Several significant bug fixes of pre-existing issues:
- Missing validation on ucap fd types passed from userspace
- Missing validation of HW DMA space vs userpace expected sizes in EFA
queue setup
- DMA corruption when using DMA block sizes >= 4G when setting up MRs in
all drivers
- Missing validation of CPU IDs when setting up dma handles
- Missing validation of IB_MR_REREG_ACCESS when changing writability of a
MR
- Missing validation of received message/packet size in ISER and SRP
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRRRCHOFoQz/8F5bUaFwuHvBreFYQUCaib4qwAKCRCFwuHvBreF
YRPNAP0TslA/smVGQcGPVHHtLl3b5n47NSE+pwNXFlWUp8yO5AD/T1VmGSRbjbc+
5eqr/1yMqGha1sHBY8XFEbqJKIPFOQY=
=CmEv
-----END PGP SIGNATURE-----
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma
Pull rdma fixes from Jason Gunthorpe:
"Several significant bug fixes of pre-existing issues:
- Missing validation on ucap fd types passed from userspace
- Missing validation of HW DMA space vs userpace expected sizes in
EFA queue setup
- DMA corruption when using DMA block sizes >= 4G when setting up MRs
in all drivers
- Missing validation of CPU IDs when setting up dma handles
- Missing validation of IB_MR_REREG_ACCESS when changing writability
of a MR
- Missing validation of received message/packet size in ISER and SRP"
* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
RDMA/srp: bound SRP_RSP sense copy by the received length
IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc
RDMA/umem: Fix truncation for block sizes >= 4G
RDMA/efa: Validate SQ ring size against max LLQ size
RDMA/core: Validate the passed in fops for ib_get_ucaps()
Commit e1c5ae59c0 ("fs: don't allow non-init s_user_ns for filesystems
without FS_USERNS_MOUNT") prevents the mount of any filesystem inside a
container that doesn't have FS_USERNS_MOUNT set.
This broke NFS mounts in our containerized environment. We have a daemon
somewhat like systemd-mountfsd running in the init_ns. A process does a
fsopen() inside the container and passes it to the daemon via unix
socket.
The daemon then vets that the request is for an allowed NFS server and
performs the mount. This now fails because the fc->user_ns is set to the
value in the container and NFS doesn't set FS_USERNS_MOUNT. We don't
want to add FS_USERNS_MOUNT to NFS since that would allow the container
to mount any NFS server (even malicious ones).
Add a new FS_USERNS_DELEGATABLE flag, and enable it on NFS.
Fixes: e1c5ae59c0 ("fs: don't allow non-init s_user_ns for filesystems without FS_USERNS_MOUNT")
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260129-twmount-v1-1-4874ed2a15c4@kernel.org
Acked-by: Anna Schumaker <anna.schumaker@oracle.com>
Reviewed-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
This configuration option exists so "that we don't provide the symbol
when there's no possibility of there being a usable clocksource".
However it only covers __vdso_gettimeofday() and none of the other vDSO
functions which should be affected by the same circumstances.slightly slightly.
Remove MIPS_CLOCK_VSYSCALL and fold its usecase into
MIPS_GENERIC_GETTIMEOFDAY, which works correctly.
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: Daniel Lezcano <daniel.lezcano@kernel.org>
Cc: Thomas Gleixner <tglx@kernel.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: linux-mips@vger.kernel.org
Link: https://patch.msgid.link/20260521-vdso-mips-kconfig-v1-9-2f79dcd6c78f@linutronix.de
As explained in the comment, the problematic GOT references are only
emitted by old versions of GCC.
Limit the restriction to those compilers.
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Link: https://patch.msgid.link/20260521-vdso-mips-kconfig-v1-8-2f79dcd6c78f@linutronix.de
The currently used MIPS_DISABLE_VDSO will disable only the userspace
bits of the time-related vDSO. The kernel part is still pointlessly
built and running.
Remove MIPS_DISABLE_VDSO and fold its usecase into
MIPS_GENERIC_GETTIMEOFDAY, which works correctly.
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: Daniel Lezcano <daniel.lezcano@kernel.org>
Cc: Thomas Gleixner <tglx@kernel.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: linux-mips@vger.kernel.org
Link: https://patch.msgid.link/20260521-vdso-mips-kconfig-v1-7-2f79dcd6c78f@linutronix.de
VDSO_CLOCKMODE_GIC is only defined if CONFIG_GENERIC_GETTIMEOFDAY is
enabled. Right now this is always the case, but it will change soon.
Prepare for the potential unavailability of VDSO_CLOCKMODE_GIC.
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Link: https://patch.msgid.link/20260521-vdso-mips-kconfig-v1-6-2f79dcd6c78f@linutronix.de
VDSO_CLOCKMODE_R4K is only defined if CONFIG_GENERIC_GETTIMEOFDAY is
enabled. Right now this is always the case, but it will change soon.
Prepare for the potential unavailability of VDSO_CLOCKMODE_R4K.
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Link: https://patch.msgid.link/20260521-vdso-mips-kconfig-v1-5-2f79dcd6c78f@linutronix.de
SiFive ccache:
Add the Starfive JH7110 to the list of devices that need the
non-standard cache ops, because the GPU appears to be DMA non-coherent
unlike other peripherals.
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRh246EGq/8RLhDjO14tDGHoIJi0gUCaiad6wAKCRB4tDGHoIJi
0glQAQDvNsPDYfDR+wcMV26aZwm8PaXqT+QE0YTIdn65w2jTNgD/ZG7atwiyaVF7
P3X+JHE6n2KKAilNcQwYxBd39wHFAAU=
=HuSd
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmooKqwACgkQmmx57+YA
GNl1kxAAmyHFQdcpqyUOjxu6gEeVC1nR9kS8iwWs77Tjr3bEB3NK6D9d8hG/9zOR
lwZhkx3Tkaq3AUmgAMG9voZ/ctGx7iqZ2f1RZY18CVjZ6AvRRA1DK1QR4krvgL4L
AgvxMHvTg9oYWYAifuyi4Mk2YRduP+IkxerYDTcX0cEQ+yneFNvpYwMuL7Xt3vKI
16hlmqIAOeu++hxtGZllFy0QeSGoRzKTb+NEj51PxM97nWQCpyQptDfylZ3Qb/kf
DhJMWe3WnbCbqDdHUdCJskUM7TndGoY6Ko0Q6sXdInUoFPb8CgTGtQJIRLZ0B2YJ
f2P0lOOubOd+4a3J6CnTbO+YGFBaLLcx5a04ddp7L11s4IkAtCMKjM36G0rksIz/
tlRxP2TZkE6oN1uOcIjBBnGKhcdqUPjM2fpLN+qEpAdyWBt1Qj3dW2HSgpSLjTA2
8eKRPq80Q7ZmXe1TQ4HLY2fKD8UNuPPa9eMlwallmF2qu0yaEoqHMPN7kaWiMNay
NWymyhm55hCXt2XMKRsbtLWMbO3aNNFxb0yV8TTdjWtRSmGzr+idxiP4WU7sFLYU
NLExMiKRKbTOiyUaQ+T0ANm3xQOnYSp02AwNu3vcNkXeMTrnlXRi3td7oYQGNo4q
DRbQNOcCa6zdEiFUIyXbxJv/NiGe7QI3fBzCKqeQdAkTSJq834Q=
=jQyh
-----END PGP SIGNATURE-----
Merge tag 'cache-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/drivers
standalone cache drivers for v7.2
SiFive ccache:
Add the Starfive JH7110 to the list of devices that need the
non-standard cache ops, because the GPU appears to be DMA non-coherent
unlike other peripherals.
