| Age | Commit message (Collapse) | Author |
|---|
|
Wire the read-only nilfs_iomap_ops added in the previous patch into
the O_DIRECT read path, and eliminate blockdev_direct_IO() from
nilfs2 entirely:
- nilfs_file_open() now sets FMODE_CAN_ODIRECT explicitly, since
permission to open the file O_DIRECT was previously implied by
aops->direct_IO being non-NULL.
- nilfs_file_read_iter() dispatches O_DIRECT reads to iomap_dio_rw()
using nilfs_iomap_ops; everything else still goes through
generic_file_read_iter() as before.
- nilfs_file_write_iter() strips IOCB_DIRECT and falls through to
generic_file_write_iter()'s ordinary buffered path. NILFS2 cannot
perform true direct I/O writes: new blocks are delay-allocated and
only given a real disk address by the segment constructor, which
works on buffer_head lists, not iomap. This reproduces today's
actual behavior: the old nilfs_direct_IO() already just returned 0
for WRITE.
- nilfs_direct_IO() and the .direct_IO callback on nilfs_aops are
removed.
- drop the unnecessary "select LEGACY_DIRECT_IO" from Kconfig
in favor of "select FS_IOMAP".
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://patch.msgid.link/20260724222745.2107464-3-slava@dubeyko.com
Acked-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
cc: Christoph Hellwig <hch@lst.de>
cc: Ryusuke Konishi <konishi.ryusuke@gmail.com>
cc: linux-nilfs@vger.kernel.org
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
Add iomap.c and iomap.h with a read-only nilfs_iomap_ops,
wrapping the existing nilfs_bmap_lookup_contig() lookup
to report a mapped range, a real hole, or an EOF-clamped
range to iomap core.
NILFS2 is a log-structured, copy-on-write filesystem:
newly allocated blocks are only given a real disk address
when the segment constructor writes them out as part of a log,
which walks buffer_head lists directly and is not integrated
with the generic address_space writeback path. Because of that,
only the read-only side of the mapping is added - buffered writes,
writeback, and mmap's ->page_mkwrite() will stay on the existing
buffer_head based path (nilfs_get_block(), nilfs_write_begin/end(),
nilfs_writepages(), nilfs_dirty_folio(), block_page_mkwrite()).
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://patch.msgid.link/20260724222745.2107464-2-slava@dubeyko.com
Acked-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
cc: Christoph Hellwig <hch@lst.de>
cc: Ryusuke Konishi <konishi.ryusuke@gmail.com>
cc: linux-nilfs@vger.kernel.org
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
ntfs_ir_to_ib copies all entries from index_root into a freshly allocated
index_block_size-byte buffer without verifying that the entries fit in the
available space. The entries in index_root may be larger than the usable
entry space in the index block.
This can cause OOB writes past the end of the allocation.
The validator ntfs_index_root_inconsistent() checks that entries are
self-consistent within the IR value, but never cross-checks them against
index_block_size. There is no bounds check in ntfs_ir_to_ib() before the
memcpy.
Fixing this at the sink in ntfs_ir_to_ib() since
ntfs_index_root_inconsistent() validates the logical consistency of
index_root as a structure and a root with large entries is a structurally
valid root. The bug is a size conflict of ntfs_ir_to_ib().
Also, the validator is called once per inode load in
ntfs_read_locked_inode() while ntfs_ir_to_ib() is only called during a
reparent, a check there adds no overhead to the common path.
Moreover, even a future call path that bypasses the validator would still
be protected.
With NULL as first parameter of ntfs_error(), the volume error flag is
never set by this call, so the device name will be absent from the error
message. In any case, that the caller, ntfs_ir_reparent(), prints an error
message that includes the device name on NULL returns.
I think this is the best solution available without adding
'struct super_block *sb' as a parameter to ntfs_ir_to_ib().
This heap out-of-bounds write is triggered by a crafted filesystem image,
which is not in the kernel threat model, anyway, fixing memory errors would
be nice to keep things secure.
Fixes: 0a8ac0c1fa0b ("ntfs: update directory operations")
Signed-off-by: Alexandro Calo <alexandro.calo@nozominetworks.com>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
ntfs_new_attr_flags() resizes the non-resident attribute record before
moving its name and mapping pairs to their shorter-header offsets when
compression or sparse state is cleared.
Shrinking the record first moves the following attribute over the tail of
the old record. The subsequent memmove() therefore copies bytes from that
following attribute instead of the old mapping pairs. Re-enabling
compression on an empty file persists those bytes as a malformed mapping
pairs array, which ntfsck reports as a missing or invalid run length.
Move the payload before shrinking the record, while retaining the existing
resize-before-move ordering when growing it.
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
When setting sparse/compressed flags on a resident attribute, the
function skipped the resident-to-non-resident conversion and
terminated.
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
ntfs_compress_write() reads every page in a compression unit before copying
new data into it. The read is unnecessary when an aligned write replaces
every byte covered by the page-cache folios.
Detect full page-aligned compression unit overwrites and grab locked cache
folios without reading them. Keep the read-modify-write path for partial
units and units that cover only part of a large page.
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
ntfs_write_cb() allocates a single-vector bio and synchronously submits it
whenever another output page cannot be added. A 64 KiB uncompressed unit
therefore requires up to sixteen separate bio submissions.
Allocate enough vectors for the complete unit, add all output pages, and
perform one synchronous submission.
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
ntfs_write_cb() allocates output pages and creates input and output
vmaps for every compression unit. Sequential writes repeatedly pay
those allocation and page-table costs even though each unit has the
same maximum output size.
Allocate and map the output workspace once per write request. Access
input sub-blocks with kmap_local_page(), and reuse the output pages and
mapping for every compression unit in the request.
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
ntfs_compress_block() allocates and initializes a roughly 40 KiB match
finder context for every 4 KiB sub-block. A 64 KiB compression unit thus
performs sixteen large allocations even though the calls are serialized.
Allocate one context for the complete write request and reset its hash
chains for each sub-block as before.
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
The write iterator now expands attributes before calling
ntfs_compress_write(), so compressed writes must not expand the
attribute themselves. However, the compressed path still needs to reject
zero-byte iterator copies, advance initialized_size after successful I/O,
and invalidate modified folios after a failed compression-unit write.
Reject no-progress copies, persist the new initialized size on success,
and clear folio uptodate state when the synchronous write fails.
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
ntfs_write_cb() punches the old compression unit and publishes the new
mapping before submitting the replacement data. An allocation or I/O
failure after the punch loses the previous contents and can leave the
mapping pointing at unwritten clusters.
Allocate and write the replacement clusters first. Replace the runlist only
after the synchronous write succeeds, and free new clusters on failure.
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
When a rewritten compression block consists entirely of zeroes,
ntfs_write_cb() returns without replacing its existing runlist mapping.
The old on-disk contents therefore remain visible after cache eviction.
Punch the compression unit so that reads resolve it as a sparse block and
release any clusters that held the previous contents.
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
ntfs_compress_write() derives its page count by shifting the compression
block size and assumes that every compression block begins at a page
boundary. This produces a zero page count for small compression blocks on
large-page systems and ignores an in-page compression block offset.
Map every page covering the compression block, pass the in-page offset to
ntfs_write_cb(), and stage uncompressed output in page-aligned pages.
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
ntfs_compress_block() returns -ENOMEM when its compression context cannot
be allocated, but its unsigned return type turns the error into a large
positive value. ntfs_write_cb() then hides the allocation failure.
Use a signed return type and propagate negative errors to the caller.
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
Both branches of the check return the same value, so the check has
no effect. Remove it and return the value directly.
This is the result of running the Coccinelle script from
scripts/coccinelle/misc/cond_return_no_effect.cocci.
