| Age | Commit message (Collapse) | Author |
|---|
|
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Jakub Kicinski:
"Including fixes from Bluetooth, IPSec and Netfilter.
Current release - fix to a fix:
- netfilter: ipset: remove need to allocate memory on delete operations
Current release - regressions:
- macb: drop CONFIG_OF #if block, fix build
Previous releases - always broken:
- stream of fixes for SCTP continues
- inet: frags: strip GSO state from fragments before reassembly
- virtio-net: ensure that TCP packets don't overflow gso_segs
- tcp-ao: fix use-after-free of current_key on reconnect to another
peer
- page_pool: remove zone/policy GFP flags when allocating XArray
entries
- Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN
- tls: device: fix out-of-bounds write in tls_append_frag()
- eth: bnxt:
- ring the doorbell when SW USO exits early, avoid packets stuck
in Tx
- gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check, avoid
users of older NICs seeing non-actionable warning messages
- eth: qede: fix NULL pointer dereference in TPA fragment processing"
* tag 'net-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (216 commits)
inet: frags: strip GSO state from fragments before reassembly
net/sched: sch_htb: limit htb_classify inner-class filter hops
selftests/net: packetdrill: add tcp_urg_ptr_retransmit
tcp: fix corruption of urgent data on multi-segment retransmit
usb: atm: usbatm: fix invalid ci_range initialization
net: fec: only stop PTP if it was initialized
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
net: dsa: mxl862xx: enable assisted learning on CPU port
net: stmmac: restore NET_IP_ALIGN in the RX DMA offset
net: stmmac: drop gso_enabled_types and rely on netdev features
net: stmmac: selftests: Don't test flow control for small rx fifos
net: stmmac: selftests: Account for the UC filter list for filtering tests
net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
net: stmmac: selftests: Check multiple MMC counters
selftests: net: Fix slow configurations in big_tcp_tunnels.sh
selftests: net: Lower threshold with csum offload off in big_tcp_tunnels.sh
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux
Pull devicetree fixes from Rob Herring:
- Fix possible out-of-bounds access in of_alias_scan()
- Fix refcount leak in of_irq_get_affinity()
- Add Qualcomm SPMI PMIC haptics input which is already referenced
* tag 'devicetree-fixes-for-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
of: fix out-of-bounds read in of_alias_scan() stem parser
of/irq: Fix device node refcount leak in of_irq_get_affinity()
dt-bindings: input: Add Qualcomm SPMI PMIC haptics
|
|
syzbot reported a shift-out-of-bounds in __vcc_connect():
UBSAN: shift-out-of-bounds in net/atm/common.c:382:32
shift exponent -1 is negative
CPU: 0 UID: 0 PID: 5987 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
__ubsan_handle_shift_out_of_bounds+0x36d/0x400 lib/ubsan.c:494
__vcc_connect+0x14b4/0x19c0 net/atm/common.c:382
vcc_connect+0x328/0x8f0 net/atm/common.c:498
pvc_bind+0x272/0x380 net/atm/pvc.c:52
__sys_bind+0x2e3/0x410 net/socket.c:1976
__x64_sys_bind+0x7a/0x90 net/socket.c:1979
...
ATM device ci_range fields (vpi_bits and vci_bits) represent the
number of bits supported for VPI and VCI addressing on the device.
net/atm/common.c directly uses these fields as bit shift counts:
vpi >> dev->ci_range.vpi_bits
vci >> dev->ci_range.vci_bits
1 << vcc->dev->ci_range.vpi_bits
1 << vcc->dev->ci_range.vci_bits
usbatm_atm_init() sets ci_range.vpi_bits and ci_range.vci_bits to
ATM_CI_MAX (-1), which is defined in <uapi/linux/atmdev.h> as a
sentinel value for userspace ATM_SETCIRANGE requests, not a valid bit
count. Shifting by -1 is undefined behavior and triggers UBSAN
warnings.
ATM UNI cell headers allow up to 8 bits for VPI (0..255) and 16 bits
for VCI (0..65535). Initialize vpi_bits to 8 and vci_bits to 16, as
done by solos-pci.
Fixes: c59bba75fa50 ("[PATCH] USB ATM: new usbatm core")
Reported-by: syzbot+6665d3db5fef15914802@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6665d3db5fef15914802
Suggested-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/all/20260824024620.23485-1-kartikey406@gmail.com/T/ [v1]
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Link: https://patch.msgid.link/20260826133258.8306-1-kartikey406@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
fec_ptp_init() is only called when fep->bufdesc_ex is available.
However, fec_probe() unconditionally calls fec_ptp_stop() on the
failed_init path, and fec_drv_remove() unconditionally calls
fec_ptp_stop() during device removal.
Check fep->bufdesc_ex before calling fec_ptp_stop() in both paths
to avoid stopping PTP when it was not initialized.
Fixes: 32cba57ba74b ("net: fec: introduce fec_ptp_stop and use in probe fail path")
Reviewed-by: Wei Fang <wei.fang@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://patch.msgid.link/20260826103428.32807-1-phucduc.bui@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read
in slip_receive_buf() when racing against tty hangup.
tty_ldisc_hangup() calls ld->ops->hangup() while holding only
a read lock on tty->ldisc_sem (via tty_ldisc_ref()).
Because slip_hangup() simply called slip_close(), it ran concurrently
with reader functions such as slip_receive_buf().
slip_close() unregisters and frees the net device and its private
struct slip, causing concurrent reader threads in slip_receive_buf()
to dereference freed memory.
Line discipline close() is already guaranteed to be called under
the write lock of tty->ldisc_sem during hangup processing
(in tty_ldisc_reinit() or tty_ldisc_kill()).
Remove slip_hangup() so teardown is serialized cleanly by slip_close().
Fixes: 5342b77c4123 ("slip: Clean up create and destroy")
Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr>
Reported-by: Eulgyu Kim <eulgyukim@snu.ac.kr>
Closes: https://lore.kernel.org/netdev/20260825150655.1450271-1-jjy600901@snu.ac.kr/
Cc: Qingfang Deng <qingfang.deng@linux.dev>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260826105238.3323436-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"A couple of fixes that came in during the merge window: Geert fixed an
uninitialised data bug in the amlogic-spisg driver which could crash
and in the Loongson driver Li Jun hooked up the existing suspend
operations more fully to fix hibernation"
* tag 'spi-fix-v7.3-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: loongson: pm: add .freeze .poweroff .thaw .restore
spi: amlogic-spisg: Make sure clk_init_data is fully initialized
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator fix from Mark Brown:
"One fix here, for a race condition on startup in the tps65185 driver
which is seen on actual boards - we need a delay after waking the chip
before it is ready to talk to the host"
* tag 'regulator-fix-v7.3-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
regulator: tps65185: wait for the IC to wake before the first I2C access
|
|
The MxL862xx driver enables FDB isolation but does not enable assisted
learning on the CPU port. Consequently, MAC addresses learned through a
physical switch port are not updated in hardware when the corresponding
station moves to a foreign bridge port, such as a Wi-Fi interface.
The stale hardware FDB entry continues directing return traffic toward
the original physical port. Traffic entering that same port is then
filtered instead of being forwarded to the CPU and software bridge. This
causes downstream unicast traffic, including DHCP OFFER and ACK packets,
to disappear after a client roams to a local wireless interface. The
client eventually considers the connection unusable and disconnects.
Enable assisted CPU-port learning so DSA installs foreign bridge FDB
entries on the CPU port. This keeps the hardware FDB synchronized with
the software bridge and allows return traffic to reach locally attached
Wi-Fi clients after roaming.
Tested on a BPI R4 PRO with a MxL862xx switch and a BE14000 WiFi interface.
- Without patch, wired uplink on lan6 port (mxl path)
Wifi clients connect but roam away not getting DHCP offers
- Without patch, wired uplink on wan port (no mxl path)
Wifi clients connect and roam successfully
- With this patch, uplink on lan6 (mxl path)
Wifi clients connect and roam successfully
Fixes: 340bdf984613 ("net: dsa: mxl862xx: implement bridge offloading")
Signed-off-by: Edoardo Pinci <epinci@outlook.com>
Link: https://patch.msgid.link/DU0P251MB069949C6DEB4D1D51F31FE87C4A02@DU0P251MB0699.EURP251.PROD.OUTLOOK.COM
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Since the RX path was converted to zero-copy, the page pool page is handed
to the stack directly as the skb head, and the offset the DMA engine writes
at is what determines the alignment of the packet headers.
Before the conversion the payload was copied into an skb obtained from
napi_alloc_skb(), which reserves NET_SKB_PAD + NET_IP_ALIGN. The
conversion moved the headroom into stmmac_rx_offset() but did not carry
over NET_IP_ALIGN, so on architectures where NET_IP_ALIGN is 2 the IP
header now lands misaligned:
64 (NET_SKB_PAD) + 14 (ethernet) + 20 (IP) = 98
Same for the XDP branch:
256 (XDP_PACKET_HEADROOM) + 14 (ethernet) + 20 (IP) = 290
On ARM32 this is fatal, because ldm and ldrd trap on unaligned addresses
even when CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS is set.
Any received echo request panics the machine, e.g:
Unhandled fault: alignment exception (0x001) at 0x81873062
Internal error: : 1 [#1] SMP ARM
Hardware name: Altera SOCFPGA Arria10
PC is at icmp_echo+0x38/0xa8
LR is at icmp_rcv+0x22c/0x370
Call trace:
icmp_echo from icmp_rcv+0x22c/0x370
icmp_rcv from ip_protocol_deliver_rcu+0x2c/0x224
ip_protocol_deliver_rcu from ip_local_deliver+0xc8/0x1a0
ip_local_deliver from ip_sublist_rcv_finish+0x3c/0x50
ip_sublist_rcv_finish from ip_list_rcv_finish+0x110/0x118
ip_list_rcv_finish from ip_list_rcv+0xc8/0xdc
ip_list_rcv from __netif_receive_skb_list_core+0x170/0x1c0
...
napi_complete_done from stmmac_napi_poll_rx+0xcb0/0x1030
Code: e24dd068 e59020a0 e28dc010 e0822001 (e8920003)
Kernel panic - not syncing: Fatal exception in interrupt
The faulting instruction is the ldm of *icmp_hdr(skb) in icmp_echo().
