6.16.1-rc1 review
Subsystems (7)
Greg Kroah-Hartman
maintainercover 6.16.1-rc1 review
This is the start of the stable review cycle for the 6.16.1 release. There are 627 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 14 Aug 2025 17:32:40 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.16.1-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.16.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.16.1-rc1
Suren Baghdasaryan <[email protected]>
mm: fix a UAF when vma->mm is freed after vma->vm_refcnt got dropped
Baochen Qiang <[email protected]>
wifi: ath12k: install pairwise key first
Tao Xue <[email protected]>
usb: gadget : fix use-after-free in composite_dev_cleanup()
Aditya Garg <[email protected]>
HID: apple: avoid setting up battery timer for devices without battery
Aditya Garg <[email protected]>
HID: magicmouse: avoid setting up battery timer when not needed
Alan Stern <[email protected]>
HID: core: Harden s32ton() against conversion to 0 bits
Yuhao Jiang <[email protected]>
USB: gadget: f_hid: Fix memory leak in hidg_bind error path
Qasim Ijaz <[email protected]>
HID: apple: validate feature-report field count to prevent NULL pointer dereference
Julien Massot <[email protected]>
media: ti: j721e-csi2rx: fix list_del corruption
Robin Murphy <[email protected]>
perf/arm-ni: Set initial IRQ affinity
Akash Kumar <[email protected]>
usb: gadget: uvc: Initialize frame-based format color matching descriptor
Baolin Wang <[email protected]>
mm: shmem: fix the shmem large folio allocation for the i915 driver
Kemeng Shi <[email protected]>
mm: swap: move nr_swap_pages counter decrement from folio_alloc_swap() to swap_range_alloc()
Kemeng Shi <[email protected]>
mm: swap: fix potential buffer overflow in setup_clusters()
Kemeng Shi <[email protected]>
mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop
Andy Shevchenko <[email protected]>
mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
Jiaxun Yang <[email protected]>
MIPS: mm: tlb-r4k: Uniquify TLB entries on init
Gerald Schaefer <[email protected]>
s390/mm: Remove possible false-positive warning in pte_free_defer()
Shin'ichiro Kawasaki <[email protected]>
zloop: fix KASAN use-after-free of tag set
Marc Zyngier <[email protected]>
KVM: arm64: Filter out HCR_EL2 bits when running in hypervisor context
Marc Zyngier <[email protected]>
KVM: arm64: Check for SYSREGS_ON_CPU before accessing the CPU state
Sean Christopherson <[email protected]>
KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported
Sean Christopherson <[email protected]>
KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag
Sean Christopherson <[email protected]>
KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap
Dave Hansen <[email protected]>
x86/fpu: Delay instruction pointer fixup until after warning
Michael J. Ruhl <[email protected]>
platform/x86/intel/pmt: fix a crashlog NULL pointer access
Edip Hazuri <[email protected]>
ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26)
Edip Hazuri <[email protected]>
ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx
Edip Hazuri <[email protected]>
ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx
Geoffrey D. Bennett <[email protected]>
ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
Thorsten Blum <[email protected]>
ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe()
Tom Lendacky <[email protected]>
x86/sev: Evict cache lines during SNP memory validation
Ammar Faizi <[email protected]>
net: usbnet: Fix the wrong netif_carrier_on() call
John Ernberg <[email protected]>
net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
Zenm Chen <[email protected]>
Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano
Slark Xiao <[email protected]>
USB: serial: option: add Foxconn T99W709
Thorsten Blum <[email protected]>
smb: server: Fix extension string in ksmbd_extract_shortname()
Namjae Jeon <[email protected]>
ksmbd: limit repeated connections from clients with the same IP
Paulo Alcantara <[email protected]>
smb: client: default to nonativesocket under POSIX mounts
Paulo Alcantara <[email protected]>
smb: client: set symlink type as native for POSIX mounts
Wang Zhaolong <[email protected]>
smb: client: fix netns refcount leak after net_passive changes
Namjae Jeon <[email protected]>
ksmbd: fix corrupted mtime and ctime in smb2_open
Namjae Jeon <[email protected]>
ksmbd: fix Preauh_HashValue race condition
Namjae Jeon <[email protected]>
ksmbd: fix null pointer dereference error in generate_encryptionkey
Budimir Markovic <[email protected]>
vsock: Do not allow binding to VMADDR_PORT_ANY
Quang Le <[email protected]>
net/packet: fix a race in packet_set_ring() and packet_notifier()
Lorenzo Stoakes <[email protected]>
selftests/perf_events: Add a mmap() correctness test
Thomas Gleixner <[email protected]>
perf/core: Prevent VMA split of buffer mappings
Thomas Gleixner <[email protected]>
perf/core: Handle buffer mapping fail correctly in perf_mmap()
Thomas Gleixner <[email protected]>
perf/core: Exit early on perf_mmap() fail
Thomas Gleixner <[email protected]>
perf/core: Don't leak AUX buffer refcount on allocation failure
Thomas Gleixner <[email protected]>
perf/core: Preserve AUX buffer allocation failure result
Olga Kornievskaia <[email protected]>
sunrpc: fix handling of server side tls alerts
NeilBrown <[email protected]>
nfsd: avoid ref leak in nfsd_open_local_fh()
Jeff Layton <[email protected]>
nfsd: don't set the ctime on delegated atime updates
Zhang Rui <[email protected]>
tools/power turbostat: Fix DMR support
Zhang Rui <[email protected]>
tools/power turbostat: Fix bogus SysWatt for forked program
Stefan Metzmacher <[email protected]>
smb: client: return an error if rdma_connect does not return within 5 seconds
Eric Dumazet <[email protected]>
pptp: fix pptp_xmit() error path
Mohamed Khalfella <[email protected]>
nvmet: exit debugfs after discovery subsystem exits
Stefan Metzmacher <[email protected]>
smb: client: let recv_done() avoid touching data_transfer after cleanup/move
Stefan Metzmacher <[email protected]>
smb: client: let recv_done() cleanup before notifying the callers.
Stefan Metzmacher <[email protected]>
smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already
Stefan Metzmacher <[email protected]>
smb: client: remove separate empty_packet_queue
Stefan Metzmacher <[email protected]>
smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection()
Stefan Metzmacher <[email protected]>
smb: server: let recv_done() avoid touching data_transfer after cleanup/move
Stefan Metzmacher <[email protected]>
smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection
Stefan Metzmacher <[email protected]>
smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already
Stefan Metzmacher <[email protected]>
smb: server: remove separate empty_recvmsg_queue
Mikhail Zaslonko <[email protected]>
s390/boot: Fix startup debugging log
Takashi Iwai <[email protected]>
ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out()
Arnd Bergmann <[email protected]>
ASoC: SOF: Intel: hda-sdw-bpt: fix SND_SOF_SOF_HDA_SDW_BPT dependencies
Arnd Bergmann <[email protected]>
irqchip: Build IMX_MU_MSI only on ARM
Meghana Malladi <[email protected]>
net: ti: icssg-prueth: Fix skb handling for XDP_PASS
Trond Myklebust <[email protected]>
NFS/localio: nfs_uuid_put() fix the wake up after unlinking the file
Trond Myklebust <[email protected]>
NFS/localio: nfs_uuid_put() fix races with nfs_open/close_local_fh()
Trond Myklebust <[email protected]>
NFS/localio: nfs_close_local_fh() fix check for file closed
Mohsin Bashir <[email protected]>
eth: fbnic: Lock the tx_dropped update
Mohsin Bashir <[email protected]>
eth: fbnic: Fix tx_dropped reporting
Jakub Kicinski <[email protected]>
eth: fbnic: remove the debugging trick of super high page bias
Sumanth Korikkar <[email protected]>
s390/mm: Allocate page table with PAGE_SIZE granularity
Maher Azzouzi <[email protected]>
net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
Jakub Kicinski <[email protected]>
Revert "net: mdio_bus: Use devm for getting reset GPIO"
Michal Schmidt <[email protected]>
benet: fix BUG when creating VFs
Lorenzo Bianconi <[email protected]>
net: airoha: npu: Add missing MODULE_FIRMWARE macros
Jakub Kicinski <[email protected]>
net: devmem: fix DMA direction on unmapping
Arnd Bergmann <[email protected]>
ipa: fix compile-testing with qcom-mdt=m
Jakub Kicinski <[email protected]>
eth: fbnic: unlink NAPIs from queues on error to open
Thomas Gleixner <[email protected]>
x86/irq: Plug vector setup race
Michal Wajdeczko <[email protected]>
drm/xe/pf: Disable PF restart worker on device removal
Olga Kornievskaia <[email protected]>
sunrpc: fix client side handling of tls alerts
Yang Erkun <[email protected]>
md: make rdev_addable usable for rcu mode
Takamitsu Iwai <[email protected]>
net/sched: taprio: enforce minimum value for picos_per_byte
Wang Liang <[email protected]>
net: drop UFO packets in udp_rcv_segment()
Florian Fainelli <[email protected]>
net: mdio: mdio-bcm-unimac: Correct rate fallback logic
Eric Dumazet <[email protected]>
ipv6: reject malicious packets in ipv6_gso_segment()
Eric Dumazet <[email protected]>
selftests: avoid using ifconfig
Christoph Paasch <[email protected]>
net/mlx5: Correctly set gso_segs when LRO is used
Lorenzo Bianconi <[email protected]>
net: airoha: Fix PPE table access in airoha_ppe_debugfs_foe_show()
Simon Trimmer <[email protected]>
spi: cs42l43: Property entry should be a null-terminated array
Baojun Xu <[email protected]>
ASoC: tas2781: Fix the wrong step for TLV on tas2781
Christoph Hellwig <[email protected]>
block: ensure discard_granularity is zero when discard is not supported
Guenter Roeck <[email protected]>
block: Fix default IO priority if there is no IO context
Jakub Kicinski <[email protected]>
netlink: specs: ethtool: fix module EEPROM input/output arguments
Alexander Gordeev <[email protected]>
s390/mm: Set high_memory at the end of the identity mapping
Harald Freudenberger <[email protected]>
s390/ap: Unmask SLCF bit in card and queue ap functions sysfs
Mohamed Khalfella <[email protected]>
nvmet: initialize discovery subsys after debugfs is initialized
Eric Dumazet <[email protected]>
pptp: ensure minimal skb length in pptp_xmit()
Bence Csókás <[email protected]>
net: mdio_bus: Use devm for getting reset GPIO
Luca Weiss <[email protected]>
net: ipa: add IPA v5.1 and v5.5 to ipa_version_string()
Horatiu Vultur <[email protected]>
phy: mscc: Fix parsing of unicast frames
Jakub Kicinski <[email protected]>
netpoll: prevent hanging NAPI when netcons gets enabled
Michal Luczaj <[email protected]>
kcm: Fix splice support
Heming Zhao <[email protected]>
md/md-cluster: handle REMOVE message earlier
Bartosz Golaszewski <[email protected]>
ARM: s3c/gpio: complete the conversion to new GPIO value setters
Benjamin Coddington <[email protected]>
NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY
Olga Kornievskaia <[email protected]>
NFSv4.2: another fix for listxattr
Trond Myklebust <[email protected]>
NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
Trond Myklebust <[email protected]>
NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate()
Tigran Mkrtchyan <[email protected]>
pNFS/flexfiles: don't attempt pnfs on fatal DS errors
Len Brown <[email protected]>
tools/power turbostat: regression fix: --show C1E%
Timothy Pearson <[email protected]>
PCI: pnv_php: Fix surprise plug detection and recovery
Timothy Pearson <[email protected]>
powerpc/eeh: Make EEH driver device hotplug safe
Timothy Pearson <[email protected]>
powerpc/eeh: Export eeh_unfreeze_pe()
Timothy Pearson <[email protected]>
PCI: pnv_php: Work around switches with broken presence detection
Timothy Pearson <[email protected]>
PCI: pnv_php: Clean up allocated IRQs on unplug
Herbert Xu <[email protected]>
padata: Remove comment for reorder_work
Peter Zijlstra <[email protected]>
sched/psi: Fix psi_seq initialization
Jason Gunthorpe <[email protected]>
vfio/pci: Do vf_token checks for VFIO_DEVICE_BIND_IOMMUFD
Masahiro Yamada <[email protected]>
kconfig: qconf: fix ConfigList::updateListAllforAll()
Salomon Dushimirimana <[email protected]>
scsi: sd: Make sd shutdown issue START STOP UNIT appropriately
Seunghui Lee <[email protected]>
scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume
Li Lingfeng <[email protected]>
scsi: Revert "scsi: iscsi: Fix HW conn removal use after free"
Tomas Henzl <[email protected]>
scsi: mpt3sas: Fix a fw_event memory leak
Alex Williamson <[email protected]>
vfio/pci: Separate SR-IOV VF dev_set
Brett Creeley <[email protected]>
vfio/pds: Fix missing detach_ioas op
Jacob Pan <[email protected]>
vfio: Prevent open_count decrement to negative
Jacob Pan <[email protected]>
vfio: Fix unbalanced vfio_df_close call in no-iommu mode
Christophe JAILLET <[email protected]>
i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe()
Zhengxu Zhang <[email protected]>
exfat: fdatasync flag should be same like generic_write_sync()
Chao Yu <[email protected]>
f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode
Chao Yu <[email protected]>
f2fs: fix to calculate dirty data during has_not_enough_free_secs()
Chao Yu <[email protected]>
f2fs: fix to update upper_p in __get_secs_required() correctly
Jan Prusakowski <[email protected]>
f2fs: vm_unmap_ram() may be called from an invalid context
Chao Yu <[email protected]>
f2fs: fix to avoid out-of-boundary access in devs.path
Chao Yu <[email protected]>
f2fs: fix to avoid panic in f2fs_evict_inode
Chao Yu <[email protected]>
f2fs: fix to avoid UAF in f2fs_sync_inode_meta()
Chao Yu <[email protected]>
f2fs: doc: fix wrong quota mount option description
Chao Yu <[email protected]>
f2fs: fix to check upper boundary for gc_no_zoned_gc_percent
Chao Yu <[email protected]>
f2fs: fix to check upper boundary for gc_valid_thresh_ratio
yohan.joung <[email protected]>
f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent
Abinash Singh <[email protected]>
f2fs: fix KMSAN uninit-value in extent_info usage
Zhiguo Niu <[email protected]>
f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic
Zhiguo Niu <[email protected]>
f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi
Chao Yu <[email protected]>
f2fs: fix to avoid invalid wait context issue
Sheng Yong <[email protected]>
f2fs: fix bio memleak when committing super block
Daeho Jeong <[email protected]>
f2fs: turn off one_time when forcibly set to foreground GC
Brian Masney <[email protected]>
rtc: rv3028: fix incorrect maximum clock rate handling
Brian Masney <[email protected]>
rtc: pcf8563: fix incorrect maximum clock rate handling
Brian Masney <[email protected]>
rtc: pcf85063: fix incorrect maximum clock rate handling
Brian Masney <[email protected]>
rtc: nct3018y: fix incorrect maximum clock rate handling
Brian Masney <[email protected]>
rtc: hym8563: fix incorrect maximum clock rate handling
Brian Masney <[email protected]>
rtc: ds1307: fix incorrect maximum clock rate handling
Uros Bizjak <[email protected]>
ucount: fix atomic_long_inc_below() argument type
Petr Pavlu <[email protected]>
module: Restore the moduleparam prefix length check
Stanley Chu <[email protected]>
i3c: master: svc: Fix npcm845 FIFO_EMPTY quirk
Arnd Bergmann <[email protected]>
i3c: fix module_i3c_i2c_driver() with I3C=n
Helge Deller <[email protected]>
apparmor: Fix unaligned memory accesses in KUnit test
Colin Ian King <[email protected]>
squashfs: fix incorrect argument to sizeof in kmalloc_array call
Matthew Wilcox (Oracle) <[email protected]>
squashfs: use folios in squashfs_bio_read_cached()
Johannes Berg <[email protected]>
scripts: gdb: move MNT_* constants to gdb-parsed
Jiri Olsa <[email protected]>
uprobes: revert ref_ctr_offset in uprobe_unregister error path
Kent Overstreet <[email protected]>
dm-flakey: Fix corrupt_bio_byte setup checks
Ryan Lee <[email protected]>
apparmor: fix loop detection used in conflicting attachment resolution
Ryan Lee <[email protected]>
apparmor: ensure WB_HISTORY_SIZE value is a power of 2
Paul Chaignon <[email protected]>
bpf: Check netfilter ctx accesses are aligned
Paul Chaignon <[email protected]>
bpf: Check flow_dissector ctx accesses are aligned
Cindy Lu <[email protected]>
vhost: Reintroduce kthread API and add mode selection
Anders Roxell <[email protected]>
vdpa: Fix IDR memory leak in VDUSE module exit
Dragos Tatulea <[email protected]>
vdpa/mlx5: Fix release of uninitialized resources on error path
Alok Tiwari <[email protected]>
vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit
Mike Christie <[email protected]>
vhost-scsi: Fix log flooding with target does not exist errors
Dragos Tatulea <[email protected]>
vdpa/mlx5: Fix needs_teardown flag calculation
Daniel Borkmann <[email protected]>
bpf: Fix oob access in cgroup local storage
Daniel Borkmann <[email protected]>
bpf: Move cgroup iterator helpers to bpf.h
Daniel Borkmann <[email protected]>
bpf: Move bpf map owner out of common struct
Daniel Borkmann <[email protected]>
bpf: Add cookie object to bpf maps
Namhyung Kim <[email protected]>
perf record: Cache build-ID of hit DSOs only
Takashi Iwai <[email protected]>
ALSA: usb: scarlett2: Fix missing NULL check
WangYuli <[email protected]>
selftests: ALSA: fix memory leak in utimer test
Lukasz Laguna <[email protected]>
drm/xe/vf: Disable CSC support on VF
Balamanikandan Gunasundar <[email protected]>
mtd: rawnand: atmel: set pmecc data setup time
Thomas Fourier <[email protected]>
mtd: rawnand: rockchip: Add missing check after DMA map
Thomas Fourier <[email protected]>
mtd: rawnand: atmel: Fix dma_mapping_error() address
Zheng Yu <[email protected]>
jfs: fix metapage reference count leak in dbAllocCtl
Michal Wajdeczko <[email protected]>
drm/xe/configfs: Fix pci_dev reference leak
Paulo Alcantara <[email protected]>
smb: client: allow parsing zero-length AV pairs
Chenyuan Yang <[email protected]>
fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref
Giovanni Cabiddu <[email protected]>
crypto: qat - fix seq_file position update in adf_ring_next()
Giovanni Cabiddu <[email protected]>
crypto: qat - fix DMA direction for compression on GEN2 devices
Shubhrajyoti Datta <[email protected]>
clk: clocking-wizard: Fix the round rate handling for versal
Chen Pei <[email protected]>
perf tools: Remove libtraceevent in .gitignore
Ben Hutchings <[email protected]>
sh: Do not use hyphen in exported variable name
Akhilesh Patil <[email protected]>
clk: spacemit: ccu_pll: fix error return value in recalc_rate callback
Ian Rogers <[email protected]>
perf topdown: Use attribute to see an event is a topdown metic or slots
Shengjiu Wang <[email protected]>
ASoC: fsl_xcvr: get channel status data with firmware exists
Shengjiu Wang <[email protected]>
ASoC: fsl_xcvr: get channel status data when PHY is not exists
Charles Keepax <[email protected]>
ASoC: SDCA: Fix some holes in the regmap readable/writeable helpers
Shree Ramamoorthy <[email protected]>
mfd: tps65219: Update TPS65214 MFD cell's GPIO compatible string
Thomas Fourier <[email protected]>
dmaengine: nbpfaxi: Add missing check after DMA map
Thomas Fourier <[email protected]>
dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
Ian Rogers <[email protected]>
perf pmu: Switch FILENAME_MAX to NAME_MAX
Ian Rogers <[email protected]>
tools subcmd: Tighten the filename size in check_if_command_finished
Yao Zi <[email protected]>
clk: thead: th1520-ap: Describe mux clocks with clk_mux
Dan Carpenter <[email protected]>
fs/orangefs: Allow 2 more characters in do_c_string()
Tanmay Shah <[email protected]>
remoteproc: xlnx: Disable unsupported features
Luca Weiss <[email protected]>
phy: qcom: phy-qcom-snps-eusb2: Add missing write from init sequence
Laurentiu Palcu <[email protected]>
clk: imx95-blk-ctl: Fix synchronous abort
Manivannan Sadhasivam <[email protected]>
PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute
Bard Liao <[email protected]>
soundwire: stream: restore params when prepare ports fail
Michal Koutný <[email protected]>
cgroup: Add compatibility option for content of /proc/cgroups
Eric Biggers <[email protected]>
crypto: krb5 - Fix memory leak in krb5_test_one_prf()
Suman Kumar Chakraborty <[email protected]>
crypto: qat - fix virtual channel configuration for GEN6 devices
Bairavi Alagappan <[email protected]>
crypto: qat - disable ZUC-256 capability for QAT GEN5
Thomas Fourier <[email protected]>
crypto: img-hash - Fix dma_unmap_sg() nents value
Thomas Fourier <[email protected]>
crypto: keembay - Fix dma_unmap_sg() nents value
Ovidiu Panait <[email protected]>
hwrng: mtk - handle devm_pm_runtime_enable errors
Varshini Rajendran <[email protected]>
clk: at91: sam9x7: update pll clk ranges
Jan Kara <[email protected]>
ext4: Make sure BH_New bit is cleared in ->write_end handler
Baokun Li <[email protected]>
ext4: fix inode use after free in ext4_end_io_rsv_work()
Shashank Balaji <[email protected]>
selftests/cgroup: fix cpu.max tests
Dan Carpenter <[email protected]>
watchdog: ziirave_wdt: check record length in ziirave_firm_verify()
Robin Murphy <[email protected]>
PCI: Fix driver_managed_dma check
Thomas Fourier <[email protected]>
scsi: isci: Fix dma_unmap_sg() nents value
Thomas Fourier <[email protected]>
scsi: mvsas: Fix dma_unmap_sg() nents value
Thomas Fourier <[email protected]>
scsi: elx: efct: Fix dma_unmap_sg() nents value
Bagas Sanjaya <[email protected]>
scsi: core: Fix kernel doc for scsi_track_queue_full()
Thomas Fourier <[email protected]>
scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
Paul Kocialkowski <[email protected]>
clk: sunxi-ng: v3s: Fix de clock definition
Zhang Yi <[email protected]>
ext4: fix insufficient credits calculation in ext4_meta_trans_blocks()
Zhang Yi <[email protected]>
ext4: correct the reserved credits for extent conversion
Yao Zi <[email protected]>
clk: thead: th1520-ap: Correctly refer the parent of osc_12m
Shiraz Saleem <[email protected]>
RDMA/mana_ib: Fix DSCP value in modify QP
Ian Rogers <[email protected]>
perf python: Correct pyrf_evsel__read for tool PMUs
Ian Rogers <[email protected]>
perf python: Fix thread check in pyrf_evsel__read
Ian Rogers <[email protected]>
perf hwmon_pmu: Avoid shortening hwmon PMU name
Leo Yan <[email protected]>
perf tests bp_account: Fix leaked file descriptor
Mukesh Ojha <[email protected]>
pinmux: fix race causing mux_owner NULL with active mux_usecount
Li Ming <[email protected]>
cxl/edac: Fix wrong dpa checking for PPR operation
Li Ming <[email protected]>
cxl/core: Introduce a new helper cxl_resource_contains_addr()
wangzijie <[email protected]>
proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al
Leon Romanovsky <[email protected]>
RDMA/uverbs: Add empty rdma_uattrs_has_raw_cap() declaration
Arnd Bergmann <[email protected]>
kernel: trace: preemptirq_delay_test: use offstack cpu mask
Steven Rostedt <[email protected]>
tracing: Use queue_rcu_work() to free filters
Junxian Huang <[email protected]>
RDMA/hns: Fix -Wframe-larger-than issue
Junxian Huang <[email protected]>
RDMA/hns: Drop GFP_NOWARN
Junxian Huang <[email protected]>
RDMA/hns: Fix accessing uninitialized resources
Junxian Huang <[email protected]>
RDMA/hns: Get message length of ack_req from FW
Mengbiao Xiong <[email protected]>
crypto: ccp - Fix crash when rebind ccp device for ccp.ko
Thomas Fourier <[email protected]>
crypto: inside-secure - Fix dma_unmap_sg() nents value
Alexey Kardashevskiy <[email protected]>
crypto: ccp - Fix locking on alloc failure handling
wenglianfa <[email protected]>
RDMA/hns: Fix HW configurations not cleared in error flow
wenglianfa <[email protected]>
RDMA/hns: Fix double destruction of rsv_qp
Alex Elder <[email protected]>
clk: spacemit: mark K1 pll1_d8 as critical
Namhyung Kim <[email protected]>
perf sched: Fix memory leaks in 'perf sched latency'
Namhyung Kim <[email protected]>
perf sched: Use RC_CHK_EQUAL() to compare pointers
Namhyung Kim <[email protected]>
perf sched: Fix memory leaks for evsel->priv in timehist
Namhyung Kim <[email protected]>
perf sched: Fix thread leaks in 'perf sched timehist'
Namhyung Kim <[email protected]>
perf sched: Fix memory leaks in 'perf sched map'
Namhyung Kim <[email protected]>
perf sched: Free thread->priv using priv_destructor
Namhyung Kim <[email protected]>
perf sched: Make sure it frees the usage string
Takahiro Kuwano <[email protected]>
mtd: spi-nor: spansion: Fixup params->set_4byte_addr_mode for SEMPER
Ian Rogers <[email protected]>
perf dso: Add missed dso__put to dso__load_kcore
Namhyung Kim <[email protected]>
perf tools: Fix use-after-free in help_unknown_cmd()
WangYuli <[email protected]>
gitignore: allow .pylintrc to be tracked
Andy Shevchenko <[email protected]>
leds: pca955x: Avoid potential overflow when filling default_label (take 2)
Thomas Fourier <[email protected]>
Fix dma_unmap_sg() nents value
Parav Pandit <[email protected]>
RDMA/counter: Check CAP_NET_RAW check in user namespace for RDMA counters
Parav Pandit <[email protected]>
RDMA/nldev: Check CAP_NET_RAW in user namespace for QP modify
Parav Pandit <[email protected]>
RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create
Arnd Bergmann <[email protected]>
leds: tps6131x: Add V4L2_FLASH_LED_CLASS dependency
Parav Pandit <[email protected]>
RDMA/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create
Parav Pandit <[email protected]>
RDMA/uverbs: Check CAP_NET_RAW in user namespace for QP create
Parav Pandit <[email protected]>
RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create
Parav Pandit <[email protected]>
RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create
Parav Pandit <[email protected]>
RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create
Mark Bloch <[email protected]>
RDMA/ipoib: Use parent rdma device net namespace
Nuno Sá <[email protected]>
clk: clk-axi-clkgen: fix fpfd_max frequency for zynq
Amir Goldstein <[email protected]>
fanotify: sanitize handle_type values when reporting fid
Luca Weiss <[email protected]>
phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers
Rodrigo Gobbi <[email protected]>
soundwire: debugfs: move debug statement outside of error handling
Krzysztof Kozlowski <[email protected]>
dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning
Charles Keepax <[email protected]>
soundwire: Correct some property names
Niklas Cassel <[email protected]>
PCI: qcom: Wait PCIE_RESET_CONFIG_WAIT_MS after link-up IRQ
Niklas Cassel <[email protected]>
PCI: dw-rockchip: Wait PCIE_RESET_CONFIG_WAIT_MS after link-up IRQ
Niklas Cassel <[email protected]>
PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS
Jiwei Sun <[email protected]>
PCI: Adjust the position of reading the Link Control 2 register
Ze Huang <[email protected]>
pinctrl: canaan: k230: Fix order of DT parse and pinctrl register
Ze Huang <[email protected]>
pinctrl: canaan: k230: add NULL check in DT parse
Yuan Chen <[email protected]>
pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state()
Yuan Chen <[email protected]>
pinctrl: sunxi: Fix memory leak on krealloc failure
Jerome Brunet <[email protected]>
PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails
Suman Kumar Chakraborty <[email protected]>
crypto: qat - restore ASYM service support for GEN6 devices
Herbert Xu <[email protected]>
crypto: ahash - Stop legacy tfms from using the set_virt fallback path
Herbert Xu <[email protected]>
crypto: ahash - Add support for drivers with no fallback
Arnd Bergmann <[email protected]>
crypto: arm/aes-neonbs - work around gcc-15 warning
Thomas Antoine <[email protected]>
power: supply: max1720x correct capacity computation
Casey Connolly <[email protected]>
power: supply: qcom_pmi8998_charger: fix wakeirq
Charles Han <[email protected]>
power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
Geert Uytterhoeven <[email protected]>
power: reset: POWER_RESET_TORADEX_EC should depend on ARCH_MXC
Charles Han <[email protected]>
power: supply: cpcap-charger: Fix null check for power_supply_get_by_name
Rohit Visavalia <[email protected]>
clk: xilinx: vcu: unregister pll_post only if registered correctly
Namhyung Kim <[email protected]>
perf parse-events: Set default GH modifier properly
James Cowgill <[email protected]>
media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check
Ming Qian <[email protected]>
media: imx-jpeg: Account for data_offset when getting image address
Henry Martin <[email protected]>
clk: davinci: Add NULL check in davinci_lpsc_clk_register()
Ivan Stepchenko <[email protected]>
mtd: fix possible integer overflow in erase_xfer()
Svyatoslav Pankratov <[email protected]>
crypto: qat - fix state restore for banks with exceptions
Ahsan Atta <[email protected]>
crypto: qat - allow enabling VFs in the absence of IOMMU
Ashish Kalra <[email protected]>
crypto: ccp - Fix dereferencing uninitialized error pointer
Herbert Xu <[email protected]>
padata: Fix pd UAF once and for all
Herbert Xu <[email protected]>
crypto: s390/sha3 - Use cpu byte-order when exporting
Herbert Xu <[email protected]>
crypto: s390/hmac - Fix counter in export state
Herbert Xu <[email protected]>
crypto: marvell/cesa - Fix engine load inaccuracy
Suman Kumar Chakraborty <[email protected]>
crypto: qat - use unmanaged allocation for dc_data
Ovidiu Panait <[email protected]>
crypto: sun8i-ce - fix nents passed to dma_unmap_sg()
Lad Prabhakar <[email protected]>
clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks
Hans Zhang <[email protected]>
PCI: rockchip-host: Fix "Unexpected Completion" log message
Bjorn Andersson <[email protected]>
remoteproc: qcom: pas: Conclude the rename from adsp
Thomas Richard <[email protected]>
pinctrl: cirrus: madera-core: Use devm_pinctrl_register_mappings()
Kees Cook <[email protected]>
fortify: Fix incorrect reporting of read buffer size
Kees Cook <[email protected]>
staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int()
Gabriele Monaco <[email protected]>
rv: Adjust monitor dependencies
Gabriele Monaco <[email protected]>
rv: Use strings in da monitors tracepoints
Gabriele Monaco <[email protected]>
rv: Remove trailing whitespace from tracepoint string
Samuel Holland <[email protected]>
RISC-V: KVM: Fix inclusion of Smnpm in the guest ISA bitmap
Puranjay Mohan <[email protected]>
bpf, arm64: Fix fp initialization for exception boundary
Thomas Weißschuh <[email protected]>
bpf/preload: Don't select USERMODE_DRIVER
Eric Dumazet <[email protected]>
ipv6: annotate data-races around rt->fib6_nsiblings
Eric Dumazet <[email protected]>
ipv6: fix possible infinite loop in fib6_info_uses_dev()
Eric Dumazet <[email protected]>
ipv6: prevent infinite loop in rt6_nlmsg_size()
Eric Dumazet <[email protected]>
ipv6: add a retry logic in net6_rt_notify()
Stanislav Fomichev <[email protected]>
vrf: Drop existing dst reference in vrf_ip6_input_dst
Xiumei Mu <[email protected]>
selftests: rtnetlink.sh: remove esp4_offload after test
Jason Xing <[email protected]>
igb: xsk: solve negative overflow of nb_pkts in zerocopy mode
Jason Xing <[email protected]>
stmmac: xsk: fix negative overflow of budget in zerocopy mode
Kuniyuki Iwashima <[email protected]>
neighbour: Fix null-ptr-deref in neigh_flush_dev().
Tristram Ha <[email protected]>
net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863
Stanislav Fomichev <[email protected]>
macsec: set IFF_UNICAST_FLT priv flag
Shahar Shitrit <[email protected]>
net/mlx5e: Fix potential deadlock by deferring RX timeout recovery
Jianbo Liu <[email protected]>
net/mlx5e: Remove skb secpath if xfrm state is not found
Alexei Lazar <[email protected]>
net/mlx5e: Clear Read-Only port buffer size in PBMC before update
Yi Chen <[email protected]>
selftests: netfilter: ipvs.sh: Explicity disable rp_filter on interface tunl0
Phil Sutter <[email protected]>
selftests: netfilter: Ignore tainted kernels in interface stress test
Florian Westphal <[email protected]>
netfilter: xt_nfacct: don't assume acct name is null-terminated
Jimmy Assarsson <[email protected]>
can: kvaser_usb: Assign netdev.dev_port based on device channel index
Jimmy Assarsson <[email protected]>
can: kvaser_pciefd: Store device channel index
Randy Dunlap <[email protected]>
can: tscan1: CAN_TSCAN1 can depend on PC104
Vincent Mailhol <[email protected]>
can: tscan1: Kconfig: add COMPILE_TEST
Stephane Grosjean <[email protected]>
can: peak_usb: fix USB FD devices potential malfunction
Daniel Zahka <[email protected]>
selftests: drv-net: tso: fix non-tunneled tso6 test case name
Daniel Zahka <[email protected]>
selftests: drv-net: tso: fix vxlan tunnel flags to get correct gso_type
Daniel Zahka <[email protected]>
selftests: drv-net: tso: enable test cases based on hw_features
Gal Pressman <[email protected]>
selftests: drv-net: Fix remote command checking in require_cmd()
Gabriele Monaco <[email protected]>
tools/rv: Do not skip idle in trace
Paul Chaignon <[email protected]>
bpf: Reject narrower access to pointer ctx fields
Kuniyuki Iwashima <[email protected]>
bpf: Disable migration in nf_hook_run_bpf().
