Commit graph

1,481,701 commits

Author SHA1 Message Date
Srinivasan Shanmugam
84298acf1c drm/amd/display: Fix redundant GPUVMEnable checks in dcn6 flip schedule
Inside dcn6_calculate_flip_schedule(), GPUVMEnable is already checked in
the outer if block. But the same GPUVMEnable is checked again in two
inner if blocks inside it. Since GPUVMEnable is always true at that
point, the inner else branches that assign meta_row_height are never
reached.

Remove the redundant inner GPUVMEnable checks and directly assign
dpte_row_height, which is always the correct value here.

Fixes: 7f7d7ea1fa ("drm/amd/display: Add new sources for DCN6")
Reported-by: Dan Carpenter <error27@gmail.com>
Cc: Roman Li <roman.li@amd.com>
Cc: Alex Hung <alex.hung@amd.com>
Cc: Tom Chung <chiahsuan.chung@amd.com>
Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: George Zhang <george.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25 18:23:50 -04:00
Srinivasan Shanmugam
fdc290ff4a drm/amd/display: Fix wrong bytes-per-pixel value for dml2_422_packed_10
The pixel format dml2_422_packed_10 needs BytePerPixelDETY set to
8.0/3. But it was accidentally placed in the wrong group that sets it to
  4, so the correct value was never used.

This caused wrong DET buffer size and bandwidth calculations whenever
this format was used.

Fix it by moving dml2_422_packed_10 out of the wrong group so it gets
the correct value of 8.0/3.

Fixes: 7f7d7ea1fa ("drm/amd/display: Add new sources for DCN6")
Reported-by: Dan Carpenter <error27@gmail.com>
Cc: Roman Li <roman.li@amd.com>
Cc: Alex Hung <alex.hung@amd.com>
Cc: Tom Chung <chiahsuan.chung@amd.com>
Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: George Zhang <george.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25 18:23:05 -04:00
Vladimir Marioukhine
6aa530642f drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore
Both create_queue_cpsch() and create_queue_nocpsch() unconditionally
call mqd_mgr->restore_mqd() when a CRIU restore is in progress
(qd != NULL), with no NULL guard. On any system where restore_mqd is
not implemented for the given queue type, a user holding
CAP_CHECKPOINT_RESTORE can trigger a kernel NULL pointer dereference
and panic the machine by issuing KFD_IOC_CRIU_OP_RESTORE with a
crafted queue restore object. Note that checkpoint_mqd is likewise
unimplemented on GFX12, so no legitimate CRIU image can reach this
path — only a hand-crafted restore payload.

Add a NULL guard for restore_mqd immediately after mqd_mgr is
resolved, unwinding via the existing error labels and returning
-EOPNOTSUPP if the callback is not implemented. This mirrors the
existing checkpoint_mqd guard in checkpoint_mqd().

Fixes: 48f0bdf4e3 ("drm/amdkfd: Added MQD manager files for GFX12.")
Cc: stable@vger.kernel.org
Signed-off-by: Vladimir Marioukhine <Vladimir.Marioukhine@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25 18:22:22 -04:00
Prike Liang
a04ea08ddb drm/amdgpu/userq: fix lock missing for userq fence error set
amdgpu_userq_fence_driver() and amdgpu_userq_fence_driver_destroy()
don't acquire the dma_fence spinlock, so locking the dma_fence lock
before test the signaled state and set error state to avoid missing
lock assert error.

Signed-off-by: Prike Liang <Prike.Liang@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25 18:22:14 -04:00
Xiaogang Chen
520e345ffe drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
When migration vm range is hole at cpu side(MIGRATE_PFN_MIGRATE set +
MIGRATE_PFN_VALID unset) driver still allocates device pages. There is no
dma map of src pages and migration. j is 0 and svm_migrate_copy_memory_gart()
will return an uninitialized r. That can trigger out_free_vram_pages to drop
all VRAM just set up.

Initialize r and only call the last svm_migrate_copy_memory_gart if j > 0.

Current code postponed the last page to the final copy. This patch flushes on
the last page when reach to the end of current drm_buddy_block; avoids another
svm_migrate_copy_memory_gart.

Cc: stable@vger.kernel.org
Signed-off-by: Xiaogang Chen <xiaogang.chen@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25 18:22:00 -04:00
Xiaogang Chen
960c4a8069 drm/amdkfd: Fix error path at svm_migrate_copy_to_ram
If page migration from device to sys ram fails for some reasons driver needs
release and unlock allocated system pages. To do that driver should use page
physical address, or pfn, then get struct page*. Current driver uses dma
address(for adev) that is not correct with IOMMU enabled, or even in general.

The patch releases and unlocks allocated system pages based on where migration
failed by struct page* of sys ram pages. Also dma_unmap correspodent system
ram pages at error path.

Cc: stable@vger.kernel.org
Signed-off-by: Xiaogang Chen <xiaogang.chen@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25 18:21:32 -04:00
Timur Kristóf
9e8bcfde00 drm/amd/display: Log details when failing to register HPD IRQ
This should help diagnose HPD IRQ related issues in the future.

Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Link: https://patch.msgid.link/20260821215059.312868-2-timur.kristof@gmail.com
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25 18:21:24 -04:00
Timur Kristóf
52536ce677 drm/amd/display: Fix HPD consideration for VGA/LVDS connectors on DCE
After a refactor that landed in Linux 7.0,
DC now crashes when it is initialized on GPUs
that have a VGA or LVDS connector. This is because
these connectors have no HPD so the hpd_gpio is NULL
and therefore DC takes the code path meant for
DCN 4.2+ which sets irq_source_hpd = 255 that
causes the subsequent code to try to register
the HPD interrupt, which fails, and causes
a crash.

This commit should be backported to Linux 7.0 and newer.

Cc: stable@vger.kernel.org
Cc: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com>
Cc: Roman Li <roman.li@amd.com>
Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5490
Fixes: def3488eb0 ("drm/amd/display: refactor HPD to increase flexibility")
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Link: https://patch.msgid.link/20260821215059.312868-1-timur.kristof@gmail.com
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25 18:20:00 -04:00
Xiang Liu
b309005666 drm/amdgpu: clamp the isolation index for rings outside a partition
adev->isolation[] has one slot per partition, but a ring that is not
assigned to one keeps AMDGPU_XCP_NO_PARTITION, which is ~0, so indexing
the array with it is out of bounds. SDMA submissions hit this on both
the isolation enforcement and the VM flush path and trip UBSAN.

Fall back to the first slot the way the cleaner shader path already
does, and stop taking the address before the ring type check that makes
it relevant.

Cc: stable@vger.kernel.org
Signed-off-by: Xiang Liu <xiang.liu@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25 18:19:30 -04:00
Sunday Clement
40ba09e111 drm/amdkfd: Reject zero-sized AQL queue allocations after size halving
KFD_IOC_ALLOC_MEMORY_OF_GPU with flag
KFD_IOC_ALLOC_MEM_FLAGS_AQL_QUEUE_MEM and size=1 triggers the AQL
wraparound workaround (size >>= 1), reducing size to 0. The resulting
zero passes through PAGE_ALIGN(0) = 0 without validation, bypassing the
per-process VRAM quota check in reserve_mem_limit()
(vram_used + 0 > vram_available is always false).

The fix adds post-halving zero-size validation in the primary
allocation path (amdgpu_amdkfd_gpuvm.c). The check happens after size
halving but before reserve_mem_limit(), and uses err_alignment_size
error path to properly clean up the allocated kgd_mem structure and
mutex.

Cc: stable@vger.kernel.org
Signed-off-by: Sunday Clement <Sunday.Clement@amd.com>
Reviewed-by: Alex Deucher <Alexander.Deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25 18:18:44 -04:00
David Rosca
2ee9836545 drm/amdgpu: Fix VCE 3 ring align_mask
The largest frame is 20 dwords, so 0xf mask is too small.
This was always wrong, but we were lucky with the VCE_CMD_END
commands inserted after fence and vm_flush.

Fixes: 8897ea8c76 ("drm/amdgpu: Implement insert_end for VCE 3")
Cc: stable@vger.kernel.org
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: David Rosca <david.rosca@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25 18:17:35 -04:00
David Belanger
fb62f7f031 drm/kfd: Add CU occupancy support to GFX12.1
Port changes from GFX9 to GFX12.1 mostly as-is.
Minor changes to register access code.

Assisted-by: Claude:Sonnet 4.6
Signed-off-by: David Belanger <david.belanger@amd.com>
Reviewed-by: Sreekant Somasekharan <Sreekant.Somasekharan@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25 18:17:32 -04:00
David Belanger
fb1e65a80d drm/kfd: Add CU occupancy support to GFX12
Port changes from GFX9 to GFX12 mostly as-is.
Minor changes to register access code.

Assisted-by: Claude:Sonnet-4-6
Signed-off-by: David Belanger <david.belanger@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Sreekant Somasekharan <Sreekant.Somasekharan@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25 18:17:29 -04:00
David Belanger
290e0be2ab drm/kfd: Add CU occupancy support to GFX11
Port changes from GFX9 to GFX11 mostly as-is.
Minor changes to register access code.

Assisted-by: Claude:Sonnet-4-6
Signed-off-by: David Belanger <david.belanger@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Sreekant Somasekharan <Sreekant.Somasekharan@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25 18:17:21 -04:00
Bob Zhou
6760f5cb12 drm/amdgpu: avoid force-completing uninitialized UVD rings
uvd_v7_0_sw_init() does not initialize the UVD decode ring for an
SR-IOV VF. However, amdgpu_uvd_resume() unconditionally force-completes
the decode ring when restoring its fence sequence.

Skip fence completion when the fence driver is not initialized.

Fixes: 0a33b11d26 ("drm/amdgpu: mark force completed fences with -ECANCELED")
Cc: stable@vger.kernel.org
Signed-off-by: Bob Zhou <bobzhou2@amd.com>
Acked-by: Leo Liu <leo.liu@amd.com>
Acked-by: Frank Min <Frank.Min@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25 18:14:53 -04:00
Jesse Zhang
d36fbf8218 drm/amdgpu/userq: lock and validate wptr BOs before reading their GPU offset on restore
On resume, amdgpu_userq_vm_validate_and_restore_queue() updates each queue's
wptr GPU address via amdgpu_bo_gpu_offset().

