For bitmap this change makes no difference, because destructors are
called synchronously.
List type however calls them via call_rcu() so accounting decrement can
happen after list_set_flush() set ext_size to 0.
'set->elements = 0' can be removed for the same reason in the list type
case, it calls 'set->elements--' for each element.
Fixes: 9e41f26a50 ("netfilter: ipset: Count non-static extension memory for userspace")
Suggested-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
If list_set_uadd() calls list_set_replace() to swap an expired entry,
the element count remains the same, therefore the increment must be elided.
Fixes: 702b71e7c6 ("netfilter: ipset: Add element count to all set types header")
Link: https://sashiko.dev/#/patchset/20260806101947.2802-1-fw%40strlen.de
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
nf_flow_table_iterate() only treats original-direction tuple nodes as
owning entries. Publishing the original node first lets GC observe and
free a flow while flow_offload_add() is still inserting the reply node.
Publish the reply node first and the original node last so GC never
sees a partially installed flow.
KASAN can trigger slab-use-after-free read and write reports in the
flowtable/rhashtable path (rht_deferred_worker, jhash, flow_offload_del,
flow_offload_lookup, etc.).
Fixes: ac2a66665e ("netfilter: add generic flow table infrastructure")
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Assisted-by: Codex:gpt-5
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
In nft_flow_rule_offload_abort(), WARN_ON_ONCE(err) is triggered on every
error during rollback, including -ENOMEM. Memory allocation failures are
expected under low-memory conditions and do not indicate a kernel bug.
Trace for example:
nft_flow_offload_chain() // FLOW_BLOCK_BIND
nft_flow_block_chain()
nft_chain_offload_cmd()
nft_block_offload_cmd()
->ndo_setup_tc()
nsim_setup_tc()
flow_block_cb_setup_simple()
flow_block_cb_alloc() // fails to -ENOMEM
The warning was reproduced on the 5.10 stable kernel under memory pressure
via fault injection, but the underlying bug exists in mainline as well,
as demonstrated by the ENOMEM trace above. The following splat was
triggered during nf_tables transaction processing:
WARNING: CPU: 0 PID: 8567 at net/netfilter/nf_tables_offload.c:532 nft_flow_rule_offload_abort net/netfilter/nf_tables_offload.c:532 [inline]
WARNING: CPU: 0 PID: 8567 at net/netfilter/nf_tables_offload.c:532 nft_flow_rule_offload_commit+0x971/0xcd0 net/netfilter/nf_tables_offload.c:591
Modules linked in:
CPU: 0 PID: 8567 Comm: syz-executor.0 Not tainted 5.10.260-syzkaller #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:nft_flow_rule_offload_abort net/netfilter/nf_tables_offload.c:532 [inline]
RIP: 0010:nft_flow_rule_offload_commit+0x971/0xcd0 net/netfilter/nf_tables_offload.c:591
Call Trace:
nf_tables_commit+0x3bd/0x4bd0 net/netfilter/nf_tables_api.c:8604
nfnetlink_rcv_batch+0xb1e/0x1f20 net/netfilter/nfnetlink.c:509
nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:579 [inline]
nfnetlink_rcv+0x3b3/0x420 net/netfilter/nfnetlink.c:597
netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
netlink_unicast+0x6cd/0xa00 net/netfilter/af_netlink.c:1340
netlink_sendmsg+0x906/0xe10 net/netfilter/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:651 [inline]
__sock_sendmsg+0x155/0x190 net/socket.c:663
____sys_sendmsg+0x705/0x870 net/socket.c:2379
___sys_sendmsg+0x100/0x170 net/socket.c:2433
__sys_sendmsg+0xe9/0x1c0 net/socket.c:2462
do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x67/0xd1
Change the condition to WARN_ON_ONCE(err && err != -ENOMEM) so that
warnings are only emitted for unexpected errors. This aligns with the
common kernel practice of not warning on -ENOMEM.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: 63b48c73ff ("netfilter: nf_tables_offload: undo updates if transaction fails")
Signed-off-by: Alexey Velichayshiy <a.velichayshiy@ispras.ru>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
While the outer IP header is already pulled into the skb head,
we must be careful and revalidate the embedded headers after
reading them from the skb frags to prevent out-of-bounds
access.
One such place reported by Sashiko is ip_vs_nat_icmp() where
local process can change the ihl field and after
skb_ensure_writable() we can see larger value which is a
problem for the ip_send_check(cih) calls.
Add check to drop the packet if the ihl field is changed.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Link: https://sashiko.dev/#/patchset/20260730183506.87473-1-ja%40ssi.bg
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the
quoted original request before passing it to icmp_send(). However,
IPCB(skb)->opt still describes the outer IPv4 header.
A timestamp option in the outer header can therefore leave an offset
that points into the quoted transport header after the rebase.