Chris Down <[email protected]>
Bluetooth: hci_event: Mask data status from LE ext adv reports
Kiran K <[email protected]>
Bluetooth: btintel_pcie: Make driver wait for alive interrupt
Kiran K <[email protected]>
Bluetooth: btintel: Define a macro for Intel Reset vendor command
Ivan Pravdin <[email protected]>
Bluetooth: hci_devcd_dump: fix out-of-bounds via dev_coredumpv
Arseniy Krasnov <[email protected]>
Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'
Zhongqiu Han <[email protected]>
Bluetooth: btusb: Fix potential NULL dereference on kmalloc failure
Ting-Ying Li <[email protected]>
wifi: brcmfmac: fix EXTSAE WPA3 connection failure due to AUTH TX failure
Lu Baolu <[email protected]>
iommu/vt-d: Fix UAF on sva unbind with pending IOPFs
Benjamin Berg <[email protected]>
wifi: iwlwifi: mld: decode EOF bit for AMPDUs
Jeremy Linton <[email protected]>
arm64/gcs: task_gcs_el0_enable() should use passed task
Johannes Berg <[email protected]>
wifi: mac80211: fix WARN_ON for monitor mode on some devices
Kees Cook <[email protected]>
wifi: brcmfmac: cyw: Fix __counted_by to be LE variant
Matthew Wilcox (Oracle) <[email protected]>
memcg_slabinfo: Fix use of PG_slab
Marco Elver <[email protected]>
kcsan: test: Initialize dummy variable
Steven Rostedt <[email protected]>
ring-buffer: Remove ring_buffer_read_prepare_sync()
Kees Cook <[email protected]>
wifi: nl80211: Set num_sub_specs before looping through sub_specs
Kees Cook <[email protected]>
wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon()
Steven Rostedt <[email protected]>
PM: cpufreq: powernv/tracing: Move powernv_throttle trace event
Gokul Sivakumar <[email protected]>
wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE
Tamizh Chelvam Raja <[email protected]>
wifi: ath12k: fix endianness handling while accessing wmi service bit
Remi Pommarel <[email protected]>
Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
Remi Pommarel <[email protected]>
wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key()
Alexander Wetzel <[email protected]>
wifi: mac80211: Don't call fq_flow_idx() for management frames
Alexander Wetzel <[email protected]>
wifi: mac80211: Do not schedule stopped TXQs
Alexander Wetzel <[email protected]>
wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac()
Murad Masimov <[email protected]>
wifi: plfxlc: Fix error handling in usb driver probe
Moon Hee Lee <[email protected]>
wifi: mac80211: reject TDLS operations when station is not associated
Tze-nan Wu <[email protected]>
rcu: Fix delayed execution of hurry callbacks
Jason Gunthorpe <[email protected]>
iommu/amd: Fix geometry.aperture_end for V2 tables
Puranjay Mohan <[email protected]>
selftests/bpf: fix implementation of smp_mb()
Alex Deucher <[email protected]>
drm/amdgpu/gfx10: fix kiq locking in KCQ reset
Alex Deucher <[email protected]>
drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset
Alex Deucher <[email protected]>
drm/amdgpu/gfx9: fix kiq locking in KCQ reset
Baochen Qiang <[email protected]>
wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()
Aaradhana Sahu <[email protected]>
wifi: ath12k: Use HTT_TCL_METADATA_VER_V1 in FTM mode
Maharaja Kennadyrajan <[email protected]>
wifi: mac80211: use RCU-safe iteration in ieee80211_csa_finish
Thomas Fourier <[email protected]>
mwl8k: Add missing check after DMA map
Bitterblue Smith <[email protected]>
wifi: rtw88: Fix macid assigned to TDLS station
Martin Kaistra <[email protected]>
wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
Eric Dumazet <[email protected]>
tcp: call tcp_measure_rcv_mss() for ooo packets
Juergen Gross <[email protected]>
xen/gntdev: remove struct gntdev_copy_batch from stack
Dmitry Baryshkov <[email protected]>
iommu/arm-smmu: disable PRR on SM8250
Ethan Milon <[email protected]>
iommu/vt-d: Fix missing PASID in dev TLB flush with cache_tag_flush_all
Jason Gunthorpe <[email protected]>
iommu/vt-d: Do not wipe out the page table NID when devices detach
Juri Lelli <[email protected]>
sched/deadline: Reset extra_bw to max_bw when clearing root domains
Juri Lelli <[email protected]>
sched/deadline: Initialize dl_servers after SMP
Al Viro <[email protected]>
xen: fix UAF in dmabuf_exp_from_pages()
Edward Srouji <[email protected]>
RDMA/mlx5: Fix UMR modifying of mkey page size
Eric Dumazet <[email protected]>
net_sched: act_ctinfo: use atomic64_t for three counters
William Liu <[email protected]>
net/sched: Restrict conditions for adding duplicating netems to qdisc tree
Thomas Weißschuh <[email protected]>
leds: lp8860: Check return value of devm_mutex_init()
Thomas Weißschuh <[email protected]>
spi: spi-nxp-fspi: Check return value of devm_mutex_init()
Easwar Hariharan <[email protected]>
iommu/amd: Enable PASID and ATS capabilities in the correct order
Tiwei Bie <[email protected]>
um: rtc: Avoid shadowing err in uml_rtc_start()
Johan Korsnes <[email protected]>
arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX
Jeff Johnson <[email protected]>
wifi: ath12k: pack HTT pdev rate stats structs
Harshitha Prem <[email protected]>
wifi: ath12k: update unsupported bandwidth flags in reg rules
Simona Vetter <[email protected]>
drm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code
Fedor Pchelkin <[email protected]>
netfilter: nf_tables: adjust lockdep assertions handling
Phil Sutter <[email protected]>
netfilter: nf_tables: Drop dead code from fill_*_info routines
Shixiong Ou <[email protected]>
fbcon: Fix outdated registered_fb reference in comment
Peter Zijlstra <[email protected]>
sched/deadline: Less agressive dl_server handling
Peter Zijlstra <[email protected]>
sched/psi: Optimize psi_group_change() cpu_clock() usage
Andy Yan <[email protected]>
drm/rockchip: vop2: Fix the update of LAYER/PORT select registers when there are multi display output on rk3588/rk3568
Heiko Stuebner <[email protected]>
drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port
Masahiro Yamada <[email protected]>
arm64: fix unnecessary rebuilding when CONFIG_DEBUG_EFI=y
Aaradhana Sahu <[email protected]>
wifi: ath12k: Block radio bring-up in FTM mode
Vitaly Prosyak <[email protected]>
drm/amdgpu: fix use-after-free in amdgpu_userq_suspend+0x51a/0x5a0
Vitaly Prosyak <[email protected]>
Revert "drm/amdgpu: fix slab-use-after-free in amdgpu_userq_mgr_fini"
Fedor Pchelkin <[email protected]>
drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
Alex Deucher <[email protected]>
drm/amdgpu/gfx10: fix KGQ reset sequence
Alex Deucher <[email protected]>
drm/amdgpu: move force completion into ring resets
Christian König <[email protected]>
drm/amdgpu: rework queue reset scheduler interaction
Emily Deng <[email protected]>
drm/amdkfd: Move the process suspend and resume out of full access
Lorenzo Bianconi <[email protected]>
wifi: mt76: mt7996: Fix valid_links bitmask in mt7996_mac_sta_{add,remove}Lorenzo Bianconi <[email protected]>
wifi: mt76: mt7996: Fix possible OOB access in mt7996_tx()
Lorenzo Bianconi <[email protected]>
wifi: mt76: mt7996: Fix secondary link lookup in mt7996_mcu_sta_mld_setup_tlv()
Artem Sadovnikov <[email protected]>
refscale: Check that nreaders and loops multiplication doesn't overflow
Finn Thain <[email protected]>
m68k: Don't unregister boot console needlessly
Konrad Dybcio <[email protected]>
drm/msm/dpu: Fill in min_prefill_lines for SC8180X
Kumar Kartikeya Dwivedi <[email protected]>
bpf: Ensure RCU lock is held around bpf_prog_ksym_find
Dan Carpenter <[email protected]>
wifi: mt76: mt7925: fix off by one in mt7925_mcu_hw_scan()
Mark Brown <[email protected]>
kselftest/arm64: Fix check for setting new VLs in sve-ptrace
Dan Carpenter <[email protected]>
wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()
Eric Dumazet <[email protected]>
net: dst: add four helpers to annotate data-races around dst->dev
Eric Dumazet <[email protected]>
net: dst: annotate data-races around dst->output
Eric Dumazet <[email protected]>
net: dst: annotate data-races around dst->input
Stav Aviram <[email protected]>
net/mlx5: Check device memory pointer before usage
xin.guo <[email protected]>
tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
Thiraviyam Mariyappan <[email protected]>
wifi: ath12k: Clear auth flag only for actual association in security mode
Sergey Senozhatsky <[email protected]>
wifi: ath11k: clear initialized flag for deinit-ed srng lists
Stanislav Fomichev <[email protected]>
team: replace team lock with rtnl lock
Shuicheng Lin <[email protected]>
drm/xe/uapi: Correct sync type definition in comments
Jiasheng Jiang <[email protected]>
iwlwifi: Add missing check for alloc_ordered_workqueue
Xiu Jianfeng <[email protected]>
wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
Vitaly Prosyak <[email protected]>
drm/amdgpu: fix slab-use-after-free in amdgpu_userq_mgr_fini+0x70c
Daniil Dulov <[email protected]>
wifi: rtl818x: Kill URBs before clearing tx status queue
Zong-Zhe Yang <[email protected]>
wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band
Eric Dumazet <[email protected]>
net: annotate races around sk->sk_uid
Arnd Bergmann <[email protected]>
caif: reduce stack size, again
Tamizh Chelvam Raja <[email protected]>
wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()
P Praneesh <[email protected]>
wifi: ath12k: Fix double budget decrement while reaping monitor ring
Kang Yang <[email protected]>
wifi: ath12k: update channel list in worker when wait flag is set
Rameshkumar Sundaram <[email protected]>
wifi: ath12k: Avoid accessing uninitialized arvif->ar during beacon miss
Haren Myneni <[email protected]>
powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add
Yuan Chen <[email protected]>
bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
Rameshkumar Sundaram <[email protected]>
wifi: mac80211: Fix bssid_indicator for MBSSID in AP mode
Erni Sri Satya Vennela <[email protected]>
net: mana: Fix potential deadlocks in mana napi ops
Alex Deucher <[email protected]>
drm/amdgpu/sdma: handle paging queues in amdgpu_sdma_reset_engine()
Lijo Lazar <[email protected]>
drm/amdgpu: Remove nbiov7.9 replay count reporting
Jonathan Corbet <[email protected]>
slub: Fix a documentation build error for krealloc()
Ian Forbes <[email protected]>
drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel
Petr Machata <[email protected]>
net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain
Mykyta Yatsenko <[email protected]>
selftests/bpf: Fix unintentional switch case fall through
Eduard Zingerman <[email protected]>
bpf: handle jset (if a & b ...) as a jump in CFG computation
Fushuai Wang <[email protected]>
selftests/bpf: fix signedness bug in redir_partial()
Charalampos Mitrodimas <[email protected]>
net, bpf: Fix RCU usage in task_cls_state() for BPF programs
Jiayuan Chen <[email protected]>
bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
Breno Leitao <[email protected]>
netconsole: Only register console drivers when targets are configured
Jiayuan Chen <[email protected]>
bpf, sockmap: Fix psock incorrectly pointing to sk
Kuan-Chung Chen <[email protected]>
wifi: rtw89: fix EHT 20MHz TX rate for non-AP STA
Fedor Pchelkin <[email protected]>
wifi: rtw89: sar: do not assert wiphy lock held until probing is done
Fedor Pchelkin <[email protected]>
wifi: rtw89: sar: drop lockdep assertion in rtw89_set_sar_from_acpi
Dan Carpenter <[email protected]>
wifi: rtw89: mcc: prevent shift wrapping in rtw89_core_mlsr_switch()
Boris Brezillon <[email protected]>
drm/panthor: Add missing explicit padding in drm_panthor_gpu_info
Adrián Larumbe <[email protected]>
drm/panfrost: Fix panfrost device variable name in devfreq
Cristian Ciocaltea <[email protected]>
drm/connector: hdmi: Evaluate limited range after computing format
Geert Uytterhoeven <[email protected]>
drm/sitronix: Remove broken backwards-compatibility layer
Andy Yan <[email protected]>
drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed
Huan Yang <[email protected]>
udmabuf: fix vmap missed offset page
Huan Yang <[email protected]>
Revert "udmabuf: fix vmap_udmabuf error page set"
Bartosz Golaszewski <[email protected]>
MIPS: alchemy: gpio: use new GPIO line value setter callbacks for the remaining chips
Steven Rostedt <[email protected]>
selftests/tracing: Fix false failure of subsystem event test
Alok Tiwari <[email protected]>
staging: nvec: Fix incorrect null termination of battery manufacturer
Inochi Amaoto <[email protected]>
riscv: dts: sophgo: sg2044: Add missing riscv,cbop-block-size property
Antheas Kapenekakis <[email protected]>
platform/x86: oxpec: Fix turbo register for G1 AMD
Michael J. Ruhl <[email protected]>
drm/xe: Correct BMG VSEC header sizing
Michael J. Ruhl <[email protected]>
drm/xe: Correct the rev value for the DVSEC entries
Slark Xiao <[email protected]>
bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640
Konrad Dybcio <[email protected]>
interconnect: qcom: qcs615: Drop IP0 interconnects
Dmitry Baryshkov <[email protected]>
interconnect: qcom: sc8180x: specify num_nodes
Dmitry Baryshkov <[email protected]>
interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg
Johan Hovold <[email protected]>
soc: qcom: pmic_glink: fix OF node leak
Brahmajit Das <[email protected]>
samples: mei: Fix building on musl libc
Johan Hovold <[email protected]>
driver core: auxiliary bus: fix OF node leak
Greg Kroah-Hartman <[email protected]>
staging: greybus: gbphy: fix up const issue with the match callback
Charles Keepax <[email protected]>
ASoC: SDCA: Allow read-only controls to be deferrable
Charles Keepax <[email protected]>
ASoC: SDCA: Update memory allocations to zero initialise
Rafael J. Wysocki <[email protected]>
kexec_core: Fix error code path in the KEXEC_JUMP flow
Jonas Karlman <[email protected]>
arm64: dts: rockchip: Fix UART DMA support for RK3528
Lifeng Zheng <[email protected]>
cpufreq: Init policy->rwsem before it may be possibly used
Lifeng Zheng <[email protected]>
cpufreq: Initialize cpufreq-based frequency-invariance later
Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode
Chanwoo Choi <[email protected]>
PM / devfreq: Fix a index typo in trans_stat
Lifeng Zheng <[email protected]>
PM / devfreq: Check governor before using governor->name
Jonas Karlman <[email protected]>
arm64: dts: rockchip: Fix pinctrl node names for RK3528
Max Krummenacher <[email protected]>
arm64: dts: freescale: imx8mp-toradex-smarc: fix lvds dsi mux gpio
Adam Ford <[email protected]>
arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed
Adam Ford <[email protected]>
arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed
Annette Kobou <[email protected]>
ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
Moon Hee Lee <[email protected]>
selftests: breakpoints: use suspend_stats to reliably check suspend success
Patrick Delaunay <[email protected]>
arm64: dts: st: fix timer used for ticks
Sebastian Reichel <[email protected]>
arm64: dts: rockchip: fix PHY handling for ROCK 4D
Sumit Gupta <[email protected]>
soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS
Christophe JAILLET <[email protected]>
staging: gpib: Fix error handling paths in cb_gpib_probe()
Harshit Mogalapalli <[email protected]>
staging: gpib: Fix error code in board_type_ioctl()
Parth Pancholi <[email protected]>
arm64: dts: ti: k3-am62p-verdin: fix PWM_3_DSI GPIO direction
Niklas Söderlund <[email protected]>
arm64: dts: renesas: r8a779g3-sparrow-hawk-fan-pwm: Add missing install target
Albin Törnqvist <[email protected]>
arm: dts: ti: omap: Fixup pinheader typo
Thomas Weißschuh <[email protected]>
tools/nolibc: avoid false-positive -Wmaybe-uninitialized through waitpid()
Lucas De Marchi <[email protected]>
usb: early: xhci-dbc: Fix early_ioremap leak
Thomas Weißschuh <[email protected]>
selftests/nolibc: correctly report errors from printf() and friends
Francesco Dolcini <[email protected]>
arm64: dts: ti: k3-am62p-verdin: add SD_1 CD pull-up
Sivan Zohar-Kotzer <[email protected]>
powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()
Greg Kroah-Hartman <[email protected]>
Revert "vmci: Prevent the dispatching of uninitialized payloads"
Thomas Weißschuh <[email protected]>
selftests: vDSO: chacha: Correctly skip test if necessary
Tim Harvey <[email protected]>
arm64: dts: imx8mp-venice-gw74xx: update name of M2SKT_WDIS2# gpio
Denis OSTERLAND-HEIM <[email protected]>
pps: fix poll support
Lizhi Xu <[email protected]>
vmci: Prevent the dispatching of uninitialized payloads
Shankari Anand <[email protected]>
rust: miscdevice: clarify invariant for MiscDeviceRegistration
Abdun Nihaal <[email protected]>
staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
Colin Ian King <[email protected]>
staging: gpib: fix unset padding field copy back to userspace
Charles Keepax <[email protected]>
ASoC: SDCA: Add missing default in switch in entity_pde_event()
Jonas Karlman <[email protected]>
arm64: dts: rockchip: Enable eMMC HS200 mode on Radxa E20C
Konrad Dybcio <[email protected]>
power: sequencing: qcom-wcn: fix bluetooth-wifi copypasta for WCN6855
Danilo Krummrich <[email protected]>
rust: devres: require T: Send for Devres
Greg Kroah-Hartman <[email protected]>
drivers: misc: sram: fix up some const issues with recent attribute changes
Clément Le Goffic <[email protected]>
spi: stm32: Check for cfg availability in stm32_spi_probe
Hans de Goede <[email protected]>
mei: vsc: Fix "BUG: Invalid wait context" lockdep error
Hans de Goede <[email protected]>
mei: vsc: Run event callback from a workqueue
Hans de Goede <[email protected]>
mei: vsc: Drop unused vsc_tp_request_irq() and vsc_tp_free_irq()
Hans de Goede <[email protected]>
mei: vsc: Unset the event callback on remove and probe errors
Hans de Goede <[email protected]>
mei: vsc: Event notifier fixes
Hans de Goede <[email protected]>
mei: vsc: Destroy mutex after freeing the IRQ
Hans de Goede <[email protected]>
mei: vsc: Don't re-init VSC from mei_vsc_hw_reset() on stop
Dmitry Baryshkov <[email protected]>
usb: typec: ucsi: yoga-c630: fix error and remove paths
Pawan Gupta <[email protected]>
x86/bugs: Allow ITS stuffing in eIBRS+retpoline mode also
Pawan Gupta <[email protected]>
x86/bugs: Introduce cdt_possible()
Pawan Gupta <[email protected]>
x86/bugs: Simplify the retbleed=stuff checks
Pawan Gupta <[email protected]>
x86/bugs: Avoid AUTO after the select step in the retbleed mitigation
Sibi Sankar <[email protected]>
firmware: arm_scmi: Fix up turbo frequencies selection
Arnd Bergmann <[email protected]>
cpufreq: armada-8k: make both cpu masks static
Ryan Wanner <[email protected]>
ARM: dts: microchip: sam9x7: Add clock name property
Ryan Wanner <[email protected]>
ARM: dts: microchip: sama7d65: Add clock name property
Michael Walle <[email protected]>
arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size
Emanuele Ghidoli <[email protected]>
arm64: dts: ti: k3-am62p-verdin: Enable pull-ups on I2C_3_HDMI
Wadim Egorov <[email protected]>
arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports
Quentin Schulz <[email protected]>
arm64: dts: rockchip: fix endpoint dtc warning for PX30 ISP
Charalampos Mitrodimas <[email protected]>
usb: misc: apple-mfi-fastcharge: Make power supply names unique
Seungjin Bae <[email protected]>
usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe()
Krzysztof Kozlowski <[email protected]>
ARM: dts: vfxxx: Correctly use two tuples for timer address
Gautham R. Shenoy <[email protected]>
pm: cpupower: Fix printing of CORE, CPU fields in cpupower-monitor
André Apitzsch <[email protected]>
arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely
Lijuan Gao <[email protected]>
arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc
Will Deacon <[email protected]>
arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes
Jie Gan <[email protected]>
arm64: dts: qcom: qcs615: disable the CTI device of the camera block
Konrad Dybcio <[email protected]>
arm64: dts: qcom: sc7180: Expand IMEM region
Konrad Dybcio <[email protected]>
arm64: dts: qcom: sdm845: Expand IMEM region
Jie Gan <[email protected]>
arm64: dts: qcom: qcs615: fix a crash issue caused by infinite loop for Coresight
Alexander Wilhelm <[email protected]>
soc: qcom: fix endianness for QMI header
Alexander Wilhelm <[email protected]>
soc: qcom: QMI encoding/decoding for big endian
Dmitry Vyukov <[email protected]>
selftests: Fix errno checking in syscall_user_dispatch test
Alexander Stein <[email protected]>
arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV
Chen-Yu Tsai <[email protected]>
ASoC: mediatek: mt8183-afe-pcm: Support >32 bit DMA addresses
Chen-Yu Tsai <[email protected]>
ASoC: mediatek: use reserved memory or enable buffer pre-allocation
Konrad Dybcio <[email protected]>
arm64: dts: qcom: x1p42100: Fix thermal sensor configuration
Arnd Bergmann <[email protected]>
ASoC: ops: dynamically allocate struct snd_ctl_elem_value
Venkata Prasad Potturu <[email protected]>
ASoC: amd: acp: Fix pointer assignments for snd_soc_acpi_mach structures
Kuninori Morimoto <[email protected]>
ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask()
Pei Xiao <[email protected]>
ASOC: rockchip: fix capture stream handling in rockchip_sai_xfer_stop
Kees Cook <[email protected]>
sched/task_stack: Add missing const qualifier to end_of_stack()
Nilay Shroff <[email protected]>
block: restore two stage elevator switch while running nr_hw_queue update
Bo Liu (OpenAnolis) <[email protected]>
erofs: fix build error with CONFIG_EROFS_FS_ZIP_ACCEL=y
Jann Horn <[email protected]>
eventpoll: fix sphinx documentation build warning
Jann Horn <[email protected]>
eventpoll: Fix semi-unbounded recursion
Sun YangKai <[email protected]>
btrfs: remove partial support for lowest level from btrfs_search_forward()
Randy Dunlap <[email protected]>
io_uring: fix breakage in EXPERT menu
John Garry <[email protected]>
block: sanitize chunk_sectors for atomic write limits
Rick Wertenbroek <[email protected]>
nvmet: pci-epf: Do not complete commands twice if nvmet_req_init() fails
Andreas Gruenbacher <[email protected]>
gfs2: No more self recovery
John Garry <[email protected]>
md/raid10: fix set but not used variable in sync_request_write()
Ming Lei <[email protected]>
ublk: validate ublk server pid
Uday Shankar <[email protected]>
ublk: speed up ublk server exit handling
Kees Cook <[email protected]>
kunit/fortify: Add back "volatile" for sizeof() constants
Zheng Qixing <[email protected]>
md: allow removing faulty rdev during resync
Ming Lei <[email protected]>
nbd: fix lockdep deadlock warning
Andreas Gruenbacher <[email protected]>
gfs2: Minor do_xmote cancelation fix
Thomas Fourier <[email protected]>
block: mtip32xx: Fix usage of dma_map_sg()
Konstantin Komarov <[email protected]>
Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
Yangtao Li <[email protected]>
hfsplus: remove mutex_lock check in hfsplus_free_extents
Yangtao Li <[email protected]>
hfs: make splice write available again
Yangtao Li <[email protected]>
hfsplus: make splice write available again
Caleb Sander Mateos <[email protected]>
ublk: use vmalloc for ublk_device's __queues
Tingmao Wang <[email protected]>
landlock: Fix warning from KUnit tests
Edward Adam Davis <[email protected]>
fs/ntfs3: cancle set bad inode after removing name fails
Song Liu <[email protected]>
selftests/landlock: Fix build of audit_test
Mickaël Salaün <[email protected]>
selftests/landlock: Fix readlink check
RubenKelevra <[email protected]>
fs_context: fix parameter name in infofc() macro
Al Viro <[email protected]>
parse_longname(): strrchr() expects NUL-terminated string
Richard Guy Briggs <[email protected]>
audit,module: restore audit logging in load failure case
-------------
Diffstat:
.gitignore | 1 + Documentation/admin-guide/kernel-parameters.txt | 8 + Documentation/filesystems/f2fs.rst | 6 +- Documentation/netlink/specs/ethtool.yaml | 6 +- Makefile | 4 +- arch/arm/boot/dts/microchip/sam9x7.dtsi | 2 + arch/arm/boot/dts/microchip/sama7d65.dtsi | 2 + .../boot/dts/nxp/imx/imx6ul-kontron-bl-common.dtsi | 1 - arch/arm/boot/dts/nxp/vf/vfxxx.dtsi | 2 +- arch/arm/boot/dts/ti/omap/am335x-boneblack.dts | 2 +- arch/arm/crypto/aes-neonbs-glue.c | 2 +- arch/arm/mach-s3c/gpio-samsung.c | 2 +- arch/arm64/boot/dts/exynos/google/gs101.dtsi | 3 + .../boot/dts/freescale/imx8mm-beacon-som.dtsi | 2 + .../boot/dts/freescale/imx8mn-beacon-som.dtsi | 2 + .../dts/freescale/imx8mp-toradex-smarc-dev.dts | 5 - .../boot/dts/freescale/imx8mp-toradex-smarc.dtsi | 2 + .../boot/dts/freescale/imx8mp-venice-gw74xx.dts | 8 +- arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi | 6 +- arch/arm64/boot/dts/qcom/msm8976.dtsi | 2 + arch/arm64/boot/dts/qcom/qcs615.dtsi | 4 + arch/arm64/boot/dts/qcom/sa8775p.dtsi | 10 +- arch/arm64/boot/dts/qcom/sc7180.dtsi | 10 +- arch/arm64/boot/dts/qcom/sdm845.dtsi | 10 +- arch/arm64/boot/dts/qcom/x1e80100.dtsi | 2 +- arch/arm64/boot/dts/qcom/x1p42100.dtsi | 556 +++++++++++++++++++ arch/arm64/boot/dts/renesas/Makefile | 1 + arch/arm64/boot/dts/rockchip/px30-evb.dts | 3 +- arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi | 3 +- arch/arm64/boot/dts/rockchip/px30.dtsi | 2 - arch/arm64/boot/dts/rockchip/rk3528-pinctrl.dtsi | 20 +- arch/arm64/boot/dts/rockchip/rk3528-radxa-e20c.dts | 1 + arch/arm64/boot/dts/rockchip/rk3528.dtsi | 16 +- arch/arm64/boot/dts/rockchip/rk3576-rock-4d.dts | 6 +- arch/arm64/boot/dts/st/stm32mp251.dtsi | 2 +- .../boot/dts/ti/k3-am62p-j722s-common-main.dtsi | 2 +- arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi | 8 +- .../boot/dts/ti/k3-am642-phyboard-electra-rdk.dts | 2 + arch/arm64/include/asm/gcs.h | 2 +- arch/arm64/include/asm/kvm_host.h | 4 + arch/arm64/kernel/Makefile | 2 +- arch/arm64/kernel/process.c | 6 +- arch/arm64/kvm/hyp/exception.c | 6 +- arch/arm64/kvm/hyp/vhe/switch.c | 14 +- arch/arm64/net/bpf_jit_comp.c | 1 + arch/m68k/Kconfig.debug | 2 +- arch/m68k/kernel/early_printk.c | 42 +- arch/m68k/kernel/head.S | 8 +- arch/mips/alchemy/common/gpiolib.c | 12 +- arch/mips/mm/tlb-r4k.c | 56 +- arch/powerpc/configs/ppc6xx_defconfig | 1 - arch/powerpc/kernel/eeh.c | 1 + arch/powerpc/kernel/eeh_driver.c | 48 +- arch/powerpc/kernel/eeh_pe.c | 10 +- arch/powerpc/kernel/pci-hotplug.c | 3 + arch/powerpc/platforms/pseries/dlpar.c | 52 +- arch/riscv/boot/dts/sophgo/sg2044-cpus.dtsi | 64 +++ arch/riscv/kvm/vcpu_onereg.c | 83 ++- arch/s390/boot/startup.c | 2 +- arch/s390/crypto/hmac_s390.c | 12 +- arch/s390/crypto/sha.h | 3 + arch/s390/crypto/sha3_256_s390.c | 22 +- arch/s390/crypto/sha3_512_s390.c | 23 +- arch/s390/include/asm/ap.h | 2 +- arch/s390/kernel/setup.c | 6 + arch/s390/mm/pgalloc.c | 5 - arch/s390/mm/vmem.c | 5 +- arch/sh/Makefile | 10 +- arch/sh/boot/compressed/Makefile | 4 +- arch/sh/boot/romimage/Makefile | 4 +- arch/um/drivers/rtc_user.c | 2 +- arch/x86/boot/cpuflags.c | 13 + arch/x86/boot/startup/sev-shared.c | 7 + arch/x86/coco/sev/core.c | 21 + arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/hw_irq.h | 12 +- arch/x86/include/asm/kvm-x86-ops.h | 1 - arch/x86/include/asm/kvm_host.h | 8 +- arch/x86/include/asm/msr-index.h | 1 + arch/x86/include/asm/sev.h | 19 + arch/x86/kernel/cpu/bugs.c | 56 +- arch/x86/kernel/cpu/scattered.c | 1 + arch/x86/kernel/irq.c | 63 ++- arch/x86/kvm/svm/svm.c | 14 +- arch/x86/kvm/vmx/main.c | 15 +- arch/x86/kvm/vmx/tdx.c | 18 +- arch/x86/kvm/vmx/vmx.c | 16 +- arch/x86/kvm/vmx/x86_ops.h | 4 +- arch/x86/kvm/x86.c | 13 +- arch/x86/mm/extable.c | 5 +- block/blk-mq.c | 84 ++- block/blk-settings.c | 19 +- block/blk.h | 2 +- block/elevator.c | 10 +- crypto/ahash.c | 13 +- crypto/krb5/selftest.c | 1 + drivers/base/auxiliary.c | 2 + drivers/block/mtip32xx/mtip32xx.c | 27 +- drivers/block/nbd.c | 12 +- drivers/block/ublk_drv.c | 49 +- drivers/block/zloop.c | 3 +- drivers/bluetooth/btintel.c | 4 +- drivers/bluetooth/btintel.h | 2 + drivers/bluetooth/btintel_pcie.c | 42 +- drivers/bluetooth/btusb.c | 14 +- drivers/bluetooth/hci_intel.c | 10 +- drivers/bus/mhi/host/pci_generic.c | 8 +- drivers/char/hw_random/mtk-rng.c | 4 +- drivers/clk/at91/sam9x7.c | 20 +- drivers/clk/clk-axi-clkgen.c | 2 +- drivers/clk/davinci/psc.c | 5 + drivers/clk/imx/clk-imx95-blk-ctl.c | 13 +- drivers/clk/renesas/rzv2h-cpg.c | 1 + drivers/clk/spacemit/ccu-k1.c | 3 +- drivers/clk/spacemit/ccu_mix.h | 11 +- drivers/clk/spacemit/ccu_pll.c | 2 +- drivers/clk/sunxi-ng/ccu-sun8i-v3s.c | 3 +- drivers/clk/thead/clk-th1520-ap.c | 102 ++-- drivers/clk/xilinx/clk-xlnx-clock-wizard.c | 2 +- drivers/clk/xilinx/xlnx_vcu.c | 4 +- drivers/cpufreq/Makefile | 1 + drivers/cpufreq/armada-8k-cpufreq.c | 3 +- drivers/cpufreq/cpufreq.c | 21 +- drivers/cpufreq/intel_pstate.c | 4 +- drivers/cpufreq/powernv-cpufreq.c | 4 +- drivers/cpufreq/powernv-trace.h | 44 ++ .../crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c | 4 +- drivers/crypto/ccp/ccp-debugfs.c | 3 + drivers/crypto/ccp/sev-dev.c | 16 +- drivers/crypto/img-hash.c | 2 +- drivers/crypto/inside-secure/safexcel_hash.c | 8 +- .../crypto/intel/keembay/keembay-ocs-hcu-core.c | 8 +- .../crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c | 9 +- .../crypto/intel/qat/qat_6xxx/adf_6xxx_hw_data.c | 20 +- .../crypto/intel/qat/qat_6xxx/adf_6xxx_hw_data.h | 2 +- .../crypto/intel/qat/qat_common/adf_gen4_hw_data.c | 29 +- drivers/crypto/intel/qat/qat_common/adf_sriov.c | 1 - .../intel/qat/qat_common/adf_transport_debug.c | 4 +- drivers/crypto/intel/qat/qat_common/qat_bl.c | 6 +- .../crypto/intel/qat/qat_common/qat_compression.c | 8 +- drivers/crypto/marvell/cesa/cipher.c | 4 +- drivers/crypto/marvell/cesa/hash.c | 5 +- drivers/cxl/core/core.h | 1 + drivers/cxl/core/edac.c | 5 +- drivers/cxl/core/hdm.c | 7 + drivers/devfreq/devfreq.c | 12 +- drivers/dma-buf/Kconfig | 1 - drivers/dma-buf/udmabuf.c | 23 +- drivers/dma/mmp_tdma.c | 2 +- drivers/dma/mv_xor.c | 21 +- drivers/dma/nbpfaxi.c | 13 + drivers/firmware/arm_scmi/perf.c | 2 +- drivers/firmware/efi/libstub/Makefile.zboot | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 24 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h | 25 +- .../gpu/drm/amd/amdgpu/amdgpu_amdkfd_arcturus.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 39 +- drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 38 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 12 +- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 12 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 9 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 10 +- drivers/gpu/drm/amd/amdgpu/jpeg_v2_0.c | 8 +- drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c | 8 +- drivers/gpu/drm/amd/amdgpu/jpeg_v3_0.c | 8 +- drivers/gpu/drm/amd/amdgpu/jpeg_v4_0.c | 8 +- drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 8 +- drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c | 8 +- drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c | 20 - drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c | 35 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 5 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 5 +- drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c | 6 +- drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c | 6 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 7 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c | 6 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c | 7 +- drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c | 7 +- drivers/gpu/drm/amd/amdkfd/kfd_device.c | 54 +- .../gpu/drm/amd/pm/powerplay/hwmgr/smu_helper.c | 2 +- drivers/gpu/drm/display/drm_hdmi_state_helper.c | 4 +- .../drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h | 1 + drivers/gpu/drm/panfrost/panfrost_devfreq.c | 4 +- drivers/gpu/drm/panthor/panthor_gem.c | 31 +- drivers/gpu/drm/panthor/panthor_gem.h | 3 - drivers/gpu/drm/rockchip/rockchip_drm_fb.c | 9 +- drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 29 +- drivers/gpu/drm/rockchip/rockchip_drm_vop2.h | 33 ++ drivers/gpu/drm/rockchip/rockchip_vop2_reg.c | 89 ++- drivers/gpu/drm/sitronix/Kconfig | 10 - drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 2 +- drivers/gpu/drm/xe/xe_configfs.c | 3 +- drivers/gpu/drm/xe/xe_device.c | 1 + drivers/gpu/drm/xe/xe_gt_sriov_pf.c | 32 +- drivers/gpu/drm/xe/xe_vsec.c | 20 +- drivers/hid/hid-apple.c | 20 +- drivers/hid/hid-core.c | 6 +- drivers/hid/hid-magicmouse.c | 60 +- drivers/i2c/muxes/i2c-mux-mule.c | 3 +- drivers/i3c/master/svc-i3c-master.c | 20 +- drivers/infiniband/core/counters.c | 2 +- drivers/infiniband/core/device.c | 27 + drivers/infiniband/core/nldev.c | 2 +- drivers/infiniband/core/rdma_core.c | 29 + drivers/infiniband/core/uverbs_cmd.c | 7 +- drivers/infiniband/core/uverbs_std_types_qp.c | 2 +- drivers/infiniband/hw/erdma/erdma_verbs.c | 3 +- drivers/infiniband/hw/hns/hns_roce_device.h | 1 + drivers/infiniband/hw/hns/hns_roce_hem.c | 18 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 87 ++- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 8 +- drivers/infiniband/hw/hns/hns_roce_main.c | 22 +- drivers/infiniband/hw/mana/qp.c | 2 +- drivers/infiniband/hw/mlx5/devx.c | 2 +- drivers/infiniband/hw/mlx5/dm.c | 2 +- drivers/infiniband/hw/mlx5/fs.c | 4 +- drivers/infiniband/hw/mlx5/umr.c | 6 +- drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 + drivers/interconnect/qcom/qcs615.c | 42 -- drivers/interconnect/qcom/sc8180x.c | 6 + drivers/interconnect/qcom/sc8280xp.c | 1 + drivers/iommu/amd/iommu.c | 19 +- drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 3 +- drivers/iommu/intel/cache.c | 18 +- drivers/iommu/intel/iommu.c | 3 +- drivers/irqchip/Kconfig | 1 + drivers/leds/flash/Kconfig | 1 + drivers/leds/leds-lp8860.c | 4 +- drivers/leds/leds-pca955x.c | 4 +- drivers/md/dm-flakey.c | 9 +- drivers/md/md.c | 41 +- drivers/md/raid10.c | 3 - drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 47 +- drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h | 1 + .../media/platform/ti/j721e-csi2rx/j721e-csi2rx.c | 1 + drivers/media/v4l2-core/v4l2-ctrls-core.c | 8 +- drivers/mfd/tps65219.c | 2 +- drivers/misc/mei/platform-vsc.c | 8 + drivers/misc/mei/vsc-tp.c | 68 +-- drivers/misc/mei/vsc-tp.h | 3 - drivers/misc/sram.c | 10 +- drivers/mtd/ftl.c | 2 +- drivers/mtd/nand/raw/atmel/nand-controller.c | 2 +- drivers/mtd/nand/raw/atmel/pmecc.c | 6 + drivers/mtd/nand/raw/rockchip-nand-controller.c | 15 + drivers/mtd/spi-nor/spansion.c | 31 ++ drivers/net/can/kvaser_pciefd.c | 1 + drivers/net/can/sja1000/Kconfig | 2 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 1 + drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 17 +- drivers/net/dsa/microchip/ksz8.c | 3 + drivers/net/dsa/microchip/ksz8_reg.h | 4 +- drivers/net/ethernet/airoha/airoha_npu.c | 2 + drivers/net/ethernet/airoha/airoha_ppe.c | 26 +- drivers/net/ethernet/emulex/benet/be_cmds.c | 2 +- drivers/net/ethernet/intel/igb/igb_xsk.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 + .../ethernet/mellanox/mlx5/core/en/port_buffer.c | 3 + .../ethernet/mellanox/mlx5/core/en/reporter_rx.c | 7 + .../mellanox/mlx5/core/en_accel/ipsec_rxtx.c | 4 + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 26 +- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 1 + drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/main.c | 3 - drivers/net/ethernet/meta/fbnic/fbnic_netdev.c | 14 +- drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 4 +- drivers/net/ethernet/meta/fbnic/fbnic_txrx.h | 6 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 28 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- drivers/net/ethernet/ti/icssg/icssg_common.c | 15 +- drivers/net/ipa/Kconfig | 2 +- drivers/net/ipa/ipa_sysfs.c | 6 +- drivers/net/macsec.c | 2 +- drivers/net/mdio/mdio-bcm-unimac.c | 5 +- drivers/net/netconsole.c | 30 +- drivers/net/phy/mscc/mscc_ptp.c | 1 + drivers/net/phy/mscc/mscc_ptp.h | 1 + drivers/net/ppp/pptp.c | 18 +- drivers/net/team/team_core.c | 96 ++-- drivers/net/team/team_mode_activebackup.c | 3 +- drivers/net/team/team_mode_loadbalance.c | 13 +- drivers/net/usb/usbnet.c | 11 +- drivers/net/vrf.c | 2 + drivers/net/wireless/ath/ath11k/hal.c | 4 + drivers/net/wireless/ath/ath11k/mac.c | 12 +- drivers/net/wireless/ath/ath12k/core.c | 1 + drivers/net/wireless/ath/ath12k/core.h | 8 +- .../net/wireless/ath/ath12k/debugfs_htt_stats.h | 6 +- drivers/net/wireless/ath/ath12k/dp.h | 1 + drivers/net/wireless/ath/ath12k/dp_mon.c | 1 - drivers/net/wireless/ath/ath12k/dp_tx.c | 10 +- drivers/net/wireless/ath/ath12k/mac.c | 120 +++- drivers/net/wireless/ath/ath12k/p2p.c | 3 +- drivers/net/wireless/ath/ath12k/reg.c | 116 +++- drivers/net/wireless/ath/ath12k/reg.h | 1 + drivers/net/wireless/ath/ath12k/wmi.c | 14 +- drivers/net/wireless/ath/ath12k/wmi.h | 2 + .../broadcom/brcm80211/brcmfmac/cfg80211.c | 38 +- .../broadcom/brcm80211/brcmfmac/cyw/core.c | 26 +- .../broadcom/brcm80211/brcmfmac/cyw/fwil_types.h | 2 +- drivers/net/wireless/intel/iwlwifi/dvm/main.c | 12 +- drivers/net/wireless/intel/iwlwifi/mld/rx.c | 9 + drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 4 +- drivers/net/wireless/marvell/mwl8k.c | 4 + drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7996/main.c | 21 +- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 3 +- drivers/net/wireless/purelifi/plfxlc/mac.c | 11 +- drivers/net/wireless/purelifi/plfxlc/mac.h | 2 +- drivers/net/wireless/purelifi/plfxlc/usb.c | 29 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 3 +- drivers/net/wireless/realtek/rtl8xxxu/core.c | 2 +- drivers/net/wireless/realtek/rtw88/main.c | 4 +- drivers/net/wireless/realtek/rtw89/core.c | 8 +- drivers/net/wireless/realtek/rtw89/phy.c | 12 +- drivers/net/wireless/realtek/rtw89/sar.c | 5 +- drivers/nvme/target/core.c | 18 +- drivers/nvme/target/pci-epf.c | 23 +- drivers/pci/controller/dwc/pcie-dw-rockchip.c | 1 + drivers/pci/controller/dwc/pcie-qcom.c | 1 + drivers/pci/controller/pcie-rockchip-host.c | 2 +- drivers/pci/controller/plda/pcie-starfive.c | 2 +- drivers/pci/endpoint/functions/pci-epf-vntb.c | 4 +- drivers/pci/hotplug/pnv_php.c | 235 +++++++- drivers/pci/pci-driver.c | 6 +- drivers/pci/pci.h | 2 +- drivers/pci/quirks.c | 6 +- drivers/perf/arm-ni.c | 2 + drivers/phy/phy-snps-eusb2.c | 3 + drivers/phy/qualcomm/phy-qcom-eusb2-repeater.c | 83 +-- drivers/pinctrl/berlin/berlin.c | 8 +- drivers/pinctrl/cirrus/pinctrl-madera-core.c | 14 +- drivers/pinctrl/pinctrl-k230.c | 13 +- drivers/pinctrl/pinmux.c | 20 +- drivers/pinctrl/sunxi/pinctrl-sunxi.c | 11 +- drivers/platform/x86/intel/pmt/class.c | 3 +- drivers/platform/x86/intel/pmt/class.h | 1 + drivers/platform/x86/oxpec.c | 37 +- drivers/power/reset/Kconfig | 1 + drivers/power/sequencing/pwrseq-qcom-wcn.c | 2 +- drivers/power/supply/cpcap-charger.c | 5 +- drivers/power/supply/max14577_charger.c | 4 +- drivers/power/supply/max1720x_battery.c | 11 +- drivers/power/supply/qcom_pmi8998_charger.c | 4 +- drivers/powercap/dtpm_cpu.c | 2 + drivers/pps/pps.c | 11 +- drivers/remoteproc/Kconfig | 11 +- drivers/remoteproc/qcom_q6v5_pas.c | 615 ++++++++++----------- drivers/remoteproc/xlnx_r5_remoteproc.c | 2 + drivers/rtc/rtc-ds1307.c | 2 +- drivers/rtc/rtc-hym8563.c | 2 +- drivers/rtc/rtc-nct3018y.c | 2 +- drivers/rtc/rtc-pcf85063.c | 2 +- drivers/rtc/rtc-pcf8563.c | 2 +- drivers/rtc/rtc-rv3028.c | 2 +- drivers/s390/crypto/ap_bus.h | 2 +- drivers/scsi/elx/efct/efct_lio.c | 2 +- drivers/scsi/ibmvscsi_tgt/libsrp.c | 6 +- drivers/scsi/isci/request.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 3 +- drivers/scsi/mvsas/mv_sas.c | 4 +- drivers/scsi/scsi.c | 8 +- drivers/scsi/scsi_transport_iscsi.c | 2 + drivers/scsi/sd.c | 4 +- drivers/soc/qcom/pmic_glink.c | 9 +- drivers/soc/qcom/qmi_encdec.c | 52 +- drivers/soc/qcom/qmi_interface.c | 6 +- drivers/soc/tegra/cbb/tegra234-cbb.c | 2 + drivers/soundwire/debugfs.c | 6 +- drivers/soundwire/mipi_disco.c | 4 +- drivers/soundwire/stream.c | 2 +- drivers/spi/spi-cs42l43.c | 2 +- drivers/spi/spi-nxp-fspi.c | 4 +- drivers/spi/spi-stm32.c | 8 +- drivers/staging/fbtft/fbtft-core.c | 1 + drivers/staging/gpib/cb7210/cb7210.c | 15 +- drivers/staging/gpib/common/gpib_os.c | 4 +- drivers/staging/greybus/gbphy.c | 6 +- .../media/atomisp/pci/atomisp_gmin_platform.c | 9 +- drivers/staging/nvec/nvec_power.c | 2 +- drivers/ufs/core/ufshcd.c | 10 +- drivers/usb/early/xhci-dbc.c | 4 + drivers/usb/gadget/composite.c | 5 + drivers/usb/gadget/function/f_hid.c | 7 +- drivers/usb/gadget/function/uvc_configfs.c | 10 + drivers/usb/host/xhci-plat.c | 2 +- drivers/usb/misc/apple-mfi-fastcharge.c | 24 +- drivers/usb/serial/option.c | 2 + drivers/usb/typec/ucsi/ucsi_yoga_c630.c | 19 +- drivers/vdpa/mlx5/core/mr.c | 3 + drivers/vdpa/mlx5/net/mlx5_vnet.c | 12 +- drivers/vdpa/vdpa_user/vduse_dev.c | 1 + drivers/vfio/device_cdev.c | 38 +- drivers/vfio/group.c | 7 +- drivers/vfio/iommufd.c | 4 + drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 1 + drivers/vfio/pci/mlx5/main.c | 1 + drivers/vfio/pci/nvgrace-gpu/main.c | 2 + drivers/vfio/pci/pds/vfio_dev.c | 2 + drivers/vfio/pci/qat/main.c | 1 + drivers/vfio/pci/vfio_pci.c | 1 + drivers/vfio/pci/vfio_pci_core.c | 24 +- drivers/vfio/pci/virtio/main.c | 3 + drivers/vfio/vfio_main.c | 3 +- drivers/vhost/Kconfig | 18 + drivers/vhost/scsi.c | 6 +- drivers/vhost/vhost.c | 244 +++++++- drivers/vhost/vhost.h | 22 + drivers/video/fbdev/core/fbcon.c | 4 +- drivers/video/fbdev/imxfb.c | 9 +- drivers/watchdog/ziirave_wdt.c | 3 + drivers/xen/gntdev-common.h | 4 + drivers/xen/gntdev-dmabuf.c | 28 +- drivers/xen/gntdev.c | 71 ++- fs/btrfs/ctree.c | 18 +- fs/ceph/crypto.c | 31 +- fs/erofs/Kconfig | 2 + fs/eventpoll.c | 58 +- fs/exfat/file.c | 5 +- fs/ext4/inline.c | 2 + fs/ext4/inode.c | 13 +- fs/ext4/page-io.c | 16 +- fs/f2fs/compress.c | 76 +-- fs/f2fs/data.c | 7 +- fs/f2fs/debug.c | 17 +- fs/f2fs/extent_cache.c | 2 +- fs/f2fs/f2fs.h | 4 +- fs/f2fs/gc.c | 1 + fs/f2fs/inode.c | 21 +- fs/f2fs/segment.h | 5 +- fs/f2fs/super.c | 1 + fs/f2fs/sysfs.c | 21 + fs/gfs2/glock.c | 3 +- fs/gfs2/util.c | 37 +- fs/hfs/inode.c | 1 + fs/hfsplus/extents.c | 3 - fs/hfsplus/inode.c | 1 + fs/jfs/jfs_dmap.c | 4 +- fs/nfs/dir.c | 4 +- fs/nfs/export.c | 11 +- fs/nfs/flexfilelayout/flexfilelayout.c | 26 +- fs/nfs/flexfilelayout/flexfilelayoutdev.c | 6 +- fs/nfs/internal.h | 9 +- fs/nfs/nfs4proc.c | 10 +- fs/nfs_common/nfslocalio.c | 28 +- fs/nfsd/localio.c | 5 +- fs/nfsd/vfs.c | 10 +- fs/notify/fanotify/fanotify.c | 8 +- fs/ntfs3/file.c | 5 +- fs/ntfs3/frecord.c | 7 +- fs/ntfs3/namei.c | 10 +- fs/ntfs3/ntfs_fs.h | 3 +- fs/orangefs/orangefs-debugfs.c | 6 +- fs/proc/generic.c | 2 + fs/proc/inode.c | 2 +- fs/proc/internal.h | 5 + fs/smb/client/cifs_debug.c | 6 +- fs/smb/client/cifsencrypt.c | 4 +- fs/smb/client/cifsfs.c | 2 +- fs/smb/client/connect.c | 9 +- fs/smb/client/fs_context.c | 19 +- fs/smb/client/fs_context.h | 18 +- fs/smb/client/link.c | 11 +- fs/smb/client/reparse.c | 2 +- fs/smb/client/smbdirect.c | 130 ++--- fs/smb/client/smbdirect.h | 4 - fs/smb/server/connection.h | 1 + fs/smb/server/smb2pdu.c | 22 +- fs/smb/server/smb_common.c | 2 +- fs/smb/server/transport_rdma.c | 97 ++-- fs/smb/server/transport_tcp.c | 17 + fs/smb/server/vfs.c | 3 +- fs/squashfs/block.c | 47 +- include/crypto/internal/hash.h | 6 + include/linux/audit.h | 9 +- include/linux/bpf-cgroup.h | 5 - include/linux/bpf.h | 60 +- include/linux/crypto.h | 3 + include/linux/fortify-string.h | 2 +- include/linux/fs_context.h | 2 +- include/linux/i3c/device.h | 4 +- include/linux/if_team.h | 3 - include/linux/ioprio.h | 3 +- include/linux/mlx5/device.h | 1 + include/linux/mmap_lock.h | 30 + include/linux/moduleparam.h | 5 +- include/linux/padata.h | 4 - include/linux/pps_kernel.h | 1 + include/linux/proc_fs.h | 1 + include/linux/psi_types.h | 6 +- include/linux/ring_buffer.h | 4 +- include/linux/sched.h | 1 + include/linux/sched/task_stack.h | 2 +- include/linux/skbuff.h | 23 + include/linux/soc/qcom/qmi.h | 6 +- include/linux/usb/usbnet.h | 1 + include/linux/vfio.h | 4 + include/linux/vfio_pci_core.h | 2 + include/net/bluetooth/hci.h | 1 + include/net/bluetooth/hci_core.h | 6 + include/net/dst.h | 24 +- include/net/lwtunnel.h | 8 +- include/net/route.h | 4 +- include/net/sock.h | 12 +- include/net/tc_act/tc_ctinfo.h | 6 +- include/net/udp.h | 24 +- include/rdma/ib_verbs.h | 12 + include/sound/tas2781-tlv.h | 2 +- include/trace/events/power.h | 22 - include/uapi/drm/panthor_drm.h | 3 + include/uapi/drm/xe_drm.h | 8 +- include/uapi/linux/vfio.h | 12 +- include/uapi/linux/vhost.h | 29 + init/Kconfig | 2 +- kernel/audit.h | 2 +- kernel/auditsc.c | 2 +- kernel/bpf/cgroup.c | 8 +- kernel/bpf/core.c | 55 +- kernel/bpf/helpers.c | 11 +- kernel/bpf/preload/Kconfig | 1 - kernel/bpf/syscall.c | 19 +- kernel/bpf/verifier.c | 1 + kernel/cgroup/cgroup-v1.c | 14 +- kernel/events/core.c | 36 +- kernel/events/uprobes.c | 4 +- kernel/kcsan/kcsan_test.c | 2 +- kernel/kexec_core.c | 3 +- kernel/module/main.c | 6 +- kernel/padata.c | 132 ++--- kernel/rcu/refscale.c | 10 +- kernel/rcu/tree_nocb.h | 2 +- kernel/sched/core.c | 2 + kernel/sched/deadline.c | 78 ++- kernel/sched/fair.c | 9 - kernel/sched/psi.c | 123 +++-- kernel/sched/sched.h | 1 + kernel/trace/power-traces.c | 1 - kernel/trace/preemptirq_delay_test.c | 13 +- kernel/trace/ring_buffer.c | 63 +-- kernel/trace/rv/monitors/scpd/Kconfig | 2 +- kernel/trace/rv/monitors/sncid/Kconfig | 2 +- kernel/trace/rv/monitors/snep/Kconfig | 2 +- kernel/trace/rv/monitors/wip/Kconfig | 2 +- kernel/trace/rv/rv_trace.h | 84 +-- kernel/trace/trace.c | 14 +- kernel/trace/trace_events_filter.c | 28 +- kernel/trace/trace_kdb.c | 8 +- kernel/ucount.c | 2 +- lib/tests/fortify_kunit.c | 4 +- mm/hmm.c | 2 +- mm/mmap_lock.c | 3 +- mm/shmem.c | 4 +- mm/slub.c | 10 +- mm/swapfile.c | 65 +-- net/bluetooth/coredump.c | 6 +- net/bluetooth/hci_event.c | 8 +- net/caif/cfctrl.c | 294 +++++----- net/core/devmem.c | 6 +- net/core/devmem.h | 7 +- net/core/dst.c | 8 +- net/core/filter.c | 23 +- net/core/neighbour.c | 88 ++- net/core/netclassid_cgroup.c | 4 +- net/core/netpoll.c | 7 + net/core/skmsg.c | 7 + net/core/sock.c | 8 +- net/ipv4/inet_connection_sock.c | 4 +- net/ipv4/ping.c | 2 +- net/ipv4/raw.c | 2 +- net/ipv4/route.c | 7 +- net/ipv4/syncookies.c | 3 +- net/ipv4/tcp_input.c | 4 +- net/ipv4/udp.c | 3 +- net/ipv6/af_inet6.c | 2 +- net/ipv6/datagram.c | 2 +- net/ipv6/inet6_connection_sock.c | 4 +- net/ipv6/ip6_fib.c | 24 +- net/ipv6/ip6_offload.c | 4 +- net/ipv6/ip6mr.c | 3 +- net/ipv6/ping.c | 2 +- net/ipv6/raw.c | 2 +- net/ipv6/route.c | 79 +-- net/ipv6/syncookies.c | 2 +- net/ipv6/tcp_ipv6.c | 2 +- net/ipv6/udp.c | 5 +- net/kcm/kcmsock.c | 6 + net/l2tp/l2tp_ip6.c | 2 +- net/mac80211/cfg.c | 12 +- net/mac80211/ieee80211_i.h | 15 + net/mac80211/main.c | 13 +- net/mac80211/tdls.c | 2 +- net/mac80211/tx.c | 14 +- net/mptcp/protocol.c | 2 +- net/netfilter/nf_bpf_link.c | 5 +- net/netfilter/nf_tables_api.c | 29 +- net/netfilter/xt_nfacct.c | 4 +- net/packet/af_packet.c | 12 +- net/sched/act_ctinfo.c | 19 +- net/sched/sch_mqprio.c | 2 +- net/sched/sch_netem.c | 40 ++ net/sched/sch_taprio.c | 21 +- net/socket.c | 8 +- net/sunrpc/svcsock.c | 43 +- net/sunrpc/xprtsock.c | 40 +- net/tls/tls_sw.c | 13 + net/vmw_vsock/af_vsock.c | 3 +- net/wireless/nl80211.c | 1 + net/wireless/reg.c | 2 + rust/kernel/devres.rs | 10 +- rust/kernel/miscdevice.rs | 8 +- samples/mei/mei-amt-version.c | 2 +- scripts/gdb/linux/constants.py.in | 12 +- scripts/kconfig/qconf.cc | 2 +- security/apparmor/include/match.h | 8 +- security/apparmor/match.c | 23 +- security/apparmor/policy_unpack_test.c | 6 +- security/landlock/id.c | 69 ++- sound/pci/hda/patch_ca0132.c | 5 +- sound/pci/hda/patch_realtek.c | 3 + sound/soc/amd/acp/acp-pci.c | 8 +- sound/soc/amd/acp/amd-acpi-mach.c | 4 +- sound/soc/amd/acp/amd.h | 8 +- sound/soc/fsl/fsl_xcvr.c | 25 +- .../soc/mediatek/common/mtk-afe-platform-driver.c | 4 +- sound/soc/mediatek/common/mtk-base-afe.h | 1 + sound/soc/mediatek/mt8173/mt8173-afe-pcm.c | 7 + sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 21 + sound/soc/mediatek/mt8186/mt8186-afe-pcm.c | 7 + sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 7 + sound/soc/rockchip/rockchip_sai.c | 16 +- sound/soc/sdca/sdca_asoc.c | 14 +- sound/soc/sdca/sdca_functions.c | 3 +- sound/soc/sdca/sdca_regmap.c | 16 +- sound/soc/soc-dai.c | 16 +- sound/soc/soc-ops.c | 28 +- sound/soc/sof/intel/Kconfig | 3 +- sound/usb/mixer_scarlett2.c | 14 +- sound/x86/intel_hdmi_audio.c | 2 +- tools/bpf/bpftool/net.c | 15 +- tools/cgroup/memcg_slabinfo.py | 4 +- tools/include/nolibc/stdio.h | 4 +- tools/include/nolibc/sys/wait.h | 2 +- tools/lib/subcmd/help.c | 12 +- tools/lib/subcmd/run-command.c | 15 +- tools/perf/.gitignore | 2 - tools/perf/arch/x86/include/arch-tests.h | 4 + tools/perf/arch/x86/tests/Build | 1 + tools/perf/arch/x86/tests/arch-tests.c | 1 + tools/perf/arch/x86/tests/topdown.c | 76 +++ tools/perf/arch/x86/util/evsel.c | 46 +- tools/perf/arch/x86/util/topdown.c | 31 +- tools/perf/arch/x86/util/topdown.h | 4 + tools/perf/builtin-sched.c | 147 +++-- tools/perf/tests/bp_account.c | 1 + tools/perf/util/build-id.c | 2 +- tools/perf/util/evsel.c | 11 + tools/perf/util/evsel.h | 2 + tools/perf/util/hwmon_pmu.c | 2 +- tools/perf/util/parse-events.c | 11 +- tools/perf/util/pmu.c | 4 +- tools/perf/util/python.c | 49 +- tools/perf/util/symbol.c | 1 + .../cpupower/utils/idle_monitor/cpupower-monitor.c | 4 - tools/power/x86/turbostat/turbostat.c | 34 +- tools/testing/selftests/alsa/utimer-test.c | 1 + tools/testing/selftests/arm64/fp/sve-ptrace.c | 2 +- tools/testing/selftests/bpf/bpf_atomic.h | 2 +- .../selftests/bpf/prog_tests/sockmap_listen.c | 2 + tools/testing/selftests/bpf/veristat.c | 1 + .../breakpoints/step_after_suspend_test.c | 41 +- tools/testing/selftests/cgroup/test_cpu.c | 63 ++- tools/testing/selftests/drivers/net/hw/tso.py | 99 ++-- tools/testing/selftests/drivers/net/lib/py/env.py | 2 +- .../ftrace/test.d/event/subsystem-enable.tc | 28 +- tools/testing/selftests/landlock/audit.h | 7 +- tools/testing/selftests/landlock/audit_test.c | 1 + tools/testing/selftests/net/netfilter/ipvs.sh | 4 +- .../net/netfilter/nft_interface_stress.sh | 5 +- tools/testing/selftests/net/rtnetlink.sh | 6 + tools/testing/selftests/net/vlan_hw_filter.sh | 16 +- tools/testing/selftests/nolibc/nolibc-test.c | 23 + tools/testing/selftests/perf_events/.gitignore | 1 + tools/testing/selftests/perf_events/Makefile | 2 +- tools/testing/selftests/perf_events/mmap.c | 236 ++++++++ .../selftests/syscall_user_dispatch/sud_test.c | 50 +- tools/testing/selftests/vDSO/vdso_test_chacha.c | 3 +- tools/verification/rv/src/in_kernel.c | 4 +- 690 files changed, 7316 insertions(+), 3614 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/627 audit,module: restore audit logging in load failure case
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Guy Briggs <[email protected]>
[ Upstream commit ae1ae11fb277f1335d6bcd4935ba0ea985af3c32 ]
The move of the module sanity check to earlier skipped the audit logging call in the case of failure and to a place where the previously used context is unavailable.
