6.12.58-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 6.12.58-rc1 review
This is the start of the stable review cycle for the 6.12.58 release. There are 565 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 13 Nov 2025 00:43:57 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.58-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.12.58-rc1
Heiner Kallweit <[email protected]>
net: phy: fix phy_disable_eee
Alex Hung <[email protected]>
drm/amd/display: Fix black screen with HDMI outputs
Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Fix function header names in amdgpu_connectors.c
Sathishkumar S <[email protected]>
drm/amdgpu: Fix unintended error log in VCN5_0_0
Punit Agrawal <[email protected]>
ACPI: SPCR: Check for table version when using precise baudrate
Krzysztof Kozlowski <[email protected]>
extcon: adc-jack: Cleanup wakeup source only if it was enabled
Melissa Wen <[email protected]>
drm/amd/display: update color on atomic commit time
Adrian Hunter <[email protected]>
scsi: ufs: core: Add a quirk to suppress link_startup_again
Adrian Hunter <[email protected]>
scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL
Adrian Hunter <[email protected]>
scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers
Nathan Chancellor <[email protected]>
lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC
Bui Quang Minh <[email protected]>
virtio-net: fix received length check in big packets
Rong Zhang <[email protected]>
drm/amd/display: Fix NULL deref in debugfs odm_combine_segments
Alex Deucher <[email protected]>
drm/amdgpu/smu: Handle S0ix for vangogh
Henrique Carvalho <[email protected]>
smb: client: fix potential UAF in smb2_close_cached_fid()
Joshua Rogers <[email protected]>
smb: client: validate change notify buffer before copy
Mario Limonciello (AMD) <[email protected]>
x86/microcode/AMD: Add more known models to entry sign checking
Yuta Hayama <[email protected]>
rtc: rx8025: fix incorrect register reference
Helge Deller <[email protected]>
parisc: Avoid crash due to unaligned access in unwinder
Jason Gunthorpe <[email protected]>
iommufd: Don't overflow during division for dirty tracking
Ilia Gavrilov <[email protected]>
Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()
Pierre-Eric Pelloux-Prayer <[email protected]>
drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb
Wayne Lin <[email protected]>
drm/amd/display: Enable mst when it's detected but yet to be initialized
Zilin Guan <[email protected]>
tracing: Fix memory leaks in create_field_var()
Nikolay Aleksandrov <[email protected]>
net: bridge: fix MST static key usage
Nikolay Aleksandrov <[email protected]>
net: bridge: fix use-after-free due to MST port state bypass
Horatiu Vultur <[email protected]>
lan966x: Fix sleeping in atomic context
Tristram Ha <[email protected]>
net: dsa: microchip: Fix reserved multicast address table programming
Haotian Zhang <[email protected]>
net: wan: framer: pef2256: Switch to devm_mfd_add_devices()
Dragos Tatulea <[email protected]>
net/mlx5e: SHAMPO, Fix skb size check for 64K pages
Meghana Malladi <[email protected]>
net: ti: icssg-prueth: Fix fdb hash size configuration
Gal Pressman <[email protected]>
net/mlx5e: Fix return value in case of module EEPROM read error
Martin Willi <[email protected]>
wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup
Hongguang Gao <[email protected]>
bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem()
Hongguang Gao <[email protected]>
bnxt_en: Refactor bnxt_free_ctx_mem()
Shruti Parab <[email protected]>
bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type
Kalesh AP <[email protected]>
bnxt_en: Fix a possible memory leak in bnxt_ptp_init
Qendrim Maxhuni <[email protected]>
net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
Mohammad Heib <[email protected]>
net: ionic: map SKB after pseudo-header checksum prep
Mohammad Heib <[email protected]>
net: ionic: add dma_wmb() before ringing TX doorbell
Stefan Wiehler <[email protected]>
sctp: Hold sock lock while iterating over address list
Stefan Wiehler <[email protected]>
sctp: Prevent TOCTOU out-of-bounds write
Stefan Wiehler <[email protected]>
sctp: Hold RCU read lock while iterating over address list
Jonas Gorski <[email protected]>
net: dsa: b53: stop reading ARL entries if search is done
Jonas Gorski <[email protected]>
net: dsa: b53: fix enabling ip multicast
Jonas Gorski <[email protected]>
net: dsa: b53: fix bcm63xx RGMII port link adjustment
Jonas Gorski <[email protected]>
net: dsa: b53: fix resetting speed and pause on forced link
Bartosz Golaszewski <[email protected]>
gpiolib: fix invalid pointer access in debugfs
Bartosz Golaszewski <[email protected]>
gpio: swnode: don't use the swnode's name as the key for GPIO lookup
Hangbin Liu <[email protected]>
net: vlan: sync VLAN features with lower device
Wang Liang <[email protected]>
selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh
Anubhav Singh <[email protected]>
selftests/net: use destination options instead of hop-by-hop
Anubhav Singh <[email protected]>
selftests/net: fix out-of-order delivery of FIN in gro:tcp test
Jonas Gorski <[email protected]>
net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx
Álvaro Fernández Rojas <[email protected]>
net: dsa: tag_brcm: legacy: reorganize functions
Abdun Nihaal <[email protected]>
Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2()
Raphael Pinsonneault-Thibeault <[email protected]>
Bluetooth: hci_event: validate skb length for unknown CC opcode
Josephine Pfeiffer <[email protected]>
riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro
Chunyan Zhang <[email protected]>
riscv: stacktrace: Disable KASAN checks for non-current tasks
Jiawen Wu <[email protected]>
net: libwx: fix device bus LAN ID
Steven Rostedt <[email protected]>
ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up
Baochen Qiang <[email protected]>
Revert "wifi: ath10k: avoid unnecessary wait for service ready message"
Ariel D'Alessandro <[email protected]>
drm/mediatek: Disable AFBC support on Mediatek DRM driver
Marek Szyprowski <[email protected]>
media: videobuf2: forbid remove_bufs when legacy fileio is active
Ricardo Ribalda <[email protected]>
media: uvcvideo: Use heuristic to find stream entity
Qu Wenruo <[email protected]>
btrfs: ensure no dirty metadata is written back for an fs with errors
Kailang Yang <[email protected]>
ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again
Linus Torvalds <[email protected]>
x86: uaccess: don't use runtime-const rewriting in modules
Kirill A. Shutemov <[email protected]>
x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro
Linus Torvalds <[email protected]>
x86: use cmov for user address masking
Kotresh HR <[email protected]>
ceph: fix multifs mds auth caps issue
Viacheslav Dubeyko <[email protected]>
ceph: refactor wake_up_bit() pattern of calling
Viacheslav Dubeyko <[email protected]>
ceph: fix potential race condition in ceph_ioctl_lazyio()
Viacheslav Dubeyko <[email protected]>
ceph: add checking of wait_for_completion_killable() return value
Philip Yang <[email protected]>
drm/amdkfd: Fix mmap write lock not release
Valerio Setti <[email protected]>
ASoC: meson: aiu-encoder-i2s: fix bit clock polarity
Geert Uytterhoeven <[email protected]>
kbuild: uapi: Strip comments before size type check
Sammy Hsu <[email protected]>
net: wwan: t7xx: add support for HP DRMR-H01
Bruno Thomsen <[email protected]>
rtc: pcf2127: fix watchdog interrupt mask on pcf2131
Albin Babu Varghese <[email protected]>
fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
Sascha Hauer <[email protected]>
tools: lib: thermal: use pkg-config to locate libnl3
Emil Dahl Juhl <[email protected]>
tools: lib: thermal: don't preserve owner in install
Ian Rogers <[email protected]>
tools bitmap: Add missing asm-generic/bitsperlong.h include
Tiezhu Yang <[email protected]>
LoongArch: Handle new atomic instructions for probes
Sakari Ailus <[email protected]>
ACPI: property: Return present device nodes only on fwnode interface
Hoyoung Seo <[email protected]>
scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS
Randall P. Embry <[email protected]>
9p: sysfs_init: don't hardcode error to ENOMEM
Aaron Kling <[email protected]>
cpufreq: tegra186: Initialize all cores to max frequencies
Randall P. Embry <[email protected]>
9p: fix /sys/fs/9p/caches overwriting itself
Jerome Brunet <[email protected]>
NTB: epf: Allow arbitrary BAR mapping
Shubhrajyoti Datta <[email protected]>
clk: clocking-wizard: Fix output clock register offset for Versal platforms
Jacky Bai <[email protected]>
clk: scmi: Add duty cycle ops only when duty cycle is supported
Matthias Schiffer <[email protected]>
clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled
Oleg Nesterov <[email protected]>
9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN
Nicolas Ferre <[email protected]>
clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register
Ryan Wanner <[email protected]>
clk: at91: clk-master: Add check for divide by 3
Balamanikandan Gunasundar <[email protected]>
clk: at91: sam9x7: Add peripheral clock id for pmecc
Nicolas Ferre <[email protected]>
ARM: at91: pm: save and restore ACR during PLL disable/enable
Josua Mayer <[email protected]>
rtc: pcf2127: clear minute/second interrupt
Chen-Yu Tsai <[email protected]>
clk: sunxi-ng: sun6i-rtc: Add A523 specifics
Tiwei Bie <[email protected]>
um: Fix help message for ssl-non-raw
Yikang Yue <[email protected]>
fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink
Marko Mäkelä <[email protected]>
clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf
austinchang <[email protected]>
btrfs: mark dirty extent range for out of bound prealloc extents
Shardul Bankar <[email protected]>
btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation
Junxian Huang <[email protected]>
RDMA/hns: Fix wrong WQE data when QP wraps around
wenglianfa <[email protected]>
RDMA/hns: Fix the modification of max_send_sge
Chengchang Tang <[email protected]>
RDMA/hns: Fix recv CQ and QP cache affinity
Jacob Moroni <[email protected]>
RDMA/irdma: Set irdma_cq cq_num field during CQ create
Jacob Moroni <[email protected]>
RDMA/irdma: Remove unused struct irdma_cq fields
Jacob Moroni <[email protected]>
RDMA/irdma: Fix SD index calculation
Saket Dumbre <[email protected]>
ACPICA: Update dsmethod.c to get rid of unused variable warning
Mario Limonciello <[email protected]>
drm/amd/display: Add fallback path for YCBCR422
Thadeu Lima de Souza Cascardo <[email protected]>
char: misc: restrict the dynamic range to exclude reserved minors
Michal Pecio <[email protected]>
usb: xhci-pci: Fix USB2-only root hub registration
Coiby Xu <[email protected]>
ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr
Fiona Ebner <[email protected]>
smb: client: transport: avoid reconnects triggered by pending task work
Namjae Jeon <[email protected]>
ksmbd: use sock_create_kern interface to create kernel socket
Vladimir Riabchun <[email protected]>
ftrace: Fix softlockup in ftrace_module_enable
Mike Marshall <[email protected]>
orangefs: fix xattr related buffer overflow...
Dragos Tatulea <[email protected]>
page_pool: Clamp pool size to max 16K pages
Qingfang Deng <[email protected]>
6pack: drop redundant locking and refcounting
Namjae Jeon <[email protected]>
exfat: validate cluster allocation bits of the allocation bitmap
Chi Zhiling <[email protected]>
exfat: limit log print for IO error
Rohan G Thomas <[email protected]>
net: stmmac: est: Drop frames causing HLBS error
Roy Vegard Ovesen <[email protected]>
ALSA: usb-audio: add mono main switch to Presonus S1824c
Ivan Pravdin <[email protected]>
Bluetooth: bcsp: receive data only if registered
Chris Lu <[email protected]>
Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922
Luiz Augusto von Dentz <[email protected]>
Bluetooth: SCO: Fix UAF on sco_conn_free
Arkadiusz Bokowy <[email protected]>
Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames
Théo Lebrun <[email protected]>
net: macb: avoid dealing with endianness in macb_set_hwaddr()
Carolina Jubran <[email protected]>
net/mlx5e: Don't query FEC statistics when FEC is disabled
Timothy Pearson <[email protected]>
vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices
Sunil V L <[email protected]>
ACPI: scan: Update honor list for RPMI System MSI
Primoz Fiser <[email protected]>
ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007
Olivier Moysan <[email protected]>
ASoC: stm32: sai: manage context in set_sysclk callback
Yifan Zhang <[email protected]>
amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw
Julian Sun <[email protected]>
ext4: increase IO priority of fastcommit
chuguangqing <[email protected]>
fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock
Moti Haimovski <[email protected]>
accel/habanalabs: support mapping cb with vmalloc-backed coherent memory
Konstantin Sinyuk <[email protected]>
accel/habanalabs/gaudi2: read preboot status after recovering from dirty state
Tomer Tayar <[email protected]>
accel/habanalabs: return ENOMEM if less than requested pages were pinned
Ranjan Kumar <[email protected]>
scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate
Vered Yavniely <[email protected]>
accel/habanalabs/gaudi2: fix BMON disable configuration
Alok Tiwari <[email protected]>
scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill()
Petr Machata <[email protected]>
net: bridge: Install FDB for bridge MAC on VLAN 0
Al Viro <[email protected]>
nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing
Anthony Iliopoulos <[email protected]>
NFSv4.1: fix mount hang after CREATE_SESSION failure
Olga Kornievskaia <[email protected]>
NFSv4: handle ERR_GRACE on delegation recalls
Melissa Wen <[email protected]>
drm/amd/display: change dc stream color settings only in atomic commit
Sridevi Arvindekar <[email protected]>
drm/amd/display: Fix for test crash due to power gating
Lo-an Chen <[email protected]>
drm/amd/display: Init dispclk from bootup clock for DCN314
Karthi Kandasamy <[email protected]>
drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream
Bastien Curutchet <[email protected]>
net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463
Nithyanantham Paramasivam <[email protected]>
wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256
Stephan Gerhold <[email protected]>
remoteproc: qcom: q6v5: Avoid handling handover twice
David Yang <[email protected]>
selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt
Mario Limonciello <[email protected]>
PCI/PM: Skip resuming to D0 if device is disconnected
Weili Qian <[email protected]>
crypto: hisilicon/qm - clear all VF configurations in the hardware
Weili Qian <[email protected]>
crypto: hisilicon/qm - invalidate queues in use
Alex Mastro <[email protected]>
vfio: return -ENOTTY for unsupported device feature
Al Viro <[email protected]>
sparc64: fix prototypes of reads[bwl]()
Koakuma <[email protected]>
sparc/module: Add R_SPARC_UA64 relocation handling
Chen Wang <[email protected]>
PCI: cadence: Check for the existence of cdns_pcie::ops before using it
ChunHao Lin <[email protected]>
r8169: set EEE speed down ratio to 1
Brahmajit Das <[email protected]>
net: intel: fm10k: Fix parameter idx set but not used
Ilan Peer <[email protected]>
wifi: mac80211: Track NAN interface start/stop
Loic Poulain <[email protected]>
wifi: ath10k: Fix connection after GTK rekeying
Seyediman Seyedarab <[email protected]>
iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot()
Vivek Pernamitta <[email protected]>
bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state
Robert Marko <[email protected]>
net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X
Oleksij Rempel <[email protected]>
net: phy: clear link parameters on admin link down
Alexey Klimov <[email protected]>
ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup()
Guangshuo Li <[email protected]>
drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked()
Shaurya Rane <[email protected]>
jfs: fix uninitialized waitqueue in transaction manager
Tetsuo Handa <[email protected]>
jfs: Verify inode mode when loading from disk
Vlad Dumitrescu <[email protected]>
IB/ipoib: Ignore L3 master device
Tatyana Nikolova <[email protected]>
RDMA/irdma: Update Kconfig
Eric Dumazet <[email protected]>
ipv6: np->rxpmtu race annotation
Niklas Neronin <[email protected]>
usb: xhci-pci: add support for hosts with zero USB3 ports
Zong-Zhe Yang <[email protected]>
wifi: rtw89: renew a completion for each H2C command waiting C2H event
Chih-Kang Chang <[email protected]>
wifi: rtw89: obtain RX path from ppdu status IE00
wangzijie <[email protected]>
f2fs: fix infinite loop in __insert_extent_tree()
Krishna Kurapati <[email protected]>
usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
Forest Crossman <[email protected]>
usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
Al Viro <[email protected]>
allow finish_no_open(file, ERR_PTR(-E...))
Justin Tee <[email protected]>
scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology
Justin Tee <[email protected]>
scsi: lpfc: Define size of debugfs entry for xri rebalancing
Justin Tee <[email protected]>
scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup
Justin Tee <[email protected]>
scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET
Justin Tee <[email protected]>
scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted
Justin Tee <[email protected]>
scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail
Bart Van Assche <[email protected]>
scsi: ufs: core: Disable timestamp functionality if not supported
Nai-Chen Cheng <[email protected]>
selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency
Christian König <[email protected]>
drm/amdgpu: reject gang submissions under SRIOV
John Harrison <[email protected]>
drm/xe/guc: Return an error code if the GuC load fails
Mario Limonciello (AMD) <[email protected]>
HID: i2c-hid: Resolve touchpad issues on Dell systems during S4
Stefan Wahren <[email protected]>
ethernet: Extend device_get_mac_address() to use NVMEM
Jakub Kicinski <[email protected]>
page_pool: always add GFP_NOWARN for ATOMIC allocations
Xi Ruoyao <[email protected]>
drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START
Timur Kristóf <[email protected]>
drm/amd/display: Disable VRR on DCE 6
Timur Kristóf <[email protected]>
drm/amd/display: Fix DVI-D/HDMI adapters
Mario Limonciello (AMD) <[email protected]>
drm/amd: Avoid evicting resources at S5
Ausef Yousof <[email protected]>
drm/amd/display: fix dml ms order of operations
Mario Limonciello <[email protected]>
drm/amd/display: Set up pixel encoding for YCBCR422
Tvrtko Ursulin <[email protected]>
drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl
Felix Fietkau <[email protected]>
wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error
John Keeping <[email protected]>
ALSA: serial-generic: remove shared static buffer
Rosen Penev <[email protected]>
wifi: mt76: mt76_eeprom_override to int
Benjamin Lin <[email protected]>
wifi: mt76: mt7996: Temporarily disable EPCS
Quan Zhou <[email protected]>
wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device
Yafang Shao <[email protected]>
net/cls_cgroup: Fix task_get_classid() during qdisc run
Gaurav Jain <[email protected]>
crypto: caam - double the entropy delay interval for retry
Yunseong Kim <[email protected]>
crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti()
Niklas Cassel <[email protected]>
PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify()
Ovidiu Panait <[email protected]>
crypto: sun8i-ce - remove channel timeout field
Sangwook Shin <[email protected]>
watchdog: s3c2410_wdt: Fix max_timeout being calculated larger
Antheas Kapenekakis <[email protected]>
HID: asus: add Z13 folio to generic group for multitouch to work
Alok Tiwari <[email protected]>
udp_tunnel: use netdev_warn() instead of netdev_WARN()
Stanislav Fomichev <[email protected]>
net: devmem: expose tcp_recvmsg_locked errors
David Ahern <[email protected]>
selftests: Replace sleep with slowwait
Daniel Palmer <[email protected]>
eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP
David Ahern <[email protected]>
selftests: Disable dad for ipv6 in fcnal-test.sh
Li RongQing <[email protected]>
x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT
Florian Westphal <[email protected]>
netfilter: nf_reject: don't reply to icmp error messages
chenmiao <[email protected]>
openrisc: Add R_OR1K_32_PCREL relocation type module support
Ido Schimmel <[email protected]>
selftests: traceroute: Return correct value on failure
Ido Schimmel <[email protected]>
selftests: traceroute: Use require_command()
Qianfeng Rong <[email protected]>
media: redrat3: use int type to store negative error codes
Jakub Kicinski <[email protected]>
selftests: net: replace sleeps in fcnal-test with waits
Niklas Söderlund <[email protected]>
net: sh_eth: Disable WoL if system can not suspend
Rob Clark <[email protected]>
drm/msm/registers: Generate _HI/LO builders for reg64
Michael Riesch <[email protected]>
phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0
Michael Dege <[email protected]>
phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet
Mario Limonciello (AMD) <[email protected]>
Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO
Harikrishna Shenoy <[email protected]>
phy: cadence: cdns-dphy: Enable lower resolutions in dphy
Ilan Peer <[email protected]>
wifi: mac80211: Fix HE capabilities element check
Tetsuo Handa <[email protected]>
ntfs3: pretend $Extend records as regular files
Peter Wang <[email protected]>
scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes
Peter Wang <[email protected]>
scsi: ufs: host: mediatek: Correct system PM flow
Rohan G Thomas <[email protected]>
net: phy: marvell: Fix 88e1510 downshift counter errata
Peter Wang <[email protected]>
scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure
Peter Wang <[email protected]>
scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue
Peter Wang <[email protected]>
scsi: ufs: host: mediatek: Enhance recovery on resume failure
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: allow more time to send ADD_ADDR
Jaegeuk Kim <[email protected]>
f2fs: fix wrong layout information on 16KB page
Vladimir Zapolskiy <[email protected]>
media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer
Hao Yao <[email protected]>
media: ov08x40: Fix the horizontal flip control
Nidhish A N <[email protected]>
wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list
Marek Vasut <[email protected]>
PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs
Xion Wang <[email protected]>
char: Use list_del_init() in misc_deregister() to reinitialize list pointer
Antonino Maniscalco <[email protected]>
drm/msm: make sure to not queue up recovery more than once
Zizhi Wo <[email protected]>
tty/vt: Add missing return value for VT_RESIZE in vt_ioctl()
Chen Yufeng <[email protected]>
usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget
William Wu <[email protected]>
usb: gadget: f_hid: Fix zero length packet transfer
Vladimir Oltean <[email protected]>
net: dsa: felix: support phy-mode = "10g-qxgmii"
Fangzhi Zuo <[email protected]>
drm/amd/display: Fix pbn_div Calculation Error
Alex Deucher <[email protected]>
drm/amdgpu: add support for cyan skillfish gpu_info
Alex Deucher <[email protected]>
drm/amdgpu: don't enable SMU on cyan skillfish
Alex Deucher <[email protected]>
drm/amd: add more cyan skillfish PCI ids
Hector Martin <[email protected]>
iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs
Ashish Kalra <[email protected]>
crypto: ccp: Skip SEV and SNP INIT for kdump boot
Ashish Kalra <[email protected]>
iommu/amd: Skip enabling command/event buffers for kdump
Colin Foster <[email protected]>
smsc911x: add second read of EEPROM mac when possible corruption seen
Eric Dumazet <[email protected]>
net: call cond_resched() less often in __release_sock()
Michal Wajdeczko <[email protected]>
drm/xe/guc: Set upper limit of H2G retries over CTB
Richard Zhu <[email protected]>
PCI: imx6: Enable the Vaux supply if available
Cryolitia PukNgae <[email protected]>
ALSA: usb-audio: apply quirk for MOONDROP Quark2
Ramya Gnanasekar <[email protected]>
wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands
Paul Kocialkowski <[email protected]>
media: verisilicon: Explicitly disable selection api ioctls for decoders
Niklas Söderlund <[email protected]>
media: adv7180: Only validate format in querystd
Niklas Söderlund <[email protected]>
media: adv7180: Do not write format to device in set_fmt
Niklas Söderlund <[email protected]>
media: adv7180: Add missing lock in suspend callback
Juraj Šarinay <[email protected]>
net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
Antheas Kapenekakis <[email protected]>
drm: panel-backlight-quirks: Make EDID match optional
Chia-I Wu <[email protected]>
drm/panthor: check bo offset alignment in vm bind
Yue Haibing <[email protected]>
ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
Jakub Kicinski <[email protected]>
selftests: drv-net: rss_ctx: make the test pass with few queues
Zhanjun Dong <[email protected]>
drm/xe/guc: Increase GuC crash dump buffer size
David Francis <[email protected]>
drm/amdgpu: Allow kfd CRIU with no buffer objects
Krzysztof Kozlowski <[email protected]>
drm/msm/dsi/phy_7nm: Fix missing initial VCO rate
Krzysztof Kozlowski <[email protected]>
drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL
Devendra K Verma <[email protected]>
dmaengine: dw-edma: Set status for callback_result
Rosen Penev <[email protected]>
dmaengine: mv_xor: match alloc_wc and free_wc
Thomas Andreatta <[email protected]>
dmaengine: sh: setup_xref error handling
Miroslav Lichvar <[email protected]>
ptp: Limit time setting of PTP clocks
Bharat Uppal <[email protected]>
scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend
Qianfeng Rong <[email protected]>
scsi: pm8001: Use int instead of u32 to store error codes
Qianfeng Rong <[email protected]>
crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof()
Eric Dumazet <[email protected]>
tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()
Parthiban Veerasooran <[email protected]>
microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support
Eric Dumazet <[email protected]>
inet_diag: annotate data-races in inet_diag_bc_sk()
Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: danube: rename stp node on EASY50712 reference board
Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: xway: sysctrl: rename stp clock
Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: danube: add missing device_type in pci node
Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: danube: add model to EASY50712 dts
Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: danube: add missing properties to cpu node
Timur Kristóf <[email protected]>
drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2)
Mangesh Gadre <[email protected]>
drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest
Clay King <[email protected]>
drm/amd/display: incorrect conditions for failing dto calculations
Relja Vojvodic <[email protected]>
drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting
Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc4-pcm: Add fixup for channels
Martin Tůma <[email protected]>
media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS
Chelsy Ratnawat <[email protected]>
media: fix uninitialized symbol warnings
Jakub Kicinski <[email protected]>
selftests: drv-net: rss_ctx: fix the queue count check
Srinivas Pandruvada <[email protected]>
platform/x86/intel-uncore-freq: Fix warning in partitioned system
Amber Lin <[email protected]>
drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
Ivan Lipski <[email protected]>
drm/amd/display: Support HW cursor 180 rot for any number of pipe splits
Eric Huang <[email protected]>
drm/amdkfd: fix vram allocation failure for a special case
Ce Sun <[email protected]>
drm/amdgpu: Correct the counts of nr_banks and nr_errors
Miklos Szeredi <[email protected]>
fuse: zero initialize inode private data
Heiner Kallweit <[email protected]>
net: phy: fixed_phy: let fixed_phy_unregister free the phy_device
Andrew Davis <[email protected]>
remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper
Krzysztof Kozlowski <[email protected]>
extcon: adc-jack: Fix wakeup source leaks on device unbind
Francisco Gutierrez <[email protected]>
scsi: pm80xx: Fix race condition caused by static variables
Chandrakanth Patil <[email protected]>
scsi: mpi3mr: Fix controller init failure on fault during queue creation
Chandrakanth Patil <[email protected]>
scsi: mpi3mr: Fix I/O failures during controller reset
Oscar Maes <[email protected]>
net: ipv4: allow directed broadcast routes to use dst hint
Andrew Davis <[email protected]>
rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table
Sakari Ailus <[email protected]>
media: ipu6: isys: Set embedded data type correctly for metadata formats
Jiawen Wu <[email protected]>
net: wangxun: limit tx_max_coalesced_frames_irq
Ujwal Kundur <[email protected]>
rds: Fix endianness annotation for RDS_MPATH_HASH
Eric Dumazet <[email protected]>
idpf: do not linearize big TSO packets
Takashi Iwai <[email protected]>
ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
Xichao Zhao <[email protected]>
tty: serial: Modify the use of dev_err_probe()
Pavan Chebbi <[email protected]>
bnxt_en: Add Hyper-V VF ID
Sungho Kim <[email protected]>
PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
Chao Yu <[email protected]>
f2fs: fix to detect potential corrupted nid in free_nid_list
Kuniyuki Iwashima <[email protected]>
net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV.
Oleksij Rempel <[email protected]>
net: stmmac: Correctly handle Rx checksum offload errors
Christoph Paasch <[email protected]>
net: When removing nexthops, don't call synchronize_net if it is not necessary
Zijun Hu <[email protected]>
char: misc: Does not request module for miscdevice with dynamic minor
Zijun Hu <[email protected]>
char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor
Christoph Hellwig <[email protected]>
dm error: mark as DM_TARGET_PASSES_INTEGRITY
Kuan-Chung Chen <[email protected]>
wifi: rtw89: fix BSSID comparison for non-transmitted BSSID
Kuan-Chung Chen <[email protected]>
wifi: rtw89: wow: remove notify during WoWLAN net-detect
raub camaioni <[email protected]>
usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
Haibo Chen <[email protected]>
iio: adc: imx93_adc: load calibrated values even calibration failed
Rodrigo Gobbi <[email protected]>
iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register
Kent Russell <[email protected]>
drm/amdkfd: Handle lack of READ permissions in SVM mapping
Heng Zhou <[email protected]>
drm/amdgpu: fix nullptr err of vm_handle_moved
Dmitry Baryshkov <[email protected]>
drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts
Tomasz Pakuła <[email protected]>
HID: pidff: PERMISSIVE_CONTROL quirk autodetection
Tomasz Pakuła <[email protected]>
HID: pidff: Use direction fix only for conditional effects
Karunika Choo <[email protected]>
drm/panthor: Serialize GPU cache flush operations
Tetsuo Handa <[email protected]>
media: imon: make send_packet() more robust
Charalampos Mitrodimas <[email protected]>
net: ipv6: fix field-spanning memcpy warning in AH output
Alice Chao <[email protected]>
scsi: ufs: host: mediatek: Fix invalid access in vccqx handling
Peter Wang <[email protected]>
scsi: ufs: host: mediatek: Change reset sequence for improved stability
Alice Chao <[email protected]>
scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change
Peter Wang <[email protected]>
scsi: ufs: host: mediatek: Fix PWM mode switch issue
Peter Wang <[email protected]>
scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration
Ido Schimmel <[email protected]>
bridge: Redirect to backup port when port is administratively down
Niklas Schnelle <[email protected]>
s390/pci: Use pci_uevent_ers() in PCI recovery
Niklas Schnelle <[email protected]>
powerpc/eeh: Use result of error_detected() in uevent
Thomas Bogendoerfer <[email protected]>
tty: serial: ip22zilog: Use platform device for probing
Lukas Wunner <[email protected]>
thunderbolt: Use is_pciehp instead of is_hotplug_bridge
Thomas Weißschuh <[email protected]>
ice: Don't use %pK through printk or tracepoints
Tiezhu Yang <[email protected]>
net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
Kirill A. Shutemov <[email protected]>
x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
Lukas Wunner <[email protected]>
PCI/ERR: Update device error_state already after reset
Mehdi Djait <[email protected]>
media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR
Jayesh Choudhary <[email protected]>
drm/tidss: Set crtc modesetting parameters with adjusted mode
Tomi Valkeinen <[email protected]>
drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST
Tomi Valkeinen <[email protected]>
drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value
Tomi Valkeinen <[email protected]>
drm/tidss: Use the crtc_* timings when programming the HW
Laurent Pinchart <[email protected]>
media: amphion: Delete v4l2_fh synchronously in .release()
Laurent Pinchart <[email protected]>
media: pci: ivtv: Don't create fake v4l2_fh
Geoffrey McRae <[email protected]>
drm/amdkfd: return -ENOTTY for unsupported IOCTLs
Ping-Ke Shih <[email protected]>
wifi: rtw88: sdio: use indirect IO for device registers before power-on
Ping-Ke Shih <[email protected]>
wifi: rtw89: print just once for unknown C2H events
Wake Liu <[email protected]>
selftests/net: Ensure assert() triggers in psock_tpacket.c
Wake Liu <[email protected]>
selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
Marcos Del Sol Vives <[email protected]>
PCI: Disable MSI on RDC PCI to PCIe bridges
TungYu Lu <[email protected]>
drm/amd/display: Wait until OTG enable state is cleared
Danny Wang <[email protected]>
drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off
Terry Cheong <[email protected]>
ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks
Seyediman Seyedarab <[email protected]>
drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
Sathishkumar S <[email protected]>
drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
Lijo Lazar <[email protected]>
drm/amd/pm: Use cached metrics data on arcturus
Lijo Lazar <[email protected]>
drm/amd/pm: Use cached metrics data on aldebaran
Paul Hsieh <[email protected]>
drm/amd/display: update dpp/disp clock from smu clock table
Alex Deucher <[email protected]>
drm/amd/display: add more cyan skillfish devices
Xiang Liu <[email protected]>
drm/amdgpu: Skip poison aca bank from UE channel
Meng Li <[email protected]>
drm/amd/amdgpu: Release xcp drm memory after unplug
Ce Sun <[email protected]>
drm/amdgpu: Avoid rma causes GPU duplicate reset
Maarten Lankhorst <[email protected]>
drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.
