mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-05-26 11:40:24 +02:00
bf94dea7fd4e6708d1a784be23db65eff84d82f1
1398251 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
|
|
95920c2ed0 |
page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches
Helge reported that the introduction of PP_MAGIC_MASK let to crashes on
boot on his 32-bit parisc machine. The cause of this is the mask is set
too wide, so the page_pool_page_is_pp() incurs false positives which
crashes the machine.
Just disabling the check in page_pool_is_pp() will lead to the page_pool
code itself malfunctioning; so instead of doing this, this patch changes
the define for PP_DMA_INDEX_BITS to avoid mistaking arbitrary kernel
pointers for page_pool-tagged pages.
The fix relies on the kernel pointers that alias with the pp_magic field
always being above PAGE_OFFSET. With this assumption, we can use the
lowest bit of the value of PAGE_OFFSET as the upper bound of the
PP_DMA_INDEX_MASK, which should avoid the false positives.
Because we cannot rely on PAGE_OFFSET always being a compile-time
constant, nor on it always being >0, we fall back to disabling the
dma_index storage when there are not enough bits available. This leaves
us in the situation we were in before the patch in the Fixes tag, but
only on a subset of architecture configurations. This seems to be the
best we can do until the transition to page types in complete for
page_pool pages.
v2:
- Make sure there's at least 8 bits available and that the PAGE_OFFSET
bit calculation doesn't wrap
Link: https://lore.kernel.org/all/aMNJMFa5fDalFmtn@p100/
Fixes:
|
||
|
|
fc282d1731 |
Merge tag 'uml-for-linux-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux
Pull uml updates from Johannes Berg: - minor preparations for SMP support - SPARSE_IRQ support for kunit - help output cleanups * tag 'uml-for-linux-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: um: Remove unused ipi_pipe field from cpuinfo_um um: Remove unused cpu_data and current_cpu_data macros um: Stop tracking virtual CPUs via mm_cpumask() um: Centralize stub size calculations um: Remove outdated comment about STUB_DATA_PAGES um: Remove unused offset and child_err fields from stub_data um: Indent time-travel help messages um: Fix help message for ssl-non-raw um: vector: Fix indentation for help message um: Add missing trailing newline to help messages um: virtio-pci: implement .shutdown() um: Support SPARSE_IRQ |
||
|
|
66128f4287 |
kbuild: uapi: Strip comments before size type check
On m68k, check_sizetypes in headers_check reports:
./usr/include/asm/bootinfo-amiga.h:17: found __[us]{8,16,32,64} type without #include <linux/types.h>
This header file does not use any of the Linux-specific integer types,
but merely refers to them from comments, so this is a false positive.
As of commit
|
||
|
|
e444c2d4a2 |
perf check: Add libLLVM feature
Advertise when perf is built with the HAVE_LIBLLVM_SUPPORT option.
Committer testing:
$ perf -vv | grep LLVM
libLLVM: [ on ] # HAVE_LIBLLVM_SUPPORT
$
And the form to use in scripts, notably the tools/perf/tests/shell/
'perf test' ones:
$ perf check feature libllvm
libLLVM: [ on ] # HAVE_LIBLLVM_SUPPORT
$ perf check -q feature libllvm && echo LLVM is present
LLVM is present
$ perf check -q feature liballvm && echo ALLVM is present
$
Signed-off-by: Ian Rogers <irogers@google.com>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alexandre Ghiti <alexghiti@rivosinc.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Athira Rajeev <atrajeev@linux.ibm.com>
Cc: Bill Wendling <morbo@google.com>
Cc: Charlie Jenkins <charlie@rivosinc.com>
Cc: Collin Funk <collin.funk1@gmail.com>
Cc: Dmitriy Vyukov <dvyukov@google.com>
Cc: Dr. David Alan Gilbert <linux@treblig.org>
Cc: Eric Biggers <ebiggers@kernel.org>
Cc: Haibo Xu <haibo1.xu@intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Justin Stitt <justinstitt@google.com>
Cc: Li Huafei <lihuafei1@huawei.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Nick Desaulniers <nick.desaulniers+lkml@gmail.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Song Liu <song@kernel.org>
Cc: Stephen Brennan <stephen.s.brennan@oracle.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
|
||
|
|
521405cb54 |
net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
Add missing of_node_put call to release device node tbi obtained
via for_each_child_of_node.
Fixes:
|
||
|
|
ba9dac9873 |
Merge tag 'libnvdimm-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm
Pull libnvdimm updates from Ira Weiny: "Primarily bug fixes. Dave introduced the usage of cleanup.h a bit late in the cycle to help with the new label work required within CXL [1] nvdimm: - Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - Clean up __nd_ioctl() and remove gotos - Remove duplicate linux/slab.h header - Introduce guard() for nvdimm_bus_lock - Use str_plural() to simplify the code ACPI: - NFIT: Fix incorrect ndr_desc being reportedin dev_err message" Link: https://lore.kernel.org/all/20250917134116.1623730-1-s.neeraj@samsung.com/ [1] * tag 'libnvdimm-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: nvdimm: Remove duplicate linux/slab.h header nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() nvdimm: Clean up __nd_ioctl() and remove gotos nvdimm: Introduce guard() for nvdimm_bus_lock ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message nvdimm: Use str_plural() to simplify the code |
||
|
|
2db687f346 |
ice: ice_adapter: release xa entry on adapter allocation failure
When ice_adapter_new() fails, the reserved XArray entry created by
xa_insert() is not released. This causes subsequent insertions at
the same index to return -EBUSY, potentially leading to
NULL pointer dereferences.
Reorder the operations as suggested by Przemek Kitszel:
1. Check if adapter already exists (xa_load)
2. Reserve the XArray slot (xa_reserve)
3. Allocate the adapter (ice_adapter_new)
4. Store the adapter (xa_store)
Fixes:
|
||
|
|
7fc25c5a5a |
selftest: net: ovpn: Fix uninit return values
Fix functions that return undefined values. These issues were caught by
running clang using LLVM=1 option.
Clang warnings are as follows:
ovpn-cli.c:1587:6: warning: variable 'ret' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
1587 | if (!sock) {
| ^~~~~
ovpn-cli.c:1635:9: note: uninitialized use occurs here
1635 | return ret;
| ^~~
ovpn-cli.c:1587:2: note: remove the 'if' if its condition is always false
1587 | if (!sock) {
| ^~~~~~~~~~~~
1588 | fprintf(stderr, "cannot allocate netlink socket\n");
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1589 | goto err_free;
| ~~~~~~~~~~~~~~
1590 | }
| ~
ovpn-cli.c:1584:15: note: initialize the variable 'ret' to silence this warning
1584 | int mcid, ret;
| ^
| = 0
ovpn-cli.c:2107:7: warning: variable 'ret' is used uninitialized whenever switch case is taken [-Wsometimes-uninitialized]
2107 | case CMD_INVALID:
| ^~~~~~~~~~~
ovpn-cli.c:2111:9: note: uninitialized use occurs here
2111 | return ret;
| ^~~
ovpn-cli.c:1939:12: note: initialize the variable 'ret' to silence this warning
1939 | int n, ret;
| ^
|
Fixes:
|
||
|
|
bc9ea78707 |
net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work
The origin code calls cancel_delayed_work() in ocelot_stats_deinit()
to cancel the cyclic delayed work item ocelot->stats_work. However,
cancel_delayed_work() may fail to cancel the work item if it is already
executing. While destroy_workqueue() does wait for all pending work items
in the work queue to complete before destroying the work queue, it cannot
prevent the delayed work item from being rescheduled within the
ocelot_check_stats_work() function. This limitation exists because the
delayed work item is only enqueued into the work queue after its timer
expires. Before the timer expiration, destroy_workqueue() has no visibility
of this pending work item. Once the work queue appears empty,
destroy_workqueue() proceeds with destruction. When the timer eventually
expires, the delayed work item gets queued again, leading to the following
warning:
workqueue: cannot queue ocelot_check_stats_work on wq ocelot-switch-stats
WARNING: CPU: 2 PID: 0 at kernel/workqueue.c:2255 __queue_work+0x875/0xaf0
...
RIP: 0010:__queue_work+0x875/0xaf0
...