Add an audit logging call for the module loading failure case and get the module name when possible.
--- include/linux/audit.h | 9 ++++----- kernel/audit.h | 2 +- kernel/auditsc.c | 2 +- kernel/module/main.c | 6 ++++-- 4 files changed, 10 insertions(+), 9 deletions(-)
include/linux/audit.h +4 -5
@@ -417,7 +417,7 @@ extern int __audit_log_bprm_fcaps(struct linux_binprm *bprm,extern void __audit_log_capset (const struct cred *new,const struct cred *old);extern void __audit_mmap_fd (int fd,int flags);extern void __audit_openat2_how (struct open_how *how); -extern void __audit_log_kern_module (char *name); +extern void __audit_log_kern_module (const char *name);extern void __audit_fanotify (u32 response,struct fanotify_response_info_audit_rule *friar);extern void __audit_tk_injoffset (struct timespec64 offset);extern void __audit_ntp_log (const struct audit_ntp_data *ad);
@@ -519,7 +519,7 @@ static inline void audit_openat2_how(struct open_how *how)__audit_openat2_how (how); } -static inline void audit_log_kern_module (char *name) +static inline void audit_log_kern_module (const char *name) {if (!audit_dummy_context ())__audit_log_kern_module (name);
@@ -677,9 +677,8 @@ static inline void audit_mmap_fd(int fd, int flags)static inline void audit_openat2_how (struct open_how *how) { } -static inline void audit_log_kern_module (char *name) -{ -} +static inline void audit_log_kern_module (const char *name) +{ }static inline void audit_fanotify (u32 response,struct fanotify_response_info_audit_rule *friar) { }
kernel/audit.h +1 -1
@@ -200,7 +200,7 @@ struct audit_context {int argc; } execve;struct { -char *name; +const char *name; } module;struct {struct audit_ntp_data ntp_data;
kernel/auditsc.c +1 -1
@@ -2864,7 +2864,7 @@ void __audit_openat2_how(struct open_how *how) context->type =AUDIT_OPENAT2 ; } -void __audit_log_kern_module (char *name) +void __audit_log_kern_module (const char *name) {struct audit_context *context =audit_context ();
kernel/module/main.c +4 -2
@@ -3373,7 +3373,7 @@ static int load_module(struct load_info *info, const char __user *uargs, module_allocated = true; -audit_log_kern_module (mod->name); +audit_log_kern_module (info->name);/* Reserve our place in the list. */ err =add_unformed_module (mod);
@@ -3537,8 +3537,10 @@ static int load_module(struct load_info *info, const char __user *uargs,* failures once the proper module was allocated and * before that. */ -if (!module_allocated) +if (!module_allocated) { +audit_log_kern_module (info->name ? info->name :"?" );mod_stat_bump_becoming (info, flags); + }free_copy (info, flags);return err; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 2/627 parse_longname(): strrchr() expects NUL-terminated string
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 101841c38346f4ca41dc1802c867da990ffb32eb ]
... and parse_longname() is not guaranteed that. That's the reason why it uses kmemdup_nul() to build the argument for kstrtou64(); the problem is, kstrtou64() is not the only thing that need it.
Just get a NUL-terminated copy of the entire thing and be done with that...
--- fs/ceph/crypto.c | 31 ++++++++++++------------------- 1 file changed, 12 insertions(+), 19 deletions(-)
fs/ceph/crypto.c +12 -19
@@ -215,35 +215,31 @@ static struct inode *parse_longname(const struct inode *parent,struct ceph_client *cl =ceph_inode_to_client (parent);struct inode *dir =NULL ;struct ceph_vino vino = { .snap =CEPH_NOSNAP }; -char *inode_number; -char *name_end; -int orig_len = *name_len; +char *name_end, *inode_number;int ret = -EIO ; - +/* NUL-terminate */ + char *str __free(kfree) = kmemdup_nul(name, *name_len, GFP_KERNEL); +if (!str) +return ERR_PTR (-ENOMEM );/* Skip initial '_' */ - name++; - name_end =strrchr (name,'_' ); + str++; + name_end =strrchr (str,'_' );if (!name_end) { -doutc (cl,"failed to parse long snapshot name: %s\n" , name); +doutc (cl,"failed to parse long snapshot name: %s\n" , str);return ERR_PTR (-EIO ); } - *name_len = (name_end - name); + *name_len = (name_end - str);if (*name_len <=0 ) {pr_err_client (cl,"failed to parse long snapshot name\n" );return ERR_PTR (-EIO ); }/* Get the inode number */ - inode_number =kmemdup_nul (name_end +1 , - orig_len - *name_len -2 , -GFP_KERNEL ); -if (!inode_number) -return ERR_PTR (-ENOMEM ); + inode_number = name_end +1 ; ret =kstrtou64 (inode_number,10 , &vino.ino);if (ret) { -doutc (cl,"failed to parse inode number: %s\n" , name); - dir =ERR_PTR (ret); - goto out; +doutc (cl,"failed to parse inode number: %s\n" , str); +return ERR_PTR (ret); }/* And finally the inode */
@@ -254,9 +250,6 @@ static struct inode *parse_longname(const struct inode *parent,if (IS_ERR (dir))doutc (cl,"can't find inode %s (%s)\n" , inode_number, name); } - -out: -kfree (inode_number);return dir; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 3/627 fs_context: fix parameter name in infofc() macro
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: RubenKelevra <[email protected]>
[ Upstream commit ffaf1bf3737f706e4e9be876de4bc3c8fc578091 ]
The macro takes a parameter called "p" but references "fc" internally. This happens to compile as long as callers pass a variable named fc, but breaks otherwise. Rename the first parameter to “fc” to match the usage and to be consistent with warnfc() / errorfc().
--- include/linux/fs_context.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/fs_context.h +1 -1
@@ -200,7 +200,7 @@ void logfc(struct fc_log *log, const char *prefix, char level, const char *fmt,*/ #define infof (fc, fmt, ...) __logfc(fc, 'i', fmt, ## __VA_ARGS__)#define info_plog (p, fmt, ...) __plog(p, 'i', fmt, ## __VA_ARGS__) -#define infofc (p, fmt, ...) __plog((&(fc)->log), 'i', fmt, ## __VA_ARGS__) +#define infofc (fc, fmt, ...) __plog((&(fc)->log), 'i', fmt, ## __VA_ARGS__)/** * warnf - Store supplementary warning message
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 4/627 selftests/landlock: Fix readlink check
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mickaël Salaün <[email protected]>
[ Upstream commit 94a7ce26428d3a7ceb46c503ed726160578b9fcc ]
The audit_init_filter_exe() helper incorrectly checks the readlink(2) error because an unsigned integer is used to store the result. Use a signed integer for this check.
--- tools/testing/selftests/landlock/audit.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
tools/testing/selftests/landlock/audit.h +4 -3
@@ -403,11 +403,12 @@ static int audit_init_filter_exe(struct audit_filter *filter, const char *path)/* It is assume that there is not already filtering rules. */ filter->record_type =AUDIT_EXE ;if (!path) { - filter->exe_len =readlink ("/proc/self/exe" , filter->exe, -sizeof (filter->exe) -1 ); -if (filter->exe_len <0 ) +int ret =readlink ("/proc/self/exe" , filter->exe, +sizeof (filter->exe) -1 ); +if (ret <0 )return -errno; + filter->exe_len = ret;return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 5/627 selftests/landlock: Fix build of audit_test
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Song Liu <[email protected]>
[ Upstream commit dc58130bc38f09b162aa3b216f8b8f1e0a56127b ]
We are hitting build error on CentOS 9:
audit_test.c:232:40: error: ‘O_CLOEXEC’ undeclared (...)
Fix this by including fcntl.h.
--- tools/testing/selftests/landlock/audit_test.c | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/landlock/audit_test.c +1 -0
@@ -7,6 +7,7 @@#define _GNU_SOURCE#include <errno.h> +#include <fcntl.h> #include <limits.h> #include <linux/landlock.h> #include <pthread.h>
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 6/627 fs/ntfs3: cancle set bad inode after removing name fails
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit d99208b91933fd2a58ed9ed321af07dacd06ddc3 ]
The reproducer uses a file0 on a ntfs3 file system with a corrupted i_link. When renaming, the file0's inode is marked as a bad inode because the file name cannot be deleted.
The underlying bug is that make_bad_inode() is called on a live inode. In some cases it's "icache lookup finds a normal inode, d_splice_alias() is called to attach it to dentry, while another thread decides to call make_bad_inode() on it - that would evict it from icache, but we'd already found it there earlier".
In some it's outright "we have an inode attached to dentry - that's how we got it in the first place; let's call make_bad_inode() on it just for shits and giggles".
--- fs/ntfs3/frecord.c | 7 +++---- fs/ntfs3/namei.c | 10 +++------- fs/ntfs3/ntfs_fs.h | 3 +-- 3 files changed, 7 insertions(+), 13 deletions(-)
fs/ntfs3/frecord.c +3 -4
@@ -3003,8 +3003,7 @@ int ni_add_name(struct ntfs_inode *dir_ni, struct ntfs_inode *ni,* ni_rename - Remove one name and insert new name. */ int ni_rename (struct ntfs_inode *dir_ni,struct ntfs_inode *new_dir_ni, -struct ntfs_inode *ni,struct NTFS_DE *de,struct NTFS_DE *new_de, -bool *is_bad) +struct ntfs_inode *ni,struct NTFS_DE *de,struct NTFS_DE *new_de) {int err;struct NTFS_DE *de2 =NULL ;
@@ -3027,8 +3026,8 @@ int ni_rename(struct ntfs_inode *dir_ni, struct ntfs_inode *new_dir_ni, err =ni_add_name (new_dir_ni, ni, new_de);if (!err) { err =ni_remove_name (dir_ni, ni, de, &de2, &undo); -if (err &&ni_remove_name (new_dir_ni, ni, new_de, &de2, &undo)) - *is_bad = true; +WARN_ON (err &&ni_remove_name (new_dir_ni, ni, new_de, &de2, + &undo)); }/*
fs/ntfs3/namei.c +3 -7
@@ -244,7 +244,7 @@ static int ntfs_rename(struct mnt_idmap *idmap, struct inode *dir,struct ntfs_inode *ni =ntfs_i (inode);struct inode *new_inode =d_inode (new_dentry);struct NTFS_DE *de, *new_de; -bool is_same, is_bad; +bool is_same;/* * de - memory of PATH_MAX bytes: * [0-1024) - original name (dentry->d_name)
@@ -313,12 +313,8 @@ static int ntfs_rename(struct mnt_idmap *idmap, struct inode *dir,if (dir_ni != new_dir_ni)ni_lock_dir2 (new_dir_ni); - is_bad = false; - err =ni_rename (dir_ni, new_dir_ni, ni, de, new_de, &is_bad); -if (is_bad) { -/* Restore after failed rename failed too. */ -_ntfs_bad_inode (inode); - }else if (!err) { + err =ni_rename (dir_ni, new_dir_ni, ni, de, new_de); +if (!err) {simple_rename_timestamp (dir, dentry, new_dir, new_dentry);mark_inode_dirty (inode);mark_inode_dirty (dir);
fs/ntfs3/ntfs_fs.h +1 -2
@@ -577,8 +577,7 @@ int ni_add_name(struct ntfs_inode *dir_ni, struct ntfs_inode *ni, struct NTFS_DE *de);int ni_rename (struct ntfs_inode *dir_ni,struct ntfs_inode *new_dir_ni, -struct ntfs_inode *ni,struct NTFS_DE *de,struct NTFS_DE *new_de, -bool *is_bad); +struct ntfs_inode *ni,struct NTFS_DE *de,struct NTFS_DE *new_de);bool ni_is_dirty (struct inode *inode);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 7/627 landlock: Fix warning from KUnit tests
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tingmao Wang <[email protected]>
[ Upstream commit e0a69cf2c03e61bd8069becb97f66c173d0d1fa1 ]
get_id_range() expects a positive value as first argument but get_random_u8() can return 0. Fix this by clamping it.
Validated by running the test in a for loop for 1000 times.
Note that MAX() is wrong as it is only supposed to be used for constants, but max() is good here.
[..] ok 9 test_range2_rand1 [..] ok 10 test_range2_rand2 [..] ok 11 test_range2_rand15
[..] ------------[ cut here ]------------
[..] WARNING: CPU: 6 PID: 104 at security/landlock/id.c:99 test_range2_rand16 (security/landlock/id.c:99 (discriminator 1) security/landlock/id.c:234 (discriminator 1)) [..] Modules linked in:
[..] CPU: 6 UID: 0 PID: 104 Comm: kunit_try_catch Tainted: G N 6.16.0-rc1-dev-00001-g314a2f98b65f #1 PREEMPT(undef)
[..] Tainted: [N]=TEST
[..] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[..] RIP: 0010:test_range2_rand16 (security/landlock/id.c:99 (discriminator 1) security/landlock/id.c:234 (discriminator 1))
[..] Code: 49 c7 c0 10 70 30 82 4c 89 ff 48 c7 c6 a0 63 1e 83 49 c7 45 a0 e0 63 1e 83 e8 3f 95 17 00 e9 1f ff ff ff 0f 0b e9 df fd ff ff <0f> 0b ba 01 00 00 00 e9 68 fe ff ff 49 89 45 a8 49 8d 4d a0 45 31
[..] RSP: 0000:ffff888104eb7c78 EFLAGS: 00010246
[..] RAX: 0000000000000000 RBX: 000000000870822c RCX: 0000000000000000
^^^^^^^^^^^^^^^^
[..]
[..] Call Trace:
[..]
[..] ---[ end trace 0000000000000000 ]---
[..] ok 12 test_range2_rand16
[..] # landlock_id: pass:12 fail:0 skip:0 total:12 [..] # Totals: pass:12 fail:0 skip:0 total:12 [..] ok 1 landlock_id
--- security/landlock/id.c | 69 +++++++++++++++++++++++++----------------- 1 file changed, 42 insertions(+), 27 deletions(-)
security/landlock/id.c +42 -27
@@ -119,6 +119,12 @@ static u64 get_id_range(size_t number_of_ids, atomic64_t *const counter,#ifdef CONFIG_SECURITY_LANDLOCK_KUNIT_TEST +static u8 get_random_u8_positive (void ) +{ +/* max() evaluates its arguments once. */ +return max (1 ,get_random_u8 ()); +} +static void test_range1_rand0 (struct kunit *const test) {atomic64_t counter;
@@ -127,9 +133,10 @@ static void test_range1_rand0(struct kunit *const test) init =get_random_u32 ();atomic64_set (&counter, init);KUNIT_EXPECT_EQ (test,get_id_range (1 , &counter,0 ), init); -KUNIT_EXPECT_EQ ( - test,get_id_range (get_random_u8 (), &counter,get_random_u8 ()), - init +1 ); +KUNIT_EXPECT_EQ (test, +get_id_range (get_random_u8_positive (), &counter, +get_random_u8 ()), + init +1 ); }static void test_range1_rand1 (struct kunit *const test)
@@ -140,9 +147,10 @@ static void test_range1_rand1(struct kunit *const test) init =get_random_u32 ();atomic64_set (&counter, init);KUNIT_EXPECT_EQ (test,get_id_range (1 , &counter,1 ), init); -KUNIT_EXPECT_EQ ( - test,get_id_range (get_random_u8 (), &counter,get_random_u8 ()), - init +2 ); +KUNIT_EXPECT_EQ (test, +get_id_range (get_random_u8_positive (), &counter, +get_random_u8 ()), + init +2 ); }static void test_range1_rand15 (struct kunit *const test)
@@ -153,9 +161,10 @@ static void test_range1_rand15(struct kunit *const test) init =get_random_u32 ();atomic64_set (&counter, init);KUNIT_EXPECT_EQ (test,get_id_range (1 , &counter,15 ), init); -KUNIT_EXPECT_EQ ( - test,get_id_range (get_random_u8 (), &counter,get_random_u8 ()), - init +16 ); +KUNIT_EXPECT_EQ (test, +get_id_range (get_random_u8_positive (), &counter, +get_random_u8 ()), + init +16 ); }static void test_range1_rand16 (struct kunit *const test)
@@ -166,9 +175,10 @@ static void test_range1_rand16(struct kunit *const test) init =get_random_u32 ();atomic64_set (&counter, init);KUNIT_EXPECT_EQ (test,get_id_range (1 , &counter,16 ), init); -KUNIT_EXPECT_EQ ( - test,get_id_range (get_random_u8 (), &counter,get_random_u8 ()), - init +1 ); +KUNIT_EXPECT_EQ (test, +get_id_range (get_random_u8_positive (), &counter, +get_random_u8 ()), + init +1 ); }static void test_range2_rand0 (struct kunit *const test)
@@ -179,9 +189,10 @@ static void test_range2_rand0(struct kunit *const test) init =get_random_u32 ();atomic64_set (&counter, init);KUNIT_EXPECT_EQ (test,get_id_range (2 , &counter,0 ), init); -KUNIT_EXPECT_EQ ( - test,get_id_range (get_random_u8 (), &counter,get_random_u8 ()), - init +2 ); +KUNIT_EXPECT_EQ (test, +get_id_range (get_random_u8_positive (), &counter, +get_random_u8 ()), + init +2 ); }static void test_range2_rand1 (struct kunit *const test)
@@ -192,9 +203,10 @@ static void test_range2_rand1(struct kunit *const test) init =get_random_u32 ();atomic64_set (&counter, init);KUNIT_EXPECT_EQ (test,get_id_range (2 , &counter,1 ), init); -KUNIT_EXPECT_EQ ( - test,get_id_range (get_random_u8 (), &counter,get_random_u8 ()), - init +3 ); +KUNIT_EXPECT_EQ (test, +get_id_range (get_random_u8_positive (), &counter, +get_random_u8 ()), + init +3 ); }static void test_range2_rand2 (struct kunit *const test)
@@ -205,9 +217,10 @@ static void test_range2_rand2(struct kunit *const test) init =get_random_u32 ();atomic64_set (&counter, init);KUNIT_EXPECT_EQ (test,get_id_range (2 , &counter,2 ), init); -KUNIT_EXPECT_EQ ( - test,get_id_range (get_random_u8 (), &counter,get_random_u8 ()), - init +4 ); +KUNIT_EXPECT_EQ (test, +get_id_range (get_random_u8_positive (), &counter, +get_random_u8 ()), + init +4 ); }static void test_range2_rand15 (struct kunit *const test)
@@ -218,9 +231,10 @@ static void test_range2_rand15(struct kunit *const test) init =get_random_u32 ();atomic64_set (&counter, init);KUNIT_EXPECT_EQ (test,get_id_range (2 , &counter,15 ), init); -KUNIT_EXPECT_EQ ( - test,get_id_range (get_random_u8 (), &counter,get_random_u8 ()), - init +17 ); +KUNIT_EXPECT_EQ (test, +get_id_range (get_random_u8_positive (), &counter, +get_random_u8 ()), + init +17 ); }static void test_range2_rand16 (struct kunit *const test)
@@ -231,9 +245,10 @@ static void test_range2_rand16(struct kunit *const test) init =get_random_u32 ();atomic64_set (&counter, init);KUNIT_EXPECT_EQ (test,get_id_range (2 , &counter,16 ), init); -KUNIT_EXPECT_EQ ( - test,get_id_range (get_random_u8 (), &counter,get_random_u8 ()), - init + 2); +KUNIT_EXPECT_EQ (test, +get_id_range (get_random_u8_positive (), &counter, +get_random_u8 ()), + init + 2); }#endif /* CONFIG_SECURITY_LANDLOCK_KUNIT_TEST */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 8/627 ublk: use vmalloc for ublk_devices __queues
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Caleb Sander Mateos <[email protected]>
[ Upstream commit c2f48453b7806d41f5a3270f206a5cd5640ed207 ]
struct ublk_device's __queues points to an allocation with up to UBLK_MAX_NR_QUEUES (4096) queues, each of which have:
- struct ublk_queue (48 bytes)
- Tail array of up to UBLK_MAX_QUEUE_DEPTH (4096) struct ublk_io's, 32 bytes each
This means the full allocation can exceed 512 MB, which may well be impossible to service with contiguous physical pages. Switch to kvcalloc() and kvfree(), since there is no need for physically contiguous memory.
--- drivers/block/ublk_drv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/block/ublk_drv.c +2 -2
@@ -2513,7 +2513,7 @@ static void ublk_deinit_queues(struct ublk_device *ub)for (i =0 ; i < nr_queues; i++)ublk_deinit_queue (ub, i); -kfree (ub->__queues); +kvfree (ub->__queues); }static int ublk_init_queues (struct ublk_device *ub)
@@ -2524,7 +2524,7 @@ static int ublk_init_queues(struct ublk_device *ub)int i, ret = -ENOMEM ; ub->queue_size = ubq_size; - ub->__queues =kcalloc (nr_queues, ubq_size,GFP_KERNEL ); + ub->__queues =kvcalloc (nr_queues, ubq_size,GFP_KERNEL );if (!ub->__queues)return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 9/627 hfsplus: make splice write available again
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yangtao Li <[email protected]>
[ Upstream commit 2eafb669da0bf71fac0838bff13594970674e2b4 ]
Since 5.10, splice() or sendfile() return EINVAL. This was caused by commit 36e2c7421f02 ("fs: don't allow splice read/write without explicit ops").
This patch initializes the splice_write field in file_operations, like most file systems do, to restore the functionality.
--- fs/hfsplus/inode.c | 1 + 1 file changed, 1 insertion(+)
fs/hfsplus/inode.c +1 -0
@@ -368,6 +368,7 @@ static const struct file_operations hfsplus_file_operations = { .write_iter = generic_file_write_iter, .mmap = generic_file_mmap, .splice_read = filemap_splice_read, + .splice_write = iter_file_splice_write, .fsync = hfsplus_file_fsync, .open = hfsplus_file_open, .release = hfsplus_file_release,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 10/627 hfs: make splice write available again
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yangtao Li <[email protected]>
[ Upstream commit 4c831f30475a222046ded25560c3810117a6cff6 ]
Since 5.10, splice() or sendfile() return EINVAL. This was caused by commit 36e2c7421f02 ("fs: don't allow splice read/write without explicit ops").
This patch initializes the splice_write field in file_operations, like most file systems do, to restore the functionality.
--- fs/hfs/inode.c | 1 + 1 file changed, 1 insertion(+)
fs/hfs/inode.c +1 -0
@@ -692,6 +692,7 @@ static const struct file_operations hfs_file_operations = { .write_iter = generic_file_write_iter, .mmap = generic_file_mmap, .splice_read = filemap_splice_read, + .splice_write = iter_file_splice_write, .fsync = hfs_file_fsync, .open = hfs_file_open, .release = hfs_file_release,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 11/627 hfsplus: remove mutex_lock check in hfsplus_free_extents
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yangtao Li <[email protected]>
[ Upstream commit fcb96956c921f1aae7e7b477f2435c56f77a31b4 ]
Syzbot reported an issue in hfsplus filesystem:
------------[ cut here ]------------ WARNING: CPU: 0 PID: 4400 at fs/hfsplus/extents.c:346 hfsplus_free_extents+0x700/0xad0 Call Trace: <TASK> hfsplus_file_truncate+0x768/0xbb0 fs/hfsplus/extents.c:606 hfsplus_write_begin+0xc2/0xd0 fs/hfsplus/inode.c:56 cont_expand_zero fs/buffer.c:2383 [inline] cont_write_begin+0x2cf/0x860 fs/buffer.c:2446 hfsplus_write_begin+0x86/0xd0 fs/hfsplus/inode.c:52 generic_cont_expand_simple+0x151/0x250 fs/buffer.c:2347 hfsplus_setattr+0x168/0x280 fs/hfsplus/inode.c:263 notify_change+0xe38/0x10f0 fs/attr.c:420 do_truncate+0x1fb/0x2e0 fs/open.c:65 do_sys_ftruncate+0x2eb/0x380 fs/open.c:193 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
To avoid deadlock, Commit 31651c607151 ("hfsplus: avoid deadlock on file truncation") unlock extree before hfsplus_free_extents(), and add check wheather extree is locked in hfsplus_free_extents().
However, when operations such as hfsplus_file_release, hfsplus_setattr, hfsplus_unlink, and hfsplus_get_block are executed concurrently in different files, it is very likely to trigger the WARN_ON, which will lead syzbot and xfstest to consider it as an abnormality.
The comment above this warning also describes one of the easy triggering situations, which can easily trigger and cause xfstest&syzbot to report errors.
[task A] [task B]
->hfsplus_file_release
->hfsplus_file_truncate
->hfs_find_init
->mutex_lock
->mutex_unlock
->hfsplus_write_begin
->hfsplus_get_block
->hfsplus_file_extend
->hfsplus_ext_read_extent
->hfs_find_init
->mutex_lock
->hfsplus_free_extents
WARN_ON(mutex_is_locked) !!!Several threads could try to lock the shared extents tree. And warning can be triggered in one thread when another thread has locked the tree. This is the wrong behavior of the code and we need to remove the warning.
--- fs/hfsplus/extents.c | 3 --- 1 file changed, 3 deletions(-)
fs/hfsplus/extents.c +0 -3
@@ -342,9 +342,6 @@ static int hfsplus_free_extents(struct super_block *sb,int i;int err =0 ; -/* Mapping the allocation file may lock the extent tree */ -WARN_ON (mutex_is_locked (&HFSPLUS_SB (sb)->ext_tree->tree_lock)); -hfsplus_dump_extent (extent);for (i =0 ; i <8 ; extent++, i++) { count =be32_to_cpu (extent->block_count);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 12/627 Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit a49f0abd8959048af18c6c690b065eb0d65b2d21 ]
This reverts commit 69505fe98f198ee813898cbcaf6770949636430b.
Initially, conditional lock acquisition was removed to fix an xfstest bug that was observed during internal testing. The deadlock reported by syzbot is resolved by reintroducing conditional acquisition. The xfstest bug no longer occurs on kernel version 6.16-rc1 during internal testing. I assume that changes in other modules may have contributed to this.
--- fs/ntfs3/file.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/ntfs3/file.c +4 -1
@@ -310,7 +310,10 @@ static int ntfs_file_mmap(struct file *file, struct vm_area_struct *vma) }if (ni->i_valid < to) { -inode_lock (inode); +if (!inode_trylock (inode)) { + err = -EAGAIN ; + goto out; + } err =ntfs_extend_initialized_size (file, ni, ni->i_valid, to);inode_unlock (inode);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 13/627 block: mtip32xx: Fix usage of dma_map_sg()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
[ Upstream commit 8e1fab9cccc7b806b0cffdceabb09b310b83b553 ]
The dma_map_sg() can fail and, in case of failure, returns 0. If it fails, mtip_hw_submit_io() returns an error.
The dma_unmap_sg() requires the nents parameter to be the same as the one passed to dma_map_sg(). This patch saves the nents in command->scatter_ents.
--- drivers/block/mtip32xx/mtip32xx.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-)
drivers/block/mtip32xx/mtip32xx.c +17 -10
@@ -2040,11 +2040,12 @@ static int mtip_hw_ioctl(struct driver_data *dd, unsigned int cmd,* @dir Direction (read or write) * * return value -* None +* 0 The IO completed successfully. +* -ENOMEM The DMA mapping failed. */ -static void mtip_hw_submit_io (struct driver_data *dd,struct request *rq, -struct mtip_cmd *command, -struct blk_mq_hw_ctx *hctx) +static int mtip_hw_submit_io (struct driver_data *dd,struct request *rq, +struct mtip_cmd *command, +struct blk_mq_hw_ctx *hctx) {struct mtip_cmd_hdr *hdr = dd->port->command_list +sizeof (struct mtip_cmd_hdr ) * rq->tag;
@@ -2056,12 +2057,14 @@ static void mtip_hw_submit_io(struct driver_data *dd, struct request *rq,unsigned int nents;/* Map the scatter list for DMA access */ - nents =blk_rq_map_sg (rq, command->sg); - nents =dma_map_sg (&dd->pdev->dev, command->sg, nents, dma_dir); + command->scatter_ents =blk_rq_map_sg (rq, command->sg); + nents =dma_map_sg (&dd->pdev->dev, command->sg, + command->scatter_ents, dma_dir); +if (!nents) +return -ENOMEM ; -prefetch (&port->flags); - command->scatter_ents = nents; +prefetch (&port->flags);/* * The number of retries for this command before it is
@@ -2112,11 +2115,13 @@ static void mtip_hw_submit_io(struct driver_data *dd, struct request *rq,if (unlikely (port->flags &MTIP_PF_PAUSE_IO )) {set_bit (rq->tag, port->cmds_to_issue);set_bit (MTIP_PF_ISSUE_CMDS_BIT , &port->flags); -return ; +return 0 ; }/* Issue the command to the hardware */ mtip_issue_ncq_command (port, rq->tag); + +return 0 ; }/*
@@ -3315,7 +3320,9 @@ static blk_status_t mtip_queue_rq(struct blk_mq_hw_ctx *hctx,blk_mq_start_request (rq); -mtip_hw_submit_io (dd, rq, cmd, hctx); +if (mtip_hw_submit_io (dd, rq, cmd, hctx)) +return BLK_STS_IOERR ; +return BLK_STS_OK ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 14/627 gfs2: Minor do_xmote cancelation fix
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit 75bb2ddea9640b663e4b2eaa06e15196f6f11a95 ]
Commit 6cb3b1c2df87 changed how finish_xmote() clears the GLF_LOCK flag, but it failed to adjust the equivalent code in do_xmote(). Fix that.
--- fs/gfs2/glock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/gfs2/glock.c +2 -1
@@ -802,7 +802,8 @@ __acquires(&gl->gl_lockref.lock)* We skip telling dlm to do the locking, so we won't get a * reply that would otherwise clear GLF_LOCK. So we clear it here. */ -clear_bit (GLF_LOCK , &gl->gl_flags); +if (!test_bit (GLF_CANCELING , &gl->gl_flags)) +clear_bit (GLF_LOCK , &gl->gl_flags);clear_bit (GLF_DEMOTE_IN_PROGRESS , &gl->gl_flags);gfs2_glock_queue_work (gl,GL_GLOCK_DFT_HOLD );return ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 15/627 nbd: fix lockdep deadlock warning
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
[ Upstream commit 8b428f42f3edfd62422aa7ad87049ab232a2eaa9 ]
nbd grabs device lock nbd->config_lock for updating nr_hw_queues, this ways cause the following lock dependency:
-> #2 (&disk->open_mutex){+.+.}-{4:4}:
lock_acquire kernel/locking/lockdep.c:5871 [inline]
lock_acquire+0x1ac/0x448 kernel/locking/lockdep.c:5828
__mutex_lock_common kernel/locking/mutex.c:602 [inline]
__mutex_lock+0x166/0x1292 kernel/locking/mutex.c:747
mutex_lock_nested+0x14/0x1c kernel/locking/mutex.c:799
__del_gendisk+0x132/0xac6 block/genhd.c:706
del_gendisk+0xf6/0x19a block/genhd.c:819
nbd_dev_remove+0x3c/0xf2 drivers/block/nbd.c:268
nbd_dev_remove_work+0x1c/0x26 drivers/block/nbd.c:284
process_one_work+0x96a/0x1f32 kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3321 [inline]
worker_thread+0x5ce/0xde8 kernel/workqueue.c:3402
kthread+0x39c/0x7d4 kernel/kthread.c:464
ret_from_fork_kernel+0x2a/0xbb2 arch/riscv/kernel/process.c:214
ret_from_fork_kernel_asm+0x16/0x18 arch/riscv/kernel/entry.S:327-> #1 (&set->update_nr_hwq_lock){++++}-{4:4}:
lock_acquire kernel/locking/lockdep.c:5871 [inline]
lock_acquire+0x1ac/0x448 kernel/locking/lockdep.c:5828
down_write+0x9c/0x19a kernel/locking/rwsem.c:1577
blk_mq_update_nr_hw_queues+0x3e/0xb86 block/blk-mq.c:5041
nbd_start_device+0x140/0xb2c drivers/block/nbd.c:1476
nbd_genl_connect+0xae0/0x1b24 drivers/block/nbd.c:2201
genl_family_rcv_msg_doit+0x206/0x2e6 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x514/0x78e net/netlink/genetlink.c:1210
netlink_rcv_skb+0x206/0x3be net/netlink/af_netlink.c:2534
genl_rcv+0x36/0x4c net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
netlink_unicast+0x4f0/0x82c net/netlink/af_netlink.c:1339
netlink_sendmsg+0x85e/0xdd6 net/netlink/af_netlink.c:1883
sock_sendmsg_nosec net/socket.c:712 [inline]
__sock_sendmsg+0xcc/0x160 net/socket.c:727
____sys_sendmsg+0x63e/0x79c net/socket.c:2566
___sys_sendmsg+0x144/0x1e6 net/socket.c:2620
__sys_sendmsg+0x188/0x246 net/socket.c:2652
__do_sys_sendmsg net/socket.c:2657 [inline]
__se_sys_sendmsg net/socket.c:2655 [inline]
__riscv_sys_sendmsg+0x70/0xa2 net/socket.c:2655
syscall_handler+0x94/0x118 arch/riscv/include/asm/syscall.h:112
do_trap_ecall_u+0x396/0x530 arch/riscv/kernel/traps.c:341
handle_exception+0x146/0x152 arch/riscv/kernel/entry.S:197-> #0 (&nbd->config_lock){+.+.}-{4:4}:
check_noncircular+0x132/0x146 kernel/locking/lockdep.c:2178
check_prev_add kernel/locking/lockdep.c:3168 [inline]
check_prevs_add kernel/locking/lockdep.c:3287 [inline]
validate_chain kernel/locking/lockdep.c:3911 [inline]
__lock_acquire+0x12b2/0x24ea kernel/locking/lockdep.c:5240
lock_acquire kernel/locking/lockdep.c:5871 [inline]
lock_acquire+0x1ac/0x448 kernel/locking/lockdep.c:5828
__mutex_lock_common kernel/locking/mutex.c:602 [inline]
__mutex_lock+0x166/0x1292 kernel/locking/mutex.c:747
mutex_lock_nested+0x14/0x1c kernel/locking/mutex.c:799
refcount_dec_and_mutex_lock+0x60/0xd8 lib/refcount.c:118
nbd_config_put+0x3a/0x610 drivers/block/nbd.c:1423
nbd_release+0x94/0x15c drivers/block/nbd.c:1735
blkdev_put_whole+0xac/0xee block/bdev.c:721
bdev_release+0x3fe/0x600 block/bdev.c:1144
blkdev_release+0x1a/0x26 block/fops.c:684
__fput+0x382/0xa8c fs/file_table.c:465
____fput+0x1c/0x26 fs/file_table.c:493
task_work_run+0x16a/0x25e kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0x118/0x134 kernel/entry/common.c:114
exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
do_trap_ecall_u+0x3f0/0x530 arch/riscv/kernel/traps.c:355
handle_exception+0x146/0x152 arch/riscv/kernel/entry.S:197Also it isn't necessary to require nbd->config_lock, because blk_mq_update_nr_hw_queues() does grab tagset lock for sync everything.
Fixes the issue by releasing ->config_lock & retry in case of concurrent updating nr_hw_queues.
--- drivers/block/nbd.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/block/nbd.c +11 -1
@@ -1473,7 +1473,17 @@ static int nbd_start_device(struct nbd_device *nbd)return -EINVAL ; } -blk_mq_update_nr_hw_queues (&nbd->tag_set, config->num_connections); +retry: +mutex_unlock (&nbd->config_lock); +blk_mq_update_nr_hw_queues (&nbd->tag_set, num_connections); +mutex_lock (&nbd->config_lock); + +/* if another code path updated nr_hw_queues, retry until succeed */ +if (num_connections != config->num_connections) { + num_connections = config->num_connections; + goto retry; + } + nbd->pid =task_pid_nr (current);nbd_parse_flags (nbd);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 16/627 md: allow removing faulty rdev during resync
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Qixing <[email protected]>
[ Upstream commit c0ffeb648000acdc932da7a9d33fd65e9263c54c ]
During RAID resync, faulty rdev cannot be removed and will result in "Device or resource busy" error when attempting hot removal.
Reproduction steps:
mdadm -Cv /dev/md0 -l1 -n3 -e1.2 /dev/sd{b..d}
mdadm /dev/md0 -f /dev/sdb
mdadm /dev/md0 -r /dev/sdb
-> mdadm: hot remove failed for /dev/sdb: Device or resource busy
After commit 4b10a3bc67c1 ("md: ensure resync is prioritized over recovery"), when a device becomes faulty during resync, the md_choose_sync_action() function returns early without calling remove_and_add_spares(), preventing faulty device removal.
This patch extracts a helper function remove_spares() to support removing faulty devices during RAID resync operations.
--- drivers/md/md.c | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-)
drivers/md/md.c +17 -7
@@ -9456,17 +9456,11 @@ static bool md_spares_need_change(struct mddev *mddev)return false; } -static int remove_and_add_spares (struct mddev *mddev, -struct md_rdev *this) +static int remove_spares (struct mddev *mddev,struct md_rdev *this) {struct md_rdev *rdev; -int spares =0 ;int removed =0 ; -if (this &&test_bit (MD_RECOVERY_RUNNING , &mddev->recovery)) -/* Mustn't remove devices when resync thread is running */ -return 0 ; -rdev_for_each (rdev, mddev) {if ((this ==NULL || rdev == this) &&rdev_removeable (rdev) && !mddev->pers->hot_remove_disk (mddev, rdev)) {
@@ -9480,6 +9474,21 @@ static int remove_and_add_spares(struct mddev *mddev,if (removed && mddev->kobj.sd)sysfs_notify_dirent_safe (mddev->sysfs_degraded); +return removed; +} + +static int remove_and_add_spares (struct mddev *mddev, +struct md_rdev *this) +{ +struct md_rdev *rdev; +int spares =0 ; +int removed =0 ; + +if (this &&test_bit (MD_RECOVERY_RUNNING , &mddev->recovery)) +/* Mustn't remove devices when resync thread is running */ +return 0 ; + + removed =remove_spares (mddev, this);if (this && removed) goto no_add;
@@ -9522,6 +9531,7 @@ static bool md_choose_sync_action(struct mddev *mddev, int *spares)/* Check if resync is in progress. */ if (mddev->recovery_cp < MaxSector) { +remove_spares (mddev,NULL );set_bit (MD_RECOVERY_SYNC , &mddev->recovery);clear_bit (MD_RECOVERY_RECOVER , &mddev->recovery);return true;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 17/627 kunit/fortify: Add back "volatile" for sizeof() constants
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 10299c07c94aa0997fa43523b53301e713a6415d ]
It seems the Clang can see through OPTIMIZER_HIDE_VAR when the constant is coming from sizeof. Adding "volatile" back to these variables solves this false positive without reintroducing the issues that originally led to switching to OPTIMIZER_HIDE_VAR in the first place[1].
