Commit graph

1,447,411 commits

Author SHA1 Message Date
Linus Torvalds
d730905bc3 Support for Mobileye EyeQ6Lplus
Cleanups and fixes
 -----BEGIN PGP SIGNATURE-----
 
 iQJOBAABCAA4FiEEbt46xwy6kEcDOXoUeZbBVTGwZHAFAmniNBwaHHRzYm9nZW5k
 QGFscGhhLmZyYW5rZW4uZGUACgkQeZbBVTGwZHB2QA//U53JZYmmOxKxwbYwLvK9
 Z8MuVgkvA/v7WktwL2PoMO0AlhQsteM5VtupddHhuhUiIr7gPy6Z7pEE9sDqM3gj
 p1d6vrg5XiWlh1fURdSqvzufKsm/etpElbvc2JjkcqD0sMGJUwlkP3ncZk/DCus6
 zhcvya7jVxyvzbCBgJSM8QHvOoj/g3EV4hsx8Ymru8XSdLVEegodZtvUHVx4Q29U
 fmHCf1u/v+rJVbe2T3nuqsqzQhmaWkC+WyeVJIDUNecjclPoGNOeg8duICNfOu9q
 dtkzOua7v6rRsUA9GDbMcR44PWzL4LqGTOffzwF7uvYakOAp6nQWsymAUIfkQbE6
 +I8heGaYPEQLjSHgCPI2WdJ4urbPdgsd5W2pC8s6WaHPdRlSMapH16I0DxmmNZlV
 CzW7o2ore5b8H4Mu5mboMjFzMY+A/0zC5S7twOpX+mvgPz+MTf1g0vD3hCSL+N7c
 LSW7rSZyd2smcgaHJBDpHceRHNZbVqloeO007DiJtrx+IWTBhvhFt2q/aqGG51xM
 2P/lRZrA8vAMaTR1hZKLmxUPZpSekezoWC8GbWNeIg5NUUTOJoTAtQvT5vU40GZA
 22o3s1a6rgz5KngV9rMWYERSV2yflvloYVo0ASVqgy1ijzzlsin/fbO976GdGD2I
 7vrch6tajmTSBYeG0SuKiFY=
 =jKsJ
 -----END PGP SIGNATURE-----

Merge tag 'mips_7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux

Pull MIPS updates from Thomas Bogendoerfer:

 - Support for Mobileye EyeQ6Lplus

 - Cleanups and fixes

* tag 'mips_7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (30 commits)
  MIPS/mtd: Handle READY GPIO in generic NAND platform data
  MIPS/input: Move RB532 button to GPIO descriptors
  MIPS: validate DT bootargs before appending them
  MIPS: Alchemy: Remove unused forward declaration
  MAINTAINERS: Mobileye: Add EyeQ6Lplus files
  MIPS: config: add eyeq6lplus_defconfig
  MIPS: Add Mobileye EyeQ6Lplus evaluation board dts
  MIPS: Add Mobileye EyeQ6Lplus SoC dtsi
  clk: eyeq: Add Mobileye EyeQ6Lplus OLB
  clk: eyeq: Adjust PLL accuracy computation
  clk: eyeq: Skip post-divisor when computing PLL frequency
  pinctrl: eyeq5: Add Mobileye EyeQ6Lplus OLB
  pinctrl: eyeq5: Use match data
  reset: eyeq: Add Mobileye EyeQ6Lplus OLB
  MIPS: Add Mobileye EyeQ6Lplus support
  dt-bindings: soc: mobileye: Add EyeQ6Lplus OLB
  dt-bindings: mips: Add Mobileye EyeQ6Lplus SoC
  MIPS: dts: loongson64g-package: Switch to Loongson UART driver
  mips: pci-mt7620: rework initialization procedure
  mips: pci-mt7620: add more register init values
  ...
2026-04-17 08:53:23 -07:00
Cássio Gabriel
a3542d1b30 ALSA: caiaq: Fix control_put() result and cache rollback
control_put() always returns 1 and updates cdev->control_state[]
before sending the USB command. It also ignores transport errors
from usb_bulk_msg(), snd_usb_caiaq_send_command(), and
snd_usb_caiaq_send_command_bank().

That breaks the ALSA .put() contract and can leave control_get()
reporting a cached value the device never accepted.

Return 0 for unchanged values, propagate transport failures,
and restore the cached byte when the write fails.

Fixes: 8e3cd08ed8 ("[ALSA] caiaq - add control API and more input features")
Cc: stable@vger.kernel.org
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260417-caiaq-control-put-v1-1-c37826e92447@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-17 17:52:00 +02:00
Linus Torvalds
a10e80be63 alpha updates for v7.1
- alpha: Define pgprot_modify to silence tautological comparison warnings
 - alpha: add support for SECCOMP and SECCOMP_FILTER
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTIw07U9ivnHy+tugnaDr6nZQzE/AUCaeEX/gAKCRDaDr6nZQzE
 /FjpAPwMQssCV12H9JczlcTxcqUoBVCTDczxOEUxLwdhXA5UKQEAu/cxICAyaul7
 6gNqwffhpOWpehGa8T8BNZeJr5wJ+Ag=
 =g5Lf
 -----END PGP SIGNATURE-----

Merge tag 'alpha-for-v7.1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/lindholm/alpha

Pull alpha updates from Magnus Lindholm:
 "One fix to silence pgprot_modify() compiler warnings, and one patch
  adding SECCOMP/SECCOMP_FILTER support together with the syscall and
  ptrace fixes needed for it"

* tag 'alpha-for-v7.1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/lindholm/alpha:
  alpha: Define pgprot_modify to silence tautological comparison warnings
  alpha: add support for SECCOMP and SECCOMP_FILTER
2026-04-17 08:34:43 -07:00
Michael Margolin
9091e3b59f RDMA/core: Fix user CQ creation for drivers without create_cq
CQ creation is failing for drivers that only implement create_user_cq
(e.g. EFA), when buffer isn't provided by userspace. This because of a
leftover check that requires create_cq existence in such case.

Remove the create_cq existence check from the no-buffer path. The
buffer is optional and drivers that handle their own memory should work
through create_user_cq regardless.

Fixes: 584ec74748 ("RDMA/core: Prepare create CQ path for API unification")
Link: https://patch.msgid.link/r/20260416201408.13980-1-mrgolin@amazon.com
Signed-off-by: Michael Margolin <mrgolin@amazon.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-04-17 12:16:00 -03:00
Vincent Donnefort
ccab51d69b KVM: arm64: Re-allow hyp tracing HVCs for [nh]VHE
The introduction of __KVM_HOST_SMCCC_FUNC_MAX_NO_PKVM excluded hyp
tracing HVCs from the common [nh]VHE/pKVM list. Re-allow them.

Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Link: https://patch.msgid.link/20260414100231.1859687-1-vdonnefort@google.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-04-17 15:21:05 +01:00
Linus Torvalds
01f492e181 Arm:
- Add support for tracing in the standalone EL2 hypervisor code, which
   should help both debugging and performance analysis.  This uses the
   new infrastructure for 'remote' trace buffers that can be exposed
   by non-kernel entities such as firmware, and which came through the
   tracing tree.
 
 - Add support for GICv5 Per Processor Interrupts (PPIs), as the starting
   point for supporting the new GIC architecture in KVM.
 
 - Finally add support for pKVM protected guests, where pages are unmapped
   from the host as they are faulted into the guest and can be shared back
   from the guest using pKVM hypercalls.  Protected guests are created
   using a new machine type identifier.  As the elusive guestmem has not
   yet delivered on its promises, anonymous memory is also supported.
 
   This is only a first step towards full isolation from the host; for
   example, the CPU register state and DMA accesses are not yet isolated.
   Because this does not really yet bring fully what it promises, it is
   hidden behind CONFIG_ARM_PKVM_GUEST + 'kvm-arm.mode=protected', and
   also triggers TAINT_USER when a VM is created.  Caveat emptor.
 
 - Rework the dreaded user_mem_abort() function to make it more
   maintainable, reducing the amount of state being exposed to the
   various helpers and rendering a substantial amount of state immutable.
 
 - Expand the Stage-2 page table dumper to support NV shadow page tables
   on a per-VM basis.
 
 - Tidy up the pKVM PSCI proxy code to be slightly less hard to follow.
 
 - Fix both SPE and TRBE in non-VHE configurations so that they do not
   generate spurious, out of context table walks that ultimately lead
   to very bad HW lockups.
 
 - A small set of patches fixing the Stage-2 MMU freeing in error cases.
 
 - Tighten-up accepted SMC immediate value to be only #0 for host
   SMCCC calls.
 
 - The usual cleanups and other selftest churn.
 
 LoongArch:
 
 - Use CSR_CRMD_PLV for kvm_arch_vcpu_in_kernel().
 
 - Add DMSINTC irqchip in kernel support.
 
 RISC-V:
 
 - Fix steal time shared memory alignment checks
 
 - Fix vector context allocation leak
 
 - Fix array out-of-bounds in pmu_ctr_read() and pmu_fw_ctr_read_hi()
 
 - Fix double-free of sdata in kvm_pmu_clear_snapshot_area()
 
 - Fix integer overflow in kvm_pmu_validate_counter_mask()
 
 - Fix shift-out-of-bounds in make_xfence_request()
 
 - Fix lost write protection on huge pages during dirty logging
 
 - Split huge pages during fault handling for dirty logging
 
 - Skip CSR restore if VCPU is reloaded on the same core
 
 - Implement kvm_arch_has_default_irqchip() for KVM selftests
 
 - Factored-out ISA checks into separate sources
 
 - Added hideleg to struct kvm_vcpu_config
 
 - Factored-out VCPU config into separate sources
 
 - Support configuration of per-VM HGATP mode from KVM user space
 
 s390:
 
 - Support for ESA (31-bit) guests inside nested hypervisors.
 
 - Remove restriction on memslot alignment, which is not needed anymore with
   the new gmap code.
 
 - Fix LPSW/E to update the bear (which of course is the breaking event
   address register).
 
 x86:
 
 - Shut up various UBSAN warnings on reading module parameter before they
   were initialized.
 
 - Don't zero-allocate page tables that are used for splitting hugepages in
   the TDP MMU, as KVM is guaranteed to set all SPTEs in the page table and
   thus write all bytes.
 
 - As an optimization, bail early when trying to unsync 4KiB mappings if the
   target gfn can just be mapped with a 2MiB hugepage.
 
 x86 generic:
 
 - Copy single-chunk MMIO write values into struct kvm_vcpu (more precisely
   struct kvm_mmio_fragment) to fix use-after-free stack bugs where KVM
   would dereference stack pointer after an exit to userspace.
 
 - Clean up and comment the emulated MMIO code to try to make it easier to
   maintain (not necessarily "easy", but "easier").
 
 - Move VMXON+VMXOFF and EFER.SVME toggling out of KVM (not *all* of VMX
   and SVM enabling) as it is needed for trusted I/O.
 
 - Advertise support for AVX512 Bit Matrix Multiply (BMM) instructions
 
 - Immediately fail the build if a required #define is missing in one of
   KVM's headers that is included multiple times.
 
 - Reject SET_GUEST_DEBUG with -EBUSY if there's an already injected
   exception, mostly to prevent syzkaller from abusing the uAPI to
   trigger WARNs, but also because it can help prevent userspace from
   unintentionally crashing the VM.
 
 - Exempt SMM from CPUID faulting on Intel, as per the spec.
 
 - Misc hardening and cleanup changes.
 
 x86 (AMD):
 
 - Fix and optimize IRQ window inhibit handling for AVIC; make it per-vCPU
   so that KVM doesn't prematurely re-enable AVIC if multiple
   vCPUs have to-be-injected IRQs.
 
 - Clean up and optimize the OSVW handling, avoiding a bug in which KVM would
   overwrite state when enabling virtualization on multiple CPUs in parallel.
   This should not be a problem because OSVW should usually be the same for
   all CPUs.
 
 - Drop a WARN in KVM_MEMORY_ENCRYPT_REG_REGION where KVM complains about a
   "too large" size based purely on user input.
 
 - Clean up and harden the pinning code for KVM_MEMORY_ENCRYPT_REG_REGION.
 
 - Disallow synchronizing a VMSA of an already-launched/encrypted vCPU, as
   doing so for an SNP guest will crash the host due to an RMP violation
   page fault.
 
 - Overhaul KVM's APIs for detecting SEV+ guests so that VM-scoped queries
   are required to hold kvm->lock, and enforce it by lockdep.  Fix various
   bugs where sev_guest() was not ensured to be stable for the whole
   duration of a function or ioctl.
 
 - Convert a pile of kvm->lock SEV code to guard().
 
 - Play nicer with userspace that does not enable KVM_CAP_EXCEPTION_PAYLOAD,
   for which KVM needs to set CR2 and DR6 as a response to ioctls such as
   KVM_GET_VCPU_EVENTS (even if the payload would end up in EXITINFO2
   rather than CR2, for example).  Only set CR2 and DR6 when consumption of
   the payload is imminent, but on the other hand force delivery of the
   payload in all paths where userspace retrieves CR2 or DR6.
 
 - Use vcpu->arch.cr2 when updating vmcb12's CR2 on nested #VMEXIT instead
   of vmcb02->save.cr2.  The value is out of sync after a save/restore
   or after a #PF is injected into L2.
 
 - Fix a class of nSVM bugs where some fields written by the CPU are not
   synchronized from vmcb02 to cached vmcb12 after VMRUN, and so are not
   up-to-date when saved by KVM_GET_NESTED_STATE.
 
 - Fix a class of bugs where the ordering between KVM_SET_NESTED_STATE and
   KVM_SET_{S}REGS could cause vmcb02 to be incorrectly initialized after
   save+restore.
 
 - Add a variety of missing nSVM consistency checks.
 
 - Fix several bugs where KVM failed to correctly update VMCB fields on
   nested #VMEXIT.
 
 - Fix several bugs where KVM failed to correctly synthesize #UD or #GP for
   SVM-related instructions.
 
 - Add support for save+restore of virtualized LBRs (on SVM).
 
 - Refactor various helpers and macros to improve clarity and (hopefully)
   make the code easier to maintain.
 
 - Aggressively sanitize fields when copying from vmcb12, to guard against
   unintentionally allowing L1 to utilize yet-to-be-defined features.
 
 - Fix several bugs where KVM botched rAX legality checks when emulating SVM
   instructions.  There are remaining issues in that KVM doesn't handle size
   prefix overrides for 64-bit guests.
 
 - Fail emulation of VMRUN/VMLOAD/VMSAVE if mapping vmcb12 fails instead of
   somewhat arbitrarily synthesizing #GP (i.e. don't double down on AMD's
   architectural but sketchy behavior of generating #GP for "unsupported"
   addresses).
 
 - Cache all used vmcb12 fields to further harden against TOCTOU bugs.
 
 x86 (Intel):
 
 - Drop obsolete branch hint prefixes from the VMX instruction macros.
 
 - Use ASM_INPUT_RM() in __vmcs_writel() to coerce clang into using a
   register input when appropriate.
 
 - Code cleanups.
 
 guest_memfd:
 
 - Don't mark guest_memfd folios as accessed, as guest_memfd doesn't support
   reclaim, the memory is unevictable, and there is no storage to write
   back to.
 
 LoongArch selftests:
 
 - Add KVM PMU test cases
 
 s390 selftests:
 
 - Enable more memory selftests.
 
 x86 selftests:
 
 - Add support for Hygon CPUs in KVM selftests.
 
 - Fix a bug in the MSR test where it would get false failures on AMD/Hygon
   CPUs with exactly one of RDPID or RDTSCP.
 
 - Add an MADV_COLLAPSE testcase for guest_memfd as a regression test for a
   bug where the kernel would attempt to collapse guest_memfd folios against
   KVM's will.
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmnftRQUHHBib256aW5p
 QHJlZGhhdC5jb20ACgkQv/vSX3jHroPAzwf+NKO4Ktv+7A22ImN0SBl0nlUuulsz
 vTcw3+hxdRoIw83GdNS+hG5js0wrpMDnbv3t4+VliDNBSSxrBzcSWX2wpilW0Xtw
 qGo1MWhs2lKPy1NlaRVOwPS6j7uF3AR0TQ1iQLGMedQuCU9WpiKJxyhNXJdbLrt3
 8EgFzsvtEsv+jKNRUNDf9+d0j4gZsFyIe+Brhianbw+u3/UCiUClLCdsKPc4+5ZX
 08otYXytacGNIf/5Ev1vT4pHkHL0yqKXAtX7LEtaS3+0KrPuLjV4slemivzE9vf5
 Evafm5AhA4wpaNMb1ZerhY3T94lsMaJpWxotjR//0Q7C9B59pCQnXCm8mg==
 =CcE0
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm updates from Paolo Bonzini:
 "Arm:

   - Add support for tracing in the standalone EL2 hypervisor code,
     which should help both debugging and performance analysis. This
     uses the new infrastructure for 'remote' trace buffers that can be
     exposed by non-kernel entities such as firmware, and which came
     through the tracing tree

   - Add support for GICv5 Per Processor Interrupts (PPIs), as the
     starting point for supporting the new GIC architecture in KVM

   - Finally add support for pKVM protected guests, where pages are
     unmapped from the host as they are faulted into the guest and can
     be shared back from the guest using pKVM hypercalls. Protected
     guests are created using a new machine type identifier. As the
     elusive guestmem has not yet delivered on its promises, anonymous
     memory is also supported

     This is only a first step towards full isolation from the host; for
     example, the CPU register state and DMA accesses are not yet
     isolated. Because this does not really yet bring fully what it
     promises, it is hidden behind CONFIG_ARM_PKVM_GUEST +
     'kvm-arm.mode=protected', and also triggers TAINT_USER when a VM is
     created. Caveat emptor

   - Rework the dreaded user_mem_abort() function to make it more
     maintainable, reducing the amount of state being exposed to the
     various helpers and rendering a substantial amount of state
     immutable

   - Expand the Stage-2 page table dumper to support NV shadow page
     tables on a per-VM basis

   - Tidy up the pKVM PSCI proxy code to be slightly less hard to
     follow

   - Fix both SPE and TRBE in non-VHE configurations so that they do not
     generate spurious, out of context table walks that ultimately lead
     to very bad HW lockups

   - A small set of patches fixing the Stage-2 MMU freeing in error
     cases

   - Tighten-up accepted SMC immediate value to be only #0 for host
     SMCCC calls

   - The usual cleanups and other selftest churn

  LoongArch:

   - Use CSR_CRMD_PLV for kvm_arch_vcpu_in_kernel()

   - Add DMSINTC irqchip in kernel support

  RISC-V:

   - Fix steal time shared memory alignment checks

   - Fix vector context allocation leak

   - Fix array out-of-bounds in pmu_ctr_read() and pmu_fw_ctr_read_hi()

   - Fix double-free of sdata in kvm_pmu_clear_snapshot_area()

   - Fix integer overflow in kvm_pmu_validate_counter_mask()

   - Fix shift-out-of-bounds in make_xfence_request()

   - Fix lost write protection on huge pages during dirty logging

   - Split huge pages during fault handling for dirty logging

   - Skip CSR restore if VCPU is reloaded on the same core

   - Implement kvm_arch_has_default_irqchip() for KVM selftests

   - Factored-out ISA checks into separate sources

   - Added hideleg to struct kvm_vcpu_config

   - Factored-out VCPU config into separate sources

   - Support configuration of per-VM HGATP mode from KVM user space

  s390:

   - Support for ESA (31-bit) guests inside nested hypervisors

   - Remove restriction on memslot alignment, which is not needed
     anymore with the new gmap code

   - Fix LPSW/E to update the bear (which of course is the breaking
     event address register)

  x86:

   - Shut up various UBSAN warnings on reading module parameter before
     they were initialized

   - Don't zero-allocate page tables that are used for splitting
     hugepages in the TDP MMU, as KVM is guaranteed to set all SPTEs in
     the page table and thus write all bytes

   - As an optimization, bail early when trying to unsync 4KiB mappings
     if the target gfn can just be mapped with a 2MiB hugepage

  x86 generic:

   - Copy single-chunk MMIO write values into struct kvm_vcpu (more
     precisely struct kvm_mmio_fragment) to fix use-after-free stack
     bugs where KVM would dereference stack pointer after an exit to
     userspace

   - Clean up and comment the emulated MMIO code to try to make it
     easier to maintain (not necessarily "easy", but "easier")

   - Move VMXON+VMXOFF and EFER.SVME toggling out of KVM (not *all* of
     VMX and SVM enabling) as it is needed for trusted I/O

   - Advertise support for AVX512 Bit Matrix Multiply (BMM) instructions

   - Immediately fail the build if a required #define is missing in one
     of KVM's headers that is included multiple times

   - Reject SET_GUEST_DEBUG with -EBUSY if there's an already injected
     exception, mostly to prevent syzkaller from abusing the uAPI to
     trigger WARNs, but also because it can help prevent userspace from
     unintentionally crashing the VM

   - Exempt SMM from CPUID faulting on Intel, as per the spec

   - Misc hardening and cleanup changes

  x86 (AMD):

   - Fix and optimize IRQ window inhibit handling for AVIC; make it
     per-vCPU so that KVM doesn't prematurely re-enable AVIC if multiple
     vCPUs have to-be-injected IRQs