__ip_options_echo() treats a byte at that stale location as the option
length and copies it into the fixed-size option storage on the
__icmp_send() stack, causing a stack out-of-bounds write.
Clear the stale option metadata after resetting the network header.
Keep the remaining control block fields, including the ingress
interface used by the ICMP response path.
Fixes: f2edb9f770 ("ipvs: implement passive PMTUD for IPIP packets")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol Codex:gpt-5.5-cyber
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Co-developed-by: David Lee <david.lee@trailofbits.com>
Signed-off-by: David Lee <david.lee@trailofbits.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
sashiko reports: "nfnl_log_net_exit() calls nf_log_unset(), which
clears the logger pointer without an RCU grace period. Immediately after,
ops_free_list() frees the per-net state while concurrent packets might
still be executing nf_log_packet() under rcu_read_lock()."
Clear the pointer via .pre_exit to make sure rcu readers have completed
before pernet storage is free'd. The change in nf_log_syslog.c is only
done for consistency: it doesn't use pernet data.
Link: https://sashiko.dev/#/patchset/20260731151806.849724-1-pablo%40netfilter.org
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
TCP and SCTP conntrack paths can emit invalid-packet logs while ct->lock
is still held.
When invalid logging is routed to nfnetlink_log and conntrack export is
enabled, the log path can re-enter conntrack netlink glue and dump the
same conntrack again. Protocol attribute dumping may take ct->lock, so
logging while holding that lock can deadlock.
Defer the TCP invalid logs by storing only the minimal log context while
ct->lock is held and emitting the log after unlocking. Also make the TCP
timeout-lowering invalid path return whether a log is needed, then emit
that log after unlocking.
Do the same for the SCTP invalid state-transition log that can be reached
while ct->lock is held.
Add a lockdep assertion to nf_ct_l4proto_log_invalid() so future callers
that log invalid conntracks while holding ct->lock are caught outside TCP
and SCTP as well.
Fixes: 628d694344 ("netfilter: conntrack: reduce timeout when receiving out-of-window fin or rst")
Fixes: d9a6f0d0df ("netfilter: conntrack: prepare tcp_in_window for ternary return value")
Fixes: f71cb8f45d ("netfilter: conntrack: sctp: use nf log infrastructure for invalid packets")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Zihan Xi <zihanx@nebusec.ai>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
IPVS configuration paths update destination availability while connection
accounting updates destination overload state. The two independent states
share dest->flags, so their read-modify-write updates can race and lose one
another.
Keep OVERLOAD in flags, where the preceding patch serializes its updates
with dst_lock, and move AVAILABLE to cflags. This keeps configuration-
controlled availability out of the scheduler hot cacheline until a
scheduler needs to check it. It also prevents availability updates from
clobbering overload state.
The destination status bits are not exposed through the IPVS sockopt or
netlink interfaces, so keep their definitions in the internal IPVS header.
Readers can still observe stale destination state; this does not provide a
cross-field snapshot.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Link: https://lore.kernel.org/all/8913381c-1e02-35c7-0ec4-61de5a12fd35@ssi.bg/
Assisted-by: Claude-Code:GLM-5.2
Suggested-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
The upper/lower connection thresholds for dest can be changed,
so use ip_vs_dest_update_overload() to properly update the
dest overload flag.
The thresholds were not limited, fit them in the 0 .. INT_MAX
range as already done in ipvsadm.
As the thresholds are also read when connections are created
and expired, use WRITE_ONCE/READ_ONCE to access them.
As the lower threshold is optional, use (u - (u >> 2)) to
calculate the 75% default value based on the upper threshold
by preserving the integer rounding, as suggested by Yizhou Zhao.
Trigger flag update when totalconns reaches one of the
thresholds and use dst_lock to serialize the updating.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Replace the inactconns dest counter with totalconns, now
inactconns can be obtained from totalconns - activeconns.
This reduces the atomic inc/dec ops for TCP/SCTP from
6 to 4 if the connection is established and then closed.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
A bridge nftables ct zone set rule can attach a conntrack template to
an skb before nf_ct_bridge_pre() sees it. For non-IPv4 and non-IPv6
EtherTypes, nf_ct_bridge_pre() currently overwrites skb->_nfct with
IP_CT_UNTRACKED without releasing the existing template reference.
That makes the per-cpu template, and any temporary templates allocated
for concurrent use, unreachable and leaks memory until the host runs out
of slab.
Reset the skb conntrack state before marking the frame untracked so the
existing template reference is dropped on the non-IP path.
Fixes: 3c171f496e ("netfilter: bridge: add connection tracking system")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
__ip_set_put_byindex() resolved the index to a set pointer under RCU,
then took ip_set_ref_lock in __ip_set_put() to decrement set->ref.
ip_set_swap() holds that same lock while swapping both the ip_set_list
slots and the two sets' ref counters, so it can interleave between the
dereference and the lock acquisition, leaving the caller to decrement a
set whose reference already moved to the other index and hit
BUG_ON(set->ref == 0). list_set_gc() reaches this from timer softirq,
which the nfnl mutex does not serialize against swap: an expiring
list:set member calls list_set_del() -> ip_set_put_byindex() while
IPSET_CMD_SWAP runs on the referenced sets.
Resolve the index and decrement under ip_set_ref_lock, as ip_set_swap()
already does, keeping the refcount tied to the index rather than to a
stale set pointer.
kernel BUG at net/netfilter/ipset/ip_set_core.c:685!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:ip_set_put_byindex (net/netfilter/ipset/ip_set_core.c:870)
Call Trace:
<IRQ>
list_set_del (net/netfilter/ipset/ip_set_list_set.c:159)
set_cleanup_entries (net/netfilter/ipset/ip_set_list_set.c:181)
list_set_gc (net/netfilter/ipset/ip_set_list_set.c:578)
call_timer_fn (kernel/time/timer.c:1748)
__run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2374)
run_timer_softirq (kernel/time/timer.c:2405)
</IRQ>
Kernel panic - not syncing: Fatal exception in interrupt
Fixes: 9076aea765 ("netfilter: ipset: Increase the number of maximal sets automatically")
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
nvmet_tcp_map_data() reads the host-controlled 32-bit sgl->length
and, for the in-capsule offset descriptor (type 0x01), checks it
against port->inline_data_size before use. Any other SGL descriptor
type -- including the non-inline transport SGL data-block descriptor
(type (NVME_TRANSPORT_SGL_DATA_DESC << 4) | NVME_SGL_FMT_TRANSPORT_A,
the type a real host uses for out-of-capsule writes) skips that check
entirely and falls straight through to:
cmd->req.sg = sgl_alloc(len, GFP_KERNEL, &cmd->req.sg_cnt);
with len taken directly from the wire, unbounded up to 4 GiB.
nvmet_req_init() only parses the command and never inspects
sgl->length, and nvmet_check_transfer_len() -- the only other place
transfer_len is validated -- runs later, from req->execute(), after
the allocation has already happened. For a write command the target
responds with an R2T and parks the command waiting for the host to
send the data; if the host (or an unauthenticated peer that simply
never follows up) never does, the sgl_alloc() buffer stays resident
for the life of the command. NVMe/TCP has no mandatory authentication
in the default configuration, so any peer able to reach the target
portal and complete a Fabrics connect can drive this with a single
crafted command, repeatable across queues and connections for
amplification. This is unbounded kernel memory allocation
triggered by a remote, effectively unauthenticated peer.
Validate len against the same NVMET_TCP_MAXH2CDATA ceiling this file
already uses to bound per-PDU H2C data, for every SGL descriptor type,
before doing any allocation. This closes the gap for the non-inline
descriptor while leaving the existing, tighter inline_data_size check
in place for the in-capsule case.
Runtime-verified on a v6.19 KASAN stand: with this bound in place, a
crafted write command carrying an oversized non-inline SGL length is
rejected before sgl_alloc() runs, where the same request previously
drove an unbounded ~256 MiB kernel allocation (up to 4 GiB) that
stayed resident pending an R2T the host never satisfies.
Fixes: 872d26a391 ("nvmet-tcp: add NVMe over TCP target driver")
Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Ibrahim Hashimov <security@auditcode.ai>
Assisted-by: AuditCode-AI:2026.07
Signed-off-by: Keith Busch <kbusch@kernel.org>
When an NFS server grants a delegation in an OPEN reply,
nfs_inode_set_delegation() records it on the client. However, three
of its error flows return without sending DELEGRETURN.
A delegation can be relinquished only by DELEGRETURN (RFC 8881
Section 20.2.4), so dropping one silently leaves the server believing
the client still holds it. If the server happens to recall that
delegation, the client answers CB_RECALL with NFS4ERR_BADHANDLE
because it has no record of the stateid. The server revokes the
delegation and moves it onto its cl_revoked list, because the client
never sends the FREE_STATEID that would drain it. Every subsequent
SEQUENCE reply then carries SEQ4_STATUS_RECALLABLE_STATE_REVOKED,
and the client's state manager loops issuing TEST_STATEID across its
delegations without ever clearing the condition.
The window is easy to reach now that a server offers a write
delegation on any write OPEN: a delegation recalled for one opener
races a re-open that the server answers with a fresh write
delegation.
Instead of dropping it, hand the delegation back during these error
flows.
Fixes: ade04647dd ("NFSv4: Ensure we honour NFS_DELEGATION_RETURNING in nfs_inode_set_delegation()")
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
xprtsock replaces and restores sk->sk_data_ready and
sk->sk_write_space on live sockets with plain stores, and
xs_udp_do_set_buffer_size() invokes sk->sk_write_space via a plain
load. These callback pointers are shared with generic socket and
protocol paths that may read or invoke them concurrently, so xprtsock
needs the same READ_ONCE()/WRITE_ONCE() callback visibility contract
that the validated 4022 family applied elsewhere.
When SUNRPC takes over an AF_LOCAL, UDP, or TCP socket and later
restores the lower-socket callbacks during teardown, another CPU may
still hold an earlier callback snapshot. The plain replace/restore
pattern leaves the same visibility hole as the validated 4022 family,
so a stale snapshot can still invoke xs_data_ready() or
xs_udp_write_space() after the live callback fields have already been
restored to the lower-socket handlers.
Use WRITE_ONCE() for the shared sk_data_ready and sk_write_space
stores in xs_local_finish_connecting(), xs_udp_finish_connecting(),
xs_tcp_finish_connecting(), and xs_restore_old_callbacks(). Use
READ_ONCE() for the direct sk_write_space invocation in
xs_udp_do_set_buffer_size(). This matches the required callback
visibility contract while leaving adjacent sk_state_change and
sk_error_report handling unchanged.
Fixes: a246b0105b ("[PATCH] RPC: introduce client-side transport switch")
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
rpcb_register_inet4() and rpcb_register_inet6() store the result of
rpc_sockaddr2uaddr() into map->r_addr without checking it for NULL.
rpc_sockaddr2uaddr() returns NULL when its final kstrdup() fails, and
the unchecked NULL is then carried into the synchronous RPCBPROC_SET
encode path: rpcb_register_call() -> rpc_call_sync() ->
rpcb_enc_getaddr() -> encode_rpcb_string(), whose first statement is
strlen(string), dereferencing NULL and oopsing the kernel.
The crash reproduces under failslab on v6.12; with KASAN the NULL
dereference surfaces as a fault on the shadow of address zero:
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000000 [#1] PREEMPT SMP KASAN
RIP: 0010:strlen (lib/string.c:409)
Call Trace:
encode_rpcb_string (net/sunrpc/rpcb_clnt.c:890)
rpcb_enc_getaddr (net/sunrpc/rpcb_clnt.c:910)
rpcauth_wrap_req_encode (net/sunrpc/auth.c:745)
call_encode (net/sunrpc/clnt.c:1966)
__rpc_execute (net/sunrpc/sched.c:952)
rpc_run_task (net/sunrpc/clnt.c:1243)
rpc_call_sync (net/sunrpc/clnt.c:1272)
rpcb_v4_register (net/sunrpc/rpcb_clnt.c:500)
svc_generic_rpcbind_set
nfsd_rpcbind_set
svc_register
svc_setup_socket
svc_addsock
write_ports
nfsctl_transaction_write
vfs_write
The crash is reachable when an in-kernel RPC service (nfsd, lockd,
nfs-callback) registers with the local rpcbind under enough memory
pressure for the small GFP_KERNEL kstrdup() in rpc_sockaddr2uaddr() to
fail. The asynchronous getport path already handles this exact failure
mode by returning -ENOMEM; only the two register helpers omit the check.
Mirror that handling: bail out with -ENOMEM when rpc_sockaddr2uaddr()
returns NULL, before the address is fed into the encoder.
Fixes: d77385f238 ("SUNRPC: Fix rpc_sockaddr2uaddr")
Reported-by: Xiang Mei <xmei5@asu.edu>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
DQS is a typical SPI memory signal used to help with reading the data on
the bus at high speeds (especially in DTR mode) by avoiding clock
skews. The chip generates a clock signal synchronized with its data
output fronts, also called data strobe.
SPI NOR and SPI NAND cores must set this flag in order to indicate to
other layers that DQS is available.
Create a getter and a setter to reach this capability.
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://patch.msgid.link/20260810-winbond-nand-next-phy-tuning-v3-1-a97c3a61e675@bootlin.com
Signed-off-by: Mark Brown <broonie@kernel.org>
- Initial M3 Pro, Max and Ultra device trees, which are responsible for
the majority of the diffstat. These include CPU cores, interrupt
controller, power state, watchdog, serial pin/gpio controller, i2c and
the boot framebuffer. They are now on par with the base M3 device
trees.
- HWMON sensors for M1/M2
- "pmgr-misc" nodes for M1/2 Pro/Max/Ultra which saves about 1W of power
on these machines. The corresponding driver and dt-binding are part of
the Apple SoC driver changes tag for this cycle.
Signed-off-by: Sven Peter <sven@kernel.org>
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQS3vz815OHsEaWy0u9EEX0kKnUe6QUCanYC3AAKCRBEEX0kKnUe
6TjhAP48U0pnqD5rIzUKiXvrsf0kYgbUg4fuvxYTKAfTU2WXvgEApHwB/aS9W+EC
AzBgYldnbJlVg5MhsBqG49l8+B7rPwo=
=odXF
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmp5/PkACgkQmmx57+YA
GNnWORAAlI7DAtGIPtoHaJNSQGVCyylEPgY23ZpIB6vraFnsBhHDdNY+sBEd1jI1
2M388XJmJ9dAbKf51pAAWiOtmW7TuuKclZWxekAZ37i+LBeL2E4034l/jLAR8ZHJ
P37ogQlOpR7C/YOV2Ro4wQ3qST2OjjANOIYCzCp390ujzqsvBPPVo5U9sF+pVSCQ
vHtXiPFck9CmxQAEfkg8XULhwc7NYLWg2aNtJ9YPmHI7+IGSjJgiXaX6JsZdPJwz
tjCrOtCWJ3RVOT18vdD1TnDBQdrpk1yquGQkk/LMEZhqXAplprKdasqegdIvgUyC
qXGZ62wiWKAg6QRlIQDCOw4Uj7mgjOeay83XgIOA+H4vRYd11SM0cMqaXlfn8DeH
n0Wqt35X0/pNVIEUEIvCmPRdMw+qSAjr4JN005eEoG76Q4Ouaf9xvqvvbtnWWgql
VYV5vSFKbkhhWuJcIwifB7d3eEk321dJHvdwuSpexLlFdM8nVu+1gHHeUn+VHBYC
xXgv9K5ou8qvIeGHXqxFYoj6lvm1jwGijgc51ROHEfPuZmBDhr3Cin2H+I+imv6q
+fc/aAX0MPoTgkdx9W/+qPZql73W+vmhlu0eYGbhSAOmtm68prrdDu6ckOaXVRbF
w8lvAFd7Wa/RBulDZxieMzU/W6Z+FZ3BSBj4H1EqqfHrp7CoaPg=
=azbS
-----END PGP SIGNATURE-----
Merge tag 'apple-soc-dt-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux into soc/dt
Apple SoC DTS changes for 7.3
- Initial M3 Pro, Max and Ultra device trees, which are responsible for
the majority of the diffstat. These include CPU cores, interrupt
controller, power state, watchdog, serial pin/gpio controller, i2c and
the boot framebuffer. They are now on par with the base M3 device
trees.
- HWMON sensors for M1/M2
- "pmgr-misc" nodes for M1/2 Pro/Max/Ultra which saves about 1W of power
on these machines. The corresponding driver and dt-binding are part of
the Apple SoC driver changes tag for this cycle.
Signed-off-by: Sven Peter <sven@kernel.org>
* tag 'apple-soc-dt-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux: (22 commits)
arm64: dts: apple: Initial T6030 (M3 Pro) device trees
arm64: dts: apple: Initial T603[124] (M3 Max and Ultra) device trees
dt-bindings: pwm: apple,s5l-fpwm: Add t6030 and t6031 compatibles
dt-bindings: i2c: apple,i2c: Add t6030 and t6031 compatibles
dt-bindings: power: apple,pmgr-pwrstate: Add t6030 and t6031 compatibles
dt-bindings: arm: apple: apple,pmgr: Add t6030 and t6031 compatibles
dt-bindings: interrupt-controller: apple,aic2: Add apple,t6031-aic3 compatible
dt-bindings: interrupt-controller: apple,aic2: Invert #interrupt-cells condition
dt-bindings: arm: apple: Add M3 Pro/Max/Ultra devices (T603x)
arm64: dts: apple: t60xx: jxxx: Add device-specific SMC hwmon sensors
arm64: dts: apple: t8112: jxxx: Add device-specific SMC hwmon sensors
arm64: dts: apple: t8103: jxxx: Add device-specific SMC hwmon sensors
arm64: dts: apple: t602x: Add common SMC hwmon sensors
arm64: dts: apple: t600x: Add common SMC hwmon sensors
arm64: dts: apple: t8112: Add common SMC hwmon sensors
arm64: dts: apple: t8103: Add common SMC hwmon sensors
arm64: dts: apple: Add common SMC hwmon infrastructure
arm64: dts: apple: t602x: Add SMC hwmon node
arm64: dts: apple: t600x: Add SMC hwmon node
arm64: dts: apple: t8103: Add SMC hwmon node
...
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Qualcomm Arm32 DeviceTree updates for v7.3
Add initial device tree support for the MSM8926-based Sony Xperia M2 and
the MSM8226-based Motorola Moto G2 (2014).
Add touchscreen, Bluetooth pin configuration, NFC, and multicolor status LED
support to the MSM8974-based HTC One M8 device tree.
Add the coreriver,tc360-touchkey compatible touchkey node to the MSM8960
Samsung ExpressATT device tree and label PM8921 XOADC channels.
Consolidate shared IPA properties in the SDX55 device tree.
* tag 'qcom-arm32-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux:
ARM: dts: qcom: msm8926-sony-xperia-yukon-eagle: add initial device tree
ARM: dts: qcom: msm8960: expressatt: Add coreriver,tc360-touchkey
ARM: dts: qcom: msm8226: Support Motorola Moto G2 (2014)
ARM: dts: qcom: pm8921: add labels for ADC channels
ARM: dts: qcom: sdx55: consolidate IPA properties
ARM: dts: qcom: msm8974pro-htc-m8: add touchscreen
ARM: dts: qcom: msm8974pro-htc-m8: add Bluetooth pins
ARM: dts: qcom: msm8974pro-htc-m8: add NFC support
ARM: dts: qcom: msm8974pro-htc-m8: add status LEDs
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
These patches fix some issues which were noticed in some drivers where
caches were not fully resynced after suspend. Drivers are supposed to
be sorting the table of register defaults they provide to the core and
the core was relying on that but it turns out there are many cases where
this does not happen, it's easy to get wrong when using named defines
for registers rather than numbers. It is more robust to remove the
requirement for sorting and instead have the core ensure everything it
needs sorting is sorted so do that.
There will be patches during the merge window sorting the tables in
drivers since it is more efficient to do that but this will just be a
minor performance win rather than a correctness fix.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmp5yXcACgkQJNaLcl1U
h9AdhQf+OuDvmAGl6VpkbUBQqK/E9YO7mXqEOKGpbhi5e4CDUN+pY1HsMIgChMC7
e2gvLNwUY1zYUlon2RzXAYJ3fV/JmIZmz/8qp65VN2qljltAS+PT47qYpZb0WKKa
RAGdUOCthmaNwGou/ofO/MpAqRbgXY89H3AlBBRfR5jGsVJTqyvMsKVCR2h/X7SN
7rlEV6/a9gubTGrZEXaNEl6SvCsI1JmTidQHO4A9ROvo38alrYU4fMCgbSJ/W7cA
U5oBbO0qIixgR/xGNkMrLMKoIRfXElJ2he9idOQDcfbAMzlUeyZkj2xHqF9gHNRs
Zx/l0QrCagcLjUNVDMhpgE85Q+dfqQ==
=7QwV
-----END PGP SIGNATURE-----
Merge tag 'regmap-fix-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap
Pull regmap fixes from Mark Brown:
"These fix some issues which were noticed in some drivers where caches
were not fully resynced after suspend. Drivers are supposed to be
sorting the table of register defaults they provide to the core and
the core was relying on that but it turns out there are many cases
where this does not happen, it's easy to get wrong when using named
defines for registers rather than numbers. It is more robust to remove
the requirement for sorting and instead have the core ensure
everything it needs sorting is sorted so do that.
There will be patches during the merge window sorting the tables in
drivers since it is more efficient to do that but this will just be a
minor performance win rather than a correctness fix"
* tag 'regmap-fix-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
regcache: Sort the local copy of an unsorted reg_defaults array
regcache: Use a consistent sort for defaults table
Several non-functional (white-space and style) changes to match with DTS
coding style as reported by recent dt-check-style tool. Goal is to get
to no `dt-check-style --mode strict` warnings over time.