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
* tag 'cache-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux:
cache: sifive_ccache: Add StarFive JH7110 SoC support
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
In tegra234_mc_icc_aggregate(), the 'if (mc)' check inside the
CPU-cluster branch is always true. 'mc' was already dereferenced
via 'mc->bwmgr_mrq_supported' a few lines above, so if it were NULL
the function would have faulted there. Drop the redundant check.
Reported-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Sumit Gupta <sumitg@nvidia.com>
Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://patch.msgid.link/20260527140127.49172-4-sumitg@nvidia.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
tegra264_mc_icc_aggregate() does nothing on top of icc_std_aggregate
except an early return on !mc->bwmgr_mrq_supported.
tegra264_mc_icc_set() already returns early on the same condition,
before reading any of the aggregated avg_bw / peak_bw values. This
makes the early return in aggregate() redundant. So, set
tegra264_mc_icc_ops.aggregate to icc_std_aggregate and drop the
helper.
Reported-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Sumit Gupta <sumitg@nvidia.com>
Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://patch.msgid.link/20260527140127.49172-3-sumitg@nvidia.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
tegra186_emc_interconnect_init() copies the MC's ICC aggregate hook
into the EMC provider. That hook (tegra234_mc_icc_aggregate /
tegra264_mc_icc_aggregate) uses container_of() to recover 'mc',
which is only valid when the icc_provider is embedded in struct
tegra_mc. For an EMC node the provider is embedded in struct
tegra186_emc, so 'mc' points into unrelated memory.
This stayed harmless until commit faafd6ca7e ("memory: tegra:
make icc_set_bw return zero if BWMGR not supported") added an
unconditional read of mc->bwmgr_mrq_supported at the top of the
hook. UBSAN catches the stray load on every EMC aggregation:
UBSAN: invalid-load in drivers/memory/tegra/tegra234.c:1104:9
load of value 112 is not a valid value for type '_Bool'
No functional impact in practice, since the hook's only other mc
dereference (mc->num_channels) sits inside a
TEGRA_ICC_MC_CPU_CLUSTER* branch that EMC nodes never enter.
Fix this by setting the EMC provider's aggregate hook to
icc_std_aggregate, instead of borrowing the MC's hook. The MC
providers continue using their own aggregate hooks, where
container_of() correctly resolves to struct tegra_mc.
Reported-by: Jon Hunter <jonathanh@nvidia.com>
Fixes: 9a38cb2766 ("memory: tegra: Add interconnect support for DRAM scaling in Tegra234")
Signed-off-by: Sumit Gupta <sumitg@nvidia.com>
Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://patch.msgid.link/20260527140127.49172-2-sumitg@nvidia.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
TI K3 TISCI:
- ti_sci: Add BOARDCFG_MANAGED mode for support system suspend/resume cycles
- ti_sci: Add support for restoring IRQ and clock contexts during resume.
- clk: keystone: sci-clk: Add clock restoration support.
SoC Drivers:
- k3-socinfo: Add support for identifying AM62P silicon variants via NVMEM,
along with corresponding dt-bindings update for nvmem-cells support
- k3-ringacc: Fix incorrect access mode for ring pop tail IO/proxy operations
Keystone Navigator (knav) Cleanup and Fixes:
- knav_qmss: Multiple code quality improvements
- knav_qmss_queue: Implement proper resource cleanup in the remove() path
General Cleanups:
- k3-ringacc: Use str_enabled_disabled() helper for consistency
- knav_qmss: Use %pe format specifier for PTR_ERR() printing
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE+KKGk1TrgjIXoxo03bWEnRc2JJ0FAmogRt8ACgkQ3bWEnRc2
JJ34qg/9G4HWCfLWqkNr9xgL3YW6/zSkj6CE47ZK+Ku7O6FZprmLZ8OtyrVZMNNp
MFv/51SVN++whZULMkr2FTjlK4BIVqnjo9smTs2timvBjoCIJuLRkIolWlob4aEF
V4+f7cW31bD3BgtxftWKWJSbRpnk2jRue8esAyVSl/N4E4/w+uEYhC0MU6gwuU3P
rZJJ+Am/4+8xri7sKD+9GXM8255T7wA92P3piQBeZXFC8r0oNsFvIkkkQ5kJe+K6
P84qkz2gxUdutlPRL6vAvxofqNF8GT0hGLM5nPGYf2NIaergUxl8ydtJWGw+x2Xw
QTWXqzETEqUdBSl/JUJHSCnxt793V8WDBAzu0Ka9UhtXnlcqAlTe46QfV5LWslaa
HOJknSvMF/6k+/5HBnS+TI8O2u+koQGlVTZnXoL/E035tXSXH8dFoeXUt1PixYDf
346cz40LNn7iry1HVuOKRtfX4+D+ZH0KqbelYSEUyPgXIt/d+rcUdZKWgCtjNDmg
GobjiSnsoAmTWA8HKDnLxaF62bUXIRJNlRfjIJ6oL8i4IQtnqU/d92ABYIQwMh+Z
yiwuJmkK7Qd6Lx0CraW9drIiSgYn9gEWGZW1JbJnoW72HP9hkjRjU6rkcKFxLckf
sQE/xdZu/unO2Zq2WxGAFAgVwJ6AyQlbpVu+kQHlJNdQYanpDfw=
=JSdI
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmooKk0ACgkQmmx57+YA
GNmFtg//QosIGaXc8MBeU+0o2qaoHZhOxlG8Z/QppdNQ0BazlTSGJK3q9CdwDyn1
25L93bSr75z0Lf57qvA2qw/esRMmCl2Hgf/xux42sWvielUXPs1/bN4IQmUoux/f
MZ8G2tPQnuOajep6wtMfr+cSqwUTPzItyOYBF6XTYOIjUnrBpzlEkHGNHXDEonu7
l3QJi6yOiOFl1MGyQLYJ1a6j+xBkD/2a7qmbuEXyKKL0DNMyGnqeSDDxbONVWQPE
+5Vu8k42Cadz68YpN6ZI7R2zrNl6m1QQEip7pYAjGI6ddM5Axy0PV6odh9ASM2Ur
vk8cicKbeyZ6Q5rmz33dxvSJYQYY0h5gZR0KBv6pX9sKiWIexUH07YiLJkcghD6i
s15IvcgXSfDfBd5hXnhYnL6XyZ4rfAtkW/PxaPi9vvUyakwnzR7WceEc0wMHGO3T
nYrhzNQAMfsbq0U3gMBPWlp55pAu0DGzg5ZnUU0WHFGiu7HUv1/oe1j8+eJSKSgF
5GcaQXQ0zH2J4D/ppC+jLOnOWbdTICVdryfU/9yNvB2ZMNMzU4uNSv8E6+ww3H3m
jSDuDnjRuD4P1nuI7zyC+xfSVxlOBcVYVGj623ODBxBpsZaCIBvbdcqocULIVAng
osK+Ouv1ymsKe1MU3MvpyFP8I5nNmv23bb1M8NzshndOylnGdo0=
=Xyhg
-----END PGP SIGNATURE-----
Merge tag 'ti-driver-soc-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/drivers
TI SoC driver updates for v7.2
TI K3 TISCI:
- ti_sci: Add BOARDCFG_MANAGED mode for support system suspend/resume cycles
- ti_sci: Add support for restoring IRQ and clock contexts during resume.
