Commit Graph
6980 Commits
Author SHA1 Message Date
Maxime Ripard 67f8bc848e Merge drm/drm-fixes into drm-misc-fixes
Let's start the 7.3 drm-misc-fixes cycle.

Signed-off-by: Maxime Ripard <mripard@kernel.org>
2026-09-01 09:38:51 +02:00
Linus Torvalds 93e4b3076b Merge tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char/misc/IIO/etc driver updates from Greg KH:
 "Here is the big set of char, misc, iio, counter, fpga, and other small
  driver subsystems for 7.3-rc1.

  Overall, due to some driver removals we only added a bit more code
  than removed, which was a nice change. Highlights in this merge
  request are:

   - Loads of IIO driver updates and additions

   - binder driver updates (more on that below...)

   - Removal of the SGI XP and GRU drivers as they are not used anymore
     and turn out to be pretty insecure overall

   - Removal of the obsolete ibmasm driver as it's not being used
     anymore

   - Coresight driver updates and additions

   - Mei driver udpates

   - Counter driver updates

   - FPGA driver updates

   - ICC driver updates

   - lots and lots of other tiny driver updates to resolve reported
     issues

  All of these have been in linux-next for a while"

* tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (513 commits)
  iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
  iio: adc: pac1921: fix wrong channel used in trigger handler read
  iio: light: gp2ap002: re-enable irq if runtime suspend fails
  iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
  iio: light: apds9306: fix PM reference leak in apds9306_read_data()
  iio: gyro: mpu3050: fix sign of raw angular velocity readings
  iio: srf04: fix pm_runtime handling on probe error path
  iio: adc: ad4080: configure backend data size
  iio: adc: adi-axi-adc: add data size support for AD408X backend
  iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
  iio: dac: ad5446: fix OF module device table
  iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
  iio: light: opt4001: Reject integration times with a non-zero seconds part
  iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
  iio: light: opt4001: Fix power down clearing bits of the wrong register
  iio: light: opt4060: Fix incorrect register name in threshold read error message
  iio: light: opt4060: Fix pointer type passed to div_u64_rem()
  iio: light: opt4060: Reject integration times with a non-zero seconds part
  iio: light: ltrf216a: fix runtime PM reference leak in error path
  iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
  ...
2026-08-25 09:38:50 -07:00
Baineng Shou a4a1a2bfcb misc: fastrpc: don't publish fd before copy_to_user() succeeds
fastrpc_ioctl_alloc_dmabuf() calls dma_buf_fd() which installs the fd
into the caller's fd table before copy_to_user() copies the fd number
back to userspace.  If copy_to_user() fails, the fd is already visible
to other threads in the same process but the ioctl returns -EFAULT.
The existing comment in the code even acknowledges the problem:

  "The usercopy failed, but we can't do much about it, as dma_buf_fd()
   already called fd_install()..."

Now that dma_buf_fd_install() is available (introduced to fix the same
issue in dma-heap), apply the same pattern here: reserve the fd with
get_unused_fd_flags(), attempt copy_to_user(), and only on success call
dma_buf_fd_install() to publish it atomically with the tracepoint.  On
copy_to_user() failure, put_unused_fd() and dma_buf_put() cleanly
unwind without any user-visible side effects.

Fixes: 6cffd79504 ("misc: fastrpc: Add support for dmabuf exporter")
Cc: stable@vger.kernel.org
Acked-by: Christian König <christian.koenig@amd.com>
Acked-by: Sumit Semwal <sumit.semwal@linaro.org>
Signed-off-by: Baineng Shou <shoubaineng@gmail.com>
Link: https://lore.kernel.org/r/20260817050457.1005285-3-shoubaineng@gmail.com
Signed-off-by: Christian König <christian.koenig@amd.com>
2026-08-24 13:58:25 +02:00
Linus Torvalds 570f7e331f Merge tag 'pci-v7.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci
Pull PCI updates from Bjorn Helgaas:
 "Resource management:

   - Add hotplug reservation only once (not at each level of the
     hierarchy) so bridge windows don't grow more than necessary (Ilpo
     Järvinen)

  Driver binding:

   - Rework device matching so device ID lifetime only needs to cover
     the probe path since dynamic IDs can be removed at any time (Gary
     Guo)

  Error handling:

   - Update mappings of AER errors to agent & layer and log them for
     each individual error when multiple errors detected (Lukas Wunner)

   - Log Error Source only once, not twice in separate messages (Lukas
     Wunner)

   - Emit TLP Log only for unmasked errors (Lukas Wunner)

   - Support Advisory Non-Fatal Errors (Lukas Wunner)

   - Allow DPC on all Downstream Ports, not just Root Ports, when OS
     controls AER (Darshit Shah)

  ASPM:

   - Program the same ASPM Control values for every function of
     multi-function devices, as recommended by the PCIe spec (Krishna
     Chaitanya Chundru)

   - Avoid L0s for Realtek RTS525A, where it causes an AER interrupt
     storm (Max Lee)

   - Avoid ASPM L0s, L1, and L1 PM Substates based on 'aspm-no-l0s',
     'aspm-no-l1' [1], and 'aspm-no-l1ss' DT properties (Krishna
     Chaitanya Chundru)

  Power management:

   - Allow D3 for native hotplug-capable Root Ports on non-x86 platforms
     (we avoid D3 for these ports on x86 because some old platforms
     didn't validate it) (Manivannan Sadhasivam)

   - Allow portdrv to claim Ports even if they don't support services
     (AER, PME, DPC, hotplug, etc) so it can do power management (Brian
     Norris)

  Power control:

   - Add support for PCIe WAKE# interrupt when described via DT (Krishna
     Chaitanya Chundru)

   - For the TC9563 PCIe switch:

       - Take a reference on the I2C adapter to avoid uninterruptible
         hang when unloading an I2C module while in-use (Johan Hovold)

       - Update DT binding and driver to restrict Tx Amplitude, DFE and
         N_FTS to USP, DSP1 and DSP2 (Manivannan Sadhasivam)

       - Power off only external-facing ports (DSP1, DSP2), leaving USP
         and DSP3 (aka VDSP) powered up (Manivannan Sadhasivam)

       - Move integrated MAC Endpoint out of the list of internal ports
         and configure it separately (Manivannan Sadhasivam)

  Virtualization:

   - Add ACS quirk for Pericom PI7C9X2G608 switches (Tim Harvey)

   - Fix a long-standing bug in the Intel PCH Root Port MPC ACS quirk
     that didn't update the intended INTEL_MPC_REG_IRBNCE bit because it
     used a 16-bit config write when a 32-bit write was intended
     (Mohamad Raizudeen)

  Procfs:

   - Avoid spurious runtime PM wakeup on config space accesses that are
     outside config space and fail before reaching PCI (Krzysztof
     Wilczyński)

   - Warn on user-space writes to kernel-exclusive config space regions,
     as we already do for sysfs (Krzysztof Wilczyński)

   - Check credentials of opener, not reader, for config space reads, as
     we already do for sysfs (Krzysztof Wilczyński)

  Sysfs:

   - In pci_write_legacy_io(), avoid out-of-bounds reads from the user
     buffer and fix incorrect ioport write data (1-byte writes on
     little-endian powerpc, 2- and 4-byte writes on big-endian powerpc)
     (Krzysztof Wilczyński)

   - In pci_read_legacy_io(), fix incorrect ioport read data for 2- and
     4-byte reads on big-endian powerpc (Krzysztof Wilczyński)

   - Fix I/O port accessor argument order in Alpha pci_legacy_write()
     (Krzysztof Wilczyński)

   - Avoid spurious runtime PM wakeup on config space accesses that are
     outside config space and fail before reaching PCI (Krzysztof
     Wilczyński)

   - Return -EINVAL, not -ENODEV, for mmap of I/O BAR that fails because
     the arch doesn't support it, as we do for procfs (Krzysztof
     Wilczyński)

   - Check for LOCKDOWN_PCI_ACCESS for legacy_io and legacy_mem, as we
     do for other config space accessors (Krzysztof Wilczyński)

  Peer-to-peer DMA:

   - Add Nvidia Vera Rubin to list of platforms that support P2PDMA
     (Leon Romanovsky)

  Endpoint framework:

   - Check doorbell SUCCESS bit in pci_endpoint_test to avoid treating
     some failures as successes (Niklas Cassel)

   - Fail doorbell test when the trigger IRQ is missed (Niklas Cassel)

  New native PCIe controller drivers:

   - Add DT binding and driver for NVIDIA Tegra264 (Thierry Reding)

  Native PCIe controllers:

   - Use common wait time definitions for PCIe link monitoring instead
     of defining driver-private duplicates (Thierry Reding)

  Generic host bridge driver:

   - Fix NULL pointer dereference that caused enumeration failures on
     32-bit CAM systems (Steffen Persvold)

  Amlogic Meson PCIe controller driver:

   - Correct the PERST# GPIO state so it remains asserted until power
     and REFCLK become stable to fix enumeration failure (Ronald
     Claveau)

  ASPEED PCIe controller driver:

   - Switch to irq_domain_create_linear() so we can obsolete
     irq_domain_add_linear() (Jiri Slaby)

  Cadence PCIe controller driver:

   - Add MODULE_DEVICE_TABLE to generate module aliases for OF-based
     module autoloading (Pengpeng Hou)

   - Add debugfs 'ltssm_status' file for LGA- and HPA-based Cadence
     controllers (Hans Zhang)

   - Support up to x4 (not x2) lanes for J200 (Takuma Fujiwara)

   - Fix host/endpoint dependencies for cadence-plat driver to fix link
     error when cadence-plat is built-in but the host or endpoint driver
     is modular (Aksh Garg)

  Freescale i.MX6 PCIe controller driver:

   - Add imx6 intr/aer/pme interrupt lines for i.MX95 (Richard Zhu)

   - Remove PERST# checking from pci_host_common_parse_port() so callers
     can decide whether to fall back to legacy DT binding with PERST# in
     the host bridge (Sherry Sun)

   - Fix build issues when PCI_PWRCTRL_GENERIC or PCI_HOST_COMMON is a
     module (Arnd Bergmann)

   - Create pwrctrl devices only once by doing it from imx_pcie_probe()
     instead of imx_pcie_host_init(), which is used during both probe
     and resume (Sherry Sun)

   - Use 'dw_pcie_rp->skip_pwrctrl_off' to avoid powering off devices
     during suspend to preserve wakeup capability (Sherry Sun)

   - Add runtime PM support for i.MX95 to allow dynamic power management
     when the link is idle (Richard Zhu)

  Intel VMD host bridge driver:

   - Support device ID 0x28C1 and assume that BIOS has already
     enumerated the hierarchy below VMD and stored bus range info for OS
     to use (Nirmal Patel)

   - Add support for VMCONFIG BUS_RESTRICT_CFG=3, which makes it
     possible to enumerate downstream devices on Intel Arrow Lake-HX
     systems and probably others (Ali Alaei)

   - Pay attention to _OSC negotiation for VMD hierarchy only when
     running on bare metal, not when running in a VM (Nirmal Patel)

   - Add Nova Lake (NVL) and Dunlow (DNL) Device IDs (Szymon Durawa)

  MediaTek PCIe controller driver:

   - Add support for PCIe controller in EcoNet EN7528 and EN751221 SoCs
     (Caleb James DeLisle)

  MediaTek PCIe Gen3 controller driver:

   - Add mediatek-gen3 'memory-region' for restricted DMA buffer
     (Chen-Yu Tsai)

  NVIDIA Tegra264 PCIe controller driver:

   - Distinguish Tegra264 C0 PCIe controller for internal GPU from C1-C5
     controllers so the unit address matches the first 'reg' entry
     (Thierry Reding)

   - Add Tegra264 Root Port stanzas to prepare for generic WAKE#
     handling (Thierry Reding)

  Qualcomm PCIe controller driver:

   - Add IPQ9650 compatible with global interrupt (Kathiravan
     Thirumoorthy)

   - Add IPQ5210 compatible with IPQ9574 fallback (Varadarajan
     Narayanan)

   - Add DT binding and driver support for Hawi SoC (Matthew Leung)

   - Skip PERST# GPIOs provided by downstream PCIe devices, which should
     be handled by drivers of those devices (Manivannan Sadhasivam)

   - Stop advertising Attention Button Present (no Qcom SoCs support
     Attention Buttons) so pciehp can use Presence Detect Changed events
     (Qiang Yu)

  Renesas R-Car PCIe controller driver:

   - Add rcar-gen4-pci-host optional 'msi-parent' for GIT ITS (Marek
     Vasut)

   - When MSI is enabled but iMSI-RX is not used, configure AXIINTC to
     allow GIT ITS to handle MSI (Marek Vasut)

   - Refactor GIC600 implementation to make it easier to add platforms
     that only support 32-bit addressing (Marek Vasut)

   - Add Renesas R-Car Gen4 S4/V4H/V4M to the list of GIC600
     integrations that only support 32-bit addressing (Marek Vasut)

  Renesas RZ/G3S PCIe controller driver:

   - Add DT binding and driver support for RZ/V2H(P) SoC, which contains
     two PCIe controllers, configured either as a single x4 link or two
     independent x2 link controllers (Lad Prabhakar)

  SpacemiT K1 PCIe controller driver:

   - Add missing MODULE_DEVICE_TABLE() to generate module alias info for
     OF-based module autoloading (Pengpeng Hou)

  StarFive PCIe controller driver:

   - Fix resource leaks on error paths in host_init() (Ali Tariq)

   - Fix runtime PM handling and teardown ordering to avoid register
     access while power or clocks are disabled (Ali Tariq)

   - Check for runtime PM resume failure to avoid register access while
     power or clocks are disabled (Ali Tariq)

  Synopsys DesignWare PCIe controller driver:

   - Add LECARC PMU IDs to the DWC RAS/DES VSEC list so it can take
     advantage of the existing debugfs support for silicon debug, error
     injection, and event counters (Brett Zhou)

   - Factor pcie_valid_speed() and pci_bus_speed2lnkctl2() out of bwctrl
     so they can be shared by the DWC core (Hans Zhang)

   - Flush MSI writes from endpoint before unmapping the iATU, as we
     already do for MSI-X writes (Niklas Cassel)

   - Unmap MSI iATU window before mapping MSI-X window, to avoid a
     subsequent MSI write using a disabled aperture and losing the
     interrupt (Niklas Cassel)

   - Change endpoint .pre_init() and .init() callbacks to return errors
     and handle them (Marek Vasut)

  UltraRISC PCIe controller driver:

   - Add 'core', 'dbi', and 'aux' clocks to DT binding and manage them
     in the driver (Jia Wang)

   - Use module_platform_driver() since this may be built as a module,
     though not removable because IRQs can't be safely disposed (Jia
     Wang)

  MicroSemi Switchtec management driver:

   - Add Microchip PCI1008 device ID and include it in NTB DMA alias
     quirk (Logan Gunthorpe)

  Miscellaneous:

   - Document how to write PCI Host Controller drivers (Manivannan
     Sadhasivam)

   - Fix typos in documentation (D'Orus Tsitera)

   - Use %pe format specifier to print error pointers so we get symbolic
     errname when available (Krzysztof Wilczyński)"

* tag 'pci-v7.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (124 commits)
  PCI: vmd: Add Nova Lake (NVL) and Dunlow (DNL) Device IDs
  PCI: tegra264: Add Tegra264 support
  dt-bindings: PCI: tegra264: Switch to PCIe Root Port bindings
  dt-bindings: PCI: tegra264: Strictly distinguish C0 from C1-C5
  PCI/AER: Support Advisory Non-Fatal Errors
  PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk
  PCI: dwc: Handle return value from endpoint .pre_init callback
  PCI: dwc: Handle return value from endpoint .init callback
  PCI: dwc: Add PCI ID for LECARC PCIe PMU
  PCI/ASPM: Mask ASPM states based on Devicetree properties
  PCI/ASPM: Disable/restore ASPM on every function for multi-function devices
  Documentation: PCI: Document how to write PCI Host Controller drivers
  PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restore
  PCI: Add support for PCIe WAKE# interrupt
  PCI: Allow D3 for native hotplug-capable Root Ports on non-x86 platforms
  dt-bindings: PCI: Correct white-space style
  PCI/ASPM: Avoid L0s for Realtek RTS525A
  PCI: ultrarisc: Use module_platform_driver()
  PCI: ultrarisc: Get and enable DP1000 PCIe controller clocks
  dt-bindings: PCI: ultrarisc: Add required DP1000 PCIe clocks
  ...
2026-08-23 12:44:10 -07:00
Bjorn Helgaas 4fe60541de Merge branch 'pci/controller/root-port-reset'
* pci/controller/root-port-reset:
  misc: pci_endpoint_test: Add AER error handlers
  PCI: dw-rockchip: Implement .reset_root_port() and use for link down
  PCI: qcom: Implement .reset_root_port() and use for link down
  PCI: host-common: Add link down handling for Root Ports
  PCI/ERR: Add support for resetting the Root Ports in a platform-specific way
  PCI: dwc: ep: Clear MSI iATU mapping in dw_pcie_ep_cleanup()
2026-08-21 16:40:40 -05:00
Linus Torvalds f96718fc1f Merge tag 'mmc-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc
Pull MMC updates from Ulf Hansson:
 "MMC core:
   - Reject invalid perdev_minors for the block device before division
   - Document DT fixed-layout NVMEM provider support for eMMC cards

  MMC host:
   - Convert a couple of plain text DT bindings to the yaml format
   - bcm2835: DMA mapping improvements
   - cqhci: Fix sparse warnings for endian conversions
   - dw_mmc: Stop and complete DMA also in busy state
   - dw_mmc-rockchip: Add support for the RV1106 variant
   - litex_mmc: Add dynamic bus width support
   - moxart: Propagate error for DMA completion timeout
   - pxamci: Remove PXA remnants for the PXA93x support
   - rtsx_usb_sdmmc: Avoid USB I/O in runtime autosuspend
   - rtsx_usb_sdmmc: Suppress false CD after init timeout
   - sdhci_am654: Add Judith Mendez as maintainer
   - sdhci-esdhc-mcf: Do not use readl()/writel() on ColdFire
   - sdhci-msm: Extend the DT bindings for ICE
   - sdhci-tegra: Add support for Tegra264/Tegra238 variants
   - sunxi: Add support for the Allwinner A733 variant
   - via-sdmmc: Clean up card detect work at remove and in probe error path"

