summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2025-01-25Merge tag 'media/v6.14-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - Sensor driver fixes - remove dead TI wl128x FM radio driver - Add support for the imx462 sensor at the IMX290 binding - V4L2 pixel data transmitter and receiver documentation improvements - Add support for MIPI Discovery and Configuration for C-PHY line orders - imx8-isi fixes and improvements - stm32: dcmipp: add core support for the stm32mp25 - qcom: camss: Add sc7280 support - Various fixes and enhancements * tag 'media/v6.14-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (152 commits) media: nuvoton: Fix an error check in npcm_video_ece_init() media: dvb-usb-v2: af9035: fix ISO C90 compilation error on af9035_i2c_master_xfer media: platform: rzg2l-cru: rzg2l-video: Fix the comment in rzg2l_cru_start_streaming_vq() media: fix secfeed undefined when filter alloc fail media: dt-bindings: trivial white-space and example cleanup MAINTAINERS: repair file entry in MEDIA DRIVERS FOR STM32 - CSI media: solo6x10: Use const 'struct bin_attribute' callback media: saa7164: Remove unused values staging: media: imx: fix OF node leak in imx_media_add_of_subdevs() media: platform: exynos4-is: Remove unused __is_get_frame_size media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread media: mmp: Bring back registration of the device media: cec: include linux/debugfs.h and linux/seq_file.h where needed Revert "media: qcom: camss: Restructure camss_link_entities" media: venus: Remove unused hfi_core_ping() media: dt-bindings: qcom-venus: Deprecate video-decoder and video-encoder where applicable media: venus: Populate video encoder/decoder nodename entries media: venus: Add support for static video encoder/decoder declarations media: venus: match instance creation and destruction order media: venus: destroy hfi session after m2m_ctx release ...
2025-01-25Merge tag 'hyperv-next-signed-20250123' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv updates from Wei Liu: - Introduce a new set of Hyper-V headers in include/hyperv and replace the old hyperv-tlfs.h with the new headers (Nuno Das Neves) - Fixes for the Hyper-V VTL mode (Roman Kisel) - Fixes for cpu mask usage in Hyper-V code (Michael Kelley) - Document the guest VM hibernation behaviour (Michael Kelley) - Miscellaneous fixes and cleanups (Jacob Pan, John Starks, Naman Jain) * tag 'hyperv-next-signed-20250123' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: Documentation: hyperv: Add overview of guest VM hibernation hyperv: Do not overlap the hvcall IO areas in hv_vtl_apicid_to_vp_id() hyperv: Do not overlap the hvcall IO areas in get_vtl() hyperv: Enable the hypercall output page for the VTL mode hv_balloon: Fallback to generic_online_page() for non-HV hot added mem Drivers: hv: vmbus: Log on missing offers if any Drivers: hv: vmbus: Wait for boot-time offers during boot and resume uio_hv_generic: Add a check for HV_NIC for send, receive buffers setup iommu/hyper-v: Don't assume cpu_possible_mask is dense Drivers: hv: Don't assume cpu_possible_mask is dense x86/hyperv: Don't assume cpu_possible_mask is dense hyperv: Remove the now unused hyperv-tlfs.h files hyperv: Switch from hyperv-tlfs.h to hyperv/hvhdk.h hyperv: Add new Hyper-V headers in include/hyperv hyperv: Clean up unnecessary #includes hyperv: Move hv_connection_id to hyperv-tlfs.h
2025-01-25Merge tag 'irq-core-2025-01-21' into loongarch-nextHuacai Chen
LoongArch architecture changes for 6.14 depend on the irq-core changes (AVECINTC fixes) to work well for NUMA, so merge them to create a base.
2025-01-24Merge tag 'spi-fix-v6.14-merge-window' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fix from Mark Brown: "A simple fix for mishandling of some clk_get_optional() return codes in the OMAP driver, the problem was reported against stable kernels on a few platforms after an earlier incomplete fix was backported" * tag 'spi-fix-v6.14-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: omap2-mcspi: Correctly handle devm_clk_get_optional() errors
2025-01-24Merge tag 'mailbox-v6.14' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox Pull mailbox updates from Jassi Brar: - samsung: add gs101-mbox driver - microchip: add sbi-ipc driver - zynqmp: fix invalid __percpu annotation - qcom: add IPQ5424 APCS compatible - mpfs fix copy and paste bug - th1520: Fix NULL vs IS_ERR() and a memory corruption bug - tegra-hsp: clear mailbox before using message * tag 'mailbox-v6.14' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox: riscv: export __cpuid_to_hartid_map riscv: sbi: vendorid_list: Add Microchip Technology to the vendor list mailbox: th1520: Fix memory corruption due to incorrect array size mailbox: zynqmp: Remove invalid __percpu annotation in zynqmp_ipi_probe() MAINTAINERS: add entry for Samsung Exynos mailbox driver mailbox: add Samsung Exynos driver dt-bindings: mailbox: add google,gs101-mbox mailbox: qcom: Add support for IPQ5424 APCS IPC dt-bindings: mailbox: qcom: Add IPQ5424 APCS compatible mailbox: qcom-ipcc: Reset CLEAR_ON_RECV_RD if set from boot firmware mailbox: add Microchip IPC support dt-bindings: mailbox: add binding for Microchip IPC mailbox controller mailbox: tegra-hsp: Clear mailbox before using message mailbox: mpfs: fix copy and paste bug in probe mailbox: th1520: Fix a NULL vs IS_ERR() bug
2025-01-25drm/nouveau: consume the return of large GSP messageZhi Wang
As the GSP message recv path is able to handle the return of large GSP message, consume the return of large GSP message in the sending path. Signed-off-by: Zhi Wang <zhiw@nvidia.com> Signed-off-by: Danilo Krummrich <dakr@kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20250124182958.2040494-16-zhiw@nvidia.com
2025-01-25drm/nouveau: support handling the return of large GSP messageZhi Wang
The max GSP message element size is 16 pages (including the headers). To send a message larger than 16 pages, nvkm should split it into multiple and send them accordingly. The first element has the expected function number, while the rest are sent with function number as NV_VGPU_MSG_FUNCTION_CONTINUATION_RECORD. GSP consumes the elements from the cmdq and always writes the result back to the msgq. The result is also formed as split elements. However, nvkm is able to split the large GSP message and send them, but totally not aware of handling the return of the large GSP message, which are the split elements in the msgq. Thus, it keeps dumping the unknown RPC messages from msgq, which is actually CONTINUATION_RECORD message, discard them unexpectedly. Thus, the caller will not be able to consume the result from GSP. Introduce the handling of the return of large GSP message on the msgq path. Slightly re-factor the low-level part of msg receiving routines. Merge the split elements back into a large element before handling it to the upper level. Thus, the upper-level of GSP RPC APIs don't need to be heavily changed. Signed-off-by: Zhi Wang <zhiw@nvidia.com> Signed-off-by: Danilo Krummrich <dakr@kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20250124182958.2040494-15-zhiw@nvidia.com
