GKI (arm64) relevant 35 out of 230 changes, affecting 67 files +612/-427
ec9be081c5 Revert "mmc: sdhci: Disable SD card clock before changing parameters" [1 file, +2/-7]
0698a2eb7d Bluetooth: HCI: Set extended advertising data synchronously [2 files, +130/-113]
3672fe9d1e Bluetooth: hci_sync: revert some mesh modifications [1 file, +4/-12]
44bb1e13b4 Bluetooth: MGMT: set_mesh: update LE scan interval and window [1 file, +22/-0]
a99f80c88a Bluetooth: MGMT: mesh_send: check instances prior disabling advertising [1 file, +2/-1]
5581e694d3 usb: typec: altmodes/displayport: do not index invalid pin_assignments [2 files, +2/-1]
b1abc5ab47 scsi: sd: Fix VPD page 0xb7 length check [1 file, +1/-1]
381c1c1219 Bluetooth: Prevent unintended pause by checking if advertising is active [1 file, +4/-0]
f0fee863a7 nvme: Fix incorrect cdw15 value in passthru error logging [1 file, +1/-1]
50c86c0945 netfs: Fix i_size updating [2 files, +8/-2]
a553afd91f net/sched: Always pass notifications when child class becomes empty [1 file, +5/-14]
d78f79a2c1 spinlock: extend guard with spinlock_bh variants [1 file, +13/-0]
0cc4721a71 sched/fair: Rename h_nr_running into h_nr_queued [5 files, +53/-53]
a2562bdd35 sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE [1 file, +11/-2]
5833026221 f2fs: decrease spare area for pinned files for zoned devices [3 files, +5/-2]
8912b139a8 f2fs: zone: fix to calculate first_zoned_segno correctly [4 files, +69/-20]
c5474a7b04 bpf: use common instruction history across all states [2 files, +63/-63]
4265682c29 bpf: Do not include stack ptr register in precision backtracking bookkeeping [2 files, +24/-6]
e0fefe9bc0 netfs: Fix oops in write-retry from mis-resetting the subreq iterator [1 file, +3/-2]
acf9ab15ec selinux: change security_compute_sid to return the ssid or tsid on match [1 file, +11/-5]
42c5a4b47d rcu: Return early if callback is not specified [1 file, +4/-0]
e036efbe58 add a string-to-qstr constructor [10 files, +13/-23]
f94c422157 fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass [3 files, +21/-13]
8caccd2eac usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed [1 file, +4/-1]
9f75893189 Revert "usb: xhci: Implement xhci_handshake_check_state() helper" [3 files, +3/-30]
fbebc2254a usb: xhci: quirk for data loss in ISOC transfers [3 files, +30/-0]
195597e0be xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS [1 file, +2/-1]
dbdd2a2320 Input: xpad - support Acer NGR 200 Controller [1 file, +2/-0]
3b1407caac usb: dwc3: Abort suspend on soft disconnect failure [2 files, +16/-15]
7cb8750160 usb: acpi: fix device link removal [3 files, +8/-1]
c745744a82 dma-buf: fix timeout handling in dma_resv_wait_timeout v2 [1 file, +7/-5]
ccdc472b4d Logitech C-270 even more broken [1 file, +2/-1]
c782f98eef usb: typec: displayport: Fix potential deadlock [1 file, +1/-2]
ead91de35d mm/vmalloc: fix data race in show_numa_info() [1 file, +35/-28]
4c443046d8 mm: userfaultfd: fix race of userfaultfd_move and swap cache [1 file, +31/-2]
Changes in 6.12.37
rtc: pcf2127: add missing semicolon after statement
rtc: pcf2127: fix SPI command byte for PCF2131
rtc: cmos: use spin_lock_irqsave in cmos_interrupt
virtio-net: xsk: rx: fix the frame's length check
virtio-net: ensure the received length does not exceed allocated size
s390/pci: Fix stale function handles in error handling
s390/pci: Do not try re-enabling load/store if device is disabled
net: txgbe: request MISC IRQ in ndo_open
vsock/vmci: Clear the vmci transport packet properly when initializing it
net: libwx: fix the incorrect display of the queue number
mmc: sdhci: Add a helper function for dump register in dynamic debug mode
Revert "mmc: sdhci: Disable SD card clock before changing parameters"
mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier
Bluetooth: HCI: Set extended advertising data synchronously
Bluetooth: hci_sync: revert some mesh modifications
Bluetooth: MGMT: set_mesh: update LE scan interval and window
Bluetooth: MGMT: mesh_send: check instances prior disabling advertising
iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes
regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt()
usb: typec: altmodes/displayport: do not index invalid pin_assignments
mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data
mtk-sd: Prevent memory corruption from DMA map failure
mtk-sd: reset host->mrq on prepare_data() error
drm/v3d: Disable interrupts before resetting the GPU
firmware: arm_ffa: Fix memory leak by freeing notifier callback node
firmware: arm_ffa: Move memory allocation outside the mutex locking
firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context
arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename
platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment
RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling
RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN
scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database()
scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu()
scsi: sd: Fix VPD page 0xb7 length check
scsi: ufs: core: Fix spelling of a sysfs attribute name
RDMA/mlx5: Fix HW counters query for non-representor devices
RDMA/mlx5: Fix CC counters query for MPV
RDMA/mlx5: Fix vport loopback for MPV device
platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1
platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message
Bluetooth: Prevent unintended pause by checking if advertising is active
btrfs: fix missing error handling when searching for inode refs during log replay
btrfs: fix iteration of extrefs during log replay
btrfs: return a btrfs_inode from btrfs_iget_logging()
btrfs: return a btrfs_inode from read_one_inode()
btrfs: fix invalid inode pointer dereferences during log replay
btrfs: fix inode lookup error handling during log replay
btrfs: record new subvolume in parent dir earlier to avoid dir logging races
btrfs: propagate last_unlink_trans earlier when doing a rmdir
btrfs: use btrfs_record_snapshot_destroy() during rmdir
ethernet: atl1: Add missing DMA mapping error checks and count errors
dpaa2-eth: fix xdp_rxq_info leak
drm/exynos: fimd: Guard display clock control with runtime PM calls
spi: spi-fsl-dspi: Clear completion counter before initiating transfer
drm/i915/selftests: Change mock_request() to return error pointers
nvme: Fix incorrect cdw15 value in passthru error logging
nvmet: fix memory leak of bio integrity
platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks
platform/x86: hp-bioscfg: Directly use firmware_attributes_class
platform/x86: hp-bioscfg: Fix class device unregistration
platform/x86: firmware_attributes_class: Move include linux/device/class.h
platform/x86: firmware_attributes_class: Simplify API
platform/x86: think-lmi: Directly use firmware_attributes_class
platform/x86: think-lmi: Fix class device unregistration
platform/x86: dell-sysman: Directly use firmware_attributes_class
platform/x86: dell-wmi-sysman: Fix class device unregistration
platform/mellanox: mlxreg-lc: Fix logic error in power state check
drm/bridge: aux-hpd-bridge: fix assignment of the of_node
smb: client: fix warning when reconnecting channel
net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect
drm/i915/gt: Fix timeline left held on VMA alloc error
drm/i915/gsc: mei interrupt top half should be in irq disabled context
idpf: return 0 size for RSS key if not supported
idpf: convert control queue mutex to a spinlock
igc: disable L1.2 PCI-E link substate to avoid performance issue
smb: client: set missing retry flag in smb2_writev_callback()
smb: client: set missing retry flag in cifs_readv_callback()
smb: client: set missing retry flag in cifs_writev_callback()
netfs: Fix i_size updating
lib: test_objagg: Set error message in check_expect_hints_stats()
amd-xgbe: align CL37 AN sequence as per databook
enic: fix incorrect MTU comparison in enic_change_mtu()
rose: fix dangling neighbour pointers in rose_rt_device_down()
nui: Fix dma_mapping_error() check
net/sched: Always pass notifications when child class becomes empty
amd-xgbe: do not double read link status
smb: client: fix race condition in negotiate timeout by using more precise timing
arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma
crypto: iaa - Remove dst_null support
crypto: iaa - Do not clobber req->base.data
spinlock: extend guard with spinlock_bh variants
crypto: zynqmp-sha - Add locking
kunit: qemu_configs: sparc: use Zilog console
kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y
kunit: qemu_configs: Disable faulting tests on 32-bit SPARC
gfs2: Initialize gl_no_formal_ino earlier
gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE
gfs2: Rename dinode_demise to evict_behavior
gfs2: Prevent inode creation race
gfs2: Decode missing glock flags in tracepoints
gfs2: Add GLF_PENDING_REPLY flag
gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE
gfs2: Move gfs2_dinode_dealloc
gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc
gfs2: deallocate inodes in gfs2_create_inode
btrfs: prepare btrfs_page_mkwrite() for large folios
btrfs: fix wrong start offset for delalloc space release during mmap write
sched/fair: Rename h_nr_running into h_nr_queued
sched/fair: Add new cfs_rq.h_nr_runnable
sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE
gfs2: Move gfs2_trans_add_databufs
gfs2: Don't start unnecessary transactions during log flush
ASoC: tas2764: Extend driver to SN012776
ASoC: tas2764: Reinit cache on part reset
ACPI: thermal: Fix stale comment regarding trip points
ACPI: thermal: Execute _SCP before reading trip points
bonding: Mark active offloaded xfrm_states
wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path
wifi: ath12k: Handle error cases during extended skb allocation
wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers
RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug
iommu: ipmmu-vmsa: avoid Wformat-security warning
f2fs: decrease spare area for pinned files for zoned devices
f2fs: zone: introduce first_zoned_segno in f2fs_sb_info
f2fs: zone: fix to calculate first_zoned_segno correctly
scsi: lpfc: Remove NLP_RELEASE_RPI flag from nodelist structure
scsi: lpfc: Change lpfc_nodelist nlp_flag member into a bitmask
scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk
hisi_acc_vfio_pci: bugfix cache write-back issue
hisi_acc_vfio_pci: bugfix the problem of uninstalling driver
bpf: use common instruction history across all states
bpf: Do not include stack ptr register in precision backtracking bookkeeping
arm64: dts: qcom: sm8650: change labels to lower-case
arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2
arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs
arm64: dts: renesas: Factor out White Hawk Single board support
arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description
arm64: dts: qcom: sm8650: add the missing l2 cache node
ubsan: integer-overflow: depend on BROKEN to keep this out of CI
remoteproc: k3: Call of_node_put(rmem_np) only once in three functions
remoteproc: k3-r5: Add devm action to release reserved memory
remoteproc: k3-r5: Use devm_kcalloc() helper
remoteproc: k3-r5: Use devm_ioremap_wc() helper
remoteproc: k3-r5: Use devm_rproc_add() helper
remoteproc: k3-r5: Refactor sequential core power up/down operations
netfs: Fix oops in write-retry from mis-resetting the subreq iterator
mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe()
drm/xe: Fix DSB buffer coherency
drm/xe: Move DSB l2 flush to a more sensible place
drm/xe: add interface to request physical alignment for buffer objects
drm/xe: Allow bo mapping on multiple ggtts
drm/xe: move DPT l2 flush to a more sensible place
drm/xe: Replace double space with single space after comma
drm/xe/guc: Dead CT helper
drm/xe/guc: Explicitly exit CT safe mode on unwind
selinux: change security_compute_sid to return the ssid or tsid on match
drm/simpledrm: Do not upcast in release helpers
drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause
drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read
drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13
drm/amd/display: Add more checks for DSC / HUBP ONO guarantees
arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on
drm/amdgpu/mes: add missing locking in helper functions
sched_ext: Make scx_group_set_weight() always update tg->scx.weight
scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp->nlp_flag
drm/msm: Fix a fence leak in submit error path
drm/msm: Fix another leak in the submit error path
ALSA: sb: Don't allow changing the DMA mode during operations
ALSA: sb: Force to disable DMAs once when DMA mode is changed
ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled
ata: pata_cs5536: fix build on 32-bit UML
ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic
platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list
genirq/irq_sim: Initialize work context pointers properly
powerpc: Fix struct termio related ioctl macros
ASoC: amd: yc: update quirk data for HP Victus
regulator: fan53555: add enable_time support and soft-start times
scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()
aoe: defer rexmit timer downdev work to workqueue
wifi: mac80211: drop invalid source address OCB frames
wifi: ath6kl: remove WARN on bad firmware input
ACPICA: Refuse to evaluate a method if arguments are missing
mtd: spinand: fix memory leak of ECC engine conf
rcu: Return early if callback is not specified
add a string-to-qstr constructor
module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper
fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass
RDMA/mlx5: Fix cache entry update on dereg error
IB/mlx5: Fix potential deadlock in MR deregistration
drm/xe/bmg: Update Wa_22019338487
drm/xe: Allow dropping kunit dependency as built-in
NFSv4/flexfiles: Fix handling of NFS level errors in I/O
usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed
Revert "usb: xhci: Implement xhci_handshake_check_state() helper"
usb: xhci: quirk for data loss in ISOC transfers
xhci: dbctty: disable ECHO flag by default
xhci: dbc: Flush queued requests before stopping dbc
xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS
Input: xpad - support Acer NGR 200 Controller
Input: iqs7222 - explicitly define number of external channels
usb: cdnsp: do not disable slot for disabled slot
usb: cdnsp: Fix issue with CV Bad Descriptor test
usb: dwc3: Abort suspend on soft disconnect failure
usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume
usb: acpi: fix device link removal
smb: client: fix readdir returning wrong type with POSIX extensions
cifs: all initializations for tcon should happen in tcon_info_alloc
dma-buf: fix timeout handling in dma_resv_wait_timeout v2
i2c/designware: Fix an initialization issue
Logitech C-270 even more broken
optee: ffa: fix sleep in atomic context
iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU
powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed
riscv: cpu_ops_sbi: Use static array for boot_data
platform/x86: think-lmi: Create ksets consecutively
platform/x86: think-lmi: Fix kobject cleanup
platform/x86: think-lmi: Fix sysfs group cleanup
usb: typec: displayport: Fix potential deadlock
powerpc/kernel: Fix ppc_save_regs inclusion in build
mm/vmalloc: fix data race in show_numa_info()
mm: userfaultfd: fix race of userfaultfd_move and swap cache
x86/bugs: Rename MDS machinery to something more generic
x86/bugs: Add a Transient Scheduler Attacks mitigation
KVM: SVM: Advertise TSA CPUID bits to guests
x86/microcode/AMD: Add TSA microcode SHAs
x86/process: Move the buffer clearing before MONITOR
Linux 6.12.37
Change-Id: If1d8d0f83e11df1540bebaf0fb136fe340f25dcb
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit db6525a8573957faea28850392f4744e5f8f7a53 ]
In a live migration scenario. If the number of VFs at the
destination is greater than the source, the recovery operation
will fail and qemu will not be able to complete the process and
exit after shutting down the device FD.