RSP: 0018:ffff88806d108b10 EFLAGS: 00010086
RAX: 0000000000000000 RBX: 0000000000000101 RCX: 0000000000000027
RDX: 0000000000000027 RSI: 0000000000000004 RDI: ffff88806d123e88
RBP: ffffffff813c3170 R08: 0000000000000000 R09: ffffed100da247d2
R10: ffffed100da247d1 R11: ffff88806d123e8b R12: ffff88800c00f000
R13: ffff88800d7285c0 R14: ffff88806d0a5580 R15: ffff88800d7285a0
FS: 0000000000000000(0000) GS:ffff8880e5725000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe18e45ea10 CR3: 0000000005e6c000 CR4: 00000000000006f0
Call Trace:
<IRQ>
? kasan_report+0xc6/0xf0
? __pfx_delayed_work_timer_fn+0x10/0x10
? __pfx_delayed_work_timer_fn+0x10/0x10
call_timer_fn+0x25/0x1c0
__run_timer_base.part.0+0x3be/0x8c0
? __pfx_delayed_work_timer_fn+0x10/0x10
? rcu_sched_clock_irq+0xb06/0x27d0
? __pfx___run_timer_base.part.0+0x10/0x10
? try_to_wake_up+0xb15/0x1960
? _raw_spin_lock_irq+0x80/0xe0
? __pfx__raw_spin_lock_irq+0x10/0x10
tmigr_handle_remote_up+0x603/0x7e0
? __pfx_tmigr_handle_remote_up+0x10/0x10
? sched_balance_trigger+0x1c0/0x9f0
? sched_tick+0x221/0x5a0
? _raw_spin_lock_irq+0x80/0xe0
? __pfx__raw_spin_lock_irq+0x10/0x10
? tick_nohz_handler+0x339/0x440
? __pfx_tmigr_handle_remote_up+0x10/0x10
__walk_groups.isra.0+0x42/0x150
tmigr_handle_remote+0x1f4/0x2e0
? __pfx_tmigr_handle_remote+0x10/0x10
? ktime_get+0x60/0x140
? lapic_next_event+0x11/0x20
? clockevents_program_event+0x1d4/0x2a0
? hrtimer_interrupt+0x322/0x780
handle_softirqs+0x16a/0x550
irq_exit_rcu+0xaf/0xe0
sysvec_apic_timer_interrupt+0x70/0x80
</IRQ>
...
The following diagram reveals the cause of the above warning:
CPU 0 (remove) | CPU 1 (delayed work callback)
mscc_ocelot_remove() |
ocelot_deinit() | ocelot_check_stats_work()
ocelot_stats_deinit() |
cancel_delayed_work()| ...
| queue_delayed_work()
destroy_workqueue() | (wait a time)
| __queue_work() //UAF
The above scenario actually constitutes a UAF vulnerability.
The ocelot_stats_deinit() is only invoked when initialization
failure or resource destruction, so we must ensure that any
delayed work items cannot be rescheduled.
Replace cancel_delayed_work() with disable_delayed_work_sync()
to guarantee proper cancellation of the delayed work item and
ensure completion of any currently executing work before the
workqueue is deallocated.
A deadlock concern was considered: ocelot_stats_deinit() is called
in a process context and is not holding any locks that the delayed
work item might also need. Therefore, the use of the _sync() variant
is safe here.
This bug was identified through static analysis. To reproduce the
issue and validate the fix, I simulated ocelot-switch device by
writing a kernel module and prepared the necessary resources for
the virtual ocelot-switch device's probe process. Then, removing
the virtual device will trigger the mscc_ocelot_remove() function,
which in turn destroys the workqueue.
Fixes:
|
||
|
|
2e7cbbbe3d |
tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
syzbot reported the splat below in tcp_conn_request(). [0]
If a listener is close()d while a TFO socket is being processed in
tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk
and calls inet_child_forget(), which calls tcp_disconnect() for the
TFO socket.
After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(),
where reqsk_put() is called due to !reqsk->sk.
Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the
last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the
drop_and_free label causes the refcount underflow for the listener
and double-free of the reqsk.
Let's remove reqsk_fastopen_remove() in tcp_conn_request().
Note that other callers make sure tp->fastopen_rsk is not NULL.
[0]:
refcount_t: underflow; use-after-free.
WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28)
Modules linked in:
CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:refcount_warn_saturate (lib/refcount.c:28)
Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6
RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246
RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900
RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280
RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280
R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100
R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8
FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0
Call Trace:
<IRQ>
tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301)
tcp_rcv_state_process (net/ipv4/tcp_input.c:6708)
tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670)
tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906)
ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438)
ip6_input (net/ipv6/ip6_input.c:500)
ipv6_rcv (net/ipv6/ip6_input.c:311)
__netif_receive_skb (net/core/dev.c:6104)
process_backlog (net/core/dev.c:6456)
__napi_poll (net/core/dev.c:7506)
net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696)
handle_softirqs (kernel/softirq.c:579)
do_softirq (kernel/softirq.c:480)
</IRQ>
Fixes:
|
||
|
|
370e98728b |
net: wwan: t7xx: add support for HP DRMR-H01
add support for HP DRMR-H01 (0x03f0, 0x09c8) Signed-off-by: Sammy Hsu <sammy.hsu@wnc.com.tw> Link: https://patch.msgid.link/20251002024841.5979-1-sammy.hsu@wnc.com.tw Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
|
2f3119686e |
net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0
and sctp_ulpevent_make_authkey() returns 0, then the variable
ai_ev remains zero and the zero will be dereferenced
in the sctp_ulpevent_free() function.
Signed-off-by: Alexandr Sapozhnikov <alsp705@gmail.com>
Acked-by: Xin Long <lucien.xin@gmail.com>
Fixes:
|
||
|
|
112104e2b7 |
Merge branch 'clk-determine-rate' into clk-next
* clk-determine-rate: (120 commits) clk: microchip: core: remove duplicate roclk_determine_rate() clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver clk: scmi: migrate round_rate() to determine_rate() clk: ti: fapll: convert from round_rate() to determine_rate() clk: ti: dra7-atl: convert from round_rate() to determine_rate() clk: ti: divider: convert from round_rate() to determine_rate() clk: ti: composite: convert from round_rate() to determine_rate() clk: ti: dpll: convert from round_rate() to determine_rate() clk: ti: dpll: change error return from ~0 to -EINVAL clk: ti: dpll: remove round_rate() in favor of determine_rate() clk: tegra: tegra210-emc: convert from round_rate() to determine_rate() clk: tegra: super: convert from round_rate() to determine_rate() clk: tegra: pll: convert from round_rate() to determine_rate() clk: tegra: periph: divider: convert from round_rate() to determine_rate() clk: tegra: divider: convert from round_rate() to determine_rate() clk: tegra: audio-sync: convert from round_rate() to determine_rate() clk: fixed-factor: drop round_rate() clk ops clk: divider: remove round_rate() in favor of determine_rate() clk: visconti: pll: convert from round_rate() to determine_rate() clk: versatile: vexpress-osc: convert from round_rate() to determine_rate() ... |
||
|
|
f35f83208c |
Merge branches 'clk-aspeed' and 'clk-rockchip' into clk-next
* clk-aspeed: reset: aspeed: register AST2700 reset auxiliary bus device dt-bindings: clock: ast2700: modify soc0/1 clock define * clk-rockchip: clk: rockchip: rk3368: use clock ids for SCLK_MIPIDSI_24M dt-bindings: clock: rk3368: Add SCLK_MIPIDSI_24M |
||
|
|
169c9d06a2 |
Merge tag 'linux-watchdog-6.18-rc1' of git://www.linux-watchdog.org/linux-watchdog