- clk: keystone: sci-clk: Add clock restoration support.
SoC Drivers:
- k3-socinfo: Add support for identifying AM62P silicon variants via NVMEM,
along with corresponding dt-bindings update for nvmem-cells support
- k3-ringacc: Fix incorrect access mode for ring pop tail IO/proxy operations
Keystone Navigator (knav) Cleanup and Fixes:
- knav_qmss: Multiple code quality improvements
- knav_qmss_queue: Implement proper resource cleanup in the remove() path
General Cleanups:
- k3-ringacc: Use str_enabled_disabled() helper for consistency
- knav_qmss: Use %pe format specifier for PTR_ERR() printing
* tag 'ti-driver-soc-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux:
firmware: ti_sci: Add support for restoring clock context during resume
clk: keystone: sci-clk: Add restore_context() operation
firmware: ti_sci: Add support for restoring IRQs during resume
firmware: ti_sci: Add BOARDCFG_MANAGED mode support
soc: ti: k3-ringacc: Use str_enabled_disabled() helper
soc: ti: knav_dma: Use IOMEM_ERR_PTR() in pktdma_get_regs()
soc: ti: knav_dma: Remove dead check on unsigned args.args[0]
soc: ti: knav_dma: Remove unused DMA_PRIO_MASK macro
soc: ti: knav_qmss_acc: Fix kernel-doc Return: tag
soc: ti: knav_qmss: Fix __iomem annotations and __be32 type
soc: ti: knav_qmss: Use %pe to print PTR_ERR()
soc: ti: knav_qmss: Fix kernel-doc Return: tags
soc: ti: knav_qmss: Inline lockdep condition in for_each_handle_rcu
soc: ti: knav_qmss: Rename global kdev to knav_qdev to fix -Wshadow
soc: ti: knav_qmss: Remove remaining redundant ENOMEM printks
soc: ti: knav_qmss_queue: Implement resource cleanup in remove()
soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy
soc: ti: knav_dma: fix all kernel-doc warnings in knav_dma.h
soc: ti: k3-socinfo: Add support for AM62P variants via NVMEM
dt-bindings: hwinfo: ti,k3-socinfo: Add nvmem-cells support
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
pull the following:
- Justin changes the soc_device driver to be more modern and consolidate
the initialization
- Chen-Yu updates the BCM2835 firmware Kconfig dependency and adds
COMPILE_TEST
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEm+Rq3+YGJdiR9yuFh9CWnEQHBwQFAmod65gACgkQh9CWnEQH
BwRaSw//a9u6jb7iZcT0drzDynqLcRNR7qM8QPgBNhQRQEHhH1CKx81958ktN+cT
lnMyYdNwYBdBYovzf0UMxc00XxiEp+nEHqHt29nkfTx+lNFOqg0Wz0C7rQSNBKtJ
bmgkcYEZhPS2e8njuCaKhPGVJJjBDTMAVawaYnItv0lsx6pOQrzbIsJWXqDEhhUJ
Hm5Rg8f9V314tbNHabt5ffDOQosuPDEaCamZWpzEX5gdx0KTC1MW3RtOfTYaFwNC
Lm1P/lNr+17aqaO4mU4WkilwsrJ1vYEwXpsdKrUc9lvLKm1QrvU15rxnx8f6W9CF
bXNJw8h+IG370Ef8GSKHdfaRzlt3o4OwShVgc8jz0HN5dTzQCuPF+ycd02o73ush
PfepJiavlT5O0NW965etVNlNgT5tA3xlPRSAep5H7ill99iqGBqxnVJX38DLyvN1
slh9W0gDgxDM2p2YQ8+s0tOxdgzx2uSSBu+A6FUWI1mRg15G+He9QHBPHBrp9OTz
lhKeAXcGZARw5hl0XtOlUMGP7SnznLgx7DRd9CfV/Y17J9AUqAqJj3nn40waWveX
cJPnR9utLdfnmbh2m9sNd+G8ZNWpDo794v0+ZL8LSdyJh8Th6Psj0svuiWlHOmjW
qLj8zPQIsCtd9RFccuY55lNR1VWau4uGE6ilaTIUK+y9n8q7UAg=
=n15T
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmooKfYACgkQmmx57+YA
GNkWGg//YLp8e3usfDeilJDL4Ddw9VzoeCBx4lo6Nq/PqdrpWw8zckM1GLXLmxoa
UbmIoKeeFixNukJaTTrcylOlCo3jKduF0frK8TQQpYbe9NXmrj0lU2JUT6noerPz
iWTwCiw6SLc4VbW+2RXLN2yfW69pIh1Zl8ijaD9wWyBNzHz5lBNs/a6ElZrPC/Gu
OLAOhC4iTD0EtnHciukZDTxZWVnPliWOoFfBxH8h+919DTtruyDTNNzelGmNlKdY
O+r+cCCIN54PbUNgelOsyr6uSSZZO7Py9W6en+DSwwBd8EdaNNC7ZXlor/1Dd+YX
Afu6T5yyVZY8VqCEbhxTcVXz4Dd5X2LINZoMIWkCI8nY3l+5+gJ491liEiNpjOxa
9OmcDhHnTT6R8qp1gS25INPlQ+tZmmXRknLloS5nIaY2Fz5e4gvG24rn104wd/2D
oz91BcwvuIx2BDfi7Tlf76csGF3cS3o8eKTnLcpRzkKEsCsolIH+TLDv1aXBQ+IO
kekItVJYuj+AF5S06NazxRztFn3WIrQ0+KeSgQYQfemeI4tkfh61ORB45y3Aelsd
jyqJnBUNhjffr+YA6tZ3v63s49+92tzawhXJy5XRsww/OvcyfouH3H13KlIhjYzO
2iHqrO9Szyow8HYmCPmyYPTB8o7D7i9vEsYV7PLKXOqByzBtZGk=
=Uzzq
-----END PGP SIGNATURE-----
Merge tag 'arm-soc/for-7.2/drivers' of https://github.com/Broadcom/stblinux into soc/drivers
This pull request contains Broadcom SoC drivers changes for 7.2, please
pull the following:
- Justin changes the soc_device driver to be more modern and consolidate
the initialization
- Chen-Yu updates the BCM2835 firmware Kconfig dependency and adds
COMPILE_TEST
* tag 'arm-soc/for-7.2/drivers' of https://github.com/Broadcom/stblinux:
firmware: raspberrypi: Change dependency to ARCH_BCM2835 and COMPILE_TEST
soc: brcmstb: consolidate initcall functions
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Improve Samsung Exynos (and Google GS101) ACPM (Alive Clock and Power
Manager) firmware driver:
1. Few code improvements.
2. Add support for protocol used to communicate with Thermal Management
Unit (TMU). This will allow to implement the thermal driver working
for newer Samsung Exynos and Google GS101 SoCs.
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmocIP8QHGtyemtAa2Vy
bmVsLm9yZwAKCRDBN2bmhouD166OD/wL+DhPwi35zocDIoPQETVZ3zaqPwE+kIhC
+ssLefI5f70tYLVy1OM9fobri2PbMnQBpY8CIZNpZRsjwfWOsrl6SpBH9SQoZnb2
UNrZGxvEcGvjw208GzjM6ZJ3LkSm0o+EvjnHYK2S5ddH6iBISe2OoW21AkhGr9ko
XhCgQGrfchQDWVkLTcT+RMN4n8e8LCKz71ebTH5YwdPt3PDL/lTHpn1/3xkfJgCR
Rzp63VAmZCz6rA0WR7g8yJ+5BVAekjoBkN7/aeeaVOKpo3xRdduedpmEokIAHqBx
eP1J9MhB71+kY30+REganonp7xo42bRct+udfw5nsoWW2aNS0lGwQNxTpnsFSgLX
rh8NeXKWnWvdB61NT5r68A9ycKAvFieWGBE/KC3fqC0uEru1LxyrA1iTG88Ko1OQ
18JrqaUV+zxz17JTzDfuTuwnQp6jw6sXcrH3dv8aM3TPnWwxpa7TRwRVB4d6MIi0
ObSmP2Grswk9CmPZBby7QNFlxRPnAstGIDINEyC23Cjv+a1K3CMDMPpjL35+IAev
DhmUW4py5p97WxwBBdsH4WcxhIa+yU5Wtw+ItZM08FtCFkPajSRmLbWA2hdfTrVx
ETvBmJxDgsxZbaAUdq0tZnjpy5b2OLFFsO53G//s0e/lP8bE6fft53OyIOm0eMHw
x+S+tIStqQ==
=dgCg
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmooKHAACgkQmmx57+YA
GNljhw/9EKi+zq6o4scloxm4FmfGyLlhqSMEQsJPbLXcLP6eebXvDd580zrhjuRW
fI5W4c2ICJYidV9LhUUBLFW7Z8fcqUQv5av2GglQQVl8QWz2HBLdXGUAacJg3mB8
wcm8IIGqgArIampzKc/RFjiXJyU/l4aIwzCMz3r4RHWCxBTDQyr/fr/JqEaGz+lP
WHnmCV1uhIRYQ0rvF0Sd52K/ScMAaIk/NC6/a9i1U1YhgbSVXySWYGUZpL1lWsGr
j4CDbjMvoE+Z4Hm7qT9WXEJt+E3JLZKlL0YJi0/OsQzRmfbszbFStRc6gcdPIWeK
LDYLbDYf0D+GxQNLcQ3mhlO35EtEX/3N4IVHZJ99h+Qx1ing9hGBd/28VtrLAU+y
IiQitk7EnoSGPzaZ6CoPgNQTNCs51GWAdP55pT3CAEuZdSnAFWq5DCVJcrv60+rc
aclekR6JkSq6GsdY4CaIa+La6iLjgdWZMe6oAVREwFGKWq2zEv6HjeJvvuQ0xx8V
mTNR57hOpcYfjjwyt9l69o4CtUYntQuqU75nTh0xjZruWu7ckvRN8Ylml6Gm8CWM
M0V8cB06936Krc/kKM93RJPbnpj1jCsw9p9qYuAvXzyES2cO5lplt2tBVrs+liWq
AcmjIiOvb2opyjB81ngD0asbPO3uzeACO75coIW4JelZgPw7WCE=
=3Tlw
-----END PGP SIGNATURE-----
Merge tag 'samsung-drivers-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/drivers
Samsung SoC drivers for v7.2
Improve Samsung Exynos (and Google GS101) ACPM (Alive Clock and Power
Manager) firmware driver:
1. Few code improvements.
2. Add support for protocol used to communicate with Thermal Management
Unit (TMU). This will allow to implement the thermal driver working
for newer Samsung Exynos and Google GS101 SoCs.
* tag 'samsung-drivers-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux:
firmware: samsung: acpm: remove compile-testing stubs
firmware: samsung: acpm: Add devm_acpm_get_by_phandle helper
firmware: samsung: acpm: Add TMU protocol support
firmware: samsung: acpm: Make acpm_ops const and access via pointer
firmware: samsung: acpm: Drop redundant _ops suffix in acpm_ops members
firmware: samsung: acpm: Annotate rx_data->cmd with __counted_by_ptr
firmware: samsung: acpm: Consolidate transfer initialization helper
firmware: samsung: acpm: Fix infinite loop on sequence number exhaustion
firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator
firmware: samsung: acpm: Fix false timeouts and Use-After-Free in polling
firmware: samsung: acpm: Fix mailbox channel leak on probe error
firmware: samsung: acpm: Fix cross-thread RX length corruption
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
The MediaTek MT7925 WiFi device advertises FLR capability, but it does not
work correctly. This manifests in VFIO passthrough scenarios. Normal VM
operation works fine, including clean shutdown/reboot. However, when the VM
terminates uncleanly (crash, force-off), VFIO attempts to reset the device
before it can be assigned to another VM. Because FLR is broken, the reset
fails, preventing reuse.
This is similar to its predecessor MT7922 (see 81f64e925c ("PCI: Avoid
FLR for Mediatek MT7922 WiFi")), but with different symptoms. The MT7922
issue manifests as config read failures (returning ~0) after FLR. The
MT7925 shows different behavior: config reads work correctly after FLR, but
firmware communication fails.
First VM start with MT7925 works fine:
mt7925e 0000:08:00.0: ASIC revision: 79250000
mt7925e 0000:08:00.0: WM Firmware Version: ____000000, Build Time: 20260106153120
After force reset or VM crash, when VFIO attempts FLR to reset the device
for reassignment, firmware initialization fails:
mt7925e 0000:08:00.0: ASIC revision: 79250000
mt7925e 0000:08:00.0: Message 00000010 (seq 1) timeout
mt7925e 0000:08:00.0: Failed to get patch semaphore
[Repeats with increasing sequence numbers 2-10]
mt7925e 0000:08:00.0: hardware init failed
The driver cannot acquire the patch semaphore needed for firmware
initialization, indicating that FLR does not properly reset the firmware
state. The device remains in this broken state until physical power cycle.
Disable FLR for MT7925 so the PCI core falls back to other reset methods,
e.g., Secondary Bus Reset, which successfully resets the device and allows
reinitialization for VFIO passthrough reuse.
Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20260522070646.203115-1-jtornosm@redhat.com
The length of the string is calculated in order to allocate the correct
sized memory block, use the same length to copy the string.
Signed-off-by: David Laight <david.laight.linux@gmail.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260606202633.5018-4-david.laight.linux@gmail.com>
This set of changes contains another attempt at resolving a Kconfig
dependency, propagates debugfs error codes and adds support for multiple
sockets to the BPMP driver.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEiOrDCAFJzPfAjcif3SOs138+s6EFAmobyUoACgkQ3SOs138+
s6Egiw//clNlyi84Hl58QEz5dTPy3kCRLPhN3tHovNJKYwAOBb4OLd3QZFBok+dw
iNA05AKFKtjWDOdkuWBE5i7okjNRNzkwrb7uKOye80aRBtPZ3kV3kfm86+Mm4PX8
moFrjqbRVEoBmdPMbJRXo4onXo3fXVMeQlnvkSRGjyiniePv153hKAmkqGUAJ0Bw
DEpd8TxDzJGyblcr8hP7LLZlSAsjvwHCqC3zbrvb15rwUZAffklou7y21J50ydoZ
BGYSblyEPSJlFM9UrJHZDovpPFN7eYf8tu7oohk1DNaXL4rv3XKHOKtOpRk90THC
0NUEpEy16f8bdCuEl3XG2JM17igVNZ0C+vq7phtW7vpLUsqWZcYN7H5hC7xWx7+C
BFVZuy6jFvJJ9u0SKYdRAp50uanu4GBWNdN71F14mpkx86KdCQ73yeQWE3vngC3P
qQUphdJUauhRG5/LJ9SxF11fSyBL1xMuX5fLAIAEGH8szGvsB6W+hgPJKnFX0vXw
G78hHN0/49edHCBe13D5OSQXsK9bVGEGN4xmj/EZim3I3MQC84yYAXPzVK97P3YK
vMsEyuqK3WnKTEmgHNCVL4glxHAlitRHPuZjQrHbVJIdbt3DihP9FXVm9XjlWQ+2
sInRybSGvs2AEiXaPOM0ZaXGK5pDwSlMnVLaYgF4nw7FXsLyxh0=
=gbxD
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmooIbwACgkQmmx57+YA
GNkPjQ//aUEpJWqH6kHDg1SnJnGKL4h2LXvbJuiod8aJoaK6vqF/TERsrWhnrNlM
fZ0Fk5Vo2w5XVzLxFy/fMLiDJBYplygVMc/SlJrM/aGuyiqaQOH8Hc/byYWWS19f
anmutIQgEPZj2ll1L4Dtjx+wCqfltX+DgdyNMdlOL/l4A79IMNQSwYhOr2nimXVy
nvNmGNup2tE5eNV1LRYiciayoovI5boULiH5aAIaWM2yzzRmFcDtrYzOwHh2LB0I
coYSrZF9SNgzrEeoU2xeQbId4nRxj/DPOtaaIygIyWiNqhGEx0IQiRoGVeMx+2h5
z8cUwR3Y/pAYcTL03o3fEnDqV+H+48LMUn7stdxhVz709uy+MtYDQls7v9dcFngM
sXvEFaFE2AoJABVnAa3KO5zFBqTPYePtpzymypMxkWuAiyKWgr/ptY5ITyW5sSNA
MUW9p7v0pssXPUIlMaMyrOBntl3ZcHjR9QfpCgqqlfk5efpAuQOjWfNSmvFLxKPb
+miK76yxdsWc1+Zxuto7+P1ZuvAs9w6YWoIsRou4yW/Jl/QOwhwRUQJEwjrXDEI6
I7ilc61hCPVObzXoNOLkTCYp7DPDdQL9xA2NIOHSRYCJ2dkxPz+tVcFjYQPxyJfo
38Ezps1Q1A9rkgLbdWTuKl2glBW6R3IdJrubccky191ixjM9RcU=
=VmwN
-----END PGP SIGNATURE-----
Merge tag 'tegra-for-7.2-firmware' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers
firmware: tegra: Changes for v7.2-rc1
This set of changes contains another attempt at resolving a Kconfig
dependency, propagates debugfs error codes and adds support for multiple
sockets to the BPMP driver.
* tag 'tegra-for-7.2-firmware' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux:
firmware: tegra: bpmp: Add support for multi-socket platforms
firmware: tegra: bpmp: Propagate debugfs errors
firmware: tegra: Make TEGRA_IVC a hidden Kconfig symbol
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
The bulk of these changes converts existing users to the modern variants
of the API that take a PMC instance as argument. This completes the
transition to multi-instance support, which then makes room for cleanups
and restricting the remaining legacy APIs to 32-bit platforms.