Fix by adding NET_IP_ALIGN back to the RX offset, which restores the
alignment the stack used to get.
Note that commit a955318fe67e ("stmmac: align RX buffers") made a similar
change in 2021 and was reverted by commit 12d125b4574b ("stmmac: Revert
"stmmac: align RX buffers"") because it caused packet corruption. That
patch raised the offset from 0 without adjusting the buffer size
accounting, so the DMA engine could arguably write past the end of the RX
buffers, though this was never root caused.
Commit df542f669307 ("net: stmmac: Switch to zero-copy in non-XDP RX
path") since derives the page pool allocation from stmmac_rx_offset(), so
the extra bytes are accounted for.
Fixes: df542f669307 ("net: stmmac: Switch to zero-copy in non-XDP RX path")
Cc: Daniel Baldin <DBaldin@dspace.de>
Signed-off-by: Pascal Kneuper <PKneuper@dspace.de>
Link: https://patch.msgid.link/20260824125014.47862-1-PKneuper@dspace.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight
Pull backlight updates from Lee Jones:
"New Support & Features:
- Silergy SY7758: Add driver for the 6-channel high-efficiency LED
driver
Improvements & Fixes
- Awinic AW99706: Fix device tree property names to match the
binding, consistently validate all property values, and honor the
core blank state in `update_status()`
- Kinetic KTD2801: Add missing dependency on `GPIOLIB` in Kconfig
- Qualcomm WLED: Remove redundant `dev_err()` calls
Cleanups & Refactoring
- Core: Use `sysfs_emit()` instead of `sprintf()` in sysfs show
callbacks
- Maintainers: Update Junjie Cao's email address for the Awinic
AW99706 driver
Device Tree Binding Updates
- Marvell 88PM860X: Add missing bracket in the example
- Silergy SY7758: Document the 6-channel high-efficiency LED driver"
* tag 'backlight-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight:
backlight: Use sysfs_emit() instead of sprintf()
backlight: qcom-wled: Remove redundant dev_err()
backlight: ktd2801: Fix unmet dependency on GPIOLIB
backlight: aw99706: Honor the core blank state in update_status()
backlight: aw99706: Validate all DT property values consistently
backlight: aw99706: Fix DT property names to match binding
dt-bindings: backlight: 88pm860x: Add missing bracket
MAINTAINERS: Update my email address for the AW99706 backlight driver
backlight: Add SY7758 6-channel High Efficiency LED Driver support
dt-bindings: leds: backlight: Document the SY7758 6-channel High Efficiency LED Driver
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds
Pull LED updates from Lee Jones:
"New Support & Features:
- Core: Extend netdev trigger speeds up to 100G
- PWM Multicolor: Introduce default-intensity property
- Analog Devices LTC3220: Add support for 18 channel LED driver
- NXP PCA963x: Add multicolor LED class support
Improvements & Fixes:
- GPIO: Clear error pointers for skipped LEDs
- Broadcom BCM63138: Use %pe to print pinctrl error instead of %ld
- ISSI IS31FL319x: Modernize device registration by using fwnode APIs
- NXP PCA9532: Fix inverted GPIO output polarity
- NXP PCA9532: Fix phantom device registration on missing hardware
- STMicroelectronics ST1202: Correct and extend hw_pattern
documentation
- STMicroelectronics ST1202: Fix channel disable logic on zero
brightness and ensure brightness changes are applied in active mode
- STMicroelectronics ST1202: Fix hardware pattern sequence
programming, validate inputs, and correct pattern duration
calculations
- STMicroelectronics ST1202: Validate LED reg property against
channel count
- TI LP5860: Fix a potential double-unlock during device
initialization and fix error handling path by using
devm_mutex_init()
Cleanups & Refactoring:
- GPIO: Make legacy gpiolib interface optional
Device Tree Binding Updates:
- Core: Add default-intensity property
- Core: Document "gpio" trigger
- Analog Devices LTC3220: Add DT binding for LTC3220 18 channel LED
driver
- Broadcom BCM6358: Convert to DT schema
- LaCie NS2: Convert to DT schema
- NXP PCA963x: Add multicolor LED support
- NXP PCA963x: Fix reg maximum for pca9635
- TI TPS65217: Convert backlight bindings to DT schema"
* tag 'leds-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: (29 commits)
leds: is31fl319x: Modernize registration
dt-bindings: leds: lacie,ns2-leds: Convert to DT schema
leds: pca963x: Add multicolor LED class support
dt-bindings: leds: nxp,pca963x: Add multicolor LED support
dt-bindings: leds: nxp,pca963x: Fix reg maximum for pca9635
leds: gpio: Clear error pointers for skipped LEDs
dt-bindings: leds: backlight: Convert TPS65217 to DT schema
leds: pca9532: Fix phantom device registration on missing hardware
leds: gpio: Make legacy gpiolib interface optional
leds: bcm63138: Use %pe to print pinctrl error instead of %ld
dt-bindings: leds: Add default-intensity property
leds: ltc3220: Add Support for LTC3220 18 channel LED Driver
dt-bindings: leds: Add LTC3220 18 channel LED Driver
dt-bindings: leds: bcm6358: Convert to DT schema
dt-bindings: leds: Document "gpio" trigger
leds: st1202: Correct and extend hw_pattern documentation
leds: st1202: Validate LED reg property against channel count
leds: st1202: Disable channel when brightness is set to zero
leds: st1202: Fix brightness having no effect while pattern mode is active
leds: st1202: Fix spurious pattern sequence start in setup
...
|
|
The gso_enabled_types field is used by stmmac_xmit() to decide whether a
GSO skb should be passed to stmmac_tso_xmit(). It is updated in
stmmac_set_features() based solely on NETIF_F_TSO, so disabling IPv4
TSO while keeping IPv6 TSO (NETIF_F_TSO6) enabled zeroes the mask. As a
result IPv6 GSO frames, which the networking stack still generates since
NETIF_F_TSO6 is enabled, fall through to the non-TSO xmit path where
they are not handled.
The networking stack already manages the GSO logic: a GSO skb is only
delivered to the driver when the matching offload feature (NETIF_F_TSO,
NETIF_F_TSO6 or NETIF_F_GSO_UDP_L4) is enabled, otherwise the frame is
segmented in software before reaching ndo_start_xmit().
stmmac_features_check() also validates each GSO frame against the TSO
hardware constraints and falls back to software GSO when they are not met.
Drop the gso_enabled_types field and rely on skb_is_gso() in
stmmac_xmit() instead, which correctly routes IPv6 GSO frames to the TSO
path when NETIF_F_TSO is disabled. This also removes the data race
between stmmac_set_gso_types(), called from the feature-set path, and
the lockless read of gso_enabled_types in stmmac_xmit().
Fixes: 2e4082e4b739 ("net: stmmac: simplify GSO/TSO test in stmmac_xmit()")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com>
Link: https://patch.msgid.link/20260824-stmmac-fix-tso6-features-v3-1-c73a7a4a0ec7@oss.qualcomm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
On dwmac1000, dwmac4 and dwxgmac, we only emit pause frames if there's
at least 4096 bytes in each queue's fifo.
The phylink mac capabilities are still MAC_ASYM_PAUSE | MAC_SYM_PAUSE as
otherwise we won't be able to negotiate 'rx on' pause. ASYM only will
prevent negotiating 'rx off tx on', while SYM only doesn't really
matche the reality (not symmetric if we can only do RX pause).
Fixes: 091810dbded9 ("net: stmmac: Introduce selftests support")
Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20260826140500.616466-7-maxime.chevallier@bootlin.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
On dwmac, one of the Unicast filter entries is used to store the local
HW addr. This means that we have to use promisc mode for any kind of
unicast filtering if we only have one slot in our unicast filter.
The number of slots available depends on how the IP is integrated, and
we can't autodiscover how many of these slots we have available, so
the DT property snps,perfect-filter-entries can be used to specify how
many are available.
Most IP variants default to 1 if this isn't specified, which is the case
for the amlogic variants (in this case, S905X3).
The stmmac selftests for UC filtering look if we have enough slots in
the filter to store the dev->uc list, but doesn't account for the
device's own MAC address. The dev->uc list's size we get with
netdev_uc_count() also doesn't account for the HW addr.
As the selftest only requires one available slot, in the case of
single-slot platforms, that means we erroneously consider we have enough
room for the test, when we actually don't, and the filtering test fails.
Fixes: 091810dbded9 ("net: stmmac: Introduce selftests support")
Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20260826140500.616466-6-maxime.chevallier@bootlin.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
The same filter slots are used to store the main MAC address as well as
the address for the unicast filter. Let's account for that when deciding
whether or not to use promisc when programming the UC list in hardware.
Fixes: 0efedbf11f07 ("net: stmmac: xgmac: Fix XGMAC selftests")
Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20260826140500.616466-5-maxime.chevallier@bootlin.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
The same filter slots are used to store the main MAC address as well as
the address for the unicast filter. Let's account for that when deciding
whether or not to use promisc when programming the UC list in hardware.
Fixes: 477286b53f55 ("stmmac: add GMAC4 core support")
Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20260826140500.616466-4-maxime.chevallier@bootlin.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
The same filter slots are used to store the main MAC address as well as
the address for the unicast filter. Let's account for that when deciding
whether or not to use promisc when programming the UC list in hardware.
Fixes: 47dd7a540b8a ("net: add support for STMicroelectronics Ethernet controllers.")
Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20260826140500.616466-3-maxime.chevallier@bootlin.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
The MMC counters report MAC statistics. Multiple counters can be
enabled when the IP is integrated, however there's no way to know
exactly which ones. Un-implemented counters seem to report 0.
It was found that on StarFive JH7110 and Amlogic SM1, the counter that's
used by the selftest (mmc_tx_framecount_g) isn't implemented, triggering
an MMC selftest failure.
Both the above SoCs seem to implement mmc_rx_framecount_gb, let's use
this counter as well for MMC counter validation.
Note that this doesn't guarantee that we won't encounter the same issue
again if another IP implements yet another set of counters that don't
include that new one.
If the game of whack-a-mole with implemented counters becomes too hard to
maintain, we may simply consider removing the MMC selftest entirely.
Fixes: 091810dbded9 ("net: stmmac: Introduce selftests support")
Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20260826140500.616466-2-maxime.chevallier@bootlin.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd
Pull MFD updates from Lee Jones:
"New Support & Features:
- MediaTek MT6397: Add mt6323 AUXADC support
- MediaTek MT6397: Add mt6323 EFUSE support
- Spreadtrum SC27xx: Add SC2730 regulator cell
Improvements & Fixes:
- Apple SMC: Fix key count endianness annotation
- Azoteq IQS62x: Reject zero-length firmware records
- ChromeOS EC: Introduce cros_ec_read_features helper and read
features during probe to catch transfer errors
- Cirrus Logic CS42L43: Fix regmap defaults ordering
- Cirrus Logic CS42L43: Remove redundant NULL checks on SoundWire
- Congatec Board Controller: Fix teardown ordering in cgbc_remove()
- HP iPAQ Micro: Fix out-of-bounds stack read in ipaq_micro_str
- Marvell 88PM886: Initialize the battery page
- QNAP MCU: Keep the reply buffer alive past a command timeout
- RAVE SP: Validate received frame payload lengths
- Silicon Labs Si476x: Drop duplicate NULL checks
- Silicon Labs Si476x: Modernize GPIO handling
- Silicon Motion SM501: Fix potential memory leaks during remove
- UCB1x00: Convert Assabet gpio-keys to use software nodes and
register software node for GPIO controller
- Viperboard: Fix native fields type in structures as little-endian
- Viperboard: Remove redundant NULL check before kfree()
- X-Powers AXP20x: Preserve other control bits when powering off
Cleanups & Refactoring:
- Core: Drop unused assignment of spi_device_id driver data
- Core: Initialize spi_device_id arrays using member names
- Core: Unify style of spi_device_id arrays
- Maintainers: Add Intel LPSS section to follow the changes
- Maintainers: Add a mailing list entry to MFD
- Cirrus Logic CS42L43: Format sdw_device_id table
- Cirrus Logic CS42L43: Use new SoundWire enumeration helper
- ROHM PMIC: Factor out power button registration and convert
gpio-keys to use software nodes
- ST-Ericsson DB8500: Fold dbx500 header into db8500
Device Tree Binding Updates:
- Core: Add techvision vendor prefix
- Marvell 88PM886: Allow vbus regulator
- MediaTek MT8195 SCP: Add support for MT8189 SoC
- Qualcomm SPMI PMIC: Document PMG1110
- Qualcomm SPMI PMIC: Document haptics device
- Qualcomm TCSR: Add compatible for Hawi and Maili SoCs
- Qualcomm TCSR: Add compatible for Shikra
- Qualcomm TCSR: Document the IPQ9650 TCSR block
- STMicroelectronics STMPE: Fix typo st,stmpe601 (should be
st,stmpe610)
- Syscon: Add ESWIN EIC7700 compatible
- Syscon: Allow syscon compatible for Loongson-2K0300 chip id
- Syscon: Disallow simple-bus with syscon
- Syscon: Drop custom select for older dtschema
- TI OMAP USBHS TLL: Convert to DT schema"
* tag 'mfd-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (45 commits)
mfd: cs42l43: Fix regmap defaults ordering
dt-bindings: mfd: syscon: Allow syscon compatible for Loongson-2K0300 chip id
dt-bindings: mfd: syscon: Add ESWIN EIC7700 compatible
mfd: qnap-mcu: keep the reply buffer alive past a command timeout
dt-bindings: mfd: qcom,tcsr: Document the IPQ9650 TCSR block
mfd: macsmc: Fix key count endianness annotation
dt-bindings: mfd: qcom,spmi-pmic: Document haptics device
mfd: iqs62x: Reject zero-length firmware records
mfd: rave-sp: validate received frame payload lengths
mfd: sm501: Fix potential memory leaks during remove
mfd: viperboard: Fix native fields type in structures as little-endian
mfd: si476x-i2c: Get rid of duplicate NULL checks
dt-bindings: mfd: Convert OMAP USB TLL to DT schema
mfd: cgbc: Fix teardown ordering in cgbc_remove()
mfd: mt6397-core: Add mt6323 AUXADC support
dt-bindings: mfd: qcom,tcsr: Add compatible for Hawi and Maili SoCs
mfd: rohm: Factor out power button registration
mfd: ucb1x00: Convert Assabet gpio-keys to use software nodes
mfd: ucb1x00: Register software node for GPIO controller
mfd: cs42l43: Tidy up formatting on sdw_device_id table
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull more MM updates from Andrew Morton:
- "mm/rmap: index MAP_PRIVATE file-backed folios by anonymous pgoff"
(Lorenzo Stoakes)
Index MAP_PRIVATE file-backed folios by their anonymous page offset
to resolve confusion around reverse mapping for zeroed and CoW'd
file-backed memory.
Use this new VMA anonymous page offset tracking to eliminate index
conflicts and lay the foundation for scalable CoW performance
improvements.
- "promote mapped executable folios after first usage for MGLRU"
(Baolin Wang)
Make MGLRU's protection of mapped executable file folios more
reliable. Follow the classical LRU's logic, promoting mapped
executable file folios after their first usage to give executable
code a better chance to stay in memory and improve workload
performance.
- "mm: vmscan: fix node reclaim ignoring swappiness parameter" (Ridong
Chen)
Fix per-node proactive reclaim interface's ignoring the swappiness
parameter when CONFIG_MEMCG is disabled by consolidating
sc_swappiness() into a single function that checks
proactive_swappiness regardless of kernel configuration.
- "mm/vmscan: reduce lru_lock contention via vmstat-derived
scan-balance cost" (Usama Arif)
Reduce lru_lock contention in the reclaim path by deriving
scan-balance costs from vmstat counters rather than lock-acquired
producer updates.
Read and decay these cost signals on the reclaim side under a
dedicated per-lruvec lock, reducing total LRU lock wait time by over
60% without impacting scan throughput.
- "zram: fix zram issues reported by sashiko" (Sergey Senozhatsky)
Fix two low-risk zram bugs which Sashiko spotted in drive-by review.
- "Honor XA_FLAGS_ACCOUNT in xas_split_alloc() and charge to folio's
memcg" (Zi Yan)
Fix xas_split_alloc() by enabling target folio memcg charging during
splits and adding the missing __GFP_ACCOUNT flag for proper XArray
node memory accounting.
- "selftests/mm: use pattern matching in .gitignore" (Pratyush Mallick)
Replace hardcoded binary names in selftests/mm/.gitignore with a
generic pattern-matching rule to automatically ignore generated test
files and avoid manual updates when adding new tests.
- "mm/page_ext: remove pgdat_page_ext_init()" (Sang-Heon Jeon)
Make the incompatibility between FLATMEM and NUMA explicit in
mm/Kconfig and remove the unused pgdat_page_ext_init() function.
- "zram: fix zstd error paths and add parameter validation" (Haoqin
Huang)
Clean up zram compression backends by removing redundant error
cleanup, adding parameter and dictionary validation, auto-prefixing
algorithm error logs, and resetting parameters prior to
reinitialization.
- "zram: fix stale scan bounds after reinitialization" (Longlong Xia)
Prevent out-of-bounds slot accesses during concurrent zram resets by
moving table scan bound calculations under dev_lock in
writeback_store() and read_block_state().
- "add anon mTHP collapse test cases" (Baolin Wang)
Extend selftests helper functions to support arbitrary page orders
and add new test cases and options for mTHP collapse in khugepaged.
- "selftests/mm: Handle unsupported and transient test conditions"
(Muhammad Usama Anjum)
Update MM selftests to report a SKIP status instead of a failure when
required kernel or filesystem features are unsupported, while adding
retry logic for transient page migration errors.
- "mm/zswap: Fixes and improves the zswap shrink" (Hao Jia)
Fix the missing zswap global shrinker when CONFIG_MEMCG is disabled
and extend shrink_memcg() to support batch writeback for improved
writeback efficiency.
- "alloc_tag: introduce IOCTL-based filtering for MAP" (Suren
Baghdasaryan)
Introduce an IOCTL-based binary interface for memory allocation
profiling that enables kernel-side filtering before per-CPU counter
aggregation.
This eliminates the text-parsing overhead of /proc/allocinfo and
provides up to a 20x speedup by transferring only filtered allocation
data to userspace.
- "better block swap batching and a different take on swap_ops v5"
(Christoph Hellwig)
Refactor block swap I/O to use swap_iocb for batching instead of
single-bio requests and rebase the swap_ops interface, achieving
faster swap throughput during kernel builds.
- "mm: kmemleak: reduce transient false positives by confirming leaks"
(Catalin Marinas)
Reduce false-positive kmemleak reports by combining two kmemleak
enhancements that add a second confirmation scan and a configurable
minimum unreferenced scan count module parameter.
- "mm: kmemleak: default min_unref_scans to 2 for verbose kernels"
(Breno Leitao)
Auto-scanning kernels can generate false-positive memory leak reports
on single scans, so this patch defaults min_unref_scans to 2 when
CONFIG_DEBUG_KMEMLEAK_VERBOSE is enabled to require a second
confirming scan.
- "swap_ops updates" (Christoph Hellwig)
Batching I/O for synchronous swap devices causes performance
regressions and filesystem-based swap suffers from double-indirection
overhead. This series resolves both issues by reintroducing per-folio
writes for synchronous swap and allowing filesystems to directly
export their own swap_ops.
- "mm/khugepaged: several cleanups" (Nico Pache)
khugepaged accumulated redundant state-checking patterns and outdated
comments following mTHP integration. Introduce dedicated helpers for
PTE validation and event counting while refreshing the internal
documentation.