2025-01-25drm/nouveau: factor out r535_gsp_msgq_recv_one_elem()Zhi Wang
Prepare for supporting receive the large GSP RPC message. Factor out r535_gsp_msgq_recv_one_elem(). Fold its params into a data structure of params. Move the allocation of the GSP RPC message to its caller. Refine the variable names in the re-factor. No functional change is intended. Signed-off-by: Zhi Wang <zhiw@nvidia.com> Signed-off-by: Danilo Krummrich <dakr@kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20250124182958.2040494-14-zhiw@nvidia.com
2025-01-25drm/nouveau: factor out r535_gsp_msgq_peek()Zhi Wang
To receive a GSP message queue element from the GSP status queue, the driver needs to make sure there are available elements in the queue. The previous r535_gsp_msgq_wait() consists of three functions, which is a little too complicated for a single function: - wait for an available element. - peek the message element header in the queue. - recevice the element from the queue. Factor out r535_gsp_msgq_peek() and divide the functions in r535_gsp_msgq_wait() into three functions. No functional change is intended. Cc: Danilo Krummrich <dakr@kernel.org> Signed-off-by: Zhi Wang <zhiw@nvidia.com> Signed-off-by: Danilo Krummrich <dakr@kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20250124182958.2040494-13-zhiw@nvidia.com
2025-01-25drm/nouveau: rename the variable "cmd" to "msg" in r535_gsp_cmdq_{get, push}()Zhi Wang
Refine the name to align with the terms in the kernel doc. No functional change is intended. Signed-off-by: Zhi Wang <zhiw@nvidia.com> Signed-off-by: Danilo Krummrich <dakr@kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20250124182958.2040494-12-zhiw@nvidia.com
2025-01-25drm/nouveau: refine the variable names in r535_gsp_msg_recv()Zhi Wang
The variable "msg" in r535_gsp_msg_recv() actually means the GSP RPC. Refine the names to align with the terms in the kernel doc. No functional change is intended. Signed-off-by: Zhi Wang <zhiw@nvidia.com> Signed-off-by: Danilo Krummrich <dakr@kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20250124182958.2040494-11-zhiw@nvidia.com
2025-01-25drm/nouveau: refine the variable names in r535_gsp_rpc_push()Zhi Wang
The variable names in r535_gsp_rpc_push() are quite confusing and some of them are not representing what they really are. Update the names and explanations in the decoder section of the kernel doc. Refine the names to align with the terms in the kernel doc. No functional change is intended. Signed-off-by: Zhi Wang <zhiw@nvidia.com> Signed-off-by: Danilo Krummrich <dakr@kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20250124182958.2040494-10-zhiw@nvidia.com
2025-01-25drm/nouveau: remove the magic number in r535_gsp_rpc_push()Zhi Wang
There has been a GSP_MSG_MAX_SIZE which represents the max size of a GSP message element header. Use it instead of a magic number. No functional change is intended. Signed-off-by: Zhi Wang <zhiw@nvidia.com> Signed-off-by: Danilo Krummrich <dakr@kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20250124182958.2040494-9-zhiw@nvidia.com
2025-01-25drm/nouveau: fix the broken marco GSP_MSG_MAX_SIZEZhi Wang
The macro GSP_MSG_MAX_SIZE refers to another macro that doesn't exist. It represents the max GSP message element size. Fix the broken marco so it can be used to replace some magic numbers in the code. Signed-off-by: Zhi Wang <zhiw@nvidia.com> Signed-off-by: Danilo Krummrich <dakr@kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20250124182958.2040494-8-zhiw@nvidia.com
2025-01-25drm/nouveau: rename "argc" to what it represents in GSP RPC routinesZhi Wang
The name "argc" has different meanings in different functions. To improve the readability, it's better to refine it to a name that reflects what it represents. Rename "argc" to what it represents. Add terms in the decoder section to explain their meaning. No functional change is intended. Signed-off-by: Zhi Wang <zhiw@nvidia.com> [ Fix indentation. - Danilo ] Signed-off-by: Danilo Krummrich <dakr@kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20250124182958.2040494-7-zhiw@nvidia.com
2025-01-25drm/nouveau: rename "argv" to what it represents in *rm_{alloc, ctrl}_*()Zhi Wang
The name "argv" has different meanings in different functions. To improve the readability, it's better to refine it to a name that reflects what it represents. Rename "argv" to what it represents. Wrap the long container_of() into to_payload_header() to denote a clear meaning and make checkpatch.pl happy. No functional change is intended. Signed-off-by: Zhi Wang <zhiw@nvidia.com> Signed-off-by: Danilo Krummrich <dakr@kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20250124182958.2040494-6-zhiw@nvidia.com
2025-01-25drm/nouveau: remove unused param repc in *rm_alloc_push()Zhi Wang
The user of *rm_alloc_push() always pass 0 in repc. Remove unused param repc since no user actually uses it. No functional change is intended. Signed-off-by: Zhi Wang <zhiw@nvidia.com> Signed-off-by: Danilo Krummrich <dakr@kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20250124182958.2040494-5-zhiw@nvidia.com
2025-01-25drm/nouveau: rename "argv" to what it represents on the GSP message send pathZhi Wang
The name "argv" has different meanings in different functions. To improve the readability, it's better to refine it to a name that reflects what it represents. Rename "repc" to what it represents in the GSP message send path. Wrap the long container_of() into to_gsp_hdr() to make checkpatch.pl happy. No functional change is intended. Signed-off-by: Zhi Wang <zhiw@nvidia.com> Signed-off-by: Danilo Krummrich <dakr@kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20250124182958.2040494-4-zhiw@nvidia.com
2025-01-25drm/nouveau: rename "repc" to "gsp_rpc_len" on the GSP message recv pathZhi Wang
The name "repc" has different meanings in different contexts. To improve the readability, it's better to refine it to a name that reflects what it actually represents. Rename "repc" to "gsp_rpc_len" in the GSP message recv path. Add an section in the doc to explain the terms. No functional change is intended. Cc: Danilo Krummrich <dakr@kernel.org> Signed-off-by: Zhi Wang <zhiw@nvidia.com> Signed-off-by: Danilo Krummrich <dakr@kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20250124182958.2040494-3-zhiw@nvidia.com
