom_q6v5_pas.c | 22 drivers/rpmsg/qcom_glink_native.c | 3 drivers/rtc/interface.c | 7 drivers/rtc/rtc-ab-eoz9.c | 7 drivers/rtc/rtc-abx80x.c | 2 drivers/rtc/rtc-rzn1.c | 8 drivers/rtc/rtc-st-lpc.c | 5 drivers/s390/cio/cio.c | 6 drivers/s390/cio/device.c | 18 drivers/scsi/bfa/bfad.c | 3 drivers/scsi/hisi_sas/hisi_sas_main.c | 8 drivers/scsi/qedf/qedf_main.c | 1 drivers/scsi/qedi/qedi_main.c | 1 drivers/scsi/sg.c | 9 drivers/sh/intc/core.c | 2 drivers/soc/fsl/rcpm.c | 1 drivers/soc/qcom/qcom-geni-se.c | 3 drivers/soc/qcom/socinfo.c | 8 drivers/soc/ti/smartreflex.c | 4 drivers/soc/xilinx/xlnx_event_manager.c | 4 drivers/spi/atmel-quadspi.c | 2 drivers/spi/spi-fsl-lpspi.c | 12 drivers/spi/spi-stm32.c | 1 drivers/spi/spi-tegra210-quad.c | 2 drivers/spi/spi-zynqmp-gqspi.c | 2 drivers/spi/spi.c | 13 drivers/staging/media/atomisp/pci/sh_css_params.c | 2 drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 6 drivers/target/target_core_pscsi.c | 2 drivers/thermal/thermal_core.c | 133 ++- drivers/thermal/thermal_core.h | 15 drivers/thermal/thermal_sysfs.c | 2 drivers/tty/serial/8250/8250_fintek.c | 14 drivers/tty/serial/8250/8250_omap.c | 4 drivers/tty/serial/amba-pl011.c | 7 drivers/tty/tty_io.c | 2 drivers/usb/dwc3/ep0.c | 2 drivers/usb/dwc3/gadget.c | 15 drivers/usb/gadget/composite.c | 18 drivers/usb/gadget/function/uvc_video.c | 4 drivers/usb/host/ehci-spear.c | 7 drivers/usb/host/xhci-pci.c | 10 drivers/usb/host/xhci-ring.c | 73 +- drivers/usb/host/xhci.c | 40 + drivers/usb/host/xhci.h | 3 drivers/usb/misc/chaoskey.c | 35 - drivers/usb/misc/iowarrior.c | 50 + drivers/usb/misc/usb-ljca.c | 20 drivers/usb/misc/yurex.c | 5 drivers/usb/musb/musb_gadget.c | 13 drivers/usb/typec/class.c | 6 drivers/usb/typec/tcpm/wcove.c | 4 drivers/usb/typec/ucsi/ucsi_ccg.c | 5 drivers/usb/typec/ucsi/ucsi_glink.c | 2 drivers/vdpa/mlx5/core/mr.c | 4 drivers/vfio/pci/mlx5/cmd.c | 6 drivers/vfio/pci/mlx5/main.c | 35 - drivers/vfio/pci/vfio_pci_config.c | 16 drivers/video/fbdev/sh7760fb.c | 3 drivers/watchdog/Kconfig | 4 drivers/xen/xenbus/xenbus_probe.c | 8 fs/binfmt_elf.c | 2 fs/binfmt_elf_fdpic.c | 5 fs/binfmt_misc.c | 7 fs/cachefiles/interface.c | 14 fs/cachefiles/ondemand.c | 38 - fs/dlm/ast.c | 2 fs/dlm/recoverd.c | 2 fs/efs/super.c | 43 - fs/erofs/zmap.c | 17 fs/exec.c | 45 - fs/exfat/file.c | 10 fs/exfat/namei.c | 21 fs/ext4/balloc.c | 4 fs/ext4/ext4.h | 12 fs/ext4/extents.c | 2 fs/ext4/fsmap.c | 54 + fs/ext4/ialloc.c | 5 fs/ext4/indirect.c | 2 fs/ext4/inode.c | 4 fs/ext4/mballoc.c | 18 fs/ext4/mballoc.h | 1 fs/ext4/mmp.c | 2 fs/ext4/move_extent.c | 43 - fs/ext4/resize.c | 2 fs/ext4/super.c | 42 - fs/f2fs/checkpoint.c | 4 fs/f2fs/data.c | 29 fs/f2fs/debug.c | 2 fs/f2fs/f2fs.h | 3 fs/f2fs/file.c | 23 fs/f2fs/gc.c | 2 fs/f2fs/node.c | 14 fs/f2fs/segment.c | 5 fs/f2fs/segment.h | 35 - fs/f2fs/super.c | 37 - fs/fuse/file.c | 62 + fs/fuse/fuse_i.h | 6 fs/fuse/virtio_fs.c | 1 fs/gfs2/glock.c | 19 fs/gfs2/glock.h | 1 fs/gfs2/incore.h | 2 fs/gfs2/rgrp.c | 2 fs/gfs2/super.c | 2 fs/hfsplus/hfsplus_fs.h | 3 fs/hfsplus/wrapper.c | 2 fs/isofs/inode.c | 8 fs/jffs2/erase.c | 7 fs/jfs/xattr.c | 2 fs/netfs/fscache_volume.c | 3 fs/nfs/blocklayout/blocklayout.c | 15 fs/nfs/blocklayout/dev.c | 6 fs/nfs/internal.h | 2 fs/nfs/nfs4proc.c | 8 fs/nfs/write.c | 49 - fs/nfsd/export.c | 31 fs/nfsd/export.h | 4 fs/nfsd/nfs4callback.c | 16 fs/nfsd/nfs4proc.c | 7 fs/nfsd/nfs4recover.c | 3 fs/nfsd/nfs4state.c | 5 fs/nfsd/nfs4xdr.c | 2 fs/nfsd/nfsfh.c | 20 fs/nfsd/nfsfh.h | 3 fs/notify/fsnotify.c | 23 fs/notify/mark.c | 12 fs/ocfs2/aops.h | 2 fs/ocfs2/file.c | 4 fs/proc/kcore.c | 10 fs/proc/softirqs.c | 2 fs/read_write.c | 15 fs/smb/client/cached_dir.c | 229 ++++-- fs/smb/client/cached_dir.h | 6 fs/smb/client/cifsfs.c | 12 fs/smb/client/cifsglob.h | 4 fs/smb/client/cifsproto.h | 1 fs/smb/client/connect.c | 59 + fs/smb/client/fs_context.c | 85 ++ fs/smb/client/fs_context.h | 1 fs/smb/client/inode.c | 4 fs/smb/client/reparse.c | 95 ++ fs/smb/client/reparse.h | 6 fs/smb/client/smb1ops.c | 4 fs/smb/client/smb2file.c | 21 fs/smb/client/smb2inode.c | 6 fs/smb/client/smb2ops.c | 2 fs/smb/client/smb2pdu.c | 4 fs/smb/client/smb2proto.h | 9 fs/smb/client/trace.h | 3 fs/smb/server/server.c | 4 fs/ubifs/super.c | 6 fs/ubifs/tnc_commit.c | 2 fs/unicode/utf8-core.c | 2 include/asm-generic/vmlinux.lds.h | 4 include/kunit/skbuff.h | 2 include/linux/blk-mq.h | 2 include/linux/blkdev.h | 15 include/linux/bpf.h | 9 include/linux/cleanup.h | 4 include/linux/compiler_attributes.h | 13 include/linux/compiler_types.h | 19 include/linux/f2fs_fs.h | 6 include/linux/fs.h | 2 include/linux/hisi_acc_qm.h | 8 include/linux/io-pgtable.h | 4 include/linux/irqdomain.h | 8 include/linux/jiffies.h | 2 include/linux/kfifo.h | 1 include/linux/kvm_host.h | 6 include/linux/lockdep.h | 2 include/linux/mmdebug.h | 6 include/linux/netpoll.h | 2 include/linux/of_fdt.h | 5 include/linux/once.h | 4 include/linux/once_lite.h | 2 include/linux/rcupdate.h | 2 include/linux/regmap.h | 4 include/linux/seqlock.h | 98 ++ include/media/v4l2-dv-timings.h | 18 include/net/bluetooth/hci.h | 4 include/net/bluetooth/hci_core.h | 63 + include/net/cfg80211.h | 44 + include/net/ieee80211_radiotap.h | 43 - include/net/net_debug.h | 2 include/rdma/ib_verbs.h | 8 include/uapi/linux/rtnetlink.h | 2 init/Kconfig | 9 init/initramfs.c | 15 io_uring/memmap.c | 11 ipc/namespace.c | 4 kernel/bpf/bpf_struct_ops.c | 114 +++ kernel/bpf/btf.c | 6 kernel/bpf/dispatcher.c | 3 kernel/bpf/trampoline.c | 9 kernel/bpf/verifier.c | 139 +++- kernel/cgroup/cgroup.c | 21 kernel/fork.c | 26 kernel/irq/irqdomain.c | 202 +++--- kernel/rcu/rcuscale.c | 6 kernel/rcu/srcutiny.c | 2 kernel/rcu/tree.c | 14 kernel/sched/cpufreq_schedutil.c | 3 kernel/time/time.c | 4 kernel/trace/bpf_trace.c | 5 kernel/trace/trace_event_perf.c | 6 lib/overflow_kunit.c | 2 lib/string_helpers.c | 2 lib/strncpy_from_user.c | 5 mm/internal.h | 2 net/9p/trans_xen.c | 9 net/bluetooth/hci_conn.c | 219 +++++- net/bluetooth/hci_event.c | 39 + net/bluetooth/hci_sysfs.c | 15 net/bluetooth/iso.c | 101 ++- net/bluetooth/mgmt.c | 38 - net/bluetooth/rfcomm/sock.c | 10 net/core/filter.c | 88 +- net/core/netdev-genl.c | 2 net/core/skmsg.c | 4 net/hsr/hsr_device.c | 4 net/ipv4/inet_connection_sock.c | 2 net/ipv4/ipmr.c | 42 - net/ipv4/ipmr_base.c | 3 net/ipv4/tcp_bpf.c | 7 net/ipv6/addrconf.c | 41 - net/ipv6/ip6_fib.c | 8 net/ipv6/ip6mr.c | 38 - net/ipv6/route.c | 51 - net/iucv/af_iucv.c | 26 net/llc/af_llc.c | 2 net/mac80211/cfg.c | 22 net/mac80211/ieee80211_i.h | 5 net/mac80211/link.c | 7 net/mac80211/main.c | 2 net/netfilter/ipset/ip_set_bitmap_ip.c | 7 net/netfilter/nf_tables_api.c | 60 + net/netlink/af_netlink.c | 21 net/rfkill/rfkill-gpio.c | 8 net/rxrpc/af_rxrpc.c | 7 net/sched/sch_fq.c | 6 net/sunrpc/cache.c | 4 net/sunrpc/svcsock.c | 4 net/sunrpc/xprtrdma/svc_rdma.c | 19 net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 8 net/sunrpc/xprtsock.c | 17 net/wireless/core.c | 71 +- net/wireless/mlme.c | 6 net/wireless/nl80211.c | 1 net/xdp/xsk.c | 11 rust/kernel/block/mq/request.rs | 67 +- rust/kernel/lib.rs | 2 rust/macros/lib.rs | 2 samples/bpf/xdp_adjust_tail_kern.c | 1 samples/kfifo/dma-example.c | 1 scripts/checkpatch.pl | 37 - scripts/faddr2line | 2 scripts/kernel-doc | 47 - scripts/mod/file2alias.c | 5 scripts/package/builddeb | 22 security/apparmor/capability.c | 2 security/apparmor/policy_unpack_test.c | 6 security/integrity/integrity.h | 4 sound/core/pcm_native.c | 6 sound/core/rawmidi.c | 4 sound/core/sound_kunit.c | 11 sound/core/ump.c | 5 sound/hda/intel-dsp-config.c | 4 sound/pci/hda/patch_realtek.c | 155 ++-- sound/soc/amd/yc/acp6x-mach.c | 32 sound/soc/codecs/da7213.c | 1 sound/soc/codecs/da7219.c | 9 sound/soc/codecs/max9768.c | 11 sound/soc/codecs/rt5640.c | 27 sound/soc/codecs/rt722-sdca.c | 8 sound/soc/codecs/tas2781-fmwlib.c | 1 sound/soc/codecs/wcd937x.c | 12 sound/soc/codecs/wcd937x.h | 4 sound/soc/fsl/fsl-asoc-card.c | 8 sound/soc/fsl/fsl_micfil.c | 4 sound/soc/fsl/imx-audmix.c | 3 sound/soc/generic/audio-graph-card2.c | 3 sound/soc/intel/atom/sst/sst_acpi.c | 64 + sound/soc/intel/boards/bytcr_rt5640.c | 48 + sound/soc/mediatek/mt8188/mt8188-mt6359.c | 9 sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c | 4 sound/soc/mediatek/mt8195/mt8195-mt6359.c | 9 sound/soc/stm/stm32_sai_sub.c | 6 sound/usb/6fire/chip.c | 10 sound/usb/caiaq/audio.c | 10 sound/usb/caiaq/audio.h | 1 sound/usb/caiaq/device.c | 19 sound/usb/caiaq/input.c | 12 sound/usb/caiaq/input.h | 1 sound/usb/clock.c | 24 sound/usb/quirks-table.h | 14 sound/usb/quirks.c | 27 sound/usb/usx2y/us122l.c | 5 sound/usb/usx2y/usbusx2y.c | 2 tools/bpf/bpftool/jit_disasm.c | 40 - tools/include/nolibc/arch-s390.h | 1 tools/lib/bpf/libbpf.c | 99 +- tools/lib/bpf/linker.c | 2 tools/lib/thermal/Makefile | 4 tools/lib/thermal/commands.c | 52 + tools/perf/Makefile.config | 2 tools/perf/builtin-ftrace.c | 2 tools/perf/builtin-list.c | 4 tools/perf/builtin-stat.c | 52 + tools/perf/builtin-trace.c | 23 tools/perf/tests/attr/test-stat-default | 90 ++ tools/perf/tests/attr/test-stat-detailed-1 | 106 ++- tools/perf/tests/attr/test-stat-detailed-2 | 130 ++- tools/perf/tests/attr/test-stat-detailed-3 | 138 ++-- tools/perf/tests/shell/test_stat_intel_tpebs.sh | 19 tools/perf/util/cs-etm.c | 25 tools/perf/util/disasm.c | 2 tools/perf/util/evlist.c | 19 tools/perf/util/evlist.h | 1 tools/perf/util/machine.c | 2 tools/perf/util/mem-events.c | 8 tools/perf/util/pfm.c | 4 tools/perf/util/pmus.c | 2 tools/perf/util/probe-finder.c | 21 tools/perf/util/probe-finder.h | 4 tools/power/x86/turbostat/turbostat.c | 5 tools/testing/selftests/arm64/abi/hwcap.c | 6 tools/testing/selftests/arm64/mte/check_tags_inclusion.c | 4 tools/testing/selftests/arm64/mte/mte_common_util.c | 4 tools/testing/selftests/bpf/bpf_testmod/bpf_testmod-events.h | 6 tools/testing/selftests/bpf/bpf_testmod/bpf_testmod.c | 2 tools/testing/selftests/bpf/network_helpers.c | 46 + tools/testing/selftests/bpf/network_helpers.h | 3 tools/testing/selftests/bpf/prog_tests/timer_lockup.c | 6 tools/testing/selftests/bpf/prog_tests/tp_btf_nullable.c | 14 tools/testing/selftests/bpf/progs/test_spin_lock_fail.c | 4 tools/testing/selftests/bpf/progs/test_tp_btf_nullable.c | 28 tools/testing/selftests/bpf/test_progs.c | 97 ++ tools/testing/selftests/bpf/test_progs.h | 4 tools/testing/selftests/bpf/test_sockmap.c | 165 ++++ tools/testing/selftests/mount_setattr/mount_setattr_test.c | 2 tools/testing/selftests/net/Makefile | 1 tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh | 262 +++++++ tools/testing/selftests/net/netfilter/conntrack_dump_flush.c | 6 tools/testing/selftests/net/pmtu.sh | 2 tools/testing/selftests/resctrl/fill_buf.c | 2 tools/testing/selftests/resctrl/mbm_test.c | 16 tools/testing/selftests/resctrl/resctrl_val.c | 3 tools/testing/selftests/vDSO/parse_vdso.c | 3 tools/testing/selftests/watchdog/watchdog-test.c | 6 tools/testing/selftests/wireguard/netns.sh | 1 tools/tracing/rtla/src/timerlat_hist.c | 2 tools/tracing/rtla/src/timerlat_top.c | 2 virt/kvm/kvm_main.c | 103 --- 900 files changed, 10279 insertions(+), 4753 deletions(-) Abel Vesa (3): arm64: dts: qcom: x1e80100-slim7x: Drop orientation-switch from USB SS[0-1] QMP PHYs arm64: dts: qcom: x1e80100-vivobook-s15: Drop orientation-switch from USB SS[0-1] QMP PHYs dt-bindings: cache: qcom,llcc: Fix X1E80100 reg entries Adrian Hunter (1): perf/x86/intel/pt: Fix buffer full but size is 0 case Adrián Larumbe (4): drm/panfrost: Add missing OPP table refcnt decremental drm/panthor: introduce job cycle and timestamp accounting drm/panthor: record current and maximum device clock frequencies drm/panthor: Fix OPP refcnt leaks in devfreq initialisation Ahmed Ehab (1): locking/lockdep: Avoid creating new name string literals in lockdep_set_subclass() Ahsan Atta (1): crypto: qat - remove faulty arbiter config reset Alain Volmat (1): spi: stm32: fix missing device mode capability in stm32mp25 Aleksa Savic (1): hwmon: (aquacomputer_d5next) Fix length of speed_input array Aleksandr Mishin (1): acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block() Aleksei Vetrov (1): wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan Alex Zenla (2): 9p/xen: fix init sequence 9p/xen: fix release of IRQ Alexander Aring (2): dlm: fix swapped args sb_flags vs sb_status dlm: fix dlm_recover_members refcount on error Alexander Hölzl (1): can: j1939: fix error in J1939 documentation. Alexey Klimov (2): ASoC: codecs: wcd937x: add missing LO Switch control ASoC: codecs: wcd937x: relax the AUX PDM watchdog Alexis Lothoré (eBPF Foundation) (1): selftests/bpf: add missing header include for htons Alper Nebi Yasak (1): wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() Amir Goldstein (1): fsnotify: fix sending inotify event with unexpected filename Andre Przywara (5): kselftest/arm64: hwcap: fix f8dp2 cpuinfo name kselftest/arm64: mte: fix printf type warnings about __u64 kselftest/arm64: mte: fix printf type warnings about longs ARM: dts: cubieboard4: Fix DCDC5 regulator constraints clk: sunxi-ng: d1: Fix PLL_AUDIO0 preset Andreas Gruenbacher (3): gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE gfs2: Allow immediate GLF_VERIFY_DELETE work gfs2: Fix unlinked inode cleanup Andreas Kemnade (1): ARM: dts: omap36xx: declare 1GHz OPP as turbo again Andrei Simion (1): ARM: dts: microchip: sam9x60: Add missing property atmel,usart-mode Andrej Shadura (1): Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}() Andrii Nakryiko (4): libbpf: fix sym_is_subprog() logic for weak global subprogs libbpf: never interpret subprogs in .text as entry programs selftests/bpf: fix test_spin_lock_fail.c's global vars usage libbpf: move global data mmap()'ing into bpf_object__load() André Almeida (1): unicode: Fix utf8_load() error path Andy Shevchenko (9): regmap: irq: Set lockdep class for hierarchical IRQ domains drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices mfd: intel_soc_pmic_bxtwc: Fix IRQ domain names duplication cpufreq: loongson3: Check for error code from devm_mutex_init() call gpio: zevio: Add missed label initialisation x86/Documentation: Update algo in init_size description of boot protocol Angelo Dureghello (2): iio: dac: adi-axi-dac: fix wrong register bitfield dt-bindings: iio: dac: ad3552r: fix maximum spi speed AngeloGioacchino Del Regno (1): arm64: dts: mediatek: Add ADC node on MT6357, MT6358, MT6359 PMICs Anjaneyulu (1): wifi: iwlwifi: mvm: SAR table alignment Antonio Quartulli (1): m68k: coldfire/device.c: only build FEC when HW macros are defined Anurag Dutta (3): arm64: dts: ti: k3-j7200: Fix clock ids for MCSPI instances arm64: dts: ti: k3-j721e: Fix clock IDs for MCSPI instances arm64: dts: ti: k3-j721s2: Fix clock IDs for MCSPI instances Ard Biesheuvel (1): x86/pvh: Call C code via the kernel virtual mapping Arnaldo Carvalho de Melo (1): perf ftrace latency: Fix unit on histogram first entry when using --use-nsec Arnd Bergmann (3): x86/amd_nb: Fix compile-testing without CONFIG_AMD_NB wifi: ath12k: fix one more memcpy size error serial: amba-pl011: fix build regression Artem Sadovnikov (1): jfs: xattr: check invalid xattr size more strictly Aurabindo Pillai (1): drm/amd/display: fix a memleak issue when driver is removed Avihai Horon (1): vfio/pci: Properly hide first-in-list PCIe extended capability Balaji Pothunoori (1): wifi: ath11k: Fix CE offset address calculation for WCN6750 in SSR Baochen Qiang (2): wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss1 wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss2 Baolin Liu (1): scsi: target: Fix incorrect function name in pscsi_create_type_disk() Barnabás Czémán (1): power: supply: bq27xxx: Fix registers of bq27426 Bart Van Assche (3): scsi: sg: Enable runtime power management power: supply: core: Remove might_sleep() from power_supply_put() blk-mq: Make blk_mq_quiesce_tagset() hold the tag list mutex less long Bartosz Golaszewski (4): mmc: mmc_spi: drop buggy snprintf() power: sequencing: make the QCom PMU pwrseq driver depend on CONFIG_OF pinctrl: zynqmp: drop excess struct member description lib: string_helpers: silence snprintf() output truncation warning Baruch Siach (1): doc: rcu: update printed dynticks counter bits Ben Greear (2): wifi: mac80211: Fix setting txpower with emulate_chanctx mac80211: fix user-power when emulating chanctx Benjamin Coddington (3): SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT nfs/blocklayout: Don't attempt unregister for invalid block device nfs/blocklayout: Limit repeat device registration on failure Benjamin Große (1): usb: add support for new USB device ID 0x17EF:0x3098 for the r8152 driver Benjamin Peterson (3): perf trace: avoid garbage when not printing a trace event's arguments perf trace: Do not lose last events in a race perf trace: Avoid garbage when not printing a syscall's arguments Benoît Monin (1): net: usb: qmi_wwan: add Quectel RG650V Benoît Sevens (1): ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices Biju Das (2): mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE clk: renesas: rzg2l: Fix FOUTPOSTDIV clk Bill O'Donnell (1): efs: fix the efs new mount api implementation Bin Liu (1): serial: 8250: omap: Move pm_runtime_get_sync Bingbu Cao (1): media: ipu6: not override the dma_ops of device in driver Björn Töpel (1): riscv: kvm: Fix out-of-bounds array access Breno Leitao (4): ipmr: Fix access to mfc_cache_list without lock held spi: tegra210-quad: Avoid shift-out-of-bounds netpoll: Use rcu_access_pointer() in netpoll_poll_lock nvme/multipath: Fix RCU list traversal to use SRCU primitive Cabiddu, Giovanni (1): crypto: qat - remove check after debugfs_create_dir() Carl Vanderlip (1): bus: mhi: host: Switch trace_mhi_gen_tre fields to native endian Carlos Llamas (1): Revert "scripts/faddr2line: Check only two symbols when calculating symbol size" Chao Yu (6): f2fs: fix to account dirty data in __get_secs_required() f2fs: fix to avoid potential deadlock in f2fs_record_stop_reason() f2fs: fix to map blocks correctly for direct write f2fs: fix to avoid forcing direct write to use buffered IO on inline_data inode f2fs: fix to do cast in F2FS_{BLK_TO_BYTES, BTYES_TO_BLK} to avoid overflow f2fs: fix to do sanity check on node blkaddr in truncate_node() Charles Han (5): soc: qcom: Add check devm_kasprintf() returned value clk: clk-apple-nco: Add NULL check in applnco_probe phy: realtek: usb: fix NULL deref in rtk_usb2phy_probe phy: realtek: usb: fix NULL deref in rtk_usb3phy_probe ASoC: imx-audmix: Add NULL check in imx_audmix_probe Chen Ridong (4): crypto: caam - add error check to caam_rsa_set_priv_key_form crypto: bcm - add error check in the ahash_hmac_init function Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline" cgroup/bpf: only cgroup v2 can be attached by bpf programs Chen Yufan (1): drm/imagination: Convert to use time_before macro Chen-Yu Tsai (5): scripts/kernel-doc: Do not track section counter across processed files arm64: dts: mediatek: mt8173-elm-hana: Add vdd-supply to second source trackpad arm64: dts: mediatek: mt8183-kukui-jacuzzi: Fix DP bridge supply names arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add supplies for fixed regulators arm64: dts: mediatek: mt8186-corsola-voltorb: Merge speaker codec nodes Cheng Ming Lin (1): mtd: spi-nor: core: replace dummy buswidth from addr to data Chengchang Tang (2): RDMA/core: Provide rdma_user_mmap_disassociate() to disassociate mmap pages RDMA/hns: Disassociate mmap pages for all uctx when HW is being reset ChiYuan Huang (2): power: supply: rt9471: Fix wrong WDT function regfield declaration power: supply: rt9471: Use IC status regfield to report real charger status Chris Lu (1): Bluetooth: btmtk: adjust the position to init iso data anchor Chris Morgan (1): arm64: dts: rockchip: correct analog audio name on Indiedroid Nova Christian Brauner (1): Revert "fs: don't block i_writecount during exec" Christian Loehle (1): sched/cpufreq: Ensure sd is rebuilt for EAS check Christoph Hellwig (9): nvme-pci: fix freeing of the HMB descriptor table block: constify the lim argument to queue_limits_max_zone_append_sectors block: properly handle REQ_OP_ZONE_APPEND in __bio_split_to_limits block: take chunk_sectors into account in bio_split_write_zeroes block: fix bio_split_rw_at to take zone_write_granularity into account nvme-pci: reverse request order in nvme_queue_rqs virtio_blk: reverse request order in virtio_queue_rqs kfifo: don't include dma-mapping.h in kfifo.h block: return unsigned int from bdev_io_min Christophe JAILLET (4): crypto: caam - Fix the pointer passed to caam_qi_shutdown() crypto: cavium - Fix an error handling path in cpt_ucode_load_fw() media: i2c: vgxy61: Fix an error handling path in vgxy61_detect() iio: light: al3010: Fix an error handling path in al3010_probe() Christophe Leroy (1): powerpc/vdso: Flag VDSO64 entry points as functions Chuck Lever (5): svcrdma: Address an integer overflow NFSD: Prevent NULL dereference in nfsd4_process_cb_update() NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir() NFSD: Fix nfsd4_shutdown_copy() NFSD: Prevent a potential integer overflow Chun-Tse Shao (1): perf/arm-smmuv3: Fix lockdep assert in ->event_init() Clark Wang (1): pwm: imx27: Workaround of the pwm output bug when decrease the duty cycle Claudiu Beznea (2): ASoC: da7213: Populate max_register to regmap_config serial: sh-sci: Clean sci_ports[0] after at earlycon exit Colin Ian King (1): media: i2c: ds90ub960: Fix missing return check on ub960_rxport_read call Cristian Marussi (1): firmware: arm_scmi: Reject clear channel request on A2P Csókás, Bence (1): spi: atmel-quadspi: Fix register name in verbose logging function Damien Le Moal (1): block: Prevent potential deadlock in blk_revalidate_disk_zones() Dan Carpenter (8): crypto: qat/qat_420xx - fix off by one in uof_get_name() crypto: qat/qat_4xxx - fix off by one in uof_get_name() soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() kunit: skb: use "gfp" variable instead of hardcoding GFP_KERNEL mailbox: arm_mhuv2: clean up loop in get_irq_chan_comb() usb: typec: fix potential array underflow in ucsi_ccg_sync_control() cifs: unlock on error in smb3_reconfigure() sh: intc: Fix use-after-free bug in register_intc_controller() Daniel Gabay (1): wifi: iwlwifi: mvm: Use the sync timepoint API in suspend Daniel Lezcano (2): tools/lib/thermal: Make more generic the command encoding function thermal/lib: Fix memory leak on error in thermal_genl_auto() Daniel Palmer (2): m68k: mvme147: Fix SCSI controller IRQ numbers m68k: mvme147: Reinstate early console Daolong Zhu (4): arm64: dts: mt8183: fennel: add i2c2's i2c-scl-internal-delay-ns arm64: dts: mt8183: burnet: add i2c2's i2c-scl-internal-delay-ns arm64: dts: mt8183: cozmo: add i2c2's i2c-scl-internal-delay-ns arm64: dts: mt8183: Damu: add i2c2's i2c-scl-internal-delay-ns Dave Stevenson (7): drm/vc4: hvs: Don't write gamma luts on 2711 drm/vc4: hvs: Fix dlist debug not resetting the next entry pointer drm/vc4: hvs: Remove incorrect limit from hvs_dlist debugfs function drm/vc4: hvs: Correct logic on stopping an HVS channel drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_lut_load drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_atomic_flush drm/vc4: Correct generation check in vc4_hvs_lut_load David Disseldorp (1): initramfs: avoid filename buffer overrun David Laight (1): x86: fix off-by-one in access_ok() David Thompson (1): EDAC/bluefield: Fix potential integer overflow David Wang (1): proc/softirqs: replace seq_printf with seq_put_decimal_ull_width Dinesh Kumar (1): ALSA: hda/realtek: Fix Internal Speaker and Mic boost of Infinix Y4 Max Dipendra Khadka (6): octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c Dmitry Antipov (2): Bluetooth: fix use-after-free in device_for_each_child() ocfs2: fix uninitialized value in ocfs2_file_read_iter() Dmitry Baryshkov (7): arm64: dts: qcom: qcs6390-rb3gen2: use modem.mbn for modem DSP arm64: dts: qcom: sda660-ifc6560: fix l10a voltage ranges drm/msm/dpu: on SDM845 move DSPP_3 to LM_5 block drm/msm/dpu: drop LM_3 / LM_4 on SDM845 drm/msm/dpu: drop LM_3 / LM_4 on MSM8998 remoteproc: qcom: pas: add minidump_id to SM8350 resources usb: typec: ucsi: glink: fix off-by-one in connector_status Dom Cobley (2): drm/vc4: hdmi: Avoid hang with debug registers when suspended drm/vc4: hdmi: Increase audio MAI fifo dreq threshold Dong Aisheng (1): clk: imx: clk-scu: fix clk enable state save and restore Dragan Simic (1): regulator: rk808: Restrict DVS GPIOs to the RK808 variant only Eduard Zingerman (1): selftests/bpf: Fix backtrace printing for selftests crashes Edward Adam Davis (1): USB: chaoskey: Fix possible deadlock chaoskey_list_lock Emmanuel Grumbach (2): wifi: iwlwifi: allow fast resume on ax200 wifi: iwlwifi: mvm: tell iwlmei when we finished suspending Eric Biggers (1): crypto: x86/aegis128 - access 32-bit arguments as 32-bit Eric Dumazet (1): net: hsr: fix hsr_init_sk() vs network/transport headers. Eryk Zagorski (1): ALSA: usb-audio: Fix Yamaha P-125 Quirk Entry Everest K.C (2): crypto: cavium - Fix the if condition to exit loop after timeout ASoC: rt722-sdca: Remove logically deadcode in rt722-sdca.c Fangzhi Zuo (3): drm/amd/display: Skip Invalid Streams from DSC Policy drm/amd/display: Fix incorrect DSC recompute trigger drm/amd/display: Reduce HPD Detection Interval for IPS Fei Shao (2): arm64: dts: mediatek: mt8188: Fix USB3 PHY port default status arm64: dts: mediatek: mt8195-cherry: Use correct audio codec DAI Felix Maurer (1): xsk: Free skb when TX metadata options are invalid Feng Fang (1): RDMA/hns: Fix different dgids mapping to the same dip_idx Filip Brozovic (1): serial: 8250_fintek: Add support for F81216E Florian Westphal (3): netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion netfilter: nf_tables: must hold rcu read lock while iterating expression type list netfilter: nf_tables: must hold rcu read lock while iterating object type list Francesco Zardi (1): rust: block: fix formatting of `kernel::block::mq::request` module Frank Li (2): arm64: dts: imx8mn-tqma8mqnl-mba8mx-usbot: fix coexistence of output-low and output-high in GPIO i3c: master: Remove i3c_dev_disable_ibi_locked(olddev) on device hotjoin Gao Xiang (1): erofs: handle NONHEAD !delta[1] lclusters gracefully Gaosheng Cui (2): drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend() firmware_loader: Fix possible resource leak in fw_log_firmware_info() Gautam Menghani (3): KVM: PPC: Book3S HV: Stop using vc->dpdes for nested KVM guests KVM: PPC: Book3S HV: Avoid returning to nested hypervisor on pending doorbells powerpc/pseries: Fix KVM guest detection for disabling hardlockup detector Gautham R. Shenoy (1): amd-pstate: Set min_perf to nominal_perf for active mode performance gov Geert Uytterhoeven (1): ASoC: fsl-asoc-card: Add missing handling of {hp,mic}-dt-gpios Gerd Bayer (1): s390/facilities: Fix warning about shadow of global variable Greg Kroah-Hartman (3): Revert "exec: don't WARN for racy path_noexec check" Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit" Linux 6.11.11 Gregory Price (1): tpm: fix signed/unsigned bug when checking event logs Guenter Roeck (1): net: microchip: vcap: Add typegroup table terminators in kunit tests Guilherme G. Piccoli (1): wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures Gustavo A. R. Silva (4): wifi: radiotap: Avoid -Wflex-array-member-not-at-end warnings integrity: Use static_assert() to check struct sizes clk: clk-loongson2: Fix memory corruption bug in struct loongson2_clk_provider clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access Hangbin Liu (3): netdevsim: copy addresses for both in and out paths wireguard: selftests: load nf_conntrack if not present net/ipv6: delete temporary address if mngtmpaddr is removed or unmanaged Hannes Reinecke (1): nvme-multipath: avoid hang on inaccessible namespaces Hans Verkuil (1): media: v4l2-core: v4l2-dv-timings: check cvt/gtf result Hans de Goede (6): ASoC: codecs: rt5640: Always disable IRQs from rt5640_cancel_work() ASoC: Intel: bytcr_rt5640: Add support for non ACPI instantiated codec ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet ASoC: Intel: sst: Support LPE0F28 ACPI HID drm: panel-orientation-quirks: Make Lenovo Yoga Tab 3 X90F DMI match less strict ASoC: Intel: sst: Fix used of uninitialized ctx to log an error Hao Ge (1): isofs: avoid memory leak in iocharset Hari Bathini (1): powerpc/fadump: allocate memory for additional parameters early Hariprasad Kelam (5): octeontx2-af: RPM: Fix mismatch in lmac type octeontx2-af: RPM: Fix low network performance octeontx2-af: RPM: fix stale RSFEC counters octeontx2-af: RPM: fix stale FCFEC counters octeontx2-af: Quiesce traffic before NIX block reset Harith G (1): ARM: 9420/1: smp: Fix SMP for xip kernels Harshit Mogalapalli (1): dax: delete a stale directory pmem Heiko Carstens (1): s390/pageattr: Implement missing kernel_page_present() Heiko Stuebner (1): arm64: dts: rockchip: Remove 'enable-active-low' from two boards Henrique Carvalho (1): smb: client: disable directory caching when dir_cache_timeout is zero Hou Tao (1): virtiofs: use pages instead of pointer for kernel direct IO Howard Chu (1): perf trace: Fix tracing itself, creating feedback loops Hsin-Te Yuan (2): arm64: dts: mt8183: krane: Fix the address of eeprom at i2c4 arm64: dts: mt8183: kukui: Fix the address of eeprom at i2c4 Huacai Chen (3): LoongArch: For all possible CPUs setup logical-physical CPU mapping LoongArch: Explicitly specify code model in Makefile sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK Huan Yang (2): udmabuf: change folios array from kmalloc to kvmalloc udmabuf: fix vmap_udmabuf error page set Hubert Wiśniewski (1): usb: musb: Fix hardware lockup on first Rx endpoint request Ian Rogers (2): perf stat: Fix affinity memory leaks on error path perf probe: Fix libdw memory leak Igor Prusov (1): dt-bindings: vendor-prefixes: Add NeoFidelity, Inc Igor Pylypiv (1): i2c: dev: Fix memory leak when underlying adapter does not support I2C Ilpo Järvinen (1): PCI: cpqphp: Fix PCIBIOS_* return value confusion Ilya Zverev (1): ASoC: amd: yc: Add a quirk for microfone on Lenovo ThinkPad P14s Gen 5 21MES00B00 Iulia Tanasescu (3): Bluetooth: ISO: Do not emit LE PA Create Sync if previous is pending Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending Bluetooth: ISO: Send BIG Create Sync via hci_sync Jacob Keller (1): ice: consistently use q_idx in ice_vc_cfg_qs_msg() Jaegeuk Kim (1): Revert "f2fs: remove unreachable lazytime mount option parsing" Jakub Kicinski (3): eth: fbnic: don't disable the PCI device twice netlink: fix false positive warning in extack during dumps net_sched: sch_fq: don't follow the fast path if Tx is behind now James Clark (1): perf cs-etm: Don't flush when packet_queue fills up Jan Hendrik Farr (1): Compiler Attributes: disable __counted_by for clang < 19.1.3 Jan Kara (1): ext4: avoid remount errors with 'abort' mount option Jann Horn (2): fsnotify: Fix ordering of iput() and watched_objects decrement comedi: Flush partial mappings in error case Jared McArthur (1): arm64: dts: ti: k3-j7200: Fix register map for main domain pmx Jason Andryuk (1): x86/pvh: Set phys_base when calling xen_prepare_pvh() Jason Gerecke (1): HID: wacom: Interpret tilt data from Intuos Pro BT as signed values Jason Gunthorpe (5): iommu/amd: Remove amd_iommu_domain_update() from page table freeing iommu/amd: Remove the amd_iommu_domain_set_pt_root() and related iommu/amd: Rename struct amd_io_pgtable iopt to pgtbl iommu/amd: Store the nid in io_pgtable_cfg instead of the domain iommu/amd: Narrow the use of struct protection_domain to invalidation Javier Carrasco (10): usb: typec: use cleanup facility for 'altmodes_node' clocksource/drivers/timer-ti-dm: Fix child node refcount handling Bluetooth: btbcm: fix missing of_node_put() in btbcm_get_board_name() leds: max5970: Fix unreleased fwnode_handle in probe function wifi: brcmfmac: release 'root' node in all execution paths platform/chrome: cros_ec_typec: fix missing fwnode reference decrement mtd: ubi: fix unreleased fwnode_handle in find_volume_fwnode() soc: fsl: rcpm: fix missing of_node_put() in copy_ippdexpcr1_setting() staging: vchiq_arm: Fix missing refcount decrement in error path for fw_node counter: stm32-timer-cnt: fix device_node handling in probe_encoder() Jean-Michel Hautbois (1): m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x Jean-Philippe Romain (1): perf list: Fix topic and pmu_name argument order Jeff Layton (1): nfsd: drop inode parameter from nfsd4_change_attribute() Jeongjun Park (4): wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read() ext4: supress data-race warnings in ext4_free_inodes_{count,set}() netfilter: ipset: add missing range check in bitmap_ip_uadt Jerome Brunet (1): hwmon: (pmbus/core) clear faults after setting smbalert mask Jesse Taube (2): RISC-V: Scalar unaligned access emulated on hotplug CPUs RISC-V: Check scalar unaligned access on all CPUs Jiasheng Jiang (2): counter: stm32-timer-cnt: Add check for clk_enable() counter: ti-ecap-capture: Add check for clk_enable() Jiawen Wu (2): net: txgbe: remove GPIO interrupt controller net: txgbe: fix null pointer to pcs Jiayuan Chen (2): bpf: fix filed access without lock bpf: fix recursive lock when verdict program return SK_PASS Jie Zhan (1): cppc_cpufreq: Use desired perf if feedback ctrs are 0 or unchanged Jing Zhang (1): KVM: arm64: vgic-its: Add a data length check in vgic_its_save_* Jinjie Ruan (17): spi: spi-fsl-lpspi: Use IRQF_NO_AUTOEN flag in request_irq() soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq() spi: zynqmp-gqspi: Undo runtime PM changes at driver exit time wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq() wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq() drm/imx/dcss: Use IRQF_NO_AUTOEN flag in request_irq() drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq() drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq() mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw() cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost() cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_cost() cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_power() misc: apds990x: Fix missing pm_runtime_disable() apparmor: test: Fix memory leak for aa_unpack_strdup() cpufreq: mediatek-hw: Fix wrong return value in mtk_cpufreq_get_cpu_power() rtc: st-lpc: Use IRQF_NO_AUTOEN flag in request_irq() Jiri Olsa (2): bpf: Allow return values 0 and 1 for kprobe session bpf: Force uprobe bpf program to always return 0 Joe Damato (1): netdev-genl: Hold rcu_read_lock in napi_get Joe Hattori (2): remoteproc: qcom: pas: Remove subdevs on the error path of adsp_probe() remoteproc: qcom: adsp: Remove subdevs on the error path of adsp_probe() Johan Hovold (1): pinctrl: qcom: spmi: fix debugfs drive strength John Garry (3): block/fs: Pass an iocb to generic_atomic_write_valid() fs/block: Check for IOCB_DIRECT in generic_atomic_write_valid() block: Don't allow an atomic write be truncated in blkdev_write_iter() John Watts (1): ASoC: audio-graph-card2: Purge absent supplies for device tree nodes Jonas Gorski (1): mips: asm: fix warning when disabling MIPS_FP_SUPPORT Jonathan Gray (1): drm: use ATOMIC64_INIT() for atomic64_t Jonathan Marek (3): efi/libstub: fix efi_parse_options() ignoring the default command line clk: qcom: videocc-sm8550: depend on either gcc-sm8550 or gcc-sm8650 rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length Jose Ignacio Tornos Martinez (2): wifi: ath12k: fix warning when unbinding wifi: ath12k: fix crash when unbinding Josh Poimboeuf (1): parisc/ftrace: Fix function graph tracing disablement José Expósito (1): drm/vkms: Drop unnecessary call to drm_crtc_cleanup() Junxian Huang (3): RDMA/hns: Use dev_* printings in hem code instead of ibdev_* RDMA/hns: Fix out-of-order issue of requester when setting FENCE RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg() Kailang Yang (3): ALSA: hda/realtek: Update ALC256 depop procedure ALSA: hda/realtek: Update ALC225 depop procedure ALSA: hda/realtek: Set PCBeep to default value for ALC274 Kajol Jain (1): KVM: PPC: Book3S HV: Fix kmv -> kvm typo Kalle Valo (1): Revert "wifi: iwlegacy: do not skip frames with bad FCS" Karol Wachowski (1): accel/ivpu: Prevent recovery invocation during probe and resume Karthikeyan Periyasamy (1): wifi: cfg80211: check radio iface combination for multi radio per wiphy Kartik Rajput (1): serial: amba-pl011: Fix RX stall when DMA is used Kashyap Desai (1): RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey Keita Morisaki (1): devres: Fix page faults when tracing devres from unloaded modules Kiran K (2): Bluetooth: btintel_pcie: Add handshake between driver and firmware Bluetooth: btintel: Do no pass vendor events to stack Kirill A. Shutemov (3): x86/tdx: Introduce wrappers to read and write TD metadata x86/tdx: Rename tdx_parse_tdinfo() to tdx_setup() x86/tdx: Dynamically disable SEPT violations from causing #VEs Konrad Dybcio (2): arm64: dts: qcom: x1e80100: Update C4/C5 residency/exit numbers arm64: dts: qcom: sc8180x: Add a SoC-specific compatible to cpufreq-hw Kristina Martsenko (1): arm64: probes: Disable kprobes/uprobes on MOPS instructions Krzysztof Kozlowski (1): dt-bindings: pinctrl: samsung: Fix interrupt constraint for variants with fallbacks Kuangyi Chiang (4): xhci: Fix control transfer error on Etron xHCI host xhci: Combine two if statements for Etron xHCI host xhci: Don't perform Soft Retry for Etron xHCI host xhci: Don't issue Reset Device command to Etron xHCI host Kui-Feng Lee (1): selftests/bpf: netns_new() and netns_free() helpers. Kumar Kartikeya Dwivedi (2): bpf: Tighten tail call checks for lingering locks, RCU, preempt_disable bpf: Mark raw_tp arguments with PTR_MAYBE_NULL Kuniyuki Iwashima (1): tcp: Fix use-after-free of nreq in reqsk_timer_handler(). Kunkun Jiang (2): KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device Kurt Borja (2): platform/x86: dell-smbios-base: Extends support to Alienware products platform/x86: dell-wmi-base: Handle META key Lock/Unlock events Lad Prabhakar (2): arm64: dts: renesas: hihope: Drop #sound-dai-cells pinctrl: renesas: Select PINCTRL_RZG2L for RZ/V2H(P) SoC Leo Yan (1): perf probe: Correct demangled symbols in C++ program Leon Hwang (1): bpf, bpftool: Fix incorrect disasm pc Levi Yun (2): trace/trace_event_perf: remove duplicate samples on the first tracepoint event perf stat: Close cork_fd when create_perf_stat_counter() failed Li Huafei (5): crypto: inside-secure - Fix the return value of safexcel_xcbcmac_cra_init() media: atomisp: Add check for rgby_data memory allocation failure drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new() drm/amdgpu: Fix the memory allocation issue in amdgpu_discovery_get_nps_info() perf disasm: Use disasm_line__free() to properly free disasm_line Li Lingfeng (1): nfs: ignore SB_RDONLY when mounting nfs Li Wang (1): loop: fix type of block size Li Zhijian (1): selftests/watchdog-test: Fix system accidentally reset after watchdog-test Lifeng Zheng (1): ACPI: CPPC: Fix _CPC register setting issue Lijo Lazar (2): drm/amdgpu: Fix JPEG v4.0.3 register write drm/amdgpu: Fix map/unmap queue logic Lingbo Kong (1): wifi: cfg80211: Remove the Medium Synchronization Delay validity check Linus Walleij (3): ARM: 9434/1: cfi: Fix compilation corner case drm/panel: nt35510: Make new commands optional wifi: cw1200: Fix potential NULL dereference Liu Jian (3): RDMA/rxe: Set queue pair cur_qp_state when being queried sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket Long Li (2): ext4: fix race in buffer_head read fault injection f2fs: fix race in concurrent f2fs_stop_gc_thread LongPing Wei (1): f2fs: fix the wrong f2fs_bug_on condition in f2fs_do_replace_block Lorenzo Bianconi (8): clk: en7523: remove REG_PCIE*_{MEM,MEM_MASK} configuration clk: en7523: move clock_register in hw_init callback clk: en7523: introduce chip_scu regmap clk: en7523: fix estimation of fixed rate for EN7581 phy: airoha: Fix REG_CSR_2L_PLL_CMN_RESERVE0 config in airoha_pcie_phy_init_clk_out() phy: airoha: Fix REG_PCIE_PMA_TX_RESET config in airoha_pcie_phy_init_csr_2l() phy: airoha: Fix REG_CSR_2L_JCPLL_SDM_HREN config in airoha_pcie_phy_init_ssc_jcpll() phy: airoha: Fix REG_CSR_2L_RX{0,1}_REV0 definitions Luca Weiss (1): arm64: dts: qcom: sm6350: Fix GPU frequencies missing on some speedbins Lucas Stach (1): drm/etnaviv: hold GPU lock across perfmon sampling Luiz Augusto von Dentz (3): Bluetooth: ISO: Use kref to track lifetime of iso_conn Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync Bluetooth: MGMT: Fix possible deadlocks Lukas Bulwahn (1): clk: mediatek: drop two dead config options Lukas Wunner (1): PCI: Fix use-after-free of slot->bus on hot remove Lukasz Luba (1): drm/msm/gpu: Check the status of registration to PM QoS Luo Qiu (1): firmware: arm_scpi: Check the DVFS OPP count returned by the firmware Luo Yifan (2): ASoC: stm: Prevent potential division by zero in stm32_sai_mclk_round_rate() ASoC: stm: Prevent potential division by zero in stm32_sai_get_clk_div() Ma Wupeng (1): ipc: fix memleak if msg_init_ns failed in create_ipc_ns Macpaul Lin (5): arm64: dts: mediatek: mt8395-genio-1200-evk: Fix dtbs_check error for phy arm64: dts: mt8195: Fix dtbs_check error for mutex node arm64: dts: mt8195: Fix dtbs_check error for infracfg_ao node arm64: dts: mediatek: mt6358: fix dtbs_check error ASoC: dt-bindings: mt6359: Update generic node name and dmic-mode Manikanta Mylavarapu (1): soc: qcom: socinfo: fix revision check in qcom_socinfo_probe() Manivannan Sadhasivam (2): PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert() PCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert() Marc Zyngier (2): arm64: Expose ID_AA64ISAR1_EL1.XS to sanitised feature consumers KVM: arm64: vgic-v3: Sanitise guest writes to GICR_INVLPIR Marco Elver (2): kcsan, seqlock: Support seqcount_latch_t kcsan, seqlock: Fix incorrect assumption in read_seqbegin() Marcus Folkesson (1): mfd: da9052-spi: Change read-mask to write-mask Marek Vasut (1): wifi: wilc1000: Set MAC after operation mode Mario Limonciello (1): cpufreq/amd-pstate: Don't update CPPC request in amd_pstate_cpu_boost_update() Mark Brown (3): ASoC: max9768: Fix event generation for playback mute kselftest/arm64: Fix encoding for SVE B16B16 test clocksource/drivers:sp804: Make user selectable Markus Petri (1): ASoC: amd: yc: Support dmic on another model of Lenovo Thinkpad E14 Gen 6 Martin Kaistra (1): wifi: rtl8xxxu: Perform update_beacon_work when beaconing is enabled Masahiro Yamada (5): arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG s390/syscalls: Avoid creation of arch/arch/ directory Rename .data.unlikely to .data..unlikely Rename .data.once to .data..once to fix resetting WARN*_ONCE modpost: remove incorrect code in do_eisa_entry() Matt Coster (1): drm/imagination: Use pvr_vm_context_get() Matt Fleming (1): kbuild: deb-pkg: Don't fail if modules.order is missing Matthew Rosato (1): iommu/s390: Implement blocking domain Matthew Wilcox (Oracle) (2): ext4: pipeline buffer reads in mext_page_mkuptodate() ext4: remove array of buffer_heads from mext_page_mkuptodate() Matthias Schiffer (1): drm: fsl-dcu: enable PIXCLK on LS1021A Matti Vaittinen (4): irqdomain: Simplify simple and legacy domain creation irqdomain: Allow giving name suffix for domain regmap: Allow setting IRQ domain name suffix irqdomain: Always associate interrupts for legacy domains Maurice Lambert (1): netlink: typographical error in nlmsg_type constants definition Maxime Chevallier (2): net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken rtc: ab-eoz9: don't fail temperature reads on undervoltage notification Maxime Ripard (1): drm/vc4: Introduce generation number enum Maíra Canal (2): drm/v3d: Address race-condition in MMU flush drm/v3d: Flush the MMU before we supply more memory to the binner Meetakshi Setiya (1): cifs: support mounting with alternate password to allow password rotation Michael Chan (2): bnxt_en: Refactor bnxt_ptp_init() bnxt_en: Unregister PTP during PCI shutdown and suspend Michael Ellerman (2): powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore selftests/mount_setattr: Fix failures on 64K PAGE_SIZE kernels Michael Grzeschik (1): usb: gadget: uvc: wake pump everytime we update the free list Michael Petlan (1): perf trace: Keep exited threads for summary Michal Luczaj (2): llc: Improve setsockopt() handling of malformed user input rxrpc: Improve setsockopt() handling of malformed user input Michal Pecio (3): usb: xhci: Limit Stop Endpoint retries usb: xhci: Fix TD invalidation under pending Set TR Dequeue usb: xhci: Avoid queuing redundant Stop Endpoint commands Michal Schmidt (1): rcu/srcutiny: don't return before reenabling preemption Michal Simek (2): microblaze: Export xmb_manager functions dt-bindings: serial: rs485: Fix rs485-rts-delay property Michal Suchanek (1): powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static Michal Vrastil (1): Revert "usb: gadget: composite: fix OS descriptors w_value logic" Miguel Ojeda (2): time: Partially revert cleanup on msecs_to_jiffies() documentation time: Fix references to _msecs_to_jiffies() handling of values Mikhail Rudenko (1): regulator: rk808: Add apply_bit for BUCK3 on RK809 Mikulas Patocka (3): dm-cache: fix warnings about duplicate slab caches dm-bufio: fix warnings about duplicate slab caches blk-settings: round down io_opt to physical_block_size Min-Hua Chen (1): regulator: qcom-smd: make smd_vreg_rpm static Ming Lei (6): ublk: fix ublk_ch_mmap() for 64K page size ublk: fix error code for unsupported command blk-mq: add non_owner variant of start_freeze/unfreeze queue APIs block: model freeze & enter queue as lock for supporting lockdep block: always verify unfreeze lock on the owner task block: don't verify IO lock for freeze/unfreeze in elevator_init_mq() Mingwei Zheng (1): net: rfkill: gpio: Add check for clk_enable() Miquel Raynal (1): mtd: rawnand: atmel: Fix possible memory leak Mirsad Todorovac (1): fs/proc/kcore.c: fix coccinelle reported ERROR instances Muchun Song (3): block: fix missing dispatching request when queue is started or unquiesced block: fix ordering between checking QUEUE_FLAG_QUIESCED request adding block: fix ordering between checking BLK_MQ_S_STOPPED request adding Murad Masimov (1): hwmon: (tps23861) Fix reporting of negative temperatures Namhyung Kim (1): perf/arm-cmn: Ensure port and device id bits are set properly Namjae Jeon (1): exfat: fix uninit-value in __exfat_get_dentry_set Nathan Morrisson (1): arm64: dts: ti: k3-am62x-phyboard-lyra: Drop unnecessary McASP AFIFOs Nicolas Bouchinet (1): tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler Niklas Schnelle (2): watchdog: Add HAS_IOPORT dependency for SBC8360 and SBC7240 s390/pci: Fix potential double remove of hotplug slot Nilay Shroff (1): nvme-fabrics: fix kernel crash while shutting down controller Nirmoy Das (1): drm/xe/ufence: Wake up waiters after setting ufence->signalled Nobuhiro Iwamatsu (1): rtc: abx80x: Fix WDT bit position of the status register Nuno Sa (2): dt-bindings: clock: axi-clkgen: include AXI clk clk: clk-axi-clkgen: make sure to enable the AXI bus clock Nícolas F. R. A. Prado (1): ASoC: mediatek: Check num_codecs is not zero to avoid panic during probe Oleksij Rempel (3): net: usb: lan78xx: Fix double free issue with interrupt buffer allocation net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration Oliver Neukum (2): usb: yurex: make waiting on yurex_write interruptible USB: chaoskey: fail open after removal Oliver Upton (1): KVM: arm64: Don't retire aborted MMIO instruction Omid Ehtemam-Haghighi (1): ipv6: Fix soft lockups in fib6_select_path under high next hop churn Orange Kao (1): EDAC/igen6: Avoid segmentation fault on module unload Pablo Sun (1): arm64: dts: mediatek: mt8188: Fix wrong clock provider in MFG1 power domain Pali Rohár (2): cifs: Fix parsing native symlinks relative to the export cifs: Fix parsing reparse point with native symlink in SMB1 non-UNICODE session Paolo Abeni (4): ipv6: release nexthop on device removal selftests: net: really check for bg process completion ip6mr: fix tables suspicious RCU usage ipmr: fix tables suspicious RCU usage Paolo Bonzini (2): rust: macros: fix documentation of the paste! macro KVM: x86: switch hugepage recovery thread to vhost_task Patrisious Haddad (1): RDMA/mlx5: Move events notifier registration to be after device registration Patryk Wlazlyn (1): tools/power turbostat: Fix child's argument forwarding Paul Aurich (5): smb: cached directories can be more than root file handle smb: Don't leak cfid when reconnect races with open_cached_dir smb: prevent use-after-free due to open_cached_dir error paths smb: During unmount, ensure all cached dir instances drop their dentry smb: Initialize cfid->tcon before performing network ops Paulo Alcantara (2): smb: client: fix NULL ptr deref in crypto_aead_setkey() smb: client: handle max length for SMB symlinks Pavan Chebbi (1): tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets Pavel Begunkov (2): io_uring: fix corner case forgetting to vunmap io_uring: check for overflows in io_pin_pages Pei Xiao (2): hwmon: (nct6775-core) Fix overflows seen when writing limit attributes wifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg() Peng Fan (3): clk: imx: lpcg-scu: SW workaround for errata (e10858) clk: imx: fracn-gppll: correct PLL initialization flow clk: imx: fracn-gppll: fix pll power up Peter Große (1): i40e: Fix handling changed priv flags Philo Lu (2): bpf: Support __nullable argument suffix for tp_btf selftests/bpf: Add test for __nullable suffix in tp_btf Pin-yen Lin (2): drm/bridge: anx7625: Drop EDID cache on bridge power off drm/bridge: it6505: Drop EDID cache on bridge power off Piyush Raj Chouhan (1): ALSA: hda/realtek: Add subwoofer quirk for Infinix ZERO BOOK 13 Priyanka Singh (1): EDAC/fsl_ddr: Fix bad bit shift operations Qi Han (1): f2fs: compress: fix inconsistent update of i_blocks in release_compress_blocks and reserve_compress_blocks Qingfang Deng (1): jffs2: fix use of uninitialized variable Qiu-ji Chen (3): xen: Fix the issue of resource not being properly released in xenbus_dev_probe() ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata() media: wl128x: Fix atomicity violation in fmc_send_cmd() Qiuxu Zhuo (2): EDAC/skx_common: Differentiate memory error sources EDAC/{skx_common,i10nm}: Fix incorrect far-memory error source indicator Rafael J. Wysocki (6): thermal: core: Initialize thermal zones before registering them thermal: core: Drop thermal_zone_device_is_enabled() thermal: core: Rearrange PM notification code thermal: core: Represent suspend-related thermal zone flags as bits thermal: core: Mark thermal zones as initializing to start with thermal: core: Fix race between zone registration and system suspend Raghavendra Rao Ananta (2): KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status KVM: arm64: Get rid of userspace_irqchip_in_use Rameshkumar Sundaram (1): wifi: ath12k: fix use-after-free in ath12k_dp_cc_cleanup() Ramya Gnanasekar (1): wifi: ath12k: Skip Rx TID cleanup for self peer Randy Dunlap (2): kernel-doc: allow object-like macros in ReST output fs_parser: update mount_api doc to match function signature Raviteja Laggyshetty (1): interconnect: qcom: icc-rpmh: probe defer incase of missing QoS clock dependency Raymond Hackley (1): leds: ktd2692: Set missing timing properties Reinette Chatre (3): selftests/resctrl: Print accurate buffer size as part of MBM results selftests/resctrl: Fix memory overflow due to unhandled wraparound selftests/resctrl: Protect against array overrun during iMC config parsing Remi Pommarel (2): wifi: cfg80211: Add wiphy_delayed_work_pending() wifi: mac80211: Convert color collision detection to wiphy work Renato Caldas (1): platform/x86: ideapad-laptop: add missing Ideapad Pro 5 fn keys Ritesh Harjani (IBM) (3): powerpc/fadump: Refactor and prepare fadump_cma_init for late init powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init() powerpc/mm/fault: Fix kfence page fault reporting Roman Li (1): drm/amd/display: Increase idle worker HPD detection time Rosen Penev (1): net: mdio-ipq4019: add missing error check Russell King (Oracle) (1): irqchip/irq-mvebu-sei: Move misplaced select() callback to SEI CP domain Ryan Walklin (1): drm: panel: nv3052c: correct spi_device_id for RG35XX panel Sabyrzhan Tasbolatov (1): kasan: move checks to do_strncpy_from_user Sai Kumar Cholleti (1): gpio: exar: set value when external pull-up or pull-down is present Sakari Ailus (1): media: ipu6: Fix DMA and physical address debugging messages for 32-bit Saravanan Vajravel (1): bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down Sean Anderson (1): drm: zynqmp_kms: Unplug DRM device before removal Sean Christopherson (1): KVM: x86/mmu: Skip the "try unsync" path iff the old SPTE was a leaf SPTE Sebastian Andrzej Siewior (1): x86/CPU/AMD: Terminate the erratum_1386_microcode array Sergio Paracuellos (2): clk: ralink: mtmips: fix clock plan for Ralink SoC RT3883 clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs Shenghao Ding (1): ASoC: tas2781: Add new driver version for tas2563 & tas2781 qfn chip Shengjiu Wang (1): ASoC: fsl_micfil: fix regmap_write_bits usage Shravya KN (2): bnxt_en: Set backplane link modes correctly for ethtool bnxt_en: Fix receive ring space parameters when XDP is active Shyam Prasad N (1): cifs: during remount, make sure passwords are in sync Si-Wei Liu (1): vdpa/mlx5: Fix suboptimal range on iotlb iteration Sibi Sankar (2): arm64: dts: qcom: x1e80100: Resize GIC Redistributor register region remoteproc: qcom_q6v5_mss: Re-order writes to the IMEM region Siddharth Vadapalli (1): PCI: j721e: Deassert PERST# after a delay of PCIE_T_PVPERL_MS milliseconds Sidraya Jayagond (1): s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() Sourabh Jain (1): fadump: reserve param area if below boot_mem_top Stafford Horne (1): openrisc: Implement fixmap to fix earlycon Stanislaw Gruszka (4): spi: Fix acpi deferred irq probe media: intel/ipu6: do not handle interrupts when device is disabled usb: misc: ljca: set small runtime autosuspend delay usb: misc: ljca: move usb_autopm_put_interface() after wait for response Steffen Dirkwinkel (1): drm: xlnx: zynqmp_disp: layer may be null while releasing Steve French (1): smb3: request handle caching when caching directories Steven 'Steve' Kendall (1): drm/radeon: Fix spurious unplug event on radeon HDMI Steven Price (1): drm/panfrost: Remove unused id_mask from struct panfrost_model Suraj Kandpal (1): drm/xe/hdcp: Fix gsc structure check in fw check status Takahiro Kuwano (1): mtd: spi-nor: spansion: Use nor->addr_nbytes in octal DTR mode in RD_ANY_REG_OP Takashi Iwai (9): ALSA: usx2y: Use snd_card_free_when_closed() at disconnection ALSA: us122l: Use snd_card_free_when_closed() at disconnection ALSA: caiaq: Use snd_card_free_when_closed() at disconnection ALSA: 6fire: Release resources at card release ALSA: usb-audio: Fix out of bounds reads when finding clock sources ALSA: rawmidi: Fix kvfree() call in spinlock ALSA: ump: Fix evaluation of MIDI 1.0 FB info ALSA: pcm: Add sanity NULL check for the default mmap fault handler ALSA: hda/realtek: Apply quirk for Medion E15433 Tamir Duberstein (1): checkpatch: always parse orig_commit in fixes tag Tao Chen (1): libbpf: Fix expected_attach_type set handling in program load callback Thadeu Lima de Souza Cascardo (1): hfsplus: don't query the device logical block size multiple times Theodore Ts'o (1): ext4: fix FS_IOC_GETFSMAP handling Thinh Nguyen (3): usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED usb: dwc3: gadget: Fix checking for number of TRBs left usb: dwc3: gadget: Fix looping of queued SG entries Thomas Falcon (1): perf mem: Fix printing PERF_MEM_LVLNUM_{L2_MHB|MSC} Thomas Gleixner (1): irqdomain: Cleanup domain name allocation Thomas Richard (3): PCI: cadence: Extract link setup sequence from cdns_pcie_host_setup() PCI: cadence: Set cdns_pcie_host_init() global PCI: j721e: Use T_PERST_CLK_US macro Thomas Weißschuh (1): tools/nolibc: s390: include std.h Théo Lebrun (2): PCI: j721e: Add reset GPIO to struct j721e_pcie PCI: j721e: Add suspend and resume support Tiezhu Yang (2): LoongArch: Fix build failure with GCC 15 (-std=gnu23) LoongArch: BPF: Sign-extend return values Tiwei Bie (7): um: ubd: Do not use drvdata in release um: net: Do not use drvdata in release um: vector: Do not use drvdata in release um: Fix potential integer overflow during physmem setup um: Fix the return value of elf_core_copy_task_fpregs um: ubd: Initialize ubd's disk pointer in ubd_add um: Always dump trace for specified task in show_stack Todd Kjos (1): PCI: Fix reset_method_store() memory leak Tomas Glozar (1): rtla/timerlat: Do not set params->user_workload with -U Tomas Paukrt (1): crypto: mxs-dcp - Fix AES-CBC with hardware-bound keys Tomi Valkeinen (3): drm/omap: Fix possible NULL dereference drm/omap: Fix locking in omap_gem_new_dmabuf() drm/bridge: tc358767: Fix link properties discovery Tony Ambardar (1): libbpf: Fix output .symtab byte-order during linking Trond Myklebust (2): NFSv4.0: Fix a use-after-free problem in the asynchronous open() Revert "nfs: don't reuse partially completed requests in nfs_lock_and_join_requests" Tvrtko Ursulin (1): drm/v3d: Appease lockdep while updating GPU stats Uladzislau Rezki (Sony) (2): rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu rcuscale: Do a proper cleanup if kfree_scale_init() fails Uros Bizjak (3): cleanup: Remove address space of returned pointer locking/atomic/x86: Use ALT_OUTPUT_SP() for __alternative_atomic64() locking/atomic/x86: Use ALT_OUTPUT_SP() for __arch_{,try_}cmpxchg64_emu() Usama Arif (1): of/fdt: add dt_phys arg to early_init_dt_scan and early_init_dt_verify Uwe Kleine-König (1): pwm: Assume a disabled PWM to emit a constant inactive output Vasant Hegde (1): iommu/amd/pgtbl_v2: Take protection domain lock before invalidating TLB Venkata Prasad Potturu (1): ASoC: amd: yc: Fix for enabling DMIC on acp6x via _DSD entry Veronika Molnarova (2): perf test attr: Add back missing topdown events perf dso: Fix symtab_type for kmod compression Viktor Malik (1): selftests/bpf: skip the timer_lockup test for single-CPU nodes Vineeth Vijayan (1): s390/cio: Do not unregister the subchannel based on DNV Vishnu Sankar (1): platform/x86: thinkpad_acpi: Fix for ThinkPad's with ECFW showing incorrect fan speed Vitalii Mordan (2): marvell: pxa168_eth: fix call balance of pep->clk handling routines usb: ehci-spear: fix call balance of sehci clk handling routines Vitaly Kuznetsov (1): HID: hyperv: streamline driver probe to avoid devres issues Wang Hai (1): crypto: qat - Fix missing destroy_workqueue in adf_init_aer() Waqar Hameed (1): ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit Weili Qian (1): crypto: hisilicon/qm - disable same error report before resetting Weilin Wang (1): perf test: Add test for Intel TPEBS counting mode Will Deacon (1): arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled Wolfram Sang (2): ARM: dts: renesas: genmai: Fix partition size for QSPI NOR Flash rtc: rzn1: fix BCD to rtc_time conversion errors Wu Hoi Pok (2): drm/radeon: add helper rdev_to_drm(rdev) drm/radeon: change rdev->ddev to rdev_to_drm(rdev) Xiaolei Wang (1): drm/etnaviv: Request pages from DMA32 zone on addressing_limited Xiuhong Wang (1): f2fs: fix fiemap failure issue when page size is 16KB Xu Kuohai (3): bpf, arm64: Remove garbage frame for struct_ops trampoline bpf: Use function pointers count as struct_ops links count bpf: Add kernel symbol for struct_ops trampoline Yang Erkun (3): brd: defer automatic disk creation until module initialization succeeds nfsd: release svc_expkey/svc_export with rcu_work SUNRPC: make sure cache entry active before cache_show Yang Wang (1): drm/amdgpu: fix ACA bank count boundary check error Yang Yingliang (2): clk: imx: imx8-acm: Fix return value check in clk_imx_acm_attach_pm_domains() mailbox: mtk-cmdq: fix wrong use of sizeof in cmdq_get_clocks() Yao Zi (1): platform/x86: panasonic-laptop: Return errno correctly in show callback Ye Bin (3): scsi: bfa: Fix use-after-free in bfad_im_module_exit() f2fs: fix null-ptr-deref in f2fs_submit_page_bio() svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() Yi Yang (1): crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY Yicong Yang (1): perf build: Add missing cflags when building with custom libtraceevent Yihang Li (1): scsi: hisi_sas: Enable all PHYs that are not disabled by user during controller reset Yishai Hadas (2): vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() vfio/mlx5: Fix unwind flows in mlx5vf_pci_save/resume_device_data() Yong-Xuan Wang (1): RISC-V: KVM: Fix APLIC in_clrip and clripnum write emulation Yongliang Gao (1): rtc: check if __rtc_read_time was successful in rtc_timer_do_work() Yongpeng Yang (1): f2fs: check curseg->inited before write_sum_page in change_curseg Yu Kuai (2): block: fix uaf for flush rq while iterating tags block, bfq: fix bfqq uaf in bfq_limit_depth() Yuan Can (5): firmware: google: Unregister driver_info on failure wifi: wfx: Fix error handling in wfx_core_init() drm/amdkfd: Fix wrong usage of INIT_WORK() cpufreq: loongson2: Unregister platform_driver on failure Input: cs40l50 - fix wrong usage of INIT_WORK() Yuan Chen (1): bpf: Fix the xdp_adjust_tail sample prog issue Yuezhang Mo (2): exfat: fix file being changed by unaligned direct write exfat: fix out-of-bounds access of directory entries Yuli Wang (1): LoongArch: Define a default value for VM_DATA_DEFAULT_FLAGS Yunseong Kim (1): ksmbd: fix use-after-free in SMB request handling Yutaro Ohno (1): rust: kernel: fix THIS_MODULE header path in ThisModule doc comment Yuyu Li (1): RDMA/hns: Modify debugfs name Zeng Heng (2): scsi: fusion: Remove unused variable 'rc' f2fs: Fix not used variable 'index' Zhang Changzhong (1): mfd: rt5033: Fix missing regmap_del_irq_chip() Zhang Rui (1): tools/power turbostat: Fix trailing '\n' parsing Zhang Xianwei (1): brd: decrease the number of allocated pages which discarded Zhang Zekun (2): pmdomain: ti-sci: Add missing of_node_put() for args.np powerpc/kexec: Fix return of uninitialized variable Zhen Lei (3): scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() Zheng Yejian (1): x86/unwind/orc: Fix unwind for newly forked tasks Zhenzhong Duan (2): iommu/vt-d: Fix checks and print in dmar_fault_dump_ptes() iommu/vt-d: Fix checks and print in pgtable_walk() Zhiguo Niu (2): f2fs: fix to avoid use GC_AT when setting gc_mode as GC_URGENT_LOW or GC_URGENT_MID f2fs: clean up val{>>,<<}F2FS_BLKSIZE_BITS Zhihao Cheng (4): ubi: wl: Put source PEB into correct list if trying locking LEB failed ubi: fastmap: wl: Schedule fm_work if wear-leveling pool is empty ubifs: Correct the total block count by deducting journal reservation ubi: fastmap: Fix duplicate slab cache names while attaching Zhongqiu Han (1): PCI: endpoint: epf-mhi: Avoid NULL dereference if DT lacks 'mmio' Zhu Yanjun (1): RDMA/rxe: Fix the qp flush warnings in req Zichen Xie (3): drm/msm/dpu: cast crtc_clk calculation to u64 in _dpu_core_perf_calc_clk() clk: sophgo: avoid integer overflow in sg2042_pll_recalc_rate() ALSA: core: Fix possible NULL dereference caused by kunit_kzalloc() Zicheng Qu (3): drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe drm/amd/display: Fix null check for pipe_ctx->plane_state in hwss_setup_dpp iio: gts: Fix uninitialized symbol 'ret' Zijian Zhang (9): selftests/bpf: Fix msg_verify_data in test_sockmap selftests/bpf: Fix txmsg_redir of test_txmsg_pull in test_sockmap selftests/bpf: Add txmsg_pass to pull/push/pop in test_sockmap selftests/bpf: Fix SENDPAGE data logic in test_sockmap selftests/bpf: Fix total_bytes in msg_loop_rx in test_sockmap selftests/bpf: Add push/pop checking for msg_verify_data in test_sockmap bpf, sockmap: Several fixes to bpf_msg_push_data bpf, sockmap: Several fixes to bpf_msg_pop_data bpf, sockmap: Fix sk_msg_reset_curr Ziwei Xiao (1): gve: Flow steering trigger reset only for timeout error Zizhi Wo (4): cachefiles: Fix incorrect length return value in cachefiles_ondemand_fd_write_iter() cachefiles: Fix missing pos updates in cachefiles_ondemand_fd_write_iter() cachefiles: Fix NULL pointer dereference in object->file netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING chao liu (1): apparmor: fix 'Do simple duplicate message elimination' guanjing (1): selftests: netfilter: Fix missing return values in conntrack_dump_flush weiyufeng (1): PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads wenglianfa (3): RDMA/hns: Fix an AEQE overflow error caused by untimely update of eq_db_ci RDMA/hns: Fix flush cqe error when racing with destroy qp RDMA/hns: Fix cpu stuck caused by printings during reset zhang jiao (2): tools/lib/thermal: Remove the thermal.h soft link when doing make clean pinctrl: k210: Undef K210_PC_DEFAULT

4 months, 4 weeks

1
1
0 0

[PATCH v2 0/2] PCI: endpoint: fix bug for an API and simplify another API

by Zijun Hu

This patch series is to fix bug for API devm_pci_epc_destroy() and simplify API pci_epc_get(). Signed-off-by: Zijun Hu <quic_zijuhu(a)quicinc.com> --- Changes in v2: - Correct tile and commit message for patch 1/2. - Add one more patch 2/2 to simplify API pci_epc_get(). - Link to v1: https://lore.kernel.org/r/20241020-pci-epc-core_fix-v1-1-3899705e3537@quici… --- Zijun Hu (2): PCI: endpoint: Fix that API devm_pci_epc_destroy() fails to destroy the EPC device PCI: endpoint: Simplify API pci_epc_get() implementation drivers/pci/endpoint/pci-epc-core.c | 23 +++++++---------------- 1 file changed, 7 insertions(+), 16 deletions(-) --- base-commit: 11066801dd4b7c4d75fce65c812723a80c1481ae change-id: 20241020-pci-epc-core_fix-a92512fa9d19 Best regards, -- Zijun Hu <quic_zijuhu(a)quicinc.com>

4 months, 4 weeks

1
2
0 0

[PATCH v2 00/10] drm: Add DSI/DP support for Renesas r8a779h0 V4M and grey-hawk board

by Tomi Valkeinen

Add everything needed to support the DSI output on Renesas r8a779h0 (V4M) SoC, and the DP output (via sn65dsi86 DSI to DP bridge) on the Renesas grey-hawk board. Overall the DSI and the board design is almost identical to Renesas r8a779g0 and white-hawk board. Signed-off-by: Tomi Valkeinen <tomi.valkeinen+renesas(a)ideasonboard.com> --- Changes in v2: - Add the DT binding with a new conditional block, so that we can set only the port@0 as required - Drop port@1 from r8a779h0.dtsi (there's no port@1) - Add a new patch to write DPTSR only if num_crtcs > 1 - Drop RCAR_DU_FEATURE_NO_DPTSR (not needed anymore) - Add Cc: stable to the fix, and move it as first patch - Added the tags from reviews - Link to v1: https://lore.kernel.org/r/20241203-rcar-gh-dsi-v1-0-738ae1a95d2a@ideasonboa… --- Tomi Valkeinen (10): drm/rcar-du: dsi: Fix PHY lock bit check drm/rcar-du: Write DPTSR only if there are more than one crtc dt-bindings: display: bridge: renesas,dsi-csi2-tx: Add r8a779h0 dt-bindings: display: renesas,du: Add r8a779h0 clk: renesas: r8a779h0: Add display clocks drm/rcar-du: dsi: Add r8a779h0 support drm/rcar-du: Add support for r8a779h0 arm64: dts: renesas: gray-hawk-single: Fix indentation arm64: dts: renesas: r8a779h0: Add display support arm64: dts: renesas: gray-hawk-single: Add DisplayPort support .../display/bridge/renesas,dsi-csi2-tx.yaml | 1 + .../devicetree/bindings/display/renesas,du.yaml | 52 ++++++++- .../boot/dts/renesas/r8a779h0-gray-hawk-single.dts | 119 ++++++++++++++++++--- arch/arm64/boot/dts/renesas/r8a779h0.dtsi | 73 +++++++++++++ drivers/clk/renesas/r8a779h0-cpg-mssr.c | 4 + drivers/gpu/drm/renesas/rcar-du/rcar_du_drv.c | 18 ++++ drivers/gpu/drm/renesas/rcar-du/rcar_du_group.c | 16 +-- drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c | 4 +- .../gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h | 1 - 9 files changed, 264 insertions(+), 24 deletions(-) --- base-commit: adc218676eef25575469234709c2d87185ca223a change-id: 20241008-rcar-gh-dsi-9c01f5deeac8 Best regards, -- Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com>

4 months, 4 weeks

1
1
0 0

[PATCH] usb: r8a66597-udc: fix call balance for r8a66597->clk handling routines

by Vitalii Mordan

If the clock r8a66597->clk was not enabled in r8a66597_probe, r8a66597->clk will contain a non-NULL value leading to the clock being incorrectly disabled later in r8a66597_remove. Use the devm_clk_get_enabled helper function to ensure proper call balance for r8a66597->clk. Found by Linux Verification Center (linuxtesting.org) with Klever. Fixes: d2e27bdf2870 ("usb: add clock support to r8a66597 gadget driver") Cc: stable(a)vger.kernel.org Signed-off-by: Vitalii Mordan <mordan(a)ispras.ru> --- drivers/usb/gadget/udc/r8a66597-udc.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c index ff6f846b1d41..8518feb90792 100644 --- a/drivers/usb/gadget/udc/r8a66597-udc.c +++ b/drivers/usb/gadget/udc/r8a66597-udc.c @@ -1812,10 +1812,6 @@ static void r8a66597_remove(struct platform_device *pdev) usb_del_gadget_udc(&r8a66597->gadget); del_timer_sync(&r8a66597->timer); r8a66597_free_request(&r8a66597->ep[0].ep, r8a66597->ep0_req); - - if (r8a66597->pdata->on_chip) { - clk_disable_unprepare(r8a66597->clk); - } } static void nop_completion(struct usb_ep *ep, struct usb_request *r) @@ -1876,12 +1872,11 @@ static int r8a66597_probe(struct platform_device *pdev) if (r8a66597->pdata->on_chip) { snprintf(clk_name, sizeof(clk_name), "usb%d", pdev->id); - r8a66597->clk = devm_clk_get(dev, clk_name); + r8a66597->clk = devm_clk_get_enabled(dev, clk_name); if (IS_ERR(r8a66597->clk)) { - dev_err(dev, "cannot get clock \"%s\"\n", clk_name); + dev_err(dev, "cannot get and enable clock \"%s\"\n", clk_name); return PTR_ERR(r8a66597->clk); } - clk_prepare_enable(r8a66597->clk); } if (r8a66597->pdata->sudmac) { @@ -1953,9 +1948,6 @@ static int r8a66597_probe(struct platform_device *pdev) err_add_udc: r8a66597_free_request(&r8a66597->ep[0].ep, r8a66597->ep0_req); clean_up2: - if (r8a66597->pdata->on_chip) - clk_disable_unprepare(r8a66597->clk); - if (r8a66597->ep0_req) r8a66597_free_request(&r8a66597->ep[0].ep, r8a66597->ep0_req); -- 2.25.1

4 months, 4 weeks

1
0
0 0

[PATCH 6.6] tpm: Lock TPM chip in tpm_pm_suspend() first

by bin.lan.cn＠eng.windriver.com

From: Jarkko Sakkinen <jarkko(a)kernel.org> [ Upstream commit 9265fed6db601ee2ec47577815387458ef4f047a ] Setting TPM_CHIP_FLAG_SUSPENDED in the end of tpm_pm_suspend() can be racy according, as this leaves window for tpm_hwrng_read() to be called while the operation is in progress. The recent bug report gives also evidence of this behaviour. Aadress this by locking the TPM chip before checking any chip->flags both in tpm_pm_suspend() and tpm_hwrng_read(). Move TPM_CHIP_FLAG_SUSPENDED check inside tpm_get_random() so that it will be always checked only when the lock is reserved. Cc: stable(a)vger.kernel.org # v6.4+ Fixes: 99d464506255 ("tpm: Prevent hwrng from activating during resume") Reported-by: Mike Seo <mikeseohyungjin(a)gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219383 Reviewed-by: Jerry Snitselaar <jsnitsel(a)redhat.com> Tested-by: Mike Seo <mikeseohyungjin(a)gmail.com> Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org> [ Don't call tpm2_end_auth_session() for this function does not exist in 6.6.y.] Signed-off-by: Bin Lan <bin.lan.cn(a)windriver.com> --- drivers/char/tpm/tpm-chip.c | 4 ---- drivers/char/tpm/tpm-interface.c | 29 +++++++++++++++++++++-------- 2 files changed, 21 insertions(+), 12 deletions(-) diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c index 42b1062e33cd..78999f7f248c 100644 --- a/drivers/char/tpm/tpm-chip.c +++ b/drivers/char/tpm/tpm-chip.c @@ -519,10 +519,6 @@ static int tpm_hwrng_read(struct hwrng *rng, void *data, size_t max, bool wait) { struct tpm_chip *chip = container_of(rng, struct tpm_chip, hwrng); - /* Give back zero bytes, as TPM chip has not yet fully resumed: */ - if (chip->flags & TPM_CHIP_FLAG_SUSPENDED) - return 0; - return tpm_get_random(chip, data, max); } diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c index 66b16d26eecc..c8ea52dfa556 100644 --- a/drivers/char/tpm/tpm-interface.c +++ b/drivers/char/tpm/tpm-interface.c @@ -394,6 +394,13 @@ int tpm_pm_suspend(struct device *dev) if (!chip) return -ENODEV; + rc = tpm_try_get_ops(chip); + if (rc) { + /* Can be safely set out of locks, as no action cannot race: */ + chip->flags |= TPM_CHIP_FLAG_SUSPENDED; + goto out; + } + if (chip->flags & TPM_CHIP_FLAG_ALWAYS_POWERED) goto suspended; @@ -401,19 +408,18 @@ int tpm_pm_suspend(struct device *dev) !pm_suspend_via_firmware()) goto suspended; - rc = tpm_try_get_ops(chip); - if (!rc) { - if (chip->flags & TPM_CHIP_FLAG_TPM2) - tpm2_shutdown(chip, TPM2_SU_STATE); - else - rc = tpm1_pm_suspend(chip, tpm_suspend_pcr); - - tpm_put_ops(chip); + if (chip->flags & TPM_CHIP_FLAG_TPM2) { + tpm2_shutdown(chip, TPM2_SU_STATE); + goto suspended; } + rc = tpm1_pm_suspend(chip, tpm_suspend_pcr); + suspended: chip->flags |= TPM_CHIP_FLAG_SUSPENDED; + tpm_put_ops(chip); +out: if (rc) dev_err(dev, "Ignoring error %d while suspending\n", rc); return 0; @@ -462,11 +468,18 @@ int tpm_get_random(struct tpm_chip *chip, u8 *out, size_t max) if (!chip) return -ENODEV; + /* Give back zero bytes, as TPM chip has not yet fully resumed: */ + if (chip->flags & TPM_CHIP_FLAG_SUSPENDED) { + rc = 0; + goto out; + } + if (chip->flags & TPM_CHIP_FLAG_TPM2) rc = tpm2_get_random(chip, out, max); else rc = tpm1_get_random(chip, out, max); +out: tpm_put_ops(chip); return rc; } -- 2.43.0

4 months, 4 weeks

2
1
0 0

[PATCH 6.1.y] drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini()

by jianqi.ren.cn＠windriver.com

From: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> Since 'adev->dm.dc' in amdgpu_dm_fini() might turn out to be NULL before the call to dc_enable_dmub_notifications(), check beforehand to ensure there will not be a possible NULL-ptr-deref there. Also, since commit 1e88eb1b2c25 ("drm/amd/display: Drop CONFIG_DRM_AMD_DC_HDCP") there are two separate checks for NULL in 'adev->dm.dc' before dc_deinit_callbacks() and dc_dmub_srv_destroy(). Clean up by combining them all under one 'if'. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. Fixes: 81927e2808be ("drm/amd/display: Support for DMUB AUX") Signed-off-by: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Jianqi Ren <jianqi.ren.cn(a)windriver.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 8dc0f70df24f..7b4d44dcb343 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -1882,14 +1882,14 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev) dc_deinit_callbacks(adev->dm.dc); #endif - if (adev->dm.dc) + if (adev->dm.dc) { dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv); - - if (dc_enable_dmub_notifications(adev->dm.dc)) { - kfree(adev->dm.dmub_notify); - adev->dm.dmub_notify = NULL; - destroy_workqueue(adev->dm.delayed_hpd_wq); - adev->dm.delayed_hpd_wq = NULL; + if (dc_enable_dmub_notifications(adev->dm.dc)) { + kfree(adev->dm.dmub_notify); + adev->dm.dmub_notify = NULL; + destroy_workqueue(adev->dm.delayed_hpd_wq); + adev->dm.delayed_hpd_wq = NULL; + } } if (adev->dm.dmub_bo) -- 2.25.1

4 months, 4 weeks

3
2
0 0

[PATCH 5.10.y] ALSA: usb-audio: Fix out of bounds reads when finding clock sources

by Benoît Sevens

From: Takashi Iwai <tiwai(a)suse.de> The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check. Reported-by: Benoît Sevens <bsevens(a)google.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/20241121140613.3651-1-bsevens@google.com Link: https://patch.msgid.link/20241125144629.20757-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> (cherry picked from commit a3dd4d63eeb452cfb064a13862fb376ab108f6a6) Signed-off-by: Benoît Sevens <bsevens(a)google.com> --- sound/usb/clock.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/sound/usb/clock.c b/sound/usb/clock.c index 514d18a3e07a..197a6b7d8ad6 100644 --- a/sound/usb/clock.c +++ b/sound/usb/clock.c @@ -21,6 +21,10 @@ #include "clock.h" #include "quirks.h" +/* check whether the descriptor bLength has the minimal length */ +#define DESC_LENGTH_CHECK(p) \ + (p->bLength >= sizeof(*p)) + static void *find_uac_clock_desc(struct usb_host_interface *iface, int id, bool (*validator)(void *, int), u8 type) { @@ -38,36 +42,60 @@ static void *find_uac_clock_desc(struct usb_host_interface *iface, int id, static bool validate_clock_source_v2(void *p, int id) { struct uac_clock_source_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_source_v3(void *p, int id) { struct uac3_clock_source_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_selector_v2(void *p, int id) { struct uac_clock_selector_descriptor *cs = p; - return cs->bClockID == id; + if (!DESC_LENGTH_CHECK(cs)) + return false; + if (cs->bClockID != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + return cs->bLength >= sizeof(*cs) + cs->bNrInPins + + 1 /* bmControls */ + 1 /* iClockSelector */; } static bool validate_clock_selector_v3(void *p, int id) { struct uac3_clock_selector_descriptor *cs = p; - return cs->bClockID == id; + if (!DESC_LENGTH_CHECK(cs)) + return false; + if (cs->bClockID != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + return cs->bLength >= sizeof(*cs) + cs->bNrInPins + + 4 /* bmControls */ + 2 /* wCSelectorDescrStr */; } static bool validate_clock_multiplier_v2(void *p, int id) { struct uac_clock_multiplier_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_multiplier_v3(void *p, int id) { struct uac3_clock_multiplier_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } -- 2.47.0.338.g60cca15819-goog

4 months, 4 weeks

3
2
0 0

[PATCH 6.1/5.15/5.10/5.4] udf: fix null-ptr-deref if sb_getblk() fails

by Jakub Acs

commit 32f123a3f342 ("udf: Fold udf_getblk() into udf_bread()"), fixes a null-ptr-deref bug as a side effect. Backport the null-ptr-deref fixing aspect of the aforementioned commit. Closes: https://syzkaller.appspot.com/bug?extid=a38e34ca637c224f4a79 Signed-off-by: Jakub Acs <acsjakub(a)amazon.de> --- fs/udf/inode.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/udf/inode.c b/fs/udf/inode.c index d7d6ccd0af06..4f505a366da9 100644 --- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -380,6 +380,10 @@ static struct buffer_head *udf_getblk(struct inode *inode, udf_pblk_t block, *err = udf_get_block(inode, block, &dummy, create); if (!*err && buffer_mapped(&dummy)) { bh = sb_getblk(inode->i_sb, dummy.b_blocknr); + if (!bh) { + *err = -ENOMEM; + return NULL; + } if (buffer_new(&dummy)) { lock_buffer(bh); memset(bh->b_data, 0x00, inode->i_sb->s_blocksize); base-commit: e4d90d63d385228b1e0bcf31cc15539bbbc28f7f -- 2.40.1

4 months, 4 weeks

4
7
0 0

[PATCH v5.10.277] wifi: mac80211: Avoid address calculations via out of bounds array indexing

by Hardik Gohil

From: Kenton Groombridge <concord(a)gentoo.org> [ Upstream commit 2663d0462eb32ae7c9b035300ab6b1523886c718 ] req->n_channels must be set before req->channels[] can be used. This patch fixes one of the issues encountered in [1]. [ 83.964255] UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:364:4 [ 83.964258] index 0 is out of range for type 'struct ieee80211_channel *[]' [...] [ 83.964264] Call Trace: [ 83.964267] <TASK> [ 83.964269] dump_stack_lvl+0x3f/0xc0 [ 83.964274] __ubsan_handle_out_of_bounds+0xec/0x110 [ 83.964278] ieee80211_prep_hw_scan+0x2db/0x4b0 [ 83.964281] __ieee80211_start_scan+0x601/0x990 [ 83.964291] nl80211_trigger_scan+0x874/0x980 [ 83.964295] genl_family_rcv_msg_doit+0xe8/0x160 [ 83.964298] genl_rcv_msg+0x240/0x270 [...] [1] https://bugzilla.kernel.org/show_bug.cgi?id=218810 Co-authored-by: Kees Cook <keescook(a)chromium.org> Signed-off-by: Kees Cook <kees(a)kernel.org> Signed-off-by: Kenton Groombridge <concord(a)gentoo.org> Link: https://msgid.link/20240605152218.236061-1-concord@gentoo.org Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> [Xiangyu: Modified to apply on 6.1.y and 6.6.y] Signed-off-by: Xiangyu Chen <xiangyu.chen(a)windriver.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hardik Gohil <hgohil(a)mvista.com> --- net/mac80211/scan.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c index be5d02c..bcbbb9f 100644 --- a/net/mac80211/scan.c +++ b/net/mac80211/scan.c @@ -351,7 +351,8 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_sub_if_data *sdata) struct cfg80211_scan_request *req; struct cfg80211_chan_def chandef; u8 bands_used = 0; - int i, ielen, n_chans; + int i, ielen; + u32 *n_chans; u32 flags = 0; req = rcu_dereference_protected(local->scan_req, @@ -361,34 +362,34 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_sub_if_data *sdata) return false; if (ieee80211_hw_check(&local->hw, SINGLE_SCAN_ON_ALL_BANDS)) { + local->hw_scan_req->req.n_channels = req->n_channels; + for (i = 0; i < req->n_channels; i++) { local->hw_scan_req->req.channels[i] = req->channels[i]; bands_used |= BIT(req->channels[i]->band); } - - n_chans = req->n_channels; } else { do { if (local->hw_scan_band == NUM_NL80211_BANDS) return false; - n_chans = 0; + n_chans = &local->hw_scan_req->req.n_channels; + *n_chans = 0; for (i = 0; i < req->n_channels; i++) { if (req->channels[i]->band != local->hw_scan_band) continue; - local->hw_scan_req->req.channels[n_chans] = + local->hw_scan_req->req.channels[(*n_chans)++] = req->channels[i]; - n_chans++; + bands_used |= BIT(req->channels[i]->band); } local->hw_scan_band++; - } while (!n_chans); + } while (!*n_chans); } - local->hw_scan_req->req.n_channels = n_chans; ieee80211_prepare_scan_chandef(&chandef, req->scan_width); if (req->flags & NL80211_SCAN_FLAG_MIN_PREQ_CONTENT) -- 2.7.4

4 months, 4 weeks

3
3
0 0

[PATCH] drivers: gpio: gpio-ljca: Initialize num before accessing item in ljca_gpio_config

by Haoyu Li

With the new __counted_by annocation in ljca_gpio_packet, the "num" struct member must be set before accessing the "item" array. Failing to do so will trigger a runtime warning when enabling CONFIG_UBSAN_BOUNDS and CONFIG_FORTIFY_SOURCE. Fixes: 1034cc423f1b ("gpio: update Intel LJCA USB GPIO driver") Signed-off-by: Haoyu Li <lihaoyu499(a)gmail.com> --- drivers/gpio/gpio-ljca.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpio/gpio-ljca.c b/drivers/gpio/gpio-ljca.c index 503d2441c58f..817ecb12d550 100644 --- a/drivers/gpio/gpio-ljca.c +++ b/drivers/gpio/gpio-ljca.c @@ -82,9 +82,9 @@ static int ljca_gpio_config(struct ljca_gpio_dev *ljca_gpio, u8 gpio_id, int ret; mutex_lock(&ljca_gpio->trans_lock); + packet->num = 1; packet->item[0].index = gpio_id; packet->item[0].value = config | ljca_gpio->connect_mode[gpio_id]; - packet->num = 1; ret = ljca_transfer(ljca_gpio->ljca, LJCA_GPIO_CONFIG, (u8 *)packet, struct_size(packet, item, packet->num), NULL, 0); -- 2.34.1

4 months, 4 weeks

3
2
0 0

[PATCH net] net :mana :Request a V2 response version for MANA_QUERY_GF_STAT

by Shradha Gupta

The current requested response version(V1) for MANA_QUERY_GF_STAT query results in STATISTICS_FLAGS_TX_ERRORS_GDMA_ERROR value being set to 0 always. In order to get the correct value for this counter we request the response version to be V2. Cc: stable(a)vger.kernel.org Fixes: e1df5202e879 ("net :mana :Add remaining GDMA stats for MANA to ethtool") Signed-off-by: Shradha Gupta <shradhagupta(a)linux.microsoft.com> --- drivers/net/ethernet/microsoft/mana/mana_en.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c index 57ac732e7707..f73848a4feb3 100644 --- a/drivers/net/ethernet/microsoft/mana/mana_en.c +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c @@ -2536,6 +2536,7 @@ void mana_query_gf_stats(struct mana_port_context *apc) mana_gd_init_req_hdr(&req.hdr, MANA_QUERY_GF_STAT, sizeof(req), sizeof(resp)); + req.hdr.resp.msg_version = GDMA_MESSAGE_V2; req.req_stats = STATISTICS_FLAGS_RX_DISCARDS_NO_WQE | STATISTICS_FLAGS_RX_ERRORS_VPORT_DISABLED | STATISTICS_FLAGS_HC_RX_BYTES | -- 2.43.0

4 months, 4 weeks

3
2
0 0

[PATCH v2 1/2] ocfs2: Revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume"

by Heming Zhao

This reverts commit dfe6c5692fb5 ("ocfs2: fix the la space leak when unmounting an ocfs2 volume"). In commit dfe6c5692fb5, the commit log "This bug has existed since the initial OCFS2 code." is wrong. The correct introduction commit is 30dd3478c3cd ("ocfs2: correctly use ocfs2_find_next_zero_bit()"). The influence of commit dfe6c5692fb5 is that it provides a correct fix for the latest kernel. however, it shouldn't be pushed to stable branches. Let's use this commit to revert all branches that include dfe6c5692fb5 and use a new fix method to fix commit 30dd3478c3cd. Fixes: dfe6c5692fb5 ("ocfs2: fix the la space leak when unmounting an ocfs2 volume") Signed-off-by: Heming Zhao <heming.zhao(a)suse.com> Cc: <stable(a)vger.kernel.org> --- fs/ocfs2/localalloc.c | 19 ------------------- 1 file changed, 19 deletions(-) diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c index 8ac42ea81a17..5df34561c551 100644 --- a/fs/ocfs2/localalloc.c +++ b/fs/ocfs2/localalloc.c @@ -1002,25 +1002,6 @@ static int ocfs2_sync_local_to_main(struct ocfs2_super *osb, start = bit_off + 1; } - /* clear the contiguous bits until the end boundary */ - if (count) { - blkno = la_start_blk + - ocfs2_clusters_to_blocks(osb->sb, - start - count); - - trace_ocfs2_sync_local_to_main_free( - count, start - count, - (unsigned long long)la_start_blk, - (unsigned long long)blkno); - - status = ocfs2_release_clusters(handle, - main_bm_inode, - main_bm_bh, blkno, - count); - if (status < 0) - mlog_errno(status); - } - bail: if (status) mlog_errno(status); -- 2.43.0

4 months, 4 weeks

2
1
0 0

[PATCH v4] mtd: diskonchip: Cast an operand to prevent potential overflow

by Gax-c

From: Zichen Xie <zichenxie0106(a)gmail.com> There may be a potential integer overflow issue in inftl_partscan(). parts[0].size is defined as "uint64_t" while mtd->erasesize and ip->firstUnit are defined as 32-bit unsigned integer. The result of the calculation will be limited to 32 bits without correct casting. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zichen Xie <zichenxie0106(a)gmail.com> Cc: stable(a)vger.kernel.org --- v2: Correct "Fixes" tag. v3: Shorten subject and adjust commit log wrapping. v4: Add Cc tag. --- drivers/mtd/nand/raw/diskonchip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mtd/nand/raw/diskonchip.c b/drivers/mtd/nand/raw/diskonchip.c index 8db7fc424571..70d6c2250f32 100644 --- a/drivers/mtd/nand/raw/diskonchip.c +++ b/drivers/mtd/nand/raw/diskonchip.c @@ -1098,7 +1098,7 @@ static inline int __init inftl_partscan(struct mtd_info *mtd, struct mtd_partiti (i == 0) && (ip->firstUnit > 0)) { parts[0].name = " DiskOnChip IPL / Media Header partition"; parts[0].offset = 0; - parts[0].size = mtd->erasesize * ip->firstUnit; + parts[0].size = (uint64_t)mtd->erasesize * ip->firstUnit; numparts = 1; } -- 2.34.1

4 months, 4 weeks

2
1
0 0

[PATCH] mtd: onenand: Fix uninitialized retlen in do_otp_read()

by Ivan Stepchenko

The function do_otp_read() does not set the output parameter *retlen, which is expected to contain the number of bytes actually read. As a result, in onenand_otp_walk(), the tmp_retlen variable remains uninitialized after calling do_otp_walk() and used to change the values of the buf, len and retlen variables. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 49dc08eeda70 ("[MTD] [OneNAND] fix numerous races") Cc: stable(a)vger.kernel.org Signed-off-by: Ivan Stepchenko <sid(a)itb.spb.ru> --- drivers/mtd/nand/onenand/onenand_base.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/mtd/nand/onenand/onenand_base.c b/drivers/mtd/nand/onenand/onenand_base.c index f66385faf631..0dc2ea4fc857 100644 --- a/drivers/mtd/nand/onenand/onenand_base.c +++ b/drivers/mtd/nand/onenand/onenand_base.c @@ -2923,6 +2923,7 @@ static int do_otp_read(struct mtd_info *mtd, loff_t from, size_t len, ret = ONENAND_IS_4KB_PAGE(this) ? onenand_mlc_read_ops_nolock(mtd, from, &ops) : onenand_read_ops_nolock(mtd, from, &ops); + *retlen = ops.retlen; /* Exit OTP access mode */ this->command(mtd, ONENAND_CMD_RESET, 0, 0); -- 2.34.1

4 months, 4 weeks

2
1
0 0

Re: [PATCH v2] selinux: ignore unknown extended permissions

by Thiébaud Weksteen

On Thu, Dec 5, 2024 at 6:42 PM Christian Göttsche <cgzones(a)googlemail.com> wrote: > > Dec 5, 2024 02:09:39 Thiébaud Weksteen <tweek(a)google.com>: > > > When evaluating extended permissions, ignore unknown permissions instead > > of calling BUG(). This commit ensures that future permissions can be > > added without interfering with older kernels. > > > > Fixes: fa1aa143ac4a ("selinux: extended permissions for ioctls") > > Cc: stable(a)vger.kernel.org > > Signed-off-by: Thiébaud Weksteen <tweek(a)google.com> > > - BUG(); > > + pr_warn_once( > > + "SELinux: unknown extended permission (%u) will be ignored\n", > > + node->datum.u.xperms->specified); > > + return; > > } > > What about instead of logging once per boot at access decision time logging once per policyload at parse time, like suggested for patch https://patchwork.kernel.org/project/selinux/patch/20241115133619.114393-11… ? > I agree, warning when the policy is loaded makes more sense. For this particular bug, I am trying to keep the patch to a bare minimum as I intend to backport it to stable kernels (on Android, this is preventing us from deploying a policy compatible with both older and newer kernels). Maybe we could land the first version of this patch (without any warning message), with the understanding that your patch will land soon after?

4 months, 4 weeks

1
0
0 0

Re: [PATCH net-next] tcp: Check space before adding MPTCP options

by Mo Yuanhao

在 2024/12/4 19:01, Matthieu Baerts 写道: > Hi MoYuanhao, > > +Cc MPTCP mailing list. > > (Please cc the MPTCP list next time) > > On 04/12/2024 09:58, MoYuanhao wrote: >> Ensure enough space before adding MPTCP options in tcp_syn_options() >> Added a check to verify sufficient remaining space >> before inserting MPTCP options in SYN packets. >> This prevents issues when space is insufficient. > > Thank you for this patch. I'm surprised we all missed this check, but > yes it is missing. > > As mentioned by Eric in his previous email, please add a 'Fixes' tag. > For bug-fixes, you should also Cc stable and target 'net', not 'net-next': > > Fixes: cec37a6e41aa ("mptcp: Handle MP_CAPABLE options for outgoing > connections") > Cc: stable(a)vger.kernel.org > > > Regarding the code, it looks OK to me, as we did exactly that with > mptcp_synack_options(). In mptcp_established_options(), we pass > 'remaining' because many MPTCP options can be set, but not here. So I > guess that's fine to keep the code like that, especially for the 'net' tree. > > > Also, and linked to Eric's email, did you have an issue with that, or is > it to prevent issues in the future? > > > One last thing, please don’t repost your patches within one 24h period, see: > > https://docs.kernel.org/process/maintainer-netdev.html > > > Because the code is OK to me, and the same patch has already been sent > twice to the netdev ML within a few hours, I'm going to apply this patch > in our MPTCP tree with the suggested modifications. Later on, we will > send it for inclusion in the net tree. > > pw-bot: awaiting-upstream > > (Not sure this pw-bot instruction will work as no net/mptcp/* files have > been modified) > > Cheers, > Matt Hi Matt, Thank you for your feedback! I have made the suggested updates to the patch (version 2): I’ve added the Fixes tag and Cc'd the stable(a)vger.kernel.org list. The target branch has been adjusted to net as per your suggestion. I will make sure to Cc the MPTCP list in future submissions. Regarding your question, this patch was created to prevent potential issues related to insufficient space for MPTCP options in the future. I didn't encounter a specific issue, but it seemed like a necessary safeguard to ensure robustness when handling SYN packets with MPTCP options. Additionally, I have made further optimizations to the patch, which are included in the attached version. I believe it would be more elegant to introduce a new function, mptcp_set_option(), similar to mptcp_set_option_cond(), to handle MPTCP options. This is my first time replying to a message in a Linux mailing list, so if there are any formatting issues or mistakes, please point them out and I will make sure to correct them in future submissions. Thanks again for your review and suggestions. Looking forward to seeing the patch applied to the MPTCP tree and later inclusion in the net tree. Best regards, MoYuanhao

4 months, 4 weeks

4
3
0 0

Hello,are you looking for bags supplier?

by Steven

4 months, 4 weeks

1
0
0 0

[PATCH 1/2] zram: refuse to use zero sized block device as backing device

by Kairui Song

From: Kairui Song <kasong(a)tencent.com> Setting a zero sized block device as backing device is pointless, and one can easily create a recursive loop by setting the uninitialized ZRAM device itself as its own backing device by (zram0 is uninitialized): echo /dev/zram0 > /sys/block/zram0/backing_dev It's definitely a wrong config, and the module will pin itself, kernel should refuse doing so in the first place. By refusing to use zero sized device we avoided misuse cases including this one above. Fixes: 013bf95a83ec ("zram: add interface to specif backing device") Reported-by: Desheng Wu <deshengwu(a)tencent.com> Signed-off-by: Kairui Song <kasong(a)tencent.com> Cc: stable(a)vger.kernel.org --- drivers/block/zram/zram_drv.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c index 0ca6d55c9917..dd48df5b97c8 100644 --- a/drivers/block/zram/zram_drv.c +++ b/drivers/block/zram/zram_drv.c @@ -614,6 +614,12 @@ static ssize_t backing_dev_store(struct device *dev, } nr_pages = i_size_read(inode) >> PAGE_SHIFT; + /* Refuse to use zero sized device (also prevents self reference) */ + if (!nr_pages) { + err = -EINVAL; + goto out; + } + bitmap_sz = BITS_TO_LONGS(nr_pages) * sizeof(long); bitmap = kvzalloc(bitmap_sz, GFP_KERNEL); if (!bitmap) { -- 2.47.0

4 months, 4 weeks

2
1
0 0

[PATCH v3] btrfs: do proper folio cleanup when run_delalloc_nocow() failed

by Qu Wenruo

[BUG] There are at least two problems when run_delalloc_nocow() hits some error and has to go cleanup routine: - It doesn't clear the folio dirty flags of any successfully ran range This breaks the regular error handling protocol for folio writeback, which should clear the dirty flag of the failed range. This clean up protocol is adapted by both iomap and btrfs (if the error happened at the very beginning of the whole delalloc range). - It can start writeback/unlock folios which is already unlocked This is done by calling extent_clear_unlock_delalloc() with PAGE_START_WRITEBACK or PAGE_UNLOCK flag. This will trigger the VM_BUG_ON() for folio_start_writeback(), which requires the folio to be locked. [CAUSE] The problem of not clearing the folio dirty flag is a common bug, shared between cow_file_range() and run_delalloc_nocow(). We just need to clear the folio dirty flags according to the @cur_offset cursor. For the extent_clear_unlock_delalloc() on unlocked folios, it's because the double error handling, one from cow_file_range() (inside fallback_to_cow()), one from run_delalloc_nocow() itself. [FIX] - Clear folio dirty for range [@start, @cur_offset) Introduce a helper, cleanup_dirty_folios(), which will find and lock the folio in the range, clear the dirty flag and start/end the writeback, with the extra handling for the @locked_folio. - Introduce a helper to record the last failed COW range end This is to trace which range we should skip, to avoid double unlocking. - Skip the failed COW range for the error handling Cc: stable(a)vger.kernel.org Signed-off-by: Qu Wenruo <wqu(a)suse.com> --- Changelog: v3: - Fix the double error handling on the COW range Which can lead to VM_BUG_ON() for extent_clear_unlock_delalloc(), as the folio is already unlocked by the error handling inside cow_file_range(). - Update the commit message to explain the bug better - Add a comment inside the error handling explaining the error patterns v2: - Fix the incorrect @cur_offset assignment to @end The @end is not aligned to sector size, nor @cur_offset should be updated before fallback_to_cow() succeeded. - Add one extra ASSERT() to make sure the range is properly aligned --- fs/btrfs/inode.c | 93 ++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 86 insertions(+), 7 deletions(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 9517fb2df649..069599b025a6 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -1969,6 +1969,48 @@ static int can_nocow_file_extent(struct btrfs_path *path, return ret < 0 ? ret : can_nocow; } +static void cleanup_dirty_folios(struct btrfs_inode *inode, + struct folio *locked_folio, + u64 start, u64 end, int error) +{ + struct btrfs_fs_info *fs_info = inode->root->fs_info; + struct address_space *mapping = inode->vfs_inode.i_mapping; + pgoff_t start_index = start >> PAGE_SHIFT; + pgoff_t end_index = end >> PAGE_SHIFT; + u32 len; + + ASSERT(end + 1 - start < U32_MAX); + ASSERT(IS_ALIGNED(start, fs_info->sectorsize) && + IS_ALIGNED(end + 1, fs_info->sectorsize)); + len = end + 1 - start; + + /* + * Handle the locked folio first. + * btrfs_folio_clamp_*() helpers can handle range out of the folio case. + */ + btrfs_folio_clamp_clear_dirty(fs_info, locked_folio, start, len); + btrfs_folio_clamp_set_writeback(fs_info, locked_folio, start, len); + btrfs_folio_clamp_clear_writeback(fs_info, locked_folio, start, len); + + for (pgoff_t index = start_index; index <= end_index; index++) { + struct folio *folio; + + /* Already handled at the beginning. */ + if (index == locked_folio->index) + continue; + folio = __filemap_get_folio(mapping, index, FGP_LOCK, GFP_NOFS); + /* Cache already dropped, no need to do any cleanup. */ + if (IS_ERR(folio)) + continue; + btrfs_folio_clamp_clear_dirty(fs_info, folio, start, len); + btrfs_folio_clamp_set_writeback(fs_info, folio, start, len); + btrfs_folio_clamp_clear_writeback(fs_info, folio, start, len); + folio_unlock(folio); + folio_put(folio); + } + mapping_set_error(mapping, error); +} + /* * when nowcow writeback call back. This checks for snapshots or COW copies * of the extents that exist in the file, and COWs the file as required. @@ -1984,6 +2026,11 @@ static noinline int run_delalloc_nocow(struct btrfs_inode *inode, struct btrfs_root *root = inode->root; struct btrfs_path *path; u64 cow_start = (u64)-1; + /* + * If not 0, represents the inclusive end of the last fallback_to_cow() + * range. Only for error handling. + */ + u64 cow_end = 0; u64 cur_offset = start; int ret; bool check_prev = true; @@ -2144,6 +2191,7 @@ static noinline int run_delalloc_nocow(struct btrfs_inode *inode, found_key.offset - 1); cow_start = (u64)-1; if (ret) { + cow_end = found_key.offset - 1; btrfs_dec_nocow_writers(nocow_bg); goto error; } @@ -2217,11 +2265,12 @@ static noinline int run_delalloc_nocow(struct btrfs_inode *inode, cow_start = cur_offset; if (cow_start != (u64)-1) { - cur_offset = end; ret = fallback_to_cow(inode, locked_folio, cow_start, end); cow_start = (u64)-1; - if (ret) + if (ret) { + cow_end = end; goto error; + } } btrfs_free_path(path); @@ -2229,12 +2278,42 @@ static noinline int run_delalloc_nocow(struct btrfs_inode *inode, error: /* - * If an error happened while a COW region is outstanding, cur_offset - * needs to be reset to cow_start to ensure the COW region is unlocked - * as well. + * There are several error cases: + * + * 1) Failed without falling back to COW + * start cur_start end + * |/////////////| | + * + * For range [start, cur_start) the folios are already unlocked (except + * @locked_folio), EXTENT_DELALLOC already removed. + * Only need to clear the dirty flag as they will never be submitted. + * Ordered extent and extent maps are handled by + * btrfs_mark_ordered_io_finished() inside run_delalloc_range(). + * + * 2) Failed with error from fallback_to_cow() + * start cur_start cow_end end + * |/////////////|-----------| | + * + * For range [start, cur_start) it's the same as case 1). + * But for range [cur_start, cow_end), the folios have dirty flag + * cleared and unlocked, EXTENT_DEALLLOC cleared. + * There may or may not be any ordered extents/extent maps allocated. + * + * We should not call extent_clear_unlock_delalloc() on range [cur_start, + * cow_end), as the folios are already unlocked. + * + * So clear the folio dirty flags for [start, cur_offset) first. */ - if (cow_start != (u64)-1) - cur_offset = cow_start; + if (cur_offset > start) + cleanup_dirty_folios(inode, locked_folio, start, cur_offset - 1, ret); + + /* + * If an error happened while a COW region is outstanding, cur_offset + * needs to be reset to @cow_end + 1 to skip the COW range, as + * cow_file_range() will do the proper cleanup at error. + */ + if (cow_end) + cur_offset = cow_end + 1; /* * We need to lock the extent here because we're clearing DELALLOC and -- 2.47.1

4 months, 4 weeks

1
0
0 0

[PATCH v2] btrfs: do proper folio cleanup when run_delalloc_nocow() failed

by Qu Wenruo

Just like cow_file_range(), from day 1 btrfs doesn't really clean the dirty flags, if it has an ordered extent created successfully. Per error handling protocol (according to the iomap, and the btrfs handling if it failed at the beginning of the range), we should clear all dirty flags for the involved folios. Or the range of that folio will still be marked dirty, but has no EXTENT_DEALLLOC set inside the io tree. Since the folio range is still dirty, it will still be the target for the next writeback, but since there is no EXTENT_DEALLLOC, no new ordered extent will be created for it. This means the writeback of that folio range will fall back to COW fixup path. However the COW fixup path itself is being re-evaluated as the newly introduced pin_user_pages_*() should prevent us hitting an out-of-band dirty folios, and we're moving to deprecate such COW fixup path. We already have an experimental patch that will make fixup COW path to crash, to verify there is no such out-of-band dirty folios anymore. So here we need to avoid going COW fixup path, by doing proper folio dirty flags cleanup. Unlike the fix in cow_file_range(), which holds the folio and extent lock until error or a fully successfully run, here we have no such luxury as we can fallback to COW, and in that case the extent/folio range will be unlocked by cow_file_range(). So here we introduce a new helper, cleanup_dirty_folios(), to clear the dirty flags for the involved folios. And since the final fallback_to_cow() call can also fail, and we rely on @cur_offset to do the proper cleanup, here we remove the unnecessary and incorrect @cur_offset assignment. Cc: stable(a)vger.kernel.org Signed-off-by: Qu Wenruo <wqu(a)suse.com> --- Changelog: v2: - Fix the incorrect @cur_offset assignment to @end The @end is not aligned to sector size, nor @cur_offset should be updated before fallback_to_cow() succeeded. - Add one extra ASSERT() to make sure the range is properly aligned --- fs/btrfs/inode.c | 59 +++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 58 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index e8232ac7917f..92df6dfff2e4 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -1969,6 +1969,48 @@ static int can_nocow_file_extent(struct btrfs_path *path, return ret < 0 ? ret : can_nocow; } +static void cleanup_dirty_folios(struct btrfs_inode *inode, + struct folio *locked_folio, + u64 start, u64 end, int error) +{ + struct btrfs_fs_info *fs_info = inode->root->fs_info; + struct address_space *mapping = inode->vfs_inode.i_mapping; + pgoff_t start_index = start >> PAGE_SHIFT; + pgoff_t end_index = end >> PAGE_SHIFT; + u32 len; + + ASSERT(end + 1 - start < U32_MAX); + ASSERT(IS_ALIGNED(start, fs_info->sectorsize) && + IS_ALIGNED(end + 1, fs_info->sectorsize)); + len = end + 1 - start; + + /* + * Handle the locked folio first. + * btrfs_folio_clamp_*() helpers can handle range out of the folio case. + */ + btrfs_folio_clamp_clear_dirty(fs_info, locked_folio, start, len); + btrfs_folio_clamp_set_writeback(fs_info, locked_folio, start, len); + btrfs_folio_clamp_clear_writeback(fs_info, locked_folio, start, len); + + for (pgoff_t index = start_index; index <= end_index; index++) { + struct folio *folio; + + /* Already handled at the beginning. */ + if (index == locked_folio->index) + continue; + folio = __filemap_get_folio(mapping, index, FGP_LOCK, GFP_NOFS); + /* Cache already dropped, no need to do any cleanup. */ + if (IS_ERR(folio)) + continue; + btrfs_folio_clamp_clear_dirty(fs_info, folio, start, len); + btrfs_folio_clamp_set_writeback(fs_info, folio, start, len); + btrfs_folio_clamp_clear_writeback(fs_info, folio, start, len); + folio_unlock(folio); + folio_put(folio); + } + mapping_set_error(mapping, error); +} + /* * when nowcow writeback call back. This checks for snapshots or COW copies * of the extents that exist in the file, and COWs the file as required. @@ -2217,7 +2259,6 @@ static noinline int run_delalloc_nocow(struct btrfs_inode *inode, cow_start = cur_offset; if (cow_start != (u64)-1) { - cur_offset = end; ret = fallback_to_cow(inode, locked_folio, cow_start, end); cow_start = (u64)-1; if (ret) @@ -2228,6 +2269,22 @@ static noinline int run_delalloc_nocow(struct btrfs_inode *inode, return 0; error: + /* + * We have some range with ordered extent created. + * + * Ordered extents and extent maps will be cleaned up by + * btrfs_mark_ordered_io_finished() later, but we also need to cleanup + * the dirty flags of folios. + * + * Or they can be written back again, but without any EXTENT_DELALLOC flag + * in io tree. + * This will force the writeback to go COW fixup, which is being deprecated. + * + * Also such left-over dirty flags do no follow the error handling protocol. + */ + if (cur_offset > start) + cleanup_dirty_folios(inode, locked_folio, start, cur_offset - 1, ret); + /* * If an error happened while a COW region is outstanding, cur_offset * needs to be reset to cow_start to ensure the COW region is unlocked -- 2.47.1

4 months, 4 weeks

1
1
0 0

[for-linus][PATCH 1/2] tracing: Fix cmp_entries_dup() to respect sort() comparison rules

by Steven Rostedt

From: Kuan-Wei Chiu <visitorckw(a)gmail.com> The cmp_entries_dup() function used as the comparator for sort() violated the symmetry and transitivity properties required by the sorting algorithm. Specifically, it returned 1 whenever memcmp() was non-zero, which broke the following expectations: * Symmetry: If x < y, then y > x. * Transitivity: If x < y and y < z, then x < z. These violations could lead to incorrect sorting and failure to correctly identify duplicate elements. Fix the issue by directly returning the result of memcmp(), which adheres to the required comparison properties. Cc: stable(a)vger.kernel.org Fixes: 08d43a5fa063 ("tracing: Add lock-free tracing_map") Link: https://lore.kernel.org/20241203202228.1274403-1-visitorckw@gmail.com Signed-off-by: Kuan-Wei Chiu <visitorckw(a)gmail.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> --- kernel/trace/tracing_map.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c index 3a56e7c8aa4f..1921ade45be3 100644 --- a/kernel/trace/tracing_map.c +++ b/kernel/trace/tracing_map.c @@ -845,15 +845,11 @@ int tracing_map_init(struct tracing_map *map) static int cmp_entries_dup(const void *A, const void *B) { const struct tracing_map_sort_entry *a, *b; - int ret = 0; a = *(const struct tracing_map_sort_entry **)A; b = *(const struct tracing_map_sort_entry **)B; - if (memcmp(a->key, b->key, a->elt->map->key_size)) - ret = 1; - - return ret; + return memcmp(a->key, b->key, a->elt->map->key_size); } static int cmp_entries_sum(const void *A, const void *B) -- 2.45.2

4 months, 4 weeks

1
0
0 0

[PATCH v2] ufs: core: add missing post notify for power mode change

by peter.wang＠mediatek.com

From: Peter Wang <peter.wang(a)mediatek.com> When the power mode change is successful but the power mode hasn't actually changed, the post notification was missed. Similar to the approach with hibernate/clock scale/hce enable, having pre/post notifications in the same function will make it easier to maintain. Additionally, supplement the description of power parameters for the pwr_change_notify callback. Fixes: 7eb584db73be ("ufs: refactor configuring power mode") Cc: stable(a)vger.kernel.org #6.11.x Signed-off-by: Peter Wang <peter.wang(a)mediatek.com> --- drivers/ufs/core/ufshcd.c | 7 ++++--- include/ufs/ufshcd.h | 10 ++++++---- 2 files changed, 10 insertions(+), 7 deletions(-) diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index abbe7135a977..814402e93a1e 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -4651,9 +4651,6 @@ static int ufshcd_change_power_mode(struct ufs_hba *hba, dev_err(hba->dev, "%s: power mode change failed %d\n", __func__, ret); } else { - ufshcd_vops_pwr_change_notify(hba, POST_CHANGE, NULL, - pwr_mode); - memcpy(&hba->pwr_info, pwr_mode, sizeof(struct ufs_pa_layer_attr)); } @@ -4682,6 +4679,10 @@ int ufshcd_config_pwr_mode(struct ufs_hba *hba, ret = ufshcd_change_power_mode(hba, &final_params); + if (!ret) + ufshcd_vops_pwr_change_notify(hba, POST_CHANGE, NULL, + &final_params); + return ret; } EXPORT_SYMBOL_GPL(ufshcd_config_pwr_mode); diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h index 3f68ae3e4330..1db754b4a4d6 100644 --- a/include/ufs/ufshcd.h +++ b/include/ufs/ufshcd.h @@ -308,7 +308,9 @@ struct ufs_pwr_mode_info { * to allow variant specific Uni-Pro initialization. * @pwr_change_notify: called before and after a power mode change * is carried out to allow vendor spesific capabilities - * to be set. + * to be set. PRE_CHANGE can modify final_params based + * on desired_pwr_mode, but POST_CHANGE must not alter + * the final_params parameter * @setup_xfer_req: called before any transfer request is issued * to set some things * @setup_task_mgmt: called before any task management request is issued @@ -350,9 +352,9 @@ struct ufs_hba_variant_ops { int (*link_startup_notify)(struct ufs_hba *, enum ufs_notify_change_status); int (*pwr_change_notify)(struct ufs_hba *, - enum ufs_notify_change_status status, - struct ufs_pa_layer_attr *, - struct ufs_pa_layer_attr *); + enum ufs_notify_change_status status, + struct ufs_pa_layer_attr *desired_pwr_mode, + struct ufs_pa_layer_attr *final_params); void (*setup_xfer_req)(struct ufs_hba *hba, int tag, bool is_scsi_cmd); void (*setup_task_mgmt)(struct ufs_hba *, int, u8); -- 2.18.0

4 months, 4 weeks

3
2
0 0

[PATCH V2 1/2] LoongArch: KVM: Protect kvm_check_requests() with SRCU

by Huacai Chen

When we enable lockdep we get such a warning: ============================= WARNING: suspicious RCU usage 6.12.0-rc7+ #1891 Tainted: G W ----------------------------- include/linux/kvm_host.h:1043 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by qemu-system-loo/948: #0: 90000001184a00a8 (&vcpu->mutex){+.+.}-{4:4}, at: kvm_vcpu_ioctl+0xf4/0xe20 [kvm] stack backtrace: CPU: 0 UID: 0 PID: 948 Comm: qemu-system-loo Tainted: G W 6.12.0-rc7+ #1891 Tainted: [W]=WARN Hardware name: Loongson Loongson-3A5000-7A1000-1w-CRB/Loongson-LS3A5000-7A1000-1w-CRB, BIOS vUDK2018-LoongArch-V2.0.0-prebeta9 10/21/2022 Stack : 0000000000000089 9000000005a0db9c 90000000071519c8 900000012c578000 900000012c57b920 0000000000000000 900000012c57b928 9000000007e53788 900000000815bcc8 900000000815bcc0 900000012c57b790 0000000000000001 0000000000000001 4b031894b9d6b725 0000000004dec000 90000001003299c0 0000000000000414 0000000000000001 000000000000002d 0000000000000003 0000000000000030 00000000000003b4 0000000004dec000 90000001184a0000 900000000806d000 9000000007e53788 00000000000000b4 0000000000000004 0000000000000004 0000000000000000 0000000000000000 9000000107baf600 9000000008916000 9000000007e53788 9000000005924778 0000000010000044 00000000000000b0 0000000000000004 0000000000000000 0000000000071c1d ... Call Trace: [<9000000005924778>] show_stack+0x38/0x180 [<90000000071519c4>] dump_stack_lvl+0x94/0xe4 [<90000000059eb754>] lockdep_rcu_suspicious+0x194/0x240 [<ffff8000022143bc>] kvm_gfn_to_hva_cache_init+0xfc/0x120 [kvm] [<ffff80000222ade4>] kvm_pre_enter_guest+0x3a4/0x520 [kvm] [<ffff80000222b3dc>] kvm_handle_exit+0x23c/0x480 [kvm] Fix it by protecting kvm_check_requests() with SRCU. Cc: stable(a)vger.kernel.org Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> --- arch/loongarch/kvm/vcpu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/loongarch/kvm/vcpu.c b/arch/loongarch/kvm/vcpu.c index cab1818be68d..d18a4a270415 100644 --- a/arch/loongarch/kvm/vcpu.c +++ b/arch/loongarch/kvm/vcpu.c @@ -240,7 +240,7 @@ static void kvm_late_check_requests(struct kvm_vcpu *vcpu) */ static int kvm_enter_guest_check(struct kvm_vcpu *vcpu) { - int ret; + int idx, ret; /* * Check conditions before entering the guest @@ -249,7 +249,9 @@ static int kvm_enter_guest_check(struct kvm_vcpu *vcpu) if (ret < 0) return ret; + idx = srcu_read_lock(&vcpu->kvm->srcu); ret = kvm_check_requests(vcpu); + srcu_read_unlock(&vcpu->kvm->srcu, idx); return ret; } -- 2.43.5

4 months, 4 weeks

2
2
0 0

[PATCH AUTOSEL 4.19] misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle

by Sasha Levin

From: Parker Newman <pnewman(a)connecttech.com> [ Upstream commit 7738a7ab9d12c5371ed97114ee2132d4512e9fd5 ] Add a quirk similar to eeprom_93xx46 to add an extra clock cycle before reading data from the EEPROM. The 93Cx6 family of EEPROMs output a "dummy 0 bit" between the writing of the op-code/address from the host to the EEPROM and the reading of the actual data from the EEPROM. More info can be found on page 6 of the AT93C46 datasheet (linked below). Similar notes are found in other 93xx6 datasheets. In summary the read operation for a 93Cx6 EEPROM is: Write to EEPROM: 110[A5-A0] (9 bits) Read from EEPROM: 0[D15-D0] (17 bits) Where: 110 is the start bit and READ OpCode [A5-A0] is the address to read from 0 is a "dummy bit" preceding the actual data [D15-D0] is the actual data. Looking at the READ timing diagrams in the 93Cx6 datasheets the dummy bit should be clocked out on the last address bit clock cycle meaning it should be discarded naturally. However, depending on the hardware configuration sometimes this dummy bit is not discarded. This is the case with Exar PCI UARTs which require an extra clock cycle between sending the address and reading the data. Datasheet: https://ww1.microchip.com/downloads/en/DeviceDoc/Atmel-5193-SEEPROM-AT93C46… Reviewed-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Signed-off-by: Parker Newman <pnewman(a)connecttech.com> Link: https://lore.kernel.org/r/0f23973efefccd2544705a0480b4ad4c2353e407.17278809… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/misc/eeprom/eeprom_93cx6.c | 10 ++++++++++ include/linux/eeprom_93cx6.h | 11 +++++++++++ 2 files changed, 21 insertions(+) diff --git a/drivers/misc/eeprom/eeprom_93cx6.c b/drivers/misc/eeprom/eeprom_93cx6.c index 0cf2c9d676be8..31c69642f13e0 100644 --- a/drivers/misc/eeprom/eeprom_93cx6.c +++ b/drivers/misc/eeprom/eeprom_93cx6.c @@ -195,6 +195,11 @@ void eeprom_93cx6_read(struct eeprom_93cx6 *eeprom, const u8 word, eeprom_93cx6_write_bits(eeprom, command, PCI_EEPROM_WIDTH_OPCODE + eeprom->width); + if (has_quirk_extra_read_cycle(eeprom)) { + eeprom_93cx6_pulse_high(eeprom); + eeprom_93cx6_pulse_low(eeprom); + } + /* * Read the requested 16 bits. */ @@ -261,6 +266,11 @@ void eeprom_93cx6_readb(struct eeprom_93cx6 *eeprom, const u8 byte, eeprom_93cx6_write_bits(eeprom, command, PCI_EEPROM_WIDTH_OPCODE + eeprom->width + 1); + if (has_quirk_extra_read_cycle(eeprom)) { + eeprom_93cx6_pulse_high(eeprom); + eeprom_93cx6_pulse_low(eeprom); + } + /* * Read the requested 8 bits. */ diff --git a/include/linux/eeprom_93cx6.h b/include/linux/eeprom_93cx6.h index eb0b1988050ae..ec913059a5299 100644 --- a/include/linux/eeprom_93cx6.h +++ b/include/linux/eeprom_93cx6.h @@ -24,6 +24,8 @@ Supported chipsets: 93c46, 93c56 and 93c66. */ +#include <linux/bits.h> + /* * EEPROM operation defines. */ @@ -47,6 +49,7 @@ * @register_write(struct eeprom_93cx6 *eeprom): handler to * write to the eeprom register by using all reg_* fields. * @width: eeprom width, should be one of the PCI_EEPROM_WIDTH_* defines + * @quirks: eeprom or controller quirks * @drive_data: Set if we're driving the data line. * @reg_data_in: register field to indicate data input * @reg_data_out: register field to indicate data output @@ -63,6 +66,9 @@ struct eeprom_93cx6 { void (*register_write)(struct eeprom_93cx6 *eeprom); int width; + unsigned int quirks; +/* Some EEPROMs require an extra clock cycle before reading */ +#define PCI_EEPROM_QUIRK_EXTRA_READ_CYCLE BIT(0) char drive_data; char reg_data_in; @@ -84,3 +90,8 @@ extern void eeprom_93cx6_wren(struct eeprom_93cx6 *eeprom, bool enable); extern void eeprom_93cx6_write(struct eeprom_93cx6 *eeprom, u8 addr, u16 data); + +static inline bool has_quirk_extra_read_cycle(struct eeprom_93cx6 *eeprom) +{ + return eeprom->quirks & PCI_EEPROM_QUIRK_EXTRA_READ_CYCLE; +} -- 2.43.0

4 months, 4 weeks

1
0
0 0

[PATCH AUTOSEL 5.4] misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle

by Sasha Levin

From: Parker Newman <pnewman(a)connecttech.com> [ Upstream commit 7738a7ab9d12c5371ed97114ee2132d4512e9fd5 ] Add a quirk similar to eeprom_93xx46 to add an extra clock cycle before reading data from the EEPROM. The 93Cx6 family of EEPROMs output a "dummy 0 bit" between the writing of the op-code/address from the host to the EEPROM and the reading of the actual data from the EEPROM. More info can be found on page 6 of the AT93C46 datasheet (linked below). Similar notes are found in other 93xx6 datasheets. In summary the read operation for a 93Cx6 EEPROM is: Write to EEPROM: 110[A5-A0] (9 bits) Read from EEPROM: 0[D15-D0] (17 bits) Where: 110 is the start bit and READ OpCode [A5-A0] is the address to read from 0 is a "dummy bit" preceding the actual data [D15-D0] is the actual data. Looking at the READ timing diagrams in the 93Cx6 datasheets the dummy bit should be clocked out on the last address bit clock cycle meaning it should be discarded naturally. However, depending on the hardware configuration sometimes this dummy bit is not discarded. This is the case with Exar PCI UARTs which require an extra clock cycle between sending the address and reading the data. Datasheet: https://ww1.microchip.com/downloads/en/DeviceDoc/Atmel-5193-SEEPROM-AT93C46… Reviewed-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Signed-off-by: Parker Newman <pnewman(a)connecttech.com> Link: https://lore.kernel.org/r/0f23973efefccd2544705a0480b4ad4c2353e407.17278809… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/misc/eeprom/eeprom_93cx6.c | 10 ++++++++++ include/linux/eeprom_93cx6.h | 11 +++++++++++ 2 files changed, 21 insertions(+) diff --git a/drivers/misc/eeprom/eeprom_93cx6.c b/drivers/misc/eeprom/eeprom_93cx6.c index 36a2eb837371b..6b42ba6705d3f 100644 --- a/drivers/misc/eeprom/eeprom_93cx6.c +++ b/drivers/misc/eeprom/eeprom_93cx6.c @@ -186,6 +186,11 @@ void eeprom_93cx6_read(struct eeprom_93cx6 *eeprom, const u8 word, eeprom_93cx6_write_bits(eeprom, command, PCI_EEPROM_WIDTH_OPCODE + eeprom->width); + if (has_quirk_extra_read_cycle(eeprom)) { + eeprom_93cx6_pulse_high(eeprom); + eeprom_93cx6_pulse_low(eeprom); + } + /* * Read the requested 16 bits. */ @@ -252,6 +257,11 @@ void eeprom_93cx6_readb(struct eeprom_93cx6 *eeprom, const u8 byte, eeprom_93cx6_write_bits(eeprom, command, PCI_EEPROM_WIDTH_OPCODE + eeprom->width + 1); + if (has_quirk_extra_read_cycle(eeprom)) { + eeprom_93cx6_pulse_high(eeprom); + eeprom_93cx6_pulse_low(eeprom); + } + /* * Read the requested 8 bits. */ diff --git a/include/linux/eeprom_93cx6.h b/include/linux/eeprom_93cx6.h index c860c72a921d0..3a485cc0e0fa0 100644 --- a/include/linux/eeprom_93cx6.h +++ b/include/linux/eeprom_93cx6.h @@ -11,6 +11,8 @@ Supported chipsets: 93c46, 93c56 and 93c66. */ +#include <linux/bits.h> + /* * EEPROM operation defines. */ @@ -34,6 +36,7 @@ * @register_write(struct eeprom_93cx6 *eeprom): handler to * write to the eeprom register by using all reg_* fields. * @width: eeprom width, should be one of the PCI_EEPROM_WIDTH_* defines + * @quirks: eeprom or controller quirks * @drive_data: Set if we're driving the data line. * @reg_data_in: register field to indicate data input * @reg_data_out: register field to indicate data output @@ -50,6 +53,9 @@ struct eeprom_93cx6 { void (*register_write)(struct eeprom_93cx6 *eeprom); int width; + unsigned int quirks; +/* Some EEPROMs require an extra clock cycle before reading */ +#define PCI_EEPROM_QUIRK_EXTRA_READ_CYCLE BIT(0) char drive_data; char reg_data_in; @@ -71,3 +77,8 @@ extern void eeprom_93cx6_wren(struct eeprom_93cx6 *eeprom, bool enable); extern void eeprom_93cx6_write(struct eeprom_93cx6 *eeprom, u8 addr, u16 data); + +static inline bool has_quirk_extra_read_cycle(struct eeprom_93cx6 *eeprom) +{ + return eeprom->quirks & PCI_EEPROM_QUIRK_EXTRA_READ_CYCLE; +} -- 2.43.0

4 months, 4 weeks

1
0
0 0

[PATCH AUTOSEL 5.10] misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle

by Sasha Levin

From: Parker Newman <pnewman(a)connecttech.com> [ Upstream commit 7738a7ab9d12c5371ed97114ee2132d4512e9fd5 ] Add a quirk similar to eeprom_93xx46 to add an extra clock cycle before reading data from the EEPROM. The 93Cx6 family of EEPROMs output a "dummy 0 bit" between the writing of the op-code/address from the host to the EEPROM and the reading of the actual data from the EEPROM. More info can be found on page 6 of the AT93C46 datasheet (linked below). Similar notes are found in other 93xx6 datasheets. In summary the read operation for a 93Cx6 EEPROM is: Write to EEPROM: 110[A5-A0] (9 bits) Read from EEPROM: 0[D15-D0] (17 bits) Where: 110 is the start bit and READ OpCode [A5-A0] is the address to read from 0 is a "dummy bit" preceding the actual data [D15-D0] is the actual data. Looking at the READ timing diagrams in the 93Cx6 datasheets the dummy bit should be clocked out on the last address bit clock cycle meaning it should be discarded naturally. However, depending on the hardware configuration sometimes this dummy bit is not discarded. This is the case with Exar PCI UARTs which require an extra clock cycle between sending the address and reading the data. Datasheet: https://ww1.microchip.com/downloads/en/DeviceDoc/Atmel-5193-SEEPROM-AT93C46… Reviewed-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Signed-off-by: Parker Newman <pnewman(a)connecttech.com> Link: https://lore.kernel.org/r/0f23973efefccd2544705a0480b4ad4c2353e407.17278809… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/misc/eeprom/eeprom_93cx6.c | 10 ++++++++++ include/linux/eeprom_93cx6.h | 11 +++++++++++ 2 files changed, 21 insertions(+) diff --git a/drivers/misc/eeprom/eeprom_93cx6.c b/drivers/misc/eeprom/eeprom_93cx6.c index 9627294fe3e95..4c9827fe92173 100644 --- a/drivers/misc/eeprom/eeprom_93cx6.c +++ b/drivers/misc/eeprom/eeprom_93cx6.c @@ -186,6 +186,11 @@ void eeprom_93cx6_read(struct eeprom_93cx6 *eeprom, const u8 word, eeprom_93cx6_write_bits(eeprom, command, PCI_EEPROM_WIDTH_OPCODE + eeprom->width); + if (has_quirk_extra_read_cycle(eeprom)) { + eeprom_93cx6_pulse_high(eeprom); + eeprom_93cx6_pulse_low(eeprom); + } + /* * Read the requested 16 bits. */ @@ -252,6 +257,11 @@ void eeprom_93cx6_readb(struct eeprom_93cx6 *eeprom, const u8 byte, eeprom_93cx6_write_bits(eeprom, command, PCI_EEPROM_WIDTH_OPCODE + eeprom->width + 1); + if (has_quirk_extra_read_cycle(eeprom)) { + eeprom_93cx6_pulse_high(eeprom); + eeprom_93cx6_pulse_low(eeprom); + } + /* * Read the requested 8 bits. */ diff --git a/include/linux/eeprom_93cx6.h b/include/linux/eeprom_93cx6.h index c860c72a921d0..3a485cc0e0fa0 100644 --- a/include/linux/eeprom_93cx6.h +++ b/include/linux/eeprom_93cx6.h @@ -11,6 +11,8 @@ Supported chipsets: 93c46, 93c56 and 93c66. */ +#include <linux/bits.h> + /* * EEPROM operation defines. */ @@ -34,6 +36,7 @@ * @register_write(struct eeprom_93cx6 *eeprom): handler to * write to the eeprom register by using all reg_* fields. * @width: eeprom width, should be one of the PCI_EEPROM_WIDTH_* defines + * @quirks: eeprom or controller quirks * @drive_data: Set if we're driving the data line. * @reg_data_in: register field to indicate data input * @reg_data_out: register field to indicate data output @@ -50,6 +53,9 @@ struct eeprom_93cx6 { void (*register_write)(struct eeprom_93cx6 *eeprom); int width; + unsigned int quirks; +/* Some EEPROMs require an extra clock cycle before reading */ +#define PCI_EEPROM_QUIRK_EXTRA_READ_CYCLE BIT(0) char drive_data; char reg_data_in; @@ -71,3 +77,8 @@ extern void eeprom_93cx6_wren(struct eeprom_93cx6 *eeprom, bool enable); extern void eeprom_93cx6_write(struct eeprom_93cx6 *eeprom, u8 addr, u16 data); + +static inline bool has_quirk_extra_read_cycle(struct eeprom_93cx6 *eeprom) +{ + return eeprom->quirks & PCI_EEPROM_QUIRK_EXTRA_READ_CYCLE; +} -- 2.43.0

4 months, 4 weeks

1
0
0 0

[PATCH AUTOSEL 5.15] misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle

by Sasha Levin

From: Parker Newman <pnewman(a)connecttech.com> [ Upstream commit 7738a7ab9d12c5371ed97114ee2132d4512e9fd5 ] Add a quirk similar to eeprom_93xx46 to add an extra clock cycle before reading data from the EEPROM. The 93Cx6 family of EEPROMs output a "dummy 0 bit" between the writing of the op-code/address from the host to the EEPROM and the reading of the actual data from the EEPROM. More info can be found on page 6 of the AT93C46 datasheet (linked below). Similar notes are found in other 93xx6 datasheets. In summary the read operation for a 93Cx6 EEPROM is: Write to EEPROM: 110[A5-A0] (9 bits) Read from EEPROM: 0[D15-D0] (17 bits) Where: 110 is the start bit and READ OpCode [A5-A0] is the address to read from 0 is a "dummy bit" preceding the actual data [D15-D0] is the actual data. Looking at the READ timing diagrams in the 93Cx6 datasheets the dummy bit should be clocked out on the last address bit clock cycle meaning it should be discarded naturally. However, depending on the hardware configuration sometimes this dummy bit is not discarded. This is the case with Exar PCI UARTs which require an extra clock cycle between sending the address and reading the data. Datasheet: https://ww1.microchip.com/downloads/en/DeviceDoc/Atmel-5193-SEEPROM-AT93C46… Reviewed-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Signed-off-by: Parker Newman <pnewman(a)connecttech.com> Link: https://lore.kernel.org/r/0f23973efefccd2544705a0480b4ad4c2353e407.17278809… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/misc/eeprom/eeprom_93cx6.c | 10 ++++++++++ include/linux/eeprom_93cx6.h | 11 +++++++++++ 2 files changed, 21 insertions(+) diff --git a/drivers/misc/eeprom/eeprom_93cx6.c b/drivers/misc/eeprom/eeprom_93cx6.c index 9627294fe3e95..4c9827fe92173 100644 --- a/drivers/misc/eeprom/eeprom_93cx6.c +++ b/drivers/misc/eeprom/eeprom_93cx6.c @@ -186,6 +186,11 @@ void eeprom_93cx6_read(struct eeprom_93cx6 *eeprom, const u8 word, eeprom_93cx6_write_bits(eeprom, command, PCI_EEPROM_WIDTH_OPCODE + eeprom->width); + if (has_quirk_extra_read_cycle(eeprom)) { + eeprom_93cx6_pulse_high(eeprom); + eeprom_93cx6_pulse_low(eeprom); + } + /* * Read the requested 16 bits. */ @@ -252,6 +257,11 @@ void eeprom_93cx6_readb(struct eeprom_93cx6 *eeprom, const u8 byte, eeprom_93cx6_write_bits(eeprom, command, PCI_EEPROM_WIDTH_OPCODE + eeprom->width + 1); + if (has_quirk_extra_read_cycle(eeprom)) { + eeprom_93cx6_pulse_high(eeprom); + eeprom_93cx6_pulse_low(eeprom); + } + /* * Read the requested 8 bits. */ diff --git a/include/linux/eeprom_93cx6.h b/include/linux/eeprom_93cx6.h index c860c72a921d0..3a485cc0e0fa0 100644 --- a/include/linux/eeprom_93cx6.h +++ b/include/linux/eeprom_93cx6.h @@ -11,6 +11,8 @@ Supported chipsets: 93c46, 93c56 and 93c66. */ +#include <linux/bits.h> + /* * EEPROM operation defines. */ @@ -34,6 +36,7 @@ * @register_write(struct eeprom_93cx6 *eeprom): handler to * write to the eeprom register by using all reg_* fields. * @width: eeprom width, should be one of the PCI_EEPROM_WIDTH_* defines + * @quirks: eeprom or controller quirks * @drive_data: Set if we're driving the data line. * @reg_data_in: register field to indicate data input * @reg_data_out: register field to indicate data output @@ -50,6 +53,9 @@ struct eeprom_93cx6 { void (*register_write)(struct eeprom_93cx6 *eeprom); int width; + unsigned int quirks; +/* Some EEPROMs require an extra clock cycle before reading */ +#define PCI_EEPROM_QUIRK_EXTRA_READ_CYCLE BIT(0) char drive_data; char reg_data_in; @@ -71,3 +77,8 @@ extern void eeprom_93cx6_wren(struct eeprom_93cx6 *eeprom, bool enable); extern void eeprom_93cx6_write(struct eeprom_93cx6 *eeprom, u8 addr, u16 data); + +static inline bool has_quirk_extra_read_cycle(struct eeprom_93cx6 *eeprom) +{ + return eeprom->quirks & PCI_EEPROM_QUIRK_EXTRA_READ_CYCLE; +} -- 2.43.0

4 months, 4 weeks

1
0
0 0

[PATCH AUTOSEL 6.1 1/4] misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle

by Sasha Levin

From: Parker Newman <pnewman(a)connecttech.com> [ Upstream commit 7738a7ab9d12c5371ed97114ee2132d4512e9fd5 ] Add a quirk similar to eeprom_93xx46 to add an extra clock cycle before reading data from the EEPROM. The 93Cx6 family of EEPROMs output a "dummy 0 bit" between the writing of the op-code/address from the host to the EEPROM and the reading of the actual data from the EEPROM. More info can be found on page 6 of the AT93C46 datasheet (linked below). Similar notes are found in other 93xx6 datasheets. In summary the read operation for a 93Cx6 EEPROM is: Write to EEPROM: 110[A5-A0] (9 bits) Read from EEPROM: 0[D15-D0] (17 bits) Where: 110 is the start bit and READ OpCode [A5-A0] is the address to read from 0 is a "dummy bit" preceding the actual data [D15-D0] is the actual data. Looking at the READ timing diagrams in the 93Cx6 datasheets the dummy bit should be clocked out on the last address bit clock cycle meaning it should be discarded naturally. However, depending on the hardware configuration sometimes this dummy bit is not discarded. This is the case with Exar PCI UARTs which require an extra clock cycle between sending the address and reading the data. Datasheet: https://ww1.microchip.com/downloads/en/DeviceDoc/Atmel-5193-SEEPROM-AT93C46… Reviewed-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Signed-off-by: Parker Newman <pnewman(a)connecttech.com> Link: https://lore.kernel.org/r/0f23973efefccd2544705a0480b4ad4c2353e407.17278809… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/misc/eeprom/eeprom_93cx6.c | 10 ++++++++++ include/linux/eeprom_93cx6.h | 11 +++++++++++ 2 files changed, 21 insertions(+) diff --git a/drivers/misc/eeprom/eeprom_93cx6.c b/drivers/misc/eeprom/eeprom_93cx6.c index 9627294fe3e95..4c9827fe92173 100644 --- a/drivers/misc/eeprom/eeprom_93cx6.c +++ b/drivers/misc/eeprom/eeprom_93cx6.c @@ -186,6 +186,11 @@ void eeprom_93cx6_read(struct eeprom_93cx6 *eeprom, const u8 word, eeprom_93cx6_write_bits(eeprom, command, PCI_EEPROM_WIDTH_OPCODE + eeprom->width); + if (has_quirk_extra_read_cycle(eeprom)) { + eeprom_93cx6_pulse_high(eeprom); + eeprom_93cx6_pulse_low(eeprom); + } + /* * Read the requested 16 bits. */ @@ -252,6 +257,11 @@ void eeprom_93cx6_readb(struct eeprom_93cx6 *eeprom, const u8 byte, eeprom_93cx6_write_bits(eeprom, command, PCI_EEPROM_WIDTH_OPCODE + eeprom->width + 1); + if (has_quirk_extra_read_cycle(eeprom)) { + eeprom_93cx6_pulse_high(eeprom); + eeprom_93cx6_pulse_low(eeprom); + } + /* * Read the requested 8 bits. */ diff --git a/include/linux/eeprom_93cx6.h b/include/linux/eeprom_93cx6.h index c860c72a921d0..3a485cc0e0fa0 100644 --- a/include/linux/eeprom_93cx6.h +++ b/include/linux/eeprom_93cx6.h @@ -11,6 +11,8 @@ Supported chipsets: 93c46, 93c56 and 93c66. */ +#include <linux/bits.h> + /* * EEPROM operation defines. */ @@ -34,6 +36,7 @@ * @register_write(struct eeprom_93cx6 *eeprom): handler to * write to the eeprom register by using all reg_* fields. * @width: eeprom width, should be one of the PCI_EEPROM_WIDTH_* defines + * @quirks: eeprom or controller quirks * @drive_data: Set if we're driving the data line. * @reg_data_in: register field to indicate data input * @reg_data_out: register field to indicate data output @@ -50,6 +53,9 @@ struct eeprom_93cx6 { void (*register_write)(struct eeprom_93cx6 *eeprom); int width; + unsigned int quirks; +/* Some EEPROMs require an extra clock cycle before reading */ +#define PCI_EEPROM_QUIRK_EXTRA_READ_CYCLE BIT(0) char drive_data; char reg_data_in; @@ -71,3 +77,8 @@ extern void eeprom_93cx6_wren(struct eeprom_93cx6 *eeprom, bool enable); extern void eeprom_93cx6_write(struct eeprom_93cx6 *eeprom, u8 addr, u16 data); + +static inline bool has_quirk_extra_read_cycle(struct eeprom_93cx6 *eeprom) +{ + return eeprom->quirks & PCI_EEPROM_QUIRK_EXTRA_READ_CYCLE; +} -- 2.43.0

4 months, 4 weeks

1
3
0 0

[PATCH AUTOSEL 6.6 1/6] misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle

by Sasha Levin

From: Parker Newman <pnewman(a)connecttech.com> [ Upstream commit 7738a7ab9d12c5371ed97114ee2132d4512e9fd5 ] Add a quirk similar to eeprom_93xx46 to add an extra clock cycle before reading data from the EEPROM. The 93Cx6 family of EEPROMs output a "dummy 0 bit" between the writing of the op-code/address from the host to the EEPROM and the reading of the actual data from the EEPROM. More info can be found on page 6 of the AT93C46 datasheet (linked below). Similar notes are found in other 93xx6 datasheets. In summary the read operation for a 93Cx6 EEPROM is: Write to EEPROM: 110[A5-A0] (9 bits) Read from EEPROM: 0[D15-D0] (17 bits) Where: 110 is the start bit and READ OpCode [A5-A0] is the address to read from 0 is a "dummy bit" preceding the actual data [D15-D0] is the actual data. Looking at the READ timing diagrams in the 93Cx6 datasheets the dummy bit should be clocked out on the last address bit clock cycle meaning it should be discarded naturally. However, depending on the hardware configuration sometimes this dummy bit is not discarded. This is the case with Exar PCI UARTs which require an extra clock cycle between sending the address and reading the data. Datasheet: https://ww1.microchip.com/downloads/en/DeviceDoc/Atmel-5193-SEEPROM-AT93C46… Reviewed-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Signed-off-by: Parker Newman <pnewman(a)connecttech.com> Link: https://lore.kernel.org/r/0f23973efefccd2544705a0480b4ad4c2353e407.17278809… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/misc/eeprom/eeprom_93cx6.c | 10 ++++++++++ include/linux/eeprom_93cx6.h | 11 +++++++++++ 2 files changed, 21 insertions(+) diff --git a/drivers/misc/eeprom/eeprom_93cx6.c b/drivers/misc/eeprom/eeprom_93cx6.c index 9627294fe3e95..4c9827fe92173 100644 --- a/drivers/misc/eeprom/eeprom_93cx6.c +++ b/drivers/misc/eeprom/eeprom_93cx6.c @@ -186,6 +186,11 @@ void eeprom_93cx6_read(struct eeprom_93cx6 *eeprom, const u8 word, eeprom_93cx6_write_bits(eeprom, command, PCI_EEPROM_WIDTH_OPCODE + eeprom->width); + if (has_quirk_extra_read_cycle(eeprom)) { + eeprom_93cx6_pulse_high(eeprom); + eeprom_93cx6_pulse_low(eeprom); + } + /* * Read the requested 16 bits. */ @@ -252,6 +257,11 @@ void eeprom_93cx6_readb(struct eeprom_93cx6 *eeprom, const u8 byte, eeprom_93cx6_write_bits(eeprom, command, PCI_EEPROM_WIDTH_OPCODE + eeprom->width + 1); + if (has_quirk_extra_read_cycle(eeprom)) { + eeprom_93cx6_pulse_high(eeprom); + eeprom_93cx6_pulse_low(eeprom); + } + /* * Read the requested 8 bits. */ diff --git a/include/linux/eeprom_93cx6.h b/include/linux/eeprom_93cx6.h index c860c72a921d0..3a485cc0e0fa0 100644 --- a/include/linux/eeprom_93cx6.h +++ b/include/linux/eeprom_93cx6.h @@ -11,6 +11,8 @@ Supported chipsets: 93c46, 93c56 and 93c66. */ +#include <linux/bits.h> + /* * EEPROM operation defines. */ @@ -34,6 +36,7 @@ * @register_write(struct eeprom_93cx6 *eeprom): handler to * write to the eeprom register by using all reg_* fields. * @width: eeprom width, should be one of the PCI_EEPROM_WIDTH_* defines + * @quirks: eeprom or controller quirks * @drive_data: Set if we're driving the data line. * @reg_data_in: register field to indicate data input * @reg_data_out: register field to indicate data output @@ -50,6 +53,9 @@ struct eeprom_93cx6 { void (*register_write)(struct eeprom_93cx6 *eeprom); int width; + unsigned int quirks; +/* Some EEPROMs require an extra clock cycle before reading */ +#define PCI_EEPROM_QUIRK_EXTRA_READ_CYCLE BIT(0) char drive_data; char reg_data_in; @@ -71,3 +77,8 @@ extern void eeprom_93cx6_wren(struct eeprom_93cx6 *eeprom, bool enable); extern void eeprom_93cx6_write(struct eeprom_93cx6 *eeprom, u8 addr, u16 data); + +static inline bool has_quirk_extra_read_cycle(struct eeprom_93cx6 *eeprom) +{ + return eeprom->quirks & PCI_EEPROM_QUIRK_EXTRA_READ_CYCLE; +} -- 2.43.0

4 months, 4 weeks

1
5
0 0

[PATCH AUTOSEL 6.11 1/7] misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle

by Sasha Levin

From: Parker Newman <pnewman(a)connecttech.com> [ Upstream commit 7738a7ab9d12c5371ed97114ee2132d4512e9fd5 ] Add a quirk similar to eeprom_93xx46 to add an extra clock cycle before reading data from the EEPROM. The 93Cx6 family of EEPROMs output a "dummy 0 bit" between the writing of the op-code/address from the host to the EEPROM and the reading of the actual data from the EEPROM. More info can be found on page 6 of the AT93C46 datasheet (linked below). Similar notes are found in other 93xx6 datasheets. In summary the read operation for a 93Cx6 EEPROM is: Write to EEPROM: 110[A5-A0] (9 bits) Read from EEPROM: 0[D15-D0] (17 bits) Where: 110 is the start bit and READ OpCode [A5-A0] is the address to read from 0 is a "dummy bit" preceding the actual data [D15-D0] is the actual data. Looking at the READ timing diagrams in the 93Cx6 datasheets the dummy bit should be clocked out on the last address bit clock cycle meaning it should be discarded naturally. However, depending on the hardware configuration sometimes this dummy bit is not discarded. This is the case with Exar PCI UARTs which require an extra clock cycle between sending the address and reading the data. Datasheet: https://ww1.microchip.com/downloads/en/DeviceDoc/Atmel-5193-SEEPROM-AT93C46… Reviewed-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Signed-off-by: Parker Newman <pnewman(a)connecttech.com> Link: https://lore.kernel.org/r/0f23973efefccd2544705a0480b4ad4c2353e407.17278809… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/misc/eeprom/eeprom_93cx6.c | 10 ++++++++++ include/linux/eeprom_93cx6.h | 11 +++++++++++ 2 files changed, 21 insertions(+) diff --git a/drivers/misc/eeprom/eeprom_93cx6.c b/drivers/misc/eeprom/eeprom_93cx6.c index 9627294fe3e95..4c9827fe92173 100644 --- a/drivers/misc/eeprom/eeprom_93cx6.c +++ b/drivers/misc/eeprom/eeprom_93cx6.c @@ -186,6 +186,11 @@ void eeprom_93cx6_read(struct eeprom_93cx6 *eeprom, const u8 word, eeprom_93cx6_write_bits(eeprom, command, PCI_EEPROM_WIDTH_OPCODE + eeprom->width); + if (has_quirk_extra_read_cycle(eeprom)) { + eeprom_93cx6_pulse_high(eeprom); + eeprom_93cx6_pulse_low(eeprom); + } + /* * Read the requested 16 bits. */ @@ -252,6 +257,11 @@ void eeprom_93cx6_readb(struct eeprom_93cx6 *eeprom, const u8 byte, eeprom_93cx6_write_bits(eeprom, command, PCI_EEPROM_WIDTH_OPCODE + eeprom->width + 1); + if (has_quirk_extra_read_cycle(eeprom)) { + eeprom_93cx6_pulse_high(eeprom); + eeprom_93cx6_pulse_low(eeprom); + } + /* * Read the requested 8 bits. */ diff --git a/include/linux/eeprom_93cx6.h b/include/linux/eeprom_93cx6.h index c860c72a921d0..3a485cc0e0fa0 100644 --- a/include/linux/eeprom_93cx6.h +++ b/include/linux/eeprom_93cx6.h @@ -11,6 +11,8 @@ Supported chipsets: 93c46, 93c56 and 93c66. */ +#include <linux/bits.h> + /* * EEPROM operation defines. */ @@ -34,6 +36,7 @@ * @register_write(struct eeprom_93cx6 *eeprom): handler to * write to the eeprom register by using all reg_* fields. * @width: eeprom width, should be one of the PCI_EEPROM_WIDTH_* defines + * @quirks: eeprom or controller quirks * @drive_data: Set if we're driving the data line. * @reg_data_in: register field to indicate data input * @reg_data_out: register field to indicate data output @@ -50,6 +53,9 @@ struct eeprom_93cx6 { void (*register_write)(struct eeprom_93cx6 *eeprom); int width; + unsigned int quirks; +/* Some EEPROMs require an extra clock cycle before reading */ +#define PCI_EEPROM_QUIRK_EXTRA_READ_CYCLE BIT(0) char drive_data; char reg_data_in; @@ -71,3 +77,8 @@ extern void eeprom_93cx6_wren(struct eeprom_93cx6 *eeprom, bool enable); extern void eeprom_93cx6_write(struct eeprom_93cx6 *eeprom, u8 addr, u16 data); + +static inline bool has_quirk_extra_read_cycle(struct eeprom_93cx6 *eeprom) +{ + return eeprom->quirks & PCI_EEPROM_QUIRK_EXTRA_READ_CYCLE; +} -- 2.43.0

4 months, 4 weeks

1
6
0 0

[PATCH AUTOSEL 6.12 1/8] misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle

by Sasha Levin

From: Parker Newman <pnewman(a)connecttech.com> [ Upstream commit 7738a7ab9d12c5371ed97114ee2132d4512e9fd5 ] Add a quirk similar to eeprom_93xx46 to add an extra clock cycle before reading data from the EEPROM. The 93Cx6 family of EEPROMs output a "dummy 0 bit" between the writing of the op-code/address from the host to the EEPROM and the reading of the actual data from the EEPROM. More info can be found on page 6 of the AT93C46 datasheet (linked below). Similar notes are found in other 93xx6 datasheets. In summary the read operation for a 93Cx6 EEPROM is: Write to EEPROM: 110[A5-A0] (9 bits) Read from EEPROM: 0[D15-D0] (17 bits) Where: 110 is the start bit and READ OpCode [A5-A0] is the address to read from 0 is a "dummy bit" preceding the actual data [D15-D0] is the actual data. Looking at the READ timing diagrams in the 93Cx6 datasheets the dummy bit should be clocked out on the last address bit clock cycle meaning it should be discarded naturally. However, depending on the hardware configuration sometimes this dummy bit is not discarded. This is the case with Exar PCI UARTs which require an extra clock cycle between sending the address and reading the data. Datasheet: https://ww1.microchip.com/downloads/en/DeviceDoc/Atmel-5193-SEEPROM-AT93C46… Reviewed-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Signed-off-by: Parker Newman <pnewman(a)connecttech.com> Link: https://lore.kernel.org/r/0f23973efefccd2544705a0480b4ad4c2353e407.17278809… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/misc/eeprom/eeprom_93cx6.c | 10 ++++++++++ include/linux/eeprom_93cx6.h | 11 +++++++++++ 2 files changed, 21 insertions(+) diff --git a/drivers/misc/eeprom/eeprom_93cx6.c b/drivers/misc/eeprom/eeprom_93cx6.c index 9627294fe3e95..4c9827fe92173 100644 --- a/drivers/misc/eeprom/eeprom_93cx6.c +++ b/drivers/misc/eeprom/eeprom_93cx6.c @@ -186,6 +186,11 @@ void eeprom_93cx6_read(struct eeprom_93cx6 *eeprom, const u8 word, eeprom_93cx6_write_bits(eeprom, command, PCI_EEPROM_WIDTH_OPCODE + eeprom->width); + if (has_quirk_extra_read_cycle(eeprom)) { + eeprom_93cx6_pulse_high(eeprom); + eeprom_93cx6_pulse_low(eeprom); + } + /* * Read the requested 16 bits. */ @@ -252,6 +257,11 @@ void eeprom_93cx6_readb(struct eeprom_93cx6 *eeprom, const u8 byte, eeprom_93cx6_write_bits(eeprom, command, PCI_EEPROM_WIDTH_OPCODE + eeprom->width + 1); + if (has_quirk_extra_read_cycle(eeprom)) { + eeprom_93cx6_pulse_high(eeprom); + eeprom_93cx6_pulse_low(eeprom); + } + /* * Read the requested 8 bits. */ diff --git a/include/linux/eeprom_93cx6.h b/include/linux/eeprom_93cx6.h index c860c72a921d0..3a485cc0e0fa0 100644 --- a/include/linux/eeprom_93cx6.h +++ b/include/linux/eeprom_93cx6.h @@ -11,6 +11,8 @@ Supported chipsets: 93c46, 93c56 and 93c66. */ +#include <linux/bits.h> + /* * EEPROM operation defines. */ @@ -34,6 +36,7 @@ * @register_write(struct eeprom_93cx6 *eeprom): handler to * write to the eeprom register by using all reg_* fields. * @width: eeprom width, should be one of the PCI_EEPROM_WIDTH_* defines + * @quirks: eeprom or controller quirks * @drive_data: Set if we're driving the data line. * @reg_data_in: register field to indicate data input * @reg_data_out: register field to indicate data output @@ -50,6 +53,9 @@ struct eeprom_93cx6 { void (*register_write)(struct eeprom_93cx6 *eeprom); int width; + unsigned int quirks; +/* Some EEPROMs require an extra clock cycle before reading */ +#define PCI_EEPROM_QUIRK_EXTRA_READ_CYCLE BIT(0) char drive_data; char reg_data_in; @@ -71,3 +77,8 @@ extern void eeprom_93cx6_wren(struct eeprom_93cx6 *eeprom, bool enable); extern void eeprom_93cx6_write(struct eeprom_93cx6 *eeprom, u8 addr, u16 data); + +static inline bool has_quirk_extra_read_cycle(struct eeprom_93cx6 *eeprom) +{ + return eeprom->quirks & PCI_EEPROM_QUIRK_EXTRA_READ_CYCLE; +} -- 2.43.0

4 months, 4 weeks

1
7
0 0

[PATCH AUTOSEL 6.6] fs/ntfs3: Fix case when unmarked clusters intersect with zone

by Sasha Levin

From: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> [ Upstream commit 5fc982fe7eca9d0cf7b25832450ebd4f7c8e1c36 ] Reported-by: syzbot+7f3761b790fa41d0f3d5(a)syzkaller.appspotmail.com Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- fs/ntfs3/run.c | 40 ++++++++++++++++++++++++++++++---------- 1 file changed, 30 insertions(+), 10 deletions(-) diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c index cb8cf0161177b..44e93ad491ba7 100644 --- a/fs/ntfs3/run.c +++ b/fs/ntfs3/run.c @@ -1053,8 +1053,8 @@ int run_unpack_ex(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, { int ret, err; CLST next_vcn, lcn, len; - size_t index; - bool ok; + size_t index, done; + bool ok, zone; struct wnd_bitmap *wnd; ret = run_unpack(run, sbi, ino, svcn, evcn, vcn, run_buf, run_buf_size); @@ -1085,8 +1085,9 @@ int run_unpack_ex(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, continue; down_read_nested(&wnd->rw_lock, BITMAP_MUTEX_CLUSTERS); + zone = max(wnd->zone_bit, lcn) < min(wnd->zone_end, lcn + len); /* Check for free blocks. */ - ok = wnd_is_used(wnd, lcn, len); + ok = !zone && wnd_is_used(wnd, lcn, len); up_read(&wnd->rw_lock); if (ok) continue; @@ -1094,14 +1095,33 @@ int run_unpack_ex(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, /* Looks like volume is corrupted. */ ntfs_set_state(sbi, NTFS_DIRTY_ERROR); - if (down_write_trylock(&wnd->rw_lock)) { - /* Mark all zero bits as used in range [lcn, lcn+len). */ - size_t done; - err = wnd_set_used_safe(wnd, lcn, len, &done); - up_write(&wnd->rw_lock); - if (err) - return err; + if (!down_write_trylock(&wnd->rw_lock)) + continue; + + if (zone) { + /* + * Range [lcn, lcn + len) intersects with zone. + * To avoid complex with zone just turn it off. + */ + wnd_zone_set(wnd, 0, 0); + } + + /* Mark all zero bits as used in range [lcn, lcn+len). */ + err = wnd_set_used_safe(wnd, lcn, len, &done); + if (zone) { + /* Restore zone. Lock mft run. */ + struct rw_semaphore *lock; + lock = is_mounted(sbi) ? &sbi->mft.ni->file.run_lock : + NULL; + if (lock) + down_read(lock); + ntfs_refresh_zone(sbi); + if (lock) + up_read(lock); } + up_write(&wnd->rw_lock); + if (err) + return err; } return ret; -- 2.43.0

4 months, 4 weeks

1
0
0 0

[PATCH AUTOSEL 6.11 1/2] fs/ntfs3: Fix case when unmarked clusters intersect with zone

by Sasha Levin

From: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> [ Upstream commit 5fc982fe7eca9d0cf7b25832450ebd4f7c8e1c36 ] Reported-by: syzbot+7f3761b790fa41d0f3d5(a)syzkaller.appspotmail.com Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- fs/ntfs3/run.c | 40 ++++++++++++++++++++++++++++++---------- 1 file changed, 30 insertions(+), 10 deletions(-) diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c index cb8cf0161177b..44e93ad491ba7 100644 --- a/fs/ntfs3/run.c +++ b/fs/ntfs3/run.c @@ -1053,8 +1053,8 @@ int run_unpack_ex(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, { int ret, err; CLST next_vcn, lcn, len; - size_t index; - bool ok; + size_t index, done; + bool ok, zone; struct wnd_bitmap *wnd; ret = run_unpack(run, sbi, ino, svcn, evcn, vcn, run_buf, run_buf_size); @@ -1085,8 +1085,9 @@ int run_unpack_ex(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, continue; down_read_nested(&wnd->rw_lock, BITMAP_MUTEX_CLUSTERS); + zone = max(wnd->zone_bit, lcn) < min(wnd->zone_end, lcn + len); /* Check for free blocks. */ - ok = wnd_is_used(wnd, lcn, len); + ok = !zone && wnd_is_used(wnd, lcn, len); up_read(&wnd->rw_lock); if (ok) continue; @@ -1094,14 +1095,33 @@ int run_unpack_ex(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, /* Looks like volume is corrupted. */ ntfs_set_state(sbi, NTFS_DIRTY_ERROR); - if (down_write_trylock(&wnd->rw_lock)) { - /* Mark all zero bits as used in range [lcn, lcn+len). */ - size_t done; - err = wnd_set_used_safe(wnd, lcn, len, &done); - up_write(&wnd->rw_lock); - if (err) - return err; + if (!down_write_trylock(&wnd->rw_lock)) + continue; + + if (zone) { + /* + * Range [lcn, lcn + len) intersects with zone. + * To avoid complex with zone just turn it off. + */ + wnd_zone_set(wnd, 0, 0); + } + + /* Mark all zero bits as used in range [lcn, lcn+len). */ + err = wnd_set_used_safe(wnd, lcn, len, &done); + if (zone) { + /* Restore zone. Lock mft run. */ + struct rw_semaphore *lock; + lock = is_mounted(sbi) ? &sbi->mft.ni->file.run_lock : + NULL; + if (lock) + down_read(lock); + ntfs_refresh_zone(sbi); + if (lock) + up_read(lock); } + up_write(&wnd->rw_lock); + if (err) + return err; } return ret; -- 2.43.0

4 months, 4 weeks

1
1
0 0

[PATCH AUTOSEL 6.12 1/3] fs/ntfs3: Fix warning in ni_fiemap

by Sasha Levin

From: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> [ Upstream commit e2705dd3d16d1000f1fd8193d82447065de8c899 ] Use local runs_tree instead of cached. This way excludes rw_semaphore lock. Reported-by: syzbot+1c25748a40fe79b8a119(a)syzkaller.appspotmail.com Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- fs/ntfs3/attrib.c | 9 ++-- fs/ntfs3/frecord.c | 103 +++++++-------------------------------------- fs/ntfs3/ntfs_fs.h | 3 +- 3 files changed, 21 insertions(+), 94 deletions(-) diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c index 0763202d00c99..8d789b017fa9b 100644 --- a/fs/ntfs3/attrib.c +++ b/fs/ntfs3/attrib.c @@ -977,7 +977,7 @@ int attr_data_get_block(struct ntfs_inode *ni, CLST vcn, CLST clen, CLST *lcn, /* Check for compressed frame. */ err = attr_is_frame_compressed(ni, attr_b, vcn >> NTFS_LZNT_CUNIT, - &hint); + &hint, run); if (err) goto out; @@ -1521,16 +1521,16 @@ int attr_wof_frame_info(struct ntfs_inode *ni, struct ATTRIB *attr, * attr_is_frame_compressed - Used to detect compressed frame. * * attr - base (primary) attribute segment. + * run - run to use, usually == &ni->file.run. * Only base segments contains valid 'attr->nres.c_unit' */ int attr_is_frame_compressed(struct ntfs_inode *ni, struct ATTRIB *attr, - CLST frame, CLST *clst_data) + CLST frame, CLST *clst_data, struct runs_tree *run) { int err; u32 clst_frame; CLST clen, lcn, vcn, alen, slen, vcn_next; size_t idx; - struct runs_tree *run; *clst_data = 0; @@ -1542,7 +1542,6 @@ int attr_is_frame_compressed(struct ntfs_inode *ni, struct ATTRIB *attr, clst_frame = 1u << attr->nres.c_unit; vcn = frame * clst_frame; - run = &ni->file.run; if (!run_lookup_entry(run, vcn, &lcn, &clen, &idx)) { err = attr_load_runs_vcn(ni, attr->type, attr_name(attr), @@ -1678,7 +1677,7 @@ int attr_allocate_frame(struct ntfs_inode *ni, CLST frame, size_t compr_size, if (err) goto out; - err = attr_is_frame_compressed(ni, attr_b, frame, &clst_data); + err = attr_is_frame_compressed(ni, attr_b, frame, &clst_data, run); if (err) goto out; diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c index 41c7ffad27901..c33e818b3164c 100644 --- a/fs/ntfs3/frecord.c +++ b/fs/ntfs3/frecord.c @@ -1900,46 +1900,6 @@ enum REPARSE_SIGN ni_parse_reparse(struct ntfs_inode *ni, struct ATTRIB *attr, return REPARSE_LINK; } -/* - * fiemap_fill_next_extent_k - a copy of fiemap_fill_next_extent - * but it uses 'fe_k' instead of fieinfo->fi_extents_start - */ -static int fiemap_fill_next_extent_k(struct fiemap_extent_info *fieinfo, - struct fiemap_extent *fe_k, u64 logical, - u64 phys, u64 len, u32 flags) -{ - struct fiemap_extent extent; - - /* only count the extents */ - if (fieinfo->fi_extents_max == 0) { - fieinfo->fi_extents_mapped++; - return (flags & FIEMAP_EXTENT_LAST) ? 1 : 0; - } - - if (fieinfo->fi_extents_mapped >= fieinfo->fi_extents_max) - return 1; - - if (flags & FIEMAP_EXTENT_DELALLOC) - flags |= FIEMAP_EXTENT_UNKNOWN; - if (flags & FIEMAP_EXTENT_DATA_ENCRYPTED) - flags |= FIEMAP_EXTENT_ENCODED; - if (flags & (FIEMAP_EXTENT_DATA_TAIL | FIEMAP_EXTENT_DATA_INLINE)) - flags |= FIEMAP_EXTENT_NOT_ALIGNED; - - memset(&extent, 0, sizeof(extent)); - extent.fe_logical = logical; - extent.fe_physical = phys; - extent.fe_length = len; - extent.fe_flags = flags; - - memcpy(fe_k + fieinfo->fi_extents_mapped, &extent, sizeof(extent)); - - fieinfo->fi_extents_mapped++; - if (fieinfo->fi_extents_mapped == fieinfo->fi_extents_max) - return 1; - return (flags & FIEMAP_EXTENT_LAST) ? 1 : 0; -} - /* * ni_fiemap - Helper for file_fiemap(). * @@ -1950,11 +1910,9 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo, __u64 vbo, __u64 len) { int err = 0; - struct fiemap_extent *fe_k = NULL; struct ntfs_sb_info *sbi = ni->mi.sbi; u8 cluster_bits = sbi->cluster_bits; - struct runs_tree *run; - struct rw_semaphore *run_lock; + struct runs_tree run; struct ATTRIB *attr; CLST vcn = vbo >> cluster_bits; CLST lcn, clen; @@ -1965,13 +1923,11 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo, u32 flags; bool ok; + run_init(&run); if (S_ISDIR(ni->vfs_inode.i_mode)) { - run = &ni->dir.alloc_run; attr = ni_find_attr(ni, NULL, NULL, ATTR_ALLOC, I30_NAME, ARRAY_SIZE(I30_NAME), NULL, NULL); - run_lock = &ni->dir.run_lock; } else { - run = &ni->file.run; attr = ni_find_attr(ni, NULL, NULL, ATTR_DATA, NULL, 0, NULL, NULL); if (!attr) { @@ -1986,7 +1942,6 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo, "fiemap is not supported for compressed file (cp -r)"); goto out; } - run_lock = &ni->file.run_lock; } if (!attr || !attr->non_res) { @@ -1998,51 +1953,33 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo, goto out; } - /* - * To avoid lock problems replace pointer to user memory by pointer to kernel memory. - */ - fe_k = kmalloc_array(fieinfo->fi_extents_max, - sizeof(struct fiemap_extent), - GFP_NOFS | __GFP_ZERO); - if (!fe_k) { - err = -ENOMEM; - goto out; - } - end = vbo + len; alloc_size = le64_to_cpu(attr->nres.alloc_size); if (end > alloc_size) end = alloc_size; - down_read(run_lock); while (vbo < end) { if (idx == -1) { - ok = run_lookup_entry(run, vcn, &lcn, &clen, &idx); + ok = run_lookup_entry(&run, vcn, &lcn, &clen, &idx); } else { CLST vcn_next = vcn; - ok = run_get_entry(run, ++idx, &vcn, &lcn, &clen) && + ok = run_get_entry(&run, ++idx, &vcn, &lcn, &clen) && vcn == vcn_next; if (!ok) vcn = vcn_next; } if (!ok) { - up_read(run_lock); - down_write(run_lock); - err = attr_load_runs_vcn(ni, attr->type, attr_name(attr), - attr->name_len, run, vcn); - - up_write(run_lock); - down_read(run_lock); + attr->name_len, &run, vcn); if (err) break; - ok = run_lookup_entry(run, vcn, &lcn, &clen, &idx); + ok = run_lookup_entry(&run, vcn, &lcn, &clen, &idx); if (!ok) { err = -EINVAL; @@ -2067,8 +2004,9 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo, } else if (is_attr_compressed(attr)) { CLST clst_data; - err = attr_is_frame_compressed( - ni, attr, vcn >> attr->nres.c_unit, &clst_data); + err = attr_is_frame_compressed(ni, attr, + vcn >> attr->nres.c_unit, + &clst_data, &run); if (err) break; if (clst_data < NTFS_LZNT_CLUSTERS) @@ -2097,8 +2035,8 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo, if (vbo + dlen >= end) flags |= FIEMAP_EXTENT_LAST; - err = fiemap_fill_next_extent_k(fieinfo, fe_k, vbo, lbo, - dlen, flags); + err = fiemap_fill_next_extent(fieinfo, vbo, lbo, dlen, + flags); if (err < 0) break; @@ -2119,8 +2057,7 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo, if (vbo + bytes >= end) flags |= FIEMAP_EXTENT_LAST; - err = fiemap_fill_next_extent_k(fieinfo, fe_k, vbo, lbo, bytes, - flags); + err = fiemap_fill_next_extent(fieinfo, vbo, lbo, bytes, flags); if (err < 0) break; if (err == 1) { @@ -2131,19 +2068,8 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo, vbo += bytes; } - up_read(run_lock); - - /* - * Copy to user memory out of lock - */ - if (copy_to_user(fieinfo->fi_extents_start, fe_k, - fieinfo->fi_extents_max * - sizeof(struct fiemap_extent))) { - err = -EFAULT; - } - out: - kfree(fe_k); + run_close(&run); return err; } @@ -2672,7 +2598,8 @@ int ni_read_frame(struct ntfs_inode *ni, u64 frame_vbo, struct page **pages, down_write(&ni->file.run_lock); run_truncate_around(run, le64_to_cpu(attr->nres.svcn)); frame = frame_vbo >> (cluster_bits + NTFS_LZNT_CUNIT); - err = attr_is_frame_compressed(ni, attr, frame, &clst_data); + err = attr_is_frame_compressed(ni, attr, frame, &clst_data, + run); up_write(&ni->file.run_lock); if (err) goto out1; diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h index 26e1e1379c04e..cd8e8374bb5a0 100644 --- a/fs/ntfs3/ntfs_fs.h +++ b/fs/ntfs3/ntfs_fs.h @@ -446,7 +446,8 @@ int attr_wof_frame_info(struct ntfs_inode *ni, struct ATTRIB *attr, struct runs_tree *run, u64 frame, u64 frames, u8 frame_bits, u32 *ondisk_size, u64 *vbo_data); int attr_is_frame_compressed(struct ntfs_inode *ni, struct ATTRIB *attr, - CLST frame, CLST *clst_data); + CLST frame, CLST *clst_data, + struct runs_tree *run); int attr_allocate_frame(struct ntfs_inode *ni, CLST frame, size_t compr_size, u64 new_valid); int attr_collapse_range(struct ntfs_inode *ni, u64 vbo, u64 bytes); -- 2.43.0