Pull watchdog updates from Wim Van Sebroeck: - renesas,wdt: Add support for RZ/T2H and RZ/N2H - Add SMARC-sAM67 support - Several small fixes and improvements * tag 'linux-watchdog-6.18-rc1' of git://www.linux-watchdog.org/linux-watchdog: watchdog/hpwdt New maintianer dt-bindings: watchdog: add SMARC-sAM67 support watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog watchdog: visconti: don't print superfluous errors watchdog: rzv2h_wdt: don't print superfluous errors watchdog: rzg2l_wdt: don't print superfluous errors watchdog: s3c2410_wdt: exynosautov9: Enable supported features watchdog: s3c2410_wdt: exynosautov920: Enable QUIRK_HAS_32BIT_CNT watchdog: s3c2410_wdt: Increase max timeout value of watchdog watchdog: s3c2410_wdt: Fix max_timeout being calculated larger watchdog: s3c2410_wdt: Replace hardcoded values with macro definitions watchdog: rzv2h: Improve error strings and add newlines watchdog: rzv2h: Add support for RZ/T2H watchdog: rzv2h: Add support for configurable count clock source watchdog: rzv2h: Make "oscclk" and reset controller optional watchdog: rzv2h: Obtain clock-divider and timeout values from OF match data dt-bindings: watchdog: renesas,wdt: Add support for RZ/T2H and RZ/N2H watchdog: intel_oc_wdt: Do not try to write into const memory |
||
|
|
8397c58ea7 |
Merge branches 'clk-marvell', 'clk-xilinx', 'clk-mediatek' and 'clk-loongson' into clk-next
- Add Mediatek MT8196 clk drivers * clk-marvell: clk: mmp: pxa1908: Instantiate power driver through auxiliary bus * clk-xilinx: clk: clocking-wizard: Fix output clock register offset for Versal platforms clk: xilinx: Optimize divisor search in clk_wzrd_get_divisors_ver() * clk-mediatek: (31 commits) clk: mediatek: Add MT8196 vencsys clock support clk: mediatek: Add MT8196 vdecsys clock support clk: mediatek: Add MT8196 ovl1 clock support clk: mediatek: Add MT8196 ovl0 clock support clk: mediatek: Add MT8196 disp-ao clock support clk: mediatek: Add MT8196 disp1 clock support clk: mediatek: Add MT8196 disp0 clock support clk: mediatek: Add MT8196 mfg clock support clk: mediatek: Add MT8196 mdpsys clock support clk: mediatek: Add MT8196 mcu clock support clk: mediatek: Add MT8196 I2C clock support clk: mediatek: Add MT8196 pextpsys clock support clk: mediatek: Add MT8196 ufssys clock support clk: mediatek: Add MT8196 peripheral clock support clk: mediatek: Add MT8196 vlpckgen clock support clk: mediatek: Add MT8196 topckgen2 clock support clk: mediatek: Add MT8196 topckgen clock support clk: mediatek: Add MT8196 apmixedsys clock support dt-bindings: clock: mediatek: Describe MT8196 clock controllers clk: mediatek: clk-mtk: Add MUX_DIV_GATE macro ... * clk-loongson: clk: loongson2: Add clock definitions for Loongson-2K0300 SoC clk: loongson2: Avoid hardcoding firmware name of the reference clock clk: loongson2: Allow zero divisors for dividers clk: loongson2: Support scale clocks with an alternative mode clk: loongson2: Allow specifying clock flags for gate clock dt-bindings: clock: loongson2: Add Loongson-2K0300 compatible |
||
|
|
b91217d912 |
Merge branches 'clk-microchip', 'clk-lookup' and 'clk-st' into clk-next
- Speed up clk_core_lookup() by using a hashtable * clk-microchip: ARM: at91: remove default values for PMC_PLL_ACR clk: at91: add ACR in all PLL settings clk: at91: sam9x7: Add peripheral clock id for pmecc clk: at91: clk-master: Add check for divide by 3 clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register ARM: at91: pm: save and restore ACR during PLL disable/enable * clk-lookup: clk: Use hashtable for global clk lookups clk: Sort include statements * clk-st: dt-bindings: stm32: cosmetic fixes for STM32MP25 clock and reset bindings clk: stm32: introduce clocks for STM32MP21 platform dt-bindings: stm32: add STM32MP21 clocks and reset bindings |
||
|
|
f0fd248204 |
Merge branches 'clk-scmi', 'clk-qcom' and 'clk-broadcom' into clk-next
* clk-scmi: clk: scmi: Add duty cycle ops only when duty cycle is supported * clk-qcom: (27 commits) clk: qcom: gcc-sc8280xp: drop obsolete PCIe GDSC comment clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk clk: qcom: dispcc-glymur: Constify 'struct qcom_cc_desc' clk: qcom: gcc: Add support for Global Clock controller found on MSM8937 dt-bindings: clock: qcom: Add MSM8937 Global Clock Controller clk: qcom: Select the intended config in QCS_DISPCC_615 clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() clk: qcom: alpha-pll: convert from round_rate() to determine_rate() clk: qcom: milos: Constify 'struct qcom_cc_desc' clk: qcom: gcc: Add support for Global Clock Controller dt-bindings: clock: qcom: document the Glymur Global Clock Controller clk: qcom: clk-alpha-pll: Add support for Taycan EKO_T PLL clk: qcom: rpmh: Add support for Glymur rpmh clocks clk: qcom: Add TCSR clock driver for Glymur SoC dt-bindings: clock: qcom: Document the Glymur SoC TCSR Clock Controller dt-bindings: clock: qcom-rpmhcc: Add support for Glymur SoCs clk: qcom: dispcc-glymur: Add support for Display Clock Controller dt-bindings: clock: Add DISPCC and reset controller for GLYMUR SoC clk: qcom: gcc-sdm660: Add missing LPASS/CDSP vote clocks dt-bindings: clock: gcc-sdm660: Add LPASS/CDSP vote clocks/GDSCs ... * clk-broadcom: clk: bcm: rpi: Maximize V3D clock clk: bcm: rpi: Turn firmware clock on/off when preparing/unpreparing clk: bcm: rpi: Add missing logs if firmware fails |
||
|
|
c1e102f349 |
Merge branches 'clk-imx', 'clk-allwinner' and 'clk-ti' into clk-next
* clk-imx: clk: imx95-blk-ctl: Save/restore registers when RPM routines are called clk: imx95-blk-ctl: Save platform data in imx95_blk_ctl structure * clk-allwinner: clk: sunxi-ng: add support for the A523/T527 MCU CCU clk: sunxi-ng: div: support power-of-two dividers clk: sunxi-ng: sun55i-a523-ccu: Add missing NPU module clock dt-bindings: clock: sun55i-a523-ccu: Add A523 MCU CCU clock controller dt-bindings: clock: sun55i-a523-ccu: Add missing NPU module clock clk: sunxi-ng: sun6i-rtc: Add A523 specifics * clk-ti: clk: keystone: sci-clk: use devm_kmemdup_array() clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled |
||
|
|
3aae991cc2 |
Merge branches 'clk-samsung', 'clk-tegra' and 'clk-amlogic' into clk-next
* clk-samsung: clk: s2mps11: add support for S2MPG10 PMIC clock dt-bindings: clock: samsung,s2mps11: add s2mpg10 clk: samsung: exynos990: Add PERIC0 and PERIC1 clock support dt-bindings: clock: exynos990: Add PERIC0 and PERIC1 clock units clk: samsung: exynos990: Add missing USB clock registers to HSI0 clk: samsung: exynos990: Add LHS_ACEL gate clock for HSI0 and update CLK_NR_TOP dt-bindings: clock: exynos990: Add LHS_ACEL clock ID for HSI0 block clk: samsung: artpec-8: Add initial clock support for ARTPEC-8 SoC clk: samsung: Add clock PLL support for ARTPEC-8 SoC dt-bindings: clock: Add ARTPEC-8 clock controller clk: samsung: exynos990: Add DPU_BUS and CMUREF mux/div and update CLKS_NR_TOP dt-bindings: clock: exynos990: Extend clocks IDs clk: samsung: exynos990: Replace bogus divs with fixed-factor clocks clk: samsung: exynos990: Fix CMU_TOP mux/div bit widths clk: samsung: exynos990: Use PLL_CON0 for PLL parent muxes clk: samsung: pll: convert from round_rate() to determine_rate() clk: samsung: cpu: convert from round_rate() to determine_rate() clk: samsung: fsd: Add clk id for PCLK and PLL in CAM_CSI block dt-bindings: clock: Add CAM_CSI clock macro for FSD * clk-tegra: clk: tegra: dfll: Add CVB tables for Tegra114 clk: tegra: Add DFLL DVCO reset control for Tegra114 dt-bindings: arm: tegra: Add ASUS TF101G and SL101 dt-bindings: reset: Add Tegra114 CAR header dt-bindings: arm: tegra: Add Xiaomi Mi Pad (A0101) dt-bindings: clock: tegra30: Add IDs for CSI pad clocks dt-bindings: display: tegra: Move avdd-dsi-csi-supply from VI to CSI dt-bindings: i2c: nvidia,tegra20-i2c: Document Tegra264 I2C * clk-amlogic: clk: amlogic: fix recent code refactoring clk: amlogic: c3-peripherals: use helper for basic composite clocks clk: amlogic: align s4 and c3 pwm clock descriptions clk: amlogic: add composite clock helpers clk: amlogic: use the common pclk definition clk: amlogic: introduce a common pclk definition clk: amlogic: pclk explicitly use CLK_IGNORE_UNUSED clk: amlogic: drop CLK_SET_RATE_PARENT from peripheral clocks clk: amlogic: move PCLK definition to clkc-utils clk: amlogic: aoclk: use clkc-utils syscon probe clk: amlogic: use probe helper in mmio based controllers clk: amlogic: add probe helper for mmio based controllers clk: amlogic: drop meson-clkcee clk: amlogic: naming consistency alignment |
||
|
|
ec7336475d |
Merge branches 'clk-bindings', 'clk-cleanup', 'clk-renesas', 'clk-thead' and 'clk-spacemit' into clk-next
* clk-bindings: dt-bindings: clock: mediatek: Add power-domains property dt-bindings: clock: silabs,si5341: Add missing properties dt-bindings: clock: adi,axi-clkgen: add clock-output-names property dt-bindings: clock: Remove unused fujitsu,mb86s70-crg11 binding dt-bindings: clock: Convert silabs,si570 to DT schema dt-bindings: clock: Convert silabs,si5341 to DT schema dt-bindings: clock: Convert silabs,si514/544 to DT schema * clk-cleanup: clk: tegra: do not overallocate memory for bpmp clocks clk: ep93xx: Use int type to store negative error codes dt-bindings: clock: st: flexgen: remove deprecated compatibles clk: st: flexgen: remove unused compatible clk: clk-axi-clkgen: remove unneeded semicolon clk: tegra: Remove redundant semicolons clk: npcm: select CONFIG_AUXILIARY_BUS clk: remove unneeded 'fast_io' parameter in regmap_config * clk-renesas: (27 commits) clk: renesas: r9a09g05[67]: Reduce differences clk: renesas: r9a09g047: Add USB3.0 clocks/resets clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() clk: renesas: r9a09g056: Add clock and reset entries for I3C clk: renesas: r9a09g057: Add clock and reset entries for I3C dt-bindings: clock: renesas,r9a09g047-cpg: Add USB3.0 core clocks clk: renesas: r9a09g077: Add Ethernet Subsystem core and module clocks clk: renesas: rzv2h: Simplify polling condition in __rzv2h_cpg_assert() clk: renesas: rzv2h: Re-assert reset on deassert timeout clk: renesas: rzg2l: Re-assert reset on deassert timeout clk: renesas: rzg2l: Simplify rzg2l_cpg_assert() and rzg2l_cpg_deassert() dt-bindings: clock: renesas,r9a09g077/87: Add Ethernet clock IDs clk: renesas: r9a09g047: Add GPT clocks and resets clk: renesas: r9a09g077: Add module clocks for SCI1-SCI5 clk: renesas: rzv2h: remove round_rate() in favor of determine_rate() clk: renesas: rzg2l: convert from round_rate() to determine_rate() clk: renesas: r9a07g04[34]: Use tabs instead of spaces clk: renesas: r9a07g043: Add MSTOP for RZ/G2UL clk: renesas: r9a07g044: Add MSTOP for RZ/G2L clk: renesas: r9a08g045: Add MSTOP for GPIO ... * clk-thead: clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL clk: thead: support changing DPU pixel clock rate clk: thead: add support for enabling/disabling PLLs clk: thead: Correct parent for DPU pixel clocks clk: thead: th1520-ap: fix parent of padctrl0 clock clk: thead: th1520-ap: describe gate clocks with clk_gate * clk-spacemit: clk: spacemit: fix i2s clock clk: spacemit: introduce pre-div for ddn clock dt-bindings: clock: spacemit: introduce i2s pre-clock to fix i2s clock clk: spacemit: ccu_pll: convert from round_rate() to determine_rate() clk: spacemit: ccu_mix: convert from round_rate() to determine_rate() clk: spacemit: ccu_ddn: convert from round_rate() to determine_rate() clk: spacemit: fix sspax_clk dt-bindings: clock: spacemit: CLK_SSPA_I2S_BCLK for SSPA |
||
|
|
c34e08ba6c |
drm/msm: Fix GEM free for imported dma-bufs
Imported dma-bufs also have obj->resv != &obj->_resv. So we should
check both this condition in addition to flags for handling the
_NO_SHARE case.
Fixes this splat that was reported with IRIS video playback:
------------[ cut here ]------------
WARNING: CPU: 3 PID: 2040 at drivers/gpu/drm/msm/msm_gem.c:1127 msm_gem_free_object+0x1f8/0x264 [msm]
CPU: 3 UID: 1000 PID: 2040 Comm: .gnome-shell-wr Not tainted 6.17.0-rc7 #1 PREEMPT
pstate: 81400005 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : msm_gem_free_object+0x1f8/0x264 [msm]
lr : msm_gem_free_object+0x138/0x264 [msm]
sp : ffff800092a1bb30
x29: ffff800092a1bb80 x28: ffff800092a1bce8 x27: ffffbc702dbdbe08
x26: 0000000000000008 x25: 0000000000000009 x24: 00000000000000a6
x23: ffff00083c72f850 x22: ffff00083c72f868 x21: ffff00087e69f200
x20: ffff00087e69f330 x19: ffff00084d157ae0 x18: 0000000000000000
x17: 0000000000000000 x16: ffffbc704bd46b80 x15: 0000ffffd0959540
x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
x11: ffffbc702e6cdb48 x10: 0000000000000000 x9 : 000000000000003f
x8 : ffff800092a1ba90 x7 : 0000000000000000 x6 : 0000000000000020
x5 : ffffbc704bd46c40 x4 : fffffdffe102cf60 x3 : 0000000000400032
x2 : 0000000000020000 x1 : ffff00087e6978e8 x0 : ffff00087e6977e8
Call trace:
msm_gem_free_object+0x1f8/0x264 [msm] (P)
drm_gem_object_free+0x1c/0x30 [drm]
drm_gem_object_handle_put_unlocked+0x138/0x150 [drm]
drm_gem_object_release_handle+0x5c/0xcc [drm]
drm_gem_handle_delete+0x68/0xbc [drm]
drm_gem_close_ioctl+0x34/0x40 [drm]
drm_ioctl_kernel+0xc0/0x130 [drm]
drm_ioctl+0x360/0x4e0 [drm]
__arm64_sys_ioctl+0xac/0x104
invoke_syscall+0x48/0x104
el0_svc_common.constprop.0+0x40/0xe0
do_el0_svc+0x1c/0x28
el0_svc+0x34/0xec
el0t_64_sync_handler+0xa0/0xe4
el0t_64_sync+0x198/0x19c
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
Reported-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Fixes:
|
||
|
|
2f2c725493 |
Merge tag 'pci-v6.18-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci
Pull pci updates from Bjorn Helgaas:
"Enumeration:
- Add PCI_FIND_NEXT_CAP() and PCI_FIND_NEXT_EXT_CAP() macros that
take config space accessor functions.
Implement pci_find_capability(), pci_find_ext_capability(), and
dwc, dwc endpoint, and cadence capability search interfaces with
them (Hans Zhang)
- Leave parent unit address 0 in 'interrupt-map' so that when we
build devicetree nodes to describe PCI functions that contain
multiple peripherals, we can build this property even when
interrupt controllers lack 'reg' properties (Lorenzo Pieralisi)
- Add a Xeon 6 quirk to disable Extended Tags and limit Max Read
Request Size to 128B to avoid a performance issue (Ilpo Järvinen)
- Add sysfs 'serial_number' file to expose the Device Serial Number
(Matthew Wood)
- Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
Resource management:
- Align m68k pcibios_enable_device() with other arches (Ilpo
Järvinen)
- Remove sparc pcibios_enable_device() implementations that don't do
anything beyond what pci_enable_resources() does (Ilpo Järvinen)
- Remove mips pcibios_enable_resources() and use
pci_enable_resources() instead (Ilpo Järvinen)
- Clean up bridge window sizing and assignment (Ilpo Järvinen),
including:
- Leave non-claimed bridge windows disabled
- Enable bridges even if a window wasn't assigned because not all
windows are required by downstream devices
- Preserve bridge window type when releasing the resource, since
the type is needed for reassignment
- Consolidate selection of bridge windows into two new
interfaces, pbus_select_window() and
pbus_select_window_for_type(), so this is done consistently
- Compute bridge window start and end earlier to avoid logging
stale information
MSI:
- Add quirk to disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol
Vives)
Error handling:
- Align AER with EEH by allowing drivers to request a Bus Reset on
Non-Fatal Errors (in addition to the reset on Fatal Errors that we
already do) (Lukas Wunner)
- If error recovery fails, emit FAILED_RECOVERY uevents for the
devices, not for the bridge leading to them.
This makes them correspond to BEGIN_RECOVERY uevents (Lukas Wunner)
- Align AER with EEH by calling err_handler.error_detected()
callbacks to notify drivers if error recovery fails (Lukas Wunner)
- Align AER with EEH by restoring device error_state to
pci_channel_io_normal before the err_handler.slot_reset() callback.
This is earlier than before the err_handler.resume() callback
(Lukas Wunner)
- Emit a BEGIN_RECOVERY uevent when driver's
err_handler.error_detected() requests a reset, as well as when it
says recovery is complete or can be done without a reset (Niklas
Schnelle)
- Align s390 with AER and EEH by emitting uevents during error
recovery (Niklas Schnelle)
- Align EEH with AER and s390 by emitting BEGIN_RECOVERY,
SUCCESSFUL_RECOVERY, or FAILED_RECOVERY uevents depending on the
result of err_handler.error_detected() (Niklas Schnelle)
- Fix a NULL pointer dereference in aer_ratelimit() when ACPI GHES
error information identifies a device without an AER Capability
(Breno Leitao)
- Update error decoding and TLP Log printing for new errors in
current PCIe base spec (Lukas Wunner)
- Update error recovery documentation to match the current code
and use consistent nomenclature (Lukas Wunner)
ASPM:
- Enable all ClockPM and ASPM states for devicetree platforms, since
there's typically no firmware that enables ASPM
This is a risky change that may uncover hardware or configuration
defects at boot-time rather than when users enable ASPM via sysfs
later. Booting with "pcie_aspm=off" prevents this enabling
(Manivannan Sadhasivam)
- Remove the qcom code that enabled ASPM (Manivannan Sadhasivam)
Power management:
- If a device has already been disconnected, e.g., by a hotplug
removal, don't bother trying to resume it to D0 when detaching the
driver.
This avoids annoying "Unable to change power state from D3cold to
D0" messages (Mario Limonciello)
- Ensure devices are powered up before config reads for
'max_link_width', 'current_link_speed', 'current_link_width',
'secondary_bus_number', and 'subordinate_bus_number' sysfs files.
This prevents using invalid data (~0) in drivers or lspci and,
depending on how the PCIe controller reports errors, may avoid
error interrupts or crashes (Brian Norris)
Virtualization:
- Add rescan/remove locking when enabling/disabling SR-IOV, which
avoids list corruption on s390, where disabling SR-IOV also
generates hotplug events (Niklas Schnelle)
Peer-to-peer DMA:
- Free struct p2p_pgmap, not a member within it, in the
pci_p2pdma_add_resource() error path (Sungho Kim)
Endpoint framework:
- Document sysfs interface for BAR assignment of vNTB endpoint
functions (Jerome Brunet)
- Fix array underflow in endpoint BAR test case (Dan Carpenter)
- Skip endpoint IRQ test if the IRQ is out of range to avoid false
errors (Christian Bruel)
- Fix endpoint test case for controllers with fixed-size BARs smaller
than requested by the test (Marek Vasut)
- Restore inbound translation when disabling doorbell so the endpoint
doorbell test case can be run more than once (Niklas Cassel)
- Avoid a NULL pointer dereference when releasing DMA channels in
endpoint DMA test case (Shin'ichiro Kawasaki)
- Convert tegra194 interrupt number to MSI vector to fix endpoint
Kselftest MSI_TEST test case (Niklas Cassel)
- Reset tegra194 BARs when running in endpoint mode so the BAR tests
don't overwrite the ATU settings in BAR4 (Niklas Cassel)
- Handle errors in tegra194 BPMP transactions so we don't mistakenly
skip future PERST# assertion (Vidya Sagar)
AMD MDB PCIe controller driver:
- Update DT binding example to separate PERST# to a Root Port stanza
to make multiple Root Ports possible in the future (Sai Krishna
Musham)
- Add driver support for PERST# being described in a Root Port
stanza, falling back to the host bridge if not found there (Sai
Krishna Musham)
Freescale i.MX6 PCIe controller driver:
- Enable the 3.3V Vaux supply if available so devices can request
wakeup with either Beacon or WAKE# (Richard Zhu)
MediaTek PCIe Gen3 controller driver:
- Add optional sys clock ready time setting to avoid sys_clk_rdy
signal glitching in MT6991 and MT8196 (AngeloGioacchino Del Regno)
- Add DT binding and driver support for MT6991 and MT8196
(AngeloGioacchino Del Regno)
NVIDIA Tegra PCIe controller driver:
- When asserting PERST#, disable the controller instead of mistakenly
disabling the PLL twice (Nagarjuna Kristam)
- Convert struct tegra_msi mask_lock to raw spinlock to avoid a lock
nesting error (Marek Vasut)
Qualcomm PCIe controller driver:
- Select PCI Power Control Slot driver so slot voltage rails can be
turned on/off if described in Root Port devicetree node (Qiang Yu)
- Parse only PCI bridge child nodes in devicetree, skipping unrelated
nodes such as OPP (Operating Performance Points), which caused
probe failures (Krishna Chaitanya Chundru)
- Add 8.0 GT/s and 32.0 GT/s equalization settings (Ziyue Zhang)
- Consolidate Root Port 'phy' and 'reset' properties in struct
qcom_pcie_port, regardless of whether we got them from the Root
Port node or the host bridge node (Manivannan Sadhasivam)
- Fetch and map the ELBI register space in the DWC core rather than
in each driver individually (Krishna Chaitanya Chundru)
- Enable ECAM mechanism in DWC core by setting up iATU with 'CFG
Shift Feature' and use this in the qcom driver (Krishna Chaitanya
Chundru)
- Add SM8750 compatible to qcom,pcie-sm8550.yaml (Krishna Chaitanya
Chundru)
- Update qcom,pcie-x1e80100.yaml to allow fifth PCIe host on Qualcomm
Glymur, which is compatible with X1E80100 but doesn't have the
cnoc_sf_axi clock (Qiang Yu)
Renesas R-Car PCIe controller driver:
- Fix a typo that prevented correct PHY initialization (Marek Vasut)
- Add a missing 1ms delay after PWR reset assertion as required by
the V4H manual (Marek Vasut)
- Assure reset has completed before DBI access to avoid SError (Marek
Vasut)
- Fix inverted PHY initialization check, which sometimes led to
timeouts and failure to start the controller (Marek Vasut)
- Pass the correct IRQ domain to generic_handle_domain_irq() to fix a
regression when converting to msi_create_parent_irq_domain()
(Claudiu Beznea)
- Drop the spinlock protecting the PMSR register - it's no longer
required since pci_lock already serializes accesses (Marek Vasut)
- Convert struct rcar_msi mask_lock to raw spinlock to avoid a lock
nesting error (Marek Vasut)
SOPHGO PCIe controller driver:
- Check for existence of struct cdns_pcie.ops before using it to
allow Cadence drivers that don't need to supply ops (Chen Wang)
- Add DT binding and driver for the SOPHGO SG2042 PCIe controller
(Chen Wang)
STMicroelectronics STM32MP25 PCIe controller driver:
- Update pinctrl documentation of initial states and use in runtime
suspend/resume (Christian Bruel)
- Add pinctrl_pm_select_init_state() for use by stm32 driver, which
needs it during resume (Christian Bruel)
- Add devicetree bindings and drivers for the STMicroelectronics
STM32MP25 in host and endpoint modes (Christian Bruel)
Synopsys DesignWare PCIe controller driver:
- Add support for x16 in devicetree 'num-lanes' property (Konrad
Dybcio)
- Verify that if DT specifies a single IRQ for all eDMA channels, it
is named 'dma' (Niklas Cassel)
TI J721E PCIe driver:
- Add MODULE_DEVICE_TABLE() so driver can be autoloaded (Siddharth
Vadapalli)
- Power controller off before configuring the glue layer so the
controller latches the correct values on power-on (Siddharth
Vadapalli)
TI Keystone PCIe controller driver:
- Use devm_request_irq() so 'ks-pcie-error-irq' is freed when driver
exits with error (Siddharth Vadapalli)
- Add Peripheral Virtualization Unit (PVU), which restricts DMA from
PCIe devices to specific regions of host memory, to the ti,am65
binding (Jan Kiszka)
Xilinx NWL PCIe controller driver:
- Clear bootloader E_ECAM_CONTROL before merging in the new driver
value to avoid writing invalid values (Jani Nurminen)"
* tag 'pci-v6.18-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (141 commits)
PCI/AER: Avoid NULL pointer dereference in aer_ratelimit()
MAINTAINERS: Add entry for ST STM32MP25 PCIe drivers
PCI: stm32-ep: Add PCIe Endpoint support for STM32MP25
dt-bindings: PCI: Add STM32MP25 PCIe Endpoint bindings
PCI: stm32: Add PCIe host support for STM32MP25
PCI: xilinx-nwl: Fix ECAM programming
PCI: j721e: Fix incorrect error message in probe()
PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
dt-bindings: PCI: qcom,pcie-x1e80100: Set clocks minItems for the fifth Glymur PCIe Controller
PCI: dwc: Support 16-lane operation
PCI: Add lockdep assertion in pci_stop_and_remove_bus_device()
PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock
PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0()
PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock
PCI: rcar-gen4: Fix inverted break condition in PHY initialization
PCI: rcar-gen4: Assure reset occurs before DBI access
PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion
PCI: Set up bridge resources earlier
PCI: rcar-host: Drop PMSR spinlock
...
|
||
|
|
e4c0fdd5af |
Merge tag 'dmaengine-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine
Pull dmaengine updates from Vinod Koul: "A couple of new device support and small driver updates for this round. New support: - Intel idxd Wildcat Lake family support - SpacemiT K1 PDMA controller support - Renesas RZ/G3E family support Updates: - Xilinx shutdown support and dma client properties update - Designware edma callback_result support" * tag 'dmaengine-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: dt-bindings: dma: rz-dmac: Document RZ/G3E family of SoCs dmaengine: dw-edma: Set status for callback_result dmaengine: mv_xor: match alloc_wc and free_wc dmaengine: mmp_pdma: Add SpacemiT K1 PDMA support with 64-bit addressing dmaengine: mmp_pdma: Add operations structure for controller abstraction dmaengine: mmp_pdma: Add reset controller support dmaengine: mmp_pdma: Add clock support dt-bindings: dma: Add SpacemiT K1 PDMA controller dt-bindings: dmaengine: xilinx_dma: Remove DMA client properties dmaengine: Fix dma_async_tx_descriptor->tx_submit documentation dmaengine: xilinx_dma: Support descriptor setup from dma_vecs dmaengine: sh: setup_xref error handling dmaengine: Replace zero-length array with flexible-array dmaengine: ppc4xx: Remove space before newline dmaengine: idxd: Add a new IAA device ID for Wildcat Lake family platforms dmaengine: idxd: Replace memset(0) + strscpy() with strscpy_pad() dt-bindings: dma: nvidia,tegra20-apbdma: Add undocumented compatibles and "clock-names" dmaengine: zynqmp_dma: Add shutdown operation support |
||
|
|
1d1ba4d390 |
Merge tag 'phy-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy
Pull phy updates from Vinod Koul:
"The usual bunch of device support and update to drivers.
New Support
- Qualcomm SM8750 QMP PCIe PHY dual lane support, PMIV0104 eusb2
repeater support, QCS8300 eDP PHY support
- Renesas RZ/T2H and RZ/N2H support and updates to driver for that
- TI TCAN1051 phy support
- Rockchip rk3588 dphy support, RK3528 combphy support
Updates:
- cadence updates for calibration and polling for ready and enabling
of lower resolutions, runtime pm support,
- Rockchip: enable U3 otg port
- Renesas USXGMII mode support
- Qualcomm UFS PHY and PLL regulator load support"
* tag 'phy-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (64 commits)
phy: rockchip: phy-rockchip-inno-csidphy: add support for rk3588 variant
phy: rockchip: phy-rockchip-inno-csidphy: allow for different reset lines
phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0
dt-bindings: phy: rockchip-inno-csi-dphy: add rk3588 variant
dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required
phy: cadence: cdns-dphy: Enable lower resolutions in dphy
phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet
phy: renesas: r8a779f0-ether-serdes: add USXGMII mode
phy: sophgo: Add USB 2.0 PHY driver for Sophgo CV18XX/SG200X
dt-bindings: phy: Add Sophgo CV1800 USB phy
phy: cadence: cdns-dphy: Update calibration wait time for startup state machine
phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling
phy: renesas: rcar-gen3-usb2: Fix ID check logic with VBUS valid
dt-bindings: phy: ti,tcan104x-can: Document TI TCAN1051
phy: lynx-28g: check return value when calling lynx_28g_pll_get
phy: qcom: m31-eusb2: Fix the error log while enabling clock
phy: rockchip: usbdp: Remove redundant ternary operators
phy: renesas: rcar-gen3-usb2: Remove redundant ternary operators
phy: hisilicon: Remove redundant ternary operators
phy: qcom-qmp-ufs: Add PHY and PLL regulator load
...
|
||
|
|
58b65f6dcc |
Merge tag 'soundwire-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire
Pull soundwire updates from Vinod Koul:
"A very small update this time
- add few registers to debugfs
- core: drop dev_pm_domain_detach() call and use min() to improve
code"
* tag 'soundwire-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire:
soundwire: Use min() to improve code
soundwire: bus: Drop dev_pm_domain_detach() call
soundwire: debugfs: add SCP_SDCA_IntStatX and SCP_SDCA_IntMaskX registers
|
||
|
|
451bb96328 |
vfio: Dump migration features under debugfs
A debugfs directory was recently added for VFIO devices. Add a new "features" file under the migration sub-directory to expose which features the device supports. Signed-off-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/r/20250918121928.1921871-1-clg@redhat.com Signed-off-by: Alex Williamson <alex.williamson@redhat.com> |
||
|
|
d14de5b925 |
vfio/type1: optimize vfio_unpin_pages_remote()
When vfio_unpin_pages_remote() is called with a range of addresses that includes large folios, the function currently performs individual put_pfn() operations for each page. This can lead to significant performance overheads, especially when dealing with large ranges of pages. It would be very rare for reserved PFNs and non reserved will to be mixed within the same range. So this patch utilizes the has_rsvd variable introduced in the previous patch to determine whether batch put_pfn() operations can be performed. Moreover, compared to put_pfn(), unpin_user_page_range_dirty_lock() is capable of handling large folio scenarios more efficiently. The performance test results for completing the 16G VFIO IOMMU DMA unmapping are as follows. Base(v6.16): ------- AVERAGE (MADV_HUGEPAGE) -------- VFIO UNMAP DMA in 0.141 s (113.7 GB/s) ------- AVERAGE (MAP_POPULATE) -------- VFIO UNMAP DMA in 0.307 s (52.2 GB/s) ------- AVERAGE (HUGETLBFS) -------- VFIO UNMAP DMA in 0.135 s (118.6 GB/s) With this patchset: ------- AVERAGE (MADV_HUGEPAGE) -------- VFIO UNMAP DMA in 0.044 s (363.2 GB/s) ------- AVERAGE (MAP_POPULATE) -------- VFIO UNMAP DMA in 0.289 s (55.3 GB/s) ------- AVERAGE (HUGETLBFS) -------- VFIO UNMAP DMA in 0.044 s (361.3 GB/s) For large folio, we achieve an over 67% performance improvement in the VFIO UNMAP DMA item. For small folios, the performance test results appear to show a slight improvement. Suggested-by: Jason Gunthorpe <jgg@ziepe.ca> Signed-off-by: Li Zhe <lizhe.67@bytedance.com> Reviewed-by: David Hildenbrand <david@redhat.com> Acked-by: David Hildenbrand <david@redhat.com> Link: https://lore.kernel.org/r/20250814064714.56485-6-lizhe.67@bytedance.com Signed-off-by: Alex Williamson <alex.williamson@redhat.com> |
||
|
|
089722e893 |
vfio/type1: introduce a new member has_rsvd for struct vfio_dma
Introduce a new member has_rsvd for struct vfio_dma. This member is used to indicate whether there are any reserved or invalid pfns in the region represented by this vfio_dma. If it is true, it indicates that there is at least one pfn in this region that is either reserved or invalid. Signed-off-by: Li Zhe <lizhe.67@bytedance.com> Reviewed-by: David Hildenbrand <david@redhat.com> Link: https://lore.kernel.org/r/20250814064714.56485-5-lizhe.67@bytedance.com Signed-off-by: Alex Williamson <alex.williamson@redhat.com> |
||
|
|
d10872050f |
vfio/type1: batch vfio_find_vpfn() in function vfio_unpin_pages_remote()
The function vpfn_pages() can help us determine the number of vpfn nodes on the vpfn rb tree within a specified range. This allows us to avoid searching for each vpfn individually in the function vfio_unpin_pages_remote(). This patch batches the vfio_find_vpfn() calls in function vfio_unpin_pages_remote(). Signed-off-by: Li Zhe <lizhe.67@bytedance.com> Link: https://lore.kernel.org/r/20250814064714.56485-4-lizhe.67@bytedance.com Signed-off-by: Alex Williamson <alex.williamson@redhat.com> |
||
|
|
f6c84a52cc |
vfio/type1: optimize vfio_pin_pages_remote()
When vfio_pin_pages_remote() is called with a range of addresses that includes large folios, the function currently performs individual statistics counting operations for each page. This can lead to significant performance overheads, especially when dealing with large ranges of pages. Batch processing of statistical counting operations can effectively enhance performance. In addition, the pages obtained through longterm GUP are neither invalid nor reserved. Therefore, we can reduce the overhead associated with some calls to function is_invalid_reserved_pfn(). The performance test results for completing the 16G VFIO IOMMU DMA mapping are as follows. Base(v6.16): ------- AVERAGE (MADV_HUGEPAGE) -------- VFIO MAP DMA in 0.049 s (328.5 GB/s) ------- AVERAGE (MAP_POPULATE) -------- VFIO MAP DMA in 0.268 s (59.6 GB/s) ------- AVERAGE (HUGETLBFS) -------- VFIO MAP DMA in 0.051 s (310.9 GB/s) With this patch: ------- AVERAGE (MADV_HUGEPAGE) -------- VFIO MAP DMA in 0.025 s (629.8 GB/s) ------- AVERAGE (MAP_POPULATE) -------- VFIO MAP DMA in 0.253 s (63.1 GB/s) ------- AVERAGE (HUGETLBFS) -------- VFIO MAP DMA in 0.030 s (530.5 GB/s) For large folio, we achieve an over 40% performance improvement. For small folios, the performance test results indicate a slight improvement. Signed-off-by: Li Zhe <lizhe.67@bytedance.com> Co-developed-by: Alex Williamson <alex.williamson@redhat.com> Acked-by: David Hildenbrand <david@redhat.com> Tested-by: Eric Farman <farman@linux.ibm.com> Link: https://lore.kernel.org/r/20250814064714.56485-3-lizhe.67@bytedance.com Signed-off-by: Alex Williamson <alex.williamson@redhat.com> |
||
|
|
929bf010e0 |
mm: introduce num_pages_contiguous()
Let's add a simple helper for determining the number of contiguous pages that represent contiguous PFNs. In an ideal world, this helper would be simpler or not even required. Unfortunately, on some configs we still have to maintain (SPARSEMEM without VMEMMAP), the memmap is allocated per memory section, and we might run into weird corner cases of false positives when blindly testing for contiguous pages only. One example of such false positives would be a memory section-sized hole that does not have a memmap. The surrounding memory sections might get "struct pages" that are contiguous, but the PFNs are actually not. This helper will, for example, be useful for determining contiguous PFNs in a GUP result, to batch further operations across returned "struct page"s. VFIO will utilize this interface to accelerate the VFIO DMA map process. Implementation based on Linus' suggestions to avoid new usage of nth_page() where avoidable. Suggested-by: Linus Torvalds <torvalds@linux-foundation.org> Suggested-by: Jason Gunthorpe <jgg@ziepe.ca> Signed-off-by: Li Zhe <lizhe.67@bytedance.com> Co-developed-by: David Hildenbrand <david@redhat.com> Signed-off-by: David Hildenbrand <david@redhat.com> Link: https://lore.kernel.org/r/20250814064714.56485-2-lizhe.67@bytedance.com Signed-off-by: Alex Williamson <alex.williamson@redhat.com> |
||
|
|
9c78e747dd |
wifi: ath11k: avoid bit operation on key flags
Bitwise operations with WMI_KEY_PAIRWISE (defined as 0) are ineffective and misleading. This results in pairwise key validations added in commit |
||
|
|
92282074e1 |
wifi: ath12k: free skb during idr cleanup callback
ath12k just like ath11k [1] did not handle skb cleanup during idr
cleanup callback. Both ath12k_mac_vif_txmgmt_idr_remove() and
ath12k_mac_tx_mgmt_pending_free() performed idr cleanup and DMA
unmapping for skb but only ath12k_mac_tx_mgmt_pending_free() freed
skb. As a result, during vdev deletion a memory leak occurs.
Refactor all clean up steps into a new function. New function
ath12k_mac_tx_mgmt_free() creates a centralized area where idr
cleanup, DMA unmapping for skb and freeing skb is performed. Utilize
skb pointer given by idr_remove(), instead of passed as a function
argument because IDR will be protected by locking. This will prevent
concurrent modification of the same IDR.
Now ath12k_mac_tx_mgmt_pending_free() and
ath12k_mac_vif_txmgmt_idr_remove() call ath12k_mac_tx_mgmt_free().
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
Link: https://lore.kernel.org/r/1637832614-13831-1-git-send-email-quic_srirrama@quicinc.com > # [1]
Fixes:
|
||
|
|
0eb002c93c |
wifi: ath11k: Add missing platform IDs for quirk table
Lenovo platforms can come with one of two different IDs.
The pm_quirk table was missing the second ID for each platform.
Add missing ID and some extra platform identification comments.
Reported on https://bugzilla.kernel.org/show_bug.cgi?id=219196
Tested-on: P14s G4 AMD.
Fixes:
|
||
|
|
2e9c1da4ee |
wifi: ath10k: Fix memory leak on unsupported WMI command
ath10k_wmi_cmd_send takes ownership of the passed buffer (skb) and has the
responsibility to release it in case of error. This patch fixes missing
free in case of early error due to unhandled WMI command ID.
Tested-on: WCN3990 hw1.0 WLAN.HL.3.3.7.c2-00931-QCAHLSWMTPLZ-1
Fixes:
|
||
|
|
4d920ed684 |
libbpf: Fix undefined behavior in {get,put}_unaligned_be32()
These violate aliasing rules and may be miscompiled unless
-fno-strict-aliasing is used. Replace them with the standard memcpy()
solution. Note that compilers know how to optimize this properly.
Fixes:
|
||
|
|
228c5d44df |
drm/vmwgfx: Fix copy-paste typo in validation
'entry' should be 'val' which is the loop iterator.
Fixes:
|
||
|
|
dfe1323ab3 |
drm/vmwgfx: Fix Use-after-free in validation
Nodes stored in the validation duplicates hashtable come from an arena
allocator that is cleared at the end of vmw_execbuf_process. All nodes
are expected to be cleared in vmw_validation_drop_ht but this node escaped
because its resource was destroyed prematurely.
Fixes:
|
||
|
|
5ac2c02790 |
drm/vmwgfx: Fix a null-ptr access in the cursor snooper
Check that the resource which is converted to a surface exists before
trying to use the cursor snooper on it.
vmw_cmd_res_check allows explicit invalid (SVGA3D_INVALID_ID) identifiers
because some svga commands accept SVGA3D_INVALID_ID to mean "no surface",
unfortunately functions that accept the actual surfaces as objects might
(and in case of the cursor snooper, do not) be able to handle null
objects. Make sure that we validate not only the identifier (via the
vmw_cmd_res_check) but also check that the actual resource exists before
trying to do something with it.
Fixes unchecked null-ptr reference in the snooping code.
Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
Fixes:
|
||
|
|
a7c4bb43bf |
fs/notify: call exportfs_encode_fid with s_umount
Calling intotify_show_fdinfo() on fd watching an overlayfs inode, while
the overlayfs is being unmounted, can lead to dereferencing NULL ptr.
This issue was found by syzkaller.
Race Condition Diagram:
Thread 1 Thread 2
-------- --------
generic_shutdown_super()
shrink_dcache_for_umount
sb->s_root = NULL
|
| vfs_read()
| inotify_fdinfo()
| * inode get from mark *
| show_mark_fhandle(m, inode)
| exportfs_encode_fid(inode, ..)
| ovl_encode_fh(inode, ..)
| ovl_check_encode_origin(inode)
| * deref i_sb->s_root *
|
|
v
fsnotify_sb_delete(sb)
Which then leads to:
[ 32.133461] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI
[ 32.134438] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
[ 32.135032] CPU: 1 UID: 0 PID: 4468 Comm: systemd-coredum Not tainted 6.17.0-rc6 #22 PREEMPT(none)
<snip registers, unreliable trace>
[ 32.143353] Call Trace:
[ 32.143732] ovl_encode_fh+0xd5/0x170
[ 32.144031] exportfs_encode_inode_fh+0x12f/0x300
[ 32.144425] show_mark_fhandle+0xbe/0x1f0
[ 32.145805] inotify_fdinfo+0x226/0x2d0
[ 32.146442] inotify_show_fdinfo+0x1c5/0x350
[ 32.147168] seq_show+0x530/0x6f0
[ 32.147449] seq_read_iter+0x503/0x12a0
[ 32.148419] seq_read+0x31f/0x410
[ 32.150714] vfs_read+0x1f0/0x9e0
[ 32.152297] ksys_read+0x125/0x240
IOW ovl_check_encode_origin derefs inode->i_sb->s_root, after it was set
to NULL in the unmount path.
Fix it by protecting calling exportfs_encode_fid() from
show_mark_fhandle() with s_umount lock.
This form of fix was suggested by Amir in [1].
[1]: https://lore.kernel.org/all/CAOQ4uxhbDwhb+2Brs1UdkoF0a3NSdBAOQPNfEHjahrgoKJpLEw@mail.gmail.com/
Fixes:
|
||
|
|
ee795e82e1 |
spi: rockchip-sfc: Fix DMA-API usage
Use DMA-API dma_map_single() call for getting the DMA address of the
transfer buffer instead of hacking with virt_to_phys().
This fixes the following DMA-API debug warning:
------------[ cut here ]------------
DMA-API: rockchip-sfc fe300000.spi: device driver tries to sync DMA memory it has not allocated [device address=0x000000000cf70000] [size=288 bytes]
WARNING: kernel/dma/debug.c:1106 at check_sync+0x1d8/0x690, CPU#2: systemd-udevd/151
Modules linked in: ...
Hardware name: Hardkernel ODROID-M1 (DT)
pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : check_sync+0x1d8/0x690
lr : check_sync+0x1d8/0x690
..
Call trace:
check_sync+0x1d8/0x690 (P)
debug_dma_sync_single_for_cpu+0x84/0x8c
__dma_sync_single_for_cpu+0x88/0x234
rockchip_sfc_exec_mem_op+0x4a0/0x798 [spi_rockchip_sfc]
spi_mem_exec_op+0x408/0x498
spi_nor_read_data+0x170/0x184
spi_nor_read_sfdp+0x74/0xe4
spi_nor_parse_sfdp+0x120/0x11f0
spi_nor_sfdp_init_params_deprecated+0x3c/0x8c
spi_nor_scan+0x690/0xf88
spi_nor_probe+0xe4/0x304
spi_mem_probe+0x6c/0xa8
spi_probe+0x94/0xd4
really_probe+0xbc/0x298
...
Fixes:
|
||
|
|
48b77733d0 |
expfs: Fix exportfs_can_encode_fh() for EXPORT_FH_FID
After commit |
||
|
|
83d59d81b2 |
slab: Fix using this_cpu_ptr() in preemptible context
defer_free() maybe called in preemptible context, this will trigger the
below warning message:
BUG: using smp_processor_id() in preemptible [00000000] code: swapper/0/1
caller is defer_free+0x1b/0x60
Call Trace:
<TASK>
dump_stack_lvl+0xac/0xc0
check_preemption_disabled+0xbe/0xe0
defer_free+0x1b/0x60
kfree_nolock+0x1eb/0x2b0
alloc_slab_obj_exts+0x356/0x390
__alloc_tagging_slab_alloc_hook+0xa0/0x300
__kmalloc_cache_noprof+0x1c4/0x5c0
__set_page_owner+0x10d/0x1c0
post_alloc_hook+0x84/0xf0
get_page_from_freelist+0x73b/0x1380
__alloc_frozen_pages_noprof+0x110/0x2c0
alloc_pages_mpol+0x44/0x140
alloc_slab_page+0xac/0x150
allocate_slab+0x78/0x3a0
___slab_alloc+0x76b/0xed0
__slab_alloc.constprop.0+0x5a/0xb0
__kmalloc_noprof+0x3dc/0x6d0
__list_lru_init+0x6c/0x210
alloc_super+0x3b6/0x470
sget_fc+0x5f/0x3a0
get_tree_nodev+0x27/0x90
vfs_get_tree+0x26/0xc0
vfs_kern_mount.part.0+0xb6/0x140
kern_mount+0x24/0x40
init_pipe_fs+0x4f/0x70
do_one_initcall+0x62/0x2e0
kernel_init_freeable+0x25b/0x4b0
kernel_init+0x1a/0x1c0
ret_from_fork+0x290/0x2e0
ret_from_fork_asm+0x11/0x20
</TASK>
Disable preemption in defer_free() and also defer_deactivate_slab() to
make it safe.
[vbabka@suse.cz: disable preemption instead of using raw_cpu_ptr() per
the discussion ]
Fixes:
|
||
|
|
fd94619c43 |
Merge tag 'zonefs-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs
Pull zonefs update from Damien Le Moal: - Some comment spelling fixes (Xichao) * tag 'zonefs-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs: zonefs: correct some spelling mistakes |
||
|
|
4b616669d1 |
Merge tag 'ata-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux
Pull ata updates from Damien Le Moal: - Improve the DT bindings documentation for the highbanck, imx and xgene-ahci controllers (Krzysztof, Fabio, Rob) * tag 'ata-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: dt-bindings: ata: apm,xgene-ahci: Add apm,xgene-ahci-v2 support dt-bindings: ata: imx: Document 'target-supply' dt-bindings: ata: highbank: Minor whitespace cleanup in example |
||
|
|
c0d36727bf |
crypto: rng - Ensure set_ent is always present
Ensure that set_ent is always set since only drbg provides it.
Fixes:
|
||
|
|
ca1354f799 |
Revert "crypto: testmgr - desupport SHA-1 for FIPS 140"
This reverts commit
|
||
|
|
87064da2db |
rtc: pcf2127: fix watchdog interrupt mask on pcf2131
When using interrupt pin (INT A) as watchdog output all other interrupt sources need to be disabled to avoid additional resets. Resulting INT_A_MASK1 value is 55 (0x37). Signed-off-by: Bruno Thomsen <bruno.thomsen@gmail.com> Link: https://lore.kernel.org/r/20250902182235.6825-1-bruno.thomsen@gmail.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
|
e22f4d1321 |
rtc: zynqmp: Restore alarm functionality after kexec transition
During kexec reboots, RTC alarms that are fired during the kernel transition experience delayed execution. The new kernel would eventually honor these alarms, but the interrupt handlers would only execute after the driver probe is completed rather than at the intended alarm time. This is because pending alarm interrupt status from the previous kernel is not properly cleared during driver initialization, causing timing discrepancies in alarm delivery. To ensure precise alarm timing across kexec transitions, enhance the probe function to: 1. Clear any pending alarm interrupt status from previous boot. 2. Detect existing valid alarms and preserve their state. 3. Re-enable alarm interrupts for future alarms. Signed-off-by: Harini T <harini.t@amd.com> Link: https://lore.kernel.org/r/20250730142110.2354507-1-harini.t@amd.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |