Commit graph

1,462,193 commits

Author SHA1 Message Date
Tristan Madani
d6ab440240 RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path
For non-SRQ QPs, the responder reads WQE fields directly from the
shared queue buffer mapped into userspace. This allows a malicious
user to modify fields like num_sge or sge entries while the kernel
is processing the WQE, leading to out-of-bounds reads in
rxe_resp_check_length() and copy_data().

Introduce get_recv_wqe() that validates num_sge and copies the WQE
to a kernel-local buffer before processing, matching the approach
already used for SRQ WQEs in get_srq_wqe(). The srq_wqe buffer is
reused since SRQ and non-SRQ paths are mutually exclusive per QP.

Fixes: 8700e3e7c4 ("Soft RoCE driver")
Link: https://patch.msgid.link/r/20260518215040.1598586-3-tristan@talencesecurity.com
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-05-29 20:33:59 -03:00
Tristan Madani
22b8fbded6 RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe
get_srq_wqe() reads wqe->dma.num_sge from the shared receive queue
buffer, which is mapped into userspace. It validates num_sge against
max_sge, but then re-reads the same field to calculate the memcpy
size. A concurrent userspace thread can modify num_sge between
validation and use, causing a heap buffer overflow when copying the
WQE into qp->resp.srq_wqe.

Read num_sge into a local variable and use it for both the bounds
check and the size calculation.

Fixes: 8700e3e7c4 ("Soft RoCE driver")
Link: https://patch.msgid.link/r/20260518215040.1598586-2-tristan@talencesecurity.com
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-05-29 20:32:48 -03:00
Jiri Pirko
3b6384dac1 RDMA/umem: Block plain userspace memory registration under CoCo bounce
When a device requires DMA bounce buffering inside a Confidential
Computing guest, __ib_umem_get_va() cannot work. The DMA mapping layer
redirects all mappings through swiotlb bounce buffers, so the device
receives DMA addresses pointing to bounce buffer memory rather than the
user's pages. Since RDMA devices access registered memory directly without
CPU involvement, there is no opportunity for swiotlb to synchronize
between the bounce buffer and the original pages.

The registration would already fail later on, since the umem mapping is
requested with DMA_ATTR_REQUIRE_COHERENT and gets rejected under
is_swiotlb_force_bounce() with -EIO. Fail early with -EOPNOTSUPP instead,
so the user gets a specific error code to react to.

Link: https://patch.msgid.link/r/20260517141311.2409230-3-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-05-29 20:27:29 -03:00
Jiri Pirko
d7a40b5194 RDMA/uverbs: Expose CoCo DMA bounce requirement to userspace
In CoCo guests, guest memory is encrypted and untrusted (T=0) devices
cannot DMA to it directly; such transfers must go through unencrypted
bounce buffers. RDMA registers user pages for direct device access,
bypassing the DMA layer and thus any bouncing, so registered memory does
not work in this configuration.

Until trusted (T=1) device detection is available, conservatively flag
every device attached to a CoCo guest. Expose the condition to userspace
as IB_UVERBS_DEVICE_CC_DMA_BOUNCE in device_cap_flags_ex so applications
can avoid memory registration and fall back to copying buffers through
send/recv.

Link: https://patch.msgid.link/r/20260517141311.2409230-2-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-05-29 20:27:29 -03:00
Jiri Pirko
93ce776a5b RDMA/mlx5: Use UMEM attribute for QP doorbell record
Add an optional mlx5 driver-namespace UMEM attribute on QP
create so userspace can supply the doorbell record umem
explicitly, symmetric to the CQ side. Resolve it inside
mlx5_ib_db_map_user() and use it as a private DBR page when
present; otherwise take the existing UHW share-or-pin path
that preserves per-page DBR sharing across CQ/QP/SRQ in the
same process.

Add mlx5's first UVERBS_OBJECT_QP UAPI definition chain to
attach the new attr.

Link: https://patch.msgid.link/r/20260529134312.2836341-17-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-05-29 20:20:00 -03:00
Jiri Pirko
d6ab1d2439 RDMA/mlx5: Use UMEM attribute for CQ doorbell record
Add an optional mlx5 driver-namespace UMEM attribute on CQ
create so userspace can supply the doorbell record buffer
explicitly. mlx5_ib_db_map_user() resolves the attribute (or
falls back to the legacy UHW VA) into a struct
ib_uverbs_buffer_desc and runs a unified lookup-then-pin:
VA-typed descriptors share a per-page umem across CQ/QP/SRQ
in the same process, FD-typed descriptors are pinned per call.

Link: https://patch.msgid.link/r/20260529134312.2836341-16-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-05-29 20:19:59 -03:00
Jiri Pirko
2cc10972f5 RDMA/umem: Add ib_umem_is_contiguous() stub for !CONFIG_INFINIBAND_USER_MEM
ib_umem_is_contiguous() is defined under #ifdef
CONFIG_INFINIBAND_USER_MEM, but the #else branch lacks a stub.

Add the missing inline to fix potential broken build.

Fixes: c897c2c8b8 ("RDMA/core: Add umem "is_contiguous" and "start_dma_addr" helpers")
Link: https://patch.msgid.link/r/20260529134312.2836341-15-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-05-29 20:19:59 -03:00
Jiri Pirko
38fc5bab6c RDMA/mlx5: Use UMEM attributes for QP buffers in create_qp
Use the per-attribute UMEM helpers to pin QP buffer umems on
demand. The QP-type predicate selects between the BUF and RQ_BUF
attrs; raw-packet SQ uses its own dedicated SQ_BUF attr.

Link: https://patch.msgid.link/r/20260529134312.2836341-14-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-05-29 20:19:59 -03:00
Jiri Pirko
cd767d980c RDMA/uverbs: Use UMEM attributes for QP creation
Apply the per-attribute UMEM model to the QP create method. Add
three optional UMEM attributes that drivers pick from based on
how their user ABI lays out the QP rings:

- CREATE_QP_BUF_UMEM is a single user buffer that backs both
  the SQ and RQ of one QP. This is the common case where
  userspace pins one contiguous WQE region for the QP.
- CREATE_QP_SQ_BUF_UMEM and CREATE_QP_RQ_BUF_UMEM are a pair
  of user buffers backing the SQ and RQ independently, used
  when the two rings live in physically distinct user
  allocations and must be pinned and addressed separately.

Existing drivers would map their current umems as follows:

- mlx5: BUF for normal QPs (one ucmd->buf_addr covers SQ+RQ);
  for IB_QPT_RAW_PACKET and IB_QP_CREATE_SOURCE_QPN, the RQ
  side comes from ucmd->buf_addr (RQ-sized) via RQ_BUF and
  the SQ from ucmd->sq_buf_addr via SQ_BUF.
- mlx4: BUF, single ucmd.buf_addr covering SQ+RQ.
- hns: BUF, single ucmd.buf_addr covering SQ + ext-SGE + RQ.
- erdma: BUF, single ureq.qbuf_va sliced by the kernel into
  SQ at offset 0 and RQ at rq_offset.
- bnxt_re: SQ_BUF (ureq->qpsva) + RQ_BUF (ureq->qprva, the
  RQ side is skipped when the QP uses an SRQ).
- vmw_pvrdma: SQ_BUF (sbuf_addr) + RQ_BUF (rbuf_addr, the RQ
  side is skipped when the QP uses an SRQ).
- qedr: SQ_BUF (sq_addr) + RQ_BUF (rq_addr) for whichever
  side the QP type actually has (no SQ for XRC_TGT/GSI; no
  RQ for XRC_INI/XRC_TGT/SRQ).
- ionic: SQ_BUF (req.sq.addr) + RQ_BUF (req.rq.addr); both
  are skipped when the rings are placed in CMB instead of
  host memory.
- mana: raw-packet QP uses SQ_BUF (sq_buf_addr) only; the RC
  path uses multiple per-queue user buffers (ucmd.queue_buf[])
  that do not fit the SQ/RQ pair semantics of these attrs and
  stays on the legacy UHW path.
- efa, irdma, hfi1, ocrdma, mthca, cxgb4 and usnic do not pin
  a QP WQE buffer via umem; none of these attributes apply.

Link: https://patch.msgid.link/r/20260529134312.2836341-13-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-05-29 20:19:59 -03:00
Jiri Pirko
7c5bbaaf44 RDMA/uverbs: Remove legacy umem field from struct ib_cq
Now that all drivers use helper to get umem and manage the lifetime,
legacy umem field in struct ib_cq is no longer needed. Remove it
along with ib_umem_get_cq_tmp() helper that populated it and both
error and destroy paths.

Link: https://patch.msgid.link/r/20260529134312.2836341-12-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-05-29 20:19:59 -03:00
Jiri Pirko
c0a94fecec RDMA/mlx4: Use ib_umem_get_cq_buf() for user CQ buffer
Pin the user CQ buffer with ib_umem_get_cq_buf() and take
ownership of the umem in the driver; fall back to
ib_umem_get_va() for the legacy UHW VA path. Apply the same
ownership pattern to the resize path.

Link: https://patch.msgid.link/r/20260529134312.2836341-11-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-05-29 20:19:59 -03:00
Jiri Pirko
c1837879e4 RDMA/bnxt_re: Use ib_umem_get_cq_buf_or_va() for user CQ buffer
Pin the user CQ buffer with ib_umem_get_cq_buf_or_va() and take
ownership of the umem in the driver. Apply the same ownership
pattern to the resize path.

Link: https://patch.msgid.link/r/20260529134312.2836341-10-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-05-29 20:19:58 -03:00
Jiri Pirko
ffdc91c993 RDMA/mlx5: Use ib_umem_get_cq_buf_or_va() for user CQ buffer
Pin the user CQ buffer with ib_umem_get_cq_buf_or_va() and take
ownership of the umem in the driver. Apply the same ownership
pattern to the resize path.

Link: https://patch.msgid.link/r/20260529134312.2836341-9-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-05-29 20:19:58 -03:00
Jiri Pirko
e3433474db RDMA/efa: Use ib_umem_get_cq_buf() for user CQ buffer
Pin the user CQ buffer with ib_umem_get_cq_buf() and take
ownership of the umem in the driver. Fall back to the
existing kernel-DMA path on NULL.