4 months, 4 weeks

1
2
0 0

[PATCH AUTOSEL 6.1] LoongArch: Fix sleeping in atomic context for PREEMPT_RT

by Sasha Levin

From: Huacai Chen <chenhuacai(a)loongson.cn> [ Upstream commit 88fd2b70120d52c1010257d36776876941375490 ] Commit bab1c299f3945ffe79 ("LoongArch: Fix sleeping in atomic context in setup_tlb_handler()") changes the gfp flag from GFP_KERNEL to GFP_ATOMIC for alloc_pages_node(). However, for PREEMPT_RT kernels we can still get a "sleeping in atomic context" error: [ 0.372259] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 [ 0.372266] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1 [ 0.372268] preempt_count: 1, expected: 0 [ 0.372270] RCU nest depth: 1, expected: 1 [ 0.372272] 3 locks held by swapper/1/0: [ 0.372274] #0: 900000000c9f5e60 (&pcp->lock){+.+.}-{3:3}, at: get_page_from_freelist+0x524/0x1c60 [ 0.372294] #1: 90000000087013b8 (rcu_read_lock){....}-{1:3}, at: rt_spin_trylock+0x50/0x140 [ 0.372305] #2: 900000047fffd388 (&zone->lock){+.+.}-{3:3}, at: __rmqueue_pcplist+0x30c/0xea0 [ 0.372314] irq event stamp: 0 [ 0.372316] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 0.372322] hardirqs last disabled at (0): [<9000000005947320>] copy_process+0x9c0/0x26e0 [ 0.372329] softirqs last enabled at (0): [<9000000005947320>] copy_process+0x9c0/0x26e0 [ 0.372335] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 0.372341] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.12.0-rc7+ #1891 [ 0.372346] Hardware name: Loongson Loongson-3A5000-7A1000-1w-CRB/Loongson-LS3A5000-7A1000-1w-CRB, BIOS vUDK2018-LoongArch-V2.0.0-prebeta9 10/21/2022 [ 0.372349] Stack : 0000000000000089 9000000005a0db9c 90000000071519c8 9000000100388000 [ 0.372486] 900000010038b890 0000000000000000 900000010038b898 9000000007e53788 [ 0.372492] 900000000815bcc8 900000000815bcc0 900000010038b700 0000000000000001 [ 0.372498] 0000000000000001 4b031894b9d6b725 00000000055ec000 9000000100338fc0 [ 0.372503] 00000000000000c4 0000000000000001 000000000000002d 0000000000000003 [ 0.372509] 0000000000000030 0000000000000003 00000000055ec000 0000000000000003 [ 0.372515] 900000000806d000 9000000007e53788 00000000000000b0 0000000000000004 [ 0.372521] 0000000000000000 0000000000000000 900000000c9f5f10 0000000000000000 [ 0.372526] 90000000076f12d8 9000000007e53788 9000000005924778 0000000000000000 [ 0.372532] 00000000000000b0 0000000000000004 0000000000000000 0000000000070000 [ 0.372537] ... [ 0.372540] Call Trace: [ 0.372542] [<9000000005924778>] show_stack+0x38/0x180 [ 0.372548] [<90000000071519c4>] dump_stack_lvl+0x94/0xe4 [ 0.372555] [<900000000599b880>] __might_resched+0x1a0/0x260 [ 0.372561] [<90000000071675cc>] rt_spin_lock+0x4c/0x140 [ 0.372565] [<9000000005cbb768>] __rmqueue_pcplist+0x308/0xea0 [ 0.372570] [<9000000005cbed84>] get_page_from_freelist+0x564/0x1c60 [ 0.372575] [<9000000005cc0d98>] __alloc_pages_noprof+0x218/0x1820 [ 0.372580] [<900000000593b36c>] tlb_init+0x1ac/0x298 [ 0.372585] [<9000000005924b74>] per_cpu_trap_init+0x114/0x140 [ 0.372589] [<9000000005921964>] cpu_probe+0x4e4/0xa60 [ 0.372592] [<9000000005934874>] start_secondary+0x34/0xc0 [ 0.372599] [<900000000715615c>] smpboot_entry+0x64/0x6c This is because in PREEMPT_RT kernels normal spinlocks are replaced by rt spinlocks and rt_spin_lock() will cause sleeping. Fix it by disabling NUMA optimization completely for PREEMPT_RT kernels. Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- arch/loongarch/mm/tlb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/loongarch/mm/tlb.c b/arch/loongarch/mm/tlb.c index eeb2d815cfa2a..faf44cac403b4 100644 --- a/arch/loongarch/mm/tlb.c +++ b/arch/loongarch/mm/tlb.c @@ -279,7 +279,7 @@ void setup_tlb_handler(int cpu) /* Avoid lockdep warning */ rcu_cpu_starting(cpu); -#ifdef CONFIG_NUMA +#if defined(CONFIG_NUMA) && !defined(CONFIG_PREEMPT_RT) vec_sz = sizeof(exception_handlers); if (pcpu_handlers[cpu]) -- 2.43.0

4 months, 4 weeks

1
0
0 0

[PATCH AUTOSEL 6.6 1/3] ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 8 A1-840

by Sasha Levin

From: Hans de Goede <hdegoede(a)redhat.com> [ Upstream commit 82f250ed1a1dcde0ad2a1513f85af7f9514635e8 ] The Acer Iconia One 8 A1-840 (not to be confused with the A1-840FHD which is a different model) ships with Android 4.4 as factory OS and has the usual broken DSDT issues for x86 Android tablets. Add quirks to skip ACPI I2C client enumeration and disable ACPI battery/AC and ACPI GPIO event handlers. Also add the "INT33F5" HID for the TI PMIC used on this tablet to the list of HIDs for which not to skip i2c_client instantiation, since we do want an ACPI instantiated i2c_client for the PMIC. Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> Link: https://patch.msgid.link/20241116095825.11660-1-hdegoede@redhat.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/acpi/x86/utils.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c index e035cec614dc8..159ac2b19672d 100644 --- a/drivers/acpi/x86/utils.c +++ b/drivers/acpi/x86/utils.c @@ -299,6 +299,18 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = { ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY | ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS), }, + { + /* Acer Iconia One 8 A1-840 (non FHD version) */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Insyde"), + DMI_MATCH(DMI_PRODUCT_NAME, "BayTrail"), + /* Above strings are too generic also match BIOS date */ + DMI_MATCH(DMI_BIOS_DATE, "04/01/2014"), + }, + .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS | + ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY | + ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS), + }, { .matches = { DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), @@ -404,6 +416,7 @@ static const struct acpi_device_id i2c_acpi_known_good_ids[] = { { "10EC5640", 0 }, /* RealTek ALC5640 audio codec */ { "10EC5651", 0 }, /* RealTek ALC5651 audio codec */ { "INT33F4", 0 }, /* X-Powers AXP288 PMIC */ + { "INT33F5", 0 }, /* TI Dollar Cove PMIC */ { "INT33FD", 0 }, /* Intel Crystal Cove PMIC */ { "INT34D3", 0 }, /* Intel Whiskey Cove PMIC */ { "NPCE69A", 0 }, /* Asus Transformer keyboard dock */ -- 2.43.0

4 months, 4 weeks

1
2
0 0

[PATCH AUTOSEL 6.11 1/3] ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 8 A1-840

by Sasha Levin

From: Hans de Goede <hdegoede(a)redhat.com> [ Upstream commit 82f250ed1a1dcde0ad2a1513f85af7f9514635e8 ] The Acer Iconia One 8 A1-840 (not to be confused with the A1-840FHD which is a different model) ships with Android 4.4 as factory OS and has the usual broken DSDT issues for x86 Android tablets. Add quirks to skip ACPI I2C client enumeration and disable ACPI battery/AC and ACPI GPIO event handlers. Also add the "INT33F5" HID for the TI PMIC used on this tablet to the list of HIDs for which not to skip i2c_client instantiation, since we do want an ACPI instantiated i2c_client for the PMIC. Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> Link: https://patch.msgid.link/20241116095825.11660-1-hdegoede@redhat.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/acpi/x86/utils.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c index ab2b5fa83e1ff..24af6a10cc5fc 100644 --- a/drivers/acpi/x86/utils.c +++ b/drivers/acpi/x86/utils.c @@ -307,6 +307,18 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = { ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY | ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS), }, + { + /* Acer Iconia One 8 A1-840 (non FHD version) */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Insyde"), + DMI_MATCH(DMI_PRODUCT_NAME, "BayTrail"), + /* Above strings are too generic also match BIOS date */ + DMI_MATCH(DMI_BIOS_DATE, "04/01/2014"), + }, + .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS | + ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY | + ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS), + }, { .matches = { DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), @@ -412,6 +424,7 @@ static const struct acpi_device_id i2c_acpi_known_good_ids[] = { { "10EC5640", 0 }, /* RealTek ALC5640 audio codec */ { "10EC5651", 0 }, /* RealTek ALC5651 audio codec */ { "INT33F4", 0 }, /* X-Powers AXP288 PMIC */ + { "INT33F5", 0 }, /* TI Dollar Cove PMIC */ { "INT33FD", 0 }, /* Intel Crystal Cove PMIC */ { "INT34D3", 0 }, /* Intel Whiskey Cove PMIC */ { "NPCE69A", 0 }, /* Asus Transformer keyboard dock */ -- 2.43.0

4 months, 4 weeks

1
2
0 0

[PATCH AUTOSEL 6.12 1/3] ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 8 A1-840

by Sasha Levin

From: Hans de Goede <hdegoede(a)redhat.com> [ Upstream commit 82f250ed1a1dcde0ad2a1513f85af7f9514635e8 ] The Acer Iconia One 8 A1-840 (not to be confused with the A1-840FHD which is a different model) ships with Android 4.4 as factory OS and has the usual broken DSDT issues for x86 Android tablets. Add quirks to skip ACPI I2C client enumeration and disable ACPI battery/AC and ACPI GPIO event handlers. Also add the "INT33F5" HID for the TI PMIC used on this tablet to the list of HIDs for which not to skip i2c_client instantiation, since we do want an ACPI instantiated i2c_client for the PMIC. Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> Link: https://patch.msgid.link/20241116095825.11660-1-hdegoede@redhat.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/acpi/x86/utils.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c index 6af546b21574f..6d185a369f068 100644 --- a/drivers/acpi/x86/utils.c +++ b/drivers/acpi/x86/utils.c @@ -307,6 +307,18 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = { ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY | ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS), }, + { + /* Acer Iconia One 8 A1-840 (non FHD version) */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Insyde"), + DMI_MATCH(DMI_PRODUCT_NAME, "BayTrail"), + /* Above strings are too generic also match BIOS date */ + DMI_MATCH(DMI_BIOS_DATE, "04/01/2014"), + }, + .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS | + ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY | + ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS), + }, { .matches = { DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), @@ -411,6 +423,7 @@ static const struct acpi_device_id i2c_acpi_known_good_ids[] = { { "10EC5640", 0 }, /* RealTek ALC5640 audio codec */ { "10EC5651", 0 }, /* RealTek ALC5651 audio codec */ { "INT33F4", 0 }, /* X-Powers AXP288 PMIC */ + { "INT33F5", 0 }, /* TI Dollar Cove PMIC */ { "INT33FD", 0 }, /* Intel Crystal Cove PMIC */ { "INT34D3", 0 }, /* Intel Whiskey Cove PMIC */ { "NPCE69A", 0 }, /* Asus Transformer keyboard dock */ -- 2.43.0

4 months, 4 weeks

1
2
0 0

[PATCH 5.4] perf/x86/intel/pt: Fix buffer full but size is 0 case

by Adrian Hunter

commit 5b590160d2cf776b304eb054afafea2bd55e3620 upstream. If the trace data buffer becomes full, a truncated flag [T] is reported in PERF_RECORD_AUX. In some cases, the size reported is 0, even though data must have been added to make the buffer full. That happens when the buffer fills up from empty to full before the Intel PT driver has updated the buffer position. Then the driver calculates the new buffer position before calculating the data size. If the old and new positions are the same, the data size is reported as 0, even though it is really the whole buffer size. Fix by detecting when the buffer position is wrapped, and adjust the data size calculation accordingly. Example Use a very small buffer size (8K) and observe the size of truncated [T] data. Before the fix, it is possible to see records of 0 size. Before: $ perf record -m,8K -e intel_pt// uname Linux [ perf record: Woken up 2 times to write data ] [ perf record: Captured and wrote 0.105 MB perf.data ] $ perf script -D --no-itrace | grep AUX | grep -F '[T]' Warning: AUX data lost 2 times out of 3! 5 19462712368111 0x19710 [0x40]: PERF_RECORD_AUX offset: 0 size: 0 flags: 0x1 [T] 5 19462712700046 0x19ba8 [0x40]: PERF_RECORD_AUX offset: 0x170 size: 0xe90 flags: 0x1 [T] After: $ perf record -m,8K -e intel_pt// uname Linux [ perf record: Woken up 3 times to write data ] [ perf record: Captured and wrote 0.040 MB perf.data ] $ perf script -D --no-itrace | grep AUX | grep -F '[T]' Warning: AUX data lost 2 times out of 3! 1 113720802995 0x4948 [0x40]: PERF_RECORD_AUX offset: 0 size: 0x2000 flags: 0x1 [T] 1 113720979812 0x6b10 [0x40]: PERF_RECORD_AUX offset: 0x2000 size: 0x2000 flags: 0x1 [T] Fixes: 52ca9ced3f70 ("perf/x86/intel/pt: Add Intel PT PMU driver") Signed-off-by: Adrian Hunter <adrian.hunter(a)intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: stable(a)vger.kernel.org Link: https://lkml.kernel.org/r/20241022155920.17511-2-adrian.hunter@intel.com Signed-off-by: Adrian Hunter <adrian.hunter(a)intel.com> --- arch/x86/events/intel/pt.c | 11 ++++++++--- arch/x86/events/intel/pt.h | 2 ++ 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c index 99b286b6c200..622bfb9a2fe7 100644 --- a/arch/x86/events/intel/pt.c +++ b/arch/x86/events/intel/pt.c @@ -782,11 +782,13 @@ static void pt_buffer_advance(struct pt_buffer *buf) buf->cur_idx++; if (buf->cur_idx == buf->cur->last) { - if (buf->cur == buf->last) + if (buf->cur == buf->last) { buf->cur = buf->first; - else + buf->wrapped = true; + } else { buf->cur = list_entry(buf->cur->list.next, struct topa, list); + } buf->cur_idx = 0; } } @@ -800,8 +802,11 @@ static void pt_buffer_advance(struct pt_buffer *buf) static void pt_update_head(struct pt *pt) { struct pt_buffer *buf = perf_get_aux(&pt->handle); + bool wrapped = buf->wrapped; u64 topa_idx, base, old; + buf->wrapped = false; + /* offset of the first region in this table from the beginning of buf */ base = buf->cur->offset + buf->output_off; @@ -814,7 +819,7 @@ static void pt_update_head(struct pt *pt) } else { old = (local64_xchg(&buf->head, base) & ((buf->nr_pages << PAGE_SHIFT) - 1)); - if (base < old) + if (base < old || (base == old && wrapped)) base += buf->nr_pages << PAGE_SHIFT; local_add(base - old, &buf->data_size); diff --git a/arch/x86/events/intel/pt.h b/arch/x86/events/intel/pt.h index c2d00a072952..51674454c69d 100644 --- a/arch/x86/events/intel/pt.h +++ b/arch/x86/events/intel/pt.h @@ -64,6 +64,7 @@ struct pt_pmu { * @lost: if data was lost/truncated * @head: logical write offset inside the buffer * @snapshot: if this is for a snapshot/overwrite counter + * @wrapped: buffer advance wrapped back to the first topa table * @stop_pos: STOP topa entry index * @intr_pos: INT topa entry index * @stop_te: STOP topa entry pointer @@ -80,6 +81,7 @@ struct pt_buffer { local_t data_size; local64_t head; bool snapshot; + bool wrapped; long stop_pos, intr_pos; struct topa_entry *stop_te, *intr_te; void **data_pages; -- 2.43.0

4 months, 4 weeks

2
1
0 0

[PATCH] selinux: ignore unknown extended permissions

by Thiébaud Weksteen

When evaluating extended permissions, ignore unknown permissions instead of calling BUG(). This commit ensures that future permissions can be added without interfering with older kernels. Fixes: fa1aa143ac4a ("selinux: extended permissions for ioctls") Cc: stable(a)vger.kernel.org Signed-off-by: Thiébaud Weksteen <tweek(a)google.com> --- security/selinux/ss/services.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index 971c45d576ba..2fa8aebcb2e5 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -979,7 +979,8 @@ void services_compute_xperms_decision(struct extended_perms_decision *xpermd, return; break; default: - BUG(); + // An unknown extended permission has been found. Ignore it. + return; } if (node->key.specified == AVTAB_XPERMS_ALLOWED) { -- 2.47.0.338.g60cca15819-goog

4 months, 4 weeks

2
1
0 0

[PATCH] drm/xe: Wait for migration job before unmapping pages

by Nirmoy Das

There could be still migration job going on while doing xe_tt_unmap_sg() which could trigger GPU page faults. Fix this by waiting for the migration job to finish. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/3466 Fixes: 75521e8b56e8 ("drm/xe: Perform dma_map when moving system buffer objects to TT") Cc: Thomas Hellström <thomas.hellstrom(a)linux.intel.com> Cc: Matthew Brost <matthew.brost(a)intel.com> Cc: Lucas De Marchi <lucas.demarchi(a)intel.com> Cc: <stable(a)vger.kernel.org> # v6.11+ Signed-off-by: Nirmoy Das <nirmoy.das(a)intel.com> --- drivers/gpu/drm/xe/xe_bo.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c index 73689dd7d672..40c5c74e9306 100644 --- a/drivers/gpu/drm/xe/xe_bo.c +++ b/drivers/gpu/drm/xe/xe_bo.c @@ -857,8 +857,16 @@ static int xe_bo_move(struct ttm_buffer_object *ttm_bo, bool evict, out: if ((!ttm_bo->resource || ttm_bo->resource->mem_type == XE_PL_SYSTEM) && - ttm_bo->ttm) + ttm_bo->ttm) { + long timeout = dma_resv_wait_timeout(ttm_bo->base.resv, + DMA_RESV_USAGE_BOOKKEEP, + true, + MAX_SCHEDULE_TIMEOUT); + if (timeout < 0) + ret = timeout; + xe_tt_unmap_sg(ttm_bo->ttm); + } return ret; } -- 2.46.0

4 months, 4 weeks

1
0
0 0

+ zram-fix-uninitialized-zram-not-releasing-backing-device.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: zram: fix uninitialized ZRAM not releasing backing device has been added to the -mm mm-hotfixes-unstable branch. Its filename is zram-fix-uninitialized-zram-not-releasing-backing-device.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Kairui Song <kasong(a)tencent.com> Subject: zram: fix uninitialized ZRAM not releasing backing device Date: Thu, 5 Dec 2024 02:02:24 +0800 Setting backing device is done before ZRAM initialization. If we set the backing device, then remove the ZRAM module without initializing the device, the backing device reference will be leaked and the device will be hold forever. Fix this by always check and release the backing device when resetting or removing ZRAM. Link: https://lkml.kernel.org/r/20241204180224.31069-3-ryncsn@gmail.com Fixes: 013bf95a83ec ("zram: add interface to specif backing device") Signed-off-by: Kairui Song <kasong(a)tencent.com> Reported-by: Desheng Wu <deshengwu(a)tencent.com> Cc: Minchan Kim <minchan(a)kernel.org> Cc: Sergey Senozhatsky <senozhatsky(a)chromium.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- drivers/block/zram/zram_drv.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/block/zram/zram_drv.c~zram-fix-uninitialized-zram-not-releasing-backing-device +++ a/drivers/block/zram/zram_drv.c @@ -2335,6 +2335,9 @@ static void zram_reset_device(struct zra zram->limit_pages = 0; if (!init_done(zram)) { + /* Backing device could be set before ZRAM initialization. */ + reset_bdev(zram); + up_write(&zram->init_lock); return; } _ Patches currently in -mm which might be from kasong(a)tencent.com are zram-refuse-to-use-zero-sized-block-device-as-backing-device.patch zram-fix-uninitialized-zram-not-releasing-backing-device.patch

4 months, 4 weeks

1
0
0 0

+ zram-refuse-to-use-zero-sized-block-device-as-backing-device.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: zram: refuse to use zero sized block device as backing device has been added to the -mm mm-hotfixes-unstable branch. Its filename is zram-refuse-to-use-zero-sized-block-device-as-backing-device.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Kairui Song <kasong(a)tencent.com> Subject: zram: refuse to use zero sized block device as backing device Date: Thu, 5 Dec 2024 02:02:23 +0800 Patch series "zram: fix backing device setup issue". This series fixes two bugs of backing device setting: - ZRAM should reject using a zero sized (or the uninitialized ZRAM device itself) as the backing device. - Fix backing device leaking when removing a uninitialized ZRAM device. This patch (of 2): Setting a zero sized block device as backing device is pointless, and one can easily create a recursive loop by setting the uninitialized ZRAM device itself as its own backing device by (zram0 is uninitialized): echo /dev/zram0 > /sys/block/zram0/backing_dev It's definitely a wrong config, and the module will pin itself, kernel should refuse doing so in the first place. By refusing to use zero sized device we avoided misuse cases including this one above. Link: https://lkml.kernel.org/r/20241204180224.31069-1-ryncsn@gmail.com Link: https://lkml.kernel.org/r/20241204180224.31069-2-ryncsn@gmail.com Fixes: 013bf95a83ec ("zram: add interface to specif backing device") Signed-off-by: Kairui Song <kasong(a)tencent.com> Reported-by: Desheng Wu <deshengwu(a)tencent.com> Cc: Minchan Kim <minchan(a)kernel.org> Cc: Sergey Senozhatsky <senozhatsky(a)chromium.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- drivers/block/zram/zram_drv.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/block/zram/zram_drv.c~zram-refuse-to-use-zero-sized-block-device-as-backing-device +++ a/drivers/block/zram/zram_drv.c @@ -614,6 +614,12 @@ static ssize_t backing_dev_store(struct } nr_pages = i_size_read(inode) >> PAGE_SHIFT; + /* Refuse to use zero sized device (also prevents self reference) */ + if (!nr_pages) { + err = -EINVAL; + goto out; + } + bitmap_sz = BITS_TO_LONGS(nr_pages) * sizeof(long); bitmap = kvzalloc(bitmap_sz, GFP_KERNEL); if (!bitmap) { _ Patches currently in -mm which might be from kasong(a)tencent.com are zram-refuse-to-use-zero-sized-block-device-as-backing-device.patch zram-fix-uninitialized-zram-not-releasing-backing-device.patch

4 months, 4 weeks

1
0
0 0

[PATCH RESEND v2] drm/i915: Fix memory leak by correcting cache object name in error handler

by Jiasheng Jiang

From: Jiasheng Jiang <jiashengjiangcool(a)outlook.com> Replace "slab_priorities" with "slab_dependencies" in the error handler to avoid memory leak. Fixes: 32eb6bcfdda9 ("drm/i915: Make request allocation caches global") Cc: <stable(a)vger.kernel.org> # v5.2+ Reviewed-by: Nirmoy Das <nirmoy.das(a)intel.com> Signed-off-by: Jiasheng Jiang <jiashengjiangcool(a)outlook.com> --- Changelog: v1 -> v2: 1. Alter the subject. --- drivers/gpu/drm/i915/i915_scheduler.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/i915_scheduler.c b/drivers/gpu/drm/i915/i915_scheduler.c index 762127dd56c5..70a854557e6e 100644 --- a/drivers/gpu/drm/i915/i915_scheduler.c +++ b/drivers/gpu/drm/i915/i915_scheduler.c @@ -506,6 +506,6 @@ int __init i915_scheduler_module_init(void) return 0; err_priorities: - kmem_cache_destroy(slab_priorities); + kmem_cache_destroy(slab_dependencies); return -ENOMEM; } -- 2.25.1

4 months, 4 weeks

2
2
0 0

[tip: x86/urgent] x86/cpu: Add Lunar Lake to list of CPUs with a broken MONITOR implementation

by tip-bot2 for Len Brown

The following commit has been merged into the x86/urgent branch of tip: Commit-ID: c9a4b55431e5220347881e148725bed69c84e037 Gitweb: https://git.kernel.org/tip/c9a4b55431e5220347881e148725bed69c84e037 Author: Len Brown <len.brown(a)intel.com> AuthorDate: Tue, 12 Nov 2024 21:07:00 -05:00 Committer: Dave Hansen <dave.hansen(a)linux.intel.com> CommitterDate: Wed, 04 Dec 2024 12:30:14 -08:00 x86/cpu: Add Lunar Lake to list of CPUs with a broken MONITOR implementation Under some conditions, MONITOR wakeups on Lunar Lake processors can be lost, resulting in significant user-visible delays. Add Lunar Lake to X86_BUG_MONITOR so that wake_up_idle_cpu() always sends an IPI, avoiding this potential delay. Reported originally here: https://bugzilla.kernel.org/show_bug.cgi?id=219364 [ dhansen: tweak subject ] Signed-off-by: Len Brown <len.brown(a)intel.com> Signed-off-by: Dave Hansen <dave.hansen(a)linux.intel.com> Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Cc:stable@vger.kernel.org Link: https://lore.kernel.org/all/a4aa8842a3c3bfdb7fe9807710eef159cbf0e705.173146… --- arch/x86/kernel/cpu/intel.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c index d1de300..8ded9f8 100644 --- a/arch/x86/kernel/cpu/intel.c +++ b/arch/x86/kernel/cpu/intel.c @@ -555,7 +555,9 @@ static void init_intel(struct cpuinfo_x86 *c) c->x86_vfm == INTEL_WESTMERE_EX)) set_cpu_bug(c, X86_BUG_CLFLUSH_MONITOR); - if (boot_cpu_has(X86_FEATURE_MWAIT) && c->x86_vfm == INTEL_ATOM_GOLDMONT) + if (boot_cpu_has(X86_FEATURE_MWAIT) && + (c->x86_vfm == INTEL_ATOM_GOLDMONT || + c->x86_vfm == INTEL_LUNARLAKE_M)) set_cpu_bug(c, X86_BUG_MONITOR); #ifdef CONFIG_X86_64

4 months, 4 weeks

1
0
0 0

[PATCH 0/3] fixes for udmabuf (memfd sealing checks and a leak)

by Jann Horn

I have tested that patches 2 and 3 work using the following reproducers. I did not write a reproducer for the issue described in patch 1. Reproducer for F_SEAL_FUTURE_WRITE not being respected: ``` #define _GNU_SOURCE #include <err.h> #include <fcntl.h> #include <stdio.h> #include <unistd.h> #include <sys/ioctl.h> #include <sys/mman.h> #include <linux/udmabuf.h> #define SYSCHK(x) ({ \ typeof(x) __res = (x); \ if (__res == (typeof(x))-1) \ err(1, "SYSCHK(" #x ")"); \ __res; \ }) int main(void) { int memfd = SYSCHK(memfd_create("test", MFD_ALLOW_SEALING)); SYSCHK(ftruncate(memfd, 0x1000)); SYSCHK(fcntl(memfd, F_ADD_SEALS, F_SEAL_SHRINK|F_SEAL_FUTURE_WRITE)); int udmabuf_fd = SYSCHK(open("/dev/udmabuf", O_RDWR)); struct udmabuf_create create_arg = { .memfd = memfd, .flags = 0, .offset = 0, .size = 0x1000 }; int buf_fd = SYSCHK(ioctl(udmabuf_fd, UDMABUF_CREATE, &create_arg)); printf("created udmabuf buffer fd %d\n", buf_fd); char *map = SYSCHK(mmap(NULL, 0x1000, PROT_READ|PROT_WRITE, MAP_SHARED, buf_fd, 0)); *map = 'a'; } ``` Reproducer for the memory leak (if you run this for a while, your memory usage will steadily go up, and /sys/kernel/debug/dma_buf/bufinfo will contain a ton of entries): ``` #define _GNU_SOURCE #include <err.h> #include <errno.h> #include <assert.h> #include <fcntl.h> #include <stdio.h> #include <unistd.h> #include <sys/ioctl.h> #include <sys/mman.h> #include <sys/resource.h> #include <linux/udmabuf.h> #define SYSCHK(x) ({ \ typeof(x) __res = (x); \ if (__res == (typeof(x))-1) \ err(1, "SYSCHK(" #x ")"); \ __res; \ }) int main(void) { int memfd = SYSCHK(memfd_create("test", MFD_ALLOW_SEALING)); SYSCHK(ftruncate(memfd, 0x1000)); SYSCHK(fcntl(memfd, F_ADD_SEALS, F_SEAL_SHRINK)); int udmabuf_fd = SYSCHK(open("/dev/udmabuf", O_RDWR)); // prevent creating new FDs struct rlimit rlim = { .rlim_cur = 1, .rlim_max = 1 }; SYSCHK(setrlimit(RLIMIT_NOFILE, &rlim)); while (1) { struct udmabuf_create create_arg = { .memfd = memfd, .flags = 0, .offset = 0, .size = 0x1000 }; int buf_fd = ioctl(udmabuf_fd, UDMABUF_CREATE, &create_arg); assert(buf_fd == -1); assert(errno == EMFILE); } } ``` Signed-off-by: Jann Horn <jannh(a)google.com> --- Jann Horn (3): udmabuf: fix racy memfd sealing check udmabuf: also check for F_SEAL_FUTURE_WRITE udmabuf: fix memory leak on last export_udmabuf() error path drivers/dma-buf/udmabuf.c | 36 ++++++++++++++++++++---------------- 1 file changed, 20 insertions(+), 16 deletions(-) --- base-commit: b86545e02e8c22fb89218f29d381fa8e8b91d815 change-id: 20241203-udmabuf-fixes-d0435ebab663 -- Jann Horn <jannh(a)google.com>

4 months, 4 weeks

2
5
0 0

[PATCH AUTOSEL 4.19] PCI: Add 'reset_subordinate' to reset hierarchy below bridge

by Sasha Levin

From: Keith Busch <kbusch(a)kernel.org> [ Upstream commit 2fa046449a82a7d0f6d9721dd83e348816038444 ] The "bus" and "cxl_bus" reset methods reset a device by asserting Secondary Bus Reset on the bridge leading to the device. These only work if the device is the only device below the bridge. Add a sysfs 'reset_subordinate' attribute on bridges that can assert Secondary Bus Reset regardless of how many devices are below the bridge. This resets all the devices below a bridge in a single command, including the locking and config space save/restore that reset methods normally do. This may be the only way to reset devices that don't support other reset methods (ACPI, FLR, PM reset, etc). Link: https://lore.kernel.org/r/20241025222755.3756162-1-kbusch@meta.com Signed-off-by: Keith Busch <kbusch(a)kernel.org> [bhelgaas: commit log, add capable(CAP_SYS_ADMIN) check] Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Reviewed-by: Alex Williamson <alex.williamson(a)redhat.com> Reviewed-by: Amey Narkhede <ameynarkhede03(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- Documentation/ABI/testing/sysfs-bus-pci | 11 +++++++++++ drivers/pci/pci-sysfs.c | 26 +++++++++++++++++++++++++ drivers/pci/pci.c | 2 +- drivers/pci/pci.h | 1 + 4 files changed, 39 insertions(+), 1 deletion(-) diff --git a/Documentation/ABI/testing/sysfs-bus-pci b/Documentation/ABI/testing/sysfs-bus-pci index 44d4b2be92fd4..c68d1d9a4d479 100644 --- a/Documentation/ABI/testing/sysfs-bus-pci +++ b/Documentation/ABI/testing/sysfs-bus-pci @@ -125,6 +125,17 @@ Description: will be present in sysfs. Writing 1 to this file will perform reset. +What: /sys/bus/pci/devices/.../reset_subordinate +Date: October 2024 +Contact: linux-pci(a)vger.kernel.org +Description: + This is visible only for bridge devices. If you want to reset + all devices attached through the subordinate bus of a specific + bridge device, writing 1 to this will try to do it. This will + affect all devices attached to the system through this bridge + similiar to writing 1 to their individual "reset" file, so use + with caution. + What: /sys/bus/pci/devices/.../vpd Date: February 2008 Contact: Ben Hutchings <bwh(a)kernel.org> diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c index f68798763af8d..d5287dfac9171 100644 --- a/drivers/pci/pci-sysfs.c +++ b/drivers/pci/pci-sysfs.c @@ -507,6 +507,31 @@ static ssize_t dev_bus_rescan_store(struct device *dev, } static DEVICE_ATTR(rescan, (S_IWUSR|S_IWGRP), NULL, dev_bus_rescan_store); +static ssize_t reset_subordinate_store(struct device *dev, + struct device_attribute *attr, + const char *buf, size_t count) +{ + struct pci_dev *pdev = to_pci_dev(dev); + struct pci_bus *bus = pdev->subordinate; + unsigned long val; + + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; + + if (kstrtoul(buf, 0, &val) < 0) + return -EINVAL; + + if (val) { + int ret = __pci_reset_bus(bus); + + if (ret) + return ret; + } + + return count; +} +static DEVICE_ATTR_WO(reset_subordinate); + #if defined(CONFIG_PM) && defined(CONFIG_ACPI) static ssize_t d3cold_allowed_store(struct device *dev, struct device_attribute *attr, @@ -778,6 +803,7 @@ static struct attribute *pci_dev_attrs[] = { static struct attribute *pci_bridge_attrs[] = { &dev_attr_subordinate_bus_number.attr, &dev_attr_secondary_bus_number.attr, + &dev_attr_reset_subordinate.attr, NULL, }; diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index aa2be8d815048..e22040c8a0aec 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5295,7 +5295,7 @@ EXPORT_SYMBOL_GPL(pci_probe_reset_bus); * * Same as above except return -EAGAIN if the bus cannot be locked */ -static int __pci_reset_bus(struct pci_bus *bus) +int __pci_reset_bus(struct pci_bus *bus) { int rc; diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h index 39725b71300f8..1db9b8ff6043d 100644 --- a/drivers/pci/pci.h +++ b/drivers/pci/pci.h @@ -36,6 +36,7 @@ int pci_mmap_fits(struct pci_dev *pdev, int resno, struct vm_area_struct *vmai, int pci_probe_reset_function(struct pci_dev *dev); int pci_bridge_secondary_bus_reset(struct pci_dev *dev); int pci_bus_error_reset(struct pci_dev *dev); +int __pci_reset_bus(struct pci_bus *bus); /** * struct pci_platform_pm_ops - Firmware PM callbacks -- 2.43.0

4 months, 4 weeks

1
0
0 0

[PATCH AUTOSEL 5.4 1/4] f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.

by Sasha Levin

From: Qi Han <hanqi(a)vivo.com> [ Upstream commit d5c367ef8287fb4d235c46a2f8c8d68715f3a0ca ] creating a large files during checkpoint disable until it runs out of space and then delete it, then remount to enable checkpoint again, and then unmount the filesystem triggers the f2fs_bug_on as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/inode.c:896! CPU: 2 UID: 0 PID: 1286 Comm: umount Not tainted 6.11.0-rc7-dirty #360 Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:f2fs_evict_inode+0x58c/0x610 Call Trace: __die_body+0x15/0x60 die+0x33/0x50 do_trap+0x10a/0x120 f2fs_evict_inode+0x58c/0x610 do_error_trap+0x60/0x80 f2fs_evict_inode+0x58c/0x610 exc_invalid_op+0x53/0x60 f2fs_evict_inode+0x58c/0x610 asm_exc_invalid_op+0x16/0x20 f2fs_evict_inode+0x58c/0x610 evict+0x101/0x260 dispose_list+0x30/0x50 evict_inodes+0x140/0x190 generic_shutdown_super+0x2f/0x150 kill_block_super+0x11/0x40 kill_f2fs_super+0x7d/0x140 deactivate_locked_super+0x2a/0x70 cleanup_mnt+0xb3/0x140 task_work_run+0x61/0x90 The root cause is: creating large files during disable checkpoint period results in not enough free segments, so when writing back root inode will failed in f2fs_enable_checkpoint. When umount the file system after enabling checkpoint, the root inode is dirty in f2fs_evict_inode function, which triggers BUG_ON. The steps to reproduce are as follows: dd if=/dev/zero of=f2fs.img bs=1M count=55 mount f2fs.img f2fs_dir -o checkpoint=disable:10% dd if=/dev/zero of=big bs=1M count=50 sync rm big mount -o remount,checkpoint=enable f2fs_dir umount f2fs_dir Let's redirty inode when there is not free segments during checkpoint is disable. Signed-off-by: Qi Han <hanqi(a)vivo.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- fs/f2fs/inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c index 53e1a757e4e17..b0cbb01df8cba 100644 --- a/fs/f2fs/inode.c +++ b/fs/f2fs/inode.c @@ -631,8 +631,10 @@ int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc) !is_inode_flag_set(inode, FI_DIRTY_INODE)) return 0; - if (!f2fs_is_checkpoint_ready(sbi)) + if (!f2fs_is_checkpoint_ready(sbi)) { + f2fs_mark_inode_dirty_sync(inode, true); return -ENOSPC; + } /* * We need to balance fs here to prevent from producing dirty node pages -- 2.43.0

4 months, 4 weeks

1
3
0 0

[PATCH AUTOSEL 5.10 1/4] f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.

by Sasha Levin

From: Qi Han <hanqi(a)vivo.com> [ Upstream commit d5c367ef8287fb4d235c46a2f8c8d68715f3a0ca ] creating a large files during checkpoint disable until it runs out of space and then delete it, then remount to enable checkpoint again, and then unmount the filesystem triggers the f2fs_bug_on as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/inode.c:896! CPU: 2 UID: 0 PID: 1286 Comm: umount Not tainted 6.11.0-rc7-dirty #360 Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:f2fs_evict_inode+0x58c/0x610 Call Trace: __die_body+0x15/0x60 die+0x33/0x50 do_trap+0x10a/0x120 f2fs_evict_inode+0x58c/0x610 do_error_trap+0x60/0x80 f2fs_evict_inode+0x58c/0x610 exc_invalid_op+0x53/0x60 f2fs_evict_inode+0x58c/0x610 asm_exc_invalid_op+0x16/0x20 f2fs_evict_inode+0x58c/0x610 evict+0x101/0x260 dispose_list+0x30/0x50 evict_inodes+0x140/0x190 generic_shutdown_super+0x2f/0x150 kill_block_super+0x11/0x40 kill_f2fs_super+0x7d/0x140 deactivate_locked_super+0x2a/0x70 cleanup_mnt+0xb3/0x140 task_work_run+0x61/0x90 The root cause is: creating large files during disable checkpoint period results in not enough free segments, so when writing back root inode will failed in f2fs_enable_checkpoint. When umount the file system after enabling checkpoint, the root inode is dirty in f2fs_evict_inode function, which triggers BUG_ON. The steps to reproduce are as follows: dd if=/dev/zero of=f2fs.img bs=1M count=55 mount f2fs.img f2fs_dir -o checkpoint=disable:10% dd if=/dev/zero of=big bs=1M count=50 sync rm big mount -o remount,checkpoint=enable f2fs_dir umount f2fs_dir Let's redirty inode when there is not free segments during checkpoint is disable. Signed-off-by: Qi Han <hanqi(a)vivo.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- fs/f2fs/inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c index b23e6a848e9b7..452c0240cc11e 100644 --- a/fs/f2fs/inode.c +++ b/fs/f2fs/inode.c @@ -701,8 +701,10 @@ int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc) !is_inode_flag_set(inode, FI_DIRTY_INODE)) return 0; - if (!f2fs_is_checkpoint_ready(sbi)) + if (!f2fs_is_checkpoint_ready(sbi)) { + f2fs_mark_inode_dirty_sync(inode, true); return -ENOSPC; + } /* * We need to balance fs here to prevent from producing dirty node pages -- 2.43.0

4 months, 4 weeks

1
3
0 0

[PATCH AUTOSEL 5.15 1/6] f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.

by Sasha Levin

From: Qi Han <hanqi(a)vivo.com> [ Upstream commit d5c367ef8287fb4d235c46a2f8c8d68715f3a0ca ] creating a large files during checkpoint disable until it runs out of space and then delete it, then remount to enable checkpoint again, and then unmount the filesystem triggers the f2fs_bug_on as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/inode.c:896! CPU: 2 UID: 0 PID: 1286 Comm: umount Not tainted 6.11.0-rc7-dirty #360 Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:f2fs_evict_inode+0x58c/0x610 Call Trace: __die_body+0x15/0x60 die+0x33/0x50 do_trap+0x10a/0x120 f2fs_evict_inode+0x58c/0x610 do_error_trap+0x60/0x80 f2fs_evict_inode+0x58c/0x610 exc_invalid_op+0x53/0x60 f2fs_evict_inode+0x58c/0x610 asm_exc_invalid_op+0x16/0x20 f2fs_evict_inode+0x58c/0x610 evict+0x101/0x260 dispose_list+0x30/0x50 evict_inodes+0x140/0x190 generic_shutdown_super+0x2f/0x150 kill_block_super+0x11/0x40 kill_f2fs_super+0x7d/0x140 deactivate_locked_super+0x2a/0x70 cleanup_mnt+0xb3/0x140 task_work_run+0x61/0x90 The root cause is: creating large files during disable checkpoint period results in not enough free segments, so when writing back root inode will failed in f2fs_enable_checkpoint. When umount the file system after enabling checkpoint, the root inode is dirty in f2fs_evict_inode function, which triggers BUG_ON. The steps to reproduce are as follows: dd if=/dev/zero of=f2fs.img bs=1M count=55 mount f2fs.img f2fs_dir -o checkpoint=disable:10% dd if=/dev/zero of=big bs=1M count=50 sync rm big mount -o remount,checkpoint=enable f2fs_dir umount f2fs_dir Let's redirty inode when there is not free segments during checkpoint is disable. Signed-off-by: Qi Han <hanqi(a)vivo.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- fs/f2fs/inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c index 27bd8d1bae4d3..558f478d037d0 100644 --- a/fs/f2fs/inode.c +++ b/fs/f2fs/inode.c @@ -724,8 +724,10 @@ int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc) !is_inode_flag_set(inode, FI_DIRTY_INODE)) return 0; - if (!f2fs_is_checkpoint_ready(sbi)) + if (!f2fs_is_checkpoint_ready(sbi)) { + f2fs_mark_inode_dirty_sync(inode, true); return -ENOSPC; + } /* * We need to balance fs here to prevent from producing dirty node pages -- 2.43.0

4 months, 4 weeks

1
5
0 0

[PATCH AUTOSEL 6.1 1/6] f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.

by Sasha Levin

From: Qi Han <hanqi(a)vivo.com> [ Upstream commit d5c367ef8287fb4d235c46a2f8c8d68715f3a0ca ] creating a large files during checkpoint disable until it runs out of space and then delete it, then remount to enable checkpoint again, and then unmount the filesystem triggers the f2fs_bug_on as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/inode.c:896! CPU: 2 UID: 0 PID: 1286 Comm: umount Not tainted 6.11.0-rc7-dirty #360 Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:f2fs_evict_inode+0x58c/0x610 Call Trace: __die_body+0x15/0x60 die+0x33/0x50 do_trap+0x10a/0x120 f2fs_evict_inode+0x58c/0x610 do_error_trap+0x60/0x80 f2fs_evict_inode+0x58c/0x610 exc_invalid_op+0x53/0x60 f2fs_evict_inode+0x58c/0x610 asm_exc_invalid_op+0x16/0x20 f2fs_evict_inode+0x58c/0x610 evict+0x101/0x260 dispose_list+0x30/0x50 evict_inodes+0x140/0x190 generic_shutdown_super+0x2f/0x150 kill_block_super+0x11/0x40 kill_f2fs_super+0x7d/0x140 deactivate_locked_super+0x2a/0x70 cleanup_mnt+0xb3/0x140 task_work_run+0x61/0x90 The root cause is: creating large files during disable checkpoint period results in not enough free segments, so when writing back root inode will failed in f2fs_enable_checkpoint. When umount the file system after enabling checkpoint, the root inode is dirty in f2fs_evict_inode function, which triggers BUG_ON. The steps to reproduce are as follows: dd if=/dev/zero of=f2fs.img bs=1M count=55 mount f2fs.img f2fs_dir -o checkpoint=disable:10% dd if=/dev/zero of=big bs=1M count=50 sync rm big mount -o remount,checkpoint=enable f2fs_dir umount f2fs_dir Let's redirty inode when there is not free segments during checkpoint is disable. Signed-off-by: Qi Han <hanqi(a)vivo.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- fs/f2fs/inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c index 5b672df194a99..0f350368dea73 100644 --- a/fs/f2fs/inode.c +++ b/fs/f2fs/inode.c @@ -719,8 +719,10 @@ int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc) !is_inode_flag_set(inode, FI_DIRTY_INODE)) return 0; - if (!f2fs_is_checkpoint_ready(sbi)) + if (!f2fs_is_checkpoint_ready(sbi)) { + f2fs_mark_inode_dirty_sync(inode, true); return -ENOSPC; + } /* * We need to balance fs here to prevent from producing dirty node pages -- 2.43.0

4 months, 4 weeks

1
5
0 0

[PATCH AUTOSEL 6.6 01/12] f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.

by Sasha Levin

From: Qi Han <hanqi(a)vivo.com> [ Upstream commit d5c367ef8287fb4d235c46a2f8c8d68715f3a0ca ] creating a large files during checkpoint disable until it runs out of space and then delete it, then remount to enable checkpoint again, and then unmount the filesystem triggers the f2fs_bug_on as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/inode.c:896! CPU: 2 UID: 0 PID: 1286 Comm: umount Not tainted 6.11.0-rc7-dirty #360 Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:f2fs_evict_inode+0x58c/0x610 Call Trace: __die_body+0x15/0x60 die+0x33/0x50 do_trap+0x10a/0x120 f2fs_evict_inode+0x58c/0x610 do_error_trap+0x60/0x80 f2fs_evict_inode+0x58c/0x610 exc_invalid_op+0x53/0x60 f2fs_evict_inode+0x58c/0x610 asm_exc_invalid_op+0x16/0x20 f2fs_evict_inode+0x58c/0x610 evict+0x101/0x260 dispose_list+0x30/0x50 evict_inodes+0x140/0x190 generic_shutdown_super+0x2f/0x150 kill_block_super+0x11/0x40 kill_f2fs_super+0x7d/0x140 deactivate_locked_super+0x2a/0x70 cleanup_mnt+0xb3/0x140 task_work_run+0x61/0x90 The root cause is: creating large files during disable checkpoint period results in not enough free segments, so when writing back root inode will failed in f2fs_enable_checkpoint. When umount the file system after enabling checkpoint, the root inode is dirty in f2fs_evict_inode function, which triggers BUG_ON. The steps to reproduce are as follows: dd if=/dev/zero of=f2fs.img bs=1M count=55 mount f2fs.img f2fs_dir -o checkpoint=disable:10% dd if=/dev/zero of=big bs=1M count=50 sync rm big mount -o remount,checkpoint=enable f2fs_dir umount f2fs_dir Let's redirty inode when there is not free segments during checkpoint is disable. Signed-off-by: Qi Han <hanqi(a)vivo.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- fs/f2fs/inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c index a3e0c92735433..7ad4a92417591 100644 --- a/fs/f2fs/inode.c +++ b/fs/f2fs/inode.c @@ -788,8 +788,10 @@ int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc) !is_inode_flag_set(inode, FI_DIRTY_INODE)) return 0; - if (!f2fs_is_checkpoint_ready(sbi)) + if (!f2fs_is_checkpoint_ready(sbi)) { + f2fs_mark_inode_dirty_sync(inode, true); return -ENOSPC; + } /* * We need to balance fs here to prevent from producing dirty node pages -- 2.43.0

4 months, 4 weeks

1
11
0 0

[PATCH AUTOSEL 6.11 01/13] f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.

by Sasha Levin

From: Qi Han <hanqi(a)vivo.com> [ Upstream commit d5c367ef8287fb4d235c46a2f8c8d68715f3a0ca ] creating a large files during checkpoint disable until it runs out of space and then delete it, then remount to enable checkpoint again, and then unmount the filesystem triggers the f2fs_bug_on as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/inode.c:896! CPU: 2 UID: 0 PID: 1286 Comm: umount Not tainted 6.11.0-rc7-dirty #360 Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:f2fs_evict_inode+0x58c/0x610 Call Trace: __die_body+0x15/0x60 die+0x33/0x50 do_trap+0x10a/0x120 f2fs_evict_inode+0x58c/0x610 do_error_trap+0x60/0x80 f2fs_evict_inode+0x58c/0x610 exc_invalid_op+0x53/0x60 f2fs_evict_inode+0x58c/0x610 asm_exc_invalid_op+0x16/0x20 f2fs_evict_inode+0x58c/0x610 evict+0x101/0x260 dispose_list+0x30/0x50 evict_inodes+0x140/0x190 generic_shutdown_super+0x2f/0x150 kill_block_super+0x11/0x40 kill_f2fs_super+0x7d/0x140 deactivate_locked_super+0x2a/0x70 cleanup_mnt+0xb3/0x140 task_work_run+0x61/0x90 The root cause is: creating large files during disable checkpoint period results in not enough free segments, so when writing back root inode will failed in f2fs_enable_checkpoint. When umount the file system after enabling checkpoint, the root inode is dirty in f2fs_evict_inode function, which triggers BUG_ON. The steps to reproduce are as follows: dd if=/dev/zero of=f2fs.img bs=1M count=55 mount f2fs.img f2fs_dir -o checkpoint=disable:10% dd if=/dev/zero of=big bs=1M count=50 sync rm big mount -o remount,checkpoint=enable f2fs_dir umount f2fs_dir Let's redirty inode when there is not free segments during checkpoint is disable. Signed-off-by: Qi Han <hanqi(a)vivo.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- fs/f2fs/inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c index 4729c49bf6d7e..b0676e8338334 100644 --- a/fs/f2fs/inode.c +++ b/fs/f2fs/inode.c @@ -775,8 +775,10 @@ int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc) !is_inode_flag_set(inode, FI_DIRTY_INODE)) return 0; - if (!f2fs_is_checkpoint_ready(sbi)) + if (!f2fs_is_checkpoint_ready(sbi)) { + f2fs_mark_inode_dirty_sync(inode, true); return -ENOSPC; + } /* * We need to balance fs here to prevent from producing dirty node pages -- 2.43.0

4 months, 4 weeks

1
12
0 0

[PATCH AUTOSEL 6.12 01/15] f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.

by Sasha Levin

From: Qi Han <hanqi(a)vivo.com> [ Upstream commit d5c367ef8287fb4d235c46a2f8c8d68715f3a0ca ] creating a large files during checkpoint disable until it runs out of space and then delete it, then remount to enable checkpoint again, and then unmount the filesystem triggers the f2fs_bug_on as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/inode.c:896! CPU: 2 UID: 0 PID: 1286 Comm: umount Not tainted 6.11.0-rc7-dirty #360 Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:f2fs_evict_inode+0x58c/0x610 Call Trace: __die_body+0x15/0x60 die+0x33/0x50 do_trap+0x10a/0x120 f2fs_evict_inode+0x58c/0x610 do_error_trap+0x60/0x80 f2fs_evict_inode+0x58c/0x610 exc_invalid_op+0x53/0x60 f2fs_evict_inode+0x58c/0x610 asm_exc_invalid_op+0x16/0x20 f2fs_evict_inode+0x58c/0x610 evict+0x101/0x260 dispose_list+0x30/0x50 evict_inodes+0x140/0x190 generic_shutdown_super+0x2f/0x150 kill_block_super+0x11/0x40 kill_f2fs_super+0x7d/0x140 deactivate_locked_super+0x2a/0x70 cleanup_mnt+0xb3/0x140 task_work_run+0x61/0x90 The root cause is: creating large files during disable checkpoint period results in not enough free segments, so when writing back root inode will failed in f2fs_enable_checkpoint. When umount the file system after enabling checkpoint, the root inode is dirty in f2fs_evict_inode function, which triggers BUG_ON. The steps to reproduce are as follows: dd if=/dev/zero of=f2fs.img bs=1M count=55 mount f2fs.img f2fs_dir -o checkpoint=disable:10% dd if=/dev/zero of=big bs=1M count=50 sync rm big mount -o remount,checkpoint=enable f2fs_dir umount f2fs_dir Let's redirty inode when there is not free segments during checkpoint is disable. Signed-off-by: Qi Han <hanqi(a)vivo.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- fs/f2fs/inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c index 1ed86df343a5d..10780e37fc7b6 100644 --- a/fs/f2fs/inode.c +++ b/fs/f2fs/inode.c @@ -775,8 +775,10 @@ int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc) !is_inode_flag_set(inode, FI_DIRTY_INODE)) return 0; - if (!f2fs_is_checkpoint_ready(sbi)) + if (!f2fs_is_checkpoint_ready(sbi)) { + f2fs_mark_inode_dirty_sync(inode, true); return -ENOSPC; + } /* * We need to balance fs here to prevent from producing dirty node pages -- 2.43.0

4 months, 4 weeks

1
14
0 0

[PATCH v4 1/5] libfs: Return ENOSPC when the directory offset range is exhausted

by cel＠kernel.org

From: Chuck Lever <chuck.lever(a)oracle.com> Testing shows that the EBUSY error return from mtree_alloc_cyclic() leaks into user space. The ERRORS section of "man creat(2)" says: > EBUSY O_EXCL was specified in flags and pathname refers > to a block device that is in use by the system > (e.g., it is mounted). ENOSPC is closer to what applications expect in this situation. Note that the normal range of simple directory offset values is 2..2^63, so hitting this error is going to be rare to impossible. Fixes: 6faddda69f62 ("libfs: Add directory operations for stable offsets") Cc: <stable(a)vger.kernel.org> # v6.9+ Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> --- fs/libfs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/libfs.c b/fs/libfs.c index 46966fd8bcf9..bf67954b525b 100644 --- a/fs/libfs.c +++ b/fs/libfs.c @@ -288,7 +288,9 @@ int simple_offset_add(struct offset_ctx *octx, struct dentry *dentry) ret = mtree_alloc_cyclic(&octx->mt, &offset, dentry, DIR_OFFSET_MIN, LONG_MAX, &octx->next_offset, GFP_KERNEL); - if (ret < 0) + if (unlikely(ret == -EBUSY)) + return -ENOSPC; + if (unlikely(ret < 0)) return ret; offset_set(dentry, offset); -- 2.47.0

4 months, 4 weeks

1
0
0 0

[PATCH AUTOSEL 4.19 1/6] tracing: Use atomic64_inc_return() in trace_clock_counter()

by Sasha Levin

From: Uros Bizjak <ubizjak(a)gmail.com> [ Upstream commit eb887c4567d1b0e7684c026fe7df44afa96589e6 ] Use atomic64_inc_return(&ref) instead of atomic64_add_return(1, &ref) to use optimized implementation and ease register pressure around the primitive for targets that implement optimized variant. Cc: Steven Rostedt <rostedt(a)goodmis.org> Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://lore.kernel.org/20241007085651.48544-1-ubizjak@gmail.com Signed-off-by: Uros Bizjak <ubizjak(a)gmail.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- kernel/trace/trace_clock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/trace_clock.c b/kernel/trace/trace_clock.c index 4702efb00ff21..4cb2ebc439be6 100644 --- a/kernel/trace/trace_clock.c +++ b/kernel/trace/trace_clock.c @@ -154,5 +154,5 @@ static atomic64_t trace_counter; */ u64 notrace trace_clock_counter(void) { - return atomic64_add_return(1, &trace_counter); + return atomic64_inc_return(&trace_counter); } -- 2.43.0

4 months, 4 weeks

1
5
0 0

[PATCH AUTOSEL 5.4 1/7] tracing: Use atomic64_inc_return() in trace_clock_counter()

by Sasha Levin

From: Uros Bizjak <ubizjak(a)gmail.com> [ Upstream commit eb887c4567d1b0e7684c026fe7df44afa96589e6 ] Use atomic64_inc_return(&ref) instead of atomic64_add_return(1, &ref) to use optimized implementation and ease register pressure around the primitive for targets that implement optimized variant. Cc: Steven Rostedt <rostedt(a)goodmis.org> Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://lore.kernel.org/20241007085651.48544-1-ubizjak@gmail.com Signed-off-by: Uros Bizjak <ubizjak(a)gmail.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- kernel/trace/trace_clock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/trace_clock.c b/kernel/trace/trace_clock.c index 4702efb00ff21..4cb2ebc439be6 100644 --- a/kernel/trace/trace_clock.c +++ b/kernel/trace/trace_clock.c @@ -154,5 +154,5 @@ static atomic64_t trace_counter; */ u64 notrace trace_clock_counter(void) { - return atomic64_add_return(1, &trace_counter); + return atomic64_inc_return(&trace_counter); } -- 2.43.0

4 months, 4 weeks

1
6
0 0

[PATCH AUTOSEL 5.10 1/9] pinctrl: freescale: fix COMPILE_TEST error with PINCTRL_IMX_SCU

by Sasha Levin

From: Esben Haabendal <esben(a)geanix.com> [ Upstream commit 58414a31c5713afb5449fd74a26a843d34cc62e8 ] When PINCTRL_IMX_SCU was selected by PINCTRL_IMX8DXL or PINCTRL_IMX8QM combined with COMPILE_TEST on a non-arm platforms, the IMX_SCU dependency could not be enabled. Reported-by: kernel test robot <lkp(a)intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202410031439.GyTSa0kX-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202410030852.q0Hukplf-lkp@intel.com/ Signed-off-by: Esben Haabendal <esben(a)geanix.com> Link: https://lore.kernel.org/20241003-imx-pinctrl-compile-test-fix-v1-1-145ca194… Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/pinctrl/freescale/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pinctrl/freescale/Kconfig b/drivers/pinctrl/freescale/Kconfig index a1fbb3b9ae346..eefc786d08b45 100644 --- a/drivers/pinctrl/freescale/Kconfig +++ b/drivers/pinctrl/freescale/Kconfig @@ -9,7 +9,7 @@ config PINCTRL_IMX config PINCTRL_IMX_SCU tristate - depends on IMX_SCU + depends on IMX_SCU || COMPILE_TEST select PINCTRL_IMX config PINCTRL_IMX1_CORE -- 2.43.0