2025-01-25drm/nouveau: add a kernel doc to introduce the GSP RPCZhi Wang
In order to explain the name clean-ups in GSP RPC routines, a kernel doc to explain the memory layout and terms is required. Add a kernel doc to introduce the GSP RPC. Cc: Danilo Krummrich <dakr@kernel.org> Signed-off-by: Zhi Wang <zhiw@nvidia.com> [ Fix bullet list indentation; add SPDX-License-Identifier. - Danilo ] Signed-off-by: Danilo Krummrich <dakr@kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20250124182958.2040494-2-zhiw@nvidia.com
2025-01-24Merge tag 'i3c/for-6.14' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull i3c updates from Alexandre Belloni: "The main change is the addition of PCI bus support for mipi-i3c-hci. I'm also carrying an hwmon patch as it makes use of the bitops addition that is then mainly used by i3c drivers. Core: - Improve initialization of numbered I2C adapters Drivers: - use parity8 helper - dw: fix possible use-after-free - mipi-i3c-hci: add support for PCI bus host - svc: many fixes for IBI and hotjoin" * tag 'i3c/for-6.14' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: i3c: master: Improve initialization of numbered I2C adapters i3c: master: Fix missing 'ret' assignment in set_speed() i3c: cdns: use parity8 helper instead of open coding it i3c: mipi-i3c-hci: use parity8 helper instead of open coding it i3c: dw: use parity8 helper instead of open coding it hwmon: (spd5118) Use generic parity calculation bitops: add generic parity calculation for u8 i3c: mipi-i3c-hci: Add support for MIPI I3C HCI on PCI bus i3c: mipi-i3c-hci: Add Intel specific quirk to ring resuming i3c: fix kdoc parameter description for module_i3c_i2c_driver() i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition
2025-01-24Merge tag 'efi-next-for-v6.14' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI updates from Ard Biesheuvel: - Increase the headroom in the EFI memory map allocation created by the EFI stub. This is needed because event callbacks called during ExitBootServices() may cause fragmentation, and reallocation is not allowed after that. - Drop obsolete UGA graphics code and switch to a more ergonomic API to traverse handle buffers. Simplify some error paths using a __free() helper while at it. - Fix some W=1 warnings when CONFIG_EFI=n - Rely on the dentry cache to keep track of the contents of the efivarfs filesystem, rather than using a separate linked list. - Improve and extend efivarfs test cases. - Synchronize efivarfs with underlying variable store on resume from hibernation - this is needed because the firmware itself or another OS running on the same machine may have modified it. - Fix x86 EFI stub build with GCC 15. - Fix kexec/x86 false positive warning in EFI memory attributes table sanity check. * tag 'efi-next-for-v6.14' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: (23 commits) x86/efi: skip memattr table on kexec boot efivarfs: add variable resync after hibernation efivarfs: abstract initial variable creation routine efi: libstub: Use '-std=gnu11' to fix build with GCC 15 selftests/efivarfs: add concurrent update tests selftests/efivarfs: fix tests for failed write removal efivarfs: fix error on write to new variable leaving remnants efivarfs: remove unused efivarfs_list efivarfs: move variable lifetime management into the inodes selftests/efivarfs: add check for disallowing file truncation efivarfs: prevent setting of zero size on the inodes in the cache efi: sysfb_efi: fix W=1 warnings when EFI is not set efi/libstub: Use __free() helper for pool deallocations efi/libstub: Use cleanup helpers for freeing copies of the memory map efi/libstub: Simplify PCI I/O handle buffer traversal efi/libstub: Refactor and clean up GOP resolution picker code efi/libstub: Simplify GOP handling code efi/libstub: Use C99-style for loop to traverse handle buffer x86/efistub: Drop long obsolete UGA support efivarfs: make variable_is_present use dcache lookup ...
2025-01-24Merge tag 'devicetree-for-6.14' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree updates from Rob Herring: "DT Bindings: - Add Bindings for QCom QCS615 UFS, QCom IPQ5424 DWC3 USB, NXP imx7d MIPI DSI, QCom SM8750 PDC, QCom MSM8976 SRAM, QCom ipq6018 temp sensor, QCom QCS8300 Power Domain Controller, QCom QCS615 Power Domain Controller, QCom QCS615 APSS, QCom QCS615 qfprom, QCom QCS8300 remoteproc, Mediatek MT6328 PMIC, Allwinner A100 OPP, and NXP iMX35 GPT - Convert Altera socfpga-system, raspberrypi,bcm2835-power to DT schema - Add Siflower vendor prefix - Cleanup display, interrupt-controller, and UFS binding examples' indentation - Document preferred line wrapping (the same as the rest of the kernel) DT Core: - Add warning when of_property_read_bool() is used on non-boolean properties - Restore keeping bootloader DTB when booting with ACPI. Turns out some x86 platforms relied on that. Shrug. - Fix of_find_node_opts_by_path() handling of alias+path+options - Fix resource bounds checking for empty resources - A bunch of small fixes/cleanups all over from Zijun Hu - Cleanups in bin_attribute handling" * tag 'devicetree-for-6.14' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (50 commits) of: address: Fix empty resource handling in __of_address_resource_bounds() of/fdt: Restore possibility to use both ACPI and FDT from bootloader docs: dt-bindings: Document preferred line wrapping dt-bindings: ufs: Correct indentation and style in DTS example of: Correct element count for two arrays in API of_parse_phandle_with_args_map() of: reserved-memory: Warn for missing static reserved memory regions of: Do not expose of_alias_scan() and correct its comments dt-bindings: ufs: qcom: Add UFS Host Controller for QCS615 dt-bindings: usb: qcom,dwc3: Add IPQ5424 to USB DWC3 bindings dt-bindings: arm: coresight: Update the pattern of ete node name of: Warn when of_property_read_bool() is used on non-boolean properties device property: Split property reading bool and presence test ops of/fdt: Check fdt_get_mem_rsv() error in early_init_fdt_scan_reserved_mem() of: reserved-memory: Move an assignment to effective place in __reserved_mem_alloc_size() of: reserved-memory: Do not make kmemleak ignore freed address of: reserved-memory: Fix using wrong number of cells to get property 'alignment' of: Remove a duplicated code block of: property: Avoiding using uninitialized variable @imaplen in parse_interrupt_map() of: Correct child specifier used as input of the 2nd nexus node dt-bindings: interrupt-controller: ti,omap4-wugen-mpu: Add file extension ...