John Harrison <[email protected]>
drm/xe/guc: Add more GuC load error status codes
Michael Strauss <[email protected]>
drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration
Michael Strauss <[email protected]>
drm/amd/display: Move setup_stream_attribute
Sathishkumar S <[email protected]>
drm/amdgpu: Check vcn sram load return value
Tao Zhou <[email protected]>
drm/amdgpu: add range check for RAS bad page address
Clay King <[email protected]>
drm/amd/display: ensure committing streams is seamless
Aurabindo Pillai <[email protected]>
drm/amd/display: fix condition for setting timing_adjust_pending
Ilpo Järvinen <[email protected]>
mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs
Bastien Curutchet <[email protected]>
mfd: core: Increment of_node's refcount before linking it to the platform device
Jens Kehne <[email protected]>
mfd: da9063: Split chip variant reading in two bus transactions
Arnd Bergmann <[email protected]>
mfd: madera: Work around false-positive -Wininitialized warning
Alexander Stein <[email protected]>
mfd: stmpe-i2c: Add missing MODULE_LICENSE
Alexander Stein <[email protected]>
mfd: stmpe: Remove IRQ domain upon removal
Len Brown <[email protected]>
tools/power x86_energy_perf_policy: Prefer driver HWP limits
Len Brown <[email protected]>
tools/power x86_energy_perf_policy: Enhance HWP enable
Kaushlendra Kumar <[email protected]>
tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
Mykyta Yatsenko <[email protected]>
selftests/bpf: Fix flaky bpf_cookie selftest
Kaushlendra Kumar <[email protected]>
tools/cpupower: Fix incorrect size in cpuidle_state_disable()
Armin Wolf <[email protected]>
hwmon: (dell-smm) Remove Dell Precision 490 custom config data
Ben Copeland <[email protected]>
hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex
Jiri Olsa <[email protected]>
uprobe: Do not emulate/sstep original instruction when ip is changed
Alistair Francis <[email protected]>
nvme: Use non zero KATO for persistent discovery connections
Amery Hung <[email protected]>
bpf: Clear pfmemalloc flag when freeing all fragments
Chenghao Duan <[email protected]>
riscv: bpf: Fix uninitialized symbol 'retval_off'
Yu Kuai <[email protected]>
blk-cgroup: fix possible deadlock while configuring policy
Markus Stockhausen <[email protected]>
clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts
Markus Stockhausen <[email protected]>
clocksource/drivers/timer-rtl-otto: Work around dying timers
Daniel Lezcano <[email protected]>
clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
Chen Pei <[email protected]>
ACPI: SPCR: Support Precise Baud Rate field
Biju Das <[email protected]>
spi: rpc-if: Add resume support for RZ/G3E
Yonghong Song <[email protected]>
selftests/bpf: Fix selftest verifier_arena_large failure
Pranav Tyagi <[email protected]>
futex: Don't leak robust_list pointer on exec race
Rafael J. Wysocki <[email protected]>
cpuidle: Fail cpuidle device registration if there is one already
Tom Stellard <[email protected]>
bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21
Fenglin Wu <[email protected]>
power: supply: qcom_battmgr: handle charging state change notifications
Janne Grunau <[email protected]>
pmdomain: apple: Add "apple,t8103-pmgr-pwrstate"
Kaushlendra Kumar <[email protected]>
tools/cpupower: fix error return value in cpupower_write_sysfs()
Svyatoslav Ryhel <[email protected]>
video: backlight: lp855x_bl: Set correct EPROM start for LP8556
Jarkko Nikula <[email protected]>
i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C
Kumar Kartikeya Dwivedi <[email protected]>
bpf: Do not limit bpf_cgroup_from_id to current's namespace
Daniel Wagner <[email protected]>
nvme-fc: use lock accessing port_state and rport state
Daniel Wagner <[email protected]>
nvmet-fc: avoid scheduling association deletion twice
Amirreza Zarrabi <[email protected]>
tee: allow a driver to allocate a tee_device without a pool
Hans de Goede <[email protected]>
ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method()
Uwe Kleine-König <[email protected]>
pwm: pca9685: Use bulk write to atomicially update registers
Sarthak Garg <[email protected]>
mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
Nikita Travkin <[email protected]>
firmware: qcom: tzmem: disable sc7180 platform
Svyatoslav Ryhel <[email protected]>
ARM: tegra: transformer-20: fix audio-codec interrupt
Svyatoslav Ryhel <[email protected]>
ARM: tegra: transformer-20: add missing magnetometer interrupt
Jonas Schwöbel <[email protected]>
ARM: tegra: p880: set correct touchscreen clipping
Svyatoslav Ryhel <[email protected]>
soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
Radhey Shyam Pandey <[email protected]>
arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106
Quanyang Wang <[email protected]>
arm64: zynqmp: Disable coresight by default
Sohil Mehta <[email protected]>
cpufreq: ondemand: Update the efficient idle check for Intel extended Families
Ming Wang <[email protected]>
irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller
Andreas Kemnade <[email protected]>
hwmon: sy7636a: add alias
Fabien Proriol <[email protected]>
power: supply: sbs-charger: Support multiple devices
Bartosz Golaszewski <[email protected]>
pinctrl: keembay: release allocated memory in detach path
Chuande Chen <[email protected]>
hwmon: (sbtsi_temp) AMD CPU extended temperature range support
David Ober <[email protected]>
hwmon: (lenovo-ec-sensors) Update P8 supprt
Rong Zhang <[email protected]>
hwmon: (k10temp) Add device ID for Strix Halo
Avadhut Naik <[email protected]>
hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models
Christopher Ruehl <[email protected]>
power: supply: qcom_battmgr: add OOI chemistry
Srinivas Pandruvada <[email protected]>
thermal: intel: selftests: workload_hint: Mask unsupported types
Rafael J. Wysocki <[email protected]>
thermal: gov_step_wise: Allow cooling level to be reduced earlier
Hans de Goede <[email protected]>
ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
Sam van Kampen <[email protected]>
ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU
Shang song (Lenovo) <[email protected]>
ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
Christian Bruel <[email protected]>
irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
Ricardo B. Marlière <[email protected]>
selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh
Yuan Chen <[email protected]>
bpftool: Add CET-aware symbol matching for x86_64 architectures
Kees Cook <[email protected]>
arc: Fix __fls() const-foldability via __builtin_clzl()
Dennis Beier <[email protected]>
cpufreq/longhaul: handle NULL policy in longhaul_exit
Ricardo B. Marlière <[email protected]>
selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
Jiawei Zhao <[email protected]>
libbpf: Fix USDT SIB argument handling causing unrecognized register error
Mario Limonciello (AMD) <[email protected]>
ACPI: video: force native for Lenovo 82K8
Kaushlendra Kumar <[email protected]>
ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object
Pavel Begunkov <[email protected]>
io_uring/zctx: check chained notif contexts
Inochi Amaoto <[email protected]>
irqchip/sifive-plic: Respect mask state when setting affinity
Takashi Sakamoto <[email protected]>
firewire: ohci: move self_id_complete tracepoint after validating register
Paul Chaignon <[email protected]>
bpf: Use tnums for JEQ/JNE is_branch_taken logic
Paresh Bhagat <[email protected]>
cpufreq: ti: Add support for AM62D2
Jiayi Li <[email protected]>
memstick: Add timeout to prevent indefinite waiting
Biju Das <[email protected]>
mmc: host: renesas_sdhi: Fix the actual clock
Chi Zhang <[email protected]>
pinctrl: single: fix bias pull up/down handling in pin_config_set
Thomas Weißschuh <[email protected]>
bpf: Don't use %pK through printk
Thomas Weißschuh <[email protected]>
soc: ti: pruss: don't use %pK through printk
Thomas Weißschuh <[email protected]>
spi: loopback-test: Don't use %pK through printk
Jens Reidel <[email protected]>
soc: qcom: smem: Fix endian-unaware access of num_entries
Mukesh Ojha <[email protected]>
firmware: qcom: scm: preserve assign_mem() error return value
Ryan Chen <[email protected]>
soc: aspeed: socinfo: Add AST27xx silicon IDs
Heiko Carstens <[email protected]>
s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP
Gerd Bayer <[email protected]>
s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump
Philipp Stanner <[email protected]>
drm/sched: Fix race in drm_sched_entity_select_rq()
Tvrtko Ursulin <[email protected]>
drm/sched: Re-group and rename the entity run-queue lock
Tvrtko Ursulin <[email protected]>
drm/sched: Optimise drm_sched_entity_push_job
Owen Gu <[email protected]>
usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
Gregory Price <[email protected]>
x86/CPU/AMD: Add RDSEED fix for Zen5
Heijligen, Thomas <[email protected]>
mfd: kempld: Switch back to earlier ->init() behavior
Rafael J. Wysocki <[email protected]>
cpuidle: governors: menu: Select polling state in some more cases
Rafael J. Wysocki <[email protected]>
cpuidle: governors: menu: Rearrange main loop in menu_select()
Tejun Heo <[email protected]>
sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU
Emanuele Ghidoli <[email protected]>
net: phy: dp83867: Disable EEE support as not implemented
Heiner Kallweit <[email protected]>
net: phy: add phy_disable_eee
Armin Wolf <[email protected]>
ACPI: fan: Use platform device for devres-related actions
Joshua Grisham <[email protected]>
ACPI: fan: Add fan speed reporting for fans with only _FST
Ivan Lipski <[email protected]>
drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc
Mario Limonciello <[email protected]>
drm/amd: Check that VPE has reached DPM0 in idle handler
Thomas Zimmermann <[email protected]>
drm/ast: Clear preserved bits from register output value
Johan Hovold <[email protected]>
drm/mediatek: Fix device use-after-free on unbind
Philipp Stanner <[email protected]>
drm/nouveau: Fix race in nouveau_sched_fini()
David Rosca <[email protected]>
drm/sched: avoid killing parent entity on child SIGKILL
Thomas Zimmermann <[email protected]>
drm/sysfb: Do not dereference NULL pointer in plane reset
Matthew Brost <[email protected]>
drm/xe: Do not wake device during a GT reset
Miaoqian Lin <[email protected]>
s390/mm: Fix memory leak in add_marker() when kvrealloc() fails
Alexey Klimov <[email protected]>
regmap: slimbus: fix bus_context pointer in regmap init calls
Dapeng Mi <[email protected]>
perf/x86/intel: Fix KASAN global-out-of-bounds warning
Damien Le Moal <[email protected]>
block: make REQ_OP_ZONE_OPEN a write operation
Damien Le Moal <[email protected]>
block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL
Armin Wolf <[email protected]>
ACPI: fan: Use ACPI handle when retrieving _FST
John Smith <[email protected]>
drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland
John Smith <[email protected]>
drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji
Yang Wang <[email protected]>
drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table()
Daniel Palmer <[email protected]>
drm/radeon: Remove calls to drm_put_dev()
Daniel Palmer <[email protected]>
drm/radeon: Do not kfree() devres managed rdev
Maarten Zanders <[email protected]>
ASoC: fsl_sai: Fix sync error in consumer mode
Petr Oros <[email protected]>
dpll: spec: add missing module-name and clock-id to pin-get reply
Abdun Nihaal <[email protected]>
sfc: fix potential memory leak in efx_mae_process_mport()
Jijie Shao <[email protected]>
net: hns3: return error code when function fails
Petr Oros <[email protected]>
tools: ynl: fix string attribute length to include null terminator
Tomeu Vizoso <[email protected]>
drm/etnaviv: fix flush sequence logic
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_core: Fix tracking of periodic advertisement
Luiz Augusto von Dentz <[email protected]>
Bluetooth: ISO: Fix another instance of dst_type handling
Luiz Augusto von Dentz <[email protected]>
Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00
Chris Lu <[email protected]>
Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset
Luiz Augusto von Dentz <[email protected]>
Bluetooth: ISO: Fix BIS connection dst_type handling
Iulia Tanasescu <[email protected]>
Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave
Cen Zhang <[email protected]>
Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
Lizhi Xu <[email protected]>
usbnet: Prevents free active kevent
Andrii Nakryiko <[email protected]>
libbpf: Fix powerpc's stack register definition in bpf_tracing.h
Shengjiu Wang <[email protected]>
ASoC: fsl_sai: fix bit order for DSD format
Cezary Rojewski <[email protected]>
ASoC: Intel: avs: Disable periods-elapsed work when closing PCM
Cezary Rojewski <[email protected]>
ASoC: Intel: avs: Unprepare a stream when XRUN occurs
Haotian Zhang <[email protected]>
crypto: aspeed - fix double free caused by devm
Ondrej Mosnacek <[email protected]>
bpf: Do not audit capability check in do_jit()
Yonghong Song <[email protected]>
bpf, x86: Avoid repeated usage of bpf_prog->aux->stack_depth
Yonghong Song <[email protected]>
bpf: Find eligible subprogs for private stack support
Wonkon Kim <[email protected]>
scsi: ufs: core: Initialize value of an attribute returned by uic cmd
Noorain Eqbal <[email protected]>
bpf: Sync pending IRQ work before freeing ring buffer
Florian Schmaus <[email protected]>
kunit: test_dev_action: Correctly cast 'priv' pointer to long*
Johannes Berg <[email protected]>
wifi: mac80211: fix key tailroom accounting leak
Miri Korenblit <[email protected]>
wifi: mac80211: don't mark keys for inactive links as uploaded
Richard Fitzgerald <[email protected]>
ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h
Roy Vegard Ovesen <[email protected]>
ALSA: usb-audio: fix control pipe direction
Akhil P Oommen <[email protected]>
drm/msm/a6xx: Fix GMU firmware parser
Rameshkumar Sundaram <[email protected]>
wifi: ath11k: avoid bit operation on key flags
Yu Zhang(Yuriy) <[email protected]>
wifi: ath11k: add support for MU EDCA
Karthik M <[email protected]>
wifi: ath12k: free skb during idr cleanup callback
Mark Pearson <[email protected]>
wifi: ath11k: Add missing platform IDs for quirk table
Loic Poulain <[email protected]>
wifi: ath10k: Fix memory leak on unsupported WMI command
Chang S. Bae <[email protected]>
x86/fpu: Ensure XFD state on signal delivery
Henrique Carvalho <[email protected]>
smb: client: fix potential cfid UAF in smb2_query_info_compound
Farhan Ali <[email protected]>
s390/pci: Restore IRQ unconditionally for the zPCI device
Srinivas Kandagatla <[email protected]>
ASoC: qdsp6: q6asm: do not sleep while atomic
Paolo Abeni <[email protected]>
mptcp: restore window probe
Paolo Abeni <[email protected]>
mptcp: drop bogus optimization in __mptcp_check_push()
Miaoqian Lin <[email protected]>
fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
Florian Fuchs <[email protected]>
fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
Gokul Sivakumar <[email protected]>
wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
Johan Hovold <[email protected]>
Bluetooth: rfcomm: fix modem control handling
Junjie Cao <[email protected]>
fbdev: bitblit: bound-check glyph index in bit_putcs*
Bui Quang Minh <[email protected]>
virtio-net: drop the multi-buffer XDP packet in zerocopy
Kaushlendra Kumar <[email protected]>
ACPI: button: Call input_free_device() on failing input device registration
Yuhao Jiang <[email protected]>
ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
Daniel Palmer <[email protected]>
fbdev: atyfb: Check if pll_ops->init_pll failed
Quanmin Yan <[email protected]>
fbcon: Set fb_display[i]->mode to NULL when the mode is released
Miaoqian Lin <[email protected]>
net: usb: asix_devices: Check return value of usbnet_get_endpoints
Chuck Lever <[email protected]>
NFSD: Fix crash in nfsd4_read_release()
-------------
Diffstat:
Documentation/netlink/specs/dpll.yaml | 2 + Makefile | 4 +- arch/arc/include/asm/bitops.h | 2 + arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts | 5 +- arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts | 4 +- arch/arm/mach-at91/pm_suspend.S | 8 +- arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts | 4 +- arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 4 + arch/loongarch/include/asm/inst.h | 5 + arch/loongarch/kernel/inst.c | 12 + arch/mips/boot/dts/lantiq/danube.dtsi | 6 + arch/mips/boot/dts/lantiq/danube_easy50712.dts | 4 +- arch/mips/lantiq/xway/sysctrl.c | 2 +- arch/mips/sgi-ip22/ip22-platform.c | 32 ++ arch/openrisc/kernel/module.c | 4 + arch/parisc/include/asm/video.h | 2 +- arch/parisc/kernel/unwind.c | 13 +- arch/powerpc/kernel/eeh_driver.c | 2 +- arch/riscv/kernel/stacktrace.c | 21 +- arch/riscv/mm/ptdump.c | 2 +- arch/riscv/net/bpf_jit_comp64.c | 5 +- arch/s390/Kconfig | 1 - arch/s390/include/asm/pci.h | 1 - arch/s390/mm/dump_pagetables.c | 19 +- arch/s390/pci/pci_event.c | 7 +- arch/s390/pci/pci_irq.c | 9 +- arch/sparc/include/asm/elf_64.h | 1 + arch/sparc/include/asm/io_64.h | 6 +- arch/sparc/include/asm/video.h | 2 + arch/sparc/kernel/module.c | 1 + arch/um/drivers/ssl.c | 5 +- arch/x86/entry/vsyscall/vsyscall_64.c | 17 +- arch/x86/events/intel/ds.c | 3 +- arch/x86/include/asm/runtime-const.h | 17 + arch/x86/include/asm/uaccess_64.h | 22 +- arch/x86/include/asm/video.h | 2 + arch/x86/kernel/cpu/amd.c | 35 ++ arch/x86/kernel/cpu/common.c | 6 +- arch/x86/kernel/cpu/microcode/amd.c | 2 + arch/x86/kernel/fpu/core.c | 3 + arch/x86/kernel/kvm.c | 20 +- arch/x86/lib/getuser.S | 12 +- arch/x86/net/bpf_jit_comp.c | 13 +- block/blk-cgroup.c | 23 +- drivers/accel/habanalabs/common/memory.c | 2 +- drivers/accel/habanalabs/gaudi/gaudi.c | 19 + drivers/accel/habanalabs/gaudi2/gaudi2.c | 15 +- drivers/accel/habanalabs/gaudi2/gaudi2_coresight.c | 2 +- drivers/acpi/acpi_video.c | 4 +- drivers/acpi/acpica/dsmethod.c | 10 +- drivers/acpi/button.c | 4 +- drivers/acpi/device_sysfs.c | 2 +- drivers/acpi/fan.h | 8 +- drivers/acpi/fan_attr.c | 39 +- drivers/acpi/fan_core.c | 61 ++- drivers/acpi/fan_hwmon.c | 19 +- drivers/acpi/prmt.c | 19 +- drivers/acpi/property.c | 24 +- drivers/acpi/resource.c | 7 + drivers/acpi/scan.c | 4 + drivers/acpi/spcr.c | 10 +- drivers/acpi/video_detect.c | 8 + drivers/base/regmap/regmap-slimbus.c | 6 +- drivers/bluetooth/btmtksdio.c | 12 + drivers/bluetooth/btrtl.c | 4 +- drivers/bluetooth/btusb.c | 19 + drivers/bluetooth/hci_bcsp.c | 3 + drivers/bus/mhi/host/internal.h | 2 + drivers/bus/mhi/host/pm.c | 2 +- drivers/char/misc.c | 40 +- drivers/clk/at91/clk-master.c | 3 + drivers/clk/at91/clk-sam9x60-pll.c | 75 ++-- drivers/clk/at91/sam9x7.c | 1 + drivers/clk/clk-scmi.c | 11 +- drivers/clk/qcom/gcc-ipq6018.c | 60 +-- drivers/clk/sunxi-ng/ccu-sun6i-rtc.c | 11 + drivers/clk/ti/clk-33xx.c | 2 + drivers/clk/xilinx/clk-xlnx-clock-wizard.c | 2 +- drivers/clocksource/timer-rtl-otto.c | 26 +- drivers/clocksource/timer-vf-pit.c | 22 +- drivers/cpufreq/cpufreq_ondemand.c | 25 +- drivers/cpufreq/cpufreq_ondemand.h | 23 ++ drivers/cpufreq/longhaul.c | 3 + drivers/cpufreq/tegra186-cpufreq.c | 27 +- drivers/cpufreq/ti-cpufreq.c | 2 + drivers/cpuidle/cpuidle.c | 8 +- drivers/cpuidle/governors/menu.c | 79 ++-- .../crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c | 1 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 5 +- drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c | 2 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c | 1 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce-trng.c | 1 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h | 2 +- drivers/crypto/aspeed/aspeed-acry.c | 2 - drivers/crypto/caam/ctrl.c | 4 +- drivers/crypto/ccp/hsti.c | 2 +- drivers/crypto/ccp/sev-dev.c | 10 + drivers/crypto/hisilicon/qm.c | 78 ++-- drivers/crypto/intel/qat/qat_common/qat_uclo.c | 2 +- drivers/dma/dw-edma/dw-edma-core.c | 22 ++ drivers/dma/mv_xor.c | 4 +- drivers/dma/sh/shdma-base.c | 25 +- drivers/dma/sh/shdmac.c | 17 +- drivers/extcon/extcon-adc-jack.c | 2 + drivers/firewire/ohci.c | 12 +- drivers/firmware/qcom/qcom_scm.c | 2 +- drivers/firmware/qcom/qcom_tzmem.c | 1 + drivers/gpio/gpiolib-swnode.c | 2 +- drivers/gpio/gpiolib.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 53 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 15 +- drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 66 +++- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 21 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 + drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 5 + drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 77 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_vpe.c | 34 +- drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.c | 1 + drivers/gpu/drm/amd/amdgpu/atom.c | 4 + drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c | 10 +- drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c | 10 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 10 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 10 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c | 11 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c | 10 +- drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c | 10 +- drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c | 13 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 19 +- drivers/gpu/drm/amd/amdkfd/kfd_device.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 9 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 25 ++ drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.c | 56 ++- drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.h | 1 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 100 ++++- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 3 + .../drm/amd/display/amdgpu_dm/amdgpu_dm_color.c | 86 ++-- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 10 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 3 +- .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 13 +- .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.h | 2 +- .../drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c | 16 + .../amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c | 142 ++++++- .../amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h | 5 + drivers/gpu/drm/amd/display/dc/core/dc.c | 25 +- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 14 +- drivers/gpu/drm/amd/display/dc/dc_helper.c | 5 + drivers/gpu/drm/amd/display/dc/dc_stream.h | 3 + .../drm/amd/display/dc/dccg/dcn401/dcn401_dccg.c | 2 +- drivers/gpu/drm/amd/display/dc/dm_services.h | 2 + .../gpu/drm/amd/display/dc/dml/dcn301/dcn301_fpu.c | 20 +- .../drm/amd/display/dc/dml2/display_mode_core.c | 2 +- .../drm/amd/display/dc/dml2/dml21/dml21_wrapper.c | 4 + .../dml21/src/dml2_core/dml2_core_dcn4_calcs.c | 28 +- .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 1 + .../drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c | 73 ++-- .../drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 5 +- .../drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 2 + .../gpu/drm/amd/display/dc/link/link_detection.c | 5 + drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 3 - .../display/dc/link/protocols/link_dp_training.c | 9 +- .../drm/amd/display/dc/optc/dcn401/dcn401_optc.c | 5 + .../display/dc/resource/dcn314/dcn314_resource.c | 1 + .../display/dc/virtual/virtual_stream_encoder.c | 7 + drivers/gpu/drm/amd/display/include/dal_asic_id.h | 5 + .../gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c | 2 +- .../drm/amd/pm/powerplay/smumgr/iceland_smumgr.c | 2 +- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 6 + drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 2 +- drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c | 3 + drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 2 +- drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 2 +- drivers/gpu/drm/ast/ast_drv.h | 8 +- drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 12 +- drivers/gpu/drm/bridge/display-connector.c | 3 +- drivers/gpu/drm/drm_gem_atomic_helper.c | 8 +- drivers/gpu/drm/drm_panel_backlight_quirks.c | 2 +- drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 2 +- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 10 - drivers/gpu/drm/mediatek/mtk_plane.c | 24 +- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 5 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 3 + drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 10 + drivers/gpu/drm/msm/registers/gen_header.py | 7 + drivers/gpu/drm/nouveau/nouveau_sched.c | 14 +- drivers/gpu/drm/nouveau/nvkm/core/enum.c | 2 +- drivers/gpu/drm/panthor/panthor_gpu.c | 7 + drivers/gpu/drm/panthor/panthor_mmu.c | 4 +- drivers/gpu/drm/radeon/radeon_drv.c | 25 +- drivers/gpu/drm/radeon/radeon_kms.c | 1 - drivers/gpu/drm/scheduler/sched_entity.c | 73 ++-- drivers/gpu/drm/scheduler/sched_main.c | 6 +- drivers/gpu/drm/tidss/tidss_crtc.c | 7 +- drivers/gpu/drm/tidss/tidss_dispc.c | 16 +- drivers/gpu/drm/xe/abi/guc_errors_abi.h | 3 + drivers/gpu/drm/xe/xe_bo.c | 28 +- drivers/gpu/drm/xe/xe_gt.c | 19 +- drivers/gpu/drm/xe/xe_guc.c | 32 +- drivers/gpu/drm/xe/xe_guc_ct.c | 10 + drivers/gpu/drm/xe/xe_guc_log.h | 2 +- drivers/hid/hid-asus.c | 6 +- drivers/hid/hid-ids.h | 2 +- drivers/hid/hid-universal-pidff.c | 20 +- drivers/hid/i2c-hid/i2c-hid-acpi.c | 8 + drivers/hid/i2c-hid/i2c-hid-core.c | 28 +- drivers/hid/i2c-hid/i2c-hid.h | 2 + drivers/hid/usbhid/hid-pidff.c | 42 +- drivers/hid/usbhid/hid-pidff.h | 2 +- drivers/hwmon/asus-ec-sensors.c | 2 +- drivers/hwmon/dell-smm-hwmon.c | 14 - drivers/hwmon/k10temp.c | 10 + drivers/hwmon/lenovo-ec-sensors.c | 34 +- drivers/hwmon/sbtsi_temp.c | 46 ++- drivers/hwmon/sy7636a-hwmon.c | 1 + drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c | 3 + drivers/iio/adc/imx93_adc.c | 18 +- drivers/iio/adc/spear_adc.c | 9 +- drivers/infiniband/hw/hns/hns_roce_cq.c | 58 ++- drivers/infiniband/hw/hns/hns_roce_device.h | 4 + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 11 +- drivers/infiniband/hw/hns/hns_roce_main.c | 4 + drivers/infiniband/hw/hns/hns_roce_qp.c | 2 - drivers/infiniband/hw/irdma/Kconfig | 7 +- drivers/infiniband/hw/irdma/pble.c | 2 +- drivers/infiniband/hw/irdma/verbs.c | 4 +- drivers/infiniband/hw/irdma/verbs.h | 8 +- drivers/infiniband/ulp/ipoib/ipoib_main.c | 21 +- drivers/iommu/amd/init.c | 28 +- drivers/iommu/apple-dart.c | 5 + drivers/iommu/intel/debugfs.c | 10 +- drivers/iommu/intel/perf.c | 10 +- drivers/iommu/intel/perf.h | 5 +- drivers/iommu/iommufd/iova_bitmap.c | 5 +- drivers/irqchip/irq-gic-v2m.c | 13 +- drivers/irqchip/irq-loongson-pch-lpc.c | 9 +- drivers/irqchip/irq-sifive-plic.c | 6 +- drivers/md/dm-target.c | 3 +- drivers/media/common/videobuf2/videobuf2-v4l2.c | 5 + drivers/media/i2c/Kconfig | 2 +- drivers/media/i2c/adv7180.c | 48 +-- drivers/media/i2c/ir-kbd-i2c.c | 6 +- drivers/media/i2c/og01a1b.c | 6 +- drivers/media/i2c/ov08x40.c | 2 +- drivers/media/pci/intel/ipu6/ipu6-isys-subdev.c | 6 + drivers/media/pci/ivtv/ivtv-alsa-pcm.c | 2 - drivers/media/pci/ivtv/ivtv-driver.h | 3 +- drivers/media/pci/ivtv/ivtv-fileops.c | 18 +- drivers/media/pci/ivtv/ivtv-irq.c | 4 +- drivers/media/pci/mgb4/mgb4_vin.c | 3 +- drivers/media/platform/amphion/vpu_v4l2.c | 7 +- drivers/media/platform/verisilicon/hantro_drv.c | 2 + drivers/media/platform/verisilicon/hantro_v4l2.c | 6 +- drivers/media/rc/imon.c | 61 +-- drivers/media/rc/redrat3.c | 2 +- drivers/media/tuners/xc4000.c | 8 +- drivers/media/tuners/xc5000.c | 12 +- drivers/media/usb/uvc/uvc_driver.c | 15 +- drivers/memstick/core/memstick.c | 8 +- drivers/mfd/da9063-i2c.c | 27 +- drivers/mfd/intel-lpss-pci.c | 13 + drivers/mfd/kempld-core.c | 32 +- drivers/mfd/madera-core.c | 4 +- drivers/mfd/mfd-core.c | 1 + drivers/mfd/stmpe-i2c.c | 1 + drivers/mfd/stmpe.c | 3 + drivers/mmc/host/renesas_sdhi_core.c | 6 +- drivers/mmc/host/sdhci-msm.c | 15 + drivers/net/dsa/b53/b53_common.c | 27 +- drivers/net/dsa/b53/b53_regs.h | 3 +- drivers/net/dsa/dsa_loop.c | 9 +- drivers/net/dsa/microchip/ksz9477.c | 98 ++++- drivers/net/dsa/microchip/ksz9477_reg.h | 3 +- drivers/net/dsa/microchip/ksz_common.c | 49 +++ drivers/net/dsa/microchip/ksz_common.h | 2 + drivers/net/dsa/ocelot/felix.c | 4 + drivers/net/dsa/ocelot/felix.h | 3 +- drivers/net/dsa/ocelot/felix_vsc9959.c | 3 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 75 ++-- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 4 +- drivers/net/ethernet/cadence/macb_main.c | 4 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 3 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c | 9 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h | 2 +- drivers/net/ethernet/intel/fm10k/fm10k_common.c | 5 +- drivers/net/ethernet/intel/fm10k/fm10k_common.h | 2 +- drivers/net/ethernet/intel/fm10k/fm10k_pf.c | 2 +- drivers/net/ethernet/intel/fm10k/fm10k_vf.c | 2 +- drivers/net/ethernet/intel/ice/ice_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_trace.h | 10 +- drivers/net/ethernet/intel/idpf/idpf.h | 2 + drivers/net/ethernet/intel/idpf/idpf_lib.c | 102 ++++- drivers/net/ethernet/intel/idpf/idpf_txrx.c | 129 ++---- .../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 5 +- drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 12 +- drivers/net/ethernet/microchip/lan865x/lan865x.c | 1 + .../ethernet/microchip/lan966x/lan966x_ethtool.c | 18 +- .../net/ethernet/microchip/lan966x/lan966x_main.c | 2 - .../net/ethernet/microchip/lan966x/lan966x_main.h | 4 +- .../ethernet/microchip/lan966x/lan966x_vcap_impl.c | 8 +- drivers/net/ethernet/microchip/sparx5/Kconfig | 2 +- drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 34 +- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 1 - drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c | 2 - drivers/net/ethernet/realtek/Kconfig | 2 +- drivers/net/ethernet/realtek/r8169_main.c | 6 +- drivers/net/ethernet/renesas/sh_eth.c | 4 + drivers/net/ethernet/sfc/mae.c | 4 + drivers/net/ethernet/smsc/smsc911x.c | 14 +- drivers/net/ethernet/stmicro/stmmac/common.h | 1 + drivers/net/ethernet/stmicro/stmmac/stmmac_est.c | 9 +- drivers/net/ethernet/stmicro/stmmac/stmmac_est.h | 1 + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 12 +- drivers/net/ethernet/ti/icssg/icssg_config.c | 7 + drivers/net/ethernet/wangxun/libwx/wx_ethtool.c | 7 +- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 3 +- drivers/net/ethernet/wangxun/libwx/wx_type.h | 4 +- drivers/net/hamradio/6pack.c | 57 +-- drivers/net/mdio/of_mdio.c | 1 - drivers/net/phy/dp83867.c | 6 + drivers/net/phy/fixed_phy.c | 1 + drivers/net/phy/marvell.c | 39 +- drivers/net/phy/phy.c | 13 + drivers/net/phy/phy_device.c | 17 + drivers/net/usb/asix_devices.c | 12 +- drivers/net/usb/qmi_wwan.c | 6 + drivers/net/usb/usbnet.c | 2 + drivers/net/virtio_net.c | 36 +- drivers/net/wan/framer/pef2256/pef2256.c | 7 +- drivers/net/wireless/ath/ath10k/mac.c | 12 +- drivers/net/wireless/ath/ath10k/wmi.c | 40 +- drivers/net/wireless/ath/ath11k/core.c | 54 ++- drivers/net/wireless/ath/ath11k/core.h | 3 +- drivers/net/wireless/ath/ath11k/mac.c | 61 ++- drivers/net/wireless/ath/ath11k/wmi.c | 11 +- drivers/net/wireless/ath/ath11k/wmi.h | 10 +- drivers/net/wireless/ath/ath12k/dp.h | 2 +- drivers/net/wireless/ath/ath12k/mac.c | 34 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 3 +- .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 28 +- .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.h | 3 +- drivers/net/wireless/intel/iwlwifi/fw/regulatory.c | 14 +- drivers/net/wireless/mediatek/mt76/eeprom.c | 9 +- drivers/net/wireless/mediatek/mt76/mt76.h | 2 +- drivers/net/wireless/mediatek/mt76/mt7603/eeprom.c | 3 +- drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7615/init.c | 5 +- drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c | 6 +- drivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7915/init.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7921/init.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 2 + drivers/net/wireless/mediatek/mt76/mt7925/init.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c | 3 +- drivers/net/wireless/mediatek/mt76/mt7996/init.c | 5 +- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 4 +- drivers/net/wireless/realtek/rtw88/sdio.c | 4 + drivers/net/wireless/realtek/rtw89/core.c | 61 ++- drivers/net/wireless/realtek/rtw89/core.h | 12 +- drivers/net/wireless/realtek/rtw89/debug.h | 1 + drivers/net/wireless/realtek/rtw89/fw.c | 4 +- drivers/net/wireless/realtek/rtw89/mac.c | 7 +- drivers/net/wireless/realtek/rtw89/phy.c | 7 +- drivers/net/wireless/realtek/rtw89/txrx.h | 1 + drivers/net/wireless/virtual/mac80211_hwsim.c | 7 +- drivers/net/wwan/t7xx/t7xx_pci.c | 1 + drivers/ntb/hw/epf/ntb_hw_epf.c | 103 ++--- drivers/nvme/host/core.c | 8 +- drivers/nvme/host/fc.c | 10 +- drivers/nvme/target/fc.c | 16 +- drivers/pci/controller/cadence/pcie-cadence-host.c | 2 +- drivers/pci/controller/cadence/pcie-cadence.c | 4 +- drivers/pci/controller/cadence/pcie-cadence.h | 6 +- drivers/pci/controller/dwc/pci-imx6.c | 4 + drivers/pci/controller/dwc/pcie-designware.c | 4 +- drivers/pci/endpoint/functions/pci-epf-test.c | 7 +- drivers/pci/p2pdma.c | 2 +- drivers/pci/pci-driver.c | 2 +- drivers/pci/pci.c | 5 + drivers/pci/pcie/err.c | 3 +- drivers/pci/quirks.c | 3 +- drivers/phy/cadence/cdns-dphy.c | 4 +- drivers/phy/renesas/r8a779f0-ether-serdes.c | 28 ++ drivers/phy/rockchip/phy-rockchip-inno-csidphy.c | 5 +- drivers/pinctrl/pinctrl-keembay.c | 7 +- drivers/pinctrl/pinctrl-single.c | 4 +- .../intel/uncore-frequency/uncore-frequency-tpmi.c | 2 +- drivers/pmdomain/apple/pmgr-pwrstate.c | 1 + drivers/power/supply/qcom_battmgr.c | 8 +- drivers/power/supply/sbs-charger.c | 16 +- drivers/ptp/ptp_clock.c | 13 +- drivers/pwm/pwm-pca9685.c | 46 ++- drivers/remoteproc/qcom_q6v5.c | 5 + drivers/remoteproc/wkup_m3_rproc.c | 6 +- drivers/rpmsg/rpmsg_char.c | 3 +- drivers/rtc/rtc-pcf2127.c | 19 +- drivers/rtc/rtc-rx8025.c | 2 +- drivers/scsi/libfc/fc_encode.h | 2 +- drivers/scsi/lpfc/lpfc_debugfs.h | 3 + drivers/scsi/lpfc/lpfc_els.c | 21 +- drivers/scsi/lpfc/lpfc_init.c | 7 - drivers/scsi/lpfc/lpfc_nportdisc.c | 23 +- drivers/scsi/lpfc/lpfc_scsi.c | 14 +- drivers/scsi/lpfc/lpfc_sli.c | 3 +- drivers/scsi/mpi3mr/mpi3mr_fw.c | 13 + drivers/scsi/mpi3mr/mpi3mr_os.c | 2 + drivers/scsi/mpt3sas/mpt3sas_transport.c | 3 + drivers/scsi/pm8001/pm8001_ctl.c | 24 +- drivers/scsi/pm8001/pm8001_init.c | 1 + drivers/scsi/pm8001/pm8001_sas.h | 4 + drivers/scsi/qla2xxx/qla_os.c | 5 - drivers/soc/aspeed/aspeed-socinfo.c | 4 + drivers/soc/qcom/smem.c | 2 +- drivers/soc/tegra/fuse/fuse-tegra30.c | 122 ++++++ drivers/soc/ti/pruss.c | 2 +- drivers/spi/spi-loopback-test.c | 12 +- drivers/spi/spi-rpc-if.c | 2 + drivers/tee/tee_core.c | 2 +- drivers/thermal/gov_step_wise.c | 15 +- drivers/thunderbolt/tb.c | 2 +- drivers/tty/serial/ip22zilog.c | 360 +++++++---------- drivers/tty/serial/max3100.c | 2 +- drivers/tty/serial/max310x.c | 3 +- drivers/tty/vt/vt_ioctl.c | 4 +- drivers/ufs/core/ufshcd.c | 16 +- drivers/ufs/host/ufs-exynos.c | 8 + drivers/ufs/host/ufs-mediatek.c | 222 ++++++++--- drivers/ufs/host/ufshcd-pci.c | 70 +++- drivers/usb/cdns3/cdnsp-gadget.c | 8 +- drivers/usb/gadget/function/f_fs.c | 8 +- drivers/usb/gadget/function/f_hid.c | 4 +- drivers/usb/gadget/function/f_ncm.c | 3 +- drivers/usb/host/xhci-pci.c | 45 ++- drivers/usb/host/xhci-plat.c | 1 + drivers/usb/mon/mon_bin.c | 14 +- drivers/vfio/pci/vfio_pci_intrs.c | 7 + drivers/vfio/vfio_main.c | 2 +- drivers/video/backlight/lp855x_bl.c | 2 +- drivers/video/fbdev/aty/atyfb_base.c | 8 +- drivers/video/fbdev/core/bitblit.c | 33 +- drivers/video/fbdev/core/fbcon.c | 19 + drivers/video/fbdev/core/fbmem.c | 1 + drivers/video/fbdev/pvr2fb.c | 2 +- drivers/video/fbdev/valkyriefb.c | 2 + drivers/watchdog/s3c2410_wdt.c | 10 +- fs/9p/v9fs.c | 9 +- fs/btrfs/extent_io.c | 8 + fs/btrfs/file.c | 10 + fs/btrfs/qgroup.c | 4 +- fs/ceph/dir.c | 3 +- fs/ceph/file.c | 6 +- fs/ceph/ioctl.c | 17 +- fs/ceph/locks.c | 5 +- fs/ceph/mds_client.c | 8 + fs/ceph/mdsmap.c | 14 +- fs/ceph/super.c | 14 - fs/ceph/super.h | 14 + fs/exfat/balloc.c | 72 +++- fs/exfat/fatent.c | 11 +- fs/ext4/fast_commit.c | 2 +- fs/ext4/xattr.c | 2 +- fs/f2fs/extent_cache.c | 6 + fs/f2fs/node.c | 17 +- fs/f2fs/sysfs.c | 9 +- fs/fuse/inode.c | 11 +- fs/hpfs/namei.c | 18 +- fs/jfs/inode.c | 8 +- fs/jfs/jfs_txnmgr.c | 9 +- fs/nfs/nfs4proc.c | 6 +- fs/nfs/nfs4state.c | 3 + fs/nfsd/nfs4proc.c | 7 +- fs/ntfs3/inode.c | 1 + fs/open.c | 10 +- fs/orangefs/xattr.c | 12 +- fs/smb/client/cached_dir.c | 16 +- fs/smb/client/smb2ops.c | 3 +- fs/smb/client/smb2pdu.c | 7 +- fs/smb/client/transport.c | 10 +- fs/smb/server/transport_tcp.c | 7 +- include/drm/gpu_scheduler.h | 23 +- include/linux/blk_types.h | 11 +- include/linux/bpf_verifier.h | 7 + include/linux/cgroup.h | 1 + include/linux/f2fs_fs.h | 1 + include/linux/fbcon.h | 2 + include/linux/filter.h | 3 +- include/linux/pci.h | 2 +- include/linux/phy.h | 1 + include/linux/shdma-base.h | 2 +- include/linux/tnum.h | 3 + include/net/bluetooth/hci.h | 1 + include/net/bluetooth/hci_core.h | 13 +- include/net/bluetooth/mgmt.h | 2 +- include/net/cls_cgroup.h | 2 +- include/net/nfc/nci_core.h | 2 +- include/net/xdp.h | 5 + include/ufs/ufs_quirks.h | 3 + include/ufs/ufshcd.h | 8 + include/ufs/ufshci.h | 4 +- io_uring/notif.c | 5 + kernel/bpf/core.c | 5 + kernel/bpf/helpers.c | 2 +- kernel/bpf/ringbuf.c | 2 + kernel/bpf/tnum.c | 8 + kernel/bpf/verifier.c | 100 ++++- kernel/cgroup/cgroup.c | 24 +- kernel/events/uprobes.c | 7 + kernel/futex/syscalls.c | 106 ++--- kernel/sched/ext.c | 8 +- kernel/trace/ftrace.c | 2 + kernel/trace/ring_buffer.c | 4 + kernel/trace/trace_events_hist.c | 6 +- lib/crypto/Makefile | 2 +- lib/kunit/kunit-test.c | 2 +- net/8021q/vlan.c | 2 + net/9p/trans_fd.c | 9 +- net/bluetooth/hci_event.c | 19 +- net/bluetooth/hci_sync.c | 23 +- net/bluetooth/iso.c | 11 +- net/bluetooth/mgmt.c | 6 +- net/bluetooth/rfcomm/tty.c | 26 +- net/bluetooth/sco.c | 7 + net/bridge/br.c | 5 + net/bridge/br_forward.c | 5 +- net/bridge/br_if.c | 1 + net/bridge/br_input.c | 4 +- net/bridge/br_mst.c | 10 +- net/bridge/br_private.h | 13 +- net/core/filter.c | 1 + net/core/page_pool.c | 12 +- net/core/sock.c | 15 +- net/dsa/tag_brcm.c | 70 ++-- net/ethernet/eth.c | 5 +- net/ipv4/inet_diag.c | 14 +- net/ipv4/ip_input.c | 11 +- net/ipv4/netfilter/nf_reject_ipv4.c | 25 ++ net/ipv4/nexthop.c | 6 + net/ipv4/route.c | 2 +- net/ipv4/tcp.c | 4 +- net/ipv4/tcp_fastopen.c | 7 +- net/ipv4/udp_tunnel_nic.c | 2 +- net/ipv6/addrconf.c | 4 +- net/ipv6/ah6.c | 50 ++- net/ipv6/netfilter/nf_reject_ipv6.c | 30 ++ net/ipv6/raw.c | 2 +- net/ipv6/udp.c | 2 +- net/mac80211/cfg.c | 20 +- net/mac80211/ieee80211_i.h | 2 + net/mac80211/iface.c | 9 + net/mac80211/key.c | 10 +- net/mac80211/mesh.c | 3 + net/mac80211/mlme.c | 5 +- net/mptcp/protocol.c | 18 +- net/mptcp/protocol.h | 2 +- net/rds/rds.h | 2 +- net/sctp/diag.c | 23 +- security/integrity/ima/ima_appraise.c | 23 +- sound/drivers/serial-generic.c | 12 +- sound/pci/hda/patch_realtek.c | 17 +- sound/soc/codecs/cs-amp-lib-test.c | 1 + sound/soc/codecs/tlv320aic3x.c | 32 +- sound/soc/fsl/fsl_sai.c | 11 +- sound/soc/intel/avs/pcm.c | 3 + sound/soc/mediatek/mt8173/mt8173-rt5650.c | 2 +- sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c | 2 +- .../mt8183/mt8183-mt6358-ts3a227-max98357.c | 2 +- sound/soc/mediatek/mt8186/mt8186-mt6366.c | 2 +- sound/soc/mediatek/mt8188/mt8188-mt6359.c | 8 +- .../mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c | 2 +- sound/soc/mediatek/mt8195/mt8195-mt6359.c | 4 +- sound/soc/meson/aiu-encoder-i2s.c | 9 +- sound/soc/qcom/qdsp6/q6asm.c | 2 +- sound/soc/qcom/sc8280xp.c | 3 + sound/soc/sof/ipc4-pcm.c | 56 +++ sound/soc/stm/stm32_sai_sub.c | 8 + sound/usb/mixer.c | 7 + sound/usb/mixer_s1810c.c | 28 +- sound/usb/validate.c | 9 +- tools/bpf/bpftool/btf_dumper.c | 2 +- tools/bpf/bpftool/link.c | 54 ++- tools/bpf/bpftool/prog.c | 2 +- tools/include/linux/bitmap.h | 1 + tools/lib/bpf/bpf_tracing.h | 2 +- tools/lib/bpf/usdt.bpf.h | 44 ++- tools/lib/bpf/usdt.c | 62 ++- tools/lib/thermal/Makefile | 9 +- tools/net/ynl/lib/ynl-priv.h | 4 +- tools/power/cpupower/lib/cpuidle.c | 5 +- tools/power/cpupower/lib/cpupower.c | 2 +- .../x86_energy_perf_policy.c | 30 +- tools/testing/selftests/Makefile | 2 +- .../testing/selftests/bpf/prog_tests/bpf_cookie.c | 3 +- .../selftests/bpf/progs/verifier_arena_large.c | 1 + tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +- tools/testing/selftests/bpf/test_xsk.sh | 2 + tools/testing/selftests/drivers/net/hw/rss_ctx.py | 11 +- .../selftests/drivers/net/netdevsim/Makefile | 4 + tools/testing/selftests/net/fcnal-test.sh | 432 +++++++++++---------- .../net/forwarding/custom_multipath_hash.sh | 2 +- .../net/forwarding/gre_custom_multipath_hash.sh | 2 +- .../net/forwarding/ip6_forward_instats_vrf.sh | 6 +- .../net/forwarding/ip6gre_custom_multipath_hash.sh | 2 +- tools/testing/selftests/net/forwarding/lib.sh | 8 +- .../net/forwarding/mirror_gre_bridge_1q_lag.sh | 2 +- .../net/forwarding/mirror_gre_vlan_bridge_1q.sh | 4 +- tools/testing/selftests/net/gro.c | 12 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 6 +- tools/testing/selftests/net/psock_tpacket.c | 4 +- tools/testing/selftests/net/traceroute.sh | 51 +-- .../intel/workload_hint/workload_hint_test.c | 2 + usr/include/headers_check.pl | 2 + 616 files changed, 5942 insertions(+), 2723 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/565 NFSD: Fix crash in nfsd4_read_release()
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
commit abb1f08a2121dd270193746e43b2a9373db9ad84 upstream.
When tracing is enabled, the trace_nfsd_read_done trace point crashes during the pynfs read.testNoFh test.
--- fs/nfsd/nfs4proc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/nfsd/nfs4proc.c +4 -3
@@ -982,10 +982,11 @@ nfsd4_read(struct svc_rqst *rqstp, strucstatic void nfsd4_read_release (union nfsd4_op_u *u) { -if (u->read.rd_nf) +if (u->read.rd_nf) { +trace_nfsd_read_done (u->read.rd_rqstp, u->read.rd_fhp, + u->read.rd_offset, u->read.rd_length);nfsd_file_put (u->read.rd_nf); -trace_nfsd_read_done (u->read.rd_rqstp, u->read.rd_fhp, - u->read.rd_offset, u->read.rd_length); + } } static __be32
Greg Kroah-Hartman
maintainerPATCH 2/565 net: usb: asix_devices: Check return value of usbnet_get_endpoints
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit dc89548c6926d68dfdda11bebc1a5258bc41d887 upstream.
The code did not check the return value of usbnet_get_endpoints. Add checks and return the error if it fails to transfer the error.
Found via static anlaysis and this is similar to
commit 07161b2416f7 ("sr9800: Add check for usbnet_get_endpoints").
--- drivers/net/usb/asix_devices.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/net/usb/asix_devices.c +9 -3
@@ -230,7 +230,9 @@ static int ax88172_bind(struct usbnet *dint i;unsigned long gpio_bits = dev->driver_info->data; -usbnet_get_endpoints (dev,intf); + ret =usbnet_get_endpoints (dev, intf); +if (ret) + goto out;/* Toggle the GPIOs in a manufacturer/model specific way */ for (i =2 ; i >=0 ; i--) {
@@ -848,7 +850,9 @@ static int ax88772_bind(struct usbnet *d dev->driver_priv = priv; -usbnet_get_endpoints (dev, intf); + ret =usbnet_get_endpoints (dev, intf); +if (ret) +return ret;/* Maybe the boot loader passed the MAC address via device tree */ if (!eth_platform_get_mac_address (&dev->udev->dev, buf)) {
@@ -1281,7 +1285,9 @@ static int ax88178_bind(struct usbnet *dint ret;u8 buf[ETH_ALEN ] = {0 }; -usbnet_get_endpoints (dev,intf); + ret =usbnet_get_endpoints (dev, intf); +if (ret) +return ret;/* Get the MAC address */ ret =asix_read_cmd (dev,AX_CMD_READ_NODE_ID ,0 ,0 ,ETH_ALEN , buf,0 );
Greg Kroah-Hartman
maintainerPATCH 3/565 fbcon: Set fb_display[i]->mode to NULL when the mode is released
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quanmin Yan <[email protected]>
commit a1f3058930745d2b938b6b4f5bd9630dc74b26b7 upstream.
Recently, we discovered the following issue through syzkaller:
BUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0 Read of size 4 at addr ff11000001b3c69c by task syz.xxx ... Call Trace: <TASK> dump_stack_lvl+0xab/0xe0 print_address_description.constprop.0+0x2c/0x390 print_report+0xb9/0x280 kasan_report+0xb8/0xf0 fb_mode_is_equal+0x285/0x2f0 fbcon_mode_deleted+0x129/0x180 fb_set_var+0xe7f/0x11d0 do_fb_ioctl+0x6a0/0x750 fb_ioctl+0xe0/0x140 __x64_sys_ioctl+0x193/0x210 do_syscall_64+0x5f/0x9c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
Based on experimentation and analysis, during framebuffer unregistration, only the memory of fb_info->modelist is freed, without setting the corresponding fb_display[i]->mode to NULL for the freed modes. This leads to UAF issues during subsequent accesses. Here's an example of reproduction steps:
1. With /dev/fb0 already registered in the system, load a kernel module to register a new device /dev/fb1;
2. Set fb1's mode to the global fb_display[] array (via FBIOPUT_CON2FBMAP);
3. Switch console from fb to VGA (to allow normal rmmod of the ko);
4. Unload the kernel module, at this point fb1's modelist is freed, leaving a wild pointer in fb_display[];
5. Trigger the bug via system calls through fb0 attempting to delete a mode from fb0.
Add a check in do_unregister_framebuffer(): if the mode to be freed exists in fb_display[], set the corresponding mode pointer to NULL.
--- drivers/video/fbdev/core/fbcon.c | 19 +++++++++++++++++++ drivers/video/fbdev/core/fbmem.c | 1 + include/linux/fbcon.h | 2 ++ 3 files changed, 22 insertions(+)
drivers/video/fbdev/core/fbcon.c +19 -0
@@ -2805,6 +2805,25 @@ int fbcon_mode_deleted(struct fb_info *ireturn found; } +static void fbcon_delete_mode (struct fb_videomode *m) +{ +struct fbcon_display *p; + +for (int i = first_fb_vc; i <= last_fb_vc; i++) { + p = &fb_display[i]; +if (p->mode == m) + p->mode =NULL ; + } +} + +void fbcon_delete_modelist (struct list_head *head) +{ +struct fb_modelist *modelist; + +list_for_each_entry (modelist, head, list) +fbcon_delete_mode (&modelist->mode); +} +#ifdef CONFIG_VT_HW_CONSOLE_BINDING static void fbcon_unbind (void ) {
drivers/video/fbdev/core/fbmem.c +1 -0
@@ -490,6 +490,7 @@ static void do_unregister_framebuffer(st fb_info->pixmap.addr =NULL ; } +fbcon_delete_modelist (&fb_info->modelist);fb_destroy_modelist (&fb_info->modelist); registered_fb[fb_info->node] =NULL ; num_registered_fb--;
include/linux/fbcon.h +2 -0
@@ -11,6 +11,7 @@ void fbcon_suspended(struct fb_info *infvoid fbcon_resumed (struct fb_info *info);int fbcon_mode_deleted (struct fb_info *info,struct fb_videomode *mode); +void fbcon_delete_modelist (struct list_head *head);void fbcon_new_modelist (struct fb_info *info);void fbcon_get_requirement (struct fb_info *info,struct fb_blit_caps *caps);
@@ -31,6 +32,7 @@ static inline void fbcon_suspended(strucstatic inline void fbcon_resumed (struct fb_info *info) {}static inline int fbcon_mode_deleted (struct fb_info *info,struct fb_videomode *mode) {return 0 ; } +static inline void fbcon_delete_modelist (struct list_head *head) {}static inline void fbcon_new_modelist (struct fb_info *info) {}static inline void fbcon_get_requirement (struct fb_info *info,struct fb_blit_caps *caps) {}
Greg Kroah-Hartman
maintainerPATCH 4/565 fbdev: atyfb: Check if pll_ops->init_pll failed
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Palmer <[email protected]>
commit 7073c7fc8d8ba47194e5fc58fcafc0efe7586e9b upstream.
