Commit graph

1,462,193 commits

Author SHA1 Message Date
David Laight
25afa211ae gpiolib: Replace strcpy() with memcpy()
The length of the string is calculated in order to allocate the correct
sized memory block, use the same length to copy the string.

Signed-off-by: David Laight <david.laight.linux@gmail.com>
Link: https://patch.msgid.link/20260606202633.5018-3-david.laight.linux@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-08 10:15:11 +02:00
Manivannan Sadhasivam
9085f71285 power: sequencing: Add an API to return the pwrseq device's 'dev' pointer
The consumer drivers can make use of the pwrseq device's 'dev' pointer to
query the pwrseq provider's DT node to check for existence of specific
properties.

Hence, add an API to return the pwrseq device's 'dev' pointer to consumers.

Note that since pwrseq_get() would've increased the pwrseq refcount, there
is no need to increase the refcount in this API again.

Tested-by: Wei Deng <wei.deng@oss.qualcomm.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Link: https://patch.msgid.link/20260519-pwrseq-m2-bt-v3-6-b39dc2ae3966@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-08 10:03:43 +02:00
Juergen Gross
cdd2c4133a x86/msr: Remove wrmsr_safe_on_cpu()
wrmsr_safe_on_cpu() has no users left. Delete it.

Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Link: https://patch.msgid.link/20260608051741.3207435-12-jgross@suse.com
2026-06-08 10:01:49 +02:00
Juergen Gross
840b401434 x86/msr: Switch wrmsr_safe_on_cpu() users to wrmsrq_safe_on_cpu()
In order to prepare retiring wrmsr_safe_on_cpu() switch
wrmsr_safe_on_cpu() users to wrmsrq_safe_on_cpu().

Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Rafael J. Wysocki <rafael@kernel.org>
Cc: Daniel Lezcano <daniel.lezcano@kernel.org>
Link: https://patch.msgid.link/20260608051741.3207435-11-jgross@suse.com
2026-06-08 10:01:49 +02:00
Juergen Gross
d2eb65a9aa x86/msr: Remove rdmsr_safe_on_cpu()
rdmsr_safe_on_cpu() has no users left. Delete it.

Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Link: https://patch.msgid.link/20260608051741.3207435-10-jgross@suse.com
2026-06-08 10:01:49 +02:00
Juergen Gross
91660aae2f x86/msr: Switch rdmsr_safe_on_cpu() users to rdmsrq_safe_on_cpu()
In order to prepare retiring rdmsr_safe_on_cpu() switch
rdmsr_safe_on_cpu() users to rdmsrq_safe_on_cpu().

Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Rafael J. Wysocki <rafael@kernel.org>
Cc: Daniel Lezcano <daniel.lezcano@kernel.org>
Link: https://patch.msgid.link/20260608051741.3207435-9-jgross@suse.com
2026-06-08 10:01:49 +02:00
Juergen Gross
dfaf45fba1 x86/msr: Don't use rdmsr_safe_on_cpu() in rdmsrq_safe_on_cpu()
In order to prepare removal of rdmsr_safe_on_cpu(), don't use it in
rdmsrq_safe_on_cpu(), but replace it with open coding it.

This will create a nearly verbatim copy of the same code, but this is
only temporary until rdmsr_safe_on_cpu() is removed.

Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Link: https://patch.msgid.link/20260608051741.3207435-8-jgross@suse.com
2026-06-08 10:01:49 +02:00
Juergen Gross
97a6561aca x86/msr: Remove wrmsr_on_cpu()
wrmsr_on_cpu() has no users left. Delete it.

Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Link: https://patch.msgid.link/20260608051741.3207435-7-jgross@suse.com
2026-06-08 10:01:49 +02:00
Juergen Gross
35971831aa x86/msr: Switch wrmsr_on_cpu() users to wrmsrq_on_cpu()
In order to prepare retiring wrmsr_on_cpu() switch wrmsr_on_cpu() users
to wrmsrq_on_cpu().

Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Viresh Kumar <viresh.kumar@linaro.org>
Cc: Rafael J. Wysocki <rafael@kernel.org>
Cc: Daniel Lezcano <daniel.lezcano@kernel.org>
Link: https://patch.msgid.link/20260608051741.3207435-6-jgross@suse.com
2026-06-08 10:01:49 +02:00
Juergen Gross
5ad93d5cd6 x86/msr: Remove rdmsr_on_cpu()
rdmsr_on_cpu() has no users left. Delete it.

Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Link: https://patch.msgid.link/20260608051741.3207435-5-jgross@suse.com
2026-06-08 10:01:49 +02:00
Juergen Gross
40b57cfbd2 x86/msr: Switch rdmsr_on_cpu() users to rdmsrq_on_cpu()
In order to prepare retiring rdmsr_on_cpu() switch rdmsr_on_cpu() users
to rdmsrq_on_cpu().

Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Rafael J. Wysocki <rafael@kernel.org>
Cc: Viresh Kumar <viresh.kumar@linaro.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Daniel Lezcano <daniel.lezcano@kernel.org>
Link: https://patch.msgid.link/20260608051741.3207435-4-jgross@suse.com
2026-06-08 10:01:49 +02:00
Juergen Gross
a83db17073 x86/msr: Remove rdmsrl_on_cpu()
rdmsrl_on_cpu() has no users left. Delete it.

Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Link: https://patch.msgid.link/20260608051741.3207435-3-jgross@suse.com
2026-06-08 10:01:49 +02:00
Juergen Gross
e2f659dd80 x86/msr: Switch rdmsrl_on_cpu() user to rdmsrq_on_cpu()
rdmsrl_on_cpu() is a deprecated synonym for rdmsrq_on_cpu().
Switch its only user to rdmsrq_on_cpu().

Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: K Prateek Nayak <kprateek.nayak@amd.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20260608051741.3207435-2-jgross@suse.com
2026-06-08 10:01:36 +02:00
Mingyu Wang
b08472db93
agp/amd64: Fix broken error propagation in agp_amd64_probe()
A NULL pointer dereference was observed in the AMD64 AGP driver when
running in a virtualized environment (e.g. qemu/kvm) without a physical
AMD northbridge. The crash occurs in amd64_fetch_size() when attempting
to dereference the pointer returned by node_to_amd_nb(0).

The root cause of this crash is broken error propagation in
agp_amd64_probe(): When no AMD northbridges are found, cache_nbs()
correctly returns -ENODEV. However, the probe function erroneously
checks the return value against exactly -1, rather than < 0.

As a result, the hardware absence error is masked, allowing the driver
to improperly proceed with initialization. It eventually calls
agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware
does not exist, node_to_amd_nb(0) returns NULL, leading to a General
Protection Fault (GPF) when accessing its ->misc member.

Fix the issue by correcting the error check in agp_amd64_probe() to
abort properly when cache_nbs() returns any negative error code. This
prevents the driver from erroneously proceeding without hardware, thereby
avoiding the subsequent NULL pointer dereference at its source.

Fixes: a32073bffc ("[PATCH] x86_64: Clean and enhance up K8 northbridge access code")
Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn>
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Cc: stable@vger.kernel.org # v2.6.18+
Link: https://patch.msgid.link/20260504074823.99377-1-w15303746062@163.com
2026-06-08 09:58:48 +02:00
Manivannan Sadhasivam
f2aeaa6d47 power: sequencing: pcie-m2: Create BT node based on the pci_device_id[] table
Currently, pwrseq_pcie_m2_create_bt_node() hardcodes the BT compatible for
creating the devicetree node. But to allow adding support for more devices
in the future, create the BT node based on the pci_device_id[] table. The
BT compatible is passed using 'driver_data'.

Co-developed-by: Wei Deng <wei.deng@oss.qualcomm.com>
Signed-off-by: Wei Deng <wei.deng@oss.qualcomm.com>
Tested-by: Wei Deng <wei.deng@oss.qualcomm.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Link: https://patch.msgid.link/20260519-pwrseq-m2-bt-v3-5-b39dc2ae3966@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-08 09:47:56 +02:00
Manivannan Sadhasivam
c4be520907 power: sequencing: pcie-m2: Create serdev for PCI devices present before probe
So far, the driver is registering a notifier to create serdev for the PCI
devices that are going to be attached after probe. But it doesn't handle
the devices present before probe. Due to this, serdev is not getting
created for those existing devices.

Hence, create serdev for PCI devices available before probe as well.

Note that the serdev for available devices are created before
registering the notifier. There is a small window where a device could
appear after pwrseq_pcie_m2_create_serdev(), before notifier registration.
But since M.2 cards are fixed to a slot, they are mostly added either
before booting the host or after using hotplug. So this window is mostly
theoretical.

Tested-by: Wei Deng <wei.deng@oss.qualcomm.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Link: https://patch.msgid.link/20260519-pwrseq-m2-bt-v3-4-b39dc2ae3966@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-08 09:47:56 +02:00
Manivannan Sadhasivam
8ababf8886 power: sequencing: pcie-m2: Improve PCI device ID check
Instead of hardcoding the PCI device check, use pci_match_id() to check for
the known IDs using the pwrseq_m2_pci_ids[] array.

This makes adding support for new devices easier.

Tested-by: Wei Deng <wei.deng@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Link: https://patch.msgid.link/20260519-pwrseq-m2-bt-v3-3-b39dc2ae3966@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-08 09:47:55 +02:00
Manivannan Sadhasivam
0822425512 power: sequencing: pcie-m2: Allow creating serdev for multiple PCI devices
Current code makes it possible to create serdev for only one PCI device.
But for scaling this driver, it is necessary to allow creating serdev for
multiple PCI devices.

Hence, add provision for it by creating 'struct pwrseq_pci_dev' for each
PCI device that requires serdev and add them to
'pwrseq_pcie_m2_ctx::pci_devices' list.

Tested-by: Wei Deng <wei.deng@oss.qualcomm.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Link: https://patch.msgid.link/20260519-pwrseq-m2-bt-v3-2-b39dc2ae3966@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-08 09:47:55 +02:00
Manivannan Sadhasivam
da35b212f8 power: sequencing: pcie-m2: Fix inconsistent function prefixes
All functions in this driver follow 'pwrseq_pcie_m2' prefix except a few.
Fix them to avoid inconsistency.

Tested-by: Wei Deng <wei.deng@oss.qualcomm.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Link: https://patch.msgid.link/20260519-pwrseq-m2-bt-v3-1-b39dc2ae3966@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-08 09:47:55 +02:00
Wolfram Sang
b3f240cca1 rust: i2c: fix I2cAdapter refcount double increment
A single bugfix for the Rust I2C abstractions, targeting 7.1.
 
 `I2cAdapter::get` calls `i2c_get_adapter()` which returns a pointer with
 an already-incremented refcount. The code then converts the raw pointer to
 an `ARef` via `.into()`, which calls `inc_ref()` again through the
 `From<&T> for ARef<T>` impl — resulting in a leaked device and module
 reference on every call.
 
 The fix uses `ARef::from_raw()` instead, which takes ownership of the
 existing refcount without incrementing it.
 
 Signed-off-by: Igor Korotin <igor.korotin@linux.dev>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEG0Kepq7dYk2deNuvoxQiWQ2T6tUFAmokUrYACgkQoxQiWQ2T
 6tXfcw//SeqQ76PJjSQf1DKf7uTEgR73RZIVEEAWEYaABPOVmwZpIAniqMz+Np2s
 CBNVpttdcbgjCsbxQny9zbgCbeOGbexP2sMEuugjxDYwXAHo5OFnY3q0ReJVQIGa
 I6HB38lQpK1+p20W+CzqH7TIT5Tj7VOCpuIRu86lMUVTFVAgJSW8VMGkKqjO7ler
 VshMUQe8SJaIxC6XAj1ChsELfHptJozZw7zUZhj2wCmfs+pl43onE079DqNfxQJ8
 YWgaF3oSBxh2/CFORJKpCy5S7J4P6JQ4j0U8G7Gvs01lhnXggPewA0oJTQlpfNPj
 UGKLnSo9pG0BdGcxFqiPKqfxrAq29LO776IcrRSQa7sEcSlwRh4L4h0LFY0TUvmY
 5nR5BoXLOYpmrNP7WFCUISvjVXJaX8F3MEnVC7R/PmnOUhXWLBXZyzqzgUrAPkgl
 R4Ofye3yWpdJRes4O7diR3vnvRdxLMpfehJi2WHUjB90StxrLkYGZRK5fGj6+90m
 Pmefu7Qic1mos5jy0/9UjfaIaUS1W23KxX8HcNoMLZF/tl8YJ1FtMpm6ZrRSxM/v
 1LiEXLZkQOfuNebjfyUZwzWIptYtq9h4N9X9ANykLPTiTncJmxQmzaPsoRE4ew0T
 AD7P/WpLFbLs2XI/J5JuAVrfnOe+UjnvsixBxuPxEtgVY5K2pjA=
 =LhTi
 -----END PGP SIGNATURE-----

Merge tag 'rust-i2c-7.1-rc7' of https://github.com/ikrtn/linux into i2c/for-current

rust: i2c: fix I2cAdapter refcount double increment
2026-06-08 09:47:50 +02:00
Juergen Gross
1d5d1b8a4c x86/xen: Replace generic lazy tracking with cpu specific one
Now that lazy mmu state tracking no longer relies on the Xen specific
one, cpu lazy mode is the only user of the Xen generic lazy tracking.

Replace the Xen generic lazy tracking with a cpu lazy specific one.

Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260526150514.129330-6-jgross@suse.com>
2026-06-08 09:21:06 +02:00
Juergen Gross
bec6f41a6f x86/xen: Get rid of last XEN_LAZY_MMU uses
There are only very few use cases of XEN_LAZY_MMU left. Get rid of
them in order to avoid having to call enter_lazy(XEN_LAZY_MMU) and
leave_lazy(XEN_LAZY_MMU).

The query in xen_batched_set_pte() can be replaced by using
is_lazy_mmu_mode_active() instead.

As xen_flush_lazy_mmu() will be called only with lazy MMU mode being
active, the test for the lazy mode can just be dropped.

In xen_start_context_switch() and xen_end_context_switch() use
__task_lazy_mmu_mode_pause() and __task_lazy_mmu_mode_resume(),
allowing to drop xen_enter_lazy_mmu() and xen_leave_lazy_mmu()
completely.

Call arch_flush_lazy_mmu_mode() from arch_leave_lazy_mmu_mode(), as
this is the only required action now.

Drop the lazy mmu enter and leave paravirt hooks, leaving the flush
hook as the only needed one.

Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260526150514.129330-5-jgross@suse.com>
2026-06-08 09:21:06 +02:00
Juergen Gross
811f0d8caa mm: Refactor lazy_mmu_mode_pause() and lazy_mmu_mode_resume()
In order to allow pausing and resuming MMU lazy mode for other tasks
than current, refactor lazy_mmu_mode_pause() and
lazy_mmu_mode_resume().

This will be needed when dropping the Xen PV private lazy MMU
bookkeeping.

Acked-by: "David Hildenbrand (Arm)" <david@kernel.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260526150514.129330-4-jgross@suse.com>
2026-06-08 09:21:06 +02:00
Juergen Gross
f5df1e0b4b x86/xen: Change interface of xen_mc_issue()
Today xen_mc_issue() is deciding whether to call xen_mc_flush() or not
based on the lazy mode input parameter passed.

Modify this interface to pass a boolean indicating whether the flush
should be done.

For querying lazy mmu mode use the is_lazy_mmu_mode_active() helper.

This is done in preparation for dropping the xen_lazy_mode percpu
variable.

Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260526150514.129330-3-jgross@suse.com>
2026-06-08 09:21:06 +02:00
Juergen Gross
3b8d9415b8 x86/xen: Drop lazy mode from trace entries
Drop the lazy mode (cpu or mmu) from the xen_mc_batch and xen_mc_issue
trace entries.

This is done in preparation of removing the xen_lazy_mode percpu
variable.

Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260526150514.129330-2-jgross@suse.com>
2026-06-08 09:21:06 +02:00
Juergen Gross
8a06aedc09 x86/xen: Remove Xen debugfs support
The only Xen file in debugfs is for dumping the p2m table when running
as a Xen PV guest. This might have been useful when the PV code was
young, but there haven't been any p2m related bugs requiring the p2m
dump since ages.

Remove the code and the related config option.

Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260522152114.77319-4-jgross@suse.com>
2026-06-08 09:20:12 +02:00
Juergen Gross
c9305cdd5f x86/xen: Cleanup Xen related trace points
Since dropping Xen-PV support for 32-bit, include/trace/events/xen.h
contains several stale trace point definitions. Remove them.

Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260522152114.77319-3-jgross@suse.com>
2026-06-08 09:20:12 +02:00
Juergen Gross
41e5f312ae x86/xen: Guard PV-only stuff in xen-ops.h with CONFIG_XEN_PV
A lot of arch/x86/xen/xen-ops.h is meant to be for PV only. Guard all
of it with CONFIG_XEN_PV in order to avoid someone misusing it in
non-PV builds. Additionally any 64-bit tests for now guarded items can
be dropped.

Move the enum pt_level definition to mmu_pv.c, as it is used only there.

Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260522152114.77319-2-jgross@suse.com>
2026-06-08 09:20:12 +02:00
Yash Suthar
77a834c9d9 xen: balloon: Replace sprintf() with sysfs_emit()
Replace sprintf() calls with sysfs_emit() to follow current kernel
coding standards.

sysfs_emit() is the preferred method for formatting sysfs output as it
provides better bounds checking and is more secure.

Signed-off-by: Yash Suthar <yashsuthar983@gmail.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260517133817.29691-1-yashsuthar983@gmail.com>
2026-06-08 09:01:49 +02:00
Len Bao
19c5d6401d xen/mcelog: mark g_physinfo, ncpus and xen_mce_chrdev_device as __ro_after_init
The 'g_physinfo' and 'ncpus' variables are initialized only during the
init phase in the 'bind_virq_for_mce' function and never changed. So,
mark them as __ro_after_init.

The 'xen_mce_chrdev_device' variable is initialized only in the
declaration and never changed. So, this variable could be 'const', but
using the 'misc_register' and 'misc_deregister' functions discards the
'const' qualifier. Therefore, as an alternative, mark it as
__ro_after_init.

Signed-off-by: Len Bao <len.bao@gmx.us>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260523132802.25391-1-len.bao@gmx.us>
2026-06-08 09:01:02 +02:00
Len Bao
c1fd2c9f7f xen: constify xsd_errors array
The 'xsd_errors' array is initialized in the declaration and never
changed. So, constify it to reduce the attack surface.

At the same time, use the preferred '__maybe_unused' form over the
'__attribute__((unused))' form.

Signed-off-by: Len Bao <len.bao@gmx.us>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260523140809.30915-1-len.bao@gmx.us>
2026-06-08 09:00:06 +02:00
Bryam Vargas
b224d18b1e wifi: mac80211: bound S1G TIM PVB walk to the TIM element
ieee80211_s1g_check_tim() parses the S1G Partial Virtual Bitmap (PVB) of a
received TIM element. The TIM is handed in as the element payload:
ieee802_11_parse_elems_full() stores elems->tim = elem->data and
elems->tim_len = elem->datalen (net/mac80211/parse.c), so the valid bytes
are [tim, tim + tim_len).

When walking the encoded blocks the function passes the walker an end
sentinel of (const u8 *)tim + tim_len + 2, i.e. two bytes past the end of
the element. ieee80211_s1g_find_target_block() loops while (ptr + 1 <= end)
and dereferences ptr (and the per-mode ieee80211_s1g_len_*() helpers read
*ptr), so it can read up to two bytes beyond the TIM element -- an
out-of-bounds read of adjacent skb/heap data when the TIM is the last
element in the frame. The +2 appears to account for the element id/len
header, but tim already points past that header at the element payload, so
the addend is wrong.

Pass the correct element end, (const u8 *)tim + tim_len.

Fixes: e0c47c6229 ("wifi: mac80211: support parsing S1G TIM PVB")
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260606074341.49135-1-hexlabsecurity@proton.me
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-06-08 08:59:03 +02:00
Uwe Kleine-König (The Capable Hub)
74b94fc5bb xen/platform-pci: Simplify initialization of pci_device_id array
Instead of using a list initializer---that is hard to read unless you know
the structure of struct pci_device_id by heart---use the PCI_VDEVICE
macro to assign the needed values and drop all explicit but unneeded
zeros.

This doesn't introduce any changes to the compiled result of the array.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260505102909.2380470-2-u.kleine-koenig@baylibre.com>
2026-06-08 08:57:25 +02:00
Junrui Luo
a4ffc59238 mshv: add bounds check on vp_index in mshv_intercept_isr()
mshv_intercept_isr() extracts vp_index from the hypervisor message
payload and uses it directly to index into pt_vp_array without
validation. handle_bitset_message() and handle_pair_message() already
validate vp_index against MSHV_MAX_VPS before array access.

Add the same MSHV_MAX_VPS bounds check for consistency with the other
message handlers.

Fixes: 621191d709 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-06-07 23:22:46 -07:00
Markus Elfring
145613eb15 hv_balloon: Simplify data output in hv_balloon_debug_show()
Move the specification for a line break from a seq_puts() call
to a seq_printf() call.

The source code was transformed by using the Coccinelle software.

Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Reviewed-by: Sahil Chandna <sahilchandna@linux.microsoft.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-06-07 23:13:15 -07:00
Mukesh R
982cb55bec x86/hyperv: Cosmetic changes in irqdomain.c for readability
Make cosmetic changes:
 o Rename struct pci_dev *dev to *pdev since there are cases of
   struct device *dev in the file and all over the kernel
 o Rename hv_build_pci_dev_id to hv_build_devid_type_pci in anticipation
   of building different types of device ids
 o Fix checkpatch.pl issues with return and extraneous printk
 o Replace spaces with tabs
 o Rename struct hv_devid *xxx to struct hv_devid *hv_devid given code
   paths involve many types of device ids
 o Fix indentation in a large if block by using goto.

There are no functional changes.

Reviewed-by: Souradeep Chakrabarti <schakrabarti@linux.microsoft.com>
Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com>
Signed-off-by: Mukesh R <mrathor@linux.microsoft.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-06-07 22:59:49 -07:00
Mukesh R
c14efec145 iommu/hyperv: Create hyperv subdirectory under drivers/iommu
Create hyperv subdirectory under drivers/iommu in anticipation of more
Hyper-V related files from upcoming PCI passthrough and PV-IOMMU patches.
Also, the current file hyperv-iommu.c actually implements irq remapping on
x86, so rename to more appropriate hv-irq-remap-x86.c and move it under
the new hyperv subdirectory. Since this file implements irq_remap_ops
exposed by drivers/iommu/irq_remapping.h, it cannot be relocated to the
irq directory. This is in sync with other backend directories like amd
and intel there.

Lastly, this file should not be tied to CONFIG_HYPERV_IOMMU, but to
CONFIG_HYPERV and CONFIG_IRQ_REMAP.

Signed-off-by: Mukesh R <mrathor@linux.microsoft.com>
Reviewed-by: Jacob Pan <jacob.pan@linux.microsoft.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-06-07 22:55:56 -07:00
Dave Airlie
2aaaf5931b amd-drm-fixes-7.1-2026-06-04:
amdgpu:
 - UserQ fix
 - Userptr fix
 - MCCS freesync fix
 
 amdkfd:
 - Fix an event information leak
 - Events bounds check fix
 - Trap cleanup fix
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCaiIE4gAKCRC93/aFa7yZ
 2LlyAQDarmdl5mFhGbJzWsW1T3TtYsJP2ieuXW7yhNvm6nFvvAD+K63zdnKMty1u
 95hKpbYfEHdt8SlIKQCejhAbGZbt4ws=
 =ic9f
 -----END PGP SIGNATURE-----

Merge tag 'amd-drm-fixes-7.1-2026-06-04' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes

amd-drm-fixes-7.1-2026-06-04:

amdgpu:
- UserQ fix
- Userptr fix
- MCCS freesync fix

amdkfd:
- Fix an event information leak
- Events bounds check fix
- Trap cleanup fix

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Alex Deucher <alexander.deucher@amd.com>
Link: https://patch.msgid.link/20260604230955.19629-1-alexander.deucher@amd.com
2026-06-08 15:53:59 +10:00
Akashdeep Kaur
b7a76f38ef cpufreq: ti: Add EPROBE_DEFER for K3 SoCs
On K3 SoCs, ti-cpufreq relies on k3-socinfo to register the SoC
device before soc_device_match() can return valid revision
information. If ti-cpufreq probes before k3-socinfo,
soc_device_match() returns NULL, leading to incorrect CPU frequency
scaling behavior.

Add a needs_k3_socinfo flag to ti_cpufreq_soc_data (similar to
the existing multi_regulator pattern) to defer probe when k3-socinfo
hasn't registered the SoC device yet.

Signed-off-by: Akashdeep Kaur <a-kaur@ti.com>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
2026-06-08 11:16:42 +05:30
Taniya Das
4b5d3b8472 cpufreq: qcom: Add cpufreq scaling support for Qualcomm Shikra SoC
The Qualcomm Shikra cpufreq hardware is functionally identical to EPSS,
but supports only up to 12 frequency lookup table (LUT) entries. When all
12 entries are populated, the existing repetitive LUT entry check may read
beyond valid entries and expose incorrect frequencies. Hence, introduce
shikra_epss_soc_data that reuses EPSS configuration with appropriate LUT
entries limit.

Signed-off-by: Taniya Das <taniya.das@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Imran Shaik <imran.shaik@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
2026-06-08 10:58:07 +05:30
Imran Shaik
ef92354d0e dt-bindings: cpufreq: Document Qualcomm Shikra SoC EPSS
The Qualcomm Shikra cpufreq hardware is functionally identical to EPSS,
but supports only up to 12 frequency lookup table (LUT) entries. Introduce
Shikra specific bindings to represent this constrained EPSS variant.

Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Imran Shaik <imran.shaik@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
2026-06-08 10:58:07 +05:30
Greg Ungerer
e1f3a00670 m68k: coldfire: use ColdFire specifc IO access in SoC code
Convert all ColdFire specific SoC/board setup code to only use the
newly created internal register access methods. This is replacing the
mixed and inconsistent use of readx/writex and __raw_readx/__raw_writex
for internal SoC registers.

Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-08 13:15:18 +10:00
Greg Ungerer
e629342493 m68k: coldfire: use ColdFire specifc IO access in system code
Convert all ColdFire specific system setup code to only use the
newly created internal register access methods. This is replacing the
mixed and inconsistent use of readx/writex and __raw_readx/__raw_writex
for internal SoC registers.

Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-08 13:15:18 +10:00
Greg Ungerer
69f78f9621 m68k: coldfire: rename timer register access defines
With the basic ColdFire IO register functions now consistently named
with a "mcf_read"/"mcf_write" prefix it makes sense to name the timers
internal access defines the same way. Convert the local __raw_readtrr
and __raw_writetrr defines to use the consistent prefixes too. Thus
the change is:

    __raw_readtrr  --> mcf_readtrr
    __raw_writetrr --> mcf_writetrr

Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-08 13:15:18 +10:00
Greg Ungerer
22371c4d8a m68k: coldfire: use ColdFire specifc IO access in timer code
Convert all ColdFire specific timer setup code to only use the
newly created internal register access methods. This is replacing the
mixed and inconsistent use of readx/writex and __raw_readx/__raw_writex
for internal SoC registers.

Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-08 13:15:18 +10:00
Greg Ungerer
2385acdb20 m68k: coldfire: use ColdFire specifc IO access in interrupt code
Convert all ColdFire specific interrupt setup code to only use the
newly created internal register access methods. This is replacing the
mixed and inconsistent use of readx/writex and __raw_readx/__raw_writex
for internal SoC registers.

Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-08 13:15:18 +10:00
Greg Ungerer
8c22702db6 m68k: coldfire: use ColdFire specific IO access in headers
Convert all m68k/ColdFire specific header file code to only use the
newly created internal register access methods. This is replacing the
mixed and inconsistent use of readx/writex and __raw_readx/__raw_writex
for internal SoC registers.

Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-08 13:15:18 +10:00
Greg Ungerer
13cb6440d8 m68k: coldfire: create IO access functions for internal registers
The internal peripheral registers contained in all varieties of ColdFire
SoCs require simple big endian access ranging in sizes from 8, 16 and 32
bit. Currently there is a mixture of IO access methods used across the
various CPU support code, some using readx/writex and some using the
simpler __raw_readx/__raw_writew.

The readx/writex use cases are particularly kludgy in that they contain
code to differentiate internal register access and other general attached
peripheral register access - say on a PCI bus. In effect this means that
the readx/writex family for ColdFire is non-standard. This ultimately
ends up causing problems with definitions of other IO access support
functions like ioreadx/ioreadxbe/iowritex/iowritexbe which in the
generic case are defined in terms of readx/writex.

Create a set of internal only register access methods to ultimately
replace all internal register access code. The new access functions
mirror the existing readx/writex family but using the preferred 8/16/32
suffixes.

Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-08 13:15:18 +10:00
Greg Ungerer
cd30961957 m68k: defconfig: update all ColdFire defconfigs
Refresh all ColdFire base defconfig files, making sure that modules
is turned on for all targets.

Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-08 13:15:18 +10:00
Greg Ungerer
b0a78e8a24 m68k: defconfig: add config for SnapGear/NETtel board
Add a default configuration for a basic M5307 based NETtel board.
This is primarily to improve defconfig build coverage. This platforms
uses the SMSC ethernet drivers for network ports, and has a few other
minor quirks that make it different from other ColdFire platforms.

Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-08 13:15:18 +10:00