Some changes in this set also clean up powergate debugfs and restrict
the power-off handler to be installed only where appropriate. Lastly,
support for Tegra238 is added.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEiOrDCAFJzPfAjcif3SOs138+s6EFAmobyPwACgkQ3SOs138+
s6HTyQ//RrgcARyTFkSRM4Eb8uxRTJ++9z0B6ICNZ+9tcQ20lPZ2aBYGRCpFyMLR
GHM7VCqdJwygAps6Fngig1/uhzy1yFt6N0bVXojqJGWvVjhAZU89kA3YuWqjYv8i
fabp4AW+RCc+/QJbdaZA44j/8nytdMjSO4npgAgY5JtNKKm2BHmb26wlzUFBx1K8
3oyt2BiLNh21vdFBlEdIcq+WytHye5a6JpqoxKwVtHm5ZEcVqRgVxmo52hZZczV5
1YQT1ubxOIeLDguEJHrqGLSHiJdDJMe78aAZ+E7rBBxySXC8fEqfBDlkhFptQXei
bJ3Zkxla/M7Ni5xvWJCzL3IkE7v8v8n3UCOW/pjNsllY6S7ls+wxfaeNLYrVU4nU
hGqjb4tQdzCLQSRsXhg8NqLZPdLw00HQ1bRp4e7Nl4VUrTv9bizJdR5u/rfP0TMQ
Qr/qXS+SuZwIxt0Qa5PVvWORdpFVVImdy/zEpQtt8o9Iwfhml56Is7pA4NqT0kz1
rSWkeAyTzBsvZRNTI86mLHrdxkPvIDNFFYS8vZwxFZZY4N9rX21+MOIigmCIcWHI
kZy/rOSs+/ZtmxFy6lTmt5sYdBjqqF/0PZsHpgw3T4/eVX5njdKFCE44/vVN87Zh
zVTzGzabMkek0qr+41wKj4B7SeJ0DzBJ298NCu6UxKCEh6o1rko=
=aXSv
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmooIVUACgkQmmx57+YA
GNnswQ//bVbhViSLGQUCRXWiJ6wrTxcTVzrvoZe9c6RbTKveJZdzjhkXj989Vtj4
e9DL2iLTBJ4cTyJpL0syerkZB9yYkUxEZUMXptQOb2An34BAVlKyR8CYuClwaY4F
QOK/6vNz2zL081ZSMxZDC9q7dTcHr69vDLa7JZmg1hejZxBleom74jXV2qtxsXRu
7IlIjk/TglpBKIyDc7aB95Oygpy9Om2QqHO40oA5iFu2f52UXbOJdwaiM4ujgAzJ
PD99mMuD1U/hPO/EnofotcpoRUWFGTasQvc9LzcEXuDB/Xi9bhMnyplpLDyB7bf0
6I58KTAoeiK+sRkEtnwwCTO+tMCwgJvS876g8A6AKB0vO/WYSZYzRKL356IHoyVz
XKtooc0Bqrb9v1VRR5FYfsViMcHckV0w2EZJR2qIG63ZgApM+G0/a3RAlxqiUoWF
9Ek53jDbxAP6U3TzFF0Uq+8IqKRgKloaChlmhqhw1nqsjrEfYEYFTKGqtGgtO1gx
IiQtJl2REGhkaaRcJTUc53KHW83MLtgYgQjjh3Dnk7WggJmmBBx4KU3NTOjD9qmL
ewNogtpbWrc8bh/gh+t9qRr1dDVi+xOn59LFElPgH8D3RMZewBVQuM1RzQbt/1wb
ZNJ2lx8rHd0R7+KUHfm8MObk3liWrguzKbJxxJAy89oteyrHxgg=
=IgxF
-----END PGP SIGNATURE-----
Merge tag 'tegra-for-7.2-pmc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers
soc/tegra: pmc: Changes for v7.2-rc1
The bulk of these changes converts existing users to the modern variants
of the API that take a PMC instance as argument. This completes the
transition to multi-instance support, which then makes room for cleanups
and restricting the remaining legacy APIs to 32-bit platforms.
Some changes in this set also clean up powergate debugfs and restrict
the power-off handler to be installed only where appropriate. Lastly,
support for Tegra238 is added.
* tag 'tegra-for-7.2-pmc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux:
soc/tegra: pmc: Add Tegra238 support
soc/tegra: pmc: Restrict power-off handler to Nexus 7
soc/tegra: pmc: Populate powergate debugfs only when needed
soc/tegra: pmc: Move legacy code behind CONFIG_ARM guard
soc/tegra: pmc: Remove unused legacy functions
soc/tegra: pmc: Create PMC context dynamically
usb: xhci: tegra: Explicitly specify PMC instance to use
PCI: tegra: Explicitly specify PMC instance to use
media: vde: Explicitly specify PMC instance to use
drm/tegra: Explicitly specify PMC instance to use
drm/nouveau: tegra: Explicitly specify PMC instance to use
ata: ahci_tegra: Explicitly specify PMC instance to use
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
fuse_ref_folio() unlocks the request but does not re-lock it before
returning. fuse_chan_abort() can end the request and the async end
callback (eg fuse_writepage_free()) can free the args while the
subsequent copy chain logic after fuse_ref_folio() accesses them,
leading to use-after-free issues.
Fix this by locking the request in fuse_ref_folio() before returning.
Fixes: c3021629a0 ("fuse: support splice() reading from fuse device")
Cc: stable@vger.kernel.org
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
fuse_try_move_folio() unlocks the request on entry but does not
re-lock it on the success path. This means fuse_chan_abort() can end the
request and free the fuse_io_args (eg fuse_readpages_end()) while the
subsequent copy chain logic after fuse_try_move_folio() accesses the
fuse_io_args, leading to use-after-free issues.
Fix this by calling lock_request() before replace_page_cache_folio().
This ensures the request is locked on the success path which will
prevent the fuse_io_args from being freed while the later copying logic
runs, and also ensures that the ap->folios[i]->mapping is never null
since ap->folios[i] will always point to the newfolio after
replace_page_cache_folio().
Fixes: ce534fb052 ("fuse: allow splice to move pages")
Cc: stable@vger.kernel.org
Reported-by: Lei Lu <llfamsec@gmail.com>
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Replacing strcpy() with strscpy() ensures that overflow of the target
buffer cannot happen.
Signed-off-by: David Laight <david.laight.linux@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Antony Antony says:
====================
The current XFRM_MSG_MIGRATE interface is tightly coupled to policy and
SA migration, and it lacks the information required to reliably migrate
individual SAs. This makes it unsuitable for IKEv2 deployments,
dual-stack setups (IPv4/IPv6), and scenarios where policies are managed
externally (e.g., by daemons other than the IKE daemon).
Mandatory SA selector list
The current API requires a non-empty SA selector list, which does not
reflect the IKEv2 use case.
A single Child SA may correspond to multiple policies,
and SA discovery already occurs via address and reqid matching. With
dual-stack Child SAs this leads to excessive churn: the current method
would have to be called up to six times (in/out/fwd × v4/v6) on SA,
while the new method only requires two calls.
Selectors lack SPI (and marks)
XFRM_MSG_MIGRATE cannot uniquely identify an SA when multiple SAs share
the same policies (per-CPU SAs, SELinux label-based SAs, etc.). Without
the SPI, the kernel may update the wrong SA instance.
Reqid cannot be changed
Some implementations allocate reqids based on traffic selectors. In
host-to-host or selector-changing scenarios, the reqid must change,
which the current API cannot express.
Because strongSwan and other implementations manage policies
independently of the kernel, an interface that updates only a specific
SA - with complete and unambiguous identification - is required.
SA Selector, x->sel, can't be changed, especially Transport mode.
XFRM_MSG_MIGRATE_STATE provides that interface. It supports migration
of a single SA via xfrm_usersa_id (including SPI) and we fix
encap removal in this patch set, reqid updates, address changes,
and other SA-specific parameters. It avoids the structural limitations
of XFRM_MSG_MIGRATE and provides a simpler, extensible mechanism for
precise per-SA migration without involving policies.
This method also allows migtrating SA selectors typically used with
host-to-host in Transport mode.
New migration steps: first install block policy, remove the old policy,
call XFRM_MSG_MIGRATE_STATE for each state, then re-install the
policies and remove the block policy.
If the target SA tuple (daddr, SPI, proto, family) is already
occupied, the operation returns -EEXIST. In this case the original
SA is not preserved. Userspace must handle -EEXIST by
re-establishing the SA at the IKE level and manage policies.
====================
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
The code that gets the frame buffer mode from OF has 'use after free',
'buffer overrun' and memory leaks.
info->edid_data isn't free if the probe functions fail or if
pd->def_mode is set.
If both the CRT and PANEL are enabled info->edid_data is used after
being freed and is freed twice.
The string returned by of_get_property(np, "mode", &len) is just
written over either the static "640x480-16@60" or the module parameter
string without any regard for the length (which is most likely longer).
Use kstrump() for the OF mode and free everything before freeing 'info.
Fixes: 4295f9bf74 ("video, sm501: add OF binding to support SM501")
Signed-off-by: David Laight <david.laight.linux@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
A comment in drivers/video/fbdev/core/fbcon.c incorrectly refers to
CONFIG_MISC_TILEBLITTING instead of CONFIG_FB_TILEBLITTING. Correct it.
Discovered while searching for CONFIG_* symbols referenced in code but
not defined in any Kconfig file.
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
The text display code used in the Risc PC kernel image decompression
code uses arch/arm/boot/compressed/font.c, which includes
lib/fonts/font_acorn_8x8.c, which further includes <linux/font.h>.
Since commit 97df896024 ("lib/fonts: Provide helpers for calculating
glyph pitch and size") <linux/font.h> contains inline functions that
require __do_div64, which is not linked into the ARM kernel
decompressor. This makes Risc PC zImages fail to build.
Resolve this issue by defining the BOOTLOADER symbol and use it to avoid
a static declaration of the acorndata_8x8 symbol. That way it can be
referenced by the arm bootloader, and other static math functions and
symbols (like __do_div64) stay static and don't get unneccesary included
in the ARM kernel bootloader decompressor object file.
Fixes: 97df896024 ("lib/fonts: Provide helpers for calculating glyph pitch and size")
Reported-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Cc: linux-arm-kernel@lists.infradead.org
Cc: Russell King <linux@armlinux.org.uk>
Signed-off-by: Helge Deller <deller@gmx.de>
Use the result of strscpy() for the overflow check.
Signed-off-by: David Laight <david.laight.linux@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
There are no callers of fbcon outside fbdev. Move the declarations
into the internal header.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Handle console remapping in fbcon in fb_switch_output(). Vga-switcheroo
invokes this functionality before switching physical outputs to a new
graphics device. Open-coding fbcon state in vga-switcheroo exposed fbdev
implementation details.
Vga-switcheroo is used for switching physical outputs among graphics
hardware. This functionality is only supported by DRM drivers. A later
update will further move fb_switch_output() into DRM's fbdev emulation;
thus fully decoupling vga-switcheroo from fbdev.
v3:
- remove Kconfig dependency related to fbcon (Geert)
v2:
- use '#if defined' (Helge)
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Handle fbcon during blanking in fb_blank_from_user(). First blank the
hardware, then blank fbcon. Same for unblanking. Update all callers and
resolve the duplicated logic.
With the new helper, fbdev's sysfb code no longer maintains fbcon state
by itself.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Handle fbcon during display updates in fb_set_var_from_user(). Check
with fbcon if the mode change is possible, update hardware state and
finally update fbcon. Update all callers.
Only the FBIOPUT_VSCREENINFO ioctl currently does all steps. Other
mode-changes callers in sysfs and driver code are missing fbcon-related
steps.
With the new helper, ps3fb and sh_mobile_lcdcfb no longer maintain
fbcon state themselves.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
omapfb_mmap() has a race condition with OMAPFB_SETUP_PLANE ioctl that
can lead to use-after-free:
The fb_mmap() entry point holds mm_lock but not lock (fb_info->lock),
while ioctl handlers like OMAPFB_SETUP_PLANE hold lock but not mm_lock.
This allows concurrent execution.
In omapfb_mmap():
1. rg = omapfb_get_mem_region(ofbi->region); // Get old region ref
2. start = omapfb_get_region_paddr(ofbi); // Read from NEW region
3. len = fix->smem_len; // Read from NEW region
4. vm_iomap_memory(vma, start, len); // Map NEW region memory
5. atomic_inc(&rg->map_count); // Increment OLD region!
Concurrently, OMAPFB_SETUP_PLANE can:
- Reassign ofbi->region = new_rg
- Update fix->smem_len
- OMAPFB_SETUP_MEM then checks NEW region's map_count (0!) and frees it
This leaves userspace with a mapping to freed physical memory.
The fix is to read all required values (start, len) from the same
region reference (rg) that will have its map_count incremented,
preventing the region from being freed while still mapped.
Cc: stable@vger.kernel.org
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
The modedb.c file was moved from drivers/video/ to
drivers/video/fbdev/core/. Update the reference.
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Costa Shulyupin <costa.shul@redhat.com>
Signed-off-by: Helge Deller <deller@gmx.de>
pxa168fb maps the LCD controller register resource with devm_ioremap(),
which does not request the memory region. Use devm_ioremap_resource()
instead so the MMIO range is claimed before being mapped.
This also handles cleanup automatically.