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
|
|
Convert the Kconfig option of every MediaTek pinctrl SoC driver from bool
to tristate and add MODULE_DESCRIPTION()/MODULE_LICENSE() so that they can
be built as loadable kernel modules.
This is required for Android GKI + vendor_dlkm deployments, where
vendor-specific drivers must be kept separate from the GKI vmlinux and
loaded as modules from the vendor partition.
Signed-off-by: Justin Yeh <justin.yeh@mediatek.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
[linusw@kernel.org: Rebased and added MT6858]
Signed-off-by: Linus Walleij <linusw@kernel.org>
|
|
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
* soc/arm:
ARM: lpc32xx: remove a few manually populated OF devices
ARM: lpc32xx: only run SoC init on LPC32xx hardware
|
|
* soc/dt: (28 commits)
arm64: dts: renesas: r9a09g047: Fix PCIe dma-ranges memory space code
arm64: dts: renesas: r9a09g056: Fix PCIe dma-ranges memory space code
arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Enable PCIe
arm64: dts: renesas: r9a09g057: Add PCIe nodes
ARM: dts: renesas: r9a06g032-rzn1d400-eb: Enable SPI-FRAM
ARM: dts: renesas: r9a06g032: Describe SPI controllers
arm64: dts: renesas: rzt2h-n2h-evk-common: Add memory nodes
arm64: dts: renesas: Add soc: labels to soc nodes
arm64: dts: renesas: r9a09g047e57-smarc: Add DA7212 audio codec support
arm64: dts: renesas: rzg3e-smarc-som: Add audio pinmux definitions
arm64: dts: renesas: rzg3e-smarc-som: Add Versa3 clock generator
arm64: dts: renesas: r9a09g047: Add RZ/G3E Sound support
arm64: dts: renesas: r8a77965-ulcb: Enable GPU support
arm64: dts: renesas: r8a77965-salvator-xs: Enable GPU support
arm64: dts: renesas: r8a77965-salvator-x: Enable GPU support
ARM: dts: renesas: r8a7740: Add FSI clocks
arm64: dts: renesas: r9a09g047: Add max-frequency to SDHI nodes
arm64: dts: renesas: r9a09g047e57-smarc: Drop SW_SER0_PMOD condition for rsci4
arm64: dts: renesas: r8a779g0: Add MFIS node
arm64: dts: renesas: r8a78000: Enable application CPU cores via PSCI
...
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt
Renesas DTS updates for v7.3
- Add sound support for the RZ/G3E SoC and the RZ/G3E SMARC EVK board,
- Add more serial and SPI support for the RZ/G3L SoC and the RZ/G3L
SMARC EVK board,
- Add SMP support (32x Cortex-A720AE) for the R-Car X5H SoC,
- Add hwspinlock and mailbox (MFIS) support for the R-Car V4H SoC,
- Add GPU support for R-Car M3-N-based Salvator-X(S) and ULCB
development boards,
- Add SPI and FRAM support for the RZ/N1D SoC and the RZN1D Expansion
Board,
- Add PCIe support for the RZ/V2H SoC and the RZ/V2H EVK development
board,
- Miscellaneous fixes and improvements.
* tag 'renesas-dts-for-v7.3-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: (29 commits)
arm64: dts: renesas: r9a09g047: Fix PCIe dma-ranges memory space code
arm64: dts: renesas: r9a09g056: Fix PCIe dma-ranges memory space code
arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Enable PCIe
arm64: dts: renesas: r9a09g057: Add PCIe nodes
ARM: dts: renesas: r9a06g032-rzn1d400-eb: Enable SPI-FRAM
ARM: dts: renesas: r9a06g032: Describe SPI controllers
arm64: dts: renesas: rzt2h-n2h-evk-common: Add memory nodes
arm64: dts: renesas: Add soc: labels to soc nodes
arm64: dts: renesas: r9a09g047e57-smarc: Add DA7212 audio codec support
arm64: dts: renesas: rzg3e-smarc-som: Add audio pinmux definitions
arm64: dts: renesas: rzg3e-smarc-som: Add Versa3 clock generator
arm64: dts: renesas: r9a09g047: Add RZ/G3E Sound support
arm64: dts: renesas: r8a77965-ulcb: Enable GPU support
arm64: dts: renesas: r8a77965-salvator-xs: Enable GPU support
arm64: dts: renesas: r8a77965-salvator-x: Enable GPU support
ARM: dts: renesas: r8a7740: Add FSI clocks
arm64: dts: renesas: r9a09g047: Add max-frequency to SDHI nodes
arm64: dts: renesas: r9a09g047e57-smarc: Drop SW_SER0_PMOD condition for rsci4
arm64: dts: renesas: r8a779g0: Add MFIS node
arm64: dts: renesas: r8a78000: Enable application CPU cores via PSCI
...
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
The DSI attach error path calls drm_panel_remove() by hand even though
the panel was registered with devm_drm_panel_add(), which already
arranges for drm_panel_remove() to run on driver detach. When
mipi_dsi_attach() fails the panel is therefore removed twice: once
directly and once again while devres unwinds.
drm_panel_add() takes a reference and drm_panel_remove() drops one, so
the extra removal releases the last reference early and frees the panel
container. The put registered by devm_drm_panel_alloc() then operates on
freed memory, resulting in a use-after-free and a reference-count
underflow when a DSI host rejects the requested configuration during
probe.
Drop the manual drm_panel_remove() and let the managed cleanup handle
it, matching the other dual-DSI panel drivers.
Fixes: 75a5dbd1f4f7 ("drm/panel: Add Novatek NT36536 panel driver")
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Pengyu Luo <mitltlatltl@gmail.com>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260724041746.12887-1-devnexen@gmail.com
|
|
Add support for the Ampire AM-800480N3TZQW-00H 5" WVGA TFT LCD panel.
Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260723-support-am-800480n3tzqw-00h-v1-2-6a4ae0575a19@bootlin.com
|
|
Add compatible for the AM-800480N3TZQW-00H from Ampire Co. Ltd.
Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260723-support-am-800480n3tzqw-00h-v1-1-6a4ae0575a19@bootlin.com
|
|
Add support for the lower (secondary) panel of the AYANEO Pocket DS, a
dual-screen QCS8550 (Snapdragon 8 Gen 2) handheld. It is a 5.0" 1024x768
4:3 IPS LCD driven by a Sitronix ST7703 DDIC: every command in the vendor
init sequence maps to an ST7703 manufacturer command (SETEXTC, SETMIPI,
SETRGBIF, SETSCR, SETPOWER, SETGAMMA, SETGIP1/2), and the SETMIPI and
SETRGBIF payloads are near-identical to the already-supported Powkiddy
RGB10MAX3.
The panel is mounted in portrait (768x1024) and rotated 270 degrees in
the device, expressed through the panel rotation property. The SETEXTC
unlock password ends in 0x87 rather than the canonical 0x83; this is the
value shipped by the vendor firmware and is kept verbatim.
Init sequence extracted from the AYANEO Pocket DS BSP kernel, via the
ROCKNIX SM8550 port.
Signed-off-by: Alexandre Hamamdjian <azkali.limited@gmail.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260723-b4-st7703-pocketds-lower-v1-2-e3db246589f4@gmail.com
|
|
The lower (secondary) 5.0" 1024x768 IPS LCD panel of the AYANEO Pocket DS
dual-screen handheld is driven by a Sitronix ST7703 DDIC, as identified
by its ST7703 manufacturer command set (SETEXTC 0xB9, SETMIPI 0xBA,
SETGIP1/2 0xE9/0xEA). Document its compatible alongside the other ST7703
panels.
Signed-off-by: Alexandre Hamamdjian <azkali.limited@gmail.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260723-b4-st7703-pocketds-lower-v1-1-e3db246589f4@gmail.com
|
|
The DCLTek dt300250 is a LCD panel using the jd9365da controller.
Add the panel to the driver.
Suggested-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Marc-Olivier Champagne <marc-olivier.champagne@savoirfairelinux.com>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260722173840.3576444-5-marc-olivier.champagne@savoirfairelinux.com
|
|
The DCLTek dt300250 is a panel using the jadard-jd9365da controller.
Add a new compatible for it.
Suggested-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Marc-Olivier Champagne <marc-olivier.champagne@savoirfairelinux.com>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260722173840.3576444-4-marc-olivier.champagne@savoirfairelinux.com
|
|
Add DCL Technologies Inc. (DCLTEK) to the devicetree vendor prefixes
registry.
Link: https://www.dcltek.com/
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Marc-Olivier Champagne <marc-olivier.champagne@savoirfairelinux.com>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260722173840.3576444-3-marc-olivier.champagne@savoirfairelinux.com
|
|
The JD9365DA-H3 uses DSI LPM for command transmissions, make sure
this is configured correctly in the DSI mode flags.
Suggested-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Marc-Olivier Champagne <marc-olivier.champagne@savoirfairelinux.com>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260722173840.3576444-2-marc-olivier.champagne@savoirfairelinux.com
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground into gpio/for-next
gpio: legacy interface cleanups for 7.3
These are the remaining patches for legacy gpio interface
cleanup, ensuring that files referencing them are sure to
have CONFIG_GPIOLIB_LEGACY set, and use linux/gpio/legacy.h
instead of the old linux/gpio.h header.
There are a few more patches already merged in other
branches for 7.3, including soc, led, net and media. Once
everything is in, we can apply the final patches to turn
off CONFIG_GPIOLIB_LEGACY by default and remove the obsolete
header file.
This branch is based on the immutable ib-mfd-legacy-gpio-7.3
branch from mfd.git to avoid a conflict in the rohm drivers.
|
|
AH6 rearranges routing-header addresses before computing or verifying the
ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than
the number of addresses described by the routing header's hdrlen field.
That assumption does not hold for raw IPv6 HDRINCL packets. A packet with
hdrlen equal to 2 describes one address, but can carry an arbitrary
segments_left value. With segments_left equal to 255, the function moves
its address pointer 4,064 bytes backwards and passes a 4,064-byte length to
memmove(), resulting in an out-of-bounds access.
Validate the invariant locally before modifying the routing header or
performing any address-pointer arithmetic, and propagate malformed-header
errors to the existing AH6 input and output error paths.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix
Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
|
|
https://github.com/vzapolskiy/linux-lpc32xx into soc/arm
ARM: nxp: lpc32xx: ARM changes for v7.3
NXP LPC32xx ARM changes for v7.3 contain:
- Karl Mehltretter fixes a multiplatform kernel runtime execution by
limiting LPC32xx SoC specific init functions to be run on this
platform only,
- a stale method of populating DMA, SLC and MLC NAND controllers is
removed from platform code, this change was announced to happen by
the end of this year, all touched by the change controllers are
properly described in the platform device tree for years, and very
old board dtbs are recommended to be updated.
* tag 'lpc32xx-arm-for-7.3' of https://github.com/vzapolskiy/linux-lpc32xx:
ARM: lpc32xx: remove a few manually populated OF devices
ARM: lpc32xx: only run SoC init on LPC32xx hardware
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
FOLL_LONGTERM pinning fails for some memory types, such as file-backed
guest memory. As a result, kvm_s390_adapter_map() returns -EINVAL and
irqfd adapter registration fails even though interrupt delivery could
still work via the existing non-atomic path.
When FOLL_LONGTERM pinning fails, verify that the page is accessible
using a short-term pin instead. If the short-term pin succeeds, unpin
the page and add a map entry with pinned=false to preserve MAP/UNMAP
symmetry. The non-atomic irqfd path already performs short-term pinning
for interrupt delivery, so this restores the previous behavior for
memory that cannot be pinned long-term.
get_map_info() is updated to return NULL for unpinned entries so that
the atomic irqfd fast path falls back to the non-atomic path.
kvm_s390_adapter_unmap() and kvm_s390_unmap_all_adapters() skip dirty
marking and unpin for unpinned entries.
Update Documentation/virt/kvm/devices/s390_flic.rst to reflect the
new MAP/UNMAP behavior.
Fixes: c9a568838086 ("KVM: s390: Add map/unmap ioctl and clean mappings post-guest")
Signed-off-by: Jaehoon Kim <jhkim@linux.ibm.com>
Reviewed-by: Douglas Freimuth <freimuth@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
|
|
New HW no longer implements a separate class for latency-sensitive QPs and
advertises this by a new cap bit.
REG_UMR is the only QP that used this feature, so gate its usage of the
feature on this cap.
Signed-off-by: Michael Guralnik <michaelgur@nvidia.com>
Reviewed-by: Patrisious Haddad <phaddad@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
Link: https://patch.msgid.link/20260726-deprecate-lat-qps-v2-2-5e0c2ee55046@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
|
|
vgic_v2_deactivate() passes the INTID a guest wrote to GICV_DIR straight
to vgic_get_vcpu_irq(), and treats a failed lookup as a "can't happen"
condition with WARN_ON_ONCE().
The guest can make it happen at will, though: for any INTID outside of
the implemented SGI, PPI and SPI ranges the lookup returns NULL, since
GICv2 has no LPIs. A guest running with EOImode==1 writing such an INTID
to GICV_DIR triggers the WARN, and panics hosts running with
panic_on_warn.
Drop the WARN and ignore failed lookups.
Fixes: 255de897e7fb ("KVM: arm64: GICv2: Handle deactivation via GICV_DIR traps")
Cc: stable@vger.kernel.org
Suggested-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Link: https://patch.msgid.link/20260726174803.5880-1-kmehltretter@gmail.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
|
|
We need the staging driver fixes in here as well.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
|
|
|
|
We need the serial driver fixes in here as well.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Add the required DT nodes for both QSPI controllers.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Link: https://lore.kernel.org/r/20260709112006.390742-6-robert.marko@sartura.hr
Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
|
|
The "reg" property is an address-sized DT cell property. The AT91
compat clock parser only uses a small bus id from it, but reading it
with the u8 helper does not match the property encoding.
Use of_property_read_reg() so the code goes through the helper for
"reg" properties, then keep the existing range check before passing
the bus id to the clock registration code.
Assisted-by: Codex:gpt-5-5
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Link: https://patch.msgid.link/20260612215251.1888345-1-robh@kernel.org
Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
|
|
We need the USB fixes in here as well.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
New HW no longer implements a separate class for latency-sensitive QPs
and advertises this by a new cap bit.
Signed-off-by: Leon Romanovsky <leon@kernel.org>
|
|
Introduce the qp_latency_sensitive_disable capability bit to indicate
that the device no longer implements a separate class for
latency-sensitive QPs, so drivers can stop programming the
latency_sensitive QPC field and skip allocating the dedicated
fast-path bfreg on such HW.
Signed-off-by: Michael Guralnik <michaelgur@nvidia.com>
Reviewed-by: Patrisious Haddad <phaddad@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
Link: https://patch.msgid.link/20260726-deprecate-lat-qps-v2-1-5e0c2ee55046@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
|
|
set_user_buf_size() computes the QP buffer size by left-shifting the
user-supplied rq.wqe_cnt and rq.wqe_shift values as signed integers.
A sufficiently large rq.wqe_cnt causes signed integer overflow, which
is undefined behavior, and yields a small or negative buf_size, causing
ib_umem_get() to map a buffer smaller than the hardware will actually
write into.
Replace the shifts and addition with check_shl_overflow() and
check_add_overflow(), rejecting invalid user inputs.
Moreover, guard the identical shift computing qp->sq.offset in
_create_user_qp() before set_user_buf_size() is reached.
Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
Link: https://patch.msgid.link/20260723-fix-qp-buf-size-overflow-v1-1-ccb05ee43a7b@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
|
|
Decouple RoCE acceleration counters exposure from the roce_accl device
cap. The device cap is intended to protect the access to the roce_accl
register and was disabled on VFs for that purpose.
Reading the acceleration counters, however, does not involve that
register, the counters are read-only statistics that carry no
configuration risk. Gating their exposure on the capability therefore
needlessly hides useful diagnostic data on VFs.
Expose the counters on all functions regardless of the capability.
Signed-off-by: Michael Gur <michaelgur@nvidia.com>
Reviewed-by: Chiara Meiohas <cmeiohas@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
Link: https://patch.msgid.link/20260723-expose-roce-accl-counters-v1-1-967618b550cd@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
|
|
The UMR XLT buffer needs to be aligned to PAGE_SIZE.
Fixes: b2022068dea0 ("RDMA/mlx5: use kmalloc() for UMR translation buffers")
Link: https://patch.msgid.link/20260722-fix-get-order-alignment-v1-1-ece212ddb5dc@nvidia.com
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
|
|
resctrl fs commands are becoming more powerful with, for example, a user able
to use syntax like '*' to make broad configuration changes. Such commands that
span multiple domains may result in more than one message printed to the
last_cmd_status buffer with more planned.
Issue "[truncated]" when displaying the last_cmd_status buffer to communicate
if it overflowed. Upon encountering this, user space is expected to combine
details about the failure found in info/last_cmd_status with related resctrl
files to learn the accurate system state after the command failure.
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Ben Horgan <ben.horgan@arm.com>
Reviewed-by: Tony Luck <tony.luck@intel.com>
Tested-by: Babu Moger <babu.moger@amd.com>
Link: https://patch.msgid.link/eb3d1aaa41d1f2bf6b1bb26ceafd52f04912121d.1782857711.git.reinette.chatre@intel.com
|
|
fs/erofs/decompressor_lzma.c sizes the module-global MicroLZMA stream
pool from num_possible_cpus() when the lzma_streams module parameter is
unset, then z_erofs_load_lzma_config() preallocates one image-supplied
dictionary per stream, accepting dictionaries up to 8 MiB. On high-CPU
systems, a small EROFS image can pin hundreds of MiB of vmalloc-backed
decoder state until the erofs module is unloaded.
Impact: An EROFS image mounted by the system can pin up to 8 MiB of
vmalloc memory per LZMA stream, either as intended or unexpectedly.
Bound the default stream count by a new
CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS option, default 16, so the
worst-case default preallocation is 128 MiB if the number of CPUs is no
less than 16 while preserving the existing per-image dictionary limit.
An explicit lzma_streams module parameter is still honoured as-is, so
administrators who deliberately size the pool are not affected.
Fixes: 622ceaddb764 ("erofs: lzma compression support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
|
|
Previously, backing files for page cache sharing were set up with
f_path left as NULL (only f_inode was valid). It worked, but a recent
mincore fix relies on f_path.mnt and crashes (found by "erofs/028" on
7.2-rc4):
BUG: kernel NULL pointer dereference, address: 0000000000000018
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: Oops: 0000 [#1] SMP PTI
CPU: 3 UID: 0 PID: 675528 Comm: fincore Not tainted 7.2.0-rc4-00002-g[]-dirty #1 PREEMPT(lazy)
Hardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014
RIP: 0010:__do_sys_mincore+0xc0/0x2c0
...
Specify valid paths using valid disconnected dentries together with
erofs_ishare_mnt instead of leaving f_path empty, so they are more
like real backing files in a pseudo filesystem and standard
backing_file_open() can be used directly.
Fixes: e187bc02f8fa ("mm: do file ownership checks with the proper mount idmap")
Acked-by: Hongbo Li <hongbohbli@tencent.com>
Signed-off-by: Gao Xiang <xiang@kernel.org>
|