2025-01-24Merge tag 'soc-drivers-6.14' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC driver updates from Arnd Bergmann: "These are changes to SoC specific drivers and DT bindings that don't have a separate subsystem tree, or that get grouped here for simplicity. Nothing out of the ordinary for the 6.14 release here: - Most of the updates are for Qualcomm specific drivers, adding support for additional SoCs in the exssting drivers, and support for wrapped encryption key access in the SCM firmware. - The Arm SCMI firmware code gains support for having multiple instances of firmware running, and better module auto loading. - A few minor updates for litex, samsung, ti, tegra, mediatek, imx and renesas platforms. - Reset controller updates for amlogic, to add support for the A1 soc and clean up the existing code. - Memory controller updates for ti davinci aemif, refactoring the code and adding a few interfaces to other drivers" * tag 'soc-drivers-6.14' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (58 commits) drivers/soc/litex: Use devm_register_restart_handler() reset: amlogic: aux: drop aux registration helper reset: amlogic: aux: get regmap through parent device reset: amlogic: add support for A1 SoC in auxiliary reset driver dt-bindings: reset: add bindings for A1 SoC audio reset controller soc/tegra: fuse: Update Tegra234 nvmem keepout list soc/tegra: Fix spelling error in tegra234_lookup_slave_timeout() soc/tegra: cbb: Drop unnecessary debugfs error handling firmware: qcom: scm: add calls for wrapped key support soc: qcom: pd_mapper: Add SM7225 compatible dt-bindings: firmware: qcom,scm: Document ipq5424 SCM soc: qcom: llcc: Update configuration data for IPQ5424 dt-bindings: cache: qcom,llcc: Add IPQ5424 compatible soc: mediatek: mtk-devapc: Fix leaking IO map on driver remove soc: mediatek: mtk-devapc: Fix leaking IO map on error paths firmware: qcom: scm: smc: Narrow 'mempool' variable scope firmware: qcom: scm: smc: Handle missing SCM device firmware: qcom: scm: Cleanup global '__scm' on probe failures firmware: qcom: scm: Fix missing read barrier in qcom_scm_get_tzmem_pool() firmware: qcom: scm: Fix missing read barrier in qcom_scm_is_available() ...
2025-01-24drm/dp_mst: Add helper to get port number at specific LCT from RADWayne Lin
Add a helper drm_dp_mst_get_ufp_num_at_lct_from_rad() to extract the up facing port number at specific link count from the RAD. Use the added helper in drm_dp_mst_rad_to_str() & drm_dp_get_mst_branch_device() to unify the implementation. V2: - Adjust the code format (Lyude) V3: - Adjust parameter "rad" of drm_dp_mst_get_ufp_num_at_lct_from_rad() to be constant (Kernel test robot) Cc: Imre Deak <imre.deak@intel.com> Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> Cc: Harry Wentland <hwentlan@amd.com> Cc: Lyude Paul <lyude@redhat.com> Reviewed-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Wayne Lin <Wayne.Lin@amd.com> [fixed commit message typo] Signed-off-by: Lyude Paul <lyude@redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/20250113091100.3314533-3-Wayne.Lin@amd.com
2025-01-24drm/dp_mst: Fix drm RAD printWayne Lin
[Why] The RAD of sideband message printed today is incorrect. For RAD stored within MST branch - If MST branch LCT is 1, it's RAD array is untouched and remained as 0. - If MST branch LCT is larger than 1, use nibble to store the up facing port number in cascaded sequence as illustrated below: u8 RAD[0] = (LCT_2_UFP << 4) | LCT_3_UFP RAD[1] = (LCT_4_UFP << 4) | LCT_5_UFP ... In drm_dp_mst_rad_to_str(), it wrongly to use BIT_MASK(4) to fetch the port number of one nibble. [How] Adjust the code by: - RAD array items are valuable only for LCT >= 1. - Use 0xF as the mask to replace BIT_MASK(4) V2: - Document how RAD is constructed (Imre) V3: - Adjust the comment for rad[] so kdoc formats it properly (Lyude) Fixes: 2f015ec6eab6 ("drm/dp_mst: Add sideband down request tracing + selftests") Cc: Imre Deak <imre.deak@intel.com> Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> Cc: Harry Wentland <hwentlan@amd.com> Cc: Lyude Paul <lyude@redhat.com> Reviewed-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Wayne Lin <Wayne.Lin@amd.com> Signed-off-by: Lyude Paul <lyude@redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/20250113091100.3314533-2-Wayne.Lin@amd.com
2025-01-24Merge tag 'soc-arm-6.14' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC arm platform code updates from Arnd Bergmann: "The updates here add code for the Microchip SAMA7D65 SoC, as well as minor bugfixes for OMAP" * tag 'soc-arm-6.14' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: omap1: Fix up the Retu IRQ on Nokia 770 ARM: omap2plus_defconfig: enable charger of TWL603X ARM: at91: add new SoC sama7d65 ARM: at91: pm: change BU Power Switch to automatic mode soc: atmel: fix device_node release in atmel_soc_device_init() ARM: OMAP2+: Fix a typo
2025-01-24of: address: Fix empty resource handling in __of_address_resource_bounds()Thomas Weißschuh
"resource->end" needs to always be equal to "resource->start + size - 1". The previous version of the function did not perform the "- 1" in case of an empty resource. Also make sure to allow an empty resource at address 0. Reported-by: Basharath Hussain Khaja <basharath@couthit.com> Closes: https://lore.kernel.org/lkml/20250108140414.13530-1-basharath@couthit.com/ Fixes: 1a52a094c2f0 ("of: address: Unify resource bounds overflow checking") Cc: stable@vger.kernel.org Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Link: https://lore.kernel.org/r/20250120-of-address-overflow-v1-1-dd68dbf47bce@linutronix.de Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-01-24of/fdt: Restore possibility to use both ACPI and FDT from bootloaderDmytro Maluka