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmp0RMQQHGtyemtAa2Vy
bmVsLm9yZwAKCRDBN2bmhouD1wL5D/9pJn/QpXraZ9Mo6aY80EO6Ufun1uz+f2lM
Jp9V/O3cUFoc3+EgGcp4oh7JbwGdfEnad2pVm+CQjpSZL6uuBNCHO9WtIcGeL63t
k9xL1/7KttPmZBSCNfB2AUKFPPyhbUr+Fk3CjYUR5mAxsa5PgivJZSIE+JQ8RN6t
rByp6qip9cyfguuQLi7xVUou5n5nQcSJPqntCsgVm0Wk1nD/gyTxuyxDp2SGt9Rs
U9CobD6YuQi8TGpjFtBNALq98isZmuAF75mgYz2RHEtjYKmXGDl/a4TZ7K3295Qc
/ZkeLvnmWaLVnoQAaGKlb3cuEgvuuZumFThPj0jwmVQn153B6UPN/M9TVfrqgpG4
Scbh2+CEb3DGRCjsmEaDtT5qZnb+xv42wW79V/MDqVQaDN8kiUxAaT0/DNPaBCJN
A3J9BnJgEN6qXDt5ZTMo7OqQB2GUra4SOoWD+6F92zWBLHyAagfc39V9IlTA1I2b
i0kfmYPRr3ooqYf2eNQPnuftUqPqlvWeJKK+tczn1GPQnaDmcvIC6V0M8qTiW3CK
UJlogvgQqYfap2Cq9ZhjyYrVXZ0H+VqlSw2xCoezdggDQBmzP9K3JsvMe8DmCRXK
uOoKEXLrAJ5krINZuVbY0L9VYH4lYtV5Kof0WXPumyYmmpIObQrGtipJKdc4CFSQ
ymzW0L79Aw==
=GPP3
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmp59ekACgkQmmx57+YA
GNkT8RAAkONJBU/GkXcmT+RclfTwZ19FZO9Pq7p7gtOLkJg1GrE1//gIcG8stpp6
1Z9OPoF3PIonN36O8in7PARSmQlltqojSFdJ6lA26g9U8DwsMTQ9g7VKgewCxMDi
23zFVCOpKxSHsQlw8nGpIWKcrceUyTsZlyPG3mete95LeoJncxr63uf9NJOGTfWq
gYtC5/amVCyl2ZvXE8YTaWVXNZBa8D/9Ea4y5ZtoLT37vSqkRjE1bFo2qWfTLT5Q
Iex7iormr+jnIP+FSeMNWQomWpeKuE7O5NhkLrygCZsguPe5pgDDx11GYFZW541N
OKhtYe02A7PVnfkapwRG2vPchytSCWVVzcRnVfzNEqjIec2WjZQ+BkeSD3uLL+lu
DyZGAKmuWcMIdFQ6xsZolRpqkHb2CLnmMbiUDf5mNisa3uqJHqHyxv4jft7mRK2k
tNawkqFsOnf440yP8pPYB8FIP+79+LTaU4rIg54X8aC0SXpj8ImARG8ud10pwy7C
6Jj8nBGHqTFQgKrVfwC53MGw876/iW09ZK0ZFBdCwmH5MtKBX7cTA8Y1Tk8DYvdt
dVKUQFAKeK80J/M52ARQPcG+BPVagej6cSyvp2cMUvinhxGczrW3SpGn3nhG2iZK
QmPjhGUydB20d+Gah6e2YP7sH0MZn66E/FyodhuRgGTURqZjpKM=
=mVJT
-----END PGP SIGNATURE-----
Merge tag 'dt64-cleanup-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-dt into soc/dt
Minor improvements in arm64 DTS for v7.3
Several non-functional (white-space and style) changes to match with DTS
coding style as reported by recent dt-check-style tool. Goal is to get
to no `dt-check-style --mode strict` warnings over time.
* tag 'dt64-cleanup-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-dt:
arm64: dts: Correct white-space style
arm64: dts: amd: seattle: Remove useless xgbe DTSI include
arm64: dts: amd: seattle: Remove useless clocks DTSI include
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
platform_get_irq_optional() returns a positive IRQ number on success or
a negative error code on failure. For an optional IRQ, -ENXIO indicates
that no IRQ is available, while other errors should be propagated.
Propagate errors such as -EPROBE_DEFER and -EINVAL instead of continuing
probe without the IRQ.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://lore.kernel.org/r/20260810082606.42623-1-phucduc.bui@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
platform_get_irq_optional() returns a positive IRQ number on success or
a negative error code on failure. For an optional IRQ, -ENXIO indicates
that no IRQ is available, while other errors should be propagated.
Instead of only checking for -EPROBE_DEFER, propagate all error codes
returned by platform_get_irq_optional() other than -ENXIO, so that
failures are properly reported to the caller.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://lore.kernel.org/r/20260810105101.55945-1-phucduc.bui@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
platform_get_irq_optional() returns a positive IRQ number on success or
a negative error code on failure. For an optional IRQ, -ENXIO indicates
that no IRQ is available, while other errors should be propagated.
Propagate errors such as -EPROBE_DEFER and -EINVAL instead of continuing
probe without the IRQ.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://lore.kernel.org/r/20260807081652.38692-4-phucduc.bui@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
platform_get_irq_optional() returns a positive IRQ number on success or
a negative error code on failure. For an optional IRQ, -ENXIO indicates
that no IRQ is available, while other errors should be propagated.
Propagate errors such as -EPROBE_DEFER and -EINVAL instead of continuing
probe without the IRQ.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://lore.kernel.org/r/20260807080447.35479-2-phucduc.bui@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
platform_get_irq_optional() returns a positive IRQ number on success or
a negative error code on failure. For an optional IRQ, -ENXIO indicates
that no IRQ is available, while other errors should be propagated.
Instead of only checking for -EPROBE_DEFER, propagate all error codes
returned by platform_get_irq_optional() other than -ENXIO, so that
failures are properly reported to the caller.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://lore.kernel.org/r/20260807081652.38692-3-phucduc.bui@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
platform_get_irq_optional() returns a positive IRQ number on success or
a negative error code on failure. For an optional IRQ, -ENXIO indicates
that no IRQ is available, while other errors should be propagated.
Instead of only checking for -EPROBE_DEFER, propagate all error codes
returned by platform_get_irq_optional() other than -ENXIO, so that
failures are properly reported to the caller.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://lore.kernel.org/r/20260807081652.38692-2-phucduc.bui@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
'struct watchdog_ops' and 'struct watchdog_info' are not modified in this
driver.
Constifying these structure moves some data to a read-only section, so
increases overall security, especially when the structure holds some
function pointers.
On a x86_64, with allmodconfig:
Before:
======
text data bss dec hex filename
7319 1768 0 9087 237f drivers/watchdog/apple_wdt.o
After:
=====
text data bss dec hex filename
7543 1544 0 9087 237f drivers/watchdog/apple_wdt.o
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/99019b7e560c2d9c087be340e68f9cce4db1988e.1786283336.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Commit 645ad41da8b2 ("watchdog: pretimeout: Add "dump" pretimeout
governor") added the "dump" watchdog pretimeout governor, but restricted
it to built-in code because trigger_all_cpu_backtrace() was not exported
to loadable modules.
Now that CPU backtrace APIs are supported for loadable kernel modules
via cpumask_backtrace(), convert WATCHDOG_PRETIMEOUT_GOV_DUMP to
tristate. This allows kernels to deliver the pretimeout governor as a
loadable kernel module.
Signed-off-by: Mayank Rungta <mrungta@google.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org>
Acked-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Link: https://lore.kernel.org/r/20260730-export-cpu-backtrace-apis-v1-2-bace8e1cb817@google.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Currently, CPU backtrace functions cannot be called from loadable
modules because the underlying helper arch_trigger_cpumask_backtrace()
is not exported.
Instead of exporting arch_trigger_cpumask_backtrace() individually
across every supported architecture, introduce and export a common
helper, cpumask_backtrace(), in lib/nmi_backtrace.c. Update the four
inline CPU backtrace macros in include/linux/nmi.h to route through this
centralized helper.
Signed-off-by: Mayank Rungta <mrungta@google.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Link: https://lore.kernel.org/r/20260730-export-cpu-backtrace-apis-v1-1-bace8e1cb817@google.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
scripts/kernel-doc -none reports:
Warning: drivers/watchdog/booke_wdt.c:158 function parameter 'data'
not described in '__booke_wdt_disable'
__booke_wdt_disable() is invoked through on_each_cpu(), so it takes a
void * argument that it does not use. Its kernel-doc comment does not
describe the parameter at all.
Document it as unused.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com>
Link: https://lore.kernel.org/r/20260730060617.7-3-bbnpreetsingh@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Some firmwares describe WDAT registers inside memory ranges marked as
ACPI NVS in the E820 map, failing with -EBUSY during probe, leaving the
hardware watchdog unserviced and triggering periodic system resets.
This issue was observed on a OnLogic Karbon 524 device (when watchdog is
enabled in BIOS):
wdat_wdt wdat_wdt: error -EBUSY: can't request region for resource [mem 0x63df7a98]
wdat_wdt wdat_wdt: probe with driver wdat_wdt failed with error -16
Check whether the region falls inside ACPI NVS before requesting it and,
if so, map it without reservation.
Signed-off-by: Renê de Souza Pinto <rene@renesp.com.br>
Link: https://lore.kernel.org/r/20260804103958.3684195-1-rene@renesp.com.br
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Add driver support for the Watchdog Timer (WDT) integrated in
Nuvoton MA35D1 SoC. This driver provides standard watchdog functionality,
including timeout configuration, ping, and system reset support via
the watchdog framework.
Signed-off-by: Zi-Yu Chen <zychennvt@gmail.com>
Link: https://lore.kernel.org/r/20260804070351.1846165-3-zychennvt@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Add device tree binding documentation for the watchdog timer (WDT)
controller found on Nuvoton MA35D1 SoC.
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Zi-Yu Chen <zychennvt@gmail.com>
Link: https://lore.kernel.org/r/20260804070351.1846165-2-zychennvt@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Report bootstatus on IPQ5332 and IPQ9574. These SoCs use different
restart-reason values from IPQ5424 for watchdog reset and powerunder
reset events, so add separate match data for them and use it when
decoding the restart reason.
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260728-qcom_wdt_powerunder-v1-2-de8d9e964e7d@oss.qualcomm.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
On IPQ platforms, identify the restart reason as POWERUNDER, similar to
CARDRESET, and expose it via the bootstatus sysfs interface.
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260728-qcom_wdt_powerunder-v1-1-de8d9e964e7d@oss.qualcomm.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