4 months, 4 weeks

1
8
0 0

[PATCH AUTOSEL 5.15 1/9] pinctrl: freescale: fix COMPILE_TEST error with PINCTRL_IMX_SCU

by Sasha Levin

From: Esben Haabendal <esben(a)geanix.com> [ Upstream commit 58414a31c5713afb5449fd74a26a843d34cc62e8 ] When PINCTRL_IMX_SCU was selected by PINCTRL_IMX8DXL or PINCTRL_IMX8QM combined with COMPILE_TEST on a non-arm platforms, the IMX_SCU dependency could not be enabled. Reported-by: kernel test robot <lkp(a)intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202410031439.GyTSa0kX-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202410030852.q0Hukplf-lkp@intel.com/ Signed-off-by: Esben Haabendal <esben(a)geanix.com> Link: https://lore.kernel.org/20241003-imx-pinctrl-compile-test-fix-v1-1-145ca194… Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/pinctrl/freescale/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pinctrl/freescale/Kconfig b/drivers/pinctrl/freescale/Kconfig index 21fa21c6547b1..93b38d97a7263 100644 --- a/drivers/pinctrl/freescale/Kconfig +++ b/drivers/pinctrl/freescale/Kconfig @@ -9,7 +9,7 @@ config PINCTRL_IMX config PINCTRL_IMX_SCU tristate - depends on IMX_SCU + depends on IMX_SCU || COMPILE_TEST select PINCTRL_IMX config PINCTRL_IMX1_CORE -- 2.43.0

4 months, 4 weeks

1
8
0 0

[PATCH AUTOSEL 6.1 01/15] pinctrl: freescale: fix COMPILE_TEST error with PINCTRL_IMX_SCU

by Sasha Levin

From: Esben Haabendal <esben(a)geanix.com> [ Upstream commit 58414a31c5713afb5449fd74a26a843d34cc62e8 ] When PINCTRL_IMX_SCU was selected by PINCTRL_IMX8DXL or PINCTRL_IMX8QM combined with COMPILE_TEST on a non-arm platforms, the IMX_SCU dependency could not be enabled. Reported-by: kernel test robot <lkp(a)intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202410031439.GyTSa0kX-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202410030852.q0Hukplf-lkp@intel.com/ Signed-off-by: Esben Haabendal <esben(a)geanix.com> Link: https://lore.kernel.org/20241003-imx-pinctrl-compile-test-fix-v1-1-145ca194… Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/pinctrl/freescale/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pinctrl/freescale/Kconfig b/drivers/pinctrl/freescale/Kconfig index 7a32f77792d9a..86110fc3c1465 100644 --- a/drivers/pinctrl/freescale/Kconfig +++ b/drivers/pinctrl/freescale/Kconfig @@ -9,7 +9,7 @@ config PINCTRL_IMX config PINCTRL_IMX_SCU tristate - depends on IMX_SCU + depends on IMX_SCU || COMPILE_TEST select PINCTRL_IMX config PINCTRL_IMX1_CORE -- 2.43.0

4 months, 4 weeks

1
14
0 0

[PATCH AUTOSEL 6.6 01/24] pinctrl: freescale: fix COMPILE_TEST error with PINCTRL_IMX_SCU

by Sasha Levin

From: Esben Haabendal <esben(a)geanix.com> [ Upstream commit 58414a31c5713afb5449fd74a26a843d34cc62e8 ] When PINCTRL_IMX_SCU was selected by PINCTRL_IMX8DXL or PINCTRL_IMX8QM combined with COMPILE_TEST on a non-arm platforms, the IMX_SCU dependency could not be enabled. Reported-by: kernel test robot <lkp(a)intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202410031439.GyTSa0kX-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202410030852.q0Hukplf-lkp@intel.com/ Signed-off-by: Esben Haabendal <esben(a)geanix.com> Link: https://lore.kernel.org/20241003-imx-pinctrl-compile-test-fix-v1-1-145ca194… Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/pinctrl/freescale/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pinctrl/freescale/Kconfig b/drivers/pinctrl/freescale/Kconfig index 27bdc548f3a7d..a36dae526de12 100644 --- a/drivers/pinctrl/freescale/Kconfig +++ b/drivers/pinctrl/freescale/Kconfig @@ -9,7 +9,7 @@ config PINCTRL_IMX config PINCTRL_IMX_SCU tristate - depends on IMX_SCU + depends on IMX_SCU || COMPILE_TEST select PINCTRL_IMX config PINCTRL_IMX1_CORE -- 2.43.0

4 months, 4 weeks

1
23
0 0

[PATCH AUTOSEL 6.11 01/33] pinctrl: freescale: fix COMPILE_TEST error with PINCTRL_IMX_SCU

by Sasha Levin

From: Esben Haabendal <esben(a)geanix.com> [ Upstream commit 58414a31c5713afb5449fd74a26a843d34cc62e8 ] When PINCTRL_IMX_SCU was selected by PINCTRL_IMX8DXL or PINCTRL_IMX8QM combined with COMPILE_TEST on a non-arm platforms, the IMX_SCU dependency could not be enabled. Reported-by: kernel test robot <lkp(a)intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202410031439.GyTSa0kX-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202410030852.q0Hukplf-lkp@intel.com/ Signed-off-by: Esben Haabendal <esben(a)geanix.com> Link: https://lore.kernel.org/20241003-imx-pinctrl-compile-test-fix-v1-1-145ca194… Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/pinctrl/freescale/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pinctrl/freescale/Kconfig b/drivers/pinctrl/freescale/Kconfig index 3b59d71890045..139bc0fb8a9db 100644 --- a/drivers/pinctrl/freescale/Kconfig +++ b/drivers/pinctrl/freescale/Kconfig @@ -20,7 +20,7 @@ config PINCTRL_IMX_SCMI config PINCTRL_IMX_SCU tristate - depends on IMX_SCU + depends on IMX_SCU || COMPILE_TEST select PINCTRL_IMX config PINCTRL_IMX1_CORE -- 2.43.0

4 months, 4 weeks

1
32
0 0

Re: [PATCH] riscv: Fix vector state restore in rt_sigreturn()

by Sasha Levin

[ Sasha's backport helper bot ] Hi, Found matching upstream commit: c27fa53b858b4ee6552a719aa599c250cf98a586 WARNING: Author mismatch between patch and found commit: Backport author: =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= <bjorn(a)kernel.org> Commit author: Björn Töpel <bjorn(a)rivosinc.com> Status in newer kernel trees: 6.12.y | Present (exact SHA1) Note: The patch differs from the upstream commit: --- Failed to apply patch cleanly, falling back to interdiff... --- Results of testing on various branches: | Branch | Patch Apply | Build Test | |---------------------------|-------------|------------| | stable/linux-6.12.y | Failed | N/A | | stable/linux-6.11.y | Failed | N/A | | stable/linux-6.6.y | Failed | N/A | | stable/linux-6.1.y | Failed | N/A | | stable/linux-5.15.y | Failed | N/A | | stable/linux-5.10.y | Failed | N/A | | stable/linux-5.4.y | Failed | N/A | | stable/linux-4.19.y | Failed | N/A |

4 months, 4 weeks

1
0
0 0

[PATCH 5.4] Revert "drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()"

by Zhang Zekun

This reverts commit 7ccd781794d247589104a791caab491e21218fba. The origin mainline patch fix a buffer overflow issue in amdgpu_debugfs_gprwave_read(), but it has not been introduced in kernel 6.1 and older kernels. This patch add a check in a wrong function in the same file. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c index fa42b3c7e1b3..48b8b5600402 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c @@ -395,7 +395,7 @@ static ssize_t amdgpu_debugfs_regs_smc_read(struct file *f, char __user *buf, if (!adev->smc_rreg) return -EOPNOTSUPP; - if (size > 4096 || size & 0x3 || *pos & 0x3) + if (size & 0x3 || *pos & 0x3) return -EINVAL; while (size) { -- 2.17.1

4 months, 4 weeks

2
1
0 0

[PATCH 5.15] Revert "drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()"

by Zhang Zekun

This reverts commit aaf6160a4b7f9ee3cd91aa5b3251f5dbe2170f42. The origin mainline patch fix a buffer overflow issue in amdgpu_debugfs_gprwave_read(), but it has not been introduced in kernel 6.1 and older kernels. This patch add a check in a wrong function in the same file. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c index 2ca7a5d5ea64..49711776b351 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c @@ -401,7 +401,7 @@ static ssize_t amdgpu_debugfs_regs_didt_write(struct file *f, const char __user ssize_t result = 0; int r; - if (size > 4096 || size & 0x3 || *pos & 0x3) + if (size & 0x3 || *pos & 0x3) return -EINVAL; if (!adev->didt_wreg) -- 2.17.1

4 months, 4 weeks

2
1
0 0

Please, fix syzbot crash: kernel BUG in filemap_unaccount_folio

by Andrey Kalachev

Hi all. The upstream kernels late than v6.10-rc6 has the patch: 7d79cd784470 udmabuf: use vmf_insert_pfn and VM_PFNMAP for handling mmap That patch stop reproducing syzbot crashes [1], [2]. The reproducer code [3] still crash longterm & stable kernel versions v5.4-v6.6. Here the 7d79cd784470 backports below. Patch v6.6 just cherry-picked, patch for v5.4-v6.1 has minor change described in the patch note. Regards, AK [1] https://syzkaller.appspot.com/bug?extid=3d218f7b6c5511a83a79 [2] https://syzkaller.appspot.com/bug?extid=17a207d226b8a5fb0fd9 [3] https://syzkaller.appspot.com/text?tag=ReproC&x=10c0b8c0580000 Reported-by: syzbot+3d218f7b6c5511a83a79(a)syzkaller.appspotmail.com Reported-by: syzbot+17a207d226b8a5fb0fd9(a)syzkaller.appspotmail.com

4 months, 4 weeks

2
4
0 0

[PATCH 6.1] Revert "drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()"

by Zhang Zekun

This reverts commit 25d7e84343e1235b667cf5226c3934fdf36f0df6. The origin mainline patch fix a buffer overflow issue in amdgpu_debugfs_gprwave_read(), but it has not been introduced in kernel 6.1 and older kernels. This patch add a check in a wrong function in the same file. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c index a8dd63f270c3..3cca3f07f34d 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c @@ -419,7 +419,7 @@ static ssize_t amdgpu_debugfs_regs_pcie_write(struct file *f, const char __user ssize_t result = 0; int r; - if (size > 4096 || size & 0x3 || *pos & 0x3) + if (size & 0x3 || *pos & 0x3) return -EINVAL; r = pm_runtime_get_sync(adev_to_drm(adev)->dev); -- 2.17.1

4 months, 4 weeks

2
1
0 0

[PATCH 5.10] Revert "drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()"

by Zhang Zekun

This reverts commit 17f5f18085acb5e9d8d13d84a4e12bb3aff2bd64. The origin mainline patch fix a buffer overflow issue in amdgpu_debugfs_gprwave_read(), but it has not been introduced in kernel 6.1 and older kernels. This patch add a check in a wrong function in the same file. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c index 3cca007a0cd0..8a1cb1de2b13 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c @@ -396,7 +396,7 @@ static ssize_t amdgpu_debugfs_regs_pcie_write(struct file *f, const char __user ssize_t result = 0; int r; - if (size > 4096 || size & 0x3 || *pos & 0x3) + if (size & 0x3 || *pos & 0x3) return -EINVAL; r = pm_runtime_get_sync(adev_to_drm(adev)->dev); -- 2.17.1

4 months, 4 weeks

2
1
0 0

[PATCH v6] drm/i915: Fix NULL pointer dereference in capture_engine

by Eugene Kobyak

When the intel_context structure contains NULL, it raises a NULL pointer dereference error in drm_info(). Fixes: e8a3319c31a1 ("drm/i915: Allow error capture without a request") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/12309 Reviewed-by: Andi Shyti <andi.shyti(a)linux.intel.com> Cc: John Harrison <John.C.Harrison(a)Intel.com> Cc: <stable(a)vger.kernel.org> # v6.3+ Signed-off-by: Eugene Kobyak <eugene.kobyak(a)intel.com> --- v2: - return drm_info to separate condition v3: - create separate condition which generate string if intel_context exist v4: - rollback and add check intel_context in log condition v5: - create separate string with guc_id if intel_context exist v6: - print changed log if intel_context exist drivers/gpu/drm/i915/i915_gpu_error.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c index 135ded17334e..d88cefb889c3 100644 --- a/drivers/gpu/drm/i915/i915_gpu_error.c +++ b/drivers/gpu/drm/i915/i915_gpu_error.c @@ -1643,9 +1643,21 @@ capture_engine(struct intel_engine_cs *engine, return NULL; intel_engine_get_hung_entity(engine, &ce, &rq); - if (rq && !i915_request_started(rq)) - drm_info(&engine->gt->i915->drm, "Got hung context on %s with active request %lld:%lld [0x%04X] not yet started\n", - engine->name, rq->fence.context, rq->fence.seqno, ce->guc_id.id); + if (rq && !i915_request_started(rq)) { + /* + * We want to know also what is the gcu_id of the context, + * but if we don't have the context reference, then skip + * printing it. + */ + if (ce) + drm_info(&engine->gt->i915->drm, + "Got hung context on %s with active request %lld:%lld [0x%04X] not yet started\n", + engine->name, rq->fence.context, rq->fence.seqno, ce->guc_id.id); + else + drm_info(&engine->gt->i915->drm, + "Got hung context on %s with active request %lld:%lld not yet started\n", + engine->name, rq->fence.context, rq->fence.seqno); + } if (rq) { capture = intel_engine_coredump_add_request(ee, rq, ATOMIC_MAYFAIL); -- 2.34.1

4 months, 4 weeks

4
5
0 0

[PATCH] drm: cast calculation to __u64 to fix potential integer overflow

by Gax-c

From: Zichen Xie <zichenxie0106(a)gmail.com> Like commit b0b0d811eac6 ("drm/mediatek: Fix coverity issue with unintentional integer overflow"), directly multiply pitch and height may lead to integer overflow. Add a cast to avoid it. Fixes: 6d1782919dc9 ("drm/cma: Introduce drm_gem_cma_dumb_create_internal()") Fixes: dc5698e80cf7 ("Add virtio gpu driver.") Fixes: dc6057ecb39e ("drm/tegra: gem: dumb: pitch and size are outputs") Signed-off-by: Zichen Xie <zichenxie0106(a)gmail.com> Cc: stable(a)vger.kernel.org --- drivers/gpu/drm/drm_gem_dma_helper.c | 6 +++--- drivers/gpu/drm/tegra/gem.c | 2 +- drivers/gpu/drm/virtio/virtgpu_gem.c | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/drm_gem_dma_helper.c b/drivers/gpu/drm/drm_gem_dma_helper.c index 870b90b78bc4..020c3b17fc02 100644 --- a/drivers/gpu/drm/drm_gem_dma_helper.c +++ b/drivers/gpu/drm/drm_gem_dma_helper.c @@ -272,8 +272,8 @@ int drm_gem_dma_dumb_create_internal(struct drm_file *file_priv, if (args->pitch < min_pitch) args->pitch = min_pitch; - if (args->size < args->pitch * args->height) - args->size = args->pitch * args->height; + if (args->size < (__u64)args->pitch * args->height) + args->size = (__u64)args->pitch * args->height; dma_obj = drm_gem_dma_create_with_handle(file_priv, drm, args->size, &args->handle); @@ -306,7 +306,7 @@ int drm_gem_dma_dumb_create(struct drm_file *file_priv, struct drm_gem_dma_object *dma_obj; args->pitch = DIV_ROUND_UP(args->width * args->bpp, 8); - args->size = args->pitch * args->height; + args->size = (__u64)args->pitch * args->height; dma_obj = drm_gem_dma_create_with_handle(file_priv, drm, args->size, &args->handle); diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c index d275404ad0e9..a84acdbbbe3f 100644 --- a/drivers/gpu/drm/tegra/gem.c +++ b/drivers/gpu/drm/tegra/gem.c @@ -548,7 +548,7 @@ int tegra_bo_dumb_create(struct drm_file *file, struct drm_device *drm, struct tegra_bo *bo; args->pitch = round_up(min_pitch, tegra->pitch_align); - args->size = args->pitch * args->height; + args->size = (__u64)args->pitch * args->height; bo = tegra_bo_create_with_handle(file, drm, args->size, 0, &args->handle); diff --git a/drivers/gpu/drm/virtio/virtgpu_gem.c b/drivers/gpu/drm/virtio/virtgpu_gem.c index 7db48d17ee3a..d5407316b12e 100644 --- a/drivers/gpu/drm/virtio/virtgpu_gem.c +++ b/drivers/gpu/drm/virtio/virtgpu_gem.c @@ -72,7 +72,7 @@ int virtio_gpu_mode_dumb_create(struct drm_file *file_priv, return -EINVAL; pitch = args->width * 4; - args->size = pitch * args->height; + args->size = (__u64)pitch * args->height; args->size = ALIGN(args->size, PAGE_SIZE); params.format = virtio_gpu_translate_format(DRM_FORMAT_HOST_XRGB8888); -- 2.34.1

4 months, 4 weeks

2
1
0 0

[PATCH v2 0/4] media: uvcvideo: Two fixes for async controls

by Ricardo Ribalda

This patchset fixes two bugs with the async controls for the uvc driver. They were found while implementing the granular PM, but I am sending them as a separate patches, so they can be reviewed sooner. They fix real issues in the driver that need to be taken care. Signed-off-by: Ricardo Ribalda <ribalda(a)chromium.org> --- Changes in v2: - Annotate lockdep - ctrl->handle != handle - Change order of patches - Move documentation of mutex - Link to v1: https://lore.kernel.org/r/20241127-uvc-fix-async-v1-0-eb8722531b8c@chromium… --- Ricardo Ribalda (4): media: uvcvideo: Remove dangling pointers media: uvcvideo: Do not set an async control owned by other fh media: uvcvideo: Annotate lock requirements for uvc_ctrl_set media: uvcvideo: Remove redundant NULL assignment drivers/media/usb/uvc/uvc_ctrl.c | 48 +++++++++++++++++++++++++++++++++++----- drivers/media/usb/uvc/uvc_v4l2.c | 2 ++ drivers/media/usb/uvc/uvcvideo.h | 8 ++++++- 3 files changed, 52 insertions(+), 6 deletions(-) --- base-commit: 72ad4ff638047bbbdf3232178fea4bec1f429319 change-id: 20241127-uvc-fix-async-2c9d40413ad8 Best regards, -- Ricardo Ribalda <ribalda(a)chromium.org>

4 months, 4 weeks

4
43
0 0

[PATCH 0/6] arm64/sme: Collected SME fixes

by Mark Brown

This series collects the various SME related fixes that were previously posted separately. These should address all the issues I am aware of so a patch which reenables the SME configuration option is also included. Signed-off-by: Mark Brown <broonie(a)kernel.org> --- Mark Brown (6): arm64/sme: Flush foreign register state in do_sme_acc() arm64/fp: Don't corrupt FPMR when streaming mode changes arm64/ptrace: Zero FPMR on streaming mode entry/exit arm64/signal: Consistently invalidate the in register FP state in restore arm64/signal: Avoid corruption of SME state when entering signal handler arm64/sme: Reenable SME arch/arm64/Kconfig | 1 - arch/arm64/include/asm/fpsimd.h | 1 + arch/arm64/kernel/fpsimd.c | 49 +++++++++++++++++++++-- arch/arm64/kernel/ptrace.c | 12 +++++- arch/arm64/kernel/signal.c | 89 +++++++++++------------------------------ 5 files changed, 79 insertions(+), 73 deletions(-) --- base-commit: 40384c840ea1944d7c5a392e8975ed088ecf0b37 change-id: 20241202-arm64-sme-reenable-98e64c161a8e Best regards, -- Mark Brown <broonie(a)kernel.org>

4 months, 4 weeks

2
11
0 0

[PATCH] x86/mm: Add _PAGE_NOPTISHADOW bit to avoid updating userspace page tables

by David Woodhouse

From: David Woodhouse <dwmw(a)amazon.co.uk> The set_p4d() and set_pgd() functions (in 4-level or 5-level page table setups respectively) assume that the root page table is actually a 8KiB allocation, with the userspace root immediately after the kernel root page table (so that the former can enforce NX on on all the subordinate page tables, which are actually shared). However, users of the kernel_ident_mapping_init() code do not give it an 8KiB allocation for its PGD. Both swsusp_arch_resume() and acpi_mp_setup_reset() allocate only a single 4KiB page. The kexec code on x86_64 currently gets away with it purely by chance, because it allocates 8KiB for its "control code page" and then actually uses the first half for the PGD, then copies the actual trampoline code into the second half only after the identmap code has finished scribbling over it. Fix this by defining a _PAGE_NOPTISHADOW bit (which can use the same bit as _PAGE_SAVED_DIRTY since one is only for the PGD/P4D root and the other is exclusively for leaf PTEs.). This instructs __pti_set_user_pgtbl() not to write to the userspace 'shadow' PGD. Strictly, the _PAGE_NOPTISHADOW bit doesn't need to be written out to the actual page tables; since __pti_set_user_pgtbl() returns the value to be written to the kernel page table, it could be filtered out. But there seems to be no benefit to actually doing so. Cc: stable(a)kernel.org Suggested-by: Dave Hansen <dave.hansen(a)intel.com> Signed-off-by: David Woodhouse <dwmw(a)amazon.co.uk> --- Split out from the kexec-debug series at https://lore.kernel.org/kexec/c16ed8f5c960c34f05b88b84a31f28a610f6a3cf.came… because it looks like it's an actual bug fix for the hibernate and acpi_mp cases. It only bites kexec after I take away the extra 4KiB that we were letting it safely scribble on purely by chance. Added Cc:stable for discussion but the simpler fix there might just be to allocate a full 8KiB for the PGD for the affected use cases? arch/x86/include/asm/pgtable_types.h | 8 ++++++-- arch/x86/mm/ident_map.c | 6 +++--- arch/x86/mm/pti.c | 2 +- 3 files changed, 10 insertions(+), 6 deletions(-) diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h index 6f82e75b6149..4b804531b03c 100644 --- a/arch/x86/include/asm/pgtable_types.h +++ b/arch/x86/include/asm/pgtable_types.h @@ -36,10 +36,12 @@ #define _PAGE_BIT_DEVMAP _PAGE_BIT_SOFTW4 #ifdef CONFIG_X86_64 -#define _PAGE_BIT_SAVED_DIRTY _PAGE_BIT_SOFTW5 /* Saved Dirty bit */ +#define _PAGE_BIT_SAVED_DIRTY _PAGE_BIT_SOFTW5 /* Saved Dirty bit (leaf) */ +#define _PAGE_BIT_NOPTISHADOW _PAGE_BIT_SOFTW5 /* No PTI shadow (root PGD) */ #else /* Shared with _PAGE_BIT_UFFD_WP which is not supported on 32 bit */ -#define _PAGE_BIT_SAVED_DIRTY _PAGE_BIT_SOFTW2 /* Saved Dirty bit */ +#define _PAGE_BIT_SAVED_DIRTY _PAGE_BIT_SOFTW2 /* Saved Dirty bit (leaf) */ +#define _PAGE_BIT_NOPTISHADOW _PAGE_BIT_SOFTW2 /* No PTI shadow (root PGD) */ #endif /* If _PAGE_BIT_PRESENT is clear, we use these: */ @@ -139,6 +141,8 @@ #define _PAGE_PROTNONE (_AT(pteval_t, 1) << _PAGE_BIT_PROTNONE) +#define _PAGE_NOPTISHADOW (_AT(pteval_t, 1) << _PAGE_BIT_NOPTISHADOW) + /* * Set of bits not changed in pte_modify. The pte's * protection key is treated like _PAGE_RW, for diff --git a/arch/x86/mm/ident_map.c b/arch/x86/mm/ident_map.c index 437e96fb4977..5ab7bd2f1983 100644 --- a/arch/x86/mm/ident_map.c +++ b/arch/x86/mm/ident_map.c @@ -174,7 +174,7 @@ static int ident_p4d_init(struct x86_mapping_info *info, p4d_t *p4d_page, if (result) return result; - set_p4d(p4d, __p4d(__pa(pud) | info->kernpg_flag)); + set_p4d(p4d, __p4d(__pa(pud) | info->kernpg_flag | _PAGE_NOPTISHADOW)); } return 0; @@ -218,14 +218,14 @@ int kernel_ident_mapping_init(struct x86_mapping_info *info, pgd_t *pgd_page, if (result) return result; if (pgtable_l5_enabled()) { - set_pgd(pgd, __pgd(__pa(p4d) | info->kernpg_flag)); + set_pgd(pgd, __pgd(__pa(p4d) | info->kernpg_flag | _PAGE_NOPTISHADOW)); } else { /* * With p4d folded, pgd is equal to p4d. * The pgd entry has to point to the pud page table in this case. */ pud_t *pud = pud_offset(p4d, 0); - set_pgd(pgd, __pgd(__pa(pud) | info->kernpg_flag)); + set_pgd(pgd, __pgd(__pa(pud) | info->kernpg_flag | _PAGE_NOPTISHADOW)); } } diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c index 851ec8f1363a..5f0d579932c6 100644 --- a/arch/x86/mm/pti.c +++ b/arch/x86/mm/pti.c @@ -132,7 +132,7 @@ pgd_t __pti_set_user_pgtbl(pgd_t *pgdp, pgd_t pgd) * Top-level entries added to init_mm's usermode pgd after boot * will not be automatically propagated to other mms. */ - if (!pgdp_maps_userspace(pgdp)) + if (!pgdp_maps_userspace(pgdp) || (pgd.pgd & _PAGE_NOPTISHADOW)) return pgd; /* -- 2.47.0

4 months, 4 weeks

2
1
0 0

[PATCH 01/11] x86/Kconfig: Geode CPU has cmpxchg8b

by Arnd Bergmann

From: Arnd Bergmann <arnd(a)arndb.de> An older cleanup of mine inadvertently removed geode-gx1 and geode-lx from the list of CPUs that are known to support a working cmpxchg8b. Fixes: 88a2b4edda3d ("x86/Kconfig: Rework CONFIG_X86_PAE dependency") Cc: stable(a)vger.kernel.org Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> --- arch/x86/Kconfig.cpu | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu index 2a7279d80460..42e6a40876ea 100644 --- a/arch/x86/Kconfig.cpu +++ b/arch/x86/Kconfig.cpu @@ -368,7 +368,7 @@ config X86_HAVE_PAE config X86_CMPXCHG64 def_bool y - depends on X86_HAVE_PAE || M586TSC || M586MMX || MK6 || MK7 + depends on X86_HAVE_PAE || M586TSC || M586MMX || MK6 || MK7 || MGEODEGX1 || MGEODE_LX # this should be set for all -march=.. options where the compiler # generates cmov. -- 2.39.5

4 months, 4 weeks

1
0
0 0

[PATCH v2] btrfs: do proper folio cleanup when cow_file_range() failed

by Qu Wenruo

[BUG] When testing with COW fixup marked as BUG_ON() (this is involved with the new pin_user_pages*() change, which should not result new out-of-band dirty pages), I hit a crash triggered by the BUG_ON() from hitting COW fixup path. This BUG_ON() happens just after a failed btrfs_run_delalloc_range(): BTRFS error (device dm-2): failed to run delalloc range, root 348 ino 405 folio 65536 submit_bitmap 6-15 start 90112 len 106496: -28 ------------[ cut here ]------------ kernel BUG at fs/btrfs/extent_io.c:1444! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 0 UID: 0 PID: 434621 Comm: kworker/u24:8 Tainted: G OE 6.12.0-rc7-custom+ #86 Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs] pc : extent_writepage_io+0x2d4/0x308 [btrfs] lr : extent_writepage_io+0x2d4/0x308 [btrfs] Call trace: extent_writepage_io+0x2d4/0x308 [btrfs] extent_writepage+0x218/0x330 [btrfs] extent_write_cache_pages+0x1d4/0x4b0 [btrfs] btrfs_writepages+0x94/0x150 [btrfs] do_writepages+0x74/0x190 filemap_fdatawrite_wbc+0x88/0xc8 start_delalloc_inodes+0x180/0x3b0 [btrfs] btrfs_start_delalloc_roots+0x174/0x280 [btrfs] shrink_delalloc+0x114/0x280 [btrfs] flush_space+0x250/0x2f8 [btrfs] btrfs_async_reclaim_data_space+0x180/0x228 [btrfs] process_one_work+0x164/0x408 worker_thread+0x25c/0x388 kthread+0x100/0x118 ret_from_fork+0x10/0x20 Code: aa1403e1 9402f3ef aa1403e0 9402f36f (d4210000) ---[ end trace 0000000000000000 ]--- [CAUSE] That failure is mostly from cow_file_range(), where we can hit -ENOSPC. Although the -ENOSPC is already a bug related to our space reservation code, let's just focus on the error handling. For example, we have the following dirty range [0, 64K) of an inode, with 4K sector size and 4K page size: 0 16K 32K 48K 64K |///////////////////////////////////////| |#######################################| Where |///| means page are still dirty, and |###| means the extent io tree has EXTENT_DELALLOC flag. - Enter extent_writepage() for page 0 - Enter btrfs_run_delalloc_range() for range [0, 64K) - Enter cow_file_range() for range [0, 64K) - Function btrfs_reserve_extent() only reserved one 16K extent So we created extent map and ordered extent for range [0, 16K) 0 16K 32K 48K 64K |////////|//////////////////////////////| |<- OE ->|##############################| And range [0, 16K) has its delalloc flag cleared. But since we haven't yet submit any bio, involved 4 pages are still dirty. - Function btrfs_reserve_extent() return with -ENOSPC Now we have to run error cleanup, which will clear all EXTENT_DELALLOC* flags and clear the dirty flags for the remaining ranges: 0 16K 32K 48K 64K |////////| | | | | Note that range [0, 16K) still has their pages dirty. - Some time later, writeback are triggered again for the range [0, 16K) since the page range still have dirty flags. - btrfs_run_delalloc_range() will do nothing because there is no EXTENT_DELALLOC flag. - extent_writepage_io() find page 0 has no ordered flag Which falls into the COW fixup path, triggering the BUG_ON(). Unfortunately this error handling bug dates back to the introduction of btrfs. Thankfully with the abuse of cow fixup, at least it won't crash the kernel. [FIX] Instead of immediately unlock the extent and folios, we keep the extent and folios locked until either erroring out or the whole delalloc range finished. When the whole delalloc range finished without error, we just unlock the whole range with PAGE_SET_ORDERED (and PAGE_UNLOCK for !keep_locked cases), with EXTENT_DELALLOC and EXTENT_LOCKED cleared. And those involved folios will be properly submitted, with their dirty flags cleared during submission. For the error path, it will be a little more complex: - The range with ordered extent allocated (range (1)) We only clear the EXTENT_DELALLOC and EXTENT_LOCKED, as the remaining flags are cleaned up by btrfs_mark_ordered_io_finished()->btrfs_finish_one_ordered(). For folios we finish the IO (clear dirty, start writeback and immediately finish the writeback) and unlock the folios. - The range with reserved extent but no ordered extent (range(2)) - The range we never touched (range(3)) For both range (2) and range(3) the behavior is not changed. Now even if cow_file_range() failed halfway with some successfully reserved extents/ordered extents, we will keep all folios clean, so there will be no future writeback triggered on them. Cc: stable(a)vger.kernel.org Signed-off-by: Qu Wenruo <wqu(a)suse.com> --- Changelog: v2: - Fix the error handling for range (1) Where the patch is still using the old "0", which will not unlock the extent range. --- fs/btrfs/inode.c | 65 ++++++++++++++++++++++++------------------------ 1 file changed, 32 insertions(+), 33 deletions(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 9267861f8ab0..9517fb2df649 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -1372,6 +1372,17 @@ static noinline int cow_file_range(struct btrfs_inode *inode, alloc_hint = btrfs_get_extent_allocation_hint(inode, start, num_bytes); + /* + * We're not doing compressed IO, don't unlock the first page + * (which the caller expects to stay locked), don't clear any + * dirty bits and don't set any writeback bits + * + * Do set the Ordered (Private2) bit so we know this page was + * properly setup for writepage. + */ + page_ops = (keep_locked ? 0 : PAGE_UNLOCK); + page_ops |= PAGE_SET_ORDERED; + /* * Relocation relies on the relocated extents to have exactly the same * size as the original extents. Normally writeback for relocation data @@ -1431,6 +1442,10 @@ static noinline int cow_file_range(struct btrfs_inode *inode, file_extent.offset = 0; file_extent.compression = BTRFS_COMPRESS_NONE; + /* + * Locked range will be released either during error clean up or + * after the whole range is finished. + */ lock_extent(&inode->io_tree, start, start + cur_alloc_size - 1, &cached); @@ -1476,21 +1491,6 @@ static noinline int cow_file_range(struct btrfs_inode *inode, btrfs_dec_block_group_reservations(fs_info, ins.objectid); - /* - * We're not doing compressed IO, don't unlock the first page - * (which the caller expects to stay locked), don't clear any - * dirty bits and don't set any writeback bits - * - * Do set the Ordered (Private2) bit so we know this page was - * properly setup for writepage. - */ - page_ops = (keep_locked ? 0 : PAGE_UNLOCK); - page_ops |= PAGE_SET_ORDERED; - - extent_clear_unlock_delalloc(inode, start, start + cur_alloc_size - 1, - locked_folio, &cached, - EXTENT_LOCKED | EXTENT_DELALLOC, - page_ops); if (num_bytes < cur_alloc_size) num_bytes = 0; else @@ -1507,6 +1507,9 @@ static noinline int cow_file_range(struct btrfs_inode *inode, if (ret) goto out_unlock; } + extent_clear_unlock_delalloc(inode, orig_start, end, locked_folio, &cached, + EXTENT_LOCKED | EXTENT_DELALLOC, + page_ops); done: if (done_offset) *done_offset = end; @@ -1527,35 +1530,31 @@ static noinline int cow_file_range(struct btrfs_inode *inode, * We process each region below. */ - clear_bits = EXTENT_LOCKED | EXTENT_DELALLOC | EXTENT_DELALLOC_NEW | - EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV; - page_ops = PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK; - /* * For the range (1). We have already instantiated the ordered extents * for this region. They are cleaned up by * btrfs_cleanup_ordered_extents() in e.g, - * btrfs_run_delalloc_range(). EXTENT_LOCKED | EXTENT_DELALLOC are - * already cleared in the above loop. And, EXTENT_DELALLOC_NEW | - * EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV are handled by the cleanup - * function. + * btrfs_run_delalloc_range(). + * EXTENT_DELALLOC_NEW | EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV + * are also handled by the cleanup function. * - * However, in case of @keep_locked, we still need to unlock the pages - * (except @locked_folio) to ensure all the pages are unlocked. + * So here we only clear EXTENT_LOCKED and EXTENT_DELALLOC flag, + * and finish the writeback of the involved folios, which will be + * never submitted. */ - if (keep_locked && orig_start < start) { + if (orig_start < start) { + clear_bits = EXTENT_LOCKED | EXTENT_DELALLOC; + page_ops = PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK; + if (!locked_folio) mapping_set_error(inode->vfs_inode.i_mapping, ret); extent_clear_unlock_delalloc(inode, orig_start, start - 1, - locked_folio, NULL, 0, page_ops); + locked_folio, NULL, clear_bits, page_ops); } - /* - * At this point we're unlocked, we want to make sure we're only - * clearing these flags under the extent lock, so lock the rest of the - * range and clear everything up. - */ - lock_extent(&inode->io_tree, start, end, NULL); + clear_bits = EXTENT_LOCKED | EXTENT_DELALLOC | EXTENT_DELALLOC_NEW | + EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV; + page_ops = PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK; /* * For the range (2). If we reserved an extent for our delalloc range -- 2.47.1

4 months, 4 weeks

1
0
0 0

[PATCH] crypto: qce - fix priority to be less than ARMv8 CE

by Eric Biggers

From: Eric Biggers <ebiggers(a)google.com> As QCE is an order of magnitude slower than the ARMv8 Crypto Extensions on the CPU, and is also less well tested, give it a lower priority. Previously the QCE SHA algorithms had higher priority than the ARMv8 CE equivalents, and the ciphers such as AES-XTS had the same priority which meant the QCE versions were chosen if they happened to be loaded later. Fixes: ec8f5d8f6f76 ("crypto: qce - Qualcomm crypto engine driver") Cc: stable(a)vger.kernel.org Cc: Bartosz Golaszewski <brgl(a)bgdev.pl> Cc: Neil Armstrong <neil.armstrong(a)linaro.org> Cc: Thara Gopinath <thara.gopinath(a)gmail.com> Signed-off-by: Eric Biggers <ebiggers(a)google.com> --- drivers/crypto/qce/aead.c | 2 +- drivers/crypto/qce/sha.c | 2 +- drivers/crypto/qce/skcipher.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/crypto/qce/aead.c b/drivers/crypto/qce/aead.c index 7d811728f047..97b56e92ea33 100644 --- a/drivers/crypto/qce/aead.c +++ b/drivers/crypto/qce/aead.c @@ -784,11 +784,11 @@ static int qce_aead_register_one(const struct qce_aead_def *def, struct qce_devi alg->encrypt = qce_aead_encrypt; alg->decrypt = qce_aead_decrypt; alg->init = qce_aead_init; alg->exit = qce_aead_exit; - alg->base.cra_priority = 300; + alg->base.cra_priority = 275; alg->base.cra_flags = CRYPTO_ALG_ASYNC | CRYPTO_ALG_ALLOCATES_MEMORY | CRYPTO_ALG_KERN_DRIVER_ONLY | CRYPTO_ALG_NEED_FALLBACK; alg->base.cra_ctxsize = sizeof(struct qce_aead_ctx); diff --git a/drivers/crypto/qce/sha.c b/drivers/crypto/qce/sha.c index fc72af8aa9a7..71b748183cfa 100644 --- a/drivers/crypto/qce/sha.c +++ b/drivers/crypto/qce/sha.c @@ -480,11 +480,11 @@ static int qce_ahash_register_one(const struct qce_ahash_def *def, else if (IS_SHA256(def->flags)) tmpl->hash_zero = sha256_zero_message_hash; base = &alg->halg.base; base->cra_blocksize = def->blocksize; - base->cra_priority = 300; + base->cra_priority = 175; base->cra_flags = CRYPTO_ALG_ASYNC | CRYPTO_ALG_KERN_DRIVER_ONLY; base->cra_ctxsize = sizeof(struct qce_sha_ctx); base->cra_alignmask = 0; base->cra_module = THIS_MODULE; base->cra_init = qce_ahash_cra_init; diff --git a/drivers/crypto/qce/skcipher.c b/drivers/crypto/qce/skcipher.c index 5b493fdc1e74..ffb334eb5b34 100644 --- a/drivers/crypto/qce/skcipher.c +++ b/drivers/crypto/qce/skcipher.c @@ -459,11 +459,11 @@ static int qce_skcipher_register_one(const struct qce_skcipher_def *def, IS_DES(def->flags) ? qce_des_setkey : qce_skcipher_setkey; alg->encrypt = qce_skcipher_encrypt; alg->decrypt = qce_skcipher_decrypt; - alg->base.cra_priority = 300; + alg->base.cra_priority = 275; alg->base.cra_flags = CRYPTO_ALG_ASYNC | CRYPTO_ALG_ALLOCATES_MEMORY | CRYPTO_ALG_KERN_DRIVER_ONLY; alg->base.cra_ctxsize = sizeof(struct qce_cipher_ctx); alg->base.cra_alignmask = 0; base-commit: ceb8bf2ceaa77fe222fe8fe32cb7789c9099ddf1 -- 2.47.1

4 months, 4 weeks

3
2
0 0

Re: kernel v6.7 warn in add_uevent_var: buffer size too small

by Greg KH

On Wed, Dec 04, 2024 at 05:29:26PM +0800, wzs wrote: > Hello, > when fuzzing the Linux kernel 6.7.0, > the following crash was triggered. > > kernel config : https://pastebin.com/3JeQFdUr > console output : https://pastebin.com/9ADtBQtP > > Basically, we use gadget module to simulate the connection and interaction > process of a USB device > (device type code : 0003, vendor id : 046D, product id : C312, serial > number : 27B4, with function : input event). > > It seems to be caused by a mismatch between the uevent's environmental > limit and the buffer size used to receive the uevent, which triggers such > kernel warning. > > The crash report is as follow: > 、、、 > [203835.102225] input: wingfuz Keyboard as > /devices/platform/dummy_hcd.0/usb3/3-1/3-1:1.0/0003:046D:C312.27B4/input/input5893 > [203835.155527] ------------[ cut here ]------------ > [203835.155533] add_uevent_var: buffer size too small > [203835.162092] WARNING: CPU: 11 PID: 57434 at lib/kobject_uevent.c:671 > add_uevent_var+0x2fe/0x390 I think this is already fixed in newer kernel versions. 6.7.0 is very old and obsolete. Can you test this on 6.12.1? thanks, greg k-h

4 months, 4 weeks

1
0
0 0

[PATCH 0/6] rtc: Fix problems with missing UIE irqs

by Esben Haabendal

This fixes a couple of different problems, that can cause RTC (alarm) irqs to be missing when generating UIE interrupts. The first commit fixes a long-standing problem, which has been documented in a comment since 2010. This fixes a race that could cause UIE irqs to stop being generated, which was easily reproduced by timing the use of RTC_UIE_ON ioctl with the seconds tick in the RTC. The last commit ensures that RTC (alarm) irqs are enabled whenever RTC_UIE_ON ioctl is used. The driver specific commits avoids kernel warnings about unbalanced enable_irq/disable_irq, which gets triggered on first RTC_UIE_ON with the last commit. Before this series, the same warning should be seen on initial RTC_AIE_ON with those drivers. Signed-off-by: Esben Haabendal <esben(a)geanix.com> --- Esben Haabendal (6): rtc: interface: Fix long-standing race when setting alarm rtc: isl12022: Fix initial enable_irq/disable_irq balance rtc: cpcap: Fix initial enable_irq/disable_irq balance rtc: st-lpc: Fix initial enable_irq/disable_irq balance rtc: tps6586x: Fix initial enable_irq/disable_irq balance rtc: interface: Ensure alarm irq is enabled when UIE is enabled drivers/rtc/interface.c | 27 +++++++++++++++++++++++++++ drivers/rtc/rtc-cpcap.c | 1 + drivers/rtc/rtc-isl12022.c | 1 + drivers/rtc/rtc-st-lpc.c | 1 + drivers/rtc/rtc-tps6586x.c | 1 + 5 files changed, 31 insertions(+) --- base-commit: 40384c840ea1944d7c5a392e8975ed088ecf0b37 change-id: 20241203-rtc-uie-irq-fixes-f2838782d0f8 Best regards, -- Esben Haabendal <esben(a)geanix.com>

4 months, 4 weeks

1
3
0 0

[PATCH v2 5.15] tty: n_gsm: Fix use-after-free in gsm_cleanup_mux

by mingli.yu＠eng.windriver.com

From: Longlong Xia <xialonglong(a)kylinos.cn> commit 9462f4ca56e7d2430fdb6dcc8498244acbfc4489 upstream. BUG: KASAN: slab-use-after-free in gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] Read of size 8 at addr ffff88815fe99c00 by task poc/3379 CPU: 0 UID: 0 PID: 3379 Comm: poc Not tainted 6.11.0+ #56 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 Call Trace: <TASK> gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] __pfx_gsm_cleanup_mux+0x10/0x10 drivers/tty/n_gsm.c:3124 [n_gsm] __pfx_sched_clock_cpu+0x10/0x10 kernel/sched/clock.c:389 update_load_avg+0x1c1/0x27b0 kernel/sched/fair.c:4500 __pfx_min_vruntime_cb_rotate+0x10/0x10 kernel/sched/fair.c:846 __rb_insert_augmented+0x492/0xbf0 lib/rbtree.c:161 gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm] _raw_spin_lock_irqsave+0x92/0xf0 arch/x86/include/asm/atomic.h:107 __pfx_gsmld_ioctl+0x10/0x10 drivers/tty/n_gsm.c:3822 [n_gsm] ktime_get+0x5e/0x140 kernel/time/timekeeping.c:195 ldsem_down_read+0x94/0x4e0 arch/x86/include/asm/atomic64_64.h:79 __pfx_ldsem_down_read+0x10/0x10 drivers/tty/tty_ldsem.c:338 __pfx_do_vfs_ioctl+0x10/0x10 fs/ioctl.c:805 tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818 Allocated by task 65: gsm_data_alloc.constprop.0+0x27/0x190 drivers/tty/n_gsm.c:926 [n_gsm] gsm_send+0x2c/0x580 drivers/tty/n_gsm.c:819 [n_gsm] gsm1_receive+0x547/0xad0 drivers/tty/n_gsm.c:3038 [n_gsm] gsmld_receive_buf+0x176/0x280 drivers/tty/n_gsm.c:3609 [n_gsm] tty_ldisc_receive_buf+0x101/0x1e0 drivers/tty/tty_buffer.c:391 tty_port_default_receive_buf+0x61/0xa0 drivers/tty/tty_port.c:39 flush_to_ldisc+0x1b0/0x750 drivers/tty/tty_buffer.c:445 process_scheduled_works+0x2b0/0x10d0 kernel/workqueue.c:3229 worker_thread+0x3dc/0x950 kernel/workqueue.c:3391 kthread+0x2a3/0x370 kernel/kthread.c:389 ret_from_fork+0x2d/0x70 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:257 Freed by task 3367: kfree+0x126/0x420 mm/slub.c:4580 gsm_cleanup_mux+0x36c/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm] tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818 [Analysis] gsm_msg on the tx_ctrl_list or tx_data_list of gsm_mux can be freed by multi threads through ioctl,which leads to the occurrence of uaf. Protect it by gsm tx lock. Signed-off-by: Longlong Xia <xialonglong(a)kylinos.cn> Cc: stable <stable(a)kernel.org> Suggested-by: Jiri Slaby <jirislaby(a)kernel.org> Link: https://lore.kernel.org/r/20240926130213.531959-1-xialonglong@kylinos.cn Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [Mingli: Backport to fix CVE-2024-50073, no guard macro defined resolution] Signed-off-by: Mingli Yu <mingli.yu(a)windriver.com> --- drivers/tty/n_gsm.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index aae9f73585bd..1becbdf7c470 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -2443,6 +2443,7 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc) int i; struct gsm_dlci *dlci; struct gsm_msg *txq, *ntxq; + unsigned long flags; gsm->dead = true; mutex_lock(&gsm->mutex); @@ -2471,9 +2472,12 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc) mutex_unlock(&gsm->mutex); /* Now wipe the queues */ tty_ldisc_flush(gsm->tty); + + spin_lock_irqsave(&gsm->tx_lock, flags); list_for_each_entry_safe(txq, ntxq, &gsm->tx_list, list) kfree(txq); INIT_LIST_HEAD(&gsm->tx_list); + spin_unlock_irqrestore(&gsm->tx_lock, flags); } /** -- 2.34.1

4 months, 4 weeks

4
4
0 0

[PATCH net] net :mana :Request a V2 response version for MANA_QUERY_GF_STAT

by Shradha Gupta

The current requested response version(V1) for MANA_QUERY_GF_STAT query results in STATISTICS_FLAGS_TX_ERRORS_GDMA_ERROR value being set to 0 always. In order to get the correct value for this counter we request the response version to be V2. Cc: stable(a)vger.kernel.org Fixes: e1df5202e879 ("net :mana :Add remaining GDMA stats for MANA to ethtool") Signed-off-by: Shradha Gupta <shradhagupta(a)linux.microsoft.com> --- drivers/net/ethernet/microsoft/mana/mana_en.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c index 57ac732e7707..f73848a4feb3 100644 --- a/drivers/net/ethernet/microsoft/mana/mana_en.c +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c @@ -2536,6 +2536,7 @@ void mana_query_gf_stats(struct mana_port_context *apc) mana_gd_init_req_hdr(&req.hdr, MANA_QUERY_GF_STAT, sizeof(req), sizeof(resp)); + req.hdr.resp.msg_version = GDMA_MESSAGE_V2; req.req_stats = STATISTICS_FLAGS_RX_DISCARDS_NO_WQE | STATISTICS_FLAGS_RX_ERRORS_VPORT_DISABLED | STATISTICS_FLAGS_HC_RX_BYTES | -- 2.43.0

4 months, 4 weeks

1
0
0 0

Re: [PATCH] riscv: Fix vector state restore in rt_sigreturn()

by Yangyu Chen

I think this patch should also be backported to the v6.6 LTS tree. Since it should recolonize as Fixes: 8ee0b41898 ("riscv: signal: Add sigcontext save/restore for vector") and that commit first appears since v6.5-rc1 and this patch land to master branch since v6.9-rc3 Thanks, Yangyu Chen On 4/3/24 15:26, Björn Töpel wrote: > From: Björn Töpel <bjorn(a)rivosinc.com> > The RISC-V Vector specification states in "Appendix D: Calling > Convention for Vector State" [1] that "Executing a system call causes > all caller-saved vector registers (v0-v31, vl, vtype) and vstart to > become unspecified.". In the RISC-V kernel this is called "discarding > the vstate". > Returning from a signal handler via the rt_sigreturn() syscall, vector > discard is also performed. However, this is not an issue since the > vector state should be restored from the sigcontext, and therefore not > care about the vector discard. > The "live state" is the actual vector register in the running context, > and the "vstate" is the vector state of the task. A dirty live state, > means that the vstate and live state are not in synch. > When vectorized user_from_copy() was introduced, an bug sneaked in at > the restoration code, related to the discard of the live state. > An example when this go wrong: > 1. A userland application is executing vector code > 2. The application receives a signal, and the signal handler is > entered. > 3. The application returns from the signal handler, using the > rt_sigreturn() syscall. > 4. The live vector state is discarded upon entering the > rt_sigreturn(), and the live state is marked as "dirty", indicating > that the live state need to be synchronized with the current > vstate. > 5. rt_sigreturn() restores the vstate, except the Vector registers, > from the sigcontext > 6. rt_sigreturn() restores the Vector registers, from the sigcontext, > and now the vectorized user_from_copy() is used. The dirty live > state from the discard is saved to the vstate, making the vstate > corrupt. > 7. rt_sigreturn() returns to the application, which crashes due to > corrupted vstate. > Note that the vectorized user_from_copy() is invoked depending on the > value of CONFIG_RISCV_ISA_V_UCOPY_THRESHOLD. Default is 768, which > means that vlen has to be larger than 128b for this bug to trigger. > The fix is simply to mark the live state as non-dirty/clean prior > performing the vstate restore. > Link: https://github.com/riscv/riscv-isa-manual/releases/download/riscv-isa-relea… # [1] > Reported-by: Charlie Jenkins <charlie(a)rivosinc.com> > Reported-by: Vineet Gupta <vgupta(a)kernel.org> > Fixes: c2a658d41924 ("riscv: lib: vectorize copy_to_user/copy_from_user") > Signed-off-by: Björn Töpel <bjorn(a)rivosinc.com> > --- > arch/riscv/kernel/signal.c | 15 ++++++++------- > 1 file changed, 8 insertions(+), 7 deletions(-) > diff --git a/arch/riscv/kernel/signal.c b/arch/riscv/kernel/signal.c > index 501e66debf69..5a2edd7f027e 100644 > --- a/arch/riscv/kernel/signal.c > +++ b/arch/riscv/kernel/signal.c > @@ -119,6 +119,13 @@ static long __restore_v_state(struct pt_regs *regs, void __user *sc_vec) > struct __sc_riscv_v_state __user *state = sc_vec; > void __user *datap; > + /* > + * Mark the vstate as clean prior performing the actual copy, > + * to avoid getting the vstate incorrectly clobbered by the > + * discarded vector state. > + */ > + riscv_v_vstate_set_restore(current, regs); > + > /* Copy everything of __sc_riscv_v_state except datap. */ > err = __copy_from_user(&current->thread.vstate, &state->v_state, > offsetof(struct __riscv_v_ext_state, datap)); > @@ -133,13 +140,7 @@ static long __restore_v_state(struct pt_regs *regs, void __user *sc_vec) > * Copy the whole vector content from user space datap. Use > * copy_from_user to prevent information leak. > */ > - err = copy_from_user(current->thread.vstate.datap, datap, riscv_v_vsize); > - if (unlikely(err)) > - return err; > - > - riscv_v_vstate_set_restore(current, regs); > - > - return err; > + return copy_from_user(current->thread.vstate.datap, datap, riscv_v_vsize); > } > #else > #define save_v_state(task, regs) (0) > base-commit: 7115ff4a8bfed3b9294bad2e111744e6abeadf1a

4 months, 4 weeks

1
0
0 0

[PATCH net-next v2 0/5] virtio_net: correct netdev_tx_reset_queue() invocation points

by Koichiro Den

When virtnet_close is followed by virtnet_open, some TX completions can possibly remain unconsumed, until they are finally processed during the first NAPI poll after the netdev_tx_reset_queue(), resulting in a crash [1]. Commit b96ed2c97c79 ("virtio_net: move netdev_tx_reset_queue() call before RX napi enable") was not sufficient to eliminate all BQL crash cases for virtio-net. This issue can be reproduced with the latest net-next master by running: `while :; do ip l set DEV down; ip l set DEV up; done` under heavy network TX load from inside the machine. This patch series resolves the issue and also addresses similar existing problems: (a). Drop netdev_tx_reset_queue() from open/close path. This eliminates the BQL crashes due to the problematic open/close path. (b). As a result of (a), netdev_tx_reset_queue() is now explicitly required in freeze/restore path. Add netdev_tx_reset_queue() to free_unused_bufs(). (c). Fix missing resetting in virtnet_tx_resize(). virtnet_tx_resize() has lacked proper resetting since commit c8bd1f7f3e61 ("virtio_net: add support for Byte Queue Limits"). (d). Fix missing resetting in the XDP_SETUP_XSK_POOL path. Similar to (c), this path lacked proper resetting. Call netdev_tx_reset_queue() when virtqueue_reset() has actually recycled unused buffers. This patch series consists of five commits: [1/5]: Resolves (a) and (b). [2/5]: Prerequisite for (c). [3/5]: Resolves (c). [4/5]: Preresuisite for (d). [5/5]: Resolves (d). Changes for v2: - add tx queue resetting for (b) to (d) above v1: https://lore.kernel.org/all/20241130181744.3772632-1-koichiro.den@canonical… [1]: ------------[ cut here ]------------ kernel BUG at lib/dynamic_queue_limits.c:99! Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 7 UID: 0 PID: 1598 Comm: ip Tainted: G N 6.12.0net-next_main+ #2 Tainted: [N]=TEST Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), \ BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:dql_completed+0x26b/0x290 Code: b7 c2 49 89 e9 44 89 da 89 c6 4c 89 d7 e8 ed 17 47 00 58 65 ff 0d 4d 27 90 7e 0f 85 fd fe ff ff e8 ea 53 8d ff e9 f3 fe ff ff <0f> 0b 01 d2 44 89 d1 29 d1 ba 00 00 00 00 0f 48 ca e9 28 ff ff ff RSP: 0018:ffffc900002b0d08 EFLAGS: 00010297 RAX: 0000000000000000 RBX: ffff888102398c80 RCX: 0000000080190009 RDX: 0000000000000000 RSI: 000000000000006a RDI: 0000000000000000 RBP: ffff888102398c00 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000000000ca R11: 0000000000015681 R12: 0000000000000001 R13: ffffc900002b0d68 R14: ffff88811115e000 R15: ffff8881107aca40 FS: 00007f41ded69500(0000) GS:ffff888667dc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000556ccc2dc1a0 CR3: 0000000104fd8003 CR4: 0000000000772ef0 PKRU: 55555554 Call Trace: <IRQ> ? die+0x32/0x80 ? do_trap+0xd9/0x100 ? dql_completed+0x26b/0x290 ? dql_completed+0x26b/0x290 ? do_error_trap+0x6d/0xb0 ? dql_completed+0x26b/0x290 ? exc_invalid_op+0x4c/0x60 ? dql_completed+0x26b/0x290 ? asm_exc_invalid_op+0x16/0x20 ? dql_completed+0x26b/0x290 __free_old_xmit+0xff/0x170 [virtio_net] free_old_xmit+0x54/0xc0 [virtio_net] virtnet_poll+0xf4/0xe30 [virtio_net] ? __update_load_avg_cfs_rq+0x264/0x2d0 ? update_curr+0x35/0x260 ? reweight_entity+0x1be/0x260 __napi_poll.constprop.0+0x28/0x1c0 net_rx_action+0x329/0x420 ? enqueue_hrtimer+0x35/0x90 ? trace_hardirqs_on+0x1d/0x80 ? kvm_sched_clock_read+0xd/0x20 ? sched_clock+0xc/0x30 ? kvm_sched_clock_read+0xd/0x20 ? sched_clock+0xc/0x30 ? sched_clock_cpu+0xd/0x1a0 handle_softirqs+0x138/0x3e0 do_softirq.part.0+0x89/0xc0 </IRQ> <TASK> __local_bh_enable_ip+0xa7/0xb0 virtnet_open+0xc8/0x310 [virtio_net] __dev_open+0xfa/0x1b0 __dev_change_flags+0x1de/0x250 dev_change_flags+0x22/0x60 do_setlink.isra.0+0x2df/0x10b0 ? rtnetlink_rcv_msg+0x34f/0x3f0 ? netlink_rcv_skb+0x54/0x100 ? netlink_unicast+0x23e/0x390 ? netlink_sendmsg+0x21e/0x490 ? ____sys_sendmsg+0x31b/0x350 ? avc_has_perm_noaudit+0x67/0xf0 ? cred_has_capability.isra.0+0x75/0x110 ? __nla_validate_parse+0x5f/0xee0 ? __pfx___probestub_irq_enable+0x3/0x10 ? __create_object+0x5e/0x90 ? security_capable+0x3b/0x7[I0 rtnl_newlink+0x784/0xaf0 ? avc_has_perm_noaudit+0x67/0xf0 ? cred_has_capability.isra.0+0x75/0x110 ? stack_depot_save_flags+0x24/0x6d0 ? __pfx_rtnl_newlink+0x10/0x10 rtnetlink_rcv_msg+0x34f/0x3f0 ? do_syscall_64+0x6c/0x180 ? entry_SYSCALL_64_after_hwframe+0x76/0x7e ? __pfx_rtnetlink_rcv_msg+0x10/0x10 netlink_rcv_skb+0x54/0x100 netlink_unicast+0x23e/0x390 netlink_sendmsg+0x21e/0x490 ____sys_sendmsg+0x31b/0x350 ? copy_msghdr_from_user+0x6d/0xa0 ___sys_sendmsg+0x86/0xd0 ? __pte_offset_map+0x17/0x160 ? preempt_count_add+0x69/0xa0 ? __call_rcu_common.constprop.0+0x147/0x610 ? preempt_count_add+0x69/0xa0 ? preempt_count_add+0x69/0xa0 ? _raw_spin_trylock+0x13/0x60 ? trace_hardirqs_on+0x1d/0x80 __sys_sendmsg+0x66/0xc0 do_syscall_64+0x6c/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f41defe5b34 Code: 15 e1 12 0f 00 f7 d8 64 89 02 b8 ff ff ff ff eb bf 0f 1f 44 00 00 f3 0f 1e fa 80 3d 35 95 0f 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 4c c3 0f 1f 00 55 48 89 e5 48 83 ec 20 89 55 RSP: 002b:00007ffe5336ecc8 EFLAGS: 00000202 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f41defe5b34 RDX: 0000000000000000 RSI: 00007ffe5336ed30 RDI: 0000000000000003 RBP: 00007ffe5336eda0 R08: 0000000000000010 R09: 0000000000000001 R10: 00007ffe5336f6f9 R11: 0000000000000202 R12: 0000000000000003 R13: 0000000067452259 R14: 0000556ccc28b040 R15: 0000000000000000 </TASK> [...] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- Koichiro Den (5): virtio_net: correct netdev_tx_reset_queue() invocation point virtio_ring: add 'flushed' as an argument to virtqueue_resize() virtio_net: add missing netdev_tx_reset_queue() to virtnet_tx_resize() virtio_ring: add 'flushed' as an argument to virtqueue_reset() virtio_net: add missing netdev_tx_reset_queue to virtnet_sq_bind_xsk_pool() drivers/net/virtio_net.c | 18 +++++++++++++----- drivers/virtio/virtio_ring.c | 13 +++++++++++-- include/linux/virtio.h | 6 ++++-- 3 files changed, 28 insertions(+), 9 deletions(-) -- 2.43.0

4 months, 4 weeks

3
11
0 0

[PATCH] net: wireless: sme: Initialize n_channels before accessing channels in cfg80211_conn_scan

by Haoyu Li

With the new __counted_by annocation in cfg80211_scan_request struct, the "n_channels" struct member must be set before accessing the "channels" array. Failing to do so will trigger a runtime warning when enabling CONFIG_UBSAN_BOUNDS and CONFIG_FORTIFY_SOURCE. Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by") Signed-off-by: Haoyu Li <lihaoyu499(a)gmail.com> --- net/wireless/sme.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/wireless/sme.c b/net/wireless/sme.c index 431da30817a6..268171600087 100644 --- a/net/wireless/sme.c +++ b/net/wireless/sme.c @@ -83,6 +83,7 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev) if (!request) return -ENOMEM; + request->n_channels = n_channels; if (wdev->conn->params.channel) { enum nl80211_band band = wdev->conn->params.channel->band; struct ieee80211_supported_band *sband = -- 2.34.1

4 months, 4 weeks

4
4
0 0

[net] net: Make napi_hash_lock irq safe

by Joe Damato

Make napi_hash_lock IRQ safe. It is used during the control path, and is taken and released in napi_hash_add and napi_hash_del, which will typically be called by calls to napi_enable and napi_disable. This change avoids a deadlock in pcnet32 (and other any other drivers which follow the same pattern): CPU 0: pcnet32_open spin_lock_irqsave(&lp->lock, ...) napi_enable napi_hash_add <- before this executes, CPU 1 proceeds spin_lock(napi_hash_lock) [...] spin_unlock_irqrestore(&lp->lock, flags); CPU 1: pcnet32_close napi_disable napi_hash_del spin_lock(napi_hash_lock) < INTERRUPT > pcnet32_interrupt spin_lock(lp->lock) <- DEADLOCK Changing the napi_hash_lock to be IRQ safe prevents the IRQ from firing on CPU 1 until napi_hash_lock is released, preventing the deadlock. Cc: stable(a)vger.kernel.org Fixes: 86e25f40aa1e ("net: napi: Add napi_config") Reported-by: Guenter Roeck <linux(a)roeck-us.net> Closes: https://lore.kernel.org/netdev/85dd4590-ea6b-427d-876a-1d8559c7ad82@roeck-u… Suggested-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Joe Damato <jdamato(a)fastly.com> --- net/core/dev.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/net/core/dev.c b/net/core/dev.c index 13d00fc10f55..45a8c3dd4a64 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -6557,18 +6557,22 @@ static void __napi_hash_add_with_id(struct napi_struct *napi, static void napi_hash_add_with_id(struct napi_struct *napi, unsigned int napi_id) { - spin_lock(&napi_hash_lock); + unsigned long flags; + + spin_lock_irqsave(&napi_hash_lock, flags); WARN_ON_ONCE(napi_by_id(napi_id)); __napi_hash_add_with_id(napi, napi_id); - spin_unlock(&napi_hash_lock); + spin_unlock_irqrestore(&napi_hash_lock, flags); } static void napi_hash_add(struct napi_struct *napi) { + unsigned long flags; + if (test_bit(NAPI_STATE_NO_BUSY_POLL, &napi->state)) return; - spin_lock(&napi_hash_lock); + spin_lock_irqsave(&napi_hash_lock, flags); /* 0..NR_CPUS range is reserved for sender_cpu use */ do { @@ -6578,7 +6582,7 @@ static void napi_hash_add(struct napi_struct *napi) __napi_hash_add_with_id(napi, napi_gen_id); - spin_unlock(&napi_hash_lock); + spin_unlock_irqrestore(&napi_hash_lock, flags); } /* Warning : caller is responsible to make sure rcu grace period @@ -6586,11 +6590,13 @@ static void napi_hash_add(struct napi_struct *napi) */ static void napi_hash_del(struct napi_struct *napi) { - spin_lock(&napi_hash_lock); + unsigned long flags; + + spin_lock_irqsave(&napi_hash_lock, flags); hlist_del_init_rcu(&napi->napi_hash_node); - spin_unlock(&napi_hash_lock); + spin_unlock_irqrestore(&napi_hash_lock, flags); } static enum hrtimer_restart napi_watchdog(struct hrtimer *timer) -- 2.25.1

4 months, 4 weeks

4
3
0 0

[PATCH] dt-bindings: soc: fsl: cpm_qe: Limit matching to nodes with "fsl,qe"

by Chen-Yu Tsai

Otherwise the binding matches against random nodes with "simple-bus" giving out all kinds of invalid warnings: $ make CHECK_DTBS=y mediatek/mt8188-evb.dtb SYNC include/config/auto.conf.cmd UPD include/config/kernel.release SCHEMA Documentation/devicetree/bindings/processed-schema.json DTC [C] arch/arm64/boot/dts/mediatek/mt8188-evb.dtb arch/arm64/boot/dts/mediatek/mt8188-evb.dtb: soc: compatible:0: 'fsl,qe' was expected from schema $id: http://devicetree.org/schemas/soc/fsl/cpm_qe/fsl,qe.yaml# arch/arm64/boot/dts/mediatek/mt8188-evb.dtb: soc: compatible: ['simple-bus'] is too short from schema $id: http://devicetree.org/schemas/soc/fsl/cpm_qe/fsl,qe.yaml# arch/arm64/boot/dts/mediatek/mt8188-evb.dtb: soc: interrupt-controller@c000000:compatible:0: 'fsl,qe-ic' was expected from schema $id: http://devicetree.org/schemas/soc/fsl/cpm_qe/fsl,qe.yaml# arch/arm64/boot/dts/mediatek/mt8188-evb.dtb: soc: interrupt-controller@c000000:reg: [[0, 201326592, 0, 262144], [0, 201588736, 0, 2097152]] is too long from schema $id: http://devicetree.org/schemas/soc/fsl/cpm_qe/fsl,qe.yaml# arch/arm64/boot/dts/mediatek/mt8188-evb.dtb: soc: interrupt-controller@c000000:#interrupt-cells:0:0: 1 was expected from schema $id: http://devicetree.org/schemas/soc/fsl/cpm_qe/fsl,qe.yaml# arch/arm64/boot/dts/mediatek/mt8188-evb.dtb: soc: interrupt-controller@c000000: '#redistributor-regions', 'ppi-partitions' do not match any of the regexes: 'pinctrl-[0-9]+' from schema $id: http://devicetree.org/schemas/soc/fsl/cpm_qe/fsl,qe.yaml# arch/arm64/boot/dts/mediatek/mt8188-evb.dtb: soc: 'reg' is a required property from schema $id: http://devicetree.org/schemas/soc/fsl/cpm_qe/fsl,qe.yaml# arch/arm64/boot/dts/mediatek/mt8188-evb.dtb: soc: 'bus-frequency' is a required property from schema $id: http://devicetree.org/schemas/soc/fsl/cpm_qe/fsl,qe.yaml# Fixes: ecbfc6ff94a2 ("dt-bindings: soc: fsl: cpm_qe: convert to yaml format") Cc: Frank Li <Frank.Li(a)nxp.com> Cc: <stable(a)vger.kernel.org> # v6.11+ Signed-off-by: Chen-Yu Tsai <wenst(a)chromium.org> --- .../devicetree/bindings/soc/fsl/cpm_qe/fsl,qe.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/Documentation/devicetree/bindings/soc/fsl/cpm_qe/fsl,qe.yaml b/Documentation/devicetree/bindings/soc/fsl/cpm_qe/fsl,qe.yaml index 89cdf5e1d0a8..9e07a2c4d05b 100644 --- a/Documentation/devicetree/bindings/soc/fsl/cpm_qe/fsl,qe.yaml +++ b/Documentation/devicetree/bindings/soc/fsl/cpm_qe/fsl,qe.yaml @@ -21,6 +21,14 @@ description: | The description below applies to the qe of MPC8360 and more nodes and properties would be extended in the future. +select: + properties: + compatible: + contains: + const: fsl,qe + required: + - compatible + properties: compatible: items: -- 2.47.0.338.g60cca15819-goog

4 months, 4 weeks

3
3
0 0

[PATCH] drivers: clk: clk-en7523.c: Initialize num before accessing hws in en7523_register_clocks

by Haoyu Li

With the new __counted_by annocation in clk_hw_onecell_data, the "num" struct member must be set before accessing the "hws" array. Failing to do so will trigger a runtime warning when enabling CONFIG_UBSAN_BOUNDS and CONFIG_FORTIFY_SOURCE. Fixes: f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with __counted_by") Signed-off-by: Haoyu Li <lihaoyu499(a)gmail.com> --- drivers/clk/clk-en7523.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/clk/clk-en7523.c b/drivers/clk/clk-en7523.c index e52c5460e927..61d95ead5ec4 100644 --- a/drivers/clk/clk-en7523.c +++ b/drivers/clk/clk-en7523.c @@ -503,6 +503,8 @@ static void en7523_register_clocks(struct device *dev, struct clk_hw_onecell_dat u32 rate; int i; + clk_data->num = EN7523_NUM_CLOCKS; + for (i = 0; i < ARRAY_SIZE(en7523_base_clks); i++) { const struct en_clk_desc *desc = &en7523_base_clks[i]; u32 reg = desc->div_reg ? desc->div_reg : desc->base_reg; @@ -524,8 +526,6 @@ static void en7523_register_clocks(struct device *dev, struct clk_hw_onecell_dat hw = en7523_register_pcie_clk(dev, np_base); clk_data->hws[EN7523_CLK_PCIE] = hw; - - clk_data->num = EN7523_NUM_CLOCKS; } static int en7523_clk_hw_init(struct platform_device *pdev, -- 2.34.1

4 months, 4 weeks

3
2
0 0

Possible wrong fix patch for some stable branches

by Zhang Zekun

Hi, All The mainline patch to fix CVE-2024-50282 add a check to fix a potential buffer overflow issue in amdgpu_debugfs_gprwave_read() which is introduced in commit 553f973a0d7b ("drm/amd/amdgpu: Update debugfs for XCC support (v3)"), but some linux-stable fix patches add the check in some other funcitons, is something wrong here? Stable version which contain the suspicious patches: Fixed in 4.19.324 with commit 673bdb4200c0: Fixed in amdgpu_debugfs_regs_smc_read() Fixed in 5.4.286 with commit 7ccd781794d2: Fixed in amdgpu_debugfs_regs_smc_read() Fixed in 5.10.230 with commit 17f5f18085ac: Fixed in amdgpu_debugfs_regs_pcie_write() Fixed in 5.15.172 with commit aaf6160a4b7f: Fixed in amdgpu_debugfs_regs_didt_write() Fixed in 6.1.117 with commit 25d7e84343e1: Fixed in amdgpu_debugfs_regs_pcie_write() Link to mainline fix patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…

5 months

4
3
0 0

[PATCH] KVM: arm64: Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden

by Marc Zyngier

Catalin reports that a hypervisor lying to a guest about the size of the ASID field may result in unexpected issues: - if the underlying HW does only supports 8 bit ASIDs, the ASID field in a TLBI VAE1* operation is only 8 bits, and the HW will ignore the other 8 bits - if on the contrary the HW is 16 bit capable, the ASID field in the same TLBI operation is always 16 bits, irrespective of the value of TCR_ELx.AS. This could lead to missed invalidations if the guest was lead to assume that the HW had 8 bit ASIDs while they really are 16 bit wide. In order to avoid any potential disaster that would be hard to debug, prenent the migration between a host with 8 bit ASIDs to one with wider ASIDs (the converse was obviously always forbidden). This is also consistent with what we already do for VMIDs. If it becomes absolutely mandatory to support such a migration path in the future, we will have to trap and emulate all TLBIs, something that nobody should look forward to. Fixes: d5a32b60dc18 ("KVM: arm64: Allow userspace to change ID_AA64MMFR{0-2}_EL1") Reported-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: Marc Zyngier <maz(a)kernel.org> Cc: stable(a)vger.kernel.org Cc: Will Deacon <will(a)kernel.org> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Marc Zyngier <maz(a)kernel.org> Cc: James Morse <james.morse(a)arm.com> Cc: Oliver Upton <oliver.upton(a)linux.dev> --- arch/arm64/kvm/sys_regs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c index a26f02ec8748..b1918adbd0aa 100644 --- a/arch/arm64/kvm/sys_regs.c +++ b/arch/arm64/kvm/sys_regs.c @@ -2674,7 +2674,8 @@ static const struct sys_reg_desc sys_reg_descs[] = { ID_WRITABLE(ID_AA64MMFR0_EL1, ~(ID_AA64MMFR0_EL1_RES0 | ID_AA64MMFR0_EL1_TGRAN4_2 | ID_AA64MMFR0_EL1_TGRAN64_2 | - ID_AA64MMFR0_EL1_TGRAN16_2)), + ID_AA64MMFR0_EL1_TGRAN16_2 | + ID_AA64MMFR0_EL1_ASIDBITS)), ID_WRITABLE(ID_AA64MMFR1_EL1, ~(ID_AA64MMFR1_EL1_RES0 | ID_AA64MMFR1_EL1_HCX | ID_AA64MMFR1_EL1_TWED | -- 2.43.0

5 months

3
2
0 0

[PATCH v2] usb: typec: ucsi: Fix completion notifications

by Łukasz Bartosik

OPM PPM LPM | 1.send cmd | | |-------------------------->| | | |-- | | | | 2.set busy bit in CCI | | |<- | | 3.notify the OPM | | |<--------------------------| | | | 4.send cmd to be executed | | |-------------------------->| | | | | | 5.cmd completed | | |<--------------------------| | | | | |-- | | | | 6.set cmd completed | | |<- bit in CCI | | | | | 7.notify the OPM | | |<--------------------------| | | | | | 8.handle notification | | | from point 3, read CCI | | |<--------------------------| | | | | When the PPM receives command from the OPM (p.1) it sets the busy bit in the CCI (p.2), sends notification to the OPM (p.3) and forwards the command to be executed by the LPM (p.4). When the PPM receives command completion from the LPM (p.5) it sets command completion bit in the CCI (p.6) and sends notification to the OPM (p.7). If command execution by the LPM is fast enough then when the OPM starts handling the notification from p.3 in p.8 and reads the CCI value it will see command completion bit set and will call complete(). Then complete() might be called again when the OPM handles notification from p.7. This fix replaces test_bit() with test_and_clear_bit() in ucsi_notify_common() in order to call complete() only once per request. This fix also reinitializes completion variable in ucsi_sync_control_common() before a command is sent. Fixes: 584e8df58942 ("usb: typec: ucsi: extract common code for command handling") Cc: stable(a)vger.kernel.org Signed-off-by: Łukasz Bartosik <ukaszb(a)chromium.org> --- Changes in v2: - Swapped points 7 and 8 in the commit description in order to make diagram more clear. - Added reinitialization of completion variable in the ucsi_sync_control_common(). --- drivers/usb/typec/ucsi/ucsi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c index c435c0835744..7a65a7672e18 100644 --- a/drivers/usb/typec/ucsi/ucsi.c +++ b/drivers/usb/typec/ucsi/ucsi.c @@ -46,11 +46,11 @@ void ucsi_notify_common(struct ucsi *ucsi, u32 cci) ucsi_connector_change(ucsi, UCSI_CCI_CONNECTOR(cci)); if (cci & UCSI_CCI_ACK_COMPLETE && - test_bit(ACK_PENDING, &ucsi->flags)) + test_and_clear_bit(ACK_PENDING, &ucsi->flags)) complete(&ucsi->complete); if (cci & UCSI_CCI_COMMAND_COMPLETE && - test_bit(COMMAND_PENDING, &ucsi->flags)) + test_and_clear_bit(COMMAND_PENDING, &ucsi->flags)) complete(&ucsi->complete); } EXPORT_SYMBOL_GPL(ucsi_notify_common); @@ -65,6 +65,8 @@ int ucsi_sync_control_common(struct ucsi *ucsi, u64 command) else set_bit(COMMAND_PENDING, &ucsi->flags); + reinit_completion(&ucsi->complete); + ret = ucsi->ops->async_control(ucsi, command); if (ret) goto out_clear_bit; -- 2.47.0.338.g60cca15819-goog

5 months

4
5
0 0

[PATCH] bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again

by Coly Li

From: Liequan Che <cheliequan(a)inspur.com> Commit 028ddcac477b ("bcache: Remove unnecessary NULL point check in node allocations") leads a NULL pointer deference in cache_set_flush(). 1721 if (!IS_ERR_OR_NULL(c->root)) 1722 list_add(&c->root->list, &c->btree_cache); From the above code in cache_set_flush(), if previous registration code fails before allocating c->root, it is possible c->root is NULL as what it is initialized. __bch_btree_node_alloc() never returns NULL but c->root is possible to be NULL at above line 1721. This patch replaces IS_ERR() by IS_ERR_OR_NULL() to fix this. Fixes: 028ddcac477b ("bcache: Remove unnecessary NULL point check in node allocations") Signed-off-by: Liequan Che <cheliequan(a)inspur.com> Cc: stable(a)vger.kernel.org Cc: Zheng Wang <zyytlz.wz(a)163.com> Reviewed-by: Mingzhe Zou <mingzhe.zou(a)easystack.cn> Signed-off-by: Coly Li <colyli(a)suse.de> --- drivers/md/bcache/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c index e7abfdd77c3b..e42f1400cea9 100644 --- a/drivers/md/bcache/super.c +++ b/drivers/md/bcache/super.c @@ -1718,7 +1718,7 @@ static CLOSURE_CALLBACK(cache_set_flush) if (!IS_ERR_OR_NULL(c->gc_thread)) kthread_stop(c->gc_thread); - if (!IS_ERR(c->root)) + if (!IS_ERR_OR_NULL(c->root)) list_add(&c->root->list, &c->btree_cache); /* -- 2.47.1

5 months

2
2
0 0

[PATCH] clk: en7523: Fix wrong BUS clock for EN7581

by Christian Marangi

The Documentation for EN7581 had a typo and still referenced the EN7523 BUS base source frequency. This was in conflict with a different page in the Documentration that state that the BUS runs at 300MHz (600MHz source with divisor set to 2) and the actual watchdog that tick at half the BUS clock (150MHz). This was verified with the watchdog by timing the seconds that the system takes to reboot (due too watchdog) and by operating on different values of the BUS divisor. The correct values for source of BUS clock are 600MHz and 540MHz. This was also confirmed by Airoha. Cc: stable(a)vger.kernel.org Fixes: 66bc47326ce2 ("clk: en7523: Add EN7581 support") Signed-off-by: Christian Marangi <ansuelsmth(a)gmail.com> --- drivers/clk/clk-en7523.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/clk/clk-en7523.c b/drivers/clk/clk-en7523.c index e52c5460e927..239cb04d9ae3 100644 --- a/drivers/clk/clk-en7523.c +++ b/drivers/clk/clk-en7523.c @@ -87,6 +87,7 @@ static const u32 slic_base[] = { 100000000, 3125000 }; static const u32 npu_base[] = { 333000000, 400000000, 500000000 }; /* EN7581 */ static const u32 emi7581_base[] = { 540000000, 480000000, 400000000, 300000000 }; +static const u32 bus7581_base[] = { 600000000, 540000000 }; static const u32 npu7581_base[] = { 800000000, 750000000, 720000000, 600000000 }; static const u32 crypto_base[] = { 540000000, 480000000 }; @@ -222,8 +223,8 @@ static const struct en_clk_desc en7581_base_clks[] = { .base_reg = REG_BUS_CLK_DIV_SEL, .base_bits = 1, .base_shift = 8, - .base_values = bus_base, - .n_base_values = ARRAY_SIZE(bus_base), + .base_values = bus7581_base, + .n_base_values = ARRAY_SIZE(bus7581_base), .div_bits = 3, .div_shift = 0, -- 2.45.2

5 months

3
2
0 0

Re: [PATCH 6.12 000/826] 6.12.2-rc1 review

by Ronald Warsow

Hi Greg no regressions here on x86_64 (RKL, Intel 11th Gen. CPU) Thanks Tested-by: Ronald Warsow <rwarsow(a)gmx.de>

5 months

1
0
0 0

[PATCH v5 0/5] media: uvcvideo: Two +1 fixes for async controls

by Ricardo Ribalda

This patchset fixes two +1 bugs with the async controls for the uvc driver. They were found while implementing the granular PM, but I am sending them as a separate patches, so they can be reviewed sooner. They fix real issues in the driver that need to be taken care. Signed-off-by: Ricardo Ribalda <ribalda(a)chromium.org> --- Changes in v5: - Move set handle to the entity_commit - Replace uvc_ctrl_set_handle with get/put_handle. - Add a patch to flush the cache of async controls. - Link to v4: https://lore.kernel.org/r/20241129-uvc-fix-async-v4-0-f23784dba80f@chromium… Changes in v4: - Fix implementation of uvc_ctrl_set_handle. - Link to v3: https://lore.kernel.org/r/20241129-uvc-fix-async-v3-0-ab675ce66db7@chromium… Changes in v3: - change again! order of patches. - Introduce uvc_ctrl_set_handle. - Do not change ctrl->handle if it is not NULL. Changes in v2: - Annotate lockdep - ctrl->handle != handle - Change order of patches - Move documentation of mutex - Link to v1: https://lore.kernel.org/r/20241127-uvc-fix-async-v1-0-eb8722531b8c@chromium… --- Ricardo Ribalda (5): media: uvcvideo: Only save async fh if success media: uvcvideo: Remove dangling pointers media: uvcvideo: Annotate lock requirements for uvc_ctrl_set media: uvcvideo: Remove redundant NULL assignment media: uvcvideo: Flush the control cache when we get an event drivers/media/usb/uvc/uvc_ctrl.c | 77 ++++++++++++++++++++++++++++++++++------ drivers/media/usb/uvc/uvc_v4l2.c | 2 ++ drivers/media/usb/uvc/uvcvideo.h | 9 ++++- 3 files changed, 76 insertions(+), 12 deletions(-) --- base-commit: 40384c840ea1944d7c5a392e8975ed088ecf0b37 change-id: 20241127-uvc-fix-async-2c9d40413ad8 Best regards, -- Ricardo Ribalda <ribalda(a)chromium.org>

5 months

3
9
0 0

[PATCH] tracing: Fix cmp_entries_dup() to respect sort() comparison rules

by Kuan-Wei Chiu

The cmp_entries_dup() function used as the comparator for sort() violated the symmetry and transitivity properties required by the sorting algorithm. Specifically, it returned 1 whenever memcmp() was non-zero, which broke the following expectations: * Symmetry: If x < y, then y > x. * Transitivity: If x < y and y < z, then x < z. These violations could lead to incorrect sorting and failure to correctly identify duplicate elements. Fix the issue by directly returning the result of memcmp(), which adheres to the required comparison properties. Fixes: 08d43a5fa063 ("tracing: Add lock-free tracing_map") Cc: stable(a)vger.kernel.org Signed-off-by: Kuan-Wei Chiu <visitorckw(a)gmail.com> --- kernel/trace/tracing_map.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c index 3a56e7c8aa4f..1921ade45be3 100644 --- a/kernel/trace/tracing_map.c +++ b/kernel/trace/tracing_map.c @@ -845,15 +845,11 @@ int tracing_map_init(struct tracing_map *map) static int cmp_entries_dup(const void *A, const void *B) { const struct tracing_map_sort_entry *a, *b; - int ret = 0; a = *(const struct tracing_map_sort_entry **)A; b = *(const struct tracing_map_sort_entry **)B; - if (memcmp(a->key, b->key, a->elt->map->key_size)) - ret = 1; - - return ret; + return memcmp(a->key, b->key, a->elt->map->key_size); } static int cmp_entries_sum(const void *A, const void *B) -- 2.34.1

5 months

1
0
0 0

[PATCH 6.6] crypto: starfive - Do not free stack buffer

by bin.lan.cn＠eng.windriver.com

From: Jia Jie Ho <jiajie.ho(a)starfivetech.com> [ Upstream commit d7f01649f4eaf1878472d3d3f480ae1e50d98f6c ] RSA text data uses variable length buffer allocated in software stack. Calling kfree on it causes undefined behaviour in subsequent operations. Cc: <stable(a)vger.kernel.org> #6.7+ Signed-off-by: Jia Jie Ho <jiajie.ho(a)starfivetech.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Bin Lan <bin.lan.cn(a)windriver.com> --- drivers/crypto/starfive/jh7110-rsa.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/crypto/starfive/jh7110-rsa.c b/drivers/crypto/starfive/jh7110-rsa.c index 1db9a3d02848..3116828d60a0 100644 --- a/drivers/crypto/starfive/jh7110-rsa.c +++ b/drivers/crypto/starfive/jh7110-rsa.c @@ -303,7 +303,6 @@ static int starfive_rsa_enc_core(struct starfive_cryp_ctx *ctx, int enc) err_rsa_crypt: writel(STARFIVE_RSA_RESET, cryp->base + STARFIVE_PKA_CACR_OFFSET); - kfree(rctx->rsa_data); return ret; } -- 2.34.1

5 months

4
4
0 0

[PATCH 6.12 v4 0/3] Fix PPS channel routing

by Csókás, Bence

On certain i.MX8 series parts [1], the PPS channel 0 is routed internally to eDMA, and the external PPS pin is available on channel 1. In addition, on certain boards, the PPS may be wired on the PCB to an EVENTOUTn pin other than 0. On these systems it is necessary that the PPS channel be able to be configured from the Device Tree. [1] https://lore.kernel.org/all/ZrPYOWA3FESx197L@lizhi-Precision-Tower-5810/ Changes in v2: * add upstream hash (pick -x) Changes in v3: * Add S-o-b despite Sasha's complaining bot Changes in v4: * Remove blank line in S-o-b area Francesco Dolcini (3): dt-bindings: net: fec: add pps channel property net: fec: refactor PPS channel configuration net: fec: make PPS channel configurable Documentation/devicetree/bindings/net/fsl,fec.yaml | 7 +++++++ drivers/net/ethernet/freescale/fec_ptp.c | 11 ++++++----- 2 files changed, 13 insertions(+), 5 deletions(-) -- 2.34.1

5 months

2
6
0 0

[PATCH 5.15] drm/amd/pm: Fix negative array index read

by mingli.yu＠eng.windriver.com

From: Jesse Zhang <jesse.zhang(a)amd.com> Avoid using the negative values for clk_idex as an index into an array pptable->DpmDescriptor. V2: fix clk_index return check (Tim Huang) Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Reviewed-by: Tim Huang <Tim.Huang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> [Don't intruduce the change for navi10_emit_clk_levels which doesn't exist] Signed-off-by: Mingli Yu <mingli.yu(a)windriver.com> --- .../gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 21 ++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c index dfba0bc73207..9f5dcfaebe63 100644 --- a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c +++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c @@ -1231,19 +1231,22 @@ static int navi10_get_current_clk_freq_by_table(struct smu_context *smu, value); } -static bool navi10_is_support_fine_grained_dpm(struct smu_context *smu, enum smu_clk_type clk_type) +static int navi10_is_support_fine_grained_dpm(struct smu_context *smu, enum smu_clk_type clk_type) { PPTable_t *pptable = smu->smu_table.driver_pptable; DpmDescriptor_t *dpm_desc = NULL; - uint32_t clk_index = 0; + int clk_index = 0; clk_index = smu_cmn_to_asic_specific_index(smu, CMN2ASIC_MAPPING_CLK, clk_type); + if (clk_index < 0) + return clk_index; + dpm_desc = &pptable->DpmDescriptor[clk_index]; /* 0 - Fine grained DPM, 1 - Discrete DPM */ - return dpm_desc->SnapToDiscrete == 0; + return dpm_desc->SnapToDiscrete == 0 ? 1 : 0; } static inline bool navi10_od_feature_is_supported(struct smu_11_0_overdrive_table *od_table, enum SMU_11_0_ODFEATURE_CAP cap) @@ -1299,7 +1302,11 @@ static int navi10_print_clk_levels(struct smu_context *smu, if (ret) return size; - if (!navi10_is_support_fine_grained_dpm(smu, clk_type)) { + ret = navi10_is_support_fine_grained_dpm(smu, clk_type); + if (ret < 0) + return ret; + + if (!ret) { for (i = 0; i < count; i++) { ret = smu_v11_0_get_dpm_freq_by_index(smu, clk_type, i, &value); if (ret) @@ -1468,7 +1475,11 @@ static int navi10_force_clk_levels(struct smu_context *smu, case SMU_UCLK: case SMU_FCLK: /* There is only 2 levels for fine grained DPM */ - if (navi10_is_support_fine_grained_dpm(smu, clk_type)) { + ret = navi10_is_support_fine_grained_dpm(smu, clk_type); + if (ret < 0) + return ret; + + if (ret) { soft_max_level = (soft_max_level >= 1 ? 1 : 0); soft_min_level = (soft_min_level >= 1 ? 1 : 0); } -- 2.34.1

5 months

3
2
0 0

[PATCH] of: Fix error path in of_parse_phandle_with_args_map()

by Herve Codina

The current code uses some 'goto put;' to cancel the parsing operation and can lead to a return code value of 0 even on error cases. Indeed, some goto calls are done from a loop without setting the ret value explicitly before the goto call and so the ret value can be set to 0 due to operation done in previous loop iteration. For instance match can be set to 0 in the previous loop iteration (leading to a new iteration) but ret can also be set to 0 it the of_property_read_u32() call succeed. In that case if no match are found or if an error is detected the new iteration, the return value can be wrongly 0. Avoid those cases setting the ret value explicitly before the goto calls. Fixes: bd6f2fd5a1d5 ("of: Support parsing phandle argument lists through a nexus node") Cc: <stable(a)vger.kernel.org> Signed-off-by: Herve Codina <herve.codina(a)bootlin.com> --- drivers/of/base.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/drivers/of/base.c b/drivers/of/base.c index 7dc394255a0a..809324607a5c 100644 --- a/drivers/of/base.c +++ b/drivers/of/base.c @@ -1507,8 +1507,10 @@ int of_parse_phandle_with_args_map(const struct device_node *np, map_len--; /* Check if not found */ - if (!new) + if (!new) { + ret = -EINVAL; goto put; + } if (!of_device_is_available(new)) match = 0; @@ -1518,17 +1520,20 @@ int of_parse_phandle_with_args_map(const struct device_node *np, goto put; /* Check for malformed properties */ - if (WARN_ON(new_size > MAX_PHANDLE_ARGS)) - goto put; - if (map_len < new_size) + if (WARN_ON(new_size > MAX_PHANDLE_ARGS) || + map_len < new_size) { + ret = -EINVAL; goto put; + } /* Move forward by new node's #<list>-cells amount */ map += new_size; map_len -= new_size; } - if (!match) + if (!match) { + ret = -ENOENT; goto put; + } /* Get the <list>-map-pass-thru property (optional) */ pass = of_get_property(cur, pass_name, NULL); -- 2.47.0

5 months

2
1
0 0

Re: [PATCH 5.15 209/214] net: drop bad gso csum_start and offset in virtio_net_hdr

by Olivier Benz

Did https://lore.kernel.org/all/20240910092607.040498134@linuxfoundation.org/ somehow backport https://bugzilla.kernel.org/show_bug.cgi?id=219129 to Linux kernel 5.15.0-125.135/5.15.0-126.136? Because I needed to rollback to Linux kernel 5.15.0-124.134 due to --- snip --- ... Dec 2 12:00:18 ags-vch-3021 kernel: [13368.433876] ens160: bad gso: type: 1, size: 1448 Dec 2 12:00:18 ags-vch-3021 kernel: [13368.437561] ens160: bad gso: type: 1, size: 1448 Dec 2 12:00:18 ags-vch-3021 kernel: [13368.446613] ens160: bad gso: type: 1, size: 1448 Dec 2 12:00:18 ags-vch-3021 kernel: [13368.451143] ens160: bad gso: type: 1, size: 1448 Dec 2 12:00:18 ags-vch-3021 kernel: [13368.457727] ens160: bad gso: type: 1, size: 1448 Dec 2 12:00:18 ags-vch-3021 kernel: [13368.461367] ens160: bad gso: type: 1, size: 1448 Dec 2 12:00:18 ags-vch-3021 kernel: [13368.467091] ens160: bad gso: type: 1, size: 1448 Dec 2 12:00:18 ags-vch-3021 kernel: [13368.472057] ens160: bad gso: type: 1, size: 1448 Dec 2 12:00:18 ags-vch-3021 kernel: [13368.478908] ens160: bad gso: type: 1, size: 1448 Dec 2 12:00:18 ags-vch-3021 kernel: [13368.484023] ens160: bad gso: type: 1, size: 1448 Dec 2 12:00:23 ags-vch-3021 kernel: [13373.495946] net_ratelimit: 486 callbacks suppressed ... --- snip --- on VMs that are running on Nutanix (using virtio net devices). -- benz0li.b-data.io | @benz0li | olivier.benz(a)b-data.ch

5 months

1
0
0 0

[PATCH v2] gpio: omap: Silence lockdep "Invalid wait context"

by A. Sverdlin

From: Alexander Sverdlin <alexander.sverdlin(a)siemens.com> The problem apparetly has been known since the conversion to raw_spin_lock() (commit 4dbada2be460 ("gpio: omap: use raw locks for locking")). Symptom: [ BUG: Invalid wait context ] 5.10.214 ----------------------------- swapper/1 is trying to lock: (enable_lock){....}-{3:3}, at: clk_enable_lock other info that might help us debug this: context-{5:5} 2 locks held by swapper/1: #0: (&dev->mutex){....}-{4:4}, at: device_driver_attach #1: (&bank->lock){....}-{2:2}, at: omap_gpio_set_config stack backtrace: CPU: 0 PID: 1 Comm: swapper Not tainted 5.10.214 Hardware name: Generic AM33XX (Flattened Device Tree) unwind_backtrace show_stack __lock_acquire lock_acquire.part.0 _raw_spin_lock_irqsave clk_enable_lock clk_enable omap_gpio_set_config gpio_keys_setup_key gpio_keys_probe platform_drv_probe really_probe driver_probe_device device_driver_attach __driver_attach bus_for_each_dev bus_add_driver driver_register do_one_initcall do_initcalls kernel_init_freeable kernel_init Reorder clk_enable()/clk_disable() calls in a way that they always happen outside of raw_spin_lock'ed sections. Cc: stable(a)vger.kernel.org Fixes: 4dbada2be460 ("gpio: omap: use raw locks for locking") Signed-off-by: Alexander Sverdlin <alexander.sverdlin(a)siemens.com> --- Changelog: v2: complete rework, I've totally missed the fact clk_enable()/clk_disable() cannot avoid clk_enable_lock() even if the clock is enabled; I had to extract all clk_*() calls out of raw_spin_lock'ed sections drivers/gpio/gpio-omap.c | 114 +++++++++++++++++++++++++++++---------- 1 file changed, 87 insertions(+), 27 deletions(-) diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c index 7ad4534054962..3e6c8dec7cacc 100644 --- a/drivers/gpio/gpio-omap.c +++ b/drivers/gpio/gpio-omap.c @@ -140,18 +140,22 @@ static void omap_set_gpio_dataout_mask(struct gpio_bank *bank, unsigned offset, BIT(offset), enable); } -static inline void omap_gpio_dbck_enable(struct gpio_bank *bank) +/* Returns true if debounce clock has to be enabled by the caller */ +static inline bool omap_gpio_dbck_enable(struct gpio_bank *bank) { if (bank->dbck_enable_mask && !bank->dbck_enabled) { - clk_enable(bank->dbck); bank->dbck_enabled = true; - writel_relaxed(bank->dbck_enable_mask, bank->base + bank->regs->debounce_en); + + return true; } + + return false; } -static inline void omap_gpio_dbck_disable(struct gpio_bank *bank) +/* Returns true if debounce clock has to be disabled by the caller */ +static inline bool omap_gpio_dbck_disable(struct gpio_bank *bank) { if (bank->dbck_enable_mask && bank->dbck_enabled) { /* @@ -160,10 +164,12 @@ static inline void omap_gpio_dbck_disable(struct gpio_bank *bank) * to detect events and generate interrupts at least on OMAP3. */ writel_relaxed(0, bank->base + bank->regs->debounce_en); - - clk_disable(bank->dbck); bank->dbck_enabled = false; + + return true; } + + return false; } /** @@ -181,9 +187,11 @@ static inline void omap_gpio_dbck_disable(struct gpio_bank *bank) static int omap2_set_gpio_debounce(struct gpio_bank *bank, unsigned offset, unsigned debounce) { + unsigned long flags; u32 val; u32 l; bool enable = !!debounce; + bool enable_clk; if (!bank->dbck_flag) return -ENOTSUPP; @@ -196,13 +204,18 @@ static int omap2_set_gpio_debounce(struct gpio_bank *bank, unsigned offset, l = BIT(offset); + /* + * Ordering is important here: clk_enable() calls spin_lock_irqsave(), + * therefore it must be outside of the following raw_spin_lock_irqsave() + */ clk_enable(bank->dbck); + raw_spin_lock_irqsave(&bank->lock, flags); + writel_relaxed(debounce, bank->base + bank->regs->debounce); val = omap_gpio_rmw(bank->base + bank->regs->debounce_en, l, enable); bank->dbck_enable_mask = val; - clk_disable(bank->dbck); /* * Enable debounce clock per module. * This call is mandatory because in omap_gpio_request() when @@ -211,12 +224,16 @@ static int omap2_set_gpio_debounce(struct gpio_bank *bank, unsigned offset, * used within _gpio_dbck_enable() is still not initialized at * that point. Therefore we have to enable dbck here. */ - omap_gpio_dbck_enable(bank); + enable_clk = omap_gpio_dbck_enable(bank); if (bank->dbck_enable_mask) { bank->context.debounce = debounce; bank->context.debounce_en = val; } + raw_spin_unlock_irqrestore(&bank->lock, flags); + if (!enable_clk) + clk_disable(bank->dbck); + return 0; } @@ -229,16 +246,19 @@ static int omap2_set_gpio_debounce(struct gpio_bank *bank, unsigned offset, * this is the only gpio in this bank using debounce, then clear the debounce * time too. The debounce clock will also be disabled when calling this function * if this is the only gpio in the bank using debounce. + * + * Return: true if bank->bdck clock has to be disabled by the caller, + * false otherwise */ -static void omap_clear_gpio_debounce(struct gpio_bank *bank, unsigned offset) +static bool omap_clear_gpio_debounce(struct gpio_bank *bank, unsigned int offset) { u32 gpio_bit = BIT(offset); if (!bank->dbck_flag) - return; + return false; if (!(bank->dbck_enable_mask & gpio_bit)) - return; + return false; bank->dbck_enable_mask &= ~gpio_bit; bank->context.debounce_en &= ~gpio_bit; @@ -249,9 +269,12 @@ static void omap_clear_gpio_debounce(struct gpio_bank *bank, unsigned offset) bank->context.debounce = 0; writel_relaxed(bank->context.debounce, bank->base + bank->regs->debounce); - clk_disable(bank->dbck); bank->dbck_enabled = false; + + return true; } + + return false; } /* @@ -646,6 +669,7 @@ static void omap_gpio_irq_shutdown(struct irq_data *d) struct gpio_bank *bank = omap_irq_data_get_bank(d); unsigned long flags; unsigned offset = d->hwirq; + bool disable_clk = false; raw_spin_lock_irqsave(&bank->lock, flags); bank->irq_usage &= ~(BIT(offset)); @@ -653,9 +677,17 @@ static void omap_gpio_irq_shutdown(struct irq_data *d) omap_clear_gpio_irqstatus(bank, offset); omap_set_gpio_irqenable(bank, offset, 0); if (!LINE_USED(bank->mod_usage, offset)) - omap_clear_gpio_debounce(bank, offset); + disable_clk = omap_clear_gpio_debounce(bank, offset); omap_disable_gpio_module(bank, offset); raw_spin_unlock_irqrestore(&bank->lock, flags); + + /* + * This has to be done outside of bank->lock'ed section, because + * spin_lock_irqsave(&enable_lock, ...) <= clk_enable_lock() + * cannot be called from raw_spin_lock'ed section. + */ + if (disable_clk) + clk_disable(bank->dbck); } static void omap_gpio_irq_bus_lock(struct irq_data *data) @@ -825,17 +857,26 @@ static int omap_gpio_request(struct gpio_chip *chip, unsigned offset) static void omap_gpio_free(struct gpio_chip *chip, unsigned offset) { struct gpio_bank *bank = gpiochip_get_data(chip); + bool disable_clk = false; unsigned long flags; raw_spin_lock_irqsave(&bank->lock, flags); bank->mod_usage &= ~(BIT(offset)); if (!LINE_USED(bank->irq_usage, offset)) { omap_set_gpio_direction(bank, offset, 1); - omap_clear_gpio_debounce(bank, offset); + disable_clk = omap_clear_gpio_debounce(bank, offset); } omap_disable_gpio_module(bank, offset); raw_spin_unlock_irqrestore(&bank->lock, flags); + /* + * This has to be done outside of bank->lock'ed section, because + * spin_lock_irqsave(&enable_lock, ...) <= clk_enable_lock() + * cannot be called from raw_spin_lock'ed section. + */ + if (disable_clk) + clk_disable(bank->dbck); + pm_runtime_put(chip->parent); } @@ -913,15 +954,11 @@ static int omap_gpio_debounce(struct gpio_chip *chip, unsigned offset, unsigned debounce) { struct gpio_bank *bank; - unsigned long flags; int ret; bank = gpiochip_get_data(chip); - raw_spin_lock_irqsave(&bank->lock, flags); ret = omap2_set_gpio_debounce(bank, offset, debounce); - raw_spin_unlock_irqrestore(&bank->lock, flags); - if (ret) dev_info(chip->parent, "Could not set line %u debounce to %u microseconds (%d)", @@ -1131,7 +1168,8 @@ static void omap_gpio_restore_context(struct gpio_bank *bank) writel_relaxed(bank->context.irqenable2, base + regs->irqenable2); } -static void omap_gpio_idle(struct gpio_bank *bank, bool may_lose_context) +/* Returns true if debounce clock has to be disabled by the caller */ +static bool omap_gpio_idle(struct gpio_bank *bank, bool may_lose_context) { struct device *dev = bank->chip.parent; void __iomem *base = bank->base; @@ -1175,13 +1213,15 @@ static void omap_gpio_idle(struct gpio_bank *bank, bool may_lose_context) bank->context_loss_count = bank->get_context_loss_count(dev); - omap_gpio_dbck_disable(bank); + return omap_gpio_dbck_disable(bank); } -static void omap_gpio_unidle(struct gpio_bank *bank) +/* Returns true if debounce clock has to be enabled by the caller */ +static bool omap_gpio_unidle(struct gpio_bank *bank) { struct device *dev = bank->chip.parent; u32 l = 0, gen, gen0, gen1; + bool enable_clk; int c; /* @@ -1197,7 +1237,7 @@ static void omap_gpio_unidle(struct gpio_bank *bank) bank->get_context_loss_count(dev); } - omap_gpio_dbck_enable(bank); + enable_clk = omap_gpio_dbck_enable(bank); if (bank->loses_context) { if (!bank->get_context_loss_count) { @@ -1207,7 +1247,7 @@ static void omap_gpio_unidle(struct gpio_bank *bank) if (c != bank->context_loss_count) { omap_gpio_restore_context(bank); } else { - return; + return enable_clk; } } } else { @@ -1267,6 +1307,8 @@ static void omap_gpio_unidle(struct gpio_bank *bank) writel_relaxed(old0, bank->base + bank->regs->leveldetect0); writel_relaxed(old1, bank->base + bank->regs->leveldetect1); } + + return enable_clk; } static int gpio_omap_cpu_notifier(struct notifier_block *nb, @@ -1276,6 +1318,8 @@ static int gpio_omap_cpu_notifier(struct notifier_block *nb, unsigned long flags; int ret = NOTIFY_OK; u32 isr, mask; + bool enable_clk = false; + bool disable_clk = false; bank = container_of(nb, struct gpio_bank, nb); @@ -1291,17 +1335,23 @@ static int gpio_omap_cpu_notifier(struct notifier_block *nb, ret = NOTIFY_BAD; break; } - omap_gpio_idle(bank, true); + disable_clk = omap_gpio_idle(bank, true); break; case CPU_CLUSTER_PM_ENTER_FAILED: case CPU_CLUSTER_PM_EXIT: - omap_gpio_unidle(bank); + enable_clk = omap_gpio_unidle(bank); break; } out_unlock: raw_spin_unlock_irqrestore(&bank->lock, flags); + /* This has to happen outside of raw_spin_lock'ed section */ + if (enable_clk) + clk_enable(bank->dbck); + if (disable_clk) + clk_disable(bank->dbck); + return ret; } @@ -1503,12 +1553,17 @@ static int __maybe_unused omap_gpio_runtime_suspend(struct device *dev) { struct gpio_bank *bank = dev_get_drvdata(dev); unsigned long flags; + bool disable_clk; raw_spin_lock_irqsave(&bank->lock, flags); - omap_gpio_idle(bank, true); + disable_clk = omap_gpio_idle(bank, true); bank->is_suspended = true; raw_spin_unlock_irqrestore(&bank->lock, flags); + /* This has to happen outside of raw_spin_lock'ed section */ + if (disable_clk) + clk_disable(bank->dbck); + return 0; } @@ -1516,12 +1571,17 @@ static int __maybe_unused omap_gpio_runtime_resume(struct device *dev) { struct gpio_bank *bank = dev_get_drvdata(dev); unsigned long flags; + bool enable_clk; raw_spin_lock_irqsave(&bank->lock, flags); - omap_gpio_unidle(bank); + enable_clk = omap_gpio_unidle(bank); bank->is_suspended = false; raw_spin_unlock_irqrestore(&bank->lock, flags); + /* This has to happen outside of raw_spin_lock'ed section */ + if (enable_clk) + clk_enable(bank->dbck); + return 0; } -- 2.47.0

5 months

2
1
0 0

bisected: [PATCH V4] x86/apic: Always explicitly disarm TSC-deadline timer

by Sergey Senozhatsky

Hi folks, sorry if messed something up, this email has never been in my inbox. > Disable the TSC Deadline timer in lapic_timer_shutdown() by writing to > MSR_IA32_TSC_DEADLINE when in TSC-deadline mode. Also avoid writing > to the initial-count register (APIC_TMICT) which is ignored in > TSC-deadline mode. So this commit hit stable and we now see section mismatch errors: // stripped WARNING: vmlinux.o(__ex_table+0x447c): Section mismatch in reference from the (unknown reference) (unknown) to the (unknown reference) .irqentry.text:(unknown) The relocation at __ex_table+0x447c references section ".irqentry.text" which is not in the list of authorized sections. WARNING: vmlinux.o(__ex_table+0x4480): Section mismatch in reference from the (unknown reference) (unknown) to the (unknown reference) .irqentry.text:(unknown) The relocation at __ex_table+0x4480 references section ".irqentry.text" which is not in the list of authorized sections. FATAL: modpost: Section mismatches detected. Specifically because of wrmsrl. I'm aware of the section mismatch errors on linux-5.4 (I know), not aware of any other stable versions (but I haven't checked). Is this something specific to linux-5.4?

5 months

3
9
0 0

[PATCH 2/7] drm/dp_mst: Verify request type in the corresponding down message reply

by Imre Deak

After receiving the response for an MST down request message, the response should be accepted/parsed only if the response type matches that of the request. Ensure this by checking if the request type code stored both in the request and the reply match, dropping the reply in case of a mismatch. This fixes the topology detection for an MST hub, as described in the Closes link below, where the hub sends an incorrect reply message after a CLEAR_PAYLOAD_TABLE -> LINK_ADDRESS down request message sequence. Cc: Lyude Paul <lyude(a)redhat.com> Cc: <stable(a)vger.kernel.org> Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/12804 Signed-off-by: Imre Deak <imre.deak(a)intel.com> --- drivers/gpu/drm/display/drm_dp_mst_topology.c | 31 +++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c index 1475aa95ab6b2..bcf3a33123be1 100644 --- a/drivers/gpu/drm/display/drm_dp_mst_topology.c +++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c @@ -3941,6 +3941,34 @@ drm_dp_get_one_sb_msg(struct drm_dp_mst_topology_mgr *mgr, bool up, return true; } +static int get_msg_request_type(u8 data) +{ + return data & 0x7f; +} + +static bool verify_rx_request_type(struct drm_dp_mst_topology_mgr *mgr, + const struct drm_dp_sideband_msg_tx *txmsg, + const struct drm_dp_sideband_msg_rx *rxmsg) +{ + const struct drm_dp_sideband_msg_hdr *hdr = &rxmsg->initial_hdr; + const struct drm_dp_mst_branch *mstb = txmsg->dst; + int tx_req_type = get_msg_request_type(txmsg->msg[0]); + int rx_req_type = get_msg_request_type(rxmsg->msg[0]); + char rad_str[64]; + + if (tx_req_type == rx_req_type) + return true; + + drm_dp_mst_rad_to_str(mstb->rad, mstb->lct, rad_str, sizeof(rad_str)); + drm_dbg_kms(mgr->dev, + "Got unexpected MST reply, mstb: %p seqno: %d lct: %d rad: %s rx_req_type: %s (%02x) != tx_req_type: %s (%02x)\n", + mstb, hdr->seqno, mstb->lct, rad_str, + drm_dp_mst_req_type_str(rx_req_type), rx_req_type, + drm_dp_mst_req_type_str(tx_req_type), tx_req_type); + + return false; +} + static int drm_dp_mst_handle_down_rep(struct drm_dp_mst_topology_mgr *mgr) { struct drm_dp_sideband_msg_tx *txmsg; @@ -3970,6 +3998,9 @@ static int drm_dp_mst_handle_down_rep(struct drm_dp_mst_topology_mgr *mgr) goto out_clear_reply; } + if (!verify_rx_request_type(mgr, txmsg, msg)) + goto out_clear_reply; + drm_dp_sideband_parse_reply(mgr, msg, &txmsg->reply); if (txmsg->reply.reply_type == DP_SIDEBAND_REPLY_NAK) { -- 2.44.2

5 months

1
0
0 0

[PATCH 1/7] drm/dp_mst: Fix resetting msg rx state after topology removal

by Imre Deak

If the MST topology is removed during the reception of an MST down reply or MST up request sideband message, the drm_dp_mst_topology_mgr::up_req_recv/down_rep_recv states could be reset from one thread via drm_dp_mst_topology_mgr_set_mst(false), racing with the reading/parsing of the message from another thread via drm_dp_mst_handle_down_rep() or drm_dp_mst_handle_up_req(). The race is possible since the reader/parser doesn't hold any lock while accessing the reception state. This in turn can lead to a memory corruption in the reader/parser as described by commit bd2fccac61b4 ("drm/dp_mst: Fix MST sideband message body length check"). Fix the above by resetting the message reception state if needed before reading/parsing a message. Another solution would be to hold the drm_dp_mst_topology_mgr::lock for the whole duration of the message reception/parsing in drm_dp_mst_handle_down_rep() and drm_dp_mst_handle_up_req(), however this would require a bigger change. Since the fix is also needed for stable, opting for the simpler solution in this patch. Cc: Lyude Paul <lyude(a)redhat.com> Cc: <stable(a)vger.kernel.org> Fixes: 1d082618bbf3 ("drm/display/dp_mst: Fix down/up message handling after sink disconnect") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/13056 Signed-off-by: Imre Deak <imre.deak(a)intel.com> --- drivers/gpu/drm/display/drm_dp_mst_topology.c | 21 +++++++++++++++++-- include/drm/display/drm_dp_mst_helper.h | 7 +++++++ 2 files changed, 26 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c index e6ee180815b20..1475aa95ab6b2 100644 --- a/drivers/gpu/drm/display/drm_dp_mst_topology.c +++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c @@ -3700,8 +3700,7 @@ int drm_dp_mst_topology_mgr_set_mst(struct drm_dp_mst_topology_mgr *mgr, bool ms ret = 0; mgr->payload_id_table_cleared = false; - memset(&mgr->down_rep_recv, 0, sizeof(mgr->down_rep_recv)); - memset(&mgr->up_req_recv, 0, sizeof(mgr->up_req_recv)); + mgr->reset_rx_state = true; } out_unlock: @@ -3859,6 +3858,11 @@ int drm_dp_mst_topology_mgr_resume(struct drm_dp_mst_topology_mgr *mgr, } EXPORT_SYMBOL(drm_dp_mst_topology_mgr_resume); +static void reset_msg_rx_state(struct drm_dp_sideband_msg_rx *msg) +{ + memset(msg, 0, sizeof(*msg)); +} + static bool drm_dp_get_one_sb_msg(struct drm_dp_mst_topology_mgr *mgr, bool up, struct drm_dp_mst_branch **mstb) @@ -4141,6 +4145,17 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) return 0; } +static void update_msg_rx_state(struct drm_dp_mst_topology_mgr *mgr) +{ + mutex_lock(&mgr->lock); + if (mgr->reset_rx_state) { + mgr->reset_rx_state = false; + reset_msg_rx_state(&mgr->down_rep_recv); + reset_msg_rx_state(&mgr->up_req_recv); + } + mutex_unlock(&mgr->lock); +} + /** * drm_dp_mst_hpd_irq_handle_event() - MST hotplug IRQ handle MST event * @mgr: manager to notify irq for. @@ -4175,6 +4190,8 @@ int drm_dp_mst_hpd_irq_handle_event(struct drm_dp_mst_topology_mgr *mgr, const u *handled = true; } + update_msg_rx_state(mgr); + if (esi[1] & DP_DOWN_REP_MSG_RDY) { ret = drm_dp_mst_handle_down_rep(mgr); *handled = true; diff --git a/include/drm/display/drm_dp_mst_helper.h b/include/drm/display/drm_dp_mst_helper.h index f6a1cbb0f600f..a80ba457a858f 100644 --- a/include/drm/display/drm_dp_mst_helper.h +++ b/include/drm/display/drm_dp_mst_helper.h @@ -699,6 +699,13 @@ struct drm_dp_mst_topology_mgr { */ bool payload_id_table_cleared : 1; + /** + * @reset_rx_state: The down request's reply and up request message + * receiver state must be reset, after the topology manager got + * removed. Protected by @lock. + */ + bool reset_rx_state : 1; + /** * @payload_count: The number of currently active payloads in hardware. This value is only * intended to be used internally by MST helpers for payload tracking, and is only safe to -- 2.44.2

5 months

1
0
0 0

[PATCH v5 0/2] media: uvcvideo: Support partial control reads and minor changes

by Ricardo Ribalda

Some cameras do not return all the bytes requested from a control if it can fit in less bytes. Eg: returning 0xab instead of 0x00ab. Support these devices. Also, now that we are at it, improve uvc_query_ctrl() logging. Signed-off-by: Ricardo Ribalda <ribalda(a)chromium.org> --- Changes in v5: - Improve comment. - Link to v4: https://lore.kernel.org/r/20241120-uvc-readless-v4-0-4672dbef3d46@chromium.… Changes in v4: - Improve comment. - Keep old likely(ret == size) - Link to v3: https://lore.kernel.org/r/20241118-uvc-readless-v3-0-d97c1a3084d0@chromium.… Changes in v3: - Improve documentation. - Do not change return sequence. - Use dev_ratelimit and dev_warn_once - Link to v2: https://lore.kernel.org/r/20241008-uvc-readless-v2-0-04d9d51aee56@chromium.… Changes in v2: - Rewrite error handling (Thanks Sakari) - Discard 2/3. It is not needed after rewriting the error handling. - Link to v1: https://lore.kernel.org/r/20241008-uvc-readless-v1-0-042ac4581f44@chromium.… --- Ricardo Ribalda (2): media: uvcvideo: Support partial control reads media: uvcvideo: Add more logging to uvc_query_ctrl() drivers/media/usb/uvc/uvc_video.c | 27 ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) --- base-commit: 9852d85ec9d492ebef56dc5f229416c925758edc change-id: 20241008-uvc-readless-23f9b8cad0b3 Best regards, -- Ricardo Ribalda <ribalda(a)chromium.org>

5 months

3
3
0 0

[PATCH v2] io_uring: Change res2 parameter type in io_uring_cmd_done

by Bernd Schubert

Change the type of the res2 parameter in io_uring_cmd_done from ssize_t to u64. This aligns the parameter type with io_req_set_cqe32_extra, which expects u64 arguments. The change eliminates potential issues on 32-bit architectures where ssize_t might be 32-bit. Only user of passing res2 is drivers/nvme/host/ioctl.c and it actually passes u64. Fixes: ee692a21e9bf ("fs,io_uring: add infrastructure for uring-cmd") Cc: stable(a)vger.kernel.org Reviewed-by: Kanchan Joshi <joshi.k(a)samsung.com> Tested-by: Li Zetao <lizetao1(a)huawei.com> Reviewed-by: Li Zetao <lizetao1(a)huawei.com> Signed-off-by: Bernd Schubert <bschubert(a)ddn.com> --- Changes in v2: - As suggested by Li Zetao, also update the type with CONFIG_IO_URING=n - Link to v1: https://lore.kernel.org/r/20241202-io_uring_cmd_done-res2-as-u64-v1-1-74f33… --- include/linux/io_uring/cmd.h | 4 ++-- io_uring/uring_cmd.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/include/linux/io_uring/cmd.h b/include/linux/io_uring/cmd.h index 578a3fdf5c719cf45fd4b6f9c894204d6b4f946c..0d5448c0b86cdde2e9764842adebafa1f8f49e61 100644 --- a/include/linux/io_uring/cmd.h +++ b/include/linux/io_uring/cmd.h @@ -43,7 +43,7 @@ int io_uring_cmd_import_fixed(u64 ubuf, unsigned long len, int rw, * Note: the caller should never hard code @issue_flags and is only allowed * to pass the mask provided by the core io_uring code. */ -void io_uring_cmd_done(struct io_uring_cmd *cmd, ssize_t ret, ssize_t res2, +void io_uring_cmd_done(struct io_uring_cmd *cmd, ssize_t ret, u64 res2, unsigned issue_flags); void __io_uring_cmd_do_in_task(struct io_uring_cmd *ioucmd, @@ -67,7 +67,7 @@ static inline int io_uring_cmd_import_fixed(u64 ubuf, unsigned long len, int rw, return -EOPNOTSUPP; } static inline void io_uring_cmd_done(struct io_uring_cmd *cmd, ssize_t ret, - ssize_t ret2, unsigned issue_flags) + u64 ret2, unsigned issue_flags) { } static inline void __io_uring_cmd_do_in_task(struct io_uring_cmd *ioucmd, diff --git a/io_uring/uring_cmd.c b/io_uring/uring_cmd.c index d9fb2143f56ff5d13483687fa949c293f9b8dbef..af842e9b4eb975ba56aaeaaa0c2e207a7732beba 100644 --- a/io_uring/uring_cmd.c +++ b/io_uring/uring_cmd.c @@ -151,7 +151,7 @@ static inline void io_req_set_cqe32_extra(struct io_kiocb *req, * Called by consumers of io_uring_cmd, if they originally returned * -EIOCBQUEUED upon receiving the command. */ -void io_uring_cmd_done(struct io_uring_cmd *ioucmd, ssize_t ret, ssize_t res2, +void io_uring_cmd_done(struct io_uring_cmd *ioucmd, ssize_t ret, u64 res2, unsigned issue_flags) { struct io_kiocb *req = cmd_to_io_kiocb(ioucmd); --- base-commit: 7af08b57bcb9ebf78675c50069c54125c0a8b795 change-id: 20241202-io_uring_cmd_done-res2-as-u64-217a4e47b93f Best regards, -- Bernd Schubert <bschubert(a)ddn.com>

