[PATCH 7.1 00/21] 7.1.2-rc1 review

[PATCH 7.1 00/21] 7.1.2-rc1 review

[Greg Kroah-Hartman]

This is the start of the stable review cycle for the 7.1.2 release.
There are 21 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sat, 27 Jun 2026 12:54:50 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.2-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 7.1.2-rc1

Miklos Szeredi <mszeredi@redhat.com>
    virtiofs: fix UAF on submount umount

Ruslan Valiyev <linuxoid@gmail.com>
    media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si

Gil Portnoy <dddhkts1@gmail.com>
    ksmbd: reject non-VALID session in compound request branch

Georgi Djakov <georgi.djakov@oss.qualcomm.com>
    drivers/base/memory: set mem->altmap after successful device registration

Stepan Ionichev <sozdayvek@gmail.com>
    serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails

Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
    serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero

Yi Yang <yiyang13@huawei.com>
    vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write

Giovanni Cabiddu <giovanni.cabiddu@intel.com>
    crypto: qat - remove unused character device and IOCTLs

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: rmi4 - fix bit count in bitmap_copy()

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: rmi4 - iterative IRQ handler

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: rmi4 - fix memory leak in rmi_set_attn_data()

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: rmi4 - fix num_subpackets overflow in register descriptor

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: rmi4 - fix type overflow in register counts

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: rmi4 - refactor register descriptor parsing

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: rmi4 - fix register descriptor address calculation

Sam Daly <sam@samdaly.ie>
    iio: adc: ti-ads1298: add bounds check to pga_settings index

Sam Daly <sam@samdaly.ie>
    iio: light: veml6075: add bounds check to veml6075_it_ms index

Mingyu Wang <25181214217@stu.xidian.edu.cn>
    agp/amd64: Fix broken error propagation in agp_amd64_probe()

Yang Erkun <yangerkun@huawei.com>
    Revert "NFSD: Defer sub-object cleanup in export put callbacks"

Joanne Koong <joannelkoong@gmail.com>
    fuse: re-lock request before replacing page cache folio

Gabriel Krisman Bertazi <krisman@suse.de>
    io_uring/net: Avoid msghdr on op_connect/op_bind async data


-------------

Diffstat:

 Documentation/userspace-api/ioctl/ioctl-number.rst |   1 -
 Makefile                                           |   4 +-
 drivers/base/memory.c                              |   3 +-
 drivers/char/agp/amd64-agp.c                       |   2 +-
 drivers/crypto/intel/qat/qat_common/adf_cfg.c      |  10 -
 drivers/crypto/intel/qat/qat_common/adf_cfg.h      |   1 -
 .../crypto/intel/qat/qat_common/adf_cfg_common.h   |  32 --
 drivers/crypto/intel/qat/qat_common/adf_cfg_user.h |  38 --
 .../crypto/intel/qat/qat_common/adf_common_drv.h   |   3 -
 drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c  | 404 +--------------------
 drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c  |  70 ----
 drivers/iio/adc/ti-ads1298.c                       |   7 +-
 drivers/iio/light/veml6075.c                       |   8 +-
 drivers/input/rmi4/rmi_driver.c                    | 171 +++++----
 drivers/input/rmi4/rmi_driver.h                    |   4 +-
 drivers/input/rmi4/rmi_f12.c                       |   7 +
 drivers/media/test-drivers/vidtv/vidtv_mux.c       |   8 +-
 drivers/tty/serial/8250/8250_dw.c                  |   4 +-
 drivers/tty/serial/qcom_geni_serial.c              |   9 +-
 drivers/tty/vt/vc_screen.c                         |   2 +-
 fs/fuse/dev.c                                      |  19 +-
 fs/fuse/file.c                                     |   8 +-
 fs/nfsd/export.c                                   |  67 +---
 fs/nfsd/export.h                                   |   7 +-
 fs/nfsd/nfsctl.c                                   |   8 +-
 fs/smb/server/smb2pdu.c                            |   5 +
 io_uring/net.c                                     |  36 +-
 io_uring/opdef.c                                   |   4 +-
 28 files changed, 193 insertions(+), 749 deletions(-)

[PATCH 7.1 01/21] io_uring/net: Avoid msghdr on op_connect/op_bind async data

[Greg Kroah-Hartman]

7.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Gabriel Krisman Bertazi <krisman@suse.de>

[ Upstream commit 3979840cd858f30f43ea9f4e7f7f1f56de82d698 ]
This fixes a memory leak due to the lack of the cleanup hook for the
iovec.  The stable backport differs from upstream by dropping the
io_connect_bpf_populate hunk, which didn't exist at the time and by
fixing the merge conflict due to the introduction of
io_bind_file_create.

Both IORING_OP_CONNECT and IORING_OP_BIND reuse the msghdr object just
to store the sockaddr. Beyond allocating a much larger object than
needed, msghdr can also wrap an iovec, which will be recycled
unnecessarily. This uses the sockaddr directly.

Cc: stable@vger.kernel.org
Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de>
Link: https://patch.msgid.link/20260602215327.1885109-2-krisman@suse.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 io_uring/net.c   | 36 ++++++++++++++++++------------------
 io_uring/opdef.c |  4 ++--
 2 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/io_uring/net.c b/io_uring/net.c
index ee848eb65ec99e..bf60cd393b11a5 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -1733,7 +1733,7 @@ int io_socket(struct io_kiocb *req, unsigned int issue_flags)
 int io_connect_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 {
 	struct io_connect *conn = io_kiocb_to_cmd(req, struct io_connect);
-	struct io_async_msghdr *io;
+	struct sockaddr_storage *addr;
 
 	if (sqe->len || sqe->buf_index || sqe->rw_flags || sqe->splice_fd_in)
 		return -EINVAL;
@@ -1742,17 +1742,17 @@ int io_connect_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 	conn->addr_len =  READ_ONCE(sqe->addr2);
 	conn->in_progress = conn->seen_econnaborted = false;
 
-	io = io_msg_alloc_async(req);
-	if (unlikely(!io))
+	addr = io_uring_alloc_async_data(NULL, req);
+	if (unlikely(!addr))
 		return -ENOMEM;
 
-	return move_addr_to_kernel(conn->addr, conn->addr_len, &io->addr);
+	return move_addr_to_kernel(conn->addr, conn->addr_len, addr);
 }
 
 int io_connect(struct io_kiocb *req, unsigned int issue_flags)
 {
 	struct io_connect *connect = io_kiocb_to_cmd(req, struct io_connect);
-	struct io_async_msghdr *io = req->async_data;
+	struct sockaddr_storage *addr = req->async_data;
 	unsigned file_flags;
 	int ret;
 	bool force_nonblock = issue_flags & IO_URING_F_NONBLOCK;
@@ -1766,8 +1766,7 @@ int io_connect(struct io_kiocb *req, unsigned int issue_flags)
 
 	file_flags = force_nonblock ? O_NONBLOCK : 0;
 
-	ret = __sys_connect_file(req->file, &io->addr, connect->addr_len,
-				 file_flags);
+	ret = __sys_connect_file(req->file, addr, connect->addr_len, file_flags);
 	if ((ret == -EAGAIN || ret == -EINPROGRESS || ret == -ECONNABORTED)
 	    && force_nonblock) {
 		if (ret == -EINPROGRESS) {
@@ -1796,7 +1795,6 @@ int io_connect(struct io_kiocb *req, unsigned int issue_flags)
 out:
 	if (ret < 0)
 		req_set_fail(req);
-	io_req_msg_cleanup(req, issue_flags);
 	io_req_set_res(req, ret, 0);
 	return IOU_COMPLETE;
 }
@@ -1806,15 +1804,15 @@ int io_connect(struct io_kiocb *req, unsigned int issue_flags)
  * which in turn end up in mnt_want_write() which will grab the fs
  * percpu start write sem. This can trigger a lockdep warning.
  */
-static int io_bind_file_create(const struct io_async_msghdr *io, int addr_len)
+static int io_bind_file_create(const struct sockaddr_storage *addr, int addr_len)
 {
 	const struct sockaddr_un *sun;
 
-	if (io->addr.ss_family != AF_UNIX)
+	if (addr->ss_family != AF_UNIX)
 		return 0;
 	if (addr_len <= offsetof(struct sockaddr_un, sun_path))
 		return 0;
-	sun = (const struct sockaddr_un *) &io->addr;
+	sun = (const struct sockaddr_un *) addr;
 	return sun->sun_path[0] != '\0';
 }
 
@@ -1822,7 +1820,7 @@ int io_bind_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 {
 	struct io_bind *bind = io_kiocb_to_cmd(req, struct io_bind);
 	struct sockaddr __user *uaddr;
-	struct io_async_msghdr *io;
+	struct sockaddr_storage *addr;
 	int ret;
 
 	if (sqe->len || sqe->buf_index || sqe->rw_flags || sqe->splice_fd_in)
@@ -1831,21 +1829,23 @@ int io_bind_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 	uaddr = u64_to_user_ptr(READ_ONCE(sqe->addr));
 	bind->addr_len =  READ_ONCE(sqe->addr2);
 
-	io = io_msg_alloc_async(req);
-	if (unlikely(!io))
+	addr = io_uring_alloc_async_data(NULL, req);
+	if (unlikely(!addr))
 		return -ENOMEM;
-	ret = move_addr_to_kernel(uaddr, bind->addr_len, &io->addr);
+
+	ret = move_addr_to_kernel(uaddr, bind->addr_len, addr);
 	if (unlikely(ret))
 		return ret;
-	if (io_bind_file_create(io, bind->addr_len))
+	if (io_bind_file_create(addr, bind->addr_len))
 		req->flags |= REQ_F_FORCE_ASYNC;
 	return 0;
 }
 
+
 int io_bind(struct io_kiocb *req, unsigned int issue_flags)
 {
 	struct io_bind *bind = io_kiocb_to_cmd(req, struct io_bind);
-	struct io_async_msghdr *io = req->async_data;
+	struct sockaddr_storage *addr = req->async_data;
 	struct socket *sock;
 	int ret;
 
@@ -1853,7 +1853,7 @@ int io_bind(struct io_kiocb *req, unsigned int issue_flags)
 	if (unlikely(!sock))
 		return -ENOTSOCK;
 
-	ret = __sys_bind_socket(sock, &io->addr, bind->addr_len);
+	ret = __sys_bind_socket(sock, addr, bind->addr_len);
 	if (ret < 0)
 		req_set_fail(req);
 	io_req_set_res(req, ret, 0);
diff --git a/io_uring/opdef.c b/io_uring/opdef.c
index c3ef52b7081132..34cd320a427b8f 100644
--- a/io_uring/opdef.c
+++ b/io_uring/opdef.c
@@ -203,7 +203,7 @@ const struct io_issue_def io_issue_defs[] = {
 		.unbound_nonreg_file	= 1,
 		.pollout		= 1,
 #if defined(CONFIG_NET)
-		.async_size		= sizeof(struct io_async_msghdr),
+		.async_size		= sizeof(struct sockaddr_storage),
 		.prep			= io_connect_prep,
 		.issue			= io_connect,
 #else
@@ -503,7 +503,7 @@ const struct io_issue_def io_issue_defs[] = {
 		.needs_file		= 1,
 		.prep			= io_bind_prep,
 		.issue			= io_bind,
-		.async_size		= sizeof(struct io_async_msghdr),
+		.async_size		= sizeof(struct sockaddr_storage),
 #else
 		.prep			= io_eopnotsupp_prep,
 #endif
-- 
2.53.0

[PATCH 7.1 02/21] fuse: re-lock request before replacing page cache folio

[Greg Kroah-Hartman]

7.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Joanne Koong <joannelkoong@gmail.com>

commit a078484921052d0badd827fcc2770b5cfc1d4120 upstream.

fuse_try_move_folio() unlocks the request on entry but does not
re-lock it on the success path. This means fuse_chan_abort() can end the
request and free the fuse_io_args (eg fuse_readpages_end()) while the
subsequent copy chain logic after fuse_try_move_folio() accesses the
fuse_io_args, leading to use-after-free issues.

Fix this by calling lock_request() before replace_page_cache_folio().
This ensures the request is locked on the success path which will
prevent the fuse_io_args from being freed while the later copying logic
runs, and also ensures that the ap->folios[i]->mapping is never null
since ap->folios[i] will always point to the newfolio after
replace_page_cache_folio().

Fixes: ce534fb05292 ("fuse: allow splice to move pages")
Cc: stable@vger.kernel.org
Reported-by: Lei Lu <llfamsec@gmail.com>
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/fuse/dev.c |   19 +++++--------------
 1 file changed, 5 insertions(+), 14 deletions(-)

--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1037,6 +1037,10 @@ static int fuse_try_move_folio(struct fu
 	if (WARN_ON(folio_test_mlocked(oldfolio)))
 		goto out_fallback_unlock;
 
+	err = lock_request(cs->req);
+	if (err)
+		goto out_fallback_unlock;
+
 	replace_page_cache_folio(oldfolio, newfolio);
 
 	folio_get(newfolio);
@@ -1050,20 +1054,7 @@ static int fuse_try_move_folio(struct fu
 	 */
 	pipe_buf_release(cs->pipe, buf);
 
-	err = 0;
-	spin_lock(&cs->req->waitq.lock);
-	if (test_bit(FR_ABORTED, &cs->req->flags))
-		err = -ENOENT;
-	else
-		*foliop = newfolio;
-	spin_unlock(&cs->req->waitq.lock);
-
-	if (err) {
-		folio_unlock(newfolio);
-		folio_put(newfolio);
-		goto out_put_old;
-	}
-
+	*foliop = newfolio;
 	folio_unlock(oldfolio);
 	/* Drop ref for ap->pages[] array */
 	folio_put(oldfolio);

[PATCH 7.1 03/21] Revert "NFSD: Defer sub-object cleanup in export put callbacks"

[Greg Kroah-Hartman]

7.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yang Erkun <yangerkun@huawei.com>

commit 516403d4d85607fdef3ca41d4a56b54e5566fa9a upstream.

This reverts commit 48db892356d6cb80f6942885545de4a6dd8d2a29.

Commit 48db892356d6 ("NFSD: Defer sub-object cleanup in export
put callbacks") moved path_put() and auth_domain_put() out of
svc_export_put() and expkey_put() and behind queue_rcu_work() to
close a claimed use-after-free in e_show() and c_show() against
ex_path and ex_client->name. Discussion in [1] shows neither
the diagnosis nor the remedy survives review.

The downstream teardown of both sub-objects is already RCU-deferred.
auth_domain_put() reaches svcauth_unix_domain_release(), which frees
the unix_domain and its ->name through call_rcu(). path_put()
reaches dentry_free(), which frees the dentry through call_rcu(),
and prepend_path() is already structured to tolerate concurrent
dentry teardown. A reader in cache_seq_start_rcu() therefore
observes both sub-objects through the next grace period regardless
of whether svc_export_put() runs synchronously, so the synchronous
form was never unsafe.

The crash signature in the report cited by commit 48db892356d6
("NFSD: Defer sub-object cleanup in export put callbacks") has a
different root cause: a /proc/net/rpc cache file held open across
network-namespace exit lets cache_destroy_net() free cd->hash_table
while a reader is still walking it. The correct fix pins cd->net for
the open fd's lifetime and does not require any deferral inside
svc_export_put().

Meanwhile, deferring path_put() out of svc_export_put() reintroduces
the regression that commit 69d803c40ede ("nfsd: Revert "nfsd:
release svc_expkey/svc_export with rcu_work"") repaired: after
"exportfs -r" drops the last cache reference, the mount reference
held through ex_path lingers in the workqueue, so a subsequent
umount fails with EBUSY.

Restore the synchronous path_put() and auth_domain_put() in
svc_export_put() and expkey_put() and the call_rcu()/kfree_rcu()
free of the containing structures. The unrelated fix for
ex_uuid/ex_stats from commit 2530766492ec ("nfsd: fix UAF when
access ex_uuid or ex_stats") is preserved.

Link: https://lore.kernel.org/all/10019b42-4589-4f9f-8d5b-d8197db1ce3c@huawei.com/ [1]
Fixes: 48db892356d6 ("NFSD: Defer sub-object cleanup in export put callbacks")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Tested-by: Alexandr Alexandrov <alexandr.alexandrov@oracle.com>
Signed-off-by: Yang Erkun <yangerkun@huawei.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/export.c |   63 +++++++------------------------------------------------
 fs/nfsd/export.h |    7 +-----
 fs/nfsd/nfsctl.c |    8 ------
 3 files changed, 12 insertions(+), 66 deletions(-)

--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -36,30 +36,19 @@
  * second map contains a reference to the entry in the first map.
  */
 
-static struct workqueue_struct *nfsd_export_wq;
-
 #define	EXPKEY_HASHBITS		8
 #define	EXPKEY_HASHMAX		(1 << EXPKEY_HASHBITS)
 #define	EXPKEY_HASHMASK		(EXPKEY_HASHMAX -1)
 
-static void expkey_release(struct work_struct *work)
+static void expkey_put(struct kref *ref)
 {
-	struct svc_expkey *key = container_of(to_rcu_work(work),
-					      struct svc_expkey, ek_rwork);
+	struct svc_expkey *key = container_of(ref, struct svc_expkey, h.ref);
 
 	if (test_bit(CACHE_VALID, &key->h.flags) &&
 	    !test_bit(CACHE_NEGATIVE, &key->h.flags))
 		path_put(&key->ek_path);
 	auth_domain_put(key->ek_client);
-	kfree(key);
-}
-
-static void expkey_put(struct kref *ref)
-{
-	struct svc_expkey *key = container_of(ref, struct svc_expkey, h.ref);
-
-	INIT_RCU_WORK(&key->ek_rwork, expkey_release);
-	queue_rcu_work(nfsd_export_wq, &key->ek_rwork);
+	kfree_rcu(key, ek_rcu);
 }
 
 static int expkey_upcall(struct cache_detail *cd, struct cache_head *h)
@@ -364,13 +353,11 @@ static void export_stats_destroy(struct
 					    EXP_STATS_COUNTERS_NUM);
 }
 
-static void svc_export_release(struct work_struct *work)
+static void svc_export_release(struct rcu_head *rcu_head)
 {
-	struct svc_export *exp = container_of(to_rcu_work(work),
-					      struct svc_export, ex_rwork);
+	struct svc_export *exp = container_of(rcu_head, struct svc_export,
+			ex_rcu);
 
-	path_put(&exp->ex_path);
-	auth_domain_put(exp->ex_client);
 	nfsd4_fslocs_free(&exp->ex_fslocs);
 	export_stats_destroy(exp->ex_stats);
 	kfree(exp->ex_stats);
@@ -382,8 +369,9 @@ static void svc_export_put(struct kref *
 {
 	struct svc_export *exp = container_of(ref, struct svc_export, h.ref);
 
-	INIT_RCU_WORK(&exp->ex_rwork, svc_export_release);
-	queue_rcu_work(nfsd_export_wq, &exp->ex_rwork);
+	path_put(&exp->ex_path);
+	auth_domain_put(exp->ex_client);
+	call_rcu(&exp->ex_rcu, svc_export_release);
 }
 
 static int svc_export_upcall(struct cache_detail *cd, struct cache_head *h)
@@ -1492,36 +1480,6 @@ const struct seq_operations nfs_exports_
 	.show	= e_show,
 };
 
-/**
- * nfsd_export_wq_init - allocate the export release workqueue
- *
- * Called once at module load. The workqueue runs deferred svc_export and
- * svc_expkey release work scheduled by queue_rcu_work() in the cache put
- * callbacks.
- *
- * Return values:
- *   %0: workqueue allocated
- *   %-ENOMEM: allocation failed
- */
-int nfsd_export_wq_init(void)
-{
-	nfsd_export_wq = alloc_workqueue("nfsd_export", WQ_UNBOUND, 0);
-	if (!nfsd_export_wq)
-		return -ENOMEM;
-	return 0;
-}
-
-/**
- * nfsd_export_wq_shutdown - drain and free the export release workqueue
- *
- * Called once at module unload. Per-namespace teardown in
- * nfsd_export_shutdown() has already drained all deferred work.
- */
-void nfsd_export_wq_shutdown(void)
-{
-	destroy_workqueue(nfsd_export_wq);
-}
-
 /*
  * Initialize the exports module.
  */
@@ -1583,9 +1541,6 @@ nfsd_export_shutdown(struct net *net)
 
 	cache_unregister_net(nn->svc_expkey_cache, net);
 	cache_unregister_net(nn->svc_export_cache, net);
-	/* Drain deferred export and expkey release work. */
-	rcu_barrier();
-	flush_workqueue(nfsd_export_wq);
 	cache_destroy_net(nn->svc_expkey_cache, net);
 	cache_destroy_net(nn->svc_export_cache, net);
 	svcauth_unix_purge(net);
--- a/fs/nfsd/export.h
+++ b/fs/nfsd/export.h
@@ -7,7 +7,6 @@
 
 #include <linux/sunrpc/cache.h>
 #include <linux/percpu_counter.h>
-#include <linux/workqueue.h>
 #include <uapi/linux/nfsd/export.h>
 #include <linux/nfs4.h>
 
@@ -76,7 +75,7 @@ struct svc_export {
 	u32			ex_layout_types;
 	struct nfsd4_deviceid_map *ex_devid_map;
 	struct cache_detail	*cd;
-	struct rcu_work		ex_rwork;
+	struct rcu_head		ex_rcu;
 	unsigned long		ex_xprtsec_modes;
 	struct export_stats	*ex_stats;
 };
@@ -93,7 +92,7 @@ struct svc_expkey {
 	u32			ek_fsid[6];
 
 	struct path		ek_path;
-	struct rcu_work		ek_rwork;
+	struct rcu_head		ek_rcu;
 };
 
 #define EX_ISSYNC(exp)		(!((exp)->ex_flags & NFSEXP_ASYNC))
@@ -111,8 +110,6 @@ __be32 check_nfsd_access(struct svc_expo
 /*
  * Function declarations
  */
-int			nfsd_export_wq_init(void);
-void			nfsd_export_wq_shutdown(void);
 int			nfsd_export_init(struct net *);
 void			nfsd_export_shutdown(struct net *);
 void			nfsd_export_flush(struct net *);
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -2320,12 +2320,9 @@ static int __init init_nfsd(void)
 	if (retval)
 		goto out_free_pnfs;
 	nfsd_lockd_init();	/* lockd->nfsd callbacks */
-	retval = nfsd_export_wq_init();
-	if (retval)
-		goto out_free_lockd;
 	retval = register_pernet_subsys(&nfsd_net_ops);
 	if (retval < 0)
-		goto out_free_export_wq;
+		goto out_free_lockd;
 	retval = register_cld_notifier();
 	if (retval)
 		goto out_free_subsys;
@@ -2354,8 +2351,6 @@ out_free_cld:
 	unregister_cld_notifier();
 out_free_subsys:
 	unregister_pernet_subsys(&nfsd_net_ops);
-out_free_export_wq:
-	nfsd_export_wq_shutdown();
 out_free_lockd:
 	nfsd_lockd_shutdown();
 	nfsd_drc_slab_free();
@@ -2376,7 +2371,6 @@ static void __exit exit_nfsd(void)
 	nfsd4_destroy_laundry_wq();
 	unregister_cld_notifier();
 	unregister_pernet_subsys(&nfsd_net_ops);
-	nfsd_export_wq_shutdown();
 	nfsd_drc_slab_free();
 	nfsd_lockd_shutdown();
 	nfsd4_free_slabs();

[PATCH 7.1 04/21] agp/amd64: Fix broken error propagation in agp_amd64_probe()

[Greg Kroah-Hartman]

7.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mingyu Wang <25181214217@stu.xidian.edu.cn>

commit b08472db93b1ccff84a7adec5779d47f0e9d3a30 upstream.

A NULL pointer dereference was observed in the AMD64 AGP driver when
running in a virtualized environment (e.g. qemu/kvm) without a physical
AMD northbridge. The crash occurs in amd64_fetch_size() when attempting
to dereference the pointer returned by node_to_amd_nb(0).

The root cause of this crash is broken error propagation in
agp_amd64_probe(): When no AMD northbridges are found, cache_nbs()
correctly returns -ENODEV. However, the probe function erroneously
checks the return value against exactly -1, rather than < 0.

As a result, the hardware absence error is masked, allowing the driver
to improperly proceed with initialization. It eventually calls
agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware
does not exist, node_to_amd_nb(0) returns NULL, leading to a General
Protection Fault (GPF) when accessing its ->misc member.

Fix the issue by correcting the error check in agp_amd64_probe() to
abort properly when cache_nbs() returns any negative error code. This
prevents the driver from erroneously proceeding without hardware, thereby
avoiding the subsequent NULL pointer dereference at its source.

Fixes: a32073bffc65 ("[PATCH] x86_64: Clean and enhance up K8 northbridge access code")
Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn>
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Cc: stable@vger.kernel.org # v2.6.18+
Link: https://patch.msgid.link/20260504074823.99377-1-w15303746062@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/char/agp/amd64-agp.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -546,7 +546,7 @@ static int agp_amd64_probe(struct pci_de
 	/* Fill in the mode register */
 	pci_read_config_dword(pdev, bridge->capndx+PCI_AGP_STATUS, &bridge->mode);
 
-	if (cache_nbs(pdev, cap_ptr) == -1) {
+	if (cache_nbs(pdev, cap_ptr) < 0) {
 		agp_put_bridge(bridge);
 		return -ENODEV;
 	}

[PATCH 7.1 05/21] iio: light: veml6075: add bounds check to veml6075_it_ms index

[Greg Kroah-Hartman]

7.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sam Daly <sam@samdaly.ie>

commit 307dc4240bd41852d9e0912921e298160db1c109 upstream.

veml6075_it_ms has 5 elements but VEML6075_CONF_IT can yield values 0-7.
If it returns a value >= 5, this causes an out-of-bounds array access.
Add a bounds check and return -EINVAL if the index is out of range.

The problem values are reserved so should never be read from the
register. Hence this is hardening against fault device, missprogramming
or bus corruption.

Assisted-by: gkh_clanker_2000
Cc: stable <stable@kernel.org>
Signed-off-by: Sam Daly <sam@samdaly.ie>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/light/veml6075.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/iio/light/veml6075.c
+++ b/drivers/iio/light/veml6075.c
@@ -100,7 +100,7 @@ static const struct iio_chan_spec veml60
 
 static int veml6075_request_measurement(struct veml6075_data *data)
 {
-	int ret, conf, int_time;
+	int ret, conf, int_time, int_index;
 
 	ret = regmap_read(data->regmap, VEML6075_CMD_CONF, &conf);
 	if (ret < 0)
@@ -117,7 +117,11 @@ static int veml6075_request_measurement(
 	 * time for all possible configurations. Using a 1.50 factor simplifies
 	 * operations and ensures reliability under all circumstances.
 	 */
-	int_time = veml6075_it_ms[FIELD_GET(VEML6075_CONF_IT, conf)];
+	int_index = FIELD_GET(VEML6075_CONF_IT, conf);
+	if (int_index >= ARRAY_SIZE(veml6075_it_ms))
+		return -EINVAL;
+
+	int_time = veml6075_it_ms[int_index];
 	msleep(int_time + (int_time / 2));
 
 	/* shutdown again, data registers are still accessible */

[PATCH 7.1 06/21] iio: adc: ti-ads1298: add bounds check to pga_settings index

[Greg Kroah-Hartman]

7.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sam Daly <sam@samdaly.ie>

commit 95e8a48d7a85d4226934020e57815a3316d3a14b upstream.

ads1298_pga_settings has 7 elements but ADS1298_MASK_CH_PGA can yield
values 0-7. If it yields a value >= 7, this causes an out-of-bounds
array access. Add a bounds check and return -EINVAL if the index
is out of range.

Note that the remaining value b111 is reserved so should not be seen
in a correctly functioning system.

Assisted-by: gkh_clanker_2000
Cc: stable <stable@kernel.org>
Cc: Jonathan Cameron <jic23@kernel.org>
Cc: David Lechner <dlechner@baylibre.com>
Cc: "Nuno Sá" <nuno.sa@analog.com>
Cc: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Sam Daly <sam@samdaly.ie>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/adc/ti-ads1298.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/drivers/iio/adc/ti-ads1298.c
+++ b/drivers/iio/adc/ti-ads1298.c
@@ -279,6 +279,7 @@ static const u8 ads1298_pga_settings[] =
 static int ads1298_get_scale(struct ads1298_private *priv,
 			     int channel, int *val, int *val2)
 {
+	unsigned int pga_idx;
 	int ret;
 	unsigned int regval;
 	u8 gain;
@@ -302,7 +303,11 @@ static int ads1298_get_scale(struct ads1
 	if (ret)
 		return ret;
 
-	gain = ads1298_pga_settings[FIELD_GET(ADS1298_MASK_CH_PGA, regval)];
+	pga_idx = FIELD_GET(ADS1298_MASK_CH_PGA, regval);
+	if (pga_idx >= ARRAY_SIZE(ads1298_pga_settings))
+		return -EINVAL;
+
+	gain = ads1298_pga_settings[pga_idx];
 	*val /= gain; /* Full scale is VREF / gain */
 
 	*val2 = ADS1298_BITS_PER_SAMPLE - 1; /* Signed, hence the -1 */

[PATCH 7.1 07/21] Input: rmi4 - fix register descriptor address calculation

[Greg Kroah-Hartman]

7.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>

commit a98518e72439fd42cbfe641c2896543cb088e3d1 upstream.

When reading the register descriptor, the base address is incremented by
1 to read the presence register block. However, after reading the
presence register block, the address is incorrectly incremented by only
1 byte (++addr) instead of the actual size of the presence block
(size_presence_reg). This causes the subsequent structure block read to
read from the wrong memory location if the presence block is larger than
1 byte.

Fix this by advancing the address by size_presence_reg.

Fixes: 2b6a321da9a2 ("Input: synaptics-rmi4 - add support for Synaptics RMI4 devices")
Cc: stable@vger.kernel.org
Assisted-by: Gemini:gemini-3.1-pro
Link: https://patch.msgid.link/20260505045952.1570713-1-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/rmi4/rmi_driver.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -594,7 +594,7 @@ int rmi_read_register_desc(struct rmi_de
 	ret = rmi_read_block(d, addr, buf, size_presence_reg);
 	if (ret)
 		return ret;
-	++addr;
+	addr += size_presence_reg;
 
 	if (buf[0] == 0) {
 		presense_offset = 3;

[PATCH 7.1 08/21] Input: rmi4 - refactor register descriptor parsing

[Greg Kroah-Hartman]

7.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>

commit 0adb483fbf2dc43c875cd7550a58b41e92efc52d upstream.

Factor out parsing a register descriptor item from
rmi_read_register_desc() and ensure there are no out-of-bounds accesses.

Use get_unaligned_le16() and get_unaligned_le32() for reading multi-byte
values.

Reported-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fixes: 2b6a321da9a2 ("Input: synaptics-rmi4 - add support for Synaptics RMI4 devices")
Cc: stable@vger.kernel.org
Assisted-by: Gemini:gemini-3.1-pro
Link: https://patch.msgid.link/20260505045952.1570713-2-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/rmi4/rmi_driver.c |  124 ++++++++++++++++++++++++----------------
 1 file changed, 76 insertions(+), 48 deletions(-)

--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -22,6 +22,7 @@
 #include <uapi/linux/input.h>
 #include <linux/rmi.h>
 #include <linux/export.h>
+#include <linux/unaligned.h>
 #include "rmi_bus.h"
 #include "rmi_driver.h"
 
@@ -558,30 +559,74 @@ int rmi_scan_pdt(struct rmi_device *rmi_
 	return retval < 0 ? retval : 0;
 }
 
+static int rmi_parse_register_desc_item(struct rmi_register_desc_item *item,
+					const u8 *buf, size_t size)
+{
+	unsigned int offset = 0;
+	unsigned int map_offset = 0;
+	int b;
+
+	if (offset >= size)
+		return -EIO;
+
+	item->reg_size = buf[offset++];
+	if (item->reg_size == 0) {
+		if (size - offset < 2)
+			return -EIO;
+		item->reg_size = get_unaligned_le16(&buf[offset]);
+		offset += 2;
+	}
+
+	if (item->reg_size == 0) {
+		if (size - offset < 4)
+			return -EIO;
+		item->reg_size = get_unaligned_le32(&buf[offset]);
+		offset += 4;
+	}
+
+	do {
+		if (offset >= size)
+			return -EIO;
+
+		for (b = 0; b < 7; b++) {
+			if (buf[offset] & BIT(b)) {
+				if (map_offset >= RMI_REG_DESC_SUBPACKET_BITS)
+					return -EIO;
+				__set_bit(map_offset, item->subpacket_map);
+			}
+			++map_offset;
+		}
+	} while (buf[offset++] & BIT(7));
+
+	item->num_subpackets = bitmap_weight(item->subpacket_map,
+					     RMI_REG_DESC_SUBPACKET_BITS);
+
+	return offset;
+}
+
 int rmi_read_register_desc(struct rmi_device *d, u16 addr,
-				struct rmi_register_descriptor *rdesc)
+			   struct rmi_register_descriptor *rdesc)
 {
 	int ret;
 	u8 size_presence_reg;
 	u8 buf[35];
-	int presense_offset = 1;
-	u8 *struct_buf;
-	int reg;
-	int offset = 0;
-	int map_offset = 0;
+	unsigned int presence_offset;
+	unsigned int map_offset;
+	unsigned int offset;
+	unsigned int reg;
 	int i;
 	int b;
 
 	/*
 	 * The first register of the register descriptor is the size of
-	 * the register descriptor's presense register.
+	 * the register descriptor's presence register.
 	 */
 	ret = rmi_read(d, addr, &size_presence_reg);
 	if (ret)
 		return ret;
 	++addr;
 
-	if (size_presence_reg < 0 || size_presence_reg > 35)
+	if (size_presence_reg < 1 || size_presence_reg > 35)
 		return -EIO;
 
 	memset(buf, 0, sizeof(buf));
@@ -597,16 +642,23 @@ int rmi_read_register_desc(struct rmi_de
 	addr += size_presence_reg;
 
 	if (buf[0] == 0) {
-		presense_offset = 3;
-		rdesc->struct_size = buf[1] | (buf[2] << 8);
+		if (size_presence_reg < 3)
+			return -EIO;
+		presence_offset = 3;
+		rdesc->struct_size = get_unaligned_le16(&buf[1]);
 	} else {
+		presence_offset = 1;
 		rdesc->struct_size = buf[0];
 	}
 
-	for (i = presense_offset; i < size_presence_reg; i++) {
+	map_offset = 0;
+	for (i = presence_offset; i < size_presence_reg; i++) {
 		for (b = 0; b < 8; b++) {
-			if (buf[i] & (0x1 << b))
+			if (buf[i] & BIT(b)) {
+				if (map_offset >= RMI_REG_DESC_PRESENSE_BITS)
+					return -EIO;
 				bitmap_set(rdesc->presense_map, map_offset, 1);
+			}
 			++map_offset;
 		}
 	}
@@ -626,7 +678,7 @@ int rmi_read_register_desc(struct rmi_de
 	 * I'm not using devm_kzalloc here since it will not be retained
 	 * after exiting this function
 	 */
-	struct_buf = kzalloc(rdesc->struct_size, GFP_KERNEL);
+	u8 *struct_buf __free(kfree) = kzalloc(rdesc->struct_size, GFP_KERNEL);
 	if (!struct_buf)
 		return -ENOMEM;
 
@@ -638,56 +690,32 @@ int rmi_read_register_desc(struct rmi_de
 	 */
 	ret = rmi_read_block(d, addr, struct_buf, rdesc->struct_size);
 	if (ret)
-		goto free_struct_buff;
+		return ret;
 
 	reg = find_first_bit(rdesc->presense_map, RMI_REG_DESC_PRESENSE_BITS);
+	offset = 0;
 	for (i = 0; i < rdesc->num_registers; i++) {
 		struct rmi_register_desc_item *item = &rdesc->registers[i];
-		int reg_size = struct_buf[offset];
+		int item_size;
 
-		++offset;
-		if (reg_size == 0) {
-			reg_size = struct_buf[offset] |
-					(struct_buf[offset + 1] << 8);
-			offset += 2;
-		}
-
-		if (reg_size == 0) {
-			reg_size = struct_buf[offset] |
-					(struct_buf[offset + 1] << 8) |
-					(struct_buf[offset + 2] << 16) |
-					(struct_buf[offset + 3] << 24);
-			offset += 4;
-		}
+		item_size = rmi_parse_register_desc_item(item,
+							 &struct_buf[offset],
+							 rdesc->struct_size - offset);
+		if (item_size < 0)
+			return item_size;
 
 		item->reg = reg;
-		item->reg_size = reg_size;
-
-		map_offset = 0;
-
-		do {
-			for (b = 0; b < 7; b++) {
-				if (struct_buf[offset] & (0x1 << b))
-					bitmap_set(item->subpacket_map,
-						map_offset, 1);
-				++map_offset;
-			}
-		} while (struct_buf[offset++] & 0x80);
-
-		item->num_subpackets = bitmap_weight(item->subpacket_map,
-						RMI_REG_DESC_SUBPACKET_BITS);
+		offset += item_size;
 
 		rmi_dbg(RMI_DEBUG_CORE, &d->dev,
 			"%s: reg: %d reg size: %ld subpackets: %d\n", __func__,
 			item->reg, item->reg_size, item->num_subpackets);
 
 		reg = find_next_bit(rdesc->presense_map,
-				RMI_REG_DESC_PRESENSE_BITS, reg + 1);
+				    RMI_REG_DESC_PRESENSE_BITS, reg + 1);
 	}
 
-free_struct_buff:
-	kfree(struct_buf);
-	return ret;
+	return 0;
 }
 
 const struct rmi_register_desc_item *rmi_get_register_desc_item(

[PATCH 7.1 09/21] Input: rmi4 - fix type overflow in register counts

[Greg Kroah-Hartman]

7.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>

commit a0a87e441238e07c5f7e3de133ef77a9d4229f01 upstream.

The number of registers in the RMI4 register descriptor is populated
by counting the bits in the presence map using bitmap_weight(). Since
the presence map can contain up to 256 bits (RMI_REG_DESC_PRESENSE_BITS),
storing this count in a u8 can overflow to 0 if all 256 bits are set.

Change the num_registers field in struct rmi_register_descriptor
from u8 to u16 to prevent potential integer overflow and ensure safe
processing of devices reporting large descriptors.

Fixes: 2b6a321da9a2 ("Input: synaptics-rmi4 - add support for Synaptics RMI4 devices")
Cc: stable@vger.kernel.org
Assisted-by: Gemini:gemini-3.1-pro
Link: https://patch.msgid.link/20260505045952.1570713-3-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/rmi4/rmi_driver.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/input/rmi4/rmi_driver.h
+++ b/drivers/input/rmi4/rmi_driver.h
@@ -65,7 +65,7 @@ struct rmi_register_desc_item {
 struct rmi_register_descriptor {
 	unsigned long struct_size;
 	unsigned long presense_map[BITS_TO_LONGS(RMI_REG_DESC_PRESENSE_BITS)];
-	u8 num_registers;
+	u16 num_registers;
 	struct rmi_register_desc_item *registers;
 };
 

[PATCH 7.1 10/21] Input: rmi4 - fix num_subpackets overflow in register descriptor

[Greg Kroah-Hartman]

7.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>

commit 2b4b482d5c4c23c668b998a7da985aea0fa4a978 upstream.

RMI_REG_DESC_SUBPACKET_BITS is defined as 296 (37 * BITS_PER_BYTE). This
may overflow num_subpackets in struct rmi_register_desc_item which is
defined as a u8.

Fix this by changing the type of num_subpackets to u16.

Fixes: 2b6a321da9a2 ("Input: synaptics-rmi4 - add support for Synaptics RMI4 devices")
Cc: stable@vger.kernel.org
Assisted-by: Gemini:gemini-3.1-pro
Link: https://patch.msgid.link/20260505045952.1570713-4-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/rmi4/rmi_driver.h |    2 +-
 drivers/input/rmi4/rmi_f12.c    |    7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

--- a/drivers/input/rmi4/rmi_driver.h
+++ b/drivers/input/rmi4/rmi_driver.h
@@ -53,7 +53,7 @@ struct pdt_entry {
 struct rmi_register_desc_item {
 	u16 reg;
 	unsigned long reg_size;
-	u8 num_subpackets;
+	u16 num_subpackets;
 	unsigned long subpacket_map[BITS_TO_LONGS(
 				RMI_REG_DESC_SUBPACKET_BITS)];
 };
--- a/drivers/input/rmi4/rmi_f12.c
+++ b/drivers/input/rmi4/rmi_f12.c
@@ -467,6 +467,13 @@ static int rmi_f12_probe(struct rmi_func
 		f12->data1 = item;
 		f12->data1_offset = data_offset;
 		data_offset += item->reg_size;
+
+		if (item->num_subpackets > 255) {
+			dev_err(&fn->dev, "Too many fingers declared: %d\n",
+				item->num_subpackets);
+			return -EINVAL;
+		}
+
 		sensor->nbr_fingers = item->num_subpackets;
 		sensor->report_abs = 1;
 		sensor->attn_size += item->reg_size;

[PATCH 7.1 11/21] Input: rmi4 - fix memory leak in rmi_set_attn_data()

[Greg Kroah-Hartman]

7.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>

commit a55a683a8e2bddb5467baab3e597a93022d4ee05 upstream.

kfifo_put() returns 0 if the FIFO is full. In this case, we must
free the memory allocated for the attention data to avoid a leak.

Fixes: b908d3cd812a ("Input: synaptics-rmi4 - allow to add attention data")
Cc: stable@vger.kernel.org
Assisted-by: Gemini:gemini-3.1-pro
Link: https://patch.msgid.link/20260505045952.1570713-5-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/rmi4/rmi_driver.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -183,7 +183,11 @@ void rmi_set_attn_data(struct rmi_device
 	attn_data.size = size;
 	attn_data.data = fifo_data;
 
-	kfifo_put(&drvdata->attn_fifo, attn_data);
+	if (!kfifo_put(&drvdata->attn_fifo, attn_data)) {
+		dev_warn_ratelimited(&rmi_dev->dev,
+				     "Failed to enqueue attention data, FIFO full\n");
+		kfree(fifo_data);
+	}
 }
 EXPORT_SYMBOL_GPL(rmi_set_attn_data);
 

[PATCH 7.1 12/21] Input: rmi4 - iterative IRQ handler

[Greg Kroah-Hartman]

7.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>

commit b6ca982afd0e8fbcbb340092d3c6d3b4a217686c upstream.

The current IRQ handler uses recursion to drain the attention FIFO,
which can lead to stack overflow on deep queues. Convert it to a
loop.

Fixes: b908d3cd812a ("Input: synaptics-rmi4 - allow to add attention data")
Cc: stable@vger.kernel.org
Assisted-by: Gemini:gemini-3.1-pro
Link: https://patch.msgid.link/20260505045952.1570713-6-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/rmi4/rmi_driver.c |   32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -198,24 +198,24 @@ static irqreturn_t rmi_irq_fn(int irq, v
 	struct rmi4_attn_data attn_data = {0};
 	int ret, count;
 
-	count = kfifo_get(&drvdata->attn_fifo, &attn_data);
-	if (count) {
-		*(drvdata->irq_status) = attn_data.irq_status;
-		drvdata->attn_data = attn_data;
-	}
+	do {
+		count = kfifo_get(&drvdata->attn_fifo, &attn_data);
+		if (count) {
+			*drvdata->irq_status = attn_data.irq_status;
+			drvdata->attn_data = attn_data;
+		}
 
-	ret = rmi_process_interrupt_requests(rmi_dev);
-	if (ret)
-		rmi_dbg(RMI_DEBUG_CORE, &rmi_dev->dev,
-			"Failed to process interrupt request: %d\n", ret);
+		ret = rmi_process_interrupt_requests(rmi_dev);
+		if (ret)
+			rmi_dbg(RMI_DEBUG_CORE, &rmi_dev->dev,
+				"Failed to process interrupt request: %d\n",
+				ret);
 
-	if (count) {
-		kfree(attn_data.data);
-		drvdata->attn_data.data = NULL;
-	}
-
-	if (!kfifo_is_empty(&drvdata->attn_fifo))
-		return rmi_irq_fn(irq, dev_id);
+		if (count) {
+			kfree(attn_data.data);
+			drvdata->attn_data.data = NULL;
+		}
+	} while (!kfifo_is_empty(&drvdata->attn_fifo));
 
 	return IRQ_HANDLED;
 }

[PATCH 7.1 13/21] Input: rmi4 - fix bit count in bitmap_copy()

[Greg Kroah-Hartman]

7.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>

commit f22dbbcbd1f70ed004a7bf8837e0f0c3cc230b78 upstream.

bitmap_copy() takes number of bits, not bytes (or longs). Correct
the bit count in rmi_driver_set_irq_bits() and
rmi_driver_clear_irq_bits().

Fixes: 2b6a321da9a2 ("Input: synaptics-rmi4 - add support for Synaptics RMI4 devices")
Cc: stable@vger.kernel.org
Assisted-by: Gemini:gemini-3.1-pro
Link: https://patch.msgid.link/20260505045952.1570713-7-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/rmi4/rmi_driver.c |    7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -388,9 +388,8 @@ static int rmi_driver_set_irq_bits(struc
 							__func__);
 		goto error_unlock;
 	}
-	bitmap_copy(data->current_irq_mask, data->new_irq_mask,
-		    data->num_of_irq_regs);
 
+	bitmap_copy(data->current_irq_mask, data->new_irq_mask, data->irq_count);
 	bitmap_or(data->fn_irq_bits, data->fn_irq_bits, mask, data->irq_count);
 
 error_unlock:
@@ -419,8 +418,8 @@ static int rmi_driver_clear_irq_bits(str
 							__func__);
 		goto error_unlock;
 	}
-	bitmap_copy(data->current_irq_mask, data->new_irq_mask,
-		    data->num_of_irq_regs);
+
+	bitmap_copy(data->current_irq_mask, data->new_irq_mask, data->irq_count);
 
 error_unlock:
 	mutex_unlock(&data->irq_mutex);

[PATCH 7.1 14/21] crypto: qat - remove unused character device and IOCTLs

[Greg Kroah-Hartman]

7.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>

commit d237230728c567297f2f98b425d63156ab2ed17f upstream.

The QAT driver exposes a character device (qat_adf_ctl) with IOCTLs
for device configuration, start, stop, status query and enumeration.
These IOCTLs are not part of any public uAPI header and have no known
in-tree or out-of-tree users. Device lifecycle is already managed via
sysfs.

The ioctl interface also increases the attack surface and is the
subject of a number of bug reports.

Remove the character device, the IOCTL definitions, and the related
data structures (adf_dev_status_info, adf_user_cfg_key_val,
adf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused
adf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal
module_init/module_exit hooks for workqueue, AER, and crypto/compression
algorithm registration.

Clean up leftover dead code that was only reachable from the removed
IOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(),
adf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(),
adf_get_vf_real_id() and the unused ADF_CFG macros.

Additionally, drop the entry associated to QAT IOCTLs in
ioctl-number.rst.

Cc: stable@vger.kernel.org
Fixes: d8cba25d2c68 ("crypto: qat - Intel(R) QAT driver framework")
Reported-by: Zhi Wang <wangzhi@stu.xidian.edu.cn>
Reported-by: Bin Yu <byu@xidian.edu.cn>
Reported-by: MingYu Wang <w15303746062@163.com>
Closes: https://lore.kernel.org/all/61d6d499.ab89.19b9b7f3186.Coremail.wangzhi_xd@stu.xidian.edu.cn/
Link: https://lore.kernel.org/all/20260508034841.256794-1-w15303746062@163.com/
Link: https://lore.kernel.org/all/20260508023542.256299-1-w15303746062@163.com/
Link: https://lore.kernel.org/all/20260504025120.98242-1-w15303746062@163.com/
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Ahsan Atta <ahsan.atta@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Documentation/userspace-api/ioctl/ioctl-number.rst   |    1 
 drivers/crypto/intel/qat/qat_common/adf_cfg.c        |   10 
 drivers/crypto/intel/qat/qat_common/adf_cfg.h        |    1 
 drivers/crypto/intel/qat/qat_common/adf_cfg_common.h |   32 -
 drivers/crypto/intel/qat/qat_common/adf_cfg_user.h   |   38 -
 drivers/crypto/intel/qat/qat_common/adf_common_drv.h |    3 
 drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c    |  404 -------------------
 drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c    |   70 ---
 8 files changed, 1 insertion(+), 558 deletions(-)
 delete mode 100644 drivers/crypto/intel/qat/qat_common/adf_cfg_user.h

--- a/Documentation/userspace-api/ioctl/ioctl-number.rst
+++ b/Documentation/userspace-api/ioctl/ioctl-number.rst
@@ -229,7 +229,6 @@ Code  Seq#    Include File
                                                                        <mailto:gregkh@linuxfoundation.org>
 'a'   all    linux/atm*.h, linux/sonet.h                               ATM on linux
                                                                        <http://lrcwww.epfl.ch/>
-'a'   00-0F  drivers/crypto/qat/qat_common/adf_cfg_common.h            conflict! qat driver
 'b'   00-FF                                                            conflict! bit3 vme host bridge
                                                                        <mailto:natalia@nikhefk.nikhef.nl>
 'b'   00-0F  linux/dma-buf.h                                           conflict!
--- a/drivers/crypto/intel/qat/qat_common/adf_cfg.c
+++ b/drivers/crypto/intel/qat/qat_common/adf_cfg.c
@@ -103,16 +103,6 @@ static void adf_cfg_section_del_all(stru
 static void adf_cfg_section_del_all_except(struct list_head *head,
 					   const char *section_name);
 
-void adf_cfg_del_all(struct adf_accel_dev *accel_dev)
-{
-	struct adf_cfg_device_data *dev_cfg_data = accel_dev->cfg;
-
-	down_write(&dev_cfg_data->lock);
-	adf_cfg_section_del_all(&dev_cfg_data->sec_list);
-	up_write(&dev_cfg_data->lock);
-	clear_bit(ADF_STATUS_CONFIGURED, &accel_dev->status);
-}
-
 void adf_cfg_del_all_except(struct adf_accel_dev *accel_dev,
 			    const char *section_name)
 {
--- a/drivers/crypto/intel/qat/qat_common/adf_cfg.h
+++ b/drivers/crypto/intel/qat/qat_common/adf_cfg.h
@@ -34,7 +34,6 @@ void adf_cfg_dev_remove(struct adf_accel
 void adf_cfg_dev_dbgfs_add(struct adf_accel_dev *accel_dev);
 void adf_cfg_dev_dbgfs_rm(struct adf_accel_dev *accel_dev);
 int adf_cfg_section_add(struct adf_accel_dev *accel_dev, const char *name);
-void adf_cfg_del_all(struct adf_accel_dev *accel_dev);
 void adf_cfg_del_all_except(struct adf_accel_dev *accel_dev,
 			    const char *section_name);
 int adf_cfg_add_key_value_param(struct adf_accel_dev *accel_dev,
--- a/drivers/crypto/intel/qat/qat_common/adf_cfg_common.h
+++ b/drivers/crypto/intel/qat/qat_common/adf_cfg_common.h
@@ -4,18 +4,11 @@
 #define ADF_CFG_COMMON_H_
 
 #include <linux/types.h>
-#include <linux/ioctl.h>
 
 #define ADF_CFG_MAX_STR_LEN 64
 #define ADF_CFG_MAX_KEY_LEN_IN_BYTES ADF_CFG_MAX_STR_LEN
 #define ADF_CFG_MAX_VAL_LEN_IN_BYTES ADF_CFG_MAX_STR_LEN
 #define ADF_CFG_MAX_SECTION_LEN_IN_BYTES ADF_CFG_MAX_STR_LEN
-#define ADF_CFG_BASE_DEC 10
-#define ADF_CFG_BASE_HEX 16
-#define ADF_CFG_ALL_DEVICES 0xFE
-#define ADF_CFG_NO_DEVICE 0xFF
-#define ADF_CFG_AFFINITY_WHATEVER 0xFF
-#define MAX_DEVICE_NAME_SIZE 32
 #define ADF_MAX_DEVICES (32 * 32)
 #define ADF_DEVS_ARRAY_SIZE BITS_TO_LONGS(ADF_MAX_DEVICES)
 
@@ -51,29 +44,4 @@ enum adf_device_type {
 	DEV_420XX,
 	DEV_6XXX,
 };
-
-struct adf_dev_status_info {
-	enum adf_device_type type;
-	__u32 accel_id;
-	__u32 instance_id;
-	__u8 num_ae;
-	__u8 num_accel;
-	__u8 num_logical_accel;
-	__u8 banks_per_accel;
-	__u8 state;
-	__u8 bus;
-	__u8 dev;
-	__u8 fun;
-	char name[MAX_DEVICE_NAME_SIZE];
-};
-
-#define ADF_CTL_IOC_MAGIC 'a'
-#define IOCTL_CONFIG_SYS_RESOURCE_PARAMETERS _IOW(ADF_CTL_IOC_MAGIC, 0, \
-		struct adf_user_cfg_ctl_data)
-#define IOCTL_STOP_ACCEL_DEV _IOW(ADF_CTL_IOC_MAGIC, 1, \
-		struct adf_user_cfg_ctl_data)
-#define IOCTL_START_ACCEL_DEV _IOW(ADF_CTL_IOC_MAGIC, 2, \
-		struct adf_user_cfg_ctl_data)
-#define IOCTL_STATUS_ACCEL_DEV _IOW(ADF_CTL_IOC_MAGIC, 3, __u32)
-#define IOCTL_GET_NUM_DEVICES _IOW(ADF_CTL_IOC_MAGIC, 4, __s32)
 #endif
--- a/drivers/crypto/intel/qat/qat_common/adf_cfg_user.h
+++ /dev/null
@@ -1,38 +0,0 @@
-/* SPDX-License-Identifier: (BSD-3-Clause OR GPL-2.0-only) */
-/* Copyright(c) 2014 - 2020 Intel Corporation */
-#ifndef ADF_CFG_USER_H_
-#define ADF_CFG_USER_H_
-
-#include "adf_cfg_common.h"
-#include "adf_cfg_strings.h"
-
-struct adf_user_cfg_key_val {
-	char key[ADF_CFG_MAX_KEY_LEN_IN_BYTES];
-	char val[ADF_CFG_MAX_VAL_LEN_IN_BYTES];
-	union {
-		struct adf_user_cfg_key_val *next;
-		__u64 padding3;
-	};
-	enum adf_cfg_val_type type;
-} __packed;
-
-struct adf_user_cfg_section {
-	char name[ADF_CFG_MAX_SECTION_LEN_IN_BYTES];
-	union {
-		struct adf_user_cfg_key_val *params;
-		__u64 padding1;
-	};
-	union {
-		struct adf_user_cfg_section *next;
-		__u64 padding3;
-	};
-} __packed;
-
-struct adf_user_cfg_ctl_data {
-	union {
-		struct adf_user_cfg_section *config_section;
-		__u64 padding;
-	};
-	__u8 device_id;
-} __packed;
-#endif
--- a/drivers/crypto/intel/qat/qat_common/adf_common_drv.h
+++ b/drivers/crypto/intel/qat/qat_common/adf_common_drv.h
@@ -68,10 +68,7 @@ int adf_devmgr_add_dev(struct adf_accel_
 void adf_devmgr_rm_dev(struct adf_accel_dev *accel_dev,
 		       struct adf_accel_dev *pf);
 struct list_head *adf_devmgr_get_head(void);
-struct adf_accel_dev *adf_devmgr_get_dev_by_id(u32 id);
 struct adf_accel_dev *adf_devmgr_pci_to_accel_dev(struct pci_dev *pci_dev);
-int adf_devmgr_verify_id(u32 id);
-void adf_devmgr_get_num_dev(u32 *num);
 int adf_devmgr_in_reset(struct adf_accel_dev *accel_dev);
 int adf_dev_started(struct adf_accel_dev *accel_dev);
 int adf_dev_restarting_notify(struct adf_accel_dev *accel_dev);
--- a/drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c
+++ b/drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c
@@ -2,410 +2,13 @@
 /* Copyright(c) 2014 - 2020 Intel Corporation */
 
 #include <crypto/algapi.h>
+#include <linux/errno.h>
 #include <linux/module.h>
-#include <linux/mutex.h>
-#include <linux/slab.h>
-#include <linux/fs.h>
-#include <linux/bitops.h>
-#include <linux/pci.h>
-#include <linux/cdev.h>
-#include <linux/uaccess.h>
 
-#include "adf_accel_devices.h"
 #include "adf_common_drv.h"
-#include "adf_cfg.h"
-#include "adf_cfg_common.h"
-#include "adf_cfg_user.h"
-
-#define ADF_CFG_MAX_SECTION 512
-#define ADF_CFG_MAX_KEY_VAL 256
-
-#define DEVICE_NAME "qat_adf_ctl"
-
-static DEFINE_MUTEX(adf_ctl_lock);
-static long adf_ctl_ioctl(struct file *fp, unsigned int cmd, unsigned long arg);
-
-static const struct file_operations adf_ctl_ops = {
-	.owner = THIS_MODULE,
-	.unlocked_ioctl = adf_ctl_ioctl,
-	.compat_ioctl = compat_ptr_ioctl,
-};
-
-static const struct class adf_ctl_class = {
-	.name = DEVICE_NAME,
-};
-
-struct adf_ctl_drv_info {
-	unsigned int major;
-	struct cdev drv_cdev;
-};
-
-static struct adf_ctl_drv_info adf_ctl_drv;
-
-static void adf_chr_drv_destroy(void)
-{
-	device_destroy(&adf_ctl_class, MKDEV(adf_ctl_drv.major, 0));
-	cdev_del(&adf_ctl_drv.drv_cdev);
-	class_unregister(&adf_ctl_class);
-	unregister_chrdev_region(MKDEV(adf_ctl_drv.major, 0), 1);
-}
-
-static int adf_chr_drv_create(void)
-{
-	dev_t dev_id;
-	struct device *drv_device;
-	int ret;
-
-	if (alloc_chrdev_region(&dev_id, 0, 1, DEVICE_NAME)) {
-		pr_err("QAT: unable to allocate chrdev region\n");
-		return -EFAULT;
-	}
-
-	ret = class_register(&adf_ctl_class);
-	if (ret)
-		goto err_chrdev_unreg;
-
-	adf_ctl_drv.major = MAJOR(dev_id);
-	cdev_init(&adf_ctl_drv.drv_cdev, &adf_ctl_ops);
-	if (cdev_add(&adf_ctl_drv.drv_cdev, dev_id, 1)) {
-		pr_err("QAT: cdev add failed\n");
-		goto err_class_destr;
-	}
-
-	drv_device = device_create(&adf_ctl_class, NULL,
-				   MKDEV(adf_ctl_drv.major, 0),
-				   NULL, DEVICE_NAME);
-	if (IS_ERR(drv_device)) {
-		pr_err("QAT: failed to create device\n");
-		goto err_cdev_del;
-	}
-	return 0;
-err_cdev_del:
-	cdev_del(&adf_ctl_drv.drv_cdev);
-err_class_destr:
-	class_unregister(&adf_ctl_class);
-err_chrdev_unreg:
-	unregister_chrdev_region(dev_id, 1);
-	return -EFAULT;
-}
-
-static struct adf_user_cfg_ctl_data *adf_ctl_alloc_resources(unsigned long arg)
-{
-	struct adf_user_cfg_ctl_data *cfg_data;
-
-	cfg_data = memdup_user((void __user *)arg, sizeof(*cfg_data));
-	if (IS_ERR(cfg_data))
-		pr_err("QAT: failed to copy from user cfg_data.\n");
-	return cfg_data;
-}
-
-static int adf_add_key_value_data(struct adf_accel_dev *accel_dev,
-				  const char *section,
-				  const struct adf_user_cfg_key_val *key_val)
-{
-	if (key_val->type == ADF_HEX) {
-		long *ptr = (long *)key_val->val;
-		long val = *ptr;
-
-		if (adf_cfg_add_key_value_param(accel_dev, section,
-						key_val->key, (void *)val,
-						key_val->type)) {
-			dev_err(&GET_DEV(accel_dev),
-				"failed to add hex keyvalue.\n");
-			return -EFAULT;
-		}
-	} else {
-		if (adf_cfg_add_key_value_param(accel_dev, section,
-						key_val->key, key_val->val,
-						key_val->type)) {
-			dev_err(&GET_DEV(accel_dev),
-				"failed to add keyvalue.\n");
-			return -EFAULT;
-		}
-	}
-	return 0;
-}
-
-static int adf_copy_key_value_data(struct adf_accel_dev *accel_dev,
-				   struct adf_user_cfg_ctl_data *ctl_data)
-{
-	struct adf_user_cfg_key_val key_val;
-	struct adf_user_cfg_key_val *params_head;
-	struct adf_user_cfg_section section, *section_head;
-	int i, j;
-
-	section_head = ctl_data->config_section;
-
-	for (i = 0; section_head && i < ADF_CFG_MAX_SECTION; i++) {
-		if (copy_from_user(&section, (void __user *)section_head,
-				   sizeof(*section_head))) {
-			dev_err(&GET_DEV(accel_dev),
-				"failed to copy section info\n");
-			goto out_err;
-		}
-
-		if (adf_cfg_section_add(accel_dev, section.name)) {
-			dev_err(&GET_DEV(accel_dev),
-				"failed to add section.\n");
-			goto out_err;
-		}
-
-		params_head = section.params;
-
-		for (j = 0; params_head && j < ADF_CFG_MAX_KEY_VAL; j++) {
-			if (copy_from_user(&key_val, (void __user *)params_head,
-					   sizeof(key_val))) {
-				dev_err(&GET_DEV(accel_dev),
-					"Failed to copy keyvalue.\n");
-				goto out_err;
-			}
-			if (adf_add_key_value_data(accel_dev, section.name,
-						   &key_val)) {
-				goto out_err;
-			}
-			params_head = key_val.next;
-		}
-		section_head = section.next;
-	}
-	return 0;
-out_err:
-	adf_cfg_del_all(accel_dev);
-	return -EFAULT;
-}
-
-static int adf_ctl_ioctl_dev_config(struct file *fp, unsigned int cmd,
-				    unsigned long arg)
-{
-	struct adf_user_cfg_ctl_data *ctl_data;
-	struct adf_accel_dev *accel_dev;
-	int ret = 0;
-
-	ctl_data = adf_ctl_alloc_resources(arg);
-	if (IS_ERR(ctl_data))
-		return PTR_ERR(ctl_data);
-
-	accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id);
-	if (!accel_dev) {
-		ret = -EFAULT;
-		goto out;
-	}
-
-	if (adf_dev_started(accel_dev)) {
-		ret = -EFAULT;
-		goto out;
-	}
-
-	if (adf_copy_key_value_data(accel_dev, ctl_data)) {
-		ret = -EFAULT;
-		goto out;
-	}
-	set_bit(ADF_STATUS_CONFIGURED, &accel_dev->status);
-out:
-	kfree(ctl_data);
-	return ret;
-}
-
-static int adf_ctl_is_device_in_use(int id)
-{
-	struct adf_accel_dev *dev;
-
-	list_for_each_entry(dev, adf_devmgr_get_head(), list) {
-		if (id == dev->accel_id || id == ADF_CFG_ALL_DEVICES) {
-			if (adf_devmgr_in_reset(dev) || adf_dev_in_use(dev)) {
-				dev_info(&GET_DEV(dev),
-					 "device qat_dev%d is busy\n",
-					 dev->accel_id);
-				return -EBUSY;
-			}
-		}
-	}
-	return 0;
-}
-
-static void adf_ctl_stop_devices(u32 id)
-{
-	struct adf_accel_dev *accel_dev;
-
-	list_for_each_entry(accel_dev, adf_devmgr_get_head(), list) {
-		if (id == accel_dev->accel_id || id == ADF_CFG_ALL_DEVICES) {
-			if (!adf_dev_started(accel_dev))
-				continue;
-
-			/* First stop all VFs */
-			if (!accel_dev->is_vf)
-				continue;
-
-			adf_dev_down(accel_dev);
-		}
-	}
-
-	list_for_each_entry(accel_dev, adf_devmgr_get_head(), list) {
-		if (id == accel_dev->accel_id || id == ADF_CFG_ALL_DEVICES) {
-			if (!adf_dev_started(accel_dev))
-				continue;
-
-			adf_dev_down(accel_dev);
-		}
-	}
-}
-
-static int adf_ctl_ioctl_dev_stop(struct file *fp, unsigned int cmd,
-				  unsigned long arg)
-{
-	int ret;
-	struct adf_user_cfg_ctl_data *ctl_data;
-
-	ctl_data = adf_ctl_alloc_resources(arg);
-	if (IS_ERR(ctl_data))
-		return PTR_ERR(ctl_data);
-
-	if (adf_devmgr_verify_id(ctl_data->device_id)) {
-		pr_err("QAT: Device %d not found\n", ctl_data->device_id);
-		ret = -ENODEV;
-		goto out;
-	}
-
-	ret = adf_ctl_is_device_in_use(ctl_data->device_id);
-	if (ret)
-		goto out;
-
-	if (ctl_data->device_id == ADF_CFG_ALL_DEVICES)
-		pr_info("QAT: Stopping all acceleration devices.\n");
-	else
-		pr_info("QAT: Stopping acceleration device qat_dev%d.\n",
-			ctl_data->device_id);
-
-	adf_ctl_stop_devices(ctl_data->device_id);
-
-out:
-	kfree(ctl_data);
-	return ret;
-}
-
-static int adf_ctl_ioctl_dev_start(struct file *fp, unsigned int cmd,
-				   unsigned long arg)
-{
-	int ret;
-	struct adf_user_cfg_ctl_data *ctl_data;
-	struct adf_accel_dev *accel_dev;
-
-	ctl_data = adf_ctl_alloc_resources(arg);
-	if (IS_ERR(ctl_data))
-		return PTR_ERR(ctl_data);
-
-	ret = -ENODEV;
-	accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id);
-	if (!accel_dev)
-		goto out;
-
-	dev_info(&GET_DEV(accel_dev),
-		 "Starting acceleration device qat_dev%d.\n",
-		 ctl_data->device_id);
-
-	ret = adf_dev_up(accel_dev, false);
-
-	if (ret) {
-		dev_err(&GET_DEV(accel_dev), "Failed to start qat_dev%d\n",
-			ctl_data->device_id);
-		adf_dev_down(accel_dev);
-	}
-out:
-	kfree(ctl_data);
-	return ret;
-}
-
-static int adf_ctl_ioctl_get_num_devices(struct file *fp, unsigned int cmd,
-					 unsigned long arg)
-{
-	u32 num_devices = 0;
-
-	adf_devmgr_get_num_dev(&num_devices);
-	if (copy_to_user((void __user *)arg, &num_devices, sizeof(num_devices)))
-		return -EFAULT;
-
-	return 0;
-}
-
-static int adf_ctl_ioctl_get_status(struct file *fp, unsigned int cmd,
-				    unsigned long arg)
-{
-	struct adf_hw_device_data *hw_data;
-	struct adf_dev_status_info dev_info;
-	struct adf_accel_dev *accel_dev;
-
-	if (copy_from_user(&dev_info, (void __user *)arg,
-			   sizeof(struct adf_dev_status_info))) {
-		pr_err("QAT: failed to copy from user.\n");
-		return -EFAULT;
-	}
-
-	accel_dev = adf_devmgr_get_dev_by_id(dev_info.accel_id);
-	if (!accel_dev)
-		return -ENODEV;
-
-	hw_data = accel_dev->hw_device;
-	dev_info.state = adf_dev_started(accel_dev) ? DEV_UP : DEV_DOWN;
-	dev_info.num_ae = hw_data->get_num_aes(hw_data);
-	dev_info.num_accel = hw_data->get_num_accels(hw_data);
-	dev_info.num_logical_accel = hw_data->num_logical_accel;
-	dev_info.banks_per_accel = hw_data->num_banks
-					/ hw_data->num_logical_accel;
-	strscpy(dev_info.name, hw_data->dev_class->name, sizeof(dev_info.name));
-	dev_info.instance_id = hw_data->instance_id;
-	dev_info.type = hw_data->dev_class->type;
-	dev_info.bus = accel_to_pci_dev(accel_dev)->bus->number;
-	dev_info.dev = PCI_SLOT(accel_to_pci_dev(accel_dev)->devfn);
-	dev_info.fun = PCI_FUNC(accel_to_pci_dev(accel_dev)->devfn);
-
-	if (copy_to_user((void __user *)arg, &dev_info,
-			 sizeof(struct adf_dev_status_info))) {
-		dev_err(&GET_DEV(accel_dev), "failed to copy status.\n");
-		return -EFAULT;
-	}
-	return 0;
-}
-
-static long adf_ctl_ioctl(struct file *fp, unsigned int cmd, unsigned long arg)
-{
-	int ret;
-
-	if (mutex_lock_interruptible(&adf_ctl_lock))
-		return -EFAULT;
-
-	switch (cmd) {
-	case IOCTL_CONFIG_SYS_RESOURCE_PARAMETERS:
-		ret = adf_ctl_ioctl_dev_config(fp, cmd, arg);
-		break;
-
-	case IOCTL_STOP_ACCEL_DEV:
-		ret = adf_ctl_ioctl_dev_stop(fp, cmd, arg);
-		break;
-
-	case IOCTL_START_ACCEL_DEV:
-		ret = adf_ctl_ioctl_dev_start(fp, cmd, arg);
-		break;
-
-	case IOCTL_GET_NUM_DEVICES:
-		ret = adf_ctl_ioctl_get_num_devices(fp, cmd, arg);
-		break;
-
-	case IOCTL_STATUS_ACCEL_DEV:
-		ret = adf_ctl_ioctl_get_status(fp, cmd, arg);
-		break;
-	default:
-		pr_err_ratelimited("QAT: Invalid ioctl %d\n", cmd);
-		ret = -EFAULT;
-		break;
-	}
-	mutex_unlock(&adf_ctl_lock);
-	return ret;
-}
 
 static int __init adf_register_ctl_device_driver(void)
 {
-	if (adf_chr_drv_create())
-		goto err_chr_dev;
-
 	if (adf_init_misc_wq())
 		goto err_misc_wq;
 
@@ -437,15 +40,11 @@ err_pf_wq:
 err_aer:
 	adf_exit_misc_wq();
 err_misc_wq:
-	adf_chr_drv_destroy();
-err_chr_dev:
-	mutex_destroy(&adf_ctl_lock);
 	return -EFAULT;
 }
 
 static void __exit adf_unregister_ctl_device_driver(void)
 {
-	adf_chr_drv_destroy();
 	adf_exit_misc_wq();
 	adf_exit_aer();
 	adf_exit_vf_wq();
@@ -453,7 +52,6 @@ static void __exit adf_unregister_ctl_de
 	qat_crypto_unregister();
 	qat_compression_unregister();
 	adf_clean_vf_map(false);
-	mutex_destroy(&adf_ctl_lock);
 }
 
 module_init(adf_register_ctl_device_driver);
--- a/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c
+++ b/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c
@@ -45,19 +45,6 @@ static struct vf_id_map *adf_find_vf(u32
 	return NULL;
 }
 
-static int adf_get_vf_real_id(u32 fake)
-{
-	struct list_head *itr;
-
-	list_for_each(itr, &vfs_table) {
-		struct vf_id_map *ptr =
-			list_entry(itr, struct vf_id_map, list);
-		if (ptr->fake_id == fake)
-			return ptr->id;
-	}
-	return -1;
-}
-
 /**
  * adf_clean_vf_map() - Cleans VF id mappings
  * @vf: flag indicating whether mappings is cleaned
@@ -304,63 +291,6 @@ struct adf_accel_dev *adf_devmgr_pci_to_
 }
 EXPORT_SYMBOL_GPL(adf_devmgr_pci_to_accel_dev);
 
-struct adf_accel_dev *adf_devmgr_get_dev_by_id(u32 id)
-{
-	struct list_head *itr;
-	int real_id;
-
-	mutex_lock(&table_lock);
-	real_id = adf_get_vf_real_id(id);
-	if (real_id < 0)
-		goto unlock;
-
-	id = real_id;
-
-	list_for_each(itr, &accel_table) {
-		struct adf_accel_dev *ptr =
-				list_entry(itr, struct adf_accel_dev, list);
-		if (ptr->accel_id == id) {
-			mutex_unlock(&table_lock);
-			return ptr;
-		}
-	}
-unlock:
-	mutex_unlock(&table_lock);
-	return NULL;
-}
-
-int adf_devmgr_verify_id(u32 id)
-{
-	if (id == ADF_CFG_ALL_DEVICES)
-		return 0;
-
-	if (adf_devmgr_get_dev_by_id(id))
-		return 0;
-
-	return -ENODEV;
-}
-
-static int adf_get_num_dettached_vfs(void)
-{
-	struct list_head *itr;
-	int vfs = 0;
-
-	mutex_lock(&table_lock);
-	list_for_each(itr, &vfs_table) {
-		struct vf_id_map *ptr =
-			list_entry(itr, struct vf_id_map, list);
-		if (ptr->bdf != ~0 && !ptr->attached)
-			vfs++;
-	}
-	mutex_unlock(&table_lock);
-	return vfs;
-}
-
-void adf_devmgr_get_num_dev(u32 *num)
-{
-	*num = num_devices - adf_get_num_dettached_vfs();
-}
-
 /**
  * adf_dev_in_use() - Check whether accel_dev is currently in use
  * @accel_dev: Pointer to acceleration device.

[PATCH 7.1 15/21] vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write

[Greg Kroah-Hartman]

7.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yi Yang <yiyang13@huawei.com>

commit a287620312dc6dcb9a093417a0e589bf30fcf38a upstream.

A KASAN null-ptr-deref was observed in vcs_notifier():

BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130
Read of size 2 at addr qmp_cmd_name: qmp_capabilities, arguments: {}

The issue is a race condition in vcs_write(). When the console_lock is
temporarily dropped (to copy data from userspace), the vc_data pointer
obtained from vcs_vc() may become stale. After re-acquiring the lock,
vcs_vc() is called again to re-validate the pointer. If the vc has been
deallocated in the meantime, vcs_vc() returns NULL, and the while loop
breaks (with written > 0). However, after the loop, vcs_scr_updated(vc)
is still called with the now-NULL vc pointer, leading to a null pointer
dereference in the notifier chain (vcs_notifier dereferences param->vc).

Fix this by adding a NULL check for vc before calling vcs_scr_updated().

Fixes: 8fb9ea65c9d1 ("vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF")
Cc: stable@vger.kernel.org
Signed-off-by: Yi Yang <yiyang13@huawei.com>
Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
Link: https://patch.msgid.link/20260604060734.2914976-1-yiyang13@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/vt/vc_screen.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/tty/vt/vc_screen.c
+++ b/drivers/tty/vt/vc_screen.c
@@ -686,7 +686,7 @@ vcs_write(struct file *file, const char
 	}
 	*ppos += written;
 	ret = written;
-	if (written)
+	if (written && vc)
 		vcs_scr_updated(vc);
 
 	return ret;

[PATCH 7.1 16/21] serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero

[Greg Kroah-Hartman]

7.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>

commit b93062b6d8a1b2d9bad235cac25558a909819026 upstream.

In qcom_geni_serial_handle_rx_dma(), geni_se_rx_dma_unprep() clears
port->rx_dma_addr before SE_DMA_RX_LEN_IN is read. If the register is zero,
for example when the RX stale counter fires on an idle line, the handler
returns without calling geni_se_rx_dma_prep().

The next RX DMA interrupt then hits the !port->rx_dma_addr guard and
returns immediately, so the RX DMA buffer is never rearmed and later input
is lost.

Keep the handler on the rearm path when rx_in is zero. Warn about the
unexpected zero-length DMA completion, skip received-data handling, and
always call geni_se_rx_dma_prep().

Fixes: 2aaa43c70778 ("tty: serial: qcom-geni-serial: add support for serial engine DMA")
Cc: stable@vger.kernel.org
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
Link: https://patch.msgid.link/20260528-serial-rx-0-byte-fix-v2-1-b4195cfe342f@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/qcom_geni_serial.c |    9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

--- a/drivers/tty/serial/qcom_geni_serial.c
+++ b/drivers/tty/serial/qcom_geni_serial.c
@@ -905,12 +905,9 @@ static void qcom_geni_serial_handle_rx_d
 	port->rx_dma_addr = 0;
 
 	rx_in = readl(uport->membase + SE_DMA_RX_LEN_IN);
-	if (!rx_in) {
-		dev_warn(uport->dev, "serial engine reports 0 RX bytes in!\n");
-		return;
-	}
-
-	if (!drop)
+	if (!rx_in)
+		dev_warn_ratelimited(uport->dev, "serial engine reports 0 RX bytes in!\n");
+	else if (!drop)
 		handle_rx_uart(uport, rx_in);
 
 	ret = geni_se_rx_dma_prep(&port->se, port->rx_buf,

[PATCH 7.1 17/21] serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails

[Greg Kroah-Hartman]

7.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stepan Ionichev <sozdayvek@gmail.com>

commit 10fc708b4de7f86002d2d735a2dbf3b5b7f65692 upstream.

dw8250_probe() registers the 8250 port via serial8250_register_8250_port()
and then, if the device has a clock, registers a clock notifier. If
clk_notifier_register() fails, probe returns the error but leaves the
8250 port registered. The matching serial8250_unregister_port() lives
in dw8250_remove(), which is not called when probe fails, so the port
slot stays occupied until the device is rebound or the system is
rebooted. The devm-allocated driver data is freed while the port still
references it (via the saved private_data and serial_in/serial_out
callbacks), so any access to that port slot before a rebind is a
use-after-free hazard.

Unregister the port on the clk_notifier_register() error path.

Fixes: cc816969d7b5 ("serial: 8250_dw: Fix common clocks usage race condition")
Cc: stable@vger.kernel.org
Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260514143746.23671-2-sozdayvek@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/8250/8250_dw.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/tty/serial/8250/8250_dw.c
+++ b/drivers/tty/serial/8250/8250_dw.c
@@ -850,8 +850,10 @@ static int dw8250_probe(struct platform_
 	 */
 	if (data->clk) {
 		err = clk_notifier_register(data->clk, &data->clk_notifier);
-		if (err)
+		if (err) {
+			serial8250_unregister_port(data->data.line);
 			return dev_err_probe(dev, err, "Failed to set the clock notifier\n");
+		}
 		queue_work(system_dfl_wq, &data->clk_work);
 	}
 

[PATCH 7.1 18/21] drivers/base/memory: set mem->altmap after successful device registration

[Greg Kroah-Hartman]

7.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Georgi Djakov <georgi.djakov@oss.qualcomm.com>

commit a2b8d7827f48ee54a686cb80e4a1d0ff954ec42a upstream.

If __add_memory_block() fails at xa_store() (under memory pressure for
example), device_unregister() is called, which eventually triggers
memory_block_release() with mem->altmap still set, causing a
WARN_ON(mem->altmap).  This was triggered by modifying virtio-mem driver.

Fix this by delaying the assignment of mem->altmap until after
__add_memory_block() has succeeded.

Link: https://lore.kernel.org/20260514092657.3057141-1-georgi.djakov@oss.qualcomm.com
Fixes: 1a8c64e11043 ("mm/memory_hotplug: embed vmem_altmap details in memory block")
Signed-off-by: Georgi Djakov <georgi.djakov@oss.qualcomm.com>
Acked-by: Oscar Salvador (SUSE) <osalvador@kernel.org>
Cc: Vishal Verma <vishal.l.verma@intel.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Richard Cheng <icheng@nvidia.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Georgi Djakov <djakov@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: "Rafael J. Wysocki" <rafael@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/memory.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -807,7 +807,6 @@ static int add_memory_block(unsigned lon
 	mem->start_section_nr = block_id * sections_per_block;
 	mem->state = state;
 	mem->nid = nid;
-	mem->altmap = altmap;
 	INIT_LIST_HEAD(&mem->group_next);
 
 #ifndef CONFIG_NUMA
@@ -825,6 +824,8 @@ static int add_memory_block(unsigned lon
 	if (ret)
 		return ret;
 
+	mem->altmap = altmap;
+
 	if (group) {
 		mem->group = group;
 		list_add(&mem->group_next, &group->memory_blocks);

[PATCH 7.1 19/21] ksmbd: reject non-VALID session in compound request branch

[Greg Kroah-Hartman]

7.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Gil Portnoy <dddhkts1@gmail.com>

commit 609ca17d869d04ba249e32cdcbf13c0b1c66f43c upstream.

smb2_check_user_session() takes a shortcut for any operation that is not
the first in a COMPOUND request: it reuses work->sess (the session bound by
the first operation) and validates only the SessionId, then returns
"valid". It never re-checks work->sess->state == SMB2_SESSION_VALID, and a
SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation
value) skips even the id comparison. The standalone path
(ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does
enforce the VALID state; the compound branch bypasses all of it.

A SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes
a fresh SMB2_SESSION_IN_PROGRESS session whose sess->user is still NULL
(->user is assigned later, by ntlm_authenticate()). Used as operation 1 of
a COMPOUND with operation 2 = TREE_CONNECT (related, SessionId=ULLONG_MAX,
\\host\IPC$), the tree-connect then runs on that IN_PROGRESS session and
reaches ksmbd_ipc_tree_connect_request(), which dereferences
user_name(sess->user) with sess->user == NULL (transport_ipc.c:687/701/704)
-> remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd
worker for all clients.

Reject any non-first compound operation that lands on a session which is
not SMB2_SESSION_VALID, mirroring the validity the standalone lookup path
enforces. SESSION_SETUP itself legitimately runs on an IN_PROGRESS session,
but it is never carried as a non-first compound operation, so multi-leg
authentication is unaffected by this check.

Fixes: 5005bcb42191 ("ksmbd: validate session id and tree id in the compound request")
Cc: stable@vger.kernel.org
Signed-off-by: Gil Portnoy <dddhkts1@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/smb2pdu.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -613,6 +613,11 @@ int smb2_check_user_session(struct ksmbd
 					sess_id, work->sess->id);
 			return -EINVAL;
 		}
+		if (work->sess->state != SMB2_SESSION_VALID) {
+			pr_err("compound request on a non-valid session (state %d)\n",
+					work->sess->state);
+			return -EINVAL;
+		}
 		return 1;
 	}
 

[PATCH 7.1 20/21] media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si

[Greg Kroah-Hartman]

7.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ruslan Valiyev <linuxoid@gmail.com>

commit 7d8bf3d8f91073f4db347ed3aa6302b56107499c upstream.

syzbot reported a general protection fault in
vidtv_psi_ts_psi_write_into [1].

vidtv_mux_get_pid_ctx() can return NULL, but vidtv_mux_push_si() does
not check for this before dereferencing the returned pointer to access
the continuity counter. This leads to a general protection fault when
accessing a near-NULL address.

The root cause is that vidtv_mux_pid_ctx_init() does not check the
return value of vidtv_mux_create_pid_ctx_once() for PMT section PIDs.
If the allocation fails, the PID context is never created, but init
returns success. The subsequent vidtv_mux_push_si() call then gets
NULL from vidtv_mux_get_pid_ctx() and crashes.

Fix both the root cause (add error check in vidtv_mux_pid_ctx_init
for PMT PIDs) and add defensive NULL checks in vidtv_mux_push_si for
all vidtv_mux_get_pid_ctx() calls.

[1]
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Workqueue: events vidtv_mux_tick
RIP: 0010:vidtv_psi_ts_psi_write_into+0x54a/0xbc0 drivers/media/test-drivers/vidtv/vidtv_psi.c:197
Call Trace:
 <TASK>
 vidtv_psi_table_header_write_into drivers/media/test-drivers/vidtv/vidtv_psi.c:799 [inline]
 vidtv_psi_pmt_write_into+0x3b2/0xa70 drivers/media/test-drivers/vidtv/vidtv_psi.c:1231
 vidtv_mux_push_si+0x932/0xe80 drivers/media/test-drivers/vidtv/vidtv_mux.c:196
 vidtv_mux_tick+0xe9b/0x1480 drivers/media/test-drivers/vidtv/vidtv_mux.c:408

Fixes: f90cf6079bf67 ("media: vidtv: add a bridge driver")
Cc: stable@vger.kernel.org
Reported-by: syzbot+814c351d094f4f1a1b86@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=814c351d094f4f1a1b86
Signed-off-by: Ruslan Valiyev <linuxoid@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/test-drivers/vidtv/vidtv_mux.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/drivers/media/test-drivers/vidtv/vidtv_mux.c
+++ b/drivers/media/test-drivers/vidtv/vidtv_mux.c
@@ -101,7 +101,8 @@ static int vidtv_mux_pid_ctx_init(struct
 	/* add a ctx for all PMT sections */
 	while (p) {
 		pid = vidtv_psi_get_pat_program_pid(p);
-		vidtv_mux_create_pid_ctx_once(m, pid);
+		if (!vidtv_mux_create_pid_ctx_once(m, pid))
+			goto free;
 		p = p->next;
 	}
 
@@ -170,6 +171,9 @@ static u32 vidtv_mux_push_si(struct vidt
 	nit_ctx = vidtv_mux_get_pid_ctx(m, VIDTV_NIT_PID);
 	eit_ctx = vidtv_mux_get_pid_ctx(m, VIDTV_EIT_PID);
 
+	if (!pat_ctx || !sdt_ctx || !nit_ctx || !eit_ctx)
+		return 0;
+
 	pat_args.offset             = m->mux_buf_offset;
 	pat_args.continuity_counter = &pat_ctx->cc;
 
@@ -186,6 +190,8 @@ static u32 vidtv_mux_push_si(struct vidt
 		}
 
 		pmt_ctx = vidtv_mux_get_pid_ctx(m, pmt_pid);
+		if (!pmt_ctx)
+			continue;
 
 		pmt_args.offset             = m->mux_buf_offset;
 		pmt_args.pmt                = m->si.pmt_secs[i];

[PATCH 7.1 21/21] virtiofs: fix UAF on submount umount

[Greg Kroah-Hartman]

7.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Miklos Szeredi <mszeredi@redhat.com>

commit 06b41351779e9289e8785694ade9042ae85e41ea upstream.

iput() called from fuse_release_end() can Oops if the super block has
already been destroyed.  Normally this is prevented by waiting for
num_waiting to go down to zero before commencing with super block shutdown.

This only works, however, for the last submount instance, as the wait
counter is per connection, not per superblock.

Revert to using synchronous release requests for the auto_submounts case,
which is virtiofs only at this time.

Reported-by: Aurélien Bombo <abombo@microsoft.com>
Reported-by: Zhihao Cheng <chengzhihao1@huawei.com>
Cc: Greg Kurz <gkurz@redhat.com>
Closes: https://github.com/kata-containers/kata-containers/issues/12589
Fixes: 26e5c67deb2e ("fuse: fix livelock in synchronous file put from fuseblk workers")
Cc: stable@vger.kernel.org
Reviewed-by: Greg Kurz <gkurz@redhat.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/fuse/file.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -380,8 +380,14 @@ void fuse_file_release(struct inode *ino
 	 * aio and closes the fd before the aio completes.  Since aio takes its
 	 * own ref to the file, the IO completion has to drop the ref, which is
 	 * how the fuse server can end up closing its clients' files.
+	 *
+	 * Exception is virtio-fs, which is not affected by the above (server is
+	 * on host, cannot close open files in guest).  Virtio-fs needs sync
+	 * release, because the num_waiting mechanism to wait for all requests
+	 * before commencing with fs shutdown doesn't work if submounts are
+	 * used.
 	 */
-	fuse_file_put(ff, false);
+	fuse_file_put(ff, ff->fm->fc->auto_submounts);
 }
 
 void fuse_release_common(struct file *file, bool isdir)

Re: [PATCH 7.1 00/21] 7.1.2-rc1 review

[Florian Fainelli]

On 6/25/2026 2:03 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 7.1.2 release.
> There are 21 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Sat, 27 Jun 2026 12:54:50 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.2-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h

On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on 
BMIPS_GENERIC:

Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
-- 
Florian

Re: [PATCH 7.1 00/21] 7.1.2-rc1 review

[Brett A C Sheffield]

# Librecast Test Results

020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast

CPU/kernel: Linux auntie 7.1.2-rc1-gecd7772bf738 #1 SMP PREEMPT_DYNAMIC Thu Jun 25 15:10:53 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux

Tested-by: Brett A C Sheffield <bacs@librecast.net>

Re: [PATCH 7.1 00/21] 7.1.2-rc1 review

[Justin Forbes]

On Thu, Jun 25, 2026 at 02:03:52PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 7.1.2 release.
> There are 21 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Sat, 27 Jun 2026 12:54:50 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.2-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h

Tested rc1 against the Fedora build system (aarch64, ppc64le, s390x,
x86_64), and boot tested x86_64. No regressions noted.

Tested-by: Justin M. Forbes <jforbes@fedoraproject.org>

Re: [PATCH 7.1 00/21] 7.1.2-rc1 review

[Peter Schneider]

Am 25.06.2026 um 15:03 schrieb Greg Kroah-Hartman:
> This is the start of the stable review cycle for the 7.1.2 release.
> There are 21 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.

Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.

Tested-by: Peter Schneider <pschneider1968@googlemail.com>


Beste Grüße,
Peter Schneider

-- 
Climb the mountain not to plant your flag, but to embrace the challenge,
enjoy the air and behold the view. Climb it so you can see the world,
not so the world can see you.                    -- David McCullough Jr.

OpenPGP:  0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244
Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@googlemail.com
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@gmail.com

Re: [PATCH 7.1 00/21] 7.1.2-rc1 review

[Shuah Khan]

On 6/25/26 07:03, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 7.1.2 release.
> There are 21 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Sat, 27 Jun 2026 12:54:50 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.2-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h
> 

Compiled and booted on my test system. No dmesg regressions.

Tested-by: Shuah Khan <skhan@linuxfoundation.org>

thanks,
-- Shuah

Re: [PATCH 7.1 00/21] 7.1.2-rc1 review

[Ron Economos]

On 6/25/26 06:03, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 7.1.2 release.
> There are 21 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 27 Jun 2026 12:54:50 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.2-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h

Built and booted successfully on RISC-V RV64 (HiFive Unmatched).

Tested-by: Ron Economos <re@w6rz.net>

Re: [PATCH 7.1 00/21] 7.1.2-rc1 review

[Miguel Ojeda]

On Thu, 25 Jun 2026 14:03:52 +0100 Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 7.1.2 release.
> There are 21 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Sat, 27 Jun 2026 12:54:50 +0000.
> Anything received after that time might be too late.

Boot-tested under QEMU for Rust x86_64, arm64 and riscv64; built-tested
for loongarch64 and arm32:

Tested-by: Miguel Ojeda <ojeda@kernel.org>

Thanks!

Cheers,
Miguel

Re: [PATCH 7.1 00/21] 7.1.2-rc1 review

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 500 bytes --]

Hi!

> This is the start of the stable review cycle for the 7.1.2 release.
> There are 21 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.

CIP testing did not find any problems here:

https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-7.1.y

Tested-by: Pavel Machek (CIP) <pavel@nabladev.com>

Best regards,
                                                                Pavel

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [PATCH 7.1 00/21] 7.1.2-rc1 review

[Dileep malepu]

On Thu, Jun 25, 2026 at 6:45 PM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 7.1.2 release.
> There are 21 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 27 Jun 2026 12:54:50 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
>         https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.2-rc1.gz
> or in the git tree and branch at:
>         git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
Build and Boot Report  7.1.2-rc1

I built and tested Linux kernel version 7.1.2 using the default configurations
on both x86_64 and arm64 architectures in a virtualized environment.

The kernel compiled successfully on both architectures and booted
without issues.
I did not observe any regressions or new warnings in dmesg during boot.

Kernel version: 7.1.2-rc1
Configurations tested: x86_64_defconfig, defconfig
Architectures tested: x86_64, arm64
Kernel source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Commit: ecd7772bf73899d9b6c14b7efe6d713949f18e74

Tested-by: Dileep Malepu <dileep.debian@gmail.com>

Best regards,
Dileep Malepu.

Re: [PATCH 7.1 00/21] 7.1.2-rc1 review

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 550 bytes --]

On Fri 2026-06-26 13:24:42, Pavel Machek wrote:
> Hi!
> 
> > This is the start of the stable review cycle for the 7.1.2 release.
> > There are 21 patches in this series, all will be posted as a response
> > to this one.  If anyone has any issues with these being applied, please
> > let me know.
> 
> CIP testing did not find any problems here:
> 
> https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-7.1.y

Aha, no, sorry, the test was running on wrong version. Disregard this.

Best regards,
										Pavel

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [PATCH 7.1 00/21] 7.1.2-rc1 review

[Takeshi Ogasawara]

Hi Greg

On Thu, Jun 25, 2026 at 10:15 PM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 7.1.2 release.
> There are 21 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 27 Jun 2026 12:54:50 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
>         https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.2-rc1.gz
> or in the git tree and branch at:
>         git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h

Linux version 7.1.2-rc1 tested.

Build successfully completed.
Boot successfully completed.
No dmesg regressions.
Video output normal.
Sound output normal.

Lenovo ThinkPad X1 Carbon Gen10(Intel i7-1260P(x86_64) arch linux)

[    0.000000] Linux version 7.1.2-rc1rv-gecd7772bf738
(takeshi@ThinkPadX1Gen10J0764) (gcc (GCC) 16.1.1 20260430, GNU ld (GNU
Binutils) 2.46.0) #1 SMP PREEMPT_DYNAMIC Fri Jun 26 20:21:58 JST 2026

Thanks

Tested-by: Takeshi Ogasawara <takeshi.ogasawara@futuring-girl.com>

Re: [PATCH 7.1 00/21] 7.1.2-rc1 review

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 343 bytes --]

On Thu, Jun 25, 2026 at 02:03:52PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 7.1.2 release.
> There are 21 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.

Tested-by: Mark Brown <broonie@kernel.org>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH 7.1 00/21] 7.1.2-rc1 review

[Jeffrin Thalakkottoor]

hello,

 Compiled and booted  7.1.2-rc1+
----------------x---------------------x-------------------
$sudo dmesg -l err
[   23.704215] ACPI Error: No handler for Region [VRTC]
(0000000042f760aa) [SystemCMOS] (20251212/evregion-131)
[   23.704246] ACPI Error: Region SystemCMOS (ID=5) has no handler
(20251212/exfldio-261)
[   23.704275] ACPI Error: Aborting method \TAAD.RTWT due to previous
error (AE_NOT_EXIST) (20251212/psparse-529)
[   23.704359] ACPI Error: Aborting method \TAAD._GRT due to previous
error (AE_NOT_EXIST) (20251212/psparse-529)
[   28.080686] ACPI BIOS Error (bug): AE_AML_BUFFER_LIMIT, Index
(0x000000032) is beyond end of object (length 0x32)
(20251212/exoparg2-393)
[   28.080708] ACPI Error: Aborting method \_SB.WMID.WQBZ due to
previous error (AE_AML_BUFFER_LIMIT) (20251212/psparse-529)
[   28.080732] ACPI Error: Aborting method \_SB.WMID.WQBE due to
previous error (AE_AML_BUFFER_LIMIT) (20251212/psparse-529)
[   28.081634] ACPI BIOS Error (bug): AE_AML_BUFFER_LIMIT, Field
[D008] at bit offset/length 128/8 exceeds size of target Buffer (128
bits) (20251212/dsopcode-198)
[   28.081647] ACPI Error: Aborting method \HWMC due to previous error
(AE_AML_BUFFER_LIMIT) (20251212/psparse-529)
[   28.081662] ACPI Error: Aborting method \_SB.WMID.WMAA due to
previous error (AE_AML_BUFFER_LIMIT) (20251212/psparse-529)
$
-----------------x---------------------x------------------

Tested-by: Jeffrin Jose T <jeffrin@rajagiritech.edu.in>


--
software engineer
rajagiri school of engineering and technology

Re: [PATCH 7.1 00/21] 7.1.2-rc1 review

[Barry K. Nathan]

(cc Dmitry Torokhov because this is related to two of your commits)

On 6/25/26 6:03 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 7.1.2 release.
> There are 21 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Sat, 27 Jun 2026 12:54:50 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.2-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h
> 

Unfortunately, 7.1.2-rc1 breaks the Synaptics touchpad on my Lenovo
ThinkPad T14 Gen 1 -- the pointer no longer moves when I touch the
touchpad. Potentially relevant line from dmesg:

rmi4_f01 rmi4-00.fn01: found RMI device, manufacturer: Synaptics, product: TM3471-020, fw id: 3972349

> Dmitry Torokhov<dmitry.torokhov@gmail.com>
>      Input: rmi4 - refactor register descriptor parsing
> 
> Dmitry Torokhov<dmitry.torokhov@gmail.com>
>      Input: rmi4 - fix register descriptor address calculation

Both of these patches seem bad in my testing. Either one, individually,
causes the pointer to no longer move when I touch the touchpad. If I
revert both of them, then my touchpad works again.

I have not yet tested 7.0.14-rc1 or 6.18.37-rc1. However, the problem
also reproduces on current mainline as of this writing (commit
51cb1aa1250c36269474b8b6ca6b6319e170f5a5).

-- 
-Barry K. Nathan  <barryn@pobox.com>

Re: [PATCH 7.1 00/21] 7.1.2-rc1 review

[Dmitry Torokhov]

Hi Barry,

On Fri, Jun 26, 2026 at 10:56:21AM -0700, Barry K. Nathan wrote:
> (cc Dmitry Torokhov because this is related to two of your commits)
> 
> On 6/25/26 6:03 AM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 7.1.2 release.
> > There are 21 patches in this series, all will be posted as a response
> > to this one.  If anyone has any issues with these being applied, please
> > let me know.
> > 
> > Responses should be made by Sat, 27 Jun 2026 12:54:50 +0000.
> > Anything received after that time might be too late.
> > 
> > The whole patch series can be found in one patch at:
> > 	https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.2-rc1.gz
> > or in the git tree and branch at:
> > 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y
> > and the diffstat can be found below.
> > 
> > thanks,
> > 
> > greg k-h
> > 
> 
> Unfortunately, 7.1.2-rc1 breaks the Synaptics touchpad on my Lenovo
> ThinkPad T14 Gen 1 -- the pointer no longer moves when I touch the
> touchpad. Potentially relevant line from dmesg:
> 
> rmi4_f01 rmi4-00.fn01: found RMI device, manufacturer: Synaptics, product: TM3471-020, fw id: 3972349
> 
> > Dmitry Torokhov<dmitry.torokhov@gmail.com>
> >      Input: rmi4 - refactor register descriptor parsing
> > 
> > Dmitry Torokhov<dmitry.torokhov@gmail.com>
> >      Input: rmi4 - fix register descriptor address calculation
> 
> Both of these patches seem bad in my testing. Either one, individually,
> causes the pointer to no longer move when I touch the touchpad. If I
> revert both of them, then my touchpad works again.
> 
> I have not yet tested 7.0.14-rc1 or 6.18.37-rc1. However, the problem
> also reproduces on current mainline as of this writing (commit
> 51cb1aa1250c36269474b8b6ca6b6319e170f5a5).

Could you please try applying this debug patch and send me dmesg?

diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
index 49a59da6a841..65095257e3c3 100644
--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -569,27 +569,35 @@ static int rmi_parse_register_desc_item(struct rmi_register_desc_item *item,
 	unsigned int map_offset = 0;
 	int b;
 
-	if (offset >= size)
+	if (offset >= size) {
+		pr_err("%s: error: offset >= size (%d >= %zu)\n", __func__, offset, size);
 		return -EIO;
+	}
 
 	item->reg_size = buf[offset++];
 	if (item->reg_size == 0) {
-		if (size - offset < 2)
+		if (size - offset < 2) {
+			pr_err("%s: error: size - offset < 2 (%zu - %d < 2)\n", __func__, size, offset);
 			return -EIO;
+		}
 		item->reg_size = get_unaligned_le16(&buf[offset]);
 		offset += 2;
 	}
 
 	if (item->reg_size == 0) {
-		if (size - offset < 4)
+		if (size - offset < 4) {
+			pr_err("%s: error: size - offset < 4 (%zu - %d < 4)\n", __func__, size, offset);
 			return -EIO;
+		}
 		item->reg_size = get_unaligned_le32(&buf[offset]);
 		offset += 4;
 	}
 
 	do {
-		if (offset >= size)
+		if (offset >= size) {
+			pr_err("%s: error in loop: offset >= size (%d >= %zu)\n", __func__, offset, size);
 			return -EIO;
+		}
 
 		for (b = 0; b < 7; b++) {
 			if (buf[offset] & BIT(b)) {
@@ -625,9 +633,11 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
 	 * The first register of the register descriptor is the size of
 	 * the register descriptor's presence register.
 	 */
+	pr_info("%s: starting read at addr 0x%04x\n", __func__, addr);
 	ret = rmi_read(d, addr, &size_presence_reg);
 	if (ret)
 		return ret;
+	pr_info("%s: size_presence_reg = %d\n", __func__, size_presence_reg);
 	++addr;
 
 	if (size_presence_reg < 1 || size_presence_reg > RMI_REG_DESC_PRESENCE_REGS_MAX)
@@ -643,7 +653,10 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
 	ret = rmi_read_block(d, addr, buf, size_presence_reg);
 	if (ret)
 		return ret;
+	pr_info("%s: presence reg: %*ph\n", __func__, (int)size_presence_reg, buf);
+	
 	addr += size_presence_reg;
+	pr_info("%s: advanced addr to 0x%04x (after skipping presence reg)\n", __func__, addr);
 
 	if (buf[0] == 0) {
 		if (size_presence_reg < 3)
@@ -654,6 +667,7 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
 		presence_offset = 1;
 		rdesc->struct_size = buf[0];
 	}
+	pr_info("%s: struct_size = %ld\n", __func__, rdesc->struct_size);
 
 	memset(presence_map, 0, sizeof(presence_map));
 	map_offset = 0;
@@ -670,6 +684,7 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
 
 	rdesc->num_registers = bitmap_weight(presence_map,
 						RMI_REG_DESC_PRESENCE_BITS);
+	pr_info("%s: num_registers = %d\n", __func__, rdesc->num_registers);
 
 	rdesc->registers = devm_kcalloc(&d->dev,
 					rdesc->num_registers,
@@ -693,10 +708,14 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
 	 * register and a bitmap of all subpackets contained in the packet
 	 * register.
 	 */
+	pr_info("%s: reading struct_buf from addr 0x%04x, size %ld\n", __func__, addr, rdesc->struct_size);
 	ret = rmi_read_block(d, addr, struct_buf, rdesc->struct_size);
 	if (ret)
 		return ret;
 
+	print_hex_dump(KERN_INFO, "rmi_struct: ", DUMP_PREFIX_OFFSET, 16, 1,
+		       struct_buf, rdesc->struct_size, false);
+
 	reg = find_first_bit(presence_map, RMI_REG_DESC_PRESENCE_BITS);
 	offset = 0;
 	for (i = 0; i < rdesc->num_registers; i++) {
@@ -712,9 +731,8 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
 		item->reg = reg;
 		offset += item_size;
 
-		rmi_dbg(RMI_DEBUG_CORE, &d->dev,
-			"%s: reg: %d reg size: %u subpackets: %d\n", __func__,
-			item->reg, item->reg_size, item->num_subpackets);
+		pr_info("%s: parsed item %d: reg: %d reg size: %u subpackets: %d\n", __func__,
+			i, item->reg, item->reg_size, item->num_subpackets);
 
 		reg = find_next_bit(presence_map,
 				    RMI_REG_DESC_PRESENCE_BITS, reg + 1);

> 

-- 
Dmitry

Re: [PATCH 7.1 00/21] 7.1.2-rc1 review

[Barry K. Nathan]

On 6/26/26 12:56 PM, Dmitry Torokhov wrote:
> Hi Barry,
> 
> On Fri, Jun 26, 2026 at 10:56:21AM -0700, Barry K. Nathan wrote:
>> (cc Dmitry Torokhov because this is related to two of your commits)
>>
>> On 6/25/26 6:03 AM, Greg Kroah-Hartman wrote:
>>> This is the start of the stable review cycle for the 7.1.2 release.
>>> There are 21 patches in this series, all will be posted as a response
>>> to this one.  If anyone has any issues with these being applied, please
>>> let me know.
>>>
>>> Responses should be made by Sat, 27 Jun 2026 12:54:50 +0000.
>>> Anything received after that time might be too late.
>>>
>>> The whole patch series can be found in one patch at:
>>> 	https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.2-rc1.gz
>>> or in the git tree and branch at:
>>> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y
>>> and the diffstat can be found below.
>>>
>>> thanks,
>>>
>>> greg k-h
>>>
>> Unfortunately, 7.1.2-rc1 breaks the Synaptics touchpad on my Lenovo
>> ThinkPad T14 Gen 1 -- the pointer no longer moves when I touch the
>> touchpad. Potentially relevant line from dmesg:
>>
>> rmi4_f01 rmi4-00.fn01: found RMI device, manufacturer: Synaptics, product: TM3471-020, fw id: 3972349
>>
>>> Dmitry Torokhov<dmitry.torokhov@gmail.com>
>>>       Input: rmi4 - refactor register descriptor parsing
>>>
>>> Dmitry Torokhov<dmitry.torokhov@gmail.com>
>>>       Input: rmi4 - fix register descriptor address calculation
>>>> Both of these patches seem bad in my testing. Either one, individually,
>> causes the pointer to no longer move when I touch the touchpad. If I
>> revert both of them, then my touchpad works again.
>>
>> I have not yet tested 7.0.14-rc1 or 6.18.37-rc1. However, the problem
>> also reproduces on current mainline as of this writing (commit
>> 51cb1aa1250c36269474b8b6ca6b6319e170f5a5).
>
> Could you please try applying this debug patch and send me dmesg?

Sure, I applied the patch on top of mainline, and the dmesg output is
below. A couple of clarifications to avoid confusion:

1. I set CONFIG_LOCALVERSION to "-t14test202606" when building this
    kernel.

2. The "debian12vm2" that I used to build this kernel is actually
    running Debian 13 trixie now, but I never changed the hostname.
    (My ThinkPad is also running trixie.)


[    0.000000] Linux version 7.1.0-t14test202606+ (barryn@debian12vm2) (x86_64-linux-gnu-gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44) #2 SMP PREEMPT_DYNAMIC Fri Jun 26 13:08:00 PDT 2026
[    0.000000] Command line: BOOT_IMAGE=/vmlinuz-7.1.0-t14test202606+ root=UUID=acabe8be-6dd5-4d04-a138-22fdf9a0b015 ro preempt=full
[    0.000000] KERNEL supported cpus:
[    0.000000]   Intel GenuineIntel
[    0.000000]   AMD AuthenticAMD
[    0.000000] BIOS-provided physical RAM map:
[    0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009efff]  System RAM
[    0.000000] BIOS-e820: [mem 0x000000000009f000-0x00000000000fffff]  device reserved
[    0.000000] BIOS-e820: [mem 0x0000000000100000-0x00000000a40b6fff]  System RAM
[    0.000000] BIOS-e820: [mem 0x00000000a40b7000-0x00000000a8294fff]  device reserved
[    0.000000] BIOS-e820: [mem 0x00000000a8295000-0x00000000a961efff]  ACPI NVS
[    0.000000] BIOS-e820: [mem 0x00000000a961f000-0x00000000a974efff]  ACPI data
[    0.000000] BIOS-e820: [mem 0x00000000a974f000-0x00000000a974ffff]  System RAM
[    0.000000] BIOS-e820: [mem 0x00000000a9750000-0x00000000af7fffff]  device reserved
[    0.000000] BIOS-e820: [gap 0x00000000af800000-0x00000000fed1ffff]
[    0.000000] BIOS-e820: [mem 0x00000000fed20000-0x00000000fed7ffff]  device reserved
[    0.000000] BIOS-e820: [gap 0x00000000fed80000-0x00000000ffffffff]
[    0.000000] BIOS-e820: [mem 0x0000000100000000-0x000000084c7fffff]  System RAM
[    0.000000] NX (Execute Disable) protection: active
[    0.000000] APIC: Static calls initialized
[    0.000000] efi: EFI v2.7 by Lenovo
[    0.000000] efi: TPMFinalLog=0xa9617000 SMBIOS=0xa66b8000 SMBIOS 3.0=0xa66ab000 ACPI=0xa974e000 ACPI 2.0=0xa974e014 MEMATTR=0xa0c96018 ESRT=0xa4b3a000 MOKvar=0xa4b34000 INITRD=0x831b7818 RNG=0xa974d018 TPMEventLog=0xa974df18
[    0.000000] random: crng init done
[    0.000000] DMI: SMBIOS 3.2.0 present.
[    0.000000] DMI: LENOVO 20S1S6D700/20S1S6D700, BIOS N2XET45W (1.35 ) 04/08/2026
[    0.000000] DMI: Memory slots populated: 2/2
[    0.000000] tsc: Detected 2200.000 MHz processor
[    0.000000] tsc: Detected 2199.996 MHz TSC
[    0.000033] e820: update [mem 0x00000000-0x00000fff] System RAM ==> device reserved
[    0.000038] e820: remove [mem 0x000a0000-0x000fffff] System RAM
[    0.000048] last_pfn = 0x84c800 max_arch_pfn = 0x400000000
[    0.000056] MTRR map: 5 entries (3 fixed + 2 variable; max 23), built from 10 variable MTRRs
[    0.000059] x86/PAT: Configuration [0-7]: WB  WC  UC- UC  WB  WP  UC- WT
[    0.000637] last_pfn = 0xa9750 max_arch_pfn = 0x400000000
[    0.014154] esrt: Reserving ESRT space from 0x00000000a4b3a000 to 0x00000000a4b3a0d8.
[    0.014171] Using GB pages for direct mapping
[    0.014544] Secure boot disabled
[    0.014545] RAMDISK: [mem 0x76bd6000-0x79b13fff]
[    0.014620] ACPI: Early table checksum verification disabled
[    0.014624] ACPI: RSDP 0x00000000A974E014 000024 (v02 LENOVO)
[    0.014631] ACPI: XSDT 0x00000000A974C188 00010C (v01 LENOVO TP-N2X   00001350 PTEC 00000002)
[    0.014640] ACPI: FACP 0x00000000A6560000 000114 (v06 LENOVO TP-N2X   00001350 PTEC 00000002)
[    0.014648] ACPI: DSDT 0x00000000A652F000 02C5BD (v02 LENOVO CML      20170001 INTL 20160422)
[    0.014653] ACPI: FACS 0x00000000A947B000 000040
[    0.014657] ACPI: SSDT 0x00000000A65BC000 0020AE (v02 LENOVO CpuSsdt  00003000 INTL 20160527)
[    0.014662] ACPI: SSDT 0x00000000A65BB000 0005A1 (v02 LENOVO CtdpB    00001000 INTL 20160527)
[    0.014667] ACPI: SSDT 0x00000000A657E000 003532 (v02 LENOVO DptfTabl 00001000 INTL 20160527)
[    0.014672] ACPI: SSDT 0x00000000A6568000 00331E (v02 LENOVO SaSsdt   00003000 INTL 20160527)
[    0.014677] ACPI: SSDT 0x00000000A6567000 00060E (v02 LENOVO Tpm2Tabl 00001000 INTL 20160527)
[    0.014681] ACPI: TPM2 0x00000000A6566000 000034 (v04 LENOVO TP-N2X   00001350 PTEC 00000002)
[    0.014686] ACPI: BOOT 0x00000000A6564000 000028 (v01 LENOVO TP-N2X   00001350 PTEC 00000002)
[    0.014691] ACPI: HPET 0x00000000A655F000 000038 (v01 LENOVO TP-N2X   00001350 PTEC 00000002)
[    0.014696] ACPI: APIC 0x00000000A655E000 000164 (v04 LENOVO TP-N2X   00001350 PTEC 00000002)
[    0.014700] ACPI: MCFG 0x00000000A655D000 00003C (v01 LENOVO TP-N2X   00001350 PTEC 00000002)
[    0.014705] ACPI: ECDT 0x00000000A655C000 000053 (v01 LENOVO TP-N2X   00001350 PTEC 00000002)
[    0.014710] ACPI: SSDT 0x00000000A652D000 001F15 (v02 LENOVO WHL_Tbt_ 00001000 INTL 20160527)
[    0.014715] ACPI: SSDT 0x00000000A652C000 0000A6 (v02 LENOVO PID0Ssdt 00000010 INTL 20160527)
[    0.014719] ACPI: SSDT 0x00000000A6528000 003AD0 (v02 LENOVO ProjSsdt 00000010 INTL 20160527)
[    0.014724] ACPI: NHLT 0x00000000A6526000 00189E (v00 LENOVO TP-N2X   00001350 PTEC 00000002)
[    0.014729] ACPI: MSDM 0x00000000A6525000 000055 (v03 LENOVO TP-N2X   00001350 PTEC 00000002)
[    0.014734] ACPI: SSDT 0x00000000A6348000 000FCE (v02 LENOVO UsbCTabl 00001000 INTL 20160527)
[    0.014738] ACPI: LPIT 0x00000000A6347000 000094 (v01 LENOVO TP-N2X   00001350 PTEC 00000002)
[    0.014743] ACPI: WSMT 0x00000000A6346000 000028 (v01 LENOVO TP-N2X   00001350 PTEC 00000002)
[    0.014748] ACPI: SSDT 0x00000000A6343000 00281B (v02 LENOVO TbtTypeC 00000000 INTL 20160527)
[    0.014753] ACPI: DBGP 0x00000000A6342000 000034 (v01 LENOVO TP-N2X   00001350 PTEC 00000002)
[    0.014757] ACPI: DBG2 0x00000000A6341000 000054 (v00 LENOVO TP-N2X   00001350 PTEC 00000002)
[    0.014762] ACPI: BATB 0x00000000A6340000 00004A (v02 LENOVO TP-N2X   00001350 PTEC 00000002)
[    0.014767] ACPI: DMAR 0x00000000A6563000 0000C8 (v01 LENOVO TP-N2X   00001350 PTEC 00000002)
[    0.014771] ACPI: ASF! 0x00000000A4B38000 0000A0 (v32 LENOVO TP-N2X   00001350 PTEC 00000002)
[    0.014776] ACPI: BGRT 0x00000000A4B37000 000038 (v01 LENOVO TP-N2X   00001350 PTEC 00000002)
[    0.014781] ACPI: UEFI 0x00000000A9430000 00012A (v01 LENOVO TP-N2X   00001350 PTEC 00000002)
[    0.014786] ACPI: FPDT 0x00000000A4B36000 000034 (v01 LENOVO TP-N2X   00001350 PTEC 00001350)
[    0.014790] ACPI: Reserving FACP table memory at [mem 0xa6560000-0xa6560113]
[    0.014793] ACPI: Reserving DSDT table memory at [mem 0xa652f000-0xa655b5bc]
[    0.014795] ACPI: Reserving FACS table memory at [mem 0xa947b000-0xa947b03f]
[    0.014796] ACPI: Reserving SSDT table memory at [mem 0xa65bc000-0xa65be0ad]
[    0.014798] ACPI: Reserving SSDT table memory at [mem 0xa65bb000-0xa65bb5a0]
[    0.014799] ACPI: Reserving SSDT table memory at [mem 0xa657e000-0xa6581531]
[    0.014801] ACPI: Reserving SSDT table memory at [mem 0xa6568000-0xa656b31d]
[    0.014802] ACPI: Reserving SSDT table memory at [mem 0xa6567000-0xa656760d]
[    0.014803] ACPI: Reserving TPM2 table memory at [mem 0xa6566000-0xa6566033]
[    0.014805] ACPI: Reserving BOOT table memory at [mem 0xa6564000-0xa6564027]
[    0.014806] ACPI: Reserving HPET table memory at [mem 0xa655f000-0xa655f037]
[    0.014808] ACPI: Reserving APIC table memory at [mem 0xa655e000-0xa655e163]
[    0.014809] ACPI: Reserving MCFG table memory at [mem 0xa655d000-0xa655d03b]
[    0.014811] ACPI: Reserving ECDT table memory at [mem 0xa655c000-0xa655c052]
[    0.014812] ACPI: Reserving SSDT table memory at [mem 0xa652d000-0xa652ef14]
[    0.014814] ACPI: Reserving SSDT table memory at [mem 0xa652c000-0xa652c0a5]
[    0.014815] ACPI: Reserving SSDT table memory at [mem 0xa6528000-0xa652bacf]
[    0.014817] ACPI: Reserving NHLT table memory at [mem 0xa6526000-0xa652789d]
[    0.014818] ACPI: Reserving MSDM table memory at [mem 0xa6525000-0xa6525054]
[    0.014820] ACPI: Reserving SSDT table memory at [mem 0xa6348000-0xa6348fcd]
[    0.014821] ACPI: Reserving LPIT table memory at [mem 0xa6347000-0xa6347093]
[    0.014823] ACPI: Reserving WSMT table memory at [mem 0xa6346000-0xa6346027]
[    0.014824] ACPI: Reserving SSDT table memory at [mem 0xa6343000-0xa634581a]
[    0.014826] ACPI: Reserving DBGP table memory at [mem 0xa6342000-0xa6342033]
[    0.014827] ACPI: Reserving DBG2 table memory at [mem 0xa6341000-0xa6341053]
[    0.014829] ACPI: Reserving BATB table memory at [mem 0xa6340000-0xa6340049]
[    0.014830] ACPI: Reserving DMAR table memory at [mem 0xa6563000-0xa65630c7]
[    0.014832] ACPI: Reserving ASF! table memory at [mem 0xa4b38000-0xa4b3809f]
[    0.014833] ACPI: Reserving BGRT table memory at [mem 0xa4b37000-0xa4b37037]
[    0.014835] ACPI: Reserving UEFI table memory at [mem 0xa9430000-0xa9430129]
[    0.014836] ACPI: Reserving FPDT table memory at [mem 0xa4b36000-0xa4b36033]
[    0.015016] No NUMA configuration found
[    0.015017] Faking a node at [mem 0x0000000000000000-0x000000084c7fffff]
[    0.015037] NODE_DATA(0) allocated [mem 0x84c7d5200-0x84c7fffff]
[    0.015512] Reserving Intel graphics memory at [mem 0xab800000-0xaf7fffff]
[    0.015793] ACPI: PM-Timer IO Port: 0x1808
[    0.015805] ACPI: LAPIC_NMI (acpi_id[0x01] high edge lint[0x1])
[    0.015808] ACPI: LAPIC_NMI (acpi_id[0x02] high edge lint[0x1])
[    0.015809] ACPI: LAPIC_NMI (acpi_id[0x03] high edge lint[0x1])
[    0.015811] ACPI: LAPIC_NMI (acpi_id[0x04] high edge lint[0x1])
[    0.015813] ACPI: LAPIC_NMI (acpi_id[0x05] high edge lint[0x1])
[    0.015814] ACPI: LAPIC_NMI (acpi_id[0x06] high edge lint[0x1])
[    0.015815] ACPI: LAPIC_NMI (acpi_id[0x07] high edge lint[0x1])
[    0.015817] ACPI: LAPIC_NMI (acpi_id[0x08] high edge lint[0x1])
[    0.015818] ACPI: LAPIC_NMI (acpi_id[0x09] high edge lint[0x1])
[    0.015819] ACPI: LAPIC_NMI (acpi_id[0x0a] high edge lint[0x1])
[    0.015821] ACPI: LAPIC_NMI (acpi_id[0x0b] high edge lint[0x1])
[    0.015822] ACPI: LAPIC_NMI (acpi_id[0x0c] high edge lint[0x1])
[    0.015823] ACPI: LAPIC_NMI (acpi_id[0x0d] high edge lint[0x1])
[    0.015825] ACPI: LAPIC_NMI (acpi_id[0x0e] high edge lint[0x1])
[    0.015826] ACPI: LAPIC_NMI (acpi_id[0x0f] high edge lint[0x1])
[    0.015827] ACPI: LAPIC_NMI (acpi_id[0x10] high edge lint[0x1])
[    0.015829] ACPI: LAPIC_NMI (acpi_id[0x11] high edge lint[0x1])
[    0.015830] ACPI: LAPIC_NMI (acpi_id[0x12] high edge lint[0x1])
[    0.015832] ACPI: LAPIC_NMI (acpi_id[0x13] high edge lint[0x1])
[    0.015833] ACPI: LAPIC_NMI (acpi_id[0x14] high edge lint[0x1])
[    0.015875] IOAPIC[0]: apic_id 2, version 32, address 0xfec00000, GSI 0-119
[    0.015880] ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 2 dfl dfl)
[    0.015883] ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level)
[    0.015891] ACPI: Using ACPI (MADT) for SMP configuration information
[    0.015892] ACPI: HPET id: 0x8086a201 base: 0xfed00000
[    0.015905] e820: update [mem 0xa0503000-0xa0593fff] System RAM ==> device reserved
[    0.015919] TSC deadline timer available
[    0.015924] CPU topo: Max. logical packages:   1
[    0.015926] CPU topo: Max. logical nodes:      1
[    0.015927] CPU topo: Num. nodes per package:  1
[    0.015932] CPU topo: Max. logical dies:       1
[    0.015933] CPU topo: Max. dies per package:   1
[    0.015942] CPU topo: Max. threads per core:   2
[    0.015943] CPU topo: Num. cores per package:     4
[    0.015944] CPU topo: Num. threads per package:   8
[    0.015945] CPU topo: Allowing 8 present CPUs plus 0 hotplug CPUs
[    0.015964] PM: hibernation: Registered nosave memory: [mem 0x00000000-0x00000fff]
[    0.015968] PM: hibernation: Registered nosave memory: [mem 0x0009f000-0x000fffff]
[    0.015971] PM: hibernation: Registered nosave memory: [mem 0xa0503000-0xa0593fff]
[    0.015974] PM: hibernation: Registered nosave memory: [mem 0xa40b7000-0xa974efff]
[    0.015976] PM: hibernation: Registered nosave memory: [mem 0xa9750000-0xffffffff]
[    0.015979] [gap 0xaf800000-0xfed1ffff] available for PCI devices
[    0.015982] Booting paravirtualized kernel on bare hardware
[    0.015984] clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1910969940391419 ns
[    0.028985] Zone ranges:
[    0.028986]   DMA      [mem 0x0000000000001000-0x0000000000ffffff]
[    0.028990]   DMA32    [mem 0x0000000001000000-0x00000000ffffffff]
[    0.028993]   Normal   [mem 0x0000000100000000-0x000000084c7fffff]
[    0.028995]   Device   empty
[    0.028997] Movable zone start for each node
[    0.029001] Early memory node ranges
[    0.029002]   node   0: [mem 0x0000000000001000-0x000000000009efff]
[    0.029004]   node   0: [mem 0x0000000000100000-0x00000000a40b6fff]
[    0.029007]   node   0: [mem 0x00000000a974f000-0x00000000a974ffff]
[    0.029008]   node   0: [mem 0x0000000100000000-0x000000084c7fffff]
[    0.029017] Initmem setup node 0 [mem 0x0000000000001000-0x000000084c7fffff]
[    0.029027] On node 0, zone DMA: 1 pages in unavailable ranges
[    0.029065] On node 0, zone DMA: 97 pages in unavailable ranges
[    0.035574] On node 0, zone DMA32: 22168 pages in unavailable ranges
[    0.036314] On node 0, zone Normal: 26800 pages in unavailable ranges
[    0.036474] On node 0, zone Normal: 14336 pages in unavailable ranges
[    0.036487] setup_percpu: NR_CPUS:8192 nr_cpumask_bits:8 nr_cpu_ids:8 nr_node_ids:1
[    0.037232] percpu: Embedded 82 pages/cpu s212992 r8192 d114688 u524288
[    0.037252] pcpu-alloc: s212992 r8192 d114688 u524288 alloc=1*2097152
[    0.037256] pcpu-alloc: [0] 0 1 2 3 [0] 4 5 6 7
[    0.037291] Kernel command line: BOOT_IMAGE=/vmlinuz-7.1.0-t14test202606+ root=UUID=acabe8be-6dd5-4d04-a138-22fdf9a0b015 ro preempt=full
[    0.038359] Dynamic Preempt: full
[    0.038406] printk: log buffer data + meta data: 131072 + 458752 = 589824 bytes
[    0.042665] Dentry cache hash table entries: 4194304 (order: 13, 33554432 bytes, linear)
[    0.044784] Inode-cache hash table entries: 2097152 (order: 12, 16777216 bytes, linear)
[    0.044974] software IO TLB: area num 8.
[    0.062221] Fallback order for Node 0: 0
[    0.062228] Built 1 zonelists, mobility grouping on.  Total pages: 8325206
[    0.062230] Policy zone: Normal
[    0.062241] mem auto-init: stack:all(zero), heap alloc:on, heap free:off
[    0.082430] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=8, Nodes=1
[    0.098163] ftrace: allocating 50623 entries in 200 pages
[    0.098166] ftrace: allocated 200 pages with 3 groups
[    0.098448] rcu: Preemptible hierarchical RCU implementation.
[    0.098449] rcu: 	RCU restricting CPUs from NR_CPUS=8192 to nr_cpu_ids=8.
[    0.098452] 	Trampoline variant of Tasks RCU enabled.
[    0.098453] 	Rude variant of Tasks RCU enabled.
[    0.098453] 	Tracing variant of Tasks RCU enabled.
[    0.098454] rcu: RCU calculated value of scheduler-enlistment delay is 100 jiffies.
[    0.098456] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=8
[    0.098473] RCU Tasks: Setting shift to 3 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=8.
[    0.098476] RCU Tasks Rude: Setting shift to 3 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=8.
[    0.110824] NR_IRQS: 524544, nr_irqs: 2048, preallocated irqs: 16
[    0.111184] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.111416] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1911260446275000 ns
[    0.111540] Console: colour dummy device 80x25
[    0.111553] printk: legacy console [tty0] enabled
[    0.112281] ACPI: Core revision 20260408
[    0.112694] hpet: HPET dysfunctional in PC10. Force disabled.
[    0.112758] APIC: Switch to symmetric I/O mode setup
[    0.112764] DMAR: Host address width 39
[    0.112768] DMAR: DRHD base: 0x000000fed90000 flags: 0x0
[    0.112794] DMAR: dmar0: reg_base_addr fed90000 ver 1:0 cap 1c0000c40660462 ecap 19e2ff0505e
[    0.112803] DMAR: DRHD base: 0x000000fed91000 flags: 0x1
[    0.112812] DMAR: dmar1: reg_base_addr fed91000 ver 1:0 cap d2008c40660462 ecap f050da
[    0.112821] DMAR: RMRR base: 0x000000a81d0000 end: 0x000000a81effff
[    0.112828] DMAR: RMRR base: 0x000000ab000000 end: 0x000000af7fffff
[    0.112833] DMAR: RMRR base: 0x000000a8201000 end: 0x000000a8280fff
[    0.112839] DMAR-IR: IOAPIC id 2 under DRHD base  0xfed91000 IOMMU 1
[    0.112846] DMAR-IR: HPET id 0 under DRHD base 0xfed91000
[    0.112851] DMAR-IR: Queued invalidation will be enabled to support x2apic and Intr-remapping.
[    0.115172] DMAR-IR: Enabled IRQ remapping in x2apic mode
[    0.115179] x2apic enabled
[    0.115320] APIC: Switched APIC routing to: cluster x2apic
[    0.120890] clocksource: tsc-early: mask: 0xffffffffffffffff max_cycles: 0x1fb62f12e8c, max_idle_ns: 440795238402 ns
[    0.120905] Calibrating delay loop (skipped), value calculated using timer frequency.. 4399.99 BogoMIPS (lpj=2199996)
[    0.120954] x86/cpu: SGX disabled or unsupported by BIOS.
[    0.120967] CPU0: Thermal monitoring enabled (TM1)
[    0.121059] Last level iTLB entries: 4KB 64, 2MB 8, 4MB 8
[    0.121064] Last level dTLB entries: 4KB 64, 2MB 32, 4MB 32, 1GB 4
[    0.121083] process: using mwait in idle threads
[    0.121089] mitigations: Enabled attack vectors: user_kernel, user_user, guest_host, guest_guest, SMT mitigations: auto
[    0.121101] Speculative Store Bypass: Mitigation: Speculative Store Bypass disabled via prctl
[    0.121108] SRBDS: Mitigation: Microcode
[    0.121114] Spectre V2 : Mitigation: Enhanced / Automatic IBRS
[    0.121119] RETBleed: Mitigation: Enhanced IBRS
[    0.121123] ITS: Mitigation: Aligned branch/return thunks
[    0.121127] MMIO Stale Data: Mitigation: Clear CPU buffers
[    0.121132] VMSCAPE: Mitigation: IBPB before exit to userspace
[    0.121136] Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization
[    0.121142] Spectre V2 : Spectre v2 / PBRSB-eIBRS: Retire a single CALL on VMEXIT
[    0.121148] Spectre V2 : mitigation: Enabling conditional Indirect Branch Prediction Barrier
[    0.121170] GDS: Mitigation: Microcode
[    0.121174] active return thunk: its_return_thunk
[    0.121183] Spectre V2 : Spectre BHI mitigation: SW BHB clearing on syscall and VM exit
[    0.121196] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
[    0.121202] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
[    0.121207] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
[    0.121212] x86/fpu: Supporting XSAVE feature 0x008: 'MPX bounds registers'
[    0.121217] x86/fpu: Supporting XSAVE feature 0x010: 'MPX CSR'
[    0.121222] x86/fpu: xstate_offset[2]:  576, xstate_sizes[2]:  256
[    0.121228] x86/fpu: xstate_offset[3]:  832, xstate_sizes[3]:   64
[    0.121233] x86/fpu: xstate_offset[4]:  896, xstate_sizes[4]:   64
[    0.121238] x86/fpu: Enabled xstate features 0x1f, context size is 960 bytes, using 'compacted' format.
[    0.121901] pid_max: default: 32768 minimum: 301
[    0.121901] landlock: Up and running.
[    0.121901] Yama: becoming mindful.
[    0.121901] AppArmor: AppArmor initialized
[    0.121901] TOMOYO Linux initialized
[    0.121901] LSM support for eBPF active
[    0.121901] Mount-cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.121901] Mountpoint-cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.121901] VFS: Finished mounting rootfs on nullfs
[    0.121901] smpboot: CPU0: Intel(R) Core(TM) i5-10310U CPU @ 1.70GHz (family: 0x6, model: 0x8e, stepping: 0xc)
[    0.121901] Performance Events: PEBS fmt3+, Skylake events, 32-deep LBR, full-width counters, Intel PMU driver.
[    0.121901] ... version:                   4
[    0.121901] ... bit width:                 48
[    0.121901] ... generic counters:          4
[    0.121901] ... generic bitmap:            000000000000000f
[    0.121901] ... fixed-purpose counters:    3
[    0.121901] ... fixed-purpose bitmap:      0000000000000007
[    0.121901] ... value mask:                0000ffffffffffff
[    0.121901] ... max period:                00007fffffffffff
[    0.121901] ... global_ctrl mask:          000000070000000f
[    0.121901] signal: max sigframe size: 2032
[    0.121901] Estimated ratio of average max frequency by base frequency (times 1024): 1861
[    0.121901] rcu: Hierarchical SRCU implementation.
[    0.121901] rcu: 	Max phase no-delay instances is 400.
[    0.121901] Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level
[    0.126955] NMI watchdog: Enabled. Permanently consumes one hw-PMU counter.
[    0.127098] smp: Bringing up secondary CPUs ...
[    0.127280] smpboot: x86: Booting SMP configuration:
[    0.127285] .... node  #0, CPUs:      #1 #2 #3 #4 #5 #6 #7
[    0.130496] MMIO Stale Data CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html for more details.
[    0.130997] smp: Brought up 1 node, 8 CPUs
[    0.130997] smpboot: Total of 8 processors activated (35199.93 BogoMIPS)
[    0.191909] node 0 deferred pages initialised in 60ms
[    0.192488] Memory: 32485468K/33300824K available (18454K kernel code, 2763K rwdata, 8120K rodata, 4296K init, 3716K bss, 794984K reserved, 0K cma-reserved)
[    0.193747] devtmpfs: initialized
[    0.193985] x86/mm: Memory block size: 128MB
[    0.199045] ACPI: PM: Registering ACPI NVS region [mem 0xa8295000-0xa961efff] (20488192 bytes)
[    0.199356] posixtimers hash table entries: 4096 (order: 4, 65536 bytes, linear)
[    0.199356] futex hash table entries: 2048 (131072 bytes on 1 NUMA nodes, total 128 KiB, linear).
[    0.200655] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.201300] DMA: preallocated 4096 KiB GFP_KERNEL pool for atomic allocations
[    0.201661] DMA: preallocated 4096 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.202054] DMA: preallocated 4096 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.202089] audit: initializing netlink subsys (disabled)
[    0.202110] audit: type=2000 audit(1782504666.081:1): state=initialized audit_enabled=0 res=1
[    0.202110] thermal_sys: Registered thermal governor 'fair_share'
[    0.202111] thermal_sys: Registered thermal governor 'bang_bang'
[    0.202118] thermal_sys: Registered thermal governor 'step_wise'
[    0.202122] thermal_sys: Registered thermal governor 'user_space'
[    0.202125] thermal_sys: Registered thermal governor 'power_allocator'
[    0.202141] cpuidle: using governor ladder
[    0.202141] cpuidle: using governor menu
[    0.202141] Simple Boot Flag at 0x47 set to 0x1
[    0.202141] Freeing SMP alternatives memory: 48K
[    0.208966] efi: Freeing EFI boot services memory: 57488K
[    0.208975] ACPI FADT declares the system doesn't support PCIe ASPM, so disable it
[    0.208981] acpiphp: ACPI Hot Plug PCI Controller Driver version: 0.5
[    0.209363] PCI: ECAM [mem 0xf0000000-0xf7ffffff] (base 0xf0000000) for domain 0000 [bus 00-7f]
[    0.209389] PCI: Using configuration type 1 for base access
[    0.209503] kprobes: kprobe jump-optimization is enabled. All kprobes are optimized if possible.
[    0.209948] HugeTLB: registered 1.00 GiB page size, pre-allocated 0 pages
[    0.209954] HugeTLB: 16380 KiB vmemmap can be freed for a 1.00 GiB page
[    0.209963] HugeTLB: registered 2.00 MiB page size, pre-allocated 0 pages
[    0.209971] HugeTLB: 28 KiB vmemmap can be freed for a 2.00 MiB page
[    0.212171] ACPI: Added _OSI(Module Device)
[    0.212180] ACPI: Added _OSI(Processor Device)
[    0.212187] ACPI: Added _OSI(Processor Aggregator Device)
[    0.306534] ACPI: 11 ACPI AML tables successfully acquired and loaded
[    0.307963] ACPI: EC: EC started
[    0.307968] ACPI: EC: interrupt blocked
[    0.308938] ACPI: EC: EC_CMD/EC_SC=0x66, EC_DATA=0x62
[    0.308944] ACPI: EC: Boot ECDT EC used to handle transactions
[    0.311517] ACPI: [Firmware Bug]: BIOS _OSI(Linux) query ignored
[    0.369944] ACPI: \_SB_: platform _OSC: OS support mask [002e7eff]
[    0.370108] ACPI: \_SB_: platform _OSC: OS control mask [002e7eff]
[    0.370151] ACPI: Dynamic OEM Table Load:
[    0.370159] ACPI: SSDT 0xFFFF8C7D8198F400 000400 (v02 PmRef  Cpu0Cst  00003001 INTL 20160527)
[    0.370791] ACPI: Dynamic OEM Table Load:
[    0.370798] ACPI: SSDT 0xFFFF8C7D814DB000 0005FD (v02 PmRef  Cpu0Ist  00003000 INTL 20160527)
[    0.371422] ACPI: Dynamic OEM Table Load:
[    0.371427] ACPI: SSDT 0xFFFF8C7D825B1000 0000FC (v02 PmRef  Cpu0Psd  00003000 INTL 20160527)
[    0.372007] ACPI: Dynamic OEM Table Load:
[    0.372012] ACPI: SSDT 0xFFFF8C7D814CC800 00016C (v02 PmRef  Cpu0Hwp  00003000 INTL 20160527)
[    0.372566] ACPI: Dynamic OEM Table Load:
[    0.372574] ACPI: SSDT 0xFFFF8C7D8262C000 000BEA (v02 PmRef  HwpLvt   00003000 INTL 20160527)
[    0.373266] ACPI: Dynamic OEM Table Load:
[    0.373273] ACPI: SSDT 0xFFFF8C7D814DA800 000778 (v02 PmRef  ApIst    00003000 INTL 20160527)
[    0.373923] ACPI: Dynamic OEM Table Load:
[    0.373929] ACPI: SSDT 0xFFFF8C7D8198A800 0003D7 (v02 PmRef  ApHwp    00003000 INTL 20160527)
[    0.374577] ACPI: Dynamic OEM Table Load:
[    0.374584] ACPI: SSDT 0xFFFF8C7D8262A000 000D22 (v02 PmRef  ApPsd    00003000 INTL 20160527)
[    0.375565] ACPI: Dynamic OEM Table Load:
[    0.375571] ACPI: SSDT 0xFFFF8C7D8198B800 0003CA (v02 PmRef  ApCst    00003000 INTL 20160527)
[    0.378604] ACPI: Interpreter enabled
[    0.378640] ACPI: PM: (supports S0 S3 S4 S5)
[    0.378642] ACPI: Using IOAPIC for interrupt routing
[    0.378678] PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug
[    0.378680] PCI: Ignoring E820 reservations for host bridge windows
[    0.378941] ACPI: Enabled 7 GPEs in block 00 to 7F
[    0.381396] ACPI: \_SB_.PCI0.LPCB.EC__.PUBS: New power resource
[    0.383569] ACPI: \_SB_.PCI0.XHC_.RHUB.HS10.BTPR: New power resource
[    0.383825] ACPI: \_SB_.PCI0.XHC_.RHUB.HS10.BTRT: New power resource
[    0.384418] ACPI: \_SB_.PCI0.XDCI.USBC: New power resource
[    0.385524] ACPI: \_SB_.PCI0.RP05.PXP_: New power resource
[    0.387333] ACPI: \_SB_.PCI0.RP07.PXP_: New power resource
[    0.391013] ACPI: \_SB_.PCI0.SAT0.VOL0.V0PR: New power resource
[    0.391112] ACPI: \_SB_.PCI0.SAT0.VOL1.V1PR: New power resource
[    0.391206] ACPI: \_SB_.PCI0.SAT0.VOL2.V2PR: New power resource
[    0.392061] ACPI: \_SB_.PCI0.CNVW.WRST: New power resource
[    0.394643] ACPI: \PIN_: New power resource
[    0.394660] ACPI: \PINP: New power resource
[    0.394968] ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-7e])
[    0.394975] acpi PNP0A08:00: _OSC: OS supports [ExtendedConfig ASPM ClockPM Segments MSI HPX-Type3]
[    0.396189] acpi PNP0A08:00: _OSC: platform does not support [AER]
[    0.398592] acpi PNP0A08:00: _OSC: OS now controls [PCIeHotplug SHPCHotplug PME PCIeCapability LTR]
[    0.398595] acpi PNP0A08:00: FADT indicates ASPM is unsupported, using BIOS configuration
[    0.400263] PCI host bridge to bus 0000:00
[    0.400268] pci_bus 0000:00: root bus resource [io  0x0000-0x0cf7 window]
[    0.400271] pci_bus 0000:00: root bus resource [io  0x0d00-0xffff window]
[    0.400273] pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000bffff window]
[    0.400275] pci_bus 0000:00: root bus resource [mem 0xaf800000-0xefffffff window]
[    0.400278] pci_bus 0000:00: root bus resource [mem 0xfc800000-0xfdffffff window]
[    0.400280] pci_bus 0000:00: root bus resource [bus 00-7e]
[    0.400303] pci 0000:00:00.0: [8086:9b61] type 00 class 0x060000 conventional PCI endpoint
[    0.400381] pci 0000:00:02.0: [8086:9b41] type 00 class 0x030000 PCIe Root Complex Integrated Endpoint
[    0.400397] pci 0000:00:02.0: BAR 0 [mem 0xed000000-0xedffffff 64bit]
[    0.400400] pci 0000:00:02.0: BAR 2 [mem 0xd0000000-0xdfffffff 64bit pref]
[    0.400403] pci 0000:00:02.0: BAR 4 [io  0x4000-0x403f]
[    0.400414] pci 0000:00:02.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff]
[    0.400542] pci 0000:00:04.0: [8086:1903] type 00 class 0x118000 conventional PCI endpoint
[    0.400561] pci 0000:00:04.0: BAR 0 [mem 0xef730000-0xef737fff 64bit]
[    0.400780] pci 0000:00:08.0: [8086:1911] type 00 class 0x088000 conventional PCI endpoint
[    0.400798] pci 0000:00:08.0: BAR 0 [mem 0xef742000-0xef742fff 64bit]
[    0.400905] pci 0000:00:12.0: [8086:02f9] type 00 class 0x118000 conventional PCI endpoint
[    0.400945] pci 0000:00:12.0: BAR 0 [mem 0xef743000-0xef743fff 64bit]
[    0.401062] pci 0000:00:14.0: [8086:02ed] type 00 class 0x0c0330 conventional PCI endpoint
[    0.401094] pci 0000:00:14.0: BAR 0 [mem 0xef720000-0xef72ffff 64bit]
[    0.401128] pci 0000:00:14.0: PME# supported from D3hot D3cold
[    0.401410] pci 0000:00:14.2: [8086:02ef] type 00 class 0x050000 conventional PCI endpoint
[    0.401450] pci 0000:00:14.2: BAR 0 [mem 0xef740000-0xef741fff 64bit]
[    0.401454] pci 0000:00:14.2: BAR 2 [mem 0xef744000-0xef744fff 64bit]
[    0.401566] pci 0000:00:14.3: [8086:02f0] type 00 class 0x028000 PCIe Root Complex Integrated Endpoint
[    0.401622] pci 0000:00:14.3: BAR 0 [mem 0xef738000-0xef73bfff 64bit]
[    0.401718] pci 0000:00:14.3: PME# supported from D0 D3hot D3cold
[    0.401926] pci 0000:00:16.0: [8086:02e0] type 00 class 0x078000 conventional PCI endpoint
[    0.401970] pci 0000:00:16.0: BAR 0 [mem 0xef745000-0xef745fff 64bit]
[    0.402017] pci 0000:00:16.0: PME# supported from D3hot
[    0.402258] pci 0000:00:16.3: [8086:02e3] type 00 class 0x070002 conventional PCI endpoint
[    0.402293] pci 0000:00:16.3: BAR 0 [io  0x4060-0x4067]
[    0.402296] pci 0000:00:16.3: BAR 1 [mem 0xef748000-0xef748fff]
[    0.402418] pci 0000:00:1c.0: [8086:02b8] type 01 class 0x060400 PCIe Root Port
[    0.402435] pci 0000:00:1c.0: PCI bridge to [bus 02]
[    0.402441] pci 0000:00:1c.0:   bridge window [mem 0xef600000-0xef6fffff]
[    0.402504] pci 0000:00:1c.0: PME# supported from D0 D3hot D3cold
[    0.402898] pci 0000:00:1c.4: [8086:02bc] type 01 class 0x060400 PCIe Root Port
[    0.402917] pci 0000:00:1c.4: PCI bridge to [bus 03-2b]
[    0.402922] pci 0000:00:1c.4:   bridge window [mem 0xe0000000-0xec1fffff]
[    0.402929] pci 0000:00:1c.4:   bridge window [mem 0xb0000000-0xcbffffff 64bit pref]
[    0.402984] pci 0000:00:1c.4: PME# supported from D0 D3hot D3cold
[    0.403372] pci 0000:00:1d.0: [8086:02b0] type 01 class 0x060400 PCIe Root Port
[    0.403393] pci 0000:00:1d.0: PCI bridge to [bus 2d]
[    0.403397] pci 0000:00:1d.0:   bridge window [io  0x3000-0x3fff]
[    0.403400] pci 0000:00:1d.0:   bridge window [mem 0xeec00000-0xef5fffff]
[    0.403409] pci 0000:00:1d.0:   bridge window [mem 0xee000000-0xee9fffff 64bit pref]
[    0.403457] pci 0000:00:1d.0: PME# supported from D0 D3hot D3cold
[    0.403815] pci 0000:00:1d.4: [8086:02b4] type 01 class 0x060400 PCIe Root Port
[    0.403836] pci 0000:00:1d.4: PCI bridge to [bus 2e]
[    0.403842] pci 0000:00:1d.4:   bridge window [mem 0xeeb00000-0xeebfffff]
[    0.403909] pci 0000:00:1d.4: PME# supported from D0 D3hot D3cold
[    0.404310] pci 0000:00:1f.0: [8086:0284] type 00 class 0x060100 conventional PCI endpoint
[    0.404675] pci 0000:00:1f.3: [8086:02c8] type 00 class 0x040380 conventional PCI endpoint
[    0.404747] pci 0000:00:1f.3: BAR 0 [mem 0xef73c000-0xef73ffff 64bit]
[    0.404756] pci 0000:00:1f.3: BAR 4 [mem 0xeea00000-0xeeafffff 64bit]
[    0.404824] pci 0000:00:1f.3: PME# supported from D3hot D3cold
[    0.405178] pci 0000:00:1f.4: [8086:02a3] type 00 class 0x0c0500 conventional PCI endpoint
[    0.405222] pci 0000:00:1f.4: BAR 0 [mem 0xef746000-0xef7460ff 64bit]
[    0.405234] pci 0000:00:1f.4: BAR 4 [io  0xefa0-0xefbf]
[    0.405444] pci 0000:00:1f.5: [8086:02a4] type 00 class 0x0c8000 conventional PCI endpoint
[    0.405487] pci 0000:00:1f.5: BAR 0 [mem 0xfe010000-0xfe010fff]
[    0.405558] pci 0000:00:1f.6: [8086:0d4e] type 00 class 0x020000 conventional PCI endpoint
[    0.405640] pci 0000:00:1f.6: BAR 0 [mem 0xef700000-0xef71ffff]
[    0.405716] pci 0000:00:1f.6: PME# supported from D0 D3hot D3cold
[    0.405855] pci 0000:02:00.0: [10ec:522a] type 00 class 0xff0000 PCIe Endpoint
[    0.405914] pci 0000:02:00.0: BAR 0 [mem 0xef600000-0xef600fff]
[    0.406026] pci 0000:02:00.0: supports D1 D2
[    0.406028] pci 0000:02:00.0: PME# supported from D1 D2 D3hot D3cold
[    0.406248] pci 0000:00:1c.0: PCI bridge to [bus 02]
[    0.406324] pci 0000:03:00.0: [8086:15c0] type 01 class 0x060400 PCIe Switch Upstream Port
[    0.406353] pci 0000:03:00.0: PCI bridge to [bus 04-2b]
[    0.406363] pci 0000:03:00.0:   bridge window [mem 0xe0000000-0xec1fffff]
[    0.406374] pci 0000:03:00.0:   bridge window [mem 0xb0000000-0xcbffffff 64bit pref]
[    0.406388] pci 0000:03:00.0: enabling Extended Tags
[    0.406478] pci 0000:03:00.0: supports D1 D2
[    0.406480] pci 0000:03:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[    0.406654] pci 0000:00:1c.4: PCI bridge to [bus 03-2b]
[    0.406744] pci 0000:04:00.0: [8086:15c0] type 01 class 0x060400 PCIe Switch Downstream Port
[    0.406774] pci 0000:04:00.0: PCI bridge to [bus 05]
[    0.406784] pci 0000:04:00.0:   bridge window [mem 0xec100000-0xec1fffff]
[    0.406809] pci 0000:04:00.0: enabling Extended Tags
[    0.406899] pci 0000:04:00.0: supports D1 D2
[    0.406901] pci 0000:04:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[    0.407081] pci 0000:04:01.0: [8086:15c0] type 01 class 0x060400 PCIe Switch Downstream Port
[    0.407111] pci 0000:04:01.0: PCI bridge to [bus 06-2a]
[    0.407121] pci 0000:04:01.0:   bridge window [mem 0xe0100000-0xec0fffff]
[    0.407133] pci 0000:04:01.0:   bridge window [mem 0xb0000000-0xcbffffff 64bit pref]
[    0.407148] pci 0000:04:01.0: enabling Extended Tags
[    0.407242] pci 0000:04:01.0: supports D1 D2
[    0.407244] pci 0000:04:01.0: PME# supported from D0 D1 D2 D3hot D3cold
[    0.407419] pci 0000:04:02.0: [8086:15c0] type 01 class 0x060400 PCIe Switch Downstream Port
[    0.407449] pci 0000:04:02.0: PCI bridge to [bus 2b]
[    0.407458] pci 0000:04:02.0:   bridge window [mem 0xe0000000-0xe00fffff]
[    0.407483] pci 0000:04:02.0: enabling Extended Tags
[    0.407573] pci 0000:04:02.0: supports D1 D2
[    0.407575] pci 0000:04:02.0: PME# supported from D0 D1 D2 D3hot D3cold
[    0.407755] pci 0000:03:00.0: PCI bridge to [bus 04-2b]
[    0.407858] pci 0000:05:00.0: [8086:15bf] type 00 class 0x088000 PCIe Endpoint
[    0.407910] pci 0000:05:00.0: BAR 0 [mem 0xec100000-0xec13ffff]
[    0.407913] pci 0000:05:00.0: BAR 1 [mem 0xec140000-0xec140fff]
[    0.407930] pci 0000:05:00.0: enabling Extended Tags
[    0.408044] pci 0000:05:00.0: supports D1 D2
[    0.408046] pci 0000:05:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[    0.408237] pci 0000:04:00.0: PCI bridge to [bus 05]
[    0.408289] pci 0000:04:01.0: PCI bridge to [bus 06-2a]
[    0.408403] pci 0000:2b:00.0: [8086:15c1] type 00 class 0x0c0330 PCIe Endpoint
[    0.408463] pci 0000:2b:00.0: BAR 0 [mem 0xe0000000-0xe000ffff]
[    0.408483] pci 0000:2b:00.0: enabling Extended Tags
[    0.408607] pci 0000:2b:00.0: supports D1 D2
[    0.408609] pci 0000:2b:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[    0.408844] pci 0000:04:02.0: PCI bridge to [bus 2b]
[    0.408930] pci 0000:00:1d.0: PCI bridge to [bus 2d]
[    0.409245] pci 0000:2e:00.0: [c0a9:5426] type 00 class 0x010802 PCIe Endpoint
[    0.409334] pci 0000:2e:00.0: BAR 0 [mem 0xeeb00000-0xeeb03fff 64bit]
[    0.409791] pci 0000:2e:00.0: 31.504 Gb/s available PCIe bandwidth, limited by 8.0 GT/s PCIe x4 link at 0000:00:1d.4 (capable of 63.012 Gb/s with 16.0 GT/s PCIe x4 link)
[    0.410238] pci 0000:00:1d.4: PCI bridge to [bus 2e]
[    0.414174] ACPI: EC: interrupt unblocked
[    0.414177] ACPI: EC: event unblocked
[    0.414188] ACPI: EC: EC_CMD/EC_SC=0x66, EC_DATA=0x62
[    0.414191] ACPI: EC: GPE=0x16
[    0.414193] ACPI: \_SB_.PCI0.LPCB.EC__: Boot ECDT EC initialization complete
[    0.414195] ACPI: \_SB_.PCI0.LPCB.EC__: EC: Used to handle transactions and events
[    0.414267] iommu: Default domain type: Translated
[    0.414267] iommu: DMA domain TLB invalidation policy: lazy mode
[    0.414267] ACPI: bus type USB registered
[    0.414267] usbcore: registered new interface driver usbfs
[    0.414267] usbcore: registered new interface driver hub
[    0.414267] usbcore: registered new device driver usb
[    0.414267] pps_core: LinuxPPS API ver. 1 registered
[    0.414267] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    0.414267] PTP clock support registered
[    0.414267] EDAC MC: Ver: 3.0.0
[    0.414907] efivars: Registered efivars operations
[    0.415043] NetLabel: Initializing
[    0.415046] NetLabel:  domain hash size = 128
[    0.415047] NetLabel:  protocols = UNLABELED CIPSOv4 CALIPSO
[    0.415061] NetLabel:  unlabeled traffic allowed by default
[    0.415074] PCI: Using ACPI for IRQ routing
[    0.431067] PCI: pci_cache_line_size set to 64 bytes
[    0.431353] pci 0000:00:1f.5: BAR 0 [mem 0xfe010000-0xfe010fff]: can't claim; no compatible bridge window
[    0.431638] e820: register RAM buffer resource [mem 0x0009f000-0x0009ffff]
[    0.431641] e820: register RAM buffer resource [mem 0xa0503000-0xa3ffffff]
[    0.431643] e820: register RAM buffer resource [mem 0xa40b7000-0xa7ffffff]
[    0.431645] e820: register RAM buffer resource [mem 0xa9750000-0xabffffff]
[    0.431647] e820: register RAM buffer resource [mem 0x84c800000-0x84fffffff]
[    0.431669] pci 0000:00:02.0: vgaarb: setting as boot VGA device
[    0.431669] pci 0000:00:02.0: vgaarb: bridge control possible
[    0.431669] pci 0000:00:02.0: vgaarb: VGA device added: decodes=io+mem,owns=mem,locks=none
[    0.431669] vgaarb: loaded
[    0.432044] clocksource: Switched to clocksource tsc-early
[    0.432073] VFS: Disk quotas dquot_6.6.0
[    0.432086] VFS: Dquot-cache hash table entries: 512 (4096 bytes)
[    0.432180] AppArmor: AppArmor Filesystem Enabled
[    0.432298] acpi PNP0C02:00: Reserved [mem 0xfd000000-0xfd69ffff]
[    0.432302] acpi PNP0C02:00: Reserved [mem 0xfd6b0000-0xfd6cffff]
[    0.432305] acpi PNP0C02:00: Reserved [mem 0xfd6f0000-0xfdffffff]
[    0.432307] acpi PNP0C02:00: Reserved [mem 0xfe000000-0xfe01ffff]
[    0.432309] acpi PNP0C02:00: Reserved [mem 0xfe200000-0xfe7fffff]
[    0.432311] acpi PNP0C02:00: Reserved [mem 0xff000000-0xffffffff]
[    0.432313] acpi PNP0C02:00: Could not reserve [io  0x1800-0x18fe]
[    0.432520] acpi PNP0C02:01: Reserved [io  0x2000-0x20fe]
[    0.432527] acpi PNP0C02:02: Skipped [io  0x002e-0x002f]
[    0.432529] acpi PNP0C02:02: Skipped [io  0x004e-0x004f]
[    0.432531] acpi PNP0C02:02: Skipped [io  0x0061]
[    0.432533] acpi PNP0C02:02: Skipped [io  0x0063]
[    0.432534] acpi PNP0C02:02: Skipped [io  0x0065]
[    0.432536] acpi PNP0C02:02: Skipped [io  0x0067]
[    0.432538] acpi PNP0C02:02: Skipped [io  0x0070]
[    0.432539] acpi PNP0C02:02: Skipped [io  0x0080]
[    0.432541] acpi PNP0C02:02: Skipped [io  0x0092]
[    0.432543] acpi PNP0C02:02: Skipped [io  0x00b2-0x00b3]
[    0.432545] acpi PNP0C02:02: Reserved [io  0x0680-0x069f]
[    0.432547] acpi PNP0C02:02: Reserved [io  0x164e-0x164f]
[    0.432569] acpi PNP0C02:03: Skipped [io  0x0010-0x001f]
[    0.432571] acpi PNP0C02:03: Skipped [io  0x0090-0x009f]
[    0.432576] acpi PNP0C02:03: Skipped [io  0x0024-0x0025]
[    0.432579] acpi PNP0C02:03: Skipped [io  0x0028-0x0029]
[    0.432580] acpi PNP0C02:03: Skipped [io  0x002c-0x002d]
[    0.432582] acpi PNP0C02:03: Skipped [io  0x0030-0x0031]
[    0.432584] acpi PNP0C02:03: Skipped [io  0x0034-0x0035]
[    0.432586] acpi PNP0C02:03: Skipped [io  0x0038-0x0039]
[    0.432587] acpi PNP0C02:03: Skipped [io  0x003c-0x003d]
[    0.432589] acpi PNP0C02:03: Skipped [io  0x00a4-0x00a5]
[    0.432591] acpi PNP0C02:03: Skipped [io  0x00a8-0x00a9]
[    0.432593] acpi PNP0C02:03: Skipped [io  0x00ac-0x00ad]
[    0.432594] acpi PNP0C02:03: Skipped [io  0x00b0-0x00b5]
[    0.432596] acpi PNP0C02:03: Skipped [io  0x00b8-0x00b9]
[    0.432598] acpi PNP0C02:03: Skipped [io  0x00bc-0x00bd]
[    0.432600] acpi PNP0C02:03: Skipped [io  0x0050-0x0053]
[    0.432601] acpi PNP0C02:03: Skipped [io  0x0072-0x0077]
[    0.432603] acpi PNP0C02:03: Could not reserve [io  0x1800-0x189f]
[    0.432605] acpi PNP0C02:03: Reserved [io  0x0800-0x087f]
[    0.432607] acpi PNP0C02:03: Reserved [io  0x0880-0x08ff]
[    0.432609] acpi PNP0C02:03: Reserved [io  0x0900-0x097f]
[    0.432611] acpi PNP0C02:03: Reserved [io  0x0980-0x09ff]
[    0.432613] acpi PNP0C02:03: Reserved [io  0x0a00-0x0a7f]
[    0.432615] acpi PNP0C02:03: Reserved [io  0x0a80-0x0aff]
[    0.432617] acpi PNP0C02:03: Reserved [io  0x0b00-0x0b7f]
[    0.432619] acpi PNP0C02:03: Reserved [io  0x0b80-0x0bff]
[    0.432620] acpi PNP0C02:03: Reserved [io  0x15e0-0x15ef]
[    0.432622] acpi PNP0C02:03: Could not reserve [io  0x1600-0x167f]
[    0.432624] acpi PNP0C02:03: Could not reserve [io  0x1640-0x165f]
[    0.432627] acpi PNP0C02:03: Reserved [mem 0xf0000000-0xf7ffffff]
[    0.432629] acpi PNP0C02:03: Reserved [mem 0xfed10000-0xfed13fff]
[    0.432631] acpi PNP0C02:03: Reserved [mem 0xfed18000-0xfed18fff]
[    0.432633] acpi PNP0C02:03: Reserved [mem 0xfed19000-0xfed19fff]
[    0.432635] acpi PNP0C02:03: Reserved [mem 0xfeb00000-0xfebfffff]
[    0.432637] acpi PNP0C02:03: Reserved [mem 0xfed20000-0xfed3ffff]
[    0.432639] acpi PNP0C02:03: Could not reserve [mem 0xfed90000-0xfed93fff]
[    0.432702] acpi PNP0C02:04: Could not reserve [mem 0xfed10000-0xfed17fff]
[    0.432704] acpi PNP0C02:04: Reserved [mem 0xfed18000-0xfed18fff]
[    0.432706] acpi PNP0C02:04: Reserved [mem 0xfed19000-0xfed19fff]
[    0.432708] acpi PNP0C02:04: Reserved [mem 0xf0000000-0xf7ffffff]
[    0.432710] acpi PNP0C02:04: Reserved [mem 0xfed20000-0xfed3ffff]
[    0.432712] acpi PNP0C02:04: Could not reserve [mem 0xfed90000-0xfed93fff]
[    0.432714] acpi PNP0C02:04: Could not reserve [mem 0xfed45000-0xfed8ffff]
[    0.432716] acpi PNP0C02:04: Reserved [mem 0xfee00000-0xfeefffff]
[    0.432792] acpi PNP0C02:05: Reserved [mem 0xfe038000-0xfe038fff]
[    0.432870] acpi PNP0C01:00: Could not reserve [mem 0x00000000-0x0009ffff]
[    0.432872] acpi PNP0C01:00: Could not reserve [mem 0x000c0000-0x000c3fff]
[    0.432874] acpi PNP0C01:00: Could not reserve [mem 0x000c8000-0x000cbfff]
[    0.432876] acpi PNP0C01:00: Could not reserve [mem 0x000d0000-0x000d3fff]
[    0.432878] acpi PNP0C01:00: Could not reserve [mem 0x000d8000-0x000dbfff]
[    0.432880] acpi PNP0C01:00: Could not reserve [mem 0x000e0000-0x000e3fff]
[    0.432882] acpi PNP0C01:00: Could not reserve [mem 0x000e8000-0x000ebfff]
[    0.432883] acpi PNP0C01:00: Could not reserve [mem 0x000f0000-0x000fffff]
[    0.432885] acpi PNP0C01:00: Could not reserve [mem 0x00100000-0xaf7fffff]
[    0.432887] acpi PNP0C01:00: Could not reserve [mem 0xfec00000-0xfed3ffff]
[    0.432889] acpi PNP0C01:00: Could not reserve [mem 0xfed4c000-0xffffffff]
[    0.432899] pnp: PnP ACPI init
[    0.433865] pnp: PnP ACPI: found 2 devices
[    0.439279] clocksource: acpi_pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns
[    0.439332] NET: Registered PF_INET protocol family
[    0.439416] IP idents hash table entries: 262144 (order: 9, 2097152 bytes, linear)
[    0.441463] tcp_listen_portaddr_hash hash table entries: 16384 (order: 6, 262144 bytes, linear)
[    0.441492] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.441602] TCP established hash table entries: 262144 (order: 9, 2097152 bytes, linear)
[    0.441830] TCP bind hash table entries: 65536 (order: 9, 2097152 bytes, linear)
[    0.441986] TCP: Hash tables configured (established 262144 bind 65536)
[    0.442070] MPTCP token hash table entries: 32768 (order: 8, 786432 bytes, linear)
[    0.442166] UDP hash table entries: 16384 (order: 8, 1048576 bytes, linear)
[    0.442283] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.442616] NET: Registered PF_XDP protocol family
[    0.442632] pci 0000:04:01.0: bridge window [io  0x1000-0x0fff] to [bus 06-2a] add_size 1000
[    0.442639] pci 0000:03:00.0: bridge window [io  0x1000-0x0fff] to [bus 04-2b] add_size 1000
[    0.442642] pci 0000:00:1c.4: bridge window [io  0x1000-0x0fff] to [bus 03-2b] add_size 2000
[    0.442653] pci 0000:00:1c.4: bridge window [io  0x5000-0x6fff]: assigned
[    0.442656] pci 0000:00:1f.5: BAR 0 [mem 0xaf800000-0xaf800fff]: assigned
[    0.442669] pci 0000:00:1c.0: PCI bridge to [bus 02]
[    0.442673] pci 0000:00:1c.0:   bridge window [mem 0xef600000-0xef6fffff]
[    0.442695] pci 0000:03:00.0: bridge window [io  0x5000-0x5fff]: assigned
[    0.442697] pci 0000:04:01.0: bridge window [io  0x5000-0x5fff]: assigned
[    0.442699] pci 0000:04:00.0: PCI bridge to [bus 05]
[    0.442704] pci 0000:04:00.0:   bridge window [mem 0xec100000-0xec1fffff]
[    0.442713] pci 0000:04:01.0: PCI bridge to [bus 06-2a]
[    0.442716] pci 0000:04:01.0:   bridge window [io  0x5000-0x5fff]
[    0.442721] pci 0000:04:01.0:   bridge window [mem 0xe0100000-0xec0fffff]
[    0.442725] pci 0000:04:01.0:   bridge window [mem 0xb0000000-0xcbffffff 64bit pref]
[    0.442732] pci 0000:04:02.0: PCI bridge to [bus 2b]
[    0.442738] pci 0000:04:02.0:   bridge window [mem 0xe0000000-0xe00fffff]
[    0.442746] pci 0000:03:00.0: PCI bridge to [bus 04-2b]
[    0.442749] pci 0000:03:00.0:   bridge window [io  0x5000-0x5fff]
[    0.442754] pci 0000:03:00.0:   bridge window [mem 0xe0000000-0xec1fffff]
[    0.442758] pci 0000:03:00.0:   bridge window [mem 0xb0000000-0xcbffffff 64bit pref]
[    0.442764] pci 0000:00:1c.4: PCI bridge to [bus 03-2b]
[    0.442767] pci 0000:00:1c.4:   bridge window [io  0x5000-0x6fff]
[    0.442770] pci 0000:00:1c.4:   bridge window [mem 0xe0000000-0xec1fffff]
[    0.442773] pci 0000:00:1c.4:   bridge window [mem 0xb0000000-0xcbffffff 64bit pref]
[    0.442778] pci 0000:00:1d.0: PCI bridge to [bus 2d]
[    0.442783] pci 0000:00:1d.0:   bridge window [io  0x3000-0x3fff]
[    0.442787] pci 0000:00:1d.0:   bridge window [mem 0xeec00000-0xef5fffff]
[    0.442791] pci 0000:00:1d.0:   bridge window [mem 0xee000000-0xee9fffff 64bit pref]
[    0.442796] pci 0000:00:1d.4: PCI bridge to [bus 2e]
[    0.442803] pci 0000:00:1d.4:   bridge window [mem 0xeeb00000-0xeebfffff]
[    0.442810] pci_bus 0000:00: resource 4 [io  0x0000-0x0cf7 window]
[    0.442812] pci_bus 0000:00: resource 5 [io  0x0d00-0xffff window]
[    0.442814] pci_bus 0000:00: resource 6 [mem 0x000a0000-0x000bffff window]
[    0.442816] pci_bus 0000:00: resource 7 [mem 0xaf800000-0xefffffff window]
[    0.442818] pci_bus 0000:00: resource 8 [mem 0xfc800000-0xfdffffff window]
[    0.442823] pci_bus 0000:02: resource 1 [mem 0xef600000-0xef6fffff]
[    0.442825] pci_bus 0000:03: resource 0 [io  0x5000-0x6fff]
[    0.442827] pci_bus 0000:03: resource 1 [mem 0xe0000000-0xec1fffff]
[    0.442829] pci_bus 0000:03: resource 2 [mem 0xb0000000-0xcbffffff 64bit pref]
[    0.442831] pci_bus 0000:04: resource 0 [io  0x5000-0x5fff]
[    0.442833] pci_bus 0000:04: resource 1 [mem 0xe0000000-0xec1fffff]
[    0.442835] pci_bus 0000:04: resource 2 [mem 0xb0000000-0xcbffffff 64bit pref]
[    0.442837] pci_bus 0000:05: resource 1 [mem 0xec100000-0xec1fffff]
[    0.442839] pci_bus 0000:06: resource 0 [io  0x5000-0x5fff]
[    0.442841] pci_bus 0000:06: resource 1 [mem 0xe0100000-0xec0fffff]
[    0.442843] pci_bus 0000:06: resource 2 [mem 0xb0000000-0xcbffffff 64bit pref]
[    0.442845] pci_bus 0000:2b: resource 1 [mem 0xe0000000-0xe00fffff]
[    0.442847] pci_bus 0000:2d: resource 0 [io  0x3000-0x3fff]
[    0.442849] pci_bus 0000:2d: resource 1 [mem 0xeec00000-0xef5fffff]
[    0.442850] pci_bus 0000:2d: resource 2 [mem 0xee000000-0xee9fffff 64bit pref]
[    0.442853] pci_bus 0000:2e: resource 1 [mem 0xeeb00000-0xeebfffff]
[    0.443711] PCI: CLS 0 bytes, default 64
[    0.443764] DMAR: Intel-IOMMU force enabled due to platform opt in
[    0.443774] DMAR: No ATSR found
[    0.443775] DMAR: No SATC found
[    0.443777] DMAR: dmar0: Using Queued invalidation
[    0.443780] DMAR: dmar1: Using Queued invalidation
[    0.443872] Unpacking initramfs...
[    0.444346] pci 0000:00:02.0: Adding to iommu group 0
[    0.444385] pci 0000:00:00.0: Adding to iommu group 1
[    0.444394] pci 0000:00:04.0: Adding to iommu group 2
[    0.444402] pci 0000:00:08.0: Adding to iommu group 3
[    0.444412] pci 0000:00:12.0: Adding to iommu group 4
[    0.444425] pci 0000:00:14.0: Adding to iommu group 5
[    0.444432] pci 0000:00:14.2: Adding to iommu group 5
[    0.444439] pci 0000:00:14.3: Adding to iommu group 6
[    0.444452] pci 0000:00:16.0: Adding to iommu group 7
[    0.444460] pci 0000:00:16.3: Adding to iommu group 7
[    0.444471] pci 0000:00:1c.0: Adding to iommu group 8
[    0.444481] pci 0000:00:1c.4: Adding to iommu group 9
[    0.444501] pci 0000:00:1d.0: Adding to iommu group 10
[    0.444572] pci 0000:00:1d.4: Adding to iommu group 11
[    0.444594] pci 0000:00:1f.0: Adding to iommu group 12
[    0.444603] pci 0000:00:1f.3: Adding to iommu group 12
[    0.444611] pci 0000:00:1f.4: Adding to iommu group 12
[    0.444632] pci 0000:00:1f.5: Adding to iommu group 12
[    0.444640] pci 0000:00:1f.6: Adding to iommu group 12
[    0.444648] pci 0000:02:00.0: Adding to iommu group 13
[    0.444665] pci 0000:03:00.0: Adding to iommu group 14
[    0.444681] pci 0000:04:00.0: Adding to iommu group 15
[    0.444692] pci 0000:04:01.0: Adding to iommu group 16
[    0.444703] pci 0000:04:02.0: Adding to iommu group 17
[    0.444708] pci 0000:05:00.0: Adding to iommu group 15
[    0.444712] pci 0000:2b:00.0: Adding to iommu group 17
[    0.444724] pci 0000:2e:00.0: Adding to iommu group 18
[    0.444882] DMAR: Intel(R) Virtualization Technology for Directed I/O
[    0.444884] PCI-DMA: Using software bounce buffering for IO (SWIOTLB)
[    0.444886] software IO TLB: mapped [mem 0x000000009b291000-0x000000009f291000] (64MB)
[    0.445387] Initialise system trusted keyrings
[    0.445441] Key type blacklist registered
[    0.445615] workingset: timestamp_bits=36 (anon: 31) max_order=23 bucket_order=0 (anon: 0)
[    0.445799] fuse: init (API version 7.45)
[    0.445977] integrity: Platform Keyring initialized
[    0.445982] integrity: Machine keyring initialized
[    0.454445] Key type asymmetric registered
[    0.454452] Asymmetric key parser 'x509' registered
[    0.454550] alg: full crypto tests enabled.  This is intended for developer use only.
[    0.458166] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 245)
[    0.458331] io scheduler mq-deadline registered
[    0.462451] ledtrig-cpu: registered to indicate activity on CPUs
[    0.462687] pcieport 0000:00:1c.0: PME: Signaling with IRQ 123
[    0.462819] pcieport 0000:00:1c.4: PME: Signaling with IRQ 124
[    0.462841] pcieport 0000:00:1c.4: pciehp: Slot #4 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+
[    0.463145] pcieport 0000:00:1d.0: PME: Signaling with IRQ 125
[    0.463174] pcieport 0000:00:1d.0: pciehp: Slot #0 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+
[    0.463540] pcieport 0000:00:1d.4: PME: Signaling with IRQ 126
[    0.463959] pcieport 0000:04:01.0: pciehp: Slot #1 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+
[    0.469249] acpi LNXTHERM:00: registered as thermal_zone0
[    0.469254] ACPI: thermal: Thermal Zone [THM0] (47 C)
[    0.469428] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
[    0.470226] serial 0000:00:16.3: enabling device (0001 -> 0003)
[    0.470863] 0000:00:16.3: ttyS0 at I/O 0x4060 (irq = 19, base_baud = 115200) is a 16550A
[    0.471102] hpet_acpi_probe: no address or irqs in _CRS
[    0.473238] tpm_tis STM0125:00: 2.0 TPM (vendor-id 0x104A, device-id 0x0, rev-id 78)
[    0.573897] Freeing initrd memory: 48376K
[    0.694449] UEFI TPM log area empty
[    0.697048] ACPI: bus type drm_connector registered
[    0.704670] i8042: PNP: PS/2 Controller [PNP0303:KBD,PNP0f13:MOU] at 0x60,0x64 irq 1,12
[    0.712704] serio: i8042 KBD port at 0x60,0x64 irq 1
[    0.712730] serio: i8042 AUX port at 0x60,0x64 irq 12
[    0.712896] mousedev: PS/2 mouse device common for all mice
[    0.712949] rtc_cmos PNP0B00:00: RTC can wake from S4
[    0.714260] rtc_cmos PNP0B00:00: registered as rtc0
[    0.714572] rtc_cmos PNP0B00:00: setting system clock to 2026-06-26T20:11:06 UTC (1782504666)
[    0.714638] rtc_cmos PNP0B00:00: alarms up to one month, y3k, 242 bytes nvram
[    0.715274] intel_pstate: Intel P-state driver initializing
[    0.715702] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input0
[    0.715879] intel_pstate: HWP enabled
[    0.716291] simple-framebuffer simple-framebuffer.0: [drm] Registered 1 planes with drm panic
[    0.716338] [drm] Initialized simpledrm 1.0.0 for simple-framebuffer.0 on minor 0
[    0.721868] Console: switching to colour frame buffer device 240x67
[    0.724702] simple-framebuffer simple-framebuffer.0: [drm] fb0: simpledrmdrmfb frame buffer device
[    0.725135] NET: Registered PF_INET6 protocol family
[    0.725739] Segment Routing with IPv6
[    0.725762] In-situ OAM (IOAM) with IPv6
[    0.725789] mip6: Mobile IPv6
[    0.725798] NET: Registered PF_PACKET protocol family
[    0.725918] mpls_gso: MPLS GSO support
[    0.726609] ENERGY_PERF_BIAS: Set to 'normal', was 'performance'
[    0.726883] microcode: Current revision: 0x00000100
[    0.727292] IPI shorthand broadcast: enabled
[    0.728491] sched_clock: Marking stable (719001105, 9486458)->(782349974, -53862411)
[    0.728888] registered taskstats version 1
[    0.728936] Loading compiled-in X.509 certificates
[    0.763542] Loaded X.509 cert 'Build time autogenerated kernel key: 9d0a22ebf69e94394359820e3dc224cdddc631d6'
[    0.767014] Demotion targets for Node 0: null
[    0.767103] Key type .fscrypt registered
[    0.767123] Key type fscrypt-provisioning registered
[    0.795565] Key type encrypted registered
[    0.795582] AppArmor: AppArmor sha256 policy hashing enabled
[    0.797439] ima: Allocated hash algorithm: sha256
[    0.872153] ima: No architecture policies found
[    0.872228] evm: Initialising EVM extended attributes:
[    0.872243] evm: security.selinux
[    0.872254] evm: security.SMACK64 (disabled)
[    0.872266] evm: security.SMACK64EXEC (disabled)
[    0.872278] evm: security.SMACK64TRANSMUTE (disabled)
[    0.872292] evm: security.SMACK64MMAP (disabled)
[    0.872304] evm: security.apparmor
[    0.872314] evm: security.ima
[    0.872323] evm: security.capability
[    0.872347] evm: HMAC attrs: 0x1
[    0.873388] integrity: Loading X.509 certificate: UEFI:db
[    0.873550] integrity: Loaded X.509 cert 'Lenovo Ltd.: ThinkPad Product CA 2012: 838b1f54c1550463f45f98700640f11069265949'
[    0.873581] integrity: Loading X.509 certificate: UEFI:db
[    0.873636] integrity: Loaded X.509 cert 'Lenovo UEFI CA 2014: 4b91a68732eaefdd2c8ffffc6b027ec3449e9c8f'
[    0.873661] integrity: Loading X.509 certificate: UEFI:db
[    0.873737] integrity: Loaded X.509 cert 'Microsoft Corporation UEFI CA 2011: 13adbf4309bd82709c8cd54f316ed522988a1bd4'
[    0.873763] integrity: Loading X.509 certificate: UEFI:db
[    0.873817] integrity: Loaded X.509 cert 'Microsoft Windows Production PCA 2011: a92902398e16c49778cd90f99e4f9ae17c55af53'
[    0.873843] integrity: Loading X.509 certificate: UEFI:db
[    0.873895] integrity: Loaded X.509 cert 'Microsoft Corporation: Windows UEFI CA 2023: aefc5fbbbe055d8f8daa585473499417ab5a5272'
[    0.873922] integrity: Loading X.509 certificate: UEFI:db
[    0.874741] integrity: Loaded X.509 cert 'Microsoft UEFI CA 2023: 81aa6b3244c935bce0d6628af39827421e32497d'
[    0.875473] integrity: Loading X.509 certificate: UEFI:db
[    0.876652] integrity: Loaded X.509 cert 'Microsoft Option ROM UEFI CA 2023: 514fbf937fa46fb57bf07af8bed84b3b864b1711'
[    0.893478] alg: No test for mldsa87 (mldsa87-lib)
[    0.895121] alg: No test for mldsa65 (mldsa65-lib)
[    0.896428] alg: No test for mldsa44 (mldsa44-lib)
[    0.910307] RAS: Correctable Errors collector initialized.
[    0.911518] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[    0.933936] Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[    0.934339] Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600'
[    0.934625] clk: Disabling unused clocks
[    0.937103] Freeing unused decrypted memory: 2028K
[    0.938876] Freeing unused kernel image (initmem) memory: 4296K
[    0.939211] Write protecting the kernel read-only data: 28672k
[    0.941158] Freeing unused kernel image (text/rodata gap) memory: 2024K
[    0.941492] Freeing unused kernel image (rodata/data gap) memory: 72K
[    0.952352] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[    0.953604] Run /init as init process
[    0.953821]   with arguments:
[    0.953822]     /init
[    0.953823]   with environment:
[    0.953824]     HOME=/
[    0.953824]     TERM=linux
[    1.110583] i801_smbus 0000:00:1f.4: SPD Write Disable is set
[    1.111147] i801_smbus 0000:00:1f.4: SMBus using PCI interrupt
[    1.115069] i2c i2c-0: Successfully instantiated SPD at 0x51
[    1.117967] rtsx_pci 0000:02:00.0: enabling device (0000 -> 0002)
[    1.137546] e1000e: Intel(R) PRO/1000 Network Driver
[    1.139322] e1000e: Copyright(c) 1999 - 2015 Intel Corporation.
[    1.141479] e1000e 0000:00:1f.6: Interrupt Throttling Rate (ints/sec) set to dynamic conservative mode
[    1.148393] ACPI: bus type thunderbolt registered
[    1.149415] thunderbolt 0000:05:00.0: enabling device (0000 -> 0002)
[    1.151079] xhci_hcd 0000:00:14.0: xHCI Host Controller
[    1.151697] xhci_hcd 0000:00:14.0: new USB bus registered, assigned bus number 1
[    1.153310] xhci_hcd 0000:00:14.0: hcc params 0x200077c1 hci version 0x110 quirks 0x0000000000009810
[    1.154294] xhci_hcd 0000:00:14.0: xHCI Host Controller
[    1.154876] xhci_hcd 0000:00:14.0: new USB bus registered, assigned bus number 2
[    1.155429] xhci_hcd 0000:00:14.0: Host supports USB 3.1 Enhanced SuperSpeed
[    1.156020] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.01
[    1.156519] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    1.157017] usb usb1: Product: xHCI Host Controller
[    1.157510] usb usb1: Manufacturer: Linux 7.1.0-t14test202606+ xhci-hcd
[    1.158017] usb usb1: SerialNumber: 0000:00:14.0
[    1.158752] hub 1-0:1.0: USB hub found
[    1.159346] hub 1-0:1.0: 12 ports detected
[    1.160043] iTCO_wdt iTCO_wdt: Found a Intel PCH TCO device (Version=6, TCOBASE=0x0400)
[    1.160657] iTCO_wdt iTCO_wdt: initialized. heartbeat=30 sec (nowayout=0)
[    1.161942] usb usb2: New USB device found, idVendor=1d6b, idProduct=0003, bcdDevice= 7.01
[    1.162460] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    1.162920] usb usb2: Product: xHCI Host Controller
[    1.163303] usb usb2: Manufacturer: Linux 7.1.0-t14test202606+ xhci-hcd
[    1.163682] usb usb2: SerialNumber: 0000:00:14.0
[    1.164221] hub 2-0:1.0: USB hub found
[    1.164700] hub 2-0:1.0: 6 ports detected
[    1.165455] nvme nvme0: pci function 0000:2e:00.0
[    1.167030] xhci_hcd 0000:2b:00.0: xHCI Host Controller
[    1.167431] xhci_hcd 0000:2b:00.0: new USB bus registered, assigned bus number 3
[    1.168935] xhci_hcd 0000:2b:00.0: hcc params 0x200077c1 hci version 0x110 quirks 0x0000000200009810
[    1.169766] xhci_hcd 0000:2b:00.0: xHCI Host Controller
[    1.170280] xhci_hcd 0000:2b:00.0: new USB bus registered, assigned bus number 4
[    1.170767] xhci_hcd 0000:2b:00.0: Host supports USB 3.1 Enhanced SuperSpeed
[    1.171308] usb usb3: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.01
[    1.171801] usb usb3: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    1.172269] usb usb3: Product: xHCI Host Controller
[    1.172736] usb usb3: Manufacturer: Linux 7.1.0-t14test202606+ xhci-hcd
[    1.173154] usb usb3: SerialNumber: 0000:2b:00.0
[    1.173826] hub 3-0:1.0: USB hub found
[    1.174268] hub 3-0:1.0: 2 ports detected
[    1.176482] usb usb4: New USB device found, idVendor=1d6b, idProduct=0003, bcdDevice= 7.01
[    1.177719] usb usb4: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    1.178052] usb usb4: Product: xHCI Host Controller
[    1.178349] usb usb4: Manufacturer: Linux 7.1.0-t14test202606+ xhci-hcd
[    1.178624] usb usb4: SerialNumber: 0000:2b:00.0
[    1.179092] hub 4-0:1.0: USB hub found
[    1.179367] hub 4-0:1.0: 2 ports detected
[    1.188444] nvme nvme0: passthrough uses implicit buffer lengths
[    1.193905] nvme nvme0: allocated 64 MiB host memory buffer (16 segments).
[    1.212535] nvme nvme0: 8/0/0 default/read/poll queues
[    1.216953] e1000e 0000:00:1f.6 0000:00:1f.6 (uninitialized): registered PHC clock
[    1.217771]  nvme0n1: p1 p2 p3 p4
[    1.280184] e1000e 0000:00:1f.6 eth0: (PCI Express:2.5GT/s:Width x1) 8c:8c:aa:54:44:f3
[    1.280593] e1000e 0000:00:1f.6 eth0: Intel(R) PRO/1000 Network Connection
[    1.281273] e1000e 0000:00:1f.6 eth0: MAC: 13, PHY: 12, PBA No: FFFFFF-0FF
[    1.283150] e1000e 0000:00:1f.6 enp0s31f6: renamed from eth0
[    1.400552] usb 1-6: new full-speed USB device number 2 using xhci_hcd
[    1.473624] typec port0: bound usb1-port2 (ops connector_ops)
[    1.474090] typec port0: bound usb2-port2 (ops connector_ops)
[    1.496520] tsc: Refined TSC clocksource calibration: 2208.000 MHz
[    1.496806] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x1fd3b81b95f, max_idle_ns: 440795257325 ns
[    1.497901] clocksource: Switched to clocksource tsc
[    1.527807] usb 1-6: New USB device found, idVendor=04f3, idProduct=289b, bcdDevice=57.13
[    1.528065] usb 1-6: New USB device strings: Mfr=4, Product=14, SerialNumber=0
[    1.528276] usb 1-6: Product: Touchscreen
[    1.528495] usb 1-6: Manufacturer: ELAN
[    1.641531] usb 1-8: new high-speed USB device number 3 using xhci_hcd
[    1.777020] usb 1-8: New USB device found, idVendor=04ca, idProduct=7070, bcdDevice= 0.25
[    1.777337] usb 1-8: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[    1.777619] usb 1-8: Product: Integrated Camera
[    1.777864] usb 1-8: Manufacturer: 8SSC20F27068V1SR0B5D74K
[    1.891533] usb 1-10: new full-speed USB device number 4 using xhci_hcd
[    1.941540] psmouse serio1: synaptics: queried max coordinates: x [..5678], y [..4694]
[    1.944499] hid: raw HID events driver (C) Jiri Kosina
[    1.944929] i915 0000:00:02.0: enabling device (0006 -> 0007)
[    1.948085] i915 0000:00:02.0: [drm] Found cometlake/ult (device ID 9b41) integrated display version 9.00 stepping N/A
[    1.949999] i915 0000:00:02.0: [drm] VT-d active for gfx access
[    1.967154] usbcore: registered new interface driver usbhid
[    1.967498] usbhid: USB HID core driver
[    1.969666] Console: switching to colour dummy device 80x25
[    1.972136] i915 0000:00:02.0: vgaarb: deactivate vga console
[    1.972178] i915 0000:00:02.0: [drm] Using Transparent Hugepages
[    1.975748] psmouse serio1: synaptics: queried min coordinates: x [1266..], y [1162..]
[    1.975757] psmouse serio1: synaptics: Trying to set up SMBus access
[    1.976208] input: ELAN Touchscreen as /devices/pci0000:00/0000:00:14.0/usb1/1-6/1-6:1.0/0003:04F3:289B.0001/input/input3
[    1.976254] input: ELAN Touchscreen as /devices/pci0000:00/0000:00:14.0/usb1/1-6/1-6:1.0/0003:04F3:289B.0001/input/input4
[    1.976269] input: ELAN Touchscreen as /devices/pci0000:00/0000:00:14.0/usb1/1-6/1-6:1.0/0003:04F3:289B.0001/input/input5
[    1.976322] hid-generic 0003:04F3:289B.0001: input,hiddev0,hidraw0: USB HID v1.10 Device [ELAN Touchscreen] on usb-0000:00:14.0-6/input0
[    1.978139] i915 0000:00:02.0: [drm] Finished loading DMC firmware i915/kbl_dmc_ver1_04.bin (v1.4)
[    1.990264] input: ELAN Touchscreen as /devices/pci0000:00/0000:00:14.0/usb1/1-6/1-6:1.0/0003:04F3:289B.0001/input/input7
[    1.990305] input: ELAN Touchscreen UNKNOWN as /devices/pci0000:00/0000:00:14.0/usb1/1-6/1-6:1.0/0003:04F3:289B.0001/input/input8
[    1.990323] input: ELAN Touchscreen UNKNOWN as /devices/pci0000:00/0000:00:14.0/usb1/1-6/1-6:1.0/0003:04F3:289B.0001/input/input9
[    1.990367] hid-multitouch 0003:04F3:289B.0001: input,hiddev0,hidraw0: USB HID v1.10 Device [ELAN Touchscreen] on usb-0000:00:14.0-6/input0
[    2.013193] i915 0000:00:02.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io:owns=mem
[    2.018225] usb 1-10: New USB device found, idVendor=8087, idProduct=0026, bcdDevice= 0.02
[    2.018231] usb 1-10: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[    2.022490] i915 0000:00:02.0: [drm] Registered 3 planes with drm panic
[    2.038675] [drm] Initialized i915 1.6.0 for 0000:00:02.0 on minor 1
[    2.052111] ACPI: video: Video Device [GFX0] (multi-head: yes  rom: no  post: no)
[    2.052228] input: Video Bus as /devices/pci0000:00/acpi.video_bus.0/input/input11
[    2.129278] fbcon: i915drmfb (fb0) is primary device
[    2.138433] Console: switching to colour frame buffer device 240x67
[    2.172873] i915 0000:00:02.0: [drm] fb0: i915drmfb frame buffer device
[    2.233591] xor: automatically using best checksumming function   avx
[    2.247124] raid6: using avx2x2 recovery algorithm
[    2.263485] raid6: avx2x1   gen() 21316 MB/s
[    2.280483] raid6: avx2x2   gen() 28552 MB/s
[    2.297484] raid6: avx2x4   gen() 30858 MB/s
[    2.298056] raid6: using algorithm avx2x4 gen() 30858 MB/s
[    2.314485] raid6: .... xor() 14170 MB/s, rmw enabled
[    2.317646] async_tx: api initialized (async)
[    2.383117] load module synosnap failed, abort cbt reloading
[    2.384824] typec port1: bound usb1-port5 (ops connector_ops)
[    2.384841] typec port1: bound usb4-port1 (ops connector_ops)
[    2.761349] Btrfs loaded, zoned=yes, fsverity=yes
[    2.782968] PM: Image not found (code -22)
[    3.489336] SGI XFS with ACLs, security attributes, realtime, scrub, repair, quota, no debug enabled
[    3.493426] XFS (nvme0n1p3): Mounting V5 Filesystem acabe8be-6dd5-4d04-a138-22fdf9a0b015
[    3.503384] XFS (nvme0n1p3): Ending clean mount
[    3.535852] Not activating Mandatory Access Control as /sbin/tomoyo-init does not exist.
[    3.626513] systemd[1]: Inserted module 'autofs4'
[    3.650609] systemd[1]: systemd 257.13-1~deb13u1 running in system mode (+PAM +AUDIT +SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK +BTF -XKBCOMMON -UTMP +SYSVINIT +LIBARCHIVE)
[    3.652750] systemd[1]: Detected architecture x86-64.
[    3.657356] systemd[1]: Hostname set to <t14>.
[    3.733520] systemd[1]: bpf-restrict-fs: Failed to load BPF object: No such process
[    3.755528] systemd-sysv-generator[372]: SysV service '/etc/init.d/uml-utilities' lacks a native systemd unit file, automatically generating a unit file for compatibility.
[    3.755928] systemd-sysv-generator[372]: Please update package to include a native systemd unit file.
[    3.756317] systemd-sysv-generator[372]: ! This compatibility logic is deprecated, expect removal soon. !
[    3.832456] systemd[1]: /etc/systemd/system/synology-active-backup-business-linux-service.service:6: PIDFile= references a path below legacy directory /var/run/, updating /var/run/synology-backupd.pid → /run/synology-backupd.pid; please update the unit file accordingly.
[    3.919633] systemd[1]: Queued start job for default target graphical.target.
[    3.927175] systemd[1]: Created slice machine.slice - Virtual Machine and Container Slice.
[    3.928582] systemd[1]: Created slice system-getty.slice - Slice /system/getty.
[    3.929985] systemd[1]: Created slice system-modprobe.slice - Slice /system/modprobe.
[    3.931085] systemd[1]: Created slice system-systemd\x2dfsck.slice - Slice /system/systemd-fsck.
[    3.932350] systemd[1]: Created slice system-xfs_scrub.slice - xfs_scrub background service slice.
[    3.933168] systemd[1]: Created slice user.slice - User and Session Slice.
[    3.934064] systemd[1]: Started systemd-ask-password-wall.path - Forward Password Requests to Wall Directory Watch.
[    3.934800] systemd[1]: Set up automount proc-sys-fs-binfmt_misc.automount - Arbitrary Executable File Formats File System Automount Point.
[    3.935831] systemd[1]: Expecting device dev-disk-by\x2dlabel-boot.device - /dev/disk/by-label/boot...
[    3.936971] systemd[1]: Expecting device dev-disk-by\x2dpartuuid-942cfd1f\x2d5513\x2d4bfb\x2d9850\x2dae56cf0e0eb4.device - /dev/disk/by-partuuid/942cfd1f-5513-4bfb-9850-ae56cf0e0eb4...
[    3.938168] systemd[1]: Expecting device dev-disk-by\x2duuid-45595b04\x2d0bed\x2d47c6\x2d9a8d\x2d7cad4e58007d.device - /dev/disk/by-uuid/45595b04-0bed-47c6-9a8d-7cad4e58007d...
[    3.939398] systemd[1]: Reached target integritysetup.target - Local Integrity Protected Volumes.
[    3.940661] systemd[1]: Reached target nss-user-lookup.target - User and Group Name Lookups.
[    3.941909] systemd[1]: Reached target slices.target - Slice Units.
[    3.943199] systemd[1]: Reached target veritysetup.target - Local Verity Protected Volumes.
[    3.944453] systemd[1]: Reached target virt-guest-shutdown.target - libvirt guests shutdown target.
[    3.945803] systemd[1]: Listening on dm-event.socket - Device-mapper event daemon FIFOs.
[    3.947125] systemd[1]: Listening on lvm2-lvmpolld.socket - LVM2 poll daemon socket.