Link: https://patch.msgid.link/r/20260529134312.2836341-8-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-05-29 20:19:58 -03:00
Jiri Pirko
f6d2e53ca5 RDMA/uverbs: Add CQ buffer UMEM attribute and driver helpers
Add UVERBS_ATTR_CREATE_CQ_BUF_UMEM and two driver-facing
wrappers, ib_umem_get_cq_buf() and ib_umem_get_cq_buf_or_va(),
that pin a CQ buffer umem from it. The wrappers reuse the
existing legacy CQ buffer-attr filler.

Link: https://patch.msgid.link/r/20260529134312.2836341-7-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-05-29 20:19:58 -03:00
Jiri Pirko
057bb70f53 RDMA/uverbs: Push out CQ buffer umem processing into a helper
Extract the UVERBS_ATTR_CREATE_CQ_BUFFER_* parser from the CQ
create handler into uverbs_create_cq_get_buffer_desc(), and wrap
it in ib_umem_get_cq_tmp(), the umem-producing helper the cq_create
handler now calls.

ib_umem_get_cq_tmp() is temporary; subsequent patches replace it
with driver-owned ib_umem_get_cq_buf*() wrappers built on the
same parser, and remove it once all CQ drivers have switched.

Link: https://patch.msgid.link/r/20260529134312.2836341-6-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-05-29 20:19:58 -03:00
Jiri Pirko
df67f15c44 RDMA/umem: Route ib_umem_get_va() through ib_umem_get_attr_or_va()
ib_umem_get_va() is now redundant: ib_umem_get_attr_or_va() with
attrs=NULL and attr_id=0 covers the exact same path. Make it a static
inline wrapper instead of a separately exported symbol.

Link: https://patch.msgid.link/r/20260529134312.2836341-5-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-05-29 20:19:57 -03:00
Jiri Pirko
3cfdff484d RDMA/core: Introduce generic buffer descriptor infrastructure for umem
Introduce a per-attribute UVERBS_ATTR_UMEM model so each uverbs
command's umem set is explicit in its UAPI definition. Add
driver-facing wrapper helpers that pin a umem on demand from an
attribute or a VA addr; the driver owns the returned umem and
releases it from its destroy/error paths.

Link: https://patch.msgid.link/r/20260529134312.2836341-4-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-05-29 20:19:57 -03:00
Jiri Pirko
28fb701c64 RDMA/umem: Split ib_umem_get_va() into a thin wrapper around __ib_umem_get_va()
The follow-up patch is going to introduce ib_umem_get_desc(),
the canonical desc-to-umem helper, which needs to pin a userspace VA
without going through the exported ib_umem_get_va() helper so later on
ib_umem_get_va() would use the ib_umem_get_desc() flow too.

Move the existing ib_umem_get_va() to a static __ib_umem_get_va()
and have ib_umem_get_va() as a thin wrapper that calls it.

Link: https://patch.msgid.link/r/20260529134312.2836341-3-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-05-29 20:19:57 -03:00
Jiri Pirko
af84105686 RDMA/umem: Rename ib_umem_get() to ib_umem_get_va()
The new umem getter family being introduced in follow-up patches
need a fitting name for the central all-source helper that resolves
attributes, legacy fillers and a UHW VA fallback.

Rename the existing VA-pinning helper ib_umem_get() to ib_umem_get_va()
so the name is freed up. The new name is consistent with names of rest
of the helpers that are about to be introduced.

Link: https://patch.msgid.link/r/20260529134312.2836341-2-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-05-29 20:19:57 -03:00
Li RongQing
555aa0e83b KVM: x86: ioapic: Use old_dest_mode consistently in ioapic_write_indirect()
When reconstructing a temporary IRQ state from the historical/old IOAPIC
redirection table configuration in ioapic_write_indirect(), the code
previously assigned 'irq.dest_id' from 'old_dest_id', but incorrectly
queried the live/new 'e->fields.dest_mode' to populate 'irq.dest_mode'.

Mixing the old destination ID with the new destination mode creates an
inconsistent, hybrid IRQ state. This discrepancy leads to an incorrect
vCPU bitmap calculation via kvm_bitmap_or_dest_vcpus(), causing subsequent
interrupt routing updates (such as RTC interrupt handling) to target the
wrong set of virtual processors if both fields were modified simultaneously.

Fix this by using 'old_dest_mode' consistently alongside 'old_dest_id' to
ensure the historical IRQ structure is reconstructed accurately.

Fixes: c96001c570 ("KVM: X86: Use APIC_DEST_* macros properly in kvm_lapic_irq.dest_mode")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Link: https://patch.msgid.link/20260528031624.1929-1-lirongqing@baidu.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-05-29 15:52:31 -07:00
Linus Torvalds
f3be0c984e Quick follow up, nothing super urgent here. Main reason I'm sending
this out is because the IPsec and Bluetooth PRs did not make it
 yesterday. I don't want to have to send you all of this + whatever
 comes next week, for rc7. The fixes under "Previous releases -
 regressions" are for real user-reported regressions from v7.0.
 
 Previous releases - regressions:
 
  - Revert "ipv6: preserve insertion order for same-scope addresses"
 
  - xfrm: move policy_bydst RCU sync, a fix which added a sync RCU
    on netns exit got backported to stable and was causing serious
    accumulation of dying netns's for real workloads
 
  - pcs-mtk-lynxi: fix bpi-r3 serdes configuration
 
 Previous releases - always broken:
 
  - usual grab bag of race, locking and leak fixes for Bluetooth
 
  - handful of page handling fixes for IPsec
 
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmoZ+wAACgkQMUZtbf5S
 IrtXJQ/9Gwf702wvkRaeLdqrwQ/qLsvDfx5s+3ALIE0Xsm4z9g7V0XKrZ0cfiI1h
 aWGX8HugXEQuy9QvlFt09tgGEd76159g2WdlsBbh1raqiJRUw4GJKXYvwCmBZxsT
 o8bwfVTQ8CVmUTCKhYrpzJKroT6jR8dKHIrkRn5ZyBOBPMOhK8rnDs1OdseW5haI
 b/EkQrzzvTxd7/dJETIJszMQh/nbS5XIlKpQ+f7dfzR1gtO2GOJ24VWqrimonRTo
 qvMwyt+ca2axv7Af796I8mz7X9rqLjWVWzY2uSpd7Y5zITyQwHNbeNvxzr2Ivi4g
 2BcIi+ZHeeRbgQ9EL+rzapTnnIPIw0APPXnp5NnnNDj0RRG3G6PzulW9SmcdsmGD
 o6E7axSZPQT/KnCw1/N7uMfB9cPzgb1i0h8rbE6tCvtkDtJwECtey7Dc7RU9zLqP
 e0jWDv99+MyEqGPcu2LAg2IWLfsuQiV4priy4mM1NgOTQVgS1yw7+x0GiTqiClJ0
 GcOCTOdvYKlmzhLzsLo4I+AcKZq2uJi8wNXMUEP5pmuYByVeF5j+MmoFpQspzx+L
 gdUh9IctAjd47oX/uNaRtocOriU+JJEApToE9WekMb0XYd5Qx1jnt3WqB9ZFuDf4
 smjUirtAWYcT3d4SXR4wGzB5WEa8TITH07A7sa8noozzNmQRu1E=
 =ttPc
 -----END PGP SIGNATURE-----

Merge tag 'net-7.1-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull more networking fixes from Jakub Kicinski:
 "Quick follow up, nothing super urgent here. Main reason I'm sending
  this out is because the IPsec and Bluetooth PRs did not make it
  yesterday. I don't want to have to send you all of this + whatever
  comes next week, for rc7. The fixes under "Previous releases -
  regressions" are for real user-reported regressions from v7.0.

  Previous releases - regressions:

   - Revert "ipv6: preserve insertion order for same-scope addresses"

   - xfrm: move policy_bydst RCU sync, a fix which added a sync RCU on
     netns exit got backported to stable and was causing serious
     accumulation of dying netns's for real workloads

   - pcs-mtk-lynxi: fix bpi-r3 serdes configuration

  Previous releases - always broken:

   - usual grab bag of race, locking and leak fixes for Bluetooth

   - handful of page handling fixes for IPsec"

* tag 'net-7.1-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (36 commits)
  wireguard: send: append trailer after expanding head
  Revert "ipv6: preserve insertion order for same-scope addresses"
  net: skbuff: fix pskb_carve leaking zcopy pages
  ipv6: fix possible infinite loop in fib6_select_path()
  ipv6: fix possible infinite loop in rt6_fill_node()
  bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
  vsock/virtio: bind uarg before filling zerocopy skb
  Revert "esp: fix page frag reference leak on skb_to_sgvec failure"
  net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration
  sctp: fix race between sctp_wait_for_connect and peeloff
  net: mana: Skip redundant detach on already-detached port
  net: mana: Add NULL guards in teardown path to prevent panic on attach failure
  Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync()
  Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
  Bluetooth: hci_core: Rework hci_dev_do_reset() to use hci_sync functions
  Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
  Bluetooth: ISO: fix UAF in iso_recv_frame
  Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
  Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
  Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading
  ...
2026-05-29 15:46:40 -07:00
Arnd Bergmann
1f512d1f74 OP-TEE updates for 7.2
- Fix kernel-doc warnings in optee_private.h and optee_msg.h
 - Allow MT_NORMAL_TAGGED shared memory to support ARM64 MTE buffers
 -----BEGIN PGP SIGNATURE-----
 
 iQJOBAABCgA4FiEE0qerISgy2SKkqO79Wr/6JGat8H4FAmoZYygaHGplbnMud2lr
 bGFuZGVyQGxpbmFyby5vcmcACgkQWr/6JGat8H53ew//TRKAo3lNtl0qpGNg/WKQ
 Js1g9Yr4CrvgH2LbjLTUxARkYjAofy82XuYrQUXX39HeWZLyrebe1o+NTdFo3fhs
 Z7fw8K+krwFe5+xI450E6jVwUnDEhzhroLC2SqC7GeaeIWCQfZxJU5TgTVqeGa2q
 SBG7pJG9w89ICvdMZtepuz5AHBmoX02lCywPYV/5yeOQ8+mitBvGdLFXtR0sGPo3
 AfQ2SsnrzhB+MVj28jjY1/lBlNxC0xA13n47u3CclCiq9UEt4v4BPGcS99Rya0r7
 Et/Jczb/c0Rtit886SOohQ6zVRZ3MLS4NMC06okGg5i1Esc2i+eovnwh9I+lM/7C
 cVFKi223/dhIBgpGwoquca8sMrTSRMTI17oWn0zGk6xrq3EESScGZuDk+dYW4w5y
 sudcfMtTmkPrfw5AzDhtO3/Ihxq58js6BtRY1D32xs3DlFea28S1IgEoxpQMGawD
 KvhGGtEkZzADiBG8hwOwzdhUnDH7mBC6hA83Tvf/8nmzGIXcLWYjmE+EWxBe+fE+
 hwLObSb3eeh4pN2KUEzWJ3JyfrxQnfpfFIWY8XnirHs4QRPGZOjOUIOpmMhg8Vf7
 2q+6IDFjxxPqogAzcF/kGCqRbcu2GlwFEBKUlDl1xOJ6wQFdLQpSL7rT1fqxFYrD
 WUMPyTTJrTMQcxXdKnXlXJg=
 =VjsA
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmoaElQACgkQmmx57+YA
 GNlShQ/9FCV5RfITCXiyLiR4FAGeByON8oT4gnO+dDm5zlmxW4EcZV3ENZ3AEvb4
 Ix6/CIyivgLqcGDAzx/LYYeH/pdEulT1/Tw6PlLJ+6aWlI+547pMQ1Bg10a4+uCX
 +rGvR994eVu25XjFdU2MwBasAm1sgwhbnkH2WAMFtu70a0yvIE38fDP4CwNqgroX
 5fimtTK5zOE1wJU7jjl5LeJuWy8ws4+k2RQlVRSXbs+Xfl/W6Ti9WiiiXArGFcbr
 E3ZdSaGf+Ne8HwLpvULwSi+xwQ/T14WkraCREu89NSe0S6D1yqoJ/6pg5GfxJ27g
 dVrROEBwjXIcI9NcApLdK9lVPzmTt6qkmv/MMDJS0q6iRxR8u+muxuXGNWcu4XRW
 TZtJVET4ZLa0ZJukHffd+lsTWZOQa1LZkvz6VUAha/rndaU/YK9sTbNTVszEXH8N
 ko1UTW/mky65hwB7cK0S3D8uT8P/1BrgjZI/oIN+XjomkM5OYT8BT5XF4H9H0DyW
 s1EN5HynPwbANUyWuo6d08C8ZNVzvI9dykoG4ZMS/KXgc2QTqa78vzWsV5U5Gd4Y
 wNKXww4bBIKDvn7aCJrpHzrwOot0hbkjUS88W1YBL9sm2fflSUHJ1UhnhUkNsuSU
 6rR/FX2BsF9ClNvDfEvtilrQZiheivgJhX7nuB6iPZZ/63yFFkg=
 =EMFT
 -----END PGP SIGNATURE-----

Merge tag 'optee-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers

OP-TEE updates for 7.2

- Fix kernel-doc warnings in optee_private.h and optee_msg.h
- Allow MT_NORMAL_TAGGED shared memory to support ARM64 MTE buffers

* tag 'optee-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee:
  tee: optee: fix kernel-doc warnings
  tee: optee: Allow MT_NORMAL_TAGGED shared memory

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-05-30 00:25:12 +02:00
Arnd Bergmann
1e09b55daf AMD-TEE update for 7.2
Store buffer ID in tee_shm->sec_world_id and remove internal tracking
 structures to align with other TEE drivers
 -----BEGIN PGP SIGNATURE-----
 
 iQJOBAABCgA4FiEE0qerISgy2SKkqO79Wr/6JGat8H4FAmoZY4waHGplbnMud2lr
 bGFuZGVyQGxpbmFyby5vcmcACgkQWr/6JGat8H42Cg//fPRFZ8igbCvGZMmfkUrc
 jLJfplUW3sLPONEC5/j3mzgrtK5bCkGqh2PYCfbtVYfW67fuGzA2BJXDSrPtIaiH
 tkwXL1vzTGZHHGfUpV8fHEsQM75jSyeXumptY/aIr9FkaLsaOIxz+YRbyzMAuOYn
 aP3wPy3ORCgbhd51mJ+aQvbu0xC7C/JJuWGfv+UmdVFaGLUYIzLp8pzJ3LESnHQq
 R8lqDUfLxu2NXmGRSZkxNQYRx9yxosmxraVSEpQYjlihz0urwQrXI55NFiHT2VRx
 mks6k/ykCKHDCszYnbWIrDtuhQ7AN09iNePfkXK/6SWoAyI5vGqaotRlqyFKSIde
 2AD/eQJm9jtBaGASjI2lOzlCRlbzNh9KFihPlVHCA669ho30hPAvX8ZxpgEKdj1x
 JLwgrqikow9VW6wGtF5uyUyWgsRuK/adQb1s5FrL+130rAW0t0MkvDBbx3EJKBvx
 yLqnmdHKIs45U8nrGA5ke9FyLuGk4Wf99r2cXoG4ZQGzIQ76irR4CFpK2LIKQMHl
 WQwBCLdh/2KmB1F8dKfHFQwaFVNvhE+fuGpaetnVOBMoA0QjmTHYI0m9Ll9ZUBnU
 6iKsMw1QukPaToEy6XAuAW59F1txiUB/n6Wenhgsr0UhhWRFaD4uqEx7EzwnbQnB
 YKFqRKZX4KMQgtihgrRKU3s=
 =D25u
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmoaEfQACgkQmmx57+YA
 GNlNuw/8DcwlczkJeD4yaOHGoHiR/91QhxZEnsbJ47xyf6Mz4NTPRqhUob2Hm2NE
 1F2gBEe8hX+ywYkaQBozopRVXSeiAtz9yhfNUxaFK9/B4QK5QDQPj2rTqreUtshy
 qMyb0Y+dCzuKxM1Zt1vVKr2NnCbZ6vGfrzsrLOS2HLWfIGAPoN7vur1ffgTipsBW
 XxbVGj9mLVBiBBGOAiZFJMuLsqKasQS+RbuRmA3E1sZ+GT9ilLkj14dUvoK3pLU6
 4OQZH3JfkHJDoziHz/qJdgRhr7gVWdiWhhLv8WnG40xjcnFAbeLoNeHUgG9JjaBM
 7yOnRsQyChRVYDHNMko//7Thi2p5pL2lqSTBcllP4quP7jeM209fi2zOKzqbty0Q
 N4PcMpJUctGailBYYnOBT3Cma+jKY7wQ08z3illC1yVaWtHkn4VwQmnKuS0da7+X
 NkQU5tvQ8lb1OUSqEE3klvSGM/sUk/g95vjGbnx3ftkwDeN1YJjmzd1ft+WdzWrj
 FD0ia88OHyKkXGA+/5NW92mOW36Kd2OMtKy84MMbuUGYXVY4ExMz3jTw9XztJ07s
 rwdY2LNVPan2bqZXkhJjBW++LMpAC/JQfsSnOtv2KPAE2X7wHi4UM61WWgv0IOxc
 yu6v7asMca4Ie15IV0u7684xiaRNH9OzP2hYY43vrS4QpmhTwoE=
 =pc2V
 -----END PGP SIGNATURE-----

Merge tag 'amdtee-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers

AMD-TEE update for 7.2

Store buffer ID in tee_shm->sec_world_id and remove internal tracking
structures to align with other TEE drivers

* tag 'amdtee-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee:
  tee: amdtee: store buffer ID in tee_shm->sec_world_id

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-05-30 00:23:15 +02:00
Arnd Bergmann
9f468bd841 Arm FF-A + SMCCC updates for v7.2
1. The FF-A core is moved onto the driver model by reverting the earlier
    rootfs initcall change and registering the core as a platform driver with
    a synthetic arm-ffa platform device. Enumerated FF-A devices are now
    parented below the FF-A core device, and probing is deferred until pKVM
    has completed its FF-A proxy initialisation.
 
 2. The platform-driver conversion is also adjusted so systems without FF-A
    support treat early unsupported transport/version discovery as a quiet
    probe miss rather than a failed matched probe.
 
 3. The register-based partition discovery path now honors the descriptor
    size reported by FFA_PARTITION_INFO_GET_REGS. This keeps parsing aligned
    for newer FF-A descriptor layouts while still copying only the fields the
    driver understands.
 
 4. Also included is an Arm SMCCC fix for the optional SOC_ID name call: the
    name query now uses the SMC64 function ID required for returning eight
    characters per register.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEunHlEgbzHrJD3ZPhAEG6vDF+4pgFAmoXBagACgkQAEG6vDF+
 4pg5Kg/+MOto5ThmWsJ42dMf/u96JDu+U5zdqnzt0wECS8wLMDyTT/t7KLz8KDQO
 7fBm1S7apWN/HsS4RaIIEJZx0Rb5qbg7X4rQXEvIw1m/YjjF5ktp0AgGC3kb1SzY
 SHntcPW2YGaDtdkoXhAy5laLl0nkjoVsdiv5QYdl7NE7XvaTmMs128P58P3UZlmu
 ubU3ua2+nyDyQewK6I4yIjAx530lvuGJPiOB2/2t4QTnMzhtMOPlBzSEvqDK/+fm
 2XvqZcWJuSnHmKqXtRmEhf3qKYxzLeoRQ45vE3BUE6DB2rvA6GRzitWItzmxwqU9
 W2HD1wqe09bWROYVgw/fSB1fMlf2rbXFP4MHp7rr3XcZdaS7paP/c9eoMkUknON2
 QdFKG8pnwICeuWfsU59wLjzOo7ebcRjRPpLj9LwKTj6k4ixee/i0E2ldUhViG75Z
 FUtiQtbf3ArBBEIhVNrlhl7Z1AkMUVAOvDJpvz4ELcvndTcSYE03uZG7BcJ1f79H
 t6KC001TeGuXAEzcbJnCiWTMufHvuWfbz6vSiE0iaJ8jpLruJHz0u3nN4Ywii/7q
 T+WM1oAdiS+bDvdWTD+LQiAOypMcrTUNJp9eNAMWAspg9Ih+r3pqqUXOzHuwlgPt
 8l/S6cK1NDBlmANZ3Pvw65vjWUTY1Cc1yejDJjAe3kXO5CNovxM=
 =oqtn
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmoaEKoACgkQmmx57+YA
 GNlE0g//VzWrRkCRjjHaapPL5lPcmsDMt3DMeGeDg8780ektIQm60TUhTT1GAAB7
 ixnXrimBGItglKQct/CAm09bZGrhnfPvUndkA9Orj6YNrF506AAA9tRgBTWdtIOp
 60x63+cGHcO4+FXDklX4Ux6CiGnSRS8RFGxYVHfFhGNmwDN/fresDRFOuGlf+ey5
 4Op2xzgmgjZMstLZ0ecz7A3XPl+brxXvLIlatmn+fQ4VI928oTbEJK8MZcx7U9gW
 yecdiP4K8xR82o+EA8aIUaLcisRrkD7vcQeaRkHGU8rF0ncHOEULVPjGQyEbxkJj
 fPudSBvAFehG7ARHfmqfKxofIglJ/lsVnGpWnBr5tcpUW4nURk0W75+rpsTO+GcH
 M5u1+nJb4c+l8ajNRb+8oKUL3SjDsjwdCIo8y4Bqjzmcxuwn72JLphhSfAS9fKwg
 SOTeaJlCC5qbo4kMCiVEqg5skm8y0h0qd3NhGHG/3TUZXtVcqZroI3vXOaowpKz4
 H0WWeIUNQy31x5sOnUulmiARoFbBAEJrBdjlfcLsEMFIX0O5BSOhRcZnXUIsGURM
 u9Ul0V9jnMYEM+BZ+ImIEVypT/uHo4/eX/s/RdSC0xhT54UJDSgooQzbl4zEpQ6K
 2TaomWgZL+O95MwxHXTVz4I8DplFUkI7kBT89Hj9gW5FTJ/wRdc=
 =J4Bj
 -----END PGP SIGNATURE-----

Merge tag 'ffa-updates-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers

Arm FF-A + SMCCC updates for v7.2

1. The FF-A core is moved onto the driver model by reverting the earlier
   rootfs initcall change and registering the core as a platform driver with
   a synthetic arm-ffa platform device. Enumerated FF-A devices are now
   parented below the FF-A core device, and probing is deferred until pKVM
   has completed its FF-A proxy initialisation.

2. The platform-driver conversion is also adjusted so systems without FF-A
   support treat early unsupported transport/version discovery as a quiet
   probe miss rather than a failed matched probe.

3. The register-based partition discovery path now honors the descriptor
   size reported by FFA_PARTITION_INFO_GET_REGS. This keeps parsing aligned
   for newer FF-A descriptor layouts while still copying only the fields the
   driver understands.

4. Also included is an Arm SMCCC fix for the optional SOC_ID name call: the
   name query now uses the SMC64 function ID required for returning eight
   characters per register.

* tag 'ffa-updates-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux:
  firmware: arm_ffa: Treat missing FF-A feature on a platform as a probe miss
  firmware: smccc: Fix Arm SMCCC SOC_ID name call
  firmware: arm_ffa: Honor partition info descriptor size
  firmware: arm_ffa: Defer probe until pKVM is initialized
  firmware: arm_ffa: Set the core device as FF-A device parent
  firmware: arm_ffa: Register core as a platform driver
  Revert "firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall"
  firmware: arm_ffa: Fix sched-recv callback partition lookup
  firmware: arm_ffa: Snapshot notifier callbacks under lock
  firmware: arm_ffa: Align RxTx buffer size before mapping
  firmware: arm_ffa: Validate framework notification message layout
  firmware: arm_ffa: Keep framework RX release under lock
  firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
  firmware: arm_ffa: Unregister bus notifier on teardown for FF-A v1.0
  firmware: arm_ffa: Fix per-vcpu self notifications handling in workqueue
  firmware: arm_ffa: Avoid collapsing NPI work from different CPUs
  firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
  firmware: arm_ffa: Check for NULL FF-A ID table while driver registration

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-05-30 00:18:07 +02:00
Linus Torvalds
77590cacab Clang build fixes for 7.1 #2
- Account for recently implemented -Wattribute-alias in clang by
   disabling it in the same places it is disabled for GCC.
 
 Signed-off-by: Nathan Chancellor <nathan@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQR74yXHMTGczQHYypIdayaRccAalgUCahnrhQAKCRAdayaRccAa
 loxRAP0dhAttt5Nzj1QVvVshp5gUdELM+zXD1qyXAY9Z81V3rgD8C867ax5pGAgO
 kV2PwaBK5P6FJ8joUz4m3qB20FXXYQs=
 =drMM
 -----END PGP SIGNATURE-----

Merge tag 'clang-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/nathan/linux

Pull clang build fix from Nathan Chancellor:
 "A small fix to disable -Wattribute-alias for clang in the few places
  it is already disabled for GCC, now that tip of tree clang has
  implemented -Wattribute-alias as GCC has"

* tag 'clang-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/nathan/linux:
  Disable -Wattribute-alias for clang-23 and newer
2026-05-29 15:17:53 -07:00
Andrei Vagin
44eeff9bc4 Revert "x86/fpu: Refine and simplify the magic number check during signal return"
This reverts

  dc8aa31a7a ("x86/fpu: Refine and simplify the magic number check during signal return").

The aforementioned commit broke applications that construct signal frames in
userspace (such as CRIU and gVisor) if the frame's xstate size is smaller than
the kernel's fpstate->user_size.

Furthermore, this introduces a critical issue for checkpoint/restore tools
like CRIU. If a process is checkpointed while inside a signal handler, its
stack contains a signal frame formatted according to the source host's xstate
capabilities.

If that process is later restored on a destination host with larger xstate
capabilities (e.g., a newer CPU with more features enabled, resulting in
a larger fpstate->user_size), the kernel will look for FP_XSTATE_MAGIC2 at the
destination host's larger user_size offset instead of the offset encoded in
the frame's fx_sw->xstate_size.

This causes the magic2 check to fail, forcing sigreturn to silently fall back
to "FX-only" mode. Upon return from the signal handler, the process's extended
state is reset to initial values instead of being restored, leading to silent
data corruption.

The aforementioned commit cited

  d877550eaf ("x86/fpu: Stop relying on userspace for info to fault in xsave buffer")

as justification to stop relying on userspace for the magic number check.

However, these two changes are fundamentally different. The last one only
changed how much memory the kernel ensures is paged-in before running XRSTOR
to prevent an infinite loop. It did not change the signal frame format or how
the layout is validated.

Reverting this change restores the use of fx_sw->xstate_size for
locating magic2 and restores the necessary sanity checks, ensuring that
the signal frame remains self-describing and portable.

  [ bp: Massage commit message. ]

Fixes: dc8aa31a7a ("x86/fpu: Refine and simplify the magic number check during signal return")
Signed-off-by: Andrei Vagin <avagin@google.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Chang S. Bae <chang.seok.bae@intel.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20260429000623.3356606-1-avagin@google.com
2026-05-29 15:05:30 -07:00
Arnd Bergmann
1499b84142 Arm SCMI updates for v7.2
1. Improve SCMI clock handling with a protocol-level determine_rate operation,
    simplified per-clock rate properties, dynamic rate allocation, bounded
    iterator support, lazy full-rate discovery, and hardened parent/rate
    enumeration.
 
 2. Fix several SCMI bounds and payload validation issues, including clock rate
    discovery OOB handling, power domain name lookup, Powercap domain state
    access, BASE_ERROR_EVENT and SENSOR_UPDATE payload sizing, and sensor config
    width handling.
 
 3. Rework SCMI transport probing for virtio and OP-TEE using per-instance
    transport handles and a generic transport supplier, removing the need to
    register SCMI core drivers from transport probe paths.
 
 4. Add i.MX SCMI MISC reset reason support and print i.MX95 boot/shutdown
    reasons via the System Manager interface.
 
 5. Clean up SCMI core internals, including base-info naming, quirk parsing and
    table iteration, and list iteration.
 
 6. Fix SCPI clock provider removal so child clock providers are unregistered
    using the same DT nodes used at registration time.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEunHlEgbzHrJD3ZPhAEG6vDF+4pgFAmoXAwkACgkQAEG6vDF+
 4piLrBAAzNS5ccs/3KAMvaFW5g3amS+FmHv4m1tzM+YmQOKjdVtysohzdHsTD0Ox
 C6No2+jFJUrtAZnENc32lTTpnHqg8QVWTujP88L17EHH0TlCQDOJb8IR7mVKFkva
 pk7Ll7dKeVTEU0lXlrK33MaVUyYAT6QFKw0jhbDCtGnmvZDbKG7Ez4ph/WODywBe
 PtKRZK0hUQNm6wyEOVep4in36P3p8vR+xn6wFR37ndbXkyvJULC45af8SceoaClH
 2doWr7nTh7rJL9ythaZ5qBodOV2IGCcAEsnxRqKdw++CBxYEApiFgCc9cT203yPw
 IoHx+/XEwt/a2K8LjJmYnai2ds5mYUMJp2uJO6FaVoeIfU/VQE8DeI1Ri2w/dS9d
 O+xoNf8Tu5phbJg3RCDXsotzNSdruqSxI4AgKl+g6XeFZJH4N2SNKrmw2trr+jpX
 FN2SJBcogXsxrza/inIUaZ8qKxz2249kHgIbwKAjXdQrnxDPhPGa8ng//rh20jN6
 wNISU6dfVtgVV7bP3M2oedAmiFdt8ltxnFXOJf+bRNEJwwDcsmNKa9LuJOEJAc1r
 cvfuX6q64Ho+ZZDqnlZsoa7Ho0LNJsg080Y/dGKRR6Llebw0y1kaIxrbiQ6sjqkH
 295U0fQOuIeUB7hA+Fb4o0IsXz5wXJE2Ri7qUU1PcqLfBAyNRbU=
 =dgQR
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmoaDYAACgkQmmx57+YA
 GNnRLBAAnLjHzohhPXs1LwoTjTTpGZOllBAn3MRejiF8Y/QMhWw2CcWeahlfH5uF
 307HXNYZbhV7hFvDHwUeTOywJxLKuBBez5GHp+XqN1sPhZsh0/+fVSSnBDERV6ix
 ZYra48jAx5yBuRP6gFlKMam0LqplToYZMRMXXmSAmF4/ljkX7SJNwH6ZkzTwqrc4
 KOHcfGE67+N+D9jY8q7OHXnkCJ+M3bOQSc93bOu6l3uHHieEjBGpnUx3lKl1lKdn
 3DpOhz1+lfFQOC1B1eul2cY+mPjliE6wnFOh2/7+z8+9FP1h3NXxfWRz2e9CdouP
 ATYjMhlrF8gDsUO1q8os/04T5iVhpZvclc3nO5sVY7DIiic7vjLiuNunVLPW0NHZ
 41vhLaUXYyU9OTbb/IHjlT6P+K6zzkPzV7uGdCzs9Yrv8T56jp88LQ9AtDXGB48t
 PQwjpeiPZa0xsDRh8HtU17yjd5JacHObPJwrmGZMWSU+Q7GE2cYaTuU2Axeiy+Fw
 uZndAm2Eka6KHLzkbac2eXLKtgc7/mafKykhTBdGCwis9glN9TfUM/160GwINKih
 r8CjArp9wr3wc3ari/vTaEcSkFoFlRl6l7IKeUnUX6FQv9HYwn7FO2ZwzICT9Ms1
 0niUuBk8Kei+NQhKHv+ncriT7SxtHdTPkGcntp722FvsECVSlfI=
 =HwlH
 -----END PGP SIGNATURE-----

Merge tag 'scmi-updates-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers

Arm SCMI updates for v7.2

1. Improve SCMI clock handling with a protocol-level determine_rate operation,
   simplified per-clock rate properties, dynamic rate allocation, bounded
   iterator support, lazy full-rate discovery, and hardened parent/rate
   enumeration.

2. Fix several SCMI bounds and payload validation issues, including clock rate
   discovery OOB handling, power domain name lookup, Powercap domain state
   access, BASE_ERROR_EVENT and SENSOR_UPDATE payload sizing, and sensor config
   width handling.

3. Rework SCMI transport probing for virtio and OP-TEE using per-instance
   transport handles and a generic transport supplier, removing the need to
   register SCMI core drivers from transport probe paths.

4. Add i.MX SCMI MISC reset reason support and print i.MX95 boot/shutdown
   reasons via the System Manager interface.

5. Clean up SCMI core internals, including base-info naming, quirk parsing and
   table iteration, and list iteration.

6. Fix SCPI clock provider removal so child clock providers are unregistered
   using the same DT nodes used at registration time.

* tag 'scmi-updates-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: (31 commits)
  firmware: arm_scmi: optee: Rework transport probe sequence
  firmware: arm_scmi: virtio: Rework transport probe sequence
  firmware: arm_scmi: Add a generic transport supplier
  firmware: arm_scmi: Add transport instance handles
  firmware: arm_scmi: Fix OOB in scmi_power_name_get()
  firmware: arm_scmi: Validate Powercap domains before state access
  firmware: arm_scmi: Validate SENSOR_UPDATE payload size
  firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size
  firmware: arm_scmi: Read sensor config as 32-bit value
  clk: scpi: Unregister child clock providers on remove
  firmware: arm_scmi: Introduce all_rates_get clock operation
  firmware: arm_scmi: Fix OOB in scmi_clock_describe_rates_get_lazy()
  firmware: arm_scmi: Use bound iterators to minimize discovered rates
  firmware: arm_scmi: Use proper iter_response_bound_cleanup() name
  firmware: arm_scmi: Fix bound iterators returning too many items
  firmware: arm_scmi: Add bound iterators support
  firmware: arm_scmi: Refactor iterators internal allocation
  firmware: arm_scmi: Harden clock parents discovery
  firmware: arm_scmi: Make clock rates allocation dynamic
  firmware: arm_scmi: Drop unused clock rate interfaces
  ...

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-05-30 00:04:46 +02:00
Arnd Bergmann
b6a6fae6c5 Qualcomm driver updates for v7.2
Enable QSEECOM and with that access to UEFI variables on the Surface Pro
 12in laptop.
 
 Refactor the Geni Serial-Engine helper code to allow the serial engine
 drivers (such as I2C) to operate on targets where power and performance
 is controlled through an SCMI server instead of individual resources in
 Linux.
 
 Extend the LLCC driver to support reading its data from a System Cache
 Table (SCT) in memory instead of being hard coded per platform in the
 driver. Also add support for the Eliza platform.
 
 Add support for the Hawi platform to pd-mapper.
 
 Switch the SMEM driver to track partitions using xarray to handle the
 ever growing number of hosts better.
 
 Extend the socinfo driver with knowledge about the Nord, SM7750,
 IPQ9650, and Shikra SoCs, as well as PMAU0102, PMC1020H, PMIV0102, and
 PMIV0104 PMICs.
 
 Define UBWC 3.1 and add a couple of convenient helpers in the UBWC
 library for MDSS and Adreno.
 
 Fix a memory leak in the WCNSS firmware download mechanism.
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCgAsFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmoVuSUOHGJqb3JuQGty
 eW8uc2UACgkQCx85Pw2ZrcUJoBAAxf+8fFvYZif2gk1wzA01IINQgB5/2gYu9oSW
 Ex4YrHF2wV3BlzRjDnoQ9yC9mYyQeAwqy0pHPIEhJrh5pTc7sJLH5P+iXwe0JU2e
 GD6WtxRlSswIhDcmoJokSWNkyQxGu540Mh140/Bd0Pb0tMelh76wmzcpY31tzDOa
 APmtPCXWOdMGYAJSA5DMUMlKEENBNuD7yg0sYtoNz4+XVv4nsjMviEspyNN/fWHg
 UvL7IJPFwiKynsYrohTgFS5spXOR79aR1xPVsujoUVhzV/W0NFXiDgGLZa41QBAJ
 lfqmxQiNCZ6I3n2R4X1OULXy9vLZalLiXQzMOJhvPbjXjW1R6jy40f5+W9SZnNSH
 Q33nbkpJWG81gN5GeqwdPi1+gDDIMyw4A3+RaqRPJBYkYzG1NU2YD5ZNFpMrfRta
 BT0Nzs8wdmMQgHDGXhjuzMC1hrm9b8QOT12GUnm2hcL7DIJsJC2mtLmlrvnQSm8y
 3iPDrEhok2GzSXOKs1EkRfennjLG2MM54Bv7WosNJjrQi2FWkwU2OeNavDxkHo4G
 JTWwOPFoRysHqmqLr9aIvQGV9lQ2W+57CqnjrbVeMNclJNUm0usZX/i3zX9jCG7R
 SGwdslqlE/PqJWjUN8S/+LECI54axJXlp3KE6+m+nkEsOQcYIxwU/PfZiG1vyJu1
 0Y22gro=
 =mOpO
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmoaDQQACgkQmmx57+YA
 GNm/KxAAumqFwdnLIK37ui8u3FG1he/Pal9RwXR0dJkLTAYmCK5vd/e/GEjTL0BG
 W2Zv+Gt1kvm0BZ10b7AaQNKx5jnE7AsglOTHXXW8pVmZW7w1Fz8CP96SiZz2iKb0
 Fqpuq8utUg7fxYzYZuPGMWNQVSf0dliZrygp8iTHop/2iaJzL/dOQHBtXSXvuJVW
 FhCYtaDIBXpLzbFpe8z+QMM5bYmgiIF8zqdmOSe92LYVVWv1WNzflu8+fGDCxv9z
 EhsLdkM62xCR2a5YE0Tx0/44hw6sGh7ffnfkkIrEJvIBtkjxoERc0TRGXcvTeUnp
 bX4H1d/kanzvUu+0KrP+fxiCQL1DmiUi8SOEFx0YUSrBSp0HtIdgVyLxM6Q0UYdc
 JP95xqb/SfvVGRf3FFrP8NlIwM7n8NGpV8PqUnQ0K+NVUnsQWPJPZ+lkyCjX6G3b
 pXR/eSe4OBu3xjUAB2x7r0YQbEjlB1FeVQEA5lRdlW5QSzty/kLgUm/z+4rLQSq1
 Zmw9rL28SnlOsoESF0/EAgNUTFfG+cA1wERwa9BdQbb3CzWxKU6QsAInL6ZEp1xI
 eTtGI+ia9yUv4pzMOiuv00seQQ2A45Qww6xkgsM2n0wbP1Bza9Rrkc1w9exK36ho
 JZkQ773gwyEYyRfHoobYyFRYtMve4JOWCjGjL5F3Gtw3YddABXU=
 =ryJr
 -----END PGP SIGNATURE-----

Merge tag 'qcom-drivers-for-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers

Qualcomm driver updates for v7.2

Enable QSEECOM and with that access to UEFI variables on the Surface Pro
12in laptop.

Refactor the Geni Serial-Engine helper code to allow the serial engine
drivers (such as I2C) to operate on targets where power and performance
is controlled through an SCMI server instead of individual resources in
Linux.

Extend the LLCC driver to support reading its data from a System Cache
Table (SCT) in memory instead of being hard coded per platform in the
driver. Also add support for the Eliza platform.

Add support for the Hawi platform to pd-mapper.

Switch the SMEM driver to track partitions using xarray to handle the
ever growing number of hosts better.

Extend the socinfo driver with knowledge about the Nord, SM7750,
IPQ9650, and Shikra SoCs, as well as PMAU0102, PMC1020H, PMIV0102, and
PMIV0104 PMICs.

Define UBWC 3.1 and add a couple of convenient helpers in the UBWC
library for MDSS and Adreno.

Fix a memory leak in the WCNSS firmware download mechanism.

* tag 'qcom-drivers-for-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (40 commits)
  soc: qcom: geni-se: Introduce helper APIs for performance control
  soc: qcom: geni-se: Introduce helper API for attaching power domains
  soc: qcom: geni-se: Add resources activation/deactivation helpers
  soc: qcom: geni-se: Handle core clk in geni_se_clks_off() and geni_se_clks_on()
  soc: qcom: geni-se: Introduce helper API for resource initialization
  soc: qcom: geni-se: Add geni_icc_set_bw_ab() function
  soc: qcom: geni-se: Refactor geni_icc_get() and make qup-memory ICC path optional
  soc: qcom: llcc-qcom: Fix NULL vs IS_ERR() bug in qcom_llcc_get_fw_config()
  soc: qcom: llcc-qcom: Add support for Eliza
  dt-bindings: cache: qcom,llcc: Document Eliza LLCC block
  soc: qcom: ubwc: add helper controlling AMSBC enablement
  soc: qcom: ubwc: define helper for MDSS and Adreno drivers
  soc: qcom: ubwc: define UBWC 3.1
  soc: qcom: socinfo: Add SoC ID for Nord SA8797P
  dt-bindings: arm: qcom,ids: Add SoC ID for Nord SA8797P
  soc: qcom: socinfo: Add SoC ID for SM7750
  dt-bindings: arm: qcom,ids: Add SoC ID for SM7750
  soc: qcom: socinfo: Add PMIC PMAU0102
  soc: qcom: socinfo: Add PMIV0102 & PMIV0104 PMICs
  firmware: qcom: scm: Allow QSEECOM on Surface Pro 12in
  ...

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-05-30 00:02:42 +02:00
Hardik Prakash
3f786abd23 Revert "pinctrl-amd: enable IRQ for WACF2200 touchscreen on Lenovo Yoga 7 14AGP11"
This reverts commit 3812a9e842.

The probe ordering fix in the following patch ensures amd_gpio_probe()
completes before i2c-designware probes AMDI0010:02, allowing the
existing amd_gpio_irq_enable() flow to work correctly. The manual IRQ
restoration added by this patch is therefore no longer needed.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=221494
Signed-off-by: Hardik Prakash <hardikprakash.official@gmail.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Fixes: 3812a9e842 ("pinctrl-amd: enable IRQ for WACF2200 touchscreen on Lenovo Yoga 7 14AGP11")
Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-05-30 00:00:33 +02:00
Arnd Bergmann
930c882020 Memory controller drivers - fixes for v7.1
Fix probing of Atmel EBI memory controller driver e.g. on at91
 sam9x60-curiosity board due to usage of platform_driver_probe() which is
 not handling deferred probe.  Lack of EBI driver caused dependant NAND
 controller to fail to probe, basically failing entire board boot.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmoZPZ4QHGtyemtAa2Vy
 bmVsLm9yZwAKCRDBN2bmhouD1wBTEACWlhnslXLbIma+QXkLDvVG4wi+WvDLMM+q
 nQGXDwFa5bkmE9dwlkVeLiDMIhBj+q0WMgH3ctHQCPyde2l8vIvdkuWM+HyGgFTs
 eNmQTIFyn09YayZTzWE/5q/fJcIBMeFyfLPDnf562qs+cWu7BxfT8M4jvvdpQ9QH
 BJZbBLq4l80+X6Q1AlLP4djklY7CRosV/8Acuo2cIaiIEPVEWaGdFX5EcGSqSvFf
 3uMIHw/X+BiHpsZv02NLFOF57El3COEJNrgaiSUM9NtUkPfgvrIIBZgUwhdvG81r
 0+3eUKqL1jvZc2K6QLUvNR9lWuCE+5g4jVhgF+mPkXyIKu5Nl1x1JO09Q+IBTkZd
 r+rJFn+mBdAFGc0gHufHNyP8QiXntmCn0BVp6paBH0RQUroC3MWaJaYGxyk1fUA4
 ohCtRqFUqkDyDebqLrtZAe1R87B382Ia+477h5pRvivEViVrRFm+n3TJl2k54Gcw
 eTs/HFv58jn2122Uz2vOmUMVlVQsbrzrm1LpPHoAmkcDkogkRSDaGUK/o3RLvh1l
 nzIelNNL3KNpw6R6wHzEJUINS31VgVxc6WadK60py5MmmoGvS1hIXOF6/iBx8Vk6
 RAyuW1LNuj6eAhwmBK6h2tQn+Gs/pidymlrassdxzPUwrft7mMuc2CwfL92QAwtN
 X3eFiWuayw==
 =4VXt
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmoaB6MACgkQmmx57+YA
 GNl5aQ/+LKUsj8Z1+ldO3y8RznLbgD4eszkgT3vjUrGj1VxdBijHL/EWqBtfacoJ
 Lat6nNMmFeE8LcDqStm3SwM20N2m5PaXFPcIeDaDL/ZiM+v3YfCTvX4lkzQGJ1B7
 dIs89cPyMQX2qwF8+uKRZou80RNAwRWTp/zT0Q7sIxnzsQ6Gz2tybuxEZ2abgdmT
 X2F1HY3ex8TXTA+NqfJLubf9eHtbXxI1KqFtjU9+YI83OHFqSPNHLNmKCNH0uHkn
 vhGXZgX6RuebtYCw0Fo73cLm3UUj24204pVuujA07OmQmPiZ5Xvp1wMGZtmNkzQU
 L1f3Pav+UDopM6IIzbc2d+Y/YSvupS8ADkaYmcsxLo2KTpdRyRrEf3If2AiQGpxG
 kTCLKWkXDVg8SQic0W+jHC+8wnm9Ec8Idp08s/4XPlA1vSo8MRSE+TDHBmDGgDhQ
 IqvddJE+uT2ZW1yU2Wao7rfQ3KRaWuz7xPYb7ySilAn1i6LtCjysUaDISxRBCiYQ
 bQoxXvvWdmqg8aDpsRyhW2mwQN+4vEeq/IH73XoiZH6jzTj9wReHbudKDG1gREFx
 X/0tBBwuuJhwNbtOj+DVrJlM1WqPDjb7zw6yzEinf3LzvEYR8BGK+R0w3mWa8Eal
 bJCEjHg4mx6LEkFdleFmhLyAL7fVJoxydmpb3HpQ+5r0xk01YhM=
 =8TQP
 -----END PGP SIGNATURE-----

Merge tag 'memory-controller-drv-fixes-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into arm/fixes

Memory controller drivers - fixes for v7.1

Fix probing of Atmel EBI memory controller driver e.g. on at91
sam9x60-curiosity board due to usage of platform_driver_probe() which is
not handling deferred probe.  Lack of EBI driver caused dependant NAND
controller to fail to probe, basically failing entire board boot.

* tag 'memory-controller-drv-fixes-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl:
  memory: atmel-ebi: Allow deferred probing

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-05-29 23:39:46 +02:00
Arnd Bergmann
f5e70b3f30 Samsung SoC driver fixes for v7.1
Fix several concurrency issues present in Samsung ACPM firmware drivers,
 used currently only on Google GS101.  Tudor with help of Sashiko
 identified several missing barriers and incomplete synchronization,
 leading to possible transfer data corruption or use after free.  Few
 other issues related to probe, including missing mailbox cleanup, were
 also fixed.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmoZgsoQHGtyemtAa2Vy
 bmVsLm9yZwAKCRDBN2bmhouD1wmbEACCXrSzY82MLt6XmVByWQy9U9OBLkC471qA
 GhcVdC0uMs6hD5prvJCnHVP236XKUZnT6EZjpBW+8Me3Yw4z4j9Wdd5j0z1haEF5
 DdldsjBjrawsXazVVlj4J7iE1fv83dZrgOASDXFhP+GHRPsfrCYWlNIPhWcG8wwp
 68yYY8FT4hQ4/i5otWixHSdeaadPV/TWf+W90l/1Z6uXdt/9CzAcavHiLOkLWji+
 dy87ZNTcpZoCqa12sPz2wkmMXj5ET5vUsuvoVZu3376ViU8q/6kSIRYtIQjCgM8J
 cMNArDequv6g24ra+W8D234qo50fBAVpeYHFyZKDJYekkJ9HJyQ2NXarJz/kvEUw
 ZkmUA/SgZUc0hM5i0J+5O6K7lTed6eMmkR72QTT/uQZOAcEkqsFpkuZhAetxguR8
 vO7p99+QAS/grHKiXaLKTOYgpoxitqx0int0FZ1shWbeO/OYorrZ00x0OkK++V++
 WsI7SJVNco/LM4APdSIRBphZ5ULl6xgu2SLO05J7uQFgiUWU0Q9v+t1MxIbvmL0T
 HH5H1STGr12LOBwnJDjK/AYbAhFFM9pZxgPJU9S4NzKu3peQJjgLvnOeEEmLkmeQ
 47bKUlrOMQIP5lpzLBYtL9NT/7fyQKfl8fbdq5O3KwthMvOiit6mGD+ExDoptIp4
 4T+NBiG08A==
 =hb6T
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmoaByIACgkQmmx57+YA
 GNmeiA/9EZ+LO2JUrUVhMNXOfUmDGrpfL/mVqcGL9ksK+EkOW+9Fae8f9hWrvBFh
 exeMRTwKDcA2hag6AnBiKhctLYFIZ7+nRb/xu2ybasdIAloR10oDKlmgzH/Yj4c9
 MsIgfuK+q5FnOxyhtNEZ4JszYYvAl3wfFvBR1241L52tJ+vyOLxEjk/8rhESFv1P
 rTeCXlRA/dJ4hqpP9j+QflgrvrIYe1vhsBdNFXQEcjUgQnqySPY7Ynlnr1BJMyWQ
 N4x+gJ9ZITr75kzMJCwqGXfktwPP6+BahBHDk8i6U6zfFwb2DJFHx0OSYf3Z1s1w
 V7wxIMiGr/XZ/r0D6prlqYAjLZS8KL9sYEC/UB+WB95SwnFWm3J1K895rt4awuzY
 HD6jhgPlyvIBEJRI7ZNMB4Hg0p9Z5pXse1EDseDdAnAth9brbFN7d/JbbtTMKfny
 jyQJG8rEUvmSF+No35VprFW6JhyDHFlnrQvoSQdLgxsKHrMRcI1xYnQXi2aILlYI
 cYCYzL2lAeteaMHVMrPDoLQGCbKnvTz+pAhiOXTX2ie6XS8JuYPhf1H+Pp8GTozp
 P+Iy995FZ92aaCyPmINa8lN2hfuC3qhxNZehZ8bEShKQ+44wab1SV6q/shM+HPt2
 i1OLt9Kg/CWt6hVXW3jkZvdNry1HuPP3f4jrQwquOFh6h2VlnXw=
 =zqbF
 -----END PGP SIGNATURE-----

Merge tag 'samsung-drivers-fixes-7.1-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into arm/fixes

Samsung SoC driver fixes for v7.1

Fix several concurrency issues present in Samsung ACPM firmware drivers,
used currently only on Google GS101.  Tudor with help of Sashiko
identified several missing barriers and incomplete synchronization,
leading to possible transfer data corruption or use after free.  Few
other issues related to probe, including missing mailbox cleanup, were
also fixed.

* tag 'samsung-drivers-fixes-7.1-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux:
  firmware: samsung: acpm: Fix infinite loop on sequence number exhaustion
  firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator
  firmware: samsung: acpm: Fix false timeouts and Use-After-Free in polling
  firmware: samsung: acpm: Fix mailbox channel leak on probe error
  firmware: samsung: acpm: Fix cross-thread RX length corruption

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-05-29 23:37:36 +02:00
Zhenghang Xiao
7164d78559 drm/gem: fix race between change_handle and handle_delete
drm_gem_change_handle_ioctl leaves the old handle live in the IDR
during the window between spin_unlock(table_lock) and the final
spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old
handle succeeds in this window, decrements handle_count to 0, and frees
the GEM object while the new handle's IDR entry still references it.

NULL the old handle's IDR entry before dropping table_lock so that any
concurrent GEM_CLOSE on the old handle sees NULL and returns -EINVAL.
Restore the old entry on the prime-bookkeeping error path.

Fixes: 5e28b7b944 ("drm: Set old handle to NULL before prime swap in change_handle")
Signed-off-by: Zhenghang Xiao <kipreyyy@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
Link: https://patch.msgid.link/20260526085313.26791-1-kipreyyy@gmail.com
2026-05-30 07:01:39 +10:00
Gary Guo
d2f3092279 rust: pin_init: internal: use loop {} to produce never value
In the `init!`/`pin_init!` macros, we rely on a trick that assigns never
(`!`) values to all mentioned fields in never-executed code to let the
compiler check that all fields have been initialized.

Currently we use `::core::panic!()` to produce this value, but before Rust
1.91.0, it creates outlined `panic_cold_explicit` functions which do not
get removed by the optimizer, thus leaving dead code behind in the binary.
This has been fixed by [1], which lands in Rust 1.91.0+, higher than the
kernel minimum version 1.85.0.

This causes ~200 dead `panic_cold_explicit` instances being included in the
binary, with ~90 of them from nova-core's usage of pin-init.

Work around the issue by using `loop {}` which creates the never value
without macro expansion or function call at all. All instances of
`panic_cold_explicit` outside libcore are removed by this change in my
kernel build.

Link: https://github.com/rust-lang/rust/pull/145304 [1]
Link: https://patch.msgid.link/20260508152950.833635-1-gary@kernel.org
Signed-off-by: Gary Guo <gary@garyguo.net>
2026-05-29 21:58:36 +01:00
Linus Torvalds
d0ee290071 Arm:
- Restore CONFIG_PKVM_DISABLE_STAGE2_ON_PANIC to its former glory by
   making sure the config symbol is correctly spelled out in the code
 
 - Don't reset the AArch32 view of the PMU counters to zero when the
   guest is writing to them
 
 - Fix an assorted collection of memory leaks in the newly added tracing
   code
 
 - Fix the capping of ZCR_EL2 which could be used in an unsanitised way
   by an L2 guest
 
 x86:
 
 - Include the kernel's linux/mman.h in KVM selftests to ensure MADV_COLLAPSE
   is defined, as older libc versions may not provide it.
 
 - Include execinfo.h if and only if KVM selftests are building against glibc,
   and provide a test_dump_stack() for non-glibc builds.
 
 - Silence an annoying RCU splat on (even non-KVM-related) panics.  The splat
   is technically legit, but in practice not an issue.  To have a race, you
   would need to unload the KVM modules at exactly the time a panic happens;
   and speaking of incredibly rare races, taking the locks risks introducing
   a deadlock if the module unload code took the lock on a CPU that has been
   halted.  Which seems possibly more likely than the RCU grace period issue,
   so just shut it up.  This code used to be in KVM but is now outside it;
   but the x86 maintainers haven't picked it up, so here we are.
 
 - Rate-limit global clock updates once again (but without delayed work), as
   KVM was subtly relying on the old rate-limiting for NPT correction to guard
   against "update storms" when running without a master clock on systems with
   overcommitted CPUs.
 
 - Fix a brown paper bag goof where KVM checked if ERAPS is "dirty" instead of
   marking it dirty when emulating INVPCID.
 
 - Flush the TLB when transitioning from xAVIC => x2AVIC to ensure the CPU TLB
   doesn't contain AVIC-tagged entries for the APIC base GPA.
 
 - The top 10 commits fix buffer overflow (and potential TOC/TOU) flaws in the
   page state change protocol for encrypted VMs.  AI models find it quite
   easily given it was reported three times, but aren't as good at writing
   a comprehensive fix.  There's more to clean up in the area, which will
   come in 7.2.
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmoZ2qQUHHBib256aW5p
 QHJlZGhhdC5jb20ACgkQv/vSX3jHroPPFQgAhDwSk+VVnn4vuerijZh6eo3Tz4EQ
 af0Ccng1uDuTuz9HzkF/ffR4z3tBMYtUhVtUiPu5xrUabzmIW7T0roNvsCwzVZor
 ekZt3Y8FgwSgF+nxbBQQXBPvv+tOHpoIhfbirftWE9tRRFivfK1Z1duRGwsv7Seb
 0eK+iB1huJLjXqIZQtSLEY44LSoQbDIt/StkkYFLUr10oOvTRCFiu2wPA2gZrK56
 KTVrCg7rtn135wh8TVA72u+pIszylIPFTQ1HbbzzBoQ8/Opp0olFL3q0HeAwkx6D
 q0EJiNMP0QD8NDC7Q8efAit4wI0pXE4Y6ScHQJTm3p+hB6KXc9o7LKbCmA==
 =6jit
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm fixes from Paolo Bonzini:
 "arm64:

   - Restore CONFIG_PKVM_DISABLE_STAGE2_ON_PANIC to its former glory by
     making sure the config symbol is correctly spelled out in the code

   - Don't reset the AArch32 view of the PMU counters to zero when the
     guest is writing to them

   - Fix an assorted collection of memory leaks in the newly added
     tracing code

   - Fix the capping of ZCR_EL2 which could be used in an unsanitised
     way by an L2 guest

  x86:

   - Include the kernel's linux/mman.h in KVM selftests to ensure
     MADV_COLLAPSE is defined, as older libc versions may not provide
     it.

   - Include execinfo.h if and only if KVM selftests are building
     against glibc, and provide a test_dump_stack() for non-glibc
     builds.

   - Silence an annoying RCU splat on (even non-KVM-related) panics.

     The splat is technically legit, but in practice not an issue. To
     have a race, you would need to unload the KVM modules at exactly
     the time a panic happens; and speaking of incredibly rare races,
     taking the locks risks introducing a deadlock if the module unload
     code took the lock on a CPU that has been halted. Which seems
     possibly more likely than the RCU grace period issue, so just shut
     it up. This code used to be in KVM but is now outside it; but the
     x86 maintainers haven't picked it up, so here we are.

   - Rate-limit global clock updates once again (but without delayed
     work), as KVM was subtly relying on the old rate-limiting for NPT
     correction to guard against "update storms" when running without a
     master clock on systems with overcommitted CPUs.

   - Fix a brown paper bag goof where KVM checked if ERAPS is "dirty"
     instead of marking it dirty when emulating INVPCID.

   - Flush the TLB when transitioning from xAVIC => x2AVIC to ensure the
     CPU TLB doesn't contain AVIC-tagged entries for the APIC base GPA.

   - The top 10 commits fix buffer overflow (and potential TOC/TOU)
     flaws in the page state change protocol for encrypted VMs. AI
     models find it quite easily given it was reported three times, but
     aren't as good at writing a comprehensive fix. There's more to
     clean up in the area, which will come in 7.2"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (22 commits)
  KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer
  KVM: SEV: Check PSC request indices against the actual size of the buffer
  KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
  KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0
  KVM: SEV: Compute the correct max length of the in-GHCB scratch area
  KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests
  KVM: SEV: Ignore Port I/O requests of length '0'
  KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+
  KVM: SEV: Ignore MMIO requests of length '0'
  KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
  KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor
  KVM: arm64: Fix memory leak in hyp_trace_unload()
  KVM: arm64: Fix rollback in hyp_trace_buffer_share_hyp()
  KVM: arm64: Fix meta-page unsharing in pKVM hyp tracing
  KVM: arm64: PMU: Preserve AArch32 counter low bits
  KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC
  KVM: x86: Fix ERAPS RAP clear on INVPCID single-context invalidation
  KVM: arm64: Fix CONFIG_PKVM_DISABLE_STAGE2_ON_PANIC
  KVM: selftests: Guard execinfo.h inclusion for non-glibc builds
  KVM: x86: Rate-limit global clock updates on vCPU load
  ...
2026-05-29 13:47:55 -07:00
Uwe Kleine-König (The Capable Hub)
3a7a1e491b pinctrl: max77620: Unify usage of space and comma in platform_device_id array
The most accepted style for the array terminator is to use a single
space between the curly braces and no trailing comma. Also don't use a comma
directly before a closing brace in the other entries.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-05-29 22:47:44 +02:00
Uwe Kleine-König (The Capable Hub)
9b97162c77 pinctrl: Use named initializers for platform_device_id arrays
Named initializers are better readable and more robust to changes of the
struct definition. This robustness is relevant for a planned change to
struct platform_device_id replacing .driver_data by an anonymous unit.

While touching these arrays unify spacing and usage of commas.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> # renesas
Acked-by: Geert Uytterhoeven <geert+renesas@glider.be> # renesas
Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-05-29 22:47:44 +02:00
Rong Xu
9f2aee8f7d
kbuild: distributed build support for Clang ThinLTO
Add distributed ThinLTO build support for the Linux kernel.
This new mode offers several advantages: (1) Increased
flexibility in handling user-specified build options.
(2) Improved user-friendliness for developers. (3) Greater
convenience for integrating with objtool and livepatch.

Note that "distributed" in this context refers to a term
that differentiates in-process ThinLTO builds by invoking
backend compilation through the linker, not necessarily
building in distributed environments.

Distributed ThinLTO is enabled via the
`CONFIG_LTO_CLANG_THIN_DIST` Kconfig option. For example:
 > make LLVM=1 defconfig
 > scripts/config -e LTO_CLANG_THIN_DIST
 > make LLVM=1 oldconfig
 > make LLVM=1 vmlinux -j <..>

The build flow proceeds in four stages:
  1. Perform FE compilation, mirroring the in-process ThinLTO mode.
  2. Thin-link the generated IR files and object files.
  3. Find all IR files and perform BE compilation, using the flags
    stored in the .*.o.cmd files.
  4. Link the BE results to generate the final vmlinux.o.

NOTE: This patch currently implements the build for the main kernel
image (vmlinux) only. Kernel module support is planned for a
subsequent patch.

