mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
1,482,976 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Rosen Penev
|
f17b0ef859 |
gpio: ppc44x: Use module platform driver helper for GPIO
Replace the open-coded arch initcall registration with module_platform_driver(). The initcall level changes from arch_initcall to device_initcall, which is safe since the driver no longer needs architecture-specific ordering. Added MODULE info as a result, otherwise these warnings appear ERROR: modpost: missing MODULE_LICENSE() in drivers/gpio/gpio-ppc4xx.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/gpio/gpio-ppc4xx.o Assisted-by: Codex:GPT-5.5 Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260803223539.86303-4-rosenp@gmail.com |
||
|
Rosen Penev
|
f9476e237a |
gpio: ppc44x: update all 4xx to 44x
The kernel lost support for 4xx platforms and now only supports 44x. Since this driver is being moved to drivers/gpio/ , take the opportunity to modernize the name. Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260803223539.86303-3-rosenp@gmail.com |
||
|
Rosen Penev
|
66da1ae196 |
gpio: move ppc4xx gpio driver from arch/powerpc to drivers/gpio
Move the ppc4xx gpio driver out of arch/powerpc/platforms/44x/ into drivers/gpio/gpio-ppc44x.c. The driver has no architecture-specific dependencies and follows the same pattern as other PowerPC GPIO drivers already in drivers/gpio/ (e.g. gpio-mpc8xxx, gpio-mpc5200). - Renamed Kconfig symbol from PPC4xx_GPIO to GPIO_PPC44X - Updated ppc44x_defconfig and warp_defconfig to use the new symbol - Marked the new option as tristate (was bool) since the driver supports module build via module_platform_driver() Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260803223539.86303-2-rosenp@gmail.com |
||
Linus Torvalds
|
b643e495ae |
s390 updates for 7.2-rc7
- Fix potential uninitialized memory reads and buffer overflows from malformed zcrypt CCA and EP11 requests by properly validating lengths and payloads - Fix possible out of bounds accesses in zcrypt EP11 domain handling by replacing fixed payload layout assumptions with parsing ASN.1 fields with bounds checks - Fix zcrypt CCA and EP11 request and reply buffer allocations missing required 4-byte padding, and scrub the full allocation on release - Fix zcrypt CCA and EP11 messages leaking up to 3 uninitialized bytes of memory by zeroing trailing alignment padding -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEE3QHqV+H2a8xAv27vjYWKoQLXFBgFAmp4YYUACgkQjYWKoQLX FBh1tgf/ZZMzYxWDawMfYg2SoE16aLEG6M+I8qa1EmpxCXwu2Evl17LdMtkZFL1C ClDux15JGBhbpYyHyXhlsnUMRSHKLatLF2LU4KR6g3q5JgFcNRUVzSH8uuE40en5 UspMeEG09NENUJGveyZ8tEbGmkbI1hxAzicD4nRMTuin8VpXWKvHaNeQYXhkuDtr 5nuCiRmJUgMrwAVgtTXkdWzMaR0QwLWwkkLXLhnQk6NWyz1EhYmXWT+YG2axu7/y KUWU5jEs1AutO7YUxgTzrvxjS4M5IbokSXNyTUlLUqmPzdbXVWrpuF0nFEorBCA3 TzA7NCaJAChYWFfg54zQYdd4ijnf2Q== =iulo -----END PGP SIGNATURE----- Merge tag 's390-7.2-7' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Fix potential uninitialized memory reads and buffer overflows from malformed zcrypt CCA and EP11 requests by properly validating lengths and payloads - Fix possible out of bounds accesses in zcrypt EP11 domain handling by replacing fixed payload layout assumptions with parsing ASN.1 fields with bounds checks - Fix zcrypt CCA and EP11 request and reply buffer allocations missing required 4-byte padding, and scrub the full allocation on release - Fix zcrypt CCA and EP11 messages leaking up to 3 uninitialized bytes of memory by zeroing trailing alignment padding * tag 's390-7.2-7' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/zcrypt: Pad trailing CCA or EP11 message with zeros s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing s390/zcrypt: Improve EP11 CPRB length and overflow checks s390/zcrypt: Improve CCA CPRB length and overflow checks s390/zcrypt: Fix CPRB memory allocation in zcrypt misc code |
||
|
Rosen Penev
|
7a90520e8c |
ARM: dts: helios4: add SATA regulator supplies
The ahci-mvebu driver and libahci_platform request three supplies
on SATA controller and port nodes:
- ahci-supply (controller power)
- phy-supply (PHY power)
- target-supply (disk power per port)
Without them the regulator core prints notices at boot, e.g.:
supply ahci not found, using dummy regulator
supply phy not found, using dummy regulator
supply target not found, using dummy regulator
The SATA controller and PHY inside the Armada 388 SoC are powered
by the 3.3V I/O rail; the four disk bays are powered by the 5V HDD
rail. Wire the existing fixed regulators accordingly.
Fixes:
|
||
|
Rosen Penev
|
c23988f844 |
ARM: dts: helios4: add vcc-supply to GPIO expander
The pca953x driver requests a 'vcc' supply, producing:
pca953x 0-0020: supply vcc not found, using dummy regulator
The PCA9655 (PCA9555-compatible) expander is powered by the same
always-on 3.3V rail as the other I2C devices on the bus. Add
vcc-supply = <®_3p3v> to silence the warning.
Fixes:
|
||
|
Rosen Penev
|
ef65cf08bd |
ARM: dts: helios4: add vcc-supply to EEPROM
The at24 driver requests a 'vcc' supply for the EEPROM, producing
'supply vcc not found, using dummy regulator' at boot when the
property is missing.
The EEPROM sits on the Helios 4 and is powered by the
same always-on 3.3V rail used by other on-board I2C devices.
Add vcc-supply = <®_3p3v> to silence the warning.
Fixes:
|
||
Tomáš Macholda
|
0c2a8eed95 |
arm64: dts: turris-mox: fix usb3 phys
After commit |
||
Ajrat Makhmutov
|
7097666b99 |
ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r
The BIOS of the F+ FLAPTOP r laptop (Realtek ALC897, SSID 1e63:6d9a) declares only pin 0x1b, the headphone output of the 3.5 mm combo jack. Every other external pin is left at 0x411111f0, so the headset mic pin 0x19 is never parsed and no headset mic input exists. The pin is wired on this board - retasking it makes the headset mic record. Reuse ALC897_FIXUP_HP_HSMIC_VERB, which already sets the pin config this machine needs: 0x19 as a headset mic without its own presence detect. Only 0x1b reports jack presence here, so a mic pin with presence detect would leave the driver in auto-mic mode waiting for an event that never arrives. Without the quirk the generic parser retasks the lone headphone pin as an input instead. That surfaces as a "Headphone Mic" input which records only the internal mic bleed, so the headset mic appears present but dead. Tested on ALT Linux, kernel 6.12, by recording a CTIA headset mic on the combo jack with the internal mic as a reference. ALSA info before the patch: https://alsa-project.org/db/?f=18363eddea933baee100c9bf461d0e5cf74c8de2 ALSA info after the patch: https://alsa-project.org/db/?f=48ae2cd7aaf1eb0f24639ce83cd38cfd93b25f76 Cc: stable@vger.kernel.org # 6.12.x Signed-off-by: Ajrat Makhmutov <rauty@altlinux.org> Link: https://patch.msgid.link/20260808185500.2564948-1-rauty@altlinux.org Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
JJ Macalinao
|
786f91da85 |
ALSA: usb-audio: add QUIRK_FLAG_ALWAYS_SET_RATE for Mackie DLZ Creator XS
set_sample_rate_v2v3() returns early when the clock already reports the
requested rate:
prev_rate = get_sample_rate_v2v3(chip, fmt->iface,
fmt->altsetting, clock);
if (prev_rate == rate)
goto validation;
A device advertising exactly one sample rate always takes this branch, so
it never receives a SET_CUR for CS_SAM_FREQ_CONTROL at all.
The Mackie DLZ Creator XS (0a73:003a, 14 in / 4 out, 48 kHz only) requires
that write. Without it the device drops off the USB bus roughly 0.2-1.8 s
into any stream, clearing its port CONNECTION bit; captured audio is
byte-correct until the instant it vanishes.
USBPcap traces of a cold-booted device on Windows show SET_CUR 48000 issued
unconditionally on every stream start, followed by clean streaming. The
device is otherwise driven with plain class-compliant UAC2 - it also works
on iOS, which cannot load a vendor driver - so no vendor-specific
initialization is involved.
The device is self-powered, so the resulting state survives a USB replug:
initializing it on any host that issues the write leaves it working on
Linux until it is power-cycled, which made the failure look intermittent.
Add a quirk flag rather than dropping the early exit, since the opposite
requirement also exists in-tree: QUIRK_FLAG_FIXED_RATE suppresses rate
setting for single-rate devices (JBL Quantum610/810). The two behaviors
are device-dependent and cannot both be the default.
A/B on identically cold-booted hardware, same kernel, same port, repeated
twice:
without the flag device dropped after 5-6 s, then again after 3-4 s
with the flag 20 s playback followed by 20 s of 14-channel capture,
960000 frames, zero re-enumerations
This change was developed with an AI coding assistant. The assistant did
the trace analysis that located the bug and wrote the patch and this
changelog; the hardware testing, the cold-boot cycles and the decision to
submit were the author's. Several earlier hypotheses it proposed - URB
queue depth, isochronous packet under-allocation, endpoint start ordering -
were disproven by measurement before this one.
The bug was located with usbmon on Linux and USBPcap on Windows, by
diffing an enumeration capture of a cold-booted device on each host.
Verified on physical hardware by the A/B above.
Assisted-by: Claude-Code:claude-opus-5
Signed-off-by: JJ Macalinao <jj@macalinao.org>
Link: https://patch.msgid.link/20260808172726.1107550-1-jj@macalinao.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
||
Hui Su
|
91542863ab |
ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
In test_ringbuffer()'s out_free cleanup loop, the check
`!rb_threads[cpu]` only catches NULL entries and misses entries that
hold an ERR_PTR.
rb_threads[] is static, so unassigned slots are NULL. But when
kthread_run_on_cpu() fails for a cpu, it stores ERR_PTR(-ENOMEM) (or
-EINTR) in rb_threads[cpu] before the creation loop jumps to out_free.