--- lib/tests/fortify_kunit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
lib/tests/fortify_kunit.c +2 -2
@@ -1003,8 +1003,8 @@ static void fortify_test_memcmp(struct kunit *test) {char one[] ="My mind is going ..." ;char two[] ="My mind is going ... I can feel it." ; -size_t one_len =sizeof (one) -1 ; -size_t two_len =sizeof (two) -1 ; +volatile size_t one_len =sizeof (one) -1 ; +volatile size_t two_len =sizeof (two) -1 ;OPTIMIZER_HIDE_VAR (one_len);OPTIMIZER_HIDE_VAR (two_len);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 18/627 ublk: speed up ublk server exit handling
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uday Shankar <[email protected]>
[ Upstream commit 2fa9c93035e17380cafa897ee1a4d503881a3770 ]
Recently, we've observed a few cases where a ublk server is able to complete restart more quickly than the driver can process the exit of the previous ublk server. The new ublk server comes up, attempts recovery of the preexisting ublk devices, and observes them still in state UBLK_S_DEV_LIVE. While this is possible due to the asynchronous nature of io_uring cleanup and should therefore be handled properly in the ublk server, it is still preferable to make ublk server exit handling faster if possible, as we should strive for it to not be a limiting factor in how fast a ublk server can restart and provide service again.
Analysis of the issue showed that the vast majority of the time spent in handling the ublk server exit was in calls to blk_mq_quiesce_queue, which is essentially just a (relatively expensive) call to synchronize_rcu. The ublk server exit path currently issues an unnecessarily large number of calls to blk_mq_quiesce_queue, for two reasons:
1. It tries to call blk_mq_quiesce_queue once per ublk_queue. However, blk_mq_quiesce_queue targets the request_queue of the underlying ublk device, of which there is only one. So the number of calls is larger than necessary by a factor of nr_hw_queues.
2. In practice, it calls blk_mq_quiesce_queue _more_ than once per ublk_queue. This is because of a data race where we read ubq->canceling without any locking when deciding if we should call ublk_start_cancel. It is thus possible for two calls to ublk_uring_cmd_cancel_fn against the same ublk_queue to both call ublk_start_cancel against the same ublk_queue.
Fix this by making the "canceling" flag a per-device state. This actually matches the existing code better, as there are several places where the flag is set or cleared for all queues simultaneously, and there is the general expectation that cancellation corresponds with ublk server exit. This per-device canceling flag is then checked under a (new) lock (addressing the data race (2) above), and the queue is only quiesced if it is cleared (addressing (1) above). The result is just one call to blk_mq_quiesce_queue per ublk device.
To minimize the number of cache lines that are accessed in the hot path, the per-queue canceling flag is kept. The values of the per-device canceling flag and all per-queue canceling flags should always match.
In our setup, where one ublk server handles I/O for 128 ublk devices, each having 24 hardware queues of depth 4096, here are the results before and after this patch, where teardown time is measured from the first call to io_ring_ctx_wait_and_kill to the return from the last ublk_ch_release:
before after
number of calls to blk_mq_quiesce_queue: 6469 256
teardown time: 11.14s 2.44s
There are still some potential optimizations here, but this takes care of a big chunk of the ublk server exit handling delay.
Stable-dep-of: c2c8089f325e ("ublk: validate ublk server pid")
--- drivers/block/ublk_drv.c | 36 +++++++++++++++++++++--------------- 1 file changed, 21 insertions(+), 15 deletions(-)
drivers/block/ublk_drv.c +21 -15
@@ -216,6 +216,8 @@ struct ublk_device {struct completion completion;unsigned int nr_queues_ready;unsigned int nr_privileged_daemon; +struct mutex cancel_mutex; +bool canceling; };/* header of ublk_params */
@@ -1578,6 +1580,7 @@ static int ublk_ch_release(struct inode *inode, struct file *filp)* All requests may be inflight, so ->canceling may not be set, set * it now. */ + ub->canceling = true;for (i =0 ; i < ub->dev_info.nr_hw_queues; i++) {struct ublk_queue *ubq =ublk_get_queue (ub, i);
@@ -1706,23 +1709,18 @@ static void ublk_abort_queue(struct ublk_device *ub, struct ublk_queue *ubq) } } -/* Must be called when queue is frozen */ -static void ublk_mark_queue_canceling (struct ublk_queue *ubq) -{ -spin_lock (&ubq->cancel_lock); -if (!ubq->canceling) - ubq->canceling = true; -spin_unlock (&ubq->cancel_lock); -} - -static void ublk_start_cancel (struct ublk_queue *ubq) +static void ublk_start_cancel (struct ublk_device *ub) { -struct ublk_device *ub = ubq->dev;struct gendisk *disk =ublk_get_disk (ub); +int i;/* Our disk has been dead */ if (!disk)return ; + +mutex_lock (&ub->cancel_mutex); +if (ub->canceling) + goto out;/* * Now we are serialized with ublk_queue_rq() *
@@ -1731,8 +1729,12 @@ static void ublk_start_cancel(struct ublk_queue *ubq)* touch completed uring_cmd */ blk_mq_quiesce_queue (disk->queue); -ublk_mark_queue_canceling (ubq); + ub->canceling = true; +for (i =0 ; i < ub->dev_info.nr_hw_queues; i++) +ublk_get_queue (ub, i)->canceling = true;blk_mq_unquiesce_queue (disk->queue); +out: +mutex_unlock (&ub->cancel_mutex);ublk_put_disk (disk); }
@@ -1805,8 +1807,7 @@ static void ublk_uring_cmd_cancel_fn(struct io_uring_cmd *cmd,if (WARN_ON_ONCE (task && task != io->task))return ; -if (!ubq->canceling) -ublk_start_cancel (ubq); +ublk_start_cancel (ubq->dev);WARN_ON_ONCE (io->cmd != cmd);ublk_cancel_cmd (ubq, pdu->tag, issue_flags);
@@ -1933,6 +1934,7 @@ static void ublk_reset_io_flags(struct ublk_device *ub) ubq->canceling = false; ubq->fail_io = false; } + ub->canceling = false; }/* device can only be started after all IOs are ready */
@@ -2580,6 +2582,7 @@ static void ublk_cdev_rel(struct device *dev)ublk_deinit_queues (ub);ublk_free_dev_number (ub);mutex_destroy (&ub->mutex); +mutex_destroy (&ub->cancel_mutex);kfree (ub); }
@@ -2933,6 +2936,7 @@ static int ublk_ctrl_add_dev(const struct ublksrv_ctrl_cmd *header) goto out_unlock;mutex_init (&ub->mutex);spin_lock_init (&ub->lock); +mutex_init (&ub->cancel_mutex); ret =ublk_alloc_dev_number (ub, header->dev_id);if (ret <0 )
@@ -3003,6 +3007,7 @@ static int ublk_ctrl_add_dev(const struct ublksrv_ctrl_cmd *header)ublk_free_dev_number (ub); out_free_ub:mutex_destroy (&ub->mutex); +mutex_destroy (&ub->cancel_mutex);kfree (ub); out_unlock:mutex_unlock (&ublk_ctl_mutex);
@@ -3357,8 +3362,9 @@ static int ublk_ctrl_quiesce_dev(struct ublk_device *ub,if (ub->dev_info.state !=UBLK_S_DEV_LIVE ) goto put_disk; -/* Mark all queues as canceling */ +/* Mark the device as canceling */ blk_mq_quiesce_queue (disk->queue); + ub->canceling = true;for (i =0 ; i < ub->dev_info.nr_hw_queues; i++) {struct ublk_queue *ubq =ublk_get_queue (ub, i);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 19/627 ublk: validate ublk server pid
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
[ Upstream commit c2c8089f325ed703fd5123b39e2dece1dd605904 ]
ublk server pid(the tgid of the process opening the ublk device) is stored in ublk_device->ublksrv_tgid. This tgid is then checked against the ublksrv_pid in ublk_ctrl_start_dev and ublk_ctrl_end_recovery.
This ensures that correct ublk server pid is stored in device info.
--- drivers/block/ublk_drv.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/block/ublk_drv.c +9 -0
@@ -218,6 +218,7 @@ struct ublk_device {unsigned int nr_privileged_daemon;struct mutex cancel_mutex;bool canceling; +pid_t ublksrv_tgid; };/* header of ublk_params */
@@ -1517,6 +1518,7 @@ static int ublk_ch_open(struct inode *inode, struct file *filp)if (test_and_set_bit (UB_STATE_OPEN , &ub->state))return -EBUSY ; filp->private_data = ub; + ub->ublksrv_tgid = current->tgid;return 0 ; }
@@ -1531,6 +1533,7 @@ static void ublk_reset_ch_dev(struct ublk_device *ub) ub->mm =NULL ; ub->nr_queues_ready =0 ; ub->nr_privileged_daemon =0 ; + ub->ublksrv_tgid =-1 ; }static struct gendisk *ublk_get_disk (struct ublk_device *ub)
@@ -2732,6 +2735,9 @@ static int ublk_ctrl_start_dev(struct ublk_device *ub,if (wait_for_completion_interruptible (&ub->completion) !=0 )return -EINTR ; +if (ub->ublksrv_tgid != ublksrv_pid) +return -EINVAL ; +mutex_lock (&ub->mutex);if (ub->dev_info.state ==UBLK_S_DEV_LIVE ||test_bit (UB_STATE_USED , &ub->state)) {
@@ -3232,6 +3238,9 @@ static int ublk_ctrl_end_recovery(struct ublk_device *ub,pr_devel ("%s: All FETCH_REQs received, dev id %d\n" , __func__, header->dev_id); +if (ub->ublksrv_tgid != ublksrv_pid) +return -EINVAL ; +mutex_lock (&ub->mutex);if (ublk_nosrv_should_stop_dev (ub)) goto out_unlock;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 20/627 md/raid10: fix set but not used variable in sync_request_write()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
[ Upstream commit bc1c2f0ae355f7e30b5baecdfb89d2b148aa0515 ]
Building with W=1 reports the following:
drivers/md/raid10.c: In function ‘sync_request_write’:drivers/md/raid10.c:2441:21: error: variable ‘d’ set but not used [-Werror=unused-but-set-variable]
2441 | int d;
| ^
cc1: all warnings being treated as errors
Remove the usage of that variable.
--- drivers/md/raid10.c | 3 --- 1 file changed, 3 deletions(-)
drivers/md/raid10.c +0 -3
@@ -2446,15 +2446,12 @@ static void sync_request_write(struct mddev *mddev, struct r10bio *r10_bio)* that are active */ for (i =0 ; i < conf->copies; i++) { -int d; - tbio = r10_bio->devs[i].repl_bio;if (!tbio || !tbio->bi_end_io)continue ;if (r10_bio->devs[i].bio->bi_end_io != end_sync_write && r10_bio->devs[i].bio != fbio)bio_copy_data (tbio, fbio); - d = r10_bio->devs[i].devnum;atomic_inc (&r10_bio->remaining);submit_bio_noacct (tbio); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 21/627 gfs2: No more self recovery
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit deb016c1669002e48c431d6fd32ea1c20ef41756 ]
When a node withdraws and it turns out that it is the only node that has the filesystem mounted, gfs2 currently tries to replay the local journal to bring the filesystem back into a consistent state. Not only is that a very bad idea, it has also never worked because gfs2_recover_func() will refuse to do anything during a withdraw.
However, before even getting to this point, gfs2_recover_func() dereferences sdp->sd_jdesc->jd_inode. This was a use-after-free before commit 04133b607a78 ("gfs2: Prevent double iput for journal on error") and is a NULL pointer dereference since then.
Simply get rid of self recovery to fix that.
--- fs/gfs2/util.c | 31 +++++++++++-------------------- 1 file changed, 11 insertions(+), 20 deletions(-)
fs/gfs2/util.c +11 -20
@@ -232,32 +232,23 @@ static void signal_our_withdraw(struct gfs2_sbd *sdp)*/ ret =gfs2_glock_nq (&sdp->sd_live_gh); +gfs2_glock_put (live_gl);/* drop extra reference we acquired */ +clear_bit (SDF_WITHDRAW_RECOVERY , &sdp->sd_flags); +/* * If we actually got the "live" lock in EX mode, there are no other -* nodes available to replay our journal. So we try to replay it -* ourselves. We hold the "live" glock to prevent other mounters -* during recovery, then just dequeue it and reacquire it in our -* normal SH mode. Just in case the problem that caused us to -* withdraw prevents us from recovering our journal (e.g. io errors -* and such) we still check if the journal is clean before proceeding -* but we may wait forever until another mounter does the recovery. +* nodes available to replay our journal. */ if (ret ==0 ) { -fs_warn (sdp,"No other mounters found. Trying to recover our " -"own journal jid %d.\n" , sdp->sd_lockstruct.ls_jid); -if (gfs2_recover_journal (sdp->sd_jdesc,1 )) -fs_warn (sdp,"Unable to recover our journal jid %d.\n" , - sdp->sd_lockstruct.ls_jid); -gfs2_glock_dq_wait (&sdp->sd_live_gh); -gfs2_holder_reinit (LM_ST_SHARED , -LM_FLAG_NOEXP |GL_EXACT |GL_NOPID , - &sdp->sd_live_gh); -gfs2_glock_nq (&sdp->sd_live_gh); +fs_warn (sdp,"No other mounters found.\n" ); +/* +* We are about to release the lockspace. By keeping live_gl +* locked here, we ensure that the next mounter coming along +* will be a "first" mounter which will perform recovery. +*/ + goto skip_recovery; } -gfs2_glock_put (live_gl);/* drop extra reference we acquired */ -clear_bit (SDF_WITHDRAW_RECOVERY , &sdp->sd_flags); -/* * At this point our journal is evicted, so we need to get a new inode * for it. Once done, we need to call gfs2_find_jhead which
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 22/627 nvmet: pci-epf: Do not complete commands twice if nvmet_req_init() fails
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rick Wertenbroek <[email protected]>
[ Upstream commit 746d0ac5a07d5da952ef258dd4d75f0b26c96476 ]
Have nvmet_req_init() and req->execute() complete failed commands.
Description of the problem:nvmet_req_init() calls __nvmet_req_complete() internally upon failure, e.g., unsupported opcode, which calls the "queue_response" callback, this results in nvmet_pci_epf_queue_response() being called, which will call nvmet_pci_epf_complete_iod() if data_len is 0 or if dma_dir is different from DMA_TO_DEVICE. This results in a double completion as nvmet_pci_epf_exec_iod_work() also calls nvmet_pci_epf_complete_iod() when nvmet_req_init() fails.
Steps to reproduce:
On the host send a command with an unsupported opcode with nvme-cli, For example the admin command "security receive"
$ sudo nvme security-recv /dev/nvme0n1 -n1 -x4096
This triggers a double completion as nvmet_req_init() fails and nvmet_pci_epf_queue_response() is called, here iod->dma_dir is still in the default state of "DMA_NONE" as set by default in nvmet_pci_epf_alloc_iod(), so nvmet_pci_epf_complete_iod() is called. Because nvmet_req_init() failed nvmet_pci_epf_complete_iod() is also called in nvmet_pci_epf_exec_iod_work() leading to a double completion. This not only sends two completions to the host but also corrupts the state of the PCI NVMe target leading to kernel oops.
This patch lets nvmet_req_init() and req->execute() complete all failed commands, and removes the double completion case in nvmet_pci_epf_exec_iod_work() therefore fixing the edge cases where double completions occurred.
--- drivers/nvme/target/pci-epf.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-)
drivers/nvme/target/pci-epf.c +16 -7
@@ -1242,8 +1242,11 @@ static void nvmet_pci_epf_queue_response(struct nvmet_req *req) iod->status =le16_to_cpu (req->cqe->status) >>1 ; -/* If we have no data to transfer, directly complete the command. */ -if (!iod->data_len || iod->dma_dir !=DMA_TO_DEVICE ) { +/* +* If the command failed or we have no data to transfer, complete the +* command immediately. +*/ +if (iod->status || !iod->data_len || iod->dma_dir !=DMA_TO_DEVICE ) {nvmet_pci_epf_complete_iod (iod);return ; }
@@ -1604,8 +1607,13 @@ static void nvmet_pci_epf_exec_iod_work(struct work_struct *work) goto complete; } +/* +* If nvmet_req_init() fails (e.g., unsupported opcode) it will call +* __nvmet_req_complete() internally which will call +* nvmet_pci_epf_queue_response() and will complete the command directly. +*/ if (!nvmet_req_init (req, &iod->sq->nvme_sq, &nvmet_pci_epf_fabrics_ops)) - goto complete; +return ; iod->data_len =nvmet_req_transfer_len (req);if (iod->data_len) {
@@ -1643,10 +1651,11 @@ static void nvmet_pci_epf_exec_iod_work(struct work_struct *work)wait_for_completion (&iod->done); -if (iod->status ==NVME_SC_SUCCESS ) { -WARN_ON_ONCE (!iod->data_len || iod->dma_dir !=DMA_TO_DEVICE ); -nvmet_pci_epf_transfer_iod_data (iod); - } +if (iod->status !=NVME_SC_SUCCESS ) +return ; + +WARN_ON_ONCE (!iod->data_len || iod->dma_dir !=DMA_TO_DEVICE ); +nvmet_pci_epf_transfer_iod_data (iod); complete:nvmet_pci_epf_complete_iod (iod);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 23/627 block: sanitize chunk_sectors for atomic write limits
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
[ Upstream commit 1de67e8e28fc47d71ee06ffa0185da549b378ffb ]
Currently we just ensure that a non-zero value in chunk_sectors aligns with any atomic write boundary, as the blk boundary functionality uses both these values.
However it is also improper to have atomic write unit max > chunk_sectors (for non-zero chunk_sectors), as this would lead to splitting of atomic write bios (which is disallowed).
Sanitize atomic write unit max against chunk_sectors to avoid any potential problems.
--- block/blk-settings.c | 6 ++++++ 1 file changed, 6 insertions(+)
block/blk-settings.c +6 -0
@@ -181,6 +181,8 @@ static void blk_atomic_writes_update_limits(struct queue_limits *lim)static void blk_validate_atomic_write_limits (struct queue_limits *lim) {unsigned int boundary_sectors; +unsigned int atomic_write_hw_max_sectors = + lim->atomic_write_hw_max >>SECTOR_SHIFT ;if (!(lim->features &BLK_FEAT_ATOMIC_WRITES )) goto unsupported;
@@ -202,6 +204,10 @@ static void blk_validate_atomic_write_limits(struct queue_limits *lim) lim->atomic_write_hw_max)) goto unsupported; +if (WARN_ON_ONCE (lim->chunk_sectors && + atomic_write_hw_max_sectors > lim->chunk_sectors)) + goto unsupported; + boundary_sectors = lim->atomic_write_hw_boundary >>SECTOR_SHIFT ;if (boundary_sectors) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 24/627 io_uring: fix breakage in EXPERT menu
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit d1fbe1ebf4a12cabd7945335d5e47718cb2bef99 ]
Add a dependency for IO_URING for the GCOV_PROFILE_URING symbol.
Without this patch the EXPERT config menu ends with "Enable IO uring support" and the menu prompts for GCOV_PROFILE_URING and IO_URING_MOCK_FILE are not subordinate to it. This causes all of the EXPERT Kconfig options that follow GCOV_PROFILE_URING to be display in the "upper" menu (General setup), just following the EXPERT menu.
--- init/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
init/Kconfig +1 -1
@@ -1794,7 +1794,7 @@ config IO_URING config GCOV_PROFILE_URING bool "Enable GCOV profiling on the io_uring subsystem" - depends on GCOV_KERNEL + depends on IO_URING && GCOV_KERNEL help Enable GCOV profiling on the io_uring subsystem, to facilitate code coverage testing.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 25/627 btrfs: remove partial support for lowest level from btrfs_search_forward()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sun YangKai <[email protected]>
[ Upstream commit 27260dd1904bb409cf84709928ba9bc5506fbe8e ]
Commit 323ac95bce44 ("Btrfs: don't read leaf blocks containing only checksums during truncate") changed the condition from level == 0 to level == path->lowest_level, while its original purpose was just to do some leaf node handling (calling btrfs_item_key_to_cpu()) and skip some code that doesn't fit leaf nodes.
After changing the condition, the code path:
1. Also handles the non-leaf nodes when path->lowest_level is nonzero, which is wrong. However btrfs_search_forward() is never called with a nonzero path->lowest_level, which makes this bug not found before.
2. Makes the later if block with the same condition, which was originally used to handle non-leaf node (calling btrfs_node_key_to_cpu()) when lowest_level is not zero, dead code.
Since btrfs_search_forward() is never called for a path with a lowest_level different from zero, just completely remove the partial support for a non-zero lowest_level, simplifying a bit the code, and assert that lowest_level is zero at the start of the function.
--- fs/btrfs/ctree.c | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-)
fs/btrfs/ctree.c +5 -13
@@ -4585,16 +4585,13 @@ int btrfs_del_items(struct btrfs_trans_handle *trans, struct btrfs_root *root,/* * A helper function to walk down the tree starting at min_key, and looking -* for nodes or leaves that are have a minimum transaction id. +* for leaves that have a minimum transaction id. * This is used by the btree defrag code, and tree logging * * This does not cow, but it does stuff the starting key it finds back * into min_key, so you can call btrfs_search_slot with cow=1 on the * key and get a writable path. * -* This honors path->lowest_level to prevent descent past a given level -* of the tree. -* * min_trans indicates the oldest transaction that you are interested * in walking through. Any nodes or leaves older than min_trans are * skipped over (without reading them).
@@ -4615,6 +4612,7 @@ int btrfs_search_forward(struct btrfs_root *root, struct btrfs_key *min_key,int keep_locks = path->keep_locks;ASSERT (!path->nowait); +ASSERT (path->lowest_level ==0 ); path->keep_locks =1 ; again: cur =btrfs_read_lock_root_node (root);
@@ -4636,8 +4634,8 @@ int btrfs_search_forward(struct btrfs_root *root, struct btrfs_key *min_key, goto out; } -/* at the lowest level, we're done, setup the path and exit */ -if (level == path->lowest_level) { +/* At level 0 we're done, setup the path and exit. */ +if (level ==0 ) {if (slot >= nritems) goto find_next_key; ret =0 ;
@@ -4678,12 +4676,6 @@ int btrfs_search_forward(struct btrfs_root *root, struct btrfs_key *min_key, goto out; } } -if (level == path->lowest_level) { - ret =0 ; -/* Save our key for returning back. */ -btrfs_node_key_to_cpu (cur, min_key, slot); - goto out; - } cur =btrfs_read_node_slot (cur, slot);if (IS_ERR (cur)) { ret =PTR_ERR (cur);
@@ -4699,7 +4691,7 @@ int btrfs_search_forward(struct btrfs_root *root, struct btrfs_key *min_key, out: path->keep_locks = keep_locks;if (ret ==0 ) -btrfs_unlock_up_safe (path, path->lowest_level +1 ); +btrfs_unlock_up_safe (path,1 );return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 26/627 eventpoll: Fix semi-unbounded recursion
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
[ Upstream commit f2e467a48287c868818085aa35389a224d226732 ]
Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links.
Currently, ep_loop_check_proc() ensures that the graph is loop-free and does some recursion depth checks, but those recursion depth checks don't limit the depth of the resulting tree for two reasons:
- They don't look upwards in the tree.
- If there are multiple downwards paths of different lengths, only one of the paths is actually considered for the depth check since commit 28d82dc1c4ed ("epoll: limit paths").
Essentially, the current recursion depth check in ep_loop_check_proc() just serves to prevent it from recursing too deeply while checking for loops.
A more thorough check is done in reverse_path_check() after the new graph edge has already been created; this checks, among other things, that no paths going upwards from any non-epoll file with a length of more than 5 edges exist. However, this check does not apply to non-epoll files.
As a result, it is possible to recurse to a depth of at least roughly 500, tested on v6.15. (I am unsure if deeper recursion is possible; and this may have changed with commit 8c44dac8add7 ("eventpoll: Fix priority inversion problem").)
To fix it:
1. In ep_loop_check_proc(), note the subtree depth of each visited node, and use subtree depths for the total depth calculation even when a subtree has already been visited.
2. Add ep_get_upwards_depth_proc() for similarly determining the maximum depth of an upwards walk.
3. In ep_loop_check(), use these values to limit the total path length between epoll nodes to EP_MAX_NESTS edges.
Stable-dep-of: ecb6cc0fd8cd ("eventpoll: fix sphinx documentation build warning")
--- fs/eventpoll.c | 60 ++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 46 insertions(+), 14 deletions(-)
fs/eventpoll.c +46 -14
@@ -218,6 +218,7 @@ struct eventpoll {/* used to optimize loop detection check */ u64 gen;struct hlist_head refs; +u8 loop_check_depth;/* * usage count, used together with epitem->dying to
@@ -2140,23 +2141,24 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events, }/** -* ep_loop_check_proc - verify that adding an epoll file inside another -* epoll structure does not violate the constraints, in -* terms of closed loops, or too deep chains (which can -* result in excessive stack usage). +* ep_loop_check_proc - verify that adding an epoll file @ep inside another +* epoll file does not create closed loops, and +* determine the depth of the subtree starting at @ep * * @ep: the &struct eventpoll to be currently checked. * @depth: Current depth of the path being checked. * -* Return: %zero if adding the epoll @file inside current epoll -* structure @ep does not violate the constraints, or %-1 otherwise. +* Return: depth of the subtree, or INT_MAX if we found a loop or went too deep. */ static int ep_loop_check_proc (struct eventpoll *ep,int depth) { -int error =0 ; +int result =0 ;struct rb_node *rbp;struct epitem *epi; +if (ep->gen == loop_check_gen) +return ep->loop_check_depth; +mutex_lock_nested (&ep->mtx, depth +1 ); ep->gen = loop_check_gen;for (rbp =rb_first_cached (&ep->rbr); rbp; rbp =rb_next (rbp)) {
@@ -2164,13 +2166,11 @@ static int ep_loop_check_proc(struct eventpoll *ep, int depth)if (unlikely (is_file_epoll (epi->ffd.file))) {struct eventpoll *ep_tovisit; ep_tovisit = epi->ffd.file->private_data; -if (ep_tovisit->gen == loop_check_gen) -continue ;if (ep_tovisit == inserting_into || depth >EP_MAX_NESTS ) - error =-1 ; + result =INT_MAX ;else - error =ep_loop_check_proc (ep_tovisit, depth +1 ); -if (error !=0 ) + result =max (result,ep_loop_check_proc (ep_tovisit, depth +1 ) +1 ); +if (result >EP_MAX_NESTS )break ; }else {/*
@@ -2184,9 +2184,27 @@ static int ep_loop_check_proc(struct eventpoll *ep, int depth)list_file (epi->ffd.file); } } + ep->loop_check_depth = result;mutex_unlock (&ep->mtx); -return error; +return result; +} + +/** +* ep_get_upwards_depth_proc - determine depth of @ep when traversed upwards +*/ +static int ep_get_upwards_depth_proc (struct eventpoll *ep,int depth) +{ +int result =0 ; +struct epitem *epi; + +if (ep->gen == loop_check_gen) +return ep->loop_check_depth; +hlist_for_each_entry_rcu (epi, &ep->refs, fllink) + result =max (result,ep_get_upwards_depth_proc (epi->ep, depth +1 ) +1 ); + ep->gen = loop_check_gen; + ep->loop_check_depth = result; +return result; }/**
@@ -2202,8 +2220,22 @@ static int ep_loop_check_proc(struct eventpoll *ep, int depth)*/ static int ep_loop_check (struct eventpoll *ep,struct eventpoll *to) { +int depth, upwards_depth; + inserting_into = ep; -return ep_loop_check_proc (to,0 ); +/* +* Check how deep down we can get from @to, and whether it is possible +* to loop up to @ep. +*/ + depth =ep_loop_check_proc (to,0 ); +if (depth >EP_MAX_NESTS ) +return -1 ; +/* Check how far up we can go from @ep. */ +rcu_read_lock (); + upwards_depth =ep_get_upwards_depth_proc (ep,0 ); +rcu_read_unlock (); + +return (depth+1 +upwards_depth >EP_MAX_NESTS ) ?-1 :0 ; }static void clear_tfile_check_list (void )
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 27/627 eventpoll: fix sphinx documentation build warning
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
[ Upstream commit ecb6cc0fd8cd2d34b983e118aa61dd8c9b052d0d ]
Sphinx complains that ep_get_upwards_depth_proc() has a kerneldoc-style comment without documenting its parameters.
This is an internal function that was not meant to show up in kernel documentation, so fix the warning by changing the comment to a non-kerneldoc one.
--- fs/eventpoll.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
fs/eventpoll.c +1 -3
@@ -2190,9 +2190,7 @@ static int ep_loop_check_proc(struct eventpoll *ep, int depth)return result; } -/** -* ep_get_upwards_depth_proc - determine depth of @ep when traversed upwards -*/ +/* ep_get_upwards_depth_proc - determine depth of @ep when traversed upwards */ static int ep_get_upwards_depth_proc (struct eventpoll *ep,int depth) {int result =0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 28/627 erofs: fix build error with CONFIG_EROFS_FS_ZIP_ACCEL=y
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bo Liu (OpenAnolis) <[email protected]>
[ Upstream commit 5e0bf36fd156b8d9b09f8481ee6daa6cdba1b064 ]
fix build err:
ld.lld: error: undefined symbol: crypto_req_done
referenced by decompressor_crypto.c
fs/erofs/decompressor_crypto.o:(z_erofs_crypto_decompress) in archive vmlinux.a
referenced by decompressor_crypto.c
fs/erofs/decompressor_crypto.o:(z_erofs_crypto_decompress) in archive vmlinux.a
ld.lld: error: undefined symbol: crypto_acomp_decompress
referenced by decompressor_crypto.c
fs/erofs/decompressor_crypto.o:(z_erofs_crypto_decompress) in archive vmlinux.a
ld.lld: error: undefined symbol: crypto_alloc_acomp
referenced by decompressor_crypto.c
fs/erofs/decompressor_crypto.o:(z_erofs_crypto_enable_engine) in archive vmlinux.a
--- fs/erofs/Kconfig | 2 ++ 1 file changed, 2 insertions(+)
fs/erofs/Kconfig +2 -0
@@ -147,6 +147,8 @@ config EROFS_FS_ZIP_ZSTD config EROFS_FS_ZIP_ACCEL bool "EROFS hardware decompression support" depends on EROFS_FS_ZIP + select CRYPTO + select CRYPTO_DEFLATE help Saying Y here includes hardware accelerator support for reading EROFS file systems containing compressed data. It gives better
Signature · 1 line
2.39.5
Re: [PATCH 6.16 028/627] erofs: fix build error with CONFIG_EROFS_FS_ZIP_ACCEL=y
Quoted 40 lines · Greg Kroah-Hartman
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bo Liu (OpenAnolis) <[email protected]>
[ Upstream commit
5e0bf36fd156b8d9b09f8481ee6daa6cdba1b064]fix build err:
ld.lld: error: undefined symbol:crypto_req_done
referenced bydecompressor_crypto.c
fs/erofs/decompressor_crypto.o:(z_erofs_crypto_decompress) in archive vmlinux.a
referenced bydecompressor_crypto.c
fs/erofs/decompressor_crypto.o:(z_erofs_crypto_decompress) in archive vmlinux.ald.lld: error: undefined symbol:
crypto_acomp_decompress
referenced bydecompressor_crypto.c
fs/erofs/decompressor_crypto.o:(z_erofs_crypto_decompress) in archive vmlinux.ald.lld: error: undefined symbol:
crypto_alloc_acomp
referenced bydecompressor_crypto.c
fs/erofs/decompressor_crypto.o:(z_erofs_crypto_enable_engine) in archive vmlinux.aReported-by kernel test robot <[email protected]>Fixes b4a29efc5146 ("erofs: support DEFLATE decompression by using Intel QAT")Signed-off-by Bo Liu (OpenAnolis) <[email protected]>Reviewed-by Gao Xiang <[email protected]>Signed-off-by Gao Xiang <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- fs/erofs/Kconfig | 2 ++ 1 file changed, 2 insertions(+)fs/erofs/Kconfig +0
-0
fs/erofs/Kconfig config EROFS_FS_ZIP_ZSTD · line 151
Quoted 5 lines
fs/erofs/Kconfig +2
-0@@ -147,6 +147,8 @@ config EROFS_FS_ZIP_ZSTD config EROFS_FS_ZIP_ACCEL bool "EROFS hardware decompression support" depends on EROFS_FS_ZIP + select CRYPTO + select CRYPTO_DEFLATE
This is not correct as it forces CRYPTO=y and CRYPTO_DEFLATE=y even if EROFS=m.
The upstream is bad, not only this stable patch.
Quoted 3 lines
fs/erofs/Kconfig +0
-0help Saying Y here includes hardware accelerator support for reading EROFS file systems containing compressed data. It gives better
Signature · 2 lines
js suse labs
Re: [PATCH 6.16 028/627] erofs: fix build error with CONFIG_EROFS_FS_ZIP_ACCEL=y
Quoted 49 lines · Jiri Slaby
Quoted 40 lines · Greg Kroah-Hartman
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bo Liu (OpenAnolis) <[email protected]>
[ Upstream commit
5e0bf36fd156b8d9b09f8481ee6daa6cdba1b064]fix build err:
ld.lld: error: undefined symbol:crypto_req_done
referenced bydecompressor_crypto.cfs/erofs/decompressor_crypto.o:(z_erofs_crypto_decompress) in archive vmlinux.a referenced bydecompressor_crypto.cfs/erofs/decompressor_crypto.o:(z_erofs_crypto_decompress) in archive vmlinux.ald.lld: error: undefined symbol:
crypto_acomp_decompress
referenced bydecompressor_crypto.cfs/erofs/decompressor_crypto.o:(z_erofs_crypto_decompress) in archive vmlinux.ald.lld: error: undefined symbol:
crypto_alloc_acomp
referenced bydecompressor_crypto.cfs/erofs/decompressor_crypto.o:(z_erofs_crypto_enable_engine) in archive vmlinux.aReported-by kernel test robot <[email protected]>Fixes b4a29efc5146 ("erofs: support DEFLATE decompression by using Intel QAT")Signed-off-by Bo Liu (OpenAnolis) <[email protected]>Reviewed-by Gao Xiang <[email protected]>Signed-off-by Gao Xiang <[email protected]>Signed-off-by Sasha Levin <[email protected]>---
fs/erofs/Kconfig| 2 ++1 file changed, 2 insertions(+)fs/erofs/Kconfig +0
-0@@ -147,6 +147,8 @@ config EROFS_FS_ZIP_ZSTDQuoted 5 lines
config
EROFS_FS_ZIP_ACCEL
bool "EROFS hardware decompression support"
depends onEROFS_FS_ZIP
+ select CRYPTO
+ selectCRYPTO_DEFLATEThis is not correct as it forces CRYPTO=y and CRYPTO_DEFLATE=y even if EROFS=m.
Quoted 1 line
The upstream is bad, not only this stable patch.
-next is fixed by:
commit 8f11edd645782b767ea1fc845adc30e057f25184
Author: Geert Uytterhoeven <[email protected]> Date: Wed Jul 30 14:44:49 2025 +0200
erofs: Do not select tristate symbols from bool symbols
I suggest postponing this patch until the above is merged and picked too...
Quoted 5 lines
Quoted 4 lines
help
Saying Y here includes hardware accelerator support for reading EROFS file systems containing compressed data. It gives better
Signature · 2 lines
js suse labs
Greg Kroah-Hartman
maintainerRe: [PATCH 6.16 028/627] erofs: fix build error with CONFIG_EROFS_FS_ZIP_ACCEL=y
Quoted 63 lines · Jiri Slaby
Quoted 58 lines · Jiri Slaby
Quoted 48 lines · Greg Kroah-Hartman
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bo Liu (OpenAnolis) <[email protected]>
[ Upstream commit
5e0bf36fd156b8d9b09f8481ee6daa6cdba1b064]fix build err:
ld.lld: error: undefined symbol:crypto_req_donereferenced bydecompressor_crypto.cfs/erofs/decompressor_crypto.o:(z_erofs_crypto_decompress) in archive vmlinux.a
referenced bydecompressor_crypto.cfs/erofs/decompressor_crypto.o:(z_erofs_crypto_decompress) in archive vmlinux.ald.lld: error: undefined symbol:
crypto_acomp_decompressreferenced bydecompressor_crypto.cfs/erofs/decompressor_crypto.o:(z_erofs_crypto_decompress) in archive vmlinux.ald.lld: error: undefined symbol:
crypto_alloc_acompreferenced bydecompressor_crypto.c
fs/erofs/decompressor_crypto.o:(z_erofs_crypto_enable_engine) in archive vmlinux.aReported-by kernel test robot <[email protected]>Fixes b4a29efc5146 ("erofs: support DEFLATE decompression by usingIntel QAT")
Signed-off-by Bo Liu (OpenAnolis) <[email protected]>Reviewed-by Gao Xiang <[email protected]>Signed-off-by Gao Xiang <[email protected]>Signed-off-by Sasha Levin <[email protected]>---
fs/erofs/Kconfig| 2 ++1 file changed, 2 insertions(+)fs/erofs/Kconfig +0
-0@@ -147,6 +147,8 @@ config EROFS_FS_ZIP_ZSTDQuoted 5 lines
config
EROFS_FS_ZIP_ACCEL
bool "EROFS hardware decompression support"
depends onEROFS_FS_ZIP
+ select CRYPTO
+ selectCRYPTO_DEFLATEThis is not correct as it forces CRYPTO=y and CRYPTO_DEFLATE=y even if EROFS=m.
Quoted 1 line
The upstream is bad, not only this stable patch.
-next is fixed by:
Quoted 7 lines
commit
8f11edd645782b767ea1fc845adc30e057f25184Author: Geert Uytterhoeven <[email protected]> Date: Wed Jul 30 14:44:49 2025 +0200erofs: Do not select tristate symbols from bool symbols
I suggest postponing this patch until the above is merged and picked too...
Thanks, I'll go drop this now.
greg k-h
Re: [PATCH 6.16 028/627] erofs: fix build error with CONFIG_EROFS_FS_ZIP_ACCEL=y
Quoted 68 lines · Greg Kroah-Hartman
Quoted 67 lines · Jiri Slaby
Quoted 58 lines · Jiri Slaby
Quoted 48 lines · Greg Kroah-Hartman
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bo Liu (OpenAnolis) <[email protected]>
[ Upstream commit
5e0bf36fd156b8d9b09f8481ee6daa6cdba1b064]fix build err:
ld.lld: error: undefined symbol:crypto_req_donereferenced bydecompressor_crypto.cfs/erofs/decompressor_crypto.o:(z_erofs_crypto_decompress)
in archive vmlinux.a
referenced bydecompressor_crypto.cfs/erofs/decompressor_crypto.o:(z_erofs_crypto_decompress)
in archive vmlinux.ald.lld: error: undefined symbol:
crypto_acomp_decompressreferenced bydecompressor_crypto.cfs/erofs/decompressor_crypto.o:(z_erofs_crypto_decompress)
in archive vmlinux.ald.lld: error: undefined symbol:
crypto_alloc_acompreferenced bydecompressor_crypto.cfs/erofs/decompressor_crypto.o:(z_erofs_crypto_enable_engine) in archive vmlinux.a
Reported-by kernel test robot <[email protected]>Fixes b4a29efc5146 ("erofs: support DEFLATE decompression by usingIntel QAT")
Signed-off-by Bo Liu (OpenAnolis) <[email protected]>Reviewed-by Gao Xiang <[email protected]>Signed-off-by Gao Xiang <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- fs/erofs/Kconfig | 2 ++ 1 file changed, 2 insertions(+)fs/erofs/Kconfig +0
-0fs/erofs/Kconfig config EROFS_FS_ZIP_ZSTD · line 151
Quoted 5 lines
fs/erofs/Kconfig +2
-0@@ -147,6 +147,8 @@ config EROFS_FS_ZIP_ZSTD config EROFS_FS_ZIP_ACCEL bool "EROFS hardware decompression support" depends on EROFS_FS_ZIP + select CRYPTO + select CRYPTO_DEFLATEThis is not correct as it forces CRYPTO=y and CRYPTO_DEFLATE=y even if EROFS=m.
Quoted 1 line
The upstream is bad, not only this stable patch.
-next is fixed by:
commit
8f11edd645782b767ea1fc845adc30e057f25184Author: Geert Uytterhoeven <[email protected]> Date: Wed Jul 30 14:44:49 2025 +0200
Quoted 5 lines
Quoted 3 lines
erofs: Do not select tristate symbols from bool symbols
I suggest postponing this patch until the above is merged and picked too...
Thanks, I'll go drop this now.
Yes, and I will submit upstream soon so that those two patches can be backported together.
Thanks,
Gao Xiang
Quoted 2 lines
greg k-h
Greg Kroah-Hartman
maintainerPATCH 29/627 block: restore two stage elevator switch while running nr_hw_queue update
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilay Shroff <[email protected]>
[ Upstream commit 5989bfe6ac6bf230c2c84e118c786be0ed4be3f4 ]
The kmemleak reports memory leaks related to elevator resources that were originally allocated in the ->init_hctx() method. The following leak traces are observed after running blktests block/040:
unreferenced object 0xffff8881b82f7400 (size 512):
comm "check", pid 68454, jiffies 4310588881 hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 5bac8b34):
__kvmalloc_node_noprof+0x55d/0x7a0
sbitmap_init_node+0x15a/0x6a0
kyber_init_hctx+0x316/0xb90
blk_mq_init_sched+0x419/0x580
elevator_switch+0x18b/0x630
elv_update_nr_hw_queues+0x219/0x2c0
__blk_mq_update_nr_hw_queues+0x36a/0x6f0
blk_mq_update_nr_hw_queues+0x3a/0x60
0xffffffffc09ceb80
0xffffffffc09d7e0b
configfs_write_iter+0x2b1/0x470
vfs_write+0x527/0xe70
ksys_write+0xff/0x200
do_syscall_64+0x98/0x3c0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
unreferenced object 0xffff8881b82f6000 (size 512):
comm "check", pid 68454, jiffies 4310588881
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 5bac8b34):
__kvmalloc_node_noprof+0x55d/0x7a0
sbitmap_init_node+0x15a/0x6a0
kyber_init_hctx+0x316/0xb90
blk_mq_init_sched+0x419/0x580
elevator_switch+0x18b/0x630
elv_update_nr_hw_queues+0x219/0x2c0
__blk_mq_update_nr_hw_queues+0x36a/0x6f0
blk_mq_update_nr_hw_queues+0x3a/0x60
0xffffffffc09ceb80
0xffffffffc09d7e0b
configfs_write_iter+0x2b1/0x470
vfs_write+0x527/0xe70
ksys_write+0xff/0x200
do_syscall_64+0x98/0x3c0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
unreferenced object 0xffff8881b82f5800 (size 512):
comm "check", pid 68454, jiffies 4310588881
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 5bac8b34):
__kvmalloc_node_noprof+0x55d/0x7a0
sbitmap_init_node+0x15a/0x6a0
kyber_init_hctx+0x316/0xb90
blk_mq_init_sched+0x419/0x580
elevator_switch+0x18b/0x630
elv_update_nr_hw_queues+0x219/0x2c0
__blk_mq_update_nr_hw_queues+0x36a/0x6f0
blk_mq_update_nr_hw_queues+0x3a/0x60
0xffffffffc09ceb80
0xffffffffc09d7e0b
configfs_write_iter+0x2b1/0x470
vfs_write+0x527/0xe70
ksys_write+0xff/0x200
do_syscall_64+0x98/0x3c0
entry_SYSCALL_64_after_hwframe+0x76/0x7eThe issue arises while we run nr_hw_queue update, Specifically, we first reallocate hardware contexts (hctx) via __blk_mq_realloc_hw_ctxs(), and then later invoke elevator_switch() (assuming q->elevator is not NULL). The elevator switch code would first exit old elevator (elevator_exit) and then switches to the new elevator. The elevator_exit loops through each hctx and invokes the elevator’s per-hctx exit method ->exit_hctx(), which releases resources allocated during ->init_hctx().
This memleak manifests when we reduce the num of h/w queues - for example, when the initial update sets the number of queues to X, and a later update reduces it to Y, where Y < X. In this case, we'd loose the access to old hctxs while we get to elevator exit code because __blk_mq_realloc_hw_ctxs would have already released the old hctxs. As we don't now have any reference left to the old hctxs, we don't have any way to free the scheduler resources (which are allocate in ->init_hctx()) and kmemleak complains about it.
This issue was caused due to the commit 596dce110b7d ("block: simplify elevator reattachment for updating nr_hw_queues"). That change unified the two-stage elevator teardown and reattachment into a single call that occurs after __blk_mq_realloc_hw_ctxs() has already freed the hctxs.
This patch restores the previous two-stage elevator switch logic during nr_hw_queues updates. First, the elevator is switched to 'none', which ensures all scheduler resources are properly freed. Then, the hardware contexts (hctxs) are reallocated, and the software-to-hardware queue mappings are updated. Finally, the original elevator is reattached. This sequence prevents loss of references to old hctxs and avoids the scheduler resource leaks reported by kmemleak.
