* Mark set_high_memory() as __init to fix section mismatch
* Accept memory allocated in memblock_double_array() to mitigate crash of SNP
guests
-----BEGIN PGP SIGNATURE-----
iQFEBAABCgAuFiEEeOVYVaWZL5900a/pOQOGJssO/ZEFAmggNRQQHHJwcHRAa2Vy
bmVsLm9yZwAKCRA5A4Ymyw79kXrCCACyy+Q+LakMWEeq4hzbYJUtyEGzSAZgYm4j
YX/fW1zgxiYgQHeYJI0fFt9RGMpbT62KWF/43sAS9HnucNWwVZKGVPct00JKe2Eb
aDMmU3HuoILuTxF1D1h3eFzX3yyM9bVIUZBOiJqzVlYH5i6NHydGhBaGFL4EZWV5
65z2pA/6nS3pNFc564T25su3gK/J/i5aYXpqhn6MHwY7QIbQhPndNu5k+UuoIQI+
Cbk0dxgx5hvJZJ45SpGuTzCx/Di6GWMRGl4XJD7VX3uJi4FrDjPEfyT6j39qtpLx
RsuiS/9iG4Y0ew1bAnQrCNlTTS/HInWJ6yV4ggdy/Cu2j/Qv7kLr
=CLPd
-----END PGP SIGNATURE-----
Merge tag 'fixes-2025-05-11' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock
Pull memblock fixes from Mike Rapoport:
- Mark set_high_memory() as __init to fix section mismatch
- Accept memory allocated in memblock_double_array() to mitigate crash
of SNP guests
* tag 'fixes-2025-05-11' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock:
memblock: Accept allocated memory before use in memblock_double_array()
mm,mm_init: Mark set_high_memory as __init
or aren't considered necessary for -stable kernels.
About half are for MM. Five OCFS2 fixes and a few MAINTAINERS updates.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCaB/D0AAKCRDdBJ7gKXxA
jk1lAPwNV14Sra7MJpVsLGip2BaJLgG+9vQ/Fg3pntEhwX4u0gD/fXEzTog/A73O
xD7jQQStJYxHwu0K8CXIDUniZAXSSQw=
=US5c
-----END PGP SIGNATURE-----
Merge tag 'mm-hotfixes-stable-2025-05-10-14-23' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull misc hotfixes from Andrew Morton:
"22 hotfixes. 13 are cc:stable and the remainder address post-6.14
issues or aren't considered necessary for -stable kernels.
About half are for MM. Five OCFS2 fixes and a few MAINTAINERS updates"
* tag 'mm-hotfixes-stable-2025-05-10-14-23' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (22 commits)
mm: fix folio_pte_batch() on XEN PV
nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs()
mm/hugetlb: copy the CMA flag when demoting
mm, swap: fix false warning for large allocation with !THP_SWAP
selftests/mm: fix a build failure on powerpc
selftests/mm: fix build break when compiling pkey_util.c
mm: vmalloc: support more granular vrealloc() sizing
tools/testing/selftests: fix guard region test tmpfs assumption
ocfs2: stop quota recovery before disabling quotas
ocfs2: implement handshaking with ocfs2 recovery thread
ocfs2: switch osb->disable_recovery to enum
mailmap: map Uwe's BayLibre addresses to a single one
MAINTAINERS: add mm THP section
mm/userfaultfd: fix uninitialized output field for -EAGAIN race
selftests/mm: compaction_test: support platform with huge mount of memory
MAINTAINERS: add core mm section
ocfs2: fix panic in failed foilio allocation
mm/huge_memory: fix dereferencing invalid pmd migration entry
MAINTAINERS: add reverse mapping section
x86: disable image size check for test builds
...
Here is a single driver core fix for a regression for platform devices
that is a regression from a change that went into 6.15-rc1 that affected
Pixel devices. It has been in linux-next for over a week with no
reported problems.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaB9XmA8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ykMpgCgkKADII5bTybOB2Rkd2XRv1gh9ggAnjnoZZNT
WdtawFbS8G6EldLgH9lN
=gJoe
-----END PGP SIGNATURE-----
Merge tag 'driver-core-6.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core
Pull driver core fix from Greg KH:
"Here is a single driver core fix for a regression for platform devices
that is a regression from a change that went into 6.15-rc1 that
affected Pixel devices. It has been in linux-next for over a week with
no reported problems"
* tag 'driver-core-6.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:
platform: Fix race condition during DMA configure at IOMMU probe time
Here are some small USB driver fixes for 6.15-rc6. Included in here
are:
- typec driver fixes
- usbtmc ioctl fixes
- xhci driver fixes
- cdnsp driver fixes
- some gadget driver fixes
Nothing really major, just all little stuff that people have reported
being issues. All of these have been in linux-next this week with no
reported issues.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaB9WpQ8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ykGJQCgkMAjVeSFVPOp7dONPEFySTqDYuAAn2d6XtXv
OccDBWmCLeQzBpTABY7j
=13hH
-----END PGP SIGNATURE-----
Merge tag 'usb-6.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB fixes from Greg KH:
"Here are some small USB driver fixes for 6.15-rc6. Included in here
are:
- typec driver fixes
- usbtmc ioctl fixes
- xhci driver fixes
- cdnsp driver fixes
- some gadget driver fixes
Nothing really major, just all little stuff that people have reported
being issues. All of these have been in linux-next this week with no
reported issues"
* tag 'usb-6.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive.
usb: xhci: Don't trust the EP Context cycle bit when moving HW dequeue
usb: usbtmc: Fix erroneous generic_read ioctl return
usb: usbtmc: Fix erroneous wait_srq ioctl return
usb: usbtmc: Fix erroneous get_stb ioctl error returns
usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition
USB: usbtmc: use interruptible sleep in usbtmc_read
usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version
usb: typec: ucsi: displayport: Fix NULL pointer access
usb: typec: ucsi: displayport: Fix deadlock
usb: misc: onboard_usb_dev: fix support for Cypress HX3 hubs
usb: uhci-platform: Make the clock really optional
usb: dwc3: gadget: Make gadget_wakeup asynchronous
usb: gadget: Use get_status callback to set remote wakeup capability
usb: gadget: f_ecm: Add get_status callback
usb: host: tegra: Prevent host controller crash when OTG port is used
usb: cdnsp: Fix issue with resuming from L1
usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN
Here are three small staging driver fixes for 6.15-rc6. These are:
- bcm2835-camera driver fix
- two axis-fifo driver fixes
All of these have been in linux-next for a few weeks with no reported
issues.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaB9XLQ8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ynOXwCg1Gdq0MgLu4zuIv//AJiPvWPR6psAniJ81XW2
FxP3AQLcyUUSItvda5xa
=JJKJ
-----END PGP SIGNATURE-----
Merge tag 'staging-6.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
Pull staging driver fixes from Greg KH:
"Here are three small staging driver fixes for 6.15-rc6. These are:
- bcm2835-camera driver fix
- two axis-fifo driver fixes
All of these have been in linux-next for a few weeks with no reported
issues"
* tag 'staging-6.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
staging: axis-fifo: Remove hardware resets for user errors
staging: axis-fifo: Correct handling of tx_fifo_depth for size validation
staging: bcm2835-camera: Initialise dev in v4l2_dev
Here are a bunch of small driver fixes (mostly all IIO) for 6.15-rc6.
Included in here are:
- loads of tiny IIO driver fixes for reported issues
- hyperv driver fix for a much-reported and worked on sysfs ring
buffer creation bug
All of these have been in linux-next for over a week (the IIO ones for
many weeks now), with no reported issues.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaB9YVQ8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ynaIwCfTPZseJ558irNFrethcxPqtAAlc0An3z4Jyij
diV9XrxG+Afasvqviyi/
=sjUN
-----END PGP SIGNATURE-----
Merge tag 'char-misc-6.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char/misc/IIO driver fixes from Greg KH:
"Here are a bunch of small driver fixes (mostly all IIO) for 6.15-rc6.
Included in here are:
- loads of tiny IIO driver fixes for reported issues
- hyperv driver fix for a much-reported and worked on sysfs ring
buffer creation bug
All of these have been in linux-next for over a week (the IIO ones for
many weeks now), with no reported issues"
* tag 'char-misc-6.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (30 commits)
Drivers: hv: Make the sysfs node size for the ring buffer dynamic
uio_hv_generic: Fix sysfs creation path for ring buffer
iio: adis16201: Correct inclinometer channel resolution
iio: adc: ad7606: fix serial register access
iio: pressure: mprls0025pa: use aligned_s64 for timestamp
iio: imu: adis16550: align buffers for timestamp
staging: iio: adc: ad7816: Correct conditional logic for store mode
iio: adc: ad7266: Fix potential timestamp alignment issue.
iio: adc: ad7768-1: Fix insufficient alignment of timestamp.
iio: adc: dln2: Use aligned_s64 for timestamp
iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64
iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer.
iio: chemical: pms7003: use aligned_s64 for timestamp
iio: chemical: sps30: use aligned_s64 for timestamp
iio: imu: inv_mpu6050: align buffer for timestamp
iio: imu: st_lsm6dsx: Fix wakeup source leaks on device unbind
iio: adc: qcom-spmi-iadc: Fix wakeup source leaks on device unbind
iio: accel: fxls8962af: Fix wakeup source leaks on device unbind
iio: adc: ad7380: fix event threshold shift
iio: hid-sensor-prox: Fix incorrect OFFSET calculation
...