That entry is non-NULL, so the old `!ptr` check does not break, and the
cleanup proceeds to call kthread_stop() on the ERR_PTR. kthread_stop()
then dereferences the bogus pointer, crashing the kernel during the
late_initcall self-test.
crash logs:
BUG: kernel NULL pointer dereference, address: 000000000000001c
Oops: 0002 [#1] SMP NOPTI
CPU: 1 PID: 1 Comm: swapper/0 Not tainted 7.2.0-rc6-dirty #7 PREEMPT(lazy)
RIP: 0010:kthread_stop+0x2e/0x220
RBX: fffffffffffffff4
CR2: 000000000000001c
Call Trace:
<TASK>
test_ringbuffer+0x1ec/0x650
do_one_initcall+0x6c/0x2c0
kernel_init_freeable+0x21d/0x420
kernel_init+0x15/0x1c0
ret_from_fork+0x21b/0x320
</TASK>
Kernel panic - not syncing: Fatal exception
Cc: stable@vger.kernel.org
Fixes:
|
||
Vincent Donnefort
|
6d014e44b6 |
ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
In rb_allocate_cpu_buffer(), bpage->order was omitted, leaving it as 0.
This is an issue for a ring-buffer with subbufs bigger than PAGE_SIZE if
when freed: free_buffer_page() relies on this value. Align the value
with the actual allocation size (buffer::subbuf_order).
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Vincent Donnefort
|
bf98d7b0d5 |
ring-buffer: Prevent subbuf order change when resizing is disabled
Because ring_buffer_subbuf_order_set() frees buffer pages, we can't
allow it when resizing is disabled. A non-consuming reader is at risk of
use-after-free (rb_advance_iter()).
Return -EBUSY on resize_disabled, matching ring_buffer_resize()
behaviour.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Vincent Donnefort
|
7c727dfce6 |
ring-buffer: Prevent resizing of persistent ring buffer
Dynamically resizing a persistent ring buffer is not possible. Disable
the feature.
Cc: stable@vger.kernel.org
Fixes:
|
||
Josh Poimboeuf
|
8b8292d648 |
ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
When a module's init text is freed, do_init_module() calls
ftrace_free_mem() with a half-open [start, end) range. However the
ftrace_cmp_recs() comparator treats the upper bound as inclusive, as all
its other users do, passing 'ip + size - 1'. So ftrace_free_mem() can
delete a record sitting exactly at 'end', which is outside the freed
range.
For a kernel without CFI or IBT, the first record of a function is at
the function start, which for the first function in a module is also the
base of its text allocation. As the module allocator packs its regions,
that address is often the 'end' passed by a neighboring module's
do_init_module(), causing the first function's ftrace location to get
disabled, preventing an attempt to livepatch it:
livepatch: failed to find location for function 'pcspkr_probe'
Convert the exclusive end to the inclusive 'end - 1' the comparator
expects, and return early for an empty range to avoid the subtraction
from underflowing when the init text size is zero.
Cc: stable@vger.kernel.org
Fixes:
|
||
Tengda Wu
|
f27bdc4307 |
ring-buffer: Use current_context for safe per-CPU buffer swap
The ring_buffer_swap_cpu() function currently checks the per-CPU
committing counter to determine if a buffer is actively being written to
before performing the swap. However, there exists a race window where
this check can be bypassed:
ring_buffer_lock_reserve
cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_a
rb_reserve_next_event
rb_start_commit // inc committing
if (unlikely(READ_ONCE(cpu_buffer->buffer) != buffer)) {...}
__rb_reserve_next
rb_move_tail
rb_end_commit(cpu_buffer); // dec committing => 0
/* interrupt hits here, successfully swaps! */
local_inc(&cpu_buffer->committing);
ring_buffer_unlock_commit
cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_b
rb_commit
rb_end_commit
RB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer->committing))
// triggers warning
The committing counter can temporarily drop to 0 during a single write
operation (within rb_move_tail), creating a window where swap can
succeed even though the write is still in progress. This leads to
inconsistent buffer state and triggers the RB_WARN_ON in rb_commit().
Replace the committing counter check with current_context checks, which
are set at the entry of ring_buffer_lock_reserve() and remain valid
throughout the entire write operation, providing a reliable indicator of
buffer busy state during swap.
Cc: stable@vger.kernel.org
Fixes:
|
||
Alexandre Belloni
|
b981359d9e |
arm64: tegra: Device tree changes for v7.3-rc1
This contains a new device tree for the Lenove ThinkEdge SE70 Edge Client device as well as a number of fixes and cleanups for Tegra234 and Tegra194. Tegra264 sees a number of additions to enable more features. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEiOrDCAFJzPfAjcif3SOs138+s6EFAmpvcb8ACgkQ3SOs138+ s6EVRg//e3keeg7ehCUFVA8mDnGfxtIR5ErkU0I5LkCaQucREvHveHuNSayiNSM0 DQVcqv3n/egea4Nnon+eH4ddpa0fosFUm0tW1agLdvhn41nKhiTg/vNcPUwqNE+p qw43rl5ecChZslW8l8+4eln9sRoTnxBKKlydu5aKKVQtpLbn23uZTwtlSwMWcduO 0GjNOpvrjNyLWzGQ6lrO7uxRxrTHJPYm68Y/sVt38tZYHKC/Ksosy1/o0fKwJd4Q kMfk2lu1DxY6LGihNmNgpoITva0EaxtwDN1I4IO+dWLNq+feOrwCdTIaanycQPSw 29COUfEcpblWvkRxd6ffWLwsAEk1ydR49FaJLgaAddb0ImEJfEeiaz8roAMqW24Q QEEDtSwg8JeC4dhWSgOqPOin328hiz3gEG3qYkP/Bi9NgCq2a0eVRlWfBOkgPI8u isGcVm1yfb2cxdgC26QWivLtuTxDNeHp/rcyGAinWrzd5FJFMvd/tn76inOS33X1 U4shiIvnYDMh0j1VkvHa2ZvN1lqOTmbAGqHOF0iuCC2fhHuu6VW3/7j7wYgtv4gP Mp2dfVWEdj1Yp+iedS63XN+rFnEqMqw2733TkI1ThLzF3PXz0BO73QMvY+qAujlV 8eLPr5091lXQKYCKCLx8AGBpLtXOFHzS1BxR/tr+OPWAutGFoXA= =qSTk -----END PGP SIGNATURE----- Merge tag 'tegra-for-7.3-arm64-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt arm64: tegra: Device tree changes for v7.3-rc1 This contains a new device tree for the Lenove ThinkEdge SE70 Edge Client device as well as a number of fixes and cleanups for Tegra234 and Tegra194. Tegra264 sees a number of additions to enable more features. * tag 'tegra-for-7.3-arm64-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: (1469 commits) arm64: tegra: Correct Tegra234 p3740 interrupt flags arm64: tegra: Correct Tegra234 p3737 interrupt flags arm64: tegra: Correct Tegra194 p2972 interrupt flags arm64: tegra: Drop CPU masks from GICv3 PPI interrupts arm64: tegra: Add Lenovo ThinkEdge SE70 device tree arm64: tegra: Add pinctrl nodes for Tegra264 arm64: tegra: Fix CMDQV interrupt type on Tegra264 arm64: tegra: Properly sort devices on Tegra264 arm64: tegra: Add GTE nodes for Tegra264 arm64: tegra: Add Host1x and VIC on Tegra264 arm64: tegra: Populate CPU and L2 cache nodes on Tegra264 arm64: tegra: Enable GPCDMA in Tegra264 and add iommu-map Linux 7.2-rc5 super: fix emergency thaw deadlock on frozen block devices tracing: perf: Fix stale head for perf syscall tracing ftrace: Add global mutex to serialize trace_parser access tracing: Delay module ref count for "enable_event" trigger tracing: Fix use-after-free freeing trigger private data bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() tracing: Fix context switch counter truncation ... Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
Alexandre Belloni
|
36a0554941 |
dt-bindings: Changes for v7.3-rc1
This contains a few fixes for interrupt types and email addresses as well as the addition of a compatible string for the Lenovo ThinkEdge SE70 Edge Client. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEiOrDCAFJzPfAjcif3SOs138+s6EFAmpvcBUACgkQ3SOs138+ s6FsAg/+MbBZhYQm08PBRJAvwOuC+3Uny4nBxPDheAyqYmi0pa7a6Az36k1ub5B2 UgXrk32x+yfhGvmSkg/bKsiSvKo9SjKz0hUY4hWOMCeursbNDdv2BcYxLwx291wu KETB3obUsGRhn3yqcQA6b/8iJOBluDDpdkZh85AT++Ss+akspCt4LeCQnXDxdtK3 aEG0lb8Q63TC0uW0a0Qg5+xh9HH7hNZN8S0giWP0OCi0+V9JNyPWEfVAFdqLaQbH bcv1udPTKYhvXemNumerMzNXtxPJTBlOTJwugyCgv7rMGRsntk54UTDqc4w6yRen T9Zf3v9ScMQ+OXpdhicdFffeNC2tky9fruTE8Vjs7Oeif2AtaqYI8wMndyMKvQl5 h4Q1uwAJeX2Wjj+5DxLQ/ets4OGb0GvXw8xdELfQ1R35YKd97eHMXqpgdwFtb5PW UecGlSly515zL43a7z/ROF33aG4Cbr3DZJANRNfqlo5oDuHWyS53q+jNklq0nhid t29eMhaB9sh8NGOgs4hHY67vMwvYHDDAUDSp66AcQFVuPkJdf8Mrw8MSaXhcqqW+ Tkn2w/ilrYTn7ZXr1CPqmSHezlr77ky/cmusBoSp2NX1LVCQPkonQAOrj1Pzd6mI vTGy7U6zj6dbXw1yZTAtBzzBJY6WwTxHsKAxW98uvr7kupbC89Y= =q7gO -----END PGP SIGNATURE----- Merge tag 'tegra-for-7.3-dt-bindings' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt dt-bindings: Changes for v7.3-rc1 This contains a few fixes for interrupt types and email addresses as well as the addition of a compatible string for the Lenovo ThinkEdge SE70 Edge Client. * tag 'tegra-for-7.3-dt-bindings' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: dt-bindings: arm: tegra: Add lenovo,thinkedge-se70 compatible string dt-bindings: gpu: host1x: Fix email address dt-bindings: iommu: Fix interrupt type in example Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
Linus Torvalds
|
06cf61899d |
- Fix MCE CMCI discovery initialization ordering bug