There are cases when the bootloader provides information to the kernel in both ACPI and DTB, not interchangeably. One such use case is virtual machines in Android. When running on x86, the Android Virtualization Framework (AVF) boots VMs with ACPI like it is usually done on x86 (i.e. the virtual LAPIC, IOAPIC, HPET, PCI MMCONFIG etc are described in ACPI) but also passes various AVF-specific boot parameters in DTB. This allows reusing the same implementations of various AVF components on both arm64 and x86. Commit 7b937cc243e5 ("of: Create of_root if no dtb provided by firmware") removed the possibility to do that, since among other things it introduced forcing emptying the bootloader-provided DTB if ACPI is enabled (probably assuming that if ACPI is available, a DTB can only be useful for applying overlays to it afterwards, for testing purposes). So restore this possibility. Instead of completely preventing using ACPI and DT together, rely on arch-specific setup code to prevent using both to set up the same things (see various acpi_disabled checks under arch/). Fixes: 7b937cc243e5 ("of: Create of_root if no dtb provided by firmware") Signed-off-by: Dmytro Maluka <dmaluka@chromium.org> Link: https://lore.kernel.org/r/20250105172741.3476758-3-dmaluka@chromium.org Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-01-24drm/panel: samsung-s6e88a0-ams452ef01: transition to mipi_dsi wrapped functionsTejas Vipin
Changes the samsung-s6e88a0-ams452ef01 panel to use multi style functions for improved error handling. Reviewed-by: Douglas Anderson <dianders@chromium.org> Signed-off-by: Tejas Vipin <tejasvipin76@gmail.com> Signed-off-by: Douglas Anderson <dianders@chromium.org> Link: https://patchwork.freedesktop.org/patch/msgid/20250122031110.286079-1-tejasvipin76@gmail.com
2025-01-25drm/virtio: Support partial maps of GEM objectsSasha Finkelstein
Those are useful to implement coherent cross-vm mmap. Signed-off-by: Sasha Finkelstein <fnkl.kernel@gmail.com> Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Tested-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Link: https://patchwork.freedesktop.org/patch/msgid/20250109-virtgpu-gem-partial-map-v1-1-a914b48776bd@gmail.com Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> [dmitry.osipenko@collabora.com: Corrected vm_size check to account vm_pgoff]
2025-01-24Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdmaLinus Torvalds
Pull rdma updates from Jason Gunthorpe: "Lighter that normal, but the now usual collection of driver fixes and small improvements: - Small fixes and minor improvements to cxgb4, bnxt_re, rxe, srp, efa, cxgb4 - Update mlx4 to use the new umem APIs, avoiding direct use of scatterlist - Support ROCEv2 in erdma - Remove various uncalled functions, constify bin_attribute - Provide core infrastructure to catch netdev events and route them to drivers, consolidating duplicated driver code - Fix rare race condition crashes in mlx5 ODP flows" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (63 commits) RDMA/mlx5: Fix implicit ODP use after free RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error RDMA/qib: Constify 'struct bin_attribute' RDMA/hfi1: Constify 'struct bin_attribute' RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]" RDMA/cxgb4: Notify rdma stack for IB_EVENT_QP_LAST_WQE_REACHED event RDMA/bnxt_re: Allocate dev_attr information dynamically RDMA/bnxt_re: Pass the context for ulp_irq_stop RDMA/bnxt_re: Add support to handle DCB_CONFIG_CHANGE event RDMA/bnxt_re: Query firmware defaults of CC params during probe RDMA/bnxt_re: Add Async event handling support bnxt_en: Add ULP call to notify async events RDMA/mlx5: Fix indirect mkey ODP page count MAINTAINERS: Update the bnxt_re maintainers RDMA/hns: Clean up the legacy CONFIG_INFINIBAND_HNS RDMA/rtrs: Add missing deinit() call RDMA/efa: Align interrupt related fields to same type RDMA/bnxt_re: Fix to drop reference to the mmap entry in case of error RDMA/mlx5: Fix link status down event for MPV RDMA/erdma: Support create_ah/destroy_ah in non-sleepable contexts ...
2025-01-24Merge tag 'for-linus-iommufd' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd updates from Jason Gunthorpe: "No major functionality this cycle: - iommufd part of the domain_alloc_paging_flags() conversion - Move IOMMU_HWPT_FAULT_ID_VALID processing out of drivers - Increase a timeout waiting for other threads to drop transient refcounts that syzkaller was hitting - Fix a UBSAN hit in iova_bitmap due to shift out of bounds - Add missing cleanup of fault events during FD shutdown, fixing a memory leak - Improve the fault delivery flow to have a smaller locking critical region that does not include copy_to_user() - Fix 32 bit ABI breakage due to missed implicit padding, and fix the stack memory leakage" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommufd: Fix struct iommu_hwpt_pgfault init and padding iommufd/fault: Use a separate spinlock to protect fault->deliver list iommufd/fault: Destroy response and mutex in iommufd_fault_destroy() iommufd: Keep OBJ/IOCTL lists in an alphabetical order iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() iommu: iommufd: fix WARNING in iommufd_device_unbind iommufd: Deal with IOMMU_HWPT_FAULT_ID_VALID in iommufd core iommufd/selftest: Remove domain_alloc_paging()
2025-01-24Merge tag 'fbdev-for-6.14-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev updates from Helge Deller: "Fixes: - omap: use threaded IRQ for LCD DMA - omapfb: Fix an OF node leak in dss_of_port_get_parent_device() - vga16fb: fix orig_video_isVGA confusion Updates & cleanups: - hdmi: Remove unused hdmi_infoframe_check - omapfb: - Remove unused hdmi5_core_handle_irqs - Use of_property_present() to test existence of DT property - Use syscon_regmap_lookup_by_phandle_args - efifb: Change the return value type to void - lcdcfb: Use backlight helper - udlfb: Use const 'struct bin_attribute' callback - radeon: Use const 'struct bin_attribute' callbacks - sm501fb: Use str_enabled_disabled() helper in sm501fb_init_fb()" * tag 'fbdev-for-6.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: lcdcfb: Use backlight helper fbdev: vga16fb: fix orig_video_isVGA confusion fbdev: omapfb: Use syscon_regmap_lookup_by_phandle_args fbdev: omapfb: Use of_property_present() to test existence of DT property fbdev: sm501fb: Use str_enabled_disabled() helper in sm501fb_init_fb() fbdev: omap: use threaded IRQ for LCD DMA fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device() fbdev: efifb: Change the return value type to void fbdev: omapfb: Remove unused hdmi5_core_handle_irqs video: hdmi: Remove unused hdmi_infoframe_check fbdev: radeon: Use const 'struct bin_attribute' callbacks fbdev: udlfb: Use const 'struct bin_attribute' callback
2025-01-24iavf: allow changing VLAN state without calling PFMichal Swiatkowski
First case: > ip l a l $VF name vlanx type vlan id 100 > ip l d vlanx > ip l a l $VF name vlanx type vlan id 100 As workqueue can be execute after sometime, there is a window to have call trace like that: - iavf_del_vlan - iavf_add_vlan - iavf_del_vlans (wq) It means that our VLAN 100 will change the state from IAVF_VLAN_ACTIVE to IAVF_VLAN_REMOVE (iavf_del_vlan). After that in iavf_add_vlan state won't be changed because VLAN 100 is on the filter list. The final result is that the VLAN 100 filter isn't added in hardware (no iavf_add_vlans call). To fix that change the state if the filter wasn't removed yet directly to active. It is save as IAVF_VLAN_REMOVE means that virtchnl message wasn't sent yet. Second case: > ip l a l $VF name vlanx type vlan id 100 Any type of VF reset ex. change trust > ip l s $PF vf $VF_NUM trust on > ip l d vlanx > ip l a l $VF name vlanx type vlan id 100 In case of reset iavf driver is responsible for readding all filters that are being used. To do that all VLAN filters state are changed to IAVF_VLAN_ADD. Here is even longer window for changing VLAN state from kernel side, as workqueue isn't called immediately. We can have call trace like that: - changing to IAVF_VLAN_ADD (after reset) - iavf_del_vlan (called from kernel ops) - iavf_del_vlans (wq) Not exsisitng VLAN filters will be removed from hardware. It isn't a bug, ice driver will handle it fine. However, we can have call trace like that: - changing to IAVF_VLAN_ADD (after reset) - iavf_del_vlan (called from kernel ops) - iavf_add_vlan (called from kernel ops) - iavf_del_vlans (wq) With fix for previous case we end up with no VLAN filters in hardware. We have to remove VLAN filters if the state is IAVF_VLAN_ADD and delete VLAN was called. It is save as IAVF_VLAN_ADD means that virtchnl message wasn't sent yet. Fixes: 0c0da0e95105 ("iavf: refactor VLAN filter states") Signed-off-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com> Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> Tested-by: Rafal Romanowski <rafal.romanowski@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2025-01-24ice: remove invalid parameter of equalizerMateusz Polchlopek
It occurred that in the commit 70838938e89c ("ice: Implement driver functionality to dump serdes equalizer values") the invalid DRATE parameter for reading has been added. The output of the command: $ ethtool -d <ethX> returns the garbage value in the place where DRATE value should be stored. Remove mentioned parameter to prevent return of corrupted data to userspace. Fixes: 70838938e89c ("ice: Implement driver functionality to dump serdes equalizer values") Signed-off-by: Mateusz Polchlopek <mateusz.polchlopek@intel.com> Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com> Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2025-01-24ice: fix ice_parser_rt::bst_key array sizePrzemek Kitszel
Fix &ice_parser_rt::bst_key size. It was wrongly set to 10 instead of 20 in the initial impl commit (see Fixes tag). All usage code assumed it was of size 20. That was also the initial size present up to v2 of the intro series [2], but halved by v3 [3] refactor described as "Replace magic hardcoded values with macros." The introducing series was so big that some ugliness was unnoticed, same for bugs :/ ICE_BST_KEY_TCAM_SIZE and ICE_BST_TCAM_KEY_SIZE were differing by one. There was tmp variable @j in the scope of edited function, but was not used in all places. This ugliness is now gone. I'm moving ice_parser_rt::pg_prio a few positions up, to fill up one of the holes in order to compensate for the added 10 bytes to the ::bst_key, resulting in the same size of the whole as prior to the fix, and minimal changes in the offsets of the fields. Extend also the debug dump print of the key to cover all bytes. To not have string with 20 "%02x" and 20 params, switch to ice_debug_array_w_prefix(). This fix obsoletes Ahmed's attempt at [1]. [1] https://lore.kernel.org/intel-wired-lan/20240823230847.172295-1-ahmed.zaki@intel.com [2] https://lore.kernel.org/intel-wired-lan/20230605054641.2865142-13-junfeng.guo@intel.com [3] https://lore.kernel.org/intel-wired-lan/20230817093442.2576997-13-junfeng.guo@intel.com Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/intel-wired-lan/b1fb6ff9-b69e-4026-9988-3c783d86c2e0@stanley.mountain Fixes: 9a4c07aaa0f5 ("ice: add parser execution main loop") CC: Ahmed Zaki <ahmed.zaki@intel.com> Reviewed-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Tested-by: Rafal Romanowski <rafal.romanowski@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2025-01-24wifi: ath12k: fix handling of 6 GHz rulesAditya Kumar Singh
In the US country code, to avoid including 6 GHz rules in the 5 GHz rules list, the number of 5 GHz rules is set to a default constant value of 4 (REG_US_5G_NUM_REG_RULES). However, if there are more than 4 valid 5 GHz rules, the current logic will bypass the legitimate 6 GHz rules. For example, if there are 5 valid 5 GHz rules and 1 valid 6 GHz rule, the current logic will only consider 4 of the 5 GHz rules, treating the last valid rule as a 6 GHz rule. Consequently, the actual 6 GHz rule is never processed, leading to the eventual disabling of 6 GHz channels. To fix this issue, instead of hardcoding the value to 4, use a helper function to determine the number of 6 GHz rules present in the 5 GHz rules list and ignore only those rules. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Cc: stable@vger.kernel.org Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Signed-off-by: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com> Link: https://patch.msgid.link/20250123-fix_6ghz_rules_handling-v1-1-d734bfa58ff4@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-01-24idpf: add more info during virtchnl transaction timeout/salt mismatchManoj Vishwanathan
Add more information related to the transaction like cookie, vc_op, salt when transaction times out and include similar information when transaction salt does not match. Info output for transaction timeout: ------------------- (op:5015 cookie:45fe vc_op:5015 salt:45 timeout:60000ms) ------------------- before it was: ------------------- (op 5015, 60000ms) ------------------- Signed-off-by: Manoj Vishwanathan <manojvishy@google.com> Signed-off-by: Brian Vazquez <brianvv@google.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de> Tested-by: Krishneil Singh <krishneil.k.singh@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2025-01-24idpf: convert workqueues to unboundMarco Leogrande
When a workqueue is created with `WQ_UNBOUND`, its work items are served by special worker-pools, whose host workers are not bound to any specific CPU. In the default configuration (i.e. when `queue_delayed_work` and friends do not specify which CPU to run the work item on), `WQ_UNBOUND` allows the work item to be executed on any CPU in the same node of the CPU it was enqueued on. While this solution potentially sacrifices locality, it avoids contention with other processes that might dominate the CPU time of the processor the work item was scheduled on. This is not just a theoretical problem: in a particular scenario misconfigured process was hogging most of the time from CPU0, leaving less than 0.5% of its CPU time to the kworker. The IDPF workqueues that were using the kworker on CPU0 suffered large completion delays as a result, causing performance degradation, timeouts and eventual system crash. Tested: * I have also run a manual test to gauge the performance improvement. The test consists of an antagonist process (`./stress --cpu 2`) consuming as much of CPU 0 as possible. This process is run under `taskset 01` to bind it to CPU0, and its priority is changed with `chrt -pQ 9900 10000 ${pid}` and `renice -n -20 ${pid}` after start. Then, the IDPF driver is forced to prefer CPU0 by editing all calls to `queue_delayed_work`, `mod_delayed_work`, etc... to use CPU 0. Finally, `ktraces` for the workqueue events are collected. Without the current patch, the antagonist process can force arbitrary delays between `workqueue_queue_work` and `workqueue_execute_start`, that in my tests were as high as `30ms`. With the current patch applied, the workqueue can be migrated to another unloaded CPU in the same node, and, keeping everything else equal, the maximum delay I could see was `6us`. Fixes: 0fe45467a104 ("idpf: add create vport and netdev configuration") Signed-off-by: Marco Leogrande <leogrande@google.com> Signed-off-by: Manoj Vishwanathan <manojvishy@google.com> Signed-off-by: Brian Vazquez <brianvv@google.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Tested-by: Krishneil Singh <krishneil.k.singh@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2025-01-24idpf: Acquire the lock before accessing the xn->saltManoj Vishwanathan
The transaction salt was being accessed before acquiring the idpf_vc_xn_lock when idpf has to forward the virtchnl reply. Fixes: 34c21fa894a1 ("idpf: implement virtchnl transaction manager") Signed-off-by: Manoj Vishwanathan <manojvishy@google.com> Signed-off-by: David Decotigny <decot@google.com> Signed-off-by: Brian Vazquez <brianvv@google.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Tested-by: Krishneil Singh <krishneil.k.singh@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2025-01-24idpf: fix transaction timeouts on resetEmil Tantilov
Restore the call to idpf_vc_xn_shutdown() at the beginning of idpf_vc_core_deinit() provided the function is not called on remove. In the reset path the mailbox is destroyed, leading to all transactions timing out. Fixes: 09d0fb5cb30e ("idpf: deinit virtchnl transaction manager after vport and vectors") Reviewed-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Tested-by: Krishneil Singh <krishneil.k.singh@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2025-01-24idpf: add read memory barrier when checking descriptor done bitEmil Tantilov
Add read memory barrier to ensure the order of operations when accessing control queue descriptors. Specifically, we want to avoid cases where loads can be reordered: 1. Load #1 is dispatched to read descriptor flags. 2. Load #2 is dispatched to read some other field from the descriptor. 3. Load #2 completes, accessing memory/cache at a point in time when the DD flag is zero. 4. NIC DMA overwrites the descriptor, now the DD flag is one. 5. Any fields loaded before step 4 are now inconsistent with the actual descriptor state. Add read memory barrier between steps 1 and 2, so that load #2 is not executed until load #1 has completed. Fixes: 8077c727561a ("idpf: add controlq init and reset checks") Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> Reviewed-by: Sridhar Samudrala <sridhar.samudrala@intel.com> Suggested-by: Lance Richardson <rlance@google.com> Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com> Tested-by: Krishneil Singh <krishneil.k.singh@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2025-01-24md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetimeYu Kuai
After commit ec6bb299c7c3 ("md/md-bitmap: add 'sync_size' into struct md_bitmap_stats"), following panic is reported: Oops: general protection fault, probably for non-canonical address RIP: 0010:bitmap_get_stats+0x2b/0xa0 Call Trace: <TASK> md_seq_show+0x2d2/0x5b0 seq_read_iter+0x2b9/0x470 seq_read+0x12f/0x180 proc_reg_read+0x57/0xb0 vfs_read+0xf6/0x380 ksys_read+0x6c/0xf0 do_syscall_64+0x82/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Root cause is that bitmap_get_stats() can be called at anytime if mddev is still there, even if bitmap is destroyed, or not fully initialized. Deferenceing bitmap in this case can crash the kernel. Meanwhile, the above commit start to deferencing bitmap->storage, make the problem easier to trigger. Fix the problem by protecting bitmap_get_stats() with bitmap_info.mutex. Cc: stable@vger.kernel.org # v6.12+ Fixes: 32a7627cf3a3 ("[PATCH] md: optimised resync using Bitmap based intent logging") Reported-and-tested-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> Closes: https://lore.kernel.org/linux-raid/ca3a91a2-50ae-4f68-b317-abd9889f3907@oracle.com/T/#m6e5086c95201135e4941fe38f9efa76daf9666c5 Signed-off-by: Yu Kuai <yukuai3@huawei.com> Link: https://lore.kernel.org/r/20250124092055.4050195-1-yukuai1@huaweicloud.com Signed-off-by: Song Liu <song@kernel.org>
2025-01-24Merge tag 'drm-misc-next-fixes-2025-01-24' of ↵Simona Vetter
https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next-fixes for v6.14-rc1: - Fix a serious regression from commit e4b5ccd392b9 ("drm/v3d: Ensure job pointer is set to NULL after job completion") - dmem cgroup Kconfig fix (acked by Tejun) - virtio: uaf in dma_buf free path - xlnx: kerneldoc Signed-off-by: Simona Vetter <simona.vetter@ffwll.ch> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/0d4a18f4-222c-4767-9169-e6350ce8fea5@linux.intel.com
2025-01-24Merge tag 'auxdisplay-v6.14-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-auxdisplay Pull auxdisplay updates from Andy Shevchenko: - A couple of cleanups to img-ascii-lcd driver * tag 'auxdisplay-v6.14-1' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-auxdisplay: auxdisplay: img-ascii-lcd: Constify struct img_ascii_lcd_config auxdisplay: img-ascii-lcd: Remove an unused field in struct img_ascii_lcd_ctx
2025-01-24Merge tag 'amd-drm-next-6.14-2025-01-24' of ↵Simona Vetter
https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.14-2025-01-24: amdgpu: - Documentation fixes - SMU 13.x fixes - SR-IOV fix - Display fix - PCIe calculation fix - MES 12 fix - HUBP fix - Cursor fix - Enforce isolation fixes - GFX 12 fix - Use drm scheduler API helper rather than open coding it - Mark some debugging parameters as unsafe - PSP 14.x fix - Add cleaner shader support for gfx12 - Add subvp debugging flag - SDMA 4.4.x fix - Clarify some kernel log messages - clang fix - PCIe lane reporting fix - Documentation fix amdkfd: - Mark some debugging parameters as unsafe - Fix partial migration handling - Trap handler updates Signed-off-by: Simona Vetter <simona.vetter@ffwll.ch> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patchwork.freedesktop.org/patch/msgid/20250124152153.3861868-1-alexander.deucher@amd.com
2025-01-24Merge tag 'sound-6.14-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "This was a relatively calm cycle, and most of changes are rather small device-specific fixes. Here are highlights: Core: - Further enhancements of ALSA rawmidi and sequencer APIs for MIDI 2.0 - compress-offload API extensions for ASRC support ASoC: - Allow clocking on each DAI in an audio graph card to be configured separately - Improved power management for Renesas RZ-SSI - KUnit testing for the Cirrus DSP framework - Memory to meory operation support for Freescale/NXP platforms - Support for pause operations in SOF - Support for Allwinner suinv F1C100s, Awinc AW88083, Realtek ALC5682I-VE HD- and USB-audio: - Add support for Focusrite Scarlett 4th Gen 16i16, 18i16, and 18i20 interfaces via new FCP driver - TAS2781 SPI HD-audio sub-codec support - Various device-specific quirks as usual" * tag 'sound-6.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (235 commits) ALSA: hda: tas2781-spi: Fix bogus error handling in tas2781_hda_spi_probe() ALSA: hda: tas2781-spi: Fix error code in tas2781_read_acpi() ALSA: hda: tas2781-spi: Delete some dead code ALSA: usb: fcp: Fix return code from poll ops ALSA: usb: fcp: Fix incorrect resp->opcode retrieval ALSA: usb: fcp: Fix meter_levels type to __le32 ALSA: hda/realtek: Enable Mute LED on HP Laptop 14s-fq1xxx ALSA: hda: tas2781-spi: Fix -Wsometimes-uninitialized in tasdevice_spi_switch_book() ALSA: ctxfi: Simplify dao_clear_{left,right}_input() functions ALSA: hda: tas2781-spi: select CRC32 instead of CRC32_SARWATE ALSA: usb: fcp: Fix hwdep read ops types ALSA: scarlett2: Add device_setup option to use FCP driver ALSA: FCP: Add Focusrite Control Protocol driver ALSA: hda/tas2781: Add tas2781 hda SPI driver ALSA: hda/realtek - Fixed headphone distorted sound on Acer Aspire A115-31 laptop ASoC: xilinx: xlnx_spdif: Simpify using devm_clk_get_enabled() ALSA: hda: Support for Ideapad hotkey mute LEDs ASoC: Intel: sof_sdw: Fix DMI match for Lenovo 83JX, 83MC and 83NM ASoC: Intel: sof_sdw: Fix DMI match for Lenovo 83LC ASoC: dapm: add support for preparing streams ...
2025-01-24Merge tag 'v6.14-p1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto updates from Herbert Xu: "API: - Remove physical address skcipher walking - Fix boot-up self-test race Algorithms: - Optimisations for x86/aes-gcm - Optimisations for x86/aes-xts - Remove VMAC - Remove keywrap Drivers: - Remove n2 Others: - Fixes for padata UAF - Fix potential rhashtable deadlock by moving schedule_work outside lock" * tag 'v6.14-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (75 commits) rhashtable: Fix rhashtable_try_insert test dt-bindings: crypto: qcom,inline-crypto-engine: Document the SM8750 ICE dt-bindings: crypto: qcom,prng: Document SM8750 RNG dt-bindings: crypto: qcom-qce: Document the SM8750 crypto engine crypto: asymmetric_keys - Remove unused key_being_used_for[] padata: avoid UAF for reorder_work padata: fix UAF in padata_reorder padata: add pd get/put refcnt helper crypto: skcipher - call cond_resched() directly crypto: skcipher - optimize initializing skcipher_walk fields crypto: skcipher - clean up initialization of skcipher_walk::flags crypto: skcipher - fold skcipher_walk_skcipher() into skcipher_walk_virt() crypto: skcipher - remove redundant check for SKCIPHER_WALK_SLOW crypto: skcipher - remove redundant clamping to page size crypto: skcipher - remove unnecessary page alignment of bounce buffer crypto: skcipher - document skcipher_walk_done() and rename some vars crypto: omap - switch from scatter_walk to plain offset crypto: powerpc/p10-aes-gcm - simplify handling of linear associated data crypto: bcm - Drop unused setting of local 'ptr' variable crypto: hisilicon/qm - support new function communication ...
2025-01-24Merge tag 'tpmdd-next-6.14-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull TPM update from Jarkko Sakkinen. * tag 'tpmdd-next-6.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm: Change to kvalloc() in eventlog/acpi.c