Commit graph

1,447,411 commits

Author SHA1 Message Date
Namhyung Kim
d9db9c8db5 perf test: Fix perf stat --bpf-counters on hybrid machines
The test constantly fails on my Intel hybrid machine.  The issue was it
has two events in the output even if I only gave it one event.

  $ perf stat -e instructions -- perf test -w sqrtloop

   Performance counter stats for 'perf test -w sqrtloop':

         910,856,421      cpu_atom/instructions/                (28.05%)
      14,852,865,997      cpu_core/instructions/                (96.79%)

         1.014313341 seconds time elapsed

         1.004114000 seconds user
         0.008174000 seconds sys

Let's modify the awk script to add the values for each line and print
the total.  The variable 'i' has a number of input lines that have valid
output and variable 'c' has the sum of actual counter values.  That way
it should work on any platforms.

Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-04-01 14:50:53 -07:00
Ian Rogers
9b6c479c5f perf tests: Write test files to tmpdir
Writing to the test output files in the current working directory can
fail in various contexts such as continual test. Other tests write to
a mktemp-ed file, make the "perf script task-analyszer tests" follow
this convention too. Currently this isn't possible for the perf.data
file due to a lack of perf script support, add a variable for when
this support is available.

Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-04-01 14:50:53 -07:00
Ian Rogers
83c338369a libperf cpumap: Make index and nr types unsigned
The index into the cpumap array and the number of entries within the
array can never be negative, so let's make them unsigned. This is
prompted by reports that gcc 13 with -O6 is giving a
alloc-size-larger-than errors. The change makes the cpumap changes and
then updates the declaration of index variables throughout perf and
libperf to be unsigned. The two things are hard to separate as
compiler warnings about mixing signed and unsigned types breaks the
build.

Reported-by: Chingbin Li <liqb365@163.com>
Closes: https://lore.kernel.org/lkml/20260212025127.841090-1-liqb365@163.com/
Tested-by: Chingbin Li <liqb365@163.com>
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-04-01 14:50:53 -07:00
Arnd Bergmann
dc26ea325f STM32 Firewall bus for v7.1, round 1
Highlights:
 ----------
 Stm32 SoCs embed debug peripherals such as Coresight. These peripherals
 can monitor the activity of the cores. Because of that, they can be
 used only if some features in the debug configuration are enabled.
 Else, errors or firewall exceptions can be observed. Similarly to
 the ETZPC(on stm32mp1x platforms) or the RIFSC(on stm32mp2x platforms),
 debug-related peripherals access can be assessed at bus level to
 prevent these issues from happening.
 
 The debug configuration can only be accessed by the secure world.
 That means that a service must be implemented in the secure world for
 the kernel to check the firewall configuration. On OpenSTLinux, it is
 done through a Debug access PTA in OP-TEE [1].
 To represent the debug peripherals present on a dedicated debug bus,
 create a debug bus node in the device tree and the associated driver
 that will interact with this PTA.
 
 Plus some fixes.
 -----BEGIN PGP SIGNATURE-----
 
 iQJRBAABCgA7FiEEctl9+nxzUSUqdELdf5rJavIecIUFAmnEEb8dHGFsZXhhbmRy
 ZS50b3JndWVAZm9zcy5zdC5jb20ACgkQf5rJavIecIX6EA//bOrRFlKpMFFTWuKB
 ueVMShipitZ0rwEz8zyCfNfKZ15hIASVb1DrnnW4RK68Q2zbuE3ZG373TM4Q7InA
 GiX4fqW2LMaJElHAzZA39bjgrvtvfyDBc/LKokbJO53HiQFrwFDfzsoTp03Juo5z
 +hoQcQaHRef1HSwJR2puj23oNYnGDxhoqUEkUAF/RQYQk32im5MUNUNSstXrKac0
 lL5adScbHdQ6YmhQ4jB/mQw9kWBEdSpC/HB3S/rbBSveGRgL2kedLnhr3z9kDbEE
 YnikgpR8LCPfwzp/bXMCRdr4eR4o8IbzzTpV/ZY6PBlKJh8DM9wM/zz+mx4AZ8ku
 g9uQpxUZp65N1We19+fsAylP50m3dnwbvite0gyLffjjWz/kc5N3FWQOcl4pIrF5
 7l1EjkbFkDAQnaec7a+OZoUd8Xw+KAd8nSBtAzpQROspxkTxmPd3gQxuAX3U3xn3
 FBYO9hSIWQ8VTMaC0bHABCybuNTBHehE20AlQBP26SA+RfooCHq8aEIqG9/J8UJW
 x9Sqja1CMZ3/MnLMbz8cmrR26GZZPDnwgErpH9mxHIUDEMaBaxE7M/raURCALkY0
 qiOJNzXwYySEkPIHQ/b8VapiKE/v6lij+XAQWk6LyVKMOu2LD0n3Zaf+tUmEc/TF
 Df6L0gSS/YOmuEe2yHSYji8b514=
 =f7UB
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNku8ACgkQmmx57+YA
 GNm+3BAAogWy8Imbks8fi/3AZPwMx3fbCG5Pk92ObuXGP8a2u6pbuFTMah1ZakWD
 1jeHK+Z0LUwsS9N/YQ8CpgT5cgklF7RZUcUDKQqTQMhFMzyBoVFJChdMHxHgmajx
 XD/2t8bC5EfwytnLbfeOqaYB6CpdikA6cMlLA8pJzggD+g5zHWvGIOvfYqVCe9KE
 /XO1f3yuXB2oXShml+pdEuXzuqBd87lxpS+9sD+24AcBNzpPbZ2P3Nkubn8TEJ3K
 AtPF2vAB244YLTFOjXOGDUbIOrr2duflUSw3sNEziGrNot+l+DbD/+tRCs8zeIvx
 N5Q6pyXg6AR+oNcdFW9s3qxn5DCUedIdkNHIF0EXjVqcGdu9/Zxmu1IlnAmFrBy3
 vOOOMgWCkbMB+bvtApdhzvhmiVuNxCuTesp2QdTxg9jbfXYUaMfzwoAf4L9uAYQT
 ZLzulpYjkR6xAKD5MJJSn9e58Ut01FLEdomY39f069VIIPMkNvjec4P/Ll1xrSaj
 rS6ni8VAGZwbD+Y6PuYXo4t+D613AzHx4VkaePpRXbihAUOhmuJ9h9p95egNxi+9
 MRVVjtq7DJgJ+BwH/QteCmvQrqu1lkMoWpHxDQJwkBDgWDU1+c6RnvHMibwq5NX1
 Ribleap9ANiMwZhPWrWIaH/wBxOanuL74SWCUvWKlCuyjLG3ITw=
 =gD+b
 -----END PGP SIGNATURE-----

Merge tag 'stm32-bus-firewall-for-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32 into soc/drivers

STM32 Firewall bus for v7.1, round 1

Highlights:
----------
Stm32 SoCs embed debug peripherals such as Coresight. These peripherals
can monitor the activity of the cores. Because of that, they can be
used only if some features in the debug configuration are enabled.
Else, errors or firewall exceptions can be observed. Similarly to
the ETZPC(on stm32mp1x platforms) or the RIFSC(on stm32mp2x platforms),
debug-related peripherals access can be assessed at bus level to
prevent these issues from happening.

The debug configuration can only be accessed by the secure world.
That means that a service must be implemented in the secure world for
the kernel to check the firewall configuration. On OpenSTLinux, it is
done through a Debug access PTA in OP-TEE [1].
To represent the debug peripherals present on a dedicated debug bus,
create a debug bus node in the device tree and the associated driver
that will interact with this PTA.

Plus some fixes.

* tag 'stm32-bus-firewall-for-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32:
  pinctrl: stm32: add firewall checks before probing the HDP driver
  drivers: bus: add the stm32 debug bus driver
  bus: stm32_firewall: add stm32_firewall_get_grant_all_access() API
  bus: stm32_firewall: allow check on different firewall controllers
  dt-bindings: bus: document the stm32 debug bus
  dt-bindings: pinctrl: document access-controllers property for stm32 HDP
  dt-bindings: document access-controllers property for coresight peripherals
  bus: rifsc: fix RIF configuration check for peripherals
  bus: rifsc: Replace snprintf("%s") with strscpy
  bus: stm32_firewall: Simplify with scoped for each OF child loop
  bus: firewall: move stm32_firewall header file in include folder

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:49:17 +02:00
Arnd Bergmann
720d813b53 Arm SCMI updates for v7.1
This batch mainly improves SCMI robustness on systems where the SCP does
 not generate completion interrupts, and includes two small follow-up
 cleanups in the SCMI core.
 
 The main functional change adds support for the new DT property
 'arm,no-completion-irq'. When present for mailbox/shared-memory based
 SCMI implementations, the driver forces SCMI operations into polling
 mode so affected platforms can continue to operate even with broken
 firmware interrupt behavior.
 
 In addition, it
  - replaces open-coded size rounding in the base protocol path with
    round_up() for clarity, with no functional change
  - updates the SCMI quirk snippet macro implementation so quirk handlers
   can use break and continue directly when invoked inside loop contexts
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEunHlEgbzHrJD3ZPhAEG6vDF+4pgFAmnD/hEACgkQAEG6vDF+
 4phtuxAAgkZT4P4EjKcS8T0FcACZ9Fi6TbICEiVpIATPscf9vi0zstRvqZ/TpUCL
 0UU/WPnBWITAC2FLemUmbK9uUJTO7De+lpoTaFLdaA/Eke/RnsQIYCxcTlN3Kuss
 MAmMYZwq/nWrz6v2yGygaoP7+VGWayoWDklJVRSsRyUAPw+3+QeIYSPCeeHYshCw
 JwAZ1KCfBodTsecxEF902o6eyJrLfIrYUo0FvTQPxchG82wKfFLGCigXjGVQnc0S
 yeXdkefXDQRq6MQKChTrcjL8ZXl+U7oqTcOXLF6IFmcpKn4gSp6Knkw9FzLjIdwR
 fz6/vdRA2sOcpYYC6CFD4qeCBwpO6D1NMAP656FdDOOmU3KU3u2msRE/XD94QCDE
 e8e/PaOY1CAzF4V659dgp0kQSkWdX4foKztTRpiBTdTla5jwmjDRbnezczcUKJtb
 2DeQBprMLwMpuufo3bZM4LNZBi6qIl8uZzVkAYgE7abQ8FkRiWcy2eSnl2SoaR9p
 IPrJlsS8RIugQQl8AzBDV7C0XAtK7yAhpoDzLmGaP/PJYLhN4dVFr5pMDkHEyrpQ
 brSflQwE5sNZ8FAg/X4elgi05i/wevvXtDh/qkTtTlAC+yhKIb1DPnJy9fuH5/P4
 JyPY3FxVzWbXUnaZr/x+C/5NUdSBOa2U6i/DE3AP+t5lvUZAb2A=
 =5Gaw
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNkrAACgkQmmx57+YA
 GNkh2w//bBVuOadMZl5bWM302Qc7qIP7N1nOCPhUl7YrXoc4NQFMbCMbfyun9QzS
 /gdazRvcYMQJE5p14/qhKMLXzUdpA5Ry25DgcQRaQNVk57iIN997XyznNs2OxI8o
 TllzhW9Okf0cdZIhiY9XP3gQJsZ8VTGuG0beGdKv+DqkT3P9XsVUiQ5trj+0y4af
 J2cVOBnzDvzxKplZ1ll1DLJDvy5xwmDEcQi+hAq1uAOMwd4izxxrQK7iofRn/495
 35bCFH7vigBEG3XASByNtbBktvgPRUMaxDLLUbluMTUxH9tqj9uzyi5qxkmOp2Qn
 azlAEyv9hxCnVC2Nnfoh8W4GpPVJ1znevakBvIjzeNYlh1SMPHG7cedvrEpzerFQ
 PiRKrgqP2Shx1D1dsgv7kib5lXhO0hYmIb/oe74Rqox4pIxnboKxC/IZ9ChPIazp
 LUGfHk6k/uEWHYFm3luCV8PPsSvNlAr7RsH9Q2qDshjoXnq6WnUVTE3n9tQ97gjD
 RnpWCKlQkh0OUSMGafWbswlvfyvTtUTa8c6bFo5HEimQiWfZYeADiJJf88+VMq7m
 Yy+8VjjWyOqdAqKuISLVnWXsEHJwiQRM6hxUjYmdQsfJG8FGLWU5e1c+2kVHB9Ff
 nB1OBxTXwbj9I2KSRBesrS92fVj0u95OmPh51dScnURFjL7d0BQ=
 =vQ0q
 -----END PGP SIGNATURE-----

Merge tag 'scmi-updates-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers

Arm SCMI updates for v7.1

This batch mainly improves SCMI robustness on systems where the SCP does
not generate completion interrupts, and includes two small follow-up
cleanups in the SCMI core.