- "maple_tree: lock checking and clean ups" (Liam Howlett)
Syzbot reports incorrectly blame memory management exit paths for
locking bugs, maple tree erase operations risk allocation failures
without gfp flags and internal documentation lacks clarity.
Improve lock error detection, update docs, fix race and allocation
edge cases and optimize erase allocations using a fallback to
GFP_KERNEL | GFP_NOFAIL.
* tag 'mm-stable-2026-08-26-15-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (172 commits)
selftests/proc: make proc-maps-race work with READ_IMPLIES_EXEC
memcg: move LRU size accounting on reparenting instead of copying it
mm/vmscan: fix comment logic in balance_pgdat
maple_tree: add helper mas_make_walkable()
maple_tree: avoid extra gap calculation
maple_tree: fix argument name in header
maple_tree: change two GFP flags in tests
maple_tree: document erase and allocations better
maple_tree: avoid mas_erase() and mtree_erase() failures
maple_tree: document that erase may use GFP_KERNEL for allocations
maple_tree: catch race in mas_alloc_cyclic()
maple_tree: add bulk parent set helper
maple_tree: micro optimisation of mas_wr_store_type()
maple_tree: optimise mas_wr_node_store() when not in rcu mode
maple_tree: use prefetched value in mas_wr_store_type()
maple_tree: clarify comments on mas_nomem()
maple_tree: drop MAPLE_ALLOC_SLOTS
maple_tree: drop dead code from mas_extend_spanning_null()
maple_tree: documentation fix
maple_tree: add write lock checking with lockdep sequence numbers
...
|
|
The driver calls dma_set_coherent_mask() but never dma_set_mask(),
leaving the streaming DMA mask at the bus default. On the non-coherent
EN7581 platform (Cortex-A53), this causes the NPU mailbox to hang
after approximately 41 calls when using streaming DMA mappings.
Replace dma_set_coherent_mask() with dma_set_mask_and_coherent() to
set both the streaming and coherent DMA masks, matching standard
driver practice.
Fixes: 6f884eb87a79 ("net: airoha: Fix DMA direction for NPU mailbox buffer")
Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20260814110017.2795022-1-pawlik.dan@gmail.com/
Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20260809152813.585797-1-pawlik.dan@gmail.com/
Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20260805070851.2885888-1-pawlik.dan@gmail.com/
Signed-off-by: Daniel Pawlik <pawlik.dan@gmail.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20260820085941.380401-1-pawlik.dan@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
The stem parser tests isdigit(*(end - 1)) before checking end > start
and so reads one byte before the property name when the name is empty
or all digits. Check the bound first.
Fixes: 611cad720148 ("dt: add of_alias_scan and of_alias_get_id")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5 [Claude Code]
Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260805-nh-of-alias-overlay-v6-1-74f21d440819@nexthop.ai
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
|
|
slip_devs[] stores bare net_device pointers and takes no reference on
them. sl_sync() and sl_alloc() walk that table from slip_open() under
rtnl_lock(), while an entry is dropped by sl_free_netdev(), which
sl_setup() installs as dev->priv_destructor.
priv_destructor is called from netdev_run_todo(), which deliberately
runs with the RTNL semaphore released so that it can sleep while waiting
for the device refcount to drop:
/* Snapshot list, allow later requests */
list_replace_init(&net_todo_list, &list);
__rtnl_unlock();
...
if (dev->priv_destructor)
dev->priv_destructor(dev); /* slip_devs[i] = NULL */
if (dev->needs_free_netdev)
free_netdev(dev);
...
/* Free network device */
kobject_put(&dev->dev.kobj);
So rtnl_lock() does not serialise slip_open() against the teardown at
all. sl_sync() can load slip_devs[i] while the entry is still published
and dereference it after netdev_run_todo() has run the destructor and
released the device:
CPU0 (slip_open) CPU1 (slip_close)
unregister_netdev()
rtnl_unlock()
netdev_run_todo()
__rtnl_unlock()
rtnl_lock()
sl_sync()
dev = slip_devs[i]
priv_destructor(dev)
slip_devs[i] = NULL
kobject_put(&dev->dev.kobj)
/* dev is freed */
sl = netdev_priv(dev)
if (sl->tty || sl->leased) /* use-after-free */
BUG: KASAN: use-after-free in sl_sync drivers/net/slip/slip.c:730 [inline]
BUG: KASAN: use-after-free in slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806
Read of size 1 at addr ffff8880712dac71 by task syz-executor.2/6506
CPU: 2 PID: 6506 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00260-g0c8fc3469765 #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
sl_sync drivers/net/slip/slip.c:730 [inline]
slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806
tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433
tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564
tiocsetd drivers/tty/tty_io.c:2428 [inline]
tty_ioctl+0x5f0/0x1530 drivers/tty/tty_io.c:2712
Allocated by task 6502:
alloc_netdev_mqs+0x98/0xfe0 net/core/dev.c:10719
sl_alloc drivers/net/slip/slip.c:756 [inline]
slip_open+0x36d/0x1210 drivers/net/slip/slip.c:817
tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433
tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564
Freed by task 6497:
device_release+0xa2/0x240 drivers/base/core.c:2507
kobject_put+0x179/0x280 lib/kobject.c:729
netdev_run_todo+0x6c8/0xef0 net/core/dev.c:10509
slip_close+0x166/0x1c0 drivers/net/slip/slip.c:906
tty_ldisc_close+0x113/0x1a0 drivers/tty/tty_ldisc.c:456
tty_ldisc_kill+0x94/0x160 drivers/tty/tty_ldisc.c:614
tty_ldisc_release+0xe3/0x2b0 drivers/tty/tty_ldisc.c:782
tty_release+0xbcc/0xe70 drivers/tty/tty_io.c:1860
Commit e58c19124189 ("slip: Fix use-after-free Read in slip_open") fixed
a different source of stale entries - a device left in slip_devs[] after
slip_open() freed it on the registration error path - and does not
address this race, which is why the report survives it.
Drop the entry from ndo_uninit instead. unregister_netdevice() calls
ndo_uninit under RTNL, before the device is queued to netdev_run_todo(),
so an entry that sl_sync() can still see while holding RTNL belongs to a
device that cannot be freed until RTNL is dropped. sl_free_netdev()
stays only for the slip_open() error path, where register_netdevice()
may have failed before ndo_init and ndo_uninit is then not called
either. Both running for the same device is harmless: they run under
the same RTNL section, so the slot cannot have been reused in between.
This also removes the second symptom of the missing exclusion: a
destructor running after sl_alloc() had already handed the slot out to
another channel used to clear a live entry, so sl_sync() stopped at that
NULL, sl_alloc() returned the same index again, and
register_netdevice() failed with -EEXIST because slN was still there.
Reproduced on x86_64 with several threads looping over
open("/dev/ptmx") + ioctl(TIOCSETD, N_SLIP) + close().
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: 5342b77c4123 ("slip: Clean up create and destroy")
Cc: stable@vger.kernel.org
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Aleksandr Khromov <haa@amicon.ru>
Link: https://patch.msgid.link/20260824100547.164773-1-haa@amicon.ru
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
The stmmac TC filtering rules have recently gained sanity checks to make
sure the passed keys and their respective masks are aligned with the HW
filtering abilities.
The stmmac selftests failed to pass the mask in the match data for L4
filtering tests, and are now failing consistently with -EINVAL :
$ ethtool -t eth1
[...]
23. L4 DA TCP Filtering -22
24. L4 SA TCP Filtering -22
25. L4 DA UDP Filtering -22
26. L4 SA UDP Filtering -22
Let's pass the ip_proto mask in the l4 filtering tests match data. Found
on imx8mp, which now have passing L4 tests :
$ ethtool -t eth1
[...]
23. L4 DA TCP Filtering 0
24. L4 SA TCP Filtering 0
25. L4 DA UDP Filtering 0
26. L4 SA UDP Filtering 0
While at it, initialize the masks and keys to avoid re-using whatever
was on the stack.
Fixes: 5536d7c84363 ("net: stmmac: fix l3l4 filter rejecting unsupported offload requests")
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Link: https://patch.msgid.link/20260825211748.360935-1-maxime.chevallier@bootlin.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
The macros TXGBE_INTR_MISC() and WX_INTR_Q() rely on the standard BIT()
macro to generate interrupt masks based on the queue vector index.
On 32-bit architectures, BIT() evaluates to a 32-bit `unsigned long`.
Since the number of queue vectors can be up to 63 on txgbe devices,
performing a left shift of 32 or more results in an integer overflow
and undefined behavior. This causes incorrect interrupt masking and
unmasking logic for both the queue and miscellaneous interrupts on
32-bit systems.
Fix this by replacing BIT() with BIT_ULL() in these macros. This
ensures that the bitwise shift is always performed safely on a 64-bit
`unsigned long long` type, regardless of the underlying architecture.
Fixes: e37546ad1f9b ("net: wangxun: revert the adjustment of the IRQ vector sequence")
Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Link: https://patch.msgid.link/45F5565CE6AC4329+20260824072119.48399-1-jiawenwu@trustnetic.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
The LED GPIO pins (GPIO3/4/5, mapped to LED2/LED1/LED0) are only ever
configured as outputs once, in .probe(). But .config_init() restarts
the MD32 MCU via en8811h_restart_mcu() on every call after the first
(priv->mcu_needs_restart), and that restart resets buckpbus-mapped MCU
state, including EN8811H_GPIO_OUTPUT. As a result the LED GPIOs fall
back to inputs after the first event that re-triggers .config_init()
(link renegotiation, ifdown/ifup, resume), and the PHY's LEDs stop
reflecting link/activity state even though they worked right after
probe.
Move the GPIO-as-output configuration from .probe() to the end of
.config_init(), so it is reapplied every time the MCU may have been
restarted.
