summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-06-05bpf: Clear rb node linkage when freeing bpf_rb_rootKaitao Cheng
bpf_rb_root_free() detaches the root by copying the current rb_root_cached and then replacing the live root with RB_ROOT_CACHED. It then walks the copied root and drops each object contained in the tree. This leaves the rb node state intact while dropping the object. If the object is refcounted and survives the drop, its bpf_rb_node_kern still contains an owner pointer to the freed root and stale rb tree linkage. If a later bpf_rb_root allocation reuses the same address, bpf_rbtree_remove() can incorrectly pass the owner check and call rb_erase_cached() on a node whose rb pointers belong to the old tree. Mirror the list draining behavior by marking nodes as busy while the root is being detached, then clear the rb node and release the owner before dropping the containing object. This makes surviving nodes unowned and safe to reject from remove or accept for a later add. Fixes: 9c395c1b99bd ("bpf: Add basic bpf_rb_{root,node} support") Signed-off-by: Kaitao Cheng <chengkaitao@kylinos.cn> Acked-by: Yonghong Song <yonghong.song@linux.dev> Link: https://lore.kernel.org/r/20260605094143.5509-1-kaitao.cheng@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-05x86/virt/tdx: Document TDX module updateChao Gao
Recent changes introduced TDX module update support. This is a thorny feature to use correctly. It is intended for informed admins only who are expected to either be doing things very carefully, or using it via userspace programs that handle the pitfalls for them. Document the basics of how to use the feature and what is expected of the user in order for it to go correctly. Both to help the intended users of the feature and as a "here be dragons" note for the more casual TDX users. [ dhansen: tweak docs a bit, clarify update constraints ] Signed-off-by: Chao Gao <chao.gao@intel.com> [dropped "Implementation details" section, update log] Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com> Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
2026-06-05Merge branch 'object-relationship-tracking-refactor-followup'Alexei Starovoitov
Amery Hung says: ==================== Object relationship tracking refactor followup Hi, The main patchset refactoring object relationship tracking in the verifier has landed and this is a followup that addresses the remaining feedback in v6 [0]. [0] https://lore.kernel.org/bpf/20260529014936.2811085-1-ameryhung@gmail.com/ v2 -> v3 - Fix cleanup in patch 2 (AI bots) v1 -> v2 - Add patch 2 fixing silent failure when acquiring reference for struct_ops argument - Add patch 4 removing WARN_ON_ONCE in check_ids() - Add fix tags ==================== Link: https://patch.msgid.link/20260605202056.1780352-1-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-05selftests/bpf: Use bpf_dynptr_slice() to read file dynptr in leak testAmery Hung
use_file_dynptr_slice_after_put_file() reads the dynptr via bpf_dynptr_data(), which always returns NULL for a read-only file dynptr, making the example confusing. Switch to bpf_dynptr_slice(), the correct read API for file dynptrs, and read (rather than write) the slice since it is read-only. The test still fails as expected. Acked-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Amery Hung <ameryhung@gmail.com> Link: https://lore.kernel.org/r/20260605202056.1780352-6-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-05bpf: Remove WARN_ON_ONCE in check_ids()Amery Hung
check_ids() warned when it ran out of idmap slots, assuming this was impossible because the slots are bounded by the number of registers and stack slots. That assumption no longer holds: referenced dynptrs acquire an intermediate reference that lives in refs[] but is not backed by any register or stack slot [0], so a program can accumulate more reference ids than the idmap can hold and exhaust it. Exhaustion is fine for verification correctness. check_ids() already returns false, which makes the states compare as not equivalent and prevents unsound pruning. The only effect of the WARN_ON_ONCE() is log noise, or a panic under panic_on_warn. Drop the warning and keep returning false. [0] 308c7a0ae885 ("bpf: Refactor object relationship tracking and fix dynptr UAF bug") Signed-off-by: Amery Hung <ameryhung@gmail.com> Link: https://lore.kernel.org/r/20260605202056.1780352-5-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-05bpf: Compare parent_id in refsafe() for REF_TYPE_PTRAmery Hung
refsafe() compared each reference's id and type but not its parent_id, so two states whose PTR references differ only in the parent object they were derived from could be wrongly treated as equivalent and pruned. Fix it by checking parent_id too. Fixes: 308c7a0ae885 ("bpf: Refactor object relationship tracking and fix dynptr UAF bug") Signed-off-by: Amery Hung <ameryhung@gmail.com> Link: https://lore.kernel.org/r/20260605202056.1780352-4-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-05bpf: Check acquire_reference() error for "__ref" struct_ops argumentsAmery Hung
When acquiring references for struct_ops program arguments tagged with "__ref", the return value of acquire_reference() was stored directly into u32 ctx_arg_info[i].ref_id without checking for failure. acquire_reference() returns -ENOMEM when acquire_reference_state() fails to allocate, so the error was silently stored as a ref_id instead of aborting verification. Fix it by checking the return. Fixes: a687df2008f6 ("bpf: Support getting referenced kptr from struct_ops argument") Signed-off-by: Amery Hung <ameryhung@gmail.com> Link: https://lore.kernel.org/r/20260605202056.1780352-3-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-05bpf: Fix dead error check on acquire_reference() in check_kfunc_callAmery Hung
acquire_reference() returns a signed int that may be a negative errno but was converted to unsigned, which makes the subsequent error check deadcode. Fix it by declaring 'id' as int so the error path is taken correctly. Fixes: 308c7a0ae885 ("bpf: Refactor object relationship tracking and fix dynptr UAF bug") Acked-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Amery Hung <ameryhung@gmail.com> Link: https://lore.kernel.org/r/20260605202056.1780352-2-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-05bpftool: Restrict feature tests during bootstrap compilationIan Rogers
When the perf build executes 'make -C ../bpf/bpftool bootstrap', bpftool's Makefile unconditionally evaluated feature checks for llvm, libcap, libbfd, and disassembler libraries because the bootstrap target was not exempted. Since the bootstrap bpftool strictly compiles minimal AST parsing and C code generation logic without linking LLVM or disassembler libraries, these feature check sub-makes are completely redundant. Exempt the bootstrap target from non-essential feature tests to eliminate unneeded sub-make fork overhead during Kbuild startup. Tested-by: James Clark <james.clark@linaro.org> Assisted-by: Gemini:gemini-3.1-pro-preview Signed-off-by: Ian Rogers <irogers@google.com> Acked-by: Quentin Monnet <qmo@kernel.org> Link: https://lore.kernel.org/r/20260531010750.525160-1-irogers@google.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-05dt-bindings: soc: ti,omap-dmm: Convert to DT schemaBhargav Joshi
Convert the TI OMAP Dynamic Memory Manager (DMM) dt binding from text format to DT schema. During conversion following changes were made: - Move file from /bindings/arm/omap to /bindings/soc/ti/ - Make the 'ti,hwmods' property optional and mark it deprecated as it is no longer used, it is kept to support legacy dtbs. - Add the missing required property 'interrupts' to example node. Signed-off-by: Bhargav Joshi <j.bhargav.u@gmail.com> Link: https://patch.msgid.link/20260605-ti-omap-dmm-v2-1-1b460742ec83@gmail.com Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-06-05selftests/bpf: Fix flaky file_reader testMykyta Yatsenko
file_reader/on_open_expect_fault test expects page fault when reading pages from the test harness executable. It is not guaranteed that those are paged out, even after madvise(MADV_PAGEOUT). Relax the condition in the test to succeed with both 0 and -EFAULT returned. Fixes: 784cdf931543 ("selftests/bpf: add file dynptr tests") Reported-by: Shung-Hsi Yu <shung-hsi.yu@suse.com> Closes: https://lore.kernel.org/all/ah6g7JSYOWGp2oAG@u94a/ Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com> Tested-by: Ihor Solodrai <ihor.solodrai@linux.dev> Link: https://lore.kernel.org/r/20260603-file_reader_flake-v1-1-7f3f52d1e388@meta.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-05Merge tag 'io_uring-7.1-20260605' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fix from Jens Axboe: "A single fix for a missing flag mask when multishot is used with an incrementally consumed buffer ring, potentially leading to application confusion because of lack of IORING_CQE_F_BUF_MORE consistency" * tag 'io_uring-7.1-20260605' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries
2026-06-05perf stat: Bounds-check CPU index in topology aggregation callbacksArnaldo Carvalho de Melo
Six perf_env__get_*_aggr_by_cpu() functions access env->cpu[cpu.cpu] after only checking cpu.cpu != -1. env->cpu[] is allocated with env->nr_cpus_avail entries, so a CPU index from an untrusted perf.data file that exceeds that count causes an out-of-bounds heap read. Replace the != -1 guard with >= 0 && < env->nr_cpus_avail in all six functions. The >= 0 check also catches -1 and any other negative values that could bypass the old check. Affected functions: - perf_env__get_socket_aggr_by_cpu() - perf_env__get_die_aggr_by_cpu() - perf_env__get_cache_aggr_by_cpu() - perf_env__get_cluster_aggr_by_cpu() - perf_env__get_core_aggr_by_cpu() - perf_env__get_cpu_aggr_by_cpu() Fixes: 68d702f7a120 ("perf stat report: Add support to initialize aggr_map from file") Reported-by: sashiko-bot <sashiko-bot@kernel.org> Cc: Ian Rogers <irogers@google.com> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Namhyung Kim <namhyung@kernel.org> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-05perf mmap: Guard cpu__get_node() return in aio_bind()Arnaldo Carvalho de Melo
perf_mmap__aio_bind() passes the cpu__get_node() return value directly to an unsigned long variable (node_index). When cpu__get_node() returns -1 for an unknown CPU, the implicit int-to-unsigned-long conversion sign-extends it to ULONG_MAX. This causes bitmap_zalloc(ULONG_MAX + 1) which wraps to bitmap_zalloc(0), returning a zero-sized allocation. The subsequent __set_bit(ULONG_MAX, node_mask) then writes massively out of bounds. Check the return value in a signed temporary before assigning to node_index, and skip the NUMA binding when the node is unknown. Fixes: c44a8b44ca9f ("perf record: Bind the AIO user space buffers to nodes") Reported-by: sashiko-bot <sashiko-bot@kernel.org> Cc: Alexey Budankov <alexey.budankov@linux.intel.com> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Namhyung Kim <namhyung@kernel.org> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-05perf sched: Fix register_pid() overflow, strcpy, and BUG_ONArnaldo Carvalho de Melo
register_pid() has several issues when processing untrusted perf.data: 1. Integer overflow: (pid + 1) * sizeof(struct task_desc *) can wrap to a small value on 32-bit systems when pid is large (e.g. 0x40000000), causing realloc to return a tiny buffer followed by out-of-bounds writes in the initialization loop. 2. Heap buffer overflow: strcpy(task->comm, comm) copies the untrusted comm string into a fixed 20-byte COMM_LEN buffer with no length check. 3. BUG_ON on allocation failure: perf.data is untrusted input, so allocation failures should be handled gracefully rather than killing the process. 4. Realloc of sched->tasks assigned directly back, leaking the old pointer on failure; nr_tasks incremented before the realloc, leaving corrupted state on failure. Cap pid at PID_MAX_LIMIT (4194304, matching the kernel's maximum on 64-bit), replace strcpy with strlcpy, guard against NULL comm, replace BUG_ON with NULL returns using safe realloc patterns, and add NULL checks in callers that dereference the result. Fixes: ec156764d424 ("perf sched: Import schedbench.c") Reported-by: sashiko-bot <sashiko-bot@kernel.org> Cc: Ingo Molnar <mingo@elte.hu> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-05perf sched: Cap max_cpu at MAX_CPUS in timehist sample processingArnaldo Carvalho de Melo
perf_timehist__process_sample() updates sched->max_cpu from the sample CPU without bounds checking. Later code uses max_cpu + 1 as an iteration count over arrays allocated with MAX_CPUS entries (curr_thread, cpu_last_switched). A recording with CPU IDs >= MAX_CPUS causes out-of-bounds array accesses. Also cap the env->nr_cpus_online initialization of max_cpu in perf_sched__timehist(), which could exceed MAX_CPUS on very large systems. Add bounds checks before both max_cpu updates, matching the pattern already used in map_switch_event(). Fixes: 49394a2a24c7 ("perf sched timehist: Introduce timehist command") Reviewed-by: David Ahern <dsahern@kernel.org> Reported-by: sashiko-bot <sashiko-bot@kernel.org> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-05power: supply: max17042_battery: Use modern PM ops to clear up warningNathan Chancellor
When building for a platform that does not have power management, such as s390, there is an unused function warning, as max17042_suspend_soc_alerts() is only used in max17042_suspend(), which is under a CONFIG_PM_SLEEP #ifdef. drivers/power/supply/max17042_battery.c:957:13: error: 'max17042_suspend_soc_alerts' defined but not used [-Werror=unused-function] 957 | static void max17042_suspend_soc_alerts(struct max17042_chip *chip) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ Use the modern DEFINE_SIMPLE_DEV_PM_OPS(), which allows the compiler to see the functions as used while allowing it to eliminate them as unused during the optimization phase. Use pm_ptr() to allow the compiler to drop max17042_pm_ops when there is no PM support. Fixes: 601885ffb5e9 ("power: supply: max17042_battery: Keep only critical alerts during suspend") Signed-off-by: Nathan Chancellor <nathan@kernel.org> Link: https://patch.msgid.link/20260604-max17042_battery-fix-unused-suspend_soc_alerts-v1-1-3562a68e6f36@kernel.org Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-06-05block: Enable lock context analysisBart Van Assche
Now that all block/*.c files have been annotated, enable lock context analysis for all these source files. Reviewed-by: Hannes Reinecke <hare@kernel.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com> Link: https://patch.msgid.link/e248ca3aeead238bbc489cf3afdafcbff9e41faf.1780682325.git.bvanassche@acm.org Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-05block/mq-deadline: Make the lock context annotations compatible with ClangBart Van Assche
While sparse ignores the __acquires() and __releases() arguments, Clang verifies these. Make the arguments of __acquires() and __releases() acceptable for Clang. Reviewed-by: Hannes Reinecke <hare@kernel.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com> Link: https://patch.msgid.link/3b6e336ced91e27213608ffce205ccd24f4ba285.1780682325.git.bvanassche@acm.org Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-05block/Kyber: Make the lock context annotations compatible with ClangBart Van Assche
While sparse ignores the __acquires() and __releases() arguments, Clang verifies these. Make the arguments of __acquires() and __releases() acceptable for Clang. Reviewed-by: Hannes Reinecke <hare@kernel.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com> Link: https://patch.msgid.link/91cb8c790fc8b26b8aa742569fbf8c2c1d099dac.1780682325.git.bvanassche@acm.org Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-05block/blk-mq-debugfs: Improve lock context annotationsBart Van Assche
Make the existing lock context annotations compatible with Clang. Add the lock context annotations that are missing. Reviewed-by: Hannes Reinecke <hare@kernel.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com> Link: https://patch.msgid.link/f58fe220ff98f9dfddfed4573f40005c773b7fb7.1780682325.git.bvanassche@acm.org Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-05block/blk-iocost: Inline iocg_lock() and iocg_unlock()Bart Van Assche
Both iocg_lock() and iocg_unlock() use conditional locking. Fold these functions into their callers such that unlocking becomes unconditional. Cc: Tejun Heo <tj@kernel.org> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com> Link: https://patch.msgid.link/f8c9867788957d2e40a32e23c6d9b866e480ad9d.1780682325.git.bvanassche@acm.org Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-05block/blk-iocost: Split ioc_rqos_throttle()Bart Van Assche
Prepare for inlining iocg_lock() and iocg_unlock() by moving the code between these two calls into a new function. No functionality has been changed. Reviewed-by: Hannes Reinecke <hare@kernel.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Cc: Tejun Heo <tj@kernel.org> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com> Link: https://patch.msgid.link/a6d3ed953cef6669d23a80923bf46600733cbdae.1780682325.git.bvanassche@acm.org Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-05block/crypto: Annotate the crypto functionsBart Van Assche
Add the lock context annotations required for Clang's thread-safety analysis. Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Hannes Reinecke <hare@kernel.org> Cc: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com> Link: https://patch.msgid.link/297b40e43a7f9b7d20e91a6c44b41a69d01f5c63.1780682325.git.bvanassche@acm.org Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-05block/cgroup: Inline blkg_conf_{open,close}_bdev_frozen()Bart Van Assche
The blkg_conf_open_bdev_frozen() calling convention is not compatible with lock context annotations. Fold both blkg_conf_open_bdev_frozen() and blkg_conf_close_bdev_frozen() into their only caller. This patch prepares for enabling lock context analysis. The type of 'memflags' has been changed from unsigned long into unsigned int to match the type of current->flags. See also <linux/sched.h>. Reviewed-by: Hannes Reinecke <hare@kernel.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Cc: Tejun Heo <tj@kernel.org> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com> Link: https://patch.msgid.link/05661d1555decc6dd5389174ba448d803b72ed9a.1780682325.git.bvanassche@acm.org Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-05block/blk-iocost: Combine two error paths in ioc_qos_write()Bart Van Assche
Reduce code duplication by combining two error paths. No functionality has been changed. Suggested-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Hannes Reinecke <hare@kernel.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Cc: Tejun Heo <tj@kernel.org> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com> Link: https://patch.msgid.link/80d4fc1ecd5eaf187c0a31c63a1033a7326d4c7e.1780682325.git.bvanassche@acm.org Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-05block/cgroup: Improve lock context annotationsBart Van Assche
Add lock context annotations where these are missing. Move the blkg_conf_prep() annotation into block/blk-cgroup.h to make it visible to all blkg_conf_prep() callers. Reviewed-by: Hannes Reinecke <hare@kernel.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com> Link: https://patch.msgid.link/58ddd6e2b960bdfa03d0007984386bc0ba351391.1780682325.git.bvanassche@acm.org Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-05block/cgroup: Split blkg_conf_exit()Bart Van Assche
Split blkg_conf_exit() into blkg_conf_unprep() and blkg_conf_close_bdev() because blkg_conf_exit() is not compatible with the Clang thread-safety annotations. Remove blkg_conf_exit(). Rename blkg_conf_exit_frozen() into blkg_conf_close_bdev_frozen(). Add thread-safety annotations to the new functions. Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Hannes Reinecke <hare@kernel.org> Cc: Tejun Heo <tj@kernel.org> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com> Link: https://patch.msgid.link/c1ec1f1c4b675bc5f187f77b3e6436234c6b244c.1780682325.git.bvanassche@acm.org Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-05block/cgroup: Split blkg_conf_prep()Bart Van Assche
Move the blkg_conf_open_bdev() call out of blkg_conf_prep() to make it possible to add lock context annotations to blkg_conf_prep(). Change an if-statement in blkg_conf_open_bdev() into a WARN_ON_ONCE() call. Export blkg_conf_open_bdev() because it is called by the BFQ I/O scheduler and the BFQ I/O scheduler may be built as a kernel module. Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Hannes Reinecke <hare@kernel.org> Cc: Tejun Heo <tj@kernel.org> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com> Link: https://patch.msgid.link/e6ea0387f413217c8561a0ca54ce7b846aa5c7c5.1780682325.git.bvanassche@acm.org Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-05block/bdev: Annotate the blk_holder_ops callback functionsBart Van Assche
The four callback functions in blk_holder_ops all release the bd_holder_lock. Annotate these functions accordingly. Reviewed-by: Hannes Reinecke <hare@kernel.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com> Link: https://patch.msgid.link/be51cf81110f691ebd5868ac2f15ceb847805bc8.1780682325.git.bvanassche@acm.org Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-05block: Annotate the queue limits functionsBart Van Assche
Let the thread-safety checker verify whether every start of a queue limits update is followed by a call to a function that finishes a queue limits update. Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Hannes Reinecke <hare@kernel.org> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com> Link: https://patch.msgid.link/8f71062b6d0fcf2b80bc8cda701c453224755439.1780682325.git.bvanassche@acm.org Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-05Merge tag 'kbuild-fixes-7.1-3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild fix from Nicolas Schier: "A single simple commit that fixes the currently broken kconfig selftests" * tag 'kbuild-fixes-7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: kconfig: Fix repeated include selftest expectation
2026-06-05Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds
Pull kvm fixes from Paolo Bonzini: "arm64: - Correctly drop the ITS translation cache reference when it actually gets invalidated - Take the SRCU lock for SW page table walks - Restore POR_EL0 access to host EL0, avoiding POR_EL0 becoming inaccessible from EL0 after running a guest - Reassign nested_mmus array behind mmu_lock, ensuring that vcpu init and MMU notifiers are mutually exclusive - Correctly handle FEAT_XNX at stage-2 s390: - More fixes for the new page table management and nested virtualization x86: - More fixes for GHCB issues: - Read start/end indices of page size change requests exactly once per vmexit - Unmap and unpin the GHCB as needed on vCPU free" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (23 commits) KVM: arm64: Correctly identify executable PTEs at stage-2 KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX KVM: arm64: Reassign nested_mmus array behind mmu_lock KVM: arm64: Restore POR_EL0 access to host EL0 KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb() KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying KVM: SEV: Read start/end indices of PSC requests exactly once per #VMGEXIT KVM: SEV: Add an anonymous "psc" struct to track current PSC metadata KVM: SEV: Make it more obvious when KVM is writing back the current PSC index KVM: s390: Remove ptep_zap_softleaf_entry() KVM: s390: Fix possible reference leak in fault-in code KVM: s390: Prevent memslots outside the ASCE range KVM: s390: Lock pte when making page secure KVM: s390: Fix fault-in code KVM: s390: vsie: Fix rmap handling in _do_shadow_crste() KVM: s390: Fix guest / virtual address confusion in _essa_clear_cbrl() ...
2026-06-05Merge tag 'probes-fixes-v7.1-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing/probes fix from Masami Hiramatsu: "Fix the eprobe event parser to point error position correctly" * tag 'probes-fixes-v7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/probes: Point the error offset correctly for eprobe argument error
2026-06-05RDMA/siw: Fix endpoint/socket association handlingBernard Metzler
Disassociating a socket from an endpoint via siw_socket_disassoc() may release the last reference on that endpoint and free it. Therefore, don't clear the endpoints socket pointer after calling that function, but within. This fixes a: BUG: KASAN: slab-use-after-free in siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075) which occurred after processing a malformed MPA request during connection establishment, causing the new endpoint to be closed. Fixes: 6c52fdc244b5c ("rdma/siw: connection management") Link: https://patch.msgid.link/r/20260604160808.30948-1-bernard.metzler@linux.dev Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> Signed-off-by: Bernard Metzler <bernard.metzler@linux.dev> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-06-05arm64: defconfig: Enable DP83822 PHY driverStefan Wahren
Enable DP83822 PHY driver as a module to support the Ethernet PHY, which is placed on phyCORE-i.MX93 SOM. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Stefan Wahren <wahrenst@gmx.net> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-06-05kconfig: Fix repeated include selftest expectationZhou Yuhang
The err_repeated_inc test was added with an expected stderr fixture that does not match the diagnostic printed by kconfig. Running "make testconfig" currently fails in that test even though the parser reports the duplicated include correctly: [stderr] Kconfig.inc1:4: error: repeated inclusion of Kconfig.inc3 Kconfig.inc2:3: note: location of first inclusion of Kconfig.inc3 The fixture expects "Repeated" and "Location" with capital letters, but the diagnostic emitted by scripts/kconfig/util.c uses lowercase words. Update the fixture to match the real message. Fixes: 102d712ded3e ("kconfig: Error out on duplicated kconfig inclusion") Signed-off-by: Zhou Yuhang <zhouyuhang@kylinos.cn> Tested-by: Nicolas Schier <nsc@kernel.org> Reviewed-by: Nathan Chancellor <nathan@kernel.org> Link: https://patch.msgid.link/20260520070800.2265479-1-zhouyuhang1010@163.com Signed-off-by: Nicolas Schier <nsc@kernel.org>
2026-06-05block: Add WQ_PERCPU to alloc_workqueue usersMarco Crivellari
This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The refactoring is going to alter the default behavior of alloc_workqueue() to be unbound by default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. For more details see the Link tag below. In order to keep alloc_workqueue() behavior identical, explicitly request WQ_PERCPU. Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Marco Crivellari <marco.crivellari@suse.com> Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Link: https://patch.msgid.link/20260604105347.168322-1-marco.crivellari@suse.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-05arm64: dts: imx{91,93}-phyboard-segin: Add peb-av-18 overlaysFlorijan Plohl
Add overlay for the PHYTEC Audio/Video adapter module PEB-AV-18 on phyBOARD-Segin-i.MX91/93 boards. The supported AC220 display is Powertip PH800480T032-ZHC19 panel with a backlight and Ilitek touch-screen controller. Signed-off-by: Florijan Plohl <florijan.plohl@norik.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-06-05arm64: dts: imx93-var-som-symphony: enable ADCStefano Radaelli
Enable ADC1 on the Symphony carrier board and describe its 1.8 V reference supply. Signed-off-by: Stefano Radaelli <stefano.r@variscite.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-06-05arm64: dts: imx93-var-som-symphony: enable TPM3 PWMStefano Radaelli
Enable TPM3 on the Symphony carrier board and add the pinctrl states for the PWM output and sleep configuration. Signed-off-by: Stefano Radaelli <stefano.r@variscite.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-06-05arm64: dts: imx93-var-som-symphony: keep RGB_SEL lowStefano Radaelli
Keep the RGB_SEL line driven low on the Symphony carrier board. This avoids leaving the line floating and ensures the board remains in the expected display configuration. Signed-off-by: Stefano Radaelli <stefano.r@variscite.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-06-05arm64: dts: imx93-var-som-symphony: enable UART7Stefano Radaelli
Enable UART7 on the Symphony carrier board and add its pinctrl configuration. Signed-off-by: Stefano Radaelli <stefano.r@variscite.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-06-05arm64: dts: imx93-var-som-symphony: add TPM supportStefano Radaelli
Add the ST33KTPM2XI2C TPM device on the Symphony carrier board. The TPM reset line is driven through a PCAL6408 GPIO expander, so add the expander on the I2C bus and describe the TPM reset GPIO. Signed-off-by: Stefano Radaelli <stefano.r@variscite.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-06-05arm64: dts: imx91-var-som-symphony: fix RGB_SEL handlingStefano Radaelli
RGB_SEL is a board-level signal driven by the PCAL6408 GPIO expander on the Symphony carrier board. The signal needs to be driven high on the i.MX91 variant to keep the board in the expected display configuration. Move the handling of this line from a fixed regulator tied to the PCAL6408 supply to a GPIO hog on the correct GPIO expander. Fixes: b3292129dcef ("arm64: dts: imx91-var-som: Add support for Variscite Symphony board") Signed-off-by: Stefano Radaelli <stefano.r@variscite.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-06-05arm64: dts: freescale: fsl-ls1028a-tqmls1028a-mbls1028a: switch mmc aliasesNora Schiffer
All modern TQ-Systems boards follow the convention that mmc0 is the eMMC and mmc1 is the SD-card when both interfaces exist, reducing differences between boards for both documentation and U-Boot code (which uses the same Device Trees). Adjust the recently added MBLS1028A Device Tree accordingly. Fixes: 0538ca1f102d ("arm64: dts: ls1028a: Add mbls1028a and mbls1028a-ind devicetrees") Signed-off-by: Nora Schiffer <nora.schiffer@ew.tq-group.com> Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-06-05arm64: dts: imx943-evk-sdwifi: add a new dtso to support SDIW612 WiFiSherry Sun
Add a new imx943-evk-sdwifi.dtso to support SDIW612 WiFi chip on imx943-evk board, the default imx943-evk.dtb is used to support PCIE AW693 WiFi. Use separate dts for SDIW612 and PCIe AW693 WiFi to avoid the shared regulator between SDIO and PCIe buses, the random probe order between the two buses may break the PCIe initialization sequence which cause AW693 has probability of failing to detect. Signed-off-by: Sherry Sun <sherry.sun@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-06-05arm64: dts: imx8mp-kontron: Fix GPIO for display power switchFrieder Schrempf
The GPIO that controls the power supply for the LVDS display connector has changed between early prototypes and the current production design of the hardware. Reflect this change in the devicetree to properly switch on the panel supply. This was working before even with the wrong GPIO due to the bidirectional level shifter used on the board which drives the EN signal high even when the input has a (weak) pull down configured as reset condition of the SoC pad. As a result the display was working but the supply was always on. Tested on BL i.MX8MP to show the correct voltage level on the level shifter input. Fixes: 946ab10e3f40 ("arm64: dts: Add support for Kontron OSM-S i.MX8MP SoM and BL carrier board") Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-06-05arm64: dts: freescale: imx95-aquila: Add Clover carrier boardAntoine Gouby
Add support for the Aquila i.MX95 SoM mated with the Clover carrier board. Clover is a low-cost carrier board for the Aquila family featuring a small form factor (Nano-ITX 120mm x 120mm) and built for volume production. Link: https://www.toradex.com/computer-on-modules/aquila-arm-family/nxp-imx95 Link: https://www.toradex.com/products/carrier-board/clover Signed-off-by: Antoine Gouby <antoine.gouby@toradex.com> Signed-off-by: Franz Schnyder <franz.schnyder@toradex.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-06-05arm64: dts: freescale: add Aquila iMX95 supportJoão Paulo Gonçalves
Add support for the Toradex Aquila iMX95 and its development carrier board. The module consists of an NXP i.MX95 family SoC, up to 16GB LPDDR5 RAM, up to 128GB of storage, a USB 3.2 OTG and USB 2.0 Host, a Gigabit Ethernet PHY, a 10 Gigabit Ethernet interface, an I2C EEPROM and Temperature Sensor, an RX8130 RTC, one Quad lane CSI interface, one Quad lane DSI or CSI interface, one LVDS interface (one or two channels), and some optional addons: DisplayPort (through a DSI-DP bridge), TPM 2.0, and a WiFi/BT module. Link: https://www.toradex.com/computer-on-modules/aquila-arm-family/nxp-imx95 Link: https://www.toradex.com/products/carrier-board/aquila-development-board-kit Signed-off-by: João Paulo Gonçalves <joao.goncalves@toradex.com> Co-developed-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com> Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com> Co-developed-by: Francesco Dolcini <francesco.dolcini@toradex.com> Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com> Co-developed-by: Antoine Gouby <antoine.gouby@toradex.com> Signed-off-by: Antoine Gouby <antoine.gouby@toradex.com> Co-developed-by: Ernest Van Hoecke <ernest.vanhoecke@toradex.com> Signed-off-by: Ernest Van Hoecke <ernest.vanhoecke@toradex.com> Co-developed-by: Franz Schnyder <franz.schnyder@toradex.com> Signed-off-by: Franz Schnyder <franz.schnyder@toradex.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-06 10:34:23 +0000