(Breno Leitao) Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmp3hxkRHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1iSyA/9EY/a7Ri29eYKrblSnPCAHyUIpo2oNNJM CVrC9TOPYPaPFQg7Py91B6+yry8aOtHVQpXygNVQJMgr8oz9QuQcfL6JumHXRYxX OV5+/S4Hba4dzhDeOEdethiz65Vp3rCm5Dl8D2/5g47CJp3JUM3WJ0GrJs6PWNST 446rTZXTVz8jVYNhFyGPJHqApMypMyqUnTS1zJsq+PEldzs+LV4YHaQ7PIvEl++w iA1yFdqvcStpeqfu/e0PwauiPH5tpwnde5ZxRjygCr9M7cWpL+wjhP4z5eGiSM1O Xgjr5tVfevbDC2LA5CZxdeFheSupUMxI/zfmYyCdCz3z22jEXMUghHUZvL+kY+cq ur6b9iFvC8R+Jwjp/pnTvqTS7xzcqXvMJFiaviiYXmeCLWu/Ah8e0v2ugmzUUxPp 5VHuhoVgyEr1eMPb2huzqozzTgqJEx5h3zOlo355IN0QjnKCMIGa8WrpkYQGTjW+ 5wl/PnPenMGl3FDHUq8IlvMlbQkbh/NLoy1EC6Kna9D46H0Cxu6NqHMu2uP6Flj7 sQxne+zdM/KLTPlPyHxtiQQCau9w0NYFsY9PtMgB/HyrjjjJiPKGL39j+kj1Yusa 2CSisQttseoNQA60Vh4o+jZ3MnnIijqPZnB4GokG2yRZ1v4GsmpacOs/VWqDrWnx sW2+z97qoZk= =YUDb -----END PGP SIGNATURE----- Merge tag 'x86-urgent-2026-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Ingo Molnar: - Fix MCE CMCI discovery initialization ordering bug (Breno Leitao) * tag 'x86-urgent-2026-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce: Set up the polling timer before CMCI discovery |
||
|
Linus Torvalds
|
d4eee3bdb8 |
- Fix race in futex_pivot_pending() during private hash resize
that can cause stuck tasks (Yao Kai) Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmp3gQ8RHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1h0CQ//Wq3AnGGWisG9OAyn22xxlkh1lK4RqUeE uAYuLQmIAw481YjiVg7U0QTcyHrMrDHK5j902oc1Zd7Cyc+IqBaaZVPs63Vq0onh KAP19tbFz2w9D/mxyTkuxEekJ42w8a7bk5cHFL1rw0t/rSA51LixzbdW7DloC2vg So+quAtUcaXI8831ljnikN4OdNQOCLJCA9MemTpncIMuyL4BmhOXDRMwXneevg74 f6BOqrgbvKEgrBsVhWzGeDdq5ZHekmGVrHQeOxlDaQy/rZS+VE3VJwtMBwZvhn6X wU3CQdvkvDOeQvqXyfWxTbqhk7AJrIL5FKQrp5ZlhECw2WnPOUHwjAHQ8dKHaJEw wbv58RALcJ33s+PWy+0tYmOP4SPyICpQEmdp+SCaR0N4N/LtAScz05XAGnJ4S97+ t8LBmmJFmkxz4rDbTdawBV+sulDX/y+8xYu0/CZJhAyp1hEW9ajyMbRj5gVGOomT xKyyQAUTUUznStscc4hgTNVd1UAhuqUYlMNCJsEJOHNHvnq5qHT+ezPoZt5X5qd6 cDHCs5b+agQ/PIpW1vIiulCypelckAqvs+XdE0Pv3uPlNVjMLfZCTeyaOoXqIqI7 LpXkgR0UxkWmFf8vGncpPHjDCh3YqGgN66iE1qKohO1L9/uSxwwxEUOJIcPaOFtX C07TnEwMdK0= =3w7m -----END PGP SIGNATURE----- Merge tag 'locking-urgent-2026-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull futex fix from Ingo Molnar: - Fix race in futex_pivot_pending() during private hash resize that can cause stuck tasks (Yao Kai) * tag 'locking-urgent-2026-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Fix race in futex_pivot_pending() during private hash resize |
||
|
Linus Torvalds
|
91a73db697 |
USB / Thunderbolt fixes for 7.2-rc7
Here are some small USB and Thunderbolt driver fixes for 7.2-rc7 that resolve some reported issues. Included in here are: - new quirk for some broken USB devices - thunderbolt device fixes for reported issues - usb gadget driver fix - usb atm driver fix - xhci driver fixes. - other minor USB driver fixes All of these have been in linux-next this week with no reported issues. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iGwEABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCandKCg8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+ymavgCgzIiJ6KRqYmikyHsPpfL6GNYtOLAAmOwaDTWL Zzvkgp8bIdQvqsPg6B0= =lR2e -----END PGP SIGNATURE----- Merge tag 'usb-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt fixes from Greg KH: "Here are some small USB and Thunderbolt driver fixes for 7.2-rc7 that resolve some reported issues. Included in here are: - new quirk for some broken USB devices - thunderbolt device fixes for reported issues - usb gadget driver fix - usb atm driver fix - xhci driver fixes. - other minor USB driver fixes All of these have been in linux-next this week with no reported issues" * tag 'usb-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: xhci: use BIT_ULL for CRCR bits to fix incorrect 64bit mask usb: quirks: Add ShanWan gamepad to quirk list usb: hub: Split announce_device() to log device identity before enumeration usb: core: Add quirk for 255-bytes initial config read usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg usb: gadget: f_ncm: Use unsigned int for ndp_index usb: cdnsp: fix incorrect endian conversions for APB timeout register thunderbolt: Initialize ->domain_released completion before it is being used thunderbolt: icm: Preserve USB4 proxy data-valid bit thunderbolt: Bound the DROM dual link port number before indexing sw->ports thunderbolt: Fix bandwidth group reservation indexing thunderbolt: stream: Unmap buffers with mapped size |
||
|
Linus Torvalds
|
e4836b67ba |
TTY / Serial / VT driver fixes for 7.2-rc7
Here are some small serial and vt tty driver fixes for 7.2-rc7 that resolve some reported problems. Included in here are: - 2 vt core fixes - amba-pl011 serial driver fixes - 8250_of and 8250_dma driver fixes - qcom-geni serial driver fix - sc16is7xx serial driver fix All of these have been in linux-next this week with no reported issues. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCandKkg8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+ylnjQCeND+mnhXzo7wmT4E2vHER2FG8UEEAmwXRTNe6 QzKAPXT2BgHPFW7Gy8dk =UY5p -----END PGP SIGNATURE----- Merge tag 'tty-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty / serial / vt driver fixes from Greg KH: "Here are some small serial and vt tty driver fixes for 7.2-rc7 that resolve some reported problems. Included in here are: - two vt core fixes - amba-pl011 serial driver fixes - 8250_of and 8250_dma driver fixes - qcom-geni serial driver fix - sc16is7xx serial driver fix All of these have been in linux-next this week with no reported issues" * tag 'tty-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: amba-pl011: synchronize DMA teardown serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ serial: amba-pl011: fix indefinite RS485 post-send delay vt: add permission check for KDSKBMETA ioctl vt: stabilize tty reference in kbd_keycode with tty_port_tty_get serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx serial: qcom-geni: fix TX DMA buffer flush serial: 8250_dma: Clear stale RX state on shutdown serial: sc16is7xx: enable THRI before filling TX FIFO |
||
|
Linus Torvalds
|
e663f6deac |
Staging driver fixes for 7.2-rc7
Here are some more small staging driver fixes, just for the rtl8723bs driver, for some reported problems found with it now that people are starting to actually test the thing with "bad" networks. Nothing major, but good to have in the -final release. All of these have been in linux-next for over a week with no reported problems. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCandJYA8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+ykIxACfTuHhJxAk0r/QsXGjmp/u8s733lYAnjVl7Kdm v7Q+WL8+jJnxPW8jpWcy =l2iZ -----END PGP SIGNATURE----- Merge tag 'staging-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are some more small staging driver fixes, just for the rtl8723bs driver, for some reported problems found with it now that people are starting to actually test the thing with "bad" networks. Nothing major, but good to have in the -final release. All of these have been in linux-next for over a week with no reported problems" * tag 'staging-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: rtl8723bs: validate monitor transmit frame lengths staging: rtl8723bs: fix missing shared-key auth challenge length check staging: rtl8723bs: fix OOB read in WMM_param_handler() staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() |
||
|
Linus Torvalds
|
5668ba2304 |
Char / Misc and documentation fixes for 7.2-rc7
Here are some small char/misc and nvmem and documentation fixes for
7.2-rc7 to resolve some reported issues. Included in here are:
- updates to the documentation for the kernel threat model and
security bugs to get the LLMs to actually follow what we have been
asking them to do (i.e. not claim security issues for things we do
not consider security issues.)
- nvmem driver fixes which required a tiny "layout" driver to be
added.
- fastrpc driver fixes
- mei driver fix
- counter driver fix
- binder driver fix
All of these have been in linux-next this week with no reported
problems.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCandLdw8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+yldzACZAVaM2/I0hIeTnoBqRFIZBcroUQYAoNk5zQSW
qYG0DWUf4LJwj9WPQWIS
=e+LJ
-----END PGP SIGNATURE-----
Merge tag 'char-misc-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char / misc and documentation fixes from Greg KH:
"Here are some small char/misc and nvmem and documentation fixes for
7.2-rc7 to resolve some reported issues. Included in here are:
- updates to the documentation for the kernel threat model and
security bugs to get the LLMs to actually follow what we have been
asking them to do (i.e. not claim security issues for things we do
not consider security issues.)
