Commit graph

1,462,193 commits

Author SHA1 Message Date
Biju Das
3aa78b828e dt-bindings: interrupt-controller: renesas,rzg2l-irqc: Document RZ/G3L SoC
Document RZ/G3L (R9A08G046) IRQC. The IRQC block on the RZ/G3L SoC is
nearly identical to that found on the RZ/G3S SoC, with the following
differences: it supports more external interrupts and GPT error
interrupts, and adds registers for GPT/MTU interrupt selection and shared
interrupt selection between external interrupt and TINT. A new compatible
string "renesas,r9a08g046-irqc" is therefore introduced for the RZ/G3L
SoC.

Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20260325192451.172562-3-biju.das.jz@bp.renesas.com
2026-03-26 16:56:20 +01:00
Biju Das
7b7d32d93e dt-bindings: interrupt-controller: renesas,rzg2l-irqc: Use pattern for interrupt-names
Simplify the bindings by using pattern property for interrupt-names.
It also allows to change the ordering of interrupts.

Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20260325192451.172562-2-biju.das.jz@bp.renesas.com
2026-03-26 16:56:20 +01:00
Kathiravan Thirumoorthy
dc67808832 dt-bindings: firmware: qcom,scm: Document ipq9650 SCM
Document the scm compatible for ipq9650 SoC.

Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260325-ipq9650_scm-v1-1-ad6a3fe53f38@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-03-26 10:52:21 -05:00
Jiakai Xu
7c61e7433b RISC-V: KVM: selftests: Add RISC-V SBI STA shmem alignment tests
Add RISC-V KVM selftests to verify the SBI Steal-Time Accounting (STA)
shared memory alignment requirements.

The SBI specification requires the STA shared memory GPA to be 64-byte
aligned, or set to all-ones to explicitly disable steal-time accounting.
This test verifies that KVM enforces the expected behavior when
configuring the SBI STA shared memory via KVM_SET_ONE_REG.

Specifically, the test checks that:
- misaligned GPAs are rejected with -EINVAL
- 64-byte aligned GPAs are accepted
- all-ones GPA is accepted

Signed-off-by: Jiakai Xu <xujiakai2025@iscas.ac.cn>
Signed-off-by: Jiakai Xu <jiakaiPeanut@gmail.com>
Reviewed-by: Andrew Jones <andrew.jones@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260303010859.1763177-4-xujiakai2025@iscas.ac.cn
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-03-26 21:21:03 +05:30
Jiakai Xu
40351ed924 KVM: selftests: Refactor UAPI tests into dedicated function
Move steal time UAPI tests from steal_time_init() into a separate
check_steal_time_uapi() function for better code organization and
maintainability.

Previously, x86 and ARM64 architectures performed UAPI validation
tests within steal_time_init(), mixing initialization logic with
uapi tests.

Changes by architecture:
x86_64:
  - Extract MSR reserved bits test from steal_time_init()
  - Move to check_steal_time_uapi() which tests that setting
    MSR_KVM_STEAL_TIME with KVM_STEAL_RESERVED_MASK fails
ARM64:
  - Extract three UAPI tests from steal_time_init():
     Device attribute support check
     Misaligned IPA rejection (EINVAL)
     Duplicate IPA setting rejection (EEXIST)
  - Move all tests to check_steal_time_uapi()
RISC-V:
  - Add empty check_steal_time_uapi() stub for future use
  - No changes to steal_time_init() (had no tests to extract)

The new check_steal_time_uapi() function:
  - Is called once before the per-VCPU test loop

No functional change intended.

Suggested-by: Andrew Jones <andrew.jones@oss.qualcomm.com>
Signed-off-by: Jiakai Xu <xujiakai2025@iscas.ac.cn>
Signed-off-by: Jiakai Xu <jiakaiPeanut@gmail.com>
Reviewed-by: Andrew Jones <andrew.jones@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260303010859.1763177-3-xujiakai2025@iscas.ac.cn
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-03-26 21:21:03 +05:30
Jiakai Xu
fa9681ed5c RISC-V: KVM: Validate SBI STA shmem alignment in kvm_sbi_ext_sta_set_reg()
The RISC-V SBI Steal-Time Accounting (STA) extension requires the shared
memory physical address to be 64-byte aligned, or set to all-ones to
explicitly disable steal-time accounting.

KVM exposes the SBI STA shared memory configuration to userspace via
KVM_SET_ONE_REG. However, the current implementation of
kvm_sbi_ext_sta_set_reg() does not validate the alignment of the configured
shared memory address. As a result, userspace can install a misaligned
shared memory address that violates the SBI specification.

Such an invalid configuration may later reach runtime code paths that
assume a valid and properly aligned shared memory region. In particular,
KVM_RUN can trigger the following WARN_ON in
kvm_riscv_vcpu_record_steal_time():

  WARNING: arch/riscv/kvm/vcpu_sbi_sta.c:49 at
  kvm_riscv_vcpu_record_steal_time

WARN_ON paths are not expected to be reachable during normal runtime
execution, and may result in a kernel panic when panic_on_warn is enabled.

Fix this by validating the computed shared memory GPA at the
KVM_SET_ONE_REG boundary. A temporary GPA is constructed and checked
before committing it to vcpu->arch.sta.shmem. The validation allows
either a 64-byte aligned GPA or INVALID_GPA (all-ones), which disables
STA as defined by the SBI specification.

This prevents invalid userspace state from reaching runtime code paths
that assume SBI STA invariants and avoids unexpected WARN_ON behavior.

Fixes: f61ce890b1 ("RISC-V: KVM: Add support for SBI STA registers")
Signed-off-by: Jiakai Xu <xujiakai2025@iscas.ac.cn>
Signed-off-by: Jiakai Xu <jiakaiPeanut@gmail.com>
Reviewed-by: Andrew Jones <andrew.jones@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260303010859.1763177-2-xujiakai2025@iscas.ac.cn
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-03-26 21:21:03 +05:30
Alice Ryhl
bdf6b22fd5 rust: drm: use new sync::aref path for imports
ARef and AlwaysRefCounted are being moved to sync::aref, and the
re-exports under types are planned to be removed. Thus, update imports
to the new path.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Reviewed-by: Gary Guo <gary@garyguo.net>
Link: https://patch.msgid.link/20260326-drm-rust-next-fix-aref-v1-2-7f6f58d2828a@google.com
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
2026-03-26 15:45:49 +00:00
Alice Ryhl
d4cf576672 rust: workqueue: use new sync::aref path for imports
ARef and AlwaysRefCounted are being moved to sync::aref, and the
re-exports under types are planned to be removed. Thus, update imports
to the new path.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Reviewed-by: Gary Guo <gary@garyguo.net>
Link: https://patch.msgid.link/20260326-drm-rust-next-fix-aref-v1-1-7f6f58d2828a@google.com
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
2026-03-26 15:45:34 +00:00
Linus Torvalds
75c78a4faa Pin control fixes for the v7.0 kernel series:
- Implement .get_direction() in the spmi-gpio gpio_chip.
   Recent changes makes this start to print warnings and it's
   not nice, let's just fix it.
 
 - Clamp the return value of gpio_get() in the Renesas
   RZA1 driver.
 
 - Add the GPIO_GENERIC dependency to the STM32 HDP driver.
 
 - Modify the Mediatek driver to accept devices that do not
   use external interrupts (EINT) at all.
 
 - Fix flag propagation in the Sunxi driver, so that we can fix
   an issue with uninitialized pins in a follow-up patch using
   said flags.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAmnFJ8kACgkQQRCzN7AZ
 XXPWKxAAomjlOX5/FprpAPQm58K1zBMdJGNrrrKRa/wOt/hNRA5BosP33Mdp+TVJ
 gIvFZHlwSU8dsqPKH4hjqrgVnS/WcvpLg24O4vpWexl9BvZnlJRb4UdQC0Kkvtu9
 mdHo/BLKi5SswQZ2R6xzF8ljtZNCiln0RoKrOzgt2IpKRrv/A19LcUmJ8VPUZ3J1
 7yNHfsM/aYTPkQkNx50XAKtfIkSZ34OBo1Y+h72s0LRvoziujcEIbrZXDM1+9lKp
 vNdbzs75NQqTwNd+HiPK9ydZ5xu5/y9lpguWi5hrpUOGzDnHd3RTSblDtSVeeN0T
 ERX2f0pKi3qdA4eJ3CQrMOHzIwDbpP9kqQhtUwrV2OqDrwPBn3xFzCIBt+iPA5vk
 tfP+rtxn+w9DcUNx4Hv1OkTk3wHPPoY7UlBiaCP6Yh6fhjaRTPS03SwXDX49mzwD
 W8MLKEAM64pdJsSFA5kX6CcETHwl5le1NcS1B8mC9KW9Enw52QBWiaTpJUoMVd6/
 tRZCR63phvOSAHtqxcSmgszytmjc5PkbHpziyINISsjCulUPIpO9mDKydNuMo2V3
 VSABF5hagFLThgyMXOLEVlK9cAyvx1zw8BpFLBbAVJQ9FHy+Zw4NqlrrCSRMEMvA
 SEc2DrhXNk8PyfVUJjo8HR2VkZW935lk9oAEQ8KjKupSdj5Duqc=
 =Ay1e
 -----END PGP SIGNATURE-----

Merge tag 'pinctrl-v7.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

Pull pin control fixes from Linus Walleij:

 - Implement .get_direction() in the spmi-gpio gpio_chip

   Recent changes makes this start to print warnings and it's not nice,
   let's just fix it

 - Clamp the return value of gpio_get() in the Renesas RZA1 driver

 - Add the GPIO_GENERIC dependency to the STM32 HDP driver

 - Modify the Mediatek driver to accept devices that do not use external
   interrupts (EINT) at all

 - Fix flag propagation in the Sunxi driver, so that we can fix an issue
   with uninitialized pins in a follow-up patch using said flags

* tag 'pinctrl-v7.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  pinctrl: sunxi: fix gpiochip_lock_as_irq() failure when pinmux is unknown
  pinctrl: sunxi: pass down flags to pinctrl routines
  pinctrl: mediatek: common: Fix probe failure for devices without EINT
  pinctrl: stm32: fix HDP driver dependency on GPIO_GENERIC
  pinctrl: renesas: rza1: Normalize return value of gpio_get()
  pinctrl: qcom: spmi-gpio: implement .get_direction()
  pinctrl: renesas: rzt2h: Fix invalid wait context
  pinctrl: renesas: rzt2h: Fix device node leak in rzt2h_gpio_register()
2026-03-26 08:35:51 -07:00
Abel Vesa
3006f7fbc7 clk: qcom: gcc-eliza: Enable FORCE_MEM_CORE_ON for UFS AXI PHY clock
According to internal documentation, the UFS AXI PHY clock requires
FORCE_MEM_CORE_ON to be enabled for UFS MCQ mode to work. Without this,
the UFS controller fails when operating in MCQ mode, which is already
enabled in the device tree.

The UFS PHY ICE core clock already has this bit set, so apply the same
configuration to the UFS PHY AXI clock.

Fixes: 3d356ab4a1 ("clk: qcom: Add support for Global clock controller on Eliza")
Reported-by: Nitin Rawat <nitin.rawat@oss.qualcomm.com>
Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Reviewed-by: Taniya Das <taniya.das@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260323-eliza-gcc-set-ufs-axi-phyforce-mem-core-on-v1-1-b6b7a6f3f8c5@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-03-26 10:33:52 -05:00
Nathan Chancellor
47f06ebbe8 perf/arm-cmn: Fix resource_size_t printk specifier in arm_cmn_init_dtc()
When building for 32-bit ARM, there is a warning when using the %llx
specifier to print a resource_size_t variable:

  drivers/perf/arm-cmn.c: In function 'arm_cmn_init_dtc':
  drivers/perf/arm-cmn.c:2149:73: error: format '%llx' expects argument of type 'long long unsigned int', but argument 4 has type 'resource_size_t' {aka 'unsigned int'} [-Werror=format=]
   2149 |                                      "Failed to request DTC region 0x%llx\n", base);
        |                                                                      ~~~^     ~~~~
        |                                                                         |     |
        |                                                                         |     resource_size_t {aka unsigned int}
        |                                                                         long long unsigned int
        |                                                                      %x

Use the %pa specifier to handle the possible sizes of phys_addr_t
properly. This requires passing the variable by reference.

Fixes: 5394396ff5 ("perf/arm-cmn: Stop claiming entire iomem region")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Robin murphy <robin.murphy@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
2026-03-26 15:25:21 +00:00
Chen Ni
d49802b661 perf/arm-cmn: Fix incorrect error check for devm_ioremap()
Check devm_ioremap() return value for NULL instead of ERR_PTR and return
-ENOMEM on failure. devm_ioremap() never returns ERR_PTR, using IS_ERR()
skips the error path and may cause a NULL pointer dereference.

Fixes: 5394396ff5 ("perf/arm-cmn: Stop claiming entire iomem region")
Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Signed-off-by: Will Deacon <will@kernel.org>
2026-03-26 15:23:38 +00:00
Linus Torvalds
dabb83ecf4 dma-mapping fixes for Linux 7.0
A set of fixes for DMA-mapping subsystem, which resolve false-positive
 warnings from KMSAN and DMA-API debug (Shigeru Yoshida and Leon
 Romanovsky) as well as a simple build fix (Miguel Ojeda).
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQSrngzkoBtlA8uaaJ+Jp1EFxbsSRAUCacP+awAKCRCJp1EFxbsS
 RB0IAP94SD5YWfKauuYfXw0uxuy0POZR7rNX93y1LMxuorU+9QEAucOy9wIfjxKC
 Sc6U+fR4cmmIUKKnj7DCiR/EW8cOuQU=
 =b7th
 -----END PGP SIGNATURE-----

Merge tag 'dma-mapping-7.0-2026-03-25' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux

Pull dma-mapping fixes from Marek Szyprowski:
 "A set of fixes for DMA-mapping subsystem, which resolve false-
  positive warnings from KMSAN and DMA-API debug (Shigeru Yoshida
  and Leon Romanovsky) as well as a simple build fix (Miguel Ojeda)"

* tag 'dma-mapping-7.0-2026-03-25' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:
  dma-mapping: add missing `inline` for `dma_free_attrs`
  mm/hmm: Indicate that HMM requires DMA coherency
  RDMA/umem: Tell DMA mapping that UMEM requires coherency
  iommu/dma: add support for DMA_ATTR_REQUIRE_COHERENT attribute
  dma-direct: prevent SWIOTLB path when DMA_ATTR_REQUIRE_COHERENT is set
  dma-mapping: Introduce DMA require coherency attribute
  dma-mapping: Clarify valid conditions for CPU cache line overlap
  dma-mapping: handle DMA_ATTR_CPU_CACHE_CLEAN in trace output
  dma-debug: Allow multiple invocations of overlapping entries
  dma: swiotlb: add KMSAN annotations to swiotlb_bounce()
2026-03-26 08:22:07 -07:00
Le Qi
20eb0aa76f arm64: dts: qcom: hamoa-evk: Add DP0/DP1 audio playback support
The hamoa-evk DTS currently lacks DAI links for DP0 and DP1, preventing
the sound card from exposing these playback paths. Add the missing links
to enable audio output on both DP interfaces.

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Le Qi <le.qi@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260210024037.3719191-1-le.qi@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-03-26 10:21:13 -05:00
Icenowy Zheng
5d994fd7e2 irqchip/loongson-pch-lpc: Enable building on MIPS Loongson64
As the driver now supports OF-based platforms, it's now possible to use it
on MIPS Loongson64 machines.

Drop the requirement of LOONGARCH for this driver, to allow build on
both MIPS-based and LoongArch-based Loongson systems.

Signed-off-by: Icenowy Zheng <zhengxingda@iscas.ac.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
Link: https://patch.msgid.link/20260321092032.3502701-7-zhengxingda@iscas.ac.cn
2026-03-26 16:15:04 +01:00
Icenowy Zheng
ed3772aa48 irqchip/loongson-pch-lpc: Add OF init code
The OF-based MIPS Loongson-3 systems can also have a PCH LPC interrupt
controller.

Add OF-based initialization code for this driver.

Co-developed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Icenowy Zheng <zhengxingda@iscas.ac.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
Link: https://patch.msgid.link/20260321092032.3502701-6-zhengxingda@iscas.ac.cn
2026-03-26 16:15:04 +01:00
Icenowy Zheng
29c10a0af0 irqchip/loongson-pch-lpc: Extract non-ACPI-related code from ACPI init
A lot of code can be shared between the existing ACPI init flow with the
upcoming OF init flow.

Extract it into a dedicated function.

The re-ordering of parent interrupt allocation requires the architecture
code to reserve legacy interrupts from the dynamic allocation by overriding
arch_dynirq_lower_bound(), otherwise the parent of LPC irqchip will be
allocated in the intended static range of LPC interrupts, which leads to
allocation failure of LPC interrupts.

Co-developed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Icenowy Zheng <zhengxingda@iscas.ac.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
Link: https://patch.msgid.link/20260321092032.3502701-5-zhengxingda@iscas.ac.cn
2026-03-26 16:15:03 +01:00
Icenowy Zheng
41bf87bcac dt-bindings: interrupt-controller: Add LS7A PCH LPC
Loongson 7A series PCH contains an LPC controller with an interrupt
controller.

Add the device tree binding for the interrupt controller.

Signed-off-by: Icenowy Zheng <zhengxingda@iscas.ac.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
Reviewed-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20260321092032.3502701-4-zhengxingda@iscas.ac.cn
2026-03-26 16:15:03 +01:00
Icenowy Zheng
dc30127cd0 LoongArch: Override arch_dynirq_lower_bound to reserve LPC IRQs
Loongson 7A PCH chips all contain a LPC controller, which is used in
some devices to connect legacy ISA devices (e.g. 8259 PS/2 controller).

The LPC irqchip driver will register LPC interrupts at the fixed range
0~15, and the PCH PIC irqchip driver uses dynamic allocation. However the
LPC interrupt numbers are currently not exempted from dynamic allocation.

The current setup work by accident because the LPC interrupt controller is
the first consumer of PIC interrupt controller, and the PIC interrupt
number is allocated after LPC interrupts are registered. Such setup is
fragile and will stop to work when the LPC irqchip driver is reworked.

Override arch_dynirq_lower_bound() to reserve LPC interrupts from dynamic
allocation, to prevent interrupt number collision and allow rework of the
LPC irqchip driver.

Signed-off-by: Icenowy Zheng <zhengxingda@iscas.ac.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
Link: https://patch.msgid.link/20260321092032.3502701-3-zhengxingda@iscas.ac.cn
2026-03-26 16:15:03 +01:00
Icenowy Zheng
57c9c7bf52 MIPS: loongson64: Override arch_dynirq_lower_bound to reserve LPC IRQs
On some Loongson 3A devices, a LPC bus is present and some legacy devices
(e.g. 8259) on it expect hardcoded low interrupt numbers. However currently
the expected low range interrupt numbers are not exempted from the dynamic
allocation, which leads to conflicts when registering LPC interrupts in the
fixed range.

Override arch_dynirq_lower_bound() to reserve these low range interrupt
numbers and prevent them from being dynamically allocated.

Signed-off-by: Icenowy Zheng <zhengxingda@iscas.ac.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
Link: https://patch.msgid.link/20260321092032.3502701-2-zhengxingda@iscas.ac.cn
2026-03-26 16:15:02 +01:00
Thomas Gleixner
87c6dfe308 Merge branch 'irq/urgent' into irq/drivers
to fixup a trivial conflict with pending upstream fixes.
2026-03-26 16:14:33 +01:00
Hao-Yu Yang
190a8c48ff futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()
During futex_key_to_node_opt() execution, vma->vm_policy is read under
speculative mmap lock and RCU. Concurrently, mbind() may call
vma_replace_policy() which frees the old mempolicy immediately via
kmem_cache_free().

This creates a race where __futex_key_to_node() dereferences a freed
mempolicy pointer, causing a use-after-free read of mpol->mode.

[  151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349)
[  151.414046] Read of size 2 at addr ffff888001c49634 by task e/87

[  151.415969] Call Trace:

[  151.416732]  __asan_load2 (mm/kasan/generic.c:271)
[  151.416777]  __futex_key_to_node (kernel/futex/core.c:349)
[  151.416822]  get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593)

Fix by adding rcu to __mpol_put().

Fixes: c042c50521 ("futex: Implement FUTEX2_MPOL")
Reported-by: Hao-Yu Yang <naup96721@gmail.com>
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Hao-Yu Yang <naup96721@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Link: https://patch.msgid.link/20260324174418.GB1850007@noisy.programming.kicks-ass.net
2026-03-26 16:13:48 +01:00
Peter Zijlstra
19f94b3905 futex: Require sys_futex_requeue() to have identical flags
Nicholas reported that his LLM found it was possible to create a UaF
when sys_futex_requeue() is used with different flags. The initial
motivation for allowing different flags was the variable sized futex,
but since that hasn't been merged (yet), simply mandate the flags are
identical, as is the case for the old style sys_futex() requeue
operations.

Fixes: 0f4b5f9722 ("futex: Add sys_futex_requeue()")
Reported-by: Nicholas Carlini <npc@anthropic.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
2026-03-26 16:13:48 +01:00
Claudio Imbrenda
0a28e06575 KVM: s390: Fix KVM_S390_VCPU_FAULT ioctl
A previous commit changed the behaviour of the KVM_S390_VCPU_FAULT
ioctl. The current (wrong) implementation will trigger a guest
addressing exception if the requested address lies outside of a
memslot, unless the VM is UCONTROL.

Restore the previous behaviour by open coding the fault-in logic.

Fixes: 3762e905ec ("KVM: s390: use __kvm_faultin_pfn()")
Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
2026-03-26 16:12:38 +01:00
Claudio Imbrenda
a12cc7e3d6 KVM: s390: vsie: Fix guest page tables protection
When shadowing, the guest page tables are write-protected, in order to
trap changes and properly unshadow the shadow mapping for the nested
guest. Already shadowed levels are skipped, so that only the needed
levels are write protected.

Currently the levels that get write protected are exactly one level too
deep: the last level (nested guest memory) gets protected in the wrong
way, and will be protected again correctly a few lines afterwards; most
importantly, the highest non-shadowed level does *not* get write
protected.

Moreover, if the nested guest is running in a real address space, there
are no DAT tables to shadow.

Write protect the correct levels, so that all the levels that need to
be protected are protected, and avoid double protecting the last level;
skip attempting to shadow the DAT tables when the nested guest is
running in a real address space.

Fixes: e38c884df9 ("KVM: s390: Switch to new gmap")
Tested-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
2026-03-26 16:12:34 +01:00
Claudio Imbrenda
19d6c5b804 KVM: s390: vsie: Fix unshadowing while shadowing
If shadowing causes the shadow gmap to get unshadowed, exit early to
prevent an attempt to dereference the parent pointer, which at this
point is NULL.

Opportunistically add some more checks to prevent NULL parents.

Fixes: a2c17f9270 ("KVM: s390: New gmap code")
Fixes: e5f98a6899 ("KVM: s390: Add some helper functions needed for vSIE")
Fixes: e38c884df9 ("KVM: s390: Switch to new gmap")
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
2026-03-26 16:12:30 +01:00
Claudio Imbrenda
0ec456b8a5 KVM: s390: vsie: Fix refcount overflow for shadow gmaps
In most cases gmap_put() was not called when it should have.

Add the missing gmap_put() in vsie_run().

Fixes: e38c884df9 ("KVM: s390: Switch to new gmap")
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
2026-03-26 16:12:25 +01:00
Claudio Imbrenda
fd7bc612cf KVM: s390: vsie: Fix nested guest memory shadowing
Fix _do_shadow_pte() to use the correct pointer (guest pte instead of
nested guest) to set up the new pte.

Add a check to return -EOPNOTSUPP if the mapping for the nested guest
is writeable but the same page in the guest is only read-only.

Fixes: e38c884df9 ("KVM: s390: Switch to new gmap")
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
2026-03-26 16:12:21 +01:00
Claudio Imbrenda
0f2b760a17 KVM: s390: Correctly handle guest mappings without struct page
Introduce a new special softbit for large pages, like already presend
for normal pages, and use it to mark guest mappings that do not have
struct pages.

Whenever a leaf DAT entry becomes dirty, check the special softbit and
only call SetPageDirty() if there is an actual struct page.

Move the logic to mark pages dirty inside _gmap_ptep_xchg() and
_gmap_crstep_xchg_atomic(), to avoid needlessly duplicating the code.

Fixes: 5a74e3d934 ("KVM: s390: KVM-specific bitfields and helper functions")
Fixes: a2c17f9270 ("KVM: s390: New gmap code")
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
2026-03-26 16:12:18 +01:00
Claudio Imbrenda
45921d0212 KVM: s390: Fix gmap_link()
The slow path of the fault handler ultimately called gmap_link(), which
assumed the fault was a major fault, and blindly called dat_link().

In case of minor faults, things were not always handled properly; in
particular the prefix and vsie marker bits were ignored.

Move dat_link() into gmap.c, renaming it accordingly. Once moved, the
new _gmap_link() function will be able to correctly honour the prefix
and vsie markers.

This will cause spurious unshadows in some uncommon cases.

Fixes: 94fd9b16cc ("KVM: s390: KVM page table management functions: lifecycle management")
Fixes: a2c17f9270 ("KVM: s390: New gmap code")
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
2026-03-26 16:12:13 +01:00
Claudio Imbrenda
6f93d1ed6f KVM: s390: vsie: Fix check for pre-existing shadow mapping
When shadowing a nested guest, a check is performed and no shadowing is
attempted if the nested guest is already shadowed.

The existing check was incomplete; fix it by also checking whether the
leaf DAT table entry in the existing shadow gmap has the same protection
as the one specified in the guest DAT entry.

Fixes: e38c884df9 ("KVM: s390: Switch to new gmap")
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
2026-03-26 16:12:07 +01:00
Claudio Imbrenda
b827ef02f4 KVM: s390: Remove non-atomic dat_crstep_xchg()
In practice dat_crstep_xchg() is racy and hard to use correctly. Simply
remove it and replace its uses with dat_crstep_xchg_atomic().

This solves some actual races that lead to system hangs / crashes.

Opportunistically fix an alignment issue in _gmap_crstep_xchg_atomic().

Fixes: 589071eaaa ("KVM: s390: KVM page table management functions: clear and replace")
Fixes: 94fd9b16cc ("KVM: s390: KVM page table management functions: lifecycle management")
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
2026-03-26 16:12:03 +01:00
Biju Das
897cf98926 irqchip/renesas-rzv2h: Fix error path in rzv2h_icu_probe_common()
Replace pm_runtime_put() with pm_runtime_put_sync() when
irq_domain_create_hierarchy() fails to ensure the device suspends
synchronously before devres cleanup disables runtime PM via
pm_runtime_disable().

Fixes: 5ec8cabc3b ("irqchip/renesas-rzv2h: Use devm_pm_runtime_enable()")
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260323124917.41602-1-biju.das.jz@bp.renesas.com
2026-03-26 16:12:01 +01:00
Claudio Imbrenda
0f54755343 KVM: s390: vsie: Fix dat_split_ste()
If the guest misbehaves and puts the page tables for its nested guest
inside the memory of the nested guest itself, and the guest and nested
guest are being mapped with large pages, the shadow mapping will
lose synchronization with the actual mapping, since this will cause the
large page with the vsie notification bit to be split, but the
vsie notification bit will not be propagated to the resulting small
pages.

Fix this by propagating the vsie_notif bit from large pages to normal
pages when splitting a large page.

Fixes: 2db149a0a6 ("KVM: s390: KVM page table management functions: walks")
Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
2026-03-26 16:11:58 +01:00
Jassi Brar
cfe02147e8 irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment
The mbox_client for qcom-mpm sends NULL doorbell messages via
mbox_send_message() but never signals TX completion.

Set knows_txdone=true and call mbox_client_txdone() after a successful
send, matching the pattern used by other Qualcomm mailbox clients (smp2p,
smsm, qcom_aoss etc).

Fixes: a6199bb514 "irqchip: Add Qualcomm MPM controller driver"
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260322171533.608436-1-jassisinghbrar@gmail.com
2026-03-26 16:11:53 +01:00
Nate DeSimone
fad2964471 Documentation: ABI: add FBPT and S3PT entries to sysfs-firmware-acpi
Document the FBPT and S3PT sysfs attributes located under
/sys/firmware/acpi/fpdt/.

Signed-off-by: Nate DeSimone <nathaniel.l.desimone@intel.com>
[ rjw: Changelog tweak ]
Link: https://patch.msgid.link/20260324231456.701-3-nathaniel.l.desimone@intel.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-03-26 15:59:53 +01:00
Nate DeSimone
8dcb4485e7 ACPI: FPDT: expose FBPT and S3PT subtables via sysfs
Add sysfs files at /sys/firmware/acpi/fpdt/FBPT and
/sys/firmware/acpi/fpdt/S3PT that expose the raw contents of the
FPDT subtables.

Note that /sys/firmware/acpi/tables/FPDT only provides the top level
table, not the subtables. Adding access to the subtables enables a
usage model similar to /sys/firmware/dmi/tables/DMI, allowing
userspace tools to interpret newer record types (e.g. String Event
Records, Microcontroller Boot Performance Data Records, etc.) defined
in recent ACPI specifications [1] without requiring kernel changes.

Link: https://uefi.org/specs/ACPI/6.6/05_ACPI_Software_Programming_Model.html#performance-event-record-types [1]
Signed-off-by: Nate DeSimone <nathaniel.l.desimone@intel.com>
[ rjw: Changelog edits ]
Link: https://patch.msgid.link/20260324231456.701-2-nathaniel.l.desimone@intel.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-03-26 15:59:52 +01:00
Thomas Weißschuh
1b6c89285d timens: Remove dependency on the vDSO
Previously, missing time namespace support in the vDSO meant that time
namespaces needed to be disabled globally. This was expressed in a hard
dependency on the generic vDSO library. This also meant that architectures
without any vDSO or only a stub vDSO could not enable time namespaces.
Now that all architectures using a real vDSO are using the generic library,
that dependency is not necessary anymore.

Remove the dependency and let all architectures enable time namespaces.

Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260326-vdso-timens-decoupling-v2-2-c82693a7775f@linutronix.de
2026-03-26 15:44:23 +01:00
Thomas Weißschuh
5dc9cf835a vdso/timens: Move functions to new file
As a preparation of the untangling of time namespaces and the vDSO, move
the glue functions between those subsystems into a new file.

While at it, switch the mutex lock and mmap_read_lock() in the vDSO
namespace code to guard().

Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260326-vdso-timens-decoupling-v2-1-c82693a7775f@linutronix.de
2026-03-26 15:44:22 +01:00
Geert Uytterhoeven
ec6944df7b arm64: dts: qcom: Drop CPU masks from GICv3 PPI interrupts
Unlike older GIC variants, the GICv3 DT bindings do not support
specifying a CPU mask in PPI interrupt specifiers.  Drop the masks.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/226c5d1005a6e295e0581b2c89e5510dbb7aa9d1.1772643434.git.geert+renesas@glider.be
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-03-26 09:40:59 -05:00
Abel Vesa
6b25a72aba arm64: dts: qcom: eliza: Add missing msi-parent for UFS
Wire up the UFS controller to the GIC ITS by specifying the
msi-parent property. The UFS host uses MSI and requires a valid
ITS mapping in order to allocate and receive interrupts.

Add the ITS reference along with the device ID to match the SMMU
stream ID.

Fixes: db7fe6963466 ("arm64: dts: qcom: Introduce Eliza Soc base dtsi")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260324-eliza-base-dt-fixes-v3-3-3a4a03e72f8f@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-03-26 09:40:59 -05:00
Abel Vesa
13aadeca9e arm64: dts: qcom: eliza: Add missing CX power domain to GCC
Unless CX is declared the power-domain of GCC votes (power and
performance) on the GDSCs provided by GCC will not propagate to the CX,
which might result in under-voltage conditions.

Add the missing power-domains property to associate GCC with RPMHPD_CX.

Fixes: db7fe6963466 ("arm64: dts: qcom: Introduce Eliza Soc base dtsi")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260324-eliza-base-dt-fixes-v3-2-3a4a03e72f8f@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-03-26 09:40:59 -05:00
Abel Vesa
fa095e0b69 arm64: dts: qcom: eliza: Coding style clean-ups
Some coding style issues were raised during review but the devicetree
was merged meanwhile. Address them here.

These changes are non-functional.

Fixes: db7fe6963466 ("arm64: dts: qcom: Introduce Eliza Soc base dtsi")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260324-eliza-base-dt-fixes-v3-1-3a4a03e72f8f@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-03-26 09:40:58 -05:00
Dmitry Baryshkov
fee828abbd arm64: dts: qcom: patch mahua thermal zones by label
Updating DT nodes by the full path is fragile and frowned upon, it's
easy to miss the rename of the node in the main tree. Add necessary
labels and patch thermal zones for Mahua using those labels.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260320-mahua-fix-thermals-v1-1-8957bf976c90@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-03-26 09:40:58 -05:00
Dmitry Baryshkov
2c098c2bae arm64: dts: qcom: purwa: deduplicate thermal sensors with Hamoa
Hamoa and Purwa have pretty close thermal zones definitions. The major
difference is that several zones are absent (because of the lack of the
CPU cluster) and several zones use tsens2 instead of tsens3.

Instead of completely duplicating thermal zones for Purwa, reuse themal
zones from Hamoa, patching them where required.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260320-purwa-drop-thermals-v1-1-2c9fe046cd02@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-03-26 09:40:58 -05:00
Abel Vesa
eb5fa758f7 arm64: dts: qcom: glymur-crd: Enable WLAN and Bluetooth
Both Glymur and Mahua CRDs feature a WCN7850 M.2 WLAN and Bluetooth
combo card.

So describe both the 0.9V and the 3.3V regulators, then WCN7850 PMU and
the PCIe WLAN and the UART Bluetooth nodes.

Do this in the Glymur CRD generic dtsi so that both Glymur and Mahua CRDs
benefit from it towards enabling WLAN and Bluetooth functionality.

Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Tested-by: Gopikrishna Garmidi <gopikrishna.garmidi@oss.qualcomm.com>
Reviewed-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260324-glymur-dts-crd-enable-bt-wlan-v2-1-6afcf1ac277a@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-03-26 09:40:58 -05:00
Val Packett
c88d3aa52a arm64: dts: qcom: kodiak: Add LPASS I2S2 pinctrl definitions
Add the pinctrl definitions to configure gpio10-gpio13 of the lpass_tlmm
for I2S output.

Signed-off-by: Val Packett <val@packett.cool>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260323095247.92890-1-val@packett.cool
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-03-26 09:40:58 -05:00
Kathiravan Thirumoorthy
4073cf900e arm64: dts: qcom: add IPQ5210 SoC and rdp504 board support
Add initial device tree support for the Qualcomm IPQ5210 SoC and
rdp504 board.

Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260325-ipq5210_boot_to_shell-v3-2-9c7360d19d10@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-03-26 09:40:57 -05:00
Kathiravan Thirumoorthy
703d08de53 dt-bindings: qcom: add ipq5210 boards
Document the new ipq5210 SoC/board device tree bindings.

Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260325-ipq5210_boot_to_shell-v3-1-9c7360d19d10@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-03-26 09:40:57 -05:00
Bjorn Andersson
4d059454d3 Merge branch '20260318-ipq5210_boot_to_shell-v2-1-a87e27c37070@oss.qualcomm.com' into HEAD
Merge the IPQ5210 global clock controller DeviceTree binding, in order
to gain access to the constants.
2026-03-26 09:40:57 -05:00