Actually check the return value from pll_ops->init_pll() as it can return an error.
If the card's BIOS didn't run because it's not the primary VGA card the fact that the xclk source is unsupported is printed as shown below but the driver continues on regardless and on my machine causes a hard lock up.
[ 61.470088] atyfb 0000:03:05.0: enabling device (0080 -> 0083) [ 61.476191] atyfb: using auxiliary register aperture [ 61.481239] atyfb: 3D RAGE XL (Mach64 GR, PCI-33) [0x4752 rev 0x27] [ 61.487569] atyfb: 512K SGRAM (1:1), 14.31818 MHz XTAL, 230 MHz PLL, 83 Mhz MCLK, 63 MHz XCLK [ 61.496112] atyfb: Unsupported xclk source: 5.
--- drivers/video/fbdev/aty/atyfb_base.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/video/fbdev/aty/atyfb_base.c +6 -2
@@ -2614,8 +2614,12 @@ static int aty_init(struct fb_info *info pr_cont("\n"); }#endif -if (par->pll_ops->init_pll) - par->pll_ops->init_pll (info, &par->pll); +if (par->pll_ops->init_pll) { + ret = par->pll_ops->init_pll (info, &par->pll); +if (ret) +return ret; + } +if (par->pll_ops->resume_pll) par->pll_ops->resume_pll (info, &par->pll);
Greg Kroah-Hartman
maintainerPATCH 5/565 ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuhao Jiang <[email protected]>
commit 8f067aa59430266386b83c18b983ca583faa6a11 upstream.
The switch_brightness_work delayed work accesses device->brightness and device->backlight, freed by acpi_video_dev_unregister_backlight() during device removal.
If the work executes after acpi_video_bus_unregister_backlight() frees these resources, it causes a use-after-free when acpi_video_switch_brightness() dereferences device->brightness or device->backlight.
Fix this by calling cancel_delayed_work_sync() for each device's switch_brightness_work in acpi_video_bus_remove_notify_handler() after removing the notify handler that queues the work. This ensures the work completes before the memory is freed.
--- drivers/acpi/acpi_video.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/acpi/acpi_video.c +3 -1
@@ -1946,8 +1946,10 @@ static void acpi_video_bus_remove_notifystruct acpi_video_device *dev;mutex_lock (&video->device_list_lock); -list_for_each_entry (dev, &video->video_device_list, entry) +list_for_each_entry (dev, &video->video_device_list, entry) {acpi_video_dev_remove_notify_handler (dev); +cancel_delayed_work_sync (&dev->switch_brightness_work); + }mutex_unlock (&video->device_list_lock);acpi_video_bus_stop_devices (video);
Greg Kroah-Hartman
maintainerPATCH 6/565 ACPI: button: Call input_free_device() on failing input device registration
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <[email protected]>
commit 20594cd104abaaabb676c7a2915b150ae5ff093d upstream.
Make acpi_button_add() call input_free_device() when input_register_device() fails as required according to the documentation of the latter.
--- drivers/acpi/button.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/acpi/button.c +3 -1
@@ -613,8 +613,10 @@ static int acpi_button_add(struct acpi_dinput_set_drvdata (input, device); error =input_register_device (input); -if (error) +if (error) { +input_free_device (input); goto err_remove_fs; + }switch (device->device_type) {case ACPI_BUS_TYPE_POWER_BUTTON :
Greg Kroah-Hartman
maintainerPATCH 7/565 virtio-net: drop the multi-buffer XDP packet in zerocopy
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bui Quang Minh <[email protected]>
commit 1ab665817448c31f4758dce43c455bd4c5e460aa upstream.
In virtio-net, we have not yet supported multi-buffer XDP packet in zerocopy mode when there is a binding XDP program. However, in that case, when receiving multi-buffer XDP packet, we skip the XDP program and return XDP_PASS. As a result, the packet is passed to normal network stack which is an incorrect behavior (e.g. a XDP program for packet count is installed, multi-buffer XDP packet arrives and does go through XDP program. As a result, the packet count does not increase but the packet is still received from network stack).This commit instead returns XDP_ABORTED in that case.
--- drivers/net/virtio_net.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/net/virtio_net.c +8 -3
@@ -1314,9 +1314,14 @@ static struct sk_buff *virtnet_receive_x ret =XDP_PASS ;rcu_read_lock (); prog =rcu_dereference (rq->xdp_prog); -/* TODO: support multi buffer. */ -if (prog && num_buf ==1 ) - ret =virtnet_xdp_handler (prog, xdp, dev, xdp_xmit, stats); +if (prog) { +/* TODO: support multi buffer. */ +if (num_buf ==1 ) + ret =virtnet_xdp_handler (prog, xdp, dev, xdp_xmit, + stats); +else + ret =XDP_ABORTED ; + }rcu_read_unlock ();switch (ret) {
Greg Kroah-Hartman
maintainerPATCH 8/565 fbdev: bitblit: bound-check glyph index in bit_putcs*
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junjie Cao <[email protected]>
commit 18c4ef4e765a798b47980555ed665d78b71aeadf upstream.
bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and read past the end of the built-in font array. Clamp the index to the actual glyph count before computing the address.
This fixes a global out-of-bounds read reported by syzbot.
--- drivers/video/fbdev/core/bitblit.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/video/fbdev/core/bitblit.c +12 -4
@@ -79,12 +79,16 @@ static inline void bit_putcs_aligned(str struct fb_image *image, u8 *buf, u8 *dst) { u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff; +unsigned int charcnt = vc->vc_font.charcount;u32 idx = vc->vc_font.width >>3 ;u8 *src;while (cnt--) { - src = vc->vc_font.data + (scr_readw (s++)& - charmask)*cellsize; +u16 ch =scr_readw (s++) & charmask; + +if (ch >= charcnt) + ch =0 ; + src = vc->vc_font.data + (unsigned int )ch * cellsize;if (attr) {update_attr (buf, src, attr, vc);
@@ -112,14 +116,18 @@ static inline void bit_putcs_unaligned(s u8 *dst) {u16 charmask = vc->vc_hi_font_mask ?0x1ff :0xff ; +unsigned int charcnt = vc->vc_font.charcount;u32 shift_low =0 , mod = vc->vc_font.width %8 ;u32 shift_high =8 ;u32 idx = vc->vc_font.width >>3 ;u8 *src;while (cnt--) { - src = vc->vc_font.data + (scr_readw (s++)& - charmask)*cellsize; +u16 ch =scr_readw (s++) & charmask; + +if (ch >= charcnt) + ch =0 ; + src = vc->vc_font.data + (unsigned int )ch * cellsize;if (attr) {update_attr (buf, src, attr, vc);
Greg Kroah-Hartman
maintainerPATCH 9/565 Bluetooth: rfcomm: fix modem control handling
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 91d35ec9b3956d6b3cf789c1593467e58855b03a upstream.
The RFCOMM driver confuses the local and remote modem control signals, which specifically means that the reported DTR and RTS state will instead reflect the remote end (i.e. DSR and CTS).
This issue dates back to the original driver (and a follow-on update) merged in 2002, which resulted in a non-standard implementation of TIOCMSET that allowed controlling also the TS07.10 IC and DV signals by mapping them to the RI and DCD input flags, while TIOCMGET failed to return the actual state of DTR and RTS.
Note that the bogus control of input signals in tiocmset() is just dead code as those flags will have been masked out by the tty layer since 2003.
--- net/bluetooth/rfcomm/tty.c | 26 +++++++++++--------------- 1 file changed, 11 insertions(+), 15 deletions(-)
net/bluetooth/rfcomm/tty.c +11 -15
@@ -648,8 +648,8 @@ static void rfcomm_dev_modem_status(strutty_port_tty_hangup (&dev->port, true); dev->modem_status = - ((v24_sig &RFCOMM_V24_RTC ) ? (TIOCM_DSR |TIOCM_DTR ) :0 ) | - ((v24_sig &RFCOMM_V24_RTR ) ? (TIOCM_RTS |TIOCM_CTS ) :0 ) | + ((v24_sig &RFCOMM_V24_RTC ) ?TIOCM_DSR :0 ) | + ((v24_sig &RFCOMM_V24_RTR ) ?TIOCM_CTS :0 ) | ((v24_sig &RFCOMM_V24_IC ) ?TIOCM_RI :0 ) | ((v24_sig &RFCOMM_V24_DV ) ?TIOCM_CD :0 ); }
@@ -1060,10 +1060,14 @@ static void rfcomm_tty_hangup(struct ttystatic int rfcomm_tty_tiocmget (struct tty_struct *tty) {struct rfcomm_dev *dev = tty->driver_data; +struct rfcomm_dlc *dlc = dev->dlc; +u8 v24_sig;BT_DBG ("tty %p dev %p" , tty, dev); -return dev->modem_status; +rfcomm_dlc_get_modem_status (dlc, &v24_sig); + +return (v24_sig & (TIOCM_DTR |TIOCM_RTS )) | dev->modem_status; }static int rfcomm_tty_tiocmset (struct tty_struct *tty,unsigned int set,unsigned int clear)
@@ -1076,23 +1080,15 @@ static int rfcomm_tty_tiocmset(struct ttrfcomm_dlc_get_modem_status (dlc, &v24_sig); -if (set &TIOCM_DSR || set &TIOCM_DTR ) +if (set &TIOCM_DTR ) v24_sig |=RFCOMM_V24_RTC ; -if (set &TIOCM_RTS || set &TIOCM_CTS ) +if (set &TIOCM_RTS ) v24_sig |=RFCOMM_V24_RTR ; -if (set &TIOCM_RI ) - v24_sig |=RFCOMM_V24_IC ; -if (set &TIOCM_CD ) - v24_sig |=RFCOMM_V24_DV ; -if (clear &TIOCM_DSR || clear &TIOCM_DTR ) +if (clear &TIOCM_DTR ) v24_sig &= ~RFCOMM_V24_RTC ; -if (clear &TIOCM_RTS || clear &TIOCM_CTS ) +if (clear &TIOCM_RTS ) v24_sig &= ~RFCOMM_V24_RTR ; -if (clear &TIOCM_RI ) - v24_sig &= ~RFCOMM_V24_IC ; -if (clear &TIOCM_CD ) - v24_sig &= ~RFCOMM_V24_DV ;rfcomm_dlc_set_modem_status (dlc, v24_sig);
Greg Kroah-Hartman
maintainerPATCH 10/565 wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gokul Sivakumar <[email protected]>
commit 3776c685ebe5f43e9060af06872661de55e80b9a upstream.
Currently, whenever there is a need to transmit an Action frame, the brcmfmac driver always uses the P2P vif to send the "actframe" IOVAR to firmware. The P2P interfaces were available when wpa_supplicant is managing the wlan interface.
However, the P2P interfaces are not created/initialized when only hostapd is managing the wlan interface. And if hostapd receives an ANQP Query REQ Action frame even from an un-associated STA, the brcmfmac driver tries to use an uninitialized P2P vif pointer for sending the IOVAR to firmware. This NULL pointer dereferencing triggers a driver crash.
[ 1417.074538] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [...] [ 1417.075188] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT) [...] [ 1417.075653] Call trace: [ 1417.075662] brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac] [ 1417.075738] brcmf_cfg80211_mgmt_tx+0x304/0x5c0 [brcmfmac] [ 1417.075810] cfg80211_mlme_mgmt_tx+0x1b0/0x428 [cfg80211] [ 1417.076067] nl80211_tx_mgmt+0x238/0x388 [cfg80211] [ 1417.076281] genl_family_rcv_msg_doit+0xe0/0x158 [ 1417.076302] genl_rcv_msg+0x220/0x2a0 [ 1417.076317] netlink_rcv_skb+0x68/0x140 [ 1417.076330] genl_rcv+0x40/0x60 [ 1417.076343] netlink_unicast+0x330/0x3b8 [ 1417.076357] netlink_sendmsg+0x19c/0x3f8 [ 1417.076370] __sock_sendmsg+0x64/0xc0 [ 1417.076391] ____sys_sendmsg+0x268/0x2a0 [ 1417.076408] ___sys_sendmsg+0xb8/0x118 [ 1417.076427] __sys_sendmsg+0x90/0xf8 [ 1417.076445] __arm64_sys_sendmsg+0x2c/0x40 [ 1417.076465] invoke_syscall+0x50/0x120 [ 1417.076486] el0_svc_common.constprop.0+0x48/0xf0 [ 1417.076506] do_el0_svc+0x24/0x38 [ 1417.076525] el0_svc+0x30/0x100 [ 1417.076548] el0t_64_sync_handler+0x100/0x130 [ 1417.076569] el0t_64_sync+0x190/0x198 [ 1417.076589] Code: f9401e80 aa1603e2 f9403be1 5280e483 (f9400000)
Fix this, by always using the vif corresponding to the wdev on which the Action frame Transmission request was initiated by the userspace. This way, even if P2P vif is not available, the IOVAR is sent to firmware on AP vif and the ANQP Query RESP Action frame is transmitted without crashing the driver.
Move init_completion() for "send_af_done" from brcmf_p2p_create_p2pdev() to brcmf_p2p_attach(). Because the former function would not get executed when only hostapd is managing wlan interface, and it is not safe to do reinit_completion() later in brcmf_p2p_tx_action_frame(), without any prior init_completion().
And in the brcmf_p2p_tx_action_frame() function, the condition check for P2P Presence response frame is not needed, since the wpa_supplicant is properly sending the P2P Presense Response frame on the P2P-GO vif instead of the P2P-Device vif.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 - drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 28 ++++-------- drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h | 3 - 3 files changed, 12 insertions(+), 22 deletions(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +1 -2
@@ -5594,8 +5594,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wipbrcmf_dbg (TRACE ,"Action frame, cookie=%lld, len=%d, freq=%d\n" , *cookie,le16_to_cpu (action_frame->len), freq); - ack =brcmf_p2p_send_action_frame (cfg,cfg_to_ndev (cfg), - af_params); + ack =brcmf_p2p_send_action_frame (vif->ifp, af_params);cfg80211_mgmt_tx_status (wdev, *cookie, buf, len, ack,GFP_KERNEL );
drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c +10 -18
@@ -1529,6 +1529,7 @@ int brcmf_p2p_notify_action_tx_complete(/** * brcmf_p2p_tx_action_frame() - send action frame over fil. * +* @ifp: interface to transmit on. * @p2p: p2p info struct for vif. * @af_params: action frame data/info. *
@@ -1538,12 +1539,11 @@ int brcmf_p2p_notify_action_tx_complete(* The WLC_E_ACTION_FRAME_COMPLETE event will be received when the action * frame is transmitted. */ -static s32 brcmf_p2p_tx_action_frame (struct brcmf_p2p_info *p2p, +static s32 brcmf_p2p_tx_action_frame (struct brcmf_if *ifp, +struct brcmf_p2p_info *p2p,struct brcmf_fil_af_params_le *af_params) {struct brcmf_pub *drvr = p2p->cfg->pub; -struct brcmf_cfg80211_vif *vif; -struct brcmf_p2p_action_frame *p2p_af;s32 err =0 ;brcmf_dbg (TRACE ,"Enter\n" );
@@ -1552,14 +1552,7 @@ static s32 brcmf_p2p_tx_action_frame(strclear_bit (BRCMF_P2P_STATUS_ACTION_TX_COMPLETED , &p2p->status);clear_bit (BRCMF_P2P_STATUS_ACTION_TX_NOACK , &p2p->status); -/* check if it is a p2p_presence response */ - p2p_af = (struct brcmf_p2p_action_frame *)af_params->action_frame.data; -if (p2p_af->subtype ==P2P_AF_PRESENCE_RSP ) - vif = p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION ].vif; -else - vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE ].vif; - - err =brcmf_fil_bsscfg_data_set (vif->ifp,"actframe" , af_params, + err =brcmf_fil_bsscfg_data_set (ifp,"actframe" , af_params,sizeof (*af_params));if (err) {bphy_err (drvr," sending action frame has failed\n" );
@@ -1711,16 +1704,14 @@ static bool brcmf_p2p_check_dwell_overfl/** * brcmf_p2p_send_action_frame() - send action frame . * -* @cfg: driver private data for cfg80211 interface. -* @ndev: net device to transmit on. +* @ifp: interface to transmit on. * @af_params: configuration data for action frame. */ -bool brcmf_p2p_send_action_frame (struct brcmf_cfg80211_info *cfg, -struct net_device *ndev, +bool brcmf_p2p_send_action_frame (struct brcmf_if *ifp,struct brcmf_fil_af_params_le *af_params) { +struct brcmf_cfg80211_info *cfg = ifp->drvr->config;struct brcmf_p2p_info *p2p = &cfg->p2p; -struct brcmf_if *ifp =netdev_priv (ndev);struct brcmf_fil_action_frame_le *action_frame;struct brcmf_config_af_params config_af_params;struct afx_hdl *afx_hdl = &p2p->afx_hdl;
@@ -1857,7 +1848,7 @@ bool brcmf_p2p_send_action_frame(structif (af_params->channel)msleep (P2P_AF_RETRY_DELAY_TIME ); - ack = !brcmf_p2p_tx_action_frame (p2p, af_params); + ack = !brcmf_p2p_tx_action_frame (ifp, p2p, af_params); tx_retry++; dwell_overflow =brcmf_p2p_check_dwell_overflow (requested_dwell, dwell_jiffies);
@@ -2217,7 +2208,6 @@ static struct wireless_dev *brcmf_p2p_crWARN_ON (p2p_ifp->bsscfgidx != bsscfgidx); -init_completion (&p2p->send_af_done);INIT_WORK (&p2p->afx_hdl.afx_work, brcmf_p2p_afx_handler);init_completion (&p2p->afx_hdl.act_frm_scan);init_completion (&p2p->wait_next_af);
@@ -2513,6 +2503,8 @@ s32 brcmf_p2p_attach(struct brcmf_cfg802 pri_ifp =brcmf_get_ifp (cfg->pub,0 ); p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY ].vif = pri_ifp->vif; +init_completion (&p2p->send_af_done); +if (p2pdev_forced) { err_ptr =brcmf_p2p_create_p2pdev (p2p,NULL ,NULL );if (IS_ERR (err_ptr)) {
drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h +1 -2
@@ -168,8 +168,7 @@ int brcmf_p2p_notify_action_frame_rx(strint brcmf_p2p_notify_action_tx_complete (struct brcmf_if *ifp,const struct brcmf_event_msg *e,void *data); -bool brcmf_p2p_send_action_frame (struct brcmf_cfg80211_info *cfg, -struct net_device *ndev, +bool brcmf_p2p_send_action_frame (struct brcmf_if *ifp,struct brcmf_fil_af_params_le *af_params);bool brcmf_p2p_scan_finding_common_channel (struct brcmf_cfg80211_info *cfg,struct brcmf_bss_info_le *bi);
Greg Kroah-Hartman
maintainerPATCH 11/565 fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fuchs <[email protected]>
commit 5f566c0ac51cd2474e47da68dbe719d3acf7d999 upstream.
Commit e24cca19babe ("sh: Kill off MAX_DMA_ADDRESS leftovers.") removed the define ONCHIP_NR_DMA_CHANNELS. So that the leftover reference needs to be replaced by CONFIG_NR_ONCHIP_DMA_CHANNELS to compile successfully with CONFIG_PVR2_DMA enabled.
--- drivers/video/fbdev/pvr2fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/pvr2fb.c +1 -1
@@ -192,7 +192,7 @@ static unsigned long pvr2fb_map;#ifdef CONFIG_PVR2_DMA static unsigned int shdma =PVR2_CASCADE_CHAN ; -static unsigned int pvr2dma =ONCHIP_NR_DMA_CHANNELS ; +static unsigned int pvr2dma =CONFIG_NR_ONCHIP_DMA_CHANNELS ;#endif static struct fb_videomode pvr2_modedb[] = {
Greg Kroah-Hartman
maintainerPATCH 12/565 fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit eb53368f8d6e2dfba84c8a94d245719bcf9ae270 upstream.
The of_find_node_by_name() function returns a device tree node with its reference count incremented. The caller is responsible for calling of_node_put() to release this reference when done.
Found via static analysis.
--- drivers/video/fbdev/valkyriefb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/video/fbdev/valkyriefb.c +2 -0
@@ -329,11 +329,13 @@ static int __init valkyriefb_init(void)if (of_address_to_resource (dp,0 , &r)) {printk (KERN_ERR "can't find address for valkyrie\n" ); +of_node_put (dp);return 0 ; } frame_buffer_phys = r.start; cmap_regs_phys = r.start +0x304000 ; + of_node_put(dp); }#endif /* ppc (!CONFIG_MAC) */
Greg Kroah-Hartman
maintainerPATCH 13/565 mptcp: drop bogus optimization in __mptcp_check_push()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit 27b0e701d3872ba59c5b579a9e8a02ea49ad3d3b upstream.
Accessing the transmit queue without owning the msk socket lock is inherently racy, hence __mptcp_check_push() could actually quit early even when there is pending data.
That in turn could cause unexpected tx lock and timeout.
Dropping the early check avoids the race, implicitly relaying on later tests under the relevant lock. With such change, all the other mptcp_send_head() call sites are now under the msk socket lock and we can additionally drop the now unneeded annotation on the transmit head pointer accesses.
--- net/mptcp/protocol.c | 11 ++++------- net/mptcp/protocol.h | 2 +- 2 files changed, 5 insertions(+), 8 deletions(-)
net/mptcp/protocol.c +4 -7
@@ -1047,7 +1047,7 @@ static void __mptcp_clean_una(struct socif (WARN_ON_ONCE (!msk->recovery))break ; -WRITE_ONCE (msk->first_pending,mptcp_send_next (sk)); + msk->first_pending =mptcp_send_next (sk); }dfrag_clear (sk, dfrag);
@@ -1593,7 +1593,7 @@ static int __subflow_push_pending(structmptcp_update_post_push (msk, dfrag, ret); } -WRITE_ONCE (msk->first_pending,mptcp_send_next (sk)); + msk->first_pending =mptcp_send_next (sk); if (msk->snd_burst <= 0 || !sk_stream_memory_free(ssk) ||
@@ -1937,7 +1937,7 @@ static int mptcp_sendmsg(struct sock *skget_page (dfrag->page);list_add_tail (&dfrag->list, &msk->rtx_queue);if (!msk->first_pending) -WRITE_ONCE (msk->first_pending, dfrag); + msk->first_pending = dfrag; } pr_debug("msk=%p dfrag at seq=%llu len=%u sent=%u new=%d\n", msk, dfrag->data_seq, dfrag->data_len, dfrag->already_sent,
@@ -2940,7 +2940,7 @@ static void __mptcp_clear_xmit(struct sostruct mptcp_sock *msk =mptcp_sk (sk);struct mptcp_data_frag *dtmp, *dfrag; -WRITE_ONCE (msk->first_pending,NULL ); + msk->first_pending =NULL ;list_for_each_entry_safe (dfrag, dtmp, &msk->rtx_queue, list)dfrag_clear (sk, dfrag); }
@@ -3494,9 +3494,6 @@ void __mptcp_data_acked(struct sock *sk)void __mptcp_check_push (struct sock *sk,struct sock *ssk) { -if (!mptcp_send_head (sk)) -return ; -if (!sock_owned_by_user (sk))__mptcp_subflow_push_pending (sk, ssk, false);else
net/mptcp/protocol.h +1 -1
@@ -414,7 +414,7 @@ static inline struct mptcp_data_frag *mp {const struct mptcp_sock *msk =mptcp_sk (sk); -return READ_ONCE (msk->first_pending); +return msk->first_pending; }static inline struct mptcp_data_frag *mptcp_send_next (struct sock *sk)
Greg Kroah-Hartman
maintainerPATCH 14/565 mptcp: restore window probe
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit a824084b98d8a1dbd6e85d0842a8eb5e73467f59 upstream.
Since commit 72377ab2d671 ("mptcp: more conservative check for zero probes") the MPTCP-level zero window probe check is always disabled, as the TCP-level write queue always contains at least the newly allocated skb.
Refine the relevant check tacking in account that the above condition and that such skb can have zero length.
--- net/mptcp/protocol.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
net/mptcp/protocol.c +6 -1
@@ -1340,7 +1340,12 @@ alloc_skb:if (copy ==0 ) {u64 snd_una =READ_ONCE (msk->snd_una); -if (snd_una != msk->snd_nxt ||tcp_write_queue_tail (ssk)) { +/* No need for zero probe if there are any data pending +* either at the msk or ssk level; skb is the current write +* queue tail and can be empty at this point. +*/ +if (snd_una != msk->snd_nxt || skb->len || + skb !=tcp_send_head (ssk)) {tcp_remove_empty_skb (ssk);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 15/565 ASoC: qdsp6: q6asm: do not sleep while atomic
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <[email protected]>
commit fdbb53d318aa94a094434e5f226617f0eb1e8f22 upstream.
For some reason we ended up kfree between spinlock lock and unlock, which can sleep.
move the kfree out of spinlock section.
--- sound/soc/qcom/qdsp6/q6asm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/qcom/qdsp6/q6asm.c +1 -1
@@ -377,9 +377,9 @@ static void q6asm_audio_client_free_buf(spin_lock_irqsave (&ac->lock, flags); port->num_periods =0 ; +spin_unlock_irqrestore (&ac->lock, flags);kfree (port->buf); port->buf =NULL ; -spin_unlock_irqrestore (&ac->lock, flags); }/**
Greg Kroah-Hartman
maintainerPATCH 16/565 s390/pci: Restore IRQ unconditionally for the zPCI device
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Farhan Ali <[email protected]>
commit b45873c3f09153d1ad9b3a7bf9e5c0b0387fd2ea upstream.
Commit c1e18c17bda6 ("s390/pci: add zpci_set_irq()/zpci_clear_irq()"), introduced the zpci_set_irq() and zpci_clear_irq(), to be used while resetting a zPCI device.
Commit da995d538d3a ("s390/pci: implement reset_slot for hotplug slot"), mentions zpci_clear_irq() being called in the path for zpci_hot_reset_device(). But that is not the case anymore and these functions are not called outside of this file. Instead zpci_hot_reset_device() relies on zpci_disable_device() also clearing the IRQs, but misses to reset the zdev->irqs_registered flag.
However after a CLP disable/enable reset, the device's IRQ are unregistered, but the flag zdev->irq_registered does not get cleared. It creates an inconsistent state and so arch_restore_msi_irqs() doesn't correctly restore the device's IRQ. This becomes a problem when a PCI driver tries to restore the state of the device through pci_restore_state(). Restore IRQ unconditionally for the device and remove the irq_registered flag as its redundant.
--- arch/s390/include/asm/pci.h | 1 - arch/s390/pci/pci_irq.c | 9 +-------- 2 files changed, 1 insertion(+), 9 deletions(-)
arch/s390/include/asm/pci.h +0 -1
@@ -141,7 +141,6 @@ struct zpci_dev { u8 has_resources : 1; u8 is_physfn : 1; u8 util_str_avail : 1; - u8 irqs_registered : 1; u8 tid_avail : 1; u8 reserved : 1;unsigned int devfn;/* DEVFN part of the RID*/
arch/s390/pci/pci_irq.c +1 -8
@@ -107,9 +107,6 @@ static int zpci_set_irq(struct zpci_develse rc =zpci_set_airq (zdev); -if (!rc) - zdev->irqs_registered =1 ; -return rc; }
@@ -123,9 +120,6 @@ static int zpci_clear_irq(struct zpci_deelse rc =zpci_clear_airq (zdev); -if (!rc) - zdev->irqs_registered =0 ; -return rc; }
@@ -427,8 +421,7 @@ bool arch_restore_msi_irqs(struct pci_de {struct zpci_dev *zdev =to_zpci (pdev); -if (!zdev->irqs_registered) -zpci_set_irq (zdev); +zpci_set_irq (zdev);return true; }
Greg Kroah-Hartman
maintainerPATCH 17/565 smb: client: fix potential cfid UAF in smb2_query_info_compound
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henrique Carvalho <[email protected]>
commit 5c76f9961c170552c1d07c830b5e145475151600 upstream.
When smb2_query_info_compound() retries, a previously allocated cfid may have been freed in the first attempt.
Because cfid wasn't reset on replay, later cleanup could act on a stale pointer, leading to a potential use-after-free.
Reinitialize cfid to NULL under the replay label.
Example trace (trimmed):
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 11224 at ../lib/refcount.c:28 refcount_warn_saturate+0x9c/0x110 [...] RIP: 0010:refcount_warn_saturate+0x9c/0x110 [...] Call Trace: <TASK> smb2_query_info_compound+0x29c/0x5c0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] ? step_into+0x10d/0x690 ? __legitimize_path+0x28/0x60 smb2_queryfs+0x6a/0xf0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] smb311_queryfs+0x12d/0x140 [cifs f90b72658819bd21c94769b6a652029a07a7172f] ? kmem_cache_alloc+0x18a/0x340 ? getname_flags+0x46/0x1e0 cifs_statfs+0x9f/0x2b0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] statfs_by_dentry+0x67/0x90 vfs_statfs+0x16/0xd0 user_statfs+0x54/0xa0 __do_sys_statfs+0x20/0x50 do_syscall_64+0x58/0x80
--- fs/smb/client/smb2ops.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/smb/client/smb2ops.c +2 -1
@@ -2725,11 +2725,12 @@ smb2_query_info_compound(const unsignedstruct cifs_fid fid;int rc;__le16 *utf16_path; -struct cached_fid *cfid =NULL ; +struct cached_fid *cfid;int retries =0 , cur_sleep =1 ; replay_again:/* reinitialize for possible replay */ + cfid =NULL ; flags =CIFS_CP_CREATE_CLOSE_OP ; oplock =SMB2_OPLOCK_LEVEL_NONE ; server =cifs_pick_channel (ses);
Greg Kroah-Hartman
maintainerPATCH 18/565 x86/fpu: Ensure XFD state on signal delivery
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chang S. Bae <[email protected]>
commit 388eff894d6bc5f921e9bfff0e4b0ab2684a96e9 upstream.
Sean reported [1] the following splat when running KVM tests:
WARNING: CPU: 232 PID: 15391 at xfd_validate_state+0x65/0x70
Call Trace:
<TASK>
fpu__clear_user_states+0x9c/0x100
arch_do_signal_or_restart+0x142/0x210
exit_to_user_mode_loop+0x55/0x100
do_syscall_64+0x205/0x2c0
entry_SYSCALL_64_after_hwframe+0x4b/0x53Chao further identified [2] a reproducible scenario involving signal
delivery: a non-AMX task is preempted by an AMX-enabled task which modifies the XFD MSR.
When the non-AMX task resumes and reloads XSTATE with init values, a warning is triggered due to a mismatch between fpstate::xfd and the CPU's current XFD state. fpu__clear_user_states() does not currently re-synchronize the XFD state after such preemption.
Invoke xfd_update_state() which detects and corrects the mismatch if there is a dynamic feature.
This also benefits the sigreturn path, as fpu__restore_sig() may call fpu__clear_user_states() when the sigframe is inaccessible.
[ dhansen: minor changelog munging ]
--- arch/x86/kernel/fpu/core.c | 3 +++ 1 file changed, 3 insertions(+)
arch/x86/kernel/fpu/core.c +3 -0
@@ -757,6 +757,9 @@ void fpu__clear_user_states(struct fpu * !fpregs_state_valid(fpu, smp_processor_id()))os_xrstor_supervisor (fpu->fpstate); +/* Ensure XFD state is in sync before reloading XSTATE */ +xfd_update_state (fpu->fpstate); +/* Reset user states in registers. */ restore_fpregs_from_init_fpstate (XFEATURE_MASK_USER_RESTORE );
Greg Kroah-Hartman
maintainerPATCH 19/565 wifi: ath10k: Fix memory leak on unsupported WMI command
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Loic Poulain <[email protected]>
[ Upstream commit 2e9c1da4ee9d0acfca2e0a3d78f3d8cb5802da1b ]
ath10k_wmi_cmd_send takes ownership of the passed buffer (skb) and has the responsibility to release it in case of error. This patch fixes missing free in case of early error due to unhandled WMI command ID.
Tested-on: WCN3990 hw1.0 WLAN.HL.3.3.7.c2-00931-QCAHLSWMTPLZ-1
--- drivers/net/wireless/ath/ath10k/wmi.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/ath/ath10k/wmi.c +1 -0
@@ -1937,6 +1937,7 @@ int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id)if (cmd_id ==WMI_CMD_UNSUPPORTED ) {ath10k_warn (ar,"wmi command %d is not supported by firmware\n" , cmd_id); +dev_kfree_skb_any (skb);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/565 wifi: ath11k: Add missing platform IDs for quirk table
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Pearson <[email protected]>
[ Upstream commit 0eb002c93c3b47f88244cecb1e356eaeab61a6bf ]
Lenovo platforms can come with one of two different IDs. The pm_quirk table was missing the second ID for each platform.
Add missing ID and some extra platform identification comments. Reported on https://bugzilla.kernel.org/show_bug.cgi?id=219196
Tested-on: P14s G4 AMD.
--- drivers/net/wireless/ath/ath11k/core.c | 54 +++++++++++++++++++++++--- 1 file changed, 48 insertions(+), 6 deletions(-)
drivers/net/wireless/ath/ath11k/core.c +48 -6
@@ -814,42 +814,84 @@ static const struct ath11k_hw_params ath11k_hw_params[] = {static const struct dmi_system_id ath11k_pm_quirk_table[] = { { .driver_data = (void *)ATH11K_PM_WOW , - .matches = { + .matches = {/* X13 G4 AMD #1 */ +DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"21J3" ), + }, + }, + { + .driver_data = (void *)ATH11K_PM_WOW , + .matches = {/* X13 G4 AMD #2 */ DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ),DMI_MATCH (DMI_PRODUCT_NAME ,"21J4" ), }, }, { .driver_data = (void *)ATH11K_PM_WOW , - .matches = { + .matches = {/* T14 G4 AMD #1 */ +DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"21K3" ), + }, + }, + { + .driver_data = (void *)ATH11K_PM_WOW , + .matches = {/* T14 G4 AMD #2 */ DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ),DMI_MATCH (DMI_PRODUCT_NAME ,"21K4" ), }, }, { .driver_data = (void *)ATH11K_PM_WOW , - .matches = { + .matches = {/* P14s G4 AMD #1 */ +DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"21K5" ), + }, + }, + { + .driver_data = (void *)ATH11K_PM_WOW , + .matches = {/* P14s G4 AMD #2 */ DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ),DMI_MATCH (DMI_PRODUCT_NAME ,"21K6" ), }, }, { .driver_data = (void *)ATH11K_PM_WOW , - .matches = { + .matches = {/* T16 G2 AMD #1 */ +DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"21K7" ), + }, + }, + { + .driver_data = (void *)ATH11K_PM_WOW , + .matches = {/* T16 G2 AMD #2 */ DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ),DMI_MATCH (DMI_PRODUCT_NAME ,"21K8" ), }, }, { .driver_data = (void *)ATH11K_PM_WOW , - .matches = { + .matches = {/* P16s G2 AMD #1 */ +DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"21K9" ), + }, + }, + { + .driver_data = (void *)ATH11K_PM_WOW , + .matches = {/* P16s G2 AMD #2 */ DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ),DMI_MATCH (DMI_PRODUCT_NAME ,"21KA" ), }, }, { .driver_data = (void *)ATH11K_PM_WOW , - .matches = { + .matches = {/* T14s G4 AMD #1 */ +DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"21F8" ), + }, + }, + { + .driver_data = (void *)ATH11K_PM_WOW , + .matches = {/* T14s G4 AMD #2 */ DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ),DMI_MATCH (DMI_PRODUCT_NAME ,"21F9" ), },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/565 wifi: ath12k: free skb during idr cleanup callback
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karthik M <[email protected]>
[ Upstream commit 92282074e1d2e7b6da5c05fe38a7cc974187fe14 ]
ath12k just like ath11k [1] did not handle skb cleanup during idr cleanup callback. Both ath12k_mac_vif_txmgmt_idr_remove() and ath12k_mac_tx_mgmt_pending_free() performed idr cleanup and DMA unmapping for skb but only ath12k_mac_tx_mgmt_pending_free() freed skb. As a result, during vdev deletion a memory leak occurs.
Refactor all clean up steps into a new function. New function ath12k_mac_tx_mgmt_free() creates a centralized area where idr cleanup, DMA unmapping for skb and freeing skb is performed. Utilize skb pointer given by idr_remove(), instead of passed as a function argument because IDR will be protected by locking. This will prevent concurrent modification of the same IDR.
Now ath12k_mac_tx_mgmt_pending_free() and ath12k_mac_vif_txmgmt_idr_remove() call ath12k_mac_tx_mgmt_free().
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath12k/mac.c | 34 ++++++++++++++------------- 1 file changed, 18 insertions(+), 16 deletions(-)
drivers/net/wireless/ath/ath12k/mac.c +18 -16
@@ -5677,23 +5677,32 @@ static void ath12k_mgmt_over_wmi_tx_drop(struct ath12k *ar, struct sk_buff *skb)wake_up (&ar->txmgmt_empty_waitq); } -int ath12k_mac_tx_mgmt_pending_free (int buf_id,void *skb,void *ctx) +static void ath12k_mac_tx_mgmt_free (struct ath12k *ar,int buf_id) { -struct sk_buff *msdu = skb; +struct sk_buff *msdu;struct ieee80211_tx_info *info; -struct ath12k *ar = ctx; -struct ath12k_base *ab = ar->ab;spin_lock_bh (&ar->txmgmt_idr_lock); -idr_remove (&ar->txmgmt_idr, buf_id); + msdu =idr_remove (&ar->txmgmt_idr, buf_id);spin_unlock_bh (&ar->txmgmt_idr_lock); -dma_unmap_single (ab->dev,ATH12K_SKB_CB (msdu)->paddr, msdu->len, + +if (!msdu) +return ; + +dma_unmap_single (ar->ab->dev,ATH12K_SKB_CB (msdu)->paddr, msdu->len,DMA_TO_DEVICE ); info =IEEE80211_SKB_CB (msdu);memset (&info->status,0 ,sizeof (info->status)); -ath12k_mgmt_over_wmi_tx_drop (ar, skb); +ath12k_mgmt_over_wmi_tx_drop (ar, msdu); +} + +int ath12k_mac_tx_mgmt_pending_free (int buf_id,void *skb,void *ctx) +{ +struct ath12k *ar = ctx; + +ath12k_mac_tx_mgmt_free (ar, buf_id);return 0 ; }
@@ -5702,17 +5711,10 @@ static int ath12k_mac_vif_txmgmt_idr_remove(int buf_id, void *skb, void *ctx) {struct ieee80211_vif *vif = ctx;struct ath12k_skb_cb *skb_cb =ATH12K_SKB_CB (skb); -struct sk_buff *msdu = skb;struct ath12k *ar = skb_cb->ar; -struct ath12k_base *ab = ar->ab; -if (skb_cb->vif == vif) { -spin_lock_bh (&ar->txmgmt_idr_lock); -idr_remove (&ar->txmgmt_idr, buf_id); -spin_unlock_bh (&ar->txmgmt_idr_lock); -dma_unmap_single (ab->dev, skb_cb->paddr, msdu->len, -DMA_TO_DEVICE ); - } +if (skb_cb->vif == vif) +ath12k_mac_tx_mgmt_free (ar, buf_id);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/565 wifi: ath11k: add support for MU EDCA
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Zhang(Yuriy) <[email protected]>
[ Upstream commit b78c02f7c7104f1e77ade12ebde267e6fb388ca9 ]
The current code does not have the MU EDCA feature, so it cannot support the use of EDCA by STA in specific UL MU HE TB PPDU transmissions. Refer to IEEE Std 802.11ax-2021 "9.4.2.251 MU EDCA Parameter Set element", "26.2.7 EDCA operation using MU EDCA parameters".
Add ath11k_mac_op_conf_tx_mu_edca() to construct the MU EDCA parameters received from mac80211 into WMI WMM parameters，and send to the firmware according to the different WMM type flags.
Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04523-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1
Stable-dep-of: 9c78e747dd4f ("wifi: ath11k: avoid bit operation on key flags")
--- drivers/net/wireless/ath/ath11k/core.h | 3 +- drivers/net/wireless/ath/ath11k/mac.c | 53 +++++++++++++++++++++++++- drivers/net/wireless/ath/ath11k/wmi.c | 11 +++--- drivers/net/wireless/ath/ath11k/wmi.h | 10 ++++- 4 files changed, 67 insertions(+), 10 deletions(-)
drivers/net/wireless/ath/ath11k/core.h +2 -1
@@ -1,7 +1,7 @@/* SPDX-License-Identifier: BSD-3-Clause-Clear */ /* * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved. -* Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved. +* Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved. */ #ifndef ATH11K_CORE_H
@@ -372,6 +372,7 @@ struct ath11k_vif {u16 tx_seq_no;struct wmi_wmm_params_all_arg wmm_params; +struct wmi_wmm_params_all_arg muedca_params;struct list_head list; union { struct {
drivers/net/wireless/ath/ath11k/mac.c +51 -2
76 lines not on this page · raw message
drivers/net/wireless/ath/ath11k/wmi.c +6 -5
@@ -1,7 +1,7 @@// SPDX-License-Identifier: BSD-3-Clause-Clear /* * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved. -* Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved. +* Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved. */ #include <linux/skbuff.h> #include <linux/ctype.h>
@@ -2662,7 +2662,8 @@ int ath11k_wmi_send_scan_chan_list_cmd(struct ath11k *ar, }int ath11k_wmi_send_wmm_update_cmd_tlv (struct ath11k *ar,u32 vdev_id, -struct wmi_wmm_params_all_arg *param) +struct wmi_wmm_params_all_arg *param, +enum wmi_wmm_params_type wmm_param_type) {struct ath11k_pdev_wmi *wmi = ar->wmi;struct wmi_vdev_set_wmm_params_cmd *cmd;
@@ -2681,7 +2682,7 @@ int ath11k_wmi_send_wmm_update_cmd_tlv(struct ath11k *ar, u32 vdev_id,FIELD_PREP (WMI_TLV_LEN ,sizeof (*cmd) -TLV_HDR_SIZE ); cmd->vdev_id = vdev_id; - cmd->wmm_param_type =0 ; + cmd->wmm_param_type = wmm_param_type;for (ac =0 ; ac <WME_NUM_AC ; ac++) {switch (ac) {
@@ -2714,8 +2715,8 @@ int ath11k_wmi_send_wmm_update_cmd_tlv(struct ath11k *ar, u32 vdev_id, wmm_param->no_ack = wmi_wmm_arg->no_ack;ath11k_dbg (ar->ab,ATH11K_DBG_WMI , -"wmm set ac %d aifs %d cwmin %d cwmax %d txop %d acm %d no_ack %d\n" , - ac, wmm_param->aifs, wmm_param->cwmin, +"wmm set type %d ac %d aifs %d cwmin %d cwmax %d txop %d acm %d no_ack %d\n" , + wmm_param_type, ac, wmm_param->aifs, wmm_param->cwmin, wmm_param->cwmax, wmm_param->txoplimit, wmm_param->acm, wmm_param->no_ack); }
drivers/net/wireless/ath/ath11k/wmi.h +8 -2
@@ -1,7 +1,7 @@/* SPDX-License-Identifier: BSD-3-Clause-Clear */ /* * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved. -* Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved. +* Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved. */ #ifndef ATH11K_WMI_H
@@ -6347,6 +6347,11 @@ enum wmi_sta_keepalive_method {#define WMI_STA_KEEPALIVE_INTERVAL_DEFAULT 30#define WMI_STA_KEEPALIVE_INTERVAL_DISABLE 0 +enum wmi_wmm_params_type { +WMI_WMM_PARAM_TYPE_LEGACY =0 , +WMI_WMM_PARAM_TYPE_11AX_MU_EDCA =1 , +}; +const void **ath11k_wmi_tlv_parse_alloc (struct ath11k_base *ab,struct sk_buff *skb,gfp_t gfp); int ath11k_wmi_cmd_send(struct ath11k_pdev_wmi *wmi, struct sk_buff *skb,
@@ -6403,7 +6408,8 @@ int ath11k_wmi_send_scan_start_cmd(struct ath11k *ar,int ath11k_wmi_send_scan_stop_cmd (struct ath11k *ar,struct scan_cancel_param *param);int ath11k_wmi_send_wmm_update_cmd_tlv (struct ath11k *ar,u32 vdev_id, -struct wmi_wmm_params_all_arg *param); +struct wmi_wmm_params_all_arg *param, +enum wmi_wmm_params_type wmm_param_type);int ath11k_wmi_pdev_suspend (struct ath11k *ar,u32 suspend_opt,u32 pdev_id);int ath11k_wmi_pdev_resume (struct ath11k *ar,u32 pdev_id);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/565 ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit ec20584f25233bfe292c8e18f9a429dfaff58a49 ]
cs-amp-lib-test uses functions from kunit/test-bug.h but wasn't including it.
This error was found by smatch.
--- sound/soc/codecs/cs-amp-lib-test.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/codecs/cs-amp-lib-test.c +1 -0
@@ -6,6 +6,7 @@// Cirrus Logic International Semiconductor Ltd. #include <kunit/test.h> +#include <kunit/test-bug.h> #include <kunit/static_stub.h> #include <linux/firmware/cirrus/cs_dsp.h> #include <linux/firmware/cirrus/wmfw.h>
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/565 wifi: mac80211: dont mark keys for inactive links as uploaded
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miri Korenblit <[email protected]>
[ Upstream commit 63df3956903748c5f374a0dfe7a89490714a4625 ]
During resume, the driver can call ieee80211_add_gtk_rekey for keys that are not programmed into the device, e.g. keys of inactive links. Don't mark such a key as uploaded to avoid removing it later from the driver/device.
Stable-dep-of: ed6a47346ec6 ("wifi: mac80211: fix key tailroom accounting leak")
--- net/mac80211/key.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/mac80211/key.c +2 -1
@@ -510,7 +510,8 @@ static int ieee80211_key_replace(struct ieee80211_sub_if_data *sdata, }else {if (!new->local->wowlan) ret =ieee80211_key_enable_hw_accel (new); -else +else if (link_id <0 || !sdata->vif.active_links || +BIT (link_id) & sdata->vif.active_links) new->flags |=KEY_FLAG_UPLOADED_TO_HARDWARE ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/565 wifi: mac80211: fix key tailroom accounting leak
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit ed6a47346ec69e7f1659e0a1a3558293f60d5dd7 ]
For keys added by ieee80211_gtk_rekey_add(), we assume that they're already present in the hardware and set the flag KEY_FLAG_UPLOADED_TO_HARDWARE. However, setting this flag needs to be paired with decrementing the tailroom needed, which was missed.
--- net/mac80211/key.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
net/mac80211/key.c +8 -3
@@ -508,11 +508,16 @@ static int ieee80211_key_replace(struct ieee80211_sub_if_data *sdata, ret =ieee80211_key_enable_hw_accel (new); } }else { -if (!new->local->wowlan) +if (!new->local->wowlan) { ret =ieee80211_key_enable_hw_accel (new); -else if (link_id <0 || !sdata->vif.active_links || -BIT (link_id) & sdata->vif.active_links) + }else if (link_id <0 || !sdata->vif.active_links || +BIT (link_id) & sdata->vif.active_links) { new->flags |=KEY_FLAG_UPLOADED_TO_HARDWARE ; +if (!(new->conf.flags & (IEEE80211_KEY_FLAG_GENERATE_MMIC | +IEEE80211_KEY_FLAG_PUT_MIC_SPACE | +IEEE80211_KEY_FLAG_RESERVE_TAILROOM ))) +decrease_tailroom_need_count (sdata,1 ); + } }if (ret)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/565 kunit: test_dev_action: Correctly cast priv pointer to long*
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Schmaus <[email protected]>
[ Upstream commit 2551a1eedc09f5a86f94b038dc1bb16855c256f1 ]
The previous implementation incorrectly assumed the original type of 'priv' was void**, leading to an unnecessary and misleading cast. Correct the cast of the 'priv' pointer in test_dev_action() to its actual type, long*, removing an unnecessary cast.
As an additional benefit, this fixes an out-of-bounds CHERI fault on hardware with architectural capabilities. The original implementation tried to store a capability-sized pointer using the priv pointer. However, the priv pointer's capability only granted access to the memory region of its original long type, leading to a bounds violation since the size of a long is smaller than the size of a capability. This change ensures that the pointer usage respects the capabilities' bounds.
--- lib/kunit/kunit-test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/kunit/kunit-test.c +1 -1
@@ -735,7 +735,7 @@ static struct kunit_case kunit_current_test_cases[] = {static void test_dev_action (void *priv) { - *(void **)priv = (void *)1 ; + *(long *)priv =1 ; }static void kunit_device_test (struct kunit *test)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/565 bpf: Sync pending IRQ work before freeing ring buffer
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Noorain Eqbal <[email protected]>
[ Upstream commit 4e9077638301816a7d73fa1e1b4c1db4a7e3b59c ]
Fix a race where irq_work can be queued in bpf_ringbuf_commit() but the ring buffer is freed before the work executes.
In the syzbot reproducer, a BPF program attached to sched_switch triggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer is freed before this work executes, the irq_work thread may accesses freed memory.
Calling irq_work_sync(&rb->work) ensures that all pending irq_work complete before freeing the buffer.
--- kernel/bpf/ringbuf.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/bpf/ringbuf.c +2 -0
@@ -215,6 +215,8 @@ static struct bpf_map *ringbuf_map_alloc(union bpf_attr *attr)static void bpf_ringbuf_free (struct bpf_ringbuf *rb) { +irq_work_sync (&rb->work); +/* copy pages pointer and nr_pages to local variable, as we are going * to unmap rb itself with vunmap() below */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/565 scsi: ufs: core: Initialize value of an attribute returned by uic cmd
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wonkon Kim <[email protected]>
[ Upstream commit 6fe4c679dde3075cb481beb3945269bb2ef8b19a ]
If ufshcd_send_cmd() fails, *mib_val may have a garbage value. It can get an unintended value of an attribute.
Make ufshcd_dme_get_attr() always initialize *mib_val.
--- drivers/ufs/core/ufshcd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/ufs/core/ufshcd.c +2 -2
@@ -4239,8 +4239,8 @@ int ufshcd_dme_get_attr(struct ufs_hba *hba, u32 attr_sel, get,UIC_GET_ATTR_ID (attr_sel), UFS_UIC_COMMAND_RETRIES - retries); -if (mib_val && !ret) - *mib_val = uic_cmd.argument3; +if (mib_val) + *mib_val = ret ==0 ? uic_cmd.argument3 :0 ;if (peer && (hba->quirks &UFSHCD_QUIRK_DME_PEER_ACCESS_AUTO_MODE ) && pwr_mode_change)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/565 bpf: Find eligible subprogs for private stack support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonghong Song <[email protected]>
[ Upstream commit a76ab5731e32d50ff5b1ae97e9dc4b23f41c23f5 ]
Private stack will be allocated with percpu allocator in jit time. To avoid complexity at runtime, only one copy of private stack is available per cpu per prog. So runtime recursion check is necessary to avoid stack corruption.
Current private stack only supports kprobe/perf_event/tp/raw_tp which has recursion check in the kernel, and prog types that use bpf trampoline recursion check. For trampoline related prog types, currently only tracing progs have recursion checking.
To avoid complexity, all async_cb subprogs use normal kernel stack including those subprogs used by both main prog subtree and async_cb subtree. Any prog having tail call also uses kernel stack.
To avoid jit penalty with private stack support, a subprog stack size threshold is set such that only if the stack size is no less than the threshold, private stack is supported. The current threshold is 64 bytes. This avoids jit penality if the stack usage is small.
A useless 'continue' is also removed from a loop in func check_max_stack_depth().
Stable-dep-of: 881a9c9cb785 ("bpf: Do not audit capability check in do_jit()")
--- include/linux/bpf_verifier.h | 7 +++ include/linux/filter.h | 1 + kernel/bpf/core.c | 5 ++ kernel/bpf/verifier.c | 96 ++++++++++++++++++++++++++++++++---- 4 files changed, 99 insertions(+), 10 deletions(-)
include/linux/bpf_verifier.h +7 -0
@@ -654,6 +654,12 @@ struct bpf_subprog_arg_info { }; }; +enum priv_stack_mode { +PRIV_STACK_UNKNOWN , +NO_PRIV_STACK , +PRIV_STACK_ADAPTIVE , +}; +struct bpf_subprog_info {/* 'start' has to be the first field otherwise find_subprog() won't work */ u32 start;/* insn idx of function entry point */
@@ -675,6 +681,7 @@ struct bpf_subprog_info { bool keep_fastcall_stack: 1; bool changes_pkt_data: 1; +enum priv_stack_mode priv_stack_mode;u8 arg_cnt;struct bpf_subprog_arg_info args[MAX_BPF_FUNC_REG_ARGS ]; };
include/linux/filter.h +1 -0
@@ -1119,6 +1119,7 @@ bool bpf_jit_supports_exceptions(void);bool bpf_jit_supports_ptr_xchg (void );bool bpf_jit_supports_arena (void );bool bpf_jit_supports_insn (struct bpf_insn *insn,bool in_arena); +bool bpf_jit_supports_private_stack (void );u64 bpf_arch_uaddress_limit (void );void arch_bpf_stack_walk (bool (*consume_fn)(void *cookie,u64 ip,u64 sp,u64 bp),void *cookie);bool bpf_helper_changes_pkt_data (enum bpf_func_id func_id);
kernel/bpf/core.c +5 -0
@@ -3094,6 +3094,11 @@ bool __weak bpf_jit_supports_exceptions(void)return false; } +bool __weak bpf_jit_supports_private_stack (void ) +{ +return false; +} +void __weak arch_bpf_stack_walk (bool (*consume_fn)(void *cookie,u64 ip,u64 sp,u64 bp),void *cookie) { }
kernel/bpf/verifier.c +86 -10
155 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/565 bpf, x86: Avoid repeated usage of bpf_prog->aux->stack_depth
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonghong Song <[email protected]>
[ Upstream commit f4b21ed0b9d6c9fe155451a1fb3531fb44b0afa8 ]
Refactor the code to avoid repeated usage of bpf_prog->aux->stack_depth in do_jit() func. If the private stack is used, the stack_depth will be 0 for that prog. Refactoring make it easy to adjust stack_depth.
Stable-dep-of: 881a9c9cb785 ("bpf: Do not audit capability check in do_jit()")
--- arch/x86/net/bpf_jit_comp.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
arch/x86/net/bpf_jit_comp.c +7 -4
@@ -1472,14 +1472,17 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image, u8 *rw_imageint i, excnt =0 ;int ilen, proglen =0 ;u8 *prog = temp; +u32 stack_depth;int err; + stack_depth = bpf_prog->aux->stack_depth; + arena_vm_start =bpf_arena_get_kern_vm_start (bpf_prog->aux->arena); user_vm_start =bpf_arena_get_user_vm_start (bpf_prog->aux->arena);detect_reg_usage (insn, insn_cnt, callee_regs_used); -emit_prologue (&prog, bpf_prog->aux->stack_depth, +emit_prologue (&prog, stack_depth,bpf_prog_was_classic (bpf_prog), tail_call_reachable,bpf_is_subprog (bpf_prog), bpf_prog->aux->exception_cb);/* Exception callback will clobber callee regs for its own use, and
@@ -2175,7 +2178,7 @@ st: if (is_imm8(insn->off)) func = (u8 *) __bpf_call_base + imm32;if (tail_call_reachable) { -LOAD_TAIL_CALL_CNT_PTR (bpf_prog->aux->stack_depth); +LOAD_TAIL_CALL_CNT_PTR (stack_depth); ip +=7 ; }if (!imm32)
@@ -2192,13 +2195,13 @@ st: if (is_imm8(insn->off)) &bpf_prog->aux->poke_tab[imm32 -1 ], &prog, image + addrs[i -1 ], callee_regs_used, - bpf_prog->aux->stack_depth, + stack_depth, ctx); else emit_bpf_tail_call_indirect(bpf_prog, &prog, callee_regs_used, - bpf_prog->aux->stack_depth, + stack_depth, image + addrs[i - 1], ctx);break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/565 bpf: Do not audit capability check in do_jit()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ondrej Mosnacek <[email protected]>
[ Upstream commit 881a9c9cb7856b24e390fad9f59acfd73b98b3b2 ]
The failure of this check only results in a security mitigation being applied, slightly affecting performance of the compiled BPF program. It doesn't result in a failed syscall, an thus auditing a failed LSM permission check for it is unwanted. For example with SELinux, it causes a denial to be reported for confined processes running as root, which tends to be flagged as a problem to be fixed in the policy. Yet dontauditing or allowing CAP_SYS_ADMIN to the domain may not be desirable, as it would allow/silence also other checks - either going against the principle of least privilege or making debugging potentially harder.
Fix it by changing it from capable() to ns_capable_noaudit(), which instructs the LSMs to not audit the resulting denials.
--- arch/x86/net/bpf_jit_comp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/net/bpf_jit_comp.c +1 -1
@@ -2453,7 +2453,7 @@ st: if (is_imm8(insn->off))/* Update cleanup_addr */ ctx->cleanup_addr = proglen;if (bpf_prog_was_classic (bpf_prog) && - !capable (CAP_SYS_ADMIN )) { + !ns_capable_noaudit (&init_user_ns,CAP_SYS_ADMIN )) {u8 *ip = image + addrs[i -1 ];if (emit_spectre_bhb_barrier (&prog, ip, bpf_prog))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/565 crypto: aspeed - fix double free caused by devm
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 3c9bf72cc1ced1297b235f9422d62b613a3fdae9 ]
The clock obtained via devm_clk_get_enabled() is automatically managed by devres and will be disabled and freed on driver detach. Manually calling clk_disable_unprepare() in error path and remove function causes double free.
Remove the manual clock cleanup in both aspeed_acry_probe()'s error path and aspeed_acry_remove().
--- drivers/crypto/aspeed/aspeed-acry.c | 2 -- 1 file changed, 2 deletions(-)
drivers/crypto/aspeed/aspeed-acry.c +0 -2
@@ -789,7 +789,6 @@ static int aspeed_acry_probe(struct platform_device *pdev) err_engine_rsa_start:crypto_engine_exit (acry_dev->crypt_engine_rsa); clk_exit: -clk_disable_unprepare (acry_dev->clk);return rc; }
@@ -801,7 +800,6 @@ static void aspeed_acry_remove(struct platform_device *pdev)aspeed_acry_unregister (acry_dev);crypto_engine_exit (acry_dev->crypt_engine_rsa);tasklet_kill (&acry_dev->done_task); -clk_disable_unprepare (acry_dev->clk); }MODULE_DEVICE_TABLE (of, aspeed_acry_of_matches);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/565 ASoC: Intel: avs: Unprepare a stream when XRUN occurs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cezary Rojewski <[email protected]>
[ Upstream commit cfca1637bc2b6b1e4f191d2f0b25f12402fbbb26 ]
The pcm->prepare() function may be called multiple times in a row by the userspace, as mentioned in the documentation. The driver shall take that into account and prevent redundancy. However, the exact same function is called during XRUNs and in such case, the particular stream shall be reset and setup anew.
--- sound/soc/intel/avs/pcm.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/intel/avs/pcm.c +2 -0
@@ -653,6 +653,8 @@ static int avs_dai_fe_prepare(struct snd_pcm_substream *substream, struct snd_so data =snd_soc_dai_get_dma_data (dai, substream); host_stream = data->host_stream; +if (runtime->state ==SNDRV_PCM_STATE_XRUN ) +hdac_stream (host_stream)->prepared = false;if (hdac_stream (host_stream)->prepared)return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/565 ASoC: Intel: avs: Disable periods-elapsed work when closing PCM
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cezary Rojewski <[email protected]>
[ Upstream commit 845f716dc5f354c719f6fda35048b6c2eca99331 ]
avs_dai_fe_shutdown() handles the shutdown procedure for HOST HDAudio stream while period-elapsed work services its IRQs. As the former frees the DAI's private context, these two operations shall be synchronized to avoid slab-use-after-free or worse errors.
--- sound/soc/intel/avs/pcm.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/intel/avs/pcm.c +1 -0
@@ -551,6 +551,7 @@ static void avs_dai_fe_shutdown(struct snd_pcm_substream *substream, struct snd_ data =snd_soc_dai_get_dma_data (dai, substream); +disable_work_sync (&data->period_elapsed_work);snd_hdac_ext_stream_release (data->host_stream,HDAC_EXT_STREAM_TYPE_HOST );avs_dai_shutdown (substream, dai); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/565 ASoC: fsl_sai: fix bit order for DSD format
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
[ Upstream commit d9fbe5b0bf7e2d1e20d53e4e2274f9f61bdcca98 ]
The DSD little endian format requires the msb first, because oldest bit is in msb.
found this issue by testing with pipewire.
--- sound/soc/fsl/fsl_sai.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
sound/soc/fsl/fsl_sai.c +1 -2
@@ -321,7 +321,6 @@ static int fsl_sai_set_dai_fmt_tr(struct snd_soc_dai *cpu_dai,break ;case SND_SOC_DAIFMT_PDM : val_cr2 |=FSL_SAI_CR2_BCP ; - val_cr4 &= ~FSL_SAI_CR4_MF ; sai->is_pdm_mode = true;break ;case SND_SOC_DAIFMT_RIGHT_J :
@@ -606,7 +605,7 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream, val_cr5 |=FSL_SAI_CR5_WNW (slot_width); val_cr5 |=FSL_SAI_CR5_W0W (slot_width); -if (sai->is_lsb_first || sai->is_pdm_mode) +if (sai->is_lsb_first) val_cr5 |=FSL_SAI_CR5_FBT (0 );else val_cr5 |=FSL_SAI_CR5_FBT (word_width -1 );
Signature · 25 lines
2.51.0 WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP") Cc: [email protected] Tested-by: Luiz Capitulino <[email protected]> Reviewed-by: Gerald Schaefer <[email protected]> Reviewed-by: David Hildenbrand <[email protected]> Signed-off-by: Heiko Carstens <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> --- arch/s390/Kconfig | 1 - 1 file changed, 1 deletion(-) --- a/arch/s390/Kconfig +++ b/arch/s390/Kconfig @@ -151,7 +151,6 @@ config S390 select ARCH_WANT_IRQS_OFF_ACTIVATE_MM select ARCH_WANT_KERNEL_PMD_MKWRITE select ARCH_WANT_LD_ORPHAN_WARN - select ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP select ARCH_WANTS_THP_SWAP select BUILDTIME_TABLE_SORT select CLONE_BACKWARDS2
Greg Kroah-Hartman
maintainerPATCH 39/565 libbpf: Fix powerpcs stack register definition in bpf_tracing.h
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit 7221b9caf84b3294688228a19273d74ea19a2ee4 ]
retsnoop's build on powerpc (ppc64le) architecture ([0]) failed due to wrong definition of PT_REGS_SP() macro. Looking at powerpc's implementation of stack unwinding in perf_callchain_user_64() clearly shows that stack pointer register is gpr[1].
Fix libbpf's definition of __PT_SP_REG for powerpc to fix all this.
[0] https://kojipkgs.fedoraproject.org/work/tasks/1544/137921544/build.log
--- tools/lib/bpf/bpf_tracing.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/lib/bpf/bpf_tracing.h +1 -1
@@ -311,7 +311,7 @@ struct pt_regs___arm64 {#define __PT_RET_REG regs[31]#define __PT_FP_REG __unsupported__#define __PT_RC_REG gpr[3] -#define __PT_SP_REG sp +#define __PT_SP_REG gpr[1]#define __PT_IP_REG nip#elif defined(bpf_target_sparc)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/565 usbnet: Prevents free active kevent
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Xu <[email protected]>
[ Upstream commit 420c84c330d1688b8c764479e5738bbdbf0a33de ]
The root cause of this issue are:
1. When probing the usbnet device, executing usbnet_link_change(dev, 0, 0); put the kevent work in global workqueue. However, the kevent has not yet been scheduled when the usbnet device is unregistered. Therefore, executing free_netdev() results in the "free active object (kevent)" error reported here.
2. Another factor is that when calling usbnet_disconnect()->unregister_netdev(), if the usbnet device is up, ndo_stop() is executed to cancel the kevent. However, because the device is not up, ndo_stop() is not executed.
The solution to this problem is to cancel the kevent before executing free_netdev().
--- drivers/net/usb/usbnet.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/usb/usbnet.c +2 -0
@@ -1650,6 +1650,8 @@ void usbnet_disconnect (struct usb_interface *intf) net = dev->net;unregister_netdev (net); +cancel_work_sync (&dev->kevent); +while ((urb =usb_get_from_anchor (&dev->deferred))) {dev_kfree_skb (urb->context);kfree (urb->sg);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/565 Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <[email protected]>
[ Upstream commit 09b0cd1297b4dbfe736aeaa0ceeab2265f47f772 ]
hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and "UAF".
Fix this by holding cmd_sync_work_lock across both lookup and cancel, so that the entry cannot be removed concurrently.
--- net/bluetooth/hci_sync.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
net/bluetooth/hci_sync.c +9 -3
@@ -863,11 +863,17 @@ bool hci_cmd_sync_dequeue_once(struct hci_dev *hdev, {struct hci_cmd_sync_work_entry *entry; - entry =hci_cmd_sync_lookup_entry (hdev, func, data, destroy); -if (!entry) +mutex_lock (&hdev->cmd_sync_work_lock); + + entry =_hci_cmd_sync_lookup_entry (hdev, func, data, destroy); +if (!entry) { +mutex_unlock (&hdev->cmd_sync_work_lock);return false; + } -hci_cmd_sync_cancel_entry (hdev, entry); +_hci_cmd_sync_cancel_entry (hdev, entry, -ECANCELED ); + +mutex_unlock (&hdev->cmd_sync_work_lock);return true; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/565 Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Iulia Tanasescu <[email protected]>
[ Upstream commit 83d328a72eff3268ea4c19deb0a6cf4c7da15746 ]
Currently, hci_conn_hash_lookup_big only checks for BIS master connections, by filtering out connections with the destination address set. This commit updates this function to also consider BIS slave connections, since it is also used for a Broadcast Receiver to set an available BIG handle before issuing the LE BIG Create Sync command.
Stable-dep-of: f0c200a4a537 ("Bluetooth: ISO: Fix BIS connection dst_type handling")
--- include/net/bluetooth/hci_core.h | 12 +++++++++++- net/bluetooth/hci_event.c | 1 + net/bluetooth/iso.c | 1 - 3 files changed, 12 insertions(+), 2 deletions(-)
include/net/bluetooth/hci_core.h +11 -1
@@ -1315,7 +1315,17 @@ static inline struct hci_conn *hci_conn_hash_lookup_big(struct hci_dev *hdev,rcu_read_lock ();list_for_each_entry_rcu (c, &h->list, list) { -if (bacmp (&c->dst,BDADDR_ANY ) || c->type !=ISO_LINK ) +if (c->type !=ISO_LINK ) +continue ; + +/* An ISO_LINK hcon with BDADDR_ANY as destination +* address is a Broadcast connection. A Broadcast +* slave connection is associated with a PA train, +* so the sync_handle can be used to differentiate +* from unicast. +*/ +if (bacmp (&c->dst,BDADDR_ANY ) && + c->sync_handle ==HCI_SYNC_HANDLE_INVALID )continue ;if (handle == c->iso_qos.bcast.big) {
net/bluetooth/hci_event.c +1 -0
@@ -6976,6 +6976,7 @@ static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data,/* Mark PA sync as established */ set_bit (HCI_CONN_PA_SYNC , &bis->flags); + bis->sync_handle = conn->sync_handle; bis->iso_qos.bcast.big = ev->handle;memset (&interval,0 ,sizeof (interval));memcpy (&interval, ev->latency,sizeof (ev->latency));
net/bluetooth/iso.c +0 -1
@@ -1928,7 +1928,6 @@ static void iso_conn_ready(struct iso_conn *conn)if (!bacmp (&hcon->dst,BDADDR_ANY )) {bacpy (&hcon->dst, &iso_pi (parent)->dst); hcon->dst_type =iso_pi (parent)->dst_type; - hcon->sync_handle =iso_pi (parent)->sync_handle; }if (ev3) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/565 Bluetooth: ISO: Fix BIS connection dst_type handling
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit f0c200a4a537f8f374584a974518b0ce69eda76c ]
Socket dst_type cannot be directly assigned to hci_conn->type since there domain is different which may lead to the wrong address type being used.
--- net/bluetooth/iso.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bluetooth/iso.c +1 -1
@@ -1927,7 +1927,7 @@ static void iso_conn_ready(struct iso_conn *conn)*/ if (!bacmp (&hcon->dst,BDADDR_ANY )) {bacpy (&hcon->dst, &iso_pi (parent)->dst); - hcon->dst_type =iso_pi (parent)->dst_type; + hcon->dst_type =le_addr_type (iso_pi (parent)->dst_type); }if (ev3) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/565 Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Lu <[email protected]>
[ Upstream commit 77343b8b4f87560f8f03e77b98a81ff3a147b262 ]
This patch adds logic to handle power management control when the Bluetooth function is closed during the SDIO reset sequence.
Specifically, if BT is closed before reset, the driver enables the SDIO function and sets driver pmctrl. After reset, if BT remains closed, the driver sets firmware pmctrl and disables the SDIO function.
These changes ensure proper power management and device state consistency across the reset flow.
--- drivers/bluetooth/btmtksdio.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/bluetooth/btmtksdio.c +12 -0
@@ -1270,6 +1270,12 @@ static void btmtksdio_cmd_timeout(struct hci_dev *hdev)sdio_claim_host (bdev->func); +/* set drv_pmctrl if BT is closed before doing reset */ +if (!test_bit (BTMTKSDIO_FUNC_ENABLED , &bdev->tx_state)) { +sdio_enable_func (bdev->func); +btmtksdio_drv_pmctrl (bdev); + } +sdio_writel (bdev->func,C_INT_EN_CLR ,MTK_REG_CHLPCR ,NULL );skb_queue_purge (&bdev->txq);cancel_work_sync (&bdev->txrx_work);
@@ -1285,6 +1291,12 @@ static void btmtksdio_cmd_timeout(struct hci_dev *hdev) goto err; } +/* set fw_pmctrl back if BT is closed after doing reset */ +if (!test_bit (BTMTKSDIO_FUNC_ENABLED , &bdev->tx_state)) { +btmtksdio_fw_pmctrl (bdev); +sdio_disable_func (bdev->func); + } +clear_bit (BTMTKSDIO_PATCH_ENABLED , &bdev->tx_state); err:sdio_release_host (bdev->func);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/565 Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 0d92808024b4e9868cef68d16f121d509843e80e ]
This fixes the state tracking of advertisement set/instance 0x00 which is considered a legacy instance and is not tracked individually by adv_instances list, previously it was assumed that hci_dev itself would track it via HCI_LE_ADV but that is a global state not specifc to instance 0x00, so to fix it a new flag is introduced that only tracks the state of instance 0x00.
--- include/net/bluetooth/hci.h | 1 + net/bluetooth/hci_event.c | 4 ++++ net/bluetooth/hci_sync.c | 5 ++--- 3 files changed, 7 insertions(+), 3 deletions(-)
include/net/bluetooth/hci.h +1 -0
@@ -424,6 +424,7 @@ enum {HCI_USER_CHANNEL ,HCI_EXT_CONFIGURED ,HCI_LE_ADV , +HCI_LE_ADV_0 ,HCI_LE_PER_ADV ,HCI_LE_SCAN , HCI_SSP_ENABLED,
net/bluetooth/hci_event.c +4 -0
@@ -1600,6 +1600,8 @@ static u8 hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev, void *data,if (adv && !adv->periodic) adv->enabled = true; +else if (!set->handle) +hci_dev_set_flag (hdev,HCI_LE_ADV_0 ); conn =hci_lookup_le_connect (hdev);if (conn)
@@ -1610,6 +1612,8 @@ static u8 hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev, void *data,if (cp->num_of_sets) {if (adv) adv->enabled = false; +else if (!set->handle) +hci_dev_clear_flag (hdev,HCI_LE_ADV_0 );/* If just one instance was disabled check if there are * any other instance enabled before clearing HCI_LE_ADV
net/bluetooth/hci_sync.c +2 -3
@@ -2616,9 +2616,8 @@ static int hci_resume_advertising_sync(struct hci_dev *hdev)/* If current advertising instance is set to instance 0x00 * then we need to re-enable it. */ -if (!hdev->cur_adv_instance) - err =hci_enable_ext_advertising_sync (hdev, - hdev->cur_adv_instance); +if (hci_dev_test_and_clear_flag (hdev,HCI_LE_ADV_0 )) + err =hci_enable_ext_advertising_sync (hdev,0x00 ); }else {/* Schedule for most recent instance to be restarted and begin * the software rotation loop
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/565 Bluetooth: ISO: Fix another instance of dst_type handling
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit c403da5e98b04a2aec9cfb25cbeeb28d7ce29975 ]
Socket dst_type cannot be directly assigned to hci_conn->type since there domain is different which may lead to the wrong address type being used.
--- net/bluetooth/iso.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
net/bluetooth/iso.c +7 -1
@@ -1939,7 +1939,13 @@ static void iso_conn_ready(struct iso_conn *conn) }bacpy (&iso_pi (sk)->dst, &hcon->dst); -iso_pi (sk)->dst_type = hcon->dst_type; + +/* Convert from HCI to three-value type */ +if (hcon->dst_type ==ADDR_LE_DEV_PUBLIC ) +iso_pi (sk)->dst_type =BDADDR_LE_PUBLIC ; +else +iso_pi (sk)->dst_type =BDADDR_LE_RANDOM ; +iso_pi (sk)->sync_handle =iso_pi (parent)->sync_handle;memcpy (iso_pi (sk)->base,iso_pi (parent)->base,iso_pi (parent)->base_len);iso_pi (sk)->base_len =iso_pi (parent)->base_len;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/565 wifi: ath11k: avoid bit operation on key flags
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rameshkumar Sundaram <[email protected]>
[ Upstream commit 9c78e747dd4fee6c36fcc926212e20032055cf9d ]
Bitwise operations with WMI_KEY_PAIRWISE (defined as 0) are ineffective and misleading. This results in pairwise key validations added in commit 97acb0259cc9 ("wifi: ath11k: fix group data packet drops during rekey") to always evaluate false and clear key commands for pairwise keys are not honored.
Since firmware supports overwriting the new key without explicitly clearing the previous one, there is no visible impact currently. However, to restore consistency with the previous behavior and improve clarity, replace bitwise operations with direct assignments and comparisons for key flags.
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-02146-QCAHKSWPL_SILICONZ-1
Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
--- drivers/net/wireless/ath/ath11k/mac.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/net/wireless/ath/ath11k/mac.c +5 -5
@@ -1,7 +1,7 @@// SPDX-License-Identifier: BSD-3-Clause-Clear /* * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved. -* Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved. +* Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. */ #include <net/mac80211.h>
@@ -4407,9 +4407,9 @@ static int ath11k_mac_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, }if (key->flags &IEEE80211_KEY_FLAG_PAIRWISE ) - flags |=WMI_KEY_PAIRWISE ; + flags =WMI_KEY_PAIRWISE ;else - flags |=WMI_KEY_GROUP ; + flags =WMI_KEY_GROUP ; ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "%s for peer %pM on vdev %d flags 0x%X, type = %d, num_sta %d\n",
@@ -4446,7 +4446,7 @@ static int ath11k_mac_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, is_ap_with_no_sta = (vif->type ==NL80211_IFTYPE_AP && !arvif->num_stations); -if ((flags &WMI_KEY_PAIRWISE ) || cmd ==SET_KEY || is_ap_with_no_sta) { +if (flags ==WMI_KEY_PAIRWISE || cmd ==SET_KEY || is_ap_with_no_sta) { ret =ath11k_install_key (arvif, key, cmd, peer_addr, flags);if (ret) {ath11k_warn (ab,"ath11k_install_key failed (%d)\n" , ret);
@@ -4460,7 +4460,7 @@ static int ath11k_mac_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, goto exit; } -if ((flags &WMI_KEY_GROUP ) && cmd ==SET_KEY && is_ap_with_no_sta) +if (flags ==WMI_KEY_GROUP && cmd ==SET_KEY && is_ap_with_no_sta) arvif->reinstall_group_keys = true; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/565 Bluetooth: hci_core: Fix tracking of periodic advertisement
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 751463ceefc3397566d03c8b64ef4a77f5fd88ac ]
Periodic advertising enabled flag cannot be tracked by the enabled flag since advertising and periodic advertising each can be enabled/disabled separately from one another causing the states to be inconsistent when for example an advertising set is disabled its enabled flag is set to false which is then used for periodic which has not being disabled.
--- include/net/bluetooth/hci_core.h | 1 + net/bluetooth/hci_event.c | 7 +++++-- net/bluetooth/hci_sync.c | 4 ++-- 3 files changed, 8 insertions(+), 4 deletions(-)
include/net/bluetooth/hci_core.h +1 -0
@@ -240,6 +240,7 @@ struct adv_info {bool enabled;bool pending;bool periodic; +bool periodic_enabled;__u8 mesh;__u8 instance;__u8 handle;
net/bluetooth/hci_event.c +5 -2
@@ -1598,7 +1598,7 @@ static u8 hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev, void *data,hci_dev_set_flag (hdev,HCI_LE_ADV ); -if (adv && !adv->periodic) +if (adv) adv->enabled = true;else if (!set->handle)hci_dev_set_flag (hdev,HCI_LE_ADV_0 );
@@ -3955,8 +3955,11 @@ static u8 hci_cc_le_set_per_adv_enable(struct hci_dev *hdev, void *data,hci_dev_set_flag (hdev,HCI_LE_PER_ADV );if (adv) - adv->enabled = true; + adv->periodic_enabled = true; }else { +if (adv) + adv->periodic_enabled = false; +/* If just one instance was disabled check if there are * any other instance enabled before clearing HCI_LE_PER_ADV. * The current periodic adv instance will be marked as
net/bluetooth/hci_sync.c +2 -2
@@ -1605,7 +1605,7 @@ int hci_disable_per_advertising_sync(struct hci_dev *hdev, u8 instance)/* If periodic advertising already disabled there is nothing to do. */ adv =hci_find_adv_instance (hdev, instance); -if (!adv || !adv->periodic || !adv->enabled) +if (!adv || !adv->periodic_enabled)return 0 ;memset (&cp,0 ,sizeof (cp));
@@ -1670,7 +1670,7 @@ static int hci_enable_per_advertising_sync(struct hci_dev *hdev, u8 instance)/* If periodic advertising already enabled there is nothing to do. */ adv =hci_find_adv_instance (hdev, instance); -if (adv && adv->periodic && adv->enabled) +if (adv && adv->periodic_enabled)return 0 ;memset (&cp,0 ,sizeof (cp));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/565 drm/etnaviv: fix flush sequence logic
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomeu Vizoso <[email protected]>
[ Upstream commit a042beac6e6f8ac1e923784cfff98b47cbabb185 ]
The current logic uses the flush sequence from the current address space. This is harmless when deducing the flush requirements for the current submit, as either the incoming address space is the same one as the currently active one or we switch context, in which case the flush is unconditional.
However, this sequence is also stored as the current flush sequence of the GPU. If we switch context the stored flush sequence will no longer belong to the currently active address space. This incoherency can then cause missed flushes, resulting in translation errors.
--- drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/etnaviv/etnaviv_buffer.c +1 -1
@@ -347,7 +347,7 @@ void etnaviv_buffer_queue(struct etnaviv_gpu *gpu, u32 exec_state,u32 link_target, link_dwords;bool switch_context = gpu->exec_state != exec_state;bool switch_mmu_context = gpu->mmu_context != mmu_context; -unsigned int new_flush_seq =READ_ONCE (gpu->mmu_context->flush_seq); +unsigned int new_flush_seq =READ_ONCE (mmu_context->flush_seq);bool need_flush = switch_mmu_context || gpu->flush_seq != new_flush_seq;bool has_blt = !!(gpu->identity.minor_features5 & chipMinorFeatures5_BLT_ENGINE);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/565 tools: ynl: fix string attribute length to include null terminator
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Oros <[email protected]>
[ Upstream commit 65f9c4c5888913c2cf5d2fc9454c83f9930d537d ]
The ynl_attr_put_str() function was not including the null terminator in the attribute length calculation. This caused kernel to reject CTRL_CMD_GETFAMILY requests with EINVAL:
"Attribute failed policy validation".
For a 4-character family name like "dpll":
- Sent: nla_len=8 (4 byte header + 4 byte string without null)
- Expected: nla_len=9 (4 byte header + 5 byte string with null)
The bug was introduced in commit 15d2540e0d62 ("tools: ynl: check for overflow of constructed messages") when refactoring from stpcpy() to strlen(). The original code correctly included the null terminator:
end = stpcpy(ynl_attr_data(attr), str);
attr->nla_len = NLA_HDRLEN + NLA_ALIGN(end -
(char *)ynl_attr_data(attr));Since stpcpy() returns a pointer past the null terminator, the length included it. The refactored version using strlen() omitted the +1.
The fix also removes NLA_ALIGN() from nla_len calculation, since nla_len should contain actual attribute length, not aligned length. Alignment is only for calculating next attribute position. This makes the code consistent with ynl_attr_put().
CTRL_ATTR_FAMILY_NAME uses NLA_NUL_STRING policy which requires null terminator. Kernel validates with memchr() and rejects if not found.
--- tools/net/ynl/lib/ynl-priv.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/net/ynl/lib/ynl-priv.h +2 -2
@@ -301,7 +301,7 @@ ynl_attr_put_str(struct nlmsghdr *nlh, unsigned int attr_type, const char *str)struct nlattr *attr;size_t len; - len =strlen (str); + len =strlen (str) +1 ;if (__ynl_attr_put_overflow (nlh, len))return ;
@@ -309,7 +309,7 @@ ynl_attr_put_str(struct nlmsghdr *nlh, unsigned int attr_type, const char *str) attr->nla_type = attr_type;strcpy ((char *)ynl_attr_data (attr), str); - attr->nla_len =NLA_HDRLEN +NLA_ALIGN (len); + attr->nla_len =NLA_HDRLEN + len; nlh->nlmsg_len +=NLMSG_ALIGN (attr->nla_len); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/565 net: hns3: return error code when function fails
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jijie Shao <[email protected]>
[ Upstream commit 03ca7c8c42be913529eb9f188278114430c6abbd ]
Currently, in hclge_mii_ioctl(), the operation to read the PHY register (SIOCGMIIREG) always returns 0.
This patch changes the return type of hclge_read_phy_reg(), returning an error code when the function fails.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 3 +-- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c | 9 ++++++--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h | 2 +- 3 files changed, 8 insertions(+), 6 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +1 -2
@@ -9439,8 +9439,7 @@ static int hclge_mii_ioctl(struct hclge_dev *hdev, struct ifreq *ifr, int cmd)/* this command reads phy id and register at the same time */ fallthrough;case SIOCGMIIREG : - data->val_out =hclge_read_phy_reg (hdev, data->reg_num); -return 0 ; +return hclge_read_phy_reg (hdev, data->reg_num, &data->val_out);case SIOCSMIIREG :return hclge_write_phy_reg (hdev, data->reg_num, data->val_in);
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c +6 -3
@@ -274,7 +274,7 @@ void hclge_mac_stop_phy(struct hclge_dev *hdev)phy_stop (phydev); } -u16 hclge_read_phy_reg (struct hclge_dev *hdev,u16 reg_addr) +int hclge_read_phy_reg (struct hclge_dev *hdev,u16 reg_addr,u16 *val) {struct hclge_phy_reg_cmd *req;struct hclge_desc desc;
@@ -286,11 +286,14 @@ u16 hclge_read_phy_reg(struct hclge_dev *hdev, u16 reg_addr) req->reg_addr =cpu_to_le16 (reg_addr); ret =hclge_cmd_send (&hdev->hw, &desc,1 ); -if (ret) +if (ret) {dev_err (&hdev->pdev->dev,"failed to read phy reg, ret = %d.\n" , ret); +return ret; + } -return le16_to_cpu (req->reg_val); + *val =le16_to_cpu (req->reg_val); +return 0 ; }int hclge_write_phy_reg (struct hclge_dev *hdev,u16 reg_addr,u16 val)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h +1 -1
@@ -13,7 +13,7 @@ int hclge_mac_connect_phy(struct hnae3_handle *handle);void hclge_mac_disconnect_phy (struct hnae3_handle *handle);void hclge_mac_start_phy (struct hclge_dev *hdev);void hclge_mac_stop_phy (struct hclge_dev *hdev); -u16 hclge_read_phy_reg (struct hclge_dev *hdev,u16 reg_addr); +int hclge_read_phy_reg (struct hclge_dev *hdev,u16 reg_addr,u16 *val);int hclge_write_phy_reg (struct hclge_dev *hdev,u16 reg_addr,u16 val);#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/565 sfc: fix potential memory leak in efx_mae_process_mport()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit 46a499aaf8c27476fd05e800f3e947bfd71aa724 ]
In efx_mae_enumerate_mports(), memory allocated for mae_mport_desc is passed as a argument to efx_mae_process_mport(), but when the error path in efx_mae_process_mport() gets executed, the memory allocated for desc gets leaked.