   - Clean up and optimize the OSVW handling, avoiding a bug in which
     KVM would overwrite state when enabling virtualization on multiple
     CPUs in parallel. This should not be a problem because OSVW should
     usually be the same for all CPUs

   - Drop a WARN in KVM_MEMORY_ENCRYPT_REG_REGION where KVM complains
     about a "too large" size based purely on user input

   - Clean up and harden the pinning code for KVM_MEMORY_ENCRYPT_REG_REGION

   - Disallow synchronizing a VMSA of an already-launched/encrypted
     vCPU, as doing so for an SNP guest will crash the host due to an
     RMP violation page fault

   - Overhaul KVM's APIs for detecting SEV+ guests so that VM-scoped
     queries are required to hold kvm->lock, and enforce it by lockdep.
     Fix various bugs where sev_guest() was not ensured to be stable for
     the whole duration of a function or ioctl

   - Convert a pile of kvm->lock SEV code to guard()

   - Play nicer with userspace that does not enable
     KVM_CAP_EXCEPTION_PAYLOAD, for which KVM needs to set CR2 and DR6
     as a response to ioctls such as KVM_GET_VCPU_EVENTS (even if the
     payload would end up in EXITINFO2 rather than CR2, for example).
     Only set CR2 and DR6 when consumption of the payload is imminent,
     but on the other hand force delivery of the payload in all paths
     where userspace retrieves CR2 or DR6

   - Use vcpu->arch.cr2 when updating vmcb12's CR2 on nested #VMEXIT
     instead of vmcb02->save.cr2. The value is out of sync after a
     save/restore or after a #PF is injected into L2

   - Fix a class of nSVM bugs where some fields written by the CPU are
     not synchronized from vmcb02 to cached vmcb12 after VMRUN, and so
     are not up-to-date when saved by KVM_GET_NESTED_STATE

   - Fix a class of bugs where the ordering between KVM_SET_NESTED_STATE
     and KVM_SET_{S}REGS could cause vmcb02 to be incorrectly
     initialized after save+restore

   - Add a variety of missing nSVM consistency checks

   - Fix several bugs where KVM failed to correctly update VMCB fields
     on nested #VMEXIT

   - Fix several bugs where KVM failed to correctly synthesize #UD or
     #GP for SVM-related instructions

   - Add support for save+restore of virtualized LBRs (on SVM)

   - Refactor various helpers and macros to improve clarity and
     (hopefully) make the code easier to maintain

   - Aggressively sanitize fields when copying from vmcb12, to guard
     against unintentionally allowing L1 to utilize yet-to-be-defined
     features

   - Fix several bugs where KVM botched rAX legality checks when
     emulating SVM instructions. There are remaining issues in that KVM
     doesn't handle size prefix overrides for 64-bit guests

   - Fail emulation of VMRUN/VMLOAD/VMSAVE if mapping vmcb12 fails
     instead of somewhat arbitrarily synthesizing #GP (i.e. don't double
     down on AMD's architectural but sketchy behavior of generating #GP
     for "unsupported" addresses)

   - Cache all used vmcb12 fields to further harden against TOCTOU bugs

  x86 (Intel):

   - Drop obsolete branch hint prefixes from the VMX instruction macros

   - Use ASM_INPUT_RM() in __vmcs_writel() to coerce clang into using a
     register input when appropriate

   - Code cleanups

  guest_memfd:

   - Don't mark guest_memfd folios as accessed, as guest_memfd doesn't
     support reclaim, the memory is unevictable, and there is no storage
     to write back to

  LoongArch selftests:

   - Add KVM PMU test cases

  s390 selftests:

   - Enable more memory selftests

  x86 selftests:

   - Add support for Hygon CPUs in KVM selftests

   - Fix a bug in the MSR test where it would get false failures on
     AMD/Hygon CPUs with exactly one of RDPID or RDTSCP

   - Add an MADV_COLLAPSE testcase for guest_memfd as a regression test
     for a bug where the kernel would attempt to collapse guest_memfd
     folios against KVM's will"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (373 commits)
  KVM: x86: use inlines instead of macros for is_sev_*guest
  x86/virt: Treat SVM as unsupported when running as an SEV+ guest
  KVM: SEV: Goto an existing error label if charging misc_cg for an ASID fails
  KVM: SVM: Move lock-protected allocation of SEV ASID into a separate helper
  KVM: SEV: use mutex guard in snp_handle_guest_req()
  KVM: SEV: use mutex guard in sev_mem_enc_unregister_region()
  KVM: SEV: use mutex guard in sev_mem_enc_ioctl()
  KVM: SEV: use mutex guard in snp_launch_update()
  KVM: SEV: Assert that kvm->lock is held when querying SEV+ support
  KVM: SEV: Document that checking for SEV+ guests when reclaiming memory is "safe"
  KVM: SEV: Hide "struct kvm_sev_info" behind CONFIG_KVM_AMD_SEV=y
  KVM: SEV: WARN on unhandled VM type when initializing VM
  KVM: LoongArch: selftests: Add PMU overflow interrupt test
  KVM: LoongArch: selftests: Add basic PMU event counting test
  KVM: LoongArch: selftests: Add cpucfg read/write helpers
  LoongArch: KVM: Add DMSINTC inject msi to vCPU
  LoongArch: KVM: Add DMSINTC device support
  LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function
  LoongArch: KVM: Move host CSR_GSTAT save and restore in context switch
  LoongArch: KVM: Move host CSR_EENTRY save and restore in context switch
  ...
2026-04-17 07:18:03 -07:00
Guido Günther
4a92ef0c57 drm/panel: visionox-rm69299: Make use of prepare_prev_first
The DSI link must be powered up to let panel driver to talk to the panel
during prepare() callback execution. Set the prepare_prev_first flag to
guarantee this.

Fixes: 9e15123eca ("drm/msm/dsi: Stop unconditionally powering up DSI hosts at modeset")
Signed-off-by: Guido Günther <agx@sigxcpu.org>
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://patch.msgid.link/20260417-axolotl-display-v2-1-8ce5341e46c2@ixit.cz
2026-04-17 07:08:29 -07:00
Guangshuo Li
707610bccc parisc: led: fix reference leak on failed device registration
When platform_device_register() fails in startup_leds(), the embedded
struct device in platform_leds has already been initialized by
device_initialize(), but the failure path only reports the error and
does not drop the device reference for the current platform device:

  startup_leds()
    -> platform_device_register(&platform_leds)
       -> device_initialize(&platform_leds.dev)
       -> setup_pdev_dma_masks(&platform_leds)
       -> platform_device_add(&platform_leds)

This leads to a reference leak when platform_device_register() fails.
Fix this by calling platform_device_put() after reporting the error.

The issue was identified by a static analysis tool I developed and
confirmed by manual review.

Fixes: 789e527adf ("parisc: led: Rewrite LED/LCD driver to utilizize Linux LED subsystem")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-17 15:46:46 +02:00
Helge Deller
1221365f55 module.lds.S: Fix modules on 32-bit parisc architecture
On the 32-bit parisc architecture, we always used the
-ffunction-sections compiler option to tell the compiler to put the
functions into seperate text sections. This is necessary, otherwise
"big" kernel modules like ext4 or ipv6 fail to load because some
branches won't be able to reach their stubs.

Commit 1ba9f89794 ("vmlinux.lds: Unify TEXT_MAIN, DATA_MAIN, and related
macros") broke this for parisc because all text sections will get
unconditionally merged now.

Introduce the ARCH_WANTS_MODULES_TEXT_SECTIONS config option which
avoids the text section merge for modules, and fix this issue by
enabling this option by default for 32-bit parisc.

Fixes: 1ba9f89794 ("vmlinux.lds: Unify TEXT_MAIN, DATA_MAIN, and related macros")
Cc: Josh Poimboeuf <jpoimboe@kernel.org>
Cc: stable@vger.kernel.org # v6.19+
Suggested-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Petr Pavlu <petr.pavlu@suse.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-17 15:46:46 +02:00
Helge Deller
3dce917902 parisc: Allow to build without VDSO32
When building for 64-bit and without CONFIG_COMPAT, leave out the
vdso32 binary.

Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-17 15:46:45 +02:00
Helge Deller
ba56cdf133 parisc: Include 32-bit VDSO only when building for 32-bit or compat mode
Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-17 15:46:45 +02:00
Helge Deller
bc4021c4e9 parisc: Allow to disable COMPAT mode on 64-bit kernel
Although we don't yet have a 64-bit userspace, allowing to disable
the compat mode should be possible.

Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-17 15:46:45 +02:00
Helge Deller
35493b28e7 parisc: Fix default stack size when COMPAT=n
The CONFIG_STACK_MAX_DEFAULT_SIZE_MB config option does not exist
when CONFIG_COMPAT is disabled. Use default 1 GB stack in this case.

Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-17 15:46:45 +02:00
Helge Deller
7dc9ee6e5e parisc: Fix signal code to depend on CONFIG_COMPAT instead of CONFIG_64BIT
The signal handler code used CONFIG_64BIT to decide if compat handling
code should be compiled in. Fix it to use CONFIG_COMPAT instead.
This allows to disable CONFIG_COMPAT even when running a 64-bit kernel.

Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-17 15:46:45 +02:00
Helge Deller
b5d5faba0f parisc: is_compat_task() shall return false for COMPAT=n
Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-17 15:46:45 +02:00
Helge Deller
97bfda4520 parisc: Avoid compat syscalls when COMPAT=n
Drop unnecessary code and syscall tables when we run a 64-bit
kernel with conpat mode disabled.

Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-17 15:46:45 +02:00
Borislav Petkov (AMD)
e55d98e775 x86/CPU: Fix FPDSS on Zen1
Zen1's hardware divider can leave, under certain circumstances, partial
results from previous operations.  Those results can be leaked by
another, attacker thread.

Fix that with a chicken bit.

Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-04-17 06:04:42 -07:00
Corey Minyard
75c486cb1b ipmi:ssif: Clean up kthread on errors
If an error occurs after the ssif kthread is created, but before the
main IPMI code starts the ssif interface, the ssif kthread will not
be stopped.

So make sure the kthread is stopped on an error condition if it is
running.

Fixes: 259307074b ("ipmi: Add SMBus interface driver (SSIF)")
Reported-by: Li Xiao <<252270051@hdu.edu.cn>
Cc: stable@vger.kernel.org
Reviewed-by: Li Xiao <252270051@hdu.edu.cn>
Signed-off-by: Corey Minyard <corey@minyard.net>
2026-04-17 06:47:40 -05:00
Junrui Luo
16d990a154 KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic
kvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and
aen_host_forward() index the GAIT by manually multiplying the index
with sizeof(struct zpci_gaite).