Fixes: 71e79430117d ("net: phy: air_en8811h: Add the Airoha EN8811H PHY driver")
Suggested-by: Mikhail Zhilkin <csharper2005@gmail.com>
Signed-off-by: Vitaliy Sochnev <sochnev.v.74@gmail.com>
Link: https://patch.msgid.link/20260823130638.1166453-2-sochnev.v.74@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
When the driver is handed a burst of packets, the doorbell is deferred
until the end. If the last packet has a huge number of frags, but fails
to linearize, the doorbell will not be written adding latency on TX for
any packets in the ring and holding their DMA mappings until the next
TX. Note that the queue is not stopped, so this issue would delay
pending BDs until the next TX.
This issue was discovered by Sashiko and reading the code verifies that,
while unlikely, it is possible.
Fix this by jumping to tx_free, which replicates the same pre-existing
logic but also writes the doorbell.
Fixes: b91e82129400 ("bnxt_en: Linearize TX SKB if the fragments exceed the max")
Cc: stable@vger.kernel.org
Signed-off-by: Joe Damato <joe@dama.to>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Reviewed-by: Andy Gospodarek <gospo@broadcom.com>
Link: https://patch.msgid.link/20260826000234.2031564-1-joe@dama.to
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
irq_of_parse_and_map() returns 0 when parsing or mapping an IRQ fails.
The current code checks for -ENXIO and therefore does not detect the
failure.
Check for a zero return value and convert it to -ENXIO.
Fixes: 492205050d77 ("net: Add EMAC ethernet driver found on Allwinner A10 SoC's")
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Reviewed-by: Andre Przywara <andre.przywara@arm.com>
Link: https://patch.msgid.link/20260824100901.31675-1-phucduc.bui@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux
Pull hyperv updates from Wei Liu:
- Decrypt netvsc buffer on contiguous direct-map addresses (Kameron
Carr)
- Drop WS2012/2012R2 & Win8/8.1 Hyper-V support (Michael Kelley)
- Use more meaningful errnos for hypercall status code (Hardik Garg)
- Fix lost interrupts on CPU hot-unplug for Hyper-V PCI/MSI (Naman
Jain)
- Reserve more MSHV vectors for Linux root partition (Wei Liu)
* tag 'hyperv-next-signed-20260826' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux:
clocksource: hyper-v: Remove support for stimer interrupts in message mode
scsi: storvsc: Remove support for storvsc protocol of old Hyper-V hosts
hv_netvsc: Remove GPADL teardown special case for old Hyper-V hosts
hv_sock: Remove check for old Hyper-V hosts
Drivers: hv: Remove support for WS2012/2012R2 & Win8/8.1 version of Hyper-V
hv_netvsc: Allocate send/receive buffers using vmbus_alloc_buffer()
Drivers: hv: vmbus: Add vmbus_alloc_buffer()/vmbus_free_buffer() for CoCo VMs
Drivers: hv: vmbus: add vmbus_establish_gpadl_caller_decrypted()
Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition
x86/hyperv: reserve more vectors
PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip
Drivers: hv: Use meaningful errnos for hypercall status codes
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull more thermal control updates from Rafael Wysocki:
"This mostly consists of assorted updates of thermal drivers, including
new hardware support (Airoha AN7583, Qualcomm Master BandGap thermal
monitor, QCom PMIC5 Gen3 ADC), but it also includes two reverts of
recent cosmetic thermal core updates that went against driver core
plans to eliminate class_create():
- Fix missing bitfield include headers in Armada and QCom SPM BMG
drivers (Daniel Lezcano)
- Fix missed file when manually applying a change after a conflict
resolution for the QCom SPMI ADC TM5 Gen3 (Daniel Lezcano)
- Move thermal_zone_device_enable() to the right place in order to
prevent calling it if the thermal zone registration failed (Dan
Carpenter)
- Improve bitfield manipulations on Armada (Bryan B. Lima)
- Remove unneeded 'fast_io' on Sun8i and Armada (Wolfram Sang)
- Fix wrong boundary when clamping the low values in the set_trips()
callback and fix wrong mask when setting the temperature interval
on Airoha (Christian Marangi)
- Make use of the regmap API to support Airoha AN7583 (Christian
Marangi)
- Fix adc_tm5_get_temp() return check value on the QCom SPMI ADC
sensor (Rakesh Kota)
- Fix unbalanced clock enablement when the resume fails on the iMX
driver (Can Peng)
- Add Qualcomm Master BandGap thermal monitor support (Satya Priya
Kakitapalli)
- Add Maili Temperature bindings compatible (Haritha S K)
- Add a devm action to clean hardware interrupts, sampling, and
control registers on Spacemit K1 (Pei Xiao)
- Fix trivial typo in a thermal OF code comment (Marek Vasut)
- Remove unnecessary print on Qcom SPMI ADC driver when a call to
devm_request_threaded_irq() fails as this one already prints a
message (Jishnu Prakash)
- Add support for QCom PMIC5 Gen3 ADC by using auxiliary driver and
shared interrupt with the IIO driver (Jishnu Prakash)
- Make resets optional on MT8196 and add the corresponding property
in the DT bindings (AngeloGioacchino Del Regno)
- Fix clock staying enabled on failing resume operation on Qoriq (Can
Peng)
- Fix wrong closing brace position in thermal library header (Andreas
Haufler)
- Fix low and high trip point validation by moving the check after
the clamp on the spacemit driver (surendra)
- Remove redundant error messages on IRQ request failure (Pan Chuang)
- Add IIO_CONSUMER namespace import to the qcom-spmi-mbg-tm thermal
driver to avoid modpost warnings that would appear after merging
the iio tree against the thermal updates (Nathan Chancellor)
- Revert two recent cosmetic updates of the thermal core conflicting
with driver core plans to eliminate class_create() (Rafael
Wysocki)"
* tag 'thermal-7.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (32 commits)
thermal/drivers/qcom-spmi-mbg-tm: Add module namespace import for IIO_CONSUMER
Revert "thermal/core: Allocate the thermal class dynamically"
Revert "thermal/core: Use the thermal class pointer as init guard"
thermal/drivers/armada: Fix missing bitfields include
thermal/drivers/qcom/spm mbg tm: Fix missing bitfield header
thermal/drivers/qcom: Fix missing spmi adc tm5 gen3 file
thermal/drivers: Remove redundant error messages on IRQ request failure
thermal/drivers/spacemit: Validate clamped trip thresholds
tools/lib/thermal: Fix misplaced extern "C" closing brace
thermal/drivers/qoriq: Disable clock on resume failure
thermal/drivers/mediatek/lvts_thermal: Make reset optional for MT8196
dt-bindings: thermal: mediatek: Make resets optional for MT8196
thermal/drivers/qcom: add support for PMIC5 Gen3 ADC thermal monitoring
iio: adc: qcom-spmi-adc5-gen3: Share SDAM0 IRQ with ADC_TM auxiliary driver
iio: adc: qcom-spmi-adc5-gen3: Remove an unnecessary print
thermal/of: Fix trivial enabled typo
thermal/drivers/spacemit/k1: Add shutdown action and reorder registration order
dt-bindings: thermal: qcom-tsens: Document the Maili Temperature Sensor
thermal/drivers/qcom: Add support for Qualcomm MBG thermal monitoring
dt-bindings: thermal: Add Qualcomm MBG thermal monitor support
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull more power management updates from Rafael Wysocki:
"These fix two issues in the intel_rapl power capping driver, fix a
potential issue in the schedutil cpufreq governor on 32-bit systems,
fix a runtime PM issue related to failing system suspend, and update
the intel_pstate cpufreq driver:
- Fix a kernel panic during PMU unbind in the intel_rapl power
capping driver and sign-extend the PMU delta on counter wraparound
in it to avoid misreporting energy (Sumeet Pawnikar and Yifan Li)
- Unblock runtime PM when device prepare fails that was not done by
mistake (Shibo Zhu)
- Fix possible rate limit overflow on 32-bit systems in the schedutil
cpufreq governor (Hui Su)
- Consolidate HWP P-states initialization in the intel_pstate cpufreq
driver and make that driver avoid using the DESIRED_PERF HWP hint
when the Dynamic Efficiency Control (DEC) is enabled in the
processor to avoid inconsistent behavior (Rafael Wysocki)"
* tag 'pm-7.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
powercap: intel_rapl: Fix kernel panic during PMU unbind
PM: sleep: Unblock runtime PM when device prepare fails
powercap: intel_rapl: Sign-extend the PMU delta on counter wraparound
cpufreq: intel_pstate: Avoid using DESIRED_PERF when DEC is enabled
cpufreq: intel_pstate: Consolidate HWP P-states initialization
cpufreq: schedutil: Fix rate limit overflow
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull more ACPI support updates from Rafael Wysocki:
"These update documentation to reflect recent changes in the upstream
ACPICA project, fix issues in the core ACPI device enumeration code
(one of which has been introduced recently), improve the primary
"physical" device lookup for ACPI device objects in that code, and
update ACPI device drivers:
- Update MAINTAINERS, CREDITS and ACPI subsystem documentation to
reflect recent changes in the upstream ACPICA project (Rafael
Wysocki)
- Prevent the core ACPI enumeration code from combining device
resources that overlap completely in order to avoid resource
conflicts during platform device registration because there are
drivers that expect such resources to be present (Rafael Wysocki)
- Defer device power initialization during ACPI-based device
enumeration to the point when the given device is known to be
present and functional and all of its dependencies have been met
(Peixin Xie)
- Fix bus ID cleanup on device_add() failures during ACPI device
object registration (Hongyan Xu)
- Introduce a new helper function for looking up the primary
"physical" device for a given ACPI device object and update the
core ACPI device enumeration code to use that function (Rafael
Wysocki)
- Protect all battery properties with a separated mutex in the ACPI
battery driver to prevent race conditions from occurring and avoid
evaluating the _BST ACPI control method multiple times in parallel
for the same battery device (Rong Zhang)
- Add DMI quirk for the Razer Blade Pro 17 early 2020 lid switch to
the ACPI button driver (Robin Everaars)
- Convert fixed clock rates in the ACPI driver for AMD SoCs (APD) to
use HZ_PER_MHZ and add a clock frequency for the HJMC01 I2C
controller to it (Hongnan Li and Xiangyang Yu)
- Fix a stack buffer overflow in query_capability() in the ACPI
platform firmware runtime update driver (Anirudh Prasad)"
* tag 'acpi-7.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
ACPI: button: Add DMI quirk for Razer Blade Pro 17 early 2020 lid switch
ACPI: scan: Do not combine resources that overlap completely
ACPI: Update upstream ACPICA repository URL in documentation
ACPI: Update MAINTAINERS entry for ACPICA
ACPI: Add Bob Moore to CREDITS
ACPI: pfr_update: fix stack buffer overflow in query_capability()
ACPI: scan: Defer device power initialization
ACPI: APD: Add clock frequency for HJMC01 I2C controller
ACPI: APD: Convert fixed clock rates to use HZ_PER_MHZ
ACPI: scan: Use acpi_bus_get_primary_device()
ACPI: platform: Use acpi_bus_get_primary_device()
ACPI: bus: Introduce acpi_bus_get_primary_device()
ACPI: scan: fix bus ID cleanup on device_add() failures
ACPI: battery: Protect all properties with a separated mutex
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux
Pull clk updates from Stephen Boyd:
"Mostly the usual clk driver updates and new SoC additions plus
non-critical data fixes for things that weren't used yet.
One thing that's new here in the core is SSC spread spectrum support
(SSC) in the clk provider API. The idea is that DT authors will
configure SSC for certain clks and they'll be configured at clk
provider registration time or when a consumer device is probed,
similar to how we handle assigned clk rates or parents.
On the clk driver side we have Qualcomm adding almost half the diff
because they add support for 4 different SoCs and then a long tail of
other SoCs like Mediatek, Renesas, Rockchip, SpaceMiT, etc. add more
SoC support this time around. Luckily it's mostly clk data for these
new SoCs because the actual clk_ops are already there. Beyond the new
drivers we get all the little fixups for more compilation coverage or
usage of more modern APIs. That all looks normal.
Finally, I kinda buried the lede, I'm bringing on Brian and Jerome to
help out with maintaining the clk subsystem. The current working model
is already semi-distributed in that silicon vendors typically take
care of their drivers and send me pull requests but I'm becoming a
bottleneck for new drivers and core framework review because this has
become a 100% volunteer effort on my part.
Mike is stepping down after all these years (thanks Mike!) and that
jump started the conversation around finding co-maintainers. Brian and
Jerome have graciously offered to help me with the work load, meaning
in the future they'll be sending pull requests and committing directly
to the clk.git tree. They've both been around on the list for a while,
I've met them both in person, and they've been making changes to the
core clk framework along with helping review patches so I'm pretty
confident this will work well.
Core:
- devm_clk_bulk_get_enable() consumer API
- devm_clk_hw_register_composite_pdata() provider API
- Spread Spectrum Clock (SSC) support via DT bindings and provider APIs
- Divider clk rounding improved (and tested)
New Drivers:
- Cix Sky1 audio subsystem (AUDSS)
- UltraRISC DP1000
- MediaTek MT8173 MFG_TOP
- Si549
- Aspeed AST2700 PECI
- Airoha EN7523 PCIe
- Rockchip RV1106
- Mobileye EyeQ7H
- Qualcomm Maili GCC, TCSR, RPMh, and video clks
- Qualcomm Shikra GCC, RPM, GPU, display, and audio clks
- Qualcomm Nord display and graphics clks
- Qualcomm Glymur camera and EVA clks
- Qualcomm Hawi video clks
- Amlogic A9 AO and peripheral clks
- Renesas R-Car X5H (R8A78000) CPG"
* tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (269 commits)
clk: microchip: mpfs: fix regmap_update_bits() mask/val order
clk: visconti: Make sure clk_init_data is fully initialized
clk: ti: Make sure clk_init_data is fully initialized
MAINTAINERS: Add Brian Masney and Jerome Brunet as co-maintainers for clk subsystem
Drop Michael Turquette's clk maintainer entry
clk: ti: composite: resolve parent clocks by DT index, not by name
clk: ti: mux: resolve parent clocks by DT index, not by name
clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate()
dt-bindings: clock: ti,keystone-gate: Convert to DT schema
dt-bindings: clock: ti: Convert APLL clock to DT schema
clk: zynq: pll: Fix kernel-doc after determine_rate() conversion
dt-bindings: clock: ti,clockdomain: Convert to DT schema
dt-bindings: clock: Correct white-space style
clk: samsung: Don't include <linux/mod_devicetable.h>
clk: at91: Read "reg" with helper
clk: renesas: Add R-Car X5H CPG driver
clk: rockchip: rk3576: fix source muxes for SPI0..SPI4
clk: rockchip: Add clock controller for the RV1106
dt-bindings: clock: rockchip: Add RV1106 CRU support
dt-bindings: clock: Document Renesas R-Car X5H Clock Pulse Generator
...
|
|
Merge additional cpufreq updates and one update related to system sleep
for 7.3-rc1:
- Unblock runtime PM when device prepare fails that was not done by
mistake (Shibo Zhu)
- Fix possible rate limit overflow on 32-bit systems in the schedutil
cpufreq governor (Hui Su)
- Consolidate HWP P-states initialization in the intel_pstate cpufreq
driver and make that driver avoid using the DESIRED_PERF HWP hint
when the Dynamic Efficiency Control (DEC) is enabled in the processor
to avoid inconsistent behavior (Rafael Wysocki)
* pm-cpufreq:
cpufreq: intel_pstate: Avoid using DESIRED_PERF when DEC is enabled
cpufreq: intel_pstate: Consolidate HWP P-states initialization
cpufreq: schedutil: Fix rate limit overflow
* pm-sleep:
PM: sleep: Unblock runtime PM when device prepare fails
|
|
Merge updates of assorted ACPI drivers for 7.3-rc1:
- Protect all battery properties with a separated mutex in the ACPI
battery driver to prevent race conditions from occurring and avoid
evaluating the _BST ACPI control method multiple times in parallel
for the same battery device (Rong Zhang)
- Add DMI quirk for Razer Blade Pro 17 early 2020 lid switch to the
ACPI button driver (Robin Everaars)
- Convert fixed clock rates in the ACPI driver for AMD SoCs (APD) to
use HZ_PER_MHZ and add a clock frequency for the HJMC01 I2C
controller to it (Hongnan Li and Xiangyang Yu)
- Fix a stack buffer overflow in query_capability() in the ACPI
platform firmware runtime update driver (Anirudh Prasad)
* acpi-battery:
ACPI: battery: Protect all properties with a separated mutex
* acpi-button:
ACPI: button: Add DMI quirk for Razer Blade Pro 17 early 2020 lid switch
* acpi-soc:
ACPI: APD: Add clock frequency for HJMC01 I2C controller
ACPI: APD: Convert fixed clock rates to use HZ_PER_MHZ
* acpi-pfrut:
ACPI: pfr_update: fix stack buffer overflow in query_capability()
|
|
Merge changes related to primary "physical" device lookup for a given
ACPI device object that include the introduction of a new lookup helper
function and core ACPI device enumeration code updates putting that new
function to use (Rafael Wysocki)
* acpi-bus:
ACPI: scan: Use acpi_bus_get_primary_device()
ACPI: platform: Use acpi_bus_get_primary_device()
ACPI: bus: Introduce acpi_bus_get_primary_device()
|
|
Merge core ACPI device enumeration code changes for 7.3-rc1:
- Prevent the core ACPI enumeration code from combining device
resources that overlap completely in order to avoid resource
conflicts during platform device registration because there are
drivers that expect such resources to be present (Rafael Wysocki)
- Defer device power initialization during ACPI-based device
enumeration to the point when the given device is known to be present
and functional and all of its dependencies have been met (Peixin Xie)
- Fix bus ID cleanup on device_add() failures during ACPI device object
registration (Hongyan Xu)
* acpi-scan:
ACPI: scan: Do not combine resources that overlap completely
ACPI: scan: Defer device power initialization
ACPI: scan: fix bus ID cleanup on device_add() failures
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull another power sequencing update from Bartosz Golaszewski:
"A single tree-wide rename of two of the public functions to better
reflect their actual semantics:
- rename pwrseq_power_on/off() to pwrseq_enable/disable() tree-wide"
* tag 'pwrseq-updates-for-v7.3-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
power: sequencing: rename pwrseq_power_on/off() to pwrseq_enable/disable()
|
|
of_irq_parse_one() raises the refcount of the interrupt controller node
on success, and of_irq_get_affinity() returns without putting it, so
every call past the parse leaks one reference. It is reached from
platform_get_irq_affinity(), used by arm_pmu, arm_spe_pmu and
coresight-trbe.
Put it once irq_populate_fwspec_info() has run: no in-tree
->get_fwspec_info() returns a mask that lives in the node.
Fixes: 5404f5c06dd4 ("of/irq: Add interrupt affinity reporting interface")
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20260826112234.1033974-1-fuad.tabba@linux.dev
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
|
|
The way power sequencing works means that a call to pwrseq_power_on()
does not necessarily result in the pwrseq target being powered-on at
that time: it may have already been powered on before. Similarly: a call
to pwrseq_power_off() does not have to result in an actual powering off
of resources: there may still be other users that requested a power-on
before.
We will also introduce the concept of "non-controllable" pwrseq targets
soon which further increases the disconnect between the naming
convention and the actual semantics.
What consumers of pwrseq descriptors actually do is: they *vote* for a
powering on of a given target or retract that vote. These operations
could be called get/put in line with runtime PM but this could become
confusing since we already provide pwrseq_get/put() for a different
purpose. pwrseq_vote_on/off() also have been rejected as unusual in
the tree.
Change the name of the two functions to pwrseq_enable/disable() which
better reflects their purpose and semantics and also mirrors other
enable-counted resources like regulators and clocks. No functional change
intended.
If at any point users need to know *when* the exact power event happens,
we can provide that information in the form of a notifier.
Acked-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Acked-by: Alessio Belle <alessio.belle@imgtec.com> # imagination
Link: https://patch.msgid.link/20260731-pwrseq-vote-rename-v3-1-44e60b8be053@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux
Pull hwspinlock updates from Bjorn Andersson:
"Propagate single-lock registration failures from radix_tree_insert(),
making caller sanity checks effective.