- nvmem driver fixes which required a tiny "layout" driver to be
added.
- fastrpc driver fixes
- mei driver fix
- counter driver fix
- binder driver fix
All of these have been in linux-next this week with no reported
problems"
* tag 'char-misc-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
docs: security-bugs: clarify some mandatory steps for AI reports
docs: coding-assistant: explain important steps when looking for bugs
docs: security-bugs: clarify what counts as a valid version
docs: threat-model: move fake devices out of "non production use"
docs: threat-model: clarify "security bug" vs "vulnerability"
counter: microchip-tcb-capture: Fix DT channel validation
mei: pull kvfree out of spinlock
rust_binder: do not query current thread for all ioctls
nvmem: layouts: Add fixed-layout driver
nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI
misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
misc: fastrpc: fix channel ctx ref leak when session alloc fails
misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
misc: fastrpc: Remove buffer from list prior to unmap operation
misc: fastrpc: Fix initial memory allocation for Audio PD memory pool
|
||
Lyude Paul
|
e35e770002 |
openrisc: Include <linux/cpumask.h> in smp.h
While OpenRISC currently doesn't fail to build upstream, it appears that
including <asm/smp.h> in the right headers is enough to break that -
primarily because OpenRISC's asm/smp.h header doesn't actually provide
any definition for struct cpumask. Which means the only reason we aren't
failing to build the kernel is because we've been lucky enough that
every spot including asm/smp.h already has definitions for struct
cpumask pulled in.
This became evident when trying to work on a patch series for adding
ref-counted interrupt enable/disable to the kernel, where introducing a
new interrupt_rc.h header suddenly introduced a build error on OpenRISC:
In file included from include/linux/interrupt_rc.h:17,
from include/linux/spinlock.h:60,
from include/linux/mmzone.h:8,
from include/linux/gfp.h:7,
from include/linux/mm.h:7,
from arch/openrisc/include/asm/pgalloc.h:20,
from arch/openrisc/include/asm/io.h:18,
from include/linux/io.h:12,
from drivers/irqchip/irq-ompic.c:61:
arch/openrisc/include/asm/smp.h:21:59: warning: 'struct cpumask'
declared inside parameter list will not be visible outside of this
definition or declaration
21 | extern void arch_send_call_function_ipi_mask(const struct cpumask *mask);
| ^~~~~~~
arch/openrisc/include/asm/smp.h:23:54: warning: 'struct cpumask'
declared inside parameter list will not be visible outside of this
definition or declaration
23 | extern void set_smp_cross_call(void (*)(const struct cpumask *, unsigned int));
| ^~~~~~~
drivers/irqchip/irq-ompic.c: In function 'ompic_of_init':
>> drivers/irqchip/irq-ompic.c:191:28: error: passing argument 1 of
'set_smp_cross_call' from incompatible pointer type
[-Werror=incompatible-pointer-types]
191 | set_smp_cross_call(ompic_raise_softirq);
| ^~~~~~~~~~~~~~~~~~~
| |
| void (*)(const struct cpumask *, unsigned int)
arch/openrisc/include/asm/smp.h:23:32: note: expected 'void (*)(const
struct cpumask *, unsigned int)' but argument is of type 'void
(*)(const struct cpumask *, unsigned int)'
23 | extern void set_smp_cross_call(void (*)(const struct cpumask *, unsigned int));
To fix this, let's take an example from the smp.h headers of other
architectures (x86, hexagon, arm64, probably more): just include
linux/cpumask.h at the top.
Signed-off-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Boqun Feng <boqun@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Stafford Horne <shorne@gmail.com>
Link: https://patch.msgid.link/20260804161447.84806-5-boqun@kernel.org
|
||
Boqun Feng
|
4ad87eee54 |
preempt: Introduce __preempt_count_{sub,add}_return()
In order to use preempt_count() to track the interrupt disable nesting
level, __preempt_count_{add,sub}_return() are introduced, as their names
suggest, these primitives return the new value of the preempt_count()
after changing it. The following example shows the usage of it in
local_interrupt_disable():
// increase the HARDIRQ_DISABLE bit
new_count = __preempt_count_add_return(HARDIRQ_DISABLE_OFFSET);
// if it's the first-time increment, then disable the interrupt
// at hardware level.
if ((new_count & HARDIRQ_DISABLE_MASK) == HARDIRQ_DISABLE_OFFSET) {
local_irq_save(flags);
raw_cpu_write(local_interrupt_disable_state, flags);
}
Having these primitives will avoid a read of preempt_count() after
changing preempt_count() on certain architectures.
Signed-off-by: Boqun Feng <boqun@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Heiko Carstens <hca@linux.ibm.com> # s390
Link: https://patch.msgid.link/20260804161447.84806-4-boqun@kernel.org
|
||
|
Boqun Feng
|
9634d860ac |
preempt: Introduce HARDIRQ_DISABLE_BITS
In order to support preempt_disable()-like interrupt disabling, that is, using part of preempt_count() to track interrupt disabling nesting level, change the preempt_count() layout to contain 8-bit HARDIRQ_DISABLE count. Signed-off-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260121223933.1568682-2-lyude@redhat.com Link: https://patch.msgid.link/20260804161447.84806-3-boqun@kernel.org |
||
Joel Fernandes
|
b54aa0edf0 |
preempt: Track NMI nesting to separate per-CPU counter
Move NMI nesting tracking from the preempt_count bits to a separate per-CPU counter (nmi_nesting). This is to free up the NMI bits in the preempt_count, allowing those bits to be repurposed for other uses. Reduce NMI_BITS from 4 to 1, using it only to detect if we're in an NMI. The per-CPU counter currently caps nesting at 15. [boqun: Address Steven Rostedt's comment on the BUG_ON() condition] [boqun: Use preempt_count_set() in __nmi_exit() to avoid underflow] Suggested-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com> Signed-off-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260121223933.1568682-3-lyude@redhat.com Link: https://patch.msgid.link/20260804161447.84806-2-boqun@kernel.org |
||
Mostafa Saleh
|
2e813a6e8e |
KVM: arm64: Fix hvhe and broken CNTVOFF_EL2
When running on a setup affected with broken CNTVOFF_EL2
(has_broken_cntvoff())
Booting with VHE or protected mode(nvhe) (id_aa64mmfr1.vh=0
and arm64_sw.hvhe=0) works fine.
However launching a protected VM with protected hvhe mode panics the
guest kernel:
[ 0.000000] Internal error: Oops - Undefined instruction: 0000000000000000 [#1] SMP
[ 0.000000] Modules linked in:
[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.2.0-rc3-g05f75bd71e0e-dirty #29 PREEMPT
[ 0.000000] Hardware name: linux,dummy-virt (DT)
[ 0.000000] pstate: 000003c5 (nzcv DAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 0.000000] pc : arch_timer_shutdown_virt+0x4/0x1c
[ 0.000000] lr : arch_timer_starting_cpu+0x1c4/0x2d4
[ 0.000000] sp : ffffa6bd9a193c00
[ 0.000000] x29: ffffa6bd9a193c20 x28: ffffa6bd9a1bcf88 x27: 0000000000000000
[ 0.000000] x26: ffff00001be70dd8 x25: ffffa6bd99d85000 x24: ffffa6bd99d85ee4
[ 0.000000] x23: ffffa6bd99d85000 x22: ffffa6bd9a1499c0 x21: ffffa6bd9a1ab900
[ 0.000000] x20: 00ffffffffffffff x19: ffff00001be8b600 x18: 000000000000028c
[ 0.000000] x17: 00000000510f0010 x16: 00000000510f0010 x15: 00000000500f0000
[ 0.000000] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000018
[ 0.000000] x11: ffffa6bd9a8ac000 x10: 0000000000f0000f x9 : ffffffffffffffff
[ 0.000000] x8 : ffffa6bd98822e18 x7 : 0070752d65746174 x6 : 00111ff76e007261
[ 0.000000] x5 : ffffa6bd9ad68078 x4 : 0000000000000000 x3 : ffffa6bd98822a0c
[ 0.000000] x2 : 0000000000000073 x1 : 0000000000000001 x0 : ffff00001be8b600
[ 0.000000] Call trace:
[ 0.000000] arch_timer_shutdown_virt+0x4/0x1c (P)
[ 0.000000] cpuhp_invoke_callback+0x11c/0x280
[ 0.000000] cpuhp_issue_call+0x1e8/0x224
[ 0.000000] __cpuhp_setup_state_cpuslocked+0x1d8/0x2b8
[ 0.000000] __cpuhp_setup_state+0x50/0x74
[ 0.000000] arch_timer_register+0xc0/0x148
[ 0.000000] arch_timer_of_init+0x148/0x170
[ 0.000000] timer_probe+0x74/0x124
[ 0.000000] time_init+0x18/0x58
[ 0.000000] start_kernel+0x1c0/0x3ac
[ 0.000000] __primary_switched+0x88/0x90
[ 0.000000] Code: c80b7d2a 35ffffab 17ffffeb d503245f (d53be328)
The workaround avoids setting non-zero CNTVOFF_EL2 and trapping the
virtual counter to emulate the offset.
In the VHE path (timer_set_traps()), traps are only enabled when the
guest actually has a non-zero virtual timer offset.
However, __timer_enable_traps() in hyp/nvhe/timer-sr.c unconditionally
set CNTHCTL_EL1TVT and CNTHCTL_EL1TVCT whenever has_broken_cntvoff()
was true.
Which causes 2 issues:
1) Protected VMs: kvm_handle_pvm_sysreg() does not find "cntv_ctl_el0"
in pvm_sys_reg_descs and injects undefined instruction exceptions.
2) non-protected guests are trapped all the time even with offset of
zero.
Fix this by adding a check in __timer_enable_traps() similar to the one in
timer_set_traps()
Fixes:
|
||
|
Mostafa Saleh
|
47d3eef780 |
KVM: arm64: Fix timer offsets for non-protected VMs
With pKVM, protected VMs always have offset of zero.
However, timer offsets for non-protected guests fail to take effect
for two reasons:
1) In __timer_enable_traps(), enabling of traps check for
is_protected_kvm_enabled() rather than vcpu_is_protected(vcpu)
2) The vcpu timer offsets were never initialised and kept as NULL.
