Use of local SPI bus data to manage a collection of SPI transfers and
flush them to the SPI platform driver with the sync() operation. This
allows for faster handling of multiple channel DAC writes, avoiding kernel
overhead per spi_sync() call, which will be helpful when enabling
triggered buffer support. For consistency, the read operation leverages
the same transfer data rather than a stack-allocated array.
Reviewed-by: David Lechner <dlechner@baylibre.com>
Signed-off-by: Rodrigo Alencar <rodrigo.alencar@analog.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Add sync() to operation to ad5686_bus_ops, which can be used to flush
multiple pending data transfers at once. This is going to be used when
implementing triggered buffer support.
Reviewed-by: David Lechner <dlechner@baylibre.com>
Signed-off-by: Rodrigo Alencar <rodrigo.alencar@analog.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Replace usage of bit shifting macros for FIELD_PREP(), which would not
ignore bit masking when preparing SPI/I2C commands. This change is a code
hardening measure to be paired with the upcoming triggered buffer support.
For the AD5310 regmap case, 16-bit data coming from the buffer may overlap
with command bits if the data field is unmasked.
*_REF_BIT_MSK and *_PD_MSK bit position macros are renamed (with a DATA
prefix) so to indicate that they are relative to the DATA field.
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/all/20260628143026.EC6CA1F000E9@smtp.kernel.org/
Reviewed-by: David Lechner <dlechner@baylibre.com>
Signed-off-by: Rodrigo Alencar <rodrigo.alencar@analog.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Verify that chip_info pointer is not NULL. If a user binds the driver
using driver_override via sysfs with a device name not present in the
id_table or of_match_table, match data will be NULL.
Fixes: 0eb1728461 ("iio: dac: ad5686: drop enum id")
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/all/20260710113149.53EC51F000E9@smtp.kernel.org/
Signed-off-by: Rodrigo Alencar <rodrigo.alencar@analog.com>
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Shengjiu Wang <shengjiu.wang@nxp.com> says:
Both fsl_asrc_probe() and fsl_easrc_probe() call fsl_asrc_m2m_init()
near the end of their probe functions. On failure, the original code
did a bare return ret, bypassing the existing error labels that call
pm_runtime_disable(). This leaves runtime PM enabled and the device
in an inconsistent state after a failed probe.
Fix both drivers by replacing the bare return with a goto to the
appropriate cleanup label (err_pm_get_sync for fsl_asrc and
err_pm_disable for fsl_easrc), ensuring pm_runtime_disable() is
always called on the probe error path.
Link: https://patch.msgid.link/20260715024758.1252801-1-shengjiu.wang@oss.nxp.com
When fsl_asrc_m2m_init() fails in fsl_easrc_probe(), the code did a
bare return ret, bypassing pm_runtime_disable() in err_pm_disable.
Use goto err_pm_disable to ensure proper cleanup on failure.
Fixes: b62eaff065 ("ASoC: fsl_easrc: register m2m platform device")
Cc: stable@vger.kernel.org
Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Link: https://patch.msgid.link/20260715024758.1252801-3-shengjiu.wang@oss.nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
When fsl_asrc_m2m_init() fails in fsl_asrc_probe(), the code did a
bare return ret, bypassing pm_runtime_disable() in err_pm_get_sync.
Use goto err_pm_get_sync to ensure proper cleanup on failure.
Fixes: 286d658477 ("ASoC: fsl_asrc: register m2m platform device")
Cc: stable@vger.kernel.org
Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Link: https://patch.msgid.link/20260715024758.1252801-2-shengjiu.wang@oss.nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Robert Marko <robert.marko@sartura.hr> says:
This series adds QSPI support for the Microchip LAN969x which has two QSPI
controllers based on SAMA7G5.
It requires pad calibration, supports DMA, and supports 100 MHz operation.
It requires a different init sequence to SAMA7G5 so support for custom
.init per controller caps is added, and existing controllers relying on
checking gclk are converted to it.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Link: https://patch.msgid.link/20260709112006.390742-1-robert.marko@sartura.hr
Microchip LAN969x has two QSPI controllers based on SAMA7G5 QSPI.
It requires pad calibration, supports DMA, and supports 100 MHz operation.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Link: https://patch.msgid.link/20260709112006.390742-5-robert.marko@sartura.hr
Signed-off-by: Mark Brown <broonie@kernel.org>
Assign the existing SAMA7G5 initialization routine to every generic
clock variant and dispatch initialization exclusively through the
capability callback.
This keeps hardware capabilities separate from initialization selection
and lets variants override the sequence explicitly.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Link: https://patch.msgid.link/20260709112006.390742-4-robert.marko@sartura.hr
Signed-off-by: Mark Brown <broonie@kernel.org>
Allow controller variants to provide a custom initialization callback
through their capability data.
This prepares the driver for variants which require a different hardware
initialization sequence without adding SoC checks to the common path.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Link: https://patch.msgid.link/20260709112006.390742-3-robert.marko@sartura.hr
Signed-off-by: Mark Brown <broonie@kernel.org>
In k1_spi_write, the count variable is intended to represent the number
of slots available for writing into the TX FIFO.
The current implementation uses FIELD_GET(SSP_STATUS_TFL, val) in an
attempt to determine this count, but this register field returns the
number of occupied slots, not the available space. The previous
implementation attempted to handle this via a ternary operator (? :
K1_SPI_FIFO_SIZE), which incorrectly assumed that the hardware returned
0 when the FIFO was empty (meaning all slots were available), leading to
incorrect accounting of the buffer space.
Fix this by calculating the free slots: count = K1_SPI_FIFO_SIZE -
FIELD_GET(SSP_STATUS_TFL, val);
The associated comment has been updated to reflect the logic change: The
old comment reflected an incorrect assumption about the hardware
behavior, which was the root cause of the previous buggy logic.
This patch accurately and concisely describes the purpose of the new
calculation.
Signed-off-by: Peixin Xie <peixin.xie@spacemit.com>
Signed-off-by: Zhengyu He <hezhy472013@gmail.com>
Link: https://patch.msgid.link/20260715-k1-spi-tx-fifo-fix-v1-for-next-v1-1-02024223b08a@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Mark Brown <broonie@kernel.org> says:
While reviewing another fix for the tas2562 volume control I noticed a
few issues with the put() operation, this series fixes them.
It's also a bit weird that the volume control is defined with twice as
many values as can actually be set, probably the best fix there is to
regnerate the table of volume values with the intermediate values.
Link: https://patch.msgid.link/20260715-asoc-tas2562-put-retval-v1-0-97bf467c924e@kernel.org
The tas2562 digital volume is spread over four registers and is implemented
as lookups into a table so the driver stores the value for the userspace
control in the driver data. This defaults to 0 due to kzalloc() but the
register default is 0x40400000 which maps onto something a bit over the
largest value defined in the lookup table. While it's not an exact match
update the default to the largest value, avoiding user surprise due to a
sudden change on first write.
Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
Link: https://patch.msgid.link/20260715-asoc-tas2562-put-retval-v1-3-97bf467c924e@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
ALSA put() operations should return 0 for noop updates and 1 if the
value of the control changed, this is used by the ALSA core to generate
events to userspace. tas2562_volume_control_put() does not implement
this, it just writes whatever value userspace wrote to the device and
returns 0 regardless of what the previous value was. Fix this by
suppressing writes if the value is unchanged and returning 1 if the
writes succeed.
Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
Link: https://patch.msgid.link/20260715-asoc-tas2562-put-retval-v1-2-97bf467c924e@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
tas2562_volume_control_put() does not do any validation of the control
value written by userspace, it uses it to look up a value in a fixed
size array which can easily be overflowed and then writes whatever value
it gets back to the device. Add validation that we are loading a value
we have in the array.
Cc: stable@vger.kernel.org
Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
Link: https://patch.msgid.link/20260715-asoc-tas2562-put-retval-v1-1-97bf467c924e@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Haidar Lee <haidar.lee@adlinktech.com> says:
The 'Digital Volume Control' added in v5.7 has never worked correctly:
the driver writes the 32-bit DVC coefficient LSB first, but the device
latches the whole coefficient on the write to the last byte (DVC_CFG4),
so every volume change applies a mix of the previous coefficient's
upper bytes and the new LSB. Depending on the sequence of values this
mutes the output entirely or plays at full volume regardless of the
requested level.
Debugged on a TAS2562 (ADLINK OSM-520 / MT8189): traced the I2C writes
with ftrace to confirm the driver writes the intended bytes, then
reproduced both behaviours by writing the same coefficients manually in
each byte order. Patch 1 fixes the write order; patch 2 fixes two wrong
entries in the volume lookup table found while debugging this.
Link: https://patch.msgid.link/20260715-tas2562-dvc-fix-v1-0-072b13901b20@adlinktech.com
The float_vol_db_lookup table is supposed to hold
round(10^(dB/20) * 2^30) for every 2 dB step from -110 dB to 0 dB,
which is 56 entries, but it only has 55: the -90 dB entry duplicates
the -92 dB value (0x0000695b) and the -20 dB entry (0x06666666) is
missing altogether. As a result every step between -90 dB and -22 dB
is off by 2 dB, and the control's maximum raw value of 110 indexes one
element past the end of the array.
Replace the duplicated -90 dB entry with the correct value 0x000084a3
and add the missing -20 dB entry, bringing the table to the full 56
entries so index 55 (raw value 110, 0 dB) is in range again.
Fixes: bf726b1c86 ("ASoC: tas2562: Add support for digital volume control")
Cc: stable@vger.kernel.org
Signed-off-by: Haidar Lee <haidar.lee@adlinktech.com>
Link: https://patch.msgid.link/20260715-tas2562-dvc-fix-v1-2-072b13901b20@adlinktech.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The TAS2562 applies the 32-bit digital volume coefficient to the
playback path when the last byte, DVC_CFG4 (book 0 page 2 reg 0x0F), is
written. tas2562_volume_control_put() wrote DVC_CFG4 first and DVC_CFG1
(the MSB) last, so every volume change latched a value made of the
previous coefficient's upper three bytes combined with the new LSB; the
remaining bytes only took effect on the next volume change.
In practice the control was unusable: the first setting after power-on
always played at roughly 0 dB no matter what value was requested (the
chip's default upper bytes were still latched), and most subsequent
changes muted the output entirely or produced a distorted, over-unity
gain.
Verified on a TAS2562 (ADLINK OSM-520 / MT8189 board) by tracing the
I2C writes with ftrace and by writing the same coefficients manually in
both byte orders: written MSB-first the register block behaves exactly
as the driver expects, LSB-first reproduces the broken behaviour.
Write the bytes MSB first with DVC_CFG4 last so the complete new
coefficient is latched atomically.
Fixes: bf726b1c86 ("ASoC: tas2562: Add support for digital volume control")
Cc: stable@vger.kernel.org
Signed-off-by: Haidar Lee <haidar.lee@adlinktech.com>
Link: https://patch.msgid.link/20260715-tas2562-dvc-fix-v1-1-072b13901b20@adlinktech.com
Signed-off-by: Mark Brown <broonie@kernel.org>
meson_card_reallocate_links() grows the DAI link and private data
arrays with two consecutive krealloc() calls and updates the owner
pointers only after both calls have succeeded.
A successful krealloc() may move the data: it frees the old block and
returns a new one. When that happens for the link array and the second
krealloc() then fails, card->dai_link still points to the block that
krealloc() already freed, and the error path frees the new block too.
The probe error path then calls meson_card_clean_references(), which
dereferences card->dai_link and kfree()s it again, resulting in a
use-after-free and a double free.
Commit card->dai_link and card->num_links right after the first
krealloc() succeeds, so the pointer always refers to a valid allocation
that meson_card_clean_references() can walk and free. krealloc() with
__GFP_ZERO zero-initializes the added entries, so walking them on the
error path is safe. With both failure paths reduced to a plain return,
drop the goto labels and the error message.
Fixes: 7864a79f37 ("ASoC: meson: add axg sound card support")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://patch.msgid.link/20260717012433.1432285-1-lilinmao@kylinos.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
- Call flush_cache_vmap() after populating new vmemmap pages, on all
architectures. This avoids spurious faults on RISC-V
microarchitectures that cache PTEs marked as non-present
- Disable LTO for the vDSO to prevent the compiler from eliding
functions that are used, but which don't appear to be
- Fix an issue with libgcc's unwinder and signal handlers by dropping
an unnecessary CFI landing pad instruction in __vdso_rt_sigreturn
(similar to what was done on ARM64)
- Avoid reading uninitialized memory under certain conditions in
hwprobe_get_cpus()
- Save some memory and I$ when CONFIG_DYNAMIC_FTRACE=n by avoiding
our four-byte function alignment requirement in that case
- Avoid clang warnings about null-pointer arithmetic in the I/O-port
accessor macros (inb, outb, etc.) by ifdeffing them out when
!CONFIG_HAS_IOPORT
- Make the build of the lazy TLB flushing code in the vmalloc path
depend on CONFIG_64BIT and CONFIG_MMU (since those platforms are the
only ones that use it)
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmpc+vAACgkQx4+xDQu9
KksZqw//fbTxRO0sOhv5h+UvJNfsKg43AZWpYVr6bGvtur3d5DUBBiIY+KOroT1Y
G3l9UvzFV6NIdvHNt3OOy9lIC25Oy0EC5MoCjToRSTOTH+EjsMgdZPMFOZh8VBkT
qnn1ehvtJSIYRmX+Xk6gPk8BQLxVbFkRedXUd24vMCSYwlt9MxqWeJjLlktm1slj
IjBWZRi5AOLGn4pVEztgMaGauxF5OObq2Cq5WjE2U1Pz/nvbAUMSBBNkJU739WOp
KK+Hr2HqcoOHbgDcElYsQEY+WMKUgn7cdv/tCLBLAIzGrthFkm/4FkIP327qkKyu
HDc3ef5VpPLY1MoS7hMFS5+HWJ4POEKaGEDf85HRIycr4mTsUUac4NtEoSvONhrP
x4jCRlu/PTWoX3n0RWR5ed5iWtk2tWCcQcaUCUYdJWPLHyJLq25TmQpvCbtfmHtI
1NySg0i4zL8tHJzCklJfwn8CyGfL1Gt627aQUHsJtMA6xeY73+zpxuOKrJElK/z7
4vHykuTlkBjnpVX+a4QImUOYQ6cJ+Km6jkwhvJAaKYXzCs4JFqolCSEg1q/eBGBk
ay9igMkpw+hy2o0OM9TdkEMPaDOsVO6XATjmoVfoyGqvMsZ4sFFHV1fiHqdE5FUE
uoQrbuJ6R729nEWEOoRdw9lGjOI+Hmv+bVKDLwpynSIfbw7TNIY=
=gKi/
-----END PGP SIGNATURE-----
Merge tag 'riscv-for-linus-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V fixes from Paul Walmsley:
- Call flush_cache_vmap() after populating new vmemmap pages, on all
architectures. This avoids spurious faults on RISC-V
microarchitectures that cache PTEs marked as non-present
- Disable LTO for the vDSO to prevent the compiler from eliding
functions that are used, but which don't appear to be
- Fix an issue with libgcc's unwinder and signal handlers by dropping
an unnecessary CFI landing pad instruction in __vdso_rt_sigreturn
(similar to what was done on ARM64)
- Avoid reading uninitialized memory under certain conditions in
hwprobe_get_cpus()
- Save some memory and I$ when CONFIG_DYNAMIC_FTRACE=n by avoiding our
four-byte function alignment requirement in that case
- Avoid clang warnings about null-pointer arithmetic in the I/O-port
accessor macros (inb, outb, etc.) by ifdeffing them out when
!CONFIG_HAS_IOPORT
- Make the build of the lazy TLB flushing code in the vmalloc path
depend on CONFIG_64BIT and CONFIG_MMU (since those platforms are the
only ones that use it)
* tag 'riscv-for-linus-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
riscv: hwprobe: Avoid uninitialized read in hwprobe_get_cpus()
arch/riscv: vdso: remove CFI landing pad from rt_sigreturn
riscv: vdso: Do not use LTO for the vDSO
riscv: io: avoid null-pointer arithmetic in PIO helpers
riscv: Gate FUNCTION_ALIGNMENT_4B on DYNAMIC_FTRACE
mm/sparse-vmemmap: flush_cache_vmap() after hotplugging vmemmap
riscv: mm: Make mark_new_valid_map() stuff depend on 64BIT && MMU
JBL Quantum650 Wireless (0ecb:2125) requires the same workaround that
was used for JBL Quantum610 and Quantum810 for limiting the sample rate.
Without it, the capture (microphone) stream fails to work. Setting the
QUIRK_FLAG_FIXED_RATE flag, as done for the sibling models, makes both
playback and capture work correctly.
Signed-off-by: Daniel C. Ribeiro <dcoutinho.96@gmail.com>
Link: https://patch.msgid.link/20260719090037.40149-1-dcoutinho.96@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Leon Hwang says:
====================
bpf: Disallow interpreter fallback for interpreter-unsupported insns
Sashiko reported two potential issues about interpreter fallback [1]
[2].
After verifying them by patch #7 of v1, I think they are real issues. With
LLM assistance, the interpreter does not support the internal
BPF_PROBE_ATOMIC insn and the gotox insn (used for indirect jumps),
either.
1) the user BPF_ADDR_SPACE_CAST insn
the interpreter just ignores it.
2) the arena ST/STX/LDX insn
the interpreter could hit the BUG_ON() in ___bpf_prog_run().
3) the BPF_MOV64_PERCPU_REG insn
the interpreter could hit page fault, due to loading memory from
invalid __percpu pointer.
4) the internal BPF_PROBE_ATOMIC insn
the interpreter could hit the BUG_ON() in ___bpf_prog_run().
5) the gotox insn used for indirect jumps
the interpreter could hit the BUG_ON() in ___bpf_prog_run(), too.
Reject these insns on interpreter fallback path in
__bpf_prog_select_runtime() by setting 'jit_required = true'.
Link:
[1] https://lore.kernel.org/bpf/20260608151347.2C77D1F00893@smtp.kernel.org/
[2] https://lore.kernel.org/bpf/20260622150759.EC9071F000E9@smtp.kernel.org/
Changes:
v1 -> v2:
* Drop RFC.
* Change target tree to bpf-next to utilize the 'jit_required' bit.
* Set jit_required as true if there's arena map, then all arena-related
insns will be rejected if JIT is not available.
* Set jit_required as true if there's insn_array map, then the gotox
insns will be rejected if JIT is not available.
* Drop the issues-proven patch.
* v1: https://lore.kernel.org/bpf/20260626154330.33619-1-leon.hwang@linux.dev/
====================
Link: https://patch.msgid.link/20260715141122.15783-1-leon.hwang@linux.dev
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
The rzg2l_gpt parameter was passed to rzg2l_gpt_calculate_prescale() but
never used inside the function. Remove it and update the sole call site
accordingly.
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Link: https://patch.msgid.link/20260604095647.108654-6-biju.das.jz@bp.renesas.com
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
On some SoCs (e.g. R-Car S4) the endpoint-side eDMA raises a single
fixed SPI that is hardwired to CPU0 and covers every read and write
channel. Handling channel events directly in that hard IRQ context
serializes the completion processing of all channels on one CPU:
descriptor recycling and refill, client callbacks (the vchan tasklet
runs on the scheduling CPU) and the doorbell writes all funnel through
CPU0, while the handler additionally spins on each channel's vc.lock.
Especially under heavy multichannel load, this contention becomes a
performance bottleneck.
Keep the hard IRQ handler minimal: clear the status, dispatch channel
events, and defer per-channel processing to work items. A work item per
channel preserves ordering while allowing different channels to run in
parallel on any CPU.
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Link: https://patch.msgid.link/20260717180639.2643243-10-den@valinux.co.jp
Signed-off-by: Vinod Koul <vkoul@kernel.org>
The v0 interrupt handler reads the interrupt status register twice per
invocation, once through the DONE accessor and once through the ABORT
accessor, although both fields live in the same 32-bit register. On
remote setups (dw-edma-pcie) each read is a non-posted round trip across
the PCIe link costing on the order of a microsecond, and with one
completion interrupt per element the duplicate adds up. As an example,
profiling the R-Car S4 remote path put the handler at ~7us per
invocation, dominated by such reads.
Read the register once and derive the DONE and ABORT views from the
snapshot. No abort is lost to this because the pass only clears status
bits it observed, so an abort raised after the snapshot keeps its status
and its own interrupt delivery brings it to the next pass. An abort on
an observed channel cannot race the clear either. Software can restart
the halted channel only after abort() runs, and abort() is called after
dw_edma_v0_core_clear_abort_int().
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Link: https://patch.msgid.link/20260717180639.2643243-9-den@valinux.co.jp
Signed-off-by: Vinod Koul <vkoul@kernel.org>
dw_edma_pcie enables the PCI device with pcim_enable_device(), so IRQ
vectors allocated by pci_alloc_irq_vectors() are released by
pcim_msi_release() on device release. The driver should not call
pci_free_irq_vectors() manually.
Drop the redundant remove-time cleanup and rely on the managed PCI
device lifetime instead, as documented by commit 03e4905402 ("PCI/MSI:
Clarify pci_free_irq_vectors() usage for managed devices").
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Link: https://patch.msgid.link/20260717180639.2643243-8-den@valinux.co.jp
Signed-off-by: Vinod Koul <vkoul@kernel.org>
terminate_all() can finish immediately when the channel is unconfigured,
paused, idle, or already stopped in hardware. A pending PAUSE request can
survive these paths and block issue_pending() even after termination.
Clear the request whenever termination leaves the channel idle. A running
channel keeps its STOP request until the interrupt handler consumes it.
Fixes: e63d79d1ff ("dmaengine: Add Synopsys eDMA IP core driver")
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Link: https://patch.msgid.link/20260717180639.2643243-7-den@valinux.co.jp
Signed-off-by: Vinod Koul <vkoul@kernel.org>
pause() and resume() read and update channel state without holding vc.lock,
while the interrupt handlers update the same state under it. Take the same
lock around those state checks so that request, status, and configured stay
consistent.
For example, pause() can observe EDMA_ST_BUSY right before the interrupt
handler completes the final descriptor and moves the channel to
EDMA_ST_IDLE, and then record EDMA_REQ_PAUSE on an already idle channel. No
further interrupt will acknowledge the request, and since issue_pending()
requires EDMA_REQ_NONE, the channel is wedged for good: terminate_all()
leaves the stale request behind, so even reconfiguring the channel does not
recover it.
issue_pending() already runs under vc.lock, but it tests configured before
taking it. Move that test under the lock as well, so configured, request,
and status are evaluated as one channel-state snapshot.
Fixes: e63d79d1ff ("dmaengine: Add Synopsys eDMA IP core driver")
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Link: https://patch.msgid.link/20260717180639.2643243-6-den@valinux.co.jp
Signed-off-by: Vinod Koul <vkoul@kernel.org>
If PAUSE is requested while the final burst of a descriptor is in
flight, the DONE interrupt takes the PAUSE path without checking whether
the descriptor has been depleted. The depleted descriptor remains on the
issued list and the channel enters EDMA_ST_PAUSE.
On resume, dw_edma_start_transfer() can select that depleted descriptor
again even though no burst remains, leaving the channel in an invalid
busy state.
Check for descriptor completion before acknowledging PAUSE. If there is
no work to start on resume, leave the channel idle. Also ignore DONE
interrupts while the channel is paused so a stale or repeated interrupt
cannot change its state or start queued work.
Fixes: e63d79d1ff ("dmaengine: Add Synopsys eDMA IP core driver")
Cc: stable@vger.kernel.org
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Link: https://patch.msgid.link/20260717180639.2643243-5-den@valinux.co.jp
Signed-off-by: Vinod Koul <vkoul@kernel.org>
dw_edma_abort_interrupt() drops vc.lock before changing request and
status. issue_pending() can acquire the lock in that small window,
observe the old busy state, and skip starting queued descriptors. Then
the abort handler overwrites the channel status as idle, leaving the new
descriptors stranded for good.
Keep descriptor completion and the state transition in the same critical
section.
Fixes: e63d79d1ff ("dmaengine: Add Synopsys eDMA IP core driver")
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Link: https://patch.msgid.link/20260717180639.2643243-4-den@valinux.co.jp
Signed-off-by: Vinod Koul <vkoul@kernel.org>
The DMA Engine client documentation says in the "Terminate APIs" section
of Documentation/driver-api/dmaengine/client.rst:
"No callback functions will be called for any incomplete transfers."
dw-edma instead calls vchan_cookie_complete() when a deferred STOP reaches
the interrupt handler. This schedules a callback for the active descriptor
and leaves other issued or submitted descriptors queued. A late callback
after dmaengine_terminate_sync() can dereference client state that has
already been freed, while leftover descriptors may later restart into
reused buffers or leak.
Move all issued and submitted descriptors to the terminated list whenever
termination completes. For a pending STOP, do this from both the DONE and
ABORT paths. Complete their cookies in order without scheduling callbacks.
A STOP can remain pending until the running transfer raises an
interrupt. Make device_synchronize() wait for such a pending STOP to
complete before releasing terminated descriptors. Reuse it from
free_chan_resources(), then release the remaining virt-dma resources.
Sleep instead of busy-polling while waiting, and warn if the existing
timeout expires.
Fixes: e63d79d1ff ("dmaengine: Add Synopsys eDMA IP core driver")
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Link: https://patch.msgid.link/20260717180639.2643243-3-den@valinux.co.jp
Signed-off-by: Vinod Koul <vkoul@kernel.org>
GET_CH_32() takes the direction before the channel ID, but
dw_hdma_v0_core_ch_status() passed them in the opposite order. This can
make the status callback read another HDMA channel status register.
Use the same argument order as the other HDMA register accesses.
Fixes: e74c39573d ("dmaengine: dw-edma: Add support for native HDMA")
Cc: stable@vger.kernel.org
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Link: https://patch.msgid.link/20260717180639.2643243-2-den@valinux.co.jp
Signed-off-by: Vinod Koul <vkoul@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmpbBc8QHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpibUD/9SCYq0YZSH4fgwv6PwouAdw2/0TogbCf2E
OZ+oq76WYeG8Q95iFXLdjv72EkNi+m1cHesn89lhvZkHWu9TAKAeCoXcnfsLIpmp
60e6Dnz7GCTRsv2L9nBEEmsyQdYGVbbMes8hSpBXbcO1jczbr8x9nzBzkfR4XL3z
/Vqy1CK9lA0z1+0sVkUrjKt9li7BGodpUPiNdhMReu8nuwuy1mHJ585+Y6pkwHav
1TmaSiQ+NQxSLmyOwG1rzmzWCDdeszAa56exJ6L/T16RJ6rNTPcz2TCjsBcmuupo
UytqdUhKaqxlikfrdus0Cnjsn8ivTiXFfYnvNTAWThRuIq+ePC4nzWzuncJTeVdE
MIzfND6sTmfOG6Vchrx0CN92nv5gsOprxbLjbM28VSb5Xpad5PYMMGpdkBranI/9
zUkJi0fiJOp0i/uvpltdPqcgvPKBHBhLyi5GPVb+fjLJW2Gm1s1xcBfpKIj+2+S5
A3F2ac626DhcGrKQcZPl71RwAeEWRzP3Zr93Eg1oEQd9uqRz1jH2K8DCGh0fd9mP
FppUw/p4GbBnc8QVraIfAIssg12eFU2ZIHvWuTiB/1UnzMuS3gJ8pwEy0s/9ObUJ
+8vCI1fZDmbXN7T31rTl/X4npL0AfXtTbG61KcWqvbAhyVmmKNoNPHFj4SA3G0wF
p5Y7qj2Jmg==
=qHz/
-----END PGP SIGNATURE-----
Merge tag 'block-7.2-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixes from Jens Axboe:
- Fixes for the dio bounce buffer helpers: correct the alignment of
bounced dio read bios to avoid a double unpin, handle huge zero
folios in bio_free_folios(), and don't warn on the larger-order folio
attempts in the greedy allocation path.
- Try a slab allocation in bio_alloc_bioset() before falling back to
the mempool, restoring the previous behavior for non-sleeping
allocations from a cache-enabled bioset.
- Serialize elevator changes for the same queue using the writer lock.
- Fix a race in blk_time_get_ns() where a task preempted between
setting PF_BLOCK_TS and the cached-timestamp reload could return 0.
- blk-cgroup fix for leaks and the online flag on a radix_tree_insert()
failure in blkg_create().
- Free the copied pages when blk_rq_map_kern() fails after
blk_rq_append_bio() rejects the bio.
- Remove manually added partitions on loop device detach, fixing dead
partition devices left behind and a subsequent LOOP_CONFIGURE -EBUSY
- Bound the AIX partition lvd scan to the sector that was actually
read.
- Show the block operation in error injection rules (Jackie)
* tag 'block-7.2-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
block: fix aligning of bounced dio read bios
block: handle huge zero folios in bio_free_folios
block: try slab allocation in bio_alloc_bioset() before mempool
block: show operation in error injection rules
block: serialize elevator changes for the same queue using a writer lock
block: free copied pages when blk_rq_map_kern() fails
block: do not warn when doing greedy allocation in folio_alloc_greedy()
partitions: aix: bound the lvd scan to one sector
blk-cgroup: fix leaks and online flag on radix_tree_insert failure
loop: remove manually added partitions on detach
block: fix race in blk_time_get_ns() returning 0
The BPF_MOV64_PERCPU_REG insn requires JIT to emit native code to for
'dst_reg = src_reg + <percpu_base_off>'.
However, the interpreter ignores the 'off' at its ALU64_MOV_X label.
The 'off' indicates the insn is BPF_MOV64_PERCPU_REG insn. Then, when
the interpreter loads memory from the register, it will hit a page
fault.
[ 2.545572] BUG: unable to handle page fault for address: ffffffffacaaf034
[ 2.546485] #PF: supervisor read access in kernel mode
[ 2.547167] #PF: error_code(0x0000) - not-present page
[ 2.547850] PGD 134e63067 P4D 134e63067 PUD 134e64063 PMD 10021c063 PTE 800ffffeca550062
[ 2.548912] Oops: Oops: 0000 [#1] SMP PTI
Set jit_required as true in order to disallow interpreter fallback in
core.c::__bpf_prog_select_runtime(), if any BPF_ADDR_PERCPU insn is
patched to the prog.
BTW, rename the helper bpf_map_supports_cpu_flags() to
bpf_map_is_percpu_map().
Fixes: 7bdbf74463 ("bpf: add special internal-only MOV instruction to resolve per-CPU addrs")
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Link: https://lore.kernel.org/bpf/20260715141122.15783-4-leon.hwang@linux.dev
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
The interpreter does not recognize the BPF_JMP|BPF_JA|BPF_X insn, which
is used for insn_array map. Thereafter, it would hit the BUG_ON() in
___bpf_prog_run() at run time.
[ 2.563726] BPF interpreter: unknown opcode 0d (imm: 0x0)
[ 2.564557] ------------[ cut here ]------------
[ 2.565206] kernel BUG at kernel/bpf/core.c:2349!
[ 2.565882] Oops: invalid opcode: 0000 [#1] SMP PTI
Set jit_required as true when insn_array map is used in the prog in
order to disallow interpreter fallback for gotox insn in
core.c::__bpf_prog_select_runtime().
Fixes: 493d9e0d60 ("bpf, x86: add support for indirect jumps")
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Link: https://lore.kernel.org/bpf/20260715141122.15783-3-leon.hwang@linux.dev
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Since the interpreter does not support the arena-related insns,
interpreter fallback should not be allowed for these insns in
core.c::__bpf_prog_select_runtime().
Currently, when the interpreter executes the arena ST/LDX/STX insns,
it would hit the BUG_ON() in ___bpf_prog_run() at run time.
[ 2.579196] BPF interpreter: unknown opcode a2 (imm: 0x0)
[ 2.579998] ------------[ cut here ]------------
[ 2.580652] kernel BUG at kernel/bpf/core.c:2349!
[ 2.581314] Oops: invalid opcode: 0000 [#1] SMP PTI
Set jit_required as true when arena map is used in the prog to disallow
interpreter fallback for arena-related insns.
Fixes: 6082b6c328 ("bpf: Recognize addr_space_cast instruction in the verifier.")
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Link: https://lore.kernel.org/bpf/20260715141122.15783-2-leon.hwang@linux.dev
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmpbBbsQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpgpFD/9NnN5A9eMm+4ZeC41yeynykN1QOl5wCqoT
zi7CIizuwtsCQAjgpFUahMosvkLg3P77S/MJxqzlGVPhaSvp/QISxr7oH9WqyoYf
jEfi3Dx8XfdxK+5GG0dC7s4iiWuxZha7iGt4W2DZmjXWWu0ofCKB0FTVK7J/AkC0
7DA4hMmts643cE9pwmD1Bbuj7SYmqjneDhgwe/JaSuCiuuclN5L359E1rnxzc+dS
9McCmwPjwF0f+Vs9IWyHb1KNMBBmC2T0n2zvzKoJKL72mQ0v3IaOlGkUEDgp7EpT
TIK5rEKPl/Wpw970BOlzdYgD01vDiWeLuQQQlGfAaLheUUImLoFPo1rf/q8nCgFN
CVEWDSZZWRnwH6FjFCa5JwOS0B9YcamYzhkTck1O+g7KcNB6ZCU1zMX8+pCMEVgr
Ju5J2uoazT2txEZEgCSSUYLuRRSpz5P5s/VmFEXNxeRAhndlGhyNq16kVnRqyLfA
OzVS5uYeqSOlOYbY8pL4QkGaxBUr0CSBOnhCT7q9d8KYXnh9CHReFQcy9wPclSfd
D+F5v4CPqWN0tg2rrYBgo3Zpt4Mwb1JEiyOAaIapAKQT2T9tNtp1fubq4PA9c1ub
VkSRutPGeUWNC1fEjs67I9V3V0bzbR8j+AMC9AAFFqaqpn2B5NGHqvlcYdaNuuje
Dr7yXvROWw==
=Ue52
-----END PGP SIGNATURE-----
Merge tag 'io_uring-7.2-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fixes from Jens Axboe:
- Fix a use-after-free in the bpf-ops struct_ops path, where the same
io_uring_bpf_ops map could be registered more than once.
- Fix the deferred iovec free for the provided-buffer grow path, which
could leave the caller with a dangling iovec and result in repeated
frees. Follow-up to the earlier fix in this series.
- Zero-check the unused addr3/pad2 SQE fields for unlinkat
* tag 'io_uring-7.2-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
io_uring/bpf-ops: reject re-registration of an already-bound ops
io_uring/fs: check unused sqe fields for unlinkat
io_uring/kbuf: free the replaced iovec after a successful grow
Yiyang Chen says:
====================
bpf: Reject arena frees below the arena base
bpf_arena_free_pages() can be called with a scalar arena address. The
runtime reconstructs a full user address from the arena base and the low
32 bits before returning the range to the arena free tree. A scalar one
page below the arena base can otherwise produce an out-of-domain free-tree
offset and make a later allocation return an address below the arena
mapping.
Patch 1 rejects frees whose reconstructed full user address is below
user_vm_start. Patch 2 adds verifier_arena coverage for the
scalar-below-base case.
Changes in v2:
- Add Reviewed-by tags from Emil Tsalapatis.
- Remove the empty inline asm from the selftest.
v1: https://lore.kernel.org/bpf/cover.1782813442.git.chenyy23@mails.tsinghua.edu.cn/
====================
Link: https://patch.msgid.link/20260717-c10-031-public-bpf-next-v2-b4-v2-0-54b555443a7c@mails.tsinghua.edu.cn
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Add a verifier_arena case that fills a two-page arena, calls
bpf_arena_free_pages() with a scalar address one page below the arena
base, and then verifies that another allocation is still rejected.
Before the runtime guard, the invalid free can repopulate the free
tree with an out-of-domain offset and the final allocation succeeds.
Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Link: https://lore.kernel.org/bpf/20260717-c10-031-public-bpf-next-v2-b4-v2-2-54b555443a7c@mails.tsinghua.edu.cn
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
bpf_arena_free_pages() accepts scalar arena addresses. The runtime
masks the address to the low 32 bits and reconstructs a full user
address from the arena base before returning the range to the arena
free tree.
When the scalar value is below the low 32 bits of the arena base,
full_uaddr falls below user_vm_start. The existing upper-end clipping
then turns this into an out-of-range free-tree offset. A later
allocation can reuse that offset and return an address below the arena
mapping.
Reject such frees before computing the clipped range.
Fixes: 317460317a ("bpf: Introduce bpf_arena.")
Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Link: https://lore.kernel.org/bpf/20260717-c10-031-public-bpf-next-v2-b4-v2-1-54b555443a7c@mails.tsinghua.edu.cn
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
CONFIG_IPV6_SEG6_LWTUNNEL is currently enabled in each arch-specific
config fragment for the BPF selftests. Commit 33a971d549
("selftests/bpf: Add LWT encap tests for skb metadata") has enabled this
config in the generic config as well, resulting in a small warning when
configuring a kernel for selftests:
$ cat tools/testing/selftests/bpf/{config,config.vm,config.x86_64}>.config
$ make olddefconfig
HOSTCC scripts/kconfig/conf.o
HOSTCC scripts/kconfig/confdata.o
HOSTLD scripts/kconfig/conf
config:269:warning: override: reassigning to symbol IPV6_SEG6_LWTUNNEL
#
# configuration written to .config
#
Now that IPV6_SEG6_LWTUNNEL is set in the general config fragment, drop
it from the arch-specific fragments.
Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
Link: https://lore.kernel.org/bpf/20260709-testing-fragments-v1-1-65244b0650ff@bootlin.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
A couple of fairly routine driver fixes, nothing too remarkable.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmpcxP4ACgkQJNaLcl1U
h9Cnigf9FRw9pWxDNEhhABYvy7A9kcSTYWDoYEoljdsvYzGCWpbkS9VCmiSOcxlA
WYrVkrknUrjnd2twMyqWSs3MGePcncEchlOKOqTF8bA12dKSiRgFlldZ5MoRgYrf
GAbFzlu0Z3wZgGK2n8NwHwQ4ut0LcM4PYYKqQ+nABbURmfCA+oCnbE2QhCdRxHUB
MtHiA1fzoBnnCHsDkRnI5MTbkKWA2r2nqzQY7pzojtwrR4xghm1MUO16gD5V8VM9
w5ndpdLIer3FtHpwy1OqtuvXnZJEu8xWqQ/uAv+HfdHsRvckPB6hKt6GkSKVdut/
R4e8ZbIuSfEwcwy8VC4fRQjVw5BNVQ==
=b2Lc
-----END PGP SIGNATURE-----
Merge tag 'spi-fix-v7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"A couple of fairly routine driver fixes, nothing too remarkable"
* tag 'spi-fix-v7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: cadence-quadspi: Fix indirect write timeout when DMA read mode is enabled
spi: dw-dma: Wait for controller idle before completing Tx
ub->completion is only re-armed by a successful START_USER_RECOVERY. If
the ublk server sends END_USER_RECOVERY without one - e.g. its START
failed with -EBUSY and the error was ignored - the wait is satisfied by
the stale completion of the previous recovery cycle, and the device is
marked LIVE and the requeue list kicked while the FETCH stream is still
running and ubq->canceling is still set. The kick redispatches a
previously requeued request, __ublk_queue_rq_common() sees ->canceling
and parks it again via __ublk_abort_rq(), and after the last FETCH
clears ->canceling nothing ever kicks the requeue list again: the
request is stranded there while holding its tag. If it is the flush
machinery's flush_rq, every subsequent fsync piles up in uninterruptible
sleep and teardown hangs on tag draining. This matches a report of a
lost PREFLUSH with ext4 on top of ublk after daemon crash recovery.
ub->completion is an edge-triggered latch used as a proxy for the level
condition "every queue has fetched all I/O commands", which can regress
(F_BATCH's UNPREP, daemon death) and whose re-arm can be skipped. Drop
it and wait on the real condition instead: the new helper
ublk_wait_dev_ready_and_lock() waits on ublk_dev_ready() via
wait_var_event_interruptible(), woken from ublk_mark_io_ready(), then
re-checks it under ub->mutex, waiting again on regression, and returns
with the mutex held and readiness guaranteed.
Readiness becomes true in the same ub->mutex critical section that
clears the last queue's ->canceling, so END_USER_RECOVERY marks the
device LIVE and kicks the requeue list strictly after ->canceling
clears. The wait stays interruptible, so a server whose daemon died can
still be signalled out. For ublk_ctrl_start_dev() this replaces the
fail-fast -EINVAL on an F_BATCH ready->UNPREP regression with waiting
until the device is ready again.
Reported-by: George Salisbury <gsalisbury@apnic.net>
Fixes: 728cbac5fe ("ublk: move device reset into ublk_ch_release()")
Cc: stable@vger.kernel.org
Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Link: https://patch.msgid.link/20260719134540.120269-1-tom.leiming@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
One straightforward driver fix for some incorrectly described bitfields
in the ltc3676 driver.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmpcxWoACgkQJNaLcl1U
h9Bj2Af+J+ibj5u+dpsT9GdFRkV3dkZtR7wAShFlbVYRI0dtEvrvAOFQ+/dh8whX
vRs8qvn8JtpXepUs2DsZlvB70CEdK5yYIuAQBJAj1QpolWLd069q0TK3fHAdqD6R
61KCpuhbQ8JTCYzL/BCmKhYTqr9A9vhC0hn6cFflqT3Ngunxvayal/pIiutC0S0W
AT57CKul41+DUPJ7XhKlCuuo2ZUL6wiYKkecRp8+hsMWllUaN9Jg+gsPKZQXwL18
ykKOsfYqQR+qinUNRqZTvzJUlMZNJCOpeTZnrVx1gIRv03UpCFnLSCQlDDRWqHkZ
CfDemVw6oZdyHY+0qNroKYENpbqWoA==
=SYeH
-----END PGP SIGNATURE-----
Merge tag 'regulator-fix-v7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator fix from Mark Brown:
"One straightforward driver fix for some incorrectly described
bitfields in the ltc3676 driver"
* tag 'regulator-fix-v7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
Jiayuan Chen says:
====================
bpf: Add memory usage for arena and selftest
arena is the only map type whose map_mem_usage() still returns 0, so
bpftool and fdinfo always show 0 memlock for it no matter how many pages
it holds. This series adds the accounting, runs the arena selftests
serially so they don't OOM a small CI VM, and adds a test for it.
v1 -> v2:
- split the scratch_page -> arena refactor into a prep patch (no
functional change)
- use WRITE_ONCE() for nr_pages to pair with the lockless reader
- reword the "run serially" commit message
- selftest: alloc prog returns 0 so the failure check is reached
v1: https://lore.kernel.org/bpf/20260716142746.8794-1-jiayuan.chen@linux.dev/
====================
Link: https://patch.msgid.link/20260717114117.350851-1-jiayuan.chen@linux.dev
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