--- block/blk-mq.c | 84 ++++++++++++++++++++++++++++++++++++++++++------ block/blk.h | 2 +- block/elevator.c | 10 +++--- 3 files changed, 81 insertions(+), 15 deletions(-)
block/blk-mq.c +75 -9
@@ -4966,6 +4966,60 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr)return ret; } +/* +* Switch back to the elevator type stored in the xarray. +*/ +static void blk_mq_elv_switch_back (struct request_queue *q, +struct xarray *elv_tbl) +{ +struct elevator_type *e =xa_load (elv_tbl, q->id); + +/* The elv_update_nr_hw_queues unfreezes the queue. */ +elv_update_nr_hw_queues (q, e); + +/* Drop the reference acquired in blk_mq_elv_switch_none. */ +if (e) +elevator_put (e); +} + +/* +* Stores elevator type in xarray and set current elevator to none. It uses +* q->id as an index to store the elevator type into the xarray. +*/ +static int blk_mq_elv_switch_none (struct request_queue *q, +struct xarray *elv_tbl) +{ +int ret =0 ; + +lockdep_assert_held_write (&q->tag_set->update_nr_hwq_lock); + +/* +* Accessing q->elevator without holding q->elevator_lock is safe here +* because we're called from nr_hw_queue update which is protected by +* set->update_nr_hwq_lock in the writer context. So, scheduler update/ +* switch code (which acquires the same lock in the reader context) +* can't run concurrently. +*/ +if (q->elevator) { + + ret =xa_insert (elv_tbl, q->id, q->elevator->type,GFP_KERNEL ); +if (WARN_ON_ONCE (ret)) +return ret; + +/* +* Before we switch elevator to 'none', take a reference to +* the elevator module so that while nr_hw_queue update is +* running, no one can remove elevator module. We'd put the +* reference to elevator module later when we switch back +* elevator. +*/ +__elevator_get (q->elevator->type); + +elevator_set_none (q); + } +return ret; +} +static void __blk_mq_update_nr_hw_queues (struct blk_mq_tag_set *set,int nr_hw_queues) {
@@ -4973,6 +5027,7 @@ static void __blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set,int prev_nr_hw_queues = set->nr_hw_queues;unsigned int memflags;int i; +struct xarray elv_tbl;lockdep_assert_held (&set->tag_list_lock);
@@ -4984,6 +5039,9 @@ static void __blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set,return ; memflags =memalloc_noio_save (); + +xa_init (&elv_tbl); +list_for_each_entry (q, &set->tag_list, tag_set_list) {blk_mq_debugfs_unregister_hctxs (q);blk_mq_sysfs_unregister_hctxs (q);
@@ -4992,11 +5050,17 @@ static void __blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set,list_for_each_entry (q, &set->tag_list, tag_set_list)blk_mq_freeze_queue_nomemsave (q); -if (blk_mq_realloc_tag_set_tags (set, nr_hw_queues) <0 ) { -list_for_each_entry (q, &set->tag_list, tag_set_list) -blk_mq_unfreeze_queue_nomemrestore (q); - goto reregister; - } +/* +* Switch IO scheduler to 'none', cleaning up the data associated +* with the previous scheduler. We will switch back once we are done +* updating the new sw to hw queue mappings. +*/ +list_for_each_entry (q, &set->tag_list, tag_set_list) +if (blk_mq_elv_switch_none (q, &elv_tbl)) + goto switch_back; + +if (blk_mq_realloc_tag_set_tags (set, nr_hw_queues) <0 ) + goto switch_back; fallback:blk_mq_update_queue_map (set);
@@ -5016,12 +5080,11 @@ static void __blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, }blk_mq_map_swqueue (q); } - -/* elv_update_nr_hw_queues() unfreeze queue for us */ +switch_back: +/* The blk_mq_elv_switch_back unfreezes queue for us. */ list_for_each_entry (q, &set->tag_list, tag_set_list) -elv_update_nr_hw_queues (q); +blk_mq_elv_switch_back (q, &elv_tbl); -reregister:list_for_each_entry (q, &set->tag_list, tag_set_list) {blk_mq_sysfs_register_hctxs (q);blk_mq_debugfs_register_hctxs (q);
@@ -5029,6 +5092,9 @@ static void __blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set,blk_mq_remove_hw_queues_cpuhp (q);blk_mq_add_hw_queues_cpuhp (q); } + +xa_destroy (&elv_tbl); +memalloc_noio_restore (memflags);/* Free the excess tags when nr_hw_queues shrink. */
block/blk.h +1 -1
@@ -321,7 +321,7 @@ bool blk_bio_list_merge(struct request_queue *q, struct list_head *list,bool blk_insert_flush (struct request *rq); -void elv_update_nr_hw_queues (struct request_queue *q); +void elv_update_nr_hw_queues (struct request_queue *q,struct elevator_type *e);void elevator_set_default (struct request_queue *q);void elevator_set_none (struct request_queue *q);
block/elevator.c +5 -5
@@ -689,21 +689,21 @@ static int elevator_change(struct request_queue *q, struct elv_change_ctx *ctx)* The I/O scheduler depends on the number of hardware queues, this forces a * reattachment when nr_hw_queues changes. */ -void elv_update_nr_hw_queues (struct request_queue *q) +void elv_update_nr_hw_queues (struct request_queue *q,struct elevator_type *e) {struct elv_change_ctx ctx = {};int ret = -ENODEV ;WARN_ON_ONCE (q->mq_freeze_depth ==0 ); -mutex_lock (&q->elevator_lock); -if (q->elevator && !blk_queue_dying (q) &&blk_queue_registered (q)) { - ctx.name = q->elevator->type->elevator_name; +if (e && !blk_queue_dying (q) &&blk_queue_registered (q)) { + ctx.name = e->elevator_name; +mutex_lock (&q->elevator_lock);/* force to reattach elevator after nr_hw_queue is updated */ ret =elevator_switch (q, &ctx); +mutex_unlock (&q->elevator_lock); } -mutex_unlock (&q->elevator_lock);blk_mq_unfreeze_queue_nomemrestore (q);if (!ret)WARN_ON_ONCE (elevator_change_done (q, &ctx));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 30/627 sched/task_stack: Add missing const qualifier to end_of_stack()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 32e42ab9fc88a884435c27527a433f61c4d2b61b ]
Add missing const qualifier to the non-CONFIG_THREAD_INFO_IN_TASK version of end_of_stack() to match the CONFIG_THREAD_INFO_IN_TASK version. Fixes a warning with CONFIG_KSTACK_ERASE=y on archs that don't select THREAD_INFO_IN_TASK (such as LoongArch):
error: passing 'const struct task_struct *' to parameter of type 'struct task_struct *' discards qualifiers
The stackleak_task_low_bound() function correctly uses a const task parameter, but the legacy end_of_stack() prototype didn't like that.
Build tested on loongarch (with CONFIG_KSTACK_ERASE=y) and m68k (with CONFIG_DEBUG_STACK_USAGE=y).
--- include/linux/sched/task_stack.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/sched/task_stack.h +1 -1
@@ -53,7 +53,7 @@ static inline void setup_thread_stack(struct task_struct *p, struct task_struct* When the stack grows up, this is the highest address. * Beyond that position, we corrupt data on the next page. */ -static inline unsigned long *end_of_stack (struct task_struct *p) +static inline unsigned long *end_of_stack (const struct task_struct *p) {#ifdef CONFIG_STACK_GROWSUP return (unsigned long *)((unsigned long )task_thread_info (p) +THREAD_SIZE ) -1 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 31/627 ASOC: rockchip: fix capture stream handling in rockchip_sai_xfer_stop
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <[email protected]>
[ Upstream commit 5dc302d00807b8916992dd25a7a22b78d07dcd03 ]
Correcting the capture stream handling which was incorrectly setting playback=true for capture streams.
The original code mistakenly set playback=true for capture streams, causing incorrect behavior.
--- sound/soc/rockchip/rockchip_sai.c | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-)
sound/soc/rockchip/rockchip_sai.c +3 -13
@@ -378,19 +378,9 @@ static void rockchip_sai_xfer_start(struct rk_sai_dev *sai, int stream)static void rockchip_sai_xfer_stop (struct rk_sai_dev *sai,int stream) {unsigned int msk =0 , val =0 , clr =0 ; -bool playback; -bool capture; - -if (stream <0 ) { - playback = true; - capture = true; - }else if (stream ==SNDRV_PCM_STREAM_PLAYBACK ) { - playback = true; - capture = false; - }else { - playback = true; - capture = false; - } +bool capture = stream ==SNDRV_PCM_STREAM_CAPTURE || stream <0 ; +bool playback = stream ==SNDRV_PCM_STREAM_PLAYBACK || stream <0 ; +/* could be <= 0 but we don't want to depend on enum values */ if (playback) { msk |=SAI_XFER_TXS_MASK ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 32/627 ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <[email protected]>
[ Upstream commit f4c77d5af0a9cd0ee22617baa8b49d0e151fbda7 ]
commit 7f1186a8d738661 ("ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot()") checks return value of xlate_tdm_slot_mask() (A1)(A2).
/*
* ...
(Y) * TDM mode can be disabled by passing 0 for @slots. In this case @tx_mask,
* @rx_mask and @slot_width will be ignored.
* ...
*/
int snd_soc_dai_set_tdm_slot(...)
{
...
if (...)
(A1) ret = dai->driver->ops->xlate_tdm_slot_mask(...);
else
(A2) ret = snd_soc_xlate_tdm_slot_mask(...);
if (ret)
goto err;
...
}snd_soc_xlate_tdm_slot_mask() (A2) will return -EINVAL if slots was 0 (X), but snd_soc_dai_set_tdm_slot() allow to use it (Y).
(A) static int snd_soc_xlate_tdm_slot_mask(...)
{
...
if (!slots)
(X) return -EINVAL;
...
}Call xlate_tdm_slot_mask() only if slots was non zero.
--- sound/soc/soc-dai.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
sound/soc/soc-dai.c +9 -7
@@ -259,13 +259,15 @@ int snd_soc_dai_set_tdm_slot(struct snd_soc_dai *dai, &rx_mask, }; -if (dai->driver->ops && - dai->driver->ops->xlate_tdm_slot_mask) - ret = dai->driver->ops->xlate_tdm_slot_mask (slots, &tx_mask, &rx_mask); -else - ret =snd_soc_xlate_tdm_slot_mask (slots, &tx_mask, &rx_mask); -if (ret) - goto err; +if (slots) { +if (dai->driver->ops && + dai->driver->ops->xlate_tdm_slot_mask) + ret = dai->driver->ops->xlate_tdm_slot_mask (slots, &tx_mask, &rx_mask); +else + ret =snd_soc_xlate_tdm_slot_mask (slots, &tx_mask, &rx_mask); +if (ret) + goto err; + }for_each_pcm_streams (stream)snd_soc_dai_tdm_mask_set (dai, stream, *tdm_mask[stream]);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 33/627 ASoC: amd: acp: Fix pointer assignments for snd_soc_acpi_mach structures
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Venkata Prasad Potturu <[email protected]>
[ Upstream commit 0779c0ad2a7cc0ae1865860c9bc8732613cc56b1 ]
This patch modifies the assignment of machine structure pointers in the acp_pci_probe function. Previously, the machine pointers were assigned using the address-of operator (&), which caused incompatibility issues in type assignments.
Additionally, the declarations of the machine arrays in amd.h have been updated to reflect that they are indeed arrays ([]). The code is further cleaned up by declaring the codec structures in amd-acpi-mach.c as static, reflecting their intended usage.
error: symbol 'amp_rt1019' was not declared. Should it be static?
error: symbol 'amp_max' was not declared. Should it be static?
error: symbol 'snd_soc_acpi_amd_acp_machines' was not declared. Should it be static?
error: symbol 'snd_soc_acpi_amd_rmb_acp_machines' was not declared. Should it be static?
error: symbol 'snd_soc_acpi_amd_acp63_acp_machines' was not declared. Should it be static?
error: symbol 'snd_soc_acpi_amd_acp70_acp_machines' was not declared. Should it be static?
--- sound/soc/amd/acp/acp-pci.c | 8 ++++---- sound/soc/amd/acp/amd-acpi-mach.c | 4 ++-- sound/soc/amd/acp/amd.h | 8 ++++---- 3 files changed, 10 insertions(+), 10 deletions(-)
sound/soc/amd/acp/acp-pci.c +4 -4
@@ -137,26 +137,26 @@ static int acp_pci_probe(struct pci_dev *pci, const struct pci_device_id *pci_id chip->name ="acp_asoc_renoir" ; chip->rsrc = &rn_rsrc; chip->acp_hw_ops_init = acp31_hw_ops_init; - chip->machines = &snd_soc_acpi_amd_acp_machines; + chip->machines = snd_soc_acpi_amd_acp_machines;break ;case 0x6f : chip->name ="acp_asoc_rembrandt" ; chip->rsrc = &rmb_rsrc; chip->acp_hw_ops_init = acp6x_hw_ops_init; - chip->machines = &snd_soc_acpi_amd_rmb_acp_machines; + chip->machines = snd_soc_acpi_amd_rmb_acp_machines;break ;case 0x63 : chip->name ="acp_asoc_acp63" ; chip->rsrc = &acp63_rsrc; chip->acp_hw_ops_init = acp63_hw_ops_init; - chip->machines = &snd_soc_acpi_amd_acp63_acp_machines; + chip->machines = snd_soc_acpi_amd_acp63_acp_machines;break ;case 0x70 :case 0x71 : chip->name ="acp_asoc_acp70" ; chip->rsrc = &acp70_rsrc; chip->acp_hw_ops_init = acp70_hw_ops_init; - chip->machines = &snd_soc_acpi_amd_acp70_acp_machines; + chip->machines = snd_soc_acpi_amd_acp70_acp_machines;break ;default :dev_err (dev,"Unsupported device revision:0x%x\n" , pci->revision);
sound/soc/amd/acp/amd-acpi-mach.c +2 -2
@@ -8,12 +8,12 @@#include <sound/soc-acpi.h> -struct snd_soc_acpi_codecs amp_rt1019 = { +static struct snd_soc_acpi_codecs amp_rt1019 = { .num_codecs =1 , .codecs = {"10EC1019" } }; -struct snd_soc_acpi_codecs amp_max = { +static struct snd_soc_acpi_codecs amp_max = { .num_codecs =1 , .codecs = {"MX98360A" } };
sound/soc/amd/acp/amd.h +4 -4
@@ -243,10 +243,10 @@ extern struct acp_resource rmb_rsrc;extern struct acp_resource acp63_rsrc;extern struct acp_resource acp70_rsrc; -extern struct snd_soc_acpi_mach snd_soc_acpi_amd_acp_machines; -extern struct snd_soc_acpi_mach snd_soc_acpi_amd_rmb_acp_machines; -extern struct snd_soc_acpi_mach snd_soc_acpi_amd_acp63_acp_machines; -extern struct snd_soc_acpi_mach snd_soc_acpi_amd_acp70_acp_machines; +extern struct snd_soc_acpi_mach snd_soc_acpi_amd_acp_machines[]; +extern struct snd_soc_acpi_mach snd_soc_acpi_amd_rmb_acp_machines[]; +extern struct snd_soc_acpi_mach snd_soc_acpi_amd_acp63_acp_machines[]; +extern struct snd_soc_acpi_mach snd_soc_acpi_amd_acp70_acp_machines[];extern const struct snd_soc_dai_ops asoc_acp_cpu_dai_ops;extern const struct snd_soc_dai_ops acp_dmic_dai_ops;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 34/627 ASoC: ops: dynamically allocate struct snd_ctl_elem_value
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 7e10d7242ea8a5947878880b912ffa5806520705 ]
This structure is really too larget to be allocated on the stack:
sound/soc/soc-ops.c:435:5: error: stack frame size (1296) exceeds limit (1280) in 'snd_soc_limit_volume' [-Werror,-Wframe-larger-than]
Change the function to dynamically allocate it instead.
There is probably a better way to do it since only two integer fields inside of that structure are actually used, but this is the simplest rework for the moment.
--- sound/soc/soc-ops.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-)
sound/soc/soc-ops.c +15 -11
@@ -399,28 +399,32 @@ EXPORT_SYMBOL_GPL(snd_soc_put_volsw_sx);static int snd_soc_clip_to_platform_max (struct snd_kcontrol *kctl) {struct soc_mixer_control *mc = (struct soc_mixer_control *)kctl->private_value; -struct snd_ctl_elem_value uctl; +struct snd_ctl_elem_value *uctl;int ret;if (!mc->platform_max)return 0 ; - ret = kctl->get (kctl, &uctl); + uctl =kzalloc (sizeof (*uctl),GFP_KERNEL ); +if (!uctl) +return -ENOMEM ; + + ret = kctl->get (kctl, uctl);if (ret <0 ) -return ret; + goto out; -if (uctl.value.integer.value[0 ] > mc->platform_max) - uctl.value.integer.value[0 ] = mc->platform_max; +if (uctl->value.integer.value[0 ] > mc->platform_max) + uctl->value.integer.value[0 ] = mc->platform_max;if (snd_soc_volsw_is_stereo (mc) && - uctl.value.integer.value[1 ] > mc->platform_max) - uctl.value.integer.value[1 ] = mc->platform_max; + uctl->value.integer.value[1 ] > mc->platform_max) + uctl->value.integer.value[1 ] = mc->platform_max; - ret = kctl->put (kctl, &uctl); -if (ret <0 ) -return ret; + ret = kctl->put (kctl, uctl); -return 0 ; +out: +kfree (uctl); +return ret; }/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 35/627 arm64: dts: qcom: x1p42100: Fix thermal sensor configuration
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 63350a07966f61183462c200361a8c8cc275d560 ]
The 8-core SKUs of the X1 family have a different sensor configuration. Override it to expose what the sensors really measure.
--- arch/arm64/boot/dts/qcom/x1e80100.dtsi | 2 +- arch/arm64/boot/dts/qcom/x1p42100.dtsi | 556 +++++++++++++++++++++++++ 2 files changed, 557 insertions(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/x1e80100.dtsi +1 -1
@@ -8548,7 +8548,7 @@ timer { <GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>; }; - thermal-zones { + thermal_zones: thermal-zones { aoss0-thermal { thermal-sensors = <&tsens0 0>;
arch/arm64/boot/dts/qcom/x1p42100.dtsi +556 -0
565 lines not on this page · raw message
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 36/627 ASoC: mediatek: use reserved memory or enable buffer pre-allocation
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit ec4a10ca4a68ec97f12f4d17d7abb74db34987db ]
In commit 32c9c06adb5b ("ASoC: mediatek: disable buffer pre-allocation") buffer pre-allocation was disabled to accommodate newer platforms that have a limited reserved memory region for the audio frontend.
Turns out disabling pre-allocation across the board impacts platforms that don't have this reserved memory region. Buffer allocation failures have been observed on MT8173 and MT8183 based Chromebooks under low memory conditions, which results in no audio playback for the user.
Since some MediaTek platforms already have dedicated reserved memory pools for the audio frontend, the plan is to enable this for all of them. This requires device tree changes. As a fallback, reinstate the original policy of pre-allocating audio buffers at probe time of the reserved memory pool cannot be found or used.
This patch covers the MT8173, MT8183, MT8186 and MT8192 platforms for now, the reason being that existing MediaTek platform drivers that supported reserved memory were all platforms that mainly supported ChromeOS, and is also the set of devices that I can verify.
--- sound/soc/mediatek/common/mtk-afe-platform-driver.c | 4 +++- sound/soc/mediatek/common/mtk-base-afe.h | 1 + sound/soc/mediatek/mt8173/mt8173-afe-pcm.c | 7 +++++++ sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 7 +++++++ sound/soc/mediatek/mt8186/mt8186-afe-pcm.c | 7 +++++++ sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 7 +++++++ 6 files changed, 32 insertions(+), 1 deletion(-)
sound/soc/mediatek/common/mtk-afe-platform-driver.c +3 -1
@@ -120,7 +120,9 @@ int mtk_afe_pcm_new(struct snd_soc_component *component,struct mtk_base_afe *afe =snd_soc_component_get_drvdata (component); size = afe->mtk_afe_hardware->buffer_bytes_max; -snd_pcm_set_managed_buffer_all (pcm,SNDRV_DMA_TYPE_DEV , afe->dev,0 , size); +snd_pcm_set_managed_buffer_all (pcm,SNDRV_DMA_TYPE_DEV , afe->dev, + afe->preallocate_buffers ? size :0 , + size);return 0 ; }
sound/soc/mediatek/common/mtk-base-afe.h +1 -0
@@ -117,6 +117,7 @@ struct mtk_base_afe {struct mtk_base_afe_irq *irqs;int irqs_size;int memif_32bit_supported; +bool preallocate_buffers;struct list_head sub_dais;struct snd_soc_dai_driver *dai_drivers;
sound/soc/mediatek/mt8173/mt8173-afe-pcm.c +7 -0
@@ -13,6 +13,7 @@#include <linux/module.h> #include <linux/of.h> #include <linux/of_address.h> +#include <linux/of_reserved_mem.h> #include <linux/dma-mapping.h> #include <linux/pm_runtime.h> #include <sound/soc.h>
@@ -1070,6 +1071,12 @@ static int mt8173_afe_pcm_dev_probe(struct platform_device *pdev) afe->dev = &pdev->dev; + ret =of_reserved_mem_device_init (&pdev->dev); +if (ret) { +dev_info (&pdev->dev,"no reserved memory found, pre-allocating buffers instead\n" ); + afe->preallocate_buffers = true; + } + irq_id =platform_get_irq (pdev,0 );if (irq_id <=0 )return irq_id <0 ? irq_id : -ENXIO ;
sound/soc/mediatek/mt8183/mt8183-afe-pcm.c +7 -0
@@ -10,6 +10,7 @@#include <linux/mfd/syscon.h> #include <linux/of.h> #include <linux/of_address.h> +#include <linux/of_reserved_mem.h> #include <linux/pm_runtime.h> #include <linux/reset.h>
@@ -777,6 +778,12 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev) afe->dev = &pdev->dev; dev = afe->dev; + ret =of_reserved_mem_device_init (dev); +if (ret) { +dev_info (dev,"no reserved memory found, pre-allocating buffers instead\n" ); + afe->preallocate_buffers = true; + } +/* initial audio related clock */ ret =mt8183_init_clock (afe);if (ret) {
sound/soc/mediatek/mt8186/mt8186-afe-pcm.c +7 -0
@@ -10,6 +10,7 @@#include <linux/module.h> #include <linux/of.h> #include <linux/of_address.h> +#include <linux/of_reserved_mem.h> #include <linux/pm_runtime.h> #include <linux/reset.h> #include <sound/soc.h>
@@ -2835,6 +2836,12 @@ static int mt8186_afe_pcm_dev_probe(struct platform_device *pdev) afe_priv = afe->platform_priv; afe->dev = &pdev->dev; + ret =of_reserved_mem_device_init (dev); +if (ret) { +dev_info (dev,"no reserved memory found, pre-allocating buffers instead\n" ); + afe->preallocate_buffers = true; + } + afe->base_addr =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (afe->base_addr))return PTR_ERR (afe->base_addr);
sound/soc/mediatek/mt8192/mt8192-afe-pcm.c +7 -0
@@ -12,6 +12,7 @@#include <linux/mfd/syscon.h> #include <linux/of.h> #include <linux/of_address.h> +#include <linux/of_reserved_mem.h> #include <linux/pm_runtime.h> #include <linux/reset.h> #include <sound/soc.h>
@@ -2179,6 +2180,12 @@ static int mt8192_afe_pcm_dev_probe(struct platform_device *pdev) afe->dev = dev; + ret =of_reserved_mem_device_init (dev); +if (ret) { +dev_info (dev,"no reserved memory found, pre-allocating buffers instead\n" ); + afe->preallocate_buffers = true; + } +/* init audio related clock */ ret =mt8192_init_clock (afe);if (ret) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 37/627 ASoC: mediatek: mt8183-afe-pcm: Support >32 bit DMA addresses
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit 9e7bc5cb8d089d9799e17a9ac99c5da9b13b02e3 ]
The AFE DMA hardware supports up to 34 bits for DMA addresses. This is missing from the driver and prevents reserved memory regions from working properly when the allocated region is above the 4GB line.
Fill in the related register offsets for each DAI, and also set the DMA mask. Also fill in the LSB end register offsets for completeness.
--- sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
sound/soc/mediatek/mt8183/mt8183-afe-pcm.c +14 -0
@@ -6,6 +6,7 @@// Author: KaiChieh Chuang <[email protected]> #include <linux/delay.h> +#include <linux/dma-mapping.h> #include <linux/module.h> #include <linux/mfd/syscon.h> #include <linux/of.h>
@@ -432,6 +433,9 @@ static const struct snd_soc_component_driver mt8183_afe_pcm_dai_component = { .reg_ofs_base = AFE_##_id##_BASE, \ .reg_ofs_cur = AFE_##_id##_CUR, \ .reg_ofs_end = AFE_##_id##_END, \ + .reg_ofs_base_msb = AFE_##_id##_BASE_MSB, \ + .reg_ofs_cur_msb = AFE_##_id##_CUR_MSB, \ + .reg_ofs_end_msb = AFE_##_id##_END_MSB, \ .fs_reg = (_fs_reg), \ .fs_shift = _id##_MODE_SFT, \ .fs_maskbit = _id##_MODE_MASK, \
@@ -463,11 +467,17 @@ static const struct snd_soc_component_driver mt8183_afe_pcm_dai_component = {#define AFE_VUL12_BASE AFE_VUL_D2_BASE#define AFE_VUL12_CUR AFE_VUL_D2_CUR#define AFE_VUL12_END AFE_VUL_D2_END +#define AFE_VUL12_BASE_MSB AFE_VUL_D2_BASE_MSB +#define AFE_VUL12_CUR_MSB AFE_VUL_D2_CUR_MSB +#define AFE_VUL12_END_MSB AFE_VUL_D2_END_MSB#define AWB2_HD_ALIGN_SFT AWB2_ALIGN_SFT#define VUL12_DATA_SFT VUL12_MONO_SFT#define AFE_HDMI_BASE AFE_HDMI_OUT_BASE#define AFE_HDMI_CUR AFE_HDMI_OUT_CUR#define AFE_HDMI_END AFE_HDMI_OUT_END +#define AFE_HDMI_BASE_MSB AFE_HDMI_OUT_BASE_MSB +#define AFE_HDMI_CUR_MSB AFE_HDMI_OUT_CUR_MSB +#define AFE_HDMI_END_MSB AFE_HDMI_OUT_END_MSBstatic const struct mtk_base_memif_data memif_data[MT8183_MEMIF_NUM ] = {MT8183_MEMIF (DL1 ,AFE_DAC_CON1 ,AFE_DAC_CON1 ),
@@ -764,6 +774,10 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev)struct reset_control *rstc;int i, irq_id, ret; + ret =dma_set_mask_and_coherent (&pdev->dev,DMA_BIT_MASK (34 )); +if (ret) +return ret; + afe =devm_kzalloc (&pdev->dev,sizeof (*afe),GFP_KERNEL );if (!afe)return -ENOMEM ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 38/627 arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 696a4c325fad8af95da6a9d797766d1613831622 ]
TQMa9352 is only using LPDDR4X, so the BUCK2 regulator should be fixed at 600MV.
--- arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi +3 -3
@@ -1,6 +1,6 @@ // SPDX-License-Identifier: (GPL-2.0-or-later OR MIT) /* - * Copyright (c) 2022 TQ-Systems GmbH <[email protected]>, + * Copyright (c) 2022-2025 TQ-Systems GmbH <[email protected]>, * D-82229 Seefeld, Germany. * Author: Markus Niebel */
@@ -110,11 +110,11 @@ buck1: BUCK1 { regulator-ramp-delay = <3125>; }; - /* V_DDRQ - 1.1 LPDDR4 or 0.6 LPDDR4X */ + /* V_DDRQ - 0.6 V for LPDDR4X */ buck2: BUCK2 { regulator-name = "BUCK2"; regulator-min-microvolt = <600000>; - regulator-max-microvolt = <1100000>; + regulator-max-microvolt = <600000>; regulator-boot-on; regulator-always-on; regulator-ramp-delay = <3125>;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 39/627 selftests: Fix errno checking in syscall_user_dispatch test
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Vyukov <[email protected]>
[ Upstream commit b89732c8c8357487185f260a723a060b3476144e ]
Successful syscalls don't change errno, so checking errno is wrong to ensure that a syscall has failed. For example for the following sequence:
prctl(PR_SET_SYSCALL_USER_DISPATCH, op, 0x0, 0xff, 0); EXPECT_EQ(EINVAL, errno); prctl(PR_SET_SYSCALL_USER_DISPATCH, op, 0x0, 0x0, &sel); EXPECT_EQ(EINVAL, errno);
only the first syscall may fail and set errno, but the second may succeed and keep errno intact, and the check will falsely pass.
Or if errno happened to be EINVAL before, even the first check may falsely pass.
Also use EXPECT/ASSERT consistently. Currently there is an inconsistent mix without obvious reasons for usage of one or another.
--- .../syscall_user_dispatch/sud_test.c | 50 +++++++++---------- 1 file changed, 25 insertions(+), 25 deletions(-)
tools/testing/selftests/syscall_user_dispatch/sud_test.c +25 -25
@@ -79,6 +79,21 @@ TEST_SIGNAL(dispatch_trigger_sigsys, SIGSYS) } } +static void prctl_valid (struct __test_metadata *_metadata, +unsigned long op,unsigned long off, +unsigned long size,void *sel) +{ +EXPECT_EQ (0 ,prctl (PR_SET_SYSCALL_USER_DISPATCH , op, off, size, sel)); +} + +static void prctl_invalid (struct __test_metadata *_metadata, +unsigned long op,unsigned long off, +unsigned long size,void *sel,int err) +{ +EXPECT_EQ (-1 ,prctl (PR_SET_SYSCALL_USER_DISPATCH , op, off, size, sel)); +EXPECT_EQ (err, errno); +} +TEST (bad_prctl_param) {char sel =SYSCALL_DISPATCH_FILTER_ALLOW ;
@@ -86,57 +101,42 @@ TEST(bad_prctl_param)/* Invalid op */ op =-1 ; -prctl (PR_SET_SYSCALL_USER_DISPATCH , op,0 ,0 , &sel); -ASSERT_EQ (EINVAL , errno); +prctl_invalid (_metadata, op,0 ,0 , &sel,EINVAL );/* PR_SYS_DISPATCH_OFF */ op =PR_SYS_DISPATCH_OFF ;/* offset != 0 */ -prctl (PR_SET_SYSCALL_USER_DISPATCH , op,0x1 ,0x0 ,0 ); -EXPECT_EQ (EINVAL , errno); +prctl_invalid (_metadata, op,0x1 ,0x0 ,0 ,EINVAL );/* len != 0 */ -prctl (PR_SET_SYSCALL_USER_DISPATCH , op,0x0 ,0xff ,0 ); -EXPECT_EQ (EINVAL , errno); +prctl_invalid (_metadata, op,0x0 ,0xff ,0 ,EINVAL );/* sel != NULL */ -prctl (PR_SET_SYSCALL_USER_DISPATCH , op,0x0 ,0x0 , &sel); -EXPECT_EQ (EINVAL , errno); +prctl_invalid (_metadata, op,0x0 ,0x0 , &sel,EINVAL );/* Valid parameter */ - errno =0 ; -prctl (PR_SET_SYSCALL_USER_DISPATCH , op,0x0 ,0x0 ,0x0 ); -EXPECT_EQ (0 , errno); +prctl_valid (_metadata, op,0x0 ,0x0 ,0x0 );/* PR_SYS_DISPATCH_ON */ op =PR_SYS_DISPATCH_ON ;/* Dispatcher region is bad (offset > 0 && len == 0) */ -prctl (PR_SET_SYSCALL_USER_DISPATCH , op,0x1 ,0x0 , &sel); -EXPECT_EQ (EINVAL , errno); -prctl (PR_SET_SYSCALL_USER_DISPATCH , op,-1L ,0x0 , &sel); -EXPECT_EQ (EINVAL , errno); +prctl_invalid (_metadata, op,0x1 ,0x0 , &sel,EINVAL ); +prctl_invalid (_metadata, op,-1L ,0x0 , &sel,EINVAL );/* Invalid selector */ -prctl (PR_SET_SYSCALL_USER_DISPATCH , op,0x0 ,0x1 , (void *)-1 ); -ASSERT_EQ (EFAULT , errno); +prctl_invalid (_metadata, op,0x0 ,0x1 , (void *)-1 ,EFAULT );/* * Dispatcher range overflows unsigned long */ -prctl (PR_SET_SYSCALL_USER_DISPATCH ,PR_SYS_DISPATCH_ON ,1 ,-1L , &sel); - ASSERT_EQ(EINVAL, errno) { -TH_LOG ("Should reject bad syscall range" ); - } +prctl_invalid (_metadata,PR_SYS_DISPATCH_ON ,1 ,-1L , &sel,EINVAL );/* * Allowed range overflows usigned long */ -prctl (PR_SET_SYSCALL_USER_DISPATCH ,PR_SYS_DISPATCH_ON ,-1L ,0x1 , &sel); - ASSERT_EQ(EINVAL, errno) { -TH_LOG ("Should reject bad syscall range" ); - } +prctl_invalid (_metadata,PR_SYS_DISPATCH_ON ,-1L ,0x1 , &sel,EINVAL ); }/*
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 40/627 soc: qcom: QMI encoding/decoding for big endian
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Wilhelm <[email protected]>
[ Upstream commit 3ced38da5f7de4c260f9eaa86fc805827953243a ]
The QMI_DATA_LEN type may have different sizes. Taking the element's address of that type and interpret it as a smaller sized ones works fine for little endian platforms but not for big endian ones. Instead use temporary variables of smaller sized types and cast them correctly to support big endian platforms.
--- drivers/soc/qcom/qmi_encdec.c | 46 +++++++++++++++++++++++++++++------ 1 file changed, 38 insertions(+), 8 deletions(-)
drivers/soc/qcom/qmi_encdec.c +38 -8
@@ -304,6 +304,8 @@ static int qmi_encode(const struct qmi_elem_info *ei_array, void *out_buf,const void *buf_src;int encode_tlv =0 ;int rc; +u8 val8; +u16 val16;if (!ei_array)return 0 ;
@@ -338,7 +340,6 @@ static int qmi_encode(const struct qmi_elem_info *ei_array, void *out_buf,break ;case QMI_DATA_LEN : -memcpy (&data_len_value, buf_src, temp_ei->elem_size); data_len_sz = temp_ei->elem_size ==sizeof (u8) ?sizeof (u8) :sizeof (u16);/* Check to avoid out of range buffer access */
@@ -348,8 +349,17 @@ static int qmi_encode(const struct qmi_elem_info *ei_array, void *out_buf, __func__);return -ETOOSMALL ; } - rc =qmi_encode_basic_elem (buf_dst, &data_len_value, -1 , data_len_sz); +if (data_len_sz ==sizeof (u8)) { + val8 = *(u8 *)buf_src; + data_len_value = (u32 )val8; + rc =qmi_encode_basic_elem (buf_dst, &val8, +1 , data_len_sz); + }else { + val16 = *(u16 *)buf_src; + data_len_value = (u32 )le16_to_cpu (val16); + rc =qmi_encode_basic_elem (buf_dst, &val16, +1 , data_len_sz); + }UPDATE_ENCODE_VARIABLES (temp_ei, buf_dst, encoded_bytes, tlv_len, encode_tlv, rc);
@@ -523,14 +533,23 @@ static int qmi_decode_string_elem(const struct qmi_elem_info *ei_array,u32 string_len =0 ;u32 string_len_sz =0 ;const struct qmi_elem_info *temp_ei = ei_array; +u8 val8; +u16 val16;if (dec_level ==1 ) { string_len = tlv_len; }else { string_len_sz = temp_ei->elem_len <=U8_MAX ?sizeof (u8) :sizeof (u16); - rc =qmi_decode_basic_elem (&string_len, buf_src, -1 , string_len_sz); +if (string_len_sz ==sizeof (u8)) { + rc =qmi_decode_basic_elem (&val8, buf_src, +1 , string_len_sz); + string_len = (u32 )val8; + }else { + rc =qmi_decode_basic_elem (&val16, buf_src, +1 , string_len_sz); + string_len = (u32 )val16; + } decoded_bytes += rc; }
@@ -604,6 +623,9 @@ static int qmi_decode(const struct qmi_elem_info *ei_array, void *out_c_struct,u32 decoded_bytes =0 ;const void *buf_src = in_buf;int rc; +u8 val8; +u16 val16; +u32 val32;while (decoded_bytes < in_buf_len) {if (dec_level >=2 && temp_ei->data_type ==QMI_EOTI )
@@ -642,9 +664,17 @@ static int qmi_decode(const struct qmi_elem_info *ei_array, void *out_c_struct,if (temp_ei->data_type ==QMI_DATA_LEN ) { data_len_sz = temp_ei->elem_size ==sizeof (u8) ?sizeof (u8) :sizeof (u16); - rc =qmi_decode_basic_elem (&data_len_value, buf_src, -1 , data_len_sz); -memcpy (buf_dst, &data_len_value,sizeof (u32)); +if (data_len_sz ==sizeof (u8)) { + rc =qmi_decode_basic_elem (&val8, buf_src, +1 , data_len_sz); + data_len_value = (u32 )val8; + }else { + rc =qmi_decode_basic_elem (&val16, buf_src, +1 , data_len_sz); + data_len_value = (u32 )val16; + } + val32 =cpu_to_le32 (data_len_value); +memcpy (buf_dst, &val32,sizeof (u32)); temp_ei = temp_ei +1 ; buf_dst = out_c_struct + temp_ei->offset; tlv_len -= data_len_sz;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 41/627 soc: qcom: fix endianness for QMI header
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Wilhelm <[email protected]>
[ Upstream commit 07a4688833b237331e5045f90fc546c085b28c86 ]
The members of QMI header have to be swapped on big endian platforms. Use __le16 types instead of u16 ones.
--- drivers/soc/qcom/qmi_encdec.c | 6 +++--- drivers/soc/qcom/qmi_interface.c | 6 +++--- include/linux/soc/qcom/qmi.h | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-)
drivers/soc/qcom/qmi_encdec.c +3 -3
@@ -776,9 +776,9 @@ void *qmi_encode_message(int type, unsigned int msg_id, size_t *len, hdr = msg; hdr->type = type; - hdr->txn_id = txn_id; - hdr->msg_id = msg_id; - hdr->msg_len = msglen; + hdr->txn_id =cpu_to_le16 (txn_id); + hdr->msg_id =cpu_to_le16 (msg_id); + hdr->msg_len =cpu_to_le16 (msglen); *len =sizeof (*hdr) + msglen;
drivers/soc/qcom/qmi_interface.c +3 -3
@@ -400,7 +400,7 @@ static void qmi_invoke_handler(struct qmi_handle *qmi, struct sockaddr_qrtr *sq,for (handler = qmi->handlers; handler->fn; handler++) {if (handler->type == hdr->type && - handler->msg_id == hdr->msg_id) + handler->msg_id ==le16_to_cpu (hdr->msg_id))break ; }
@@ -488,7 +488,7 @@ static void qmi_handle_message(struct qmi_handle *qmi,/* If this is a response, find the matching transaction handle */ if (hdr->type ==QMI_RESPONSE ) {mutex_lock (&qmi->txn_lock); - txn =idr_find (&qmi->txns, hdr->txn_id); + txn =idr_find (&qmi->txns,le16_to_cpu (hdr->txn_id));/* Ignore unexpected responses */ if (!txn) {
@@ -514,7 +514,7 @@ static void qmi_handle_message(struct qmi_handle *qmi, }else {/* Create a txn based on the txn_id of the incoming message */ memset (&tmp_txn,0 ,sizeof (tmp_txn)); - tmp_txn.id = hdr->txn_id; + tmp_txn.id =le16_to_cpu (hdr->txn_id);qmi_invoke_handler (qmi, sq, &tmp_txn, buf, len); }
include/linux/soc/qcom/qmi.h +3 -3
@@ -24,9 +24,9 @@ struct socket;*/ struct qmi_header {u8 type; -u16 txn_id; -u16 msg_id; -u16 msg_len; +__le16 txn_id; +__le16 msg_id; +__le16 msg_len; } __packed;#define QMI_REQUEST 0
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 42/627 arm64: dts: qcom: qcs615: fix a crash issue caused by infinite loop for Coresight
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Gan <[email protected]>
[ Upstream commit bd4f35786d5f0798cc1f8c187a81a7c998e6c58f ]
An infinite loop has been created by the Coresight devices. When only a source device is enabled, the coresight_find_activated_sysfs_sink function is recursively invoked in an attempt to locate an active sink device, ultimately leading to a stack overflow and system crash. Therefore, disable the replicator1 to break the infinite loop and prevent a potential stack overflow.
replicator1_out -> funnel_swao_in6 -> tmc_etf_swao_in -> tmc_etf_swao_out
| |
replicator1_in replicator_swao_in
| |
replicator0_out1 replicator_swao_out0
| |
replicator0_in funnel_in1_in3
| |tmc_etf_out <- tmc_etf_in <- funnel_merg_out <- funnel_merg_in1 <- funnel_in1_out
[call trace]
dump_backtrace+0x9c/0x128 show_stack+0x20/0x38 dump_stack_lvl+0x48/0x60 dump_stack+0x18/0x28 panic+0x340/0x3b0 nmi_panic+0x94/0xa0 panic_bad_stack+0x114/0x138 handle_bad_stack+0x34/0xb8 __bad_stack+0x78/0x80 coresight_find_activated_sysfs_sink+0x28/0xa0 [coresight] coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight] coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight] coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight] coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight] ... coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight] coresight_enable_sysfs+0x80/0x2a0 [coresight]
side effect after the change:
Only trace data originating from AOSS can reach the ETF_SWAO and EUD sinks.
--- arch/arm64/boot/dts/qcom/qcs615.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/qcom/qcs615.dtsi +1 -0
@@ -1902,6 +1902,7 @@ replicator@604a000 { clocks = <&aoss_qmp>; clock-names = "apb_pclk"; + status = "disabled"; in-ports { port {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 43/627 arm64: dts: qcom: sdm845: Expand IMEM region
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 81a4a7de3d4031e77b5796479ef21aefb0862807 ]
We need more than what is currently described, expand the region to its actual boundaries.
--- arch/arm64/boot/dts/qcom/sdm845.dtsi | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/arm64/boot/dts/qcom/sdm845.dtsi +5 -5
@@ -5081,18 +5081,18 @@ spmi_bus: spmi@c440000 { #interrupt-cells = <4>; }; - sram@146bf000 { + sram@14680000 { compatible = "qcom,sdm845-imem", "syscon", "simple-mfd"; - reg = <0 0x146bf000 0 0x1000>; + reg = <0 0x14680000 0 0x40000>; #address-cells = <1>; #size-cells = <1>; - ranges = <0 0 0x146bf000 0x1000>; + ranges = <0 0 0x14680000 0x40000>; - pil-reloc@94c { + pil-reloc@3f94c { compatible = "qcom,pil-reloc-info"; - reg = <0x94c 0xc8>; + reg = <0x3f94c 0xc8>; }; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 44/627 arm64: dts: qcom: sc7180: Expand IMEM region
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 965e28cad4739b11f1bc58c0a9935e025938bb1f ]
We need more than what is currently described, expand the region to its actual boundaries.
--- arch/arm64/boot/dts/qcom/sc7180.dtsi | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/arm64/boot/dts/qcom/sc7180.dtsi +5 -5
@@ -3526,18 +3526,18 @@ spmi_bus: spmi@c440000 { #interrupt-cells = <4>; }; - sram@146aa000 { + sram@14680000 { compatible = "qcom,sc7180-imem", "syscon", "simple-mfd"; - reg = <0 0x146aa000 0 0x2000>; + reg = <0 0x14680000 0 0x2e000>; #address-cells = <1>; #size-cells = <1>; - ranges = <0 0 0x146aa000 0x2000>; + ranges = <0 0 0x14680000 0x2e000>; - pil-reloc@94c { + pil-reloc@2a94c { compatible = "qcom,pil-reloc-info"; - reg = <0x94c 0xc8>; + reg = <0x2a94c 0xc8>; }; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 45/627 arm64: dts: qcom: qcs615: disable the CTI device of the camera block
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Gan <[email protected]>
[ Upstream commit 1b7fc8a281cae9e3176584558a4ac551ce0f777d ]
Disable the CTI device of the camera block to prevent potential NoC errors during AMBA bus device matching.
The clocks for the Qualcomm Debug Subsystem (QDSS) are managed by aoss_qmp through a mailbox. However, the camera block resides outside the AP domain, meaning its QDSS clock cannot be controlled via aoss_qmp.
--- arch/arm64/boot/dts/qcom/qcs615.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm64/boot/dts/qcom/qcs615.dtsi +3 -0
@@ -2462,6 +2462,9 @@ cti@6c13000 { clocks = <&aoss_qmp>; clock-names = "apb_pclk"; + + /* Not all required clocks can be enabled from the OS */ + status = "fail"; }; cti@6c20000 {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 46/627 arm64: dts: exynos: gs101: Add local-timer-stop to cpuidle nodes
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
[ Upstream commit b649082312dd1a4c3989bbdb7c25eb711e9b1d94 ]
In preparation for switching to the architected timer as the primary clockevents device, mark the cpuidle nodes with the 'local-timer-stop' property to indicate that an alternative clockevents device must be used for waking up from the "c2" idle state.