Update the hwspinlock MAINTAINERS repository URL to the current
remoteproc tree"
* tag 'hwlock-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux:
hwspinlock: propagate errno when registering single lock
MAINTAINERS: Update remoteproc repo url for hwspinlock
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux
Pull rpmsg updates from Bjorn Andersson:
"Fix a GLINK endpoint teardown deadlock during driver detach and order
SMEM FIFO reads after the remote-updated availability check.
Prevent duplicate rpmsg character endpoint teardown when remoteproc
shutdown races with RPMSG_DESTROY_EPT_IOCTL.
Replace unsafe string and sysfs formatting helpers, and correct the
unregister_rpmsg_driver() return value documentation"
* tag 'rpmsg-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux:
rpmsg: glink: smem: order FIFO read after availability check
rpmsg: glink: fix deadlock in endpoint destroy during driver detach
rpmsg: char: Check for ongoing chrdev destroy
rpmsg: glink: Replace strcpy() with strscpy()
rpmsg: core: Fix incorrect return value documentation
rpmsg: Replace sprintf() with sysfs_emit() in sysfs show
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux
Pull remoteproc updates from Bjorn Andersson:
"Add a remoteproc driver and binding for AMD MicroBlaze/V soft cores
executing from dual-port BRAM, with clock and reset control and
support for firmware without a resource table.
Introduce a generic Qualcomm PAS service with SCM and OP-TEE backends,
and migrate the PAS, MSS, and WCNSS remoteproc drivers to it. Add Nord
ADSP and CDSP support, Eliza CDSP support, Maili ADSP/CDSP bindings,
and late-attach SoCCP support for Kaanapali, Hawi, Maili, and Glymur.
Enable BAM-DMUX child devices for PAS modems and fix PAS memory
protection, handover, shutdown, and resource lifetime handling.
Harden remoteproc lifecycle handling by attaching asynchronously,
stopping crashed processors, synchronizing crash work with removal,
and forcing shutdown before device resources are released. Reallocate
resources during attach recovery and fix several reference and
error-path leaks.
Add Xilinx R5 crash detection and move RPU start and stop sequencing
into the platform firmware driver. Consolidate write-combining
carveout mapping callbacks, use correct I/O-memory accessors, and
share optional ELF resource-table handling across drivers.
Convert the TI Wakeup M3 binding to DT schema, correct Qualcomm and
generic remoteproc bindings, and harden resource-table iteration
against signed-offset out-of-bounds accesses"
* tag 'rproc-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (60 commits)
remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()
remoteproc: replace BSD blurb with SPDX identifier in rsc_table.h
remoteproc: replace BSD blurb with SPDX identifier in remoteproc.h
remoteproc: fix coding style issues in remoteproc.h
MAINTAINERS: add rsc_table.h to remoteproc entry
remoteproc: qcom: pas: Add Nord ADSP and CDSP support
dt-bindings: remoteproc: qcom,nord-pas: Document Nord PAS
remoteproc: qcom: pas: Drop unused dtb_mem_region field
remoteproc: qcom: pas: Map/unmap subsystem region before auth_and_reset
remoteproc: qcom: pas: Fix the PAS context creation placement
remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check
remoteproc: qcom: annotate mem_region fields with __iomem
arm64: dts: qcom: eliza: Add fallback compatible for ADSP remoteproc
dt-bindings: remoteproc: qcom,milos-pas: Move Eliza ADSP to SM8550 schema
remoteproc: qcom: pas: Add Eliza CDSP support
dt-bindings: remoteproc: qcom,sm8550-pas: Add Eliza CDSP compatible
remoteproc: qcom: q6v5: Request shutdown if crash is triggered host-side
remoteproc: Force shutdown during device removal
remoteproc: Prevent crash handling to race with rproc_del()
remoteproc: Allow shutdown of crashed processors
...
|
|
Commit ebf1d03dab96 ("iio: inkern: Use namespaced exports") in the iio
tree restricts certain exported core functions that a driver added in
commit c3dce117333c ("thermal/drivers/qcom: Add support for Qualcomm MBG
thermal monitoring") from the thermal tree uses, causing modpost to
warn (or error without CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS):
ERROR: modpost: drivers/thermal/qcom/qcom-spmi-mbg-tm.ko: module uses symbol 'devm_iio_channel_get' from namespace 'IIO_CONSUMER', but does not import it.
ERROR: modpost: drivers/thermal/qcom/qcom-spmi-mbg-tm.ko: module uses symbol 'iio_read_channel_processed' from namespace 'IIO_CONSUMER', but does not import it.
Add the IIO_CONSUMER namespace import to clear up the error.
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Tested-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://patch.msgid.link/20260812-qcom-spmi-mbg-tm-ns-modpost-error-v1-1-d849390d2714@kernel.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
|
|
This reverts commit 34f54003643e ("thermal/core: Allocate the thermal
class dynamically") that went against driver core changes aiming at the
elimination of class_create() [1].
No intentional functional impact.
Link: https://lore.kernel.org/linux-pm/2026082411-flask-rewire-434f@gregkh/
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/4761117.LvFx2qVVIh@rafael.j.wysocki
|
|
This reverts commit 499274d078d0 ("thermal/core: Use the thermal class
pointer as init guard") because it depends on another commit that needs
to be reverted.
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/6301222.lOV4Wx5bFT@rafael.j.wysocki
|
|
Pull kvm updates from Paolo Bonzini:
"ARM64:
- Add support for 'slot' based PMU events, paired with new UAPI that
compels the user to select a specific PMU implementation
- Lazy save/restore of vCPU state for pKVM, along with various fixes
and cleanups to the management of vCPU state between the untrusted
host and pKVM hypervisor
- Disable traps of EL1 registers for nested hypervisors when
FEAT_NV2p1 is present, guaranteeing that EL2-specific register bits
are stateful in the EL1 counterpart
- Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the
scope of those instructions remains 'in host' (i.e. L1
kernel/userspace)
- Pile of fixes for the management of the VNCR pseudo-TLB, such as
under-invalidations and races with concurrent TLBIs on other vCPUs
- Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a
runtime-patched constant, allowing the same data to be shared with
pKVM prior to dropping host privileges
- Considerable pile of LLM-assisted fixes around the shop but mostly
in the VGIC, our in-kernel generator of bugs (and sometimes
interrupts)
LoongArch:
- Advertise already-supported capabilities
- Some bug fixes about timer and MMIO
- Some hardening about interrupt injection
- Replace kvm_err() with kvm_pr_unimpl()
- Add FPU/LSX/LASX test cases for selftests
RISC-V:
- Svadu/Zicfiss/Zicfilp FWFT support for Guest
- Use try_cmpxchg for IMSIC MRIF RMW
- More arch-specific tracepoints in KVM RISC-V
- Eager page splitting when enabling dirty logging
- Optimize hfence request handling for SMP Guests
- Improve dirty log clearing by skipping zero bits in mask
- Guard HFENCE range loops against overflow
- CPU PM notifiers in KVM RISC-V for non-retentive idle states
- Fix kernel-mode vector context save/restore for Guest
s390:
- Fixes for vfio-ap
- Fixes for the gmap rework
- Fixes for vsie
- AI triggered fixes all over
- diag9c tracing
- code move preparation for the additional arm64 support
- enable CONTEXT_ANALYSIS
x86:
- Perform spring cleaning on x86.{c,h} and asm/kvm_host.h, by adding
regs.c (the kvm_cache_regs.h => regs.h is already applied) and
msrs.{c,h}, and moving relevant code out of x86.c
- Split kvm_mmu in three parts, respectively to describe the format
of page tables, walking the guest page tables and building the page
tables. Always use the same page table walker kvm->arch.gva_walk as
the entry point to convert a guest's virtual address, where the
previous code used two different kvm_mmu structs depending on
whether the walk included nested EPT/NPT or not. Make page fault
vmexits reuse the permission checking machinery that is used for
guest page faults. This is both a cleanup and a baby step towards
supporting XS/XU memory permissions
- Document some of the "fun" gotchas with the APIC base when creating
IRQCHIPs on x86
- Remove a defunct masterclock update from kvm_xen_shared_info_init().