This is problematic for cases when the timer is trapped in the
hypervisor as the with the case of broken CNTVOFF_EL2, which leads
to the hypervisor and host using different offsets and causing VM
hangs.
This can be confirmed by running the arch_timer selftest which fails:
./arch_timer -o 100000000
Random seed: 0x6b8b4567
Guest assert failed, vcpu 0; stage; 3; iter: 0
==== Test Assertion Failure ====
arm64/arch_timer.c:137: config_iter + 1 == irq_iter
pid=310 tid=312 errno=4 - Interrupted system call
Guest assert failed, vcpu 3; stage; 3; iter: 0
Guest assert failed, vcpu 1; stage; 3; iter: 0
==== Test Assertion Failure ====
arm64/arch_timer.c:137: config_iter + 1 == irq_iter
pid=310 tid=313 errno=4 - Interrupted system call
Guest assert failed, vcpu 2; stage; 3; iter: 0
==== Test Assertion Failure ====
arm64/arch_timer.c:137: config_iter + 1 == irq_iter
pid=310 tid=314 errno=4 - Interrupted system call
[...]
After the fix:
./arch_timer -o 100000000
Random seed: 0x6b8b4567
PASS(vCPU-1).
PASS(vCPU-3).
PASS(vCPU-0).
PASS(vCPU-2)
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes:
|
||
Marc Zyngier
|
2858600ecd |
KVM: arm64: Make timer_get_offset() work in all contexts
We currently have two implementations of get_timer offset(), one in arm_arch_timer.h, and another one in switch.h. These two only differ by a pair of kern_hyp_va(), which seems a pretty weak reason to open-code it. Turn this function into a macro to avoid the include dependency hell on kern_hyp_va(), and make it work correctly in all contexts. Signed-off-by: Marc Zyngier <maz@kernel.org> Signed-off-by: Mostafa Saleh <smostafa@google.com> Link: https://patch.msgid.link/20260808085824.732659-2-smostafa@google.com Signed-off-by: Oliver Upton <oupton@kernel.org> |
||
|
Marc Zyngier
|
62e3bb894a |
KVM: arm64: Add VNCR TLB tracking again
Having established that our VNCR TLB tracking was flawed and having dropped it from KVM, it is time to replace it with something that actually works in order to get some performance back, as the TLBI overhead is otherwise pretty high. The goal of such tracking is to hit the TLBI slow path if there are any VNCR TLBs in the guest, irrespective of their mapping state. For this purpose, we introduce an VM wide counter (vncr_tlb_count) that tracks how many valid VNCR TLB are present. This means that creating such TLB must increment the counter, and invalidation decrement it, and both these operations must be done with the MMU lock held for write. On TLBI handling affecting EL2 S1, a non-zero counter forces the handling to take the slow path to consider the VNCR TLBs. Note that the bumping up is done "speculatively" in order to make sure that a concurrent invalidation will be taken on the slow path. Not exactly rocket science. Hopefully I got it right this time. Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://patch.msgid.link/20260806091026.620700-9-maz@kernel.org Signed-off-by: Oliver Upton <oupton@kernel.org> |
||
|
Marc Zyngier
|
2b7324f3a0 |
KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
A VNCR TLB invalidation can occur on one vcpu while another vcpu is
faulting in this same page. Without correctly handling this, we can
end up with the following scenario:
- vcpu A walks the PTs to translate VNCR
- before vcpu A is able to grab the MMU lock to insert the TLB,
vcpu B updates the S1 PTs with an invalid entry, and issues
a TLBI S1E2 for this VA
- vcpu A inserts the TLB for something that is now invalid
This isn't a new problem, and we manage S2 by having the MMU notifier
to bump up mmu_invalidate_seq on invalidation so that the fault can be
replayed.
We can perform something similar here, and extend invalidate_vncr_va() to
update the same counter, clearly indicating that the context has
changed under our feet. This is safe as the invalidation always happen
while holding the MMU lock for write, and that we sample the sequence
number before walking S1.
Fixes:
|
||
|
Marc Zyngier
|
2393470085 |
KVM: arm64: Sign-extend VA for range-based TLBI invalidation
When the decode_range_tlbi() helper was moved to be used for S1 TLBIs,
the required sign extension was omitted. Add it.
As a result, special care must be taken to not overflow PA bits when
this is used for S2 invalidation.
Fixes:
|
||
|
Marc Zyngier
|
38640bc32b |
KVM: arm64: Handle VNCR TLB invalidation race with vcpu_put() VNCR unmapping
While VNCR TLB invalidation always occurs under the MMU lock,
vcpu_put() doesn't, while it unmaps the VNCR page.
The problem is that the invalidation evaluates vncr_tlb::cpu to
decide whether an unmapping needs to take place (cpu != -1) before
performing it. On the other hand, this_cpu_reset_vncr_fixmap()
unconditionally unmaps if L1_VNCR_MAPPED is set.
These two obviously can race, with a TOCTOU pattern on the TLBI
path, and a BUG_ON() on the vcpu_put() path. And the two can end-up
calling vncr_fixmap(-1), with extra lethal effects.
Move the reset of vncr_tlb::cpu to -1 to a common function, and make
this update atomic so that only a single thread can reset the field
and perform the corresponding unmap. The vcpu_put() still need to
unconditionally unmap the current VNCR to close another ugly race.
Finally, the assignment of vncr_tlb::cpu is moved to be kept in sync
with the actual mapping, similar to L1_VNCR_MAPPED being set.
Fixes:
|
||
|
Marc Zyngier
|
34af2c3e31 |
KVM: arm64: Correctly handle end of VA space TLBI invalidation
Our TLB invalidation by VA code is based on comparing two ranges,
one defined by the TLB, and one defined by the TLBI instruction.
Each range is defined by a start and a size. However, the way the
comparison is done doesn't account for address rollover, as it
compares an address with (base + size). This works nicely until
this expression represent the last page/block in the TTBR1 VA space,
as the result is a big fat 0. And a failed TLB invalidation.
Rewrite the comparison in a way that is immune to the address
rollover (making the end address inclusive instead of exclusive),
and move this into a common helper that is used by both VA and IPA
invalidations, as suggested by Hyunwoo Kim (although the IPA version
didn't suffer from this particular problem, obviously).
Fixes:
|
||
|
Marc Zyngier
|
8c774604b6 |
KVM: arm64: Consider SCTLR_EL2.M when mapping the L1 VNCR page
We record a VNCR TLB even when SCTLR_EL2.M is 0 in order to make
our life easier. But this is not something that the architecture
anticipate.
As a consequence, a hypervisor is free to set VNCR_EL2 to
some PA when SCTLR_EL2.M==0, use it to run a guest which indirectly
accesses the VNCR page, then eventually set SCTLR_EL2.M==1 with
the same VA. Yes, this is odd, but apparently legal.
A common trick in HW is to invalidate the TLBs on SCTLR_ELx.M being
flipped. But doing this is a not a good idea for us (we'd need to
trap SCTLR accesses), and wouldn't scale as we nest deeper.
Instead, use the fact that the S1 MMU being off at the point of
translation is cached in our TLB, and if it doesn't match the current
MMU state, leave the VNCR unmapped.
Fixes:
|
||
|
Marc Zyngier
|
8053393680 |
KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
Computing the effects of a TLB invalidation involves looking at
the size of the mapping cached by the TLB. For S1 mappings such as
VNCR, this is deducted from the combination of the base granule size
and the mapping level.
However, this implies that the S1 MMU is *on*. When the MMU is off,
we indicate this with the level being set to a "creative" value of
-127 (S1_MMU_DISABLED).
This ends-up being misinterpreted by pgshift_level_to_ttl() as it
doesn't handle negative levels at all (the level is immediately cast
to a u8 and only the bottom two bits considered), leading to an
invalidation size of 0. Not helpful.
Tidy-up pgshift_level_to_ttl() to handle these negative levels, and
ttl_to_size() to always return SZ_1G when no valid TTL is present.
This allows the removal of open-coded checks for similar situations.
Note that the check for a negative value not explicitely checking for
S1_MMU_DISABLED is deliberate, so that actual negative levels introduced
with LVA2 and D128 can take the same path if we ever support them.
Fixes:
|
||
|
Marc Zyngier
|
c55bc773b6 |
KVM: arm64: Remove VM-wide VNCR mapping counter
The global VNCR mapping counter is used to decide whether an L1
provided VNCR page is mapped in L0 on any CPU at the point of
dealing with a TLB invalidation. It is incremented when a mapping
is made in the fixmap, and decremented when unmapped.
As it turns out, this tracking has several flaws:
- we are trying to invalidate TLBs, and the mapping is only an
opportunistic consequence of the TLB. Checking this counter to
decide whether a TLB needs to be invalidated may result in missed
invalidations.
- an L1 vcpu invalidating its own TLB (a very likely case) will not
succeed in invalidating the VNCR pseudo TLB because that page is
not mapped in L0 at this stage.
Given that this tracking fails at delivering the minimum guarantees
that are required and is only a performance optimisation, remove it
completely.
Fixes:
|
||
Michael Neuling
|
5d588c6848 |
riscv: lib: Fix ZBB strnlen reading past count boundary
The ZBB-optimized strnlen loop loads one word ahead before checking the
aligned boundary:
REG_L t1, SZREG(t0) // load next word
addi t0, t0, SZREG // advance
orc.b t1, t1
bgeu t0, t4, 4f // boundary check AFTER load
where t4 = (s + count) & -SZREG. When s is aligned and count is a
multiple of SZREG, t4 equals s + count and the loop loads a full word
starting at exactly s + count. If s + count falls on a page boundary
with the next page unmapped, this faults.
Fix by computing the aligned boundary from the last valid byte
(s + count - 1) instead of s + count. This makes the loop stop at the
word containing the last valid byte rather than potentially loading the
word after it. The count == 0 case is already handled by the beqz
early exit.
Also add a pre-loop guard (bgeu t0, t4) for the case where all valid
bytes fit within the first word. With the adjusted boundary, t4 can
equal t0, and entering the loop with stale register state from the
first-word processing would produce incorrect results.
The final minu clamp ensures the result is still correct when the last
loaded word extends past s + count - 1 within the same aligned word.
Fixes:
|
||
|
Alexandre Belloni
|
2cd4d47c72 |
aspeed: First batch of ARM devicetree changes for 7.3
No significant changes this time around. Instead, several cleanups for Meta's San Miguel platform, along with some changes enabling dt-check-style. -----BEGIN PGP SIGNATURE----- iJIEABYKADoWIQSoUT1x3bOSX/nAa8ajM9GZTrjhpgUCanF5jhwcYW5kcmV3QGNv ZGVjb25zdHJ1Y3QuY29tLmF1AAoJEKMz0ZlOuOGmKM4BAIn485+eqqhirbu9AlZ1 vR71X3FozVRs9a5AJkl2ZLQaAPsE5mLKHPBv9b7tQNTjtweWg+ZzSW+dSwi6fvaT T5lTAA== =wBKd -----END PGP SIGNATURE----- Merge tag 'aspeed-arm-7.3-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/dt aspeed: First batch of ARM devicetree changes for 7.3 No significant changes this time around. Instead, several cleanups for Meta's San Miguel platform, along with some changes enabling dt-check-style. * tag 'aspeed-arm-7.3-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: ARM: dts: aspeed: Correct indentation ARM: dts: aspeed: sanmiguel: fix PDB HSC shunt resistor ARM: dts: aspeed: sanmiguel: Fix PWRGD_RMC_N active-low hog configuration ARM: dts: aspeed: sanmiguel: Fix FIO IOEXP interrupt pin Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
Alexandre Belloni
|
dcc9253b5f |
nuvoton: First batch of arm64 devicetree changes for 7.3
Similar to the 7.3 ARM PR for Nuvoton we have a couple of arm64 tidy-ups from Tomer. -----BEGIN PGP SIGNATURE----- iJIEABYKADoWIQSoUT1x3bOSX/nAa8ajM9GZTrjhpgUCanF2rxwcYW5kcmV3QGNv ZGVjb25zdHJ1Y3QuY29tLmF1AAoJEKMz0ZlOuOGm7RQBAITiQe5Y+lq06iGFVoCK uMGOoT2dJ8l7nb/vB+Wq7wcHAQCc+8HzdiIYwg4mAUdu9KBYTa45ENMmc7xCz2ro lgZQDQ== =X0Sh -----END PGP SIGNATURE----- Merge tag 'nuvoton-arm64-7.3-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/dt nuvoton: First batch of arm64 devicetree changes for 7.3 Similar to the 7.3 ARM PR for Nuvoton we have a couple of arm64 tidy-ups from Tomer. * tag 'nuvoton-arm64-7.3-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: arm64: dts: nuvoton: npcm845: Reorder timer0 and PECI nodes arm64: dts: nuvoton: npcm845: Drop redundant timer clock-names Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
Alexandre Belloni
|
ef59e07114 |
nuvoton: First batch of ARM devicetree changes for 7.3
This time around we have a couple of cleanups from Tomer that make way for improvements in the bindings. -----BEGIN PGP SIGNATURE----- iJIEABYKADoWIQSoUT1x3bOSX/nAa8ajM9GZTrjhpgUCanFyrBwcYW5kcmV3QGNv ZGVjb25zdHJ1Y3QuY29tLmF1AAoJEKMz0ZlOuOGmUpYA/RIAIMzFmJ7AAIGeVq6i Obc906cAt8/t5yazfSno0yT9AQCiNUJCJD28vD1PMglfSGyu+cvhjMI/va/SE021 8s9cDA== =kqlH -----END PGP SIGNATURE----- Merge tag 'nuvoton-arm-7.3-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/dt nuvoton: First batch of ARM devicetree changes for 7.3 This time around we have a couple of cleanups from Tomer that make way for improvements in the bindings. * tag 'nuvoton-arm-7.3-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: arm: dts: nuvoton: npcm7xx: Drop redundant FIU clock-names arm: dts: nuvoton: npcm7xx: Drop bogus FIU memory reg-names Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
Alexandre Belloni
|
ff1d40db21 |
Allwinner device tree changes for 7.3
Some changes for old chips/devices and some for recent ones. - A10 PMU interrupt number fixed - A100/A133 gained LRADC - enabled overlay support for sun8i-h2-plus pi boards - A523 family gained consumer IR receiver - H728-based X96QPRO+ gained SPDIF audio output - PinePhone's mpu6050 mount orientation fixed - style fixes New board added: - Baijie Helper A133 - NetCube Systems OpenNMC (dobermann) -----BEGIN PGP SIGNATURE----- iQJEBAABCgAuFiEE2nN1m/hhnkhOWjtHOJpUIZwPJDAFAmpwvNYQHHdlbnNAa2Vy bmVsLm9yZwAKCRA4mlQhnA8kMC8qD/0R7T3AqT3n2HChF6NLv5mGqbJSxmTqG7FN FsJ9YuL+6ooeMRnktXypf1tagaVwZjz31U6LsCEPtmyxMZBrNXW0vE5iukvXVxG7 /F1Ar9vezQ1BVtd5qAdLbsWGQRfxsaTtk38sqYP+m1EObFKaxIKrf6VN8pX94uyM pJFXnIY0uEgHedEIzHphJYJP/y+r0WuvcI2ydpRU2u0yyBIj8JxY+pYvCeG8mw9x QXSZkDrz3ImdsHQqyMDN9lUEsgg/41DL9PyEcaiu0hv0Jiik0hQmX+NRZvo16LmO JZJjpPyVVxIxTGB15Bnh1z8dU+fPcmXxTOYJfDmYEI87Y81nUD1tG3UtyrOsirt2 aler/di3aAPUw9IysEyTU56vrAE2e76iCHhgO/Ba27Wi9HYjnRD4t+xSmLO5LXOv HlcRrzg5VPzlrXlabkuZQbJPfeqoZlwi08NCZxAo5mFeuDWuEDC5qnJzHezouicG DpAMchWZaTr+6wdFOUegZbGeNIp9LqK4Im/ySFmP2pGtBQ6avyLii9vlp52cc5Na banc4LgSigNFJVGKZ48DCk6q9ACfG8MTGLkT0wyRr5/1C4Aqrsd4LBptcsESk2Wv FbAneZj/nIs/Zke+Ek3tuVCx76KOt+2jxeTIp8gd7WWJGOWT+q2I5UBv2qTOvhfA 0Z/dB/ll4A== =S3xU -----END PGP SIGNATURE----- Merge tag 'sunxi-dt-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/dt Allwinner device tree changes for 7.3 Some changes for old chips/devices and some for recent ones. - A10 PMU interrupt number fixed - A100/A133 gained LRADC - enabled overlay support for sun8i-h2-plus pi boards - A523 family gained consumer IR receiver - H728-based X96QPRO+ gained SPDIF audio output - PinePhone's mpu6050 mount orientation fixed - style fixes New board added: - Baijie Helper A133 - NetCube Systems OpenNMC (dobermann) * tag 'sunxi-dt-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: arm64: dts: allwinner: Correct white-space style ARM: dts: allwinner: Correct white-space style arm64: dts: allwinner: a523: Enable SPDIF on X96QPRO+ arm64: dts: allwinner: a523: Add SPDIF output PH pin mux option arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix arm64: dts: allwinner: a523: enable IR on the Avaota A1 arm64: dts: allwinner: a523: enable IR receiver on the X96Q Pro+ arm64: dts: allwinner: a523: add IR receiver nodes media: dt-bindings: allwinner,sun4i-a10-ir: add A523 compatible ARM: dts: allwinner: a10: Fix PMU interrupt ARM: dts: allwinner: enable overlay support for sun8i-h2-plus pi boards ARM: dts: allwinner: add support for NetCube Systems OpenNMC (dobermann) riscv: dts: allwinner: d1s-t113: Add uart4 pinctrl required by NetCube Systems OpenNMC dt-bindings: arm: sunxi: Add NetCube Systems OpenNMC (dobermann) ARM: dts: allwinner: sun8i-h3: Correct indentation arm64: dts: allwinner: A133: add support for Baijie Helper A133 board arm64: dts: allwinner: a100: Add LRADC node dt-bindings: input: sun4i-lradc-keys: Add A100/A133 compatible dt-bindings: arm: sunxi: Add Baijie HelperBoard A133 compatible dt-bindings: vendor-prefixes: Add Shenzhen Baijie Technology Co., Ltd. Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
Alexandre Belloni
|
52b1700b30 |
ARM: dts: OMAP updates for v7.3
- DT support for PRU-ICSS on AM3/4/5 - minor fixes & cleanups -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEe4dGDhaSf6n1v/EMWTcYmtP7xmUFAmpwuDQACgkQWTcYmtP7 xmXGtA//ROU+70rWugsXkpzQdwPpJDaB7SlGJTzdqX0Nic9BKFv2h2mu4VH+7qLp ydLVpY2t6eEgolAfNjUQ2MXNl3qK/QMiIjNGgURHlpAl90YeXlST2bOo7kXDMLgG 9mlOVZyN2Wx5FEUN66ezlvcnTXjQP8vC2kXT4ya+a7ZQ6PL28UwfisD16Fs98gGk m2IgRPPCmCn1o+A2rQ+H+DBwW7p/1oe7t9r2xcFusDmQXx4f8XoghwK0Z5t+qVkk cDDI7poHBAty+sR0jKY6qa62kXnybig/yZeGQrUIX1F+BOivs+Ko7gUiqMYyO5bl AFcsf0LDS+OLa1bhw1Mcua2/03cELYQSxKZQiSVAo9/Bel4tXaYn3WWzH3e2Lw1F 2n+OAGfLWHAz7bIj3VfaurG3JUYNFUWqD6oe7PniaGFDg6EinU9ibwYIFtVT9ZB2 Iug4/9TUzcLONnMjvgz2D5ooUcEx62aIYRPsT9AOX4SjOY+rM/+3Wtg8VZzPKClb deUTvUPLQg1bucWj2RRV0/x56Jae3k4MypZeiXtK5RT+YUrWeNcHzwAqAnhvKglr wpUw6KU39oXF5o7neUk07A41vRuPh6+TP1nebZlPhB/7yjgjyQg2xFT4Fr+A+v1y 43MAyEgZnxjNrF0UXrdTU3xvVx3b41Q1TXgflyAPwWV82+hHDaI= =PThB -----END PGP SIGNATURE----- Merge tag 'omap-for-v7.3/dt-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/dt ARM: dts: OMAP updates for v7.3 - DT support for PRU-ICSS on AM3/4/5 - minor fixes & cleanups * tag 'omap-for-v7.3/dt-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap: ARM: dts: ti/omap: embt2ws: use mulit-led for RGB LED ARM: dts: ti: omap: Correct indentation ARM: dts: ti: Fix typos in comments ARM: dts: ti: Add specific compatibles for SCM conf nodes arm: dts: ti: Add device tree support for PRU-ICSS on AM335x arm: dts: ti: Add device tree support for PRU-ICSS on AM437x arm: dts: ti: Add device tree support for PRU-ICSS on AM57xx ARM: dts: ti: var-som-om44: Add USB Ethernet controller node Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
Alexandre Belloni
|
0b02b8f941 |
RISC-V SpacemiT DT changes for 7.3
For K3 SoC - Enable SD card support - Enable QSPI - Fix reset delay of ETH PHY - Fix PHY ID of ETH - Symbolic PDAM ID - Add SPI controller support - Add USB and PHY support - Add I2S nodes For K1 SoC - Symbolic PDAM ID - Enable cpufreq support - Fix max CPU core voltage For boards of K3 - Pico-ITX - Enable ALDPS on RTL8211F PHY - Disable 125MHz clock on RTL8211F PHY - Enable NOR flash - Add EEPROM support - CoM260 - Add EEPROM support For boards of K1 - Milk-V Jupiter - Enable CPU DVFS - Banana Pi BPI-CM6 - Add initial support - OrangePi R2S - Enable PCIe -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQKvBAABCgCZFiEEtbq4ycMbcRVnAiPcMarqR1lNu+0FAmpupawbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMiwyXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25z Lm9wZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRCNUJBQjhDOUMzMUI3MTE1NjcwMjIz REMzMUFBRUE0NzU5NERCQkVEAAoJEDGq6kdZTbvtuDgP/0+IIPDo/U7U0IhT+dAx Mxr1fWX1M4h5nEmirD8Zsx8TSfvZrpZr5MvazjrHxZ5U2U4ntkqrcoByhIqEy6Dn wz3A8arOEe3BU1zXf4UAPAW0CZA3Bp9rEDgwbgsTfyelSLyeDqaMX8l/8XQLU8Sl f28L5p+5AQota4Cutl36yE/KP6cK+7SBSgXA2Rnb9SXzvwC9cQGuOUq71zUsS7jI FdpYcvyCbLFmUiq2XoeFAdGB04nYs28VWiFnHg7FNdrCqWH6pgi/zxd3QtlTxjd6 oIrp/NsBnx9WAyx9GDhckpqOLt+sA49BjMTArBHmytVBI0ku2kbueQXJIS2J2OEq Cj4jkMD36Mbk21UP/3OOohARxPYWDDsRQ6NzvAMqNnmFdGa2lTCGA2pBsXF6pzYA cgFoSQq3s37ArNWaFxeCgnAnzyUWtEUEA3wcp+04xh4s9a90khxuU/rpF+GuyZwp 5Bfppy9L9dI6BogmfAcMsVHcLd0UhDoC6nokx8QLCtrVKEnpvWHfAtWProzEINfX k9K+f+fLtvL4aWGevKfZZfbMwFRrDaARI03HqW/flUjLBVggoC2FFo63WOfEmvZr ldCmIWM2iDgr7gBTSy8FSX+3FNROyc2xDFhM189crVvK0+LCCMyqGhHFNnk6NYbU NRf7S+rwIN9yrBSUgrX6GCXs =WKqT -----END PGP SIGNATURE----- Merge tag 'spacemit-dt-for-7.3-1' of https://git.kernel.org/pub/scm/linux/kernel/git/spacemit/linux into soc/dt RISC-V SpacemiT DT changes for 7.3 For K3 SoC - Enable SD card support - Enable QSPI - Fix reset delay of ETH PHY - Fix PHY ID of ETH - Symbolic PDAM ID - Add SPI controller support - Add USB and PHY support - Add I2S nodes For K1 SoC - Symbolic PDAM ID - Enable cpufreq support - Fix max CPU core voltage For boards of K3 - Pico-ITX - Enable ALDPS on RTL8211F PHY - Disable 125MHz clock on RTL8211F PHY - Enable NOR flash - Add EEPROM support - CoM260 - Add EEPROM support For boards of K1 - Milk-V Jupiter - Enable CPU DVFS - Banana Pi BPI-CM6 - Add initial support - OrangePi R2S - Enable PCIe * tag 'spacemit-dt-for-7.3-1' of https://git.kernel.org/pub/scm/linux/kernel/git/spacemit/linux: (33 commits) riscv: dts: spacemit: Add cpu scaling for Milk-V Jupiter riscv: dts: spacemit: k1-bananapi-cm6: fix maximum CPU core voltage riscv: dts: spacemit: k1-orangepi-r2s: fix maximum CPU core voltage riscv: dts: spacemit: k1-musepi-pro: fix maximum CPU core voltage riscv: dts: spacemit: k1-orangepi-rv2: fix maximum CPU core voltage riscv: dts: spacemit: k1-milkv-jupiter: fix maximum CPU core voltage riscv: dts: spacemit: k1-bananapi-f3: fix maximum CPU core voltage riscv: dts: spacemit: Make dtschema recognize the etherent PHY correctly on K3 com260 board riscv: dts: spacemit: Make dtschema recognize the etherent PHY correctly on K3 pico-itx board riscv: dts: spacemit: k3: add i2s0-i2s5 nodes riscv: dts: spacemit: k3: add USB controller and USB phy support riscv: dts: spacemit: enable PCIe on OrangePi R2S riscv: dts: spacemit: k3-com260-ifx: add eeprom on i2c1 riscv: dts: spacemit: k3-com260: add eeprom on i2c2 riscv: dts: spacemit: add SPI controllers for K3 riscv: dts: spacemit: add K3 PDMA request numbers riscv: dts: spacemit: Fix phy id check for the phy on com260 board riscv: dts: spacemit: Fix phy id check for the phy on pico-itx board riscv: dts: spacemit: Add enough deassert time for the PHY on com260 board riscv: dts: spacemit: Add enough deassert time for the PHY on PICO ITX ... Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
Alexandre Belloni
|
476906f83c |
New boards: Graperain G3568, HINLINK H28K, LCKFB Taishan Pi 3M,
Orange Pi 5 Pro, Vicharak Axon, Vicharak Vaaman2, Youyeetoo YY3588 New peripherals: eDP support on RK3576 And of course a number of board-fixes, style-fixes and some newly enabled board-components. -----BEGIN PGP SIGNATURE----- iQFEBAABCAAuFiEE7v+35S2Q1vLNA3Lx86Z5yZzRHYEFAmptHIQQHGhlaWtvQHNu dGVjaC5kZQAKCRDzpnnJnNEdgc0AB/9BaMz8DtfWjjLRIQTBoIHDCeflNPO/deS0 Gea4KkofOsLapsflB4WvVs9HAxJfX43LE4xFFqQn947wiFVDA7xV9Z1T9V3DkxiE 5GnvrjYbfDGBtYeAJZmYm3Lq2AA7HeIVAQhgOXEow+6MH5GmG3SRWg8aBplNQC0K pPvLc+AdFyQCLlVVf12iVOeViIZejIEXYGDuofa8euTEUjZxNSlqvxfX/YF5uE2K 1ycQX6MwNLA7x1Gx4GXCytgt+oKTtl42NAQLeIHYwJyinnMd2JY8RrDQBBozENZf YQVWUE53W7W/9OWsLptfjLN5Jya9iMVxMXcsGRvtNe44SyyGnCT3 =0Vz9 -----END PGP SIGNATURE----- Merge tag 'v7.3-rockchip-dts64-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt New boards: Graperain G3568, HINLINK H28K, LCKFB Taishan Pi 3M, Orange Pi 5 Pro, Vicharak Axon, Vicharak Vaaman2, Youyeetoo YY3588 New peripherals: eDP support on RK3576 And of course a number of board-fixes, style-fixes and some newly enabled board-components. * tag 'v7.3-rockchip-dts64-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: (39 commits) arm64: dts: rockchip: Fix rk3566-bigtreetech-cb2 touchscreen property arm64: dts: rockchip: fix label of sys_led for nanopi-r4s arm64: dts: rockchip: Fix the rk3566-radxa-cm3 Wifi compatible arm64: dts: rockchip: Fix Gru WLAN sideband interrupt arm64: dts: rockchip: Add Vicharak Vaaman2 board dt-bindings: arm: rockchip: Add Vicharak Vaaman2 arm64: dts: rockchip: add Vicharak Axon board dt-bindings: arm: rockchip: add Vicharak Axon board arm64: dts: rockchip: Add LCKFB Taishan Pi 3M dt-bindings: arm: rockchip: Add LCKFB Taishan Pi 3M arm64: dts: rockchip: Add Orange Pi 5 Pro board support arm64: dts: rockchip: refactor items from Orange Pi 5/b to prep for Pro arm64: dts: rockchip: rename PLDO regulator labels to match schematic on rk3588s-orangepi-5 dt-bindings: arm: rockchip: Add Orange Pi 5 Pro arm64: dts: rockchip: Add devicetree for the Graperain G3568 v2 dt-bindings: arm: rockchip: Add Graperain G3568 series dt-bindings: vendor-prefixes: Add graperain Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro" arm64: dts: rockchip: fix HDMI-RX signal detect GPIO on yy3588 arm64: dts: rockchip: Enable USB device mode on rk3588s-roc-pc ... Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
Jann Horn
|
fedc88e38c |
smack: fix cred UAF in smack_file_send_sigiotask()
When inspecting the credentials of another task, objective credentials (->real_cred, accessed with __task_cred()) must always be used. Accessing ->cred on a non-current task is forbidden unless that task is being created or destroyed; a task is allowed to change its own ->cred pointer with no synchronization, and changing ->cred should only affect the current syscall. smack_file_send_sigiotask() was accessing both sets of credentials: First tsk->cred, then __task_cred(tsk). Fix it, always access the objective credentials here. I have tested that this bug can lead to a KASAN-reported UAF of struct cred in smack_file_send_sigiotask(), and that this fix prevents the race. Cc: stable@vger.kernel.org Signed-off-by: Jann Horn <jannh@google.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> |
||
|
Alexandre Belloni
|
307b9caae6 |
Amlogic ARM64 DT for v7.3:
- Amlogic AXG fixups for PCIe and NAND - Overall indentation and whitespace fixups - Amlogic A9 Pinctrl & GPIO IRQ nodes - Clock measure nodes for Amlogic T7 & A1 -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEPVPGJshWBf4d9CyLd9zb2sjISdEFAmppuD4ACgkQd9zb2sjI SdGFPxAAwLi5kwLl7ID9WgjCZ/Qqb3XIyfrnFiBJTXydFAmdxqRvzI1d3P0gwukp GXRb+ZegfeqXVXIrUt3X95SPAwx6ajPF7uxAYopxanHPvnhEp7cPZihKoAuJSUHl nuntgyU8048//MLRGizXX1VPL7NilW+uIQAe7ut4AVIvDVzHoSP818Aek7GoyS6D k6+txNZ+gCDIr7RhCXlHXbw2GRNyvi5oguoniSXgy+PhNT3p9k+4Vy7VJSHxzScD ZKaO+qQHsqtmmLDLYuOVKFTCL2unGtIJNpLHDyG6bvhTlFdebYS7Y6XSB8am34KN pPukfCwAxAkmh0JoYTawwwGuh90roqesmyQhMCybs9c1JBMx8f50vrzUosvy65sc M42lBcDfEDVe5bT4H0y83WC2MmDb2gdvkNf4C+c3RQJINVSy67RhpbPOP9L6pptq 3oWY1ZWrcWnpAZSEiWapkvqiHO7KnQw3UaUe+m5T/z/xiXKL212pXxc38O7bmfyC XZlcxtdwo42h6DpYV1sQPf/BbIA8Qr4r8RuE7X8qYkl9CKZvO7MP28TTDiuaUauJ zKOuSSu48qOmUc7LX0tt3P9OBaD7Mcwfqj7KFvgws+3yf5J+deLrW8TjaF6MyoIf bw0xUvX1+Co2mqRyHaF/CU+nGfPfxuH26nvZtcZmSMwnLC4KZPc= =q1K8 -----END PGP SIGNATURE----- Merge tag 'amlogic-arm64-dt-for-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into soc/dt Amlogic ARM64 DT for v7.3: - Amlogic AXG fixups for PCIe and NAND - Overall indentation and whitespace fixups - Amlogic A9 Pinctrl & GPIO IRQ nodes - Clock measure nodes for Amlogic T7 & A1 * tag 'amlogic-arm64-dt-for-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux: arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe arm64: dts: amlogic: meson-axg: Disable pcie_phy node by default arm64: dts: amlogic: meson-axg: Add missing nand_rb0 pin to nand_all_pins arm64: dts: amlogic: meson-axg: Disable nfc node by default arm64: dts: amlogic: Correct indentation and whitespace arm64: dts: amlogic: add some device nodes for A9 arm64: dts: amlogic: t7: Add clk measure support arm64: dts: meson: a1: Add clk measure support Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
Alexandre Belloni
|
7855656ffb |
Qualcomm Arm64 DeviceTree updates for v7.3
Introduce DeviceTree support for the Shikra SoC, its GCC and RPM clock controllers, CQM, CQS, and IQS SoM platforms, and their evaluation boards. Document the Hawi and Maili SoCs. Add the Eliza CQS SoM and EVK platforms, the QCS8550 RB5 Gen 2, Vicharak Axon Mini, HONOR MagicBook Art 14, Microsoft Surface Pro 12, Xiaomi 12 Lite, Motorola Edge 30, Sony Xperia M2, and Motorola Moto G2 device trees. Extend Eliza support with USB, SD card, touchscreen, PMIC, interconnect, thermal, CPU and LLCC bandwidth-monitor, QUPv3, and ADSP GPR descriptions. Expand Glymur support with GPU, camera and EVA clock controllers, LPASS audio, CoreSight, PCIe, USB, IMEM and PIL memory regions, power domains, thermal cooling, and CRD peripherals. Add SoCCP, PMIC regulator, TRNG, and CPU-capacity descriptions. Add display, IPA, camera, USB, audio, crypto, TRNG, CoreSight, and thermal support to the Kaanapali, Milos, Hamoa, and related platforms. Add embedded controller support for Hamoa and Glymur boards. Improve networking-platform descriptions with IPQ PCIe port, PHY, clock, PWM, regulator, and interrupt updates. Update CTCU, display, Iris, audio, camera, PCIe, USB-C, power-domain, memory-region, and thermal descriptions across established Qualcomm platforms. Correct bindings and DeviceTree validation for Qualcomm compatible strings, legacy fallback compatibles, node naming and formatting, address ranges, clock specifiers, reserved memory, regulators, GPIOs, and peripheral wiring. -----BEGIN PGP SIGNATURE----- iQJCBAABCgAsFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmprfucOHGJqb3JuQGty eW8uc2UACgkQCx85Pw2ZrcVSexAAkUYQzdf+LbI2LXMUwhASxt0BcCGFUMnBzi1G B6QXIP/3H6ucb/QXhYAfghuSrd6SPWCmCueS+FiMJst+eEiuvSDPkPiGyMAWs3kM fuQbxSWc1VcAgVCbjABrCHSptmJRU+poRent3raLqgCQJ3oip78mnn3p3SEcv4rg HK4TyjF5EWjzZo6sQWYuS6F3zAeu5Az5ft83Qjd/87PnFYl3A5Y8ZJMleT1o9yi0 eqwBh2XlyMHVZB83Bm6kIRfDFQ+q6CjB/CNCjrjfdXQeKbkYNMnEF3NywIDckPDC L6O1kTuld3L25koRRfMeHq8bWpOTEWLq4UCqvpEVpj352eZPAgFYfd0zudVhjLQP CPmoq+5quRbltq7VxO2x7LWz6vzgrrRevC9n3Eyj6uBioCo+JpcMTns/zDGDrzm/ dl43YwGcOI0+U3m3GXJ9567T9zIEA8CzuOd3tHcmTxGmxMU2y313cwfHqgbqy6K6 NLzToYYPclB6aC44yqBPjOhkP653atqDc6qhhMCix7swoTEUqs780fH/G7X6ammY 9XgUM/pxB3dB37dqy8fBBha0TdQ6dQm25DAN2TULgKcolFzHo+O2vd4jR4KpU2eg 3L+pdMUZgF0bvrlqpR9Q8z2TYpIkL/Z5Tc/eEdI6WWF9YXF0TV+iI/7U6S/a+ZJi gfrBpeo= =ZLfL -----END PGP SIGNATURE----- Merge tag 'qcom-arm64-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt Qualcomm Arm64 DeviceTree updates for v7.3 Introduce DeviceTree support for the Shikra SoC, its GCC and RPM clock controllers, CQM, CQS, and IQS SoM platforms, and their evaluation boards. Document the Hawi and Maili SoCs. Add the Eliza CQS SoM and EVK platforms, the QCS8550 RB5 Gen 2, Vicharak Axon Mini, HONOR MagicBook Art 14, Microsoft Surface Pro 12, Xiaomi 12 Lite, Motorola Edge 30, Sony Xperia M2, and Motorola Moto G2 device trees. Extend Eliza support with USB, SD card, touchscreen, PMIC, interconnect, thermal, CPU and LLCC bandwidth-monitor, QUPv3, and ADSP GPR descriptions. Expand Glymur support with GPU, camera and EVA clock controllers, LPASS audio, CoreSight, PCIe, USB, IMEM and PIL memory regions, power domains, thermal cooling, and CRD peripherals. Add SoCCP, PMIC regulator, TRNG, and CPU-capacity descriptions. Add display, IPA, camera, USB, audio, crypto, TRNG, CoreSight, and thermal support to the Kaanapali, Milos, Hamoa, and related platforms. Add embedded controller support for Hamoa and Glymur boards. Improve networking-platform descriptions with IPQ PCIe port, PHY, clock, PWM, regulator, and interrupt updates. Update CTCU, display, Iris, audio, camera, PCIe, USB-C, power-domain, memory-region, and thermal descriptions across established Qualcomm platforms. Correct bindings and DeviceTree validation for Qualcomm compatible strings, legacy fallback compatibles, node naming and formatting, address ranges, clock specifiers, reserved memory, regulators, GPIOs, and peripheral wiring. * tag 'qcom-arm64-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (244 commits) arm64: dts: qcom: eliza: Describe the ADSP GPR node arm64: dts: qcom: eliza-evk: Add support for USB and SD card dt-bindings: arm: qcom-soc: Allow WSA88xx speaker compatible dt-bindings: arm: qcom-soc: Validate nodes with fallbacks dt-bindings: arm: qcom-soc: Document more of existing legacy style compatibles dt-bindings: arm: qcom-soc: Include Eliza, Kaanapali and others in SoC names arm64: dts: qcom: eliza: Enable cpufreq cooling devices arm64: dts: qcom: glymur: add SoCCP DT node arm64: dts: qcom: glymur: fix SoCCP memory mappings arm64: dts: qcom: mahua: Add QREF regulator supplies to TCSR arm64: dts: qcom: glymur: Add QREF regulator supplies to TCSR arm64: dts: qcom: glymur: Add CX power domain to GCC arm64: dts: qcom: glymur: Drop fake PCIe phy 3B arm64: dts: qcom: glymur: add TRNG node arm64: dts: qcom: glymur: enable ETR and CTCU devices arm64: dts: qcom: glymur: Add PCIe port compatibles and ports arm64: dts: qcom: smb2370: Disable SMB2370_2 by default arm64: dts: qcom: eliza-mtp: Enable touchscreen arm64: dts: qcom: purwa-iot-som: enable video arm64: dts: qcom: purwa: Override Iris clocks and operating points ... Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |