| Age | Commit message (Collapse) | Author |
|---|
|
This driver converts information from ACPI in x86 based tablets and
laptops into platform_data for the gpio_keys driver, using the obsolete
gpio number based interfaces.
This should really be converted to some other method, but since the
conversion is nontrivial, have this one select GPIOLIB_LEGACY for the
time being.
This enables turning GPIOLIB_LEGACY off by default on most kernel
builds. Since the driver is only used on x86 portables, add a CONFIG_X86
dependency, which means non-x86 allmodconfig builds usuallly build
without the legacy gpio support.
Link: https://lore.kernel.org/all/ah-1z9LhVG0wtfBw@google.com/
Acked-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> # for input
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
trace_user_fault_read() samples nr_context_switches_cpu() before enabling
preemption and retries the user copy if the counter changes. The helper
returns unsigned long long because rq->nr_switches is u64, but the saved
value is unsigned int.
Once a CPU has performed 2^32 context switches, assigning the counter to
cnt discards its upper bits. The comparison after the copy promotes cnt
back to unsigned long long, but the lost bits remain zero, so it reports a
change even when the task was never scheduled out. Every retry then fails
the same way until the 100-try guard warns and the user copy is abandoned.
This affects long-running systems and workloads with high context-switch
rates. A CPU switching 1,000 times per second takes about 50 days.
Store the sampled count in unsigned long long so the full value is
preserved.
Cc: stable@vger.kernel.org
Fixes: 64cf7d058a00 ("tracing: Have trace_marker use per-cpu data to read user space")
Link: https://patch.msgid.link/20260717173252.3431565-1-usama.arif@linux.dev
Reported-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Usama Arif <usama.arif@linux.dev>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Reviewed-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
|
|
When running instance tests, 'ftracetest' creates a new ftrace instance
and runs the tests inside it. Before starting each test, it executes
'initialize_system()' to reset the ftrace state to initial-state.
However, since 'initialize_system()' is executed in the context of the
instance directory, it only cleans up triggers and filters of that
instance.
Any triggers or dynamic events left behind in the top-level instance by
previous failed top-level tests, are left completely untouched. These
top-level leftovers can cause subsequent instance-based tests to fail
or even crash the kernel.
Fix this by executing 'initialize_system()' in the top-level tracing
directory once before entering the instance loop.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/178425671889.84440.9477850701738666404.stgit@devnote2
Fixes: b5b77be812de ("selftests: ftrace: Allow some tests to be run in a tracing instance")
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
|
|
In 'struct trace_event_call', the 'module' pointer and the 'refcnt'
atomic variable share the same memory space in a union. For dynamic
events, the union member is 'refcnt', which acts as an active
reference counter.
When a dynamic event (such as kprobe, uprobe, fprobe, eprobe, or
wprobe) has a non-zero reference count (e.g. due to active event
triggers or perf attachments), its 'call->module' evaluates to a
small non-zero integer instead of NULL.
When filtering or setting events for a specific module (e.g., writing
':mod:<module>' to 'set_event'), the code in
'__ftrace_set_clr_event_nolock()' and 'update_event_fields()' reads
'call->module' directly without checking whether the event is dynamic.
This causes the kernel to treat the small integer (refcnt) as a
'struct module' pointer, leading to a NULL/invalid pointer dereference
(Oops) when dereferencing the module name.
Fix this by ensuring that the 'TRACE_EVENT_FL_DYNAMIC' flag is checked
before treating 'call->module' as a valid pointer in these code paths.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/178425670947.84440.11344393611899824907.stgit@devnote2
Fixes: 4c86bc531e60 ("tracing: Add :mod: command to enabled module events")
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
|
|
If the mmio_pipe_open() fails to find a PCI device, the hiter->dev
will be assigned to NULL. The mmiotrace read() function dereferences the
hiter->dev if hiter exists.
Change the test of the read to not only check hiter being NULL, but also
the hiter->dev before dereferencing it.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260721211143.36dbd559@gandalf.local.home
Fixes: f984b51e0779 ("ftrace: add mmiotrace plugin")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260715143604.14481-1-gaikwad.dcg%40gmail.com
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
|
|
cxl_test support for type2
cxl/test: Rework cxl_type2_mem_init() to use cxl_mock_platform_device_add()
cxl/test: Add cxl_test accelerator driver
cxl/test: Fixup hdm init for auto region to support type2
cxl/test: Propagate -ENOMEM on platform_device_alloc() failures
cxl/test: Add hierarchy enumeration support for type2 device
cxl/test: Refactor platform device enumerations
cxl/test: Add type2 support for mock CFMWS0
cxl/test: Add test for module parameters
|
|
* soc/arm:
ARM: sa1100: h3xxx: convert gpio-keys to use software nodes
ARM: sa1100: collie: convert gpio-keys to use software nodes
ARM: sa1100: assabet: convert gpio-keys to use software nodes
gpio: sa1100: register software node for GPIO controller
|
|
Remaining cxl/core type2 support
cxl: Support dpa without a mailbox
cxl: Support Type2 cxl regs mapping
|
|
Convert the legacy gpio-keys platform device on the StrongARM SA-1100
HP iPAQ H3xxx series boards to use software nodes and device properties.
This helps progress the removal of platform data support from the
gpio-keys driver.
Define static software nodes for the gpio-keys device and the power and
action button child nodes at file scope, referencing the SA-1100 GPIO
controller node directly. In h3xxx_mach_init(), register the software node
group and use platform_device_register_full() to register the device.
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20260706-sa1100-swnode-v1-4-332759bbd930@gmail.com
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
Convert the legacy gpio-keys platform device on the StrongARM SA-1100
Collie (Sharp Zaurus SL-5500) board to use software nodes and device
properties. This helps progress the removal of platform data support
from the gpio-keys driver.
Define static software nodes for the gpio-keys device and the power and
sync button child nodes at file scope, referencing the SA-1100 GPIO
controller node directly and specifying EV_PWR input type. In
collie_init(), register the software node group and use
platform_device_register_full() to register the gpio-keys device.
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20260706-sa1100-swnode-v1-3-332759bbd930@gmail.com
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
Convert the legacy gpio-keys platform device on the StrongARM SA-1100
Assabet evaluation board to use software nodes and device properties.
This allows describing the buttons and their GPIO bindings via software
nodes so that platform data support can eventually be removed from the
gpio-keys driver.
Define static software nodes for the gpio-keys device and the two button
child nodes at file scope, referencing the SA-1100 GPIO controller node
directly. In assabet_init(), register the software node group and use
platform_device_register_full() to register the gpio-keys device.
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20260706-sa1100-swnode-v1-2-332759bbd930@gmail.com
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
Define and register a static software node (sa1100_gpiochip_node) for the
SA-1100 GPIO controller during sa1100_init_gpio(). Assign its firmware node
directly to the GPIO chip prior to calling gpiochip_add_data().
This allows StrongARM SA-1100 board setup files to reference the SoC GPIO
controller in property entries when converting legacy platform data to
software nodes, resolving pin bindings directly via the attached firmware
node without relying on name matching.
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20260706-sa1100-swnode-v1-1-332759bbd930@gmail.com
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
The RAW mailbox command path allows user to issue arbitrary opcodes
to the device. The FWCTL interface was introduced to support the
CXL Features commands where access control is provided depends on
what the CEL indicates.
Add the Features commands to cxl_disabled_raw_commands[] to ensure
that all Features commands are only accessible through the FWCTL
interface.
The cxl_raw_allow_all debugfs override knob bypasses the disabled list
if the user is aware of the risks and wants to use the RAW path for
Features commands.
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20260715155126.1629178-1-dave.jiang@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
|
|
Next batch of driver fixes
Signed-off-by: Nishanth Menon <nm@ti.com>
|
|
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_irq() automatically logs
detailed error messages on failure. Remove the now-redundant
driver-specific dev_err() calls.
Signed-off-by: Pan Chuang <panchuang@vivo.com>
Reviewed-by: Hari Prasath Gujulan Elango <gehariprasath@ti.com>
Link: https://patch.msgid.link/20260720095920.542801-7-panchuang@vivo.com
Signed-off-by: Nishanth Menon <nm@ti.com>
|
|
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
* soc/defconfig:
riscv: defconfig: thead: enable PCA953X GPIO driver
|
|
* soc/drivers: (26 commits)
soc: ixp4xx: Remove redundant dev_err()
soc: ixp4xx: npe: add missing MODULE_DEVICE_TABLE()
soc: ixp4xx: qmgr: add missing MODULE_DEVICE_TABLE()
firmware: arm_scmi: Unrequest devices if driver registration fails
firmware: arm_scmi: Roll back partial protocol table registration
firmware: arm_scmi: Fix requested device removal race
soc: renesas: r8a78000: Drop duplicate "default ARCH_RENESAS"
firmware: arm_scmi: Fix transport device teardown lookup
firmware: arm_scmi: Fix SCMI device destroy lifetimes
firmware: arm_scmi: Unwind P2A receiver mailbox setup failure
firmware: arm_scmi: Unwind TX receiver mailbox setup failure
firmware: arm_scmi: Fix OF node reference handling
firmware: arm_scmi: Clear SystemPower flag on create failure
firmware: arm_scmi: Drop handle on protocol bind failures
firmware: arm_scmi: Protect device request lookup with RCU
firmware: arm_scmi: Use channel ID for transport teardown
firmware: arm_scmi: Reject out of range DT protocol IDs
firmware: arm_scmi: Avoid IDR updates while cleaning channels
firmware: arm_scmi: Free transport channel on IDR failure
firmware: arm_scmi: Clean up channels on setup failure
...
|
|
* soc/arm:
ARM: ixp4xx: Relax endianness
ARM: shmobile: rcar-gen2: Use of_machine_compatible_match() helper
|
|
* soc/dt:
ARM: dts: ixp4xx: Drop the reg-offset hack
riscv: dts: canaan: Add clock definition for K230
riscv: dts: canaan: add reset controller for K230
riscv: dts: canaan: k230: Add "b" ISA extension
riscv: dts: canaan: Add k230's pinctrl node
riscv: dts: canaan: Correct the formatting issues about k230 dts
riscv: dts: add initial canmv-k230 and k230-evb dts
dt-bindings: interrupt-controller: Add Canaan K230 PLIC
dt-bindings: timer: Add Canaan K230 CLINT
dt-bindings: add Canaan K230 boards compatible strings
|
|
* arm/fixes: (468 commits)
arm64: dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer
Linux 7.2-rc4
Revert "drm/amd/display: Restore 5s vbl offdelay for NV3x+ DGPUs"
drm/amd/display: check GRPH_FLIP status before sending event
drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock
drm/amd: Create a device link between APU display and XHCI devices
drm/amd/display: wire DCN42B mcache programming callback
drm/amd/display: set new_stream to NULL after release
drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05
drm/amdkfd: free MQD managers on DQM init failures
drm/amdgpu/ttm: Consider concurrent VM flushes for buffer entities
drm/amd/pm/smu7: Fix AC/DC switch notification
drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge
drm/amdgpu: always emit the job vm fence
drm/amd/pm/si: Fix AC/DC switch notification
drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized
drm/amd/display: dce100: skip non-DP stream encoders for DP MST
drm/amd/display: Set native cursor mode for disabled CRTCs
drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)
drm/amd/display: fix __udivdi3 link error
...
|
|
* arm/fixes: (468 commits)
arm64: dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer
Linux 7.2-rc4
Revert "drm/amd/display: Restore 5s vbl offdelay for NV3x+ DGPUs"
drm/amd/display: check GRPH_FLIP status before sending event
drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock
drm/amd: Create a device link between APU display and XHCI devices
drm/amd/display: wire DCN42B mcache programming callback
drm/amd/display: set new_stream to NULL after release
drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05
drm/amdkfd: free MQD managers on DQM init failures
drm/amdgpu/ttm: Consider concurrent VM flushes for buffer entities
drm/amd/pm/smu7: Fix AC/DC switch notification
drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge
drm/amdgpu: always emit the job vm fence
drm/amd/pm/si: Fix AC/DC switch notification
drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized
drm/amd/display: dce100: skip non-DP stream encoders for DP MST
drm/amd/display: Set native cursor mode for disabled CRTCs
drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)
drm/amd/display: fix __udivdi3 link error
...
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/dt
RISC-V devicetrees for v7.3 - early k230 material
Canaan:
Support for the k230 SoC that was too late for the 7.2 window.
Consists of some bindings not taken by the various subsystem
maintainers, the original dts patches from Yangyu back in 2024
and the more recent clock, reset and pinctrl additions from various
contributors.
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
* tag 'riscv-dt-for-v7.3-early-k230' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux:
riscv: dts: canaan: Add clock definition for K230
riscv: dts: canaan: add reset controller for K230
riscv: dts: canaan: k230: Add "b" ISA extension
riscv: dts: canaan: Add k230's pinctrl node
riscv: dts: canaan: Correct the formatting issues about k230 dts
riscv: dts: add initial canmv-k230 and k230-evb dts
dt-bindings: interrupt-controller: Add Canaan K230 PLIC
dt-bindings: timer: Add Canaan K230 CLINT
dt-bindings: add Canaan K230 boards compatible strings
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
PALC_DSM_FN_TRIGGER_PLDR was defined as BIT(1) (value 2).
acpi_evaluate_dsm() expects a 0-based function index integer (0, 1,
2, ...), whereas acpi_check_dsm() expects a bitmask of supported
function indices (BIT(1), BIT(2), ...).
Because PALC_DSM_FN_TRIGGER_PLDR was defined as BIT(1),
acpi_evaluate_dsm() was evaluating Function Index 2 instead of Function
Index 1, while acpi_check_dsm() was checking for Function Index 1
support.
Fix this by setting PALC_DSM_FN_TRIGGER_PLDR to 1 (the function index)
and passing BIT(PALC_DSM_FN_TRIGGER_PLDR) to acpi_check_dsm().
Fixes: 1ab843135a77 ("platform/x86: dell-dw5826e: Add reset driver for DW5826e")
Signed-off-by: Surendra Singh Chouhan <kr494167@gmail.com>
Link: https://patch.msgid.link/20260724125533.74751-1-kr494167@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux into soc/defconfig
RISC-V defconfig changes for 7.3
Enable PCA953X GPIO driver to properly probe Wifi pwrseq driver on
the Sipeed Lichee Pi 4a board which is based on the T-HEAD TH1520 SoC.
* tag 'riscv-config-for-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux:
riscv: defconfig: thead: enable PCA953X GPIO driver
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
https://github.com/Broadcom/stblinux into arm/fixes
This pull request contains Broadcom ARM64-based SoCs Device Tree fixes
for 7.2, please pull the following:
- Daniel removes the non-functional EL2 timer interrupt which is not
connected on 2712
* tag 'arm-soc/for-7.2/devicetree-arm64-fixes' of https://github.com/Broadcom/stblinux:
arm64: dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
Before this change the HSMP data plane runs without any coordination with
driver teardown: open /dev/hsmp fds and hwmon sysfs reads call
hsmp_send_message() while probe and remove bring sockets up and down.
misc_deregister() does not drain already-open fds, so an in-flight message
can race a concurrent unbind and touch a freed socket array or an unmapped
mailbox.
Add the read side of hsmp_sock_rwsem to the data plane. Split the message
send into hsmp_send_message_locked(), which does the bounds check and MMIO
access and asserts the rwsem is held, and hsmp_send_message(), which wraps
it in guard(rwsem_read). Probe and remove hold the rwsem for write, so they
drain in-flight messages and keep new ones out while they tear a socket
down.
The probe-time senders run under the probe write lock and so must not take
the rwsem again: route hsmp_test(), hsmp_cache_proto_ver() and
hsmp_get_tbl_dram_base() through hsmp_send_message_locked() to avoid
recursive locking. A single rwsem therefore covers both the data plane and
the probe/remove handshake, with no separate probe lock:
- acpi.c already holds it for write across probe for the socket-array and
misc-registration handshake, so the mailbox handshake now nests under
that same lock.
- plat.c takes it for write around init_platform_device(). It is not held
across devm_add_action_or_reset() so the release action, which also
takes it for write, cannot deadlock if that registration fails.
Signed-off-by: Muralidhara M K <muralidhara.mk@amd.com>
Link: https://patch.msgid.link/20260723094656.3806028-7-muralidhara.mk@amd.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
The ACPI driver binds one platform device per socket but shares a single
socket array and a single /dev/hsmp misc device across them. Replace the
is_probed flag with state that tracks this shared ownership:
- miscdevice.this_device tells whether /dev/hsmp is registered, so the
misc device is registered on the first socket and torn down last. A
preceding change clears mdev.this_device on deregister so this gate
stays reliable across a re-probe.
- a kref tracks the sockets that share the array. The first probe
initializes it, each further probe takes a reference and every remove
(or probe failure) drops one; the last put runs the release callback.
All get/put happen under hsmp_sock_rwsem held for write, so the counting
is already serialized and kref's atomic is not strictly needed, but kref
gives the clearer get/put interface and a release callback. The shared
socket array is allocated with kcalloc() on the first probe and freed by
the release callback once the last reference is dropped.
hsmp_acpi_sock_release() is the single teardown helper, run from
kref_put(): it deregisters /dev/hsmp if registered, unmaps any
metric-table DRAM, destroys the per-socket mutexes and frees the array.
The remove path and the probe-failure path both reach it through the last
put, so the teardown lives in one place.
Both paths also clear this socket's dev, so a message issued after a
non-final unbind (or to a socket that failed to probe on a multi-socket
system, whose array stays alive and whose remove() is never called) cannot
reach the mailbox that devres is about to unmap.
Two lifetime fixes fall out of the array persisting across a non-final
unbind:
- hsmp_get_tbl_dram_base() iounmap()s any stale metric_tbl_addr before
remapping, so a rebind does not leak one mapping per cycle. It runs
during (re)probe before the metric sysfs attribute is exposed, so no
reader can be using the old mapping.
- The ACPI path registers /dev/hsmp unparented by passing NULL to
hsmp_misc_register(). Its per-socket devices can be unbound individually
and out of order and the misc device outlives all but the last of them,
so parenting it to one socket's device would leave a dangling parent.
hsmp_misc_register() now takes the parent from its caller, so the
platform driver keeps parenting /dev/hsmp to its single device.
hsmp_sock_rwsem is held for write across probe and remove, so the release
and probe-failure cleanup run with it already held; an upcoming change adds
its read side so the same lock also drains the data plane.
Signed-off-by: Muralidhara M K <muralidhara.mk@amd.com>
Link: https://patch.msgid.link/20260723094656.3806028-6-muralidhara.mk@amd.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
misc_deregister() destroys the device but leaves miscdevice.this_device
pointing at the freed struct device. Clear it so any later check of
this_device, and a subsequent re-register, does not observe a stale
pointer. An upcoming change uses this_device to track whether /dev/hsmp is
registered across the shared ACPI sockets and relies on it being NULL after
deregister.
Signed-off-by: Muralidhara M K <muralidhara.mk@amd.com>
Link: https://patch.msgid.link/20260723094656.3806028-5-muralidhara.mk@amd.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
HSMP_GET_METRIC_TABLE makes the firmware refill a shared per-socket metric
DRAM region, which hsmp_metric_tbl_read() then copies out with
memcpy_fromio(). Two concurrent readers of the metrics_bin sysfs attribute
on the same socket can race: one can trigger a fresh fill while the other
is mid-copy and return a torn snapshot. (The hwmon path does not touch
this region; it only issues power messages via hsmp_send_message().)
Embed a struct mutex metric_read_lock in each hsmp_socket and hold it
across the fill-and-copy in hsmp_metric_tbl_read(). Add
hsmp_init_metric_read_locks() and hsmp_destroy_metric_read_locks(), which
take only struct hsmp_plat_device and iterate pdev->sock[] over
pdev->num_sockets so the caller cannot pass a count that disagrees with the
array.
Wire them into both front-ends' probe and teardown paths so the mutex is
always initialized before metrics_bin is exposed: the platform driver and
the ACPI driver both drive hsmp_metric_tbl_read() through the same 0444
metrics_bin attribute. Doing this in one patch avoids a bisection point
where an ACPI read would lock an uninitialized mutex.
Signed-off-by: Muralidhara M K <muralidhara.mk@amd.com>
Link: https://patch.msgid.link/20260723094656.3806028-4-muralidhara.mk@amd.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
explicitly
The metric-table DRAM region is mapped with devm_ioremap(), which ties the
mapping to the socket device's devres scope. An upcoming change lets the
ACPI front-end share the socket array across sockets and run its own
coordinated teardown, so the mapping can no longer be pinned to a single
per-socket devres scope.
Map it with plain ioremap() instead and add hsmp_unmap_metric_tbls(), which
drops every socket's metric_tbl_addr mapping. The platform driver registers
that helper with devm_add_action_or_reset() so the mappings are released on
both remove and probe failure, while the socket array itself stays
devm-managed.
Signed-off-by: Muralidhara M K <muralidhara.mk@amd.com>
Link: https://patch.msgid.link/20260723094656.3806028-3-muralidhara.mk@amd.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
Add hsmp_sock_rwsem and export it, then hold it for write across ACPI
probe, remove and init_acpi() so concurrent per-socket platform probes
cannot race the is_probed handshake or the one-time socket-array
allocation. Use lockdep_assert_held_write() in init_acpi() to catch
incorrect locking under lockdep.
An rw_semaphore is used rather than a plain mutex because an upcoming
change adds a read side so data-plane messages run concurrently with each
other while probe/remove hold it for write to drain in-flight messages.
Introducing it as an rwsem now keeps the lock type stable across that
change.
Signed-off-by: Muralidhara M K <muralidhara.mk@amd.com>
Link: https://patch.msgid.link/20260723094656.3806028-2-muralidhara.mk@amd.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
The reg-offset hack only works when the IXP4xx platform is
running in big endian mode, and it is there to byte-offset
the byte where the serial registers appear in the BE config.
This is clearly wrong, workarounds need to be in the
drivers. Drop the reg-offset.
Signed-off-by: Linus Walleij <linusw@kernel.org>
Link: https://lore.kernel.org/r/20260724-ixp4xx-dts-fix-v1-1-09bf7111e94e@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-integrator into soc/arm
IXP4xx ARM changes for v7.3:
Make it possible to boot IXP4xx in little endian mode. This is
dependent on the patch for the xscale decompress header
submitted through Russell's patch tracker.
* tag 'ixp4xx-arm-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-integrator:
ARM: ixp4xx: Relax endianness
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/arm
Renesas ARM SoC updates for v7.3
- Use the of_machine_compatible_match() helper.
* tag 'renesas-arm-soc-for-v7.3-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel:
ARM: shmobile: rcar-gen2: Use of_machine_compatible_match() helper
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/drivers
Renesas driver updates for v7.3
- Drop duplicate default for ARCH_R8A78000.
* tag 'renesas-drivers-for-v7.3-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel:
soc: renesas: r8a78000: Drop duplicate "default ARCH_RENESAS"
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/drivers
Narrowing of reboot-mode definitions in the bindings for GRF and PMU.
* tag 'v7.3-rockchip-drivers1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip:
dt-bindings: rockchip: grf: Narrow allowed reboot modes
dt-bindings: rockchip: pmu: Narrow definition of reboot-mode
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers
Arm SCMI updates/fixes for v7.3
A collection of SCMI core and transport fixes addressing resource
lifetimes, teardown races and error handling. Most of these issues
are reported by Sashiko as existing issues while reviewing new feature
additions to SCMI.
The changes:
- publish channel state before mailbox and SMC callbacks can run,
- quiesce notification work before tearing down transport channels,
- fix partial channel setup and mailbox allocation cleanup,
- make IDR iteration and shared-channel teardown safe,
- correct SCMI device, OF node, handle, bus ID and SystemPower lifetimes;,
- harden requested-device registration and removal against races and
partial failures,
- reject out-of-range DT protocol IDs, and
- simplify notification allocations using flexible arrays.
* tag 'scmi-updates-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: (25 commits)
firmware: arm_scmi: Unrequest devices if driver registration fails
firmware: arm_scmi: Roll back partial protocol table registration
firmware: arm_scmi: Fix requested device removal race
firmware: arm_scmi: Fix transport device teardown lookup
firmware: arm_scmi: Fix SCMI device destroy lifetimes
firmware: arm_scmi: Unwind P2A receiver mailbox setup failure
firmware: arm_scmi: Unwind TX receiver mailbox setup failure
firmware: arm_scmi: Fix OF node reference handling
firmware: arm_scmi: Clear SystemPower flag on create failure
firmware: arm_scmi: Drop handle on protocol bind failures
firmware: arm_scmi: Protect device request lookup with RCU
firmware: arm_scmi: Use channel ID for transport teardown
firmware: arm_scmi: Reject out of range DT protocol IDs
firmware: arm_scmi: Avoid IDR updates while cleaning channels
firmware: arm_scmi: Free transport channel on IDR failure
firmware: arm_scmi: Clean up channels on setup failure
firmware: arm_scmi: Quiesce notifications before teardown
firmware: arm_scmi: Unregister device notifier before IDR teardown
firmware: arm_scmi: Publish channel state before callbacks
firmware: arm_scmi: Simplify notification allocations
...
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-integrator into soc/drivers
IXP4xx SoC changes for v7.3:
- Add some MODULE_DEVICE_TABLE():s to the ixp4xx SoC drivers.
- Drop redundant dev_err() calls in the ixp4xx SoC drivers.
* tag 'ixp4xx-soc-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-integrator:
soc: ixp4xx: Remove redundant dev_err()
soc: ixp4xx: npe: add missing MODULE_DEVICE_TABLE()
soc: ixp4xx: qmgr: add missing MODULE_DEVICE_TABLE()
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
In panthor_fw_load_section_entry(), the data size to copy is calculated
without validating it against the allocated section_size:
section->data.size = hdr.data.end - hdr.data.start;
If a crafted firmware sets data.size larger than the allocated memory,
this could cause a heap buffer overflow in panthor_fw_init_section_mem()
memcpy(section->mem->kmap, section->data.buf, section->data.size);
Additionally, if the section->data.size exceeds the BO size, could this
memset underflow the size calculation, leading to a massive out-of-bounds
zeroing of kernel memory?
memset(section->mem->kmap + section->data.size, 0,
panthor_kernel_bo_size(section->mem) - section->data.size);
Reject section entries whose initial data is larger than the section size.
Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block")
Cc: stable@vger.kernel.org
Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Link: https://patch.msgid.link/20260716143939.21903-1-osama.abdelkader@gmail.com
Signed-off-by: Steven Price <steven.price@arm.com>
|
|
Add the newly created official mailing list for the exfat file system.
This mailing list will be shared and used for both the kernel driver
and the exfatprogs utility project.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
When a shared writable mapping has its valid_size extended by a buffered
write or a page fault, exfat zeroes the page-cache gap below the new
valid_size. A store through the mapping can race with this zeroing and be
overwritten.
Fix this by zeroing the gap lazily. Drop ->map_pages so that every first
write fault goes through exfat_page_mkwrite(), which advances valid_size to
cover the faulting page. With fault-around enabled, a store could install a
writable PTE, skip ->page_mkwrite(), and land past valid_size without
advancing it. Extending valid_size one faulting page at a time also leaves
never-written pages in a large mapping alone.
The gap is filled with block granularity, zeroing only the not-uptodate
blocks and preserving blocks that may hold data stored through the mapping.
On the buffered-write path the invalidate lock is held and the gap is
unmapped before zeroing, so a racing store re-faults and, under the inode
lock, completes only after the gap has been zeroed and valid_size covers
it.
Fixes: 82a81a7352bc ("exfat: add iomap buffered I/O support")
Co-developed-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
There are two drivers in the ideapad-laptop module: a wmi_driver and a
platform_driver. The former is registered before the latter, but the
unregistration order is the same as the init one instead of the reverse.
Fix the driver unregistration order by reversing it.
Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
Signed-off-by: Rong Zhang <i@rong.moe>
Link: https://patch.msgid.link/20260723-ideapad-rev-exit-v2-1-9c31159022de@rong.moe
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
Sashiko reports a possible information leak that can occur as follows:
1. In parse_package(), memory allocated for data->device_mode_info is not
zerozed initially as it is allocated with devm_kmalloc_array().
2. In the for loop after the allocation, a malformed ACPI package
provided by firmware can cause some fields in data->device_mode_info
to remain uninitialized.
3. Later in update_sar_data(), the uninitialized fields gets copied to
the fields of context->sar_data, which can be exposed to userspace
through sysfs attribute read (intc_data_show()).
Fix the leak by switching to use devm_kcalloc() for allocation.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260710052806.100107-1-nihaal%40cse.iitm.ac.in
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Link: https://patch.msgid.link/20260723-platx86-v4-2-93b4a178b595@cse.iitm.ac.in
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
The memory allocated for device_mode_info in parse_package() called by
sar_get_data() is not freed in some of the error paths in sar_probe().
Fix that by converting to use device managed allocations.
Fixes: dcfbd31ef4bc ("platform/x86: BIOS SAR driver for Intel M.2 Modem")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Link: https://patch.msgid.link/20260723-platx86-v4-1-93b4a178b595@cse.iitm.ac.in
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
Merge the pmdomain fixes for v7.2-rc[n] into the next branch, to allow
them to get tested together with the pmdomain changes that are targeted
for the next release.
Signed-off-by: Ulf Hansson <ulfh@kernel.org>
|
|
KVM services local TLB flushes on "full" nested VM-Exits (through
__nested_vmx_vmexit()), but not if a nested VM-Enter fails (e.g. due to
failed VMCS checks in nested_vmx_enter_non_root_mode()).
However, it is possible that KVM had queued TLB flushes that need to be
performed, even if the nested VM-Enter was not successful. For example,
if VPID is disabled for L2 (via nested_vmx_transition_tlb_flush(), or if
via the MSR load lists, as the SDM says:
If any MSR is being loaded in such a way that would architecturally
require a TLB flush, the TLBs are updated so that, after VM entry, the
logical processor will not use any translations that were cached before
the transition.
The SDM is unclear about when the TLB flush should occur, and whether or
not a failed VM entry would flush the TLB, so it is safer to always
do the TLB flush in this case.
More concretely, KVM also updates the last VPID L1 used for L2 in
nested_vmx_transition_tlb_flush() (i.e. last_vpid), even if the VM entry
ultimately fails. With the current code, KVM could miss a TLB flush if
L1 changes L2's VPID, then does a failed VM entry followed by a
successful one, as the failed VM entry would update last_vpid but not
actually flush the TLB. Servicing local TLB flushes on failed VM entries
makes sure that the TLB is always flushed when last_vpid is updated.
Fixes: 5c614b3583e7 ("KVM: nVMX: nested VPID emulation")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org> # Internal review
Suggested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Yosry Ahmed <yosry@kernel.org>
Link: https://patch.msgid.link/20260722230128.1587363-1-yosry@kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
When {de,en}crypting memory of an SEV or SEV-ES guest on an SNP-enabled
host via a temporary buffer, allocate a full 4KiB page for the buffer to
ensure the page containing the buffer is wholly owned by KVM, i.e. won't
be concurrently allocated and accessed by other kernel code while KVM is
using the buffer to {de,en}crypt memory. On SNP-enabled platforms, when
sending SEV/SEV-ES commands that trigger firmware writes to memory, the
to-be-written page(s) must be (temporarily) assigned to Firmware (as
required by the SNP architecture, to guard against using such commands as
gadgets to attack SNP guests). See snp_map_cmd_buf_desc() and friends.
Unfortunately, transferring ownership of a page to Firmware makes the page
inaccessible to software, and thus writes generate RMP #PF violations. If
KVM uses a sub-page allocation for its temporary buffer, some other actor
in the kernel can allocate and use the other portions of the page, and thus
trigger unexpected (and seemingly spurious) RMP #PF violations due to
software attempting to access a Firmware-owned page.
BUG: unable to handle page fault for address: ffff906ae30f0300
#PF: supervisor write access in kernel mode
#PF: error_code(0x80000003) - RMP violation
PGD 6b1b80d067 P4D 6b1b80d067 PUD 100231e2063 PMD 10055a88063 PTE 80000100630f0163
SEV-SNP: PFN 0x100630f0 unassigned, dumping non-zero entries in 2M PFN region: [0x10063000 - 0x10063200]
Oops: Oops: 0003 [#1] SMP
CPU: 70 UID: 0 PID: 10658 Comm: svw_WaiterThrea Tainted: G U W O 7.1.0-smp--c22293789940-seanjc-next #1 PREEMPTLAZY
Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE
Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.86.0-102 01/25/2026
RIP: 0010:memset+0xf/0x20
Call Trace:
<TASK>
__kvmalloc_node_noprof+0x2a4/0x710
do_getxattr+0x4e/0x130
path_getxattrat+0x125/0x1b0
do_syscall_64+0x10a/0x480
entry_SYSCALL_64_after_hwframe+0x4b/0x53
RIP: 0033:0x7f3a22cb6daa
</TASK>
Modules linked in: kvm_amd kvm irqbypass vfat fat ccp k10temp sha3 libsha3 i2c_piix4 gq(O) cdc_acm xhci_pci xhci_hcd
gsmi: Log Shutdown Reason 0x03
CR2: ffff906ae30f0300
---[ end trace 0000000000000000 ]---
RIP: 0010:memset+0xf/0x20
Kernel panic - not syncing: Fatal exception
Kernel Offset: 0x39e00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
gsmi: Log Shutdown Reason 0x02
Fixes: 4c735bf1bc22 ("KVM: SEV: Allocate only as many bytes as needed for temp crypt buffers")
Cc: stable@vger.kernel.org
Cc: Michael Roth <michael.roth@amd.com>
Debugged-by: Michael Roth <michael.roth@amd.com>
Link: https://patch.msgid.link/20260723211306.75397-1-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
devm_drm_dev_alloc() returns an ERR_PTR() on failure, but panthor_probe()
always converts that failure to -ENOMEM. Preserve the actual error code
returned by the DRM core instead.
Fixes: 4bdca1150792 ("drm/panthor: Add the driver frontend block")
Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Signed-off-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20260716140337.10679-1-osama.abdelkader@gmail.com
|
|
Without a module description modpost emits a build warning:
WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/pmdomain/imx/imx8m-blk-ctrl.o
WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/pmdomain/imx/imx8mp-blk-ctrl.o
So add the required string to these two drivers.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Ulf Hansson <ulfh@kernel.org>
|