This will cause the driver to be unable to be unloaded normally due
to abnormal reference counting of the live migration driver caused
by the abnormal closing operation of fd.
Therefore, make sure the migration file descriptor references are
always released when the device is closed.
Fixes: b0eed08590 ("hisi_acc_vfio_pci: Add support for VFIO live migration")
Signed-off-by: Longfang Liu <liulongfang@huawei.com>
Reviewed-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
Link: https://lore.kernel.org/r/20250510081155.55840-5-liulongfang@huawei.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit e63c466398731bb7867f42f44b76fa984de59db2 ]
At present, cache write-back is placed in the device data
copy stage after stopping the device operation.
Writing back to the cache at this stage will cause the data
obtained by the cache to be written back to be empty.
In order to ensure that the cache data is written back
successfully, the data needs to be written back into the
stop device stage.
Fixes: b0eed08590 ("hisi_acc_vfio_pci: Add support for VFIO live migration")
Signed-off-by: Longfang Liu <liulongfang@huawei.com>
Reviewed-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
Link: https://lore.kernel.org/r/20250510081155.55840-4-liulongfang@huawei.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Steps on the way to 6.12.34
Resolves merge conflicts in:
kernel/sched/core.c
net/netfilter/xt_mark.c
Change-Id: I6df5e27c2a5bfa8b077b1f2814ad98b2a3dc0877
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 4518e5a60c7fbf0cdff393c2681db39d77b4f87e ]
When setting up dirty page tracking at the vfio IOMMU backend for
device migration, if an error is encountered allocating a tracking
bitmap, the unwind loop fails to free previously allocated tracking
bitmaps. This occurs because the wrong loop index is used to
generate the tracking object. This results in unintended memory
usage for the life of the current DMA mappings where bitmaps were
successfully allocated.
Use the correct loop index to derive the tracking object for
freeing during unwind.
Fixes: d6a4c18566 ("vfio iommu: Implementation of ioctl for dirty pages tracking")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Link: https://lore.kernel.org/r/20250521034647.2877-1-lirongqing@baidu.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 2777a40998deb36f96b6afc48bd397cf58a4edf0 ]
If the VF device driver is not loaded in the Guest OS and we attempt to
perform device data migration, the address of the migrated data will
be NULL.
The live migration recovery operation on the destination side will
access a null address value, which will cause access errors.
Therefore, live migration of VMs without added VF device drivers
does not require device data migration.
In addition, when the queue address data obtained by the destination
is empty, device queue recovery processing will not be performed.
Fixes: b0eed08590 ("hisi_acc_vfio_pci: Add support for VFIO live migration")
Signed-off-by: Longfang Liu <liulongfang@huawei.com>
Reviewed-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
Link: https://lore.kernel.org/r/20250510081155.55840-6-liulongfang@huawei.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 3495cec0787721ba7a9d5c19d0bbb66d182de584 ]
In order to ensure that the task packets of the accelerator
device are not lost during the migration process, it is necessary
to send an EQ and AEQ command to the device after the live migration
is completed and to update the completion position of the task queue.
Let the device recheck the completed tasks data and if there are
uncollected packets, device resend a task completion interrupt
to the software.
Fixes: b0eed08590 ("hisi_acc_vfio_pci: Add support for VFIO live migration")
Signed-off-by: Longfang Liu <liulongfang@huawei.com>
Reviewed-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
Link: https://lore.kernel.org/r/20250510081155.55840-3-liulongfang@huawei.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 8bb7170c5a055ea17c6857c256ee73c10ff872eb ]
The dma addresses of EQE and AEQE are wrong after migration and
results in guest kernel-mode encryption services failure.
Comparing the definition of hardware registers, we found that
there was an error when the data read from the register was
combined into an address. Therefore, the address combination
sequence needs to be corrected.
Even after fixing the above problem, we still have an issue
where the Guest from an old kernel can get migrated to
new kernel and may result in wrong data.
In order to ensure that the address is correct after migration,
if an old magic number is detected, the dma address needs to be
updated.
Fixes: b0eed08590 ("hisi_acc_vfio_pci: Add support for VFIO live migration")
Signed-off-by: Longfang Liu <liulongfang@huawei.com>
Reviewed-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
Link: https://lore.kernel.org/r/20250510081155.55840-2-liulongfang@huawei.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 860be250fc32de9cb24154bf21b4e36f40925707 ]
Some systems report INTx as not routed by setting pdev->irq to
IRQ_NOTCONNECTED, resulting in a -ENOTCONN error when trying to
setup eventfd signaling. Include this in the set of conditions
for which the PIN register is virtualized to zero.
Additionally consolidate vfio_pci_get_irq_count() to use this
virtualized value in reporting INTx support via ioctl and sanity
checking ioctl paths since pdev->irq is re-used when the device
is in MSI mode.
The combination of these results in both the config space of the
device and the ioctl interface behaving as if the device does not
support INTx.
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Link: https://lore.kernel.org/r/20250311230623.1264283-1-alex.williamson@redhat.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
commit c1d9dac0db168198b6f63f460665256dedad9b6e upstream.
The vfio-pci huge_fault handler doesn't make any attempt to insert a
mapping containing the faulting address, it only inserts mappings if the
faulting address and resulting pfn are aligned. This works in a lot of
cases, particularly in conjunction with QEMU where DMA mappings linearly
fault the mmap. However, there are configurations where we don't get
that linear faulting and pages are faulted on-demand.
The scenario reported in the bug below is such a case, where the physical
address width of the CPU is greater than that of the IOMMU, resulting in a
VM where guest firmware has mapped device MMIO beyond the address width of
the IOMMU. In this configuration, the MMIO is faulted on demand and
tracing indicates that occasionally the faults generate a VM_FAULT_OOM.
Given the use case, this results in a "error: kvm run failed Bad address",
killing the VM.
The host is not under memory pressure in this test, therefore it's
suspected that VM_FAULT_OOM is actually the result of a NULL return from
__pte_offset_map_lock() in the get_locked_pte() path from insert_pfn().
This suggests a potential race inserting a pte concurrent to a pmd, and
maybe indicates some deficiency in the mm layer properly handling such a
case.
Nevertheless, Peter noted the inconsistency of vfio-pci's huge_fault
handler where our mapping granularity depends on the alignment of the
faulting address relative to the order rather than aligning the faulting
address to the order to more consistently insert huge mappings. This
change not only uses the page tables more consistently and efficiently, but
as any fault to an aligned page results in the same mapping, the race
condition suspected in the VM_FAULT_OOM is avoided.
Reported-by: Adolfo <adolfotregosa@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220057
Fixes: 09dfc8a5f2ce ("vfio/pci: Fallback huge faults for unaligned pfn")
Cc: stable@vger.kernel.org
Tested-by: Adolfo <adolfotregosa@gmail.com>
Co-developed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
Link: https://lore.kernel.org/r/20250502224035.3183451-1-alex.williamson@redhat.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
GKI (arm64) relevant 76 out of 226 changes, affecting 86 files +761/-318
aa879ef6d3 HID: multitouch: Add NULL check in mt_input_configured [1 file, +4/-1]
ba6ab3f04d pinctrl: pinconf-generic: Print unsigned value if a format is registered [1 file, +4/-4]
36fd8f1c73 HID: hid-steam: Don't use cancel_delayed_work_sync in IRQ context [1 file, +1/-1]
889e6b42a4 net: fib_rules: annotate data-races around rule->[io]ifindex [1 file, +13/-11]
18e77fccfc ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu() [1 file, +1/-1]
022cac1c69 vrf: use RCU protection in l3mdev_l3_out() [1 file, +2/-0]
e7c16028a4 workqueue: Put the pwq after detaching the rescuer from the pool [1 file, +6/-6]
715eb1af64 arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array [1 file, +7/-5]
c3e39d6acb cgroup: Remove steal time from usage_usec [1 file, +0/-1]
9d32212b99 io_uring/waitid: don't abuse io_tw_state [1 file, +2/-2]
98d6ee3e30 io_uring/uring_cmd: remove dead req_has_async_data() check [1 file, +0/-3]
9e6d70a910 block: cleanup and fix batch completion adding conditions [1 file, +14/-4]
a7052afa9e gpiolib: Fix crash on error in gpiochip_get_ngpios() [1 file, +3/-3]
1b259a5df5 media: uvcvideo: Implement dual stream quirk to fix loss of usb packets [2 files, +27/-1]
7706d1edb9 media: uvcvideo: Add new quirk definition for the Sonix Technology Co. 292a camera [1 file, +9/-0]
24407a7584 media: uvcvideo: Add Kurokesu C1 PRO camera [1 file, +9/-0]
2290d3bd96 PCI/DPC: Quirk PIO log size for Intel Raptor Lake-P [1 file, +1/-0]
551df35e4f PCI: switchtec: Add Microchip PCI100X device IDs [2 files, +37/-0]
88a01e9c9a scsi: ufs: bsg: Set bsg_queue to NULL after removal [1 file, +1/-0]
c58e0d2d04 serial: 8250_pci: Resolve WCH vendor ID ambiguity [1 file, +41/-41]
14a2a8ec50 kunit: platform: Resolve 'struct completion' warning [1 file, +1/-0]
abb99f28b4 ring-buffer: Unlock resize on mmap error [1 file, +1/-0]
e8dff5f739 tracing: Do not allow mmap() of persistent ring buffer [1 file, +4/-0]
3ec743d558 ring-buffer: Validate the persistent meta data subbuf array [1 file, +20/-2]
9f837ea922 ring-buffer: Update pages_touched to reflect persistent buffer content [1 file, +5/-0]
a5852836e5 usb: gadget: f_midi: Fixing wMaxPacketSize exceeded issue during MIDI bind retries [1 file, +9/-0]
5fead36e09 usb: dwc3: Fix timeout issue during controller enter/exit from halt state [1 file, +34/-0]
69f27580e8 usb: roles: set switch registered flag early on [1 file, +3/-2]
f3b755022f usb: xhci: Restore xhci_pci support for Renesas HCs [1 file, +4/-3]
9c91296e2d USB: pci-quirks: Fix HCCPARAMS register error for LS7A EHCI [1 file, +9/-0]
847fff8e20 usb: core: fix pipe creation for get_bMaxPacketSize0 [1 file, +1/-2]
6c4fce1b16 USB: quirks: add USB_QUIRK_NO_LPM quirk for Teclast dist [1 file, +3/-0]
f4e1cebbfa USB: Add USB_QUIRK_NO_LPM quirk for sony xperia xz1 smartphone [1 file, +3/-0]
6b16761a92 usb: gadget: f_midi: fix MIDI Streaming descriptor lengths [1 file, +4/-4]
62d8f4c545 USB: hub: Ignore non-compliant devices with too many configs or interfaces [1 file, +11/-0]
165fac6ceb USB: cdc-acm: Fill in Renesas R-Car D3 USB Download mode quirk [1 file, +6/-3]
f64079bef6 usb: cdc-acm: Check control transfer buffer size before access [1 file, +14/-3]
a5b205ceef usb: cdc-acm: Fix handling of oversized fragments [1 file, +1/-1]
f894448f39 usb: gadget: core: flush gadget workqueue after device removal [1 file, +1/-1]