* tag 'mmc-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (35 commits)
  ARM: PXA: Fix build error for PXA93x
  dt-bindings: mmc: sunxi: add compatible string for Allwinner A733 MMC0/1/2
  dt-bindings: mmc: Document fixed-layout NVMEM provider support
  mmc: sdhci-tegra: Add Tegra264 SoC data
  dt-bindings: mmc: tegra: Document Tegra264 SDHCI
  mmc: sdhci-tegra: Add Tegra238 SoC data
  dt-bindings: mmc: tegra: Document Tegra238 SDHCI
  mmc: omap_hsmmc: use platform_get_irq_optional for wake IRQ
  mmc: via-sdmmc: cancel card-detect work on remove
  mmc: via-sdmmc: stop card-detect handling on probe failure
  mmc: moxart: use platform helpers for resource and IRQ
  mmc: host: Remove redundant dev_err()/dev_err_probe()
  mmc: bcm2835: DMA mapping improvements
  mmc: dw_mmc: move declaration of dw_mci_pmops
  dt-bindings: mmc: rockchip-dw-mshc: Add RV1106 compatible
  mmc: rtsx_usb_sdmmc: suppress false CD after init timeout
  misc: rtsx_usb: avoid USB I/O in runtime autosuspend
  mmc: sdhci-of-dwcmshc: Log eMMC reset calls
  mmc: block: reject invalid perdev_minors before division
  mmc: sdhci-of-ma35d1: add missing MODULE_DEVICE_TABLE()
  ...
2026-08-21 11:58:08 -07:00
Linus Torvalds ed3b875bea Merge tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull MM updates from Andrew Morton:

 - "mm: drop "sub" prefix from various places" (Dev Jain)

   page->folio conversion and a naming cleanup

 - "mm/kasan: remove redundant initialization for kasan_flag_write_only"
   (Igor Putko)

   KASAN cleanup work

 - "mm/filemap: reduce unnecessary xarray lookups" (Chi Zhiling)

   Small speedup in the pagecaache read code

 - "mm/percpu: Fix possible NOFS/NOIO reclaim recursion" (Kaitao Cheng)

   Improve the vmalloc code - mainly the avoidance of GFP_KERNEL
   allocations when the caller asked for GFP_NOFS or GFP_NOIO

 - "mm/kmemleak: avoid soft lockup when scanning task stacks" (Breno
   Leitao)

   Avoid a soft lockup watchdog trigger from the kmemleak scanning code
   in extreme situations

 - "mm/page_owner: misc cleanups" (Ye Liu)

   Cleanups to the page_owner code. For some reason lots of people have
   been working on the page_owner code this cycle.

 - "mm: convert to walk_page_range_vma() to eliminate find_vma()"
   (Kefeng Wang)

   Simplify and accelerate the page walking library function

 - "mm/migrate: preparatory cleanups for batch copy and offload"
   (Shivank Garg)

   Cleanups in the migration code

 - "mm/page_owner: add per-fd filter infrastructure for print_mode and
   NUMA filtering" (Zhen Ni)

   Per-fd filtering to page_owner in order to reduce the sometimes vast
   amount of output it can produce

 - "mm: Refactor bootmem gigantic hugepage allocation" (Muchun Song)

   Fixes and preparatory cleanups around bootmem HugeTLB handling,
   sparse initialization ordering, and related vmemmap setup

 - "mm/zsmalloc: reduce lock contention in zs_free()" (Wenchao Hao)

   Reduce lock contention in zs_free(), which dominates the unmap path
   under memory pressure on Android (LMK kills) and on x86 servers
   running zswap-heavy workloads.

   Up to 1.83x improvement in microbenchmarking.

 - "move alloc_tag.c file under mm/" (Suren Baghdasaryan)

 - "samples/damon: handle damon_{start,stop}() failures" (SJ Park)

   Fix improper handling of damon_start(), damon_stop(), and
   damon_call() failures across DAMON sample modules to prevent
   potential memory leaks, operation disruptions and use-after-free
   bugs

 - "mm/damon/sysfs: kobject_del() directories that users can
   create/remove" (SJ Park)

   Fix delayed sysfs directory removal under DEBUG_KOBJECT_RELEASE
   causeing creation failures due to duplicate directory names by adding
   missing kobject_del() calls before creating new directories

 - "mm: cleanup clear_not_present_full_ptes()" (David Hildenbrand)

   Clean up the core pte handling code

 - "selftests/damon: misc fixes for test bugs" (Kunwu Chan)

   Fix several bugs in the DAMON selftests

 - "selftests/damon: fix memcg_path staging handling" (Cheng Nie)

   Fix a bug in _damon_sysfs.py for damos_filter memcg_path setup, and
   add a test case for it in sysfs.py.

 - "selftests/damon: test kdamond refresh_ms" (Ruslan Valiyev)

   Selftest coverage for DAMON's refresh_ms sysfs feature by updating
   the test control module and verifying that scheme stats update
   automatically without manual intervention

 - "mm/damon: five misc fixups" (Akinobu Mita)

   Miscellaneous DAMON fixups.

 - "mm/damon/core: detect internal variation above max_nr_regions/2"
   (Jiayuan Chen)

   Fix DAMON's region splitting behavior when region counts exceed half
   the maximum budget by dynamically scaling down the split fraction as
   the limit approaches, preventing large regions from staying un-split,
   and add corresponding KUnit test coverage

 - "mm: preparatory patches for PMD level swap entries" (Usama Arif)

   Refactor and clean up PMD softleaf helpers, call sites, and
   architecture flags to lay the groundwork for a follow-up series that
   introduces PMD page table swap entries

 - "mm/damon: update, optimize, and clean up doc, tests, and code" (SJ
   Park)

   Update DAMON design and ABI documentation, expands unit and selftest
   coverage, optimize damon_commit_target_regions(), and clean up
   recently added sysfs interface code for better readability

 - "mm/vmpressure: reduce CPU, memory and code overhead on cgroup v2"
   (Usama Arif)

   Optimize vmpressure() by skipping unnecessary work on cgroup v2 for
   userspace event notifications and refactor v1-only eventfd handling
   into mm/memcontrol-v1.c to reduce memory overhead and code complexity

 - "selftests/mm: refactor pkey helpers and fix mmap error handling"
   (Hongfu Li)

   Refactor pkeys shared tracing and assertion helpers into a common
   file, unify protection key selftests to use consistent diagnostic
   logging and assertions, and enforce standardized MAP_FAILED return
   checks for mmap() calls across the tests

 - "mm/damon: optimize out nr_accesses_bp" (SJ Park)

   Replace the error-prone, continuously updated nr_accesses_bp field in
   damon_region with an on-demand moving sum function, reducing
   structure memory overhead and avoiding state corruption bugs

 - "Open HugeTLB allocation routine for more generic use" (Ackerley Tng)

   Decouple HugeTLB folio allocation from VMA dependencies by
   introducing hugetlb_alloc_folio(), enabling subsystems like
   guest_memfd to allocate HugeTLB folios without standard VMA
   reservations or pseudo-VMAs

 - "mm/damon: provide pseudo moving sum probe_hits" (SJ Park)

   Integrate DAMON's probe_hits attribute counter into the pseudo moving
   sum infrastructure, enabling real-time, online monitoring without
   waiting for full aggregation intervals

 - "mm: Some cleanups for page allocator APIs" (Brendan Jackman)

   Simplify and refactor the page allocator entry points and flags by
   unifying allocation paths, adding internal alloc_flags arguments, and
   eliminating redundant __ prefixed alloc_pages variants.

 - "Fix incorrect access of hugetlb pte entries" (Dev Jain)

   Enforce the consistent use of huge_ptep_get() instead of ptep_get()
   for HugeTLB entries and fixes an unaligned address issue in arm64's
   huge_ptep_get() implementation

 - "mm/damon: validate all parameters in the core" (SJ Park)

   Consolidate parameter validation into the DAMON core specifically
   within damon_start() and damon_commit_ctx() to centralize error
   checking, eliminate caller-side redundant checks and to improve
   maintenance efficiency

 - "tools/mm/page_owner_sort: fix filtering and cleanup issues" (Yichong
   Chen)

   Rename is_need() to filter_record() for clearer return semantics, fix
   per-record allocation memory leaks and bound output copies in
   search_pattern() to address an existing buffer issue

 - "memcg: bail out reclaim when memcg is dying" (Jiayuan Chen)

   Mitigate a system-wide stall which occurs when a cgroup is removed
   while one of its memory control files is doing synchronous reclaim

 - "mm/memory-failure: add panic option for unrecoverable pages" (Breno
   Leitao)

   Introduce an opt-in vm.panic_on_unrecoverable_memory_failure sysctl
   that immediately panics the kernel on unrecoverable memory errors in
   kernel-owned pages to preserve error context and prevent delayed,
   silent data corruption

 - "mm/damon: refactor damon_{start,stop,commit}() for simple error
   handling" (SJ Park)

   Refactor the DAMON core API functions to guarantee that all contexts
   are fully stopped when damon_start(), damon_stop(), or damon_commit()
   fail, eliminating the need for complex and error-prone caller-side
   cleanup code

 - "Keep tail page private zero at free and folio split" (Zi Yan)

   Add checks to ensure tail_page->private is zero when freeing compound
   or high-order pages and when promoting tail pages during large folio
   splits. By validating these fields at free and split time, it allows
   the removal of redundant private field clearing inside
   prep_compound_tail()

 - "mm: drop redundant lru_add_drain in anon folio reuse paths" (Barry
   Song)

   Eliminate redundant lru_add_drain() calls in
   wp_can_reuse_anon_folio() and do_swap_page() to reduce LRU lock
   contention and system overhead

   By validating folio refcounts against the LRU cache before draining
   and removing unnecessary drains in the swap path, it achieves up to a
   30.5% reduction in drain calls during heavy swap workloads

 - "mm: clean up folio LRU and swap declarations" (Jianyue Wu)

   Reorganize folio LRU and swap code by relocating page-cluster state
   to mm/swap_state.c, renaming mm/swap.c to mm/folio.c, and moving
   MM-internal reclaim declarations into mm/internal.h.

 - "userfaultfd: working set tracking for VM guest memory" (Kiryl
   Shutsemau)

   Add userfaultfd support for tracking the working set of VM guest
   memory, so a VMM can identify hot pages and reclaim cold ones to
   tiered or remote storage

 - "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part 2)" (David
   Hildenbrand)

   Remove the remaining pieces of CONFIG_HAVE_BOOTMEM_INFO_NODE,
   performing some smaller cleanups around freeing of reserved vmemmap
   pages on the way.

 - "mm/damon: update probe hits for runtime parameter commits" (SJ Park)

   Ensure that DAMON's probe_hits attribute counter is properly updated
   when monitoring intervals are changed at runtime, matching the
   behavior of nr_accesses. To achieve this, it refactors and renames
   existing helper functions for shared use, applies the updates to
   probe_hits, and handles edge cases in damon_probe_hits_mvsum() to
   maintain measurement accuracy.

 - "KSM: performance optimizations for rmap_walk_ksm" (xu xin)

   Resolve a severe KSM reverse-mapping performance bottleneck where
   thousands of split VMAs sharing a single anon_vma cause extended lock
   contention.

   By adding an interval-filtering check during the rmap walk, it
   reduces worst-case anon_vma lock hold times from over 500ms down to
   under 2ms, preventing application freezes and latency spikes under
   memory pressure.

 - "mm: split a couple of headers from internal.h" (Mike Rapoport)

   Split declarations related to mm_init, memblock, vmalloc and sparse
   into new headers

 - "KSM: use linear_page_index in collect_procs_ksm()" (xu xin)

   Apply the interval tree optimization from rmap_walk_ksm() to
   collect_procs_ksm() to avoid iterating over non-matching VMAs during
   KSM memory error handling.

   It hoists loop-invariant address initialization and restricts the
   anon_vma_interval_tree_foreach walk to a targeted page offset range,
   reducing redundant checks and improving lookup efficiency.

 - "selftests/mm: avoid false failures in hugetlb and KSM tests" (Sayali
   Patil)

   Fix issues in the hugetlb and KSM MM selftest categories that can
   report failures when the prerequisites for the tests are not
   satisfied

 - "mm/damon: introduce data attributes only monitoring" (SJ Park)

   Introduce attribute-weighted region management in DAMON, allowing
   users to prioritize specific data attributes (such as page sizes or
   cgroups) over or instead of access monitoring.

   By assigning weights to attribute probes, DAMON can completely
   disable access tracking and adjust monitoring regions based on
   weighted probe-hit counters to optimize monitoring quality for
   attribute-focused workloads.

 - "mm/hmm: Add mmap lock-drop support for userfaultfd-backed mappings"
   (Stanislav Kinsburskii)

   Extend hmm_range_fault() to support userfaultfd-backed regions by
   allowing the mmap lock to be dropped during fault handling via a new
   hmm_range_fault_locked() helper.

   By accepting a locked pointer and signaling retry status when lock
   release occurs, it enables page fault resolution in userfaultfd
   regions while preserving backward compatibility for existing callers.

 - "mm: make VMA page offset handling more consistent" (Lorenzo Stoakes)

   Clean up and standardize how vma->vm_pgoff is accessed and
   manipulated across file-backed and anonymous mappings in the kernel

   It introduces dedicated helper functions such as vma_start_pgoff(),
   vma_end_pgoff(), vma_set_pgoff() and linear_page_delta() while
   renaming rmap interval tree helpers to better reflect their
   functionality.

   These changes establish a cleaner foundation for future work that
   will unify virtual page offset indexing for all anonymous and CoW'd
   folios.

 - "mm: handle device-private PMDs in walk callbacks" (Usama Arif)

   Address kernel panics and state corruption caused by MM walk
   callbacks reaching non-present device-private PMD swap entries
   created during HMM migrations

   It ensures that functions which acquire pmd_trans_huge_lock()
   properly recognize device-private PMDs instead of assuming a present
   THP or a standard migration entry.

 - "mm/rmap: Refactor try_to_unmap_one" (Dev Jain)

   Refactor try_to_unmap_one by modularizing Hugetlb,
   anonymous-lazyfree, and anonymous-swapbacked logic into dedicated
   functions, laying the structural groundwork for batched anonymous
   large folio unmapping.

 - "Docs/ABI/damon: sysfs ABI document fixes and additions" (Song Hu)

   Fix typos and fills in missing entries in the DAMON sysfs ABI
   document

 - "dax/kmem: atomic whole-device hotplug via sysfs" (Gregory Price)

   Introduce an atomic sysfs state attribute and supporting DAX/MM
   infrastructure to prevent userland races when offlining and removing
   entire memory regions

   By adding an unplugged state alongside standard online modes, it
   enables whole-device atomic hotplug control while preserving backward
   compatibility.

 - "mm: convert more vm_flags_t users to vma_flags_t" (Lorenzo Stoakes)

   Continue transitioning the kernel from the deprecated vm_flags_t type
   to vma_flags_t across core memory management infrastructure.

   It replaces legacy type usage in core functions such as do_mmap(),
   unmapped area allocation, mm->def_vma_flags, and VMA operations like
   mlock, mprotect, and mremap.

 - "Two small patches to clean up mm/mm_slot.h" (xu xin)

   Refactor mm_slot.h by introducing mm_slot_remove() to unify duplicate
   slot deletion sequences in khugepaged and KSM. It also adds code
   documentation explaining why mm_slot_lookup and mm_slot_insert must
   remain as preprocessor macros rather than static inline functions.

 - "mm/damon/core: hide core-private struct fields" (SJ Park)

   Clean up DAMON core structures by consistently marking internal-only
   fields with private: comment tags to prevent improper direct access
   from outer layers.

   It enforces encapsulation across core structures including
   damon_region, damon_target, and damon_ctx and updates DAMON_SYSFS to
   interact through approved access APIs instead of exposing raw struct
   members.

 - "mm/damon: unurgent fixes for infinite loop, NULL de-ref and races"
   (SJ Park)

   Address potential infinite loops, NULL dereferences, and race
   conditions identified in DAMON

   It fixes an infinite loop triggered by extreme user configurations, a
   NULL pointer dereference within unit tests and minor monitoring
   accuracy degradation caused by subtle runtime races.

 - "mm/page_alloc: fixes for free_pages_nolock() on RT/UP" (Brendan
   Jackman)

   Fix an NMI safety flaw in __free_frozen_pages() where freeing pages
   on non-SMP or PREEMPT_RT kernels can bypass can_spin_trylock() checks
   via non-PCP or isolated migration paths.

   It also resolves potential kernel crashes and privilege escalation
   risks triggered when BPF tracing runs in NMI context alongside memory
   hotplug or large allocation frees.

 - "mm/page_alloc: couple of followups for recent cleanups" (Brendan
   Jackman)

   Clean up and update page allocator nomenclature, documentation, and
   debug assertions.

   It aligns internal FPI_ flags with the public "nolock" naming
   convention, removes outdated internal implementation details from
   high-level page allocator comments, and eliminates obsolete
   VM_BUG_ON() assertions in allocation paths.

 - "mm/mseal: further cleanups" (Lorenzo Stoakes)

   Refactor and simplify the mseal implementation by clarifying API
   boundaries and removing unnecessary code complexity.

   It replaces generic do_mseal() usage outside the syscall with a
   dedicated mseal_mmap_page_zero() helper for MMAP_PAGE_ZERO,
   eliminates mm_struct parameters to enforce that sealing applies only
   to current->mm, and streamlines overall logic and comments with no
   functional changes intended.

 - "mm/vmscan: fix swappiness=max and clean up per-node proactive
   reclaim" (Ridong Chen)

   Resolve reclaim behavior bugs and clean up function parameters across
   memory reclaim paths

   It fixes swappiness=max in both standard reclaim and MGLRU so
   unswappable anonymous memory no longer falls back to evicting page
   cache, ensures reclaim_store() returns accurate error codes instead
   of collapsing all failures into -EAGAIN, and removes the obsolete
   gfp_mask parameter from __node_reclaim().

 - "mm: mincore: misc cleanups" (Kefeng Wang)

   Clean up and simplifies the mincore code. Most importantly, it
   removes the historical special behavior that always reports VM_PFNMAP
   pages as non-resident.

 - "mm/huge_memory: drop dead split helper variants" (Kiryl Shutsemau)

   Two trivial cleanups in the folio split API

 - "mm/damon: fix uninitialized DAMOS field and kunit exec expectation
   bugs" (SJ Park)

   Resolve minor operational and testing bugs in DAMON identified by
   Sashiko. It initializes the damos->last_applied field to prevent
   occasional efficiency degradation and fixes invalid memory accesses
   in DAMON KUnit tests during test failure handling.

 - "cleanup for stable_page_flags()" (Jinjiang Tu)

   Clean up and refactor stable_page_flags() used by /proc/kpageflags
   without altering functionality.

   It uses BIT_ULL() to prevent shift-overflow warnings on 64-bit flag
   bits, converts folio-specific flag checks to standard folio_test_*()
   helpers, and removes redundant CONFIG_PAGE_IDLE_FLAG handling.

 - "Batch unmap of uffd-wp file folios" (Dev Jain)

   Extend batched folio unmapping support to file folios within
   userfaultfd write-protect (uffd-wp) VMAs by adding batching
   capabilities to pte_install_uffd_wp_if_needed().

   This removes special-case restrictions on uffd-wp VMAs in
   try_to_unmap_one(), significantly simplifying the function's control
   flow and complexity.

 - "mm/early_ioremap: clarify and clean up early_ioremap_reset()"
   (Sang-Heon Jeon)

   Clarify and clean up the architecture-specific usage of
   __late_set_fixmap() and __late_clear_fixmap() after
   early_ioremap_reset()

   It adds explicit documentation regarding when early_ioremap_reset()
   must be called and removes redundant macro definitions and reset
   calls in the RISC-V and ARM64 architectures.

 - "mm: fix reclaim storms in defrag_mode" (Johannes Weiner)

   Address severe performance regressions, swap storms, and spurious
   OOMs caused by vm.defrag_mode=1 under high memory pressure in Meta
   production

   It updates the page allocator slowpath so non-movable allocation
   requests actively trigger direct reclaim and direct compaction at
   pageblock_order scale, allowing them to claim whole pageblocks rather
   than spinning unproductively.

 - "zram: lockmap tweaks" (Sebastian Siewior)

   Optimize and fix lockdep tracking for zram devices by consolidating
   per-entry lockmaps and isolate lock classes across multiple instances

   This reduces memory overhead by replacing per-entry lockdep_map
   instances with a single map per struct zram, and assigns a dynamic
   lock_class_key to each instance to prevent false deadlock reports
   when different zram devices are backed by distinct filesystems.

* tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (501 commits)
  selftests/mm: thuge-gen: fix test_shmget() for PAGE_SIZE check
  selftests/mm: unpoison pages in memory-failure teardown
  mm/shmem: downgrade final i_blocks check in shmem_evict_inode() to pr_warn()
  mm/khugepaged: replace mutex_lock/mutex_unlock usage with guard macro
  mm/zsmalloc: fix release order of locks in zs_page_migrate()
  Documentation: zram: remove sections numbering
  ksm: stop iterating VMAs when ksm_test_exit returns true
  mm: fold userfaultfd_rwp() to false without CONFIG_ARCH_HAS_PTE_PROTNONE
  mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
  zram: use a custom key for each zram object
  zram: move lockmap to be per-zram instead per table
  selftests/mm: fix gup_longterm EINVAL error message
  mm: page_alloc: fix non-movable reclaim storm in defrag_mode
  mm: page_alloc: move capture_control to the page allocator
  mm: compaction: support non-movable compaction for pageblock requests
  mm: page_alloc: __GFP_FS lockdep annotation for direct compaction
  hugetlb: evaluate subpool free state while locked
  mm/damon: remove trailing semicolons after function definitions
  mm/damon/ops-common: prevent migration fallback to non-target nodes
  mm/damon: update outdated comment about DAMOS filter handling
  ...
2026-08-20 18:17:08 -07:00
Dimitri Sivanich 85de4712bc misc: sgi-gru: Remove SGI GRU driver
Due to security concerns, remove the SGI GRU driver, which cannot be used
on anything newer than the long time unsupported UV2 platform.

Signed-off-by: Dimitri Sivanich <sivanich@hpe.com>
Acked-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Acked-By: Robin Holt <robinmholt@gmail.com>
Acked-by: Steve Wahl <steve.wahl@hpe.com>
Link: https://patch.msgid.link/amyzGw1-MVLpNH-d@hpe.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-06 11:14:24 +02:00
Dimitri Sivanich dbf69afe32 misc: sgi-xp: Remove SGI XP drivers
Working XP drivers require the GRU driver.  The GRU driver is being
removed, so remove XP as well.

Signed-off-by: Dimitri Sivanich <sivanich@hpe.com>
Acked-by: Robin Holt <robinmholt@gmail.com>
Acked-by: Steve Wahl <steve.wahl@hpe.com>
Link: https://patch.msgid.link/amyxgPYeowzWt_8W@hpe.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-06 11:12:56 +02:00
Mingyu Wang c20800490f misc: ibmasm: Remove obsolete IBM Remote Supervisor Adapter driver
The IBM Remote Supervisor Adapter (RSA) and RSA II were out-of-band
management PCI/ISA cards introduced in the early 2000s for ancient
IBM eServer xSeries machines. IBM deprecated the RSA family and
replaced it with the Integrated Management Module (IMM) around 2008.
IBM subsequently sold its x86 server business to Lenovo in 2014, and
modern systems use entirely different BMC architectures.

This hardware has been completely obsolete and out of production for
over 15 years. Surviving physical servers using this specific hardware
would be running ancient 32-bit processors vastly unsuited for modern
kernels.

A review of the recent git history shows that aside from mechanical
treewide VFS API updates, the only recent activities are out-of-bounds
fixes in command_file_write and MFA handling. These fixes address
userspace-triggered security vulnerabilities and fuzzer-discovered
MMIO bugs rather than functional issues reported by active hardware users.

Keeping this obsolete driver in the tree leaves an unnecessary attack
surface and acts as a "fuzzing honeypot", forcing core maintainers to
endlessly review CVEs and OOB fixes for dead hardware, while also paying
a maintenance tax to drag it through modern API refactorings.

Remove the driver entirely.

Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Link: https://patch.msgid.link/20260801070756.161698-1-25181214217@stu.xidian.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-06 11:12:07 +02:00
Manivannan Sadhasivam 29e179cb7f misc: pci_endpoint_test: Add AER error handlers
The Endpoint test driver doesn't need to do anything fancy in its error
handlers; just restore the config space that was saved during probe and
report the correct result. This helps in making sure that the AER recovery
succeeds.

Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260729-pci-port-reset-v9-5-53570b92064d@oss.qualcomm.com
2026-08-04 16:34:15 -05:00
Niklas Cassel 0a6f72eda3 misc: pci_endpoint_test: Fail doorbell test when the trigger IRQ is missed
The doorbell test case was observed to pass even when the Endpoint had
clearly failed to handle the doorbell trigger.

  pci-endpoint-test 0000:01:00.0: Failed to trigger doorbell in endpoint
  ok 23 pcie_ep_doorbell.DOORBELL_TEST

The root cause turned out to be a buggy EPC driver that raised two IRQs
in response to a single ENABLE DOORBELL command. The extra IRQ left
test->irq_raised.done at a non zero value, so the next
wait_for_completion_timeout() after the writel() that rings the
doorbell returned immediately, before the Endpoint had set
STATUS_DOORBELL_SUCCESS and raised the IRQ that belongs to that write.

The status readback that followed therefore did not yet reflect the
doorbell trigger, and the test logged the failure but did not fail the
test case. Later on, after the doorbell was disabled, the status was
read again and STATUS_DOORBELL_SUCCESS had by then been set by the
Endpoint for the earlier trigger. The final check saw the bit set and
reported the test as passed.

Make the trigger step actually fail the test case when it detects a
problem. Record the failure in a local variable, keep going so that
the doorbell is still disabled and the Endpoint is left in a clean
state, and return the stored error at the end. The disable path still
returns its own error immediately when its wait times out, which is
unchanged.

Signed-off-by: Niklas Cassel <cassel@kernel.org>
[mani: change log]
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Link: https://patch.msgid.link/20260730122045.1382749-6-cassel@kernel.org
2026-08-03 18:27:03 +02:00
Niklas Cassel 37ddcce690 misc: pci_endpoint_test: Check SUCCESS bit for doorbell status
The pci-epf driver sets STATUS_DOORBELL_ENABLE_SUCCESS as the final step of
pci_epf_test_enable_doorbell(), and STATUS_DOORBELL_DISABLE_SUCCESS as the
final step of pci_epf_test_disable_doorbell(). A missing SUCCESS bit
therefore unambiguously means that the operation did not complete, whereas
the FAIL bit is only set on an explicit failure path.

The host side test in pci_endpoint_test_doorbell() currently keys off
the FAIL bit. That covers explicit failures but misses two cases.

The first case is when the wait for the completion IRQ times out. No IRQ
arrives, the Endpoint never updates STATUS, and neither SUCCESS nor FAIL
is set. The enable path already handles this correctly because it also
fails when the wait times out without an IRQ. The disable path does not
have that extra guard and would wrongly treat the timeout as success.

The second is a buggy EPC that raises two IRQs in response to a single
DOORBELL_ENABLE command. The second wait_for_completion_timeout()
returns immediately with 'left' non zero, but the endpoint has not yet
written STATUS, so SUCCESS is clear and FAIL is also clear. The current
FAIL only check treats this as success.

So check the SUCCESS bit instead. That matches the Endpoint's contract
because SUCCESS is the last write on the success path, and it correctly
reports failure for both timeouts and the spurious IRQ case without
relying on the FAIL bit being set.

Fixes: eefb83790a ("misc: pci_endpoint_test: Add doorbell test case")
Signed-off-by: Niklas Cassel <cassel@kernel.org>
[mani: commit log]
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Link: https://patch.msgid.link/20260730122045.1382749-5-cassel@kernel.org
2026-08-03 18:19:10 +02:00
Linmao Li 220190f97d misc: issei: check bus message length before reading the command
__issei_ham_process_ham_rsp() dispatches on hdr->cmd before the message
length is validated. The length comes from the firmware-owned DMA header
read in issei_dma_read(), which only bounds it from above, so firmware
sending a short bus message reaches the dispatch with less than
sizeof(struct ham_bus_message) bytes available.

For a zero-length message kmemdup() returns ZERO_SIZE_PTR, which passes
the NULL check in issei_dma_read(), and the dispatch dereferences it. A
length of one to three bytes gives a slab out-of-bounds read instead.

Reject bus messages shorter than the header before touching it, the way
the individual response handlers already validate their own length.

Fixes: 7bd4b9991d ("issei: implement main thread and ham messages")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Link: https://patch.msgid.link/20260731025952.3505287-1-lilinmao@kylinos.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:27:46 +02:00
Hongyan Xu 9bcb5dbf0d misc: hisi_hikey_usb: remove untested role-switch driver
During review of a lifetime fix for this driver, it turned out that the
role-switch path has no upstream DT binding or in-tree user and has not
been tested in years.

Rather than keep carrying and fixing an effectively unused board-specific
driver, remove it. If this functionality is needed again later, it can be
reintroduced in drivers/phy/, where USB role-switch support lives today.

Link: https://lore.kernel.org/r/20260728065558.1532-1-getshell@seu.edu.cn
Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
Link: https://patch.msgid.link/20260729154523.1116-1-getshell@seu.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:26:48 +02:00
Nathan Chancellor 284497419a issei: Fix size_t printk specifier in heci_{write,read}_buf()
When building for 32-bit platforms, for which 'size_t' is
'unsigned int', there are a couple of warnings around incorrect printk
specifiers:

  In file included from drivers/misc/issei/hw_heci.c:7:
  drivers/misc/issei/hw_heci.c: In function 'heci_write_hbuf':
  drivers/misc/issei/hw_heci.c:374:37: error: format '%lu' expects argument of type 'long unsigned int', but argument 4 has type 'unsigned int' [-Werror=format=]
    374 |                 dev_err(&idev->dev, "Data size %zu not aligned to slot size %lu\n",
        |                                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  ...
  drivers/misc/issei/hw_heci.c:374:79: note: format string is defined here
    374 |                 dev_err(&idev->dev, "Data size %zu not aligned to slot size %lu\n",
        |                                                                             ~~^
        |                                                                               |
        |                                                                               long unsigned int
        |                                                                             %u
  drivers/misc/issei/hw_heci.c: In function 'heci_read_hbuf':
  drivers/misc/issei/hw_heci.c:404:37: error: format '%lu' expects argument of type 'long unsigned int', but argument 4 has type 'unsigned int' [-Werror=format=]
    404 |                 dev_err(&idev->dev, "Data size %zu not aligned to slot size %lu\n",
        |                                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  ...
  drivers/misc/issei/hw_heci.c:404:79: note: format string is defined here
    404 |                 dev_err(&idev->dev, "Data size %zu not aligned to slot size %lu\n",
        |                                                                             ~~^
        |                                                                               |
        |                                                                               long unsigned int
        |                                                                             %u
  cc1: all warnings being treated as errors

Use '%zu' for printing these values, the proper printk specifier for
'size_t'.

Fixes: 8bf5e84998 ("issei: add heci hardware module")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Alexander Usyskin <alexander.usyskin@intel.com>
Link: https://patch.msgid.link/20260721-issei-fix-size_t-specifier-v1-1-246155b42d48@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:21:26 +02:00
Uwe Kleine-König (The Capable Hub) f06bae4ddc misc: Unify code style for various *_device_id arrays
- Add a trailing comma for initializers unless the closing brace is on
   the same line and for the list terminator;
 - Use a single space in the list terminator;
 - A space after an opening { and before a closing };
 - Use the PCI_DEVICE* macro in two drivers for pci_device_id entry
   which is usual for these arrays
 - No explicit zeros in the list terminator;

None of these changes introduces changes to the compiled result.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Acked-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Link: https://patch.msgid.link/583653bc7b9ae19707bc28be69a20e66b8c3720a.1784299069.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:20:50 +02:00
Uwe Kleine-König (The Capable Hub) 6658673030 misc: Unify style of of_device_id arrays
Update the various of_device_id arrays to conform to the most used and
generally recommended coding style. That is:

 - No comma after the list terminator;
 - A comma after an initializer if (and only if) the closing } is not
   directly following;
 - No explicit zeros in the list terminator;
 - A space after an opening { and before a closing }, a single space in
   the list terminator;

Adapt the few offenders accordingly.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Reviewed-by: Romain Gantois <romain.gantois@bootlin.com>
Link: https://patch.msgid.link/fbf51b8f413c516977e2c8a81896221795df77e4.1784299069.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:20:50 +02:00
Uwe Kleine-König (The Capable Hub) 50b712469c misc: eeprom: idt_89hpesx: Unify style of of_device_id array
Update the of_device_id array to conform to the most used and generally
recommended coding style. That is:

 - No comma after the list terminator;
 - A comma after an initializer if (and only if) the closing } is not
   directly following;
 - No explicit zeros in the list terminator;
 - A space after an opening { and before a closing }, a single space in
   the list terminator;

Adapt the driver's array accordingly.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/2c35ea101e5eb28334137d9341a8b1e564102ae5.1784299069.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:20:50 +02:00
Uwe Kleine-König (The Capable Hub) a503587751 misc: ibmvmc: Use named initializers for vio_device_id array
While being less compact, using named initializers allows to more easily
see which members of the structs are assigned which value without having
to lookup the declaration of the struct. And it's also more robust
against changes to the struct definition.

While touching this array, also simplify the list terminator. This
change doesn't introduce differences to the compiled result.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/a451863ca59ab700b6e65b76a17a8b6eb1431e6b.1784299069.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:20:50 +02:00
Uwe Kleine-König (The Capable Hub) 14e8c32dbc misc: mei: Use named initializer for platform_device_id array
While being less compact, using named initializers allows to more easily
see which members of the structs are assigned which value without having
to lookup the declaration of the struct. And it's also more robust
against changes to the struct definition.

The mentioned robustness is relevant for a planned change to struct
platform_device_id that replaces .driver_data by an anonymous union (though
this driver doesn't use .driver_data, so this patch isn't strictly
necessary for the plan, but still ok for consistency).

This patch doesn't modify the compiled array, only its representation
in source form benefits.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/9c4a5a5b086d4ce913e84dfa7d140a8b492d557b.1784299069.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:20:50 +02:00
Uwe Kleine-König (The Capable Hub) 3cd092ac55 misc: mei: Use named initializers for acpi_device_id array
While being less compact, using named initializers allows to more easily
see which members of the structs are assigned which value without having
to lookup the declaration of the struct. And it's also more robust
against changes to the struct definition.

While touching this array, add a space to the list terminator to make it
match the most common usage.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/c189ce8aeae288e9d8bcdfff150957c6f3e6e37d.1784299069.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:20:50 +02:00
Uwe Kleine-König (The Capable Hub) 3e97a4e171 misc: Use named initializers for arrays of spi_device_data
While being less compact, using named initializers allows to more easily
see which members of the structs are assigned which value without having
to lookup the declaration of the struct. And it's also more robust
against changes to the struct definition.

The mentioned robustness is relevant for a planned change to struct
spi_device_id that replaces .driver_data by an anonymous union.

While touching all these arrays, unify usage of whitespace.

This patch doesn't modify the compiled arrays, only their representation
in source form benefits.

Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/ad1f0b3efcc3d9d362b33753734cfb064c079cd3.1784299069.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:20:50 +02:00
Uwe Kleine-König (The Capable Hub) a4fa3300f0 misc: Use named initializers for arrays of i2c_device_data
While being less compact, using named initializers allows to more easily
see which members of the structs are assigned which value without having
to lookup the declaration of the struct. And it's also more robust
against changes to the struct definition.

The mentioned robustness is relevant for a planned change to struct
i2c_device_id that replaces .driver_data by an anonymous union.

While touching all these arrays, unify usage of whitespace.

This patch doesn't modify the compiled arrays, only their representation
in source form benefits.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/5a4fb64166ab7e06adf94e5fa3d46bb5f6493324.1784299069.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:20:50 +02:00
Uwe Kleine-König (The Capable Hub) 230cb31dc3 misc: eeprom: Use named initializers for arrays of i2c_device_data
While being less compact, using named initializers allows to more easily
see which members of the structs are assigned which value without having
to lookup the declaration of the struct. And it's also more robust
against changes to the struct definition.

While touching all these arrays, unify usage of whitespace.

This patch doesn't modify the compiled arrays, only their representation
in source form benefits.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/e9ad2fe1d850ffd64eb053cb03395e7ca6f848dc.1784299069.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:20:50 +02:00
Uwe Kleine-König (The Capable Hub) f21139e60b misc: genwqe: Drop unused assignment of pci_device_id driver data
The driver explicitly sets the .driver_data member of struct
pci_device_id to zero without relying on that value. Drop this unused
assignment.

While touching this array, also convert it to use one of the PCI_DEVICE
macros that is usually used for these and drop the explicit 0 in the
list terminator. This patch doesn't modify the compiled array.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/0756a50095f65ada4b82a65a4f827bcd5f0e5d84.1784299069.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:20:50 +02:00
Uwe Kleine-König (The Capable Hub) 125e27168b misc/pvpanic: Drop unused assignment of acpi_device_id driver data
The driver explicitly sets the .driver_data member of struct
acpi_device_id to zero without relying on that value. Drop this unused
assignments.

While touching this array simplify the list terminator and use a named
initalizer.

This patch doesn't modify the compiled array, only its representation in
source form benefits.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/98f1fb885b797f8b3ccf24980d8036d67eb3966d.1784299069.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:20:50 +02:00
Uwe Kleine-König (The Capable Hub) 4eb0946caf misc: Drop unused assignment of spi_device_id driver data
The drivers don't make use of the values that were explicitly assigned
to the .driver_data members. Drop these assignments.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/e2ad3f93b358cc246a64a3d0a7c3f037b2201412.1784299069.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:20:49 +02:00
Muhammad Usama Anjum 48c7907d92 misc: sgi-gru: inline the user CBR status update
The process-context fault path always has a valid user CBR pointer. Inline
the one-use status helper and remove its obsolete NULL check.

No functional change.

Signed-off-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Link: https://patch.msgid.link/20260730111316.3672672-4-usama.anjum@arm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:15:54 +02:00
Muhammad Usama Anjum 7d58b218e7 misc: sgi-gru: remove obsolete atomic fault-handling state
After interrupt faults are sent directly to user polling mode, only the
process-context call path remains. Remove the atomic flag passed through
the fault-handling interfaces and the related dead code.

No functional change.

Signed-off-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Link: https://patch.msgid.link/20260730111316.3672672-3-usama.anjum@arm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:15:54 +02:00
Muhammad Usama Anjum 928a8e9f52 misc: sgi-gru: remove interrupt-context page-table walks
The GRU TLB miss handler walks a process's page tables without holding
page-table locks or a reference to the mapped page. It also uses a kernel
page-table accessor on user page tables and supports only PMD-level large
mappings on x86-64.

Remove the direct walker. Send interrupt faults directly to user polling
mode so the existing call-OS fallback retries them in process context.

Remove the mmap-lock failure statistic that can no longer be incremented.

Fixes: 142586409c ("GRU Driver: page faults & exceptions")
Signed-off-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Link: https://patch.msgid.link/20260730111316.3672672-2-usama.anjum@arm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:15:54 +02:00
Iván Ezequiel Rodriguez 61611481f7 ntsync: reject wait ioctls with zero owner
setup_wait() already validates pad and flags but not owner, while
Documentation/userspace-api/ntsync.rst requires EINVAL when owner is
zero. Reject early before queueing waiters.

Signed-off-by: Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com>
Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
Reviewed-by: Elizabeth Figura <zfigura@codeweavers.com>
Signed-off-by: Elizabeth Figura <zfigura@codeweavers.com>
Link: https://patch.msgid.link/20260723201301.11826-4-zfigura@codeweavers.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:15:54 +02:00
Abdun Nihaal 210854a96e misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe()
The memory allocated for struct vmci_subscription (sub) is not freed
in the error path when have_new_id is false. Fix that by adding a
kfree() call, and moving the read of sub->id to a point before freeing.

Fixes: 1d990201f9 ("VMCI: event handling implementation.")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Acked-by: Vishnu Dasa <vishnu.dasa@broadcom.com>
Link: https://patch.msgid.link/20260722101215.76680-1-nihaal@cse.iitm.ac.in
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:15:54 +02:00
Bartosz Golaszewski cf09b7a056 eeprom: move nvmem EEPROM drivers to drivers/nvmem/
For historical reasons EEPROM drivers have lived under
drivers/misc/eeprom/. Also for historical reasons changes to most of
them would go through the char-misc tree while some would be queued
through the I2C tree. Over the years some of them have also been
converted to using nvmem - the dedicated subsystem for non-volatile
memory - while get_maintainer.pl does not Cc the maintainer of nvmem on
patches changing them.

Move the EEPROM drivers using nvmem under drivers/nvmem/ for
consistency of the review process and path upstream.

Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094647.111468-11-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:15:53 +02:00
Shawn Guo 5533bb4bc5 misc: fastrpc: Drop unhandled DSP PD exit notification
Newer DSP firmware implements a PD (Protection Domain) notification
framework that sends PD state notifications upon request. The PD exit
notification is unconditionally sent by the DSP with a fixed sentinel
0xABCDABCD in the context field.

fastrpc_rpmsg_callback() treats every inbound message as an invoke
response, so the sentinel is masked and shifted like any real response
((0xABCDABCD & 0xFF0) >> 4 == 188) and looked up in the channel's
context idr.

This is not merely cosmetic. In the common case idr slot 188 is empty,
the lookup fails, and the driver only logs a spurious "No context ID
matches response" error on every teardown. But the context idr is shared
by every protection domain and the listener thread on the channel and is
filled cyclically over [1, FASTRPC_CTX_MAX]. If slot 188 holds a live
context when the sentinel arrives, the sentinel's return value is written
into that unrelated in-flight invocation and it is completed early.

Since neither the fastrpc library nor the driver supports the DSP PD
notification framework, it is safe to drop the PD exit notification
before it is ever turned into a context lookup. This removes both the
log spam and the mis-completion race. A genuine response can never be
masked: a real context is (idr_index << 4) | pd (at most 0xFF3) and
can never equal the sentinel.

Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094352.111065-11-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:15:53 +02:00
Ekansh Gupta 96e62cc0a8 misc: fastrpc: Add polling mode support for fastRPC driver
For any remote call to DSP, after sending an invocation message,
the fastRPC driver waits for a glink response, during which the CPU
can enter low power modes. This adds latency to the fastRPC call
due to CPU wakeup and scheduling overhead. Add polling mode support
where the fastRPC driver polls a shared memory location for
completion after sending the invocation, avoiding CPU wakeup and
scheduling latency and reducing fastRPC overhead. If the poll times
out, the call falls back to the normal interrupt/glink-based
completion path.

Poll mode is only applied to dynamic modules running in a user PD
(handle > FASTRPC_MAX_STATIC_HANDLE), since static/root-PD handles
are not expected to benefit from, or require, this optimization.
Support is advertised per SoC via fastrpc_soc_data, with a closed
exception list for older platforms whose DSP firmware is known to
support polling but which otherwise use the default soc_data.

Poll mode can be enabled by userspace via the FASTRPC_IOCTL_SET_OPTION
ioctl with the FASTRPC_POLL_MODE request id.

Since context IDs (ctxid) are allocated from a fixed-size, per-channel
cyclic IDR shared by all processes on a DSP, a context ID can be
recycled for a new request soon after it is freed. In poll mode the
context can be considered complete (and released) as soon as the poll
memory is updated, while the corresponding glink COMPLETE response
from the DSP may still be in flight. If that response arrives after
the ctxid has been reused, it would otherwise match the new context
and incorrectly signal completion for it while the DSP may still be
operating on the new context's buffers. To prevent this, embed a
monotonically increasing per-channel sequence number in the unused
upper bits of the ctxid/message context and validate it in the
rpmsg callback, dropping any response whose sequence number does not
match the current owner of that ctxid slot.

Signed-off-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094352.111065-8-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:15:53 +02:00
Ekansh Gupta 62373b7879 misc: fastrpc: Expand context ID mask for DSP polling mode support
Current FastRPC context uses a 12-bit mask:
  [ID(8 bits)][PD type(4 bits)] = GENMASK(11, 4)

This works for normal calls but fails for DSP polling mode.
Polling mode expects a 16-bit layout:
  [15:8] = context ID (8 bits)
  [7:5]  = reserved
  [4]    = async mode bit
  [3:0]  = PD type (4 bits)

If async bit (bit 4) is set, DSP disables polling. With current
mask, odd IDs can set this bit, causing DSP to skip poll updates.

Update FASTRPC_CTXID_MASK to GENMASK(15, 8) so IDs occupy upper
byte and lower byte is left for DSP flags and PD type.

Reserved bits remain unused. This change is compatible with
polling mode and does not break non-polling behavior.

Bit layout:
  [15:8] = CCCCCCCC (context ID)
  [7:5]  = xxx (reserved)
  [4]    = A (async mode)
  [3:0]  = PPPP (PD type)

Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094352.111065-7-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:15:53 +02:00
Ekansh Gupta 713b54b86a misc: fastrpc: Replace hardcoded ctxid mask with GENMASK
Replace the hardcoded context ID mask (0xFF0) with GENMASK(11, 4) to
improve readability and follow kernel bitfield conventions. Use
FIELD_PREP and FIELD_GET instead of manual shifts for setting and
extracting ctxid values.

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094352.111065-6-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:15:53 +02:00
Ekansh Gupta 1b59271fa6 misc: fastrpc: Move fdlist to invoke context structure
The fdlist is currently part of the meta buffer which is set during
fastrpc_get_args(), this fdlist is getting recalculated during
fastrpc_put_args().

Move fdlist to the invoke context structure to improve maintainability
and reduce redundancy. This centralizes its handling and simplifies
meta buffer preparation and reading logic.

Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094352.111065-5-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:15:52 +02:00
Ekansh Gupta 23fce99d05 misc: fastrpc: Allow fastrpc_buf_free() to accept NULL
Make fastrpc_buf_free() a no-op when passed a NULL pointer, allowing
callers to avoid open-coded NULL checks.

Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Jianping Li <jianping.li@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094352.111065-3-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:15:52 +02:00
Mukesh Ojha c3306dd3bd misc: fastrpc: Move prints outside spinlock in fastrpc_cb_probe
dev_err() and dev_info() were called while holding a spinlock with
IRQs disabled, which is incorrect as printk can be slow and should
not be called in atomic context.

Move the dev_err() for the FASTRPC_MAX_SESSIONS check to after the
spinlock is released, and save the return value of of_property_read_u32()
to print dev_info() after the lock is dropped. Minor variable style
correction in probe function.

Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Reviewed-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094352.111065-2-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 14:15:52 +02:00
Alexander Usyskin b0495bb58a mei: pull kvfree out of spinlock
The read buffer allocation was changed from kmalloc() to kvmalloc().

This buffer is part of mei_cl_cb structure that can be queued in
rd_complete queue protected by spinlock.
Releasing the structure leads to errors like below when freeing buffer
that allocated non-contiguous:

BUG: sleeping function called from invalid context at mm/vmalloc.c:3448

Separate mei_cl_cb structure dequeue and release to
perform only dequeue under spinlock and push release out of spinlock.

Cc: stable <stable@kernel.org>
Fixes: 4adf613e01 ("mei: use kvmalloc for read buffer")
Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/16359
Reviewed-by: Menachem Adin <menachem.adin@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Link: https://patch.msgid.link/20260719-kvfree_out_of_spinlock-v1-1-e07d6333bea7@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 13:28:05 +02:00
Eddie Lin 2fae94ee14 misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
The 'ctx_idr' is initialized but never destroyed when
the channel context is freed, leading to a memory leak.
Add idr_destroy() to properly clean up the IDR resources.

Fixes: f6f9279f2b ("misc: fastrpc: Add Qualcomm fastrpc basic driver model")
Cc: stable@vger.kernel.org
Signed-off-by: Eddie Lin <eddie.lin@oss.qualcomm.com>
Reviewed-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260724223342.629168-6-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 10:59:47 +02:00
Anandu Krishnan E 310f786839 misc: fastrpc: fix channel ctx ref leak when session alloc fails
fastrpc_channel_ctx_get() is called in fastrpc_device_open() before
fastrpc_session_alloc(). If session alloc fails, the error path
returns -EBUSY without calling fastrpc_channel_ctx_put(), leaking
the reference. Fix by adding the missing put.

Fixes: 278d56f970 ("misc: fastrpc: Reference count channel context")
Cc: stable@kernel.org
Signed-off-by: Anandu Krishnan E <anandu.e@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260724223342.629168-5-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 10:59:47 +02:00
Junrui Luo b85a0e91d7 misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
When an invoke is interrupted by a signal,
wait_for_completion_interruptible() returns -ERESTARTSYS and
fastrpc_internal_invoke() moves every buffer from fl->mmaps onto
cctx->invoke_interrupted_mmaps. This list_del()/list_add_tail() walk
runs without holding fl->lock, the lock that serialises fl->mmaps in
fastrpc_req_mmap() and fastrpc_req_munmap() everywhere else.

Take fl->lock around the move, matching every other fl->mmaps accessor.

Fixes: 76e8e4ace1 ("misc: fastrpc: Safekeep mmaps on interrupted invoke")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260724223342.629168-4-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 10:59:47 +02:00
Ekansh Gupta 6102ceb4ea misc: fastrpc: Remove buffer from list prior to unmap operation
fastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is
getting removed from the list after it is unmapped from DSP. This can
create potential race conditions if multiple threads invoke unmap
concurrently, where one thread may remove the entry from the list while
another thread's unmap operation is still ongoing.

Fix this by removing the buffer entry from the list before calling the
unmap operation. If the unmap fails, the entry is re-added to the list
so that userspace can retry the unmap, or alternatively, the buffer
will be cleaned up during device release when the DSP process is torn
down and all DSP-side mappings are freed along with remaining buffers
in the list.

Fixes: 2419e55e53 ("misc: fastrpc: add mmap/unmap support")
Cc: stable@kernel.org
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Jianping Li <jianping.li@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260724223342.629168-3-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 10:59:47 +02:00
Ekansh Gupta ab99eaafb0 misc: fastrpc: Fix initial memory allocation for Audio PD memory pool
The initial buffer allocated for the Audio PD memory pool is never added
to the pool because pageslen is set to 0. As a result, the buffer is not
registered with Audio PD and is never used, causing a memory leak. Audio
PD immediately falls back to allocating memory from the remote heap since
the pool starts out empty.

Fix this by setting pageslen to 1 so that the initially allocated buffer
is correctly registered and becomes part of the Audio PD memory pool.

Fixes: 0871561055 ("misc: fastrpc: Add support for audiopd")
Cc: stable@kernel.org
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Jianping Li <jianping.li@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260724223342.629168-2-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 10:59:47 +02:00
Brendan Jackman 579c6de3de sgi-xp: use higher-level allocator API
The difference between __alloc_pages_node() and alloc_pages_node() is
that the latter allows you to pass NUMA_NO_NODE.

The former is going away and the latter works fine here so switch over.

No functional change intended.

Link: https://lore.kernel.org/20260703-alloc-trylock-v5-11-c87b714e19d3@google.com
Signed-off-by: Brendan Jackman <jackmanb@google.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Suren Baghdasaryan <surenb@google.com>
Acked-by: Steve Wahl <steve.wahl@hpe.com>
Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Cc: Robin Holt <robinmholt@gmail.com>
Cc: Steve Wahl <steve.wahl@hpe.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Assisted-by: Gemini:unknown-model
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-30 19:40:42 -07:00
Greg Kroah-Hartman 0957fbab97 Merge 7.2-rc5 into char-misc-next
We need the char/misc fixes AND this resolves two merge conflicts in:
	drivers/android/binder/thread.rs
	drivers/misc/nsm.c

Reported-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-27 14:17:19 +02:00
Jiri Slaby (SUSE) d7f0b6a15d misc: rp1: Switch to irq_domain_create_linear()
irq_domain_add_linear() is going away as being obsolete now. Switch to
the preferred irq_domain_create_linear(). That differs in the first
parameter: It takes more generic struct fwnode_handle instead of struct
device_node. Therefore, of_fwnode_handle() is added around the
parameter.

Note some of the users can likely use dev->fwnode directly instead of
indirect of_fwnode_handle(dev->of_node). But dev->fwnode is not
guaranteed to be set for all, so this has to be investigated on case to
case basis (by people who can actually test with the HW).

Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
Cc: Thomas Gleixner <tglx@kernel.org>
Cc: Andrea della Porta <andrea.porta@suse.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Tested-by: Andrea della Porta <andrea.porta@suse.com>
Link: https://patch.msgid.link/20260708095733.385396-1-jirislaby@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17 15:51:10 +02:00