Fix that by freeing the memory allocation before returning error.
--- drivers/net/ethernet/sfc/mae.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/sfc/mae.c +4 -0
@@ -1101,6 +1101,9 @@ void efx_mae_remove_mport(void *desc, void *arg)kfree (mport); } +/* +* Takes ownership of @desc, even if it returns an error +*/ static int efx_mae_process_mport (struct efx_nic *efx,struct mae_mport_desc *desc) {
@@ -1111,6 +1114,7 @@ static int efx_mae_process_mport(struct efx_nic *efx,if (!IS_ERR_OR_NULL (mport)) {netif_err (efx, drv, efx->net_dev,"mport with id %u does exist!!!\n" , desc->mport_id); +kfree (desc);return -EEXIST ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/565 dpll: spec: add missing module-name and clock-id to pin-get reply
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Oros <[email protected]>
[ Upstream commit 520ad9e96937e825a117e9f00dd35a3e199d67b5 ]
The dpll.yaml spec incorrectly omitted module-name and clock-id from the pin-get operation reply specification, even though the kernel DPLL implementation has always included these attributes in pin-get responses since the initial implementation.
This spec inconsistency caused issues with the C YNL code generator. The generated dpll_pin_get_rsp structure was missing these fields.
Fix the spec by adding module-name and clock-id to the pin-attrs reply specification to match the actual kernel behavior.
--- Documentation/netlink/specs/dpll.yaml | 2 ++ 1 file changed, 2 insertions(+)
Documentation/netlink/specs/dpll.yaml +2 -0
@@ -517,6 +517,8 @@ operations: reply: &pin-attrs attributes: - id + - module-name + - clock-id - board-label - panel-label - package-label
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/565 ASoC: fsl_sai: Fix sync error in consumer mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maarten Zanders <[email protected]>
[ Upstream commit b2dd1d0d322dce5f331961c927e775b84014d5ab ]
When configured for default synchronisation (Rx syncs to Tx) and the SAI operates in consumer mode (clocks provided externally to Tx), a synchronisation error occurs on Tx on the first attempt after device initialisation when the playback stream is started while a capture stream is already active. This results in channel shift/swap on the playback stream.
Subsequent streams (ie after that first failing one) always work correctly, no matter the order, with or without the other stream active.
This issue was observed (and fix tested) on an i.MX6UL board connected to an ADAU1761 codec, where the codec provides both frame and bit clock (connected to TX pins).
To fix this, always initialize the 'other' xCR4 and xCR5 registers when we're starting a stream which is synced to the opposite one, irregardless of the producer/consumer status.
--- sound/soc/fsl/fsl_sai.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
sound/soc/fsl/fsl_sai.c +4 -4
@@ -620,12 +620,12 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream, val_cr4 |=FSL_SAI_CR4_CHMOD ;/* -* For SAI provider mode, when Tx(Rx) sync with Rx(Tx) clock, Rx(Tx) will -* generate bclk and frame clock for Tx(Rx), we should set RCR4(TCR4), -* RCR5(TCR5) for playback(capture), or there will be sync error. +* When Tx(Rx) sync with Rx(Tx) clock, Rx(Tx) will provide bclk and +* frame clock for Tx(Rx). We should set RCR4(TCR4), RCR5(TCR5) +* for playback(capture), or there will be sync error. */ -if (!sai->is_consumer_mode[tx] &&fsl_sai_dir_is_synced (sai, adir)) { +if (fsl_sai_dir_is_synced (sai, adir)) { regmap_update_bits(sai->regmap, FSL_SAI_xCR4(!tx, ofs), FSL_SAI_CR4_SYWD_MASK | FSL_SAI_CR4_FRSZ_MASK | FSL_SAI_CR4_CHMOD_MASK,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/565 drm/radeon: Do not kfree() devres managed rdev
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Palmer <[email protected]>
[ Upstream commit 3328443363a0895fd9c096edfe8ecd372ca9145e ]
Since the allocation of the drivers main structure was changed to devm_drm_dev_alloc() rdev is managed by devres and we shouldn't be calling kfree() on it.
This fixes things exploding if the driver probe fails and devres cleans up the rdev after we already free'd it.
--- drivers/gpu/drm/radeon/radeon_kms.c | 1 - 1 file changed, 1 deletion(-)
drivers/gpu/drm/radeon/radeon_kms.c +0 -1
@@ -84,7 +84,6 @@ void radeon_driver_unload_kms(struct drm_device *dev) rdev->agp =NULL ; done_free: -kfree (rdev); dev->dev_private =NULL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/565 drm/radeon: Remove calls to drm_put_dev()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Palmer <[email protected]>
[ Upstream commit 745bae76acdd71709773c129a69deca01036250b ]
Since the allocation of the drivers main structure was changed to devm_drm_dev_alloc() drm_put_dev()'ing to trigger it to be free'd should be done by devres.
However, drm_put_dev() is still in the probe error and device remove paths. When the driver fails to probe warnings like the following are shown because devres is trying to drm_put_dev() after the driver already did it.
[ 5.642230] radeon 0000:01:05.0: probe with driver radeon failed with error -22 [ 5.649605] ------------[ cut here ]------------ [ 5.649607] refcount_t: underflow; use-after-free. [ 5.649620] WARNING: CPU: 0 PID: 357 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110
--- drivers/gpu/drm/radeon/radeon_drv.c | 25 ++++--------------------- 1 file changed, 4 insertions(+), 21 deletions(-)
drivers/gpu/drm/radeon/radeon_drv.c +4 -21
@@ -312,46 +312,30 @@ static int radeon_pci_probe(struct pci_dev *pdev, ret =pci_enable_device (pdev);if (ret) - goto err_free; +return ret;pci_set_drvdata (pdev, ddev); ret =radeon_driver_load_kms (ddev, flags);if (ret) - goto err_agp; + goto err; ret =drm_dev_register (ddev, flags);if (ret) - goto err_agp; + goto err;radeon_fbdev_setup (ddev->dev_private);return 0 ; -err_agp: +err:pci_disable_device (pdev); -err_free: -drm_dev_put (ddev);return ret; } -static void -radeon_pci_remove (struct pci_dev *pdev) -{ -struct drm_device *dev =pci_get_drvdata (pdev); - -drm_put_dev (dev); -} -static void radeon_pci_shutdown (struct pci_dev *pdev) { -/* if we are running in a VM, make sure the device -* torn down properly on reboot/shutdown -*/ -if (radeon_device_is_virtual ()) -radeon_pci_remove (pdev); -#if defined(CONFIG_PPC64 ) || defined(CONFIG_MACH_LOONGSON64 )/* * Some adapters need to be suspended before a
@@ -603,7 +587,6 @@ static struct pci_driver radeon_kms_pci_driver = { .name = DRIVER_NAME, .id_table = pciidlist, .probe = radeon_pci_probe, - .remove = radeon_pci_remove, .shutdown = radeon_pci_shutdown, .driver.pm = &radeon_pm_ops, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/565 drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <[email protected]>
[ Upstream commit 238d468d3ed18a324bb9d8c99f18c665dbac0511 ]
'table_index' is a variable defined by the smu driver (kmd) 'table_id' is a variable defined by the hw smu (pmfw)
This code should use table_index as a bounds check.
--- drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c +1 -1
@@ -955,7 +955,7 @@ int smu_cmn_update_table(struct smu_context *smu, table_index);uint32_t table_size;int ret =0 ; -if (!table_data || table_id >=SMU_TABLE_COUNT || table_id <0 ) +if (!table_data || table_index >=SMU_TABLE_COUNT || table_id <0 )return -EINVAL ; table_size = smu_table->tables[table_index].size;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/565 drm/msm/a6xx: Fix GMU firmware parser
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil P Oommen <[email protected]>
[ Upstream commit b4789aac9d3441d9f830f0a4022d8dc122d6cab3 ]
Current parser logic for GMU firmware assumes a dword aligned payload size for every block. This is not true for all GMU firmwares. So, fix this by using correct 'size' value in the calculation for the offset for the next block's header.
Patchwork: https://patchwork.freedesktop.org/patch/674040/
Message-ID: <[email protected]>
--- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/adreno/a6xx_gmu.c +4 -1
@@ -730,6 +730,9 @@ static bool fw_block_mem(struct a6xx_gmu_bo *bo, const struct block_header *blk)return true; } +#define NEXT_BLK (blk) \ + ((const struct block_header *)((const char *)(blk) + sizeof(*(blk)) + (blk)->size)) +static int a6xx_gmu_fw_load (struct a6xx_gmu *gmu) { struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu);
@@ -760,7 +763,7 @@ static int a6xx_gmu_fw_load(struct a6xx_gmu *gmu)for (blk = (const struct block_header *) fw_image->data; (const u8 *) blk < fw_image->data + fw_image->size; - blk = (const struct block_header *) &blk->data[blk->size >>2 ]) { + blk =NEXT_BLK (blk)) {if (blk->size ==0 )continue ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/565 drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Smith <[email protected]>
[ Upstream commit 07a13f913c291d6ec72ee4fc848d13ecfdc0e705 ]
Previously this was initialized with zero which represented PCIe Gen 1.0 instead of using the
maximum value from the speed table which is the behaviour of all other smumgr implementations.
--- drivers/gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c +1 -1
@@ -2024,7 +2024,7 @@ static int fiji_init_smc_table(struct pp_hwmgr *hwmgr) table->VoltageResponseTime =0 ; table->PhaseResponseTime =0 ; table->MemoryThermThrottleEnable =1 ; - table->PCIeBootLinkLevel =0 ;/* 0:Gen1 1:Gen2 2:Gen3*/ + table->PCIeBootLinkLevel = (uint8_t ) (data->dpm_table.pcie_speed_table.count); table->PCIeGenInterval =1 ; table->VRConfig =0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/565 drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Smith <[email protected]>
[ Upstream commit 501672e3c1576aa9a8364144213c77b98a31a42c ]
Previously this was initialized with zero which represented PCIe Gen 1.0 instead of using the
maximum value from the speed table which is the behaviour of all other smumgr implementations.
--- drivers/gpu/drm/amd/pm/powerplay/smumgr/iceland_smumgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/powerplay/smumgr/iceland_smumgr.c +1 -1
@@ -2028,7 +2028,7 @@ static int iceland_init_smc_table(struct pp_hwmgr *hwmgr) table->VoltageResponseTime =0 ; table->PhaseResponseTime =0 ; table->MemoryThermThrottleEnable =1 ; - table->PCIeBootLinkLevel =0 ; + table->PCIeBootLinkLevel = (uint8_t ) (data->dpm_table.pcie_speed_table.count); table->PCIeGenInterval =1 ; result =iceland_populate_smc_svi2_config (hwmgr, table);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/565 ACPI: fan: Use ACPI handle when retrieving _FST
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
commit 58764259ebe0c9efd569194444629f6b26f86583 upstream.
Usage of the ACPI device should be phased out in the future, as the driver itself is now using the platform bus.
Replace any usage of struct acpi_device in acpi_fan_get_fst() to allow users to drop usage of struct acpi_device.
Also extend the integer check to all three package elements.
--- drivers/acpi/fan.h | 3 ++- drivers/acpi/fan_attr.c | 2 +- drivers/acpi/fan_core.c | 34 ++++++++++++++++++++++------------ drivers/acpi/fan_hwmon.c | 3 +-- 4 files changed, 26 insertions(+), 16 deletions(-)
drivers/acpi/fan.h +2 -1
@@ -47,6 +47,7 @@ struct acpi_fan_fst { };struct acpi_fan { +acpi_handle handle;bool acpi4;struct acpi_fan_fif fif;struct acpi_fan_fps *fps;
@@ -56,7 +57,7 @@ struct acpi_fan {struct device_attribute fine_grain_control; }; -int acpi_fan_get_fst (struct acpi_device *device,struct acpi_fan_fst *fst); +int acpi_fan_get_fst (acpi_handle handle,struct acpi_fan_fst *fst);int acpi_fan_create_attributes (struct acpi_device *device);void acpi_fan_delete_attributes (struct acpi_device *device);
drivers/acpi/fan_attr.c +1 -1
@@ -55,7 +55,7 @@ static ssize_t show_fan_speed(struct devstruct acpi_fan_fst fst;int status; - status =acpi_fan_get_fst (acpi_dev, &fst); + status =acpi_fan_get_fst (acpi_dev->handle, &fst);if (status)return status;
drivers/acpi/fan_core.c +22 -12
@@ -44,25 +44,30 @@ static int fan_get_max_state(struct therreturn 0 ; } -int acpi_fan_get_fst (struct acpi_device *device,struct acpi_fan_fst *fst) +int acpi_fan_get_fst (acpi_handle handle,struct acpi_fan_fst *fst) {struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER ,NULL };union acpi_object *obj;acpi_status status;int ret =0 ; - status =acpi_evaluate_object (device->handle,"_FST" ,NULL , &buffer); -if (ACPI_FAILURE (status)) { -dev_err (&device->dev,"Get fan state failed\n" ); -return -ENODEV ; - } + status =acpi_evaluate_object (handle,"_FST" ,NULL , &buffer); +if (ACPI_FAILURE (status)) +return -EIO ; obj = buffer.pointer; -if (!obj || obj->type !=ACPI_TYPE_PACKAGE || - obj->package.count !=3 || - obj->package.elements[1 ].type !=ACPI_TYPE_INTEGER ) { -dev_err (&device->dev,"Invalid _FST data\n" ); - ret = -EINVAL ; +if (!obj) +return -ENODATA ; + +if (obj->type !=ACPI_TYPE_PACKAGE || obj->package.count !=3 ) { + ret = -EPROTO ; + goto err; + } + +if (obj->package.elements[0 ].type !=ACPI_TYPE_INTEGER || + obj->package.elements[1 ].type !=ACPI_TYPE_INTEGER || + obj->package.elements[2 ].type !=ACPI_TYPE_INTEGER ) { + ret = -EPROTO ; goto err; }
@@ -81,7 +86,7 @@ static int fan_get_state_acpi4(struct acstruct acpi_fan_fst fst;int status, i; - status =acpi_fan_get_fst (device, &fst); + status =acpi_fan_get_fst (device->handle, &fst);if (status)return status;
@@ -319,11 +324,16 @@ static int acpi_fan_probe(struct platforstruct acpi_device *device =ACPI_COMPANION (&pdev->dev);char *name; +if (!device) +return -ENODEV ; + fan =devm_kzalloc (&pdev->dev,sizeof (*fan),GFP_KERNEL );if (!fan) {dev_err (&device->dev,"No memory for fan\n" );return -ENOMEM ; } + + fan->handle = device->handle; device->driver_data = fan;platform_set_drvdata (pdev, fan);
drivers/acpi/fan_hwmon.c +1 -2
@@ -85,13 +85,12 @@ static umode_t acpi_fan_hwmon_is_visiblestatic int acpi_fan_hwmon_read (struct device *dev,enum hwmon_sensor_types type,u32 attr,int channel,long *val) { -struct acpi_device *adev =to_acpi_device (dev->parent);struct acpi_fan *fan =dev_get_drvdata (dev);struct acpi_fan_fps *fps;struct acpi_fan_fst fst;int ret; - ret =acpi_fan_get_fst (adev, &fst); + ret =acpi_fan_get_fst (fan->handle, &fst);if (ret <0 )return ret;
Greg Kroah-Hartman
maintainerPATCH 60/565 block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit 12a1c9353c47c0fb3464eba2d78cdf649dee1cf7 upstream.
REQ_OP_ZONE_RESET_ALL is a zone management request. Fix op_is_zone_mgmt() to return true for that operation, like it already does for REQ_OP_ZONE_RESET.
While no problems were reported without this fix, this change allows strengthening checks in various block device drivers (scsi sd, virtioblk, DM) where op_is_zone_mgmt() is used to verify that a zone management command is not being issued to a regular block device.
--- include/linux/blk_types.h | 1 + 1 file changed, 1 insertion(+)
include/linux/blk_types.h +1 -0
@@ -473,6 +473,7 @@ static inline bool op_is_zone_mgmt(enum {switch (op &REQ_OP_MASK ) {case REQ_OP_ZONE_RESET : +case REQ_OP_ZONE_RESET_ALL :case REQ_OP_ZONE_OPEN :case REQ_OP_ZONE_CLOSE :case REQ_OP_ZONE_FINISH :
Greg Kroah-Hartman
maintainerPATCH 61/565 block: make REQ_OP_ZONE_OPEN a write operation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit 19de03b312d69a7e9bacb51c806c6e3f4207376c upstream.
A REQ_OP_OPEN_ZONE request changes the condition of a sequential zone of a zoned block device to the explicitly open condition (BLK_ZONE_COND_EXP_OPEN). As such, it should be considered a write operation.
Change this operation code to be an odd number to reflect this. The following operation numbers are changed to keep the numbering compact.
No problems were reported without this change as this operation has no data. However, this unifies the zone operation to reflect that they modify the device state and also allows strengthening checks in the block layer, e.g. checking if this operation is not issued against a read-only device.
--- include/linux/blk_types.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
include/linux/blk_types.h +5 -5
@@ -338,15 +338,15 @@ enum req_op {/* write the zero filled sector many times */ REQ_OP_WRITE_ZEROES = (__force blk_opf_t )9 ,/* Open a zone */ -REQ_OP_ZONE_OPEN = (__force blk_opf_t )10 , +REQ_OP_ZONE_OPEN = (__force blk_opf_t )11 ,/* Close a zone */ -REQ_OP_ZONE_CLOSE = (__force blk_opf_t )11 , +REQ_OP_ZONE_CLOSE = (__force blk_opf_t )13 ,/* Transition a zone to full */ -REQ_OP_ZONE_FINISH = (__force blk_opf_t )13 , +REQ_OP_ZONE_FINISH = (__force blk_opf_t )15 ,/* reset a zone write pointer */ -REQ_OP_ZONE_RESET = (__force blk_opf_t )15 , +REQ_OP_ZONE_RESET = (__force blk_opf_t )17 ,/* reset all the zone present on the device */ -REQ_OP_ZONE_RESET_ALL = (__force blk_opf_t )17 , +REQ_OP_ZONE_RESET_ALL = (__force blk_opf_t )19 ,/* Driver private requests */ REQ_OP_DRV_IN = (__force blk_opf_t)34,
Greg Kroah-Hartman
maintainerPATCH 62/565 perf/x86/intel: Fix KASAN global-out-of-bounds warning
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dapeng Mi <[email protected]>
commit 0ba6502ce167fc3d598c08c2cc3b4ed7ca5aa251 upstream.
When running "perf mem record" command on CWF, the below KASAN global-out-of-bounds warning is seen.
==================================================================
BUG: KASAN: global-out-of-bounds in cmt_latency_data+0x176/0x1b0 Read of size 4 at addr ffffffffb721d000 by task dtlb/9850 Call Trace: kasan_report+0xb8/0xf0 cmt_latency_data+0x176/0x1b0 setup_arch_pebs_sample_data+0xf49/0x2560 intel_pmu_drain_arch_pebs+0x577/0xb00 handle_pmi_common+0x6c4/0xc80
The issue is caused by below code in __grt_latency_data(). The code tries to access x86_hybrid_pmu structure which doesn't exist on non-hybrid platform like CWF.
WARN_ON_ONCE(hybrid_pmu(event->pmu)->pmu_type == hybrid_big)
So add is_hybrid() check before calling this WARN_ON_ONCE to fix the global-out-of-bounds access issue.
--- arch/x86/events/intel/ds.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/events/intel/ds.c +2 -1
@@ -305,7 +305,8 @@ static u64 __grt_latency_data(struct per {u64 val; -WARN_ON_ONCE (hybrid_pmu (event->pmu)->pmu_type == hybrid_big); +WARN_ON_ONCE (is_hybrid () && +hybrid_pmu (event->pmu)->pmu_type == hybrid_big); dse &=PERF_PEBS_DATA_SOURCE_GRT_MASK ; val =hybrid_var (event->pmu, pebs_data_source)[dse];
Greg Kroah-Hartman
maintainerPATCH 25/565 ALSA: usb-audio: fix control pipe direction
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roy Vegard Ovesen <[email protected]>
[ Upstream commit 7963891f7c9c6f759cc9ab7da71406b4234f3dd6 ]
Since the requesttype has USB_DIR_OUT the pipe should be constructed with usb_sndctrlpipe().
--- sound/usb/mixer_s1810c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/mixer_s1810c.c +1 -1
@@ -181,7 +181,7 @@ snd_sc1810c_get_status_field(struct usb_device *dev, pkt_out.fields[SC1810C_STATE_F1_IDX ] =SC1810C_SET_STATE_F1 ; pkt_out.fields[SC1810C_STATE_F2_IDX ] =SC1810C_SET_STATE_F2 ; - ret =snd_usb_ctl_msg (dev,usb_rcvctrlpipe (dev,0 ), + ret =snd_usb_ctl_msg (dev,usb_sndctrlpipe (dev,0 ),SC1810C_SET_STATE_REQ ,SC1810C_SET_STATE_REQTYPE , (*seqnum),0 , &pkt_out,sizeof (pkt_out));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 65/565 drm/xe: Do not wake device during a GT reset
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Brost <[email protected]>
commit b3fbda1a630a9439c885b2a5dc5230cc49a87e9e upstream.
Waking the device during a GT reset can lead to unintended memory allocation, which is not allowed since GT resets occur in the reclaim path. Prevent this by holding a PM reference while a reset is in flight.
--- drivers/gpu/drm/xe/xe_gt.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
drivers/gpu/drm/xe/xe_gt.c +12 -7
@@ -746,17 +746,19 @@ static int gt_reset(struct xe_gt *gt) {int err; -if (xe_device_wedged (gt_to_xe (gt))) -return -ECANCELED ; +if (xe_device_wedged (gt_to_xe (gt))) { + err = -ECANCELED ; + goto err_pm_put; + }/* We only support GT resets with GuC submission */ -if (!xe_device_uc_enabled (gt_to_xe (gt))) -return -ENODEV ; +if (!xe_device_uc_enabled (gt_to_xe (gt))) { + err = -ENODEV ; + goto err_pm_put; + }xe_gt_info (gt,"reset started\n" ); -xe_pm_runtime_get (gt_to_xe (gt)); -if (xe_fault_inject_gt_reset ()) { err = -ECANCELED ; goto err_fail;
@@ -803,6 +805,7 @@ err_fail:xe_gt_err (gt,"reset failed (%pe)\n" ,ERR_PTR (err));xe_device_declare_wedged (gt_to_xe (gt)); +err_pm_put:xe_pm_runtime_put (gt_to_xe (gt));return err;
@@ -824,7 +827,9 @@ void xe_gt_reset_async(struct xe_gt *gt)return ;xe_gt_info (gt,"reset queued\n" ); -queue_work (gt->ordered_wq, >->reset.worker); +xe_pm_runtime_get_noresume (gt_to_xe (gt)); +if (!queue_work (gt->ordered_wq, >->reset.worker)) +xe_pm_runtime_put (gt_to_xe (gt)); }void xe_gt_suspend_prepare (struct xe_gt *gt)
Greg Kroah-Hartman
maintainerPATCH 66/565 drm/sysfb: Do not dereference NULL pointer in plane reset
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
commit 14e02ed3876f4ab0ed6d3f41972175f8b8df3d70 upstream.
The plane state in __drm_gem_reset_shadow_plane() can be NULL. Do not deref that pointer, but forward NULL to the other plane-reset helpers. Clears plane->state to NULL.
v2:
- fix typo in commit description (Javier)
--- drivers/gpu/drm/drm_gem_atomic_helper.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/gpu/drm/drm_gem_atomic_helper.c +6 -2
@@ -309,8 +309,12 @@ EXPORT_SYMBOL(drm_gem_destroy_shadow_plavoid __drm_gem_reset_shadow_plane (struct drm_plane *plane,struct drm_shadow_plane_state *shadow_plane_state) { -__drm_atomic_helper_plane_reset (plane, &shadow_plane_state->base); -drm_format_conv_state_init (&shadow_plane_state->fmtcnv_state); +if (shadow_plane_state) { +__drm_atomic_helper_plane_reset (plane, &shadow_plane_state->base); +drm_format_conv_state_init (&shadow_plane_state->fmtcnv_state); + }else { +__drm_atomic_helper_plane_reset (plane,NULL ); + } }EXPORT_SYMBOL (__drm_gem_reset_shadow_plane);
Greg Kroah-Hartman
maintainerPATCH 67/565 drm/sched: avoid killing parent entity on child SIGKILL
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Rosca <[email protected]>
commit 9e8b3201c7302d5b522ba3535630bed21cc03c27 upstream.
The DRM scheduler tracks who last uses an entity and when that process is killed blocks all further submissions to that entity.
The problem is that we didn't track who initially created an entity, so when a process accidently leaked its file descriptor to a child and that child got killed, we killed the parent's entities.
Avoid that and instead initialize the entities last user on entity creation. This also allows to drop the extra NULL check.
--- drivers/gpu/drm/scheduler/sched_entity.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/scheduler/sched_entity.c +2 -1
@@ -71,6 +71,7 @@ int drm_sched_entity_init(struct drm_sch entity->guilty = guilty; entity->num_sched_list = num_sched_list; entity->priority = priority; + entity->last_user = current->group_leader;/* * It's perfectly valid to initialize an entity without having a valid * scheduler attached. It's just not valid to use the scheduler before it
@@ -315,7 +316,7 @@ long drm_sched_entity_flush(struct drm_s/* For killed process disable any more IBs enqueue right now */ last_user =cmpxchg (&entity->last_user, current->group_leader,NULL ); -if ((!last_user || last_user == current->group_leader) && +if (last_user == current->group_leader && (current->flags &PF_EXITING ) && (current->exit_code ==SIGKILL ))drm_sched_entity_kill (entity);
Greg Kroah-Hartman
maintainerPATCH 68/565 drm/nouveau: Fix race in nouveau_sched_fini()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Stanner <[email protected]>
commit e0023c8a74028739643aa14bd201c41a99866ca4 upstream.
nouveau_sched_fini() uses a memory barrier before wait_event(). wait_event(), however, is a macro which expands to a loop which might check the passed condition several times. The barrier would only take effect for the first check.
Replace the barrier with a function which takes the spinlock.
--- drivers/gpu/drm/nouveau/nouveau_sched.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/gpu/drm/nouveau/nouveau_sched.c +12 -2
@@ -475,6 +475,17 @@ nouveau_sched_create(struct nouveau_schereturn 0 ; } +static bool +nouveau_sched_job_list_empty (struct nouveau_sched *sched) +{ +bool empty; + +spin_lock (&sched->job.list.lock); + empty =list_empty (&sched->job.list.head); +spin_unlock (&sched->job.list.lock); + +return empty; +}static void nouveau_sched_fini (struct nouveau_sched *sched)
@@ -482,8 +493,7 @@ nouveau_sched_fini(struct nouveau_schedstruct drm_gpu_scheduler *drm_sched = &sched->base;struct drm_sched_entity *entity = &sched->entity; -rmb ();/* for list_empty to work without lock */ -wait_event (sched->job.wq,list_empty (&sched->job.list.head)); +wait_event (sched->job.wq,nouveau_sched_job_list_empty (sched));drm_sched_entity_fini (entity);drm_sched_fini (drm_sched);
Greg Kroah-Hartman
maintainerPATCH 69/565 drm/mediatek: Fix device use-after-free on unbind
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 926d002e6d7e2f1fd5c1b53cf6208153ee7d380d upstream.
A recent change fixed device reference leaks when looking up drm platform device driver data during bind() but failed to remove a partial fix which had been added by commit 80805b62ea5b ("drm/mediatek: Fix kobject put for component sub-drivers").
This results in a reference imbalance on component bind() failures and on unbind() which could lead to a user-after-free.
Make sure to only drop the references after retrieving the driver data by effectively reverting the previous partial fix.
Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference.
--- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 10 ---------- 1 file changed, 10 deletions(-)
drivers/gpu/drm/mediatek/mtk_drm_drv.c +0 -10
@@ -684,10 +684,6 @@ err_free:for (i =0 ; i < private->data->mmsys_dev_num; i++) private->all_drm_private[i]->drm =NULL ; err_put_dev: -for (i =0 ; i < private->data->mmsys_dev_num; i++) { -/* For device_find_child in mtk_drm_get_all_priv() */ -put_device (private->all_drm_private[i]->dev); - }put_device (private->mutex_dev);return ret; }
@@ -695,18 +691,12 @@ err_put_dev:static void mtk_drm_unbind (struct device *dev) {struct mtk_drm_private *private =dev_get_drvdata (dev); -int i;/* for multi mmsys dev, unregister drm dev in mmsys master */ if (private->drm_master) {drm_dev_unregister (private->drm);mtk_drm_kms_deinit (private->drm);drm_dev_put (private->drm); - -for (i =0 ; i < private->data->mmsys_dev_num; i++) { -/* For device_find_child in mtk_drm_get_all_priv() */ -put_device (private->all_drm_private[i]->dev); - }put_device (private->mutex_dev); } private->mtk_drm_bound = false;
Greg Kroah-Hartman
maintainerPATCH 70/565 drm/ast: Clear preserved bits from register output value
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
commit a9fb41b5def8e1e0103d5fd1453787993587281e upstream.
Preserve the I/O register bits in __ast_write8_i_masked() as specified by preserve_mask. Accidentally OR-ing the output value into these will overwrite the register's previous settings.
Fixes display output on the AST2300, where the screen can go blank at boot. The driver's original commit 312fec1405dd ("drm: Initial KMS driver for AST (ASpeed Technologies) 2000 series (v2)") already added the broken code. Commit 6f719373b943 ("drm/ast: Blank with VGACR17 sync enable, always clear VGACRB6 sync off") triggered the bug.
--- drivers/gpu/drm/ast/ast_drv.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/ast/ast_drv.h +4 -4
@@ -286,13 +286,13 @@ static inline void __ast_write8_i(void ___ast_write8 (addr, reg +1 , val); } -static inline void __ast_write8_i_masked (void __iomem *addr,u32 reg,u8 index,u8 read_mask, +static inline void __ast_write8_i_masked (void __iomem *addr,u32 reg,u8 index,u8 preserve_mask,u8 val) { -u8 tmp =__ast_read8_i_masked (addr, reg, index, read_mask); +u8 tmp =__ast_read8_i_masked (addr, reg, index, preserve_mask); - tmp |= val; -__ast_write8_i (addr, reg, index, tmp); + val &= ~preserve_mask; +__ast_write8_i (addr, reg, index, tmp | val); }static inline u32 ast_read32 (struct ast_device *ast,u32 reg)
Greg Kroah-Hartman
maintainerPATCH 71/565 drm/amd: Check that VPE has reached DPM0 in idle handler
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
commit ba10f8d92a2c026b1052b4c0fa2cd7538838c965 upstream.
[Why]
Newer VPE microcode has functionality that will decrease DPM level only when a workload has run for 2 or more seconds. If VPE is turned off before this DPM decrease and the PMFW doesn't reset it when power gating VPE, the SOC can get stuck with a higher DPM level.
This can happen from amdgpu's ring buffer test because it's a short quick workload for VPE and VPE is turned off after 1s.
[How]
In idle handler besides checking fences are drained check PMFW version to determine if it will reset DPM when power gating VPE. If PMFW will not do this, then check VPE DPM level. If it is not DPM0 reschedule delayed work again until it is.
v2: squash in return fix (Alex)
--- drivers/gpu/drm/amd/amdgpu/amdgpu_vpe.c | 34 ++++++++++++++++++++++++++++---- 1 file changed, 30 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_vpe.c +30 -4
@@ -321,6 +321,26 @@ static int vpe_early_init(void *handle)return 0 ; } +static bool vpe_need_dpm0_at_power_down (struct amdgpu_device *adev) +{ +switch (amdgpu_ip_version (adev,VPE_HWIP ,0 )) { +case IP_VERSION (6 ,1 ,1 ): +return adev->pm.fw_version <0x0a640500 ; +default : +return false; + } +} + +static int vpe_get_dpm_level (struct amdgpu_device *adev) +{ +struct amdgpu_vpe *vpe = &adev->vpe; + +if (!adev->pm.dpm_enabled) +return 0 ; + +return RREG32 (vpe_get_reg_offset (vpe,0 , vpe->regs.dpm_request_lv)); +} +static void vpe_idle_work_handler (struct work_struct *work) { struct amdgpu_device *adev =
@@ -328,11 +348,17 @@ static void vpe_idle_work_handler(structunsigned int fences =0 ; fences +=amdgpu_fence_count_emitted (&adev->vpe.ring); +if (fences) + goto reschedule; + +if (vpe_need_dpm0_at_power_down (adev) &&vpe_get_dpm_level (adev) !=0 ) + goto reschedule; + +amdgpu_device_ip_set_powergating_state (adev,AMD_IP_BLOCK_TYPE_VPE ,AMD_PG_STATE_GATE ); +return ; -if (fences ==0 ) -amdgpu_device_ip_set_powergating_state (adev,AMD_IP_BLOCK_TYPE_VPE ,AMD_PG_STATE_GATE ); -else -schedule_delayed_work (&adev->vpe.idle_work,VPE_IDLE_TIMEOUT ); +reschedule: +schedule_delayed_work (&adev->vpe.idle_work,VPE_IDLE_TIMEOUT ); }static int vpe_common_init (struct amdgpu_vpe *vpe)
Greg Kroah-Hartman
maintainerPATCH 72/565 drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Lipski <[email protected]>
commit b3656b355b5522cef1b52a7469010009c98156db upstream.
[Why&How]
Return -EINVAL when userspace asks us to enable vblank on a crtc that is not yet enabled.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c +7 -3
@@ -296,8 +296,12 @@ static inline int amdgpu_dm_crtc_set_vblint irq_type;int rc =0 ; -if (acrtc->otg_inst ==-1 ) - goto skip; +if (enable && !acrtc->base.enabled) { +drm_dbg_vbl (crtc->dev, +"Reject vblank enable on unconfigured CRTC %d (enabled=%d)\n" , + acrtc->crtc_id, acrtc->base.enabled); +return -EINVAL ; + } irq_type =amdgpu_display_crtc_idx_to_irq_type (adev, acrtc->crtc_id);
@@ -378,7 +382,7 @@ static inline int amdgpu_dm_crtc_set_vbl return rc; }#endif -skip: +if (amdgpu_in_reset (adev))return 0 ;
Greg Kroah-Hartman
maintainerPATCH 73/565 ACPI: fan: Add fan speed reporting for fans with only _FST
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Grisham <[email protected]>
[ Upstream commit 6c00f29f74cb2c063b6f31a0b6d73f9db132b9ac ]
Add support for ACPI fans with _FST to report their speed even if they do not support fan control.
As suggested by Armin Wolf [1] and per the Windows Thermal Management Design Guide [2], Samsung Galaxy Book series devices (and possibly many more devices where the Windows guide was strictly followed) only implement the _FST method and do not support ACPI-based fan control.
Currently, these fans are not supported by the kernel driver but this patch will make some very small adjustments to allow them to be supported.
This patch is tested and working for me on a Samsung Galaxy Book2 Pro whose DSDT (and several other Samsung Galaxy Book series notebooks which currently have the same issue) can be found at [3].
Stable-dep-of: d91a1d129b63 ("ACPI: fan: Use platform device for devres-related actions")
--- drivers/acpi/fan.h | 1 + drivers/acpi/fan_attr.c | 37 ++++++++++++++++++++++--------------- drivers/acpi/fan_core.c | 25 ++++++++++++++++++------- drivers/acpi/fan_hwmon.c | 8 ++++++++ 4 files changed, 49 insertions(+), 22 deletions(-)
drivers/acpi/fan.h +1 -0
@@ -49,6 +49,7 @@ struct acpi_fan_fst {struct acpi_fan {acpi_handle handle;bool acpi4; +bool has_fst;struct acpi_fan_fif fif;struct acpi_fan_fps *fps;int fps_count;
drivers/acpi/fan_attr.c +22 -15
@@ -75,15 +75,6 @@ int acpi_fan_create_attributes(struct acstruct acpi_fan *fan =acpi_driver_data (device);int i, status; -sysfs_attr_init (&fan->fine_grain_control.attr); - fan->fine_grain_control.show = show_fine_grain_control; - fan->fine_grain_control.store =NULL ; - fan->fine_grain_control.attr.name ="fine_grain_control" ; - fan->fine_grain_control.attr.mode =0444 ; - status =sysfs_create_file (&device->dev.kobj, &fan->fine_grain_control.attr); -if (status) -return status; -/* _FST is present if we are here */ sysfs_attr_init (&fan->fst_speed.attr); fan->fst_speed.show = show_fan_speed;
@@ -92,7 +83,19 @@ int acpi_fan_create_attributes(struct ac fan->fst_speed.attr.mode =0444 ; status =sysfs_create_file (&device->dev.kobj, &fan->fst_speed.attr);if (status) - goto rem_fine_grain_attr; +return status; + +if (!fan->acpi4) +return 0 ; + +sysfs_attr_init (&fan->fine_grain_control.attr); + fan->fine_grain_control.show = show_fine_grain_control; + fan->fine_grain_control.store =NULL ; + fan->fine_grain_control.attr.name ="fine_grain_control" ; + fan->fine_grain_control.attr.mode =0444 ; + status =sysfs_create_file (&device->dev.kobj, &fan->fine_grain_control.attr); +if (status) + goto rem_fst_attr;for (i =0 ; i < fan->fps_count; ++i) {struct acpi_fan_fps *fps = &fan->fps[i];
@@ -109,18 +112,18 @@ int acpi_fan_create_attributes(struct acfor (j =0 ; j < i; ++j)sysfs_remove_file (&device->dev.kobj, &fan->fps[j].dev_attr.attr); - goto rem_fst_attr; + goto rem_fine_grain_attr; } }return 0 ; -rem_fst_attr: -sysfs_remove_file (&device->dev.kobj, &fan->fst_speed.attr); - rem_fine_grain_attr:sysfs_remove_file (&device->dev.kobj, &fan->fine_grain_control.attr); +rem_fst_attr: +sysfs_remove_file (&device->dev.kobj, &fan->fst_speed.attr); +return status; }
@@ -129,9 +132,13 @@ void acpi_fan_delete_attributes(struct astruct acpi_fan *fan =acpi_driver_data (device);int i; +sysfs_remove_file (&device->dev.kobj, &fan->fst_speed.attr); + +if (!fan->acpi4) +return ; +for (i =0 ; i < fan->fps_count; ++i)sysfs_remove_file (&device->dev.kobj, &fan->fps[i].dev_attr.attr); -sysfs_remove_file (&device->dev.kobj, &fan->fst_speed.attr);sysfs_remove_file (&device->dev.kobj, &fan->fine_grain_control.attr); }
drivers/acpi/fan_core.c +18 -7
@@ -208,12 +208,16 @@ static const struct thermal_cooling_devi* -------------------------------------------------------------------------- */ +static bool acpi_fan_has_fst (struct acpi_device *device) +{ +return acpi_has_method (device->handle,"_FST" ); +} +static bool acpi_fan_is_acpi4 (struct acpi_device *device) {return acpi_has_method (device->handle,"_FIF" ) &&acpi_has_method (device->handle,"_FPS" ) && -acpi_has_method (device->handle,"_FSL" ) && -acpi_has_method (device->handle,"_FST" ); +acpi_has_method (device->handle,"_FSL" ); }static int acpi_fan_get_fif (struct acpi_device *device)
@@ -337,7 +341,12 @@ static int acpi_fan_probe(struct platfor device->driver_data = fan;platform_set_drvdata (pdev, fan); -if (acpi_fan_is_acpi4 (device)) { +if (acpi_fan_has_fst (device)) { + fan->has_fst = true; + fan->acpi4 =acpi_fan_is_acpi4 (device); + } + +if (fan->acpi4) { result =acpi_fan_get_fif (device);if (result)return result;
@@ -345,7 +354,9 @@ static int acpi_fan_probe(struct platfor result =acpi_fan_get_fps (device);if (result)return result; + } +if (fan->has_fst) { result =devm_acpi_fan_create_hwmon (device);if (result)return result;
@@ -353,9 +364,9 @@ static int acpi_fan_probe(struct platfor result =acpi_fan_create_attributes (device);if (result)return result; + } - fan->acpi4 = true; - }else { +if (!fan->acpi4) { result =acpi_device_update_power (device,NULL );if (result) {dev_err (&device->dev,"Failed to set initial power state\n" );
@@ -401,7 +412,7 @@ err_remove_link: err_unregister:thermal_cooling_device_unregister (cdev); err_end: -if (fan->acpi4) +if (fan->has_fst)acpi_fan_delete_attributes (device);return result;
@@ -411,7 +422,7 @@ static void acpi_fan_remove(struct platf {struct acpi_fan *fan =platform_get_drvdata (pdev); -if (fan->acpi4) { +if (fan->has_fst) {struct acpi_device *device =ACPI_COMPANION (&pdev->dev);acpi_fan_delete_attributes (device);
drivers/acpi/fan_hwmon.c +8 -0
@@ -43,6 +43,10 @@ static umode_t acpi_fan_hwmon_is_visiblecase hwmon_fan_input:return 0444 ;case hwmon_fan_target: +/* Only acpi4 fans support fan control. */ +if (!fan->acpi4) +return 0 ; +/* * When in fine grain control mode, not every fan control value * has an associated fan performance state.
@@ -57,6 +61,10 @@ static umode_t acpi_fan_hwmon_is_visiblecase hwmon_power:switch (attr) {case hwmon_power_input: +/* Only acpi4 fans support fan control. */ +if (!fan->acpi4) +return 0 ; +/* * When in fine grain control mode, not every fan control value * has an associated fan performance state.
Greg Kroah-Hartman
maintainerPATCH 74/565 ACPI: fan: Use platform device for devres-related actions
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit d91a1d129b63614fa4c2e45e60918409ce36db7e ]
Device-managed resources are cleaned up when the driver unbinds from the underlying device. In our case this is the platform device as this driver is a platform driver. Registering device-managed resources on the associated ACPI device will thus result in a resource leak when this driver unbinds.
Ensure that any device-managed resources are only registered on the platform device to ensure that they are cleaned up during removal.