Signed-off-by: AlbertoArostegui <aarosteguig@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
The comment does not match the actual address offset. According
to the GRLIB IP Library Reference Manual (p. 2119), the CLUT register
is at offset 0x28, not the value stated in the comment.
Signed-off-by: Eduardo Silva <eduardo4silva@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Replace all printk() calls with appropriate device-aware logging
functions to properly associate log messages with the PCI device.
- Use pci_err() for errors where struct pci_dev is available
- Use pci_info() for info messages where struct pci_dev is available
Remove redundant 's3d:' prefix and pci_name() calls as device-aware
functions include device identification automatically.
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Rahman Mahmutović <mahmutovicrahman5@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Don't need to do suspend/resume for fbcon in graphic mode.
Doing this may cause error, eg:
At the beginning, starting the Xorg with single screen and then an
external screen was plugged in. After logging out in Xorg, fbdev
info may using screen which is connected later on for info always
using first connected connector in list in func 'drm_setup_crtcs_fb'.
Then, S3 executed, fbcon found that the information did not match
and do atomic to switch fb. However, Xorg will not re-bind the crtc
fb but continues doing ioctl. At this time, the fb is incorrect.
With some modifications by Helge Deller.
Signed-off-by: Lu Yao <yaolu@kylinos.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
The chipsfb driver is missing the MODULE_DESCRIPTION macro which
is required for all kernel modules.
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Rahman Mahmutović <mahmutovicrahman5@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
The big_swap(p) macro was intended to swap bytes within 16-bit halves
of a 32-bit value. However, because the bitwise shift operators (<<, >>)
have higher precedence than the bitwise AND operator (&), the original
code failed to perform any shifting on the masked bits.
For example, 'p & 0xff00ff00 >> 8' was evaluated as 'p &
(0xff00ff00 >> 8)', effectively neutralizing the intended swap.
Fix this by adding parentheses to ensure the bitwise AND is performed
before the shift, correctly implementing the byte swap logic.
Fixes: 1461d66728 ("staging: sm7xxfb: merge sm712fb with fbdev")
Cc: stable@vger.kernel.org
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Signed-off-by: Helge Deller <deller@gmx.de>
In esp_output_tail(), when esp->inplace is false, the old skb page frags
are replaced with a new page from the xfrm page_frag cache The source
scatterlist (sg) is built from the old frags before the replacement, and
esp_ssg_unref() is responsible for releasing the old page references
after the crypto operation completes
However, if the second skb_to_sgvec() call (which builds the destination
scatterlist from the new page) fails, the code jumps to error_free which
only calls kfree(tmp). The old page frag references captured in the
source scatterlist are never released:
1 sg[] is built from old frags via skb_to_sgvec() (no extra get_page)
2 nr_frags is set to 1 and frag[0] is replaced with the new page
3 Second skb_to_sgvec() fails -> goto error_free
Fix this by adding a bool parameter to esp_ssg_unref() that, when true,
unconditionally unrefs the source scatterlist frags. Since req->src is
not yet initialized by aead_request_set_crypt() at the point of the
error, the source scatterlist is obtained directly via esp_req_sg()
Existing callers pass false to preserve the original behavior
The same issue exists in both esp4 and esp6 as the code is identical
Fixes: cac2661c53 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30f6a ("esp6: Avoid skb_cow_data whenever possible")
Signed-off-by: Alessandro Schino <7991aleschino@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
The Cadence HPA driver uses hardcoded constants (0x0, 0x2, 0x4, 0x5,
0x10) to program the outbound region type. Replace them with the newly
introduced common TLP type macros from pci.h for better readability
and maintainability.
Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20260516153657.65214-4-18255117159@163.com
The dwc driver defines its own ATU type macros (PCIE_ATU_TYPE_MEM,
PCIE_ATU_TYPE_IO, PCIE_ATU_TYPE_CFG0, PCIE_ATU_TYPE_CFG1,
PCIE_ATU_TYPE_MSG) with the same numerical values as the newly
introduced common TLP type macros.
Remove the local definitions and switch all DWC users to the common
PCIE_TLP_TYPE_* macros. This eliminates redundancy and improves
consistency across PCI controller drivers.
No functional change intended.
Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20260516153657.65214-3-18255117159@163.com
Introduce a set of unified TLP type macros in pci.h according to PCIe
spec r7.0, sec 2.2.1:
- PCIE_TLP_TYPE_MEM_RDWR (0x00) for Memory Read/Write
- PCIE_TLP_TYPE_IO_RDWR (0x02) for I/O Read/Write
- PCIE_TLP_TYPE_CFG0_RDWR (0x04) for Type 0 Config Read/Write
- PCIE_TLP_TYPE_CFG1_RDWR (0x05) for Type 1 Config Read/Write
- PCIE_TLP_TYPE_MSG (0x10) for Message Request (routing to RC)
These replace the old per-driver hardcoded values or local macros, and
also replace the previous PCIE_TLP_TYPE_CFG0_RD/WR and
PCIE_TLP_TYPE_CFG1_RD/WR definitions which had identical numeric values.
The read/write distinction is already handled by the TLP Format field
(Fmt), so a single type macro suffices.
Convert the aspeed and mediatek drivers to use the new macros, and remove
the obsolete definitions from pci.h.
No functional change intended.
Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20260516153657.65214-2-18255117159@163.com
When firmware reports NSS ratio support, SUPPORTS_VHT_EXT_NSS_BW is enabled in
ath12k. However, IEEE80211_VHT_EXT_NSS_BW_CAPABLE must also be set to make the
advertisement valid.
According to IEEE Std 802.11-2024, Subclause 9.4.2.156.3 (Supported VHT-MCS and
NSS Set subfields), the VHT Extended NSS BW Capable bit indicates whether a STA
is capable of interpreting the Extended NSS BW Support subfield of the VHT
capabilities information field. Advertising extended NSS BW support without
setting this capability bit is therefore invalid.
Without this change, mac80211 detects the inconsistency and logs:
ieee80211 phy0: copying sband (band 1) due to VHT EXT NSS BW flag
This indicates that mac80211 implicitly aligns IEEE80211_VHT_EXT_NSS_BW_CAPABLE
during ieee80211_register_hw(). Explicitly setting the bit in ath12k avoids this
fixup and ensures capabilities are advertised correctly by the driver.
This change follows the same approach as the existing ath11k fix.
https://lore.kernel.org/all/20211013073704.15888-1-wgong@codeaurora.org/
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1
Fixes: 18ab9d038f ("wifi: ath12k: add support for 160 MHz bandwidth")
Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
Signed-off-by: Maharaja Kennadyrajan <maharaja.kennadyrajan@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20260604095831.2674298-1-maharaja.kennadyrajan@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