The main functional change adds support for the new DT property
'arm,no-completion-irq'. When present for mailbox/shared-memory based
SCMI implementations, the driver forces SCMI operations into polling
mode so affected platforms can continue to operate even with broken
firmware interrupt behavior.

In addition, it
 - replaces open-coded size rounding in the base protocol path with
   round_up() for clarity, with no functional change
 - updates the SCMI quirk snippet macro implementation so quirk handlers
  can use break and continue directly when invoked inside loop contexts

* tag 'scmi-updates-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux:
  firmware: arm_scmi: Support loop control in quirk code snippets
  firmware: arm_scmi: Use round_up() for base protocol list size calculation
  firmware: arm_scmi: Implement arm,no-completion-irq property
  dt-bindings: firmware: arm,scmi: Document arm,no-completion-irq property

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:48:30 +02:00
Haoxiang Li
a0ac82cbed
clk: spear: fix resource leak in clk_register_vco_pll()
Add a goto label in clk_register_vco_pll(), unregister vco_clk
if tpll_clk is failed to be registered.

Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Link: https://lore.kernel.org/r/20260325062204.169648-1-lihaoxiang@isrc.iscas.ac.cn
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:46:18 +02:00
Arnd Bergmann
c7091fd5eb Memory controller drivers for v7.1
1. TegraMC:
  - Few fixes for older issues - missing clock on Tegra264,
    missing enabling of DLL for Tegra30 and Tegra124.
  - Simplify the code in a few places.
  - Rework handling interrupts on different variants and add support for
    error logging on Tegra 264.
 
 2. Drop Baikal SoC bt1-l2-ctl driver, because SoC support is being
    removed tree-wide.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmnCj2oQHGtyemtAa2Vy
 bmVsLm9yZwAKCRDBN2bmhouD15akD/9ROv+8UYFkZe1uHd1vmPe+x9DmSq2t0TUz
 dycW91jyahQ2Tb57HSayBObLDN/xKK985+DCqILZsXUtY1KpkyMfS4nfKUM9mQA0
 ihNm/IPVx2soGG/qPMBOMYMK+RObXGeA5pXWbz6T7ty94sRPDPk5HSMiDLRBk9xk
 Df48KitcQM/jAzE/y4kWcqA0Mynb6Ngs6yr0fqkd+YtRbEzq/sgAzhIlfoPyzdOC
 5+lNme3AFJ0EM7a3jclF0Wt2jGZAHp7gbINBRhiDqLL8bve2PT4en92/sKub1g+n
 Vqp0A7W/wfGg8DOmYzj/9AjhWP4B6Omwm8/2wCNTHXRrViAqosKj5E0i7+s+zNbC
 D5kd7d3rdIfE4PfIl5zRmgZ9Z5pMhJvun6mc70+EkDfWuO6zDx6xYS7UxyQELw2d
 F+vMJI9rnjBR26fUyNeQUrChWR7U2H3UkwVQp7OUv7ieGNPB2F2pQDULHHjamhSA
 PXmJ2R2rwSWAYPA/jrz3zw9HC7432V448RBcg188vTSeobScY81Xdw8XmYgKMNfx
 RTykyDrvHUpraO1FkJmxRFWXHnz0FxwBxFtX8UZsf/Wz98IaUihqAPJnalHHmwUa
 fjAJQwOEEbg4YGpjpA9uadoancNLPsPlS+iwBoPJzULv1tQhRsZ2/TInR9uXweTe
 Ca1QV/YHug==
 =AJYZ
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNkd4ACgkQmmx57+YA
 GNmALRAAs/2faPGjhBgpYnfZp+5Mh9NqaeIekT2Fg6iOUibWihTMpPmTxdZdfo7v
 2jIaE0uDksaXyDDvCeKHhmVumZPNwhVodB2O4cEIN7qUUaRa6iQA9A1L0wKPCMxt
 aqW+YML5yvHRV0QefZ497bDBhSXUvcqRUDePznTwNn4RV1y0cnuNIQTN+lbuiZij
 4WnRNrsWzOiSGZKczJaBPY7X+o54CyLOYDB2UTzHepY7GYmh8/T/FvU2uS0Z5MN+
 mtE5jH5+8QrsPTGXCVE4/2NpYTrr0ODNpSHBH1MYwltxxY0f7Euoo76ShbtAdvDL
 EFnX1OjV+/V9bBVVypQJ5TPDNDcqhMzctupkYO3L6/C9Sh8EKi//7xaoQJKLKTiz
 kGLfKljW85YnbQtpJmXNxJFMcrNxUz+oS+pZJOvARFEwDYOUtTF5BfzxKqqVJIba
 YE9TupN78Slzx0X9+MXt161FVX8SCRa/izRCZTvLS6d1k1WPKV9d6amZT6pxsHXY
 AXeRcX7SEBEG3R/ratgP+MhAC9w1X5wLNbA7XyBy2AKVyJi6uRVvq3iKlKelzqXY
 mK/EK903WNGpJ0jeARDOHTEmeUdy6Ao2+DcztqriZCAFyPEj6+zT/zqPLZwofOWd
 cRtKcwiXs63RLymJj+koxlkhOId7NHgjFu1JiV+oIJbC2vpS0gU=
 =VH6z
 -----END PGP SIGNATURE-----

Merge tag 'memory-controller-drv-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers

Memory controller drivers for v7.1

1. TegraMC:
 - Few fixes for older issues - missing clock on Tegra264,
   missing enabling of DLL for Tegra30 and Tegra124.
 - Simplify the code in a few places.
 - Rework handling interrupts on different variants and add support for
   error logging on Tegra 264.

2. Drop Baikal SoC bt1-l2-ctl driver, because SoC support is being
   removed tree-wide.

* tag 'memory-controller-drv-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl:
  memory: tegra: Add MC error logging support for Tegra264
  memory: tegra: Prepare for supporting multiple intmask registers
  memory: tegra: Group SoC specific fields
  memory: tegra: Add support for multiple IRQs
  memory: tegra: Group register and fields
  memory: tegra: Group error handling related registers
  memory: tegra-mc: Use %pe format
  memory: tegra-mc: Simplify printing PTR_ERR with dev_err_probe
  memory: tegra-mc: Drop tegra_mc_setup_latency_allowance() return value
  memory: renesas-rpc-if: Simplify printing PTR_ERR with dev_err_probe
  memory: brcmstb_memc: Expand LPDDR4 check to cover for LPDDR5
  dt-bindings: cache: bt1-l2-ctl: Remove unused bindings
  memory: bt1-l2-ctl: Remove not-going-to-be-supported code for Baikal SoC
  memory: tegra30-emc: Fix dll_change check
  memory: tegra124-emc: Fix dll_change check
  memory: tegra: Add support for DBB clock on Tegra264

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:44:56 +02:00
Arnd Bergmann
fb5fee1cbc Samsung SoC drivers for v7.1
Few cleanups in ACPM firmware drivers, used on Google GS101 and newer
 Samsung Exynos SoCs.  Notable change is removing 'const' in
 'struct acpm_handle' pointers, because even though the code does not
 modify pointed data, it immediately drops the const via cast.  Also code
 is not logically readable when a reference getters/putters (e.g.
 acpm_handle_put()) take a pointer to const, because the meaning of "get"
 and "put" implies changing the memory, even if that changeable field is
 outside of pointed data.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmnCiMEQHGtyemtAa2Vy
 bmVsLm9yZwAKCRDBN2bmhouD1x0tD/4mDlUO7FilWlNO9WwQSlNDT5lAwejozMEr
 PhP/k5mfDKn0zwXvqjq7dAHE2VP9Odw6o2QpGZRY1+rSGXUPYu0BXP/t7J1Q//ND
 MQittsPNqwLdwdSBu88lzV+kzpGYLJumL+f4auIKDER/VyE0f8TRI5Ms61PH2xZ2
 ayXzAeJCj+OCG4Ib8bdzil7L0T48HEfDlhC6d0vjrU7sbnnuC1HtjMhUnzzTjuie
 3C0hd6/mYqRL84m9O0km+DZPkJwS8yXCXl5P2pZqdZsUc1d+BKrKpWuJDBfjugB6
 fw1dFpqIKtphONryMZ8BCJ2vQD/fi0JaUHzh774JVNjVchrKlxW0DF7h1JHzupeM
 uVeiU0nqpanWjkoO3KuKC5et7MBsN+HJ7rfb4BuXtoSYh8OMWdo3nNlLeevn6HeB
 BS6yGv7U7Pwq7eXH2mPPpOlu4Ub2ddwMxXYZHPf2W5f8zfGMzyVjeYqmty47tMYC
 RzNLfPZheNg6RhsyL7BzaU/guiFpLow6c3PYgJuVDrkPotMgK8L0/XR0+xxdVGpu
 Y1DLDdPMyReSPIrA0TwoHjD6TLqoODAehUH+TRrrzCNrRIYkJmJ1GV2VtK1Qpsck
 s76TEa5fE4OXbRA7jlZrK+CeybItl6a/Z/u96yBl/mLbQJ855g8gsZc5SSo7az0z
 lQvvxSb08w==
 =BDkF
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNkaAACgkQmmx57+YA
 GNmSQg//W+MuGGRlNQr5gZPzmDWhisuYj/rJK7I4Lc/Ukg5LTHWJDB9hpRkUPV1q
 5vdArhURcwWpP8tcqz6ouursLiZShOn4bIllb7wPg9dSSEfzW33jytj2tWgFKKXx
 oV3uKrPJcwglwEhPBv57/hC+nk2C5pWUxiwqMrni2L/NZZM7MeM0qtFPUadRVtE8
 SZ3RupwE/eQ2IvFXbAyM7dqzPTO0H0xVMNjnfbMkuVT75316/Oy/d+Eu2aHlL5x9
 T1AydFOTNdMygb3XNNBECTYdUTyJ4bodeKly0EHSZXIvzO3nzjbeY022vka2jLhM
 4wT8ussjGY+SWNc/nEsqdwQVcVRF1Gg6v8qEEyC5S8IG0Ug1x26FbU+iu2dWOkfD
 2MM2cEGsVE05rjlI9rFzPdu6UMl28GFqpGLTEzq4kIYLdutLr6kDnIs9azJbvHuR
 v2y/jJL3TrJlOQ24VsrLmvp/k0Aj14O1qO7BHiNcC9DVJMp8h4cwrgpauE5nJn8z
 kRoYvpAwSvL3A7xlBaiV8shX6LjQrltvYSFZnDFKMqArh0DuoVHrL3vuysiknKdP
 72ghXc17RkxTbvdv971ou/YxYoQ3DYbPA2YlJ7NFeE1SQdp09VK1BFBw5E1pfrN1
 MHSbxmqGKJME1rUTGdZUlbFl6Bf2RooStiwmDvfttIpgkLk9j40=
 =T6Y1
 -----END PGP SIGNATURE-----

Merge tag 'samsung-drivers-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/drivers

Samsung SoC drivers for v7.1

Few cleanups in ACPM firmware drivers, used on Google GS101 and newer
Samsung Exynos SoCs.  Notable change is removing 'const' in
'struct acpm_handle' pointers, because even though the code does not
modify pointed data, it immediately drops the const via cast.  Also code
is not logically readable when a reference getters/putters (e.g.
acpm_handle_put()) take a pointer to const, because the meaning of "get"
and "put" implies changing the memory, even if that changeable field is
outside of pointed data.

* tag 'samsung-drivers-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux:
  firmware: exynos-acpm: Drop fake 'const' on handle pointer
  dt-bindings: firmware: google,gs101-acpm-ipc: add S2MPG11 secondary PMIC
  firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr
  firmware: exynos-acpm: Count number of commands in acpm_xfer
  firmware: exynos-acpm: Use unsigned int for acpm_pmic_linux_errmap index

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:43:58 +02:00
Julian Ruess
29afd0c70d vfio/pci: Rename vfio_config_do_rw() to vfio_pci_config_rw_single() and export it
A follow-up patch adds a new variant driver for s390 ISM devices. Since
this device uses a 256 TiB BAR 0 that is never mapped, the variant
driver needs its own ISM_VFIO_PCI_OFFSET_MASK. To minimally mirror the
functionality of vfio_pci_config_rw() with such a custom mask, export
vfio_config_do_rw(). To better distinguish the now exported function
from vfio_pci_config_rw(), rename it to vfio_pci_config_rw_single()
emphasizing that it does a single config space read or write.

Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Julian Ruess <julianr@linux.ibm.com>
Link: https://lore.kernel.org/r/20260325-vfio_pci_ism-v8-1-ddc504cde914@linux.ibm.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-04-01 15:41:02 -06:00
Arnd Bergmann
b986e98ccd More Qualcomm Arm64 DeviceTree fixes for v7.0
The shuffling of reset and wake GPIO properties across various Hamoa
 devices left things in an incomplete state, fix this.
 
 Add the missing "ranges" property to the QCM2290 MDSS DeviceTree binding
 example, to fix the validation warning that was introduced by the
 previous fix.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmnMNBkACgkQCx85Pw2Z
 rcV7Ew/9HTWGi/VEdxQ74WwKjmKTVNZ1zN78VpIE4LO/5HBUyNCCCxHMLRmzSptM
 nopqcA9wdUTBSJBhBjCPLNmkowCsyKqoa8Wd8fIdzv/quNXOYHzVFUfKLRzfB2De
 WZoz3sJAgoNqObqh/6A+YZ+bem7mAHy0+U5FuJnenyNJObrVJTJRlHileo4y6ufp
 3gqlP9znSloZA8Szn9i1yN3VGcmrafAioMFw4wWvIfrkplJMVY8pyM6MiMSLivja
 34XoxiD3OaDzjfcmZ8xLE0Sy4VB0Cj0i5YlFH+aCy+xmQEAQJnp2Yb55GYTZs/Am
 Mvln825GlKuMX4TK18RUFppPPTqJf6IVUANOGgx5CgDlThq3PX/qNpouRKkpTqr7
 NJG1xB0DpDKGglx1Yl7quR/zvWi5MxGUDpWgGDMjrlcvvlImLHKNocpSlQRf64w/
 36Mxa9kzFuxAgH+XJ6bNK+kewYyV4Ec4FR59G8SukyEgqCz66B/G18wI4qKHF4HU
 XhbB9cOzQhNkrcKd76QcDx0gNWknLgpK1sENqK+OL9LZpzDtAp7/Il/+tV12LogK
 4aVkwBLx2w2Vc8Z45MvQADcs0UIILNeTIwduzogVQogcJi7vCxSKglDFGMUnUzxu
 X7LcO+hRmrwRoRFWYoQaM9GmXzrU6k8h2H4zROJfXY14vLZGhPI=
 =iljH
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNj98ACgkQmmx57+YA
 GNmSWhAAi0AJen2M2A/cfSXEJvHlbk+y8Wf8GR9V0ZOIc9/FmVDxovUSGJTi/0g0
 aDXwj2PmaH2EJ5xnL+mow2U+gTW4NwjYz+WJNQbzZhuu6r2uPoYovVN+8NM0nYws
 pDw8IaD1PWKHOPcum1pLGrG7vEtQ9cGoRL8gXvP4toCWt6pu5yhi5qjqnJxGJKhw
 fYkiWSJOk8lTj8GoxtBrGbXoGGQdsuMqzgiL+n/xLtQezGzR9CZ6G6daSaKAgM9z
 ji35yJFqvQl2/qfeWvWsBbvZtMZ5uxGSYBMxiKUjsuuOu8f2wFOU64mDJLdwaSGG
 YJ3gdu/DGN8+6Q+iQZV5n6ARI0Qcbe94w5Wck96u14uDbeNLDgnEueYKQEzK23mz
 RWrLCErIckH1/cCpuaawEZ8IU3rvMrPXMKRYn96yfO+JhxFY0gpzZsR2odKuCsf+
 E6FE6JWf2KI8rS6JkZyemkvkogg/tjEJKFQ8FJ1M3UY9ZlNe4iI/nC/TPZ3/Lyci
 9+Q6TPPU/LMqNc57JSBLPpT+pA+bvAG9Sde7TWcNFPJKsIHHUBrfjE060VhMAdsd
 B4GdpB14XHZR4UVPmngvi7sYhUGA1Z+HiBuCa3GPxi6/Kozq9vVX9N+po74tsH/9
 tM2g9iOYHHMv9O2hvg4tX1BXPuUW+/xcfK4FTClitoA/aNPzS/Q=
 =HmIq
 -----END PGP SIGNATURE-----

Merge tag 'qcom-arm64-fixes-for-7.0-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes

More Qualcomm Arm64 DeviceTree fixes for v7.0

The shuffling of reset and wake GPIO properties across various Hamoa
devices left things in an incomplete state, fix this.

Add the missing "ranges" property to the QCM2290 MDSS DeviceTree binding
example, to fix the validation warning that was introduced by the
previous fix.

* tag 'qcom-arm64-fixes-for-7.0-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux:
  arm64: dts: qcom: hamoa: Fix incomplete Root Port property migration
  dt-bindings: display/msm: qcm2290-mdss: Fix missing ranges in example
  arm64: dts: qcom: agatti: Fix IOMMU DT properties
  dt-bindings: media: venus: Fix iommus property
  dt-bindings: display: msm: qcm2290-mdss: Fix iommus property
  arm64: dts: qcom: monaco: Reserve full Gunyah metadata region
  arm64: dts: qcom: monaco: Fix UART10 pinconf
  arm64: dts: qcom: qcm6490-idp: Fix WCD9370 reset GPIO polarity
  arm64: dts: qcom: hamoa/x1: fix idle exit latency

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:36:29 +02:00
Arnd Bergmann
14edf33d1b Allwinner fixes for 7.0
Just one fix to make the r-spi SPI controller use the mcu-dma DMA
 controller for DMA instead of the main DMA controller.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEE2nN1m/hhnkhOWjtHOJpUIZwPJDAFAmnJKlEQHHdlbnNAa2Vy
 bmVsLm9yZwAKCRA4mlQhnA8kMKy3EADBWn65Iqkl2SDvRy7UTB94BqCf16jZnI27
 j7jUe8hLPQ94QjRczkz9NuB9/iQoMAXbd+lqf/p8Ku+cRPlnt2Pt6/yBGvdpIBTo
 KBEK3skSabk3FoHvcA1EJc6VyBfack/cloJiall4/IMw73pXFNKirpKhZ6vtDijT
 jS9XexW4eNgV5/LIX1C6Ly+uQRv/5NSGEMf1QE8yNeeafPymRCws0xTIuYb8wSlh
 XrEY3T9X52tUld8/+mUd5UyokIc7K94DrnAXFVSJDwFT4powurI8PIpIa9ZnfzUq
 M3lQFzk2PHpVkNJqoPgGESy2+lYyf3+orP8VABLv8advxkpoHR/mrWgLLv4sJl60
 FdlLhqui3i4/w4ycYmqmEUu98Ef2sOrYB4bVzMHh4ANIVoFyC8PT29K3PdcvM1yK
 0Dhtk02yQRafz4s5h/pl1+nU0RVEga/L1c0Vk7fX7eQCah3xl1KI6i8KURi3vtDS
 g5bRE+x/ASvVHd3pk4wfu0u6gDoCq84JrvNYgivgl9+rypNuh+KRIfaOkJnMxAid
 y9D2//Mh3l3affO1EdaRj0IcGBdoBIIw91g1CUKe0kh5GnzMbnDZfg+7+Hsw314u
 X7qwvVspE7SHc5LpkHNmJiM/e3+Ptz1CYm72caoBAbwZE4MH37qGfrODQqA/CPLX
 QsfYCIIumA==
 =T2us
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNj7sACgkQmmx57+YA
 GNn5kQ//QjTCkaaCqztXhSjjlLgvq54Ck/6O9gV3wt7cZaPOUc628bnkircS91u0
 qwSQqlU4/RCrhu/2I4LsPwkPif1LLXj3dPrqhHqomIjPeIiVGFP7CJwrqddDhqjA
 0YFHy+9sVWnctt3Prff3wFya2N4oECpQBHRL7/j5O3aXBewfBpqqDL0MLs0aWA/k
 n/gREbf7NCAb18l9MlrKCMctj1X24Phm/Q1Am5JuAPEwnWwqHX3fntiXLTN2fNJl
 Jo8LwvhwMPiUn3aVpcwijHR/klb5AErCNp/+aSECXGQdc0A3Y2QqngbvIzX1lqhi
 IPgM7ao2NLeBfnvucjDKZo5I8GieCLbrUKnUNfsH2HAu2aQWqwptXEbTMOMub/m3
 1Ho+s2k9B6IY0EykBuhEoDPDmwkfGYQqI7hZDYpwxWexjKF27sytVYqEgU8CJiNJ
 ksr1cT732Jfig2mr94OhVKyx2cCBx8UwLHcRksReFlkrL6EYOE22HGIfdIDKxgIr
 1YoxUXY6Gvvt+qhOdzChXv4T+AB8cJuKwwgPwIbcB2ZjHfGX5Nt9eXIXq7j2Rd9G
 MMmMICHWFhxsgqiIbWH96Y1ZGd+a8JrDlzymT9qVDIEHynL+ZfIwG1iTHrX56LeI
 FAIyJMk35MXQUYo6P7EkKP3peBlo/q3lAizuI7pHTbSJphD13eE=
 =pJhF
 -----END PGP SIGNATURE-----

Merge tag 'sunxi-fixes-for-7.0' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes

Allwinner fixes for 7.0

Just one fix to make the r-spi SPI controller use the mcu-dma DMA
controller for DMA instead of the main DMA controller.

* tag 'sunxi-fixes-for-7.0' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux:
  arm64: dts: allwinner: sun55i: Fix r-spi DMA

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:35:36 +02:00
Arnd Bergmann
b09719b9b0 Renesas fixes for v7.0 (take two)
- Fix TFA BL31 memory corruption on Sparrow Hawk.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQ9qaHoIs/1I4cXmEiKwlD9ZEnxcAUCacZOwgAKCRCKwlD9ZEnx
 cJLGAQC+ITBQHuHm1t675uUf6KjZi7rtFIHwLuMahmaIx/nKnAEAxDZz74TQrphw
 lDyToZaAM0vfOKSiDgh9USsy5oR84AA=
 =cysH
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNj3QACgkQmmx57+YA
 GNncig/+MCtWCNonRXdzZFWCti+SMimSsAYWYsxLMQ8AcU5WgVbObZFw67CAzH8g
 m8ZCWUpt4oVqqGT0+TA7T5IU9EZj4KEltiNnIDZ9+YYM1BQYZqYaN2nQX3mWEaeN
 LXxfyEZI/Ykc0x5NOH/qeCYQFaLZTHS4spOMlMVX3fLMqw8D/GZBMq802mHW0ope
 2/kYpduqTuy9hjAiNYWwDvl9Ng7glDlcxj9aFFiobJ9h9UvsFR9v16f+YFG4PoJJ
 wgUQ4/mEj5s7O/HbIO6rtS1U9m9eYUemmbAoIxyUtJLEQ32HOTZVsE9gbyJCu2Db
 VVaLl8AUtBySG1dp47/b+ybenJILNCodwyhn6bEM2+Gs11I3ZtZpJ9yOEMIu3ZlL
 6YQXBPnYEGCrI7UVe1VQkwwewZhFMsgglpc4/5tXVKyyhDZIMmUAywofHEWLfBDq
 gnmh/os+sovFDiDcfsmrw8fR3ECwZpxcmQuLZu6QIKKbuLuqCHtAsSS0eznnrf9Z
 V3N2zB+06GbW6oUnakE2GC1tSpv9nQdJcgLZZLfcUvEa5sX6MqJVcMmbhf9ahd1g
 5QYKpUWUL4V8FW1I17opx1BvQNkuQGJ6/dlNGL0qFD7Ay87UjJxYtHPlGgFU3xFo
 3ZqUO38Ih288LNqA6wcpYymj0fyy4OUgp8KhBt9MezUqXIdq5vQ=
 =yCU9
 -----END PGP SIGNATURE-----

Merge tag 'renesas-fixes-for-v7.0-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into arm/fixes

Renesas fixes for v7.0 (take two)

  - Fix TFA BL31 memory corruption on Sparrow Hawk.