--- drivers/acpi/fan.h | 4 ++-- drivers/acpi/fan_core.c | 2 +- drivers/acpi/fan_hwmon.c | 8 ++++---- 3 files changed, 7 insertions(+), 7 deletions(-)
drivers/acpi/fan.h +2 -2
@@ -63,9 +63,9 @@ int acpi_fan_create_attributes(struct acvoid acpi_fan_delete_attributes (struct acpi_device *device);#if IS_REACHABLE (CONFIG_HWMON ) -int devm_acpi_fan_create_hwmon (struct acpi_device *device); +int devm_acpi_fan_create_hwmon (struct device *dev);#else -static inline int devm_acpi_fan_create_hwmon (struct acpi_device *device) {return 0 ; }; +static inline int devm_acpi_fan_create_hwmon (struct device *dev) {return 0 ; };#endif #endif
drivers/acpi/fan_core.c +1 -1
@@ -357,7 +357,7 @@ static int acpi_fan_probe(struct platfor }if (fan->has_fst) { - result =devm_acpi_fan_create_hwmon (device); + result =devm_acpi_fan_create_hwmon (&pdev->dev);if (result)return result;
drivers/acpi/fan_hwmon.c +4 -4
@@ -166,12 +166,12 @@ static const struct hwmon_chip_info acpi .info = acpi_fan_hwmon_info, }; -int devm_acpi_fan_create_hwmon (struct acpi_device *device) +int devm_acpi_fan_create_hwmon (struct device *dev) { -struct acpi_fan *fan =acpi_driver_data (device); +struct acpi_fan *fan =dev_get_drvdata (dev);struct device *hdev; - hdev =devm_hwmon_device_register_with_info (&device->dev,"acpi_fan" , fan, - &acpi_fan_hwmon_chip_info,NULL ); + hdev =devm_hwmon_device_register_with_info (dev,"acpi_fan" , fan, &acpi_fan_hwmon_chip_info, +NULL );return PTR_ERR_OR_ZERO (hdev); }
Greg Kroah-Hartman
maintainerPATCH 75/565 net: phy: add phy_disable_eee
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
[ Upstream commit b55498ff14bd14860d48dc8d2a0b6889b218c408 ]
If a MAC driver doesn't support EEE, then the PHY shouldn't advertise it. Add phy_disable_eee() for this purpose.
Stable-dep-of: 84a905290cb4 ("net: phy: dp83867: Disable EEE support as not implemented")
--- drivers/net/phy/phy_device.c | 16 ++++++++++++++++ include/linux/phy.h | 1 + 2 files changed, 17 insertions(+)
drivers/net/phy/phy_device.c +16 -0
@@ -3046,6 +3046,22 @@ void phy_support_eee(struct phy_device *EXPORT_SYMBOL (phy_support_eee);/** +* phy_disable_eee - Disable EEE for the PHY +* @phydev: Target phy_device struct +* +* This function is used by MAC drivers for MAC's which don't support EEE. +* It disables EEE on the PHY layer. +*/ +void phy_disable_eee (struct phy_device *phydev) +{ +linkmode_zero (phydev->supported_eee); +linkmode_zero (phydev->advertising_eee); + phydev->eee_cfg.tx_lpi_enabled = false; + phydev->eee_cfg.eee_enabled = false; +} +EXPORT_SYMBOL_GPL (phy_disable_eee); + +/** * phy_support_sym_pause - Enable support of symmetrical pause * @phydev: target phy_device struct *
include/linux/phy.h +1 -0
@@ -2030,6 +2030,7 @@ void phy_advertise_eee_all(struct phy_devoid phy_support_sym_pause (struct phy_device *phydev);void phy_support_asym_pause (struct phy_device *phydev);void phy_support_eee (struct phy_device *phydev); +void phy_disable_eee (struct phy_device *phydev);void phy_set_sym_pause (struct phy_device *phydev,bool rx,bool tx,bool autoneg);void phy_set_asym_pause (struct phy_device *phydev,bool rx,bool tx);
Greg Kroah-Hartman
maintainerPATCH 76/565 net: phy: dp83867: Disable EEE support as not implemented
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emanuele Ghidoli <[email protected]>
[ Upstream commit 84a905290cb4c3d9a71a9e3b2f2e02e031e7512f ]
While the DP83867 PHYs report EEE capability through their feature registers, the actual hardware does not support EEE (see Links). When the connected MAC enables EEE, it causes link instability and communication failures.
The issue is reproducible with a iMX8MP and relevant stmmac ethernet port. Since the introduction of phylink-managed EEE support in the stmmac driver, EEE is now enabled by default, leading to issues on systems using the DP83867 PHY.
Call phy_disable_eee during phy initialization to prevent EEE from being enabled on DP83867 PHYs.
--- drivers/net/phy/dp83867.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/phy/dp83867.c +6 -0
@@ -792,6 +792,12 @@ static int dp83867_config_init(struct phreturn ret; } +/* Although the DP83867 reports EEE capability through the +* MDIO_PCS_EEE_ABLE and MDIO_AN_EEE_ADV registers, the feature +* is not actually implemented in hardware. +*/ +phy_disable_eee (phydev); +if (phy_interface_is_rgmii (phydev) || phydev->interface ==PHY_INTERFACE_MODE_SGMII ) { val =phy_read (phydev,MII_DP83867_PHYCTRL );
Greg Kroah-Hartman
maintainerPATCH 77/565 sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
[ Upstream commit 54e96258a6930909b690fd7e8889749231ba8085 ]
scx_bpf_dsq_move_set_slice() and scx_bpf_dsq_move_set_vtime() take a DSQ iterator argument which has to be valid. Mark them with KF_RCU.
--- kernel/sched/ext.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
kernel/sched/ext.c +4 -4
@@ -6493,8 +6493,8 @@ BTF_KFUNCS_START(scx_kfunc_ids_dispatch) BTF_ID_FLAGS(func, scx_bpf_dispatch_nr_slots) BTF_ID_FLAGS(func, scx_bpf_dispatch_cancel) BTF_ID_FLAGS(func, scx_bpf_consume) -BTF_ID_FLAGS(func, scx_bpf_dispatch_from_dsq_set_slice) -BTF_ID_FLAGS(func, scx_bpf_dispatch_from_dsq_set_vtime) +BTF_ID_FLAGS(func, scx_bpf_dispatch_from_dsq_set_slice, KF_RCU) +BTF_ID_FLAGS(func, scx_bpf_dispatch_from_dsq_set_vtime, KF_RCU) BTF_ID_FLAGS(func, scx_bpf_dispatch_from_dsq, KF_RCU) BTF_ID_FLAGS(func, scx_bpf_dispatch_vtime_from_dsq, KF_RCU)BTF_KFUNCS_END (scx_kfunc_ids_dispatch)
@@ -6593,8 +6593,8 @@ __bpf_kfunc_end_defs(); BTF_KFUNCS_START(scx_kfunc_ids_unlocked) BTF_ID_FLAGS(func, scx_bpf_create_dsq, KF_SLEEPABLE) -BTF_ID_FLAGS(func, scx_bpf_dispatch_from_dsq_set_slice) -BTF_ID_FLAGS(func, scx_bpf_dispatch_from_dsq_set_vtime) +BTF_ID_FLAGS(func, scx_bpf_dispatch_from_dsq_set_slice, KF_RCU) +BTF_ID_FLAGS(func, scx_bpf_dispatch_from_dsq_set_vtime, KF_RCU) BTF_ID_FLAGS(func, scx_bpf_dispatch_from_dsq, KF_RCU) BTF_ID_FLAGS(func, scx_bpf_dispatch_vtime_from_dsq, KF_RCU) BTF_KFUNCS_END(scx_kfunc_ids_unlocked)
Greg Kroah-Hartman
maintainerPATCH 78/565 cpuidle: governors: menu: Rearrange main loop in menu_select()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <[email protected]>
[ Upstream commit 17224c1d2574d29668c4879e1fbf36d6f68cd22b ]
Reduce the indentation level in the main loop of menu_select() by rearranging some checks and assignments in it.
No intentional functional impact.
Stable-dep-of: db86f55bf81a ("cpuidle: governors: menu: Select polling state in some more cases")
--- drivers/cpuidle/governors/menu.c | 70 ++++++++++++++++++++------------------- 1 file changed, 36 insertions(+), 34 deletions(-)
drivers/cpuidle/governors/menu.c +36 -34
@@ -317,45 +317,47 @@ static int menu_select(struct cpuidle_drif (s->exit_latency_ns > latency_req)break ; -if (s->target_residency_ns > predicted_ns) { -/* -* Use a physical idle state, not busy polling, unless -* a timer is going to trigger soon enough. -*/ -if ((drv->states[idx].flags &CPUIDLE_FLAG_POLLING ) && - s->target_residency_ns <= data->next_timer_ns) { - predicted_ns = s->target_residency_ns; - idx = i; -break ; - } -if (predicted_ns <TICK_NSEC ) -break ; - -if (!tick_nohz_tick_stopped ()) { -/* -* If the state selected so far is shallow, -* waking up early won't hurt, so retain the -* tick in that case and let the governor run -* again in the next iteration of the loop. -*/ - predicted_ns = drv->states[idx].target_residency_ns; -break ; - } +if (s->target_residency_ns <= predicted_ns) { + idx = i; +continue ; + } + +/* +* Use a physical idle state, not busy polling, unless a timer +* is going to trigger soon enough. +*/ +if ((drv->states[idx].flags &CPUIDLE_FLAG_POLLING ) && + s->target_residency_ns <= data->next_timer_ns) { + predicted_ns = s->target_residency_ns; + idx = i; +break ; + } +if (predicted_ns <TICK_NSEC ) +break ; + +if (!tick_nohz_tick_stopped ()) {/* -* If the state selected so far is shallow and this -* state's target residency matches the time till the -* closest timer event, select this one to avoid getting -* stuck in the shallow one for too long. +* If the state selected so far is shallow, waking up +* early won't hurt, so retain the tick in that case and +* let the governor run again in the next iteration of +* the idle loop. */ -if (drv->states[idx].target_residency_ns <TICK_NSEC && - s->target_residency_ns <= delta_tick) - idx = i; - -return idx; + predicted_ns = drv->states[idx].target_residency_ns; +break ; } - idx = i; +/* +* If the state selected so far is shallow and this state's +* target residency matches the time till the closest timer +* event, select this one to avoid getting stuck in the shallow +* one for too long. +*/ +if (drv->states[idx].target_residency_ns <TICK_NSEC && + s->target_residency_ns <= delta_tick) + idx = i; + +return idx; }if (idx ==-1 )
Greg Kroah-Hartman
maintainerPATCH 79/565 cpuidle: governors: menu: Select polling state in some more cases
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <[email protected]>
[ Upstream commit db86f55bf81a3a297be05ee8775ae9a8c6e3a599 ]
A throughput regression of 11% introduced by commit 779b1a1cb13a ("cpuidle:
governors: menu: Avoid selecting states with too much latency") has been reported and it is related to the case when the menu governor checks if selecting a proper idle state instead of a polling one makes sense.
In particular, it is questionable to do so if the exit latency of the idle state in question exceeds the predicted idle duration, so add a check for that, which is sufficient to make the reported regression go away, and update the related code comment accordingly.
--- drivers/cpuidle/governors/menu.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/cpuidle/governors/menu.c +5 -2
@@ -324,10 +324,13 @@ static int menu_select(struct cpuidle_dr/* * Use a physical idle state, not busy polling, unless a timer -* is going to trigger soon enough. +* is going to trigger soon enough or the exit latency of the +* idle state in question is greater than the predicted idle +* duration. */ if ((drv->states[idx].flags &CPUIDLE_FLAG_POLLING ) && - s->target_residency_ns <= data->next_timer_ns) { + s->target_residency_ns <= data->next_timer_ns && + s->exit_latency_ns <= predicted_ns) { predicted_ns = s->target_residency_ns; idx = i;break ;
Greg Kroah-Hartman
maintainerPATCH 80/565 mfd: kempld: Switch back to earlier ->init() behavior
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heijligen, Thomas <[email protected]>
commit 309e65d151ab9be1e7b01d822880cd8c4e611dff upstream.
Commit 9e36775c22c7 ("mfd: kempld: Remove custom DMI matching code") removes the ability to load the driver if no matching system DMI data is found. Before this commit the driver could be loaded using alternative methods such as ACPI or force_device_id in the absence of a matching system DMI entry.
Restore this ability while keeping the refactoredplatform_device_info table.
--- drivers/mfd/kempld-core.c | 32 ++++++++++++++++++-------------- 1 file changed, 18 insertions(+), 14 deletions(-)
drivers/mfd/kempld-core.c +18 -14
@@ -779,22 +779,26 @@ MODULE_DEVICE_TABLE(dmi, kempld_dmi_tablstatic int __init kempld_init (void ) {const struct dmi_system_id *id; -int ret = -ENODEV ; -for (id =dmi_first_match (kempld_dmi_table); id; id =dmi_first_match (id +1 )) { -/* Check, if user asked for the exact device ID match */ -if (force_device_id[0 ] && !strstr (id->ident, force_device_id)) -continue ; - - ret =kempld_create_platform_device (&kempld_platform_data_generic); -if (ret) -continue ; - -break ; +/* +* This custom DMI iteration allows the driver to be initialized in three ways: +* - When a forced_device_id string matches any ident in the kempld_dmi_table, +* regardless of whether the DMI device is present in the system dmi table. +* - When a matching entry is present in the DMI system tabe. +* - Through alternative mechanisms like ACPI. +*/ +if (force_device_id[0 ]) { +for (id = kempld_dmi_table; id->matches[0 ].slot !=DMI_NONE ; id++) +if (strstr (id->ident, force_device_id)) +if (!kempld_create_platform_device (&kempld_platform_data_generic)) +break ; +if (id->matches[0 ].slot ==DMI_NONE ) +return -ENODEV ; + }else { +for (id =dmi_first_match (kempld_dmi_table); id; id =dmi_first_match (id+1 )) +if (kempld_create_platform_device (&kempld_platform_data_generic)) +break ; } -if (ret) -return ret; -return platform_driver_register (&kempld_driver); }
Greg Kroah-Hartman
maintainerPATCH 81/565 x86/CPU/AMD: Add RDSEED fix for Zen5
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <[email protected]>
commit 607b9fb2ce248cc5b633c5949e0153838992c152 upstream.
There's an issue with RDSEED's 16-bit and 32-bit register output variants on Zen5 which return a random value of 0 "at a rate inconsistent with randomness while incorrectly signaling success (CF=1)". Search the web for AMD-SB-7055 for more detail.
Add a fix glue which checks microcode revisions.
[ bp: Add microcode revisions checking, rewrite. ]
--- arch/x86/kernel/cpu/amd.c | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+)
arch/x86/kernel/cpu/amd.c +35 -0
@@ -1018,8 +1018,43 @@ static void init_amd_zen4(struct cpuinfo } } +static bool check_rdseed_microcode (void ) +{ +struct cpuinfo_x86 *c = &boot_cpu_data; +union zen_patch_rev p; +u32 min_rev =0 ; + + p.ext_fam = c->x86 -0xf ; + p.model = c->x86_model; + p.ext_model = c->x86_model >>4 ; + p.stepping = c->x86_stepping; +/* reserved bits are expected to be 0 in test below */ + p.__reserved =0 ; + +if (cpu_has (c,X86_FEATURE_ZEN5 )) { +switch (p.ucode_rev >>8 ) { +case 0xb0021 : min_rev =0xb00215a ;break ; +case 0xb1010 : min_rev =0xb101054 ;break ; +default : +pr_debug ("%s: ucode_rev: 0x%x, current revision: 0x%x\n" , + __func__, p.ucode_rev, c->microcode); +return false; + } + } + +if (!min_rev) +return false; + +return c->microcode >= min_rev; +} +static void init_amd_zen5 (struct cpuinfo_x86 *c) { +if (!check_rdseed_microcode ()) { +clear_cpu_cap (c,X86_FEATURE_RDSEED ); +msr_clear_bit (MSR_AMD64_CPUID_FN_7 ,18 ); +pr_emerg_once ("RDSEED32 is broken. Disabling the corresponding CPUID bit.\n" ); + } }static void init_amd (struct cpuinfo_x86 *c)
Greg Kroah-Hartman
maintainerPATCH 82/565 usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Owen Gu <[email protected]>
commit cfd6f1a7b42f62523c96d9703ef32b0dbc495ba4 upstream.
A race condition occurs when ffs_func_eps_enable() runs concurrently with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset() sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading to a NULL pointer dereference when accessing epfile->ep in ffs_func_eps_enable() after successful usb_ep_enable().
The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and ffs_data_close() functions, and its modification is protected by the spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function is also protected by ffs->eps_lock.
Thus, add NULL pointer handling for ffs->epfiles in the ffs_func_eps_enable() function to fix issues
--- drivers/usb/gadget/function/f_fs.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/usb/gadget/function/f_fs.c +7 -1
@@ -2418,7 +2418,12 @@ static int ffs_func_eps_enable(struct ff ep = func->eps; epfile = ffs->epfiles; count = ffs->eps_count; -while (count--) { +if (!epfile) { + ret = -ENOMEM ; + goto done; + } + +while (count--) { ep->ep->driver_data = ep; ret =config_ep_by_speed (func->gadget, &func->function, ep->ep);
@@ -2442,6 +2447,7 @@ static int ffs_func_eps_enable(struct ff }wake_up_interruptible (&ffs->wait); +done:spin_unlock_irqrestore (&func->ffs->eps_lock, flags);return ret;
Greg Kroah-Hartman
maintainerPATCH 83/565 drm/sched: Optimise drm_sched_entity_push_job
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tvrtko Ursulin <[email protected]>
[ Upstream commit d42a254633c773921884a19e8a1a0f53a31150c3 ]
In FIFO mode (which is the default), both drm_sched_entity_push_job() and drm_sched_rq_update_fifo(), where the latter calls the former, are currently taking and releasing the same entity->rq_lock.
We can avoid that design inelegance, and also have a miniscule efficiency improvement on the submit from idle path, by introducing a new drm_sched_rq_update_fifo_locked() helper and pulling up the lock taking to its callers.
v2:
* Remove drm_sched_rq_update_fifo() altogether. (Christian)
v3:
* Improved commit message. (Philipp)
Stable-dep-of: d25e3a610bae ("drm/sched: Fix race in drm_sched_entity_select_rq()")
--- drivers/gpu/drm/scheduler/sched_entity.c | 13 +++++++++---- drivers/gpu/drm/scheduler/sched_main.c | 6 +++--- include/drm/gpu_scheduler.h | 2 +- 3 files changed, 13 insertions(+), 8 deletions(-)
drivers/gpu/drm/scheduler/sched_entity.c +9 -4
@@ -506,8 +506,12 @@ struct drm_sched_job *drm_sched_entity_pstruct drm_sched_job *next; next =to_drm_sched_job (spsc_queue_peek (&entity->job_queue)); -if (next) -drm_sched_rq_update_fifo (entity, next->submit_ts); +if (next) { +spin_lock (&entity->rq_lock); +drm_sched_rq_update_fifo_locked (entity, + next->submit_ts); +spin_unlock (&entity->rq_lock); + } }/* Jobs and entities might have different lifecycles. Since we're
@@ -607,10 +611,11 @@ void drm_sched_entity_push_job(struct dr sched = rq->sched;drm_sched_rq_add_entity (rq, entity); -spin_unlock (&entity->rq_lock);if (drm_sched_policy ==DRM_SCHED_POLICY_FIFO ) -drm_sched_rq_update_fifo (entity, submit_ts); +drm_sched_rq_update_fifo_locked (entity, submit_ts); + +spin_unlock (&entity->rq_lock);drm_sched_wakeup (sched); }
drivers/gpu/drm/scheduler/sched_main.c +3 -3
@@ -169,14 +169,15 @@ static inline void drm_sched_rq_remove_f } } -void drm_sched_rq_update_fifo (struct drm_sched_entity *entity,ktime_t ts) +void drm_sched_rq_update_fifo_locked (struct drm_sched_entity *entity,ktime_t ts) {/* * Both locks need to be grabbed, one to protect from entity->rq change * for entity from within concurrent drm_sched_entity_select_rq and the * other to update the rb tree structure. */ -spin_lock (&entity->rq_lock); +lockdep_assert_held (&entity->rq_lock); +spin_lock (&entity->rq->lock);drm_sched_rq_remove_fifo_locked (entity);
@@ -187,7 +188,6 @@ void drm_sched_rq_update_fifo(struct drm drm_sched_entity_compare_before);spin_unlock (&entity->rq->lock); -spin_unlock (&entity->rq_lock); }/**
include/drm/gpu_scheduler.h +1 -1
@@ -593,7 +593,7 @@ void drm_sched_rq_add_entity(struct drm_void drm_sched_rq_remove_entity (struct drm_sched_rq *rq,struct drm_sched_entity *entity); -void drm_sched_rq_update_fifo (struct drm_sched_entity *entity,ktime_t ts); +void drm_sched_rq_update_fifo_locked (struct drm_sched_entity *entity,ktime_t ts); int drm_sched_entity_init(struct drm_sched_entity *entity, enum drm_sched_priority priority,
Greg Kroah-Hartman
maintainerPATCH 84/565 drm/sched: Re-group and rename the entity run-queue lock
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tvrtko Ursulin <[email protected]>
[ Upstream commit f93126f5d55920d1447ef00a3fbe6706f40f53de ]
When writing to a drm_sched_entity's run-queue, writers are protected through the lock drm_sched_entity.rq_lock. This naming, however, frequently collides with the separate internal lock of struct drm_sched_rq, resulting in uses like this:
spin_lock(&entity->rq_lock); spin_lock(&entity->rq->lock);
Rename drm_sched_entity.rq_lock to improve readability. While at it, re-order that struct's members to make it more obvious what the lock protects.
v2:
* Rename some rq_lock straddlers in kerneldoc, improve commit text. (Philipp)
Stable-dep-of: d25e3a610bae ("drm/sched: Fix race in drm_sched_entity_select_rq()")
--- drivers/gpu/drm/scheduler/sched_entity.c | 28 ++++++++++++++-------------- drivers/gpu/drm/scheduler/sched_main.c | 2 +- include/drm/gpu_scheduler.h | 21 +++++++++++---------- 3 files changed, 26 insertions(+), 25 deletions(-)
drivers/gpu/drm/scheduler/sched_entity.c +14 -14
@@ -106,7 +106,7 @@ int drm_sched_entity_init(struct drm_sch/* We start in an idle state. */ complete_all (&entity->entity_idle); -spin_lock_init (&entity->rq_lock); +spin_lock_init (&entity->lock);spsc_queue_init (&entity->job_queue);atomic_set (&entity->fence_seq,0 );
@@ -134,10 +134,10 @@ void drm_sched_entity_modify_sched(struc {WARN_ON (!num_sched_list || !sched_list); -spin_lock (&entity->rq_lock); +spin_lock (&entity->lock); entity->sched_list = sched_list; entity->num_sched_list = num_sched_list; -spin_unlock (&entity->rq_lock); +spin_unlock (&entity->lock); }EXPORT_SYMBOL (drm_sched_entity_modify_sched);
@@ -246,10 +246,10 @@ static void drm_sched_entity_kill(structif (!entity->rq)return ; -spin_lock (&entity->rq_lock); +spin_lock (&entity->lock); entity->stopped = true;drm_sched_rq_remove_entity (entity->rq, entity); -spin_unlock (&entity->rq_lock); +spin_unlock (&entity->lock);/* Make sure this entity is not used by the scheduler at the moment */ wait_for_completion (&entity->entity_idle);
@@ -395,9 +395,9 @@ static void drm_sched_entity_wakeup(struvoid drm_sched_entity_set_priority (struct drm_sched_entity *entity,enum drm_sched_priority priority) { -spin_lock (&entity->rq_lock); +spin_lock (&entity->lock); entity->priority = priority; -spin_unlock (&entity->rq_lock); +spin_unlock (&entity->lock); }EXPORT_SYMBOL (drm_sched_entity_set_priority);
@@ -507,10 +507,10 @@ struct drm_sched_job *drm_sched_entity_p next =to_drm_sched_job (spsc_queue_peek (&entity->job_queue));if (next) { -spin_lock (&entity->rq_lock); +spin_lock (&entity->lock);drm_sched_rq_update_fifo_locked (entity, next->submit_ts); -spin_unlock (&entity->rq_lock); +spin_unlock (&entity->lock); } }
@@ -551,14 +551,14 @@ void drm_sched_entity_select_rq(struct dif (fence && !dma_fence_is_signaled (fence))return ; -spin_lock (&entity->rq_lock); +spin_lock (&entity->lock); sched =drm_sched_pick_best (entity->sched_list, entity->num_sched_list); rq = sched ? sched->sched_rq[entity->priority] :NULL ;if (rq != entity->rq) {drm_sched_rq_remove_entity (entity->rq, entity); entity->rq = rq; } -spin_unlock (&entity->rq_lock); +spin_unlock (&entity->lock);if (entity->num_sched_list ==1 ) entity->sched_list =NULL ;
@@ -599,9 +599,9 @@ void drm_sched_entity_push_job(struct drstruct drm_sched_rq *rq;/* Add the entity to the run queue */ -spin_lock (&entity->rq_lock); +spin_lock (&entity->lock);if (entity->stopped) { -spin_unlock (&entity->rq_lock); +spin_unlock (&entity->lock);DRM_ERROR ("Trying to push to a killed entity\n" );return ;
@@ -615,7 +615,7 @@ void drm_sched_entity_push_job(struct drif (drm_sched_policy ==DRM_SCHED_POLICY_FIFO )drm_sched_rq_update_fifo_locked (entity, submit_ts); -spin_unlock (&entity->rq_lock); +spin_unlock (&entity->lock);drm_sched_wakeup (sched); }
drivers/gpu/drm/scheduler/sched_main.c +1 -1
@@ -176,7 +176,7 @@ void drm_sched_rq_update_fifo_locked(str* for entity from within concurrent drm_sched_entity_select_rq and the * other to update the rb tree structure. */ -lockdep_assert_held (&entity->rq_lock); +lockdep_assert_held (&entity->lock);spin_lock (&entity->rq->lock);
include/drm/gpu_scheduler.h +11 -10
@@ -97,13 +97,21 @@ struct drm_sched_entity {struct list_head list;/** +* @lock: +* +* Lock protecting the run-queue (@rq) to which this entity belongs, +* @priority and the list of schedulers (@sched_list, @num_sched_list). +*/ +spinlock_t lock; + +/** * @rq: * * Runqueue on which this entity is currently scheduled. * * FIXME: Locking is very unclear for this. Writers are protected by -* @rq_lock, but readers are generally lockless and seem to just race -* with not even a READ_ONCE. +* @lock, but readers are generally lockless and seem to just race with +* not even a READ_ONCE. */ struct drm_sched_rq *rq;
@@ -136,18 +144,11 @@ struct drm_sched_entity {* @priority: * * Priority of the entity. This can be modified by calling -* drm_sched_entity_set_priority(). Protected by &rq_lock. +* drm_sched_entity_set_priority(). Protected by @lock. */ enum drm_sched_priority priority;/** -* @rq_lock: -* -* Lock to modify the runqueue to which this entity belongs. -*/ -spinlock_t rq_lock; - -/** * @job_queue: the list of jobs of this entity. */ struct spsc_queue job_queue;
Greg Kroah-Hartman
maintainerPATCH 85/565 drm/sched: Fix race in drm_sched_entity_select_rq()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Stanner <[email protected]>
[ Upstream commit d25e3a610bae03bffc5c14b5d944a5d0cd844678 ]
In a past bug fix it was forgotten that entity access must be protected by the entity lock. That's a data race and potentially UB.
Move the spin_unlock() to the appropriate position.
--- drivers/gpu/drm/scheduler/sched_entity.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/scheduler/sched_entity.c +2 -1
@@ -558,10 +558,11 @@ void drm_sched_entity_select_rq(struct ddrm_sched_rq_remove_entity (entity->rq, entity); entity->rq = rq; } -spin_unlock (&entity->lock);if (entity->num_sched_list ==1 ) entity->sched_list =NULL ; + +spin_unlock (&entity->lock); }/**
Greg Kroah-Hartman
maintainerPATCH 86/565 s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerd Bayer <[email protected]>
[ Upstream commit 0fd20f65df6aa430454a0deed8f43efa91c54835 ]
Do not block PCI config accesses through pci_cfg_access_lock() when executing the s390 variant of PCI error recovery: Acquire just device_lock() instead of pci_dev_lock() as powerpc's EEH and generig PCI AER processing do.
During error recovery testing a pair of tasks was reported to be hung:
mlx5_core 0000:00:00.1: mlx5_health_try_recover:338:(pid 5553): health recovery flow aborted, PCI reads still not working
INFO: task kmcheck:72 blocked for more than 122 seconds.
Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kmcheck state:D stack:0 pid:72 tgid:72 ppid:2 flags:0x00000000
Call Trace:
[<000000065256f030>] __schedule+0x2a0/0x590
[<000000065256f356>] schedule+0x36/0xe0
[<000000065256f572>] schedule_preempt_disabled+0x22/0x30
[<0000000652570a94>] __mutex_lock.constprop.0+0x484/0x8a8
[<000003ff800673a4>] mlx5_unload_one+0x34/0x58 [mlx5_core]
[<000003ff8006745c>] mlx5_pci_err_detected+0x94/0x140 [mlx5_core]
[<0000000652556c5a>] zpci_event_attempt_error_recovery+0xf2/0x398
[<0000000651b9184a>] __zpci_event_error+0x23a/0x2c0
INFO: task kworker/u1664:6:1514 blocked for more than 122 seconds.
Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u1664:6 state:D stack:0 pid:1514 tgid:1514 ppid:2 flags:0x00000000
Workqueue: mlx5_health0000:00:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core]
Call Trace:
[<000000065256f030>] __schedule+0x2a0/0x590
[<000000065256f356>] schedule+0x36/0xe0
[<0000000652172e28>] pci_wait_cfg+0x80/0xe8
[<0000000652172f94>] pci_cfg_access_lock+0x74/0x88
[<000003ff800916b6>] mlx5_vsc_gw_lock+0x36/0x178 [mlx5_core]
[<000003ff80098824>] mlx5_crdump_collect+0x34/0x1c8 [mlx5_core]
[<000003ff80074b62>] mlx5_fw_fatal_reporter_dump+0x6a/0xe8 [mlx5_core]
[<0000000652512242>] devlink_health_do_dump.part.0+0x82/0x168
[<0000000652513212>] devlink_health_report+0x19a/0x230
[<000003ff80075a12>] mlx5_fw_fatal_reporter_err_work+0xba/0x1b0 [mlx5_core]No kernel log of the exact same error with an upstream kernel is available - but the very same deadlock situation can be constructed there, too:
- task: kmcheck
mlx5_unload_one() tries to acquire devlink lock while the PCI error recovery code has set pdev->block_cfg_access by way of pci_cfg_access_lock()
- task: kworker
mlx5_crdump_collect() tries to set block_cfg_access through pci_cfg_access_lock() while devlink_health_report() had acquired the devlink lock.
A similar deadlock situation can be reproduced by requesting a crdump with
Quoted 1 line
devlink health dump show pci/<BDF> reporter
fw_fatal
while PCI error recovery is executed on the same <BDF> physical function by mlx5_core's pci_error_handlers. On s390 this can be injected with
Quoted 1 line
zpcictl --reset-fw <BDF>
Tests with this patch failed to reproduce that second deadlock situation, the devlink command is rejected with "kernel answers: Permission denied" - and we get a kernel log message of:
mlx5_core 1ed0:00:00.1: mlx5_crdump_collect:50:(pid 254382): crdump: failed to lock vsc gw err -5
because the config read of VSC_SEMAPHORE is rejected by the underlying hardware.
Two prior attempts to address this issue have been discussed and ultimately rejected [see link], with the primary argument that s390's implementation of PCI error recovery is imposing restrictions that neither powerpc's EEH nor PCI AER handling need. Tests show that PCI error recovery on s390 is running to completion even without blocking access to PCI config space.
--- arch/s390/pci/pci_event.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/s390/pci/pci_event.c +2 -2
@@ -180,7 +180,7 @@ static pci_ers_result_t zpci_event_attem* is unbound or probed and that userspace can't access its * configuration space while we perform recovery. */ -pci_dev_lock (pdev); +device_lock (&pdev->dev);if (pdev->error_state == pci_channel_io_perm_failure) { ers_res =PCI_ERS_RESULT_DISCONNECT ; goto out_unlock;
@@ -228,7 +228,7 @@ static pci_ers_result_t zpci_event_attemif (driver->err_handler->resume) driver->err_handler->resume (pdev); out_unlock: -pci_dev_unlock (pdev); +device_unlock (&pdev->dev);return ers_res; }
Greg Kroah-Hartman
maintainerPATCH 87/565 s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit 64e2f60f355e556337fcffe80b9bcff1b22c9c42 ]
As reported by Luiz Capitulino enabling HVO on s390 leads to reproducible crashes. The problem is that kernel page tables are modified without flushing corresponding TLB entries.
Even if it looks like the empty flush_tlb_all() implementation on s390 is the problem, it is actually a different problem: on s390 it is not allowed to replace an active/valid page table entry with another valid page table entry without the detour over an invalid entry. A direct replacement may lead to random crashes and/or data corruption.
In order to invalidate an entry special instructions have to be used (e.g. ipte or idte). Alternatively there are also special instructions available which allow to replace a valid entry with a different valid entry (e.g. crdte or cspg).
Given that the HVO code currently does not provide the hooks to allow for an implementation which is compliant with the s390 architecture requirements, disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP again, which is basically a revert of the original patch which enabled it.
--- arch/s390/Kconfig | 1 - 1 file changed, 1 deletion(-)
arch/s390/Kconfig +0 -1
@@ -135,7 +135,6 @@ config S390 select ARCH_WANT_IPC_PARSE_VERSION select ARCH_WANT_KERNEL_PMD_MKWRITE select ARCH_WANT_LD_ORPHAN_WARN - select ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP select BUILDTIME_TABLE_SORT select CLONE_BACKWARDS2 select DCACHE_WORD_ACCESS if !KMSAN
Greg Kroah-Hartman
maintainerPATCH 88/565 soc: aspeed: socinfo: Add AST27xx silicon IDs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Chen <[email protected]>
[ Upstream commit c30dcfd4b5a0f0e3fe7138bf287f6de6b1b00278 ]
Extend the ASPEED SoC info driver to support AST27XX silicon IDs.
--- drivers/soc/aspeed/aspeed-socinfo.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/soc/aspeed/aspeed-socinfo.c +4 -0
@@ -27,6 +27,10 @@ static struct { { "AST2620", 0x05010203 }, { "AST2605", 0x05030103 }, { "AST2625", 0x05030403 }, +/* AST2700 */ + { "AST2750", 0x06000003 }, + { "AST2700", 0x06000103 }, + { "AST2720", 0x06000203 }, };static const char *siliconid_to_name (u32 siliconid)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 89/565 firmware: qcom: scm: preserve assign_mem() error return value
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mukesh Ojha <[email protected]>
[ Upstream commit 121fcf3c871181edce0708a49d2397cedd6ad21f ]
When qcom_scm_assign_mem() fails, the error value is currently being overwritten after it is logged, resulting in the loss of the original error code. Fix this by retaining and returning the original error value as intended.
--- drivers/firmware/qcom/qcom_scm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/qcom/qcom_scm.c +1 -1
@@ -1093,7 +1093,7 @@ int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz,if (ret) {dev_err (__scm->dev,"Assign memory protection call failed %d\n" , ret); -return -EINVAL ; +return ret; } *srcvm = next_vm;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/565 regmap: slimbus: fix bus_context pointer in regmap init calls
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Klimov <[email protected]>
commit 434f7349a1f00618a620b316f091bd13a12bc8d2 upstream.
Commit 4e65bda8273c ("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()") revealed the problem in the slimbus regmap. That commit breaks audio playback, for instance, on sdm845 Thundercomm Dragonboard 845c board:
Unable to handle kernel paging request at virtual address ffff8000847cbad4 ... CPU: 5 UID: 0 PID: 776 Comm: aplay Not tainted 6.18.0-rc1-00028-g7ea30958b305 #11 PREEMPT Hardware name: Thundercomm Dragonboard 845c (DT) ... Call trace: slim_xfer_msg+0x24/0x1ac [slimbus] (P) slim_read+0x48/0x74 [slimbus] regmap_slimbus_read+0x18/0x24 [regmap_slimbus] _regmap_raw_read+0xe8/0x174 _regmap_bus_read+0x44/0x80 _regmap_read+0x60/0xd8 _regmap_update_bits+0xf4/0x140 _regmap_select_page+0xa8/0x124 _regmap_raw_write_impl+0x3b8/0x65c _regmap_bus_raw_write+0x60/0x80 _regmap_write+0x58/0xc0 regmap_write+0x4c/0x80 wcd934x_hw_params+0x494/0x8b8 [snd_soc_wcd934x] snd_soc_dai_hw_params+0x3c/0x7c [snd_soc_core] __soc_pcm_hw_params+0x22c/0x634 [snd_soc_core] dpcm_be_dai_hw_params+0x1d4/0x38c [snd_soc_core] dpcm_fe_dai_hw_params+0x9c/0x17c [snd_soc_core] snd_pcm_hw_params+0x124/0x464 [snd_pcm] snd_pcm_common_ioctl+0x110c/0x1820 [snd_pcm] snd_pcm_ioctl+0x34/0x4c [snd_pcm] __arm64_sys_ioctl+0xac/0x104 invoke_syscall+0x48/0x104 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xec el0t_64_sync_handler+0xa0/0xf0 el0t_64_sync+0x198/0x19c
The __devm_regmap_init_slimbus() started to be used instead of __regmap_init_slimbus() after the commit mentioned above and turns out the incorrect bus_context pointer (3rd argument) was used in __devm_regmap_init_slimbus(). It should be just "slimbus" (which is equal to &slimbus->dev). Correct it. The wcd934x codec seems to be the only or the first user of devm_regmap_init_slimbus() but we should fix it till the point where __devm_regmap_init_slimbus() was introduced therefore two "Fixes" tags.
While at this, also correct the same argument in __regmap_init_slimbus().
--- drivers/base/regmap/regmap-slimbus.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/base/regmap/regmap-slimbus.c +2 -4
@@ -48,8 +48,7 @@ struct regmap *__regmap_init_slimbus(strif (IS_ERR (bus))return ERR_CAST (bus); -return __regmap_init (&slimbus->dev, bus, &slimbus->dev, config, - lock_key, lock_name); +return __regmap_init (&slimbus->dev, bus, slimbus, config, lock_key, lock_name); }EXPORT_SYMBOL_GPL (__regmap_init_slimbus);
@@ -63,8 +62,7 @@ struct regmap *__devm_regmap_init_slimbuif (IS_ERR (bus))return ERR_CAST (bus); -return __devm_regmap_init (&slimbus->dev, bus, &slimbus, config, - lock_key, lock_name); +return __devm_regmap_init (&slimbus->dev, bus, slimbus, config, lock_key, lock_name); }EXPORT_SYMBOL_GPL (__devm_regmap_init_slimbus);
Greg Kroah-Hartman
maintainerPATCH 90/565 soc: qcom: smem: Fix endian-unaware access of num_entries
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Reidel <[email protected]>
[ Upstream commit 19e7aa0e9e46d0ad111a4af55b3d681b6ad945e0 ]
Add a missing le32_to_cpu when accessing num_entries, which is always a little endian integer.
Fixes booting on Xiaomi Mi 9T (xiaomi-davinci) in big endian.
--- drivers/soc/qcom/smem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/qcom/smem.c +1 -1
@@ -892,7 +892,7 @@ static u32 qcom_smem_get_item_count(struct qcom_smem *smem)if (IS_ERR_OR_NULL (ptable))return SMEM_ITEM_COUNT ; - info = (struct smem_info *)&ptable->entry[ptable->num_entries]; + info = (struct smem_info *)&ptable->entry[le32_to_cpu (ptable->num_entries)];if (memcmp (info->magic,SMEM_INFO_MAGIC ,sizeof (info->magic)))return SMEM_ITEM_COUNT ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 91/565 spi: loopback-test: Dont use %pK through printk
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit b832b19318534bb4f1673b24d78037fee339c679 ]
In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log.
Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts.
Switch to the regular pointer formatting which is safer and easier to reason about.
There are still a few users of %pK left, but these use it through seq_file, for which its usage is safe.
--- drivers/spi/spi-loopback-test.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/spi/spi-loopback-test.c +6 -6
@@ -446,7 +446,7 @@ static void spi_test_dump_message(struct spi_device *spi,int i;u8 b; -dev_info (&spi->dev," spi_msg@%pK\n" , msg); +dev_info (&spi->dev," spi_msg@%p\n" , msg);if (msg->status)dev_info (&spi->dev," status: %i\n" , msg->status);
@@ -456,15 +456,15 @@ static void spi_test_dump_message(struct spi_device *spi, msg->actual_length);list_for_each_entry (xfer, &msg->transfers, transfer_list) { -dev_info (&spi->dev," spi_transfer@%pK\n" , xfer); +dev_info (&spi->dev," spi_transfer@%p\n" , xfer);dev_info (&spi->dev," len: %i\n" , xfer->len); -dev_info (&spi->dev," tx_buf: %pK\n" , xfer->tx_buf); +dev_info (&spi->dev," tx_buf: %p\n" , xfer->tx_buf);if (dump_data && xfer->tx_buf)spi_test_print_hex_dump (" TX: " , xfer->tx_buf, xfer->len); -dev_info (&spi->dev," rx_buf: %pK\n" , xfer->rx_buf); +dev_info (&spi->dev," rx_buf: %p\n" , xfer->rx_buf);if (dump_data && xfer->rx_buf) spi_test_print_hex_dump(" RX: ", xfer->rx_buf,
@@ -558,7 +558,7 @@ static int spi_check_rx_ranges(struct spi_device *spi,/* if still not found then something has modified too much */ /* we could list the "closest" transfer here... */ dev_err (&spi->dev, -"loopback strangeness - rx changed outside of allowed range at: %pK\n" , +"loopback strangeness - rx changed outside of allowed range at: %p\n" , addr);/* do not return, only set ret, * so that we list all addresses
@@ -696,7 +696,7 @@ static int spi_test_translate(struct spi_device *spi, }dev_err (&spi->dev, -"PointerRange [%pK:%pK[ not in range [%pK:%pK[ or [%pK:%pK[\n" , +"PointerRange [%p:%p[ not in range [%p:%p[ or [%p:%p[\n" , *ptr, *ptr + len,RX (0 ),RX (SPI_TEST_MAX_SIZE ),TX (0 ),TX (SPI_TEST_MAX_SIZE ));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 92/565 soc: ti: pruss: dont use %pK through printk
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit a5039648f86424885aae37f03dc39bc9cb972ecb ]
In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log.
Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts.
Switch to the regular pointer formatting which is safer and easier to reason about.
--- drivers/soc/ti/pruss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/ti/pruss.c +1 -1
@@ -449,7 +449,7 @@ static int pruss_of_setup_memories(struct device *dev, struct pruss *pruss) pruss->mem_regions[i].pa = res.start; pruss->mem_regions[i].size =resource_size (&res); -dev_dbg (dev,"memory %8s: pa %pa size 0x%zx va %pK\n" , +dev_dbg (dev,"memory %8s: pa %pa size 0x%zx va %p\n" , mem_names[i], &pruss->mem_regions[i].pa, pruss->mem_regions[i].size, pruss->mem_regions[i].va); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 93/565 bpf: Dont use %pK through printk
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit 2caa6b88e0ba0231fb4ff0ba8e73cedd5fb81fc8 ]
In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log.
Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts.
Switch to the regular pointer formatting which is safer and easier to reason about.
--- include/linux/filter.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/filter.h +1 -1
@@ -1263,7 +1263,7 @@ void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other);static inline void bpf_jit_dump (unsigned int flen,unsigned int proglen,u32 pass,void *image) { -pr_err ("flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n" , flen, +pr_err ("flen=%u proglen=%u pass=%u image=%p from=%s pid=%d\n" , flen, proglen, pass, image, current->comm,task_pid_nr (current));if (image)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 94/565 pinctrl: single: fix bias pull up/down handling in pin_config_set
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chi Zhang <[email protected]>
[ Upstream commit 236152dd9b1675a35eee912e79e6c57ca6b6732f ]
In the pin_config_set function, when handling PIN_CONFIG_BIAS_PULL_DOWN or PIN_CONFIG_BIAS_PULL_UP, the function calls pcs_pinconf_clear_bias() which writes the register. However, the subsequent operations continue using the stale 'data' value from before the register write, effectively causing the bias clear operation to be overwritten and not take effect.
Fix this by reading the 'data' value from the register after calling pcs_pinconf_clear_bias().
This bug seems to have existed when this code was first merged in commit 9dddb4df90d1 ("pinctrl: single: support generic pinconf").
--- drivers/pinctrl/pinctrl-single.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/pinctrl/pinctrl-single.c +3 -1
@@ -589,8 +589,10 @@ static int pcs_pinconf_set(struct pinctrl_dev *pctldev,/* 4 parameters */ case PIN_CONFIG_BIAS_PULL_DOWN :case PIN_CONFIG_BIAS_PULL_UP : -if (arg) +if (arg) {pcs_pinconf_clear_bias (pctldev, pin); + data = pcs->read (pcs->base + offset); + } fallthrough;case PIN_CONFIG_INPUT_SCHMITT_ENABLE : data &= ~func->conf[i].mask;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 95/565 mmc: host: renesas_sdhi: Fix the actual clock
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit 9c174e4dacee9fb2014a4ffc953d79a5707b77e4 ]
Wrong actual clock reported, if the SD clock division ratio is other than 1:1(bits DIV[7:0] in SD_CLK_CTRL are set to 11111111).
On high speed mode, cat /sys/kernel/debug/mmc1/ios Without the patch:
clock: 50000000 Hz actual clock: 200000000 Hz
After the fix:
clock: 50000000 Hz actual clock: 50000000 Hz
--- drivers/mmc/host/renesas_sdhi_core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/mmc/host/renesas_sdhi_core.c +5 -1
@@ -220,7 +220,11 @@ static void renesas_sdhi_set_clock(struct tmio_mmc_host *host, clk &= ~0xff ; } -sd_ctrl_write16 (host,CTL_SD_CARD_CLK_CTL , clk &CLK_CTL_DIV_MASK ); + clock = clk &CLK_CTL_DIV_MASK ; +if (clock !=0xff ) + host->mmc->actual_clock /= (1 << (ffs (clock) +1 )); + +sd_ctrl_write16 (host,CTL_SD_CARD_CLK_CTL , clock);if (!(host->pdata->flags &TMIO_MMC_MIN_RCAR2 ))usleep_range (10000 ,11000 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 96/565 memstick: Add timeout to prevent indefinite waiting
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayi Li <[email protected]>
[ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ]
Add timeout handling to wait_for_completion calls in memstick_set_rw_addr() and memstick_alloc_card() to prevent indefinite blocking in case of hardware or communication failures.
--- drivers/memstick/core/memstick.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/memstick/core/memstick.c +6 -2
@@ -366,7 +366,9 @@ int memstick_set_rw_addr(struct memstick_dev *card) { card->next_request = h_memstick_set_rw_addr;memstick_new_req (card->host); -wait_for_completion (&card->mrq_complete); +if (!wait_for_completion_timeout (&card->mrq_complete, +msecs_to_jiffies (500 ))) + card->current_mrq.error = -ETIMEDOUT ;return card->current_mrq.error; }
@@ -400,7 +402,9 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host) card->next_request = h_memstick_read_dev_id;memstick_new_req (host); -wait_for_completion (&card->mrq_complete); +if (!wait_for_completion_timeout (&card->mrq_complete, +msecs_to_jiffies (500 ))) + card->current_mrq.error = -ETIMEDOUT ;if (card->current_mrq.error) goto err_out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 97/565 cpufreq: ti: Add support for AM62D2
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paresh Bhagat <[email protected]>
[ Upstream commit b5af45302ebc141662b2b60c713c9202e88c943c ]
Add support for TI K3 AM62D2 SoC to read speed and revision values from hardware and pass to OPP layer. AM62D shares the same configuations as AM62A so use existing am62a7_soc_data.
--- drivers/cpufreq/ti-cpufreq.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/cpufreq/ti-cpufreq.c +2 -0
@@ -308,6 +308,7 @@ static const struct soc_device_attribute k3_cpufreq_soc[] = { { .family = "AM62X", .revision = "SR1.0" }, { .family = "AM62AX", .revision = "SR1.0" }, { .family = "AM62PX", .revision = "SR1.0" }, + { .family = "AM62DX", .revision = "SR1.0" }, {/* sentinel */ } };
@@ -453,6 +454,7 @@ static const struct of_device_id ti_cpufreq_of_match[] __maybe_unused = { { .compatible = "ti,omap36xx", .data = &omap36xx_soc_data, }, { .compatible = "ti,am625", .data = &am625_soc_data, }, { .compatible = "ti,am62a7", .data = &am62a7_soc_data, }, + { .compatible = "ti,am62d2", .data = &am62a7_soc_data, }, { .compatible = "ti,am62p5", .data = &am62p5_soc_data, }, /* legacy */ { .compatible = "ti,omap3430", .data = &omap34xx_soc_data, },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 98/565 bpf: Use tnums for JEQ/JNE is_branch_taken logic
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Chaignon <[email protected]>
[ Upstream commit f41345f47fb267a9c95ca710c33448f8d0d81d83 ]
In the following toy program (reg states minimized for readability), R0 and R1 always have different values at instruction 6. This is obvious when reading the program but cannot be guessed from ranges alone as they overlap (R0 in [0; 0xc0000000], R1 in [1024; 0xc0000400]).
0: call bpf_get_prandom_u32#7 ; R0_w=scalar() 1: w0 = w0 ; R0_w=scalar(var_off=(0x0; 0xffffffff)) 2: r0 >>= 30 ; R0_w=scalar(var_off=(0x0; 0x3)) 3: r0 <<= 30 ; R0_w=scalar(var_off=(0x0; 0xc0000000)) 4: r1 = r0 ; R1_w=scalar(var_off=(0x0; 0xc0000000)) 5: r1 += 1024 ; R1_w=scalar(var_off=(0x400; 0xc0000000))
6: if r1 != r0 goto pc+1
Looking at tnums however, we can deduce that R1 is always different from R0 because their tnums don't agree on known bits. This patch uses this logic to improve is_scalar_branch_taken in case of BPF_JEQ and BPF_JNE.
This change has a tiny impact on complexity, which was measured with the Cilium complexity CI test. That test covers 72 programs with various build and load time configurations for a total of 970 test cases. For 80% of test cases, the patch has no impact. On the other test cases, the patch decreases complexity by only 0.08% on average. In the best case, the verifier needs to walk 3% less instructions and, in the worst case, 1.5% more. Overall, the patch has a small positive impact, especially for our largest programs.
--- include/linux/tnum.h | 3 +++ kernel/bpf/tnum.c | 8 ++++++++ kernel/bpf/verifier.c | 4 ++++ 3 files changed, 15 insertions(+)
include/linux/tnum.h +3 -0
@@ -49,6 +49,9 @@ struct tnum tnum_xor(struct tnum a, struct tnum b);/* Multiply two tnums, return @a * @b */ struct tnum tnum_mul (struct tnum a,struct tnum b); +/* Return true if the known bits of both tnums have the same value */ +bool tnum_overlap (struct tnum a,struct tnum b); +/* Return a tnum representing numbers satisfying both @a and @b */ struct tnum tnum_intersect (struct tnum a,struct tnum b);
kernel/bpf/tnum.c +8 -0
@@ -138,6 +138,14 @@ struct tnum tnum_mul(struct tnum a, struct tnum b)return tnum_add (TNUM (acc_v,0 ), acc_m); } +bool tnum_overlap (struct tnum a,struct tnum b) +{ +u64 mu; + + mu = ~a.mask & ~b.mask; +return (a.value & mu) == (b.value & mu); +} +/* Note that if a and b disagree - i.e. one has a 'known 1' where the other has * a 'known 0' - this will return a 'known 1' for that bit. */
kernel/bpf/verifier.c +4 -0
@@ -14772,6 +14772,8 @@ static int is_scalar_branch_taken(struct bpf_reg_state *reg1, struct bpf_reg_sta*/ if (tnum_is_const (t1) &&tnum_is_const (t2))return t1.value == t2.value; +if (!tnum_overlap (t1, t2)) +return 0 ;/* non-overlapping ranges */ if (umin1 > umax2 || umax1 < umin2)return 0 ;
@@ -14796,6 +14798,8 @@ static int is_scalar_branch_taken(struct bpf_reg_state *reg1, struct bpf_reg_sta*/ if (tnum_is_const (t1) &&tnum_is_const (t2))return t1.value != t2.value; +if (!tnum_overlap (t1, t2)) +return 1 ;/* non-overlapping ranges */ if (umin1 > umax2 || umax1 < umin2)return 1 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 99/565 firewire: ohci: move self_id_complete tracepoint after validating register
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Sakamoto <[email protected]>
[ Upstream commit 696968262aeee51e1c0529c3c060ddd180702e02 ]
The value of OHCI1394_SelfIDCount register includes an error-indicating bit. It is safer to place the tracepoint probe after validating the register value.
--- drivers/firewire/ohci.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
drivers/firewire/ohci.c +4 -8
@@ -2060,6 +2060,9 @@ static void bus_reset_work(struct work_struct *work)ohci_notice (ohci,"self ID receive error\n" );return ; } + +trace_self_id_complete (ohci->card.index, reg, ohci->self_id,has_be_header_quirk (ohci)); +/* * The count in the SelfIDCount register is the number of * bytes in the self ID receive buffer. Since we also receive
@@ -2228,15 +2231,8 @@ static irqreturn_t irq_handler(int irq, void *data)if (event & OHCI1394_busReset)reg_write (ohci, OHCI1394_IntMaskClear, OHCI1394_busReset); -if (event & OHCI1394_selfIDComplete) { -if (trace_self_id_complete_enabled ()) { -u32 reg =reg_read (ohci, OHCI1394_SelfIDCount); - -trace_self_id_complete (ohci->card.index, reg, ohci->self_id, -has_be_header_quirk (ohci)); - } +if (event & OHCI1394_selfIDComplete)queue_work (selfid_workqueue, &ohci->bus_reset_work); - }if (event & OHCI1394_RQPkt)tasklet_schedule (&ohci->ar_request_ctx.tasklet);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 64/565 s390/mm: Fix memory leak in add_marker() when kvrealloc() fails
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit 07ad45e06b4039adf96882aefcb1d3299fb7c305 upstream.
The function has a memory leak when kvrealloc() fails.
The function directly assigns NULL to the markers pointer, losing the reference to the previously allocated memory. This causes kvfree() in pt_dump_init() to free NULL instead of the leaked memory.
Fix by:
1. Using kvrealloc() uniformly for all allocations
2. Using a temporary variable to preserve the original pointer until allocation succeeds
3. Removing the error path that sets markers_cnt=0 to keep consistency between markers and markers_cnt
Found via static analysis and this is similar to commit 42378a9ca553 ("bpf, verifier: Fix memory leak in array reallocation for stack state")
--- arch/s390/mm/dump_pagetables.c | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-)
arch/s390/mm/dump_pagetables.c +7 -12
@@ -247,16 +247,14 @@ static int ptdump_cmp(const void *a, constatic int add_marker (unsigned long start,unsigned long end,const char *name) { -size_t oldsize, newsize; +struct addr_marker *new; +size_t newsize; - oldsize = markers_cnt *sizeof (*markers); - newsize = oldsize +2 *sizeof (*markers); -if (!oldsize) - markers =kvmalloc (newsize,GFP_KERNEL ); -else - markers =kvrealloc (markers, newsize,GFP_KERNEL ); -if (!markers) - goto error; + newsize = (markers_cnt +2 ) *sizeof (*markers); + new =kvrealloc (markers, newsize,GFP_KERNEL ); +if (!new) +return -ENOMEM ; + markers = new; markers[markers_cnt].is_start =1 ; markers[markers_cnt].start_address = start; markers[markers_cnt].size = end - start;
@@ -268,9 +266,6 @@ static int add_marker(unsigned long star markers[markers_cnt].name = name; markers_cnt++;return 0 ; -error: - markers_cnt =0 ; -return -ENOMEM ; }static int pt_dump_init (void )
Greg Kroah-Hartman
maintainerPATCH 100/565 irqchip/sifive-plic: Respect mask state when setting affinity
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Inochi Amaoto <[email protected]>
[ Upstream commit adecf78df945f4c7a1d29111b0002827f487df51 ]
plic_set_affinity() always calls plic_irq_enable(), which clears up the priority setting even the interrupt is only masked. This unmasks the interrupt unexpectly.
Replace the plic_irq_enable/disable() with plic_irq_toggle() to avoid changing the priority setting.
--- drivers/irqchip/irq-sifive-plic.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/irqchip/irq-sifive-plic.c +4 -2
@@ -179,12 +179,14 @@ static int plic_set_affinity(struct irq_data *d,if (cpu >= nr_cpu_ids)return -EINVAL ; -plic_irq_disable (d); +/* Invalidate the original routing entry */ +plic_irq_toggle (irq_data_get_effective_affinity_mask (d), d,0 );irq_data_update_effective_affinity (d,cpumask_of (cpu)); +/* Setting the new routing entry if irq is enabled */ if (!irqd_irq_disabled (d)) -plic_irq_enable (d); +plic_irq_toggle (irq_data_get_effective_affinity_mask (d), d,1 );return IRQ_SET_MASK_OK_DONE ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 106/565 cpufreq/longhaul: handle NULL policy in longhaul_exit
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dennis Beier <[email protected]>
[ Upstream commit 592532a77b736b5153e0c2e4c74aa50af0a352ab ]
longhaul_exit() was calling cpufreq_cpu_get(0) without checking for a NULL policy pointer. On some systems, this could lead to a NULL dereference and a kernel warning or panic.
This patch adds a check using unlikely() and returns early if the policy is NULL.
Bugzilla: #219962
--- drivers/cpufreq/longhaul.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/cpufreq/longhaul.c +3 -0
@@ -954,6 +954,9 @@ static void __exit longhaul_exit(void)struct cpufreq_policy *policy =cpufreq_cpu_get (0 );int i; +if (unlikely (!policy)) +return ; +for (i =0 ; i < numscales; i++) {if (mults[i] == maxmult) {struct cpufreq_freqs freqs;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 107/565 arc: Fix __fls() const-foldability via __builtin_clzl()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit a3fecb9160482367365cc384c59dd220b162b066 ]
While tracking down a problem where constant expressions used by BUILD_BUG_ON() suddenly stopped working[1], we found that an added static initializer was convincing the compiler that it couldn't track the state of the prior statically initialized value. Tracing this down found that ffs() was used in the initializer macro, but since it wasn't marked with __attribute__const__, the compiler had to assume the function might change variable states as a side-effect (which is not true for ffs(), which provides deterministic math results).
For arc architecture with CONFIG_ISA_ARCV2=y, the __fls() function uses __builtin_arc_fls() which lacks GCC's const attribute, preventing compile-time constant folding, and KUnit testing of ffs/fls fails on arc[3]. A patch[2] to GCC to solve this has been sent.
Add a fix for this by handling compile-time constants with the standard __builtin_clzl() builtin (which has const attribute) while preserving the optimized arc-specific builtin for runtime cases. This has the added benefit of skipping runtime calculation of compile-time constant values. Even with the GCC bug fixed (which is about "attribute const") this is a good change to avoid needless runtime costs, and should be done regardless of the state of GCC's bug.
Build tested ARCH=arc allyesconfig with GCC arc-linux 15.2.0.
--- arch/arc/include/asm/bitops.h | 2 ++ 1 file changed, 2 insertions(+)
arch/arc/include/asm/bitops.h +2 -0
@@ -133,6 +133,8 @@ static inline __attribute__ ((const)) int fls(unsigned int x)*/ static inline __attribute__ ((const))unsigned long __fls (unsigned long x) { +if (__builtin_constant_p (x)) +return x ?BITS_PER_LONG -1 -__builtin_clzl (x) :0 ;/* FLS insn has exactly same semantics as the API */ return __builtin_arc_fls (x); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 108/565 bpftool: Add CET-aware symbol matching for x86_64 architectures
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Chen <[email protected]>
[ Upstream commit 6417ca85305ecaffef13cf9063ac35da8fba8500 ]
Adjust symbol matching logic to account for Control-flow Enforcement Technology (CET) on x86_64 systems. CET prefixes functions with a 4-byte 'endbr' instruction, shifting the actual hook entry point to symbol + 4.
--- tools/bpf/bpftool/link.c | 54 +++++++++++++++++++++++++++++++++++++--- 1 file changed, 50 insertions(+), 4 deletions(-)
tools/bpf/bpftool/link.c +50 -4
@@ -282,11 +282,52 @@ get_addr_cookie_array(__u64 *addrs, __u64 *cookies, __u32 count)return data; } +static bool is_x86_ibt_enabled (void ) +{ +#if defined(__x86_64__) +struct kernel_config_option options[] = { + {"CONFIG_X86_KERNEL_IBT" , }, + }; +char *values[ARRAY_SIZE (options)] = { }; +bool ret; + +if (read_kernel_config (options,ARRAY_SIZE (options), values,NULL )) +return false; + + ret = !!values[0 ]; +free (values[0 ]); +return ret; +#else +return false; +#endif +} + +static bool +symbol_matches_target (__u64 sym_addr,__u64 target_addr,bool is_ibt_enabled) +{ +if (sym_addr == target_addr) +return true; + +/* +* On x86_64 architectures with CET (Control-flow Enforcement Technology), +* function entry points have a 4-byte 'endbr' instruction prefix. +* This causes kprobe hooks to target the address *after* 'endbr' +* (symbol address + 4), preserving the CET instruction. +* Here we check if the symbol address matches the hook target address +* minus 4, indicating a CET-enabled function entry point. +*/ +if (is_ibt_enabled && sym_addr == target_addr -4 ) +return true; + +return false; +} +static void show_kprobe_multi_json (struct bpf_link_info *info,json_writer_t *wtr) {struct addr_cookie *data;__u32 i, j =0 ; +bool is_ibt_enabled;jsonw_bool_field (json_wtr,"retprobe" , info->kprobe_multi.flags &BPF_F_KPROBE_MULTI_RETURN );
@@ -306,11 +347,13 @@ show_kprobe_multi_json(struct bpf_link_info *info, json_writer_t *wtr)if (!dd.sym_count) goto error; + is_ibt_enabled =is_x86_ibt_enabled ();for (i =0 ; i < dd.sym_count; i++) { -if (dd.sym_mapping[i].address != data[j].addr) +if (!symbol_matches_target (dd.sym_mapping[i].address, + data[j].addr, is_ibt_enabled))continue ;jsonw_start_object (json_wtr); -jsonw_uint_field (json_wtr,"addr" , dd.sym_mapping[i].address); +jsonw_uint_field (json_wtr,"addr" , (unsigned long )data[j].addr);jsonw_string_field (json_wtr,"func" , dd.sym_mapping[i].name);/* Print null if it is vmlinux */ if (dd.sym_mapping[i].module[0 ] =='\0' ) {
@@ -716,6 +759,7 @@ static void show_kprobe_multi_plain(struct bpf_link_info *info) {struct addr_cookie *data;__u32 i, j =0 ; +bool is_ibt_enabled;if (!info->kprobe_multi.count)return ;
@@ -739,12 +783,14 @@ static void show_kprobe_multi_plain(struct bpf_link_info *info)if (!dd.sym_count) goto error; + is_ibt_enabled =is_x86_ibt_enabled ();printf ("\n\t%-16s %-16s %s" ,"addr" ,"cookie" ,"func [module]" );for (i =0 ; i < dd.sym_count; i++) { -if (dd.sym_mapping[i].address != data[j].addr) +if (!symbol_matches_target (dd.sym_mapping[i].address, + data[j].addr, is_ibt_enabled))continue ;printf ("\n\t%016lx %-16llx %s" , - dd.sym_mapping[i].address, data[j].cookie, dd.sym_mapping[i].name); + (unsigned long )data[j].addr, data[j].cookie, dd.sym_mapping[i].name);if (dd.sym_mapping[i].module[0 ] !='\0' )printf (" [%s] " , dd.sym_mapping[i].module);else
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 109/565 selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <[email protected]>
[ Upstream commit 2a912258c90e895363c0ffc0be8a47f112ab67b7 ]
Currently, even if some subtests fails, the end result will still yield "ok 1 selftests: bpf: test_xsk.sh". Fix it by exiting with 1 if there are any failures.
--- tools/testing/selftests/bpf/test_xsk.sh | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/bpf/test_xsk.sh +2 -0
@@ -241,4 +241,6 @@ done if [ $failures -eq 0 ]; then echo "All tests successful!" +else + exit 1 fi
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 110/565 irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Bruel <[email protected]>
[ Upstream commit 2ef3886ce626dcdab0cbc452dbbebc19f57133d8 ]
The PCI Local Bus Specification 3.0 (section 6.8.1.6) allows modifying the low-order bits of the MSI Message DATA register to encode nr_irqs interrupt numbers in the log2(nr_irqs) bits for the domain.
The problem arises if the base vector (GICV2m base spi) is not aligned with nr_irqs; in this case, the low-order log2(nr_irqs) bits from the base vector conflict with the nr_irqs masking, causing the wrong MSI interrupt to be identified.
To fix this, use bitmap_find_next_zero_area_off() instead of bitmap_find_free_region() to align the initial base vector with nr_irqs.
--- drivers/irqchip/irq-gic-v2m.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/irqchip/irq-gic-v2m.c +9 -4
@@ -156,14 +156,19 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq, {msi_alloc_info_t *info = args;struct v2m_data *v2m =NULL , *tmp; -int hwirq, offset, i, err =0 ; +int hwirq, i, err =0 ; +unsigned long offset; +unsigned long align_mask = nr_irqs -1 ;spin_lock (&v2m_lock);list_for_each_entry (tmp, &v2m_nodes, entry) { - offset =bitmap_find_free_region (tmp->bm, tmp->nr_spis, -get_count_order (nr_irqs)); -if (offset >=0 ) { +unsigned long align_off = tmp->spi_start - (tmp->spi_start & ~align_mask); + + offset =bitmap_find_next_zero_area_off (tmp->bm, tmp->nr_spis,0 , + nr_irqs, align_mask, align_off); +if (offset < tmp->nr_spis) { v2m = tmp; +bitmap_set (v2m->bm, offset, nr_irqs);break ; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 102/565 ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <[email protected]>
[ Upstream commit 149139ddcb99583fdec8d1eaf7dada41e5896101 ]
Since str_obj is allocated by ACPICA in acpi_evaluate_object_typed(), it should be free with ACPI_FREE() rather than with kfree(), so use the former instead of the latter for freeing it.
--- drivers/acpi/device_sysfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/device_sysfs.c +1 -1
@@ -464,7 +464,7 @@ static ssize_t description_show(struct device *dev, buf[result++] ='\n' ; -kfree (str_obj); +ACPI_FREE (str_obj);return result; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 111/565 ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shang song (Lenovo) <[email protected]>
[ Upstream commit 311942ce763e21dacef7e53996d5a1e19b8adab1 ]
If handler_address or mapped VA is NULL, the related buffer address and VA can be ignored, so make acpi_parse_prmt() skip the current handler in those cases.
--- drivers/acpi/prmt.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
drivers/acpi/prmt.c +16 -3
@@ -150,15 +150,28 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end) th = &tm->handlers[cur_handler];guid_copy (&th->guid, (guid_t *)handler_info->handler_guid); + +/* +* Print an error message if handler_address is NULL, the parse of VA also +* can be skipped. +*/ +if (unlikely (!handler_info->handler_address)) { +pr_info ("Skipping handler with NULL address for GUID: %pUL" , + (guid_t *)handler_info->handler_guid); +continue ; + } + th->handler_addr = (void *)efi_pa_va_lookup (&th->guid, handler_info->handler_address);/* -* Print a warning message if handler_addr is zero which is not expected to -* ever happen. +* Print a warning message and skip the parse of VA if handler_addr is zero +* which is not expected to ever happen. */ -if (unlikely (!th->handler_addr)) +if (unlikely (!th->handler_addr)) {pr_warn ("Failed to find VA of handler for GUID: %pUL, PA: 0x%llx" , &th->guid, handler_info->handler_address); +continue ; + } th->static_data_buffer_addr =efi_pa_va_lookup (&th->guid, handler_info->static_data_buffer_address);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 112/565 ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sam van Kampen <[email protected]>
[ Upstream commit 3a351de0d9c86e23b9eca25838b19468aab02f38 ]
Just like the other Vivobooks here, the N6506CU has its keyboard IRQ described as ActiveLow in the DSDT, which the kernel overrides to EdgeHigh, causing the internal keyboard not to work.
Add the N6506CU to the irq1_level_low_skip_override[] quirk table to fix this.
--- drivers/acpi/resource.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/acpi/resource.c +7 -0
@@ -510,6 +510,13 @@ static const struct dmi_system_id irq1_level_low_skip_override[] = { DMI_MATCH(DMI_BOARD_NAME, "N6506M"), }, }, + { +/* Asus Vivobook Pro N6506CU* */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), + DMI_MATCH(DMI_BOARD_NAME, "N6506CU"), + }, + }, {/* LG Electronics 17U70P */ .matches = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 113/565 ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 4405a214df146775338a1e6232701a29024b82e1 ]
Some x86/ACPI laptops with MIPI cameras have a INTC10DE or INTC10E0 ACPI device in the _DEP dependency list of the ACPI devices for the camera- sensors (which have flags.honor_deps set).
These devices are for an Intel Vision CVS chip for which an out of tree driver is available [1].
The camera sensor works fine without a driver being loaded for this ACPI device on the 2 laptops this was tested on:
ThinkPad X1 Carbon Gen 12 (Meteor Lake)
ThinkPad X1 2-in-1 Gen 10 (Arrow Lake)
For now add these HIDs to acpi_ignore_dep_ids[] so that acpi_dev_ready_for_enumeration() will return true once the other _DEP dependencies are met and an i2c_client for the camera sensor will get instantiated.
--- drivers/acpi/scan.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/acpi/scan.c +2 -0
@@ -847,6 +847,8 @@ static bool acpi_info_matches_ids(struct acpi_device_info *info,static const char *const acpi_ignore_dep_ids[] = {"PNP0D80" ,/* Windows-compatible System Power Management Controller */ "INT33BD" ,/* Intel Baytrail Mailbox Device */ +"INTC10DE" ,/* Intel CVS LNL */ +"INTC10E0" ,/* Intel CVS ARL */ "LATT2021" ,/* Lattice FW Update Client Driver */ NULL };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 114/565 thermal: gov_step_wise: Allow cooling level to be reduced earlier
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 2e82368359f63567862a0d438710ddffcb1ace83 ]
The current behavior of the Step-wise thermal governor is to increase the cooling level one step at a time after trip point threshold passing by thermal zone temperature until the temperature stops to rise. Then, nothing is done until the temperature decreases below the (possibly updated) trip point threshold, at which point the cooling level is reduced straight to the applicable minimum.
While this generally works, it is not in agreement with the throttling logic description comment in step_wise_manage() any more after some relatively recent changes, and in the case of passive cooling, it may lead to undesirable performance oscillations between high and low levels.
For this reason, modify the governor's cooling device state selection function, get_target_state(), to reduce cooling by one level even if the temperature is still above the thermal zone threshold, but the temperature has started to fall down. However, ensure that the cooling level will remain above the applicable minimum in that case to pull the zone temperature further down, possibly until it falls below the trip threshold (which may now be equal to the low temperature of the trip).
Doing so should help higher performance to be restored earlier in some cases which is desirable especially for passive trip points with relatively high hysteresis values.
--- drivers/thermal/gov_step_wise.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
drivers/thermal/gov_step_wise.c +14 -1
@@ -20,7 +20,9 @@* If the temperature is higher than a trip point, * a. if the trend is THERMAL_TREND_RAISING, use higher cooling * state for this trip point -* b. if the trend is THERMAL_TREND_DROPPING, do nothing +* b. if the trend is THERMAL_TREND_DROPPING, use a lower cooling state +* for this trip point, but keep the cooling state above the applicable +* minimum * If the temperature is lower than a trip point, * a. if the trend is THERMAL_TREND_RAISING, do nothing * b. if the trend is THERMAL_TREND_DROPPING, use lower cooling
@@ -51,6 +53,17 @@ static unsigned long get_target_state(struct thermal_instance *instance,if (throttle) {if (trend ==THERMAL_TREND_RAISING )return clamp (cur_state +1 , instance->lower, instance->upper); + +/* +* If the zone temperature is falling, the cooling level can +* be reduced, but it should still be above the lower state of +* the given thermal instance to pull the temperature further +* down. +*/ +if (trend ==THERMAL_TREND_DROPPING ) +return clamp (cur_state -1 , +min (instance->lower +1 , instance->upper), + instance->upper); }else if (trend ==THERMAL_TREND_DROPPING ) {if (cur_state <= instance->lower)return THERMAL_NO_TARGET ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 115/565 thermal: intel: selftests: workload_hint: Mask unsupported types
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
[ Upstream commit 0115d063559fa6d25e41751cf455dda40aa2c856 ]
The workload hint may contain some other hints which are not defined. So mask out unsupported types. Currently only lower 4 bits of workload type hints are defined.
--- .../selftests/thermal/intel/workload_hint/workload_hint_test.c | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/thermal/intel/workload_hint/workload_hint_test.c +2 -0
@@ -146,6 +146,8 @@ int main(int argc, char **argv) ret =sscanf (index_str,"%d" , &index);if (ret <0 )break ; + + index &=0x0f ;if (index >WORKLOAD_TYPE_MAX_INDEX )printf ("Invalid workload type index\n" );else
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 116/565 power: supply: qcom_battmgr: add OOI chemistry
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christopher Ruehl <[email protected]>
[ Upstream commit fee0904441325d83e7578ca457ec65a9d3f21264 ]
The ASUS S15 xElite model report the Li-ion battery with an OOI, hence this update the detection and return the appropriate type.
--- drivers/power/supply/qcom_battmgr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/power/supply/qcom_battmgr.c +2 -1
@@ -978,7 +978,8 @@ static void qcom_battmgr_sc8280xp_strcpy(char *dest, const char *src)static unsigned int qcom_battmgr_sc8280xp_parse_technology (const char *chemistry) { -if (!strncmp (chemistry,"LIO" ,BATTMGR_CHEMISTRY_LEN )) +if ((!strncmp (chemistry,"LIO" ,BATTMGR_CHEMISTRY_LEN )) || + (!strncmp (chemistry,"OOI" ,BATTMGR_CHEMISTRY_LEN )))return POWER_SUPPLY_TECHNOLOGY_LION ;if (!strncmp (chemistry,"LIP" ,BATTMGR_CHEMISTRY_LEN ))return POWER_SUPPLY_TECHNOLOGY_LIPO ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 117/565 hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avadhut Naik <[email protected]>
[ Upstream commit f116af2eb51ed9df24911537fda32a033f1c58da ]
Add thermal info support for newer AMD Family 1Ah-based models.
--- drivers/hwmon/k10temp.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/hwmon/k10temp.c +9 -0
@@ -84,6 +84,13 @@ static DEFINE_MUTEX(nb_smu_ind_mutex);*/ #define AMD_I3255_STR "3255" +/* +* PCI Device IDs for AMD's Family 1Ah-based SOCs. +* Defining locally as IDs are not shared. +*/ +#define PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3 0x12cb +#define PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3 0x127b +struct k10temp_data {struct pci_dev *pdev;void (*read_htcreg)(struct pci_dev *pdev,u32 *regval);
@@ -542,7 +549,9 @@ static const struct pci_device_id k10temp_id_table[] = { { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_19H_M78H_DF_F3) }, { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M00H_DF_F3) }, { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3) }, + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3) }, { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3) }, + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3) }, { PCI_VDEVICE(HYGON, PCI_DEVICE_ID_AMD_17H_DF_F3) }, {} };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 118/565 hwmon: (k10temp) Add device ID for Strix Halo
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rong Zhang <[email protected]>
[ Upstream commit e5d1e313d7b6272d6dfda983906d99f97ad9062b ]
The device ID of Strix Halo Data Fabric Function 3 has been in the tree since commit 0e640f0a47d8 ("x86/amd_nb: Add new PCI IDs for AMD family 0x1a"), but is somehow missing from k10temp_id_table.
Add it so that it works out of the box.
Tested on Beelink GTR9 Pro Mini PC.
--- drivers/hwmon/k10temp.c | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/k10temp.c +1 -0
@@ -551,6 +551,7 @@ static const struct pci_device_id k10temp_id_table[] = { { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3) }, { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3) }, { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3) }, + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M70H_DF_F3) }, { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3) }, { PCI_VDEVICE(HYGON, PCI_DEVICE_ID_AMD_17H_DF_F3) }, {}
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 119/565 hwmon: (lenovo-ec-sensors) Update P8 supprt
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ober <[email protected]>
[ Upstream commit 43c056ac85b60232861005765153707f1b0354b6 ]
This fixes differences for the P8 system that was initially set to the same thermal values as the P7, also adds in the PSU sensor for all of the supported systems
--- drivers/hwmon/lenovo-ec-sensors.c | 34 +++++++++++++++++++++++++++---- 1 file changed, 30 insertions(+), 4 deletions(-)
drivers/hwmon/lenovo-ec-sensors.c +30 -4
@@ -66,7 +66,7 @@ enum systems { LENOVO_P8, }; -static int px_temp_map[] = {0 ,1 ,2 ,3 ,4 ,5 ,6 ,7 ,8 ,9 ,10 ,11 ,12 ,13 ,14 ,15 }; +static int px_temp_map[] = {0 ,1 ,2 ,3 ,4 ,5 ,6 ,7 ,8 ,9 ,10 ,11 ,12 ,13 ,14 ,31 ,32 };static const char *const lenovo_px_ec_temp_label[] = {"CPU1" ,
@@ -84,9 +84,29 @@ static const char * const lenovo_px_ec_temp_label[] = {"PCI_Z3" ,"PCI_Z4" ,"AMB" , +"PSU1" , + "PSU2", }; -static int gen_temp_map[] = {0 ,2 ,3 ,6 ,7 ,8 ,9 ,10 ,11 ,12 ,13 ,14 ,15 }; +static int p8_temp_map[] = {0 ,1 ,2 ,8 ,9 ,13 ,14 ,15 ,16 ,17 ,19 ,20 ,33 }; + +static const char *const lenovo_p8_ec_temp_label[] = { +"CPU1" , +"CPU_DIMM_BANK1" , +"CPU_DIMM_BANK2" , +"M2_Z2R" , +"M2_Z3R" , +"DIMM_RIGHT" , +"DIMM_LEFT" , +"PCI_Z1" , +"PCI_Z2" , +"PCI_Z3" , +"AMB" , +"REAR_VR" , +"PSU" , +}; + +static int gen_temp_map[] = {0 ,2 ,3 ,6 ,7 ,8 ,9 ,10 ,11 ,12 ,13 ,14 ,31 };static const char *const lenovo_gen_ec_temp_label[] = { "CPU1",
@@ -101,6 +121,7 @@ static const char * const lenovo_gen_ec_temp_label[] = {"PCI_Z3" ,"PCI_Z4" ,"AMB" , + "PSU", };static int px_fan_map[] = {0 ,1 ,2 ,3 ,4 ,5 ,6 ,7 ,8 ,9 ,10 ,11 ,12 ,13 ,14 ,15 };
@@ -293,6 +314,8 @@ static const struct hwmon_channel_info *lenovo_ec_hwmon_info_px[] = { HWMON_T_INPUT | HWMON_T_LABEL, HWMON_T_INPUT | HWMON_T_LABEL, HWMON_T_INPUT | HWMON_T_LABEL, + HWMON_T_INPUT | HWMON_T_LABEL, + HWMON_T_INPUT | HWMON_T_LABEL, HWMON_T_INPUT | HWMON_T_LABEL), HWMON_CHANNEL_INFO(fan, HWMON_F_INPUT | HWMON_F_LABEL | HWMON_F_MAX,
@@ -327,6 +350,7 @@ static const struct hwmon_channel_info *lenovo_ec_hwmon_info_p8[] = { HWMON_T_INPUT | HWMON_T_LABEL, HWMON_T_INPUT | HWMON_T_LABEL, HWMON_T_INPUT | HWMON_T_LABEL, + HWMON_T_INPUT | HWMON_T_LABEL, HWMON_T_INPUT | HWMON_T_LABEL), HWMON_CHANNEL_INFO(fan, HWMON_F_INPUT | HWMON_F_LABEL | HWMON_F_MAX,
@@ -359,6 +383,7 @@ static const struct hwmon_channel_info *lenovo_ec_hwmon_info_p7[] = { HWMON_T_INPUT | HWMON_T_LABEL, HWMON_T_INPUT | HWMON_T_LABEL, HWMON_T_INPUT | HWMON_T_LABEL, + HWMON_T_INPUT | HWMON_T_LABEL, HWMON_T_INPUT | HWMON_T_LABEL), HWMON_CHANNEL_INFO(fan, HWMON_F_INPUT | HWMON_F_LABEL | HWMON_F_MAX,
@@ -388,6 +413,7 @@ static const struct hwmon_channel_info *lenovo_ec_hwmon_info_p5[] = { HWMON_T_INPUT | HWMON_T_LABEL, HWMON_T_INPUT | HWMON_T_LABEL, HWMON_T_INPUT | HWMON_T_LABEL, + HWMON_T_INPUT | HWMON_T_LABEL, HWMON_T_INPUT | HWMON_T_LABEL), HWMON_CHANNEL_INFO(fan, HWMON_F_INPUT | HWMON_F_LABEL | HWMON_F_MAX,
@@ -545,9 +571,9 @@ static int lenovo_ec_probe(struct platform_device *pdev)break ;case 3 : ec_data->fan_labels = p8_ec_fan_label; - ec_data->temp_labels = lenovo_gen_ec_temp_label; + ec_data->temp_labels = lenovo_p8_ec_temp_label; ec_data->fan_map = p8_fan_map; - ec_data->temp_map = gen_temp_map; + ec_data->temp_map = p8_temp_map; lenovo_ec_chip_info.info = lenovo_ec_hwmon_info_p8;break ;default :
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 120/565 hwmon: (sbtsi_temp) AMD CPU extended temperature range support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuande Chen <[email protected]>
[ Upstream commit d9d61f1da35038793156c04bb13f0a1350709121 ]
Many AMD CPUs can support this feature now. We would get a wrong CPU DIE temperature if don't consider this. In low-temperature environments, the CPU die temperature can drop below zero. So many platforms would like to make extended temperature range as their default configuration. Default temperature range (0C to 255.875C).
Extended temperature range (-49C to +206.875C).
Ref Doc: AMD V3000 PPR (Doc ID #56558).
--- drivers/hwmon/sbtsi_temp.c | 46 +++++++++++++++++++++++++------------- 1 file changed, 31 insertions(+), 15 deletions(-)
drivers/hwmon/sbtsi_temp.c +31 -15
@@ -14,6 +14,7 @@#include <linux/module.h> #include <linux/mutex.h> #include <linux/of.h> +#include <linux/bitfield.h> /* * SB-TSI registers only support SMBus byte data access. "_INT" registers are
@@ -29,8 +30,22 @@#define SBTSI_REG_TEMP_HIGH_DEC 0x13/* RW */ #define SBTSI_REG_TEMP_LOW_DEC 0x14/* RW */ +/* +* Bit for reporting value with temperature measurement range. +* bit == 0: Use default temperature range (0C to 255.875C). +* bit == 1: Use extended temperature range (-49C to +206.875C). +*/ +#define SBTSI_CONFIG_EXT_RANGE_SHIFT 2 +/* +* ReadOrder bit specifies the reading order of integer and decimal part of +* CPU temperature for atomic reads. If bit == 0, reading integer part triggers +* latching of the decimal part, so integer part should be read first. +* If bit == 1, read order should be reversed. +*/ #define SBTSI_CONFIG_READ_ORDER_SHIFT 5 +#define SBTSI_TEMP_EXT_RANGE_ADJ 49000 +#define SBTSI_TEMP_MIN 0#define SBTSI_TEMP_MAX 255875
@@ -38,6 +53,8 @@struct sbtsi_data {struct i2c_client *client;struct mutex lock; +bool ext_range_mode; +bool read_order; };/*
@@ -74,23 +91,11 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type, {struct sbtsi_data *data =dev_get_drvdata (dev);s32 temp_int, temp_dec; -int err;switch (attr) {case hwmon_temp_input: -/* -* ReadOrder bit specifies the reading order of integer and -* decimal part of CPU temp for atomic reads. If bit == 0, -* reading integer part triggers latching of the decimal part, -* so integer part should be read first. If bit == 1, read -* order should be reversed. -*/ - err =i2c_smbus_read_byte_data (data->client,SBTSI_REG_CONFIG ); -if (err <0 ) -return err; -mutex_lock (&data->lock); -if (err &BIT (SBTSI_CONFIG_READ_ORDER_SHIFT )) { +if (data->read_order) { temp_dec =i2c_smbus_read_byte_data (data->client,SBTSI_REG_TEMP_DEC ); temp_int =i2c_smbus_read_byte_data (data->client,SBTSI_REG_TEMP_INT ); }else {
@@ -122,6 +127,8 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,return temp_dec; *val =sbtsi_reg_to_mc (temp_int, temp_dec); +if (data->ext_range_mode) + *val -=SBTSI_TEMP_EXT_RANGE_ADJ ;return 0 ; }
@@ -146,6 +153,8 @@ static int sbtsi_write(struct device *dev, enum hwmon_sensor_types type,return -EINVAL ; } +if (data->ext_range_mode) + val +=SBTSI_TEMP_EXT_RANGE_ADJ ; val =clamp_val (val,SBTSI_TEMP_MIN ,SBTSI_TEMP_MAX );sbtsi_mc_to_reg (val, &temp_int, &temp_dec);
@@ -203,6 +212,7 @@ static int sbtsi_probe(struct i2c_client *client)struct device *dev = &client->dev;struct device *hwmon_dev;struct sbtsi_data *data; +int err; data =devm_kzalloc (dev,sizeof (struct sbtsi_data ),GFP_KERNEL );if (!data)
@@ -211,8 +221,14 @@ static int sbtsi_probe(struct i2c_client *client) data->client = client;mutex_init (&data->lock); - hwmon_dev =devm_hwmon_device_register_with_info (dev, client->name, data, &sbtsi_chip_info, -NULL ); + err =i2c_smbus_read_byte_data (data->client,SBTSI_REG_CONFIG ); +if (err <0 ) +return err; + data->ext_range_mode =FIELD_GET (BIT (SBTSI_CONFIG_EXT_RANGE_SHIFT ), err); + data->read_order =FIELD_GET (BIT (SBTSI_CONFIG_READ_ORDER_SHIFT ), err); + + hwmon_dev =devm_hwmon_device_register_with_info (dev, client->name, data, + &sbtsi_chip_info,NULL );return PTR_ERR_OR_ZERO (hwmon_dev); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 103/565 ACPI: video: force native for Lenovo 82K8
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello (AMD) <[email protected]>
[ Upstream commit f144bc21befdcf8e54d2f19b23b4e84f13be01f9 ]
Lenovo 82K8 has a broken brightness control provided by nvidia_wmi_ec. Add a quirk to prevent using it.