- omap: use correct function to read from device tree
- MAINTAINERS: remove Seth from ISMT maintainership
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEOZGx6rniZ1Gk92RdFA3kzBSgKbYFAmgfJckACgkQFA3kzBSg
KbYccRAAoccV12i7q1GS9DlnkkxObENoJ18c4oV0XzH+US+Oi7BeD8c1/NAbLSMS
7RUJjqBf/4q8xHlvP3GTI8yGWwwdQRzHBS1Ul1kpNvX7CM8Jwi4ljAO2x+aoElEw
VnJTJj2dzjFZ4DQVQXUJmNAwPgpsQl/OuBd+i7YwXqJyeCRSvkrxc3D4AftoHQJl
e12a43qDm6wtRtGV6jIkDOyaZ+0+zYe8LAT8hNfAB/oJf4cz3W49LH8/pKl6y6FQ
2Tjw4TtERQQaSwKcjt03sIXqP3mMSEuRJdCyINvtkeCDqZiYVkN4p4JaGWCSaLCh
Yscuefdq8E0SDFKkS/ogGq7/YaBt/rIA8O3fRhVfnh/nx/I2wJXgIMBKDnkjMa6g
k1p9+RdAMxNyEoiFH4ALHeX0eztvQmNyAh3IvPvcZZ3+0yLqSmxkMZO87gi95+Vu
AxcSXZZQA4yy+rqNrgWAel7zXQSmBCppsjI90jj0Br072uYFuQ5Ja7LGmN0F7SDR
SlIaQ1dbi9dZE36F9IY2/GtTEGY6cQp8Hire58BqKwnE/qvId22Ywv12sqZLdNPp
CeywLiXJjFxCJjLqWRU0OY1lSTW6Tnp6aCZMtuIpjBQ0L39luPSZxsx4Mh3zM4UK
CO7I+fpViabeHq2cBtDvQSMDejuxp6Tig4H1WHHsSAhhnFjxVao=
=0qWn
-----END PGP SIGNATURE-----
Merge tag 'i2c-for-6.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux
Pull i2c fixes from Wolfram Sang:
- omap: use correct function to read from device tree
- MAINTAINERS: remove Seth from ISMT maintainership
* tag 'i2c-for-6.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
MAINTAINERS: Remove entry for Seth Heasley
i2c: omap: fix deprecated of_property_read_bool() use
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRTLbB6QfY48x44uB6AXGG7T9hjvgUCaB7qnQAKCRCAXGG7T9hj
vp7jAP9+fWTsuK6K3HnWn/XeQjLUIO37rty2Xep8vB6tdfa6GwEA/9YTgffq4R7w
UtIZiACpqRvawuBncK/ENjehbi72pgQ=
=DYrf
-----END PGP SIGNATURE-----
Merge tag 'for-linus-6.15a-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip
Pull xen fixes from Juergen Gross:
- A fix for the xenbus driver allowing to use a PVH Dom0 with
Xenstore running in another domain
- A fix for the xenbus driver addressing a rare race condition
resulting in NULL dereferences and other problems
- A fix for the xen-swiotlb driver fixing a problem seen on Arm
platforms
* tag 'for-linus-6.15a-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
xenbus: Use kref to track req lifetime
xenbus: Allow PVH dom0 a non-local xenstore
xen: swiotlb: Use swiotlb bouncing if kmalloc allocation demands it
-----BEGIN PGP SIGNATURE-----
iHUEABYIAB0WIQQqUNBr3gm4hGXdBJlZ7Krx/gZQ6wUCaB59uwAKCRBZ7Krx/gZQ
65LzAQDNWuHb/oR1LMgdPxynDDh3kFAuj1P3KN9j0QYw83RYMAD/aJucjRhIKUIH
ajyA4t/MMZsA2gBBdkKwWO9IDt8PAg0=
=RRin
-----END PGP SIGNATURE-----
Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull mount fixes from Al Viro:
"A couple of races around legalize_mnt vs umount (both fairly old and
hard to hit) plus two bugs in move_mount(2) - both around 'move
detached subtree in place' logics"
* tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
fix IS_MNT_PROPAGATING uses
do_move_mount(): don't leak MNTNS_PROPAGATING on failures
do_umount(): add missing barrier before refcount checks in sync case
__legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
- omap: use correct function to read from device tree
- MAINTAINERS: remove Seth from ISMT maintainership
-----BEGIN PGP SIGNATURE-----
iIwEABYKADQWIQScDfrjQa34uOld1VLaeAVmJtMtbgUCaB3svBYcYW5kaS5zaHl0
aUBrZXJuZWwub3JnAAoJENp4BWYm0y1u+LYBAM9HQg3hDogvUTzT1bDUeBzAtNPk
brPFmUSi9wFZp8L1AQDwdTQSZOFp5yjboAtU5/MDBTFxdPlROkxrzror6wDDDA==
=HzZn
-----END PGP SIGNATURE-----
Merge tag 'i2c-host-fixes-6.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current
i2c-host-fixes for v6.15-rc6
- omap: use correct function to read from device tree
- MAINTAINERS: remove Seth from ISMT maintainership
-----BEGIN PGP SIGNATURE-----
iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmgebFUACgkQiiy9cAdy
T1HI+gv/Q1R0t6HlpL3fgMPw9RZIOcndvIulYI1CyNQ/xdhqDcPBGl3qt3vm6247
OM7o/easyr6TXXY5rdO/zne2ekORRLKBKFeoH/1v4jQu3XBoc/O2S0jaM9rmNuvm
gDgVU+rzkfIUWLYQz1r8XxQ7umz+rZYEX3E9K96mlQWlykSdepx8wtLDE5kZoZZb
fo5sHw1iEuWXLualM0fuNbqScdWKQ/Wg//yjopefwsldLY/JcoOfA/1HLXOgI451
a3AcL7QmZzQG6wa/aq1kUmU10fL9DxbDhNmCPyiGTlCIcyithECrMaR4IRq6/FlU
E1Zh1v7K+zCH48DSrb9SlVaCoqkZmkztvadTZBqp9NqnjOUlbpX0mHK2I0hFxcMN
nrYFg5HPKYdo0pbLSobgIGQPph6UIrAjSlKiTfTdpEGjyyStRjtftmhhky5vKHKS
ZXkQ9XNdS6Cwx1DT9JDYQrUwt2xH44kDx+OYsxYYYaw9yLkClJBDfQZWr4zeMnWi
0E0mx1cz
=m9eD
-----END PGP SIGNATURE-----
Merge tag '6.15-rc5-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6
Pull smb client fixes from Steve French:
- Fix dentry leak which can cause umount crash
- Add warning for parse contexts error on compounded operation
* tag '6.15-rc5-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
smb: client: Avoid race in open_cached_dir with lease breaks
smb3 client: warn when parse contexts returns error on compounded operation
propagate_mnt() does not attach anything to mounts created during
propagate_mnt() itself. What's more, anything on ->mnt_slave_list
of such new mount must also be new, so we don't need to even look
there.
When move_mount() had been introduced, we've got an additional
class of mounts to skip - if we are moving from anon namespace,
we do not want to propagate to mounts we are moving (i.e. all
mounts in that anon namespace).
Unfortunately, the part about "everything on their ->mnt_slave_list
will also be ignorable" is not true - if we have propagation graph
A -> B -> C
and do OPEN_TREE_CLONE open_tree() of B, we get
A -> [B <-> B'] -> C
as propagation graph, where B' is a clone of B in our detached tree.
Making B private will result in
A -> B' -> C
C still gets propagation from A, as it would after making B private
if we hadn't done that open_tree(), but now the propagation goes
through B'. Trying to move_mount() our detached tree on subdirectory
in A should have
* moved B' on that subdirectory in A
* skipped the corresponding subdirectory in B' itself
* copied B' on the corresponding subdirectory in C.
As it is, the logics in propagation_next() and friends ends up
skipping propagation into C, since it doesn't consider anything
downstream of B'.
IOW, walking the propagation graph should only skip the ->mnt_slave_list
of new mounts; the only places where the check for "in that one
anon namespace" are applicable are propagate_one() (where we should
treat that as the same kind of thing as "mountpoint we are looking
at is not visible in the mount we are looking at") and
propagation_would_overmount(). The latter is better dealt with
in the caller (can_move_mount_beneath()); on the first call of
propagation_would_overmount() the test is always false, on the
second it is always true in "move from anon namespace" case and
always false in "move within our namespace" one, so it's easier
to just use check_mnt() before bothering with the second call and
be done with that.
Fixes: 064fe6e233 ("mount: handle mount propagation for detached mount trees")
Reviewed-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
as it is, a failed move_mount(2) from anon namespace breaks
all further propagation into that namespace, including normal
mounts in non-anon namespaces that would otherwise propagate
there.
Fixes: 064fe6e233 ("mount: handle mount propagation for detached mount trees")
Reviewed-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
do_umount() analogue of the race fixed in 119e1ef80e "fix
__legitimize_mnt()/mntput() race". Here we want to make sure that
if __legitimize_mnt() doesn't notice our lock_mount_hash(), we will
notice their refcount increment. Harder to hit than mntput_no_expire()
one, fortunately, and consequences are milder (sync umount acting
like umount -l on a rare race with RCU pathwalk hitting at just the
wrong time instead of use-after-free galore mntput_no_expire()
counterpart used to be hit). Still a bug...
Fixes: 48a066e72d ("RCU'd vfsmounts")
Reviewed-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
... or we risk stealing final mntput from sync umount - raising mnt_count
after umount(2) has verified that victim is not busy, but before it
has set MNT_SYNC_UMOUNT; in that case __legitimize_mnt() doesn't see
that it's safe to quietly undo mnt_count increment and leaves dropping
the reference to caller, where it'll be a full-blown mntput().
Check under mount_lock is needed; leaving the current one done before
taking that makes no sense - it's nowhere near common enough to bother
with.
Reviewed-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Toolchain and infrastructure:
- Make CFI_AUTO_DEFAULT depend on !RUST or Rust >= 1.88.0.
- Clean Rust (and Clippy) lints for the upcoming Rust 1.87.0 and Rust
1.88.0 releases.
- Clean objtool warning for the upcoming Rust 1.87.0 release by adding
one more noreturn function.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmgeYP0ACgkQGXyLc2ht
IW1P4hAAkgehQqfec/Ebn31euIHcS2GTAr1UzSEM23ErYieLTKUOH3vaPq3rxxsF
Tfq/n7vjRI55hfQ199nYaWIXL/BBPIDGxGZ6EwoOcH/xx4Y7er4WIbCuaxaN2ySy
GniUtOOvbXM9tB4h/SjBc/8fv6XxmP0T8ylO4a2G1HIWz31Iy5KkeohmmugnpX0F
FvVdR0aAjbGk1bS4JCi4Y9/TX7FzjBd6gIErvIcYZNtNUkxlWYVbIOKTSOoQiQu0
JSI9EpgiDYjMMXvIM+INOapoVUX9yTJ/ZisoMEb2gkAkC15UVa+M8D4jaP1bYNPp
YcjiWGJv5TNIL9F25p0Wa9pgP/OGVzJxKZv11dAwkeqX6SM/nUXuNa3pBNiuSpn8
syoPTcP2DeZnPrXNZeItZ8KRl27TSdhs3y4RPW8jd77Fo5Hqw7nRrHqI9n+0DBKw
7FRqnXmUQfRzlpz29Y4nA9mr8k5gLJsdKLpLEzdxC8Fec3wDPTzvchu0X722UPq+
k+8Ex5sh8cDm0BKqplS6ZFEShMhqtwpRQFhZpCga8Ogs6t13b3vQRDkWFoeKvbGQ
7CxSUHQRjbiwJNEpemFUCLw6fHJMusnrEXNQCIOdxuIYFyCZKiV9wFyxVWYcEp6W
YTNnyp3f1GVlsiT9qSyNi9woUF4HTRdhUOQqsmGhCHDcUM6Ufhc=
=lyOI
-----END PGP SIGNATURE-----
Merge tag 'rust-fixes-6.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux
Pull rust fixes from Miguel Ojeda:
- Make CFI_AUTO_DEFAULT depend on !RUST or Rust >= 1.88.0
- Clean Rust (and Clippy) lints for the upcoming Rust 1.87.0 and 1.88.0
releases
- Clean objtool warning for the upcoming Rust 1.87.0 release by adding
one more noreturn function
* tag 'rust-fixes-6.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust >= 1.88
rust: clean Rust 1.88.0's `clippy::uninlined_format_args` lint
rust: clean Rust 1.88.0's warning about `clippy::disallowed_macros` configuration
rust: clean Rust 1.88.0's `unnecessary_transmutes` lint
rust: allow Rust 1.87.0's `clippy::ptr_eq` lint
objtool/rust: add one more `noreturn` Rust function for Rust 1.87.0
drm:
- Fix overflow when generating wedged event
ttm:
- Fix documentation
- Remove struct ttm_backup
panel:
- simple: Fix timings for AUO G101EVN010
amdgpu:
- DC FP fixes
- Freesync fix
- DMUB AUX fixes
- VCN fix
- Hibernation fixes
- HDP fixes
xe:
- Prevent PF queue overflow
- Hold all forcewake during mocs test
- Remove GSC flush on reset path
- Fix forcewake put on error path
- Fix runtime warning when building without svm
i915:
- Fix oops on resume after disconnecting DP MST sinks during suspend
- Fix SPLC num_waiters refcounting
ivpu:
- Increase timeouts
- Fix deadlock in cmdq ioctl
- Unlock mutices in correct order
v3d:
- Avoid memory leak in job handling
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmgeVDsACgkQDHTzWXnE
hr5ohw/9EH3+kIhmMGXjWLLSAbFlbzxe/CT8fdMi9Sf9w9lz5q8MHUmisVFw+zoK
XyKSU8Gvr1Ca5e7lH2tSEPQtjSnjAhnGdksv4TKTuDv9ZGampVfmHh0yyCc4z9ID
I7NLiceo8rc5heBw303XO/obotkteoK1mEY9kuPe30wRQtHMKwO4+VgC075ygygq
Ptvl7XFGBhgcpBespikZcdp/Oi+xOeWux9sEdd50xyXzU53n1ZjVQC8/vr2lnUCq
I3+4seJY/DKtBAw/RrqGPKYzG1r0Wa9kmmGyV1YnMPdicdgP58kbFJDSEO9r2cIL
yN6uy4va6lUdAtcmpnbZWzou3HFWiSpMbKsGRrWovjvmIaH8ltszILaZ8aMXCwY9
BeM6VWONjknRmoHDjZ03YuLM7HjKAC9jO8bxhBY2TcT+tb+1TXnMTXx0zcxamVMV
8FLV0ki+o3hsErl+HFNe9hqXPwtTgfVAdOjY+8vmX1Idex1dZYbk/d7BCk06dQOW
n4dnZLZXbZJfZ2IEyTZh5Hnw18No2hTiAHsePzWhjyJbUWn66ck0juNToIUxOf1i
Jw5i2ohTN/rT82f2CqSCeD+AMRjrJmht+jAO6MhnP3woV/s8MIx5BJQqqv14FdTq
dV5YITC5g3vkKuMK4PHwe9qAi/qOVIzduzlS3D997WNoP8y++fQ=
=50os
-----END PGP SIGNATURE-----
Merge tag 'drm-fixes-2025-05-10' of https://gitlab.freedesktop.org/drm/kernel
Pull drm fixes from Dave Airlie:
"Weekly drm fixes, bit bigger than last week, but overall amdgpu/xe
with some ivpu bits and a random few fixes, and dropping the
ttm_backup struct which wrapped struct file and was recently
frowned at.
drm:
- Fix overflow when generating wedged event
ttm:
- Fix documentation
- Remove struct ttm_backup
panel:
- simple: Fix timings for AUO G101EVN010
amdgpu:
- DC FP fixes
- Freesync fix
- DMUB AUX fixes
- VCN fix
- Hibernation fixes
- HDP fixes
xe:
- Prevent PF queue overflow
- Hold all forcewake during mocs test
- Remove GSC flush on reset path
- Fix forcewake put on error path
- Fix runtime warning when building without svm
i915:
- Fix oops on resume after disconnecting DP MST sinks during suspend
- Fix SPLC num_waiters refcounting
ivpu:
- Increase timeouts
- Fix deadlock in cmdq ioctl
- Unlock mutices in correct order
v3d:
- Avoid memory leak in job handling"
* tag 'drm-fixes-2025-05-10' of https://gitlab.freedesktop.org/drm/kernel: (32 commits)
drm/i915/dp: Fix determining SST/MST mode during MTP TU state computation
drm/xe: Add config control for svm flush work
drm/xe: Release force wake first then runtime power
drm/xe/gsc: do not flush the GSC worker from the reset path
drm/xe/tests/mocs: Hold XE_FORCEWAKE_ALL for LNCF regs
drm/xe: Add page queue multiplier
drm/amdgpu/hdp7: use memcfg register to post the write for HDP flush
drm/amdgpu/hdp6: use memcfg register to post the write for HDP flush
drm/amdgpu/hdp5.2: use memcfg register to post the write for HDP flush
drm/amdgpu/hdp5: use memcfg register to post the write for HDP flush
drm/amdgpu/hdp4: use memcfg register to post the write for HDP flush
drm/amdgpu: fix pm notifier handling
Revert "drm/amd: Stop evicting resources on APUs in suspend"
drm/amdgpu/vcn: using separate VCN1_AON_SOC offset
drm/amd/display: Fix wrong handling for AUX_DEFER case
drm/amd/display: Copy AUX read reply data whenever length > 0
drm/amd/display: Remove incorrect checking in dmub aux handler
drm/amd/display: Fix the checking condition in dmub aux handling
drm/amd/display: Shift DMUB AUX reply command if necessary
drm/amd/display: Call FP Protect Before Mode Programming/Mode Support
...
- Prevent PF queue overflow
- Hold all forcewake during mocs test
- Remove GSC flush on reset path
- Fix forcewake put on error path
- Fix runtime warning when building without svm
-----BEGIN PGP SIGNATURE-----
iQJNBAABCAA3FiEE6rM8lpABPHM5FqyDm6KlpjDL6lMFAmgdjogZHGx1Y2FzLmRl
bWFyY2hpQGludGVsLmNvbQAKCRCboqWmMMvqU6i6D/wID1kcnrLd8V/0F8o1UFP3
oIFgbHwWbOSejufgr8t6TEvWoh7S8YcGh5S5BlJU66gbpMqVUktnjbOGmUeqY2BE
9YxkGxyXisSjK7/E93D61tP+Bz4qWWlxaoDZLTCxq8kSqI4WTlvHc75HT5yo/bXs
CvjYTv2zSHmIIEEbDILzH75St6c+WiN9qn8TKaUNPWkKKd2OLkXbhMKdhD6+dPFM
lrswQDbaAkxWxMal6HstY/YexMzNe37VRgajXgr0i372mO6y2IUCFjtKlULrk3Fh
NJ1kBhLRkM3eGbeXFcwORKNGZ4+ecA4b0xxeTuPuzRw44ks1efkMpuh080Itmbl9
P8fs0LjDaGW1ILaBwD8yaBaYGgL1sasG7bnS16y+i/98aY8mXNhznNImQTEDQdSj
YGe8CLtDfMqJm9Ksg9tvuAZK6Z4NDSMEBTCZ59zJAN1OToEMu8d54okHSmdgI6xj
6GVjiXbZgwuLTjjjZ6NMgpjKLi+j0VPx/1jFDxTZ71sRQqSKNId6i9/jazKGe/nR
qUZyT9AXNShntR75FXmAXkTRlE+4tL+BaTbVqjuMwRoi/bN3fhpiugj7ucRK03n7
IjhP19YOfV1XfXk95y1cKnktspmSRHoSCuD/JO5GRKJpb1NkNAlH7aQ4JqKJW59B
p6s+gPruce1OE7GP5RQUmg==
=dbSX
-----END PGP SIGNATURE-----
Merge tag 'drm-xe-fixes-2025-05-09' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes
Driver Changes:
- Prevent PF queue overflow
- Hold all forcewake during mocs test
- Remove GSC flush on reset path
- Fix forcewake put on error path
- Fix runtime warning when building without svm
Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://lore.kernel.org/r/jffqa56f2zp4i5ztz677cdspgxhnw7qfop3dd3l2epykfpfvza@q2nw6wapsphz
section as it is accessed very early during boot with the MMU off and
before the .bss has been initialised. This can lead to incorrect idmap
page table.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE5RElWfyWxS+3PLO2a9axLQDIXvEFAmgeNE0ACgkQa9axLQDI
XvHaog//SZP7GWW2xJZfw4hGBWZ8outFS3f+E/ldHn+HHHsnJwqVL+CC5Rm3Aa/R
x3I9mqPfvdmxkMiWvvTqAJJzSbsi8S2zcW46ytZuhkhz6n4DTIpoTcafYJavlIJy
lMpKrCVtnAEGf1ZP56IF5/+SVG/30/tQrv7d6sKcMwibnAta9TufqW5+lxW3EOFp
Mbo1d/3P/ApAtZIWYnOVIWxRDV9DyJpUvH1njkhv4iNQS6mXinqbhAtE8wgcnCZo
0ATeSqtNJDGuqTsf7/tDwaC9Dd9MyVXR0uyEwz7e0uFxX4hypC5ikAuEW2yDlt7X
Xng+TSaoiKc6fTbyG+/do8/EcxakDEWjph6Z6oBOtjBjTqkm1ECt3wdQLnrk/eqk
hzqtjqr6RaZhEF0RnpAny7h8wOpbf7JNxFJEUOugDz61RFl1mPZa22wQw6hNaRZT
uK507QA3ly1yAmIyVQ1AFFOQ7IWy3+NQc8ChNuTD9RiOqjqLcQ8X7sclSJ+yyZVM
5/5L8OayAUQj9orL9t5x9+NXuuaDL9bGZVr0p+9DHgCMYWmhldFgC5RvFFm8DW0v
Ll7sGeNjIqCuyGoXHbJwchCqcnjY1x+lZdUP74N10TUtr4h3dhEkBJvAvl9fOqzp
htaN36hCptq6aMQ59sR0C3QA0a29xRvb7jOCWec+02ExkdN7QZQ=
=sOHy
-----END PGP SIGNATURE-----
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fix from Catalin Marinas:
"Move the arm64_use_ng_mappings variable from the .bss to the .data
section as it is accessed very early during boot with the MMU off and
before the .bss has been initialised.
This could lead to incorrect idmap page table"
* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
arm64: cpufeature: Move arm64_use_ng_mappings to the .data section to prevent wrong idmap generation
* The compressed half-word misaligned access instructions (c.lhu, c.lh,
and c.sh) from the Zcb extension are now properly emulated.
* A series of fixes to properly emulate permissions while handling
userspace misaligned accesses.
* A pair of fixes for PR_GET_TAGGED_ADDR_CTRL to avoid accessing the
envcfg CSR on systems that don't support that CSR, and to report those
failures up to userspace.
* The .rela.dyn section is no longer stripped from vmlinux, as it is
necessary to relocate the kernel under some conditions (including
kexec).
-----BEGIN PGP SIGNATURE-----
iQJHBAABCAAxFiEEAM520YNJYN/OiG3470yhUCzLq0EFAmgeKQ4THHBhbG1lckBk
YWJiZWx0LmNvbQAKCRDvTKFQLMurQbWRD/4uQ3JzhTsSCW+j2X6gwmn80Y7ugQN/
PURkgP0jzORrJxvM0fuUqMlvC9WjlBBxmLeVehsCqpbWYA6jwQbLlNNhE30l0GDB
pEMhuJ2zCCIQ18GLB7UGrsZO/XvfiwrFYhrLmbKFby5Z0utDubm3dTVPh+kMKHJd
SmcX0z1uxd/ONFWccI9Hh99Q4Q1fGcEneITlFA7DDfUGoP8ZuAOXG8xxi1m0Qbdg
nIPwgA0qIasPbR831QVnqV94rjcdwwsxZG7+kFCEgPjlxywSt3plFg7jH2sgeOc8
Xj+q2pdAktznpYDGAEZmZDmrIWa5RVwdAWqD0qlRW6C1ryVanuefc61v6CKrQ5Gt
w1v4y46XhnVeSkHvPbcqdHGyQnPpDvDdPndMYY39XkNTdRld72wkv7K+6Ow6483X
S16k/UwlnqybIh0B6/4BeRqGc2Gzu/Jz/L1nmd+iEcLnMVeSA3J1V7brFgAp49bF
0vYD9QHohq7RUdcctjr/EICjfMx32nrhXHt+gp6tB6SOnojk5m5/J7sOrXmtBl0o
Xo56zW9TSsxZyYrLAj57oT+r6C2EenQZrsx/UV8gLlyOmI7jLshFVwH2IGnSBD2Z
ZGtB82jaYyxJBVPwETN15rVXIZn7xhMjDy85upvN1NOknbSfuDX3+JuYgbt018Lp
Xew5LNj9cudIqA==
=5+HB
-----END PGP SIGNATURE-----
Merge tag 'riscv-for-linus-6.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V fixes from Palmer Dabbelt:
- The compressed half-word misaligned access instructions (c.lhu, c.lh,
and c.sh) from the Zcb extension are now properly emulated
- A series of fixes to properly emulate permissions while handling
userspace misaligned accesses
- A pair of fixes for PR_GET_TAGGED_ADDR_CTRL to avoid accessing the
envcfg CSR on systems that don't support that CSR, and to report
those failures up to userspace
- The .rela.dyn section is no longer stripped from vmlinux, as it is
necessary to relocate the kernel under some conditions (including
kexec)
* tag 'riscv-for-linus-6.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
riscv: Disallow PR_GET_TAGGED_ADDR_CTRL without Supm
scripts: Do not strip .rela.dyn section
riscv: Fix kernel crash due to PR_SET_TAGGED_ADDR_CTRL
riscv: misaligned: use get_user() instead of __get_user()
riscv: misaligned: enable IRQs while handling misaligned accesses
riscv: misaligned: factorize trap handling
riscv: misaligned: Add handling for ZCB instructions
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmgeCdgQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgprW3EACoZmPgLRnt19f/u+veGKnJknGMkxgyph44
MryIe6kmJPnZ8CUAq+RloHtObAsMDbNmvcfwvp4Aeg1he7D6yNgCTHyamGRhtwR0
ydGS/eawYUibp5757TIegj26jZOEwWKkVaytX60N0rnRLLkr6IFXgA9JBhxpkF95
YYDW5+6nr7Z95ZNprSpvA5Q59tbv+HAGoKX2mmmj6sWwXCwx9eHEK0//bnOe6HzA
3mYGpsFOIgOZ/DFj33jscSygsuyQRevh/i4TxuNZjDm+AD9TZZwAbspxKPVml+pT
aVQ6oRQoGzcPDaoMTTUAwxrMmMaVI3oDFibTDofldDjRbvPI96wR4Cs1orCBHrsE
5xOynjyp6Yrr+RBCbA0i6vIdhb5P/oDsXQ4/qxLgdz46aWwXl7kxd6JhdjDXrmXm
3k9Kou/GHNGbB2qhYU+qASRAWj+hieEEgS31ppCu44q0hh8pbynlUCnl3Di0hHsJ
CIgjzOtdLb9sCJm68mpZGCkx71B2RX2TTZRhtCUHZNuAr2vqynPcza2+gtTIYJkN
uxtYeguKwKzWTJkB5l4hvscH8GVAKY4hFpILT7CjAMs6Rn/i9mCtnuWlDdGbxQdb
JQjxbKM5C/XNdcMG/3oDWaTrg1beFPSk87N9dCNx2A87zLxtLi71OpIScPFdlP9y
XN6QgJbh2g==
=sdd1
-----END PGP SIGNATURE-----
Merge tag 'block-6.15-20250509' of git://git.kernel.dk/linux
Pull block fixes from Jens Axboe:
- Fix for a regression in this series for loop and read/write iterator
handling
- zone append block update tweak
- remove a broken IO priority test
- NVMe pull request via Christoph:
- unblock ctrl state transition for firmware update (Daniel
Wagner)
* tag 'block-6.15-20250509' of git://git.kernel.dk/linux:
block: remove test of incorrect io priority level
nvme: unblock ctrl state transition for firmware update
block: only update request sector if needed
loop: Add sanity check for read/write_iter
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmgeCbcQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpjqBEACSplsJV9Xwby8tOHpjqPKMpHMoY4oeML6b
PY1LNLpdTA9PvJVwLgFODJBQr3If39nJfzgua7T2f6MLcFQSmhtSLEc9x5g+32Uv
rHALCcLS070ekuHNPC/pS6kDoO+7TL8n8LhgvZcAQ51DqqOh1cfTuxZH78/F7eYt
J7K2c6ayW0pPkVbWOAjALxJIZpK+yWloh6AhNSg+TGfRcLOb8BJK3Migkf6jMP2N
f4AA1J7SkqO0CAmB8HPcJRxelbuNNL8pJSJDhuii7SgkyKtXp7s3p7+/OfyUZaDL
FyrhSFNpswUI2sw5xDDZOs9I/BuoRiuz/QamuKhwEm1eTJZkoT4Vt263tpoIXKyU
M4gD6lQVAQxJlQvurx1/D5+n52T1lJsR9w5U+KpcpYY6ISs9f40nnt6m5naoTDaH
WgOkK/6vr77KZ30upDe2Y4ZY9knqRg+vc2btgqSEw/jmGZMb9+R7TA6R8Ef7KM+j
E6zSRLzR8rBB3dUMhcumR9uZRBoJuI9kQvk5iD9AeFMVjQBrtA3P/M8pRc/I+QuF
Zh3y3bfbhirIpWMxUHeaDHQ0PkQchyFprIABamVhhk3Dxpm/O1gFfxxY9Jj9UsGx
awfYpmB9AKtnw+/aH3kvg6Gf234/UOqLGGKiITHhtdtMBAXjgVIeG+mQdIpOL53t
BekdMII8kA==
=Ug++
-----END PGP SIGNATURE-----
Merge tag 'io_uring-6.15-20250509' of git://git.kernel.dk/linux
Pull io_uring fixes from Jens Axboe:
- Fix for linked timeouts arming and firing wrt prep and issue of the
request being managed by the linked timeout
- Fix for a CQE ordering issue between requests with multishot and
using the same buffer group. This is a dumbed down version for this
release and for stable, it'll get improved for v6.16
- Tweak the SQPOLL submit batch size. A previous commit made SQPOLL
manage its own task_work and chose a tiny batch size, bump it from 8
to 32 to fix a performance regression due to that
* tag 'io_uring-6.15-20250509' of git://git.kernel.dk/linux:
io_uring/sqpoll: Increase task_work submission batch size
io_uring: ensure deferred completions are flushed for multishot
io_uring: always arm linked timeouts prior to issue
A single fix to prevent use of an uninitialized completion pointer when
releasing a module_kobject in specific situations.
This addresses a latent bug exposed by commit f95bbfe185 ("drivers: base:
handle module_kobject creation"), which was merged in 6.15-rc5. The fix has
been on modules-next only since yesterday but should be safe.
-----BEGIN PGP SIGNATURE-----
iQFIBAABCAAyFiEEIduBR9MnFA82q/jtumpXJwqY6poFAmgeFsAUHHBldHIucGF2
bHVAc3VzZS5jb20ACgkQumpXJwqY6po5FQgAgI+UlBRH+oMvzDCZqwoEm0anWthe
id4JiQT13HHZx1Z/27JNb2NkikqoWURdX1HGEbtfs86HfiSQZutR/nhk7Uwy0fve
i6kHvIGOtVsDxv/NX/EOVL1Foa5rTMBJoTPTYf81tvVT/PtFII90HuA38NZQXglV
DRyYncPAgJuDpayVTmKdN+VcM7+Ma7DR6WCfyhIUEJigAjm3cWxLo3F3poYLdthS
3hzun+BDay60dXZuQ8VHce8zovOs2/cQgYbw7L06y3FbGBTeBEZKEtSdb4uWh1gi
3BELNPMW1zj1rBZVCOPOHQTgAPi8uGhquLM/8onmbb8vAbzE6D+vESrY3A==
=xJA1
-----END PGP SIGNATURE-----
Merge tag 'modules-6.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux
Pull modules fix from Petr Pavlu:
"A single fix to prevent use of an uninitialized completion pointer
when releasing a module_kobject in specific situations.
This addresses a latent bug exposed by commit f95bbfe185 ("drivers:
base: handle module_kobject creation")"
* tag 'modules-6.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux:
module: ensure that kobject_put() is safe for module type kobjects
tl;dr: There is a window in the mm switching code where the new CR3 is
set and the CPU should be getting TLB flushes for the new mm. But
should_flush_tlb() has a bug and suppresses the flush. Fix it by
widening the window where should_flush_tlb() sends an IPI.
Long Version:
=== History ===
There were a few things leading up to this.
First, updating mm_cpumask() was observed to be too expensive, so it was
made lazier. But being lazy caused too many unnecessary IPIs to CPUs
due to the now-lazy mm_cpumask(). So code was added to cull
mm_cpumask() periodically[2]. But that culling was a bit too aggressive
and skipped sending TLB flushes to CPUs that need them. So here we are
again.
=== Problem ===
The too-aggressive code in should_flush_tlb() strikes in this window:
// Turn on IPIs for this CPU/mm combination, but only
// if should_flush_tlb() agrees:
cpumask_set_cpu(cpu, mm_cpumask(next));
next_tlb_gen = atomic64_read(&next->context.tlb_gen);
choose_new_asid(next, next_tlb_gen, &new_asid, &need_flush);
load_new_mm_cr3(need_flush);
// ^ After 'need_flush' is set to false, IPIs *MUST*
// be sent to this CPU and not be ignored.
this_cpu_write(cpu_tlbstate.loaded_mm, next);
// ^ Not until this point does should_flush_tlb()
// become true!
should_flush_tlb() will suppress TLB flushes between load_new_mm_cr3()
and writing to 'loaded_mm', which is a window where they should not be
suppressed. Whoops.
=== Solution ===
Thankfully, the fuzzy "just about to write CR3" window is already marked
with loaded_mm==LOADED_MM_SWITCHING. Simply checking for that state in
should_flush_tlb() is sufficient to ensure that the CPU is targeted with
an IPI.
This will cause more TLB flush IPIs. But the window is relatively small
and I do not expect this to cause any kind of measurable performance
impact.
Update the comment where LOADED_MM_SWITCHING is written since it grew
yet another user.
Peter Z also raised a concern that should_flush_tlb() might not observe
'loaded_mm' and 'is_lazy' in the same order that switch_mm_irqs_off()
writes them. Add a barrier to ensure that they are observed in the
order they are written.
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Rik van Riel <riel@surriel.com>
Link: https://lore.kernel.org/oe-lkp/202411282207.6bd28eae-lkp@intel.com/ [1]
Fixes: 6db2526c1d ("x86/mm/tlb: Only trim the mm_cpumask once a second") [2]
Reported-by: Stephen Dolan <sdolan@janestreet.com>
Cc: stable@vger.kernel.org
Acked-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Our QA team reported a 10%-23%, throughput reduction on an io_uring
sqpoll testcase doing IO to a null_blk, that I traced back to a
reduction of the device submission queue depth utilization. It turns out
that, after commit af5d68f889 ("io_uring/sqpoll: manage task_work
privately"), we capped the number of task_work entries that can be
completed from a single spin of sqpoll to only 8 entries, before the
sqpoll goes around to (potentially) sleep. While this cap doesn't drive
the submission side directly, it impacts the completion behavior, which
affects the number of IO queued by fio per sqpoll cycle on the
submission side, and io_uring ends up seeing less ios per sqpoll cycle.
As a result, block layer plugging is less effective, and we see more
time spent inside the block layer in profilings charts, and increased
submission latency measured by fio.
There are other places that have increased overhead once sqpoll sleeps
more often, such as the sqpoll utilization calculation. But, in this
microbenchmark, those were not representative enough in perf charts, and
their removal didn't yield measurable changes in throughput. The major
overhead comes from the fact we plug less, and less often, when submitting
to the block layer.
My benchmark is:
fio --ioengine=io_uring --direct=1 --iodepth=128 --runtime=300 --bs=4k \
--invalidate=1 --time_based --ramp_time=10 --group_reporting=1 \
--filename=/dev/nullb0 --name=RandomReads-direct-nullb-sqpoll-4k-1 \
--rw=randread --numjobs=1 --sqthread_poll
In one machine, tested on top of Linux 6.15-rc1, we have the following
baseline:
READ: bw=4994MiB/s (5236MB/s), 4994MiB/s-4994MiB/s (5236MB/s-5236MB/s), io=439GiB (471GB), run=90001-90001msec
With this patch:
READ: bw=5762MiB/s (6042MB/s), 5762MiB/s-5762MiB/s (6042MB/s-6042MB/s), io=506GiB (544GB), run=90001-90001msec
which is a 15% improvement in measured bandwidth. The average
submission latency is noticeably lowered too. As measured by
fio:
Baseline:
lat (usec): min=20, max=241, avg=99.81, stdev=3.38
Patched:
lat (usec): min=26, max=226, avg=86.48, stdev=4.82
If we look at blktrace, we can also see the plugging behavior is
improved. In the baseline, we end up limited to plugging 8 requests in
the block layer regardless of the device queue depth size, while after
patching we can drive more io, and we manage to utilize the full device
queue.
In the baseline, after a stabilization phase, an ordinary submission
looks like:
254,0 1 49942 0.016028795 5977 U N [iou-sqp-5976] 7
After patching, I see consistently more requests per unplug.
254,0 1 4996 0.001432872 3145 U N [iou-sqp-3144] 32
Ideally, the cap size would at least be the deep enough to fill the
device queue, but we can't predict that behavior, or assume all IO goes
to a single device, and thus can't guess the ideal batch size. We also
don't want to let the tw run unbounded, though I'm not sure it would
really be a problem. Instead, let's just give it a more sensible value
that will allow for more efficient batching. I've tested with different
cap values, and initially proposed to increase the cap to 1024. Jens
argued it is too big of a bump and I observed that, with 32, I'm no
longer able to observe this bottleneck in any of my machines.