It could result in incorrect kvmclock due to triggering an
unnecessary switch to/from masterclock mode
- Skip Xen runstate time updates if time has effectively gone
backwards, so that the guest doesn't report 100% steal time for
a very, very long time
- Drop KVM's runtime updates of the Xen PV timing CPUID leaf, as KVM
was updating the wrong sub-leaf, and upstream KVM will soon provide
all the information needed by userspace to populate the CPUID field
itself
- Fix a bug where KVM would walk a newly created rmap without holding
the rmap lock (or mmu_lock) during aging
- Fix a bug where aging TDP MMU SPTEs could clobber FROZEN SPTEs
- Fix a variety of #DB priority bugs
- Fix a class of races related to enabling Hyper-V emulation on a
vCPU after the vCPU is visible to the rest of KVM
- Use static calls for nested virtualization ops
- Move more KVM-internal code out of x86's kvm_host.h
- Enumerate support for a variety of Zhaoxin instructions that don't
require explicit virtualization
- Fix missing EFER validation bugs, including in the KVM_SET_SREGS*
path
- Harden kvm_vcpu_map() against double-mapping and thus leaking
references
- Misc fixes and cleanups, e.g. for largely benign syzkaller splats
x86 (Intel):
- Zero a vCPU's entry in VMX's Posted Interrupt Descriptor table used
for IPI virtualization when the vCPU is freed, to fix a
use-after-free where hardware will write to a freed vCPU's PID
- Service local TLB flushes on a failed nested VM-Enter to fix a bug
where KVM could miss a TLB on a future, successful VM-Enter with
the same L2 VPID
- Cap the maximum value shoved into the VMX Preemption Timer to
workaround an erratum that affects all existing Intel CPUs that
support CPUID 0x15
- Fix VPID virtualization bugs where KVM would fail to flush hardware
TLBs
- Harden the TDX "populate" ioctls against bad input, and to prepare
for supporting in-place private<=>shared conversion
x86 (AMD):
- Forcefully invalidate SNP VMSA pages if their backing guest_memfd
page is zapped/invalidated, e.g. due to a PUNCH_HOLE in response to
a Page-State Change request
- Remove a dying VM from the GA Log notifier list before the VM is
actually destroyed, to fix a potential use-after-free
- While FOLL_WRITE was needed in the past to trigger CoW unsharing,
nowadays FOLL_LONGTERM does that already even without FOLL_WRITE,
and in fact, get_user_pages() actually disallows FOLL_WRITE
together with FOLL_LONGTERM. So don't pass FOLL_WRITE when
registering encrypted memory regions, i.e. when pinning SEV/SEV-ES
guest memory, to fix a regression with file-backed memory
introduced by KVM's (correct) usage of long-term pins
(This was reviewed by mm maintainers; for more information, see
commit ee1a586dd1fa "KVM: SEV: Drop FOLL_WRITE for encrypted region
registration")
- Allocate full pages for SEV/SEV-ES {DE,EN}CRYPT ops on SNP-enabled
hosts to fix a data corruption issue due to the PSP driver
assigning to-be-written pages to firmware (as required by the SNP
specs)
- Unconditionally intercept ICBEP so that KVM generates the correct
guest RIP when handling an ICEBP-induced TASK_SWITCH #VMEXIT
- Harden the SNP "populate" ioctls against bad input, and to prepare
for supporting in-place private<=>shared conversion
Generic:
- Remove kvm_debugfs_dir if kvm_init() fails after creating KVM's
debugfs
- Add a per-VM bitmap to track which vCPU IDs have been "claimed" but
for which the vCPU isn't yet online, and use the bitmap to reject
duplicate IDs before calling into arch code. This allows arch code
to consume vcpu_id without having to worry about cross-vCPU
clobbering (at least s390 and x86 have had related bugs)
- Rework the so called "prepare" and "invalidate" guest_memfd hooks
to prepare for in-place private<=>shared conversion, and clean up a
few warts along the way
Selftests:
- Automatically allocate a full page for L2 guest stacks on x86
instead of requiring test-specific L1 guest code to carve out a
portion of the L1 stack for L2 usage, and to ensure the L2 stack
also adheres to the x86-64 calling convention ABI
- Add a selftest to verify {Guest,Host}-Only behavior in x86's
mediated PMU
- Clean up nested SVM's handling of GPRs on L2<=>L1 transitions,
reuse the functionality for nested VMX, and drop the ucall hack
that was fudging around the lack of GPR switching on nVMX
- Add a stress test to verify KVM doesn't clobber/drop #PF state,
e.g. CR2, across save/restore, including when L2 is active
- Add a test to verify KVM_CREATE_VM accepts exactly what is reported
by KVM_CAP_VM_TYPES
- Misc selftests fixes and cleanups
- Fix several issues with seeding the pRNG, and rework the pRNG APIs
to that the pRNG can be sanely used in host code, not just guest
code
- Add an IRQ test to validate virtual IRQ deliverty for IRQs wired up
via KVM_IRQFD + KVM_SET_GSI_ROUTING, with optional support for
triggering IRQs via writes to an assigned VFIO device
- Add syscall wrappers to assert success on a variety of pthreads and
CPU affinity APIs
- Set vCPU pthread affinity as early as possible to reduce contention
issues that were surfaced by PREEMPT_LAZY, which result in runtimes
of over a minute on large hosts, versus the expected ~5 seconds
- Rework the PMU counters test to run each testcase using a single VM
with many vCPUs for each sub-testcase, instead of using a unique VM
for each sub-testcase. This cuts the runtime by ~20x
Miscellaneous:
- MAINTAINERS updates for vfio-ap, guest_memfd, kvm-x86. Mostly
representing the status quo more accurately, but also... welcome
David Hildenbrand as guest_memfd reviewer!"
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (413 commits)
KVM: arm64: Validate GICv5 timer PPIs before claiming ownership
KVM: arm64: vgic: Reject out-of-range GICv5 PPI IDs
KVM: arm64: vgic: Prevent speculative SPI array underflow
KVM: arm64: vgic: Free gic_kvm_info on initialization failure
KVM: arm64: Avoid mismatched accesses to 'struct kvm_nvhe_init_params'
s390/vfio-ap: Fix NULL deref in status_show() during queue probe
s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed
s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap
s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove
s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object
s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects
s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL
s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove
RISC-V: KVM: fix vcpu vector context handling for kernel-mode vector
riscv: vector: allow non-preemptible kernel-mode vector with IRQs off
riscv: vector: refactor riscv_v_start_kernel_context
KVM: s390: gmap: Make prefix handling optional
KVM: s390: gmap: Make CMMA optional
KVM: s390: gmap: Make storage keys optional
KVM: s390: Prepare gmap for a second KVM implementation
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Pull TTY / serial driver updates from Greg KH:
"Here is the "big" set of tty and serial driver updates for 7.3-rc1.
Not really all that much happened this development cycle for this
subsystem, changes in here are:
- removal of the ipwireless driver as it's no longer used or needed
- new 8250_mxpcie driver added
- qcom serial driver updates and additions
- vt mode validation addition
- lots of other small serial driver updates and additions
All of these have been in linux-next for weeks with no reported issues"
* tag 'tty-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (97 commits)
serial: imx: serialize imx_uart_ports[] lifetime
tty: clear cdev pointer after cdev_add() failure
tty: skip cdev_del() when no cdev is registered
serial: core: clear freed pointers on uart_register_driver() failure
serial: core: do fallible allocations before the console can be registered
serial: 8250_mxpcie: implement rx_trig_bytes callbacks via MUEx50 RTL
serial: 8250_mxpcie: introduce per-port private data structure
serial: 8250: allow UART drivers to override rx_trig_bytes handling
serial: 8250_mxpcie: add break support for RS485 using MUEx50 features
serial: 8250: allow low-level drivers to override break control
serial: 8250_mxpcie: support serial interface mode switching
serial: 8250_mxpcie: speed up TX using memory-mapped FIFO window
serial: 8250_mxpcie: speed up RX using memory-mapped FIFO window
serial: 8250_mxpcie: add custom handle_irq callback
serial: 8250_mxpcie: offload XON/XOFF flow control to MUEx50 hardware
serial: 8250_mxpcie: enable automatic RTS/CTS flow control
serial: 8250_mxpcie: enable enhanced mode and program FIFO trigger levels
serial: 8250: add Moxa MUEx50 UART port type
serial: 8250: split Moxa PCIe serial board support out of 8250_pci
serial: qcom-geni: Use geni_se_set_perf_level() for baud rate perf level
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB / Thunderbolt updates from Greg KH:
"Here is the big set of USB and Thunderbolt driver updates for 7.3-rc1.
Lots of driver work for new devices and systems, and many other minor
fixes and updates. Included in here are:
- Thunderbolt subsystem driver updates and additions
- typec driver updates and additions
- usb gadget fixes all over the place, seems like people are finally
paying attention to these drivers for some reason
- xhci driver updates and fixes based on lots of reports
- usb-serial driver updates and additions
- new device ids
- other minor USB driver updates and fixes
All of these have been in linux-next for a while with no reported issues"
* tag 'usb-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (163 commits)
usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
usb: typec: hd3ss3220: fix VBUS regulator error message
usb: usbfs: fix use-after-free of usb_device in usbdev_release()
usb: gadget: u_audio: Fix use-after-free on sound card disconnect
usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition
usb: gadget: f_tcm: keep port count until LUN teardown completes
usb: usbtest: disable dynamic ID support
usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive()
USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion
usb: gadget: snps_udc_plat: clean up PHY on probe deferral
usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
usb: gadget: f_fs: Fix Use-After-Free in AIO error path
usb: gadget: f_fs: Prevent deadlock during ep0 read loop
usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
usb: gadget: midi2: remove default configfs groups on teardown
usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()
usb: typec: thunderbolt: Disable work before freeing tbt on remove
usb: xhci: Handle bogus TRB pointers in Missed Service Error events
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
Pull staging driver updates from Greg KH:
"Here is the big set of drivers/staging/ updates for 7.3-rc1.
Nothing major in here at all, just lots of tiny coding style cleanups,
refactoring, and minor "fixes" as found by some tools. Included in
here
- loads of coding style and refactoring in the rtl8723bs wireless
driver
- minor greybus driver cleanups
- minor sm750fb driver cleanups
- other even smaller driver cleanups
All of these have been in linux-next for a weeks with no reported
issues"
* tag 'staging-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (186 commits)
staging: rtl8723bs: add blank line after declaration
staging: rtl8723bs: remove unused enumerations
staging: rtl8723bs: use !psta instead of comparison to NULL
staging: rtl8723bs: Replace custom RotR1 macro with ror16
staging: rtl8723bs: Remove multiple assignments
staging: rtl8723bs: fix several line spaces in wifi.h
staging: rtl8723bs: remove redundant goto in rtw_free_xmitframe()
staging: rtl8723bs: rename Restore_DM_Func_Flag functions to avoid CamelCase
staging: rtl8723bs: rename Save_DM_Func_Flag functions to avoid CamelCase
staging: rtl8723bs: wrap line over 100 characters
staging: rtl8723bs: remove unnecessary whitespace
staging: rtl8723bs: remove extra blank lines in rtw_qos.h
staging: rtl8723bs: remove redundant ReadChipVersion8723B wrapper
staging: rtl8723bs: remove debug fields from hal_com_data
staging: rtl8723bs: remove 'rf_chip' from struct hal_com_data
staging: rtl8723bs: remove unused spinlock 'SdioTxFIFOFreePageLock'
staging: rtl8723bs: remove unused 'UsbRxHighSpeedMode' from hal_com_data
staging: rtl8723bs: hal: remove unused readings from the chip
staging: rtl8723bs: remove unused 'bNeedIQK' from struct hal_com_data
staging: rtl8723bs: remove unused 'bIQKInitialized ' from hal_com_data
...
|