--- arch/arm64/boot/dts/exynos/google/gs101.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm64/boot/dts/exynos/google/gs101.dtsi +3 -0
@@ -155,6 +155,7 @@ ananke_cpu_sleep: cpu-ananke-sleep { idle-state-name = "c2"; compatible = "arm,idle-state"; arm,psci-suspend-param = <0x0010000>; + local-timer-stop; entry-latency-us = <70>; exit-latency-us = <160>; min-residency-us = <2000>;
@@ -164,6 +165,7 @@ enyo_cpu_sleep: cpu-enyo-sleep { idle-state-name = "c2"; compatible = "arm,idle-state"; arm,psci-suspend-param = <0x0010000>; + local-timer-stop; entry-latency-us = <150>; exit-latency-us = <190>; min-residency-us = <2500>;
@@ -173,6 +175,7 @@ hera_cpu_sleep: cpu-hera-sleep { idle-state-name = "c2"; compatible = "arm,idle-state"; arm,psci-suspend-param = <0x0010000>; + local-timer-stop; entry-latency-us = <235>; exit-latency-us = <220>; min-residency-us = <3500>;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 47/627 arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijuan Gao <[email protected]>
[ Upstream commit 7bd7209e9cb11c8864e601d915008da088476f0c ]
Fix the incorrect IRQ numbers for ready and handover on sa8775p. The correct values are as follows:
Fatal interrupt - 0
Ready interrupt - 1
Handover interrupt - 2
Stop acknowledge interrupt - 3
--- arch/arm64/boot/dts/qcom/sa8775p.dtsi | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/arm64/boot/dts/qcom/sa8775p.dtsi +5 -5
@@ -5571,8 +5571,8 @@ remoteproc_gpdsp0: remoteproc@20c00000 { interrupts-extended = <&intc GIC_SPI 768 IRQ_TYPE_EDGE_RISING>, <&smp2p_gpdsp0_in 0 0>, - <&smp2p_gpdsp0_in 2 0>, <&smp2p_gpdsp0_in 1 0>, + <&smp2p_gpdsp0_in 2 0>, <&smp2p_gpdsp0_in 3 0>; interrupt-names = "wdog", "fatal", "ready", "handover", "stop-ack";
@@ -5614,8 +5614,8 @@ remoteproc_gpdsp1: remoteproc@21c00000 { interrupts-extended = <&intc GIC_SPI 624 IRQ_TYPE_EDGE_RISING>, <&smp2p_gpdsp1_in 0 0>, - <&smp2p_gpdsp1_in 2 0>, <&smp2p_gpdsp1_in 1 0>, + <&smp2p_gpdsp1_in 2 0>, <&smp2p_gpdsp1_in 3 0>; interrupt-names = "wdog", "fatal", "ready", "handover", "stop-ack";
@@ -5755,8 +5755,8 @@ remoteproc_cdsp0: remoteproc@26300000 { interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>, <&smp2p_cdsp0_in 0 IRQ_TYPE_EDGE_RISING>, - <&smp2p_cdsp0_in 2 IRQ_TYPE_EDGE_RISING>, <&smp2p_cdsp0_in 1 IRQ_TYPE_EDGE_RISING>, + <&smp2p_cdsp0_in 2 IRQ_TYPE_EDGE_RISING>, <&smp2p_cdsp0_in 3 IRQ_TYPE_EDGE_RISING>; interrupt-names = "wdog", "fatal", "ready", "handover", "stop-ack";
@@ -5887,8 +5887,8 @@ remoteproc_cdsp1: remoteproc@2a300000 { interrupts-extended = <&intc GIC_SPI 798 IRQ_TYPE_EDGE_RISING>, <&smp2p_cdsp1_in 0 IRQ_TYPE_EDGE_RISING>, - <&smp2p_cdsp1_in 2 IRQ_TYPE_EDGE_RISING>, <&smp2p_cdsp1_in 1 IRQ_TYPE_EDGE_RISING>, + <&smp2p_cdsp1_in 2 IRQ_TYPE_EDGE_RISING>, <&smp2p_cdsp1_in 3 IRQ_TYPE_EDGE_RISING>; interrupt-names = "wdog", "fatal", "ready", "handover", "stop-ack";
@@ -6043,8 +6043,8 @@ remoteproc_adsp: remoteproc@30000000 { interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>, <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>, - <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>, <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>, + <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>, <&smp2p_adsp_in 3 IRQ_TYPE_EDGE_RISING>; interrupt-names = "wdog", "fatal", "ready", "handover", "stop-ack";
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 48/627 arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: André Apitzsch <[email protected]>
[ Upstream commit 76270a18dbdf0bb50615f1b29d2cae8d683da01e ]
The blsp_dma controller is shared between the different subsystems, which is why it is already initialized by the firmware. We should not reinitialize it from Linux to avoid potential other users of the DMA engine to misbehave.
In mainline this can be described using the "qcom,controlled-remotely" property. In the downstream/vendor kernel from Qualcomm there is an opposite "qcom,managed-locally" property. This property is *not* set for the qcom,sps-dma@7884000 and qcom,sps-dma@7ac4000 [1] so adding "qcom,controlled-remotely" upstream matches the behavior of the downstream/vendor kernel.
Adding this fixes booting Longcheer L9360.
--- arch/arm64/boot/dts/qcom/msm8976.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/qcom/msm8976.dtsi +2 -0
@@ -1331,6 +1331,7 @@ blsp1_dma: dma-controller@7884000 { clock-names = "bam_clk"; #dma-cells = <1>; qcom,ee = <0>; + qcom,controlled-remotely; }; blsp1_uart1: serial@78af000 {
@@ -1451,6 +1452,7 @@ blsp2_dma: dma-controller@7ac4000 { clock-names = "bam_clk"; #dma-cells = <1>; qcom,ee = <0>; + qcom,controlled-remotely; }; blsp2_uart2: serial@7af0000 {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 49/627 pm: cpupower: Fix printing of CORE, CPU fields in cpupower-monitor
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gautham R. Shenoy <[email protected]>
[ Upstream commit 14a3318b4ac8ae0ca2e1132a89de167e1030fbdb ]
After the commit 0014f65e3df0 ("pm: cpupower: remove hard-coded topology depth values"), "cpupower monitor" output ceased to print the CORE and the CPU fields on a multi-socket platform.
The reason for this is that the patch changed the behaviour to break out of the switch-case after printing the PKG details, while prior to the patch, the CORE and the CPU details would also get printed since the "if" condition check would pass for any level whose topology depth was lesser than that of a package.
Fix this ensuring all the details below a desired topology depth are printed in the cpupower monitor output.
--- tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c | 4 ---- 1 file changed, 4 deletions(-)
tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c +0 -4
@@ -121,10 +121,8 @@ void print_header(int topology_depth)switch (topology_depth) {case TOPOLOGY_DEPTH_PKG :printf (" PKG|" ); -break ;case TOPOLOGY_DEPTH_CORE :printf ("CORE|" ); -break ;case TOPOLOGY_DEPTH_CPU :printf (" CPU|" );break ;
@@ -167,10 +165,8 @@ void print_results(int topology_depth, int cpu)switch (topology_depth) {case TOPOLOGY_DEPTH_PKG :printf ("%4d|" , cpu_top.core_info[cpu].pkg); -break ;case TOPOLOGY_DEPTH_CORE :printf ("%4d|" , cpu_top.core_info[cpu].core); -break ;case TOPOLOGY_DEPTH_CPU :printf ("%4d|" , cpu_top.core_info[cpu].cpu);break ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 50/627 ARM: dts: vfxxx: Correctly use two tuples for timer address
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit f3440dcf8b994197c968fbafe047ce27eed226e8 ]
Address and size-cells are 1 and the ftm timer node takes two address spaces in "reg" property, so this should be in two <> tuples. Change has no functional impact, but original code is confusing/less readable.
--- arch/arm/boot/dts/nxp/vf/vfxxx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/nxp/vf/vfxxx.dtsi +1 -1
@@ -603,7 +603,7 @@ usbmisc1: usb@400b4800 { ftm: ftm@400b8000 { compatible = "fsl,ftm-timer"; - reg = <0x400b8000 0x1000 0x400b9000 0x1000>; + reg = <0x400b8000 0x1000>, <0x400b9000 0x1000>; interrupts = <44 IRQ_TYPE_LEVEL_HIGH>; clock-names = "ftm-evt", "ftm-src", "ftm-evt-counter-en", "ftm-src-counter-en";
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 51/627 usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <[email protected]>
[ Upstream commit d9e496a9fb4021a9e6b11e7ba221a41a2597ac27 ]
The variable of_match was incorrectly declared as a bool. It is assigned the return value of of_match_device(), which is a pointer of type const struct of_device_id *.
--- drivers/usb/host/xhci-plat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-plat.c +1 -1
@@ -152,7 +152,7 @@ int xhci_plat_probe(struct platform_device *pdev, struct device *sysdev, const sint ret;int irq;struct xhci_plat_priv *priv =NULL ; -bool of_match; +const struct of_device_id *of_match;if (usb_disabled ())return -ENODEV ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 52/627 usb: misc: apple-mfi-fastcharge: Make power supply names unique
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charalampos Mitrodimas <[email protected]>
[ Upstream commit 43007b89fb2de746443fbbb84aedd1089afdf582 ]
When multiple Apple devices are connected concurrently, the apple-mfi-fastcharge driver fails to probe the subsequent devices with the following error:
sysfs: cannot create duplicate filename '/class/power_supply/apple_mfi_fastcharge' apple-mfi-fastcharge 5-2.4.3.3: probe of 5-2.4.3.3 failed with error -17
This happens because the driver uses a fixed power supply name ("apple_mfi_fastcharge") for all devices, causing a sysfs name conflict when a second device is connected.
Fix this by generating unique names using the USB bus and device number (e.g., "apple_mfi_fastcharge_5-12"). This ensures each connected device gets a unique power supply entry in sysfs.
The change requires storing a copy of the power_supply_desc structure in the per-device mfi_device struct, since the name pointer needs to remain valid for the lifetime of the power supply registration.
--- drivers/usb/misc/apple-mfi-fastcharge.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-)
drivers/usb/misc/apple-mfi-fastcharge.c +21 -3
@@ -44,6 +44,7 @@ MODULE_DEVICE_TABLE(usb, mfi_fc_id_table);struct mfi_device {struct usb_device *udev;struct power_supply *battery; +struct power_supply_desc battery_desc;int charge_type; };
@@ -178,6 +179,7 @@ static int mfi_fc_probe(struct usb_device *udev) {struct power_supply_config battery_cfg = {};struct mfi_device *mfi =NULL ; +char *battery_name;int err;if (!mfi_fc_match (udev))
@@ -187,23 +189,38 @@ static int mfi_fc_probe(struct usb_device *udev)if (!mfi)return -ENOMEM ; + battery_name =kasprintf (GFP_KERNEL ,"apple_mfi_fastcharge_%d-%d" , + udev->bus->busnum, udev->devnum); +if (!battery_name) { + err = -ENOMEM ; + goto err_free_mfi; + } + + mfi->battery_desc = apple_mfi_fc_desc; + mfi->battery_desc.name = battery_name; + battery_cfg.drv_data = mfi; mfi->charge_type =POWER_SUPPLY_CHARGE_TYPE_TRICKLE ; mfi->battery =power_supply_register (&udev->dev, - &apple_mfi_fc_desc, + &mfi->battery_desc, &battery_cfg);if (IS_ERR (mfi->battery)) {dev_err (&udev->dev,"Can't register battery\n" ); err =PTR_ERR (mfi->battery); -kfree (mfi); -return err; + goto err_free_name; } mfi->udev =usb_get_dev (udev);dev_set_drvdata (&udev->dev, mfi);return 0 ; + +err_free_name: +kfree (battery_name); +err_free_mfi: +kfree (mfi); +return err; }static void mfi_fc_disconnect (struct usb_device *udev)
@@ -213,6 +230,7 @@ static void mfi_fc_disconnect(struct usb_device *udev) mfi =dev_get_drvdata (&udev->dev);if (mfi->battery)power_supply_unregister (mfi->battery); +kfree (mfi->battery_desc.name);dev_set_drvdata (&udev->dev,NULL );usb_put_dev (mfi->udev);kfree (mfi);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 53/627 arm64: dts: rockchip: fix endpoint dtc warning for PX30 ISP
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quentin Schulz <[email protected]>
[ Upstream commit 5ddb2d46852997a28f8d77153e225611a8268b74 ]
dtc complains with the following message for DTSes which use the ISP:
arch/arm64/boot/dts/rockchip/px30.dtsi:1272.19-1276.6: Warning (graph_child_address): /isp@ff4a0000/ports/port@0: graph node has single child node 'endpoint@0', #address-cells/#size-cells are not necessary
Typically, it is expected from the device DTS(I) to update the SoC DTSI nodes if they have more than one endpoint, so let's assume there's only one endpoint in port@0 by default, instead of forcing board DTS(I)s to /delete-property/ address-cells and size-cells to make dtc happy.
Because PX30 PP1516/EVB's endpoint@0 is the only endpoint and considering its parent node now has no address-cells property, dtc complains (same messages for PX30 EVB):
arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi:447.29-451.6: Warning (avoid_default_addr_size): /isp@ff4a0000/ports/port@0/endpoint@0: Relying on default #address-cells value arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi:447.29-451.6: Warning (avoid_default_addr_size): /isp@ff4a0000/ports/port@0/endpoint@0: Relying on default #size-cells value arch/arm64/boot/dts/rockchip/px30-pp1516-ltk050h3146w-a2.dtb: Warning (avoid_unnecessary_addr_size): Failed prerequisite 'avoid_default_addr_size' arch/arm64/boot/dts/rockchip/px30-pp1516-ltk050h3146w-a2.dtb: Warning (unique_unit_address_if_enabled): Failed prerequisite 'avoid_default_addr_size' arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi:447.29-451.6: Warning (graph_endpoint): /isp@ff4a0000/ports/port@0/endpoint@0: graph node '#address-cells' is -1, must be 1 arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi:447.29-451.6: Warning (graph_endpoint): /isp@ff4a0000/ports/port@0/endpoint@0: graph node '#size-cells' is -1, must be 0 arch/arm64/boot/dts/rockchip/px30-pp1516-ltk050h3146w-a2.dtb: Warning (graph_child_address): Failed prerequisite 'graph_endpoint'
so we fix that by removing the reg property. dtc still complains (same messages for PX30 EVB):
arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi:447.29-450.6: Warning (unit_address_vs_reg): /isp@ff4a0000/ports/port@0/endpoint@0: node has a unit name, but no reg or ranges property
so we also remove the @0 suffix off the node name.
--- arch/arm64/boot/dts/rockchip/px30-evb.dts | 3 +-- arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi | 3 +-- arch/arm64/boot/dts/rockchip/px30.dtsi | 2 -- 3 files changed, 2 insertions(+), 6 deletions(-)
arch/arm64/boot/dts/rockchip/px30-evb.dts +1 -2
@@ -483,8 +483,7 @@ &isp { ports { port@0 { - mipi_in_ucam: endpoint@0 { - reg = <0>; + mipi_in_ucam: endpoint { data-lanes = <1 2>; remote-endpoint = <&ucam_out>; };
arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi +1 -2
@@ -444,8 +444,7 @@ &isp { ports { port@0 { - mipi_in_ucam: endpoint@0 { - reg = <0>; + mipi_in_ucam: endpoint { data-lanes = <1 2>; remote-endpoint = <&ucam_out>; };
arch/arm64/boot/dts/rockchip/px30.dtsi +0 -2
@@ -1271,8 +1271,6 @@ ports { port@0 { reg = <0>; - #address-cells = <1>; - #size-cells = <0>; }; }; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 54/627 arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wadim Egorov <[email protected]>
[ Upstream commit 945e48a39c957924bc84d1a6c137da039e13855b ]
For the ICSSG PHYs to operate correctly, a 25 MHz reference clock must be supplied on CLKOUT0. Previously, our bootloader configured this clock, which is why the PRU Ethernet ports appeared to work, but the change never made it into the device tree.
Add clock properties to make EXT_REFCLK1.CLKOUT0 output a 25MHz clock.
--- arch/arm64/boot/dts/ti/k3-am642-phyboard-electra-rdk.dts | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/ti/k3-am642-phyboard-electra-rdk.dts +2 -0
@@ -322,6 +322,8 @@ AM64X_IOPAD(0x0040, PIN_OUTPUT, 7) /* (U21) GPMC0_AD1.GPIO0_16 */ &icssg0_mdio { pinctrl-names = "default"; pinctrl-0 = <&icssg0_mdio_pins_default &clkout0_pins_default>; + assigned-clocks = <&k3_clks 157 123>; + assigned-clock-parents = <&k3_clks 157 125>; status = "okay"; icssg0_phy1: ethernet-phy@1 {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 55/627 arm64: dts: ti: k3-am62p-verdin: Enable pull-ups on I2C_3_HDMI
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emanuele Ghidoli <[email protected]>
[ Upstream commit cb2d9c00770e2e6c51864704b5d98c9a0ddccaf9 ]
Enable internal bias pull-ups on the SoC-side I2C_3_HDMI that do not have external pull resistors populated on the SoM. This ensures proper default line levels.
--- arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi +2 -2
@@ -717,8 +717,8 @@ AM62PX_MCU_IOPAD(0x0010, PIN_INPUT, 7) /* (D10) MCU_SPI0_D1.MCU_GPIO0_4 */ /* SO /* Verdin I2C_3_HDMI */ pinctrl_mcu_i2c0: mcu-i2c0-default-pins { pinctrl-single,pins = < - AM62PX_MCU_IOPAD(0x0044, PIN_INPUT, 0) /* (E11) MCU_I2C0_SCL */ /* SODIMM 59 */ - AM62PX_MCU_IOPAD(0x0048, PIN_INPUT, 0) /* (D11) MCU_I2C0_SDA */ /* SODIMM 57 */ + AM62PX_MCU_IOPAD(0x0044, PIN_INPUT_PULLUP, 0) /* (E11) MCU_I2C0_SCL */ /* SODIMM 59 */ + AM62PX_MCU_IOPAD(0x0048, PIN_INPUT_PULLUP, 0) /* (D11) MCU_I2C0_SDA */ /* SODIMM 57 */ >; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 56/627 arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <[email protected]>
[ Upstream commit fdc8ad019ab9a2308b8cef54fbc366f482fb746f ]
Pinmux registers ends at 0x000f42ac (including). Thus, the size argument of the pinctrl-single node has to be 0x2b0. Fix it.
This will fix the following error:
pinctrl-single f4000.pinctrl: mux offset out of range: 0x2ac (0x2ac)
--- arch/arm64/boot/dts/ti/k3-am62p-j722s-common-main.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/ti/k3-am62p-j722s-common-main.dtsi +1 -1
@@ -259,7 +259,7 @@ secure_proxy_sa3: mailbox@43600000 { main_pmx0: pinctrl@f4000 { compatible = "pinctrl-single"; - reg = <0x00 0xf4000 0x00 0x2ac>; + reg = <0x00 0xf4000 0x00 0x2b0>; #pinctrl-cells = <1>; pinctrl-single,register-width = <32>; pinctrl-single,function-mask = <0xffffffff>;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 57/627 ARM: dts: microchip: sama7d65: Add clock name property
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Wanner <[email protected]>
[ Upstream commit 0029468132ba2e00a3010865038783d9b2e6cc07 ]
Add clock-output-names to the xtal nodes, so the driver can correctly register the main and slow xtal.
This fixes the issue of the SoC clock driver not being able to find the main xtal and slow xtal correctly causing a bad clock tree.
--- arch/arm/boot/dts/microchip/sama7d65.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/boot/dts/microchip/sama7d65.dtsi +2 -0
@@ -38,11 +38,13 @@ cpu0: cpu@0 { clocks { main_xtal: clock-mainxtal { compatible = "fixed-clock"; + clock-output-names = "main_xtal"; #clock-cells = <0>; }; slow_xtal: clock-slowxtal { compatible = "fixed-clock"; + clock-output-names = "slow_xtal"; #clock-cells = <0>; }; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 58/627 ARM: dts: microchip: sam9x7: Add clock name property
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Wanner <[email protected]>
[ Upstream commit 2e24723492b28ffdccb0e3e68725673e299e3823 ]
Add clock-output-names to the xtal nodes, so the driver can correctly register the main and slow xtal.
This fixes the issue of the SoC clock driver not being able to find the main xtal and slow xtal correctly causing a bad clock tree.
--- arch/arm/boot/dts/microchip/sam9x7.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/boot/dts/microchip/sam9x7.dtsi +2 -0
@@ -45,11 +45,13 @@ cpu@0 { clocks { slow_xtal: clock-slowxtal { compatible = "fixed-clock"; + clock-output-names = "slow_xtal"; #clock-cells = <0>; }; main_xtal: clock-mainxtal { compatible = "fixed-clock"; + clock-output-names = "main_xtal"; #clock-cells = <0>; }; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 59/627 cpufreq: armada-8k: make both cpu masks static
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit b1b41bc072baf7301b1ae95fe417de09a5ad47e2 ]
An earlier patch marked one of the two CPU masks as 'static' to reduce stack usage, but if CONFIG_NR_CPUS is large enough, the function still produces a warning for compile testing:
drivers/cpufreq/armada-8k-cpufreq.c: In function 'armada_8k_cpufreq_init':drivers/cpufreq/armada-8k-cpufreq.c:203:1: error: the frame size of 1416 bytes is larger than 1408 bytes [-Werror=frame-larger-than=]
Normally this should be done using alloc_cpumask_var(), but since the driver already has a static mask and the probe function is not called concurrently, use the same trick for both.
--- drivers/cpufreq/armada-8k-cpufreq.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/cpufreq/armada-8k-cpufreq.c +1 -2
@@ -132,7 +132,7 @@ static int __init armada_8k_cpufreq_init(void)int ret =0 , opps_index =0 , cpu, nb_cpus;struct freq_table *freq_tables;struct device_node *node; -static struct cpumask cpus; +static struct cpumask cpus, shared_cpus; node =of_find_matching_node_and_match (NULL , armada_8k_cpufreq_of_match,NULL );
@@ -154,7 +154,6 @@ static int __init armada_8k_cpufreq_init(void)* divisions of it). */ for_each_cpu (cpu, &cpus) { -struct cpumask shared_cpus;struct device *cpu_dev;struct clk *clk;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 60/627 firmware: arm_scmi: Fix up turbo frequencies selection
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sibi Sankar <[email protected]>
[ Upstream commit ad28fc31dd702871764e9294d4f2314ad78d24a9 ]
Sustained frequency when greater than or equal to 4Ghz on 64-bit devices currently result in marking all frequencies as turbo. Address the turbo frequency selection bug by fixing the truncation.
Message-Id: <[email protected]>
--- drivers/firmware/arm_scmi/perf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/arm_scmi/perf.c +1 -1
@@ -892,7 +892,7 @@ static int scmi_dvfs_device_opps_add(const struct scmi_protocol_handle *ph, freq = dom->opp[idx].indicative_freq * dom->mult_factor;/* All OPPs above the sustained frequency are treated as turbo */ - data.turbo = freq > dom->sustained_freq_khz *1000 ; + data.turbo = freq > dom->sustained_freq_khz *1000UL ; data.level = dom->opp[idx].perf; data.freq = freq;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 61/627 x86/bugs: Avoid AUTO after the select step in the retbleed mitigation
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
[ Upstream commit 98ff5c071d1cde9426b0bfa449c43d49ec58f1c4 ]
The retbleed select function leaves the mitigation to AUTO in some cases. Moreover, the update function can also set the mitigation to AUTO. This is inconsistent with other mitigations and requires explicit handling of AUTO at the end of update step.
Make sure a mitigation gets selected in the select step, and do not change it to AUTO in the update step. When no mitigation can be selected leave it to NONE, which is what AUTO was getting changed to in the end.
Stable-dep-of: ab9f2388e0b9 ("x86/bugs: Allow ITS stuffing in eIBRS+retpoline mode also")
--- arch/x86/kernel/cpu/bugs.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
arch/x86/kernel/cpu/bugs.c +10 -9
@@ -1251,6 +1251,14 @@ static void __init retbleed_select_mitigation(void) retbleed_mitigation =RETBLEED_MITIGATION_IBPB ; else retbleed_mitigation =RETBLEED_MITIGATION_NONE ; + }else if (boot_cpu_data.x86_vendor ==X86_VENDOR_INTEL ) { +/* Final mitigation depends on spectre-v2 selection */ +if (boot_cpu_has (X86_FEATURE_IBRS_ENHANCED )) + retbleed_mitigation =RETBLEED_MITIGATION_EIBRS ; +else if (boot_cpu_has (X86_FEATURE_IBRS )) + retbleed_mitigation =RETBLEED_MITIGATION_IBRS ; +else + retbleed_mitigation =RETBLEED_MITIGATION_NONE ; } }
@@ -1259,9 +1267,6 @@ static void __init retbleed_update_mitigation(void)if (!boot_cpu_has_bug (X86_BUG_RETBLEED ) ||cpu_mitigations_off ())return ; -if (retbleed_mitigation ==RETBLEED_MITIGATION_NONE ) - goto out; -/* * retbleed=stuff is only allowed on Intel. If stuffing can't be used * then a different mitigation will be selected below.
@@ -1272,7 +1277,7 @@ static void __init retbleed_update_mitigation(void) its_mitigation == ITS_MITIGATION_RETPOLINE_STUFF) {if (spectre_v2_enabled !=SPECTRE_V2_RETPOLINE ) {pr_err ("WARNING: retbleed=stuff depends on spectre_v2=retpoline\n" ); - retbleed_mitigation =RETBLEED_MITIGATION_AUTO ; + retbleed_mitigation =RETBLEED_MITIGATION_NONE ; }else {if (retbleed_mitigation !=RETBLEED_MITIGATION_STUFF )pr_info ("Retbleed mitigation updated to stuffing\n" );
@@ -1298,15 +1303,11 @@ static void __init retbleed_update_mitigation(void)if (retbleed_mitigation !=RETBLEED_MITIGATION_STUFF )pr_err (RETBLEED_INTEL_MSG ); } -/* If nothing has set the mitigation yet, default to NONE. */ -if (retbleed_mitigation ==RETBLEED_MITIGATION_AUTO ) - retbleed_mitigation =RETBLEED_MITIGATION_NONE ; } -out: +pr_info ("%s\n" , retbleed_strings[retbleed_mitigation]); } -static void __init retbleed_apply_mitigation (void ) {bool mitigate_smt = false;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 62/627 x86/bugs: Simplify the retbleed=stuff checks
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
[ Upstream commit 530e80648bff083e1d19ad7248c0540812a9a35f ]
Simplify the nested checks, remove redundant print and comment.
Stable-dep-of: ab9f2388e0b9 ("x86/bugs: Allow ITS stuffing in eIBRS+retpoline mode also")
--- arch/x86/kernel/cpu/bugs.c | 24 ++++++++---------------- 1 file changed, 8 insertions(+), 16 deletions(-)
arch/x86/kernel/cpu/bugs.c +8 -16
@@ -1267,24 +1267,16 @@ static void __init retbleed_update_mitigation(void)if (!boot_cpu_has_bug (X86_BUG_RETBLEED ) ||cpu_mitigations_off ())return ; -/* -* retbleed=stuff is only allowed on Intel. If stuffing can't be used -* then a different mitigation will be selected below. -* -* its=stuff will also attempt to enable stuffing. -*/ -if (retbleed_mitigation ==RETBLEED_MITIGATION_STUFF || - its_mitigation ==ITS_MITIGATION_RETPOLINE_STUFF ) { -if (spectre_v2_enabled !=SPECTRE_V2_RETPOLINE ) { -pr_err ("WARNING: retbleed=stuff depends on spectre_v2=retpoline\n" ); - retbleed_mitigation =RETBLEED_MITIGATION_NONE ; - }else { -if (retbleed_mitigation !=RETBLEED_MITIGATION_STUFF ) -pr_info ("Retbleed mitigation updated to stuffing\n" ); +/* ITS can also enable stuffing */ +if (its_mitigation ==ITS_MITIGATION_RETPOLINE_STUFF ) + retbleed_mitigation =RETBLEED_MITIGATION_STUFF ; - retbleed_mitigation =RETBLEED_MITIGATION_STUFF ; - } +if (retbleed_mitigation ==RETBLEED_MITIGATION_STUFF && + spectre_v2_enabled !=SPECTRE_V2_RETPOLINE ) { +pr_err ("WARNING: retbleed=stuff depends on spectre_v2=retpoline\n" ); + retbleed_mitigation =RETBLEED_MITIGATION_NONE ; } +/* * Let IBRS trump all on Intel without affecting the effects of the * retbleed= cmdline option except for call depth based stuffing
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 63/627 x86/bugs: Introduce cdt_possible()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
[ Upstream commit 8374a2719df2a00781e6821e373d7de71390d1b4 ]
In preparation to allow ITS to also enable stuffing aka Call Depth Tracking (CDT) independently of retbleed, introduce a helper cdt_possible().
Stable-dep-of: ab9f2388e0b9 ("x86/bugs: Allow ITS stuffing in eIBRS+retpoline mode also")
--- arch/x86/kernel/cpu/bugs.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
arch/x86/kernel/cpu/bugs.c +14 -1
@@ -1124,6 +1124,19 @@ early_param("nospectre_v1", nospectre_v1_cmdline);enum spectre_v2_mitigation spectre_v2_enabled__ro_after_init =SPECTRE_V2_NONE ; +/* Depends on spectre_v2 mitigation selected already */ +static inline bool cdt_possible (enum spectre_v2_mitigation mode) +{ +if (!IS_ENABLED (CONFIG_MITIGATION_CALL_DEPTH_TRACKING ) || + !IS_ENABLED (CONFIG_MITIGATION_RETPOLINE )) +return false; + +if (mode ==SPECTRE_V2_RETPOLINE ) +return true; + +return false; +} +#undef pr_fmt#define pr_fmt (fmt) "RETBleed: " fmt
@@ -1272,7 +1285,7 @@ static void __init retbleed_update_mitigation(void) retbleed_mitigation =RETBLEED_MITIGATION_STUFF ;if (retbleed_mitigation ==RETBLEED_MITIGATION_STUFF && - spectre_v2_enabled !=SPECTRE_V2_RETPOLINE ) { + !cdt_possible (spectre_v2_enabled)) {pr_err ("WARNING: retbleed=stuff depends on spectre_v2=retpoline\n" ); retbleed_mitigation =RETBLEED_MITIGATION_NONE ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 64/627 x86/bugs: Allow ITS stuffing in eIBRS+retpoline mode also
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
[ Upstream commit ab9f2388e0b99cd164ddbd74a6133d3070e2788d ]
After a recent restructuring of the ITS mitigation, RSB stuffing can no longer be enabled in eIBRS+Retpoline mode. Before ITS, retbleed mitigation only allowed stuffing when eIBRS was not enabled. This was perfectly fine since eIBRS mitigates retbleed.
However, RSB stuffing mitigation for ITS is still needed with eIBRS. The restructuring solely relies on retbleed to deploy stuffing, and does not allow it when eIBRS is enabled. This behavior is different from what was before the restructuring. Fix it by allowing stuffing in eIBRS+retpoline mode also.
--- arch/x86/kernel/cpu/bugs.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/x86/kernel/cpu/bugs.c +4 -2
@@ -1131,7 +1131,8 @@ static inline bool cdt_possible(enum spectre_v2_mitigation mode) !IS_ENABLED(CONFIG_MITIGATION_RETPOLINE))return false; -if (mode ==SPECTRE_V2_RETPOLINE ) +if (mode ==SPECTRE_V2_RETPOLINE || + mode ==SPECTRE_V2_EIBRS_RETPOLINE )return true;return false;
@@ -1286,7 +1287,7 @@ static void __init retbleed_update_mitigation(void)if (retbleed_mitigation ==RETBLEED_MITIGATION_STUFF && !cdt_possible (spectre_v2_enabled)) { -pr_err ("WARNING: retbleed=stuff depends on spectre_v2=retpoline\n" ); +pr_err ("WARNING: retbleed=stuff depends on retpoline\n" ); retbleed_mitigation =RETBLEED_MITIGATION_NONE ; }
@@ -1459,6 +1460,7 @@ static void __init its_update_mitigation(void) its_mitigation =ITS_MITIGATION_OFF ;break ;case SPECTRE_V2_RETPOLINE : +case SPECTRE_V2_EIBRS_RETPOLINE :/* Retpoline+CDT mitigates ITS */ if (retbleed_mitigation ==RETBLEED_MITIGATION_STUFF ) its_mitigation =ITS_MITIGATION_RETPOLINE_STUFF ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 65/627 usb: typec: ucsi: yoga-c630: fix error and remove paths
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 168c3896f32e78e7b87f6aa9e85af36e47a9f96c ]
Fix memory leak and call ucsi_destroy() from the driver's remove function and probe's error path in order to remove debugfs files and free the memory. Also call yoga_c630_ec_unregister_notify() in the probe's error path.
--- drivers/usb/typec/ucsi/ucsi_yoga_c630.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
drivers/usb/typec/ucsi/ucsi_yoga_c630.c +16 -3
@@ -133,17 +133,30 @@ static int yoga_c630_ucsi_probe(struct auxiliary_device *adev, ret =yoga_c630_ec_register_notify (ec, &uec->nb);if (ret) -return ret; + goto err_destroy; + + ret =ucsi_register (uec->ucsi); +if (ret) + goto err_unregister; + +return 0 ; -return ucsi_register (uec->ucsi); +err_unregister: +yoga_c630_ec_unregister_notify (uec->ec, &uec->nb); + +err_destroy: +ucsi_destroy (uec->ucsi); + +return ret; }static void yoga_c630_ucsi_remove (struct auxiliary_device *adev) {struct yoga_c630_ucsi *uec =auxiliary_get_drvdata (adev); -yoga_c630_ec_unregister_notify (uec->ec, &uec->nb);ucsi_unregister (uec->ucsi); +yoga_c630_ec_unregister_notify (uec->ec, &uec->nb); +ucsi_destroy (uec->ucsi); }static const struct auxiliary_device_id yoga_c630_ucsi_id_table[] = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 66/627 mei: vsc: Dont re-init VSC from mei_vsc_hw_reset() on stop
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 880af854d6343b796f05b9a8b52b68a88535625b ]
mei_vsc_hw_reset() gets called from mei_start() and mei_stop() in the latter case we do not need to re-init the VSC by calling vsc_tp_init().
mei_stop() only happens on shutdown and driver unbind. On shutdown we don't need to load + boot the firmware and if the driver later is bound to the device again then mei_start() will do another reset.
The intr_enable flag is true when called from mei_start() and false on mei_stop(). Skip vsc_tp_init() when intr_enable is false.
This avoids unnecessarily uploading the firmware, which takes 11 seconds. This change reduces the poweroff/reboot time by 11 seconds.
--- drivers/misc/mei/platform-vsc.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/misc/mei/platform-vsc.c +3 -0
@@ -256,6 +256,9 @@ static int mei_vsc_hw_reset(struct mei_device *mei_dev, bool intr_enable)vsc_tp_reset (hw->tp); +if (!intr_enable) +return 0 ; +return vsc_tp_init (hw->tp, mei_dev->dev); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 67/627 mei: vsc: Destroy mutex after freeing the IRQ
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 35b7f3525fe0a7283de7116e3c75ee3ccb3b14c9 ]
The event_notify callback which runs from vsc_tp_thread_isr may call vsc_tp_xfer() which locks the mutex. So the ISR depends on the mutex.
Move the mutex_destroy() call to after free_irq() to ensure that the ISR is not running while the mutex is destroyed.
--- drivers/misc/mei/vsc-tp.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/misc/mei/vsc-tp.c +4 -4
@@ -552,10 +552,10 @@ static int vsc_tp_probe(struct spi_device *spi)return 0 ; err_destroy_lock: -mutex_destroy (&tp->mutex); -free_irq (spi->irq, tp); +mutex_destroy (&tp->mutex); +return ret; }
@@ -565,9 +565,9 @@ static void vsc_tp_remove(struct spi_device *spi)platform_device_unregister (tp->pdev); -mutex_destroy (&tp->mutex); -free_irq (spi->irq, tp); + +mutex_destroy (&tp->mutex); }static void vsc_tp_shutdown (struct spi_device *spi)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 68/627 mei: vsc: Event notifier fixes
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 18f14b2e7f73c7ec272d833d570b632286467c7d ]
vsc_tp_register_event_cb() can race with vsc_tp_thread_isr(), add a mutex to protect against this.
--- drivers/misc/mei/vsc-tp.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/misc/mei/vsc-tp.c +9 -3
@@ -79,9 +79,8 @@ struct vsc_tp {vsc_tp_event_cb_t event_notify;void *event_notify_context; - -/* used to protect command download */ -struct mutex mutex; +struct mutex event_notify_mutex;/* protects event_notify + context */ +struct mutex mutex;/* protects command download */ };/* GPIO resources */
@@ -113,6 +112,8 @@ static irqreturn_t vsc_tp_thread_isr(int irq, void *data) {struct vsc_tp *tp = data; +guard (mutex)(&tp->event_notify_mutex); +if (tp->event_notify) tp->event_notify (tp->event_notify_context);
@@ -399,6 +400,8 @@ EXPORT_SYMBOL_NS_GPL(vsc_tp_need_read, "VSC_TP");int vsc_tp_register_event_cb (struct vsc_tp *tp,vsc_tp_event_cb_t event_cb,void *context) { +guard (mutex)(&tp->event_notify_mutex); + tp->event_notify = event_cb; tp->event_notify_context = context;
@@ -530,6 +533,7 @@ static int vsc_tp_probe(struct spi_device *spi)return ret;mutex_init (&tp->mutex); +mutex_init (&tp->event_notify_mutex);/* only one child acpi device */ ret = acpi_dev_for_each_child(ACPI_COMPANION(dev),
@@ -554,6 +558,7 @@ static int vsc_tp_probe(struct spi_device *spi) err_destroy_lock:free_irq (spi->irq, tp); +mutex_destroy (&tp->event_notify_mutex);mutex_destroy (&tp->mutex);return ret;
@@ -567,6 +572,7 @@ static void vsc_tp_remove(struct spi_device *spi)free_irq (spi->irq, tp); +mutex_destroy (&tp->event_notify_mutex);mutex_destroy (&tp->mutex); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 69/627 mei: vsc: Unset the event callback on remove and probe errors
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 6175c6974095f8ca7e5f8d593171512f3e5bd453 ]
Make mei_vsc_remove() properly unset the callback to avoid a dead callback sticking around after probe errors or unbinding of the platform driver.
--- drivers/misc/mei/platform-vsc.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/misc/mei/platform-vsc.c +5 -0
@@ -380,6 +380,8 @@ static int mei_vsc_probe(struct platform_device *pdev) err_cancel:mei_cancel_work (mei_dev); +vsc_tp_register_event_cb (tp,NULL ,NULL ); +mei_disable_interrupts (mei_dev);return ret;
@@ -388,11 +390,14 @@ static int mei_vsc_probe(struct platform_device *pdev)static void mei_vsc_remove (struct platform_device *pdev) {struct mei_device *mei_dev =platform_get_drvdata (pdev); +struct mei_vsc_hw *hw =mei_dev_to_vsc_hw (mei_dev);pm_runtime_disable (mei_dev->dev);mei_stop (mei_dev); +vsc_tp_register_event_cb (hw->tp,NULL ,NULL ); +mei_disable_interrupts (mei_dev);mei_deregister (mei_dev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 70/627 mei: vsc: Drop unused vsc_tp_request_irq() and vsc_tp_free_irq()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit a49159aa80207d49569b7453b4838f2f9501a17c ]
Drop the unused vsc_tp_request_irq() and vsc_tp_free_irq() functions.
Stable-dep-of: de88b02c94db ("mei: vsc: Run event callback from a workqueue")
--- drivers/misc/mei/vsc-tp.c | 31 ------------------------------- drivers/misc/mei/vsc-tp.h | 3 --- 2 files changed, 34 deletions(-)
drivers/misc/mei/vsc-tp.c +0 -31
@@ -409,37 +409,6 @@ int vsc_tp_register_event_cb(struct vsc_tp *tp, vsc_tp_event_cb_t event_cb, }EXPORT_SYMBOL_NS_GPL (vsc_tp_register_event_cb,"VSC_TP" ); -/** -* vsc_tp_request_irq - request irq for vsc_tp device -* @tp: vsc_tp device handle -*/ -int vsc_tp_request_irq (struct vsc_tp *tp) -{ -struct spi_device *spi = tp->spi; -struct device *dev = &spi->dev; -int ret; - -irq_set_status_flags (spi->irq,IRQ_DISABLE_UNLAZY ); - ret =request_threaded_irq (spi->irq, vsc_tp_isr, vsc_tp_thread_isr, -IRQF_TRIGGER_FALLING |IRQF_ONESHOT , -dev_name (dev), tp); -if (ret) -return ret; - -return 0 ; -} -EXPORT_SYMBOL_NS_GPL (vsc_tp_request_irq,"VSC_TP" ); - -/** -* vsc_tp_free_irq - free irq for vsc_tp device -* @tp: vsc_tp device handle -*/ -void vsc_tp_free_irq (struct vsc_tp *tp) -{ -free_irq (tp->spi->irq, tp); -} -EXPORT_SYMBOL_NS_GPL (vsc_tp_free_irq,"VSC_TP" ); -/** * vsc_tp_intr_synchronize - synchronize vsc_tp interrupt * @tp: vsc_tp device handle
drivers/misc/mei/vsc-tp.h +0 -3
@@ -37,9 +37,6 @@ int vsc_tp_xfer(struct vsc_tp *tp, u8 cmd, const void *obuf, size_t olen,int vsc_tp_register_event_cb (struct vsc_tp *tp,vsc_tp_event_cb_t event_cb,void *context); -int vsc_tp_request_irq (struct vsc_tp *tp); -void vsc_tp_free_irq (struct vsc_tp *tp); -void vsc_tp_intr_enable (struct vsc_tp *tp);void vsc_tp_intr_disable (struct vsc_tp *tp);void vsc_tp_intr_synchronize (struct vsc_tp *tp);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 71/627 mei: vsc: Run event callback from a workqueue
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit de88b02c94db7f3c115eb5bfdc1ec444934f277a ]
The event_notify callback in some cases calls vsc_tp_xfer(), which checks tp->assert_cnt and waits for it through the tp->xfer_wait wait-queue.
And tp->assert_cnt is increased and the tp->xfer_wait queue is woken o from the interrupt handler.
So the interrupt handler which is running the event callback is waiting for itself to signal that it can continue.
This happens to work because the event callback runs from the threaded ISR handler and while that is running the hard ISR handler will still get called a second / third time for further interrupts and it is the hard ISR handler which does the atomic_inc() and wake_up() calls.
But having the threaded ISR handler wait for its own interrupt to trigger again is not how a threaded ISR handler is supposed to be used.
Move the running of the event callback from a threaded interrupt handler to a workqueue since a threaded ISR should not wait for events from its own interrupt.
This is a preparation patch for moving the atomic_inc() and wake_up() calls to the threaded ISR handler, which is necessary to fix a locking issue.
--- drivers/misc/mei/vsc-tp.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
drivers/misc/mei/vsc-tp.c +11 -6
@@ -18,6 +18,7 @@#include <linux/platform_device.h> #include <linux/spi/spi.h> #include <linux/types.h> +#include <linux/workqueue.h> #include "vsc-tp.h"
@@ -76,6 +77,7 @@ struct vsc_tp {atomic_t assert_cnt;wait_queue_head_t xfer_wait; +struct work_struct event_work;vsc_tp_event_cb_t event_notify;void *event_notify_context;
@@ -105,19 +107,19 @@ static irqreturn_t vsc_tp_isr(int irq, void *data)wake_up (&tp->xfer_wait); -return IRQ_WAKE_THREAD ; +schedule_work (&tp->event_work); + +return IRQ_HANDLED ; } -static irqreturn_t vsc_tp_thread_isr (int irq,void *data) +static void vsc_tp_event_work (struct work_struct *work) { -struct vsc_tp *tp = data; + struct vsc_tp *tp = container_of(work, struct vsc_tp, event_work);guard (mutex)(&tp->event_notify_mutex);if (tp->event_notify) tp->event_notify (tp->event_notify_context); - -return IRQ_HANDLED ; }/* wakeup firmware and wait for response */
@@ -495,7 +497,7 @@ static int vsc_tp_probe(struct spi_device *spi) tp->spi = spi;irq_set_status_flags (spi->irq,IRQ_DISABLE_UNLAZY ); - ret =request_threaded_irq (spi->irq, vsc_tp_isr, vsc_tp_thread_isr, + ret =request_threaded_irq (spi->irq, vsc_tp_isr,NULL ,IRQF_TRIGGER_FALLING |IRQF_ONESHOT ,dev_name (dev), tp);if (ret)
@@ -503,6 +505,7 @@ static int vsc_tp_probe(struct spi_device *spi)mutex_init (&tp->mutex);mutex_init (&tp->event_notify_mutex); +INIT_WORK (&tp->event_work, vsc_tp_event_work);/* only one child acpi device */ ret = acpi_dev_for_each_child(ACPI_COMPANION(dev),
@@ -527,6 +530,7 @@ static int vsc_tp_probe(struct spi_device *spi) err_destroy_lock:free_irq (spi->irq, tp); +cancel_work_sync (&tp->event_work);mutex_destroy (&tp->event_notify_mutex);mutex_destroy (&tp->mutex);
@@ -541,6 +545,7 @@ static void vsc_tp_remove(struct spi_device *spi)free_irq (spi->irq, tp); +cancel_work_sync (&tp->event_work);mutex_destroy (&tp->event_notify_mutex);mutex_destroy (&tp->mutex); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 72/627 mei: vsc: Fix "BUG: Invalid wait context" lockdep error
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit cee3dba7b7416c02ff3cd27489f82859cc852532 ]
Kernels build with CONFIG_PROVE_RAW_LOCK_NESTING report the following tp-vsc lockdep error:
=============================
[ BUG: Invalid wait context ]
...
swapper/10/0 is trying to lock:
ffff88819c271888 (&tp->xfer_wait){....}-{3:3},
at: __wake_up (kernel/sched/wait.c:106 kernel/sched/wait.c:127)
...