5 months

3
2
0 0

Re: [PATCH net] net: usb: usbnet: fix name regression

by Dominique MARTINET

Hi, Oliver Neukum wrote on Thu, Oct 17, 2024 at 09:18:37AM +0200: > The fix for MAC addresses broke detection of the naming convention > because it gave network devices no random MAC before bind() > was called. This means that the check for the local assignment bit > was always negative as the address was zeroed from allocation, > instead of from overwriting the MAC with a unique hardware address. So we hit the exact inverse problem with this patch: our device ships an LTE modem which exposes a cdc-ethernet interface that had always been named usb0, and with this patch it started being named eth1, breaking too many hardcoded things expecting the name to be usb0 and making our devices unable to connect to the internet after updating the kernel. Long term we'll probably add an udev rule or something to make the name explicit in userspace and not risk this happening again, but perhaps there's a better way to keep the old behavior? (In particular this hit all stable kernels last month so I'm sure we won't be the only ones getting annoyed with this... Perhaps reverting both patches for stable branches might make sense if no better way forward is found -- I've added stable@ in cc for heads up/opinions) > +++ b/drivers/net/usb/usbnet.c > @@ -1767,7 +1767,8 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod) > // can rename the link if it knows better. > if ((dev->driver_info->flags & FLAG_ETHER) != 0 && > ((dev->driver_info->flags & FLAG_POINTTOPOINT) == 0 || > - (net->dev_addr [0] & 0x02) == 0)) > + /* somebody touched it*/ > + !is_zero_ether_addr(net->dev_addr))) ... or actually now I'm looking at it again, perhaps is the check just backwards, or am I getting this wrong? previous check was rename if (mac[0] & 0x2 == 0), which reads to me as "nobody set the 2nd bit" new check now renames if !is_zero, so renames if it was set, which is the opposite?... > strscpy(net->name, "eth%d", sizeof(net->name)); > /* WLAN devices should always be named "wlan%d" */ Thanks, -- Dominique Martinet

5 months

5
10
0 0

stable-rc: queues: 5.15: arch/arm64/kvm/vgic/vgic-its.c:870:24: error: implicit declaration of function 'vgic_its_write_entry_lock' [-Werror=implicit-function-declaration]

by Naresh Kamboju

The arm64 queues build gcc-12 defconfig-lkftconfig failed on the Linux stable-rc queue 5.15 for the arm64 architectures. arm64 * arm64, build - build/gcc-12-defconfig-lkftconfig Reported-by: Linux Kernel Functional Testing <lkft(a)linaro.org> Build errors: ------ arch/arm64/kvm/vgic/vgic-its.c:870:24: error: implicit declaration of function 'vgic_its_write_entry_lock' [-Werror=implicit-function-declaration] 870 | return vgic_its_write_entry_lock(its, gpa, 0, ite_esz); | ^~~~~~~~~~~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors Links: --- - https://qa-reports.linaro.org/lkft/linux-stable-rc-queues-queue_5.15/build/… - https://qa-reports.linaro.org/lkft/linux-stable-rc-queues-queue_5.15/build/… - https://qa-reports.linaro.org/lkft/linux-stable-rc-queues-queue_5.15/build/… Steps to reproduce: ------------ - tuxmake \ --runtime podman \ --target-arch arm64 \ --toolchain gcc-12 \ --kconfig https://storage.tuxsuite.com/public/linaro/lkft/builds/2pfZrGeL0phpW3aHlpr5… metadata: ---- git describe: v5.15.173-312-gc83ccef4e8ee git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git git sha: c83ccef4e8ee73e988561f85f18d2d73c7626ad0 kernel config: https://storage.tuxsuite.com/public/linaro/lkft/builds/2pfZrGeL0phpW3aHlpr5… build url: https://storage.tuxsuite.com/public/linaro/lkft/builds/2pfZrGeL0phpW3aHlpr5… toolchain: gcc-12 config: gcc-12-defconfig-lkftconfig arch: arm64 -- Linaro LKFT https://lkft.linaro.org

5 months

2
2
0 0

[PATCH v2 0/8] USB31DRD phy updates for Google Tensor gs101 (orientation & DWC3 rpm)

by André Draszik

Hi, This series enables USB3 Type-C lane orientation detection and configuration on platforms that support this (Google gs101), and it also allows the DWC3 core to enter runtime suspend even when UDC is active. For lane orientation, this driver now optionally (based on DT) subscribes to the TCPC's lane orientation notifier and remembers the orientation to later be used during phy_init(). To enable DWC3 runtime suspend, the gadget needs to inform the core via dwc3_gadget_interrupt() with event type == DWC3_DEVICE_EVENT_DISCONNECT of a cable disconnect. For that to allow to happen, this driver therefore needs to stop forcing the Vbus and bvalid signals to active and instead change their state based on actual conditions. The same TCPC notifier is used to detect this, and program the hardware accordingly. That signal state is based on advice given by Thinh in https://lore.kernel.org/all/20240813230625.jgkatqstyhcmpezv@synopsys.com/ Both changes together now allow cable orientation detection to work, as the DWC3 will now call phy_exit() on cable disconnect, and we can reprogram the lane mux in phy_init(). On top of that, there are some small related cleanup patches. Signed-off-by: André Draszik <andre.draszik(a)linaro.org> --- Changes in v2: - squash patches #2 and #3 from v1 to actually disallow orientation-switch on !gs101 (not just optional) (Conor) - update bindings commit message to clarify that the intention for the driver is to work with old and new DTS (Conor) - add cc-stable and fixes tags to power gating patch (Krzysztof) - fix an #include and typo (Peter) - Link to v1: https://lore.kernel.org/r/20241127-gs101-phy-lanes-orientation-phy-v1-0-1b7… --- André Draszik (8): dt-bindings: phy: samsung,usb3-drd-phy: align to universal style dt-bindings: phy: samsung,usb3-drd-phy: gs101: require Type-C properties phy: exynos5-usbdrd: convert to dev_err_probe phy: exynos5-usbdrd: fix EDS distribution tuning (gs101) phy: exynos5-usbdrd: gs101: ensure power is gated to SS phy in phy_exit() phy: exynos5-usbdrd: gs101: configure SS lanes based on orientation phy: exynos5-usbdrd: subscribe to orientation notifier if required phy: exynos5-usbdrd: allow DWC3 runtime suspend with UDC bound (E850+) .../bindings/phy/samsung,usb3-drd-phy.yaml | 24 +++ drivers/phy/samsung/Kconfig | 1 + drivers/phy/samsung/phy-exynos5-usbdrd.c | 223 ++++++++++++++++----- 3 files changed, 202 insertions(+), 46 deletions(-) --- base-commit: ed9a4ad6e5bd3a443e81446476718abebee47e82 change-id: 20241127-gs101-phy-lanes-orientation-phy-29d20c6d84d2 Best regards, -- André Draszik <andre.draszik(a)linaro.org>

5 months

1
1
0 0

[net PATCH 1/2] selftests: net: lib: fix broken ping with coreutils ping util

by Christian Marangi

If the coreutils variant of ping is used instead of the busybox one, the ping_do() command is broken. This comes by the fact that for coreutils ping, the ping IP needs to be the very last elements. To handle this, reorder the ping args and make $dip last element. The use of coreutils ping might be useful for case where busybox is not compiled with float interval support and ping command doesn't support 0.1 interval. (in such case a dedicated ping utility is installed instead) Cc: stable(a)vger.kernel.org Fixes: 73bae6736b6b ("selftests: forwarding: Add initial testing framework") Signed-off-by: Christian Marangi <ansuelsmth(a)gmail.com> --- tools/testing/selftests/net/forwarding/lib.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh index c992e385159c..2060f95d5c62 100644 --- a/tools/testing/selftests/net/forwarding/lib.sh +++ b/tools/testing/selftests/net/forwarding/lib.sh @@ -1473,8 +1473,8 @@ ping_do() vrf_name=$(master_name_get $if_name) ip vrf exec $vrf_name \ - $PING $args $dip -c $PING_COUNT -i 0.1 \ - -w $PING_TIMEOUT &> /dev/null + $PING $args -c $PING_COUNT -i 0.1 \ + -w $PING_TIMEOUT $dip &> /dev/null } ping_test() @@ -1504,8 +1504,8 @@ ping6_do() vrf_name=$(master_name_get $if_name) ip vrf exec $vrf_name \ - $PING6 $args $dip -c $PING_COUNT -i 0.1 \ - -w $PING_TIMEOUT &> /dev/null + $PING6 $args -c $PING_COUNT -i 0.1 \ + -w $PING_TIMEOUT $dip &> /dev/null } ping6_test() -- 2.45.2

5 months

2
10
0 0

[PATCH] jffs2: Fix rtime decompressor

by Richard Weinberger

The fix for a memory corruption contained a off-by-one error and caused the compressor to fail in legit cases. Cc: Kinsey Moore <kinsey.moore(a)oarcorp.com> Cc: stable(a)vger.kernel.org Fixes: fe051552f5078 ("jffs2: Prevent rtime decompress memory corruption") Signed-off-by: Richard Weinberger <richard(a)nod.at> --- fs/jffs2/compr_rtime.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jffs2/compr_rtime.c b/fs/jffs2/compr_rtime.c index 2b9ef713b844a..3bd9d2f3bece2 100644 --- a/fs/jffs2/compr_rtime.c +++ b/fs/jffs2/compr_rtime.c @@ -95,7 +95,7 @@ static int jffs2_rtime_decompress(unsigned char *data_in, positions[value]=outpos; if (repeat) { - if ((outpos + repeat) >= destlen) { + if ((outpos + repeat) > destlen) { return 1; } if (backoffs + repeat >= outpos) { -- 2.47.0

5 months

1
0
0 0

[PATCH] riscv/ptrace: add new regset to get original a0 register

by Celeste Liu

The orig_a0 is missing in struct user_regs_struct of riscv, and there is no way to add it without breaking UAPI. (See Link tag below) Like NT_ARM_SYSTEM_CALL do, we add a new regset name NT_RISCV_ORIG_A0 to access original a0 register from userspace via ptrace API. Link: https://lore.kernel.org/all/59505464-c84a-403d-972f-d4b2055eeaac@gmail.com/ Signed-off-by: Celeste Liu <uwu(a)coelacanthus.name> --- arch/riscv/kernel/ptrace.c | 33 +++++++++++++++++++++++++++++++++ include/uapi/linux/elf.h | 1 + 2 files changed, 34 insertions(+) diff --git a/arch/riscv/kernel/ptrace.c b/arch/riscv/kernel/ptrace.c index ea67e9fb7a583683b922fe2c017ea61f3bc848db..faa46de9000376eb445a32d43a40210d7b846844 100644 --- a/arch/riscv/kernel/ptrace.c +++ b/arch/riscv/kernel/ptrace.c @@ -31,6 +31,7 @@ enum riscv_regset { #ifdef CONFIG_RISCV_ISA_SUPM REGSET_TAGGED_ADDR_CTRL, #endif + REGSET_ORIG_A0, }; static int riscv_gpr_get(struct task_struct *target, @@ -184,6 +185,30 @@ static int tagged_addr_ctrl_set(struct task_struct *target, } #endif +static int riscv_orig_a0_get(struct task_struct *target, + const struct user_regset *regset, + struct membuf to) +{ + return membuf_store(&to, task_pt_regs(target)->orig_a0); +} + +static int riscv_orig_a0_set(struct task_struct *target, + const struct user_regset *regset, + unsigned int pos, unsigned int count, + const void *kbuf, const void __user *ubuf) +{ + int orig_a0 = task_pt_regs(target)->orig_a0; + int ret; + + ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &orig_a0, 0, -1); + if (ret) + return ret; + + task_pt_regs(target)->orig_a0 = orig_a0; + return ret; +} + + static const struct user_regset riscv_user_regset[] = { [REGSET_X] = { .core_note_type = NT_PRSTATUS, @@ -224,6 +249,14 @@ static const struct user_regset riscv_user_regset[] = { .set = tagged_addr_ctrl_set, }, #endif + [REGSET_ORIG_A0] = { + .core_note_type = NT_RISCV_ORIG_A0, + .n = 1, + .size = sizeof(elf_greg_t), + .align = sizeof(elf_greg_t), + .regset_get = riscv_orig_a0_get, + .set = riscv_orig_a0_set, + }, }; static const struct user_regset_view riscv_user_native_view = { diff --git a/include/uapi/linux/elf.h b/include/uapi/linux/elf.h index b44069d29cecc0f9de90ee66bfffd2137f4275a8..390060229601631da2fb27030d9fa2142e676c14 100644 --- a/include/uapi/linux/elf.h +++ b/include/uapi/linux/elf.h @@ -452,6 +452,7 @@ typedef struct elf64_shdr { #define NT_RISCV_CSR 0x900 /* RISC-V Control and Status Registers */ #define NT_RISCV_VECTOR 0x901 /* RISC-V vector registers */ #define NT_RISCV_TAGGED_ADDR_CTRL 0x902 /* RISC-V tagged address control (prctl()) */ +#define NT_RISCV_ORIG_A0 0x903 /* RISC-V original a0 register */ #define NT_LOONGARCH_CPUCFG 0xa00 /* LoongArch CPU config registers */ #define NT_LOONGARCH_CSR 0xa01 /* LoongArch control and status registers */ #define NT_LOONGARCH_LSX 0xa02 /* LoongArch Loongson SIMD Extension registers */ --- base-commit: 0e287d31b62bb53ad81d5e59778384a40f8b6f56 change-id: 20241201-riscv-new-regset-d529b952ad0d Best regards, -- Celeste Liu <uwu(a)coelacanthus.name>

5 months

4
6
0 0

FAILED: patch "[PATCH] usb: dwc3: gadget: Fix looping of queued SG entries" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y git checkout FETCH_HEAD git cherry-pick -x b7fc65f5141c24785dc8c19249ca4efcf71b3524 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120326-tactful-stash-66fd@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From b7fc65f5141c24785dc8c19249ca4efcf71b3524 Mon Sep 17 00:00:00 2001 From: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Date: Thu, 14 Nov 2024 01:02:18 +0000 Subject: [PATCH] usb: dwc3: gadget: Fix looping of queued SG entries The dwc3_request->num_queued_sgs is decremented on completion. If a partially completed request is handled, then the dwc3_request->num_queued_sgs no longer reflects the total number of num_queued_sgs (it would be cleared). Correctly check the number of request SG entries remained to be prepare and queued. Failure to do this may cause null pointer dereference when accessing non-existent SG entry. Cc: stable(a)vger.kernel.org Fixes: c96e6725db9d ("usb: dwc3: gadget: Correct the logic for queuing sgs") Signed-off-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Link: https://lore.kernel.org/r/d07a7c4aa0fcf746cdca0515150dbe5c52000af7.17315457… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 38c3769a6c48..3a5a0d8be33c 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -1470,8 +1470,8 @@ static int dwc3_prepare_trbs_sg(struct dwc3_ep *dep, struct scatterlist *s; int i; unsigned int length = req->request.length; - unsigned int remaining = req->request.num_mapped_sgs - - req->num_queued_sgs; + unsigned int remaining = req->num_pending_sgs; + unsigned int num_queued_sgs = req->request.num_mapped_sgs - remaining; unsigned int num_trbs = req->num_trbs; bool needs_extra_trb = dwc3_needs_extra_trb(dep, req); @@ -1479,7 +1479,7 @@ static int dwc3_prepare_trbs_sg(struct dwc3_ep *dep, * If we resume preparing the request, then get the remaining length of * the request and resume where we left off. */ - for_each_sg(req->request.sg, s, req->num_queued_sgs, i) + for_each_sg(req->request.sg, s, num_queued_sgs, i) length -= sg_dma_len(s); for_each_sg(sg, s, remaining, i) {

5 months

1
0
0 0

FAILED: patch "[PATCH] usb: dwc3: gadget: Fix looping of queued SG entries" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x b7fc65f5141c24785dc8c19249ca4efcf71b3524 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120325-flaky-phantom-f755@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From b7fc65f5141c24785dc8c19249ca4efcf71b3524 Mon Sep 17 00:00:00 2001 From: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Date: Thu, 14 Nov 2024 01:02:18 +0000 Subject: [PATCH] usb: dwc3: gadget: Fix looping of queued SG entries The dwc3_request->num_queued_sgs is decremented on completion. If a partially completed request is handled, then the dwc3_request->num_queued_sgs no longer reflects the total number of num_queued_sgs (it would be cleared). Correctly check the number of request SG entries remained to be prepare and queued. Failure to do this may cause null pointer dereference when accessing non-existent SG entry. Cc: stable(a)vger.kernel.org Fixes: c96e6725db9d ("usb: dwc3: gadget: Correct the logic for queuing sgs") Signed-off-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Link: https://lore.kernel.org/r/d07a7c4aa0fcf746cdca0515150dbe5c52000af7.17315457… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 38c3769a6c48..3a5a0d8be33c 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -1470,8 +1470,8 @@ static int dwc3_prepare_trbs_sg(struct dwc3_ep *dep, struct scatterlist *s; int i; unsigned int length = req->request.length; - unsigned int remaining = req->request.num_mapped_sgs - - req->num_queued_sgs; + unsigned int remaining = req->num_pending_sgs; + unsigned int num_queued_sgs = req->request.num_mapped_sgs - remaining; unsigned int num_trbs = req->num_trbs; bool needs_extra_trb = dwc3_needs_extra_trb(dep, req); @@ -1479,7 +1479,7 @@ static int dwc3_prepare_trbs_sg(struct dwc3_ep *dep, * If we resume preparing the request, then get the remaining length of * the request and resume where we left off. */ - for_each_sg(req->request.sg, s, req->num_queued_sgs, i) + for_each_sg(req->request.sg, s, num_queued_sgs, i) length -= sg_dma_len(s); for_each_sg(sg, s, remaining, i) {

5 months

1
0
0 0

FAILED: patch "[PATCH] usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x 5d2fb074dea289c41f5aaf2c3f68286bee370634 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120324-washable-bronze-6e25@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 5d2fb074dea289c41f5aaf2c3f68286bee370634 Mon Sep 17 00:00:00 2001 From: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Date: Thu, 14 Nov 2024 01:02:06 +0000 Subject: [PATCH] usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED The driver cannot issue the End Transfer command to the SETUP transfer. Don't clear DWC3_EP_TRANSFER_STARTED flag to make sure that the driver won't send Start Transfer command again, which can cause no-resource error. For example this can occur if the host issues a reset to the device. Cc: stable(a)vger.kernel.org Fixes: 76cb323f80ac ("usb: dwc3: ep0: clear all EP0 flags") Signed-off-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Link: https://lore.kernel.org/r/d3d618185fd614bb7426352a9fc1199641d3b5f5.17315457… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c index f3d97ad5156e..666ac432f52d 100644 --- a/drivers/usb/dwc3/ep0.c +++ b/drivers/usb/dwc3/ep0.c @@ -232,7 +232,7 @@ void dwc3_ep0_stall_and_restart(struct dwc3 *dwc) /* stall is always issued on EP0 */ dep = dwc->eps[0]; __dwc3_gadget_ep_set_halt(dep, 1, false); - dep->flags &= DWC3_EP_RESOURCE_ALLOCATED; + dep->flags &= DWC3_EP_RESOURCE_ALLOCATED | DWC3_EP_TRANSFER_STARTED; dep->flags |= DWC3_EP_ENABLED; dwc->delayed_status = false;

5 months

1
0
0 0

FAILED: patch "[PATCH] usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y git checkout FETCH_HEAD git cherry-pick -x 5d2fb074dea289c41f5aaf2c3f68286bee370634 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120325-spookily-agreeably-b1e4@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 5d2fb074dea289c41f5aaf2c3f68286bee370634 Mon Sep 17 00:00:00 2001 From: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Date: Thu, 14 Nov 2024 01:02:06 +0000 Subject: [PATCH] usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED The driver cannot issue the End Transfer command to the SETUP transfer. Don't clear DWC3_EP_TRANSFER_STARTED flag to make sure that the driver won't send Start Transfer command again, which can cause no-resource error. For example this can occur if the host issues a reset to the device. Cc: stable(a)vger.kernel.org Fixes: 76cb323f80ac ("usb: dwc3: ep0: clear all EP0 flags") Signed-off-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Link: https://lore.kernel.org/r/d3d618185fd614bb7426352a9fc1199641d3b5f5.17315457… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c index f3d97ad5156e..666ac432f52d 100644 --- a/drivers/usb/dwc3/ep0.c +++ b/drivers/usb/dwc3/ep0.c @@ -232,7 +232,7 @@ void dwc3_ep0_stall_and_restart(struct dwc3 *dwc) /* stall is always issued on EP0 */ dep = dwc->eps[0]; __dwc3_gadget_ep_set_halt(dep, 1, false); - dep->flags &= DWC3_EP_RESOURCE_ALLOCATED; + dep->flags &= DWC3_EP_RESOURCE_ALLOCATED | DWC3_EP_TRANSFER_STARTED; dep->flags |= DWC3_EP_ENABLED; dwc->delayed_status = false;

5 months

1
0
0 0

FAILED: patch "[PATCH] usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 5d2fb074dea289c41f5aaf2c3f68286bee370634 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120324-chimp-congested-68a6@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 5d2fb074dea289c41f5aaf2c3f68286bee370634 Mon Sep 17 00:00:00 2001 From: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Date: Thu, 14 Nov 2024 01:02:06 +0000 Subject: [PATCH] usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED The driver cannot issue the End Transfer command to the SETUP transfer. Don't clear DWC3_EP_TRANSFER_STARTED flag to make sure that the driver won't send Start Transfer command again, which can cause no-resource error. For example this can occur if the host issues a reset to the device. Cc: stable(a)vger.kernel.org Fixes: 76cb323f80ac ("usb: dwc3: ep0: clear all EP0 flags") Signed-off-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Link: https://lore.kernel.org/r/d3d618185fd614bb7426352a9fc1199641d3b5f5.17315457… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c index f3d97ad5156e..666ac432f52d 100644 --- a/drivers/usb/dwc3/ep0.c +++ b/drivers/usb/dwc3/ep0.c @@ -232,7 +232,7 @@ void dwc3_ep0_stall_and_restart(struct dwc3 *dwc) /* stall is always issued on EP0 */ dep = dwc->eps[0]; __dwc3_gadget_ep_set_halt(dep, 1, false); - dep->flags &= DWC3_EP_RESOURCE_ALLOCATED; + dep->flags &= DWC3_EP_RESOURCE_ALLOCATED | DWC3_EP_TRANSFER_STARTED; dep->flags |= DWC3_EP_ENABLED; dwc->delayed_status = false;

5 months

1
0
0 0

FAILED: patch "[PATCH] usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x 5d2fb074dea289c41f5aaf2c3f68286bee370634 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120323-liable-thee-505d@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 5d2fb074dea289c41f5aaf2c3f68286bee370634 Mon Sep 17 00:00:00 2001 From: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Date: Thu, 14 Nov 2024 01:02:06 +0000 Subject: [PATCH] usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED The driver cannot issue the End Transfer command to the SETUP transfer. Don't clear DWC3_EP_TRANSFER_STARTED flag to make sure that the driver won't send Start Transfer command again, which can cause no-resource error. For example this can occur if the host issues a reset to the device. Cc: stable(a)vger.kernel.org Fixes: 76cb323f80ac ("usb: dwc3: ep0: clear all EP0 flags") Signed-off-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Link: https://lore.kernel.org/r/d3d618185fd614bb7426352a9fc1199641d3b5f5.17315457… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c index f3d97ad5156e..666ac432f52d 100644 --- a/drivers/usb/dwc3/ep0.c +++ b/drivers/usb/dwc3/ep0.c @@ -232,7 +232,7 @@ void dwc3_ep0_stall_and_restart(struct dwc3 *dwc) /* stall is always issued on EP0 */ dep = dwc->eps[0]; __dwc3_gadget_ep_set_halt(dep, 1, false); - dep->flags &= DWC3_EP_RESOURCE_ALLOCATED; + dep->flags &= DWC3_EP_RESOURCE_ALLOCATED | DWC3_EP_TRANSFER_STARTED; dep->flags |= DWC3_EP_ENABLED; dwc->delayed_status = false;

5 months

1
0
0 0

FAILED: patch "[PATCH] usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 5d2fb074dea289c41f5aaf2c3f68286bee370634 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120322-lurk-clutch-522d@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 5d2fb074dea289c41f5aaf2c3f68286bee370634 Mon Sep 17 00:00:00 2001 From: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Date: Thu, 14 Nov 2024 01:02:06 +0000 Subject: [PATCH] usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED The driver cannot issue the End Transfer command to the SETUP transfer. Don't clear DWC3_EP_TRANSFER_STARTED flag to make sure that the driver won't send Start Transfer command again, which can cause no-resource error. For example this can occur if the host issues a reset to the device. Cc: stable(a)vger.kernel.org Fixes: 76cb323f80ac ("usb: dwc3: ep0: clear all EP0 flags") Signed-off-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Link: https://lore.kernel.org/r/d3d618185fd614bb7426352a9fc1199641d3b5f5.17315457… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c index f3d97ad5156e..666ac432f52d 100644 --- a/drivers/usb/dwc3/ep0.c +++ b/drivers/usb/dwc3/ep0.c @@ -232,7 +232,7 @@ void dwc3_ep0_stall_and_restart(struct dwc3 *dwc) /* stall is always issued on EP0 */ dep = dwc->eps[0]; __dwc3_gadget_ep_set_halt(dep, 1, false); - dep->flags &= DWC3_EP_RESOURCE_ALLOCATED; + dep->flags &= DWC3_EP_RESOURCE_ALLOCATED | DWC3_EP_TRANSFER_STARTED; dep->flags |= DWC3_EP_ENABLED; dwc->delayed_status = false;

5 months

1
0
0 0

FAILED: patch "[PATCH] usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED" failed to apply to 6.6-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.6-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y git checkout FETCH_HEAD git cherry-pick -x 5d2fb074dea289c41f5aaf2c3f68286bee370634 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120322-subside-manhood-cb29@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 5d2fb074dea289c41f5aaf2c3f68286bee370634 Mon Sep 17 00:00:00 2001 From: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Date: Thu, 14 Nov 2024 01:02:06 +0000 Subject: [PATCH] usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED The driver cannot issue the End Transfer command to the SETUP transfer. Don't clear DWC3_EP_TRANSFER_STARTED flag to make sure that the driver won't send Start Transfer command again, which can cause no-resource error. For example this can occur if the host issues a reset to the device. Cc: stable(a)vger.kernel.org Fixes: 76cb323f80ac ("usb: dwc3: ep0: clear all EP0 flags") Signed-off-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Link: https://lore.kernel.org/r/d3d618185fd614bb7426352a9fc1199641d3b5f5.17315457… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c index f3d97ad5156e..666ac432f52d 100644 --- a/drivers/usb/dwc3/ep0.c +++ b/drivers/usb/dwc3/ep0.c @@ -232,7 +232,7 @@ void dwc3_ep0_stall_and_restart(struct dwc3 *dwc) /* stall is always issued on EP0 */ dep = dwc->eps[0]; __dwc3_gadget_ep_set_halt(dep, 1, false); - dep->flags &= DWC3_EP_RESOURCE_ALLOCATED; + dep->flags &= DWC3_EP_RESOURCE_ALLOCATED | DWC3_EP_TRANSFER_STARTED; dep->flags |= DWC3_EP_ENABLED; dwc->delayed_status = false;

5 months

1
0
0 0

FAILED: patch "[PATCH] ALSA: hda/realtek: Update ALC225 depop procedure" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y git checkout FETCH_HEAD git cherry-pick -x 1fd50509fe14a9adc9329e0454b986157a4c155a # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120303-talcum-editor-4060@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 1fd50509fe14a9adc9329e0454b986157a4c155a Mon Sep 17 00:00:00 2001 From: Kailang Yang <kailang(a)realtek.com> Date: Thu, 14 Nov 2024 15:08:07 +0800 Subject: [PATCH] ALSA: hda/realtek: Update ALC225 depop procedure Old procedure has a chance to meet Headphone no output. Fixes: da911b1f5e98 ("ALSA: hda/realtek - update ALC225 depop optimize") Signed-off-by: Kailang Yang <kailang(a)realtek.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/5a27b016ba9d42b4a4e6dadce50a3ba4@realtek.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index 290c0710f24d..c53a5f8d1559 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -3768,33 +3768,28 @@ static void alc225_init(struct hda_codec *codec) hp1_pin_sense = snd_hda_jack_detect(codec, hp_pin); hp2_pin_sense = snd_hda_jack_detect(codec, 0x16); - if (hp1_pin_sense || hp2_pin_sense) + if (hp1_pin_sense || hp2_pin_sense) { msleep(2); + alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x1); /* Low power */ - alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x1); /* Low power */ + if (hp1_pin_sense) + snd_hda_codec_write(codec, hp_pin, 0, + AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT); + if (hp2_pin_sense) + snd_hda_codec_write(codec, 0x16, 0, + AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT); + msleep(75); - if (hp1_pin_sense || spec->ultra_low_power) - snd_hda_codec_write(codec, hp_pin, 0, - AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE); - if (hp2_pin_sense) - snd_hda_codec_write(codec, 0x16, 0, - AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE); + if (hp1_pin_sense) + snd_hda_codec_write(codec, hp_pin, 0, + AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE); + if (hp2_pin_sense) + snd_hda_codec_write(codec, 0x16, 0, + AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE); - if (hp1_pin_sense || hp2_pin_sense || spec->ultra_low_power) - msleep(85); - - if (hp1_pin_sense || spec->ultra_low_power) - snd_hda_codec_write(codec, hp_pin, 0, - AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT); - if (hp2_pin_sense) - snd_hda_codec_write(codec, 0x16, 0, - AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT); - - if (hp1_pin_sense || hp2_pin_sense || spec->ultra_low_power) - msleep(100); - - alc_update_coef_idx(codec, 0x4a, 3 << 10, 0); - alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x4); /* Hight power */ + msleep(75); + alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x4); /* Hight power */ + } } static void alc225_shutup(struct hda_codec *codec) @@ -3806,36 +3801,35 @@ static void alc225_shutup(struct hda_codec *codec) if (!hp_pin) hp_pin = 0x21; - alc_disable_headset_jack_key(codec); - /* 3k pull low control for Headset jack. */ - alc_update_coef_idx(codec, 0x4a, 0, 3 << 10); - hp1_pin_sense = snd_hda_jack_detect(codec, hp_pin); hp2_pin_sense = snd_hda_jack_detect(codec, 0x16); - if (hp1_pin_sense || hp2_pin_sense) + if (hp1_pin_sense || hp2_pin_sense) { + alc_disable_headset_jack_key(codec); + /* 3k pull low control for Headset jack. */ + alc_update_coef_idx(codec, 0x4a, 0, 3 << 10); msleep(2); - if (hp1_pin_sense || spec->ultra_low_power) - snd_hda_codec_write(codec, hp_pin, 0, - AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE); - if (hp2_pin_sense) - snd_hda_codec_write(codec, 0x16, 0, - AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE); + if (hp1_pin_sense) + snd_hda_codec_write(codec, hp_pin, 0, + AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE); + if (hp2_pin_sense) + snd_hda_codec_write(codec, 0x16, 0, + AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE); - if (hp1_pin_sense || hp2_pin_sense || spec->ultra_low_power) - msleep(85); + msleep(75); - if (hp1_pin_sense || spec->ultra_low_power) - snd_hda_codec_write(codec, hp_pin, 0, - AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); - if (hp2_pin_sense) - snd_hda_codec_write(codec, 0x16, 0, - AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); - - if (hp1_pin_sense || hp2_pin_sense || spec->ultra_low_power) - msleep(100); + if (hp1_pin_sense) + snd_hda_codec_write(codec, hp_pin, 0, + AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); + if (hp2_pin_sense) + snd_hda_codec_write(codec, 0x16, 0, + AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); + msleep(75); + alc_update_coef_idx(codec, 0x4a, 3 << 10, 0); + alc_enable_headset_jack_key(codec); + } alc_auto_setup_eapd(codec, false); alc_shutup_pins(codec); if (spec->ultra_low_power) { @@ -3846,9 +3840,6 @@ static void alc225_shutup(struct hda_codec *codec) alc_update_coef_idx(codec, 0x4a, 3<<4, 2<<4); msleep(30); } - - alc_update_coef_idx(codec, 0x4a, 3 << 10, 0); - alc_enable_headset_jack_key(codec); } static void alc_default_init(struct hda_codec *codec)

5 months

1
0
0 0

FAILED: patch "[PATCH] serial: 8250_fintek: Add support for F81216E" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 166105c9030a30ba08574a9998afc7b60bc72dd7 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120304-postnasal-shoptalk-c764@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 166105c9030a30ba08574a9998afc7b60bc72dd7 Mon Sep 17 00:00:00 2001 From: Filip Brozovic <fbrozovic(a)gmail.com> Date: Sun, 10 Nov 2024 12:17:00 +0100 Subject: [PATCH] serial: 8250_fintek: Add support for F81216E The F81216E is a LPC/eSPI to 4 UART Super I/O and is mostly compatible with the F81216H, but does not support RS-485 auto-direction delays on any port. Signed-off-by: Filip Brozovic <fbrozovic(a)gmail.com> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/20241110111703.15494-1-fbrozovic@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/tty/serial/8250/8250_fintek.c b/drivers/tty/serial/8250/8250_fintek.c index f59c01f48480..b4461a89b8d0 100644 --- a/drivers/tty/serial/8250/8250_fintek.c +++ b/drivers/tty/serial/8250/8250_fintek.c @@ -21,6 +21,7 @@ #define CHIP_ID_F81866 0x1010 #define CHIP_ID_F81966 0x0215 #define CHIP_ID_F81216AD 0x1602 +#define CHIP_ID_F81216E 0x1617 #define CHIP_ID_F81216H 0x0501 #define CHIP_ID_F81216 0x0802 #define VENDOR_ID1 0x23 @@ -158,6 +159,7 @@ static int fintek_8250_check_id(struct fintek_8250 *pdata) case CHIP_ID_F81866: case CHIP_ID_F81966: case CHIP_ID_F81216AD: + case CHIP_ID_F81216E: case CHIP_ID_F81216H: case CHIP_ID_F81216: break; @@ -181,6 +183,7 @@ static int fintek_8250_get_ldn_range(struct fintek_8250 *pdata, int *min, return 0; case CHIP_ID_F81216AD: + case CHIP_ID_F81216E: case CHIP_ID_F81216H: case CHIP_ID_F81216: *min = F81216_LDN_LOW; @@ -250,6 +253,7 @@ static void fintek_8250_set_irq_mode(struct fintek_8250 *pdata, bool is_level) break; case CHIP_ID_F81216AD: + case CHIP_ID_F81216E: case CHIP_ID_F81216H: case CHIP_ID_F81216: sio_write_mask_reg(pdata, FINTEK_IRQ_MODE, IRQ_SHARE, @@ -263,7 +267,8 @@ static void fintek_8250_set_irq_mode(struct fintek_8250 *pdata, bool is_level) static void fintek_8250_set_max_fifo(struct fintek_8250 *pdata) { switch (pdata->pid) { - case CHIP_ID_F81216H: /* 128Bytes FIFO */ + case CHIP_ID_F81216E: /* 128Bytes FIFO */ + case CHIP_ID_F81216H: case CHIP_ID_F81966: case CHIP_ID_F81866: sio_write_mask_reg(pdata, FIFO_CTRL, @@ -297,6 +302,7 @@ static void fintek_8250_set_termios(struct uart_port *port, goto exit; switch (pdata->pid) { + case CHIP_ID_F81216E: case CHIP_ID_F81216H: reg = RS485; break; @@ -346,6 +352,7 @@ static void fintek_8250_set_termios_handler(struct uart_8250_port *uart) struct fintek_8250 *pdata = uart->port.private_data; switch (pdata->pid) { + case CHIP_ID_F81216E: case CHIP_ID_F81216H: case CHIP_ID_F81966: case CHIP_ID_F81866: @@ -438,6 +445,11 @@ static void fintek_8250_set_rs485_handler(struct uart_8250_port *uart) uart->port.rs485_supported = fintek_8250_rs485_supported; break; + case CHIP_ID_F81216E: /* F81216E does not support RS485 delays */ + uart->port.rs485_config = fintek_8250_rs485_config; + uart->port.rs485_supported = fintek_8250_rs485_supported; + break; + default: /* No RS485 Auto direction functional */ break; }

5 months

1
0
0 0

FAILED: patch "[PATCH] media: v4l2-core: v4l2-dv-timings: check cvt/gtf result" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x 9f070b1862f3411b8bcdfd51a8eaad25286f9deb # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120333-canon-nurture-3430@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 9f070b1862f3411b8bcdfd51a8eaad25286f9deb Mon Sep 17 00:00:00 2001 From: Hans Verkuil <hverkuil(a)xs4all.nl> Date: Mon, 14 Oct 2024 16:52:41 +0200 Subject: [PATCH] media: v4l2-core: v4l2-dv-timings: check cvt/gtf result The v4l2_detect_cvt/gtf functions should check the result against the timing capabilities: these functions calculate the timings, so if they are out of bounds, they should be rejected. To do this, add the struct v4l2_dv_timings_cap as argument to those functions. This required updates to the adv7604 and adv7842 drivers since the prototype of these functions has now changed. The timings struct that is passed to v4l2_detect_cvt/gtf in those two drivers is filled with the timings detected by the hardware. The vivid driver was also updated, but an additional check was added: the width and height specified by VIDIOC_S_DV_TIMINGS has to match the calculated result, otherwise something went wrong. Note that vivid *emulates* hardware, so all the values passed to the v4l2_detect_cvt/gtf functions came from the timings struct that was filled by userspace and passed on to the driver via VIDIOC_S_DV_TIMINGS. So these fields can contain random data. Both the constraints check via struct v4l2_dv_timings_cap and the additional width/height check ensure that the resulting timings are sane and not messed up by the v4l2_detect_cvt/gtf calculations. Signed-off-by: Hans Verkuil <hverkuil(a)xs4all.nl> Fixes: 2576415846bc ("[media] v4l2: move dv-timings related code to v4l2-dv-timings.c") Cc: stable(a)vger.kernel.org Reported-by: syzbot+a828133770f62293563e(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-media/000000000000013050062127830a@google.com/ diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c index 3184a2fa1532..4504909d95bc 100644 --- a/drivers/media/i2c/adv7604.c +++ b/drivers/media/i2c/adv7604.c @@ -1408,12 +1408,13 @@ static int stdi2dv_timings(struct v4l2_subdev *sd, if (v4l2_detect_cvt(stdi->lcf + 1, hfreq, stdi->lcvs, 0, (stdi->hs_pol == '+' ? V4L2_DV_HSYNC_POS_POL : 0) | (stdi->vs_pol == '+' ? V4L2_DV_VSYNC_POS_POL : 0), - false, timings)) + false, adv76xx_get_dv_timings_cap(sd, -1), timings)) return 0; if (v4l2_detect_gtf(stdi->lcf + 1, hfreq, stdi->lcvs, (stdi->hs_pol == '+' ? V4L2_DV_HSYNC_POS_POL : 0) | (stdi->vs_pol == '+' ? V4L2_DV_VSYNC_POS_POL : 0), - false, state->aspect_ratio, timings)) + false, state->aspect_ratio, + adv76xx_get_dv_timings_cap(sd, -1), timings)) return 0; v4l2_dbg(2, debug, sd, diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c index e445699da85b..3c9e613af0ce 100644 --- a/drivers/media/i2c/adv7842.c +++ b/drivers/media/i2c/adv7842.c @@ -1434,14 +1434,15 @@ static int stdi2dv_timings(struct v4l2_subdev *sd, } if (v4l2_detect_cvt(stdi->lcf + 1, hfreq, stdi->lcvs, 0, - (stdi->hs_pol == '+' ? V4L2_DV_HSYNC_POS_POL : 0) | - (stdi->vs_pol == '+' ? V4L2_DV_VSYNC_POS_POL : 0), - false, timings)) + (stdi->hs_pol == '+' ? V4L2_DV_HSYNC_POS_POL : 0) | + (stdi->vs_pol == '+' ? V4L2_DV_VSYNC_POS_POL : 0), + false, adv7842_get_dv_timings_cap(sd), timings)) return 0; if (v4l2_detect_gtf(stdi->lcf + 1, hfreq, stdi->lcvs, - (stdi->hs_pol == '+' ? V4L2_DV_HSYNC_POS_POL : 0) | - (stdi->vs_pol == '+' ? V4L2_DV_VSYNC_POS_POL : 0), - false, state->aspect_ratio, timings)) + (stdi->hs_pol == '+' ? V4L2_DV_HSYNC_POS_POL : 0) | + (stdi->vs_pol == '+' ? V4L2_DV_VSYNC_POS_POL : 0), + false, state->aspect_ratio, + adv7842_get_dv_timings_cap(sd), timings)) return 0; v4l2_dbg(2, debug, sd, diff --git a/drivers/media/test-drivers/vivid/vivid-vid-cap.c b/drivers/media/test-drivers/vivid/vivid-vid-cap.c index e74d73d370e0..ecff984e521c 100644 --- a/drivers/media/test-drivers/vivid/vivid-vid-cap.c +++ b/drivers/media/test-drivers/vivid/vivid-vid-cap.c @@ -1457,12 +1457,19 @@ static bool valid_cvt_gtf_timings(struct v4l2_dv_timings *timings) h_freq = (u32)bt->pixelclock / total_h_pixel; if (bt->standards == 0 || (bt->standards & V4L2_DV_BT_STD_CVT)) { + struct v4l2_dv_timings cvt = {}; + if (v4l2_detect_cvt(total_v_lines, h_freq, bt->vsync, bt->width, - bt->polarities, bt->interlaced, timings)) + bt->polarities, bt->interlaced, + &vivid_dv_timings_cap, &cvt) && + cvt.bt.width == bt->width && cvt.bt.height == bt->height) { + *timings = cvt; return true; + } } if (bt->standards == 0 || (bt->standards & V4L2_DV_BT_STD_GTF)) { + struct v4l2_dv_timings gtf = {}; struct v4l2_fract aspect_ratio; find_aspect_ratio(bt->width, bt->height, @@ -1470,8 +1477,12 @@ static bool valid_cvt_gtf_timings(struct v4l2_dv_timings *timings) &aspect_ratio.denominator); if (v4l2_detect_gtf(total_v_lines, h_freq, bt->vsync, bt->polarities, bt->interlaced, - aspect_ratio, timings)) + aspect_ratio, &vivid_dv_timings_cap, + &gtf) && + gtf.bt.width == bt->width && gtf.bt.height == bt->height) { + *timings = gtf; return true; + } } return false; } diff --git a/drivers/media/v4l2-core/v4l2-dv-timings.c b/drivers/media/v4l2-core/v4l2-dv-timings.c index 39b5fc1807c4..d26edf157e64 100644 --- a/drivers/media/v4l2-core/v4l2-dv-timings.c +++ b/drivers/media/v4l2-core/v4l2-dv-timings.c @@ -481,25 +481,28 @@ EXPORT_SYMBOL_GPL(v4l2_calc_timeperframe); * @polarities - the horizontal and vertical polarities (same as struct * v4l2_bt_timings polarities). * @interlaced - if this flag is true, it indicates interlaced format - * @fmt - the resulting timings. + * @cap - the v4l2_dv_timings_cap capabilities. + * @timings - the resulting timings. * * This function will attempt to detect if the given values correspond to a * valid CVT format. If so, then it will return true, and fmt will be filled * in with the found CVT timings. */ -bool v4l2_detect_cvt(unsigned frame_height, - unsigned hfreq, - unsigned vsync, - unsigned active_width, +bool v4l2_detect_cvt(unsigned int frame_height, + unsigned int hfreq, + unsigned int vsync, + unsigned int active_width, u32 polarities, bool interlaced, - struct v4l2_dv_timings *fmt) + const struct v4l2_dv_timings_cap *cap, + struct v4l2_dv_timings *timings) { - int v_fp, v_bp, h_fp, h_bp, hsync; - int frame_width, image_height, image_width; + struct v4l2_dv_timings t = {}; + int v_fp, v_bp, h_fp, h_bp, hsync; + int frame_width, image_height, image_width; bool reduced_blanking; bool rb_v2 = false; - unsigned pix_clk; + unsigned int pix_clk; if (vsync < 4 || vsync > 8) return false; @@ -625,36 +628,39 @@ bool v4l2_detect_cvt(unsigned frame_height, h_fp = h_blank - hsync - h_bp; } - fmt->type = V4L2_DV_BT_656_1120; - fmt->bt.polarities = polarities; - fmt->bt.width = image_width; - fmt->bt.height = image_height; - fmt->bt.hfrontporch = h_fp; - fmt->bt.vfrontporch = v_fp; - fmt->bt.hsync = hsync; - fmt->bt.vsync = vsync; - fmt->bt.hbackporch = frame_width - image_width - h_fp - hsync; + t.type = V4L2_DV_BT_656_1120; + t.bt.polarities = polarities; + t.bt.width = image_width; + t.bt.height = image_height; + t.bt.hfrontporch = h_fp; + t.bt.vfrontporch = v_fp; + t.bt.hsync = hsync; + t.bt.vsync = vsync; + t.bt.hbackporch = frame_width - image_width - h_fp - hsync; if (!interlaced) { - fmt->bt.vbackporch = frame_height - image_height - v_fp - vsync; - fmt->bt.interlaced = V4L2_DV_PROGRESSIVE; + t.bt.vbackporch = frame_height - image_height - v_fp - vsync; + t.bt.interlaced = V4L2_DV_PROGRESSIVE; } else { - fmt->bt.vbackporch = (frame_height - image_height - 2 * v_fp - + t.bt.vbackporch = (frame_height - image_height - 2 * v_fp - 2 * vsync) / 2; - fmt->bt.il_vbackporch = frame_height - image_height - 2 * v_fp - - 2 * vsync - fmt->bt.vbackporch; - fmt->bt.il_vfrontporch = v_fp; - fmt->bt.il_vsync = vsync; - fmt->bt.flags |= V4L2_DV_FL_HALF_LINE; - fmt->bt.interlaced = V4L2_DV_INTERLACED; + t.bt.il_vbackporch = frame_height - image_height - 2 * v_fp - + 2 * vsync - t.bt.vbackporch; + t.bt.il_vfrontporch = v_fp; + t.bt.il_vsync = vsync; + t.bt.flags |= V4L2_DV_FL_HALF_LINE; + t.bt.interlaced = V4L2_DV_INTERLACED; } - fmt->bt.pixelclock = pix_clk; - fmt->bt.standards = V4L2_DV_BT_STD_CVT; + t.bt.pixelclock = pix_clk; + t.bt.standards = V4L2_DV_BT_STD_CVT; if (reduced_blanking) - fmt->bt.flags |= V4L2_DV_FL_REDUCED_BLANKING; + t.bt.flags |= V4L2_DV_FL_REDUCED_BLANKING; + if (!v4l2_valid_dv_timings(&t, cap, NULL, NULL)) + return false; + *timings = t; return true; } EXPORT_SYMBOL_GPL(v4l2_detect_cvt); @@ -699,22 +705,25 @@ EXPORT_SYMBOL_GPL(v4l2_detect_cvt); * image height, so it has to be passed explicitly. Usually * the native screen aspect ratio is used for this. If it * is not filled in correctly, then 16:9 will be assumed. - * @fmt - the resulting timings. + * @cap - the v4l2_dv_timings_cap capabilities. + * @timings - the resulting timings. * * This function will attempt to detect if the given values correspond to a * valid GTF format. If so, then it will return true, and fmt will be filled * in with the found GTF timings. */ -bool v4l2_detect_gtf(unsigned frame_height, - unsigned hfreq, - unsigned vsync, - u32 polarities, - bool interlaced, - struct v4l2_fract aspect, - struct v4l2_dv_timings *fmt) +bool v4l2_detect_gtf(unsigned int frame_height, + unsigned int hfreq, + unsigned int vsync, + u32 polarities, + bool interlaced, + struct v4l2_fract aspect, + const struct v4l2_dv_timings_cap *cap, + struct v4l2_dv_timings *timings) { + struct v4l2_dv_timings t = {}; int pix_clk; - int v_fp, v_bp, h_fp, hsync; + int v_fp, v_bp, h_fp, hsync; int frame_width, image_height, image_width; bool default_gtf; int h_blank; @@ -783,36 +792,39 @@ bool v4l2_detect_gtf(unsigned frame_height, h_fp = h_blank / 2 - hsync; - fmt->type = V4L2_DV_BT_656_1120; - fmt->bt.polarities = polarities; - fmt->bt.width = image_width; - fmt->bt.height = image_height; - fmt->bt.hfrontporch = h_fp; - fmt->bt.vfrontporch = v_fp; - fmt->bt.hsync = hsync; - fmt->bt.vsync = vsync; - fmt->bt.hbackporch = frame_width - image_width - h_fp - hsync; + t.type = V4L2_DV_BT_656_1120; + t.bt.polarities = polarities; + t.bt.width = image_width; + t.bt.height = image_height; + t.bt.hfrontporch = h_fp; + t.bt.vfrontporch = v_fp; + t.bt.hsync = hsync; + t.bt.vsync = vsync; + t.bt.hbackporch = frame_width - image_width - h_fp - hsync; if (!interlaced) { - fmt->bt.vbackporch = frame_height - image_height - v_fp - vsync; - fmt->bt.interlaced = V4L2_DV_PROGRESSIVE; + t.bt.vbackporch = frame_height - image_height - v_fp - vsync; + t.bt.interlaced = V4L2_DV_PROGRESSIVE; } else { - fmt->bt.vbackporch = (frame_height - image_height - 2 * v_fp - + t.bt.vbackporch = (frame_height - image_height - 2 * v_fp - 2 * vsync) / 2; - fmt->bt.il_vbackporch = frame_height - image_height - 2 * v_fp - - 2 * vsync - fmt->bt.vbackporch; - fmt->bt.il_vfrontporch = v_fp; - fmt->bt.il_vsync = vsync; - fmt->bt.flags |= V4L2_DV_FL_HALF_LINE; - fmt->bt.interlaced = V4L2_DV_INTERLACED; + t.bt.il_vbackporch = frame_height - image_height - 2 * v_fp - + 2 * vsync - t.bt.vbackporch; + t.bt.il_vfrontporch = v_fp; + t.bt.il_vsync = vsync; + t.bt.flags |= V4L2_DV_FL_HALF_LINE; + t.bt.interlaced = V4L2_DV_INTERLACED; } - fmt->bt.pixelclock = pix_clk; - fmt->bt.standards = V4L2_DV_BT_STD_GTF; + t.bt.pixelclock = pix_clk; + t.bt.standards = V4L2_DV_BT_STD_GTF; if (!default_gtf) - fmt->bt.flags |= V4L2_DV_FL_REDUCED_BLANKING; + t.bt.flags |= V4L2_DV_FL_REDUCED_BLANKING; + if (!v4l2_valid_dv_timings(&t, cap, NULL, NULL)) + return false; + *timings = t; return true; } EXPORT_SYMBOL_GPL(v4l2_detect_gtf); diff --git a/include/media/v4l2-dv-timings.h b/include/media/v4l2-dv-timings.h index 13830411bd6c..ff07dc6b103c 100644 --- a/include/media/v4l2-dv-timings.h +++ b/include/media/v4l2-dv-timings.h @@ -147,15 +147,18 @@ void v4l2_print_dv_timings(const char *dev_prefix, const char *prefix, * @polarities: the horizontal and vertical polarities (same as struct * v4l2_bt_timings polarities). * @interlaced: if this flag is true, it indicates interlaced format + * @cap: the v4l2_dv_timings_cap capabilities. * @fmt: the resulting timings. * * This function will attempt to detect if the given values correspond to a * valid CVT format. If so, then it will return true, and fmt will be filled * in with the found CVT timings. */ -bool v4l2_detect_cvt(unsigned frame_height, unsigned hfreq, unsigned vsync, - unsigned active_width, u32 polarities, bool interlaced, - struct v4l2_dv_timings *fmt); +bool v4l2_detect_cvt(unsigned int frame_height, unsigned int hfreq, + unsigned int vsync, unsigned int active_width, + u32 polarities, bool interlaced, + const struct v4l2_dv_timings_cap *cap, + struct v4l2_dv_timings *fmt); /** * v4l2_detect_gtf - detect if the given timings follow the GTF standard @@ -171,15 +174,18 @@ bool v4l2_detect_cvt(unsigned frame_height, unsigned hfreq, unsigned vsync, * image height, so it has to be passed explicitly. Usually * the native screen aspect ratio is used for this. If it * is not filled in correctly, then 16:9 will be assumed. + * @cap: the v4l2_dv_timings_cap capabilities. * @fmt: the resulting timings. * * This function will attempt to detect if the given values correspond to a * valid GTF format. If so, then it will return true, and fmt will be filled * in with the found GTF timings. */ -bool v4l2_detect_gtf(unsigned frame_height, unsigned hfreq, unsigned vsync, - u32 polarities, bool interlaced, struct v4l2_fract aspect, - struct v4l2_dv_timings *fmt); +bool v4l2_detect_gtf(unsigned int frame_height, unsigned int hfreq, + unsigned int vsync, u32 polarities, bool interlaced, + struct v4l2_fract aspect, + const struct v4l2_dv_timings_cap *cap, + struct v4l2_dv_timings *fmt); /** * v4l2_calc_aspect_ratio - calculate the aspect ratio based on bytes

5 months

1
0
0 0

FAILED: patch "[PATCH] media: v4l2-core: v4l2-dv-timings: check cvt/gtf result" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y git checkout FETCH_HEAD git cherry-pick -x 9f070b1862f3411b8bcdfd51a8eaad25286f9deb # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120328-shorts-twice-a92e@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 9f070b1862f3411b8bcdfd51a8eaad25286f9deb Mon Sep 17 00:00:00 2001 From: Hans Verkuil <hverkuil(a)xs4all.nl> Date: Mon, 14 Oct 2024 16:52:41 +0200 Subject: [PATCH] media: v4l2-core: v4l2-dv-timings: check cvt/gtf result The v4l2_detect_cvt/gtf functions should check the result against the timing capabilities: these functions calculate the timings, so if they are out of bounds, they should be rejected. To do this, add the struct v4l2_dv_timings_cap as argument to those functions. This required updates to the adv7604 and adv7842 drivers since the prototype of these functions has now changed. The timings struct that is passed to v4l2_detect_cvt/gtf in those two drivers is filled with the timings detected by the hardware. The vivid driver was also updated, but an additional check was added: the width and height specified by VIDIOC_S_DV_TIMINGS has to match the calculated result, otherwise something went wrong. Note that vivid *emulates* hardware, so all the values passed to the v4l2_detect_cvt/gtf functions came from the timings struct that was filled by userspace and passed on to the driver via VIDIOC_S_DV_TIMINGS. So these fields can contain random data. Both the constraints check via struct v4l2_dv_timings_cap and the additional width/height check ensure that the resulting timings are sane and not messed up by the v4l2_detect_cvt/gtf calculations. Signed-off-by: Hans Verkuil <hverkuil(a)xs4all.nl> Fixes: 2576415846bc ("[media] v4l2: move dv-timings related code to v4l2-dv-timings.c") Cc: stable(a)vger.kernel.org Reported-by: syzbot+a828133770f62293563e(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-media/000000000000013050062127830a@google.com/ diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c index 3184a2fa1532..4504909d95bc 100644 --- a/drivers/media/i2c/adv7604.c +++ b/drivers/media/i2c/adv7604.c @@ -1408,12 +1408,13 @@ static int stdi2dv_timings(struct v4l2_subdev *sd, if (v4l2_detect_cvt(stdi->lcf + 1, hfreq, stdi->lcvs, 0, (stdi->hs_pol == '+' ? V4L2_DV_HSYNC_POS_POL : 0) | (stdi->vs_pol == '+' ? V4L2_DV_VSYNC_POS_POL : 0), - false, timings)) + false, adv76xx_get_dv_timings_cap(sd, -1), timings)) return 0; if (v4l2_detect_gtf(stdi->lcf + 1, hfreq, stdi->lcvs, (stdi->hs_pol == '+' ? V4L2_DV_HSYNC_POS_POL : 0) | (stdi->vs_pol == '+' ? V4L2_DV_VSYNC_POS_POL : 0), - false, state->aspect_ratio, timings)) + false, state->aspect_ratio, + adv76xx_get_dv_timings_cap(sd, -1), timings)) return 0; v4l2_dbg(2, debug, sd, diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c index e445699da85b..3c9e613af0ce 100644 --- a/drivers/media/i2c/adv7842.c +++ b/drivers/media/i2c/adv7842.c @@ -1434,14 +1434,15 @@ static int stdi2dv_timings(struct v4l2_subdev *sd, } if (v4l2_detect_cvt(stdi->lcf + 1, hfreq, stdi->lcvs, 0, - (stdi->hs_pol == '+' ? V4L2_DV_HSYNC_POS_POL : 0) | - (stdi->vs_pol == '+' ? V4L2_DV_VSYNC_POS_POL : 0), - false, timings)) + (stdi->hs_pol == '+' ? V4L2_DV_HSYNC_POS_POL : 0) | + (stdi->vs_pol == '+' ? V4L2_DV_VSYNC_POS_POL : 0), + false, adv7842_get_dv_timings_cap(sd), timings)) return 0; if (v4l2_detect_gtf(stdi->lcf + 1, hfreq, stdi->lcvs, - (stdi->hs_pol == '+' ? V4L2_DV_HSYNC_POS_POL : 0) | - (stdi->vs_pol == '+' ? V4L2_DV_VSYNC_POS_POL : 0), - false, state->aspect_ratio, timings)) + (stdi->hs_pol == '+' ? V4L2_DV_HSYNC_POS_POL : 0) | + (stdi->vs_pol == '+' ? V4L2_DV_VSYNC_POS_POL : 0), + false, state->aspect_ratio, + adv7842_get_dv_timings_cap(sd), timings)) return 0; v4l2_dbg(2, debug, sd, diff --git a/drivers/media/test-drivers/vivid/vivid-vid-cap.c b/drivers/media/test-drivers/vivid/vivid-vid-cap.c index e74d73d370e0..ecff984e521c 100644 --- a/drivers/media/test-drivers/vivid/vivid-vid-cap.c +++ b/drivers/media/test-drivers/vivid/vivid-vid-cap.c @@ -1457,12 +1457,19 @@ static bool valid_cvt_gtf_timings(struct v4l2_dv_timings *timings) h_freq = (u32)bt->pixelclock / total_h_pixel; if (bt->standards == 0 || (bt->standards & V4L2_DV_BT_STD_CVT)) { + struct v4l2_dv_timings cvt = {}; + if (v4l2_detect_cvt(total_v_lines, h_freq, bt->vsync, bt->width, - bt->polarities, bt->interlaced, timings)) + bt->polarities, bt->interlaced, + &vivid_dv_timings_cap, &cvt) && + cvt.bt.width == bt->width && cvt.bt.height == bt->height) { + *timings = cvt; return true; + } } if (bt->standards == 0 || (bt->standards & V4L2_DV_BT_STD_GTF)) { + struct v4l2_dv_timings gtf = {}; struct v4l2_fract aspect_ratio; find_aspect_ratio(bt->width, bt->height, @@ -1470,8 +1477,12 @@ static bool valid_cvt_gtf_timings(struct v4l2_dv_timings *timings) &aspect_ratio.denominator); if (v4l2_detect_gtf(total_v_lines, h_freq, bt->vsync, bt->polarities, bt->interlaced, - aspect_ratio, timings)) + aspect_ratio, &vivid_dv_timings_cap, + &gtf) && + gtf.bt.width == bt->width && gtf.bt.height == bt->height) { + *timings = gtf; return true; + } } return false; } diff --git a/drivers/media/v4l2-core/v4l2-dv-timings.c b/drivers/media/v4l2-core/v4l2-dv-timings.c index 39b5fc1807c4..d26edf157e64 100644 --- a/drivers/media/v4l2-core/v4l2-dv-timings.c +++ b/drivers/media/v4l2-core/v4l2-dv-timings.c @@ -481,25 +481,28 @@ EXPORT_SYMBOL_GPL(v4l2_calc_timeperframe); * @polarities - the horizontal and vertical polarities (same as struct * v4l2_bt_timings polarities). * @interlaced - if this flag is true, it indicates interlaced format - * @fmt - the resulting timings. + * @cap - the v4l2_dv_timings_cap capabilities. + * @timings - the resulting timings. * * This function will attempt to detect if the given values correspond to a * valid CVT format. If so, then it will return true, and fmt will be filled * in with the found CVT timings. */ -bool v4l2_detect_cvt(unsigned frame_height, - unsigned hfreq, - unsigned vsync, - unsigned active_width, +bool v4l2_detect_cvt(unsigned int frame_height, + unsigned int hfreq, + unsigned int vsync, + unsigned int active_width, u32 polarities, bool interlaced, - struct v4l2_dv_timings *fmt) + const struct v4l2_dv_timings_cap *cap, + struct v4l2_dv_timings *timings) { - int v_fp, v_bp, h_fp, h_bp, hsync; - int frame_width, image_height, image_width; + struct v4l2_dv_timings t = {}; + int v_fp, v_bp, h_fp, h_bp, hsync; + int frame_width, image_height, image_width; bool reduced_blanking; bool rb_v2 = false; - unsigned pix_clk; + unsigned int pix_clk; if (vsync < 4 || vsync > 8) return false; @@ -625,36 +628,39 @@ bool v4l2_detect_cvt(unsigned frame_height, h_fp = h_blank - hsync - h_bp; } - fmt->type = V4L2_DV_BT_656_1120; - fmt->bt.polarities = polarities; - fmt->bt.width = image_width; - fmt->bt.height = image_height; - fmt->bt.hfrontporch = h_fp; - fmt->bt.vfrontporch = v_fp; - fmt->bt.hsync = hsync; - fmt->bt.vsync = vsync; - fmt->bt.hbackporch = frame_width - image_width - h_fp - hsync; + t.type = V4L2_DV_BT_656_1120; + t.bt.polarities = polarities; + t.bt.width = image_width; + t.bt.height = image_height; + t.bt.hfrontporch = h_fp; + t.bt.vfrontporch = v_fp; + t.bt.hsync = hsync; + t.bt.vsync = vsync; + t.bt.hbackporch = frame_width - image_width - h_fp - hsync; if (!interlaced) { - fmt->bt.vbackporch = frame_height - image_height - v_fp - vsync; - fmt->bt.interlaced = V4L2_DV_PROGRESSIVE; + t.bt.vbackporch = frame_height - image_height - v_fp - vsync; + t.bt.interlaced = V4L2_DV_PROGRESSIVE; } else { - fmt->bt.vbackporch = (frame_height - image_height - 2 * v_fp - + t.bt.vbackporch = (frame_height - image_height - 2 * v_fp - 2 * vsync) / 2; - fmt->bt.il_vbackporch = frame_height - image_height - 2 * v_fp - - 2 * vsync - fmt->bt.vbackporch; - fmt->bt.il_vfrontporch = v_fp; - fmt->bt.il_vsync = vsync; - fmt->bt.flags |= V4L2_DV_FL_HALF_LINE; - fmt->bt.interlaced = V4L2_DV_INTERLACED; + t.bt.il_vbackporch = frame_height - image_height - 2 * v_fp - + 2 * vsync - t.bt.vbackporch; + t.bt.il_vfrontporch = v_fp; + t.bt.il_vsync = vsync; + t.bt.flags |= V4L2_DV_FL_HALF_LINE; + t.bt.interlaced = V4L2_DV_INTERLACED; } - fmt->bt.pixelclock = pix_clk; - fmt->bt.standards = V4L2_DV_BT_STD_CVT; + t.bt.pixelclock = pix_clk; + t.bt.standards = V4L2_DV_BT_STD_CVT; if (reduced_blanking) - fmt->bt.flags |= V4L2_DV_FL_REDUCED_BLANKING; + t.bt.flags |= V4L2_DV_FL_REDUCED_BLANKING; + if (!v4l2_valid_dv_timings(&t, cap, NULL, NULL)) + return false; + *timings = t; return true; } EXPORT_SYMBOL_GPL(v4l2_detect_cvt); @@ -699,22 +705,25 @@ EXPORT_SYMBOL_GPL(v4l2_detect_cvt); * image height, so it has to be passed explicitly. Usually * the native screen aspect ratio is used for this. If it * is not filled in correctly, then 16:9 will be assumed. - * @fmt - the resulting timings. + * @cap - the v4l2_dv_timings_cap capabilities. + * @timings - the resulting timings. * * This function will attempt to detect if the given values correspond to a * valid GTF format. If so, then it will return true, and fmt will be filled * in with the found GTF timings. */ -bool v4l2_detect_gtf(unsigned frame_height, - unsigned hfreq, - unsigned vsync, - u32 polarities, - bool interlaced, - struct v4l2_fract aspect, - struct v4l2_dv_timings *fmt) +bool v4l2_detect_gtf(unsigned int frame_height, + unsigned int hfreq, + unsigned int vsync, + u32 polarities, + bool interlaced, + struct v4l2_fract aspect, + const struct v4l2_dv_timings_cap *cap, + struct v4l2_dv_timings *timings) { + struct v4l2_dv_timings t = {}; int pix_clk; - int v_fp, v_bp, h_fp, hsync; + int v_fp, v_bp, h_fp, hsync; int frame_width, image_height, image_width; bool default_gtf; int h_blank; @@ -783,36 +792,39 @@ bool v4l2_detect_gtf(unsigned frame_height, h_fp = h_blank / 2 - hsync; - fmt->type = V4L2_DV_BT_656_1120; - fmt->bt.polarities = polarities; - fmt->bt.width = image_width; - fmt->bt.height = image_height; - fmt->bt.hfrontporch = h_fp; - fmt->bt.vfrontporch = v_fp; - fmt->bt.hsync = hsync; - fmt->bt.vsync = vsync; - fmt->bt.hbackporch = frame_width - image_width - h_fp - hsync; + t.type = V4L2_DV_BT_656_1120; + t.bt.polarities = polarities; + t.bt.width = image_width; + t.bt.height = image_height; + t.bt.hfrontporch = h_fp; + t.bt.vfrontporch = v_fp; + t.bt.hsync = hsync; + t.bt.vsync = vsync; + t.bt.hbackporch = frame_width - image_width - h_fp - hsync; if (!interlaced) { - fmt->bt.vbackporch = frame_height - image_height - v_fp - vsync; - fmt->bt.interlaced = V4L2_DV_PROGRESSIVE; + t.bt.vbackporch = frame_height - image_height - v_fp - vsync; + t.bt.interlaced = V4L2_DV_PROGRESSIVE; } else { - fmt->bt.vbackporch = (frame_height - image_height - 2 * v_fp - + t.bt.vbackporch = (frame_height - image_height - 2 * v_fp - 2 * vsync) / 2; - fmt->bt.il_vbackporch = frame_height - image_height - 2 * v_fp - - 2 * vsync - fmt->bt.vbackporch; - fmt->bt.il_vfrontporch = v_fp; - fmt->bt.il_vsync = vsync; - fmt->bt.flags |= V4L2_DV_FL_HALF_LINE; - fmt->bt.interlaced = V4L2_DV_INTERLACED; + t.bt.il_vbackporch = frame_height - image_height - 2 * v_fp - + 2 * vsync - t.bt.vbackporch; + t.bt.il_vfrontporch = v_fp; + t.bt.il_vsync = vsync; + t.bt.flags |= V4L2_DV_FL_HALF_LINE; + t.bt.interlaced = V4L2_DV_INTERLACED; } - fmt->bt.pixelclock = pix_clk; - fmt->bt.standards = V4L2_DV_BT_STD_GTF; + t.bt.pixelclock = pix_clk; + t.bt.standards = V4L2_DV_BT_STD_GTF; if (!default_gtf) - fmt->bt.flags |= V4L2_DV_FL_REDUCED_BLANKING; + t.bt.flags |= V4L2_DV_FL_REDUCED_BLANKING; + if (!v4l2_valid_dv_timings(&t, cap, NULL, NULL)) + return false; + *timings = t; return true; } EXPORT_SYMBOL_GPL(v4l2_detect_gtf); diff --git a/include/media/v4l2-dv-timings.h b/include/media/v4l2-dv-timings.h index 13830411bd6c..ff07dc6b103c 100644 --- a/include/media/v4l2-dv-timings.h +++ b/include/media/v4l2-dv-timings.h @@ -147,15 +147,18 @@ void v4l2_print_dv_timings(const char *dev_prefix, const char *prefix, * @polarities: the horizontal and vertical polarities (same as struct * v4l2_bt_timings polarities). * @interlaced: if this flag is true, it indicates interlaced format + * @cap: the v4l2_dv_timings_cap capabilities. * @fmt: the resulting timings. * * This function will attempt to detect if the given values correspond to a * valid CVT format. If so, then it will return true, and fmt will be filled * in with the found CVT timings. */ -bool v4l2_detect_cvt(unsigned frame_height, unsigned hfreq, unsigned vsync, - unsigned active_width, u32 polarities, bool interlaced, - struct v4l2_dv_timings *fmt); +bool v4l2_detect_cvt(unsigned int frame_height, unsigned int hfreq, + unsigned int vsync, unsigned int active_width, + u32 polarities, bool interlaced, + const struct v4l2_dv_timings_cap *cap, + struct v4l2_dv_timings *fmt); /** * v4l2_detect_gtf - detect if the given timings follow the GTF standard @@ -171,15 +174,18 @@ bool v4l2_detect_cvt(unsigned frame_height, unsigned hfreq, unsigned vsync, * image height, so it has to be passed explicitly. Usually * the native screen aspect ratio is used for this. If it * is not filled in correctly, then 16:9 will be assumed. + * @cap: the v4l2_dv_timings_cap capabilities. * @fmt: the resulting timings. * * This function will attempt to detect if the given values correspond to a * valid GTF format. If so, then it will return true, and fmt will be filled * in with the found GTF timings. */ -bool v4l2_detect_gtf(unsigned frame_height, unsigned hfreq, unsigned vsync, - u32 polarities, bool interlaced, struct v4l2_fract aspect, - struct v4l2_dv_timings *fmt); +bool v4l2_detect_gtf(unsigned int frame_height, unsigned int hfreq, + unsigned int vsync, u32 polarities, bool interlaced, + struct v4l2_fract aspect, + const struct v4l2_dv_timings_cap *cap, + struct v4l2_dv_timings *fmt); /** * v4l2_calc_aspect_ratio - calculate the aspect ratio based on bytes

5 months

1
0
0 0

FAILED: patch "[PATCH] soc: fsl: cpm1: qmc: Set the ret error code on" failed to apply to 6.6-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.6-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y git checkout FETCH_HEAD git cherry-pick -x cb3daa51db819a172e9524e96e2ed96b4237e51a # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120331-disarm-unfixed-bbec@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From cb3daa51db819a172e9524e96e2ed96b4237e51a Mon Sep 17 00:00:00 2001 From: Herve Codina <herve.codina(a)bootlin.com> Date: Tue, 5 Nov 2024 15:56:23 +0100 Subject: [PATCH] soc: fsl: cpm1: qmc: Set the ret error code on platform_get_irq() failure A kernel test robot detected a missing error code: qmc.c:1942 qmc_probe() warn: missing error code 'ret' Indeed, the error returned by platform_get_irq() is checked and the operation is aborted in case of failure but the ret error code is not set in that case. Set the ret error code. Reported-by: kernel test robot <lkp(a)intel.com> Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/r/202411051350.KNy6ZIWA-lkp@intel.com/ Fixes: 3178d58e0b97 ("soc: fsl: cpm1: Add support for QMC") Cc: stable(a)vger.kernel.org Signed-off-by: Herve Codina <herve.codina(a)bootlin.com> Link: https://lore.kernel.org/r/20241105145623.401528-1-herve.codina@bootlin.com Signed-off-by: Christophe Leroy <christophe.leroy(a)csgroup.eu> diff --git a/drivers/soc/fsl/qe/qmc.c b/drivers/soc/fsl/qe/qmc.c index 3dffebb48b0d..fa7dc7d4abf3 100644 --- a/drivers/soc/fsl/qe/qmc.c +++ b/drivers/soc/fsl/qe/qmc.c @@ -2005,8 +2005,10 @@ static int qmc_probe(struct platform_device *pdev) /* Set the irq handler */ irq = platform_get_irq(pdev, 0); - if (irq < 0) + if (irq < 0) { + ret = irq; goto err_exit_xcc; + } ret = devm_request_irq(qmc->dev, irq, qmc_irq_handler, 0, "qmc", qmc); if (ret < 0) goto err_exit_xcc;

5 months

1
0
0 0

FAILED: patch "[PATCH] soc: fsl: cpm1: qmc: Set the ret error code on" failed to apply to 6.11-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.11-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.11.y git checkout FETCH_HEAD git cherry-pick -x cb3daa51db819a172e9524e96e2ed96b4237e51a # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120330-purifier-maturely-c720@gregkh' --subject-prefix 'PATCH 6.11.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From cb3daa51db819a172e9524e96e2ed96b4237e51a Mon Sep 17 00:00:00 2001 From: Herve Codina <herve.codina(a)bootlin.com> Date: Tue, 5 Nov 2024 15:56:23 +0100 Subject: [PATCH] soc: fsl: cpm1: qmc: Set the ret error code on platform_get_irq() failure A kernel test robot detected a missing error code: qmc.c:1942 qmc_probe() warn: missing error code 'ret' Indeed, the error returned by platform_get_irq() is checked and the operation is aborted in case of failure but the ret error code is not set in that case. Set the ret error code. Reported-by: kernel test robot <lkp(a)intel.com> Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/r/202411051350.KNy6ZIWA-lkp@intel.com/ Fixes: 3178d58e0b97 ("soc: fsl: cpm1: Add support for QMC") Cc: stable(a)vger.kernel.org Signed-off-by: Herve Codina <herve.codina(a)bootlin.com> Link: https://lore.kernel.org/r/20241105145623.401528-1-herve.codina@bootlin.com Signed-off-by: Christophe Leroy <christophe.leroy(a)csgroup.eu> diff --git a/drivers/soc/fsl/qe/qmc.c b/drivers/soc/fsl/qe/qmc.c index 3dffebb48b0d..fa7dc7d4abf3 100644 --- a/drivers/soc/fsl/qe/qmc.c +++ b/drivers/soc/fsl/qe/qmc.c @@ -2005,8 +2005,10 @@ static int qmc_probe(struct platform_device *pdev) /* Set the irq handler */ irq = platform_get_irq(pdev, 0); - if (irq < 0) + if (irq < 0) { + ret = irq; goto err_exit_xcc; + } ret = devm_request_irq(qmc->dev, irq, qmc_irq_handler, 0, "qmc", qmc); if (ret < 0) goto err_exit_xcc;

5 months

1
0
0 0

FAILED: patch "[PATCH] block: fix ordering between checking QUEUE_FLAG_QUIESCED" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y git checkout FETCH_HEAD git cherry-pick -x 6bda857bcbb86fb9d0e54fbef93a093d51172acc # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120344-onshore-retrain-f7ee@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 6bda857bcbb86fb9d0e54fbef93a093d51172acc Mon Sep 17 00:00:00 2001 From: Muchun Song <muchun.song(a)linux.dev> Date: Mon, 14 Oct 2024 17:29:33 +0800 Subject: [PATCH] block: fix ordering between checking QUEUE_FLAG_QUIESCED request adding Supposing the following scenario. CPU0 CPU1 blk_mq_insert_request() 1) store blk_mq_unquiesce_queue() blk_queue_flag_clear() 3) store blk_mq_run_hw_queues() blk_mq_run_hw_queue() if (!blk_mq_hctx_has_pending()) 4) load return blk_mq_run_hw_queue() if (blk_queue_quiesced()) 2) load return blk_mq_sched_dispatch_requests() The full memory barrier should be inserted between 1) and 2), as well as between 3) and 4) to make sure that either CPU0 sees QUEUE_FLAG_QUIESCED is cleared or CPU1 sees dispatch list or setting of bitmap of software queue. Otherwise, either CPU will not rerun the hardware queue causing starvation. So the first solution is to 1) add a pair of memory barrier to fix the problem, another solution is to 2) use hctx->queue->queue_lock to synchronize QUEUE_FLAG_QUIESCED. Here, we chose 2) to fix it since memory barrier is not easy to be maintained. Fixes: f4560ffe8cec ("blk-mq: use QUEUE_FLAG_QUIESCED to quiesce queue") Cc: stable(a)vger.kernel.org Cc: Muchun Song <muchun.song(a)linux.dev> Signed-off-by: Muchun Song <songmuchun(a)bytedance.com> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Link: https://lore.kernel.org/r/20241014092934.53630-3-songmuchun@bytedance.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> diff --git a/block/blk-mq.c b/block/blk-mq.c index 5deb9dffca0a..bb4ee2380dce 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2227,6 +2227,24 @@ void blk_mq_delay_run_hw_queue(struct blk_mq_hw_ctx *hctx, unsigned long msecs) } EXPORT_SYMBOL(blk_mq_delay_run_hw_queue); +static inline bool blk_mq_hw_queue_need_run(struct blk_mq_hw_ctx *hctx) +{ + bool need_run; + + /* + * When queue is quiesced, we may be switching io scheduler, or + * updating nr_hw_queues, or other things, and we can't run queue + * any more, even blk_mq_hctx_has_pending() can't be called safely. + * + * And queue will be rerun in blk_mq_unquiesce_queue() if it is + * quiesced. + */ + __blk_mq_run_dispatch_ops(hctx->queue, false, + need_run = !blk_queue_quiesced(hctx->queue) && + blk_mq_hctx_has_pending(hctx)); + return need_run; +} + /** * blk_mq_run_hw_queue - Start to run a hardware queue. * @hctx: Pointer to the hardware queue to run. @@ -2247,20 +2265,23 @@ void blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async) might_sleep_if(!async && hctx->flags & BLK_MQ_F_BLOCKING); - /* - * When queue is quiesced, we may be switching io scheduler, or - * updating nr_hw_queues, or other things, and we can't run queue - * any more, even __blk_mq_hctx_has_pending() can't be called safely. - * - * And queue will be rerun in blk_mq_unquiesce_queue() if it is - * quiesced. - */ - __blk_mq_run_dispatch_ops(hctx->queue, false, - need_run = !blk_queue_quiesced(hctx->queue) && - blk_mq_hctx_has_pending(hctx)); + need_run = blk_mq_hw_queue_need_run(hctx); + if (!need_run) { + unsigned long flags; - if (!need_run) - return; + /* + * Synchronize with blk_mq_unquiesce_queue(), because we check + * if hw queue is quiesced locklessly above, we need the use + * ->queue_lock to make sure we see the up-to-date status to + * not miss rerunning the hw queue. + */ + spin_lock_irqsave(&hctx->queue->queue_lock, flags); + need_run = blk_mq_hw_queue_need_run(hctx); + spin_unlock_irqrestore(&hctx->queue->queue_lock, flags); + + if (!need_run) + return; + } if (async || !cpumask_test_cpu(raw_smp_processor_id(), hctx->cpumask)) { blk_mq_delay_run_hw_queue(hctx, 0);

5 months

1
0
0 0

FAILED: patch "[PATCH] block: fix ordering between checking QUEUE_FLAG_QUIESCED" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x 6bda857bcbb86fb9d0e54fbef93a093d51172acc # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120343-express-overbuilt-6478@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 6bda857bcbb86fb9d0e54fbef93a093d51172acc Mon Sep 17 00:00:00 2001 From: Muchun Song <muchun.song(a)linux.dev> Date: Mon, 14 Oct 2024 17:29:33 +0800 Subject: [PATCH] block: fix ordering between checking QUEUE_FLAG_QUIESCED request adding Supposing the following scenario. CPU0 CPU1 blk_mq_insert_request() 1) store blk_mq_unquiesce_queue() blk_queue_flag_clear() 3) store blk_mq_run_hw_queues() blk_mq_run_hw_queue() if (!blk_mq_hctx_has_pending()) 4) load return blk_mq_run_hw_queue() if (blk_queue_quiesced()) 2) load return blk_mq_sched_dispatch_requests() The full memory barrier should be inserted between 1) and 2), as well as between 3) and 4) to make sure that either CPU0 sees QUEUE_FLAG_QUIESCED is cleared or CPU1 sees dispatch list or setting of bitmap of software queue. Otherwise, either CPU will not rerun the hardware queue causing starvation. So the first solution is to 1) add a pair of memory barrier to fix the problem, another solution is to 2) use hctx->queue->queue_lock to synchronize QUEUE_FLAG_QUIESCED. Here, we chose 2) to fix it since memory barrier is not easy to be maintained. Fixes: f4560ffe8cec ("blk-mq: use QUEUE_FLAG_QUIESCED to quiesce queue") Cc: stable(a)vger.kernel.org Cc: Muchun Song <muchun.song(a)linux.dev> Signed-off-by: Muchun Song <songmuchun(a)bytedance.com> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Link: https://lore.kernel.org/r/20241014092934.53630-3-songmuchun@bytedance.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> diff --git a/block/blk-mq.c b/block/blk-mq.c index 5deb9dffca0a..bb4ee2380dce 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2227,6 +2227,24 @@ void blk_mq_delay_run_hw_queue(struct blk_mq_hw_ctx *hctx, unsigned long msecs) } EXPORT_SYMBOL(blk_mq_delay_run_hw_queue); +static inline bool blk_mq_hw_queue_need_run(struct blk_mq_hw_ctx *hctx) +{ + bool need_run; + + /* + * When queue is quiesced, we may be switching io scheduler, or + * updating nr_hw_queues, or other things, and we can't run queue + * any more, even blk_mq_hctx_has_pending() can't be called safely. + * + * And queue will be rerun in blk_mq_unquiesce_queue() if it is + * quiesced. + */ + __blk_mq_run_dispatch_ops(hctx->queue, false, + need_run = !blk_queue_quiesced(hctx->queue) && + blk_mq_hctx_has_pending(hctx)); + return need_run; +} + /** * blk_mq_run_hw_queue - Start to run a hardware queue. * @hctx: Pointer to the hardware queue to run. @@ -2247,20 +2265,23 @@ void blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async) might_sleep_if(!async && hctx->flags & BLK_MQ_F_BLOCKING); - /* - * When queue is quiesced, we may be switching io scheduler, or - * updating nr_hw_queues, or other things, and we can't run queue - * any more, even __blk_mq_hctx_has_pending() can't be called safely. - * - * And queue will be rerun in blk_mq_unquiesce_queue() if it is - * quiesced. - */ - __blk_mq_run_dispatch_ops(hctx->queue, false, - need_run = !blk_queue_quiesced(hctx->queue) && - blk_mq_hctx_has_pending(hctx)); + need_run = blk_mq_hw_queue_need_run(hctx); + if (!need_run) { + unsigned long flags; - if (!need_run) - return; + /* + * Synchronize with blk_mq_unquiesce_queue(), because we check + * if hw queue is quiesced locklessly above, we need the use + * ->queue_lock to make sure we see the up-to-date status to + * not miss rerunning the hw queue. + */ + spin_lock_irqsave(&hctx->queue->queue_lock, flags); + need_run = blk_mq_hw_queue_need_run(hctx); + spin_unlock_irqrestore(&hctx->queue->queue_lock, flags); + + if (!need_run) + return; + } if (async || !cpumask_test_cpu(raw_smp_processor_id(), hctx->cpumask)) { blk_mq_delay_run_hw_queue(hctx, 0);

5 months

1
0
0 0

FAILED: patch "[PATCH] block: fix ordering between checking QUEUE_FLAG_QUIESCED" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 6bda857bcbb86fb9d0e54fbef93a093d51172acc # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120343-livable-euphemism-b28b@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 6bda857bcbb86fb9d0e54fbef93a093d51172acc Mon Sep 17 00:00:00 2001 From: Muchun Song <muchun.song(a)linux.dev> Date: Mon, 14 Oct 2024 17:29:33 +0800 Subject: [PATCH] block: fix ordering between checking QUEUE_FLAG_QUIESCED request adding Supposing the following scenario. CPU0 CPU1 blk_mq_insert_request() 1) store blk_mq_unquiesce_queue() blk_queue_flag_clear() 3) store blk_mq_run_hw_queues() blk_mq_run_hw_queue() if (!blk_mq_hctx_has_pending()) 4) load return blk_mq_run_hw_queue() if (blk_queue_quiesced()) 2) load return blk_mq_sched_dispatch_requests() The full memory barrier should be inserted between 1) and 2), as well as between 3) and 4) to make sure that either CPU0 sees QUEUE_FLAG_QUIESCED is cleared or CPU1 sees dispatch list or setting of bitmap of software queue. Otherwise, either CPU will not rerun the hardware queue causing starvation. So the first solution is to 1) add a pair of memory barrier to fix the problem, another solution is to 2) use hctx->queue->queue_lock to synchronize QUEUE_FLAG_QUIESCED. Here, we chose 2) to fix it since memory barrier is not easy to be maintained. Fixes: f4560ffe8cec ("blk-mq: use QUEUE_FLAG_QUIESCED to quiesce queue") Cc: stable(a)vger.kernel.org Cc: Muchun Song <muchun.song(a)linux.dev> Signed-off-by: Muchun Song <songmuchun(a)bytedance.com> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Link: https://lore.kernel.org/r/20241014092934.53630-3-songmuchun@bytedance.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> diff --git a/block/blk-mq.c b/block/blk-mq.c index 5deb9dffca0a..bb4ee2380dce 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2227,6 +2227,24 @@ void blk_mq_delay_run_hw_queue(struct blk_mq_hw_ctx *hctx, unsigned long msecs) } EXPORT_SYMBOL(blk_mq_delay_run_hw_queue); +static inline bool blk_mq_hw_queue_need_run(struct blk_mq_hw_ctx *hctx) +{ + bool need_run; + + /* + * When queue is quiesced, we may be switching io scheduler, or + * updating nr_hw_queues, or other things, and we can't run queue + * any more, even blk_mq_hctx_has_pending() can't be called safely. + * + * And queue will be rerun in blk_mq_unquiesce_queue() if it is + * quiesced. + */ + __blk_mq_run_dispatch_ops(hctx->queue, false, + need_run = !blk_queue_quiesced(hctx->queue) && + blk_mq_hctx_has_pending(hctx)); + return need_run; +} + /** * blk_mq_run_hw_queue - Start to run a hardware queue. * @hctx: Pointer to the hardware queue to run. @@ -2247,20 +2265,23 @@ void blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async) might_sleep_if(!async && hctx->flags & BLK_MQ_F_BLOCKING); - /* - * When queue is quiesced, we may be switching io scheduler, or - * updating nr_hw_queues, or other things, and we can't run queue - * any more, even __blk_mq_hctx_has_pending() can't be called safely. - * - * And queue will be rerun in blk_mq_unquiesce_queue() if it is - * quiesced. - */ - __blk_mq_run_dispatch_ops(hctx->queue, false, - need_run = !blk_queue_quiesced(hctx->queue) && - blk_mq_hctx_has_pending(hctx)); + need_run = blk_mq_hw_queue_need_run(hctx); + if (!need_run) { + unsigned long flags; - if (!need_run) - return; + /* + * Synchronize with blk_mq_unquiesce_queue(), because we check + * if hw queue is quiesced locklessly above, we need the use + * ->queue_lock to make sure we see the up-to-date status to + * not miss rerunning the hw queue. + */ + spin_lock_irqsave(&hctx->queue->queue_lock, flags); + need_run = blk_mq_hw_queue_need_run(hctx); + spin_unlock_irqrestore(&hctx->queue->queue_lock, flags); + + if (!need_run) + return; + } if (async || !cpumask_test_cpu(raw_smp_processor_id(), hctx->cpumask)) { blk_mq_delay_run_hw_queue(hctx, 0);

5 months

1
0
0 0

FAILED: patch "[PATCH] block: fix ordering between checking QUEUE_FLAG_QUIESCED" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 6bda857bcbb86fb9d0e54fbef93a093d51172acc # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120341-stray-sinner-8eb4@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 6bda857bcbb86fb9d0e54fbef93a093d51172acc Mon Sep 17 00:00:00 2001 From: Muchun Song <muchun.song(a)linux.dev> Date: Mon, 14 Oct 2024 17:29:33 +0800 Subject: [PATCH] block: fix ordering between checking QUEUE_FLAG_QUIESCED request adding Supposing the following scenario. CPU0 CPU1 blk_mq_insert_request() 1) store blk_mq_unquiesce_queue() blk_queue_flag_clear() 3) store blk_mq_run_hw_queues() blk_mq_run_hw_queue() if (!blk_mq_hctx_has_pending()) 4) load return blk_mq_run_hw_queue() if (blk_queue_quiesced()) 2) load return blk_mq_sched_dispatch_requests() The full memory barrier should be inserted between 1) and 2), as well as between 3) and 4) to make sure that either CPU0 sees QUEUE_FLAG_QUIESCED is cleared or CPU1 sees dispatch list or setting of bitmap of software queue. Otherwise, either CPU will not rerun the hardware queue causing starvation. So the first solution is to 1) add a pair of memory barrier to fix the problem, another solution is to 2) use hctx->queue->queue_lock to synchronize QUEUE_FLAG_QUIESCED. Here, we chose 2) to fix it since memory barrier is not easy to be maintained. Fixes: f4560ffe8cec ("blk-mq: use QUEUE_FLAG_QUIESCED to quiesce queue") Cc: stable(a)vger.kernel.org Cc: Muchun Song <muchun.song(a)linux.dev> Signed-off-by: Muchun Song <songmuchun(a)bytedance.com> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Link: https://lore.kernel.org/r/20241014092934.53630-3-songmuchun@bytedance.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> diff --git a/block/blk-mq.c b/block/blk-mq.c index 5deb9dffca0a..bb4ee2380dce 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2227,6 +2227,24 @@ void blk_mq_delay_run_hw_queue(struct blk_mq_hw_ctx *hctx, unsigned long msecs) } EXPORT_SYMBOL(blk_mq_delay_run_hw_queue); +static inline bool blk_mq_hw_queue_need_run(struct blk_mq_hw_ctx *hctx) +{ + bool need_run; + + /* + * When queue is quiesced, we may be switching io scheduler, or + * updating nr_hw_queues, or other things, and we can't run queue + * any more, even blk_mq_hctx_has_pending() can't be called safely. + * + * And queue will be rerun in blk_mq_unquiesce_queue() if it is + * quiesced. + */ + __blk_mq_run_dispatch_ops(hctx->queue, false, + need_run = !blk_queue_quiesced(hctx->queue) && + blk_mq_hctx_has_pending(hctx)); + return need_run; +} + /** * blk_mq_run_hw_queue - Start to run a hardware queue. * @hctx: Pointer to the hardware queue to run. @@ -2247,20 +2265,23 @@ void blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async) might_sleep_if(!async && hctx->flags & BLK_MQ_F_BLOCKING); - /* - * When queue is quiesced, we may be switching io scheduler, or - * updating nr_hw_queues, or other things, and we can't run queue - * any more, even __blk_mq_hctx_has_pending() can't be called safely. - * - * And queue will be rerun in blk_mq_unquiesce_queue() if it is - * quiesced. - */ - __blk_mq_run_dispatch_ops(hctx->queue, false, - need_run = !blk_queue_quiesced(hctx->queue) && - blk_mq_hctx_has_pending(hctx)); + need_run = blk_mq_hw_queue_need_run(hctx); + if (!need_run) { + unsigned long flags; - if (!need_run) - return; + /* + * Synchronize with blk_mq_unquiesce_queue(), because we check + * if hw queue is quiesced locklessly above, we need the use + * ->queue_lock to make sure we see the up-to-date status to + * not miss rerunning the hw queue. + */ + spin_lock_irqsave(&hctx->queue->queue_lock, flags); + need_run = blk_mq_hw_queue_need_run(hctx); + spin_unlock_irqrestore(&hctx->queue->queue_lock, flags); + + if (!need_run) + return; + } if (async || !cpumask_test_cpu(raw_smp_processor_id(), hctx->cpumask)) { blk_mq_delay_run_hw_queue(hctx, 0);

5 months

1
0
0 0

FAILED: patch "[PATCH] block: fix missing dispatching request when queue is started" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y git checkout FETCH_HEAD git cherry-pick -x 2003ee8a9aa14d766b06088156978d53c2e9be3d # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120326-hedging-banker-f8bd@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 2003ee8a9aa14d766b06088156978d53c2e9be3d Mon Sep 17 00:00:00 2001 From: Muchun Song <muchun.song(a)linux.dev> Date: Mon, 14 Oct 2024 17:29:32 +0800 Subject: [PATCH] block: fix missing dispatching request when queue is started or unquiesced Supposing the following scenario with a virtio_blk driver. CPU0 CPU1 CPU2 blk_mq_try_issue_directly() __blk_mq_issue_directly() q->mq_ops->queue_rq() virtio_queue_rq() blk_mq_stop_hw_queue() virtblk_done() blk_mq_try_issue_directly() if (blk_mq_hctx_stopped()) blk_mq_request_bypass_insert() blk_mq_run_hw_queue() blk_mq_run_hw_queue() blk_mq_run_hw_queue() blk_mq_insert_request() return After CPU0 has marked the queue as stopped, CPU1 will see the queue is stopped. But before CPU1 puts the request on the dispatch list, CPU2 receives the interrupt of completion of request, so it will run the hardware queue and marks the queue as non-stopped. Meanwhile, CPU1 also runs the same hardware queue. After both CPU1 and CPU2 complete blk_mq_run_hw_queue(), CPU1 just puts the request to the same hardware queue and returns. It misses dispatching a request. Fix it by running the hardware queue explicitly. And blk_mq_request_issue_directly() should handle a similar situation. Fix it as well. Fixes: d964f04a8fde ("blk-mq: fix direct issue") Cc: stable(a)vger.kernel.org Cc: Muchun Song <muchun.song(a)linux.dev> Signed-off-by: Muchun Song <songmuchun(a)bytedance.com> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Link: https://lore.kernel.org/r/20241014092934.53630-2-songmuchun@bytedance.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> diff --git a/block/blk-mq.c b/block/blk-mq.c index 7d05a56e3639..5deb9dffca0a 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2647,6 +2647,7 @@ static void blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx, if (blk_mq_hctx_stopped(hctx) || blk_queue_quiesced(rq->q)) { blk_mq_insert_request(rq, 0); + blk_mq_run_hw_queue(hctx, false); return; } @@ -2677,6 +2678,7 @@ static blk_status_t blk_mq_request_issue_directly(struct request *rq, bool last) if (blk_mq_hctx_stopped(hctx) || blk_queue_quiesced(rq->q)) { blk_mq_insert_request(rq, 0); + blk_mq_run_hw_queue(hctx, false); return BLK_STS_OK; }

5 months

1
0
0 0

FAILED: patch "[PATCH] block: fix missing dispatching request when queue is started" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x 2003ee8a9aa14d766b06088156978d53c2e9be3d # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120325-botanical-radish-48b4@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 2003ee8a9aa14d766b06088156978d53c2e9be3d Mon Sep 17 00:00:00 2001 From: Muchun Song <muchun.song(a)linux.dev> Date: Mon, 14 Oct 2024 17:29:32 +0800 Subject: [PATCH] block: fix missing dispatching request when queue is started or unquiesced Supposing the following scenario with a virtio_blk driver. CPU0 CPU1 CPU2 blk_mq_try_issue_directly() __blk_mq_issue_directly() q->mq_ops->queue_rq() virtio_queue_rq() blk_mq_stop_hw_queue() virtblk_done() blk_mq_try_issue_directly() if (blk_mq_hctx_stopped()) blk_mq_request_bypass_insert() blk_mq_run_hw_queue() blk_mq_run_hw_queue() blk_mq_run_hw_queue() blk_mq_insert_request() return After CPU0 has marked the queue as stopped, CPU1 will see the queue is stopped. But before CPU1 puts the request on the dispatch list, CPU2 receives the interrupt of completion of request, so it will run the hardware queue and marks the queue as non-stopped. Meanwhile, CPU1 also runs the same hardware queue. After both CPU1 and CPU2 complete blk_mq_run_hw_queue(), CPU1 just puts the request to the same hardware queue and returns. It misses dispatching a request. Fix it by running the hardware queue explicitly. And blk_mq_request_issue_directly() should handle a similar situation. Fix it as well. Fixes: d964f04a8fde ("blk-mq: fix direct issue") Cc: stable(a)vger.kernel.org Cc: Muchun Song <muchun.song(a)linux.dev> Signed-off-by: Muchun Song <songmuchun(a)bytedance.com> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Link: https://lore.kernel.org/r/20241014092934.53630-2-songmuchun@bytedance.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> diff --git a/block/blk-mq.c b/block/blk-mq.c index 7d05a56e3639..5deb9dffca0a 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2647,6 +2647,7 @@ static void blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx, if (blk_mq_hctx_stopped(hctx) || blk_queue_quiesced(rq->q)) { blk_mq_insert_request(rq, 0); + blk_mq_run_hw_queue(hctx, false); return; } @@ -2677,6 +2678,7 @@ static blk_status_t blk_mq_request_issue_directly(struct request *rq, bool last) if (blk_mq_hctx_stopped(hctx) || blk_queue_quiesced(rq->q)) { blk_mq_insert_request(rq, 0); + blk_mq_run_hw_queue(hctx, false); return BLK_STS_OK; }

5 months

1
0
0 0

FAILED: patch "[PATCH] block: fix missing dispatching request when queue is started" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 2003ee8a9aa14d766b06088156978d53c2e9be3d # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120324-eating-amid-74df@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 2003ee8a9aa14d766b06088156978d53c2e9be3d Mon Sep 17 00:00:00 2001 From: Muchun Song <muchun.song(a)linux.dev> Date: Mon, 14 Oct 2024 17:29:32 +0800 Subject: [PATCH] block: fix missing dispatching request when queue is started or unquiesced Supposing the following scenario with a virtio_blk driver. CPU0 CPU1 CPU2 blk_mq_try_issue_directly() __blk_mq_issue_directly() q->mq_ops->queue_rq() virtio_queue_rq() blk_mq_stop_hw_queue() virtblk_done() blk_mq_try_issue_directly() if (blk_mq_hctx_stopped()) blk_mq_request_bypass_insert() blk_mq_run_hw_queue() blk_mq_run_hw_queue() blk_mq_run_hw_queue() blk_mq_insert_request() return After CPU0 has marked the queue as stopped, CPU1 will see the queue is stopped. But before CPU1 puts the request on the dispatch list, CPU2 receives the interrupt of completion of request, so it will run the hardware queue and marks the queue as non-stopped. Meanwhile, CPU1 also runs the same hardware queue. After both CPU1 and CPU2 complete blk_mq_run_hw_queue(), CPU1 just puts the request to the same hardware queue and returns. It misses dispatching a request. Fix it by running the hardware queue explicitly. And blk_mq_request_issue_directly() should handle a similar situation. Fix it as well. Fixes: d964f04a8fde ("blk-mq: fix direct issue") Cc: stable(a)vger.kernel.org Cc: Muchun Song <muchun.song(a)linux.dev> Signed-off-by: Muchun Song <songmuchun(a)bytedance.com> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Link: https://lore.kernel.org/r/20241014092934.53630-2-songmuchun@bytedance.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> diff --git a/block/blk-mq.c b/block/blk-mq.c index 7d05a56e3639..5deb9dffca0a 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2647,6 +2647,7 @@ static void blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx, if (blk_mq_hctx_stopped(hctx) || blk_queue_quiesced(rq->q)) { blk_mq_insert_request(rq, 0); + blk_mq_run_hw_queue(hctx, false); return; } @@ -2677,6 +2678,7 @@ static blk_status_t blk_mq_request_issue_directly(struct request *rq, bool last) if (blk_mq_hctx_stopped(hctx) || blk_queue_quiesced(rq->q)) { blk_mq_insert_request(rq, 0); + blk_mq_run_hw_queue(hctx, false); return BLK_STS_OK; }

5 months

1
0
0 0

FAILED: patch "[PATCH] block: fix missing dispatching request when queue is started" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 2003ee8a9aa14d766b06088156978d53c2e9be3d # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120322-cyclic-shadily-cc71@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 2003ee8a9aa14d766b06088156978d53c2e9be3d Mon Sep 17 00:00:00 2001 From: Muchun Song <muchun.song(a)linux.dev> Date: Mon, 14 Oct 2024 17:29:32 +0800 Subject: [PATCH] block: fix missing dispatching request when queue is started or unquiesced Supposing the following scenario with a virtio_blk driver. CPU0 CPU1 CPU2 blk_mq_try_issue_directly() __blk_mq_issue_directly() q->mq_ops->queue_rq() virtio_queue_rq() blk_mq_stop_hw_queue() virtblk_done() blk_mq_try_issue_directly() if (blk_mq_hctx_stopped()) blk_mq_request_bypass_insert() blk_mq_run_hw_queue() blk_mq_run_hw_queue() blk_mq_run_hw_queue() blk_mq_insert_request() return After CPU0 has marked the queue as stopped, CPU1 will see the queue is stopped. But before CPU1 puts the request on the dispatch list, CPU2 receives the interrupt of completion of request, so it will run the hardware queue and marks the queue as non-stopped. Meanwhile, CPU1 also runs the same hardware queue. After both CPU1 and CPU2 complete blk_mq_run_hw_queue(), CPU1 just puts the request to the same hardware queue and returns. It misses dispatching a request. Fix it by running the hardware queue explicitly. And blk_mq_request_issue_directly() should handle a similar situation. Fix it as well. Fixes: d964f04a8fde ("blk-mq: fix direct issue") Cc: stable(a)vger.kernel.org Cc: Muchun Song <muchun.song(a)linux.dev> Signed-off-by: Muchun Song <songmuchun(a)bytedance.com> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Link: https://lore.kernel.org/r/20241014092934.53630-2-songmuchun@bytedance.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> diff --git a/block/blk-mq.c b/block/blk-mq.c index 7d05a56e3639..5deb9dffca0a 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2647,6 +2647,7 @@ static void blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx, if (blk_mq_hctx_stopped(hctx) || blk_queue_quiesced(rq->q)) { blk_mq_insert_request(rq, 0); + blk_mq_run_hw_queue(hctx, false); return; } @@ -2677,6 +2678,7 @@ static blk_status_t blk_mq_request_issue_directly(struct request *rq, bool last) if (blk_mq_hctx_stopped(hctx) || blk_queue_quiesced(rq->q)) { blk_mq_insert_request(rq, 0); + blk_mq_run_hw_queue(hctx, false); return BLK_STS_OK; }

5 months

1
0
0 0

FAILED: patch "[PATCH] serial: amba-pl011: Fix RX stall when DMA is used" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y git checkout FETCH_HEAD git cherry-pick -x 2bcacc1c87acf9a8ebc17de18cb2b3cfeca547cf # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120358-dating-yahoo-5b4b@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 2bcacc1c87acf9a8ebc17de18cb2b3cfeca547cf Mon Sep 17 00:00:00 2001 From: Kartik Rajput <kkartik(a)nvidia.com> Date: Wed, 13 Nov 2024 14:56:29 +0530 Subject: [PATCH] serial: amba-pl011: Fix RX stall when DMA is used Function pl011_throttle_rx() calls pl011_stop_rx() to disable RX, which also disables the RX DMA by clearing the RXDMAE bit of the DMACR register. However, to properly unthrottle RX when DMA is used, the function pl011_unthrottle_rx() is expected to set the RXDMAE bit of the DMACR register, which it currently lacks. This causes RX to stall after the throttle API is called. Set RXDMAE bit in the DMACR register while unthrottling RX if RX DMA is used. Fixes: 211565b10099 ("serial: pl011: UPSTAT_AUTORTS requires .throttle/unthrottle") Cc: stable(a)vger.kernel.org Signed-off-by: Kartik Rajput <kkartik(a)nvidia.com> Reviewed-by: Linus Walleij <linus.walleij(a)linaro.org> Link: https://lore.kernel.org/r/20241113092629.60226-1-kkartik@nvidia.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c index 56e587b94823..2facdbcd73eb 100644 --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -1819,6 +1819,11 @@ static void pl011_unthrottle_rx(struct uart_port *port) pl011_write(uap->im, uap, REG_IMSC); + if (uap->using_rx_dma) { + uap->dmacr |= UART011_RXDMAE; + pl011_write(uap->dmacr, uap, REG_DMACR); + } + uart_port_unlock_irqrestore(&uap->port, flags); }

5 months

1
0
0 0

FAILED: patch "[PATCH] serial: amba-pl011: Fix RX stall when DMA is used" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x 2bcacc1c87acf9a8ebc17de18cb2b3cfeca547cf # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120358-ungreased-creole-192e@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 2bcacc1c87acf9a8ebc17de18cb2b3cfeca547cf Mon Sep 17 00:00:00 2001 From: Kartik Rajput <kkartik(a)nvidia.com> Date: Wed, 13 Nov 2024 14:56:29 +0530 Subject: [PATCH] serial: amba-pl011: Fix RX stall when DMA is used Function pl011_throttle_rx() calls pl011_stop_rx() to disable RX, which also disables the RX DMA by clearing the RXDMAE bit of the DMACR register. However, to properly unthrottle RX when DMA is used, the function pl011_unthrottle_rx() is expected to set the RXDMAE bit of the DMACR register, which it currently lacks. This causes RX to stall after the throttle API is called. Set RXDMAE bit in the DMACR register while unthrottling RX if RX DMA is used. Fixes: 211565b10099 ("serial: pl011: UPSTAT_AUTORTS requires .throttle/unthrottle") Cc: stable(a)vger.kernel.org Signed-off-by: Kartik Rajput <kkartik(a)nvidia.com> Reviewed-by: Linus Walleij <linus.walleij(a)linaro.org> Link: https://lore.kernel.org/r/20241113092629.60226-1-kkartik@nvidia.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c index 56e587b94823..2facdbcd73eb 100644 --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -1819,6 +1819,11 @@ static void pl011_unthrottle_rx(struct uart_port *port) pl011_write(uap->im, uap, REG_IMSC); + if (uap->using_rx_dma) { + uap->dmacr |= UART011_RXDMAE; + pl011_write(uap->dmacr, uap, REG_DMACR); + } + uart_port_unlock_irqrestore(&uap->port, flags); }

5 months

1
0
0 0

FAILED: patch "[PATCH] serial: amba-pl011: Fix RX stall when DMA is used" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x 2bcacc1c87acf9a8ebc17de18cb2b3cfeca547cf # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120356-unclothed-handwoven-5255@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 2bcacc1c87acf9a8ebc17de18cb2b3cfeca547cf Mon Sep 17 00:00:00 2001 From: Kartik Rajput <kkartik(a)nvidia.com> Date: Wed, 13 Nov 2024 14:56:29 +0530 Subject: [PATCH] serial: amba-pl011: Fix RX stall when DMA is used Function pl011_throttle_rx() calls pl011_stop_rx() to disable RX, which also disables the RX DMA by clearing the RXDMAE bit of the DMACR register. However, to properly unthrottle RX when DMA is used, the function pl011_unthrottle_rx() is expected to set the RXDMAE bit of the DMACR register, which it currently lacks. This causes RX to stall after the throttle API is called. Set RXDMAE bit in the DMACR register while unthrottling RX if RX DMA is used. Fixes: 211565b10099 ("serial: pl011: UPSTAT_AUTORTS requires .throttle/unthrottle") Cc: stable(a)vger.kernel.org Signed-off-by: Kartik Rajput <kkartik(a)nvidia.com> Reviewed-by: Linus Walleij <linus.walleij(a)linaro.org> Link: https://lore.kernel.org/r/20241113092629.60226-1-kkartik@nvidia.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c index 56e587b94823..2facdbcd73eb 100644 --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -1819,6 +1819,11 @@ static void pl011_unthrottle_rx(struct uart_port *port) pl011_write(uap->im, uap, REG_IMSC); + if (uap->using_rx_dma) { + uap->dmacr |= UART011_RXDMAE; + pl011_write(uap->dmacr, uap, REG_DMACR); + } + uart_port_unlock_irqrestore(&uap->port, flags); }

5 months

1
0
0 0

FAILED: patch "[PATCH] serial: amba-pl011: Fix RX stall when DMA is used" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 2bcacc1c87acf9a8ebc17de18cb2b3cfeca547cf # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120357-gathering-handling-0bdf@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 2bcacc1c87acf9a8ebc17de18cb2b3cfeca547cf Mon Sep 17 00:00:00 2001 From: Kartik Rajput <kkartik(a)nvidia.com> Date: Wed, 13 Nov 2024 14:56:29 +0530 Subject: [PATCH] serial: amba-pl011: Fix RX stall when DMA is used Function pl011_throttle_rx() calls pl011_stop_rx() to disable RX, which also disables the RX DMA by clearing the RXDMAE bit of the DMACR register. However, to properly unthrottle RX when DMA is used, the function pl011_unthrottle_rx() is expected to set the RXDMAE bit of the DMACR register, which it currently lacks. This causes RX to stall after the throttle API is called. Set RXDMAE bit in the DMACR register while unthrottling RX if RX DMA is used. Fixes: 211565b10099 ("serial: pl011: UPSTAT_AUTORTS requires .throttle/unthrottle") Cc: stable(a)vger.kernel.org Signed-off-by: Kartik Rajput <kkartik(a)nvidia.com> Reviewed-by: Linus Walleij <linus.walleij(a)linaro.org> Link: https://lore.kernel.org/r/20241113092629.60226-1-kkartik@nvidia.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c index 56e587b94823..2facdbcd73eb 100644 --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -1819,6 +1819,11 @@ static void pl011_unthrottle_rx(struct uart_port *port) pl011_write(uap->im, uap, REG_IMSC); + if (uap->using_rx_dma) { + uap->dmacr |= UART011_RXDMAE; + pl011_write(uap->dmacr, uap, REG_DMACR); + } + uart_port_unlock_irqrestore(&uap->port, flags); }

5 months

1
0
0 0

FAILED: patch "[PATCH] serial: amba-pl011: Fix RX stall when DMA is used" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 2bcacc1c87acf9a8ebc17de18cb2b3cfeca547cf # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120356-maturing-junkman-2988@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 2bcacc1c87acf9a8ebc17de18cb2b3cfeca547cf Mon Sep 17 00:00:00 2001 From: Kartik Rajput <kkartik(a)nvidia.com> Date: Wed, 13 Nov 2024 14:56:29 +0530 Subject: [PATCH] serial: amba-pl011: Fix RX stall when DMA is used Function pl011_throttle_rx() calls pl011_stop_rx() to disable RX, which also disables the RX DMA by clearing the RXDMAE bit of the DMACR register. However, to properly unthrottle RX when DMA is used, the function pl011_unthrottle_rx() is expected to set the RXDMAE bit of the DMACR register, which it currently lacks. This causes RX to stall after the throttle API is called. Set RXDMAE bit in the DMACR register while unthrottling RX if RX DMA is used. Fixes: 211565b10099 ("serial: pl011: UPSTAT_AUTORTS requires .throttle/unthrottle") Cc: stable(a)vger.kernel.org Signed-off-by: Kartik Rajput <kkartik(a)nvidia.com> Reviewed-by: Linus Walleij <linus.walleij(a)linaro.org> Link: https://lore.kernel.org/r/20241113092629.60226-1-kkartik@nvidia.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c index 56e587b94823..2facdbcd73eb 100644 --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -1819,6 +1819,11 @@ static void pl011_unthrottle_rx(struct uart_port *port) pl011_write(uap->im, uap, REG_IMSC); + if (uap->using_rx_dma) { + uap->dmacr |= UART011_RXDMAE; + pl011_write(uap->dmacr, uap, REG_DMACR); + } + uart_port_unlock_irqrestore(&uap->port, flags); }

5 months

1
0
0 0

FAILED: patch "[PATCH] serial: amba-pl011: Fix RX stall when DMA is used" failed to apply to 6.6-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.6-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y git checkout FETCH_HEAD git cherry-pick -x 2bcacc1c87acf9a8ebc17de18cb2b3cfeca547cf # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120355-monitor-shaft-8108@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 2bcacc1c87acf9a8ebc17de18cb2b3cfeca547cf Mon Sep 17 00:00:00 2001 From: Kartik Rajput <kkartik(a)nvidia.com> Date: Wed, 13 Nov 2024 14:56:29 +0530 Subject: [PATCH] serial: amba-pl011: Fix RX stall when DMA is used Function pl011_throttle_rx() calls pl011_stop_rx() to disable RX, which also disables the RX DMA by clearing the RXDMAE bit of the DMACR register. However, to properly unthrottle RX when DMA is used, the function pl011_unthrottle_rx() is expected to set the RXDMAE bit of the DMACR register, which it currently lacks. This causes RX to stall after the throttle API is called. Set RXDMAE bit in the DMACR register while unthrottling RX if RX DMA is used. Fixes: 211565b10099 ("serial: pl011: UPSTAT_AUTORTS requires .throttle/unthrottle") Cc: stable(a)vger.kernel.org Signed-off-by: Kartik Rajput <kkartik(a)nvidia.com> Reviewed-by: Linus Walleij <linus.walleij(a)linaro.org> Link: https://lore.kernel.org/r/20241113092629.60226-1-kkartik@nvidia.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c index 56e587b94823..2facdbcd73eb 100644 --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -1819,6 +1819,11 @@ static void pl011_unthrottle_rx(struct uart_port *port) pl011_write(uap->im, uap, REG_IMSC); + if (uap->using_rx_dma) { + uap->dmacr |= UART011_RXDMAE; + pl011_write(uap->dmacr, uap, REG_DMACR); + } + uart_port_unlock_irqrestore(&uap->port, flags); }

5 months

1
0
0 0

FAILED: patch "[PATCH] dt-bindings: serial: rs485: Fix rs485-rts-delay property" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 12b3642b6c242061d3ba84e6e3050c3141ded14c # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120308-yo-yo-bagful-0961@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 12b3642b6c242061d3ba84e6e3050c3141ded14c Mon Sep 17 00:00:00 2001 From: Michal Simek <michal.simek(a)amd.com> Date: Mon, 16 Sep 2024 11:53:06 +0200 Subject: [PATCH] dt-bindings: serial: rs485: Fix rs485-rts-delay property Code expects array only with 2 items which should be checked. But also item checking is not working as it should likely because of incorrect items description. Fixes: d50f974c4f7f ("dt-bindings: serial: Convert rs485 bindings to json-schema") Signed-off-by: Michal Simek <michal.simek(a)amd.com> Cc: stable(a)vger.kernel.org Reviewed-by: Krzysztof Kozlowski <krzk(a)kernel.org> Link: https://lore.kernel.org/r/820c639b9e22fe037730ed44d1b044cdb6d28b75.17264803… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/Documentation/devicetree/bindings/serial/rs485.yaml b/Documentation/devicetree/bindings/serial/rs485.yaml index 9418fd66a8e9..b93254ad2a28 100644 --- a/Documentation/devicetree/bindings/serial/rs485.yaml +++ b/Documentation/devicetree/bindings/serial/rs485.yaml @@ -18,16 +18,15 @@ properties: description: prop-encoded-array <a b> $ref: /schemas/types.yaml#/definitions/uint32-array items: - items: - - description: Delay between rts signal and beginning of data sent in - milliseconds. It corresponds to the delay before sending data. - default: 0 - maximum: 100 - - description: Delay between end of data sent and rts signal in milliseconds. - It corresponds to the delay after sending data and actual release - of the line. - default: 0 - maximum: 100 + - description: Delay between rts signal and beginning of data sent in + milliseconds. It corresponds to the delay before sending data. + default: 0 + maximum: 100 + - description: Delay between end of data sent and rts signal in milliseconds. + It corresponds to the delay after sending data and actual release + of the line. + default: 0 + maximum: 100 rs485-rts-active-high: description: drive RTS high when sending (this is the default).

5 months

1
0
0 0

FAILED: patch "[PATCH] dt-bindings: serial: rs485: Fix rs485-rts-delay property" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x 12b3642b6c242061d3ba84e6e3050c3141ded14c # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024120307-crazy-twitch-d786@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 12b3642b6c242061d3ba84e6e3050c3141ded14c Mon Sep 17 00:00:00 2001 From: Michal Simek <michal.simek(a)amd.com> Date: Mon, 16 Sep 2024 11:53:06 +0200 Subject: [PATCH] dt-bindings: serial: rs485: Fix rs485-rts-delay property Code expects array only with 2 items which should be checked. But also item checking is not working as it should likely because of incorrect items description. Fixes: d50f974c4f7f ("dt-bindings: serial: Convert rs485 bindings to json-schema") Signed-off-by: Michal Simek <michal.simek(a)amd.com> Cc: stable(a)vger.kernel.org Reviewed-by: Krzysztof Kozlowski <krzk(a)kernel.org> Link: https://lore.kernel.org/r/820c639b9e22fe037730ed44d1b044cdb6d28b75.17264803… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/Documentation/devicetree/bindings/serial/rs485.yaml b/Documentation/devicetree/bindings/serial/rs485.yaml index 9418fd66a8e9..b93254ad2a28 100644 --- a/Documentation/devicetree/bindings/serial/rs485.yaml +++ b/Documentation/devicetree/bindings/serial/rs485.yaml @@ -18,16 +18,15 @@ properties: description: prop-encoded-array <a b> $ref: /schemas/types.yaml#/definitions/uint32-array items: - items: - - description: Delay between rts signal and beginning of data sent in - milliseconds. It corresponds to the delay before sending data. - default: 0 - maximum: 100 - - description: Delay between end of data sent and rts signal in milliseconds. - It corresponds to the delay after sending data and actual release - of the line. - default: 0 - maximum: 100 + - description: Delay between rts signal and beginning of data sent in + milliseconds. It corresponds to the delay before sending data. + default: 0 + maximum: 100 + - description: Delay between end of data sent and rts signal in milliseconds. + It corresponds to the delay after sending data and actual release + of the line. + default: 0 + maximum: 100 rs485-rts-active-high: description: drive RTS high when sending (this is the default).

5 months

1
0
0 0