* tag 'renesas-fixes-for-v7.0-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel:
  arm64: dts: renesas: sparrow-hawk: Reserve first 128 MiB of DRAM

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:34:22 +02:00
Arnd Bergmann
0a1f536c9f Allwinner device tree changes for 7.1 - part 1
Only minor additions this cycle.
 
 Allwinner A523 SoC family had LED controller enabled.
 
 Avaota A1 board had SPI NAND enabled.
 
 New board added:
 - TaiqiCat (TQC) A01
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEE2nN1m/hhnkhOWjtHOJpUIZwPJDAFAmnJKccQHHdlbnNAa2Vy
 bmVsLm9yZwAKCRA4mlQhnA8kMLtLD/9KMA/u8W1bQcI1bTLi89ikQ4WVXCX2mAnG
 hdHpzUnjrL6HxJF8mAIYcadZBt3TmY+nRPCUgUvKsHh0eAqoz89VIPxdYsqQ8sOX
 8GMaijS/VGM0jP4JYrJDEaeEdT9mjm9eefqIZrxgUXSTw3hj/C6uFxoLvmoC+P0n
 TXxjW5V4+5qQXl1lLMUiJDovqjvhGZYW6c/V1gogQeXFTtUeoyWPYkuuksMCq3ix
 XMWapArA/aBIf4HCDqZ5GbAAm0/jcx6tNcFbN3qWvzHgw/S5gL+dTRKgyw/3GIl/
 1CUBRLHjM5nfyMMtQ1WKX5p+oj99D5/izdZ2CyX4vPn0SDz+mzCGB3x6hg+yIDEY
 URnhds5BDkXmpcFsKIhAbMaVGgkLE+0MvWfRl9/OXwYV3qy7I6cW/9fRbt3YEK2K
 EgGdxFdyyFjXWOYzfN9DKytz1capfboZXDuK4NEpuIXFVl00qgSdpXf73Tf6S7e1
 9tCvhuGyVqHfnilKp3ibiFceVhfaklmpv9GfViix9ETfO3myZ2jaqZl6w3AS0TT0
 3xD6g+zhzyoWv+9gr1TiJ59JcBQhq4ANeaU54xVwVlwsaf8GFD7I0P8u0hHD0V7T
 +McUPtQqPn4i60qoNrXDoNxK42OIpPqqVZNvplPRRq+3mg3MhrFKh3PaalZV0U7w
 0dlJ/s3ysQ==
 =A7Bm
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNiUQACgkQmmx57+YA
 GNn39w/+J+mOmFnVfpoyjpRx/yJZuGPP+aUZxtovzVXrvPXKd6kKqWkwz9bhGoBN
 +FbIWw2ZVppO7dIBJPQt7nU+BIJ6EWlEci91NiR1gVOQDmevwk9IBye5VWgMUUQ4
 0TqFaJNyxytZ7O9H/A4HE4DYZ6ph4TKq4p1DzUAdvZifeSM4OzBVjIXe8H92+Q/w
 7/iIyrFkixHEMriojYOdDN4W08OkB7MQGjm47KyB2LgyzQj3jQY+oLEsL7U6AL42
 qQhU44TgscxO5pxcC3jHPqZ3PdGI/6bS/pv4ISIkE7EF9teXFGjXOduiY3TgQ64S
 HJ9y7yqHUB2dLTjgtlzhvDAwzfhPihddUCUSeet2Excn3ZVqZXqhC0OtcLoBWF6x
 TUrdjXet4AoVrDIobwSORkETYUfSPH0WJpyh88h1Bh/3v58oX5ABuCqd58R6yzvr
 VNPLVRQMIcqJyJ6DKHcCsx1dnZKXzmhyFb+0YGxPqAyHivoRPA42vCTRna01jDTO
 +pV500mKaMx+eFwh7ld3Y7+wqm+8fOe5RXev3z8eJjYvZJ0KPa5uIuSOmVVI3qnv
 rT5n4Ey7sUSFUdceEYVKMlVXheZlD79nLSYnUuL2+UCCqips3kcz+C8QdeqH/Y08
 KruqkTOFS/YsJZa7eOkj142wwgLC1qDpxVjOJX8JEDzzPre0o4c=
 =iSgy
 -----END PGP SIGNATURE-----

Merge tag 'sunxi-dt-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/dt

Allwinner device tree changes for 7.1 - part 1

Only minor additions this cycle.

Allwinner A523 SoC family had LED controller enabled.

Avaota A1 board had SPI NAND enabled.

New board added:
- TaiqiCat (TQC) A01

* tag 'sunxi-dt-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux:
  arm64: dts: allwinner: h6: Add TaiqiCat (TQC) A01 support
  dt-bindings: arm: sunxi: Add TaiqiCat (TQC) A01
  dt-bindings: vendor-prefixes: Add Beijing Ultrapower Software Co., Ltd.
  arm64: dts: allwinner: sun55i-t527: avaota-a1: Add SPI NAND
  arm64: dts: allwinner: sun55i-a523: Add pinmux for spi0 on PJ pins
  arm64: dts: allwinner: sun55i-t527: avaota-a1: Enable LEDs
  arm64: dts: allwinner: sun55i-a523: Add LED controller
  dt-bindings: leds: sun50i-a100: Add compatible for Allwinner A523 SoC

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:08:16 +02:00
Arnd Bergmann
710c166c0f Qualcomm Arm32 DeviceTree updates for v7.1
Qualcomm APQ8084 is incomplete and hasn't seen functional contributions
 since 2016, so drop the platform (for now?). Also drop a number of
 unused IPQ-related dtsi files.
 
 Lastly clean up the RPM bus clocks in MSM8974 interconnect nodes.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmnMOWcACgkQCx85Pw2Z
 rcX0vhAAm6jfQxvLYZIYJq/gMHa7nlENhxcmkrfeouJxRwZlv7O69TuyW9Ei0IPT
 IlN+JkRtWNrEHjVEMZG1+xu36GDTG7VM8fQ9ovnJcGvKxMZwHe5Jneg5gBBndys5
 aR2AnB8w7zp8HlFaa2QP0yRBvx2PPcV7d5jfwOGTL44rSnFd8ZvaeOun5dXdIBHc
 0QMQRn0+jyB08Iv0JqMUZCwn3vZgOGmHgmD9gMIGnqa+yF5ai4g8Lbn67PqEZ5IW
 /niwqvg757TiuZPVBU+Pv2SdFBjB9+iG4wkDcOdPoikLwimk/u4VvUsVufuyPPjZ
 ADWnqG1itNUt+JRVx/oP2m/C2+b9UbpxEgkZk8HXYIbbPGgLp5GN28W42kFQRCae
 4HPC7ZPtncSiy45UuGgGzsySiVZai3XCVgnJQ8mwrrynZ63Gnii8B7mqYb86IYql
 Q4+0u3FLc+06ksl1Ohsvn3EK01oLXnvlxncOWd3Qen4p5Trc/E/5rKc3TwecnVSz
 NJuhiGGVkROwMMk/b716Dz2n0ZPX+S3fjG+TyUx34jdN56E8c9dL8to1PPJc3/3P
 23/PGoLKLxSOePbLYzKT4B9YdsCyeXRkrKpLiDxFgKZFMc/0prs4jJnfihrYUu/e
 WTr3ZNtdTXhlS97SUiRM37Nh97E+L7Fs9tQK2XIKgFpakhBkSpw=
 =l50h
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNiKIACgkQmmx57+YA
 GNkwZRAAqMy2pTJnkGZXWxHAUfROCax/n3EtdK4h7svG8KjEqUSAaXLh0GsrC32m
 CjHy0/Zrxvtx18GBLS+8ijpMf1Fj0vZw7et3TRVBH49nBhMwnd4W00NTojM05kF0
 QRExUDSV9BHDHPQZytrvnbG5DP5R91G/QkeYriLbOzokLAKRYQv/tEdQLYFQr/WF
 oBkjSW3p30scNtTvQNss39z9hep9j5s43n0jXLPwBxp8RM1XtotV9Vt1LmJA/dcf
 ZGfyvyafFTjHQuhTo/0CL7XuAn5vOgBwhwhHZzp6tQKAyP2RzER4UebCwL7/+mJo
 +lD8yyMXdOlbehxmXGyCaGjFUqamHCHCgKe+/NZFGyZmWPi8/cihvaHnXWMKShXW
 BrzIjxTHEgb6KbE98yOvDJE7O3YLAMQUB/fER0aqKCj0rNRTX3Su1ufLQbqMd6SV
 wnQcdUDZ5ej2ZupQ/MUMQKO27PIjgYG2yKZ/xU497k9F6nzXT0q51pyJ+enZqNwB
 Uc8J6bMPWui137ZymUL1wGfeQe9RAZMgCG3256T0L/uZSZreUtwaqMsjlQ5zA3yp
 aueCJBKNKwK/b21HPOwacM+sIMGrdMjJEHvvI3jnIcOxIiY9P9FXXOzfyPTlXDkl
 CHimwaUjz6h9rzULJ42g5rqXX85B3AKr786sIyek9dIj6yKmjuc=
 =odV/
 -----END PGP SIGNATURE-----

Merge tag 'qcom-arm32-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt

Qualcomm Arm32 DeviceTree updates for v7.1

Qualcomm APQ8084 is incomplete and hasn't seen functional contributions
since 2016, so drop the platform (for now?). Also drop a number of
unused IPQ-related dtsi files.

Lastly clean up the RPM bus clocks in MSM8974 interconnect nodes.

* tag 'qcom-arm32-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux:
  ARM: dts: qcom: msm8974: Drop RPM bus clocks
  ARM: dts: qcom: drop apq8084 support
  ARM: dts: qcom: Drop unused .dtsi

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:05:35 +02:00
Arnd Bergmann
e0c2f14a36 ARM64: DT: HiSilicon ARM64 DT updates for v7.1
- Rename dwmmc nodes to mmc to comply with the schema
 -----BEGIN PGP SIGNATURE-----
 
 iQJJBAABCgAzFiEEQeMYD8qOQTc1R/snC8hXbtmJZlwFAmnGM2gVHHh1d2VpNUBo
 aXNpbGljb24uY29tAAoJEAvIV27ZiWZcpG8P/0VIz8r60UcKoPCkjD9cfu1i2PSj
 ENtSpuTLM/A7QPNvdFfKtgKHBks58iq7s6C3qR6e421GVc2h0L6mICECK848uu3d
 MK4NR6wOm6P6VxCfi8F8D8g0KfVnUoRKC83aVf4zpJuFhEfTSWd+JJRw9Pnk9X5u
 AW+G369S18l07yoNni8kNslIbSzOrtJanXhBFi4eZJsfTo+/zvVOsA0E9NOG7E3Y
 zbM2PB2O3I2dTm78UkqxuZPdOBqWk6OLEuMVUoeiikUa2jY7Bzb4flVHSDHbrgDN
 bZV4wi6zUXQ+nFxHsflyxHDufJ4lXvQ+hx2is2T/nxSYTM/QlLojUYO4wfJ0BfIl
 au5UtOccD/ycSK3LbUf/6pru0CNTdesRF+M3nJpZwT4UL5Up/cOkcA4LpPHK6LYC
 cULDJgxk7Y+tOO9aGrpRTohW6Bxw1vHQwSDEyGR9cDo63VqgpEGYSlb0KCb19J3a
 jRIHsIb1I2bsszwKAQu3H0ykjh/eCaHorA1J1xuYp5ToxQb+v+y4yNyTBvH4fwMi
 /mveTD5/7Ed0V3xfjF0C5zKq4Q8H5jTz00exPZXB0man3xtuLGGeMoXm30xF4dor
 JoQByedBVQBWwHEL8bGXMypsbyPsMrsKeoRCN4YnbwD1mSG9a11a11xjEgLj3VLF
 KvaG6Jlg0f+UuMVe
 =dVbP
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNiHoACgkQmmx57+YA
 GNluyg//RoFMl+th8pS3zceIZe7uegZJar2mdmbUMLRNf+e7z11NJ9+1L9V7A1aj
 x2ANcXm3xpk6+GI22suKudQ3zfgnwDGxJs/IXu0BMWyR4bEabkwGYFTugFuHubaf
 TIpDbXIA4ed7ZusLmDC2R1newvcBpkVE2kzyalOqYyNb94Toc0K/xkygc1hG0c43
 D7OdQUopErdSroKMVtO8yB3dgThQqEO3SBXXuWshYgWtYHPId5tB/9vcBACN9DPa
 DpZtAZ5qu9VCqwCkq6LnSW6PlgE/tcys6+wY09tZeS8wN/nSIU88PfSeu/IMfHUY
 65UqWJSzlRR+3nKDRp/c0i9aps/inEU4YE8PRZkVI9cFzVAN43bOmO3NZUXPNoBn
 1I2z06DFbIa/+2+O9G2V7ZLNrvY6JFHjkWgqO5LmyXIlfeVMx17Ehu/Xtit2JAfz
 PIfzQPzsab/SY3ww9VsZv/BSxlM0jf+HuytOXQZvbWcNCku5gIJ3Sv1a102heDYS
 wqvFQ0mVq3eXoLcChPp1xEN4mB23f1z7Hn7CsndPVc+DEGsW5J9hbPMcMIOG5spo
 H4ATvh17m564vlcEKnBajTM4slch5Jtr5PoLkcrzmUlS8pg9LtZWLJ+jTgJ7+Cd9
 3zhrGmST98AW4MzMjcbxbvwboy5wysoTavMIzDyWNG9IJy0F7y8=
 =J1El
 -----END PGP SIGNATURE-----

Merge tag 'hisi-arm64-dt-for-7.1' of https://github.com/hisilicon/linux-hisi into soc/dt

ARM64: DT: HiSilicon ARM64 DT updates for v7.1

- Rename dwmmc nodes to mmc to comply with the schema

* tag 'hisi-arm64-dt-for-7.1' of https://github.com/hisilicon/linux-hisi:
  arm64: dts: hisilicon: Rename dwmmc nodes to mmc

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:04:56 +02:00
Arnd Bergmann
6935cce658 SoCFPGA DTS updates for v7.1
- dt-bindings updates:
 	- Document fallback compatible for Stratix10 SoCDK eMMC board
 	- Document compatible for the Agilex5 SoCFPGA modular board
 
 - Add emmc support for the Stratix10
 - Drop CPU masks from the GICv3 PPI interrupts for Agilex5
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEoHhMeiyk5VmwVMwNGZQEC4GjKPQFAmnLMagACgkQGZQEC4Gj
 KPQ7uBAAgTu4ifShxyIfwlnC7LXxMBbjKvCiDTv7aUQzTyv3eAXG4Vy6YyV07Dw/
 0+ccAZj+dyyRf/vTRNWUYhCmu3X8iTUmlMj1IS9gCwYsBi/YJH5F5ZVUmEXPLm7m
 gR/AYgdWUOdM1dOm6NsPNL+lRS9yjN4mkNq2rKZa+/VdSf6I9ErkOauVmaGAGTiD
 72MpzQ+0UvAIrmKXhgELLlgBwVzQBQfbLEYGIbys4UgzIKs7EmtFXnQ9XSM0PGPB
 DZwZRrOWPVyTo7wxNZxQsnSKxDwGY2ZLQZQ6rg7TqY5FKnqg9XDJyMBWkhVM/Jhh
 Fry1/DVUCH/xuljSzppKWEccZ9HqZRlTTFfN2FshVJ8pMco7A6CrHdpC/3ZcTvHb
 pmtFdr6hdPxXDZVVa4AXkp7dp+n5ikwCHh+luoww+Vk29KBcFYqQBytgQ9WRLQZU
 X34CnbCKOvvRoMnkpmq0nblJeyPnY+Ibn9/dBlFqYjJ/lUsfCudD5/FVjDmRoDhe
 eriH4p2zDo3hYrB0vuKlGEHYLpa+j4n9pJ8qAHSPp5YVVvqpHJGWKO81kAcAJfPn
 IyUOl1SSUDdJIVO5AZDEsze5FWQwshz1BHUAMeWFOw4Hz/5QyqzTP3mVXQqSgRp+
 ykiCasMFsUDkZmAmVql/60LgmhBoi4SM5tDNyGQl1qyIEm+igAU=
 =3/wH
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNiDkACgkQmmx57+YA
 GNnbWQ/9HOxDXWo5g8CKDhuC3EyMQn8W/UXiS/pjulNECTpLwQQS42DKVhgfMogy
 AMyh4jqr2KENCGnICdtDDRqTKAOMdngOyr5nB4Wmit2gGo9EdW/52Y3PnygfDBiT
 hAjQh7MimD9vag8e6S/8o51pZwZIpp3wDlGTO5vhWDYTWRN0Ia0Dvq8SSyHdcEnL
 WMj3tFkjVfiEAmVZSl3V34EuWwXZrTLetipJEdasSsKI0WTyYaApDv3jFdMjAMDu
 tvQh2hf0mZgiuU30yAZ4Be6n93QV2oKbRPDEyFFKi5ig7TeL5+hMfaA9APegjWoY
 LAqd9PNqn2katag8kA4Ve1NceHwPDcgQ6or/MNU+x7WN0fSEnQa1bp9xd//bCN8e
 Omag/xf7owWbQgFnoi7lubbj+8dX2QczdZMh5vQ6vBw7aL/qPVp7Zjs1rLC7P1n1
 O+Hx2b1x+GWK0wP62xT4zmkoNfllFfl62VAUk29DiGXFcaV5JjSt7OIbwBOhm0uK
 ouqzdFXiMO/9hCIeQlI4zOvi55twMNmgLAuz2LxCxCSJ5UYTkCrAiPyG//nQAbr8
 4tQeVEEMgictas/gxRUQ/70jOy+OsBw3MDzUKeEb1UDBeLACbJlaOFHsIrJF3z4v
 ZyF58kA7oFiI89TvF69EPrkCCXY993aQzrS9jXnQZXiVN2LpnmI=
 =6ggO
 -----END PGP SIGNATURE-----

Merge tag 'socfpga_updates_for_v7.1_v2' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into soc/dt

SoCFPGA DTS updates for v7.1
- dt-bindings updates:
	- Document fallback compatible for Stratix10 SoCDK eMMC board
	- Document compatible for the Agilex5 SoCFPGA modular board

- Add emmc support for the Stratix10
- Drop CPU masks from the GICv3 PPI interrupts for Agilex5

* tag 'socfpga_updates_for_v7.1_v2' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux:
  arm64: dts: intel: agilex5: Drop CPU masks from GICv3 PPI interrupts
  dt-bindings: intel: Add Agilex5 SoCFPGA modular board
  arm64: dts: socfpga: stratix10: Add emmc support
  dt-bindings: altera: Add fallback compatible for Stratix 10 SoCDK eMMC variant

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:03:50 +02:00
Arnd Bergmann
9988201705 T-HEAD Devicetrees for 7.1, part 2
Additional updates to T-Head device trees for v7.1:
 
  - Enable the display pipeline for the TH1520-based BeagleV Ahead board
    by adding the HDMI connector node, connecting it to the HDMI
    controller, and activating the DPU and HDMI nodes.
 
  - Add coefficients to the TH1520 PVT node as the values in the TH1520
    manual differ from the defaults in the driver.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQSy8G7QpEpV9aCf6Lbb7CzD2SixDAUCacidFQAKCRDb7CzD2Six
 DFkHAP9NsRtmq+55EDQgvc47B4L3tdSNnglbQ7EnASs4ralNMAD+LWr0aWKNCtzz
 OihmHGJ2Rn47huwl3rz3cJ2zsf1txQ4=
 =TrtU
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNh/4ACgkQmmx57+YA
 GNlSGQ/+I0hB1oQHRhNnFc1S03ZCj0XjGL5+VGfCncgcCbHpWdD9wgRygjhxjTjK
 /+OKefyzCwO637UTyRcSuRwnYSuan0p+X+QA35BE/Pg6XBcBe759yrndUH+DaTUo
 JJBHFv2D3d7vUcBggPVjOIZt6auVC9MXz0D1pL5LJYNxLzDKLsvObGUzCE5AUMZ/
 HDuyF9C5yywLpKLLLpT6kO6fjcMJ4jGMNcO9XhsQmMUjIJzS0ZVHMETJXt96BX9L
 vKbySxeMn9zg3dK6byR+lnVFFFlhW4/9MaiqzqM770+DcE1lWBa7Of3Hl8CkYq99
 B2u9QUYSVUnHGvzWVjfHevFKWa5cvWVNaZ+4uY14KNOqu+3l0kvgwtmEjxUToZJN
 NASk/qh8weMkORqLytHymsTLsFF/IQ0IyPcXWH562IhTshPVrzMO7TRrVuUw4+nq
 9E79WQGR9Zf793fB7YBWzSnH9Nq8kinS7eInoFlLDiYFS14MrpKykNHxHyolG7TA
 zxZp4CNn7WrPJc4UOEb0cRwzzWjyyZMRJFVec3/R8X8g8nP3DShHXJPtwNGGfqKM
 fiZ5weR4Lf3Zj/vStiENd/EUwELmL0oe5670XlhAr9tOghCVu2JbToGg1S3Cm2f+
 n/Jcwh5bESP/IV6PGh7TAriPQmy2jmb3J0Ah4wpz7Ess3t4dzXc=
 =Lzra
 -----END PGP SIGNATURE-----

Merge tag 'thead-dt-for-v7.1-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux into soc/dt

T-HEAD Devicetrees for 7.1, part 2

Additional updates to T-Head device trees for v7.1:

 - Enable the display pipeline for the TH1520-based BeagleV Ahead board
   by adding the HDMI connector node, connecting it to the HDMI
   controller, and activating the DPU and HDMI nodes.

 - Add coefficients to the TH1520 PVT node as the values in the TH1520
   manual differ from the defaults in the driver.

* tag 'thead-dt-for-v7.1-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux:
  riscv: dts: thead: beaglev-ahead: enable HDMI output
  riscv: dts: thead: th1520: add coefficients to the PVT node

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:02:52 +02:00
Arnd Bergmann
d2be897ff9 - Add power domain and reset for SoC
- Add GPIO for both SoC and Radxa Orion O6 board
 -----BEGIN PGP SIGNATURE-----
 
 iQHLBAABCgA1FiEEE9MyVaemtW1m4wM6rfNrQFP6hVAFAmnKMQ4XHHBldGVyLmNo
 ZW5AY2l4dGVjaC5jb20ACgkQrfNrQFP6hVBFHgwAgMcA3aiQyJlK2qoovziTXWrb
 9lPOXFthuNmoqlVUs7cYS/A3n/zkmIroc9tZ9xgMqHk0VfUdrvWs7R65+cNvQndE
 OumWt60WpRP3oT6l6zD1K/7lrFioBAs41zAyPzmtCFYeFwVrIig3nnrOaHp5+8H6
 Wc1gzARVhq7OhwP5+uct+28NPyYGkKov+B03ky1RFIcD8DnAha+19W+tVM5YI8X3
 cDESQJTw1TSTCB/R2VBHDYF+DiKCtOCfFK1PK4ULVcvbXBFK9Gf/lU81AiE+DZyA
 gLEphiYy1/YzpB7tOJBLuSUuZYqxUke3akwVz0tohvWThfGJbzoZWDw72KfzTgx5
 5Gqds40p1QDL9J7KLSN4HEn9SJ2SsNz6V9DXVG4lZeR2WJ9H8AIjA7CWXnj3G46Q
 a/ki3NB0E1w4vlFCKXiYYsIZbVk+Cz8cJmwv2Q7Wc/urY/lv7sSaKjNeW5/yCYW/
 3lmoe++i9ge3J/ZBfUYKt4iiCvItEU+LWJm5Br+L
 =LF6r
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNhz8ACgkQmmx57+YA
 GNnedw/9EcyKC8MP6deL28yvi23o64qtXsZfuchQYEjtwYhnw050rVF3aG2Ifoku
 QhdbMdM6MlzhU08jZuQXJTwoQ15eptSM2MkxT+nLCchQ+aFFa4Cz/Xk9u5UVBHHg
 +VPUWwo2ig0b003JTZA+rnHHD7r3kQ7jHS2Qm2hCKqAPII6ufP3J8eUsOeNu+1at
 BkLuxwaUxvQUq+0T+i6W0BcasFJv33sbWx30u7dSTpvFuLiSFnIDcXW+2/0R5Oa/
 PPxXibiCT74foKekg+KEFMOltPaOyAklAsCKLodvrfD3lvQvE9VVtMwtpkoXGwgn
 TFOQ4/fnO3VPx9/TseamfLQzgD1kL5tNLaN21VRDJ6UqAzK8RUaPfD5Du4G9EFor
 N0R3fVi9uNlPMKKv8bq0AaAhec5RrXlPgL4y7NIMYebSP1gGuhP46U1D3pd0veTr
 gbu0871I60gXSERvCwAG9ZA1YmMDwMyNd3jnQZsqPVF2ur3UaGw3LNvPlv+tmvQ6
 VNMDL+ZnNsKm+XR2wYGOilKer2JGyfFPOnUsAbDH2X+NOMfsJKj+2hVQVl9Jj60d
 pRfj+Jesjnk7XBasKx1grdiAa9i5amkfoTzMlEIEdzSB39FL8viKQU89yBiUwVrr
 h9BGoT4ueI3/pWFratN3AUSEQAz+GuoEdbQWCjnSwFDMO5g5Fho=
 =UosP
 -----END PGP SIGNATURE-----

Merge tag 'cix-dt-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/cix into soc/dt

- Add power domain and reset for SoC
- Add GPIO for both SoC and Radxa Orion O6 board

* tag 'cix-dt-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/cix:
  arm64: dts: cix: add FCH(S0)/S5 GPIO controllers for sky1
  arm64: dts: cix: Add scmi powerdomain nodes for sky1
  arm64: dts: cix: add support for cix sky1 resets

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 22:59:40 +02:00
Andrey Grodzovsky
93e8fd1a56 ftrace: Use kallsyms binary search for single-symbol lookup
When ftrace_lookup_symbols() is called with a single symbol (cnt == 1),
use kallsyms_lookup_name() for O(log N) binary search instead of the
full linear scan via kallsyms_on_each_symbol().

ftrace_lookup_symbols() was designed for batch resolution of many
symbols in a single pass.  For large cnt this is efficient: a single
O(N) walk over all symbols with O(log cnt) binary search into the
sorted input array.  But for cnt == 1 it still decompresses all ~200K
kernel symbols only to match one.

kallsyms_lookup_name() uses the sorted kallsyms index and needs only
~17 decompressions for a single lookup.

This is the common path for kprobe.session with exact function names,
where libbpf sends one symbol per BPF_LINK_CREATE syscall.

If binary lookup fails (duplicate symbol names where the first match
is not ftrace-instrumented), the function falls through to the existing
linear scan path.

Before (cnt=1, 50 kprobe.session programs):
  Attach: 858 ms  (kallsyms_expand_symbol 25% of CPU)

After:
  Attach:  52 ms  (16x faster)

Cc: <bpf@vger.kernel.org>
Link: https://patch.msgid.link/20260302200837.317907-3-andrey.grodzovsky@crowdstrike.com
Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@crowdstrike.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2026-04-01 16:58:36 -04:00
hkbinbin
bc39a09473 Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
hci_le_big_create_sync() uses DEFINE_FLEX to allocate a
struct hci_cp_le_big_create_sync on the stack with room for 0x11 (17)
BIS entries.  However, conn->num_bis can hold up to HCI_MAX_ISO_BIS (31)
entries — validated against ISO_MAX_NUM_BIS (0x1f) in the caller
hci_conn_big_create_sync().  When conn->num_bis is between 18 and 31,
the memcpy that copies conn->bis into cp->bis writes up to 14 bytes
past the stack buffer, corrupting adjacent stack memory.

This is trivially reproducible: binding an ISO socket with
bc_num_bis = ISO_MAX_NUM_BIS (31) and calling listen() will
eventually trigger hci_le_big_create_sync() from the HCI command
sync worker, causing a KASAN-detectable stack-out-of-bounds write:

  BUG: KASAN: stack-out-of-bounds in hci_le_big_create_sync+0x256/0x3b0
  Write of size 31 at addr ffffc90000487b48 by task kworker/u9:0/71

Fix this by changing the DEFINE_FLEX count from the incorrect 0x11 to
HCI_MAX_ISO_BIS, which matches the maximum number of BIS entries that
conn->bis can actually carry.

Fixes: 42ecf19471 ("Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending")
Cc: stable@vger.kernel.org
Signed-off-by: hkbinbin <hkbinbinbin@gmail.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:48:28 -04:00
Oleh Konko
20756fec2f Bluetooth: SMP: derive legacy responder STK authentication from MITM state
The legacy responder path in smp_random() currently labels the stored
STK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH.
That reflects what the local service requested, not what the pairing
flow actually achieved.

For Just Works/Confirm legacy pairing, SMP_FLAG_MITM_AUTH stays clear
and the resulting STK should remain unauthenticated even if the local
side requested HIGH security. Use the established MITM state when
storing the responder STK so the key metadata matches the pairing result.

This also keeps the legacy path aligned with the Secure Connections code,
which already treats JUST_WORKS/JUST_CFM as unauthenticated.

Fixes: fff3490f47 ("Bluetooth: Fix setting correct authentication information for SMP STK")
Cc: stable@vger.kernel.org
Signed-off-by: Oleh Konko <security@1seal.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:48:06 -04:00
Oleh Konko
d05111bfe3 Bluetooth: SMP: force responder MITM requirements before building the pairing response
smp_cmd_pairing_req() currently builds the pairing response from the
initiator auth_req before enforcing the local BT_SECURITY_HIGH
requirement. If the initiator omits SMP_AUTH_MITM, the response can
also omit it even though the local side still requires MITM.

tk_request() then sees an auth value without SMP_AUTH_MITM and may
select JUST_CFM, making method selection inconsistent with the pairing
policy the responder already enforces.

When the local side requires HIGH security, first verify that MITM can
be achieved from the IO capabilities and then force SMP_AUTH_MITM in the
response in both rsp.auth_req and auth. This keeps the responder auth bits
and later method selection aligned.

Fixes: 2b64d153a0 ("Bluetooth: Add MITM mechanism to LE-SMP")
Cc: stable@vger.kernel.org
Suggested-by: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Signed-off-by: Oleh Konko <security@1seal.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:47:43 -04:00
Keenan Dong
bda93eec78 Bluetooth: MGMT: validate mesh send advertising payload length
mesh_send() currently bounds MGMT_OP_MESH_SEND by total command
length, but it never verifies that the bytes supplied for the
flexible adv_data[] array actually match the embedded adv_data_len
field. MGMT_MESH_SEND_SIZE only covers the fixed header, so a
truncated command can still pass the existing 20..50 byte range
check and later drive the async mesh send path past the end of the
queued command buffer.

Keep rejecting zero-length and oversized advertising payloads, but
validate adv_data_len explicitly and require the command length to
exactly match the flexible array size before queueing the request.

Fixes: b338d91703 ("Bluetooth: Implement support for Mesh")
Reported-by: Keenan Dong <keenanat2000@gmail.com>
Signed-off-by: Keenan Dong <keenanat2000@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:47:19 -04:00
Pauli Virtanen
b255531b27 Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt
hci_conn lookup and field access must be covered by hdev lock in
hci_le_remote_conn_param_req_evt, otherwise it's possible it is freed
concurrently.

Extend the hci_dev_lock critical section to cover all conn usage.

Fixes: 95118dd4ed ("Bluetooth: hci_event: Use of a function table to handle LE subevents")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:46:55 -04:00
Pauli Virtanen
a2639a7f0f Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
hci_conn lookup and field access must be covered by hdev lock in
set_cig_params_sync, otherwise it's possible it is freed concurrently.

Take hdev lock to prevent hci_conn from being deleted or modified
concurrently.  Just RCU lock is not suitable here, as we also want to
avoid "tearing" in the configuration.

Fixes: a091289218 ("Bluetooth: hci_conn: Fix hci_le_set_cig_params")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:46:33 -04:00
Keenan Dong
b8dbe9648d Bluetooth: MGMT: validate LTK enc_size on load
Load Long Term Keys stores the user-provided enc_size and later uses
it to size fixed-size stack operations when replying to LE LTK
requests. An enc_size larger than the 16-byte key buffer can therefore
overflow the reply stack buffer.

Reject oversized enc_size values while validating the management LTK
record so invalid keys never reach the stored key state.

Fixes: 346af67b8d ("Bluetooth: Add MGMT handlers for dealing with SMP LTK's")
Reported-by: Keenan Dong <keenanat2000@gmail.com>
Signed-off-by: Keenan Dong <keenanat2000@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:46:09 -04:00
Jonathan Rissanen
0ffac654e9 Bluetooth: hci_h4: Fix race during initialization
Commit 5df5dafc17 ("Bluetooth: hci_uart: Fix another race during
initialization") fixed a race for hci commands sent during initialization.
However, there is still a race that happens if an hci event from one of
these commands is received before HCI_UART_REGISTERED has been set at
the end of hci_uart_register_dev(). The event will be ignored which
causes the command to fail with a timeout in the log:

"Bluetooth: hci0: command 0x1003 tx timeout"

This is because the hci event receive path (hci_uart_tty_receive ->
h4_recv) requires HCI_UART_REGISTERED to be set in h4_recv(), while the
hci command transmit path (hci_uart_send_frame -> h4_enqueue) only
requires HCI_UART_PROTO_INIT to be set in hci_uart_send_frame().

The check for HCI_UART_REGISTERED was originally added in commit
c257820291 ("Bluetooth: Fix H4 crash from incoming UART packets")
to fix a crash caused by hu->hdev being null dereferenced. That can no
longer happen: once HCI_UART_PROTO_INIT is set in hci_uart_register_dev()
all pointers (hu, hu->priv and hu->hdev) are valid, and
hci_uart_tty_receive() already calls h4_recv() on HCI_UART_PROTO_INIT
or HCI_UART_PROTO_READY.

Remove the check for HCI_UART_REGISTERED in h4_recv() to fix the race
condition.

Fixes: 5df5dafc17 ("Bluetooth: hci_uart: Fix another race during initialization")
Signed-off-by: Jonathan Rissanen <jonathan.rissanen@axis.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:45:47 -04:00
Luiz Augusto von Dentz
035c25007c Bluetooth: hci_sync: Fix UAF in le_read_features_complete
This fixes the following backtrace caused by hci_conn being freed
before le_read_features_complete but after
hci_le_read_remote_features_sync so hci_conn_del -> hci_cmd_sync_dequeue
is not able to prevent it:

==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: slab-use-after-free in atomic_dec_and_test include/linux/atomic/atomic-instrumented.h:1383 [inline]
BUG: KASAN: slab-use-after-free in hci_conn_drop include/net/bluetooth/hci_core.h:1688 [inline]
BUG: KASAN: slab-use-after-free in le_read_features_complete+0x5b/0x340 net/bluetooth/hci_sync.c:7344
Write of size 4 at addr ffff8880796b0010 by task kworker/u9:0/52

CPU: 0 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xcd/0x630 mm/kasan/report.c:482
 kasan_report+0xe0/0x110 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:194 [inline]
 kasan_check_range+0x100/0x1b0 mm/kasan/generic.c:200
 instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
 atomic_dec_and_test include/linux/atomic/atomic-instrumented.h:1383 [inline]
 hci_conn_drop include/net/bluetooth/hci_core.h:1688 [inline]
 le_read_features_complete+0x5b/0x340 net/bluetooth/hci_sync.c:7344
 hci_cmd_sync_work+0x1ff/0x430 net/bluetooth/hci_sync.c:334
 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>

Allocated by task 5932:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:56
 kasan_save_track+0x14/0x30 mm/kasan/common.c:77
 poison_kmalloc_redzone mm/kasan/common.c:400 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:417
 kmalloc_noprof include/linux/slab.h:957 [inline]
 kzalloc_noprof include/linux/slab.h:1094 [inline]
 __hci_conn_add+0xf8/0x1c70 net/bluetooth/hci_conn.c:963
 hci_conn_add_unset+0x76/0x100 net/bluetooth/hci_conn.c:1084
 le_conn_complete_evt+0x639/0x1f20 net/bluetooth/hci_event.c:5714
 hci_le_enh_conn_complete_evt+0x23d/0x380 net/bluetooth/hci_event.c:5861
 hci_le_meta_evt+0x357/0x5e0 net/bluetooth/hci_event.c:7408
 hci_event_func net/bluetooth/hci_event.c:7716 [inline]
 hci_event_packet+0x685/0x11c0 net/bluetooth/hci_event.c:7773
 hci_rx_work+0x2c9/0xeb0 net/bluetooth/hci_core.c:4076
 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

Freed by task 5932:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:56
 kasan_save_track+0x14/0x30 mm/kasan/common.c:77
 __kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:587
 kasan_save_free_info mm/kasan/kasan.h:406 [inline]
 poison_slab_object mm/kasan/common.c:252 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:284
 kasan_slab_free include/linux/kasan.h:234 [inline]
 slab_free_hook mm/slub.c:2540 [inline]
 slab_free mm/slub.c:6663 [inline]
 kfree+0x2f8/0x6e0 mm/slub.c:6871
 device_release+0xa4/0x240 drivers/base/core.c:2565
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x1e7/0x590 lib/kobject.c:737
 put_device drivers/base/core.c:3797 [inline]
 device_unregister+0x2f/0xc0 drivers/base/core.c:3920
 hci_conn_del_sysfs+0xb4/0x180 net/bluetooth/hci_sysfs.c:79
 hci_conn_cleanup net/bluetooth/hci_conn.c:173 [inline]
 hci_conn_del+0x657/0x1180 net/bluetooth/hci_conn.c:1234
 hci_disconn_complete_evt+0x410/0xa00 net/bluetooth/hci_event.c:3451
 hci_event_func net/bluetooth/hci_event.c:7719 [inline]
 hci_event_packet+0xa10/0x11c0 net/bluetooth/hci_event.c:7773
 hci_rx_work+0x2c9/0xeb0 net/bluetooth/hci_core.c:4076
 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

The buggy address belongs to the object at ffff8880796b0000
 which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 16 bytes inside of
 freed 8192-byte region [ffff8880796b0000, ffff8880796b2000)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x796b0
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88813ff27280 0000000000000000 0000000000000001
raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88813ff27280 0000000000000000 0000000000000001
head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
head: 00fff00000000003 ffffea0001e5ac01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5657, tgid 5657 (dhcpcd-run-hook), ts 79819636908, free_ts 79814310558
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1af/0x220 mm/page_alloc.c:1845
 prep_new_page mm/page_alloc.c:1853 [inline]
 get_page_from_freelist+0xd0b/0x31a0 mm/page_alloc.c:3879
 __alloc_frozen_pages_noprof+0x25f/0x2440 mm/page_alloc.c:5183
 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2416
 alloc_slab_page mm/slub.c:3075 [inline]
 allocate_slab mm/slub.c:3248 [inline]
 new_slab+0x2c3/0x430 mm/slub.c:3302
 ___slab_alloc+0xe18/0x1c90 mm/slub.c:4651
 __slab_alloc.constprop.0+0x63/0x110 mm/slub.c:4774
 __slab_alloc_node mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:5246 [inline]
 __kmalloc_cache_noprof+0x477/0x800 mm/slub.c:5766
 kmalloc_noprof include/linux/slab.h:957 [inline]
 kzalloc_noprof include/linux/slab.h:1094 [inline]
 tomoyo_print_bprm security/tomoyo/audit.c:26 [inline]
 tomoyo_init_log+0xc8a/0x2140 security/tomoyo/audit.c:264
 tomoyo_supervisor+0x302/0x13b0 security/tomoyo/common.c:2198
 tomoyo_audit_env_log security/tomoyo/environ.c:36 [inline]
 tomoyo_env_perm+0x191/0x200 security/tomoyo/environ.c:63
 tomoyo_environ security/tomoyo/domain.c:672 [inline]
 tomoyo_find_next_domain+0xec1/0x20b0 security/tomoyo/domain.c:888
 tomoyo_bprm_check_security security/tomoyo/tomoyo.c:102 [inline]
 tomoyo_bprm_check_security+0x12d/0x1d0 security/tomoyo/tomoyo.c:92
 security_bprm_check+0x1b9/0x1e0 security/security.c:794
 search_binary_handler fs/exec.c:1659 [inline]
 exec_binprm fs/exec.c:1701 [inline]
 bprm_execve fs/exec.c:1753 [inline]
 bprm_execve+0x81e/0x1620 fs/exec.c:1729
 do_execveat_common.isra.0+0x4a5/0x610 fs/exec.c:1859
page last free pid 5657 tgid 5657 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1394 [inline]
 __free_frozen_pages+0x7df/0x1160 mm/page_alloc.c:2901
 discard_slab mm/slub.c:3346 [inline]
 __put_partials+0x130/0x170 mm/slub.c:3886
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4c/0xf0 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:352
 kasan_slab_alloc include/linux/kasan.h:252 [inline]
 slab_post_alloc_hook mm/slub.c:4948 [inline]
 slab_alloc_node mm/slub.c:5258 [inline]
 __kmalloc_cache_noprof+0x274/0x800 mm/slub.c:5766
 kmalloc_noprof include/linux/slab.h:957 [inline]
 tomoyo_print_header security/tomoyo/audit.c:156 [inline]
 tomoyo_init_log+0x197/0x2140 security/tomoyo/audit.c:255
 tomoyo_supervisor+0x302/0x13b0 security/tomoyo/common.c:2198
 tomoyo_audit_env_log security/tomoyo/environ.c:36 [inline]
 tomoyo_env_perm+0x191/0x200 security/tomoyo/environ.c:63
 tomoyo_environ security/tomoyo/domain.c:672 [inline]
 tomoyo_find_next_domain+0xec1/0x20b0 security/tomoyo/domain.c:888
 tomoyo_bprm_check_security security/tomoyo/tomoyo.c:102 [inline]
 tomoyo_bprm_check_security+0x12d/0x1d0 security/tomoyo/tomoyo.c:92
 security_bprm_check+0x1b9/0x1e0 security/security.c:794
 search_binary_handler fs/exec.c:1659 [inline]
 exec_binprm fs/exec.c:1701 [inline]
 bprm_execve fs/exec.c:1753 [inline]
 bprm_execve+0x81e/0x1620 fs/exec.c:1729
 do_execveat_common.isra.0+0x4a5/0x610 fs/exec.c:1859
 do_execve fs/exec.c:1933 [inline]
 __do_sys_execve fs/exec.c:2009 [inline]
 __se_sys_execve fs/exec.c:2004 [inline]
 __x64_sys_execve+0x8e/0xb0 fs/exec.c:2004
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94

Memory state around the buggy address:
 ffff8880796aff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8880796aff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880796b0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff8880796b0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880796b0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Fixes: a106e50be7 ("Bluetooth: HCI: Add support for LL Extended Feature Set")
Reported-by: syzbot+87badbb9094e008e0685@syzkaller.appspotmail.com
Tested-by: syzbot+87badbb9094e008e0685@syzkaller.appspotmail.com
Closes: https://syzbot.org/bug?extid=87badbb9094e008e0685
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Pauli Virtanen <pav@iki.fi>
2026-04-01 16:45:24 -04:00
Pauli Virtanen
aca377208e Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails
When hci_cmd_sync_queue_once() returns with error, the destroy callback
will not be called.

Fix leaking references / memory on these failures.

Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:45:00 -04:00
Pauli Virtanen
2969554bcf Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
hci_cmd_sync_queue_once() needs to indicate whether a queue item was
added, so caller can know if callbacks are called, so it can avoid
leaking resources.

Change the function to return -EEXIST if queue item already exists.

Modify all callsites to handle that.

Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:44:38 -04:00
Oleh Konko
2b2bf47cd7 Bluetooth: hci_event: move wake reason storage into validated event handlers
hci_store_wake_reason() is called from hci_event_packet() immediately
after stripping the HCI event header but before hci_event_func()
enforces the per-event minimum payload length from hci_ev_table.
This means a short HCI event frame can reach bacpy() before any bounds
check runs.

Rather than duplicating skb parsing and per-event length checks inside
hci_store_wake_reason(), move wake-address storage into the individual
event handlers after their existing event-length validation has
succeeded. Convert hci_store_wake_reason() into a small helper that only
stores an already-validated bdaddr while the caller holds hci_dev_lock().
Use the same helper after hci_event_func() with a NULL address to
preserve the existing unexpected-wake fallback semantics when no
validated event handler records a wake address.

Annotate the helper with __must_hold(&hdev->lock) and add
lockdep_assert_held(&hdev->lock) so future call paths keep the lock
contract explicit.

Call the helper from hci_conn_request_evt(), hci_conn_complete_evt(),
hci_sync_conn_complete_evt(), le_conn_complete_evt(),
hci_le_adv_report_evt(), hci_le_ext_adv_report_evt(),
hci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and
hci_le_past_received_evt().

Fixes: 2f20216c1d ("Bluetooth: Emit controller suspend and resume events")
Cc: stable@vger.kernel.org
Signed-off-by: Oleh Konko <security@1seal.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:44:15 -04:00
Cen Zhang
8a5b0135d4 Bluetooth: SCO: fix race conditions in sco_sock_connect()
sco_sock_connect() checks sk_state and sk_type without holding
the socket lock. Two concurrent connect() syscalls on the same
socket can both pass the check and enter sco_connect(), leading
to use-after-free.

The buggy scenario involves three participants and was confirmed
with additional logging instrumentation:

  Thread A (connect):    HCI disconnect:      Thread B (connect):

  sco_sock_connect(sk)                        sco_sock_connect(sk)
  sk_state==BT_OPEN                           sk_state==BT_OPEN
  (pass, no lock)                             (pass, no lock)
  sco_connect(sk):                            sco_connect(sk):
    hci_dev_lock                                hci_dev_lock
    hci_connect_sco                               <- blocked
      -> hcon1
    sco_conn_add->conn1
    lock_sock(sk)
    sco_chan_add:
      conn1->sk = sk
      sk->conn = conn1
    sk_state=BT_CONNECT
    release_sock
    hci_dev_unlock
                           hci_dev_lock
                           sco_conn_del:
                             lock_sock(sk)
                             sco_chan_del:
                               sk->conn=NULL
                               conn1->sk=NULL
                               sk_state=
                                 BT_CLOSED
                               SOCK_ZAPPED
                             release_sock
                           hci_dev_unlock
                                                  (unblocked)
                                                  hci_connect_sco
                                                    -> hcon2
                                                  sco_conn_add
                                                    -> conn2
                                                  lock_sock(sk)
                                                  sco_chan_add:
                                                    sk->conn=conn2
                                                  sk_state=
                                                    BT_CONNECT
                                                  // zombie sk!
                                                  release_sock
                                                  hci_dev_unlock

Thread B revives a BT_CLOSED + SOCK_ZAPPED socket back to
BT_CONNECT. Subsequent cleanup triggers double sock_put() and
use-after-free. Meanwhile conn1 is leaked as it was orphaned
when sco_conn_del() cleared the association.

Fix this by:
- Moving lock_sock() before the sk_state/sk_type checks in
  sco_sock_connect() to serialize concurrent connect attempts
- Fixing the sk_type != SOCK_SEQPACKET check to actually
  return the error instead of just assigning it
- Adding a state re-check in sco_connect() after lock_sock()
  to catch state changes during the window between the locks
- Adding sco_pi(sk)->conn check in sco_chan_add() to prevent
  double-attach of a socket to multiple connections
- Adding hci_conn_drop() on sco_chan_add failure to prevent
  HCI connection leaks

Fixes: 9a8ec9e8eb ("Bluetooth: SCO: Fix possible circular locking dependency on sco_connect_cfm")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:43:53 -04:00
Pauli Virtanen
a834a0b66e Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate
hci_cmd_sync_run() may run the work immediately if called from existing
sync work (otherwise it queues a new sync work). In this case it fails
to call the destroy() function.

On immediate run, make it behave same way as if item was queued
successfully: call destroy, and return 0.

The only callsite is hci_abort_conn() via hci_cmd_sync_run_once(), and
this changes its return value. However, its return value is not used
except as the return value for hci_disconnect(), and nothing uses the
return value of hci_disconnect(). Hence there should be no behavior
change anywhere.

Fixes: c898f6d7b0 ("Bluetooth: hci_sync: Introduce hci_cmd_sync_run/hci_cmd_sync_run_once")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:39:43 -04:00
Stefan Wiehler
01cc50ea51 mips: mm: Allocate tlb_vpn array atomically
Found by DEBUG_ATOMIC_SLEEP:

  BUG: sleeping function called from invalid context at /include/linux/sched/mm.h:306
  in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1
  preempt_count: 1, expected: 0
  RCU nest depth: 0, expected: 0
  no locks held by swapper/1/0.
  irq event stamp: 0
  hardirqs last  enabled at (0): [<0000000000000000>] 0x0
  hardirqs last disabled at (0): [<ffffffff801477fc>] copy_process+0x75c/0x1b68
  softirqs last  enabled at (0): [<ffffffff801477fc>] copy_process+0x75c/0x1b68
  softirqs last disabled at (0): [<0000000000000000>] 0x0
  CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.6.119-d79e757675ec-fct #1
  Stack : 800000000290bad8 0000000000000000 0000000000000008 800000000290bae8
          800000000290bae8 800000000290bc78 0000000000000000 0000000000000000
          ffffffff80c80000 0000000000000001 ffffffff80d8dee8 ffffffff810d09c0
          784bb2a7ec10647d 0000000000000010 ffffffff80a6fd60 8000000001d8a9c0
          0000000000000000 0000000000000000 ffffffff80d90000 0000000000000000
          ffffffff80c9e0e8 0000000007ffffff 0000000000000cc0 0000000000000400
          ffffffffffffffff 0000000000000001 0000000000000002 ffffffffc0149ed8
          fffffffffffffffe 8000000002908000 800000000290bae0 ffffffff80a81b74
          ffffffff80129fb0 0000000000000000 0000000000000000 0000000000000000
          0000000000000000 0000000000000000 ffffffff80129fd0 0000000000000000
          ...
  Call Trace:
  [<ffffffff80129fd0>] show_stack+0x60/0x158
  [<ffffffff80a7f894>] dump_stack_lvl+0x88/0xbc
  [<ffffffff8018d3c8>] __might_resched+0x268/0x288
  [<ffffffff803648b0>] __kmem_cache_alloc_node+0x2e0/0x330
  [<ffffffff80302788>] __kmalloc+0x58/0xd0
  [<ffffffff80a81b74>] r4k_tlb_uniquify+0x7c/0x428
  [<ffffffff80143e8c>] tlb_init+0x7c/0x110
  [<ffffffff8012bdb4>] per_cpu_trap_init+0x16c/0x1d0
  [<ffffffff80133258>] start_secondary+0x28/0x128

Fixes: 231ac951fa ("MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow")
Signed-off-by: Stefan Wiehler <stefan.wiehler@nokia.com>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2026-04-01 22:24:36 +02:00
Breno Leitao
41e3ccca00 docs: workqueue: document WQ_AFFN_CACHE_SHARD affinity scope
Update kernel-parameters.txt and workqueue.rst to reflect the new
cache_shard affinity scope and the default change from cache to
cache_shard.

Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-04-01 10:24:18 -10:00
Breno Leitao
24b2e73f97 workqueue: add test_workqueue benchmark module
Add a kernel module that benchmarks queue_work() throughput on an
unbound workqueue to measure pool->lock contention under different
affinity scope configurations (cache vs cache_shard).

The module spawns N kthreads (default: num_online_cpus()), each bound
to a different CPU. All threads start simultaneously and queue work
items, measuring the latency of each queue_work() call. Results are
reported as p50/p90/p95 latencies for each affinity scope.

The affinity scope is switched between runs via the workqueue's sysfs
affinity_scope attribute (WQ_SYSFS), avoiding the need for any new
exported symbols.

The module runs as __init-only, returning -EAGAIN to auto-unload,
and can be re-run via insmod.

Example of the output:

 running 50 threads, 50000 items/thread

   cpu              6806017 items/sec p50=2574    p90=5068    p95=5818 ns
   smt              6821040 items/sec p50=2624    p90=5168    p95=5949 ns
   cache_shard      1633653 items/sec p50=5337    p90=9694    p95=11207 ns
   cache            286069 items/sec p50=72509    p90=82304   p95=85009 ns
   numa             319403 items/sec p50=63745    p90=73480   p95=76505 ns
   system           308461 items/sec p50=66561    p90=75714   p95=78048 ns

Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-04-01 10:24:18 -10:00
Breno Leitao
738390a532 tools/workqueue: add CACHE_SHARD support to wq_dump.py
The WQ_AFFN_CACHE_SHARD affinity scope was added to the kernel but
wq_dump.py was not updated to enumerate it. Add the missing constant
lookup and include it in the affinity scopes iteration so that drgn
output shows the CACHE_SHARD pod topology alongside the other scopes.

Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-04-01 10:24:18 -10:00
Breno Leitao
4cdc8a7389 workqueue: set WQ_AFFN_CACHE_SHARD as the default affinity scope
Set WQ_AFFN_CACHE_SHARD as the default affinity scope for unbound
workqueues. On systems where many CPUs share one LLC, the previous
default (WQ_AFFN_CACHE) collapses all CPUs to a single worker pool,
causing heavy spinlock contention on pool->lock.

WQ_AFFN_CACHE_SHARD subdivides each LLC into smaller groups, providing
a better balance between locality and contention. Users can revert to
the previous behavior with workqueue.default_affinity_scope=cache.

On systems with 8 or fewer cores per LLC, CACHE_SHARD produces a single
shard covering the entire LLC, making it functionally identical to the
previous CACHE default. The sharding only activates when an LLC has more
than 8 cores.

Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-04-01 10:24:18 -10:00
Breno Leitao
5920d046f7 workqueue: add WQ_AFFN_CACHE_SHARD affinity scope
On systems where many CPUs share one LLC, unbound workqueues using
WQ_AFFN_CACHE collapse to a single worker pool, causing heavy spinlock
contention on pool->lock. For example, Chuck Lever measured 39% of
cycles lost to native_queued_spin_lock_slowpath on a 12-core shared-L3
NFS-over-RDMA system.

The existing affinity hierarchy (cpu, smt, cache, numa, system) offers
no intermediate option between per-LLC and per-SMT-core granularity.

Add WQ_AFFN_CACHE_SHARD, which subdivides each LLC into groups of at
most wq_cache_shard_size cores (default 8, tunable via boot parameter).
Shards are always split on core (SMT group) boundaries so that
Hyper-Threading siblings are never placed in different pods. Cores are
distributed across shards as evenly as possible -- for example, 36 cores
in a single LLC with max shard size 8 produces 5 shards of 8+7+7+7+7
cores.

The implementation follows the same comparator pattern as other affinity
scopes: precompute_cache_shard_ids() pre-fills the cpu_shard_id[] array
from the already-initialized WQ_AFFN_CACHE and WQ_AFFN_SMT topology,
and cpus_share_cache_shard() is passed to init_pod_type().

Benchmark on NVIDIA Grace (72 CPUs, single LLC, 50k items/thread), show
cache_shard delivers ~5x the throughput and ~6.5x lower p50 latency
compared to cache scope on this 72-core single-LLC system.

Suggested-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-04-01 10:24:18 -10:00
Breno Leitao
9dc42c9070 workqueue: fix typo in WQ_AFFN_SMT comment
Fix "poer" -> "per" in the WQ_AFFN_SMT enum comment.

Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-04-01 10:24:18 -10:00
Matthew Brost
703ccb63ae workqueue: Add pool_workqueue to pending_pwqs list when unplugging multiple inactive works
In unplug_oldest_pwq(), the first inactive work item on the
pool_workqueue is activated correctly. However, if multiple inactive
works exist on the same pool_workqueue, subsequent works fail to
activate because wq_node_nr_active.pending_pwqs is empty — the list
insertion is skipped when the pool_workqueue is plugged.

Fix this by checking for additional inactive works in
unplug_oldest_pwq() and updating wq_node_nr_active.pending_pwqs
accordingly.

Fixes: 4c065dbce1 ("workqueue: Enable unbound cpumask update on ordered workqueues")
Cc: stable@vger.kernel.org
Cc: Carlos Santa <carlos.santa@intel.com>
Cc: Ryan Neph <ryanneph@google.com>
Cc: Lai Jiangshan <jiangshanlai@gmail.com>
Cc: Waiman Long <longman@redhat.com>
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Acked-by: Waiman Long <longman@redhat.com>
2026-04-01 10:18:22 -10:00
Eric Biggers
12b11e47f1 lib/crypto: arm64: Assume a little-endian kernel
Since support for big-endian arm64 kernels was removed, the CPU_LE()
macro now unconditionally emits the code it is passed, and the CPU_BE()
macro now unconditionally discards the code it is passed.

Simplify the assembly code in lib/crypto/arm64/ accordingly.

Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20260401003331.144065-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-04-01 13:02:15 -07:00
Eric Biggers
180e92df9a arm64: fpsimd: Remove obsolete cond_yield macro
All invocations of the cond_yield macro have been removed, so remove the
macro definition as well.

Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20260401000548.133151-10-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-04-01 13:02:10 -07:00
Eric Biggers
6d575f11c7 lib/crypto: arm64/sha3: Remove obsolete chunking logic
Since commit aefbab8e77 ("arm64: fpsimd: Preserve/restore kernel mode
NEON at context switch"), kernel-mode NEON sections have been
preemptible on arm64.  And since commit 7dadeaa6e8 ("sched: Further
restrict the preemption modes"), voluntary preemption is no longer
supported on arm64 either.  Therefore, there's no longer any need to
limit the length of kernel-mode NEON sections on arm64.

Simplify the SHA-3 code accordingly.

Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20260401000548.133151-9-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-04-01 13:02:10 -07:00
Eric Biggers
7116418f6b lib/crypto: arm64/sha512: Remove obsolete chunking logic
Since commit aefbab8e77 ("arm64: fpsimd: Preserve/restore kernel mode
NEON at context switch"), kernel-mode NEON sections have been
preemptible on arm64.  And since commit 7dadeaa6e8 ("sched: Further
restrict the preemption modes"), voluntary preemption is no longer
supported on arm64 either.  Therefore, there's no longer any need to
limit the length of kernel-mode NEON sections on arm64.

Simplify the SHA-512 code accordingly.

Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20260401000548.133151-8-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-04-01 13:02:10 -07:00
Eric Biggers
fe1233c2eb lib/crypto: arm64/sha256: Remove obsolete chunking logic
Since commit aefbab8e77 ("arm64: fpsimd: Preserve/restore kernel mode
NEON at context switch"), kernel-mode NEON sections have been
preemptible on arm64.  And since commit 7dadeaa6e8 ("sched: Further
restrict the preemption modes"), voluntary preemption is no longer
supported on arm64 either.  Therefore, there's no longer any need to
limit the length of kernel-mode NEON sections on arm64.

Simplify the SHA-256 code accordingly.

Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20260401000548.133151-7-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-04-01 13:02:10 -07:00
Eric Biggers
fd5017138c lib/crypto: arm64/sha1: Remove obsolete chunking logic
Since commit aefbab8e77 ("arm64: fpsimd: Preserve/restore kernel mode
NEON at context switch"), kernel-mode NEON sections have been
preemptible on arm64.  And since commit 7dadeaa6e8 ("sched: Further
restrict the preemption modes"), voluntary preemption is no longer
supported on arm64 either.  Therefore, there's no longer any need to
limit the length of kernel-mode NEON sections on arm64.

Simplify the SHA-1 code accordingly.

Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20260401000548.133151-6-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-04-01 13:02:10 -07:00
Eric Biggers
dec1061f0a lib/crypto: arm64/poly1305: Remove obsolete chunking logic
Since commit aefbab8e77 ("arm64: fpsimd: Preserve/restore kernel mode
NEON at context switch"), kernel-mode NEON sections have been
preemptible on arm64.  And since commit 7dadeaa6e8 ("sched: Further
restrict the preemption modes"), voluntary preemption is no longer
supported on arm64 either.  Therefore, there's no longer any need to
limit the length of kernel-mode NEON sections on arm64.

Simplify the Poly1305 code accordingly.

Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20260401000548.133151-5-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-04-01 13:02:10 -07:00
Eric Biggers
d3a5cc5c92 lib/crypto: arm64/gf128hash: Remove obsolete chunking logic
Since commit aefbab8e77 ("arm64: fpsimd: Preserve/restore kernel mode
NEON at context switch"), kernel-mode NEON sections have been
preemptible on arm64.  And since commit 7dadeaa6e8 ("sched: Further
restrict the preemption modes"), voluntary preemption is no longer
supported on arm64 either.  Therefore, there's no longer any need to
limit the length of kernel-mode NEON sections on arm64.

Simplify the GHASH and POLYVAL code accordingly.

Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20260401000548.133151-4-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-04-01 13:02:10 -07:00
Eric Biggers
63fcc765e1 lib/crypto: arm64/chacha: Remove obsolete chunking logic
Since commit aefbab8e77 ("arm64: fpsimd: Preserve/restore kernel mode
NEON at context switch"), kernel-mode NEON sections have been
preemptible on arm64.  And since commit 7dadeaa6e8 ("sched: Further
restrict the preemption modes"), voluntary preemption is no longer
supported on arm64 either.  Therefore, there's no longer any need to
limit the length of kernel-mode NEON sections on arm64.

Simplify the ChaCha code accordingly.

Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20260401000548.133151-3-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-04-01 13:02:09 -07:00