Tested on the following arch: x86, arm64, loongarch, and
riscv.

The earlier implementation details can be found here:
https://discourse.llvm.org/t/rfc-distributed-thinlto-build-for-kernel/85934

Signed-off-by: Rong Xu <xur@google.com>
Co-developed-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Tested-by: Piotr Gorski <piotrgorski@cachyos.org>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Link: https://patch.msgid.link/20260529185347.2418373-4-xur@google.com
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
2026-05-29 13:44:29 -07:00
Masahiro Yamada
9c72d26e9f
kbuild: move vmlinux.a build rule to scripts/Makefile.vmlinux_a
Move the build rule for vmlinux.a to a separate file in preparation
for supporting distributed builds with Clang ThinLTO.

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Tested-by: Rong Xu <xur@google.com>
Tested-by: Piotr Gorski <piotrgorski@cachyos.org>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Rong Xu <xur@google.com>
Link: https://patch.msgid.link/20260529185347.2418373-2-xur@google.com
[nathan: Squash in forward fix from Rong around '--thin' to $(AR)
         https://patch.msgid.link/20260529185347.2418373-3-xur@google.com]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
2026-05-29 13:44:29 -07:00
Dave Airlie
6e40c93789 Short summary of fixes pull:
amdxdna:
 - require IOMMU on AIE2
 
 dumb-buffer:
 - prevent overflows in dumb-buffer creation
 
 dma-buf:
 - fix UAF in dma_buf_fd() tracepoint
 
 hyperv:
 - improve protocol validation
 
 ivpu:
 - test write offset in debugfs
 
 rocket:
 - fix UAF in bo creation
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEchf7rIzpz2NEoWjlaA3BHVMLeiMFAmoZON4bFIAAAAAABAAO
 bWFudTIsMi41KzEuMTIsMiwyAAoJEGgNwR1TC3ojkmQH/iTes3bKpMGoXvNUWblI
 QYDtLgQR6uHwDwJgeYDBxu2RZQvS2y29bsW02dSCtAgQ+OkAb5TKRg1ew/cBfKQm
 QSjp4aT1qM+U+mqWhJhN40dtyyEVXZ4JlzeVcACLQhRzuohd2u5AybONtW/1NRnX
 BSpKXbntjKk+1EX6do0Cs4I8KaSKkogBAeKRIbS+J9w4rTBds3LefOGjhHo+hVkY
 +G4LAjEYO1onmN+OGvqZGXtdZKhH6j1rb8trRWHYkkcNP8GLWPQ2WFOMXDNLcxA3
 l3EUcOiU0ka6oW2NunO7rFay0h/+VFDU2VyUUvUTBKSxjbQ/7uhdIa+UoYYJOQ6B
 I+Y=
 =UkZG
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2026-05-29' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes

Short summary of fixes pull:

amdxdna:
- require IOMMU on AIE2

dumb-buffer:
- prevent overflows in dumb-buffer creation

dma-buf:
- fix UAF in dma_buf_fd() tracepoint

hyperv:
- improve protocol validation

ivpu:
- test write offset in debugfs

rocket:
- fix UAF in bo creation

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20260529070009.GA313534@linux.fritz.box
2026-05-30 06:40:28 +10:00
Maulik Shah
446fa334d1 pinctrl: qcom: Replace open coded eoi call with irq_chip_eoi_parent()
Before commit 14dbe186b9 ("pinctrl: msmgpio: Make the irqchip immutable")
msm gpio irqchip conditionally initialized pctrl->irq_chip.irq_eoi to
irq_chip_eoi_parent() only for the GPIO irqs having a wakeup capable irq.

In order to make gpio irqchip immutable pctrl->irq_chip.irq_eoi is
initialized to msm_gpio_irq_eoi() which now gets invoked for both wake up
and non-wakeup capable GPIO IRQs.

Replace open coded eoi call to parent irqchip with irq_chip_eoi_parent().

Since the irq_chip_*_parent() APIs internally do not check the valid parent
data is present to ensure irq_chip_eoi_parent() is only invoked for wakeup
capable GPIOs validate d->parent_data within msm_gpio_irq_eoi().

For non wakeup capable GPIOs d->parent_data will be NULL since parent
irqchip diconnects hierarchy using irq_domain_disconnect_hierarchy() and
later irq framework trims hierarchy using irq_domain_trim_hierarchy() which
makes d->parent_data as NULL.

No functional impact.

Reviewed-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Maulik Shah <maulik.shah@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-05-29 22:35:14 +02:00
Gary Guo
f85906616e rust: pin-init: remove E from InitClosure
Move `E` from type to trait impl block. This greatly shortens the
monomorphized type names. The `__pinned_init` function name is only
slightly shortened as it still encodes the `E` as part of `PinInit<T, E>`
in the symbol.

`T` cannot be moved to trait impl block otherwise it will start to conflict
with the `impl Init<T> for T` as Rust cannot deduce that there're no types
that fulfill `T: FnOnce(*mut T)`.

Link: https://patch.msgid.link/20260527-pin-init-sync-v1-6-e20335ed2501@garyguo.net
Signed-off-by: Gary Guo <gary@garyguo.net>
2026-05-29 21:34:53 +01:00
Gary Guo
79bc923ae2 rust: pin-init: move InitClosure out from __internal
The `__internal` module is for exposing internal items publicly to
procedural macros (pin-init-internal). Types that are crate-local only can
just have proper visibility and does not need to be in `__internal`.

The type name of `InitClosure` can often shows up in symbol names, this
reduces the length slightly.

Link: https://patch.msgid.link/20260527-pin-init-sync-v1-5-e20335ed2501@garyguo.net
Signed-off-by: Gary Guo <gary@garyguo.net>
2026-05-29 21:34:53 +01:00
Xiaobo Liu
2a02b4f96f rust: pin-init: docs: fix typos in MaybeZeroable documentation
Signed-off-by: Xiaobo Liu <cppcoffee@gmail.com>
Link: https://patch.msgid.link/20260527-pin-init-sync-v1-4-e20335ed2501@garyguo.net
Signed-off-by: Gary Guo <gary@garyguo.net>
2026-05-29 21:34:53 +01:00
Mirko Adzic
5423ef9d4d rust: pin-init: internal: suppress non_snake_case lint in [pin_]init!
Allows `non_snake_case` lint on local variables generated in `[pin_]init!`.

Conceptually the identifiers in `[pin_]init!` just references the field
names, and are not defining them, so the warning should not be generated,
similar to how constructing a struct with non-snake-case field names do no
generate these warnings.

Reported-by: Gary Guo <gary@garyguo.net>
Closes: https://github.com/Rust-for-Linux/pin-init/issues/125
Closes: https://lore.kernel.org/rust-for-linux/DGTBJBIVFZ2K.2F1ZEFGY0G7NK@garyguo.net/
Fixes: 42415d163e ("rust: pin-init: add references to previously initialized fields")
Signed-off-by: Mirko Adzic <adzicmirko97@gmail.com>
[ Reworded commit message - Gary ]
Link: https://patch.msgid.link/20260527-pin-init-sync-v1-3-e20335ed2501@garyguo.net
Signed-off-by: Gary Guo <gary@garyguo.net>
2026-05-29 21:34:53 +01:00
Mirko Adzic
e6405dca10 rust: pin-init: internal: suppress non_snake_case lint in #[pin_data]
Allows `non_snake_case` lint on struct fields generated by `#[pin_data]`.

Since the same warning will be reported by the compiler on the struct
definition, having extra warnings for the generated code is unnecessary
and confusing.

Signed-off-by: Mirko Adzic <adzicmirko97@gmail.com>
Link: https://patch.msgid.link/20260527-pin-init-sync-v1-2-e20335ed2501@garyguo.net
Signed-off-by: Gary Guo <gary@garyguo.net>
2026-05-29 21:34:53 +01:00
Martin Kletzander
28ba76f374 rust: pin-init: internal: pin_data: filter non-#[cfg] attr in generated code
When using a macro with custom attributes in a `#[pin_data]` struct it
can mess up the generated code. The generated code needs nothing more than
the `#[cfg]` attribute, thus strip away all other attributes.

[ Rebased and updated to only include `#[cfg]` instead of both `#[cfg]` and
  `#[doc]`; doc is not needed for the generated hidden items. - Gary ]

Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
Co-developed-by: Gary Guo <gary@garyguo.net>
Link: https://patch.msgid.link/20260527-pin-init-sync-v1-1-e20335ed2501@garyguo.net
Signed-off-by: Gary Guo <gary@garyguo.net>
2026-05-29 21:34:53 +01:00
Xianwei Zhao
e1147e8a00 pinctrl: meson: support amlogic A9 SoC
In Amlogic A9 SoC, subordinate bank reuse other master bank is
not from bit0, and subordinate bank reuse multi master banks.

This submission implements this situation.

Signed-off-by: Xianwei Zhao <xianwei.zhao@amlogic.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-05-29 22:30:02 +02:00
Xianwei Zhao
8c63821f22 dt-bindings: pinctl: amlogic,pinctrl-a4: Add compatible string for A9
Update dt-binding document for pinctrl of Amlogic A9.

In Amlogic A9 SoC, a bank mux register reuse other banks.
The multiplexed part requires special processing and is
therefore incompatible with the previous SoCs.

Signed-off-by: Xianwei Zhao <xianwei.zhao@amlogic.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-05-29 22:30:02 +02:00
Uwe Kleine-König (The Capable Hub)
78d86a71de EDAC: Consistently define pci_device_ids using named initializers
... and PCI device helpers.

The various struct pci_device_id arrays were initialized mostly by one of the
PCI_DEVICE macros and then list expressions. The latter aren't easily readable
if you're not into PCI. Using named initializers is more explicit and thus
easier to parse.

Also use PCI_DEVICE* helper macros to assign .vendor, .device, .subvendor and
.subdevice where appropriate and skip explicit assignments of 0 (which the
compiler takes care of).

The secret plan is to make struct pci_device_id::driver_data an anonymous
union (similar to

  https://lore.kernel.org/all/cover.1776579304.git.u.kleine-koenig@baylibre.com/

and that requires named initializers. But it's also a nice cleanup on its own.

  [ bp: Massage commit message. ]

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Reviewed-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
Tested-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
Link: https://patch.msgid.link/20260527061057.3796383-2-u.kleine-koenig@baylibre.com
2026-05-29 13:28:36 -07:00