[    3.949758] systemd[1]: Listening on systemd-creds.socket - Credential Encryption/Decryption.
[    3.951083] systemd[1]: Listening on systemd-initctl.socket - initctl Compatibility Named Pipe.
[    3.952435] systemd[1]: Listening on systemd-journald-dev-log.socket - Journal Socket (/dev/log).
[    3.953759] systemd[1]: Listening on systemd-journald.socket - Journal Sockets.
[    3.955004] systemd[1]: systemd-pcrextend.socket - TPM PCR Measurements skipped, unmet condition check ConditionSecurity=measured-uki
[    3.955018] systemd[1]: systemd-pcrlock.socket - Make TPM PCR Policy skipped, unmet condition check ConditionSecurity=measured-uki
[    3.955092] systemd[1]: Listening on systemd-udevd-control.socket - udev Control Socket.
[    3.957528] systemd[1]: Listening on systemd-udevd-kernel.socket - udev Kernel Socket.
[    3.959687] systemd[1]: Mounting dev-hugepages.mount - Huge Pages File System...
[    3.961192] systemd[1]: Mounting dev-mqueue.mount - POSIX Message Queue File System...
[    3.963037] systemd[1]: Mounting run-lock.mount - Legacy Locks Directory /run/lock...
[    3.964890] systemd[1]: Mounting sys-kernel-debug.mount - Kernel Debug File System...
[    3.973272] systemd[1]: Mounting sys-kernel-tracing.mount - Kernel Trace File System...
[    3.975813] systemd[1]: Starting keyboard-setup.service - Set the console keyboard layout...
[    3.977321] systemd[1]: Starting kmod-static-nodes.service - Create List of Static Device Nodes...
[    3.979019] systemd[1]: Starting lvm2-monitor.service - Monitoring of LVM2 mirrors, snapshots etc. using dmeventd or progress polling...
[    3.980842] systemd[1]: Starting modprobe@configfs.service - Load Kernel Module configfs...
[    3.983057] systemd[1]: Starting modprobe@drm.service - Load Kernel Module drm...
[    3.984905] systemd[1]: Starting modprobe@efi_pstore.service - Load Kernel Module efi_pstore...
[    3.986871] systemd[1]: Starting modprobe@fuse.service - Load Kernel Module fuse...
[    3.989450] systemd[1]: Starting modprobe@nvme_fabrics.service - Load Kernel Module nvme_fabrics...
[    3.990696] systemd[1]: systemd-hibernate-clear.service - Clear Stale Hibernate Storage Info skipped, unmet condition check ConditionPathExists=/sys/firmware/efi/efivars/HibernateLocation-8cf2644b-4b0b-428f-9387-6d876050dc67
[    3.992871] systemd[1]: Starting systemd-journald.service - Journal Service...
[    3.995397] systemd[1]: Starting systemd-modules-load.service - Load Kernel Modules...
[    3.996258] systemd[1]: systemd-pcrmachine.service - TPM PCR Machine ID Measurement skipped, unmet condition check ConditionSecurity=measured-uki
[    3.997397] systemd[1]: Starting systemd-remount-fs.service - Remount Root and Kernel File Systems...
[    3.998705] systemd[1]: systemd-tpm2-setup-early.service - Early TPM SRK Setup skipped, unmet condition check ConditionSecurity=measured-uki
[    3.998766] pstore: Using crash dump compression: deflate
[    4.001844] systemd[1]: Starting systemd-udev-load-credentials.service - Load udev Rules from Credentials...
[    4.023713] systemd[1]: Starting systemd-udev-trigger.service - Coldplug All udev Devices...
[    4.025057] pstore: Registered efi_pstore as persistent store backend
[    4.028776] systemd[1]: Mounted dev-hugepages.mount - Huge Pages File System.
[    4.029601] systemd[1]: Mounted dev-mqueue.mount - POSIX Message Queue File System.
[    4.030270] systemd[1]: Mounted run-lock.mount - Legacy Locks Directory /run/lock.
[    4.032155] systemd[1]: Mounted sys-kernel-debug.mount - Kernel Debug File System.
[    4.033252] systemd[1]: Mounted sys-kernel-tracing.mount - Kernel Trace File System.
[    4.035722] systemd[1]: Finished kmod-static-nodes.service - Create List of Static Device Nodes.
[    4.036922] systemd[1]: modprobe@configfs.service: Deactivated successfully.
[    4.037121] systemd[1]: Finished modprobe@configfs.service - Load Kernel Module configfs.
[    4.038593] systemd[1]: modprobe@drm.service: Deactivated successfully.
[    4.038780] systemd[1]: Finished modprobe@drm.service - Load Kernel Module drm.
[    4.040274] systemd[1]: modprobe@efi_pstore.service: Deactivated successfully.
[    4.040461] systemd[1]: Finished modprobe@efi_pstore.service - Load Kernel Module efi_pstore.
[    4.041816] systemd[1]: modprobe@fuse.service: Deactivated successfully.
[    4.042003] systemd[1]: Finished modprobe@fuse.service - Load Kernel Module fuse.
[    4.043066] systemd-journald[394]: Collecting audit messages is disabled.
[    4.044230] systemd[1]: modprobe@nvme_fabrics.service: Deactivated successfully.
[    4.044403] systemd[1]: Finished modprobe@nvme_fabrics.service - Load Kernel Module nvme_fabrics.
[    4.045847] systemd[1]: Finished systemd-remount-fs.service - Remount Root and Kernel File Systems.
[    4.047028] systemd[1]: Finished systemd-udev-load-credentials.service - Load udev Rules from Credentials.
[    4.048434] device-mapper: core: CONFIG_IMA_DISABLE_HTABLE is disabled. Duplicate IMA measurements will not be recorded in the IMA log.
[    4.048491] device-mapper: uevent: version 1.0.3
[    4.048581] device-mapper: ioctl: 4.50.0-ioctl (2025-04-28) initialised: dm-devel@lists.linux.dev
[    4.049372] systemd[1]: Mounting sys-fs-fuse-connections.mount - FUSE Control File System...
[    4.051916] systemd[1]: Mounting sys-kernel-config.mount - Kernel Configuration File System...
[    4.053025] lp: driver loaded but no devices found
[    4.054039] systemd[1]: systemd-hwdb-update.service - Rebuild Hardware Database skipped, unmet condition check ConditionNeedsUpdate=/etc
[    4.054096] systemd[1]: systemd-pstore.service - Platform Persistent Storage Archival skipped, unmet condition check ConditionDirectoryNotEmpty=/sys/fs/pstore
[    4.055109] systemd[1]: Starting systemd-random-seed.service - Load/Save OS Random Seed...
[    4.060212] ppdev: user-space parallel port driver
[    4.067671] systemd[1]: Starting systemd-tmpfiles-setup-dev-early.service - Create Static Device Nodes in /dev gracefully...
[    4.068547] systemd[1]: systemd-tpm2-setup.service - TPM SRK Setup skipped, unmet condition check ConditionSecurity=measured-uki
[    4.069374] systemd[1]: Mounted sys-fs-fuse-connections.mount - FUSE Control File System.
[    4.070737] systemd[1]: Mounted sys-kernel-config.mount - Kernel Configuration File System.
[    4.073402] systemd[1]: Finished systemd-random-seed.service - Load/Save OS Random Seed.
[    4.075553] systemd[1]: Finished lvm2-monitor.service - Monitoring of LVM2 mirrors, snapshots etc. using dmeventd or progress polling.
[    4.078023] systemd[1]: Finished keyboard-setup.service - Set the console keyboard layout.
[    4.081069] systemd[1]: Finished systemd-modules-load.service - Load Kernel Modules.
[    4.082686] systemd[1]: Starting systemd-sysctl.service - Apply Kernel Variables...
[    4.093817] systemd[1]: Finished systemd-tmpfiles-setup-dev-early.service - Create Static Device Nodes in /dev gracefully.
[    4.094379] systemd[1]: systemd-sysusers.service - Create System Users skipped, no trigger condition checks were met.
[    4.095746] systemd[1]: Starting systemd-timesyncd.service - Network Time Synchronization...
[    4.097227] systemd[1]: Starting systemd-tmpfiles-setup-dev.service - Create Static Device Nodes in /dev...
[    4.101936] systemd[1]: Finished systemd-sysctl.service - Apply Kernel Variables.
[    4.108206] systemd[1]: Finished systemd-tmpfiles-setup-dev.service - Create Static Device Nodes in /dev.
[    4.110394] systemd[1]: Starting systemd-udevd.service - Rule-based Manager for Device Events and Files...
[    4.121077] systemd[1]: Started systemd-journald.service - Journal Service.
[    4.148264] systemd-journald[394]: Received client request to flush runtime journal.
[    4.283840] intel_pch_thermal 0000:00:12.0: enabling device (0000 -> 0002)
[    4.295584] input: Sleep Button as /devices/platform/PNP0C0E:00/input/input12
[    4.303789] ACPI: button: Sleep Button [SLPB]
[    4.312243] input: Lid Switch as /devices/platform/PNP0C0D:00/input/input13
[    4.317792] ACPI: button: Lid Switch [LID]
[    4.323396] input: Power Button as /devices/platform/LNXPWRBN:00/input/input14
[    4.329212] ACPI: button: Power Button [PWRF]
[    4.341395] ACPI: AC: AC Adapter [AC] (on-line)
[    4.372793] mc: Linux media interface: v0.10
[    4.373197] Adding 25165820k swap on /dev/nvme0n1p2.  Priority:-1 extents:1 across:25165820k SS
[    4.389083] iwlwifi 0000:00:14.3: enabling device (0000 -> 0002)
[    4.390182] ACPI: battery: Slot [BAT0] (battery present)
[    4.415882] iwlwifi 0000:00:14.3: Detected crf-id 0x3617, cnv-id 0x20000302 wfpm id 0x80000000
[    4.416671] iwlwifi 0000:00:14.3: PCI dev 02f0/0070, rev=0x351, rfid=0x10a100
[    4.417413] iwlwifi 0000:00:14.3: Detected Intel(R) Wi-Fi 6 AX201 160MHz
[    4.419911] Non-volatile memory driver v1.3
[    4.427613] iwlwifi 0000:00:14.3: loaded firmware version 77.2753b721.0 QuZ-a0-hr-b0-77.ucode op_mode iwlmvm
[    4.430242] mei_me 0000:00:16.0: enabling device (0000 -> 0002)
[    4.432288] ee1004 0-0051: 512 byte EE1004-compliant SPD EEPROM, read-only
[    4.448909] videodev: Linux video capture interface: v2.00
[    4.451023] rmi4_smbus 0-002c: registering SMbus-connected sensor
[    4.462323] thinkpad_acpi: ThinkPad ACPI Extras v0.26
[    4.462768] thinkpad_acpi: http://ibm-acpi.sf.net/
[    4.463194] thinkpad_acpi: ThinkPad BIOS N2XET45W (1.35 ), EC N2XHT27W
[    4.464055] thinkpad_acpi: Lenovo ThinkPad T14 Gen 1, model 20S1S6D700
[    4.464150] input: PC Speaker as /devices/platform/pcspkr/input/input15
[    4.481084] thinkpad_acpi: radio switch found; radios are enabled
[    4.482268] thinkpad_acpi: This ThinkPad has standard ACPI backlight brightness control, supported by the ACPI video driver
[    4.483770] thinkpad_acpi: Disabling thinkpad-acpi brightness events by default...
[    4.498986] thinkpad_acpi: rfkill switch tpacpi_bluetooth_sw: radio is unblocked
[    4.511475] Bluetooth: Core ver 2.22
[    4.512189] NET: Registered PF_BLUETOOTH protocol family
[    4.512851] Bluetooth: HCI device and connection manager initialized
[    4.513546] Bluetooth: HCI socket layer initialized
[    4.514190] Bluetooth: L2CAP socket layer initialized
[    4.514196] Bluetooth: SCO socket layer initialized
[    4.526797] resource: resource sanity check: requesting [mem 0x00000000fed10000-0x00000000fed15fff], which spans more than PNP0C02:03 [mem 0xfed10000-0xfed13fff]
[    4.527481] caller snb_uncore_imc_init_box+0x86/0xe0 [intel_uncore] mapping multiple BARs
[    4.541616] thinkpad_acpi: battery 1 registered (start 0, stop 100, behaviours: 0xb)
[    4.542198] ACPI: battery: new hook: ThinkPad Battery Extension
[    4.555306] proc_thermal 0000:00:04.0: enabling device (0000 -> 0002)
[    4.562967] RAPL PMU: API unit is 2^-32 Joules, 5 fixed counters, 655360 ms ovfl timer
[    4.562971] RAPL PMU: hw unit of domain pp0-core 2^-14 Joules
[    4.562972] RAPL PMU: hw unit of domain package 2^-14 Joules
[    4.562973] RAPL PMU: hw unit of domain dram 2^-14 Joules
[    4.562974] RAPL PMU: hw unit of domain pp1-gpu 2^-14 Joules
[    4.562975] RAPL PMU: hw unit of domain psys 2^-14 Joules
[    4.566621] input: ThinkPad Extra Buttons as /devices/platform/thinkpad_acpi/input/input16
[    4.573058] intel_rapl_common: Found RAPL domain package
[    4.573061] intel_rapl_common: Found RAPL domain dram
[    4.581077] rmi4_f01 rmi4-00.fn01: found RMI device, manufacturer: Synaptics, product: TM3471-020, fw id: 3972349
[    4.587908] usbcore: registered new interface driver btusb
[    4.588832] Bluetooth: hci0: Bootloader revision 0.4 build 0 week 30 2018
[    4.589837] Bluetooth: hci0: Device revision is 2
[    4.589839] Bluetooth: hci0: Secure boot is enabled
[    4.589839] Bluetooth: hci0: OTP lock is enabled
[    4.589840] Bluetooth: hci0: API lock is enabled
[    4.589840] Bluetooth: hci0: Debug lock is disabled
[    4.589841] Bluetooth: hci0: Minimum firmware build 1 week 10 2014
[    4.592010] rmi_read_register_desc: starting read at addr 0x0054
[    4.593382] rmi_read_register_desc: size_presence_reg = 4
[    4.596851] Bluetooth: hci0: Found device firmware: intel/ibt-19-0-4.sfi
[    4.596961] Bluetooth: hci0: Boot Address: 0x24800
[    4.596963] Bluetooth: hci0: Firmware Version: 132-3.24
[    4.596999] rmi_read_register_desc: presence reg: 2b ff 27 00
[    4.597001] rmi_read_register_desc: advanced addr to 0x0059 (after skipping presence reg)
[    4.597002] rmi_read_register_desc: struct_size = 43
[    4.597004] rmi_read_register_desc: num_registers = 12
[    4.597006] rmi_read_register_desc: reading struct_buf from addr 0x0059, size 43
[    4.612001] rmi_struct: 00000000: 0f 1f 14 87 12 13 2f 19 c9 03 07 83 02 43 80 1f
[    4.612005] rmi_struct: 00000010: 01 02 04 05 03 07 01 01 04 01 06 0e 36 82 00 00
[    4.612006] rmi_struct: 00000020: 00 00 00 00 00 00 00 00 00 00 00
[    4.612008] rmi_read_register_desc: parsed item 0: reg: 0 reg size: 15 subpackets: 5
[    4.612010] rmi_read_register_desc: parsed item 1: reg: 1 reg size: 20 subpackets: 5
[    4.612011] rmi_read_register_desc: parsed item 2: reg: 2 reg size: 19 subpackets: 5
[    4.612013] rmi_read_register_desc: parsed item 3: reg: 3 reg size: 25 subpackets: 5
[    4.612014] rmi_read_register_desc: parsed item 4: reg: 4 reg size: 7 subpackets: 3
[    4.612016] rmi_read_register_desc: parsed item 5: reg: 5 reg size: 67 subpackets: 5
[    4.612017] rmi_read_register_desc: parsed item 6: reg: 6 reg size: 1 subpackets: 1
[    4.612019] rmi_read_register_desc: parsed item 7: reg: 7 reg size: 4 subpackets: 2
[    4.612020] rmi_read_register_desc: parsed item 8: reg: 8 reg size: 3 subpackets: 3
[    4.612022] rmi_read_register_desc: parsed item 9: reg: 9 reg size: 1 subpackets: 1
[    4.612023] rmi_read_register_desc: parsed item 10: reg: 10 reg size: 4 subpackets: 1
[    4.612025] rmi_read_register_desc: parsed item 11: reg: 13 reg size: 6 subpackets: 3
[    4.612026] rmi_read_register_desc: starting read at addr 0x0057
[    4.612959] uvcvideo 1-8:1.0: Found UVC 1.00 device Integrated Camera (04ca:7070)
[    4.615098] rmi_read_register_desc: size_presence_reg = 12
[    4.644133] mei_hdcp 0000:00:16.0-b638ab7e-94e2-4ea2-a552-d1c54b627f04: bound 0000:00:02.0 (ops i915_hdcp_ops [i915])
[    4.647549] alg: skcipher: skipping comparison tests for xctr-aes-aesni-avx because xctr(aes-lib) is unavailable
[    4.648550] rmi_read_register_desc: presence reg: 1a 00 8f d8 10 00 00 00 01 00 00 00
[    4.648676] iwlwifi 0000:00:14.3: Detected RF HR B3, rfid=0x10a100
[    4.649043] rmi_read_register_desc: advanced addr to 0x0064 (after skipping presence reg)
[    4.649293] usbcore: registered new interface driver uvcvideo
[    4.653182] rmi_read_register_desc: struct_size = 26
[    4.653185] rmi_read_register_desc: num_registers = 11
[    4.653187] rmi_read_register_desc: reading struct_buf from addr 0x0064, size 26
[    4.657334] rmi_struct: 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[    4.657338] rmi_struct: 00000010: 00 00 00 00 00 00 00 00 00 00
[    4.657340] rmi_read_register_desc: parsed item 0: reg: 8 reg size: 0 subpackets: 0
[    4.657342] rmi_read_register_desc: parsed item 1: reg: 9 reg size: 0 subpackets: 0
[    4.657343] rmi_read_register_desc: parsed item 2: reg: 10 reg size: 0 subpackets: 0
[    4.657345] rmi_parse_register_desc_item: error: size - offset < 2 (2 - 1 < 2)
[    4.657348] rmi4_f12 rmi4-00.fn12: Failed to read the Control Register Descriptor: -5
[    4.657351] rmi4_f12 rmi4-00.fn12: probe with driver rmi4_f12 failed with error -5
[    4.711325] input: Synaptics TM3471-020 as /devices/pci0000:00/0000:00:1f.4/i2c-0/0-002c/rmi4-00/input/input17
[    4.717767] iwlwifi 0000:00:14.3: base HW address: 40:1c:83:ca:fa:8a
[    4.718914] serio: RMI4 PS/2 pass-through port at rmi4-00.fn03
[    4.771194] iwlwifi 0000:00:14.3 wlp0s20f3: renamed from wlan0
[    4.837386] snd_hda_intel 0000:00:1f.3: enabling device (0004 -> 0006)
[    4.838552] snd_hda_intel 0000:00:1f.3: bound 0000:00:02.0 (ops intel_audio_component_bind_ops [i915])
[    4.852045] psmouse serio2: trackpoint: Elan TrackPoint firmware: 0x11, buttons: 3/3
[    4.860752] intel_pmc_core intel_pmc_core.0:  initialized
[    4.876139] intel_rapl_common: Found RAPL domain package
[    4.876808] intel_rapl_common: Found RAPL domain core
[    4.877279] intel_rapl_common: Found RAPL domain uncore
[    4.877749] intel_rapl_common: Found RAPL domain dram
[    4.878193] intel_rapl_common: Found RAPL domain psys
[    4.888947] input: TPPS/2 Elan TrackPoint as /devices/pci0000:00/0000:00:1f.4/i2c-0/0-002c/rmi4-00/rmi4-00.fn03/serio2/input/input18
[    4.891762] snd_hda_codec_alc269 hdaudioC0D0: ALC257: picked fixup  for PCI SSID 17aa:0000
[    4.892508] snd_hda_codec_alc269 hdaudioC0D0: autoconfig for ALC257: line_outs=1 (0x14/0x0/0x0/0x0/0x0) type:speaker
[    4.892510] snd_hda_codec_alc269 hdaudioC0D0:    speaker_outs=0 (0x0/0x0/0x0/0x0/0x0)
[    4.892511] snd_hda_codec_alc269 hdaudioC0D0:    hp_outs=1 (0x21/0x0/0x0/0x0/0x0)
[    4.892512] snd_hda_codec_alc269 hdaudioC0D0:    mono: mono_out=0x0
[    4.892513] snd_hda_codec_alc269 hdaudioC0D0:    inputs:
[    4.892514] snd_hda_codec_alc269 hdaudioC0D0:      Mic=0x19
[    4.946186] input: HDA Digital PCBeep as /devices/pci0000:00/0000:00:1f.3/sound/card0/input19
[    4.947633] input: HDA Intel PCH Mic as /devices/pci0000:00/0000:00:1f.3/sound/card0/input20
[    4.947704] input: HDA Intel PCH Headphone as /devices/pci0000:00/0000:00:1f.3/sound/card0/input21
[    4.947763] input: HDA Intel PCH HDMI/DP,pcm=3 as /devices/pci0000:00/0000:00:1f.3/sound/card0/input22
[    4.947835] input: HDA Intel PCH HDMI/DP,pcm=7 as /devices/pci0000:00/0000:00:1f.3/sound/card0/input23
[    4.948003] input: HDA Intel PCH HDMI/DP,pcm=8 as /devices/pci0000:00/0000:00:1f.3/sound/card0/input24
[    5.039175] XFS (nvme0n1p4): Mounting V5 Filesystem 900b5e70-35d0-4fdc-9f3f-a87f11b47fa9
[    5.044692] XFS (nvme0n1p4): Ending clean mount
[    5.111917] audit: type=1400 audit(1782504670.896:2): apparmor="STATUS" operation="profile_load" profile="unconfined" name="buildah" pid=800 comm="apparmor_parser"
[    5.113671] audit: type=1400 audit(1782504670.896:3): apparmor="STATUS" operation="profile_load" profile="unconfined" name="Discord" pid=793 comm="apparmor_parser"
[    5.115571] audit: type=1400 audit(1782504670.896:4): apparmor="STATUS" operation="profile_load" profile="unconfined" name="brave" pid=799 comm="apparmor_parser"
[    5.115574] audit: type=1400 audit(1782504670.896:5): apparmor="STATUS" operation="profile_load" profile="unconfined" name="balena-etcher" pid=798 comm="apparmor_parser"
[    5.115576] audit: type=1400 audit(1782504670.896:6): apparmor="STATUS" operation="profile_load" profile="unconfined" name="1password" pid=792 comm="apparmor_parser"
[    5.115577] audit: type=1400 audit(1782504670.896:7): apparmor="STATUS" operation="profile_load" profile="unconfined" name=4D6F6E676F444220436F6D70617373 pid=795 comm="apparmor_parser"
[    5.115580] audit: type=1400 audit(1782504670.898:8): apparmor="STATUS" operation="profile_load" profile="unconfined" name="QtWebEngineProcess" pid=796 comm="apparmor_parser"
[    5.115581] audit: type=1400 audit(1782504670.899:9): apparmor="STATUS" operation="profile_load" profile="unconfined" name="ch-checkns" pid=805 comm="apparmor_parser"
[    5.115583] audit: type=1400 audit(1782504670.899:10): apparmor="STATUS" operation="profile_load" profile="unconfined" name="cam" pid=804 comm="apparmor_parser"
[    5.202800] kauditd_printk_skb: 115 callbacks suppressed
[    5.202803] audit: type=1400 audit(1782504670.987:126): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/bin/papers" pid=888 comm="apparmor_parser"
[    5.205354] audit: type=1400 audit(1782504670.987:127): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/bin/papers//sanitized_helper" pid=888 comm="apparmor_parser"
[    5.205357] audit: type=1400 audit(1782504670.987:128): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/bin/papers//snap_browsers" pid=888 comm="apparmor_parser"
[    5.205358] audit: type=1400 audit(1782504670.987:129): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/bin/papers-previewer" pid=888 comm="apparmor_parser"
[    5.205360] audit: type=1400 audit(1782504670.987:130): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/bin/papers-previewer//sanitized_helper" pid=888 comm="apparmor_parser"
[    5.205362] audit: type=1400 audit(1782504670.987:131): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/bin/papers-thumbnailer" pid=888 comm="apparmor_parser"
[    5.215774] audit: type=1400 audit(1782504671.000:132): apparmor="STATUS" operation="profile_load" profile="unconfined" name="libreoffice-soffice" pid=893 comm="apparmor_parser"
[    5.215777] audit: type=1400 audit(1782504671.000:133): apparmor="STATUS" operation="profile_load" profile="unconfined" name="libreoffice-soffice//gpg" pid=893 comm="apparmor_parser"
[    5.221647] audit: type=1400 audit(1782504671.006:134): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/bin/evince" pid=886 comm="apparmor_parser"
[    5.221650] audit: type=1400 audit(1782504671.006:135): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/bin/evince//sanitized_helper" pid=886 comm="apparmor_parser"
[    5.408037] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[    5.408675] Bluetooth: BNEP filters: protocol multicast
[    5.409281] Bluetooth: BNEP socket layer initialized
[    5.486683] block nvme0n1: No UUID available providing old NGUID
[    5.558146] NET: Registered PF_QIPCRTR protocol family
[    6.300224] Bluetooth: hci0: Waiting for firmware download to complete
[    6.301809] Bluetooth: hci0: Firmware loaded in 1664994 usecs
[    6.301840] Bluetooth: hci0: Waiting for device to boot
[    6.316023] Bluetooth: hci0: Device booted in 13862 usecs
[    6.317816] Bluetooth: hci0: Found Intel DDC parameters: intel/ibt-19-0-4.ddc
[    6.319977] Bluetooth: hci0: Applying Intel DDC parameters completed
[    6.320877] Bluetooth: hci0: Firmware revision 0.4 build 132 week 3 2024
[    6.324006] Bluetooth: hci0: HCI LE Coded PHY feature bit is set, but its usage is not supported.
[    6.389690] Bluetooth: MGMT ver 1.23
[    6.415900] NET: Registered PF_ALG protocol family
[    6.489360] Bluetooth: RFCOMM TTY layer initialized
[    6.490317] Bluetooth: RFCOMM socket layer initialized
[    6.490856] Bluetooth: RFCOMM ver 1.11
[    9.259257] e1000e 0000:00:1f.6 enp0s31f6: NIC Link is Up 1000 Mbps Full Duplex, Flow Control: Rx/Tx
[   11.331382] rfkill: input handler disabled
[   23.047109] rfkill: input handler enabled
[   24.176902] rfkill: input handler disabled
[   25.743455] SCSI subsystem initialized

-- 
-Barry K. Nathan  <barryn@pobox.com>