Fixes: af5d68f889 ("io_uring/sqpoll: manage task_work privately")
Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de>
Link: https://lore.kernel.org/r/20250508181203.3785544-1-krisman@suse.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Determining the SST/MST mode during state computation must be done based
on the output type stored in the CRTC state, which in turn is set once
based on the modeset connector's SST vs. MST type and will not change as
long as the connector is using the CRTC. OTOH the MST mode indicated by
the given connector's intel_dp::is_mst flag can change independently of
the above output type, based on what sink is at any moment plugged to
the connector.
Fix the state computation accordingly.
Cc: Jani Nikula <jani.nikula@intel.com>
Fixes: f6971d7427 ("drm/i915/mst: adapt intel_dp_mtp_tu_compute_config() for 128b/132b SST")
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4607
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Imre Deak <imre.deak@intel.com>
Link: https://lore.kernel.org/r/20250507151953.251846-1-imre.deak@intel.com
(cherry picked from commit 0f45696ddb)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
When increasing the array size in memblock_double_array() and the slab
is not yet available, a call to memblock_find_in_range() is used to
reserve/allocate memory. However, the range returned may not have been
accepted, which can result in a crash when booting an SNP guest:
RIP: 0010:memcpy_orig+0x68/0x130
Code: ...
RSP: 0000:ffffffff9cc03ce8 EFLAGS: 00010006
RAX: ff11001ff83e5000 RBX: 0000000000000000 RCX: fffffffffffff000
RDX: 0000000000000bc0 RSI: ffffffff9dba8860 RDI: ff11001ff83e5c00
RBP: 0000000000002000 R08: 0000000000000000 R09: 0000000000002000
R10: 000000207fffe000 R11: 0000040000000000 R12: ffffffff9d06ef78
R13: ff11001ff83e5000 R14: ffffffff9dba7c60 R15: 0000000000000c00
memblock_double_array+0xff/0x310
memblock_add_range+0x1fb/0x2f0
memblock_reserve+0x4f/0xa0
memblock_alloc_range_nid+0xac/0x130
memblock_alloc_internal+0x53/0xc0
memblock_alloc_try_nid+0x3d/0xa0
swiotlb_init_remap+0x149/0x2f0
mem_init+0xb/0xb0
mm_core_init+0x8f/0x350
start_kernel+0x17e/0x5d0
x86_64_start_reservations+0x14/0x30
x86_64_start_kernel+0x92/0xa0
secondary_startup_64_no_verify+0x194/0x19b
Mitigate this by calling accept_memory() on the memory range returned
before the slab is available.
Prior to v6.12, the accept_memory() interface used a 'start' and 'end'
parameter instead of 'start' and 'size', therefore the accept_memory()
call must be adjusted to specify 'start + size' for 'end' when applying
to kernels prior to v6.12.
Cc: stable@vger.kernel.org # see patch description, needs adjustments for <= 6.11
Fixes: dcdfdd40fa ("mm: Add support for unaccepted memory")
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Link: https://lore.kernel.org/r/da1ac73bf4ded761e21b4e4bb5178382a580cd73.1746725050.git.thomas.lendacky@amd.com
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
- Some fixes to help with filesystem analysis: ensure superblock error
count gets written if we go ERO, don't discard the journal
aggressively (so it's available for list_journal -a).
- Fix lost wakeup on arm causing us to get stuck when reading btree
nodes.
- Fix fsck failing to exit on ctrl-c.
- An additional fix for filesystems with misaligned bucket sizes: we now
ensure that allocations are properly aligned.
- Setting background target but not promote target will now leave that
data cached on the foreground target, as it used to.
- Revert a change to when we allocate the VFS superblock, this was done
for implementing blk_holder_ops but ended up not being needed, and
allocating a superblock and not setting SB_BORN while we do recovery
caused sync() calls and other things to hang.
- Assorted fixes for harmless error messages that caused concern to
users.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEKnAFLkS8Qha+jvQrE6szbY3KbnYFAmgdDE0ACgkQE6szbY3K
bnaKJA/+LGbMm1/dxCHSXP9CVbqB4cZL+UaP+01EDLXn+EQPrc1Zrt3TZznj79HR
noCkX/L8hg8i06KNFYo4ZjARdt6Erlizoc3sy8QYKixyC3qzpiEwSt78aRufphWZ
GO0GKkWuBrUC4Fsyc3lLmwcWCSMC7s4CofGsk4aprhddvv5taSR41CB2kxVa0t2c
LFastz1kCglDWepND+1Ie6fsC3XNtd5X65bc4K7w2nS2/2Tlzcvh3If3wbNu2Edo
/XMGyHJp0pcUT2UKJUp3a88HdjSrJLY2sP1B4+shs9McYhZ3xWq0okPjfcidDA0V
eGlHpcrNMwWp4l0etROI0Qo97/jA+UTJc5uCXbReNWEdaFz0+w8VeEo1dJIGDJKR
5xLM2fkyFiar5ee7KlMdicxVMiKLgyy+V8NGUUWktLYyuoEb7bJIlnlqyxRVhCMn
cLJ6AWwv7wmw40S74VHg5tjdkflB52BiJISK5I3FL1KCyz848nUzidEhYMCsPQaw
AZJudl5FxymJMNQLKso7KyDE9ce9QbmUyQgHGDde3HkSEym1NuTNpeiMxZu/skPj
JTlG/vFefQ0DhGcIF962rOAifdHS7YJftXo54YMtIbbix+RxyLRszet9QzJJxYlz
sAQ8ncgL9hmhMZDj0ym88quLALmm3VJNcAb0TZVigf/HPX1Tx/U=
=O9KF
-----END PGP SIGNATURE-----
Merge tag 'bcachefs-2025-05-08' of git://evilpiepirate.org/bcachefs
Pull bcachefs fixes from Kent Overstreet:
- Some fixes to help with filesystem analysis: ensure superblock
error count gets written if we go ERO, don't discard the journal
aggressively (so it's available for list_journal -a)
- Fix lost wakeup on arm causing us to get stuck when reading btree
nodes
- Fix fsck failing to exit on ctrl-c
- An additional fix for filesystems with misaligned bucket sizes: we
now ensure that allocations are properly aligned
- Setting background target but not promote target will now leave that
data cached on the foreground target, as it used to
- Revert a change to when we allocate the VFS superblock, this was done
for implementing blk_holder_ops but ended up not being needed, and
allocating a superblock and not setting SB_BORN while we do recovery
caused sync() calls and other things to hang
- Assorted fixes for harmless error messages that caused concern to
users
* tag 'bcachefs-2025-05-08' of git://evilpiepirate.org/bcachefs:
bcachefs: Don't aggressively discard the journal
bcachefs: Ensure superblock gets written when we go ERO
bcachefs: Filter out harmless EROFS error messages
bcachefs: journal_shutdown is EROFS, not EIO
bcachefs: Call bch2_fs_start before getting vfs superblock
bcachefs: fix hung task timeout in journal read
bcachefs: Add missing barriers before wake_up_bit()
bcachefs: Ensure proper write alignment
bcachefs: Improve want_cached_ptr()
bcachefs: thread_with_stdio: fix spinning instead of exiting
xe_force_wake_get() is dependent on xe_pm_runtime_get(), so for
the release path, xe_force_wake_put() should be called first then
xe_pm_runtime_put().
Combine the error path and normal path together with goto.
Fixes: 85d547608e ("drm/xe/xe_gt_debugfs: Update handling of xe_force_wake_get return")
Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
Link: https://lore.kernel.org/r/20250507022302.2187527-1-shuicheng.lin@intel.com
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
(cherry picked from commit 432cd94efd)
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
The workqueue used for the reset worker is marked as WQ_MEM_RECLAIM,
while the GSC one isn't (and can't be as we need to do memory
allocations in the gsc worker). Therefore, we can't flush the latter
from the former.
The reason why we had such a flush was to avoid interrupting either
the GSC FW load or in progress GSC proxy operations. GSC proxy
operations fall into 2 categories:
1) GSC proxy init: this only happens once immediately after GSC FW load
and does not support being interrupted. The only way to recover from
an interruption of the proxy init is to do an FLR and re-load the GSC.
2) GSC proxy request: this can happen in response to a request that
the driver sends to the GSC. If this is interrupted, the GSC FW will
timeout and the driver request will be failed, but overall the GSC
will keep working fine.
Flushing the work allowed us to avoid interruption in both cases (unless
the hang came from the GSC engine itself, in which case we're toast
anyway). However, a failure on a proxy request is tolerable if we're in
a scenario where we're triggering a GT reset (i.e., something is already
gone pretty wrong), so what we really need to avoid is interrupting
the init flow, which we can do by polling on the register that reports
when the proxy init is complete (as that ensure us that all the load and
init operations have been completed).
Note that during suspend we still want to do a flush of the worker to
make sure it completes any operations involving the HW before the power
is cut.
v2: fix spelling in commit msg, rename waiter function (Julia)
Fixes: dd0e89e5ed ("drm/xe/gsc: GSC FW load")
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4830
Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
Cc: John Harrison <John.C.Harrison@Intel.com>
Cc: Alan Previn <alan.previn.teres.alexis@intel.com>
Cc: <stable@vger.kernel.org> # v6.8+
Reviewed-by: Julia Filipchuk <julia.filipchuk@intel.com>
Link: https://lore.kernel.org/r/20250502155104.2201469-1-daniele.ceraolospurio@intel.com
(cherry picked from commit 12370bfcc4)
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
For an unknown reason the math to determine the PF queue size does is
not correct - compute UMD applications are overflowing the PF queue
which is fatal. A multippier of 8 fixes the problem.