Call Trace: <IRQ> ... __raw_spin_lock_irqsave (./include/linux/spinlock_api_smp.h:111) __wake_up (kernel/sched/wait.c:106 kernel/sched/wait.c:127) vsc_tp_isr (drivers/misc/mei/vsc-tp.c:110) mei_vsc_hw __handle_irq_event_percpu (kernel/irq/handle.c:158) handle_irq_event (kernel/irq/handle.c:195 kernel/irq/handle.c:210) handle_edge_irq (kernel/irq/chip.c:833) ... </IRQ>
The root-cause of this is the IRQF_NO_THREAD flag used by the intel-pinctrl code. Setting IRQF_NO_THREAD requires all interrupt handlers for GPIO ISRs to use raw-spinlocks only since normal spinlocks can sleep in PREEMPT-RT kernels and with IRQF_NO_THREAD the interrupt handlers will always run in an atomic context [1].
vsc_tp_isr() calls wake_up(&tp->xfer_wait), which uses a regular spinlock, breaking the raw-spinlocks only rule for Intel GPIO ISRs.
Make vsc_tp_isr() run as threaded ISR instead of as hard ISR to fix this.
--- drivers/misc/mei/vsc-tp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/mei/vsc-tp.c +1 -1
@@ -497,7 +497,7 @@ static int vsc_tp_probe(struct spi_device *spi) tp->spi = spi;irq_set_status_flags (spi->irq,IRQ_DISABLE_UNLAZY ); - ret =request_threaded_irq (spi->irq, vsc_tp_isr,NULL , + ret =request_threaded_irq (spi->irq,NULL , vsc_tp_isr,IRQF_TRIGGER_FALLING |IRQF_ONESHOT ,dev_name (dev), tp);if (ret)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 73/627 spi: stm32: Check for cfg availability in stm32_spi_probe
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clément Le Goffic <[email protected]>
[ Upstream commit 21f1c800f6620e43f31dfd76709dbac8ebaa5a16 ]
The stm32_spi_probe function now includes a check to ensure that the pointer returned by of_device_get_match_data is not NULL before accessing its members. This resolves a warning where a potential NULL pointer dereference could occur when accessing cfg->has_device_mode.
Before accessing the 'has_device_mode' member, we verify that 'cfg' is not NULL. If 'cfg' is NULL, an error message is logged.
This change ensures that the driver does not attempt to access configuration data if it is not available, thus preventing a potential system crash due to a NULL pointer dereference.
--- drivers/spi/spi-stm32.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/spi/spi-stm32.c +7 -1
@@ -2069,9 +2069,15 @@ static int stm32_spi_probe(struct platform_device *pdev)struct resource *res;struct reset_control *rst;struct device_node *np = pdev->dev.of_node; +const struct stm32_spi_cfg *cfg;bool device_mode;int ret; -const struct stm32_spi_cfg *cfg =of_device_get_match_data (&pdev->dev); + + cfg =of_device_get_match_data (&pdev->dev); +if (!cfg) { +dev_err (&pdev->dev,"Failed to get match data for platform\n" ); +return -ENODEV ; + } device_mode =of_property_read_bool (np,"spi-slave" );if (!cfg->has_device_mode && device_mode) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 74/627 drivers: misc: sram: fix up some const issues with recent attribute changes
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
[ Upstream commit bf7b4a0e25569ce39c6749afe363aefe5723d326 ]
The binary attribute const changes recently for the sram driver were made in a way that hid the fact that we would be casting a const pointer to a non-const one. So explicitly make the cast so that it is obvious and preserve the const pointer in the sram_reserve_cmp() function.
--- drivers/misc/sram.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/misc/sram.c +6 -4
@@ -28,7 +28,8 @@ static ssize_t sram_read(struct file *filp, struct kobject *kobj, {struct sram_partition *part; - part = container_of(attr, struct sram_partition, battr); +/* Cast away the const as the attribute is part of a larger structure */ + part = (struct sram_partition *)container_of(attr, struct sram_partition, battr);mutex_lock (&part->lock);memcpy_fromio (buf, part->base + pos, count);
@@ -43,7 +44,8 @@ static ssize_t sram_write(struct file *filp, struct kobject *kobj, {struct sram_partition *part; - part = container_of(attr, struct sram_partition, battr); +/* Cast away the const as the attribute is part of a larger structure */ + part = (struct sram_partition *)container_of(attr, struct sram_partition, battr);mutex_lock (&part->lock);memcpy_toio (part->base + pos, buf, count);
@@ -164,8 +166,8 @@ static void sram_free_partitions(struct sram_dev *sram)static int sram_reserve_cmp (void *priv,const struct list_head *a,const struct list_head *b) { - struct sram_reserve *ra = list_entry(a, struct sram_reserve, list); - struct sram_reserve *rb = list_entry(b, struct sram_reserve, list); + const struct sram_reserve *ra = list_entry(a, struct sram_reserve, list); + const struct sram_reserve *rb = list_entry(b, struct sram_reserve, list);return ra->start - rb->start; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 75/627 rust: devres: require T: Send for Devres
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <[email protected]>
[ Upstream commit 0dab138d0f4c0b3ce7f835d577e52a2b5ebdd536 ]
Due to calling Revocable::revoke() from Devres::devres_callback() T may be dropped from Devres::devres_callback() and hence must be Send.
Fix this by adding the corresponding bound to Devres and DevresInner.
--- rust/kernel/devres.rs | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
rust/kernel/devres.rs +5 -5
@@ -18,7 +18,7 @@ };#[pin_data] -struct DevresInner <T > { +struct DevresInner <T :Send > { dev:ARef <Device >, callback:unsafe extern "C" fn (*mut c_void ), #[pin]
@@ -95,9 +95,9 @@ struct DevresInner<T> { /// # Ok(()) /// # } /// ``` -pub struct Devres<T>(Arc<DevresInner<T>>); +pub struct Devres<T: Send>(Arc<DevresInner<T>>); -impl<T> DevresInner<T> { +impl<T: Send> DevresInner<T> { fn new(dev: &Device<Bound>, data: T, flags: Flags) -> Result<Arc<DevresInner<T>>> { let inner = Arc::pin_init( pin_init!( DevresInner {
@@ -175,7 +175,7 @@ fn remove_action(this: &Arc<Self>) -> bool { } } -impl <T >Devres <T > { +impl <T :Send >Devres <T > {/// Creates a new [`Devres`] instance of the given `data`. The `data` encapsulated within the /// returned `Devres` instance' `data` will be revoked once the device is detached. pub fn new (dev: &Device <Bound >, data:T , flags:Flags ) ->Result <Self > {
@@ -247,7 +247,7 @@ pub fn try_access_with_guard<'a>(&'a self, guard: &'a rcu::Guard) -> Option<&'a } } -impl <T >Drop for Devres <T > { +impl <T :Send >Drop for Devres <T > {fn drop (&mut self) {// SAFETY: When `drop` runs, it is guaranteed that nobody is accessing the revocable data // anymore, hence it is safe not to wait for the grace period to finish.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 76/627 power: sequencing: qcom-wcn: fix bluetooth-wifi copypasta for WCN6855
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 07d59dec6795428983a840de85aa02febaf7e01b ]
Prevent a name conflict (which is surprisingly not caught by the framework).
--- drivers/power/sequencing/pwrseq-qcom-wcn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/power/sequencing/pwrseq-qcom-wcn.c +1 -1
@@ -155,7 +155,7 @@ static const struct pwrseq_unit_data pwrseq_qcom_wcn_bt_unit_data = { };static const struct pwrseq_unit_data pwrseq_qcom_wcn6855_bt_unit_data = { - .name ="wlan-enable" , + .name ="bluetooth-enable" , .deps = pwrseq_qcom_wcn6855_unit_deps, .enable = pwrseq_qcom_wcn_bt_enable, .disable = pwrseq_qcom_wcn_bt_disable,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 77/627 arm64: dts: rockchip: Enable eMMC HS200 mode on Radxa E20C
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Karlman <[email protected]>
[ Upstream commit 6e3071f4e03997ca0e4388ca61aa06df2802dcd1 ]
eMMC HS200 mode (1.8V I/O) is supported by the MMC host controller on RK3528 and works with the optional on-board eMMC module on Radxa E20C.
Be explicit about HS200 support in the device tree for Radxa E20C.
--- arch/arm64/boot/dts/rockchip/rk3528-radxa-e20c.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/rockchip/rk3528-radxa-e20c.dts +1 -0
@@ -278,6 +278,7 @@ &saradc { &sdhci { bus-width = <8>; cap-mmc-highspeed; + mmc-hs200-1_8v; no-sd; no-sdio; non-removable;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 78/627 ASoC: SDCA: Add missing default in switch in entity_pde_event()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit 2ed526bf04a6d81592b314f81e7719a14048f732 ]
The current code should be safe as the PDE widget only registers for the two events handled in the switch statement. However, it is causing a smatch warning and also is a little fragile to future code changes, add a default case to avoid the warning and make the code more robust.
--- sound/soc/sdca/sdca_asoc.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/sdca/sdca_asoc.c +2 -0
@@ -397,6 +397,8 @@ static int entity_pde_event(struct snd_soc_dapm_widget *widget, from = widget->off_val; to = widget->on_val;break ; +default : +return 0 ; }for (i =0 ; i < entity->pde.num_max_delay; i++) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 79/627 staging: gpib: fix unset padding field copy back to userspace
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <[email protected]>
[ Upstream commit a739d3b13bff0dfa1aec679d08c7062131a2a425 ]
The introduction of a padding field in the gpib_board_info_ioctl is showing up as initialized data on the stack frame being copyied back to userspace in function board_info_ioctl. The simplest fix is to initialize the entire struct to zero to ensure all unassigned padding fields are zero'd before being copied back to userspace.
--- drivers/staging/gpib/common/gpib_os.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/gpib/common/gpib_os.c +1 -1
@@ -1774,7 +1774,7 @@ static int query_board_rsv_ioctl(struct gpib_board *board, unsigned long arg)static int board_info_ioctl (const struct gpib_board *board,unsigned long arg) { -struct gpib_board_info_ioctl info; +struct gpib_board_info_ioctl info = { };int retval; info.pad = board->pad;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 80/627 staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit eb2cb7dab60f9be0b435ac4a674255429a36d72c ]
In the error paths after fb_info structure is successfully allocated, the memory allocated in fb_deferred_io_init() for info->pagerefs is not freed. Fix that by adding the cleanup function on the error path.
--- drivers/staging/fbtft/fbtft-core.c | 1 + 1 file changed, 1 insertion(+)
drivers/staging/fbtft/fbtft-core.c +1 -0
@@ -692,6 +692,7 @@ struct fb_info *fbtft_framebuffer_alloc(struct fbtft_display *display,return info; release_framebuf: +fb_deferred_io_cleanup (info);framebuffer_release (info); alloc_fail:
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 81/627 rust: miscdevice: clarify invariant for `MiscDeviceRegistration`
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shankari Anand <[email protected]>
[ Upstream commit b9ff1c2a26fa31216be18e9b14c419ff8fe39e72 ]
Reword and expand the invariant documentation for MiscDeviceRegistration to clarify what it means for the inner device to be "registered". It expands to explain:
- inner points to a miscdevice registered via misc_register.
- This registration stays valid for the entire lifetime of the object.
- Deregistration is guaranteed on Drop, via misc_deregister.
--- rust/kernel/miscdevice.rs | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
rust/kernel/miscdevice.rs +7 -1
@@ -45,7 +45,13 @@ pub const fn into_raw<T: MiscDevice>(self) -> bindings::miscdevice {/// /// # Invariants /// -/// `inner` is a registered misc device. +/// - `inner` contains a `struct miscdevice` that is registered using +/// `misc_register()`. +/// - This registration remains valid for the entire lifetime of the +/// [`MiscDeviceRegistration`] instance. +/// - Deregistration occurs exactly once in [`Drop`] via `misc_deregister()`. +/// - `inner` wraps a valid, pinned `miscdevice` created using +/// [`MiscDeviceOptions::into_raw`]. #[repr(transparent)] #[pin_data( PinnedDrop )] pub struct MiscDeviceRegistration <T > {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 82/627 vmci: Prevent the dispatching of uninitialized payloads
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Xu <[email protected]>
[ Upstream commit bfb4cf9fb97e4063f0aa62e9e398025fb6625031 ]
The reproducer executes the host's unlocked_ioctl call in two different tasks. When init_context fails, the struct vmci_event_ctx is not fully initialized when executing vmci_datagram_dispatch() to send events to all vm contexts. This affects the datagram taken from the datagram queue of its context by another task, because the datagram payload is not initialized according to the size payload_size, which causes the kernel data to leak to the user space.
Before dispatching the datagram, and before setting the payload content, explicitly set the payload content to 0 to avoid data leakage caused by incomplete payload initialization.
--- drivers/misc/vmw_vmci/vmci_context.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/misc/vmw_vmci/vmci_context.c +2 -0
@@ -251,6 +251,8 @@ static int ctx_fire_notification(u32 context_id, u32 priv_flags) ev.msg.hdr.src =vmci_make_handle (VMCI_HYPERVISOR_CONTEXT_ID ,VMCI_CONTEXT_RESOURCE_ID ); ev.msg.hdr.payload_size =sizeof (ev) -sizeof (ev.msg.hdr); +memset ((char *)&ev.msg.hdr +sizeof (ev.msg.hdr),0 , + ev.msg.hdr.payload_size); ev.msg.event_data.event =VMCI_EVENT_CTX_REMOVED ; ev.payload.context_id = context_id;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 83/627 pps: fix poll support
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis OSTERLAND-HEIM <[email protected]>
[ Upstream commit 12c409aa1ec2592280a2ddcc66ff8f3c7f7bb171 ]
Because pps_cdev_poll() returns unconditionally EPOLLIN,
a user space program that calls select/poll get always an immediate data ready-to-read response. As a result the intended use to wait until next data becomes ready does not work.
User space snippet:
struct pollfd pollfd = {
.fd = open("/dev/pps0", O_RDONLY),
.events = POLLIN|POLLERR,
.revents = 0 };
while(1) {
poll(&pollfd, 1, 2000/*ms*/); // returns immediate, but should wait
if(revents & EPOLLIN) { // always true
struct pps_fdata fdata;
memset(&fdata, 0, sizeof(memdata));
ioctl(PPS_FETCH, &fdata); // currently fetches data at max speed
}
}Lets remember the last fetch event counter and compare this value in pps_cdev_poll() with most recent event counter
and return 0 if they are equal.
--- drivers/pps/pps.c | 11 +++++++++-- include/linux/pps_kernel.h | 1 + 2 files changed, 10 insertions(+), 2 deletions(-)
drivers/pps/pps.c +9 -2
@@ -41,6 +41,9 @@ static __poll_t pps_cdev_poll(struct file *file, poll_table *wait)poll_wait (file, &pps->queue, wait); +if (pps->last_fetched_ev == pps->last_ev) +return 0 ; +return EPOLLIN |EPOLLRDNORM ; }
@@ -186,9 +189,11 @@ static long pps_cdev_ioctl(struct file *file,if (err)return err; -/* Return the fetched timestamp */ +/* Return the fetched timestamp and save last fetched event */ spin_lock_irq (&pps->lock); + pps->last_fetched_ev = pps->last_ev; + fdata.info.assert_sequence = pps->assert_sequence; fdata.info.clear_sequence = pps->clear_sequence; fdata.info.assert_tu = pps->assert_tu;
@@ -272,9 +277,11 @@ static long pps_cdev_compat_ioctl(struct file *file,if (err)return err; -/* Return the fetched timestamp */ +/* Return the fetched timestamp and save last fetched event */ spin_lock_irq (&pps->lock); + pps->last_fetched_ev = pps->last_ev; + compat.info.assert_sequence = pps->assert_sequence; compat.info.clear_sequence = pps->clear_sequence; compat.info.current_mode = pps->current_mode;
include/linux/pps_kernel.h +1 -0
@@ -52,6 +52,7 @@ struct pps_device {int current_mode;/* PPS mode at event time */ unsigned int last_ev;/* last PPS event id */ +unsigned int last_fetched_ev;/* last fetched PPS event id */ wait_queue_head_t queue;/* PPS event queue */ unsigned int id;/* PPS source unique ID */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 84/627 arm64: dts: imx8mp-venice-gw74xx: update name of M2SKT_WDIS2# gpio
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Harvey <[email protected]>
[ Upstream commit 26a6a9cde64a890997708007d9de25809970eac9 ]
The GW74xx D revision has added a M2SKT_WDIS2# GPIO which routes to the W_DISABLE2# pin of the M.2 socket. Update the gpio name for consistency.
--- arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts +4 -4
@@ -301,7 +301,7 @@ &gpio2 { &gpio3 { gpio-line-names = "", "", "", "", "", "", "m2_rst", "", - "", "", "", "", "", "", "m2_gpio10", "", + "", "", "", "", "", "", "m2_wdis2#", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", ""; };
@@ -310,7 +310,7 @@ &gpio4 { gpio-line-names = "", "", "m2_off#", "", "", "", "", "", "", "", "", "", "", "", "", "", - "", "", "m2_wdis#", "", "", "", "", "", + "", "", "m2_wdis1#", "", "", "", "", "", "", "", "", "", "", "", "", "rs485_en"; };
@@ -811,14 +811,14 @@ pinctrl_hog: hoggrp { MX8MP_IOMUXC_GPIO1_IO09__GPIO1_IO09 0x40000040 /* DIO0 */ MX8MP_IOMUXC_GPIO1_IO11__GPIO1_IO11 0x40000040 /* DIO1 */ MX8MP_IOMUXC_SAI1_RXD0__GPIO4_IO02 0x40000040 /* M2SKT_OFF# */ - MX8MP_IOMUXC_SAI1_TXD6__GPIO4_IO18 0x40000150 /* M2SKT_WDIS# */ + MX8MP_IOMUXC_SAI1_TXD6__GPIO4_IO18 0x40000150 /* M2SKT_WDIS1# */ MX8MP_IOMUXC_SD1_DATA4__GPIO2_IO06 0x40000040 /* M2SKT_PIN20 */ MX8MP_IOMUXC_SD1_STROBE__GPIO2_IO11 0x40000040 /* M2SKT_PIN22 */ MX8MP_IOMUXC_SD2_CLK__GPIO2_IO13 0x40000150 /* PCIE1_WDIS# */ MX8MP_IOMUXC_SD2_CMD__GPIO2_IO14 0x40000150 /* PCIE3_WDIS# */ MX8MP_IOMUXC_SD2_DATA3__GPIO2_IO18 0x40000150 /* PCIE2_WDIS# */ MX8MP_IOMUXC_NAND_DATA00__GPIO3_IO06 0x40000040 /* M2SKT_RST# */ - MX8MP_IOMUXC_NAND_DQS__GPIO3_IO14 0x40000040 /* M2SKT_GPIO10 */ + MX8MP_IOMUXC_NAND_DQS__GPIO3_IO14 0x40000150 /* M2KST_WDIS2# */ MX8MP_IOMUXC_SAI3_TXD__GPIO5_IO01 0x40000104 /* UART_TERM */ MX8MP_IOMUXC_SAI3_TXFS__GPIO4_IO31 0x40000104 /* UART_RS485 */ MX8MP_IOMUXC_SAI3_TXC__GPIO5_IO00 0x40000104 /* UART_HALF */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 85/627 selftests: vDSO: chacha: Correctly skip test if necessary
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit 2c0a4428f5d6005ff0db12057cc35273593fc040 ]
According to kselftest.h ksft_exit_skip() is not meant to be called when a plan has already been printed.
Use the recommended function ksft_test_result_skip().
This fixes a bug, where the TAP output would be invalid when skipping:
TAP version 13
1..1
ok 2 # SKIP Not implemented on architecture
The SKIP line should start with "ok 1" as the plan only contains one test.
--- tools/testing/selftests/vDSO/vdso_test_chacha.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/vDSO/vdso_test_chacha.c +2 -1
@@ -76,7 +76,8 @@ static void reference_chacha20_blocks(uint8_t *dst_bytes, const uint32_t *key, uvoid __weak __arch_chacha20_blocks_nostack (uint8_t *dst_bytes,const uint32_t *key,uint32_t *counter,size_t nblocks) { -ksft_exit_skip ("Not implemented on architecture\n" ); +ksft_test_result_skip ("Not implemented on architecture\n" ); +ksft_finished (); }int main (int argc,char *argv[])
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 86/627 Revert "vmci: Prevent the dispatching of uninitialized payloads"
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
[ Upstream commit 8f5d9bed6122b8d96508436e5ad2498bb797eb6b ]
This reverts commit bfb4cf9fb97e4063f0aa62e9e398025fb6625031.
While the code "looks" correct, the compiler has no way to know that doing "fun" pointer math like this really isn't a write off the end of the structure as there is no hint anywhere that the structure has data at the end of it.
This causes the following build warning:
In function 'fortify_memset_chk',
inlined from 'ctx_fire_notification.isra' at drivers/misc/vmw_vmci/vmci_context.c:254:3:include/linux/fortify-string.h:480:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning]
480 | __write_overflow_field(p_size_field, size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~So revert it for now and it can come back in the future in a "sane" way that either correctly makes the structure know that there is trailing data, OR just the payload structure is properly referenced and zeroed out.
--- drivers/misc/vmw_vmci/vmci_context.c | 2 -- 1 file changed, 2 deletions(-)
drivers/misc/vmw_vmci/vmci_context.c +0 -2
@@ -251,8 +251,6 @@ static int ctx_fire_notification(u32 context_id, u32 priv_flags) ev.msg.hdr.src =vmci_make_handle (VMCI_HYPERVISOR_CONTEXT_ID ,VMCI_CONTEXT_RESOURCE_ID ); ev.msg.hdr.payload_size =sizeof (ev) -sizeof (ev.msg.hdr); -memset ((char *)&ev.msg.hdr +sizeof (ev.msg.hdr),0 , - ev.msg.hdr.payload_size); ev.msg.event_data.event =VMCI_EVENT_CTX_REMOVED ; ev.payload.context_id = context_id;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 87/627 powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sivan Zohar-Kotzer <[email protected]>
[ Upstream commit 46dc57406887dd02565cb264224194a6776d882b ]
The get_pd_power_uw() function can crash with a NULL pointer dereference when em_cpu_get() returns NULL. This occurs when a CPU becomes impossible during runtime, causing get_cpu_device() to return NULL, which propagates through em_cpu_get() and leads to a crash when em_span_cpus() dereferences the NULL pointer.
Add a NULL check after em_cpu_get() and return 0 if unavailable, matching the existing fallback behavior in __dtpm_cpu_setup().
--- drivers/powercap/dtpm_cpu.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/powercap/dtpm_cpu.c +2 -0
@@ -96,6 +96,8 @@ static u64 get_pd_power_uw(struct dtpm *dtpm)int i; pd =em_cpu_get (dtpm_cpu->cpu); +if (!pd) +return 0 ; pd_mask =em_span_cpus (pd);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 88/627 arm64: dts: ti: k3-am62p-verdin: add SD_1 CD pull-up
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <[email protected]>
[ Upstream commit fefaa8d7f8012249729a987d3abce747ffab0ca7 ]
Add internal pull-up to the SD_1 card detect signal, without this the CD signal is floating and spurious detects events can happen.
--- arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi +1 -1
@@ -433,7 +433,7 @@ AM62PX_IOPAD(0x01b8, PIN_OUTPUT, 7) /* (E20) SPI0_CS1.GPIO1_16 */ /* SODIMM 19 * /* Verdin SD_1_CD# */ pinctrl_sd1_cd: main-gpio1-48-default-pins { pinctrl-single,pins = < - AM62PX_IOPAD(0x0240, PIN_INPUT, 7) /* (D23) MMC1_SDCD.GPIO1_48 */ /* SODIMM 84 */ + AM62PX_IOPAD(0x0240, PIN_INPUT_PULLUP, 7) /* (D23) MMC1_SDCD.GPIO1_48 */ /* SODIMM 84 */ >; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 89/627 selftests/nolibc: correctly report errors from printf() and friends
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit 4a40129087a4c32135bb1177a57bbbe6ee646f1a ]
When an error is encountered by printf() it needs to be reported. errno() is already set by the callback.
sprintf() is different, but that keeps working and is already tested.
Also add a new test.
--- tools/include/nolibc/stdio.h | 4 ++-- tools/testing/selftests/nolibc/nolibc-test.c | 23 ++++++++++++++++++++ 2 files changed, 25 insertions(+), 2 deletions(-)
tools/include/nolibc/stdio.h +2 -2
@@ -358,11 +358,11 @@ int __nolibc_printf(__nolibc_printf_cb cb, intptr_t state, size_t n, const char n -= w;while (width-- > w) {if (cb (state," " ,1 ) !=0 ) -break ; +return -1 ; written +=1 ; }if (cb (state, outstr, w) !=0 ) -break ; +return -1 ; } written += len;
tools/testing/selftests/nolibc/nolibc-test.c +23 -0
@@ -1646,6 +1646,28 @@ int test_strerror(void)return 0 ; } +static int test_printf_error (void ) +{ +int fd, ret, saved_errno; + + fd =open ("/dev/full" ,O_RDWR ); +if (fd ==-1 ) +return 1 ; + + errno =0 ; + ret =dprintf (fd,"foo" ); + saved_errno = errno; +close (fd); + +if (ret !=-1 ) +return 2 ; + +if (saved_errno !=ENOSPC ) +return 3 ; + +return 0 ; +} +static int run_printf (int min,int max) {int test;
@@ -1675,6 +1697,7 @@ static int run_printf(int min, int max)CASE_TEST (width_trunc);EXPECT_VFPRINTF (25 ," " ,"%25d" ,1 );break ;CASE_TEST (scanf);EXPECT_ZR (1 ,test_scanf ());break ;CASE_TEST (strerror);EXPECT_ZR (1 ,test_strerror ());break ; +CASE_TEST (printf_error);EXPECT_ZR (1 ,test_printf_error ());break ;case __LINE__:return ret;/* must be last */ /* note: do not set any defaults so as to permit holes above */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 90/627 usb: early: xhci-dbc: Fix early_ioremap leak
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas De Marchi <[email protected]>
[ Upstream commit 2b7eec2ec3015f52fc74cf45d0408925e984ecd1 ]
Using the kernel param earlyprintk=xdbc,keep without proper hardware setup leads to this:
[ ] xhci_dbc:early_xdbc_parse_parameter: dbgp_num: 0 ... [ ] xhci_dbc:early_xdbc_setup_hardware: failed to setup the connection to host ... [ ] calling kmemleak_late_init+0x0/0xa0 @ 1 [ ] kmemleak: Kernel memory leak detector initialized (mem pool available: 14919) [ ] kmemleak: Automatic memory scanning thread started [ ] initcall kmemleak_late_init+0x0/0xa0 returned 0 after 417 usecs [ ] calling check_early_ioremap_leak+0x0/0x70 @ 1 [ ] ------------[ cut here ]------------ [ ] Debug warning: early ioremap leak of 1 areas detected. please boot with early_ioremap_debug and report the dmesg. [ ] WARNING: CPU: 11 PID: 1 at mm/early_ioremap.c:90 check_early_ioremap_leak+0x4e/0x70
When early_xdbc_setup_hardware() fails, make sure to call early_iounmap() since xdbc_init() won't handle it.
--- drivers/usb/early/xhci-dbc.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/early/xhci-dbc.c +4 -0
@@ -681,6 +681,10 @@ int __init early_xdbc_setup_hardware(void) xdbc.table_base =NULL ; xdbc.out_buf =NULL ; + +early_iounmap (xdbc.xhci_base, xdbc.xhci_length); + xdbc.xhci_base =NULL ; + xdbc.xhci_length =0 ; }return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 91/627 tools/nolibc: avoid false-positive -Wmaybe-uninitialized through waitpid()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit 31db7b6a78b7651973c66b7cf479209b20c55290 ]
The compiler does not know that waitid() will only ever return 0 or -1. If waitid() would return a positive value than waitpid() would return that same value and *status would not be initialized.
However users calling waitpid() know that the only possible return values of it are 0 or -1. They therefore might check for errors with 'ret == -1' or 'ret < 0' and use *status otherwise. The compiler will then warn about the usage of a potentially uninitialized variable.
Example:
$ cat test.c #include <stdio.h> #include <unistd.h>
int main(void)
{
int ret, status;
ret = waitpid(0, &status, 0);
if (ret == -1)
return 0;
printf("status %x\n", status);
return 0;
}
$ gcc --version
gcc (GCC) 15.1.1 20250425
$ gcc -Wall -Os -Werror -nostdlib -nostdinc -static -Iusr/include -Itools/include/nolibc/ -o /dev/null test.c
test.c: In function ‘main’:
test.c:12:9: error: ‘status’ may be used uninitialized [-Werror=maybe-uninitialized]
12 | printf("status %x\n", status);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
test.c:6:18: note: ‘status’ was declared here
6 | int ret, status;
| ^~~~~~
cc1: all warnings being treated as errorsAvoid the warning by normalizing waitid() errors to '-1' in waitpid().
--- tools/include/nolibc/sys/wait.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/include/nolibc/sys/wait.h +1 -1
@@ -78,7 +78,7 @@ pid_t waitpid(pid_t pid, int *status, int options) ret =waitid (idtype, id, &info, options);if (ret) -return ret; +return -1 ;switch (info.si_code) {case 0 :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 92/627 arm: dts: ti: omap: Fixup pinheader typo
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Albin Törnqvist <[email protected]>
[ Upstream commit a3a4be32b69c99fc20a66e0de83b91f8c882bf4c ]
This commit fixes a typo introduced in commitee368a10d0df ("ARM: dts: am335x-boneblack.dts: unique gpio-line-names"). gpio0_7 is located on the P9 header on the BBB.
This was verified with a BeagleBone Black by toggling the pin and checking with a multimeter that it corresponds to pin 42 on the P9 header.
--- arch/arm/boot/dts/ti/omap/am335x-boneblack.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/ti/omap/am335x-boneblack.dts +1 -1
@@ -35,7 +35,7 @@ &gpio0 { "P9_18 [spi0_d1]", "P9_17 [spi0_cs0]", "[mmc0_cd]", - "P8_42A [ecappwm0]", + "P9_42A [ecappwm0]", "P8_35 [lcd d12]", "P8_33 [lcd d13]", "P8_31 [lcd d14]",
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 93/627 arm64: dts: renesas: r8a779g3-sparrow-hawk-fan-pwm: Add missing install target
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Söderlund <[email protected]>
[ Upstream commit 7e5624e231eea73a6a2c2d0b837a085267590167 ]
The target to consider the dtbo file for installation is missing, add it.
--- arch/arm64/boot/dts/renesas/Makefile | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/renesas/Makefile +1 -0
@@ -96,6 +96,7 @@ dtb-$(CONFIG_ARCH_R8A779G0) += r8a779g2-white-hawk-single-ard-audio-da7212.dtb DTC_FLAGS_r8a779g3-sparrow-hawk += -Wno-spi_bus_bridge dtb-$(CONFIG_ARCH_R8A779G0) += r8a779g3-sparrow-hawk.dtb +dtb-$(CONFIG_ARCH_R8A779G0) += r8a779g3-sparrow-hawk-fan-pwm.dtbo r8a779g3-sparrow-hawk-fan-pwm-dtbs := r8a779g3-sparrow-hawk.dtb r8a779g3-sparrow-hawk-fan-pwm.dtbo dtb-$(CONFIG_ARCH_R8A779G0) += r8a779g3-sparrow-hawk-fan-pwm.dtb
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 94/627 arm64: dts: ti: k3-am62p-verdin: fix PWM_3_DSI GPIO direction
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Parth Pancholi <[email protected]>
[ Upstream commit b1a8daa7cf2650637f6cca6aaf014bee89672120 ]
PWM_3_DSI is used as the HDMI Hot-Plug Detect (HPD) GPIO for the Verdin DSI-to-HDMI adapter. After the commit 33bab9d84e52 ("arm64: dts: ti:
k3-am62p: fix pinctrl settings"), the pin was incorrectly set as output without RXACTIVE, breaking HPD detection and display functionality. The issue was previously hidden and worked by chance before the mentioned pinctrl fix.
Fix the pinmux configuration to correctly set PWM_3_DSI GPIO as an input.
--- arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi +1 -1
@@ -426,7 +426,7 @@ AM62PX_IOPAD(0x00f4, PIN_INPUT, 7) /* (Y20) VOUT0_DATA15.GPIO0_60 */ /* WIFI_SPI /* Verdin PWM_3_DSI as GPIO */ pinctrl_pwm3_dsi_gpio: main-gpio1-16-default-pins { pinctrl-single,pins = < - AM62PX_IOPAD(0x01b8, PIN_OUTPUT, 7) /* (E20) SPI0_CS1.GPIO1_16 */ /* SODIMM 19 */ + AM62PX_IOPAD(0x01b8, PIN_INPUT, 7) /* (E20) SPI0_CS1.GPIO1_16 */ /* SODIMM 19 */ >; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 95/627 staging: gpib: Fix error code in board_type_ioctl()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harshit Mogalapalli <[email protected]>
[ Upstream commit aa07b790d79226f9bd0731d2c065db2823867cc5 ]
When copy_from_user() fails it return number of bytes it wasn't able to copy. So the correct return value when copy_from_user() fails is -EFAULT.
--- drivers/staging/gpib/common/gpib_os.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/gpib/common/gpib_os.c +1 -1
@@ -831,7 +831,7 @@ static int board_type_ioctl(struct gpib_file_private *file_priv, retval =copy_from_user (&cmd, (void __user *)arg,sizeof (struct gpib_board_type_ioctl ));if (retval) -return retval; +return -EFAULT ;for (list_ptr = registered_drivers.next; list_ptr != ®istered_drivers; list_ptr = list_ptr->next) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 96/627 staging: gpib: Fix error handling paths in cb_gpib_probe()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 1b0ee85ee7967a4d7a68080c3f6a66af69e4e0b4 ]
If cb_gpib_config() fails, 'info' needs to be freed, as already done in the remove function.
While at it, remove a pointless comment related to gpib_attach().
--- drivers/staging/gpib/cb7210/cb7210.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/staging/gpib/cb7210/cb7210.c +11 -4
@@ -1184,8 +1184,7 @@ struct local_info {static int cb_gpib_probe (struct pcmcia_device *link) {struct local_info *info; - -// int ret, i; +int ret;/* Allocate space for private device-specific data */ info =kzalloc (sizeof (*info),GFP_KERNEL );
@@ -1211,8 +1210,16 @@ static int cb_gpib_probe(struct pcmcia_device *link)/* Register with Card Services */ curr_dev = link; -return cb_gpib_config (link); -}/* gpib_attach */ + ret =cb_gpib_config (link); +if (ret) + goto free_info; + +return 0 ; + +free_info: +kfree (info); +return ret; +}/* * This deletes a driver "instance". The device is de-registered
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 97/627 soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumit Gupta <[email protected]>
[ Upstream commit a0647bca8966db04b79af72851ebd04224a4da40 ]
When error is injected with the ERR_FORCE register, then this register is not auto cleared on clearing the ERR_STATUS register. This causes repeated interrupts on error injection. To fix, set the ERR_FORCE to zero along with clearing the ERR_STATUS register after handling error.
--- drivers/soc/tegra/cbb/tegra234-cbb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/soc/tegra/cbb/tegra234-cbb.c +2 -0
@@ -185,6 +185,8 @@ static void tegra234_cbb_error_clear(struct tegra_cbb *cbb) {struct tegra234_cbb *priv =to_tegra234_cbb (cbb); +writel (0 , priv->mon +FABRIC_MN_MASTER_ERR_FORCE_0 ); +writel (0x3f , priv->mon +FABRIC_MN_MASTER_ERR_STATUS_0 );dsb (sy); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 98/627 arm64: dts: rockchip: fix PHY handling for ROCK 4D
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Reichel <[email protected]>
[ Upstream commit cd803da7c033e376a66793a43ee98e136bc6cc25 ]
Old revisions of the ROCK 4D board have a dedicated crystal to supply the RTL8211F PHY's 25MHz clock input. At least some newer revisions instead use REFCLKO25M_GMAC0_OUT. The DT already has this half-prepared, but there are some issues:
1. The DT relies on auto-selecting the right PHY driver, which requires that it works good enough to read the ID registers. This does not work without the clock, which is handled by the PHY driver. By updating the compatible to contain the RTL8211F IDs, so that the operating system can choose the right PHY driver without relying on a pre-powered PHY.
2. Despite the name REFCLKO25M_GMAC0_OUT could also provide a different frequency, so ensure it is explicitly set to 25 MHz as expected by the PHY.
3. While at it switch from deprecated "enable-gpio" to standard "enable-gpios".
--- arch/arm64/boot/dts/rockchip/rk3576-rock-4d.dts | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/rockchip/rk3576-rock-4d.dts +4 -2
@@ -641,14 +641,16 @@ hym8563: rtc@51 { &mdio0 { rgmii_phy0: ethernet-phy@1 { - compatible = "ethernet-phy-ieee802.3-c22"; + compatible = "ethernet-phy-id001c.c916"; reg = <0x1>; clocks = <&cru REFCLKO25M_GMAC0_OUT>; + assigned-clocks = <&cru REFCLKO25M_GMAC0_OUT>; + assigned-clock-rates = <25000000>; pinctrl-names = "default"; pinctrl-0 = <&rtl8211f_rst>; reset-assert-us = <20000>; reset-deassert-us = <100000>; - reset-gpio = <&gpio2 RK_PB5 GPIO_ACTIVE_LOW>; + reset-gpios = <&gpio2 RK_PB5 GPIO_ACTIVE_LOW>; }; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 99/627 arm64: dts: st: fix timer used for ticks
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrick Delaunay <[email protected]>
[ Upstream commit 9ec406ac4b7de3e8040a503429d1a5d389bfdaf6 ]
Remove always-on on generic ARM timer as the clock source provided by STGEN is deactivated in low power mode, STOP1 by example.
--- arch/arm64/boot/dts/st/stm32mp251.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/st/stm32mp251.dtsi +1 -1
@@ -150,7 +150,7 @@ timer { <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>, <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>, <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>; - always-on; + arm,no-tick-in-suspend; }; soc@0 {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 100/627 selftests: breakpoints: use suspend_stats to reliably check suspend success
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moon Hee Lee <[email protected]>
[ Upstream commit 07b7c2b4eca3f83ce9cd5ee3fa1c7c001d721c69 ]
The step_after_suspend_test verifies that the system successfully suspended and resumed by setting a timerfd and checking whether the timer fully expired. However, this method is unreliable due to timing races.
In practice, the system may take time to enter suspend, during which the timer may expire just before or during the transition. As a result, the remaining time after resume may show non-zero nanoseconds, even if suspend/resume completed successfully. This leads to false test failures.
Replace the timer-based check with a read from /sys/power/suspend_stats/success. This counter is incremented only after a full suspend/resume cycle, providing a reliable and race-free indicator.
Also remove the unused file descriptor for /sys/power/state, which remained after switching to a system() call to trigger suspend [1].
[1] https://lore.kernel.org/all/[email protected]/
--- .../breakpoints/step_after_suspend_test.c | 41 ++++++++++++++----- 1 file changed, 31 insertions(+), 10 deletions(-)
tools/testing/selftests/breakpoints/step_after_suspend_test.c +31 -10
@@ -127,22 +127,42 @@ int run_test(int cpu)return KSFT_PASS ; } +/* +* Reads the suspend success count from sysfs. +* Returns the count on success or exits on failure. +*/ +static int get_suspend_success_count_or_fail (void ) +{ +FILE *fp; +int val; + + fp =fopen ("/sys/power/suspend_stats/success" ,"r" ); +if (!fp) +ksft_exit_fail_msg ( +"Failed to open suspend_stats/success: %s\n" , +strerror (errno)); + +if (fscanf (fp,"%d" , &val) !=1 ) { +fclose (fp); +ksft_exit_fail_msg ( +"Failed to read suspend success count\n" ); + } + +fclose (fp); +return val; +} +void suspend (void ) { -int power_state_fd;int timerfd;int err; +int count_before; +int count_after;struct itimerspec spec = {};if (getuid () !=0 )ksft_exit_skip ("Please run the test as root - Exiting.\n" ); - power_state_fd =open ("/sys/power/state" ,O_RDWR ); -if (power_state_fd <0 ) -ksft_exit_fail_msg ( -"open(\"/sys/power/state\") failed %s)\n" , -strerror (errno)); - timerfd =timerfd_create (CLOCK_BOOTTIME_ALARM ,0 );if (timerfd <0 )ksft_exit_fail_msg ("timerfd_create() failed\n" );
@@ -152,14 +172,15 @@ void suspend(void)if (err <0 )ksft_exit_fail_msg ("timerfd_settime() failed\n" ); + count_before =get_suspend_success_count_or_fail (); +system ("(echo mem > /sys/power/state) 2> /dev/null" ); -timerfd_gettime (timerfd, &spec); -if (spec.it_value.tv_sec !=0 || spec.it_value.tv_nsec !=0 ) + count_after =get_suspend_success_count_or_fail (); +if (count_after <= count_before)ksft_exit_fail_msg ("Failed to enter Suspend state\n" );close (timerfd); -close (power_state_fd); }int main (int argc,char **argv)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 101/627 ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Annette Kobou <[email protected]>
[ Upstream commit 47ef5256124fb939d8157b13ca048c902435cf23 ]
The polarity of the DE signal of the transceiver is active-high for sending. Therefore rs485-rts-active-low is wrong and needs to be removed to make RS485 transmissions work.
--- arch/arm/boot/dts/nxp/imx/imx6ul-kontron-bl-common.dtsi | 1 - 1 file changed, 1 deletion(-)
arch/arm/boot/dts/nxp/imx/imx6ul-kontron-bl-common.dtsi +0 -1
@@ -168,7 +168,6 @@ &uart2 { pinctrl-0 = <&pinctrl_uart2>; linux,rs485-enabled-at-boot-time; rs485-rx-during-tx; - rs485-rts-active-low; uart-has-rtscts; status = "okay"; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 102/627 arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Ford <[email protected]>
[ Upstream commit f83f69097a302ed2a2775975ddcf12e6a5ac6ec3 ]
The reference manual for the i.MX8MM states the clock rate in MMC mode is 1/2 of the input clock, therefore to properly run at HS400 rates, the input clock must be 400MHz to operate at 200MHz. Currently the clock is set to 200MHz which is half the rate it should be, so the throughput is half of what it should be for HS400 operation.
--- arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi +2 -0
@@ -294,6 +294,8 @@ &usdhc3 { pinctrl-0 = <&pinctrl_usdhc3>; pinctrl-1 = <&pinctrl_usdhc3_100mhz>; pinctrl-2 = <&pinctrl_usdhc3_200mhz>; + assigned-clocks = <&clk IMX8MM_CLK_USDHC3>; + assigned-clock-rates = <400000000>; bus-width = <8>; non-removable; status = "okay";
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 103/627 arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Ford <[email protected]>
[ Upstream commit e16ad6c79906bba5e2ac499492b6a5b29ab19d6c ]
The reference manual for the i.MX8MN states the clock rate in MMC mode is 1/2 of the input clock, therefore to properly run at HS400 rates, the input clock must be 400MHz to operate at 200MHz. Currently the clock is set to 200MHz which is half the rate it should be, so the throughput is half of what it should be for HS400 operation.
--- arch/arm64/boot/dts/freescale/imx8mn-beacon-som.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/freescale/imx8mn-beacon-som.dtsi +2 -0
@@ -305,6 +305,8 @@ &usdhc3 { pinctrl-0 = <&pinctrl_usdhc3>; pinctrl-1 = <&pinctrl_usdhc3_100mhz>; pinctrl-2 = <&pinctrl_usdhc3_200mhz>; + assigned-clocks = <&clk IMX8MN_CLK_USDHC3>; + assigned-clock-rates = <400000000>; bus-width = <8>; non-removable; status = "okay";
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 104/627 arm64: dts: freescale: imx8mp-toradex-smarc: fix lvds dsi mux gpio
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Krummenacher <[email protected]>
[ Upstream commit 29d34c678cf82341cb0bedb3179d59c56856a80f ]
The MUX which either outputs DSI or 2nd channel LVDS signals is part of the SoM. Move the pinmuxing of the GPIO used for controlling the MUX to the SoM dtsi file.