WPTR BOs are VM-mapped, but each BO has its own reservation object and is not
implicitly covered by the VM validation path here. This can leave offset reads
without proper BO locking/placement state and trigger WARN_ONs.
  ------------[ cut here ]------------
  WARNING: amdgpu_object.c:1486 at amdgpu_bo_gpu_offset+0x75/0xa0 [amdgpu], CPU#3: kworker/3:1/116
  Workqueue: events amdgpu_userq_restore_worker [amdgpu]
  RIP: 0010:amdgpu_bo_gpu_offset+0x75/0xa0 [amdgpu]
  Call Trace:
   <TASK>
   amdgpu_userq_vm_validate_and_restore_queue+0x629/0x960 [amdgpu]
   amdgpu_userq_restore_worker+0xa6/0x180 [amdgpu]
   process_scheduled_works+0xa6/0x460
   worker_thread+0x13c/0x290
   kthread+0xfb/0x140
   ret_from_fork+0x1b6/0x2b0
   ret_from_fork_asm+0x1a/0x30
   </TASK>
  ---[ end trace 0000000000000000 ]---
  ------------[ cut here ]------------
  WARNING: amdgpu_object.c:1485 at amdgpu_bo_gpu_offset+0x9a/0xa0 [amdgpu], CPU#2: kworker/2:1/127
  Workqueue: events amdgpu_userq_restore_worker [amdgpu]
  RIP: 0010:amdgpu_bo_gpu_offset+0x9a/0xa0 [amdgpu]

Add each queue's WPTR BO to the drm_exec ww context and validate it to its
allowed placement before the later offset update.

v2:
- Clarify that WPTR BOs are VM-mapped (fix incorrect "not part of VM" wording). (Christian)
- Describe both parts of the fix: lock BO reservations in drm_exec and
  validate BO placement before offset reads.

Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25 18:14:20 -04:00
Prike Liang
aef2ca9353 drm/amdgpu/mes: fix the inconsistent indenting for mes_userq_map()
Fix the inconsistent indenting warning for mes_userq_map().

Fixes: d0827dda8f ("drm/amdgpu/mes: refactor the amdgpu_mes_alloc/free_proc|gang()")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202608190252.8XCa0HqR-lkp@intel.com/
Signed-off-by: Prike Liang <Prike.Liang@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25 18:12:53 -04:00
Linus Torvalds
45c13f3f9e hwspinlock updates for v7.3
Propagate single-lock registration failures from radix_tree_insert(), making
 caller sanity checks effective.
 
 Update the hwspinlock MAINTAINERS repository URL to the current remoteproc
 tree.
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCgAsFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmqN+8MOHGJqb3JuQGty
 eW8uc2UACgkQCx85Pw2ZrcUN+xAAv/yAIAOhanNNvoA0nDZptfX2b561APc3gSRg
 zx6KLsY+a0y9s6z6VKhv4BuKxSYSR/A0gTjHcKog7ZebrlTxUhT3UV+f7M3lI6AK
 Z7wkiyCc2Z7m/plPtvVm6juwYWaaCyc2qxOXca79ExG5hfiq5W/MXbHpajkLdlcY
 rWvNBgjxEzcUhR13qr4WIkSq6pybGbdoRlnH8rK+7evYJlgSKep7apQKDpkwKMG1
 RRJQn2XBn12Yr5AfENfb3WdkcuUsGgyYAmv21yOWem4h/awZuAhsOS5j1X89Mzyo
 L3e6fdtVjcYwQlD8rolJYhhoW9OadkoDxHGXLrIiGZMgPRaR0k93WJOKSSwocEMG
 Ud6b8QTSuRYTa3Ygi0d+fODuhxB7cNl5iVcViAH/O3iyhkzIqeLidfmIwiU4LNKM
 Wn6xAp+oRGPYJuNO8X2qFYZS3ZhIkK1NpQekR9WMiiu8sgFrDM5LogL0XU8Ck+yk
 ysm9wn2h97yOV6vowpF/UHU/hu+VbC2Iu+qyNCtkdU+JQHo4X7tEhadd8FV5DbFe
 FugWcla5RwDa3Lef8qLZLo1xx/tmIWAx7HZLN5D/cffuG1j6ioeJHnIu/LFBEZeO
 Wyo5TOFrYQoIDUR+8rW7aGykYAhfevaaVuVSdl/EXMaGjADoNDunyFaG7cFnKUP/
 fEG0HUw=
 =Z/YJ
 -----END PGP SIGNATURE-----

Merge tag 'hwlock-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux

Pull hwspinlock updates from Bjorn Andersson:
 "Propagate single-lock registration failures from radix_tree_insert(),
  making caller sanity checks effective.

  Update the hwspinlock MAINTAINERS repository URL to the current
  remoteproc tree"

* tag 'hwlock-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux:
  hwspinlock: propagate errno when registering single lock
  MAINTAINERS: Update remoteproc repo url for hwspinlock
2026-08-25 14:21:47 -07:00
Linus Torvalds
f2ed28dce9 rpmsg updates for v7.3
Fix a GLINK endpoint teardown deadlock during driver detach and order SMEM
 FIFO reads after the remote-updated availability check.
 
 Prevent duplicate rpmsg character endpoint teardown when remoteproc shutdown
 races with RPMSG_DESTROY_EPT_IOCTL.
 
 Replace unsafe string and sysfs formatting helpers, and correct the
 unregister_rpmsg_driver() return value documentation.
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCgAsFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmqN/A8OHGJqb3JuQGty
 eW8uc2UACgkQCx85Pw2ZrcVtjQ/+Ohv/oawAyLpPs73206Mjg/vCwpwfw8blHjf+
 fsJ6jQQ32GUY7ySz4azNOGUvipVZ59Gf79fGXxOD1Gy49EO4h9VxYrxdgxz4WrPu
 RC74zDCsp6kjqCYWsRIsaCWDycubW+fMW4f9cqJ/+wEbAj4pb2kvij/Irbs+i4cW
 bUha/eEIpNGxikW7Un7Ikvqgxg3L77HRlWonrwt1aPnMd1SM6w5pT/0gz6zF4R9I
 QB4EYK5MJvcVcdciECkQf5txVNsHRPUg6d/eLZsPsxLGMNoXHBoKFHJVx6TLcy4r
 pJFJ/h8sNTRSSx/eHoF2i0mf4gz5aKg1V4XR9NQQ8hsLv5IIMUg5Qm4Jez5wUDJE
 jHiSxQzrts/HUxT8W60TGAREG0oiet0dRgZXtMZ0Muw+iLXLlSSdcS6MOvvCSIVU
 MHxC5wpcYRf2sMsqG3PGAs4erHsI/H1QLVV75f6UMpKcpgwYpeYzaMKx3otod95Y
 bvmQuEo56yqh4Pzllw7nG/avjp+zHpy0aY8YGUducQOopYv4T1WmbolYw5kYBUE8
 zLKY69c3tiIwK/qgnmROfVzMAz0VjGTKeIWFUxy7rdUk9l8cRSguz0bKWN73GPx4
 UwCgSFsFJHFl63idgs6KfysbVPW308ISDYLUybENEc93uM2gdV0LsOkKAraqd9lR
 LTZwDys=
 =bTs/
 -----END PGP SIGNATURE-----

Merge tag 'rpmsg-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux

Pull rpmsg updates from Bjorn Andersson:
 "Fix a GLINK endpoint teardown deadlock during driver detach and order
  SMEM FIFO reads after the remote-updated availability check.

  Prevent duplicate rpmsg character endpoint teardown when remoteproc
  shutdown races with RPMSG_DESTROY_EPT_IOCTL.

  Replace unsafe string and sysfs formatting helpers, and correct the
  unregister_rpmsg_driver() return value documentation"

* tag 'rpmsg-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux:
  rpmsg: glink: smem: order FIFO read after availability check
  rpmsg: glink: fix deadlock in endpoint destroy during driver detach
  rpmsg: char: Check for ongoing chrdev destroy
  rpmsg: glink: Replace strcpy() with strscpy()
  rpmsg: core: Fix incorrect return value documentation
  rpmsg: Replace sprintf() with sysfs_emit() in sysfs show
2026-08-25 14:13:38 -07:00
Linus Torvalds
fc710de0dd remoteproc updates for v7.3
Add a remoteproc driver and binding for AMD MicroBlaze/V soft cores
 executing from dual-port BRAM, with clock and reset control and support
 for firmware without a resource table.
 
 Introduce a generic Qualcomm PAS service with SCM and OP-TEE backends,
 and migrate the PAS, MSS, and WCNSS remoteproc drivers to it. Add Nord
 ADSP and CDSP support, Eliza CDSP support, Maili ADSP/CDSP bindings, and
 late-attach SoCCP support for Kaanapali, Hawi, Maili, and Glymur. Enable
 BAM-DMUX child devices for PAS modems and fix PAS memory protection,
 handover, shutdown, and resource lifetime handling.
 
 Harden remoteproc lifecycle handling by attaching asynchronously,
 stopping crashed processors, synchronizing crash work with removal, and
 forcing shutdown before device resources are released. Reallocate
 resources during attach recovery and fix several reference and error-path
 leaks.
 
 Add Xilinx R5 crash detection and move RPU start and stop sequencing into
 the platform firmware driver. Consolidate write-combining carveout
 mapping callbacks, use correct I/O-memory accessors, and share optional
 ELF resource-table handling across drivers.
 
 Convert the TI Wakeup M3 binding to DT schema, correct Qualcomm and
 generic remoteproc bindings, and harden resource-table iteration against
 signed-offset out-of-bounds accesses.
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCgAsFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmqN/FgOHGJqb3JuQGty
 eW8uc2UACgkQCx85Pw2ZrcUvXRAAkCk6ogZOdjGY9WBugieN3WEfkAzrWAS9ntWK
 CGR+VcL633ymLtS/6E2fdv4d7Uh1An/ipcCJUSXU4CzumB7O1FJi1CfQok2j+4xz
 dIBc9m6SAMYBFVLAXD2NujdOf+nwEDLbJQib7lVBTBCNjQamvjFhUu9g/bnJt4gT
 F1ieAgNP15OFfHnoSWhoFHXI8ao4Vs0PwfoBLEwIP5VuFXy3DzVGaqEZgEgD7+G5
 Qy0ii/TO+EFC8GdK8xxlCtKYT6J3qG/pQBaCtS9QwSXNPTbI31MlDimInUl7lxHS
 yWeDOJPVgNL279W7DnHiELQT6uGFac+1ILNBIGl9lI1+4Hcwgg6eTwwP6wcIOhYL
 YFXNfCeb5XW6moOKxhkcbOwZ46/FUS4sywoUyaAevFOc8kisDwMy81C1d2cYVg12
 gq69ah4sWkSPSkAgOeUf8Aa8v3eXj9IaxcIAW9+fQdNaduuG7oRvVzowKbli9SiD
 qAAaIV2wyt+Il7VJl5Nw1R0nJONMTK44Xft+3k/TFzmr5N1ivfSBvGxIg0zdB9xZ
 7akukQjCJgWOcyICa3ShyA6foClsJF26xVhQrfY7UPKI7DQHY5GQAKgpA2zWrqH5
 cKt5xRcImKn+788pfkNdVj8IxROjGEI5JXf6etIvpPnUzkFG3nZfY6kLryOxvv0H
 zyxm4OM=
 =wi8c
 -----END PGP SIGNATURE-----

Merge tag 'rproc-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux

Pull remoteproc updates from Bjorn Andersson:
 "Add a remoteproc driver and binding for AMD MicroBlaze/V soft cores
  executing from dual-port BRAM, with clock and reset control and
  support for firmware without a resource table.

  Introduce a generic Qualcomm PAS service with SCM and OP-TEE backends,
  and migrate the PAS, MSS, and WCNSS remoteproc drivers to it. Add Nord
  ADSP and CDSP support, Eliza CDSP support, Maili ADSP/CDSP bindings,
  and late-attach SoCCP support for Kaanapali, Hawi, Maili, and Glymur.
  Enable BAM-DMUX child devices for PAS modems and fix PAS memory
  protection, handover, shutdown, and resource lifetime handling.

  Harden remoteproc lifecycle handling by attaching asynchronously,
  stopping crashed processors, synchronizing crash work with removal,
  and forcing shutdown before device resources are released. Reallocate
  resources during attach recovery and fix several reference and
  error-path leaks.

  Add Xilinx R5 crash detection and move RPU start and stop sequencing
  into the platform firmware driver. Consolidate write-combining
  carveout mapping callbacks, use correct I/O-memory accessors, and
  share optional ELF resource-table handling across drivers.

  Convert the TI Wakeup M3 binding to DT schema, correct Qualcomm and
  generic remoteproc bindings, and harden resource-table iteration
  against signed-offset out-of-bounds accesses"

* tag 'rproc-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (60 commits)
  remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()
  remoteproc: replace BSD blurb with SPDX identifier in rsc_table.h
  remoteproc: replace BSD blurb with SPDX identifier in remoteproc.h
  remoteproc: fix coding style issues in remoteproc.h
  MAINTAINERS: add rsc_table.h to remoteproc entry
  remoteproc: qcom: pas: Add Nord ADSP and CDSP support
  dt-bindings: remoteproc: qcom,nord-pas: Document Nord PAS
  remoteproc: qcom: pas: Drop unused dtb_mem_region field
  remoteproc: qcom: pas: Map/unmap subsystem region before auth_and_reset
  remoteproc: qcom: pas: Fix the PAS context creation placement
  remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check
  remoteproc: qcom: annotate mem_region fields with __iomem
  arm64: dts: qcom: eliza: Add fallback compatible for ADSP remoteproc
  dt-bindings: remoteproc: qcom,milos-pas: Move Eliza ADSP to SM8550 schema
  remoteproc: qcom: pas: Add Eliza CDSP support
  dt-bindings: remoteproc: qcom,sm8550-pas: Add Eliza CDSP compatible
  remoteproc: qcom: q6v5: Request shutdown if crash is triggered host-side
  remoteproc: Force shutdown during device removal
  remoteproc: Prevent crash handling to race with rproc_del()
  remoteproc: Allow shutdown of crashed processors
  ...
2026-08-25 14:03:31 -07:00
Miguel Ojeda
1b0bab4a87 rust: kbuild: disambiguate zerocopy_derive for rusttest
The `rustc-dev` components for Rust 1.82.0 through 1.87.0 include a
precompiled `zerocopy_derive` procedural macro in the sysroot. This
range includes Rust 1.85.0, our minimum supported version.

This makes `rusttest` fail because the compiler finds both the sysroot
copy and the copy built in `rust/test`:

    error[E0464]: multiple candidates for `dylib` dependency `zerocopy_derive` found
      --> rust/kernel/prelude.rs:70:9
       |
    70 | pub use zerocopy_derive::{
       |         ^^^^^^^^^^^^^^^
       |
       = note: candidate #1: .../lib/rustlib/x86_64-unknown-linux-gnu/lib/libzerocopy_derive-54d2b38896fa6bc5.so
       = note: candidate #2: .../rust/test/libzerocopy_derive.so

Commit fe39a233ea ("rust: kbuild: disambiguate `zerocopy` for
`rusttest`") fixed the equivalent ambiguity for `zerocopy`.

Thus point to the dependency explicitly in this case too.

Cc: Antoni Boucher <bouanto@zoho.com>
Cc: stable@vger.kernel.org
Fixes: 5060549804 ("rust: zerocopy-derive: enable support in kbuild")
Link: https://patch.msgid.link/20260823193529.156066-1-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-25 22:19:27 +02:00
Linus Torvalds
73ae59e975 Changes since last update:
- Fix up the EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic so that
    "make savedefconfig" won't write the needless default value to the
    defconfig file
 
  - Add support for SEEK_{HOLE,DATA}, splice() as well as enable large
    folios in inode_share mode
 
  - Fix z_erofs_gbuf_growsize() after the previous buffer resizing fails
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEQ0A6bDUS9Y+83NPFUXZn5Zlu5qoFAmqNu/kRHHhpYW5nQGtl
 cm5lbC5vcmcACgkQUXZn5Zlu5qoMTA/8Cb7MRcm7eyCvTT1wyfgx6DSiOuYdITDW
 6iQ/qRTnYDEO8FNVwqZJflLPO5pjIs/sucg69XvZg9cIP0gW4o3R5INJx+ZNZx0j
 hnbPY8RNtIP0Z0rbt8Qes2cXORosZlqcdZvQFQgbmKx6jo72MLWMof7qM9jC8rOy
 jMm9wipn7RjM5jN6sLGWMDleV+xfHOWT7cJzWL4qyJLgWWMp8vBMhuGfK46Cz/R4
 wns+5gFanQAPmaWRJ8Wl0MIFBNhF49IGKRSxku8LYCmcnZMlnsL5TfQK/HP+d+o9
 OLTK3M9zDm5VFbp18YAHNgZVUhZKZpaYC3PwmpY2t2/w2zjXVgQ1+dkXn5Iuho+y
 IY7fc+D27E/QKUq7xz+H3i+0z7SW+nC4ErLxE6GQfpRLEV6GoYibkDuzrUH6+6sI
 abJrLGwnE++ZXKBd3s2nspsn1Pq/ItyRdE4nsm5QZQbVbFDctZpG25gN0PM49DDV
 jh6ByRMPkR5ZHVzdFhGsbT6KQyadEU/zr1AFy3UCOZ+JNv+Gs7HHI028vucbN3/x
 SyX8wrt/D503+AZHLZdHp4y5BsdAXFp/qurHFY5JNMR0w7B8WmeV0q07XlBUle6v
 vxQzQm920x5ZX9aGm+iYtMCWZyvdnTqp+eKHYwnyjifu6RbShFsMmpZsQ0+Du+NE
 V/JvRUFV+ss=
 =cqYR
 -----END PGP SIGNATURE-----

Merge tag 'erofs-for-7.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs

Pull more erofs updates from Gao Xiang:

 - Fix up the EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic so
   that "make savedefconfig" won't write the needless default value to
   the defconfig file

 - Add support for SEEK_{HOLE,DATA}, splice() as well as enable large
   folios in inode_share mode

 - Fix z_erofs_gbuf_growsize() after the previous buffer resizing fails

* tag 'erofs-for-7.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
  erofs: simplify z_erofs_gbuf_growsize()
  erofs: skip sufficiently large global buffers when resizing
  erofs: support large folios in inode_share mode
  erofs: support splice() in inode_share mode
  erofs: support SEEK_HOLE/SEEK_DATA in inode_share mode
  erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic
2026-08-25 12:27:41 -07:00
Nathan Chancellor
79a57e4882 thermal/drivers/qcom-spmi-mbg-tm: Add module namespace import for IIO_CONSUMER
Commit ebf1d03dab ("iio: inkern: Use namespaced exports") in the iio
tree restricts certain exported core functions that a driver added in
commit c3dce11733 ("thermal/drivers/qcom: Add support for Qualcomm MBG
thermal monitoring") from the thermal tree uses, causing modpost to
warn (or error without CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS):

  ERROR: modpost: drivers/thermal/qcom/qcom-spmi-mbg-tm.ko: module uses symbol 'devm_iio_channel_get' from namespace 'IIO_CONSUMER', but does not import it.
  ERROR: modpost: drivers/thermal/qcom/qcom-spmi-mbg-tm.ko: module uses symbol 'iio_read_channel_processed' from namespace 'IIO_CONSUMER', but does not import it.

Add the IIO_CONSUMER namespace import to clear up the error.

Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Tested-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://patch.msgid.link/20260812-qcom-spmi-mbg-tm-ns-modpost-error-v1-1-d849390d2714@kernel.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-08-25 21:09:40 +02:00
Rafael J. Wysocki
aa4174127f Revert "thermal/core: Allocate the thermal class dynamically"
This reverts commit 34f5400364 ("thermal/core: Allocate the thermal
class dynamically") that went against driver core changes aiming at the
elimination of class_create() [1].

No intentional functional impact.

Link: https://lore.kernel.org/linux-pm/2026082411-flask-rewire-434f@gregkh/
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/4761117.LvFx2qVVIh@rafael.j.wysocki
2026-08-25 21:08:46 +02:00
Rafael J. Wysocki
1087c29d9c Revert "thermal/core: Use the thermal class pointer as init guard"
This reverts commit 499274d078 ("thermal/core: Use the thermal class
pointer as init guard") because it depends on another commit that needs
to be reverted.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/6301222.lOV4Wx5bFT@rafael.j.wysocki
2026-08-25 21:08:45 +02:00
Linus Torvalds
7bb6284aa7 Arm:
* Add support for 'slot' based PMU events, paired with new UAPI that
   compels the user to select a specific PMU implementation
 
 * Lazy save/restore of vCPU state for pKVM, along with various fixes
   and cleanups to the management of vCPU state between the untrusted
   host and pKVM hypervisor
 
 * Disable traps of EL1 registers for nested hypervisors when FEAT_NV2p1
   is present, guaranteeing that EL2-specific register bits are stateful
   in the EL1 counterpart
 
 * Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the scope
   of those instructions remains 'in host' (i.e. L1 kernel/userspace)
 
 * Pile of fixes for the management of the VNCR pseudo-TLB, such as
   under-invalidations and races with concurrent TLBIs on other vCPUs
 
 * Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a
   runtime-patched constant, allowing the same data to be shared with
   pKVM prior to dropping host privileges
 
 * Considerable pile of LLM-assisted fixes around the shop but mostly in
   the VGIC, our in-kernel generator of bugs (and sometimes interrupts)
 
 LoongArch:
 
 * Advertise already-supported capabilities.
 
 * Some bug fixes about timer and MMIO.
 
 * Some hardening about interrupt injection.
 
 * Replace kvm_err() with kvm_pr_unimpl().
 
 * Add FPU/LSX/LASX test cases for selftests.
 
 RISC-V:
 
 * Svadu/Zicfiss/Zicfilp FWFT support for Guest
 
 * Use try_cmpxchg for IMSIC MRIF RMW
 
 * More arch-specific tracepoints in KVM RISC-V
 
 * Eager page splitting when enabling dirty logging
 
 * Optimize hfence request handling for SMP Guests
 
 * Improve dirty log clearing by skipping zero bits in mask
 
 * Guard HFENCE range loops against overflow
 
 * CPU PM notifiers in KVM RISC-V for non-retentive idle states
 
 * Fix kernel-mode vector context save/restore for Guest
 
 s390:
 
 * Fixes for vfio-ap
 
 * Fixes for the gmap rework
 
 * Fixes for vsie
 
 * AI triggered fixes all over
 
 * diag9c tracing
 
 * code move preparation for the additional arm64 support
 
 * enable CONTEXT_ANALYSIS
 
 x86:
 
 * Perform spring cleaning on x86.{c,h} and asm/kvm_host.h, by adding regs.c
   (the kvm_cache_regs.h => regs.h is already applied) and msrs.{c,h}, and moving
   relevant code out of x86.c.
 
 * Split kvm_mmu in three parts, respectively to describe the format of page
   tables, walking the guest page tables and building the page tables.  Always
   use the same page table walker kvm->arch.gva_walk as the entry point to
   convert a guest's virtual address, where the previous code used two
   different kvm_mmu structs depending on whether the walk included nested
   EPT/NPT or not.  Make page fault vmexits reuse the permission checking
   machinery that is used for guest page faults.  This is both a cleanup
   and a baby step towards supporting XS/XU memory permissions.
 
 * Document some of the "fun" gotchas with the APIC base when creating IRQCHIPs
   on x86.
 
 * Remove a defunct masterclock update from kvm_xen_shared_info_init().  It
   could result in incorrect kvmclock due to triggering an unnecessary
   switch to/from masterclock mode.
 
 * Skip Xen runstate time updates if time has effectively gone backwards, so
   that the guest doesn't report 100% steal time for a very, very long time.
 
 * Drop KVM's runtime updates of the Xen PV timing CPUID leaf, as KVM was
   updating the wrong sub-leaf, and upstream KVM will soon provide all the
   information needed by userspace to populate the CPUID field itself.
 
 * Fix a bug where KVM would walk a newly created rmap without holding the rmap
   lock (or mmu_lock) during aging.
 
 * Fix a bug where aging TDP MMU SPTEs could clobber FROZEN SPTEs.
 
 * Fix a variety of #DB priority bugs.
 
 * Fix a class of races related to enabling Hyper-V emulation on a vCPU after
   the vCPU is visible to the rest of KVM.
 
 * Use static calls for nested virtualization ops.
 
 * Move more KVM-internal code out of x86's kvm_host.h.
 
 * Enumerate support for a variety of Zhaoxin instructions that don't require
   explicit virtualization.
 
 * Fix missing EFER validation bugs, including in the KVM_SET_SREGS* path.
 
 * Harden kvm_vcpu_map() against double-mapping and thus leaking references.
 
 * Misc fixes and cleanups, e.g. for largely benign syzkaller splats.
 
 x86 (Intel):
 
 * Zero a vCPU's entry in VMX's Posted Interrupt Descriptor table used for IPI
   virtualization when the vCPU is freed, to fix a use-after-free where hardware
   will write to a freed vCPU's PID.
 
 * Service local TLB flushes on a failed nested VM-Enter to fix a bug where KVM
   could miss a TLB on a future, successful VM-Enter with the same L2 VPID.
 
 * Cap the maximum value shoved into the VMX Preemption Timer to workaround an
   erratum that affects all existing Intel CPUs that support CPUID 0x15.
 
 * Fix VPID virtualization bugs where KVM would fail to flush hardware TLBs.
 
 * Harden the TDX "populate" ioctls against bad input, and to prepare
   for supporting in-place private<=>shared conversion.
 
 x86 (AMD):
 
 * Forcefully invalidate SNP VMSA pages if their backing guest_memfd page is
   zapped/invalidated, e.g. due to a PUNCH_HOLE in response to a Page-State
   Change request.
 
 * Remove a dying VM from the GA Log notifier list before the VM is actually
   destroyed, to fix a potential use-after-free.
 
 * While FOLL_WRITE was needed in the past to trigger CoW unsharing, nowadays
   FOLL_LONGTERM does that already even without FOLL_WRITE, and in fact,
   get_user_pages() actually disallows FOLL_WRITE together with FOLL_LONGTERM.
   So don't pass FOLL_WRITE when registering encrypted memory regions, i.e. when
   pinning SEV/SEV-ES guest memory, to fix a regression with file-backed memory
   introduced by KVM's (correct) usage of long-term pins.
 
   (This was reviewed by mm maintainers; for more information, see commit
   ee1a586dd1).
 
 * Allocate full pages for SEV/SEV-ES {DE,EN}CRYPT ops on SNP-enabled hosts to
   fix a data corruption issue due to the PSP driver assigning to-be-written
   pages to firmware (as required by the SNP specs).
 
 * Unconditionally intercept ICBEP so that KVM generates the correct guest RIP
   when handling an ICEBP-induced TASK_SWITCH #VMEXIT.
 
 * Harden the SNP "populate" ioctls against bad input, and to prepare
   for supporting in-place private<=>shared conversion.
 
 Generic:
 
 * Remove kvm_debugfs_dir if kvm_init() fails after creating KVM's debugfs.
 
 * Add a per-VM bitmap to track which vCPU IDs have been "claimed" but for
   which the vCPU isn't yet online, and use the bitmap to reject duplicate IDs
   before calling into arch code.  This allows arch code to consume vcpu_id
   without having to worry about cross-vCPU clobbering (at least s390 and x86
   have had related bugs).
 
 * Rework the so called "prepare" and "invalidate" guest_memfd hooks to prepare
   for in-place private<=>shared conversion, and clean up a few warts along the
   way.
 
 Selftests:
 
 * Automatically allocate a full page for L2 guest stacks on x86 instead of
   requiring test-specific L1 guest code to carve out a portion of the L1
   stack for L2 usage, and to ensure the L2 stack also adheres to the x86-64
   calling convention ABI.
 
 * Add a selftest to verify {Guest,Host}-Only behavior in x86's mediated PMU.
 
 * Clean up nested SVM's handling of GPRs on L2<=>L1 transitions, reuse the
   functionality for nested VMX, and drop the ucall hack that was fudging
   around the lack of GPR switching on nVMX.
 
 * Add a stress test to verify KVM doesn't clobber/drop #PF state, e.g. CR2,
   across save/restore, including when L2 is active.
 
 * Add a test to verify KVM_CREATE_VM accepts exactly what is reported by
   KVM_CAP_VM_TYPES.
 
 * Misc selftests fixes and cleanups
 
 * Fix several issues with seeding the pRNG, and rework the pRNG APIs to that
   the pRNG can be sanely used in host code, not just guest code.
 
 * Add an IRQ test to validate virtual IRQ deliverty for IRQs wired up via
   KVM_IRQFD + KVM_SET_GSI_ROUTING, with optional support for triggering IRQs
   via writes to an assigned VFIO device.
 
 * Add syscall wrappers to assert success on a variety of pthreads and CPU
   affinity APIs.
 
 * Set vCPU pthread affinity as early as possible to reduce contention issues
   that were surfaced by PREEMPT_LAZY, which result in runtimes of over a
   minute on large hosts, versus the expected ~5 seconds.
 
 * Rework the PMU counters test to run each testcase using a single VM with
   many vCPUs for each sub-testcase, instead of using a unique VM for each
   sub-testcase.  This cuts the runtime by ~20x.
 
 Miscellaneous:
 
 * MAINTAINERS updates for vfio-ap, guest_memfd, kvm-x86.  Mostly representing
   the status quo more accurately, but also... welcome David Hildenbrand
   as guest_memfd reviewer!
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmqMgosUHHBib256aW5p
 QHJlZGhhdC5jb20ACgkQv/vSX3jHroP8bwf+ORImBMDM3QEmybZM3I+N2+xqSuHP
 QHttbmqGbsFK/RUeH96/X/+P9waqaz3uVeUQ6Qp2r0ryqwKtLt8YvIxKDp+M0vVJ
 n+iukk1xulBEc28aGdKHn9G4wayAwDA/9f7CvJ23hojaJfLScbF3OlFkDd7y5DpO
 x15Rtg9folYUjjop3LDML4N9/9Qmk4KRvVZ4ZVv6IB4uGJJ72fLd5dbBMyDk+BLl
 Lz9N1xVTXcnJXJmrjMB4/QNt/HiQJdun8LcokJZyykta7Xx6aY7OGZv+VmCeq47K
 e9Hk8mD4AyAdVbVvIntROSeBJOrlsgWJXAPHea6wEdRQnS3XVEBuZC0yDA==
 =rfLh
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm updates from Paolo Bonzini:
 "ARM64:

   - Add support for 'slot' based PMU events, paired with new UAPI that
     compels the user to select a specific PMU implementation

   - Lazy save/restore of vCPU state for pKVM, along with various fixes
     and cleanups to the management of vCPU state between the untrusted
     host and pKVM hypervisor

   - Disable traps of EL1 registers for nested hypervisors when
     FEAT_NV2p1 is present, guaranteeing that EL2-specific register bits
     are stateful in the EL1 counterpart

   - Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the
     scope of those instructions remains 'in host' (i.e. L1
     kernel/userspace)

   - Pile of fixes for the management of the VNCR pseudo-TLB, such as
     under-invalidations and races with concurrent TLBIs on other vCPUs

   - Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a
     runtime-patched constant, allowing the same data to be shared with
     pKVM prior to dropping host privileges

   - Considerable pile of LLM-assisted fixes around the shop but mostly
     in the VGIC, our in-kernel generator of bugs (and sometimes
     interrupts)

  LoongArch:

   - Advertise already-supported capabilities

   - Some bug fixes about timer and MMIO

   - Some hardening about interrupt injection

   - Replace kvm_err() with kvm_pr_unimpl()

   - Add FPU/LSX/LASX test cases for selftests

  RISC-V:

   - Svadu/Zicfiss/Zicfilp FWFT support for Guest

   - Use try_cmpxchg for IMSIC MRIF RMW

   - More arch-specific tracepoints in KVM RISC-V

   - Eager page splitting when enabling dirty logging

   - Optimize hfence request handling for SMP Guests

   - Improve dirty log clearing by skipping zero bits in mask

   - Guard HFENCE range loops against overflow

   - CPU PM notifiers in KVM RISC-V for non-retentive idle states

   - Fix kernel-mode vector context save/restore for Guest

  s390:

   - Fixes for vfio-ap

   - Fixes for the gmap rework

   - Fixes for vsie

   - AI triggered fixes all over

   - diag9c tracing

   - code move preparation for the additional arm64 support

   - enable CONTEXT_ANALYSIS

  x86:

   - Perform spring cleaning on x86.{c,h} and asm/kvm_host.h, by adding
     regs.c (the kvm_cache_regs.h => regs.h is already applied) and
     msrs.{c,h}, and moving relevant code out of x86.c

   - Split kvm_mmu in three parts, respectively to describe the format
     of page tables, walking the guest page tables and building the page
     tables. Always use the same page table walker kvm->arch.gva_walk as
     the entry point to convert a guest's virtual address, where the
     previous code used two different kvm_mmu structs depending on
     whether the walk included nested EPT/NPT or not. Make page fault
     vmexits reuse the permission checking machinery that is used for
     guest page faults. This is both a cleanup and a baby step towards
     supporting XS/XU memory permissions

   - Document some of the "fun" gotchas with the APIC base when creating
     IRQCHIPs on x86

   - Remove a defunct masterclock update from kvm_xen_shared_info_init().
     It could result in incorrect kvmclock due to triggering an
     unnecessary switch to/from masterclock mode

   - Skip Xen runstate time updates if time has effectively gone
     backwards, so that the guest doesn't report 100% steal time for
     a very, very long time

   - Drop KVM's runtime updates of the Xen PV timing CPUID leaf, as KVM
     was updating the wrong sub-leaf, and upstream KVM will soon provide
     all the information needed by userspace to populate the CPUID field
     itself

   - Fix a bug where KVM would walk a newly created rmap without holding
     the rmap lock (or mmu_lock) during aging

   - Fix a bug where aging TDP MMU SPTEs could clobber FROZEN SPTEs

   - Fix a variety of #DB priority bugs

   - Fix a class of races related to enabling Hyper-V emulation on a
     vCPU after the vCPU is visible to the rest of KVM

   - Use static calls for nested virtualization ops

   - Move more KVM-internal code out of x86's kvm_host.h

   - Enumerate support for a variety of Zhaoxin instructions that don't
     require explicit virtualization

   - Fix missing EFER validation bugs, including in the KVM_SET_SREGS*
     path

   - Harden kvm_vcpu_map() against double-mapping and thus leaking
     references

   - Misc fixes and cleanups, e.g. for largely benign syzkaller splats

  x86 (Intel):

   - Zero a vCPU's entry in VMX's Posted Interrupt Descriptor table used
     for IPI virtualization when the vCPU is freed, to fix a
     use-after-free where hardware will write to a freed vCPU's PID

   - Service local TLB flushes on a failed nested VM-Enter to fix a bug
     where KVM could miss a TLB on a future, successful VM-Enter with
     the same L2 VPID

   - Cap the maximum value shoved into the VMX Preemption Timer to
     workaround an erratum that affects all existing Intel CPUs that
     support CPUID 0x15

   - Fix VPID virtualization bugs where KVM would fail to flush hardware
     TLBs

   - Harden the TDX "populate" ioctls against bad input, and to prepare
     for supporting in-place private<=>shared conversion

  x86 (AMD):

   - Forcefully invalidate SNP VMSA pages if their backing guest_memfd
     page is zapped/invalidated, e.g. due to a PUNCH_HOLE in response to
     a Page-State Change request

   - Remove a dying VM from the GA Log notifier list before the VM is
     actually destroyed, to fix a potential use-after-free

   - While FOLL_WRITE was needed in the past to trigger CoW unsharing,
     nowadays FOLL_LONGTERM does that already even without FOLL_WRITE,
     and in fact, get_user_pages() actually disallows FOLL_WRITE
     together with FOLL_LONGTERM. So don't pass FOLL_WRITE when
     registering encrypted memory regions, i.e. when pinning SEV/SEV-ES
     guest memory, to fix a regression with file-backed memory
     introduced by KVM's (correct) usage of long-term pins

     (This was reviewed by mm maintainers; for more information, see
     commit ee1a586dd1 "KVM: SEV: Drop FOLL_WRITE for encrypted region
     registration")

   - Allocate full pages for SEV/SEV-ES {DE,EN}CRYPT ops on SNP-enabled
     hosts to fix a data corruption issue due to the PSP driver
     assigning to-be-written pages to firmware (as required by the SNP
     specs)

   - Unconditionally intercept ICBEP so that KVM generates the correct
     guest RIP when handling an ICEBP-induced TASK_SWITCH #VMEXIT

   - Harden the SNP "populate" ioctls against bad input, and to prepare
     for supporting in-place private<=>shared conversion

  Generic:

   - Remove kvm_debugfs_dir if kvm_init() fails after creating KVM's
     debugfs

   - Add a per-VM bitmap to track which vCPU IDs have been "claimed" but
     for which the vCPU isn't yet online, and use the bitmap to reject
     duplicate IDs before calling into arch code. This allows arch code
     to consume vcpu_id without having to worry about cross-vCPU
     clobbering (at least s390 and x86 have had related bugs)

   - Rework the so called "prepare" and "invalidate" guest_memfd hooks
     to prepare for in-place private<=>shared conversion, and clean up a
     few warts along the way

  Selftests:

   - Automatically allocate a full page for L2 guest stacks on x86
     instead of requiring test-specific L1 guest code to carve out a
     portion of the L1 stack for L2 usage, and to ensure the L2 stack
     also adheres to the x86-64 calling convention ABI

   - Add a selftest to verify {Guest,Host}-Only behavior in x86's
     mediated PMU

   - Clean up nested SVM's handling of GPRs on L2<=>L1 transitions,
     reuse the functionality for nested VMX, and drop the ucall hack
     that was fudging around the lack of GPR switching on nVMX

   - Add a stress test to verify KVM doesn't clobber/drop #PF state,
     e.g. CR2, across save/restore, including when L2 is active

   - Add a test to verify KVM_CREATE_VM accepts exactly what is reported
     by KVM_CAP_VM_TYPES

   - Misc selftests fixes and cleanups

   - Fix several issues with seeding the pRNG, and rework the pRNG APIs
     to that the pRNG can be sanely used in host code, not just guest
     code

   - Add an IRQ test to validate virtual IRQ deliverty for IRQs wired up
     via KVM_IRQFD + KVM_SET_GSI_ROUTING, with optional support for
     triggering IRQs via writes to an assigned VFIO device

   - Add syscall wrappers to assert success on a variety of pthreads and
     CPU affinity APIs

   - Set vCPU pthread affinity as early as possible to reduce contention
     issues that were surfaced by PREEMPT_LAZY, which result in runtimes
     of over a minute on large hosts, versus the expected ~5 seconds

   - Rework the PMU counters test to run each testcase using a single VM
     with many vCPUs for each sub-testcase, instead of using a unique VM
     for each sub-testcase. This cuts the runtime by ~20x

  Miscellaneous:

   - MAINTAINERS updates for vfio-ap, guest_memfd, kvm-x86. Mostly
     representing the status quo more accurately, but also... welcome
     David Hildenbrand as guest_memfd reviewer!"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (413 commits)
  KVM: arm64: Validate GICv5 timer PPIs before claiming ownership
  KVM: arm64: vgic: Reject out-of-range GICv5 PPI IDs
  KVM: arm64: vgic: Prevent speculative SPI array underflow
  KVM: arm64: vgic: Free gic_kvm_info on initialization failure
  KVM: arm64: Avoid mismatched accesses to 'struct kvm_nvhe_init_params'
  s390/vfio-ap: Fix NULL deref in status_show() during queue probe
  s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed
  s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap
  s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove
  s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object
  s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects
  s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL
  s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove
  RISC-V: KVM: fix vcpu vector context handling for kernel-mode vector
  riscv: vector: allow non-preemptible kernel-mode vector with IRQs off
  riscv: vector: refactor riscv_v_start_kernel_context
  KVM: s390: gmap: Make prefix handling optional
  KVM: s390: gmap: Make CMMA optional
  KVM: s390: gmap: Make storage keys optional
  KVM: s390: Prepare gmap for a second KVM implementation
  ...
2026-08-25 11:48:04 -07:00
Linus Torvalds
70f5376dbd TTY / Serial driver updates for 7.3-rc1
Here is the "big" set of tty and serial driver updates for 7.3-rc1.  Not
 really all that much happened this development cycle for this subsystem,
 changes in here are:
   - removal of the ipwireless driver as it's no longer used or needed
   - new 8250_mxpcie driver added
   - qcom serial driver updates and additions
   - vt mode validation addition
   - lots of other small serial driver updates and additions
 
 All of these have been in linux-next for weeks with no reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCao2mTw8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+yk34ACdFfyDYJ0n1JcdskTxdNMBSPRkj7UAoJtMC/2y
 jxCfyfkM18YIuwZD6CvO
 =MlfE
 -----END PGP SIGNATURE-----

Merge tag 'tty-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull TTY / serial driver updates from Greg KH:
 "Here is the "big" set of tty and serial driver updates for 7.3-rc1.

  Not really all that much happened this development cycle for this
  subsystem, changes in here are:

   - removal of the ipwireless driver as it's no longer used or needed

   - new 8250_mxpcie driver added

   - qcom serial driver updates and additions

   - vt mode validation addition

   - lots of other small serial driver updates and additions

  All of these have been in linux-next for weeks with no reported issues"

* tag 'tty-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (97 commits)
  serial: imx: serialize imx_uart_ports[] lifetime
  tty: clear cdev pointer after cdev_add() failure
  tty: skip cdev_del() when no cdev is registered
  serial: core: clear freed pointers on uart_register_driver() failure
  serial: core: do fallible allocations before the console can be registered
  serial: 8250_mxpcie: implement rx_trig_bytes callbacks via MUEx50 RTL
  serial: 8250_mxpcie: introduce per-port private data structure
  serial: 8250: allow UART drivers to override rx_trig_bytes handling
  serial: 8250_mxpcie: add break support for RS485 using MUEx50 features
  serial: 8250: allow low-level drivers to override break control
  serial: 8250_mxpcie: support serial interface mode switching
  serial: 8250_mxpcie: speed up TX using memory-mapped FIFO window
  serial: 8250_mxpcie: speed up RX using memory-mapped FIFO window
  serial: 8250_mxpcie: add custom handle_irq callback
  serial: 8250_mxpcie: offload XON/XOFF flow control to MUEx50 hardware
  serial: 8250_mxpcie: enable automatic RTS/CTS flow control
  serial: 8250_mxpcie: enable enhanced mode and program FIFO trigger levels
  serial: 8250: add Moxa MUEx50 UART port type
  serial: 8250: split Moxa PCIe serial board support out of 8250_pci
  serial: qcom-geni: Use geni_se_set_perf_level() for baud rate perf level
  ...
2026-08-25 10:59:12 -07:00
Hui Su
2cf20c4e0f io_uring/waitid: avoid siginfo copy during ring teardown
During ring teardown, io_ring_exit_work() cancels outstanding requests
from a kworker with a NULL tctx. The waitid cancellation path eventually
reaches io_waitid_finish(), which copies the stored siginfo to the
userspace pointer supplied with the request.

Ring-wide teardown does not run in the task context that submitted the
request, so it must not access that task's userspace pointer. Depending
on the address and mm state, the copy may fail with -EFAULT, but the
uaccess itself is inappropriate from the teardown kworker.

Use a no-copy cancellation callback when io_waitid_remove_all() is
called without an owning task context. Complete the request with
-ECANCELED while releasing the waitid state without touching siginfo.

Keep the existing siginfo handling for explicit async cancellation and
task-scoped cancellation.

Fixes: f31ecf671d ("io_uring: add IORING_OP_WAITID support")
Cc: stable@vger.kernel.org
Signed-off-by: Hui Su <sh_def@163.com>
Link: https://patch.msgid.link/20260818103336.1922818-3-sh_def@163.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-25 11:51:38 -06:00
Hui Su
14572de82e io_uring/waitid: honor task_work cancellation
io_waitid_cb() may run through the fallback task_work path when
task_work_add() can no longer queue work to the originating task. The
fallback runs from a kworker and io_uring marks such task work as
canceled through tw.cancel.

io_waitid_cb() currently ignores tw.cancel and calls __do_wait().
waitid is task-context dependent: __do_wait() performs child lookup
relative to current, and the retry path also uses
current->signal->wait_chldexit. If the callback runs from the fallback
kworker, current is therefore not the task that submitted the request.

Honor tw.cancel before entering __do_wait(). Complete the request with
-ECANCELED and skip the siginfo copy, since canceled task work may run
without the submitting task's userspace execution context.

Keep the existing siginfo handling for normal waitid completion and
explicit cancellation.

Fixes: f31ecf671d ("io_uring: add IORING_OP_WAITID support")
Cc: stable@vger.kernel.org
Signed-off-by: Hui Su <sh_def@163.com>
Link: https://patch.msgid.link/20260818103336.1922818-2-sh_def@163.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-25 11:51:38 -06:00
Laxman Acharya Padhya
ba77efee1b io_uring/query: cap user size passed to copy_struct_to_user
io_handle_query_entry() clamps hdr.size for the inbound copy_from_user()
but keeps the original user value as usize. copy_struct_to_user() uses
that usize and, when it is larger than the kernel result, clear_user()s
the trailing bytes.

As hdr.size is a __u32, a query can request nearly 4 GiB of zeroing,
including on the error path where res_size stays 0. The interface is
reachable without a ring via IORING_REGISTER_QUERY.

Reject sizes larger than PAGE_SIZE, as recommended for copy_struct_*
interfaces.

Fixes: c265ae75f9 ("io_uring: introduce io_uring querying")
Cc: stable@vger.kernel.org # 6.18+
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>
Link: https://patch.msgid.link/20260821103317.91437-1-acharyalaxman8848@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-25 11:49:48 -06:00
Linus Torvalds
f4d50813c0 USB / Thunderbolt changes for 7.3-rc1
Here is the big set of USB and Thunderbolt driver updates for 7.3-rc1.
 
 Lots of driver work for new devices and systems, and many other minor
 fixes and updates.  Included in here are:
   - Thunderbolt subsystem driver updates and additions
   - typec driver updates and additions
   - usb gadget fixes all over the place, seems like people are finally
     paying attention to these drivers for some reason
   - xhci driver updates and fixes based on lots of reports
   - usb-serial driver updates and additions
   - new device ids
   - other minor USB driver updates and fixes
 
 All of these have been in linux-next for a while with no reported issues
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCao2lJA8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ynK3QCeLQdHatZ2d5sJdvssiLKREZeND4EAnj+V1K1O
 PcVJzKAiC4dgSZ5SOwn1
 =OJea
 -----END PGP SIGNATURE-----

Merge tag 'usb-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB / Thunderbolt updates from Greg KH:
 "Here is the big set of USB and Thunderbolt driver updates for 7.3-rc1.

  Lots of driver work for new devices and systems, and many other minor
  fixes and updates. Included in here are:

   - Thunderbolt subsystem driver updates and additions

   - typec driver updates and additions

   - usb gadget fixes all over the place, seems like people are finally
     paying attention to these drivers for some reason

   - xhci driver updates and fixes based on lots of reports

   - usb-serial driver updates and additions

   - new device ids

   - other minor USB driver updates and fixes

  All of these have been in linux-next for a while with no reported issues"

* tag 'usb-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (163 commits)
  usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
  usb: typec: hd3ss3220: fix VBUS regulator error message
  usb: usbfs: fix use-after-free of usb_device in usbdev_release()
  usb: gadget: u_audio: Fix use-after-free on sound card disconnect
  usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition
  usb: gadget: f_tcm: keep port count until LUN teardown completes
  usb: usbtest: disable dynamic ID support
  usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive()
  USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
  usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion
  usb: gadget: snps_udc_plat: clean up PHY on probe deferral
  usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
  usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
  usb: gadget: f_fs: Fix Use-After-Free in AIO error path
  usb: gadget: f_fs: Prevent deadlock during ep0 read loop
  usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
  usb: gadget: midi2: remove default configfs groups on teardown
  usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()
  usb: typec: thunderbolt: Disable work before freeing tbt on remove
  usb: xhci: Handle bogus TRB pointers in Missed Service Error events
  ...
2026-08-25 10:44:46 -07:00
Linus Torvalds
29b0977977 Staging driver updates for 7.3-rc1
Here is the big set of drivers/staging/ updates for 7.3-rc1.
 
 Nothing major in here at all, just lots of tiny coding style cleanups,
 refactoring, and minor "fixes" as found by some tools.  Included in here
   - loads of coding style and refactoring in the rtl8723bs wireless
     driver
   - minor greybus driver cleanups
   - minor sm750fb driver cleanups
   - other even smaller driver cleanups
 
 All of these have been in linux-next for a weeks with no reported
 issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCao2kLQ8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ym5DgCfcNXDT1NW9BrzpktehBbt+2xhtdsAoL/oRN9n
 6npdA+zvLcvV6hE3kdta
 =3AGF
 -----END PGP SIGNATURE-----

Merge tag 'staging-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging driver updates from Greg KH:
 "Here is the big set of drivers/staging/ updates for 7.3-rc1.

  Nothing major in here at all, just lots of tiny coding style cleanups,
  refactoring, and minor "fixes" as found by some tools. Included in
  here

   - loads of coding style and refactoring in the rtl8723bs wireless
     driver

   - minor greybus driver cleanups

   - minor sm750fb driver cleanups

   - other even smaller driver cleanups

  All of these have been in linux-next for a weeks with no reported
  issues"

* tag 'staging-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (186 commits)
  staging: rtl8723bs: add blank line after declaration
  staging: rtl8723bs: remove unused enumerations
  staging: rtl8723bs: use !psta instead of comparison to NULL
  staging: rtl8723bs: Replace custom RotR1 macro with ror16
  staging: rtl8723bs: Remove multiple assignments
  staging: rtl8723bs: fix several line spaces in wifi.h
  staging: rtl8723bs: remove redundant goto in rtw_free_xmitframe()
  staging: rtl8723bs: rename Restore_DM_Func_Flag functions to avoid CamelCase
  staging: rtl8723bs: rename Save_DM_Func_Flag functions to avoid CamelCase
  staging: rtl8723bs: wrap line over 100 characters
  staging: rtl8723bs: remove unnecessary whitespace
  staging: rtl8723bs: remove extra blank lines in rtw_qos.h
  staging: rtl8723bs: remove redundant ReadChipVersion8723B wrapper
  staging: rtl8723bs: remove debug fields from hal_com_data
  staging: rtl8723bs: remove 'rf_chip' from struct hal_com_data
  staging: rtl8723bs: remove unused spinlock 'SdioTxFIFOFreePageLock'
  staging: rtl8723bs: remove unused 'UsbRxHighSpeedMode' from hal_com_data
  staging: rtl8723bs: hal: remove unused readings from the chip
  staging: rtl8723bs: remove unused 'bNeedIQK' from struct hal_com_data
  staging: rtl8723bs: remove unused 'bIQKInitialized ' from hal_com_data
  ...
2026-08-25 10:16:19 -07:00
Linus Torvalds
93e4b3076b Char/Misc/IIO/etc driver update for 7.3-rc1
Here is the big set of char, misc, iio, counter, fpga, and other small
 driver subsystems for 7.3-rc1.
 
 Overall, due to some driver removals we only added a bit more code than
 removed, which was a nice change.  Highlights in this merge request are:
   - Loads of IIO driver updates and additions
   - binder driver updates (more on that below...)
   - Removal of the SGI XP and GRU drivers as they are not used anymore
     and turn out to be pretty insecure overall
   - Removal of the obsolete ibmasm driver as it's not being used anymore
   - Coresight driver updates and additions
   - Mei driver udpates
   - Counter driver updates
   - FPGA driver updates
   - ICC driver updates
   - lots and lots of other tiny driver updates to resolve reported
     issues
 
 All of these have been in linux-next for a while, with the only reported
 issues being some major merge conflicts.  Miguel pointed out some of
 these with the Rust tree merge, which is the majority of them.  I'll
 follow up with a diffstat of the merge resolution I made against your
 most recent tree, which works for me.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCao143A8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ymtUgCeKB62gT1JfA86cg3NDB1opp+10N0An3oBBegQ
 IJLqJgK45dTNtMGBwGFV
 =68af
 -----END PGP SIGNATURE-----

Merge tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc/IIO/etc driver updates from Greg KH:
 "Here is the big set of char, misc, iio, counter, fpga, and other small
  driver subsystems for 7.3-rc1.

  Overall, due to some driver removals we only added a bit more code
  than removed, which was a nice change. Highlights in this merge
  request are:

   - Loads of IIO driver updates and additions

   - binder driver updates (more on that below...)

   - Removal of the SGI XP and GRU drivers as they are not used anymore
     and turn out to be pretty insecure overall

   - Removal of the obsolete ibmasm driver as it's not being used
     anymore

   - Coresight driver updates and additions

   - Mei driver udpates

   - Counter driver updates

   - FPGA driver updates

   - ICC driver updates

   - lots and lots of other tiny driver updates to resolve reported
     issues

  All of these have been in linux-next for a while"

* tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (513 commits)
  iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
  iio: adc: pac1921: fix wrong channel used in trigger handler read
  iio: light: gp2ap002: re-enable irq if runtime suspend fails
  iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
  iio: light: apds9306: fix PM reference leak in apds9306_read_data()
  iio: gyro: mpu3050: fix sign of raw angular velocity readings
  iio: srf04: fix pm_runtime handling on probe error path
  iio: adc: ad4080: configure backend data size
  iio: adc: adi-axi-adc: add data size support for AD408X backend
  iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
  iio: dac: ad5446: fix OF module device table
  iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
  iio: light: opt4001: Reject integration times with a non-zero seconds part
  iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
  iio: light: opt4001: Fix power down clearing bits of the wrong register
  iio: light: opt4060: Fix incorrect register name in threshold read error message
  iio: light: opt4060: Fix pointer type passed to div_u64_rem()
  iio: light: opt4060: Reject integration times with a non-zero seconds part
  iio: light: ltrf216a: fix runtime PM reference leak in error path
  iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
  ...
2026-08-25 09:38:50 -07:00
Linus Torvalds
5f5ef9c407 Bootconfig updates for v7.3:
- bootconfig: Support build-time command line rendering for embedded bootconfig
   . bootconfig: render descendant keys when xbc_snprint_cmdline() root has a
     value. Fix xbc_snprint_cmdline() to render descendant keys when the root
     has both a value and subkeys, and treats empty subtrees correctly.
   . bootconfig: render embedded bootconfig as a kernel cmdline at build time.
     Add build-time pipeline using tools/bootconfig -C to render the embedded
     bootconfig "kernel" subtree into .init.rodata as a cmdline string.
   . bootconfig: clean build-time tools/bootconfig from make clean.
   . bootconfig: add xbc_prepend_embedded_cmdline() helper.
     Add helper to prepend embedded bootconfig cmdline into boot_command_line
     early before parse_early_param().
   . x86/setup: prepend embedded bootconfig cmdline before parse_early_param.
     Wire early prepend helper in x86 setup_arch() so early_param handlers see
     values from the embedded bootconfig. (So this feature is currently x86 only)
   . bootconfig: skip runtime kernel.* render once prepended early.
     Avoid duplicating "kernel" keys in setup_boot_config().
   . init/main.c: use bootconfig_cmdline_requested() for the runtime opt-in.
     Refactor setup_boot_config() to share bootconfig_cmdline_requested().
   . Documentation: bootconfig: document build-time cmdline rendering.
     Document CONFIG_CMDLINE_FROM_BOOTCONFIG usage, requirements, and precedence.
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmqNQwAbHG1hc2FtaS5o
 aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bcLcH/1GHYfxZHrl1aA112j60
 YqBgn98hnCiH+Q1wMhqgDIF7ks1qePT9pq0zC2vJawVa1BM6OM5RpnC4BW+YSpCa
 7tRf209Hrr5sd2i0vmsnYpmd9SV9JWKsuyz6VJjFjPsfEFtI9Nj7d3jm7WfGypUc
 aNEAjf3sntEaFB44MoKekHlLzTXDFrgBaUaAcdw3aGjUU1CE9ltdT+QooQGv6CHe
 7Z+UlmGhg+jkQa1tNNpRnKZErD5OBLnTkoMU5ca3M7PQLlPjIcOTf62SInm47Ma/
 viOyzkSYIXC/yq2U4Je4qKcZaKhNIL61jtQGFI8EbbZ0x1BzVbPjbr0DB3iq2YW4
 4Xk=
 =8++3
 -----END PGP SIGNATURE-----

Merge tag 'bootconfig-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull bootconfig updates from Masami Hiramatsu:

 - Support build-time command line building for embedded bootconfig

 - Fix xbc_snprint_cmdline() to render descendant keys when the root has
   both a value and subkeys, and treats empty subtrees correctly.

 - Add build-time pipeline using tools/bootconfig -C to render the
   embedded bootconfig "kernel" subtree into .init.rodata as a cmdline
   string.

 - Clean build-time tools/bootconfig from make clean

 - Add helper to prepend embedded bootconfig cmdline into
   boot_command_line early before parse_early_param()

 - Wire early prepend helper in x86 setup_arch() so early_param handlers
   see values from the embedded bootconfig (currently x86 only)

 - Avoid duplicating "kernel" keys in setup_boot_config()

 - Refactor setup_boot_config() to share bootconfig_cmdline_requested()

 - Document CONFIG_CMDLINE_FROM_BOOTCONFIG usage, requirements, and
   precedence

* tag 'bootconfig-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  init/main.c: use bootconfig_cmdline_requested() for the runtime opt-in
  bootconfig: skip runtime kernel.* render once prepended early
  x86/setup: prepend embedded bootconfig cmdline before parse_early_param
  Documentation: bootconfig: document build-time cmdline rendering
  bootconfig: add xbc_prepend_embedded_cmdline() helper
  bootconfig: clean build-time tools/bootconfig from make clean
  bootconfig: render embedded bootconfig as a kernel cmdline at build time
  bootconfig: render descendant keys when xbc_snprint_cmdline() root has a value
2026-08-25 08:59:09 -07:00
Linus Torvalds
7f22f3a193 This contains 52 commits with improvements to compression support,
metadata handling, error propagation, and filesystem robustness.
 
 New feature:
 
  - Add optional read support for Windows System Compression (WOF).
    Add CONFIG_NTFS_FS_WOF_COMPRESSION and support reading WOF-compressed
    files through the NTFS page-read path. This includes parsing
    REPARSE_TAG_WOF, handling resident and non-resident WOF metadata and
    compressed chunks, and adding kernel-side XPRESS 4K/8K/16K and LZX 32K
    decompressors. The codecs use a common transparent compression interface
    shared with LZNT1. WOF support is read-only and disabled unless
    explicitly enabled.
 
 Other changes:
 
  - Harden malformed filesystem handling and error paths.
    Add bounds and consistency checks for mapping pairs, run lengths, MFT
    locations, update-sequence offsets, non-resident attributes, compressed
    attributes, index roots, and bitmap scans. Prevent out-of-bounds accesses
    in decompression, MFT allocation, and index conversion paths, clean up MFT
    mappings and attribute search contexts on failure, and propagate attribute
    and inode initialization errors correctly.
 
  - Improve compressed-file I/O path.
    Fix compressed writes on large-page and highmem systems, reuse compression
    contexts and output workspaces, avoid unnecessary reads for full-unit
    overwrites, and submit one bio per compressed write unit. Write replacement
    data before publishing the new mapping, correctly handle zero-filled
    compressed blocks, and fix initialized-size and folio state updates after
    compressed writes.
 
  - Synchronize resident reads with MFT record updates.
 
  - Validate the final EA stream size before modifying existing data, rewrite
    the stream safely when replacing entries, restore the previous state when
    metadata updates fail, and remove the EA attribute pair when the last
    entry is deleted.
 
  - Apply Windows filename restrictions only when windows_names is enabled.
 
  - Allow index roots to relocate to extent MFT records when the base record
    lacks sufficient space.
 
  - Move non-resident attribute payload data before shrinking its record.
 
  - Correct resident-to-non-resident conversion when compression or sparse
    flags are enabled.
 
  - Prepare file allocation and initialized-size updates before buffered or
    direct I/O submission, and use pagecache_isize_extended() when extending
    the file size.
 
  - Fix highmem and page/folio access in compressed I/O paths by using the
    correct local mappings and page helpers.
 
  - Apply per-file $LXMOD permissions instead of mount masks when available,
    and prevent unprivileged writes to reserved $LX* attributes.
 
  - Update the NTFS maintainer mailing list.
 
  - Four small cleanups.
 -----BEGIN PGP SIGNATURE-----
 
 iQJKBAABCgA0FiEE6NzKS6Uv/XAAGHgyZwv7A1FEIQgFAmqNZO8WHGxpbmtpbmpl
 b25Aa2VybmVsLm9yZwAKCRBnC/sDUUQhCOOoD/9wqck6nOvUaCTRvcKbTEw2yVrR
 C+S15hC/OuwqlxFHQQucav2NvCqwzuL/T/OBHycWi0NOycq+xYQQExs5wTms77R8
 0a+lS5QS+evc8XM1IFOywiaetJQCpn6ivDimRKzZiuMJGPwdAVYY6dRX90WW1afl
 fk9uxQHcy1Tvv7L1zvNbkr8vaycOH7LEWDukEe2XAXeZbQpumF8N0TETjH3oiNUK
 NinDliRDisn0Z00qkV+DcGLQCYdVYgyJc9jW0lWT2Q2dd/o/NxfwZCrGXOSkzn1Y
 6OXtMB36cQAxrW/lINwX0hSPj+YcMYQIi32nH3qyVC6+CcJ01OD5VU1aPtSsOqIX
 viehEDBca7WJJq2AUBBUeAhK+Mq/exqNmm0UbMZKYikckkDrGDoYrnGMK4QAtkP5
 EEduZRVy57VsRDV9gO/oNCMO3+VoAJ+iU27XFcHBxzpbsR0vmJWAjivSoRJducg0
 nwZwUXfDxe6g4qFMVdd255y133uAsZ5G/lqPVFXEDiYfK/uCnKMH8O20HkzhYA75
 b7sDbboRYhiXJhMKz08fKMgov4LvewgnC2wk0Farrvb719H6ELdcHooaIfBF4pkc
 o1UStWnh/a6Sd4L5FCnVn4IBfiVkz9eDQzL0DKfhLfzVKcxyNmGStxrGSyUCZd6K
 k1pRdpLI9Z2h6ALfhQ==
 =pHcD
 -----END PGP SIGNATURE-----

Merge tag 'ntfs-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs

Pull ntfs updates from Namjae Jeon:
 "This contains improvements to compression support, metadata handling,
  error propagation, and filesystem robustness.

  New feature:

   - Add optional read support for Windows System Compression (WOF)

     Add CONFIG_NTFS_FS_WOF_COMPRESSION and support reading
     WOF-compressed files through the NTFS page-read path. This includes
     parsing REPARSE_TAG_WOF, handling resident and non-resident WOF
     metadata and compressed chunks, and adding kernel-side XPRESS
     4K/8K/16K and LZX 32K decompressors. The codecs use a common
     transparent compression interface shared with LZNT1.

     WOF support is read-only and disabled unless explicitly enabled.

  Other changes:

   - Harden malformed filesystem handling and error paths.

     Add bounds and consistency checks for mapping pairs, run lengths,
     MFT locations, update-sequence offsets, non-resident attributes,
     compressed attributes, index roots, and bitmap scans. Prevent
     out-of-bounds accesses in decompression, MFT allocation, and index
     conversion paths, clean up MFT mappings and attribute search
     contexts on failure, and propagate attribute and inode
     initialization errors correctly.

   - Improve compressed-file I/O path.

     Fix compressed writes on large-page and highmem systems, reuse
     compression contexts and output workspaces, avoid unnecessary reads
     for full-unit overwrites, and submit one bio per compressed write
     unit. Write replacement data before publishing the new mapping,
     correctly handle zero-filled compressed blocks, and fix
     initialized-size and folio state updates after compressed writes.

   - Synchronize resident reads with MFT record updates.

   - Validate the final EA stream size before modifying existing data,
     rewrite the stream safely when replacing entries, restore the
     previous state when metadata updates fail, and remove the EA
     attribute pair when the last entry is deleted.

   - Apply Windows filename restrictions only when windows_names is
     enabled.

   - Allow index roots to relocate to extent MFT records when the base
     record lacks sufficient space.

   - Move non-resident attribute payload data before shrinking its
     record.

   - Correct resident-to-non-resident conversion when compression or
     sparse flags are enabled.

   - Prepare file allocation and initialized-size updates before
     buffered or direct I/O submission, and use
     pagecache_isize_extended() when extending the file size.

   - Fix highmem and page/folio access in compressed I/O paths by using
     the correct local mappings and page helpers.

   - Apply per-file $LXMOD permissions instead of mount masks when
     available, and prevent unprivileged writes to reserved $LX*
     attributes

   - Update the NTFS maintainer mailing list

   - Small cleanups"

* tag 'ntfs-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs: (52 commits)
  ntfs: support resident WOF decompression
  ntfs: add non-resident WOF decompression
  ntfs: implement codec ops for LZX and XPRESS
  ntfs: port lzx/xpress decompressors from ntfs-3g-system-compression
  ntfs: return errors from inode initialization
  ntfs: parse REPARSE_TAG_WOF
  ntfs: return errors from ntfs_attr_readall
  ntfs: add WOF compression config option
  ntfs: define LZNT1 codec ops under transparent codec interface
  ntfs: introduce transparent compression codec interface
  ntfs: reject invalid empty mapping pairs
  ntfs: fix resource leak in ntfs_new_attr_flags
  ntfs: validate usa_ofs before preserving the update sequence number
  ntfs: fix off-by-one page overflow in ntfs_decompress()
  ntfs: do not update ctime when setxattr fails
  ntfs: reject invalid MFT LCNs from boot sector
  ntfs: serialize resident iomap reads with mrec_lock
  ntfs: verify run length exceeding volume boundary
  ntfs: allow index root relocation
  ntfs: validate non-resident attribute offsets
  ...
2026-08-25 08:33:43 -07:00
Daeho Jeong
8c963d1738 f2fs: accurately adjust free_sections during free_segment_range
In free_segment_range(), MAIN_SECS(sbi) is temporarily reduced by `secs`
to restrict block allocation to the safe remaining main area while valid
blocks in the truncated range are evacuated by GC.