Fixes: 3338e4f90c ("drm/xe: Use topology to determine page fault queue size")
Cc: stable@vger.kernel.org
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Jagmeet Randhawa <jagmeet.randhawa@intel.com>
Link: https://lore.kernel.org/r/20250408155915.78770-1-matthew.brost@intel.com
(cherry picked from commit 29582e0ea7)
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
- Fix an issue in vfio-pci huge_fault handling by aligning faults to
the order, resulting in deterministic use of huge pages. This
avoids a race where simultaneous aligned and unaligned faults to
the same PMD can result in a VM_FAULT_OOM and subsequent VM crash.
(Alex Williamson)
-----BEGIN PGP SIGNATURE-----
iQJPBAABCAA5FiEEQvbATlQL0amee4qQI5ubbjuwiyIFAmgc4NEbHGFsZXgud2ls
bGlhbXNvbkByZWRoYXQuY29tAAoJECObm247sIsiD0YQAIXheISbFEJA+PAGIMgf
aMYHU8yfl9KudaR/0aufI8ex2pkEBZUIMVz2YT58f0p3dkgvGFgcGO4k+qBmZb+U
a9eAy0aYJKCWq2s5PdbAvkiT7IiCzvXDRj/o5AjAAXv8K/PcLSZQVScPyaWjG4+g
APvhPxdFyM2SrHDIevXXNHDLGXj5SZZzlJCnE8Koxce9rgrZOqweK3yodE559Pve
M8gspOpXlrfBIC/EuCxAh5djL0toY5KPNkCsXyjIoIkrVMz5qE9MbJ35fykQ0AL2
p5UgsPWOABt7gbmHZ13Ce2Lkz07pq3ZpcI+7ZiyBiDzV6d/XyWL13jrRhWK+MyIV
yi8Q5+W1I9HAfaAWyxNQf22uzcnCMmTbnExo2Muw2eBnAkfLFZXrisx4yzaDT83c
98cKWXBB0MRj7N7DXieaG3uv0YcE5sfkE5mOaqzyytvddVJleALWJe87cCqkCgyt
/hAddSOW/muo06fETMH70qK3vohdCC+2CbZ8PJVGKYwKrbculhduMYK7Ll5EmAFY
YMCPYVn9/qFttSqn9+wPOLVAgbpbHtHrZnPtHiGR0SiEDxsR84IngyU1wxipoFr2
WEkq0QfhJcyClp8bIbF1+vulstkITqeCmPMWZMpgSUdyG14Nj/Tk8unK/ekKLibb
+mpBiXxtba0Z7P5IjIuQd7le
=rMiX
-----END PGP SIGNATURE-----
Merge tag 'vfio-v6.15-rc6' of https://github.com/awilliam/linux-vfio
Pull vfio fix from Alex Williamson:
- Fix an issue in vfio-pci huge_fault handling by aligning faults to
the order, resulting in deterministic use of huge pages. This
avoids a race where simultaneous aligned and unaligned faults to
the same PMD can result in a VM_FAULT_OOM and subsequent VM crash.
(Alex Williamson)
* tag 'vfio-v6.15-rc6' of https://github.com/awilliam/linux-vfio:
vfio/pci: Align huge faults to order
- A fix to handle compressed halfword load/store instructions misaligned accesses
- A fix to allow user memory access while handling a misaligned access
- 2 fixes to return an error if the pointer masking extension is not implemented on the platform but userspace still tries to access it, which caused oops on some early platforms
- A fix to prevent the stripping of .rela.dyn so that a vmlinux loaded by kexec can successfully boot
-----BEGIN PGP SIGNATURE-----
iHUEABYIAB0WIQQgN2CKhD/Nf5v80u9kP7K8koXvigUCaBydcwAKCRBkP7K8koXv
ivskAP0Shl3co28ajBZRwMbc5Si4UC3TfqN7edN56KgLFZystQEAv+ObGpydANB7
AXhg4uGUOOQDtC2d/Hdr71Ms0eOpiQo=
=wXDY
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQJHBAABCAAxFiEEAM520YNJYN/OiG3470yhUCzLq0EFAmgc3oETHHBhbG1lckBk
YWJiZWx0LmNvbQAKCRDvTKFQLMurQW0RD/4iI/q6TGBjWullYOBRmJNWQGs0vux/
ZoGH9IoB6/AwSxnzMvk3fx81vK95Bg+cO44aRaLG+FtSUDlNMfdxPVPCEMBh1vqJ
MBAjppglVI0dfGcKZC42m+cnfg5TNWr2mTKFk2CCWITbVkaZDFKSuoBJnxmL+HtR
K36L8mW3i9xBpllaw+N2yk5V10Ep1q8Rq4m3sOkokMX6fRpvWmBCy6aMsIYy5FaA
5kEaVQ8Kb5LBfB4MjSdCX7XzZMiR3TZEfOGD32uwHjMFmajSuHSn7SJYeCdIW0wH
7YNoqOzJ+1ojRKIa16JYllzLOx9bhHdFI0nHSDB295293U/C5x+DsIyW5Aa5j/Su
TAWCvjlKmFopeDXFTrFI7Oi54Z1+jENNa57uinpgNRWtFZIy3/OSWEPib6QYL4sh
Jn23pituwm6J56IW23vrpxTxupp5R5SEYeIBVUTvozWNM96ZBsYOX0Z9d/GTBJDL
Hu/yGPHIHQJ7+GmCzcwRKvDPX+ndEGWq9iflG1umgKZ65dotnhSTuOKL7Suu2h60
KXsEdjda9LcS7WU2GiOVz0/Kj5h7DQvJ9EiYvLiOyMqv8iS5iSgxznQYl8GgLnsn
qcdKC+T8cnW3jJimv64A7L3deoaFDzQC3N7QBrU/DRib5/Aos7Z0f+w7XcHxBpy2
dXUDxRIrrCkR7Q==
=5iWu
-----END PGP SIGNATURE-----
Merge tag 'riscv-fixes-6.15-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/alexghiti/linux into fixes
riscv fixes for 6.15-rc6
- A fix to handle compressed halfword load/store instructions misaligned accesses
- A fix to allow user memory access while handling a misaligned access
- 2 fixes to return an error if the pointer masking extension is not implemented on the platform but userspace still tries to access it, which caused oops on some early platforms
- A fix to prevent the stripping of .rela.dyn so that a vmlinux loaded by kexec can successfully boot
* tag 'riscv-fixes-6.15-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/alexghiti/linux:
riscv: Disallow PR_GET_TAGGED_ADDR_CTRL without Supm
scripts: Do not strip .rela.dyn section
riscv: Fix kernel crash due to PR_SET_TAGGED_ADDR_CTRL
riscv: misaligned: use get_user() instead of __get_user()
riscv: misaligned: enable IRQs while handling misaligned accesses
riscv: misaligned: factorize trap handling
riscv: misaligned: Add handling for ZCB instructions
We have still a comple of regressions open due to the recent
drivers locking refactor. The patches are in-flight, but not
ready yet.
Current release - regressions:
- core: lock netdevices during dev_shutdown
- sch_htb: make htb_deactivate() idempotent
- eth: virtio-net: don't re-enable refill work too early
Current release - new code bugs:
- eth: icssg-prueth: fix kernel panic during concurrent Tx queue access
Previous releases - regressions:
- gre: fix again IPv6 link-local address generation.
- eth: b53: fix learning on VLAN unaware bridges
Previous releases - always broken:
- wifi: fix out-of-bounds access during multi-link element defragmentation
- can:
- initialize spin lock on device probe
- fix order of unregistration calls
- openvswitch: fix unsafe attribute parsing in output_userspace()
- eth: virtio-net: fix total qstat values
- eth: mtk_eth_soc: reset all TX queues on DMA free
- eth: fbnic: firmware IPC mailbox fixes
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-----BEGIN PGP SIGNATURE-----
iQJGBAABCAAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmgcsVkSHHBhYmVuaUBy
ZWRoYXQuY29tAAoJECkkeY3MjxOkSbAP/2z4masWpIdjaKqatxs071/RTmGps1Lw
YSI8YJugdt65J044m0DtIsNVbaKAL1C3q2msu/u27b68fL2jrP1Ulp61+6CFOOGm
MbRK60ibcJOMGC8gc4zVXvP7DsA/ZPWbUSlizjmQPiGC/PFimsbxTOVpK6Nzavrg
7x1Cs01vHjmkcWb/QAsVQAgM+StvtKBhUR4alVB6V5AsK1s5LAHPFj+NKyPDIyTr
OEQ8qvcuP9EDWwssr7Uoaijlkzo8jS8DcHZQZSup3MROVa8mLJm+fzg6rbKzxJnM
wEZAA7AVtnMiGeeuguBQVHFuVLDCl8iXNkC9EA14ARyUtr5cGTURzhDg+qqYCKhm
n/0q/mwy6QbmETQjbQK92z2uihVJlNw/ignwH/yllkok/X6eSHxtgJV8A6VHxBOa
YoJUh1nOmnhE0IgI/xS/wzaRFLb7+F6YE4DLuSBSm8/k+PHpx/pShIyHGtn8fyIj
HHl6g06UmR8/px2clUTk0Xxnksa6iiETEl8UCJW58NReaHIbqnBfjwEnqk+AiAmV
tfhn1EKKi7CcOWeHVZZro2RVCgSqwAXvtgYIms7pDbEvruKQJbaVxHIJR49wTDOd
T+dm7frnmiIJrNUVAJnS6hg00LHySztrizu/4V5WimdROY5dhnN8uJ/+JRC8LDXE
ou66UUpj4gdg
=8E6K
-----END PGP SIGNATURE-----
Merge tag 'net-6.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Paolo Abeni:
"Including fixes from CAN, WiFi and netfilter.