ce526e1b29 PCI: Avoid FLR for Mediatek MT7922 WiFi [1 file, +2/-1]
3ed642e80c efi: Avoid cold plugged memory for placing the kernel [4 files, +11/-2]
edd4084445 cgroup: fix race between fork and cgroup.kill [3 files, +16/-11]
29c04864fb serial: port: Assign ->iotype correctly when ->iobase is set [1 file, +2/-1]
010eb5fe22 serial: port: Always update ->iotype in __uart_read_properties() [1 file, +1/-1]
eeb64f9637 regmap-irq: Add missing kfree() [1 file, +2/-0]
9a1c65ff5e include: net: add static inline dst_dev_overhead() to dst.h [1 file, +9/-0]
ebf0ac02e2 clocksource: Use pr_info() for "Checking clocksource synchronization" message [1 file, +2/-1]
cc3d79e7c8 clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context [1 file, +4/-2]
f7015dcac2 scsi: ufs: core: Introduce ufshcd_has_pending_tasks() [1 file, +9/-4]
9ece41a0d7 scsi: ufs: core: Prepare to introduce a new clock_gating lock [1 file, +7/-4]
f453c45152 scsi: ufs: core: Introduce a new clock_gating lock [2 files, +59/-59]
7d46869aa7 scsi: ufs: Fix toggling of clk_gating.state when clock gating is not allowed [1 file, +1/-1]
cb4d7fbc93 ipv4: add RCU protection to ip4_dst_hoplimit() [1 file, +7/-2]
dfe542e745 ipv4: use RCU protection in ip_dst_mtu_maybe_forward() [1 file, +10/-3]
ec9af76451 net: add dev_net_rcu() helper [2 files, +7/-1]
f4ba5e65c9 ipv4: use RCU protection in ipv4_default_advmss() [1 file, +8/-3]
77096420be ipv4: use RCU protection in rt_is_expired() [1 file, +7/-1]
ad66c7c4d8 ipv4: use RCU protection in inet_select_addr() [1 file, +2/-1]
7f5005457b net: ipv4: Cache pmtu for all packet paths if multipath enabled [2 files, +108/-17]
4583748b65 ipv4: use RCU protection in __ip_rt_update_pmtu() [1 file, +6/-5]
3c925321a5 ipv4: icmp: convert to dev_net_rcu() [1 file, +17/-14]
a575827791 flow_dissector: use RCU protection to fetch dev_net() [1 file, +11/-10]
713a40c892 ipv6: use RCU protection in ip6_default_advmss() [1 file, +6/-1]
653bb5225c ipv6: icmp: convert to dev_net_rcu() [1 file, +23/-19]
2152b417be HID: hid-steam: Make sure rumble work is canceled on removal [1 file, +1/-0]
3e38cbbfa0 HID: hid-steam: Move hidraw input (un)registering to work [1 file, +31/-7]
bbec88e410 ndisc: use RCU protection in ndisc_alloc_skb() [1 file, +4/-6]
cdd5c2a12d neighbour: use RCU protection in __neigh_notify() [1 file, +6/-2]
01d1b5c9ab arp: use RCU protection in arp_xmit() [1 file, +3/-1]
789230e5a8 ndisc: extend RCU protection in ndisc_send_skb() [1 file, +8/-4]
0bf8e2f376 ipv6: mcast: extend RCU protection in igmp6_send() [1 file, +15/-16]
25195f9d5f ipv6: mcast: add RCU protection to mld_newpack() [1 file, +10/-4]
13129b1fbf scsi: ufs: core: Ensure clk_gating.lock is used only after initialization [1 file, +6/-2]
7d0dc28dae io_uring/kbuf: reallocate buf lists on upgrade [1 file, +11/-4]
645ce25aa0 vsock: Keep the binding until socket destruction [1 file, +6/-2]
3a866f8376 vsock: Orphan socket after transport release [1 file, +7/-1]
Changes in 6.12.16
nfsd: clear acl_access/acl_default after releasing them
NFSD: fix hang in nfsd4_shutdown_callback
nfsd: validate the nfsd_serv pointer before calling svc_wake_up
x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit
pinctrl: cy8c95x0: Avoid accessing reserved registers
pinctrl: cy8c95x0: Enable regmap locking for debug
pinctrl: cy8c95x0: Rename PWMSEL to SELPWM
pinctrl: cy8c95x0: Respect IRQ trigger settings from firmware
HID: winwing: Add NULL check in winwing_init_led()
HID: multitouch: Add NULL check in mt_input_configured
scripts/Makefile.extrawarn: Do not show clang's non-kprintf warnings at W=1
pinctrl: pinconf-generic: Print unsigned value if a format is registered
HID: hid-thrustmaster: fix stack-out-of-bounds read in usb_check_int_endpoints()
HID: hid-steam: Don't use cancel_delayed_work_sync in IRQ context
spi: sn-f-ospi: Fix division by zero
ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt
net: fib_rules: annotate data-races around rule->[io]ifindex
Documentation/networking: fix basic node example document ISO 15765-2
ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()
vrf: use RCU protection in l3mdev_l3_out()
idpf: fix handling rsc packet with a single segment
idpf: record rx queue in skb for RSC packets
idpf: call set_real_num_queues in idpf_open
igc: Fix HW RX timestamp when passed by ZC XDP
vxlan: check vxlan_vnigroup_init() return value
LoongArch: Fix idle VS timer enqueue
LoongArch: csum: Fix OoB access in IP checksum code for negative lengths
LoongArch: KVM: Fix typo issue about GCFG feature detection
net: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases
net: ethernet: ti: am65_cpsw: fix tx_cleanup for XDP case
Bluetooth: btintel_pcie: Fix a potential race condition
team: better TEAM_OPTION_TYPE_STRING validation
workqueue: Put the pwq after detaching the rescuer from the pool
sched_ext: Fix lock imbalance in dispatch_to_local_dsq()
drm/tests: hdmi: Fix WW_MUTEX_SLOWPATH failures
arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
gpu: host1x: Fix a use of uninitialized mutex
cgroup: Remove steal time from usage_usec
perf/x86/intel: Clean up PEBS-via-PT on hybrid
drm/xe/client: bo->client does not need bos_lock
drm/i915/selftests: avoid using uninitialized context
gpio: bcm-kona: Fix GPIO lock/unlock for banks above bank 0
gpio: bcm-kona: Make sure GPIO bits are unlocked when requesting IRQ
gpio: bcm-kona: Add missing newline to dev_err format string
io_uring/waitid: don't abuse io_tw_state
io_uring/uring_cmd: remove dead req_has_async_data() check
amdkfd: properly free gang_ctx_bo when failed to init user queue
drm/amdgpu: bail out when failed to load fw in psp_init_cap_microcode()
drm: Fix DSC BPP increment decoding
xen/swiotlb: relax alignment requirements
x86/xen: allow larger contiguous memory regions in PV guests
block: cleanup and fix batch completion adding conditions
sched_ext: Fix the incorrect bpf_list kfunc API in common.bpf.h.
sched_ext: Use SCX_CALL_OP_TASK in task_tick_scx
gpiolib: Fix crash on error in gpiochip_get_ngpios()
iommu/amd: Expicitly enable CNTRL.EPHEn bit in resume path
tools: fix annoying "mkdir -p ..." logs when building tools in parallel
RDMA/efa: Reset device on probe failure
firmware: qcom: scm: smc: Handle missing SCM device
fbdev: omap: use threaded IRQ for LCD DMA
soc/tegra: fuse: Update Tegra234 nvmem keepout list
i3c: mipi-i3c-hci: Add Intel specific quirk to ring resuming
i3c: mipi-i3c-hci: Add support for MIPI I3C HCI on PCI bus
media: cxd2841er: fix 64-bit division on gcc-9
media: i2c: ds90ub913: Add error handling to ub913_hw_init()
media: i2c: ds90ub953: Add error handling for i2c reads/writes
media: bcm2835-unicam: Disable trigger mode operation
media: uvcvideo: Implement dual stream quirk to fix loss of usb packets
media: uvcvideo: Add new quirk definition for the Sonix Technology Co. 292a camera
media: uvcvideo: Add Kurokesu C1 PRO camera
media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread
PCI/DPC: Quirk PIO log size for Intel Raptor Lake-P
PCI: switchtec: Add Microchip PCI100X device IDs
scsi: ufs: bsg: Set bsg_queue to NULL after removal
rtla/timerlat_hist: Abort event processing on second signal
rtla/timerlat_top: Abort event processing on second signal
serial: 8250_pci: Resolve WCH vendor ID ambiguity
serial: 8250_pci: Share WCH IDs with parport_serial driver
8250: microchip: pci1xxxx: Add workaround for RTS bit toggle
kunit: platform: Resolve 'struct completion' warning
vfio/pci: Enable iowrite64 and ioread64 for vfio pci
NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()
vfio/nvgrace-gpu: Read dvsec register to determine need for uncached resmem
vfio/nvgrace-gpu: Expose the blackwell device PF BAR1 to the VM
fs/ntfs3: Unify inode corruption marking with _ntfs_bad_inode()
Grab mm lock before grabbing pt lock
selftests: gpio: gpio-sim: Fix missing chip disablements
ACPI: x86: Add skip i2c clients quirk for Vexia EDU ATLA 10 tablet 5V
x86/mm/tlb: Only trim the mm_cpumask once a second
orangefs: fix a oob in orangefs_debug_write
kbuild: suppress stdout from merge_config for silent builds
ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet 5V
kbuild: Use -fzero-init-padding-bits=all
batman-adv: fix panic during interface removal
batman-adv: Ignore neighbor throughput metrics in error case
batman-adv: Drop unmanaged ELP metric worker
drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel
KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop
KVM: nSVM: Enter guest mode before initializing nested NPT MMU
perf/x86/intel: Fix ARCH_PERFMON_NUM_COUNTER_LEAF
perf/x86/intel: Ensure LBRs are disabled when a CPU is starting
ring-buffer: Unlock resize on mmap error
tracing: Do not allow mmap() of persistent ring buffer
ring-buffer: Validate the persistent meta data subbuf array
ring-buffer: Update pages_touched to reflect persistent buffer content
usb: gadget: f_midi: Fixing wMaxPacketSize exceeded issue during MIDI bind retries
usb: dwc3: Fix timeout issue during controller enter/exit from halt state
usb: roles: set switch registered flag early on
usb: gadget: udc: renesas_usb3: Fix compiler warning
usb: dwc2: gadget: remove of_node reference upon udc_stop
usb: xhci: Restore xhci_pci support for Renesas HCs
USB: pci-quirks: Fix HCCPARAMS register error for LS7A EHCI
usb: core: fix pipe creation for get_bMaxPacketSize0
USB: quirks: add USB_QUIRK_NO_LPM quirk for Teclast dist
USB: Add USB_QUIRK_NO_LPM quirk for sony xperia xz1 smartphone
usb: gadget: f_midi: fix MIDI Streaming descriptor lengths
USB: hub: Ignore non-compliant devices with too many configs or interfaces
USB: cdc-acm: Fill in Renesas R-Car D3 USB Download mode quirk
usb: cdc-acm: Check control transfer buffer size before access
usb: cdc-acm: Fix handling of oversized fragments
usb: gadget: core: flush gadget workqueue after device removal
USB: serial: option: add MeiG Smart SLM828
USB: serial: option: add Telit Cinterion FN990B compositions
USB: serial: option: fix Telit Cinterion FN990A name
USB: serial: option: drop MeiG Smart defines
can: ctucanfd: handle skb allocation failure
can: c_can: fix unbalanced runtime PM disable in error path
can: j1939: j1939_sk_send_loop(): fix unable to send messages with data length zero
can: rockchip: rkcanfd_handle_rx_fifo_overflow_int(): bail out if skb cannot be allocated
can: etas_es58x: fix potential NULL pointer dereference on udev->serial
alpha: make stack 16-byte aligned (most cases)
wifi: ath12k: fix handling of 6 GHz rules
PCI: Avoid FLR for Mediatek MT7922 WiFi
kbuild: userprogs: fix bitsize and target detection on clang
efi: Avoid cold plugged memory for placing the kernel
arm64: rust: clean Rust 1.85.0 warning using softfloat target
objtool/rust: add one more `noreturn` Rust function
rust: rbtree: fix overindented list item
cgroup: fix race between fork and cgroup.kill
serial: port: Assign ->iotype correctly when ->iobase is set
serial: port: Always update ->iotype in __uart_read_properties()
serial: 8250: Fix fifo underflow on flush
alpha: replace hardcoded stack offsets with autogenerated ones
alpha: align stack for page fault and user unaligned trap handlers
s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn()
s390/pci: Fix handling of isolated VFs
gpiolib: acpi: Add a quirk for Acer Nitro ANV14
gpio: stmpe: Check return value of stmpe_reg_read in stmpe_gpio_irq_sync_unlock
partitions: mac: fix handling of bogus partition table