Since aift->gait is already a struct zpci_gaite pointer, this
double-scales the offset, accessing element aisb*16 instead of aisb.

This causes out-of-bounds accesses when aisb >= 32 (with
ZPCI_NR_DEVICES=512)

Fix by removing the erroneous sizeof multiplication.

Fixes: 3c5a1b6f0a ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding")
Fixes: 73f91b0043 ("KVM: s390: pci: enable host forwarding of Adapter Event Notifications")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
2026-04-17 13:12:07 +02:00
Yuho Choi
7e555fcae4
regmap: ram: fix memory leaks in __regmap_init_ram() on error
Two allocations in __regmap_init_ram() are not cleaned up on failure.

If the kzalloc_objs() for data->written fails, data->read is returned
with no way for the caller to free it.

If __regmap_init() fails, neither data->read nor data->written is freed
because its error paths do not call bus->free_context() (which is
regmap_ram_free_context() here). Only regmap_exit() does, and that is
never reached on an init failure.

Free the allocated arrays before returning any error.

Fixes: f6352424e3 ("regmap: Add RAM backed register map")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Link: https://patch.msgid.link/20260416235630.78408-1-dbgh9129@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-17 12:07:31 +01:00
Helge Deller
da3680f564 parisc: _llseek syscall is only available for 32-bit userspace
Cc: stable@vger.kernel.org
Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-17 11:32:46 +02:00
Helge Deller
3dd31a370c parisc: Drop ip_fast_csum() inline assembly implementation
The assembly code of ip_fast_csum() triggers unaligned access warnings
if the IP header isn't correctly aligned:

 Kernel: unaligned access to 0x173d22e76 in inet_gro_receive+0xbc/0x2e8 (iir 0x0e8810b6)
 Kernel: unaligned access to 0x173d22e7e in inet_gro_receive+0xc4/0x2e8 (iir 0x0e88109a)
 Kernel: unaligned access to 0x173d22e82 in inet_gro_receive+0xc8/0x2e8 (iir 0x0e90109d)
 Kernel: unaligned access to 0x173d22e7a in inet_gro_receive+0xd0/0x2e8 (iir 0x0e9810b8)
 Kernel: unaligned access to 0x173d22e86 in inet_gro_receive+0xdc/0x2e8 (iir 0x0e8810b8)

We have the option to a) ignore the warnings, b) work around it by
adding more code to check for alignment, or c) to switch to the generic
implementation and rely on the compiler to optimize the code.

Let's go with c), because a) isn't nice, and b) would effectively lead
to an implementation which is basically equal to c).

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org # v7.0+
2026-04-17 11:32:46 +02:00
Kexin Sun
0b6c8e2115 parisc: update outdated comments for renamed ccio_alloc_consistent()
The function ccio_alloc_consistent() was renamed to ccio_alloc() by commit
79387179e2 ("parisc: convert to dma_map_ops").  Update the three stale
references in ccio-dma.c.

Also replace the obsolete PCI_DMA_TODEVICE constant name with DMA_TO_DEVICE in
a nearby comment to match the code.

Assisted-by: unnamed:deepseek-v3.2 coccinelle
Signed-off-by: Kexin Sun <kexinsun@smail.nju.edu.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-17 11:32:46 +02:00
Marco Elver
082a6d03a2 slub: fix data loss and overflow in krealloc()
Commit 2cd8231796 ("mm/slub: allow to set node and align in
k[v]realloc") introduced the ability to force a reallocation if the
original object does not satisfy new alignment or NUMA node, even when
the object is being shrunk.

This introduced two bugs in the reallocation fallback path:

1. Data loss during NUMA migration: The jump to 'alloc_new' happens
   before 'ks' and 'orig_size' are initialized. As a result, the
   memcpy() in the 'alloc_new' block would copy 0 bytes into the new
   allocation.

2. Buffer overflow during shrinking: When shrinking an object while
   forcing a new alignment, 'new_size' is smaller than the old size.
   However, the memcpy() used the old size ('orig_size ?: ks'), leading
   to an out-of-bounds write.

The same overflow bug exists in the kvrealloc() fallback path, where the
old bucket size ksize(p) is copied into the new buffer without being
bounded by the new size.

A simple reproducer:

	// e.g. add to lkdtm as KREALLOC_SHRINK_OVERFLOW
	while (1) {
		void *p = kmalloc(128, GFP_KERNEL);
		p = krealloc_node_align(p, 64, 256, GFP_KERNEL, NUMA_NO_NODE);
		kfree(p);
	}

demonstrates the issue:

  ==================================================================
  BUG: KFENCE: out-of-bounds write in memcpy_orig+0x68/0x130

  Out-of-bounds write at 0xffff8883ad757038 (120B right of kfence-#47):
   memcpy_orig+0x68/0x130
   krealloc_node_align_noprof+0x1c8/0x340
   lkdtm_KREALLOC_SHRINK_OVERFLOW+0x8c/0xc0 [lkdtm]
   lkdtm_do_action+0x3a/0x60 [lkdtm]
   ...

  kfence-#47: 0xffff8883ad756fc0-0xffff8883ad756fff, size=64, cache=kmalloc-64

  allocated by task 316 on cpu 7 at 97.680481s (0.021813s ago):
   krealloc_node_align_noprof+0x19c/0x340
   lkdtm_KREALLOC_SHRINK_OVERFLOW+0x8c/0xc0 [lkdtm]
   lkdtm_do_action+0x3a/0x60 [lkdtm]
   ...
  ==================================================================

Fix it by moving the old size calculation to the top of __do_krealloc()
and bounding all copy lengths by the new allocation size.

Fixes: 2cd8231796 ("mm/slub: allow to set node and align in k[v]realloc")
Cc: stable@vger.kernel.org
Reported-by: https://sashiko.dev/#/patchset/20260415143735.2974230-1-elver%40google.com
Signed-off-by: Marco Elver <elver@google.com>
Link: https://patch.msgid.link/20260416132837.3787694-1-elver@google.com
Reviewed-by: Harry Yoo (Oracle) <harry@kernel.org>
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
2026-04-17 11:07:48 +02:00
Ralf Lici
6c9b1dc218 selftests: ovpn: serialize YNL listener startup
Starting one background YNL notification listener per peer back-to-back
can intermittently stall the test setup before the listeners even reach
the Python main function.

This was reproducible in a reduced test.sh setup-only loop: a single
listener stayed stable across repeated runs, while starting listeners
for all peers could hang early in the listener launch phase. Adding a
short delay between listener launches makes the listeners start cleanly
and eliminates the reproduced hangs in repeated normal and slow-runner
tests.

Serialize listener startup with a small sleep between setup_listener
calls.

Fixes: 77de28cd7c ("selftests: ovpn: add notification parsing and matching")
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-04-17 10:54:04 +02:00
Ralf Lici
1be93bb979 selftests: ovpn: align command flow with TAP
Current tests do not properly adhere to the TAP infrastructure
therefore they do not properly report failures leading to hangs of
the CI machinery.

Restructure ovpn selftests into using the TAP infrastructure: split each
test in stages, execute stage bodies with fail-fast semantics, and emit
KTAP pass/fail for each stage.

Centralize behavior control in common.sh and makes the scripts use
dedicated wrappers for required-success, expected-failure, and non-fatal
commands. Also add the OVPN_VERBOSE mode that exposes captured command
output for debugging.
This way tests won't hang anymore in case of failure when executed
within the CI machinery.

This change also makes default OVPN_CLI and YNL resolution
independent from the caller CWD by anchoring both to COMMON_DIR, so
behavior is stable across direct execution and run_tests-style
execution.

Fixes: 959bc330a4 ("testing/selftests: add test tool and scripts for ovpn module")
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-04-17 10:54:03 +02:00
Ralf Lici
7c29665a3a selftests: ovpn: add prefix to helpers and shared variables
Current naming for shared variables, helpers and netnamespaces is
a bit unfortunate as it doesn't come with a clean prefix.
This showed to be problematic in case of name clashes with external
scripts or in case of abrupt test termination (hanging netns' weren't
easily reconducible to ovpn).

Rename common helper entry points and all shared globals in the ovpn
selftests to ovpn_ or OVPN_ names so test scripts and wrappers use a
single explicit prefix. Also rename the temporary network namespaces
created by the tests from peerN to ovpn_peerN. This makes leaked
namespaces easier to identify.

This is a mechanical refactor only, behavior is unchanged.

Fixes: 959bc330a4 ("testing/selftests: add test tool and scripts for ovpn module")
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-04-17 10:54:03 +02:00
Ralf Lici
222e7f8d1c selftests: ovpn: flatten slurped notification JSON before filtering
Notification comparison uses jq -s, which slurps all inputs into an
array. Some inputs can be arrays themselves, and applying the .msg.peer
filter directly on those entries triggers jq type errors.

Expand any array-valued JSON items returned by jq -s before selecting
.msg.peer, so the filter handles both normal notification objects and []
entries without type errors.

Fixes: 77de28cd7c ("selftests: ovpn: add notification parsing and matching")
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-04-17 10:54:03 +02:00
Ralf Lici
c409da0fe1 selftests: ovpn: fail notification check on mismatch
compare_ntfs doesn't fail when expected and received notification
streams diverge.

Fix this bug by tracking the diff exit status explicitly and return it
to the caller so notification mismatches propagate as test failures.

Fixes: 77de28cd7c ("selftests: ovpn: add notification parsing and matching")
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-04-17 10:54:03 +02:00
Ralf Lici
e5fd34ab8d selftests: ovpn: add nftables config dependencies for test-mark
test-mark.sh installs nftables rules in an inet/filter output chain and
verifies packet drops via nft counters. In vmksft this can fail when the
nftables core is not enabled by the ovpn selftest config.

Add the missing kernel options required by this test:
- CONFIG_NETFILTER
- CONFIG_NF_TABLES
- CONFIG_NF_TABLES_INET

Fixes: 7b80d8a335 ("selftests: ovpn: add test for the FW mark feature")
Reported-by: Jakub Kicinski <kuba@kernel.org>
Closes: https://lore.kernel.org/all/20260319124114.42f91f72@kernel.org/
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-04-17 10:54:03 +02:00
Giovanni Cabiddu
d7e20b9bd6 crypto: acomp - fix wrong pointer stored by acomp_save_req()
acomp_save_req() stores &req->chain in req->base.data. When
acomp_reqchain_done() is invoked on asynchronous completion, it receives
&req->chain as the data argument but casts it directly to struct
acomp_req. Since data points to the chain member, all subsequent field
accesses are at a wrong offset, resulting in memory corruption.

The issue occurs when an asynchronous hardware implementation, such as
the QAT driver, completes a request that uses the DMA virtual address
interface (e.g. acomp_request_set_src_dma()). This combination causes
crypto_acomp_compress() to enter the acomp_do_req_chain() path, which
sets acomp_reqchain_done() as the completion callback via
acomp_save_req().

With KASAN enabled, this manifests as a general protection fault in
acomp_reqchain_done():

  general protection fault, probably for non-canonical address 0xe000040000000000
  KASAN: probably user-memory-access in range [0x0000400000000000-0x0000400000000007]
  RIP: 0010:acomp_reqchain_done+0x15b/0x4e0
  Call Trace:
   <IRQ>
   qat_comp_alg_callback+0x5d/0xa0 [intel_qat]
   adf_ring_response_handler+0x376/0x8b0 [intel_qat]
   adf_response_handler+0x60/0x170 [intel_qat]
   tasklet_action_common+0x223/0x820
   handle_softirqs+0x1ab/0x640
   </IRQ>

Fix this by storing the request itself in req->base.data instead of
&req->chain, so that acomp_reqchain_done() receives the correct pointer.
Simplify acomp_restore_req() accordingly to access req->chain directly.

Fixes: 64929fe8c0 ("crypto: acomp - Remove request chaining")
Cc: stable@vger.kernel.org
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-04-17 16:50:21 +08:00
Yilin Zhu
bc0fcb9823 ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
xfrm6_rcv_encap() performs an IPv6 route lookup when the skb does not
already have a dst attached. ip6_route_input_lookup() returns a
referenced dst entry even when the lookup resolves to an error route.

If dst->error is set, xfrm6_rcv_encap() drops the skb without attaching
the dst to the skb and without releasing the reference returned by the
lookup. Repeated packets hitting this path therefore leak dst entries.

Release the dst before jumping to the drop path.

Fixes: 0146dca70b ("xfrm: add support for UDPv6 encapsulation of ESP")
Cc: stable@kernel.org
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Co-developed-by: Yuan Tan <yuantan098@gmail.com>
Signed-off-by: Yuan Tan <yuantan098@gmail.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Tested-by: Ruide Cao <caoruide123@gmail.com>
Signed-off-by: Yilin Zhu <zylzyl2333@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2026-04-17 10:40:29 +02:00
Guangshuo Li
4ff036f952 ALSA: pcmtest: fix reference leak on failed device registration
When platform_device_register() fails in mod_init(), the embedded struct
device in pcmtst_pdev has already been initialized by
device_initialize(), but the failure path returns the error without
dropping the device reference for the current platform device:

  mod_init()
    -> platform_device_register(&pcmtst_pdev)
       -> device_initialize(&pcmtst_pdev.dev)
       -> setup_pdev_dma_masks(&pcmtst_pdev)
       -> platform_device_add(&pcmtst_pdev)

This leads to a reference leak when platform_device_register() fails.
Fix this by calling platform_device_put() before returning the error.

The issue was identified by a static analysis tool I developed and
confirmed by manual review.

Fixes: 315a3d57c6 ("ALSA: Implement the new Virtual PCM Test Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260415193138.3861297-1-lgs201920130244@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-17 09:54:34 +02:00
Cássio Gabriel
dc88eef8f5 ALSA: 6fire: Fix input volume change detection
usb6fire_control_input_vol_put() stores the analog capture volume
as a signed offset in rt->input_vol[] (-15..+15), but it compares
the cached value against the user-visible mixer value (0..30)
before subtracting 15.

This mixes two domains in the change detection path. Since the
runtime is zero-initialized, the visible default is 15; writing 0
right after probe is ignored, while writing 15 is reported as a
change even though the cached value remains 0.

Normalize the user value before comparing it with the cached offset.

Fixes: 06bb4e7435 ("ALSA: snd-usb-6fire: add analog input volume control")
Cc: stable@vger.kernel.org
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260416-alsa-6fire-input-volume-change-detection-v1-1-ec78299168df@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-17 09:51:26 +02:00
Johnathan Penberthy
17bc5dd492 ALSA: usb-audio: Add quirk entries for NexiGo N930W webcam
The NexiGo N930W 60fps webcam (USB ID 3443:930d) hits the same
'cannot get freq at ep 0x84' error in snd-usb-audio as its sibling
N930AF (1bcf:2283). Without QUIRK_FLAG_GET_SAMPLE_RATE the ADC clock
is never configured and the microphone streams only zero samples.

Testing on Linux 6.17 with QUIRK_FLAG_GET_SAMPLE_RATE |
QUIRK_FLAG_MIC_RES_16 (via quirk_alias=3443930d:1bcf2283) confirmed
the microphone captures real audio after a cold USB re-enumeration.
Adding a native quirk_flags_table entry avoids the alias workaround.

Signed-off-by: Johnathan Penberthy <johnathan.penberthy@gmail.com>
Link: https://patch.msgid.link/20260417010123.3080904-1-johnathan.penberthy@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-17 09:49:48 +02:00
Randy Dunlap
2866156e77 ALSA: vx: use correct function name in kernel-doc comment
Use the correct function name to avoid a kernel-doc warning (when
W=1 is used):

vx_cmd.h:210: warning: expecting prototype for vx_send_pipe_cmd_params().
 Prototype was for vx_set_pipe_cmd_params() instead

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260216060010.2784438-1-rdunlap@infradead.org
2026-04-17 09:48:20 +02:00
Randy Dunlap
4f01559b5e ALSA: virtio: drop an extaneous kernel-doc comment
Drop a kernel-doc struct comment since the struct member was removed.
This eliminates a kernel-doc warning when make W=1 is used.

virtio_pcm.h:65: warning: Excess struct member 'msg_last_enqueued'
 description in 'virtio_pcm_substream'

Fixes: fe981e6756 ("ALSA: virtio: use ack callback")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260216055956.2784399-1-rdunlap@infradead.org
2026-04-17 09:47:54 +02:00
Juan Pablo Fuentealba Bizama
d1aa2b9aad ALSA: usb-audio: Add quirk for SmartlinkTechnology M01
Add quirk entry for SmartlinkTechnology M01 USB microphone to enable
the standard mixer interface.

Signed-off-by: Juan Pablo Fuentealba Bizama <jpfuentealbabizama@gmail.com>
Link: https://patch.msgid.link/20260416191149.12088-1-jpfuentealbabizama@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-17 09:46:39 +02:00
Dave Airlie
a7756371e5 Short summary of fixes pull:
dma-buf:
 - fix documentation formatting
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEchf7rIzpz2NEoWjlaA3BHVMLeiMFAmnhz4obFIAAAAAABAAO
 bWFudTIsMi41KzEuMTIsMiwyAAoJEGgNwR1TC3oj6w8H/ift5l8QuCR66usSkCab
 bs50LC4CFqEdUCjyRtPHo6pnNstDXIWC57fiZ0UF8USI9BLcupSMfbeoYKerRICU
 Zxb0cNBSEi8cxMQZ4QjpkXP9ICSnVM4n1qBkZiJeaS293QbpRb6Hj9ARsZHTMlot
 Cvwt93PGFTS0RGEokzzUzTIGKekDOzVOdUJrg84X7mSBv+zdVDH4K//Z2asEI9h+
 Hb9CwLj7yNqj/k1+rXDtPEQwplfVLgSaoJBvuunkj4Rk2F0ih6RHKKGXhLFB1Xrx
 jOMkYpXMR5fMvcLmY2OzfusDDlCkoi0UV7+6DFPDDhrjtGVCRGXupo++84yY4eCH
 VoQ=
 =uRB9
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-next-fixes-2026-04-17' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

Short summary of fixes pull:

dma-buf:
- fix documentation formatting

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20260417061430.GA11880@linux.fritz.box
2026-04-17 16:29:24 +10:00
Linus Torvalds
43cfbdda5a iommufd v7.1 merge window pull request
Several fixes:
 
 - Add missing static const
 
 - Correct type 1 emulation for VFIO_CHECK_EXTENSION when no-iommu is
   turned on
 
 - Fix selftest memory leak and syzkaller splat
 
 - Fix missed -EFAULT in fault reporting write() fops
 
 - Fix a race where map/unmap with the internal IOVA allocator can unmap
   things it should not
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRRRCHOFoQz/8F5bUaFwuHvBreFYQUCaeECkwAKCRCFwuHvBreF
 YT5LAQD2DWHgrrgiv3z0X3J+ymvMPIw32hI2J7rAbrR+olAvigEA5adGbQAUI6cC
 msu5z8gv6bK1bzcqPbkL8hPlNU0naQQ=
 =fe0o
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd

Pull iommufd updates from Jason Gunthorpe:
 "Several fixes:

   - Add missing static const

   - Correct type 1 emulation for VFIO_CHECK_EXTENSION when no-iommu is
     turned on

   - Fix selftest memory leak and syzkaller splat

   - Fix missed -EFAULT in fault reporting write() fops

   - Fix a race where map/unmap with the internal IOVA allocator can
     unmap things it should not"

* tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:
  iommufd: Fix a race with concurrent allocation and unmap
  iommufd/selftest: Remove MOCK_IOMMUPT_AMDV1 format
  iommufd: Fix return value of iommufd_fault_fops_write()
  iommufd: update outdated comment for renamed iommufd_hw_pagetable_alloc()
  iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy}
  iommufd: vfio compatibility extension check for noiommu mode
  iommufd: Constify struct dma_buf_attach_ops
2026-04-16 21:21:55 -07:00
Paulo Alcantara
c4d3fc5844 smb: client: fix dir separator in SMB1 UNIX mounts
When calling cifs_mount_get_tcon() with SMB1 UNIX mounts,
@cifs_sb->mnt_cifs_flags needs to be read or updated only after
calling reset_cifs_unix_caps(), otherwise it might end up with missing
CIFS_MOUNT_POSIXACL and CIFS_MOUNT_POSIX_PATHS bits.

This fixes the wrong dir separator used in paths caused by the missing
CIFS_MOUNT_POSIX_PATHS bit in cifs_sb_info::mnt_cifs_flags.

Reported-by: "Kris Karas (Bug Reporting)" <bugs-a21@moonlit-rail.com>
Closes: https://lore.kernel.org/r/f758f4ff-4d54-4244-931d-38f469c3ff14@moonlit-rail.com
Fixes: 4fc3a433c1 ("smb: client: use atomic_t for mnt_cifs_flags")
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Cc: David Howells <dhowells@redhat.com>
Cc: linux-cifs@vger.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
2026-04-16 23:21:00 -05:00
Linus Torvalds
87fe97a184 fwctl 7.1 merge window pull request
- New fwctl driver for Broadcom RDMA NICs
 
 - Bug fix for non-modular builds
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRRRCHOFoQz/8F5bUaFwuHvBreFYQUCaeDp6gAKCRCFwuHvBreF
 YXiBAQCUW1N0n7iTqlkbdbCs3GsI0d78x2dDN7aEc7SKDr/+CgEA69TVKDTLkIJa
 CAzwZLkAKjRDUH7PXh65i8svJnwvzAk=
 =MoNI
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-fwctl' of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl

Pull fwctl updates from Jason Gunthorpe:

 - New fwctl driver for Broadcom RDMA NICs

 - Bug fix for non-modular builds

* tag 'for-linus-fwctl' of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl:
  fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal
  fwctl/bnxt_fwctl: Add documentation entries
  fwctl/bnxt_fwctl: Add bnxt fwctl device
  fwctl/bnxt_en: Create an aux device for fwctl
  fwctl/bnxt_en: Refactor aux bus functions to be more generic
  fwctl/bnxt_en: Move common definitions to include/linux/bnxt/
2026-04-16 21:15:56 -07:00
Linus Torvalds
8242c709d4 soc: ARM code changes for 7.1
These are again very minimal updates:
 
  - A workaround for firmware on Google Nexus 10
  - A fix for early debugging on OMAP1
  - A rework for Microchip SoC configuration
  - Cleanups on OMAP2 an R-Car-Gen2
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnhCkAACgkQmmx57+YA
 GNlmlxAAgvOCI5Knxv0K0IyUTCknVY1kE6a/JasD6ib+4gVhSa1XDVSAzEWkkS5v
 8UoZtXQ/fvxx3PakgVuIe7BKRk1y9N2Msj3n2dlGBKCsvIXxNaZayyODWVnkJUmR
 anmyy4Y7jPtCi1uSOj9heA9VzMBu54sEJH0Ay7p6nykBPyD08Oo2hljbZyIjABTG
 FuAPksB345a2go5eb0MoAKQGHtrNjzXD1LXkcKammSxqEgcEocQa3DqLCCRNqLJu
 cfA8OmoOgtDoK9jbTh3sOmstM2LWCPBlBAnu56c1m5oEQr5IjrcCqKskMtyl47R9
 kNzIWISgBkj5pfl/zTIy/qD3msd8OssIe2ZAUSChZ5ceSi8aC4B+ISC+E8g8nm1j
 6wTAkeDK0iQVndPgoKwPSjyngsK+yAT6SMzZDGY9dODe9I35Mq1F5m32FuU3C3m/
 r/BLl7ixcUPo3mVK1eZCoNdHhmrINhJfed4Kj+phidBNGXWd82E1nJjZ98mo9V2s
 YbUerxScb9P1TMnUdPu69AeLTBH6dlgmKpQNa04KxhZwjx+JhSx+7/v6KohdRZIS
 Y+gfPKYYkwqtgItcQ6/otk6OWWsRx+msr+sJky3giIhkyqOLmBdxvhezuOs0Mmle
 9AOn3UrXubNteGR48AfYi+bOIb8FPQLoHOAgVIL0fbhqF2mzSNw=
 =nOGB
 -----END PGP SIGNATURE-----

Merge tag 'soc-arm-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull SoC ARM code updates from Arnd Bergmann:
 "These are again very minimal updates:

   - A workaround for firmware on Google Nexus 10

   - A fix for early debugging on OMAP1

   - A rework for Microchip SoC configuration

   - Cleanups on OMAP2 an R-Car-Gen2"

* tag 'soc-arm-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
  ARM: omap2: dead code cleanup in kconfig for ARCH_OMAP4
  ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX
  arm64: Kconfig: provide a top-level switch for Microchip platforms
  ARM: shmobile: rcar-gen2: Use of_phandle_args_equal() helper
  ARM: omap: fix all kernel-doc warnings
  ARM: omap2: Replace scnprintf with strscpy in omap3_cpuinfo
  ARM: samsung: exynos5250: Allow CPU1 to boot
2026-04-16 20:45:14 -07:00
Linus Torvalds
231d703058 soc: defconfig updates for 7.1
As usual, we enable a number of additional device drivers as loadable
 modules, to support the added platforms. The largest change this time
 is for OMAP2/3, which were not that well supported in the generic arm32
 defconfig.
 
 The Tegra SoC platforms are now enabled by default in Kconfig when
 ARCH_TEGRA is enabled, which means the defconfig change is done at
 the same time as the Kconfig change here.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnhC1IACgkQmmx57+YA
 GNlH1BAAtiJ53U6+xf83+Eou3trytyXIs3qTw+wQ0mRfXxczeVMV76lRpLcK78iI
 8gZg0zMb71kEI4kScOqraewtVGap2ktkz40Nw146q+K+ctj0Qklb54oA+ZS/NVra
 nE0Cc3PCJkbWTUHQoYpLwiGefFJrahOm7q14JHedmS07Z7BUwzZRaefOp8Jdjafu
 sEo1gX4lW8f8Yh2HXxf2QuRTcihzGR/kqzYzzl44M4dC5QFRD0ddcUVYgKsfYLkA
 mp8+mdTcIeNTyOpf9BT0OSXDnt7242lzM+vg59rsp5BY9fxiO1kA1K6gsKb4OCX/
 v0R46ZsPdE1NV8BvnZ7eEUUKOhtjzu0hITtVgNg5DsLnRzhuEe/8FEUx1mB2jY56
 IwvjchSkUoRX2MPFjSneLSe+u+wZFXaeLNnmkVsIe9CYUThsydZyL8g+l5/xPaTC
 MMcrI8CehNehZ+ZW5fSt49zXzp80PivdG39xmoKc/UmGIGtPyl7Ual1OEVf+OoxR
 H8UguX368MK4h5e1KjNZynT/z3obxuOc9e1sqddWx2khDYp0XcGeRcc0nyMREruQ
 5Nvyx3KaqRGQBrPUyWBOB9G7ItgIv18aZ+eTtzI5xcgZxvzEmhbwrVecsMjh9B9f
 3g3eWOBcV5GbJ1RpN+z5wRXhmQuAXOWWWSCoAUhpm3QpdpNWxo4=
 =OCxO
 -----END PGP SIGNATURE-----

Merge tag 'soc-defconfig-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull SoC defconfig updates from Arnd Bergmann:
 "As usual, we enable a number of additional device drivers as loadable
  modules, to support the added platforms. The largest change this time
  is for OMAP2/3, which were not that well supported in the generic
  arm32 defconfig.

  The Tegra SoC platforms are now enabled by default in Kconfig when
  ARCH_TEGRA is enabled, which means the defconfig change is done at the
  same time as the Kconfig change here"

* tag 'soc-defconfig-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (25 commits)
  arch/arm: Drop CONFIG_FIRMWARE_EDID from defconfig files
  arm64: defconfig: Enable DP83TG720 PHY driver
  arm64: tegra: defconfig: Drop redundant ARCH_TEGRA_foo_SOC
  ARM: tegra: defconfig: Drop redundant ARCH_TEGRA_foo_SOC
  arm64: defconfig: enable pci-pwrctrl-generic as module
  arm64: defconfig: Enable Lontium LT8713sx driver
  arm64: defconfig: Enable Qualcomm Eliza SoC display clock controller
  arm64: defconfig: enable IPQ5210 RDP504 base configs
  arm64: defconfig: Enable Milos LPASS LPI pinctrl driver
  arm64: defconfig: Enable Kaanapali clock controllers
  arm64: defconfig: Enable configs for Arduino VENTUNO Q
  arm64: defconfig: Enable Qualcomm Eliza basic resource providers
  arm64: defconfig: Enable S5KJN1 camera sensor
  arm64: defconfig: Enable configurations for Toradex Aquila AM69
  arm64: defconfig: remove SENSORS_SA67MCU
  arm64: defconfig: Enable Qualcomm WCD937x headphone codec as module
  arm64: defconfig: Enable QCOMTEE module for QTEE-enabled Qualcomm SoCs
  ARM: shmobile: defconfig: Refresh for v7.0-rc1
  arm: multi_v7_defconfig: Enable more OMAP 3/4 related configs
  ARM: multi_v7_defconfig: omap2plus_defconfig: Enable ITE IT66121 driver
  ...
2026-04-16 20:40:20 -07:00
Linus Torvalds
31b43c079f soc: drivers for 7.1
The driver updates again are all over the place with many minor fixes
 going into platform specific code. The most notable changes are:
 
  - Support for Microchip pic64gx system controllers
  - Work on cleaning up devicetree bindings for SoC drivers, and
    converting them into the new format
  - Lots of smaller changes for Qualcomm SoC drivers, including support
    for a number of newly supported chips
  - reset controller API cleanups and a new driver for Cix Sky1
  - Reworks of the Tegra PMC and CBB drivers, along with a change
    to how individual Tegra SoCs get selected in Kconfig and
    BPMP firmware driver updates including a refresh of the ABI
    header to match the version used by firmware
  - STM32 updates to the firewall bus driver and support for
    the debug bus through OP-TEE
  - SCMI firmware driver improvements for reliability, in particular
    for dealing with broken firmware interrupts
  - Memory driver updates for Tegra, and a patch to remove the
    unused Baikal T1 driver
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnhCSYACgkQmmx57+YA
 GNl2ow/+Pti7qbBE34WNyIuWOgZEzjo1OeLe/Y4LqkQmHcM9FJV3/rCadA/FkmD9
 nH85WiRuUjIjzUiAl24SP2nkEcIU/yv8ECvROX46uAjhTByVHkaCedwl3ECW9RPA
 IAYiTJPrQBNCmWZuGO4bZ3go6hHn4q4RSd2V8vrCw/J3b+wBSAPTPzsaWnWg4MiL
 QYz7sBTwcNJaJuwJ7ZnHN/VgEOs9OgY6ejGJImiaVzBbsH7rNp7Cbs6t88X5rCXS
 mbgMvVlYKbsOWj3kNyv98YFAGgzo59uEL+m+846U32w9o0nIgkmIS60RQ5k73JV4
 QlhV1uT7PPtu7y7VbxfJ8KISxaRoex/+AZShmAWCul4YK75hEWT3mWGhM8cqeMUQ
 U0ogpbekRjKdn2Bgfl6kHf38smusjJ1fOBr8QIZcdDJpEtxYtRmNpLUNNSc5vO+T
 HvA79C8I8ydWGyqr1wRP1gDRBNc1BDYKxJO4ohvjnAPIeC01zArXCOyf0F3VtPzH
 XSycnyW7eRUVi+4C3/cF8qzhW2y7Wx03ui5mCDIEcOzyVoGNqTrPNsbCvkNkyrdc
 jqvWagZ4Ci8jaRxLAawnqHI/stvsHx9V+NPp6p07BsOxJMsuOqO4sInRhh5P6YvM
 5wZCFUK37xPEqYvr+BFS9B/4jgw3Mg2Kj+gjxShwsLS5JtVDfZw=
 =UB4F
 -----END PGP SIGNATURE-----

Merge tag 'soc-drivers-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull SoC driver updates from Arnd Bergmann:
 "The driver updates again are all over the place with many minor fixes
  going into platform specific code. The most notable changes are:

   - Support for Microchip pic64gx system controllers
   - Work on cleaning up devicetree bindings for SoC drivers, and
     converting them into the new format
   - Lots of smaller changes for Qualcomm SoC drivers, including support
     for a number of newly supported chips
   - reset controller API cleanups and a new driver for Cix Sky1
   - Reworks of the Tegra PMC and CBB drivers, along with a change to
     how individual Tegra SoCs get selected in Kconfig and BPMP firmware
     driver updates including a refresh of the ABI header to match the
     version used by firmware
   - STM32 updates to the firewall bus driver and support for the debug
     bus through OP-TEE
   - SCMI firmware driver improvements for reliability, in particular
     for dealing with broken firmware interrupts
   - Memory driver updates for Tegra, and a patch to remove the unused
     Baikal T1 driver"

* tag 'soc-drivers-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (193 commits)
  firmware: arm_ffa: Use the correct buffer size during RXTX_MAP
  firmware: qcom: scm: Allow QSEECOM on Lenovo IdeaCentre Mini X
  clk: spear: fix resource leak in clk_register_vco_pll()
  reset: rzv2h-usb2phy: Add support for VBUS mux controller registration
  reset: rzv2h-usb2phy: Convert to regmap API
  dt-bindings: reset: renesas,rzv2h-usb2phy: Document RZ/G3E USB2PHY reset
  dt-bindings: reset: renesas,rzv2h-usb2phy: Add '#mux-state-cells' property
  soc: microchip: add mpfs gpio interrupt mux driver
  dt-bindings: soc: microchip: document PolarFire SoC's gpio interrupt mux
  gpio: mpfs: Add interrupt support
  soc: qcom: ubwc: add helpers to get programmable values
  soc: qcom: ubwc: add helper to get min_acc length
  firmware: qcom: scm: Register gunyah watchdog device
  soc: qcom: socinfo: Add SoC ID for SA8650P
  dt-bindings: arm: qcom,ids: Add SoC ID for SA8650P
  firmware: qcom: scm: Allow QSEECOM on Mahua CRD
  soc: qcom: wcnss: simplify allocation of req
  soc: qcom: pd-mapper: Add support for Eliza
  soc: qcom: aoss: compare against normalized cooling state
  soc: qcom: llcc: fix v1 SB syndrome register offset
  ...
2026-04-16 20:34:34 -07:00
Linus Torvalds
e65f4718a5 soc: dt changes for 7.1
A number of SoC platforms are adding modernized variants of their
 already supported chips time, with a total of 12 new SoCs,
 and two older SoC getting removed:
 
  - Qualcomm Glymur is a compute SoC using 18 Oryon-2 CPU cores
  - Qualcomm Mahua is a variant of Glymur with only 12 CPU cores, but
    largely identical.
  - Qualcomm Eliza is an embeded platform for mobile phone (SM7750) and IOT
    (QC7790S/M) workloads
  - Qualcomm IPQ5210 is a wireless networking SoC using Cortex-A53 cores
  - Qualcomm apq8084 and ipq806x had only rudimentary support but no
    actual products using them, so they are now gone.
  - Axis ARTPEC-9 is a follow-up to the ARTPEC-8 embedded SoC, using
    the Samsung SoC platform but now with Cortex-A55 cores
  - ARM Zena is a virtual platform in FVP using Cortex-A720AE cores, with
    additional versions planned to be merged in the future.
  - ARM corstone-1000-a320 is a reference platform for IOT, using low-end
    Cortex-A320 cores
  - Microchip LAN9691 is an updated 64-bit variant of the arm32 lan966x
    series of networking SoCs
  - Microchip PIC64GX is an embedded RISC-V chip using SIFIVE U54 CPU cores
  - Rockchip RV1103B is the low-end 32-bit single-core vision processor
  - Renesas RZ/G3L (r9a08g046) is an industrial embedded chip using
    Cortex-A55 cores, similar to the G3E and G3S variants we already
    supported.
  - NXP S32N79 is an automotive SoC using Cortex-A78AE cores, a
    significant upgrade from the older S32V and S32G series
 
 These all come with at least one reference board or an initial product
 using these, in total there are 67 newly added boards. The ones for
 already supported SoCs are:
 
  - Two more Aspeed BMC based boards
  - Three older tablets based on 32-bit OMAP4 and Exynos5 SoCs
  - One Set-top-box based on Allwinner H6
  - 22 additional industrial/embedded boards using 64-bit NXP i.MX8M
    or i.MX9 SoCs
  - 20 Qualcomm SoC based machines across all possible markets:
    workstation, gaming, laptop, phone, networking, reference, ...
  - Three more Rockchips rk35xx based boards
  - Four variants of the Toradex Verdin using TI AM62
 
 Other notable bits are:
 
  - A cleanup for the 32-bit Tegra paz00 board moved the last
    board specific code on Tegra into equivalent dts syntax.
  - There continues to be a significant number of fixes for static
    checking of dtc syntax, but it feels like this is slowing down,
    hopefully getting into a state where most known issues are
    addressed
  - Additional hardware support for many existing boards across SoC
    families, notably Qualcomm, Broadcom, i.MX2, i.MX6, Rockchips,
    STM32, Mediatek, Tegra, TI and Microchip
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnhBREACgkQmmx57+YA
 GNnKqQ//bvEidvJXnGbZQkHzh/6rF8lX7EhbEx4RUgp9R1h5Q9/74a70lAHFq3Lm
 OC/CbcXVRwM3ASsKhTk0Q7ypncXgy5JxEiPVROqGCNW2vP1SMzcwyWM/Zg4QCL+h
 4/ER2gjIwdrS/pcVspCJ5wyvuo9WC4VR3I0CLC84j4f+Myj9vhVV80KOrnsCJFNU
 iVRBwZmoISOJIjT2RcgDaus65e/Ys39aBP7j4GJ9D0ksQiacJR23Ktw4z5lDW/N0
 9VZxowNAKwazaPrdbKdO5Jmebl/WWaO1LGWA43v5LJo3IvDZj28af0Ewsk7FSIOo
 GcdxyWFvN8I5N7cxfPNsXawKVlEiI6lqycoPEqTk87hed3BGR0G57NCD5EShnUAG
 7YjQwN5sA04dQbGPCkBM4QZRK9aq1f44YPWCFdZokaPdmSzt01GaASEcm5tMAZf7
 eDvgPsZmB+lgbJiLh66Rxo94SrLwN6SXnsOpfiouDOSLsYOZ7Xqo2ljuA+j6JndN
 rxKa6qfMwKw0FoNFr2MKde659utUfbt50bCqwdRAwSFFUhO/x38w5DafdB0BFyry
 /lXU/ocpO6YImiS62kbdo9v/v+WUr/SlRL2f8Vq5IsLmYfn5grhHGmJwS57WrrH7
 ZVQdi6PWIUrUyb08WOQZ0XvmCIYN7VUzUQjI3tD1VM1B6ksAsTQ=
 =5Dwm
 -----END PGP SIGNATURE-----

Merge tag 'soc-dt-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull SoC devicetree updates from Arnd Bergmann:
 "A number of SoC platforms are adding modernized variants of their
  already supported chips time, with a total of 12 new SoCs, and two
  older SoC getting removed:

   - Qualcomm Glymur is a compute SoC using 18 Oryon-2 CPU cores
   - Qualcomm Mahua is a variant of Glymur with only 12 CPU cores, but
     largely identical.
   - Qualcomm Eliza is an embeded platform for mobile phone (SM7750) and
     IOT (QC7790S/M) workloads
   - Qualcomm IPQ5210 is a wireless networking SoC using Cortex-A53
     cores
   - Qualcomm apq8084 and ipq806x had only rudimentary support but no
     actual products using them, so they are now gone.
   - Axis ARTPEC-9 is a follow-up to the ARTPEC-8 embedded SoC, using
     the Samsung SoC platform but now with Cortex-A55 cores
   - ARM Zena is a virtual platform in FVP using Cortex-A720AE cores,
     with additional versions planned to be merged in the future.
   - ARM corstone-1000-a320 is a reference platform for IOT, using
     low-end Cortex-A320 cores
   - Microchip LAN9691 is an updated 64-bit variant of the arm32 lan966x
     series of networking SoCs
   - Microchip PIC64GX is an embedded RISC-V chip using SIFIVE U54 CPU
     cores
   - Rockchip RV1103B is the low-end 32-bit single-core vision processor
   - Renesas RZ/G3L (r9a08g046) is an industrial embedded chip using
     Cortex-A55 cores, similar to the G3E and G3S variants we already
     supported.
   - NXP S32N79 is an automotive SoC using Cortex-A78AE cores, a
     significant upgrade from the older S32V and S32G series

  These all come with at least one reference board or an initial product
  using these, in total there are 67 newly added boards. The ones for
  already supported SoCs are:

   - Two more Aspeed BMC based boards
   - Three older tablets based on 32-bit OMAP4 and Exynos5 SoCs
   - One Set-top-box based on Allwinner H6
   - 22 additional industrial/embedded boards using 64-bit NXP i.MX8M or
     i.MX9 SoCs
   - 20 Qualcomm SoC based machines across all possible markets:
     workstation, gaming, laptop, phone, networking, reference, ...
   - Three more Rockchips rk35xx based boards
   - Four variants of the Toradex Verdin using TI AM62

  Other notable bits are:

   - A cleanup for the 32-bit Tegra paz00 board moved the last board
     specific code on Tegra into equivalent dts syntax.
   - There continues to be a significant number of fixes for static
     checking of dtc syntax, but it feels like this is slowing down,
     hopefully getting into a state where most known issues are
     addressed
   - Additional hardware support for many existing boards across SoC
     families, notably Qualcomm, Broadcom, i.MX2, i.MX6, Rockchips,
     STM32, Mediatek, Tegra, TI and Microchip"

* tag 'soc-dt-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (841 commits)
  arm64: dts: ti: k3: Use memory-region-names for r5f
  ARM: dts: imx: Add DT overlays for DH i.MX6 DHCOM SoM and boards
  ARM: dts: imx6sx: remove fallback compatible string fsl,imx28-lcdif
  ARM: dts: imx25: rename node name tcq to touchscreen
  ARM: dts: imx: b850v3: Disable unused usdhc4
  ARM: dts: imx: b850v3: Define GPIO line names
  ARM: dts: imx: b850v3: Use alphabetical sorting
  ARM: dts: imx: bx50v3: Configure phy-mode to eliminate a warning
  ARM: dts: imx: bx50v3: Configure switch PHY max-speed to 100Mbps
  ARM: dts: imx7ulp: Add CPU clock and OPP table support
  ARM: dts: imx7-mba7: Deassert BOOT_EN after boot
  ARM: dts: tqma7: add boot phase properties
  ARM: dts: imx7s: add boot phase properties
  ARM: dts: tqma6ul[l]: correct spelling of TQ-Systems
  ARM: dts: mba6ulx: add boot phase properties
  ARM: dts: imx6ul[l]-tqma6ul[l]: add boot phase properties
  ARM: dts: imx6ul/imx6ull: add boot phase properties
  ARM: dts: imx6qdl-mba6: add boot phase properties
  ARM: dts: imx6qdl-tqma6: add boot phase properties
  ARM: dts: imx6qdl: add boot phase properties
  ...
2026-04-16 20:28:48 -07:00
Linus Torvalds
440d6635b2 mm.git review status for linus..mm-nonmm-stable
Total patches:       126
 Reviews/patch:       0.92
 Reviewed rate:       76%
 
 - The 2 patch series "pid: make sub-init creation retryable" from Oleg
   Nesterov increases the robustness of our creation of init in a new
   namespace.  By clearing away some historical cruft which is no longer
   needed.  Also some documentation fixups are provided.
 
 - The 2 patch series "selftests/fchmodat2: Error handling and general"
   from Mark Brown has a fixup and a cleanup for the fchmodat2() syscall
   selftest.
 
 - The 3 patch series "lib: polynomial: Move to math/ and clean up" from
   Andy Shevchenko does as advertised.
 
 - The 3 patch series "hung_task: Provide runtime reset interface for
   hung task detector" from Aaron Tomlin gives administrators the ability
   to zero out /proc/sys/kernel/hung_task_detect_count.
 
 - The 2 patch series "tools/getdelays: use the static UAPI headers from
   tools/include/uapi" from Thomas Weißschuh teaches getdelays to use the
   in-kernel UAPI headers rather than the system-provided ones.
 
 - The 5 patch series "watchdog/hardlockup: Improvements to hardlockup"
   from Mayank Rungta provides several cleanups and fixups to the
   hardlockup detector code and its documentation.
 
 - The 2 patch series "lib/bch: fix undefined behavior from signed
   left-shifts" from Josh Law provides a couple of small/theoretical fixes
   in the bch code.
 
 - The 2 patch series "ocfs2/dlm: fix two bugs in dlm_match_regions()"
   from Junrui Luo does what is claims.
 
 - The 27 patch series "cleanup the RAID5 XOR library" from Christoph
   Hellwig is a quite far-reaching cleanup to this code.  I can't do better
   than to quote Christoph:
 
     The XOR library used for the RAID5 parity is a bit of a mess right
     now.  The main file sits in crypto/ despite not being cryptography and
     not using the crypto API, with the generic implementations sitting in
     include/asm-generic and the arch implementations sitting in an asm/
     header in theory.  The latter doesn't work for many cases, so
     architectures often build the code directly into the core kernel, or
     create another module for the architecture code.
 
     Change this to a single module in lib/ that also contains the
     architecture optimizations, similar to the library work Eric Biggers
     has done for the CRC and crypto libraries later.  After that it
     changes to better calling conventions that allow for smarter
     architecture implementations (although none is contained here yet),
     and uses static_call to avoid indirection function call overhead.
 
 - The 2 patch series "lib/list_sort: Clean up list_sort() scheduling
   workarounds" from Kuan-Wei Chiu cleans up this library code by removing
   a hacky thing which was added for UBIFS, which UBIFS doesn't actually
   need.
 
 - The 5 patch series "Fix bugs in extract_iter_to_sg()" from Christian
   Ehrhardt fixes a few bugs in the scatterlist code, adds in-kernel tests
   for the now-fixed bugs and fixes a leak in the test itself.
 
 - The 3 patch series "kdump: Enable LUKS-encrypted dump target support
   in ARM64 and PowerPC" from Coiby Xu eenables support of the
   LUKS-encrypted device dump target on arm64 and powerpc.
 
 - The 4 patch series "ocfs2: consolidate extent list validation into
   block read callbacks" from Joseph Qi addresses ocfs2's validation of
   extent list fields - cleanup, simplification, robustness.  (Kernel test
   robot loves mounting corrupted fs images!)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCad90rQAKCRDdBJ7gKXxA
 jl7rAQD4/Rq7ZSSnEv6FS4gOwc3MgTdWcZZaXkqL1KiWyYhRwAEA+cVCO344+AKb
 znBOjet/hUr+/kBwyViifiC8LHzchwM=
 =Nfnf
 -----END PGP SIGNATURE-----

Merge tag 'mm-nonmm-stable-2026-04-15-04-20' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull non-MM updates from Andrew Morton:

 - "pid: make sub-init creation retryable" (Oleg Nesterov)

   Make creation of init in a new namespace more robust by clearing away
   some historical cruft which is no longer needed. Also some
   documentation fixups

 - "selftests/fchmodat2: Error handling and general" (Mark Brown)

   Fix and a cleanup for the fchmodat2() syscall selftest

 - "lib: polynomial: Move to math/ and clean up" (Andy Shevchenko)

 - "hung_task: Provide runtime reset interface for hung task detector"
   (Aaron Tomlin)

   Give administrators the ability to zero out
   /proc/sys/kernel/hung_task_detect_count

 - "tools/getdelays: use the static UAPI headers from
   tools/include/uapi" (Thomas Weißschuh)

   Teach getdelays to use the in-kernel UAPI headers rather than the
   system-provided ones

 - "watchdog/hardlockup: Improvements to hardlockup" (Mayank Rungta)

   Several cleanups and fixups to the hardlockup detector code and its
   documentation

 - "lib/bch: fix undefined behavior from signed left-shifts" (Josh Law)

   A couple of small/theoretical fixes in the bch code

 - "ocfs2/dlm: fix two bugs in dlm_match_regions()" (Junrui Luo)

 - "cleanup the RAID5 XOR library" (Christoph Hellwig)

   A quite far-reaching cleanup to this code. I can't do better than to
   quote Christoph:

     "The XOR library used for the RAID5 parity is a bit of a mess right
      now. The main file sits in crypto/ despite not being cryptography
      and not using the crypto API, with the generic implementations
      sitting in include/asm-generic and the arch implementations
      sitting in an asm/ header in theory. The latter doesn't work for
      many cases, so architectures often build the code directly into
      the core kernel, or create another module for the architecture
      code.

      Change this to a single module in lib/ that also contains the
      architecture optimizations, similar to the library work Eric
      Biggers has done for the CRC and crypto libraries later. After
      that it changes to better calling conventions that allow for
      smarter architecture implementations (although none is contained
      here yet), and uses static_call to avoid indirection function call
      overhead"

 - "lib/list_sort: Clean up list_sort() scheduling workarounds"
   (Kuan-Wei Chiu)

   Clean up this library code by removing a hacky thing which was added
   for UBIFS, which UBIFS doesn't actually need

 - "Fix bugs in extract_iter_to_sg()" (Christian Ehrhardt)

   Fix a few bugs in the scatterlist code, add in-kernel tests for the
   now-fixed bugs and fix a leak in the test itself

 - "kdump: Enable LUKS-encrypted dump target support in ARM64 and
   PowerPC" (Coiby Xu)

   Enable support of the LUKS-encrypted device dump target on arm64 and
   powerpc

 - "ocfs2: consolidate extent list validation into block read callbacks"
   (Joseph Qi)

   Cleanup, simplify, and make more robust ocfs2's validation of extent
   list fields (Kernel test robot loves mounting corrupted fs images!)

* tag 'mm-nonmm-stable-2026-04-15-04-20' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (127 commits)
  ocfs2: validate group add input before caching
  ocfs2: validate bg_bits during freefrag scan
  ocfs2: fix listxattr handling when the buffer is full
  doc: watchdog: fix typos etc
  update Sean's email address
  ocfs2: use get_random_u32() where appropriate
  ocfs2: split transactions in dio completion to avoid credit exhaustion
  ocfs2: remove redundant l_next_free_rec check in __ocfs2_find_path()
  ocfs2: validate extent block list fields during block read
  ocfs2: remove empty extent list check in ocfs2_dx_dir_lookup_rec()
  ocfs2: validate dx_root extent list fields during block read
  ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
  ocfs2: handle invalid dinode in ocfs2_group_extend
  .get_maintainer.ignore: add Askar
  ocfs2: validate bg_list extent bounds in discontig groups
  checkpatch: exclude forward declarations of const structs
  tools/accounting: handle truncated taskstats netlink messages
  taskstats: set version in TGID exit notifications
  ocfs2/heartbeat: fix slot mapping rollback leaks on error paths
  arm64,ppc64le/kdump: pass dm-crypt keys to kdump kernel
  ...
2026-04-16 20:11:56 -07:00
Jakub Kicinski
82c2106902 selftests: net: add missing CMAC to tcp_ao config
Recent changes to crypto and wifi made CMAC no longer
selected by default on x86 and tcp_ao needs it.
Add the missing config.

Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260416010439.1053587-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-16 19:35:43 -07:00
Jakub Kicinski
946e991465 Merge branch 'vsock-virtio-fix-msg_peek-calculation-on-bytes-to-copy'
Luigi Leonardi says:

====================
vsock/virtio: fix MSG_PEEK calculation on bytes to copy

`virtio_transport_stream_do_peek`, when calculating the number of bytes to
copy, didn't consider the `offset`, caused by partial reads that happened
before.
This might cause out-of-bounds read that lead to an EFAULT.
More details in the commits.

Commit 1 introduces the fix
Commit 2 introduces some preliminary work for adding a test and fixes a
problem in existing tests.
Commit 3 introduces a test that checks for this bug to avoid future
regressions.

For disclosure: this bug was found initially by claude opus 4.6, I then analyzed
it and worked on the fix and the test.
====================

Link: https://patch.msgid.link/20260415-fix_peek-v4-0-8207e872759e@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-16 19:34:26 -07:00
Luigi Leonardi
2a2675ef61 vsock/test: add MSG_PEEK after partial recv test
Add a test that verifies MSG_PEEK works correctly after a partial
recv().

This is to test a bug that was present in the
`virtio_transport_stream_do_peek()` when computing the number of bytes to
copy: After a partial read, the peek function didn't take into
consideration the number of bytes that were already read. So peeking the
whole buffer would cause an out-of-bounds read, that resulted in a -EFAULT.

This test does exactly this: do a partial recv on a buffer, then try to
peek the whole buffer content. The test re-uses
`test_stream_msg_peek_client()` to also cover this scenario.

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Luigi Leonardi <leonardi@redhat.com>
Link: https://patch.msgid.link/20260415-fix_peek-v4-3-8207e872759e@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-16 19:34:22 -07:00