We have still a comple of regressions open due to the recent
drivers locking refactor. The patches are in-flight, but not
ready yet.
Current release - regressions:
- core: lock netdevices during dev_shutdown
- sch_htb: make htb_deactivate() idempotent
- eth: virtio-net: don't re-enable refill work too early
Current release - new code bugs:
- eth: icssg-prueth: fix kernel panic during concurrent Tx queue
access
Previous releases - regressions:
- gre: fix again IPv6 link-local address generation.
- eth: b53: fix learning on VLAN unaware bridges
Previous releases - always broken:
- wifi: fix out-of-bounds access during multi-link element
defragmentation
- can:
- initialize spin lock on device probe
- fix order of unregistration calls
- openvswitch: fix unsafe attribute parsing in output_userspace()
- eth:
- virtio-net: fix total qstat values
- mtk_eth_soc: reset all TX queues on DMA free
- fbnic: firmware IPC mailbox fixes"
* tag 'net-6.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (55 commits)
virtio-net: fix total qstat values
net: export a helper for adding up queue stats
fbnic: Do not allow mailbox to toggle to ready outside fbnic_mbx_poll_tx_ready
fbnic: Pull fbnic_fw_xmit_cap_msg use out of interrupt context
fbnic: Improve responsiveness of fbnic_mbx_poll_tx_ready
fbnic: Cleanup handling of completions
fbnic: Actually flush_tx instead of stalling out
fbnic: Add additional handling of IRQs
fbnic: Gate AXI read/write enabling on FW mailbox
fbnic: Fix initialization of mailbox descriptor rings
net: dsa: b53: do not set learning and unicast/multicast on up
net: dsa: b53: fix learning on VLAN unaware bridges
net: dsa: b53: fix toggling vlan_filtering
net: dsa: b53: do not program vlans when vlan filtering is off
net: dsa: b53: do not allow to configure VLAN 0
net: dsa: b53: always rejoin default untagged VLAN on bridge leave
net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave
net: dsa: b53: fix flushing old pvid VLAN on pvid change
net: dsa: b53: fix clearing PVID of a port
net: dsa: b53: keep CPU port always tagged again
...
-----BEGIN PGP SIGNATURE-----
iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmgcFAMACgkQiiy9cAdy
T1EIYQv9FUOa+A86sVkOunLFw0h0+F28lrHKzRvzm3hMqOzOvY79sZv1bdltgWm/
4yy0kT+gmmrHxH4aka2oegt3pOSTjJgpJsgzDNddg/FLHP9u1p39qr++7FZjsTg1
+rly6N1fdsfaVbxSUNXyq+VzszqPJLYfKgGRlX/8LgS0z/U1hI9h24GP0u1kfS/l
ScKlA+Kvt59dmQ5W2exg6DMMQGP6Q79SbobpdN9AKO4cpxFDQCIIoe1hzGc8S5h3
FjH/pVC+J/xBdVLQFFvpuNxU/uCx7YmvqdG9WeYTKxOyfmcI203eHuBwYwdi8khm
h/UNh0R3w83WDHkAB9KdHac2LPO6agJgz1ED37fN0G7bmxVwavSRX19roCNlaoQV
zLqSYpaHsCv2zcvKwhDJwdjtfUTncfXnzVDGSid5AEF4amOQhKBmXJUXS/BflN36
AgowoLZ8Sg7wa1VCWHHADaga4FPVSszWetEQ3yx+YEqlzgf2R5TtqVaZe73EFPwb
eEJKmV86
=soic
-----END PGP SIGNATURE-----
Merge tag 'v6.15-rc5-ksmbd-server-fixes' of git://git.samba.org/ksmbd
Pull smb server fixes from Steve French:
- Fix UAF closing file table (e.g. in tree disconnect)
- Fix potential out of bounds write
- Fix potential memory leak parsing lease state in open
- Fix oops in rename with empty target
* tag 'v6.15-rc5-ksmbd-server-fixes' of git://git.samba.org/ksmbd:
ksmbd: Fix UAF in __close_file_table_ids
ksmbd: prevent out-of-bounds stream writes by validating *pos
ksmbd: fix memory leak in parse_lease_state()
ksmbd: prevent rename with empty string
- unblock ctrl state transition for firmware update (Daniel Wagner)
-----BEGIN PGP SIGNATURE-----
iQI/BAABCgApFiEEgdbnc3r/njty3Iq9D55TZVIEUYMFAmgcyH0LHGhjaEBsc3Qu
ZGUACgkQD55TZVIEUYN+4xAAsiuDNOrV1Y3SlDdCz78SsFhs5ylQ3PtUO1qdca56
yrXv41sAbvkkqPvB29UgqlGD/sbY6KbA3tbZ2Q081nweKOuVrI6n3eNzcguIaA2X
I9UmojBxphhefR5APsMtY4FpDzks+cCeqmGK+fRGZ3fMdq4vc6qoOpmTkg+cT0lr
1F3N6Mai8D3RZovH2Z23EpWiHiJOFX3qbFxPhNL43ekC3Lx0DlUJmfLl+GMWUJu/
hEX77/c/4g0k3uitrTY1nebZ3/Zt0y9QOlM9hOoDQfRplQ40L9HeJfwavVkrw0jB
4PSRSeLNI3ONo/tnAz7fxfnsWou+jBDDHgHnWKWvOYMr4enWATWwpI9W2lckhVuS
b1OLmAPDb1e7IRgvCSmorkD88SJlbddyifbHNlzyY16nP1PuvKqWtU229CTIm4A3
4dJqL3ZbA2sEW5usXGq+SuaxJjEvU8lQv/5uz1Rsixn5wYVoI13qPhNlQUNAoX9i
WNynScKV5LIxafB+sVRlN9dWlcWiXcuQ5Ip8jdRyCdbDd/9u/C6qIx+RFfcm1OJt
rqKttrSKzqdwDYmbHuhec48JZw3NbfGp1lxfH8MrMj3PAF5dq54/W3wdgJXZpnvH
h8rHzt8gT2DXLv0iF0McC6m9PAdJXrqQ6kdVlErRT35KwFT6jagvncZ5p3ZhBaVg
7ho=
=63LF
-----END PGP SIGNATURE-----
Merge tag 'nvme-6.15-2025-05-08' of git://git.infradead.org/nvme into block-6.15
Pull NVMe fix from Christoph:
"nvme fixes for linux 6.15
- unblock ctrl state transition for firmware update (Daniel Wagner)"
* tag 'nvme-6.15-2025-05-08' of git://git.infradead.org/nvme:
nvme: unblock ctrl state transition for firmware update
Ever since commit eca2040972b4("scsi: block: ioprio: Clean up interface
definition"), the macro IOPRIO_PRIO_LEVEL() will mask the level value to
something between 0 and 7 so necessarily, level will always be lower than
IOPRIO_NR_LEVELS(8).
Remove this obsolete check.
Reported-by: Kexin Wei <ys.weikexin@h3c.com>
Cc: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Aaron Lu <ziqianlu@bytedance.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20250508083018.GA769554@bytedance
Signed-off-by: Jens Axboe <axboe@kernel.dk>
When the prctl() interface for pointer masking was added, it did not
check that the pointer masking ISA extension was supported, only the
individual submodes. Userspace could still attempt to disable pointer
masking and query the pointer masking state. commit 81de1afb2dd1
("riscv: Fix kernel crash due to PR_SET_TAGGED_ADDR_CTRL") disallowed
the former, as the senvcfg write could crash on older systems.
PR_GET_TAGGED_ADDR_CTRL state does not crash, because it reads only
kernel-internal state and not senvcfg, but it should still be disallowed
for consistency.
Fixes: 09d6775f50 ("riscv: Add support for userspace pointer masking")
Signed-off-by: Samuel Holland <samuel.holland@sifive.com>
Reviewed-by: Nam Cao <namcao@linutronix.de>
Link: https://lore.kernel.org/r/20250507145230.2272871-1-samuel.holland@sifive.com
Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
The .rela.dyn section contains runtime relocations and is only emitted
for a relocatable kernel.
riscv uses this section to relocate the kernel at runtime but that section
is stripped from vmlinux. That prevents kexec to successfully load vmlinux
since it does not contain the relocations info needed.
Fixes: 559d1e45a1 ("riscv: Use --emit-relocs in order to move .rela.dyn in init")
Tested-by: Björn Töpel <bjorn@rivosinc.com>
Reviewed-by: Björn Töpel <bjorn@rivosinc.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20250408072851.90275-1-alexghiti@rivosinc.com
Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
When userspace does PR_SET_TAGGED_ADDR_CTRL, but Supm extension is not
available, the kernel crashes:
Oops - illegal instruction [#1]
[snip]
epc : set_tagged_addr_ctrl+0x112/0x15a
ra : set_tagged_addr_ctrl+0x74/0x15a
epc : ffffffff80011ace ra : ffffffff80011a30 sp : ffffffc60039be10
[snip]
status: 0000000200000120 badaddr: 0000000010a79073 cause: 0000000000000002
set_tagged_addr_ctrl+0x112/0x15a
__riscv_sys_prctl+0x352/0x73c
do_trap_ecall_u+0x17c/0x20c
andle_exception+0x150/0x15c
Fix it by checking if Supm is available.
Fixes: 09d6775f50 ("riscv: Add support for userspace pointer masking")
Signed-off-by: Nam Cao <namcao@linutronix.de>
Cc: stable@vger.kernel.org
Reviewed-by: Samuel Holland <samuel.holland@sifive.com>
Link: https://lore.kernel.org/r/20250504101920.3393053-1-namcao@linutronix.de
Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