--- arch/arm64/boot/dts/freescale/imx8mp-toradex-smarc-dev.dts | 5 ----- arch/arm64/boot/dts/freescale/imx8mp-toradex-smarc.dtsi | 2 ++ 2 files changed, 2 insertions(+), 5 deletions(-)
arch/arm64/boot/dts/freescale/imx8mp-toradex-smarc-dev.dts +0 -5
@@ -102,11 +102,6 @@ &gpio1 { <&pinctrl_gpio13>; }; -&gpio3 { - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_lvds_dsi_sel>; -}; - &gpio4 { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_gpio4>, <&pinctrl_gpio6>;
arch/arm64/boot/dts/freescale/imx8mp-toradex-smarc.dtsi +2 -0
@@ -320,6 +320,8 @@ &gpio2 { }; &gpio3 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_lvds_dsi_sel>; gpio-line-names = "ETH_0_INT#", /* 0 */ "SLEEP#", "",
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 105/627 arm64: dts: rockchip: Fix pinctrl node names for RK3528
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Karlman <[email protected]>
[ Upstream commit f2792bf1c7a54ef23fb3a84286b66f427bfc4853 ]
Following warnings can be observed with CHECK_DTBS=y for the RK3528:
rk3528-pinctrl.dtsi:101.36-105.5: Warning (node_name_chars_strict):
/pinctrl/fephy/fephym0-led_dpx: Character '_' not recommended in node name
rk3528-pinctrl.dtsi:108.38-112.5: Warning (node_name_chars_strict):
/pinctrl/fephy/fephym0-led_link: Character '_' not recommended in node name
rk3528-pinctrl.dtsi:115.36-119.5: Warning (node_name_chars_strict):
/pinctrl/fephy/fephym0-led_spd: Character '_' not recommended in node name
rk3528-pinctrl.dtsi:122.36-126.5: Warning (node_name_chars_strict):
/pinctrl/fephy/fephym1-led_dpx: Character '_' not recommended in node name
rk3528-pinctrl.dtsi:129.38-133.5: Warning (node_name_chars_strict):
/pinctrl/fephy/fephym1-led_link: Character '_' not recommended in node name
rk3528-pinctrl.dtsi:136.36-140.5: Warning (node_name_chars_strict):
/pinctrl/fephy/fephym1-led_spd: Character '_' not recommended in node name
rk3528-pinctrl.dtsi:782.32-790.5: Warning (node_name_chars_strict):
/pinctrl/rgmii/rgmii-rx_bus2: Character '_' not recommended in node name
rk3528-pinctrl.dtsi:793.32-801.5: Warning (node_name_chars_strict):
/pinctrl/rgmii/rgmii-tx_bus2: Character '_' not recommended in node name
rk3528-pinctrl.dtsi:804.36-810.5: Warning (node_name_chars_strict):
/pinctrl/rgmii/rgmii-rgmii_clk: Character '_' not recommended in node name
rk3528-pinctrl.dtsi:813.36-823.5: Warning (node_name_chars_strict):
/pinctrl/rgmii/rgmii-rgmii_bus: Character '_' not recommended in node name
Rename the affected nodes to fix these warnings.
--- .../boot/dts/rockchip/rk3528-pinctrl.dtsi | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
arch/arm64/boot/dts/rockchip/rk3528-pinctrl.dtsi +10 -10
@@ -98,42 +98,42 @@ eth_pins: eth-pins { fephy { /omit-if-no-ref/ - fephym0_led_dpx: fephym0-led_dpx { + fephym0_led_dpx: fephym0-led-dpx { rockchip,pins = /* fephy_led_dpx_m0 */ <4 RK_PB5 2 &pcfg_pull_none>; }; /omit-if-no-ref/ - fephym0_led_link: fephym0-led_link { + fephym0_led_link: fephym0-led-link { rockchip,pins = /* fephy_led_link_m0 */ <4 RK_PC0 2 &pcfg_pull_none>; }; /omit-if-no-ref/ - fephym0_led_spd: fephym0-led_spd { + fephym0_led_spd: fephym0-led-spd { rockchip,pins = /* fephy_led_spd_m0 */ <4 RK_PB7 2 &pcfg_pull_none>; }; /omit-if-no-ref/ - fephym1_led_dpx: fephym1-led_dpx { + fephym1_led_dpx: fephym1-led-dpx { rockchip,pins = /* fephy_led_dpx_m1 */ <2 RK_PA4 5 &pcfg_pull_none>; }; /omit-if-no-ref/ - fephym1_led_link: fephym1-led_link { + fephym1_led_link: fephym1-led-link { rockchip,pins = /* fephy_led_link_m1 */ <2 RK_PA6 5 &pcfg_pull_none>; }; /omit-if-no-ref/ - fephym1_led_spd: fephym1-led_spd { + fephym1_led_spd: fephym1-led-spd { rockchip,pins = /* fephy_led_spd_m1 */ <2 RK_PA5 5 &pcfg_pull_none>;
@@ -779,7 +779,7 @@ rgmii_miim: rgmii-miim { }; /omit-if-no-ref/ - rgmii_rx_bus2: rgmii-rx_bus2 { + rgmii_rx_bus2: rgmii-rx-bus2 { rockchip,pins = /* rgmii_rxd0 */ <3 RK_PA3 2 &pcfg_pull_none>,
@@ -790,7 +790,7 @@ rgmii_rx_bus2: rgmii-rx_bus2 { }; /omit-if-no-ref/ - rgmii_tx_bus2: rgmii-tx_bus2 { + rgmii_tx_bus2: rgmii-tx-bus2 { rockchip,pins = /* rgmii_txd0 */ <3 RK_PA1 2 &pcfg_pull_none_drv_level_2>,
@@ -801,7 +801,7 @@ rgmii_tx_bus2: rgmii-tx_bus2 { }; /omit-if-no-ref/ - rgmii_rgmii_clk: rgmii-rgmii_clk { + rgmii_rgmii_clk: rgmii-rgmii-clk { rockchip,pins = /* rgmii_rxclk */ <3 RK_PA5 2 &pcfg_pull_none>,
@@ -810,7 +810,7 @@ rgmii_rgmii_clk: rgmii-rgmii_clk { }; /omit-if-no-ref/ - rgmii_rgmii_bus: rgmii-rgmii_bus { + rgmii_rgmii_bus: rgmii-rgmii-bus { rockchip,pins = /* rgmii_rxd2 */ <3 RK_PA7 2 &pcfg_pull_none>,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 106/627 PM / devfreq: Check governor before using governor->name
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <[email protected]>
[ Upstream commit bab7834c03820eb11269bc48f07c3800192460d2 ]
Commit 96ffcdf239de ("PM / devfreq: Remove redundant governor_name from struct devfreq") removes governor_name and uses governor->name to replace it. But devfreq->governor may be NULL and directly using devfreq->governor->name may cause null pointer exception. Move the check of governor to before using governor->name.
--- drivers/devfreq/devfreq.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-)
drivers/devfreq/devfreq.c +3 -7
@@ -1382,15 +1382,11 @@ int devfreq_remove_governor(struct devfreq_governor *governor)int ret;struct device *dev = devfreq->dev.parent; +if (!devfreq->governor) +continue ; +if (!strncmp (devfreq->governor->name, governor->name,DEVFREQ_NAME_LEN )) { -/* we should have a devfreq governor! */ -if (!devfreq->governor) { -dev_warn (dev,"%s: Governor %s NOT present\n" , - __func__, governor->name); -continue ; -/* Fall through */ - } ret = devfreq->governor->event_handler (devfreq,DEVFREQ_GOV_STOP ,NULL );if (ret) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 107/627 PM / devfreq: Fix a index typo in trans_stat
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chanwoo Choi <[email protected]>
[ Upstream commit 78c5845fbbf6aaeb9959c5fbaee5cc53ef5f38c2 ]
--- drivers/devfreq/devfreq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/devfreq/devfreq.c +1 -1
@@ -1739,7 +1739,7 @@ static ssize_t trans_stat_show(struct device *dev,for (i =0 ; i < max_state; i++) {if (len >=PAGE_SIZE -1 )break ; -if (df->freq_table[2 ] == df->previous_freq) +if (df->freq_table[i] == df->previous_freq) len +=sysfs_emit_at (buf, len,"*" );else len +=sysfs_emit_at (buf, len," " );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 108/627 cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 1cefe495cacba5fb0417da3a75a1a76e3546d176 ]
In the passive mode, intel_cpufreq_update_pstate() sets HWP_MIN_PERF in accordance with the target frequency to ensure delivering adequate performance, but it sets HWP_DESIRED_PERF to 0, so the processor has no indication that the desired performance level is actually equal to the floor one. This may cause it to choose a performance point way above the desired level.
Moreover, this is inconsistent with intel_cpufreq_adjust_perf() which actually sets HWP_DESIRED_PERF in accordance with the target performance value.
Address this by adjusting intel_cpufreq_update_pstate() to pass target_pstate as both the minimum and the desired performance levels to intel_cpufreq_hwp_update().
--- drivers/cpufreq/intel_pstate.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/cpufreq/intel_pstate.c +2 -2
@@ -3249,8 +3249,8 @@ static int intel_cpufreq_update_pstate(struct cpufreq_policy *policy,int max_pstate = policy->strict_target ? target_pstate : cpu->max_perf_ratio; -intel_cpufreq_hwp_update (cpu, target_pstate, max_pstate,0 , - fast_switch); +intel_cpufreq_hwp_update (cpu, target_pstate, max_pstate, + target_pstate, fast_switch); }else if (target_pstate != old_pstate) {intel_cpufreq_perf_ctl_update (cpu, target_pstate, fast_switch); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 109/627 cpufreq: Initialize cpufreq-based frequency-invariance later
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <[email protected]>
[ Upstream commit 2a6c727387062a2ea79eb6cf5004820cb1b0afe2 ]
The cpufreq-based invariance is enabled in cpufreq_register_driver(), but never disabled after registration fails. Move the invariance initialization to where all other initializations have been successfully done to solve this problem.
--- drivers/cpufreq/cpufreq.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/cpufreq/cpufreq.c +9 -9
@@ -2944,15 +2944,6 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data) cpufreq_driver = driver_data;write_unlock_irqrestore (&cpufreq_driver_lock, flags); -/* -* Mark support for the scheduler's frequency invariance engine for -* drivers that implement target(), target_index() or fast_switch(). -*/ -if (!cpufreq_driver->setpolicy) { -static_branch_enable_cpuslocked (&cpufreq_freq_invariance); -pr_debug ("supports frequency invariance" ); - } -if (driver_data->setpolicy) driver_data->flags |=CPUFREQ_CONST_LOOPS ;
@@ -2983,6 +2974,15 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data) hp_online = ret; ret =0 ; +/* +* Mark support for the scheduler's frequency invariance engine for +* drivers that implement target(), target_index() or fast_switch(). +*/ +if (!cpufreq_driver->setpolicy) { +static_branch_enable_cpuslocked (&cpufreq_freq_invariance); +pr_debug ("supports frequency invariance" ); + } +pr_debug ("driver %s up and running\n" , driver_data->name); goto out;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 110/627 cpufreq: Init policy->rwsem before it may be possibly used
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <[email protected]>
[ Upstream commit d1378d1d7edb3a4c4935a44fe834ae135be03564 ]
In cpufreq_policy_put_kobj(), policy->rwsem is used. But in cpufreq_policy_alloc(), if freq_qos_add_notifier() returns an error, error path via err_kobj_remove or err_min_qos_notifier will be reached and cpufreq_policy_put_kobj() will be called before policy->rwsem is initialized. Thus, the calling of init_rwsem() should be moved to where before these two error paths can be reached.
--- drivers/cpufreq/cpufreq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/cpufreq/cpufreq.c +2 -1
@@ -1284,6 +1284,8 @@ static struct cpufreq_policy *cpufreq_policy_alloc(unsigned int cpu) goto err_free_real_cpus; } +init_rwsem (&policy->rwsem); +freq_constraints_init (&policy->constraints); policy->nb_min.notifier_call = cpufreq_notifier_min;
@@ -1306,7 +1308,6 @@ static struct cpufreq_policy *cpufreq_policy_alloc(unsigned int cpu) }INIT_LIST_HEAD (&policy->policy_list); -init_rwsem (&policy->rwsem);spin_lock_init (&policy->transition_lock);init_waitqueue_head (&policy->transition_wait);INIT_WORK (&policy->update, handle_update);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 111/627 arm64: dts: rockchip: Fix UART DMA support for RK3528
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Karlman <[email protected]>
[ Upstream commit ae019f0bdfbef3e0671e7b954321e92fc24c7e54 ]
Trying to use UART2 DMA for Bluetooth on ArmSoM Sige1 result in tx timeout when using dma-names = "tx", "rx" as required by the dt-binding:
Bluetooth: hci0: command 0x0c03 tx timeout
Bluetooth: hci0: BCM: Reset failed (-110)
Change the dmas order to fix UART DMA support on RK3528.
With this fixed Bluetooth can be loaded using DMA on ArmSoM Sige1:
Bluetooth: hci0: BCM: chip id 159
Bluetooth: hci0: BCM: features 0x0f
Bluetooth: hci0: BCM4362A2
Bluetooth: hci0: BCM4362A2 (000.017.017) build 0000
Bluetooth: hci0: BCM4362A2 'brcm/BCM4362A2.hcd' Patch
Bluetooth: hci0: BCM: features 0x0f
Bluetooth: hci0: BCM43752A2 UART 37.4MHz Ampak AP6398 sLNA iLNA CL1 [Version: 1091.1173]
Bluetooth: hci0: BCM4362A2 (000.017.017) build 1173
--- arch/arm64/boot/dts/rockchip/rk3528.dtsi | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
arch/arm64/boot/dts/rockchip/rk3528.dtsi +8 -8
@@ -445,7 +445,7 @@ uart0: serial@ff9f0000 { clocks = <&cru SCLK_UART0>, <&cru PCLK_UART0>; clock-names = "baudclk", "apb_pclk"; interrupts = <GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>; - dmas = <&dmac 8>, <&dmac 9>; + dmas = <&dmac 9>, <&dmac 8>; reg-io-width = <4>; reg-shift = <2>; status = "disabled";
@@ -457,7 +457,7 @@ uart1: serial@ff9f8000 { clocks = <&cru SCLK_UART1>, <&cru PCLK_UART1>; clock-names = "baudclk", "apb_pclk"; interrupts = <GIC_SPI 41 IRQ_TYPE_LEVEL_HIGH>; - dmas = <&dmac 10>, <&dmac 11>; + dmas = <&dmac 11>, <&dmac 10>; reg-io-width = <4>; reg-shift = <2>; status = "disabled";
@@ -469,7 +469,7 @@ uart2: serial@ffa00000 { clocks = <&cru SCLK_UART2>, <&cru PCLK_UART2>; clock-names = "baudclk", "apb_pclk"; interrupts = <GIC_SPI 42 IRQ_TYPE_LEVEL_HIGH>; - dmas = <&dmac 12>, <&dmac 13>; + dmas = <&dmac 13>, <&dmac 12>; reg-io-width = <4>; reg-shift = <2>; status = "disabled";
@@ -481,7 +481,7 @@ uart3: serial@ffa08000 { clocks = <&cru SCLK_UART3>, <&cru PCLK_UART3>; clock-names = "baudclk", "apb_pclk"; interrupts = <GIC_SPI 43 IRQ_TYPE_LEVEL_HIGH>; - dmas = <&dmac 14>, <&dmac 15>; + dmas = <&dmac 15>, <&dmac 14>; reg-io-width = <4>; reg-shift = <2>; status = "disabled";
@@ -493,7 +493,7 @@ uart4: serial@ffa10000 { clocks = <&cru SCLK_UART4>, <&cru PCLK_UART4>; clock-names = "baudclk", "apb_pclk"; interrupts = <GIC_SPI 44 IRQ_TYPE_LEVEL_HIGH>; - dmas = <&dmac 16>, <&dmac 17>; + dmas = <&dmac 17>, <&dmac 16>; reg-io-width = <4>; reg-shift = <2>; status = "disabled";
@@ -505,7 +505,7 @@ uart5: serial@ffa18000 { clocks = <&cru SCLK_UART5>, <&cru PCLK_UART5>; clock-names = "baudclk", "apb_pclk"; interrupts = <GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>; - dmas = <&dmac 18>, <&dmac 19>; + dmas = <&dmac 19>, <&dmac 18>; reg-io-width = <4>; reg-shift = <2>; status = "disabled";
@@ -517,7 +517,7 @@ uart6: serial@ffa20000 { clocks = <&cru SCLK_UART6>, <&cru PCLK_UART6>; clock-names = "baudclk", "apb_pclk"; interrupts = <GIC_SPI 46 IRQ_TYPE_LEVEL_HIGH>; - dmas = <&dmac 20>, <&dmac 21>; + dmas = <&dmac 21>, <&dmac 20>; reg-io-width = <4>; reg-shift = <2>; status = "disabled";
@@ -529,7 +529,7 @@ uart7: serial@ffa28000 { clocks = <&cru SCLK_UART7>, <&cru PCLK_UART7>; clock-names = "baudclk", "apb_pclk"; interrupts = <GIC_SPI 47 IRQ_TYPE_LEVEL_HIGH>; - dmas = <&dmac 22>, <&dmac 23>; + dmas = <&dmac 23>, <&dmac 22>; reg-io-width = <4>; reg-shift = <2>; status = "disabled";
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 112/627 kexec_core: Fix error code path in the KEXEC_JUMP flow
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 996afb6efd1a345736f9a888e4d6c7d4f3752aa5 ]
If dpm_suspend_start() fails, dpm_resume_end() must be called to recover devices whose suspend callbacks have been called, but this does not happen in the KEXEC_JUMP flow's error path due to a confused goto target label.
Address this by using the correct target label in the goto statement in question and drop the Resume_console label that is not used any more.
--- kernel/kexec_core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
kernel/kexec_core.c +1 -2
@@ -1080,7 +1080,7 @@ int kernel_kexec(void)console_suspend_all (); error =dpm_suspend_start (PMSG_FREEZE );if (error) - goto Resume_console; + goto Resume_devices;/* * dpm_suspend_end() must be called after dpm_suspend_start() * to complete the transition, like in the hibernation flows
@@ -1135,7 +1135,6 @@ int kernel_kexec(void)dpm_resume_start (PMSG_RESTORE ); Resume_devices:dpm_resume_end (PMSG_RESTORE ); - Resume_console:pm_restore_gfp_mask ();console_resume_all ();thaw_processes ();
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 113/627 ASoC: SDCA: Update memory allocations to zero initialise
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit 15247b5a63f506125360fa45d7aa1fbe8b903b95 ]
All the memory allocations in the SDCA ASoC helpers rely on fields being zero initialised, the code should use kzalloc not kmalloc.
--- sound/soc/sdca/sdca_asoc.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
sound/soc/sdca/sdca_asoc.c +6 -6
@@ -229,11 +229,11 @@ static int entity_early_parse_ge(struct device *dev,if (!control_name)return -ENOMEM ; - kctl =devm_kmalloc (dev,sizeof (*kctl),GFP_KERNEL ); + kctl =devm_kzalloc (dev,sizeof (*kctl),GFP_KERNEL );if (!kctl)return -ENOMEM ; - soc_enum =devm_kmalloc (dev,sizeof (*soc_enum),GFP_KERNEL ); + soc_enum =devm_kzalloc (dev,sizeof (*soc_enum),GFP_KERNEL );if (!soc_enum)return -ENOMEM ;
@@ -560,11 +560,11 @@ static int entity_parse_su_class(struct device *dev,const char **texts;int i; - kctl =devm_kmalloc (dev,sizeof (*kctl),GFP_KERNEL ); + kctl =devm_kzalloc (dev,sizeof (*kctl),GFP_KERNEL );if (!kctl)return -ENOMEM ; - soc_enum =devm_kmalloc (dev,sizeof (*soc_enum),GFP_KERNEL ); + soc_enum =devm_kzalloc (dev,sizeof (*soc_enum),GFP_KERNEL );if (!soc_enum)return -ENOMEM ;
@@ -671,7 +671,7 @@ static int entity_parse_mu(struct device *dev,if (!control_name)return -ENOMEM ; - mc =devm_kmalloc (dev,sizeof (*mc),GFP_KERNEL ); + mc =devm_kzalloc (dev,sizeof (*mc),GFP_KERNEL );if (!mc)return -ENOMEM ;
@@ -925,7 +925,7 @@ static int populate_control(struct device *dev,if (!control_name)return -ENOMEM ; - mc =devm_kmalloc (dev,sizeof (*mc),GFP_KERNEL ); + mc =devm_kzalloc (dev,sizeof (*mc),GFP_KERNEL );if (!mc)return -ENOMEM ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 114/627 ASoC: SDCA: Allow read-only controls to be deferrable
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit 4eb6ad5d2080681b531db2c1764246f9a868062f ]
The current SDCA Control parsing only checks the deferrable flag for Read/Write and Dual Ranked controls. However, reads can defer as well as writes so Read Only controls should also check for the deferrable flag. Add the handling for this into find_sdca_entity_control().
--- sound/soc/sdca/sdca_functions.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/sdca/sdca_functions.c +2 -1
@@ -880,7 +880,8 @@ static int find_sdca_entity_control(struct device *dev, struct sdca_entity *enti control->value = tmp; control->has_fixed = true; } - + fallthrough; +case SDCA_ACCESS_MODE_RO : control->deferrable =fwnode_property_read_bool (control_node,"mipi-sdca-control-deferrable" );break ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 115/627 staging: greybus: gbphy: fix up const issue with the match callback
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
[ Upstream commit ce32eff1cf3ae8ac2596171dd0af1657634c83eb ]
gbphy_dev_match_id() should be taking a const pointer, as the pointer passed to it from the container_of() call was const to start with (it was accidentally cast away with the call.) Fix this all up by correctly marking the pointer types.
--- drivers/staging/greybus/gbphy.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/staging/greybus/gbphy.c +3 -3
@@ -102,8 +102,8 @@ static int gbphy_dev_uevent(const struct device *dev, struct kobj_uevent_env *en }static const struct gbphy_device_id * -gbphy_dev_match_id (struct gbphy_device *gbphy_dev, -struct gbphy_driver *gbphy_drv) +gbphy_dev_match_id (const struct gbphy_device *gbphy_dev, +const struct gbphy_driver *gbphy_drv) {const struct gbphy_device_id *id = gbphy_drv->id_table;
@@ -119,7 +119,7 @@ gbphy_dev_match_id(struct gbphy_device *gbphy_dev,static int gbphy_dev_match (struct device *dev,const struct device_driver *drv) { -struct gbphy_driver *gbphy_drv =to_gbphy_driver (drv); +const struct gbphy_driver *gbphy_drv =to_gbphy_driver (drv);struct gbphy_device *gbphy_dev =to_gbphy_dev (dev);const struct gbphy_device_id *id;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 116/627 driver core: auxiliary bus: fix OF node leak
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 6beb4ec0f9fdff4c4c6eb8ed8654fe8396c2b6e0 ]
Make sure to drop the OF node reference taken when creating an auxiliary device using auxiliary_device_create() when the device is later released.
--- drivers/base/auxiliary.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/base/auxiliary.c +2 -0
@@ -399,6 +399,7 @@ static void auxiliary_device_release(struct device *dev) {struct auxiliary_device *auxdev =to_auxiliary_dev (dev); +of_node_put (dev->of_node);kfree (auxdev); }
@@ -435,6 +436,7 @@ struct auxiliary_device *auxiliary_device_create(struct device *dev, ret =auxiliary_device_init (auxdev);if (ret) { +of_node_put (auxdev->dev.of_node);kfree (auxdev);return NULL ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 117/627 samples: mei: Fix building on musl libc
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brahmajit Das <[email protected]>
[ Upstream commit 239df3e4b4752524e7c0fb3417c218d8063654b4 ]
The header bits/wordsize.h is glibc specific and on building on musl with allyesconfig results in
samples/mei/mei-amt-version.c:77:10: fatal error: bits/wordsize.h: No such file or directory
77 | #include <bits/wordsize.h>
| ^~~~~~~~~~~~~~~~~
mei-amt-version.c build file without bits/wordsize.h on musl and glibc.
However on musl we get the follwing error without sys/time.h
samples/mei/mei-amt-version.c: In function 'mei_recv_msg':samples/mei/mei-amt-version.c:159:24: error: storage size of 'tv' isn't known
159 | struct timeval tv;
| ^~samples/mei/mei-amt-version.c:160:9: error: unknown type name 'fd_set'
160 | fd_set set;
| ^~~~~~
samples/mei/mei-amt-version.c:168:9: error: implicit declaration of function 'FD_ZERO' [-Wimplicit-function-declaration]
168 | FD_ZERO(&set);
| ^~~~~~~
samples/mei/mei-amt-version.c:169:9: error: implicit declaration of function 'FD_SET'; did you mean 'L_SET'? [-Wimplicit-function-declaration]
169 | FD_SET(me->fd, &set);
| ^~~~~~
| L_SET
samples/mei/mei-amt-version.c:170:14: error: implicit declaration of function 'select' [-Wimplicit-function-declaration]
170 | rc = select(me->fd + 1, &set, NULL, NULL, &tv);
| ^~~~~~
samples/mei/mei-amt-version.c:171:23: error: implicit declaration of function 'FD_ISSET' [-Wimplicit-function-declaration]
171 | if (rc > 0 && FD_ISSET(me->fd, &set)) {
| ^~~~~~~~samples/mei/mei-amt-version.c:159:24: warning: unused variable 'tv' [-Wunused-variable]
159 | struct timeval tv;
| ^~
Hence the the file has been included.
--- samples/mei/mei-amt-version.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
samples/mei/mei-amt-version.c +1 -1
@@ -69,11 +69,11 @@#include <string.h> #include <fcntl.h> #include <sys/ioctl.h> +#include <sys/time.h> #include <unistd.h> #include <errno.h> #include <stdint.h> #include <stdbool.h> -#include <bits/wordsize.h> #include <linux/mei.h> /*****************************************************************************
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 118/627 soc: qcom: pmic_glink: fix OF node leak
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 65702c3d293e45d3cac5e4e175296a9c90404326 ]
Make sure to drop the OF node reference taken when registering the auxiliary devices when the devices are later released.
--- drivers/soc/qcom/pmic_glink.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/soc/qcom/pmic_glink.c +7 -2
@@ -167,7 +167,10 @@ static int pmic_glink_rpmsg_callback(struct rpmsg_device *rpdev, void *data,return 0 ; } -static void pmic_glink_aux_release (struct device *dev) {} +static void pmic_glink_aux_release (struct device *dev) +{ +of_node_put (dev->of_node); +} static int pmic_glink_add_aux_device(struct pmic_glink *pg, struct auxiliary_device *aux,
@@ -181,8 +184,10 @@ static int pmic_glink_add_aux_device(struct pmic_glink *pg, aux->dev.release = pmic_glink_aux_release;device_set_of_node_from_dev (&aux->dev, parent); ret =auxiliary_device_init (aux); -if (ret) +if (ret) { +of_node_put (aux->dev.of_node);return ret; + } ret =auxiliary_device_add (aux);if (ret)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 119/627 interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 02ee375506dceb7d32007821a2bff31504d64b99 ]
The qnm_a1noc_cfg declaration didn't include .num_links definition, fix it.
--- drivers/interconnect/qcom/sc8280xp.c | 1 + 1 file changed, 1 insertion(+)
drivers/interconnect/qcom/sc8280xp.c +1 -0
@@ -48,6 +48,7 @@ static struct qcom_icc_node qnm_a1noc_cfg = { .id = SC8280XP_MASTER_A1NOC_CFG, .channels = 1, .buswidth = 4, + .num_links = 1, .links = { SC8280XP_SLAVE_SERVICE_A1NOC }, };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 120/627 interconnect: qcom: sc8180x: specify num_nodes
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 7e0b59496a02d25828612721e846ea4b717a97b9 ]
Specify .num_nodes for several BCMs which missed this declaration.
--- drivers/interconnect/qcom/sc8180x.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/interconnect/qcom/sc8180x.c +6 -0
@@ -1492,34 +1492,40 @@ static struct qcom_icc_bcm bcm_sh3 = {static struct qcom_icc_bcm bcm_sn0 = { .name ="SN0" , + .num_nodes =1 , .nodes = { &slv_qns_gemnoc_sf } };static struct qcom_icc_bcm bcm_sn1 = { .name ="SN1" , + .num_nodes =1 , .nodes = { &slv_qxs_imem } };static struct qcom_icc_bcm bcm_sn2 = { .name ="SN2" , .keepalive = true, + .num_nodes =1 , .nodes = { &slv_qns_gemnoc_gc } };static struct qcom_icc_bcm bcm_co2 = { .name ="CO2" , + .num_nodes =1 , .nodes = { &mas_qnm_npu } };static struct qcom_icc_bcm bcm_sn3 = { .name ="SN3" , .keepalive = true, + .num_nodes =2 , .nodes = { &slv_srvc_aggre1_noc, &slv_qns_cnoc } };static struct qcom_icc_bcm bcm_sn4 = { .name ="SN4" , + .num_nodes =1 , .nodes = { &slv_qxs_pimem } };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 121/627 interconnect: qcom: qcs615: Drop IP0 interconnects
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit cbabc73e85be9e706a5051c9416de4a8d391cf57 ]
In the same spirit as e.g. Commit b136d257ee0b ("interconnect: qcom:
sc8280xp: Drop IP0 interconnects"), drop the resources that should be taken care of through the clk-rpmh driver.
--- drivers/interconnect/qcom/qcs615.c | 42 ------------------------------ 1 file changed, 42 deletions(-)
drivers/interconnect/qcom/qcs615.c +0 -42
@@ -342,15 +342,6 @@ static struct qcom_icc_node qnm_snoc_sf = { .links = { QCS615_SLAVE_LLCC }, }; -static struct qcom_icc_node ipa_core_master = { - .name ="ipa_core_master" , - .id =QCS615_MASTER_IPA_CORE , - .channels =1 , - .buswidth =8 , - .num_links =1 , - .links = {QCS615_SLAVE_IPA_CORE }, -}; -static struct qcom_icc_node llcc_mc = { .name ="llcc_mc" , .id = QCS615_MASTER_LLCC,
@@ -942,14 +933,6 @@ static struct qcom_icc_node srvc_gemnoc = { .num_links = 0, }; -static struct qcom_icc_node ipa_core_slave = { - .name ="ipa_core_slave" , - .id =QCS615_SLAVE_IPA_CORE , - .channels =1 , - .buswidth =8 , - .num_links =0 , -}; -static struct qcom_icc_node ebi = { .name ="ebi" , .id =QCS615_SLAVE_EBI1 ,
@@ -1113,12 +1096,6 @@ static struct qcom_icc_bcm bcm_cn1 = { &qhs_sdc1, &qhs_sdc2 }, }; -static struct qcom_icc_bcm bcm_ip0 = { - .name ="IP0" , - .num_nodes =1 , - .nodes = { &ipa_core_slave }, -}; -static struct qcom_icc_bcm bcm_mc0 = { .name ="MC0" , .keepalive = true,
@@ -1260,7 +1237,6 @@ static struct qcom_icc_bcm * const aggre1_noc_bcms[] = { &bcm_qup0, &bcm_sn3, &bcm_sn14, - &bcm_ip0, }; static struct qcom_icc_node * const aggre1_noc_nodes[] = {
@@ -1411,22 +1387,6 @@ static const struct qcom_icc_desc qcs615_gem_noc = { .num_bcms = ARRAY_SIZE(gem_noc_bcms), }; -static struct qcom_icc_bcm *const ipa_virt_bcms[] = { - &bcm_ip0, -}; - -static struct qcom_icc_node *const ipa_virt_nodes[] = { - [MASTER_IPA_CORE ] = &ipa_core_master, - [SLAVE_IPA_CORE ] = &ipa_core_slave, -}; - -static const struct qcom_icc_desc qcs615_ipa_virt = { - .nodes = ipa_virt_nodes, - .num_nodes =ARRAY_SIZE (ipa_virt_nodes), - .bcms = ipa_virt_bcms, - .num_bcms =ARRAY_SIZE (ipa_virt_bcms), -}; -static struct qcom_icc_bcm *const mc_virt_bcms[] = { &bcm_acv, &bcm_mc0,
@@ -1525,8 +1485,6 @@ static const struct of_device_id qnoc_of_match[] = { .data = &qcs615_dc_noc}, { .compatible = "qcom,qcs615-gem-noc", .data = &qcs615_gem_noc}, - { .compatible = "qcom,qcs615-ipa-virt", - .data = &qcs615_ipa_virt}, { .compatible = "qcom,qcs615-mc-virt", .data = &qcs615_mc_virt}, { .compatible = "qcom,qcs615-mmss-noc",
Signature · 1 line
2.39.5
Re: [PATCH 6.16 121/627] interconnect: qcom: qcs615: Drop IP0 interconnects
Quoted 12 lines · Greg Kroah-Hartman
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit
cbabc73e85be9e706a5051c9416de4a8d391cf57]In the same spirit as e.g. Commit
b136d257ee0b("interconnect: qcom:
sc8280xp: Drop IP0 interconnects"), drop the resources that should be taken care of through the clk-rpmh driver.
Quoted 7 lines
Fixes 77d79677b04b ("interconnect: qcom: add QCS615 interconnect provider driver")Signed-off-by Konrad Dybcio <[email protected]>Reviewed-by Dmitry Baryshkov <[email protected]>Signed-off-by Georgi Djakov <[email protected]>Signed-off-by Sasha Levin <[email protected]>---
<copypasta for another stable queue>
Please drop, this has cross-dependencies and even if we applied all of them, the series had no visible impact
Konrad
Greg Kroah-Hartman
maintainerRe: [PATCH 6.16 121/627] interconnect: qcom: qcs615: Drop IP0 interconnects
Quoted 21 lines · Konrad Dybcio
Quoted 12 lines · Greg Kroah-Hartman
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit
cbabc73e85be9e706a5051c9416de4a8d391cf57]In the same spirit as e.g. Commit
b136d257ee0b("interconnect: qcom:
sc8280xp: Drop IP0 interconnects"), drop the resources that should be taken care of through the clk-rpmh driver.Quoted 7 lines
Fixes 77d79677b04b ("interconnect: qcom: add QCS615 interconnect provider driver")Signed-off-by Konrad Dybcio <[email protected]>Reviewed-by Dmitry Baryshkov <[email protected]>Signed-off-by Georgi Djakov <[email protected]>Signed-off-by Sasha Levin <[email protected]>---
Quoted 4 lines
<copypasta for another stable queue>
Please drop, this has cross-dependencies and even if we applied all of them, the series had no visible impact
Ok, all now dropped, thanks.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 122/627 bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Slark Xiao <[email protected]>
[ Upstream commit ae5a34264354087aef38cdd07961827482a51c5a ]
T99W640 was mistakenly mentioned as T99W515. T99W515 is a LGA device, not a M.2 modem device. So correct it's name to avoid name mismatch issue.
--- drivers/bus/mhi/host/pci_generic.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/bus/mhi/host/pci_generic.c +4 -4
@@ -593,8 +593,8 @@ static const struct mhi_pci_dev_info mhi_foxconn_dw5932e_info = { .sideband_wake = false, }; -static const struct mhi_pci_dev_info mhi_foxconn_t99w515_info = { - .name ="foxconn-t99w515" , +static const struct mhi_pci_dev_info mhi_foxconn_t99w640_info = { + .name ="foxconn-t99w640" , .edl ="qcom/sdx72m/foxconn/edl.mbn" , .edl_trigger = true, .config = &modem_foxconn_sdx72_config,
@@ -920,9 +920,9 @@ static const struct pci_device_id mhi_pci_id_table[] = {/* DW5932e (sdx62), Non-eSIM */ { PCI_DEVICE(PCI_VENDOR_ID_FOXCONN, 0xe0f9), .driver_data = (kernel_ulong_t) &mhi_foxconn_dw5932e_info }, -/* T99W515 (sdx72) */ +/* T99W640 (sdx72) */ { PCI_DEVICE(PCI_VENDOR_ID_FOXCONN, 0xe118), - .driver_data = (kernel_ulong_t) &mhi_foxconn_t99w515_info }, + .driver_data = (kernel_ulong_t) &mhi_foxconn_t99w640_info },/* DW5934e(sdx72), With eSIM */ { PCI_DEVICE(PCI_VENDOR_ID_FOXCONN, 0xe11d), .driver_data = (kernel_ulong_t) &mhi_foxconn_dw5934e_info },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 123/627 drm/xe: Correct the rev value for the DVSEC entries
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael J. Ruhl <[email protected]>
[ Upstream commit 0ba9e9cf76f2487654bc9bca38218780fa53030e ]
By definition, the Designated Vendor Specific Extended Capability (DVSEC) revision should be 1.
Add the rev value to be correct.
--- drivers/gpu/drm/xe/xe_vsec.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/xe/xe_vsec.c +3 -0
@@ -24,6 +24,7 @@#define BMG_DEVICE_ID 0xE2F8static struct intel_vsec_header bmg_telemetry = { + .rev =1 , .length =0x10 , .id =VSEC_ID_TELEMETRY , .num_entries =2 ,
@@ -33,6 +34,7 @@ static struct intel_vsec_header bmg_telemetry = { };static struct intel_vsec_header bmg_punit_crashlog = { + .rev =1 , .length =0x10 , .id =VSEC_ID_CRASHLOG , .num_entries =1 ,
@@ -42,6 +44,7 @@ static struct intel_vsec_header bmg_punit_crashlog = { };static struct intel_vsec_header bmg_oobmsm_crashlog = { + .rev =1 , .length =0x10 , .id =VSEC_ID_CRASHLOG , .num_entries =1 ,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 124/627 drm/xe: Correct BMG VSEC header sizing
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael J. Ruhl <[email protected]>
[ Upstream commit 5b27388171a18cf6842c700520086ec50194e858 ]
The intel_vsec_header information for the crashlog feature is incorrect.
Update the VSEC header with correct sizing and count.
Since the crashlog entries are "merged" (num_entries = 2), the separate capabilities entries must be merged as well.
--- drivers/gpu/drm/xe/xe_vsec.c | 19 ++++--------------- 1 file changed, 4 insertions(+), 15 deletions(-)
drivers/gpu/drm/xe/xe_vsec.c +4 -15
@@ -33,30 +33,19 @@ static struct intel_vsec_header bmg_telemetry = { .offset = BMG_DISCOVERY_OFFSET, }; -static struct intel_vsec_header bmg_punit_crashlog = { +static struct intel_vsec_header bmg_crashlog = { .rev =1 , .length =0x10 , .id =VSEC_ID_CRASHLOG , - .num_entries =1 , - .entry_size =4 , + .num_entries =2 , + .entry_size =6 , .tbir =0 , .offset =BMG_DISCOVERY_OFFSET +0x60 , }; -static struct intel_vsec_header bmg_oobmsm_crashlog = { - .rev =1 , - .length =0x10 , - .id =VSEC_ID_CRASHLOG , - .num_entries =1 , - .entry_size =4 , - .tbir =0 , - .offset =BMG_DISCOVERY_OFFSET +0x78 , -}; -static struct intel_vsec_header *bmg_capabilities[] = { &bmg_telemetry, - &bmg_punit_crashlog, - &bmg_oobmsm_crashlog, + &bmg_crashlog,NULL };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 125/627 platform/x86: oxpec: Fix turbo register for G1 AMD
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antheas Kapenekakis <[email protected]>
[ Upstream commit 232b41d3c2ce8cf4641a174416676458bf0de5b2 ]
Turns out that the AMD variant of the G1 uses different EC registers than the Intel variant. Differentiate them and apply the correct ones to the AMD variant.
--- drivers/platform/x86/oxpec.c | 37 +++++++++++++++++++++++------------- 1 file changed, 24 insertions(+), 13 deletions(-)
drivers/platform/x86/oxpec.c +24 -13
@@ -58,7 +58,8 @@ enum oxp_board { oxp_mini_amd_a07, oxp_mini_amd_pro, oxp_x1, - oxp_g1, + oxp_g1_i, + oxp_g1_a, };static enum oxp_board board;
@@ -247,14 +248,14 @@ static const struct dmi_system_id dmi_table[] = {DMI_MATCH (DMI_BOARD_VENDOR ,"ONE-NETBOOK" ), DMI_EXACT_MATCH(DMI_BOARD_NAME, "ONEXPLAYER G1 A"), }, - .driver_data = (void *)oxp_g1, + .driver_data = (void *)oxp_g1_a, }, { .matches = {DMI_MATCH (DMI_BOARD_VENDOR ,"ONE-NETBOOK" ), DMI_EXACT_MATCH(DMI_BOARD_NAME, "ONEXPLAYER G1 i"), }, - .driver_data = (void *)oxp_g1, + .driver_data = (void *)oxp_g1_i, }, { .matches = {
@@ -352,7 +353,8 @@ static umode_t tt_toggle_is_visible(struct kobject *kobj,case oxp_mini_amd_a07:case oxp_mini_amd_pro:case oxp_x1: -case oxp_g1: +case oxp_g1_i: +case oxp_g1_a:return attr->mode;default :break ;
@@ -381,12 +383,13 @@ static ssize_t tt_toggle_store(struct device *dev,case aok_zoe_a1:case oxp_fly:case oxp_mini_amd_pro: +case oxp_g1_a: reg =OXP_TURBO_SWITCH_REG ; mask =OXP_TURBO_TAKE_VAL ;break ;case oxp_2:case oxp_x1: -case oxp_g1: +case oxp_g1_i: reg =OXP_2_TURBO_SWITCH_REG ; mask =OXP_TURBO_TAKE_VAL ;break ;
@@ -426,12 +429,13 @@ static ssize_t tt_toggle_show(struct device *dev,case aok_zoe_a1:case oxp_fly:case oxp_mini_amd_pro: +case oxp_g1_a: reg =OXP_TURBO_SWITCH_REG ; mask =OXP_TURBO_TAKE_VAL ;break ;case oxp_2:case oxp_x1: -case oxp_g1: +case oxp_g1_i: reg =OXP_2_TURBO_SWITCH_REG ; mask =OXP_TURBO_TAKE_VAL ;break ;
@@ -520,7 +524,8 @@ static bool oxp_psy_ext_supported(void) {switch (board) {case oxp_x1: -case oxp_g1: +case oxp_g1_i: +case oxp_g1_a:case oxp_fly:return true;default :
@@ -659,7 +664,8 @@ static int oxp_pwm_enable(void)case oxp_mini_amd_a07:case oxp_mini_amd_pro:case oxp_x1: -case oxp_g1: +case oxp_g1_i: +case oxp_g1_a:return write_to_ec (OXP_SENSOR_PWM_ENABLE_REG ,PWM_MODE_MANUAL );default :return -EINVAL ;
@@ -686,7 +692,8 @@ static int oxp_pwm_disable(void)case oxp_mini_amd_a07:case oxp_mini_amd_pro:case oxp_x1: -case oxp_g1: +case oxp_g1_i: +case oxp_g1_a:return write_to_ec (OXP_SENSOR_PWM_ENABLE_REG ,PWM_MODE_AUTO );default :return -EINVAL ;
@@ -713,7 +720,8 @@ static int oxp_pwm_read(long *val)case oxp_mini_amd_a07:case oxp_mini_amd_pro:case oxp_x1: -case oxp_g1: +case oxp_g1_i: +case oxp_g1_a:return read_from_ec (OXP_SENSOR_PWM_ENABLE_REG ,1 , val);default :return -EOPNOTSUPP ;
@@ -742,7 +750,7 @@ static int oxp_pwm_fan_speed(long *val)return read_from_ec (ORANGEPI_SENSOR_FAN_REG ,2 , val);case oxp_2:case oxp_x1: -case oxp_g1: +case oxp_g1_i:return read_from_ec (OXP_2_SENSOR_FAN_REG ,2 , val);case aok_zoe_a1:case aya_neo_2:
@@ -757,6 +765,7 @@ static int oxp_pwm_fan_speed(long *val)case oxp_mini_amd:case oxp_mini_amd_a07:case oxp_mini_amd_pro: +case oxp_g1_a:return read_from_ec (OXP_SENSOR_FAN_REG ,2 , val);default :return -EOPNOTSUPP ;
@@ -776,7 +785,7 @@ static int oxp_pwm_input_write(long val)return write_to_ec (ORANGEPI_SENSOR_PWM_REG , val);case oxp_2:case oxp_x1: -case oxp_g1: +case oxp_g1_i:/* scale to range [0-184] */ val = (val *184 ) /255 ;return write_to_ec (OXP_SENSOR_PWM_REG , val);
@@ -796,6 +805,7 @@ static int oxp_pwm_input_write(long val)case aok_zoe_a1:case oxp_fly:case oxp_mini_amd_pro: +case oxp_g1_a:return write_to_ec (OXP_SENSOR_PWM_REG , val);default :return -EOPNOTSUPP ;
@@ -816,7 +826,7 @@ static int oxp_pwm_input_read(long *val)break ;case oxp_2:case oxp_x1: -case oxp_g1: +case oxp_g1_i: ret =read_from_ec (OXP_SENSOR_PWM_REG ,1 , val);if (ret)return ret;
@@ -842,6 +852,7 @@ static int oxp_pwm_input_read(long *val)case aok_zoe_a1:case oxp_fly:case oxp_mini_amd_pro: +case oxp_g1_a:default : ret =read_from_ec (OXP_SENSOR_PWM_REG ,1 , val);if (ret)
Signature · 1 line
2.39.5