However, FREE_I(sbi)->free_sections tracks the total number of free
sections across the whole filesystem. If any sections within the
truncated range were already free upon entering free_segment_range(),
failing to deduct them from free_sections causes the filesystem to
overestimate available free sections in the active, reduced main area.
This leads to inconsistent free section accounting during GC data
migration and can trigger unexpected allocation failures or assertion
errors when space is tight.

Fix this by calculating the number of already-free sections in the
truncated range, deducting them from free_sections upon entering
free_segment_range(), and restoring them on exit.

Fixes: b4b10061ef ("f2fs: refactor resize_fs to avoid meta updates in progress")
Cc: stable@vger.kernel.org
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Signed-off-by: Sunmin Jeong <s_min.jeong@samsung.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2026-08-25 15:32:48 +00:00
Ross Philipson
55ba91d4c5 tpm-buf: Add TPM buffer support header for standalone reuse
Extract all the functions and definitions for TPM buffer handling
and separate them into their own header.

Signed-off-by: Ross Philipson <ross.philipson@gmail.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2026-08-25 18:13:37 +03:00
Jarkko Sakkinen
3d9e043dab tpm-buf: Memory-safe allocations
Decouple kzalloc from buffer creation, so that a managed allocation can be
used:

	struct tpm_buf *buf __free(kfree) buf = kzalloc(TPM_BUFSIZE,
						GFP_KERNEL);
	if (!buf)
		return -ENOMEM;

	tpm_buf_init(buf, TPM_BUFSIZE);

Alternatively, other allocations are also possible (static data, stack,
etc) for example:

	u8 buf_data[512];
	struct tpm_buf *buf = (struct tpm_buf *)buf_data;
	tpm_buf_init(buf, sizeof(buf_data));

This is achieved by embedding buffer's header inside the allocated blob,
instead of having an outer wrapper.

Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@opinsys.com>
Tested-by: Srish Srinivasan <ssrish@linux.ibm.com>
Message-ID: <20260522013555.1063716-1-jarkko@kernel.org>
Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
2026-08-25 18:13:36 +03:00
Jarkko Sakkinen
065cfba1f4 tpm-buf: Remove chip parameter from tpm_buf_append_handle()
Remove the TPM driver chip parameter from the function
tpm_buf_append_handle(). The chip parameter is only for error logging
which can be done with other facilities like WARN().

Message-ID: <20260125192526.782202-11-jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@opinsys.com>
Signed-off-by: Ross Philipson <ross.philipson@gmail.com>
2026-08-25 18:13:36 +03:00
Jarkko Sakkinen
0b9551c189 tpm-buf: Merge TPM_BUF_BOUNDARY_ERROR and TPM_BUF_OVERFLOW
Merge TPM_BUF_BOUNDARY_ERROR and TPM_BUF_OVERFLOW flags into
the TPM_BUF_INVALID flag, as their behavior is identical (the only
difference being the associated log messages).

Message-ID: <20260125192526.782202-11-jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@opinsys.com>
Reviewed-by: Jonathan McDowell <noodles@meta.com>
Signed-off-by: Ross Philipson <ross.philipson@gmail.com>
2026-08-25 18:13:36 +03:00
Alec Brown
71ab22dbcf tpm: Remove main TPM header from TPM event log header
Allow the TPM event log functionality to be used without including
the main TPM driver definitions.

Signed-off-by: Alec Brown <alec.r.brown@oracle.com>
Signed-off-by: Ross Philipson <ross.philipson@gmail.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2026-08-25 18:13:36 +03:00
Ross Philipson
5467ade151 tpm: Move platform specific definitions to the new PTP header
These are definitions for TPM 2.0 interface and interactions with
the platform as defined in the TCG specification:

These definitions are located here in a separate file to avoid conflicts
with vendor specific TIS/FIFO definition (e.g. STMicroelectronics,
Infineon Technologies, etc). This allows the TCG defined TIS/FIFO
interface to be in a public header while the former chip specific
implementations contain their own definitions. TPM 1.x family chips
that adhere to the TCG specifications use the TIS/FIFO interface as
defined here.

TCG PC Client Platform TPM Profile (PTP) Specification
 - https://trustedcomputinggroup.org/resource/pc-client-platform-tpm-profile-ptp-specification/

Co-developed-by: Daniel P. Smith <dpsmith@apertussolutions.com>
Signed-off-by: Daniel P. Smith <dpsmith@apertussolutions.com>
Co-developed-by: Alec Brown <alec.r.brown@oracle.com>
Signed-off-by: Alec Brown <alec.r.brown@oracle.com>
Signed-off-by: Ross Philipson <ross.philipson@gmail.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2026-08-25 18:13:35 +03:00
Ross Philipson
88c5a62c3a tpm: Move TPM common base definitions to the command header
These are top level definitions shared by both TPM 1 and 2
family chips. This includes core definitions like TPM localities,
common crypto algorithm IDs, and the base TPM command header.

Co-developed-by: Daniel P. Smith <dpsmith@apertussolutions.com>
Signed-off-by: Daniel P. Smith <dpsmith@apertussolutions.com>
Co-developed-by: Alec Brown <alec.r.brown@oracle.com>
Signed-off-by: Alec Brown <alec.r.brown@oracle.com>
Signed-off-by: Ross Philipson <ross.philipson@gmail.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2026-08-25 18:13:35 +03:00
Ross Philipson
7a5ec92813 tpm: Move TPM2 specific definitions to the command header
Gather all the TPM2 definitions and structures in the internal header
file drivers/char/tpm/tpm.h into the command header, including:
 - Command codes, return codes and definitions from the public and
internal tpm.h files.
 - Structures defined in numerous TPM driver C modules.

The definitions moved to these files correspond to the TCG specification
for TPM 2 family:

TPM 2.0 Library
 - https://trustedcomputinggroup.org/resource/tpm-library-specification/

Co-developed-by: Daniel P. Smith <dpsmith@apertussolutions.com>
Signed-off-by: Daniel P. Smith <dpsmith@apertussolutions.com>
Co-developed-by: Alec Brown <alec.r.brown@oracle.com>
Signed-off-by: Alec Brown <alec.r.brown@oracle.com>
Signed-off-by: Ross Philipson <ross.philipson@gmail.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2026-08-25 18:13:35 +03:00
Ross Philipson
94d48062eb tpm: Move TPM1 specific definitions to the command header
Gather all the TPM1 definitions and structures from the internal header
file drivers/char/tpm/tpm.h into the command header. In addition, bring
in the single RNG structure from tpm1-cmd.c.

The definitions moved to these files correspond to the TCG specification
for TPM 1 family:

TPM 1.2 Main Specification
 -  https://trustedcomputinggroup.org/resource/tpm-main-specification/

Co-developed-by: Daniel P. Smith <dpsmith@apertussolutions.com>
Signed-off-by: Daniel P. Smith <dpsmith@apertussolutions.com>
Co-developed-by: Alec Brown <alec.r.brown@oracle.com>
Signed-off-by: Alec Brown <alec.r.brown@oracle.com>
Signed-off-by: Ross Philipson <ross.philipson@gmail.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2026-08-25 18:13:35 +03:00
Ross Philipson
e06f28d32f tpm: Initial step to reorganize TPM public headers
Consolidate TPM1 constants in tpm_command.h and remove duplicate
constants from tpm1-cmd.c.

Co-developed-by: Daniel P. Smith <dpsmith@apertussolutions.com>
Signed-off-by: Daniel P. Smith <dpsmith@apertussolutions.com>
Co-developed-by: Alec Brown <alec.r.brown@oracle.com>
Signed-off-by: Alec Brown <alec.r.brown@oracle.com>
Signed-off-by: Ross Philipson <ross.philipson@gmail.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2026-08-25 18:13:35 +03:00
Ruoyu Wang
264216889d tpm: st33zp24: Validate locality read result
check_locality() treats every nonzero transport return as success. SPI
errors remain negative, while the I2C path can convert a negative write
error through its byte-sized status variable. Either result is nonzero
even though the TPM_ACCESS byte can remain unwritten, so indeterminate
ACTIVE_LOCALITY and VALID bits can falsely report an active locality.

Require recv() to return exactly the requested byte before examining
TPM_ACCESS. Transport errors and short reads now report an inactive
locality, while successful reads retain the existing behavior.

This issue was found by a static analysis checker and confirmed by manual
source review.

Fixes: 251a7b0821 ("TPM: STMicroelectronics ST33 I2C KERNEL 3.x")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Link: https://lore.kernel.org/r/20260813153032.3951878-2-ruoyuw560@gmail.com
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2026-08-25 18:13:34 +03:00
Ruoyu Wang
8b92687708 tpm: st33zp24: Return zero on status read failure
st33zp24_status() ignores the result of the transport read and returns
data even when no byte was received. The I2C transport, for example,
skips i2c_master_recv() when the register-select write is short or fails,
leaving data uninitialized. The resulting stack value can be interpreted
as TPM_STS flags and let status checks complete spuriously.

The status callback cannot propagate a transport error. Return zero
unless recv() reports exactly one byte. With no status bits set, callers
retry or take their existing timeout or error path instead of acting on
an invalid status value.

This issue was found by a static analysis checker and confirmed by manual
source review.

Fixes: 251a7b0821 ("TPM: STMicroelectronics ST33 I2C KERNEL 3.x")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Link: https://lore.kernel.org/r/20260813153032.3951878-1-ruoyuw560@gmail.com
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2026-08-25 18:13:34 +03:00
Li Jun
b4d1adc704 tpm: tpm_tis_spi: fix nodef CR50 tpm_tis_spi_resume is null
if no define CONFIG_TCG_TIS_SPI_CR50 in config,
the add of tpm_tis_spi_resume is null, this cause the tpm chip to
fail to resume.

Signed-off-by: Li Jun <lijun01@kylinos.cn>
Link: https://lore.kernel.org/r/20260812100914.3540149-1-lijun01@kylinos.cn
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2026-08-25 18:13:34 +03:00
Karl Mehltretter
4bfacee94f tpm: atmel: depend on X86
tpm_atmel probes for the chip at fixed x86 Super-I/O ports (0x4e) with
inb()/outb(), so it only works on x86. TCG_ATMEL nevertheless depends
only on HAS_IOPORT_MAP/HAS_IOPORT, which arm and arm64 also satisfy.
There the probe is useless, and on platforms whose unbacked I/O access
faults it oopses in init_atmel() at boot (e.g. arm/versatile):

  Unable to handle kernel paging request at virtual address fee0004e
  PC is at init_atmel+0x34/0x244

TCG_NSC and TCG_TIS already "depends on X86" (commit 2f592f2a7d ("TPM:
NSC and TIS drivers X86 dependency fix")); TCG_ATMEL was missed. Add the
same dependency.

Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Link: https://lore.kernel.org/r/20260712183234.23125-1-kmehltretter@gmail.com
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2026-08-25 18:13:34 +03:00