sched_ext: Fix incorrect autogroup migration detection
regulator: qcom_smd: Add l2, l5 sub-node to mp5496 regulator
iommu: Fix potential memory leak in iopf_queue_remove_device()
regmap-irq: Add missing kfree()
arm64: Handle .ARM.attributes section in linker scripts
mmc: mtk-sd: Fix register settings for hs400(es) mode
igc: Set buffer type for empty frames in igc_init_empty_frame
cifs: pick channels for individual subrequests
mlxsw: Add return value check for mlxsw_sp_port_get_stats_raw()
btrfs: fix hole expansion when writing at an offset beyond EOF
include: net: add static inline dst_dev_overhead() to dst.h
net: ipv6: ioam6_iptunnel: mitigate 2-realloc issue
net: ipv6: seg6_iptunnel: mitigate 2-realloc issue
net: ipv6: rpl_iptunnel: mitigate 2-realloc issue
net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels
clocksource: Use pr_info() for "Checking clocksource synchronization" message
clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context
scsi: ufs: core: Introduce ufshcd_has_pending_tasks()
scsi: ufs: core: Prepare to introduce a new clock_gating lock
scsi: ufs: core: Introduce a new clock_gating lock
scsi: ufs: Fix toggling of clk_gating.state when clock gating is not allowed
rust: kbuild: add -fzero-init-padding-bits to bindgen_skip_cflags
cpufreq/amd-pstate: Call cppc_set_epp_perf in the reenable function
cpufreq/amd-pstate: Align offline flow of shared memory and MSR based systems
cpufreq/amd-pstate: Refactor amd_pstate_epp_reenable() and amd_pstate_epp_offline()
cpufreq/amd-pstate: Remove the cppc_state check in offline/online functions
cpufreq/amd-pstate: Merge amd_pstate_epp_cpu_offline() and amd_pstate_epp_offline()
cpufreq/amd-pstate: convert mutex use to guard()
cpufreq/amd-pstate: Fix cpufreq_policy ref counting
ipv4: add RCU protection to ip4_dst_hoplimit()
ipv4: use RCU protection in ip_dst_mtu_maybe_forward()
net: add dev_net_rcu() helper
ipv4: use RCU protection in ipv4_default_advmss()
ipv4: use RCU protection in rt_is_expired()
ipv4: use RCU protection in inet_select_addr()
net: ipv4: Cache pmtu for all packet paths if multipath enabled
ipv4: use RCU protection in __ip_rt_update_pmtu()
ipv4: icmp: convert to dev_net_rcu()
flow_dissector: use RCU protection to fetch dev_net()
ipv6: use RCU protection in ip6_default_advmss()
ipv6: icmp: convert to dev_net_rcu()
HID: hid-steam: Make sure rumble work is canceled on removal
HID: hid-steam: Move hidraw input (un)registering to work
ndisc: use RCU protection in ndisc_alloc_skb()
neighbour: use RCU protection in __neigh_notify()
arp: use RCU protection in arp_xmit()
openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
ndisc: extend RCU protection in ndisc_send_skb()
ipv6: mcast: extend RCU protection in igmp6_send()
btrfs: rename __get_extent_map() and pass btrfs_inode
btrfs: fix stale page cache after race between readahead and direct IO write
ipv6: mcast: add RCU protection to mld_newpack()
drm/tidss: Fix issue in irq handling causing irq-flood issue
drm/tidss: Fix race condition while handling interrupt registers
drm/tidss: Clear the interrupt status for interrupts being disabled
drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()
drm/rcar-du: dsi: Fix PHY lock bit check
drm/msm/dpu: fix x1e80100 intf_6 underrun/vsync interrupt
drm/msm/dpu1: don't choke on disabling the writeback connector
drm/v3d: Stop active perfmon if it is being destroyed
drm/xe/tracing: Fix a potential TP_printk UAF
drm: renesas: rz-du: Increase supported resolutions
netdevsim: print human readable IP address
selftests: rtnetlink: update netdevsim ipsec output format
x86/static-call: Remove early_boot_irqs_disabled check to fix Xen PVH dom0
bpf: handle implicit declaration of function gettid in bpf_iter.c
selftests/bpf: Fix uprobe consumer test
wifi: rtw89: pci: disable PCIE wake bit when PCIE deinit
cpufreq/amd-pstate: Remove the goto label in amd_pstate_update_limits
net: ipv6: fix dst refleaks in rpl, seg6 and ioam6 lwtunnels
scsi: ufs: core: Ensure clk_gating.lock is used only after initialization
io_uring/kbuf: reallocate buf lists on upgrade
vsock: Keep the binding until socket destruction
vsock: Orphan socket after transport release
Revert "vfio/platform: check the bounds of read/write syscalls"
Linux 6.12.16
Change-Id: I84e354ffa6aeb0323a95046630310c3d2185a069
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
GKI (arm64) relevant 75 out of 419 changes, affecting 91 files +700/-304
38a1aa02b9 exec: fix up /proc/pid/comm in the execveat(AT_EMPTY_PATH) case [2 files, +29/-4]
e5ff8d825d sched: Don't try to catch up excess steal time. [1 file, +4/-2]
404e5fd918 printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX [1 file, +1/-1]
b006aadf72 drm/connector: add mutex to protect ELD from concurrent access [3 files, +11/-1]
22a1a75818 ring-buffer: Make reading page consistent with the code logic [1 file, +3/-1]
5c2b1d9386 tun: fix group permission check [1 file, +9/-5]
f4b8bac3cf mmc: core: Respect quirk_max_rate for non-UHS SDIO card [1 file, +2/-0]
e557b15ea2 HID: multitouch: Add quirk for Hantick 5288 touchpad [1 file, +5/-0]
adcb8ce68d HID: Wacom: Add PCI Wacom device support [1 file, +5/-0]
ebb90f23f0 Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync [1 file, +11/-1]
c257c15845 tipc: re-order conditions in tipc_crypto_key_rcv() [1 file, +2/-2]
90778f31ef ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback [1 file, +28/-4]
33a4a9f54a Input: allocate keycode for phone linking [1 file, +1/-0]
57e07d10b3 sched/fair: Fix inaccurate h_nr_runnable accounting with delayed dequeue [1 file, +19/-0]
bc85817e6b nvme: handle connectivity loss in nvme_set_queue_count [1 file, +7/-1]
5eba53a9ea nvme: make nvme_tls_attrs_group static [1 file, +1/-1]
83ebf741aa udp: gso: do not drop small packets when PMTU reduces [3 files, +30/-4]
3139a7024e ethtool: rss: fix hiding unsupported fields in dumps [1 file, +2/-1]
e40cb34b7f pfifo_tail_enqueue: Drop new packet when sch->limit == 0 [1 file, +3/-0]
6312555249 netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() [1 file, +1/-1]
e36364d5d4 tun: revert fix group permission check [1 file, +5/-9]
181b23ca2e net: sched: Fix truncation of offloaded action statistics [1 file, +1/-1]
ac7b5f3e4d drm/client: Handle tiled displays better [1 file, +9/-0]
f735c9d4dc fs/proc: do_task_stat: Fix ESP not readable during coredump [1 file, +1/-1]
5a6520493c arm64/kvm: Configure HYP TCR.PS/DS based on host stage1 [1 file, +4/-4]
c66e5205fd arm64/sme: Move storage of reg_smidr to __cpuinfo_store_cpu() [2 files, +10/-13]
e5251ae5d3 arm64/mm: Reduce PA space to 48 bits when LPA2 is not enabled [3 files, +11/-7]
de3ffeb212 KVM: arm64: timer: Always evaluate the need for a soft timer [1 file, +1/-3]
f2f805ada6 KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() [1 file, +9/-0]
691218a50c Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc [1 file, +2/-1]
ddfc234761 Bluetooth: L2CAP: accept zero as a special value for MTU auto-selection [1 file, +2/-2]
5a262628f4 seccomp: passthrough uretprobe systemcall without filtering [1 file, +12/-0]
2ce09aabe0 blk-cgroup: Fix class @block_class's subsystem refcount leakage [1 file, +1/-0]
ae959ab075 scsi: ufs: core: Fix the HIGH/LOW_TEMP Bit Definitions [1 file, +2/-2]
45ad3c7d62 of: Correct child specifier used as input of the 2nd nexus node [1 file, +1/-1]
e62c630810 of: address: Fix empty resource handling in __of_address_resource_bounds() [1 file, +5/-7]
4e4b3d4926 of: Fix of_find_node_opts_by_path() handling of alias+path+options [1 file, +3/-3]
5b91440ebe of: reserved-memory: Fix using wrong number of cells to get property 'alignment' [1 file, +2/-2]
ed0ad04c68 ring-buffer: Do not allow events in NMI with generic atomic64 cmpxchg() [1 file, +7/-2]
d0b81ea5a5 dm-crypt: don't update io->sector after kcryptd_crypt_write_io_submit() [1 file, +3/-11]
68a25ceb11 dm-crypt: track tag_offset in convert_context [1 file, +7/-6]
68f16d3034 block: don't revert iter for -EIOCBQUEUED [1 file, +3/-2]
0a14a2b841 Revert "media: uvcvideo: Require entities to have a non-zero unique ID" [1 file, +27/-43]
3d17a4bbf2 PCI: endpoint: Finish virtual EP removal in pci_epf_remove_vepf() [1 file, +1/-0]
36786d1a45 PCI: dwc: ep: Write BAR_MASK before iATU registers in pci_epc_set_bar() [1 file, +15/-13]
b5cacfd067 PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar() [1 file, +21/-1]
9fbac83100 nvme-pci: Add TUXEDO InfinityFlex to Samsung sleep quirk [1 file, +2/-1]
2c4cda456e nvme-pci: Add TUXEDO IBP Gen9 to Samsung sleep quirk [1 file, +1/-0]
0c77c0d754 scsi: ufs: core: Fix use-after free in init error and remove paths [4 files, +30/-32]
8db25d4c4a scsi: core: Do not retry I/Os during depopulation [1 file, +7/-2]
c287f18f64 rv: Reset per-task monitors also for idle tasks [1 file, +4/-0]
e456a88bdd hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING [2 files, +83/-21]
2a54e8f118 kfence: skip __GFP_THISNODE allocations on NUMA systems [1 file, +2/-0]
b64b773087 soc: qcom: smem_state: fix missing of_node_put in error path [1 file, +2/-1]
5100391aca media: mc: fix endpoint iteration [1 file, +1/-1]
d2eac8b14a media: uvcvideo: Fix crash during unbind if gpio unit is in use [2 files, +22/-7]
4f534dd576 media: uvcvideo: Fix event flags in uvc_ctrl_send_events [1 file, +2/-2]
ac7737ed9a media: uvcvideo: Support partial control reads [1 file, +21/-0]
34fb9eb31d media: uvcvideo: Only save async fh if success [1 file, +11/-7]
e8a650dbc7 media: uvcvideo: Remove redundant NULL assignment [1 file, +1/-3]
438bda062b media: uvcvideo: Remove dangling pointers [3 files, +67/-3]
a403eca86c mm: gup: fix infinite loop within __get_longterm_locked [1 file, +4/-10]
4b69308314 mm/vmscan: accumulate nr_demoted for accurate demotion statistics [1 file, +4/-3]
4491159774 mm/compaction: fix UBSAN shift-out-of-bounds warning [1 file, +2/-1]
2c3109dcda nvmem: core: improve range check for nvmem_cell_write() [1 file, +2/-0]
35ae7910c3 io_uring: fix multishots with selected buffers [1 file, +2/-0]
be985aea92 io_uring/net: don't retry connect operation on EPOLLERR [2 files, +7/-0]
e398619920 i3c: master: Fix missing 'ret' assignment in set_speed() [1 file, +1/-1]
8b4120b3e0 misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors [1 file, +30/-9]
19fc795e9d maple_tree: simplify split calculation [1 file, +6/-17]
8441aea464 ptp: Ensure info->enable callback is always set [1 file, +8/-0]
c6dd70e5b4 timers/migration: Fix off-by-one root mis-connection [1 file, +9/-1]
45439a8b11 fs: prepend statmount.mnt_opts string with security_sb_mnt_opts() [1 file, +4/-0]
7db0365ee6 fs: fix adding security options to statmount.mnt_opt [1 file, +14/-15]
d49c64c1d7 statmount: let unset strings be empty [1 file, +12/-4]
Changes in 6.12.14
irqchip/lan966x-oic: Make CONFIG_LAN966X_OIC depend on CONFIG_MCHP_LAN966X_PCI
btrfs: fix assertion failure when splitting ordered extent after transaction abort
btrfs: do not output error message if a qgroup has been already cleaned up
btrfs: fix use-after-free when attempting to join an aborted transaction
arm64/mm: Ensure adequate HUGE_MAX_HSTATE
exec: fix up /proc/pid/comm in the execveat(AT_EMPTY_PATH) case
s390/stackleak: Use exrl instead of ex in __stackleak_poison()
btrfs: fix data race when accessing the inode's disk_i_size at btrfs_drop_extents()
btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error handling
sched: Don't try to catch up excess steal time.
x86: Convert unreachable() to BUG()
locking/ww_mutex/test: Use swap() macro
lockdep: Fix upper limit for LOCKDEP_*_BITS configs
x86/amd_nb: Restrict init function to AMD-based systems
drm/virtio: New fence for every plane update
drm: Add panel backlight quirks
drm: panel-backlight-quirks: Add Framework 13 matte panel
drm: panel-backlight-quirks: Add Framework 13 glossy and 2.8k panels
nvkm/gsp: correctly advance the read pointer of GSP message queue
nvkm: correctly calculate the available space of the GSP cmdq buffer
drm/tests: hdmi: handle empty modes in find_preferred_mode()
drm/tests: hdmi: return meaningful value from set_connector_edid()
drm/amd/display: Populate chroma prefetch parameters, DET buffer fix
drm/amd/display: Overwriting dualDPP UBF values before usage
printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX
drm/connector: add mutex to protect ELD from concurrent access
drm/bridge: anx7625: use eld_mutex to protect access to connector->eld
drm/bridge: ite-it66121: use eld_mutex to protect access to connector->eld
drm/amd/display: use eld_mutex to protect access to connector->eld
drm/exynos: hdmi: use eld_mutex to protect access to connector->eld
drm/radeon: use eld_mutex to protect access to connector->eld
drm/sti: hdmi: use eld_mutex to protect access to connector->eld
drm/vc4: hdmi: use eld_mutex to protect access to connector->eld
drm/amd/display: Fix Mode Cutoff in DSC Passthrough to DP2.1 Monitor
drm/amdgpu: Don't enable sdma 4.4.5 CTXEMPTY interrupt
drm/amdkfd: Queue interrupt work to different CPU
drm/bridge: it6505: Change definition MAX_HDCP_DOWN_STREAM_COUNT
drm/bridge: it6505: fix HDCP Bstatus check
drm/bridge: it6505: fix HDCP encryption when R0 ready
drm/bridge: it6505: fix HDCP CTS compare V matching
drm/bridge: it6505: fix HDCP CTS KSV list wait timer
safesetid: check size of policy writes
drm/amd/display: Increase sanitizer frame larger than limit when compile testing with clang
drm/amd/display: Limit Scaling Ratio on DCN3.01
ring-buffer: Make reading page consistent with the code logic
wifi: rtw89: add crystal_cap check to avoid setting as overflow value
tun: fix group permission check
mmc: core: Respect quirk_max_rate for non-UHS SDIO card
mmc: sdhci-esdhc-imx: enable 'SDHCI_QUIRK_NO_LED' quirk for S32G
wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
tomoyo: don't emit warning in tomoyo_write_control()
mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id
wifi: rtw88: add __packed attribute to efuse layout struct
clk: qcom: Make GCC_8150 depend on QCOM_GDSC
HID: multitouch: Add quirk for Hantick 5288 touchpad
HID: Wacom: Add PCI Wacom device support
net/mlx5: use do_aux_work for PHC overflow checks
wifi: brcmfmac: Check the return value of of_property_read_string_index()
wifi: iwlwifi: pcie: Add support for new device ids
wifi: iwlwifi: avoid memory leak
i2c: Force ELAN06FA touchpad I2C bus freq to 100KHz
APEI: GHES: Have GHES honor the panic= setting
Bluetooth: btusb: Add new VID/PID 13d3/3610 for MT7922
Bluetooth: btusb: Add new VID/PID 13d3/3628 for MT7925
Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync
net: wwan: iosm: Fix hibernation by re-binding the driver around it
HID: hid-asus: Disable OOBE mode on the ProArt P16
mmc: sdhci-msm: Correctly set the load for the regulator
octeon_ep: update tx/rx stats locally for persistence
octeon_ep_vf: update tx/rx stats locally for persistence
tipc: re-order conditions in tipc_crypto_key_rcv()
selftests/net/ipsec: Fix Null pointer dereference in rtattr_pack()
net: ethernet: ti: am65-cpsw: ensure proper channel cleanup in error path
ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params
x86/kexec: Allocate PGD for x86_64 transition page tables separately
ASoC: Intel: sof_sdw: Correct quirk for Lenovo Yoga Slim 7
iommu/arm-smmu-qcom: add sdm670 adreno iommu compatible
iommu/arm-smmu-v3: Clean up more on probe failure
platform/x86: int3472: Check for adev == NULL
platform/x86: acer-wmi: Add support for Acer PH14-51
ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback
platform/x86: acer-wmi: Add support for Acer Predator PH16-72
ASoC: amd: Add ACPI dependency to fix build error
Input: allocate keycode for phone linking
platform/x86: acer-wmi: add support for Acer Nitro AN515-58
platform/x86: acer-wmi: Ignore AC events
KVM: PPC: e500: Mark "struct page" dirty in kvmppc_e500_shadow_map()
KVM: PPC: e500: Mark "struct page" pfn accessed before dropping mmu_lock
KVM: PPC: e500: Use __kvm_faultin_pfn() to handle page faults
KVM: e500: always restore irqs
drm/amdgpu: Fix Circular Locking Dependency in AMDGPU GFX Isolation
xfs: report realtime block quota limits on realtime directories
xfs: don't over-report free space or inodes in statvfs
tty: xilinx_uartps: split sysrq handling
tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN
platform/x86: serdev_helpers: Check for serial_ctrl_uid == NULL
sched/fair: Fix inaccurate h_nr_runnable accounting with delayed dequeue
nvme: handle connectivity loss in nvme_set_queue_count
firmware: iscsi_ibft: fix ISCSI_IBFT Kconfig entry
gpu: drm_dp_cec: fix broken CEC adapter properties check
ice: put Rx buffers after being done with current frame
ice: gather page_count()'s of each frag right before XDP prog call
ice: stop storing XDP verdict within ice_rx_buf
nvme: make nvme_tls_attrs_group static
nvme-fc: use ctrl state getter
net: bcmgenet: Correct overlaying of PHY and MAC Wake-on-LAN
ice: Add check for devm_kzalloc()
vmxnet3: Fix tx queue race condition with XDP
tg3: Disable tg3 PCIe AER on system reboot
udp: gso: do not drop small packets when PMTU reduces
drm/i915/dp: fix the Adaptive sync Operation mode for SDP
ethtool: rss: fix hiding unsupported fields in dumps
rxrpc: Fix the rxrpc_connection attend queue handling
gpio: pca953x: Improve interrupt support
net: atlantic: fix warning during hot unplug
net: rose: lock the socket in rose_bind()
gpio: sim: lock hog configfs items if present
x86/xen: fix xen_hypercall_hvm() to not clobber %rbx
x86/xen: add FRAME_END to xen_hypercall_hvm()
ACPI: property: Fix return value for nval == 0 in acpi_data_prop_read()
pfifo_tail_enqueue: Drop new packet when sch->limit == 0
netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
tun: revert fix group permission check
net: sched: Fix truncation of offloaded action statistics
rxrpc: Fix call state set to not include the SERVER_SECURING state
cpufreq: fix using cpufreq-dt as module
cpufreq: s3c64xx: Fix compilation warning
leds: lp8860: Write full EEPROM, not only half of it
ALSA: hda/realtek: Enable Mute LED on HP Laptop 14s-fq1xxx
cifs: Remove intermediate object of failed create SFU call
drm/modeset: Handle tiled displays in pan_display_atomic.
drm/client: Handle tiled displays better
smb: client: fix order of arguments of tracepoints
smb: client: change lease epoch type from unsigned int to __u16
md: reintroduce md-linear
s390/futex: Fix FUTEX_OP_ANDN implementation
arm64: Filter out SVE hwcaps when FEAT_SVE isn't implemented
m68k: vga: Fix I/O defines
fs/proc: do_task_stat: Fix ESP not readable during coredump
binfmt_flat: Fix integer overflow bug on 32 bit systems
accel/ivpu: Fix Qemu crash when running in passthrough
arm64/kvm: Configure HYP TCR.PS/DS based on host stage1
arm64/mm: Override PARange for !LPA2 and use it consistently
arm64/sme: Move storage of reg_smidr to __cpuinfo_store_cpu()
arm64/mm: Reduce PA space to 48 bits when LPA2 is not enabled
KVM: arm64: timer: Always evaluate the need for a soft timer
drm/rockchip: cdn-dp: Use drm_connector_helper_hpd_irq_event()
arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma
remoteproc: omap: Handle ARM dma_iommu_mapping
KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
kvm: defer huge page recovery vhost task to later
KVM: s390: vsie: fix some corner-cases when grabbing vsie pages
ksmbd: fix integer overflows on 32 bit systems
drm/amd/display: Optimize cursor position updates
drm/amd/pm: Mark MM activity as unsupported
drm/amd/amdgpu: change the config of cgcg on gfx12
drm/amdkfd: only flush the validate MES contex
drm/amdkfd: Block per-queue reset when halt_if_hws_hang=1
Revert "drm/amd/display: Use HW lock mgr for PSR1"
drm/i915/guc: Debug print LRC state entries only if the context is pinned
drm/i915: Fix page cleanup on DMA remap failure
drm/komeda: Add check for komeda_get_layer_fourcc_list()
drm/xe/devcoredump: Move exec queue snapshot to Contexts section
drm/i915/dp: Iterate DSC BPP from high to low on all platforms
drm/i915: Drop 64bpp YUV formats from ICL+ SDR planes
drm/amdgpu: add a BO metadata flag to disable write compression for Vulkan
drm/amd/display: Fix seamless boot sequence
Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
Bluetooth: L2CAP: accept zero as a special value for MTU auto-selection
KEYS: trusted: dcp: fix improper sg use with CONFIG_VMAP_STACK=y
clk: sunxi-ng: a100: enable MMC clock reparenting
clk: mmp2: call pm_genpd_init() only after genpd.name is set
media: i2c: ds90ub960: Fix UB9702 refclk register access
clk: clk-loongson2: Fix the number count of clk provider
clk: qcom: clk-alpha-pll: fix alpha mode configuration
clk: qcom: gcc-sm8550: Do not turn off PCIe GDSCs during gdsc_disable()
clk: qcom: gcc-sm8650: Do not turn off PCIe GDSCs during gdsc_disable()
clk: qcom: gcc-sm6350: Add missing parent_map for two clocks
clk: qcom: dispcc-sm6350: Add missing parent_map for a clock
clk: qcom: gcc-mdm9607: Fix cmd_rcgr offset for blsp1_uart6 rcg
clk: qcom: clk-rpmh: prevent integer overflow in recalc_rate
clk: mediatek: mt2701-vdec: fix conversion to mtk_clk_simple_probe
clk: mediatek: mt2701-aud: fix conversion to mtk_clk_simple_probe
clk: mediatek: mt2701-bdp: add missing dummy clk
clk: mediatek: mt2701-img: add missing dummy clk
clk: mediatek: mt2701-mm: add missing dummy clk
seccomp: passthrough uretprobe systemcall without filtering
blk-cgroup: Fix class @block_class's subsystem refcount leakage
efi: libstub: Use '-std=gnu11' to fix build with GCC 15
perf bench: Fix undefined behavior in cmpworker()
scsi: ufs: core: Fix the HIGH/LOW_TEMP Bit Definitions
of: Correct child specifier used as input of the 2nd nexus node
of: address: Fix empty resource handling in __of_address_resource_bounds()
of: Fix of_find_node_opts_by_path() handling of alias+path+options
of: reserved-memory: Fix using wrong number of cells to get property 'alignment'
Input: bbnsm_pwrkey - add remove hook
HID: hid-sensor-hub: don't use stale platform-data on remove
ring-buffer: Do not allow events in NMI with generic atomic64 cmpxchg()
atomic64: Use arch_spin_locks instead of raw_spin_locks
wifi: rtlwifi: rtl8821ae: Fix media status report
wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()
wifi: mt76: mt7921u: Add VID/PID for TP-Link TXE50UH
wifi: rtw88: sdio: Fix disconnection after beacon loss
wifi: mt76: mt7915: add module param to select 5 GHz or 6 GHz on MT7916
wifi: rtw88: 8703b: Fix RX/TX issues
usb: gadget: f_tcm: Translate error to sense
usb: gadget: f_tcm: Decrement command ref count on cleanup
usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint
usb: gadget: f_tcm: Don't prepare BOT write request twice
usbnet: ipheth: fix possible overflow in DPE length check
usbnet: ipheth: use static NDP16 location in URB
usbnet: ipheth: check that DPE points past NCM header
usbnet: ipheth: refactor NCM datagram loop
usbnet: ipheth: break up NCM header size computation
usbnet: ipheth: fix DPE OoB read
usbnet: ipheth: document scope of NCM implementation
arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix USB QMP PHY supplies
arm64: dts: qcom: x1e80100-qcp: Fix USB QMP PHY supplies
arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Fix USB QMP PHY supplies
arm64: dts: qcom: x1e80100-crd: Fix USB QMP PHY supplies
arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix USB QMP PHY supplies
arm64: dts: qcom: x1e80100-microsoft-romulus: Fix USB QMP PHY supplies
arm64: dts: qcom: x1e80100: Fix usb_2 controller interrupts
ASoC: acp: Support microphone from Lenovo Go S
soc: qcom: socinfo: Avoid out of bounds read of serial number
serial: sh-sci: Drop __initdata macro for port_cfg
serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is in use
MIPS: Loongson64: remove ROM Size unit in boardinfo
LoongArch: Extend the maximum number of watchpoints
powerpc/pseries/eeh: Fix get PE state translation
dm-crypt: don't update io->sector after kcryptd_crypt_write_io_submit()
dm-crypt: track tag_offset in convert_context
mips/math-emu: fix emulation of the prefx instruction
MIPS: pci-legacy: Override pci_address_to_pio
Revert "MIPS: csrc-r4k: Select HAVE_UNSTABLE_SCHED_CLOCK if SMP && 64BIT"
block: don't revert iter for -EIOCBQUEUED
Revert "media: uvcvideo: Require entities to have a non-zero unique ID"
firmware: qcom: scm: Fix missing read barrier in qcom_scm_is_available()
firmware: qcom: scm: Fix missing read barrier in qcom_scm_get_tzmem_pool()
ALSA: hda/realtek: Enable headset mic on Positivo C6400
ALSA: hda/realtek: Fix quirk matching for Legion Pro 7
ALSA: hda: Fix headset detection failure due to unstable sort
arm64: tegra: Fix Tegra234 PCIe interrupt-map
s390/pci: Fix SR-IOV for PFs initially in standby
PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1
PCI: endpoint: Finish virtual EP removal in pci_epf_remove_vepf()
PCI: dwc: ep: Write BAR_MASK before iATU registers in pci_epc_set_bar()
PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()
nvme-pci: Add TUXEDO InfinityFlex to Samsung sleep quirk
nvme-pci: Add TUXEDO IBP Gen9 to Samsung sleep quirk
KVM: x86/mmu: Ensure NX huge page recovery thread is alive before waking
scsi: st: Don't set pos_unknown just after device recognition
scsi: qla2xxx: Move FCE Trace buffer allocation to user control
scsi: ufs: qcom: Fix crypto key eviction
scsi: ufs: core: Fix use-after free in init error and remove paths
scsi: storvsc: Set correct data length for sending SCSI command without payload
scsi: core: Do not retry I/Os during depopulation
kbuild: Move -Wenum-enum-conversion to W=2
rust: init: use explicit ABI to clean warning in future compilers
x86: rust: set rustc-abi=x86-softfloat on rustc>=1.86.0
x86/acpi: Fix LAPIC/x2APIC parsing order
x86/boot: Use '-std=gnu11' to fix build with GCC 15
ubi: Add a check for ubi_num
ARM: dts: dra7: Add bus_dma_limit for l4 cfg bus
ARM: dts: ti/omap: gta04: fix pm issues caused by spi module
arm64: dts: mediatek: mt8183: Disable DPI display output by default
arm64: dts: qcom: sdx75: Fix MPSS memory length
arm64: dts: qcom: x1e80100: Fix ADSP memory base and length
arm64: dts: qcom: x1e80100: Fix CDSP memory length
arm64: dts: qcom: sm6115: Fix MPSS memory length
arm64: dts: qcom: sm6115: Fix CDSP memory length
arm64: dts: qcom: sm6115: Fix ADSP memory base and length
arm64: dts: qcom: sm6350: Fix ADSP memory length
arm64: dts: qcom: sm6350: Fix MPSS memory length
arm64: dts: qcom: sm6350: Fix uart1 interconnect path
arm64: dts: qcom: sm6375: Fix ADSP memory length
arm64: dts: qcom: sm6375: Fix CDSP memory base and length
arm64: dts: qcom: sm6375: Fix MPSS memory base and length
arm64: dts: qcom: sm8350: Fix ADSP memory base and length
arm64: dts: qcom: sm8350: Fix CDSP memory base and length
arm64: dts: qcom: sm8350: Fix MPSS memory length
arm64: dts: qcom: sm8450: Fix ADSP memory base and length
arm64: dts: qcom: sm8450: Fix CDSP memory length
arm64: dts: qcom: sm8450: Fix MPSS memory length
arm64: dts: qcom: sm8550: Fix ADSP memory base and length
arm64: dts: qcom: sm8550: Fix CDSP memory length
arm64: dts: qcom: sm8550: Fix MPSS memory length
arm64: dts: qcom: sm8650: Fix ADSP memory base and length
arm64: dts: qcom: sm8650: Fix CDSP memory length
arm64: dts: qcom: sm8650: Fix MPSS memory length
arm64: dts: qcom: sm8550: correct MDSS interconnects
arm64: dts: qcom: sm8650: correct MDSS interconnects
crypto: qce - fix priority to be less than ARMv8 CE
arm64: tegra: Fix typo in Tegra234 dce-fabric compatible
arm64: tegra: Disable Tegra234 sce-fabric node
parisc: Temporarily disable jump label support
pwm: microchip-core: fix incorrect comparison with max period
xfs: don't call remap_verify_area with sb write protection held
xfs: Propagate errors from xfs_reflink_cancel_cow_range in xfs_dax_write_iomap_end
xfs: Add error handling for xfs_reflink_cancel_cow_range
accel/ivpu: Clear runtime_error after pm_runtime_resume_and_get() fails
ACPI: PRM: Remove unnecessary strict handler address checks
tpm: Change to kvalloc() in eventlog/acpi.c
rv: Reset per-task monitors also for idle tasks
hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING
iommufd: Fix struct iommu_hwpt_pgfault init and padding
kfence: skip __GFP_THISNODE allocations on NUMA systems
media: ccs: Clean up parsed CCS static data on parse failure
mm/hugetlb: fix avoid_reserve to allow taking folio from subpool
iio: light: as73211: fix channel handling in only-color triggered buffer
iommu/tegra241-cmdqv: Read SMMU IDR1.CMDQS instead of hardcoding
iommufd/fault: Destroy response and mutex in iommufd_fault_destroy()
iommufd/fault: Use a separate spinlock to protect fault->deliver list
soc: samsung: exynos-pmu: Fix uninitialized ret in tensor_set_bits_atomic()
soc: mediatek: mtk-devapc: Fix leaking IO map on error paths
soc: mediatek: mtk-devapc: Fix leaking IO map on driver remove
soc: qcom: llcc: Enable LLCC_WRCACHE at boot on X1
soc: qcom: smem_state: fix missing of_node_put in error path
media: mmp: Bring back registration of the device
media: mc: fix endpoint iteration
media: nuvoton: Fix an error check in npcm_video_ece_init()
media: imx296: Add standby delay during probe
media: intel/ipu6: remove cpu latency qos request on error
media: ov5640: fix get_light_freq on auto
media: stm32: dcmipp: correct dma_set_mask_and_coherent mask value
media: ccs: Fix CCS static data parsing for large block sizes
media: ccs: Fix cleanup order in ccs_probe()
media: i2c: ds90ub9x3: Fix extra fwnode_handle_put()
media: i2c: ds90ub960: Fix use of non-existing registers on UB9702
media: i2c: ds90ub960: Fix UB9702 VC map
media: i2c: ds90ub960: Fix logging SP & EQ status only for UB9702
media: uvcvideo: Fix crash during unbind if gpio unit is in use
media: uvcvideo: Fix event flags in uvc_ctrl_send_events
media: uvcvideo: Support partial control reads
media: uvcvideo: Only save async fh if success
media: uvcvideo: Remove redundant NULL assignment
media: uvcvideo: Remove dangling pointers
mm: kmemleak: fix upper boundary check for physical address objects
mm: gup: fix infinite loop within __get_longterm_locked
mm/vmscan: accumulate nr_demoted for accurate demotion statistics
mm/hugetlb: fix hugepage allocation for interleaved memory nodes
mm/compaction: fix UBSAN shift-out-of-bounds warning
ata: libata-sff: Ensure that we cannot write outside the allocated buffer
irqchip/irq-mvebu-icu: Fix access to msi_data from irq_domain::host_data
crypto: qce - fix goto jump in error path
crypto: qce - unregister previously registered algos in error path
ceph: fix memory leak in ceph_mds_auth_match()
nvmem: qcom-spmi-sdam: Set size in struct nvmem_config
nvmem: core: improve range check for nvmem_cell_write()
nvmem: imx-ocotp-ele: simplify read beyond device check
nvmem: imx-ocotp-ele: fix MAC address byte order
nvmem: imx-ocotp-ele: fix reading from non zero offset
nvmem: imx-ocotp-ele: set word length to 1
io_uring: fix multishots with selected buffers
io_uring/net: don't retry connect operation on EPOLLERR
vfio/platform: check the bounds of read/write syscalls
selftests: mptcp: connect: -f: no reconnect
pnfs/flexfiles: retry getting layout segment for reads
ocfs2: fix incorrect CPU endianness conversion causing mount failure
ocfs2: handle a symlink read error correctly
nilfs2: fix possible int overflows in nilfs_fiemap()
nfs: Make NFS_FSCACHE select NETFS_SUPPORT instead of depending on it
NFSD: Encode COMPOUND operation status on page boundaries
mailbox: tegra-hsp: Clear mailbox before using message
mailbox: zynqmp: Remove invalid __percpu annotation in zynqmp_ipi_probe()
NFC: nci: Add bounds checking in nci_hci_create_pipe()
fgraph: Fix set_graph_notrace with setting TRACE_GRAPH_NOTRACE_BIT
i3c: master: Fix missing 'ret' assignment in set_speed()
irqchip/apple-aic: Only handle PMC interrupt as FIQ when configured so
mtd: onenand: Fix uninitialized retlen in do_otp_read()
misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors
misc: fastrpc: Deregister device nodes properly in error scenarios
misc: fastrpc: Fix registered buffer page address
misc: fastrpc: Fix copy buffer page size
net/ncsi: wait for the last response to Deselect Package before configuring channel
net: phy: c45-tjaxx: add delay between MDIO write and read in soft_reset
maple_tree: simplify split calculation
scripts/gdb: fix aarch64 userspace detection in get_current_task
tracing/osnoise: Fix resetting of tracepoints
rtla/osnoise: Distinguish missing workload option
rtla/timerlat_hist: Set OSNOISE_WORKLOAD for kernel threads
rtla/timerlat_top: Set OSNOISE_WORKLOAD for kernel threads
rtla: Add trace_instance_stop
rtla/timerlat_hist: Stop timerlat tracer on signal
rtla/timerlat_top: Stop timerlat tracer on signal
pinctrl: samsung: fix fwnode refcount cleanup if platform_get_irq_optional() fails
pinctrl: renesas: rzg2l: Fix PFC_MASK for RZ/V2H and RZ/G3E
ptp: Ensure info->enable callback is always set
RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error
rtc: zynqmp: Fix optional clock name property
timers/migration: Fix off-by-one root mis-connection
s390/fpu: Add fpc exception handler / remove fixup section again
MIPS: ftrace: Declare ftrace_get_parent_ra_addr() as static
xfs: avoid nested calls to __xfs_trans_commit
xfs: don't lose solo superblock counter update transactions
xfs: separate dquot buffer reads from xfs_dqflush
xfs: clean up log item accesses in xfs_qm_dqflush{,_done}
xfs: attach dquot buffer to dquot log item buffer
xfs: convert quotacheck to attach dquot buffers
xfs: release the dquot buf outside of qli_lock
xfs: lock dquot buffer before detaching dquot from b_li_list
xfs: fix mount hang during primary superblock recovery failure
spi: atmel-quadspi: Create `atmel_qspi_ops` to support newer SoC families
spi: atmel-qspi: Memory barriers after memory-mapped I/O
Revert "btrfs: avoid monopolizing a core when activating a swap file"
btrfs: avoid monopolizing a core when activating a swap file
mptcp: prevent excessive coalescing on receive
x86/mm: Convert unreachable() to BUG()
md/md-linear: Fix a NULL vs IS_ERR() bug in linear_add()
md: Fix linear_set_limits()
Revert "selftests/sched_ext: fix build after renames in sched_ext API"
Revert "drm/amd/display: Fix green screen issue after suspend"
drm/xe: Fix and re-enable xe_print_blob_ascii85()
fs: prepend statmount.mnt_opts string with security_sb_mnt_opts()
fs: fix adding security options to statmount.mnt_opt
statmount: let unset strings be empty
arm64: dts: rockchip: add reset-names for combphy on rk3568
ocfs2: check dir i_size in ocfs2_find_entry
Linux 6.12.14
Change-Id: Id4141bfc8ee9a6320b056561aa528228e7a3f1df
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 6a9eb2d125ba90d13b45bcfabcddf9f61268f6a8 ]
There is a HW defect on Grace Hopper (GH) to support the
Multi-Instance GPU (MIG) feature [1] that necessiated the presence
of a 1G region carved out from the device memory and mapped as
uncached. The 1G region is shown as a fake BAR (comprising region 2 and 3)
to workaround the issue.
The Grace Blackwell systems (GB) differ from GH systems in the following
aspects:
1. The aforementioned HW defect is fixed on GB systems.
2. There is a usable BAR1 (region 2 and 3) on GB systems for the
GPUdirect RDMA feature [2].
This patch accommodate those GB changes by showing the 64b physical
device BAR1 (region2 and 3) to the VM instead of the fake one. This
takes care of both the differences.
Moreover, the entire device memory is exposed on GB as cacheable to
the VM as there is no carveout required.
Link: https://www.nvidia.com/en-in/technologies/multi-instance-gpu/ [1]
Link: https://docs.nvidia.com/cuda/gpudirect-rdma/ [2]
Cc: Kevin Tian <kevin.tian@intel.com>
CC: Jason Gunthorpe <jgg@nvidia.com>
Suggested-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Ankit Agrawal <ankita@nvidia.com>
Link: https://lore.kernel.org/r/20250124183102.3976-3-ankita@nvidia.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit bd53764a60ad586ad5b6ed339423ad5e67824464 ]
NVIDIA's recently introduced Grace Blackwell (GB) Superchip is a
continuation with the Grace Hopper (GH) superchip that provides a
cache coherent access to CPU and GPU to each other's memory with
an internal proprietary chip-to-chip cache coherent interconnect.
There is a HW defect on GH systems to support the Multi-Instance
GPU (MIG) feature [1] that necessiated the presence of a 1G region
with uncached mapping carved out from the device memory. The 1G
region is shown as a fake BAR (comprising region 2 and 3) to
workaround the issue. This is fixed on the GB systems.
The presence of the fix for the HW defect is communicated by the
device firmware through the DVSEC PCI config register with ID 3.
The module reads this to take a different codepath on GB vs GH.
Scan through the DVSEC registers to identify the correct one and use
it to determine the presence of the fix. Save the value in the device's
nvgrace_gpu_pci_core_device structure.
Link: https://www.nvidia.com/en-in/technologies/multi-instance-gpu/ [1]
CC: Jason Gunthorpe <jgg@nvidia.com>
CC: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Ankit Agrawal <ankita@nvidia.com>
Link: https://lore.kernel.org/r/20250124183102.3976-2-ankita@nvidia.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 2b938e3db335e3670475e31a722c2bee34748c5a ]
Definitions of ioread64 and iowrite64 macros in asm/io.h called by vfio
pci implementations are enclosed inside check for CONFIG_GENERIC_IOMAP.
They don't get defined if CONFIG_GENERIC_IOMAP is defined. Include
linux/io-64-nonatomic-lo-hi.h to define iowrite64 and ioread64 macros
when they are not defined. io-64-nonatomic-lo-hi.h maps the macros to
generic implementation in lib/iomap.c. The generic implementation does
64 bit rw if readq/writeq is defined for the architecture, otherwise it
would do 32 bit back to back rw.
Note that there are two versions of the generic implementation that
differs in the order the 32 bit words are written if 64 bit support is
not present. This is not the little/big endian ordering, which is
handled separately. This patch uses the lo followed by hi word ordering
which is consistent with current back to back implementation in the
vfio/pci code.
Signed-off-by: Ramesh Thomas <ramesh.thomas@intel.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/20241210131938.303500-2-ramesh.thomas@intel.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
pKVM provides mutual distrust between host kernel and protected VMs(pVM)
One solution to provide DMA isolation in this model, is to move the IOMMU
control to the hypervisor and para-virtualize the IOMMU interface for
the host and guest kernel. (none of them have direct access to IOMMU
programming interface).
In the case of device assignement, the host can't map memory in for the
guest kernel (as it is not trusted).
So, what mainly needs to be done is to assign a blocking domain, when
VFIO assigns the device to user space, so it can't issue any DMA, and
when the guest take control it can program the IOMMU through hypervisor
with collapsed translation (IOVA->PA directly).
Bug: 357781595
Bug: 348382247
Change-Id: Ie424c54d32f43016465de71f24129fea2fe47e59
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Add arch specific functions to notify KVM about device/group assignment
to KVM.
pKVM would use this to assign devices at once, as this is a requirement
for pVM device passthrough, that all devices have to be donated first
before the VM using them.
That allow the hypervisor to properly reset the device, and prevent
situations where a devices is not fully owned by pVM.
Bug: 357781595
Bug: 348382247
Change-Id: Icedc6b72eff713702361d424c702eb6c395267dd
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Add a function to get struct device from a VFIO file, this is would
be used from kvm-vfio bridge for protected device assignment.
Bug: 357781595
Bug: 348382247
Change-Id: I60026744e2bd65b290cee8eb439a542946255755
Signed-off-by: Mostafa Saleh <smostafa@google.com>
[ Upstream commit 9c7c5430bca36e9636eabbba0b3b53251479c7ab ]
Align the page tracking maximum message size with the device's
capability instead of relying on PAGE_SIZE.
This adjustment resolves a mismatch on systems where PAGE_SIZE is 64K,
but the firmware only supports a maximum message size of 4K.
Now that we rely on the device's capability for max_message_size, we
must account for potential future increases in its value.
Key considerations include:
- Supporting message sizes that exceed a single system page (e.g., an 8K
message on a 4K system).
- Ensuring the RQ size is adjusted to accommodate at least 4
WQEs/messages, in line with the device specification.
The above has been addressed as part of the patch.
Fixes: 79c3cf2799 ("vfio/mlx5: Init QP based resources for dirty tracking")
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Tested-by: Yingshun Cui <yicui@redhat.com>
Signed-off-by: Yishai Hadas <yishaih@nvidia.com>
Link: https://lore.kernel.org/r/20241205122654.235619-1-yishaih@nvidia.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
commit 9283b7392570421c22a6c8058614f5b76a46b81c upstream.
The unsigned variable `size_t len` is cast to the signed type `loff_t`
when passed to the function check_add_overflow(). This function considers
the type of the destination, which is of type loff_t (signed),
potentially leading to an overflow. This issue is similar to the one
described in the link below.
Remove the cast.
Note that even if check_add_overflow() is bypassed, by setting `len` to
a value that is greater than LONG_MAX (which is considered as a negative
value after the cast), the function copy_from_user(), invoked a few lines
later, will not perform any copy and return `len` as (len > INT_MAX)
causing qat_vf_resume_write() to fail with -EFAULT.
Fixes: bb208810b1 ("vfio/qat: Add vfio_pci driver for Intel QAT SR-IOV VF devices")
CC: stable@vger.kernel.org # 6.10+
Link: https://lore.kernel.org/all/138bd2e2-ede8-4bcc-aa7b-f3d9de167a37@moroto.mountain
Reported-by: Zijie Zhao <zzjas98@gmail.com>
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Xin Zeng <xin.zeng@intel.com>
Link: https://lore.kernel.org/r/20241021123843.42979-1-giovanni.cabiddu@intel.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit fe4bf8d0b6716a423b16495d55b35d3fe515905d ]
There are cases where a PCIe extended capability should be hidden from
the user. For example, an unknown capability (i.e., capability with ID
greater than PCI_EXT_CAP_ID_MAX) or a capability that is intentionally
chosen to be hidden from the user.
Hiding a capability is done by virtualizing and modifying the 'Next
Capability Offset' field of the previous capability so it points to the
capability after the one that should be hidden.
The special case where the first capability in the list should be hidden
is handled differently because there is no previous capability that can
be modified. In this case, the capability ID and version are zeroed
while leaving the next pointer intact. This hides the capability and
leaves an anchor for the rest of the capability list.
However, today, hiding the first capability in the list is not done
properly if the capability is unknown, as struct
vfio_pci_core_device->pci_config_map is set to the capability ID during
initialization but the capability ID is not properly checked later when
used in vfio_config_do_rw(). This leads to the following warning [1] and
to an out-of-bounds access to ecap_perms array.
Fix it by checking cap_id in vfio_config_do_rw(), and if it is greater
than PCI_EXT_CAP_ID_MAX, use an alternative struct perm_bits for direct
read only access instead of the ecap_perms array.
Note that this is safe since the above is the only case where cap_id can
exceed PCI_EXT_CAP_ID_MAX (except for the special capabilities, which
are already checked before).
[1]
WARNING: CPU: 118 PID: 5329 at drivers/vfio/pci/vfio_pci_config.c:1900 vfio_pci_config_rw+0x395/0x430 [vfio_pci_core]
CPU: 118 UID: 0 PID: 5329 Comm: simx-qemu-syste Not tainted 6.12.0+ #1
(snip)
Call Trace:
<TASK>
? show_regs+0x69/0x80
? __warn+0x8d/0x140
? vfio_pci_config_rw+0x395/0x430 [vfio_pci_core]
? report_bug+0x18f/0x1a0
? handle_bug+0x63/0xa0
? exc_invalid_op+0x19/0x70
? asm_exc_invalid_op+0x1b/0x20
? vfio_pci_config_rw+0x395/0x430 [vfio_pci_core]
? vfio_pci_config_rw+0x244/0x430 [vfio_pci_core]
vfio_pci_rw+0x101/0x1b0 [vfio_pci_core]
vfio_pci_core_read+0x1d/0x30 [vfio_pci_core]
vfio_device_fops_read+0x27/0x40 [vfio]
vfs_read+0xbd/0x340
? vfio_device_fops_unl_ioctl+0xbb/0x740 [vfio]
? __rseq_handle_notify_resume+0xa4/0x4b0
__x64_sys_pread64+0x96/0xc0
x64_sys_call+0x1c3d/0x20d0
do_syscall_64+0x4d/0x120
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Fixes: 89e1f7d4c6 ("vfio: Add PCI device driver")
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Yi Liu <yi.l.liu@intel.com>
Tested-by: Yi Liu <yi.l.liu@intel.com>
Link: https://lore.kernel.org/r/20241124142739.21698-1-avihaih@nvidia.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit cb04444c243c001fc27f275e84792ff1c2b96867 ]
Fix unwind flows in mlx5vf_pci_save_device_data() and
mlx5vf_pci_resume_device_data() to avoid freeing the migf pointer at the
'end' label, as this will be handled by fput(migf->filp) through
mlx5vf_release_file().
To ensure mlx5vf_release_file() functions correctly, move the
initialization of migf fields (such as migf->lock) to occur before any
potential unwind flow, as these fields may be accessed within
mlx5vf_release_file().
Fixes: 9945a67ea4 ("vfio/mlx5: Refactor PD usage")
Signed-off-by: Yishai Hadas <yishaih@nvidia.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/20241114095318.16556-3-yishaih@nvidia.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 22e87bf3f77c18f5982c19ffe2732ef0c7a25f16 ]
Fix an unwind issue in mlx5vf_add_migration_pages().
If a set of pages is allocated but fails to be added to the SG table,
they need to be freed to prevent a memory leak.
Any pages successfully added to the SG table will be freed as part of
mlx5vf_free_data_buffer().
Fixes: 6fadb02126 ("vfio/mlx5: Implement vfio_pci driver for mlx5 devices")
Signed-off-by: Yishai Hadas <yishaih@nvidia.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/20241114095318.16556-2-yishaih@nvidia.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
no_llseek had been defined to NULL two years ago, in commit 868941b144
("fs: remove no_llseek")
To quote that commit,
At -rc1 we'll need do a mechanical removal of no_llseek -
git grep -l -w no_llseek | grep -v porting.rst | while read i; do
sed -i '/\<no_llseek\>/d' $i
done
would do it.
Unfortunately, that hadn't been done. Linus, could you do that now, so
that we could finally put that thing to rest? All instances are of the
form
.llseek = no_llseek,
so it's obviously safe.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Pull VFIO updates from Alex Williamson:
"Just a few cleanups this cycle:
- Remove several unused structure and function declarations, and
unused variables (Dr. David Alan Gilbert, Yue Haibing, Zhang Zekun)
- Constify unmodified structure in mdev (Hongbo Li)
- Convert to unsigned type to catch overflow with less fanfare than
passing a negative value to kcalloc() (Dan Carpenter)"
* tag 'vfio-v6.12-rc1' of https://github.com/awilliam/linux-vfio:
vfio/pci: clean up a type in vfio_pci_ioctl_pci_hot_reset_groups()
vfio/mdev: Constify struct kobj_type
vfio: mdev: Remove unused function declarations
vfio/fsl-mc: Remove unused variable 'hwirq'
vfio/pci: Remove unused struct 'vfio_pci_mmap_vma'
Pull 'struct fd' updates from Al Viro:
"Just the 'struct fd' layout change, with conversion to accessor
helpers"
* tag 'pull-stable-struct_fd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
add struct fd constructors, get rid of __to_fd()
struct fd: representation change
introduce fd_file(), convert all accessors to it.
The "array_count" value comes from the copy_from_user() in
vfio_pci_ioctl_pci_hot_reset(). If the user passes a value larger than
INT_MAX then we'll pass a negative value to kcalloc() which triggers an
allocation failure and a stack trace.
It's better to make the type unsigned so that if (array_count > count)
returns -EINVAL instead.
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/262ada03-d848-4369-9c37-81edeeed2da2@stanley.mountain
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
This 'struct kobj_type' is not modified. It is only used in
kobject_init_and_add() which takes a 'const struct kobj_type *ktype'
parameter.
Constifying this structure and moving it to a read-only section,
and this can increase over all security.
```
[Before]
text data bss dec hex filename
2372 600 0 2972 b9c drivers/vfio/mdev/mdev_sysfs.o
[After]
text data bss dec hex filename
2436 568 0 3004 bbc drivers/vfio/mdev/mdev_sysfs.o
```
Signed-off-by: Hongbo Li <lihongbo22@huawei.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/20240904011837.2010444-1-lihongbo22@huawei.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
For any changes of struct fd representation we need to
turn existing accesses to fields into calls of wrappers.
Accesses to struct fd::flags are very few (3 in linux/file.h,
1 in net/socket.c, 3 in fs/overlayfs/file.c and 3 more in
explicit initializers).
Those can be dealt with in the commit converting to
new layout; accesses to struct fd::file are too many for that.
This commit converts (almost) all of f.file to
fd_file(f). It's not entirely mechanical ('file' is used as
a member name more than just in struct fd) and it does not
even attempt to distinguish the uses in pointer context from
those in boolean context; the latter will be eventually turned
into a separate helper (fd_empty()).
NOTE: mass conversion to fd_empty(), tempting as it
might be, is a bad idea; better do that piecewise in commit
that convert from fdget...() to CLASS(...).
[conflicts in fs/fhandle.c, kernel/bpf/syscall.c, mm/memcontrol.c
caught by git; fs/stat.c one got caught by git grep]
[fs/xattr.c conflict]
Reviewed-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Pull driver core updates from Greg KH:
"Here is the big set of driver core changes for 6.11-rc1.
Lots of stuff in here, with not a huge diffstat, but apis are evolving
which required lots of files to be touched. Highlights of the changes
in here are:
- platform remove callback api final fixups (Uwe took many releases
to get here, finally!)
- Rust bindings for basic firmware apis and initial driver-core
interactions.
It's not all that useful for a "write a whole driver in rust" type
of thing, but the firmware bindings do help out the phy rust
drivers, and the driver core bindings give a solid base on which
others can start their work.
There is still a long way to go here before we have a multitude of
rust drivers being added, but it's a great first step.
- driver core const api changes.
This reached across all bus types, and there are some fix-ups for
some not-common bus types that linux-next and 0-day testing shook
out.
This work is being done to help make the rust bindings more safe,
as well as the C code, moving toward the end-goal of allowing us to
put driver structures into read-only memory. We aren't there yet,
but are getting closer.
- minor devres cleanups and fixes found by code inspection
- arch_topology minor changes
- other minor driver core cleanups
All of these have been in linux-next for a very long time with no
reported problems"
* tag 'driver-core-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (55 commits)
ARM: sa1100: make match function take a const pointer
sysfs/cpu: Make crash_hotplug attribute world-readable
dio: Have dio_bus_match() callback take a const *
zorro: make match function take a const pointer
driver core: module: make module_[add|remove]_driver take a const *
driver core: make driver_find_device() take a const *
driver core: make driver_[create|remove]_file take a const *
firmware_loader: fix soundness issue in `request_internal`
firmware_loader: annotate doctests as `no_run`
devres: Correct code style for functions that return a pointer type
devres: Initialize an uninitialized struct member
devres: Fix memory leakage caused by driver API devm_free_percpu()
devres: Fix devm_krealloc() wasting memory
driver core: platform: Switch to use kmemdup_array()
driver core: have match() callback in struct bus_type take a const *
MAINTAINERS: add Rust device abstractions to DRIVER CORE
device: rust: improve safety comments
MAINTAINERS: add Danilo as FIRMWARE LOADER maintainer
MAINTAINERS: add Rust FW abstractions to FIRMWARE LOADER
firmware: rust: improve safety comments
...
Pull powerpc updates from Michael Ellerman:
- Remove support for 40x CPUs & platforms
- Add support to the 64-bit BPF JIT for cpu v4 instructions
- Fix PCI hotplug driver crash on powernv
- Fix doorbell emulation for KVM on PAPR guests (nestedv2)
- Fix KVM nested guest handling of some less used SPRs
- Online NUMA nodes with no CPU/memory if they have a PCI device
attached
- Reduce memory overhead of enabling kfence on 64-bit Radix MMU kernels
- Reimplement the iommu table_group_ops for pseries for VFIO SPAPR TCE
Thanks to: Anjali K, Artem Savkov, Athira Rajeev, Breno Leitao, Brian
King, Celeste Liu, Christophe Leroy, Esben Haabendal, Gaurav Batra,
Gautam Menghani, Haren Myneni, Hari Bathini, Jeff Johnson, Krishna
Kumar, Krzysztof Kozlowski, Nathan Lynch, Nicholas Piggin, Nick Bowler,
Nilay Shroff, Rob Herring (Arm), Shawn Anastasio, Shivaprasad G Bhat,
Sourabh Jain, Srikar Dronamraju, Timothy Pearson, Uwe Kleine-König, and
Vaibhav Jain.
* tag 'powerpc-6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (57 commits)
Documentation/powerpc: Mention 40x is removed
powerpc: Remove 40x leftovers
macintosh/therm_windtunnel: fix module unload.
powerpc: Check only single values are passed to CPU/MMU feature checks
powerpc/xmon: Fix disassembly CPU feature checks
powerpc: Drop clang workaround for builtin constant checks
powerpc64/bpf: jit support for signed division and modulo
powerpc64/bpf: jit support for sign extended mov
powerpc64/bpf: jit support for sign extended load
powerpc64/bpf: jit support for unconditional byte swap
powerpc64/bpf: jit support for 32bit offset jmp instruction
powerpc/pci: Hotplug driver bridge support
pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
powerpc/configs: Update defconfig with now user-visible CONFIG_FSL_IFC
powerpc: add missing MODULE_DESCRIPTION() macros
macintosh/mac_hid: add MODULE_DESCRIPTION()
KVM: PPC: add missing MODULE_DESCRIPTION() macros
powerpc/kexec: Use of_property_read_reg()
powerpc/64s/radix/kfence: map __kfence_pool at page granularity
powerpc/pseries/iommu: Define spapr_tce_table_group_ops only with CONFIG_IOMMU_API
...
Pull VFIO updates from Alex Williamson:
- Add support for 8-byte accesses when using read/write through the
device regions. This fills a gap for userspace drivers that might
not be able to use access through mmap to perform native register
width accesses (Gerd Bayer)
- Add missing MODULE_DESCRIPTION to vfio-mdev sample drivers and
replace a non-standard MODULE_INFO usage (Jeff Johnson)
* tag 'vfio-v6.11-rc1' of https://github.com/awilliam/linux-vfio:
vfio-mdev: add missing MODULE_DESCRIPTION() macros
vfio/pci: Fix typo in macro to declare accessors
vfio/pci: Support 8-byte PCI loads and stores
vfio/pci: Extract duplicated code into macro
Pull iommu updates from Will Deacon:
"Core:
- Support for the "ats-supported" device-tree property
- Removal of the 'ops' field from 'struct iommu_fwspec'
- Introduction of iommu_paging_domain_alloc() and partial conversion
of existing users
- Introduce 'struct iommu_attach_handle' and provide corresponding
IOMMU interfaces which will be used by the IOMMUFD subsystem
- Remove stale documentation
- Add missing MODULE_DESCRIPTION() macro
- Misc cleanups
Allwinner Sun50i:
- Ensure bypass mode is disabled on H616 SoCs
- Ensure page-tables are allocated below 4GiB for the 32-bit
page-table walker
- Add new device-tree compatible strings
AMD Vi:
- Use try_cmpxchg64() instead of cmpxchg64() when updating pte
Arm SMMUv2:
- Print much more useful information on context faults
- Fix Qualcomm TBU probing when CONFIG_ARM_SMMU_QCOM_DEBUG=n
- Add new Qualcomm device-tree bindings
Arm SMMUv3:
- Support for hardware update of access/dirty bits and reporting via
IOMMUFD
- More driver rework from Jason, this time updating the PASID/SVA
support to prepare for full IOMMUFD support
- Add missing MODULE_DESCRIPTION() macro
- Minor fixes and cleanups
NVIDIA Tegra:
- Fix for benign fwspec initialisation issue exposed by rework on the
core branch
Intel VT-d:
- Use try_cmpxchg64() instead of cmpxchg64() when updating pte
- Use READ_ONCE() to read volatile descriptor status
- Remove support for handling Execute-Requested requests
- Avoid calling iommu_domain_alloc()
- Minor fixes and refactoring
Qualcomm MSM:
- Updates to the device-tree bindings"
* tag 'iommu-updates-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (72 commits)
iommu/tegra-smmu: Pass correct fwnode to iommu_fwspec_init()
iommu/vt-d: Fix identity map bounds in si_domain_init()
iommu: Move IOMMU_DIRTY_NO_CLEAR define
dt-bindings: iommu: Convert msm,iommu-v0 to yaml
iommu/vt-d: Fix aligned pages in calculate_psi_aligned_address()
iommu/vt-d: Limit max address mask to MAX_AGAW_PFN_WIDTH
docs: iommu: Remove outdated Documentation/userspace-api/iommu.rst
arm64: dts: fvp: Enable PCIe ATS for Base RevC FVP
iommu/of: Support ats-supported device-tree property
dt-bindings: PCI: generic: Add ats-supported property
iommu: Remove iommu_fwspec ops
OF: Simplify of_iommu_configure()
ACPI: Retire acpi_iommu_fwspec_ops()
iommu: Resolve fwspec ops automatically
iommu/mediatek-v1: Clean up redundant fwspec checks
RDMA/usnic: Use iommu_paging_domain_alloc()
wifi: ath11k: Use iommu_paging_domain_alloc()
wifi: ath10k: Use iommu_paging_domain_alloc()
drm/msm: Use iommu_paging_domain_alloc()
vhost-vdpa: Use iommu_paging_domain_alloc()
...
In the match() callback, the struct device_driver * should not be
changed, so change the function callback to be a const *. This is one
step of many towards making the driver core safe to have struct
device_driver in read-only memory.
Because the match() callback is in all busses, all busses are modified
to handle this properly. This does entail switching some container_of()
calls to container_of_const() to properly handle the constant *.
For some busses, like PCI and USB and HV, the const * is cast away in
the match callback as those busses do want to modify those structures at
this point in time (they have a local lock in the driver structure.)
That will have to be changed in the future if they wish to have their
struct device * in read-only-memory.
Cc: Rafael J. Wysocki <rafael@kernel.org>
Reviewed-by: Alex Elder <elder@kernel.org>
Acked-by: Sumit Garg <sumit.garg@linaro.org>
Link: https://lore.kernel.org/r/2024070136-wrongdoer-busily-01e8@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The PAPR expects the TCE table to have no entries at the time of
unset window(i.e. remove-pe). The TCE clear right now is done
before freeing the iommu table. On pSeries, the unset window
makes those entries inaccessible to the OS and the H_PUT/GET calls
fail on them with H_CONSTRAINED.
On PowerNV, this has no side effect as the TCE clear can be done
before the DMA window removal as well.
Signed-off-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/171923273535.1397.1236742071894414895.stgit@linux.ibm.com
Greg Kroah-Hartman
Longfang Liu
Li RongQing
Alex Williamson
Greg Kroah-Hartman
Ankit Agrawal
Ramesh Thomas
Mostafa Saleh
Yishai Hadas
Giovanni Cabiddu
Avihai Horon
Al Viro
Linus Torvalds
Peter Xu
Dan Carpenter
Hongbo Li
Zhang Zekun
Yue Haibing
Dr. David Alan Gilbert
Yi Liu
Lu Baolu
Shivaprasad G Bhat
Ben Segal
Gerd Bayer