should_nocow() reads inode->defrag_bytes without holding inode->lock,
while btrfs_set_delalloc_extent() and btrfs_clear_delalloc_extent()
update it under that spinlock.
This is a data race. The read is a quick check used to decide whether
to fall back to COW for a NOCOW inode: if defrag_bytes is non-zero and
the range is tagged EXTENT_DEFRAG, we force COW so that defragmentation
can rewrite the extent. Reading a stale value is harmless because:
- A missed increment may skip COW once, but the defrag pass will
redo the extent later.
- A stale non-zero may force an unnecessary COW, which is a minor
efficiency loss, not a correctness issue.
On 64-bit platforms an aligned u64 load is naturally atomic so tearing
cannot happen. On 32-bit platforms u64 may tear, but we only test for
zero vs non-zero, so the heuristic stays correct regardless. Use
data_race() annotation.
Fixes: 47059d930f ("Btrfs: make defragment work with nodatacow option")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
[ Use data_race() instead of READ_ONCXE() ]
Signed-off-by: David Sterba <dsterba@suse.com>
The fs_path can use the auto freeing pattern and it's completely
contained in send. Define the freeing wrapper and add the cleanup
attributes.
Almost all conversions are straightforward, replacing goto with direct
return.
Signed-off-by: David Sterba <dsterba@suse.com>
The qgroupid has a specific format, add common format specifier, similar
to what we have for checksums and keys.
Reviewed-by: Boris Burkov <boris@bur.io>
Signed-off-by: David Sterba <dsterba@suse.com>
When a block device does not report a maximum number of open or active
zones, currently assign BTRFS_DEFAULT_MAX_ACTIVE_ZONES (128) to
the internal limit, if the device has more than
BTRFS_DEFAULT_MAX_ACTIVE_ZONES zones.
But if the device has less than BTRFS_DEFAULT_MAX_ACTIVE_ZONES the
internal max_active_zones limit will stay at 0, even if the device has
zone resource limits. Furthermore, if the device has a total number of
zones that is less than BTRFS_DEFAULT_MAX_ACTIVE_ZONE, max_active_zones
should be set to at most the number of zones.
Also move the max_active_zone calculation and setting into a dedicated
helper, to shrink btrfs_get_dev_zone_info().
Fixes: 04147d8394 ("btrfs: zoned: limit active zones to max_open_zones")
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: David Sterba <dsterba@suse.com>
This is open-coded bvec_phys(), also remove direct use of bv_page.
Reviewed-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: Boris Burkov <boris@bur.io>
Tested-by: Boris Burkov <boris@bur.io>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: David Sterba <dsterba@suse.com>
Calling __free_page() on folio_page() happens to work today, but
won't always. Besides, it's far simpler to call folio_put().
Reviewed-by: Boris Burkov <boris@bur.io>
Reviewed-by: Qu Wenruo <wqu@suse.com>
Tested-by: Boris Burkov <boris@bur.io>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: David Sterba <dsterba@suse.com>
It seems that af566bdaff was tested against a tree which did not
contain commit 12851bd921 ("fs: Turn page_offset() into a wrapper
around folio_pos()). Unfortunately it has a bug of its own; on 32-bit
systems, shifting by PAGE_SHIFT will overflow on files larger than 4GiB.
Since page_offset() is now fixed, just revert af566bdaff.
Fixes: af566bdaff (btrfs: fix the file offset calculation inside btrfs_decompress_buf2page())
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Reviewed-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: Boris Burkov <boris@bur.io>
Tested-by: Boris Burkov <boris@bur.io>
Signed-off-by: David Sterba <dsterba@suse.com>
When performing data relocation on a zoned filesystem, BTRFS can deadlock
in handle_reserve_tickets(). The relocation process is waiting on a space
reservation ticket that can never be fulfilled, because the relocation
itself is the operation responsible for freeing up that space.
Fix this by introducing a new flush state,
BTRFS_RESERVE_FLUSH_ZONED_RELOCATION, specifically for data chunk
allocation during zoned relocation. Like
BTRFS_RESERVE_FLUSH_FREE_SPACE_INODE, this state uses
priority_reclaim_data_space() instead of the normal flushing path, which
avoids re-entering the relocation code and breaking the deadlock cycle.
In btrfs_alloc_data_chunk_ondemand(), select this new flush state when the
inode belongs to a data relocation root on a zoned filesystem.
Fixes: e2a7fd2237 ("btrfs: zoned: add zone reclaim flush state for DATA space_info")
Reviewed-by: Boris Burkov <boris@bur.io>
Reviewed-by: Naohiro Aota <naohiro.aota@wdc.com>
Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Don't account the free space in a data relocation space-info sub-group as
usable free space in statfs.
This is misleading as no user allocations can be made in this space-info
sub-group. It is only a target for relocation.
Fixes: f92ee31e03 ("btrfs: introduce btrfs_space_info sub-group")
Reviewed-by: Boris Burkov <boris@bur.io>
Reviewed-by: Naohiro Aota <naohiro.aota@wdc.com>
Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: David Sterba <dsterba@suse.com>
When searching for a data relocation block-group on mount,
btrfs_zoned_reserve_data_reloc_bg() is looking for the first empty DATA
block-group. But it first checks if the block-group is empty and if yes
continues the search, and then checks if it is the first DATA block-group.
There is actually no point in looking for the second empty DATA block
group as new DATA allocations will just allocate a new chunk for it. Pick
the first DATA block-group without any allocations done and set it as
relocation block-group.
At first, the commit 694ce5e143 ("btrfs: zoned: reserve data_reloc
block group on mount") introduced the functionality. At that time, we
took second unused (used == 0) block group, as the first one might be a
block group used for normal data. Later, commit daa0fde322 ("btrfs:
zoned: fix data relocation block group reservation") switched to look
for an empty block group (alloc_offset == 0). At this point, there is no
reason taking the second one anymore. So, this commit is fixing an issue
in commit daa0fde322.
Reviewed-by: Boris Burkov <boris@bur.io>
Reviewed-by: Naohiro Aota <naohiro.aota@wdc.com>
Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Add device tree compatible string for AST2700 based boards
("aspeed,ast2700-evb" and "aspeed,ast2700") to the Aspeed SoC
board bindings. This allows proper schema validation and
enables support for AST2700 platforms.
Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://lore.kernel.org/r/20260609-upstream_ast2700-v9-1-f631752f0cb1@aspeedtech.com
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
This time around, there's nothing other than patches for Microchip
boards. All of this is low priority fixes and cleanup, centred on the
pic64gx and beaglev-fire boards. There is no new support added.
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRh246EGq/8RLhDjO14tDGHoIJi0gUCaiaVfAAKCRB4tDGHoIJi
0ukrAP9WOUMFZsIkVJvjMgrPoC+0km/Uy8WDj4efBgxW8Z7xvwD8D2uG9Revojwm
8PRjydw22KWI2DIxzxP3Gei7HMZLwQE=
=1br7
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmooO9MACgkQmmx57+YA
GNluoA/+IAZnT8Aa1dRag6H67qgERTFzyeU3uE48Vv/MHrhAuuRc8G22z4/i33Er
0z5mrb7PwGmC3OfrAkr3ATQDY9reYjADRe5jq3xA9Ip3e43uphBDcHN3qpDREDdX
DaYOaWSwOkK80lWQ1nRE8OlztEIqqb2TamPZ7HYpuyMho8OHm0QZHQOMsSMzxlhX
vYay2jSB/KwjcJWJdWANeyRarxnNY/g/V5lQT5YM4nt9vJ6W6/bRrR8O0wsHiGn8
daJ1ZljOKxEfhfQ12gbuzBKesz0aZ06aWPtuvsN/6HlkFWUwfxcsrJvbRR5zLKAZ
QeKBnyWeN3xZe9ZiZN4rMgU6IxCChQbYsWB3yLei/NUTcB4YsM2NZXt7c3JBPIIj
fqt7Pj9BCrSnvSFMS2bA43M7sNTfIA1DyNEgTo+Gp3D/4HFTz69vOBwSERS5PlfK
JBXiw4/uVskQxbNwc9IhpEGo0Aa1Y+Vf9I+XbqFqvbGqNpaaw9LeFCCLjqHHRnjW
l8YFxj7FO4u7BDt8LZ2NIUrQu0NTJHYSWNZe+ps4TpwkRrFMD/xODRP0QkFxd3Gy
wLDAHN6MPBRLo3/zusoXHRe0xZK4f4C8SFXjVBB8K5pCYgZLgbxg/IprDgTLvU10
vLVjiDlkBlLa/AnT1QAGoAsmuE2kWy/NR6GPx4SVn1yc/vdUxxs=
=syLy
-----END PGP SIGNATURE-----
Merge tag 'riscv-dt-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/dt
Microchip RISC-V devicetrees for v7.2
This time around, there's nothing other than patches for Microchip
boards. All of this is low priority fixes and cleanup, centred on the
pic64gx and beaglev-fire boards. There is no new support added.
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
* tag 'riscv-dt-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux:
riscv: dts: microchip: remove redudant enabling of syscontroller
riscv: dts: microchip: fix pic64gx gpio interrupt-cells
riscv: dts: microchip: add gpio line names on beaglev-fire
riscv: dts: microchip: add adc interrupt on beaglev-fire
riscv: dts: microchip: clean up beaglev-fire regulator node names
riscv: dts: microchip: remove gpio hogs from beaglev-fire
riscv: dts: microchip: gpio controllers on mpfs need 2 interrupt cells
riscv: dts: microchip: sort pic64gx i2c nodes alphanumerically
riscv: dts: microchip: update pic64gx gpio interrupts to better match the SoC
riscv: dts: microchip: add tsu clock to macb on pic64gx
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Increase the pm_runtime autosuspend delay to be longer than the
timeout of the firmware's own inactivity timer.
There is no point attempting to pm_runtime suspend any sooner than
the firmware idle timeout because it would only mean the driver has
to poll waiting for the firmware idle.
Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://patch.msgid.link/20260609122946.288103-1-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Now when I/O is submitted to a partition, the per-CPU in_flight[]
counter is incremented only on the partition's block_device, not on the
underlying whole disk. This leads to a problem which can be shown by a
fio test:
lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
mydev 252:1 0 20G 0 disk
└─mydev1 259:0 0 10G 0 part
iostat -xp 1
Device r/s rkB/s ... aqu-sz %util
mydev 128153.00 512612.00 ... 13.22 72.20
mydev1 128154.00 512616.00 ... 13.22 100.00
%util is different between mydev and mydev1, which is unexpected.
This is the cumulative effect of a series of patches. The root cause is
commit e016b78201 ("block: return just one value from part_in_flight"),
which deleted the branch in part_in_flight() that aggregated the whole-disk
in_flight count on top of the partition's. Then the second commit is
commit 10ec5e86f9 ("block: merge part_{inc,dev}_in_flight into their
only callers"), which folded the whole-disk in_flight accounting into
generic_start_io_acct() and generic_end_io_acct(). Those two helpers
were then removed by commit e722fff238 ("block: remove
generic_{start,end}_io_acct"), and from that point on the whole disk's
in_flight is no longer accounted at all.
In update_io_ticks(), if calling bdev_count_inflight() finds that the
inflight value of the whole device is 0, the accumulation of io_ticks will
be skipped, causing the reported util% value to be underestimated.
Fix it by restoring the whole-disk in_flight accounting.
Fixes: e016b78201 ("block: return just one value from part_in_flight")
Suggested-by: Leon Hwang <leon.huangfu@shopee.com>
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Tang Yizhou <yizhou.tang@shopee.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260526021555.359500-1-yizhou.tang@shopee.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
New peripherals RK3588 vicap plus camera addition to some boards,
RK3528 USB and USB enablement on some boards, RGA3 support on RK3588.
Missing EL2 virtual timer interrupt added to RK3588.
Some more added peripherals for the Khadas Edge 2L board.
-----BEGIN PGP SIGNATURE-----
iQFEBAABCAAuFiEE7v+35S2Q1vLNA3Lx86Z5yZzRHYEFAmojShgQHGhlaWtvQHNu
dGVjaC5kZQAKCRDzpnnJnNEdgUA3B/90b5Ot4cK7ke1kX9SMzDtXjc5cNfsLA2wT
2CCwbZVPTxbmhZLd1OUU6v8A1ThY08TYMDVoph5ngxbnv2jjliWt1mPr76rkk+fk
X2UCEkTCwpIXB1WCn4XU5q4WNUchDTf3Ggkbybuyfy5XZD77B90auTVUdFmJQOme
zKpupUmXCf5xm1hcdgoXkC4mLb5DrRDCV5bQBbagQuimtR78tWmalJvj60IJJ6zx
4SZgMO5y87oLjgwecYEEElBGdO9kulzWsWqL1qXTk3Z/D2erE/fCEteFjWXRvGGS
U/lz6a4BVPPqemEMz2aHK/8U2D+qZ30r4o0ENcCBT80RyCfJHQFT
=k9Nv
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmooO28ACgkQmmx57+YA
GNli+A/+K8bFV8M8569aTKmwXpBtfSjcYIK+/qBwkiDSVWlUyghUlq+Tx8hZZ203
J6ak+U8nH9zfeuL+5gLeQ9BaqRK1ns5CbIv9H0sZvHfp9wqaxvYKgeXF3Px36bSP
tZlJmgLY6mBnfo7x2UokWYMClPHgF2dIVnvwAwe69UD4GXgElZL1FL+kFZZErwlH
9SS76nyVA2JnalqNsqQ+ZzTzMCB5uCrUlxde9b6GxjB9vjlvCNCPtlHRQh0tPDmt
kBEZzXD6YF6OfGofHYFIaNTaU5iGwNGdFMzcVwPks7CMNgtrZxILW/qYbvD36Fud
wILmAqNDyZhCHwjfmLj4F5sLYe6SAk9GMRjROy+IxVngRM1EhsU4IA+Db10THmcb
FsVwO0d3/KP9xJUhmAMm0m77fi718UvgpBfrJpP0xkRzBindhHaghMJq9ueGiZq8
CkFL6hWYrPDx6QSATcVUvZfbitaT4uuC54sKytWI+j9H+J3RO3px6A7WiRXH3Txb
r/v9uYF3XUxZlk8kAxLrF1TAI8y8mP682Ms2JPSBZyFz66QscmatwnW6G5jOfgiL
3hzGUGpy6e2bUQaXMQSO9Jx4oATngocwz79e0xsNMzv2wjhBhB7hVofhosBrd0Gr
nCX1vJn9YmOjMeIkRzWoj7RUjFUqahE+WQyPLulMzix9DglzlDs=
=qcRw
-----END PGP SIGNATURE-----
Merge tag 'v7.2-rockchip-dts64-2' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt
We've got basic camera support on RK3588!
New peripherals RK3588 vicap plus camera addition to some boards,
RK3528 USB and USB enablement on some boards, RGA3 support on RK3588.
Missing EL2 virtual timer interrupt added to RK3588.
Some more added peripherals for the Khadas Edge 2L board.
* tag 'v7.2-rockchip-dts64-2' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip:
arm64: dts: rockchip: Fix vcc_sdio regulator max voltage on Pinebook Pro
arm64: dts: rockchip: Enable USB 2.0 ports on NanoPi Zero2
arm64: dts: rockchip: Enable USB 2.0 ports on ArmSoM Sige1
arm64: dts: rockchip: Enable USB ports on Radxa ROCK 2A/2F
arm64: dts: rockchip: Enable USB 2.0 ports on Radxa E20C
arm64: dts: rockchip: Add USB nodes for RK3528
arm64: dts: rockchip: enable adc button for Radxa E25
arm64: dts: rockchip: Add Bluetooth support for Khadas Edge 2L
arm64: dts: rockchip: Enable USB for Khadas Edge 2L
arm64: dts: rockchip: Disable removed devices from rk3399-nanopi-r4s
arm64: dts: rockchip: Fix EEPROM compatible on rk3399-nanopi-r4s-enterprise
arm64: dts: rockchip: add radxa camera 4k on rock 5b+ cam1
arm64: dts: rockchip: add radxa camera 4k on rock 5b+ cam0
arm64: dts: rockchip: add vicap node to rk3588
arm64: dts: rockchip: Add EL2 virtual timer interrupt
arm64: dts: rockchip: add rga3 dt nodes to rk3588
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
cpu_latency_qos_init() registers cpu_dma_latency first and, when
CONFIG_PM_QOS_CPU_SYSTEM_WAKEUP is enabled, registers cpu_wakeup_latency
afterwards. The second registration overwrites the first return value.
As a result, a failure to register cpu_dma_latency can be masked if the
second registration succeeds. Conversely, if cpu_dma_latency succeeds and
cpu_wakeup_latency fails, the function returns an error while leaving the
first misc device registered.
Return immediately on the first registration failure and deregister
cpu_dma_latency if the second registration fails.
Fixes: a4e6512a79 ("PM: QoS: Introduce a CPU system wakeup QoS limit")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Link: https://patch.msgid.link/20260608170748.82273-1-dbgh9129@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
virtblk_report_zones() trusts the device-reported number of zones when
walking the report buffer:
nz = min_t(u64, virtio64_to_cpu(vblk->vdev, report->nr_zones),
nr_zones);
...
for (i = 0; i < nz && zone_idx < nr_zones; i++) {
ret = virtblk_parse_zone(vblk, &report->zones[i], ...);
The buffer is allocated by virtblk_alloc_report_buffer(), whose size is
capped by the queue's max hardware sectors and max segments and can
therefore hold fewer descriptors than nr_zones. nz is bounded only by
the device-supplied report->nr_zones and the requested nr_zones, never
by the buffer's descriptor capacity. At probe time the request count is
unbounded (blk_revalidate_disk_zones() calls report_zones() with
nr_zones == UINT_MAX), so the device-supplied report->nr_zones is the
sole gate: a device that reports more zones than fit in the buffer
drives the loop to read report->zones[i] past the end of the allocation.
A malicious or buggy virtio-blk device that reports an inflated nr_zones
triggers this during zone revalidation at probe. KASAN reports a
vmalloc-out-of-bounds read in virtblk_report_zones() against the report
buffer allocated a few lines earlier.
Clamp nz to the number of descriptors that actually fit in the report
buffer.
Fixes: 95bfec41bd ("virtio-blk: add support for zoned block devices")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Link: https://patch.msgid.link/20260607124834.3059944-1-michael.bommarito@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Add minimal device trees for all t8122 / base M3 based devices and some
required new compatibles to the dt-bindings. These are enough to boot
Linux on these devices to a simple serial console but future work is
required to make these machines useful for end users.
Signed-off-by: Sven Peter <sven@kernel.org>
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQS3vz815OHsEaWy0u9EEX0kKnUe6QUCaiFSMAAKCRBEEX0kKnUe
6ULzAQDG1d3BZ6IKYZRZkCNuQUecKZY/NA/6TdzU1I8eQ3nW7gEAsYeh/OSPD5/+
ZehIZZ7sIqowWzcmGAAXNDJvZBJKCw8=
=mqxb
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmooOGQACgkQmmx57+YA
GNnHnxAAvKzB3bciQatigK6ggr53jjWm3XKzWlzE9ICGWiQk7uNcXQ3xsVVekOcg
vAR1pEoVbi1ofNvptdiEIOvUULCB/0s/6aso7lqhMLC2M+CRCKPnvIOQvAh91pdJ
ZvuHlptrK3guFLunGiDjWrahjwY7oLs0DOBXsLJq9BIsHJKtAlNzSMAIVJJAMd23
sVm6lq/kfFEa46YFLQYkZAKaW/DrhxFLQR092qMvoquFZwMxKm5y9ajt0h5LXLPb
jPKRarCK0BJ+NwyRkIRHM2bYQxQrmBEhlJ/XetDtuA6o6fJce1rDZS2i3IywDVzP
tvt8UPticpO6J5YbF1YHG2iMQkqPnquYl28RaPq8PPjWoJJ57phfhiffJZ7ZSusH
mOis0++87Fe9uVKcvBiTCfjZibbFOAVgU5yu2M+GrSs6rl+OnbUqGOY7QNnMmDER
autZuhuWNbTnNIuXa7s4j8GlS6YNoHIvlkTF20v2ABJeJc9zcaMJwgQOVNDShqhu
HKml8AgdPIylSSHInZ9nkGjjfmUczTxtCMA3Pkp2Qi+SF41ry9dJP0oncX3kWSdV
rRYAMDe5VQSI7aHKxHUuFxii6FG4mdEWeDjvjw/LGELenp52gSC5SCDY3/mycGop
S+XMKxN6EO9+p8SrYBpmFVVJskSWIP+d5P+R4RVmfNZiHDA6h+s=
=thB1
-----END PGP SIGNATURE-----
Merge tag 'apple-soc-dt-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux into soc/dt
Apple SoC DT update for 7.2
Add minimal device trees for all t8122 / base M3 based devices and some
required new compatibles to the dt-bindings. These are enough to boot
Linux on these devices to a simple serial console but future work is
required to make these machines useful for end users.
Signed-off-by: Sven Peter <sven@kernel.org>
* tag 'apple-soc-dt-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux:
arm64: dts: apple: Initial t8122 (M3) device trees
dt-bindings: arm: apple: Add M3 based devices
dt-bindings: pwm: apple,s5l-fpwm: Add t8122 compatible
dt-bindings: power: apple,pmgr-pwrstate: Add t8122 compatible
dt-bindings: arm: apple: apple,pmgr: Add t8122 compatible
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
for 7.2, please pull the following:
- Rosen moves the Meraki MX6X pinctrl configuration to the PWM node
where it belongs, also fixes the USB3 GPIO for the R6300v2 and
EA6500v2 routers
- Jinseok fixes a gpio label for the bcm2711 systems (Raspberry Pi 4)
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEm+Rq3+YGJdiR9yuFh9CWnEQHBwQFAmod6zkACgkQh9CWnEQH
BwT8rA//fyt24BziBBI0p36ZyQtM09aALU1o0lw7/SvA1dNXLwVyZpGkYLuvQEhU
9cMPnvgk2zzcGkC0kEAb+URgZJm/jSC6q1XktV/Ah+mXFbydFzB6mZpnl36zJYSS
77ZHSNzXmGbFjJ1A9Z7PTj91P6OnrwS2qzTb4zfC+t+u/AU5fud7sId7KzPgiUHM
pJFYhlPRdwpg1CwxRkXP1VK318bvDYD4BIs42nYZd1HE8Yzl/5DTePrteUAHRk57
oJkuKn3ZYi7pgboIUKypqO6VyHh5LD3qoZN8SbkWA9gZ/A61mkpR2dceg7zCTNFu
CtFyxicfsNacOOkYkN4B+9OebE7KsNOgjuO6bDDZdb92PeoVDzMUr8DNkKlnuCE9
TmerTX06WLjEti/aKW4XmLhDKtGNSbbtdWNVMAPrJbLn5ctEdxDH5ILaHlvcrq8f
Ya4JNZLDhG+JJqZSX65S9aYcinUb7BmUpoli5YbczG1yQbte6qHeHOjIuHGncDHc
B030XEYD4SMAyPpJqKJze20QEK9lKaSgSPixZq5Pb9ZZuUBDc8zPUEV3+7hailpU
Zm0jdffpTRP3bpIymefPuy2N6V3YxfZKRetW32JrLzcecCEr6KlqvVztFlUjjM7s
nITgB/qfTkmVz8TsjYyLf2f7E60OJGai16gBSB/qzOUp9qJTatQ=
=+Xv1
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmooN54ACgkQmmx57+YA
GNlY7xAAnykFhBvTpvWvm+QnNIEz7FnTOZ5tJxHkzU3ra2BA5XENn2i9hr9bTaC3
pcvV9Uj7ciidA5W0vsr2+Mx6MDqRrbCNUMNYJmzQoSsJThCYCk3bEeYtwVJWgp2E
iNt2SBdTtmRpmD/0OK/3u6y37NJTmoaBy2E/MpCl+5aWJnoUZso1I9BVE1CIXD5I
Ztdf+OKYIG00eFl7l1qf0wxu7AhagW8tEUO2sy3mb++pga6nlsk4tyGOFF9zIhcr
6di/ifDDkjQCTO4YHcnmi1k7sAImD+46bSRd3gbgXCtaUYuPmDzwYzk1Z5fXHcJ3
f3FtWfzjKXCpV+FLrCoSNEiku0EO7wOnx9qfHs8ObUTIUCqFNrTGZ5NQvh+CKsct
3BCYccx73lTStTqk1fbtshDdzQG495xylTBc3T8Tjt2yM2SzWtMIkRb5lfL/1dh6
3NisDK3tSppnSKbnnLIsG0l1IdRm8Wwd8oR7TJjv3J37fxw1HeEBEWYSv2jVzNJl
vLaontWV6b0Umn/737nb7nMXXYOf53zes7Qa57GP7jSuJ6JIOR0BC+orEc75LNxJ
5n8ZTQa5TcgEq30cfWzUhjphKoU/URafsT92m/t9msMG7MPpfBpR3M2W692mP93i
1dQ83VF+LotOLIpqcixLIAJyQbaYr2A0wXGk51n521CFnnscNM4=
=iAvC
-----END PGP SIGNATURE-----
Merge tag 'arm-soc/for-7.2/devicetree' of https://github.com/Broadcom/stblinux into soc/dt
This pull request contains Broadcom ARM-based SoCs Device Tree changes
for 7.2, please pull the following:
- Rosen moves the Meraki MX6X pinctrl configuration to the PWM node
where it belongs, also fixes the USB3 GPIO for the R6300v2 and
EA6500v2 routers
- Jinseok fixes a gpio label for the bcm2711 systems (Raspberry Pi 4)
* tag 'arm-soc/for-7.2/devicetree' of https://github.com/Broadcom/stblinux:
arm: dts: bcm2711: Fix typo in gpio-line-names
ARM: dts: BCM5301X: EA6500v2: fix USB3
ARM: dts: BCM5301X: R6300v2: fix USB3
ARM: dts: NSP: Move MX6X pinctrl config to PWM node
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
This contains a fix for GPIO on Jetson AGX Thor and enables the PCIe
controllers used on this platform.
Smaug (a.k.a. Pixel C) devices can now be properly powered off via the
PMIC.
Miscellaneous improvements are made across a number of different boards,
such as SMMU enablement on Tegra194 platforms and some better bootloader
interoperation on Chromium-based devices.
Finally, various minor fixes to device tree properties round off this
set of changes.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEiOrDCAFJzPfAjcif3SOs138+s6EFAmobywUACgkQ3SOs138+
s6HDpg/8D6TiSLg6O2ei6dFCeyZGXyG1MxlZyBW9eS4peb8WR3J5AwL5xWMj3gyk
JRXLQcQbme+f6EVlBxZBUcNvqilKw4ESd4Zi58P/4Jw/yZ7ExcuXmlt9b0JIiqNC
8LsQkAqYIU6sWlcb9ti5SKXalNTZ4KglJicmXS1YdV+cCMnBXydRui2kc9cTSrFF
TyP6sdb+OebvKltiFd3tlV18joEeoKy1H/Uz8hTuDefEOAKAYqy+rUi68qm/yqR0
kSt4swqVRHRotmdoP0eqNCxi+iD10roiRLw+GZZ88dpvrmpN3jIXoTs35u3tUTOA
+exKTJOggr7bGkb4RZ5pZ9r1+TTPD/trcao98oer9RU+++1d29rmIV4+mXt9wVEo
PA+gelULpY9K/FUSohwkXt+X+XODVel1Ijo5QdXlhGwzoooR/O7uAzOoT0+i5/3g
RR/WjSQ/7li7TTFDGWSZS0SbIVPDsb8+gRePLWwEDJdEIhnSc24X2j/qziV2Mys6
ohrtERbXtIm8Wv/v4ACtROQ2uDWtigvMZ+XIUjriHXau5JYiBClutX43TfI/vL8l
c8y0dHpu37SMIa4wYo4/RIjdK4d1UIdr8tz/8VSKEczf4vogftAnH9iQDTKQsAN6
rgSVJHs694rKYThGWgF77uC5U0uf87AAPh5xpCCd9mywgyw5HmA=
=kj5P
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmooNrYACgkQmmx57+YA
GNkarBAAtrNMz2vLZVgizX3Xi2UmG5hgCBoAH94m8T9+NmQjc52wWGMqZI5nUI5g
U1P/D9yme+V4NYTArll5bmW+NEXtqUIczUO1zmvUQmfici/bp3exOQF7TEP0PhZ/
dPxPcR47UGWXoysSbHWeSHPb+wqaU+F6NciSYfDmpV1GGuNWOtfbLTINNEEfFqWJ
jpab7TTsWudekfKk5xJMFKjannb0obGg9qj6Qq7djE/z1maoOYURdWXCK0+wYQb0
4idZTA/6qf4rKs41JAVOr4KuHVKFjtiOiMWerOJbm28EkN6tOckTkSU6U1MpZE9V
oVaMSMZY0QT2MHc4q4lE2m921bNKB7w2czdj02/7cskePEUZGQI47Ol/7OreEI+7
on21CRM3NxbSLi6z+GjbwhArnKJGl+UXIVji142+goZgWyJiGEe79ZqAZq6P/wyf
zRHCS2B7/S5YNmLxTl9JkXxZorU0BHV0A15YyudFlL1HRW6s8mmEwAVuhVjwJ2SO
O2eut6iy4RMCKHP2Ff7lcWGwXnJdeE1nEf/mtCVNaE5H75m7rwiphMyKg+at8Mi2
tID/hhCdBlyGDwWGyO/QOkdi78KolbYCW4pDb64Y04c45natalc0hmbh3lca3Uep
guGYsNfumPtXwDJDxG68v/T4Bbbd4lrrstNVHrcfWWqsa1IAOPU=
=VIOE
-----END PGP SIGNATURE-----
Merge tag 'tegra-for-7.2-arm64-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt
arm64: tegra: Changes for v7.2-rc1
This contains a fix for GPIO on Jetson AGX Thor and enables the PCIe
controllers used on this platform.
Smaug (a.k.a. Pixel C) devices can now be properly powered off via the
PMIC.
Miscellaneous improvements are made across a number of different boards,
such as SMMU enablement on Tegra194 platforms and some better bootloader
interoperation on Chromium-based devices.
Finally, various minor fixes to device tree properties round off this
set of changes.
* tag 'tegra-for-7.2-arm64-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux:
arm64: tegra: Enable SMMU on Tegra194 display controllers
Revert "arm64: tegra: Disable ISO SMMU for Tegra194"
arm64: tegra: Add #{address,size}-cells to Chromium-based /firmware
arm64: tegra: Fix aspm-l1-entry-delay-ns L1 latency cells
arm64: tegra: Mark MAX77620 as system power controller on Smaug
arm64: tegra: Enable PCIe for Jetson AGX Thor
arm64: tegra: Fix address of Tegra264 main GPIO controller
arm64: tegra: Add aspm-l1-entry-delay-ns to PCIe nodes
arm64: tegra: Fix Tegra234 MGBE PTP clock
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
According to the PHY Databook Common Block Signals section, the
ref_clk_en signal must remain de-asserted until the reference clock is
running at the appropriate frequency. Once the clock is stable,
ref_clk_en can be asserted. For lower power states where the reference
clock to the PHY is disabled, ref_clk_en should also be de-asserted.
Move the ref_clk_en bit manipulation into imx95_pcie_enable_ref_clk()
to ensure the reference clock stabilizes before ref_clk_en is asserted
and before the PHY reset is de-asserted. This aligns with the timing
requirements specified in the PHY documentation.
Fixes: d8574ce57d ("PCI: imx6: Add external reference clock input mode support")
Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260518072715.3166514-3-hongxing.zhu@nxp.com
According to the i.MX95 PCIe PHY Databook, the ref_use_pad signal in the
Common Block Signals section selects the reference clock source connected
to the PHY pads. Per the specification, any change to this input must be
followed by a PHY reset assertion to take effect.
Move the REF_USE_PAD configuration before the PHY reset toggle to comply
with the required initialization sequence.
Fixes: 47f54a902d ("PCI: imx6: Toggle the core reset for i.MX95 PCIe")
Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
[mani: renamed the callback and helper to match the usecase]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260518072715.3166514-2-hongxing.zhu@nxp.com
Nuoqi Gui says:
====================
bpf: Enforce BTF pointer write checks for global args
check_mem_reg() verifies both read and write access when a caller passes
memory into a global subprogram. For PTR_TO_BTF_ID callers,
check_helper_mem_access() currently always checks the access as BPF_READ.
That lets a tracing program pass a task_struct field pointer to a global
subprogram argument typed as writable memory. The direct field store is rejected
with "only read is supported", but the callee is validated with a generic
writable PTR_TO_MEM argument and can store through it.
Forward the requested access type into the PTR_TO_BTF_ID helper-access path and
add verifier coverage for the global-subprogram argument case.
Validation (tested on bpf-next 8496d9020f):
Without this series:
direct BTF field store rejected with "only read is supported";
global-subprogram candidate loaded, attached, and runtime-confirmed.
With this series applied:
direct BTF field store rejected with "only read is supported";
global-subprogram candidate rejected with "only read is supported".
Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
---
====================
Link: https://patch.msgid.link/20260609-f01-04-btf-writable-arg-v1-0-f449cd970669@mails.tsinghua.edu.cn
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Add a verifier test for passing a BTF-backed task_struct field pointer to a
global subprogram argument typed as writable memory.
The direct field store is already rejected.
The global subprogram path should be rejected too.
The callee must not lose the BTF pointer's read-only provenance.
It must not validate the argument as ordinary writable memory.
Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
Link: https://lore.kernel.org/bpf/20260609-f01-04-btf-writable-arg-v1-2-f449cd970669@mails.tsinghua.edu.cn
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
check_mem_reg() verifies both read and write access for global subprogram
memory arguments. When the caller register is PTR_TO_BTF_ID,
check_helper_mem_access() currently forwards the access to
check_ptr_to_btf_access() as BPF_READ regardless of the requested access
type.
This lets a BTF-backed kernel object field pointer pass the caller-side
writable memory check for a global subprogram argument. The callee is then
validated with a generic writable PTR_TO_MEM argument and can store through
it, even though an equivalent direct BTF field store is rejected with "only
read is supported".
Forward the requested access type to check_ptr_to_btf_access().
This enforces existing BTF write restrictions for global subprogram memory
arguments as well.
Fixes: 3e30be4288 ("bpf: Allow helpers access trusted PTR_TO_BTF_ID.")
Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
Link: https://lore.kernel.org/bpf/20260609-f01-04-btf-writable-arg-v1-1-f449cd970669@mails.tsinghua.edu.cn
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Document the KVM_CAP_S390_HPAGE_2G capability, which behaves very
similarly to the existing KVM_CAP_S390_HPAGE_1M.
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260609150930.665370-5-imbrenda@linux.ibm.com>
Change gmap_2g_allowed() to perform the necessary checks to allow for
2G hugepages to be used, instead of returning false. The
GMAP_FLAG_ALLOW_HPAGE_2G gmap flag is now taken into account.
Also add appropriate kerneldoc comments.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260609150930.665370-4-imbrenda@linux.ibm.com>
Add KVM_CAP_S390_HPAGE_2G to signal to userspace that 2G hugepages may
be used to back the guest; restrictions apply similar to 1M hugepages.
Enable the (for now still ignored) GMAP_FLAG_ALLOW_HPAGE_2G flag for
the guest gmap, and propagate / disable it as necessary.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260609150930.665370-3-imbrenda@linux.ibm.com>
Add the hpage_2g module parameter to KVM to allow enabling or disabling
2G hugepages in KVM.
If hpage_2g is enabled but hpage is not enabled, print a message and
disable hpage_2g.
Opportunistically fix the comment for the hpage module parameter.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260609150930.665370-2-imbrenda@linux.ibm.com>
The LTC4283 device has up to 8 pins that can be configured as GPIOs.
Note that PGIO pins are not set as GPIOs by default so if they are
configured to be used as GPIOs we need to make sure to initialize them
to a sane default. They are set as inputs by default.
Acked-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20260502-ltc4283-support-v13-3-1c206542e652@analog.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Support the LTC4283 Hot Swap Controller. The device features programmable
current limit with foldback and independently adjustable inrush current to
optimize the MOSFET safe operating area (SOA). The SOA timer limits MOSFET
temperature rise for reliable protection against overstresses.
An I2C interface and onboard ADC allow monitoring of board current,
voltage, power, energy, and fault status.
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20260502-ltc4283-support-v13-2-1c206542e652@analog.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Some workloads with different CPU capacities consume more power with
timer migration than before. The recently introduced per capacity
hierarchies were supposed to alleviate this problem. However it appears
to also regress other types of workloads, especially when plenty of
capacities live together in the same machine.
Disable the feature until a reasonable solution is found.
Fixes: 098cbaad8e ("timers/migration: Split per-capacity hierarchies")
Reported-by: Christian Loehle <christian.loehle@arm.com>
Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260609123356.28449-1-frederic@kernel.org
Closes: https://lore.kernel.org/all/3b79338f-6cfc-4722-8062-9103db2c8ad1@arm.com
address post-7.1 issues or aren't considered suitable for backporting.
Thre's a 2 patch series "mm/damon/{reclaim,lru_sort}: handle ctx
allocation failures" from SeongJae Park which fixes a couple of DAMON
-ENOMEM bloopers. The rest are singletons - please see the individual
changelogs for details.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCaieN5AAKCRDdBJ7gKXxA
jkN7AP9wXhRFOUq0EPeQxnlie7vgM/jiDuOoPAn7EUt9S7pqCwEApJnxEbMzXioD
Jx6MxoUqqa/d5wXb7u0MRgT76n9KOwk=
=hdKc
-----END PGP SIGNATURE-----
Merge tag 'mm-hotfixes-stable-2026-06-08-20-51' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull misc fixes from Andrew Morton:
"11 hotfixes. 9 are for MM. 8 are cc:stable and the remaining 3 address
post-7.1 issues or aren't considered suitable for backporting.
Thre's a two-patch series "mm/damon/{reclaim,lru_sort}: handle ctx
allocation failures" from SeongJae Park which fixes a couple of DAMON
-ENOMEM bloopers. The rest are singletons - please see the individual
changelogs for details"
* tag 'mm-hotfixes-stable-2026-06-08-20-51' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
mm/mincore: handle non-swap entries before !CONFIG_SWAP guard
arm64: mm: call pagetable dtor when freeing hot-removed page tables
mm/list_lru: drain before clearing xarray entry on reparent
mm/huge_memory: use correct flags for device private PMD entry
mm/damon/lru_sort: handle ctx allocation failure
mm/damon/reclaim: handle ctx allocation failure
zram: fix use-after-free in zram_bvec_write_partial()
MAINTAINERS: update Baoquan He's email address
tools headers UAPI: sync linux/taskstats.h for procacct.c
mm/cma_sysfs: skip inactive CMA areas in sysfs
ipc/shm: serialize orphan cleanup with shm_nattch updates
The LTC4283 is a negative voltage hot swap controller that drives an
external N-channel MOSFET to allow a board to be safely inserted and
removed from a live backplane.
Special note for the "adi,vpower-drns-enable" property. It allows to choose
between the attenuated MOSFET drain voltage or the attenuated input
voltage at the RTNS pin (effectively choosing between input or output
power). This is a system level decision not really intended to change at
runtime and hence is being added as a Firmware property.
Reviewed-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20260502-ltc4283-support-v13-1-1c206542e652@analog.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Adds support for the Infineon XDP730 Digital eFuse Controller by
updating the existing XDP720 driver.
Signed-off-by: Ashish Yadav <ashish.yadav@infineon.com>
Link: https://lore.kernel.org/r/20260609072231.15486-3-Ashish.Yadav@infineon.com
[groeck: Fixed conflicts in xdp720_id declaration]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Add documentation for the device tree binding of the XDP730 eFuse.
Rename node to efuse to accurately reflect its hardware function.
Signed-off-by: Ashish Yadav <ashish.yadav@infineon.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://lore.kernel.org/r/20260609072231.15486-2-Ashish.Yadav@infineon.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Add a PMBus driver for the Analog Devices MAX20860A step-down DC-DC
switching regulator. The MAX20860A provides monitoring of input/output
voltage, output current, and temperature via the PMBus interface using
linear data format. Optional regulator support is available via
CONFIG_SENSORS_MAX20860A_REGULATOR.
Signed-off-by: Syed Arif <arif.syed@hpe.com>
Signed-off-by: Sanman Pradhan <psanman@juniper.net>
Link: https://lore.kernel.org/r/20260601184516.919488-3-sanman.pradhan@hpe.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Add support for BMR316, BMR321, BMR350 and BMR351 DC/DC converter
modules from Flex to the pmbus driver.
Signed-off-by: Daniel Nilsson <linux@erq.se>
Link: https://lore.kernel.org/r/20260603085712.659432-2-linux@erq.se
[groeck: Resolved conflicts (explicit struct members in pmbus_id)]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Named initializers are better readable and more robust to changes of the
struct definition. This robustness is relevant for a planned change to
struct platform_device_id replacing .driver_data by an anonymous unit.
While touching these arrays unify usage of commas.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://lore.kernel.org/r/25d38df8db42d69f33fa30267c9fd5ea058223d0.1779894738.git.u.kleine-koenig@baylibre.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
The driver explicitly set the .driver_data member of struct
platform_device_id to zero without relying on that value. Drop this
unused assignments.
While touching this array unify spacing and use named initializers for
.name.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org>
Acked-by: Thomas Weißschuh <linux@weissschuh.net>
Link: https://lore.kernel.org/r/972c9998054c7944f63266819d6fb08b36edb5c5.1779894738.git.u.kleine-koenig@baylibre.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
set_fan() parses user input with kstrtol() and passes the resulting
value to FAN16_TO_REG() on chips with 16-bit fan support.
Negative fan speeds are not meaningful and should be rejected before
conversion. Worst scenario, one may be able to abuse undefined
behaviour of signed overflow to possibly induce rpm * 2 == 0 in
FAN16_TO_REG(), thus causing a division by zero.
Instead, clamp val < 0 to zero and keep the conversion in its valid
input domain, avoiding unsafe arithmetic in the register conversion
path.
Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.
Fixes: 17d648bf57 ("it87: Add support for the IT8716F")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Link: https://lore.kernel.org/r/20260529141839.1639287-1-n.zhandarovich@fintech.ru
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