--- drivers/acpi/video_detect.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/acpi/video_detect.c +8 -0
@@ -948,6 +948,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "Mipad2"), }, }, +/* https://gitlab.freedesktop.org/drm/amd/-/issues/4512 */ + { + .callback = video_detect_force_native, + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "82K8"), + }, + }, { }, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 121/565 pinctrl: keembay: release allocated memory in detach path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit aae7a2876c3b39d07aa7655ea082af8e7862f3a5 ]
Unlike all the other allocations in this driver, the memory for storing the pin function descriptions allocated with kcalloc() and later resized with krealloc() is never freed. Use devres like elsewhere to handle that. While at it - replace krealloc() with more suitable devm_krealloc_array().
Note: the logic in this module is pretty convoluted and could probably use some revisiting, we should probably be able to calculate the exact amount of memory needed in advance or even skip the allocation altogether and just add each function to the radix tree separately.
--- drivers/pinctrl/pinctrl-keembay.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/pinctrl/pinctrl-keembay.c +5 -2
@@ -1606,7 +1606,8 @@ static int keembay_build_functions(struct keembay_pinctrl *kpc)* being part of 8 (hw maximum) globally unique muxes. */ kpc->nfuncs =0 ; - keembay_funcs =kcalloc (kpc->npins *8 ,sizeof (*keembay_funcs),GFP_KERNEL ); + keembay_funcs =devm_kcalloc (kpc->dev, kpc->npins *8 , +sizeof (*keembay_funcs),GFP_KERNEL );if (!keembay_funcs)return -ENOMEM ;
@@ -1637,7 +1638,9 @@ static int keembay_build_functions(struct keembay_pinctrl *kpc) }/* Reallocate memory based on actual number of functions */ - new_funcs =krealloc (keembay_funcs, kpc->nfuncs *sizeof (*new_funcs),GFP_KERNEL ); + new_funcs =devm_krealloc_array (kpc->dev, keembay_funcs, + kpc->nfuncs,sizeof (*new_funcs), +GFP_KERNEL );if (!new_funcs) {kfree (keembay_funcs);return -ENOMEM ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 122/565 power: supply: sbs-charger: Support multiple devices
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabien Proriol <[email protected]>
[ Upstream commit 3ec600210849cf122606e24caab85f0b936cf63c ]
If we have 2 instances of sbs-charger in the DTS, the driver probe for the second instance will fail:
[ 8.012874] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered [ 8.039094] sbs-charger 18-0009: ltc4100: smart charger device registered [ 8.112911] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered [ 8.134533] sysfs: cannot create duplicate filename '/class/power_supply/sbs-charger' [ 8.143871] CPU: 3 PID: 295 Comm: systemd-udevd Tainted: G O 5.10.147 #22 [ 8.151974] Hardware name: ALE AMB (DT) [ 8.155828] Call trace: [ 8.158292] dump_backtrace+0x0/0x1d4 [ 8.161960] show_stack+0x18/0x6c [ 8.165280] dump_stack+0xcc/0x128 [ 8.168687] sysfs_warn_dup+0x60/0x7c [ 8.172353] sysfs_do_create_link_sd+0xf0/0x100 [ 8.176886] sysfs_create_link+0x20/0x40 [ 8.180816] device_add+0x270/0x7a4 [ 8.184311] __power_supply_register+0x304/0x560 [ 8.188930] devm_power_supply_register+0x54/0xa0 [ 8.193644] sbs_probe+0xc0/0x214 [sbs_charger] [ 8.198183] i2c_device_probe+0x2dc/0x2f4 [ 8.202196] really_probe+0xf0/0x510 [ 8.205774] driver_probe_device+0xfc/0x160 [ 8.209960] device_driver_attach+0xc0/0xcc [ 8.214146] __driver_attach+0xc0/0x170 [ 8.218002] bus_for_each_dev+0x74/0xd4 [ 8.221862] driver_attach+0x24/0x30 [ 8.225444] bus_add_driver+0x148/0x250 [ 8.229283] driver_register+0x78/0x130 [ 8.233140] i2c_register_driver+0x4c/0xe0 [ 8.237250] sbs_driver_init+0x20/0x1000 [sbs_charger] [ 8.242424] do_one_initcall+0x50/0x1b0 [ 8.242434] do_init_module+0x44/0x230 [ 8.242438] load_module+0x2200/0x27c0 [ 8.242442] __do_sys_finit_module+0xa8/0x11c [ 8.242447] __arm64_sys_finit_module+0x20/0x30 [ 8.242457] el0_svc_common.constprop.0+0x64/0x154 [ 8.242464] do_el0_svc+0x24/0x8c [ 8.242474] el0_svc+0x10/0x20 [ 8.242481] el0_sync_handler+0x108/0x114 [ 8.242485] el0_sync+0x180/0x1c0 [ 8.243847] sbs-charger 20-0009: Failed to register power supply [ 8.287934] sbs-charger: probe of 20-0009 failed with error -17
This is mainly because the "name" field of power_supply_desc is a constant. This patch fixes the issue by reusing the same approach as sbs-battery. With this patch, the result is:
[ 7.819532] sbs-charger 18-0009: ltc4100: smart charger device registered [ 7.825305] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered [ 7.887423] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered [ 7.893501] sbs-charger 20-0009: ltc4100: smart charger device registered
--- drivers/power/supply/sbs-charger.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
drivers/power/supply/sbs-charger.c +13 -3
@@ -154,8 +154,7 @@ static const struct regmap_config sbs_regmap = { .val_format_endian = REGMAP_ENDIAN_LITTLE, /* since based on SMBus */ }; -static const struct power_supply_desc sbs_desc = { - .name ="sbs-charger" , +static const struct power_supply_desc sbs_default_desc = { .type =POWER_SUPPLY_TYPE_MAINS , .properties = sbs_properties, .num_properties =ARRAY_SIZE (sbs_properties),
@@ -165,9 +164,20 @@ static const struct power_supply_desc sbs_desc = {static int sbs_probe (struct i2c_client *client) {struct power_supply_config psy_cfg = {}; +struct power_supply_desc *sbs_desc;struct sbs_info *chip;int ret, val; + sbs_desc =devm_kmemdup (&client->dev, &sbs_default_desc, +sizeof (*sbs_desc),GFP_KERNEL ); +if (!sbs_desc) +return -ENOMEM ; + + sbs_desc->name =devm_kasprintf (&client->dev,GFP_KERNEL ,"sbs-%s" , +dev_name (&client->dev)); +if (!sbs_desc->name) +return -ENOMEM ; + chip =devm_kzalloc (&client->dev,sizeof (struct sbs_info ),GFP_KERNEL );if (!chip)return -ENOMEM ;
@@ -191,7 +201,7 @@ static int sbs_probe(struct i2c_client *client)return dev_err_probe (&client->dev, ret,"Failed to get device status\n" ); chip->last_state = val; - chip->power_supply =devm_power_supply_register (&client->dev, &sbs_desc, &psy_cfg); + chip->power_supply =devm_power_supply_register (&client->dev, sbs_desc, &psy_cfg);if (IS_ERR (chip->power_supply))return dev_err_probe (&client->dev,PTR_ERR (chip->power_supply),"Failed to register power supply\n" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 123/565 hwmon: sy7636a: add alias
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Kemnade <[email protected]>
[ Upstream commit 80038a758b7fc0cdb6987532cbbf3f75b13e0826 ]
Add module alias to have it autoloaded.
--- drivers/hwmon/sy7636a-hwmon.c | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/sy7636a-hwmon.c +1 -0
@@ -104,3 +104,4 @@ module_platform_driver(sy7636a_sensor_driver);MODULE_DESCRIPTION ("SY7636A sensor driver" );MODULE_LICENSE ("GPL" ); +MODULE_ALIAS ("platform:sy7636a-temperature" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 124/565 irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Wang <[email protected]>
[ Upstream commit c33c43f71bda362b292a6e57ac41b64342dc87b3 ]
On certain Loongson platforms, drivers attempting to request a legacy ISA IRQ directly via request_irq() (e.g., IRQ 4) may fail. The virtual IRQ descriptor is not fully initialized and lacks a valid irqchip.
This issue does not affect ACPI-enumerated devices described in DSDT, as their interrupts are properly mapped via the GSI translation path. This indicates the LPC irqdomain itself is functional but is not correctly handling direct VIRQ-to-HWIRQ mappings.
The root cause is the use of irq_domain_create_linear(). This API sets up a domain for dynamic, on-demand mapping, typically triggered by a GSI request. It does not pre-populate the mappings for the legacy VIRQ range (0-15). Consequently, if no ACPI device claims a specific GSI (e.g., GSI 4), the corresponding VIRQ (e.g., VIRQ 4) is never mapped to the LPC domain. A direct call to request_irq(4, ...) then fails because the kernel cannot resolve this VIRQ to a hardware interrupt managed by the LPC controller.
The PCH-LPC interrupt controller is an i8259-compatible legacy device that requires a deterministic, static 1-to-1 mapping for IRQs 0-15 to support legacy drivers.
Fix this by replacing irq_domain_create_linear() with irq_domain_create_legacy(). This API is specifically designed for such controllers. It establishes the required static 1-to-1 VIRQ-to-HWIRQ mapping for the entire legacy range (0-15) immediately upon domain creation. This ensures that any VIRQ in this range is always resolvable, making direct calls to request_irq() for legacy IRQs function correctly.
--- drivers/irqchip/irq-loongson-pch-lpc.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/irqchip/irq-loongson-pch-lpc.c +7 -2
@@ -200,8 +200,13 @@ int __init pch_lpc_acpi_init(struct irq_domain *parent, goto iounmap_base; } - priv->lpc_domain =irq_domain_create_linear (irq_handle,LPC_COUNT , - &pch_lpc_domain_ops, priv); +/* +* The LPC interrupt controller is a legacy i8259-compatible device, +* which requires a static 1:1 mapping for IRQs 0-15. +* Use irq_domain_create_legacy to establish this static mapping early. +*/ + priv->lpc_domain =irq_domain_create_legacy (irq_handle,LPC_COUNT ,0 ,0 , + &pch_lpc_domain_ops, priv);if (!priv->lpc_domain) {pr_err ("Failed to create IRQ domain\n" ); goto free_irq_handle;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 125/565 cpufreq: ondemand: Update the efficient idle check for Intel extended Families
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sohil Mehta <[email protected]>
[ Upstream commit 7f3cfb7943d27a7b61bdac8db739cf0bdc28e87d ]
IO time is considered busy by default for modern Intel processors. The current check covers recent Family 6 models but excludes the brand new Families 18 and 19.
According to Arjan van de Ven, the model check was mainly due to a lack of testing on systems before INTEL_CORE2_MEROM. He suggests considering all Intel processors as having an efficient idle.
Extend the IO busy classification to all Intel processors starting with Family 6, including Family 15 (Pentium 4s) and upcoming Families 18/19.
Use an x86 VFM check and move the function to the header file to avoid using arch-specific #ifdefs in the C file.
--- drivers/cpufreq/cpufreq_ondemand.c | 25 +------------------------ drivers/cpufreq/cpufreq_ondemand.h | 23 +++++++++++++++++++++++ 2 files changed, 24 insertions(+), 24 deletions(-)
drivers/cpufreq/cpufreq_ondemand.c +1 -24
@@ -29,29 +29,6 @@ static struct od_ops od_ops;static unsigned int default_powersave_bias; -/* -* Not all CPUs want IO time to be accounted as busy; this depends on how -* efficient idling at a higher frequency/voltage is. -* Pavel Machek says this is not so for various generations of AMD and old -* Intel systems. -* Mike Chan (android.com) claims this is also not true for ARM. -* Because of this, whitelist specific known (series) of CPUs by default, and -* leave all others up to the user. -*/ -static int should_io_be_busy (void ) -{ -#if defined(CONFIG_X86 ) -/* -* For Intel, Core 2 (model 15) and later have an efficient idle. -*/ -if (boot_cpu_data.x86_vendor ==X86_VENDOR_INTEL && - boot_cpu_data.x86 ==6 && - boot_cpu_data.x86_model >=15 ) -return 1 ; -#endif -return 0 ; -} -/* * Find right freq to be set now with powersave_bias on. * Returns the freq_hi to be used right now and will set freq_hi_delay_us,
@@ -377,7 +354,7 @@ static int od_init(struct dbs_data *dbs_data) dbs_data->sampling_down_factor =DEF_SAMPLING_DOWN_FACTOR ; dbs_data->ignore_nice_load =0 ; tuners->powersave_bias = default_powersave_bias; - dbs_data->io_is_busy =should_io_be_busy (); + dbs_data->io_is_busy =od_should_io_be_busy (); dbs_data->tuners = tuners;return 0 ;
drivers/cpufreq/cpufreq_ondemand.h +23 -0
@@ -24,3 +24,26 @@ static inline struct od_policy_dbs_info *to_dbs_info(struct policy_dbs_info *polstruct od_dbs_tuners {unsigned int powersave_bias; }; + +#ifdef CONFIG_X86 +#include <asm/cpu_device_id.h> + +/* +* Not all CPUs want IO time to be accounted as busy; this depends on +* how efficient idling at a higher frequency/voltage is. +* +* Pavel Machek says this is not so for various generations of AMD and +* old Intel systems. Mike Chan (android.com) claims this is also not +* true for ARM. +* +* Because of this, select a known series of Intel CPUs (Family 6 and +* later) by default, and leave all others up to the user. +*/ +static inline bool od_should_io_be_busy (void ) +{ +return (boot_cpu_data.x86_vendor ==X86_VENDOR_INTEL && + boot_cpu_data.x86_vfm >=INTEL_PENTIUM_PRO ); +} +#else +static inline bool od_should_io_be_busy (void ) {return false; } +#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 126/565 arm64: zynqmp: Disable coresight by default
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quanyang Wang <[email protected]>
[ Upstream commit 0e3f9140ad04dca9a6a93dd6a6decdc53fd665ca ]
When secure-boot mode of bootloader is enabled, the registers of coresight are not permitted to access that's why disable it by default.
--- arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm64/boot/dts/xilinx/zynqmp.dtsi +4 -0
@@ -450,6 +450,7 @@ reg = <0x0 0xfec10000 0x0 0x1000>; clock-names = "apb_pclk"; cpu = <&cpu0>; + status = "disabled"; }; cpu1_debug: debug@fed10000 {
@@ -457,6 +458,7 @@ reg = <0x0 0xfed10000 0x0 0x1000>; clock-names = "apb_pclk"; cpu = <&cpu1>; + status = "disabled"; }; cpu2_debug: debug@fee10000 {
@@ -464,6 +466,7 @@ reg = <0x0 0xfee10000 0x0 0x1000>; clock-names = "apb_pclk"; cpu = <&cpu2>; + status = "disabled"; }; cpu3_debug: debug@fef10000 {
@@ -471,6 +474,7 @@ reg = <0x0 0xfef10000 0x0 0x1000>; clock-names = "apb_pclk"; cpu = <&cpu3>; + status = "disabled"; }; /* GDMA */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 127/565 arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radhey Shyam Pandey <[email protected]>
[ Upstream commit 767ecf9da7b31e5c0c22c273001cb2784705fe8c ]
On a few zcu106 boards USB devices (Dell MS116 USB Optical Mouse, Dell USB Entry Keyboard) are not enumerated on linux boot due to commit 'b8745e7eb488 ("arm64: zynqmp: Fix usb node drive strength and slew rate")'.
To fix it as a workaround revert to working version and then investigate at board level why drive strength from 12mA to 4mA and slew from fast to slow is not working.
--- arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts +2 -2
@@ -808,8 +808,8 @@ pins = "MIO54", "MIO56", "MIO57", "MIO58", "MIO59", "MIO60", "MIO61", "MIO62", "MIO63"; bias-disable; - drive-strength = <4>; - slew-rate = <SLEW_RATE_SLOW>; + drive-strength = <12>; + slew-rate = <SLEW_RATE_FAST>; }; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 128/565 soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Svyatoslav Ryhel <[email protected]>
[ Upstream commit b9c01adedf38c69abb725a60a05305ef70dbce03 ]
Add missing Tegra114 nvmem cells and fuse lookups which were added for Tegra124+ but omitted for Tegra114.
--- drivers/soc/tegra/fuse/fuse-tegra30.c | 122 ++++++++++++++++++++++++++ 1 file changed, 122 insertions(+)
drivers/soc/tegra/fuse/fuse-tegra30.c +122 -0
@@ -117,6 +117,124 @@ const struct tegra_fuse_soc tegra30_fuse_soc = {#endif #ifdef CONFIG_ARCH_TEGRA_114_SOC +static const struct nvmem_cell_info tegra114_fuse_cells[] = { + { + .name ="tsensor-cpu1" , + .offset =0x084 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-cpu2" , + .offset =0x088 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-common" , + .offset =0x08c , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-cpu0" , + .offset =0x098 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="xusb-pad-calibration" , + .offset =0x0f0 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-cpu3" , + .offset =0x12c , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-gpu" , + .offset =0x154 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-mem0" , + .offset =0x158 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-mem1" , + .offset =0x15c , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-pllx" , + .offset =0x160 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, +}; + +static const struct nvmem_cell_lookup tegra114_fuse_lookups[] = { + { + .nvmem_name ="fuse" , + .cell_name ="xusb-pad-calibration" , + .dev_id ="7009f000.padctl" , + .con_id ="calibration" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-common" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="common" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-cpu0" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="cpu0" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-cpu1" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="cpu1" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-cpu2" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="cpu2" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-cpu3" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="cpu3" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-mem0" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="mem0" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-mem1" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="mem1" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-gpu" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="gpu" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-pllx" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="pllx" , + }, +}; +static const struct tegra_fuse_info tegra114_fuse_info = { .read = tegra30_fuse_read, .size = 0x2a0,
@@ -127,6 +245,10 @@ const struct tegra_fuse_soc tegra114_fuse_soc = { .init = tegra30_fuse_init, .speedo_init = tegra114_init_speedo_data, .info = &tegra114_fuse_info, + .lookups = tegra114_fuse_lookups, + .num_lookups = ARRAY_SIZE(tegra114_fuse_lookups), + .cells = tegra114_fuse_cells, + .num_cells = ARRAY_SIZE(tegra114_fuse_cells), .soc_attr_group = &tegra_soc_attr_group, .clk_suspend_on = false, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 129/565 ARM: tegra: p880: set correct touchscreen clipping
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Schwöbel <[email protected]>
[ Upstream commit b49a73a08100ab139e07cfa7ca36e9b15787d0ab ]
Existing touchscreen clipping is too small and causes problems with touchscreen accuracy.
--- arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts +2 -2
@@ -108,8 +108,8 @@ i2c@7000c400 { touchscreen@20 { rmi4-f11@11 { - syna,clip-x-high = <1110>; - syna,clip-y-high = <1973>; + syna,clip-x-high = <1440>; + syna,clip-y-high = <2560>; touchscreen-inverted-y; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 130/565 ARM: tegra: transformer-20: add missing magnetometer interrupt
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Svyatoslav Ryhel <[email protected]>
[ Upstream commit cca41614d15ce2bbc2c661362d3eafe53c9990af ]
Add missing interrupt to magnetometer node.
--- arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts | 3 +++ 1 file changed, 3 insertions(+)
arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts +3 -0
@@ -502,6 +502,9 @@ compatible = "asahi-kasei,ak8974"; reg = <0xe>; + interrupt-parent = <&gpio>; + interrupts = <TEGRA_GPIO(N, 5) IRQ_TYPE_EDGE_RISING>; + avdd-supply = <&vdd_3v3_sys>; dvdd-supply = <&vdd_1v8_sys>;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 104/565 libbpf: Fix USDT SIB argument handling causing unrecognized register error
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawei Zhao <[email protected]>
[ Upstream commit 758acb9ccfdbf854b55abaceaf1f3f229cde3d19 ]
On x86-64, USDT arguments can be specified using Scale-Index-Base (SIB) addressing, e.g. "1@-96(%rbp,%rax,8)". The current USDT implementation in libbpf cannot parse this format, causing bpf_program__attach_usdt() to fail with -ENOENT (unrecognized register).
This patch fixes this by implementing the necessary changes:
- add correct handling for SIB-addressed arguments in bpf_usdt_arg.
- add adaptive support to __bpf_usdt_arg_type and __bpf_usdt_arg_spec to represent SIB addressing parameters.
--- tools/lib/bpf/usdt.bpf.h | 44 ++++++++++++++++++++++++++-- tools/lib/bpf/usdt.c | 62 ++++++++++++++++++++++++++++++++++++---- 2 files changed, 99 insertions(+), 7 deletions(-)
tools/lib/bpf/usdt.bpf.h +42 -2
@@ -34,13 +34,32 @@ enum __bpf_usdt_arg_type {BPF_USDT_ARG_CONST ,BPF_USDT_ARG_REG ,BPF_USDT_ARG_REG_DEREF , + BPF_USDT_ARG_SIB, }; +/* +* This struct layout is designed specifically to be backwards/forward +* compatible between libbpf versions for ARG_CONST, ARG_REG, and +* ARG_REG_DEREF modes. ARG_SIB requires libbpf v1.7+. +*/ struct __bpf_usdt_arg_spec {/* u64 scalar interpreted depending on arg_type, see below */ __u64 val_off; +#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__/* arg location case, see bpf_usdt_arg() for details */ -enum __bpf_usdt_arg_type arg_type; +enum __bpf_usdt_arg_type arg_type:8 ; +/* index register offset within struct pt_regs */ +__u16 idx_reg_off:12 ; +/* scale factor for index register (1, 2, 4, or 8) */ +__u16 scale_bitshift:4 ; +/* reserved for future use, keeps reg_off offset stable */ +__u8 __reserved:8 ; +#else +__u8 __reserved:8 ; +__u16 idx_reg_off:12 ; +__u16 scale_bitshift:4 ; +enum __bpf_usdt_arg_type arg_type:8 ; +#endif /* offset of referenced register within struct pt_regs */ short reg_off;/* whether arg should be interpreted as signed value */
@@ -117,7 +136,7 @@ int bpf_usdt_arg(struct pt_regs *ctx, __u64 arg_num, long *res) {struct __bpf_usdt_spec *spec;struct __bpf_usdt_arg_spec *arg_spec; -unsigned long val; +unsigned long val, idx;int err, spec_id; *res =0 ;
@@ -170,6 +189,27 @@ int bpf_usdt_arg(struct pt_regs *ctx, __u64 arg_num, long *res)return err;#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__ val >>= arg_spec->arg_bitshift; +#endif +break ; +case BPF_USDT_ARG_SIB : +/* Arg is in memory addressed by SIB (Scale-Index-Base) mode +* (e.g., "-1@-96(%rbp,%rax,8)" in USDT arg spec). We first +* fetch the base register contents and the index register +* contents from pt_regs. Then we calculate the final address +* as base + (index * scale) + offset, and do a user-space +* probe read to fetch the argument value. +*/ + err =bpf_probe_read_kernel (&val,sizeof (val), (void *)ctx + arg_spec->reg_off); +if (err) +return err; + err =bpf_probe_read_kernel (&idx,sizeof (idx), (void *)ctx + arg_spec->idx_reg_off); +if (err) +return err; + err =bpf_probe_read_user (&val,sizeof (val), (void *)(val + (idx << arg_spec->scale_bitshift) + arg_spec->val_off)); +if (err) +return err; +#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__ + val >>= arg_spec->arg_bitshift;#endif break ;default :
tools/lib/bpf/usdt.c +57 -5
86 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 131/565 ARM: tegra: transformer-20: fix audio-codec interrupt
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Svyatoslav Ryhel <[email protected]>
[ Upstream commit 3f973d78d176768fa7456def97f0b9824235024f ]
Correct audio-codec interrupt should be PX3 while PX1 is used for external microphone detection.
--- arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts +1 -1
@@ -518,7 +518,7 @@ reg = <0x1a>; interrupt-parent = <&gpio>; - interrupts = <TEGRA_GPIO(X, 1) IRQ_TYPE_EDGE_BOTH>; + interrupts = <TEGRA_GPIO(X, 3) IRQ_TYPE_EDGE_BOTH>; gpio-controller; #gpio-cells = <2>;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 132/565 firmware: qcom: tzmem: disable sc7180 platform
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Travkin <[email protected]>
[ Upstream commit 3cc9a8cadaf66e1a53e5fee48f8bcdb0a3fd5075 ]
When SHM bridge is enabled, assigning RMTFS memory causes the calling core to hang if the system is running in EL1.
Disable SHM bridge on sc7180 devices to avoid that hang.
--- drivers/firmware/qcom/qcom_tzmem.c | 1 + 1 file changed, 1 insertion(+)
drivers/firmware/qcom/qcom_tzmem.c +1 -0
@@ -76,6 +76,7 @@ static bool qcom_tzmem_using_shm_bridge;/* List of machines that are known to not support SHM bridge correctly. */ static const char *const qcom_tzmem_blacklist[] = { +"qcom,sc7180" ,/* hang in rmtfs memory assignment */ "qcom,sc8180x" ,"qcom,sdm670" ,/* failure in GPU firmware loading */ "qcom,sdm845" ,/* reset in rmtfs memory assignment */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 133/565 mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarthak Garg <[email protected]>
[ Upstream commit 08b68ca543ee9d5a8d2dc406165e4887dd8f170b ]
For Qualcomm SoCs which needs level shifter for SD card, extra delay is seen on receiver data path.
To compensate this delay enable tuning for SDR50 mode for targets which has level shifter. SDHCI_SDR50_NEEDS_TUNING caps will be set for targets with level shifter on Qualcomm SOC's.
--- drivers/mmc/host/sdhci-msm.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/mmc/host/sdhci-msm.c +15 -0
@@ -81,6 +81,7 @@#define CORE_IO_PAD_PWR_SWITCH_EN BIT(15)#define CORE_IO_PAD_PWR_SWITCH BIT(16)#define CORE_HC_SELECT_IN_EN BIT(18) +#define CORE_HC_SELECT_IN_SDR50 (4 << 19)#define CORE_HC_SELECT_IN_HS400 (6 << 19)#define CORE_HC_SELECT_IN_MASK (7 << 19)
@@ -1133,6 +1134,10 @@ static bool sdhci_msm_is_tuning_needed(struct sdhci_host *host) {struct mmc_ios *ios = &host->mmc->ios; +if (ios->timing ==MMC_TIMING_UHS_SDR50 && + host->flags &SDHCI_SDR50_NEEDS_TUNING ) +return true; +/* * Tuning is required for SDR104, HS200 and HS400 cards and * if clock frequency is greater than 100MHz in these modes.
@@ -1201,6 +1206,8 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)struct mmc_ios ios = host->mmc->ios;struct sdhci_pltfm_host *pltfm_host =sdhci_priv (host);struct sdhci_msm_host *msm_host =sdhci_pltfm_priv (pltfm_host); +const struct sdhci_msm_offset *msm_offset = msm_host->offset; +u32 config;if (!sdhci_msm_is_tuning_needed (host)) { msm_host->use_cdr = false;
@@ -1217,6 +1224,14 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)*/ msm_host->tuning_done =0 ; +if (ios.timing ==MMC_TIMING_UHS_SDR50 && + host->flags &SDHCI_SDR50_NEEDS_TUNING ) { + config =readl_relaxed (host->ioaddr + msm_offset->core_vendor_spec); + config &= ~CORE_HC_SELECT_IN_MASK ; + config |=CORE_HC_SELECT_IN_EN |CORE_HC_SELECT_IN_SDR50 ; +writel_relaxed (config, host->ioaddr + msm_offset->core_vendor_spec); + } +/* * For HS400 tuning in HS200 timing requires: * - select MCLK/2 in VENDOR_SPEC
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 134/565 pwm: pca9685: Use bulk write to atomicially update registers
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit de5855613263b426ee697dd30224322f2e634dec ]
The output of a PWM channel is configured by four register values. Write them in a single i2c transaction to ensure glitch free updates.
--- drivers/pwm/pwm-pca9685.c | 46 ++++++++++++++++++++++++--------------- 1 file changed, 29 insertions(+), 17 deletions(-)
drivers/pwm/pwm-pca9685.c +29 -17
@@ -62,6 +62,8 @@#define MODE1_SUB2 BIT(2)#define MODE1_SUB1 BIT(3)#define MODE1_SLEEP BIT(4) +#define MODE1_AI BIT(5) +#define MODE2_INVRT BIT(4)#define MODE2_OUTDRV BIT(2)
@@ -132,6 +134,19 @@ static int pca9685_write_reg(struct pwm_chip *chip, unsigned int reg, unsigned ireturn err; } +static int pca9685_write_4reg (struct pwm_chip *chip,unsigned int reg,u8 val[4 ]) +{ +struct pca9685 *pca =to_pca (chip); +struct device *dev =pwmchip_parent (chip); +int err; + + err =regmap_bulk_write (pca->regmap, reg, val,4 ); +if (err) +dev_err (dev,"regmap_write to register 0x%x failed: %pe\n" , reg,ERR_PTR (err)); + +return err; +} +/* Helper function to set the duty cycle ratio to duty/4096 (e.g. duty=2048 -> 50%) */ static void pca9685_pwm_set_duty (struct pwm_chip *chip,int channel,unsigned int duty) {
@@ -144,12 +159,10 @@ static void pca9685_pwm_set_duty(struct pwm_chip *chip, int channel, unsigned inreturn ; }else if (duty >=PCA9685_COUNTER_RANGE ) {/* Set the full ON bit and clear the full OFF bit */ -pca9685_write_reg (chip,REG_ON_H (channel),LED_FULL ); -pca9685_write_reg (chip,REG_OFF_H (channel),0 ); +pca9685_write_4reg (chip,REG_ON_L (channel), (u8 [4 ]){0 ,LED_FULL ,0 ,0 });return ; } -if (pwm->state.usage_power && channel <PCA9685_MAXCHAN ) {/* * If usage_power is set, the pca9685 driver will phase shift
@@ -164,12 +177,9 @@ static void pca9685_pwm_set_duty(struct pwm_chip *chip, int channel, unsigned in off = (on + duty) %PCA9685_COUNTER_RANGE ; -/* Set ON time (clears full ON bit) */ -pca9685_write_reg (chip,REG_ON_L (channel), on &0xff ); -pca9685_write_reg (chip,REG_ON_H (channel), (on >>8 ) &0xf ); -/* Set OFF time (clears full OFF bit) */ -pca9685_write_reg (chip,REG_OFF_L (channel), off &0xff ); -pca9685_write_reg (chip,REG_OFF_H (channel), (off >>8 ) &0xf ); +/* implicitly clear full ON and full OFF bit */ +pca9685_write_4reg (chip,REG_ON_L (channel), + (u8 [4 ]){ on &0xff , (on >>8 ) &0xf , off &0xff , (off >>8 ) &0xf }); }static unsigned int pca9685_pwm_get_duty (struct pwm_chip *chip,int channel)
@@ -543,9 +553,8 @@ static int pca9685_pwm_probe(struct i2c_client *client)mutex_init (&pca->lock); - ret =pca9685_read_reg (chip,PCA9685_MODE2 , ®); -if (ret) -return ret; +/* clear MODE2_OCH */ + reg =0 ;if (device_property_read_bool (&client->dev,"invert" )) reg |=MODE2_INVRT ;
@@ -561,16 +570,19 @@ static int pca9685_pwm_probe(struct i2c_client *client)if (ret)return ret; -/* Disable all LED ALLCALL and SUBx addresses to avoid bus collisions */ +/* +* Disable all LED ALLCALL and SUBx addresses to avoid bus collisions, +* enable Auto-Increment. +*/ pca9685_read_reg (chip,PCA9685_MODE1 , ®); reg &= ~(MODE1_ALLCALL |MODE1_SUB1 |MODE1_SUB2 |MODE1_SUB3 ); + reg |=MODE1_AI ;pca9685_write_reg (chip,PCA9685_MODE1 , reg);/* Reset OFF/ON registers to POR default */ -pca9685_write_reg (chip,PCA9685_ALL_LED_OFF_L ,0 ); -pca9685_write_reg (chip,PCA9685_ALL_LED_OFF_H ,LED_FULL ); -pca9685_write_reg (chip,PCA9685_ALL_LED_ON_L ,0 ); -pca9685_write_reg (chip,PCA9685_ALL_LED_ON_H ,LED_FULL ); + ret =pca9685_write_4reg (chip,PCA9685_ALL_LED_ON_L , (u8 []){0 ,LED_FULL ,0 ,LED_FULL }); +if (ret <0 ) +return dev_err_probe (&client->dev, ret,"Failed to reset ON/OFF registers\n" ); chip->ops = &pca9685_pwm_ops;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 135/565 ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit e9dff11a7a50fcef23fe3e8314fafae6d5641826 ]
When deleting the previous walkstate operand stack acpi_ds_call_control_method() was deleting obj_desc->Method.param_count operands. But Method.param_count does not necessarily match this_walk_state->num_operands, it may be either less or more.
After correcting the for loop to check i < this_walk_state->num_operands the code is identical to acpi_ds_clear_operands(), so just outright replace the code with acpi_ds_clear_operands() to fix this.
--- drivers/acpi/acpica/dsmethod.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-)
drivers/acpi/acpica/dsmethod.c +1 -8
@@ -546,14 +546,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,* Delete the operands on the previous walkstate operand stack * (they were copied to new objects) */ -for (i =0 ; i < obj_desc->method.param_count; i++) { -acpi_ut_remove_reference (this_walk_state->operands[i]); - this_walk_state->operands[i] =NULL ; - } - -/* Clear the operand stack */ - - this_walk_state->num_operands =0 ; +acpi_ds_clear_operands (this_walk_state); ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH, "**** Begin nested execution of [%4.4s] **** WalkState=%p\n",
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 136/565 tee: allow a driver to allocate a tee_device without a pool
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amirreza Zarrabi <[email protected]>
[ Upstream commit 6dbcd5a9ab6cb6644e7d728521da1c9035ec7235 ]
A TEE driver doesn't always need to provide a pool if it doesn't support memory sharing ioctls and can allocate memory for TEE messages in another way. Although this is mentioned in the documentation for tee_device_alloc(), it is not handled correctly.
--- drivers/tee/tee_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tee/tee_core.c +1 -1
@@ -889,7 +889,7 @@ struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,if (!teedesc || !teedesc->name || !teedesc->ops || !teedesc->ops->get_version || !teedesc->ops->open || - !teedesc->ops->release || !pool) + !teedesc->ops->release)return ERR_PTR (-EINVAL ); teedev =kzalloc (sizeof (*teedev),GFP_KERNEL );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 137/565 nvmet-fc: avoid scheduling association deletion twice
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <[email protected]>
[ Upstream commit f2537be4f8421f6495edfa0bc284d722f253841d ]
When forcefully shutting down a port via the configfs interface, nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and then nvmet_disable_port(). Both functions will eventually schedule all remaining associations for deletion.
The current implementation checks whether an association is about to be removed, but only after the work item has already been scheduled. As a result, it is possible for the first scheduled work item to free all resources, and then for the same work item to be scheduled again for deletion.
Because the association list is an RCU list, it is not possible to take a lock and remove the list entry directly, so it cannot be looked up again. Instead, a flag (terminating) must be used to determine whether the association is already in the process of being deleted.
--- drivers/nvme/target/fc.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/nvme/target/fc.c +9 -7
@@ -1088,6 +1088,14 @@ nvmet_fc_delete_assoc_work(struct work_struct *work)static void nvmet_fc_schedule_delete_assoc (struct nvmet_fc_tgt_assoc *assoc) { +int terminating; + + terminating =atomic_xchg (&assoc->terminating,1 ); + +/* if already terminating, do nothing */ +if (terminating) +return ; +nvmet_fc_tgtport_get (assoc->tgtport);if (!queue_work (nvmet_wq, &assoc->del_work))nvmet_fc_tgtport_put (assoc->tgtport);
@@ -1214,13 +1222,7 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc) {struct nvmet_fc_tgtport *tgtport = assoc->tgtport;unsigned long flags; -int i, terminating; - - terminating =atomic_xchg (&assoc->terminating,1 ); - -/* if already terminating, do nothing */ -if (terminating) -return ; +int i;spin_lock_irqsave (&tgtport->lock, flags);list_del_rcu (&assoc->a_list);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 138/565 nvme-fc: use lock accessing port_state and rport state
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <[email protected]>
[ Upstream commit 891cdbb162ccdb079cd5228ae43bdeebce8597ad ]
nvme_fc_unregister_remote removes the remote port on a lport object at any point in time when there is no active association. This races with with the reconnect logic, because nvme_fc_create_association is not taking a lock to check the port_state and atomically increase the active count on the rport.
--- drivers/nvme/host/fc.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/nvme/host/fc.c +8 -2
@@ -3026,11 +3026,17 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl) ++ctrl->ctrl.nr_reconnects; -if (ctrl->rport->remoteport.port_state !=FC_OBJSTATE_ONLINE ) +spin_lock_irqsave (&ctrl->rport->lock, flags); +if (ctrl->rport->remoteport.port_state !=FC_OBJSTATE_ONLINE ) { +spin_unlock_irqrestore (&ctrl->rport->lock, flags);return -ENODEV ; + } -if (nvme_fc_ctlr_active_on_rport (ctrl)) +if (nvme_fc_ctlr_active_on_rport (ctrl)) { +spin_unlock_irqrestore (&ctrl->rport->lock, flags);return -ENOTUNIQ ; + } +spin_unlock_irqrestore (&ctrl->rport->lock, flags);dev_info (ctrl->ctrl.device, "NVME-FC{%d}: create association : host wwpn 0x%016llx "
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 139/565 bpf: Do not limit bpf_cgroup_from_id to currents namespace
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kumar Kartikeya Dwivedi <[email protected]>
[ Upstream commit 2c895133950646f45e5cf3900b168c952c8dbee8 ]
The bpf_cgroup_from_id kfunc relies on cgroup_get_from_id to obtain the cgroup corresponding to a given cgroup ID. This helper can be called in a lot of contexts where the current thread can be random. A recent example was its use in sched_ext's ops.tick(), to obtain the root cgroup pointer. Since the current task can be whatever random user space task preempted by the timer tick, this makes the behavior of the helper unreliable.
Refactor out __cgroup_get_from_id as the non-namespace aware version of cgroup_get_from_id, and change bpf_cgroup_from_id to make use of it.
There is no compatibility breakage here, since changing the namespace against which the lookup is being done to the root cgroup namespace only permits a wider set of lookups to succeed now. The cgroup IDs across namespaces are globally unique, and thus don't need to be retranslated.
--- include/linux/cgroup.h | 1 + kernel/bpf/helpers.c | 2 +- kernel/cgroup/cgroup.c | 24 ++++++++++++++++++++---- 3 files changed, 22 insertions(+), 5 deletions(-)
include/linux/cgroup.h +1 -0
@@ -631,6 +631,7 @@ static inline void cgroup_kthread_ready(void) }void cgroup_path_from_kernfs_id (u64 id,char *buf,size_t buflen); +struct cgroup *__cgroup_get_from_id (u64 id);struct cgroup *cgroup_get_from_id (u64 id);#else /* !CONFIG_CGROUPS */
kernel/bpf/helpers.c +1 -1
@@ -2455,7 +2455,7 @@ __bpf_kfunc struct cgroup *bpf_cgroup_from_id(u64 cgid) {struct cgroup *cgrp; - cgrp =cgroup_get_from_id (cgid); + cgrp =__cgroup_get_from_id (cgid);if (IS_ERR (cgrp))return NULL ;return cgrp;
kernel/cgroup/cgroup.c +20 -4
@@ -6343,15 +6343,15 @@ void cgroup_path_from_kernfs_id(u64 id, char *buf, size_t buflen) }/* -* cgroup_get_from_id : get the cgroup associated with cgroup id +* __cgroup_get_from_id : get the cgroup associated with cgroup id * @id: cgroup id * On success return the cgrp or ERR_PTR on failure -* Only cgroups within current task's cgroup NS are valid. +* There are no cgroup NS restrictions. */ -struct cgroup *cgroup_get_from_id (u64 id) +struct cgroup *__cgroup_get_from_id (u64 id) {struct kernfs_node *kn; -struct cgroup *cgrp, *root_cgrp; +struct cgroup *cgrp; kn =kernfs_find_and_get_node_by_id (cgrp_dfl_root.kf_root, id);if (!kn)
@@ -6373,6 +6373,22 @@ struct cgroup *cgroup_get_from_id(u64 id)if (!cgrp)return ERR_PTR (-ENOENT ); +return cgrp; +} + +/* +* cgroup_get_from_id : get the cgroup associated with cgroup id +* @id: cgroup id +* On success return the cgrp or ERR_PTR on failure +* Only cgroups within current task's cgroup NS are valid. +*/ +struct cgroup *cgroup_get_from_id (u64 id) +{ +struct cgroup *cgrp, *root_cgrp; + + cgrp =__cgroup_get_from_id (id); +if (IS_ERR (cgrp)) +return cgrp; root_cgrp =current_cgns_cgroup_dfl ();if (!cgroup_is_descendant (cgrp, root_cgrp)) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 140/565 i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Nikula <[email protected]>
[ Upstream commit d515503f3c8a8475b2f78782534aad09722904e1 ]
Add I3C controller PCI IDs on Intel Wildcat Lake-U.
--- drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c +3 -0
@@ -124,6 +124,9 @@ static void mipi_i3c_hci_pci_remove(struct pci_dev *pci) }static const struct pci_device_id mipi_i3c_hci_pci_devices[] = { +/* Wildcat Lake-U */ + {PCI_VDEVICE (INTEL ,0x4d7c ), (kernel_ulong_t)&intel_info}, + {PCI_VDEVICE (INTEL ,0x4d6f ), (kernel_ulong_t)&intel_info},/* Panther Lake-H */ {PCI_VDEVICE (INTEL ,0xe37c ), (kernel_ulong_t)&intel_info}, {PCI_VDEVICE (INTEL ,0xe36f ), (kernel_ulong_t)&intel_info},
Signature · 1 line
2.51.0